@anchrd/intel-api 0.6.7 → 0.9.0

package/dist/adapters/gate-applications/gate-applications.d.ts

@@ -0,0 +1,23 @@
+import type { AgentApplications } from "../../nodes/nodes.types.js";
+/**
+ * Intel's door to Gate's Applications surface (`anchrd/gate#223`/`#224`, Gate 0.10.x).
+ *
+ * ⚠️ This is the one Gate call Intel makes with the CALLER's bearer instead of its service key, and
+ * that is not a shortcut — the service key does not open this door. A Gate service key authorizes
+ * `/api/v1/authorization` and `/api/v1/schema` and nothing else (Gate's two-token rule); the
+ * Applications routes are admin-gated and resolve a real principal, so the person creating an agent
+ * needs `applications:write` in Gate and their act is audited in Gate under their own name. A
+ * service key here would have made Intel the author of every machine principal an installation ever
+ * grew, which is the opposite of what an audit trail is for.
+ *
+ * ⚠️ Nothing this module receives from Gate is logged, wrapped into a message, or returned other
+ * than through the one typed answer below. `create` is handed a plain-text key, and the shortest
+ * path from here to a leak is an error that quotes the response body — so no refusal names anything
+ * but the status Gate answered with.
+ */
+export interface GateApplicationsDeps {
+    fetch: (url: string, init?: RequestInit) => Promise<Response>;
+    gateUrl: string;
+    timeoutMs?: number;
+}
+export declare function createGateApplications(deps: GateApplicationsDeps): AgentApplications;

package/dist/adapters/gate-applications/gate-applications.js

@@ -0,0 +1,88 @@
+import { z } from "zod";
+import { IntelError } from "../../shared/intel-error/intel-error.js";
+// Tolerant on purpose, unlike Intel's own contracts: this is somebody else's wire format, and a
+// field Gate adds tomorrow must not stop an installation from creating an agent. Only what Intel
+// actually reads is named.
+const CreatedApplication = z.object({ id: z.string().min(1), key: z.string().min(1) });
+// The same tolerance, for the same reason. Only the key is read: the ID is the one Intel asked with.
+const RotatedApplication = z.object({ key: z.string().min(1) });
+const DefaultTimeoutMs = 10_000;
+export function createGateApplications(deps) {
+    const base = deps.gateUrl.replace(/\/+$/, "");
+    const timeoutMs = deps.timeoutMs ?? DefaultTimeoutMs;
+    // Gate's refusals, translated once. A 401/403 is the caller's missing `applications:write` and is
+    // permanent until somebody acts in Gate, so it is answered as a refusal rather than as an outage;
+    // everything else — a 5xx, a timeout, a DNS failure — is "Gate did not answer", and the caller is
+    // told that no agent was created rather than left to guess.
+    function refusal(status) {
+        if (status === 401 || status === 403) {
+            return new IntelError(403, "agent_application_forbidden", "Gate refused this account the management of applications — creating an agent needs the applications permission in Gate");
+        }
+        return new IntelError(502, "agent_application_unavailable", `Gate could not manage this agent's application (${status})`);
+    }
+    async function call(path, token, body) {
+        try {
+            return await deps.fetch(`${base}/api/v1/applications${path}`, {
+                method: "POST",
+                headers: {
+                    "content-type": "application/json",
+                    authorization: `Bearer ${token}`,
+                },
+                body: JSON.stringify(body),
+                signal: AbortSignal.timeout(timeoutMs),
+            });
+        }
+        catch {
+            // ⚠️ The caught error is dropped rather than described. A fetch failure carries the URL, and
+            // the URL is the one place the bearer could still be if a caller ever put it in a query.
+            throw new IntelError(502, "agent_application_unavailable", "Gate did not answer, so no agent application was created or changed");
+        }
+    }
+    return {
+        async create(input) {
+            const response = await call("", input.token, { name: input.name });
+            if (!response.ok)
+                throw refusal(response.status);
+            const parsed = CreatedApplication.safeParse(await response.json().catch(() => null));
+            if (!parsed.success) {
+                // ⚠️ A 2xx Intel cannot read means a principal MAY exist in Gate that Intel cannot record.
+                // Nothing has been written on this side yet, so the agent does not come into being; the
+                // operator finds an unused application in Gate's list rather than an agent that half works.
+                throw new IntelError(502, "agent_application_unavailable", "Gate answered the application creation in a shape Intel cannot read");
+            }
+            return { id: parsed.data.id, key: parsed.data.key };
+        },
+        async rotateKey(input) {
+            // Gate issues the replacement FIRST and only then revokes what was there, so a rotation that
+            // fails leaves the old key working rather than locking the agent out (`applications.ts` in
+            // `anchrd/gate`). Intel relies on that: the handover to the runtime happens after this call,
+            // and until it succeeds the agent keeps running on the key it had.
+            const response = await call(`/${encodeURIComponent(input.applicationId)}/rotate-key`, input.token, {});
+            if (response.status === 404) {
+                throw new IntelError(502, "agent_application_missing", "Gate does not know this agent's application any more");
+            }
+            if (!response.ok)
+                throw refusal(response.status);
+            const parsed = RotatedApplication.safeParse(await response.json().catch(() => null));
+            if (!parsed.success) {
+                // ⚠️ A 2xx Intel cannot read means the OLD key is already revoked in Gate and the new one is
+                // lost. The agent is broken either way, so the caller is told the rotation failed and rotates
+                // again — which is safe, because rotating twice is just another new key.
+                throw new IntelError(502, "agent_application_unavailable", "Gate answered the key rotation in a shape Intel cannot read");
+            }
+            return { key: parsed.data.key };
+        },
+        async setEnabled(input) {
+            // Both routes are idempotent in Gate, which is what lets a retried archive heal a run that
+            // failed between the two writes instead of needing a repair path of its own.
+            const response = await call(`/${encodeURIComponent(input.applicationId)}/${input.enabled ? "enable" : "disable"}`, input.token, {});
+            // A 404 is the one status worth separating: the Application behind this agent is gone from
+            // Gate, and telling the operator that is more use than a generic outage they would retry.
+            if (response.status === 404) {
+                throw new IntelError(502, "agent_application_missing", "Gate does not know this agent's application any more");
+            }
+            if (!response.ok)
+                throw refusal(response.status);
+        },
+    };
+}

package/dist/adapters/index-queue/index-queue.d.ts

@@ -1,7 +1,7 @@
 import { z } from "zod";
 import type { QueueProducer } from "./index-queue.types.js";
 export declare const IndexMessage: z.ZodObject<{
-    type: z.ZodLiteral<"knowledge.version">;
+    type: z.ZodLiteral<"node.version">;
     versionId: z.ZodString;
 }, z.core.$strict>;
 export type IndexMessage = z.infer<typeof IndexMessage>;

package/dist/adapters/index-queue/index-queue.js

@@ -1,12 +1,12 @@
 import { z } from "zod";
 export const IndexMessage = z.strictObject({
-    type: z.literal("knowledge.version"),
+    type: z.literal("node.version"),
     versionId: z.string().min(1),
 });
 export function createIndexQueue(queue) {
     return {
         async enqueue(versionId) {
-            await queue.send({ type: "knowledge.version", versionId });
+            await queue.send({ type: "node.version", versionId });
         },
     };
 }

package/dist/adapters/semantic-index/semantic-index.types.d.ts

@@ -1,4 +1,4 @@
-import type { KnowledgeIndexTarget } from "../../knowledge/knowledge.types.js";
+import type { NodeIndexTarget } from "../../nodes/nodes.types.js";
 export interface WorkersAiBinding {
     run(model: string, input: {
         text: string[];
@@ -22,7 +22,7 @@ export interface SemanticHit {
     score: number;
 }
 export interface SemanticIndex {
-    replace(target: KnowledgeIndexTarget, content: string): Promise<void>;
+    replace(target: NodeIndexTarget, content: string): Promise<void>;
     search(query: string, limit: number): Promise<SemanticHit[]>;
 }
 export interface SemanticIndexDeps {

package/dist/adapters/tool-delegation/tool-delegation.d.ts

@@ -0,0 +1,22 @@
+import type { ContentStore } from "../../nodes/nodes.types.js";
+import type { ToolAuditEvent, ToolDelegation } from "../../tools/tools.types.js";
+import type { D1Database } from "../db/db.types.js";
+/**
+ * The two D1 statements the delegated tool path needs (D30): who is acting, and a record that they
+ * did.
+ *
+ * ⚠️ Its own adapter rather than a method on the node repository, and deliberately so. The question
+ * is asked with a **Gate Application id** and no Intel actor at all — there is no ACL to apply,
+ * because the answer is not "may you read this agent" but "which agent are you". Hanging it off the
+ * tree's repository would put an unauthorized read next to authorized ones, which is the shape a
+ * later reader copies by accident.
+ */
+export declare function createToolDelegation(deps: {
+    db: D1Database;
+    content: ContentStore;
+    id(): string;
+    now(): Date;
+}): {
+    resolve(applicationId: string): Promise<ToolDelegation | null>;
+    audit(event: ToolAuditEvent): Promise<void>;
+};

package/dist/adapters/tool-delegation/tool-delegation.js

@@ -0,0 +1,90 @@
+import { AgentDefinition } from "@anchrd/intel-contract";
+import { reportUnexpectedError } from "../../shared/report-unexpected-error/report-unexpected-error.js";
+/**
+ * The two D1 statements the delegated tool path needs (D30): who is acting, and a record that they
+ * did.
+ *
+ * ⚠️ Its own adapter rather than a method on the node repository, and deliberately so. The question
+ * is asked with a **Gate Application id** and no Intel actor at all — there is no ACL to apply,
+ * because the answer is not "may you read this agent" but "which agent are you". Hanging it off the
+ * tree's repository would put an unauthorized read next to authorized ones, which is the shape a
+ * later reader copies by accident.
+ */
+export function createToolDelegation(deps) {
+    return {
+        /**
+         * ⚠️ `null` has exactly ONE meaning here and it is a strong claim: "this caller is not an
+         * agent", after which the tool service treats them as an ordinary person with a portal
+         * connection of their own. Every other outcome — an archived agent, an agent with no definition
+         * version yet, a body R2 lost, a body that will not parse, a definition with no `tools` — is an
+         * agent that delegates NOTHING, and is answered as an empty delegation. That is the difference
+         * between "act as yourself" and "act on nobody's connection", and only one of them is safe to
+         * fall into by accident.
+         *
+         * The joins are therefore LEFT: a row in `agent_applications` is already the whole answer to
+         * "is this an agent", and losing it to a missing version would turn a fresh agent into a user.
+         */
+        async resolve(applicationId) {
+            const row = await deps.db
+                .prepare(`SELECT a.node_id AS node_id, n.archived_at AS archived_at,
+                 v.content_key AS content_key
+          FROM agent_applications a
+          LEFT JOIN nodes n ON n.id = a.node_id
+          LEFT JOIN node_versions v ON v.id = n.current_version_id
+          WHERE a.application_id = ?`)
+                .bind(applicationId)
+                .first();
+            if (!row)
+                return null;
+            const nothing = { agentId: row.node_id, delegatedBy: "", servers: [] };
+            // Archiving an agent switches its Gate Application off, but Gate's own state is not what
+            // Intel is allowed to depend on: an archived agent reaches nothing through Intel from the
+            // moment it is archived, whatever another system still thinks.
+            if (row.archived_at !== null || row.content_key === null)
+                return nothing;
+            const body = await deps.content.get(row.content_key);
+            if (body === null) {
+                reportUnexpectedError(new Error(`agent ${row.node_id} has no readable definition body`));
+                return nothing;
+            }
+            let parsed;
+            try {
+                parsed = JSON.parse(body);
+            }
+            catch {
+                parsed = null;
+            }
+            const definition = AgentDefinition.safeParse(parsed);
+            if (!definition.success) {
+                reportUnexpectedError(new Error(`agent ${row.node_id} has a definition Intel cannot parse`));
+                return nothing;
+            }
+            const tools = definition.data.tools;
+            if (!tools)
+                return nothing;
+            return {
+                agentId: row.node_id,
+                delegatedBy: tools.delegatedBy,
+                servers: tools.servers,
+            };
+        },
+        async audit(event) {
+            // ⚠️ The agent's node is the resource and the Application is the actor, which is the only
+            // pairing that reads correctly later: `actor_id` is what authenticated, `resource_id` is what
+            // a person searches for. The tool and the server are metadata, and the ARGUMENTS are absent —
+            // an append-only table is the last place a payload should be copied to.
+            await deps.db
+                .prepare(`INSERT INTO audit_events (
+          id, actor_id, action, resource_type, resource_id, metadata_json, occurred_at
+        ) VALUES (?, ?, 'tool.execute', 'agent', ?, ?, ?)`)
+                .bind(deps.id(), event.applicationId, event.agentId, JSON.stringify({
+                tool: event.tool,
+                server: event.server,
+                // Both principals, which is the whole point of the row: who acted, and whose portal
+                // connection made it possible (D30).
+                delegatedBy: event.delegatedBy,
+            }), deps.now().toISOString())
+                .run();
+        },
+    };
+}

package/dist/agent-runtime/agent-runtime.d.ts

@@ -0,0 +1,16 @@
+import type { AgentRuntimeDeps, AgentRuntimeService } from "./agent-runtime.types.js";
+/**
+ * Intel's door to the agent runtime.
+ *
+ * ⚠️ The browser never talks to the runtime. It talks to Intel, and Intel forwards — one origin for
+ * the page, one session cookie, no CORS, and no Gate token in browser JavaScript. What travels on
+ * the forwarded call is the caller's OWN bearer, which the runtime then checks for `agents/run`
+ * exactly as it would from any other client. Intel impersonates nobody: there is no service key on
+ * this path, and a request that arrives without a usable session never reaches the binding.
+ *
+ * ⚠️ The three checks below are in this order on purpose. The capability comes first, so a caller
+ * who may not drive agents at all causes no storage read; the resource ACL comes second, because it
+ * is the question the runtime cannot answer; the binding comes last, so nobody learns whether this
+ * deployment has a runtime before they are allowed to ask.
+ */
+export declare function createAgentRuntimeService(deps: AgentRuntimeDeps): AgentRuntimeService;

package/dist/agent-runtime/agent-runtime.js

@@ -0,0 +1,150 @@
+import { ProblemDetails } from "@anchrd/intel-contract";
+import { IntelError } from "../shared/intel-error/intel-error.js";
+/**
+ * The host a service binding never resolves.
+ *
+ * A `Request` needs an absolute URL and a binding routes on the path alone, so this name exists
+ * only to make one. `.internal` is not a resolvable TLD: a call that ever left this Worker by
+ * mistake fails to connect rather than reaching a stranger who registered the domain.
+ */
+const RuntimeOrigin = "https://intel-agent.internal";
+/**
+ * Intel's door to the agent runtime.
+ *
+ * ⚠️ The browser never talks to the runtime. It talks to Intel, and Intel forwards — one origin for
+ * the page, one session cookie, no CORS, and no Gate token in browser JavaScript. What travels on
+ * the forwarded call is the caller's OWN bearer, which the runtime then checks for `agents/run`
+ * exactly as it would from any other client. Intel impersonates nobody: there is no service key on
+ * this path, and a request that arrives without a usable session never reaches the binding.
+ *
+ * ⚠️ The three checks below are in this order on purpose. The capability comes first, so a caller
+ * who may not drive agents at all causes no storage read; the resource ACL comes second, because it
+ * is the question the runtime cannot answer; the binding comes last, so nobody learns whether this
+ * deployment has a runtime before they are allowed to ask.
+ */
+export function createAgentRuntimeService(deps) {
+    async function reach(actor, agentId) {
+        if (!actor.canRun) {
+            throw new IntelError(403, "permission_required", "Permission required");
+        }
+        const node = await deps.visibleNode(actor, agentId);
+        // Not found and not visible answer alike, as everywhere else in the tree: the difference would
+        // tell somebody an agent exists that they may not see.
+        if (node?.kind !== "agent") {
+            throw new IntelError(404, "agent_not_found", "Agent was not found");
+        }
+        if (!deps.runtime) {
+            throw new IntelError(503, "agent_runtime_not_configured", "This installation has no agent runtime");
+        }
+        return deps.runtime;
+    }
+    async function forward(input) {
+        const runtime = await reach(input.actor, input.agentId);
+        const headers = new Headers({ authorization: `Bearer ${input.token}` });
+        if (input.body !== undefined)
+            headers.set("content-type", "application/json");
+        return await runtime.fetch(new Request(`${RuntimeOrigin}/agents/${encodeURIComponent(input.agentId)}${input.path}`, {
+            method: input.method,
+            headers,
+            ...(input.body === undefined ? {} : { body: input.body }),
+            ...(input.signal ? { signal: input.signal } : {}),
+        }));
+    }
+    /**
+     * The two routes Intel dials itself, rather than on a browser's behalf: `/key` and
+     * `/schedules/sync`.
+     *
+     * ⚠️ Neither goes through `forward`, and that is deliberate. `forward` asks `canRun` — the
+     * question for somebody driving an agent — while both of these belong to *maintaining* one, which
+     * Intel has already authorized with `knowledge/create` or `knowledge/write` plus the resource ACL.
+     * What travels instead is the caller's own bearer beside the handover secret: the bearer says who
+     * is behind the call, the secret says it came down Intel's binding at all. The runtime cannot
+     * check Intel's resource ACL — it knows Gate and nothing about the tree — so without the secret a
+     * published runtime hostname would open both routes to anybody holding `knowledge/write` (D29).
+     */
+    async function handover(call) {
+        if (!deps.runtime) {
+            throw new IntelError(503, "agent_runtime_not_configured", "This installation has no agent runtime");
+        }
+        const handoverSecret = deps.handoverSecret?.trim();
+        if (!handoverSecret) {
+            // ⚠️ Refused here rather than dialled and refused there. The runtime would answer 403, and
+            // a 403 reads like "this person may not" — which would send an operator looking at Gate
+            // permissions for a secret that was never set.
+            throw new IntelError(503, call.unconfigured.code, call.unconfigured.detail);
+        }
+        return await deps.runtime.fetch(new Request(`${RuntimeOrigin}/agents/${encodeURIComponent(call.agentId)}${call.path}`, {
+            method: "POST",
+            headers: {
+                authorization: `Bearer ${call.token}`,
+                "content-type": "application/json",
+                // ⚠️ Its own header, never folded into `authorization`: that one already carries the
+                // caller's Gate bearer on this very request, and two credentials in one header is how
+                // one of them ends up read as the other.
+                "x-intel-agent-handover": handoverSecret,
+            },
+            body: call.body,
+        }));
+    }
+    return {
+        forward,
+        async syncSchedules(input) {
+            const response = await handover({
+                agentId: input.agentId,
+                path: "/schedules/sync",
+                token: input.token,
+                // No schedules travel: the runtime re-reads the definition from Intel itself (#214).
+                body: "{}",
+                unconfigured: {
+                    code: "agent_schedule_sync_not_configured",
+                    detail: "This installation has no shared secret for reaching the agent runtime, so schedules cannot be armed",
+                },
+            });
+            if (response.ok)
+                return;
+            // ⚠️ Loud, and named after the state it leaves behind rather than after the call that failed.
+            // What the caller has to act on is not "the runtime answered 502" but "this agent's schedules
+            // are not armed", and the sentence says the repair: write the definition again.
+            throw new IntelError(502, "agent_schedules_not_armed", `The definition was saved, but the agent runtime did not arm its schedules (${response.status}). Saving the definition again arms them.`);
+        },
+        async storeKey(input) {
+            const response = await handover({
+                agentId: input.agentId,
+                path: "/key",
+                token: input.token,
+                body: JSON.stringify({ key: input.key }),
+                unconfigured: {
+                    code: "agent_key_handover_not_configured",
+                    detail: "This installation has no shared secret for handing an agent its application key",
+                },
+            });
+            if (response.ok)
+                return;
+            // ⚠️ The runtime's answer is read for its status and thrown away. Its body cannot be quoted
+            // here the way `request` quotes it: the call that produced it carried a credential, and an
+            // echoed body is the shortest path from a refusal to a key in a log. What the caller is told
+            // is that the agent has no usable key — which is the only thing they can act on anyway.
+            throw new IntelError(502, "agent_key_not_stored", `The agent runtime did not take this agent's application key (${response.status}), so the agent cannot run yet`);
+        },
+        // A plain fact, not a probe: the binding is either configured or it is not, and nothing is
+        // dialled to answer. Unlike `reach` this stands before any per-agent check — it names no agent.
+        available: () => deps.runtime !== undefined,
+        async request(input) {
+            const response = await forward(input);
+            const body = await response.json().catch(() => null);
+            if (!response.ok) {
+                const problem = ProblemDetails.safeParse(body);
+                // ⚠️ The runtime's own words, and only those. Its refusals are written to be read — by a
+                // person on the Log tab and by a model on the MCP surface alike — while anything it could
+                // not explain arrives as a generic 500 body. Nothing about the forwarded call is added
+                // here: the URL, the binding and above all the bearer stay out of every message.
+                throw new IntelError(response.status, problem.success
+                    ? (problem.data.code ?? "agent_runtime_refused")
+                    : "agent_runtime_refused", problem.success
+                    ? (problem.data.detail ?? problem.data.title)
+                    : "The agent runtime refused this call");
+            }
+            return body;
+        },
+    };
+}

package/dist/agent-runtime/agent-runtime.types.d.ts

@@ -0,0 +1,122 @@
+import type { Node } from "@anchrd/intel-contract";
+import type { Actor } from "../nodes/nodes.types.js";
+/**
+ * The agent runtime Worker, as Intel is allowed to see it.
+ *
+ * One method, because that is all a service binding is. The Cloudflare adapter hands the binding
+ * over unchanged; nothing below this line knows it is one, so the whole seam is testable with a
+ * plain object that records what it was asked.
+ */
+export interface AgentRuntimeBinding {
+    fetch(request: Request): Promise<Response>;
+}
+/**
+ * Who is driving the agent.
+ *
+ * ⚠️ `canRun` is the caller's Gate capability, resolved once at the door — never something a body,
+ * an MCP argument or a definition may say. It is spelled beside the actor rather than derived here
+ * for the same reason `FlowActor` spells `canRun`: the service must not need a Gate client.
+ */
+export interface AgentActor extends Actor {
+    canRun: boolean;
+}
+export interface AgentRuntimeDeps {
+    /**
+     * The shared secret that proves a key handover came down this binding (D29, #207).
+     *
+     * ⚠️ The SAME value the agent Worker holds as `AGENT_HANDOVER_SECRET`, and it travels on exactly
+     * one route. It is not a substitute for the caller's bearer, which travels beside it: the bearer
+     * says who is asking, this says the request came through Intel at all. The runtime cannot check
+     * Intel's resource ACLs — it knows Gate and nothing about the tree — so without this a published
+     * runtime hostname would let anybody with `knowledge/write` write the key of any agent.
+     *
+     * Absent, `storeKey` refuses by name rather than dialling the binding and being refused there:
+     * the deployment is misconfigured, and saying so beats a 403 that reads like a permission problem.
+     */
+    handoverSecret?: string;
+    /**
+     * Absent where a deployment runs no agent Worker. Every call then refuses by name instead of
+     * failing somewhere unreadable — a customer may deploy Intel without agents.
+     */
+    runtime?: AgentRuntimeBinding;
+    /**
+     * The tree's own visibility lookup, unchanged on the way through. It is the check the runtime
+     * cannot make: the runtime knows Gate capabilities and nothing about Intel's resource ACLs, so
+     * "may this person drive agents at all" is its question and "may they reach THIS agent" is ours.
+     */
+    visibleNode(actor: Actor, nodeId: string): Promise<Node | null>;
+}
+export interface ForwardInput {
+    actor: AgentActor;
+    /** The caller's own Gate bearer, passed on unchanged. Never a service key (D19). */
+    token: string;
+    agentId: string;
+    method: "GET" | "POST";
+    /** The path below `/agents/:agentId`, exactly as the runtime mounts it. */
+    path: string;
+    body?: string;
+    signal?: AbortSignal;
+}
+/**
+ * One agent's Application key, on its way from Gate into the agent's Durable Object (D29, #207).
+ *
+ * ⚠️ It exists as a parameter and never as a field of anything stored. The value is in one local
+ * variable from the moment Gate answers until this call returns, exactly as it was before D29 — what
+ * changed is where it goes: into the runtime instead of into a response the browser reads.
+ */
+export interface StoreKeyInput {
+    /** The caller's own Gate bearer, passed on unchanged. Never a service key (D19). */
+    token: string;
+    agentId: string;
+    key: string;
+}
+/**
+ * Which agent's alarm has to be brought in line with the definition Intel just wrote (#214).
+ *
+ * ⚠️ It carries no schedules. The runtime re-reads the definition from Intel itself, with the
+ * agent's own token, so this is a "look again" and never a second copy of the document — a schedule
+ * pushed down this call would be one the agent could act on without it ever having been written.
+ */
+export interface SyncSchedulesInput {
+    /** The caller's own Gate bearer, passed on unchanged. Never a service key (D19). */
+    token: string;
+    agentId: string;
+}
+export interface AgentRuntimeService {
+    /** The browser's way through: the runtime's answer, body and headers untouched. */
+    forward(input: ForwardInput): Promise<Response>;
+    /**
+     * Hands an agent the key of the Gate Application it runs as.
+     *
+     * ⚠️ The one door here that does NOT ask `canRun`, and that is deliberate. Its two callers —
+     * creating an agent and rotating its key — have already decided who may act: `knowledge/create`
+     * with a writable parent, or `knowledge/write` with the resource ACL of the agent node. Requiring
+     * `agents/run` on top would mean a person who may create agents but never run one creates keyless
+     * agents, which is #200 arrived at from the other side. The runtime makes the same distinction at
+     * its own door.
+     *
+     * ⚠️ It fails loudly. A handover that quietly did not happen is an agent that exists, looks
+     * right, and dies at its first run — the whole failure this ticket removes.
+     */
+    storeKey(input: StoreKeyInput): Promise<void>;
+    /**
+     * Arms the agent's alarm for whatever the definition Intel just wrote schedules (#214).
+     *
+     * ⚠️ Like `storeKey` and unlike everything else here, it does NOT ask `canRun`. Its two callers —
+     * creating an agent and saving its definition — have already decided who may act: `knowledge/
+     * create` with a writable parent, or `knowledge/write` with the resource ACL of the agent node.
+     * Requiring `agents/run` on top would mean an editor who may not drive agents saves a schedule
+     * that is never armed, which is the failure this exists to remove.
+     *
+     * ⚠️ It fails loudly, for the same reason `storeKey` does. A sync that quietly did not happen is
+     * an agent whose profile shows a schedule that will never fire.
+     */
+    syncSchedules(input: SyncSchedulesInput): Promise<void>;
+    /** The same door for a caller that wants the answer, not the response — Intel MCP uses this. */
+    request(input: ForwardInput): Promise<unknown>;
+    /**
+     * Whether this deployment has a runtime at all (#190). The answer `/capabilities` gives to an
+     * authenticated caller so the UI can stop offering agents instead of guessing from a 503.
+     */
+    available(): boolean;
+}

package/dist/bundle/bundle.d.ts

@@ -0,0 +1,4 @@
+import type { BundleDeps, BundleService } from "./bundle.types.js";
+export declare const MaxImportZipBytes: number;
+export declare const MaxImportEntryBytes: number;
+export declare function createBundle(deps: BundleDeps): BundleService;