@anchrd/intel 0.59.0

package/dist/adapters/db/db.types.d.ts

@@ -0,0 +1,16 @@
+export interface D1Result<T = unknown> {
+    results?: T[];
+    meta?: {
+        changes?: number;
+    };
+}
+export interface D1Statement {
+    bind(...values: unknown[]): D1Statement;
+    first<T = Record<string, unknown>>(): Promise<T | null>;
+    all<T = Record<string, unknown>>(): Promise<D1Result<T>>;
+    run<T = Record<string, unknown>>(): Promise<D1Result<T>>;
+}
+export interface D1Database {
+    prepare(query: string): D1Statement;
+    batch<T = unknown>(statements: D1Statement[]): Promise<D1Result<T>[]>;
+}

package/dist/adapters/db/db.types.js

@@ -0,0 +1 @@
+export {};

package/dist/adapters/document-converter/document-converter.d.ts

@@ -0,0 +1,2 @@
+import type { DocumentConverter, DocumentConverterDeps } from "./document-converter.types.js";
+export declare function createDocumentConverter(deps: DocumentConverterDeps): DocumentConverter;

package/dist/adapters/document-converter/document-converter.js

@@ -0,0 +1,26 @@
+function converted(result) {
+    const item = Array.isArray(result) ? result[0] : result;
+    if (typeof item !== "object" ||
+        item === null ||
+        !("format" in item) ||
+        (item.format !== "markdown" && item.format !== "text") ||
+        !("data" in item) ||
+        typeof item.data !== "string") {
+        const detail = typeof item === "object" && item !== null && "error" in item && typeof item.error === "string"
+            ? item.error
+            : "Markdown conversion returned an invalid response";
+        throw new Error(detail);
+    }
+    return item.data;
+}
+export function createDocumentConverter(deps) {
+    const gateway = { id: deps.gateway };
+    return {
+        async convert(name, mediaType, content) {
+            return converted(await deps.ai.toMarkdown({
+                name,
+                blob: new Blob([content], { type: mediaType }),
+            }, { gateway }));
+        },
+    };
+}

package/dist/adapters/document-converter/document-converter.types.d.ts

@@ -0,0 +1,17 @@
+export interface MarkdownAiBinding {
+    toMarkdown(input: {
+        name: string;
+        blob: Blob;
+    }, options: {
+        gateway: {
+            id: string;
+        };
+    }): Promise<unknown>;
+}
+export interface DocumentConverterDeps {
+    ai: MarkdownAiBinding;
+    gateway: string;
+}
+export interface DocumentConverter {
+    convert(name: string, mediaType: string, content: ArrayBuffer): Promise<string>;
+}

package/dist/adapters/document-converter/document-converter.types.js

@@ -0,0 +1 @@
+export {};

package/dist/adapters/flow-runtime/flow-runtime.d.ts

@@ -0,0 +1,3 @@
+import type { FlowRuntime } from "../../flows/flows.types.js";
+import type { WorkflowBinding } from "./flow-runtime.types.js";
+export declare function createFlowRuntime(binding: WorkflowBinding): FlowRuntime;

package/dist/adapters/flow-runtime/flow-runtime.js

@@ -0,0 +1,22 @@
+export function createFlowRuntime(binding) {
+    return {
+        async start(runId) {
+            try {
+                await binding.create({ id: runId, params: { runId } });
+            }
+            catch (error) {
+                try {
+                    const existing = await binding.get(runId);
+                    await existing.status();
+                }
+                catch {
+                    throw error;
+                }
+            }
+        },
+        async signal(runId) {
+            const instance = await binding.get(runId);
+            await instance.sendEvent({ type: "advance", payload: { runId } });
+        },
+    };
+}

package/dist/adapters/flow-runtime/flow-runtime.types.d.ts

@@ -0,0 +1,19 @@
+export interface WorkflowBinding {
+    create(options: {
+        id: string;
+        params: {
+            runId: string;
+        };
+    }): Promise<{
+        id: string;
+    }>;
+    get(id: string): Promise<{
+        status(): Promise<{
+            status: string;
+        }>;
+        sendEvent(event: {
+            type: string;
+            payload: unknown;
+        }): Promise<void>;
+    }>;
+}

package/dist/adapters/flow-runtime/flow-runtime.types.js

@@ -0,0 +1 @@
+export {};

package/dist/adapters/index-queue/index-queue.d.ts

@@ -0,0 +1,10 @@
+import { z } from "zod";
+import type { QueueProducer } from "./index-queue.types.js";
+export declare const IndexMessage: z.ZodObject<{
+    type: z.ZodLiteral<"node.version">;
+    versionId: z.ZodString;
+}, z.core.$strict>;
+export type IndexMessage = z.infer<typeof IndexMessage>;
+export declare function createIndexQueue(queue: QueueProducer<IndexMessage>): {
+    enqueue(versionId: string): Promise<void>;
+};

package/dist/adapters/index-queue/index-queue.js

@@ -0,0 +1,12 @@
+import { z } from "zod";
+export const IndexMessage = z.strictObject({
+    type: z.literal("node.version"),
+    versionId: z.string().min(1),
+});
+export function createIndexQueue(queue) {
+    return {
+        async enqueue(versionId) {
+            await queue.send({ type: "node.version", versionId });
+        },
+    };
+}

package/dist/adapters/index-queue/index-queue.types.d.ts

@@ -0,0 +1,11 @@
+export interface QueueProducer<T> {
+    send(message: T): Promise<void>;
+}
+export interface QueueMessage<T> {
+    body: T;
+    ack(): void;
+    retry(): void;
+}
+export interface QueueBatch<T> {
+    messages: QueueMessage<T>[];
+}

package/dist/adapters/index-queue/index-queue.types.js

@@ -0,0 +1 @@
+export {};

package/dist/adapters/json-schema/json-schema.d.ts

@@ -0,0 +1,2 @@
+import type { ToolDeps } from "../../tools/tools.types.js";
+export declare function createJsonSchemaValidator(): ToolDeps["validate"];

package/dist/adapters/json-schema/json-schema.js

@@ -0,0 +1,77 @@
+import { Validator } from "@cfworker/json-schema";
+import { reportUnexpectedError } from "../../shared/report-unexpected-error/report-unexpected-error.js";
+// ⚠️ This validator must not generate code, and Ajv must never come back. Ajv turns a schema into
+// JavaScript with `new Function`, and workerd answers that with `EvalError: Code generation from
+// strings disallowed for this context` — so `compile` threw for EVERY schema in production, the
+// catch called it a broken schema, and each tool call died with 400 "The cached tool schema is
+// invalid" while nothing was wrong with any schema (#229). Ajv is usable only with schemas
+// precompiled at build time; these arrive from a remote catalog and are unknown until the call.
+// `@cfworker/json-schema` interprets the schema instead, which is what it was written for.
+//
+// ⚠️ The `workerd` test pool does not prove this on its own: it replaces `globalThis.Function` with
+// a proxy onto an unsafe-eval binding, so Ajv compiled happily in every test while failing in every
+// deployment. `json-schema.int.ts` therefore takes that patch away for the length of the test — it
+// is the only thing that turns red when a code-generating validator returns.
+// Tool schemas come from remote catalogs and are therefore untrusted: `ShortCircuit` stops at the
+// first error so a crafted schema cannot amplify the work of one call, and the prepared validators
+// are bounded because each one holds its dereferenced schema for the life of the isolate.
+const MaxPreparedSchemas = 200;
+const ShortCircuit = true;
+const MaxDetailLength = 2_000;
+// A tool schema that names its draft gets that draft: draft-07 ignores keywords sitting beside a
+// `$ref` and the later drafts apply them, so guessing here would validate a foreign catalog against
+// rules its author never wrote. Unnamed means 2020-12, the draft the MCP generators emit when they
+// stay silent.
+const DefaultDraft = "2020-12";
+const DraftsByMetaSchema = [
+    ["draft-04", "4"],
+    ["draft-07", "7"],
+    ["2019-09", "2019-09"],
+    ["2020-12", "2020-12"],
+];
+function draftOf(schema) {
+    const declared = schema.$schema;
+    if (typeof declared !== "string")
+        return DefaultDraft;
+    return DraftsByMetaSchema.find(([marker]) => declared.includes(marker))?.[1] ?? DefaultDraft;
+}
+export function createJsonSchemaValidator() {
+    const prepared = new Map();
+    return (schema, value) => {
+        const key = JSON.stringify(schema);
+        let validator = prepared.get(key);
+        if (!validator) {
+            try {
+                validator = new Validator(schema, draftOf(schema), ShortCircuit);
+            }
+            catch (error) {
+                // A schema this validator cannot even read is still refused by name — but the caller hears
+                // that it was the schema, not their arguments, and the reason itself goes to the log. The
+                // old wording claimed a broken schema for every failure, which is what hid #229 for weeks.
+                reportUnexpectedError(error);
+                return { valid: false, detail: "The tool schema could not be read; the reason was logged" };
+            }
+            if (prepared.size >= MaxPreparedSchemas)
+                prepared.clear();
+            prepared.set(key, validator);
+        }
+        try {
+            const result = validator.validate(value);
+            if (result.valid)
+                return { valid: true };
+            return { valid: false, detail: describe(result) };
+        }
+        catch (error) {
+            // An unresolvable `$ref` only shows up while walking the instance, so this is the same
+            // unreadable schema arriving one step later — and never a statement about the arguments.
+            reportUnexpectedError(error);
+            return { valid: false, detail: "The tool schema could not be read; the reason was logged" };
+        }
+    };
+}
+function describe(result) {
+    return result.errors
+        .map((unit) => `${unit.instanceLocation}: ${unit.error}`)
+        .join("; ")
+        .slice(0, MaxDetailLength);
+}

package/dist/adapters/openid/openid.d.ts

@@ -0,0 +1,5 @@
+import type { OAuthPort } from "../../auth/auth.types.js";
+export declare function createOpenId(deps: {
+    fetch: typeof fetch;
+    allowInsecure?: boolean;
+}): OAuthPort;

package/dist/adapters/openid/openid.js

@@ -0,0 +1,301 @@
+import * as client from "openid-client";
+import { z } from "zod";
+import { ToolSourceUrl } from "../../contract/tool.js";
+const ProtectedResource = z.looseObject({
+    resource: ToolSourceUrl,
+    authorization_servers: z.array(ToolSourceUrl).min(1),
+});
+function metadataCandidates(resourceUrl, challenge) {
+    const resource = new URL(resourceUrl);
+    const path = resource.pathname === "/" ? "" : resource.pathname.replace(/\/+$/, "");
+    let challengeUrl = null;
+    try {
+        challengeUrl = challenge ? new URL(challenge, resource) : null;
+    }
+    catch {
+        challengeUrl = null;
+    }
+    return [
+        ...(challengeUrl?.origin === resource.origin ? [challengeUrl.href] : []),
+        `${resource.origin}/.well-known/oauth-protected-resource${path}`,
+        `${resource.origin}/.well-known/oauth-protected-resource`,
+    ].filter((value, index, values) => values.indexOf(value) === index);
+}
+function resourceMetadataChallenge(header) {
+    return header?.match(/resource_metadata="([^"]+)"/i)?.[1] ?? null;
+}
+/**
+ * ⚠️ `issuer` is REQUIRED by RFC 8414 §2 and by OpenID Connect Discovery, and it is read here for one
+ * reason: it is the only thing that says WHO a metadata document describes. Two of the URLs below are
+ * bare-root guesses, and a bare root under a multi-tenant authorization server answers for a
+ * different tenant — a perfectly valid document about somebody else.
+ */
+const AuthorizationServerMetadata = z.looseObject({
+    issuer: z.string().nullish(),
+    scopes_supported: z.array(z.string()).nullish(),
+});
+/**
+ * Where an authorization server may publish its metadata, in the order worth asking.
+ *
+ * ⚠️ One candidate was never a decision, it was an omission — `metadataCandidates` above tries three
+ * and `withAlgorithmFallback` tries two. A server that publishes only OIDC discovery read as "names
+ * no scopes", which is #97 at a different server class and with the same silent symptom (#303).
+ *
+ * ⚠️ The three spellings are not interchangeable, and the third is the one that is easy to miss.
+ * RFC 8414 §3.1 INSERTS the issuer's path between the well-known prefix and nothing else; OpenID
+ * Connect Discovery 1.0 APPENDS its suffix to the issuer instead. A realm-style issuer
+ * (`https://as.example/realms/x`) publishes at `…/realms/x/.well-known/openid-configuration` and at
+ * neither of the other two — which is exactly the form `client.discovery` asks for further down this
+ * file, so the same server was reachable for registration and invisible here.
+ */
+function authorizationServerCandidates(issuer) {
+    const url = new URL(issuer);
+    const path = url.pathname === "/" ? "" : url.pathname.replace(/\/+$/, "");
+    return [
+        // RFC 8414 with the path inserted. First, because it is the shape the MCP portals publish.
+        `${url.origin}/.well-known/oauth-authorization-server${path}`,
+        // The same document at the bare root, for an issuer WITH a path that publishes it there anyway.
+        `${url.origin}/.well-known/oauth-authorization-server`,
+        // OpenID Connect Discovery 1.0, appended to the issuer — the realm-style form.
+        `${url.origin}${path}/.well-known/openid-configuration`,
+        // The same document read the RFC 8414 way, and at the bare root.
+        `${url.origin}/.well-known/openid-configuration${path}`,
+        `${url.origin}/.well-known/openid-configuration`,
+    ].filter((value, index, values) => values.indexOf(value) === index);
+}
+/** Two issuer identifiers are the same server, compared the way a URL says so and not as strings. */
+function sameIssuer(published, wanted) {
+    if (!published)
+        return false;
+    try {
+        return new URL(published).href.replace(/\/$/, "") === new URL(wanted).href.replace(/\/$/, "");
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * The scopes this authorization server says it understands, or `null` when it names none.
+ *
+ * ⚠️ `null` is not "no scopes" — RFC 8414 makes `scopes_supported` OPTIONAL, and Cloudflare Access
+ * omits it. It means "this server never said", and the only safe reading of that is to ask for
+ * nothing: a scope the server does not know is at best ignored and at worst turns the whole
+ * authorization down, and neither failure names the scope as its cause.
+ *
+ * This replaces a hostname check (`issuer.endsWith(".cloudflareaccess.com")`) that decided the same
+ * question by guessing who the server was. A Cloudflare Access portal on its own domain — the
+ * normal case for anyone who cares what their portal is called — was read as some other vendor, and
+ * Intel then asked it for `offline_access`, a scope it never published (#97).
+ */
+async function publishedScopes(fetcher, issuer) {
+    for (const candidate of authorizationServerCandidates(issuer)) {
+        const response = await fetcher(candidate, {
+            signal: AbortSignal.timeout(RequestTimeoutMs),
+            headers: { accept: "application/json" },
+        }).catch(() => null);
+        if (!response?.ok)
+            continue;
+        const metadata = AuthorizationServerMetadata.safeParse(await response.json().catch(() => null));
+        if (!metadata.success)
+            continue;
+        // ⚠️ The document has to be ABOUT this issuer, and that check is what makes the bare-root
+        // candidates safe to ask at all. Under a multi-tenant server the root answers for a different
+        // tenant, and taking its `scopes_supported` would ask THIS server for a scope it never published
+        // — the very rule this function exists to keep, broken by the fallback added to protect it.
+        // The resource loop further down does the same thing for the same reason.
+        if (!sameIssuer(metadata.data.issuer, issuer))
+            continue;
+        // ⚠️ A document that answered ABOUT THIS SERVER and named no scopes ends the search. Reading on
+        // would let the next candidate answer a question this server has already answered — "I publish
+        // none" — and the documents of one issuer may disagree about a field RFC 8414 makes optional.
+        return metadata.data.scopes_supported ?? null;
+    }
+    return null;
+}
+/**
+ * Of the scopes Intel would like, the ones this server published — joined, or absent.
+ *
+ * `offline_access` is the one that matters: it is where a refresh token comes from on a server that
+ * gates it behind a scope. Asking for it unconditionally is what a hostname check amounted to.
+ */
+function requestableScope(published) {
+    if (!published)
+        return undefined;
+    const wanted = ["openid", "profile", "email", "offline_access"].filter((scope) => published.includes(scope));
+    return wanted.length > 0 ? wanted.join(" ") : undefined;
+}
+function tokenResponse(tokens) {
+    return {
+        accessToken: tokens.access_token,
+        expiresIn: tokens.expires_in ?? 3_600,
+        ...(tokens.refresh_token ? { refreshToken: tokens.refresh_token } : {}),
+    };
+}
+// Discovery, token and probe requests run inside the login and connect paths. Without a deadline a
+// hanging issuer would hold the request open until the platform kills it.
+const RequestTimeoutMs = 10_000;
+export function createOpenId(deps) {
+    const customFetch = async (url, options) => {
+        const init = options;
+        const deadline = AbortSignal.timeout(RequestTimeoutMs);
+        // The library may pass its own signal. Spreading init last would drop the deadline, spreading it
+        // first would drop the caller's cancellation, so both have to abort the request.
+        return await deps.fetch(url, {
+            ...init,
+            signal: init.signal ? AbortSignal.any([init.signal, deadline]) : deadline,
+        });
+    };
+    const configurations = new Map();
+    function options(issuer) {
+        const insecure = new URL(issuer).protocol === "http:";
+        if (insecure && !deps.allowInsecure) {
+            throw new Error("Insecure OAuth issuers require ALLOW_INSECURE_OAUTH=true");
+        }
+        return {
+            [client.customFetch]: customFetch,
+            ...(insecure ? { execute: [client.allowInsecureRequests] } : {}),
+        };
+    }
+    // openid-client resolves issuer metadata via OIDC discovery unless told otherwise. Gate serves
+    // that document, but a plain OAuth 2.0 authorization server — the MCP portal on its custom
+    // domain is one — publishes only RFC 8414's oauth-authorization-server path and answers the OIDC
+    // one with a 404, which surfaced as a bare 500 on /auth/connect (#93). The fallback repeats the
+    // operation once with the OAuth document; when both fail, the second error is thrown because it
+    // belongs to the attempt that got further for the issuer that needed the fallback at all.
+    async function withAlgorithmFallback(run, usable = () => true) {
+        try {
+            const first = await run();
+            // ⚠️ A THROW is not the only way the OIDC document can be the wrong one (#425). Cloudflare
+            // Access answers `/.well-known/openid-configuration` with **200** and a two-field stub —
+            // `issuer` and `jwks_uri`, nothing else — while the endpoints live only under RFC 8414's
+            // `oauth-authorization-server`. Discovery therefore SUCCEEDS, the fallback never runs, and
+            // the missing endpoint surfaces minutes later inside `buildAuthorizationUrl` as
+            // `authorization server metadata does not contain a valid "as.authorization_endpoint"` — a
+            // 500 on `/auth/connect` with nothing in it pointing at discovery.
+            //
+            // So the question is not "did it fail" but "is what came back usable". An answer that parses
+            // and carries nothing is the same situation as a 404, and it gets the same second attempt.
+            return usable(first) ? first : await run("oauth2");
+        }
+        catch {
+            return await run("oauth2");
+        }
+    }
+    async function discover(issuer, clientId) {
+        const key = `${issuer}#${clientId}`;
+        let configuration = configurations.get(key);
+        if (!configuration) {
+            configuration = withAlgorithmFallback((algorithm) => client.discovery(new URL(issuer), clientId, { token_endpoint_auth_method: "none" }, client.None(), { ...options(issuer), ...(algorithm ? { algorithm } : {}) }), 
+            // The two endpoints every flow here needs. Asking for exactly them rather than for a long
+            // list keeps the check honest: a server that publishes these two is usable, and one that
+            // publishes neither is the stub case above, whatever else it carries.
+            (resolved) => {
+                const metadata = resolved.serverMetadata();
+                return Boolean(metadata.authorization_endpoint && metadata.token_endpoint);
+            });
+            configurations.set(key, configuration);
+            void configuration.catch(() => configurations.delete(key));
+        }
+        return await configuration;
+    }
+    return {
+        async discoverResource(resourceUrl) {
+            const probe = await deps
+                .fetch(resourceUrl, {
+                method: "POST",
+                signal: AbortSignal.timeout(RequestTimeoutMs),
+                headers: {
+                    accept: "application/json, text/event-stream",
+                    "content-type": "application/json",
+                },
+                body: JSON.stringify({
+                    jsonrpc: "2.0",
+                    id: "intel-oauth-discovery",
+                    method: "initialize",
+                    params: {
+                        protocolVersion: "2025-11-25",
+                        capabilities: {},
+                        clientInfo: { name: "intel", version: "0.1.0" },
+                    },
+                }),
+            })
+                .catch(() => null);
+            const candidates = metadataCandidates(resourceUrl, resourceMetadataChallenge(probe?.headers.get("www-authenticate") ?? null));
+            for (const candidate of candidates) {
+                const response = await deps
+                    .fetch(candidate, {
+                    signal: AbortSignal.timeout(RequestTimeoutMs),
+                    headers: { accept: "application/json" },
+                })
+                    .catch(() => null);
+                if (!response?.ok)
+                    continue;
+                const metadata = ProtectedResource.safeParse(await response.json().catch(() => null));
+                if (!metadata.success)
+                    continue;
+                if (new URL(metadata.data.resource).href !== new URL(resourceUrl).href)
+                    continue;
+                const issuer = metadata.data.authorization_servers[0];
+                if (issuer) {
+                    const scope = requestableScope(await publishedScopes(deps.fetch, issuer));
+                    return {
+                        resource: metadata.data.resource,
+                        issuer,
+                        ...(scope ? { scope } : {}),
+                    };
+                }
+            }
+            throw new Error("MCP resource did not publish valid OAuth metadata");
+        },
+        async register(input) {
+            const configuration = await withAlgorithmFallback((algorithm) => client.dynamicClientRegistration(new URL(input.issuer), {
+                client_name: input.clientName,
+                redirect_uris: [input.redirectUri],
+                response_types: ["code"],
+                // ⚠️ `refresh_token` belongs here, not only in the scope. RFC 7591 §2: `grant_types`
+                // declares which grants this client may USE, and a client registered without it may
+                // not refresh — whatever scope it was granted. That is why the portal connection did
+                // not survive its first access token (#97): `offline_access` was being requested and
+                // the right to act on it never was.
+                grant_types: ["authorization_code", "refresh_token"],
+                ...(input.scope ? { scope: input.scope } : {}),
+                token_endpoint_auth_method: "none",
+                // ⚠️ Unconditional, and that is the protocol rather than a vendor accommodation. The
+                // MCP authorization spec: "MCP clients MUST send this parameter regardless of whether
+                // authorization servers support it" (RFC 8707 Resource Indicators). Sending it only to
+                // hosts whose name ended in `.cloudflareaccess.com` meant every portal on its own
+                // domain registered as a client that never named the resource it wanted a token for —
+                // and Cloudflare's Managed OAuth requires exactly that conformance before it will hand
+                // out a refresh token. The connection then died at the first token expiry, and the log
+                // said "no refresh token was ever issued" (#97).
+                resource: input.resource,
+            }, client.None(), { ...options(input.issuer), ...(algorithm ? { algorithm } : {}) }));
+            return configuration.clientMetadata().client_id;
+        },
+        async authorizationUrl(input) {
+            const configuration = await discover(input.issuer, input.clientId);
+            return client.buildAuthorizationUrl(configuration, {
+                response_type: "code",
+                redirect_uri: input.redirectUri,
+                ...(input.scope ? { scope: input.scope } : {}),
+                resource: input.resource,
+                code_challenge: input.codeChallenge,
+                code_challenge_method: "S256",
+                state: input.state,
+                ...(input.prompt ? { prompt: input.prompt } : {}),
+            });
+        },
+        async exchange(input) {
+            const configuration = await discover(input.issuer, input.clientId);
+            const tokens = await client.authorizationCodeGrant(configuration, input.callbackUrl, { pkceCodeVerifier: input.codeVerifier, expectedState: input.state }, { resource: input.resource });
+            return tokenResponse(tokens);
+        },
+        async refresh(input) {
+            const configuration = await discover(input.issuer, input.clientId);
+            const tokens = await client.refreshTokenGrant(configuration, input.refreshToken, {
+                resource: input.resource,
+            });
+            return tokenResponse(tokens);
+        },
+    };
+}

package/dist/adapters/portal-tokens/portal-tokens.d.ts

@@ -0,0 +1,8 @@
+import type { PortalTokenStore } from "../../tools/tools.types.js";
+import type { D1Database } from "../db/db.types.js";
+export declare function createPortalTokenStore(deps: {
+    db: D1Database;
+    secret: string;
+    crypto: Crypto;
+    now(): Date;
+}): PortalTokenStore;

package/dist/adapters/portal-tokens/portal-tokens.js

@@ -0,0 +1,79 @@
+import { z } from "zod";
+import { reportUnexpectedError } from "../../shared/report-unexpected-error/report-unexpected-error.js";
+const StoredToken = z.strictObject({
+    version: z.literal(1),
+    accessToken: z.string().min(1),
+    refreshToken: z.string().min(1).nullable(),
+    expiresAt: z.number().int().positive(),
+    issuer: z.url(),
+    clientId: z.string().min(1),
+    resource: z.url(),
+});
+// Bound to this purpose so a sealed value cannot be replayed as a session cookie and vice versa.
+const additionalData = new TextEncoder().encode("anchrd-intel-portal-token-v1");
+function encode(bytes) {
+    let value = "";
+    for (const byte of bytes)
+        value += String.fromCharCode(byte);
+    return btoa(value);
+}
+function decode(value) {
+    return Uint8Array.from(atob(value), (character) => character.charCodeAt(0));
+}
+export function createPortalTokenStore(deps) {
+    if (new TextEncoder().encode(deps.secret).byteLength < 32) {
+        throw new Error("INTEL_SESSION_SECRET must contain at least 32 bytes");
+    }
+    const key = deps.crypto.subtle
+        .digest("SHA-256", new TextEncoder().encode(deps.secret))
+        .then((hash) => deps.crypto.subtle.importKey("raw", hash, "AES-GCM", false, ["encrypt", "decrypt"]));
+    return {
+        async read(userId) {
+            const row = await deps.db
+                .prepare("SELECT sealed FROM portal_tokens WHERE user_id = ?")
+                .bind(userId)
+                .first();
+            if (!row)
+                return null;
+            try {
+                const raw = decode(row.sealed);
+                const plaintext = await deps.crypto.subtle.decrypt({ name: "AES-GCM", iv: raw.subarray(0, 12), additionalData }, await key, raw.subarray(12));
+                const parsed = StoredToken.parse(JSON.parse(new TextDecoder().decode(plaintext)));
+                const { version: _version, ...token } = parsed;
+                return token;
+            }
+            catch (error) {
+                // A row that no longer decrypts (rotated secret, tampering) is treated as absent so the
+                // user is asked to reconnect instead of hitting an opaque failure on every call.
+                // ⚠️ Absent and unreadable look identical from the outside — both end in the sign-in screen
+                // — but only one of them is a defect. Without this line the difference is unobservable, and
+                // a connection that disappears has no explanation anywhere (#97). The row is named by its
+                // length alone; the sealed value never goes near a log.
+                reportUnexpectedError(new Error(`portal token for a user did not decrypt (sealed length ${row.sealed.length})`, {
+                    cause: error,
+                }));
+                return null;
+            }
+        },
+        async write(userId, token) {
+            const iv = deps.crypto.getRandomValues(new Uint8Array(12));
+            const encrypted = new Uint8Array(await deps.crypto.subtle.encrypt({ name: "AES-GCM", iv, additionalData }, await key, new TextEncoder().encode(JSON.stringify({ version: 1, ...token }))));
+            const sealed = new Uint8Array(iv.byteLength + encrypted.byteLength);
+            sealed.set(iv);
+            sealed.set(encrypted, iv.byteLength);
+            const timestamp = deps.now().toISOString();
+            await deps.db
+                .prepare(`INSERT INTO portal_tokens (user_id, sealed, expires_at, updated_at)
+          VALUES (?, ?, ?, ?)
+          ON CONFLICT(user_id) DO UPDATE SET
+            sealed = excluded.sealed,
+            expires_at = excluded.expires_at,
+            updated_at = excluded.updated_at`)
+                .bind(userId, encode(sealed), new Date(token.expiresAt).toISOString(), timestamp)
+                .run();
+        },
+        async clear(userId) {
+            await deps.db.prepare("DELETE FROM portal_tokens WHERE user_id = ?").bind(userId).run();
+        },
+    };
+}

package/dist/adapters/remote-tools/remote-tools.d.ts

@@ -0,0 +1,5 @@
+import type { RemoteTools } from "../../tools/tools.types.js";
+export interface RemoteToolsDeps {
+    fetch: (url: string | URL, init?: RequestInit) => Promise<Response>;
+}
+export declare function createRemoteTools(deps: RemoteToolsDeps): RemoteTools;