@anchrd/intel 0.59.0

package/dist/adapters/remote-tools/remote-tools.js

@@ -0,0 +1,129 @@
+import { Client } from "@modelcontextprotocol/sdk/client/index.js";
+import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
+import { CfWorkerJsonSchemaValidator } from "@modelcontextprotocol/sdk/validation/cfworker";
+import { ToolTestResult } from "../../contract/tool.js";
+function responseWithLimit(response, maxBytes) {
+    const length = Number(response.headers.get("content-length"));
+    if (Number.isFinite(length) && length > maxBytes) {
+        void response.body?.cancel();
+        throw new Error(`Remote MCP response exceeded ${maxBytes} bytes`);
+    }
+    if (!response.body)
+        return response;
+    let received = 0;
+    const bounded = response.body.pipeThrough(new TransformStream({
+        transform(chunk, controller) {
+            received += chunk.byteLength;
+            if (received > maxBytes) {
+                controller.error(new Error(`Remote MCP response exceeded ${maxBytes} bytes`));
+                return;
+            }
+            controller.enqueue(chunk);
+        },
+    }));
+    return new Response(bounded, {
+        status: response.status,
+        statusText: response.statusText,
+        headers: response.headers,
+    });
+}
+export function createRemoteTools(deps) {
+    async function connected(url, accessToken, signal, maxBytes, work) {
+        /**
+         * ⚠️ The SDK's DEFAULT validator is Ajv, and Ajv cannot run in a Worker.
+         *
+         * `Client.cacheToolMetadata` compiles a validator for every tool that carries an `outputSchema`,
+         * Ajv builds that with `new Function`, and `workerd` answers `EvalError: Code generation from
+         * strings disallowed for this context`. The throw takes the WHOLE `tools/list` with it, so a
+         * single such tool empties the catalog of every other server (#308).
+         *
+         * Nothing announces this. Tools without an `outputSchema` never reach the line, so a portal can
+         * work for months and break the moment somebody adds a server whose tools declare one — which
+         * is exactly how it was found: three servers fine, the fourth took the screen down. And no test
+         * can catch it either: `@cloudflare/vitest-pool-workers` replaces `globalThis.Function` with a
+         * proxy onto an unsafe-eval binding, so code generation WORKS in every test and fails in every
+         * deployment.
+         *
+         * This is #229 one layer down — there Ajv sat in Intel's own schema adapter, here it sits in a
+         * dependency. The SDK offers the way out itself: `CfWorkerJsonSchemaValidator` interprets the
+         * schema instead of compiling it, and it is the same `@cfworker/json-schema` #229 settled on.
+         */
+        const client = new Client({ name: "intel-tools", version: "0.1.0" }, { jsonSchemaValidator: new CfWorkerJsonSchemaValidator() });
+        const transport = new StreamableHTTPClientTransport(new URL(url), {
+            fetch: async (input, init) => responseWithLimit(await deps.fetch(input, {
+                ...init,
+                signal: init?.signal ? AbortSignal.any([signal, init.signal]) : signal,
+            }), maxBytes),
+            requestInit: { headers: { authorization: `Bearer ${accessToken}` }, signal },
+        });
+        try {
+            // The SDK's transport and client currently disagree under exactOptionalPropertyTypes.
+            await client.connect(transport);
+            return await work(client);
+        }
+        finally {
+            await client.close().catch(() => undefined);
+        }
+    }
+    return {
+        async list(url, accessToken, signal) {
+            return await connected(url, accessToken, signal, 5_000_000, async (client) => {
+                const tools = [];
+                let cursor;
+                do {
+                    const page = await client.listTools(cursor ? { cursor } : undefined);
+                    for (const tool of page.tools) {
+                        tools.push({
+                            name: tool.name,
+                            title: tool.title ?? tool.annotations?.title ?? null,
+                            description: tool.description ?? null,
+                            inputSchema: tool.inputSchema,
+                            outputSchema: tool.outputSchema ?? null,
+                            annotations: {
+                                ...(tool.annotations?.title ? { title: tool.annotations.title } : {}),
+                                ...(tool.annotations?.readOnlyHint !== undefined
+                                    ? { readOnlyHint: tool.annotations.readOnlyHint }
+                                    : {}),
+                                ...(tool.annotations?.destructiveHint !== undefined
+                                    ? { destructiveHint: tool.annotations.destructiveHint }
+                                    : {}),
+                                ...(tool.annotations?.idempotentHint !== undefined
+                                    ? { idempotentHint: tool.annotations.idempotentHint }
+                                    : {}),
+                                ...(tool.annotations?.openWorldHint !== undefined
+                                    ? { openWorldHint: tool.annotations.openWorldHint }
+                                    : {}),
+                            },
+                        });
+                        if (tools.length > 1_000)
+                            return tools;
+                    }
+                    cursor = page.nextCursor;
+                } while (cursor);
+                return tools;
+            });
+        },
+        async call(input) {
+            return await connected(input.url, input.accessToken, input.signal, 1_100_000, async (client) => {
+                const result = await client.callTool({
+                    name: input.name,
+                    arguments: input.arguments,
+                });
+                if (!("content" in result)) {
+                    return ToolTestResult.parse({
+                        isError: false,
+                        content: [],
+                        structuredContent: result.toolResult,
+                    });
+                }
+                return ToolTestResult.parse({
+                    isError: result.isError ?? false,
+                    content: result.content,
+                    ...(result.structuredContent !== undefined
+                        ? { structuredContent: result.structuredContent }
+                        : {}),
+                });
+            });
+        },
+    };
+}

package/dist/adapters/semantic-index/semantic-index.d.ts

@@ -0,0 +1,2 @@
+import type { SemanticIndex, SemanticIndexDeps } from "./semantic-index.types.js";
+export declare function createSemanticIndex(deps: SemanticIndexDeps): SemanticIndex;

package/dist/adapters/semantic-index/semantic-index.js

@@ -0,0 +1,139 @@
+const defaultModel = "@cf/baai/bge-m3";
+const maxEmbeddingCharacters = 24_000;
+// How much of one embedding request this adapter is willing to be: at most this many texts, and at
+// most this many characters across them. Both bounds are ours rather than a number Cloudflare
+// publishes — what the model documents is the shape of `text`, not a batch size — so they are set
+// well inside anything plausible. The point is that a board with three hundred cards costs a
+// handful of requests on its first pass instead of three hundred round trips.
+const maxBatchTexts = 25;
+const maxBatchCharacters = 96_000;
+// Vectorize takes at most 1000 vectors in one call from a Worker (platform limits). A board may
+// hold 5000 tasks, so the write is cut rather than sent whole and refused.
+const maxVectorsPerCall = 1000;
+/**
+ * How a chunk is named in the vector index (anchrd/intel#301).
+ *
+ * ⚠️ `""` keeps the bare node id, which is what every vector written before this was called. That
+ * is the whole reason the separator sits on the SUFFIX side: nothing an installation already holds
+ * changes its name, so this ships without re-embedding a tree.
+ *
+ * ⚠️ Reading it back splits at the FIRST separator, and that direction matters. A node id is minted
+ * here (`ulid`) and cannot contain a `#`; a task id can, because a bundle import carries the task
+ * ids written in the file. Splitting at the first `#` therefore always recovers the node id exactly
+ * and leaves the rest to the key — and even a key that never matched a card costs a hit that
+ * hydrates to nothing, never a citation for a node the searcher did not match.
+ */
+const chunkSeparator = "#";
+function vectorId(nodeId, key) {
+    return key === "" ? nodeId : `${nodeId}${chunkSeparator}${key}`;
+}
+function embeddings(result, expected) {
+    if (typeof result !== "object" ||
+        result === null ||
+        !("data" in result) ||
+        !Array.isArray(result.data) ||
+        // ⚠️ The count is part of the check. The rows come back in the order the texts went out and
+        // nothing else identifies them, so a short answer would silently pair every embedding after the
+        // gap with the wrong card — a search that answers confidently with the neighbouring task.
+        result.data.length !== expected ||
+        // ⚠️ And every row has to hold something. An empty one passes "is an array of numbers" and would
+        // be upserted under a real card's name as a vector that matches nothing — indexed, recorded as
+        // fingerprinted, and never looked at again until somebody edits that card.
+        !result.data.every((row) => Array.isArray(row) && row.length > 0 && row.every((value) => typeof value === "number"))) {
+        throw new Error("The embedding provider returned an invalid response");
+    }
+    return result.data;
+}
+function matches(result) {
+    if (typeof result !== "object" ||
+        result === null ||
+        !("matches" in result) ||
+        !Array.isArray(result.matches)) {
+        throw new Error("The semantic index returned an invalid response");
+    }
+    return result.matches.flatMap((match) => {
+        if (typeof match !== "object" ||
+            match === null ||
+            !("id" in match) ||
+            typeof match.id !== "string" ||
+            !("score" in match) ||
+            typeof match.score !== "number") {
+            return [];
+        }
+        const separator = match.id.indexOf(chunkSeparator);
+        return [
+            {
+                nodeId: separator < 0 ? match.id : match.id.slice(0, separator),
+                chunkKey: separator < 0 ? "" : match.id.slice(separator + 1),
+                score: Math.max(0, Math.min(1, match.score)),
+            },
+        ];
+    });
+}
+function batched(chunks) {
+    const batches = [];
+    let current = [];
+    let characters = 0;
+    for (const chunk of chunks) {
+        if (current.length > 0 &&
+            (current.length >= maxBatchTexts || characters >= maxBatchCharacters)) {
+            batches.push(current);
+            current = [];
+            characters = 0;
+        }
+        current.push(chunk);
+        characters += chunk.text.length;
+    }
+    if (current.length > 0)
+        batches.push(current);
+    return batches;
+}
+export function createSemanticIndex(deps) {
+    const model = deps.model ?? defaultModel;
+    // Every embedding request carries it, both the write side and the search side (anchrd/intel#800).
+    const gateway = { id: deps.gateway };
+    async function embed(texts) {
+        return embeddings(await deps.ai.run(model, { text: texts }, { gateway }), texts.length);
+    }
+    return {
+        async upsert(target, chunks) {
+            const vectors = [];
+            for (const batch of batched(chunks)) {
+                const values = await embed(batch.map((chunk) => chunk.text.slice(0, maxEmbeddingCharacters)));
+                batch.forEach((chunk, index) => {
+                    const embedded = values[index];
+                    // The index is what makes this reachable at all — `embeddings` has already refused a short
+                    // answer and an empty row, so this is the type system's question rather than the
+                    // provider's. It throws anyway rather than skipping: the alternative to a missing card is
+                    // never a shorter list, it is a card recorded as fingerprinted with no vector behind it.
+                    if (!embedded)
+                        throw new Error("The embedding provider returned an invalid response");
+                    vectors.push({
+                        id: vectorId(target.nodeId, chunk.key),
+                        values: embedded,
+                        metadata: { versionId: target.versionId },
+                    });
+                });
+            }
+            for (let offset = 0; offset < vectors.length; offset += maxVectorsPerCall) {
+                await deps.index.upsert(vectors.slice(offset, offset + maxVectorsPerCall));
+            }
+        },
+        async remove(nodeId, keys) {
+            const ids = keys.map((key) => vectorId(nodeId, key));
+            for (let offset = 0; offset < ids.length; offset += maxVectorsPerCall) {
+                await deps.index.deleteByIds(ids.slice(offset, offset + maxVectorsPerCall));
+            }
+        },
+        async search(query, limit) {
+            const [vector] = await embed([query]);
+            if (!vector)
+                throw new Error("The embedding provider returned an invalid response");
+            const result = await deps.index.query(vector, {
+                topK: Math.max(1, Math.min(100, limit)),
+                returnMetadata: "none",
+            });
+            return matches(result);
+        },
+    };
+}

package/dist/adapters/semantic-index/semantic-index.types.d.ts

@@ -0,0 +1,56 @@
+import type { NodeIndexTarget } from "../../nodes/nodes.types.js";
+export interface WorkersAiBinding {
+    run(model: string, input: {
+        text: string[];
+    }, options: {
+        gateway: {
+            id: string;
+        };
+    }): Promise<unknown>;
+}
+export interface VectorizeBinding {
+    upsert(vectors: Array<{
+        id: string;
+        values: number[];
+        metadata: {
+            versionId: string;
+        };
+    }>): Promise<unknown>;
+    deleteByIds(ids: string[]): Promise<unknown>;
+    query(vector: number[], options: {
+        topK: number;
+        returnMetadata: "none";
+    }): Promise<unknown>;
+}
+/**
+ * One vector's worth of a node (anchrd/intel#301).
+ *
+ * ⚠️ `key` is `""` for a node that carries exactly one vector — every kind but `board` — and the
+ * vector is then named by the bare node id it has always been named by. A board card carries its
+ * task id, and its vector is `<node id>#<task id>`.
+ *
+ * `text` is embedded verbatim. Composing it — the node's title in front of a document's body, the
+ * card's own title in front of a card — belongs to the indexing pass rather than here, because the
+ * same string has to be fingerprinted there to decide whether this vector needs making at all. A
+ * title prefixed on this side would sit outside that fingerprint and change nothing when it changed.
+ */
+export interface SemanticChunk {
+    key: string;
+    text: string;
+}
+export interface SemanticHit {
+    nodeId: string;
+    chunkKey: string;
+    score: number;
+}
+export interface SemanticIndex {
+    upsert(target: NodeIndexTarget, chunks: SemanticChunk[]): Promise<void>;
+    remove(nodeId: string, keys: string[]): Promise<void>;
+    search(query: string, limit: number): Promise<SemanticHit[]>;
+}
+export interface SemanticIndexDeps {
+    ai: WorkersAiBinding;
+    index: VectorizeBinding;
+    gateway: string;
+    model?: string;
+}

package/dist/adapters/semantic-index/semantic-index.types.js

@@ -0,0 +1 @@
+export {};

package/dist/adapters/session-cookie/session-cookie.d.ts

@@ -0,0 +1,5 @@
+import type { SessionCodec } from "../../auth/auth.types.js";
+export declare function createSessionCodec(deps: {
+    secret: string;
+    crypto: Crypto;
+}): SessionCodec;

package/dist/adapters/session-cookie/session-cookie.js

@@ -0,0 +1,87 @@
+import { z } from "zod";
+import { SafeReturnPath } from "../../shared/safe-return-path/safe-return-path.js";
+const PendingSession = z.strictObject({
+    version: z.literal(1),
+    kind: z.literal("pending"),
+    clientId: z.string().min(1),
+    codeVerifier: z.string().min(43),
+    state: z.string().min(16),
+    returnTo: SafeReturnPath,
+    expiresAt: z.number().int().positive(),
+});
+const UserSession = z.strictObject({
+    version: z.literal(1),
+    kind: z.literal("user"),
+    clientId: z.string().min(1),
+    accessToken: z.string().min(1),
+    expiresAt: z.number().int().positive(),
+});
+const ConnectionPendingSession = z.strictObject({
+    version: z.literal(1),
+    kind: z.literal("connection-pending"),
+    clientId: z.string().min(1),
+    codeVerifier: z.string().min(43),
+    state: z.string().min(16),
+    returnTo: SafeReturnPath,
+    issuer: z.url(),
+    resource: z.url(),
+    userId: z.string().min(1),
+    user: UserSession,
+    // Older cookies carry no `silent`, and one in flight across a deploy must not become an invalid
+    // session: absent means the visible flow, which is what those attempts were.
+    silent: z.boolean().default(false),
+    // Same for `resumed`: absent means a first attempt, so a handoff written before the deploy still
+    // gets its one restart rather than dying at the parser.
+    resumed: z.boolean().default(false),
+    expiresAt: z.number().int().positive(),
+});
+const Session = z.discriminatedUnion("kind", [
+    PendingSession,
+    ConnectionPendingSession,
+    UserSession,
+]);
+const additionalData = new TextEncoder().encode("anchrd-intel-session-v1");
+function encode(bytes) {
+    let value = "";
+    for (const byte of bytes)
+        value += String.fromCharCode(byte);
+    return btoa(value).replaceAll("+", "-").replaceAll("/", "_").replace(/=+$/, "");
+}
+function decode(value) {
+    const padded = value
+        .replaceAll("-", "+")
+        .replaceAll("_", "/")
+        .padEnd(Math.ceil(value.length / 4) * 4, "=");
+    return Uint8Array.from(atob(padded), (character) => character.charCodeAt(0));
+}
+export function createSessionCodec(deps) {
+    if (new TextEncoder().encode(deps.secret).byteLength < 32) {
+        throw new Error("INTEL_SESSION_SECRET must contain at least 32 bytes");
+    }
+    const key = deps.crypto.subtle
+        .digest("SHA-256", new TextEncoder().encode(deps.secret))
+        .then((hash) => deps.crypto.subtle.importKey("raw", hash, "AES-GCM", false, ["encrypt", "decrypt"]));
+    return {
+        async seal(value) {
+            const session = Session.parse(value);
+            const iv = deps.crypto.getRandomValues(new Uint8Array(12));
+            const encrypted = new Uint8Array(await deps.crypto.subtle.encrypt({ name: "AES-GCM", iv, additionalData }, await key, new TextEncoder().encode(JSON.stringify(session))));
+            const output = new Uint8Array(iv.byteLength + encrypted.byteLength);
+            output.set(iv);
+            output.set(encrypted, iv.byteLength);
+            return encode(output);
+        },
+        async open(value) {
+            try {
+                const input = decode(value);
+                if (input.byteLength <= 28)
+                    return null;
+                const decrypted = await deps.crypto.subtle.decrypt({ name: "AES-GCM", iv: input.slice(0, 12), additionalData }, await key, input.slice(12));
+                return Session.parse(JSON.parse(new TextDecoder().decode(decrypted)));
+            }
+            catch {
+                return null;
+            }
+        },
+    };
+}

package/dist/adapters/tool-source-policy/tool-source-policy.d.ts

@@ -0,0 +1 @@
+export declare function createToolSourcePolicy(configuredOrigins: string | undefined): (sourceUrl: string) => boolean;

package/dist/adapters/tool-source-policy/tool-source-policy.js

@@ -0,0 +1,22 @@
+export function createToolSourcePolicy(configuredOrigins) {
+    const origins = new Set((configuredOrigins ?? "")
+        .split(",")
+        .map((value) => value.trim())
+        .filter(Boolean)
+        .map((value) => {
+        const url = new URL(value);
+        if (url.username || url.password || (url.pathname !== "/" && url.pathname !== "")) {
+            throw new Error("TOOL_SOURCE_ORIGINS must contain exact origins without credentials or paths");
+        }
+        return url.origin;
+    }));
+    // A malformed URL is not an allowed origin, so the policy answers false instead of throwing.
+    return (sourceUrl) => {
+        try {
+            return origins.has(new URL(sourceUrl).origin);
+        }
+        catch {
+            return false;
+        }
+    };
+}

package/dist/audit/audit.d.ts

@@ -0,0 +1,2 @@
+import type { AuditDeps, AuditService } from "./audit.types.js";
+export declare function createAudit(deps: AuditDeps): AuditService;

package/dist/audit/audit.js

@@ -0,0 +1,87 @@
+import { IntelError } from "../shared/intel-error/intel-error.js";
+// The separator inside the encoded cursor. `\0` cannot occur in either half: an ISO timestamp
+// is digits and punctuation, an Intel id is Crockford base32. Splitting on the FIRST occurrence
+// would still be safe, but there is no occurrence to split on.
+const SEPARATOR = "\0";
+/**
+ * The pair, made into one string a reader cannot take apart by accident.
+ *
+ * ⚠️ This is not encryption and does not pretend to be. Anyone determined can decode base64url and
+ * read a timestamp. The point is the accident, not the attacker: a cursor that LOOKS like a
+ * timestamp invites a caller to send a timestamp, and a timestamp alone loses every second event
+ * written in the same millisecond. Making the shape unusable by hand is what keeps the pair whole.
+ */
+function encodeCursor(position) {
+    const raw = `${position.occurredAt}${SEPARATOR}${position.id}`;
+    return btoa(String.fromCharCode(...new TextEncoder().encode(raw)))
+        .replaceAll("+", "-")
+        .replaceAll("/", "_")
+        .replaceAll("=", "");
+}
+function decodeCursor(cursor) {
+    // A cursor comes back from a consumer that stored it, possibly weeks ago, possibly truncated by
+    // whatever stored it. Every failure below is the same answer: this is not a cursor this service
+    // handed out. Guessing a position from a damaged one would silently move the reader — forward
+    // past unread events, or backward into duplicates.
+    const refuse = () => new IntelError(400, "invalid_cursor", "The cursor is not one this service issued. Pass back the nextCursor from a previous response unchanged, or omit it to start from the beginning.");
+    let raw;
+    try {
+        const padded = cursor.replaceAll("-", "+").replaceAll("_", "/");
+        const binary = atob(padded + "=".repeat((4 - (padded.length % 4)) % 4));
+        raw = new TextDecoder().decode(Uint8Array.from(binary, (c) => c.charCodeAt(0)));
+    }
+    catch {
+        throw refuse();
+    }
+    const separator = raw.indexOf(SEPARATOR);
+    if (separator <= 0 || separator === raw.length - 1)
+        throw refuse();
+    const occurredAt = raw.slice(0, separator);
+    const id = raw.slice(separator + 1);
+    // ⚠️ Both halves are checked, not just the split. A cursor whose timestamp decoded to an empty
+    // string would compare as "before everything" and quietly replay the whole journal.
+    if (occurredAt.length === 0 || id.length === 0)
+        throw refuse();
+    return { occurredAt, id };
+}
+export function createAudit(deps) {
+    return {
+        async list(actor, input) {
+            const after = input.after === undefined ? null : decodeCursor(input.after);
+            // ⚠️ The refusal that stood here until #774 is GONE, and it was doing real work: it named
+            // `node` explicitly so that widening the contract enum could not silently route flow events
+            // through the node visibility walk. What replaces it is not trust but a repository that takes
+            // the kind as an argument and picks a statement per kind — each with its own walk, none able
+            // to answer for another. Adding a fourth kind to the enum is now a type error there rather
+            // than a wrong answer here, which is the stronger version of the same guard.
+            //
+            // One more row than asked for, so "is there another page" is answered by the same authorized
+            // query instead of a second one that could disagree with it.
+            const page = await deps.audit.listEvents(actor, {
+                after,
+                resourceType: input.resourceType,
+                limit: input.limit + 1,
+            });
+            const hasMore = page.events.length > input.limit;
+            const events = hasMore ? page.events.slice(0, input.limit) : page.events;
+            const last = events.at(-1);
+            return {
+                events,
+                /**
+                 * ⚠️ The cursor is the LAST DELIVERED row, never the probe row that was dropped. Taking it
+                 * from the probe would skip exactly one event per page — the classic off-by-one that shows
+                 * up as a lead nobody contacted, not as an error.
+                 *
+                 * ⚠️ **And it is returned whenever rows were delivered, not only when more follows.** It
+                 * used to carry `hasMore &&`, which meant a reader catching up received fifty events and no
+                 * position: it started over on its next run and would have delivered the same fifty for
+                 * ever. A reader paging through never sees it, because it always asks for a full page —
+                 * which is why this survived until `anchrd/signals` read the journal for real (`#793`).
+                 */
+                nextCursor: last === undefined ? null : encodeCursor(last),
+                // Whether another page may follow. Its own field, because it is its own question.
+                hasMore,
+            };
+        },
+    };
+}

package/dist/audit/audit.types.d.ts

@@ -0,0 +1,23 @@
+import type { AuditEvent, AuditListRequest, AuditListResponse, AuditResourceType } from "../contract/audit.js";
+import type { Actor } from "../nodes/nodes.types.js";
+export interface AuditPosition {
+    occurredAt: string;
+    id: string;
+}
+export interface AuditQuery {
+    after: AuditPosition | null;
+    resourceType: AuditResourceType;
+    limit: number;
+}
+export interface AuditPage {
+    events: AuditEvent[];
+}
+export interface AuditRepository {
+    listEvents(actor: Actor, query: AuditQuery): Promise<AuditPage>;
+}
+export interface AuditDeps {
+    audit: AuditRepository;
+}
+export interface AuditService {
+    list(actor: Actor, input: AuditListRequest): Promise<AuditListResponse>;
+}

package/dist/audit/audit.types.js

@@ -0,0 +1 @@
+export {};

package/dist/auth/auth.d.ts

@@ -0,0 +1,2 @@
+import type { BrowserAuth, BrowserAuthDeps } from "./auth.types.js";
+export declare function createBrowserAuth(deps: BrowserAuthDeps): BrowserAuth;