@anchrd/intel 0.59.0

package/dist/adapters/cloudflare/cloudflare-flow-workflow.js

@@ -0,0 +1,89 @@
+// The runtime module is provided by workerd and intentionally has no Node package resolution path.
+// @ts-expect-error cloudflare:workers is available inside the deployed Worker runtime.
+import { WorkflowEntrypoint as RuntimeWorkflowEntrypoint } from "cloudflare:workers";
+class WorkflowEntrypoint extends RuntimeWorkflowEntrypoint {
+}
+/**
+ * How long a run may stand on one step before nobody is working on it any more (#83).
+ *
+ * ⚠️ This is a product decision and not a constant somebody may tune while reading the code. Too
+ * short is worse than the problem it fixes: it ends runs that were only slow, which destroys work
+ * instead of merely displaying it wrongly. 30 minutes covers a large document, a sluggish API and
+ * a person who walks away from an approval; it does not cover a tab that was closed yesterday.
+ *
+ * The deployment may override it with `FLOW_RUN_STALL_TIMEOUT` (a Workflows duration, e.g. "2
+ * hours"), which is what makes the figure readable in operation rather than buried here.
+ */
+const DefaultStallTimeout = "30 minutes";
+/**
+ * What the durable wait actually does, with storage handed in.
+ *
+ * ⚠️ Separated from the class because `WorkflowEntrypoint` is a runtime class that cannot be
+ * constructed outside workerd's workflow context — so as long as this logic lived inside it, none
+ * of it could be tested, including the rule that keeps a caller alive while its child runs. That
+ * rule is the one that decides whether this feature destroys work or not, and it had to be
+ * provable. The shell below is now only bindings and SQL, which is what `CLAUDE.md` asks of it.
+ */
+export async function driveFlowRun(step, deps) {
+    const fail = async (name, error) => await step.do(name, async () => {
+        await deps.markFailed(error);
+        return { status: "failed", error };
+    });
+    for (let iteration = 0; iteration < 500; iteration += 1) {
+        const state = await step.do(`inspect flow run ${iteration}`, async () => await deps.readStatus());
+        if (["completed", "failed", "cancelled"].includes(state.status))
+            return state;
+        try {
+            await step.waitForEvent(`wait for flow run ${iteration}`, {
+                type: "advance",
+                // ⚠️ The clock starts HERE, which is what makes it "since the last step" rather than "since
+                // the run began": every `advance` returns to the top of the loop and waits anew. A flow
+                // with one genuinely long step is measured against that step, not against its total length.
+                timeout: deps.stallTimeout,
+            });
+        }
+        catch {
+            // ⚠️ A caller standing on a sub-flow node looks exactly like a run nobody is working on — it
+            // is waiting, by design, for the called run to finish. Ending it here would tear down a
+            // caller because its child was slow, which is the one way this fix could destroy work rather
+            // than merely display it wrongly. So the timeout asks first, and waits again if a child is
+            // still going.
+            const waiting = await step.do(`check called run ${iteration}`, async () => await deps.hasRunningChild());
+            if (waiting)
+                continue;
+            return await fail(`expire flow run ${iteration}`, "Nothing has moved this run forward, so it was ended. Whatever was running it stopped without reporting a result — start it again if it is still needed.");
+        }
+    }
+    return await fail("fail flow step limit", "Flow exceeded the maximum durable step count");
+}
+class IntelFlowWorkflowImplementation extends WorkflowEntrypoint {
+    async run(event, step) {
+        const runId = event.payload.runId;
+        return await driveFlowRun(step, {
+            readStatus: async () => {
+                const row = await this.env.DB.prepare("SELECT status, error FROM flow_runs WHERE id = ?")
+                    .bind(runId)
+                    .first();
+                return row ?? { status: "failed", error: "Flow run disappeared" };
+            },
+            hasRunningChild: async () => {
+                const row = await this.env.DB.prepare(`SELECT id FROM flow_runs
+          WHERE parent_run_id = ? AND status IN ('queued', 'running')
+          LIMIT 1`)
+                    .bind(runId)
+                    .first();
+                return row !== null;
+            },
+            markFailed: async (error) => {
+                const occurredAt = new Date().toISOString();
+                await this.env.DB.prepare(`UPDATE flow_runs
+          SET status = 'failed', error = ?, completed_at = ?, updated_at = ?
+          WHERE id = ? AND status NOT IN ('completed', 'failed', 'cancelled')`)
+                    .bind(error, occurredAt, occurredAt, runId)
+                    .run();
+            },
+            stallTimeout: this.env.FLOW_RUN_STALL_TIMEOUT || DefaultStallTimeout,
+        });
+    }
+}
+export const IntelFlowWorkflow = IntelFlowWorkflowImplementation;

package/dist/adapters/cloudflare/cloudflare.d.ts

@@ -0,0 +1,29 @@
+import type { DocumentConverter } from "../document-converter/document-converter.types.js";
+import type { SemanticIndex } from "../semantic-index/semantic-index.types.js";
+import type { CloudflareEnv, CloudflareExecutionContext, IndexQueueBatch } from "./cloudflare.types.js";
+export { IntelFlowWorkflow } from "./cloudflare-flow-workflow.js";
+export declare function isSpaNavigation(request: Request): boolean;
+/**
+ * The two ports that call Workers AI, and the one condition that decides whether they exist at all
+ * (#800).
+ *
+ * ⚠️ **No gateway id, no ports.** The obvious spelling would have been to pass the gateway when
+ * there is one and call Workers AI directly when there is not — and that is precisely the silent
+ * bypass the spend limit exists against: the deployment keeps embedding on every save and every
+ * `reindex`, the gateway counts none of it, and nobody notices because everything works. A missing
+ * semantic index is a state this repository already knows and describes (see the bindings table in
+ * the package README); an unmetered one is not.
+ *
+ * ⚠️ Both ports fall away together, because both call Workers AI: the embeddings through `run` and
+ * the attachment conversion through `toMarkdown`. Repairing only the first half would have left a
+ * second door open on the same account.
+ */
+export declare function createAiPorts(env: CloudflareEnv): {
+    semantic: SemanticIndex | undefined;
+    converter: DocumentConverter | undefined;
+};
+declare const _default: {
+    fetch(request: Request, env: CloudflareEnv, _context: CloudflareExecutionContext): Promise<Response>;
+    queue(batch: IndexQueueBatch, env: CloudflareEnv): Promise<void>;
+};
+export default _default;

package/dist/adapters/cloudflare/cloudflare.js

@@ -0,0 +1,416 @@
+import { createGateClient } from "@anchrd/gate-sdk";
+import { ulid } from "ulid";
+import { createAudit } from "../../audit/audit.js";
+import { createBrowserAuth } from "../../auth/auth.js";
+import { createBoards, FIRST_DEFAULT_COLUMN } from "../../boards/boards.js";
+import { createBundle } from "../../bundle/bundle.js";
+import { serverOf } from "../../contract/tool.js";
+import { createFeed } from "../../feed/feed.js";
+import { createFlows } from "../../flows/flows.js";
+import { createIndexing, PermanentIndexingError } from "../../indexing/indexing.js";
+import { createIntel } from "../../intel/intel.js";
+import { createNodes } from "../../nodes/nodes.js";
+import { createPrompts } from "../../prompts/prompts.js";
+import { bearer } from "../../shared/gate-authorization/gate-authorization.js";
+import { IntelError } from "../../shared/intel-error/intel-error.js";
+import { sha256Hex } from "../../shared/sha256/sha256.js";
+import { createTools } from "../../tools/tools.js";
+import { createContentStore } from "../content/content.js";
+import { createNodeRepository } from "../db/db.js";
+import { createAuditRepository } from "../db/db-audit.js";
+import { createBoardRepository } from "../db/db-boards.js";
+import { createFeedRepository } from "../db/db-feed.js";
+import { createFlowRepository } from "../db/db-flows.js";
+import { createNodeIndexRepository } from "../db/db-indexing.js";
+import { createOAuthClientStore } from "../db/db-oauth.js";
+import { createPromptRepository } from "../db/db-prompts.js";
+import { createDocumentConverter } from "../document-converter/document-converter.js";
+import { createFlowRuntime } from "../flow-runtime/flow-runtime.js";
+import { createIndexQueue, IndexMessage } from "../index-queue/index-queue.js";
+import { createJsonSchemaValidator } from "../json-schema/json-schema.js";
+import { createOpenId } from "../openid/openid.js";
+import { createPortalTokenStore } from "../portal-tokens/portal-tokens.js";
+import { createRemoteTools } from "../remote-tools/remote-tools.js";
+import { createSemanticIndex } from "../semantic-index/semantic-index.js";
+import { createSessionCodec } from "../session-cookie/session-cookie.js";
+import { createToolSourcePolicy } from "../tool-source-policy/tool-source-policy.js";
+// biome-ignore lint/performance/noBarrelFile: The package entry must expose Wrangler's named Workflow class.
+export { IntelFlowWorkflow } from "./cloudflare-flow-workflow.js";
+const workerPrefixes = ["/api", "/auth", "/.well-known", "/mcp", "/health"];
+export function isSpaNavigation(request) {
+    if (request.method !== "GET" && request.method !== "HEAD")
+        return false;
+    if (!request.headers.get("accept")?.includes("text/html"))
+        return false;
+    const { pathname } = new URL(request.url);
+    return !workerPrefixes.some((prefix) => pathname === prefix || pathname.startsWith(`${prefix}/`));
+}
+// A missing variable would otherwise surface deep inside a request as an opaque URL or crypto
+// error. Naming it once here keeps a misconfigured deployment diagnosable.
+const requiredVariables = [
+    "GATE_URL",
+    "GATE_SERVICE_KEY",
+    "INTEL_URL",
+    "INTEL_SESSION_SECRET",
+    "TOOL_SOURCE_ORIGINS",
+];
+function assertConfigured(env) {
+    const missing = requiredVariables.filter((name) => !env[name]?.trim());
+    if (missing.length) {
+        throw new IntelError(500, "configuration_missing", `Intel is missing required configuration: ${missing.join(", ")}`);
+    }
+}
+/**
+ * The two ports that call Workers AI, and the one condition that decides whether they exist at all
+ * (#800).
+ *
+ * ⚠️ **No gateway id, no ports.** The obvious spelling would have been to pass the gateway when
+ * there is one and call Workers AI directly when there is not — and that is precisely the silent
+ * bypass the spend limit exists against: the deployment keeps embedding on every save and every
+ * `reindex`, the gateway counts none of it, and nobody notices because everything works. A missing
+ * semantic index is a state this repository already knows and describes (see the bindings table in
+ * the package README); an unmetered one is not.
+ *
+ * ⚠️ Both ports fall away together, because both call Workers AI: the embeddings through `run` and
+ * the attachment conversion through `toMarkdown`. Repairing only the first half would have left a
+ * second door open on the same account.
+ */
+export function createAiPorts(env) {
+    const gateway = env.AI_GATEWAY_ID?.trim();
+    if (!env.AI || !gateway)
+        return { semantic: undefined, converter: undefined };
+    return {
+        // Vectorize stays its own condition: without an index to write into there is nothing to embed
+        // for, and that half of the answer predates this ticket.
+        semantic: env.SEARCH
+            ? createSemanticIndex({ ai: env.AI, index: env.SEARCH, gateway })
+            : undefined,
+        converter: createDocumentConverter({ ai: env.AI, gateway }),
+    };
+}
+export default {
+    async fetch(request, env, _context) {
+        if (env.ASSETS && isSpaNavigation(request)) {
+            return await env.ASSETS.fetch(new Request(new URL("/", request.url), { method: "GET" }));
+        }
+        assertConfigured(env);
+        const now = () => new Date();
+        const { semantic } = createAiPorts(env);
+        // Built before the tree because the tree has to ask it one question: who calls into a folder
+        // from outside it. The repository knows no service, so this stays one direction of dependency.
+        const flowRepository = createFlowRepository({ db: env.DB, now });
+        const nodeRepository = createNodeRepository({ db: env.DB, now });
+        const auditRepository = createAuditRepository({ db: env.DB, now });
+        const feedRepository = createFeedRepository({ db: env.DB, now });
+        const boardRepository = createBoardRepository({ db: env.DB, now });
+        const contentStore = createContentStore(env.CONTENT);
+        const gate = createGateClient({ url: env.GATE_URL, serviceKey: env.GATE_SERVICE_KEY });
+        const oauth = createOpenId({
+            fetch: globalThis.fetch.bind(globalThis),
+            allowInsecure: env.ALLOW_INSECURE_OAUTH === "true",
+        });
+        const intelResource = `${env.INTEL_URL.replace(/\/+$/, "")}/mcp`;
+        const portalUrl = env.MCP_PORTAL_URL?.trim() || null;
+        const portalTokens = createPortalTokenStore({
+            db: env.DB,
+            secret: env.INTEL_SESSION_SECRET,
+            crypto,
+            now,
+        });
+        const tools = createTools({
+            portalUrl,
+            remote: createRemoteTools({ fetch: globalThis.fetch.bind(globalThis) }),
+            tokens: portalTokens,
+            refresh: async (token) => {
+                try {
+                    const refreshed = await oauth.refresh({
+                        issuer: token.issuer,
+                        clientId: token.clientId,
+                        resource: token.resource,
+                        refreshToken: token.refreshToken ?? "",
+                    });
+                    return {
+                        ...token,
+                        accessToken: refreshed.accessToken,
+                        refreshToken: refreshed.refreshToken ?? token.refreshToken,
+                        expiresAt: now().getTime() + Math.max(30, refreshed.expiresIn) * 1_000,
+                    };
+                }
+                catch {
+                    // A refusal from the portal's issuer means the grant is gone; the caller drops the token
+                    // and asks the user to reconnect rather than retrying a dead credential.
+                    return null;
+                }
+            },
+            now,
+            validate: createJsonSchemaValidator(),
+            sourceAllowed: createToolSourcePolicy(env.TOOL_SOURCE_ORIGINS),
+            fingerprint: async (value) => {
+                return await sha256Hex(crypto, JSON.stringify(value));
+            },
+        });
+        const nodes = createNodes({
+            repository: nodeRepository,
+            content: contentStore,
+            id: ulid,
+            now,
+            // ⚠️ The REPOSITORY, not the board service — that is what keeps this from being a cycle. The
+            // board service needs the node service to create a task; the node service needs only the two
+            // reads below to file one.
+            // ⚠️ `"write"` for the same reason as below: this answers "may this actor file a card here",
+            // not "may they look at it". Reading it with `"read"` would let somebody nest a card under a
+            // task on a board they may only look at.
+            boardOfTask: async (who, taskId) => (await boardRepository.taskRow(who, taskId, "write"))?.boardId ?? null,
+            attachToBoard: async (who, taskId, boardId, occurredAt) => {
+                // ⚠️ `"write"` — the actor is filing a task on this board, and the board's own creation
+                // path is a write too. `"read"` here would put back exactly the hole #649 found.
+                const columns = await boardRepository.columnsOf(who, boardId, "write");
+                // `null` means the parent is not a board this actor may read — then there is nothing to
+                // file the task on, and the node stands on its own. That is the folder case, and it is
+                // silent on purpose: a `task` filed in a plain folder is unusual, not an error.
+                if (columns === null)
+                    return;
+                const status = columns[0] ?? FIRST_DEFAULT_COLUMN;
+                await boardRepository.attach({
+                    nodeId: taskId,
+                    boardId,
+                    status,
+                    assigneeId: null,
+                    labels: [],
+                    startDate: null,
+                    dueDate: null,
+                    dependsOn: null,
+                    position: await boardRepository.nextPosition(boardId, status),
+                    occurredAt,
+                });
+            },
+            indexing: createIndexQueue(env.INDEXING),
+            semantic,
+            externalFlowCallers: async (who, folderId) => await flowRepository.externalCallers(who, folderId),
+            flowNodeReferences: async (who, folderId) => await flowRepository.nodeReferences(who, folderId),
+            // ⚠️ The real one, like its two neighbours: the refusal is only worth anything if it reads
+            // real published graphs and the real visibility predicate (#457).
+            flowsUsingNode: async (who, nodeId) => await flowRepository.flowsUsingNode({ ...who, canRun: true }, nodeId),
+            // ⚠️ `canExecute: true` is not a permission being granted here — the servers list touches
+            // nothing and executes nothing. It exists because `ToolActor` carries the flag for the one
+            // method that needs it, and a `false` would read as if listing were gated on execution.
+            toolServers: async (who) => {
+                const catalog = await tools.servers({ id: who.id, email: who.email, canExecute: true });
+                return catalog.items.map((server) => server.handle);
+            },
+            hash: async (content) => {
+                const source = typeof content === "string"
+                    ? new TextEncoder().encode(content)
+                    : Uint8Array.from(content).buffer;
+                return await sha256Hex(crypto, source);
+            },
+        });
+        const auth = createBrowserAuth({
+            baseUrl: env.INTEL_URL,
+            gateUrl: env.GATE_URL,
+            resource: intelResource,
+            oauth,
+            clients: createOAuthClientStore(env.DB),
+            sessions: createSessionCodec({ secret: env.INTEL_SESSION_SECRET, crypto }),
+            portalUrl,
+            portalTokens,
+            now,
+        });
+        const flows = createFlows({
+            repository: flowRepository,
+            runtime: createFlowRuntime(env.FLOWS),
+            id: ulid,
+            now,
+            folderAccess: async (actor, folderId) => await nodes.folderAccess(actor, folderId),
+            // ⚠️ Straight to the repository, past the node service: this one question is asked WITHOUT the
+            // visibility predicate on purpose (#733), and a service method taking an actor would invite
+            // somebody to hand one in.
+            parentArchivedAt: async (folderId) => await nodeRepository.parentArchivedAt(folderId),
+            nodeChildren: async (actor, folderId, limit) => await nodes.childrenBounded(actor, { parentId: folderId, limit }),
+            // The tree's own visibility lookup, unchanged on the way through: the relation graph, the
+            // requirements list and every tree link of every run read this one answer, so none of
+            // them can be kinder than the others.
+            visibleNodes: async (actor, nodeId) => await nodes.visibleNode(actor, nodeId),
+            // The outer ring of the relation graph (#825), straight to the repository like
+            // `parentArchivedAt` above: the graph has already proven a node visible through `visibleNodes`
+            // by the time it asks either of these, so there is nothing left for a service-level wrapper to
+            // add beyond what `nodes.ts:1537` already checks for `node_effective_access_list`.
+            nodeShareable: async (actor, nodeId) => await nodeRepository.can(actor, nodeId, "share"),
+            nodeEffectiveAccess: async (nodeId) => await nodeRepository.listEffectiveAccess(nodeId),
+            /**
+             * ⚠️ The fingerprint of a whole SURFACE, not of one tool (#489). A step names a server and
+             * optionally the functions of it it may use, so what publishing freezes is that set — every
+             * covered function's own fingerprint, sorted so the order the portal happens to answer in
+             * cannot change the result, and hashed into one value.
+             *
+             * `null` in three cases, and all three have to refuse a publish: the catalog is unreachable,
+             * the server offers this user nothing, or a function the step explicitly allows is gone. The
+             * last one matters most — a narrowed step whose function disappeared is not a step that may
+             * quietly fall back to the rest of the server.
+             */
+            toolSurfaceFingerprint: async (actor, server, allow) => {
+                const catalog = await tools
+                    .catalog({ id: actor.id, email: actor.email, canExecute: true })
+                    .catch(() => null);
+                if (!catalog)
+                    return null;
+                const reachable = new Map(catalog.items.map((item) => [item.name, item.fingerprint]));
+                const covered = allow === null
+                    ? [...reachable.keys()].filter((name) => serverOf(name, [server]) !== null)
+                    : allow;
+                if (covered.length === 0)
+                    return null;
+                const parts = [];
+                for (const name of [...new Set(covered)].sort()) {
+                    const fingerprint = reachable.get(name);
+                    if (!fingerprint)
+                        return null;
+                    parts.push(`${name}:${fingerprint}`);
+                }
+                // ⚠️ The handle and the narrowing mode are part of what is hashed, not just the covered
+                // functions. Without them two different surfaces could collide: a server whose only
+                // function is allowed explicitly would hash the same as the same server left open, and the
+                // difference between "this one function" and "whatever this server offers" is exactly what
+                // publishing is meant to freeze.
+                const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode([server, allow === null ? "*" : "allow", ...parts].join("\n")));
+                return [...new Uint8Array(digest)].map((b) => b.toString(16).padStart(2, "0")).join("");
+            },
+            // Which of the named servers this user does NOT reach. A server is reached when the live
+            // catalog carries at least one function of it — the same live answer the tool surface uses,
+            // never a mirrored table.
+            // ⚠️ The catalog error is NOT caught here, and that is the whole point. Answering an
+            // unreadable portal with "all of them are missing" turns an outage into a sentence about
+            // PERMISSIONS — the reader goes asking for access they already have, while the portal is
+            // simply down. `tools.catalog` already tells the two apart (`tool_catalog_unreadable`,
+            // `portal_not_connected`), and letting that answer through is the same rule the tool surface
+            // keeps one screen up: a sentence more specific than the evidence sends the reader looking in
+            // the wrong place.
+            unavailableServers: async (actor, servers) => {
+                if (servers.length === 0)
+                    return [];
+                const catalog = await tools.catalog({ id: actor.id, email: actor.email, canExecute: true });
+                return servers.filter((server) => !catalog.items.some((item) => serverOf(item.name, [server]) !== null));
+            },
+        });
+        return await createIntel({
+            baseUrl: env.INTEL_URL,
+            gateUrl: env.GATE_URL,
+            gate,
+            nodes,
+            flows,
+            tools,
+            audit: createAudit({ audit: auditRepository }),
+            feed: createFeed({ feed: feedRepository }),
+            /**
+             * The slash-command catalogue (#775). It reads its own rows through its own repository and
+             * borrows exactly one thing from the node service: reading one document, with the
+             * authorization walk that service already performs. A second reader into R2 here would be a
+             * second place for that ACL to be applied, and the one that gets it wrong is the one nobody
+             * looks at.
+             */
+            prompts: createPrompts({
+                repository: createPromptRepository({ db: env.DB, now }),
+                // ⚠️ Handed on whole, and nothing is decided here. Turning a stored version into readable
+                // text is business behaviour, and this shell maps bindings — it does not get to know what a
+                // BlockNote payload is.
+                readDocument: async (actor, nodeId) => await nodes.get(actor, nodeId),
+            }),
+            boards: createBoards({
+                boards: boardRepository,
+                nodes,
+                now,
+                /**
+                 * The seam to gate's directory (#700, D70).
+                 *
+                 * ⚠️ BUILT HERE AND NOWHERE ELSE, because this is the only place that legitimately holds
+                 * the caller's bearer. `Actor` carries the resolved identity, never the credential that
+                 * produced it, and the board service must stay that way: it narrows what gate offers, it
+                 * does not get to speak for anybody.
+                 *
+                 * ⚠️ The token is resolved LAZILY and at most once. Two doors lead in and they answer
+                 * differently — `/mcp` and the API carry an `Authorization` header, the browser carries a
+                 * cookie the session has to be asked about — and doing that work eagerly would cost a
+                 * session read on every request that never opens a picker.
+                 *
+                 * ⚠️ No token means an EMPTY answer, never a throw. A picker with no names shows nothing;
+                 * a board that refuses to load because gate was slow is the worse outcome, and it would
+                 * take the whole screen with it.
+                 */
+                directory: (() => {
+                    let pending = null;
+                    const token = () => {
+                        pending ??= (async () => bearer(request.headers) ?? (await auth.resolve(request.headers))?.bearer ?? null)();
+                        return pending;
+                    };
+                    return {
+                        async search(query) {
+                            const value = await token();
+                            if (!value)
+                                return [];
+                            return await gate.directory.search(value, { q: query });
+                        },
+                        async resolve(ids) {
+                            const value = await token();
+                            if (!value)
+                                return [];
+                            return await gate.directory.resolve(value, { ids });
+                        },
+                    };
+                })(),
+            }),
+            bundle: createBundle({
+                repository: nodeRepository,
+                flows: flowRepository,
+                content: contentStore,
+                id: ulid,
+                now,
+                hash: async (content) => {
+                    const source = typeof content === "string"
+                        ? new TextEncoder().encode(content)
+                        : Uint8Array.from(content).buffer;
+                    return await sha256Hex(crypto, source);
+                },
+                indexing: createIndexQueue(env.INDEXING),
+            }),
+            auth,
+        }).fetch(request);
+    },
+    async queue(batch, env) {
+        const { semantic, converter } = createAiPorts(env);
+        const indexing = createIndexing({
+            repository: createNodeIndexRepository(env.DB),
+            content: createContentStore(env.CONTENT),
+            semantic,
+            converter,
+            hash: async (content) => await sha256Hex(crypto, content),
+            now: () => new Date(),
+        });
+        for (const message of batch.messages) {
+            const parsed = IndexMessage.safeParse(message.body);
+            if (!parsed.success) {
+                console.warn("Intel discarded an invalid indexing queue message");
+                message.ack();
+                continue;
+            }
+            try {
+                await indexing.index(parsed.data.versionId);
+                message.ack();
+            }
+            catch (error) {
+                if (error instanceof PermanentIndexingError) {
+                    console.warn("Intel discarded a permanently unindexable node version", {
+                        versionId: parsed.data.versionId,
+                        error: error.message,
+                    });
+                    message.ack();
+                    continue;
+                }
+                console.error("Intel indexing failed; Cloudflare retry policy will apply", {
+                    versionId: parsed.data.versionId,
+                    error: error instanceof Error ? error.message : "indexing_failed",
+                });
+                message.retry();
+            }
+        }
+    },
+};

package/dist/adapters/cloudflare/cloudflare.types.d.ts

@@ -0,0 +1,31 @@
+import type { R2Bucket } from "../content/content.types.js";
+import type { D1Database } from "../db/db.types.js";
+import type { MarkdownAiBinding } from "../document-converter/document-converter.types.js";
+import type { WorkflowBinding } from "../flow-runtime/flow-runtime.types.js";
+import type { IndexMessage } from "../index-queue/index-queue.js";
+import type { QueueBatch, QueueProducer } from "../index-queue/index-queue.types.js";
+import type { VectorizeBinding, WorkersAiBinding } from "../semantic-index/semantic-index.types.js";
+export interface CloudflareEnv {
+    ASSETS?: {
+        fetch(request: Request): Promise<Response>;
+    };
+    DB: D1Database;
+    CONTENT: R2Bucket;
+    INDEXING: QueueProducer<IndexMessage>;
+    FLOWS: WorkflowBinding;
+    AI?: WorkersAiBinding & MarkdownAiBinding;
+    SEARCH?: VectorizeBinding;
+    GATE_URL: string;
+    GATE_SERVICE_KEY: string;
+    INTEL_URL: string;
+    INTEL_SESSION_SECRET: string;
+    TOOL_SOURCE_ORIGINS: string;
+    MCP_PORTAL_URL?: string;
+    ALLOW_INSECURE_OAUTH?: string;
+    AI_GATEWAY_ID?: string;
+    FLOW_RUN_STALL_TIMEOUT?: string;
+}
+export interface CloudflareExecutionContext {
+    waitUntil(promise: Promise<unknown>): void;
+}
+export type IndexQueueBatch = QueueBatch<unknown>;

package/dist/adapters/cloudflare/cloudflare.types.js

@@ -0,0 +1 @@
+export {};

package/dist/adapters/content/content.d.ts

@@ -0,0 +1,3 @@
+import type { ContentStore } from "../../nodes/nodes.types.js";
+import type { R2Bucket } from "./content.types.js";
+export declare function createContentStore(bucket: R2Bucket): ContentStore;