@loopingai/core 0.7.0 → 0.8.0

package/README.md

@@ -39,11 +39,12 @@ optional is a plugin. Anything opinionated belongs to your app.
 npx looping-keys
 ```
 
-Set the private JWK as `A2A_SIGNING_KEY` (`.dev.vars` locally, `wrangler secret put`
-when deployed) and the origins you accept calls from as `GATEWAY_ORIGINS`:
+Set the private JWK as `A2A_SIGNING_KEY` (`.env` locally; `wrangler deploy
+--secrets-file .env` or `wrangler secret put` when deployed) and the origins you accept
+calls from as `GATEWAY_ORIGINS`:
 
 ```ini
-# .dev.vars
+# .env
 A2A_SIGNING_KEY={"crv":"Ed25519","d":"…","x":"…","kty":"OKP","kid":"a2a-2026-08-01"}
 GATEWAY_ORIGINS=["https://gateway.example.com"]
 ```
@@ -228,7 +229,6 @@ not drag in the A2A adapter, and the test harness cannot reach a production bund
 | `@loopingai/core/agent`        | session, history, models + Workers AI, inference, budget, control tools     |
 | `@loopingai/core/host`         | `LoopingAgent` — the Durable Object body — and `PluginHost`                 |
 | `@loopingai/core/round`        | the delegating round loop: `RoundAgentBase`, `runHandleTask`, `runTurn`     |
-| `@loopingai/core/anthropic`    | Claude as a second provider — _optional peer on `@anthropic-ai/sdk`_        |
 | `@loopingai/core/subtasks`     | delegation types, decomposition, the `delegate` tool                        |
 | `@loopingai/core/subagent`     | `RecipeSubagentBase`, resumable runs, fingerprinting, workspace             |
 | `@loopingai/core/db`           | `AgentDB`, `notify_tasks` + `subtasks` schema, migrations, `PluginStore`    |
@@ -268,6 +268,39 @@ makes the served document a fixed point under the repeated decoding a verifier
 performs. A gateway pins the card's `kid` + `jku` on first registration
 (Trust-On-First-Use).
 
+### Calling out, and knowing your own origin
+
+The same key proves this agent to services that are not the gateway — another agent,
+or any service that verifies against the published JWKS. `signCallerToken` mints the
+short-lived token for that: `iss` is
+this deployment's origin, `jku` is derived from it, and the audience is normalized to a
+bare origin because the far side compares it byte-for-byte.
+
+Its `iss` is **not** something to configure. Inside a Durable Object it is:
+
+```ts
+protected override modelRuntime(model: ModelConfig): ModelRuntime {
+  return myProvider(this.env, model, () => this.requireSelfOrigin());
+}
+```
+
+`requireSelfOrigin()` (and `selfOrigin()`, which returns `undefined` instead of
+throwing) answer with the origin core already delivers: the executor computes the
+callback `jku` from `new URL(request.url).origin`, and it rides every turn into the DO
+and on into each subagent facet. A `SELF_ORIGIN` secret only restates that, and has to
+be kept byte-identical with the verifier's allowlist by hand in every environment.
+
+The first turn an instance serves **pins** it, and nothing is persisted. Pinning is
+what makes it safe to read: turns run concurrently in one Durable Object and a
+credential thunk fires several frames below the turn that set the value, so a mutable
+field could hand one turn another's origin. An agent has one endpoint anyway — the one
+its card advertises and a verifier allowlists — and a fresh isolate on deploy re-learns
+it.
+
+It is known **inside a turn or a chunk**: `onStart`, a constructor and a scheduled
+callback all run before any request has said what this deployment is called, and
+`requireSelfOrigin()` throws there saying so.
+
 ---
 
 ## Plugins
@@ -466,7 +499,6 @@ await withDb("accepts a turn once", async (db) => {
 - **Bindings:** `AI`, one Durable Object, one Workflow
 - **Secrets:** `A2A_SIGNING_KEY`, `GATEWAY_ORIGINS`
 - **Peers, never bundled:** `agents`, `ai`, `workers-ai-provider`
-- **Optional peer:** `@anthropic-ai/sdk`, needed only by `@loopingai/core/anthropic`
 
 That last point is not stylistic: two copies of `agents` in one Worker breaks the
 `Session` / `SessionMessage` types and every `instanceof`. For local development

package/dist/a2a/caller-token.d.ts

@@ -5,6 +5,12 @@ export interface CallerTokenOptions {
      * This agent's own origin. It becomes `iss`, and `jku` is derived from it, and
      * the two must agree: a verifier that accepts a `jku` on a different origin
      * than `iss` lets one allowlisted origin impersonate another.
+     *
+     * **Not something to configure.** Inside a Durable Object it is
+     * `requireSelfOrigin()` — see {@link file://./self-origin.ts SelfOrigin},
+     * which learns it from the `jku` every turn already carries. A `SELF_ORIGIN`
+     * secret restates what the request path knows and has to be kept
+     * byte-identical with the verifier's allowlist by hand.
      */
     issuer: string;
     /**

package/dist/a2a/index.d.ts

@@ -24,6 +24,7 @@ export { A2A_RPC_PATH, buildBaseCard, signCard, wireCard, parsePrivateJwk, publi
 export { NOTIFICATION_TOKEN_HEADER, buildSubmittedTask, buildWorkingTask, buildCompletedTask, buildFailedTask, buildNoReplyCompletedTask, signCallbackJwt, postNotification } from "./notify.js";
 export { deliverTerminalTask, type DeliverTerminalOptions } from "./deliver.js";
 export { signCallerToken, type CallerTokenOptions } from "./caller-token.js";
+export { SelfOrigin } from "./self-origin.js";
 export { callerContext } from "./caller.js";
 export { createPushChannel, type PushChannel, type TurnPushContext } from "./push.js";
 export { taskStateLabel, type PlainArtifact, type PlainMessage, type PlainPart, type PlainStatus, type PlainTask } from "./task.js";

package/dist/a2a/index.js

@@ -24,6 +24,7 @@ export { A2A_RPC_PATH, buildBaseCard, signCard, wireCard, parsePrivateJwk, publi
 export { NOTIFICATION_TOKEN_HEADER, buildSubmittedTask, buildWorkingTask, buildCompletedTask, buildFailedTask, buildNoReplyCompletedTask, signCallbackJwt, postNotification } from "./notify.js";
 export { deliverTerminalTask } from "./deliver.js";
 export { signCallerToken } from "./caller-token.js";
+export { SelfOrigin } from "./self-origin.js";
 export { callerContext } from "./caller.js";
 export { createPushChannel } from "./push.js";
 export { taskStateLabel } from "./task.js";

package/dist/a2a/self-origin.d.ts

@@ -0,0 +1,91 @@
+/**
+ * This deployment's own public origin — learned from the request path, never
+ * configured.
+ *
+ * ## Why an agent needs it at all
+ *
+ * A Worker that only *answers* never needs to know its own name.
+ * {@link file://../worker/index.ts createA2AWorker} derives its audience, its
+ * card and its `jku` from `new URL(request.url).origin`, and none of it outlives
+ * the request. An agent that **calls out** mint-signed does need it:
+ * {@link file://./caller-token.ts signCallerToken} puts it in `iss` and derives
+ * the token's `jku` from it. That call happens inside a Durable Object, where
+ * there is no `Request` — which is the whole difficulty.
+ *
+ * The obvious answer is a `SELF_ORIGIN` secret, and it is the wrong one. It
+ * restates a value the request already carries, and it has to be kept
+ * byte-identical by hand with the origin allowlist on the far side, in every
+ * environment, forever. Every sibling that tried it took it back out —
+ * `looping-gateway` discovers its own origin from the first signature-verified
+ * request rather than being told, and a verifying Worker that once carried a
+ * configured audience replaced it with `url.origin`.
+ *
+ * ## Where the value comes from
+ *
+ * Core already sends the origin into the Durable Object on every turn, one field
+ * short of this use. `A2AExecutor` computes `jku` as `${origin}${jwksPath}` and
+ * it rides {@link file://./push.ts TurnPushContext} through the Workflow into
+ * `runTaskTurn` and `executeSubtaskChunk`.
+ *
+ * That is the same origin `signCallerToken` needs, and not by coincidence: a
+ * caller token's `jku` **must** be the JWKS the verifier fetches, and `iss` must
+ * agree with it — the third check in {@link file://./verify.ts verify.ts}. An
+ * origin derived from anywhere else is exactly what that check exists to catch,
+ * so deriving it from the `jku` core already serves makes the agreement
+ * structural instead of clerical.
+ *
+ * ## Pinned on the first turn, and in memory
+ *
+ * The first origin an isolate is told wins, and later ones are ignored. That is
+ * not laziness about staleness — it is what makes the value safe to *read*.
+ *
+ * A Durable Object's input gate stays open across a non-storage await, and this
+ * package runs concurrent RPCs into one object by design (`round/workflow.ts`
+ * runs a round's branches under `Promise.all`). Mutable instance state can
+ * therefore change while a turn is awaiting a model call, and the credential
+ * thunks that read this are lazy — they run several frames below the turn, when
+ * the client is built. Pinned, the field is immutable after its first write, so
+ * every concurrent reader in the isolate gets the same string and no turn can
+ * sign as another turn's origin.
+ *
+ * The cost of pinning is what an agent does not have: several identities. An
+ * agent has one endpoint — the one its card advertises, the one a gateway calls
+ * and a verifier allowlists — so there is nothing to follow. Note the asymmetry
+ * with a *verifier*, which derives the audience it expects per request and must
+ * not cache it: a verifier has to accept every hostname it answers on, while a
+ * signer needs one stable identity.
+ *
+ * Nothing is persisted, which is what keeps a pin from outliving its truth. An
+ * isolate is fresh on every `wrangler deploy` and recycles on its own, so a moved
+ * deployment re-learns its origin from the next turn it serves.
+ */
+export declare class SelfOrigin {
+    private observed?;
+    /**
+     * Offer the origin of an absolute URL seen on the request path — a `jku`, an
+     * endpoint, or a bare origin. Only `.origin` is kept, so a path or a trailing
+     * slash cannot reach a token claim.
+     *
+     * **The first usable value wins**; every later call is a no-op, including one
+     * naming a different origin. Called at each RPC entry and again when the push
+     * channel is built, so most calls are already no-ops — but the reason for the
+     * pin is the read side, not the write side. See the note above the class.
+     *
+     * Silently ignores anything unusable (absent, relative, or a scheme that has
+     * no meaningful origin), and an unusable value never pins: the parse comes
+     * first and the field is assigned only on success. This runs at the top of a
+     * turn, where a diagnostic value must never be the thing that fails it; the
+     * throw belongs at {@link require}, where something actually wanted the value.
+     */
+    note(url: string | undefined): void;
+    /** The pinned origin, or `undefined` when nothing has carried one yet. */
+    peek(): string | undefined;
+    /**
+     * The pinned origin, for a caller that cannot proceed without it.
+     *
+     * Throws naming the timing, because that is what the mistake always is: the
+     * value arrives with a turn, so `onStart`, a constructor and a scheduled
+     * callback all run before any request has said what this deployment is called.
+     */
+    require(): string;
+}

package/dist/a2a/self-origin.js

@@ -0,0 +1,114 @@
+/**
+ * This deployment's own public origin — learned from the request path, never
+ * configured.
+ *
+ * ## Why an agent needs it at all
+ *
+ * A Worker that only *answers* never needs to know its own name.
+ * {@link file://../worker/index.ts createA2AWorker} derives its audience, its
+ * card and its `jku` from `new URL(request.url).origin`, and none of it outlives
+ * the request. An agent that **calls out** mint-signed does need it:
+ * {@link file://./caller-token.ts signCallerToken} puts it in `iss` and derives
+ * the token's `jku` from it. That call happens inside a Durable Object, where
+ * there is no `Request` — which is the whole difficulty.
+ *
+ * The obvious answer is a `SELF_ORIGIN` secret, and it is the wrong one. It
+ * restates a value the request already carries, and it has to be kept
+ * byte-identical by hand with the origin allowlist on the far side, in every
+ * environment, forever. Every sibling that tried it took it back out —
+ * `looping-gateway` discovers its own origin from the first signature-verified
+ * request rather than being told, and a verifying Worker that once carried a
+ * configured audience replaced it with `url.origin`.
+ *
+ * ## Where the value comes from
+ *
+ * Core already sends the origin into the Durable Object on every turn, one field
+ * short of this use. `A2AExecutor` computes `jku` as `${origin}${jwksPath}` and
+ * it rides {@link file://./push.ts TurnPushContext} through the Workflow into
+ * `runTaskTurn` and `executeSubtaskChunk`.
+ *
+ * That is the same origin `signCallerToken` needs, and not by coincidence: a
+ * caller token's `jku` **must** be the JWKS the verifier fetches, and `iss` must
+ * agree with it — the third check in {@link file://./verify.ts verify.ts}. An
+ * origin derived from anywhere else is exactly what that check exists to catch,
+ * so deriving it from the `jku` core already serves makes the agreement
+ * structural instead of clerical.
+ *
+ * ## Pinned on the first turn, and in memory
+ *
+ * The first origin an isolate is told wins, and later ones are ignored. That is
+ * not laziness about staleness — it is what makes the value safe to *read*.
+ *
+ * A Durable Object's input gate stays open across a non-storage await, and this
+ * package runs concurrent RPCs into one object by design (`round/workflow.ts`
+ * runs a round's branches under `Promise.all`). Mutable instance state can
+ * therefore change while a turn is awaiting a model call, and the credential
+ * thunks that read this are lazy — they run several frames below the turn, when
+ * the client is built. Pinned, the field is immutable after its first write, so
+ * every concurrent reader in the isolate gets the same string and no turn can
+ * sign as another turn's origin.
+ *
+ * The cost of pinning is what an agent does not have: several identities. An
+ * agent has one endpoint — the one its card advertises, the one a gateway calls
+ * and a verifier allowlists — so there is nothing to follow. Note the asymmetry
+ * with a *verifier*, which derives the audience it expects per request and must
+ * not cache it: a verifier has to accept every hostname it answers on, while a
+ * signer needs one stable identity.
+ *
+ * Nothing is persisted, which is what keeps a pin from outliving its truth. An
+ * isolate is fresh on every `wrangler deploy` and recycles on its own, so a moved
+ * deployment re-learns its origin from the next turn it serves.
+ */
+export class SelfOrigin {
+    observed;
+    /**
+     * Offer the origin of an absolute URL seen on the request path — a `jku`, an
+     * endpoint, or a bare origin. Only `.origin` is kept, so a path or a trailing
+     * slash cannot reach a token claim.
+     *
+     * **The first usable value wins**; every later call is a no-op, including one
+     * naming a different origin. Called at each RPC entry and again when the push
+     * channel is built, so most calls are already no-ops — but the reason for the
+     * pin is the read side, not the write side. See the note above the class.
+     *
+     * Silently ignores anything unusable (absent, relative, or a scheme that has
+     * no meaningful origin), and an unusable value never pins: the parse comes
+     * first and the field is assigned only on success. This runs at the top of a
+     * turn, where a diagnostic value must never be the thing that fails it; the
+     * throw belongs at {@link require}, where something actually wanted the value.
+     */
+    note(url) {
+        if (this.observed || !url)
+            return;
+        let parsed;
+        try {
+            parsed = new URL(url);
+        }
+        catch {
+            return;
+        }
+        if (parsed.protocol !== "https:" && parsed.protocol !== "http:")
+            return;
+        this.observed = parsed.origin;
+    }
+    /** The pinned origin, or `undefined` when nothing has carried one yet. */
+    peek() {
+        return this.observed;
+    }
+    /**
+     * The pinned origin, for a caller that cannot proceed without it.
+     *
+     * Throws naming the timing, because that is what the mistake always is: the
+     * value arrives with a turn, so `onStart`, a constructor and a scheduled
+     * callback all run before any request has said what this deployment is called.
+     */
+    require() {
+        if (!this.observed) {
+            throw new Error("this deployment's own origin is not known on this instance yet: it is " +
+                "learned from the `jku` that arrives with every turn, so it is " +
+                "available inside a turn or a subtask chunk — not from onStart, a " +
+                "constructor or a scheduled callback");
+        }
+        return this.observed;
+    }
+}

package/dist/agent/errors.d.ts

@@ -6,7 +6,7 @@
  * any particular one exists. `nonRecoverableKind` in
  * {@link file://./inference.ts inference.ts} keys on this file, so a provider
  * written outside core — the thing `ModelRuntimeFactory` exists to make cheap —
- * gets the same handling as `agent/anthropic` with no change to core.
+ * gets the same handling as core's own, with no change to core.
  *
  * ## Why a third classification was needed at all
  *
@@ -24,26 +24,26 @@
 /**
  * Who refused the request, when a `401` came back.
  *
- * There can be up to three authorities on the path, each with its own
- * credential: the AI Gateway (`cf-aig-authorization`), an optional intermediary
- * a deployment puts between the gateway and the provider (`"proxy"`), and the
- * model provider itself (`Authorization`). They fail with the same status code
- * and completely different remedies, so a rejection that does not say which one
- * it was sends an operator to rotate the wrong secret — which is exactly what
- * happened before this existed.
- *
- * `"proxy"` is the odd one out: it is generally *not* a secret to rotate. An
- * intermediary that mints its caller credential per request fails for reasons
- * upstream of any stored secret — configuration drift, a rotated signing key,
- * clock skew — so the remedy is to look, not to rotate. Core recognises no
- * particular intermediary; a deployment that has one supplies its own classifier
- * (see `AnthropicModelDeps.classifyAuthFailure`).
+ * Two authorities sit on the path, each with its own credential: the AI Gateway
+ * (`cf-aig-authorization`) and the model provider itself (`Authorization`). They
+ * fail with the same status code and have completely different remedies, so a
+ * rejection that does not say which one it was sends an operator to rotate the
+ * wrong secret — which is exactly what happened before this existed.
  *
  * `"unknown"` is a real answer and the default. Guessing `"provider"` for an
  * unrecognised body is how the misdiagnosis happens; saying "one of these, here
  * is how to check each" is worse copy and better information.
+ *
+ * A third arm, `"proxy"`, named an optional intermediary between the two — the
+ * shape where a deployment terminates the gateway's request at its own Worker to
+ * attach a credential. It was removed in 0.8.0 with the deployment that had one.
+ * If you build that topology again, the honest classification for its refusals
+ * is `"unknown"` until you widen this union, because the remedy genuinely
+ * differs: an intermediary minting its caller credential per request fails for
+ * reasons upstream of any stored secret, so the fix is to look rather than to
+ * rotate.
  */
-export type CredentialRejectedBy = "provider" | "gateway" | "proxy" | "unknown";
+export type CredentialRejectedBy = "provider" | "gateway" | "unknown";
 /**
  * A credential on the path to the model was rejected (HTTP 401 / 403).
  *

package/dist/agent/errors.js

@@ -6,7 +6,7 @@
  * any particular one exists. `nonRecoverableKind` in
  * {@link file://./inference.ts inference.ts} keys on this file, so a provider
  * written outside core — the thing `ModelRuntimeFactory` exists to make cheap —
- * gets the same handling as `agent/anthropic` with no change to core.
+ * gets the same handling as core's own, with no change to core.
  *
  * ## Why a third classification was needed at all
  *

package/dist/agent/inference.d.ts

@@ -49,14 +49,16 @@ export declare function isTransientAiError(err: unknown): boolean;
  * - `gateway-credential` — the gateway *in front of* the provider rejected the
  *   request, which the provider therefore never saw. Rotate the gateway's token
  *   instead; the model credential is very likely fine.
- * - `proxy-credential` — an intermediary between the gateway and the provider
- *   rejected the caller. Notably **not** a token to rotate: the credential it
- *   refused is minted per request, so the fault is upstream of the secret —
- *   configuration drift, a rotated signing key, or clock skew.
  * - `unknown-credential` — a `401`/`403` matching none of the shapes. Says so,
  *   rather than picking one and sending an operator to rotate a working secret.
+ *
+ * A fourth, `proxy-credential`, was removed in 0.8.0 along with
+ * {@link file://./errors.ts CredentialRejectedBy}'s `"proxy"` arm. Adding a kind
+ * back is a breaking change for every consumer, because the `Record` they map it
+ * with is total — which is the property that makes a new kind impossible to
+ * ignore, and the reason to remove one rather than leave it unreachable.
  */
-export type NonRecoverableKind = "credential" | "gateway-credential" | "proxy-credential" | "unknown-credential";
+export type NonRecoverableKind = "credential" | "gateway-credential" | "unknown-credential";
 /**
  * Why a round ended with no answer — one terminal status, two situations.
  *

package/dist/agent/inference.js

@@ -80,8 +80,6 @@ export function nonRecoverableKind(err) {
             return "credential";
         case "gateway":
             return "gateway-credential";
-        case "proxy":
-            return "proxy-credential";
         // Includes an error that crossed a realm boundary carrying no `source` at
         // all: `isInstance` is structural, so that is reachable, and "unknown" is
         // the honest reading of it.

package/dist/agent/model.d.ts

@@ -10,11 +10,17 @@ import type { ModelConfig } from "../config.js";
  * more than a `LanguageModel` from `ai`. It never learns which provider produced
  * it.
  *
- * The implementations are siblings under `agent/`, one directory each:
- * {@link file://./workers-ai/index.ts `./workers-ai`} is core's default, and
- * {@link file://./anthropic/index.ts `./anthropic`} is Claude behind an optional
- * peer dependency. A third provider is a third directory exporting one
- * {@link ModelRuntimeFactory}; nothing here has to change to admit it.
+ * Core ships exactly one implementation —
+ * {@link file://./workers-ai/index.ts `./workers-ai`} — as a sibling directory
+ * under `agent/`. A second provider is a second directory exporting one
+ * {@link ModelRuntimeFactory}, and nothing here has to change to admit it;
+ * a consumer can equally supply one from outside the package, which is the
+ * point of the seam.
+ *
+ * There was a `./anthropic` sibling until 0.8.0 — a hand-written Messages API
+ * adapter behind an optional peer dependency. It was removed with the only
+ * deployment that used it. Nothing about this contract changed when it went,
+ * which is the strongest thing that can be said for the contract.
  *
  * Which is why this file has no runtime imports at all. The Workers AI factory
  * used to live in it, and a contract that ships one implementation inline reads

package/dist/agent/workers-ai/index.d.ts

@@ -1,23 +1,23 @@
 /**
  * Workers AI — core's default model provider.
  *
- * A sibling of {@link file://../anthropic/index.ts `./anthropic`}, and like it a
- * provider rather than a capability: it ships no tools, no prompt copy and no
+ * A provider rather than a capability: it ships no tools, no prompt copy and no
  * policy; it satisfies {@link file://../model.ts ModelRuntime} and stops.
  *
- * It differs from that sibling in two ways, both deliberate:
+ * Two things about its shape are worth stating, because both look like
+ * omissions:
  *
  * **No `LanguageModel` adapter.** `workers-ai-provider` ships one, so this
- * directory is a factory and nothing else. The Anthropic side hand-builds the
- * adapter — the prompt mapping, the cache control, the error taxonomy — which is
- * why it is five files and this is one.
+ * directory is a factory and nothing else — one file rather than the five a
+ * hand-written adapter costs (a prompt mapping, a cache-control policy, an
+ * error taxonomy). That is what makes it the cheap default.
  *
- * **No package subpath.** `/anthropic` has one because `@anthropic-ai/sdk` is an
- * *optional* peer and an agent on Workers AI must not pay for a provider it
- * never calls. That argument does not apply here: `workers-ai-provider` is a
- * required peer, and this is the default every un-overridden seam reaches
- * through `LoopingAgent` itself, so it is in every consumer's module graph
- * already. It is exported from `@loopingai/core/agent` — one symbol, one import
- * path.
+ * **No package subpath.** `workers-ai-provider` is a *required* peer and this is
+ * the default every un-overridden seam reaches through `LoopingAgent` itself, so
+ * it is in every consumer's module graph already and a subpath would buy
+ * nothing. It is exported from `@loopingai/core/agent` — one symbol, one import
+ * path. A provider behind an *optional* peer would want its own subpath instead,
+ * so that an agent never calling it does not pay for it; `./anthropic` was one
+ * until 0.8.0.
  */
 export { createWorkersAIModelRuntime, workersAIModels, type WorkersAIRuntimeDeps } from "./runtime.js";

package/dist/agent/workers-ai/index.js

@@ -1,23 +1,23 @@
 /**
  * Workers AI — core's default model provider.
  *
- * A sibling of {@link file://../anthropic/index.ts `./anthropic`}, and like it a
- * provider rather than a capability: it ships no tools, no prompt copy and no
+ * A provider rather than a capability: it ships no tools, no prompt copy and no
  * policy; it satisfies {@link file://../model.ts ModelRuntime} and stops.
  *
- * It differs from that sibling in two ways, both deliberate:
+ * Two things about its shape are worth stating, because both look like
+ * omissions:
  *
  * **No `LanguageModel` adapter.** `workers-ai-provider` ships one, so this
- * directory is a factory and nothing else. The Anthropic side hand-builds the
- * adapter — the prompt mapping, the cache control, the error taxonomy — which is
- * why it is five files and this is one.
+ * directory is a factory and nothing else — one file rather than the five a
+ * hand-written adapter costs (a prompt mapping, a cache-control policy, an
+ * error taxonomy). That is what makes it the cheap default.
  *
- * **No package subpath.** `/anthropic` has one because `@anthropic-ai/sdk` is an
- * *optional* peer and an agent on Workers AI must not pay for a provider it
- * never calls. That argument does not apply here: `workers-ai-provider` is a
- * required peer, and this is the default every un-overridden seam reaches
- * through `LoopingAgent` itself, so it is in every consumer's module graph
- * already. It is exported from `@loopingai/core/agent` — one symbol, one import
- * path.
+ * **No package subpath.** `workers-ai-provider` is a *required* peer and this is
+ * the default every un-overridden seam reaches through `LoopingAgent` itself, so
+ * it is in every consumer's module graph already and a subpath would buy
+ * nothing. It is exported from `@loopingai/core/agent` — one symbol, one import
+ * path. A provider behind an *optional* peer would want its own subpath instead,
+ * so that an agent never calling it does not pay for it; `./anthropic` was one
+ * until 0.8.0.
  */
 export { createWorkersAIModelRuntime, workersAIModels } from "./runtime.js";

package/dist/config.d.ts

@@ -27,21 +27,6 @@ export interface ModelConfig {
     fallbackChatModelId: string;
     /** AI Gateway slug; `"default"` auto-provisions on first request. */
     aiGatewayId: string;
-    /**
-     * The segment after the gateway slug in `.../{gateway}/{provider}` — either a
-     * provider-native path like `"anthropic"` or a
-     * [custom provider](https://developers.cloudflare.com/ai-gateway/configuration/custom-providers/)
-     * slug. Core never reads it; a `ModelRuntime` that builds its own base URL
-     * does.
-     *
-     * Config rather than a literal at that call site because the parent agent and
-     * its subagent facet resolve their config independently, and a value that
-     * drifts between them routes delegated subtasks through a different provider
-     * than the round that delegated them — silently, since both satisfy
-     * `ModelRuntime`. Which path to pick, and why, belongs with the agent that
-     * picks it.
-     */
-    aiGatewayProvider: string;
     /**
      * Output-token ceiling for every chat call. Left unset, the binding applies a
      * per-model default which a reasoning model spends on `reasoning_content`
@@ -71,9 +56,9 @@ export interface ModelConfig {
      * The AI SDK does the waiting, and it does it properly:
      * `retryWithExponentialBackoffRespectingRetryHeaders` honours `retry-after-ms`
      * and `retry-after` and falls back to exponential backoff. It only fires for
-     * an `APICallError` carrying `isRetryable`, which is why
-     * {@link file://./agent/anthropic/language-model.ts} maps provider errors into
-     * that shape rather than rethrowing them raw.
+     * an `APICallError` carrying `isRetryable`, so a provider written outside core
+     * has to map its errors into that shape rather than rethrowing them raw, or
+     * none of this fires for it.
      *
      * Bounded at 4 by `resolveConfig`. The retries happen *inside*
      * `step.do("turn:<round>")`, and the SDK caps a single honoured `retry-after`

package/dist/config.js

@@ -32,10 +32,6 @@ export const DEFAULT_CORE_CONFIG = {
         // Not a model: an AI Gateway slug, and `"default"` is Cloudflare's own
         // auto-provision behaviour rather than a choice core is making for anyone.
         aiGatewayId: "default",
-        // The provider-native Anthropic endpoint, which is what a deployment with
-        // no custom provider registered has. Agents that must own the credential
-        // themselves override this with their `custom-*` slug.
-        aiGatewayProvider: "anthropic",
         maxOutputTokens: 16_384,
         reasoningEffort: "medium",
         // Two, which is the AI SDK's own default and enough to ride out the kind of

package/dist/host/agent.d.ts

@@ -69,6 +69,17 @@ export declare abstract class LoopingAgent<TEnv extends Cloudflare.Env & AiEnv &
      * not depend on it surviving.
      */
     private identityKey?;
+    /**
+     * This deployment's own public origin, learned from the `jku` every turn
+     * carries and **pinned on the first one** this instance serves.
+     *
+     * Unlike {@link identityKey} this is shared by concurrent turns — the object
+     * is keyed by caller, not by origin — so it is pinned rather than
+     * last-write-wins: an immutable field cannot change under a credential thunk
+     * that reads it while a turn awaits a model call. See {@link SelfOrigin} for
+     * the full argument, and for why nothing is persisted.
+     */
+    private readonly selfOriginMemo;
     /**
      * Test-only model injection. A **field**, not a constructor argument or an RPC
      * parameter, so it never appears on the generated DO stub: production callers
@@ -107,12 +118,11 @@ export declare abstract class LoopingAgent<TEnv extends Cloudflare.Env & AiEnv &
      * a trap that only shows up as a performance bug. This is called once.
      *
      * `ModelRuntime` is the whole contract: return anything satisfying it and
-     * every loop in core keeps working unchanged. Core ships two implementations,
-     * one directory each — {@link file://../agent/workers-ai/index.ts
-     * `agent/workers-ai`} (the default below) and `@loopingai/core/anthropic` —
-     * and a third provider is a third directory exporting one
-     * {@link file://../agent/model.ts ModelRuntimeFactory}, not a change to
-     * anything on this path.
+     * every loop in core keeps working unchanged. Core ships one implementation,
+     * {@link file://../agent/workers-ai/index.ts `agent/workers-ai`} (the default
+     * below); a second provider is one more
+     * {@link file://../agent/model.ts ModelRuntimeFactory}, defined here or in the
+     * consumer, not a change to anything on this path.
      *
      * Takes the resolved {@link ModelConfig} rather than reading `this.config`, so
      * that this signature matches
@@ -197,6 +207,31 @@ export declare abstract class LoopingAgent<TEnv extends Cloudflare.Env & AiEnv &
      * exists.
      */
     protected requireIdentityKey(): string;
+    /**
+     * Offer this deployment's own origin from a value that carries it. The first
+     * usable one is kept for the life of the instance.
+     *
+     * Called wherever a {@link TurnPushContext} arrives — here for every agent
+     * shape, and at the entry of `RoundAgentBase`'s two RPCs, where the origin is
+     * needed *before* this channel would be built. All three matter because any of
+     * them can be the call that wakes a fresh isolate. Cheap and unfailing: past
+     * the first turn it is one truthiness check, and an unusable value is ignored
+     * rather than thrown, because a turn must not fail over this.
+     */
+    protected noteSelfOrigin(url: string | undefined): void;
+    /**
+     * This deployment's own public origin, if a turn has carried it to this
+     * instance yet. Constant once set, so it reads the same from any turn running
+     * on this object. See {@link SelfOrigin}.
+     */
+    protected selfOrigin(): string | undefined;
+    /**
+     * The same, for a caller that cannot proceed without it — signing a caller
+     * token with {@link file://../a2a/caller-token.ts signCallerToken} above all,
+     * whose `iss` this is. Throws naming the timing rather than producing a token
+     * with a nonsense issuer.
+     */
+    protected requireSelfOrigin(): string;
     /** The gateway callback channel for one turn. See {@link PushChannel}. */
     protected push(context: TurnPushContext): PushChannel;
     /**