catalog-tools: create and prioritise catalog offerings (CL-7468)

apps/hub/package.json

@@ -20,6 +20,7 @@
     "@corbits/artifacts": "github:corbitsdev/corbits-artifacts#dc435ba749b4378f19e5de772159c2a57e932938",
     "@corbits/artifacts-hub": "workspace:*",
     "@corbits/bench": "workspace:*",
+    "@corbits/catalog-tools": "workspace:*",
     "@corbits/chat": "workspace:*",
     "@corbits/commands": "workspace:*",
     "@corbits/error-sink": "workspace:*",

apps/hub/src/index.ts

@@ -165,6 +165,7 @@ import {
   createDrizzleSidecarPlacementStore,
   createSidecarPlacementRoutes,
 } from "@corbits/sidecar-placement";
+import { createWorkflowCatalogAdminRoutes } from "@corbits/catalog-tools/routes";
 import { createWorkflowAccessRoutes } from "@corbits/access-tools/routes";
 import { generateId } from "@intx/hub-common";
 
@@ -2866,6 +2867,27 @@ export async function createHub(config: HubConfig) {
       getPolicy: (tenantId) => benchModelPolicy.store.getPolicy(tenantId),
     }),
   );
+  // Myra's own catalog-administration surface
+  // (`@corbits/catalog-tools`' `create_offering`/`set_offering_priority`/
+  // `disable_offering`): the workflow-run-authenticated counterpart to
+  // `@intx/hub-api`'s tenant-session `/api/tenants/:tenantId/catalog/
+  // {models,providers,offerings}` mount, which only accepts a browser
+  // session and so 401s a workflow child. Reuses the SAME grant store and
+  // condition registry every other extension's own requireGrant check
+  // runs against, and the SAME sidecarRouter/credentialCipher the
+  // tenant-session mount pushes source updates through on every offering
+  // write, so a write through either surface propagates identically.
+  app.route(
+    "/api/workflow-catalog-admin",
+    createWorkflowCatalogAdminRoutes({
+      db,
+      authenticator: createWorkflowRunAuthenticator({ db }),
+      grantStore: chatGrantStore,
+      conditionRegistry: chatConditionRegistry,
+      sidecarRouter,
+      credentialCipher,
+    }),
+  );
   // Myra's own principal/grant surface (`@corbits/access-tools`'
   // `list_principals`/`list_grants`/`grant_access`/`revoke_access`): the
   // workflow-run-authenticated counterpart to the tenant-session

packages/catalog-tools/README.md

@@ -20,3 +20,32 @@ Everything comes from `@corbits/inference-catalog`'s run-authenticated
 surface at `/api/workflow-inference-catalog`, reached with the sidecar bearer
 token and run address like every other workflow-run tool bundle. All three
 tools read only, so none is gated behind approval.
+
+## Managing offerings
+
+Three more tools let an agent write to the tenant's own inference catalog,
+through this package's own workflow-run-authenticated mirror of the
+tenant-admin catalog routes (`./src/routes.ts`'s
+`createWorkflowCatalogAdminRoutes`, mounted in `apps/hub` at
+`/api/workflow-catalog-admin`) rather than the read-only concept surface
+above. The tenant-admin routes themselves
+(`vendor/intx/hub-api/src/routes/{models,model-providers,
+model-offerings}.ts`) only accept a browser session, which a workflow run
+never has — only its sidecar bearer token and run address, the same
+credential the read-only surface above already uses.
+
+- **`create_offering`** — pairs a model (by canonical name) with a model
+  provider (by name), both already present in this workbench's own catalog,
+  at a given priority with a set of advertised capabilities. Gated behind
+  `approval: "ask"`: it changes what this bench can resolve to at runtime.
+- **`set_offering_priority`** — reorders an offering this workbench already
+  owns directly, changing where it falls in source-resolution fallback
+  order. Ungated: it only reorders an offering already live.
+- **`disable_offering`** — restricts an offering this workbench already owns
+  directly, taking it out of source resolution without deleting its pricing
+  history. Gated behind `approval: "ask"`: running instances resolved
+  through it fail over to the next eligible source.
+
+`create_offering` never invents a model or provider id — it resolves the
+given canonical name and provider name against this tenant's own catalog
+listing first, and refuses rather than guessing when neither is found.

packages/catalog-tools/package.json

@@ -2,20 +2,28 @@
   "name": "@corbits/catalog-tools",
   "private": true,
   "description": "The list_model_concepts, pick_models and estimate_run_cost tools as an @intx/agent bundle: an agent asks for a model by what the work needs and gets back an ordered, priced chain of what this bench can actually reach — never a model named by hand.",
-  "version": "0.0.2",
+  "version": "0.0.4",
   "license": "LGPL-2.1-or-later",
   "type": "module",
   "exports": {
-    ".": "./src/index.ts"
+    ".": "./src/index.ts",
+    "./routes": "./src/routes.ts"
   },
   "scripts": {
     "typecheck": "tsc --noEmit",
     "test": "bun test"
   },
   "dependencies": {
+    "@corbits/error-sink": "workspace:*",
     "@intx/agent": "workspace:*",
+    "@intx/db": "workspace:*",
+    "@intx/hub-api": "workspace:*",
+    "@intx/hub-common": "0.3.0",
+    "@intx/hub-sessions": "workspace:*",
     "@intx/types": "workspace:*",
-    "arktype": "catalog:"
+    "arktype": "catalog:",
+    "drizzle-orm": "catalog:",
+    "hono": "catalog:"
   },
   "devDependencies": {
     "@types/bun": "catalog:",