# AI Gateway — wiring `/api/ask` through Cloudflare AI Gateway

The resource-library Worker calls Workers AI for `/api/ask`. When `AI_GATEWAY_ID`
is set, that call is routed through an [AI Gateway](https://developers.cloudflare.com/ai-gateway/)
for **response caching**, **per-request analytics/logs**, and **retry/fallback**.

The wiring is **opt-in**: with `AI_GATEWAY_ID` empty (the default), `/api/ask`
runs exactly as before (direct Workers AI). Nothing breaks if the gateway
doesn't exist yet — you turn it on by creating the gateway and setting the id.

## 1. Create the gateway (once)

`wrangler` has **no** `ai-gateway` command — use the dashboard or the REST API.

**Dashboard (simplest):** dash.cloudflare.com → **AI** → **AI Gateway** →
**Create Gateway** → name it `trustfortress-library`. Optionally set a default
cache TTL (the Worker also passes `cacheTtl: 3600`).

**REST API (scriptable):** account id is `9a672bc9fdb94006d556843ab468f894`.
```bash
curl -sS -X POST \
  "https://api.cloudflare.com/client/v4/accounts/9a672bc9fdb94006d556843ab468f894/ai-gateway/gateways" \
  -H "Authorization: Bearer $CF_API_TOKEN" \
  -H "Content-Type: application/json" \
  --data '{"id":"trustfortress-library","cache_ttl":3600,"collect_logs":true}'
```
(Confirm the current request body against the AI Gateway API docs; fields evolve.
`id` is required. Do not paste the token into a committed file.)

Verify it exists:
```bash
curl -sS "https://api.cloudflare.com/client/v4/accounts/9a672bc9fdb94006d556843ab468f894/ai-gateway/gateways" \
  -H "Authorization: Bearer $CF_API_TOKEN" | jq '.result[].id'
```

## 2. Point the Worker at it

Set the id in `apps/resource-library/wrangler.jsonc`:
```jsonc
"vars": { "AI_GATEWAY_ID": "trustfortress-library" }
```
Then deploy (push to `main` runs the deploy workflow, or `npx wrangler deploy`
from `apps/resource-library`).

## 3. Verify it's actually serving (paste-the-output, don't assume)

```bash
# Ask the same question twice — the second should be a gateway cache hit.
curl -sS -X POST https://lib.trustfortress.ai/api/ask \
  -H 'content-type: application/json' \
  -d '{"question":"what is the agentic waste blast radius"}' | jq '.mode,.answer' | head
```
Then open **AI Gateway → trustfortress-library → Logs/Analytics** in the dashboard
and confirm the request appears (and the repeat is `cached`). Only after seeing
real traffic there should the site copy call the gateway "live" rather than
"configured".

## What the Worker sends

`aiGatewayOptions(env, "ask")` in `src/index.js` builds:
```js
{ gateway: { id: env.AI_GATEWAY_ID, skipCache: false, cacheTtl: 3600,
             metadata: { app: "resource-library", endpoint: "ask" } } }
```
passed as the third arg to `env.AI.run(model, inputs, opts)`. Empty id → `undefined` → unchanged.

## Bigger follow-up (separate)

For the "LLMs don't find our material" problem, AI Gateway is **not** the fix —
that's semantic retrieval. Cloudflare now ships **AI Search** (managed AutoRAG:
`wrangler ai-search create|search`), which indexes R2 and answers with citations.
That's a separate, larger build tracked apart from this gateway wiring.