@intx/db 0.1.2 → 0.3.0

package/dist/model-source-resolution.js

@@ -0,0 +1,291 @@
+import { and, eq } from "drizzle-orm";
+import { createNoopCredentialCipher } from "@intx/crypto";
+import { InvokerModelPreferences, ModelRequirements, credentialAad, } from "@intx/types";
+import { listVisibleOfferings, } from "./catalog-resolution.js";
+import { resolveCredentialById } from "./credential-resolution.js";
+import { parseModelOfferingRow } from "./parse-row.js";
+import { workflowDefinition } from "./schema/workflow-definitions.js";
+function byPriority(a, b) {
+    if (a.offering.priority !== b.offering.priority) {
+        return a.offering.priority - b.offering.priority;
+    }
+    // Deterministic tiebreak so the head/defaultSource never flaps across
+    // resolutions. Equal-priority load balancing is future work.
+    return a.offering.id < b.offering.id ? -1 : 1;
+}
+/**
+ * Applies a provider preference over an already-priority-sorted candidate
+ * list. `pin` restricts to the named providers (ordered by the preference);
+ * `prefer` fronts the named providers in preference order and keeps the rest
+ * as fallback. With no preference the priority order stands.
+ */
+function applyPreference(candidates, preference) {
+    if (preference === undefined)
+        return candidates;
+    const rank = new Map(preference.order.map((name, i) => [name, i]));
+    // Partition by whether the preference names the provider, capturing the
+    // rank as we go. `ranked` only ever holds named providers, so the sort
+    // reads a concrete rank and never needs a fallback for a missing one.
+    const ranked = [];
+    const rest = [];
+    for (const offering of candidates) {
+        const position = rank.get(offering.provider.name);
+        if (position === undefined) {
+            rest.push(offering);
+        }
+        else {
+            ranked.push({ offering, rank: position });
+        }
+    }
+    ranked.sort((a, b) => a.rank - b.rank);
+    const named = ranked.map((entry) => entry.offering);
+    // `pin` drops every provider the preference did not name; `prefer` keeps
+    // the rest as fallback after the named providers.
+    return preference.mode === "pin" ? named : [...named, ...rest];
+}
+async function buildSource(db, tenantId, resolved, credentialCipher) {
+    const { provider, model, offering } = resolved;
+    if (provider.credentialId === null) {
+        // No credential reference. A wallet-backed provider is a valid catalog
+        // row but not launchable in this credential-backed-only release;
+        // anything else is a misconfigured row.
+        if (provider.walletId !== null) {
+            return {
+                ok: false,
+                skip: { reason: "wallet_backed", provider: provider.name },
+            };
+        }
+        return {
+            ok: false,
+            skip: { reason: "provider_misconfigured", provider: provider.name },
+        };
+    }
+    // Resolve the secret through the tenant-scoped credential resolver so a
+    // provider row referencing a credential outside the tenant's ancestor
+    // chain cannot leak that secret (the chain is the authority).
+    const credential = await resolveCredentialById(db, tenantId, provider.credentialId);
+    if (credential === null) {
+        return {
+            ok: false,
+            skip: { reason: "credential_unresolved", provider: provider.name },
+        };
+    }
+    // Authority to use a credential through a catalog provider is ownership
+    // within the tenant hierarchy -- the same rule the tool-binding path resolves
+    // (`source: "tenant"`). `resolveCredentialById` above already proved the
+    // credential is reachable in this tenant's ancestor chain, so a tenant-owned
+    // credential (`principalId IS NULL`) is authorized here by ownership alone,
+    // with no personal grant and no role grant consulted. This runs live on every
+    // launch and rotation, so a catalog edit that adds an eligible credential is
+    // picked up without re-materializing any grant. A principal-owned credential
+    // is not usable through a shared catalog provider; fail closed.
+    if (credential.principalId !== null) {
+        return {
+            ok: false,
+            skip: { reason: "credential_unauthorized", provider: provider.name },
+        };
+    }
+    // Validate the row once at this DB-to-runtime boundary. This narrows the
+    // jsonb `quirks` from `unknown` to a `Record | null` and checks
+    // `capabilities` against the curated enum. `quirks` is spread in only when
+    // non-null so a source with no accommodations omits the key entirely
+    // (InferenceSource.quirks is present-or-absent, never null). The capability
+    // filter in resolveModelSources still reads the raw row's `capabilities`
+    // for its `.includes` check; that read-only comparison cannot be corrupted
+    // into a wrong routing decision, so it is left as-is.
+    const parsed = parseModelOfferingRow(offering);
+    return {
+        ok: true,
+        source: {
+            id: offering.id,
+            provider: provider.plugin,
+            baseURL: provider.baseURL,
+            // Decrypt the stored secret at the one point it is used. Strict: a
+            // non-ciphertext value (a row not yet re-keyed, or a write that failed to
+            // encrypt) throws rather than delivering a bad key -- fail closed.
+            apiKey: await credentialCipher.decrypt(credential.secret, credentialAad(credential.id, "secret")),
+            model: model.canonicalName,
+            capabilities: parsed.capabilities,
+            ...(parsed.quirks !== null ? { quirks: parsed.quirks } : {}),
+        },
+    };
+}
+/**
+ * Rebuild an exact, ordered source chain from durable catalog offering ids.
+ * This is the recovery counterpart to launch-time source selection: it keeps
+ * secrets out of persisted launch specs and rechecks tenant visibility and
+ * credential ownership on every launch.
+ */
+export async function resolveSourcesByOfferingIds(db, tenantId, offeringIds, credentialCipher = createNoopCredentialCipher()) {
+    const visible = await listVisibleOfferings(db, tenantId);
+    const byId = new Map(visible.map((entry) => [entry.offering.id, entry]));
+    const sources = [];
+    for (const offeringId of offeringIds) {
+        const offering = byId.get(offeringId);
+        if (offering === undefined) {
+            return { ok: false, reason: "offering_unavailable", offeringId };
+        }
+        const built = await buildSource(db, tenantId, offering, credentialCipher);
+        if (!built.ok) {
+            return {
+                ok: false,
+                reason: "offering_unavailable",
+                offeringId,
+                skip: built.skip,
+            };
+        }
+        sources.push(built.source);
+    }
+    return { ok: true, sources };
+}
+/**
+ * Resolves an agent's model requirements against the tenant catalog into an
+ * ordered `InferenceSource[]` for the harness.
+ *
+ * For each requirement, the tenant-visible offerings for the named model are
+ * filtered by the required capabilities, ordered by catalog priority, then
+ * reordered by the creator preference and finally the invoker preference
+ * (invoker preferences key on the canonical model name). Each surviving
+ * offering is resolved to a credential-backed source; offerings that cannot
+ * produce one are skipped. A required model that yields no source makes the
+ * agent unlaunchable.
+ *
+ * A credential-backed source is emitted only when the launching tenant owns
+ * the referenced credential within its hierarchy (ownership is the authority);
+ * otherwise the offering is skipped (`credential_unauthorized`) and its secret
+ * is withheld.
+ */
+export async function resolveModelSources(db, tenantId, requirements, opts) {
+    if (requirements.length === 0) {
+        return { ok: false, reason: "no_requirements" };
+    }
+    const credentialCipher = opts?.credentialCipher ?? createNoopCredentialCipher();
+    const visible = await listVisibleOfferings(db, tenantId);
+    const sources = [];
+    for (const requirement of requirements) {
+        let candidates = visible
+            .filter((o) => o.model.canonicalName === requirement.model)
+            .sort(byPriority);
+        if (requirement.capabilities && requirement.capabilities.length > 0) {
+            const required = requirement.capabilities;
+            candidates = candidates.filter((o) => required.every((c) => o.offering.capabilities.includes(c)));
+        }
+        candidates = applyPreference(candidates, requirement.providers);
+        candidates = applyPreference(candidates, opts?.invokerPreferences?.[requirement.model]);
+        const skips = [];
+        const modelSources = [];
+        for (const candidate of candidates) {
+            const built = await buildSource(db, tenantId, candidate, credentialCipher);
+            if (built.ok) {
+                modelSources.push(built.source);
+            }
+            else {
+                skips.push(built.skip);
+            }
+        }
+        if (modelSources.length === 0) {
+            return {
+                ok: false,
+                reason: "model_unavailable",
+                model: requirement.model,
+                skips,
+            };
+        }
+        sources.push(...modelSources);
+    }
+    return { ok: true, sources };
+}
+/**
+ * Resolve an agent's model requirements to the credential-free
+ * `{ provider, model }` inference preferences a folded workflow definition
+ * carries on its step agent. Reuses `resolveModelSources` -- the same catalog
+ * + creator-grant resolution the instance launch path runs -- and projects its
+ * ordered sources to their `{ provider (plugin), model }` identity, dropping
+ * the credentials: a definition's inference preference is hash-only, and the
+ * credential-bearing sources are supplied per deploy on the workflow path.
+ *
+ * A requirement set that resolves to no source is a hard failure. A folded
+ * agent whose model is unresolvable is undeployable, so this raises rather
+ * than synthesizing an empty preference list that would silently strip the
+ * agent's inference. It also raises when the resolved sources are not
+ * injective on `(provider, model)` -- the projection would otherwise freeze
+ * an ambiguous preference list whose lost `offering.id` distinctions cannot be
+ * recovered after the agent's columns are dropped.
+ */
+export async function resolveInferencePreferences(db, tenantId, requirements) {
+    const resolution = await resolveModelSources(db, tenantId, requirements);
+    if (!resolution.ok) {
+        throw new Error(`cannot resolve inference preferences for the folded definition: ${resolution.reason}`);
+    }
+    // The projection to `{ provider (plugin), model }` drops the `offering.id`
+    // that keys each resolved source. Two distinct offerings can share a
+    // provider plugin and canonical model -- the catalog permits two
+    // `model_provider` rows on the same plugin (uniqueness is on the provider
+    // name), each offering the same model -- so the projection is only
+    // well-defined when the resolved sources are injective on `(provider,
+    // model)`. If they collapse, the folded definition's inference preferences
+    // cannot distinguish which offering each entry meant, and once the agent's
+    // columns are dropped that distinction is unrecoverable. Refuse to
+    // synthesize an ambiguous preference list: fail loud so the collapse
+    // surfaces in the fold/materialize manifest rather than freezing silently.
+    const preferences = resolution.sources.map((source) => ({
+        provider: source.provider,
+        model: source.model,
+    }));
+    const seen = new Set();
+    for (const preference of preferences) {
+        // Join on a NUL: it cannot appear in a provider plugin or canonical model
+        // name, so the composite key is collision-free. Written as an explicit
+        // unicode escape rather than an invisible raw control byte in the source.
+        const key = `${preference.provider}\u0000${preference.model}`;
+        if (seen.has(key)) {
+            throw new Error(`cannot resolve inference preferences for the folded definition: ` +
+                `the model resolution is not injective on (provider, model) -- ` +
+                `two offerings collapse to (${preference.provider}, ${preference.model}); ` +
+                `a folded agent requires a distinguishable inference preference per source`);
+        }
+        seen.add(key);
+    }
+    return preferences;
+}
+/**
+ * Resolves the ordered sources for a running instance from persisted state:
+ * the definition's model requirements and the invoker's launch-time
+ * preferences stored on the instance row. The credential-rotation and
+ * catalog-edit source push resolves through this, so a running instance's
+ * source list is a pure function of persisted state — re-resolution
+ * reproduces the launch ordering, including the invoker's reorder/restrict.
+ */
+export async function resolveInstanceModelSources(db, tenantId, instance, credentialCipher) {
+    // Resolve from the run's own definition by primary key. This is the SAME row
+    // the launch resolves its requirements from, so a rotation or catalog edit
+    // reproduces the launch's model resolution rather than drifting. Scope to the
+    // resolving tenant, matching the launch route: a definition in another tenant
+    // resolves to nothing rather than contributing another tenant's models. A
+    // definition with no creator principal cannot authorize a credential-backed
+    // source, so it fails closed like a missing definition.
+    const definitionRow = await db.query.workflowDefinition.findFirst({
+        where: and(eq(workflowDefinition.id, instance.definitionId), eq(workflowDefinition.tenantId, tenantId)),
+    });
+    // A credential-backed source is authorized by tenant ownership of the
+    // credential (walked in `buildSource`), not by the definition's creator, so a
+    // definition with no creator can still launch a tenant-owned inference
+    // source. Only a missing definition (or one in another tenant) fails closed.
+    if (definitionRow === undefined) {
+        return { ok: false, reason: "no_requirements" };
+    }
+    const requirements = definitionRow.modelRequirements !== null
+        ? ModelRequirements.assert(definitionRow.modelRequirements)
+        : [];
+    const preferences = instance.modelPreferences !== null
+        ? InvokerModelPreferences.assert(instance.modelPreferences)
+        : [];
+    const invokerPreferences = {};
+    for (const preference of preferences) {
+        invokerPreferences[preference.model] = preference.providers;
+    }
+    return resolveModelSources(db, tenantId, requirements, {
+        invokerPreferences,
+        ...(credentialCipher !== undefined ? { credentialCipher } : {}),
+    });
+}

package/dist/parse-row.d.ts

@@ -0,0 +1,373 @@
+import type { approval, credential, gitToken, grant, modelOffering, modelProvider, oauthClient, offering, principal, provider, signalCorrelation, tenant, transaction, turnPart, wallet, workflowDefinition, workflowDefinitionVersion, workflowRun, workflowRunDispatch, workflowRunLaunchSpec } from "./schema/index.js";
+export declare const GitTokenKindValidator: import("arktype/internal/variants/string.ts").StringType<"pat" | "svc", {}>;
+export declare function parseWorkflowDefinitionRow(row: typeof workflowDefinition.$inferSelect): {
+    status: "deployed" | "stopped";
+    grantRequirements: {
+        resource: string;
+        action: string;
+        source: "creator" | "invoker";
+        effect?: "allow" | "deny" | "ask";
+        conditions?: Record<string, unknown> | null;
+    }[] | null;
+    modelRequirements: {
+        model: string;
+        capabilities?: ("plain-text" | "plain-text-streaming" | "function-calling" | "function-calling-multi-turn" | "function-calling-multi-turn-streaming" | "function-calling-with-thinking" | "function-calling-with-thinking-streaming" | "vision-input" | "vision-input-streaming" | "audio-input" | "audio-input-streaming" | "video-input" | "video-input-streaming" | "document-input" | "document-input-streaming" | "image-output" | "image-output-streaming" | "code-execution" | "code-execution-streaming" | "reasoning-content" | "reasoning-content-streaming" | "grounding" | "grounding-streaming" | "files-api-reference" | "files-api-reference-streaming" | "redacted-thinking" | "redacted-thinking-streaming" | "structured-output" | "structured-output-streaming" | "long-context" | "prompt-caching")[];
+        providers?: {
+            mode: "prefer" | "pin";
+            order: string[];
+        };
+    }[] | null;
+    credentialBindings: {
+        package: string;
+        handle: string;
+        provider: string;
+        locator: "tenant";
+        name?: string;
+    }[] | null;
+    id: string;
+    name: string;
+    createdAt: Date;
+    updatedAt: Date;
+    tenantId: string;
+    creatorPrincipalId: string | null;
+    assetId: string | null;
+    wireHash: string | null;
+    description: string | null;
+    currentVersion: string;
+};
+export declare function parseWorkflowDefinitionVersionRow(row: typeof workflowDefinitionVersion.$inferSelect): {
+    status: "active" | "inactive" | "failed";
+    id: string;
+    createdAt: Date;
+    definitionId: string;
+    version: string;
+    approvedWireHash: string | null;
+    grantSnapshot: unknown;
+};
+export declare function parseGrantRow(row: typeof grant.$inferSelect): {
+    effect: "allow" | "deny" | "ask";
+    origin: "role" | "system" | "creator" | "invoker";
+    conditions: Record<string, unknown> | null;
+    id: string;
+    createdAt: Date;
+    updatedAt: Date;
+    expiresAt: Date | null;
+    tenantId: string;
+    roleId: string | null;
+    principalId: string | null;
+    resource: string;
+    action: string;
+};
+export declare function parseApprovalRow(row: typeof approval.$inferSelect): {
+    scope: "always" | "once" | null;
+    status: "pending" | "approved" | "rejected" | "timeout" | "expired";
+    toolDefinition: Record<string, unknown>;
+    toolArguments: Record<string, unknown>;
+    id: string;
+    createdAt: Date;
+    updatedAt: Date;
+    tenantId: string;
+    anchorRunId: string;
+    runId: string;
+    agentAddress: string;
+    correlationId: string;
+    timeoutAt: Date | null;
+    resolvedAt: Date | null;
+};
+export declare function parsePrincipalRow(row: typeof principal.$inferSelect): {
+    kind: "user" | "agent" | "workflow";
+    status: "active" | "suspended" | "invited" | "deactivated";
+    id: string;
+    createdAt: Date;
+    updatedAt: Date;
+    tenantId: string;
+    refId: string;
+};
+export declare function parseSignalCorrelationRow(row: typeof signalCorrelation.$inferSelect): {
+    kind: "approval";
+    createdAt: Date;
+    tenantId: string;
+    anchorRunId: string;
+    runId: string;
+    agentAddress: string;
+    correlationId: string;
+    resolvedAt: Date | null;
+    signalName: string;
+    signalId: string | null;
+};
+export declare function parseWorkflowRunRow(row: typeof workflowRun.$inferSelect): {
+    status: "deployed" | "failed" | "running" | "completed" | "cancelled";
+    modelPreferences: {
+        model: string;
+        providers: {
+            mode: "prefer" | "pin";
+            order: string[];
+        };
+    }[] | null;
+    id: string;
+    createdAt: Date;
+    tenantId: string;
+    definitionId: string;
+    principalId: string | null;
+    anchorRunId: string | null;
+    address: string | null;
+    publicKey: string | null;
+    sidecarId: string | null;
+    kernelId: string | null;
+    endedAt: Date | null;
+};
+export declare function parseWorkflowRunLaunchSpecRow(row: typeof workflowRunLaunchSpec.$inferSelect): {
+    frozenApprovalBundle: {
+        source: {
+            kind: "registry";
+            registry: string;
+        } | {
+            kind: "asset";
+            assetId: string;
+            package: {
+                format: "tarball";
+            } | {
+                format: "source";
+                commitSha: string;
+                packageName?: string;
+            };
+        };
+        entry: string;
+        projection: {
+            id: string;
+            triggers: unknown[];
+            stepOrder: string[];
+            steps: {
+                [x: string]: unknown;
+            };
+            state?: Record<string, unknown>;
+            credentialBindings?: {
+                package: string;
+                handle: string;
+                provider: string;
+                locator: "tenant";
+                name?: string;
+            }[];
+        };
+        closure: {
+            schemaVersion: "1";
+            topLevel: {
+                name: string;
+                version: string;
+                credentials?: {
+                    handle: string;
+                    scopes?: string[];
+                }[];
+            }[];
+            entries: {
+                name: string;
+                version: string;
+                source: {
+                    kind: "registry";
+                    registry: string;
+                    integrity: string;
+                } | {
+                    kind: "asset";
+                    assetId: string;
+                    package: {
+                        format: "tarball";
+                        path: string;
+                        integrity: string;
+                    } | {
+                        format: "source";
+                        commitSha: string;
+                        packageDir: string;
+                        treeOid: string;
+                    };
+                };
+                os?: string[];
+                cpu?: string[];
+                tarballUrl?: string;
+            }[];
+        };
+        approvedWireHash: string;
+        approvedGrants: string[];
+    };
+    sourceOfferingIds: string[];
+    deployContent: Record<string, unknown>;
+    toolPackagePins: {
+        name: string;
+        version: string;
+    }[] | null;
+    createdAt: Date;
+    anchorRunId: string;
+    sessionId: string;
+    schemaVersion: number;
+    deploymentDomain: string;
+    sourceAuthorityPrincipalId: string;
+    defaultSourceOfferingId: string;
+};
+export declare function parseWorkflowRunDispatchRow(row: typeof workflowRunDispatch.$inferSelect): {
+    kind: "signal" | "mail";
+    status: "failed" | "pending" | "acknowledged" | "settled";
+    stepGrants: {
+        id: string;
+        resource: string;
+        action: string;
+        effect: "allow" | "deny" | "ask";
+        origin: "role" | "system" | "creator" | "invoker";
+        conditions: {
+            [x: string]: unknown;
+        } | null;
+        expiresAt: Date | null;
+        roleId: string | null;
+        principalId: string | null;
+    }[];
+    id: string;
+    createdAt: Date;
+    updatedAt: Date;
+    anchorRunId: string;
+    messageId: string;
+    nextAttemptAt: Date | null;
+    failureCode: string | null;
+    failureMessage: string | null;
+    rawMessage: Uint8Array<ArrayBufferLike>;
+    acknowledgedGeneration: number | null;
+    attemptCount: number;
+    deliveryLeaseId: string | null;
+    deliveryLeaseExpiresAt: Date | null;
+    acknowledgedAt: Date | null;
+    settledAt: Date | null;
+};
+export declare function parseOfferingRow(row: typeof offering.$inferSelect): {
+    pricing: Record<string, unknown> | null;
+    schema: Record<string, unknown> | null;
+    id: string;
+    name: string;
+    createdAt: Date;
+    updatedAt: Date;
+    tenantId: string;
+    description: string | null;
+    agentId: string;
+};
+export declare function parseCredentialRow(row: typeof credential.$inferSelect): {
+    type: "api_key" | "oauth_token" | "certificate" | "other";
+    status: "active" | "error" | "expired" | "revoked";
+    metadata: Record<string, unknown> | null;
+    id: string;
+    name: string;
+    createdAt: Date;
+    updatedAt: Date;
+    expiresAt: Date | null;
+    providerId: string;
+    tenantId: string;
+    description: string | null;
+    principalId: string | null;
+    scopes: string[] | null;
+    oauthClientId: string | null;
+    secret: string;
+    refreshSecret: string | null;
+};
+export declare function parseProviderRow(row: typeof provider.$inferSelect): {
+    metadata: Record<string, unknown> | null;
+    id: string;
+    name: string;
+    createdAt: Date;
+    updatedAt: Date;
+    tenantId: string;
+    plugin: string;
+    apiBaseUrl: string | null;
+    authorizationUrl: string | null;
+    tokenUrl: string | null;
+    userInfoUrl: string | null;
+    scopes: string[] | null;
+};
+export declare function parseModelProviderRow(row: typeof modelProvider.$inferSelect): {
+    plugin: "anthropic" | "openai" | "openai-compatible" | "google-genai";
+    id: string;
+    name: string;
+    createdAt: Date;
+    updatedAt: Date;
+    tenantId: string;
+    walletId: string | null;
+    disabled: boolean;
+    baseURL: string;
+    credentialId: string | null;
+};
+export declare function parseModelOfferingRow(row: typeof modelOffering.$inferSelect): {
+    capabilities: ("plain-text" | "plain-text-streaming" | "function-calling" | "function-calling-multi-turn" | "function-calling-multi-turn-streaming" | "function-calling-with-thinking" | "function-calling-with-thinking-streaming" | "vision-input" | "vision-input-streaming" | "audio-input" | "audio-input-streaming" | "video-input" | "video-input-streaming" | "document-input" | "document-input-streaming" | "image-output" | "image-output-streaming" | "code-execution" | "code-execution-streaming" | "reasoning-content" | "reasoning-content-streaming" | "grounding" | "grounding-streaming" | "files-api-reference" | "files-api-reference-streaming" | "redacted-thinking" | "redacted-thinking-streaming" | "structured-output" | "structured-output-streaming" | "long-context" | "prompt-caching")[];
+    quirks: Record<string, unknown> | null;
+    id: string;
+    createdAt: Date;
+    updatedAt: Date;
+    providerId: string;
+    tenantId: string;
+    disabled: boolean;
+    modelId: string;
+    priority: number;
+    deploymentTags: string[];
+};
+export declare function parseTenantRow(row: typeof tenant.$inferSelect): {
+    config: {
+        [x: string]: unknown;
+        sidecarPlacement?: {
+            sharing: "exclusive";
+            reuse?: "never" | "same-deployment";
+        };
+    } | null;
+    domain: string;
+    id: string;
+    name: string;
+    createdAt: Date;
+    updatedAt: Date;
+    slug: string;
+    parentId: string | null;
+};
+export declare function parseWalletRow(row: typeof wallet.$inferSelect): {
+    backendType: "crypto" | "fiat" | "credits";
+    config: Record<string, unknown> | null;
+    id: string;
+    name: string;
+    createdAt: Date;
+    updatedAt: Date;
+    tenantId: string;
+    currency: string;
+    balance: string;
+};
+export declare function parseTransactionRow(row: typeof transaction.$inferSelect): {
+    direction: "inbound" | "outbound";
+    status: "failed" | "completed" | "pending";
+    id: string;
+    createdAt: Date;
+    runId: string | null;
+    currency: string;
+    walletId: string;
+    amount: string;
+    recipientId: string | null;
+    senderId: string | null;
+    requestId: string | null;
+};
+export declare function parseOAuthClientRow(row: typeof oauthClient.$inferSelect): {
+    metadata: Record<string, unknown> | null;
+    id: string;
+    name: string;
+    createdAt: Date;
+    updatedAt: Date;
+    providerId: string;
+    tenantId: string;
+    clientId: string;
+    clientSecret: string;
+    redirectUris: string[] | null;
+    defaultScopes: string[] | null;
+};
+export declare function parseGitTokenRow(row: typeof gitToken.$inferSelect): {
+    kind: "pat" | "svc";
+    actions: ("init" | "writeTree" | "receivePack" | "createPack" | "resolveRef")[];
+    id: string;
+    name: string;
+    createdAt: Date;
+    userId: string;
+    expiresAt: Date;
+    tenantId: string | null;
+    principalId: string | null;
+    resource: string;
+    tokenHashSha256: Uint8Array<ArrayBufferLike>;
+    refPattern: string;
+    revokedAt: Date | null;
+};
+export declare function parseTurnPartType(partType: string): (typeof turnPart.$inferInsert)["type"];