@intx/db 0.2.2 → 0.3.0

package/README.md

@@ -31,8 +31,8 @@ const row = await db.query.agent.findFirst({
 });
 ```
 
-The `parseRow` functions (`parseAgentRow`, `parseGrantRow`, and so
-on) validate each table's `jsonb` columns once and return fully
+The `parseRow` functions (`parseWorkflowDefinitionRow`, `parseGrantRow`,
+and so on) validate each table's `jsonb` columns once and return fully
 typed values; downstream code uses those values without
 re-casting. See `CONVENTIONS.md` for the project-wide rule against
 cast-at-callsite in DB consumers.

package/dist/approval-store.d.ts

@@ -0,0 +1,52 @@
+import type { DB, DBExecutor } from "./client.js";
+import { approval } from "./schema/approvals.js";
+import { parseApprovalRow } from "./parse-row.js";
+type DBHandle = DB["db"];
+type ApprovalRow = typeof approval.$inferSelect;
+type ApprovalInsert = typeof approval.$inferInsert;
+type ParsedApproval = ReturnType<typeof parseApprovalRow>;
+type ApprovalResolution = Exclude<ApprovalRow["status"], "pending">;
+type ApprovalScope = NonNullable<ApprovalRow["scope"]>;
+export type ResolveApprovalArgs = {
+    status: ApprovalResolution;
+    scope?: ApprovalScope;
+    resolvedAt: Date;
+};
+/**
+ * Store for the `approval` table backing the approval round-trip. Each method
+ * accepts an optional transaction handle so the resolver can flip the approval
+ * and its signal correlation in a single `db.transaction`; when omitted the
+ * method runs against the store's own connection.
+ */
+export declare function createApprovalStore(db: DBHandle): {
+    create(row: ApprovalInsert, tx?: DBExecutor): Promise<ParsedApproval>;
+    /**
+     * Idempotent variant of `create`. On a `correlationId` unique conflict the
+     * insert is a no-op and this returns `null` rather than throwing, so a
+     * redelivered register frame (sidecar reconnect, workflow-log replay,
+     * supervisor restart re-emitting) does not fail the co-write. Conflicts
+     * on `correlationId` -- not the `id` primary key -- because the register
+     * co-write mints a fresh `id` per frame while the correlation is the stable
+     * dedup key. Returns the parsed row only when this call performed the
+     * insert.
+     */
+    createIfAbsent(row: ApprovalInsert, tx?: DBExecutor): Promise<ParsedApproval | null>;
+    findByCorrelationId(correlationId: string, tx?: DBExecutor): Promise<ParsedApproval | null>;
+    /**
+     * Look up an approval by its primary key. The resolve/reject routes key on
+     * the `approvalId` path parameter, which is the row's `id`, so they need a
+     * by-id read distinct from the by-correlation read the register co-write
+     * uses. Returns null when no row carries the id.
+     */
+    findById(id: string, tx?: DBExecutor): Promise<ParsedApproval | null>;
+    /**
+     * Conditionally resolve a pending approval. The `WHERE status = 'pending'`
+     * guard makes resolution terminal at the database: the first caller to
+     * resolve a given correlation gets the updated row back; any later caller
+     * (a duplicate delivery, a timeout racing an approval) matches no row and
+     * receives null.
+     */
+    resolve(correlationId: string, args: ResolveApprovalArgs, tx?: DBExecutor): Promise<ParsedApproval | null>;
+};
+export type ApprovalStore = ReturnType<typeof createApprovalStore>;
+export {};

package/dist/approval-store.js

@@ -0,0 +1,79 @@
+import { and, eq } from "drizzle-orm";
+import { approval } from "./schema/approvals.js";
+import { parseApprovalRow } from "./parse-row.js";
+/**
+ * Store for the `approval` table backing the approval round-trip. Each method
+ * accepts an optional transaction handle so the resolver can flip the approval
+ * and its signal correlation in a single `db.transaction`; when omitted the
+ * method runs against the store's own connection.
+ */
+export function createApprovalStore(db) {
+    return {
+        async create(row, tx) {
+            const [inserted] = await (tx ?? db)
+                .insert(approval)
+                .values(row)
+                .returning();
+            if (inserted === undefined) {
+                throw new Error(`approvalStore.create: insert returned no row for ${row.id}`);
+            }
+            return parseApprovalRow(inserted);
+        },
+        /**
+         * Idempotent variant of `create`. On a `correlationId` unique conflict the
+         * insert is a no-op and this returns `null` rather than throwing, so a
+         * redelivered register frame (sidecar reconnect, workflow-log replay,
+         * supervisor restart re-emitting) does not fail the co-write. Conflicts
+         * on `correlationId` -- not the `id` primary key -- because the register
+         * co-write mints a fresh `id` per frame while the correlation is the stable
+         * dedup key. Returns the parsed row only when this call performed the
+         * insert.
+         */
+        async createIfAbsent(row, tx) {
+            const [inserted] = await (tx ?? db)
+                .insert(approval)
+                .values(row)
+                .onConflictDoNothing({ target: approval.correlationId })
+                .returning();
+            return inserted === undefined ? null : parseApprovalRow(inserted);
+        },
+        async findByCorrelationId(correlationId, tx) {
+            const row = await (tx ?? db).query.approval.findFirst({
+                where: eq(approval.correlationId, correlationId),
+            });
+            return row === undefined ? null : parseApprovalRow(row);
+        },
+        /**
+         * Look up an approval by its primary key. The resolve/reject routes key on
+         * the `approvalId` path parameter, which is the row's `id`, so they need a
+         * by-id read distinct from the by-correlation read the register co-write
+         * uses. Returns null when no row carries the id.
+         */
+        async findById(id, tx) {
+            const row = await (tx ?? db).query.approval.findFirst({
+                where: eq(approval.id, id),
+            });
+            return row === undefined ? null : parseApprovalRow(row);
+        },
+        /**
+         * Conditionally resolve a pending approval. The `WHERE status = 'pending'`
+         * guard makes resolution terminal at the database: the first caller to
+         * resolve a given correlation gets the updated row back; any later caller
+         * (a duplicate delivery, a timeout racing an approval) matches no row and
+         * receives null.
+         */
+        async resolve(correlationId, args, tx) {
+            const [updated] = await (tx ?? db)
+                .update(approval)
+                .set({
+                status: args.status,
+                scope: args.scope ?? null,
+                resolvedAt: args.resolvedAt,
+                updatedAt: new Date(),
+            })
+                .where(and(eq(approval.correlationId, correlationId), eq(approval.status, "pending")))
+                .returning();
+            return updated === undefined ? null : parseApprovalRow(updated);
+        },
+    };
+}

package/dist/asset-resolution.d.ts

@@ -23,8 +23,8 @@ export declare function resolveAssetByName(db: DB["db"], tenantId: string, kind:
     createdAt: Date;
     updatedAt: Date;
     tenantId: string;
-    creatorPrincipalId: string | null;
     displayName: string | null;
+    creatorPrincipalId: string | null;
 } | null>;
 /**
  * Resolves an asset by ID, validating that it belongs to the given
@@ -38,8 +38,8 @@ export declare function resolveAssetById(db: DB["db"], tenantId: string, assetId
     createdAt: Date;
     updatedAt: Date;
     tenantId: string;
-    creatorPrincipalId: string | null;
     displayName: string | null;
+    creatorPrincipalId: string | null;
 } | null>;
 /**
  * Lists assets visible to the tenant, including those inherited from

package/dist/client.d.ts

@@ -7,3 +7,13 @@ export declare function createDB(raw: unknown): {
     close: () => Promise<void>;
 };
 export type DB = ReturnType<typeof createDB>;
+/**
+ * A handle that can execute queries: either the top-level `db` or a
+ * transaction handle passed into a `db.transaction` callback. Store methods
+ * that accept an optional `tx` type it against this so a caller can hand in
+ * the transaction object and have the write join the surrounding transaction.
+ * `DB["db"]` alone rejects a `PgTransaction` (it lacks the `$client` field the
+ * top-level database carries), so a bare `DB["db"]` parameter cannot accept a
+ * tx.
+ */
+export type DBExecutor = DB["db"] | Parameters<Parameters<DB["db"]["transaction"]>[0]>[0];

package/dist/connection.js

@@ -11,13 +11,16 @@ export function createConnection(config) {
         database: config.database,
         max: config.max ?? 10,
         ...(config.ssl !== undefined && { ssl: config.ssl }),
-        ...(config.schema !== undefined && {
-            // Pin the connection's search_path so unqualified table
-            // references resolve to the caller's schema. The migration
-            // runner emits SQL with the schema baked into FK references,
-            // but ORM-issued queries bind table names without a schema
-            // qualifier and rely on this setting.
-            connection: { search_path: quoteIdentifier(config.schema) },
-        }),
+        connection: {
+            TimeZone: "UTC",
+            ...(config.schema !== undefined && {
+                // Pin the connection's search_path so unqualified table
+                // references resolve to the caller's schema. The migration
+                // runner emits SQL with the schema baked into FK references,
+                // but ORM-issued queries bind table names without a schema
+                // qualifier and rely on this setting.
+                search_path: quoteIdentifier(config.schema),
+            }),
+        },
     });
 }

package/dist/credential-resolution.d.ts

@@ -1,4 +1,46 @@
+import type { CredentialBinding, CredentialCipher } from "@intx/types";
+import type { CredentialDelivery } from "@intx/types/sidecar";
 import type { DB } from "./client.js";
+/**
+ * Thrown by `resolveCredentialRequirement` when more than one credential
+ * matches a requirement and no name disambiguates them. A distinct type so
+ * callers can catch *this* condition (a launch-blocking configuration error)
+ * without also swallowing the DB reads the resolver performs first -- an
+ * infrastructure failure must surface, not be mislabeled as ambiguity.
+ */
+export declare class AmbiguousCredentialError extends Error {
+    constructor(message: string);
+}
+/**
+ * Resolve a credential USABLE by the launching tenant purely through ownership:
+ * it exists, is reachable in the tenant's ancestor chain, and is tenant-owned
+ * (`principalId IS NULL`). Returns the row -- the proof of authority -- or null.
+ *
+ * This is the one "usable by ownership" resolver: a tenant may use what it (or
+ * an ancestor) owns, and descendants inherit; a principal-owned credential is
+ * never usable this way, its delegation flowing from its owner instead. It
+ * wraps `resolveCredentialById` (the ancestor-chain check) with the tenant-owned
+ * gate, so callers do not re-implement the predicate. `buildSource` expands it
+ * inline only to distinguish an unresolved reference from a principal-owned one.
+ */
+export declare function resolveTenantOwnedCredentialById(db: DB["db"], tenantId: string, credentialId: string): Promise<{
+    id: string;
+    name: string;
+    createdAt: Date;
+    updatedAt: Date;
+    expiresAt: Date | null;
+    providerId: string;
+    tenantId: string;
+    status: "active" | "error" | "expired" | "revoked";
+    description: string | null;
+    principalId: string | null;
+    scopes: string[] | null;
+    metadata: unknown;
+    oauthClientId: string | null;
+    type: "api_key" | "oauth_token" | "certificate" | "other";
+    secret: string;
+    refreshSecret: string | null;
+} | null>;
 /**
  * Resolves a provider by name, walking up the tenant hierarchy.
  * Returns the first match (child shadows parent).
@@ -10,6 +52,7 @@ export declare function resolveProviderByName(db: DB["db"], tenantId: string, na
     updatedAt: Date;
     tenantId: string;
     plugin: string;
+    apiBaseUrl: string | null;
     authorizationUrl: string | null;
     tokenUrl: string | null;
     userInfoUrl: string | null;
@@ -45,7 +88,7 @@ export declare function resolveCredentialByName(db: DB["db"], tenantId: string,
     expiresAt: Date | null;
     providerId: string;
     tenantId: string;
-    status: "active" | "expired" | "revoked" | "error";
+    status: "active" | "error" | "expired" | "revoked";
     description: string | null;
     principalId: string | null;
     scopes: string[] | null;
@@ -67,7 +110,7 @@ export declare function resolveCredentialById(db: DB["db"], tenantId: string, cr
     expiresAt: Date | null;
     providerId: string;
     tenantId: string;
-    status: "active" | "expired" | "revoked" | "error";
+    status: "active" | "error" | "expired" | "revoked";
     description: string | null;
     principalId: string | null;
     scopes: string[] | null;
@@ -90,21 +133,90 @@ type CredentialRequirement = {
  * catalog, not this path).
  */
 export declare function resolveCredentialRequirement(db: DB["db"], tenantId: string, requirement: CredentialRequirement, creatorPrincipalId: string | null, invokerPrincipalId: string | null): Promise<{
-    id: string;
-    name: string;
-    createdAt: Date;
-    updatedAt: Date;
-    expiresAt: Date | null;
-    providerId: string;
-    tenantId: string;
-    status: "active" | "expired" | "revoked" | "error";
-    description: string | null;
-    principalId: string | null;
-    scopes: string[] | null;
-    metadata: unknown;
-    oauthClientId: string | null;
-    type: "api_key" | "oauth_token" | "certificate" | "other";
-    secret: string;
-    refreshSecret: string | null;
+    credential: {
+        id: string;
+        name: string;
+        createdAt: Date;
+        updatedAt: Date;
+        expiresAt: Date | null;
+        providerId: string;
+        tenantId: string;
+        status: "active" | "error" | "expired" | "revoked";
+        description: string | null;
+        principalId: string | null;
+        scopes: string[] | null;
+        metadata: unknown;
+        oauthClientId: string | null;
+        type: "api_key" | "oauth_token" | "certificate" | "other";
+        secret: string;
+        refreshSecret: string | null;
+    };
+    provider: {
+        id: string;
+        name: string;
+        createdAt: Date;
+        updatedAt: Date;
+        tenantId: string;
+        plugin: string;
+        apiBaseUrl: string | null;
+        authorizationUrl: string | null;
+        tokenUrl: string | null;
+        userInfoUrl: string | null;
+        scopes: string[] | null;
+        metadata: unknown;
+    };
 } | null>;
+/**
+ * A launch-blocking CONFIGURATION failure for one binding: a binding no
+ * credential resolves, a provider with no API origin (can't pin an http
+ * handle), or an ambiguous match. Distinct from an infrastructure failure (a DB
+ * read fault), which `buildCredentialDelivery` THROWS rather than returning --
+ * so a caller never mistakes a transient fault for revocation.
+ */
+export type CredentialDeliveryFailure = {
+    code: "unresolved" | "no_origin" | "ambiguous";
+    binding: {
+        provider: string;
+        package: string;
+        handle: string;
+    };
+    message: string;
+};
+/**
+ * Outcome of `buildCredentialDelivery`. `ok: true` carries the material +
+ * descriptors delivered to the tools; `delivery` is `undefined` when there are
+ * no bindings. `ok: false` carries the first launch-blocking configuration
+ * failure for the caller to map to a fail-closed response.
+ */
+export type BuildCredentialDeliveryResult = {
+    ok: true;
+    delivery: CredentialDelivery | undefined;
+} | {
+    ok: false;
+    reason: CredentialDeliveryFailure;
+};
+/**
+ * Resolve a definition's credential bindings into the material + per-handle
+ * descriptors delivered to its tools. Each credential's secret is decrypted
+ * once, keyed by credentialId (a credential backing several handles is
+ * decrypted once).
+ *
+ * This path delivers credential material only; it does not mint, stamp, or
+ * carry any grant. Credential-use authorization is enforced by a separate grant
+ * layer.
+ *
+ * The workflow-deploy path (`deployCodeSourcedWorkflow`) is the only caller
+ * today, using `delivery`. Returning a discriminated result rather than an HTTP
+ * response keeps it safe to call off the request path: a configuration failure
+ * is `ok: false`, and a transient DB read fault THROWS so the caller surfaces it
+ * rather than silently dropping a still-valid credential.
+ */
+export declare function buildCredentialDelivery(args: {
+    db: DB["db"];
+    tenantId: string;
+    bindings: readonly CredentialBinding[];
+    creatorPrincipalId: string | null;
+    invokerPrincipalId: string | null;
+    credentialCipher: CredentialCipher;
+}): Promise<BuildCredentialDeliveryResult>;
 export {};

package/dist/credential-resolution.js

@@ -1,8 +1,39 @@
 import { eq, and, isNull } from "drizzle-orm";
+import { toolConsumer } from "@intx/authz";
+import { credentialAad } from "@intx/types";
 import { credential } from "./schema/credentials.js";
 import { oauthClient } from "./schema/oauth-clients.js";
 import { provider } from "./schema/providers.js";
 import { getAncestorChain } from "./tenant-hierarchy.js";
+/**
+ * Thrown by `resolveCredentialRequirement` when more than one credential
+ * matches a requirement and no name disambiguates them. A distinct type so
+ * callers can catch *this* condition (a launch-blocking configuration error)
+ * without also swallowing the DB reads the resolver performs first -- an
+ * infrastructure failure must surface, not be mislabeled as ambiguity.
+ */
+export class AmbiguousCredentialError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "AmbiguousCredentialError";
+    }
+}
+/**
+ * Resolve a credential USABLE by the launching tenant purely through ownership:
+ * it exists, is reachable in the tenant's ancestor chain, and is tenant-owned
+ * (`principalId IS NULL`). Returns the row -- the proof of authority -- or null.
+ *
+ * This is the one "usable by ownership" resolver: a tenant may use what it (or
+ * an ancestor) owns, and descendants inherit; a principal-owned credential is
+ * never usable this way, its delegation flowing from its owner instead. It
+ * wraps `resolveCredentialById` (the ancestor-chain check) with the tenant-owned
+ * gate, so callers do not re-implement the predicate. `buildSource` expands it
+ * inline only to distinguish an unresolved reference from a principal-owned one.
+ */
+export async function resolveTenantOwnedCredentialById(db, tenantId, credentialId) {
+    const row = await resolveCredentialById(db, tenantId, credentialId);
+    return row !== null && row.principalId === null ? row : null;
+}
 /**
  * Resolves a provider by name, walking up the tenant hierarchy.
  * Returns the first match (child shadows parent).
@@ -104,13 +135,121 @@ export async function resolveCredentialRequirement(db, tenantId, requirement, cr
             return requirement.scopes.every((s) => rowScopes.includes(s));
         });
         const [sole] = matching;
-        if (matching.length === 1 && sole)
-            return sole;
+        // Return the resolved provider alongside the credential. The provider was
+        // already fetched above to constrain the credential query, so surfacing it
+        // spares the caller a second lookup for the provider facts (plugin, base
+        // URL) a resolved credential is always paired with.
+        if (matching.length === 1 && sole) {
+            return { credential: sole, provider: resolvedProvider };
+        }
         if (matching.length > 1) {
-            throw new Error(`Ambiguous credential match: ${matching.length} credentials match ` +
+            throw new AmbiguousCredentialError(`Ambiguous credential match: ${matching.length} credentials match ` +
                 `provider=${requirement.providerName} source=${requirement.source} ` +
                 `in tenant ${tid}. Specify a name to disambiguate.`);
         }
     }
     return null;
 }
+/**
+ * Resolve a definition's credential bindings into the material + per-handle
+ * descriptors delivered to its tools. Each credential's secret is decrypted
+ * once, keyed by credentialId (a credential backing several handles is
+ * decrypted once).
+ *
+ * This path delivers credential material only; it does not mint, stamp, or
+ * carry any grant. Credential-use authorization is enforced by a separate grant
+ * layer.
+ *
+ * The workflow-deploy path (`deployCodeSourcedWorkflow`) is the only caller
+ * today, using `delivery`. Returning a discriminated result rather than an HTTP
+ * response keeps it safe to call off the request path: a configuration failure
+ * is `ok: false`, and a transient DB read fault THROWS so the caller surfaces it
+ * rather than silently dropping a still-valid credential.
+ */
+export async function buildCredentialDelivery(args) {
+    const materials = new Map();
+    const descriptors = [];
+    for (const binding of args.bindings) {
+        const context = {
+            provider: binding.provider,
+            package: binding.package,
+            handle: binding.handle,
+        };
+        let resolved;
+        try {
+            resolved = await resolveCredentialRequirement(args.db, args.tenantId, {
+                providerName: binding.provider,
+                source: binding.locator,
+                ...(binding.name !== undefined ? { name: binding.name } : {}),
+            }, args.creatorPrincipalId, args.invokerPrincipalId);
+        }
+        catch (e) {
+            // AmbiguousCredentialError is a launch-blocking config failure; any other
+            // throw is a DB read fault the resolver performs first -- surface it, do
+            // not mislabel it as revocation.
+            if (!(e instanceof AmbiguousCredentialError))
+                throw e;
+            return {
+                ok: false,
+                reason: {
+                    code: "ambiguous",
+                    binding: context,
+                    message: `Ambiguous credential for the binding on provider ${binding.provider} (package ${binding.package}, handle ${binding.handle}): ${e.message}`,
+                },
+            };
+        }
+        if (resolved === null) {
+            return {
+                ok: false,
+                reason: {
+                    code: "unresolved",
+                    binding: context,
+                    message: `No credential resolves the binding for provider ${binding.provider} (package ${binding.package}, handle ${binding.handle})`,
+                },
+            };
+        }
+        // The credential is delivered as an origin-pinned http handle, so its
+        // provider must declare an API origin. A provider without one (OAuth-login
+        // only) cannot back a tool credential; fail closed rather than deliver an
+        // un-pinnable secret.
+        const providerOrigin = resolved.provider.apiBaseUrl;
+        if (providerOrigin === null || providerOrigin === "") {
+            return {
+                ok: false,
+                reason: {
+                    code: "no_origin",
+                    binding: context,
+                    message: `Provider ${binding.provider} has no API base URL; cannot deliver an origin-pinned credential (package ${binding.package}, handle ${binding.handle})`,
+                },
+            };
+        }
+        const credentialId = resolved.credential.id;
+        // A binding resolves only a tenant-owned credential (the `tenant` locator
+        // filters `principalId IS NULL` in resolveCredentialRequirement), so its use
+        // is authorized by ownership -- already proven by this walk-up resolution,
+        // not re-checked here. This path delivers credential material only; it does
+        // not mint or carry any grant. Credential-use authorization is enforced by a
+        // separate grant layer.
+        descriptors.push({
+            handle: binding.handle,
+            credentialId,
+            consumer: toolConsumer(binding.package),
+        });
+        if (!materials.has(credentialId)) {
+            // Decrypt at the single point of use. A decrypt failure propagates and
+            // fails the caller closed; there is no placeholder secret.
+            materials.set(credentialId, {
+                credentialId,
+                providerKey: resolved.provider.plugin,
+                origin: providerOrigin,
+                secret: await args.credentialCipher.decrypt(resolved.credential.secret, credentialAad(credentialId, "secret")),
+            });
+        }
+    }
+    return {
+        ok: true,
+        delivery: descriptors.length > 0
+            ? { bindings: descriptors, materials: [...materials.values()] }
+            : undefined,
+    };
+}

package/dist/grant-store.js

@@ -2,6 +2,7 @@ import { eq, and, or, isNull, gt, inArray } from "drizzle-orm";
 import { grant } from "./schema/grants.js";
 import { principalRole } from "./schema/roles.js";
 import { parseGrantRow } from "./parse-row.js";
+import { getAncestorChain } from "./tenant-hierarchy.js";
 function toGrantRule(row) {
     const parsed = parseGrantRow(row);
     return {
@@ -16,22 +17,43 @@ function toGrantRule(row) {
         principalId: parsed.principalId,
     };
 }
+/**
+ * Collects a principal's live (non-expired) grants — the ones the principal
+ * owns directly plus the ones granted to any role it holds — restricted to
+ * the tenants matched by `tenantScope`. The scope is the sole knob that
+ * decides single-tenant versus chain-aware collection.
+ */
+async function collectGrantsScoped(db, principalId, tenantScope) {
+    const roleAssignments = await db.query.principalRole.findMany({
+        where: eq(principalRole.principalId, principalId),
+    });
+    const roleIds = roleAssignments.map((a) => a.roleId);
+    const now = new Date();
+    const ownership = [eq(grant.principalId, principalId)];
+    if (roleIds.length > 0) {
+        ownership.push(inArray(grant.roleId, roleIds));
+    }
+    const rows = await db.query.grant.findMany({
+        where: and(tenantScope, or(...ownership), or(isNull(grant.expiresAt), gt(grant.expiresAt, now))),
+    });
+    return rows.map(toGrantRule);
+}
 export function createGrantStore(db) {
     return {
         async collectGrants(principalId, tenantId) {
-            const roleAssignments = await db.query.principalRole.findMany({
-                where: eq(principalRole.principalId, principalId),
-            });
-            const roleIds = roleAssignments.map((a) => a.roleId);
-            const now = new Date();
-            const ownership = [eq(grant.principalId, principalId)];
-            if (roleIds.length > 0) {
-                ownership.push(inArray(grant.roleId, roleIds));
-            }
-            const rows = await db.query.grant.findMany({
-                where: and(eq(grant.tenantId, tenantId), or(...ownership), or(isNull(grant.expiresAt), gt(grant.expiresAt, now))),
-            });
-            return rows.map(toGrantRule);
+            return collectGrantsScoped(db, principalId, eq(grant.tenantId, tenantId));
+        },
+        // Union the principal's grants across the tenant ancestor chain — the
+        // acting tenant plus every ancestor up to the root. Mirrors the
+        // ancestor-chain resolution credential lookup already performs, so a
+        // `credential:{id}` / `use` grant stamped with an ancestor tenant (as the
+        // mint path and 0037 backfill do) still authorizes use of a credential
+        // inherited down the chain. Kept distinct from the single-tenant
+        // `collectGrants` so only the source-resolution credential-use check
+        // widens to the chain; the general RBAC path stays single-tenant.
+        async collectGrantsInChain(principalId, tenantId) {
+            const chain = await getAncestorChain(db, tenantId);
+            return collectGrantsScoped(db, principalId, inArray(grant.tenantId, chain));
         },
     };
 }

package/dist/index.d.ts

@@ -1,13 +1,22 @@
-export { createDB, type DB } from "./client.js";
+export { createDB, type DB, type DBExecutor } from "./client.js";
 export { pgErrorCode, PG_UNIQUE_VIOLATION, PG_FOREIGN_KEY_VIOLATION, } from "./pg-error.js";
 export type { DBConfig } from "./config.js";
 export { runMigrations, dropSchema } from "./migrate.js";
+export { rekeyCredentialSecrets, type RekeyReport, } from "./rekey-credential-secrets.js";
 export { createGrantStore } from "./grant-store.js";
+export { createApprovalStore, type ApprovalStore, type ResolveApprovalArgs, } from "./approval-store.js";
+export { createSignalCorrelationStore, type SignalCorrelationStore, } from "./signal-correlation-store.js";
+export { createWorkflowRunStore, type WorkflowRunStore, } from "./workflow-run-store.js";
+export { createWorkflowRunLaunchSpecStore, type WorkflowRunLaunchSpecStore, } from "./workflow-run-launch-spec-store.js";
+export { createWorkflowRunDispatchStore, WorkflowRunDispatchPayloadConflictError, type AcknowledgeWorkflowRunDispatchArgs, type ClaimWorkflowRunDispatchArgs, type EnqueueWorkflowRunDispatchArgs, type EnqueueWorkflowRunDispatchResult, type EnqueueWorkflowSignalDispatchArgs, type RetryWorkflowRunDispatchArgs, type WorkflowRunDispatchStore, } from "./workflow-run-dispatch-store.js";
+export { createSidecarAllocationStore, type BeginSidecarReleaseArgs, type BeginSidecarReplacementArgs, type BindInitialSidecarArgs, type BindReplacementSidecarArgs, type ClaimSidecarAllocationArgs, type CreatePendingSidecarAllocationArgs, type FailSidecarAllocationArgs, type MarkSidecarAllocatedArgs, type MarkSidecarConnectionLostArgs, type MarkSidecarConnectionReadyArgs, type MarkSidecarReleasedArgs, type ParkSidecarReconciliationPolicy, type ScheduleSidecarAllocationRetryArgs, type SidecarAllocation, type SidecarAllocationStore, } from "./sidecar-allocation-store.js";
+export { createWorkflowDefinitionStore, loadFrozenGrantSnapshot, resolveDefinitionIdForAsset, type WorkflowDefinitionRollbackResult, type WorkflowDefinitionSelector, } from "./workflow-definition-store.js";
 export { getAncestorChain, getDescendantTenants } from "./tenant-hierarchy.js";
 export { resolveActivePrice, type ModelPricingRow } from "./pricing.js";
-export { resolveProviderByName, resolveOAuthClient, resolveCredentialByName, resolveCredentialById, resolveCredentialRequirement, } from "./credential-resolution.js";
+export { resolveProviderByName, resolveOAuthClient, resolveCredentialByName, resolveCredentialById, resolveCredentialRequirement, resolveTenantOwnedCredentialById, AmbiguousCredentialError, buildCredentialDelivery, } from "./credential-resolution.js";
+export type { BuildCredentialDeliveryResult, CredentialDeliveryFailure, } from "./credential-resolution.js";
 export { resolveAssetByName, resolveAssetById, listAssetsForTenant, type AssetRow, type AssetWithOrigin, } from "./asset-resolution.js";
 export { listVisibleModels, listVisibleProviders, listVisibleOfferings, type ModelRow, type ModelProviderRow, type ModelOfferingRow, type Origin, type VisibleModel, type VisibleProvider, type ResolvedOffering, } from "./catalog-resolution.js";
-export { resolveModelSources, resolveInstanceModelSources, type CatalogSourceResolution, type SourceSkip, } from "./model-source-resolution.js";
-export { parseAgentRow, parseAgentVersionRow, parseGrantRow, parseOfferingRow, parseCredentialRow, parseProviderRow, parseTenantRow, parseWalletRow, parseTransactionRow, parseOAuthClientRow, parseGitTokenRow, parseTurnPartType, } from "./parse-row.js";
+export { resolveModelSources, resolveInferencePreferences, resolveInstanceModelSources, resolveSourcesByOfferingIds, type CatalogSourceResolution, type OfferingSourceResolution, type SourceSkip, } from "./model-source-resolution.js";
+export { parseGrantRow, parseApprovalRow, parsePrincipalRow, parseSignalCorrelationRow, parseWorkflowRunRow, parseWorkflowRunDispatchRow, parseWorkflowRunLaunchSpecRow, parseWorkflowDefinitionRow, parseWorkflowDefinitionVersionRow, parseOfferingRow, parseModelOfferingRow, parseCredentialRow, parseProviderRow, parseTenantRow, parseWalletRow, parseTransactionRow, parseOAuthClientRow, parseGitTokenRow, parseTurnPartType, } from "./parse-row.js";
 export * as schema from "./schema/index.js";