@intx/db 0.2.2 → 0.3.0

package/dist/index.js

@@ -1,12 +1,20 @@
 export { createDB } from "./client.js";
 export { pgErrorCode, PG_UNIQUE_VIOLATION, PG_FOREIGN_KEY_VIOLATION, } from "./pg-error.js";
 export { runMigrations, dropSchema } from "./migrate.js";
+export { rekeyCredentialSecrets, } from "./rekey-credential-secrets.js";
 export { createGrantStore } from "./grant-store.js";
+export { createApprovalStore, } from "./approval-store.js";
+export { createSignalCorrelationStore, } from "./signal-correlation-store.js";
+export { createWorkflowRunStore, } from "./workflow-run-store.js";
+export { createWorkflowRunLaunchSpecStore, } from "./workflow-run-launch-spec-store.js";
+export { createWorkflowRunDispatchStore, WorkflowRunDispatchPayloadConflictError, } from "./workflow-run-dispatch-store.js";
+export { createSidecarAllocationStore, } from "./sidecar-allocation-store.js";
+export { createWorkflowDefinitionStore, loadFrozenGrantSnapshot, resolveDefinitionIdForAsset, } from "./workflow-definition-store.js";
 export { getAncestorChain, getDescendantTenants } from "./tenant-hierarchy.js";
 export { resolveActivePrice } from "./pricing.js";
-export { resolveProviderByName, resolveOAuthClient, resolveCredentialByName, resolveCredentialById, resolveCredentialRequirement, } from "./credential-resolution.js";
+export { resolveProviderByName, resolveOAuthClient, resolveCredentialByName, resolveCredentialById, resolveCredentialRequirement, resolveTenantOwnedCredentialById, AmbiguousCredentialError, buildCredentialDelivery, } from "./credential-resolution.js";
 export { resolveAssetByName, resolveAssetById, listAssetsForTenant, } from "./asset-resolution.js";
 export { listVisibleModels, listVisibleProviders, listVisibleOfferings, } from "./catalog-resolution.js";
-export { resolveModelSources, resolveInstanceModelSources, } from "./model-source-resolution.js";
-export { parseAgentRow, parseAgentVersionRow, parseGrantRow, parseOfferingRow, parseCredentialRow, parseProviderRow, parseTenantRow, parseWalletRow, parseTransactionRow, parseOAuthClientRow, parseGitTokenRow, parseTurnPartType, } from "./parse-row.js";
+export { resolveModelSources, resolveInferencePreferences, resolveInstanceModelSources, resolveSourcesByOfferingIds, } from "./model-source-resolution.js";
+export { parseGrantRow, parseApprovalRow, parsePrincipalRow, parseSignalCorrelationRow, parseWorkflowRunRow, parseWorkflowRunDispatchRow, parseWorkflowRunLaunchSpecRow, parseWorkflowDefinitionRow, parseWorkflowDefinitionVersionRow, parseOfferingRow, parseModelOfferingRow, parseCredentialRow, parseProviderRow, parseTenantRow, parseWalletRow, parseTransactionRow, parseOAuthClientRow, parseGitTokenRow, parseTurnPartType, } from "./parse-row.js";
 export * as schema from "./schema/index.js";

package/dist/model-source-resolution.d.ts

@@ -1,4 +1,4 @@
-import { type ModelRequirement, type ProviderPreference } from "@intx/types";
+import { type CredentialCipher, type ModelRequirement, type ProviderPreference } from "@intx/types";
 import type { InferenceSource } from "@intx/types/runtime";
 import type { DB } from "./client.js";
 /**
@@ -12,6 +12,9 @@ export type SourceSkip = {
 } | {
     reason: "credential_unresolved";
     provider: string;
+} | {
+    reason: "credential_unauthorized";
+    provider: string;
 } | {
     reason: "provider_misconfigured";
     provider: string;
@@ -40,6 +43,22 @@ export type CatalogSourceResolution = {
     model: string;
     skips: SourceSkip[];
 };
+export type OfferingSourceResolution = {
+    ok: true;
+    sources: InferenceSource[];
+} | {
+    ok: false;
+    reason: "offering_unavailable";
+    offeringId: string;
+    skip?: SourceSkip;
+};
+/**
+ * Rebuild an exact, ordered source chain from durable catalog offering ids.
+ * This is the recovery counterpart to launch-time source selection: it keeps
+ * secrets out of persisted launch specs and rechecks tenant visibility and
+ * credential ownership on every launch.
+ */
+export declare function resolveSourcesByOfferingIds(db: DB["db"], tenantId: string, offeringIds: readonly string[], credentialCipher?: CredentialCipher): Promise<OfferingSourceResolution>;
 /**
  * Resolves an agent's model requirements against the tenant catalog into an
  * ordered `InferenceSource[]` for the harness.
@@ -51,19 +70,46 @@ export type CatalogSourceResolution = {
  * offering is resolved to a credential-backed source; offerings that cannot
  * produce one are skipped. A required model that yields no source makes the
  * agent unlaunchable.
+ *
+ * A credential-backed source is emitted only when the launching tenant owns
+ * the referenced credential within its hierarchy (ownership is the authority);
+ * otherwise the offering is skipped (`credential_unauthorized`) and its secret
+ * is withheld.
  */
 export declare function resolveModelSources(db: DB["db"], tenantId: string, requirements: ModelRequirement[], opts?: {
     invokerPreferences?: Record<string, ProviderPreference>;
+    credentialCipher?: CredentialCipher;
 }): Promise<CatalogSourceResolution>;
+/**
+ * Resolve an agent's model requirements to the credential-free
+ * `{ provider, model }` inference preferences a folded workflow definition
+ * carries on its step agent. Reuses `resolveModelSources` -- the same catalog
+ * + creator-grant resolution the instance launch path runs -- and projects its
+ * ordered sources to their `{ provider (plugin), model }` identity, dropping
+ * the credentials: a definition's inference preference is hash-only, and the
+ * credential-bearing sources are supplied per deploy on the workflow path.
+ *
+ * A requirement set that resolves to no source is a hard failure. A folded
+ * agent whose model is unresolvable is undeployable, so this raises rather
+ * than synthesizing an empty preference list that would silently strip the
+ * agent's inference. It also raises when the resolved sources are not
+ * injective on `(provider, model)` -- the projection would otherwise freeze
+ * an ambiguous preference list whose lost `offering.id` distinctions cannot be
+ * recovered after the agent's columns are dropped.
+ */
+export declare function resolveInferencePreferences(db: DB["db"], tenantId: string, requirements: ModelRequirement[]): Promise<{
+    provider: string;
+    model: string;
+}[]>;
 /**
  * Resolves the ordered sources for a running instance from persisted state:
- * the agent definition's model requirements and the invoker's launch-time
- * preferences stored on the instance row. Launch, credential-rotation push,
- * and sidecar reconnect all resolve through this, so a running instance's
+ * the definition's model requirements and the invoker's launch-time
+ * preferences stored on the instance row. The credential-rotation and
+ * catalog-edit source push resolves through this, so a running instance's
  * source list is a pure function of persisted state — re-resolution
  * reproduces the launch ordering, including the invoker's reorder/restrict.
  */
 export declare function resolveInstanceModelSources(db: DB["db"], tenantId: string, instance: {
-    agentId: string;
+    definitionId: string;
     modelPreferences: unknown;
-}): Promise<CatalogSourceResolution>;
+}, credentialCipher?: CredentialCipher): Promise<CatalogSourceResolution>;

package/dist/model-source-resolution.js

@@ -1,8 +1,10 @@
 import { and, eq } from "drizzle-orm";
-import { InvokerModelPreferences, ModelRequirements, } from "@intx/types";
+import { createNoopCredentialCipher } from "@intx/crypto";
+import { InvokerModelPreferences, ModelRequirements, credentialAad, } from "@intx/types";
 import { listVisibleOfferings, } from "./catalog-resolution.js";
 import { resolveCredentialById } from "./credential-resolution.js";
-import { agent } from "./schema/agents.js";
+import { parseModelOfferingRow } from "./parse-row.js";
+import { workflowDefinition } from "./schema/workflow-definitions.js";
 function byPriority(a, b) {
     if (a.offering.priority !== b.offering.priority) {
         return a.offering.priority - b.offering.priority;
@@ -41,7 +43,7 @@ function applyPreference(candidates, preference) {
     // the rest as fallback after the named providers.
     return preference.mode === "pin" ? named : [...named, ...rest];
 }
-async function buildSource(db, tenantId, resolved) {
+async function buildSource(db, tenantId, resolved, credentialCipher) {
     const { provider, model, offering } = resolved;
     if (provider.credentialId === null) {
         // No credential reference. A wallet-backed provider is a valid catalog
@@ -60,7 +62,7 @@ async function buildSource(db, tenantId, resolved) {
     }
     // Resolve the secret through the tenant-scoped credential resolver so a
     // provider row referencing a credential outside the tenant's ancestor
-    // chain cannot leak that secret (INTR-203: the chain is the authority).
+    // chain cannot leak that secret (the chain is the authority).
     const credential = await resolveCredentialById(db, tenantId, provider.credentialId);
     if (credential === null) {
         return {
@@ -68,18 +70,74 @@ async function buildSource(db, tenantId, resolved) {
             skip: { reason: "credential_unresolved", provider: provider.name },
         };
     }
+    // Authority to use a credential through a catalog provider is ownership
+    // within the tenant hierarchy -- the same rule the tool-binding path resolves
+    // (`source: "tenant"`). `resolveCredentialById` above already proved the
+    // credential is reachable in this tenant's ancestor chain, so a tenant-owned
+    // credential (`principalId IS NULL`) is authorized here by ownership alone,
+    // with no personal grant and no role grant consulted. This runs live on every
+    // launch and rotation, so a catalog edit that adds an eligible credential is
+    // picked up without re-materializing any grant. A principal-owned credential
+    // is not usable through a shared catalog provider; fail closed.
+    if (credential.principalId !== null) {
+        return {
+            ok: false,
+            skip: { reason: "credential_unauthorized", provider: provider.name },
+        };
+    }
+    // Validate the row once at this DB-to-runtime boundary. This narrows the
+    // jsonb `quirks` from `unknown` to a `Record | null` and checks
+    // `capabilities` against the curated enum. `quirks` is spread in only when
+    // non-null so a source with no accommodations omits the key entirely
+    // (InferenceSource.quirks is present-or-absent, never null). The capability
+    // filter in resolveModelSources still reads the raw row's `capabilities`
+    // for its `.includes` check; that read-only comparison cannot be corrupted
+    // into a wrong routing decision, so it is left as-is.
+    const parsed = parseModelOfferingRow(offering);
     return {
         ok: true,
         source: {
             id: offering.id,
             provider: provider.plugin,
             baseURL: provider.baseURL,
-            apiKey: credential.secret,
+            // Decrypt the stored secret at the one point it is used. Strict: a
+            // non-ciphertext value (a row not yet re-keyed, or a write that failed to
+            // encrypt) throws rather than delivering a bad key -- fail closed.
+            apiKey: await credentialCipher.decrypt(credential.secret, credentialAad(credential.id, "secret")),
             model: model.canonicalName,
-            capabilities: offering.capabilities,
+            capabilities: parsed.capabilities,
+            ...(parsed.quirks !== null ? { quirks: parsed.quirks } : {}),
         },
     };
 }
+/**
+ * Rebuild an exact, ordered source chain from durable catalog offering ids.
+ * This is the recovery counterpart to launch-time source selection: it keeps
+ * secrets out of persisted launch specs and rechecks tenant visibility and
+ * credential ownership on every launch.
+ */
+export async function resolveSourcesByOfferingIds(db, tenantId, offeringIds, credentialCipher = createNoopCredentialCipher()) {
+    const visible = await listVisibleOfferings(db, tenantId);
+    const byId = new Map(visible.map((entry) => [entry.offering.id, entry]));
+    const sources = [];
+    for (const offeringId of offeringIds) {
+        const offering = byId.get(offeringId);
+        if (offering === undefined) {
+            return { ok: false, reason: "offering_unavailable", offeringId };
+        }
+        const built = await buildSource(db, tenantId, offering, credentialCipher);
+        if (!built.ok) {
+            return {
+                ok: false,
+                reason: "offering_unavailable",
+                offeringId,
+                skip: built.skip,
+            };
+        }
+        sources.push(built.source);
+    }
+    return { ok: true, sources };
+}
 /**
  * Resolves an agent's model requirements against the tenant catalog into an
  * ordered `InferenceSource[]` for the harness.
@@ -91,11 +149,17 @@ async function buildSource(db, tenantId, resolved) {
  * offering is resolved to a credential-backed source; offerings that cannot
  * produce one are skipped. A required model that yields no source makes the
  * agent unlaunchable.
+ *
+ * A credential-backed source is emitted only when the launching tenant owns
+ * the referenced credential within its hierarchy (ownership is the authority);
+ * otherwise the offering is skipped (`credential_unauthorized`) and its secret
+ * is withheld.
  */
 export async function resolveModelSources(db, tenantId, requirements, opts) {
     if (requirements.length === 0) {
         return { ok: false, reason: "no_requirements" };
     }
+    const credentialCipher = opts?.credentialCipher ?? createNoopCredentialCipher();
     const visible = await listVisibleOfferings(db, tenantId);
     const sources = [];
     for (const requirement of requirements) {
@@ -111,7 +175,7 @@ export async function resolveModelSources(db, tenantId, requirements, opts) {
         const skips = [];
         const modelSources = [];
         for (const candidate of candidates) {
-            const built = await buildSource(db, tenantId, candidate);
+            const built = await buildSource(db, tenantId, candidate, credentialCipher);
             if (built.ok) {
                 modelSources.push(built.source);
             }
@@ -131,26 +195,87 @@ export async function resolveModelSources(db, tenantId, requirements, opts) {
     }
     return { ok: true, sources };
 }
+/**
+ * Resolve an agent's model requirements to the credential-free
+ * `{ provider, model }` inference preferences a folded workflow definition
+ * carries on its step agent. Reuses `resolveModelSources` -- the same catalog
+ * + creator-grant resolution the instance launch path runs -- and projects its
+ * ordered sources to their `{ provider (plugin), model }` identity, dropping
+ * the credentials: a definition's inference preference is hash-only, and the
+ * credential-bearing sources are supplied per deploy on the workflow path.
+ *
+ * A requirement set that resolves to no source is a hard failure. A folded
+ * agent whose model is unresolvable is undeployable, so this raises rather
+ * than synthesizing an empty preference list that would silently strip the
+ * agent's inference. It also raises when the resolved sources are not
+ * injective on `(provider, model)` -- the projection would otherwise freeze
+ * an ambiguous preference list whose lost `offering.id` distinctions cannot be
+ * recovered after the agent's columns are dropped.
+ */
+export async function resolveInferencePreferences(db, tenantId, requirements) {
+    const resolution = await resolveModelSources(db, tenantId, requirements);
+    if (!resolution.ok) {
+        throw new Error(`cannot resolve inference preferences for the folded definition: ${resolution.reason}`);
+    }
+    // The projection to `{ provider (plugin), model }` drops the `offering.id`
+    // that keys each resolved source. Two distinct offerings can share a
+    // provider plugin and canonical model -- the catalog permits two
+    // `model_provider` rows on the same plugin (uniqueness is on the provider
+    // name), each offering the same model -- so the projection is only
+    // well-defined when the resolved sources are injective on `(provider,
+    // model)`. If they collapse, the folded definition's inference preferences
+    // cannot distinguish which offering each entry meant, and once the agent's
+    // columns are dropped that distinction is unrecoverable. Refuse to
+    // synthesize an ambiguous preference list: fail loud so the collapse
+    // surfaces in the fold/materialize manifest rather than freezing silently.
+    const preferences = resolution.sources.map((source) => ({
+        provider: source.provider,
+        model: source.model,
+    }));
+    const seen = new Set();
+    for (const preference of preferences) {
+        // Join on a NUL: it cannot appear in a provider plugin or canonical model
+        // name, so the composite key is collision-free. Written as an explicit
+        // unicode escape rather than an invisible raw control byte in the source.
+        const key = `${preference.provider}\u0000${preference.model}`;
+        if (seen.has(key)) {
+            throw new Error(`cannot resolve inference preferences for the folded definition: ` +
+                `the model resolution is not injective on (provider, model) -- ` +
+                `two offerings collapse to (${preference.provider}, ${preference.model}); ` +
+                `a folded agent requires a distinguishable inference preference per source`);
+        }
+        seen.add(key);
+    }
+    return preferences;
+}
 /**
  * Resolves the ordered sources for a running instance from persisted state:
- * the agent definition's model requirements and the invoker's launch-time
- * preferences stored on the instance row. Launch, credential-rotation push,
- * and sidecar reconnect all resolve through this, so a running instance's
+ * the definition's model requirements and the invoker's launch-time
+ * preferences stored on the instance row. The credential-rotation and
+ * catalog-edit source push resolves through this, so a running instance's
  * source list is a pure function of persisted state — re-resolution
  * reproduces the launch ordering, including the invoker's reorder/restrict.
  */
-export async function resolveInstanceModelSources(db, tenantId, instance) {
-    // Scope the agent lookup to the resolving tenant, matching the launch
-    // route. A cross-tenant agentId resolves to nothing rather than
-    // contributing another tenant's model names or preferences.
-    const agentRow = await db.query.agent.findFirst({
-        where: and(eq(agent.id, instance.agentId), eq(agent.tenantId, tenantId)),
+export async function resolveInstanceModelSources(db, tenantId, instance, credentialCipher) {
+    // Resolve from the run's own definition by primary key. This is the SAME row
+    // the launch resolves its requirements from, so a rotation or catalog edit
+    // reproduces the launch's model resolution rather than drifting. Scope to the
+    // resolving tenant, matching the launch route: a definition in another tenant
+    // resolves to nothing rather than contributing another tenant's models. A
+    // definition with no creator principal cannot authorize a credential-backed
+    // source, so it fails closed like a missing definition.
+    const definitionRow = await db.query.workflowDefinition.findFirst({
+        where: and(eq(workflowDefinition.id, instance.definitionId), eq(workflowDefinition.tenantId, tenantId)),
     });
-    if (agentRow === undefined) {
+    // A credential-backed source is authorized by tenant ownership of the
+    // credential (walked in `buildSource`), not by the definition's creator, so a
+    // definition with no creator can still launch a tenant-owned inference
+    // source. Only a missing definition (or one in another tenant) fails closed.
+    if (definitionRow === undefined) {
         return { ok: false, reason: "no_requirements" };
     }
-    const requirements = agentRow.modelRequirements !== null
-        ? ModelRequirements.assert(agentRow.modelRequirements)
+    const requirements = definitionRow.modelRequirements !== null
+        ? ModelRequirements.assert(definitionRow.modelRequirements)
         : [];
     const preferences = instance.modelPreferences !== null
         ? InvokerModelPreferences.assert(instance.modelPreferences)
@@ -161,5 +286,6 @@ export async function resolveInstanceModelSources(db, tenantId, instance) {
     }
     return resolveModelSources(db, tenantId, requirements, {
         invokerPreferences,
+        ...(credentialCipher !== undefined ? { credentialCipher } : {}),
     });
 }