@intx/db 0.2.2 → 0.3.0

package/dist/parse-row.d.ts

@@ -1,52 +1,48 @@
-import type { agent, agentVersion, credential, gitToken, grant, modelOffering, modelProvider, oauthClient, offering, provider, tenant, transaction, turnPart, wallet } from "./schema/index.js";
+import type { approval, credential, gitToken, grant, modelOffering, modelProvider, oauthClient, offering, principal, provider, signalCorrelation, tenant, transaction, turnPart, wallet, workflowDefinition, workflowDefinitionVersion, workflowRun, workflowRunDispatch, workflowRunLaunchSpec } from "./schema/index.js";
 export declare const GitTokenKindValidator: import("arktype/internal/variants/string.ts").StringType<"pat" | "svc", {}>;
-export declare function parseAgentRow(row: typeof agent.$inferSelect): {
-    contextConfig: Record<string, unknown> | null;
-    initialState: Record<string, unknown> | null;
-    modelConfig: Record<string, unknown> | null;
-    capabilities: Record<string, unknown> | null;
-    credentialRequirements: {
-        providerName: string;
-        source: "tenant" | "creator" | "invoker";
-        scopes?: string[];
-        name?: string;
+export declare function parseWorkflowDefinitionRow(row: typeof workflowDefinition.$inferSelect): {
+    status: "deployed" | "stopped";
+    grantRequirements: {
+        resource: string;
+        action: string;
+        source: "creator" | "invoker";
+        effect?: "allow" | "deny" | "ask";
+        conditions?: Record<string, unknown> | null;
     }[] | null;
     modelRequirements: {
         model: string;
-        capabilities?: ("vision" | "audio-input" | "tool-use" | "extended-thinking" | "structured-output" | "long-context" | "prompt-caching")[];
+        capabilities?: ("plain-text" | "plain-text-streaming" | "function-calling" | "function-calling-multi-turn" | "function-calling-multi-turn-streaming" | "function-calling-with-thinking" | "function-calling-with-thinking-streaming" | "vision-input" | "vision-input-streaming" | "audio-input" | "audio-input-streaming" | "video-input" | "video-input-streaming" | "document-input" | "document-input-streaming" | "image-output" | "image-output-streaming" | "code-execution" | "code-execution-streaming" | "reasoning-content" | "reasoning-content-streaming" | "grounding" | "grounding-streaming" | "files-api-reference" | "files-api-reference-streaming" | "redacted-thinking" | "redacted-thinking-streaming" | "structured-output" | "structured-output-streaming" | "long-context" | "prompt-caching")[];
         providers?: {
             mode: "prefer" | "pin";
             order: string[];
         };
     }[] | null;
-    grantRequirements: {
-        resource: string;
-        action: string;
-        source: "creator" | "invoker";
-        effect?: "allow" | "deny" | "ask";
-        conditions?: Record<string, unknown> | null;
+    credentialBindings: {
+        package: string;
+        handle: string;
+        provider: string;
+        locator: "tenant";
+        name?: string;
     }[] | null;
-    toolPackages: {
-        name: string;
-        version: string;
-    }[];
     id: string;
     name: string;
     createdAt: Date;
     updatedAt: Date;
     tenantId: string;
-    status: "deployed" | "stopped";
-    creatorPrincipalId: string;
+    creatorPrincipalId: string | null;
+    assetId: string | null;
+    wireHash: string | null;
     description: string | null;
-    systemPrompt: string | null;
     currentVersion: string;
 };
-export declare function parseAgentVersionRow(row: typeof agentVersion.$inferSelect): {
+export declare function parseWorkflowDefinitionVersionRow(row: typeof workflowDefinitionVersion.$inferSelect): {
     status: "active" | "inactive" | "failed";
     id: string;
     createdAt: Date;
-    agentId: string;
+    definitionId: string;
     version: string;
+    approvedWireHash: string | null;
+    grantSnapshot: unknown;
 };
 export declare function parseGrantRow(row: typeof grant.$inferSelect): {
     effect: "allow" | "deny" | "ask";
@@ -62,6 +58,182 @@ export declare function parseGrantRow(row: typeof grant.$inferSelect): {
     resource: string;
     action: string;
 };
+export declare function parseApprovalRow(row: typeof approval.$inferSelect): {
+    scope: "always" | "once" | null;
+    status: "pending" | "approved" | "rejected" | "timeout" | "expired";
+    toolDefinition: Record<string, unknown>;
+    toolArguments: Record<string, unknown>;
+    id: string;
+    createdAt: Date;
+    updatedAt: Date;
+    tenantId: string;
+    anchorRunId: string;
+    runId: string;
+    agentAddress: string;
+    correlationId: string;
+    timeoutAt: Date | null;
+    resolvedAt: Date | null;
+};
+export declare function parsePrincipalRow(row: typeof principal.$inferSelect): {
+    kind: "user" | "agent" | "workflow";
+    status: "active" | "suspended" | "invited" | "deactivated";
+    id: string;
+    createdAt: Date;
+    updatedAt: Date;
+    tenantId: string;
+    refId: string;
+};
+export declare function parseSignalCorrelationRow(row: typeof signalCorrelation.$inferSelect): {
+    kind: "approval";
+    createdAt: Date;
+    tenantId: string;
+    anchorRunId: string;
+    runId: string;
+    agentAddress: string;
+    correlationId: string;
+    resolvedAt: Date | null;
+    signalName: string;
+    signalId: string | null;
+};
+export declare function parseWorkflowRunRow(row: typeof workflowRun.$inferSelect): {
+    status: "deployed" | "failed" | "running" | "completed" | "cancelled";
+    modelPreferences: {
+        model: string;
+        providers: {
+            mode: "prefer" | "pin";
+            order: string[];
+        };
+    }[] | null;
+    id: string;
+    createdAt: Date;
+    tenantId: string;
+    definitionId: string;
+    principalId: string | null;
+    anchorRunId: string | null;
+    address: string | null;
+    publicKey: string | null;
+    sidecarId: string | null;
+    kernelId: string | null;
+    endedAt: Date | null;
+};
+export declare function parseWorkflowRunLaunchSpecRow(row: typeof workflowRunLaunchSpec.$inferSelect): {
+    frozenApprovalBundle: {
+        source: {
+            kind: "registry";
+            registry: string;
+        } | {
+            kind: "asset";
+            assetId: string;
+            package: {
+                format: "tarball";
+            } | {
+                format: "source";
+                commitSha: string;
+                packageName?: string;
+            };
+        };
+        entry: string;
+        projection: {
+            id: string;
+            triggers: unknown[];
+            stepOrder: string[];
+            steps: {
+                [x: string]: unknown;
+            };
+            state?: Record<string, unknown>;
+            credentialBindings?: {
+                package: string;
+                handle: string;
+                provider: string;
+                locator: "tenant";
+                name?: string;
+            }[];
+        };
+        closure: {
+            schemaVersion: "1";
+            topLevel: {
+                name: string;
+                version: string;
+                credentials?: {
+                    handle: string;
+                    scopes?: string[];
+                }[];
+            }[];
+            entries: {
+                name: string;
+                version: string;
+                source: {
+                    kind: "registry";
+                    registry: string;
+                    integrity: string;
+                } | {
+                    kind: "asset";
+                    assetId: string;
+                    package: {
+                        format: "tarball";
+                        path: string;
+                        integrity: string;
+                    } | {
+                        format: "source";
+                        commitSha: string;
+                        packageDir: string;
+                        treeOid: string;
+                    };
+                };
+                os?: string[];
+                cpu?: string[];
+                tarballUrl?: string;
+            }[];
+        };
+        approvedWireHash: string;
+        approvedGrants: string[];
+    };
+    sourceOfferingIds: string[];
+    deployContent: Record<string, unknown>;
+    toolPackagePins: {
+        name: string;
+        version: string;
+    }[] | null;
+    createdAt: Date;
+    anchorRunId: string;
+    sessionId: string;
+    schemaVersion: number;
+    deploymentDomain: string;
+    sourceAuthorityPrincipalId: string;
+    defaultSourceOfferingId: string;
+};
+export declare function parseWorkflowRunDispatchRow(row: typeof workflowRunDispatch.$inferSelect): {
+    kind: "signal" | "mail";
+    status: "failed" | "pending" | "acknowledged" | "settled";
+    stepGrants: {
+        id: string;
+        resource: string;
+        action: string;
+        effect: "allow" | "deny" | "ask";
+        origin: "role" | "system" | "creator" | "invoker";
+        conditions: {
+            [x: string]: unknown;
+        } | null;
+        expiresAt: Date | null;
+        roleId: string | null;
+        principalId: string | null;
+    }[];
+    id: string;
+    createdAt: Date;
+    updatedAt: Date;
+    anchorRunId: string;
+    messageId: string;
+    nextAttemptAt: Date | null;
+    failureCode: string | null;
+    failureMessage: string | null;
+    rawMessage: Uint8Array<ArrayBufferLike>;
+    acknowledgedGeneration: number | null;
+    attemptCount: number;
+    deliveryLeaseId: string | null;
+    deliveryLeaseExpiresAt: Date | null;
+    acknowledgedAt: Date | null;
+    settledAt: Date | null;
+};
 export declare function parseOfferingRow(row: typeof offering.$inferSelect): {
     pricing: Record<string, unknown> | null;
     schema: Record<string, unknown> | null;
@@ -75,7 +247,7 @@ export declare function parseOfferingRow(row: typeof offering.$inferSelect): {
 };
 export declare function parseCredentialRow(row: typeof credential.$inferSelect): {
     type: "api_key" | "oauth_token" | "certificate" | "other";
-    status: "active" | "expired" | "revoked" | "error";
+    status: "active" | "error" | "expired" | "revoked";
     metadata: Record<string, unknown> | null;
     id: string;
     name: string;
@@ -99,6 +271,7 @@ export declare function parseProviderRow(row: typeof provider.$inferSelect): {
     updatedAt: Date;
     tenantId: string;
     plugin: string;
+    apiBaseUrl: string | null;
     authorizationUrl: string | null;
     tokenUrl: string | null;
     userInfoUrl: string | null;
@@ -117,7 +290,8 @@ export declare function parseModelProviderRow(row: typeof modelProvider.$inferSe
     credentialId: string | null;
 };
 export declare function parseModelOfferingRow(row: typeof modelOffering.$inferSelect): {
-    capabilities: ("vision" | "audio-input" | "tool-use" | "extended-thinking" | "structured-output" | "long-context" | "prompt-caching")[];
+    capabilities: ("plain-text" | "plain-text-streaming" | "function-calling" | "function-calling-multi-turn" | "function-calling-multi-turn-streaming" | "function-calling-with-thinking" | "function-calling-with-thinking-streaming" | "vision-input" | "vision-input-streaming" | "audio-input" | "audio-input-streaming" | "video-input" | "video-input-streaming" | "document-input" | "document-input-streaming" | "image-output" | "image-output-streaming" | "code-execution" | "code-execution-streaming" | "reasoning-content" | "reasoning-content-streaming" | "grounding" | "grounding-streaming" | "files-api-reference" | "files-api-reference-streaming" | "redacted-thinking" | "redacted-thinking-streaming" | "structured-output" | "structured-output-streaming" | "long-context" | "prompt-caching")[];
+    quirks: Record<string, unknown> | null;
     id: string;
     createdAt: Date;
     updatedAt: Date;
@@ -129,7 +303,13 @@ export declare function parseModelOfferingRow(row: typeof modelOffering.$inferSe
     deploymentTags: string[];
 };
 export declare function parseTenantRow(row: typeof tenant.$inferSelect): {
-    config: Record<string, unknown> | null;
+    config: {
+        [x: string]: unknown;
+        sidecarPlacement?: {
+            sharing: "exclusive";
+            reuse?: "never" | "same-deployment";
+        };
+    } | null;
     domain: string;
     id: string;
     name: string;
@@ -151,10 +331,10 @@ export declare function parseWalletRow(row: typeof wallet.$inferSelect): {
 };
 export declare function parseTransactionRow(row: typeof transaction.$inferSelect): {
     direction: "inbound" | "outbound";
-    status: "failed" | "pending" | "completed";
+    status: "failed" | "completed" | "pending";
     id: string;
     createdAt: Date;
-    agentId: string | null;
+    runId: string | null;
     currency: string;
     walletId: string;
     amount: string;

package/dist/parse-row.js

@@ -1,12 +1,38 @@
 import { type } from "arktype";
-import { Capability, CredentialRequirement, GrantRequirement, grantEffects, grantOrigins, ModelProviderPlugin, ModelRequirements, } from "@intx/types";
-import { RepoAction } from "@intx/types/sidecar";
+import { Capability, CredentialBinding, GrantRequirement, grantEffects, grantOrigins, InvokerModelPreferences, ModelProviderPlugin, ModelRequirements, principalKinds, principalStatuses, signalKinds, TenantConfig, workflowDefinitionStatuses, workflowDefinitionVersionStatuses, } from "@intx/types";
+import { WireGrantRule } from "@intx/types/grant-wire";
+import { FrozenApprovalBundle, RepoAction } from "@intx/types/sidecar";
 import { ToolPackagePinArray } from "@intx/types/tool-packages";
 const JSONObject = type("Record<string, unknown>");
+const StringArray = type("string[]");
+const WireGrantRuleArray = WireGrantRule.array();
 const GrantEffectValidator = type.enumerated(...grantEffects);
 const GrantOriginValidator = type.enumerated(...grantOrigins);
-const agentVersionStatuses = ["active", "inactive", "failed"];
-const AgentVersionStatusValidator = type.enumerated(...agentVersionStatuses);
+const approvalScopes = ["once", "always"];
+const ApprovalScopeValidator = type.enumerated(...approvalScopes);
+const approvalStatuses = [
+    "pending",
+    "approved",
+    "rejected",
+    "timeout",
+    "expired",
+];
+const ApprovalStatusValidator = type.enumerated(...approvalStatuses);
+const SignalKindValidator = type.enumerated(...signalKinds);
+const workflowRunStatuses = [
+    "deployed",
+    "running",
+    "completed",
+    "failed",
+    "cancelled",
+];
+const WorkflowRunStatusValidator = type.enumerated(...workflowRunStatuses);
+const WorkflowRunDispatchStatusValidator = type.enumerated("pending", "acknowledged", "settled", "failed");
+const WorkflowRunDispatchKindValidator = type.enumerated("mail", "signal");
+const WorkflowDefinitionStatusValidator = type.enumerated(...workflowDefinitionStatuses);
+const WorkflowDefinitionVersionStatusValidator = type.enumerated(...workflowDefinitionVersionStatuses);
+const PrincipalKindValidator = type.enumerated(...principalKinds);
+const PrincipalStatusValidator = type.enumerated(...principalStatuses);
 const credentialTypes = [
     "api_key",
     "oauth_token",
@@ -31,35 +57,36 @@ const turnPartTypes = [
     "file",
     "error",
     "refusal",
+    "safety_rating",
     "step-start",
     "step-finish",
     "snapshot",
     "patch",
 ];
 const TurnPartTypeValidator = type.enumerated(...turnPartTypes);
-export function parseAgentRow(row) {
+export function parseWorkflowDefinitionRow(row) {
     return {
         ...row,
-        contextConfig: row.contextConfig !== null ? JSONObject.assert(row.contextConfig) : null,
-        initialState: row.initialState !== null ? JSONObject.assert(row.initialState) : null,
-        modelConfig: row.modelConfig !== null ? JSONObject.assert(row.modelConfig) : null,
-        capabilities: row.capabilities !== null ? JSONObject.assert(row.capabilities) : null,
-        credentialRequirements: row.credentialRequirements !== null
-            ? CredentialRequirement.array().assert(row.credentialRequirements)
+        status: WorkflowDefinitionStatusValidator.assert(row.status),
+        grantRequirements: row.grantRequirements !== null
+            ? GrantRequirement.array().assert(row.grantRequirements)
             : null,
         modelRequirements: row.modelRequirements !== null
             ? ModelRequirements.assert(row.modelRequirements)
             : null,
-        grantRequirements: row.grantRequirements !== null
-            ? GrantRequirement.array().assert(row.grantRequirements)
-            : null,
-        toolPackages: ToolPackagePinArray.assert(row.toolPackages),
+        // Nullable jsonb: `null` on a real drizzle row, `undefined` only on a
+        // partial row-shaped test stub that predates the column. Both mean "no
+        // bindings" -- treat them alike rather than asserting `undefined` as an
+        // array.
+        credentialBindings: row.credentialBindings === null || row.credentialBindings === undefined
+            ? null
+            : CredentialBinding.array().assert(row.credentialBindings),
     };
 }
-export function parseAgentVersionRow(row) {
+export function parseWorkflowDefinitionVersionRow(row) {
     return {
         ...row,
-        status: AgentVersionStatusValidator.assert(row.status),
+        status: WorkflowDefinitionVersionStatusValidator.assert(row.status),
     };
 }
 export function parseGrantRow(row) {
@@ -70,6 +97,69 @@ export function parseGrantRow(row) {
         conditions: row.conditions !== null ? JSONObject.assert(row.conditions) : null,
     };
 }
+export function parseApprovalRow(row) {
+    return {
+        ...row,
+        scope: row.scope !== null ? ApprovalScopeValidator.assert(row.scope) : null,
+        status: ApprovalStatusValidator.assert(row.status),
+        toolDefinition: JSONObject.assert(row.toolDefinition),
+        toolArguments: JSONObject.assert(row.toolArguments),
+    };
+}
+export function parsePrincipalRow(row) {
+    return {
+        ...row,
+        kind: PrincipalKindValidator.assert(row.kind),
+        status: PrincipalStatusValidator.assert(row.status),
+    };
+}
+export function parseSignalCorrelationRow(row) {
+    return {
+        ...row,
+        kind: SignalKindValidator.assert(row.kind),
+    };
+}
+export function parseWorkflowRunRow(row) {
+    return {
+        ...row,
+        status: WorkflowRunStatusValidator.assert(row.status),
+        modelPreferences: row.modelPreferences !== null
+            ? InvokerModelPreferences.assert(row.modelPreferences)
+            : null,
+    };
+}
+export function parseWorkflowRunLaunchSpecRow(row) {
+    const sourceOfferingIds = StringArray.assert(row.sourceOfferingIds);
+    assertLaunchSpecSources(sourceOfferingIds, row.defaultSourceOfferingId);
+    return {
+        ...row,
+        frozenApprovalBundle: FrozenApprovalBundle.assert(row.frozenApprovalBundle),
+        sourceOfferingIds,
+        deployContent: JSONObject.assert(row.deployContent),
+        toolPackagePins: row.toolPackagePins !== null
+            ? ToolPackagePinArray.assert(row.toolPackagePins)
+            : null,
+    };
+}
+export function parseWorkflowRunDispatchRow(row) {
+    return {
+        ...row,
+        kind: WorkflowRunDispatchKindValidator.assert(row.kind),
+        status: WorkflowRunDispatchStatusValidator.assert(row.status),
+        stepGrants: WireGrantRuleArray.assert(row.stepGrants),
+    };
+}
+function assertLaunchSpecSources(sourceOfferingIds, defaultSourceOfferingId) {
+    if (sourceOfferingIds.length === 0) {
+        throw new Error("workflow launch spec requires at least one source offering");
+    }
+    if (new Set(sourceOfferingIds).size !== sourceOfferingIds.length) {
+        throw new Error("workflow launch spec source offering ids must be unique");
+    }
+    if (!sourceOfferingIds.includes(defaultSourceOfferingId)) {
+        throw new Error(`workflow launch spec default source ${defaultSourceOfferingId} is not in its source offering ids`);
+    }
+}
 export function parseOfferingRow(row) {
     return {
         ...row,
@@ -101,12 +191,13 @@ export function parseModelOfferingRow(row) {
     return {
         ...row,
         capabilities: Capability.array().assert(row.capabilities),
+        quirks: row.quirks !== null ? JSONObject.assert(row.quirks) : null,
     };
 }
 export function parseTenantRow(row) {
     return {
         ...row,
-        config: row.config !== null ? JSONObject.assert(row.config) : null,
+        config: row.config !== null ? TenantConfig.assert(row.config) : null,
     };
 }
 export function parseWalletRow(row) {

package/dist/rekey-credential-secrets.d.ts

@@ -0,0 +1,13 @@
+import { type CredentialCipher } from "@intx/types";
+import type { DB } from "./client.js";
+export type RekeyReport = {
+    /** Credential `secret` columns newly encrypted. */
+    credentialSecrets: number;
+    /** Credential `refresh_secret` columns newly encrypted. */
+    credentialRefreshSecrets: number;
+    /** OAuth-client `client_secret` columns newly encrypted. */
+    oauthClientSecrets: number;
+    /** Columns already encrypted and left unchanged. */
+    alreadyEncrypted: number;
+};
+export declare function rekeyCredentialSecrets(db: DB["db"], cipher: CredentialCipher): Promise<RekeyReport>;

package/dist/rekey-credential-secrets.js

@@ -0,0 +1,61 @@
+// Re-key existing credential secrets: encrypt any secret still stored as
+// plaintext, in place, under the given cipher.
+//
+// Ordinarily every secret is encrypted at its write site, so on a database
+// created after encryption-at-rest landed there is nothing to do. This pass
+// exists for the transition: a database whose rows predate encryption still
+// holds plaintext, and the strict read path throws on a non-ciphertext value.
+// Running this once (against a stopped hub, so no write races an un-re-keyed
+// row) brings every row to the encrypted form.
+//
+// Idempotent: a value already a ciphertext is skipped, so the pass is safe to
+// re-run or resume after a partial failure.
+import { eq } from "drizzle-orm";
+import { credentialAad } from "@intx/types";
+import { isCiphertext } from "@intx/crypto";
+import { credential } from "./schema/credentials.js";
+import { oauthClient } from "./schema/oauth-clients.js";
+export async function rekeyCredentialSecrets(db, cipher) {
+    const report = {
+        credentialSecrets: 0,
+        credentialRefreshSecrets: 0,
+        oauthClientSecrets: 0,
+        alreadyEncrypted: 0,
+    };
+    for (const row of await db.select().from(credential)) {
+        const updates = {};
+        if (isCiphertext(row.secret)) {
+            report.alreadyEncrypted += 1;
+        }
+        else {
+            updates.secret = await cipher.encrypt(row.secret, credentialAad(row.id, "secret"));
+            report.credentialSecrets += 1;
+        }
+        if (row.refreshSecret !== null) {
+            if (isCiphertext(row.refreshSecret)) {
+                report.alreadyEncrypted += 1;
+            }
+            else {
+                updates.refreshSecret = await cipher.encrypt(row.refreshSecret, credentialAad(row.id, "refreshSecret"));
+                report.credentialRefreshSecrets += 1;
+            }
+        }
+        if (updates.secret !== undefined || updates.refreshSecret !== undefined) {
+            await db.update(credential).set(updates).where(eq(credential.id, row.id));
+        }
+    }
+    for (const row of await db.select().from(oauthClient)) {
+        if (isCiphertext(row.clientSecret)) {
+            report.alreadyEncrypted += 1;
+            continue;
+        }
+        await db
+            .update(oauthClient)
+            .set({
+            clientSecret: await cipher.encrypt(row.clientSecret, credentialAad(row.id, "clientSecret")),
+        })
+            .where(eq(oauthClient.id, row.id));
+        report.oauthClientSecrets += 1;
+    }
+    return report;
+}