@intx/db 0.2.2 → 0.4.0

package/dist/credential-resolution.js

@@ -1,8 +1,148 @@
 import { eq, and, isNull } from "drizzle-orm";
+import { toolConsumer } from "@intx/authz";
+import { credentialAad } from "@intx/types";
 import { credential } from "./schema/credentials.js";
 import { oauthClient } from "./schema/oauth-clients.js";
 import { provider } from "./schema/providers.js";
 import { getAncestorChain } from "./tenant-hierarchy.js";
+/**
+ * Thrown by `resolveCredentialRequirement` when more than one credential
+ * matches a requirement and no name disambiguates them. A distinct type so
+ * callers can catch *this* condition (a launch-blocking configuration error)
+ * without also swallowing the DB reads the resolver performs first -- an
+ * infrastructure failure must surface, not be mislabeled as ambiguity.
+ */
+export class AmbiguousCredentialError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "AmbiguousCredentialError";
+    }
+}
+/**
+ * Thrown when a referenced credential is not a tenant-owned credential the given
+ * tenant can use -- it does not exist, is not reachable in the tenant's ancestor
+ * chain, or is principal-owned. A distinct type so a caller can map a client's
+ * bad credential reference to a 4xx (a launch-blocking configuration error),
+ * separate from the infrastructure faults the resolvers otherwise surface.
+ */
+export class CredentialUnauthorizedError extends Error {
+    credentialId;
+    tenantId;
+    constructor(credentialId, tenantId) {
+        super(`credential ${credentialId} is not a tenant-owned credential usable by tenant ${tenantId}`);
+        this.name = "CredentialUnauthorizedError";
+        this.credentialId = credentialId;
+        this.tenantId = tenantId;
+    }
+}
+/**
+ * Resolve a credential USABLE by the launching tenant purely through ownership:
+ * it exists, is reachable in the tenant's ancestor chain, and is tenant-owned
+ * (`principalId IS NULL`). Returns the row -- the proof of authority -- or null.
+ *
+ * This is the one "usable by ownership" resolver: a tenant may use what it (or
+ * an ancestor) owns, and descendants inherit; a principal-owned credential is
+ * never usable this way, its delegation flowing from its owner instead. It
+ * wraps `resolveCredentialById` (the ancestor-chain check) with the tenant-owned
+ * gate, so callers do not re-implement the predicate. `buildSource` expands it
+ * inline only to distinguish an unresolved reference from a principal-owned one.
+ */
+export async function resolveTenantOwnedCredentialById(db, tenantId, credentialId) {
+    const row = await resolveCredentialById(db, tenantId, credentialId);
+    return row !== null && row.principalId === null ? row : null;
+}
+/**
+ * Resolve a set of inference-source credentialIds into the credential material
+ * delivered on a run's unified credential-material cell. An inference source
+ * references its credential by id only; for each DISTINCT id this resolves the
+ * secret under the SAME tenant-ownership authority `buildSource` uses -- the
+ * credential must exist, be reachable in the tenant's ancestor chain, and be
+ * tenant-owned (`principalId IS NULL`) -- then decrypts it at the single point of
+ * use. `providerKey`/`origin` come from the credential's own provider row
+ * (`provider.plugin` / `provider.apiBaseUrl`), so the material describes the
+ * credential itself, independent of any caller-supplied source fields.
+ *
+ * Fails CLOSED, by throwing, on the first credentialId that is unresolved, not
+ * tenant-owned, references a missing provider, or whose provider has no API
+ * origin to pin -- a secret is never dropped nor delivered without an origin. The
+ * single resolver for every inference source credentialId -> material, shared by
+ * the deploy composition (top-level + inline body sources) and any other caller
+ * that must materialize inference credentials for the cell.
+ */
+export async function resolveInferenceMaterials(db, tenantId, credentialIds, credentialCipher) {
+    const materials = new Map();
+    for (const credentialId of credentialIds) {
+        if (materials.has(credentialId))
+            continue;
+        const row = await resolveTenantOwnedCredentialById(db, tenantId, credentialId);
+        if (row === null) {
+            throw new CredentialUnauthorizedError(credentialId, tenantId);
+        }
+        const providerRow = await db.query.provider.findFirst({
+            where: eq(provider.id, row.providerId),
+        });
+        if (providerRow === undefined) {
+            throw new Error(`credential ${credentialId} references provider ${row.providerId}, which does not exist`);
+        }
+        if (providerRow.apiBaseUrl === null || providerRow.apiBaseUrl === "") {
+            throw new Error(`provider ${providerRow.name} backing credential ${credentialId} has no API base URL; cannot pin an origin for its material`);
+        }
+        materials.set(credentialId, {
+            credentialId: row.id,
+            providerKey: providerRow.plugin,
+            origin: providerRow.apiBaseUrl,
+            secret: await credentialCipher.decrypt(row.secret, credentialAad(row.id, "secret")),
+        });
+    }
+    return [...materials.values()];
+}
+/**
+ * Re-resolve the CURRENT material for a set of already-authorized credentialIds,
+ * for the reconnect resync. Unlike `resolveInferenceMaterials`, a credential
+ * that no longer exists or is `revoked` is DROPPED (omitted) rather than
+ * throwing: the resync reflects credential lifecycle, so a dead id is simply
+ * absent from the reconciled delivery and the child evicts it.
+ *
+ * A credential that IS alive but whose material cannot be resolved (its provider
+ * vanished or has no API base URL) is NOT a lifecycle removal, so it throws --
+ * the caller aborts the whole reconcile rather than delivering a partial set
+ * paired with a spurious revoke. A rotated secret is picked up because the row's
+ * current secret is decrypted here.
+ *
+ * Ids are looked up by primary key (globally unique) and come from the
+ * deployment's own persisted delivery, so no re-authorization is performed --
+ * this reflects lifecycle only.
+ */
+export async function reresolveCurrentMaterials(db, credentialIds, credentialCipher) {
+    const materials = new Map();
+    for (const credentialId of credentialIds) {
+        if (materials.has(credentialId))
+            continue;
+        const row = await db.query.credential.findFirst({
+            where: eq(credential.id, credentialId),
+        });
+        if (row === undefined)
+            continue; // deleted -> drop
+        if (row.status === "revoked")
+            continue; // revoked -> drop
+        const providerRow = await db.query.provider.findFirst({
+            where: eq(provider.id, row.providerId),
+        });
+        if (providerRow === undefined) {
+            throw new Error(`credential ${credentialId} references provider ${row.providerId}, which does not exist`);
+        }
+        if (providerRow.apiBaseUrl === null || providerRow.apiBaseUrl === "") {
+            throw new Error(`provider ${providerRow.name} backing credential ${credentialId} has no API base URL; cannot pin an origin for its material`);
+        }
+        materials.set(credentialId, {
+            credentialId: row.id,
+            providerKey: providerRow.plugin,
+            origin: providerRow.apiBaseUrl,
+            secret: await credentialCipher.decrypt(row.secret, credentialAad(row.id, "secret")),
+        });
+    }
+    return [...materials.values()];
+}
 /**
  * Resolves a provider by name, walking up the tenant hierarchy.
  * Returns the first match (child shadows parent).
@@ -104,13 +244,121 @@ export async function resolveCredentialRequirement(db, tenantId, requirement, cr
             return requirement.scopes.every((s) => rowScopes.includes(s));
         });
         const [sole] = matching;
-        if (matching.length === 1 && sole)
-            return sole;
+        // Return the resolved provider alongside the credential. The provider was
+        // already fetched above to constrain the credential query, so surfacing it
+        // spares the caller a second lookup for the provider facts (plugin, base
+        // URL) a resolved credential is always paired with.
+        if (matching.length === 1 && sole) {
+            return { credential: sole, provider: resolvedProvider };
+        }
         if (matching.length > 1) {
-            throw new Error(`Ambiguous credential match: ${matching.length} credentials match ` +
+            throw new AmbiguousCredentialError(`Ambiguous credential match: ${matching.length} credentials match ` +
                 `provider=${requirement.providerName} source=${requirement.source} ` +
                 `in tenant ${tid}. Specify a name to disambiguate.`);
         }
     }
     return null;
 }
+/**
+ * Resolve a definition's credential bindings into the material + per-handle
+ * descriptors delivered to its tools. Each credential's secret is decrypted
+ * once, keyed by credentialId (a credential backing several handles is
+ * decrypted once).
+ *
+ * This path delivers credential material only; it does not mint, stamp, or
+ * carry any grant. Credential-use authorization is enforced by a separate grant
+ * layer.
+ *
+ * The workflow-deploy path (`deployCodeSourcedWorkflow`) is the only caller
+ * today, using `delivery`. Returning a discriminated result rather than an HTTP
+ * response keeps it safe to call off the request path: a configuration failure
+ * is `ok: false`, and a transient DB read fault THROWS so the caller surfaces it
+ * rather than silently dropping a still-valid credential.
+ */
+export async function buildCredentialDelivery(args) {
+    const materials = new Map();
+    const descriptors = [];
+    for (const binding of args.bindings) {
+        const context = {
+            provider: binding.provider,
+            package: binding.package,
+            handle: binding.handle,
+        };
+        let resolved;
+        try {
+            resolved = await resolveCredentialRequirement(args.db, args.tenantId, {
+                providerName: binding.provider,
+                source: binding.locator,
+                ...(binding.name !== undefined ? { name: binding.name } : {}),
+            }, args.creatorPrincipalId, args.invokerPrincipalId);
+        }
+        catch (e) {
+            // AmbiguousCredentialError is a launch-blocking config failure; any other
+            // throw is a DB read fault the resolver performs first -- surface it, do
+            // not mislabel it as revocation.
+            if (!(e instanceof AmbiguousCredentialError))
+                throw e;
+            return {
+                ok: false,
+                reason: {
+                    code: "ambiguous",
+                    binding: context,
+                    message: `Ambiguous credential for the binding on provider ${binding.provider} (package ${binding.package}, handle ${binding.handle}): ${e.message}`,
+                },
+            };
+        }
+        if (resolved === null) {
+            return {
+                ok: false,
+                reason: {
+                    code: "unresolved",
+                    binding: context,
+                    message: `No credential resolves the binding for provider ${binding.provider} (package ${binding.package}, handle ${binding.handle})`,
+                },
+            };
+        }
+        // The credential is delivered as an origin-pinned http handle, so its
+        // provider must declare an API origin. A provider without one (OAuth-login
+        // only) cannot back a tool credential; fail closed rather than deliver an
+        // un-pinnable secret.
+        const providerOrigin = resolved.provider.apiBaseUrl;
+        if (providerOrigin === null || providerOrigin === "") {
+            return {
+                ok: false,
+                reason: {
+                    code: "no_origin",
+                    binding: context,
+                    message: `Provider ${binding.provider} has no API base URL; cannot deliver an origin-pinned credential (package ${binding.package}, handle ${binding.handle})`,
+                },
+            };
+        }
+        const credentialId = resolved.credential.id;
+        // A binding resolves only a tenant-owned credential (the `tenant` locator
+        // filters `principalId IS NULL` in resolveCredentialRequirement), so its use
+        // is authorized by ownership -- already proven by this walk-up resolution,
+        // not re-checked here. This path delivers credential material only; it does
+        // not mint or carry any grant. Credential-use authorization is enforced by a
+        // separate grant layer.
+        descriptors.push({
+            handle: binding.handle,
+            credentialId,
+            consumer: toolConsumer(binding.package),
+        });
+        if (!materials.has(credentialId)) {
+            // Decrypt at the single point of use. A decrypt failure propagates and
+            // fails the caller closed; there is no placeholder secret.
+            materials.set(credentialId, {
+                credentialId,
+                providerKey: resolved.provider.plugin,
+                origin: providerOrigin,
+                secret: await args.credentialCipher.decrypt(resolved.credential.secret, credentialAad(credentialId, "secret")),
+            });
+        }
+    }
+    return {
+        ok: true,
+        delivery: descriptors.length > 0
+            ? { bindings: descriptors, materials: [...materials.values()] }
+            : undefined,
+    };
+}

package/dist/grant-store.js

@@ -2,6 +2,7 @@ import { eq, and, or, isNull, gt, inArray } from "drizzle-orm";
 import { grant } from "./schema/grants.js";
 import { principalRole } from "./schema/roles.js";
 import { parseGrantRow } from "./parse-row.js";
+import { getAncestorChain } from "./tenant-hierarchy.js";
 function toGrantRule(row) {
     const parsed = parseGrantRow(row);
     return {
@@ -16,22 +17,43 @@ function toGrantRule(row) {
         principalId: parsed.principalId,
     };
 }
+/**
+ * Collects a principal's live (non-expired) grants — the ones the principal
+ * owns directly plus the ones granted to any role it holds — restricted to
+ * the tenants matched by `tenantScope`. The scope is the sole knob that
+ * decides single-tenant versus chain-aware collection.
+ */
+async function collectGrantsScoped(db, principalId, tenantScope) {
+    const roleAssignments = await db.query.principalRole.findMany({
+        where: eq(principalRole.principalId, principalId),
+    });
+    const roleIds = roleAssignments.map((a) => a.roleId);
+    const now = new Date();
+    const ownership = [eq(grant.principalId, principalId)];
+    if (roleIds.length > 0) {
+        ownership.push(inArray(grant.roleId, roleIds));
+    }
+    const rows = await db.query.grant.findMany({
+        where: and(tenantScope, or(...ownership), or(isNull(grant.expiresAt), gt(grant.expiresAt, now))),
+    });
+    return rows.map(toGrantRule);
+}
 export function createGrantStore(db) {
     return {
         async collectGrants(principalId, tenantId) {
-            const roleAssignments = await db.query.principalRole.findMany({
-                where: eq(principalRole.principalId, principalId),
-            });
-            const roleIds = roleAssignments.map((a) => a.roleId);
-            const now = new Date();
-            const ownership = [eq(grant.principalId, principalId)];
-            if (roleIds.length > 0) {
-                ownership.push(inArray(grant.roleId, roleIds));
-            }
-            const rows = await db.query.grant.findMany({
-                where: and(eq(grant.tenantId, tenantId), or(...ownership), or(isNull(grant.expiresAt), gt(grant.expiresAt, now))),
-            });
-            return rows.map(toGrantRule);
+            return collectGrantsScoped(db, principalId, eq(grant.tenantId, tenantId));
+        },
+        // Union the principal's grants across the tenant ancestor chain — the
+        // acting tenant plus every ancestor up to the root. Mirrors the
+        // ancestor-chain resolution credential lookup already performs, so a
+        // `credential:{id}` / `use` grant stamped with an ancestor tenant (as the
+        // mint path and 0037 backfill do) still authorizes use of a credential
+        // inherited down the chain. Kept distinct from the single-tenant
+        // `collectGrants` so only the source-resolution credential-use check
+        // widens to the chain; the general RBAC path stays single-tenant.
+        async collectGrantsInChain(principalId, tenantId) {
+            const chain = await getAncestorChain(db, tenantId);
+            return collectGrantsScoped(db, principalId, inArray(grant.tenantId, chain));
         },
     };
 }

package/dist/index.d.ts

@@ -1,13 +1,28 @@
-export { createDB, type DB } from "./client.js";
+export { createDB, type AnyPgDatabase, type DB, type DBExecutor, } from "./client.js";
 export { pgErrorCode, PG_UNIQUE_VIOLATION, PG_FOREIGN_KEY_VIOLATION, } from "./pg-error.js";
 export type { DBConfig } from "./config.js";
 export { runMigrations, dropSchema } from "./migrate.js";
+export { rekeyCredentialSecrets, type RekeyReport, } from "./rekey-credential-secrets.js";
+export { backfillPrincipalKeys, type BackfillPrincipalKeysReport, } from "./backfill-principal-keys.js";
 export { createGrantStore } from "./grant-store.js";
-export { getAncestorChain, getDescendantTenants } from "./tenant-hierarchy.js";
+export { createPrincipalStore, type PrincipalStore } from "./principal-store.js";
+export { createPrincipalKeyStore, type CreatePrincipalKeyStoreDeps, type PrincipalKeyStore, } from "./principal-key-store.js";
+export { lookupLocalPrincipalSigner } from "./signer-identity.js";
+export { resolveSenderKey, resolveFrameSenderKey, auditSenderKeys, type SenderKeyResolution, type SenderKeyAuditReport, } from "./sender-key-resolver.js";
+export { createApprovalStore, type ApprovalStore, type ResolveApprovalArgs, } from "./approval-store.js";
+export { createSignalCorrelationStore, type SignalCorrelationStore, } from "./signal-correlation-store.js";
+export { createWorkflowRunStore, type WorkflowRunStore, } from "./workflow-run-store.js";
+export { createWorkflowRunLaunchSpecStore, type WorkflowRunLaunchSpecStore, } from "./workflow-run-launch-spec-store.js";
+export { createWorkflowRunDispatchStore, WorkflowRunDispatchPayloadConflictError, type AcknowledgeWorkflowRunDispatchArgs, type ClaimWorkflowRunDispatchArgs, type EnqueueWorkflowRunDispatchArgs, type EnqueueWorkflowRunDispatchResult, type EnqueueWorkflowSignalDispatchArgs, type RetryWorkflowRunDispatchArgs, type WorkflowRunDispatchStore, } from "./workflow-run-dispatch-store.js";
+export { createSidecarAllocationStore, type BeginSidecarReleaseArgs, type BeginSidecarReplacementArgs, type BindInitialSidecarArgs, type BindReplacementSidecarArgs, type CreateAdoptedSidecarAllocationArgs, type ClaimSidecarAllocationArgs, type CreatePendingSidecarAllocationArgs, type FailSidecarAllocationArgs, type MarkSidecarAllocatedArgs, type MarkSidecarConnectionLostArgs, type MarkSidecarConnectionReadyArgs, type MarkSidecarDestroyFailedArgs, type MarkSidecarReleasedArgs, type ParkSidecarReconciliationPolicy, type ScheduleSidecarAllocationRetryArgs, type SidecarAllocation, type SidecarAllocationStore, } from "./sidecar-allocation-store.js";
+export { createWorkflowProbeStore, type BindWorkflowProbeSidecarArgs, type CreateWorkflowProbeArgs, type WorkflowProbe, type WorkflowProbeStore, } from "./workflow-probe-store.js";
+export { createWorkflowDefinitionStore, loadFrozenGrantSnapshot, resolveDefinitionIdForAsset, type WorkflowDefinitionRollbackResult, type WorkflowDefinitionSelector, } from "./workflow-definition-store.js";
+export { getAncestorChain, getDescendantTenants, resolveTenantSidecarCapabilityPolicies, } from "./tenant-hierarchy.js";
 export { resolveActivePrice, type ModelPricingRow } from "./pricing.js";
-export { resolveProviderByName, resolveOAuthClient, resolveCredentialByName, resolveCredentialById, resolveCredentialRequirement, } from "./credential-resolution.js";
+export { resolveProviderByName, resolveOAuthClient, resolveCredentialByName, resolveCredentialById, resolveCredentialRequirement, resolveTenantOwnedCredentialById, resolveInferenceMaterials, reresolveCurrentMaterials, AmbiguousCredentialError, CredentialUnauthorizedError, buildCredentialDelivery, } from "./credential-resolution.js";
+export type { BuildCredentialDeliveryResult, CredentialDeliveryFailure, } from "./credential-resolution.js";
 export { resolveAssetByName, resolveAssetById, listAssetsForTenant, type AssetRow, type AssetWithOrigin, } from "./asset-resolution.js";
 export { listVisibleModels, listVisibleProviders, listVisibleOfferings, type ModelRow, type ModelProviderRow, type ModelOfferingRow, type Origin, type VisibleModel, type VisibleProvider, type ResolvedOffering, } from "./catalog-resolution.js";
-export { resolveModelSources, resolveInstanceModelSources, type CatalogSourceResolution, type SourceSkip, } from "./model-source-resolution.js";
-export { parseAgentRow, parseAgentVersionRow, parseGrantRow, parseOfferingRow, parseCredentialRow, parseProviderRow, parseTenantRow, parseWalletRow, parseTransactionRow, parseOAuthClientRow, parseGitTokenRow, parseTurnPartType, } from "./parse-row.js";
+export { resolveModelSources, resolveInferencePreferences, resolveInstanceModelSources, resolveSourcesByOfferingIds, type CatalogSourceResolution, type OfferingSourceResolution, type SourceSkip, } from "./model-source-resolution.js";
+export { parseGrantRow, parseApprovalRow, parsePrincipalRow, parsePrincipalKeyRow, parseSignalCorrelationRow, parseWorkflowRunRow, parseWorkflowRunDispatchRow, parseWorkflowRunLaunchSpecRow, parseWorkflowDefinitionRow, parseWorkflowDefinitionVersionRow, parseOfferingRow, parseModelOfferingRow, parseCredentialRow, parseProviderRow, parseTenantRow, parseWalletRow, parseTransactionRow, parseOAuthClientRow, parseGitTokenRow, parseTurnPartType, } from "./parse-row.js";
 export * as schema from "./schema/index.js";

package/dist/index.js

@@ -1,12 +1,26 @@
-export { createDB } from "./client.js";
+export { createDB, } from "./client.js";
 export { pgErrorCode, PG_UNIQUE_VIOLATION, PG_FOREIGN_KEY_VIOLATION, } from "./pg-error.js";
 export { runMigrations, dropSchema } from "./migrate.js";
+export { rekeyCredentialSecrets, } from "./rekey-credential-secrets.js";
+export { backfillPrincipalKeys, } from "./backfill-principal-keys.js";
 export { createGrantStore } from "./grant-store.js";
-export { getAncestorChain, getDescendantTenants } from "./tenant-hierarchy.js";
+export { createPrincipalStore } from "./principal-store.js";
+export { createPrincipalKeyStore, } from "./principal-key-store.js";
+export { lookupLocalPrincipalSigner } from "./signer-identity.js";
+export { resolveSenderKey, resolveFrameSenderKey, auditSenderKeys, } from "./sender-key-resolver.js";
+export { createApprovalStore, } from "./approval-store.js";
+export { createSignalCorrelationStore, } from "./signal-correlation-store.js";
+export { createWorkflowRunStore, } from "./workflow-run-store.js";
+export { createWorkflowRunLaunchSpecStore, } from "./workflow-run-launch-spec-store.js";
+export { createWorkflowRunDispatchStore, WorkflowRunDispatchPayloadConflictError, } from "./workflow-run-dispatch-store.js";
+export { createSidecarAllocationStore, } from "./sidecar-allocation-store.js";
+export { createWorkflowProbeStore, } from "./workflow-probe-store.js";
+export { createWorkflowDefinitionStore, loadFrozenGrantSnapshot, resolveDefinitionIdForAsset, } from "./workflow-definition-store.js";
+export { getAncestorChain, getDescendantTenants, resolveTenantSidecarCapabilityPolicies, } from "./tenant-hierarchy.js";
 export { resolveActivePrice } from "./pricing.js";
-export { resolveProviderByName, resolveOAuthClient, resolveCredentialByName, resolveCredentialById, resolveCredentialRequirement, } from "./credential-resolution.js";
+export { resolveProviderByName, resolveOAuthClient, resolveCredentialByName, resolveCredentialById, resolveCredentialRequirement, resolveTenantOwnedCredentialById, resolveInferenceMaterials, reresolveCurrentMaterials, AmbiguousCredentialError, CredentialUnauthorizedError, buildCredentialDelivery, } from "./credential-resolution.js";
 export { resolveAssetByName, resolveAssetById, listAssetsForTenant, } from "./asset-resolution.js";
 export { listVisibleModels, listVisibleProviders, listVisibleOfferings, } from "./catalog-resolution.js";
-export { resolveModelSources, resolveInstanceModelSources, } from "./model-source-resolution.js";
-export { parseAgentRow, parseAgentVersionRow, parseGrantRow, parseOfferingRow, parseCredentialRow, parseProviderRow, parseTenantRow, parseWalletRow, parseTransactionRow, parseOAuthClientRow, parseGitTokenRow, parseTurnPartType, } from "./parse-row.js";
+export { resolveModelSources, resolveInferencePreferences, resolveInstanceModelSources, resolveSourcesByOfferingIds, } from "./model-source-resolution.js";
+export { parseGrantRow, parseApprovalRow, parsePrincipalRow, parsePrincipalKeyRow, parseSignalCorrelationRow, parseWorkflowRunRow, parseWorkflowRunDispatchRow, parseWorkflowRunLaunchSpecRow, parseWorkflowDefinitionRow, parseWorkflowDefinitionVersionRow, parseOfferingRow, parseModelOfferingRow, parseCredentialRow, parseProviderRow, parseTenantRow, parseWalletRow, parseTransactionRow, parseOAuthClientRow, parseGitTokenRow, parseTurnPartType, } from "./parse-row.js";
 export * as schema from "./schema/index.js";

package/dist/model-source-resolution.d.ts

@@ -1,5 +1,6 @@
-import { type ModelRequirement, type ProviderPreference } from "@intx/types";
+import { type CredentialCipher, type ModelRequirement, type ProviderPreference } from "@intx/types";
 import type { InferenceSource } from "@intx/types/runtime";
+import type { CredentialMaterialEntry } from "@intx/types/sidecar";
 import type { DB } from "./client.js";
 /**
  * Why a single offering could not be turned into a launchable source.
@@ -12,6 +13,9 @@ export type SourceSkip = {
 } | {
     reason: "credential_unresolved";
     provider: string;
+} | {
+    reason: "credential_unauthorized";
+    provider: string;
 } | {
     reason: "provider_misconfigured";
     provider: string;
@@ -31,6 +35,7 @@ export type SourceSkip = {
 export type CatalogSourceResolution = {
     ok: true;
     sources: InferenceSource[];
+    materials: CredentialMaterialEntry[];
 } | {
     ok: false;
     reason: "no_requirements";
@@ -40,6 +45,22 @@ export type CatalogSourceResolution = {
     model: string;
     skips: SourceSkip[];
 };
+export type OfferingSourceResolution = {
+    ok: true;
+    sources: InferenceSource[];
+} | {
+    ok: false;
+    reason: "offering_unavailable";
+    offeringId: string;
+    skip?: SourceSkip;
+};
+/**
+ * Rebuild an exact, ordered source chain from durable catalog offering ids.
+ * This is the recovery counterpart to launch-time source selection: it keeps
+ * secrets out of persisted launch specs and rechecks tenant visibility and
+ * credential ownership on every launch.
+ */
+export declare function resolveSourcesByOfferingIds(db: DB["db"], tenantId: string, offeringIds: readonly string[], credentialCipher: CredentialCipher): Promise<OfferingSourceResolution>;
 /**
  * Resolves an agent's model requirements against the tenant catalog into an
  * ordered `InferenceSource[]` for the harness.
@@ -51,19 +72,45 @@ export type CatalogSourceResolution = {
  * offering is resolved to a credential-backed source; offerings that cannot
  * produce one are skipped. A required model that yields no source makes the
  * agent unlaunchable.
+ *
+ * A credential-backed source is emitted only when the launching tenant owns
+ * the referenced credential within its hierarchy (ownership is the authority);
+ * otherwise the offering is skipped (`credential_unauthorized`) and its secret
+ * is withheld.
  */
-export declare function resolveModelSources(db: DB["db"], tenantId: string, requirements: ModelRequirement[], opts?: {
+export declare function resolveModelSources(db: DB["db"], tenantId: string, requirements: ModelRequirement[], credentialCipher: CredentialCipher, opts?: {
     invokerPreferences?: Record<string, ProviderPreference>;
 }): Promise<CatalogSourceResolution>;
+/**
+ * Resolve an agent's model requirements to the credential-free
+ * `{ provider, model }` inference preferences a folded workflow definition
+ * carries on its step agent. Reuses `resolveModelSources` -- the same catalog
+ * + creator-grant resolution the instance launch path runs -- and projects its
+ * ordered sources to their `{ provider (plugin), model }` identity, dropping
+ * the credentials: a definition's inference preference is hash-only, and the
+ * credential-bearing sources are supplied per deploy on the workflow path.
+ *
+ * A requirement set that resolves to no source is a hard failure. A folded
+ * agent whose model is unresolvable is undeployable, so this raises rather
+ * than synthesizing an empty preference list that would silently strip the
+ * agent's inference. It also raises when the resolved sources are not
+ * injective on `(provider, model)` -- the projection would otherwise freeze
+ * an ambiguous preference list whose lost `offering.id` distinctions cannot be
+ * recovered after the agent's columns are dropped.
+ */
+export declare function resolveInferencePreferences(db: DB["db"], tenantId: string, requirements: ModelRequirement[], credentialCipher: CredentialCipher): Promise<{
+    provider: string;
+    model: string;
+}[]>;
 /**
  * Resolves the ordered sources for a running instance from persisted state:
- * the agent definition's model requirements and the invoker's launch-time
- * preferences stored on the instance row. Launch, credential-rotation push,
- * and sidecar reconnect all resolve through this, so a running instance's
+ * the definition's model requirements and the invoker's launch-time
+ * preferences stored on the instance row. The credential-rotation and
+ * catalog-edit source push resolves through this, so a running instance's
  * source list is a pure function of persisted state — re-resolution
  * reproduces the launch ordering, including the invoker's reorder/restrict.
  */
 export declare function resolveInstanceModelSources(db: DB["db"], tenantId: string, instance: {
-    agentId: string;
+    definitionId: string;
     modelPreferences: unknown;
-}): Promise<CatalogSourceResolution>;
+}, credentialCipher: CredentialCipher): Promise<CatalogSourceResolution>;