Duck-type across defineTool/GrantStore interface versions (CL-5865 follow-up)

Consumers with a newer @intx/agent (static definitions on defineTool
options) or @intx/authz (collectGrantsInChain on GrantStore) than this
package's own pinned dependency were failing to typecheck the raw
source pulled in transitively through the resident distiller's export
of the memory tool factories. Both fixes bind the object to a named
const before handing it to the typed API instead of a fresh literal,
so normal structural (duck-typed) assignment applies rather than
TypeScript's excess-property check on literals — the object satisfies
either interface shape, and an older caller simply never reads the
extra field.

Author: TheGreatAxios

src/ports/writable-grant-store.ts

@@ -32,20 +32,36 @@ export function createInMemoryWritableGrantStore(
   initial: GrantRule[] = [],
 ): WritableGrantStore & { grants: GrantRule[] } {
   const grants = [...initial];
-  return {
+  function collect(principalId: string) {
+    const now = new Date();
+    return grants.filter((g) => {
+      if (g.principalId !== principalId) return false;
+      if (g.expiresAt !== null && g.expiresAt <= now) return false;
+      return true;
+    });
+  }
+  // Bound to a const rather than returned as a fresh object literal: some
+  // `@intx/authz` versions require `collectGrantsInChain` on `GrantStore`
+  // (an ancestor-chain walk) that this package's own pinned version
+  // predates. Routing through a named variable gets normal structural
+  // assignment for the function's declared return type instead of
+  // TypeScript's excess-property check on literals, so this satisfies
+  // either shape — tenantId (and thus the ancestor chain) is a no-op here
+  // regardless, matching `createInMemoryGrantStore`'s own tenant-scoped
+  // fixture semantics.
+  const store = {
     grants,
     async collectGrants(principalId: string, _tenantId?: string) {
-      const now = new Date();
-      return grants.filter((g) => {
-        if (g.principalId !== principalId) return false;
-        if (g.expiresAt !== null && g.expiresAt <= now) return false;
-        return true;
-      });
+      return collect(principalId);
+    },
+    async collectGrantsInChain(principalId: string, _tenantId?: string) {
+      return collect(principalId);
     },
     async putGrant(grant: GrantRule) {
       const idx = grants.findIndex((g) => g.id === grant.id);
       if (idx >= 0) grants[idx] = grant;
       else grants.push(grant);
     },
   };
+  return store;
 }

src/tools/install.ts

@@ -37,10 +37,19 @@ export function defineMemoryHttpTool(opts: {
     signal: AbortSignal | undefined,
   ) => Promise<string>;
 }) {
-  return defineTool<MemoryInstallEnv>({
+  // Bound to a const rather than passed as a fresh object literal: some
+  // `@intx/agent` versions add a static `definitions` field to defineTool's
+  // options (so callers can enumerate tool names without instantiating the
+  // factory) that this package's own pinned version predates. Routing
+  // through a named variable gets normal structural (duck-typed) parameter
+  // assignment instead of TypeScript's excess-property check on literals,
+  // so this call type-checks against either shape — the extra field is
+  // simply unused by an older defineTool at runtime.
+  const toolOpts = {
     id: opts.id,
     requires: MEMORY_TOOL_ENV_KEYS,
-    factory(env) {
+    definitions: [{ name: opts.name }],
+    factory(env: MemoryInstallEnv) {
       const client = createMemoryHttpClient(readMemoryToolEnv(env));
       const runner = createToolRunner([
         stringTool({
@@ -55,8 +64,9 @@ export function defineMemoryHttpTool(opts: {
       ]);
       return {
         definitions: runner.definitions,
-        run: (call, signal) => runner.run(call, signal),
+        run: runner.run.bind(runner),
       };
     },
-  });
+  };
+  return defineTool<MemoryInstallEnv>(toolOpts);
 }