@intx/hub-sessions 0.2.2 → 0.3.0

package/README.md

@@ -95,11 +95,9 @@ for the authoritative type shapes.
 ### Asset service
 
 - `createAssetService` / `AssetService`, `AssetServiceError`,
-  `DEFAULT_ASSET_REF`, and the supporting types `Asset`, `AgentAsset`,
-  `AgentAssetWithAsset`, `AccessMode`, `CreateAssetParams`,
-  `PopulateAssetParams`, `AttachAssetParams`,
-  `AssetServiceErrorReason`, `ReadAssetBlobParams`,
-  `ListAssetBlobsParams`.
+  `DEFAULT_ASSET_REF`, and the supporting types `Asset`,
+  `CreateAssetParams`, `PopulateAssetParams`, `AssetServiceErrorReason`,
+  `ReadAssetBlobParams`, `ListAssetBlobsParams`.
 
 ### Skills stanza and credential push
 

package/dist/agent-repo.d.ts

@@ -1,6 +1,6 @@
-import type { GCPolicy } from "@intx/storage-isogit";
+import type { GCPolicy } from "@intx/storage-isogit/node";
 import type { ToolPackageManifest } from "@intx/types/tool-packages";
-import type { RepoId, RepoStore } from "./repo-store/index.js";
+import type { NewlyTerminalRun, RepoId, RepoStore } from "./repo-store/index.js";
 export type DeployContent = {
     systemPrompt: string;
     /**
@@ -44,7 +44,7 @@ export type AgentRepoStore = {
      * tree.
      *
      * `repoId.kind` must be `"agent-state"`. The `repoId.id` is used as
-     * the agent address internally. Stamps an
+     * the run address internally. Stamps an
      * `AgentStateSidecarPrincipal` so the agent-state kind handler
      * authorizes the receivePack as a per-agent sidecar write.
      */
@@ -55,13 +55,17 @@ export type AgentRepoStore = {
      * tree.
      *
      * `repoId.kind` must be `"workflow-run"`. Stamps a
-     * `WorkflowRunSupervisorPrincipal` whose `deploymentId` equals
+     * `WorkflowRunSupervisorPrincipal` whose `anchorRunId` equals
      * `repoId.id`; the workflow-run kind handler denies sidecar-kind
      * writes by design, so the supervisor branch is the correct path for
      * sidecar-originated run-event commits (the supervisor lives on the
      * sidecar and is the actual signer of the run events).
+     *
+     * Returns the runs the pack drove terminal, surfaced from the
+     * substrate's per-commit validation so a caller can flip the run's
+     * DB state without re-deriving terminal-ness.
      */
-    receiveWorkflowRunPack(repoId: RepoId, pack: Uint8Array, ref: string, commitSha: string): Promise<void>;
+    receiveWorkflowRunPack(repoId: RepoId, pack: Uint8Array, ref: string, commitSha: string): Promise<NewlyTerminalRun[]>;
     /** Resolve the current deploy ref SHA, or null if no deploy exists. */
     getDeployRef(agentId: string): Promise<string | null>;
     /** Raw 32-byte Ed25519 public key used to sign deploy commits. */

package/dist/agent-repo.js

@@ -93,10 +93,10 @@ export function createAgentRepoStore(config) {
             }
             const principal = {
                 kind: "supervisor",
-                deploymentId: incomingRepoId.id,
+                anchorRunId: incomingRepoId.id,
             };
             const expectedOldSha = await store.resolveRef(hub, incomingRepoId, ref);
-            await store.receivePack(principal, incomingRepoId, ref, pack, commitSha, expectedOldSha);
+            return store.receivePack(principal, incomingRepoId, ref, pack, commitSha, expectedOldSha);
         },
         async getDeployRef(agentId) {
             return store.resolveRef(hub, repoId(agentId), AGENT_STATE_DEPLOY_REF);

package/dist/agent-state-kind.js

@@ -178,6 +178,10 @@ export const agentStateAuthorize = (principal, repoId, ref, action) => {
             reason: `authz verdict denied for ${expectedResource} ${expectedGrantVerb}`,
         };
     }
+    // Fail closed on any kind not handled above. The tenant-level
+    // `workflow` principal kind (`@intx/types` principalKinds) is a
+    // grant owner, not an agent-state bearer, and never carries an
+    // agent-state repo push here -- so it is intentionally left denied.
     return {
         allowed: false,
         reason: `unknown principal kind: ${principal.kind}`,

package/dist/asset-service.d.ts

@@ -11,18 +11,6 @@ export type Asset = {
     createdAt: Date;
     updatedAt: Date;
 };
-export type AccessMode = "read-only" | "read-write";
-export type AgentAsset = {
-    id: string;
-    agentId: string;
-    assetId: string;
-    ref: string;
-    accessMode: AccessMode;
-    createdAt: Date;
-};
-export type AgentAssetWithAsset = AgentAsset & {
-    asset: Pick<Asset, "id" | "tenantId" | "kind" | "name" | "displayName">;
-};
 export type CreateAssetParams = {
     tenantId: string;
     /** Accepted kinds: "skill", "package-registry", "workflow".
@@ -48,19 +36,11 @@ export type PopulateAssetParams = {
      * (e.g. skillAuthorize only permits `kind: "hub"` writes). */
     principal: Principal;
 };
-export type AttachAssetParams = {
-    agentId: string;
-    assetId: string;
-    ref: string;
-    accessMode?: AccessMode;
-};
 export interface AssetService {
     createAsset(params: CreateAssetParams): Promise<Asset>;
     populateAsset(params: PopulateAssetParams): Promise<{
         commitSha: string;
     }>;
-    attachAsset(params: AttachAssetParams): Promise<AgentAsset>;
-    listAgentAssets(agentId: string): Promise<AgentAssetWithAsset[]>;
     /**
      * In-process blob read. Resolves the asset's row, then reads the blob
      * at `path` from the commit pointed to by `ref` (defaults to
@@ -99,6 +79,7 @@ export declare const DEFAULT_ASSET_REF = "refs/heads/main";
 /** Discriminator for AssetServiceError variants. Lets callers branch
  * without instanceof gymnastics across the different error subclasses. */
 export type AssetServiceErrorReason = "unsupported_kind" | "duplicate_asset" | "duplicate_attachment" | "invalid_name" | "invalid_reference" | "name_reserved" | "not_found" | "path_violation";
+export declare const ASSET_NAME_PATTERN: RegExp;
 export declare class AssetServiceError extends Error {
     readonly reason: AssetServiceErrorReason;
     constructor(reason: AssetServiceErrorReason, message: string, cause?: unknown);

package/dist/asset-service.js

@@ -1,4 +1,4 @@
-// In-process service for creating and attaching skill-asset repos.
+// In-process service for creating and populating skill-asset repos.
 //
 // Three responsibilities are layered here, mirroring the substrate's
 // own layering (DB row, repo bookkeeping, content validation):
@@ -8,19 +8,15 @@
 //   populateAsset  drives RepoStore.writeTree, which runs the kind
 //                  handler's validatePush before advancing the ref.
 //                  Content rejections surface as AssetValidationError.
-//   attachAsset    inserts an agent_asset row, surfacing the
-//                  (agentId, assetId) uniqueness violation (which
-//                  prevents the same asset being attached to one
-//                  agent twice) as AssetAttachError.
 //
 // The factory is closure-based to match createAgentRepoStore and
 // createRepoStore. There is no class because there is no per-instance
 // mutable state — every method is a pure function over the deps.
 import fs from "node:fs";
-import { asc, eq } from "drizzle-orm";
+import { eq } from "drizzle-orm";
 import git from "isomorphic-git";
-import { pgErrorCode, PG_UNIQUE_VIOLATION, PG_FOREIGN_KEY_VIOLATION, } from "@intx/db";
-import { agentAsset as agentAssetTable, asset as assetTable, } from "@intx/db/schema";
+import { pgErrorCode, PG_UNIQUE_VIOLATION } from "@intx/db";
+import { asset as assetTable } from "@intx/db/schema";
 import { generateId } from "@intx/hub-common";
 import { getLogger } from "@intx/log";
 const logger = getLogger(["hub-sessions", "asset-service"]);
@@ -36,8 +32,11 @@ export const DEFAULT_ASSET_REF = "refs/heads/main";
 // character set; validate at the createAsset boundary so a bad name
 // fails at creation time rather than at materialization time. Names
 // must be lowercase-kebab: lowercase letters, digits, hyphens, with
-// no leading or trailing hyphen.
-const ASSET_NAME_PATTERN = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
+// no leading or trailing hyphen. Exported so a caller deriving a name
+// (the agent-fold materializer) asserts the shape at its own boundary
+// rather than discovering a violation three layers in as a generic
+// `invalid_name`.
+export const ASSET_NAME_PATTERN = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
 export class AssetServiceError extends Error {
     reason;
     constructor(reason, message, cause) {
@@ -46,9 +45,6 @@ export class AssetServiceError extends Error {
         this.reason = reason;
     }
 }
-function isAccessMode(value) {
-    return value === "read-only" || value === "read-write";
-}
 /**
  * Reject malformed `dir` arguments at the `listAssetBlobs` boundary
  * before any tree walk begins. The empty string is the documented
@@ -112,19 +108,6 @@ function rowToAsset(row) {
         updatedAt: row.updatedAt,
     };
 }
-function rowToAgentAsset(row) {
-    if (!isAccessMode(row.accessMode)) {
-        throw new Error(`agent_asset row ${row.id} has unknown accessMode ${JSON.stringify(row.accessMode)}`);
-    }
-    return {
-        id: row.id,
-        agentId: row.agentId,
-        assetId: row.assetId,
-        ref: row.ref,
-        accessMode: row.accessMode,
-        createdAt: row.createdAt,
-    };
-}
 export function createAssetService(deps) {
     const { db, repoStore } = deps;
     const reservedPackageRegistryNames = deps.reservedPackageRegistryNames ?? new Set();
@@ -216,69 +199,6 @@ export function createAssetService(deps) {
             throw err;
         }
     }
-    async function attachAsset(params) {
-        const id = generateId("agentAsset");
-        const accessMode = params.accessMode ?? "read-only";
-        const insertRow = {
-            id,
-            agentId: params.agentId,
-            assetId: params.assetId,
-            ref: params.ref,
-            accessMode,
-            createdAt: new Date(),
-        };
-        let inserted;
-        try {
-            const rows = await db
-                .insert(agentAssetTable)
-                .values(insertRow)
-                .returning();
-            const row = rows[0];
-            if (row === undefined) {
-                throw new Error("insert into agent_asset returned no rows");
-            }
-            inserted = row;
-        }
-        catch (err) {
-            if (pgErrorCode(err) === PG_UNIQUE_VIOLATION) {
-                throw new AssetServiceError("duplicate_attachment", `agent_asset (agentId=${params.agentId}, assetId=${params.assetId}) already attached`, err);
-            }
-            if (pgErrorCode(err) === PG_FOREIGN_KEY_VIOLATION) {
-                throw new AssetServiceError("invalid_reference", `agent_asset (agentId=${params.agentId}, assetId=${params.assetId}) references a missing agent or asset`, err);
-            }
-            throw err;
-        }
-        return rowToAgentAsset(inserted);
-    }
-    async function listAgentAssets(agentId) {
-        // Order by (createdAt, id) so the row sequence is stable across reads
-        // — the available_skills stanza and pack fan-out both depend on a
-        // deterministic order, and Postgres does not guarantee one without
-        // an explicit orderBy.
-        const rows = await db
-            .select({
-            agentAsset: agentAssetTable,
-            asset: assetTable,
-        })
-            .from(agentAssetTable)
-            .innerJoin(assetTable, eq(agentAssetTable.assetId, assetTable.id))
-            .where(eq(agentAssetTable.agentId, agentId))
-            .orderBy(asc(agentAssetTable.createdAt), asc(agentAssetTable.id));
-        return rows.map((row) => {
-            const aa = rowToAgentAsset(row.agentAsset);
-            const a = rowToAsset(row.asset);
-            return {
-                ...aa,
-                asset: {
-                    id: a.id,
-                    tenantId: a.tenantId,
-                    kind: a.kind,
-                    name: a.name,
-                    displayName: a.displayName,
-                },
-            };
-        });
-    }
     async function resolveAssetRowOrThrow(assetId, label) {
         const row = await db.query.asset.findFirst({
             where: eq(assetTable.id, assetId),
@@ -341,8 +261,6 @@ export function createAssetService(deps) {
     return {
         createAsset,
         populateAsset,
-        attachAsset,
-        listAgentAssets,
         readAssetBlob,
         listAssetBlobs,
     };

package/dist/committed-source-tree.d.ts

@@ -0,0 +1,10 @@
+import type { CommittedReads } from "./repo-store/types.js";
+import type { SourceTreeReads } from "./workflow-source-closure.js";
+/**
+ * Wrap `reads` so `readBlob(path)` resolves a repo-relative POSIX path to its
+ * blob: list the path's parent directory, match the final segment as a `blob`
+ * entry, then read by its object id. `listDir` and `treeOid` pass straight
+ * through -- both handles already speak repo-relative paths and return the same
+ * shapes.
+ */
+export declare function committedReadsToSourceTree(reads: CommittedReads): SourceTreeReads;

package/dist/committed-source-tree.js

@@ -0,0 +1,35 @@
+// Adapts a repo-store `CommittedReads` handle (reads pinned to a commit,
+// addressed by object id) to the `SourceTreeReads` shape the source-closure
+// resolver consumes (reads addressed by repo-relative path). This bridge lives
+// at the caller layer, not inside the resolver: the resolver stays agnostic of
+// where its tree bytes come from (a test fake, this store, a future one), and
+// the repo-store stays unaware of the closure interface. Only a layer that
+// composes both types -- the install/deploy glue's caller -- owns the join.
+/**
+ * Wrap `reads` so `readBlob(path)` resolves a repo-relative POSIX path to its
+ * blob: list the path's parent directory, match the final segment as a `blob`
+ * entry, then read by its object id. `listDir` and `treeOid` pass straight
+ * through -- both handles already speak repo-relative paths and return the same
+ * shapes.
+ */
+export function committedReadsToSourceTree(reads) {
+    return {
+        async readBlob(blobPath) {
+            // The parent of a top-level path (no slash) is the root tree, which
+            // `CommittedReads.listDir` addresses with the empty string.
+            const slash = blobPath.lastIndexOf("/");
+            const parentDir = slash === -1 ? "" : blobPath.slice(0, slash);
+            const name = slash === -1 ? blobPath : blobPath.slice(slash + 1);
+            const entries = await reads.listDir(parentDir);
+            // Match on the blob type so a path naming a directory or a gitlink fails
+            // loud here rather than handing a tree/commit oid to `readBlobByOid`.
+            const entry = entries.find((e) => e.name === name && e.type === "blob");
+            if (entry === undefined) {
+                throw new Error(`committedReadsToSourceTree: no blob at ${JSON.stringify(blobPath)}`);
+            }
+            return reads.readBlobByOid(entry.oid);
+        },
+        listDir: (dir) => reads.listDir(dir),
+        treeOid: (dir) => reads.treeOid(dir),
+    };
+}

package/dist/credential-push.d.ts

@@ -1,9 +1,10 @@
 import type { DB } from "@intx/db";
+import type { CredentialCipher } from "@intx/types";
 import type { SidecarRouter } from "./ws/sidecar-handler.js";
 /**
  * Re-resolve a single running instance's inference sources from the catalog
- * (the agent's model requirements plus the invoker preferences persisted on
- * the instance) and push the ordered list to its sidecar. The head of the
+ * (the definition's model requirements plus the invoker preferences persisted
+ * on the instance) and push the ordered list to its sidecar. The head of the
  * catalog-priority-ordered list is the active default; the tail is the
  * failover chain.
  *
@@ -12,21 +13,21 @@ import type { SidecarRouter } from "./ws/sidecar-handler.js";
  */
 export declare function pushInstanceSourceUpdate(db: DB["db"], sidecarRouter: Pick<SidecarRouter, "sendSourcesUpdate">, instance: {
     address: string;
-    agentId: string;
+    definitionId: string;
     tenantId: string;
     modelPreferences: unknown;
-}): Promise<void>;
+}, credentialCipher?: CredentialCipher): Promise<void>;
 /**
  * After a credential secret is rotated, re-resolve every running instance in
  * the tenant against the catalog and push the updates. A rotated secret flows
  * through because resolution dereferences the provider's credential reference
  * to the current secret.
  */
-export declare function pushSourceUpdates(db: DB["db"], sidecarRouter: SidecarRouter, tenantId: string): Promise<void>;
+export declare function pushSourceUpdates(db: DB["db"], sidecarRouter: SidecarRouter, tenantId: string, credentialCipher?: CredentialCipher): Promise<void>;
 /**
  * After a catalog edit in a tenant, re-resolve and push to every running
  * instance in that tenant AND its descendants. Descendants inherit the
  * edited tenant's catalog, so a change there (a disabled provider, a new
  * offering, a price update) alters their resolved sources too.
  */
-export declare function pushSourceUpdatesSubtree(db: DB["db"], sidecarRouter: SidecarRouter, tenantId: string): Promise<void>;
+export declare function pushSourceUpdatesSubtree(db: DB["db"], sidecarRouter: SidecarRouter, tenantId: string, credentialCipher?: CredentialCipher): Promise<void>;

package/dist/credential-push.js

@@ -2,24 +2,25 @@
 // the catalog and pushing the update to its sidecar.
 //
 // Used after a credential secret rotation (a model provider's credential
-// changes the resolved source's apiKey) and on sidecar reconnect.
-import { eq, and, inArray } from "drizzle-orm";
+// changes the resolved source's apiKey) and after a catalog edit in a tenant
+// or its subtree.
+import { eq, and, inArray, isNull, isNotNull } from "drizzle-orm";
 import { getLogger } from "@intx/log";
-import { agentInstance } from "@intx/db/schema";
+import { workflowRun } from "@intx/db/schema";
 import { resolveInstanceModelSources, getDescendantTenants } from "@intx/db";
 const log = getLogger(["hub", "credentials"]);
 /**
  * Re-resolve a single running instance's inference sources from the catalog
- * (the agent's model requirements plus the invoker preferences persisted on
- * the instance) and push the ordered list to its sidecar. The head of the
+ * (the definition's model requirements plus the invoker preferences persisted
+ * on the instance) and push the ordered list to its sidecar. The head of the
  * catalog-priority-ordered list is the active default; the tail is the
  * failover chain.
  *
  * No-op when the instance resolves to no launchable source — the resolver's
  * own logger is the signal for why.
  */
-export async function pushInstanceSourceUpdate(db, sidecarRouter, instance) {
-    const resolution = await resolveInstanceModelSources(db, instance.tenantId, instance);
+export async function pushInstanceSourceUpdate(db, sidecarRouter, instance, credentialCipher) {
+    const resolution = await resolveInstanceModelSources(db, instance.tenantId, instance, credentialCipher);
     if (!resolution.ok)
         return;
     const [head] = resolution.sources;
@@ -29,11 +30,15 @@ export async function pushInstanceSourceUpdate(db, sidecarRouter, instance) {
 }
 /**
  * Re-resolve every running instance in the given tenants against the catalog
- * and push the updates to sidecars. Each instance re-resolves from its own
- * tenant's context (its ancestor chain), so the rotated/edited upstream entry
- * flows through. Errors are logged per-instance but do not propagate.
+ * and push the updates to sidecars. The running instances are the folded runs
+ * a launch produces: born running, with a routing address and no deployment.
+ * Deployment-anchor runs (which own a deployment id and a workflow-derived
+ * address) and address-less child runs route via the deployment, not this
+ * per-instance push, so they are excluded. Each instance re-resolves from its
+ * own tenant's context (its ancestor chain), so the rotated/edited upstream
+ * entry flows through. Errors are logged per-instance but do not propagate.
  */
-async function pushSourceUpdatesToTenants(db, sidecarRouter, tenantIds) {
+async function pushSourceUpdatesToTenants(db, sidecarRouter, tenantIds, credentialCipher) {
     if (tenantIds.length === 0)
         return;
     // Callers fire this without awaiting, so it must never reject: a failure to
@@ -41,12 +46,31 @@ async function pushSourceUpdatesToTenants(db, sidecarRouter, tenantIds) {
     // rejection. The push is best effort — the next mutation or a sidecar
     // reconnect re-resolves sources.
     try {
-        const instances = await db.query.agentInstance.findMany({
-            where: and(inArray(agentInstance.tenantId, tenantIds), eq(agentInstance.status, "running")),
+        // The instance-shaped runs: running, addressable, and not anchored on a
+        // deployment. `anchorRunId IS NULL` excludes the deployment-anchor runs
+        // (which set it to their own id), so no deployment-anchor run address can
+        // reach the address-targeted push below. Mirrors the /me/workflows/runs and
+        // tenant run-list predicate.
+        const instances = await db.query.workflowRun.findMany({
+            where: and(inArray(workflowRun.tenantId, tenantIds), eq(workflowRun.status, "running"), isNull(workflowRun.anchorRunId), isNotNull(workflowRun.address)),
         });
         if (instances.length === 0)
             return;
-        const results = await Promise.allSettled(instances.map((instance) => pushInstanceSourceUpdate(db, sidecarRouter, instance)));
+        const results = await Promise.allSettled(instances.map(async (instance) => {
+            // The isNotNull(address) filter guarantees a value; a null here is a
+            // broken invariant. The callback is async, so this throw becomes a
+            // rejected promise captured per-instance by allSettled and logged
+            // below -- one bad row is surfaced, not fatal to the whole batch.
+            if (instance.address === null) {
+                throw new Error(`running run ${instance.id} matched the non-null-address filter but has a null address`);
+            }
+            return pushInstanceSourceUpdate(db, sidecarRouter, {
+                address: instance.address,
+                definitionId: instance.definitionId,
+                tenantId: instance.tenantId,
+                modelPreferences: instance.modelPreferences,
+            }, credentialCipher);
+        }));
         for (const result of results) {
             if (result.status === "rejected") {
                 log.warn `Failed to push source update: ${String(result.reason)}`;
@@ -63,8 +87,8 @@ async function pushSourceUpdatesToTenants(db, sidecarRouter, tenantIds) {
  * through because resolution dereferences the provider's credential reference
  * to the current secret.
  */
-export async function pushSourceUpdates(db, sidecarRouter, tenantId) {
-    await pushSourceUpdatesToTenants(db, sidecarRouter, [tenantId]);
+export async function pushSourceUpdates(db, sidecarRouter, tenantId, credentialCipher) {
+    await pushSourceUpdatesToTenants(db, sidecarRouter, [tenantId], credentialCipher);
 }
 /**
  * After a catalog edit in a tenant, re-resolve and push to every running
@@ -72,7 +96,7 @@ export async function pushSourceUpdates(db, sidecarRouter, tenantId) {
  * edited tenant's catalog, so a change there (a disabled provider, a new
  * offering, a price update) alters their resolved sources too.
  */
-export async function pushSourceUpdatesSubtree(db, sidecarRouter, tenantId) {
+export async function pushSourceUpdatesSubtree(db, sidecarRouter, tenantId, credentialCipher) {
     let tenants;
     try {
         tenants = await getDescendantTenants(db, tenantId);
@@ -81,5 +105,5 @@ export async function pushSourceUpdatesSubtree(db, sidecarRouter, tenantId) {
         log.warn `Failed to enumerate descendants for source push: ${String(err)}`;
         return;
     }
-    await pushSourceUpdatesToTenants(db, sidecarRouter, tenants);
+    await pushSourceUpdatesToTenants(db, sidecarRouter, tenants, credentialCipher);
 }

package/dist/event-collector-registry.d.ts

@@ -3,7 +3,7 @@ import type { InferenceEvent } from "@intx/types/runtime";
 import type { SessionStatus } from "@intx/types";
 import { type TurnFinalized } from "./event-collector.js";
 export type EventCollectorRegistry = {
-    create(agentAddress: string, tenantId: string, sessionId: string, instanceId: string): void;
+    create(agentAddress: string, tenantId: string, sessionId: string, runId: string): void;
     dispatch(agentAddress: string, event: InferenceEvent): void;
     abandon(agentAddress: string): void;
     has(agentAddress: string): boolean;

package/dist/event-collector-registry.js

@@ -1,8 +1,8 @@
-// Registry of active event collectors, keyed by agent address.
+// Registry of active event collectors, keyed by run address.
 //
 // The hub creates a collector when an instance starts and removes it when the
 // instance ends or the sidecar disconnects. The hub session orchestrator's
-// `agent.event` listener looks up the collector by agent address and
+// `agent.event` listener looks up the collector by run address and
 // dispatches the event.
 import { getLogger } from "@intx/log";
 import { createEventCollector, } from "./event-collector.js";
@@ -33,7 +33,7 @@ export function createEventCollectorRegistry(config) {
     const { db, onTurnFinalized } = config;
     const collectors = new Map();
     const statuses = new Map();
-    function create(agentAddress, tenantId, sessionId, instanceId) {
+    function create(agentAddress, tenantId, sessionId, runId) {
         if (collectors.has(agentAddress)) {
             log.warn `Collector already exists for ${agentAddress}, replacing`;
             abandon(agentAddress);
@@ -41,7 +41,7 @@ export function createEventCollectorRegistry(config) {
         const collector = createEventCollector({
             db,
             sessionId,
-            instanceId,
+            runId,
             tenantId,
             ...(onTurnFinalized
                 ? {

package/dist/event-collector.d.ts

@@ -32,7 +32,7 @@ export type EventCollector = {
 export type EventCollectorConfig = {
     db: DB["db"];
     sessionId: string;
-    instanceId: string;
+    runId: string;
     tenantId: string;
     onTurnFinalized?: (turn: TurnFinalized) => void;
 };

package/dist/event-collector.js

@@ -10,7 +10,7 @@ import { parseTurnPartType } from "@intx/db";
 import { generateId } from "@intx/hub-common";
 const log = getLogger(["hub", "event-collector"]);
 export function createEventCollector(config) {
-    const { db, sessionId, instanceId, tenantId, onTurnFinalized } = config;
+    const { db, sessionId, runId, tenantId, onTurnFinalized } = config;
     // Current inference turn being accumulated. A new turn is created on each
     // inference.start. Finalized on connector.reply, reactor.done,
     // reactor.error (fatal), or abandon. Null when no turn is active.
@@ -173,7 +173,7 @@ export function createEventCollector(config) {
         await db.insert(inferenceTurn).values({
             id: currentTurnId,
             sessionId,
-            instanceId,
+            runId,
             tenantId,
             model,
             status: "running",
@@ -208,6 +208,14 @@ export function createEventCollector(config) {
                     // declines differently from regular assistant output.
                     await insertPart("refusal", block.reason, null);
                     break;
+                case "safety_rating":
+                    // Structured safety signals (e.g. Gemini
+                    // promptFeedback.blockReason). Persist the reason under a
+                    // dedicated part kind so a blocked turn is not empty in
+                    // the audit trail. Content is the provider-native reason
+                    // string (observed: PROHIBITED_CONTENT).
+                    await insertPart("safety_rating", block.blockReason, null);
+                    break;
                 case "tool_call":
                     callNames.set(block.id, block.name);
                     callArgs.set(block.id, block.arguments);