@intx/hub-sessions 0.2.2 → 0.4.0

package/README.md

@@ -95,11 +95,9 @@ for the authoritative type shapes.
 ### Asset service
 
 - `createAssetService` / `AssetService`, `AssetServiceError`,
-  `DEFAULT_ASSET_REF`, and the supporting types `Asset`, `AgentAsset`,
-  `AgentAssetWithAsset`, `AccessMode`, `CreateAssetParams`,
-  `PopulateAssetParams`, `AttachAssetParams`,
-  `AssetServiceErrorReason`, `ReadAssetBlobParams`,
-  `ListAssetBlobsParams`.
+  `DEFAULT_ASSET_REF`, and the supporting types `Asset`,
+  `CreateAssetParams`, `PopulateAssetParams`, `AssetServiceErrorReason`,
+  `ReadAssetBlobParams`, `ListAssetBlobsParams`.
 
 ### Skills stanza and credential push
 

package/dist/agent-repo.d.ts

@@ -1,6 +1,6 @@
-import type { GCPolicy } from "@intx/storage-isogit";
+import type { GCPolicy } from "@intx/storage-isogit/node";
 import type { ToolPackageManifest } from "@intx/types/tool-packages";
-import type { RepoId, RepoStore } from "./repo-store/index.js";
+import type { NewlyTerminalRun, RepoId, RepoStore } from "./repo-store/index.js";
 export type DeployContent = {
     systemPrompt: string;
     /**
@@ -44,7 +44,7 @@ export type AgentRepoStore = {
      * tree.
      *
      * `repoId.kind` must be `"agent-state"`. The `repoId.id` is used as
-     * the agent address internally. Stamps an
+     * the run address internally. Stamps an
      * `AgentStateSidecarPrincipal` so the agent-state kind handler
      * authorizes the receivePack as a per-agent sidecar write.
      */
@@ -55,15 +55,17 @@ export type AgentRepoStore = {
      * tree.
      *
      * `repoId.kind` must be `"workflow-run"`. Stamps a
-     * `WorkflowRunSupervisorPrincipal` whose `deploymentId` equals
+     * `WorkflowRunSupervisorPrincipal` whose `anchorRunId` equals
      * `repoId.id`; the workflow-run kind handler denies sidecar-kind
      * writes by design, so the supervisor branch is the correct path for
      * sidecar-originated run-event commits (the supervisor lives on the
      * sidecar and is the actual signer of the run events).
+     *
+     * Returns the runs the pack drove terminal, surfaced from the
+     * substrate's per-commit validation so a caller can flip the run's
+     * DB state without re-deriving terminal-ness.
      */
-    receiveWorkflowRunPack(repoId: RepoId, pack: Uint8Array, ref: string, commitSha: string): Promise<void>;
-    /** Resolve the current deploy ref SHA, or null if no deploy exists. */
-    getDeployRef(agentId: string): Promise<string | null>;
+    receiveWorkflowRunPack(repoId: RepoId, pack: Uint8Array, ref: string, commitSha: string): Promise<NewlyTerminalRun[]>;
     /** Raw 32-byte Ed25519 public key used to sign deploy commits. */
     getSigningPublicKey(): Uint8Array;
     /**
@@ -74,6 +76,20 @@ export type AgentRepoStore = {
      */
     readonly repoStore: RepoStore;
 };
+/**
+ * Repo kinds eligible for write-path object GC. Deliberately EXCLUDES
+ * "workflow-run". The warm-agent mailbox physically expunges `<uid>.eml`
+ * blobs from the live tree; the raw bytes then persist only through the
+ * parent commit in git history, and they survive a push ONLY because a
+ * `workflow-run` repo's objects are never GC'd. Adding "workflow-run"
+ * here -- above all with a retention other than "keep-history" -- would
+ * make an expunged message's bytes prunable and silently destroy the
+ * mailbox audit trail. The mailbox subtree contract in `workflow-run-kind`
+ * documents this dependency; `agent-repo.test.ts` pins it. Do not add
+ * "workflow-run" without replacing physical expunge with a tip-reachable
+ * retain-bytes scheme first.
+ */
+export declare const DEFAULT_GC_KINDS: readonly ["agent-state"];
 export declare function createAgentRepoStore(config: {
     dataDir: string;
     signingKey: {

package/dist/agent-repo.js

@@ -5,6 +5,20 @@ import { skillKindHandler, skillAuthorize } from "./skill-kind.js";
 import { packageRegistryKindHandler, packageRegistryAuthorize, } from "./package-registry-kind.js";
 import { workflowKindHandler, workflowAuthorize } from "./workflow-kind.js";
 import { workflowRunKindHandler, workflowRunAuthorize, } from "./workflow-run-kind.js";
+/**
+ * Repo kinds eligible for write-path object GC. Deliberately EXCLUDES
+ * "workflow-run". The warm-agent mailbox physically expunges `<uid>.eml`
+ * blobs from the live tree; the raw bytes then persist only through the
+ * parent commit in git history, and they survive a push ONLY because a
+ * `workflow-run` repo's objects are never GC'd. Adding "workflow-run"
+ * here -- above all with a retention other than "keep-history" -- would
+ * make an expunged message's bytes prunable and silently destroy the
+ * mailbox audit trail. The mailbox subtree contract in `workflow-run-kind`
+ * documents this dependency; `agent-repo.test.ts` pins it. Do not add
+ * "workflow-run" without replacing physical expunge with a tip-reachable
+ * retain-bytes scheme first.
+ */
+export const DEFAULT_GC_KINDS = ["agent-state"];
 export function createAgentRepoStore(config) {
     const { dataDir, signingKey, gc } = config;
     const authorize = (principal, incomingRepoId, ref, action) => {
@@ -47,7 +61,9 @@ export function createAgentRepoStore(config) {
         },
         authorize,
         signingCallback: () => signer,
-        ...(gc === undefined ? {} : { gc: { kinds: ["agent-state"], ...gc } }),
+        ...(gc === undefined
+            ? {}
+            : { gc: { kinds: [...DEFAULT_GC_KINDS], ...gc } }),
     });
     const hub = { kind: "hub" };
     function repoId(agentId) {
@@ -93,13 +109,10 @@ export function createAgentRepoStore(config) {
             }
             const principal = {
                 kind: "supervisor",
-                deploymentId: incomingRepoId.id,
+                anchorRunId: incomingRepoId.id,
             };
             const expectedOldSha = await store.resolveRef(hub, incomingRepoId, ref);
-            await store.receivePack(principal, incomingRepoId, ref, pack, commitSha, expectedOldSha);
-        },
-        async getDeployRef(agentId) {
-            return store.resolveRef(hub, repoId(agentId), AGENT_STATE_DEPLOY_REF);
+            return store.receivePack(principal, incomingRepoId, ref, pack, commitSha, expectedOldSha);
         },
         getSigningPublicKey() {
             return signingKey.publicKey;

package/dist/agent-state-kind.js

@@ -1,6 +1,5 @@
 import { type } from "arktype";
-import { glob, repoActionToGrantVerb } from "@intx/hub-common";
-import { UserPrincipal, } from "./repo-store/index.js";
+import { authorizeUserPrincipal, } from "./repo-store/index.js";
 const SidecarPrincipal = type({
     kind: "'sidecar'",
     agentId: "string",
@@ -62,10 +61,9 @@ export const agentStateKindHandler = {
 };
 export const agentStateAuthorize = (principal, repoId, ref, action) => {
     if (principal.kind === "hub") {
-        // Full access at this kind. Hub-side reads (getDeployRef,
-        // createDeployPack) and writes (writeDeployTree) all flow through
-        // here, so changing this branch tightens behavior in non-obvious
-        // places.
+        // Full access at this kind. Hub-side reads (createDeployPack) and writes
+        // (writeDeployTree) all flow through here, so changing this branch tightens
+        // behavior in non-obvious places.
         return { allowed: true };
     }
     if (principal.kind === "sidecar") {
@@ -114,70 +112,27 @@ export const agentStateAuthorize = (principal, repoId, ref, action) => {
         }
     }
     if (principal.kind === "user") {
-        // The route layer has already pre-resolved the grant verdict and
-        // attached it as `authz`. The substrate does NOT re-query the
-        // grant store here; it (a) checks the bearer-token's claims
-        // bound the requested (ref, action) and have not expired, and
-        // (b) sanity-checks that the pre-resolved verdict targets this
-        // exact resource and grant verb. Both gates must pass before the
-        // verdict's `effect` is honoured.
-        const parsed = UserPrincipal(principal);
-        if (parsed instanceof type.errors) {
-            return {
-                allowed: false,
-                reason: `user principal is malformed: ${parsed.summary}`,
-            };
-        }
+        // `agentStateAuthorize` has no top-level repoId.kind gate (the
+        // other kind handlers reject a mismatched kind up front), so the
+        // kind check lives here inside the user branch.
         if (repoId.kind !== "agent-state") {
             return {
                 allowed: false,
                 reason: `user authorize received non-agent-state repo ${repoId.kind}/${repoId.id}`,
             };
         }
-        if (!parsed.tokenClaims.actions.includes(action)) {
-            return {
-                allowed: false,
-                reason: `token does not grant action ${action}`,
-            };
-        }
-        // `ref === "*"` is the substrate's sentinel for the bulk read
-        // performed by `listRefs`. Per-ref filtering is the advertise-refs
-        // layer's responsibility, so the bulk read is gated on action and
-        // expiry alone.
-        if (ref !== "*" && !glob.match(parsed.tokenClaims.refPattern, ref)) {
-            return {
-                allowed: false,
-                reason: `token refPattern ${parsed.tokenClaims.refPattern} does not match ${ref}`,
-            };
-        }
-        if (Date.now() >= parsed.tokenClaims.expiresAt) {
-            return {
-                allowed: false,
-                reason: `token expired at ${parsed.tokenClaims.expiresAt}`,
-            };
-        }
-        const expectedResource = `agent-state:${repoId.id}`;
-        if (parsed.authz.resource !== expectedResource) {
-            return {
-                allowed: false,
-                reason: `authz verdict resource ${parsed.authz.resource} does not match ${expectedResource}`,
-            };
-        }
-        const expectedGrantVerb = repoActionToGrantVerb(action);
-        if (parsed.authz.grantVerb !== expectedGrantVerb) {
-            return {
-                allowed: false,
-                reason: `authz verdict grantVerb ${parsed.authz.grantVerb} does not match ${expectedGrantVerb}`,
-            };
-        }
-        if (parsed.authz.effect === "allow") {
-            return { allowed: true };
-        }
-        return {
-            allowed: false,
-            reason: `authz verdict denied for ${expectedResource} ${expectedGrantVerb}`,
-        };
+        return authorizeUserPrincipal({
+            principal,
+            repoId,
+            ref,
+            action,
+            resourcePrefix: "agent-state",
+        });
     }
+    // Fail closed on any kind not handled above. The tenant-level
+    // `workflow` principal kind (`@intx/types` principalKinds) is a
+    // grant owner, not an agent-state bearer, and never carries an
+    // agent-state repo push here -- so it is intentionally left denied.
     return {
         allowed: false,
         reason: `unknown principal kind: ${principal.kind}`,

package/dist/asset-service.d.ts

@@ -11,18 +11,6 @@ export type Asset = {
     createdAt: Date;
     updatedAt: Date;
 };
-export type AccessMode = "read-only" | "read-write";
-export type AgentAsset = {
-    id: string;
-    agentId: string;
-    assetId: string;
-    ref: string;
-    accessMode: AccessMode;
-    createdAt: Date;
-};
-export type AgentAssetWithAsset = AgentAsset & {
-    asset: Pick<Asset, "id" | "tenantId" | "kind" | "name" | "displayName">;
-};
 export type CreateAssetParams = {
     tenantId: string;
     /** Accepted kinds: "skill", "package-registry", "workflow".
@@ -48,19 +36,11 @@ export type PopulateAssetParams = {
      * (e.g. skillAuthorize only permits `kind: "hub"` writes). */
     principal: Principal;
 };
-export type AttachAssetParams = {
-    agentId: string;
-    assetId: string;
-    ref: string;
-    accessMode?: AccessMode;
-};
 export interface AssetService {
     createAsset(params: CreateAssetParams): Promise<Asset>;
     populateAsset(params: PopulateAssetParams): Promise<{
         commitSha: string;
     }>;
-    attachAsset(params: AttachAssetParams): Promise<AgentAsset>;
-    listAgentAssets(agentId: string): Promise<AgentAssetWithAsset[]>;
     /**
      * In-process blob read. Resolves the asset's row, then reads the blob
      * at `path` from the commit pointed to by `ref` (defaults to
@@ -99,6 +79,7 @@ export declare const DEFAULT_ASSET_REF = "refs/heads/main";
 /** Discriminator for AssetServiceError variants. Lets callers branch
  * without instanceof gymnastics across the different error subclasses. */
 export type AssetServiceErrorReason = "unsupported_kind" | "duplicate_asset" | "duplicate_attachment" | "invalid_name" | "invalid_reference" | "name_reserved" | "not_found" | "path_violation";
+export declare const ASSET_NAME_PATTERN: RegExp;
 export declare class AssetServiceError extends Error {
     readonly reason: AssetServiceErrorReason;
     constructor(reason: AssetServiceErrorReason, message: string, cause?: unknown);

package/dist/asset-service.js

@@ -1,4 +1,4 @@
-// In-process service for creating and attaching skill-asset repos.
+// In-process service for creating and populating skill-asset repos.
 //
 // Three responsibilities are layered here, mirroring the substrate's
 // own layering (DB row, repo bookkeeping, content validation):
@@ -8,19 +8,15 @@
 //   populateAsset  drives RepoStore.writeTree, which runs the kind
 //                  handler's validatePush before advancing the ref.
 //                  Content rejections surface as AssetValidationError.
-//   attachAsset    inserts an agent_asset row, surfacing the
-//                  (agentId, assetId) uniqueness violation (which
-//                  prevents the same asset being attached to one
-//                  agent twice) as AssetAttachError.
 //
 // The factory is closure-based to match createAgentRepoStore and
 // createRepoStore. There is no class because there is no per-instance
 // mutable state — every method is a pure function over the deps.
 import fs from "node:fs";
-import { asc, eq } from "drizzle-orm";
+import { eq } from "drizzle-orm";
 import git from "isomorphic-git";
-import { pgErrorCode, PG_UNIQUE_VIOLATION, PG_FOREIGN_KEY_VIOLATION, } from "@intx/db";
-import { agentAsset as agentAssetTable, asset as assetTable, } from "@intx/db/schema";
+import { pgErrorCode, PG_UNIQUE_VIOLATION } from "@intx/db";
+import { asset as assetTable } from "@intx/db/schema";
 import { generateId } from "@intx/hub-common";
 import { getLogger } from "@intx/log";
 const logger = getLogger(["hub-sessions", "asset-service"]);
@@ -30,14 +26,21 @@ const logger = getLogger(["hub-sessions", "asset-service"]);
  * push to this ref so it carries the published-asset HEAD.
  */
 export const DEFAULT_ASSET_REF = "refs/heads/main";
-// Asset names become the default workspace mountpath segment at
-// session start (`skills/<asset.name>/`). The mountpath segment
-// validator in applyAssetPack rejects anything outside a safe
-// character set; validate at the createAsset boundary so a bad name
-// fails at creation time rather than at materialization time. Names
-// must be lowercase-kebab: lowercase letters, digits, hyphens, with
-// no leading or trailing hyphen.
-const ASSET_NAME_PATTERN = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
+// An asset name becomes a workspace mountpath segment for the asset
+// kinds a session actually mounts: a tool-package registry mounts at
+// `package-registries/<asset.name>/`. A skill is an asset kind too,
+// and its `SKILL.md` frontmatter is validated on push and indexed
+// under the pushed ref, but nothing consumes that index and no
+// session path mounts a skill asset into an agent workspace. A skill
+// asset is therefore recorded and validated, not materialized and not
+// executed. The mountpath segment validator in applyAssetPack
+// rejects anything outside a safe character set; validate at the
+// createAsset boundary so a bad name fails at creation time rather
+// than at materialization time. Names must be lowercase-kebab:
+// lowercase letters, digits, hyphens, with no leading or trailing
+// hyphen. The sole enforcement site is the createAsset check below,
+// which rejects a bad name as `invalid_name`.
+export const ASSET_NAME_PATTERN = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
 export class AssetServiceError extends Error {
     reason;
     constructor(reason, message, cause) {
@@ -46,9 +49,6 @@ export class AssetServiceError extends Error {
         this.reason = reason;
     }
 }
-function isAccessMode(value) {
-    return value === "read-only" || value === "read-write";
-}
 /**
  * Reject malformed `dir` arguments at the `listAssetBlobs` boundary
  * before any tree walk begins. The empty string is the documented
@@ -112,19 +112,6 @@ function rowToAsset(row) {
         updatedAt: row.updatedAt,
     };
 }
-function rowToAgentAsset(row) {
-    if (!isAccessMode(row.accessMode)) {
-        throw new Error(`agent_asset row ${row.id} has unknown accessMode ${JSON.stringify(row.accessMode)}`);
-    }
-    return {
-        id: row.id,
-        agentId: row.agentId,
-        assetId: row.assetId,
-        ref: row.ref,
-        accessMode: row.accessMode,
-        createdAt: row.createdAt,
-    };
-}
 export function createAssetService(deps) {
     const { db, repoStore } = deps;
     const reservedPackageRegistryNames = deps.reservedPackageRegistryNames ?? new Set();
@@ -216,69 +203,6 @@ export function createAssetService(deps) {
             throw err;
         }
     }
-    async function attachAsset(params) {
-        const id = generateId("agentAsset");
-        const accessMode = params.accessMode ?? "read-only";
-        const insertRow = {
-            id,
-            agentId: params.agentId,
-            assetId: params.assetId,
-            ref: params.ref,
-            accessMode,
-            createdAt: new Date(),
-        };
-        let inserted;
-        try {
-            const rows = await db
-                .insert(agentAssetTable)
-                .values(insertRow)
-                .returning();
-            const row = rows[0];
-            if (row === undefined) {
-                throw new Error("insert into agent_asset returned no rows");
-            }
-            inserted = row;
-        }
-        catch (err) {
-            if (pgErrorCode(err) === PG_UNIQUE_VIOLATION) {
-                throw new AssetServiceError("duplicate_attachment", `agent_asset (agentId=${params.agentId}, assetId=${params.assetId}) already attached`, err);
-            }
-            if (pgErrorCode(err) === PG_FOREIGN_KEY_VIOLATION) {
-                throw new AssetServiceError("invalid_reference", `agent_asset (agentId=${params.agentId}, assetId=${params.assetId}) references a missing agent or asset`, err);
-            }
-            throw err;
-        }
-        return rowToAgentAsset(inserted);
-    }
-    async function listAgentAssets(agentId) {
-        // Order by (createdAt, id) so the row sequence is stable across reads
-        // — the available_skills stanza and pack fan-out both depend on a
-        // deterministic order, and Postgres does not guarantee one without
-        // an explicit orderBy.
-        const rows = await db
-            .select({
-            agentAsset: agentAssetTable,
-            asset: assetTable,
-        })
-            .from(agentAssetTable)
-            .innerJoin(assetTable, eq(agentAssetTable.assetId, assetTable.id))
-            .where(eq(agentAssetTable.agentId, agentId))
-            .orderBy(asc(agentAssetTable.createdAt), asc(agentAssetTable.id));
-        return rows.map((row) => {
-            const aa = rowToAgentAsset(row.agentAsset);
-            const a = rowToAsset(row.asset);
-            return {
-                ...aa,
-                asset: {
-                    id: a.id,
-                    tenantId: a.tenantId,
-                    kind: a.kind,
-                    name: a.name,
-                    displayName: a.displayName,
-                },
-            };
-        });
-    }
     async function resolveAssetRowOrThrow(assetId, label) {
         const row = await db.query.asset.findFirst({
             where: eq(assetTable.id, assetId),
@@ -341,8 +265,6 @@ export function createAssetService(deps) {
     return {
         createAsset,
         populateAsset,
-        attachAsset,
-        listAgentAssets,
         readAssetBlob,
         listAssetBlobs,
     };

package/dist/committed-source-tree.d.ts

@@ -0,0 +1,10 @@
+import type { CommittedReads } from "./repo-store/types.js";
+import type { SourceTreeReads } from "./workflow-source-closure.js";
+/**
+ * Wrap `reads` so `readBlob(path)` resolves a repo-relative POSIX path to its
+ * blob: list the path's parent directory, match the final segment as a `blob`
+ * entry, then read by its object id. `listDir` and `treeOid` pass straight
+ * through -- both handles already speak repo-relative paths and return the same
+ * shapes.
+ */
+export declare function committedReadsToSourceTree(reads: CommittedReads): SourceTreeReads;

package/dist/committed-source-tree.js

@@ -0,0 +1,35 @@
+// Adapts a repo-store `CommittedReads` handle (reads pinned to a commit,
+// addressed by object id) to the `SourceTreeReads` shape the source-closure
+// resolver consumes (reads addressed by repo-relative path). This bridge lives
+// at the caller layer, not inside the resolver: the resolver stays agnostic of
+// where its tree bytes come from (a test fake, this store, a future one), and
+// the repo-store stays unaware of the closure interface. Only a layer that
+// composes both types -- the install/deploy glue's caller -- owns the join.
+/**
+ * Wrap `reads` so `readBlob(path)` resolves a repo-relative POSIX path to its
+ * blob: list the path's parent directory, match the final segment as a `blob`
+ * entry, then read by its object id. `listDir` and `treeOid` pass straight
+ * through -- both handles already speak repo-relative paths and return the same
+ * shapes.
+ */
+export function committedReadsToSourceTree(reads) {
+    return {
+        async readBlob(blobPath) {
+            // The parent of a top-level path (no slash) is the root tree, which
+            // `CommittedReads.listDir` addresses with the empty string.
+            const slash = blobPath.lastIndexOf("/");
+            const parentDir = slash === -1 ? "" : blobPath.slice(0, slash);
+            const name = slash === -1 ? blobPath : blobPath.slice(slash + 1);
+            const entries = await reads.listDir(parentDir);
+            // Match on the blob type so a path naming a directory or a gitlink fails
+            // loud here rather than handing a tree/commit oid to `readBlobByOid`.
+            const entry = entries.find((e) => e.name === name && e.type === "blob");
+            if (entry === undefined) {
+                throw new Error(`committedReadsToSourceTree: no blob at ${JSON.stringify(blobPath)}`);
+            }
+            return reads.readBlobByOid(entry.oid);
+        },
+        listDir: (dir) => reads.listDir(dir),
+        treeOid: (dir) => reads.treeOid(dir),
+    };
+}

package/dist/credential-push.d.ts

@@ -1,32 +1,77 @@
 import type { DB } from "@intx/db";
+import type { CredentialCipher } from "@intx/types";
 import type { SidecarRouter } from "./ws/sidecar-handler.js";
 /**
  * Re-resolve a single running instance's inference sources from the catalog
- * (the agent's model requirements plus the invoker preferences persisted on
- * the instance) and push the ordered list to its sidecar. The head of the
+ * (the definition's model requirements plus the invoker preferences persisted
+ * on the instance) and push the ordered list to its sidecar. The head of the
  * catalog-priority-ordered list is the active default; the tail is the
  * failover chain.
  *
  * No-op when the instance resolves to no launchable source — the resolver's
  * own logger is the signal for why.
  */
-export declare function pushInstanceSourceUpdate(db: DB["db"], sidecarRouter: Pick<SidecarRouter, "sendSourcesUpdate">, instance: {
+export declare function pushInstanceSourceUpdate(db: DB["db"], sidecarRouter: Pick<SidecarRouter, "sendSourcesUpdate" | "sendCredentialsUpdate">, instance: {
     address: string;
-    agentId: string;
+    definitionId: string;
     tenantId: string;
     modelPreferences: unknown;
-}): Promise<void>;
+}, credentialCipher: CredentialCipher): Promise<void>;
 /**
  * After a credential secret is rotated, re-resolve every running instance in
  * the tenant against the catalog and push the updates. A rotated secret flows
  * through because resolution dereferences the provider's credential reference
  * to the current secret.
  */
-export declare function pushSourceUpdates(db: DB["db"], sidecarRouter: SidecarRouter, tenantId: string): Promise<void>;
+export declare function pushSourceUpdates(db: DB["db"], sidecarRouter: SidecarRouter, tenantId: string, credentialCipher: CredentialCipher): Promise<void>;
 /**
  * After a catalog edit in a tenant, re-resolve and push to every running
  * instance in that tenant AND its descendants. Descendants inherit the
  * edited tenant's catalog, so a change there (a disabled provider, a new
  * offering, a price update) alters their resolved sources too.
  */
-export declare function pushSourceUpdatesSubtree(db: DB["db"], sidecarRouter: SidecarRouter, tenantId: string): Promise<void>;
+export declare function pushSourceUpdatesSubtree(db: DB["db"], sidecarRouter: SidecarRouter, tenantId: string, credentialCipher: CredentialCipher): Promise<void>;
+/**
+ * After a credential is deleted or deliberately revoked, evict it from every
+ * running deployment in the tenant AND its descendants. A descendant resolves
+ * an ancestor's tenant-owned credential through the tenant walk-up, so a
+ * revoke in one tenant can affect a descendant's run. The push is a flat named
+ * revocation: the child drops the credentialId's material and any binding that
+ * references it, and a run that never held it no-ops. Because a flat revoke is
+ * safe to broadcast, this needs no per-instance ledger of what was delivered.
+ *
+ * Callers fire this without awaiting, so it must never reject: a failure to
+ * enumerate or push is logged and dropped. This closes the ONLINE revocation
+ * window (a running deployment stops holding the credential now); the offline
+ * window -- a run whose sidecar was disconnected when the revoke fired -- is
+ * closed by the reconnect resync, not here.
+ */
+export declare function pushCredentialRevoke(db: DB["db"], sidecarRouter: Pick<SidecarRouter, "sendCredentialsUpdate">, tenantId: string, credentialId: string): Promise<void>;
+/**
+ * Reconcile a reconnecting deployment's credentials against its deploy-time set.
+ * Re-resolve the CURRENT material for every credentialId the deployment
+ * persisted at deploy (`workflow_run.credentialRefs`), then push a MERGE that
+ * upserts the survivors (picking up a same-id secret rotation) and REVOKES the
+ * deploy-time ids that no longer resolve (deleted or revoked while the sidecar
+ * was disconnected). Closes the OFFLINE revocation window (the online window is
+ * closed by `pushCredentialRevoke`).
+ *
+ * Merge, not wholesale-replace: `credentialRefs` is only the deploy-time id set,
+ * not the child's complete live set (a catalog re-point can deliver a new
+ * credential online), so a replace would evict online-added credentials. The
+ * merge upserts survivors and names the dead ids in `revoke`, leaving online
+ * credentials untouched. It does NOT handle an id-CHANGING rotation of a
+ * deploy-time source (the new id is not in `credentialRefs`); a later source
+ * push delivers that.
+ *
+ * No-op when the run persisted no credential refs (a folded run, or a
+ * deployment with no credentials). Fire-and-forget from the reconnect handler:
+ * it never rejects. A live-but-unresolvable credential (its provider vanished
+ * or has no API base URL) makes `reresolveCurrentMaterials` throw, which aborts
+ * the WHOLE reconcile (logged, not sent) so a partial set with a spurious
+ * revoke never lands. This is deliberately all-or-nothing: one misconfigured
+ * credential blocks this reconnect's revocation of the others too, trading
+ * revocation timeliness for never falsely evicting a live credential. The next
+ * reconnect (or an online revoke) retries.
+ */
+export declare function pushCredentialReconcile(db: DB["db"], sidecarRouter: Pick<SidecarRouter, "sendCredentialsUpdate">, agentAddress: string, credentialCipher: CredentialCipher): Promise<void>;