@undefineds.co/xpod 0.4.14 → 0.4.16

package/dist/api/tasks/TaskCredentialSchema.d.ts

@@ -0,0 +1,471 @@
+/**
+ * Task-layer credential records: the runtime's own copy of a user's CSS client credentials.
+ *
+ * This table belongs to the task layer, not to the API: the API only ever uses a credential the
+ * caller brought with that request, while background execution needs one on file when nobody is
+ * present. Keeping it in its own database (local mode: its own SQLite file) is what makes that
+ * boundary real instead of a naming convention.
+ *
+ * `sealed_secret` is encrypted with the deployment key (decision 6), and the row records which
+ * key sealed it so rotation keeps old rows decryptable.
+ */
+export declare const taskCredentialsSqlite: import("drizzle-orm/sqlite-core").SQLiteTableWithColumns<{
+    name: "task_credential";
+    schema: undefined;
+    columns: {
+        credentialId: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: "credential_id";
+            tableName: "task_credential";
+            dataType: "string";
+            columnType: "SQLiteText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: true;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: number | undefined;
+        }>;
+        ownerWebId: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: "owner_web_id";
+            tableName: "task_credential";
+            dataType: "string";
+            columnType: "SQLiteText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: number | undefined;
+        }>;
+        issuer: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: "issuer";
+            tableName: "task_credential";
+            dataType: "string";
+            columnType: "SQLiteText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: number | undefined;
+        }>;
+        clientId: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: "client_id";
+            tableName: "task_credential";
+            dataType: "string";
+            columnType: "SQLiteText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: number | undefined;
+        }>;
+        sealedSecret: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: "sealed_secret";
+            tableName: "task_credential";
+            dataType: "string";
+            columnType: "SQLiteText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: number | undefined;
+        }>;
+        sealedSecretKeyId: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: "sealed_secret_key_id";
+            tableName: "task_credential";
+            dataType: "string";
+            columnType: "SQLiteText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: number | undefined;
+        }>;
+        credentialVersion: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: "credential_version";
+            tableName: "task_credential";
+            dataType: "number";
+            columnType: "SQLiteInteger";
+            data: number;
+            driverParam: number;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        status: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: "status";
+            tableName: "task_credential";
+            dataType: "string";
+            columnType: "SQLiteText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: number | undefined;
+        }>;
+        createdAt: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: "created_at";
+            tableName: "task_credential";
+            dataType: "number";
+            columnType: "SQLiteInteger";
+            data: number;
+            driverParam: number;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        rotatedAt: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: "rotated_at";
+            tableName: "task_credential";
+            dataType: "number";
+            columnType: "SQLiteInteger";
+            data: number;
+            driverParam: number;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        lastUsedAt: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: "last_used_at";
+            tableName: "task_credential";
+            dataType: "number";
+            columnType: "SQLiteInteger";
+            data: number;
+            driverParam: number;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        expiresAt: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: "expires_at";
+            tableName: "task_credential";
+            dataType: "number";
+            columnType: "SQLiteInteger";
+            data: number;
+            driverParam: number;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+    };
+    dialect: "sqlite";
+}>;
+export declare const taskCredentialsPg: any;
+export declare const taskCredentialSchema: {
+    sqlite: {
+        taskCredentials: import("drizzle-orm/sqlite-core").SQLiteTableWithColumns<{
+            name: "task_credential";
+            schema: undefined;
+            columns: {
+                credentialId: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+                    name: "credential_id";
+                    tableName: "task_credential";
+                    dataType: "string";
+                    columnType: "SQLiteText";
+                    data: string;
+                    driverParam: string;
+                    notNull: true;
+                    hasDefault: false;
+                    isPrimaryKey: true;
+                    isAutoincrement: false;
+                    hasRuntimeDefault: false;
+                    enumValues: [string, ...string[]];
+                    baseColumn: never;
+                    identity: undefined;
+                    generated: undefined;
+                }, {}, {
+                    length: number | undefined;
+                }>;
+                ownerWebId: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+                    name: "owner_web_id";
+                    tableName: "task_credential";
+                    dataType: "string";
+                    columnType: "SQLiteText";
+                    data: string;
+                    driverParam: string;
+                    notNull: true;
+                    hasDefault: false;
+                    isPrimaryKey: false;
+                    isAutoincrement: false;
+                    hasRuntimeDefault: false;
+                    enumValues: [string, ...string[]];
+                    baseColumn: never;
+                    identity: undefined;
+                    generated: undefined;
+                }, {}, {
+                    length: number | undefined;
+                }>;
+                issuer: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+                    name: "issuer";
+                    tableName: "task_credential";
+                    dataType: "string";
+                    columnType: "SQLiteText";
+                    data: string;
+                    driverParam: string;
+                    notNull: true;
+                    hasDefault: false;
+                    isPrimaryKey: false;
+                    isAutoincrement: false;
+                    hasRuntimeDefault: false;
+                    enumValues: [string, ...string[]];
+                    baseColumn: never;
+                    identity: undefined;
+                    generated: undefined;
+                }, {}, {
+                    length: number | undefined;
+                }>;
+                clientId: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+                    name: "client_id";
+                    tableName: "task_credential";
+                    dataType: "string";
+                    columnType: "SQLiteText";
+                    data: string;
+                    driverParam: string;
+                    notNull: true;
+                    hasDefault: false;
+                    isPrimaryKey: false;
+                    isAutoincrement: false;
+                    hasRuntimeDefault: false;
+                    enumValues: [string, ...string[]];
+                    baseColumn: never;
+                    identity: undefined;
+                    generated: undefined;
+                }, {}, {
+                    length: number | undefined;
+                }>;
+                sealedSecret: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+                    name: "sealed_secret";
+                    tableName: "task_credential";
+                    dataType: "string";
+                    columnType: "SQLiteText";
+                    data: string;
+                    driverParam: string;
+                    notNull: true;
+                    hasDefault: false;
+                    isPrimaryKey: false;
+                    isAutoincrement: false;
+                    hasRuntimeDefault: false;
+                    enumValues: [string, ...string[]];
+                    baseColumn: never;
+                    identity: undefined;
+                    generated: undefined;
+                }, {}, {
+                    length: number | undefined;
+                }>;
+                sealedSecretKeyId: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+                    name: "sealed_secret_key_id";
+                    tableName: "task_credential";
+                    dataType: "string";
+                    columnType: "SQLiteText";
+                    data: string;
+                    driverParam: string;
+                    notNull: true;
+                    hasDefault: false;
+                    isPrimaryKey: false;
+                    isAutoincrement: false;
+                    hasRuntimeDefault: false;
+                    enumValues: [string, ...string[]];
+                    baseColumn: never;
+                    identity: undefined;
+                    generated: undefined;
+                }, {}, {
+                    length: number | undefined;
+                }>;
+                credentialVersion: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+                    name: "credential_version";
+                    tableName: "task_credential";
+                    dataType: "number";
+                    columnType: "SQLiteInteger";
+                    data: number;
+                    driverParam: number;
+                    notNull: true;
+                    hasDefault: true;
+                    isPrimaryKey: false;
+                    isAutoincrement: false;
+                    hasRuntimeDefault: false;
+                    enumValues: undefined;
+                    baseColumn: never;
+                    identity: undefined;
+                    generated: undefined;
+                }, {}, {}>;
+                status: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+                    name: "status";
+                    tableName: "task_credential";
+                    dataType: "string";
+                    columnType: "SQLiteText";
+                    data: string;
+                    driverParam: string;
+                    notNull: true;
+                    hasDefault: false;
+                    isPrimaryKey: false;
+                    isAutoincrement: false;
+                    hasRuntimeDefault: false;
+                    enumValues: [string, ...string[]];
+                    baseColumn: never;
+                    identity: undefined;
+                    generated: undefined;
+                }, {}, {
+                    length: number | undefined;
+                }>;
+                createdAt: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+                    name: "created_at";
+                    tableName: "task_credential";
+                    dataType: "number";
+                    columnType: "SQLiteInteger";
+                    data: number;
+                    driverParam: number;
+                    notNull: true;
+                    hasDefault: false;
+                    isPrimaryKey: false;
+                    isAutoincrement: false;
+                    hasRuntimeDefault: false;
+                    enumValues: undefined;
+                    baseColumn: never;
+                    identity: undefined;
+                    generated: undefined;
+                }, {}, {}>;
+                rotatedAt: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+                    name: "rotated_at";
+                    tableName: "task_credential";
+                    dataType: "number";
+                    columnType: "SQLiteInteger";
+                    data: number;
+                    driverParam: number;
+                    notNull: false;
+                    hasDefault: false;
+                    isPrimaryKey: false;
+                    isAutoincrement: false;
+                    hasRuntimeDefault: false;
+                    enumValues: undefined;
+                    baseColumn: never;
+                    identity: undefined;
+                    generated: undefined;
+                }, {}, {}>;
+                lastUsedAt: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+                    name: "last_used_at";
+                    tableName: "task_credential";
+                    dataType: "number";
+                    columnType: "SQLiteInteger";
+                    data: number;
+                    driverParam: number;
+                    notNull: false;
+                    hasDefault: false;
+                    isPrimaryKey: false;
+                    isAutoincrement: false;
+                    hasRuntimeDefault: false;
+                    enumValues: undefined;
+                    baseColumn: never;
+                    identity: undefined;
+                    generated: undefined;
+                }, {}, {}>;
+                expiresAt: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+                    name: "expires_at";
+                    tableName: "task_credential";
+                    dataType: "number";
+                    columnType: "SQLiteInteger";
+                    data: number;
+                    driverParam: number;
+                    notNull: false;
+                    hasDefault: false;
+                    isPrimaryKey: false;
+                    isAutoincrement: false;
+                    hasRuntimeDefault: false;
+                    enumValues: undefined;
+                    baseColumn: never;
+                    identity: undefined;
+                    generated: undefined;
+                }, {}, {}>;
+            };
+            dialect: "sqlite";
+        }>;
+    };
+    pg: {
+        taskCredentials: any;
+    };
+};
+/** Creates the task-layer table on a fresh database; existing rows are left untouched. */
+export declare function ensureTaskCredentialTables(db: any): Promise<void>;

package/dist/api/tasks/TaskCredentialSchema.js

@@ -0,0 +1,92 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.taskCredentialSchema = exports.taskCredentialsPg = exports.taskCredentialsSqlite = void 0;
+exports.ensureTaskCredentialTables = ensureTaskCredentialTables;
+const drizzle_orm_1 = require("drizzle-orm");
+const pg_core_1 = require("drizzle-orm/pg-core");
+const integer_1 = require("drizzle-orm/pg-core/columns/integer");
+const sqlite_core_1 = require("drizzle-orm/sqlite-core");
+/**
+ * Task-layer credential records: the runtime's own copy of a user's CSS client credentials.
+ *
+ * This table belongs to the task layer, not to the API: the API only ever uses a credential the
+ * caller brought with that request, while background execution needs one on file when nobody is
+ * present. Keeping it in its own database (local mode: its own SQLite file) is what makes that
+ * boundary real instead of a naming convention.
+ *
+ * `sealed_secret` is encrypted with the deployment key (decision 6), and the row records which
+ * key sealed it so rotation keeps old rows decryptable.
+ */
+exports.taskCredentialsSqlite = (0, sqlite_core_1.sqliteTable)('task_credential', {
+    credentialId: (0, sqlite_core_1.text)('credential_id').primaryKey(),
+    ownerWebId: (0, sqlite_core_1.text)('owner_web_id').notNull(),
+    issuer: (0, sqlite_core_1.text)('issuer').notNull(),
+    clientId: (0, sqlite_core_1.text)('client_id').notNull(),
+    sealedSecret: (0, sqlite_core_1.text)('sealed_secret').notNull(),
+    sealedSecretKeyId: (0, sqlite_core_1.text)('sealed_secret_key_id').notNull(),
+    credentialVersion: (0, sqlite_core_1.integer)('credential_version').notNull().default(1),
+    status: (0, sqlite_core_1.text)('status').notNull(),
+    createdAt: (0, sqlite_core_1.integer)('created_at').notNull(),
+    rotatedAt: (0, sqlite_core_1.integer)('rotated_at'),
+    lastUsedAt: (0, sqlite_core_1.integer)('last_used_at'),
+    expiresAt: (0, sqlite_core_1.integer)('expires_at'),
+});
+exports.taskCredentialsPg = (0, pg_core_1.pgTable)('task_credential', {
+    credentialId: (0, pg_core_1.text)('credential_id').primaryKey(),
+    ownerWebId: (0, pg_core_1.text)('owner_web_id').notNull(),
+    issuer: (0, pg_core_1.text)('issuer').notNull(),
+    clientId: (0, pg_core_1.text)('client_id').notNull(),
+    sealedSecret: (0, pg_core_1.text)('sealed_secret').notNull(),
+    sealedSecretKeyId: (0, pg_core_1.text)('sealed_secret_key_id').notNull(),
+    credentialVersion: (0, integer_1.integer)('credential_version').notNull().default(1),
+    status: (0, pg_core_1.text)('status').notNull(),
+    createdAt: (0, pg_core_1.timestamp)('created_at', { withTimezone: true }).notNull(),
+    rotatedAt: (0, pg_core_1.timestamp)('rotated_at', { withTimezone: true }),
+    lastUsedAt: (0, pg_core_1.timestamp)('last_used_at', { withTimezone: true }),
+    expiresAt: (0, pg_core_1.timestamp)('expires_at', { withTimezone: true }),
+});
+exports.taskCredentialSchema = {
+    sqlite: { taskCredentials: exports.taskCredentialsSqlite },
+    pg: { taskCredentials: exports.taskCredentialsPg },
+};
+/** Creates the task-layer table on a fresh database; existing rows are left untouched. */
+async function ensureTaskCredentialTables(db) {
+    if (typeof db.run === 'function') {
+        db.run((0, drizzle_orm_1.sql) `
+      CREATE TABLE IF NOT EXISTS task_credential (
+        credential_id TEXT PRIMARY KEY,
+        owner_web_id TEXT NOT NULL,
+        issuer TEXT NOT NULL,
+        client_id TEXT NOT NULL,
+        sealed_secret TEXT NOT NULL,
+        sealed_secret_key_id TEXT NOT NULL,
+        credential_version INTEGER NOT NULL DEFAULT 1,
+        status TEXT NOT NULL,
+        created_at INTEGER NOT NULL,
+        rotated_at INTEGER,
+        last_used_at INTEGER,
+        expires_at INTEGER
+      )
+    `);
+        db.run((0, drizzle_orm_1.sql) `CREATE INDEX IF NOT EXISTS task_credential_owner ON task_credential (owner_web_id)`);
+        return;
+    }
+    await db.execute((0, drizzle_orm_1.sql) `
+    CREATE TABLE IF NOT EXISTS task_credential (
+      credential_id TEXT PRIMARY KEY,
+      owner_web_id TEXT NOT NULL,
+      issuer TEXT NOT NULL,
+      client_id TEXT NOT NULL,
+      sealed_secret TEXT NOT NULL,
+      sealed_secret_key_id TEXT NOT NULL,
+      credential_version INTEGER NOT NULL DEFAULT 1,
+      status TEXT NOT NULL,
+      created_at TIMESTAMPTZ NOT NULL,
+      rotated_at TIMESTAMPTZ,
+      last_used_at TIMESTAMPTZ,
+      expires_at TIMESTAMPTZ
+    )
+  `);
+    await db.execute((0, drizzle_orm_1.sql) `CREATE INDEX IF NOT EXISTS task_credential_owner ON task_credential (owner_web_id)`);
+}
+//# sourceMappingURL=TaskCredentialSchema.js.map

package/dist/api/tasks/TaskCredentialStore.d.ts

@@ -0,0 +1,129 @@
+import type { SecretCellVault } from '../../security/secret-cell';
+import type { TaskCredentialSource } from '../ai-gateway/pod/OwnerPodAccess';
+import type { TaskCredentialDatabase } from './TaskCredentialDatabase';
+/** Stable reference a task binding carries instead of a secret. */
+export type TaskCredentialRef = string;
+/**
+ * Every generated reference starts with this, which is what lets a binding tell "this id names a
+ * task-layer grant" from "this id is a Pod-stored credential".
+ */
+export declare const TASK_CREDENTIAL_REF_PREFIX = "taskcred_";
+/**
+ * `pending` is a grant that exists but must not be used yet: the user asked for it, and the
+ * runtime activates it only once the grant is confirmed. `expired` and `revoked` are terminal for
+ * execution but keep the row, so audits and rotation keep their history.
+ */
+export type TaskCredentialStatus = 'pending' | 'active' | 'revoked' | 'expired';
+/** Everything an executor needs to open the owner's Pod; never logged or persisted elsewhere. */
+export interface TaskCredentialLease {
+    credentialRef: TaskCredentialRef;
+    ownerWebId: string;
+    issuer: string;
+    clientId: string;
+    clientSecret: string;
+    version: number;
+}
+/** Metadata about a grant, safe to return to a UI. */
+export interface TaskCredentialSummary {
+    credentialRef: TaskCredentialRef;
+    ownerWebId: string;
+    issuer: string;
+    clientId: string;
+    version: number;
+    status: TaskCredentialStatus;
+    createdAt: Date;
+    rotatedAt?: Date;
+    lastUsedAt?: Date;
+    expiresAt?: Date;
+}
+export declare const TASK_CREDENTIAL_NOT_FOUND = "task_credential_not_found";
+export declare const TASK_CREDENTIAL_NOT_ACTIVE = "task_credential_not_active";
+export declare const TASK_CREDENTIAL_VERSION_CONFLICT = "task_credential_version_conflict";
+export declare const TASK_CREDENTIAL_OWNER_MISMATCH = "task_credential_owner_mismatch";
+export declare const TASK_CREDENTIAL_ENCRYPTION_FAILED = "task_credential_encryption_failed";
+export interface TaskCredentialStoreOptions {
+    database: TaskCredentialDatabase;
+    /** Deployment-key vault. The secret is stored encrypted, never in the clear. */
+    vault: SecretCellVault;
+    now?: () => Date;
+    /** Stable id for a new grant; injectable so callers can make granting idempotent. */
+    newCredentialRef?: (input: {
+        ownerWebId: string;
+        issuer: string;
+    }) => string;
+}
+export interface GrantTaskCredentialInput {
+    ownerWebId: string;
+    issuer: string;
+    clientId: string;
+    clientSecret: string;
+    /** `pending` until the grant is confirmed; defaults to `pending`. */
+    status?: Extract<TaskCredentialStatus, 'pending' | 'active'>;
+    expiresAt?: Date;
+    /** Reuse this reference to make a retried grant idempotent. */
+    credentialRef?: TaskCredentialRef;
+}
+/**
+ * The task layer's own credential store.
+ *
+ * Reading a lease requires an explicit owner and an `active` row at the expected version, so a
+ * stale task, a revoked grant or another user's reference cannot open somebody else's Pod.
+ */
+export declare class TaskCredentialStore {
+    private readonly logger;
+    private readonly db;
+    private readonly table;
+    private readonly vault;
+    private readonly now;
+    private readonly newCredentialRef;
+    private readonly ready;
+    private initError?;
+    constructor(options: TaskCredentialStoreOptions);
+    /** Grant, or idempotently re-grant, a credential for one user and issuer. */
+    grant(input: GrantTaskCredentialInput): Promise<TaskCredentialSummary>;
+    /** Confirm a grant so executions may use it. */
+    activate(credentialRef: TaskCredentialRef): Promise<TaskCredentialSummary>;
+    /** Replace the secret, bumping the version so older bindings stop matching. */
+    rotate(credentialRef: TaskCredentialRef, input: {
+        clientId: string;
+        clientSecret: string;
+        expectedVersion: number;
+    }): Promise<TaskCredentialSummary>;
+    /** Stop using a grant without losing its history. */
+    revoke(credentialRef: TaskCredentialRef): Promise<void>;
+    /**
+     * Open the credential for one execution.
+     *
+     * Everything that makes a grant usable is checked here: the owner the caller claims, the status,
+     * the version the binding froze, and the expiry. A refusal keeps its own reason code so the
+     * caller can tell a revoked grant from a stale one.
+     */
+    lease(input: {
+        credentialRef: TaskCredentialRef;
+        ownerWebId: string;
+        version?: number;
+        /** Check the version without extending `last_used_at`. */
+        recordUsage?: boolean;
+    }): Promise<TaskCredentialLease>;
+    /** Metadata for one user's grants; never a secret. */
+    listForOwner(ownerWebId: string): Promise<TaskCredentialSummary[]>;
+    /** The rows whose secret was sealed with a key that is no longer active. */
+    listNeedingRewrap(activeKeyId: string): Promise<TaskCredentialRef[]>;
+    private seal;
+    private openRow;
+    private findRow;
+    private requireRow;
+    private toSummary;
+    private ensureReady;
+}
+/**
+ * The task layer's credentials as Pod access needs them.
+ *
+ * `activeFor` answers "may background work use this owner's grant at all", which is what a
+ * scheduled entry needs; `forRef` answers a task binding that names its credential and version.
+ */
+export declare function createTaskCredentialSource(input: {
+    store: TaskCredentialStore;
+    /** Issuer whose grants this deployment can use; grants for other issuers are ignored. */
+    issuer: string;
+}): TaskCredentialSource;