build(deps): move reference-host to @intx 0.4.0 (CL-8856)

[TheGreatAxios]

Summary

examples/reference-host still pinned @intx/db, @intx/hub-api and @intx/hub-sessions at 0.2.2, though the rest of the package moved to published @intx 0.4.0 in #31. This moves the example onto 0.4.0 and adapts it to the real API changes:

• SidecarCredentialIdentity is now a discriminated union over "allocated" | "probe" — the old handshake stub's { kind: "sidecar", sidecarId } no longer typechecks. Rebuilt the sidecar authenticator the published way, off createSidecarCredentialResolver({ db }): .resolve for authenticateSidecar, .isCurrent for validateSidecarIdentity. This is the same pairing workbench's own hub wires (apps/hub/src/server.ts).
• SessionService dropped deployInstanceAtHead, deploySingleStepAtHead, deployWorkflowDefinition and sendUserMessage — the type now declares only stageWorkflowStep and endSession. Trimmed the hand-written stub to match; it still refuses both verbs, since this host runs no agent sessions.
• SidecarRouterConfig now requires validateSidecarIdentity alongside authenticateSidecar — wired from the same credential resolver above.

While adapting the API, also restructured the mailbox wiring itself into the two named, parameterized functions the root README Quickstart documents:

• installMailbox(app, { databaseUrl, resolvePrincipal, senderAddressFor, deliver }) — host deps in, mailbox { db, bus } out.
• wrapPersistMail(db, bus, { upstream, authorizeSender }) — host deps in, a wrapped persist fn out.

wrapPersistMail is still wired at host construction so the example proves the seam composes, but both of its callbacks refuse: this reference host has no live agent instance and no pre-existing agent-mail persist path to authorize or wrap (same posture SessionService already took).

Checks vs. baseline (main @ fe3ef04, still on 0.2.2)

All run with bun 1.3.14 and a local Postgres 16 on a free port.

Check	Baseline (main)	This branch
bun run typecheck (root, covers the example)	clean	clean
bun run build	clean	clean
bun test src	159 pass / 0 fail	159 pass / 0 fail
bun test --cwd examples/reference-host	11 pass / 0 fail	11 pass / 0 fail
bunx bun@1.3.14 install --frozen-lockfile	n/a (unchanged)	passes

No stray pnpm-lock.yaml/pnpm-workspace.yaml. bun.lock refreshed with bun 1.3.14.

Test plan

• bunx bun@1.3.14 install --frozen-lockfile
• bun run build
• bun run typecheck
• bun test src (159 pass)
• bun test --cwd examples/reference-host (11 pass)
• CI green (Postgres service, same suite)

Fixes CL-8856.

[TheGreatAxios]

Review · Comment (would approve if not for author-account restriction)

examples/reference-host moves onto published @intx 0.4.0 and rebuilds the sidecar authenticator, trimmed SessionService stub, and mailbox wiring to match the new API surface and the root README's installMailbox/wrapPersistMail shape.

Verified locally (bun 1.3.14, Postgres 16 on 5433): bun install --frozen-lockfile clean, bun run build clean, bun run typecheck clean, bun test src 159/159, bun test --cwd examples/reference-host 11/11. Matches the numbers in the PR description.

Findings

• examples/reference-host/src/index.ts:234-237 — wrapPersistMail(db, bus, {...})'s return value (the wrapped persist function) is never assigned or called. Nothing in createReferenceHost or the acceptance suite reaches it, so the call proves only that the arguments typecheck against createMailboxPersist's signature — which wrapPersistMail's own body already establishes without being invoked at runtime. Either expose the wrapped fn on ReferenceHost so a test can drive it through the refusal/dual-write path, or drop the call and let the function definition alone stand as the README-shape demonstration.

Sidecar wiring (createSidecarCredentialResolver({ db }).resolve/.isCurrent) and the trimmed SessionService (stageWorkflowStep, endSession) match the published 0.4.0 types and mirror workbench's own hub wiring. No unused imports, no unreachable defensive branches, no comments that just restate the adjacent line.

Notes

• The installMailbox/wrapPersistMail restructuring is scoped correctly per CONTRIBUTING.md ("the reference host is the acceptance suite... if you change the mount seam... the reference host is where that change has to be shown working") — it's not churn riding on the version bump, since the README already documents these two named functions and the example previously inlined the same wiring.