@happyvertical/smrt-ingestion 0.0.0-stage → 0.55.6

package/dist/server.js

@@ -0,0 +1,1588 @@
+import "./models.js";
+import { n as generationSnapshotRead } from "./chunks/execution-internal-DWteDHM2.js";
+import { n as extractAnalysis, r as proposeDocumentSplits, t as createSDKExtractionAdapter } from "./chunks/extraction-bseWZuWN.js";
+import { detectEngine, isEmbeddedDatabase, isTransientDatabaseError, withEmbeddedWriteTransaction } from "@happyvertical/smrt-core";
+import { withTenant } from "@happyvertical/smrt-tenancy";
+import { createHash, randomUUID } from "node:crypto";
+import { Asset } from "@happyvertical/smrt-assets";
+import { SmrtJobCollection } from "@happyvertical/smrt-jobs";
+import { join } from "node:path";
+import { constants } from "node:fs";
+import { lstat, mkdir, open, readFile, readdir, rename, writeFile } from "node:fs/promises";
+//#region src/sources/common.ts
+var SourceInputError = class extends Error {
+	constructor(category) {
+		super(category);
+		this.category = category;
+	}
+	category;
+};
+function record(value) {
+	if (!value || typeof value !== "object" || Array.isArray(value)) throw new SourceInputError("invalid");
+	return value;
+}
+function keys(value, allowed) {
+	if (Object.keys(value).some((key) => !allowed.includes(key))) throw new SourceInputError("invalid");
+}
+function text(value) {
+	if (typeof value !== "string" || !value || value.length > 1024) throw new SourceInputError("invalid");
+	return value;
+}
+function timestamp(value) {
+	const date = new Date(text(value));
+	if (!Number.isFinite(date.getTime())) throw new SourceInputError("invalid");
+	return date;
+}
+async function boundedBytes(stream, limit) {
+	if (!Number.isSafeInteger(limit) || limit < 1) throw new SourceInputError("limit");
+	if (!stream) return /* @__PURE__ */ new Uint8Array();
+	const reader = stream.getReader();
+	const chunks = [];
+	let size = 0;
+	try {
+		for (;;) {
+			const { value, done } = await reader.read();
+			if (done) break;
+			size += value.byteLength;
+			if (size > limit) {
+				await reader.cancel();
+				throw new SourceInputError("limit");
+			}
+			chunks.push(value);
+		}
+	} finally {
+		reader.releaseLock();
+	}
+	return Buffer.concat(chunks);
+}
+function validateMedia(bytes, type, allowed) {
+	if (!allowed.includes(type)) throw new SourceInputError("unsupported_type");
+	const b = Buffer.from(bytes);
+	const ascii = (start, end) => b.subarray(start, end).toString("ascii");
+	const valid = {
+		"application/pdf": ascii(0, 5) === "%PDF-",
+		"image/tiff": b.subarray(0, 4).equals(Buffer.from([
+			73,
+			73,
+			42,
+			0
+		])) || b.subarray(0, 4).equals(Buffer.from([
+			77,
+			77,
+			0,
+			42
+		])),
+		"image/jpeg": b[0] === 255 && b[1] === 216 && b[2] === 255,
+		"image/png": b.subarray(0, 8).equals(Buffer.from([
+			137,
+			80,
+			78,
+			71,
+			13,
+			10,
+			26,
+			10
+		])),
+		"image/webp": ascii(0, 4) === "RIFF" && ascii(8, 12) === "WEBP",
+		"audio/wav": ascii(0, 4) === "RIFF" && ascii(8, 12) === "WAVE",
+		"audio/ogg": ascii(0, 4) === "OggS",
+		"audio/webm": b.subarray(0, 4).equals(Buffer.from([
+			26,
+			69,
+			223,
+			163
+		])),
+		"audio/mpeg": ascii(0, 3) === "ID3" || b[0] === 255 && (b[1] & 224) === 224,
+		"audio/mp4": ascii(4, 8) === "ftyp",
+		"text/plain": true,
+		"text/html": true,
+		"application/json": true
+	};
+	if (!Object.hasOwn(valid, type) || !valid[type]) throw new SourceInputError("unsupported_type");
+	if (type.startsWith("text/") || type === "application/json") try {
+		const s = new TextDecoder("utf-8", { fatal: true }).decode(bytes);
+		if (type === "application/json") JSON.parse(s);
+	} catch {
+		throw new SourceInputError("invalid");
+	}
+}
+async function deliver(binding, deliveryKey, deliveredAt, parts) {
+	if (!binding.enabled) return {
+		kind: "rejected",
+		category: "authentication"
+	};
+	try {
+		text(deliveryKey);
+		if (!Number.isFinite(deliveredAt.getTime())) throw new SourceInputError("invalid");
+		if (parts.length > binding.limits.maxParts || parts.reduce((n, p) => n + p.bytes.byteLength, 0) > binding.limits.maxBytes) throw new SourceInputError("limit");
+		for (const part of parts) validateMedia(part.bytes, part.mediaType, binding.allowedMediaTypes);
+		return await binding.service.receive({
+			sourceId: binding.sourceId,
+			sourceVersion: binding.sourceVersion,
+			capturedCeiling: binding.capturedCeiling,
+			retention: binding.retention,
+			limits: binding.limits,
+			deliveryKey,
+			deliveredAt,
+			parts
+		});
+	} catch (error) {
+		return safeFailure(error);
+	}
+}
+function safeFailure(error) {
+	return error instanceof SourceInputError ? {
+		kind: "rejected",
+		category: error.category
+	} : {
+		kind: "retry",
+		category: "unavailable"
+	};
+}
+//#endregion
+//#region src/sources/email.ts
+var EmailSourceAdapter = class {
+	constructor(options) {
+		this.options = options;
+	}
+	options;
+	async receive(delivery) {
+		const { binding } = this.options;
+		if (!binding.enabled) return {
+			kind: "rejected",
+			category: "authentication"
+		};
+		try {
+			text(delivery.locator);
+			text(delivery.revision);
+			text(delivery.checkpoint);
+			const snapshot = await this.options.readMessage(delivery);
+			if (snapshot.accountId !== this.options.accountId) return {
+				kind: "rejected",
+				category: "authentication"
+			};
+			const { attachments } = snapshot;
+			const body = {
+				accountId: snapshot.accountId,
+				messageId: snapshot.messageId,
+				threadId: snapshot.threadId,
+				inReplyTo: snapshot.inReplyTo,
+				subject: snapshot.subject,
+				text: snapshot.text,
+				html: snapshot.html,
+				date: snapshot.date
+			};
+			if (Object.values(body).some((value) => typeof value !== "string")) throw new SourceInputError("invalid");
+			const parts = [{
+				partId: "message",
+				mediaType: "application/json",
+				bytes: Buffer.from(JSON.stringify(body)),
+				sourceReference: {
+					owner: "message",
+					id: delivery.locator,
+					version: delivery.revision
+				}
+			}];
+			for (const attachment of attachments) {
+				if (!(attachment.bytes instanceof Uint8Array)) throw new SourceInputError("unavailable_bytes");
+				parts.push({
+					partId: `attachment:${text(attachment.partId)}`,
+					parentPartId: "message",
+					mediaType: attachment.mediaType,
+					bytes: attachment.bytes,
+					sourceReference: {
+						owner: "message-attachment",
+						id: `${delivery.locator}:${attachment.partId}`,
+						version: delivery.revision
+					}
+				});
+			}
+			parts[0].bytes = Buffer.from(JSON.stringify({
+				...body,
+				attachments: attachments.map(({ partId, filename, mediaType }) => ({
+					partId,
+					filename,
+					mediaType
+				}))
+			}));
+			const result = await deliver(binding, JSON.stringify([
+				this.options.accountId,
+				delivery.locator,
+				delivery.revision
+			]), new Date(snapshot.date), parts);
+			if (result.kind === "accepted" || result.kind === "duplicate") await this.options.acknowledge(delivery.checkpoint);
+			return result;
+		} catch (error) {
+			if (error instanceof Error && error.name === "EmailIntakeSnapshotError" && "category" in error) {
+				const category = error.category;
+				if (category === "invalid" || category === "limit" || category === "unavailable_bytes") return {
+					kind: "rejected",
+					category
+				};
+			}
+			return safeFailure(error);
+		}
+	}
+	async receiveBatch(deliveries) {
+		const results = [];
+		for (const delivery of deliveries) {
+			const result = await this.receive(delivery);
+			results.push(result);
+			if (result.kind !== "accepted" && result.kind !== "duplicate") break;
+		}
+		return results;
+	}
+};
+//#endregion
+//#region src/sources/http.ts
+function response(result) {
+	return Response.json(result, { status: result.kind === "accepted" || result.kind === "duplicate" ? 200 : result.kind === "retry" ? 503 : "category" in result && result.category === "authentication" ? 401 : "category" in result && result.category === "limit" ? 413 : 400 });
+}
+function createSourceDeliveryHandler(options) {
+	return async (request) => {
+		try {
+			const binding = await options.authenticate(request);
+			if (!binding?.enabled) return response({
+				kind: "rejected",
+				category: "authentication"
+			});
+			if (request.method !== "POST") throw new SourceInputError("invalid");
+			const key = text(request.headers.get("idempotency-key"));
+			const length = request.headers.get("content-length");
+			if (length && (!/^\d+$/.test(length) || Number(length) > binding.maxRequestBytes)) throw new SourceInputError("limit");
+			const bytes = await boundedBytes(request.body, binding.maxRequestBytes);
+			const type = request.headers.get("content-type") || "";
+			let deliveredAt;
+			const parts = [];
+			if (type.split(";")[0] === "application/json") {
+				let payload;
+				try {
+					payload = record(JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes)));
+				} catch {
+					throw new SourceInputError("invalid");
+				}
+				keys(payload, [
+					"capturedAt",
+					"text",
+					"structured",
+					"reference"
+				]);
+				deliveredAt = timestamp(payload.capturedAt);
+				if ([
+					"text",
+					"structured",
+					"reference"
+				].filter((field) => payload[field] !== void 0).length !== 1) throw new SourceInputError("invalid");
+				if (payload.text !== void 0) {
+					if (typeof payload.text !== "string") throw new SourceInputError("invalid");
+					parts.push({
+						partId: "body",
+						mediaType: "text/plain",
+						bytes: Buffer.from(payload.text)
+					});
+				} else if (payload.structured !== void 0) parts.push({
+					partId: "body",
+					mediaType: "application/json",
+					bytes: Buffer.from(JSON.stringify(record(payload.structured)))
+				});
+				else {
+					const ref = record(payload.reference);
+					keys(ref, [
+						"owner",
+						"id",
+						"version"
+					]);
+					if (ref.owner !== "asset" && ref.owner !== "message" || !binding.snapshotReference) throw new SourceInputError("invalid");
+					const reference = {
+						owner: ref.owner,
+						id: text(ref.id),
+						version: text(ref.version)
+					};
+					const snapshots = await binding.snapshotReference(reference);
+					if (!snapshots.length) throw new SourceInputError("unavailable_bytes");
+					for (const part of snapshots) parts.push({
+						...part,
+						sourceReference: part.sourceReference ?? reference
+					});
+				}
+			} else if (type.startsWith("multipart/form-data;")) {
+				let form;
+				try {
+					form = await new Response(Buffer.from(bytes), { headers: { "content-type": type } }).formData();
+				} catch {
+					throw new SourceInputError("invalid");
+				}
+				const fields = {};
+				for (const [name, value] of form.entries()) if (typeof value === "string") {
+					if (![
+						"captureId",
+						"capturedAt",
+						"captureSource",
+						"sha256"
+					].includes(name) || fields[name] !== void 0) throw new SourceInputError("invalid");
+					fields[name] = value;
+				} else {
+					if (name !== "file" || parts.length) throw new SourceInputError("invalid");
+					parts.push({
+						partId: "file",
+						parentPartId: "capture",
+						mediaType: value.type,
+						bytes: await boundedBytes(value.stream(), binding.limits.maxBytes)
+					});
+				}
+				if (parts.length !== 1 || text(fields.captureId) !== key || ![
+					"camera",
+					"native_picker",
+					"audio",
+					"document"
+				].includes(fields.captureSource)) throw new SourceInputError("invalid");
+				deliveredAt = timestamp(fields.capturedAt);
+				if (fields.sha256) {
+					if (!/^[a-f0-9]{64}$/.test(fields.sha256)) throw new SourceInputError("invalid");
+					parts[0].expectedHash = fields.sha256;
+				}
+				parts.unshift({
+					partId: "capture",
+					mediaType: "application/json",
+					bytes: Buffer.from(JSON.stringify({
+						captureId: fields.captureId,
+						capturedAt: fields.capturedAt,
+						captureSource: fields.captureSource,
+						...fields.sha256 === void 0 ? {} : { sha256: fields.sha256 }
+					}))
+				});
+			} else throw new SourceInputError("unsupported_type");
+			return response(await deliver(binding, key, deliveredAt, parts));
+		} catch (error) {
+			return response(error instanceof SyntaxError ? {
+				kind: "rejected",
+				category: "invalid"
+			} : safeFailure(error));
+		}
+	};
+}
+function createVendorWebhookHandler(options) {
+	return async (request) => {
+		try {
+			if (request.method !== "POST") throw new SourceInputError("invalid");
+			const bytes = await boundedBytes(request.body, options.maxRequestBytes);
+			const verified = await options.verify(request, bytes);
+			if (!verified) return response({
+				kind: "rejected",
+				category: "authentication"
+			});
+			return response(await deliver(verified.binding, verified.deliveryKey, verified.deliveredAt, verified.parts));
+		} catch (error) {
+			return response(safeFailure(error));
+		}
+	};
+}
+//#endregion
+//#region src/sources/watch-folder.ts
+var WatchFolderSourceAdapter = class {
+	constructor(options) {
+		this.options = options;
+		if (!Number.isSafeInteger(options.stabilityMs) || options.stabilityMs < 1) throw new Error("Positive stability interval required");
+	}
+	options;
+	observations = /* @__PURE__ */ new Map();
+	polling = false;
+	async stable(path) {
+		const stat = await lstat(path);
+		if (!stat.isFile() || stat.isSymbolicLink()) throw new SourceInputError("invalid");
+		const fingerprint = [
+			stat.dev,
+			stat.ino,
+			stat.size,
+			stat.mtimeMs,
+			stat.ctimeMs
+		].join(":");
+		const now = (this.options.now ?? Date.now)();
+		const prior = this.observations.get(path);
+		if (!prior || prior.fingerprint !== fingerprint) {
+			this.observations.set(path, {
+				fingerprint,
+				since: now
+			});
+			return false;
+		}
+		return now - prior.since >= this.options.stabilityMs;
+	}
+	async syncDirectory(path) {
+		const directory = await open(path, constants.O_RDONLY);
+		try {
+			await directory.sync();
+		} finally {
+			await directory.close();
+		}
+	}
+	async importClaim(directory, claim) {
+		const path = join(directory, "original");
+		try {
+			if (!await this.stable(path)) return null;
+			const handle = await open(path, constants.O_RDONLY | constants.O_NOFOLLOW);
+			let bytes;
+			try {
+				const before = await handle.stat();
+				if (before.size > this.options.binding.limits.maxBytes) throw new SourceInputError("limit");
+				bytes = Buffer.alloc(before.size);
+				let offset = 0;
+				while (offset < bytes.length) {
+					const { bytesRead } = await handle.read(bytes, offset, bytes.length - offset, offset);
+					if (!bytesRead) throw new SourceInputError("invalid");
+					offset += bytesRead;
+				}
+				const after = await handle.stat();
+				if (before.size !== after.size || before.mtimeMs !== after.mtimeMs || before.ctimeMs !== after.ctimeMs) throw new SourceInputError("invalid");
+			} finally {
+				await handle.close();
+			}
+			const mediaType = /\.pdf$/i.test(claim.filename) ? "application/pdf" : "image/tiff";
+			const result = await deliver(this.options.binding, claim.id, new Date(claim.capturedAt), [{
+				partId: "original",
+				mediaType,
+				bytes,
+				sourceReference: {
+					owner: "watch-folder",
+					id: claim.filename,
+					version: claim.id
+				}
+			}]);
+			if (result.kind === "accepted" || result.kind === "duplicate") {
+				await this.options.checkpoint?.("received", claim.id);
+				await rename(directory, join(this.options.directory, ".ingestion-processed", claim.id));
+				await this.syncDirectory(join(this.options.directory, ".ingestion-processed"));
+				await this.syncDirectory(join(this.options.directory, ".ingestion-claims"));
+				this.observations.delete(path);
+			} else await writeFile(join(directory, "failure.json"), JSON.stringify(result), { mode: 384 });
+			return {
+				claimId: claim.id,
+				filename: claim.filename,
+				result
+			};
+		} catch (error) {
+			const result = safeFailure(error);
+			await writeFile(join(directory, "failure.json"), JSON.stringify(result), { mode: 384 }).catch(() => {});
+			return {
+				claimId: claim.id,
+				filename: claim.filename,
+				result
+			};
+		}
+	}
+	async poll() {
+		if (!this.options.binding.enabled || this.polling) return [];
+		this.polling = true;
+		const results = [];
+		try {
+			const root = this.options.directory;
+			const claims = join(root, ".ingestion-claims");
+			const processed = join(root, ".ingestion-processed");
+			const rootStat = await lstat(root);
+			if (!rootStat.isDirectory() || rootStat.isSymbolicLink()) throw new SourceInputError("invalid");
+			await mkdir(claims, {
+				recursive: true,
+				mode: 448
+			});
+			await mkdir(processed, {
+				recursive: true,
+				mode: 448
+			});
+			for (const privatePath of [claims, processed]) if ((await lstat(privatePath)).isSymbolicLink()) throw new SourceInputError("invalid");
+			for (const entry of await readdir(claims, { withFileTypes: true })) {
+				if (!entry.isDirectory() || !/^[a-f0-9-]{36}$/.test(entry.name)) continue;
+				const directory = join(claims, entry.name);
+				try {
+					const claim = JSON.parse(await readFile(join(directory, "claim.json"), "utf8"));
+					if (claim.id !== entry.name || claim.sourceId !== this.options.binding.sourceId || claim.sourceVersion !== this.options.binding.sourceVersion) throw new SourceInputError("invalid");
+					try {
+						await lstat(join(directory, "original"));
+					} catch {
+						continue;
+					}
+					const result = await this.importClaim(directory, claim);
+					if (result) results.push(result);
+				} catch (error) {
+					results.push({
+						claimId: entry.name,
+						filename: "",
+						result: safeFailure(error)
+					});
+				}
+			}
+			for (const entry of await readdir(root, { withFileTypes: true })) {
+				if (!/\.(pdf|tiff?)$/i.test(entry.name)) continue;
+				const path = join(root, entry.name);
+				try {
+					if (!await this.stable(path)) continue;
+					const stat = await lstat(path);
+					const claim = {
+						id: randomUUID(),
+						filename: entry.name,
+						capturedAt: new Date(stat.mtimeMs).toISOString(),
+						sourceId: this.options.binding.sourceId,
+						sourceVersion: this.options.binding.sourceVersion
+					};
+					const directory = join(claims, claim.id);
+					await mkdir(directory, { mode: 448 });
+					const metadata = await open(join(directory, "claim.json"), "wx", 384);
+					try {
+						await metadata.writeFile(JSON.stringify(claim));
+						await metadata.sync();
+					} finally {
+						await metadata.close();
+					}
+					await this.syncDirectory(directory);
+					await this.syncDirectory(claims);
+					await rename(path, join(directory, "original"));
+					await this.syncDirectory(directory);
+					await this.syncDirectory(root);
+					this.observations.delete(path);
+					await this.options.checkpoint?.("claimed", claim.id);
+					await this.stable(join(directory, "original"));
+				} catch (error) {
+					results.push({
+						filename: entry.name,
+						result: safeFailure(error)
+					});
+				}
+			}
+			return results;
+		} finally {
+			this.polling = false;
+		}
+	}
+};
+//#endregion
+//#region src/server.ts
+var TABLES = [
+	"intake_items",
+	"intake_evidence",
+	"intake_analyses",
+	"intake_analysis_attempts",
+	"intake_plans",
+	"intake_actions",
+	"intake_proposals",
+	"intake_review_decisions",
+	"intake_executions",
+	"intake_feedback",
+	"intake_dispatches",
+	"intake_deletions"
+];
+var failures = /* @__PURE__ */ new Set([
+	"unsupported_type",
+	"malformed_output",
+	"limit",
+	"timeout",
+	"unavailable",
+	"authentication",
+	"cancelled",
+	"integrity"
+]);
+var uuid = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+function object(value) {
+	const parsed = typeof value === "string" ? JSON.parse(value) : value;
+	if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) throw new Error("Invalid intake payload");
+	return parsed;
+}
+function canonical(value) {
+	if (value === null || typeof value === "string" || typeof value === "boolean") return JSON.stringify(value);
+	if (typeof value === "number" && Number.isFinite(value)) return JSON.stringify(value);
+	if (Array.isArray(value)) return `[${value.map(canonical).join(",")}]`;
+	if (value && typeof value === "object" && Object.getPrototypeOf(value) === Object.prototype) return `{${Object.keys(value).sort().map((k) => `${JSON.stringify(k)}:${canonical(value[k])}`).join(",")}}`;
+	throw new Error("Invalid canonical intake value");
+}
+function digest(value) {
+	return createHash("sha256").update(canonical(value)).digest("hex");
+}
+function bytesHash(value) {
+	return createHash("sha256").update(value).digest("hex");
+}
+function nonempty(value) {
+	if (typeof value !== "string" || !value.trim() || value.length > 512) throw new Error("Invalid intake identifier");
+}
+function integer(value, max = 2147483647) {
+	if (typeof value !== "number" || !Number.isSafeInteger(value) || value <= 0 || value > max) throw new Error("Invalid intake limit");
+}
+function persistedDate(value) {
+	return value instanceof Date ? value : new Date(String(value));
+}
+function date(value) {
+	if (!(value instanceof Date) || !Number.isFinite(value.getTime())) throw new Error("Invalid intake date");
+	return value.toISOString();
+}
+var IngestionService = class {
+	constructor(options) {
+		this.options = options;
+		this.db = options.db;
+		this.scope = Object.freeze({ ...options.scope });
+		if (!uuid.test(this.scope.tenantId)) throw new Error("Required tenant UUID");
+		nonempty(this.scope.actorId);
+		nonempty(this.scope.confidentialScopeId);
+		const configured = this.db;
+		const engine = detectEngine(this.db.url || configured.config?.url || "", configured.type || configured.config?.type);
+		if (!["sqlite", "postgres"].includes(engine) || !this.db.transaction) throw new Error("Ingestion requires transactional SQLite or PostgreSQL");
+		nonempty(options.jobTarget.objectType);
+		nonempty(options.jobTarget.method);
+	}
+	options;
+	db;
+	scope;
+	async execution() {
+		if (!this.options.execution) throw new Error("Intake execution is not configured");
+		const { IntakeExecutionService } = await import("./execution.js");
+		return new IntakeExecutionService(this.options, this.options.execution);
+	}
+	async previewProposal(input) {
+		return (await this.execution()).previewProposal(input);
+	}
+	async submitDecision(input) {
+		return (await this.execution()).submitDecision(input);
+	}
+	async applyAction(actionId) {
+		return (await this.execution()).applyAction(actionId);
+	}
+	async reconcileAction(actionId) {
+		return (await this.execution()).reconcileAction(actionId);
+	}
+	async getAction(actionId) {
+		return (await this.execution()).getAction(actionId);
+	}
+	async authorizeAutomatic(actionId) {
+		return (await this.execution()).authorizeAutomatic(actionId);
+	}
+	async previewPlan(input) {
+		return (await this.execution()).previewPlan(input);
+	}
+	async applyPlan(planId) {
+		return (await this.execution()).applyPlan(planId);
+	}
+	async proposals() {
+		if (!this.options.proposals) throw new Error("Intake proposals are not configured");
+		const { IngestionProposalService } = await import("./proposals.js");
+		return new IngestionProposalService(this, this.options, this.options.proposals);
+	}
+	async listHandlers(itemId) {
+		return (await this.proposals()).listHandlers(itemId);
+	}
+	async findCandidates(input) {
+		return (await this.proposals()).findCandidates(input);
+	}
+	async prepareGeneration(itemId, attemptId) {
+		return (await this.proposals()).prepareGeneration(itemId, attemptId);
+	}
+	async generateProposals(lease) {
+		return (await this.proposals()).generate(lease);
+	}
+	async previewGeneratedProposals(input) {
+		return (await this.proposals()).preview(input);
+	}
+	now() {
+		return this.options.now?.() ?? /* @__PURE__ */ new Date();
+	}
+	async point(name) {
+		await this.options.checkpoint?.(name);
+	}
+	async authorize(operation, data, db = this.db) {
+		if (!await this.options.authorize({
+			scope: this.scope,
+			operation,
+			capturedCeiling: object(data.capturedCeiling ?? {}),
+			db
+		})) throw new Error("Intake unavailable");
+	}
+	async rows(db, table, where = "", params = []) {
+		return (await db.query(`SELECT * FROM ${table} WHERE tenant_id = ? AND confidential_scope_id = ?${where ? ` AND ${where}` : ""}`, this.scope.tenantId, this.scope.confidentialScopeId, ...params)).rows;
+	}
+	async item(id, operation, db = this.db, allowExpired = false) {
+		const [item] = await this.rows(db, "intake_items", "id = ?", [id]);
+		if (!item) throw new Error("Intake unavailable");
+		await this.authorize(operation, object(item.data), db);
+		if (!allowExpired && (item.visibility !== "active" || persistedDate(item.expires_at).getTime() <= this.now().getTime())) throw new Error("Intake unavailable");
+		return item;
+	}
+	async tx(work) {
+		for (let attempt = 0;; attempt++) try {
+			return await withEmbeddedWriteTransaction(this.db, isEmbeddedDatabase(this.db), work);
+		} catch (error) {
+			if (attempt >= 3 || !isTransientDatabaseError(error)) throw error;
+			await new Promise((resolve) => setTimeout(resolve, 10 * 2 ** attempt));
+		}
+	}
+	async lock(db, itemId) {
+		if (!(await db.query("UPDATE intake_items SET analysis_revision = analysis_revision WHERE tenant_id = ? AND confidential_scope_id = ? AND id = ? RETURNING id", this.scope.tenantId, this.scope.confidentialScopeId, itemId)).rows.length) throw new Error("Intake unavailable");
+	}
+	async insert(db, table, values, conflict) {
+		const now = this.now().toISOString();
+		const row = {
+			id: randomUUID(),
+			slug: randomUUID(),
+			context: "",
+			created_at: now,
+			updated_at: now,
+			tenant_id: this.scope.tenantId,
+			confidential_scope_id: this.scope.confidentialScopeId,
+			...values
+		};
+		const keys = Object.keys(row);
+		return (await db.query(`INSERT INTO ${table} (${keys.join(",")}) VALUES (${keys.map(() => "?").join(",")})${conflict ? ` ON CONFLICT (${conflict}) DO NOTHING` : ""} RETURNING *`, ...Object.values(row))).rows;
+	}
+	/** Diagnostic only: deploy manifest migrations before starting ingestion. */
+	async assertReady() {
+		for (const table of TABLES) await this.db.query(`SELECT id FROM ${table} WHERE 1 = 0`);
+	}
+	/** Preserve every original before acknowledgment; retries retain receipt identity. */
+	async receive(input) {
+		await this.authorize("receive", { capturedCeiling: input.capturedCeiling });
+		const now = this.now();
+		let parts;
+		try {
+			for (const value of [
+				input.sourceId,
+				input.sourceVersion,
+				input.deliveryKey,
+				input.retention.version
+			]) nonempty(value);
+			for (const value of Object.values(input.limits)) integer(value);
+			date(input.deliveredAt);
+			date(input.retention.expiresAt);
+			date(input.retention.replayUntil);
+			date(input.retention.acceptAfter);
+			if (input.deliveredAt < input.retention.acceptAfter || input.retention.expiresAt <= now || input.retention.replayUntil < input.retention.expiresAt) return {
+				kind: "rejected",
+				category: "expired"
+			};
+			if (!input.parts.length || input.parts.length > input.limits.maxParts) return {
+				kind: "rejected",
+				category: "limit"
+			};
+			const ids = /* @__PURE__ */ new Set();
+			let total = 0;
+			parts = input.parts.map((part) => {
+				nonempty(part.partId);
+				nonempty(part.mediaType);
+				if (ids.has(part.partId) || !(part.bytes instanceof Uint8Array)) throw new Error("Invalid part");
+				ids.add(part.partId);
+				total += part.bytes.byteLength;
+				const hash = bytesHash(part.bytes);
+				if (part.expectedHash && part.expectedHash !== hash) throw new Error("Invalid hash");
+				return {
+					...part,
+					bytes: Buffer.from(part.bytes),
+					hash
+				};
+			});
+			if (total > input.limits.maxBytes) return {
+				kind: "rejected",
+				category: "limit"
+			};
+			for (const part of parts) if (part.parentPartId && (!ids.has(part.parentPartId) || part.parentPartId === part.partId)) throw new Error("Invalid parent");
+			for (const part of parts) {
+				const seen = /* @__PURE__ */ new Set([part.partId]);
+				let parent = part.parentPartId;
+				while (parent) {
+					if (seen.has(parent)) throw new Error("Cyclic evidence");
+					seen.add(parent);
+					parent = parts.find((p) => p.partId === parent)?.parentPartId;
+				}
+			}
+		} catch {
+			return {
+				kind: "rejected",
+				category: "invalid"
+			};
+		}
+		const payloadDigest = digest(parts.map((p) => ({
+			partId: p.partId,
+			parentPartId: p.parentPartId ?? null,
+			mediaType: p.mediaType,
+			hash: p.hash,
+			length: p.bytes.byteLength,
+			sourceReference: p.sourceReference ?? null
+		})).sort((a, b) => a.partId.localeCompare(b.partId)));
+		const scopeDigest = digest({
+			scope: this.scope,
+			ceiling: input.capturedCeiling,
+			sourceVersion: input.sourceVersion
+		});
+		const reservation = await this.tx(async (db) => {
+			await this.authorize("receive", { capturedCeiling: input.capturedCeiling }, db);
+			const inserted = await this.insert(db, "intake_items", {
+				source_id: input.sourceId,
+				source_version: input.sourceVersion,
+				delivery_key: input.deliveryKey,
+				payload_digest: payloadDigest,
+				scope_digest: scopeDigest,
+				receipt_state: "reserved",
+				processing_state: "queued",
+				visibility: "active",
+				receipt_version: 1,
+				analysis_revision: 0,
+				fence: 0,
+				lease_token: "",
+				lease_until: null,
+				expires_at: date(input.retention.expiresAt),
+				replay_until: date(input.retention.replayUntil),
+				cancelled: false,
+				trace_id: input.traceId ?? randomUUID(),
+				data: canonical({
+					capturedCeiling: input.capturedCeiling,
+					limits: input.limits,
+					retentionVersion: input.retention.version,
+					deliveredAt: date(input.deliveredAt)
+				})
+			}, "tenant_id,source_id,delivery_key");
+			const item2 = (await db.query("SELECT * FROM intake_items WHERE tenant_id = ? AND source_id = ? AND delivery_key = ?", this.scope.tenantId, input.sourceId, input.deliveryKey)).rows[0];
+			if (item2.scope_digest !== scopeDigest || item2.payload_digest !== payloadDigest) return { kind: "conflict" };
+			if (item2.visibility !== "active" || persistedDate(item2.replay_until) <= now || persistedDate(item2.expires_at) <= now) return { kind: "expired" };
+			if (inserted.length) {
+				const evidenceIds = new Map(parts.map((p) => [p.partId, randomUUID()]));
+				const ordered = [...parts].sort((a, b) => {
+					const depth = (p) => p.parentPartId ? 1 + depth(parts.find((x) => x.partId === p.parentPartId)) : 0;
+					return depth(a) - depth(b);
+				});
+				for (const part of ordered) await this.insert(db, "intake_evidence", {
+					id: evidenceIds.get(part.partId),
+					item_id: item2.id,
+					part_id: part.partId,
+					parent_evidence_id: part.parentPartId ? evidenceIds.get(part.parentPartId) : null,
+					asset_id: randomUUID(),
+					state: "intent",
+					content_hash: part.hash,
+					byte_length: part.bytes.byteLength,
+					media_type: part.mediaType,
+					source_uri: "",
+					data: canonical({ sourceReference: part.sourceReference ?? null })
+				});
+			}
+			return {
+				kind: "reserved",
+				item: item2,
+				created: !!inserted.length
+			};
+		});
+		if (reservation.kind !== "reserved") return {
+			kind: "rejected",
+			category: reservation.kind
+		};
+		const item = reservation.item;
+		const itemId = String(item.id);
+		await this.point("reserved");
+		if (item.receipt_state === "ready") {
+			try {
+				await this.repairDispatches();
+			} catch {
+				return {
+					kind: "retry",
+					category: "unavailable"
+				};
+			}
+			return {
+				kind: "duplicate",
+				itemId,
+				receiptVersion: Number(item.receipt_version)
+			};
+		}
+		const token = randomUUID();
+		if (!(await this.tx((db) => db.query(`UPDATE intake_items SET receipt_state = 'preserving', fence = fence + 1, lease_token = ?, lease_until = ? WHERE tenant_id = ? AND confidential_scope_id = ? AND id = ? AND visibility = 'active' AND receipt_state <> 'ready' AND (lease_until IS NULL OR lease_until <= ?) RETURNING fence`, token, new Date(now.getTime() + input.limits.leaseMs).toISOString(), this.scope.tenantId, this.scope.confidentialScopeId, itemId, now.toISOString()))).rows.length) return {
+			kind: "retry",
+			category: "busy"
+		};
+		try {
+			for (const part of parts) await this.preserve(itemId, part, token);
+			await this.point("evidence");
+			await this.tx(async (db) => {
+				await this.lock(db, itemId);
+				await this.item(itemId, "process", db);
+				const evidence = await this.rows(db, "intake_evidence", "item_id = ?", [itemId]);
+				if (evidence.length !== parts.length || evidence.some((e) => e.state !== "durable")) throw new Error("Incomplete evidence");
+				if (!(await db.query(`UPDATE intake_items SET receipt_state='ready',lease_token='',lease_until=NULL WHERE tenant_id=? AND confidential_scope_id=? AND id=? AND lease_token=? AND lease_until>? AND visibility='active' RETURNING id`, this.scope.tenantId, this.scope.confidentialScopeId, itemId, token, this.now().toISOString())).rows.length) throw new Error("Lease lost");
+				await this.insert(db, "intake_dispatches", {
+					item_id: itemId,
+					stage: "analyze",
+					revision: 1,
+					state: "pending",
+					job_id: "",
+					deliveries: 0,
+					data: "{}"
+				}, "tenant_id,item_id,stage,revision");
+			});
+			await this.point("ready");
+			await this.repairDispatches();
+			await this.point("ack");
+			return {
+				kind: reservation.created ? "accepted" : "duplicate",
+				itemId,
+				receiptVersion: 1
+			};
+		} catch {
+			await this.tx((db) => db.query(`UPDATE intake_items SET receipt_state='needs_attention',lease_token='',lease_until=NULL WHERE tenant_id=? AND confidential_scope_id=? AND id=? AND lease_token=? AND receipt_state<>'ready'`, this.scope.tenantId, this.scope.confidentialScopeId, itemId, token));
+			return {
+				kind: "retry",
+				category: "unavailable"
+			};
+		}
+	}
+	async preserve(itemId, part, token) {
+		const [evidence] = await this.rows(this.db, "intake_evidence", "item_id=? AND part_id=?", [itemId, part.partId]);
+		if (!evidence) throw new Error("Missing storage intent");
+		await this.item(itemId, "process");
+		const asset = await withTenant({ tenantId: this.scope.tenantId }, async () => {
+			let asset2 = await this.options.assets.collection.get({ id: String(evidence.asset_id) });
+			if (!asset2) asset2 = await this.options.assets.collection.create({
+				id: String(evidence.asset_id),
+				tenantId: this.scope.tenantId,
+				name: String(evidence.id),
+				mimeType: part.mediaType,
+				typeSlug: "intake",
+				statusSlug: "active",
+				sourceUri: ""
+			});
+			if (asset2.tenantId !== this.scope.tenantId) throw new Error("Asset unavailable");
+			return asset2;
+		});
+		const uri = await this.options.assets.store.planFile(asset, {
+			mimeType: part.mediaType,
+			typeSlug: "intake"
+		});
+		if (evidence.source_uri && evidence.source_uri !== uri) throw new Error("Storage plan changed");
+		await this.tx(async (db) => {
+			await this.lock(db, itemId);
+			const item = await this.item(itemId, "process", db);
+			if (item.lease_token !== token || persistedDate(item.lease_until) <= this.now()) throw new Error("Lease lost");
+			await db.query("UPDATE intake_evidence SET source_uri=? WHERE tenant_id=? AND confidential_scope_id=? AND id=?", uri, this.scope.tenantId, this.scope.confidentialScopeId, evidence.id);
+		});
+		asset.sourceUri = uri;
+		await asset.save();
+		await this.point("storage_intent");
+		await this.options.assets.store.preserveFile(asset, Buffer.from(part.bytes), {
+			mimeType: part.mediaType,
+			typeSlug: "intake"
+		});
+		await this.point("storage");
+		const actual = await this.options.assets.store.read(asset);
+		if (actual.length !== Number(evidence.byte_length) || bytesHash(actual) !== evidence.content_hash) throw new Error("Storage integrity");
+		await this.tx(async (db) => {
+			await this.lock(db, itemId);
+			const item = await this.item(itemId, "process", db);
+			if (item.lease_token !== token || persistedDate(item.lease_until) <= this.now()) throw new Error("Lease lost");
+			await db.query("UPDATE intake_evidence SET state='durable' WHERE tenant_id=? AND confidential_scope_id=? AND id=?", this.scope.tenantId, this.scope.confidentialScopeId, evidence.id);
+		});
+	}
+	/** Repair lost enqueue/mark writes and deleted/failed jobs. Duplicate jobs are safe. */
+	async repairDispatches() {
+		let repaired = 0;
+		const intents = await this.rows(this.db, "intake_dispatches", "state <> 'completed'");
+		const jobs = await SmrtJobCollection.create({ db: this.db });
+		for (const intent of intents) {
+			const item = await this.item(String(intent.item_id), "process", this.db, true);
+			if (item.visibility !== "active" || item.cancelled || persistedDate(item.expires_at) <= this.now()) continue;
+			if (intent.job_id && Number(intent.revision) === Math.max(1, Number(item.analysis_revision))) {
+				const job2 = await withTenant({ tenantId: this.scope.tenantId }, () => jobs.get({ id: String(intent.job_id) }));
+				if (job2 && ["pending", "running"].includes(job2.status)) continue;
+			}
+			if (!await this.tx(async (db) => {
+				await this.lock(db, String(item.id));
+				const currentItem = await this.item(String(item.id), "process", db);
+				const [currentIntent] = await this.rows(db, "intake_dispatches", "id=? AND item_id=?", [intent.id, item.id]);
+				if (!currentIntent || currentIntent.state === "completed") return false;
+				if (currentItem.cancelled || Number(currentIntent.revision) !== Math.max(1, Number(currentItem.analysis_revision))) {
+					await db.query("UPDATE intake_dispatches SET state='completed' WHERE tenant_id=? AND confidential_scope_id=? AND id=?", this.scope.tenantId, this.scope.confidentialScopeId, currentIntent.id);
+					return false;
+				}
+				const limits = object(object(currentItem.data).limits);
+				if (Number(currentIntent.deliveries) >= limits.maxAttempts) {
+					await db.query("UPDATE intake_items SET processing_state='needs_attention' WHERE tenant_id=? AND confidential_scope_id=? AND id=?", this.scope.tenantId, this.scope.confidentialScopeId, item.id);
+					await db.query("UPDATE intake_dispatches SET state='completed' WHERE tenant_id=? AND confidential_scope_id=? AND id=?", this.scope.tenantId, this.scope.confidentialScopeId, intent.id);
+					return false;
+				}
+				return (await db.query("UPDATE intake_dispatches SET deliveries=deliveries+1 WHERE tenant_id=? AND confidential_scope_id=? AND id=? AND state<>'completed' AND deliveries<? RETURNING id", this.scope.tenantId, this.scope.confidentialScopeId, currentIntent.id, limits.maxAttempts)).rows.length === 1;
+			})) continue;
+			const job = await withTenant({ tenantId: this.scope.tenantId }, () => jobs.enqueueJob({
+				tenantId: this.scope.tenantId,
+				objectType: this.options.jobTarget.objectType,
+				method: this.options.jobTarget.method,
+				args: {
+					itemId: intent.item_id,
+					revision: Number(intent.revision),
+					dispatchId: intent.id
+				},
+				queue: "ingestion",
+				maxAttempts: 1
+			}));
+			await this.point("enqueued");
+			await this.tx((db) => db.query("UPDATE intake_dispatches SET state='delivered',job_id=? WHERE tenant_id=? AND confidential_scope_id=? AND id=? AND state<>'completed'", job.id, this.scope.tenantId, this.scope.confidentialScopeId, intent.id));
+			repaired++;
+		}
+		return repaired;
+	}
+	/** List only authorized active items; omitted items do not contribute counts. */
+	async listItems() {
+		const rows = await this.rows(this.db, "intake_items", "visibility='active' AND expires_at>?", [this.now().toISOString()]);
+		const result = [];
+		for (const row of rows) try {
+			await this.authorize("read", object(row.data));
+			result.push(this.itemDTO(row));
+		} catch {}
+		return result;
+	}
+	itemDTO(row) {
+		return {
+			id: String(row.id),
+			receiptState: String(row.receipt_state),
+			processingState: String(row.processing_state),
+			analysisRevision: Number(row.analysis_revision),
+			cancelled: !!row.cancelled,
+			traceId: String(row.trace_id)
+		};
+	}
+	async getItem(id) {
+		return this.itemDTO(await this.item(id, "read"));
+	}
+	async getEvidence(itemId) {
+		await this.item(itemId, "read");
+		return (await this.rows(this.db, "intake_evidence", "item_id=? AND state='durable'", [itemId])).map((e) => ({
+			id: String(e.id),
+			partId: String(e.part_id),
+			parentEvidenceId: e.parent_evidence_id ? String(e.parent_evidence_id) : null,
+			mediaType: String(e.media_type),
+			contentHash: String(e.content_hash),
+			byteLength: Number(e.byte_length)
+		}));
+	}
+	async readEvidence(itemId, evidenceId) {
+		await this.item(itemId, "read");
+		const [e] = await this.rows(this.db, "intake_evidence", "item_id=? AND id=? AND state='durable'", [itemId, evidenceId]);
+		if (!e) throw new Error("Intake unavailable");
+		const asset = await withTenant({ tenantId: this.scope.tenantId }, () => this.options.assets.collection.get({ id: String(e.asset_id) }));
+		if (!asset || asset.tenantId !== this.scope.tenantId || asset.sourceUri !== e.source_uri) throw new Error("Intake unavailable");
+		const bytes = await this.options.assets.store.read(asset);
+		if (bytes.length !== Number(e.byte_length) || bytesHash(bytes) !== e.content_hash) throw new Error("Intake integrity");
+		await this.item(itemId, "read");
+		return bytes;
+	}
+	/** Append an immutable input revision. Reprocessing never creates actions. */
+	async analyze(itemId, configuration, requestKey) {
+		nonempty(requestKey);
+		const configDigest = digest(configuration);
+		return this.tx(async (db) => {
+			await this.lock(db, itemId);
+			const item = await this.item(itemId, "process", db);
+			if (item.receipt_state !== "ready" || item.cancelled) throw new Error("Intake not processable");
+			const replay = (await this.rows(db, "intake_analyses", "item_id=?", [itemId])).find((a) => object(a.data).requestKey === requestKey);
+			if (replay) {
+				if (object(replay.data).configDigest !== configDigest) throw new Error("Analysis request conflict");
+				return {
+					id: String(replay.id),
+					revision: Number(replay.revision)
+				};
+			}
+			const evidence = await this.rows(db, "intake_evidence", "item_id=? AND state='durable'", [itemId]);
+			await db.query("UPDATE intake_analysis_attempts SET state='superseded' WHERE tenant_id=? AND confidential_scope_id=? AND item_id=? AND state IN ('queued','running')", this.scope.tenantId, this.scope.confidentialScopeId, itemId);
+			await db.query("UPDATE intake_analyses SET state='superseded' WHERE tenant_id=? AND confidential_scope_id=? AND item_id=? AND state IN ('queued','running')", this.scope.tenantId, this.scope.confidentialScopeId, itemId);
+			const revision = Number(item.analysis_revision) + 1;
+			await db.query("UPDATE intake_dispatches SET state='completed' WHERE tenant_id=? AND confidential_scope_id=? AND item_id=? AND revision<? AND state<>'completed'", this.scope.tenantId, this.scope.confidentialScopeId, itemId, revision);
+			const inputs = evidence.map((e) => ({
+				id: e.id,
+				hash: e.content_hash
+			})).sort((a, b) => String(a.id).localeCompare(String(b.id)));
+			const [analysis] = await this.insert(db, "intake_analyses", {
+				item_id: itemId,
+				revision,
+				fence: 0,
+				attempt_number: 0,
+				current_attempt_id: null,
+				state: "queued",
+				input_digest: digest({
+					inputs,
+					configuration
+				}),
+				data: canonical({
+					inputs,
+					configuration,
+					requestKey,
+					configDigest
+				})
+			});
+			await db.query("UPDATE intake_items SET analysis_revision=?,processing_state='queued' WHERE tenant_id=? AND confidential_scope_id=? AND id=?", revision, this.scope.tenantId, this.scope.confidentialScopeId, itemId);
+			await this.insert(db, "intake_dispatches", {
+				item_id: itemId,
+				stage: "analyze",
+				revision,
+				state: "pending",
+				job_id: "",
+				deliveries: 0,
+				data: "{}"
+			}, "tenant_id,item_id,stage,revision");
+			return {
+				id: String(analysis.id),
+				revision
+			};
+		});
+	}
+	/** Allocate a fenced attempt; active leases cannot be stolen before expiry. */
+	async claimAnalysis(itemId, revision, workerId) {
+		integer(revision);
+		nonempty(workerId);
+		return this.tx(async (db) => {
+			await this.lock(db, itemId);
+			const item = await this.item(itemId, "process", db);
+			if (item.cancelled || item.receipt_state !== "ready" || Number(item.analysis_revision) !== revision) return null;
+			const [analysis] = await this.rows(db, "intake_analyses", "item_id=? AND revision=?", [itemId, revision]);
+			if (!analysis || ["completed", "partial"].includes(String(analysis.state))) return null;
+			const limits = object(object(item.data).limits);
+			const prior = (await this.rows(db, "intake_analysis_attempts", "analysis_id=?", [analysis.id])).find((a) => a.id === analysis.current_attempt_id);
+			if (prior?.state === "running" && persistedDate(prior.lease_until) > this.now()) return null;
+			if (Number(analysis.attempt_number) >= limits.maxAttempts) {
+				if (prior?.state === "running") await db.query("UPDATE intake_analysis_attempts SET state='needs_attention',safe_error='limit' WHERE tenant_id=? AND confidential_scope_id=? AND id=?", this.scope.tenantId, this.scope.confidentialScopeId, prior.id);
+				await db.query("UPDATE intake_analyses SET state='needs_attention' WHERE tenant_id=? AND confidential_scope_id=? AND id=?", this.scope.tenantId, this.scope.confidentialScopeId, analysis.id);
+				await db.query("UPDATE intake_items SET processing_state='needs_attention' WHERE tenant_id=? AND confidential_scope_id=? AND id=? AND analysis_revision=?", this.scope.tenantId, this.scope.confidentialScopeId, itemId, revision);
+				await db.query("UPDATE intake_dispatches SET state='completed' WHERE tenant_id=? AND confidential_scope_id=? AND item_id=? AND revision=?", this.scope.tenantId, this.scope.confidentialScopeId, itemId, revision);
+				return null;
+			}
+			if (prior && ["running", "queued"].includes(String(prior.state))) await db.query("UPDATE intake_analysis_attempts SET state='superseded' WHERE tenant_id=? AND confidential_scope_id=? AND id=?", this.scope.tenantId, this.scope.confidentialScopeId, prior.id);
+			const fence = Number(analysis.fence) + 1;
+			const attempt = Number(analysis.attempt_number) + 1;
+			const token = randomUUID();
+			const [row] = await this.insert(db, "intake_analysis_attempts", {
+				item_id: itemId,
+				analysis_id: analysis.id,
+				attempt_number: attempt,
+				fence,
+				state: "running",
+				lease_token: token,
+				lease_until: new Date(this.now().getTime() + limits.leaseMs).toISOString(),
+				output_digest: "",
+				safe_error: "",
+				confidence: null,
+				data: canonical({
+					workerId,
+					startedAt: this.now().toISOString(),
+					limits
+				})
+			});
+			await db.query("UPDATE intake_analyses SET fence=?,attempt_number=?,current_attempt_id=?,state='running' WHERE tenant_id=? AND confidential_scope_id=? AND id=?", fence, attempt, row.id, this.scope.tenantId, this.scope.confidentialScopeId, analysis.id);
+			await db.query("UPDATE intake_items SET processing_state='running' WHERE tenant_id=? AND confidential_scope_id=? AND id=?", this.scope.tenantId, this.scope.confidentialScopeId, itemId);
+			return {
+				itemId,
+				analysisId: String(analysis.id),
+				attemptId: String(row.id),
+				revision,
+				fence,
+				token
+			};
+		});
+	}
+	async completedAnalysisSnapshot(db, itemId, attemptId, current) {
+		await this.lock(db, itemId);
+		const item = await this.item(itemId, "process", db);
+		if (item.cancelled) throw new Error("Analysis unavailable");
+		if (attemptId === void 0) {
+			if (!current) throw new Error("Historical attempt required");
+			const [latest] = await this.rows(db, "intake_analyses", "item_id=? AND revision=?", [itemId, item.analysis_revision]);
+			if (!latest?.current_attempt_id) throw new Error("Analysis unavailable");
+			attemptId = String(latest.current_attempt_id);
+		}
+		const [attempt] = await this.rows(db, "intake_analysis_attempts", "item_id=? AND id=?", [itemId, attemptId]);
+		if (!attempt || !["completed", "partial"].includes(String(attempt.state)) || !attempt.output_digest) throw new Error("Analysis unavailable");
+		const [analysis] = await this.rows(db, "intake_analyses", "item_id=? AND id=?", [itemId, attempt.analysis_id]);
+		if (!analysis || analysis.current_attempt_id !== attemptId || current && Number(item.analysis_revision) !== Number(analysis.revision)) throw new Error("Analysis unavailable");
+		const data = object(analysis.data);
+		const configuration = object(data.configuration);
+		if (!Array.isArray(data.inputs) || !data.inputs.length || digest({
+			inputs: data.inputs,
+			configuration
+		}) !== analysis.input_digest || digest(configuration) !== data.configDigest) throw new Error("Analysis input integrity");
+		const resultData = object(attempt.data);
+		const result = {
+			status: resultData.status,
+			provider: resultData.provider,
+			model: resultData.model,
+			version: resultData.version,
+			output: resultData.output,
+			usage: resultData.usage,
+			...Object.hasOwn(resultData, "error") ? { error: resultData.error } : {},
+			...Object.hasOwn(resultData, "confidence") ? { confidence: resultData.confidence } : {}
+		};
+		if (result.status !== attempt.state || digest(result) !== attempt.output_digest) throw new Error("Analysis output integrity");
+		const evidence = [];
+		for (const input of data.inputs) {
+			const frozen = object(input);
+			const [row] = await this.rows(db, "intake_evidence", "item_id=? AND id=? AND state='durable'", [itemId, frozen.id]);
+			if (!row || row.content_hash !== frozen.hash) throw new Error("Analysis input integrity");
+			evidence.push({
+				id: String(row.id),
+				partId: String(row.part_id),
+				parentEvidenceId: row.parent_evidence_id ? String(row.parent_evidence_id) : null,
+				mediaType: String(row.media_type),
+				contentHash: String(row.content_hash),
+				byteLength: Number(row.byte_length)
+			});
+		}
+		if (new Set(evidence.map((entry) => entry.id)).size !== evidence.length) throw new Error("Analysis input integrity");
+		await this.item(itemId, "process", db);
+		return structuredClone({
+			itemId,
+			attemptId,
+			revision: Number(analysis.revision),
+			inputDigest: String(analysis.input_digest),
+			outputDigest: String(attempt.output_digest),
+			evidenceDigest: digest(data.inputs),
+			configuration,
+			evidence,
+			result
+		});
+	}
+	/** Detached successful current revision; always current-scope/process authorized. */
+	async getCompletedAnalysis(itemId, attemptId) {
+		const snapshot = await this.tx((db) => this.completedAnalysisSnapshot(db, itemId, attemptId, true));
+		await this.point("analysis:snapshot-read");
+		const read = async (db) => {
+			const current = await this.completedAnalysisSnapshot(db, itemId, snapshot.attemptId, true);
+			if (current.inputDigest !== snapshot.inputDigest || current.outputDigest !== snapshot.outputDigest) throw new Error("Analysis changed");
+			return current;
+		};
+		if (snapshot.configuration.stage === "interpret") return (await this.proposals())[generationSnapshotRead](itemId, (work) => this.tx(work), read);
+		return this.tx(read);
+	}
+	/** Historical source is readable only through its frozen pin on a live generation lease. */
+	async getGenerationInput(lease) {
+		const generation = await this.getAnalysisInput(lease);
+		const configuration = generation.configuration;
+		const pin = object(object(configuration.proposals).source);
+		if (configuration.stage !== "interpret" || typeof pin.attemptId !== "string") throw new Error("Invalid generation source");
+		const source = await this.tx((db) => this.completedAnalysisSnapshot(db, lease.itemId, String(pin.attemptId), false));
+		for (const key of [
+			"attemptId",
+			"revision",
+			"inputDigest",
+			"outputDigest",
+			"evidenceDigest"
+		]) if (pin[key] !== source[key]) throw new Error("Generation source changed");
+		if (source.result.provider !== "smrt-ingestion-extraction" || source.configuration.stage === "interpret" || source.revision !== generation.revision - 1 || digest(generation.evidence.map((entry) => ({
+			id: entry.id,
+			hash: entry.contentHash
+		}))) !== source.evidenceDigest) throw new Error("Generation evidence changed");
+		await this.getAnalysisInput(lease);
+		return {
+			generation,
+			source
+		};
+	}
+	/** Reload immutable inputs only through the current live processing lease. */
+	async getAnalysisInput(lease) {
+		return this.tx(async (db) => {
+			await this.lock(db, lease.itemId);
+			const item = await this.item(lease.itemId, "process", db);
+			if (item.cancelled || Number(item.analysis_revision) !== lease.revision) throw new Error("Analysis lease unavailable");
+			const [analysis] = await this.rows(db, "intake_analyses", "id=? AND item_id=?", [lease.analysisId, lease.itemId]);
+			const [attempt] = await this.rows(db, "intake_analysis_attempts", "id=? AND analysis_id=? AND item_id=?", [
+				lease.attemptId,
+				lease.analysisId,
+				lease.itemId
+			]);
+			if (!analysis || !attempt || Number(analysis.revision) !== lease.revision || analysis.current_attempt_id !== lease.attemptId || Number(analysis.fence) !== lease.fence || Number(attempt.fence) !== lease.fence || attempt.state !== "running" || attempt.lease_token !== lease.token || persistedDate(attempt.lease_until) <= this.now()) throw new Error("Analysis lease unavailable");
+			const data = object(analysis.data);
+			const configuration = object(data.configuration);
+			if (!Array.isArray(data.inputs) || !data.inputs.length || digest({
+				inputs: data.inputs,
+				configuration
+			}) !== analysis.input_digest || digest(configuration) !== data.configDigest) throw new Error("Analysis input integrity");
+			const evidence = [];
+			for (const input of data.inputs) {
+				const frozen = object(input);
+				const [row] = await this.rows(db, "intake_evidence", "item_id=? AND id=? AND state='durable'", [lease.itemId, frozen.id]);
+				if (!row || row.content_hash !== frozen.hash) throw new Error("Analysis input integrity");
+				evidence.push({
+					id: String(row.id),
+					partId: String(row.part_id),
+					parentEvidenceId: row.parent_evidence_id ? String(row.parent_evidence_id) : null,
+					mediaType: String(row.media_type),
+					contentHash: String(row.content_hash),
+					byteLength: Number(row.byte_length)
+				});
+			}
+			if (new Set(evidence.map((entry) => entry.id)).size !== evidence.length) throw new Error("Analysis input integrity");
+			return {
+				revision: lease.revision,
+				attemptId: lease.attemptId,
+				fence: lease.fence,
+				inputDigest: String(analysis.input_digest),
+				maxOutputBytes: Number(object(object(item.data).limits).maxOutputBytes),
+				configuration,
+				evidence
+			};
+		});
+	}
+	/** Publish once, only through the current unexpired fence and captured scope. */
+	async completeAnalysis(lease, output) {
+		if (![
+			"completed",
+			"partial",
+			"failed",
+			"needs_attention"
+		].includes(output.status) || !output.provider || !output.model || !output.version || output.error && !failures.has(output.error)) throw new Error("Invalid analysis output");
+		if (output.confidence !== void 0 && (!Number.isFinite(output.confidence) || output.confidence < 0 || output.confidence > 1)) throw new Error("Invalid confidence");
+		for (const value of Object.values(output.usage)) if (!Number.isFinite(value) || value < 0) throw new Error("Invalid usage");
+		const serialized = canonical(output);
+		const outputDigest = digest(output);
+		return this.tx(async (db) => {
+			await this.lock(db, lease.itemId);
+			const item = await this.item(lease.itemId, "process", db);
+			if (item.cancelled || Number(item.analysis_revision) !== lease.revision) return false;
+			const limits = object(object(item.data).limits);
+			if (Buffer.byteLength(serialized) > limits.maxOutputBytes) throw new Error("Analysis output budget exceeded");
+			const [analysis] = await this.rows(db, "intake_analyses", "id=? AND item_id=?", [lease.analysisId, lease.itemId]);
+			if (!analysis || analysis.current_attempt_id !== lease.attemptId || Number(analysis.fence) !== lease.fence) return false;
+			const [attempt] = await this.rows(db, "intake_analysis_attempts", "id=? AND analysis_id=?", [lease.attemptId, lease.analysisId]);
+			if (!attempt || attempt.state !== "running" || attempt.lease_token !== lease.token || persistedDate(attempt.lease_until) <= this.now()) return false;
+			const attemptData = {
+				...object(attempt.data),
+				...output,
+				completedAt: this.now().toISOString()
+			};
+			await db.query("UPDATE intake_analysis_attempts SET state=?,output_digest=?,safe_error=?,confidence=?,data=? WHERE tenant_id=? AND confidential_scope_id=? AND id=?", output.status, outputDigest, output.error ?? "", output.confidence ?? null, canonical(attemptData), this.scope.tenantId, this.scope.confidentialScopeId, lease.attemptId);
+			await db.query("UPDATE intake_analyses SET state=? WHERE tenant_id=? AND confidential_scope_id=? AND id=?", output.status, this.scope.tenantId, this.scope.confidentialScopeId, lease.analysisId);
+			await db.query("UPDATE intake_items SET processing_state=? WHERE tenant_id=? AND confidential_scope_id=? AND id=?", output.status, this.scope.tenantId, this.scope.confidentialScopeId, lease.itemId);
+			if ([
+				"completed",
+				"partial",
+				"needs_attention"
+			].includes(output.status)) await db.query("UPDATE intake_dispatches SET state='completed' WHERE tenant_id=? AND confidential_scope_id=? AND item_id=? AND revision=?", this.scope.tenantId, this.scope.confidentialScopeId, lease.itemId, lease.revision);
+			return true;
+		});
+	}
+	/** Terminal failure accounting without a provider payload. The fixed safe error
+	* and lifecycle metadata are not charged to the provider-output byte ceiling. */
+	async failAnalysis(lease, category) {
+		if (!failures.has(category)) throw new Error("Invalid analysis failure");
+		return this.tx(async (db) => {
+			await this.lock(db, lease.itemId);
+			const item = await this.item(lease.itemId, "process", db);
+			if (item.cancelled || Number(item.analysis_revision) !== lease.revision) return false;
+			const [analysis] = await this.rows(db, "intake_analyses", "id=? AND item_id=?", [lease.analysisId, lease.itemId]);
+			const [attempt] = await this.rows(db, "intake_analysis_attempts", "id=? AND analysis_id=? AND item_id=?", [
+				lease.attemptId,
+				lease.analysisId,
+				lease.itemId
+			]);
+			if (!analysis || !attempt || Number(analysis.revision) !== lease.revision || analysis.current_attempt_id !== lease.attemptId || Number(analysis.fence) !== lease.fence || Number(attempt.fence) !== lease.fence || attempt.state !== "running" || attempt.lease_token !== lease.token || persistedDate(attempt.lease_until) <= this.now()) return false;
+			await db.query("UPDATE intake_analysis_attempts SET state='needs_attention',safe_error=?,data=? WHERE tenant_id=? AND confidential_scope_id=? AND id=?", category, canonical({
+				...object(attempt.data),
+				completedAt: this.now().toISOString()
+			}), this.scope.tenantId, this.scope.confidentialScopeId, lease.attemptId);
+			await db.query("UPDATE intake_analyses SET state='needs_attention' WHERE tenant_id=? AND confidential_scope_id=? AND id=?", this.scope.tenantId, this.scope.confidentialScopeId, lease.analysisId);
+			await db.query("UPDATE intake_items SET processing_state='needs_attention' WHERE tenant_id=? AND confidential_scope_id=? AND id=?", this.scope.tenantId, this.scope.confidentialScopeId, lease.itemId);
+			await db.query("UPDATE intake_dispatches SET state='completed' WHERE tenant_id=? AND confidential_scope_id=? AND item_id=? AND revision=?", this.scope.tenantId, this.scope.confidentialScopeId, lease.itemId, lease.revision);
+			return true;
+		});
+	}
+	/** Cancel pending processing immediately; original receipt remains ready. */
+	async cancel(itemId) {
+		await this.tx(async (db) => {
+			await this.lock(db, itemId);
+			await this.item(itemId, "process", db);
+			await db.query("UPDATE intake_items SET cancelled=?,processing_state='cancelled' WHERE tenant_id=? AND confidential_scope_id=? AND id=?", true, this.scope.tenantId, this.scope.confidentialScopeId, itemId);
+			await db.query("UPDATE intake_analyses SET state='superseded' WHERE tenant_id=? AND confidential_scope_id=? AND item_id=? AND state IN ('queued','running')", this.scope.tenantId, this.scope.confidentialScopeId, itemId);
+			await db.query("UPDATE intake_analysis_attempts SET state='superseded',safe_error='cancelled' WHERE tenant_id=? AND confidential_scope_id=? AND item_id=? AND state IN ('queued','running')", this.scope.tenantId, this.scope.confidentialScopeId, itemId);
+			await db.query("UPDATE intake_dispatches SET state='completed' WHERE tenant_id=? AND confidential_scope_id=? AND item_id=?", this.scope.tenantId, this.scope.confidentialScopeId, itemId);
+		});
+	}
+	/** Mint an action only on an explicit host intention, never during reanalysis. */
+	async createAction(itemId, actionKey, provenance) {
+		nonempty(actionKey);
+		const payload = canonical(provenance);
+		return this.tx(async (db) => {
+			await this.lock(db, itemId);
+			if ((await this.item(itemId, "process", db)).cancelled) throw new Error("Intake cancelled");
+			const [existing] = await this.rows(db, "intake_actions", "item_id=? AND action_key=?", [itemId, actionKey]);
+			if (existing) {
+				if (canonical(object(existing.data)) !== payload) throw new Error("Action identity conflict");
+				return String(existing.id);
+			}
+			const [action] = await this.insert(db, "intake_actions", {
+				item_id: itemId,
+				action_key: actionKey,
+				state: "proposed",
+				proposal_revision: 0,
+				review_version: 0,
+				execution_attempt: 0,
+				fence: 0,
+				result_digest: "",
+				data: payload
+			});
+			return String(action.id);
+		});
+	}
+	/** Append a proposal pinned to a completed attempt. Policy/preview is host-owned. */
+	async publishProposal(input) {
+		canonical(input.binding);
+		return this.tx(async (db) => {
+			await this.lock(db, input.itemId);
+			const item = await this.item(input.itemId, "process", db);
+			if (item.cancelled) throw new Error("Intake cancelled");
+			const [action] = await this.rows(db, "intake_actions", "item_id=? AND id=?", [input.itemId, input.actionId]);
+			const [attempt] = await this.rows(db, "intake_analysis_attempts", "item_id=? AND id=?", [input.itemId, input.attemptId]);
+			if (!action || !attempt || !["completed", "partial"].includes(String(attempt.state)) || !attempt.output_digest) throw new Error("Invalid proposal evidence");
+			if (Number(action.proposal_revision) !== input.expectedRevision || [
+				"succeeded",
+				"executing",
+				"outcome_unknown"
+			].includes(String(action.state))) throw new Error("Proposal conflict");
+			const [analysis] = await this.rows(db, "intake_analyses", "id=? AND item_id=?", [attempt.analysis_id, input.itemId]);
+			if (!analysis || Number(analysis.revision) !== Number(item.analysis_revision)) throw new Error("Proposal conflict");
+			const bindingHash = digest({
+				binding: input.binding,
+				attemptId: attempt.id,
+				attemptDigest: attempt.output_digest,
+				inputDigest: analysis.input_digest
+			});
+			const revision = input.expectedRevision + 1;
+			const [proposal] = await this.insert(db, "intake_proposals", {
+				item_id: input.itemId,
+				action_id: input.actionId,
+				analysis_id: attempt.analysis_id,
+				analysis_attempt_id: attempt.id,
+				revision,
+				binding_hash: bindingHash,
+				data: canonical({
+					binding: input.binding,
+					attemptDigest: attempt.output_digest
+				})
+			});
+			await db.query("UPDATE intake_actions SET proposal_revision=?,state='waiting_review',review_version=review_version+1 WHERE tenant_id=? AND confidential_scope_id=? AND id=?", revision, this.scope.tenantId, this.scope.confidentialScopeId, input.actionId);
+			return {
+				id: String(proposal.id),
+				revision,
+				bindingHash
+			};
+		});
+	}
+	/** Persist frozen plan structure; no expansion or apply authority is implied. */
+	async appendPlan(itemId, planKey, revision, steps, definition) {
+		nonempty(planKey);
+		integer(revision);
+		return this.tx(async (db) => {
+			await this.lock(db, itemId);
+			await this.item(itemId, "process", db);
+			if (!steps.length || new Set(steps.map((s) => s.actionId)).size !== steps.length) throw new Error("Invalid plan");
+			for (const step of steps) {
+				const [proposal] = await this.rows(db, "intake_proposals", "item_id=? AND action_id=? AND revision=?", [
+					itemId,
+					step.actionId,
+					step.proposalRevision
+				]);
+				if (!proposal) throw new Error("Invalid plan binding");
+			}
+			const data = canonical({
+				steps,
+				definition
+			});
+			const hash = digest({
+				steps,
+				definition
+			});
+			const previous = await this.rows(db, "intake_plans", "item_id=? AND plan_key=?", [itemId, planKey]);
+			const replay = previous.find((p) => Number(p.revision) === revision);
+			if (replay) {
+				if (replay.digest !== hash) throw new Error("Plan conflict");
+				return String(replay.id);
+			}
+			if (revision !== Math.max(0, ...previous.map((p) => Number(p.revision))) + 1) throw new Error("Plan revision conflict");
+			const [plan] = await this.insert(db, "intake_plans", {
+				item_id: itemId,
+				plan_key: planKey,
+				revision,
+				digest: hash,
+				data
+			});
+			return String(plan.id);
+		});
+	}
+	/** Revoke immediately and durably schedule deletion before external I/O. */
+	async expire(itemId) {
+		await this.scheduleExpiry(itemId);
+		await this.repairDeletions();
+	}
+	async scheduleExpiry(itemId) {
+		await this.tx(async (db) => {
+			await this.lock(db, itemId);
+			await this.item(itemId, "delete", db, true);
+			await db.query("UPDATE intake_items SET visibility='expired',processing_state='expired',cancelled=?,lease_token='',lease_until=NULL WHERE tenant_id=? AND confidential_scope_id=? AND id=?", true, this.scope.tenantId, this.scope.confidentialScopeId, itemId);
+			await db.query("UPDATE intake_evidence SET state='revoked' WHERE tenant_id=? AND confidential_scope_id=? AND item_id=?", this.scope.tenantId, this.scope.confidentialScopeId, itemId);
+			await db.query("UPDATE intake_dispatches SET state='completed' WHERE tenant_id=? AND confidential_scope_id=? AND item_id=?", this.scope.tenantId, this.scope.confidentialScopeId, itemId);
+			await db.query("UPDATE intake_analyses SET state='superseded' WHERE tenant_id=? AND confidential_scope_id=? AND item_id=? AND state IN ('queued','running')", this.scope.tenantId, this.scope.confidentialScopeId, itemId);
+			await db.query("UPDATE intake_analysis_attempts SET state='superseded' WHERE tenant_id=? AND confidential_scope_id=? AND item_id=? AND state IN ('queued','running')", this.scope.tenantId, this.scope.confidentialScopeId, itemId);
+			const cleanup = (await this.rows(db, "intake_evidence", "item_id=?", [itemId])).filter((e) => e.asset_id && e.source_uri).map((e) => ({
+				assetId: e.asset_id,
+				sourceUri: e.source_uri
+			}));
+			await this.insert(db, "intake_deletions", {
+				item_id: itemId,
+				state: "pending",
+				data: canonical({ cleanup })
+			}, "tenant_id,item_id");
+		});
+	}
+	/** Retry privacy propagation. Minimal receipt/action identities remain replay-safe. */
+	async repairDeletions() {
+		let completed = 0;
+		const pending = await this.rows(this.db, "intake_deletions");
+		for (const intent of pending) {
+			const itemId = String(intent.item_id);
+			await this.item(itemId, "delete", this.db, true);
+			const evidence = await this.rows(this.db, "intake_evidence", "item_id=?", [itemId]);
+			for (const row of evidence) {
+				if (!row.asset_id) continue;
+				const asset = await withTenant({ tenantId: this.scope.tenantId }, () => this.options.assets.collection.get({ id: String(row.asset_id) }));
+				if (asset) {
+					if (asset.tenantId !== this.scope.tenantId) throw new Error("Asset unavailable");
+					await this.options.assets.store.remove(asset);
+				}
+			}
+			const cleanup = object(intent.data).cleanup;
+			if (Array.isArray(cleanup)) for (const entry of cleanup) {
+				const locator = object(entry);
+				const asset = new Asset({ db: this.db });
+				asset.id = String(locator.assetId);
+				asset.tenantId = this.scope.tenantId;
+				asset.sourceUri = String(locator.sourceUri);
+				await this.options.assets.store.removeFile(asset);
+			}
+			if (intent.state === "completed") continue;
+			await this.options.purgeDerived({
+				tenantId: this.scope.tenantId,
+				itemId
+			});
+			await this.point("deleted");
+			await this.tx(async (db) => {
+				await this.lock(db, itemId);
+				const item = await this.item(itemId, "delete", db, true);
+				for (const table of TABLES.filter((t) => t !== "intake_items" && t !== "intake_deletions")) await db.query(`UPDATE ${table} SET data='{}' WHERE tenant_id=? AND confidential_scope_id=? AND item_id=?`, this.scope.tenantId, this.scope.confidentialScopeId, itemId);
+				await db.query("UPDATE intake_evidence SET source_uri='',content_hash='',media_type='',byte_length=0 WHERE tenant_id=? AND confidential_scope_id=? AND item_id=?", this.scope.tenantId, this.scope.confidentialScopeId, itemId);
+				await db.query("UPDATE intake_items SET data=?,trace_id='' WHERE tenant_id=? AND confidential_scope_id=? AND id=?", canonical({ capturedCeiling: object(item.data).capturedCeiling ?? {} }), this.scope.tenantId, this.scope.confidentialScopeId, itemId);
+				await db.query("UPDATE intake_deletions SET state='completed' WHERE tenant_id=? AND confidential_scope_id=? AND id=?", this.scope.tenantId, this.scope.confidentialScopeId, intent.id);
+			});
+			completed++;
+		}
+		return completed;
+	}
+	/** Run host-configured expiry policy and retry interrupted deletion propagation. */
+	async sweepRetention() {
+		const expired = await this.rows(this.db, "intake_items", "visibility='active' AND expires_at<=?", [this.now().toISOString()]);
+		try {
+			for (const item of expired) await this.scheduleExpiry(String(item.id));
+		} catch (error) {
+			try {
+				await this.repairDeletions();
+			} catch {}
+			throw error;
+		}
+		await this.repairDeletions();
+		return expired.length;
+	}
+};
+//#endregion
+export { EmailSourceAdapter, IngestionService, WatchFolderSourceAdapter, createSDKExtractionAdapter, createSourceDeliveryHandler, createVendorWebhookHandler, extractAnalysis, proposeDocumentSplits };
+
+//# sourceMappingURL=server.js.map