@happyvertical/smrt-ingestion 0.57.21 → 0.57.23

package/dist/server.js

@@ -1,7 +1,8 @@
-import { c as GenerationSnapshotStaleError, f as generationSnapshotRead, l as GenerationSourceStaleError, p as listReadGate, u as HandlerArgumentsInvalidError } from "./chunks/execution-9CfjxX8I.js";
+import { _ as listReadGate, d as GenerationSnapshotStaleError, f as GenerationSourceStaleError, g as generationSnapshotRead, l as UNFINISHED_ACTION_STATES, m as ProposalsNotConfiguredError, p as HandlerArgumentsInvalidError, u as redactedCeiling } from "./chunks/execution-BzVQax0n.js";
 import "./models.js";
-import { a as assertProposalLimits, i as proposalReadConfiguration, n as extractAnalysis, r as proposeDocumentSplits, t as createSDKExtractionAdapter } from "./chunks/extraction-CJ-zrbg0.js";
-import { i as reviewerInstructionView, n as ReviewerInstructionInvalidError, r as ReviewerInstructionStaleError, t as REVIEWER_INSTRUCTION_MAX_LENGTH } from "./chunks/reviewer-instruction-Db3jDN9a.js";
+import { r as extractWithProviders } from "./chunks/extraction-providers-C66ADDVe.js";
+import { a as proposeDocumentSplits, i as extractAnalysis, n as assertProposalLimits, r as createSDKExtractionAdapter, t as proposalReadConfiguration } from "./chunks/proposal-contracts-77Uo1B1j.js";
+import { i as reviewerInstructionView, n as ReviewerInstructionInvalidError, r as ReviewerInstructionStaleError, t as REVIEWER_INSTRUCTION_MAX_LENGTH } from "./chunks/reviewer-instruction-CEc3AOuU.js";
 import { detectEngine, isEmbeddedDatabase, isTransientDatabaseError, withEmbeddedWriteTransaction } from "@happyvertical/smrt-core";
 import { withTenant } from "@happyvertical/smrt-tenancy";
 import { createCipheriv, createDecipheriv, createHash, randomBytes, randomUUID } from "node:crypto";
@@ -81,7 +82,7 @@ async function loadReviewSummary(service, item, requestedCursor) {
 	} while (cursor);
 	const current = await service.getItem(item.id);
 	if (!requested) throw new Error("Review page unavailable");
-	const state = ["queued", "running"].includes(current.processingState) ? "processing" : total ? succeeded === total ? "completed" : succeeded ? "partially_completed" : deferred ? "deferred" : failed ? "failed" : "waiting" : current.processingState === "needs_attention" ? "failed" : "unresolved";
+	const state = current.disposition && !succeeded ? "resolved" : ["queued", "running"].includes(current.processingState) ? "processing" : total ? succeeded === total ? "completed" : succeeded ? "partially_completed" : deferred ? "deferred" : failed ? "failed" : "waiting" : current.processingState === "needs_attention" ? "failed" : "unresolved";
 	return {
 		reviews: requested,
 		state
@@ -233,6 +234,18 @@ function createIntakeReviewHost(service, options) {
 				evidence: part
 			});
 			const assignment = await options.assignment(itemId);
+			let catalog;
+			try {
+				catalog = await service.listHandlers(itemId);
+			} catch {
+				catalog = void 0;
+			}
+			let disposition;
+			if (item.disposition) try {
+				disposition = await service.getItemDisposition(itemId);
+			} catch {
+				disposition = void 0;
+			}
 			const instruction = await loadInstructionView(service, itemId, analysis);
 			await service.getItem(itemId);
 			return {
@@ -244,6 +257,8 @@ function createIntakeReviewHost(service, options) {
 				},
 				evidence,
 				analysis,
+				...catalog ? { catalog } : {},
+				...disposition ? { disposition } : {},
 				reviews,
 				...instruction ? { instruction } : {},
 				availability: "available",
@@ -334,6 +349,12 @@ function createIntakeReviewHost(service, options) {
 			const result = await service.reviseLogicalSplit(input);
 			await options.onSplit?.(input.itemId, result.revision);
 		},
+		async startAction(input) {
+			await service.startReviewerAction(input);
+		},
+		async resolve(input) {
+			await service.resolveItem(input);
+		},
 		async instruct(input) {
 			let result;
 			try {
@@ -918,6 +939,7 @@ var TABLES = [
 	"intake_review_decisions",
 	"intake_executions",
 	"intake_feedback",
+	"intake_dispositions",
 	"intake_dispatches",
 	"intake_deletions"
 ];
@@ -967,6 +989,7 @@ function isIntakeId(value) {
 	return typeof value === "string" && uuid.test(value);
 }
 var INBOX_STATES = [
+	"resolved",
 	"processing",
 	"unresolved",
 	"waiting",
@@ -978,7 +1001,8 @@ var INBOX_STATES = [
 function actionCount(where = "") {
 	return `(SELECT COUNT(*) FROM intake_actions a WHERE a.tenant_id = i.tenant_id AND a.confidential_scope_id = i.confidential_scope_id AND a.item_id = i.id${where ? ` AND ${where}` : ""})`;
 }
-var INBOX_STATE_SQL = `CASE WHEN i.processing_state IN ('queued','running') THEN 'processing' WHEN ${actionCount()} = 0 THEN CASE WHEN i.processing_state = 'needs_attention' THEN 'failed' ELSE 'unresolved' END WHEN ${actionCount("a.state <> 'succeeded'")} = 0 THEN 'completed' WHEN ${actionCount("a.state = 'succeeded'")} > 0 THEN 'partially_completed' WHEN ${actionCount("a.state = 'deferred'")} > 0 THEN 'deferred' WHEN ${actionCount("a.state IN ('failed','outcome_unknown')")} > 0 THEN 'failed' ELSE 'waiting' END`;
+var dispositionWhere = "d.tenant_id=i.tenant_id AND d.confidential_scope_id=i.confidential_scope_id AND d.item_id=i.id";
+var INBOX_STATE_SQL = `CASE WHEN EXISTS (SELECT 1 FROM intake_dispositions d WHERE ${dispositionWhere}) AND ${actionCount("a.state = 'succeeded'")} = 0 THEN 'resolved' WHEN i.processing_state IN ('queued','running') THEN 'processing' WHEN ${actionCount()} = 0 THEN CASE WHEN i.processing_state = 'needs_attention' THEN 'failed' ELSE 'unresolved' END WHEN ${actionCount("a.state <> 'succeeded'")} = 0 THEN 'completed' WHEN ${actionCount("a.state = 'succeeded'")} > 0 THEN 'partially_completed' WHEN ${actionCount("a.state = 'deferred'")} > 0 THEN 'deferred' WHEN ${actionCount("a.state IN ('failed','outcome_unknown')")} > 0 THEN 'failed' ELSE 'waiting' END`;
 var RECEIPT_TIME = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z$/;
 function receiptTime(row) {
 	const value = row.created_at;
@@ -1015,6 +1039,89 @@ function decodeItemCursor(cursor) {
 function persistedDate(value) {
 	return value instanceof Date ? value : new Date(String(value));
 }
+var inlineMedia = /* @__PURE__ */ new Set(["text/plain", "application/json"]);
+var REDACTED = "redacted";
+var REDACTED_DIGESTS = [
+	["intake_analyses", "input_digest"],
+	["intake_analysis_attempts", "output_digest"],
+	["intake_plans", "digest"],
+	["intake_proposals", "binding_hash"],
+	["intake_review_decisions", "binding_hash"],
+	["intake_executions", "binding_hash"]
+];
+function mediaKind(mediaType) {
+	return mediaType.split(";")[0].trim().toLowerCase();
+}
+function ownerKey(owner) {
+	nonempty(owner.kind);
+	nonempty(owner.id);
+	if (owner.kind.includes(":") || !storableText(owner.kind) || !storableText(owner.id)) throw new Error("Invalid intake owner");
+	return `${owner.kind}:${owner.id}`;
+}
+function storableText(value) {
+	if (value.includes("\0")) return false;
+	for (let i = 0; i < value.length; i++) {
+		const code = value.charCodeAt(i);
+		if (code >= 55296 && code <= 56319) {
+			const next = value.charCodeAt(i + 1);
+			if (!(next >= 56320 && next <= 57343)) return false;
+			i++;
+		} else if (code >= 56320 && code <= 57343) return false;
+	}
+	return true;
+}
+function receivedPart(part) {
+	nonempty(part.partId);
+	if (!("reference" in part)) {
+		nonempty(part.mediaType);
+		if (!(part.bytes instanceof Uint8Array)) throw new Error("Invalid part");
+		const bytes2 = Buffer.from(part.bytes);
+		const hash = bytesHash(bytes2);
+		if (part.expectedHash && part.expectedHash !== hash) throw new Error("Invalid hash");
+		if (part.filename !== void 0) filename(part.filename);
+		return {
+			...part,
+			bytes: bytes2,
+			hash,
+			retain: "copy"
+		};
+	}
+	const reference = object(part.reference);
+	nonempty(reference.owner);
+	nonempty(reference.id);
+	if (reference.version !== void 0) nonempty(reference.version);
+	for (const value2 of [
+		reference.owner,
+		reference.id,
+		reference.version
+	]) if (typeof value2 === "string" && !storableText(value2)) throw new Error("Invalid reference");
+	const snapshot = object(part.snapshot);
+	let mediaType;
+	let value;
+	if ("text" in snapshot && !("structured" in snapshot)) {
+		if (typeof snapshot.text !== "string" || !storableText(snapshot.text)) throw new Error("Invalid snapshot");
+		mediaType = "text/plain";
+		value = snapshot.text;
+	} else if ("structured" in snapshot && !("text" in snapshot)) {
+		mediaType = "application/json";
+		value = canonical(object(snapshot.structured));
+	} else throw new Error("Invalid snapshot");
+	const bytes = Buffer.from(value, "utf8");
+	return {
+		partId: part.partId,
+		...part.parentPartId === void 0 ? {} : { parentPartId: part.parentPartId },
+		mediaType,
+		bytes,
+		hash: bytesHash(bytes),
+		sourceReference: {
+			owner: reference.owner,
+			id: reference.id,
+			version: reference.version ?? ""
+		},
+		retain: "reference",
+		snapshot: value
+	};
+}
 function date(value) {
 	if (!(value instanceof Date) || !Number.isFinite(value.getTime())) throw new Error("Invalid intake date");
 	return value.toISOString();
@@ -1078,9 +1185,28 @@ var IngestionService = class {
 	async getAction(actionId) {
 		return (await this.execution()).getAction(actionId);
 	}
+	/** Own-submission review surface; see execution for its authority gate. */
+	async listOwnProposals(input = {}) {
+		return (await this.execution()).listOwnProposals(input);
+	}
+	async submitOwnDecision(input) {
+		return (await this.execution()).submitOwnDecision(input);
+	}
 	async authorizeAutomatic(actionId) {
 		return (await this.execution()).authorizeAutomatic(actionId);
 	}
+	/** Reviewer-chosen handler for any item; same preview/approval path, never automatic. */
+	async startReviewerAction(input) {
+		return (await this.execution()).startAction(input);
+	}
+	/** Terminal "handled, no action" disposition; distinct from rejecting a proposal. */
+	async resolveItem(input) {
+		return (await this.execution()).resolveItem(input);
+	}
+	/** Reviewer and reason of a resolved item; requires reviewer authority. */
+	async getItemDisposition(itemId) {
+		return (await this.execution()).getItemDisposition(itemId);
+	}
 	async previewPlan(input) {
 		return (await this.execution()).previewPlan(input);
 	}
@@ -1088,18 +1214,19 @@ var IngestionService = class {
 		return (await this.execution()).applyPlan(planId);
 	}
 	async proposals() {
-		if (!this.options.proposals) throw new Error("Intake proposals are not configured");
+		if (!this.options.proposals) throw new ProposalsNotConfiguredError();
 		const { IngestionProposalService } = await import("./proposals.js");
 		return new IngestionProposalService(this, this.options, this.options.proposals);
 	}
 	async proposalReader() {
 		const config = this.options.proposals ?? this.options.proposalRead;
-		if (!config) throw new Error("Intake proposals are not configured");
+		if (!config) throw new ProposalsNotConfiguredError();
 		const { IngestionProposalService } = await import("./proposals.js");
 		return new IngestionProposalService(this, this.options, config);
 	}
+	/** Currently offered reviewer catalog; needs no generation credentials. */
 	async listHandlers(itemId) {
-		return (await this.proposals()).listHandlers(itemId);
+		return (await this.proposalReader()).listHandlers(itemId);
 	}
 	async findCandidates(input) {
 		return (await this.proposals()).findCandidates(input);
@@ -1114,7 +1241,7 @@ var IngestionService = class {
 		return (await this.proposalReader()).preview(input);
 	}
 	async feedback() {
-		const { IntakeFeedbackService } = await import("./chunks/feedback-CuUzWKzP.js").then((n) => n.r);
+		const { IntakeFeedbackService } = await import("./chunks/feedback-D3UTF8fm.js").then((n) => n.r);
 		return new IntakeFeedbackService(this.options);
 	}
 	async recordFeedback(input) {
@@ -1167,6 +1294,10 @@ var IngestionService = class {
 			await new Promise((resolve) => setTimeout(resolve, 10 * 2 ** attempt));
 		}
 	}
+	/** Refuse under the caller's item lock when a terminal disposition exists. */
+	async assertUnresolved(db, itemId) {
+		if ((await this.rows(db, "intake_dispositions", "item_id=?", [itemId])).length) throw new Error("Item resolved");
+	}
 	async lock(db, itemId) {
 		if (!(await db.query("UPDATE intake_items SET analysis_revision = analysis_revision WHERE tenant_id = ? AND confidential_scope_id = ? AND id = ? RETURNING id", this.scope.tenantId, this.scope.confidentialScopeId, itemId)).rows.length) throw new Error("Intake unavailable");
 	}
@@ -1194,6 +1325,8 @@ var IngestionService = class {
 		await this.authorize("receive", { capturedCeiling: input.capturedCeiling });
 		const now = this.now();
 		let parts;
+		let owner = null;
+		const inline = input.dispatch === "inline";
 		try {
 			for (const value of [
 				input.sourceId,
@@ -1201,6 +1334,16 @@ var IngestionService = class {
 				input.deliveryKey,
 				input.retention.version
 			]) nonempty(value);
+			if (input.dispatch !== void 0 && !["job", "inline"].includes(input.dispatch)) throw new Error("Invalid dispatch mode");
+			const retention = input.retention;
+			if (retention.kind !== void 0 && !["time", "owner"].includes(retention.kind)) throw new Error("Invalid retention mode");
+			if (retention.kind === "owner") {
+				ownerKey(retention.owner);
+				owner = {
+					kind: retention.owner.kind,
+					id: retention.owner.id
+				};
+			}
 			for (const value of Object.values(input.limits)) integer(value);
 			date(input.deliveredAt);
 			date(input.retention.expiresAt);
@@ -1217,24 +1360,17 @@ var IngestionService = class {
 			const ids = /* @__PURE__ */ new Set();
 			let total = 0;
 			parts = input.parts.map((part) => {
-				nonempty(part.partId);
-				nonempty(part.mediaType);
-				if (ids.has(part.partId) || !(part.bytes instanceof Uint8Array)) throw new Error("Invalid part");
-				ids.add(part.partId);
-				total += part.bytes.byteLength;
-				const hash = bytesHash(part.bytes);
-				if (part.expectedHash && part.expectedHash !== hash) throw new Error("Invalid hash");
-				if (part.filename !== void 0) filename(part.filename);
-				return {
-					...part,
-					bytes: Buffer.from(part.bytes),
-					hash
-				};
+				const received = receivedPart(part);
+				if (ids.has(received.partId)) throw new Error("Invalid part");
+				ids.add(received.partId);
+				total += received.bytes.byteLength;
+				return received;
 			});
 			if (total > input.limits.maxBytes) return {
 				kind: "rejected",
 				category: "limit"
 			};
+			if (inline && parts.some((p) => !inlineMedia.has(mediaKind(p.mediaType)))) throw new Error("Inline receipt requires text or structured parts");
 			for (const part of parts) if (part.parentPartId && (!ids.has(part.parentPartId) || part.parentPartId === part.partId)) throw new Error("Invalid parent");
 			for (const part of parts) {
 				const seen = /* @__PURE__ */ new Set([part.partId]);
@@ -1257,12 +1393,15 @@ var IngestionService = class {
 			mediaType: p.mediaType,
 			hash: p.hash,
 			length: p.bytes.byteLength,
-			sourceReference: p.sourceReference ?? null
+			sourceReference: p.sourceReference ?? null,
+			...p.retain === "reference" ? { retain: "reference" } : {}
 		})).sort((a, b) => a.partId.localeCompare(b.partId)));
 		const scopeDigest = digest({
 			scope: this.scope,
 			ceiling: input.capturedCeiling,
-			sourceVersion: input.sourceVersion
+			sourceVersion: input.sourceVersion,
+			...inline ? { dispatch: "inline" } : {},
+			...owner ? { owner } : {}
 		});
 		const reservation = await this.tx(async (db) => {
 			await this.authorize("receive", { capturedCeiling: input.capturedCeiling }, db);
@@ -1284,12 +1423,16 @@ var IngestionService = class {
 				replay_until: date(input.retention.replayUntil),
 				cancelled: false,
 				trace_id: input.traceId ?? randomUUID(),
+				submitter_id: this.scope.actorId,
+				owner_key: owner ? ownerKey(owner) : "",
 				data: canonical({
 					capturedCeiling: input.capturedCeiling,
 					limits: input.limits,
 					retentionVersion: input.retention.version,
 					deliveredAt: date(input.deliveredAt),
-					dispatchTarget: this.dispatchTarget
+					dispatchTarget: this.dispatchTarget,
+					...inline ? { dispatch: "inline" } : {},
+					...owner ? { retentionOwner: owner } : {}
 				})
 			}, "tenant_id,source_id,delivery_key");
 			const item2 = (await db.query("SELECT * FROM intake_items WHERE tenant_id = ? AND source_id = ? AND delivery_key = ?", this.scope.tenantId, input.sourceId, input.deliveryKey)).rows[0];
@@ -1306,15 +1449,19 @@ var IngestionService = class {
 					item_id: item2.id,
 					part_id: part.partId,
 					parent_evidence_id: part.parentPartId ? evidenceIds.get(part.parentPartId) : null,
-					asset_id: randomUUID(),
-					state: "intent",
+					asset_id: part.retain === "reference" ? null : randomUUID(),
+					state: part.retain === "reference" ? "durable" : "intent",
 					content_hash: part.hash,
 					byte_length: part.bytes.byteLength,
 					media_type: part.mediaType,
 					source_uri: "",
 					data: canonical({
 						sourceReference: part.sourceReference ?? null,
-						...part.filename === void 0 ? {} : { filename: part.filename }
+						...part.filename === void 0 ? {} : { filename: part.filename },
+						...part.retain === "reference" ? {
+							retain: "reference",
+							snapshot: part.snapshot
+						} : {}
 					})
 				});
 			}
@@ -1332,8 +1479,12 @@ var IngestionService = class {
 		const itemId = String(item.id);
 		await this.point("reserved");
 		if (item.receipt_state === "ready") {
+			if (await this.revokedBeforeAck(itemId)) return {
+				kind: "rejected",
+				category: "expired"
+			};
 			try {
-				await this.repairDispatches();
+				if (!inline) await this.repairDispatches();
 			} catch {
 				return {
 					kind: "retry",
@@ -1347,12 +1498,15 @@ var IngestionService = class {
 			};
 		}
 		const token = randomUUID();
-		if (!(await this.tx((db) => db.query(`UPDATE intake_items SET receipt_state = 'preserving', fence = fence + 1, lease_token = ?, lease_until = ? WHERE tenant_id = ? AND confidential_scope_id = ? AND id = ? AND visibility = 'active' AND receipt_state <> 'ready' AND (lease_until IS NULL OR lease_until <= ?) RETURNING fence`, token, new Date(now.getTime() + input.limits.leaseMs).toISOString(), this.scope.tenantId, this.scope.confidentialScopeId, itemId, now.toISOString()))).rows.length) return {
+		if (!(await this.tx((db) => db.query(`UPDATE intake_items SET receipt_state = 'preserving', fence = fence + 1, lease_token = ?, lease_until = ? WHERE tenant_id = ? AND confidential_scope_id = ? AND id = ? AND visibility = 'active' AND receipt_state <> 'ready' AND (lease_until IS NULL OR lease_until <= ?) RETURNING fence`, token, new Date(now.getTime() + input.limits.leaseMs).toISOString(), this.scope.tenantId, this.scope.confidentialScopeId, itemId, now.toISOString()))).rows.length) return await this.revokedBeforeAck(itemId) ? {
+			kind: "rejected",
+			category: "expired"
+		} : {
 			kind: "retry",
 			category: "busy"
 		};
 		try {
-			for (const part of parts) await this.preserve(itemId, part, token);
+			for (const part of parts) if (part.retain === "copy") await this.preserve(itemId, part, token);
 			await this.point("evidence");
 			await this.tx(async (db) => {
 				await this.lock(db, itemId);
@@ -1364,15 +1518,19 @@ var IngestionService = class {
 					item_id: itemId,
 					stage: "analyze",
 					revision: 1,
-					state: "pending",
+					state: inline ? "completed" : "pending",
 					job_id: "",
 					deliveries: 0,
 					data: canonical({ dispatchTarget: this.dispatchTarget })
 				}, "tenant_id,item_id,stage,revision");
 			});
 			await this.point("ready");
-			await this.repairDispatches();
+			if (!inline) await this.repairDispatches();
 			await this.point("ack");
+			if (await this.revokedBeforeAck(itemId)) return {
+				kind: "rejected",
+				category: "expired"
+			};
 			return {
 				kind: reservation.created ? "accepted" : "duplicate",
 				itemId,
@@ -1380,12 +1538,20 @@ var IngestionService = class {
 			};
 		} catch {
 			await this.tx((db) => db.query(`UPDATE intake_items SET receipt_state='needs_attention',lease_token='',lease_until=NULL WHERE tenant_id=? AND confidential_scope_id=? AND id=? AND lease_token=? AND receipt_state<>'ready'`, this.scope.tenantId, this.scope.confidentialScopeId, itemId, token));
+			if (await this.revokedBeforeAck(itemId)) return {
+				kind: "rejected",
+				category: "expired"
+			};
 			return {
 				kind: "retry",
 				category: "unavailable"
 			};
 		}
 	}
+	async revokedBeforeAck(itemId) {
+		const [row] = await this.rows(this.db, "intake_items", "id=?", [itemId]);
+		return !row || row.visibility !== "active";
+	}
 	async preserve(itemId, part, token) {
 		const [evidence] = await this.rows(this.db, "intake_evidence", "item_id=? AND part_id=?", [itemId, part.partId]);
 		if (!evidence) throw new Error("Missing storage intent");
@@ -1724,7 +1890,7 @@ var IngestionService = class {
 			}
 			const wanted = limit - items.length;
 			const batch = Math.min(scanCeiling - examined, Math.max(wanted, Math.min(100, examined)));
-			const rows = (await this.db.query(`SELECT i.*, ${INBOX_STATE_SQL} AS inbox_state, ${actionCount()} AS action_count, ${receipt} FROM intake_items i${pinned} WHERE i.tenant_id = ? AND i.confidential_scope_id = ? AND i.visibility = 'active' AND i.expires_at > ?${where} ORDER BY i.created_at DESC, i.id DESC LIMIT ?`, ...params, batch + 1)).rows;
+			const rows = (await this.db.query(`SELECT i.*, (SELECT first_d.created_at FROM intake_dispositions first_d WHERE first_d.tenant_id=i.tenant_id AND first_d.confidential_scope_id=i.confidential_scope_id AND first_d.item_id=i.id AND CAST(first_d.id AS TEXT)=(SELECT MIN(CAST(d.id AS TEXT)) FROM intake_dispositions d WHERE ${dispositionWhere})) AS disposition_at, ${INBOX_STATE_SQL} AS inbox_state, ${actionCount()} AS action_count, ${receipt} FROM intake_items i${pinned} WHERE i.tenant_id = ? AND i.confidential_scope_id = ? AND i.visibility = 'active' AND i.expires_at > ?${where} ORDER BY i.created_at DESC, i.id DESC LIMIT ?`, ...params, batch + 1)).rows;
 			const more = rows.length > batch;
 			const candidates = rows.slice(0, batch);
 			const passed = /* @__PURE__ */ new Set();
@@ -1761,7 +1927,7 @@ var IngestionService = class {
 				lastReadable = position;
 				if (input.state && row.inbox_state !== input.state) continue;
 				items.push({
-					item: this.itemDTO(row),
+					item: this.itemDTO(row, row.disposition_at),
 					state: String(row.inbox_state),
 					position
 				});
@@ -1924,18 +2090,25 @@ var IngestionService = class {
 			}
 		};
 	}
-	itemDTO(row) {
+	/** Only the disposition state and time; reviewer and reason need review authority. */
+	itemDTO(row, dispositionAt) {
 		return {
 			id: String(row.id),
 			receiptState: String(row.receipt_state),
 			processingState: String(row.processing_state),
 			analysisRevision: Number(row.analysis_revision),
 			cancelled: !!row.cancelled,
-			traceId: String(row.trace_id)
+			traceId: String(row.trace_id),
+			...dispositionAt !== void 0 && dispositionAt !== null ? { disposition: {
+				state: "resolved",
+				at: persistedDate(dispositionAt).toISOString()
+			} } : {}
 		};
 	}
 	async getItem(id) {
-		return this.itemDTO(await this.item(id, "read"));
+		const item = await this.item(id, "read");
+		const [disposition] = await this.rows(this.db, "intake_dispositions", "item_id=? ORDER BY id LIMIT 1", [item.id]);
+		return this.itemDTO(item, disposition?.created_at);
 	}
 	async getEvidence(itemId) {
 		await this.item(itemId, "read");
@@ -1986,13 +2159,23 @@ var IngestionService = class {
 		await this.item(itemId, "read");
 		const [e] = await this.rows(this.db, "intake_evidence", "item_id=? AND id=? AND state='durable'", [itemId, evidenceId]);
 		if (!e) throw new Error("Intake unavailable");
-		const asset = await withTenant({ tenantId: this.scope.tenantId }, () => this.options.assets.collection.get({ id: String(e.asset_id) }));
-		if (!asset || asset.tenantId !== this.scope.tenantId || asset.sourceUri !== e.source_uri) throw new Error("Intake unavailable");
-		const bytes = await this.options.assets.store.read(asset);
+		const bytes = await this.evidenceBytes(e);
 		if (bytes.length !== Number(e.byte_length) || bytesHash(bytes) !== e.content_hash) throw new Error("Intake integrity");
 		await this.item(itemId, "read");
 		return bytes;
 	}
+	async evidenceBytes(e) {
+		const data = object(e.data);
+		if (data.retain === "reference") {
+			if (e.asset_id) throw new Error("Intake integrity");
+			if (typeof data.snapshot !== "string") throw new Error("Intake unavailable");
+			return Buffer.from(data.snapshot, "utf8");
+		}
+		if (!e.asset_id) throw new Error("Intake unavailable");
+		const asset = await withTenant({ tenantId: this.scope.tenantId }, () => this.options.assets.collection.get({ id: String(e.asset_id) }));
+		if (!asset || asset.tenantId !== this.scope.tenantId || asset.sourceUri !== e.source_uri) throw new Error("Intake unavailable");
+		return this.options.assets.store.read(asset);
+	}
 	/** Append an immutable input revision. Reprocessing never creates actions. */
 	async analyze(itemId, configuration, requestKey) {
 		const frozen = structuredClone(configuration);
@@ -2000,11 +2183,12 @@ var IngestionService = class {
 		if (Object.hasOwn(frozen, "reviewerInstruction") && frozen.stage !== "interpret") throw new Error("Reviewer instructions require authenticated instruction revision");
 		return this.tx((db) => this.appendAnalysis(db, itemId, frozen, requestKey));
 	}
-	async appendAnalysis(db, itemId, configuration, requestKey) {
+	async appendAnalysis(db, itemId, configuration, requestKey, pinnedSourceAttemptId) {
 		nonempty(requestKey);
 		const configDigest = digest(configuration);
 		await this.lock(db, itemId);
 		const item = await this.item(itemId, "process", db);
+		await this.assertUnresolved(db, itemId);
 		if (!await this.matchesDispatchRoute(db, item)) throw new Error("Intake dispatch route unavailable");
 		await this.bindDispatchRoute(db, item);
 		if (item.receipt_state !== "ready" || item.cancelled) throw new Error("Intake not processable");
@@ -2020,6 +2204,10 @@ var IngestionService = class {
 		if (configuration.stage === "interpret") {
 			if (Number(object(object(configuration.proposals).source).revision) !== previous.filter((row) => object(object(row.data).configuration).stage !== "interpret").reduce((max, row) => Math.max(max, Number(row.revision)), Number.NEGATIVE_INFINITY)) throw new GenerationSourceStaleError();
 		}
+		if (pinnedSourceAttemptId !== void 0) {
+			const latest = previous.find((a) => Number(a.revision) === Number(item.analysis_revision));
+			if (!latest || latest.current_attempt_id !== pinnedSourceAttemptId) throw new Error("Generation source changed");
+		}
 		const evidence = await this.rows(db, "intake_evidence", "item_id=? AND state='durable'", [itemId]);
 		await db.query("UPDATE intake_analysis_attempts SET state='superseded' WHERE tenant_id=? AND confidential_scope_id=? AND item_id=? AND state IN ('queued','running')", this.scope.tenantId, this.scope.confidentialScopeId, itemId);
 		await db.query("UPDATE intake_analyses SET state='superseded' WHERE tenant_id=? AND confidential_scope_id=? AND item_id=? AND state IN ('queued','running')", this.scope.tenantId, this.scope.confidentialScopeId, itemId);
@@ -2052,7 +2240,7 @@ var IngestionService = class {
 			item_id: itemId,
 			stage: "analyze",
 			revision,
-			state: "pending",
+			state: object(item.data).dispatch === "inline" ? "completed" : "pending",
 			job_id: "",
 			deliveries: 0,
 			data: canonical({ dispatchTarget: this.dispatchTarget })
@@ -2062,6 +2250,107 @@ var IngestionService = class {
 			revision
 		};
 	}
+	/** Run one fenced stage in-process and reload its terminal projection. */
+	async inlineStage(itemId, revision, work) {
+		const lease = await this.claimAnalysis(itemId, revision, "inline");
+		if (lease) await work(lease);
+		return this.tx(async (db) => {
+			await this.lock(db, itemId);
+			await this.item(itemId, "process", db);
+			const [analysis] = await this.rows(db, "intake_analyses", "item_id=? AND revision=?", [itemId, revision]);
+			if (!analysis) throw new Error("Analysis unavailable");
+			const [attempt] = analysis.current_attempt_id ? await this.rows(db, "intake_analysis_attempts", "id=? AND item_id=?", [analysis.current_attempt_id, itemId]) : [];
+			if (!attempt || ![
+				"completed",
+				"partial",
+				"needs_attention",
+				"failed"
+			].includes(String(attempt.state))) throw new Error("Inline interpretation busy");
+			return {
+				analysisId: String(analysis.id),
+				revision,
+				attemptId: String(attempt.id),
+				state: String(attempt.state),
+				error: attempt.safe_error ? String(attempt.safe_error) : null
+			};
+		});
+	}
+	/** Documented in-process receive-to-proposals path for `dispatch: 'inline'`
+	* receipts. Extraction (UTF-8 text/structured only) and interpretation use the
+	* same immutable revisions, fenced leases, catalog-live checks, provenance and
+	* failure categories as the job path; no queue intent is created or delivered. */
+	async interpretInline(itemId, input) {
+		nonempty(input.requestId);
+		if (!storableText(input.requestId)) throw new Error("Invalid intake identifier");
+		if (typeof input.extraction?.configurationRevision !== "string" || !input.extraction.configurationRevision || !storableText(input.extraction.configurationRevision)) throw new Error("Invalid extraction configuration");
+		if (object((await this.item(itemId, "process")).data).dispatch !== "inline") throw new Error("Inline interpretation requires an inline receipt");
+		const extraction = {
+			configurationRevision: input.extraction.configurationRevision,
+			limits: structuredClone(input.extraction.limits)
+		};
+		const requested = await this.analyze(itemId, {
+			stage: "extract",
+			extraction
+		}, `inline:extract:${input.requestId}`);
+		const extracted = await this.inlineStage(itemId, requested.revision, (lease) => extractAnalysis(this, lease, { extract: (request) => extractWithProviders(request, {}) }, extraction));
+		if (!["completed", "partial"].includes(extracted.state)) return {
+			itemId,
+			extraction: extracted
+		};
+		const interpretKey = `inline:interpret:${input.requestId}`;
+		const interpretation = await this.analysisByRequest(itemId, interpretKey) ?? await this.appendInterpretation(itemId, extracted.attemptId, interpretKey);
+		const generation = await this.inlineStage(itemId, interpretation.revision, (lease) => this.generateProposals(lease));
+		if (!["completed", "partial"].includes(generation.state)) return {
+			itemId,
+			extraction: extracted,
+			generation
+		};
+		return {
+			itemId,
+			extraction: extracted,
+			generation,
+			analysis: await this.getCompletedAnalysis(itemId, generation.attemptId)
+		};
+	}
+	/** Prepare outside the lock (it reads catalog and analysis), then append
+	* under it with the source pin rechecked. A concurrent identical request
+	* that appended first makes preparation fail; its revision is the replay. */
+	async appendInterpretation(itemId, sourceAttemptId, requestKey) {
+		await this.point("inline:replay-miss");
+		let configuration;
+		try {
+			configuration = structuredClone(await this.prepareGeneration(itemId, sourceAttemptId));
+		} catch (error) {
+			const replay = await this.analysisByRequest(itemId, requestKey);
+			if (replay) return replay;
+			throw error;
+		}
+		await this.point("inline:prepared");
+		return this.tx((db) => this.appendAnalysis(db, itemId, configuration, requestKey, sourceAttemptId));
+	}
+	async analysisByRequest(itemId, requestKey) {
+		const found = (await this.rows(this.db, "intake_analyses", "item_id=?", [itemId])).find((row) => object(row.data).requestKey === requestKey);
+		return found ? {
+			id: String(found.id),
+			revision: Number(found.revision)
+		} : null;
+	}
+	/** Owner-lifecycle hook: expire every active receipt bound to a deleted owner
+	* through the ordinary revoke-then-delete path. Returns the number scheduled. */
+	async expireOwned(owner) {
+		const key = ownerKey(owner);
+		const items = await this.rows(this.db, "intake_items", "owner_key=? AND visibility='active'", [key]);
+		try {
+			for (const item of items) await this.scheduleExpiry(String(item.id));
+		} catch (error) {
+			try {
+				await this.repairDeletions();
+			} catch {}
+			throw error;
+		}
+		await this.repairDeletions();
+		return items.length;
+	}
 	/** Record an authenticated split correction and queue fresh extraction, never copy model output. */
 	async reviseLogicalSplit(input) {
 		const frozen = structuredClone(input);
@@ -2079,6 +2368,7 @@ var IngestionService = class {
 		const replay = await this.tx(async (db) => {
 			await this.lock(db, frozen.itemId);
 			await this.item(frozen.itemId, "process", db);
+			await this.assertUnresolved(db, frozen.itemId);
 			const found = (await this.rows(db, "intake_analyses", "item_id=?", [frozen.itemId])).find((row) => object(row.data).requestKey === requestKey);
 			if (!found) return null;
 			if (digest(object(object(found.data).configuration).humanCorrection) !== digest(correction)) throw new Error("Split request conflict");
@@ -2351,7 +2641,7 @@ var IngestionService = class {
 		return this.tx(async (db) => {
 			await this.lock(db, itemId);
 			const item = await this.item(itemId, "process", db);
-			if (item.cancelled || item.receipt_state !== "ready" || Number(item.analysis_revision) !== revision) return null;
+			if (item.cancelled || item.receipt_state !== "ready" || Number(item.analysis_revision) !== revision || (await this.rows(db, "intake_dispositions", "item_id=?", [itemId])).length) return null;
 			const [analysis] = await this.rows(db, "intake_analyses", "item_id=? AND revision=?", [itemId, revision]);
 			if (!analysis || ["completed", "partial"].includes(String(analysis.state))) return null;
 			const limits = object(object(item.data).limits);
@@ -2615,10 +2905,12 @@ var IngestionService = class {
 	/** Mint an action only on an explicit host intention, never during reanalysis. */
 	async createAction(itemId, actionKey, provenance) {
 		nonempty(actionKey);
+		if (actionKey.startsWith("reviewer:") || provenance.origin === "reviewer-selected") throw new Error("Reserved action provenance");
 		const payload = canonical(provenance);
 		return this.tx(async (db) => {
 			await this.lock(db, itemId);
 			if ((await this.item(itemId, "process", db)).cancelled) throw new Error("Intake cancelled");
+			await this.assertUnresolved(db, itemId);
 			const [existing] = await this.rows(db, "intake_actions", "item_id=? AND action_key=?", [itemId, actionKey]);
 			if (existing) {
 				if (canonical(object(existing.data)) !== payload) throw new Error("Action identity conflict");
@@ -2645,7 +2937,9 @@ var IngestionService = class {
 			await this.lock(db, input.itemId);
 			const item = await this.item(input.itemId, "process", db);
 			if (item.cancelled) throw new Error("Intake cancelled");
+			await this.assertUnresolved(db, input.itemId);
 			const [action] = await this.rows(db, "intake_actions", "item_id=? AND id=?", [input.itemId, input.actionId]);
+			if (action && object(action.data).origin === "reviewer-selected") throw new Error("Reviewer-selected action requires review");
 			const [attempt] = await this.rows(db, "intake_analysis_attempts", "item_id=? AND id=?", [input.itemId, input.attemptId]);
 			if (!action || !attempt || !["completed", "partial"].includes(String(attempt.state)) || !attempt.output_digest) throw new Error("Invalid proposal evidence");
 			if (Number(action.proposal_revision) !== input.expectedRevision || [
@@ -2773,7 +3067,10 @@ var IngestionService = class {
 				asset.sourceUri = String(locator.sourceUri);
 				await this.options.assets.store.removeFile(asset);
 			}
-			if (intent.state === "completed") continue;
+			if (intent.state === "completed") {
+				await this.releaseRedactedPrincipal(itemId);
+				continue;
+			}
 			await this.options.purgeDerived({
 				tenantId: this.scope.tenantId,
 				itemId
@@ -2784,13 +3081,35 @@ var IngestionService = class {
 				const item = await this.item(itemId, "delete", db, true);
 				for (const table of TABLES.filter((t) => t !== "intake_items" && t !== "intake_deletions")) await db.query(`UPDATE ${table} SET data='{}' WHERE tenant_id=? AND confidential_scope_id=? AND item_id=?`, this.scope.tenantId, this.scope.confidentialScopeId, itemId);
 				await db.query("UPDATE intake_evidence SET source_uri='',content_hash='',media_type='',byte_length=0 WHERE tenant_id=? AND confidential_scope_id=? AND item_id=?", this.scope.tenantId, this.scope.confidentialScopeId, itemId);
-				await db.query("UPDATE intake_items SET data=?,trace_id='' WHERE tenant_id=? AND confidential_scope_id=? AND id=?", canonical({ capturedCeiling: object(item.data).capturedCeiling ?? {} }), this.scope.tenantId, this.scope.confidentialScopeId, itemId);
+				for (const [table, column] of REDACTED_DIGESTS) await db.query(`UPDATE ${table} SET ${column}=? WHERE tenant_id=? AND confidential_scope_id=? AND item_id=?`, REDACTED, this.scope.tenantId, this.scope.confidentialScopeId, itemId);
+				await db.query("UPDATE intake_items SET data=?,trace_id='',submitter_id='',owner_key='',payload_digest=?,scope_digest=? WHERE tenant_id=? AND confidential_scope_id=? AND id=?", canonical({ capturedCeiling: redactedCeiling(object(object(item.data).capturedCeiling ?? {}), await this.hasUnfinishedActions(db, itemId)) }), REDACTED, REDACTED, this.scope.tenantId, this.scope.confidentialScopeId, itemId);
 				await db.query("UPDATE intake_deletions SET state='completed' WHERE tenant_id=? AND confidential_scope_id=? AND id=?", this.scope.tenantId, this.scope.confidentialScopeId, intent.id);
 			});
 			completed++;
 		}
 		return completed;
 	}
+	async hasUnfinishedActions(db, itemId) {
+		return (await this.rows(db, "intake_actions", `item_id=? AND state IN (${UNFINISHED_ACTION_STATES.map(() => "?").join(",")})`, [itemId, ...UNFINISHED_ACTION_STATES])).length > 0;
+	}
+	/** Later sweeps drop a principal retained for a reconciliation that has
+	* since reached a final state. */
+	async releaseRedactedPrincipal(itemId) {
+		await this.tx(async (db) => {
+			await this.lock(db, itemId);
+			const [item] = await this.rows(db, "intake_items", "id=?", [itemId]);
+			if (!item || item.visibility === "active") return;
+			if (await this.hasUnfinishedActions(db, itemId)) return;
+			const data = object(item.data);
+			const ceiling = object(data.capturedCeiling ?? {});
+			const released = redactedCeiling(ceiling, false);
+			if (canonical(released) === canonical(ceiling)) return;
+			await db.query("UPDATE intake_items SET data=? WHERE tenant_id=? AND confidential_scope_id=? AND id=?", canonical({
+				...data,
+				capturedCeiling: released
+			}), this.scope.tenantId, this.scope.confidentialScopeId, itemId);
+		});
+	}
 	/** Run host-configured expiry policy and retry interrupted deletion propagation. */
 	async sweepRetention() {
 		const expired = await this.rows(this.db, "intake_items", "visibility='active' AND expires_at<=?", [this.now().toISOString()]);
@@ -2807,6 +3126,6 @@ var IngestionService = class {
 	}
 };
 //#endregion
-export { EmailSourceAdapter, GenerationSnapshotStaleError, GenerationSourceStaleError, HandlerArgumentsInvalidError, ITEM_ID_FILTER_CEILING, ITEM_PAGE_CEILING, ITEM_SCAN_CEILING, IngestionService, IntakeScanLimitError, REVIEWER_INSTRUCTION_MAX_LENGTH, ReviewerInstructionInvalidError, ReviewerInstructionStaleError, WatchFolderSourceAdapter, createIntakeReviewHost, createSDKExtractionAdapter, createSourceDeliveryHandler, createVendorWebhookHandler, extractAnalysis, isIntakeId, proposeDocumentSplits, reviewerInstructionView };
+export { EmailSourceAdapter, GenerationSnapshotStaleError, GenerationSourceStaleError, HandlerArgumentsInvalidError, ITEM_ID_FILTER_CEILING, ITEM_PAGE_CEILING, ITEM_SCAN_CEILING, IngestionService, IntakeScanLimitError, ProposalsNotConfiguredError, REVIEWER_INSTRUCTION_MAX_LENGTH, ReviewerInstructionInvalidError, ReviewerInstructionStaleError, WatchFolderSourceAdapter, createIntakeReviewHost, createSDKExtractionAdapter, createSourceDeliveryHandler, createVendorWebhookHandler, extractAnalysis, isIntakeId, proposeDocumentSplits, reviewerInstructionView };
 
 //# sourceMappingURL=server.js.map