@opengeni/worker-bundle 0.29.0-canary.0 → 0.29.0-canary.2

package/dist/{activities-control-MKGEOBXT.js → activities-control-HMFGSKC5.js}

@@ -11,7 +11,9 @@ import {
   assertReusableSessionRevivable,
   captureConnectedCommandOutput,
   createCodexCapacityActivities,
+  createDocumentActivities,
   createGoalActivities,
+  createKnowledgeSourceSyncActivities,
   createSharedActivityServices,
   currentActivityContext,
   deliverFailedChildTurnToParent,
@@ -31,7 +33,7 @@ import {
   scheduledUserMessagePayload,
   withFirstPartyTools,
   workflowIdForSession
-} from "./chunk-OA5CSY5N.js";
+} from "./chunk-CYITU5UH.js";
 import {
   inspectOpenSandboxKubernetesInventory,
   recordCreditBalanceGauges,
@@ -54,6 +56,126 @@ import {
 } from "./chunk-A4XQWVZK.js";
 import "./chunk-PZ5AY32C.js";
 
+// src/activities/knowledge-indexing.ts
+import { configuredStaticUsageLimits } from "@opengeni/config";
+import {
+  appendKnowledgeIndexChunks,
+  claimKnowledgeIndexJobs,
+  completeKnowledgeIndexJob,
+  continueKnowledgeIndexJob,
+  deferKnowledgeIndexJob,
+  getBillingBalance,
+  readKnowledgeIndexSource,
+  recordUsageEvent,
+  sumUsageQuantity,
+  withWorkspaceUsageLock
+} from "@opengeni/db";
+function createKnowledgeIndexingActivities(services, resolveDocumentServices) {
+  return {
+    indexKnowledge: async () => {
+      const result = { completed: 0, advanced: 0, deferred: 0, unavailable: 0 };
+      if (!resolveDocumentServices) return result;
+      const { db, settings, observability } = await services();
+      const { embedder } = await resolveDocumentServices();
+      const { knowledgeIndexChunks } = await import("@opengeni/documents");
+      const claims = await claimKnowledgeIndexJobs(db, {
+        model: embedder.model,
+        dimensions: embedder.dimensions,
+        limit: 2
+      });
+      for (const claim of claims) {
+        try {
+          const source = await readKnowledgeIndexSource(db, claim);
+          if (!source) {
+            result.unavailable++;
+            continue;
+          }
+          await withWorkspaceUsageLock(db, source.billingWorkspaceId, async (lockedDb) => {
+            const current = await readKnowledgeIndexSource(lockedDb, claim);
+            if (!current) {
+              result.unavailable++;
+              return;
+            }
+            const chunks = [];
+            let more = false;
+            for (const chunk of knowledgeIndexChunks(current.entry)) {
+              if (chunk.index < current.nextIndex) continue;
+              if (chunks.length === 32) {
+                more = true;
+                break;
+              }
+              chunks.push(chunk);
+            }
+            if (chunks.length) {
+              if (settings.billingMode === "stripe" || settings.usageLimitsMode === "managed") {
+                const balance = await getBillingBalance(lockedDb, claim.accountId);
+                if (balance.balanceMicros <= 0) throw new Error("insufficient OpenGeni credits");
+              }
+              if (settings.usageLimitsMode === "static" || settings.usageLimitsMode === "managed") {
+                const limit = configuredStaticUsageLimits(settings).maxDocumentIndexedChunksPerWorkspace;
+                if (limit) {
+                  const now = /* @__PURE__ */ new Date();
+                  const used = await sumUsageQuantity(lockedDb, {
+                    workspaceId: current.billingWorkspaceId,
+                    eventType: "document.indexed",
+                    since: new Date(Date.UTC(now.getUTCFullYear(), now.getUTCMonth(), 1))
+                  });
+                  if (used + chunks.length > limit)
+                    throw new Error("monthly document indexing limit reached");
+                }
+              }
+              const vectors = await embedder.embedMany(chunks.map((chunk) => chunk.embeddingInput));
+              if (vectors.length !== chunks.length)
+                throw new Error("Incomplete Knowledge embeddings");
+              const appended = await appendKnowledgeIndexChunks(
+                lockedDb,
+                claim,
+                current.nextIndex,
+                chunks.map((chunk, index) => ({ ...chunk, embedding: vectors[index] }))
+              );
+              if (appended.status !== "running") {
+                result.unavailable++;
+                return;
+              }
+              await recordUsageEvent(lockedDb, {
+                accountId: claim.accountId,
+                workspaceId: current.billingWorkspaceId,
+                eventType: "document.indexed",
+                quantity: chunks.length,
+                unit: "chunk",
+                sourceResourceType: "knowledge_revision",
+                sourceResourceId: claim.revisionId,
+                idempotencyKey: `knowledge.indexed:${claim.revisionId}:${claim.generation}:${current.nextIndex}`
+              });
+            }
+            if (more) {
+              await continueKnowledgeIndexJob(lockedDb, claim);
+              result.advanced++;
+            } else {
+              const completed = await completeKnowledgeIndexJob(
+                lockedDb,
+                claim,
+                current.nextIndex + chunks.length
+              );
+              if (completed.status === "ready") result.completed++;
+              else result.unavailable++;
+            }
+          });
+        } catch {
+          await deferKnowledgeIndexJob(db, claim).catch(() => void 0);
+          result.deferred++;
+          observability.warn("Knowledge indexing batch deferred", {
+            accountId: claim.accountId,
+            entryId: claim.entryId,
+            revisionId: claim.revisionId
+          });
+        }
+      }
+      return result;
+    }
+  };
+}
+
 // src/activities/browser-state-artifact-reaper.ts
 import {
   claimBrowserStateArtifactCleanup,
@@ -161,9 +283,9 @@ import {
 import { SessionSkills } from "@opengeni/contracts";
 
 // src/activities/agent-run-admission.ts
-import { configuredStaticUsageLimits } from "@opengeni/config";
+import { configuredStaticUsageLimits as configuredStaticUsageLimits2 } from "@opengeni/config";
 import { modelFundingForAdmission } from "@opengeni/core";
-import { getBillingBalance, isCodexBilledTurn, sumUsageQuantity } from "@opengeni/db";
+import { getBillingBalance as getBillingBalance2, isCodexBilledTurn, sumUsageQuantity as sumUsageQuantity2 } from "@opengeni/db";
 async function agentRunAdmissionDenial(services, input) {
   const codexBilled = await isCodexBilledTurn({
     db: services.db,
@@ -186,16 +308,16 @@ async function agentRunAdmissionDenial(services, input) {
       });
       if (!decision.allowed) return "insufficient_credits";
     } else {
-      const balance = await getBillingBalance(services.db, input.accountId);
+      const balance = await getBillingBalance2(services.db, input.accountId);
       if (balance.balanceMicros <= 0) return "insufficient_credits";
     }
   }
   if (services.settings.usageLimitsMode !== "static" && services.settings.usageLimitsMode !== "managed") {
     return null;
   }
-  const limits = configuredStaticUsageLimits(services.settings);
+  const limits = configuredStaticUsageLimits2(services.settings);
   if (!externallyBilled && limits.maxMonthlyCostMicrosPerAccount) {
-    const used = await sumUsageQuantity(services.db, {
+    const used = await sumUsageQuantity2(services.db, {
       accountId: input.accountId,
       eventType: "model.cost",
       since: startOfUtcMonth()
@@ -205,7 +327,7 @@ async function agentRunAdmissionDenial(services, input) {
     }
   }
   if (limits.maxMonthlyAgentRunsPerWorkspace) {
-    const used = await sumUsageQuantity(services.db, {
+    const used = await sumUsageQuantity2(services.db, {
       workspaceId: input.workspaceId,
       eventType: "agent_run.created",
       since: startOfUtcMonth()
@@ -421,3307 +543,178 @@ function createAutomationActivities(services, options = {}) {
         }
         throw error;
       }
-    }
-  };
-}
-function isUnprocessableEntity(error) {
-  return error instanceof Error && "status" in error && error.status === 422;
-}
-
-// src/activities/documents.ts
-import { configuredStaticUsageLimits as configuredStaticUsageLimits2 } from "@opengeni/config";
-import {
-  getBillingBalance as getBillingBalance2,
-  recordUsageEvent,
-  resolveDocumentIndexAuthority,
-  rlsContextForWorkspace,
-  sumUsageQuantity as sumUsageQuantity2,
-  withWorkspaceUsageLock
-} from "@opengeni/db";
-function createDocumentActivities(services, resolveDocumentServices) {
-  return {
-    indexDocument: async (input) => {
-      const { settings, db, objectStorage } = await services();
-      if (!objectStorage) {
-        throw new Error("object storage is not configured");
-      }
-      if (!resolveDocumentServices) {
-        throw new Error("document services are not configured");
-      }
-      const [{ getDocumentForIndexing, indexDocumentNow }, documentServices] = await Promise.all([
-        import("@opengeni/documents"),
-        resolveDocumentServices()
-      ]);
-      const context = await rlsContextForWorkspace(db, input.workspaceId);
-      if (context.accountId !== input.accountId) {
-        throw new Error("document account/workspace authority mismatch");
-      }
-      return await withWorkspaceUsageLock(db, input.workspaceId, async (lockedDb) => {
-        const storedAuthority = await resolveDocumentIndexAuthority(lockedDb, input);
-        if (!storedAuthority) {
-          throw new Error("document authority was not found before indexing");
-        }
-        const suppliedAuthorityFields = [
-          "authorityKind",
-          "authorityWorkspaceId",
-          "authoritySubjectId"
-        ];
-        const suppliedCount = suppliedAuthorityFields.filter(
-          (field) => Object.prototype.hasOwnProperty.call(input, field)
-        ).length;
-        const suppliedMismatch = Object.prototype.hasOwnProperty.call(input, "authorityKind") && input.authorityKind !== storedAuthority.authorityKind || Object.prototype.hasOwnProperty.call(input, "authorityWorkspaceId") && input.authorityWorkspaceId !== storedAuthority.authorityWorkspaceId || Object.prototype.hasOwnProperty.call(input, "authoritySubjectId") && input.authoritySubjectId !== storedAuthority.authoritySubjectId;
-        if (suppliedMismatch) {
-          throw new Error("document authority changed before indexing");
-        }
-        if (suppliedCount !== 0 && suppliedCount !== suppliedAuthorityFields.length) {
-          throw new Error("document authority tuple is partial");
-        }
-        const claimedDocument = await getDocumentForIndexing(
-          lockedDb,
-          input.workspaceId,
-          input.documentId
-        );
-        if (!claimedDocument || claimedDocument.authorityKind !== storedAuthority.authorityKind || claimedDocument.authorityWorkspaceId !== storedAuthority.authorityWorkspaceId || claimedDocument.authoritySubjectId !== storedAuthority.authoritySubjectId) {
-          throw new Error("document authority changed before indexing");
-        }
-        const document = await indexDocumentNow(
-          lockedDb,
-          objectStorage,
-          input.workspaceId,
-          input.documentId,
-          documentServices,
-          {
-            beforeEmbed: async ({ chunkCount }) => {
-              if (settings.billingMode === "stripe" || settings.usageLimitsMode === "managed") {
-                const balance = await getBillingBalance2(lockedDb, input.accountId);
-                if (balance.balanceMicros <= 0) {
-                  throw new Error("insufficient OpenGeni credits");
-                }
-              }
-              if (settings.usageLimitsMode !== "static" && settings.usageLimitsMode !== "managed") {
-                return;
-              }
-              const limit = configuredStaticUsageLimits2(settings).maxDocumentIndexedChunksPerWorkspace;
-              if (!limit) {
-                return;
-              }
-              const used = await sumUsageQuantity2(lockedDb, {
-                workspaceId: input.workspaceId,
-                eventType: "document.indexed",
-                since: startOfUtcMonth2()
-              });
-              if (used + chunkCount > limit) {
-                throw new Error(`monthly document indexing limit reached (${limit} chunks)`);
-              }
-            }
-          },
-          { viewerSubjectId: storedAuthority.authoritySubjectId }
-        );
-        if (document.authorityKind !== storedAuthority.authorityKind || document.authorityWorkspaceId !== storedAuthority.authorityWorkspaceId || document.authoritySubjectId !== storedAuthority.authoritySubjectId) {
-          throw new Error("document authority changed before indexing");
-        }
-        if (document.status === "ready") {
-          await recordUsageEvent(lockedDb, {
-            accountId: input.accountId,
-            workspaceId: input.workspaceId,
-            eventType: "document.indexed",
-            quantity: document.chunkCount,
-            unit: "chunk",
-            sourceResourceType: "document",
-            sourceResourceId: document.id,
-            idempotencyKey: `document.indexed:${input.workspaceId}:${document.id}:${document.updatedAt}`
-          });
-        }
-        return document;
-      });
-    }
-  };
-}
-function startOfUtcMonth2(date = /* @__PURE__ */ new Date()) {
-  return new Date(Date.UTC(date.getUTCFullYear(), date.getUTCMonth(), 1));
-}
-
-// src/activities/file-upload-reaper.ts
-import {
-  claimDueTranscriptionRecordingObjectCleanup,
-  claimExpiredFileUploadCleanup,
-  completeDueTranscriptionRecordingObjectCleanup,
-  completeExpiredFileUploadCleanup,
-  claimVideoGenerationOperations,
-  purgeExpiredTranscriptionRecordings
-} from "@opengeni/db";
-import { randomUUID } from "crypto";
-var FILE_UPLOAD_CLEANUP_GRACE_MS = 60 * 60 * 1e3;
-var FILE_UPLOAD_CLEANUP_CLAIM_TIMEOUT_MS = 10 * 60 * 1e3;
-var FILE_UPLOAD_CLEANUP_BATCH_SIZE = 100;
-var SAFE_CLEANUP_ERROR_CATEGORIES = /* @__PURE__ */ new Set([
-  "aborted",
-  "conflict",
-  "invalid_response",
-  "network",
-  "not_found",
-  "permission_denied",
-  "provider",
-  "timeout",
-  "unavailable"
-]);
-function cleanupErrorAttributes(error) {
-  let errorCategory = "provider_error";
-  let errorStatus;
-  if (error && typeof error === "object") {
-    const rawCode = error.code;
-    if (typeof rawCode === "string" && SAFE_CLEANUP_ERROR_CATEGORIES.has(rawCode)) {
-      errorCategory = rawCode;
-    } else if (rawCode !== void 0) {
-      errorCategory = "unknown";
-    }
-    const rawStatus = Number(
-      error.status ?? error.statusCode
-    );
-    if (Number.isInteger(rawStatus) && rawStatus >= 100 && rawStatus <= 599) {
-      errorStatus = rawStatus;
-    }
-  }
-  return { errorCategory, ...errorStatus === void 0 ? {} : { errorStatus } };
-}
-function createFileUploadReaperActivities(services, options = {}) {
-  const graceMs = options.graceMs ?? FILE_UPLOAD_CLEANUP_GRACE_MS;
-  const claimTimeoutMs = options.claimTimeoutMs ?? FILE_UPLOAD_CLEANUP_CLAIM_TIMEOUT_MS;
-  const batchSize = options.batchSize ?? FILE_UPLOAD_CLEANUP_BATCH_SIZE;
-  const deleteObject = options.deleteObject ?? (async (storage, key) => storage.deleteObject(key));
-  const claimFileUploads = options.claimFileUploads ?? claimExpiredFileUploadCleanup;
-  const completeFileUpload = options.completeFileUpload ?? completeExpiredFileUploadCleanup;
-  const claimTranscriptionObjects = options.claimTranscriptionObjects ?? claimDueTranscriptionRecordingObjectCleanup;
-  const completeTranscriptionObject = options.completeTranscriptionObject ?? completeDueTranscriptionRecordingObjectCleanup;
-  const purgeTranscriptionRecordings = options.purgeTranscriptionRecordings ?? purgeExpiredTranscriptionRecordings;
-  async function reapExpiredFileUploads() {
-    const { db, objectStorage, observability } = await services();
-    if (!objectStorage) {
-      try {
-        await purgeTranscriptionRecordings(db, { graceMs, limit: batchSize });
-      } catch (error) {
-        observability.warn("expired transcription recording metadata purge failed", {
-          ...cleanupErrorAttributes(error)
-        });
-      }
-      return { claimed: 0, deleted: 0, failed: 0 };
-    }
-    const claims = await claimFileUploads(db, {
-      graceMs,
-      claimTimeoutMs,
-      limit: batchSize
-    });
-    let deleted = 0;
-    let failed = 0;
-    for (const claim of claims) {
-      try {
-        await deleteObject(objectStorage, claim.objectKey);
-        const settled = await completeFileUpload(db, claim);
-        if (!settled) {
-          throw new Error("cleanup claim no longer owns a reclaimable upload");
-        }
-        deleted += 1;
-      } catch (error) {
-        failed += 1;
-        observability.warn("expired file upload cleanup failed; claim remains reclaimable", {
-          workspaceId: claim.workspaceId,
-          uploadId: claim.uploadId,
-          fileId: claim.fileId,
-          ...cleanupErrorAttributes(error)
-        });
-      }
-    }
-    const recordingClaims = await claimTranscriptionObjects(db, {
-      graceMs,
-      claimTimeoutMs,
-      limit: batchSize
-    });
-    for (const claim of recordingClaims) {
-      try {
-        await deleteObject(objectStorage, claim.objectKey);
-        const settled = await completeTranscriptionObject(db, claim);
-        if (!settled) {
-          throw new Error("cleanup claim no longer owns a transcription recording object");
-        }
-        deleted += 1;
-      } catch (error) {
-        failed += 1;
-        observability.warn(
-          "expired transcription recording object cleanup failed; claim remains reclaimable",
-          {
-            workspaceId: claim.workspaceId,
-            recordingId: claim.recordingId,
-            ...cleanupErrorAttributes(error)
-          }
-        );
-      }
-    }
-    let transcriptionRecordingsPurged = 0;
-    try {
-      transcriptionRecordingsPurged = await purgeTranscriptionRecordings(db, {
-        graceMs,
-        limit: batchSize
-      });
-    } catch (error) {
-      observability.warn("expired transcription recording metadata purge failed", {
-        ...cleanupErrorAttributes(error)
-      });
-    }
-    const claimed = claims.length + recordingClaims.length;
-    if (claimed > 0 || transcriptionRecordingsPurged > 0) {
-      observability.info("expired file upload cleanup swept", {
-        claimed,
-        deleted,
-        failed,
-        fileUploads: claims.length,
-        transcriptionRecordingObjects: recordingClaims.length,
-        transcriptionRecordingsPurged
-      });
-    }
-    return { claimed, deleted, failed };
-  }
-  async function recoverVideoGenerationWorkflows() {
-    const { db, startVideoGenerationWorkflow, observability } = await services();
-    if (!startVideoGenerationWorkflow) return { claimed: 0, started: 0, failed: 0 };
-    const claims = await claimVideoGenerationOperations(db, {
-      owner: `video-workflow-recovery:${randomUUID()}`,
-      leaseSeconds: 120,
-      limit: 100
-    });
-    let started = 0;
-    let failed = 0;
-    for (const claim of claims) {
-      try {
-        await startVideoGenerationWorkflow(claim);
-        started += 1;
-      } catch (error) {
-        failed += 1;
-        observability.warn("Video generation workflow recovery start failed", {
-          operationId: claim.operationId,
-          errorClass: error instanceof Error ? error.name : "UnknownError"
-        });
-      }
-    }
-    return { claimed: claims.length, started, failed };
-  }
-  return { reapExpiredFileUploads, recoverVideoGenerationWorkflows };
-}
-
-// src/activities/knowledge-source-sync.ts
-import { createHash as createHash2 } from "crypto";
-import { heartbeat } from "@temporalio/activity";
-import {
-  googleDriveProviderRetryOptions
-} from "@opengeni/config";
-import {
-  KnowledgeSourceSyncRunSummary
-} from "@opengeni/contracts";
-import {
-  ATLASSIAN_PROVIDER_DOMAIN,
-  AtlassianConnectionMetadata,
-  atlassianScopesAllowRead
-} from "@opengeni/contracts/atlassian";
-import {
-  GoogleDriveConnectionMetadata,
-  GOOGLE_DRIVE_PROVIDER_DOMAIN,
-  googleDriveScopesAllowCapability
-} from "@opengeni/contracts/google-drive";
-import {
-  googleDriveKnowledgeScope,
-  inventoryGoogleDriveSource
-} from "@opengeni/documents/google-drive";
-import {
-  atlassianKnowledgeScope,
-  inventoryAtlassianSource
-} from "@opengeni/documents/atlassian";
-import { addDocumentToBase, ensureDefaultBase, getDocumentBase } from "@opengeni/documents";
-import {
-  appendKnowledgeDocumentVersion,
-  appendKnowledgeSourceAclVersion,
-  beginKnowledgeSyncRun,
-  beginGoogleDriveObjectAclRefresh,
-  buildConnectionTokenResolver,
-  checkpointKnowledgeSourceSync,
-  claimKnowledgeSourceSyncLease,
-  compareCanonicalDecimalProviderRevisions,
-  completeKnowledgeSyncRun,
-  completeKnowledgeSourceSyncWakeWithoutLease,
-  deauthorizeKnowledgeSourceRetrieval,
-  enqueueKnowledgeSourceSyncIndexObligation,
-  ensureKnowledgeSourceBlobFile,
-  getConnectionMetadata,
-  getKnowledgeDocumentVersionObservationForSyncAuthority,
-  getKnowledgeSyncRunForSyncAuthority,
-  getKnowledgeSourceAclForSyncAuthority,
-  getKnowledgeSourceForSyncAuthority,
-  getKnowledgeSourceObjectForSyncAuthority,
-  getKnowledgeSourceSyncIndexObligationForVersion,
-  getScheduledTask,
-  listObservedKnowledgeSourceSyncExternalObjectIds,
-  KnowledgeSourceSyncObservationFenceError,
-  reconcileKnowledgeSourceSyncCompleteScan,
-  reconcileKnowledgeSourceSyncLiveGeneration,
-  recordGoogleDriveObjectAclEvidence,
-  recordKnowledgeSourceSyncItemOutcomes,
-  recordKnowledgeSourceSyncObjectObservations,
-  recordUsageEvent as recordUsageEvent2,
-  releaseKnowledgeSourceSyncLeaseForRetry,
-  restoreKnowledgeSourceObject,
-  retryKnowledgeSourceSyncIndexObligation,
-  scopedKnowledgeScopeKey,
-  settleKnowledgeSourceSyncLease,
-  settleKnowledgeSourceSyncIndexObligation,
-  updateKnowledgeSourceDocumentObservationMetadata,
-  updateScheduledTaskRun,
-  upsertKnowledgeSourceObject
-} from "@opengeni/db";
-import { readResponseJsonBounded } from "@opengeni/network";
-
-// src/activities/google-drive-provider.ts
-var GoogleDriveProviderTransportError = class extends Error {
-  constructor() {
-    super("google_drive_provider_transport_failed");
-    this.name = "GoogleDriveProviderTransportError";
-  }
-};
-async function fetchGoogleDriveProvider(input) {
-  const now = input.now ?? Date.now;
-  const sleep = input.sleep ?? Bun.sleep;
-  let retryDelaySpentMs = 0;
-  for (let attempt = 1; attempt <= input.policy.attempts; attempt += 1) {
-    let response;
-    input.heartbeat?.({ operation: input.operation, attempt, phase: "request_start" });
-    try {
-      response = await input.fetchImpl(input.url, {
-        ...input.init,
-        redirect: "error",
-        signal: AbortSignal.timeout(input.policy.requestTimeoutMs)
-      });
-    } catch {
-      input.heartbeat?.({ operation: input.operation, attempt, phase: "request_end" });
-      recordRequest(input.observability, input.operation, "retryable_error");
-      const delayMs2 = retryDelayMs(input.policy, attempt, null);
-      if (!canRetry(input.policy, attempt, retryDelaySpentMs, delayMs2)) {
-        throw new GoogleDriveProviderTransportError();
-      }
-      recordRetry(input.observability, input.operation, "transport", attempt, delayMs2);
-      retryDelaySpentMs += delayMs2;
-      input.heartbeat?.({ operation: input.operation, attempt, phase: "retry_delay_start" });
-      await sleep(delayMs2);
-      input.heartbeat?.({ operation: input.operation, attempt, phase: "retry_delay_end" });
-      continue;
-    }
-    input.heartbeat?.({ operation: input.operation, attempt, phase: "request_end" });
-    if (!isRetryableStatus(response.status)) {
-      recordRequest(
-        input.observability,
-        input.operation,
-        response.ok ? "succeeded" : "terminal_error"
-      );
-      return response;
-    }
-    recordRequest(input.observability, input.operation, "retryable_error");
-    const delayMs = retryDelayMs(
-      input.policy,
-      attempt,
-      retryAfterDelayMs(response.headers.get("retry-after"), now())
-    );
-    if (!canRetry(input.policy, attempt, retryDelaySpentMs, delayMs)) return response;
-    await response.body?.cancel().catch(() => void 0);
-    recordRetry(
-      input.observability,
-      input.operation,
-      response.status === 429 ? "rate_limited" : "provider_unavailable",
-      attempt,
-      delayMs
-    );
-    retryDelaySpentMs += delayMs;
-    input.heartbeat?.({ operation: input.operation, attempt, phase: "retry_delay_start" });
-    await sleep(delayMs);
-    input.heartbeat?.({ operation: input.operation, attempt, phase: "retry_delay_end" });
-  }
-  throw new GoogleDriveProviderTransportError();
-}
-function canRetry(policy, attempt, retryDelaySpentMs, delayMs) {
-  return attempt < policy.attempts && retryDelaySpentMs + delayMs <= policy.budgetMs;
-}
-function retryDelayMs(policy, attempt, retryAfterMs) {
-  const exponential = Math.min(
-    policy.maxDelayMs,
-    policy.initialDelayMs * 2 ** Math.max(0, attempt - 1)
-  );
-  return Math.min(policy.maxDelayMs, Math.max(exponential, retryAfterMs ?? 0));
-}
-function retryAfterDelayMs(value, nowMs) {
-  if (!value) return null;
-  const seconds = Number(value);
-  if (Number.isFinite(seconds) && seconds >= 0) return Math.round(seconds * 1e3);
-  const timestamp = Date.parse(value);
-  return Number.isFinite(timestamp) ? Math.max(0, timestamp - nowMs) : null;
-}
-function isRetryableStatus(status) {
-  return status === 429 || status >= 500;
-}
-function recordRequest(observability, operation, outcome) {
-  observability.incrementCounter({
-    name: "opengeni_google_drive_provider_requests_total",
-    help: "Google Drive provider request attempts by operation and bounded outcome.",
-    labels: { operation, outcome }
-  });
-}
-function recordRetry(observability, operation, reason, attempt, delayMs) {
-  observability.incrementCounter({
-    name: "opengeni_google_drive_provider_retries_total",
-    help: "Bounded Google Drive provider retries by operation and reason.",
-    labels: { operation, reason }
-  });
-  observability.observeHistogram({
-    name: "opengeni_google_drive_provider_retry_delay_seconds",
-    help: "Delay applied before a bounded Google Drive provider retry.",
-    labels: { operation, reason },
-    value: delayMs / 1e3,
-    buckets: [0.1, 0.25, 0.5, 1, 2, 5, 10, 30, 60]
-  });
-  observability.warn("Google Drive provider request retry scheduled", {
-    provider: "google_drive",
-    operation,
-    outcome: "retry_scheduled",
-    reason,
-    attempt,
-    delayMs
-  });
-}
-
-// src/activities/google-drive-changes.ts
-import { createHash } from "crypto";
-import {
-  GOOGLE_DRIVE_FOLDER_MIME_TYPE,
-  planGoogleDriveTransfer
-} from "@opengeni/documents/google-drive";
-var MAX_TOKEN_CHARS = 4096;
-var MAX_BOUNDARY_ID_CHARS = 1024;
-var MAX_ANCESTOR_DEPTH = 100;
-function parseGoogleDriveChangesCursor(value, expected) {
-  if (!value || value.version !== 1 || value.kind !== "google_drive_changes") return null;
-  if (value.connectionId !== expected.connectionId || value.googlePermissionId !== expected.googlePermissionId || value.sourceId !== expected.sourceId || value.driveId !== expected.driveId || typeof value.boundaryId !== "string" || value.boundaryId.length < 1 || value.boundaryId.length > MAX_BOUNDARY_ID_CHARS || typeof value.pageToken !== "string" || value.pageToken.length < 1 || value.pageToken.length > MAX_TOKEN_CHARS || typeof value.cursorGeneration !== "number" || !Number.isSafeInteger(value.cursorGeneration) || value.cursorGeneration < 1 || typeof value.lastFullReconciliationAt !== "string" || !Number.isFinite(Date.parse(value.lastFullReconciliationAt)) || typeof value.nextFullReconciliationAt !== "string" || !Number.isFinite(Date.parse(value.nextFullReconciliationAt))) {
-    return null;
-  }
-  return value;
-}
-function buildGoogleDriveChangesCursor(input) {
-  return {
-    version: 1,
-    kind: "google_drive_changes",
-    connectionId: input.connectionId,
-    googlePermissionId: input.googlePermissionId,
-    sourceId: input.sourceId,
-    driveId: input.driveId,
-    boundaryId: boundedBoundaryId(input.boundaryId),
-    pageToken: boundedToken(input.pageToken),
-    cursorGeneration: input.previousGeneration + 1,
-    lastFullReconciliationAt: input.reconciledAt.toISOString(),
-    nextFullReconciliationAt: new Date(
-      input.reconciledAt.getTime() + input.fullReconciliationIntervalMs
-    ).toISOString()
-  };
-}
-function advanceGoogleDriveChangesCursor(cursor, pageToken) {
-  return {
-    ...cursor,
-    pageToken: boundedToken(pageToken),
-    cursorGeneration: cursor.cursorGeneration + 1
-  };
-}
-function googleDriveFullReconciliationDue(cursor, now) {
-  return Date.parse(cursor.nextFullReconciliationAt) <= now.getTime();
-}
-async function resolveGoogleDriveChangesBoundaryId(input) {
-  if (input.source.id !== "root" || input.source.driveId !== null) {
-    return boundedBoundaryId(input.source.id);
-  }
-  const root = await input.getFile("root");
-  if (!root || root.mimeType !== GOOGLE_DRIVE_FOLDER_MIME_TYPE || root.trashed) {
-    throw new GoogleDriveChangesProtocolError("google_drive_root_boundary_invalid");
-  }
-  return boundedBoundaryId(root.id);
-}
-function parseGoogleDriveChangesCheckpoint(value, limits) {
-  try {
-    return validatedCheckpoint(value, limits);
-  } catch {
-    return null;
-  }
-}
-async function drainGoogleDriveChanges(input) {
-  const now = input.now ?? Date.now;
-  const startedAt = now();
-  const checkpoint = input.checkpoint ? validatedCheckpoint(input.checkpoint, input) : null;
-  let pageToken = boundedToken(checkpoint?.pageToken ?? input.cursor.pageToken);
-  let requiresFullReconciliation = checkpoint?.requiresFullReconciliation ?? false;
-  const seenPageTokenHashes = new Set(checkpoint?.seenPageTokenHashes ?? []);
-  const initialBudget = checkpoint?.budget ?? emptyBudget();
-  const budget = { ...initialBudget };
-  const entries = /* @__PURE__ */ new Map();
-  while (true) {
-    const invocationElapsedMs = Math.max(0, now() - startedAt);
-    budget.elapsedMs = initialBudget.elapsedMs + invocationElapsedMs;
-    const stopReason = limitReason(budget, input, invocationElapsedMs);
-    if (stopReason) {
-      return {
-        status: "paused",
-        stopReason,
-        entries: [...entries.values()],
-        checkpoint: {
-          version: 2,
-          pageToken,
-          requiresFullReconciliation,
-          seenPageTokenHashes: [...seenPageTokenHashes],
-          budget: { ...budget }
-        },
-        newStartPageToken: null,
-        requiresFullReconciliation,
-        providerRequests: budget.providerRequests,
-        elapsedMs: budget.elapsedMs,
-        budget: { ...budget },
-        hardLimitReached: stopReason !== "elapsed_time_limit" || budget.elapsedMs >= input.maxElapsedMs
-      };
-    }
-    const pageTokenHash = createHash("sha256").update(pageToken).digest("hex");
-    if (seenPageTokenHashes.has(pageTokenHash)) {
-      throw new GoogleDriveChangesProtocolError("google_drive_changes_page_token_cycle");
-    }
-    seenPageTokenHashes.add(pageTokenHash);
-    budget.providerRequests += 1;
-    const pageSize = Math.min(100, input.maxItems - budget.examinedItems);
-    let page;
-    try {
-      page = await input.listChanges(pageToken, pageSize);
-    } catch (error) {
-      budget.elapsedMs = initialBudget.elapsedMs + Math.max(0, now() - startedAt);
-      if (error instanceof GoogleDriveCursorInvalidError) error.budget = { ...budget };
-      throw error;
-    }
-    if (page.changes.length > pageSize) {
-      throw new GoogleDriveChangesProtocolError("google_drive_changes_page_exceeds_item_budget");
-    }
-    budget.examinedItems += page.changes.length;
-    const repairCandidates = /* @__PURE__ */ new Set();
-    for (const change of page.changes) {
-      if (change.removed || !change.file || change.file.trashed) {
-        repairCandidates.add(change.fileId);
-        continue;
-      }
-      const membership = await isInsideSource({
-        file: change.file,
-        boundaryId: input.cursor.boundaryId,
-        getFile: async (fileId) => {
-          const ancestryElapsedMs = Math.max(0, now() - startedAt);
-          budget.elapsedMs = initialBudget.elapsedMs + ancestryElapsedMs;
-          if (budget.providerRequests >= input.maxProviderRequests || budget.elapsedMs >= input.maxElapsedMs || ancestryElapsedMs >= input.maxInvocationElapsedMs) {
-            return null;
-          }
-          budget.providerRequests += 1;
-          const parent = await input.getFile(fileId);
-          budget.elapsedMs = initialBudget.elapsedMs + Math.max(0, now() - startedAt);
-          return parent;
-        }
-      });
-      if (change.file.mimeType === GOOGLE_DRIVE_FOLDER_MIME_TYPE) {
-        entries.delete(change.fileId);
-        if (membership !== "outside") requiresFullReconciliation = true;
-        else repairCandidates.add(change.fileId);
-        continue;
-      }
-      if (membership === "inside") {
-        entries.set(change.fileId, toInventoryEntry(change.file, input.source, input.maxFileBytes));
-      } else if (membership === "unknown") {
-        entries.delete(change.fileId);
-        requiresFullReconciliation = true;
-      } else {
-        repairCandidates.add(change.fileId);
-      }
-    }
-    if (repairCandidates.size > 0) {
-      for (const fileId of repairCandidates) {
-        if (entries.delete(fileId)) requiresFullReconciliation = true;
-      }
-      const observed = await input.observedExternalObjectIds([...repairCandidates]);
-      if (observed.size > 0) requiresFullReconciliation = true;
-    }
-    if (page.nextPageToken) {
-      pageToken = boundedToken(page.nextPageToken);
-      continue;
-    }
-    if (!page.newStartPageToken) {
-      throw new GoogleDriveChangesProtocolError("google_drive_changes_terminal_token_missing");
-    }
-    budget.elapsedMs = initialBudget.elapsedMs + Math.max(0, now() - startedAt);
-    return {
-      status: "complete",
-      stopReason: null,
-      entries: [...entries.values()],
-      checkpoint: null,
-      newStartPageToken: boundedToken(page.newStartPageToken),
-      requiresFullReconciliation,
-      providerRequests: budget.providerRequests,
-      elapsedMs: budget.elapsedMs,
-      budget: { ...budget },
-      hardLimitReached: false
-    };
-  }
-}
-async function isInsideSource(input) {
-  if (input.file.id === input.boundaryId) return "inside";
-  let parents = input.file.parents;
-  const seen = /* @__PURE__ */ new Set([input.file.id]);
-  for (let depth = 0; depth < MAX_ANCESTOR_DEPTH; depth += 1) {
-    if (parents.includes(input.boundaryId)) return "inside";
-    const next = parents.find((parent2) => !seen.has(parent2));
-    if (!next) return "outside";
-    seen.add(next);
-    const parent = await input.getFile(next);
-    if (!parent) return "unknown";
-    parents = parent.parents;
-  }
-  return "unknown";
-}
-function toInventoryEntry(file, source, maxFileBytes) {
-  return {
-    externalObjectId: file.id,
-    externalVersionId: file.version ?? file.modifiedTime ?? file.md5Checksum,
-    sourceId: source.id,
-    parentFolderId: file.parents[0] ?? source.id,
-    driveId: file.driveId ?? source.driveId,
-    title: file.name,
-    mimeType: file.mimeType,
-    modifiedTime: file.modifiedTime,
-    createdTime: file.createdTime,
-    sourceUri: file.webViewLink ?? `https://drive.google.com/open?id=${encodeURIComponent(file.id)}`,
-    transfer: planGoogleDriveTransfer(file, maxFileBytes)
-  };
-}
-function validatedCheckpoint(value, limits) {
-  if (!value || typeof value !== "object") {
-    throw new Error("google_drive_changes_checkpoint_invalid");
-  }
-  const checkpoint = value;
-  const budget = checkpoint.budget;
-  if (checkpoint.version !== 2 || typeof checkpoint.requiresFullReconciliation !== "boolean" || !Array.isArray(checkpoint.seenPageTokenHashes) || checkpoint.seenPageTokenHashes.some((hash) => !/^[a-f0-9]{64}$/.test(hash)) || new Set(checkpoint.seenPageTokenHashes).size !== checkpoint.seenPageTokenHashes.length || checkpoint.seenPageTokenHashes.length > limits.maxProviderRequests || !budget || typeof budget !== "object") {
-    throw new Error("google_drive_changes_checkpoint_invalid");
-  }
-  if (typeof checkpoint.pageToken !== "string") {
-    throw new Error("google_drive_changes_checkpoint_invalid");
-  }
-  boundedToken(checkpoint.pageToken);
-  const budgetRow = budget;
-  for (const [key, maximum] of [
-    ["examinedItems", limits.maxItems],
-    ["providerRequests", limits.maxProviderRequests],
-    ["elapsedMs", limits.maxElapsedMs]
-  ]) {
-    const budgetValue = budgetRow[key];
-    if (!Number.isSafeInteger(budgetValue) || Number(budgetValue) < 0 || Number(budgetValue) > maximum) {
-      throw new Error("google_drive_changes_checkpoint_budget_invalid");
-    }
-  }
-  if (checkpoint.seenPageTokenHashes.length > Number(budgetRow.providerRequests)) {
-    throw new Error("google_drive_changes_checkpoint_request_history_invalid");
-  }
-  return value;
-}
-function limitReason(budget, input, invocationElapsedMs) {
-  if (budget.examinedItems >= input.maxItems) return "item_limit";
-  if (budget.providerRequests >= input.maxProviderRequests) return "api_request_limit";
-  if (budget.elapsedMs >= input.maxElapsedMs || invocationElapsedMs >= input.maxInvocationElapsedMs) {
-    return "elapsed_time_limit";
-  }
-  return null;
-}
-function emptyBudget() {
-  return { examinedItems: 0, providerRequests: 0, elapsedMs: 0 };
-}
-function boundedToken(value) {
-  if (value.length < 1 || value.length > MAX_TOKEN_CHARS) {
-    throw new Error("google_drive_changes_token_invalid");
-  }
-  return value;
-}
-function boundedBoundaryId(value) {
-  if (value.length < 1 || value.length > MAX_BOUNDARY_ID_CHARS) {
-    throw new Error("google_drive_changes_boundary_invalid");
-  }
-  return value;
-}
-var GoogleDriveCursorInvalidError = class extends Error {
-  budget = null;
-  constructor() {
-    super("google_drive_changes_cursor_invalid");
-    this.name = "GoogleDriveCursorInvalidError";
-  }
-};
-var GoogleDriveChangesProtocolError = class extends Error {
-  constructor(message) {
-    super(message);
-    this.name = "GoogleDriveChangesProtocolError";
-  }
-};
-
-// src/activities/knowledge-source-sync.ts
-var DRIVE_API_BASE = "https://www.googleapis.com/drive/v3";
-var DRIVE_JSON_MAX_BYTES = 2 * 1024 * 1024;
-var GOOGLE_DRIVE_FULL_RECONCILIATION_INTERVAL_MS = 24 * 60 * 60 * 1e3;
-var GOOGLE_DRIVE_SYNC_INVOCATION_SLICE_MS = 3e4;
-var GOOGLE_DRIVE_EXECUTION_CHECKPOINT_MAX_BYTES = 2 * 1024 * 1024;
-var GOOGLE_DRIVE_ACL_FRESHNESS_MS = 26 * 60 * 60 * 1e3;
-var GOOGLE_DRIVE_ACL_MAX_PRINCIPALS = 1e3;
-var ATLASSIAN_API_BASE = "https://api.atlassian.com";
-var ATLASSIAN_JSON_MAX_BYTES = 4 * 1024 * 1024;
-function knowledgeSyncObservationPolicy(kind) {
-  return kind === "google_drive" ? { revisionOrdering: "canonical_decimal", filterWithDriveDurability: true } : { revisionOrdering: "first_observation", filterWithDriveDurability: false };
-}
-function createKnowledgeSourceSyncActivities(services, resolveDocumentServices) {
-  const documentActivities = createDocumentActivities(services, resolveDocumentServices);
-  return {
-    runKnowledgeSourceSyncBatch: async (input) => {
-      const { settings, db, objectStorage, observability } = await services();
-      if (!objectStorage) throw new Error("object storage is not configured");
-      const task = await getScheduledTask(db, input.workspaceId, input.taskId);
-      if (!task || task.accountId !== input.accountId || task.action.kind !== "knowledge_source_sync" || task.action.sourceId !== input.sourceId || task.status !== "active") {
-        return await failWithoutProvider("schedule_inactive_or_changed");
-      }
-      const action = task.action;
-      const providerLabel = action.connection.providerDomain === ATLASSIAN_PROVIDER_DOMAIN ? "atlassian" : "google_drive";
-      if (action.controlWorkspaceId !== input.workspaceId || action.sourceConfigGeneration <= 0 || !action.providerCoordinationKey) {
-        return await failWithoutProvider("authority_changed");
-      }
-      const lease = await claimKnowledgeSourceSyncLease(db, {
-        ...input,
-        overlapPolicy: input.overlapPolicy
-      });
-      if (lease.action !== "claimed") {
-        observability.incrementCounter({
-          name: "opengeni_knowledge_source_sync_runs_total",
-          labels: { provider: providerLabel, outcome: lease.action }
-        });
-        return { action: lease.action };
-      }
-      let knowledgeRunId = null;
-      let activeSourceSyncGeneration = null;
-      const startedAt = Date.now();
-      const summary = {
-        phase: "queued",
-        scanned: 0,
-        imported: 0,
-        unchanged: 0,
-        skipped: 0,
-        failed: 0,
-        bytes: 0,
-        providerRequests: 0,
-        elapsedMs: 0,
-        indexed: 0,
-        aclPending: 0,
-        retryable: false,
-        limitReached: null,
-        checkpointed: false,
-        reconnectRequired: false,
-        failures: []
-      };
-      observability.info("Knowledge source sync started", {
-        provider: providerLabel,
-        outcome: "started"
-      });
-      try {
-        summary.phase = "inventory";
-        const resolved = await getKnowledgeSourceForSyncAuthority(db, {
-          accountId: input.accountId,
-          workspaceId: input.workspaceId,
-          sourceId: input.sourceId,
-          initiatingSubjectId: action.initiatingSubjectId
-        });
-        if (!resolved || resolved.source.lifecycleState !== "active") {
-          throw new SyncFailure("authority_changed", false);
-        }
-        if (scopedKnowledgeScopeKey(resolved.source.scope) !== scopedKnowledgeScopeKey(action.destination)) {
-          throw new SyncFailure("authority_changed", false);
-        }
-        const liveState = await reconcileKnowledgeSourceSyncLiveGeneration(db, {
-          accountId: input.accountId,
-          workspaceId: input.workspaceId,
-          sourceId: input.sourceId,
-          scheduledTaskRunId: input.scheduledTaskRunId,
-          initiatingSubjectId: action.initiatingSubjectId,
-          sourceConfigGeneration: action.sourceConfigGeneration,
-          sourceLifecycleGeneration: action.sourceLifecycleGeneration,
-          liveSourceSyncGeneration: resolved.source.syncGeneration
-        });
-        activeSourceSyncGeneration = resolved.source.syncGeneration;
-        const syncOperationId = `scheduled-task-run:${input.scheduledTaskRunId}`;
-        const replayedRun = await getKnowledgeSyncRunForSyncAuthority(db, {
-          accountId: input.accountId,
-          workspaceId: input.workspaceId,
-          sourceId: input.sourceId,
-          operationId: syncOperationId,
-          initiatingSubjectId: action.initiatingSubjectId
-        });
-        if (replayedRun && replayedRun.state !== "started") {
-          const replayedSummary = KnowledgeSourceSyncRunSummary.parse(replayedRun.metadata);
-          const settlementInput = {
-            accountId: input.accountId,
-            workspaceId: input.workspaceId,
-            sourceId: input.sourceId,
-            scheduledTaskRunId: input.scheduledTaskRunId,
-            knowledgeSyncRunId: replayedRun.id,
-            status: replayedRun.state === "succeeded" ? "succeeded" : "failed",
-            summary: replayedSummary,
-            error: replayedRun.errorCode,
-            sourceConfigGeneration: action.sourceConfigGeneration,
-            sourceLifecycleGeneration: action.sourceLifecycleGeneration,
-            sourceSyncGeneration: replayedRun.inputSyncGeneration,
-            completedSourceSyncGeneration: replayedRun.state === "succeeded" ? replayedRun.inputSyncGeneration + 1 : null,
-            ...replayedRun.state === "succeeded" && replayedRun.metadata.providerCursor && typeof replayedRun.metadata.providerCursor === "object" ? {
-              providerCursor: replayedRun.metadata.providerCursor
-            } : {}
-          };
-          const settled2 = replayedRun.state === "failed" && replayedSummary.reconnectRequired ? await deauthorizeAndSettleKnowledgeSourceSyncFailure(db, {
-            deauthorization: {
-              accountId: input.accountId,
-              workspaceId: input.workspaceId,
-              sourceId: input.sourceId,
-              audience: action.destination,
-              operationId: `knowledge-sync-deauthorize:${input.sourceId}:${action.connection.connectionVersion}:${replayedRun.errorCode ?? "connection_reconnect_required"}`,
-              reasonCode: "connection_reconnect_required",
-              actor: {
-                kind: "service",
-                subjectId: "knowledge-source-sync",
-                initiatingHumanSubjectId: action.initiatingSubjectId
-              }
-            },
-            settlement: settlementInput
-          }) : await settleKnowledgeSourceSyncLease(db, settlementInput);
-          await recordConnectorUsage("completed", replayedSummary.scanned, "item");
-          await recordConnectorUsage("items", replayedSummary.imported, "item");
-          await recordConnectorUsage("bytes", replayedSummary.bytes, "byte");
-          return {
-            action: replayedRun.state === "succeeded" ? "complete" : "failed",
-            bufferedWake: settled2.bufferedWake,
-            bufferedScheduledTaskRunId: settled2.bufferedScheduledTaskRunId
-          };
-        }
-        const provider = await resolveKnowledgeSyncProvider({
-          db,
-          settings,
-          observability,
-          accountId: input.accountId,
-          workspaceId: input.workspaceId,
-          action,
-          sourceId: input.sourceId,
-          externalSourceId: resolved.source.externalSourceId
-        });
-        const selectedDestination = provider.selectedDestination;
-        const observationPolicy = knowledgeSyncObservationPolicy(provider.kind);
-        let aclGeneration = resolved.source.currentAclGeneration;
-        let acl = aclGeneration ? await getKnowledgeSourceAclForSyncAuthority(db, {
-          accountId: input.accountId,
-          workspaceId: input.workspaceId,
-          sourceId: input.sourceId,
-          generation: aclGeneration,
-          initiatingSubjectId: action.initiatingSubjectId
-        }) : null;
-        const actor = {
-          kind: "service",
-          subjectId: "knowledge-source-sync",
-          initiatingHumanSubjectId: action.initiatingSubjectId
-        };
-        if (!acl) {
-          acl = await appendKnowledgeSourceAclVersion(db, {
-            accountId: input.accountId,
-            workspaceId: input.workspaceId,
-            sourceId: input.sourceId,
-            audience: action.destination,
-            expectedSourceLifecycleGeneration: resolved.source.lifecycleGeneration,
-            expectedAclGeneration: 0,
-            aclVersion: "opengeni-destination-v1",
-            agentAccess: false,
-            operationId: `source-initial-acl:${input.sourceId}`,
-            reasonCode: "initial_destination_acl",
-            actor
-          });
-          aclGeneration = acl.generation;
-        }
-        const knowledgeRun = replayedRun ?? await beginKnowledgeSyncRun(db, {
-          accountId: input.accountId,
-          workspaceId: input.workspaceId,
-          sourceId: input.sourceId,
-          expectedSourceLifecycleGeneration: resolved.source.lifecycleGeneration,
-          expectedSyncGeneration: resolved.source.syncGeneration,
-          inputCursor: null,
-          operationId: syncOperationId,
-          actor
-        });
-        knowledgeRunId = knowledgeRun.id;
-        const driver = provider.driver;
-        const inventory = await driver.inventory(
-          lease.state.executionCheckpoint,
-          lease.state.providerCursor
-        );
-        summary.providerRequests = inventory.providerRequests;
-        summary.elapsedMs = inventory.elapsedMs;
-        const base = selectedDestination.collectionId ? await getDocumentBase(db, input.workspaceId, selectedDestination.collectionId) : await ensureDefaultBase(db, {
-          accountId: input.accountId,
-          workspaceId: input.workspaceId
-        });
-        if (!base) throw new SyncFailure("authority_changed", false);
-        const durableObservations = await recordKnowledgeSourceSyncObjectObservations(db, {
-          accountId: input.accountId,
-          workspaceId: input.workspaceId,
-          sourceId: input.sourceId,
-          scheduledTaskRunId: input.scheduledTaskRunId,
-          initiatingSubjectId: action.initiatingSubjectId,
-          scanGeneration: liveState.activeScanGeneration,
-          executionCheckpointGeneration: lease.state.executionCheckpointGeneration,
-          revisionOrdering: observationPolicy.revisionOrdering,
-          observations: inventory.entries.map((entry) => ({
-            externalObjectId: entry.externalObjectId,
-            providerRevision: entry.externalVersionId,
-            metadataHash: entryMetadataHash(entry)
-          }))
-        });
-        const entriesToProcess = observationPolicy.filterWithDriveDurability ? inventory.entries.filter(
-          (entry, index) => shouldProcessGoogleDriveDurableObservation({
-            entry,
-            observation: durableObservations[index],
-            sourceLifecycleGeneration: resolved.source.lifecycleGeneration,
-            aclGeneration
-          })
-        ) : inventory.entries;
-        const observationFloorsById = /* @__PURE__ */ new Map();
-        for (const observation of durableObservations) {
-          observationFloorsById.set(observation.externalObjectId, {
-            externalObjectId: observation.externalObjectId,
-            providerRevision: observation.providerRevision,
-            metadataHash: observation.metadataHash
-          });
-        }
-        const observationFloors = [...observationFloorsById.values()];
-        const executionCheckpoint = mergeGoogleDriveDurableObservationFloors(
-          inventory.checkpoint,
-          observationFloors,
-          action.limits.maxItems
-        );
-        const ensureVersionIndexed = async (details) => {
-          if (!details.version.documentId) {
-            throw new SyncFailure("authority_changed", false);
-          }
-          let obligation = details.obligation ?? await getKnowledgeSourceSyncIndexObligationForVersion(db, {
-            accountId: input.accountId,
-            workspaceId: input.workspaceId,
-            knowledgeDocumentVersionId: details.version.id,
-            initiatingSubjectId: action.initiatingSubjectId
-          });
-          if (!obligation) {
-            obligation = await enqueueKnowledgeSourceSyncIndexObligation(db, {
-              accountId: input.accountId,
-              workspaceId: input.workspaceId,
-              scheduledTaskRunId: input.scheduledTaskRunId,
-              sourceId: input.sourceId,
-              sourceSyncGeneration: knowledgeRun.inputSyncGeneration,
-              initiatingSubjectId: action.initiatingSubjectId,
-              externalObjectId: details.entry.externalObjectId,
-              knowledgeSourceObjectId: details.object.id,
-              knowledgeDocumentVersionId: details.version.id,
-              documentId: details.version.documentId,
-              sourceConfigGeneration: action.sourceConfigGeneration,
-              sourceLifecycleGeneration: action.sourceLifecycleGeneration,
-              objectLifecycleGeneration: details.object.lifecycleGeneration,
-              objectVersionGeneration: details.version.versionGeneration,
-              citationLocator: driver.citationLocator(details.entry)
-            });
-          }
-          if (obligation.documentId !== details.version.documentId) {
-            throw new SyncFailure("authority_changed", false);
-          }
-          if (obligation.status === "indexed" && !details.indexRequired) return obligation;
-          if (obligation.status === "indexed" && details.indexRequired) {
-            summary.phase = "index";
-            try {
-              const indexedDocument = await documentActivities.indexDocument({
-                accountId: input.accountId,
-                workspaceId: input.workspaceId,
-                documentId: details.version.documentId,
-                authorityKind: action.destination.kind,
-                authorityWorkspaceId: action.destination.workspaceId,
-                authoritySubjectId: action.destination.subjectId
-              });
-              if (indexedDocument.status !== "ready") {
-                throw new Error("document indexing did not complete");
-              }
-            } catch {
-              throw new SyncFailure("indexing_failed", true);
-            }
-            return obligation;
-          }
-          if (obligation.status === "failed") {
-            const retried = await retryKnowledgeSourceSyncIndexObligation(db, {
-              accountId: input.accountId,
-              workspaceId: input.workspaceId,
-              obligationId: obligation.id,
-              scheduledTaskRunId: input.scheduledTaskRunId
-            });
-            if (retried === "invalidated") {
-              throw new SyncFailure("authority_changed", false);
-            }
-            obligation = { ...obligation, status: retried };
-            if (retried === "indexed") return obligation;
-          }
-          if (obligation.status !== "pending") {
-            throw new SyncFailure("authority_changed", false);
-          }
-          if (details.indexRequired) {
-            summary.phase = "index";
-            try {
-              const indexedDocument = await documentActivities.indexDocument({
-                accountId: input.accountId,
-                workspaceId: input.workspaceId,
-                documentId: details.version.documentId,
-                authorityKind: action.destination.kind,
-                authorityWorkspaceId: action.destination.workspaceId,
-                authoritySubjectId: action.destination.subjectId
-              });
-              if (indexedDocument.status !== "ready") {
-                throw new Error("document indexing did not complete");
-              }
-            } catch {
-              await settleKnowledgeSourceSyncIndexObligation(db, {
-                accountId: input.accountId,
-                workspaceId: input.workspaceId,
-                obligationId: obligation.id,
-                status: "failed",
-                failureCode: "indexing_failed"
-              }).catch(() => void 0);
-              throw new SyncFailure("indexing_failed", true);
-            }
-          }
-          const settlement = await settleKnowledgeSourceSyncIndexObligation(db, {
-            accountId: input.accountId,
-            workspaceId: input.workspaceId,
-            obligationId: obligation.id,
-            status: "indexed"
-          });
-          if (settlement === "invalidated") {
-            throw new SyncFailure("authority_changed", false);
-          }
-          return { ...obligation, status: "indexed" };
-        };
-        const recordEntryAcl = async (details) => {
-          if (!driver.readAcl || !provider.aclAuthority) {
-            return { aclEligibility: "pending", aclEvidence: null };
-          }
-          await beginGoogleDriveObjectAclRefresh(db, {
-            accountId: input.accountId,
-            workspaceId: input.workspaceId,
-            obligationId: details.obligation.id,
-            sourceSyncGeneration: details.obligation.sourceSyncGeneration,
-            sourceConfigGeneration: action.sourceConfigGeneration,
-            sourceLifecycleGeneration: action.sourceLifecycleGeneration,
-            objectLifecycleGeneration: details.object.lifecycleGeneration,
-            objectVersionGeneration: details.version.versionGeneration
-          });
-          const remainingProviderRequests = action.limits.maxProviderRequests - summary.providerRequests;
-          if (remainingProviderRequests < 1) {
-            throw new SyncFailure("resource_limit", false);
-          }
-          const evidence = await driver.readAcl(details.entry, remainingProviderRequests);
-          summary.providerRequests += evidence.providerRequests;
-          if (summary.providerRequests > action.limits.maxProviderRequests) {
-            throw new SyncFailure("resource_limit", false);
-          }
-          const recorded = await recordGoogleDriveObjectAclEvidence(db, {
-            accountId: input.accountId,
-            workspaceId: input.workspaceId,
-            obligationId: details.obligation.id,
-            connectionId: provider.aclAuthority.connectionId,
-            connectionVersion: provider.aclAuthority.connectionVersion,
-            sourceGooglePermissionId: provider.aclAuthority.sourceGooglePermissionId,
-            sourceSyncGeneration: details.obligation.sourceSyncGeneration,
-            sourceConfigGeneration: action.sourceConfigGeneration,
-            sourceLifecycleGeneration: action.sourceLifecycleGeneration,
-            objectLifecycleGeneration: details.object.lifecycleGeneration,
-            objectVersionGeneration: details.version.versionGeneration,
-            providerRevision: evidence.providerRevision,
-            driveId: evidence.driveId,
-            aclRevision: evidence.aclRevision,
-            eligibility: evidence.eligibility,
-            observedAt: evidence.observedAt,
-            expiresAt: evidence.expiresAt,
-            citationLocator: driver.citationLocator(details.entry),
-            operationId: `drive-acl:${details.obligation.id}:${evidence.aclRevision}`,
-            principals: evidence.principals
-          });
-          return {
-            aclEligibility: evidence.eligibility,
-            aclEvidence: {
-              version: 1,
-              provider: "google_drive",
-              evidenceId: recorded.evidenceId,
-              aclRevision: evidence.aclRevision,
-              aclHash: recorded.aclHash,
-              observedAt: evidence.observedAt,
-              expiresAt: evidence.expiresAt
-            }
-          };
-        };
-        const outcomes = [];
-        for (const entry of entriesToProcess) {
-          heartbeat({ sourceId: input.sourceId, externalObjectId: entry.externalObjectId });
-          const observationFloor = observationFloorsById.get(entry.externalObjectId);
-          if (!observationFloor) throw new SyncFailure("provider_payload_invalid", false);
-          const syncObservation = {
-            scheduledTaskRunId: input.scheduledTaskRunId,
-            scanGeneration: liveState.activeScanGeneration,
-            providerRevision: observationFloor.providerRevision,
-            metadataHash: observationFloor.metadataHash
-          };
-          summary.scanned += 1;
-          if (entry.transfer.action === "skip") {
-            summary.skipped += 1;
-            outcomes.push({
-              externalObjectId: entry.externalObjectId,
-              outcome: "skipped",
-              reasonCode: entry.transfer.reason
-            });
-            continue;
-          }
-          if (entry.transfer.action === "traverse") continue;
-          try {
-            const existingObject = await getKnowledgeSourceObjectForSyncAuthority(db, {
-              accountId: input.accountId,
-              workspaceId: input.workspaceId,
-              sourceId: input.sourceId,
-              externalObjectId: entry.externalObjectId,
-              initiatingSubjectId: action.initiatingSubjectId
-            });
-            let object = existingObject ?? await upsertKnowledgeSourceObject(db, {
-              accountId: input.accountId,
-              workspaceId: input.workspaceId,
-              sourceId: input.sourceId,
-              externalObjectId: entry.externalObjectId,
-              operationId: `source-object:${input.sourceId}:${entry.externalObjectId}`,
-              actor
-            });
-            if (object.lifecycleState !== "active") {
-              const restored = await restoreKnowledgeSourceObject(db, {
-                accountId: input.accountId,
-                workspaceId: input.workspaceId,
-                targetId: object.id,
-                expectedGeneration: object.lifecycleGeneration,
-                operationId: `knowledge-sync-object-restore:${object.id}:${liveState.activeScanGeneration}`,
-                reasonCode: "authoritative_scan_observed",
-                actor
-              });
-              object = {
-                ...object,
-                lifecycleState: "active",
-                lifecycleGeneration: restored.lifecycleGeneration
-              };
-            }
-            const currentObservation = object.currentVersionId ? await getKnowledgeDocumentVersionObservationForSyncAuthority(db, {
-              accountId: input.accountId,
-              workspaceId: input.workspaceId,
-              versionId: object.currentVersionId,
-              initiatingSubjectId: action.initiatingSubjectId
-            }) : null;
-            const currentVersion = currentObservation?.version ?? null;
-            const metadataHash = entryMetadataHash(entry);
-            const observedProviderRevision = typeof currentObservation?.sourceMetadata.providerRevision === "string" ? currentObservation.sourceMetadata.providerRevision : null;
-            const observedMetadataHash = typeof currentObservation?.sourceMetadata.metadataHash === "string" ? currentObservation.sourceMetadata.metadataHash : null;
-            const observedSourceLifecycleGeneration = Number(
-              currentObservation?.sourceMetadata.sourceLifecycleGeneration ?? 0
-            );
-            const observedObjectLifecycleGeneration = Number(
-              currentObservation?.sourceMetadata.objectLifecycleGeneration ?? 0
-            );
-            const currentObligation = currentVersion ? await getKnowledgeSourceSyncIndexObligationForVersion(db, {
-              accountId: input.accountId,
-              workspaceId: input.workspaceId,
-              knowledgeDocumentVersionId: currentVersion.id,
-              initiatingSubjectId: action.initiatingSubjectId
-            }) : null;
-            if (currentVersion && currentVersion.documentId && observedProviderRevision === entry.externalVersionId && observedMetadataHash === metadataHash && currentVersion.aclGeneration === aclGeneration && observedSourceLifecycleGeneration === resolved.source.lifecycleGeneration && observedObjectLifecycleGeneration === object.lifecycleGeneration && currentObligation?.status !== "invalidated") {
-              await updateKnowledgeSourceDocumentObservationMetadata(db, {
-                accountId: input.accountId,
-                workspaceId: input.workspaceId,
-                initiatingSubjectId: action.initiatingSubjectId,
-                sourceId: input.sourceId,
-                expectedSourceLifecycleGeneration: resolved.source.lifecycleGeneration,
-                objectId: object.id,
-                expectedObjectLifecycleGeneration: object.lifecycleGeneration,
-                versionId: currentVersion.id,
-                documentId: currentVersion.documentId,
-                title: entry.title,
-                sourceUri: entry.sourceUri,
-                sourceVersion: entry.externalVersionId ?? currentVersion.contentSha256,
-                sourceUpdatedAt: entry.modifiedTime,
-                syncObservation
-              });
-              const obligation2 = await ensureVersionIndexed({
-                entry,
-                object,
-                version: currentVersion,
-                indexRequired: (currentObservation?.documentChunkCount ?? 0) === 0,
-                obligation: currentObligation
-              });
-              const objectAcl2 = await recordEntryAcl({
-                entry,
-                object,
-                version: currentVersion,
-                obligation: obligation2
-              });
-              summary.unchanged += 1;
-              outcomes.push({
-                externalObjectId: entry.externalObjectId,
-                outcome: "unchanged",
-                contentSha256: currentVersion.contentSha256,
-                providerRevision: entry.externalVersionId,
-                metadataHash,
-                aclEligibility: objectAcl2.aclEligibility,
-                aclEvidence: objectAcl2.aclEvidence,
-                indexObligationId: obligation2.id
-              });
-              continue;
-            }
-            summary.phase = "transfer";
-            const bytes = await driver.fetchContent(entry, action.limits.maxFileBytes);
-            const contentSha256 = createHash2("sha256").update(bytes).digest("hex");
-            const observationKey = createHash2("sha256").update(
-              JSON.stringify({
-                externalObjectId: entry.externalObjectId,
-                providerRevision: entry.externalVersionId,
-                metadataHash,
-                contentSha256,
-                aclGeneration,
-                sourceLifecycleGeneration: resolved.source.lifecycleGeneration,
-                objectLifecycleGeneration: object.lifecycleGeneration
-              })
-            ).digest("hex");
-            if (currentVersion?.contentSha256 === contentSha256 && currentVersion.documentId && currentVersion.fileId) {
-              const version2 = await appendKnowledgeDocumentVersion(db, {
-                accountId: input.accountId,
-                workspaceId: input.workspaceId,
-                objectId: object.id,
-                expectedSourceLifecycleGeneration: resolved.source.lifecycleGeneration,
-                expectedObjectLifecycleGeneration: object.lifecycleGeneration,
-                expectedVersionGeneration: object.versionGeneration,
-                externalVersionId: entry.externalVersionId ?? contentSha256,
-                contentSha256,
-                ingestionKey: `${entry.externalObjectId}:${observationKey}`,
-                sourceCursor: null,
-                sourceMetadata: {
-                  title: entry.title,
-                  mimeType: entry.mimeType,
-                  driveId: entry.driveId,
-                  providerRevision: entry.externalVersionId,
-                  metadataHash,
-                  aclEligibility: "pending",
-                  sourceLifecycleGeneration: resolved.source.lifecycleGeneration,
-                  objectLifecycleGeneration: object.lifecycleGeneration
-                },
-                sourceCreatedAt: entry.createdTime,
-                sourceUpdatedAt: entry.modifiedTime,
-                aclVersionId: acl.id,
-                aclGeneration,
-                documentId: currentVersion.documentId,
-                fileId: currentVersion.fileId,
-                locationMetadata: { sourceUri: entry.sourceUri },
-                documentObservationMetadata: {
-                  title: entry.title,
-                  sourceUri: entry.sourceUri,
-                  sourceVersion: entry.externalVersionId ?? contentSha256,
-                  sourceUpdatedAt: entry.modifiedTime
-                },
-                syncObservation,
-                operationId: `document-observation:${object.id}:${observationKey}`,
-                reasonCode: "source_metadata_observed",
-                actor
-              });
-              await updateKnowledgeSourceDocumentObservationMetadata(db, {
-                accountId: input.accountId,
-                workspaceId: input.workspaceId,
-                initiatingSubjectId: action.initiatingSubjectId,
-                sourceId: input.sourceId,
-                expectedSourceLifecycleGeneration: resolved.source.lifecycleGeneration,
-                objectId: object.id,
-                expectedObjectLifecycleGeneration: object.lifecycleGeneration,
-                versionId: version2.id,
-                documentId: currentVersion.documentId,
-                title: entry.title,
-                sourceUri: entry.sourceUri,
-                sourceVersion: entry.externalVersionId ?? contentSha256,
-                sourceUpdatedAt: entry.modifiedTime,
-                syncObservation
-              });
-              const obligation2 = await ensureVersionIndexed({
-                entry,
-                object,
-                version: version2,
-                indexRequired: (currentObservation?.documentChunkCount ?? 0) === 0
-              });
-              const objectAcl2 = await recordEntryAcl({ entry, object, version: version2, obligation: obligation2 });
-              summary.unchanged += 1;
-              summary.indexed += 1;
-              if (objectAcl2.aclEligibility === "pending") summary.aclPending += 1;
-              outcomes.push({
-                externalObjectId: entry.externalObjectId,
-                outcome: "unchanged",
-                contentSha256,
-                sizeBytes: bytes.byteLength,
-                providerRevision: entry.externalVersionId,
-                metadataHash,
-                aclEligibility: objectAcl2.aclEligibility,
-                aclEvidence: objectAcl2.aclEvidence,
-                indexObligationId: obligation2.id
-              });
-              continue;
-            }
-            const fileId = deterministicUuid(
-              `knowledge-blob:${input.accountId}:${input.workspaceId}:${contentSha256}`
-            );
-            const objectKey = `workspaces/${input.workspaceId}/knowledge/blobs/${contentSha256}`;
-            await objectStorage.putObject({
-              key: objectKey,
-              contentType: entry.transfer.contentType,
-              body: bytes,
-              sha256: contentSha256
-            });
-            const file = await ensureKnowledgeSourceBlobFile(db, {
-              accountId: input.accountId,
-              workspaceId: input.workspaceId,
-              fileId,
-              filename: entry.transfer.filename,
-              safeFilename: safeFilename(entry.transfer.filename),
-              contentType: entry.transfer.contentType,
-              sizeBytes: bytes.byteLength,
-              sha256: contentSha256,
-              bucket: objectStorage.bucket,
-              objectKey
-            });
-            const document = await addDocumentToBase(db, {
-              accountId: input.accountId,
-              workspaceId: input.workspaceId,
-              baseId: base.id,
-              fileId: file.id,
-              title: entry.title,
-              sourceKind: "document",
-              sourceUri: entry.sourceUri,
-              sourceExternalId: entry.externalObjectId,
-              sourceTitle: entry.title,
-              sourceCreatedAt: entry.createdTime ?? void 0,
-              sourceUpdatedAt: entry.modifiedTime ?? void 0,
-              sourceVersion: entry.externalVersionId ?? contentSha256,
-              knowledgeSourceIdentity: deterministicUuid(
-                `knowledge-source-version:${object.id}:${observationKey}`
-              ),
-              authorityKind: action.destination.kind,
-              createdBy: action.initiatingSubjectId,
-              initiatingSubjectId: action.initiatingSubjectId,
-              organizationAuthorityGranted: action.destination.kind === "organization",
-              agentAccess: false,
-              curationStatus: "none",
-              access: { viewerSubjectId: action.initiatingSubjectId }
-            });
-            const version = await appendKnowledgeDocumentVersion(db, {
-              accountId: input.accountId,
-              workspaceId: input.workspaceId,
-              objectId: object.id,
-              expectedSourceLifecycleGeneration: resolved.source.lifecycleGeneration,
-              expectedObjectLifecycleGeneration: object.lifecycleGeneration,
-              expectedVersionGeneration: object.versionGeneration,
-              externalVersionId: entry.externalVersionId ?? contentSha256,
-              contentSha256,
-              ingestionKey: `${entry.externalObjectId}:${observationKey}`,
-              sourceCursor: null,
-              sourceMetadata: {
-                title: entry.title,
-                mimeType: entry.mimeType,
-                driveId: entry.driveId,
-                providerRevision: entry.externalVersionId,
-                metadataHash,
-                aclEligibility: "pending",
-                sourceLifecycleGeneration: resolved.source.lifecycleGeneration,
-                objectLifecycleGeneration: object.lifecycleGeneration
-              },
-              sourceCreatedAt: entry.createdTime,
-              sourceUpdatedAt: entry.modifiedTime,
-              aclVersionId: acl.id,
-              aclGeneration,
-              documentId: document.id,
-              fileId: file.id,
-              locationMetadata: { sourceUri: entry.sourceUri },
-              syncObservation,
-              operationId: `document-version:${object.id}:${observationKey}`,
-              reasonCode: "source_content_observed",
-              actor
-            });
-            const obligation = await ensureVersionIndexed({
-              entry,
-              object,
-              version,
-              indexRequired: true
-            });
-            const objectAcl = await recordEntryAcl({ entry, object, version, obligation });
-            summary.indexed += 1;
-            summary.imported += 1;
-            if (objectAcl.aclEligibility === "pending") summary.aclPending += 1;
-            summary.bytes += bytes.byteLength;
-            outcomes.push({
-              externalObjectId: entry.externalObjectId,
-              outcome: "imported",
-              contentSha256,
-              sizeBytes: bytes.byteLength,
-              providerRevision: entry.externalVersionId,
-              metadataHash,
-              aclEligibility: objectAcl.aclEligibility,
-              aclEvidence: objectAcl.aclEvidence,
-              indexObligationId: obligation.id
-            });
-          } catch (error) {
-            if (error instanceof KnowledgeSourceSyncObservationFenceError) {
-              throw new SyncFailure("provider_payload_invalid", false);
-            }
-            const message = boundedError(error);
-            const itemFailure = error instanceof SyncFailure ? error : new SyncFailure("item_processing_failed", false);
-            summary.failed += 1;
-            summary.retryable ||= itemFailure.retryable;
-            if (summary.failures.length < action.limits.maxFailureDetails) {
-              summary.failures.push({
-                externalObjectId: entry.externalObjectId,
-                code: itemFailure.code,
-                retryable: itemFailure.retryable,
-                message
-              });
-            }
-            outcomes.push({
-              externalObjectId: entry.externalObjectId,
-              outcome: "failed",
-              reasonCode: itemFailure.code,
-              detail: message,
-              providerRevision: entry.externalVersionId,
-              metadataHash: entryMetadataHash(entry),
-              aclEligibility: "pending"
-            });
-          }
-        }
-        await recordKnowledgeSourceSyncItemOutcomes(db, {
-          accountId: input.accountId,
-          workspaceId: input.workspaceId,
-          scheduledTaskRunId: input.scheduledTaskRunId,
-          knowledgeSyncRunId: knowledgeRun.id,
-          sourceId: input.sourceId,
-          sourceConfigGeneration: action.sourceConfigGeneration,
-          sourceLifecycleGeneration: action.sourceLifecycleGeneration,
-          outcomes
-        });
-        if (inventory.status === "paused" && inventory.checkpoint) {
-          if (inventory.stopReason === "provider_error" || inventory.stopReason === "incomplete_search") {
-            throw new SyncFailure(
-              inventory.stopReason === "provider_error" ? "provider_unavailable" : "provider_payload_invalid",
-              inventory.stopReason === "provider_error"
-            );
-          }
-          if (inventory.hardLimitReached) {
-            summary.limitReached = inventoryLimit(inventory.stopReason);
-            throw new SyncFailure("resource_limit", false);
-          }
-          if (inventory.stopReason !== "elapsed_time_limit") {
-            summary.limitReached = inventoryLimit(inventory.stopReason);
-            throw new SyncFailure("resource_limit", false);
-          }
-          summary.checkpointed = true;
-          summary.phase = "checkpoint";
-          await checkpointKnowledgeSourceSync(db, {
-            accountId: input.accountId,
-            workspaceId: input.workspaceId,
-            sourceId: input.sourceId,
-            scheduledTaskRunId: input.scheduledTaskRunId,
-            sourceConfigGeneration: action.sourceConfigGeneration,
-            sourceLifecycleGeneration: action.sourceLifecycleGeneration,
-            executionCheckpoint,
-            observationFence: {
-              initiatingSubjectId: action.initiatingSubjectId,
-              scanGeneration: liveState.activeScanGeneration,
-              executionCheckpointGeneration: lease.state.executionCheckpointGeneration,
-              observations: observationFloors
-            }
-          });
-          return { action: "continue" };
-        }
-        const tombstonedExternalObjectIds = inventory.authoritativeFullScan ? await reconcileKnowledgeSourceSyncCompleteScan(db, {
-          accountId: input.accountId,
-          workspaceId: input.workspaceId,
-          sourceId: input.sourceId,
-          scheduledTaskRunId: input.scheduledTaskRunId,
-          initiatingSubjectId: action.initiatingSubjectId,
-          sourceSyncGeneration: knowledgeRun.inputSyncGeneration,
-          sourceConfigGeneration: action.sourceConfigGeneration,
-          sourceLifecycleGeneration: action.sourceLifecycleGeneration,
-          scanGeneration: liveState.activeScanGeneration
-        }) : [];
-        if (tombstonedExternalObjectIds.length > 0) {
-          summary.skipped += tombstonedExternalObjectIds.length;
-          await recordKnowledgeSourceSyncItemOutcomes(db, {
-            accountId: input.accountId,
-            workspaceId: input.workspaceId,
-            scheduledTaskRunId: input.scheduledTaskRunId,
-            knowledgeSyncRunId: knowledgeRun.id,
-            sourceId: input.sourceId,
-            sourceConfigGeneration: action.sourceConfigGeneration,
-            sourceLifecycleGeneration: action.sourceLifecycleGeneration,
-            outcomes: tombstonedExternalObjectIds.map((externalObjectId) => ({
-              externalObjectId,
-              outcome: "tombstoned",
-              reasonCode: "authoritative_scan_absent",
-              aclEligibility: "denied"
-            }))
-          });
-        }
-        await completeKnowledgeSyncRun(db, {
-          accountId: input.accountId,
-          workspaceId: input.workspaceId,
-          initiatingSubjectId: action.initiatingSubjectId,
-          runId: knowledgeRun.id,
-          state: "succeeded",
-          outputCursor: null,
-          watermark: (/* @__PURE__ */ new Date()).toISOString(),
-          metadata: { ...summary, providerCursor: inventory.providerCursor },
-          reasonCode: "scheduled_source_sync"
-        });
-        summary.phase = "completed";
-        summary.elapsedMs = Date.now() - startedAt;
-        const settled = await settleKnowledgeSourceSyncLease(db, {
-          accountId: input.accountId,
-          workspaceId: input.workspaceId,
-          sourceId: input.sourceId,
-          scheduledTaskRunId: input.scheduledTaskRunId,
-          knowledgeSyncRunId: knowledgeRun.id,
-          status: "succeeded",
-          summary,
-          sourceConfigGeneration: action.sourceConfigGeneration,
-          sourceLifecycleGeneration: action.sourceLifecycleGeneration,
-          sourceSyncGeneration: knowledgeRun.inputSyncGeneration,
-          completedSourceSyncGeneration: knowledgeRun.inputSyncGeneration + 1,
-          providerCursor: inventory.providerCursor,
-          observationFence: {
-            initiatingSubjectId: action.initiatingSubjectId,
-            scanGeneration: liveState.activeScanGeneration,
-            executionCheckpointGeneration: lease.state.executionCheckpointGeneration,
-            observations: observationFloors
-          }
-        });
-        await recordConnectorUsage("completed", summary.scanned, "item");
-        await recordConnectorUsage("items", summary.imported, "item");
-        await recordConnectorUsage("bytes", summary.bytes, "byte");
-        observability.incrementCounter({
-          name: "opengeni_knowledge_source_sync_runs_total",
-          labels: { provider: providerLabel, outcome: "succeeded" }
-        });
-        observability.incrementCounter({
-          name: "opengeni_knowledge_source_sync_items_total",
-          labels: { provider: providerLabel, outcome: "imported" },
-          amount: summary.imported
-        });
-        for (const outcome of ["unchanged", "skipped", "failed"]) {
-          observability.incrementCounter({
-            name: "opengeni_knowledge_source_sync_items_total",
-            labels: { provider: providerLabel, outcome },
-            amount: summary[outcome]
-          });
-        }
-        observability.incrementCounter({
-          name: "opengeni_knowledge_source_sync_bytes_total",
-          labels: { provider: providerLabel },
-          amount: summary.bytes
-        });
-        recordSyncHealthTelemetry(observability, providerLabel, summary, "succeeded");
-        return {
-          action: "complete",
-          bufferedWake: settled.bufferedWake,
-          bufferedScheduledTaskRunId: settled.bufferedScheduledTaskRunId
-        };
-      } catch (error) {
-        const failure = error instanceof SyncFailure ? error : new SyncFailure("internal_failure", false);
-        summary.phase = "failed";
-        summary.retryable ||= failure.retryable;
-        summary.elapsedMs = Date.now() - startedAt;
-        summary.reconnectRequired = failure.reconnectRequired;
-        summary.failed = Math.max(summary.failed, 1);
-        if (summary.failures.length === 0) {
-          summary.failures.push({
-            externalObjectId: input.sourceId,
-            code: failure.code,
-            retryable: failure.retryable,
-            message: boundedError(error)
-          });
-        }
-        if (knowledgeRunId) {
-          await completeKnowledgeSyncRun(db, {
-            accountId: input.accountId,
-            workspaceId: input.workspaceId,
-            initiatingSubjectId: task.action.initiatingSubjectId,
-            runId: knowledgeRunId,
-            state: "failed",
-            metadata: summary,
-            errorCode: failure.code,
-            reasonCode: "scheduled_source_sync_failed"
-          }).catch(() => void 0);
-        }
-        const settlementInput = {
-          accountId: input.accountId,
-          workspaceId: input.workspaceId,
-          sourceId: input.sourceId,
-          scheduledTaskRunId: input.scheduledTaskRunId,
-          knowledgeSyncRunId: knowledgeRunId,
-          status: "failed",
-          summary,
-          error: failure.code,
-          sourceConfigGeneration: action.sourceConfigGeneration,
-          sourceLifecycleGeneration: action.sourceLifecycleGeneration,
-          sourceSyncGeneration: activeSourceSyncGeneration ?? lease.state.sourceSyncGeneration,
-          // Failed or incomplete provider walks are not authoritative scans.
-          // A later scheduled run must restart from the root under a fresh
-          // observation generation before it can infer object absence.
-          executionCheckpoint: null
-        };
-        const settled = failure.reconnectRequired ? await deauthorizeAndSettleKnowledgeSourceSyncFailure(db, {
-          deauthorization: {
-            accountId: input.accountId,
-            workspaceId: input.workspaceId,
-            sourceId: input.sourceId,
-            audience: action.destination,
-            operationId: `knowledge-sync-deauthorize:${input.sourceId}:${action.connection.connectionVersion}:${failure.code}`,
-            reasonCode: "connection_reconnect_required",
-            actor: {
-              kind: "service",
-              subjectId: "knowledge-source-sync",
-              initiatingHumanSubjectId: action.initiatingSubjectId
-            }
-          },
-          settlement: settlementInput
-        }) : await settleKnowledgeSourceSyncLease(db, settlementInput);
-        await recordConnectorUsage("completed", summary.scanned, "item");
-        await recordConnectorUsage("items", summary.imported, "item");
-        await recordConnectorUsage("bytes", summary.bytes, "byte");
-        observability.incrementCounter({
-          name: "opengeni_knowledge_source_sync_runs_total",
-          labels: { provider: providerLabel, outcome: "failed" }
-        });
-        for (const outcome of ["imported", "unchanged", "skipped", "failed"]) {
-          observability.incrementCounter({
-            name: "opengeni_knowledge_source_sync_items_total",
-            labels: { provider: providerLabel, outcome },
-            amount: summary[outcome]
-          });
-        }
-        observability.incrementCounter({
-          name: "opengeni_knowledge_source_sync_bytes_total",
-          labels: { provider: providerLabel },
-          amount: summary.bytes
-        });
-        recordSyncHealthTelemetry(observability, providerLabel, summary, "failed", failure);
-        return {
-          action: "failed",
-          bufferedWake: settled.bufferedWake,
-          bufferedScheduledTaskRunId: settled.bufferedScheduledTaskRunId
-        };
-      }
-      async function failWithoutProvider(code) {
-        const terminalSummary = {
-          phase: "failed",
-          scanned: 0,
-          imported: 0,
-          unchanged: 0,
-          skipped: 0,
-          failed: 1,
-          bytes: 0,
-          providerRequests: 0,
-          elapsedMs: 0,
-          indexed: 0,
-          aclPending: 0,
-          retryable: false,
-          limitReached: null,
-          checkpointed: false,
-          reconnectRequired: false,
-          failures: [
-            {
-              externalObjectId: input.sourceId,
-              code: "authority_changed",
-              retryable: false,
-              message: code
-            }
-          ]
-        };
-        await updateScheduledTaskRun(db, input.workspaceId, input.scheduledTaskRunId, {
-          status: "failed",
-          actionKind: "knowledge_source_sync",
-          knowledgeSummary: terminalSummary,
-          completedAt: /* @__PURE__ */ new Date(),
-          error: code
-        }).catch(() => void 0);
-        await completeKnowledgeSourceSyncWakeWithoutLease(db, {
-          accountId: input.accountId,
-          workspaceId: input.workspaceId,
-          sourceId: input.sourceId,
-          scheduledTaskRunId: input.scheduledTaskRunId
-        }).catch(() => void 0);
-        await recordConnectorUsage("completed", 0, "item").catch(() => void 0);
-        observability.incrementCounter({
-          name: "opengeni_knowledge_source_sync_runs_total",
-          labels: { provider: "unknown", outcome: "failed_preflight" }
-        });
-        return { action: "failed", bufferedWake: false };
-      }
-      async function recordConnectorUsage(kind, quantity, unit) {
-        if (quantity === 0 && kind !== "completed") return;
-        await recordUsageEvent2(db, {
-          accountId: input.accountId,
-          workspaceId: input.workspaceId,
-          eventType: `knowledge_source_sync.${kind}`,
-          quantity: kind === "completed" ? 1 : quantity,
-          unit,
-          sourceResourceType: "scheduled_task_run",
-          sourceResourceId: input.scheduledTaskRunId,
-          initiator: { kind: "service", subjectId: "knowledge-source-sync" },
-          initiatorContext: {
-            scheduledTaskId: input.taskId,
-            scheduledTaskRunId: input.scheduledTaskRunId
-          },
-          origin: "scheduled_task",
-          idempotencyKey: `usage:knowledge_source_sync.${kind}:${input.scheduledTaskRunId}`
-        });
-      }
-    }
-  };
-}
-async function deauthorizeAndSettleKnowledgeSourceSyncFailure(db, input) {
-  try {
-    await deauthorizeKnowledgeSourceRetrieval(db, input.deauthorization);
-  } catch (error) {
-    await releaseKnowledgeSourceSyncLeaseForRetry(db, {
-      accountId: input.settlement.accountId,
-      workspaceId: input.settlement.workspaceId,
-      sourceId: input.settlement.sourceId,
-      scheduledTaskRunId: input.settlement.scheduledTaskRunId
-    });
-    throw error;
-  }
-  return await settleKnowledgeSourceSyncLease(db, input.settlement);
-}
-async function resolveKnowledgeSyncProvider(input) {
-  const { action } = input;
-  const connection = await getConnectionMetadata(
-    input.db,
-    input.workspaceId,
-    action.connection.connectionId,
-    action.initiatingSubjectId
-  );
-  if (!connection || connection.accountId !== input.accountId || connection.subjectId !== action.connection.ownerSubjectId || connection.providerDomain.toLowerCase() !== action.connection.providerDomain.toLowerCase() || connection.kind !== action.connection.kind || connection.version < action.connection.connectionVersion || connection.status !== "active") {
-    throw new SyncFailure("connection_reconnect_required", true, true);
-  }
-  const googleInitial = connection.providerDomain === GOOGLE_DRIVE_PROVIDER_DOMAIN ? GoogleDriveConnectionMetadata.safeParse(connection.metadata) : null;
-  const atlassianInitial = connection.providerDomain === ATLASSIAN_PROVIDER_DOMAIN ? AtlassianConnectionMetadata.safeParse(connection.metadata) : null;
-  const initialAtlassianMetadata = atlassianInitial?.success ? atlassianInitial.data : null;
-  if (!googleInitial?.success && !initialAtlassianMetadata) {
-    throw new SyncFailure("provider_rejected", false);
-  }
-  if (googleInitial?.success && !googleDriveScopesAllowCapability(connection.grantedScopes, "recursive_source_sync")) {
-    throw new SyncFailure("connection_reconnect_required", true, true);
-  }
-  if (atlassianInitial?.success && !atlassianScopesAllowRead(connection.grantedScopes)) {
-    throw new SyncFailure("connection_reconnect_required", true, true);
-  }
-  const initialLifecycle = googleInitial?.success ? googleInitial.data.lifecycle : initialAtlassianMetadata.lifecycle;
-  if (initialLifecycle?.state && initialLifecycle.state !== "active") {
-    throw new SyncFailure("connection_reconnect_required", true, true);
-  }
-  const initialSource = googleInitial?.success ? selectedDriveSource(googleInitial.data, input.externalSourceId) : selectedAtlassianSource(initialAtlassianMetadata, input.externalSourceId);
-  if (!initialSource || !initialSource.syncEnabled || initialSource.configGeneration !== action.sourceConfigGeneration || !initialSource.destination || scopedKnowledgeScopeKey(
-    googleInitial?.success ? googleDriveKnowledgeScope(initialSource.destination) : atlassianKnowledgeScope(initialSource.destination)
-  ) !== scopedKnowledgeScopeKey(action.destination)) {
-    throw new SyncFailure("authority_changed", false);
-  }
-  const token = await buildConnectionTokenResolver(
-    input.db,
-    input.settings
-  )({
-    workspaceId: input.workspaceId,
-    subjectId: action.initiatingSubjectId,
-    serverId: "knowledge-source-sync",
-    connectionRef: {
-      connectionId: connection.id,
-      providerDomain: connection.providerDomain,
-      kind: connection.kind,
-      subjectScope: "subject"
-    },
-    destinationUrl: connection.providerDomain === ATLASSIAN_PROVIDER_DOMAIN ? ATLASSIAN_API_BASE : "https://www.googleapis.com"
-  });
-  if (token.status !== "ok") {
-    throw new SyncFailure("connection_reconnect_required", true, true);
-  }
-  const resolvedConnection = await getConnectionMetadata(
-    input.db,
-    input.workspaceId,
-    action.connection.connectionId,
-    action.initiatingSubjectId
-  );
-  if (!resolvedConnection || resolvedConnection.accountId !== input.accountId || resolvedConnection.subjectId !== action.connection.ownerSubjectId || resolvedConnection.providerDomain.toLowerCase() !== action.connection.providerDomain.toLowerCase() || resolvedConnection.kind !== action.connection.kind || resolvedConnection.version !== token.connectionVersion || resolvedConnection.status !== "active") {
-    throw new SyncFailure("connection_reconnect_required", true, true);
-  }
-  const authorization = token.headers.Authorization ?? token.headers.authorization;
-  if (resolvedConnection.providerDomain === GOOGLE_DRIVE_PROVIDER_DOMAIN) {
-    const metadata = GoogleDriveConnectionMetadata.parse(resolvedConnection.metadata);
-    if (!googleDriveSyncProviderAccessAllowed({
-      connectionVersion: resolvedConnection.version,
-      resolvedConnectionVersion: token.connectionVersion,
-      connectionStatus: resolvedConnection.status,
-      lifecycleState: metadata.lifecycle?.state,
-      grantedScopes: resolvedConnection.grantedScopes
-    })) {
-      throw new SyncFailure("connection_reconnect_required", true, true);
-    }
-    const source = selectedDriveSource(metadata, input.externalSourceId);
-    if (!validSelectedSource(source, action, googleDriveKnowledgeScope)) {
-      throw new SyncFailure("authority_changed", false);
-    }
-    return {
-      kind: "google_drive",
-      selectedDestination: source.destination,
-      aclAuthority: {
-        connectionId: resolvedConnection.id,
-        connectionVersion: resolvedConnection.version,
-        sourceGooglePermissionId: metadata.googlePermissionId
-      },
-      driver: googleDriveSyncDriver({
-        actionProviderCoordinationKey: action.providerCoordinationKey,
-        metadata,
-        selectedSource: source,
-        accountId: input.accountId,
-        workspaceId: input.workspaceId,
-        initiatingSubjectId: action.initiatingSubjectId,
-        authorization,
-        retry: googleDriveProviderRetryOptions(input.settings),
-        observability: input.observability,
-        limits: action.limits,
-        connectionId: resolvedConnection.id,
-        fullReconciliationIntervalMs: GOOGLE_DRIVE_FULL_RECONCILIATION_INTERVAL_MS,
-        observedExternalObjectIds: async (externalObjectIds) => await listObservedKnowledgeSourceSyncExternalObjectIds(input.db, {
-          accountId: input.accountId,
-          workspaceId: input.workspaceId,
-          sourceId: input.sourceId,
-          externalObjectIds
-        })
-      })
-    };
-  }
-  if (resolvedConnection.providerDomain === ATLASSIAN_PROVIDER_DOMAIN) {
-    const metadata = AtlassianConnectionMetadata.parse(resolvedConnection.metadata);
-    if (metadata.lifecycle?.state !== "active" || !atlassianScopesAllowRead(resolvedConnection.grantedScopes)) {
-      throw new SyncFailure("connection_reconnect_required", true, true);
-    }
-    const source = selectedAtlassianSource(metadata, input.externalSourceId);
-    if (!validSelectedSource(source, action, atlassianKnowledgeScope)) {
-      throw new SyncFailure("authority_changed", false);
-    }
-    return {
-      kind: "atlassian",
-      selectedDestination: source.destination,
-      aclAuthority: null,
-      driver: atlassianSyncDriver({
-        actionProviderCoordinationKey: action.providerCoordinationKey,
-        metadata,
-        selectedSource: source,
-        authorization,
-        limits: action.limits
-      })
-    };
-  }
-  throw new SyncFailure("provider_rejected", false);
-}
-function validSelectedSource(source, action, scope) {
-  return Boolean(
-    source && source.syncEnabled && source.configGeneration === action.sourceConfigGeneration && source.destination && scopedKnowledgeScopeKey(scope(source.destination)) === scopedKnowledgeScopeKey(action.destination)
-  );
-}
-function selectedAtlassianSource(metadata, externalSourceId) {
-  return metadata.selectedSources.find((source) => source.id === externalSourceId) ?? null;
-}
-function atlassianSyncDriver(input) {
-  return {
-    providerKey: "atlassian",
-    providerDomain: ATLASSIAN_PROVIDER_DOMAIN,
-    providerCoordinationKey: input.actionProviderCoordinationKey,
-    inventory: async (checkpoint) => {
-      const inventory = await inventoryAtlassianSource({
-        cloudId: input.selectedSource.cloudId,
-        source: input.selectedSource,
-        limits: {
-          maxItems: input.limits.maxItems,
-          maxApiRequests: input.limits.maxProviderRequests,
-          maxElapsedMs: input.limits.maxElapsedSeconds * 1e3,
-          pageSize: Math.min(input.limits.maxItems, 100)
-        },
-        checkpoint,
-        listPage: async (cursor, pageSize) => await listAtlassianItems(input.selectedSource, cursor, pageSize, input.authorization)
-      });
-      return {
-        ...inventory,
-        providerCursor: null,
-        authoritativeFullScan: inventory.status === "complete",
-        cursorInvalidated: false,
-        hardLimitReached: inventory.status === "paused" && inventory.stopReason !== "elapsed_time_limit" && inventory.stopReason !== "provider_error"
-      };
-    },
-    fetchContent: async (entry, maxBytes) => await fetchAtlassianContent(input.selectedSource, entry, input.authorization, maxBytes),
-    citationLocator: (entry) => ({
-      version: 1,
-      providerKey: "atlassian",
-      providerCoordinationKey: input.actionProviderCoordinationKey,
-      cloudId: input.selectedSource.cloudId,
-      sourceKind: input.selectedSource.kind,
-      externalObjectId: entry.externalObjectId,
-      sourceUri: entry.sourceUri
-    })
-  };
-}
-function googleDriveSyncDriver(input) {
-  const maxElapsedMs = input.limits.maxElapsedSeconds * 1e3;
-  const provider = input.provider ?? {
-    getStartPageToken: async (driveId) => await getDriveStartPageToken(driveId, input.authorization, input.retry, input.observability),
-    listChanges: async (pageToken, driveId, pageSize) => await listDriveChanges(
-      pageToken,
-      driveId,
-      pageSize,
-      input.authorization,
-      input.retry,
-      input.observability
-    ),
-    getFile: async (fileId) => await getDriveFile(fileId, input.authorization, input.retry, input.observability),
-    listChildren: async (request) => await listDriveChildren(request, input.authorization, input.retry, input.observability),
-    listPermissions: async (request) => await listDrivePermissions(request, input.authorization, input.retry, input.observability)
-  };
-  const clock = provider.now ?? Date.now;
-  const budgetLimits = {
-    maxItems: input.limits.maxItems,
-    maxProviderRequests: input.limits.maxProviderRequests,
-    maxElapsedMs
-  };
-  return {
-    providerKey: "google_drive",
-    providerDomain: GOOGLE_DRIVE_PROVIDER_DOMAIN,
-    providerCoordinationKey: input.actionProviderCoordinationKey,
-    inventory: async (executionCheckpoint, providerCursor) => {
-      const expectedCursor = {
-        connectionId: input.connectionId,
-        googlePermissionId: input.metadata.googlePermissionId,
-        sourceId: input.selectedSource.id,
-        driveId: input.selectedSource.driveId
-      };
-      const legacyFullCheckpoint = isLegacyGoogleDriveFullReconciliationCheckpoint(
-        executionCheckpoint,
-        expectedCursor
-      );
-      const cursor = parseGoogleDriveChangesCursor(providerCursor, expectedCursor);
-      const checkpoint = parseGoogleDriveExecutionCheckpoint(
-        executionCheckpoint,
-        expectedCursor,
-        budgetLimits
-      );
-      const now = new Date(clock());
-      const runFullReconciliation = async (full) => {
-        const inventoryItems = full.inventoryCheckpoint?.totals.itemCount ?? 0;
-        const inventoryProviderRequests = full.inventoryCheckpoint?.totals.apiRequestCount ?? 0;
-        const budgetBeforeInvocation = {
-          examinedItems: full.budgetBeforeInventory.examinedItems + inventoryItems,
-          providerRequests: full.budgetBeforeInventory.providerRequests + inventoryProviderRequests,
-          elapsedMs: full.budgetBeforeInventory.elapsedMs + full.inventoryElapsedMs
-        };
-        const hardStopReason = googleDriveHardLimitReason(budgetBeforeInvocation, budgetLimits);
-        const fullCheckpoint = buildGoogleDriveFullReconciliationCheckpoint({
-          ...expectedCursor,
-          ...full
-        });
-        if (hardStopReason) {
-          return {
-            status: "paused",
-            stopReason: hardStopReason,
-            entries: [],
-            checkpoint: fullCheckpoint,
-            providerCursor,
-            authoritativeFullScan: false,
-            cursorInvalidated: full.cursorInvalidated,
-            providerRequests: budgetBeforeInvocation.providerRequests,
-            elapsedMs: budgetBeforeInvocation.elapsedMs,
-            hardLimitReached: true
-          };
-        }
-        const phaseMaxItems = input.limits.maxItems - full.budgetBeforeInventory.examinedItems;
-        const phaseMaxProviderRequests = input.limits.maxProviderRequests - full.budgetBeforeInventory.providerRequests;
-        const remainingElapsedMs = maxElapsedMs - budgetBeforeInvocation.elapsedMs;
-        const inventory = await inventoryGoogleDriveSource({
-          googlePermissionId: input.metadata.googlePermissionId,
-          googleEmail: input.metadata.googleEmail,
-          source: input.selectedSource,
-          accountId: input.accountId,
-          workspaceId: input.workspaceId,
-          connectionSubjectId: input.initiatingSubjectId,
-          limits: {
-            maxItems: phaseMaxItems,
-            maxKnownBytes: input.limits.maxBytes,
-            maxApiRequests: phaseMaxProviderRequests,
-            maxElapsedMs: Math.min(GOOGLE_DRIVE_SYNC_INVOCATION_SLICE_MS, remainingElapsedMs),
-            maxFileBytes: input.limits.maxFileBytes,
-            maxFolders: Math.min(phaseMaxItems * 2, 2e3),
-            pageSize: Math.min(phaseMaxItems, 100)
-          },
-          checkpoint: full.inventoryCheckpoint,
-          listChildren: provider.listChildren,
-          now: clock
-        });
-        const inventoryElapsedMs = full.inventoryElapsedMs + inventory.run.elapsedMs;
-        const budget = {
-          examinedItems: full.budgetBeforeInventory.examinedItems + inventory.totals.itemCount,
-          providerRequests: full.budgetBeforeInventory.providerRequests + inventory.totals.apiRequestCount,
-          elapsedMs: full.budgetBeforeInventory.elapsedMs + inventoryElapsedMs
-        };
-        const reconciled = reconcileGoogleDriveRevisionFloors(
-          inventory.entries,
-          full.revisionFloors,
-          input.limits.maxItems
-        );
-        if (reconciled.conflict) {
-          return {
-            status: "paused",
-            stopReason: "incomplete_search",
-            entries: [],
-            checkpoint: fullCheckpoint,
-            providerCursor,
-            authoritativeFullScan: false,
-            cursorInvalidated: full.cursorInvalidated,
-            providerRequests: budget.providerRequests,
-            elapsedMs: budget.elapsedMs,
-            hardLimitReached: false
-          };
-        }
-        const nextCursor = inventory.status === "complete" ? buildGoogleDriveChangesCursor({
-          ...expectedCursor,
-          boundaryId: full.boundaryId,
-          pageToken: full.startPageToken,
-          previousGeneration: cursor?.cursorGeneration ?? 0,
-          reconciledAt: now,
-          fullReconciliationIntervalMs: input.fullReconciliationIntervalMs
-        }) : providerCursor;
-        return {
-          status: inventory.status,
-          stopReason: inventory.stopReason,
-          entries: reconciled.entries,
-          checkpoint: inventory.status === "paused" && inventory.checkpoint ? buildGoogleDriveFullReconciliationCheckpoint({
-            ...expectedCursor,
-            boundaryId: full.boundaryId,
-            startPageToken: full.startPageToken,
-            cursorInvalidated: full.cursorInvalidated,
-            budgetBeforeInventory: full.budgetBeforeInventory,
-            inventoryElapsedMs,
-            inventoryCheckpoint: inventory.checkpoint,
-            revisionFloors: reconciled.revisionFloors
-          }) : null,
-          providerCursor: nextCursor,
-          authoritativeFullScan: inventory.status === "complete",
-          cursorInvalidated: full.cursorInvalidated,
-          providerRequests: budget.providerRequests,
-          elapsedMs: budget.elapsedMs,
-          hardLimitReached: inventory.status === "paused" && googleDriveInventoryStopIsHard(inventory.stopReason, budget, budgetLimits)
-        };
-      };
-      const acquireFullReconciliation = async (details) => {
-        const acquisitionStartedAt = clock();
-        const initialElapsedMs = details.budget.elapsedMs;
-        const budget = { ...details.budget };
-        const refreshElapsed = () => {
-          budget.elapsedMs = initialElapsedMs + Math.max(0, clock() - acquisitionStartedAt);
-        };
-        const requireProviderCapacity = () => {
-          refreshElapsed();
-          if (googleDriveHardLimitReason(budget, budgetLimits)) {
-            throw new SyncFailure("resource_limit", false);
-          }
-          budget.providerRequests += 1;
-        };
-        requireProviderCapacity();
-        const startPageToken = await provider.getStartPageToken(input.selectedSource.driveId);
-        refreshElapsed();
-        let boundaryId = details.boundaryId;
-        if (!boundaryId) {
-          if (input.selectedSource.id === "root" && input.selectedSource.driveId === null) {
-            requireProviderCapacity();
-            try {
-              boundaryId = await resolveGoogleDriveChangesBoundaryId({
-                source: input.selectedSource,
-                getFile: provider.getFile
-              });
-            } catch (error) {
-              if (error instanceof GoogleDriveChangesProtocolError) {
-                throw new SyncFailure("provider_payload_invalid", false);
-              }
-              throw error;
-            }
-            refreshElapsed();
-          } else {
-            boundaryId = input.selectedSource.id;
-          }
-        }
-        return {
-          boundaryId,
-          startPageToken,
-          cursorInvalidated: details.cursorInvalidated,
-          budgetBeforeInventory: budget,
-          inventoryElapsedMs: 0,
-          inventoryCheckpoint: null,
-          revisionFloors: []
-        };
-      };
-      if (checkpoint?.kind === "google_drive_full_reconciliation") {
-        return await runFullReconciliation(checkpoint);
-      }
-      if (!cursor) {
-        const budget = checkpoint?.kind === "google_drive_changes" ? checkpoint.changesCheckpoint.budget : emptyGoogleDriveSyncBudget();
-        return await runFullReconciliation(
-          await acquireFullReconciliation({
-            budget,
-            boundaryId: null,
-            cursorInvalidated: providerCursor !== null
-          })
-        );
-      }
-      if (!checkpoint && !legacyFullCheckpoint && googleDriveFullReconciliationDue(cursor, now)) {
-        return await runFullReconciliation(
-          await acquireFullReconciliation({
-            budget: emptyGoogleDriveSyncBudget(),
-            boundaryId: cursor.boundaryId,
-            cursorInvalidated: false
-          })
-        );
-      }
-      try {
-        const forceFullReconciliation = legacyFullCheckpoint || googleDriveFullReconciliationDue(cursor, now);
-        const changesCheckpoint = checkpoint?.kind === "google_drive_changes" ? {
-          ...checkpoint.changesCheckpoint,
-          requiresFullReconciliation: checkpoint.changesCheckpoint.requiresFullReconciliation || forceFullReconciliation
-        } : null;
-        const changes = await drainGoogleDriveChanges({
-          source: input.selectedSource,
-          cursor,
-          checkpoint: changesCheckpoint,
-          maxItems: input.limits.maxItems,
-          maxProviderRequests: input.limits.maxProviderRequests,
-          maxElapsedMs,
-          maxInvocationElapsedMs: Math.min(GOOGLE_DRIVE_SYNC_INVOCATION_SLICE_MS, maxElapsedMs),
-          maxFileBytes: input.limits.maxFileBytes,
-          listChanges: async (pageToken, pageSize) => await provider.listChanges(pageToken, input.selectedSource.driveId, pageSize),
-          getFile: provider.getFile,
-          observedExternalObjectIds: input.observedExternalObjectIds,
-          now: clock
-        });
-        if (changes.status === "paused" && changes.checkpoint) {
-          return {
-            status: "paused",
-            stopReason: changes.stopReason,
-            entries: changes.entries,
-            checkpoint: {
-              version: 2,
-              kind: "google_drive_changes",
-              ...expectedCursor,
-              changesCheckpoint: {
-                ...changes.checkpoint,
-                requiresFullReconciliation: changes.checkpoint.requiresFullReconciliation || forceFullReconciliation
-              }
-            },
-            providerCursor,
-            authoritativeFullScan: false,
-            cursorInvalidated: false,
-            providerRequests: changes.providerRequests,
-            elapsedMs: changes.elapsedMs,
-            hardLimitReached: changes.hardLimitReached
-          };
-        }
-        if (!changes.newStartPageToken) throw new Error("google_drive_changes_cursor_missing");
-        if (changes.requiresFullReconciliation || forceFullReconciliation) {
-          const hardStopReason = googleDriveHardLimitReason(changes.budget, budgetLimits);
-          return {
-            status: "paused",
-            stopReason: hardStopReason ?? "elapsed_time_limit",
-            entries: changes.entries,
-            checkpoint: buildGoogleDriveFullReconciliationCheckpoint({
-              ...expectedCursor,
-              boundaryId: cursor.boundaryId,
-              startPageToken: changes.newStartPageToken,
-              cursorInvalidated: false,
-              budgetBeforeInventory: changes.budget,
-              inventoryElapsedMs: 0,
-              inventoryCheckpoint: null,
-              revisionFloors: revisionFloorsForEntries(changes.entries, input.limits.maxItems)
-            }),
-            providerCursor,
-            authoritativeFullScan: false,
-            cursorInvalidated: false,
-            providerRequests: changes.providerRequests,
-            elapsedMs: changes.elapsedMs,
-            hardLimitReached: hardStopReason !== null
-          };
-        }
-        return {
-          status: "complete",
-          stopReason: null,
-          entries: changes.entries,
-          checkpoint: null,
-          providerCursor: advanceGoogleDriveChangesCursor(cursor, changes.newStartPageToken),
-          authoritativeFullScan: false,
-          cursorInvalidated: false,
-          providerRequests: changes.providerRequests,
-          elapsedMs: changes.elapsedMs,
-          hardLimitReached: false
-        };
-      } catch (error) {
-        if (error instanceof GoogleDriveChangesProtocolError) {
-          throw new SyncFailure("provider_payload_invalid", false);
-        }
-        if (!(error instanceof GoogleDriveCursorInvalidError)) throw error;
-        const full = await acquireFullReconciliation({
-          budget: error.budget ?? emptyGoogleDriveSyncBudget(),
-          boundaryId: cursor.boundaryId,
-          cursorInvalidated: true
-        });
-        const hardStopReason = googleDriveHardLimitReason(full.budgetBeforeInventory, budgetLimits);
-        return {
-          status: "paused",
-          stopReason: hardStopReason ?? "elapsed_time_limit",
-          entries: [],
-          checkpoint: buildGoogleDriveFullReconciliationCheckpoint({
-            ...expectedCursor,
-            ...full
-          }),
-          providerCursor,
-          authoritativeFullScan: false,
-          cursorInvalidated: true,
-          providerRequests: full.budgetBeforeInventory.providerRequests,
-          elapsedMs: full.budgetBeforeInventory.elapsedMs,
-          hardLimitReached: hardStopReason !== null
-        };
-      }
-    },
-    fetchContent: async (entry, maxBytes) => await fetchDriveBytes(entry, input.authorization, maxBytes, input.retry, input.observability),
-    readAcl: async (entry, maxProviderRequests) => {
-      if (!provider.listPermissions) {
-        throw new SyncFailure("provider_rejected", false);
-      }
-      return await collectGoogleDriveAclEvidence({
-        entry,
-        maxProviderRequests,
-        listPermissions: provider.listPermissions,
-        getFile: provider.getFile,
-        now: clock
-      });
-    },
-    citationLocator: (entry) => ({
-      version: 2,
-      providerKey: "google-drive",
-      providerCoordinationKey: input.actionProviderCoordinationKey,
-      externalObjectId: entry.externalObjectId,
-      providerRevision: entry.externalVersionId,
-      driveId: entry.driveId,
-      sourceUri: entry.sourceUri
-    })
-  };
-}
-function isLegacyGoogleDriveFullReconciliationCheckpoint(value, expected) {
-  return value?.version === 2 && value.kind === "google_drive_full_reconciliation" && value.connectionId === expected.connectionId && value.googlePermissionId === expected.googlePermissionId && value.sourceId === expected.sourceId && value.driveId === expected.driveId && encodedJsonBytes(value) <= GOOGLE_DRIVE_EXECUTION_CHECKPOINT_MAX_BYTES;
-}
-function parseGoogleDriveExecutionCheckpoint(value, expected, limits) {
-  if (!value || value.connectionId !== expected.connectionId || value.googlePermissionId !== expected.googlePermissionId || value.sourceId !== expected.sourceId || value.driveId !== expected.driveId || encodedJsonBytes(value) > GOOGLE_DRIVE_EXECUTION_CHECKPOINT_MAX_BYTES) {
-    return null;
-  }
-  if (value.version === 2 && value.kind === "google_drive_changes") {
-    const changesCheckpoint = parseGoogleDriveChangesCheckpoint(value.changesCheckpoint, limits);
-    return changesCheckpoint ? { ...value, changesCheckpoint } : null;
-  }
-  if (value.version === 3 && value.kind === "google_drive_full_reconciliation") {
-    const budgetBeforeInventory = parseGoogleDriveSyncBudget(value.budgetBeforeInventory, limits);
-    const revisionFloors = parseGoogleDriveRevisionFloors(value.revisionFloors, limits.maxItems);
-    if (typeof value.boundaryId !== "string" || value.boundaryId.length < 1 || value.boundaryId.length > 1024 || typeof value.startPageToken !== "string" || value.startPageToken.length < 1 || value.startPageToken.length > 4096 || typeof value.cursorInvalidated !== "boolean" || !budgetBeforeInventory || !revisionFloors || !Number.isSafeInteger(value.inventoryElapsedMs) || Number(value.inventoryElapsedMs) < 0 || Number(value.inventoryElapsedMs) > limits.maxElapsedMs || budgetBeforeInventory.elapsedMs + Number(value.inventoryElapsedMs) > limits.maxElapsedMs || value.inventoryCheckpoint !== null && (!value.inventoryCheckpoint || typeof value.inventoryCheckpoint !== "object" || Array.isArray(value.inventoryCheckpoint))) {
-      return null;
-    }
-    return {
-      ...value,
-      budgetBeforeInventory,
-      inventoryElapsedMs: Number(value.inventoryElapsedMs),
-      revisionFloors
-    };
-  }
-  return null;
-}
-function buildGoogleDriveFullReconciliationCheckpoint(input) {
-  const checkpoint = {
-    version: 3,
-    kind: "google_drive_full_reconciliation",
-    ...input,
-    revisionFloors: input.revisionFloors.map((floor) => [...floor])
-  };
-  if (encodedJsonBytes(checkpoint) > GOOGLE_DRIVE_EXECUTION_CHECKPOINT_MAX_BYTES) {
-    throw new SyncFailure("resource_limit", false);
-  }
-  return checkpoint;
-}
-function parseGoogleDriveRevisionFloors(value, maxItems) {
-  if (!Array.isArray(value) || value.length > maxItems) return null;
-  const floors = [];
-  const seen = /* @__PURE__ */ new Set();
-  for (const floor of value) {
-    if (!Array.isArray(floor) || floor.length !== 2 || typeof floor[0] !== "string" || floor[0].trim().length < 1 || floor[0].length > 1024 || floor[1] !== null && (typeof floor[1] !== "string" || floor[1].length < 1 || floor[1].length > 256) || seen.has(floor[0])) {
-      return null;
-    }
-    seen.add(floor[0]);
-    floors.push([floor[0], floor[1]]);
-  }
-  return floors;
-}
-function revisionFloorsForEntries(entries, maxItems) {
-  const reconciled = reconcileGoogleDriveRevisionFloors(entries, [], maxItems);
-  if (reconciled.conflict) throw new SyncFailure("provider_payload_invalid", false);
-  return reconciled.revisionFloors;
-}
-function shouldProcessGoogleDriveDurableObservation(input) {
-  if (input.observation.externalObjectId !== input.entry.externalObjectId) {
-    throw new SyncFailure("provider_payload_invalid", false);
-  }
-  if (input.observation.disposition === "accepted" || input.observation.disposition === "replayed") {
-    return true;
-  }
-  if (input.observation.disposition === "conflict") {
-    throw new SyncFailure("provider_payload_invalid", false);
-  }
-  const current = input.observation.currentVersion;
-  const comparison = current ? compareCanonicalDecimalProviderRevisions(
-    current.providerRevision,
-    input.observation.providerRevision
-  ) : null;
-  const fullyProcessed = current !== null && current.objectLifecycleState === "active" && current.sourceLifecycleGeneration === input.sourceLifecycleGeneration && current.objectLifecycleGeneration === current.currentObjectLifecycleGeneration && current.aclGeneration === input.aclGeneration && current.indexObligationStatus === "indexed" && comparison !== null && comparison >= 0 && (comparison > 0 || current.metadataHash === input.observation.metadataHash);
-  if (!fullyProcessed) throw new SyncFailure("provider_payload_invalid", false);
-  return false;
-}
-function mergeGoogleDriveDurableObservationFloors(checkpoint, observations, maxItems) {
-  if (!checkpoint || checkpoint.version !== 3 || checkpoint.kind !== "google_drive_full_reconciliation") {
-    return checkpoint;
-  }
-  const parsedFloors = parseGoogleDriveRevisionFloors(checkpoint.revisionFloors, maxItems);
-  if (!parsedFloors) throw new SyncFailure("provider_payload_invalid", false);
-  const floors = new Map(parsedFloors);
-  for (const observation of observations) {
-    floors.set(observation.externalObjectId, observation.providerRevision);
-  }
-  if (floors.size > maxItems) throw new SyncFailure("resource_limit", false);
-  const merged = {
-    ...checkpoint,
-    revisionFloors: [...floors]
-  };
-  if (encodedJsonBytes(merged) > GOOGLE_DRIVE_EXECUTION_CHECKPOINT_MAX_BYTES) {
-    throw new SyncFailure("resource_limit", false);
-  }
-  return merged;
-}
-function reconcileGoogleDriveRevisionFloors(entries, existingFloors, maxItems) {
-  const floors = new Map(existingFloors);
-  const accepted = [];
-  for (const entry of entries) {
-    if (!floors.has(entry.externalObjectId)) {
-      floors.set(entry.externalObjectId, entry.externalVersionId);
-      accepted.push(entry);
-    } else {
-      const comparison = compareCanonicalDecimalProviderRevisions(
-        entry.externalVersionId,
-        floors.get(entry.externalObjectId) ?? null
-      );
-      if (comparison === null) {
-        return {
-          entries: [],
-          revisionFloors: [...floors],
-          conflict: true
-        };
-      }
-      if (comparison > 0) {
-        floors.set(entry.externalObjectId, entry.externalVersionId);
-        accepted.push(entry);
-      }
-    }
-    if (floors.size > maxItems) throw new SyncFailure("resource_limit", false);
-  }
-  return {
-    entries: accepted,
-    revisionFloors: [...floors],
-    conflict: false
-  };
-}
-function encodedJsonBytes(value) {
-  try {
-    return new TextEncoder().encode(JSON.stringify(value)).byteLength;
-  } catch {
-    return Number.POSITIVE_INFINITY;
-  }
-}
-function parseGoogleDriveSyncBudget(value, limits) {
-  if (!value || typeof value !== "object" || Array.isArray(value)) return null;
-  const row = value;
-  for (const [key, maximum] of [
-    ["examinedItems", limits.maxItems],
-    ["providerRequests", limits.maxProviderRequests],
-    ["elapsedMs", limits.maxElapsedMs]
-  ]) {
-    const budgetValue = row[key];
-    if (!Number.isSafeInteger(budgetValue) || Number(budgetValue) < 0 || Number(budgetValue) > maximum) {
-      return null;
-    }
-  }
-  return value;
-}
-function emptyGoogleDriveSyncBudget() {
-  return { examinedItems: 0, providerRequests: 0, elapsedMs: 0 };
-}
-function googleDriveHardLimitReason(budget, limits) {
-  if (budget.examinedItems >= limits.maxItems) return "item_limit";
-  if (budget.providerRequests >= limits.maxProviderRequests) return "api_request_limit";
-  if (budget.elapsedMs >= limits.maxElapsedMs) return "elapsed_time_limit";
-  return null;
-}
-function googleDriveInventoryStopIsHard(reason, budget, limits) {
-  if (reason === "api_request_limit" || reason === "item_limit" || reason === "known_byte_limit") {
-    return true;
-  }
-  return reason === "elapsed_time_limit" && budget.elapsedMs >= limits.maxElapsedMs;
-}
-async function getDriveStartPageToken(driveId, authorization, retry, observability) {
-  if (!authorization) throw new SyncFailure("connection_reconnect_required", true, true);
-  const url = new URL(`${DRIVE_API_BASE}/changes/startPageToken`);
-  url.searchParams.set("supportsAllDrives", "true");
-  if (driveId) url.searchParams.set("driveId", driveId);
-  const response = await requestGoogleDrive(
-    url,
-    { headers: { authorization, accept: "application/json" } },
-    "start_page_token",
-    retry,
-    observability
-  );
-  if (!response.ok) throwGoogleDriveResponse(response);
-  const payload = await readResponseJsonBounded(
-    response,
-    DRIVE_JSON_MAX_BYTES,
-    "Google Drive start page token"
-  );
-  return requiredString(payload.startPageToken, "start_page_token");
-}
-async function listDriveChanges(pageToken, driveId, pageSize, authorization, retry, observability) {
-  if (!authorization) throw new SyncFailure("connection_reconnect_required", true, true);
-  const url = new URL(`${DRIVE_API_BASE}/changes`);
-  url.searchParams.set("pageToken", pageToken);
-  url.searchParams.set("pageSize", String(pageSize));
-  url.searchParams.set("supportsAllDrives", "true");
-  url.searchParams.set("includeItemsFromAllDrives", "true");
-  url.searchParams.set("spaces", "drive");
-  url.searchParams.set(
-    "fields",
-    "nextPageToken,newStartPageToken,changes(fileId,removed,time,driveId,file(id,name,mimeType,driveId,parents,modifiedTime,createdTime,version,md5Checksum,size,webViewLink,trashed))"
-  );
-  if (driveId) url.searchParams.set("driveId", driveId);
-  const response = await requestGoogleDrive(
-    url,
-    { headers: { authorization, accept: "application/json" } },
-    "list_changes",
-    retry,
-    observability
-  );
-  if (response.status === 410) throw new GoogleDriveCursorInvalidError();
-  if (!response.ok) throwGoogleDriveResponse(response);
-  const payload = await readResponseJsonBounded(
-    response,
-    DRIVE_JSON_MAX_BYTES,
-    "Google Drive changes list"
-  );
-  const changes = Array.isArray(payload.changes) ? payload.changes : [];
-  return {
-    changes: changes.map((value) => {
-      const row = value && typeof value === "object" ? value : {};
-      const fileId = requiredString(row.fileId, "change_file_id");
-      return {
-        fileId,
-        removed: row.removed === true,
-        file: row.file && typeof row.file === "object" ? parseDriveProviderItem(row.file) : null
-      };
-    }),
-    nextPageToken: optionalString(payload.nextPageToken),
-    newStartPageToken: optionalString(payload.newStartPageToken)
-  };
-}
-async function getDriveFile(fileId, authorization, retry, observability) {
-  if (!authorization) throw new SyncFailure("connection_reconnect_required", true, true);
-  const url = new URL(`${DRIVE_API_BASE}/files/${encodeURIComponent(fileId)}`);
-  url.searchParams.set("supportsAllDrives", "true");
-  url.searchParams.set(
-    "fields",
-    "id,name,mimeType,driveId,parents,modifiedTime,createdTime,version,md5Checksum,size,webViewLink,trashed"
-  );
-  const response = await requestGoogleDrive(
-    url,
-    { headers: { authorization, accept: "application/json" } },
-    "get_file",
-    retry,
-    observability
-  );
-  if (response.status === 404) return null;
-  if (!response.ok) throwGoogleDriveResponse(response);
-  return parseDriveProviderItem(
-    await readResponseJsonBounded(response, DRIVE_JSON_MAX_BYTES, "Google Drive file metadata")
-  );
-}
-async function listDrivePermissions(input, authorization, retry, observability) {
-  if (!authorization) throw new SyncFailure("connection_reconnect_required", true, true);
-  const url = new URL(`${DRIVE_API_BASE}/files/${encodeURIComponent(input.fileId)}/permissions`);
-  url.searchParams.set("supportsAllDrives", "true");
-  url.searchParams.set("pageSize", String(input.pageSize));
-  url.searchParams.set(
-    "fields",
-    "nextPageToken,permissions(id,type,emailAddress,domain,role,allowFileDiscovery,expirationTime,deleted,permissionDetails(inherited))"
-  );
-  if (input.pageToken) url.searchParams.set("pageToken", input.pageToken);
-  const response = await requestGoogleDrive(
-    url,
-    { headers: { authorization, accept: "application/json" } },
-    "list_permissions",
-    retry,
-    observability
-  );
-  if (response.status === 403 || response.status === 404) {
-    return { permissions: [], nextPageToken: null, denied: true };
-  }
-  if (!response.ok) throwGoogleDriveResponse(response);
-  const payload = await readResponseJsonBounded(
-    response,
-    DRIVE_JSON_MAX_BYTES,
-    "Google Drive permission list"
-  );
-  const rawPermissions = Array.isArray(payload.permissions) ? payload.permissions : null;
-  if (!rawPermissions) throw new SyncFailure("provider_payload_invalid", false);
-  return {
-    permissions: rawPermissions.map(parseDrivePermission),
-    nextPageToken: optionalString(payload.nextPageToken),
-    denied: false
-  };
-}
-async function collectGoogleDriveAclEvidence(input) {
-  if (!Number.isSafeInteger(input.maxProviderRequests) || input.maxProviderRequests < 1) {
-    throw new SyncFailure("resource_limit", false);
-  }
-  const now = input.now ?? Date.now;
-  const observedAt = new Date(now());
-  if (!Number.isFinite(observedAt.getTime())) {
-    throw new SyncFailure("provider_payload_invalid", false);
-  }
-  const permissions = [];
-  const seenTokens = /* @__PURE__ */ new Set();
-  let pageToken = null;
-  let providerRequests = 0;
-  let permissionListDenied = false;
-  do {
-    if (providerRequests >= input.maxProviderRequests) {
-      throw new SyncFailure("resource_limit", false);
-    }
-    providerRequests += 1;
-    const page = await input.listPermissions({
-      fileId: input.entry.externalObjectId,
-      pageToken,
-      pageSize: Math.min(100, GOOGLE_DRIVE_ACL_MAX_PRINCIPALS - permissions.length)
-    });
-    if (page.denied) {
-      permissionListDenied = true;
-      break;
-    }
-    permissions.push(...page.permissions);
-    if (permissions.length > GOOGLE_DRIVE_ACL_MAX_PRINCIPALS) {
-      throw new SyncFailure("resource_limit", false);
-    }
-    pageToken = page.nextPageToken;
-    if (pageToken) {
-      if (pageToken.length > 4096 || seenTokens.has(pageToken)) {
-        throw new SyncFailure("provider_payload_invalid", false);
-      }
-      seenTokens.add(pageToken);
-    }
-  } while (pageToken);
-  if (permissionListDenied) {
-    if (!input.getFile || providerRequests >= input.maxProviderRequests) {
-      return googleDriveDeniedAclEvidence(input.entry, observedAt, providerRequests);
-    }
-    providerRequests += 1;
-    const current = await input.getFile(input.entry.externalObjectId);
-    if (!current || current.trashed) {
-      return googleDriveDeniedAclEvidence(input.entry, observedAt, providerRequests);
-    }
-    const aclRevision2 = createHash2("sha256").update(
-      JSON.stringify({
-        version: 1,
-        mode: "source_owner_only",
-        externalObjectId: input.entry.externalObjectId,
-        providerRevision: input.entry.externalVersionId
-      })
-    ).digest("hex");
-    return {
-      eligibility: "eligible",
-      providerRevision: input.entry.externalVersionId,
-      driveId: input.entry.driveId,
-      aclRevision: aclRevision2,
-      observedAt: observedAt.toISOString(),
-      expiresAt: new Date(observedAt.getTime() + GOOGLE_DRIVE_ACL_FRESHNESS_MS).toISOString(),
-      providerRequests,
-      principals: []
-    };
-  }
-  const canonicalPermissions = permissions.map((permission) => ({
-    id: permission.id,
-    type: permission.type,
-    role: permission.role,
-    emailAddress: permission.emailAddress,
-    domain: permission.domain,
-    allowFileDiscovery: permission.allowFileDiscovery,
-    expirationTime: permission.expirationTime,
-    inherited: permission.inherited
-  })).sort((left, right) => JSON.stringify(left).localeCompare(JSON.stringify(right)));
-  const aclRevision = createHash2("sha256").update(
-    JSON.stringify({
-      version: 1,
-      externalObjectId: input.entry.externalObjectId,
-      providerRevision: input.entry.externalVersionId,
-      permissions: canonicalPermissions
-    })
-  ).digest("hex");
-  return {
-    eligibility: "eligible",
-    providerRevision: input.entry.externalVersionId,
-    driveId: input.entry.driveId,
-    aclRevision,
-    observedAt: observedAt.toISOString(),
-    expiresAt: new Date(observedAt.getTime() + GOOGLE_DRIVE_ACL_FRESHNESS_MS).toISOString(),
-    providerRequests,
-    principals: canonicalPermissions.map((permission) => ({
-      type: permission.type,
-      permissionId: permission.id,
-      emailAddress: permission.emailAddress,
-      domain: permission.domain,
-      role: permission.role,
-      inherited: permission.inherited,
-      allowFileDiscovery: permission.allowFileDiscovery,
-      expirationTime: permission.expirationTime
-    }))
-  };
-}
-function googleDriveDeniedAclEvidence(entry, observedAt, providerRequests) {
-  return {
-    eligibility: "denied",
-    providerRevision: entry.externalVersionId,
-    driveId: entry.driveId,
-    aclRevision: createHash2("sha256").update(
-      JSON.stringify({
-        version: 1,
-        mode: "provider_denied",
-        externalObjectId: entry.externalObjectId,
-        providerRevision: entry.externalVersionId
-      })
-    ).digest("hex"),
-    observedAt: observedAt.toISOString(),
-    expiresAt: new Date(observedAt.getTime() + GOOGLE_DRIVE_ACL_FRESHNESS_MS).toISOString(),
-    providerRequests,
-    principals: []
-  };
-}
-function parseDrivePermission(value) {
-  const row = objectRecord(value);
-  if (row.deleted === true) throw new SyncFailure("provider_payload_invalid", false);
-  const type = requiredString(row.type, "permission.type");
-  if (type !== "user" && type !== "group" && type !== "domain" && type !== "anyone") {
-    throw new SyncFailure("provider_payload_invalid", false);
-  }
-  const role = requiredString(row.role, "permission.role");
-  if (role !== "owner" && role !== "organizer" && role !== "fileOrganizer" && role !== "writer" && role !== "commenter" && role !== "reader") {
-    throw new SyncFailure("provider_payload_invalid", false);
-  }
-  const permissionDetails = Array.isArray(row.permissionDetails) ? row.permissionDetails : [];
-  return {
-    id: requiredString(row.id, "permission.id"),
-    type,
-    role,
-    emailAddress: optionalString(row.emailAddress),
-    domain: optionalString(row.domain),
-    allowFileDiscovery: typeof row.allowFileDiscovery === "boolean" ? row.allowFileDiscovery : null,
-    expirationTime: optionalExactProviderTimestamp(row.expirationTime),
-    inherited: permissionDetails.some((detail) => objectRecord(detail).inherited === true)
-  };
-}
-function optionalExactProviderTimestamp(value) {
-  const timestamp = optionalString(value);
-  if (!timestamp) return null;
-  const parsed = new Date(timestamp);
-  if (!Number.isFinite(parsed.getTime())) throw new SyncFailure("provider_payload_invalid", false);
-  return parsed.toISOString();
-}
-function throwGoogleDriveResponse(response) {
-  if (response.status === 401 || response.status === 403) {
-    throw new SyncFailure("connection_reconnect_required", true, true);
-  }
-  throw new SyncFailure(
-    response.status >= 500 || response.status === 429 ? "provider_unavailable" : "provider_rejected",
-    response.status >= 500 || response.status === 429
-  );
-}
-async function requestGoogleDrive(url, init, operation, retry, observability) {
-  try {
-    return await fetchGoogleDriveProvider({
-      fetchImpl: fetch,
-      url,
-      init,
-      operation,
-      policy: retry,
-      observability,
-      heartbeat: (details) => heartbeat({ provider: "google_drive", ...details })
-    });
-  } catch (error) {
-    if (error instanceof GoogleDriveProviderTransportError) {
-      throw new SyncFailure("provider_unavailable", true);
-    }
-    throw error;
-  }
-}
-function selectedDriveSource(metadata, externalSourceId) {
-  const sources = metadata.selectedSources ?? (metadata.selectedSource ? [metadata.selectedSource] : []);
-  return sources.find((source) => source.id === externalSourceId) ?? null;
-}
-function googleDriveSyncProviderAccessAllowed(input) {
-  return input.resolvedConnectionVersion !== void 0 && input.connectionVersion === input.resolvedConnectionVersion && input.connectionStatus === "active" && (input.lifecycleState === void 0 || input.lifecycleState === "active") && googleDriveScopesAllowCapability(input.grantedScopes, "recursive_source_sync");
-}
-async function listDriveChildren(input, authorization, retry, observability) {
-  if (!authorization) throw new SyncFailure("connection_reconnect_required", true, true);
-  const url = new URL(`${DRIVE_API_BASE}/files`);
-  url.searchParams.set(
-    "q",
-    `'${input.folderId.replaceAll("'", "\\'")}' in parents and trashed = false`
-  );
-  url.searchParams.set("pageSize", String(input.pageSize));
-  url.searchParams.set("supportsAllDrives", "true");
-  url.searchParams.set("includeItemsFromAllDrives", "true");
-  url.searchParams.set(
-    "fields",
-    "nextPageToken,incompleteSearch,files(id,name,mimeType,driveId,parents,modifiedTime,createdTime,version,md5Checksum,size,webViewLink,trashed)"
-  );
-  if (input.pageToken) url.searchParams.set("pageToken", input.pageToken);
-  if (input.driveId) {
-    url.searchParams.set("corpora", "drive");
-    url.searchParams.set("driveId", input.driveId);
-  }
-  const response = await requestGoogleDrive(
-    url,
-    { headers: { authorization, accept: "application/json" } },
-    "list_children",
-    retry,
-    observability
-  );
-  if (!response.ok) {
-    if (response.status === 401 || response.status === 403) {
-      throw new SyncFailure("connection_reconnect_required", true, true);
-    }
-    throw new SyncFailure(
-      "provider_unavailable",
-      response.status >= 500 || response.status === 429
-    );
-  }
-  const payload = await readResponseJsonBounded(
-    response,
-    DRIVE_JSON_MAX_BYTES,
-    "Google Drive file list"
-  );
-  const rawFiles = Array.isArray(payload.files) ? payload.files : [];
-  return {
-    items: rawFiles.map(parseDriveProviderItem),
-    nextPageToken: typeof payload.nextPageToken === "string" ? payload.nextPageToken : null,
-    incompleteSearch: payload.incompleteSearch === true
-  };
-}
-function parseDriveProviderItem(value) {
-  const row = value && typeof value === "object" ? value : {};
-  return {
-    id: requiredString(row.id, "id"),
-    name: requiredString(row.name, "name"),
-    mimeType: requiredString(row.mimeType, "mimeType"),
-    driveId: optionalString(row.driveId),
-    parents: Array.isArray(row.parents) ? row.parents.filter((item) => typeof item === "string") : [],
-    modifiedTime: optionalString(row.modifiedTime),
-    createdTime: optionalString(row.createdTime),
-    version: optionalString(row.version),
-    md5Checksum: optionalString(row.md5Checksum),
-    size: optionalString(row.size),
-    webViewLink: optionalString(row.webViewLink),
-    trashed: row.trashed === true
-  };
-}
-async function fetchDriveBytes(entry, authorization, maxBytes, retry, observability) {
-  if (!authorization) throw new SyncFailure("connection_reconnect_required", true, true);
-  const url = entry.transfer.action === "export" ? new URL(`${DRIVE_API_BASE}/files/${encodeURIComponent(entry.externalObjectId)}/export`) : new URL(`${DRIVE_API_BASE}/files/${encodeURIComponent(entry.externalObjectId)}`);
-  if (entry.transfer.action === "export") {
-    url.searchParams.set("mimeType", entry.transfer.contentType);
-  } else {
-    url.searchParams.set("alt", "media");
-    url.searchParams.set("supportsAllDrives", "true");
-  }
-  const response = await requestGoogleDrive(
-    url,
-    { headers: { authorization } },
-    entry.transfer.action === "export" ? "export" : "download",
-    retry,
-    observability
-  );
-  if (!response.ok) {
-    if (response.status === 401 || response.status === 403) {
-      throw new SyncFailure("connection_reconnect_required", true, true);
-    }
-    throw new SyncFailure(
-      "provider_unavailable",
-      response.status >= 500 || response.status === 429
-    );
-  }
-  const declared = Number(response.headers.get("content-length") ?? "0");
-  if (Number.isFinite(declared) && declared > maxBytes) {
-    throw new SyncFailure("content_too_large", false);
-  }
-  if (!response.body) {
-    const bytes2 = new Uint8Array(await response.arrayBuffer());
-    if (bytes2.byteLength > maxBytes) throw new SyncFailure("content_too_large", false);
-    return bytes2;
-  }
-  const reader = response.body.getReader();
-  const chunks = [];
-  let total = 0;
-  while (true) {
-    const { done, value } = await reader.read();
-    if (done) break;
-    total += value.byteLength;
-    if (total > maxBytes) {
-      await reader.cancel();
-      throw new SyncFailure("content_too_large", false);
-    }
-    chunks.push(value);
-  }
-  const bytes = new Uint8Array(total);
-  let offset = 0;
-  for (const chunk of chunks) {
-    bytes.set(chunk, offset);
-    offset += chunk.byteLength;
-  }
-  return bytes;
-}
-async function listAtlassianItems(source, cursor, pageSize, authorization) {
-  if (!authorization) throw new SyncFailure("connection_reconnect_required", true, true);
-  if (source.kind === "jira_project") {
-    const url2 = new URL(
-      `${ATLASSIAN_API_BASE}/ex/jira/${encodeURIComponent(source.cloudId)}/rest/api/3/search/jql`
-    );
-    url2.searchParams.set(
-      "jql",
-      `project = "${source.key.replaceAll('"', '\\"')}" ORDER BY key ASC`
-    );
-    url2.searchParams.set("maxResults", String(pageSize));
-    url2.searchParams.set("fields", "summary,created,updated");
-    if (cursor) url2.searchParams.set("nextPageToken", cursor);
-    const payload2 = objectRecord(await atlassianJsonRequest(url2, authorization, "Jira issue list"));
-    const issues = Array.isArray(payload2.issues) ? payload2.issues : [];
-    return {
-      items: issues.map((raw) => {
-        const row = objectRecord(raw);
-        const fields = objectRecord(row.fields);
-        const id = requiredAtlassianString(row.id, "issue.id");
-        const key = requiredAtlassianString(row.key, "issue.key");
-        const updatedAt = optionalString(fields.updated);
-        return {
-          id,
-          key,
-          title: requiredAtlassianString(fields.summary, "issue.summary"),
-          version: updatedAt,
-          createdAt: optionalString(fields.created),
-          updatedAt,
-          webUrl: new URL(`/browse/${encodeURIComponent(key)}`, source.siteUrl).toString()
-        };
-      }),
-      nextCursor: optionalString(payload2.nextPageToken)
-    };
-  }
-  const url = new URL(
-    `${ATLASSIAN_API_BASE}/ex/confluence/${encodeURIComponent(source.cloudId)}/wiki/api/v2/spaces/${encodeURIComponent(source.resourceId)}/pages`
-  );
-  url.searchParams.set("limit", String(pageSize));
-  url.searchParams.set("sort", "id");
-  if (cursor) url.searchParams.set("cursor", cursor);
-  const payload = objectRecord(
-    await atlassianJsonRequest(url, authorization, "Confluence page list")
-  );
-  const pages = Array.isArray(payload.results) ? payload.results : [];
-  return {
-    items: pages.map((raw) => {
-      const row = objectRecord(raw);
-      const version = objectRecord(row.version);
-      const id = requiredAtlassianString(row.id, "page.id");
-      const webUi = optionalString(objectRecord(row._links).webui);
-      const versionNumber = numberValue(version.number);
-      return {
-        id,
-        key: id,
-        title: requiredAtlassianString(row.title, "page.title"),
-        version: versionNumber === void 0 ? null : String(versionNumber),
-        createdAt: optionalString(row.createdAt),
-        updatedAt: optionalString(version.createdAt),
-        webUrl: webUi ? new URL(webUi.startsWith("/wiki/") ? webUi : `/wiki${webUi}`, source.siteUrl).toString() : new URL(
-          `/wiki/spaces/${encodeURIComponent(source.key)}/pages/${encodeURIComponent(id)}`,
-          source.siteUrl
-        ).toString()
-      };
-    }),
-    nextCursor: confluenceCursor(objectRecord(payload._links).next)
+    }
   };
 }
-async function fetchAtlassianContent(source, entry, authorization, maxBytes) {
-  if (!authorization) throw new SyncFailure("connection_reconnect_required", true, true);
-  const objectId = entry.externalObjectId.slice(entry.externalObjectId.indexOf(":") + 1);
-  const markdown = source.kind === "jira_project" ? await jiraIssueMarkdown(source, objectId, entry, authorization) : await confluencePageMarkdown(source, objectId, entry, authorization);
-  const bytes = new TextEncoder().encode(markdown);
-  if (bytes.byteLength > maxBytes) throw new SyncFailure("content_too_large", false);
-  return bytes;
-}
-async function jiraIssueMarkdown(source, issueId, entry, authorization) {
-  const issueUrl = new URL(
-    `${ATLASSIAN_API_BASE}/ex/jira/${encodeURIComponent(source.cloudId)}/rest/api/3/issue/${encodeURIComponent(issueId)}`
-  );
-  issueUrl.searchParams.set(
-    "fields",
-    "summary,description,status,issuetype,priority,assignee,reporter,labels,created,updated"
-  );
-  const issue = objectRecord(await atlassianJsonRequest(issueUrl, authorization, "Jira issue"));
-  const fields = objectRecord(issue.fields);
-  const lines = [
-    `# ${entry.title}`,
-    "",
-    `- Key: ${optionalString(issue.key) ?? entry.title}`,
-    `- Type: ${optionalString(objectRecord(fields.issuetype).name) ?? "Unknown"}`,
-    `- Status: ${optionalString(objectRecord(fields.status).name) ?? "Unknown"}`,
-    `- Priority: ${optionalString(objectRecord(fields.priority).name) ?? "None"}`,
-    `- Assignee: ${optionalString(objectRecord(fields.assignee).displayName) ?? "Unassigned"}`,
-    `- Reporter: ${optionalString(objectRecord(fields.reporter).displayName) ?? "Unknown"}`,
-    `- Updated: ${optionalString(fields.updated) ?? "Unknown"}`,
-    `- Source: ${entry.sourceUri}`,
-    "",
-    "## Description",
-    "",
-    adfToMarkdown(fields.description) || "No description."
-  ];
-  const labels = Array.isArray(fields.labels) ? fields.labels.filter((value) => typeof value === "string") : [];
-  if (labels.length > 0) lines.splice(9, 0, `- Labels: ${labels.join(", ")}`);
-  const comments = await jiraComments(source, issueId, authorization);
-  if (comments.length > 0) {
-    lines.push("", "## Comments", "");
-    for (const comment of comments) {
-      const row = objectRecord(comment);
-      const author = optionalString(objectRecord(row.author).displayName) ?? "Unknown author";
-      const created = optionalString(row.created) ?? "Unknown date";
-      lines.push(`### ${author} \xB7 ${created}`, "", adfToMarkdown(row.body), "");
-    }
-  }
-  return lines.join("\n");
-}
-async function jiraComments(source, issueId, authorization) {
-  const comments = [];
-  let startAt = 0;
-  for (let page = 0; page < 20; page += 1) {
-    const url = new URL(
-      `${ATLASSIAN_API_BASE}/ex/jira/${encodeURIComponent(source.cloudId)}/rest/api/3/issue/${encodeURIComponent(issueId)}/comment`
-    );
-    url.searchParams.set("startAt", String(startAt));
-    url.searchParams.set("maxResults", "100");
-    url.searchParams.set("orderBy", "created");
-    const payload = objectRecord(await atlassianJsonRequest(url, authorization, "Jira comments"));
-    const pageComments = Array.isArray(payload.comments) ? payload.comments : [];
-    comments.push(...pageComments);
-    const total = numberValue(payload.total) ?? comments.length;
-    if (comments.length >= total || pageComments.length === 0) break;
-    startAt += pageComments.length;
-  }
-  return comments;
+function isUnprocessableEntity(error) {
+  return error instanceof Error && "status" in error && error.status === 422;
 }
-async function confluencePageMarkdown(source, pageId, entry, authorization) {
-  const pageUrl = new URL(
-    `${ATLASSIAN_API_BASE}/ex/confluence/${encodeURIComponent(source.cloudId)}/wiki/api/v2/pages/${encodeURIComponent(pageId)}`
-  );
-  pageUrl.searchParams.set("body-format", "storage");
-  const page = objectRecord(await atlassianJsonRequest(pageUrl, authorization, "Confluence page"));
-  const storage = objectRecord(objectRecord(page.body).storage);
-  const lines = [
-    `# ${entry.title}`,
-    "",
-    `- Space: ${source.name} (${source.key})`,
-    `- Updated: ${entry.modifiedTime ?? "Unknown"}`,
-    `- Source: ${entry.sourceUri}`,
-    "",
-    "## Content",
-    "",
-    optionalString(storage.value) ?? "No content."
-  ];
-  const comments = await confluenceFooterComments(source, pageId, authorization);
-  if (comments.length > 0) {
-    lines.push("", "## Comments", "");
-    for (const comment of comments) {
-      const row = objectRecord(comment);
-      const body = objectRecord(objectRecord(row.body).storage);
-      const version = objectRecord(row.version);
-      lines.push(
-        `### Comment \xB7 ${optionalString(version.createdAt) ?? "Unknown date"}`,
-        "",
-        optionalString(body.value) ?? "",
-        ""
-      );
+
+// src/activities/file-upload-reaper.ts
+import {
+  claimDueTranscriptionRecordingObjectCleanup,
+  claimExpiredFileUploadCleanup,
+  completeDueTranscriptionRecordingObjectCleanup,
+  completeExpiredFileUploadCleanup,
+  claimVideoGenerationOperations,
+  purgeExpiredTranscriptionRecordings
+} from "@opengeni/db";
+import { randomUUID } from "crypto";
+var FILE_UPLOAD_CLEANUP_GRACE_MS = 60 * 60 * 1e3;
+var FILE_UPLOAD_CLEANUP_CLAIM_TIMEOUT_MS = 10 * 60 * 1e3;
+var FILE_UPLOAD_CLEANUP_BATCH_SIZE = 100;
+var SAFE_CLEANUP_ERROR_CATEGORIES = /* @__PURE__ */ new Set([
+  "aborted",
+  "conflict",
+  "invalid_response",
+  "network",
+  "not_found",
+  "permission_denied",
+  "provider",
+  "timeout",
+  "unavailable"
+]);
+function cleanupErrorAttributes(error) {
+  let errorCategory = "provider_error";
+  let errorStatus;
+  if (error && typeof error === "object") {
+    const rawCode = error.code;
+    if (typeof rawCode === "string" && SAFE_CLEANUP_ERROR_CATEGORIES.has(rawCode)) {
+      errorCategory = rawCode;
+    } else if (rawCode !== void 0) {
+      errorCategory = "unknown";
     }
-  }
-  return lines.join("\n");
-}
-async function confluenceFooterComments(source, pageId, authorization) {
-  const comments = [];
-  let cursor = null;
-  for (let page = 0; page < 20; page += 1) {
-    const url = new URL(
-      `${ATLASSIAN_API_BASE}/ex/confluence/${encodeURIComponent(source.cloudId)}/wiki/api/v2/pages/${encodeURIComponent(pageId)}/footer-comments`
-    );
-    url.searchParams.set("body-format", "storage");
-    url.searchParams.set("limit", "100");
-    if (cursor) url.searchParams.set("cursor", cursor);
-    const payload = objectRecord(
-      await atlassianJsonRequest(url, authorization, "Confluence page comments")
-    );
-    const results = Array.isArray(payload.results) ? payload.results : [];
-    comments.push(...results);
-    cursor = confluenceCursor(objectRecord(payload._links).next);
-    if (!cursor) break;
-  }
-  return comments;
-}
-async function atlassianJsonRequest(url, authorization, label) {
-  const response = await fetch(url, {
-    headers: { authorization, accept: "application/json" },
-    redirect: "error",
-    signal: AbortSignal.timeout(2e4)
-  });
-  if (!response.ok) {
-    await response.body?.cancel().catch(() => void 0);
-    if (response.status === 401 || response.status === 403) {
-      throw new SyncFailure("connection_reconnect_required", true, true);
-    }
-    throw new SyncFailure(
-      "provider_unavailable",
-      response.status >= 500 || response.status === 429
+    const rawStatus = Number(
+      error.status ?? error.statusCode
     );
+    if (Number.isInteger(rawStatus) && rawStatus >= 100 && rawStatus <= 599) {
+      errorStatus = rawStatus;
+    }
   }
-  return await readResponseJsonBounded(response, ATLASSIAN_JSON_MAX_BYTES, label);
-}
-function confluenceCursor(value) {
-  const next = optionalString(value);
-  if (!next) return null;
-  const url = new URL(next, ATLASSIAN_API_BASE);
-  const cursor = url.searchParams.get("cursor");
-  if (!cursor || cursor.length > 4096 || /[\u0000-\u001f]/.test(cursor)) {
-    throw new Error("invalid Confluence cursor");
-  }
-  return cursor;
+  return { errorCategory, ...errorStatus === void 0 ? {} : { errorStatus } };
 }
-function adfToMarkdown(value) {
-  const node = objectRecord(value);
-  const type = optionalString(node.type);
-  const children = Array.isArray(node.content) ? node.content.map(adfToMarkdown).join("") : "";
-  if (type === "text") {
-    let text = typeof node.text === "string" ? node.text : "";
-    const marks = Array.isArray(node.marks) ? node.marks : [];
-    for (const rawMark of marks) {
-      const mark = objectRecord(rawMark);
-      const markType = optionalString(mark.type);
-      if (markType === "code") text = `\`${text}\``;
-      if (markType === "strong") text = `**${text}**`;
-      if (markType === "em") text = `*${text}*`;
-      if (markType === "strike") text = `~~${text}~~`;
-      if (markType === "link") {
-        const href = optionalString(objectRecord(mark.attrs).href);
-        if (href) text = `[${text}](${href})`;
+function createFileUploadReaperActivities(services, options = {}) {
+  const graceMs = options.graceMs ?? FILE_UPLOAD_CLEANUP_GRACE_MS;
+  const claimTimeoutMs = options.claimTimeoutMs ?? FILE_UPLOAD_CLEANUP_CLAIM_TIMEOUT_MS;
+  const batchSize = options.batchSize ?? FILE_UPLOAD_CLEANUP_BATCH_SIZE;
+  const deleteObject = options.deleteObject ?? (async (storage, key) => storage.deleteObject(key));
+  const claimFileUploads = options.claimFileUploads ?? claimExpiredFileUploadCleanup;
+  const completeFileUpload = options.completeFileUpload ?? completeExpiredFileUploadCleanup;
+  const claimTranscriptionObjects = options.claimTranscriptionObjects ?? claimDueTranscriptionRecordingObjectCleanup;
+  const completeTranscriptionObject = options.completeTranscriptionObject ?? completeDueTranscriptionRecordingObjectCleanup;
+  const purgeTranscriptionRecordings = options.purgeTranscriptionRecordings ?? purgeExpiredTranscriptionRecordings;
+  async function reapExpiredFileUploads() {
+    const { db, objectStorage, observability } = await services();
+    if (!objectStorage) {
+      try {
+        await purgeTranscriptionRecordings(db, { graceMs, limit: batchSize });
+      } catch (error) {
+        observability.warn("expired transcription recording metadata purge failed", {
+          ...cleanupErrorAttributes(error)
+        });
       }
+      return { claimed: 0, deleted: 0, failed: 0 };
     }
-    return text;
-  }
-  if (type === "paragraph") return `${children}
-
-`;
-  if (type === "heading") {
-    const level = Math.min(Math.max(numberValue(objectRecord(node.attrs).level) ?? 2, 1), 6);
-    return `${"#".repeat(level)} ${children.trim()}
-
-`;
-  }
-  if (type === "hardBreak") return "  \n";
-  if (type === "rule") return "---\n\n";
-  if (type === "blockquote") {
-    return `${children.trim().split("\n").map((line) => `> ${line}`).join("\n")}
-
-`;
-  }
-  if (type === "bulletList") {
-    return `${children.trimEnd()}
-`;
-  }
-  if (type === "orderedList") {
-    return `${children.trimEnd()}
-`;
-  }
-  if (type === "listItem") {
-    return `- ${children.trim().replaceAll("\n", "\n  ")}
-`;
-  }
-  if (type === "codeBlock") return `\`\`\`
-${children.trimEnd()}
-\`\`\`
-
-`;
-  if (type === "mention") return `@${optionalString(objectRecord(node.attrs).text) ?? "user"}`;
-  if (type === "emoji") return optionalString(objectRecord(node.attrs).text) ?? "";
-  if (type === "inlineCard") {
-    const url = optionalString(objectRecord(node.attrs).url);
-    return url ? `[${url}](${url})` : "";
-  }
-  return children;
-}
-function objectRecord(value) {
-  return value && typeof value === "object" && !Array.isArray(value) ? value : {};
-}
-function requiredAtlassianString(value, label) {
-  if (typeof value !== "string" || !value.trim()) throw new Error(`invalid_atlassian_${label}`);
-  return value;
-}
-function deterministicUuid(value) {
-  const bytes = createHash2("sha256").update(value).digest().subarray(0, 16);
-  bytes[6] = bytes[6] & 15 | 80;
-  bytes[8] = bytes[8] & 63 | 128;
-  const hex = bytes.toString("hex");
-  return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20)}`;
-}
-function safeFilename(value) {
-  const normalized = value.normalize("NFKC").replace(/[\\/:*?"<>|\0-\x1f]/g, "_").trim();
-  return (normalized || "document").slice(0, 240);
-}
-function requiredString(value, label) {
-  if (typeof value !== "string" || !value.trim()) throw new Error(`invalid_google_drive_${label}`);
-  return value;
-}
-function optionalString(value) {
-  return typeof value === "string" && value.length > 0 ? value : null;
-}
-function numberValue(value) {
-  return typeof value === "number" && Number.isFinite(value) ? value : void 0;
-}
-function boundedError(error) {
-  return (error instanceof Error ? error.message : String(error)).slice(0, 1e3);
-}
-function entryMetadataHash(entry) {
-  return createHash2("sha256").update(
-    JSON.stringify({
-      externalObjectId: entry.externalObjectId,
-      externalVersionId: entry.externalVersionId,
-      title: entry.title,
-      mimeType: entry.mimeType,
-      driveId: entry.driveId,
-      modifiedTime: entry.modifiedTime,
-      createdTime: entry.createdTime,
-      sourceUri: entry.sourceUri
-    })
-  ).digest("hex");
-}
-function inventoryLimit(reason) {
-  if (reason === "api_request_limit") return "provider_requests";
-  if (reason === "elapsed_time_limit") return "elapsed_time";
-  if (reason === "item_limit") return "items";
-  if (reason === "known_byte_limit") return "bytes";
-  return null;
-}
-function recordSyncHealthTelemetry(observability, provider, summary, outcome, failure) {
-  observability.observeHistogram({
-    name: "opengeni_knowledge_source_sync_terminal_batch_duration_seconds",
-    help: "Terminal knowledge-source activity batch duration by provider and outcome.",
-    labels: { provider, outcome },
-    value: Math.max(0, summary.elapsedMs) / 1e3
-  });
-  if (summary.providerRequests > 0) {
-    observability.incrementCounter({
-      name: "opengeni_knowledge_source_sync_provider_requests_total",
-      help: "Logical provider requests consumed by knowledge-source synchronization.",
-      labels: { provider, outcome },
-      amount: summary.providerRequests
+    const claims = await claimFileUploads(db, {
+      graceMs,
+      claimTimeoutMs,
+      limit: batchSize
     });
-  }
-  if (summary.limitReached) {
-    observability.incrementCounter({
-      name: "opengeni_knowledge_source_sync_limit_hits_total",
-      help: "Knowledge-source synchronization runs stopped by an explicit resource budget.",
-      labels: { provider, limit: summary.limitReached }
+    let deleted = 0;
+    let failed = 0;
+    for (const claim of claims) {
+      try {
+        await deleteObject(objectStorage, claim.objectKey);
+        const settled = await completeFileUpload(db, claim);
+        if (!settled) {
+          throw new Error("cleanup claim no longer owns a reclaimable upload");
+        }
+        deleted += 1;
+      } catch (error) {
+        failed += 1;
+        observability.warn("expired file upload cleanup failed; claim remains reclaimable", {
+          workspaceId: claim.workspaceId,
+          uploadId: claim.uploadId,
+          fileId: claim.fileId,
+          ...cleanupErrorAttributes(error)
+        });
+      }
+    }
+    const recordingClaims = await claimTranscriptionObjects(db, {
+      graceMs,
+      claimTimeoutMs,
+      limit: batchSize
     });
+    for (const claim of recordingClaims) {
+      try {
+        await deleteObject(objectStorage, claim.objectKey);
+        const settled = await completeTranscriptionObject(db, claim);
+        if (!settled) {
+          throw new Error("cleanup claim no longer owns a transcription recording object");
+        }
+        deleted += 1;
+      } catch (error) {
+        failed += 1;
+        observability.warn(
+          "expired transcription recording object cleanup failed; claim remains reclaimable",
+          {
+            workspaceId: claim.workspaceId,
+            recordingId: claim.recordingId,
+            ...cleanupErrorAttributes(error)
+          }
+        );
+      }
+    }
+    let transcriptionRecordingsPurged = 0;
+    try {
+      transcriptionRecordingsPurged = await purgeTranscriptionRecordings(db, {
+        graceMs,
+        limit: batchSize
+      });
+    } catch (error) {
+      observability.warn("expired transcription recording metadata purge failed", {
+        ...cleanupErrorAttributes(error)
+      });
+    }
+    const claimed = claims.length + recordingClaims.length;
+    if (claimed > 0 || transcriptionRecordingsPurged > 0) {
+      observability.info("expired file upload cleanup swept", {
+        claimed,
+        deleted,
+        failed,
+        fileUploads: claims.length,
+        transcriptionRecordingObjects: recordingClaims.length,
+        transcriptionRecordingsPurged
+      });
+    }
+    return { claimed, deleted, failed };
   }
-  if (summary.reconnectRequired) {
-    observability.incrementCounter({
-      name: "opengeni_knowledge_source_sync_reconnect_required_total",
-      help: "Knowledge-source synchronization failures requiring connector reconnection.",
-      labels: { provider }
+  async function recoverVideoGenerationWorkflows() {
+    const { db, startVideoGenerationWorkflow, observability } = await services();
+    if (!startVideoGenerationWorkflow) return { claimed: 0, started: 0, failed: 0 };
+    const claims = await claimVideoGenerationOperations(db, {
+      owner: `video-workflow-recovery:${randomUUID()}`,
+      leaseSeconds: 120,
+      limit: 100
     });
-  }
-  if (failure) {
-    observability.incrementCounter({
-      name: "opengeni_knowledge_source_sync_failures_total",
-      help: "Knowledge-source synchronization terminal failures by bounded reason.",
-      labels: {
-        provider,
-        reason: failure.code,
-        retryable: failure.retryable ? "true" : "false"
+    let started = 0;
+    let failed = 0;
+    for (const claim of claims) {
+      try {
+        await startVideoGenerationWorkflow(claim);
+        started += 1;
+      } catch (error) {
+        failed += 1;
+        observability.warn("Video generation workflow recovery start failed", {
+          operationId: claim.operationId,
+          errorClass: error instanceof Error ? error.name : "UnknownError"
+        });
       }
-    });
-    observability.warn("Knowledge source sync failed", {
-      provider,
-      outcome: failure.retryable ? "retryable_failed" : "failed",
-      reason: failure.code,
-      durationMs: summary.elapsedMs
-    });
-    return;
+    }
+    return { claimed: claims.length, started, failed };
   }
-  observability.info("Knowledge source sync completed", {
-    provider,
-    outcome: "succeeded",
-    durationMs: summary.elapsedMs
-  });
+  return { reapExpiredFileUploads, recoverVideoGenerationWorkflows };
 }
-var SyncFailure = class extends Error {
-  constructor(code, retryable, reconnectRequired = false) {
-    super(code);
-    this.code = code;
-    this.retryable = retryable;
-    this.reconnectRequired = reconnectRequired;
-    this.name = "KnowledgeSourceSyncFailure";
-  }
-};
 
 // src/activities/retained-screenshot-reaper.ts
 import {
@@ -4037,7 +1030,7 @@ function createRigVerificationActivityLifecycle(context = currentActivityContext
       Math.max(1, startToCloseTimeoutMs - reserveMs)
     );
   }
-  const heartbeat2 = () => {
+  const heartbeat = () => {
     if (!context) return;
     try {
       context.heartbeat({
@@ -4050,13 +1043,13 @@ function createRigVerificationActivityLifecycle(context = currentActivityContext
       if (!controller.signal.aborted) controller.abort(error);
     }
   };
-  heartbeat2();
+  heartbeat();
   const heartbeatTimeoutMs = context?.info.heartbeatTimeoutMs;
   const heartbeatIntervalMs = typeof heartbeatTimeoutMs === "number" && heartbeatTimeoutMs > 0 ? Math.min(
     RIG_VERIFICATION_HEARTBEAT_MAX_INTERVAL_MS,
     Math.max(RIG_VERIFICATION_HEARTBEAT_MIN_INTERVAL_MS, Math.floor(heartbeatTimeoutMs / 3))
   ) : RIG_VERIFICATION_HEARTBEAT_MAX_INTERVAL_MS;
-  const heartbeatTimer = context ? setInterval(heartbeat2, heartbeatIntervalMs) : null;
+  const heartbeatTimer = context ? setInterval(heartbeat, heartbeatIntervalMs) : null;
   if (heartbeatTimer && "unref" in heartbeatTimer && typeof heartbeatTimer.unref === "function") {
     heartbeatTimer.unref();
   }
@@ -5188,7 +2181,7 @@ function createRigVerificationActivities(services) {
 }
 
 // src/activities/sandbox-lease.ts
-import { createHash as createHash3, randomUUID as randomUUID2 } from "crypto";
+import { createHash, randomUUID as randomUUID2 } from "crypto";
 import { retainedProviderCommandPersistence } from "@opengeni/db/retained-provider-commands";
 import { Context } from "@temporalio/activity";
 import { OpLostReason, OpState } from "@opengeni/agent-proto";
@@ -5231,7 +2224,7 @@ import {
   retainedProcessSettlementIdentity,
   settleClaimedConnectedMachineBackgroundCommand,
   settleSandboxCheckpointArtifactGc,
-  rlsContextForWorkspace as rlsContextForWorkspace2,
+  rlsContextForWorkspace,
   settleRetainedProcess
 } from "@opengeni/db";
 import {
@@ -5326,14 +2319,14 @@ function startSandboxReaperHeartbeat(details) {
   } catch {
     return () => void 0;
   }
-  const heartbeat2 = () => {
+  const heartbeat = () => {
     try {
       context.heartbeat({ ...details, heartbeatAt: (/* @__PURE__ */ new Date()).toISOString() });
     } catch {
     }
   };
-  heartbeat2();
-  const timer = setInterval(heartbeat2, SANDBOX_REAPER_ACTIVITY_HEARTBEAT_INTERVAL_MS);
+  heartbeat();
+  const timer = setInterval(heartbeat, SANDBOX_REAPER_ACTIVITY_HEARTBEAT_INTERVAL_MS);
   if ("unref" in timer && typeof timer.unref === "function") timer.unref();
   return () => clearInterval(timer);
 }
@@ -5348,7 +2341,7 @@ function sandboxDrainCaptureId(operationId, attempt) {
     throw new Error("Sandbox drain activity attempt is invalid");
   }
   if (attempt === 1) return operationId.toLowerCase();
-  const bytes = createHash3("sha256").update(`opengeni:sandbox-drain:${operationId.toLowerCase()}:${attempt}`).digest().subarray(0, 16);
+  const bytes = createHash("sha256").update(`opengeni:sandbox-drain:${operationId.toLowerCase()}:${attempt}`).digest().subarray(0, 16);
   bytes[6] = bytes[6] & 15 | 80;
   bytes[8] = bytes[8] & 63 | 128;
   const hex = bytes.toString("hex");
@@ -6745,7 +3738,7 @@ async function forceDrainOverLimitWorkspaces(db, settings, workspaceIds, observa
     SANDBOX_MAINTENANCE_ITEM_CONCURRENCY,
     async (workspaceId) => {
       try {
-        const { accountId } = await rlsContextForWorkspace2(db, workspaceId);
+        const { accountId } = await rlsContextForWorkspace(db, workspaceId);
         const balance = enforceBalance ? await getBillingBalance3(db, accountId) : { balanceMicros: 1 };
         const result = await forceDrainOverLimitViewerOnlyBoxes(db, {
           workspaceId,
@@ -6883,7 +3876,7 @@ function sandboxDrainReason(lease) {
   return lease.rotationReason ?? "rotation_requested";
 }
 async function terminateDrainableBox(db, settings, row, observability, terminateBox, probeDrainableProvider, attempt, objectStorage) {
-  const { accountId } = await rlsContextForWorkspace2(db, row.workspaceId);
+  const { accountId } = await rlsContextForWorkspace(db, row.workspaceId);
   const lease = await readLease(db, row.workspaceId, row.sandboxGroupId);
   if (!lease) {
     return false;
@@ -7491,12 +4484,11 @@ import {
   createSessionWithIdempotencyKeyResult,
   enqueueSessionWorkflowWakeIfRunnable,
   failScheduledGeneratedSessionRoute,
-  getScheduledTask as getScheduledTask2,
+  getScheduledTask,
   getScheduledTaskCreatorPolicy,
   getScheduledTaskRunAcceptedExecution,
   getScheduledTaskRunByProducerKey,
   getScheduledTargetSessionExecution,
-  ensureKnowledgeSourceSyncState,
   getScheduledTaskPersonalConnectionDelegations,
   getScheduledTaskRunPersonalResourceAuthority,
   getScheduledTaskPersonalResourceAuthoritySubject,
@@ -7517,14 +4509,12 @@ import {
   listInstalledApiIntegrationServerIdsForDelegations,
   markScheduledTaskRunFailedIfQueued,
   markScheduledTaskRunSkippedIfQueued,
-  recordKnowledgeSourceSyncWake,
-  recordUsageEvent as recordUsageEvent3,
+  recordUsageEvent as recordUsageEvent2,
   requireScheduledTaskIncidentAuthorityInTransaction,
   requireSession,
   requireWorkspace,
   settleScheduledTaskRunInTransaction,
   SessionSpawnDeniedDbError,
-  updateScheduledTaskRun as updateScheduledTaskRun2,
   updateSessionTitleWithEvent,
   upsertScheduledSessionGoalForRun,
   withSessionActivityRlsContext
@@ -7536,10 +4526,10 @@ import {
   resolveTurnExecutionPolicyV1 as resolveTurnExecutionPolicyV12
 } from "@opengeni/config";
 import { Context as Context2 } from "@temporalio/activity";
-import { createHash as createHash5 } from "crypto";
+import { createHash as createHash3 } from "crypto";
 
 // src/scheduled-alert-occurrence.ts
-import { createHash as createHash4 } from "crypto";
+import { createHash as createHash2 } from "crypto";
 var MAX_SCHEDULED_TASK_ID_BYTES = 256;
 var MAX_STARTS_AT_BYTES = 256;
 var MAX_PROVIDER_BYTES = 256;
@@ -7549,7 +4539,7 @@ var MAX_LABEL_KEY_BYTES = 256;
 var MAX_LABEL_VALUE_BYTES = 4096;
 var OFFSET_TIMESTAMP = /^(\d{4})-(\d{2})-(\d{2})T(\d{2}):(\d{2})(?::(\d{2})(?:\.(\d+))?)?(?:Z|[+-](\d{2}):(\d{2}))$/;
 function scheduledAlertResponderSessionCreateIdempotencyKey(input) {
-  const digest = createHash4("sha256").update(
+  const digest = createHash2("sha256").update(
     JSON.stringify({
       version: 1,
       occurrenceKey: input.occurrence.sessionCreateIdempotencyKey,
@@ -7575,7 +4565,7 @@ function scheduledAlertOccurrenceIdentity(input) {
     MAX_PROVIDER_BYTES
   );
   if (!provider) return null;
-  const digest = createHash4("sha256").update(
+  const digest = createHash2("sha256").update(
     JSON.stringify({
       version: 1,
       workspaceId: input.workspaceId,
@@ -7673,7 +4663,7 @@ function scheduledTaskRunProducerKey(input, suppliedActivityIdentity) {
   })}`;
 }
 function scheduledTaskGeneratedSessionCreateIdempotencyKey(producerKey) {
-  const digest = createHash5("sha256").update("scheduled-task-run\0", "utf8").update(producerKey, "utf8").digest("hex");
+  const digest = createHash3("sha256").update("scheduled-task-run\0", "utf8").update(producerKey, "utf8").digest("hex");
   return `scheduled-task-run:${digest}`;
 }
 function scheduledTaskSessionTitle(taskName) {
@@ -7784,73 +4774,19 @@ function createScheduledTaskActivities(services) {
           return scheduledRunTerminalResult(priorRun.error);
         }
       }
-      const task = await getScheduledTask2(db, input.workspaceId, input.taskId);
+      const task = await getScheduledTask(db, input.workspaceId, input.taskId);
       if (!task) {
         return { action: "deleted" };
       }
-      if (task.action.kind === "knowledge_source_sync") {
-        if (knowledgeSourceSyncEffectivelyPaused(task)) {
-          return { action: "blocked", reason: "knowledge_source_paused" };
-        }
-        const run = await createScheduledTaskRun(db, {
-          workspaceId: task.workspaceId,
-          taskId: task.id,
-          taskAuthorityRevision: task.authorityRevision,
-          taskExecutionDigest: task.executionDigest,
-          triggerType: input.triggerType,
-          producerKey: stableProducerKey,
-          scheduledAt: null
-        });
-        await ensureKnowledgeSourceSyncState(db, task);
-        await recordKnowledgeSourceSyncWake(db, {
-          accountId: task.accountId,
-          workspaceId: task.workspaceId,
-          sourceId: task.action.sourceId,
-          scheduledTaskId: task.id,
-          scheduledTaskRunId: run.id,
-          cause: input.triggerType,
-          producerKey: stableProducerKey,
-          sourceConfigGeneration: task.action.sourceConfigGeneration,
-          sourceLifecycleGeneration: task.action.sourceLifecycleGeneration
-        });
-        await recordUsageEvent3(db, {
-          accountId: task.accountId,
-          workspaceId: task.workspaceId,
-          eventType: "knowledge_source_sync.fired",
-          quantity: 1,
-          unit: "run",
-          sourceResourceType: "scheduled_task_run",
-          sourceResourceId: run.id,
-          initiator: input.initiator ?? {
-            kind: "service",
-            subjectId: "scheduler"
-          },
-          initiatorContext: {
-            scheduledTaskId: task.id,
-            scheduledTaskRunId: run.id
-          },
-          origin: "scheduled_task",
-          idempotencyKey: `usage:knowledge_source_sync.fired:${run.id}`
-        });
-        if (run.status === "queued") {
-          await updateScheduledTaskRun2(db, task.workspaceId, run.id, {
-            status: "dispatched",
-            actionKind: "knowledge_source_sync"
-          });
-        }
-        return {
-          action: "knowledge_source_sync",
-          accountId: task.accountId,
-          workspaceId: task.workspaceId,
-          taskId: task.id,
-          scheduledTaskRunId: run.id,
-          sourceId: task.action.sourceId,
-          overlapPolicy: task.overlapPolicy
-        };
+      if (task.action.kind !== "agent_turn") {
+        return { action: "blocked", reason: "legacy_source_schedule_requires_migration" };
       }
       if (task.status !== "active") {
         return { action: "blocked", reason: "scheduled_task_paused" };
       }
+      if (task.agentConfig.knowledgeSource && knowledgeSourceSyncEffectivelyPaused(task)) {
+        return { action: "blocked", reason: "knowledge_source_paused" };
+      }
       const structuredAlertOccurrence = scheduledAlertOccurrenceIdentity({
         workspaceId: task.workspaceId,
         scheduledTaskId: task.id,
@@ -8112,6 +5048,11 @@ function createScheduledTaskActivities(services) {
         throw new Error("scheduled authority classes have different causal humans");
       }
       const causalHumanSubjectId = taskAuthoritySubjectId ?? xaiAuthoritySubjectId;
+      if (task.agentConfig.knowledgeSource && causalHumanSubjectId !== task.agentConfig.knowledgeSource.initiatingSubjectId) {
+        throw new Error(
+          "Source schedule requires its connection owner's current human authorization; update the source schedule to authorize it"
+        );
+      }
       if ((acceptedVariableSet?.scope === "user" || acceptedRig?.scope === "user") && !causalHumanSubjectId) {
         throw new Error("scheduled personal-resource execution has no causal human");
       }
@@ -8256,7 +5197,7 @@ function createScheduledTaskActivities(services) {
           if (deferPublications) {
             return { kind: "replay", run, acceptedExecution };
           }
-          await recordUsageEvent3(dispatchDb, {
+          await recordUsageEvent2(dispatchDb, {
             accountId: task.accountId,
             workspaceId: task.workspaceId,
             eventType: "agent_run.created",
@@ -8354,6 +5295,10 @@ function createScheduledTaskActivities(services) {
                 firstPartyMcpTools,
                 firstPartyMcpPermissions,
                 ...creatorSessionPolicy,
+                ...task.agentConfig.knowledgeSource?.destination.kind === "personal" ? {
+                  visibility: "user_private",
+                  scheduledSourceRunId: run.id
+                } : {},
                 metadata: {
                   ...taskMetadata,
                   model,
@@ -8842,7 +5787,7 @@ function createScheduledTaskActivities(services) {
             run: { ...run, status: "failed", error: terminalError.code }
           };
         }
-        await recordUsageEvent3(dispatchDb, {
+        await recordUsageEvent2(dispatchDb, {
           accountId: task.accountId,
           workspaceId: task.workspaceId,
           eventType: "agent_run.created",
@@ -9062,7 +6007,7 @@ async function prepareIncidentTelemetrySource(input) {
 }
 async function recordScheduledTaskFiredUsage(db, acceptedExecution, run) {
   const task = acceptedExecution.task;
-  await recordUsageEvent3(db, {
+  await recordUsageEvent2(db, {
     accountId: task.accountId,
     workspaceId: task.workspaceId,
     eventType: "scheduled_task.fired",
@@ -9209,6 +6154,10 @@ async function recoverBoundScheduledTaskDispatch(input) {
       firstPartyMcpTools: input.acceptedExecution.resolvedFirstPartyMcpTools,
       firstPartyMcpPermissions: input.acceptedExecution.resolvedFirstPartyMcpPermissions,
       ...scheduledCreatorSessionPolicyInput(recoveredCreatorPolicy?.sessionPolicy ?? null),
+      ...task.agentConfig.knowledgeSource?.destination.kind === "personal" ? {
+        visibility: "user_private",
+        scheduledSourceRunId: input.run.id
+      } : {},
       metadata: {
         ...taskMetadata,
         model: input.acceptedExecution.resolvedModel,
@@ -9486,7 +6435,7 @@ async function recoverBoundScheduledTaskDispatch(input) {
       scheduledUpdate.events
     );
   }
-  await recordUsageEvent3(input.db, {
+  await recordUsageEvent2(input.db, {
     accountId: task.accountId,
     workspaceId: task.workspaceId,
     eventType: "agent_run.created",
@@ -9534,7 +6483,7 @@ async function replayScheduledTaskDispatch(input) {
   const sessionId = input.run.sessionId;
   const triggerEventId = input.run.triggerEventId;
   await requireSession(input.db, input.task.workspaceId, sessionId);
-  await recordUsageEvent3(input.db, {
+  await recordUsageEvent2(input.db, {
     accountId: input.task.accountId,
     workspaceId: input.task.workspaceId,
     eventType: "agent_run.created",
@@ -9904,14 +6853,14 @@ function createSessionStateActivities(services, overrides = {}) {
         return { action: "failed" };
       }
       const requestedRetryDelayMs = input.retryDelayMs;
-      const retryDelayMs2 = typeof requestedRetryDelayMs === "number" && Number.isFinite(requestedRetryDelayMs) ? Math.max(1e3, Math.min(6e4, Math.trunc(requestedRetryDelayMs))) : 6e4;
+      const retryDelayMs = typeof requestedRetryDelayMs === "number" && Number.isFinite(requestedRetryDelayMs) ? Math.max(1e3, Math.min(6e4, Math.trunc(requestedRetryDelayMs))) : 6e4;
       await enqueueSessionWorkflowWakeFn(db, {
         accountId: input.accountId,
         workspaceId: input.workspaceId,
         sessionId: input.sessionId,
         temporalWorkflowId: workflowId,
         reason: "turn_activity_failed_before_attempt_claim",
-        notBefore: new Date(Date.now() + retryDelayMs2)
+        notBefore: new Date(Date.now() + retryDelayMs)
       });
       return { action: "unclaimed" };
     }
@@ -10340,6 +7289,7 @@ function createControlActivitiesFromServices(services, resolveDocumentServices)
   return {
     ...createAutomationActivities(services),
     ...createDocumentActivities(services, resolveDocumentServices),
+    ...createKnowledgeIndexingActivities(services, resolveDocumentServices),
     ...createKnowledgeSourceSyncActivities(services, resolveDocumentServices),
     ...createSessionStateActivities(services),
     ...createScheduledTaskActivities(services),
@@ -10369,4 +7319,4 @@ export {
   createControlActivities,
   createControlActivitiesFromServices
 };
-//# sourceMappingURL=activities-control-MKGEOBXT.js.map
+//# sourceMappingURL=activities-control-HMFGSKC5.js.map