@opengeni/worker-bundle 0.29.0-canary.0 → 0.29.0-canary.2

package/dist/{chunk-OA5CSY5N.js → chunk-CYITU5UH.js}

@@ -246,7 +246,7 @@ function exactRequestedRepositories(refs, credentialBindingId, snapshots) {
 // src/pr-review-credentials.ts
 import { environmentsEncryptionKeyBytes } from "@opengeni/config";
 import { prReviewRegistrationIdFromCredentialBinding } from "@opengeni/core";
-import { createRemoteMcpCredentialsPort } from "@opengeni/core/remote-mcp-credentials";
+import { createNativeRemoteMcpCredentialsPort } from "@opengeni/core/remote-mcp-credentials";
 import { decryptVariableSetValue, resolvePrReviewGitCredential } from "@opengeni/db";
 import {
   createGitHubAppInstallationTokenWithExpiry,
@@ -254,7 +254,7 @@ import {
 } from "@opengeni/github";
 function createStandaloneConnectionCredentialsPort(settings, db) {
   return {
-    ...createRemoteMcpCredentialsPort(settings),
+    ...createNativeRemoteMcpCredentialsPort(settings, db),
     gitCredentials: async (request) => await resolveStandaloneGitCredentials(settings, db, request)
   };
 }
@@ -1115,6 +1115,82 @@ function createCodexCapacityActivities(services) {
   return { getCodexCapacityWait, reconcileCodexCapacityWait };
 }
 
+// src/activities/documents.ts
+import {
+  resolveDocumentIndexAuthority,
+  rlsContextForWorkspace,
+  withSessionRlsActorContext,
+  withWorkspaceUsageLock
+} from "@opengeni/db";
+function createDocumentActivities(services, resolveDocumentServices) {
+  return {
+    indexDocument: async (input) => {
+      const { db, objectStorage } = await services();
+      if (!objectStorage) {
+        throw new Error("object storage is not configured");
+      }
+      if (!resolveDocumentServices) {
+        throw new Error("document services are not configured");
+      }
+      const [{ getDocumentForIndexing, indexDocumentNow }, documentServices] = await Promise.all([
+        import("@opengeni/documents"),
+        resolveDocumentServices()
+      ]);
+      const context = await rlsContextForWorkspace(db, input.workspaceId);
+      if (context.accountId !== input.accountId) {
+        throw new Error("document account/workspace authority mismatch");
+      }
+      return await withWorkspaceUsageLock(db, input.workspaceId, async (lockedDb) => {
+        const storedAuthority = await resolveDocumentIndexAuthority(lockedDb, input);
+        if (!storedAuthority) {
+          throw new Error("document authority was not found before indexing");
+        }
+        const suppliedAuthorityFields = [
+          "authorityKind",
+          "authorityWorkspaceId",
+          "authoritySubjectId"
+        ];
+        const suppliedCount = suppliedAuthorityFields.filter(
+          (field) => Object.prototype.hasOwnProperty.call(input, field)
+        ).length;
+        const suppliedMismatch = Object.prototype.hasOwnProperty.call(input, "authorityKind") && input.authorityKind !== storedAuthority.authorityKind || Object.prototype.hasOwnProperty.call(input, "authorityWorkspaceId") && input.authorityWorkspaceId !== storedAuthority.authorityWorkspaceId || Object.prototype.hasOwnProperty.call(input, "authoritySubjectId") && input.authoritySubjectId !== storedAuthority.authoritySubjectId;
+        if (suppliedMismatch) {
+          throw new Error("document authority changed before indexing");
+        }
+        if (suppliedCount !== 0 && suppliedCount !== suppliedAuthorityFields.length) {
+          throw new Error("document authority tuple is partial");
+        }
+        const claimedDocument = await getDocumentForIndexing(
+          lockedDb,
+          input.workspaceId,
+          input.documentId
+        );
+        if (!claimedDocument || claimedDocument.authorityKind !== storedAuthority.authorityKind || claimedDocument.authorityWorkspaceId !== storedAuthority.authorityWorkspaceId || claimedDocument.authoritySubjectId !== storedAuthority.authoritySubjectId) {
+          throw new Error("document authority changed before indexing");
+        }
+        const document = await withSessionRlsActorContext(
+          {
+            subjectId: "service:document-preparation",
+            privateFileOwnerSubjectId: storedAuthority.authorityKind === "personal" ? storedAuthority.authoritySubjectId : null
+          },
+          () => indexDocumentNow(
+            lockedDb,
+            objectStorage,
+            input.workspaceId,
+            input.documentId,
+            documentServices,
+            { viewerSubjectId: storedAuthority.authoritySubjectId }
+          )
+        );
+        if (document.authorityKind !== storedAuthority.authorityKind || document.authorityWorkspaceId !== storedAuthority.authorityWorkspaceId || document.authoritySubjectId !== storedAuthority.authoritySubjectId) {
+          throw new Error("document authority changed before indexing");
+        }
+        return document;
+      });
+    }
+  };
+}
+
 // src/activities/goals.ts
 import {
   allowedFirstPartyMcpToolsForSession,
@@ -1226,187 +1302,3282 @@ function createGoalActivities(services) {
       latencyMode: continuationLatencyMode,
       latencyModeSource: "continuation"
     });
-    const decision = await materializeGoalContinuation(db, {
-      accountId: input.accountId,
-      workspaceId: input.workspaceId,
-      sessionId: input.sessionId,
-      workflowId: input.workflowId,
-      defaultMaxAutoContinuations: settings.goalMaxAutoContinuations ?? null,
-      // Pacing between consecutive no-input continuations (never a cap). The
-      // materializer re-arms a delayed outbox wake and returns `deferred`.
-      idleBackoff: {
-        scheduleMs: settings.goalIdleBackoffMs,
-        maxMs: settings.goalIdleBackoffMaxMs
-      },
-      // A model-policy block takes precedence: it is deterministic (a budget
-      // pause can clear on its own; a policy pause needs a model/policy change)
-      // and rides the same visible-pause channel.
-      budgetBlocked: modelPolicyBlocked ?? budgetBlocked,
-      policy: {
-        model: continuationModel,
-        reasoningEffort: continuationReasoningEffort,
-        latencyMode: continuationLatencyMode,
-        turnExecutionPolicy,
-        tools: withFirstPartyTools(settings, session.tools),
-        sandboxBackend: session.sandboxBackend
-      },
-      // Long-wait guidance is only given when `wait_for_input` is actually in this
-      // session's effective first-party selection (the same source the worker
-      // signs into the delegated token and the API uses to register tools), so
-      // a pre-existing narrowed selection is never told to call a missing tool.
-      prompt: (goal, autoContinuation, cap) => {
-        const effectiveFirstPartyTools = allowedFirstPartyMcpToolsForSession(
-          settings,
-          session.firstPartyMcpTools
-        );
-        return goalContinuationPrompt(goal, autoContinuation, cap, {
-          inputWaitAvailable: effectiveFirstPartyTools.includes("wait_for_input"),
-          humanInputRespondAvailable: effectiveFirstPartyTools.includes(
-            "session_human_input_respond"
-          )
-        });
+    const decision = await materializeGoalContinuation(db, {
+      accountId: input.accountId,
+      workspaceId: input.workspaceId,
+      sessionId: input.sessionId,
+      workflowId: input.workflowId,
+      defaultMaxAutoContinuations: settings.goalMaxAutoContinuations ?? null,
+      // Pacing between consecutive no-input continuations (never a cap). The
+      // materializer re-arms a delayed outbox wake and returns `deferred`.
+      idleBackoff: {
+        scheduleMs: settings.goalIdleBackoffMs,
+        maxMs: settings.goalIdleBackoffMaxMs
+      },
+      // A model-policy block takes precedence: it is deterministic (a budget
+      // pause can clear on its own; a policy pause needs a model/policy change)
+      // and rides the same visible-pause channel.
+      budgetBlocked: modelPolicyBlocked ?? budgetBlocked,
+      policy: {
+        model: continuationModel,
+        reasoningEffort: continuationReasoningEffort,
+        latencyMode: continuationLatencyMode,
+        turnExecutionPolicy,
+        tools: withFirstPartyTools(settings, session.tools),
+        sandboxBackend: session.sandboxBackend
+      },
+      // Long-wait guidance is only given when `wait_for_input` is actually in this
+      // session's effective first-party selection (the same source the worker
+      // signs into the delegated token and the API uses to register tools), so
+      // a pre-existing narrowed selection is never told to call a missing tool.
+      prompt: (goal, autoContinuation, cap) => {
+        const effectiveFirstPartyTools = allowedFirstPartyMcpToolsForSession(
+          settings,
+          session.firstPartyMcpTools
+        );
+        return goalContinuationPrompt(goal, autoContinuation, cap, {
+          inputWaitAvailable: effectiveFirstPartyTools.includes("wait_for_input"),
+          humanInputRespondAvailable: effectiveFirstPartyTools.includes(
+            "session_human_input_respond"
+          )
+        });
+      }
+    });
+    if (decision.events.length > 0) {
+      await bus.publish(input.workspaceId, input.sessionId, decision.events);
+    }
+    return { action: decision.action };
+  }
+  return {
+    enqueueGoalRetryWake,
+    maybeContinueGoal
+  };
+}
+function goalContinuationModelDecision(input) {
+  const catalogSettings = input.settings.supergrokSubscriptionEnabled ? withXaiSubscriptionCatalogProvider(
+    input.settings.codexSubscriptionEnabled ? withCodexCatalogProvider(input.settings) : input.settings
+  ) : input.settings.codexSubscriptionEnabled ? withCodexCatalogProvider(input.settings) : input.settings;
+  const policyBlocks = (modelId) => input.workspaceModelPolicy !== null && !evaluateWorkspaceModelPolicy(input.workspaceModelPolicy, {
+    providerId: policyProviderIdForModel(catalogSettings, modelId),
+    modelId
+  }).allowed;
+  if (resolveModelProvider(catalogSettings, input.inheritedModel) && !policyBlocks(input.inheritedModel)) {
+    return { model: input.inheritedModel, blocked: null };
+  }
+  if (!resolveModelProvider(catalogSettings, input.inheritedModel)) {
+    return {
+      model: input.inheritedModel,
+      blocked: `model "${input.inheritedModel}" is no longer in the deployment or workspace catalog; choose an available model before resuming the goal`
+    };
+  }
+  return {
+    model: input.inheritedModel,
+    blocked: `workspace model policy blocks model "${input.inheritedModel}"; pick an allowed model or change the workspace model policy`
+  };
+}
+function goalContinuationFundedWithoutCredits(settings, model, codexBilled) {
+  return modelFundingForAdmission(settings, model, codexBilled).fundedWithoutCredits;
+}
+function goalContinuationPrompt(_goal, _autoContinuation, _cap, options = {}) {
+  const waitingGuidance = options.inputWaitAvailable ? [
+    "Waiting on child sessions, background commands, or external events:",
+    "- When further progress depends on work already in flight, do not sleep, loop, or poll session or command state repeatedly.",
+    "- Re-check once; if the work is still in flight and the wait is long or uncertain, call opengeni__wait_for_input with a concrete reason and timeoutSeconds, then end your turn immediately. Relevant session input or the safety deadline will start a new turn, and this goal stays active.",
+    "- If the immediately preceding user-facing update already reported this same unchanged wait, do not restate it or produce another equivalent final answer. Call opengeni__wait_for_input and end the turn. Report only material new state or a newly discovered blocker.",
+    "- If you are blocked on a human decision, use opengeni__goal_pause under the blocked audit below instead.",
+    ""
+  ] : [];
+  const childNoticeGuidance = [
+    "Child lifecycle notices:",
+    "- A `child_requires_action` update means a worker you spawned is blocked on a question or a tool approval and will not progress until it is answered. " + (options.humanInputRespondAvailable ? "If you know the answer to its question, answer it with opengeni__session_human_input_respond (pass the worker's sessionId, the requestId from the notice, and a response). " : "") + "Tool approvals can only be decided by a human. If you cannot resolve the blocker yourself, report the exact blocker (worker session id, the question) to the user and wait or pause instead of retrying the worker.",
+    "- `child_requires_action_resolved`, `child_paused`, `child_waiting_capacity`, and `child_progress` updates are informational: a resolved notice means the worker is moving again; a paused worker needs a human or you to resume it; a capacity wait resumes by itself; a progress note needs no action.",
+    ""
+  ];
+  return [
+    "Reconcile the active session goal against authoritative current state, then carry the work through to the full requested end state and verify it.",
+    "",
+    "Goal recovery:",
+    "- Treat this continuation as re-entry into the full objective, not as a request to perform one step and stop.",
+    "- Do not rely on previous assistant claims of progress or completion; use them only to locate authoritative evidence.",
+    "- If authoritative evidence already proves the full objective, call opengeni__goal_complete instead of manufacturing more work.",
+    "- Before repeating a state-setting action, verify whether its desired state already holds. If it does, do not repeat it; continue reconciling the overall goal.",
+    "",
+    "Continuation behavior:",
+    "- This goal persists across turns. A runtime boundary can end one turn without shrinking the objective; the next continuation resumes the same full objective.",
+    "- Keep working until the requested end state is true and verified. Do not end the turn merely because one useful action completed, and do not redefine success around a smaller or easier task.",
+    "- An incomplete-status report is not a substitute for continuing the work. If the remaining problem can be investigated or addressed within your current authority, continue that work in this turn rather than returning another equivalent status-only final.",
+    "- Distinguish unfinished work from a blocker that actually requires human input or external change; use the existing waiting and blocked audits only when their conditions hold.",
+    "- Temporary rough edges are acceptable while the work is moving in the right direction. Completion still requires the requested end state to be true and verified.",
+    "",
+    "Work from evidence:",
+    "Use the current workspace and external state as authoritative. Conversation context can help locate relevant work, but it is not proof of the current state. Inspect the current state before relying on it. Improve, replace, or remove existing work as needed to satisfy the actual objective.",
+    "",
+    "Progress visibility:",
+    "If a planning tool is available and the next work is meaningfully multi-step, use it to show a concise plan tied to the real objective. Keep the plan current as steps complete or the next best action changes. Skip planning overhead for trivial one-step progress, and do not treat a plan update as a substitute for doing the work.",
+    "",
+    "Fidelity:",
+    "- Optimize each turn for movement toward the requested end state, not for the smallest stable-looking subset or easiest passing change.",
+    "- Do not substitute a narrower, safer, smaller, merely compatible, or easier-to-test solution because it is more likely to pass current tests.",
+    "- Treat alignment as movement toward the requested end state. An edit is aligned only if it makes the requested final state more true; useful-looking behavior that preserves a different end state is misaligned.",
+    "",
+    "Completion audit:",
+    "Before deciding that the goal is achieved, treat completion as unproven and verify it against the actual current state:",
+    "- Derive concrete requirements from the objective and any referenced files, plans, specifications, issues, or user instructions.",
+    "- Preserve the original scope; do not redefine success around the work that already exists.",
+    "- For every explicit requirement, named artifact, command, test, gate, invariant, and deliverable, identify and inspect the authoritative evidence that would prove it.",
+    "- Match verification scope to requirement scope. Treat uncertain, indirect, incomplete, or missing evidence as not achieved and continue working.",
+    "- The audit must prove completion, not merely fail to find obvious remaining work.",
+    "",
+    "Do not rely on intent, partial progress, memory of earlier work, or a plausible final answer as proof of completion. Call opengeni__goal_complete with concrete evidence only when the full objective is actually achieved and no required work remains.",
+    "",
+    ...waitingGuidance,
+    ...childNoticeGuidance,
+    "Blocked audit:",
+    "- Do not call opengeni__goal_pause the first time a blocker appears.",
+    "- Pause only when the same blocking condition has repeated for at least three consecutive goal turns and meaningful progress is impossible without user input or an external-state change.",
+    "- Do not pause merely because the work is hard, slow, uncertain, incomplete, or would benefit from clarification.",
+    "- Once that threshold is satisfied, call opengeni__goal_pause with the concrete blocker instead of repeatedly reporting it while leaving the goal active.",
+    "",
+    "Do not call opengeni__goal_complete or opengeni__goal_pause unless the corresponding audit above is satisfied."
+  ].join("\n");
+}
+function withFirstPartyTools(settings, tools) {
+  if (!settings.mcpServers.some((server) => server.id === "opengeni")) {
+    return tools;
+  }
+  return mergeToolRefs(tools, [{ kind: "mcp", id: "opengeni" }]);
+}
+async function goalRunBudgetBlocked(settings, db, accountId, workspaceId, fundedWithoutCredits) {
+  if (!fundedWithoutCredits && (settings.billingMode === "stripe" || settings.usageLimitsMode === "managed")) {
+    const balance = await getBillingBalance(db, accountId);
+    if (balance.balanceMicros <= 0) {
+      return "insufficient OpenGeni credits";
+    }
+  }
+  if (settings.usageLimitsMode === "static" || settings.usageLimitsMode === "managed") {
+    const limits = configuredStaticUsageLimits(settings);
+    if (!fundedWithoutCredits && limits.maxMonthlyCostMicrosPerAccount) {
+      const used = await sumUsageQuantity(db, {
+        accountId,
+        eventType: "model.cost",
+        since: startOfUtcMonth()
+      });
+      if (used >= limits.maxMonthlyCostMicrosPerAccount) {
+        return `monthly model cost limit reached (${limits.maxMonthlyCostMicrosPerAccount} micros)`;
+      }
+    }
+    if (limits.maxMonthlyAgentRunsPerWorkspace) {
+      const used = await sumUsageQuantity(db, {
+        workspaceId,
+        eventType: "agent_run.created",
+        since: startOfUtcMonth()
+      });
+      if (used + 1 > limits.maxMonthlyAgentRunsPerWorkspace) {
+        return `monthly agent run limit reached (${limits.maxMonthlyAgentRunsPerWorkspace})`;
+      }
+    }
+  }
+  return null;
+}
+function startOfUtcMonth() {
+  const now = /* @__PURE__ */ new Date();
+  return new Date(Date.UTC(now.getUTCFullYear(), now.getUTCMonth(), 1));
+}
+
+// src/activities/knowledge-source-sync.ts
+import { isDeepStrictEqual as isDeepStrictEqual2 } from "util";
+import { AsyncLocalStorage } from "async_hooks";
+import { scheduledTaskKnowledgeSource } from "@opengeni/contracts";
+import {
+  freezeAgentLearningPolicy,
+  getScheduledTaskRunAcceptedExecution,
+  ensureKnowledgeSourceSyncState,
+  recordKnowledgeSourceSyncWake
+} from "@opengeni/db";
+import { createHash as createHash2 } from "crypto";
+import { heartbeat } from "@temporalio/activity";
+import {
+  googleDriveProviderRetryOptions
+} from "@opengeni/config";
+import {
+  KnowledgeSourceSyncRunSummary
+} from "@opengeni/contracts";
+import {
+  ATLASSIAN_PROVIDER_DOMAIN,
+  AtlassianConnectionMetadata,
+  atlassianScopesAllowRead
+} from "@opengeni/contracts/atlassian";
+import {
+  GoogleDriveConnectionMetadata,
+  GOOGLE_DRIVE_PROVIDER_DOMAIN,
+  googleDriveScopesAllowCapability
+} from "@opengeni/contracts/google-drive";
+import {
+  googleDriveKnowledgeScope,
+  inventoryGoogleDriveSource
+} from "@opengeni/documents/google-drive";
+import {
+  atlassianKnowledgeScope,
+  inventoryAtlassianSource
+} from "@opengeni/documents/atlassian";
+import { addDocumentToBase, ensureDefaultBase, getDocumentBase } from "@opengeni/documents";
+import {
+  appendKnowledgeDocumentVersion,
+  appendKnowledgeSourceAclVersion,
+  beginKnowledgeSyncRun,
+  beginGoogleDriveObjectAclRefresh,
+  buildConnectionTokenResolver,
+  checkpointKnowledgeSourceSync,
+  claimKnowledgeSourceSyncLease,
+  compareCanonicalDecimalProviderRevisions,
+  completeKnowledgeSyncRun,
+  completeKnowledgeSourceSyncWakeWithoutLease,
+  deauthorizeKnowledgeSourceRetrieval,
+  enqueueKnowledgeSourceSyncIndexObligation,
+  ensureKnowledgeSourceBlobFile,
+  getConnectionMetadata as getConnectionMetadata2,
+  getKnowledgeDocumentVersionObservationForSyncAuthority,
+  getKnowledgeSyncRunForSyncAuthority,
+  getKnowledgeSourceAclForSyncAuthority,
+  getKnowledgeSourceForSyncAuthority,
+  getKnowledgeSourceObjectForSyncAuthority,
+  getKnowledgeSourceSyncIndexObligationForVersion,
+  getScheduledTask,
+  listObservedKnowledgeSourceSyncExternalObjectIds,
+  KnowledgeSourceSyncObservationFenceError,
+  reconcileKnowledgeSourceSyncCompleteScan,
+  reconcileKnowledgeSourceSyncLiveGeneration,
+  recordGoogleDriveObjectAclEvidence,
+  recordKnowledgeSourceSyncItemOutcomes,
+  recordKnowledgeSourceSyncObjectObservations,
+  recordUsageEvent,
+  releaseKnowledgeSourceSyncLeaseForRetry,
+  restoreKnowledgeSourceObject,
+  retryKnowledgeSourceSyncIndexObligation,
+  scopedKnowledgeScopeKey,
+  settleKnowledgeSourceSyncLease,
+  settleKnowledgeSourceSyncIndexObligation,
+  updateKnowledgeSourceDocumentObservationMetadata,
+  updateScheduledTaskRun,
+  upsertKnowledgeSourceObject
+} from "@opengeni/db";
+import { readResponseJsonBounded } from "@opengeni/network";
+
+// src/activities/google-drive-provider.ts
+var GoogleDriveProviderTransportError = class extends Error {
+  constructor() {
+    super("google_drive_provider_transport_failed");
+    this.name = "GoogleDriveProviderTransportError";
+  }
+};
+async function fetchGoogleDriveProvider(input) {
+  const now = input.now ?? Date.now;
+  const sleep3 = input.sleep ?? Bun.sleep;
+  let retryDelaySpentMs = 0;
+  for (let attempt = 1; attempt <= input.policy.attempts; attempt += 1) {
+    let response;
+    input.heartbeat?.({ operation: input.operation, attempt, phase: "request_start" });
+    try {
+      response = await input.fetchImpl(input.url, {
+        ...input.init,
+        redirect: "error",
+        signal: AbortSignal.timeout(input.policy.requestTimeoutMs)
+      });
+    } catch {
+      input.heartbeat?.({ operation: input.operation, attempt, phase: "request_end" });
+      recordRequest(input.observability, input.operation, "retryable_error");
+      const delayMs2 = retryDelayMs(input.policy, attempt, null);
+      if (!canRetry(input.policy, attempt, retryDelaySpentMs, delayMs2)) {
+        throw new GoogleDriveProviderTransportError();
+      }
+      recordRetry(input.observability, input.operation, "transport", attempt, delayMs2);
+      retryDelaySpentMs += delayMs2;
+      input.heartbeat?.({ operation: input.operation, attempt, phase: "retry_delay_start" });
+      await sleep3(delayMs2);
+      input.heartbeat?.({ operation: input.operation, attempt, phase: "retry_delay_end" });
+      continue;
+    }
+    input.heartbeat?.({ operation: input.operation, attempt, phase: "request_end" });
+    if (!isRetryableStatus(response.status)) {
+      recordRequest(
+        input.observability,
+        input.operation,
+        response.ok ? "succeeded" : "terminal_error"
+      );
+      return response;
+    }
+    recordRequest(input.observability, input.operation, "retryable_error");
+    const delayMs = retryDelayMs(
+      input.policy,
+      attempt,
+      retryAfterDelayMs(response.headers.get("retry-after"), now())
+    );
+    if (!canRetry(input.policy, attempt, retryDelaySpentMs, delayMs)) return response;
+    await response.body?.cancel().catch(() => void 0);
+    recordRetry(
+      input.observability,
+      input.operation,
+      response.status === 429 ? "rate_limited" : "provider_unavailable",
+      attempt,
+      delayMs
+    );
+    retryDelaySpentMs += delayMs;
+    input.heartbeat?.({ operation: input.operation, attempt, phase: "retry_delay_start" });
+    await sleep3(delayMs);
+    input.heartbeat?.({ operation: input.operation, attempt, phase: "retry_delay_end" });
+  }
+  throw new GoogleDriveProviderTransportError();
+}
+function canRetry(policy, attempt, retryDelaySpentMs, delayMs) {
+  return attempt < policy.attempts && retryDelaySpentMs + delayMs <= policy.budgetMs;
+}
+function retryDelayMs(policy, attempt, retryAfterMs) {
+  const exponential = Math.min(
+    policy.maxDelayMs,
+    policy.initialDelayMs * 2 ** Math.max(0, attempt - 1)
+  );
+  return Math.min(policy.maxDelayMs, Math.max(exponential, retryAfterMs ?? 0));
+}
+function retryAfterDelayMs(value, nowMs) {
+  if (!value) return null;
+  const seconds = Number(value);
+  if (Number.isFinite(seconds) && seconds >= 0) return Math.round(seconds * 1e3);
+  const timestamp = Date.parse(value);
+  return Number.isFinite(timestamp) ? Math.max(0, timestamp - nowMs) : null;
+}
+function isRetryableStatus(status) {
+  return status === 429 || status >= 500;
+}
+function recordRequest(observability, operation, outcome) {
+  observability.incrementCounter({
+    name: "opengeni_google_drive_provider_requests_total",
+    help: "Google Drive provider request attempts by operation and bounded outcome.",
+    labels: { operation, outcome }
+  });
+}
+function recordRetry(observability, operation, reason, attempt, delayMs) {
+  observability.incrementCounter({
+    name: "opengeni_google_drive_provider_retries_total",
+    help: "Bounded Google Drive provider retries by operation and reason.",
+    labels: { operation, reason }
+  });
+  observability.observeHistogram({
+    name: "opengeni_google_drive_provider_retry_delay_seconds",
+    help: "Delay applied before a bounded Google Drive provider retry.",
+    labels: { operation, reason },
+    value: delayMs / 1e3,
+    buckets: [0.1, 0.25, 0.5, 1, 2, 5, 10, 30, 60]
+  });
+  observability.warn("Google Drive provider request retry scheduled", {
+    provider: "google_drive",
+    operation,
+    outcome: "retry_scheduled",
+    reason,
+    attempt,
+    delayMs
+  });
+}
+
+// src/activities/google-drive-changes.ts
+import { createHash } from "crypto";
+import {
+  GOOGLE_DRIVE_FOLDER_MIME_TYPE,
+  planGoogleDriveTransfer
+} from "@opengeni/documents/google-drive";
+var MAX_TOKEN_CHARS = 4096;
+var MAX_BOUNDARY_ID_CHARS = 1024;
+var MAX_ANCESTOR_DEPTH = 100;
+function parseGoogleDriveChangesCursor(value, expected) {
+  if (!value || value.version !== 1 || value.kind !== "google_drive_changes") return null;
+  if (value.connectionId !== expected.connectionId || value.googlePermissionId !== expected.googlePermissionId || value.sourceId !== expected.sourceId || value.driveId !== expected.driveId || typeof value.boundaryId !== "string" || value.boundaryId.length < 1 || value.boundaryId.length > MAX_BOUNDARY_ID_CHARS || typeof value.pageToken !== "string" || value.pageToken.length < 1 || value.pageToken.length > MAX_TOKEN_CHARS || typeof value.cursorGeneration !== "number" || !Number.isSafeInteger(value.cursorGeneration) || value.cursorGeneration < 1 || typeof value.lastFullReconciliationAt !== "string" || !Number.isFinite(Date.parse(value.lastFullReconciliationAt)) || typeof value.nextFullReconciliationAt !== "string" || !Number.isFinite(Date.parse(value.nextFullReconciliationAt))) {
+    return null;
+  }
+  return value;
+}
+function buildGoogleDriveChangesCursor(input) {
+  return {
+    version: 1,
+    kind: "google_drive_changes",
+    connectionId: input.connectionId,
+    googlePermissionId: input.googlePermissionId,
+    sourceId: input.sourceId,
+    driveId: input.driveId,
+    boundaryId: boundedBoundaryId(input.boundaryId),
+    pageToken: boundedToken(input.pageToken),
+    cursorGeneration: input.previousGeneration + 1,
+    lastFullReconciliationAt: input.reconciledAt.toISOString(),
+    nextFullReconciliationAt: new Date(
+      input.reconciledAt.getTime() + input.fullReconciliationIntervalMs
+    ).toISOString()
+  };
+}
+function advanceGoogleDriveChangesCursor(cursor, pageToken) {
+  return {
+    ...cursor,
+    pageToken: boundedToken(pageToken),
+    cursorGeneration: cursor.cursorGeneration + 1
+  };
+}
+function googleDriveFullReconciliationDue(cursor, now) {
+  return Date.parse(cursor.nextFullReconciliationAt) <= now.getTime();
+}
+async function resolveGoogleDriveChangesBoundaryId(input) {
+  if (input.source.id !== "root" || input.source.driveId !== null) {
+    return boundedBoundaryId(input.source.id);
+  }
+  const root = await input.getFile("root");
+  if (!root || root.mimeType !== GOOGLE_DRIVE_FOLDER_MIME_TYPE || root.trashed) {
+    throw new GoogleDriveChangesProtocolError("google_drive_root_boundary_invalid");
+  }
+  return boundedBoundaryId(root.id);
+}
+function parseGoogleDriveChangesCheckpoint(value, limits) {
+  try {
+    return validatedCheckpoint(value, limits);
+  } catch {
+    return null;
+  }
+}
+async function drainGoogleDriveChanges(input) {
+  const now = input.now ?? Date.now;
+  const startedAt = now();
+  const checkpoint = input.checkpoint ? validatedCheckpoint(input.checkpoint, input) : null;
+  let pageToken = boundedToken(checkpoint?.pageToken ?? input.cursor.pageToken);
+  let requiresFullReconciliation = checkpoint?.requiresFullReconciliation ?? false;
+  const seenPageTokenHashes = new Set(checkpoint?.seenPageTokenHashes ?? []);
+  const initialBudget = checkpoint?.budget ?? emptyBudget();
+  const budget = { ...initialBudget };
+  const entries = /* @__PURE__ */ new Map();
+  while (true) {
+    const invocationElapsedMs = Math.max(0, now() - startedAt);
+    budget.elapsedMs = initialBudget.elapsedMs + invocationElapsedMs;
+    const stopReason = limitReason(budget, input, invocationElapsedMs);
+    if (stopReason) {
+      return {
+        status: "paused",
+        stopReason,
+        entries: [...entries.values()],
+        checkpoint: {
+          version: 2,
+          pageToken,
+          requiresFullReconciliation,
+          seenPageTokenHashes: [...seenPageTokenHashes],
+          budget: { ...budget }
+        },
+        newStartPageToken: null,
+        requiresFullReconciliation,
+        providerRequests: budget.providerRequests,
+        elapsedMs: budget.elapsedMs,
+        budget: { ...budget },
+        hardLimitReached: stopReason !== "elapsed_time_limit" || budget.elapsedMs >= input.maxElapsedMs
+      };
+    }
+    const pageTokenHash = createHash("sha256").update(pageToken).digest("hex");
+    if (seenPageTokenHashes.has(pageTokenHash)) {
+      throw new GoogleDriveChangesProtocolError("google_drive_changes_page_token_cycle");
+    }
+    seenPageTokenHashes.add(pageTokenHash);
+    budget.providerRequests += 1;
+    const pageSize = Math.min(100, input.maxItems - budget.examinedItems);
+    let page;
+    try {
+      page = await input.listChanges(pageToken, pageSize);
+    } catch (error) {
+      budget.elapsedMs = initialBudget.elapsedMs + Math.max(0, now() - startedAt);
+      if (error instanceof GoogleDriveCursorInvalidError) error.budget = { ...budget };
+      throw error;
+    }
+    if (page.changes.length > pageSize) {
+      throw new GoogleDriveChangesProtocolError("google_drive_changes_page_exceeds_item_budget");
+    }
+    budget.examinedItems += page.changes.length;
+    const repairCandidates = /* @__PURE__ */ new Set();
+    for (const change of page.changes) {
+      if (change.removed || !change.file || change.file.trashed) {
+        repairCandidates.add(change.fileId);
+        continue;
+      }
+      const membership = await isInsideSource({
+        file: change.file,
+        boundaryId: input.cursor.boundaryId,
+        getFile: async (fileId) => {
+          const ancestryElapsedMs = Math.max(0, now() - startedAt);
+          budget.elapsedMs = initialBudget.elapsedMs + ancestryElapsedMs;
+          if (budget.providerRequests >= input.maxProviderRequests || budget.elapsedMs >= input.maxElapsedMs || ancestryElapsedMs >= input.maxInvocationElapsedMs) {
+            return null;
+          }
+          budget.providerRequests += 1;
+          const parent = await input.getFile(fileId);
+          budget.elapsedMs = initialBudget.elapsedMs + Math.max(0, now() - startedAt);
+          return parent;
+        }
+      });
+      if (change.file.mimeType === GOOGLE_DRIVE_FOLDER_MIME_TYPE) {
+        entries.delete(change.fileId);
+        if (membership !== "outside") requiresFullReconciliation = true;
+        else repairCandidates.add(change.fileId);
+        continue;
+      }
+      if (membership === "inside") {
+        entries.set(change.fileId, toInventoryEntry(change.file, input.source, input.maxFileBytes));
+      } else if (membership === "unknown") {
+        entries.delete(change.fileId);
+        requiresFullReconciliation = true;
+      } else {
+        repairCandidates.add(change.fileId);
+      }
+    }
+    if (repairCandidates.size > 0) {
+      for (const fileId of repairCandidates) {
+        if (entries.delete(fileId)) requiresFullReconciliation = true;
+      }
+      const observed = await input.observedExternalObjectIds([...repairCandidates]);
+      if (observed.size > 0) requiresFullReconciliation = true;
+    }
+    if (page.nextPageToken) {
+      pageToken = boundedToken(page.nextPageToken);
+      continue;
+    }
+    if (!page.newStartPageToken) {
+      throw new GoogleDriveChangesProtocolError("google_drive_changes_terminal_token_missing");
+    }
+    budget.elapsedMs = initialBudget.elapsedMs + Math.max(0, now() - startedAt);
+    return {
+      status: "complete",
+      stopReason: null,
+      entries: [...entries.values()],
+      checkpoint: null,
+      newStartPageToken: boundedToken(page.newStartPageToken),
+      requiresFullReconciliation,
+      providerRequests: budget.providerRequests,
+      elapsedMs: budget.elapsedMs,
+      budget: { ...budget },
+      hardLimitReached: false
+    };
+  }
+}
+async function isInsideSource(input) {
+  if (input.file.id === input.boundaryId) return "inside";
+  let parents = input.file.parents;
+  const seen = /* @__PURE__ */ new Set([input.file.id]);
+  for (let depth = 0; depth < MAX_ANCESTOR_DEPTH; depth += 1) {
+    if (parents.includes(input.boundaryId)) return "inside";
+    const next = parents.find((parent2) => !seen.has(parent2));
+    if (!next) return "outside";
+    seen.add(next);
+    const parent = await input.getFile(next);
+    if (!parent) return "unknown";
+    parents = parent.parents;
+  }
+  return "unknown";
+}
+function toInventoryEntry(file, source, maxFileBytes) {
+  return {
+    externalObjectId: file.id,
+    externalVersionId: file.version ?? file.modifiedTime ?? file.md5Checksum,
+    sourceId: source.id,
+    parentFolderId: file.parents[0] ?? source.id,
+    driveId: file.driveId ?? source.driveId,
+    title: file.name,
+    mimeType: file.mimeType,
+    modifiedTime: file.modifiedTime,
+    createdTime: file.createdTime,
+    sourceUri: file.webViewLink ?? `https://drive.google.com/open?id=${encodeURIComponent(file.id)}`,
+    transfer: planGoogleDriveTransfer(file, maxFileBytes)
+  };
+}
+function validatedCheckpoint(value, limits) {
+  if (!value || typeof value !== "object") {
+    throw new Error("google_drive_changes_checkpoint_invalid");
+  }
+  const checkpoint = value;
+  const budget = checkpoint.budget;
+  if (checkpoint.version !== 2 || typeof checkpoint.requiresFullReconciliation !== "boolean" || !Array.isArray(checkpoint.seenPageTokenHashes) || checkpoint.seenPageTokenHashes.some((hash) => !/^[a-f0-9]{64}$/.test(hash)) || new Set(checkpoint.seenPageTokenHashes).size !== checkpoint.seenPageTokenHashes.length || checkpoint.seenPageTokenHashes.length > limits.maxProviderRequests || !budget || typeof budget !== "object") {
+    throw new Error("google_drive_changes_checkpoint_invalid");
+  }
+  if (typeof checkpoint.pageToken !== "string") {
+    throw new Error("google_drive_changes_checkpoint_invalid");
+  }
+  boundedToken(checkpoint.pageToken);
+  const budgetRow = budget;
+  for (const [key, maximum] of [
+    ["examinedItems", limits.maxItems],
+    ["providerRequests", limits.maxProviderRequests],
+    ["elapsedMs", limits.maxElapsedMs]
+  ]) {
+    const budgetValue = budgetRow[key];
+    if (!Number.isSafeInteger(budgetValue) || Number(budgetValue) < 0 || Number(budgetValue) > maximum) {
+      throw new Error("google_drive_changes_checkpoint_budget_invalid");
+    }
+  }
+  if (checkpoint.seenPageTokenHashes.length > Number(budgetRow.providerRequests)) {
+    throw new Error("google_drive_changes_checkpoint_request_history_invalid");
+  }
+  return value;
+}
+function limitReason(budget, input, invocationElapsedMs) {
+  if (budget.examinedItems >= input.maxItems) return "item_limit";
+  if (budget.providerRequests >= input.maxProviderRequests) return "api_request_limit";
+  if (budget.elapsedMs >= input.maxElapsedMs || invocationElapsedMs >= input.maxInvocationElapsedMs) {
+    return "elapsed_time_limit";
+  }
+  return null;
+}
+function emptyBudget() {
+  return { examinedItems: 0, providerRequests: 0, elapsedMs: 0 };
+}
+function boundedToken(value) {
+  if (value.length < 1 || value.length > MAX_TOKEN_CHARS) {
+    throw new Error("google_drive_changes_token_invalid");
+  }
+  return value;
+}
+function boundedBoundaryId(value) {
+  if (value.length < 1 || value.length > MAX_BOUNDARY_ID_CHARS) {
+    throw new Error("google_drive_changes_boundary_invalid");
+  }
+  return value;
+}
+var GoogleDriveCursorInvalidError = class extends Error {
+  budget = null;
+  constructor() {
+    super("google_drive_changes_cursor_invalid");
+    this.name = "GoogleDriveCursorInvalidError";
+  }
+};
+var GoogleDriveChangesProtocolError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "GoogleDriveChangesProtocolError";
+  }
+};
+
+// src/activities/knowledge-source-sync.ts
+var sourceRequestAuthority = new AsyncLocalStorage();
+var sourceFetch = Object.assign(
+  async (...args) => {
+    await sourceRequestAuthority.getStore()?.();
+    return fetch(...args);
+  },
+  { preconnect: fetch.preconnect }
+);
+var DRIVE_API_BASE = "https://www.googleapis.com/drive/v3";
+var DRIVE_JSON_MAX_BYTES = 2 * 1024 * 1024;
+var GOOGLE_DRIVE_FULL_RECONCILIATION_INTERVAL_MS = 24 * 60 * 60 * 1e3;
+var GOOGLE_DRIVE_SYNC_INVOCATION_SLICE_MS = 3e4;
+var GOOGLE_DRIVE_EXECUTION_CHECKPOINT_MAX_BYTES = 2 * 1024 * 1024;
+var GOOGLE_DRIVE_ACL_FRESHNESS_MS = 26 * 60 * 60 * 1e3;
+var GOOGLE_DRIVE_ACL_MAX_PRINCIPALS = 1e3;
+var ATLASSIAN_API_BASE = "https://api.atlassian.com";
+var ATLASSIAN_JSON_MAX_BYTES = 4 * 1024 * 1024;
+function knowledgeSyncObservationPolicy(kind) {
+  return kind === "google_drive" ? { revisionOrdering: "canonical_decimal", filterWithDriveDurability: true } : { revisionOrdering: "first_observation", filterWithDriveDurability: false };
+}
+function createKnowledgeSourceSyncActivities(services, resolveDocumentServices) {
+  const documentActivities = createDocumentActivities(services, resolveDocumentServices);
+  return {
+    runKnowledgeSourceSyncBatch: async (input) => {
+      const { settings, db, objectStorage, observability } = await services();
+      if (!objectStorage) throw new Error("object storage is not configured");
+      if (!input.agent)
+        return { action: "failed", bufferedWake: false, errorCode: "accepted_agent_required" };
+      const context = {
+        accountId: input.accountId,
+        workspaceId: input.workspaceId,
+        actor: input.agent
+      };
+      let boundSource = null;
+      const authorize = async () => {
+        const policy = await freezeAgentLearningPolicy(db, context);
+        if (policy.scheduledTaskRunId !== input.scheduledTaskRunId)
+          throw new Error("Source fetch does not belong to this accepted agent run");
+        if (boundSource) {
+          const [currentTask, connection] = await Promise.all([
+            getScheduledTask(db, input.workspaceId, input.taskId),
+            getConnectionMetadata2(
+              db,
+              input.workspaceId,
+              boundSource.connection.connectionId,
+              boundSource.initiatingSubjectId
+            )
+          ]);
+          const control = currentTask?.metadata.knowledgeSourceSync;
+          if (!currentTask || currentTask.status !== "active" || control?.sourceEnabled === false || control?.connectionPaused === true || !isDeepStrictEqual2(scheduledTaskKnowledgeSource(currentTask), boundSource) || !connection || connection.status !== "active" || connection.version !== boundSource.connection.connectionVersion || connection.subjectId !== boundSource.connection.ownerSubjectId)
+            throw new SyncFailure("authority_changed", false);
+        }
+        return policy;
+      };
+      await authorize();
+      const accepted = await getScheduledTaskRunAcceptedExecution(db, {
+        workspaceId: input.workspaceId,
+        runId: input.scheduledTaskRunId
+      });
+      const task = accepted?.task;
+      const action = task ? scheduledTaskKnowledgeSource(task) : null;
+      const liveTask = await getScheduledTask(db, input.workspaceId, input.taskId);
+      if (!task || !action || !liveTask || liveTask.status !== "active" || task.id !== input.taskId || task.accountId !== input.accountId || task.action.kind !== "agent_turn" || action.sourceId !== input.sourceId || accepted.causalHumanSubjectId !== action.initiatingSubjectId) {
+        return { action: "failed", bufferedWake: false };
+      }
+      boundSource = action;
+      await authorize();
+      await ensureKnowledgeSourceSyncState(db, task);
+      await recordKnowledgeSourceSyncWake(db, {
+        accountId: input.accountId,
+        workspaceId: input.workspaceId,
+        sourceId: input.sourceId,
+        scheduledTaskId: task.id,
+        scheduledTaskRunId: input.scheduledTaskRunId,
+        cause: "scheduled",
+        producerKey: `agent-source:${input.scheduledTaskRunId}`,
+        sourceConfigGeneration: action.sourceConfigGeneration,
+        sourceLifecycleGeneration: action.sourceLifecycleGeneration
+      });
+      const providerLabel = action.connection.providerDomain === ATLASSIAN_PROVIDER_DOMAIN ? "atlassian" : "google_drive";
+      if (action.controlWorkspaceId !== input.workspaceId || action.sourceConfigGeneration <= 0 || !action.providerCoordinationKey) {
+        return await failWithoutProvider("authority_changed");
+      }
+      const lease = await claimKnowledgeSourceSyncLease(db, {
+        ...input,
+        overlapPolicy: input.overlapPolicy
+      });
+      if (lease.action !== "claimed") {
+        observability.incrementCounter({
+          name: "opengeni_knowledge_source_sync_runs_total",
+          labels: { provider: providerLabel, outcome: lease.action }
+        });
+        return { action: lease.action };
+      }
+      let knowledgeRunId = null;
+      let activeSourceSyncGeneration = null;
+      const startedAt = Date.now();
+      const summary = {
+        phase: "queued",
+        scanned: 0,
+        imported: 0,
+        unchanged: 0,
+        skipped: 0,
+        failed: 0,
+        bytes: 0,
+        providerRequests: 0,
+        elapsedMs: 0,
+        indexed: 0,
+        aclPending: 0,
+        retryable: false,
+        limitReached: null,
+        checkpointed: false,
+        reconnectRequired: false,
+        failures: []
+      };
+      observability.info("Knowledge source sync started", {
+        provider: providerLabel,
+        outcome: "started"
+      });
+      try {
+        summary.phase = "inventory";
+        const resolved = await getKnowledgeSourceForSyncAuthority(db, {
+          accountId: input.accountId,
+          workspaceId: input.workspaceId,
+          sourceId: input.sourceId,
+          initiatingSubjectId: action.initiatingSubjectId
+        });
+        if (!resolved || resolved.source.lifecycleState !== "active") {
+          throw new SyncFailure("authority_changed", false);
+        }
+        if (scopedKnowledgeScopeKey(resolved.source.scope) !== scopedKnowledgeScopeKey(action.destination)) {
+          throw new SyncFailure("authority_changed", false);
+        }
+        const liveState = await reconcileKnowledgeSourceSyncLiveGeneration(db, {
+          accountId: input.accountId,
+          workspaceId: input.workspaceId,
+          sourceId: input.sourceId,
+          scheduledTaskRunId: input.scheduledTaskRunId,
+          initiatingSubjectId: action.initiatingSubjectId,
+          sourceConfigGeneration: action.sourceConfigGeneration,
+          sourceLifecycleGeneration: action.sourceLifecycleGeneration,
+          liveSourceSyncGeneration: resolved.source.syncGeneration
+        });
+        activeSourceSyncGeneration = resolved.source.syncGeneration;
+        const syncOperationId = `scheduled-task-run:${input.scheduledTaskRunId}`;
+        const replayedRun = await getKnowledgeSyncRunForSyncAuthority(db, {
+          accountId: input.accountId,
+          workspaceId: input.workspaceId,
+          sourceId: input.sourceId,
+          operationId: syncOperationId,
+          initiatingSubjectId: action.initiatingSubjectId
+        });
+        if (replayedRun && replayedRun.state !== "started") {
+          const replayedSummary = KnowledgeSourceSyncRunSummary.parse(replayedRun.metadata);
+          const settlementInput = {
+            accountId: input.accountId,
+            workspaceId: input.workspaceId,
+            sourceId: input.sourceId,
+            scheduledTaskRunId: input.scheduledTaskRunId,
+            knowledgeSyncRunId: replayedRun.id,
+            status: replayedRun.state === "succeeded" ? "succeeded" : "failed",
+            summary: replayedSummary,
+            error: replayedRun.errorCode,
+            sourceConfigGeneration: action.sourceConfigGeneration,
+            sourceLifecycleGeneration: action.sourceLifecycleGeneration,
+            sourceSyncGeneration: replayedRun.inputSyncGeneration,
+            completedSourceSyncGeneration: replayedRun.state === "succeeded" ? replayedRun.inputSyncGeneration + 1 : null,
+            ...replayedRun.state === "succeeded" && replayedRun.metadata.providerCursor && typeof replayedRun.metadata.providerCursor === "object" ? {
+              providerCursor: replayedRun.metadata.providerCursor
+            } : {}
+          };
+          const settled2 = replayedRun.state === "failed" && replayedSummary.reconnectRequired ? await deauthorizeAndSettleKnowledgeSourceSyncFailure(db, {
+            deauthorization: {
+              accountId: input.accountId,
+              workspaceId: input.workspaceId,
+              sourceId: input.sourceId,
+              audience: action.destination,
+              operationId: `knowledge-sync-deauthorize:${input.sourceId}:${action.connection.connectionVersion}:${replayedRun.errorCode ?? "connection_reconnect_required"}`,
+              reasonCode: "connection_reconnect_required",
+              actor: {
+                kind: "service",
+                subjectId: "knowledge-source-sync",
+                initiatingHumanSubjectId: action.initiatingSubjectId
+              }
+            },
+            settlement: settlementInput
+          }) : await settleKnowledgeSourceSyncLease(db, settlementInput);
+          await recordConnectorUsage("completed", replayedSummary.scanned, "item");
+          await recordConnectorUsage("items", replayedSummary.imported, "item");
+          await recordConnectorUsage("bytes", replayedSummary.bytes, "byte");
+          return {
+            action: replayedRun.state === "succeeded" ? "complete" : "failed",
+            summary: replayedSummary,
+            ...replayedRun.errorCode ? { errorCode: replayedRun.errorCode } : {},
+            bufferedWake: settled2.bufferedWake,
+            bufferedScheduledTaskRunId: settled2.bufferedScheduledTaskRunId
+          };
+        }
+        const provider = await resolveKnowledgeSyncProvider({
+          db,
+          settings,
+          observability,
+          accountId: input.accountId,
+          workspaceId: input.workspaceId,
+          action,
+          sourceId: input.sourceId,
+          externalSourceId: resolved.source.externalSourceId
+        });
+        const selectedDestination = provider.selectedDestination;
+        const observationPolicy = knowledgeSyncObservationPolicy(provider.kind);
+        let aclGeneration = resolved.source.currentAclGeneration;
+        let acl = aclGeneration ? await getKnowledgeSourceAclForSyncAuthority(db, {
+          accountId: input.accountId,
+          workspaceId: input.workspaceId,
+          sourceId: input.sourceId,
+          generation: aclGeneration,
+          initiatingSubjectId: action.initiatingSubjectId
+        }) : null;
+        const actor = {
+          kind: "service",
+          subjectId: "knowledge-source-sync",
+          initiatingHumanSubjectId: action.initiatingSubjectId
+        };
+        if (!acl) {
+          acl = await appendKnowledgeSourceAclVersion(db, {
+            accountId: input.accountId,
+            workspaceId: input.workspaceId,
+            sourceId: input.sourceId,
+            audience: action.destination,
+            expectedSourceLifecycleGeneration: resolved.source.lifecycleGeneration,
+            expectedAclGeneration: 0,
+            aclVersion: "opengeni-destination-v1",
+            agentAccess: false,
+            operationId: `source-initial-acl:${input.sourceId}`,
+            reasonCode: "initial_destination_acl",
+            actor
+          });
+          aclGeneration = acl.generation;
+        }
+        const knowledgeRun = replayedRun ?? await beginKnowledgeSyncRun(db, {
+          accountId: input.accountId,
+          workspaceId: input.workspaceId,
+          sourceId: input.sourceId,
+          expectedSourceLifecycleGeneration: resolved.source.lifecycleGeneration,
+          expectedSyncGeneration: resolved.source.syncGeneration,
+          inputCursor: null,
+          operationId: syncOperationId,
+          actor
+        });
+        knowledgeRunId = knowledgeRun.id;
+        const originalDriver = provider.driver;
+        const readAcl = originalDriver.readAcl;
+        const driver = {
+          ...originalDriver,
+          inventory: (...args) => sourceRequestAuthority.run(authorize, () => originalDriver.inventory(...args)),
+          fetchContent: (...args) => sourceRequestAuthority.run(authorize, () => originalDriver.fetchContent(...args)),
+          ...readAcl ? {
+            readAcl: (...args) => sourceRequestAuthority.run(authorize, () => readAcl(...args))
+          } : {}
+        };
+        await authorize();
+        const inventory = await driver.inventory(
+          lease.state.executionCheckpoint,
+          lease.state.providerCursor
+        );
+        summary.providerRequests = inventory.providerRequests;
+        summary.elapsedMs = inventory.elapsedMs;
+        const base = selectedDestination.collectionId ? await getDocumentBase(db, input.workspaceId, selectedDestination.collectionId) : await ensureDefaultBase(db, {
+          accountId: input.accountId,
+          workspaceId: input.workspaceId
+        });
+        if (!base) throw new SyncFailure("authority_changed", false);
+        const durableObservations = await recordKnowledgeSourceSyncObjectObservations(db, {
+          accountId: input.accountId,
+          workspaceId: input.workspaceId,
+          sourceId: input.sourceId,
+          scheduledTaskRunId: input.scheduledTaskRunId,
+          initiatingSubjectId: action.initiatingSubjectId,
+          scanGeneration: liveState.activeScanGeneration,
+          executionCheckpointGeneration: lease.state.executionCheckpointGeneration,
+          revisionOrdering: observationPolicy.revisionOrdering,
+          observations: inventory.entries.map((entry) => ({
+            externalObjectId: entry.externalObjectId,
+            providerRevision: entry.externalVersionId,
+            metadataHash: entryMetadataHash(entry)
+          }))
+        });
+        const entriesToProcess = observationPolicy.filterWithDriveDurability ? inventory.entries.filter(
+          (entry, index) => shouldProcessGoogleDriveDurableObservation({
+            entry,
+            observation: durableObservations[index],
+            sourceLifecycleGeneration: resolved.source.lifecycleGeneration,
+            aclGeneration
+          })
+        ) : inventory.entries;
+        const observationFloorsById = /* @__PURE__ */ new Map();
+        for (const observation of durableObservations) {
+          observationFloorsById.set(observation.externalObjectId, {
+            externalObjectId: observation.externalObjectId,
+            providerRevision: observation.providerRevision,
+            metadataHash: observation.metadataHash
+          });
+        }
+        const observationFloors = [...observationFloorsById.values()];
+        const executionCheckpoint = mergeGoogleDriveDurableObservationFloors(
+          inventory.checkpoint,
+          observationFloors,
+          action.limits.maxItems
+        );
+        const ensureVersionIndexed = async (details) => {
+          if (!details.version.documentId) {
+            throw new SyncFailure("authority_changed", false);
+          }
+          let obligation = details.obligation ?? await getKnowledgeSourceSyncIndexObligationForVersion(db, {
+            accountId: input.accountId,
+            workspaceId: input.workspaceId,
+            knowledgeDocumentVersionId: details.version.id,
+            initiatingSubjectId: action.initiatingSubjectId
+          });
+          if (!obligation) {
+            obligation = await enqueueKnowledgeSourceSyncIndexObligation(db, {
+              accountId: input.accountId,
+              workspaceId: input.workspaceId,
+              scheduledTaskRunId: input.scheduledTaskRunId,
+              sourceId: input.sourceId,
+              sourceSyncGeneration: knowledgeRun.inputSyncGeneration,
+              initiatingSubjectId: action.initiatingSubjectId,
+              externalObjectId: details.entry.externalObjectId,
+              knowledgeSourceObjectId: details.object.id,
+              knowledgeDocumentVersionId: details.version.id,
+              documentId: details.version.documentId,
+              sourceConfigGeneration: action.sourceConfigGeneration,
+              sourceLifecycleGeneration: action.sourceLifecycleGeneration,
+              objectLifecycleGeneration: details.object.lifecycleGeneration,
+              objectVersionGeneration: details.version.versionGeneration,
+              citationLocator: driver.citationLocator(details.entry)
+            });
+          }
+          if (obligation.documentId !== details.version.documentId) {
+            throw new SyncFailure("authority_changed", false);
+          }
+          if (obligation.status === "indexed" && !details.indexRequired) return obligation;
+          if (obligation.status === "indexed" && details.indexRequired) {
+            summary.phase = "index";
+            try {
+              const indexedDocument = await documentActivities.indexDocument({
+                accountId: input.accountId,
+                workspaceId: input.workspaceId,
+                documentId: details.version.documentId,
+                authorityKind: action.destination.kind,
+                authorityWorkspaceId: action.destination.workspaceId,
+                authoritySubjectId: action.destination.subjectId
+              });
+              if (indexedDocument.status !== "ready") {
+                throw new Error("document indexing did not complete");
+              }
+            } catch {
+              throw new SyncFailure("indexing_failed", true);
+            }
+            return obligation;
+          }
+          if (obligation.status === "failed") {
+            const retried = await retryKnowledgeSourceSyncIndexObligation(db, {
+              accountId: input.accountId,
+              workspaceId: input.workspaceId,
+              obligationId: obligation.id,
+              scheduledTaskRunId: input.scheduledTaskRunId
+            });
+            if (retried === "invalidated") {
+              throw new SyncFailure("authority_changed", false);
+            }
+            obligation = { ...obligation, status: retried };
+            if (retried === "indexed") return obligation;
+          }
+          if (obligation.status !== "pending") {
+            throw new SyncFailure("authority_changed", false);
+          }
+          if (details.indexRequired) {
+            summary.phase = "index";
+            try {
+              const indexedDocument = await documentActivities.indexDocument({
+                accountId: input.accountId,
+                workspaceId: input.workspaceId,
+                documentId: details.version.documentId,
+                authorityKind: action.destination.kind,
+                authorityWorkspaceId: action.destination.workspaceId,
+                authoritySubjectId: action.destination.subjectId
+              });
+              if (indexedDocument.status !== "ready") {
+                throw new Error("document indexing did not complete");
+              }
+            } catch {
+              await settleKnowledgeSourceSyncIndexObligation(db, {
+                accountId: input.accountId,
+                workspaceId: input.workspaceId,
+                obligationId: obligation.id,
+                status: "failed",
+                failureCode: "indexing_failed"
+              }).catch(() => void 0);
+              throw new SyncFailure("indexing_failed", true);
+            }
+          }
+          const settlement = await settleKnowledgeSourceSyncIndexObligation(db, {
+            accountId: input.accountId,
+            workspaceId: input.workspaceId,
+            obligationId: obligation.id,
+            status: "indexed"
+          });
+          if (settlement === "invalidated") {
+            throw new SyncFailure("authority_changed", false);
+          }
+          return { ...obligation, status: "indexed" };
+        };
+        const recordEntryAcl = async (details) => {
+          if (!driver.readAcl || !provider.aclAuthority) {
+            return { aclEligibility: "pending", aclEvidence: null };
+          }
+          await beginGoogleDriveObjectAclRefresh(db, {
+            accountId: input.accountId,
+            workspaceId: input.workspaceId,
+            obligationId: details.obligation.id,
+            sourceSyncGeneration: details.obligation.sourceSyncGeneration,
+            sourceConfigGeneration: action.sourceConfigGeneration,
+            sourceLifecycleGeneration: action.sourceLifecycleGeneration,
+            objectLifecycleGeneration: details.object.lifecycleGeneration,
+            objectVersionGeneration: details.version.versionGeneration
+          });
+          const remainingProviderRequests = action.limits.maxProviderRequests - summary.providerRequests;
+          if (remainingProviderRequests < 1) {
+            throw new SyncFailure("resource_limit", false);
+          }
+          await authorize();
+          const evidence = await driver.readAcl(details.entry, remainingProviderRequests);
+          summary.providerRequests += evidence.providerRequests;
+          if (summary.providerRequests > action.limits.maxProviderRequests) {
+            throw new SyncFailure("resource_limit", false);
+          }
+          const recorded = await recordGoogleDriveObjectAclEvidence(db, {
+            accountId: input.accountId,
+            workspaceId: input.workspaceId,
+            obligationId: details.obligation.id,
+            connectionId: provider.aclAuthority.connectionId,
+            connectionVersion: provider.aclAuthority.connectionVersion,
+            sourceGooglePermissionId: provider.aclAuthority.sourceGooglePermissionId,
+            sourceSyncGeneration: details.obligation.sourceSyncGeneration,
+            sourceConfigGeneration: action.sourceConfigGeneration,
+            sourceLifecycleGeneration: action.sourceLifecycleGeneration,
+            objectLifecycleGeneration: details.object.lifecycleGeneration,
+            objectVersionGeneration: details.version.versionGeneration,
+            providerRevision: evidence.providerRevision,
+            driveId: evidence.driveId,
+            aclRevision: evidence.aclRevision,
+            eligibility: evidence.eligibility,
+            observedAt: evidence.observedAt,
+            expiresAt: evidence.expiresAt,
+            citationLocator: driver.citationLocator(details.entry),
+            operationId: `drive-acl:${details.obligation.id}:${evidence.aclRevision}`,
+            principals: evidence.principals
+          });
+          return {
+            aclEligibility: evidence.eligibility,
+            aclEvidence: {
+              version: 1,
+              provider: "google_drive",
+              evidenceId: recorded.evidenceId,
+              aclRevision: evidence.aclRevision,
+              aclHash: recorded.aclHash,
+              observedAt: evidence.observedAt,
+              expiresAt: evidence.expiresAt
+            }
+          };
+        };
+        const outcomes = [];
+        for (const entry of entriesToProcess) {
+          await authorize();
+          heartbeat({ sourceId: input.sourceId, externalObjectId: entry.externalObjectId });
+          const observationFloor = observationFloorsById.get(entry.externalObjectId);
+          if (!observationFloor) throw new SyncFailure("provider_payload_invalid", false);
+          const syncObservation = {
+            scheduledTaskRunId: input.scheduledTaskRunId,
+            scanGeneration: liveState.activeScanGeneration,
+            providerRevision: observationFloor.providerRevision,
+            metadataHash: observationFloor.metadataHash
+          };
+          summary.scanned += 1;
+          if (entry.transfer.action === "skip") {
+            summary.skipped += 1;
+            outcomes.push({
+              externalObjectId: entry.externalObjectId,
+              outcome: "skipped",
+              reasonCode: entry.transfer.reason
+            });
+            continue;
+          }
+          if (entry.transfer.action === "traverse") continue;
+          try {
+            const existingObject = await getKnowledgeSourceObjectForSyncAuthority(db, {
+              accountId: input.accountId,
+              workspaceId: input.workspaceId,
+              sourceId: input.sourceId,
+              externalObjectId: entry.externalObjectId,
+              initiatingSubjectId: action.initiatingSubjectId
+            });
+            let object = existingObject ?? await upsertKnowledgeSourceObject(db, {
+              accountId: input.accountId,
+              workspaceId: input.workspaceId,
+              sourceId: input.sourceId,
+              externalObjectId: entry.externalObjectId,
+              operationId: `source-object:${input.sourceId}:${entry.externalObjectId}`,
+              actor
+            });
+            if (object.lifecycleState !== "active") {
+              const restored = await restoreKnowledgeSourceObject(db, {
+                accountId: input.accountId,
+                workspaceId: input.workspaceId,
+                targetId: object.id,
+                expectedGeneration: object.lifecycleGeneration,
+                operationId: `knowledge-sync-object-restore:${object.id}:${liveState.activeScanGeneration}`,
+                reasonCode: "authoritative_scan_observed",
+                actor
+              });
+              object = {
+                ...object,
+                lifecycleState: "active",
+                lifecycleGeneration: restored.lifecycleGeneration
+              };
+            }
+            const currentObservation = object.currentVersionId ? await getKnowledgeDocumentVersionObservationForSyncAuthority(db, {
+              accountId: input.accountId,
+              workspaceId: input.workspaceId,
+              versionId: object.currentVersionId,
+              initiatingSubjectId: action.initiatingSubjectId
+            }) : null;
+            const currentVersion = currentObservation?.version ?? null;
+            const metadataHash = entryMetadataHash(entry);
+            const observedProviderRevision = typeof currentObservation?.sourceMetadata.providerRevision === "string" ? currentObservation.sourceMetadata.providerRevision : null;
+            const observedMetadataHash = typeof currentObservation?.sourceMetadata.metadataHash === "string" ? currentObservation.sourceMetadata.metadataHash : null;
+            const observedSourceLifecycleGeneration = Number(
+              currentObservation?.sourceMetadata.sourceLifecycleGeneration ?? 0
+            );
+            const observedObjectLifecycleGeneration = Number(
+              currentObservation?.sourceMetadata.objectLifecycleGeneration ?? 0
+            );
+            const currentObligation = currentVersion ? await getKnowledgeSourceSyncIndexObligationForVersion(db, {
+              accountId: input.accountId,
+              workspaceId: input.workspaceId,
+              knowledgeDocumentVersionId: currentVersion.id,
+              initiatingSubjectId: action.initiatingSubjectId
+            }) : null;
+            if (currentVersion && currentVersion.documentId && observedProviderRevision === entry.externalVersionId && observedMetadataHash === metadataHash && currentVersion.aclGeneration === aclGeneration && observedSourceLifecycleGeneration === resolved.source.lifecycleGeneration && observedObjectLifecycleGeneration === object.lifecycleGeneration && currentObligation?.status !== "invalidated") {
+              await updateKnowledgeSourceDocumentObservationMetadata(db, {
+                accountId: input.accountId,
+                workspaceId: input.workspaceId,
+                initiatingSubjectId: action.initiatingSubjectId,
+                sourceId: input.sourceId,
+                expectedSourceLifecycleGeneration: resolved.source.lifecycleGeneration,
+                objectId: object.id,
+                expectedObjectLifecycleGeneration: object.lifecycleGeneration,
+                versionId: currentVersion.id,
+                documentId: currentVersion.documentId,
+                title: entry.title,
+                sourceUri: entry.sourceUri,
+                sourceVersion: entry.externalVersionId ?? currentVersion.contentSha256,
+                sourceUpdatedAt: entry.modifiedTime,
+                syncObservation
+              });
+              const obligation2 = await ensureVersionIndexed({
+                entry,
+                object,
+                version: currentVersion,
+                indexRequired: (currentObservation?.documentChunkCount ?? 0) === 0,
+                obligation: currentObligation
+              });
+              const objectAcl2 = await recordEntryAcl({
+                entry,
+                object,
+                version: currentVersion,
+                obligation: obligation2
+              });
+              summary.unchanged += 1;
+              outcomes.push({
+                externalObjectId: entry.externalObjectId,
+                outcome: "unchanged",
+                contentSha256: currentVersion.contentSha256,
+                providerRevision: entry.externalVersionId,
+                metadataHash,
+                aclEligibility: objectAcl2.aclEligibility,
+                aclEvidence: objectAcl2.aclEvidence,
+                indexObligationId: obligation2.id
+              });
+              continue;
+            }
+            summary.phase = "transfer";
+            await authorize();
+            const bytes = await driver.fetchContent(entry, action.limits.maxFileBytes);
+            const contentSha256 = createHash2("sha256").update(bytes).digest("hex");
+            const observationKey = createHash2("sha256").update(
+              JSON.stringify({
+                externalObjectId: entry.externalObjectId,
+                providerRevision: entry.externalVersionId,
+                metadataHash,
+                contentSha256,
+                aclGeneration,
+                sourceLifecycleGeneration: resolved.source.lifecycleGeneration,
+                objectLifecycleGeneration: object.lifecycleGeneration
+              })
+            ).digest("hex");
+            if (currentVersion?.contentSha256 === contentSha256 && currentVersion.documentId && currentVersion.fileId) {
+              const version2 = await appendKnowledgeDocumentVersion(db, {
+                accountId: input.accountId,
+                workspaceId: input.workspaceId,
+                objectId: object.id,
+                expectedSourceLifecycleGeneration: resolved.source.lifecycleGeneration,
+                expectedObjectLifecycleGeneration: object.lifecycleGeneration,
+                expectedVersionGeneration: object.versionGeneration,
+                externalVersionId: entry.externalVersionId ?? contentSha256,
+                contentSha256,
+                ingestionKey: `${entry.externalObjectId}:${observationKey}`,
+                sourceCursor: null,
+                sourceMetadata: {
+                  title: entry.title,
+                  mimeType: entry.mimeType,
+                  driveId: entry.driveId,
+                  providerRevision: entry.externalVersionId,
+                  metadataHash,
+                  aclEligibility: "pending",
+                  sourceLifecycleGeneration: resolved.source.lifecycleGeneration,
+                  objectLifecycleGeneration: object.lifecycleGeneration
+                },
+                sourceCreatedAt: entry.createdTime,
+                sourceUpdatedAt: entry.modifiedTime,
+                aclVersionId: acl.id,
+                aclGeneration,
+                documentId: currentVersion.documentId,
+                fileId: currentVersion.fileId,
+                locationMetadata: { sourceUri: entry.sourceUri },
+                documentObservationMetadata: {
+                  title: entry.title,
+                  sourceUri: entry.sourceUri,
+                  sourceVersion: entry.externalVersionId ?? contentSha256,
+                  sourceUpdatedAt: entry.modifiedTime
+                },
+                syncObservation,
+                operationId: `document-observation:${object.id}:${observationKey}`,
+                reasonCode: "source_metadata_observed",
+                actor
+              });
+              await updateKnowledgeSourceDocumentObservationMetadata(db, {
+                accountId: input.accountId,
+                workspaceId: input.workspaceId,
+                initiatingSubjectId: action.initiatingSubjectId,
+                sourceId: input.sourceId,
+                expectedSourceLifecycleGeneration: resolved.source.lifecycleGeneration,
+                objectId: object.id,
+                expectedObjectLifecycleGeneration: object.lifecycleGeneration,
+                versionId: version2.id,
+                documentId: currentVersion.documentId,
+                title: entry.title,
+                sourceUri: entry.sourceUri,
+                sourceVersion: entry.externalVersionId ?? contentSha256,
+                sourceUpdatedAt: entry.modifiedTime,
+                syncObservation
+              });
+              const obligation2 = await ensureVersionIndexed({
+                entry,
+                object,
+                version: version2,
+                indexRequired: (currentObservation?.documentChunkCount ?? 0) === 0
+              });
+              const objectAcl2 = await recordEntryAcl({ entry, object, version: version2, obligation: obligation2 });
+              summary.unchanged += 1;
+              summary.indexed += 1;
+              if (objectAcl2.aclEligibility === "pending") summary.aclPending += 1;
+              outcomes.push({
+                externalObjectId: entry.externalObjectId,
+                outcome: "unchanged",
+                contentSha256,
+                sizeBytes: bytes.byteLength,
+                providerRevision: entry.externalVersionId,
+                metadataHash,
+                aclEligibility: objectAcl2.aclEligibility,
+                aclEvidence: objectAcl2.aclEvidence,
+                indexObligationId: obligation2.id
+              });
+              continue;
+            }
+            const fileId = deterministicUuid(
+              `knowledge-blob:${input.accountId}:${input.workspaceId}:${contentSha256}`
+            );
+            const objectKey = `workspaces/${input.workspaceId}/knowledge/blobs/${contentSha256}`;
+            await objectStorage.putObject({
+              key: objectKey,
+              contentType: entry.transfer.contentType,
+              body: bytes,
+              sha256: contentSha256
+            });
+            const file = await ensureKnowledgeSourceBlobFile(db, {
+              accountId: input.accountId,
+              workspaceId: input.workspaceId,
+              fileId,
+              filename: entry.transfer.filename,
+              safeFilename: safeFilename(entry.transfer.filename),
+              contentType: entry.transfer.contentType,
+              sizeBytes: bytes.byteLength,
+              sha256: contentSha256,
+              bucket: objectStorage.bucket,
+              objectKey
+            });
+            const document = await addDocumentToBase(db, {
+              accountId: input.accountId,
+              workspaceId: input.workspaceId,
+              baseId: base.id,
+              fileId: file.id,
+              title: entry.title,
+              sourceKind: "document",
+              sourceUri: entry.sourceUri,
+              sourceExternalId: entry.externalObjectId,
+              sourceTitle: entry.title,
+              sourceCreatedAt: entry.createdTime ?? void 0,
+              sourceUpdatedAt: entry.modifiedTime ?? void 0,
+              sourceVersion: entry.externalVersionId ?? contentSha256,
+              knowledgeSourceIdentity: deterministicUuid(
+                `knowledge-source-version:${object.id}:${observationKey}`
+              ),
+              authorityKind: action.destination.kind,
+              createdBy: action.initiatingSubjectId,
+              initiatingSubjectId: action.initiatingSubjectId,
+              organizationAuthorityGranted: action.destination.kind === "organization",
+              agentAccess: false,
+              curationStatus: "none",
+              access: { viewerSubjectId: action.initiatingSubjectId }
+            });
+            const version = await appendKnowledgeDocumentVersion(db, {
+              accountId: input.accountId,
+              workspaceId: input.workspaceId,
+              objectId: object.id,
+              expectedSourceLifecycleGeneration: resolved.source.lifecycleGeneration,
+              expectedObjectLifecycleGeneration: object.lifecycleGeneration,
+              expectedVersionGeneration: object.versionGeneration,
+              externalVersionId: entry.externalVersionId ?? contentSha256,
+              contentSha256,
+              ingestionKey: `${entry.externalObjectId}:${observationKey}`,
+              sourceCursor: null,
+              sourceMetadata: {
+                title: entry.title,
+                mimeType: entry.mimeType,
+                driveId: entry.driveId,
+                providerRevision: entry.externalVersionId,
+                metadataHash,
+                aclEligibility: "pending",
+                sourceLifecycleGeneration: resolved.source.lifecycleGeneration,
+                objectLifecycleGeneration: object.lifecycleGeneration
+              },
+              sourceCreatedAt: entry.createdTime,
+              sourceUpdatedAt: entry.modifiedTime,
+              aclVersionId: acl.id,
+              aclGeneration,
+              documentId: document.id,
+              fileId: file.id,
+              locationMetadata: { sourceUri: entry.sourceUri },
+              syncObservation,
+              operationId: `document-version:${object.id}:${observationKey}`,
+              reasonCode: "source_content_observed",
+              actor
+            });
+            const obligation = await ensureVersionIndexed({
+              entry,
+              object,
+              version,
+              indexRequired: true
+            });
+            const objectAcl = await recordEntryAcl({ entry, object, version, obligation });
+            summary.indexed += 1;
+            summary.imported += 1;
+            if (objectAcl.aclEligibility === "pending") summary.aclPending += 1;
+            summary.bytes += bytes.byteLength;
+            outcomes.push({
+              externalObjectId: entry.externalObjectId,
+              outcome: "imported",
+              contentSha256,
+              sizeBytes: bytes.byteLength,
+              providerRevision: entry.externalVersionId,
+              metadataHash,
+              aclEligibility: objectAcl.aclEligibility,
+              aclEvidence: objectAcl.aclEvidence,
+              indexObligationId: obligation.id
+            });
+          } catch (error) {
+            if (error instanceof KnowledgeSourceSyncObservationFenceError) {
+              throw new SyncFailure("provider_payload_invalid", false);
+            }
+            const message = boundedError(error);
+            const itemFailure = error instanceof SyncFailure ? error : new SyncFailure("item_processing_failed", false);
+            summary.failed += 1;
+            summary.retryable ||= itemFailure.retryable;
+            if (summary.failures.length < action.limits.maxFailureDetails) {
+              summary.failures.push({
+                externalObjectId: entry.externalObjectId,
+                code: itemFailure.code,
+                retryable: itemFailure.retryable,
+                message
+              });
+            }
+            outcomes.push({
+              externalObjectId: entry.externalObjectId,
+              outcome: "failed",
+              reasonCode: itemFailure.code,
+              detail: message,
+              providerRevision: entry.externalVersionId,
+              metadataHash: entryMetadataHash(entry),
+              aclEligibility: "pending"
+            });
+          }
+        }
+        await recordKnowledgeSourceSyncItemOutcomes(db, {
+          accountId: input.accountId,
+          workspaceId: input.workspaceId,
+          scheduledTaskRunId: input.scheduledTaskRunId,
+          knowledgeSyncRunId: knowledgeRun.id,
+          sourceId: input.sourceId,
+          sourceConfigGeneration: action.sourceConfigGeneration,
+          sourceLifecycleGeneration: action.sourceLifecycleGeneration,
+          outcomes
+        });
+        if (inventory.status === "paused" && inventory.checkpoint) {
+          if (inventory.stopReason === "provider_error" || inventory.stopReason === "incomplete_search") {
+            throw new SyncFailure(
+              inventory.stopReason === "provider_error" ? "provider_unavailable" : "provider_payload_invalid",
+              inventory.stopReason === "provider_error"
+            );
+          }
+          if (inventory.hardLimitReached) {
+            summary.limitReached = inventoryLimit(inventory.stopReason);
+            throw new SyncFailure("resource_limit", false);
+          }
+          if (inventory.stopReason !== "elapsed_time_limit") {
+            summary.limitReached = inventoryLimit(inventory.stopReason);
+            throw new SyncFailure("resource_limit", false);
+          }
+          summary.checkpointed = true;
+          summary.phase = "checkpoint";
+          await checkpointKnowledgeSourceSync(db, {
+            accountId: input.accountId,
+            workspaceId: input.workspaceId,
+            sourceId: input.sourceId,
+            scheduledTaskRunId: input.scheduledTaskRunId,
+            sourceConfigGeneration: action.sourceConfigGeneration,
+            sourceLifecycleGeneration: action.sourceLifecycleGeneration,
+            executionCheckpoint,
+            observationFence: {
+              initiatingSubjectId: action.initiatingSubjectId,
+              scanGeneration: liveState.activeScanGeneration,
+              executionCheckpointGeneration: lease.state.executionCheckpointGeneration,
+              observations: observationFloors
+            }
+          });
+          return { action: "continue", summary };
+        }
+        const tombstonedExternalObjectIds = inventory.authoritativeFullScan ? await reconcileKnowledgeSourceSyncCompleteScan(db, {
+          accountId: input.accountId,
+          workspaceId: input.workspaceId,
+          sourceId: input.sourceId,
+          scheduledTaskRunId: input.scheduledTaskRunId,
+          initiatingSubjectId: action.initiatingSubjectId,
+          sourceSyncGeneration: knowledgeRun.inputSyncGeneration,
+          sourceConfigGeneration: action.sourceConfigGeneration,
+          sourceLifecycleGeneration: action.sourceLifecycleGeneration,
+          scanGeneration: liveState.activeScanGeneration
+        }) : [];
+        if (tombstonedExternalObjectIds.length > 0) {
+          summary.skipped += tombstonedExternalObjectIds.length;
+          await recordKnowledgeSourceSyncItemOutcomes(db, {
+            accountId: input.accountId,
+            workspaceId: input.workspaceId,
+            scheduledTaskRunId: input.scheduledTaskRunId,
+            knowledgeSyncRunId: knowledgeRun.id,
+            sourceId: input.sourceId,
+            sourceConfigGeneration: action.sourceConfigGeneration,
+            sourceLifecycleGeneration: action.sourceLifecycleGeneration,
+            outcomes: tombstonedExternalObjectIds.map((externalObjectId) => ({
+              externalObjectId,
+              outcome: "tombstoned",
+              reasonCode: "authoritative_scan_absent",
+              aclEligibility: "denied"
+            }))
+          });
+        }
+        await completeKnowledgeSyncRun(db, {
+          accountId: input.accountId,
+          workspaceId: input.workspaceId,
+          initiatingSubjectId: action.initiatingSubjectId,
+          runId: knowledgeRun.id,
+          state: "succeeded",
+          outputCursor: null,
+          watermark: (/* @__PURE__ */ new Date()).toISOString(),
+          metadata: { ...summary, providerCursor: inventory.providerCursor },
+          reasonCode: "scheduled_source_sync"
+        });
+        summary.phase = "completed";
+        summary.elapsedMs = Date.now() - startedAt;
+        const settled = await settleKnowledgeSourceSyncLease(db, {
+          accountId: input.accountId,
+          workspaceId: input.workspaceId,
+          sourceId: input.sourceId,
+          scheduledTaskRunId: input.scheduledTaskRunId,
+          knowledgeSyncRunId: knowledgeRun.id,
+          status: "succeeded",
+          summary,
+          sourceConfigGeneration: action.sourceConfigGeneration,
+          sourceLifecycleGeneration: action.sourceLifecycleGeneration,
+          sourceSyncGeneration: knowledgeRun.inputSyncGeneration,
+          completedSourceSyncGeneration: knowledgeRun.inputSyncGeneration + 1,
+          providerCursor: inventory.providerCursor,
+          observationFence: {
+            initiatingSubjectId: action.initiatingSubjectId,
+            scanGeneration: liveState.activeScanGeneration,
+            executionCheckpointGeneration: lease.state.executionCheckpointGeneration,
+            observations: observationFloors
+          }
+        });
+        await recordConnectorUsage("completed", summary.scanned, "item");
+        await recordConnectorUsage("items", summary.imported, "item");
+        await recordConnectorUsage("bytes", summary.bytes, "byte");
+        observability.incrementCounter({
+          name: "opengeni_knowledge_source_sync_runs_total",
+          labels: { provider: providerLabel, outcome: "succeeded" }
+        });
+        observability.incrementCounter({
+          name: "opengeni_knowledge_source_sync_items_total",
+          labels: { provider: providerLabel, outcome: "imported" },
+          amount: summary.imported
+        });
+        for (const outcome of ["unchanged", "skipped", "failed"]) {
+          observability.incrementCounter({
+            name: "opengeni_knowledge_source_sync_items_total",
+            labels: { provider: providerLabel, outcome },
+            amount: summary[outcome]
+          });
+        }
+        observability.incrementCounter({
+          name: "opengeni_knowledge_source_sync_bytes_total",
+          labels: { provider: providerLabel },
+          amount: summary.bytes
+        });
+        recordSyncHealthTelemetry(observability, providerLabel, summary, "succeeded");
+        return {
+          action: "complete",
+          summary,
+          bufferedWake: settled.bufferedWake,
+          bufferedScheduledTaskRunId: settled.bufferedScheduledTaskRunId
+        };
+      } catch (error) {
+        const failure = error instanceof SyncFailure ? error : new SyncFailure("internal_failure", false);
+        summary.phase = "failed";
+        summary.retryable ||= failure.retryable;
+        summary.elapsedMs = Date.now() - startedAt;
+        summary.reconnectRequired = failure.reconnectRequired;
+        summary.failed = Math.max(summary.failed, 1);
+        if (summary.failures.length === 0) {
+          summary.failures.push({
+            externalObjectId: input.sourceId,
+            code: failure.code,
+            retryable: failure.retryable,
+            message: boundedError(error)
+          });
+        }
+        if (knowledgeRunId) {
+          await completeKnowledgeSyncRun(db, {
+            accountId: input.accountId,
+            workspaceId: input.workspaceId,
+            initiatingSubjectId: action.initiatingSubjectId,
+            runId: knowledgeRunId,
+            state: "failed",
+            metadata: summary,
+            errorCode: failure.code,
+            reasonCode: "scheduled_source_sync_failed"
+          }).catch(() => void 0);
+        }
+        const settlementInput = {
+          accountId: input.accountId,
+          workspaceId: input.workspaceId,
+          sourceId: input.sourceId,
+          scheduledTaskRunId: input.scheduledTaskRunId,
+          knowledgeSyncRunId: knowledgeRunId,
+          status: "failed",
+          summary,
+          error: failure.code,
+          sourceConfigGeneration: action.sourceConfigGeneration,
+          sourceLifecycleGeneration: action.sourceLifecycleGeneration,
+          sourceSyncGeneration: activeSourceSyncGeneration ?? lease.state.sourceSyncGeneration,
+          // Failed or incomplete provider walks are not authoritative scans.
+          // A later scheduled run must restart from the root under a fresh
+          // observation generation before it can infer object absence.
+          executionCheckpoint: null
+        };
+        const settled = failure.reconnectRequired ? await deauthorizeAndSettleKnowledgeSourceSyncFailure(db, {
+          deauthorization: {
+            accountId: input.accountId,
+            workspaceId: input.workspaceId,
+            sourceId: input.sourceId,
+            audience: action.destination,
+            operationId: `knowledge-sync-deauthorize:${input.sourceId}:${action.connection.connectionVersion}:${failure.code}`,
+            reasonCode: "connection_reconnect_required",
+            actor: {
+              kind: "service",
+              subjectId: "knowledge-source-sync",
+              initiatingHumanSubjectId: action.initiatingSubjectId
+            }
+          },
+          settlement: settlementInput
+        }) : await settleKnowledgeSourceSyncLease(db, settlementInput);
+        await recordConnectorUsage("completed", summary.scanned, "item");
+        await recordConnectorUsage("items", summary.imported, "item");
+        await recordConnectorUsage("bytes", summary.bytes, "byte");
+        observability.incrementCounter({
+          name: "opengeni_knowledge_source_sync_runs_total",
+          labels: { provider: providerLabel, outcome: "failed" }
+        });
+        for (const outcome of ["imported", "unchanged", "skipped", "failed"]) {
+          observability.incrementCounter({
+            name: "opengeni_knowledge_source_sync_items_total",
+            labels: { provider: providerLabel, outcome },
+            amount: summary[outcome]
+          });
+        }
+        observability.incrementCounter({
+          name: "opengeni_knowledge_source_sync_bytes_total",
+          labels: { provider: providerLabel },
+          amount: summary.bytes
+        });
+        recordSyncHealthTelemetry(observability, providerLabel, summary, "failed", failure);
+        return {
+          action: "failed",
+          summary,
+          errorCode: failure.code,
+          bufferedWake: settled.bufferedWake,
+          bufferedScheduledTaskRunId: settled.bufferedScheduledTaskRunId
+        };
+      }
+      async function failWithoutProvider(code) {
+        const terminalSummary = {
+          phase: "failed",
+          scanned: 0,
+          imported: 0,
+          unchanged: 0,
+          skipped: 0,
+          failed: 1,
+          bytes: 0,
+          providerRequests: 0,
+          elapsedMs: 0,
+          indexed: 0,
+          aclPending: 0,
+          retryable: false,
+          limitReached: null,
+          checkpointed: false,
+          reconnectRequired: false,
+          failures: [
+            {
+              externalObjectId: input.sourceId,
+              code: "authority_changed",
+              retryable: false,
+              message: code
+            }
+          ]
+        };
+        await updateScheduledTaskRun(db, input.workspaceId, input.scheduledTaskRunId, {
+          knowledgeSummary: terminalSummary
+        }).catch(() => void 0);
+        await completeKnowledgeSourceSyncWakeWithoutLease(db, {
+          accountId: input.accountId,
+          workspaceId: input.workspaceId,
+          sourceId: input.sourceId,
+          scheduledTaskRunId: input.scheduledTaskRunId
+        }).catch(() => void 0);
+        await recordConnectorUsage("completed", 0, "item").catch(() => void 0);
+        observability.incrementCounter({
+          name: "opengeni_knowledge_source_sync_runs_total",
+          labels: { provider: "unknown", outcome: "failed_preflight" }
+        });
+        return { action: "failed", bufferedWake: false, summary: terminalSummary, errorCode: code };
+      }
+      async function recordConnectorUsage(kind, quantity, unit) {
+        if (quantity === 0 && kind !== "completed") return;
+        await recordUsageEvent(db, {
+          accountId: input.accountId,
+          workspaceId: input.workspaceId,
+          eventType: `knowledge_source_sync.${kind}`,
+          quantity: kind === "completed" ? 1 : quantity,
+          unit,
+          sourceResourceType: "scheduled_task_run",
+          sourceResourceId: input.scheduledTaskRunId,
+          initiator: { kind: "service", subjectId: "knowledge-source-sync" },
+          initiatorContext: {
+            scheduledTaskId: input.taskId,
+            scheduledTaskRunId: input.scheduledTaskRunId
+          },
+          origin: "scheduled_task",
+          idempotencyKey: `usage:knowledge_source_sync.${kind}:${input.scheduledTaskRunId}`
+        });
+      }
+    }
+  };
+}
+async function deauthorizeAndSettleKnowledgeSourceSyncFailure(db, input) {
+  try {
+    await deauthorizeKnowledgeSourceRetrieval(db, input.deauthorization);
+  } catch (error) {
+    await releaseKnowledgeSourceSyncLeaseForRetry(db, {
+      accountId: input.settlement.accountId,
+      workspaceId: input.settlement.workspaceId,
+      sourceId: input.settlement.sourceId,
+      scheduledTaskRunId: input.settlement.scheduledTaskRunId
+    });
+    throw error;
+  }
+  return await settleKnowledgeSourceSyncLease(db, input.settlement);
+}
+async function resolveKnowledgeSyncProvider(input) {
+  const { action } = input;
+  const connection = await getConnectionMetadata2(
+    input.db,
+    input.workspaceId,
+    action.connection.connectionId,
+    action.initiatingSubjectId
+  );
+  if (!connection || connection.accountId !== input.accountId || connection.subjectId !== action.connection.ownerSubjectId || connection.providerDomain.toLowerCase() !== action.connection.providerDomain.toLowerCase() || connection.kind !== action.connection.kind || connection.version < action.connection.connectionVersion || connection.status !== "active") {
+    throw new SyncFailure("connection_reconnect_required", true, true);
+  }
+  const googleInitial = connection.providerDomain === GOOGLE_DRIVE_PROVIDER_DOMAIN ? GoogleDriveConnectionMetadata.safeParse(connection.metadata) : null;
+  const atlassianInitial = connection.providerDomain === ATLASSIAN_PROVIDER_DOMAIN ? AtlassianConnectionMetadata.safeParse(connection.metadata) : null;
+  const initialAtlassianMetadata = atlassianInitial?.success ? atlassianInitial.data : null;
+  if (!googleInitial?.success && !initialAtlassianMetadata) {
+    throw new SyncFailure("provider_rejected", false);
+  }
+  if (googleInitial?.success && !googleDriveScopesAllowCapability(connection.grantedScopes, "recursive_source_sync")) {
+    throw new SyncFailure("connection_reconnect_required", true, true);
+  }
+  if (atlassianInitial?.success && !atlassianScopesAllowRead(connection.grantedScopes)) {
+    throw new SyncFailure("connection_reconnect_required", true, true);
+  }
+  const initialLifecycle = googleInitial?.success ? googleInitial.data.lifecycle : initialAtlassianMetadata.lifecycle;
+  if (initialLifecycle?.state && initialLifecycle.state !== "active") {
+    throw new SyncFailure("connection_reconnect_required", true, true);
+  }
+  const initialSource = googleInitial?.success ? selectedDriveSource(googleInitial.data, input.externalSourceId) : selectedAtlassianSource(initialAtlassianMetadata, input.externalSourceId);
+  if (!initialSource || !initialSource.syncEnabled || initialSource.configGeneration !== action.sourceConfigGeneration || !initialSource.destination || scopedKnowledgeScopeKey(
+    googleInitial?.success ? googleDriveKnowledgeScope(initialSource.destination) : atlassianKnowledgeScope(initialSource.destination)
+  ) !== scopedKnowledgeScopeKey(action.destination)) {
+    throw new SyncFailure("authority_changed", false);
+  }
+  const token = await buildConnectionTokenResolver(
+    input.db,
+    input.settings
+  )({
+    workspaceId: input.workspaceId,
+    subjectId: action.initiatingSubjectId,
+    serverId: "knowledge-source-sync",
+    connectionRef: {
+      connectionId: connection.id,
+      providerDomain: connection.providerDomain,
+      kind: connection.kind,
+      subjectScope: "subject"
+    },
+    destinationUrl: connection.providerDomain === ATLASSIAN_PROVIDER_DOMAIN ? ATLASSIAN_API_BASE : "https://www.googleapis.com"
+  });
+  if (token.status !== "ok") {
+    throw new SyncFailure("connection_reconnect_required", true, true);
+  }
+  const resolvedConnection = await getConnectionMetadata2(
+    input.db,
+    input.workspaceId,
+    action.connection.connectionId,
+    action.initiatingSubjectId
+  );
+  if (!resolvedConnection || resolvedConnection.accountId !== input.accountId || resolvedConnection.subjectId !== action.connection.ownerSubjectId || resolvedConnection.providerDomain.toLowerCase() !== action.connection.providerDomain.toLowerCase() || resolvedConnection.kind !== action.connection.kind || resolvedConnection.version !== token.connectionVersion || resolvedConnection.status !== "active") {
+    throw new SyncFailure("connection_reconnect_required", true, true);
+  }
+  const authorization = token.headers.Authorization ?? token.headers.authorization;
+  if (resolvedConnection.providerDomain === GOOGLE_DRIVE_PROVIDER_DOMAIN) {
+    const metadata = GoogleDriveConnectionMetadata.parse(resolvedConnection.metadata);
+    if (!googleDriveSyncProviderAccessAllowed({
+      connectionVersion: resolvedConnection.version,
+      resolvedConnectionVersion: token.connectionVersion,
+      connectionStatus: resolvedConnection.status,
+      lifecycleState: metadata.lifecycle?.state,
+      grantedScopes: resolvedConnection.grantedScopes
+    })) {
+      throw new SyncFailure("connection_reconnect_required", true, true);
+    }
+    const source = selectedDriveSource(metadata, input.externalSourceId);
+    if (!validSelectedSource(source, action, googleDriveKnowledgeScope)) {
+      throw new SyncFailure("authority_changed", false);
+    }
+    return {
+      kind: "google_drive",
+      selectedDestination: source.destination,
+      aclAuthority: {
+        connectionId: resolvedConnection.id,
+        connectionVersion: resolvedConnection.version,
+        sourceGooglePermissionId: metadata.googlePermissionId
+      },
+      driver: googleDriveSyncDriver({
+        actionProviderCoordinationKey: action.providerCoordinationKey,
+        metadata,
+        selectedSource: source,
+        accountId: input.accountId,
+        workspaceId: input.workspaceId,
+        initiatingSubjectId: action.initiatingSubjectId,
+        authorization,
+        retry: googleDriveProviderRetryOptions(input.settings),
+        observability: input.observability,
+        limits: action.limits,
+        connectionId: resolvedConnection.id,
+        fullReconciliationIntervalMs: GOOGLE_DRIVE_FULL_RECONCILIATION_INTERVAL_MS,
+        observedExternalObjectIds: async (externalObjectIds) => await listObservedKnowledgeSourceSyncExternalObjectIds(input.db, {
+          accountId: input.accountId,
+          workspaceId: input.workspaceId,
+          sourceId: input.sourceId,
+          externalObjectIds
+        })
+      })
+    };
+  }
+  if (resolvedConnection.providerDomain === ATLASSIAN_PROVIDER_DOMAIN) {
+    const metadata = AtlassianConnectionMetadata.parse(resolvedConnection.metadata);
+    if (metadata.lifecycle?.state !== "active" || !atlassianScopesAllowRead(resolvedConnection.grantedScopes)) {
+      throw new SyncFailure("connection_reconnect_required", true, true);
+    }
+    const source = selectedAtlassianSource(metadata, input.externalSourceId);
+    if (!validSelectedSource(source, action, atlassianKnowledgeScope)) {
+      throw new SyncFailure("authority_changed", false);
+    }
+    return {
+      kind: "atlassian",
+      selectedDestination: source.destination,
+      aclAuthority: null,
+      driver: atlassianSyncDriver({
+        actionProviderCoordinationKey: action.providerCoordinationKey,
+        metadata,
+        selectedSource: source,
+        authorization,
+        limits: action.limits
+      })
+    };
+  }
+  throw new SyncFailure("provider_rejected", false);
+}
+function validSelectedSource(source, action, scope) {
+  return Boolean(
+    source && source.syncEnabled && source.configGeneration === action.sourceConfigGeneration && source.destination && scopedKnowledgeScopeKey(scope(source.destination)) === scopedKnowledgeScopeKey(action.destination)
+  );
+}
+function selectedAtlassianSource(metadata, externalSourceId) {
+  return metadata.selectedSources.find((source) => source.id === externalSourceId) ?? null;
+}
+function atlassianSyncDriver(input) {
+  return {
+    providerKey: "atlassian",
+    providerDomain: ATLASSIAN_PROVIDER_DOMAIN,
+    providerCoordinationKey: input.actionProviderCoordinationKey,
+    inventory: async (checkpoint) => {
+      const inventory = await inventoryAtlassianSource({
+        cloudId: input.selectedSource.cloudId,
+        source: input.selectedSource,
+        limits: {
+          maxItems: input.limits.maxItems,
+          maxApiRequests: input.limits.maxProviderRequests,
+          maxElapsedMs: input.limits.maxElapsedSeconds * 1e3,
+          pageSize: Math.min(input.limits.maxItems, 100)
+        },
+        checkpoint,
+        listPage: async (cursor, pageSize) => await listAtlassianItems(input.selectedSource, cursor, pageSize, input.authorization)
+      });
+      return {
+        ...inventory,
+        providerCursor: null,
+        authoritativeFullScan: inventory.status === "complete",
+        cursorInvalidated: false,
+        hardLimitReached: inventory.status === "paused" && inventory.stopReason !== "elapsed_time_limit" && inventory.stopReason !== "provider_error"
+      };
+    },
+    fetchContent: async (entry, maxBytes) => await fetchAtlassianContent(input.selectedSource, entry, input.authorization, maxBytes),
+    citationLocator: (entry) => ({
+      version: 1,
+      providerKey: "atlassian",
+      providerCoordinationKey: input.actionProviderCoordinationKey,
+      cloudId: input.selectedSource.cloudId,
+      sourceKind: input.selectedSource.kind,
+      externalObjectId: entry.externalObjectId,
+      sourceUri: entry.sourceUri
+    })
+  };
+}
+function googleDriveSyncDriver(input) {
+  const maxElapsedMs = input.limits.maxElapsedSeconds * 1e3;
+  const provider = input.provider ?? {
+    getStartPageToken: async (driveId) => await getDriveStartPageToken(driveId, input.authorization, input.retry, input.observability),
+    listChanges: async (pageToken, driveId, pageSize) => await listDriveChanges(
+      pageToken,
+      driveId,
+      pageSize,
+      input.authorization,
+      input.retry,
+      input.observability
+    ),
+    getFile: async (fileId) => await getDriveFile(fileId, input.authorization, input.retry, input.observability),
+    listChildren: async (request) => await listDriveChildren(request, input.authorization, input.retry, input.observability),
+    listPermissions: async (request) => await listDrivePermissions(request, input.authorization, input.retry, input.observability)
+  };
+  const clock = provider.now ?? Date.now;
+  const budgetLimits = {
+    maxItems: input.limits.maxItems,
+    maxProviderRequests: input.limits.maxProviderRequests,
+    maxElapsedMs
+  };
+  return {
+    providerKey: "google_drive",
+    providerDomain: GOOGLE_DRIVE_PROVIDER_DOMAIN,
+    providerCoordinationKey: input.actionProviderCoordinationKey,
+    inventory: async (executionCheckpoint, providerCursor) => {
+      const expectedCursor = {
+        connectionId: input.connectionId,
+        googlePermissionId: input.metadata.googlePermissionId,
+        sourceId: input.selectedSource.id,
+        driveId: input.selectedSource.driveId
+      };
+      const legacyFullCheckpoint = isLegacyGoogleDriveFullReconciliationCheckpoint(
+        executionCheckpoint,
+        expectedCursor
+      );
+      const cursor = parseGoogleDriveChangesCursor(providerCursor, expectedCursor);
+      const checkpoint = parseGoogleDriveExecutionCheckpoint(
+        executionCheckpoint,
+        expectedCursor,
+        budgetLimits
+      );
+      const now = new Date(clock());
+      const runFullReconciliation = async (full) => {
+        const inventoryItems = full.inventoryCheckpoint?.totals.itemCount ?? 0;
+        const inventoryProviderRequests = full.inventoryCheckpoint?.totals.apiRequestCount ?? 0;
+        const budgetBeforeInvocation = {
+          examinedItems: full.budgetBeforeInventory.examinedItems + inventoryItems,
+          providerRequests: full.budgetBeforeInventory.providerRequests + inventoryProviderRequests,
+          elapsedMs: full.budgetBeforeInventory.elapsedMs + full.inventoryElapsedMs
+        };
+        const hardStopReason = googleDriveHardLimitReason(budgetBeforeInvocation, budgetLimits);
+        const fullCheckpoint = buildGoogleDriveFullReconciliationCheckpoint({
+          ...expectedCursor,
+          ...full
+        });
+        if (hardStopReason) {
+          return {
+            status: "paused",
+            stopReason: hardStopReason,
+            entries: [],
+            checkpoint: fullCheckpoint,
+            providerCursor,
+            authoritativeFullScan: false,
+            cursorInvalidated: full.cursorInvalidated,
+            providerRequests: budgetBeforeInvocation.providerRequests,
+            elapsedMs: budgetBeforeInvocation.elapsedMs,
+            hardLimitReached: true
+          };
+        }
+        const phaseMaxItems = input.limits.maxItems - full.budgetBeforeInventory.examinedItems;
+        const phaseMaxProviderRequests = input.limits.maxProviderRequests - full.budgetBeforeInventory.providerRequests;
+        const remainingElapsedMs = maxElapsedMs - budgetBeforeInvocation.elapsedMs;
+        const inventory = await inventoryGoogleDriveSource({
+          googlePermissionId: input.metadata.googlePermissionId,
+          googleEmail: input.metadata.googleEmail,
+          source: input.selectedSource,
+          accountId: input.accountId,
+          workspaceId: input.workspaceId,
+          connectionSubjectId: input.initiatingSubjectId,
+          limits: {
+            maxItems: phaseMaxItems,
+            maxKnownBytes: input.limits.maxBytes,
+            maxApiRequests: phaseMaxProviderRequests,
+            maxElapsedMs: Math.min(GOOGLE_DRIVE_SYNC_INVOCATION_SLICE_MS, remainingElapsedMs),
+            maxFileBytes: input.limits.maxFileBytes,
+            maxFolders: Math.min(phaseMaxItems * 2, 2e3),
+            pageSize: Math.min(phaseMaxItems, 100)
+          },
+          checkpoint: full.inventoryCheckpoint,
+          listChildren: provider.listChildren,
+          now: clock
+        });
+        const inventoryElapsedMs = full.inventoryElapsedMs + inventory.run.elapsedMs;
+        const budget = {
+          examinedItems: full.budgetBeforeInventory.examinedItems + inventory.totals.itemCount,
+          providerRequests: full.budgetBeforeInventory.providerRequests + inventory.totals.apiRequestCount,
+          elapsedMs: full.budgetBeforeInventory.elapsedMs + inventoryElapsedMs
+        };
+        const reconciled = reconcileGoogleDriveRevisionFloors(
+          inventory.entries,
+          full.revisionFloors,
+          input.limits.maxItems
+        );
+        if (reconciled.conflict) {
+          return {
+            status: "paused",
+            stopReason: "incomplete_search",
+            entries: [],
+            checkpoint: fullCheckpoint,
+            providerCursor,
+            authoritativeFullScan: false,
+            cursorInvalidated: full.cursorInvalidated,
+            providerRequests: budget.providerRequests,
+            elapsedMs: budget.elapsedMs,
+            hardLimitReached: false
+          };
+        }
+        const nextCursor = inventory.status === "complete" ? buildGoogleDriveChangesCursor({
+          ...expectedCursor,
+          boundaryId: full.boundaryId,
+          pageToken: full.startPageToken,
+          previousGeneration: cursor?.cursorGeneration ?? 0,
+          reconciledAt: now,
+          fullReconciliationIntervalMs: input.fullReconciliationIntervalMs
+        }) : providerCursor;
+        return {
+          status: inventory.status,
+          stopReason: inventory.stopReason,
+          entries: reconciled.entries,
+          checkpoint: inventory.status === "paused" && inventory.checkpoint ? buildGoogleDriveFullReconciliationCheckpoint({
+            ...expectedCursor,
+            boundaryId: full.boundaryId,
+            startPageToken: full.startPageToken,
+            cursorInvalidated: full.cursorInvalidated,
+            budgetBeforeInventory: full.budgetBeforeInventory,
+            inventoryElapsedMs,
+            inventoryCheckpoint: inventory.checkpoint,
+            revisionFloors: reconciled.revisionFloors
+          }) : null,
+          providerCursor: nextCursor,
+          authoritativeFullScan: inventory.status === "complete",
+          cursorInvalidated: full.cursorInvalidated,
+          providerRequests: budget.providerRequests,
+          elapsedMs: budget.elapsedMs,
+          hardLimitReached: inventory.status === "paused" && googleDriveInventoryStopIsHard(inventory.stopReason, budget, budgetLimits)
+        };
+      };
+      const acquireFullReconciliation = async (details) => {
+        const acquisitionStartedAt = clock();
+        const initialElapsedMs = details.budget.elapsedMs;
+        const budget = { ...details.budget };
+        const refreshElapsed = () => {
+          budget.elapsedMs = initialElapsedMs + Math.max(0, clock() - acquisitionStartedAt);
+        };
+        const requireProviderCapacity = () => {
+          refreshElapsed();
+          if (googleDriveHardLimitReason(budget, budgetLimits)) {
+            throw new SyncFailure("resource_limit", false);
+          }
+          budget.providerRequests += 1;
+        };
+        requireProviderCapacity();
+        const startPageToken = await provider.getStartPageToken(input.selectedSource.driveId);
+        refreshElapsed();
+        let boundaryId = details.boundaryId;
+        if (!boundaryId) {
+          if (input.selectedSource.id === "root" && input.selectedSource.driveId === null) {
+            requireProviderCapacity();
+            try {
+              boundaryId = await resolveGoogleDriveChangesBoundaryId({
+                source: input.selectedSource,
+                getFile: provider.getFile
+              });
+            } catch (error) {
+              if (error instanceof GoogleDriveChangesProtocolError) {
+                throw new SyncFailure("provider_payload_invalid", false);
+              }
+              throw error;
+            }
+            refreshElapsed();
+          } else {
+            boundaryId = input.selectedSource.id;
+          }
+        }
+        return {
+          boundaryId,
+          startPageToken,
+          cursorInvalidated: details.cursorInvalidated,
+          budgetBeforeInventory: budget,
+          inventoryElapsedMs: 0,
+          inventoryCheckpoint: null,
+          revisionFloors: []
+        };
+      };
+      if (checkpoint?.kind === "google_drive_full_reconciliation") {
+        return await runFullReconciliation(checkpoint);
+      }
+      if (!cursor) {
+        const budget = checkpoint?.kind === "google_drive_changes" ? checkpoint.changesCheckpoint.budget : emptyGoogleDriveSyncBudget();
+        return await runFullReconciliation(
+          await acquireFullReconciliation({
+            budget,
+            boundaryId: null,
+            cursorInvalidated: providerCursor !== null
+          })
+        );
+      }
+      if (!checkpoint && !legacyFullCheckpoint && googleDriveFullReconciliationDue(cursor, now)) {
+        return await runFullReconciliation(
+          await acquireFullReconciliation({
+            budget: emptyGoogleDriveSyncBudget(),
+            boundaryId: cursor.boundaryId,
+            cursorInvalidated: false
+          })
+        );
+      }
+      try {
+        const forceFullReconciliation = legacyFullCheckpoint || googleDriveFullReconciliationDue(cursor, now);
+        const changesCheckpoint = checkpoint?.kind === "google_drive_changes" ? {
+          ...checkpoint.changesCheckpoint,
+          requiresFullReconciliation: checkpoint.changesCheckpoint.requiresFullReconciliation || forceFullReconciliation
+        } : null;
+        const changes = await drainGoogleDriveChanges({
+          source: input.selectedSource,
+          cursor,
+          checkpoint: changesCheckpoint,
+          maxItems: input.limits.maxItems,
+          maxProviderRequests: input.limits.maxProviderRequests,
+          maxElapsedMs,
+          maxInvocationElapsedMs: Math.min(GOOGLE_DRIVE_SYNC_INVOCATION_SLICE_MS, maxElapsedMs),
+          maxFileBytes: input.limits.maxFileBytes,
+          listChanges: async (pageToken, pageSize) => await provider.listChanges(pageToken, input.selectedSource.driveId, pageSize),
+          getFile: provider.getFile,
+          observedExternalObjectIds: input.observedExternalObjectIds,
+          now: clock
+        });
+        if (changes.status === "paused" && changes.checkpoint) {
+          return {
+            status: "paused",
+            stopReason: changes.stopReason,
+            entries: changes.entries,
+            checkpoint: {
+              version: 2,
+              kind: "google_drive_changes",
+              ...expectedCursor,
+              changesCheckpoint: {
+                ...changes.checkpoint,
+                requiresFullReconciliation: changes.checkpoint.requiresFullReconciliation || forceFullReconciliation
+              }
+            },
+            providerCursor,
+            authoritativeFullScan: false,
+            cursorInvalidated: false,
+            providerRequests: changes.providerRequests,
+            elapsedMs: changes.elapsedMs,
+            hardLimitReached: changes.hardLimitReached
+          };
+        }
+        if (!changes.newStartPageToken) throw new Error("google_drive_changes_cursor_missing");
+        if (changes.requiresFullReconciliation || forceFullReconciliation) {
+          const hardStopReason = googleDriveHardLimitReason(changes.budget, budgetLimits);
+          return {
+            status: "paused",
+            stopReason: hardStopReason ?? "elapsed_time_limit",
+            entries: changes.entries,
+            checkpoint: buildGoogleDriveFullReconciliationCheckpoint({
+              ...expectedCursor,
+              boundaryId: cursor.boundaryId,
+              startPageToken: changes.newStartPageToken,
+              cursorInvalidated: false,
+              budgetBeforeInventory: changes.budget,
+              inventoryElapsedMs: 0,
+              inventoryCheckpoint: null,
+              revisionFloors: revisionFloorsForEntries(changes.entries, input.limits.maxItems)
+            }),
+            providerCursor,
+            authoritativeFullScan: false,
+            cursorInvalidated: false,
+            providerRequests: changes.providerRequests,
+            elapsedMs: changes.elapsedMs,
+            hardLimitReached: hardStopReason !== null
+          };
+        }
+        return {
+          status: "complete",
+          stopReason: null,
+          entries: changes.entries,
+          checkpoint: null,
+          providerCursor: advanceGoogleDriveChangesCursor(cursor, changes.newStartPageToken),
+          authoritativeFullScan: false,
+          cursorInvalidated: false,
+          providerRequests: changes.providerRequests,
+          elapsedMs: changes.elapsedMs,
+          hardLimitReached: false
+        };
+      } catch (error) {
+        if (error instanceof GoogleDriveChangesProtocolError) {
+          throw new SyncFailure("provider_payload_invalid", false);
+        }
+        if (!(error instanceof GoogleDriveCursorInvalidError)) throw error;
+        const full = await acquireFullReconciliation({
+          budget: error.budget ?? emptyGoogleDriveSyncBudget(),
+          boundaryId: cursor.boundaryId,
+          cursorInvalidated: true
+        });
+        const hardStopReason = googleDriveHardLimitReason(full.budgetBeforeInventory, budgetLimits);
+        return {
+          status: "paused",
+          stopReason: hardStopReason ?? "elapsed_time_limit",
+          entries: [],
+          checkpoint: buildGoogleDriveFullReconciliationCheckpoint({
+            ...expectedCursor,
+            ...full
+          }),
+          providerCursor,
+          authoritativeFullScan: false,
+          cursorInvalidated: true,
+          providerRequests: full.budgetBeforeInventory.providerRequests,
+          elapsedMs: full.budgetBeforeInventory.elapsedMs,
+          hardLimitReached: hardStopReason !== null
+        };
+      }
+    },
+    fetchContent: async (entry, maxBytes) => await fetchDriveBytes(entry, input.authorization, maxBytes, input.retry, input.observability),
+    readAcl: async (entry, maxProviderRequests) => {
+      if (!provider.listPermissions) {
+        throw new SyncFailure("provider_rejected", false);
+      }
+      return await collectGoogleDriveAclEvidence({
+        entry,
+        maxProviderRequests,
+        listPermissions: provider.listPermissions,
+        getFile: provider.getFile,
+        now: clock
+      });
+    },
+    citationLocator: (entry) => ({
+      version: 2,
+      providerKey: "google-drive",
+      providerCoordinationKey: input.actionProviderCoordinationKey,
+      externalObjectId: entry.externalObjectId,
+      providerRevision: entry.externalVersionId,
+      driveId: entry.driveId,
+      sourceUri: entry.sourceUri
+    })
+  };
+}
+function isLegacyGoogleDriveFullReconciliationCheckpoint(value, expected) {
+  return value?.version === 2 && value.kind === "google_drive_full_reconciliation" && value.connectionId === expected.connectionId && value.googlePermissionId === expected.googlePermissionId && value.sourceId === expected.sourceId && value.driveId === expected.driveId && encodedJsonBytes(value) <= GOOGLE_DRIVE_EXECUTION_CHECKPOINT_MAX_BYTES;
+}
+function parseGoogleDriveExecutionCheckpoint(value, expected, limits) {
+  if (!value || value.connectionId !== expected.connectionId || value.googlePermissionId !== expected.googlePermissionId || value.sourceId !== expected.sourceId || value.driveId !== expected.driveId || encodedJsonBytes(value) > GOOGLE_DRIVE_EXECUTION_CHECKPOINT_MAX_BYTES) {
+    return null;
+  }
+  if (value.version === 2 && value.kind === "google_drive_changes") {
+    const changesCheckpoint = parseGoogleDriveChangesCheckpoint(value.changesCheckpoint, limits);
+    return changesCheckpoint ? { ...value, changesCheckpoint } : null;
+  }
+  if (value.version === 3 && value.kind === "google_drive_full_reconciliation") {
+    const budgetBeforeInventory = parseGoogleDriveSyncBudget(value.budgetBeforeInventory, limits);
+    const revisionFloors = parseGoogleDriveRevisionFloors(value.revisionFloors, limits.maxItems);
+    if (typeof value.boundaryId !== "string" || value.boundaryId.length < 1 || value.boundaryId.length > 1024 || typeof value.startPageToken !== "string" || value.startPageToken.length < 1 || value.startPageToken.length > 4096 || typeof value.cursorInvalidated !== "boolean" || !budgetBeforeInventory || !revisionFloors || !Number.isSafeInteger(value.inventoryElapsedMs) || Number(value.inventoryElapsedMs) < 0 || Number(value.inventoryElapsedMs) > limits.maxElapsedMs || budgetBeforeInventory.elapsedMs + Number(value.inventoryElapsedMs) > limits.maxElapsedMs || value.inventoryCheckpoint !== null && (!value.inventoryCheckpoint || typeof value.inventoryCheckpoint !== "object" || Array.isArray(value.inventoryCheckpoint))) {
+      return null;
+    }
+    return {
+      ...value,
+      budgetBeforeInventory,
+      inventoryElapsedMs: Number(value.inventoryElapsedMs),
+      revisionFloors
+    };
+  }
+  return null;
+}
+function buildGoogleDriveFullReconciliationCheckpoint(input) {
+  const checkpoint = {
+    version: 3,
+    kind: "google_drive_full_reconciliation",
+    ...input,
+    revisionFloors: input.revisionFloors.map((floor) => [...floor])
+  };
+  if (encodedJsonBytes(checkpoint) > GOOGLE_DRIVE_EXECUTION_CHECKPOINT_MAX_BYTES) {
+    throw new SyncFailure("resource_limit", false);
+  }
+  return checkpoint;
+}
+function parseGoogleDriveRevisionFloors(value, maxItems) {
+  if (!Array.isArray(value) || value.length > maxItems) return null;
+  const floors = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const floor of value) {
+    if (!Array.isArray(floor) || floor.length !== 2 || typeof floor[0] !== "string" || floor[0].trim().length < 1 || floor[0].length > 1024 || floor[1] !== null && (typeof floor[1] !== "string" || floor[1].length < 1 || floor[1].length > 256) || seen.has(floor[0])) {
+      return null;
+    }
+    seen.add(floor[0]);
+    floors.push([floor[0], floor[1]]);
+  }
+  return floors;
+}
+function revisionFloorsForEntries(entries, maxItems) {
+  const reconciled = reconcileGoogleDriveRevisionFloors(entries, [], maxItems);
+  if (reconciled.conflict) throw new SyncFailure("provider_payload_invalid", false);
+  return reconciled.revisionFloors;
+}
+function shouldProcessGoogleDriveDurableObservation(input) {
+  if (input.observation.externalObjectId !== input.entry.externalObjectId) {
+    throw new SyncFailure("provider_payload_invalid", false);
+  }
+  if (input.observation.disposition === "accepted" || input.observation.disposition === "replayed") {
+    return true;
+  }
+  if (input.observation.disposition === "conflict") {
+    throw new SyncFailure("provider_payload_invalid", false);
+  }
+  const current = input.observation.currentVersion;
+  const comparison = current ? compareCanonicalDecimalProviderRevisions(
+    current.providerRevision,
+    input.observation.providerRevision
+  ) : null;
+  const fullyProcessed = current !== null && current.objectLifecycleState === "active" && current.sourceLifecycleGeneration === input.sourceLifecycleGeneration && current.objectLifecycleGeneration === current.currentObjectLifecycleGeneration && current.aclGeneration === input.aclGeneration && current.indexObligationStatus === "indexed" && comparison !== null && comparison >= 0 && (comparison > 0 || current.metadataHash === input.observation.metadataHash);
+  if (!fullyProcessed) throw new SyncFailure("provider_payload_invalid", false);
+  return false;
+}
+function mergeGoogleDriveDurableObservationFloors(checkpoint, observations, maxItems) {
+  if (!checkpoint || checkpoint.version !== 3 || checkpoint.kind !== "google_drive_full_reconciliation") {
+    return checkpoint;
+  }
+  const parsedFloors = parseGoogleDriveRevisionFloors(checkpoint.revisionFloors, maxItems);
+  if (!parsedFloors) throw new SyncFailure("provider_payload_invalid", false);
+  const floors = new Map(parsedFloors);
+  for (const observation of observations) {
+    floors.set(observation.externalObjectId, observation.providerRevision);
+  }
+  if (floors.size > maxItems) throw new SyncFailure("resource_limit", false);
+  const merged = {
+    ...checkpoint,
+    revisionFloors: [...floors]
+  };
+  if (encodedJsonBytes(merged) > GOOGLE_DRIVE_EXECUTION_CHECKPOINT_MAX_BYTES) {
+    throw new SyncFailure("resource_limit", false);
+  }
+  return merged;
+}
+function reconcileGoogleDriveRevisionFloors(entries, existingFloors, maxItems) {
+  const floors = new Map(existingFloors);
+  const accepted = [];
+  for (const entry of entries) {
+    if (!floors.has(entry.externalObjectId)) {
+      floors.set(entry.externalObjectId, entry.externalVersionId);
+      accepted.push(entry);
+    } else {
+      const comparison = compareCanonicalDecimalProviderRevisions(
+        entry.externalVersionId,
+        floors.get(entry.externalObjectId) ?? null
+      );
+      if (comparison === null) {
+        return {
+          entries: [],
+          revisionFloors: [...floors],
+          conflict: true
+        };
+      }
+      if (comparison > 0) {
+        floors.set(entry.externalObjectId, entry.externalVersionId);
+        accepted.push(entry);
+      }
+    }
+    if (floors.size > maxItems) throw new SyncFailure("resource_limit", false);
+  }
+  return {
+    entries: accepted,
+    revisionFloors: [...floors],
+    conflict: false
+  };
+}
+function encodedJsonBytes(value) {
+  try {
+    return new TextEncoder().encode(JSON.stringify(value)).byteLength;
+  } catch {
+    return Number.POSITIVE_INFINITY;
+  }
+}
+function parseGoogleDriveSyncBudget(value, limits) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return null;
+  const row = value;
+  for (const [key, maximum] of [
+    ["examinedItems", limits.maxItems],
+    ["providerRequests", limits.maxProviderRequests],
+    ["elapsedMs", limits.maxElapsedMs]
+  ]) {
+    const budgetValue = row[key];
+    if (!Number.isSafeInteger(budgetValue) || Number(budgetValue) < 0 || Number(budgetValue) > maximum) {
+      return null;
+    }
+  }
+  return value;
+}
+function emptyGoogleDriveSyncBudget() {
+  return { examinedItems: 0, providerRequests: 0, elapsedMs: 0 };
+}
+function googleDriveHardLimitReason(budget, limits) {
+  if (budget.examinedItems >= limits.maxItems) return "item_limit";
+  if (budget.providerRequests >= limits.maxProviderRequests) return "api_request_limit";
+  if (budget.elapsedMs >= limits.maxElapsedMs) return "elapsed_time_limit";
+  return null;
+}
+function googleDriveInventoryStopIsHard(reason, budget, limits) {
+  if (reason === "api_request_limit" || reason === "item_limit" || reason === "known_byte_limit") {
+    return true;
+  }
+  return reason === "elapsed_time_limit" && budget.elapsedMs >= limits.maxElapsedMs;
+}
+async function getDriveStartPageToken(driveId, authorization, retry, observability) {
+  if (!authorization) throw new SyncFailure("connection_reconnect_required", true, true);
+  const url = new URL(`${DRIVE_API_BASE}/changes/startPageToken`);
+  url.searchParams.set("supportsAllDrives", "true");
+  if (driveId) url.searchParams.set("driveId", driveId);
+  const response = await requestGoogleDrive(
+    url,
+    { headers: { authorization, accept: "application/json" } },
+    "start_page_token",
+    retry,
+    observability
+  );
+  if (!response.ok) throwGoogleDriveResponse(response);
+  const payload = await readResponseJsonBounded(
+    response,
+    DRIVE_JSON_MAX_BYTES,
+    "Google Drive start page token"
+  );
+  return requiredString(payload.startPageToken, "start_page_token");
+}
+async function listDriveChanges(pageToken, driveId, pageSize, authorization, retry, observability) {
+  if (!authorization) throw new SyncFailure("connection_reconnect_required", true, true);
+  const url = new URL(`${DRIVE_API_BASE}/changes`);
+  url.searchParams.set("pageToken", pageToken);
+  url.searchParams.set("pageSize", String(pageSize));
+  url.searchParams.set("supportsAllDrives", "true");
+  url.searchParams.set("includeItemsFromAllDrives", "true");
+  url.searchParams.set("spaces", "drive");
+  url.searchParams.set(
+    "fields",
+    "nextPageToken,newStartPageToken,changes(fileId,removed,time,driveId,file(id,name,mimeType,driveId,parents,modifiedTime,createdTime,version,md5Checksum,size,webViewLink,trashed))"
+  );
+  if (driveId) url.searchParams.set("driveId", driveId);
+  const response = await requestGoogleDrive(
+    url,
+    { headers: { authorization, accept: "application/json" } },
+    "list_changes",
+    retry,
+    observability
+  );
+  if (response.status === 410) throw new GoogleDriveCursorInvalidError();
+  if (!response.ok) throwGoogleDriveResponse(response);
+  const payload = await readResponseJsonBounded(
+    response,
+    DRIVE_JSON_MAX_BYTES,
+    "Google Drive changes list"
+  );
+  const changes = Array.isArray(payload.changes) ? payload.changes : [];
+  return {
+    changes: changes.map((value) => {
+      const row = value && typeof value === "object" ? value : {};
+      const fileId = requiredString(row.fileId, "change_file_id");
+      return {
+        fileId,
+        removed: row.removed === true,
+        file: row.file && typeof row.file === "object" ? parseDriveProviderItem(row.file) : null
+      };
+    }),
+    nextPageToken: optionalString(payload.nextPageToken),
+    newStartPageToken: optionalString(payload.newStartPageToken)
+  };
+}
+async function getDriveFile(fileId, authorization, retry, observability) {
+  if (!authorization) throw new SyncFailure("connection_reconnect_required", true, true);
+  const url = new URL(`${DRIVE_API_BASE}/files/${encodeURIComponent(fileId)}`);
+  url.searchParams.set("supportsAllDrives", "true");
+  url.searchParams.set(
+    "fields",
+    "id,name,mimeType,driveId,parents,modifiedTime,createdTime,version,md5Checksum,size,webViewLink,trashed"
+  );
+  const response = await requestGoogleDrive(
+    url,
+    { headers: { authorization, accept: "application/json" } },
+    "get_file",
+    retry,
+    observability
+  );
+  if (response.status === 404) return null;
+  if (!response.ok) throwGoogleDriveResponse(response);
+  return parseDriveProviderItem(
+    await readResponseJsonBounded(response, DRIVE_JSON_MAX_BYTES, "Google Drive file metadata")
+  );
+}
+async function listDrivePermissions(input, authorization, retry, observability) {
+  if (!authorization) throw new SyncFailure("connection_reconnect_required", true, true);
+  const url = new URL(`${DRIVE_API_BASE}/files/${encodeURIComponent(input.fileId)}/permissions`);
+  url.searchParams.set("supportsAllDrives", "true");
+  url.searchParams.set("pageSize", String(input.pageSize));
+  url.searchParams.set(
+    "fields",
+    "nextPageToken,permissions(id,type,emailAddress,domain,role,allowFileDiscovery,expirationTime,deleted,permissionDetails(inherited))"
+  );
+  if (input.pageToken) url.searchParams.set("pageToken", input.pageToken);
+  const response = await requestGoogleDrive(
+    url,
+    { headers: { authorization, accept: "application/json" } },
+    "list_permissions",
+    retry,
+    observability
+  );
+  if (response.status === 403 || response.status === 404) {
+    return { permissions: [], nextPageToken: null, denied: true };
+  }
+  if (!response.ok) throwGoogleDriveResponse(response);
+  const payload = await readResponseJsonBounded(
+    response,
+    DRIVE_JSON_MAX_BYTES,
+    "Google Drive permission list"
+  );
+  const rawPermissions = Array.isArray(payload.permissions) ? payload.permissions : null;
+  if (!rawPermissions) throw new SyncFailure("provider_payload_invalid", false);
+  return {
+    permissions: rawPermissions.map(parseDrivePermission),
+    nextPageToken: optionalString(payload.nextPageToken),
+    denied: false
+  };
+}
+async function collectGoogleDriveAclEvidence(input) {
+  if (!Number.isSafeInteger(input.maxProviderRequests) || input.maxProviderRequests < 1) {
+    throw new SyncFailure("resource_limit", false);
+  }
+  const now = input.now ?? Date.now;
+  const observedAt = new Date(now());
+  if (!Number.isFinite(observedAt.getTime())) {
+    throw new SyncFailure("provider_payload_invalid", false);
+  }
+  const permissions = [];
+  const seenTokens = /* @__PURE__ */ new Set();
+  let pageToken = null;
+  let providerRequests = 0;
+  let permissionListDenied = false;
+  do {
+    if (providerRequests >= input.maxProviderRequests) {
+      throw new SyncFailure("resource_limit", false);
+    }
+    providerRequests += 1;
+    const page = await input.listPermissions({
+      fileId: input.entry.externalObjectId,
+      pageToken,
+      pageSize: Math.min(100, GOOGLE_DRIVE_ACL_MAX_PRINCIPALS - permissions.length)
+    });
+    if (page.denied) {
+      permissionListDenied = true;
+      break;
+    }
+    permissions.push(...page.permissions);
+    if (permissions.length > GOOGLE_DRIVE_ACL_MAX_PRINCIPALS) {
+      throw new SyncFailure("resource_limit", false);
+    }
+    pageToken = page.nextPageToken;
+    if (pageToken) {
+      if (pageToken.length > 4096 || seenTokens.has(pageToken)) {
+        throw new SyncFailure("provider_payload_invalid", false);
       }
+      seenTokens.add(pageToken);
+    }
+  } while (pageToken);
+  if (permissionListDenied) {
+    if (!input.getFile || providerRequests >= input.maxProviderRequests) {
+      return googleDriveDeniedAclEvidence(input.entry, observedAt, providerRequests);
+    }
+    providerRequests += 1;
+    const current = await input.getFile(input.entry.externalObjectId);
+    if (!current || current.trashed) {
+      return googleDriveDeniedAclEvidence(input.entry, observedAt, providerRequests);
+    }
+    const aclRevision2 = createHash2("sha256").update(
+      JSON.stringify({
+        version: 1,
+        mode: "source_owner_only",
+        externalObjectId: input.entry.externalObjectId,
+        providerRevision: input.entry.externalVersionId
+      })
+    ).digest("hex");
+    return {
+      eligibility: "eligible",
+      providerRevision: input.entry.externalVersionId,
+      driveId: input.entry.driveId,
+      aclRevision: aclRevision2,
+      observedAt: observedAt.toISOString(),
+      expiresAt: new Date(observedAt.getTime() + GOOGLE_DRIVE_ACL_FRESHNESS_MS).toISOString(),
+      providerRequests,
+      principals: []
+    };
+  }
+  const canonicalPermissions = permissions.map((permission) => ({
+    id: permission.id,
+    type: permission.type,
+    role: permission.role,
+    emailAddress: permission.emailAddress,
+    domain: permission.domain,
+    allowFileDiscovery: permission.allowFileDiscovery,
+    expirationTime: permission.expirationTime,
+    inherited: permission.inherited
+  })).sort((left, right) => JSON.stringify(left).localeCompare(JSON.stringify(right)));
+  const aclRevision = createHash2("sha256").update(
+    JSON.stringify({
+      version: 1,
+      externalObjectId: input.entry.externalObjectId,
+      providerRevision: input.entry.externalVersionId,
+      permissions: canonicalPermissions
+    })
+  ).digest("hex");
+  return {
+    eligibility: "eligible",
+    providerRevision: input.entry.externalVersionId,
+    driveId: input.entry.driveId,
+    aclRevision,
+    observedAt: observedAt.toISOString(),
+    expiresAt: new Date(observedAt.getTime() + GOOGLE_DRIVE_ACL_FRESHNESS_MS).toISOString(),
+    providerRequests,
+    principals: canonicalPermissions.map((permission) => ({
+      type: permission.type,
+      permissionId: permission.id,
+      emailAddress: permission.emailAddress,
+      domain: permission.domain,
+      role: permission.role,
+      inherited: permission.inherited,
+      allowFileDiscovery: permission.allowFileDiscovery,
+      expirationTime: permission.expirationTime
+    }))
+  };
+}
+function googleDriveDeniedAclEvidence(entry, observedAt, providerRequests) {
+  return {
+    eligibility: "denied",
+    providerRevision: entry.externalVersionId,
+    driveId: entry.driveId,
+    aclRevision: createHash2("sha256").update(
+      JSON.stringify({
+        version: 1,
+        mode: "provider_denied",
+        externalObjectId: entry.externalObjectId,
+        providerRevision: entry.externalVersionId
+      })
+    ).digest("hex"),
+    observedAt: observedAt.toISOString(),
+    expiresAt: new Date(observedAt.getTime() + GOOGLE_DRIVE_ACL_FRESHNESS_MS).toISOString(),
+    providerRequests,
+    principals: []
+  };
+}
+function parseDrivePermission(value) {
+  const row = objectRecord(value);
+  if (row.deleted === true) throw new SyncFailure("provider_payload_invalid", false);
+  const type = requiredString(row.type, "permission.type");
+  if (type !== "user" && type !== "group" && type !== "domain" && type !== "anyone") {
+    throw new SyncFailure("provider_payload_invalid", false);
+  }
+  const role = requiredString(row.role, "permission.role");
+  if (role !== "owner" && role !== "organizer" && role !== "fileOrganizer" && role !== "writer" && role !== "commenter" && role !== "reader") {
+    throw new SyncFailure("provider_payload_invalid", false);
+  }
+  const permissionDetails = Array.isArray(row.permissionDetails) ? row.permissionDetails : [];
+  return {
+    id: requiredString(row.id, "permission.id"),
+    type,
+    role,
+    emailAddress: optionalString(row.emailAddress),
+    domain: optionalString(row.domain),
+    allowFileDiscovery: typeof row.allowFileDiscovery === "boolean" ? row.allowFileDiscovery : null,
+    expirationTime: optionalExactProviderTimestamp(row.expirationTime),
+    inherited: permissionDetails.some((detail) => objectRecord(detail).inherited === true)
+  };
+}
+function optionalExactProviderTimestamp(value) {
+  const timestamp = optionalString(value);
+  if (!timestamp) return null;
+  const parsed = new Date(timestamp);
+  if (!Number.isFinite(parsed.getTime())) throw new SyncFailure("provider_payload_invalid", false);
+  return parsed.toISOString();
+}
+function throwGoogleDriveResponse(response) {
+  if (response.status === 401 || response.status === 403) {
+    throw new SyncFailure("connection_reconnect_required", true, true);
+  }
+  throw new SyncFailure(
+    response.status >= 500 || response.status === 429 ? "provider_unavailable" : "provider_rejected",
+    response.status >= 500 || response.status === 429
+  );
+}
+async function requestGoogleDrive(url, init, operation, retry, observability) {
+  try {
+    return await fetchGoogleDriveProvider({
+      fetchImpl: sourceFetch,
+      url,
+      init,
+      operation,
+      policy: retry,
+      observability,
+      heartbeat: (details) => heartbeat({ provider: "google_drive", ...details })
     });
-    if (decision.events.length > 0) {
-      await bus.publish(input.workspaceId, input.sessionId, decision.events);
+  } catch (error) {
+    if (error instanceof GoogleDriveProviderTransportError) {
+      throw new SyncFailure("provider_unavailable", true);
     }
-    return { action: decision.action };
+    throw error;
+  }
+}
+function selectedDriveSource(metadata, externalSourceId) {
+  const sources = metadata.selectedSources ?? (metadata.selectedSource ? [metadata.selectedSource] : []);
+  return sources.find((source) => source.id === externalSourceId) ?? null;
+}
+function googleDriveSyncProviderAccessAllowed(input) {
+  return input.resolvedConnectionVersion !== void 0 && input.connectionVersion === input.resolvedConnectionVersion && input.connectionStatus === "active" && (input.lifecycleState === void 0 || input.lifecycleState === "active") && googleDriveScopesAllowCapability(input.grantedScopes, "recursive_source_sync");
+}
+async function listDriveChildren(input, authorization, retry, observability) {
+  if (!authorization) throw new SyncFailure("connection_reconnect_required", true, true);
+  const url = new URL(`${DRIVE_API_BASE}/files`);
+  url.searchParams.set(
+    "q",
+    `'${input.folderId.replaceAll("'", "\\'")}' in parents and trashed = false`
+  );
+  url.searchParams.set("pageSize", String(input.pageSize));
+  url.searchParams.set("supportsAllDrives", "true");
+  url.searchParams.set("includeItemsFromAllDrives", "true");
+  url.searchParams.set(
+    "fields",
+    "nextPageToken,incompleteSearch,files(id,name,mimeType,driveId,parents,modifiedTime,createdTime,version,md5Checksum,size,webViewLink,trashed)"
+  );
+  if (input.pageToken) url.searchParams.set("pageToken", input.pageToken);
+  if (input.driveId) {
+    url.searchParams.set("corpora", "drive");
+    url.searchParams.set("driveId", input.driveId);
+  }
+  const response = await requestGoogleDrive(
+    url,
+    { headers: { authorization, accept: "application/json" } },
+    "list_children",
+    retry,
+    observability
+  );
+  if (!response.ok) {
+    if (response.status === 401 || response.status === 403) {
+      throw new SyncFailure("connection_reconnect_required", true, true);
+    }
+    throw new SyncFailure(
+      "provider_unavailable",
+      response.status >= 500 || response.status === 429
+    );
   }
+  const payload = await readResponseJsonBounded(
+    response,
+    DRIVE_JSON_MAX_BYTES,
+    "Google Drive file list"
+  );
+  const rawFiles = Array.isArray(payload.files) ? payload.files : [];
   return {
-    enqueueGoalRetryWake,
-    maybeContinueGoal
+    items: rawFiles.map(parseDriveProviderItem),
+    nextPageToken: typeof payload.nextPageToken === "string" ? payload.nextPageToken : null,
+    incompleteSearch: payload.incompleteSearch === true
   };
 }
-function goalContinuationModelDecision(input) {
-  const catalogSettings = input.settings.supergrokSubscriptionEnabled ? withXaiSubscriptionCatalogProvider(
-    input.settings.codexSubscriptionEnabled ? withCodexCatalogProvider(input.settings) : input.settings
-  ) : input.settings.codexSubscriptionEnabled ? withCodexCatalogProvider(input.settings) : input.settings;
-  const policyBlocks = (modelId) => input.workspaceModelPolicy !== null && !evaluateWorkspaceModelPolicy(input.workspaceModelPolicy, {
-    providerId: policyProviderIdForModel(catalogSettings, modelId),
-    modelId
-  }).allowed;
-  if (resolveModelProvider(catalogSettings, input.inheritedModel) && !policyBlocks(input.inheritedModel)) {
-    return { model: input.inheritedModel, blocked: null };
+function parseDriveProviderItem(value) {
+  const row = value && typeof value === "object" ? value : {};
+  return {
+    id: requiredString(row.id, "id"),
+    name: requiredString(row.name, "name"),
+    mimeType: requiredString(row.mimeType, "mimeType"),
+    driveId: optionalString(row.driveId),
+    parents: Array.isArray(row.parents) ? row.parents.filter((item) => typeof item === "string") : [],
+    modifiedTime: optionalString(row.modifiedTime),
+    createdTime: optionalString(row.createdTime),
+    version: optionalString(row.version),
+    md5Checksum: optionalString(row.md5Checksum),
+    size: optionalString(row.size),
+    webViewLink: optionalString(row.webViewLink),
+    trashed: row.trashed === true
+  };
+}
+async function fetchDriveBytes(entry, authorization, maxBytes, retry, observability) {
+  if (!authorization) throw new SyncFailure("connection_reconnect_required", true, true);
+  const url = entry.transfer.action === "export" ? new URL(`${DRIVE_API_BASE}/files/${encodeURIComponent(entry.externalObjectId)}/export`) : new URL(`${DRIVE_API_BASE}/files/${encodeURIComponent(entry.externalObjectId)}`);
+  if (entry.transfer.action === "export") {
+    url.searchParams.set("mimeType", entry.transfer.contentType);
+  } else {
+    url.searchParams.set("alt", "media");
+    url.searchParams.set("supportsAllDrives", "true");
+  }
+  const response = await requestGoogleDrive(
+    url,
+    { headers: { authorization } },
+    entry.transfer.action === "export" ? "export" : "download",
+    retry,
+    observability
+  );
+  if (!response.ok) {
+    if (response.status === 401 || response.status === 403) {
+      throw new SyncFailure("connection_reconnect_required", true, true);
+    }
+    throw new SyncFailure(
+      "provider_unavailable",
+      response.status >= 500 || response.status === 429
+    );
   }
-  if (!resolveModelProvider(catalogSettings, input.inheritedModel)) {
+  const declared = Number(response.headers.get("content-length") ?? "0");
+  if (Number.isFinite(declared) && declared > maxBytes) {
+    throw new SyncFailure("content_too_large", false);
+  }
+  if (!response.body) {
+    const bytes2 = new Uint8Array(await response.arrayBuffer());
+    if (bytes2.byteLength > maxBytes) throw new SyncFailure("content_too_large", false);
+    return bytes2;
+  }
+  const reader = response.body.getReader();
+  const chunks = [];
+  let total = 0;
+  while (true) {
+    const { done, value } = await reader.read();
+    if (done) break;
+    total += value.byteLength;
+    if (total > maxBytes) {
+      await reader.cancel();
+      throw new SyncFailure("content_too_large", false);
+    }
+    chunks.push(value);
+  }
+  const bytes = new Uint8Array(total);
+  let offset = 0;
+  for (const chunk of chunks) {
+    bytes.set(chunk, offset);
+    offset += chunk.byteLength;
+  }
+  return bytes;
+}
+async function listAtlassianItems(source, cursor, pageSize, authorization) {
+  if (!authorization) throw new SyncFailure("connection_reconnect_required", true, true);
+  if (source.kind === "jira_project") {
+    const url2 = new URL(
+      `${ATLASSIAN_API_BASE}/ex/jira/${encodeURIComponent(source.cloudId)}/rest/api/3/search/jql`
+    );
+    url2.searchParams.set(
+      "jql",
+      `project = "${source.key.replaceAll('"', '\\"')}" ORDER BY key ASC`
+    );
+    url2.searchParams.set("maxResults", String(pageSize));
+    url2.searchParams.set("fields", "summary,created,updated");
+    if (cursor) url2.searchParams.set("nextPageToken", cursor);
+    const payload2 = objectRecord(await atlassianJsonRequest(url2, authorization, "Jira issue list"));
+    const issues = Array.isArray(payload2.issues) ? payload2.issues : [];
     return {
-      model: input.inheritedModel,
-      blocked: `model "${input.inheritedModel}" is no longer in the deployment or workspace catalog; choose an available model before resuming the goal`
+      items: issues.map((raw) => {
+        const row = objectRecord(raw);
+        const fields = objectRecord(row.fields);
+        const id = requiredAtlassianString(row.id, "issue.id");
+        const key = requiredAtlassianString(row.key, "issue.key");
+        const updatedAt = optionalString(fields.updated);
+        return {
+          id,
+          key,
+          title: requiredAtlassianString(fields.summary, "issue.summary"),
+          version: updatedAt,
+          createdAt: optionalString(fields.created),
+          updatedAt,
+          webUrl: new URL(`/browse/${encodeURIComponent(key)}`, source.siteUrl).toString()
+        };
+      }),
+      nextCursor: optionalString(payload2.nextPageToken)
     };
   }
+  const url = new URL(
+    `${ATLASSIAN_API_BASE}/ex/confluence/${encodeURIComponent(source.cloudId)}/wiki/api/v2/spaces/${encodeURIComponent(source.resourceId)}/pages`
+  );
+  url.searchParams.set("limit", String(pageSize));
+  url.searchParams.set("sort", "id");
+  if (cursor) url.searchParams.set("cursor", cursor);
+  const payload = objectRecord(
+    await atlassianJsonRequest(url, authorization, "Confluence page list")
+  );
+  const pages = Array.isArray(payload.results) ? payload.results : [];
   return {
-    model: input.inheritedModel,
-    blocked: `workspace model policy blocks model "${input.inheritedModel}"; pick an allowed model or change the workspace model policy`
+    items: pages.map((raw) => {
+      const row = objectRecord(raw);
+      const version = objectRecord(row.version);
+      const id = requiredAtlassianString(row.id, "page.id");
+      const webUi = optionalString(objectRecord(row._links).webui);
+      const versionNumber = numberValue(version.number);
+      return {
+        id,
+        key: id,
+        title: requiredAtlassianString(row.title, "page.title"),
+        version: versionNumber === void 0 ? null : String(versionNumber),
+        createdAt: optionalString(row.createdAt),
+        updatedAt: optionalString(version.createdAt),
+        webUrl: webUi ? new URL(webUi.startsWith("/wiki/") ? webUi : `/wiki${webUi}`, source.siteUrl).toString() : new URL(
+          `/wiki/spaces/${encodeURIComponent(source.key)}/pages/${encodeURIComponent(id)}`,
+          source.siteUrl
+        ).toString()
+      };
+    }),
+    nextCursor: confluenceCursor(objectRecord(payload._links).next)
   };
 }
-function goalContinuationFundedWithoutCredits(settings, model, codexBilled) {
-  return modelFundingForAdmission(settings, model, codexBilled).fundedWithoutCredits;
-}
-function goalContinuationPrompt(_goal, _autoContinuation, _cap, options = {}) {
-  const waitingGuidance = options.inputWaitAvailable ? [
-    "Waiting on child sessions, background commands, or external events:",
-    "- When further progress depends on work already in flight, do not sleep, loop, or poll session or command state repeatedly.",
-    "- Re-check once; if the work is still in flight and the wait is long or uncertain, call opengeni__wait_for_input with a concrete reason and timeoutSeconds, then end your turn immediately. Relevant session input or the safety deadline will start a new turn, and this goal stays active.",
-    "- If the immediately preceding user-facing update already reported this same unchanged wait, do not restate it or produce another equivalent final answer. Call opengeni__wait_for_input and end the turn. Report only material new state or a newly discovered blocker.",
-    "- If you are blocked on a human decision, use opengeni__goal_pause under the blocked audit below instead.",
-    ""
-  ] : [];
-  const childNoticeGuidance = [
-    "Child lifecycle notices:",
-    "- A `child_requires_action` update means a worker you spawned is blocked on a question or a tool approval and will not progress until it is answered. " + (options.humanInputRespondAvailable ? "If you know the answer to its question, answer it with opengeni__session_human_input_respond (pass the worker's sessionId, the requestId from the notice, and a response). " : "") + "Tool approvals can only be decided by a human. If you cannot resolve the blocker yourself, report the exact blocker (worker session id, the question) to the user and wait or pause instead of retrying the worker.",
-    "- `child_requires_action_resolved`, `child_paused`, `child_waiting_capacity`, and `child_progress` updates are informational: a resolved notice means the worker is moving again; a paused worker needs a human or you to resume it; a capacity wait resumes by itself; a progress note needs no action.",
-    ""
-  ];
-  return [
-    "Reconcile the active session goal against authoritative current state, then carry the work through to the full requested end state and verify it.",
-    "",
-    "Goal recovery:",
-    "- Treat this continuation as re-entry into the full objective, not as a request to perform one step and stop.",
-    "- Do not rely on previous assistant claims of progress or completion; use them only to locate authoritative evidence.",
-    "- If authoritative evidence already proves the full objective, call opengeni__goal_complete instead of manufacturing more work.",
-    "- Before repeating a state-setting action, verify whether its desired state already holds. If it does, do not repeat it; continue reconciling the overall goal.",
-    "",
-    "Continuation behavior:",
-    "- This goal persists across turns. A runtime boundary can end one turn without shrinking the objective; the next continuation resumes the same full objective.",
-    "- Keep working until the requested end state is true and verified. Do not end the turn merely because one useful action completed, and do not redefine success around a smaller or easier task.",
-    "- An incomplete-status report is not a substitute for continuing the work. If the remaining problem can be investigated or addressed within your current authority, continue that work in this turn rather than returning another equivalent status-only final.",
-    "- Distinguish unfinished work from a blocker that actually requires human input or external change; use the existing waiting and blocked audits only when their conditions hold.",
-    "- Temporary rough edges are acceptable while the work is moving in the right direction. Completion still requires the requested end state to be true and verified.",
-    "",
-    "Work from evidence:",
-    "Use the current workspace and external state as authoritative. Conversation context can help locate relevant work, but it is not proof of the current state. Inspect the current state before relying on it. Improve, replace, or remove existing work as needed to satisfy the actual objective.",
+async function fetchAtlassianContent(source, entry, authorization, maxBytes) {
+  if (!authorization) throw new SyncFailure("connection_reconnect_required", true, true);
+  const objectId = entry.externalObjectId.slice(entry.externalObjectId.indexOf(":") + 1);
+  const markdown = source.kind === "jira_project" ? await jiraIssueMarkdown(source, objectId, entry, authorization) : await confluencePageMarkdown(source, objectId, entry, authorization);
+  const bytes = new TextEncoder().encode(markdown);
+  if (bytes.byteLength > maxBytes) throw new SyncFailure("content_too_large", false);
+  return bytes;
+}
+async function jiraIssueMarkdown(source, issueId, entry, authorization) {
+  const issueUrl = new URL(
+    `${ATLASSIAN_API_BASE}/ex/jira/${encodeURIComponent(source.cloudId)}/rest/api/3/issue/${encodeURIComponent(issueId)}`
+  );
+  issueUrl.searchParams.set(
+    "fields",
+    "summary,description,status,issuetype,priority,assignee,reporter,labels,created,updated"
+  );
+  const issue = objectRecord(await atlassianJsonRequest(issueUrl, authorization, "Jira issue"));
+  const fields = objectRecord(issue.fields);
+  const lines = [
+    `# ${entry.title}`,
     "",
-    "Progress visibility:",
-    "If a planning tool is available and the next work is meaningfully multi-step, use it to show a concise plan tied to the real objective. Keep the plan current as steps complete or the next best action changes. Skip planning overhead for trivial one-step progress, and do not treat a plan update as a substitute for doing the work.",
+    `- Key: ${optionalString(issue.key) ?? entry.title}`,
+    `- Type: ${optionalString(objectRecord(fields.issuetype).name) ?? "Unknown"}`,
+    `- Status: ${optionalString(objectRecord(fields.status).name) ?? "Unknown"}`,
+    `- Priority: ${optionalString(objectRecord(fields.priority).name) ?? "None"}`,
+    `- Assignee: ${optionalString(objectRecord(fields.assignee).displayName) ?? "Unassigned"}`,
+    `- Reporter: ${optionalString(objectRecord(fields.reporter).displayName) ?? "Unknown"}`,
+    `- Updated: ${optionalString(fields.updated) ?? "Unknown"}`,
+    `- Source: ${entry.sourceUri}`,
     "",
-    "Fidelity:",
-    "- Optimize each turn for movement toward the requested end state, not for the smallest stable-looking subset or easiest passing change.",
-    "- Do not substitute a narrower, safer, smaller, merely compatible, or easier-to-test solution because it is more likely to pass current tests.",
-    "- Treat alignment as movement toward the requested end state. An edit is aligned only if it makes the requested final state more true; useful-looking behavior that preserves a different end state is misaligned.",
+    "## Description",
     "",
-    "Completion audit:",
-    "Before deciding that the goal is achieved, treat completion as unproven and verify it against the actual current state:",
-    "- Derive concrete requirements from the objective and any referenced files, plans, specifications, issues, or user instructions.",
-    "- Preserve the original scope; do not redefine success around the work that already exists.",
-    "- For every explicit requirement, named artifact, command, test, gate, invariant, and deliverable, identify and inspect the authoritative evidence that would prove it.",
-    "- Match verification scope to requirement scope. Treat uncertain, indirect, incomplete, or missing evidence as not achieved and continue working.",
-    "- The audit must prove completion, not merely fail to find obvious remaining work.",
+    adfToMarkdown(fields.description) || "No description."
+  ];
+  const labels = Array.isArray(fields.labels) ? fields.labels.filter((value) => typeof value === "string") : [];
+  if (labels.length > 0) lines.splice(9, 0, `- Labels: ${labels.join(", ")}`);
+  const comments = await jiraComments(source, issueId, authorization);
+  if (comments.length > 0) {
+    lines.push("", "## Comments", "");
+    for (const comment of comments) {
+      const row = objectRecord(comment);
+      const author = optionalString(objectRecord(row.author).displayName) ?? "Unknown author";
+      const created = optionalString(row.created) ?? "Unknown date";
+      lines.push(`### ${author} \xB7 ${created}`, "", adfToMarkdown(row.body), "");
+    }
+  }
+  return lines.join("\n");
+}
+async function jiraComments(source, issueId, authorization) {
+  const comments = [];
+  let startAt = 0;
+  for (let page = 0; page < 20; page += 1) {
+    const url = new URL(
+      `${ATLASSIAN_API_BASE}/ex/jira/${encodeURIComponent(source.cloudId)}/rest/api/3/issue/${encodeURIComponent(issueId)}/comment`
+    );
+    url.searchParams.set("startAt", String(startAt));
+    url.searchParams.set("maxResults", "100");
+    url.searchParams.set("orderBy", "created");
+    const payload = objectRecord(await atlassianJsonRequest(url, authorization, "Jira comments"));
+    const pageComments = Array.isArray(payload.comments) ? payload.comments : [];
+    comments.push(...pageComments);
+    const total = numberValue(payload.total) ?? comments.length;
+    if (comments.length >= total || pageComments.length === 0) break;
+    startAt += pageComments.length;
+  }
+  return comments;
+}
+async function confluencePageMarkdown(source, pageId, entry, authorization) {
+  const pageUrl = new URL(
+    `${ATLASSIAN_API_BASE}/ex/confluence/${encodeURIComponent(source.cloudId)}/wiki/api/v2/pages/${encodeURIComponent(pageId)}`
+  );
+  pageUrl.searchParams.set("body-format", "storage");
+  const page = objectRecord(await atlassianJsonRequest(pageUrl, authorization, "Confluence page"));
+  const storage = objectRecord(objectRecord(page.body).storage);
+  const lines = [
+    `# ${entry.title}`,
     "",
-    "Do not rely on intent, partial progress, memory of earlier work, or a plausible final answer as proof of completion. Call opengeni__goal_complete with concrete evidence only when the full objective is actually achieved and no required work remains.",
+    `- Space: ${source.name} (${source.key})`,
+    `- Updated: ${entry.modifiedTime ?? "Unknown"}`,
+    `- Source: ${entry.sourceUri}`,
     "",
-    ...waitingGuidance,
-    ...childNoticeGuidance,
-    "Blocked audit:",
-    "- Do not call opengeni__goal_pause the first time a blocker appears.",
-    "- Pause only when the same blocking condition has repeated for at least three consecutive goal turns and meaningful progress is impossible without user input or an external-state change.",
-    "- Do not pause merely because the work is hard, slow, uncertain, incomplete, or would benefit from clarification.",
-    "- Once that threshold is satisfied, call opengeni__goal_pause with the concrete blocker instead of repeatedly reporting it while leaving the goal active.",
+    "## Content",
     "",
-    "Do not call opengeni__goal_complete or opengeni__goal_pause unless the corresponding audit above is satisfied."
-  ].join("\n");
-}
-function withFirstPartyTools(settings, tools) {
-  if (!settings.mcpServers.some((server) => server.id === "opengeni")) {
-    return tools;
+    optionalString(storage.value) ?? "No content."
+  ];
+  const comments = await confluenceFooterComments(source, pageId, authorization);
+  if (comments.length > 0) {
+    lines.push("", "## Comments", "");
+    for (const comment of comments) {
+      const row = objectRecord(comment);
+      const body = objectRecord(objectRecord(row.body).storage);
+      const version = objectRecord(row.version);
+      lines.push(
+        `### Comment \xB7 ${optionalString(version.createdAt) ?? "Unknown date"}`,
+        "",
+        optionalString(body.value) ?? "",
+        ""
+      );
+    }
   }
-  return mergeToolRefs(tools, [{ kind: "mcp", id: "opengeni" }]);
+  return lines.join("\n");
 }
-async function goalRunBudgetBlocked(settings, db, accountId, workspaceId, fundedWithoutCredits) {
-  if (!fundedWithoutCredits && (settings.billingMode === "stripe" || settings.usageLimitsMode === "managed")) {
-    const balance = await getBillingBalance(db, accountId);
-    if (balance.balanceMicros <= 0) {
-      return "insufficient OpenGeni credits";
-    }
+async function confluenceFooterComments(source, pageId, authorization) {
+  const comments = [];
+  let cursor = null;
+  for (let page = 0; page < 20; page += 1) {
+    const url = new URL(
+      `${ATLASSIAN_API_BASE}/ex/confluence/${encodeURIComponent(source.cloudId)}/wiki/api/v2/pages/${encodeURIComponent(pageId)}/footer-comments`
+    );
+    url.searchParams.set("body-format", "storage");
+    url.searchParams.set("limit", "100");
+    if (cursor) url.searchParams.set("cursor", cursor);
+    const payload = objectRecord(
+      await atlassianJsonRequest(url, authorization, "Confluence page comments")
+    );
+    const results = Array.isArray(payload.results) ? payload.results : [];
+    comments.push(...results);
+    cursor = confluenceCursor(objectRecord(payload._links).next);
+    if (!cursor) break;
+  }
+  return comments;
+}
+async function atlassianJsonRequest(url, authorization, label) {
+  const response = await sourceFetch(url, {
+    headers: { authorization, accept: "application/json" },
+    redirect: "error",
+    signal: AbortSignal.timeout(2e4)
+  });
+  if (!response.ok) {
+    await response.body?.cancel().catch(() => void 0);
+    if (response.status === 401 || response.status === 403) {
+      throw new SyncFailure("connection_reconnect_required", true, true);
+    }
+    throw new SyncFailure(
+      "provider_unavailable",
+      response.status >= 500 || response.status === 429
+    );
   }
-  if (settings.usageLimitsMode === "static" || settings.usageLimitsMode === "managed") {
-    const limits = configuredStaticUsageLimits(settings);
-    if (!fundedWithoutCredits && limits.maxMonthlyCostMicrosPerAccount) {
-      const used = await sumUsageQuantity(db, {
-        accountId,
-        eventType: "model.cost",
-        since: startOfUtcMonth()
-      });
-      if (used >= limits.maxMonthlyCostMicrosPerAccount) {
-        return `monthly model cost limit reached (${limits.maxMonthlyCostMicrosPerAccount} micros)`;
-      }
-    }
-    if (limits.maxMonthlyAgentRunsPerWorkspace) {
-      const used = await sumUsageQuantity(db, {
-        workspaceId,
-        eventType: "agent_run.created",
-        since: startOfUtcMonth()
-      });
-      if (used + 1 > limits.maxMonthlyAgentRunsPerWorkspace) {
-        return `monthly agent run limit reached (${limits.maxMonthlyAgentRunsPerWorkspace})`;
+  return await readResponseJsonBounded(response, ATLASSIAN_JSON_MAX_BYTES, label);
+}
+function confluenceCursor(value) {
+  const next = optionalString(value);
+  if (!next) return null;
+  const url = new URL(next, ATLASSIAN_API_BASE);
+  const cursor = url.searchParams.get("cursor");
+  if (!cursor || cursor.length > 4096 || /[\u0000-\u001f]/.test(cursor)) {
+    throw new Error("invalid Confluence cursor");
+  }
+  return cursor;
+}
+function adfToMarkdown(value) {
+  const node = objectRecord(value);
+  const type = optionalString(node.type);
+  const children = Array.isArray(node.content) ? node.content.map(adfToMarkdown).join("") : "";
+  if (type === "text") {
+    let text = typeof node.text === "string" ? node.text : "";
+    const marks = Array.isArray(node.marks) ? node.marks : [];
+    for (const rawMark of marks) {
+      const mark = objectRecord(rawMark);
+      const markType = optionalString(mark.type);
+      if (markType === "code") text = `\`${text}\``;
+      if (markType === "strong") text = `**${text}**`;
+      if (markType === "em") text = `*${text}*`;
+      if (markType === "strike") text = `~~${text}~~`;
+      if (markType === "link") {
+        const href = optionalString(objectRecord(mark.attrs).href);
+        if (href) text = `[${text}](${href})`;
       }
     }
+    return text;
+  }
+  if (type === "paragraph") return `${children}
+
+`;
+  if (type === "heading") {
+    const level = Math.min(Math.max(numberValue(objectRecord(node.attrs).level) ?? 2, 1), 6);
+    return `${"#".repeat(level)} ${children.trim()}
+
+`;
+  }
+  if (type === "hardBreak") return "  \n";
+  if (type === "rule") return "---\n\n";
+  if (type === "blockquote") {
+    return `${children.trim().split("\n").map((line) => `> ${line}`).join("\n")}
+
+`;
+  }
+  if (type === "bulletList") {
+    return `${children.trimEnd()}
+`;
   }
+  if (type === "orderedList") {
+    return `${children.trimEnd()}
+`;
+  }
+  if (type === "listItem") {
+    return `- ${children.trim().replaceAll("\n", "\n  ")}
+`;
+  }
+  if (type === "codeBlock") return `\`\`\`
+${children.trimEnd()}
+\`\`\`
+
+`;
+  if (type === "mention") return `@${optionalString(objectRecord(node.attrs).text) ?? "user"}`;
+  if (type === "emoji") return optionalString(objectRecord(node.attrs).text) ?? "";
+  if (type === "inlineCard") {
+    const url = optionalString(objectRecord(node.attrs).url);
+    return url ? `[${url}](${url})` : "";
+  }
+  return children;
+}
+function objectRecord(value) {
+  return value && typeof value === "object" && !Array.isArray(value) ? value : {};
+}
+function requiredAtlassianString(value, label) {
+  if (typeof value !== "string" || !value.trim()) throw new Error(`invalid_atlassian_${label}`);
+  return value;
+}
+function deterministicUuid(value) {
+  const bytes = createHash2("sha256").update(value).digest().subarray(0, 16);
+  bytes[6] = bytes[6] & 15 | 80;
+  bytes[8] = bytes[8] & 63 | 128;
+  const hex = bytes.toString("hex");
+  return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20)}`;
+}
+function safeFilename(value) {
+  const normalized = value.normalize("NFKC").replace(/[\\/:*?"<>|\0-\x1f]/g, "_").trim();
+  return (normalized || "document").slice(0, 240);
+}
+function requiredString(value, label) {
+  if (typeof value !== "string" || !value.trim()) throw new Error(`invalid_google_drive_${label}`);
+  return value;
+}
+function optionalString(value) {
+  return typeof value === "string" && value.length > 0 ? value : null;
+}
+function numberValue(value) {
+  return typeof value === "number" && Number.isFinite(value) ? value : void 0;
+}
+function boundedError(error) {
+  return (error instanceof Error ? error.message : String(error)).slice(0, 1e3);
+}
+function entryMetadataHash(entry) {
+  return createHash2("sha256").update(
+    JSON.stringify({
+      externalObjectId: entry.externalObjectId,
+      externalVersionId: entry.externalVersionId,
+      title: entry.title,
+      mimeType: entry.mimeType,
+      driveId: entry.driveId,
+      modifiedTime: entry.modifiedTime,
+      createdTime: entry.createdTime,
+      sourceUri: entry.sourceUri
+    })
+  ).digest("hex");
+}
+function inventoryLimit(reason) {
+  if (reason === "api_request_limit") return "provider_requests";
+  if (reason === "elapsed_time_limit") return "elapsed_time";
+  if (reason === "item_limit") return "items";
+  if (reason === "known_byte_limit") return "bytes";
   return null;
 }
-function startOfUtcMonth() {
-  const now = /* @__PURE__ */ new Date();
-  return new Date(Date.UTC(now.getUTCFullYear(), now.getUTCMonth(), 1));
+function recordSyncHealthTelemetry(observability, provider, summary, outcome, failure) {
+  observability.observeHistogram({
+    name: "opengeni_knowledge_source_sync_terminal_batch_duration_seconds",
+    help: "Terminal knowledge-source activity batch duration by provider and outcome.",
+    labels: { provider, outcome },
+    value: Math.max(0, summary.elapsedMs) / 1e3
+  });
+  if (summary.providerRequests > 0) {
+    observability.incrementCounter({
+      name: "opengeni_knowledge_source_sync_provider_requests_total",
+      help: "Logical provider requests consumed by knowledge-source synchronization.",
+      labels: { provider, outcome },
+      amount: summary.providerRequests
+    });
+  }
+  if (summary.limitReached) {
+    observability.incrementCounter({
+      name: "opengeni_knowledge_source_sync_limit_hits_total",
+      help: "Knowledge-source synchronization runs stopped by an explicit resource budget.",
+      labels: { provider, limit: summary.limitReached }
+    });
+  }
+  if (summary.reconnectRequired) {
+    observability.incrementCounter({
+      name: "opengeni_knowledge_source_sync_reconnect_required_total",
+      help: "Knowledge-source synchronization failures requiring connector reconnection.",
+      labels: { provider }
+    });
+  }
+  if (failure) {
+    observability.incrementCounter({
+      name: "opengeni_knowledge_source_sync_failures_total",
+      help: "Knowledge-source synchronization terminal failures by bounded reason.",
+      labels: {
+        provider,
+        reason: failure.code,
+        retryable: failure.retryable ? "true" : "false"
+      }
+    });
+    observability.warn("Knowledge source sync failed", {
+      provider,
+      outcome: failure.retryable ? "retryable_failed" : "failed",
+      reason: failure.code,
+      durationMs: summary.elapsedMs
+    });
+    return;
+  }
+  observability.info("Knowledge source sync completed", {
+    provider,
+    outcome: "succeeded",
+    durationMs: summary.elapsedMs
+  });
 }
+var SyncFailure = class extends Error {
+  constructor(code, retryable, reconnectRequired = false) {
+    super(code);
+    this.code = code;
+    this.retryable = retryable;
+    this.reconnectRequired = reconnectRequired;
+    this.name = "KnowledgeSourceSyncFailure";
+  }
+};
 
 // src/activities/sandbox-images.ts
 import {
@@ -2557,18 +5728,18 @@ async function resumeBoxForTurn(services, ids, kind, holderId) {
     void release().catch(() => void 0);
   };
   holderLivenessTimer = setInterval(() => {
-    const heartbeat = holderLeaseHeartbeat;
-    if (heartbeat) {
+    const heartbeat2 = holderLeaseHeartbeat;
+    if (heartbeat2) {
       void heartbeatLeaseHolderStatus(db, {
         accountId: ids.accountId,
         workspaceId: ids.workspaceId,
         sandboxGroupId: ids.sandboxGroupId,
         kind,
         holderId,
-        expectedEpoch: heartbeat.expectedEpoch,
-        leaseTtlMs: heartbeat.leaseTtlMs
+        expectedEpoch: heartbeat2.expectedEpoch,
+        leaseTtlMs: heartbeat2.leaseTtlMs
       }).then((status) => {
-        if (heartbeat !== holderLeaseHeartbeat) return;
+        if (heartbeat2 !== holderLeaseHeartbeat) return;
         if (!status.holderAlive) {
           releaseDeadHolder(status.fence);
           return;
@@ -2590,7 +5761,7 @@ async function resumeBoxForTurn(services, ids, kind, holderId) {
       kind,
       holderId
     }).then((touched) => {
-      if (heartbeat !== holderLeaseHeartbeat) return;
+      if (heartbeat2 !== holderLeaseHeartbeat) return;
       if (!touched) {
         releaseDeadHolder("holder_gone");
         return;
@@ -4390,8 +7561,8 @@ import {
   IncidentTelemetryPreflight,
   stableJson
 } from "@opengeni/contracts";
-import { createHash } from "crypto";
-import { isDeepStrictEqual as isDeepStrictEqual2 } from "util";
+import { createHash as createHash3 } from "crypto";
+import { isDeepStrictEqual as isDeepStrictEqual3 } from "util";
 var INCIDENT_TELEMETRY_AUTHORITY_FENCE_LINEAGE_KEY = "incidentTelemetryAuthorityFence";
 function incidentTelemetryPreflightDeclaration(agentConfig, incidentTriggered) {
   const rawConfig = agentConfig;
@@ -4424,7 +7595,7 @@ function evaluateIncidentTelemetryPreflight(input) {
     return blocked("incident_preflight_metadata_missing");
   }
   if (preflight.requiredResources.some(
-    (required) => !input.responder.resources.some((selected) => isDeepStrictEqual2(selected, required))
+    (required) => !input.responder.resources.some((selected) => isDeepStrictEqual3(selected, required))
   )) {
     return blocked("incident_responder_under_capable");
   }
@@ -4514,9 +7685,9 @@ function incidentTelemetryAuthorityFence(input) {
   return {
     version: 2,
     toolPolicyVersion: responder.toolPolicyVersion,
-    responderDigest: createHash("sha256").update(stableJson(normalized)).digest("hex"),
-    taskDigest: createHash("sha256").update(stableJson(task)).digest("hex"),
-    alertSelectorDigest: createHash("sha256").update(stableJson(selectorEntries)).digest("hex")
+    responderDigest: createHash3("sha256").update(stableJson(normalized)).digest("hex"),
+    taskDigest: createHash3("sha256").update(stableJson(task)).digest("hex"),
+    alertSelectorDigest: createHash3("sha256").update(stableJson(selectorEntries)).digest("hex")
   };
 }
 function parseIncidentTelemetryAuthorityFence(lineage) {
@@ -4570,7 +7741,7 @@ import { defaultSessionMcpServerIds, resolveSessionToolPolicy } from "@opengeni/
 import {
   getRig,
   getScheduledScopedRigVersionMetadata,
-  getScheduledTaskRunAcceptedExecution,
+  getScheduledTaskRunAcceptedExecution as getScheduledTaskRunAcceptedExecution2,
   getVariableSet,
   listEnabledMcpCapabilityServerIds,
   listInstalledApiIntegrationServerIdsForDelegations,
@@ -4744,7 +7915,7 @@ async function validateIncidentTelemetrySystemUpdateAuthority(input) {
   };
   if (!fence || typeof taskId !== "string" || !runId) return await reject();
   const session = await requireSession2(input.db, input.workspaceId, input.sessionId);
-  const acceptedExecution = await getScheduledTaskRunAcceptedExecution(input.db, {
+  const acceptedExecution = await getScheduledTaskRunAcceptedExecution2(input.db, {
     workspaceId: input.workspaceId,
     runId
   });
@@ -5287,7 +8458,7 @@ async function drainAttemptOwnedSandboxWriters(input) {
 }
 async function releaseTurnSandboxAfterWriterDrain(sandbox, options = {}) {
   const maxAttempts = Math.max(1, options.maxAttempts ?? 3);
-  const retryDelayMs = Math.max(0, options.retryDelayMs ?? 50);
+  const retryDelayMs2 = Math.max(0, options.retryDelayMs ?? 50);
   const wait = options.wait ?? sleep2;
   let lastError;
   for (let attempt = 1; attempt <= maxAttempts; attempt += 1) {
@@ -5297,7 +8468,7 @@ async function releaseTurnSandboxAfterWriterDrain(sandbox, options = {}) {
     } catch (error) {
       lastError = error;
       if (attempt < maxAttempts) {
-        await wait(retryDelayMs * attempt);
+        await wait(retryDelayMs2 * attempt);
       }
     }
   }
@@ -5445,7 +8616,7 @@ import {
   FileResourceRef,
   resourceMountPath
 } from "@opengeni/contracts";
-import { createHash as createHash2 } from "crypto";
+import { createHash as createHash4 } from "crypto";
 import {
   getActiveSessionHistoryItemsPaged,
   getFilesForSubject,
@@ -5563,7 +8734,7 @@ async function modelAttachmentContentForFiles(files, readFileBytes, options = {}
           });
           continue;
         }
-        if (createHash2("sha256").update(bytes).digest("hex") !== checksum) {
+        if (createHash4("sha256").update(bytes).digest("hex") !== checksum) {
           console.error("model attachment checksum did not match finalized metadata", {
             fileId: file.id
           });
@@ -5741,7 +8912,8 @@ async function turnInput(db, runtime, agent, trigger, options) {
     ].join("\n") : void 0,
     options.unavailableSandboxFilesNote,
     options.runCredentialsNote,
-    options.mcpAvailabilityNote
+    options.mcpAvailabilityNote,
+    options.knowledgeSourcePreparationNote
   );
   if (trigger.type === "user.message") {
     const payload = trigger.payload;
@@ -6669,8 +9841,10 @@ export {
   signalPendingCodexCapacityWakeTargets,
   armAndReconcileCodexCapacityWait,
   createCodexCapacityActivities,
+  createDocumentActivities,
   createGoalActivities,
   withFirstPartyTools,
+  createKnowledgeSourceSyncActivities,
   rigProviderImageSourceImage,
   settingsWithPackSandboxImage,
   resolveWorkspacePackRuntime,
@@ -6761,4 +9935,4 @@ export {
   codexUsageLimitFailurePayload,
   CODEX_USAGE_LIMIT_MAX_RESUME_MS
 };
-//# sourceMappingURL=chunk-OA5CSY5N.js.map
+//# sourceMappingURL=chunk-CYITU5UH.js.map