haansi 0.1.36 → 0.1.42

package/dist/haansi.js

@@ -95,7 +95,7 @@ var require_package = __commonJS({
   "package.json"(exports2, module2) {
     module2.exports = {
       name: "haansi",
-      version: "0.1.36",
+      version: "0.1.42",
       description: "Haansi CLI - Session collector and MCP server for Claude Code & OpenAI Codex",
       bin: {
         haansi: "./dist/haansi.js"
@@ -109,15 +109,13 @@ var require_package = __commonJS({
         prepublishOnly: "npm run build"
       },
       devDependencies: {
+        "@company/pii": "*",
+        "@types/node": "^22.10.1",
         esbuild: "^0.27.0",
-        typescript: "^5.7.2",
-        "@types/node": "^22.10.1"
+        typescript: "^5.7.2"
       },
       engines: {
         node: ">=18.0.0"
-      },
-      dependencies: {
-        "@company/pii": "*"
       }
     };
   }
@@ -149,9 +147,11 @@ async function authLogin() {
     body: JSON.stringify({ client_type: "cli" })
   });
   if (!initiateRes.ok) {
-    const body = await initiateRes.text().catch(() => "");
-    throw new Error(
-      `Failed to start auth session (${initiateRes.status}): ${body.slice(0, 200)}`
+    throw Object.assign(
+      new Error(`Failed to start auth session (${initiateRes.status})`),
+      {
+        publicMessage: `Could not start sign-in (${initiateRes.status}). Please try again.`
+      }
     );
   }
   const { session_id, auth_url: vsCodeAuthUrl } = await initiateRes.json();
@@ -209,9 +209,11 @@ If the browser didn't open, visit this URL:
     body: JSON.stringify({ name: "CLI (haansi auth login)" })
   });
   if (!tokenRes.ok) {
-    const body = await tokenRes.text().catch(() => "");
-    throw new Error(
-      `Failed to create CLI token (${tokenRes.status}): ${body.slice(0, 200)}`
+    throw Object.assign(
+      new Error(`Failed to create CLI token (${tokenRes.status})`),
+      {
+        publicMessage: `Could not create a CLI token (${tokenRes.status}). Please try again.`
+      }
     );
   }
   const { token: hskToken } = await tokenRes.json();
@@ -272,9 +274,11 @@ async function validateToken(token, apiUrl2) {
     }
   );
   if (!response.ok) {
-    const body = await response.text().catch(() => "");
-    throw new Error(
-      `Token validation failed (${response.status}): ${body.slice(0, 200)}`
+    throw Object.assign(
+      new Error(`Token validation failed (${response.status})`),
+      {
+        publicMessage: response.status === 401 || response.status === 403 ? "That token was rejected. Check it and try again." : `Could not validate the token (${response.status}).`
+      }
     );
   }
 }
@@ -396,7 +400,7 @@ var require_package2 = __commonJS({
 var require_main = __commonJS({
   "../../node_modules/dotenv/lib/main.js"(exports2, module2) {
     var fs = require("fs");
-    var path3 = require("path");
+    var path2 = require("path");
     var os = require("os");
     var crypto8 = require("crypto");
     var packageJson = require_package2();
@@ -512,7 +516,7 @@ var require_main = __commonJS({
           possibleVaultPath = options.path.endsWith(".vault") ? options.path : `${options.path}.vault`;
         }
       } else {
-        possibleVaultPath = path3.resolve(process.cwd(), ".env.vault");
+        possibleVaultPath = path2.resolve(process.cwd(), ".env.vault");
       }
       if (fs.existsSync(possibleVaultPath)) {
         return possibleVaultPath;
@@ -520,7 +524,7 @@ var require_main = __commonJS({
       return null;
     }
     function _resolveHome(envPath) {
-      return envPath[0] === "~" ? path3.join(os.homedir(), envPath.slice(1)) : envPath;
+      return envPath[0] === "~" ? path2.join(os.homedir(), envPath.slice(1)) : envPath;
     }
     function _configVault(options) {
       const debug = Boolean(options && options.debug);
@@ -537,7 +541,7 @@ var require_main = __commonJS({
       return { parsed };
     }
     function configDotenv(options) {
-      const dotenvPath = path3.resolve(process.cwd(), ".env");
+      const dotenvPath = path2.resolve(process.cwd(), ".env");
       let encoding = "utf8";
       const debug = Boolean(options && options.debug);
       const quiet = options && "quiet" in options ? options.quiet : true;
@@ -561,13 +565,13 @@ var require_main = __commonJS({
       }
       let lastError;
       const parsedAll = {};
-      for (const path4 of optionPaths) {
+      for (const path3 of optionPaths) {
         try {
-          const parsed = DotenvModule.parse(fs.readFileSync(path4, { encoding }));
+          const parsed = DotenvModule.parse(fs.readFileSync(path3, { encoding }));
           DotenvModule.populate(parsedAll, parsed, options);
         } catch (e) {
           if (debug) {
-            _debug(`Failed to load ${path4} ${e.message}`);
+            _debug(`Failed to load ${path3} ${e.message}`);
           }
           lastError = e;
         }
@@ -582,7 +586,7 @@ var require_main = __commonJS({
         const shortPaths = [];
         for (const filePath of optionPaths) {
           try {
-            const relative = path3.relative(process.cwd(), filePath);
+            const relative = path2.relative(process.cwd(), filePath);
             shortPaths.push(relative);
           } catch (e) {
             if (debug) {
@@ -905,10 +909,10 @@ var init_bootstrap = __esm({
 });
 
 // ../../packages/@company/cloud/src/storage-uri.ts
-function storageUri(bucket, path3) {
+function storageUri(bucket, path2) {
   const provider = cloudRegistry.provider;
   const scheme = provider === "aws" ? "s3" : provider === "gcp" ? "gs" : "file";
-  return `${scheme}://${bucket}/${path3}`;
+  return `${scheme}://${bucket}/${path2}`;
 }
 var init_storage_uri = __esm({
   "../../packages/@company/cloud/src/storage-uri.ts"() {
@@ -1974,6 +1978,13 @@ var init_middleware = __esm({
   }
 });
 
+// ../../packages/@company/observability/src/public-error.ts
+var init_public_error = __esm({
+  "../../packages/@company/observability/src/public-error.ts"() {
+    "use strict";
+  }
+});
+
 // ../../packages/@company/observability/src/health.ts
 var init_health = __esm({
   "../../packages/@company/observability/src/health.ts"() {
@@ -2000,6 +2011,7 @@ var init_src2 = __esm({
     init_metrics();
     init_scaling_metrics();
     init_middleware();
+    init_public_error();
     init_health();
     init_degradation();
     init_types();
@@ -2139,12 +2151,213 @@ var init_hmac = __esm({
   }
 });
 
+// ../../node_modules/wink-porter2-stemmer/src/wink-porter2-stemmer.js
+var require_wink_porter2_stemmer = __commonJS({
+  "../../node_modules/wink-porter2-stemmer/src/wink-porter2-stemmer.js"(exports2, module2) {
+    var rgxDouble = /(bb|dd|ff|gg|mm|nn|pp|rr|tt)$/;
+    var rgxSFXsses = /(.+)(sses)$/;
+    var rgxSFXiedORies2 = /(.{2,})(ied|ies)$/;
+    var rgxSFXiedORies1 = /(.{1})(ied|ies)$/;
+    var rgxSFXusORss = /(.+)(us|ss)$/;
+    var rgxSFXs = /(.+)(s)$/;
+    var rgxSFXeedlyOReed = /(.*)(eedly|eed)$/;
+    var rgxSFXedORedlyORinglyORing = /([aeiouy].*)(ed|edly|ingly|ing)$/;
+    var rgxSFXatORblORiz = /(at|bl|iz)$/;
+    var rgxSFXyOR3 = /(.+[^aeiouy])([y3])$/;
+    var rgxSFXstep2 = /(ization|ational|fulness|ousness|iveness|tional|biliti|lessli|entli|ation|alism|aliti|ousli|iviti|fulli|enci|anci|abli|izer|ator|alli|bli|ogi|li)$/;
+    var rgxSFXstep2WithReplacements = [
+      // Length 7.
+      { rgx: /ational$/, replacement: "ate" },
+      { rgx: /ization$/, replacement: "ize" },
+      { rgx: /fulness$/, replacement: "ful" },
+      { rgx: /ousness$/, replacement: "ous" },
+      { rgx: /iveness$/, replacement: "ive" },
+      // Length 6.
+      { rgx: /tional$/, replacement: "tion" },
+      { rgx: /biliti$/, replacement: "ble" },
+      { rgx: /lessli$/, replacement: "less" },
+      // Length 5.
+      { rgx: /iviti$/, replacement: "ive" },
+      { rgx: /ousli$/, replacement: "ous" },
+      { rgx: /ation$/, replacement: "ate" },
+      { rgx: /entli$/, replacement: "ent" },
+      { rgx: /(.*)(alism|aliti)$/, replacement: "$1al" },
+      { rgx: /fulli$/, replacement: "ful" },
+      // Length 4.
+      { rgx: /alli$/, replacement: "al" },
+      { rgx: /ator$/, replacement: "ate" },
+      { rgx: /izer$/, replacement: "ize" },
+      { rgx: /enci$/, replacement: "ence" },
+      { rgx: /anci$/, replacement: "ance" },
+      { rgx: /abli$/, replacement: "able" },
+      // Length 3.
+      { rgx: /bli$/, replacement: "ble" },
+      { rgx: /(.*)(l)(ogi)$/, replacement: "$1$2og" },
+      // Length 2.
+      { rgx: /(.*)([cdeghkmnrt])(li)$/, replacement: "$1$2" }
+    ];
+    var rgxSFXstep3 = /(ational|tional|alize|icate|iciti|ative|ical|ness|ful)$/;
+    var rgxSFXstep3WithReplacements = [
+      { rgx: /ational$/, replacement: "ate" },
+      { rgx: /tional$/, replacement: "tion" },
+      { rgx: /alize$/, replacement: "al" },
+      { rgx: /(.*)(icate|iciti|ical)$/, replacement: "$1ic" },
+      { rgx: /(ness|ful)$/, replacement: "" }
+    ];
+    var rgxSFXstep4 = /(ement|ance|ence|able|ible|ment|ant|ent|ism|ate|iti|ous|ive|ize|al|er|ic)$/;
+    var rgxSFXstep4Full = /(ement|ance|ence|able|ible|ment|ant|ent|ism|ate|iti|ous|ive|ize|ion|al|er|ic)$/;
+    var rgxSFXstep4ion = /(.*)(s|t)(ion)$/;
+    var exceptions1 = /* @__PURE__ */ Object.create(null);
+    exceptions1.skis = "ski";
+    exceptions1.skies = "sky";
+    exceptions1.dying = "die";
+    exceptions1.lying = "lie";
+    exceptions1.tying = "tie";
+    exceptions1.idly = "idl";
+    exceptions1.gently = "gentl";
+    exceptions1.ugly = "ugli";
+    exceptions1.early = "earli";
+    exceptions1.only = "onli";
+    exceptions1.singly = "singl";
+    exceptions1.sky = "sky";
+    exceptions1.news = "news";
+    exceptions1.atlas = "atlas";
+    exceptions1.cosmos = "cosmos";
+    exceptions1.bias = "bias";
+    exceptions1.andes = "andes";
+    var rgxException2 = /^(inning|outing|canning|herring|proceed|exceed|succeed|earring)$/;
+    var prelude = function(s) {
+      return s.replace(/^y/, "3").replace(/([aeiou])y/, "$13").replace(/\’s$|\'s$/, "").replace(/s\’$|s\'$/, "").replace(/[\’\']$/, "");
+    };
+    var isShort = function(s) {
+      return /[^aeiouy][aeiouy][^aeiouywx3]$/.test(s) || /^[aeiouy][^aeiouy]{0,1}$/.test(s);
+    };
+    var markRegions = function(s) {
+      var m1, m2;
+      var rgxRegions = /[aeiouy]+([^aeiouy]{1}.+)/;
+      m1 = rgxRegions.exec(s);
+      if (!m1) return { r1: "", r2: "" };
+      m1 = m1[1].slice(1);
+      m1 = /^(gener|commun|arsen)/.test(s) ? s.replace(/^(gener|commun|arsen)(.*)/, "$2") : m1;
+      m2 = rgxRegions.exec(m1);
+      if (!m2) return { r1: m1, r2: "" };
+      m2 = m2[1].slice(1);
+      return { r1: m1, r2: m2 };
+    };
+    var step1a = function(s) {
+      var wordPart;
+      if (rgxSFXsses.test(s)) return s.replace(rgxSFXsses, "$1ss");
+      if (rgxSFXiedORies2.test(s)) return s.replace(rgxSFXiedORies2, "$1i");
+      if (rgxSFXiedORies1.test(s)) return s.replace(rgxSFXiedORies1, "$1ie");
+      if (rgxSFXusORss.test(s)) return s;
+      wordPart = s.replace(rgxSFXs, "$1");
+      if (/[aeiuouy](.+)$/.test(wordPart)) return s.replace(rgxSFXs, "$1");
+      return s;
+    };
+    var step1b = function(s) {
+      var rgn = markRegions(s), sd;
+      if (rgxSFXeedlyOReed.test(s))
+        return rgxSFXeedlyOReed.test(rgn.r1) ? s.replace(rgxSFXeedlyOReed, "$1ee") : s;
+      if (rgxSFXedORedlyORinglyORing.test(s)) {
+        sd = s.replace(rgxSFXedORedlyORinglyORing, "$1");
+        rgn = markRegions(sd);
+        return rgxSFXatORblORiz.test(sd) ? sd + "e" : (
+          // or
+          rgxDouble.test(sd) ? sd.replace(/.$/, "") : (
+            // or
+            isShort(sd) && rgn.r1 === "" ? sd + "e" : (
+              // or
+              sd
+            )
+          )
+        );
+      }
+      return s;
+    };
+    var step1c = function(s) {
+      return s.replace(rgxSFXyOR3, "$1i");
+    };
+    var step2 = function(s) {
+      var i, imax, rgn = markRegions(s), us;
+      var match = s.match(rgxSFXstep2);
+      match = match === null ? "$$$$$" : match[1];
+      if (rgn.r1.indexOf(match) !== -1) {
+        for (i = 0, imax = rgxSFXstep2WithReplacements.length; i < imax; i += 1) {
+          us = s.replace(rgxSFXstep2WithReplacements[i].rgx, rgxSFXstep2WithReplacements[i].replacement);
+          if (s !== us) return us;
+        }
+      }
+      return s;
+    };
+    var step3 = function(s) {
+      var i, imax, rgn = markRegions(s), us;
+      var match = s.match(rgxSFXstep3);
+      match = match === null ? "$$$$$" : match[1];
+      if (rgn.r1.indexOf(match) !== -1) {
+        for (i = 0, imax = rgxSFXstep3WithReplacements.length; i < imax; i += 1) {
+          us = s.replace(rgxSFXstep3WithReplacements[i].rgx, rgxSFXstep3WithReplacements[i].replacement);
+          if (s !== us) return us;
+        }
+        if (/ative/.test(rgn.r2)) return s.replace(/ative$/, "");
+      }
+      return s;
+    };
+    var step4 = function(s) {
+      var rgn = markRegions(s);
+      var match = s.match(rgxSFXstep4Full);
+      match = match === null ? "$$$$$" : match[1];
+      if (rgxSFXstep4Full.test(s) && rgn.r2.indexOf(match) !== -1) {
+        return rgxSFXstep4.test(s) ? s.replace(rgxSFXstep4, "") : rgxSFXstep4ion.test(s) ? s.replace(rgxSFXstep4ion, "$1$2") : s;
+      }
+      return s;
+    };
+    var step5 = function(s) {
+      var preceding, rgn;
+      rgn = markRegions(s);
+      if (/e$/i.test(s)) {
+        preceding = s.replace(/e$/, "");
+        return (
+          // Found: delete if in R2, or in R1 and not preceded by a short syllable
+          /e/.test(rgn.r2) || /e/.test(rgn.r1) && !isShort(preceding) ? preceding : s
+        );
+      }
+      if (/l$/.test(s)) {
+        rgn = markRegions(s);
+        return rgn.r2 && /l$/.test(rgn.r2) ? s.replace(/ll$/, "l") : s;
+      }
+      return s;
+    };
+    var stem2 = function(word) {
+      var str = word.toLowerCase();
+      if (str.length < 3) return str;
+      if (exceptions1[str]) return exceptions1[str];
+      str = prelude(str);
+      str = step1a(str);
+      if (!rgxException2.test(str)) {
+        str = step1b(str);
+        str = step1c(str);
+        str = step2(str);
+        str = step3(str);
+        str = step4(str);
+        str = step5(str);
+      }
+      str = str.replace(/3/g, "y");
+      return str;
+    };
+    module2.exports = stem2;
+  }
+});
+
 // ../../packages/@company/encryption/src/search-tokens.ts
+var import_wink_porter2_stemmer, SEARCH_TOKEN_VERSION, SEARCH_TOKEN_PREFIX;
 var init_search_tokens = __esm({
   "../../packages/@company/encryption/src/search-tokens.ts"() {
     "use strict";
     init_hmac();
     init_org_keys();
+    import_wink_porter2_stemmer = __toESM(require_wink_porter2_stemmer());
+    SEARCH_TOKEN_VERSION = 2;
+    SEARCH_TOKEN_PREFIX = `h${SEARCH_TOKEN_VERSION}`;
   }
 });
 
@@ -19676,7 +19889,7 @@ var require_split2 = __commonJS({
 var require_helper = __commonJS({
   "../../node_modules/pgpass/lib/helper.js"(exports2, module2) {
     "use strict";
-    var path3 = require("path");
+    var path2 = require("path");
     var Stream = require("stream").Stream;
     var split = require_split2();
     var util2 = require("util");
@@ -19715,7 +19928,7 @@ var require_helper = __commonJS({
     };
     module2.exports.getFileName = function(rawEnv) {
       var env = rawEnv || process.env;
-      var file2 = env.PGPASSFILE || (isWin ? path3.join(env.APPDATA || "./", "postgresql", "pgpass.conf") : path3.join(env.HOME || "./", ".pgpass"));
+      var file2 = env.PGPASSFILE || (isWin ? path2.join(env.APPDATA || "./", "postgresql", "pgpass.conf") : path2.join(env.HOME || "./", ".pgpass"));
       return file2;
     };
     module2.exports.usePgPass = function(stats, fname) {
@@ -19847,7 +20060,7 @@ var require_helper = __commonJS({
 var require_lib2 = __commonJS({
   "../../node_modules/pgpass/lib/index.js"(exports2, module2) {
     "use strict";
-    var path3 = require("path");
+    var path2 = require("path");
     var fs = require("fs");
     var helper = require_helper();
     module2.exports = function(connInfo, cb) {
@@ -21325,6 +21538,19 @@ var init_client = __esm({
   }
 });
 
+// ../../packages/@company/db/src/byod/routed-pool.ts
+var logger, ROUTED_TENANT_CONTEXT, ROUTED_TENANT_RAW_POOL, ADMITTED_TENANT_CONTEXT;
+var init_routed_pool = __esm({
+  "../../packages/@company/db/src/byod/routed-pool.ts"() {
+    "use strict";
+    init_src2();
+    logger = createLogger("db-byod-routed-pool");
+    ROUTED_TENANT_CONTEXT = Symbol.for("haansi.db.routedTenantContext");
+    ROUTED_TENANT_RAW_POOL = Symbol.for("haansi.db.routedTenantRawPool");
+    ADMITTED_TENANT_CONTEXT = Symbol.for("haansi.db.admittedTenantContext");
+  }
+});
+
 // ../../packages/@company/db/src/org-context.ts
 var observability3, DECRYPTING_CLIENT;
 var init_org_context = __esm({
@@ -21332,16 +21558,299 @@ var init_org_context = __esm({
     "use strict";
     init_src4();
     init_src2();
+    init_routed_pool();
     observability3 = createObservabilityService("db-org-context");
     DECRYPTING_CLIENT = Symbol.for("haansi.db.decryptingClient");
   }
 });
 
+// ../../packages/@company/types/src/timeline.ts
+var init_timeline = __esm({
+  "../../packages/@company/types/src/timeline.ts"() {
+    "use strict";
+  }
+});
+
+// ../../packages/@company/types/src/artifact.ts
+var init_artifact = __esm({
+  "../../packages/@company/types/src/artifact.ts"() {
+    "use strict";
+  }
+});
+
+// ../../packages/@company/types/src/taxonomy.ts
+function normalizeSessionType(raw) {
+  if (!raw) return "general";
+  const lower = raw.toLowerCase().trim();
+  if (lower in SESSION_TYPES) return lower;
+  if (lower in SESSION_TYPE_ALIASES) return SESSION_TYPE_ALIASES[lower];
+  return "general";
+}
+function normalizeComplexity(raw) {
+  if (!raw) return "moderate";
+  const lower = raw.toLowerCase().trim();
+  if (lower in COMPLEXITIES) return lower;
+  return "moderate";
+}
+function isReservedArtifactType(id) {
+  const meta3 = ARTIFACT_TYPES[id];
+  return meta3?.reserved === true;
+}
+var SESSION_TYPES, SESSION_TYPE_ALIASES, COMPLEXITIES, ARTIFACT_TYPES, __seenAliases, ALIAS_REVERSE_MAP, ARTIFACT_TYPE_IDS, AUTO_APPROVED_ARTIFACT_TYPES, GENERIC_WRITABLE_ARTIFACT_TYPE_IDS;
+var init_taxonomy = __esm({
+  "../../packages/@company/types/src/taxonomy.ts"() {
+    "use strict";
+    SESSION_TYPES = {
+      debugging: {
+        label: "Debugging",
+        description: "Investigating and fixing bugs or errors"
+      },
+      feature_implementation: {
+        label: "Feature Implementation",
+        description: "Building new functionality or features"
+      },
+      code_review: {
+        label: "Code Review",
+        description: "Reviewing code for quality, correctness, or style"
+      },
+      deployment: {
+        label: "Deployment",
+        description: "Deploying, releasing, or provisioning infrastructure"
+      },
+      refactoring: {
+        label: "Refactoring",
+        description: "Restructuring existing code without changing behavior"
+      },
+      configuration: {
+        label: "Configuration",
+        description: "Setting up or modifying project/tool configuration"
+      },
+      question_answer: {
+        label: "Question & Answer",
+        description: "Asking or answering questions about code or systems"
+      },
+      general: {
+        label: "General",
+        description: "General-purpose session not fitting other categories"
+      }
+    };
+    SESSION_TYPE_ALIASES = {
+      bug_fix: "debugging",
+      feature: "feature_implementation",
+      refactor: "refactoring",
+      config: "configuration"
+    };
+    COMPLEXITIES = {
+      simple: {
+        label: "Simple",
+        description: "Straightforward task with few steps"
+      },
+      moderate: {
+        label: "Moderate",
+        description: "Multi-step task requiring some investigation"
+      },
+      complex: {
+        label: "Complex",
+        description: "Involved task with many steps or deep analysis"
+      }
+    };
+    ARTIFACT_TYPES = {
+      report_incident: {
+        category: "report",
+        label: "Incident Report",
+        description: "Production-incident record + post-incident writeup: detection, timeline, root cause, resolution, follow-ups.",
+        icon: "AlertTriangle",
+        aliases: ["incident_summary", "incident", "postmortem", "post-mortem"],
+        autoApproved: false,
+        producedBy: [
+          "POST /api/v1/memory/processes/incidents",
+          "POST /api/v1/memory/reports/incident",
+          "POST /api/v1/memory/processes/incidents/:id/postmortem"
+        ]
+      },
+      report_decision: {
+        category: "report",
+        label: "Decision Record",
+        description: "Architectural / product decision record with context, options considered, decision, and rationale.",
+        icon: "Scale",
+        aliases: ["decision_record", "decision-record", "adr"],
+        autoApproved: false,
+        producedBy: ["POST /api/v1/memory"]
+      },
+      report_work: {
+        category: "report",
+        label: "Work Report",
+        description: "Periodic or one-off work-progress report \u2014 status updates, weekly digests, project rollups, team-activity summaries.",
+        icon: "CalendarDays",
+        aliases: ["weekly_digest", "weekly-digest", "status_report"],
+        autoApproved: true,
+        producedBy: ["POST /api/v1/memory", "POST /api/v1/memory/reports/work"]
+      },
+      report_sop: {
+        category: "report",
+        label: "Standard Operating Procedure",
+        description: "Reusable step-by-step procedure or runbook. Placeholder \u2014 surface not yet specialized; written via generic POST /memory until a dedicated producer ships.",
+        icon: "FileText",
+        aliases: ["sop", "runbook"],
+        autoApproved: false,
+        producedBy: ["POST /api/v1/memory"]
+      },
+      report_onboarding: {
+        category: "report",
+        label: "Onboarding Packet",
+        description: "Onboarding guide assembled from team knowledge, scoped to a project or role.",
+        icon: "GraduationCap",
+        aliases: ["onboarding_packet", "onboarding-packet"],
+        autoApproved: false,
+        producedBy: ["POST /api/v1/memory/reports/onboarding"]
+      },
+      report_pr: {
+        category: "report",
+        label: "PR Context",
+        description: "Enriched pull-request description with linked Jira/Slack context, recent decisions, and reviewer hints.",
+        icon: "GitPullRequest",
+        aliases: ["pr_context", "pr-context"],
+        autoApproved: true,
+        producedBy: ["POST /api/v1/memory/reports/pr"]
+      },
+      expert: {
+        category: "expert",
+        label: "Expert Profile",
+        description: "Per-person expertise profile across platforms \u2014 areas of focus, recent contributions, identity links.",
+        icon: "Users",
+        aliases: ["expert_profile", "expert-profile"],
+        autoApproved: false,
+        // No longer produced: expert profiles are versioned in expert_profiles
+        // (Expert Profiles v2). Snapshots saved earlier stay readable.
+        producedBy: []
+      },
+      solution_mined: {
+        category: "solution",
+        label: "Mined Solution",
+        description: "Problem + solution mined automatically from a developer coding session (the distilled-path pipeline).",
+        icon: "Lightbulb",
+        aliases: ["solution", "mined_solution", "distilled_path"],
+        autoApproved: true,
+        producedBy: ["POST /api/v1/memory/solutions/mined"]
+      },
+      solution_qna: {
+        category: "solution",
+        label: "Q&A Solution",
+        description: "Q&A answer marked verified by a user and distilled into reusable knowledge \u2014 promoted out of a conversation thread.",
+        icon: "ThumbsUp",
+        aliases: ["verified_answer", "verified-answer"],
+        autoApproved: true,
+        producedBy: ["POST /api/v1/memory/recall/messages/:id/feedback"]
+      },
+      digest_entry: {
+        category: "digest",
+        label: "Digest Entry",
+        description: "One period of a member's (or the organization's) work journal. Private to its subject and to owners/admins; written only by the digest service.",
+        icon: "Mail",
+        aliases: [],
+        autoApproved: true,
+        producedBy: [],
+        reserved: true
+      }
+    };
+    __seenAliases = /* @__PURE__ */ new Set();
+    for (const [id, meta3] of Object.entries(ARTIFACT_TYPES)) {
+      for (const a of meta3.aliases) {
+        if (__seenAliases.has(a)) {
+          throw new Error(
+            `[taxonomy] alias "${a}" declared on multiple artifact types; last seen on "${id}"`
+          );
+        }
+        __seenAliases.add(a);
+      }
+    }
+    ALIAS_REVERSE_MAP = Object.freeze(
+      Object.fromEntries(
+        Object.entries(ARTIFACT_TYPES).flatMap(
+          ([id, meta3]) => meta3.aliases.map((a) => [a, id])
+        )
+      )
+    );
+    ARTIFACT_TYPE_IDS = Object.keys(
+      ARTIFACT_TYPES
+    );
+    AUTO_APPROVED_ARTIFACT_TYPES = ARTIFACT_TYPE_IDS.filter((id) => ARTIFACT_TYPES[id].autoApproved);
+    GENERIC_WRITABLE_ARTIFACT_TYPE_IDS = ARTIFACT_TYPE_IDS.filter((id) => !isReservedArtifactType(id));
+  }
+});
+
+// ../../packages/@company/types/src/embedding.ts
+var EMBEDDING_DEFAULTS, EMBEDDING_COLUMN, SUMMARY_EMBEDDING_COLUMN;
+var init_embedding = __esm({
+  "../../packages/@company/types/src/embedding.ts"() {
+    "use strict";
+    EMBEDDING_DEFAULTS = {
+      // `as const` gives a literal string type for the provider field, which
+      // is assignable to llm-client's LLMProvider union without forcing
+      // @company/types to import that union (which would re-introduce the
+      // dependency edge we want to keep absent).
+      // CUTOVER (2026-07-17): in-house model is now the active config. Reads +
+      // writes + backfills all target the local-768 columns. The old OpenAI 1536
+      // columns (`embedding` / `summary_embedding`) are retained but dormant —
+      // roll back by flipping this whole object back to
+      //   { provider:"openai", model:"text-embedding-3-small", dimensions:1536,
+      //     column:"embedding", summaryColumn:"summary_embedding" }
+      // (a later contract migration drops the dormant columns). Readers alias
+      // `<column> AS embedding` so result-row field names stay stable.
+      provider: "local",
+      model: "Alibaba-NLP/gte-base-en-v1.5",
+      dimensions: 768,
+      // The ACTIVE dense-vector column that every reader + writer + backfill targets.
+      column: "embedding_v2",
+      // The active summary-embedding column (process_registry's second vector,
+      // used by the process matcher).
+      summaryColumn: "summary_embedding_v2"
+    };
+    EMBEDDING_COLUMN = EMBEDDING_DEFAULTS.column;
+    SUMMARY_EMBEDDING_COLUMN = EMBEDDING_DEFAULTS.summaryColumn;
+  }
+});
+
+// ../../packages/@company/types/src/repo-file-url.ts
+var init_repo_file_url = __esm({
+  "../../packages/@company/types/src/repo-file-url.ts"() {
+    "use strict";
+  }
+});
+
+// ../../packages/@company/types/src/query-dialect.ts
+var init_query_dialect = __esm({
+  "../../packages/@company/types/src/query-dialect.ts"() {
+    "use strict";
+  }
+});
+
+// ../../packages/@company/types/src/report-template.ts
+var init_report_template = __esm({
+  "../../packages/@company/types/src/report-template.ts"() {
+    "use strict";
+  }
+});
+
+// ../../packages/@company/types/src/index.ts
+var init_src5 = __esm({
+  "../../packages/@company/types/src/index.ts"() {
+    init_timeline();
+    init_artifact();
+    init_taxonomy();
+    init_embedding();
+    init_repo_file_url();
+    init_query_dialect();
+    init_report_template();
+  }
+});
+
 // ../../packages/@company/db/src/search-vector-write.ts
 var KNOWLEDGE_ARTIFACT_VECTOR_NULLS, PROCESS_REGISTRY_VECTOR_NULLS;
 var init_search_vector_write = __esm({
   "../../packages/@company/db/src/search-vector-write.ts"() {
     "use strict";
+    init_src5();
     init_src4();
     init_org_context();
     KNOWLEDGE_ARTIFACT_VECTOR_NULLS = (KNOWLEDGE_ARTIFACTS_SEARCH_VECTOR.weights ?? []).map(() => null);
@@ -21387,6 +21896,37 @@ var init_integration_purge = __esm({
   }
 });
 
+// ../../packages/@company/db/src/person-source-identities.ts
+var init_person_source_identities = __esm({
+  "../../packages/@company/db/src/person-source-identities.ts"() {
+    "use strict";
+    init_org_context();
+  }
+});
+
+// ../../packages/@company/db/src/expert-evidence-availability.ts
+var init_expert_evidence_availability = __esm({
+  "../../packages/@company/db/src/expert-evidence-availability.ts"() {
+    "use strict";
+    init_org_context();
+  }
+});
+
+// ../../packages/@company/db/src/activity-title.ts
+var init_activity_title = __esm({
+  "../../packages/@company/db/src/activity-title.ts"() {
+    "use strict";
+  }
+});
+
+// ../../packages/@company/db/src/expert-areas.ts
+var init_expert_areas = __esm({
+  "../../packages/@company/db/src/expert-areas.ts"() {
+    "use strict";
+    init_src4();
+  }
+});
+
 // ../../packages/@company/db/src/exchange-context.ts
 var observability6;
 var init_exchange_context = __esm({
@@ -21409,6 +21949,7 @@ var init_organization_data_access = __esm({
   "../../packages/@company/db/src/data-access/organization-data-access.ts"() {
     "use strict";
     init_src4();
+    init_org_context();
   }
 });
 
@@ -21450,11 +21991,26 @@ var init_config_cache = __esm({
   }
 });
 
+// ../../packages/@company/db/src/byod/control-plane-residency.ts
+var init_control_plane_residency = __esm({
+  "../../packages/@company/db/src/byod/control-plane-residency.ts"() {
+    "use strict";
+  }
+});
+
+// ../../packages/@company/db/src/byod/org-db-resolver.ts
+var init_org_db_resolver = __esm({
+  "../../packages/@company/db/src/byod/org-db-resolver.ts"() {
+    "use strict";
+    init_pool_manager();
+    init_routed_pool();
+  }
+});
+
 // ../../packages/@company/db/src/byod/source-events-routing.ts
 var init_source_events_routing = __esm({
   "../../packages/@company/db/src/byod/source-events-routing.ts"() {
     "use strict";
-    init_pool_manager();
   }
 });
 
@@ -21464,24 +22020,17 @@ var init_integration_storage = __esm({
     "use strict";
     init_config_cache();
     init_pool_manager();
+    init_org_db_resolver();
     init_source_events_routing();
   }
 });
 
-// ../../packages/@company/db/src/byod/org-db-resolver.ts
-var init_org_db_resolver = __esm({
-  "../../packages/@company/db/src/byod/org-db-resolver.ts"() {
-    "use strict";
-    init_pool_manager();
-  }
-});
-
 // ../../packages/@company/db/src/byod/query-helper.ts
 var init_query_helper = __esm({
   "../../packages/@company/db/src/byod/query-helper.ts"() {
     "use strict";
-    init_src4();
     init_org_context();
+    init_org_db_resolver();
   }
 });
 
@@ -21494,8 +22043,15 @@ function entry(database, dbName, table, orgScoping, opts = {}) {
     orgScoping,
     scopingColumn: opts.scopingColumn,
     hasVectorColumn: opts.hasVectorColumn ?? false,
-    flagGated: opts.flagGated ?? false,
-    mergePolicy: opts.mergePolicy
+    mergePolicy: opts.mergePolicy,
+    reconciliation: opts.reconciliation ?? (opts.mergePolicy?.identityKey ? {
+      ...DEFAULT_RECONCILIATION,
+      identity: {
+        kind: "columns",
+        columns: opts.mergePolicy.identityKey,
+        version: 1
+      }
+    } : DEFAULT_RECONCILIATION)
   };
 }
 function standardIntegrationTables(database, dbName) {
@@ -21533,58 +22089,17 @@ function standardIntegrationTables(database, dbName) {
     })
   ];
 }
-var OBJECT_GRAPH_TABLES, INTELLIGENCE_DB, intelligenceTables, INTEGRATIONS_DB, integrationTables, TABLE_REGISTRY;
+var DEFAULT_RECONCILIATION, INTELLIGENCE_DB, intelligenceTables, INTEGRATIONS_DB, integrationTables, TABLE_REGISTRY;
 var init_table_registry = __esm({
   "../../packages/@company/db/src/byod/table-registry.ts"() {
     "use strict";
-    OBJECT_GRAPH_TABLES = /* @__PURE__ */ new Set([
-      "objects",
-      "object_relationships",
-      "context_categories",
-      "identity_groups",
-      "identity_links",
-      "event_object_links",
-      "process_registry",
-      "process_activity_facts",
-      "process_anchor_entities",
-      "activity_graph_edges",
-      "process_assignment_predictions",
-      "process_assignment_audit",
-      "process_feedback_events",
-      "training_pair_labels",
-      "training_event_splits",
-      "model_evaluation_runs",
-      "model_evaluation_scores",
-      "training_runs",
-      "model_versions",
-      "process_discovery_candidates",
-      "activity_backfill_checkpoints",
-      "user_workstream_state",
-      // Identity/graph audit + override + derived-index tables written by the same
-      // routed mining object-graph path (audit round 3 coverage sweep).
-      "identity_audit_log",
-      "merge_operations",
-      "user_graph_overrides",
-      "event_feature_index",
-      // Sparse-index IDF derived from objects.search_vector — follows the object
-      // graph's residency (migration object-graph/043).
-      "org_term_df",
-      "org_corpus_stats",
-      // Per-identity keyword profile (migration object-graph/044).
-      "identity_keywords",
-      "org_mining_state",
-      "org_active_integrations",
-      // Object-graph correction/audit log (old/new JSONB + actor + trigger event),
-      // written by the routed mining object-graph path (lifecycle-engine →
-      // logCorrection). Rides to BYOD with the graph — audit round 4 (#2).
-      "object_corrections",
-      // Graph-enrichment bookkeeping: per-(org,platform) watermark + deadletter over
-      // process_activity_facts (deadletter FKs into it). The enrichment tick now runs
-      // per-org on the object-graph pool, so these ride to BYOD with the graph —
-      // audit round 4 (#3).
-      "graph_enrichment_state",
-      "graph_enrichment_deadletter"
-    ]);
+    DEFAULT_RECONCILIATION = {
+      identity: { kind: "primary_key" },
+      class: "authoritative",
+      conflictPolicy: "source_wins",
+      deleteDestinationOrphans: true,
+      destinationManagedColumns: ["updated_at"]
+    };
     INTELLIGENCE_DB = "haansi_intelligence_prod";
     intelligenceTables = [
       entry("intelligence", INTELLIGENCE_DB, "haansi_schema_version", "global"),
@@ -21673,21 +22188,78 @@ var init_table_registry = __esm({
       entry("intelligence", INTELLIGENCE_DB, "identity_links", "direct", {
         scopingColumn: "organization_id"
       }),
-      // Sparse-index IDF (per-org term-DF + corpus size) derived from
-      // objects.search_vector — rides to BYOD with the object graph.
-      entry("intelligence", INTELLIGENCE_DB, "org_term_df", "direct", {
+      entry("intelligence", INTELLIGENCE_DB, "event_object_links", "direct", {
         scopingColumn: "organization_id"
       }),
-      entry("intelligence", INTELLIGENCE_DB, "org_corpus_stats", "direct", {
+      entry("intelligence", INTELLIGENCE_DB, "process_activity_facts", "direct", {
         scopingColumn: "organization_id"
       }),
-      entry("intelligence", INTELLIGENCE_DB, "identity_keywords", "direct", {
+      // Role-aware attribution (object-graph/093): durable per-platform identities
+      // and (activity, identity, role) rows. Graph data — rides with PAF.
+      entry("intelligence", INTELLIGENCE_DB, "person_source_identities", "direct", {
         scopingColumn: "organization_id"
       }),
-      entry("intelligence", INTELLIGENCE_DB, "event_object_links", "direct", {
+      entry("intelligence", INTELLIGENCE_DB, "activity_participants", "direct", {
         scopingColumn: "organization_id"
       }),
-      entry("intelligence", INTELLIGENCE_DB, "process_activity_facts", "direct", {
+      // Expert profile change ledger (object-graph/094): pending recompute work,
+      // derived from graph writes. Rides with the object graph.
+      entry("intelligence", INTELLIGENCE_DB, "expert_dirty_queue", "direct", {
+        scopingColumn: "organization_id"
+      }),
+      // Member ↔ person-object links and precomputed expert facts (object-graph/095).
+      entry("intelligence", INTELLIGENCE_DB, "member_identity_links", "direct", {
+        scopingColumn: "organization_id"
+      }),
+      entry("intelligence", INTELLIGENCE_DB, "expert_profile_facts", "direct", {
+        scopingColumn: "organization_id"
+      }),
+      // Expert profile synthesis (object-graph/096).
+      entry("intelligence", INTELLIGENCE_DB, "expert_evidence_refs", "direct", {
+        scopingColumn: "organization_id"
+      }),
+      entry("intelligence", INTELLIGENCE_DB, "expert_profiles", "direct", {
+        scopingColumn: "organization_id"
+      }),
+      entry("intelligence", INTELLIGENCE_DB, "expert_profile_citations", "direct", {
+        scopingColumn: "organization_id"
+      }),
+      entry("intelligence", INTELLIGENCE_DB, "org_expertise_areas", "direct", {
+        scopingColumn: "organization_id"
+      }),
+      entry("intelligence", INTELLIGENCE_DB, "expert_areas", "direct", {
+        scopingColumn: "organization_id"
+      }),
+      entry("intelligence", INTELLIGENCE_DB, "expert_synthesis_claims", "direct", {
+        scopingColumn: "organization_id"
+      }),
+      // Org-level expertise grouping (object-graph/100).
+      entry("intelligence", INTELLIGENCE_DB, "expert_grouping_state", "direct", {
+        scopingColumn: "organization_id"
+      }),
+      entry("intelligence", INTELLIGENCE_DB, "expert_area_merge_log", "direct", {
+        scopingColumn: "organization_id"
+      }),
+      entry("intelligence", INTELLIGENCE_DB, "expert_profile_curation", "direct", {
+        scopingColumn: "organization_id"
+      }),
+      entry(
+        "intelligence",
+        INTELLIGENCE_DB,
+        "expert_profile_curation_log",
+        "direct",
+        { scopingColumn: "organization_id" }
+      ),
+      // Digests (migrations/digests/002): the generation queue, what each entry
+      // cites, and the audit log of explicit cross-member access. They ride with
+      // knowledge_artifacts, where digest entries live.
+      entry("intelligence", INTELLIGENCE_DB, "digest_generation_queue", "direct", {
+        scopingColumn: "organization_id"
+      }),
+      entry("intelligence", INTELLIGENCE_DB, "digest_evidence_refs", "direct", {
+        scopingColumn: "organization_id"
+      }),
+      entry("intelligence", INTELLIGENCE_DB, "digest_access_log", "direct", {
         scopingColumn: "organization_id"
       }),
       entry("intelligence", INTELLIGENCE_DB, "activity_graph_edges", "direct", {
@@ -21768,12 +22340,12 @@ var init_table_registry = __esm({
         scopingColumn: "organization_id"
       }),
       // Artifact-domain, always-BYOD (read/written via getUserdataPool like the rest
-      // of the artifacts). NOT flagGated.
+      // of the artifacts).
       entry("intelligence", INTELLIGENCE_DB, "artifact_corrections", "direct", {
         scopingColumn: "organization_id"
       }),
       // Object-graph identity/merge/override/audit + derived feature index + per-org
-      // mining state. flagGated (tagged via OBJECT_GRAPH_TABLES) — written by the
+      // mining state — written by the
       // routed mining object-graph path, so they ride to BYOD with the graph.
       entry("intelligence", INTELLIGENCE_DB, "identity_audit_log", "direct", {
         scopingColumn: "organization_id"
@@ -21793,7 +22365,7 @@ var init_table_registry = __esm({
       entry("intelligence", INTELLIGENCE_DB, "org_active_integrations", "direct", {
         scopingColumn: "organization_id"
       }),
-      // Object-graph correction/audit log — flagGated (via OBJECT_GRAPH_TABLES),
+      // Object-graph correction/audit log,
       // written by the routed object-graph path (lifecycle-engine → logCorrection),
       // so it rides to BYOD with the graph. audit round 4 (#2).
       entry("intelligence", INTELLIGENCE_DB, "object_corrections", "direct", {
@@ -21801,7 +22373,7 @@ var init_table_registry = __esm({
       }),
       // Trending similarity clusters — derived from, FK-bound to, and JOINed against
       // knowledge_artifacts (always-BYOD via getUserdataPool), so they follow the
-      // artifacts to BYOD (NOT flagGated — not object-graph). The trending tick +
+      // artifacts to BYOD. The trending tick +
       // read route resolve the org's userdata pool. audit round 4 (#3).
       entry("intelligence", INTELLIGENCE_DB, "artifact_clusters", "direct", {
         scopingColumn: "organization_id"
@@ -21809,8 +22381,8 @@ var init_table_registry = __esm({
       entry("intelligence", INTELLIGENCE_DB, "artifact_cluster_members", "direct", {
         scopingColumn: "organization_id"
       }),
-      // Graph-enrichment watermark + deadletter — flagGated (via OBJECT_GRAPH_TABLES),
-      // ride to BYOD with the object graph they walk. audit round 4 (#3).
+      // Graph-enrichment watermark + deadletter ride to BYOD with the object graph
+      // they walk. audit round 4 (#3).
       entry("intelligence", INTELLIGENCE_DB, "graph_enrichment_state", "direct", {
         scopingColumn: "organization_id"
       }),
@@ -21833,18 +22405,14 @@ var init_table_registry = __esm({
       entry("integrations", INTEGRATIONS_DB, "schema_migrations", "global")
     ];
     TABLE_REGISTRY = [
-      // Tag the object-graph residency tables as flagGated (single source of truth:
-      // OBJECT_GRAPH_TABLES) so migration gates them on byod_object_graph.
-      ...intelligenceTables.map(
-        (t) => OBJECT_GRAPH_TABLES.has(t.table) ? { ...t, flagGated: true } : t
-      ),
+      ...intelligenceTables,
       ...integrationTables
     ];
   }
 });
 
 // ../../packages/@company/db/src/byod/schema-provisioner.ts
-var path, SCHEMAS_DIR, logger;
+var path, SCHEMAS_DIR, logger2;
 var init_schema_provisioner = __esm({
   "../../packages/@company/db/src/byod/schema-provisioner.ts"() {
     "use strict";
@@ -21854,7 +22422,7 @@ var init_schema_provisioner = __esm({
     init_pool_manager();
     init_table_registry();
     SCHEMAS_DIR = path.join(__dirname, "schemas");
-    logger = createLogger("db-byod-schema-provisioner");
+    logger2 = createLogger("db-byod-schema-provisioner");
   }
 });
 
@@ -22737,10 +23305,10 @@ var require_pg_copy_streams = __commonJS({
     var CopyToQueryStream = require_copy_to();
     var CopyFromQueryStream = require_copy_from();
     var CopyBothQueryStream = require_copy_both();
-    exports2.to = function copyTo2(txt, options) {
+    exports2.to = function copyTo3(txt, options) {
       return new CopyToQueryStream(txt, options);
     };
-    exports2.from = function copyFrom2(txt, options) {
+    exports2.from = function copyFrom3(txt, options) {
       return new CopyFromQueryStream(txt, options);
     };
     exports2.both = function copyBoth(txt, options) {
@@ -22750,18 +23318,44 @@ var require_pg_copy_streams = __commonJS({
 });
 
 // ../../packages/@company/db/src/byod/migration-utils.ts
-var import_pg_copy_streams, import_pg_copy_streams2, logger2, COPY_TIMEOUT_MS;
+var import_pg_copy_streams, import_pg_copy_streams2, logger3, COPY_TIMEOUT_MS;
 var init_migration_utils = __esm({
   "../../packages/@company/db/src/byod/migration-utils.ts"() {
     "use strict";
     import_pg_copy_streams = __toESM(require_pg_copy_streams());
     import_pg_copy_streams2 = __toESM(require_pg_copy_streams());
     init_src2();
-    logger2 = createLogger("db-byod-migration-utils");
+    logger3 = createLogger("db-byod-migration-utils");
     COPY_TIMEOUT_MS = Number(process.env.BYOD_COPY_TIMEOUT_MS ?? 30 * 6e4);
   }
 });
 
+// ../../packages/@company/db/src/byod/partition-helpers.ts
+var PARTITIONABLE_TENANT_TABLES, PARTITIONABLE_TENANT_TABLE_SET;
+var init_partition_helpers = __esm({
+  "../../packages/@company/db/src/byod/partition-helpers.ts"() {
+    "use strict";
+    PARTITIONABLE_TENANT_TABLES = ["object_relationships"];
+    PARTITIONABLE_TENANT_TABLE_SET = new Set(
+      PARTITIONABLE_TENANT_TABLES
+    );
+  }
+});
+
+// ../../packages/@company/db/src/byod/reconciliation.ts
+var import_pg_copy_streams3, import_pg_copy_streams4, logger4;
+var init_reconciliation = __esm({
+  "../../packages/@company/db/src/byod/reconciliation.ts"() {
+    "use strict";
+    init_src2();
+    init_migration_utils();
+    init_partition_helpers();
+    import_pg_copy_streams3 = __toESM(require_pg_copy_streams());
+    import_pg_copy_streams4 = __toESM(require_pg_copy_streams());
+    logger4 = createLogger("db-byod-reconciliation");
+  }
+});
+
 // ../../packages/@company/db/src/byod/migration-service.ts
 var obs3, STALE_MIGRATION_MS;
 var init_migration_service = __esm({
@@ -22770,24 +23364,22 @@ var init_migration_service = __esm({
     init_esm();
     init_pool_manager();
     init_org_context();
+    init_client();
     init_src2();
+    init_control_plane_residency();
     init_table_registry();
     init_migration_utils();
+    init_partition_helpers();
+    init_reconciliation();
     obs3 = createObservabilityService("byod-migration");
     STALE_MIGRATION_MS = 10 * 60 * 1e3;
   }
 });
 
-// ../../packages/@company/db/src/byod/schema-sync.ts
-var path2, SCHEMAS_DIR2;
-var init_schema_sync = __esm({
-  "../../packages/@company/db/src/byod/schema-sync.ts"() {
+// ../../packages/@company/db/src/byod/reconciliation-limits.ts
+var init_reconciliation_limits = __esm({
+  "../../packages/@company/db/src/byod/reconciliation-limits.ts"() {
     "use strict";
-    init_esm();
-    path2 = __toESM(require("path"));
-    init_pool_manager();
-    init_schema_provisioner();
-    SCHEMAS_DIR2 = path2.join(__dirname, "schemas");
   }
 });
 
@@ -22795,6 +23387,8 @@ var init_schema_sync = __esm({
 var init_object_graph_pool = __esm({
   "../../packages/@company/db/src/byod/object-graph-pool.ts"() {
     "use strict";
+    init_org_db_resolver();
+    init_routed_pool();
   }
 });
 
@@ -22804,17 +23398,20 @@ var init_byod = __esm({
     "use strict";
     init_pool_manager();
     init_config_cache();
+    init_control_plane_residency();
     init_integration_storage();
     init_source_events_routing();
     init_org_db_resolver();
+    init_routed_pool();
     init_query_helper();
     init_schema_provisioner();
     init_host_resolver();
     init_active_orgs();
     init_migration_service();
     init_degradation2();
-    init_migration_utils();
-    init_schema_sync();
+    init_partition_helpers();
+    init_reconciliation();
+    init_reconciliation_limits();
     init_object_graph_pool();
     init_table_registry();
   }
@@ -22829,7 +23426,7 @@ var init_report_generation_jobs = __esm({
 });
 
 // ../../packages/@company/db/src/index.ts
-var init_src5 = __esm({
+var init_src6 = __esm({
   "../../packages/@company/db/src/index.ts"() {
     init_client();
     init_org_context();
@@ -22837,6 +23434,10 @@ var init_src5 = __esm({
     init_org_purge();
     init_org_orphan_scan();
     init_integration_purge();
+    init_person_source_identities();
+    init_expert_evidence_availability();
+    init_activity_title();
+    init_expert_areas();
     init_exchange_context();
     init_data_access();
     init_byod();
@@ -22850,7 +23451,7 @@ var init_dictionary = __esm({
   "../../packages/@company/pii/src/dictionary.ts"() {
     "use strict";
     init_src4();
-    init_src5();
+    init_src6();
     init_src2();
     init_spans();
     obs4 = createObservabilityService("org-pii-dictionary");
@@ -22858,18 +23459,25 @@ var init_dictionary = __esm({
   }
 });
 
+// ../../packages/@company/pii/src/pii-redaction-setting.ts
+var init_pii_redaction_setting = __esm({
+  "../../packages/@company/pii/src/pii-redaction-setting.ts"() {
+    "use strict";
+  }
+});
+
 // ../../packages/@company/pii/src/path-policy.ts
 function normalizeRoot(root) {
   return root.replace(/[\\/]+$/u, "");
 }
-function pathSeparator(path3) {
-  if (path3.includes("\\\\")) return "\\\\";
-  return path3.includes("\\") ? "\\" : "/";
+function pathSeparator(path2) {
+  if (path2.includes("\\\\")) return "\\\\";
+  return path2.includes("\\") ? "\\" : "/";
 }
-function matchingRepositoryRoot(path3, roots) {
-  const separator = pathSeparator(path3);
+function matchingRepositoryRoot(path2, roots) {
+  const separator = pathSeparator(path2);
   const windows = separator !== "/";
-  const comparablePath = windows ? path3.toLowerCase() : path3;
+  const comparablePath = windows ? path2.toLowerCase() : path2;
   return [...roots].map((root) => normalizeRoot(root).replace(/[\\/]/gu, separator)).filter(Boolean).sort((a, b) => b.length - a.length).find((root) => {
     const comparableRoot = windows ? root.toLowerCase() : root;
     return comparablePath === comparableRoot || comparablePath.startsWith(`${comparableRoot}${separator}`);
@@ -23040,10 +23648,11 @@ var init_presidio_adapter = __esm({
 });
 
 // ../../packages/@company/pii/src/index.ts
-var init_src6 = __esm({
+var init_src7 = __esm({
   "../../packages/@company/pii/src/index.ts"() {
     init_spans();
     init_dictionary();
+    init_pii_redaction_setting();
     init_deterministic();
     init_engine();
     init_jsonl_scalars();
@@ -23359,7 +23968,7 @@ function extractGitInfo(projectDir, sessionTimestamp, sessionBranch) {
   };
   const gitBin = resolveGitBin();
   if (!gitBin) {
-    logger3.warn("Git metadata skipped \u2014 git binary not found", {
+    logger5.warn("Git metadata skipped \u2014 git binary not found", {
       projectDir,
       reason: "git-not-on-path",
       tried: GIT_BIN_CANDIDATES
@@ -23377,7 +23986,7 @@ function extractGitInfo(projectDir, sessionTimestamp, sessionBranch) {
   try {
     git(["rev-parse", "--is-inside-work-tree"]);
   } catch (err) {
-    logger3.warn("Git metadata skipped \u2014 cwd not a resolvable git repo", {
+    logger5.warn("Git metadata skipped \u2014 cwd not a resolvable git repo", {
       projectDir,
       resolvedDir: dir,
       reason: err?.code === "ENOENT" ? "cwd-missing" : err?.status === 128 ? "not-a-git-repo" : "git-check-failed",
@@ -23429,7 +24038,7 @@ function resolveToken2() {
       const creds = JSON.parse((0, import_fs3.readFileSync)(CREDENTIALS_FILE4, "utf-8"));
       if (creds.token) return creds.token;
     } catch {
-      logger3.warn("Could not parse credentials file", {
+      logger5.warn("Could not parse credentials file", {
         file: CREDENTIALS_FILE4
       });
     }
@@ -23454,7 +24063,7 @@ function discoverSessions(agentIds) {
     try {
       discovered = agent.discoverSessions();
     } catch (err) {
-      logger3.warn(`Discovery failed for ${agent.displayName}`, {
+      logger5.warn(`Discovery failed for ${agent.displayName}`, {
         err: err?.message
       });
       continue;
@@ -23465,8 +24074,8 @@ function discoverSessions(agentIds) {
   }
   return sessions;
 }
-async function apiGet(path3, apiUrl2, token) {
-  const response = await fetch(`${apiUrl2}/api/v1${path3}`, {
+async function apiGet(path2, apiUrl2, token) {
+  const response = await fetch(`${apiUrl2}/api/v1${path2}`, {
     headers: { Authorization: `Bearer ${token}` }
   });
   if (!response.ok) {
@@ -23491,7 +24100,7 @@ async function getUploadedSessions(apiUrl2, token) {
     }
     return map2;
   } catch (err) {
-    void logger3.warn(
+    void logger5.warn(
       "Could not fetch uploaded sessions list \u2014 skipping this run rather than re-uploading everything",
       { error: err?.message ?? String(err) }
     );
@@ -23563,7 +24172,7 @@ function acquireRunLock() {
         }
         continue;
       }
-      void logger3.warn(
+      void logger5.warn(
         "Another collector run is in progress \u2014 skipping this run",
         {
           holderPid: holder
@@ -23602,11 +24211,11 @@ async function collectLocked(options) {
   }
   const agentIds = resolveAgentIds(options.agents);
   const localSessions = discoverSessions(agentIds);
-  logger3.info(`Found ${localSessions.length} session files on disk`, {
+  logger5.info(`Found ${localSessions.length} session files on disk`, {
     agents: agentIds.join(",")
   });
   if (localSessions.length === 0) {
-    return { uploaded: 0, skipped: 0, errors: 0 };
+    return { uploaded: 0, skipped: 0, errors: 0, deferred: 0 };
   }
   let uploaded = 0;
   let skipped = 0;
@@ -23614,11 +24223,16 @@ async function collectLocked(options) {
   let deferred = 0;
   const remoteMap = options.forceAll ? /* @__PURE__ */ new Map() : await getUploadedSessions(apiUrl2, token);
   if (remoteMap === null) {
-    void logger3.warn("Skipping collection: server inventory unavailable", {
+    void logger5.warn("Skipping collection: server inventory unavailable", {
       localSessions: localSessions.length,
       hint: "re-authenticate with `haansi auth login` if this persists"
     });
-    return { uploaded: 0, skipped: localSessions.length, errors: 0 };
+    return {
+      uploaded: 0,
+      skipped: localSessions.length,
+      errors: 0,
+      deferred: 0
+    };
   }
   const toUpload = [];
   for (const session of localSessions) {
@@ -23633,7 +24247,7 @@ async function collectLocked(options) {
   }
   const batch = options.limit ? toUpload.slice(0, options.limit) : toUpload;
   skipped += toUpload.length - batch.length;
-  logger3.info(
+  logger5.info(
     `Uploading ${batch.length} session(s), skipping ${skipped} unchanged`
   );
   for (const session of batch) {
@@ -23660,7 +24274,7 @@ async function collectLocked(options) {
           session.gitBranch ?? void 0
         );
       } else {
-        logger3.warn("Git metadata skipped \u2014 no cwd resolved for session", {
+        logger5.warn("Git metadata skipped \u2014 no cwd resolved for session", {
           sessionId: shortId,
           agentSource: session.agentId
         });
@@ -23675,7 +24289,7 @@ async function collectLocked(options) {
         normalizeLocalPathsForUpload(rawContent, gitInfo.gitRoot)
       );
       if (options.dryRun) {
-        logger3.info(
+        logger5.info(
           `[dry-run] Would upload ${shortId} (${session.agentId}, ${session.lineCount} lines)`,
           {
             agentSource: session.agentId,
@@ -23696,7 +24310,7 @@ async function collectLocked(options) {
         gitInfo
       );
       uploaded++;
-      logger3.info(
+      logger5.info(
         `Uploaded ${shortId} (${session.agentId}, ${session.lineCount} lines)`,
         {
           agentSource: session.agentId,
@@ -23707,22 +24321,22 @@ async function collectLocked(options) {
       );
     } catch (err) {
       if (err?.miningDisabled) {
-        void logger3.info(
+        void logger5.info(
           "Mining is disabled for this organization \u2014 nothing is being collected. An owner or admin can enable it in Settings \u2192 Connections \u2192 Coding Sessions."
         );
         break;
       }
       if (err?.rateLimited) {
         deferred++;
-        void logger3.info(`Rate limited, will retry next run: ${shortId}`);
+        void logger5.info(`Rate limited, will retry next run: ${shortId}`);
       } else {
         errors++;
-        logger3.error(`Failed to upload ${shortId}`, { err: err.message });
+        logger5.error(`Failed to upload ${shortId}`, { err: err.message });
       }
     }
   }
   if (deferred > 0) {
-    void logger3.info(
+    void logger5.info(
       `${deferred} session(s) deferred by the upload rate limit \u2014 they remain queued`,
       { deferred, uploaded }
     );
@@ -23734,7 +24348,7 @@ async function main() {
   const dryRun = process.argv.includes("--dry-run");
   const limitIdx = process.argv.indexOf("--limit");
   const limit = limitIdx !== -1 ? parseInt(process.argv[limitIdx + 1], 10) : void 0;
-  logger3.info("Collector starting", { forceAll, dryRun });
+  logger5.info("Collector starting", { forceAll, dryRun });
   const {
     uploaded: _uploaded,
     skipped: _skipped,
@@ -23749,14 +24363,14 @@ async function main() {
 async function collect(options) {
   if (options.dryRun) return collectLocked(options);
   const lock = acquireRunLock();
-  if (lock === null) return { uploaded: 0, skipped: 0, errors: 0 };
+  if (lock === null) return { uploaded: 0, skipped: 0, errors: 0, deferred: 0 };
   try {
     return await collectLocked(options);
   } finally {
     releaseRunLock(lock);
   }
 }
-var import_dotenv, import_path3, import_fs3, import_os3, import_zlib, import_child_process, logger3, DEFAULT_API_URL2, CREDENTIALS_FILE4, LOCK_FILE, MIN_LINES, EDGE_SCRUB_PATTERNS, GIT_BIN_CANDIDATES, resolvedGitBin, UPLOAD_RATE_LIMIT_RETRIES, DEFAULT_RATE_LIMIT_WAIT_MS;
+var import_dotenv, import_path3, import_fs3, import_os3, import_zlib, import_child_process, logger5, DEFAULT_API_URL2, CREDENTIALS_FILE4, LOCK_FILE, MIN_LINES, EDGE_SCRUB_PATTERNS, GIT_BIN_CANDIDATES, resolvedGitBin, UPLOAD_RATE_LIMIT_RETRIES, DEFAULT_RATE_LIMIT_WAIT_MS;
 var init_collector = __esm({
   "../service-capture/agent-sessions/collector.ts"() {
     "use strict";
@@ -23768,10 +24382,10 @@ var init_collector = __esm({
     import_child_process = require("child_process");
     init_src2();
     init_service_urls();
-    init_src6();
+    init_src7();
     init_agents();
     (0, import_dotenv.config)({ path: (0, import_path3.resolve)(__dirname, "../../../.env") });
-    logger3 = createLogger("session-collector");
+    logger5 = createLogger("session-collector");
     DEFAULT_API_URL2 = SERVICE_URL_DEFAULTS.haansiApiBaseUrl;
     CREDENTIALS_FILE4 = (0, import_path3.join)((0, import_os3.homedir)(), ".haansi", "credentials.json");
     LOCK_FILE = (0, import_path3.join)((0, import_os3.homedir)(), ".haansi", "collector.lock");
@@ -23825,7 +24439,7 @@ var init_collector = __esm({
     DEFAULT_RATE_LIMIT_WAIT_MS = 6e4;
     if (require.main === module) {
       main().catch((err) => {
-        logger3.error("Collector failed", err);
+        logger5.error("Collector failed", err);
         process.exit(1);
       });
     }
@@ -24734,7 +25348,7 @@ var require_scheduled_task = __commonJS({
 var require_background_scheduled_task = __commonJS({
   "../../node_modules/node-cron/src/background-scheduled-task/index.js"(exports2, module2) {
     var EventEmitter = require("events");
-    var path3 = require("path");
+    var path2 = require("path");
     var { fork } = require("child_process");
     var uuid3 = (init_esm_node2(), __toCommonJS(esm_node_exports));
     var daemonPath = `${__dirname}/daemon.js`;
@@ -24769,7 +25383,7 @@ var require_background_scheduled_task = __commonJS({
         options.scheduled = true;
         this.forkProcess.send({
           type: "register",
-          path: path3.resolve(this.taskPath),
+          path: path2.resolve(this.taskPath),
           cron: this.cronExpression,
           options
         });
@@ -24915,7 +25529,7 @@ function getOnDiskVersion() {
 function trimLog() {
   const { rotated, sizeBefore, tailKept } = rotateLogIfLarge(LOG_FILE);
   if (rotated) {
-    logger4.info("Rotated daemon log", {
+    void logger6.info("Rotated daemon log", {
       sizeBefore,
       tailKept,
       previous: `${LOG_FILE}.1`
@@ -24925,22 +25539,24 @@ function trimLog() {
 async function run() {
   trimLog();
   const agents = resolveAgentsEnv();
-  logger4.info("Collect run starting", { agents: agents?.join(",") ?? "all" });
+  void logger6.info("Collect run starting", {
+    agents: agents?.join(",") ?? "all"
+  });
   const start = Date.now();
   try {
     const { uploaded, skipped, errors } = await collect({ agents });
     const elapsed = ((Date.now() - start) / 1e3).toFixed(1);
-    logger4.info(`Collect run complete in ${elapsed}s`, {
+    void logger6.info(`Collect run complete in ${elapsed}s`, {
       uploaded,
       skipped,
       errors
     });
   } catch (err) {
-    logger4.error("Collect run failed", { err: err.message });
+    void logger6.error("Collect run failed", { err: err.message });
   }
 }
 async function main2() {
-  logger4.info("Collector daemon starting", {
+  void logger6.info("Collector daemon starting", {
     schedule: SCHEDULE,
     version: IN_MEMORY_VERSION
   });
@@ -24948,24 +25564,26 @@ async function main2() {
   import_node_cron.default.schedule(SCHEDULE, async () => {
     const diskVersion = getOnDiskVersion();
     if (diskVersion && diskVersion !== IN_MEMORY_VERSION) {
-      logger4.info("Version mismatch detected \u2014 restarting", {
+      void logger6.info("Version mismatch detected \u2014 restarting", {
         inMemory: IN_MEMORY_VERSION,
         onDisk: diskVersion
       });
       process.exit(0);
     }
-    logger4.info("Scheduled collect run triggered");
+    void logger6.info("Scheduled collect run triggered");
     await run();
   });
-  logger4.info(`Daemon running. Next run scheduled per cron: "${SCHEDULE}"`);
+  void logger6.info(
+    `Daemon running. Next run scheduled per cron: "${SCHEDULE}"`
+  );
   const shutdown = async (signal) => {
-    logger4.info(`Received ${signal}, shutting down`);
+    void logger6.info(`Received ${signal}, shutting down`);
     process.exit(0);
   };
   process.on("SIGTERM", () => shutdown("SIGTERM"));
   process.on("SIGINT", () => shutdown("SIGINT"));
 }
-var import_dotenv2, import_fs5, import_path4, import_os4, import_node_cron, logger4, IN_MEMORY_VERSION, SCHEDULE, LOG_FILE;
+var import_dotenv2, import_fs5, import_path4, import_os4, import_node_cron, logger6, IN_MEMORY_VERSION, SCHEDULE, LOG_FILE;
 var init_collector_daemon = __esm({
   "../service-capture/agent-sessions/collector-daemon.ts"() {
     "use strict";
@@ -24978,13 +25596,13 @@ var init_collector_daemon = __esm({
     init_src2();
     init_log_rotation();
     (0, import_dotenv2.config)({ path: (0, import_path4.resolve)(__dirname, "../../../.env") });
-    logger4 = createLogger("collector-daemon");
+    logger6 = createLogger("collector-daemon");
     IN_MEMORY_VERSION = // eslint-disable-next-line @typescript-eslint/no-require-imports
     require_package().version;
     SCHEDULE = process.env.HAANSI_COLLECT_SCHEDULE ?? process.env.CLAUDE_COLLECT_SCHEDULE ?? "*/30 * * * *";
     LOG_FILE = (0, import_path4.join)((0, import_os4.homedir)(), ".haansi", "daemon.log");
     main2().catch((err) => {
-      logger4.error("Daemon failed to start", err);
+      void logger6.error("Daemon failed to start", err);
       process.exit(1);
     });
   }
@@ -25006,246 +25624,6 @@ var init_http_timeout = __esm({
   }
 });
 
-// ../../packages/@company/types/src/timeline.ts
-var init_timeline = __esm({
-  "../../packages/@company/types/src/timeline.ts"() {
-    "use strict";
-  }
-});
-
-// ../../packages/@company/types/src/artifact.ts
-var init_artifact = __esm({
-  "../../packages/@company/types/src/artifact.ts"() {
-    "use strict";
-  }
-});
-
-// ../../packages/@company/types/src/taxonomy.ts
-function normalizeSessionType(raw) {
-  if (!raw) return "general";
-  const lower = raw.toLowerCase().trim();
-  if (lower in SESSION_TYPES) return lower;
-  if (lower in SESSION_TYPE_ALIASES) return SESSION_TYPE_ALIASES[lower];
-  return "general";
-}
-function normalizeComplexity(raw) {
-  if (!raw) return "moderate";
-  const lower = raw.toLowerCase().trim();
-  if (lower in COMPLEXITIES) return lower;
-  return "moderate";
-}
-var SESSION_TYPES, SESSION_TYPE_ALIASES, COMPLEXITIES, ARTIFACT_TYPES, __seenAliases, ALIAS_REVERSE_MAP, ARTIFACT_TYPE_IDS, AUTO_APPROVED_ARTIFACT_TYPES;
-var init_taxonomy = __esm({
-  "../../packages/@company/types/src/taxonomy.ts"() {
-    "use strict";
-    SESSION_TYPES = {
-      debugging: {
-        label: "Debugging",
-        description: "Investigating and fixing bugs or errors"
-      },
-      feature_implementation: {
-        label: "Feature Implementation",
-        description: "Building new functionality or features"
-      },
-      code_review: {
-        label: "Code Review",
-        description: "Reviewing code for quality, correctness, or style"
-      },
-      deployment: {
-        label: "Deployment",
-        description: "Deploying, releasing, or provisioning infrastructure"
-      },
-      refactoring: {
-        label: "Refactoring",
-        description: "Restructuring existing code without changing behavior"
-      },
-      configuration: {
-        label: "Configuration",
-        description: "Setting up or modifying project/tool configuration"
-      },
-      question_answer: {
-        label: "Question & Answer",
-        description: "Asking or answering questions about code or systems"
-      },
-      general: {
-        label: "General",
-        description: "General-purpose session not fitting other categories"
-      }
-    };
-    SESSION_TYPE_ALIASES = {
-      bug_fix: "debugging",
-      feature: "feature_implementation",
-      refactor: "refactoring",
-      config: "configuration"
-    };
-    COMPLEXITIES = {
-      simple: {
-        label: "Simple",
-        description: "Straightforward task with few steps"
-      },
-      moderate: {
-        label: "Moderate",
-        description: "Multi-step task requiring some investigation"
-      },
-      complex: {
-        label: "Complex",
-        description: "Involved task with many steps or deep analysis"
-      }
-    };
-    ARTIFACT_TYPES = {
-      report_incident: {
-        category: "report",
-        label: "Incident Report",
-        description: "Production-incident record + post-incident writeup: detection, timeline, root cause, resolution, follow-ups.",
-        icon: "AlertTriangle",
-        aliases: ["incident_summary", "incident", "postmortem", "post-mortem"],
-        autoApproved: false,
-        producedBy: [
-          "POST /api/v1/memory/processes/incidents",
-          "POST /api/v1/memory/reports/incident",
-          "POST /api/v1/memory/processes/incidents/:id/postmortem"
-        ]
-      },
-      report_decision: {
-        category: "report",
-        label: "Decision Record",
-        description: "Architectural / product decision record with context, options considered, decision, and rationale.",
-        icon: "Scale",
-        aliases: ["decision_record", "decision-record", "adr"],
-        autoApproved: false,
-        producedBy: ["POST /api/v1/memory"]
-      },
-      report_work: {
-        category: "report",
-        label: "Work Report",
-        description: "Periodic or one-off work-progress report \u2014 status updates, weekly digests, project rollups, team-activity summaries.",
-        icon: "CalendarDays",
-        aliases: ["weekly_digest", "weekly-digest", "status_report"],
-        autoApproved: true,
-        producedBy: ["POST /api/v1/memory", "POST /api/v1/memory/reports/work"]
-      },
-      report_sop: {
-        category: "report",
-        label: "Standard Operating Procedure",
-        description: "Reusable step-by-step procedure or runbook. Placeholder \u2014 surface not yet specialized; written via generic POST /memory until a dedicated producer ships.",
-        icon: "FileText",
-        aliases: ["sop", "runbook"],
-        autoApproved: false,
-        producedBy: ["POST /api/v1/memory"]
-      },
-      report_onboarding: {
-        category: "report",
-        label: "Onboarding Packet",
-        description: "Onboarding guide assembled from team knowledge, scoped to a project or role.",
-        icon: "GraduationCap",
-        aliases: ["onboarding_packet", "onboarding-packet"],
-        autoApproved: false,
-        producedBy: ["POST /api/v1/memory/reports/onboarding"]
-      },
-      report_pr: {
-        category: "report",
-        label: "PR Context",
-        description: "Enriched pull-request description with linked Jira/Slack context, recent decisions, and reviewer hints.",
-        icon: "GitPullRequest",
-        aliases: ["pr_context", "pr-context"],
-        autoApproved: true,
-        producedBy: ["POST /api/v1/memory/reports/pr"]
-      },
-      expert: {
-        category: "expert",
-        label: "Expert Profile",
-        description: "Per-person expertise profile across platforms \u2014 areas of focus, recent contributions, identity links.",
-        icon: "Users",
-        aliases: ["expert_profile", "expert-profile"],
-        autoApproved: false,
-        producedBy: ["POST /api/v1/memory/experts"]
-      },
-      solution_mined: {
-        category: "solution",
-        label: "Mined Solution",
-        description: "Problem + solution mined automatically from a developer coding session (the distilled-path pipeline).",
-        icon: "Lightbulb",
-        aliases: ["solution", "mined_solution", "distilled_path"],
-        autoApproved: true,
-        producedBy: ["POST /api/v1/memory/solutions/mined"]
-      },
-      solution_qna: {
-        category: "solution",
-        label: "Q&A Solution",
-        description: "Q&A answer marked verified by a user and distilled into reusable knowledge \u2014 promoted out of a conversation thread.",
-        icon: "ThumbsUp",
-        aliases: ["verified_answer", "verified-answer"],
-        autoApproved: true,
-        producedBy: ["POST /api/v1/memory/recall/messages/:id/feedback"]
-      }
-    };
-    __seenAliases = /* @__PURE__ */ new Set();
-    for (const [id, meta3] of Object.entries(ARTIFACT_TYPES)) {
-      for (const a of meta3.aliases) {
-        if (__seenAliases.has(a)) {
-          throw new Error(
-            `[taxonomy] alias "${a}" declared on multiple artifact types; last seen on "${id}"`
-          );
-        }
-        __seenAliases.add(a);
-      }
-    }
-    ALIAS_REVERSE_MAP = Object.freeze(
-      Object.fromEntries(
-        Object.entries(ARTIFACT_TYPES).flatMap(
-          ([id, meta3]) => meta3.aliases.map((a) => [a, id])
-        )
-      )
-    );
-    ARTIFACT_TYPE_IDS = Object.keys(
-      ARTIFACT_TYPES
-    );
-    AUTO_APPROVED_ARTIFACT_TYPES = ARTIFACT_TYPE_IDS.filter((id) => ARTIFACT_TYPES[id].autoApproved);
-  }
-});
-
-// ../../packages/@company/types/src/embedding.ts
-var EMBEDDING_DEFAULTS, EMBEDDING_COLUMN, SUMMARY_EMBEDDING_COLUMN;
-var init_embedding = __esm({
-  "../../packages/@company/types/src/embedding.ts"() {
-    "use strict";
-    EMBEDDING_DEFAULTS = {
-      // `as const` gives a literal string type for the provider field, which
-      // is assignable to llm-client's LLMProvider union without forcing
-      // @company/types to import that union (which would re-introduce the
-      // dependency edge we want to keep absent).
-      // CUTOVER (2026-07-17): in-house model is now the active config. Reads +
-      // writes + backfills all target the local-768 columns. The old OpenAI 1536
-      // columns (`embedding` / `summary_embedding`) are retained but dormant —
-      // roll back by flipping this whole object back to
-      //   { provider:"openai", model:"text-embedding-3-small", dimensions:1536,
-      //     column:"embedding", summaryColumn:"summary_embedding" }
-      // (a later contract migration drops the dormant columns). Readers alias
-      // `<column> AS embedding` so result-row field names stay stable.
-      provider: "local",
-      model: "Alibaba-NLP/gte-base-en-v1.5",
-      dimensions: 768,
-      // The ACTIVE dense-vector column that every reader + writer + backfill targets.
-      column: "embedding_v2",
-      // The active summary-embedding column (process_registry's second vector,
-      // used by the process matcher).
-      summaryColumn: "summary_embedding_v2"
-    };
-    EMBEDDING_COLUMN = EMBEDDING_DEFAULTS.column;
-    SUMMARY_EMBEDDING_COLUMN = EMBEDDING_DEFAULTS.summaryColumn;
-  }
-});
-
-// ../../packages/@company/types/src/index.ts
-var init_src7 = __esm({
-  "../../packages/@company/types/src/index.ts"() {
-    init_timeline();
-    init_artifact();
-    init_taxonomy();
-    init_embedding();
-  }
-});
-
 // ../../node_modules/zod/v3/helpers/util.js
 var util, objectUtil, ZodParsedType, getParsedType;
 var init_util = __esm({
@@ -25651,8 +26029,8 @@ var init_parseUtil = __esm({
     init_errors();
     init_en();
     makeIssue = (params) => {
-      const { data, path: path3, errorMaps, issueData } = params;
-      const fullPath = [...path3, ...issueData.path || []];
+      const { data, path: path2, errorMaps, issueData } = params;
+      const fullPath = [...path2, ...issueData.path || []];
       const fullIssue = {
         ...issueData,
         path: fullPath
@@ -25932,11 +26310,11 @@ var init_types3 = __esm({
     init_parseUtil();
     init_util();
     ParseInputLazyPath = class {
-      constructor(parent, value, path3, key) {
+      constructor(parent, value, path2, key) {
         this._cachedPath = [];
         this.parent = parent;
         this.data = value;
-        this._path = path3;
+        this._path = path2;
         this._key = key;
       }
       get path() {
@@ -29442,10 +29820,10 @@ function mergeDefs(...defs) {
 function cloneDef(schema) {
   return mergeDefs(schema._zod.def);
 }
-function getElementAtPath(obj, path3) {
-  if (!path3)
+function getElementAtPath(obj, path2) {
+  if (!path2)
     return obj;
-  return path3.reduce((acc, key) => acc?.[key], obj);
+  return path2.reduce((acc, key) => acc?.[key], obj);
 }
 function promiseAllObject(promisesObj) {
   const keys = Object.keys(promisesObj);
@@ -29757,11 +30135,11 @@ function aborted(x, startIndex = 0) {
   }
   return false;
 }
-function prefixIssues(path3, issues) {
+function prefixIssues(path2, issues) {
   return issues.map((iss) => {
     var _a2;
     (_a2 = iss).path ?? (_a2.path = []);
-    iss.path.unshift(path3);
+    iss.path.unshift(path2);
     return iss;
   });
 }
@@ -44251,8 +44629,8 @@ var require_utils5 = __commonJS({
       }
       return ind;
     }
-    function removeDotSegments(path3) {
-      let input = path3;
+    function removeDotSegments(path2) {
+      let input = path2;
       const output = [];
       let nextSlash = -1;
       let len = 0;
@@ -44451,8 +44829,8 @@ var require_schemes = __commonJS({
         wsComponent.secure = void 0;
       }
       if (wsComponent.resourceName) {
-        const [path3, query] = wsComponent.resourceName.split("?");
-        wsComponent.path = path3 && path3 !== "/" ? path3 : void 0;
+        const [path2, query] = wsComponent.resourceName.split("?");
+        wsComponent.path = path2 && path2 !== "/" ? path2 : void 0;
         wsComponent.query = query;
         wsComponent.resourceName = void 0;
       }
@@ -45393,13 +45771,13 @@ var require_core = __commonJS({
     }, warn() {
     }, error() {
     } };
-    function getLogger(logger5) {
-      if (logger5 === false)
+    function getLogger(logger7) {
+      if (logger7 === false)
         return noLogs;
-      if (logger5 === void 0)
+      if (logger7 === void 0)
         return console;
-      if (logger5.log && logger5.warn && logger5.error)
-        return logger5;
+      if (logger7.log && logger7.warn && logger7.error)
+        return logger7;
       throw new Error("logger must implement log, warn and error methods");
     }
     var KEYWORD_NAME = /^[a-z_$][a-z0-9_$:-]*$/i;
@@ -51291,13 +51669,13 @@ var require_core3 = __commonJS({
     }, warn() {
     }, error() {
     } };
-    function getLogger(logger5) {
-      if (logger5 === false)
+    function getLogger(logger7) {
+      if (logger7 === false)
         return noLogs;
-      if (logger5 === void 0)
+      if (logger7 === void 0)
         return console;
-      if (logger5.log && logger5.warn && logger5.error)
-        return logger5;
+      if (logger7.log && logger7.warn && logger7.error)
+        return logger7;
       throw new Error("logger must implement log, warn and error methods");
     }
     var KEYWORD_NAME = /^[a-z_$][a-z0-9_$:-]*$/i;
@@ -69619,11 +69997,11 @@ var require_mime_types = __commonJS({
       }
       return exts[0];
     }
-    function lookup(path3) {
-      if (!path3 || typeof path3 !== "string") {
+    function lookup(path2) {
+      if (!path2 || typeof path2 !== "string") {
         return false;
       }
-      var extension2 = extname("x." + path3).toLowerCase().slice(1);
+      var extension2 = extname("x." + path2).toLowerCase().slice(1);
       if (!extension2) {
         return false;
       }
@@ -73061,13 +73439,13 @@ var require_view = __commonJS({
   "../service-capture/node_modules/express/lib/view.js"(exports2, module2) {
     "use strict";
     var debug = require_src()("express:view");
-    var path3 = require("node:path");
+    var path2 = require("node:path");
     var fs = require("node:fs");
-    var dirname3 = path3.dirname;
-    var basename4 = path3.basename;
-    var extname = path3.extname;
-    var join15 = path3.join;
-    var resolve4 = path3.resolve;
+    var dirname3 = path2.dirname;
+    var basename4 = path2.basename;
+    var extname = path2.extname;
+    var join14 = path2.join;
+    var resolve4 = path2.resolve;
     module2.exports = View;
     function View(name, options) {
       var opts = options || {};
@@ -73096,17 +73474,17 @@ var require_view = __commonJS({
       this.path = this.lookup(fileName);
     }
     View.prototype.lookup = function lookup(name) {
-      var path4;
+      var path3;
       var roots = [].concat(this.root);
       debug('lookup "%s"', name);
-      for (var i = 0; i < roots.length && !path4; i++) {
+      for (var i = 0; i < roots.length && !path3; i++) {
         var root = roots[i];
         var loc = resolve4(root, name);
         var dir = dirname3(loc);
         var file2 = basename4(loc);
-        path4 = this.resolve(dir, file2);
+        path3 = this.resolve(dir, file2);
       }
-      return path4;
+      return path3;
     };
     View.prototype.render = function render(options, callback) {
       var sync = true;
@@ -73128,21 +73506,21 @@ var require_view = __commonJS({
     };
     View.prototype.resolve = function resolve5(dir, file2) {
       var ext = this.ext;
-      var path4 = join15(dir, file2);
-      var stat = tryStat(path4);
+      var path3 = join14(dir, file2);
+      var stat = tryStat(path3);
       if (stat && stat.isFile()) {
-        return path4;
+        return path3;
       }
-      path4 = join15(dir, basename4(file2, ext), "index" + ext);
-      stat = tryStat(path4);
+      path3 = join14(dir, basename4(file2, ext), "index" + ext);
+      stat = tryStat(path3);
       if (stat && stat.isFile()) {
-        return path4;
+        return path3;
       }
     };
-    function tryStat(path4) {
-      debug('stat "%s"', path4);
+    function tryStat(path3) {
+      debug('stat "%s"', path3);
       try {
-        return fs.statSync(path4);
+        return fs.statSync(path3);
       } catch (e) {
         return void 0;
       }
@@ -74340,15 +74718,15 @@ var require_dist3 = __commonJS({
           if (token.type === endType)
             break;
           if (token.type === "char" || token.type === "escape") {
-            let path3 = token.value;
+            let path2 = token.value;
             let cur = tokens[pos];
             while (cur.type === "char" || cur.type === "escape") {
-              path3 += cur.value;
+              path2 += cur.value;
               cur = tokens[++pos];
             }
             output.push({
               type: "text",
-              value: encodePath(path3)
+              value: encodePath(path2)
             });
             continue;
           }
@@ -74372,16 +74750,16 @@ var require_dist3 = __commonJS({
       }
       return new TokenData(consumeUntil("end"), str);
     }
-    function compile(path3, options = {}) {
+    function compile(path2, options = {}) {
       const { encode: encode3 = encodeURIComponent, delimiter = DEFAULT_DELIMITER } = options;
-      const data = typeof path3 === "object" ? path3 : parse4(path3, options);
+      const data = typeof path2 === "object" ? path2 : parse4(path2, options);
       const fn = tokensToFunction(data.tokens, delimiter, encode3);
-      return function path4(params = {}) {
-        const [path5, ...missing] = fn(params);
+      return function path3(params = {}) {
+        const [path4, ...missing] = fn(params);
         if (missing.length) {
           throw new TypeError(`Missing parameters: ${missing.join(", ")}`);
         }
-        return path5;
+        return path4;
       };
     }
     function tokensToFunction(tokens, delimiter, encode3) {
@@ -74437,9 +74815,9 @@ var require_dist3 = __commonJS({
         return [encodeValue(value)];
       };
     }
-    function match(path3, options = {}) {
+    function match(path2, options = {}) {
       const { decode: decode3 = decodeURIComponent, delimiter = DEFAULT_DELIMITER } = options;
-      const { regexp, keys } = pathToRegexp(path3, options);
+      const { regexp, keys } = pathToRegexp(path2, options);
       const decoders = keys.map((key) => {
         if (decode3 === false)
           return NOOP_VALUE;
@@ -74451,7 +74829,7 @@ var require_dist3 = __commonJS({
         const m = regexp.exec(input);
         if (!m)
           return false;
-        const path4 = m[0];
+        const path3 = m[0];
         const params = /* @__PURE__ */ Object.create(null);
         for (let i = 1; i < m.length; i++) {
           if (m[i] === void 0)
@@ -74460,15 +74838,15 @@ var require_dist3 = __commonJS({
           const decoder = decoders[i - 1];
           params[key.name] = decoder(m[i]);
         }
-        return { path: path4, params };
+        return { path: path3, params };
       };
     }
-    function pathToRegexp(path3, options = {}) {
+    function pathToRegexp(path2, options = {}) {
       const { delimiter = DEFAULT_DELIMITER, end = true, sensitive = false, trailing = true } = options;
       const keys = [];
       const flags = sensitive ? "" : "i";
       const sources = [];
-      for (const input of pathsToArray(path3, [])) {
+      for (const input of pathsToArray(path2, [])) {
         const data = typeof input === "object" ? input : parse4(input, options);
         for (const tokens of flatten(data.tokens, 0, [])) {
           sources.push(toRegExpSource(tokens, delimiter, keys, data.originalPath));
@@ -74598,18 +74976,18 @@ var require_layer = __commonJS({
     var TRAILING_SLASH_REGEXP = /\/+$/;
     var MATCHING_GROUP_REGEXP = /\((?:\?<(.*?)>)?(?!\?)/g;
     module2.exports = Layer;
-    function Layer(path3, options, fn) {
+    function Layer(path2, options, fn) {
       if (!(this instanceof Layer)) {
-        return new Layer(path3, options, fn);
+        return new Layer(path2, options, fn);
       }
-      debug("new %o", path3);
+      debug("new %o", path2);
       const opts = options || {};
       this.handle = fn;
       this.keys = [];
       this.name = fn.name || "<anonymous>";
       this.params = void 0;
       this.path = void 0;
-      this.slash = path3 === "/" && opts.end === false;
+      this.slash = path2 === "/" && opts.end === false;
       function matcher(_path) {
         if (_path instanceof RegExp) {
           const keys = [];
@@ -74648,7 +75026,7 @@ var require_layer = __commonJS({
           decode: decodeParam
         });
       }
-      this.matchers = Array.isArray(path3) ? path3.map(matcher) : [matcher(path3)];
+      this.matchers = Array.isArray(path2) ? path2.map(matcher) : [matcher(path2)];
     }
     Layer.prototype.handleError = function handleError(error2, req, res, next) {
       const fn = this.handle;
@@ -74688,9 +75066,9 @@ var require_layer = __commonJS({
         next(err);
       }
     };
-    Layer.prototype.match = function match(path3) {
+    Layer.prototype.match = function match(path2) {
       let match2;
-      if (path3 != null) {
+      if (path2 != null) {
         if (this.slash) {
           this.params = {};
           this.path = "";
@@ -74698,7 +75076,7 @@ var require_layer = __commonJS({
         }
         let i = 0;
         while (!match2 && i < this.matchers.length) {
-          match2 = this.matchers[i](path3);
+          match2 = this.matchers[i](path2);
           i++;
         }
       }
@@ -74726,13 +75104,13 @@ var require_layer = __commonJS({
         throw err;
       }
     }
-    function loosen(path3) {
-      if (path3 instanceof RegExp || path3 === "/") {
-        return path3;
+    function loosen(path2) {
+      if (path2 instanceof RegExp || path2 === "/") {
+        return path2;
       }
-      return Array.isArray(path3) ? path3.map(function(p) {
+      return Array.isArray(path2) ? path2.map(function(p) {
         return loosen(p);
-      }) : String(path3).replace(TRAILING_SLASH_REGEXP, "");
+      }) : String(path2).replace(TRAILING_SLASH_REGEXP, "");
     }
   }
 });
@@ -74748,9 +75126,9 @@ var require_route = __commonJS({
     var flatten = Array.prototype.flat;
     var methods = METHODS.map((method) => method.toLowerCase());
     module2.exports = Route;
-    function Route(path3) {
-      debug("new %o", path3);
-      this.path = path3;
+    function Route(path2) {
+      debug("new %o", path2);
+      this.path = path2;
       this.stack = [];
       this.methods = /* @__PURE__ */ Object.create(null);
     }
@@ -74958,8 +75336,8 @@ var require_router = __commonJS({
         if (++sync > 100) {
           return setImmediate(next, err);
         }
-        const path3 = getPathname(req);
-        if (path3 == null) {
+        const path2 = getPathname(req);
+        if (path2 == null) {
           return done(layerError);
         }
         let layer;
@@ -74967,7 +75345,7 @@ var require_router = __commonJS({
         let route;
         while (match !== true && idx < stack.length) {
           layer = stack[idx++];
-          match = matchLayer(layer, path3);
+          match = matchLayer(layer, path2);
           route = layer.route;
           if (typeof match !== "boolean") {
             layerError = layerError || match;
@@ -75005,18 +75383,18 @@ var require_router = __commonJS({
           } else if (route) {
             layer.handleRequest(req, res, next);
           } else {
-            trimPrefix(layer, layerError, layerPath, path3);
+            trimPrefix(layer, layerError, layerPath, path2);
           }
           sync = 0;
         });
       }
-      function trimPrefix(layer, layerError, layerPath, path3) {
+      function trimPrefix(layer, layerError, layerPath, path2) {
         if (layerPath.length !== 0) {
-          if (layerPath !== path3.substring(0, layerPath.length)) {
+          if (layerPath !== path2.substring(0, layerPath.length)) {
             next(layerError);
             return;
           }
-          const c = path3[layerPath.length];
+          const c = path2[layerPath.length];
           if (c && c !== "/") {
             next(layerError);
             return;
@@ -75040,7 +75418,7 @@ var require_router = __commonJS({
     };
     Router.prototype.use = function use(handler) {
       let offset = 0;
-      let path3 = "/";
+      let path2 = "/";
       if (typeof handler !== "function") {
         let arg = handler;
         while (Array.isArray(arg) && arg.length !== 0) {
@@ -75048,7 +75426,7 @@ var require_router = __commonJS({
         }
         if (typeof arg !== "function") {
           offset = 1;
-          path3 = handler;
+          path2 = handler;
         }
       }
       const callbacks = flatten.call(slice.call(arguments, offset), Infinity);
@@ -75060,8 +75438,8 @@ var require_router = __commonJS({
         if (typeof fn !== "function") {
           throw new TypeError("argument handler must be a function");
         }
-        debug("use %o %s", path3, fn.name || "<anonymous>");
-        const layer = new Layer(path3, {
+        debug("use %o %s", path2, fn.name || "<anonymous>");
+        const layer = new Layer(path2, {
           sensitive: this.caseSensitive,
           strict: false,
           end: false
@@ -75071,9 +75449,9 @@ var require_router = __commonJS({
       }
       return this;
     };
-    Router.prototype.route = function route(path3) {
-      const route2 = new Route(path3);
-      const layer = new Layer(path3, {
+    Router.prototype.route = function route(path2) {
+      const route2 = new Route(path2);
+      const layer = new Layer(path2, {
         sensitive: this.caseSensitive,
         strict: this.strict,
         end: true
@@ -75086,8 +75464,8 @@ var require_router = __commonJS({
       return route2;
     };
     methods.concat("all").forEach(function(method) {
-      Router.prototype[method] = function(path3) {
-        const route = this.route(path3);
+      Router.prototype[method] = function(path2) {
+        const route = this.route(path2);
         route[method].apply(route, slice.call(arguments, 1));
         return this;
       };
@@ -75116,9 +75494,9 @@ var require_router = __commonJS({
       const fqdnIndex = url2.substring(0, pathLength).indexOf("://");
       return fqdnIndex !== -1 ? url2.substring(0, url2.indexOf("/", 3 + fqdnIndex)) : void 0;
     }
-    function matchLayer(layer, path3) {
+    function matchLayer(layer, path2) {
       try {
-        return layer.match(path3);
+        return layer.match(path2);
       } catch (err) {
         return err;
       }
@@ -75346,7 +75724,7 @@ var require_application = __commonJS({
     };
     app.use = function use(fn) {
       var offset = 0;
-      var path3 = "/";
+      var path2 = "/";
       if (typeof fn !== "function") {
         var arg = fn;
         while (Array.isArray(arg) && arg.length !== 0) {
@@ -75354,7 +75732,7 @@ var require_application = __commonJS({
         }
         if (typeof arg !== "function") {
           offset = 1;
-          path3 = fn;
+          path2 = fn;
         }
       }
       var fns = flatten.call(slice.call(arguments, offset), Infinity);
@@ -75364,12 +75742,12 @@ var require_application = __commonJS({
       var router = this.router;
       fns.forEach(function(fn2) {
         if (!fn2 || !fn2.handle || !fn2.set) {
-          return router.use(path3, fn2);
+          return router.use(path2, fn2);
         }
-        debug(".use app under %s", path3);
-        fn2.mountpath = path3;
+        debug(".use app under %s", path2);
+        fn2.mountpath = path2;
         fn2.parent = this;
-        router.use(path3, function mounted_app(req, res, next) {
+        router.use(path2, function mounted_app(req, res, next) {
           var orig = req.app;
           fn2.handle(req, res, function(err) {
             Object.setPrototypeOf(req, orig.request);
@@ -75381,8 +75759,8 @@ var require_application = __commonJS({
       }, this);
       return this;
     };
-    app.route = function route(path3) {
-      return this.router.route(path3);
+    app.route = function route(path2) {
+      return this.router.route(path2);
     };
     app.engine = function engine(ext, fn) {
       if (typeof fn !== "function") {
@@ -75425,7 +75803,7 @@ var require_application = __commonJS({
       }
       return this;
     };
-    app.path = function path3() {
+    app.path = function path2() {
       return this.parent ? this.parent.path() + this.mountpath : "";
     };
     app.enabled = function enabled(setting) {
@@ -75441,17 +75819,17 @@ var require_application = __commonJS({
       return this.set(setting, false);
     };
     methods.forEach(function(method) {
-      app[method] = function(path3) {
+      app[method] = function(path2) {
         if (method === "get" && arguments.length === 1) {
-          return this.set(path3);
+          return this.set(path2);
         }
-        var route = this.route(path3);
+        var route = this.route(path2);
         route[method].apply(route, slice.call(arguments, 1));
         return this;
       };
     });
-    app.all = function all(path3) {
-      var route = this.route(path3);
+    app.all = function all(path2) {
+      var route = this.route(path2);
       var args = slice.call(arguments, 1);
       for (var i = 0; i < methods.length; i++) {
         route[methods[i]].apply(route, args);
@@ -76361,7 +76739,7 @@ var require_request = __commonJS({
       var subdomains2 = !isIP(hostname3) ? hostname3.split(".").reverse() : [hostname3];
       return subdomains2.slice(offset);
     });
-    defineGetter(req, "path", function path3() {
+    defineGetter(req, "path", function path2() {
       return parse4(this).pathname;
     });
     defineGetter(req, "host", function host() {
@@ -76773,27 +77151,27 @@ var require_send = __commonJS({
     var ms = require_ms();
     var onFinished = require_on_finished();
     var parseRange = require_range_parser();
-    var path3 = require("path");
+    var path2 = require("path");
     var statuses = require_statuses();
     var Stream = require("stream");
     var util2 = require("util");
-    var extname = path3.extname;
-    var join15 = path3.join;
-    var normalize = path3.normalize;
-    var resolve4 = path3.resolve;
-    var sep = path3.sep;
+    var extname = path2.extname;
+    var join14 = path2.join;
+    var normalize = path2.normalize;
+    var resolve4 = path2.resolve;
+    var sep = path2.sep;
     var BYTES_RANGE_REGEXP = /^ *bytes=/;
     var MAX_MAXAGE = 60 * 60 * 24 * 365 * 1e3;
     var UP_PATH_REGEXP = /(?:^|[\\/])\.\.(?:[\\/]|$)/;
     module2.exports = send;
-    function send(req, path4, options) {
-      return new SendStream(req, path4, options);
+    function send(req, path3, options) {
+      return new SendStream(req, path3, options);
     }
-    function SendStream(req, path4, options) {
+    function SendStream(req, path3, options) {
       Stream.call(this);
       var opts = options || {};
       this.options = opts;
-      this.path = path4;
+      this.path = path3;
       this.req = req;
       this._acceptRanges = opts.acceptRanges !== void 0 ? Boolean(opts.acceptRanges) : true;
       this._cacheControl = opts.cacheControl !== void 0 ? Boolean(opts.cacheControl) : true;
@@ -76907,10 +77285,10 @@ var require_send = __commonJS({
       var lastModified = this.res.getHeader("Last-Modified");
       return parseHttpDate(lastModified) <= parseHttpDate(ifRange);
     };
-    SendStream.prototype.redirect = function redirect(path4) {
+    SendStream.prototype.redirect = function redirect(path3) {
       var res = this.res;
       if (hasListeners(this, "directory")) {
-        this.emit("directory", res, path4);
+        this.emit("directory", res, path3);
         return;
       }
       if (this.hasTrailingSlash()) {
@@ -76930,38 +77308,38 @@ var require_send = __commonJS({
     SendStream.prototype.pipe = function pipe2(res) {
       var root = this._root;
       this.res = res;
-      var path4 = decode3(this.path);
-      if (path4 === -1) {
+      var path3 = decode3(this.path);
+      if (path3 === -1) {
         this.error(400);
         return res;
       }
-      if (~path4.indexOf("\0")) {
+      if (~path3.indexOf("\0")) {
         this.error(400);
         return res;
       }
       var parts;
       if (root !== null) {
-        if (path4) {
-          path4 = normalize("." + sep + path4);
+        if (path3) {
+          path3 = normalize("." + sep + path3);
         }
-        if (UP_PATH_REGEXP.test(path4)) {
-          debug('malicious path "%s"', path4);
+        if (UP_PATH_REGEXP.test(path3)) {
+          debug('malicious path "%s"', path3);
           this.error(403);
           return res;
         }
-        parts = path4.split(sep);
-        path4 = normalize(join15(root, path4));
+        parts = path3.split(sep);
+        path3 = normalize(join14(root, path3));
       } else {
-        if (UP_PATH_REGEXP.test(path4)) {
-          debug('malicious path "%s"', path4);
+        if (UP_PATH_REGEXP.test(path3)) {
+          debug('malicious path "%s"', path3);
           this.error(403);
           return res;
         }
-        parts = normalize(path4).split(sep);
-        path4 = resolve4(path4);
+        parts = normalize(path3).split(sep);
+        path3 = resolve4(path3);
       }
       if (containsDotFile(parts)) {
-        debug('%s dotfile "%s"', this._dotfiles, path4);
+        debug('%s dotfile "%s"', this._dotfiles, path3);
         switch (this._dotfiles) {
           case "allow":
             break;
@@ -76975,13 +77353,13 @@ var require_send = __commonJS({
         }
       }
       if (this._index.length && this.hasTrailingSlash()) {
-        this.sendIndex(path4);
+        this.sendIndex(path3);
         return res;
       }
-      this.sendFile(path4);
+      this.sendFile(path3);
       return res;
     };
-    SendStream.prototype.send = function send2(path4, stat) {
+    SendStream.prototype.send = function send2(path3, stat) {
       var len = stat.size;
       var options = this.options;
       var opts = {};
@@ -76993,9 +77371,9 @@ var require_send = __commonJS({
         this.headersAlreadySent();
         return;
       }
-      debug('pipe "%s"', path4);
-      this.setHeader(path4, stat);
-      this.type(path4);
+      debug('pipe "%s"', path3);
+      this.setHeader(path3, stat);
+      this.type(path3);
       if (this.isConditionalGET()) {
         if (this.isPreconditionFailure()) {
           this.error(412);
@@ -77044,28 +77422,28 @@ var require_send = __commonJS({
         res.end();
         return;
       }
-      this.stream(path4, opts);
+      this.stream(path3, opts);
     };
-    SendStream.prototype.sendFile = function sendFile(path4) {
+    SendStream.prototype.sendFile = function sendFile(path3) {
       var i = 0;
       var self = this;
-      debug('stat "%s"', path4);
-      fs.stat(path4, function onstat(err, stat) {
-        var pathEndsWithSep = path4[path4.length - 1] === sep;
-        if (err && err.code === "ENOENT" && !extname(path4) && !pathEndsWithSep) {
+      debug('stat "%s"', path3);
+      fs.stat(path3, function onstat(err, stat) {
+        var pathEndsWithSep = path3[path3.length - 1] === sep;
+        if (err && err.code === "ENOENT" && !extname(path3) && !pathEndsWithSep) {
           return next(err);
         }
         if (err) return self.onStatError(err);
-        if (stat.isDirectory()) return self.redirect(path4);
+        if (stat.isDirectory()) return self.redirect(path3);
         if (pathEndsWithSep) return self.error(404);
-        self.emit("file", path4, stat);
-        self.send(path4, stat);
+        self.emit("file", path3, stat);
+        self.send(path3, stat);
       });
       function next(err) {
         if (self._extensions.length <= i) {
           return err ? self.onStatError(err) : self.error(404);
         }
-        var p = path4 + "." + self._extensions[i++];
+        var p = path3 + "." + self._extensions[i++];
         debug('stat "%s"', p);
         fs.stat(p, function(err2, stat) {
           if (err2) return next(err2);
@@ -77075,7 +77453,7 @@ var require_send = __commonJS({
         });
       }
     };
-    SendStream.prototype.sendIndex = function sendIndex(path4) {
+    SendStream.prototype.sendIndex = function sendIndex(path3) {
       var i = -1;
       var self = this;
       function next(err) {
@@ -77083,7 +77461,7 @@ var require_send = __commonJS({
           if (err) return self.onStatError(err);
           return self.error(404);
         }
-        var p = join15(path4, self._index[i]);
+        var p = join14(path3, self._index[i]);
         debug('stat "%s"', p);
         fs.stat(p, function(err2, stat) {
           if (err2) return next(err2);
@@ -77094,10 +77472,10 @@ var require_send = __commonJS({
       }
       next();
     };
-    SendStream.prototype.stream = function stream(path4, options) {
+    SendStream.prototype.stream = function stream(path3, options) {
       var self = this;
       var res = this.res;
-      var stream2 = fs.createReadStream(path4, options);
+      var stream2 = fs.createReadStream(path3, options);
       this.emit("stream", stream2);
       stream2.pipe(res);
       function cleanup() {
@@ -77112,17 +77490,17 @@ var require_send = __commonJS({
         self.emit("end");
       });
     };
-    SendStream.prototype.type = function type(path4) {
+    SendStream.prototype.type = function type(path3) {
       var res = this.res;
       if (res.getHeader("Content-Type")) return;
-      var ext = extname(path4);
+      var ext = extname(path3);
       var type2 = mime.contentType(ext) || "application/octet-stream";
       debug("content-type %s", type2);
       res.setHeader("Content-Type", type2);
     };
-    SendStream.prototype.setHeader = function setHeader(path4, stat) {
+    SendStream.prototype.setHeader = function setHeader(path3, stat) {
       var res = this.res;
-      this.emit("headers", res, path4, stat);
+      this.emit("headers", res, path3, stat);
       if (this._acceptRanges && !res.getHeader("Accept-Ranges")) {
         debug("accept ranges");
         res.setHeader("Accept-Ranges", "bytes");
@@ -77180,9 +77558,9 @@ var require_send = __commonJS({
       }
       return err instanceof Error ? createError(status, err, { expose: false }) : createError(status, err);
     }
-    function decode3(path4) {
+    function decode3(path3) {
       try {
-        return decodeURIComponent(path4);
+        return decodeURIComponent(path3);
       } catch (err) {
         return -1;
       }
@@ -77326,7 +77704,7 @@ var require_response = __commonJS({
     var http = require("node:http");
     var onFinished = require_on_finished();
     var mime = require_mime_types();
-    var path3 = require("node:path");
+    var path2 = require("node:path");
     var pathIsAbsolute = require("node:path").isAbsolute;
     var statuses = require_statuses();
     var sign = require_cookie_signature().sign;
@@ -77335,8 +77713,8 @@ var require_response = __commonJS({
     var setCharset = require_utils8().setCharset;
     var cookie = require_cookie();
     var send = require_send();
-    var extname = path3.extname;
-    var resolve4 = path3.resolve;
+    var extname = path2.extname;
+    var resolve4 = path2.resolve;
     var vary = require_vary();
     var { Buffer: Buffer2 } = require("node:buffer");
     var res = Object.create(http.ServerResponse.prototype);
@@ -77482,26 +77860,26 @@ var require_response = __commonJS({
       this.type("txt");
       return this.send(body);
     };
-    res.sendFile = function sendFile(path4, options, callback) {
+    res.sendFile = function sendFile(path3, options, callback) {
       var done = callback;
       var req = this.req;
       var res2 = this;
       var next = req.next;
       var opts = options || {};
-      if (!path4) {
+      if (!path3) {
         throw new TypeError("path argument is required to res.sendFile");
       }
-      if (typeof path4 !== "string") {
+      if (typeof path3 !== "string") {
         throw new TypeError("path must be a string to res.sendFile");
       }
       if (typeof options === "function") {
         done = options;
         opts = {};
       }
-      if (!opts.root && !pathIsAbsolute(path4)) {
+      if (!opts.root && !pathIsAbsolute(path3)) {
         throw new TypeError("path must be absolute or specify root to res.sendFile");
       }
-      var pathname = encodeURI(path4);
+      var pathname = encodeURI(path3);
       opts.etag = this.app.enabled("etag");
       var file2 = send(req, pathname, opts);
       sendfile(res2, file2, opts, function(err) {
@@ -77512,7 +77890,7 @@ var require_response = __commonJS({
         }
       });
     };
-    res.download = function download(path4, filename, options, callback) {
+    res.download = function download(path3, filename, options, callback) {
       var done = callback;
       var name = filename;
       var opts = options || null;
@@ -77529,7 +77907,7 @@ var require_response = __commonJS({
         opts = filename;
       }
       var headers = {
-        "Content-Disposition": contentDisposition(name || path4)
+        "Content-Disposition": contentDisposition(name || path3)
       };
       if (opts && opts.headers) {
         var keys = Object.keys(opts.headers);
@@ -77542,7 +77920,7 @@ var require_response = __commonJS({
       }
       opts = Object.create(opts);
       opts.headers = headers;
-      var fullPath = !opts.root ? resolve4(path4) : path4;
+      var fullPath = !opts.root ? resolve4(path3) : path3;
       return this.sendFile(fullPath, opts, done);
     };
     res.contentType = res.type = function contentType(type) {
@@ -77825,11 +78203,11 @@ var require_serve_static = __commonJS({
         }
         var forwardError = !fallthrough;
         var originalUrl = parseUrl.original(req);
-        var path3 = parseUrl(req).pathname;
-        if (path3 === "/" && originalUrl.pathname.substr(-1) !== "/") {
-          path3 = "";
+        var path2 = parseUrl(req).pathname;
+        if (path2 === "/" && originalUrl.pathname.substr(-1) !== "/") {
+          path2 = "";
         }
-        var stream = send(req, path3, opts);
+        var stream = send(req, path2, opts);
         stream.on("directory", onDirectory);
         if (setHeaders) {
           stream.on("headers", setHeaders);
@@ -79204,12 +79582,12 @@ function maybeCollect() {
     triggerCollectInBackground();
   }
 }
-async function apiGet2(path3, options) {
+async function apiGet2(path2, options) {
   const headers = {
     Authorization: `Bearer ${TOKEN}`,
     ...options?.extraHeaders
   };
-  const response = await fetchWithTimeout(`${API_URL}/api/v1${path3}`, {
+  const response = await fetchWithTimeout(`${API_URL}/api/v1${path2}`, {
     headers
   });
   if (!response.ok) {
@@ -79218,13 +79596,13 @@ async function apiGet2(path3, options) {
   }
   return response.json();
 }
-async function apiPost(path3, body, options) {
+async function apiPost(path2, body, options) {
   const headers = {
     Authorization: `Bearer ${TOKEN}`,
     "Content-Type": "application/json",
     ...options?.extraHeaders
   };
-  const response = await fetchWithTimeout(`${API_URL}/api/v1${path3}`, {
+  const response = await fetchWithTimeout(`${API_URL}/api/v1${path2}`, {
     method: "POST",
     headers,
     body: JSON.stringify(body)
@@ -79278,7 +79656,7 @@ var init_mcp_server2 = __esm({
     init_collector();
     init_http_timeout();
     init_service_urls();
-    init_src7();
+    init_src5();
     init_mcp();
     init_stdio2();
     init_types4();
@@ -79568,8 +79946,9 @@ var init_mcp_server2 = __esm({
             throw new Error(`Unknown tool: ${name}`);
         }
       } catch (err) {
+        console.error(`[MCP] agent-sessions tool failed:`, err?.message ?? err);
         return {
-          content: [{ type: "text", text: `Error: ${err.message}` }],
+          content: [{ type: "text", text: "An internal error occurred." }],
           isError: true
         };
       }
@@ -79631,17 +80010,20 @@ var init_codex_config = __esm({
 // src/commands/setup-mcp.ts
 var setup_mcp_exports = {};
 __export(setup_mcp_exports, {
+  HTTP_SERVERS: () => HTTP_SERVERS,
+  parseTarget: () => parseTarget,
   setupMcp: () => setupMcp
 });
 function parseTarget(arg) {
   if (!arg || arg === "all") return "all";
-  if (arg === "solutions" || arg === "exchange") return arg;
+  if (arg === "solutions" || arg === "exchange" || arg === "digests")
+    return arg;
   throw new Error(
-    `Unknown target: ${arg}. Use one of: solutions, exchange, all (default).`
+    `Unknown target: ${arg}. Use one of: solutions, exchange, digests, all (default).`
   );
 }
-function exchangeUrl() {
-  return `${apiUrl().replace(/\/+$/, "")}/api/v1/memory/exchange/mcp`;
+function httpServerUrl(path2) {
+  return `${apiUrl().replace(/\/+$/, "")}${path2}`;
 }
 function setupClaudeMcp(target) {
   let config6 = {};
@@ -79666,21 +80048,22 @@ function setupClaudeMcp(target) {
     };
     installed.push(`haansi-solutions (stdio \u2192 ${haansiBin} mcp-server)`);
   }
-  if (target === "all" || target === "exchange") {
+  for (const http of HTTP_SERVERS) {
+    if (target !== "all" && target !== http.target) continue;
     const token = resolveToken();
     if (!token) {
       warnings.push(
-        "haansi-exchange not registered: no token found. Run `haansi auth login` first, or set HAANSI_TOKEN."
+        `${http.name} not registered: no token found. Run \`haansi auth login\` first, or set HAANSI_TOKEN.`
       );
-    } else {
-      const url2 = exchangeUrl();
-      config6.mcpServers["haansi-exchange"] = {
-        type: "http",
-        url: url2,
-        headers: { Authorization: `Bearer ${token}` }
-      };
-      installed.push(`haansi-exchange (http \u2192 ${url2})`);
+      continue;
     }
+    const url2 = httpServerUrl(http.path);
+    config6.mcpServers[http.name] = {
+      type: "http",
+      url: url2,
+      headers: { Authorization: `Bearer ${token}` }
+    };
+    installed.push(`${http.name} (http \u2192 ${url2})`);
   }
   (0, import_node_fs5.writeFileSync)(CLAUDE_JSON, JSON.stringify(config6, null, 2) + "\n", "utf-8");
   console.log(`
@@ -79711,20 +80094,21 @@ function setupCodexMcp(target) {
     });
     installed.push(`haansi-solutions (stdio \u2192 ${haansiBin} mcp-server)`);
   }
-  if (target === "all" || target === "exchange") {
+  for (const http of HTTP_SERVERS) {
+    if (target !== "all" && target !== http.target) continue;
     const token = resolveToken();
     if (!token) {
       warnings.push(
-        "haansi-exchange not registered: no token found. Run `haansi auth login` first, or set HAANSI_TOKEN."
+        `${http.name} not registered: no token found. Run \`haansi auth login\` first, or set HAANSI_TOKEN.`
       );
-    } else {
-      const url2 = exchangeUrl();
-      content = upsertTomlTable(content, "mcp_servers.haansi-exchange", {
-        url: tomlString(url2),
-        http_headers: tomlInlineTable({ Authorization: `Bearer ${token}` })
-      });
-      installed.push(`haansi-exchange (http \u2192 ${url2})`);
+      continue;
     }
+    const url2 = httpServerUrl(http.path);
+    content = upsertTomlTable(content, `mcp_servers.${http.name}`, {
+      url: tomlString(url2),
+      http_headers: tomlInlineTable({ Authorization: `Bearer ${token}` })
+    });
+    installed.push(`${http.name} (http \u2192 ${url2})`);
   }
   (0, import_node_fs5.mkdirSync)(CODEX_HOME, { recursive: true });
   (0, import_node_fs5.writeFileSync)(CODEX_CONFIG, content, "utf-8");
@@ -79745,7 +80129,7 @@ async function setupMcp(targetArg, agentFlag) {
   console.log(`
 Restart ${restart} to activate the changes.`);
 }
-var import_node_fs5, import_node_path4, import_node_os4, CLAUDE_JSON, CODEX_HOME, CODEX_CONFIG, WRITERS;
+var import_node_fs5, import_node_path4, import_node_os4, CLAUDE_JSON, CODEX_HOME, CODEX_CONFIG, HTTP_SERVERS, WRITERS;
 var init_setup_mcp = __esm({
   "src/commands/setup-mcp.ts"() {
     "use strict";
@@ -79758,6 +80142,18 @@ var init_setup_mcp = __esm({
     CLAUDE_JSON = (0, import_node_path4.join)((0, import_node_os4.homedir)(), ".claude.json");
     CODEX_HOME = process.env.CODEX_HOME || (0, import_node_path4.join)((0, import_node_os4.homedir)(), ".codex");
     CODEX_CONFIG = (0, import_node_path4.join)(CODEX_HOME, "config.toml");
+    HTTP_SERVERS = [
+      {
+        target: "exchange",
+        name: "haansi-exchange",
+        path: "/api/v1/memory/exchange/mcp"
+      },
+      {
+        target: "digests",
+        name: "haansi-digests",
+        path: "/api/v1/memory/digests/mcp"
+      }
+    ];
     WRITERS = {
       "claude-code": setupClaudeMcp,
       codex: setupCodexMcp
@@ -79804,7 +80200,7 @@ function warnIfStaleDevBundle(haansiPath) {
 }
 function buildPlist(haansiPath) {
   const binDir = haansiPath.replace(/\/[^/]+$/, "");
-  const path3 = `${binDir}:/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin`;
+  const path2 = `${binDir}:/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin`;
   return `<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
@@ -79819,7 +80215,7 @@ function buildPlist(haansiPath) {
   <key>EnvironmentVariables</key>
   <dict>
     <key>PATH</key>
-    <string>${path3}</string>
+    <string>${path2}</string>
   </dict>
   <key>RunAtLoad</key>
   <true/>
@@ -79840,8 +80236,8 @@ async function setupDaemon(uninstall) {
     }
     try {
       (0, import_node_child_process3.spawnSync)("launchctl", ["unload", PLIST_PATH], { stdio: "pipe" });
-    } catch (err) {
-      console.error("Failed to unload daemon:", err);
+    } catch {
+      console.error("Failed to unload daemon.");
     }
     (0, import_node_fs6.unlinkSync)(PLIST_PATH);
     console.log("Daemon stopped and removed.");
@@ -79853,8 +80249,8 @@ async function setupDaemon(uninstall) {
   (0, import_node_fs6.writeFileSync)(PLIST_PATH, buildPlist(haansiPath), "utf-8");
   try {
     (0, import_node_child_process3.spawnSync)("launchctl", ["unload", PLIST_PATH], { stdio: "pipe" });
-  } catch (err) {
-    console.error("Failed to unload previous daemon:", err);
+  } catch {
+    console.error("Failed to unload previous daemon.");
   }
   (0, import_node_child_process3.spawnSync)("launchctl", ["load", PLIST_PATH], { stdio: "inherit" });
   console.log("Daemon installed and started.");
@@ -79894,8 +80290,10 @@ function resolveToken4() {
     try {
       const creds = JSON.parse((0, import_node_fs7.readFileSync)(CREDENTIALS_FILE6, "utf-8"));
       if (creds.token) return creds.token;
-    } catch (err) {
-      console.error("Failed to read credentials file:", err);
+    } catch {
+      console.error(
+        "Failed to read credentials file. Run `haansi init` to recreate it."
+      );
     }
   }
   return null;
@@ -79920,10 +80318,7 @@ async function config5(args) {
       }
     );
     if (!response.ok) {
-      const body = await response.text().catch(() => "");
-      console.error(
-        `Error fetching preferences (${response.status}): ${body.slice(0, 200)}`
-      );
+      console.error(`Error fetching preferences (${response.status}).`);
       process.exit(1);
       return;
     }
@@ -79972,10 +80367,7 @@ async function config5(args) {
       }
     );
     if (!response.ok) {
-      const body = await response.text().catch(() => "");
-      console.error(
-        `Error updating preferences (${response.status}): ${body.slice(0, 200)}`
-      );
+      console.error(`Error updating preferences (${response.status}).`);
       process.exit(1);
       return;
     }
@@ -80016,24 +80408,27 @@ function resolveToken5() {
     try {
       const creds = JSON.parse((0, import_node_fs8.readFileSync)(CREDENTIALS_FILE7, "utf-8"));
       if (creds.token) return creds.token;
-    } catch (err) {
-      console.error("Failed to read credentials file:", err);
+    } catch {
+      console.error(
+        "Failed to read credentials file. Run `haansi init` to recreate it."
+      );
     }
   }
   throw new Error("No token found. Run `haansi init` first.");
 }
-async function apiGet3(path3, token, apiUrl2) {
-  const response = await fetch(`${apiUrl2}/api/v1${path3}`, {
+async function apiGet3(path2, token, apiUrl2) {
+  const response = await fetch(`${apiUrl2}/api/v1${path2}`, {
     headers: { Authorization: `Bearer ${token}` }
   });
   if (!response.ok) {
-    const body = await response.text().catch(() => "");
-    throw new Error(`API error ${response.status}: ${body.slice(0, 200)}`);
+    throw Object.assign(new Error(`API error ${response.status}`), {
+      publicMessage: `The request failed (${response.status}).`
+    });
   }
   return response.json();
 }
-async function apiPost2(path3, body, token, apiUrl2) {
-  const response = await fetch(`${apiUrl2}/api/v1${path3}`, {
+async function apiPost2(path2, body, token, apiUrl2) {
+  const response = await fetch(`${apiUrl2}/api/v1${path2}`, {
     method: "POST",
     headers: {
       Authorization: `Bearer ${token}`,
@@ -80042,8 +80437,9 @@ async function apiPost2(path3, body, token, apiUrl2) {
     body: JSON.stringify(body)
   });
   if (!response.ok) {
-    const text = await response.text().catch(() => "");
-    throw new Error(`API error ${response.status}: ${text.slice(0, 200)}`);
+    throw Object.assign(new Error(`API error ${response.status}`), {
+      publicMessage: `The request failed (${response.status}).`
+    });
   }
   return response.json();
 }
@@ -80356,7 +80752,9 @@ Environment variables:
 `);
 }
 run2().catch((err) => {
-  console.error("Error:", err.message ?? err);
+  const publicMessage = typeof err === "object" && err !== null && "publicMessage" in err ? String(err.publicMessage) : void 0;
+  console.error("Error:", publicMessage ?? "The command failed.");
+  if (process.env.HAANSI_DEBUG) console.error(err);
   process.exit(1);
 });
 /*! Bundled license information: