mcp-scraper 0.84.0 → 0.85.0

package/dist/{server-3F3JMHBF.js → server-EOPETL7Q.js}

@@ -43,7 +43,7 @@ import {
   setExtractJobTotal,
   settleExtractJob,
   terminalExtractJobStatus
-} from "./chunk-ZB55UMMF.js";
+} from "./chunk-C7OKENCR.js";
 import {
   REQUIRED_LOCATION_STATE_CODES,
   importHostedCensusPlacesCsv,
@@ -88,6 +88,7 @@ import {
   GmailServiceError,
   MainNangoTransportError,
   assertGmailSelectionReceipt,
+  assertNangoProviderAvailable,
   callNangoToolDirect,
   createNangoReconnectSessionDirect,
   createNangoSessionDirect,
@@ -96,6 +97,7 @@ import {
   discoverOwnedNangoConnections,
   getOwnedGmailSelection,
   gmailFingerprint,
+  isWithdrawnNangoProvider,
   listConnectedUsageHistory,
   listNangoCatalogDirect,
   listNangoToolsDirect,
@@ -103,7 +105,7 @@ import {
   probeNangoConnectionDirect,
   recordNangoConnectionCost,
   settleConnectedUsage
-} from "./chunk-4KFD2WXG.js";
+} from "./chunk-W3SGF7GX.js";
 import {
   ANALYTICS_ATTRIBUTION_MODELS,
   ANALYTICS_CONTENT_SORTS,
@@ -154,7 +156,6 @@ import {
   getPublicAnalyticsForm,
   identityHmac,
   ingestAnalyticsEvents,
-  insertAnalyticsRevenueSetupRevision,
   isAnalyticsFormPlacementApproved,
   linkAnalyticsFormIdentity,
   listAnalyticsActivationDestinations,
@@ -251,13 +252,15 @@ import {
   AnalyticsCrmOutboundJobSchema,
   AnalyticsCrmOutboundPolicySchema,
   AnalyticsCrmOutboundReceiptSchema,
-  AnalyticsCrmProviderIdSchema,
   AnalyticsCrmProvisioningPlanSchema,
   AnalyticsCrmProvisioningReceiptSchema,
   AnalyticsCrmSyncStatusSchema,
   AnalyticsExperimentPlanSchema,
   AnalyticsPipelineEventMappingSchema,
   AnalyticsPipelineEventSchema,
+  AnalyticsPublicCrmProviderIdSchema,
+  AnalyticsPublicCrmProvisioningPlanSchema,
+  AnalyticsPublicCrmProvisioningReceiptSchema,
   AnalyticsResolvedCrmCapabilitySchema,
   ApiErrorResponseSchema,
   ApprovalDecisionSchema,
@@ -384,7 +387,7 @@ import {
   transcribeMediaUrl,
   transitionAnalyticsExperiment,
   validateAnalyticsRestResponseForRequest
-} from "./chunk-U77X4NIR.js";
+} from "./chunk-W4IY6CB4.js";
 import {
   auditImageUrls,
   auditImages,
@@ -455,7 +458,7 @@ import {
   tierChangeLeavesPrivateOffer,
   tierCreditsPerInterval,
   vendorCostUsdToMc
-} from "./chunk-UM7DCY6W.js";
+} from "./chunk-X5HRAAQM.js";
 import {
   browserServiceApiKey,
   browserServiceProfileName,
@@ -479,7 +482,7 @@ import {
   workflowOutputBaseDir,
   workflowStepCount,
   workflowSupportsSteps
-} from "./chunk-LHIWX7RM.js";
+} from "./chunk-6IOGTFNS.js";
 import {
   csvRecords,
   parseCsv,
@@ -497,7 +500,7 @@ import {
 } from "./chunk-OWF2JJKN.js";
 import {
   extractContactEvidence
-} from "./chunk-4S6HPHPB.js";
+} from "./chunk-P7FWOMU7.js";
 import {
   isPrivateIpAddress,
   loadHtmlDocument,
@@ -505,7 +508,7 @@ import {
 } from "./chunk-GGZEC22A.js";
 import {
   PACKAGE_VERSION
-} from "./chunk-OUTE3755.js";
+} from "./chunk-RHAOKXQK.js";
 import {
   CaptchaError,
   MapsSearchIncompletePageError,
@@ -3968,7 +3971,7 @@ async function generateOgImage(post) {
 
 // src/api/server.ts
 import { Resend as Resend3 } from "resend";
-import { createHash as createHash105, randomUUID as randomUUID70 } from "crypto";
+import { createHash as createHash103, randomUUID as randomUUID68 } from "crypto";
 
 // src/api/kpo-extractor.ts
 import TurndownService from "turndown";
@@ -9760,7 +9763,7 @@ var siteExtractFn = inngest.createFunction(
       });
     }) : null;
     const finalized = await step.run("finalize", async () => {
-      const { assembleExtractArtifacts } = await import("./extract-bundle-SI35H4HR.js");
+      const { assembleExtractArtifacts } = await import("./extract-bundle-NSMGHEG6.js");
       const current = await getExtractJob(jobId2);
       if (!current) throw new Error("extract job disappeared before finalization");
       const stored = await assembleExtractArtifacts(current, { branding, imageAudit });
@@ -22274,11 +22277,11 @@ async function beginOrResumeGmailImport(args) {
   await ensureGmailImportSchema();
   const key3 = args.idempotencyKey.trim();
   if (key3.length < 8 || key3.length > 200) throw new GmailImportRepositoryError("idempotency_key_invalid", "Idempotency-Key must be 8-200 characters.");
-  const fingerprint6 = gmailFingerprint({ importPlanId: args.plan.importPlanId, planFingerprint: args.plan.planFingerprint });
+  const fingerprint5 = gmailFingerprint({ importPlanId: args.plan.importPlanId, planFingerprint: args.plan.planFingerprint });
   const existing = await getDb().execute({ sql: `SELECT * FROM gmail_import_jobs WHERE owner_identity = ? AND idempotency_key = ? LIMIT 1`, args: [args.ownerId, key3] });
   if (existing.rows[0]) {
     const job2 = jobFromRow(existing.rows[0]);
-    if (job2.fingerprint !== fingerprint6) throw new GmailImportRepositoryError("idempotency_conflict", "This Idempotency-Key is already bound to a different Gmail import.", 409);
+    if (job2.fingerprint !== fingerprint5) throw new GmailImportRepositoryError("idempotency_conflict", "This Idempotency-Key is already bound to a different Gmail import.", 409);
     if (job2.status !== "running") return { job: job2, acquired: false };
     const now2 = args.now ?? /* @__PURE__ */ new Date();
     if (job2.leaseExpiresAt && new Date(job2.leaseExpiresAt).getTime() > now2.getTime()) return { job: job2, acquired: false };
@@ -22290,7 +22293,7 @@ async function beginOrResumeGmailImport(args) {
   }
   const now = args.now ?? /* @__PURE__ */ new Date();
   const leaseExpiresAt = new Date(now.getTime() + (args.leaseMs ?? 45e3)).toISOString();
-  const job = { ingestId: `ging_${randomUUID6().replace(/-/g, "")}`, ownerId: args.ownerId, importPlanId: args.plan.importPlanId, idempotencyKey: key3, fingerprint: fingerprint6, status: "running", attempts: 0, leaseExpiresAt, progress: { messagesStored: 0, attachmentsStored: 0, attachmentsIndexed: 0, skipped: 0, errors: [], checkpoints: {} }, createdAt: now.toISOString(), updatedAt: now.toISOString() };
+  const job = { ingestId: `ging_${randomUUID6().replace(/-/g, "")}`, ownerId: args.ownerId, importPlanId: args.plan.importPlanId, idempotencyKey: key3, fingerprint: fingerprint5, status: "running", attempts: 0, leaseExpiresAt, progress: { messagesStored: 0, attachmentsStored: 0, attachmentsIndexed: 0, skipped: 0, errors: [], checkpoints: {} }, createdAt: now.toISOString(), updatedAt: now.toISOString() };
   await getDb().execute({ sql: `INSERT INTO gmail_import_jobs (ingest_id, owner_identity, import_plan_id, idempotency_key, fingerprint, status, attempts, lease_expires_at, progress_json, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`, args: [job.ingestId, job.ownerId, job.importPlanId, job.idempotencyKey, job.fingerprint, job.status, job.attempts, job.leaseExpiresAt, JSON.stringify(job.progress), job.createdAt, job.updatedAt] });
   return { job, acquired: true };
 }
@@ -24204,12 +24207,12 @@ directoryApp.post("/run", createApiKeyAuth(), async (c) => {
   const keyResult = idempotencyKey(c.req.header("idempotency-key") ?? c.req.header("x-idempotency-key"));
   if (!keyResult.ok) return c.json({ error: keyResult.message, error_code: "invalid_request", retryable: false }, 400);
   c.header("Idempotency-Key", keyResult.key);
-  const fingerprint6 = requestFingerprint(parsed.data);
+  const fingerprint5 = requestFingerprint(parsed.data);
   let existingJob = null;
   if (parsed.data.background) {
     existingJob = await getDirectoryWorkflowJobByIdempotencyKey(Number(user.id), keyResult.key);
     if (existingJob) {
-      if (existingJob.requestFingerprint !== fingerprint6) {
+      if (existingJob.requestFingerprint !== fingerprint5) {
         return c.json({ error: "Idempotency-Key was already used for different directory workflow inputs.", error_code: "idempotency_conflict", retryable: false }, 409);
       }
       if (existingJob.status !== "initializing") return c.json(await publicJobEnvelope(existingJob));
@@ -24264,7 +24267,7 @@ directoryApp.post("/run", createApiKeyAuth(), async (c) => {
       id: requestedJobId,
       userId: Number(user.id),
       idempotencyKey: keyResult.key,
-      requestFingerprint: fingerprint6,
+      requestFingerprint: fingerprint5,
       options: parsed.data,
       plan,
       holdMc,
@@ -24474,7 +24477,7 @@ async function createOrGetLeadListUpload(args) {
   const id2 = cleanId(args.id ?? newLeadListUploadId(), "upl");
   const ownerId3 = bounded(args.ownerId, "ownerId", 1, 160);
   const key3 = bounded(args.idempotencyKey, "idempotencyKey", 8, 200);
-  const fingerprint6 = bounded(args.requestFingerprint, "requestFingerprint", 16, 128);
+  const fingerprint5 = bounded(args.requestFingerprint, "requestFingerprint", 16, 128);
   const createdAt = args.createdAt ?? (/* @__PURE__ */ new Date()).toISOString();
   const result3 = await getDb().execute({
     sql: `INSERT OR IGNORE INTO lead_list_uploads (
@@ -24485,7 +24488,7 @@ async function createOrGetLeadListUpload(args) {
       id2,
       ownerId3,
       key3,
-      fingerprint6,
+      fingerprint5,
       args.blobPathname,
       args.filenameHint ?? null,
       JSON.stringify(args.allowedMimeTypes),
@@ -24498,7 +24501,7 @@ async function createOrGetLeadListUpload(args) {
   const upload = await getLeadListUploadByIdempotencyKey(ownerId3, key3);
   if (!upload) throw new Error("lead-list upload insert did not persist");
   const created = Number(result3.rowsAffected ?? 0) > 0;
-  return { upload, created, conflict: !created && upload.requestFingerprint !== fingerprint6 };
+  return { upload, created, conflict: !created && upload.requestFingerprint !== fingerprint5 };
 }
 async function getLeadListUpload(id2, ownerId3) {
   await ensureLeadListImportRepositorySchema();
@@ -24548,7 +24551,7 @@ async function createOrGetImportedLeadList(args) {
   const id2 = cleanId(args.id ?? newImportedLeadListId(), "lst");
   const ownerId3 = bounded(args.ownerId, "ownerId", 1, 160);
   const key3 = bounded(args.idempotencyKey, "idempotencyKey", 8, 200);
-  const fingerprint6 = bounded(args.requestFingerprint, "requestFingerprint", 16, 128);
+  const fingerprint5 = bounded(args.requestFingerprint, "requestFingerprint", 16, 128);
   const createdAt = args.createdAt ?? (/* @__PURE__ */ new Date()).toISOString();
   const result3 = await getDb().execute({
     sql: `INSERT OR IGNORE INTO imported_lead_lists (
@@ -24560,7 +24563,7 @@ async function createOrGetImportedLeadList(args) {
       id2,
       ownerId3,
       key3,
-      fingerprint6,
+      fingerprint5,
       args.normalizedArtifactId,
       args.normalizedDigest,
       args.sourceFormat,
@@ -24580,7 +24583,7 @@ async function createOrGetImportedLeadList(args) {
   const leadList = await getImportedLeadListByIdempotencyKey(ownerId3, key3);
   if (!leadList) throw new Error("imported lead-list insert did not persist");
   const created = Number(result3.rowsAffected ?? 0) > 0;
-  return { leadList, created, conflict: !created && leadList.requestFingerprint !== fingerprint6 };
+  return { leadList, created, conflict: !created && leadList.requestFingerprint !== fingerprint5 };
 }
 async function getImportedLeadList(id2, ownerId3) {
   await ensureLeadListImportRepositorySchema();
@@ -25832,10 +25835,10 @@ leadListEnrichmentApp.post("/jobs", createApiKeyAuth(), async (c) => {
     const failure2 = inputError(error);
     return c.json({ error: failure2.message, error_code: failure2.code, retryable: false, details: failure2.details }, 400);
   }
-  const fingerprint6 = leadListEnrichmentFingerprint(input);
+  const fingerprint5 = leadListEnrichmentFingerprint(input);
   const existingJob = await getLeadListEnrichmentJobByIdempotencyKey(userId, key3.value);
   if (existingJob) {
-    if (existingJob.requestFingerprint !== fingerprint6) {
+    if (existingJob.requestFingerprint !== fingerprint5) {
       return c.json({
         error: "Idempotency-Key was already used for different lead-list enrichment inputs.",
         error_code: "idempotency_conflict",
@@ -25859,7 +25862,7 @@ leadListEnrichmentApp.post("/jobs", createApiKeyAuth(), async (c) => {
       id: existingJob?.id ?? newJobId(),
       userId,
       idempotencyKey: key3.value,
-      requestFingerprint: fingerprint6,
+      requestFingerprint: fingerprint5,
       input,
       holdMc,
       debitKey: debitKeyFor2(userId, key3.value),
@@ -33507,17 +33510,6 @@ function evaluateAnalyticsEventValueRule(input, context) {
 }
 
 // src/api/analytics-contracts.ts
-var AnalyticsRevenueProviderSchema = z32.literal("stripe_revenue");
-var AnalyticsRevenueConnectionReferenceSchema = z32.object({
-  provider: AnalyticsRevenueProviderSchema,
-  serviceConnectionRef: z32.string().trim().min(1).max(240),
-  role: z32.enum(["primary", "observation"]),
-  outcomeFamily: z32.literal("subscription_revenue")
-}).strict().superRefine((value, context) => {
-  if (/(?:secret|token|password|api[_-]?key|authorization)/i.test(value.serviceConnectionRef)) {
-    context.addIssue({ code: "custom", path: ["serviceConnectionRef"], message: "Use an authorized connection reference, never a credential." });
-  }
-});
 var AnalyticsClickIdSchema = z32.object({
   gclid: z32.string().trim().max(500).optional(),
   gbraid: z32.string().trim().max(500).optional(),
@@ -34536,7 +34528,8 @@ async function claimAnalyticsCrmOutboundJobs(input) {
     `WITH due AS (
        SELECT j.job_id FROM analytics_crm_outbound_jobs j
        JOIN analytics_crm_outbound_policies p ON p.policy_id=j.policy_id
-       WHERE p.enabled=true AND ((j.state IN ('pending','retrying') AND j.next_attempt_at <= now()) OR
+       WHERE p.enabled=true AND p.provider NOT IN ('salesforce','pipedrive')
+         AND ((j.state IN ('pending','retrying') AND j.next_attempt_at <= now()) OR
              (j.state='running' AND j.lease_expires_at < now()))
        ORDER BY coalesce(j.next_attempt_at,j.lease_expires_at),j.created_at FOR UPDATE OF j SKIP LOCKED LIMIT $1
      )
@@ -34674,8 +34667,11 @@ async function settleAnalyticsCrmOutboundJob(input) {
 }
 async function listAnalyticsCrmOutboundReceipts(input) {
   const result3 = await dbOrDefault(input.db).query(
-    `SELECT r.* FROM analytics_crm_outbound_receipts r JOIN analytics_crm_outbound_jobs j ON j.job_id=r.job_id
-      WHERE j.site_id=$1 ORDER BY r.occurred_at DESC LIMIT $2`,
+    `SELECT r.* FROM analytics_crm_outbound_receipts r
+      JOIN analytics_crm_outbound_jobs j ON j.job_id=r.job_id
+      JOIN analytics_crm_outbound_policies p ON p.policy_id=j.policy_id
+      WHERE j.site_id=$1 AND p.provider NOT IN ('salesforce','pipedrive')
+      ORDER BY r.occurred_at DESC LIMIT $2`,
     [input.siteId, Math.max(1, Math.min(100, input.limit ?? 25))]
   );
   return result3.rows.map((row) => AnalyticsCrmOutboundReceiptSchema.parse({
@@ -34700,6 +34696,12 @@ var ANALYTICS_CRM_PROVIDER_IDS = [
   "pipedrive",
   "keap"
 ];
+var ANALYTICS_PUBLIC_CRM_PROVIDER_IDS = [
+  "hubspot",
+  "highlevel",
+  "zoho",
+  "keap"
+];
 var operations = (enabled) => {
   const result3 = {
     describe: false,
@@ -36994,7 +36996,11 @@ function safeAnalyticsConnectionErrorCode(error) {
 function analyticsConnectionSetupProfile(input) {
   const provider = input.provider;
   const profile = CONNECTION_SETUP[provider];
-  if (!profile) throw new AnalyticsRepositoryError("analytics_connection_provider_unsupported", "Unsupported analytics connection provider.", 400);
+  if (!profile) throw new AnalyticsRepositoryError(
+    "analytics_connection_provider_unavailable",
+    "This analytics connection is not available in the current public release.",
+    404
+  );
   return {
     callbackPath: `/analytics/v1/webhooks/${provider}/${input.connectionId}`,
     expectedEventTypes: [...profile.expectedEventTypes],
@@ -46532,7 +46538,7 @@ function xmlEscape(value) {
 import { Hono as Hono36 } from "hono";
 import { createMiddleware as createMiddleware4 } from "hono/factory";
 import { z as z43 } from "zod";
-import { createHash as createHash45, randomUUID as randomUUID40 } from "crypto";
+import { createHash as createHash43, randomUUID as randomUUID38 } from "crypto";
 import Papa5 from "papaparse";
 
 // src/api/analytics-manual-imports.ts
@@ -46652,10 +46658,10 @@ function previewAnalyticsManualImport(input) {
     });
   }
   const headers = parsed.meta.fields ?? [];
-  const fingerprint6 = createHash31("sha256").update(canonical({ sourceSystem: parsedInput.sourceSystem, filename: parsedInput.filename, mapping: parsedInput.mapping, rows })).digest("hex");
+  const fingerprint5 = createHash31("sha256").update(canonical({ sourceSystem: parsedInput.sourceSystem, filename: parsedInput.filename, mapping: parsedInput.mapping, rows })).digest("hex");
   return {
     schemaVersion: 1,
-    fingerprint: fingerprint6,
+    fingerprint: fingerprint5,
     headers,
     totalRows: parsed.data.length,
     acceptedRows: rows.length,
@@ -48561,7 +48567,7 @@ async function callMainOwnedExportPage(identity, input) {
     });
   }
   if (connection.providerConfigKey === "google-mail" && input.dataset === "emails") {
-    const { GmailService: GmailService2 } = await import("./gmail-service-MOZ6S56I.js");
+    const { GmailService: GmailService2 } = await import("./gmail-service-BTRAHGJS.js");
     const service = new GmailService2();
     const ownerId3 = createHash32("sha256").update(identity.toLowerCase()).digest("hex").slice(0, 24);
     const after = Math.floor(Date.parse(input.from) / 1e3);
@@ -49327,13 +49333,11 @@ async function readSaasChecklist(siteId, db) {
   if (site.rows[0]?.business_model !== "saas") return [];
   const definitions = [
     { key: "tag", label: "Global tag", nextAction: "Install and verify the X-Ray tag across every production surface.", sql: `SELECT p.id::text AS evidence_id,CASE WHEN EXISTS(SELECT 1 FROM analytics_ingestion_receipts r WHERE r.site_id=p.site_id AND r.accepted_count>0) THEN 'complete' ELSE 'in_progress' END AS status FROM analytics_pixels p WHERE p.site_id=$1 AND p.status='active' AND EXISTS(SELECT 1 FROM analytics_pixel_domains d WHERE d.pixel_id=p.id AND d.state='approved') LIMIT 1` },
-    { key: "ads", label: "Ad tracking", nextAction: "Connect ad sources and preserve consent-eligible click identifiers.", sql: `SELECT id::text AS evidence_id,'complete' AS status FROM analytics_attribution_touches WHERE site_id=$1 AND click_ids<>'{}'::jsonb LIMIT 1` },
+    { key: "ads", label: "Ad-source capture", nextAction: "Preserve consent-eligible campaign and click identifiers on landing events.", sql: `SELECT id::text AS evidence_id,'complete' AS status FROM analytics_attribution_touches WHERE site_id=$1 AND click_ids<>'{}'::jsonb LIMIT 1` },
     { key: "lifecycle", label: "Lifecycle channels", nextAction: "Configure signup, account, checkout, email, and product lifecycle events.", sql: `SELECT id::text AS evidence_id,'complete' AS status FROM analytics_event_definitions WHERE site_id=$1 AND status='active' AND event_name ~ '(signup|account|checkout|trial|demo)' LIMIT 1` },
-    { key: "revenue", label: "Revenue authority", nextAction: "Connect and verify one primary subscription revenue authority.", sql: `SELECT authority_id::text AS evidence_id,CASE WHEN state='live' THEN 'complete' WHEN state IN ('verified','configured_unverified') THEN 'in_progress' WHEN state IN ('blocked','degraded') THEN 'blocked' ELSE 'unavailable' END AS status FROM analytics_revenue_authorities WHERE site_id=$1 AND outcome_family='subscription_revenue' AND authority_role='primary' AND state<>'disabled' ORDER BY updated_at DESC LIMIT 1` },
-    { key: "calls_demos", label: "Calls and demos", nextAction: "Connect a call or CRM source when demos participate in the sales journey.", sql: `SELECT id::text AS evidence_id,CASE WHEN readiness IN ('verified','live') THEN 'complete' WHEN readiness='configured_unverified' THEN 'in_progress' WHEN readiness='degraded' THEN 'blocked' ELSE 'unavailable' END AS status FROM analytics_connections WHERE site_id=$1 AND provider IN ('callrail','calltrackingmetrics','twilio','hubspot','highlevel','generic_crm') ORDER BY updated_at DESC LIMIT 1` },
-    { key: "currency_timezone", label: "Currency and timezone", nextAction: "Confirm the reporting timezone and collect one authoritative currency receipt.", sql: `SELECT s.id::text AS evidence_id,CASE WHEN s.timezone<>'' AND EXISTS(SELECT 1 FROM analytics_conversions c WHERE c.site_id=s.id AND c.currency ~ '^[A-Z]{3}$') THEN 'complete' ELSE 'in_progress' END AS status FROM analytics_sites s WHERE s.id=$1` },
+    { key: "currency_timezone", label: "Currency and timezone", nextAction: "Confirm the reporting timezone and the ISO currency attached to measured value events.", sql: `SELECT s.id::text AS evidence_id,CASE WHEN s.timezone<>'' AND EXISTS(SELECT 1 FROM analytics_conversions c WHERE c.site_id=s.id AND c.currency ~ '^[A-Z]{3}$') THEN 'complete' ELSE 'in_progress' END AS status FROM analytics_sites s WHERE s.id=$1` },
     { key: "consent", label: "Consent", nextAction: "Publish the analytics and customer-reported measurement disclosures.", sql: `SELECT min(id::text) AS evidence_id,CASE WHEN count(*) FILTER(WHERE purpose='site_analytics' AND enabled AND retired_at IS NULL)>0 THEN 'complete' ELSE 'in_progress' END AS status FROM analytics_purpose_policies WHERE site_id=$1 HAVING count(*)>0` },
-    { key: "end_to_end_outcome", label: "End-to-end outcome test", nextAction: "Run a non-customer subscription canary and verify its provider receipt.", sql: `SELECT outcome.outcome_id::text AS evidence_id,'complete' AS status FROM analytics_authoritative_outcomes outcome JOIN analytics_revenue_authorities authority ON authority.site_id=outcome.site_id AND authority.authority_id=outcome.authority_id WHERE outcome.site_id=$1 AND outcome.conversion_id IS NOT NULL AND authority.authority_role='primary' AND authority.state='live' LIMIT 1` }
+    { key: "observed_event_verification", label: "Observed outcome event", nextAction: "Verify at least one configured outcome event is observed; browser evidence does not prove paid revenue.", sql: `SELECT c.id::text AS evidence_id,'complete' AS status FROM analytics_conversions c WHERE c.site_id=$1 LIMIT 1` }
   ];
   const rows = await Promise.all(definitions.map((definition) => db.query(definition.sql, [siteId])));
   return definitions.map((definition, index) => {
@@ -50147,8 +50151,8 @@ function buildAnalyticsSiteInventory(input) {
       evidenceIds: [...new Set(input.routes.flatMap((route) => route.evidenceIds))]
     });
   }
-  const stable3 = { startUrl: input.startUrl, routes: input.routes, surfaces: input.surfaces, diagnoses };
-  return { schemaVersion: 1, ...input, diagnoses, fingerprint: stableFingerprint2(stable3) };
+  const stable2 = { startUrl: input.startUrl, routes: input.routes, surfaces: input.surfaces, diagnoses };
+  return { schemaVersion: 1, ...input, diagnoses, fingerprint: stableFingerprint2(stable2) };
 }
 
 // src/api/analytics-site-setup.ts
@@ -50416,13 +50420,11 @@ var AnalyticsSiteSetupService = class {
       measurementPlan: { eventRuleCount: candidates.length, recommendedRuleCount: candidates.filter((candidate) => candidate.disposition === "recommended").length, approvalRequired: true },
       ...outcomePlan.businessModel === "saas" ? { saasChecklist: [
         { key: "tag", state: tagReady ? "complete" : routesWithPixel > 0 ? "in_progress" : "not_configured", evidenceIds: input.inventory.routes.flatMap((route) => route.evidenceIds), nextAction: tagReady ? null : "Install and verify the X-Ray tag across every rendering surface." },
-        { key: "ads", state: input.inventory.routes.some((route) => route.semanticTags > 0) ? "in_progress" : "not_configured", evidenceIds: [], nextAction: "Connect ad sources and preserve click identifiers through the consented tag." },
+        { key: "ads", state: input.inventory.routes.some((route) => route.semanticTags > 0) ? "in_progress" : "not_configured", evidenceIds: [], nextAction: "Preserve consent-eligible campaign and click identifiers through the installed tag." },
         { key: "lifecycle", state: candidates.some((candidate) => /signup|account|checkout/i.test(candidate.eventName)) ? "in_progress" : "not_configured", evidenceIds: candidates.map((candidate) => candidate.candidateId), nextAction: "Tag signup, account, and checkout lifecycle actions." },
-        { key: "revenue", state: "not_configured", evidenceIds: [], nextAction: "Connect and verify one primary subscription revenue authority." },
-        { key: "calls_demos", state: "not_configured", evidenceIds: [], nextAction: "Connect call or CRM evidence when demos are part of the sales journey." },
         { key: "currency_timezone", state: "not_configured", evidenceIds: [], nextAction: "Confirm reporting currency and IANA timezone." },
         { key: "consent", state: "in_progress", evidenceIds: input.inventory.routes.flatMap((route) => route.evidenceIds), nextAction: "Publish consent purposes before collecting analytics or reported influence." },
-        { key: "end_to_end_outcome", state: "not_configured", evidenceIds: [], nextAction: "Run a non-customer subscription outcome canary after revenue verification." }
+        { key: "observed_event_verification", state: candidates.some((candidate) => candidate.disposition === "recommended") ? "in_progress" : "not_configured", evidenceIds: candidates.filter((candidate) => candidate.disposition === "recommended").map((candidate) => candidate.candidateId), nextAction: "Verify at least one configured outcome event; browser evidence does not prove paid revenue." }
       ] } : {},
       readiness: readiness2,
       backlog: (input.backlog ?? []).map((item) => ({ ...item, revision })),
@@ -50544,390 +50546,8 @@ var AnalyticsSiteSetupService = class {
   }
 };
 
-// src/api/analytics-revenue-setup.ts
-import { createHash as createHash40, randomUUID as randomUUID33 } from "crypto";
-
-// src/api/analytics-revenue-authority.ts
-import { createHash as createHash39, createHmac as createHmac12, randomUUID as randomUUID32 } from "crypto";
-function requiredText2(value, name, maximum) {
-  if (typeof value !== "string" || !value.trim() || value.trim().length > maximum)
-    throw new AnalyticsRepositoryError("analytics_revenue_outcome_invalid", `${name} is invalid.`);
-  return value.trim();
-}
-function opaqueProviderRef(value, name) {
-  const normalized = requiredText2(value, name, 300);
-  if (normalized.includes("@")) {
-    throw new AnalyticsRepositoryError(
-      "analytics_revenue_customer_binding_required",
-      `${name} must be an opaque provider reference; email is not identity evidence.`
-    );
-  }
-  return normalized;
-}
-async function setPrimaryRevenueAuthority(input) {
-  const db = input.db ?? getAnalyticsPool();
-  const client2 = await db.connect();
-  const provider = requiredText2(input.provider, "provider", 80).toLowerCase();
-  const sourceAccountRef = opaqueProviderRef(input.sourceAccountRef, "sourceAccountRef");
-  const outcomeFamily = input.outcomeFamily ?? "subscription_revenue";
-  const role = input.role ?? "primary";
-  const state2 = input.state ?? "configured_unverified";
-  try {
-    await client2.query("BEGIN");
-    await requireAnalyticsEditor(client2, input.siteId, input.userId);
-    if (role === "primary") {
-      await client2.query(
-        `UPDATE analytics_revenue_authorities
-            SET authority_role='observation',current_revision=current_revision+1,
-                updated_at=now()
-          WHERE site_id=$1 AND outcome_family=$2 AND authority_role='primary'
-            AND state<>'disabled'
-            AND NOT (provider=$3 AND source_account_ref=$4)`,
-        [input.siteId, outcomeFamily, provider, sourceAccountRef]
-      );
-    }
-    const authorityId = input.authorityId ?? randomUUID32();
-    const result3 = await client2.query(
-      `INSERT INTO analytics_revenue_authorities(
-         authority_id,site_id,provider,source_account_ref,connection_id,
-         outcome_family,authority_role,state,current_revision,created_by_user_id
-       ) VALUES($1,$2,$3,$4,$5,$6,$7,$8,1,$9)
-       ON CONFLICT(site_id,provider,source_account_ref,outcome_family)
-       DO UPDATE SET connection_id=EXCLUDED.connection_id,
-         authority_role=EXCLUDED.authority_role,state=EXCLUDED.state,
-         current_revision=analytics_revenue_authorities.current_revision+1,
-         updated_at=now(),disabled_at=CASE WHEN EXCLUDED.state='disabled' THEN now() ELSE NULL END
-       RETURNING authority_id,authority_role,state,current_revision`,
-      [
-        authorityId,
-        input.siteId,
-        provider,
-        sourceAccountRef,
-        input.connectionId ?? null,
-        outcomeFamily,
-        role,
-        state2,
-        input.userId
-      ]
-    );
-    await client2.query("COMMIT");
-    return {
-      authorityId: result3.rows[0].authority_id,
-      role: result3.rows[0].authority_role,
-      state: result3.rows[0].state,
-      revision: result3.rows[0].current_revision
-    };
-  } catch (error) {
-    await client2.query("ROLLBACK").catch(() => void 0);
-    throw error;
-  } finally {
-    client2.release();
-  }
-}
-
-// src/api/analytics-revenue-setup.ts
-function stable(value) {
-  if (Array.isArray(value)) return value.map(stable);
-  if (!value || typeof value !== "object") return value;
-  return Object.fromEntries(Object.entries(value).sort(([left], [right]) => left.localeCompare(right)).map(([key3, item]) => [key3, stable(item)]));
-}
-function fingerprint4(value) {
-  return createHash40("sha256").update(JSON.stringify(stable(value))).digest("hex");
-}
-function requiredText3(value, field, max = 240) {
-  if (typeof value !== "string" || !value.trim()) {
-    throw new AnalyticsRepositoryError("analytics_revenue_setup_invalid", `${field} is required.`, 400);
-  }
-  const normalized = value.trim();
-  if (normalized.length > max) {
-    throw new AnalyticsRepositoryError("analytics_revenue_setup_invalid", `${field} exceeds its size limit.`, 400);
-  }
-  return normalized;
-}
-function safeConnection(connection) {
-  if (!connection || connection.lifecycleStatus !== "connected") {
-    throw new AnalyticsRepositoryError(
-      "analytics_revenue_connection_unavailable",
-      "Choose a connected Stripe revenue account before continuing.",
-      409
-    );
-  }
-  if (connection.providerConfigKey !== "stripe_revenue") {
-    throw new AnalyticsRepositoryError(
-      "analytics_revenue_connection_provider_invalid",
-      "The selected connection is not an approved Stripe revenue connection.",
-      409
-    );
-  }
-  if (!connection.providerAccountId || !/^acct_[A-Za-z0-9]+$/.test(connection.providerAccountId) || !connection.providerIdentityCheckedAt) {
-    throw new AnalyticsRepositoryError(
-      "analytics_revenue_provider_identity_unverified",
-      "Stripe account identity must be verified before revenue setup.",
-      409
-    );
-  }
-  return connection;
-}
-function publicPlan2(row) {
-  return {
-    ...row.plan,
-    setupId: row.setup_id,
-    siteId: row.site_id,
-    revision: row.revision,
-    state: row.state,
-    authorityId: row.authority_id,
-    createdAt: new Date(row.created_at).toISOString()
-  };
-}
-async function currentRow(db, siteId, setupId, lock = false) {
-  const result3 = await db.query(
-    `SELECT setup_id,site_id,revision,authority_id,state,plan,created_at
-       FROM analytics_revenue_setup_revisions
-      WHERE site_id=$1 AND setup_id=$2
-      ORDER BY revision DESC LIMIT 1${lock ? " FOR UPDATE" : ""}`,
-    [siteId, setupId]
-  );
-  if (!result3.rows[0]) {
-    throw new AnalyticsRepositoryError("analytics_revenue_setup_not_found", "Revenue setup not found.", 404);
-  }
-  return result3.rows[0];
-}
-async function idempotentReceipt(input) {
-  const result3 = await input.db.query(
-    `SELECT request_fingerprint,receipt FROM analytics_revenue_setup_receipts
-      WHERE site_id=$1 AND idempotency_key=$2`,
-    [input.siteId, input.idempotencyKey]
-  );
-  const receipt4 = result3.rows[0];
-  if (!receipt4) return null;
-  if (receipt4.request_fingerprint !== input.requestFingerprint) {
-    throw new AnalyticsRepositoryError(
-      "analytics_revenue_setup_idempotency_conflict",
-      "The idempotency key was reused with a different request.",
-      409
-    );
-  }
-  return receipt4.receipt.setup;
-}
-async function appendReceipt(input) {
-  await input.db.query(
-    `INSERT INTO analytics_revenue_setup_receipts(
-       receipt_id,setup_id,site_id,revision,operation,status,idempotency_key,request_fingerprint,receipt
-     ) VALUES($1,$2,$3,$4,$5,$6,$7,$8,$9::jsonb)`,
-    [
-      randomUUID33(),
-      input.setup.setupId,
-      input.setup.siteId,
-      input.setup.revision,
-      input.operation,
-      input.setup.state,
-      input.idempotencyKey,
-      input.requestFingerprint,
-      JSON.stringify({ setup: input.setup })
-    ]
-  );
-}
-async function prepareAnalyticsRevenueSetup(input) {
-  const db = input.db ?? getAnalyticsPool();
-  const serviceConnectionRef = requiredText3(input.serviceConnectionRef, "serviceConnectionRef");
-  const role = input.role ?? "primary";
-  const idempotencyKey4 = requiredText3(input.idempotencyKey, "idempotencyKey");
-  const requestFingerprint3 = fingerprint4({ siteId: input.siteId, serviceConnectionRef, role });
-  await requireAnalyticsEditor(db, input.siteId, input.userId);
-  const replay = await idempotentReceipt({ db, siteId: input.siteId, idempotencyKey: idempotencyKey4, requestFingerprint: requestFingerprint3 });
-  if (replay) return replay;
-  const connection = safeConnection(await getOwnedServiceConnection(input.ownerIdentity, serviceConnectionRef));
-  const setupId = randomUUID33();
-  const now = (/* @__PURE__ */ new Date()).toISOString();
-  const plan = {
-    schemaVersion: 1,
-    setupId,
-    siteId: input.siteId,
-    revision: 1,
-    state: "prepared",
-    authorityId: null,
-    provider: "stripe_revenue",
-    serviceConnectionRef,
-    providerAccountRef: connection.providerAccountId,
-    providerIdentityVerifiedAt: connection.providerIdentityCheckedAt,
-    outcomeFamily: "subscription_revenue",
-    role,
-    eventFamilies: ["subscription", "invoice", "refund", "credit_note"],
-    verification: { status: "not_started", receiptRef: null, evidenceKind: null, testClass: null },
-    nextAction: "Review the Stripe account, authority role, and event families, then apply this exact revision.",
-    createdAt: now
-  };
-  const client2 = await db.connect();
-  try {
-    await client2.query("BEGIN");
-    await requireAnalyticsEditor(client2, input.siteId, input.userId);
-    const concurrentReplay = await idempotentReceipt({ db: client2, siteId: input.siteId, idempotencyKey: idempotencyKey4, requestFingerprint: requestFingerprint3 });
-    if (concurrentReplay) {
-      await client2.query("COMMIT");
-      return concurrentReplay;
-    }
-    await insertAnalyticsRevenueSetupRevision({
-      db: client2,
-      setupId,
-      siteId: input.siteId,
-      expectedRevision: 0,
-      state: plan.state,
-      plan,
-      requestFingerprint: requestFingerprint3,
-      createdByUserId: input.userId
-    });
-    await appendReceipt({ db: client2, setup: plan, operation: "prepare", idempotencyKey: idempotencyKey4, requestFingerprint: requestFingerprint3 });
-    await client2.query("COMMIT");
-    return plan;
-  } catch (error) {
-    await client2.query("ROLLBACK").catch(() => void 0);
-    throw error;
-  } finally {
-    client2.release();
-  }
-}
-async function currentAnalyticsRevenueSetup(input) {
-  const db = input.db ?? getAnalyticsPool();
-  await requireAnalyticsAccess(db, input.siteId, input.userId);
-  return publicPlan2(await currentRow(db, input.siteId, input.setupId));
-}
-async function currentAnalyticsRevenueSetupForOwner(input) {
-  const db = input.db ?? getAnalyticsPool();
-  const result3 = await db.query(
-    `SELECT revision_row.setup_id,revision_row.site_id,revision_row.revision,
-            revision_row.authority_id,revision_row.state,revision_row.plan,revision_row.created_at
-       FROM analytics_revenue_setup_revisions revision_row
-       JOIN analytics_site_grants grant_row
-         ON grant_row.site_id=revision_row.site_id
-        AND grant_row.user_id=$2 AND grant_row.role='owner'
-      WHERE revision_row.setup_id=$1
-      ORDER BY revision_row.revision DESC LIMIT 1`,
-    [input.setupId, input.userId]
-  );
-  if (!result3.rows[0]) {
-    throw new AnalyticsRepositoryError(
-      "analytics_revenue_setup_not_found",
-      "No owner-authorized revenue setup was found.",
-      404
-    );
-  }
-  return publicPlan2(result3.rows[0]);
-}
-async function applyAnalyticsRevenueSetup(input) {
-  const db = input.db ?? getAnalyticsPool();
-  await requireAnalyticsEditor(db, input.siteId, input.userId);
-  const idempotencyKey4 = requiredText3(input.idempotencyKey, "idempotencyKey");
-  const requestFingerprint3 = fingerprint4({ setupId: input.setupId, revision: input.revision, confirmed: input.confirmed });
-  const replay = await idempotentReceipt({ db, siteId: input.siteId, idempotencyKey: idempotencyKey4, requestFingerprint: requestFingerprint3 });
-  if (replay) return replay;
-  const current = publicPlan2(await currentRow(db, input.siteId, input.setupId));
-  if (current.revision !== input.revision) {
-    throw new AnalyticsRepositoryError("analytics_revenue_setup_stale_revision", `Revenue setup revision ${input.revision} is stale; current revision is ${current.revision}.`, 409);
-  }
-  const connection = safeConnection(await getOwnedServiceConnection(input.ownerIdentity, current.serviceConnectionRef));
-  if (connection.providerAccountId !== current.providerAccountRef) {
-    throw new AnalyticsRepositoryError("analytics_revenue_provider_identity_changed", "The connected Stripe account changed after setup preparation.", 409);
-  }
-  const authority = await setPrimaryRevenueAuthority({
-    siteId: input.siteId,
-    userId: input.userId,
-    provider: current.provider,
-    sourceAccountRef: current.providerAccountRef,
-    outcomeFamily: current.outcomeFamily,
-    role: current.role,
-    state: "configured_unverified",
-    db
-  });
-  const next = {
-    ...current,
-    revision: current.revision + 1,
-    state: "configured_unverified",
-    authorityId: authority.authorityId,
-    verification: { status: "missing_provider_receipt", receiptRef: null, evidenceKind: null, testClass: null },
-    nextAction: "Run provider verification. X-Ray requires a signed webhook or reconciliation receipt from a non-customer test account."
-  };
-  await insertAnalyticsRevenueSetupRevision({
-    db,
-    setupId: next.setupId,
-    siteId: next.siteId,
-    expectedRevision: current.revision,
-    authorityId: next.authorityId,
-    state: next.state,
-    plan: next,
-    requestFingerprint: requestFingerprint3,
-    createdByUserId: input.userId
-  });
-  await appendReceipt({ db, setup: next, operation: "apply", idempotencyKey: idempotencyKey4, requestFingerprint: requestFingerprint3 });
-  return next;
-}
-async function verifyAnalyticsRevenueSetup(input) {
-  const db = input.db ?? getAnalyticsPool();
-  await requireAnalyticsEditor(db, input.siteId, input.userId);
-  const idempotencyKey4 = requiredText3(input.idempotencyKey, "idempotencyKey");
-  const requestFingerprint3 = fingerprint4({ setupId: input.setupId, revision: input.revision });
-  const replay = await idempotentReceipt({ db, siteId: input.siteId, idempotencyKey: idempotencyKey4, requestFingerprint: requestFingerprint3 });
-  if (replay) return replay;
-  const current = publicPlan2(await currentRow(db, input.siteId, input.setupId));
-  if (current.revision !== input.revision) {
-    throw new AnalyticsRepositoryError("analytics_revenue_setup_stale_revision", `Revenue setup revision ${input.revision} is stale; current revision is ${current.revision}.`, 409);
-  }
-  if (!current.authorityId) {
-    throw new AnalyticsRepositoryError("analytics_revenue_setup_not_applied", "Apply the revenue setup before verification.", 409);
-  }
-  const connection = safeConnection(await getOwnedServiceConnection(input.ownerIdentity, current.serviceConnectionRef));
-  if (connection.providerAccountId !== current.providerAccountRef) {
-    throw new AnalyticsRepositoryError("analytics_revenue_provider_identity_changed", "The connected Stripe account changed before verification.", 409);
-  }
-  const evidence = await db.query(
-    `SELECT version.receipt_ref,
-            CASE WHEN version.provenance->>'transport'='signed_webhook' THEN 'signed_webhook' ELSE 'reconciliation' END AS evidence_kind
-       FROM analytics_authoritative_outcome_versions version
-       JOIN analytics_authoritative_outcomes outcome
-         ON outcome.site_id=version.site_id AND outcome.outcome_id=version.outcome_id
-      WHERE version.site_id=$1 AND outcome.authority_id=$2
-        AND version.provenance->>'transport' IN ('signed_webhook','reconciliation')
-        AND version.provenance->>'test_class'='non_customer'
-      ORDER BY version.observed_at DESC LIMIT 1`,
-    [input.siteId, current.authorityId]
-  );
-  const receipt4 = evidence.rows[0];
-  if (!receipt4) {
-    throw new AnalyticsRepositoryError(
-      "analytics_revenue_verification_receipt_required",
-      "Verification requires a signed webhook or reconciliation receipt from an authorized non-customer account.",
-      409
-    );
-  }
-  await db.query(
-    `UPDATE analytics_revenue_authorities
-        SET state='live',current_revision=current_revision+1,updated_at=now()
-      WHERE site_id=$1 AND authority_id=$2`,
-    [input.siteId, current.authorityId]
-  );
-  const next = {
-    ...current,
-    revision: current.revision + 1,
-    state: "live",
-    verification: { status: "live", receiptRef: receipt4.receipt_ref, evidenceKind: receipt4.evidence_kind, testClass: "non_customer" },
-    nextAction: "Revenue authority is live. Monitor webhook and reconciliation health before relying on reporting."
-  };
-  await insertAnalyticsRevenueSetupRevision({
-    db,
-    setupId: next.setupId,
-    siteId: next.siteId,
-    expectedRevision: current.revision,
-    authorityId: next.authorityId,
-    state: next.state,
-    plan: next,
-    requestFingerprint: requestFingerprint3,
-    createdByUserId: input.userId
-  });
-  await appendReceipt({ db, setup: next, operation: "verify", idempotencyKey: idempotencyKey4, requestFingerprint: requestFingerprint3 });
-  return next;
-}
-
 // src/api/analytics-survey-attribution.ts
-import { createHash as createHash41, randomBytes as randomBytes5, randomUUID as randomUUID34 } from "crypto";
+import { createHash as createHash39, randomBytes as randomBytes5, randomUUID as randomUUID32 } from "crypto";
 var CREDIT_SCALE = 1e6;
 var REPORTED_IMPACT_METHODOLOGY_VERSION = "xray_observed_plus_reported_equal_selected_v1";
 var TOKEN_BYTES = 32;
@@ -50945,14 +50565,14 @@ var AnalyticsSurveyAttributionError = class extends Error {
 function fail3(code, message, status = 400) {
   throw new AnalyticsSurveyAttributionError(code, message, status);
 }
-function requiredText4(value, field, max) {
+function requiredText2(value, field, max) {
   if (typeof value !== "string" || !value.trim()) fail3("analytics_survey_invalid_input", `${field} is required.`);
   const normalized = value.trim();
   if (normalized.length > max) fail3("analytics_survey_invalid_input", `${field} must not exceed ${max} characters.`);
   return normalized;
 }
 function optionId(value) {
-  const normalized = requiredText4(value, "optionId", 80).toLowerCase();
+  const normalized = requiredText2(value, "optionId", 80).toLowerCase();
   if (!/^[a-z][a-z0-9_-]{0,79}$/u.test(normalized)) {
     fail3("analytics_survey_invalid_option", "Survey option IDs must be stable lowercase identifiers.");
   }
@@ -50973,7 +50593,7 @@ function normalizeOptions(input) {
     const id2 = optionId(raw.optionId);
     if (seen.has(id2)) fail3("analytics_survey_duplicate_option", `Survey option ${id2} is duplicated.`);
     seen.add(id2);
-    return { optionId: id2, label: requiredText4(raw.label, "option label", 160), position };
+    return { optionId: id2, label: requiredText2(raw.label, "option label", 160), position };
   });
 }
 function normalizeOutcomeFamilies(values) {
@@ -50981,23 +50601,23 @@ function normalizeOutcomeFamilies(values) {
     fail3("analytics_survey_invalid_outcomes", "At least one eligible outcome family is required.");
   }
   return [...new Set(values.map((value) => {
-    const normalized = requiredText4(value, "eligible outcome family", 80).toLowerCase();
+    const normalized = requiredText2(value, "eligible outcome family", 80).toLowerCase();
     if (!/^[a-z][a-z0-9_.-]{0,79}$/u.test(normalized)) {
       fail3("analytics_survey_invalid_outcomes", `Invalid eligible outcome family ${normalized}.`);
     }
     return normalized;
   }))].sort();
 }
-function stable2(value) {
-  if (Array.isArray(value)) return value.map(stable2);
+function stable(value) {
+  if (Array.isArray(value)) return value.map(stable);
   if (!value || typeof value !== "object") return value;
-  return Object.fromEntries(Object.entries(value).sort(([left], [right]) => left.localeCompare(right)).map(([key3, item]) => [key3, stable2(item)]));
+  return Object.fromEntries(Object.entries(value).sort(([left], [right]) => left.localeCompare(right)).map(([key3, item]) => [key3, stable(item)]));
 }
-function fingerprint5(value) {
-  return createHash41("sha256").update(JSON.stringify(stable2(value))).digest("hex");
+function fingerprint4(value) {
+  return createHash39("sha256").update(JSON.stringify(stable(value))).digest("hex");
 }
 function tokenDigest(value) {
-  return createHash41("sha256").update(value).digest("hex");
+  return createHash39("sha256").update(value).digest("hex");
 }
 function opaqueToken(prefix) {
   return `${prefix}_${randomBytes5(TOKEN_BYTES).toString("base64url")}`;
@@ -51052,23 +50672,23 @@ async function readSurvey(db, siteId, surveyId, lock = false, requestedRevision)
   };
 }
 async function createPostPurchaseSurveyDraft(input) {
-  const siteId = requiredText4(input.siteId, "siteId", 100);
-  const idempotencyKey4 = requiredText4(input.idempotencyKey, "idempotencyKey", 200);
+  const siteId = requiredText2(input.siteId, "siteId", 100);
+  const idempotencyKey4 = requiredText2(input.idempotencyKey, "idempotencyKey", 200);
   const options = normalizeOptions(input.options);
   const record7 = {
-    name: requiredText4(input.name, "name", 160),
-    question: requiredText4(input.question, "question", 500),
+    name: requiredText2(input.name, "name", 160),
+    question: requiredText2(input.question, "question", 500),
     selectionMode: input.selectionMode,
     eligibleOutcomeFamilies: normalizeOutcomeFamilies(input.eligibleOutcomeFamilies),
     exchangeTtlSeconds: ttl(input.exchangeTtlSeconds, "exchangeTtlSeconds"),
     sessionTtlSeconds: ttl(input.sessionTtlSeconds, "sessionTtlSeconds"),
-    approvedCopyId: input.approvedCopyId ? requiredText4(input.approvedCopyId, "approvedCopyId", 200) : null,
+    approvedCopyId: input.approvedCopyId ? requiredText2(input.approvedCopyId, "approvedCopyId", 200) : null,
     options
   };
   if (record7.selectionMode !== "single" && record7.selectionMode !== "multiple") {
     fail3("analytics_survey_invalid_selection_mode", "selectionMode must be single or multiple.");
   }
-  const requestFingerprint3 = fingerprint5(record7);
+  const requestFingerprint3 = fingerprint4(record7);
   return transaction(input.db, async (db) => {
     const replay = await db.query(
       `SELECT survey_id,create_request_fingerprint FROM analytics_post_purchase_surveys
@@ -51081,7 +50701,7 @@ async function createPostPurchaseSurveyDraft(input) {
       }
       return { ...await readSurvey(db, siteId, replay.rows[0].survey_id), created: false };
     }
-    const surveyId = randomUUID34();
+    const surveyId = randomUUID32();
     await db.query(
       `INSERT INTO analytics_post_purchase_surveys(
          survey_id,site_id,current_revision,state,name,question,selection_mode,eligible_outcome_families,
@@ -51124,8 +50744,8 @@ async function transitionPostPurchaseSurvey(input) {
   if (!Number.isInteger(input.expectedRevision) || input.expectedRevision < 1) {
     fail3("analytics_survey_invalid_revision", "expectedRevision must be a positive integer.");
   }
-  const idempotencyKey4 = requiredText4(input.idempotencyKey, "idempotencyKey", 240);
-  const requestFingerprint3 = fingerprint5({
+  const idempotencyKey4 = requiredText2(input.idempotencyKey, "idempotencyKey", 240);
+  const requestFingerprint3 = fingerprint4({
     surveyId: input.surveyId,
     expectedRevision: input.expectedRevision,
     nextState: input.nextState,
@@ -51157,7 +50777,7 @@ async function transitionPostPurchaseSurvey(input) {
     if (!ALLOWED_TRANSITIONS[survey.state].includes(input.nextState)) {
       fail3("analytics_survey_invalid_transition", `Survey state ${survey.state} cannot transition to ${input.nextState}.`, 409);
     }
-    const approvedCopyId = input.approvedCopyId ? requiredText4(input.approvedCopyId, "approvedCopyId", 200) : survey.approvedCopyId;
+    const approvedCopyId = input.approvedCopyId ? requiredText2(input.approvedCopyId, "approvedCopyId", 200) : survey.approvedCopyId;
     if (input.nextState === "published") {
       if (!approvedCopyId) fail3("analytics_survey_copy_approval_required", "Published surveys require an approved disclosure copy ID.", 409);
       if (survey.options.length < 2) fail3("analytics_survey_options_required", "Published surveys require at least two active options.", 409);
@@ -51198,7 +50818,7 @@ async function transitionPostPurchaseSurvey(input) {
   });
 }
 async function exchangePostPurchaseSurveyCode(input) {
-  const code = requiredText4(input.exchangeCode, "exchangeCode", 200);
+  const code = requiredText2(input.exchangeCode, "exchangeCode", 200);
   if (!code.startsWith("xse_")) fail3("analytics_survey_exchange_invalid", "The survey exchange code is invalid.", 404);
   return transaction(input.db, async (db) => {
     const now = new Date(input.now ?? (/* @__PURE__ */ new Date()).toISOString());
@@ -51227,14 +50847,14 @@ async function exchangePostPurchaseSurveyCode(input) {
   });
 }
 async function redeemPostPurchaseSurveyInvite(input) {
-  const sessionToken = requiredText4(input.sessionToken, "sessionToken", 200);
+  const sessionToken = requiredText2(input.sessionToken, "sessionToken", 200);
   if (!sessionToken.startsWith("xss_")) fail3("analytics_survey_session_invalid", "The survey session is invalid.", 404);
   if (!Array.isArray(input.selectedOptionIds)) fail3("analytics_survey_invalid_response", "selectedOptionIds must be an array.");
   const selectedOptionIds = [...new Set(input.selectedOptionIds.map(optionId))].sort();
   if (selectedOptionIds.length === 0 || selectedOptionIds.length > 20) {
     fail3("analytics_survey_invalid_response", "Select between one and twenty survey options.");
   }
-  const bodyFingerprint = fingerprint5({ selectedOptionIds });
+  const bodyFingerprint = fingerprint4({ selectedOptionIds });
   return transaction(input.db, async (db) => {
     const now = new Date(input.now ?? (/* @__PURE__ */ new Date()).toISOString());
     if (!Number.isFinite(now.getTime())) fail3("analytics_survey_invalid_time", "now must be a valid timestamp.");
@@ -51276,7 +50896,7 @@ async function redeemPostPurchaseSurveyInvite(input) {
     if (options.rows.length !== selectedOptionIds.length) {
       fail3("analytics_survey_option_unavailable", "One or more selected survey options are unavailable.", 409);
     }
-    const responseId = randomUUID34();
+    const responseId = randomUUID32();
     await db.query(
       `INSERT INTO analytics_post_purchase_survey_responses(
          response_id,site_id,survey_id,survey_revision,conversion_id,invite_id,body_fingerprint,submitted_at
@@ -51294,7 +50914,7 @@ async function redeemPostPurchaseSurveyInvite(input) {
     );
     const evidence = [];
     for (const option of options.rows) {
-      const evidenceId = randomUUID34();
+      const evidenceId = randomUUID32();
       await db.query(
         `INSERT INTO analytics_reported_influences(
            evidence_id,site_id,response_id,conversion_id,survey_id,survey_revision,option_id,option_label
@@ -51526,7 +51146,7 @@ function buildObservedPlusReportedImpact(input) {
 }
 
 // src/api/analytics-provider-view-evidence.ts
-import { createHash as createHash42, randomUUID as randomUUID35 } from "crypto";
+import { createHash as createHash40, randomUUID as randomUUID33 } from "crypto";
 var ANALYTICS_VIEW_EVIDENCE_RESEARCH_DATE = "2026-09-01";
 var ANALYTICS_VIEW_EVIDENCE_PROVIDERS = [
   "meta",
@@ -51700,7 +51320,7 @@ var PostgresAnalyticsSiteSetupStore = class {
 };
 
 // src/api/analytics-product-health.ts
-import { createHash as createHash43, randomUUID as randomUUID36 } from "crypto";
+import { createHash as createHash41, randomUUID as randomUUID34 } from "crypto";
 var ANALYTICS_PRODUCT_MILESTONES = [
   "xray_opened",
   "setup_started",
@@ -51727,7 +51347,7 @@ function asIso2(value) {
 }
 function safeReference(kind, value) {
   if (!value) return null;
-  return `${kind}:${createHash43("sha256").update(value).digest("hex").slice(0, 16)}`;
+  return `${kind}:${createHash41("sha256").update(value).digest("hex").slice(0, 16)}`;
 }
 function numberValue(value) {
   const number = Number(value ?? 0);
@@ -51861,7 +51481,7 @@ async function getAnalyticsProductHealth(input, db = getAnalyticsPool()) {
 }
 
 // src/api/analytics-consent.ts
-import { randomUUID as randomUUID37 } from "crypto";
+import { randomUUID as randomUUID35 } from "crypto";
 import { z as z41 } from "zod";
 var ChoiceSchema = z41.enum(["granted", "denied", "unknown"]);
 var CurrentReceiptSchema = z41.object({
@@ -52016,7 +51636,7 @@ async function recordAnalyticsConsentReceipt(raw, options = {}) {
         WHERE site_id=$1 AND subject_ref=$2 FOR UPDATE`,
       [receipt4.siteId, receipt4.subjectRef]
     );
-    const id2 = randomUUID37();
+    const id2 = randomUUID35();
     const allowed = (purpose) => evaluateAnalyticsPurpose({ receipt: receipt4, purpose }).allowed;
     const inserted = await tx.query(
       `INSERT INTO analytics_consent_receipts(
@@ -52241,7 +51861,7 @@ function analyticsVisualPickerUxSdk() {
 }
 
 // src/api/analytics-privacy-lifecycle.ts
-import { randomUUID as randomUUID38 } from "crypto";
+import { randomUUID as randomUUID36 } from "crypto";
 var ANALYTICS_PRIVACY_FIELD_REGISTRY = Object.freeze([
   {
     dataClass: "necessary",
@@ -52603,7 +52223,7 @@ async function deleteAnalyticsPrivacySubject(input) {
       `INSERT INTO analytics_privacy_audits(id, site_id, namespace_ref, subject_ref, action, idempotency_key, actor_user_id, result_code, affected_counts, created_at)
        VALUES($1,$2,$3,$4,'deletion_requested',$5,$6,'running','{}'::jsonb,$7)
        ON CONFLICT(site_id, idempotency_key) DO UPDATE SET result_code='running'`,
-      [randomUUID38(), siteId, namespaceId, subject.ref, input.idempotencyKey, input.actorUserId, now]
+      [randomUUID36(), siteId, namespaceId, subject.ref, input.idempotencyKey, input.actorUserId, now]
     );
     const target = await resolveSubject(client2, { siteId, namespaceId, subject });
     const tombstones = await client2.query(
@@ -52792,7 +52412,7 @@ async function applyAnalyticsPrivacyWithdrawal(input) {
       `INSERT INTO analytics_privacy_audits(id, site_id, namespace_ref, subject_ref, action, idempotency_key, result_code, affected_counts, created_at, completed_at)
        VALUES($1,$2,$3,$4,'withdrawal_applied',$5,'completed',$6::jsonb,$7,$7)
        ON CONFLICT(site_id, idempotency_key) DO NOTHING`,
-      [randomUUID38(), siteId, namespaceId, subject.ref, input.idempotencyKey, JSON.stringify(affectedCounts), now]
+      [randomUUID36(), siteId, namespaceId, subject.ref, input.idempotencyKey, JSON.stringify(affectedCounts), now]
     );
     if (ownsTransaction) await client2.query("COMMIT");
     return { affectedCounts };
@@ -52969,7 +52589,7 @@ async function drainAnalyticsPrivacyLifecycle(input = {}) {
 }
 
 // src/api/analytics-crm-sync.ts
-import { createHash as createHash44 } from "crypto";
+import { createHash as createHash42 } from "crypto";
 var VERIFIED_READ_SCOPES = Object.freeze({
   hubspot: ["crm.objects.deals.read"],
   salesforce: ["api"],
@@ -53035,7 +52655,7 @@ async function previewAnalyticsCrmSync(input) {
   };
 }
 function stableId2(prefix, input) {
-  return `${prefix}_${createHash44("sha256").update(JSON.stringify(input)).digest("hex").slice(0, 24)}`;
+  return `${prefix}_${createHash42("sha256").update(JSON.stringify(input)).digest("hex").slice(0, 24)}`;
 }
 function isRecord5(value) {
   return Boolean(value) && typeof value === "object" && !Array.isArray(value);
@@ -53208,7 +52828,7 @@ async function cancelAnalyticsCrmSync(input) {
 }
 
 // src/api/analytics-prediction.ts
-import { randomUUID as randomUUID39 } from "crypto";
+import { randomUUID as randomUUID37 } from "crypto";
 import { z as z42 } from "zod";
 function createAnalyticsPredictionTables() {
   return { targets: /* @__PURE__ */ new Map(), manifests: /* @__PURE__ */ new Map(), results: [] };
@@ -53255,7 +52875,7 @@ function targetKey(namespaceId, targetId) {
 }
 function registerAnalyticsPredictionTarget(input) {
   const parsed = TargetInputSchema.parse(input.target);
-  const id2 = input.id ?? randomUUID39();
+  const id2 = input.id ?? randomUUID37();
   const key3 = targetKey(parsed.namespaceId, id2);
   const existing = input.tables.targets.get(key3);
   if (existing && input.expectedVersion !== existing.version) throw new AnalyticsPredictionError("analytics_prediction_version_conflict", "The prediction target changed; reload before updating.");
@@ -53312,7 +52932,7 @@ function analyticsContractRequestId(c) {
   const existing = analyticsRequestIds.get(c.req.raw);
   if (existing) return existing;
   const supplied = c.req.header("x-request-id");
-  const requestId = supplied && supplied.length <= 160 && /^[a-zA-Z0-9._:-]+$/.test(supplied) ? supplied : randomUUID40();
+  const requestId = supplied && supplied.length <= 160 && /^[a-zA-Z0-9._:-]+$/.test(supplied) ? supplied : randomUUID38();
   analyticsRequestIds.set(c.req.raw, requestId);
   return requestId;
 }
@@ -53400,7 +53020,7 @@ function analyticsSiteSetupService() {
     publishManifest: async ({ record: record7, idempotencyKey: idempotencyKey4 }) => {
       const hostname = new URL(record7.startUrl).hostname.toLowerCase().replace(/\.$/, "");
       const uuidFor = (value) => {
-        const hex = createHash45("sha256").update(`${record7.siteId}:${value}`).digest("hex").slice(0, 32).split("");
+        const hex = createHash43("sha256").update(`${record7.siteId}:${value}`).digest("hex").slice(0, 32).split("");
         hex[12] = "4";
         hex[16] = ["8", "9", "a", "b"][Number.parseInt(hex[16], 16) % 4];
         return `${hex.slice(0, 8).join("")}-${hex.slice(8, 12).join("")}-${hex.slice(12, 16).join("")}-${hex.slice(16, 20).join("")}-${hex.slice(20).join("")}`;
@@ -53539,7 +53159,7 @@ function isRecord6(value) {
   return Boolean(value) && typeof value === "object" && !Array.isArray(value);
 }
 function analyticsPrivacyRequestFingerprint(siteId, operation, body3) {
-  return createHash45("sha256").update(canonicalRequest({ siteId, operation, body: { ...body3, idempotencyKey: void 0 } })).digest("hex");
+  return createHash43("sha256").update(canonicalRequest({ siteId, operation, body: { ...body3, idempotencyKey: void 0 } })).digest("hex");
 }
 function privacyIdempotency(c, body3, siteId, operation) {
   const header = c.req.header("Idempotency-Key")?.trim();
@@ -53547,8 +53167,8 @@ function privacyIdempotency(c, body3, siteId, operation) {
   if (header && legacy && header !== legacy) throw new AnalyticsRepositoryError("analytics_invalid_request", "Idempotency-Key header and body key must match.", 400);
   const key3 = header || legacy;
   if (key3.length < 8 || key3.length > 240) throw new AnalyticsRepositoryError("analytics_invalid_request", "Idempotency-Key is required (8-240 characters).", 400);
-  const fingerprint6 = analyticsPrivacyRequestFingerprint(siteId, operation, body3);
-  return { key: key3, fingerprint: fingerprint6 };
+  const fingerprint5 = analyticsPrivacyRequestFingerprint(siteId, operation, body3);
+  return { key: key3, fingerprint: fingerprint5 };
 }
 function manualImportPreviewOrThrow(input) {
   try {
@@ -53558,8 +53178,8 @@ function manualImportPreviewOrThrow(input) {
     throw new AnalyticsRepositoryError(code, code === "analytics_manual_import_row_limit" ? "Import files are limited to 2,500 rows per batch." : "The CSV or TSV could not be parsed.", 400);
   }
 }
-function assertAnalyticsPrivacyIdempotencyFingerprint(row, fingerprint6) {
-  if (row.request_fingerprint !== fingerprint6) throw new AnalyticsRepositoryError("idempotency_conflict", "This Idempotency-Key was already used for a different X-Ray privacy request.", 409);
+function assertAnalyticsPrivacyIdempotencyFingerprint(row, fingerprint5) {
+  if (row.request_fingerprint !== fingerprint5) throw new AnalyticsRepositoryError("idempotency_conflict", "This Idempotency-Key was already used for a different X-Ray privacy request.", 409);
 }
 function analyticsConsentWithdrawalPublicResponse(receipt4, replayed = false) {
   if (!receipt4 || typeof receipt4 !== "object" || Array.isArray(receipt4)) {
@@ -54346,7 +53966,7 @@ analyticsApp.get("/v1/pixels/:publicPixelId/event-definitions", async (c) => {
   });
 });
 function deterministicRuntimeManifestId(siteId) {
-  const hex = createHash45("sha256").update(`xray-runtime-manifest:${siteId}`).digest("hex").slice(0, 32).split("");
+  const hex = createHash43("sha256").update(`xray-runtime-manifest:${siteId}`).digest("hex").slice(0, 32).split("");
   hex[12] = "4";
   hex[16] = ["8", "9", "a", "b"][Number.parseInt(hex[16], 16) % 4];
   return `${hex.slice(0, 8).join("")}-${hex.slice(8, 12).join("")}-${hex.slice(12, 16).join("")}-${hex.slice(16, 20).join("")}-${hex.slice(20).join("")}`;
@@ -54601,8 +54221,8 @@ analyticsApp.post("/forms/:publicId/submissions", async (c) => {
   const firstName = typeof data.first_name === "string" ? data.first_name.trim() : "";
   const lastName = typeof data.last_name === "string" ? data.last_name.trim() : "";
   const fullName = [firstName, lastName].filter(Boolean).join(" ") || (typeof data.name === "string" ? data.name.trim() : "") || email || "Website lead";
-  const identitySeed = email || phone.replace(/\D/g, "") || randomUUID40();
-  const suffix2 = createHash45("sha256").update(identitySeed).digest("hex").slice(0, 12);
+  const identitySeed = email || phone.replace(/\D/g, "") || randomUUID38();
+  const suffix2 = createHash43("sha256").update(identitySeed).digest("hex").slice(0, 12);
   const path5 = `Leads/person-${suffix2}`;
   const crmPersonRef = `People::${path5}`;
   const { key: memoryKey, error: memoryKeyError } = await getOrCreateUserMemoryKey(user);
@@ -54694,9 +54314,9 @@ Submitted the published form.
     });
   }
   const match = {
-    ...email ? { emailSha256: createHash45("sha256").update(email).digest("hex") } : {},
+    ...email ? { emailSha256: createHash43("sha256").update(email).digest("hex") } : {},
     ...phone ? {
-      phoneSha256: createHash45("sha256").update(phone.replace(/\D/g, "")).digest("hex")
+      phoneSha256: createHash43("sha256").update(phone.replace(/\D/g, "")).digest("hex")
     } : {}
   };
   const conversionOccurredAt = (/* @__PURE__ */ new Date()).toISOString();
@@ -54823,7 +54443,7 @@ analyticsApp.post("/v1/events", async (c) => {
             if (rule.condition.eventName && rule.condition.eventName !== event2.eventName) continue;
             const tags = Array.isArray(event2.properties?.tags) ? event2.properties.tags.map(String) : [];
             if ((rule.condition.excludedTags ?? []).some((tag) => tags.includes(tag))) continue;
-            const sourceEventId = `browser-rule:${rule.id}:${createHash45("sha256").update(event2.eventId).digest("hex").slice(0, 32)}`;
+            const sourceEventId = `browser-rule:${rule.id}:${createHash43("sha256").update(event2.eventId).digest("hex").slice(0, 32)}`;
             const valueMinor = Number(rule.default_value_minor ?? 0);
             await createAnalyticsConversion({
               userId: ownerUserId2,
@@ -54982,7 +54602,7 @@ analyticsApp.post("/v1/webhooks/:provider/:connectionId", async (c) => {
       connectionId: connection.id,
       provider,
       sourceAccountRef: connection.sourceAccountRef,
-      sourceEventId: `invalid:${createHash45("sha256").update(rawBody).digest("hex")}`,
+      sourceEventId: `invalid:${createHash43("sha256").update(rawBody).digest("hex")}`,
       signatureStatus: "invalid"
     });
     await setAnalyticsConnectionReadiness({
@@ -55221,73 +54841,6 @@ analyticsApp.get("/sites/:siteId/site-setups/:setupId/first-answers", auth4, asy
   const answers = await analyticsSiteSetupService().firstAnswers({ ownerId: String(userId), setupId });
   return c.json({ ok: true, answers }, 200, noStore);
 });
-var RevenueSetupPrepareSchema = z43.object({
-  serviceConnectionRef: z43.string().trim().min(1).max(240),
-  role: z43.enum(["primary", "observation"]).default("primary"),
-  idempotencyKey: z43.string().trim().min(8).max(240)
-}).strict();
-var RevenueSetupMutationSchema = z43.object({
-  revision: z43.number().int().positive(),
-  confirmed: z43.literal(true).optional(),
-  idempotencyKey: z43.string().trim().min(8).max(240).optional()
-}).strict();
-analyticsApp.post("/sites/:siteId/revenue-source-setup/prepare", auth4, async (c) => {
-  const { siteId, userId, user } = await requireOwnedSite(c);
-  const body3 = await strictJson(c, RevenueSetupPrepareSchema);
-  const setup = await prepareAnalyticsRevenueSetup({
-    siteId,
-    userId,
-    ownerIdentity: user.email,
-    serviceConnectionRef: body3.serviceConnectionRef,
-    role: body3.role,
-    idempotencyKey: c.req.header("idempotency-key") ?? body3.idempotencyKey
-  });
-  return c.json({ ok: true, setup }, 201, noStore);
-});
-analyticsApp.get("/sites/:siteId/revenue-source-setups/:setupId", auth4, async (c) => {
-  const { siteId, userId } = await requireOwnedSite(c);
-  const setup = await currentAnalyticsRevenueSetup({ siteId, userId, setupId: pathParam(c, "setupId") });
-  return c.json({ ok: true, setup }, 200, noStore);
-});
-analyticsApp.get("/revenue-source-setups/:setupId", auth4, entitlementGuard, async (c) => {
-  const setup = await currentAnalyticsRevenueSetupForOwner({
-    setupId: pathParam(c, "setupId"),
-    userId: Number(c.get("user").id)
-  });
-  return c.json({ ok: true, setup }, 200, noStore);
-});
-analyticsApp.post("/sites/:siteId/revenue-source-setups/:setupId/apply", auth4, async (c) => {
-  const { siteId, userId, user } = await requireOwnedSite(c);
-  const body3 = await strictJson(c, RevenueSetupMutationSchema);
-  if (body3.confirmed !== true) throw new AnalyticsRepositoryError("analytics_revenue_setup_confirmation_required", "Confirm the reviewed revenue setup before applying it.", 400);
-  const idempotencyKey4 = c.req.header("idempotency-key") ?? body3.idempotencyKey;
-  if (!idempotencyKey4) throw new AnalyticsRepositoryError("idempotency_key_required", "Apply requires an Idempotency-Key header or body field.", 400);
-  const setup = await applyAnalyticsRevenueSetup({
-    siteId,
-    userId,
-    ownerIdentity: user.email,
-    setupId: pathParam(c, "setupId"),
-    revision: body3.revision,
-    confirmed: true,
-    idempotencyKey: idempotencyKey4
-  });
-  return c.json({ ok: true, setup }, 200, noStore);
-});
-analyticsApp.post("/sites/:siteId/revenue-source-setups/:setupId/verify", auth4, async (c) => {
-  const { siteId, userId, user } = await requireOwnedSite(c);
-  const body3 = await strictJson(c, RevenueSetupMutationSchema);
-  const idempotencyKey4 = c.req.header("idempotency-key") ?? body3.idempotencyKey;
-  if (!idempotencyKey4) throw new AnalyticsRepositoryError("idempotency_key_required", "Verify requires an Idempotency-Key header or body field.", 400);
-  const setup = await verifyAnalyticsRevenueSetup({
-    siteId,
-    userId,
-    ownerIdentity: user.email,
-    setupId: pathParam(c, "setupId"),
-    revision: body3.revision,
-    idempotencyKey: idempotencyKey4
-  });
-  return c.json({ ok: true, setup }, 200, noStore);
-});
 var PostPurchaseSurveyCreateSchema = z43.object({
   name: z43.string().trim().min(1).max(160),
   question: z43.string().trim().min(1).max(500),
@@ -55412,7 +54965,7 @@ function surveyPublicHeaders(c) {
 }
 function surveyRateLimit(c) {
   const networkRef = c.req.header("cf-connecting-ip") ?? c.req.header("x-forwarded-for")?.split(",")[0]?.trim() ?? "unknown";
-  const key3 = createHash45("sha256").update(`survey-exchange:${networkRef}`).digest("hex");
+  const key3 = createHash43("sha256").update(`survey-exchange:${networkRef}`).digest("hex");
   const now = Date.now();
   const window2 = surveyExchangeRateWindows.get(key3);
   if (!window2 || now - window2.startedAt >= 6e4) {
@@ -55435,7 +54988,7 @@ function surveyCookie(c) {
   return { siteId, sessionToken };
 }
 async function approvedSurveyExchangeSite(exchangeCode, origin) {
-  const digest23 = createHash45("sha256").update(exchangeCode).digest("hex");
+  const digest23 = createHash43("sha256").update(exchangeCode).digest("hex");
   const hostname = normalizeAnalyticsHostname(new URL(origin).hostname);
   const result3 = await getAnalyticsPool().query(
     `SELECT invite.site_id
@@ -55474,7 +55027,7 @@ analyticsApp.post("/survey/exchange", async (c) => {
   return c.redirect("/analytics/survey/session", 303);
 });
 async function readPublicSurveySession(siteId, sessionToken) {
-  const digest23 = createHash45("sha256").update(sessionToken).digest("hex");
+  const digest23 = createHash43("sha256").update(sessionToken).digest("hex");
   const session = await getAnalyticsPool().query(
     `SELECT invite.survey_id,invite.survey_revision,invite.conversion_id,invite.session_expires_at,
             survey.state,survey.name,survey.question,survey.selection_mode,survey.eligible_outcome_families,
@@ -55641,10 +55194,10 @@ analyticsApp.post("/v1/conversions", auth4, async (c) => {
         clickIds: clickIds ?? {},
         match: {
           ...normalizedEmail ? {
-            emailSha256: createHash45("sha256").update(normalizedEmail).digest("hex")
+            emailSha256: createHash43("sha256").update(normalizedEmail).digest("hex")
           } : {},
           ...normalizedPhone ? {
-            phoneSha256: createHash45("sha256").update(normalizedPhone).digest("hex")
+            phoneSha256: createHash43("sha256").update(normalizedPhone).digest("hex")
           } : {}
         }
       }),
@@ -55683,7 +55236,7 @@ analyticsApp.get("/sites/:siteId/connections", auth4, async (c) => {
   const origin = new URL(analyticsExternalRequestUrl(c)).origin;
   return c.json({
     ok: true,
-    connections: connections.map((connection) => buildAnalyticsConnectionSetupView(connection, origin))
+    connections: connections.filter((connection) => connection.provider !== "salesforce" && connection.provider !== "pipedrive").map((connection) => buildAnalyticsConnectionSetupView(connection, origin))
   });
 });
 analyticsApp.post("/sites/:siteId/connections", auth4, async (c) => {
@@ -56173,7 +55726,7 @@ analyticsApp.post("/sites/:siteId/crm-imports", auth4, async (c) => {
       rejectedCount += 1;
       continue;
     }
-    const digest23 = createHash45("sha256").update(
+    const digest23 = createHash43("sha256").update(
       `${parsed.data.sourceSystem}:${externalId || email || phone || `${fullName}:${index}`}`
     ).digest("hex").slice(0, 16);
     const path5 = `Leads/person-${digest23}`;
@@ -56897,7 +56450,7 @@ analyticsApp.post("/sites/:siteId/consent/policies", auth4, async (c) => {
      ON CONFLICT(site_id,purpose,policy_version,jurisdiction_profile) DO UPDATE SET
        retention_days=excluded.retention_days, enabled=excluded.enabled, policy=excluded.policy, retired_at=NULL
      RETURNING id,purpose,policy_version AS "policyVersion",jurisdiction_profile AS "jurisdictionProfile",retention_days AS "retentionDays",enabled,policy`,
-    [randomUUID40(), siteId, body3.purpose, body3.policyVersion, body3.jurisdictionProfile, body3.retentionDays ?? null, body3.enabled, JSON.stringify(body3.policy), userId]
+    [randomUUID38(), siteId, body3.purpose, body3.policyVersion, body3.jurisdictionProfile, body3.retentionDays ?? null, body3.enabled, JSON.stringify(body3.policy), userId]
   );
   return c.json({ ok: true, policy: result3.rows[0] }, 201, noStore);
 });
@@ -56921,7 +56474,7 @@ analyticsApp.post("/sites/:siteId/consent/withdrawals", auth4, async (c) => {
   try {
     await client2.query("BEGIN");
     await client2.query(`INSERT INTO analytics_privacy_audits(id,site_id,subject_ref,action,idempotency_key,request_fingerprint,actor_user_id,result_code)
-      VALUES($1,$2,$3,'withdrawal_applied',$4,$5,$6,'running') ON CONFLICT(site_id,idempotency_key) DO NOTHING`, [randomUUID40(), siteId, `subject:${createHash45("sha256").update(body3.subjectRef).digest("hex").slice(0, 16)}`, idem.key, idem.fingerprint, userId]);
+      VALUES($1,$2,$3,'withdrawal_applied',$4,$5,$6,'running') ON CONFLICT(site_id,idempotency_key) DO NOTHING`, [randomUUID38(), siteId, `subject:${createHash43("sha256").update(body3.subjectRef).digest("hex").slice(0, 16)}`, idem.key, idem.fingerprint, userId]);
     const claimed = await client2.query("SELECT request_fingerprint,result_code,affected_counts FROM analytics_privacy_audits WHERE site_id=$1 AND idempotency_key=$2 FOR UPDATE", [siteId, idem.key]);
     assertAnalyticsPrivacyIdempotencyFingerprint(claimed.rows[0], idem.fingerprint);
     if (claimed.rows[0].result_code === "completed") {
@@ -57028,7 +56581,7 @@ analyticsApp.post("/sites/:siteId/identity-namespaces/:namespaceId/candidates/:a
 });
 analyticsApp.get("/sites/:siteId/crm/capabilities", auth4, async (c) => {
   await requireSite(c);
-  const providers = ANALYTICS_CRM_PROVIDER_IDS.map((provider) => ({
+  const providers = ANALYTICS_PUBLIC_CRM_PROVIDER_IDS.map((provider) => ({
     profile: getAnalyticsCrmProviderProfile(provider),
     sync: getAnalyticsCrmSyncCapability(provider)
   }));
@@ -57037,7 +56590,7 @@ analyticsApp.get("/sites/:siteId/crm/capabilities", auth4, async (c) => {
 analyticsApp.post("/sites/:siteId/crm/schema/discover", auth4, async (c) => {
   const { user, userId, siteId } = await requireSite(c, true);
   const body3 = await strictJson(c, z43.object({
-    provider: AnalyticsCrmProviderIdSchema,
+    provider: AnalyticsPublicCrmProviderIdSchema,
     connectionId: z43.string().trim().min(1).max(240),
     discoveryContext: z43.object({
       locationId: z43.string().trim().min(1).max(128).regex(/^[A-Za-z0-9_-]+$/).optional(),
@@ -57084,7 +56637,7 @@ analyticsApp.post("/sites/:siteId/crm/schema/discover", auth4, async (c) => {
 analyticsApp.post("/sites/:siteId/crm/provisioning/plan", auth4, async (c) => {
   const { siteId, userId } = await requireSite(c, true);
   const body3 = await strictJson(c, z43.object({
-    provider: AnalyticsCrmProviderIdSchema,
+    provider: AnalyticsPublicCrmProviderIdSchema,
     connectionId: z43.string().trim().min(1).max(240),
     fields: z43.array(AnalyticsCrmFieldSchema).max(5e3),
     allowedOperations: z43.array(z43.string()).max(100).optional()
@@ -57095,7 +56648,7 @@ analyticsApp.post("/sites/:siteId/crm/provisioning/plan", auth4, async (c) => {
 });
 analyticsApp.post("/sites/:siteId/crm/provisioning/approve", auth4, async (c) => {
   const { user, userId, siteId } = await requireSite(c, true);
-  const body3 = await strictJson(c, z43.object({ plan: AnalyticsCrmProvisioningPlanSchema, approvedFieldInternalNames: z43.array(z43.string().trim().min(1).max(160)).max(50) }).strict());
+  const body3 = await strictJson(c, z43.object({ plan: AnalyticsPublicCrmProvisioningPlanSchema, approvedFieldInternalNames: z43.array(z43.string().trim().min(1).max(160)).max(50) }).strict());
   const persistedPlan = await readAnalyticsCrmProvisioningPlan({ siteId, planId: body3.plan.planId });
   if (persistedPlan.requestFingerprint !== body3.plan.requestFingerprint)
     throw new AnalyticsRepositoryError("idempotency_conflict", "The submitted plan does not match the persisted plan.", 409);
@@ -57117,7 +56670,7 @@ analyticsApp.post("/sites/:siteId/crm/provisioning/approve", auth4, async (c) =>
 });
 analyticsApp.post("/sites/:siteId/crm/provisioning/test", auth4, async (c) => {
   const { user, userId, siteId } = await requireSite(c, true);
-  const body3 = await strictJson(c, z43.object({ receipt: AnalyticsCrmProvisioningReceiptSchema }).strict());
+  const body3 = await strictJson(c, z43.object({ receipt: AnalyticsPublicCrmProvisioningReceiptSchema }).strict());
   const persistedReceipt = await readAnalyticsCrmProvisioningReceipt({ siteId, receiptId: body3.receipt.receiptId });
   if (persistedReceipt.planFingerprint !== body3.receipt.planFingerprint)
     throw new AnalyticsRepositoryError("idempotency_conflict", "The submitted receipt does not match the persisted receipt.", 409);
@@ -57128,7 +56681,7 @@ analyticsApp.post("/sites/:siteId/crm/provisioning/test", auth4, async (c) => {
 analyticsApp.post("/sites/:siteId/crm/person-sync", auth4, async (c) => {
   const { user } = await requireSite(c, true);
   const body3 = await strictJson(c, z43.object({
-    provider: AnalyticsCrmProviderIdSchema,
+    provider: AnalyticsPublicCrmProviderIdSchema,
     connectionId: z43.string().trim().min(1).max(240),
     person: AnalyticsConfirmedPersonProjectionSchema,
     mapping: z43.record(z43.string(), z43.string()).optional()
@@ -57139,7 +56692,7 @@ analyticsApp.post("/sites/:siteId/crm/person-sync", auth4, async (c) => {
 analyticsApp.post("/sites/:siteId/crm/pipeline-mapping/apply", auth4, async (c) => {
   const { user } = await requireSite(c, true);
   const body3 = await strictJson(c, z43.object({
-    provider: AnalyticsCrmProviderIdSchema,
+    provider: AnalyticsPublicCrmProviderIdSchema,
     connectionId: z43.string().trim().min(1).max(240),
     person: AnalyticsConfirmedPersonProjectionSchema.pick({ identityTier: true, personId: true, deterministicIdentity: true, consentReceiptRef: true }),
     event: AnalyticsPipelineEventSchema,
@@ -57150,12 +56703,16 @@ analyticsApp.post("/sites/:siteId/crm/pipeline-mapping/apply", auth4, async (c)
 });
 analyticsApp.get("/sites/:siteId/crm/outbound-policies", auth4, async (c) => {
   const { siteId } = await requireSite(c);
-  return c.json({ ok: true, policies: await listAnalyticsCrmOutboundPolicies({ siteId }) }, 200, noStore);
+  const policies = await listAnalyticsCrmOutboundPolicies({ siteId });
+  return c.json({
+    ok: true,
+    policies: policies.filter((policy7) => policy7.provider !== "salesforce" && policy7.provider !== "pipedrive")
+  }, 200, noStore);
 });
 analyticsApp.post("/sites/:siteId/crm/outbound-policies", auth4, async (c) => {
   const { siteId, userId } = await requireSite(c, true);
   const body3 = await strictJson(c, z43.object({
-    provider: AnalyticsCrmProviderIdSchema,
+    provider: AnalyticsPublicCrmProviderIdSchema,
     connectionId: z43.string().trim().min(1).max(240),
     kind: z43.enum(["person_summary", "pipeline_event"]),
     enabled: z43.boolean(),
@@ -57168,7 +56725,7 @@ analyticsApp.post("/sites/:siteId/crm/outbound-policies", auth4, async (c) => {
     selectedEvents: z43.array(z43.string().regex(/^[a-z][a-z0-9_]{1,79}$/)).max(100),
     purpose: z43.enum(["necessary_form_fulfillment", "site_analytics", "advertising_measurement"])
   }).strict());
-  const policyId = `crmpolicy_${createHash45("sha256").update(JSON.stringify({
+  const policyId = `crmpolicy_${createHash43("sha256").update(JSON.stringify({
     siteId,
     connectionId: body3.connectionId,
     kind: body3.kind,
@@ -57199,11 +56756,12 @@ analyticsApp.post("/sites/:siteId/crm/outbound-policies", auth4, async (c) => {
 analyticsApp.get("/sites/:siteId/crm/outbound-receipts", auth4, async (c) => {
   const { siteId } = await requireSite(c);
   const limit = z43.coerce.number().int().min(1).max(100).catch(25).parse(c.req.query("limit"));
-  return c.json({ ok: true, receipts: await listAnalyticsCrmOutboundReceipts({ siteId, limit }) }, 200, noStore);
+  const receipts = await listAnalyticsCrmOutboundReceipts({ siteId, limit });
+  return c.json({ ok: true, receipts }, 200, noStore);
 });
 analyticsApp.post("/sites/:siteId/crm/sync/discover", auth4, async (c) => {
   const { user, siteId } = await requireSite(c);
-  const body3 = await strictJson(c, z43.object({ provider: AnalyticsCrmProviderIdSchema, connectionId: z43.string().trim().max(240).optional() }).strict());
+  const body3 = await strictJson(c, z43.object({ provider: AnalyticsPublicCrmProviderIdSchema, connectionId: z43.string().trim().max(240).optional() }).strict());
   const serviceConnectionRef = body3.connectionId ? await analyticsCrmServiceConnectionRef(siteId, body3.connectionId) : void 0;
   let baseDiscovery = await discoverAnalyticsCrmObjects({ provider: body3.provider });
   let discoveryContext;
@@ -57258,7 +56816,7 @@ analyticsApp.post("/sites/:siteId/crm/sync/discover", auth4, async (c) => {
 analyticsApp.post("/sites/:siteId/crm/sync/test", auth4, async (c) => {
   await requireSite(c);
   const body3 = await strictJson(c, z43.object({
-    provider: AnalyticsCrmProviderIdSchema,
+    provider: AnalyticsPublicCrmProviderIdSchema,
     mapping: AnalyticsCrmMappingSchema,
     availableObjects: z43.array(z43.object({ name: z43.string().trim().min(1).max(100), fields: z43.array(z43.string().trim().min(1).max(160)).max(1e3) }).strict()).max(100).optional()
   }).strict());
@@ -57267,7 +56825,7 @@ analyticsApp.post("/sites/:siteId/crm/sync/test", auth4, async (c) => {
 analyticsApp.post("/sites/:siteId/crm/sync/preview", auth4, async (c) => {
   const { user, siteId } = await requireSite(c, true);
   const body3 = await strictJson(c, z43.object({
-    provider: AnalyticsCrmProviderIdSchema,
+    provider: AnalyticsPublicCrmProviderIdSchema,
     connectionId: z43.string().uuid(),
     mapping: AnalyticsCrmMappingSchema
   }).strict());
@@ -57316,7 +56874,7 @@ analyticsApp.post("/sites/:siteId/crm/sync/preview", auth4, async (c) => {
 analyticsApp.post("/sites/:siteId/crm/sync/start", auth4, async (c) => {
   const { siteId } = await requireSite(c, true);
   const body3 = await strictJson(c, z43.object({
-    provider: AnalyticsCrmProviderIdSchema,
+    provider: AnalyticsPublicCrmProviderIdSchema,
     connectionId: z43.string().trim().min(1).max(240),
     mode: z43.enum(["initial", "incremental"]),
     mapping: AnalyticsCrmMappingSchema,
@@ -57356,16 +56914,25 @@ analyticsApp.post("/sites/:siteId/crm/sync/start", auth4, async (c) => {
 });
 analyticsApp.get("/sites/:siteId/crm/sync/:syncId", auth4, async (c) => {
   const { siteId } = await requireSite(c);
+  const syncId = pathParam(c, "syncId");
+  const current = await readAnalyticsCrmSyncRun({ siteId, syncId });
+  if (current && (current.provider === "salesforce" || current.provider === "pipedrive")) {
+    throw new AnalyticsRepositoryError(
+      "analytics_crm_provider_unavailable",
+      "This CRM provider integration is not currently available.",
+      409
+    );
+  }
   const status = await getAnalyticsCrmSyncStatus({
-    syncId: pathParam(c, "syncId"),
-    dependencies: { readStatus: async (syncId) => readAnalyticsCrmSyncRun({ siteId, syncId }) }
+    syncId,
+    dependencies: { readStatus: async () => current }
   });
   return c.json({ ok: true, sync: status }, 200, noStore);
 });
 analyticsApp.patch("/sites/:siteId/crm/sync/:syncId/schedule", auth4, async (c) => {
   const { siteId } = await requireSite(c, true);
   const syncId = pathParam(c, "syncId");
-  const body3 = await strictJson(c, z43.object({ provider: AnalyticsCrmProviderIdSchema, connectionId: z43.string().trim().min(1).max(240), intervalSeconds: z43.number().int().nullable() }).strict());
+  const body3 = await strictJson(c, z43.object({ provider: AnalyticsPublicCrmProviderIdSchema, connectionId: z43.string().trim().min(1).max(240), intervalSeconds: z43.number().int().nullable() }).strict());
   const schedule = await updateAnalyticsCrmSyncSchedule({
     provider: body3.provider,
     connectionId: body3.connectionId,
@@ -57381,8 +56948,17 @@ analyticsApp.patch("/sites/:siteId/crm/sync/:syncId/schedule", auth4, async (c)
 });
 analyticsApp.delete("/sites/:siteId/crm/sync/:syncId", auth4, async (c) => {
   const { siteId } = await requireSite(c, true);
-  const result3 = await cancelAnalyticsCrmSync({ syncId: pathParam(c, "syncId"), dependencies: {
-    cancel: async (syncId) => cancelAnalyticsCrmSyncRun({ siteId, syncId })
+  const syncId = pathParam(c, "syncId");
+  const current = await readAnalyticsCrmSyncRun({ siteId, syncId });
+  if (current && (current.provider === "salesforce" || current.provider === "pipedrive")) {
+    throw new AnalyticsRepositoryError(
+      "analytics_crm_provider_unavailable",
+      "This CRM provider integration is not currently available.",
+      409
+    );
+  }
+  const result3 = await cancelAnalyticsCrmSync({ syncId, dependencies: {
+    cancel: async (syncId2) => cancelAnalyticsCrmSyncRun({ siteId, syncId: syncId2 })
   } });
   return c.json({ ok: true, ...result3 }, 200, noStore);
 });
@@ -57504,7 +57080,7 @@ analyticsApp.post("/sites/:siteId/saved-views", auth4, async (c) => {
   const { siteId, userId } = await requireSite(c, true);
   const body3 = await strictJson(c, z43.object({ name: z43.string().trim().min(1).max(120), settings: z43.any(), isDefault: z43.boolean().default(false) }).strict());
   const settings = parseAnalyticsReportView(body3.settings);
-  const id2 = randomUUID40();
+  const id2 = randomUUID38();
   const client2 = await getAnalyticsPool().connect();
   try {
     await client2.query("BEGIN");
@@ -57576,7 +57152,7 @@ analyticsApp.post("/sites/:siteId/privacy/subject/export", auth4, async (c) => {
   await getAnalyticsPool().query(
     `INSERT INTO analytics_privacy_audits(id,site_id,subject_ref,action,idempotency_key,request_fingerprint,actor_user_id,result_code,affected_counts,completed_at)
      VALUES($1,$2,$3,'export_completed',$4,$5,$6,'completed',$7::jsonb,now()) ON CONFLICT(site_id,idempotency_key) DO NOTHING`,
-    [randomUUID40(), siteId, `person:${createHash45("sha256").update(body3.subjectRef).digest("hex").slice(0, 16)}`, idem.key, idem.fingerprint, userId, JSON.stringify({ export: { schemaVersion: 1, subject: person.rows[0], restrictedIdentityExcluded: true } })]
+    [randomUUID38(), siteId, `person:${createHash43("sha256").update(body3.subjectRef).digest("hex").slice(0, 16)}`, idem.key, idem.fingerprint, userId, JSON.stringify({ export: { schemaVersion: 1, subject: person.rows[0], restrictedIdentityExcluded: true } })]
   );
   const persisted = await getAnalyticsPool().query("SELECT request_fingerprint,affected_counts FROM analytics_privacy_audits WHERE site_id=$1 AND idempotency_key=$2", [siteId, idem.key]);
   assertAnalyticsPrivacyIdempotencyFingerprint(persisted.rows[0], idem.fingerprint);
@@ -57590,7 +57166,7 @@ analyticsApp.post("/sites/:siteId/privacy/subject/delete", auth4, async (c) => {
   try {
     await client2.query("BEGIN");
     await client2.query(`INSERT INTO analytics_privacy_audits(id,site_id,subject_ref,action,idempotency_key,request_fingerprint,actor_user_id,result_code)
-      VALUES($1,$2,$3,'deletion_requested',$4,$5,$6,'running') ON CONFLICT(site_id,idempotency_key) DO NOTHING`, [randomUUID40(), siteId, `subject:${createHash45("sha256").update(body3.subjectRef).digest("hex").slice(0, 16)}`, idem.key, idem.fingerprint, userId]);
+      VALUES($1,$2,$3,'deletion_requested',$4,$5,$6,'running') ON CONFLICT(site_id,idempotency_key) DO NOTHING`, [randomUUID38(), siteId, `subject:${createHash43("sha256").update(body3.subjectRef).digest("hex").slice(0, 16)}`, idem.key, idem.fingerprint, userId]);
     const claim = await client2.query("SELECT request_fingerprint,result_code,affected_counts FROM analytics_privacy_audits WHERE site_id=$1 AND idempotency_key=$2 FOR UPDATE", [siteId, idem.key]);
     assertAnalyticsPrivacyIdempotencyFingerprint(claim.rows[0], idem.fingerprint);
     if (claim.rows[0].result_code === "deleted") {
@@ -57608,7 +57184,7 @@ analyticsApp.post("/sites/:siteId/privacy/subject/delete", auth4, async (c) => {
       db: client2
     });
     const counts = { ...deletion.affectedCounts };
-    await client2.query(`UPDATE analytics_privacy_audits SET namespace_ref=$3,subject_ref=$4,action='deletion_completed',result_code='deleted',affected_counts=$5::jsonb,completed_at=now() WHERE site_id=$1 AND idempotency_key=$2`, [siteId, idem.key, `namespace:${locked.rows[0].namespace_id}`, `deleted:${createHash45("sha256").update(body3.subjectRef).digest("hex").slice(0, 16)}`, JSON.stringify(counts)]);
+    await client2.query(`UPDATE analytics_privacy_audits SET namespace_ref=$3,subject_ref=$4,action='deletion_completed',result_code='deleted',affected_counts=$5::jsonb,completed_at=now() WHERE site_id=$1 AND idempotency_key=$2`, [siteId, idem.key, `namespace:${locked.rows[0].namespace_id}`, `deleted:${createHash43("sha256").update(body3.subjectRef).digest("hex").slice(0, 16)}`, JSON.stringify(counts)]);
     await client2.query("COMMIT");
     return c.json({ ok: true, deleted: true, counts }, 200, noStore);
   } catch (error) {
@@ -57652,7 +57228,7 @@ analyticsApp.post("/sites/:siteId/privacy/namespace/delete", auth4, async (c) =>
     await client2.query(
       `INSERT INTO analytics_privacy_audits(id,site_id,namespace_ref,action,idempotency_key,actor_user_id,result_code,affected_counts,completed_at)
        VALUES($1,$2,$3,'deletion_completed',$4,$5,'deleted',$6::jsonb,now()) ON CONFLICT(site_id,idempotency_key) DO NOTHING`,
-      [randomUUID40(), siteId, `deleted:${createHash45("sha256").update(body3.namespaceId).digest("hex").slice(0, 16)}`, body3.idempotencyKey, userId, JSON.stringify(counts)]
+      [randomUUID38(), siteId, `deleted:${createHash43("sha256").update(body3.namespaceId).digest("hex").slice(0, 16)}`, body3.idempotencyKey, userId, JSON.stringify(counts)]
     );
     await client2.query("COMMIT");
     return c.json({ ok: true, deleted: true, counts }, 200, noStore);
@@ -57984,7 +57560,7 @@ async function deliverPendingAnalyticsCrmImports(limit = 10) {
 }
 
 // src/api/analytics-activation-dispatcher.ts
-import { randomUUID as randomUUID41 } from "crypto";
+import { randomUUID as randomUUID39 } from "crypto";
 function parseAnalyticsActivationDestinationProviderConfig(platform, value) {
   if (!value || typeof value !== "object" || Array.isArray(value)) return null;
   const config = value;
@@ -58063,7 +57639,7 @@ async function claimAnalyticsActivationJobs(limit = 10) {
   }));
 }
 async function beginAttempt(job, stableEventId) {
-  const id2 = randomUUID41();
+  const id2 = randomUUID39();
   const result3 = await getAnalyticsPool().query(
     `INSERT INTO analytics_activation_delivery_attempts(
        id, job_id, destination_id, mapping_version, attempt_number, provider_event_id, actor
@@ -58448,7 +58024,7 @@ async function pollPendingGoogleActivationDiagnostics(limit = 10, deadlineMs = D
 }
 
 // src/api/analytics-reconciliation.ts
-import { createHash as createHash46, randomUUID as randomUUID42 } from "crypto";
+import { createHash as createHash44, randomUUID as randomUUID40 } from "crypto";
 var RECONCILIATION_INTERVAL_SECONDS = 15 * 60;
 var WEBHOOK_ONLY_RECHECK_SECONDS = 24 * 60 * 60;
 var LEASE_SECONDS = 90;
@@ -58472,7 +58048,7 @@ var defaultDependencies2 = {
       input: input.payload,
       classification: "read",
       operationKind: "sync",
-      requestId: randomUUID42()
+      requestId: randomUUID40()
     });
   },
   async resolveMappedCrmPerson(input) {
@@ -58575,14 +58151,14 @@ function crmReadInput(provider, sourceAccountRef, cursorValue, now) {
   }
 }
 function crmOutcomeSourceEventId(outcome) {
-  const digest23 = createHash46("sha256").update(`${outcome.provider}:${outcome.sourceRecordId}:${outcome.updatedAt}:${outcome.tombstone}`).digest("hex").slice(0, 40);
+  const digest23 = createHash44("sha256").update(`${outcome.provider}:${outcome.sourceRecordId}:${outcome.updatedAt}:${outcome.tombstone}`).digest("hex").slice(0, 40);
   return `crm:${outcome.provider}:${digest23}`;
 }
 function analyticsCrmOutcomeToExternalEvent(outcome, sourceAccountRef) {
   const sourceEventId = crmOutcomeSourceEventId(outcome);
   return {
     schemaVersion: 1,
-    eventId: `crm_${createHash46("sha256").update(sourceEventId).digest("hex").slice(0, 24)}`,
+    eventId: `crm_${createHash44("sha256").update(sourceEventId).digest("hex").slice(0, 24)}`,
     sourceEventId,
     source: outcome.provider,
     sourceAccountRef,
@@ -58717,6 +58293,7 @@ async function ensureDueJobs() {
        FROM analytics_connections c
        LEFT JOIN analytics_reconciliation_jobs j ON j.connection_id=c.id
       WHERE c.readiness <> 'disabled' AND j.connection_id IS NULL
+        AND c.provider NOT IN ('salesforce','pipedrive')
         AND (
           c.provider IN ('callrail','twilio')
           OR EXISTS (
@@ -58738,7 +58315,7 @@ async function ensureDueJobs() {
     await db.query(
       `INSERT INTO analytics_reconciliation_jobs(id, connection_id)
        VALUES ($1,$2) ON CONFLICT(connection_id) DO NOTHING`,
-      [randomUUID42(), connection.id]
+      [randomUUID40(), connection.id]
     );
   }
 }
@@ -58747,10 +58324,12 @@ async function claimAnalyticsReconciliationJobs(limit = 10, leaseSeconds = LEASE
   await ensureDueJobs();
   const result3 = await getAnalyticsPool().query(
     `WITH due AS (
-       SELECT id FROM analytics_reconciliation_jobs
-        WHERE next_attempt_at <= now()
-          AND (status='pending' OR (status='leased' AND lease_until < now()))
-        ORDER BY next_attempt_at, created_at
+       SELECT j.id FROM analytics_reconciliation_jobs j
+       JOIN analytics_connections c ON c.id=j.connection_id
+        WHERE j.next_attempt_at <= now()
+          AND c.provider NOT IN ('salesforce','pipedrive')
+          AND (j.status='pending' OR (j.status='leased' AND j.lease_until < now()))
+        ORDER BY j.next_attempt_at, j.created_at
         FOR UPDATE SKIP LOCKED
         LIMIT $1
      )
@@ -58784,7 +58363,8 @@ async function loadScope(jobId2) {
           WHERE sr.site_id=c.site_id AND sr.connection_id=c.id AND sr.state <> 'cancelled'
           ORDER BY sr.created_at DESC LIMIT 1
        ) latest_sync ON true
-      WHERE j.id=$1 AND j.status='leased' AND j.lease_until > now()`,
+      WHERE j.id=$1 AND j.status='leased' AND j.lease_until > now()
+        AND c.provider NOT IN ('salesforce','pipedrive')`,
     [jobId2]
   );
   return result3.rows[0] ?? null;
@@ -58878,7 +58458,7 @@ async function deferAnalyticsReconciliationJob(input) {
       connectionId: input.connectionId,
       safeErrorCode: errorCode2,
       nextRunAt: new Date(Date.now() + delaySeconds * 1e3).toISOString(),
-      receiptFingerprint: createHash46("sha256").update(`${input.jobId}:${input.attempts}:${errorCode2}`).digest("hex")
+      receiptFingerprint: createHash44("sha256").update(`${input.jobId}:${input.attempts}:${errorCode2}`).digest("hex")
     });
   }
 }
@@ -58989,7 +58569,7 @@ async function reconcileAnalyticsConnection(job, dependencies = defaultDependenc
           deduplicated: duplicates,
           rejected: page3.rejected,
           hasMore: page3.hasMore,
-          receiptFingerprint: createHash46("sha256").update(`${job.id}:${JSON.stringify(page3.nextCursor)}:${replayed}:${duplicates}`).digest("hex"),
+          receiptFingerprint: createHash44("sha256").update(`${job.id}:${JSON.stringify(page3.nextCursor)}:${replayed}:${duplicates}`).digest("hex"),
           scheduleConfigured: Boolean(scope.sync_id),
           scheduleIntervalSeconds: scope.sync_interval_seconds ?? null
         }
@@ -59026,7 +58606,7 @@ async function drainAnalyticsReconciliation(limit = 5, deadlineMs = Date.now() +
 }
 
 // src/api/analytics-scheduled-lanes.ts
-import { randomUUID as randomUUID43 } from "crypto";
+import { randomUUID as randomUUID41 } from "crypto";
 var ANALYTICS_SCHEDULED_LANES = [
   { key: "rollup", intervalMinutes: 15, catchUpIntervals: 2, maxAttempts: 4 },
   { key: "form_delivery", intervalMinutes: 1, catchUpIntervals: 3, maxAttempts: 5 },
@@ -59073,7 +58653,7 @@ var PostgresAnalyticsScheduledOccurrenceStore = class {
              (id,lane_key,scheduled_for,status,attempt_count,max_attempts,next_attempt_at,created_at,updated_at)
            VALUES ($1,$2,$3,'pending',0,$4,$3,now(),now())
            ON CONFLICT (lane_key,scheduled_for) DO NOTHING`,
-          [randomUUID43(), definition.key, scheduledFor, definition.maxAttempts]
+          [randomUUID41(), definition.key, scheduledFor, definition.maxAttempts]
         );
         inserted += Number(result3.rowCount ?? 0);
       }
@@ -59156,7 +58736,7 @@ var PostgresAnalyticsScheduledOccurrenceStore = class {
 async function runAnalyticsScheduledLanes(executors, options = {}) {
   const store = options.store ?? new PostgresAnalyticsScheduledOccurrenceStore();
   const now = options.now ?? (() => /* @__PURE__ */ new Date());
-  const owner5 = options.owner ?? `cron:${randomUUID43()}`;
+  const owner5 = options.owner ?? `cron:${randomUUID41()}`;
   const leaseMs = options.leaseMs ?? 6e4;
   const maxClaims = options.maxClaims ?? 12;
   const firstNow = now();
@@ -59206,13 +58786,13 @@ import { Hono as Hono37 } from "hono";
 import { z as z44 } from "zod";
 
 // src/api/scheduled-artifact-owner.ts
-import { createHash as createHash47 } from "crypto";
+import { createHash as createHash45 } from "crypto";
 function scheduledArtifactOwnerIdForApiKey(apiKey) {
-  return createHash47("sha256").update(apiKey).digest("hex").slice(0, 24);
+  return createHash45("sha256").update(apiKey).digest("hex").slice(0, 24);
 }
 
 // src/api/scheduled-run-view-links.ts
-import { createHash as createHash48, randomBytes as randomBytes6, randomUUID as randomUUID44 } from "crypto";
+import { createHash as createHash46, randomBytes as randomBytes6, randomUUID as randomUUID42 } from "crypto";
 var schemaReady3 = false;
 async function ensureScheduledRunViewLinksSchema() {
   if (schemaReady3) return;
@@ -59266,7 +58846,7 @@ async function ensureScheduledRunViewLinksSchema() {
   schemaReady3 = true;
 }
 function tokenHash2(token7) {
-  return createHash48("sha256").update(token7).digest("hex");
+  return createHash46("sha256").update(token7).digest("hex");
 }
 function mapRow(row) {
   return {
@@ -59288,7 +58868,7 @@ async function createScheduledRunViewLink(input) {
   const now = input.now ?? /* @__PURE__ */ new Date();
   const token7 = randomBytes6(32).toString("base64url");
   const record7 = {
-    shareId: randomUUID44(),
+    shareId: randomUUID42(),
     ownerId: input.ownerId,
     runId: input.runId,
     artifactId: input.artifactId,
@@ -59353,7 +58933,7 @@ async function revokeScheduledRunViewLink(ownerId3, runId, shareId, now = /* @__
 }
 
 // src/personal-authority/render.ts
-import { createHash as createHash49 } from "crypto";
+import { createHash as createHash47 } from "crypto";
 function escapeHtml8(value) {
   return value.replace(/[&<>"']/g, (character) => ({
     "&": "&amp;",
@@ -59413,13 +58993,13 @@ ${section(flags.finalCta && Boolean(finalCta), `<section class="section cta" id=
     html,
     filename: `${input.name.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "") || "personal-authority"}.html`,
     bytes: bytes2,
-    sha256: createHash49("sha256").update(html).digest("hex"),
+    sha256: createHash47("sha256").update(html).digest("hex"),
     generatedAt: generatedAtIso
   };
 }
 
 // src/personal-authority/render-v2.ts
-import { createHash as createHash50 } from "crypto";
+import { createHash as createHash48 } from "crypto";
 var FONT_STACKS = Object.freeze({
   "editorial-serif": "Iowan Old Style, Baskerville, Times New Roman, serif",
   "modern-sans": "Avenir Next, Avenir, Helvetica Neue, Arial, sans-serif",
@@ -59523,13 +59103,13 @@ ${section2(flags.finalCta && Boolean(finalCta), `<section class="section cta" id
     html,
     filename: `${input.name.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "") || "personal-authority"}.html`,
     bytes: bytes2,
-    sha256: createHash50("sha256").update(html).digest("hex"),
+    sha256: createHash48("sha256").update(html).digest("hex"),
     generatedAt: generatedAtIso
   };
 }
 
 // src/newsroom-publisher/render.ts
-import { createHash as createHash51 } from "crypto";
+import { createHash as createHash49 } from "crypto";
 function escapeHtml10(value) {
   return value.replace(/[&<>"']/g, (character) => ({
     "&": "&amp;",
@@ -59635,13 +59215,13 @@ body{overflow-x:hidden}.lead-story__body,.lead-support__item,.story-card__body{m
 @media(max-width:620px){.desk-section__grid--panorama,.desk-section__grid--mosaic,.desk-section__grid--tiles{grid-template-columns:1fr}.story-card--panorama{display:block}.story-card--panorama h3,.story-card--mosaic-lead h3{font-size:34px}.story-card--mosaic-lead{grid-column:auto;grid-row:auto}.desk-section__grid--tiles>.story-card:nth-child(3n+2){margin-top:0}}
 </style></head><body data-theme="${escapeHtml10(config.theme)}" id="top" data-scheduled-renderer="newsroom_publisher_v1">${ticker}${masthead}${navigation}<main>${leadGrid}${latest}${sections}${newsletter}${pressRoom}${trustCenter}</main>${trustFooter}</body></html>`;
   const bytes2 = Buffer.byteLength(html);
-  const sha2564 = createHash51("sha256").update(html).digest("hex");
+  const sha2564 = createHash49("sha256").update(html).digest("hex");
   const filename2 = `${brand.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "") || "newsroom"}-news-site.html`;
   return { html, filename: filename2, bytes: bytes2, sha256: sha2564, generatedAt: generatedAtIso };
 }
 
 // src/blog-article/render.ts
-import { createHash as createHash52 } from "crypto";
+import { createHash as createHash50 } from "crypto";
 function escapeHtml11(value) {
   return value.replace(
     /[&<>"']/g,
@@ -59729,7 +59309,7 @@ function renderBlogArticleV1(input, config, generatedAt) {
 :root{--ink:#10213d;--ink2:#1c355a;--blue:#2563eb;--blue2:#1749b6;--mint:#45d5aa;--paper:#f7f5f0;--line:#dce4ef;--card:#fff;--body:#475569;--serif:Iowan Old Style,Palatino Linotype,Palatino,Georgia,serif;--sans:Inter,Avenir Next,ui-sans-serif,system-ui,sans-serif}body[data-theme="slate"]{--ink:#1e293b;--ink2:#334155;--blue:#475569;--blue2:#1e293b;--mint:#94a3b8;--paper:#f8fafc}body[data-theme="forest"]{--ink:#12352e;--ink2:#23584c;--blue:#147d64;--blue2:#0c5b48;--mint:#79d8bd;--paper:#f4f8f3}*{box-sizing:border-box}html{scroll-behavior:smooth;background:var(--paper)}body{margin:0;color:#252a33;background:var(--paper);font-family:var(--sans);line-height:1.6}a{color:inherit}button{font:inherit}button:focus-visible,a:focus-visible{outline:3px solid var(--mint);outline-offset:3px}.progress{position:fixed;z-index:50;top:0;left:0;height:4px;width:0;background:var(--mint)}.hero{position:relative;overflow:hidden;color:#fff;background:var(--ink)}.hero:after{position:absolute;right:-110px;top:-150px;width:420px;height:420px;border:1px solid #ffffff1a;border-radius:50%;content:""}.hero-inner{position:relative;z-index:1;max-width:1240px;margin:auto;padding:58px 42px 126px}.breadcrumb{display:flex;gap:8px;margin-bottom:34px;color:#dbeafecc;font-size:14px}.eyebrow{display:block;color:var(--blue);font-size:12px;font-weight:800;letter-spacing:.16em;text-transform:uppercase}.hero .eyebrow{color:var(--mint)}h1,h2,h3,p{margin-top:0}.hero h1{max-width:1000px;margin:14px 0 24px;font:700 clamp(44px,6vw,78px)/.98 var(--serif);letter-spacing:-.035em}.hero .dek{max-width:780px;color:#dbeafe;font-size:20px}.contributors{margin-top:30px;color:#eff6ff;font-size:14px}.contributors a{font-weight:800}.meta{display:flex;flex-wrap:wrap;gap:12px;margin-top:6px;color:#dbeafecc}.layout{position:relative;z-index:2;display:grid;grid-template-columns:minmax(0,760px) 290px;gap:64px;max-width:1240px;margin:-78px auto 0;padding:0 42px 80px}.main{min-width:0}.takeaways{padding:38px 44px;border-radius:24px;background:#fff;box-shadow:0 24px 70px #10213d24}.takeaways h2{margin:5px 0 20px;font:700 32px/1.1 var(--serif);color:var(--ink)}.takeaways ul{display:grid;gap:16px;margin:0;padding:0;list-style:none}.takeaways li{position:relative;padding-left:26px;color:var(--body);font-size:17px}.takeaways li:before{position:absolute;left:2px;top:.7em;width:8px;height:8px;border-radius:50%;background:var(--blue);content:""}.intro{padding:40px 0 4px}.intro p,.article-section>p{margin-bottom:22px;color:var(--body);font:400 18px/1.75 var(--sans)}.article-section{scroll-margin-top:28px;padding-top:45px}.article-section h2,.faq h2{margin:6px 0 20px;color:var(--ink);font:700 38px/1.08 var(--serif);letter-spacing:-.02em}.article-section ul{display:grid;gap:10px;margin:22px 0;padding-left:24px;color:var(--body);font-size:17px}.article-section li::marker{color:var(--blue)}.callout{margin:34px 0;padding:24px 28px;border-left:4px solid var(--blue);border-radius:0 16px 16px 0;background:#fff}.callout span{color:var(--blue);font-size:11px;font-weight:800;letter-spacing:.13em;text-transform:uppercase}.callout h3{margin:5px 0 8px;color:var(--ink);font:700 24px/1.15 var(--serif)}.callout p{margin:0;color:var(--body)}.rail{padding-top:0}.sidebar-media{overflow:hidden;margin:0 0 18px;border:1px solid #dbeafe;border-radius:16px;background:#fff}.sidebar-media img,.sidebar-media svg{display:block;width:100%;aspect-ratio:16/9;object-fit:cover}.sidebar-media figcaption{padding:10px 13px;color:#64748b;font-size:11px}.disclosure{margin-bottom:28px;border-top:1px solid #dbeafe;border-bottom:1px solid #dbeafe}.disclosure button{display:flex;width:100%;align-items:center;justify-content:space-between;gap:14px;padding:15px 0;border:0;color:#64748b;background:transparent;text-align:left;font-size:12px;cursor:pointer}.disclosure button b{color:var(--blue);font-size:18px;transition:transform .2s}.disclosure button[aria-expanded="true"] b{transform:rotate(180deg)}.disclosure p{padding:0 0 16px;margin:0;color:#64748b;font-size:12px}.toc{position:sticky;top:30px;padding:22px;border:1px solid var(--line);border-radius:16px;background:#fff;box-shadow:0 2px 5px #10213d12}.toc header{display:flex;align-items:center;justify-content:space-between}.toc header strong{color:var(--ink);font:700 21px/1 var(--serif)}.toc header button{width:34px;height:34px;border:0;border-radius:50%;color:var(--blue);background:transparent;cursor:pointer}.toc nav{display:grid;margin-top:14px}.toc nav a{display:flex;align-items:flex-start;gap:11px;padding:8px 0;color:#64748b;text-decoration:none;font-size:13px;line-height:1.35}.toc nav i{width:8px;height:8px;margin-top:5px;border:2px solid #bfdbfe;border-radius:50%}.toc nav a[aria-current="location"]{color:var(--ink);font-weight:800}.toc nav a[aria-current="location"] i{border-color:var(--blue);background:var(--blue)}.back-top{width:100%;margin-top:18px;padding:16px 0 0;border:0;border-top:1px solid var(--line);color:var(--blue);background:transparent;text-align:right;font-size:13px;font-weight:800;cursor:pointer}.faq{scroll-margin-top:28px;padding-top:64px}.faq>div{border-top:1px solid var(--line);border-bottom:1px solid var(--line)}.faq article+article{border-top:1px solid var(--line)}.faq h3{margin:0}.faq h3 button{display:flex;width:100%;align-items:center;justify-content:space-between;gap:18px;padding:19px 0;border:0;color:var(--ink);background:transparent;text-align:left;font-weight:800;cursor:pointer}.faq h3 b{color:var(--blue);font-size:22px}.faq article>p{padding:0 0 20px;margin:0;color:var(--body);font-size:16px}.author-card{margin-top:64px;padding:32px 36px;border-radius:18px;background:#fff}.article-actions{display:flex;flex-wrap:wrap;justify-content:space-between;gap:14px}.article-actions button{display:inline-flex;min-height:46px;align-items:center;justify-content:center;gap:8px;padding:8px 18px;border:2px solid var(--blue);border-radius:999px;color:var(--ink);background:#fff;font-weight:800;cursor:pointer}.article-actions button:hover{color:#fff;background:var(--blue)}.action-status{min-height:20px;margin:8px 0 0;color:var(--blue);text-align:right;font-size:13px;font-weight:700}.author-grid{display:grid;grid-template-columns:auto 1fr auto;gap:22px;align-items:center;margin-top:24px}.author-portrait{width:88px;height:88px;border-radius:50%;object-fit:cover}.author-initials{display:grid;place-items:center;color:var(--ink);background:#fecdd3;font-size:22px;font-weight:900}.author-grid span{color:#64748b;font-size:13px}.author-grid h2{margin:2px 0;color:var(--ink);font:700 27px/1 var(--serif)}.author-grid h2 a{text-decoration:none}.author-grid p{margin:8px 0;color:#64748b;font-size:14px}.author-grid nav{display:flex;flex-wrap:wrap;gap:14px}.author-grid nav a{color:#64748b;font-size:12px}.author-more{display:inline-flex;min-height:48px;align-items:center;justify-content:center;padding:10px 24px;border:2px solid var(--blue);color:var(--blue);text-align:center;text-decoration:none;font-size:13px;font-weight:800}.author-bio{margin:24px 0 0!important;padding-top:20px;border-top:1px solid var(--line);color:var(--body);font-size:16px}dialog{width:min(720px,calc(100% - 30px));max-height:calc(100dvh - 30px);padding:0;border:0;border-radius:18px;color:var(--ink);background:#fff;box-shadow:0 24px 70px #10213d38}dialog::backdrop{background:#0f172a7a;backdrop-filter:blur(2px)}dialog>div{position:relative;padding:30px}dialog h2{margin:0 50px 2px 0;font:700 30px/1.1 var(--serif)}dialog>div>p{color:#64748b}.dialog-close{position:absolute;top:13px;right:13px;width:44px;height:44px;border:0;border-radius:50%;color:var(--blue);background:transparent;font-size:29px;cursor:pointer}dialog section{border-top:1px solid var(--line)}dialog section button{display:block;width:100%;padding:17px 5px;border:0;border-bottom:1px solid var(--line);color:var(--body);background:#fff;text-align:left;line-height:1.65;cursor:pointer}.citation-status{min-height:22px;margin:14px 0 0!important;color:var(--blue)!important;font-size:13px;font-weight:800}.generated{max-width:1156px;margin:-52px auto 50px;padding:0 42px;color:#94a3b8;font-size:11px}@media(max-width:900px){.layout{display:block}.rail{display:none}.hero-inner{padding-bottom:116px}}@media(max-width:620px){.hero-inner{padding:36px 20px 104px}.hero h1{font-size:46px}.hero .dek{font-size:17px}.layout{margin-top:-70px;padding:0 16px 54px}.takeaways{padding:28px 24px}.article-section h2,.faq h2{font-size:32px}.author-card{padding:24px}.article-actions{display:grid;justify-content:start}.author-grid{grid-template-columns:1fr;gap:12px}.author-more{width:100%}dialog>div{padding:24px}.generated{padding:0 20px}}
 </style></head><body data-theme="${escapeHtml11(config.theme)}" data-scheduled-renderer="blog_article_v1"><div class="progress" aria-hidden="true"></div><header class="hero"><div class="hero-inner"><nav class="breadcrumb" aria-label="Breadcrumb"><a href="${safeHref4(input.canonicalUrl)}">${escapeHtml11(input.category)}</a><span>/</span><span>Article</span></nav><span class="eyebrow">${escapeHtml11(input.eyebrow)}</span><h1>${escapeHtml11(input.title)}</h1>${input.dek ? `<p class="dek">${escapeHtml11(input.dek)}</p>` : ""}<div class="contributors">${contributorText}<div class="meta"><time datetime="${escapeHtml11(articleDate)}">Updated ${formatDate2(articleDate)}</time><span>\u2022</span><span>${input.readTimeMinutes} min read</span>${input.reviewer ? "<span>\u2022</span><strong>Expert reviewed</strong>" : ""}</div></div></div></header><main class="layout"><article class="main"><section class="takeaways"><span class="eyebrow">The short answer</span><h2>Key takeaways</h2><ul>${input.keyTakeaways.map((item) => `<li>${escapeHtml11(item)}</li>`).join("")}</ul></section><section class="intro">${input.introduction.map((paragraph) => `<p>${escapeHtml11(paragraph)}</p>`).join("")}</section>${sections}${faq}${author}</article><div class="rail">${media}${disclosure}${toc}</div></main>${config.showGeneratedAt ? `<p class="generated">Rendered ${formatDate2(generatedAtIso)} by MCP Scraper.</p>` : ""}${citationDialog}<script>(()=>{const citations=${jsonForScript(citationValues)};const canonical=${jsonForScript(input.canonicalUrl)};const title=${jsonForScript(input.title)};const progress=document.querySelector('.progress');const tocLinks=[...document.querySelectorAll('.toc nav a')];const targets=tocLinks.map(link=>document.querySelector(link.hash)).filter(Boolean);const update=()=>{const max=document.documentElement.scrollHeight-innerHeight;if(progress)progress.style.width=(max>0?scrollY/max*100:0)+'%';let active=targets[0]?.id;for(const target of targets){if(target.getBoundingClientRect().top<=innerHeight*.55)active=target.id}tocLinks.forEach(link=>link.toggleAttribute('aria-current',link.hash==='#'+active));tocLinks.forEach(link=>{if(link.hash==='#'+active)link.setAttribute('aria-current','location');else link.removeAttribute('aria-current')})};addEventListener('scroll',update,{passive:true});addEventListener('resize',update);update();document.querySelectorAll('.faq h3 button').forEach(button=>button.addEventListener('click',()=>{const panel=document.getElementById(button.getAttribute('aria-controls'));const open=button.getAttribute('aria-expanded')==='true';button.setAttribute('aria-expanded',String(!open));panel.hidden=open;button.querySelector('b').textContent=open?'+':'\u2212'}));const disclosure=document.querySelector('.disclosure button');disclosure?.addEventListener('click',()=>{const panel=document.getElementById(disclosure.getAttribute('aria-controls'));const open=disclosure.getAttribute('aria-expanded')==='true';disclosure.setAttribute('aria-expanded',String(!open));panel.hidden=open});const tocToggle=document.querySelector('.toc header button');tocToggle?.addEventListener('click',()=>{const nav=document.getElementById('toc-links');const open=tocToggle.getAttribute('aria-expanded')==='true';tocToggle.setAttribute('aria-expanded',String(!open));nav.hidden=open;tocToggle.textContent=open?'\u2304':'\u2303'});document.querySelector('.back-top')?.addEventListener('click',()=>scrollTo({top:0,behavior:'smooth'}));const copy=async text=>{try{await navigator.clipboard.writeText(text)}catch{const area=document.createElement('textarea');area.value=text;area.style.position='fixed';area.style.opacity='0';document.body.append(area);area.select();document.execCommand('copy');area.remove()}};const dialog=document.getElementById('citation-dialog');document.querySelector('[data-cite]')?.addEventListener('click',()=>dialog.showModal());document.querySelector('.dialog-close')?.addEventListener('click',()=>dialog.close());dialog?.addEventListener('click',event=>{if(event.target===dialog)dialog.close()});document.querySelectorAll('[data-citation]').forEach(button=>button.addEventListener('click',async()=>{const style=button.dataset.citation;await copy(citations[style]);document.querySelector('.citation-status').textContent=style+' citation copied to clipboard.'}));document.querySelector('[data-share]')?.addEventListener('click',async()=>{const status=document.querySelector('.action-status');if(navigator.share){try{await navigator.share({title,url:canonical});status.textContent='Sharing options opened.';return}catch(error){if(error.name==='AbortError')return}}await copy(canonical);status.textContent='Article link copied to clipboard.'})})()</script></body></html>`;
   const bytes2 = Buffer.byteLength(html);
-  const sha2564 = createHash52("sha256").update(html).digest("hex");
+  const sha2564 = createHash50("sha256").update(html).digest("hex");
   return {
     html,
     filename: "blog-article.html",
@@ -60032,7 +59612,7 @@ scheduledResultApp.delete("/schedule-runs/:runId/view-links/:shareId", async (c)
 import { Hono as Hono38 } from "hono";
 
 // src/scheduled-artifacts/scheduled-run-artifact-store.ts
-import { createHash as createHash53 } from "crypto";
+import { createHash as createHash51 } from "crypto";
 var SCHEDULED_RUN_ARTIFACT_PREFIX = "scheduled-run-artifacts/";
 var SCHEDULED_RUN_ARTIFACT_DOWNLOAD_TTL_MS = 15 * 60 * 1e3;
 var SCHEDULED_RUN_ARTIFACT_MAX_BYTES = 2e6;
@@ -60048,7 +59628,7 @@ function policy5() {
   };
 }
 function runStorageSegment(runId) {
-  return /^[a-zA-Z0-9_-]{1,160}$/.test(runId) ? runId : `run-${createHash53("sha256").update(runId).digest("hex").slice(0, 32)}`;
+  return /^[a-zA-Z0-9_-]{1,160}$/.test(runId) ? runId : `run-${createHash51("sha256").update(runId).digest("hex").slice(0, 32)}`;
 }
 async function createScheduledRunArtifact(args) {
   if (args.rendered.bytes > SCHEDULED_RUN_ARTIFACT_MAX_BYTES) {
@@ -60240,11 +59820,11 @@ scheduledArtifactInternalApp.post("/render", async (c) => {
 });
 
 // src/api/personal-assistant-routes.ts
-import { createHash as createHash61, randomUUID as randomUUID46 } from "crypto";
+import { createHash as createHash59, randomUUID as randomUUID44 } from "crypto";
 import { Hono as Hono41 } from "hono";
 
 // src/api/personal-assistant-schedule-readiness.ts
-import { createHash as createHash54 } from "crypto";
+import { createHash as createHash52 } from "crypto";
 import { z as z45 } from "zod";
 var opaqueRef = z45.string().trim().regex(/^[a-z][a-z0-9_]*_[A-Za-z0-9_-]{3,128}$/);
 var isoTimestamp2 = z45.iso.datetime({ offset: true });
@@ -60317,7 +59897,7 @@ function canonicalJson2(value) {
   return JSON.stringify(value);
 }
 function digest2(value) {
-  return createHash54("sha256").update(canonicalJson2(value)).digest("hex");
+  return createHash52("sha256").update(canonicalJson2(value)).digest("hex");
 }
 function validTimezone2(timezone) {
   try {
@@ -60578,7 +60158,7 @@ async function evaluateScheduleReadiness(rawInput, dependencies) {
 }
 
 // src/api/personal-assistant-command-builder.ts
-import { createHash as createHash55 } from "crypto";
+import { createHash as createHash53 } from "crypto";
 function canonicalJson3(value) {
   return JSON.stringify(value, (_key, entry) => {
     if (!entry || typeof entry !== "object" || Array.isArray(entry)) return entry;
@@ -60586,7 +60166,7 @@ function canonicalJson3(value) {
   });
 }
 function digest3(value) {
-  return createHash55("sha256").update(canonicalJson3(value)).digest("hex");
+  return createHash53("sha256").update(canonicalJson3(value)).digest("hex");
 }
 function explicitControlIntent(text3) {
   const normalized = text3.trim().toLowerCase();
@@ -60635,7 +60215,7 @@ async function buildPersonalAssistantCommand(context, input) {
 }
 
 // src/api/personal-assistant-consent-content.ts
-import { createHash as createHash56 } from "crypto";
+import { createHash as createHash54 } from "crypto";
 var SUBMITTED_EVIDENCE = Object.freeze({
   evidenceVersion: "twilio-toll-free-submission.2026-08-28.v1",
   policyVersion: "2026-08-28.v1",
@@ -60698,7 +60278,7 @@ var ASSISTANT_ENROLLMENT_DISCLOSURE_TEXT = Object.freeze([
   ASSISTANT_CONSENT_CONTENT_V1.retentionDisclosure,
   ASSISTANT_CONSENT_CONTENT_V1.termsDisclosure
 ].join("\n\n"));
-var ASSISTANT_ENROLLMENT_DISCLOSURE_DIGEST = createHash56("sha256").update(`${ASSISTANT_CONSENT_CONTENT_V1.policyVersion}\0${ASSISTANT_ENROLLMENT_DISCLOSURE_TEXT}`).digest("hex");
+var ASSISTANT_ENROLLMENT_DISCLOSURE_DIGEST = createHash54("sha256").update(`${ASSISTANT_CONSENT_CONTENT_V1.policyVersion}\0${ASSISTANT_ENROLLMENT_DISCLOSURE_TEXT}`).digest("hex");
 var ASSISTANT_ENROLLMENT_DISCLOSURE_PROJECTION = Object.freeze({
   policyVersion: ASSISTANT_CONSENT_CONTENT_V1.policyVersion,
   disclosureDigest: ASSISTANT_ENROLLMENT_DISCLOSURE_DIGEST,
@@ -60709,11 +60289,11 @@ var ASSISTANT_ENROLLMENT_DISCLOSURE_PROJECTION = Object.freeze({
 });
 
 // src/api/personal-assistant-lifecycle.ts
-import { createHash as createHash58, randomUUID as randomUUID45 } from "crypto";
+import { createHash as createHash56, randomUUID as randomUUID43 } from "crypto";
 import { z as z46 } from "zod";
 
 // src/api/personal-assistant-db.ts
-import { createHash as createHash57 } from "crypto";
+import { createHash as createHash55 } from "crypto";
 import { Pool } from "pg";
 
 // src/api/personal-assistant-schema.ts
@@ -60835,7 +60415,7 @@ function assistantDatabaseBindingFingerprint(value) {
   if (!database) {
     throw new AssistantDatabaseError("assistant_database_binding_invalid", "Personal Assistant database name is missing.");
   }
-  return createHash57("sha256").update(`${normalizedNeonHost(parsed.hostname)}\0${database}`).digest("hex");
+  return createHash55("sha256").update(`${normalizedNeonHost(parsed.hostname)}\0${database}`).digest("hex");
 }
 function assistantDatabaseRole(value) {
   const role = decodeURIComponent(parseDatabaseUrl(value).username);
@@ -61123,7 +60703,7 @@ var AssistantLifecycleError = class extends Error {
 };
 
 // src/api/personal-assistant-service.ts
-import { createHash as createHash59 } from "crypto";
+import { createHash as createHash57 } from "crypto";
 var PERSONAL_ASSISTANT_INTENT_ENVELOPE_VERSION = "assistant-intent-envelope.v1";
 var CONTROL_INTENTS = /* @__PURE__ */ new Set(["help", "status", "approve", "reject", "cancel"]);
 var EXPLICIT_TASK_INTENTS = /* @__PURE__ */ new Set([
@@ -61289,7 +60869,7 @@ function canonicalServiceJson(value) {
   });
 }
 function serviceDigest(value) {
-  return createHash59("sha256").update(canonicalServiceJson(value)).digest("hex");
+  return createHash57("sha256").update(canonicalServiceJson(value)).digest("hex");
 }
 function serviceReceipt(idempotencyKey4, requestDigest2, occurredAt, state2, result3, error = null) {
   const receiptRef = `receipt_${serviceDigest({ idempotencyKey: idempotencyKey4, requestDigest: requestDigest2 }).slice(0, 32)}`;
@@ -62716,7 +62296,7 @@ import twilio3 from "twilio";
 import { Hono as Hono40 } from "hono";
 
 // src/api/personal-assistant-observability.ts
-import { createHash as createHash60 } from "crypto";
+import { createHash as createHash58 } from "crypto";
 var OPAQUE_TRACE_REF = /^trace_[A-Za-z0-9_-]{8,128}$/u;
 var KINDS = /* @__PURE__ */ new Set([
   "purchase_unknown",
@@ -63413,7 +62993,7 @@ function payloadWithout(input, ...keys) {
   return Object.fromEntries(Object.entries(input).filter(([key3, value]) => !omitted.has(key3) && value !== void 0));
 }
 function personalAssistantMessagingServiceReviewDigest(review) {
-  return createHash61("sha256").update(JSON.stringify({
+  return createHash59("sha256").update(JSON.stringify({
     schemaVersion: "assistant-messaging-service-review.v1",
     numberRef: review.numberRef,
     connectionRef: review.connectionRef,
@@ -63547,7 +63127,7 @@ function ownerCaller(c) {
     throw new OwnerRouteError("not_authenticated", "Authentication is required.", 401);
   }
   if (ownerUserId2 <= 0n) throw new OwnerRouteError("not_authenticated", "Authentication is required.", 401);
-  const subjectRef = `owner_${createHash61("sha256").update(ownerUserId2.toString()).digest("hex").slice(0, 24)}`;
+  const subjectRef = `owner_${createHash59("sha256").update(ownerUserId2.toString()).digest("hex").slice(0, 24)}`;
   return { kind: "owner", surface: "rest", ownerUserId: ownerUserId2, subjectRef };
 }
 function enrollmentRequesterBinding(c, caller2) {
@@ -63601,7 +63181,7 @@ function publicError2(error, requestRef) {
 function buildPersonalAssistantOwnerRoutes(options) {
   const app2 = new Hono41();
   const now = options.now ?? (() => /* @__PURE__ */ new Date());
-  const nextRequestRef = options.requestRef ?? (() => `request_${randomUUID46().replaceAll("-", "")}`);
+  const nextRequestRef = options.requestRef ?? (() => `request_${randomUUID44().replaceAll("-", "")}`);
   const route = (method, path5, mutating, call) => {
     app2[method](path5, async (c) => {
       const requestRef = nextRequestRef();
@@ -63876,7 +63456,7 @@ function buildPersonalAssistantOwnerRoutes(options) {
 var personalAssistantOwnerApp = buildPersonalAssistantOwnerRoutes({ service: getPersonalAssistantService });
 
 // src/api/personal-assistant-browser-handoff-routes.ts
-import { randomUUID as randomUUID47 } from "crypto";
+import { randomUUID as randomUUID45 } from "crypto";
 import { Hono as Hono42 } from "hono";
 var PERSONAL_ASSISTANT_BROWSER_HANDOFF_PROJECTION_VERSION = "assistant-browser-handoff.v1";
 var OPAQUE_REF2 = /^[a-z][a-z0-9]{1,31}_[A-Za-z0-9_-]{3,160}$/;
@@ -63989,7 +63569,7 @@ function controlUrl(raw) {
 function buildPersonalAssistantBrowserHandoffRoutes(options) {
   const app2 = new Hono42();
   const now = options.now ?? (() => /* @__PURE__ */ new Date());
-  const nextRequestRef = options.requestRef ?? (() => `request_${randomUUID47().replaceAll("-", "")}`);
+  const nextRequestRef = options.requestRef ?? (() => `request_${randomUUID45().replaceAll("-", "")}`);
   const json = async (c, operation, created = false) => {
     const requestRef = nextRequestRef();
     try {
@@ -64077,7 +63657,7 @@ function buildPersonalAssistantBrowserHandoffRoutes(options) {
 }
 
 // src/api/personal-assistant-browser-profile-routes.ts
-import { randomUUID as randomUUID48 } from "crypto";
+import { randomUUID as randomUUID46 } from "crypto";
 import { Hono as Hono43 } from "hono";
 var PERSONAL_ASSISTANT_BROWSER_PROFILE_PROJECTION_VERSION = "assistant-browser-profile.v1";
 var IDEMPOTENCY_KEY3 = /^[A-Za-z0-9._~:/+-]{8,240}$/;
@@ -64240,7 +63820,7 @@ function buildPersonalAssistantBrowserProfileRoutes(options) {
   const app2 = new Hono43();
   const now = options.now ?? (() => /* @__PURE__ */ new Date());
   const healthStaleAfterMs = options.healthStaleAfterMs ?? 15 * 6e4;
-  const requestRef = options.requestRef ?? (() => `request_${randomUUID48().replaceAll("-", "")}`);
+  const requestRef = options.requestRef ?? (() => `request_${randomUUID46().replaceAll("-", "")}`);
   const respond = async (c, operation, created = false) => {
     const ref6 = requestRef();
     try {
@@ -64323,10 +63903,10 @@ function buildPersonalAssistantBrowserProfileRoutes(options) {
 }
 
 // src/api/personal-assistant-browser-production.ts
-import { createHash as createHash65, randomUUID as randomUUID53 } from "crypto";
+import { createHash as createHash63, randomUUID as randomUUID51 } from "crypto";
 
 // src/api/personal-assistant-browser-handoff-store.ts
-import { createHmac as createHmac13, randomUUID as randomUUID49 } from "crypto";
+import { createHmac as createHmac12, randomUUID as randomUUID47 } from "crypto";
 var BrowserHandoffStoreError = class extends Error {
   constructor(code, status) {
     super(code);
@@ -64374,7 +63954,7 @@ function nextAction(phase) {
   return "none";
 }
 function personalAssistantBrowserOwnerRef(ownerUserId2) {
-  return `owner_${createHmac13("sha256", "assistant-browser-owner-ref").update(String(ownerUserId2)).digest("hex").slice(0, 24)}`;
+  return `owner_${createHmac12("sha256", "assistant-browser-owner-ref").update(String(ownerUserId2)).digest("hex").slice(0, 24)}`;
 }
 function createPostgresPersonalAssistantBrowserHandoffStore(options) {
   if (options.queryable && !options.transaction) throw new TypeError("an injected queryable requires an atomic transaction port");
@@ -64385,7 +63965,7 @@ function createPostgresPersonalAssistantBrowserHandoffStore(options) {
   const absoluteLifetimeMs = Math.max(6e4, Math.min(options.absoluteLifetimeMs ?? 20 * 6e4, 20 * 6e4));
   const claimLifetimeMs = Math.max(3e4, Math.min(options.claimLifetimeMs ?? 2 * 6e4, 5 * 6e4));
   const controlLifetimeMs = Math.max(3e4, Math.min(options.controlLifetimeMs ?? 5 * 6e4, 5 * 6e4));
-  const claimDigest = (claimRef) => createHmac13("sha256", digestKey).update(`assistant.browser-handoff-claim\0${claimRef}`).digest("hex");
+  const claimDigest = (claimRef) => createHmac12("sha256", digestKey).update(`assistant.browser-handoff-claim\0${claimRef}`).digest("hex");
   async function select(client2, ownerUserId2, takeoverRef, lock = false) {
     const result3 = await client2.query(
       `${HANDOFF_SELECT}
@@ -64414,14 +63994,14 @@ function createPostgresPersonalAssistantBrowserHandoffStore(options) {
       [row.owner_user_id, row.handoff_id, mode, now().toISOString()]
     );
     if (existing.rows[0]) return existing.rows[0].claim_ref;
-    const claimRef = `claim_${randomUUID49().replaceAll("-", "")}`;
+    const claimRef = `claim_${randomUUID47().replaceAll("-", "")}`;
     const ceiling = Math.min(new Date(row.expires_at).getTime(), now().getTime() + (mode === "control" ? controlLifetimeMs : claimLifetimeMs));
     if (ceiling <= now().getTime()) throw new BrowserHandoffStoreError("handoff_expired", 409);
     await client2.query(
       `INSERT INTO assistant.browser_handoff_claims
       (owner_user_id,id,public_id,handoff_id,mode,state,claim_digest,expires_at,created_at)
       VALUES ($1,$2,$3,$4,$5,'available',$6,$7::timestamptz,$8::timestamptz)`,
-      [row.owner_user_id, randomUUID49(), claimRef, row.handoff_id, mode, claimDigest(claimRef), new Date(ceiling).toISOString(), now().toISOString()]
+      [row.owner_user_id, randomUUID47(), claimRef, row.handoff_id, mode, claimDigest(claimRef), new Date(ceiling).toISOString(), now().toISOString()]
     );
     return claimRef;
   }
@@ -64443,7 +64023,7 @@ function createPostgresPersonalAssistantBrowserHandoffStore(options) {
   async function create(input) {
     return transaction2(async (client2) => {
       const owner5 = positiveOwner(input.ownerUserId);
-      const takeoverRef = `takeover_${randomUUID49().replaceAll("-", "")}`;
+      const takeoverRef = `takeover_${randomUUID47().replaceAll("-", "")}`;
       const createdAt = now();
       const expiresAt = new Date(createdAt.getTime() + absoluteLifetimeMs);
       const inserted = await client2.query(
@@ -64458,7 +64038,7 @@ function createPostgresPersonalAssistantBrowserHandoffStore(options) {
       ) ${HANDOFF_SELECT} JOIN inserted ON inserted.id=handoff.id WHERE handoff.owner_user_id=$1`,
         [
           owner5,
-          randomUUID49(),
+          randomUUID47(),
           takeoverRef,
           ref(input.profileRef, PROFILE_REF),
           ref(input.loginBindingRef, LOGIN_REF),
@@ -64617,7 +64197,7 @@ function createPostgresPersonalAssistantBrowserHandoffStore(options) {
 }
 
 // src/api/personal-assistant-browser-profile-store.ts
-import { createHash as createHash62, createHmac as createHmac14, randomUUID as randomUUID50 } from "crypto";
+import { createHash as createHash60, createHmac as createHmac13, randomUUID as randomUUID48 } from "crypto";
 import { domainToASCII } from "url";
 var PersonalAssistantBrowserProfileStoreError = class extends Error {
   constructor(code, message = code, status = code.endsWith("revision_conflict") ? 409 : code.endsWith("input_rejected") ? 400 : 404) {
@@ -64659,10 +64239,10 @@ function iso2(value) {
   return value instanceof Date ? value.toISOString() : new Date(value).toISOString();
 }
 function newRef(prefix) {
-  return `${prefix}_${randomUUID50().replaceAll("-", "")}`;
+  return `${prefix}_${randomUUID48().replaceAll("-", "")}`;
 }
 function deterministicRef(prefix, key3, identity) {
-  return `${prefix}_${createHmac14("sha256", key3).update(`assistant.${prefix}\0${identity}`).digest("hex").slice(0, 32)}`;
+  return `${prefix}_${createHmac13("sha256", key3).update(`assistant.${prefix}\0${identity}`).digest("hex").slice(0, 32)}`;
 }
 function namespaceKey(value) {
   const key3 = Buffer.isBuffer(value) ? Buffer.from(value) : Buffer.from(value, "utf8");
@@ -64743,11 +64323,11 @@ function assertMaskedIdentity(value) {
 function deriveBrowserProviderNamespaceDigest(keyInput, ownerUserId2, profileRef) {
   const owner5 = assertOwner(ownerUserId2);
   assertRef(profileRef, PROFILE_REF2, "profileRef");
-  return createHmac14("sha256", namespaceKey(keyInput)).update(`assistant.browser-profile\0${owner5}\0${profileRef}`).digest("hex");
+  return createHmac13("sha256", namespaceKey(keyInput)).update(`assistant.browser-profile\0${owner5}\0${profileRef}`).digest("hex");
 }
 function digestEvidence(value) {
   const canonical3 = JSON.stringify(value, (_key, entry) => entry && typeof entry === "object" && !Array.isArray(entry) ? Object.fromEntries(Object.entries(entry).sort(([a], [b]) => a.localeCompare(b))) : entry);
-  return createHash62("sha256").update(canonical3).digest("hex");
+  return createHash60("sha256").update(canonical3).digest("hex");
 }
 function exactCapabilityList(value, allowed) {
   if (!Array.isArray(value)) return [];
@@ -64862,7 +64442,7 @@ function createPostgresPersonalAssistantBrowserProfileStore(options) {
       inserted.status,inserted.capability_summary,inserted.revision,inserted.last_verified_at,inserted.verification_digest,
       inserted.created_at,inserted.updated_at FROM inserted`, [
       owner5,
-      randomUUID50(),
+      randomUUID48(),
       profileRef,
       input.assistantRef,
       label2,
@@ -64941,7 +64521,7 @@ function createPostgresPersonalAssistantBrowserProfileStore(options) {
       inserted.identity_label_masked,inserted.status,inserted.capability_summary,inserted.revision,inserted.last_verified_at,
       inserted.verification_digest,inserted.created_at,inserted.updated_at FROM inserted`, [
       owner5,
-      randomUUID50(),
+      randomUUID48(),
       ref6,
       assertRef(input.profileRef, PROFILE_REF2, "profileRef"),
       canonicalizeBrowserDomain(input.canonicalDomain),
@@ -65040,7 +64620,7 @@ function createPostgresPersonalAssistantBrowserProfileStore(options) {
         verification.observed_status,verification.evidence_digest,verification.evidence_summary,verification.verified_at,
         verification.created_at FROM verification`, [
         owner5,
-        randomUUID50(),
+        randomUUID48(),
         newRef("bpver"),
         profile.rows[0].id,
         bindingId,
@@ -65098,7 +64678,7 @@ function createPostgresPersonalAssistantBrowserProfileStore(options) {
         FROM assistant.assistants assistant WHERE assistant.owner_user_id=$1 AND assistant.public_id=$4 AND assistant.deleted_at IS NULL
         ON CONFLICT (owner_user_id,public_id) DO NOTHING`, [
         owner5,
-        randomUUID50(),
+        randomUUID48(),
         profileRef,
         input.assistantRef,
         assertSafeText(input.displayLabel ?? "Imported browser profile", "displayLabel", 120),
@@ -65119,7 +64699,7 @@ function createPostgresPersonalAssistantBrowserProfileStore(options) {
           VALUES ($1,$2,$3,$4,$5,$6,$7,$8::jsonb,$9::timestamptz,$9::timestamptz)
           ON CONFLICT (owner_user_id,public_id) DO NOTHING`, [
           owner5,
-          randomUUID50(),
+          randomUUID48(),
           bindingRef,
           existing.rows[0].id,
           domain,
@@ -65153,7 +64733,7 @@ function createPostgresPersonalAssistantBrowserProfileStore(options) {
 }
 
 // src/api/personal-assistant-idempotency-store.ts
-import { createHash as createHash63, randomUUID as randomUUID51 } from "crypto";
+import { createHash as createHash61, randomUUID as randomUUID49 } from "crypto";
 var PersonalAssistantIdempotencyConflictError = class extends Error {
   code = "idempotency_conflict";
   status = 409;
@@ -65182,7 +64762,7 @@ function jsonValue(value) {
   return JSON.parse(serialized);
 }
 function resultDigest(value) {
-  return createHash63("sha256").update(canonicalJson4(value)).digest("hex");
+  return createHash61("sha256").update(canonicalJson4(value)).digest("hex");
 }
 function timestamp3(value) {
   return value instanceof Date ? value.toISOString() : new Date(value).toISOString();
@@ -65194,7 +64774,7 @@ function createPostgresPersonalAssistantIdempotencyStore(options = {}) {
   return Object.freeze({
     async run(input, work) {
       const ownerUserId2 = input.ownerUserId.toString();
-      const id2 = randomUUID51();
+      const id2 = randomUUID49();
       const claim = await transaction2(async (client2) => {
         const inserted = await client2.query(`
           INSERT INTO assistant.owner_request_idempotency (
@@ -65236,8 +64816,8 @@ function createPostgresPersonalAssistantIdempotencyStore(options = {}) {
             ) VALUES ($1, $2, $3, 'system', 'assistant.idempotency.completed', $4, $5, $6, $7::jsonb, $8::timestamptz)
           `, [
             ownerUserId2,
-            randomUUID51(),
-            `audit_${randomUUID51()}`,
+            randomUUID49(),
+            `audit_${randomUUID49()}`,
             input.action,
             input.idempotencyKey,
             input.requestDigest,
@@ -65265,7 +64845,7 @@ function createPostgresPersonalAssistantIdempotencyStore(options = {}) {
 }
 
 // src/api/personal-assistant-browser-account-cleanup.ts
-import { createHash as createHash64, randomUUID as randomUUID52 } from "crypto";
+import { createHash as createHash62, randomUUID as randomUUID50 } from "crypto";
 function positiveOwner2(value) {
   if (typeof value !== "bigint" || value <= 0n) throw new TypeError("positive ownerUserId is required");
   return value.toString();
@@ -65324,10 +64904,10 @@ function createPersonalAssistantBrowserAccountCleanup(options) {
     };
     return Object.freeze({
       schemaVersion: "assistant-browser-account-cleanup.v1",
-      cleanupRef: `cleanup_${randomUUID52().replaceAll("-", "")}`,
+      cleanupRef: `cleanup_${randomUUID50().replaceAll("-", "")}`,
       state: "confirmed",
       ...evidence,
-      evidenceDigest: createHash64("sha256").update(JSON.stringify(evidence)).digest("hex")
+      evidenceDigest: createHash62("sha256").update(JSON.stringify(evidence)).digest("hex")
     });
   };
 }
@@ -65354,7 +64934,7 @@ var VERIFIED_BROWSER_CAPABILITIES = Object.freeze([
   "download"
 ]);
 function digest5(value) {
-  return createHash65("sha256").update(JSON.stringify(value, (_key, entry) => {
+  return createHash63("sha256").update(JSON.stringify(value, (_key, entry) => {
     if (typeof entry === "bigint") return entry.toString();
     if (!entry || typeof entry !== "object" || Array.isArray(entry)) return entry;
     return Object.fromEntries(Object.entries(entry).sort(([a], [b]) => a.localeCompare(b)));
@@ -65386,13 +64966,13 @@ function handoffError(error) {
 }
 function receipt2(data, replayed, revision = 1) {
   return { data, receipt: {
-    receiptRef: `receipt_${randomUUID53().replaceAll("-", "")}`,
+    receiptRef: `receipt_${randomUUID51().replaceAll("-", "")}`,
     state: replayed ? "reused" : "confirmed",
     revision
   } };
 }
 function handoffReceipt(data, replayed) {
-  return { data, receipt: { receiptRef: `receipt_${randomUUID53().replaceAll("-", "")}`, state: replayed ? "reused" : "confirmed" } };
+  return { data, receipt: { receiptRef: `receipt_${randomUUID51().replaceAll("-", "")}`, state: replayed ? "reused" : "confirmed" } };
 }
 function loginHealth(status) {
   return status === "deleted" ? "revoked" : status;
@@ -65504,7 +65084,7 @@ function createPersonalAssistantBrowserProductionDependencies(options) {
     async createProfile(ownerUserId2, input) {
       try {
         const result3 = await run(ownerUserId2, "assistant.browser-profile.create", input.idempotencyKey, input, async () => {
-          const profileRef = `bprof_${randomUUID53().replaceAll("-", "")}`;
+          const profileRef = `bprof_${randomUUID51().replaceAll("-", "")}`;
           const scope = { ownerRef: personalAssistantBrowserOwnerRef(ownerUserId2), profileRef };
           await runtime.ensureProfile(scope);
           try {
@@ -65567,7 +65147,7 @@ function createPersonalAssistantBrowserProductionDependencies(options) {
         const result3 = await run(ownerUserId2, "assistant.browser-login.begin", input.idempotencyKey, input, async () => {
           const profile = await profiles2.getProfile(ownerUserId2, input.profileRef);
           if (!profile) throw new PersonalAssistantBrowserProfileStoreError("browser_profile_not_found");
-          const loginBindingRef = `blogin_${randomUUID53().replaceAll("-", "")}`;
+          const loginBindingRef = `blogin_${randomUUID51().replaceAll("-", "")}`;
           const session = await openLoginSetup(ownerUserId2, profile.profileRef, loginBindingRef, input.canonicalDomain);
           try {
             const binding = await profiles2.createLoginBinding({
@@ -65925,7 +65505,7 @@ var personalAssistantBrowserHandoffApp = buildPersonalAssistantBrowserHandoffRou
 import { Hono as Hono45 } from "hono";
 
 // src/api/personal-assistant-worker-routes.ts
-import { createHash as createHash66, createPublicKey, verify as verify2 } from "crypto";
+import { createHash as createHash64, createPublicKey, verify as verify2 } from "crypto";
 import { Hono as Hono44 } from "hono";
 import { z as z47 } from "zod";
 var PERSONAL_ASSISTANT_WORKER_API_PREFIX = "/api/private/v1/assistant-worker";
@@ -65955,11 +65535,11 @@ function canonicalJson5(value) {
   return JSON.stringify(value);
 }
 function personalAssistantWorkerBodyDigest(rawBody) {
-  return createHash66("sha256").update(rawBody, "utf8").digest("hex");
+  return createHash64("sha256").update(rawBody, "utf8").digest("hex");
 }
 function personalAssistantPlanDigest(plan) {
   const { planRef: _planRef, planDigest: _planDigest, immutable: _immutable, createdAt: _createdAt, ...proposal } = plan;
-  return createHash66("sha256").update(canonicalJson5(proposal)).digest("hex");
+  return createHash64("sha256").update(canonicalJson5(proposal)).digest("hex");
 }
 function personalAssistantWorkerSigningPayload(input) {
   return [
@@ -66113,7 +65693,7 @@ function verifyPolicyEnvelope(identity, envelope, at) {
   if (Date.parse(envelope.expiresAt) <= at.getTime() || Math.abs(at.getTime() - Date.parse(envelope.createdAt)) > 6e4) {
     throw new AssistantWorkerRouteError("worker_policy_request_expired", "The policy request has expired.", 401);
   }
-  const expectedDigest = createHash66("sha256").update(canonicalJson5(envelope.body)).digest("hex");
+  const expectedDigest = createHash64("sha256").update(canonicalJson5(envelope.body)).digest("hex");
   if (expectedDigest !== envelope.bodyDigest) throw new AssistantWorkerRouteError("worker_policy_digest_mismatch", "The policy request digest does not match.", 401);
   const { signature, ...unsigned } = envelope;
   let valid = false;
@@ -66131,7 +65711,7 @@ function verifyClaimEnvelope(identity, envelope, at) {
   if (Math.abs(at.getTime() - Date.parse(envelope.createdAt)) > PERSONAL_ASSISTANT_WORKER_SIGNATURE_TTL_MS) {
     throw new AssistantWorkerRouteError("worker_claim_expired", "The worker claim has expired.", 401);
   }
-  const expectedDigest = createHash66("sha256").update(canonicalJson5(envelope.body)).digest("hex");
+  const expectedDigest = createHash64("sha256").update(canonicalJson5(envelope.body)).digest("hex");
   if (expectedDigest !== envelope.bodyDigest) throw new AssistantWorkerRouteError("worker_claim_digest_mismatch", "The claim digest does not match.", 401);
   const { signature, ...unsigned } = envelope;
   let valid = false;
@@ -66434,12 +66014,12 @@ var personalAssistantWorkerProductionApp = (() => {
 })();
 
 // src/api/personal-assistant-admin-routes.ts
-import { createHash as createHash68, createPublicKey as createPublicKey2 } from "crypto";
+import { createHash as createHash66, createPublicKey as createPublicKey2 } from "crypto";
 import { Hono as Hono46 } from "hono";
 import { z as z48 } from "zod";
 
 // src/api/personal-assistant-kill-controls.ts
-import { createHash as createHash67, randomUUID as randomUUID54 } from "crypto";
+import { createHash as createHash65, randomUUID as randomUUID52 } from "crypto";
 var PERSONAL_ASSISTANT_KILL_SCOPES = [
   "global",
   "outbound",
@@ -66467,7 +66047,7 @@ function canonicalJson6(value) {
   return JSON.stringify(value);
 }
 function digest6(value) {
-  return createHash67("sha256").update(canonicalJson6(value)).digest("hex");
+  return createHash65("sha256").update(canonicalJson6(value)).digest("hex");
 }
 function validateTarget(target) {
   if (!PERSONAL_ASSISTANT_KILL_SCOPES.includes(target.scope)) throw new PersonalAssistantKillControlError("invalid_kill_control", "Invalid kill-control scope.", 400);
@@ -66587,7 +66167,7 @@ var PostgresPersonalAssistantKillControlStore = class {
       const active = input.action === "activate";
       if (state2.active === active) throw new PersonalAssistantKillControlError("kill_state_conflict", "Kill control is already in the requested state.", 409);
       const revision = Number(state2.revision) + 1;
-      const receiptRef = `kill_receipt_${randomUUID54().replaceAll("-", "")}`;
+      const receiptRef = `kill_receipt_${randomUUID52().replaceAll("-", "")}`;
       await client2.query(`UPDATE assistant.kill_switch_controls SET revision = $3, active = $4, reason_code = $5, actor_ref = $6, updated_at = $7
         WHERE scope = $1 AND target_key = $2`, [input.target.scope, input.target.targetKey, revision, active, input.reasonCode, input.actorRef, input.occurredAt]);
       const inserted = await client2.query(
@@ -66735,7 +66315,7 @@ async function strictJson2(c, maxBodyBytes) {
   }
 }
 function derivedRef(prefix, ...identity) {
-  return `${prefix}_${createHash68("sha256").update(identity.join("\0")).digest("base64url").slice(0, 32)}`;
+  return `${prefix}_${createHash66("sha256").update(identity.join("\0")).digest("base64url").slice(0, 32)}`;
 }
 function ownerUserId(target) {
   if (!/^[1-9][0-9]{0,18}$/.test(target.targetKey)) {
@@ -66821,7 +66401,7 @@ function buildPersonalAssistantAdminRoutes(options) {
     const identity = c.get("assistantAdmin");
     requireCapability(identity, "assistant.worker_registration.register");
     const parsed = WorkerRegistrationSchema.safeParse(await strictJson2(c, maxBodyBytes));
-    if (!parsed.success || Date.parse(parsed.data.expiresAt) <= now().getTime() || !/^-----BEGIN PUBLIC KEY-----\n[\s\S]+\n-----END PUBLIC KEY-----\n?$/.test(parsed.data.publicKeyPem) || /PRIVATE KEY|ENCRYPTED/.test(parsed.data.publicKeyPem) || createHash68("sha256").update(parsed.success ? parsed.data.publicKeyPem : "").digest("hex") !== (parsed.success ? parsed.data.publicKeySha256 : "")) {
+    if (!parsed.success || Date.parse(parsed.data.expiresAt) <= now().getTime() || !/^-----BEGIN PUBLIC KEY-----\n[\s\S]+\n-----END PUBLIC KEY-----\n?$/.test(parsed.data.publicKeyPem) || /PRIVATE KEY|ENCRYPTED/.test(parsed.data.publicKeyPem) || createHash66("sha256").update(parsed.success ? parsed.data.publicKeyPem : "").digest("hex") !== (parsed.success ? parsed.data.publicKeySha256 : "")) {
       throw new PersonalAssistantAdminRouteError("invalid_worker_registration", "Invalid worker registration request.", 400);
     }
     try {
@@ -66947,24 +66527,24 @@ var personalAssistantCronProductionApp = (() => {
 })();
 
 // src/api/personal-assistant-production.ts
-import { createHash as createHash98 } from "crypto";
+import { createHash as createHash96 } from "crypto";
 
 // src/api/personal-assistant-admin-production.ts
-import { createHash as createHash72 } from "crypto";
+import { createHash as createHash70 } from "crypto";
 
 // src/api/personal-assistant-worker-store.ts
-import { createHash as createHash71, randomUUID as randomUUID56 } from "crypto";
+import { createHash as createHash69, randomUUID as randomUUID54 } from "crypto";
 
 // src/api/personal-assistant-repository.ts
-import { createHash as createHash70, randomBytes as randomBytes7, randomUUID as randomUUID55 } from "crypto";
+import { createHash as createHash68, randomBytes as randomBytes7, randomUUID as randomUUID53 } from "crypto";
 
 // src/api/personal-assistant-wake-packet.ts
-import { createHash as createHash69 } from "crypto";
+import { createHash as createHash67 } from "crypto";
 function stableJson(value) {
   return JSON.stringify(value, (_key, entry) => !entry || typeof entry !== "object" || Array.isArray(entry) ? entry : Object.fromEntries(Object.entries(entry).sort(([a], [b]) => a.localeCompare(b))));
 }
 function stableDigest(value) {
-  return createHash69("sha256").update(stableJson(value)).digest("hex");
+  return createHash67("sha256").update(stableJson(value)).digest("hex");
 }
 function deterministicWakePacketRef(snapshot) {
   return `wake_${stableDigest({ assistantRef: snapshot.assistantRef, commandRef: snapshot.commandRef, cycleRef: snapshot.cycleRef, executionRef: snapshot.executionRef, contextVersionRef: snapshot.contextVersion.contextVersionRef }).slice(0, 32)}`;
@@ -67017,10 +66597,10 @@ function canonicalJson7(value) {
   });
 }
 function digest7(value) {
-  return createHash70("sha256").update(canonicalJson7(value)).digest("hex");
+  return createHash68("sha256").update(canonicalJson7(value)).digest("hex");
 }
 function deterministicRef2(prefix, identity) {
-  return `${prefix}_${createHash70("sha256").update(identity).digest("hex").slice(0, 32)}`;
+  return `${prefix}_${createHash68("sha256").update(identity).digest("hex").slice(0, 32)}`;
 }
 function messageCursor(message) {
   return Buffer.from(JSON.stringify([message.occurredAt, message.messageRef])).toString("base64url");
@@ -67405,7 +66985,7 @@ function createPostgresPersonalAssistantRepositoryStore(options = {}) {
           const stored = AssistantCommandSchema.parse(existing.rows[0].payload);
           return { command: stored, receipt: receipt4, entity: stored };
         }
-        const commandId = randomUUID55();
+        const commandId = randomUUID53();
         const inserted = await client2.query(`
           INSERT INTO assistant.commands (
             owner_user_id, id, public_id, assistant_id, conversation_id, command_type,
@@ -67447,7 +67027,7 @@ function createPostgresPersonalAssistantRepositoryStore(options = {}) {
           )
         `, [
           ownerUserId2.toString(),
-          randomUUID55(),
+          randomUUID53(),
           receipt4.receiptRef,
           commandId,
           command.operation,
@@ -67516,7 +67096,7 @@ function createPostgresPersonalAssistantRepositoryStore(options = {}) {
           `, [ownerUserId2.toString(), row.id]);
         }
         const token7 = randomBytes7(32).toString("base64url");
-        const tokenHash5 = createHash70("sha256").update(token7).digest("hex");
+        const tokenHash5 = createHash68("sha256").update(token7).digest("hex");
         const leaseRef = deterministicRef2("lease", `${input.executionRef}\0${input.workerRef}\0${input.now}`);
         const expiresAt = new Date(Date.parse(input.now) + input.leaseSeconds * 1e3).toISOString();
         await client2.query(`
@@ -67524,7 +67104,7 @@ function createPostgresPersonalAssistantRepositoryStore(options = {}) {
             owner_user_id, id, public_id, worker_id, execution_id, lease_token_hash,
             state, claimed_at, heartbeat_at, expires_at
           ) VALUES ($1, $2, $3, $4, $5, $6, 'active', $7, $7, $8)
-        `, [ownerUserId2.toString(), randomUUID55(), leaseRef, worker.rows[0].id, row.id, tokenHash5, input.now, expiresAt]);
+        `, [ownerUserId2.toString(), randomUUID53(), leaseRef, worker.rows[0].id, row.id, tokenHash5, input.now, expiresAt]);
         await client2.query(`
           UPDATE assistant.executions
           SET state = 'claimed', claimed_by_worker_id = $3, claim_token_hash = $4,
@@ -67601,7 +67181,7 @@ function createPostgresPersonalAssistantRepositoryStore(options = {}) {
           RETURNING public_id
         `, [
           ownerUserId2.toString(),
-          randomUUID55(),
+          randomUUID53(),
           grant.grantRef,
           grant.revision,
           grant.authorityClass,
@@ -67658,7 +67238,7 @@ function createPostgresPersonalAssistantRepositoryStore(options = {}) {
         RETURNING public_id
       `, [
         ownerUserId2.toString(),
-        randomUUID55(),
+        randomUUID53(),
         approval.approvalRef,
         approval.requestedActionDigest,
         approval.approvedArgumentDigest,
@@ -67791,7 +67371,7 @@ function createPostgresPersonalAssistantRepositoryStore(options = {}) {
           RETURNING public_id
         `, [
           ownerUserId2.toString(),
-          randomUUID55(),
+          randomUUID53(),
           input.conversationRef,
           input.participantDigest,
           input.occurredAt,
@@ -67839,7 +67419,7 @@ function createPostgresPersonalAssistantRepositoryStore(options = {}) {
           RETURNING public_id
         `, [
           ownerUserId2.toString(),
-          randomUUID55(),
+          randomUUID53(),
           message.messageRef,
           message.direction,
           message.providerAccountRef,
@@ -67882,7 +67462,7 @@ function createPostgresPersonalAssistantRepositoryStore(options = {}) {
             provider_message_sid,provider_event_key,error_class,occurred_at
         `, [
           ownerUserId2.toString(),
-          randomUUID55(),
+          randomUUID53(),
           event2.deliveryEventRef,
           event2.providerAccountRef,
           event2.providerMessageSid,
@@ -67931,7 +67511,7 @@ function createPostgresPersonalAssistantRepositoryStore(options = {}) {
         RETURNING public_id, byte_digest
       `, [
         ownerUserId2.toString(),
-        randomUUID55(),
+        randomUUID53(),
         media.mediaRef,
         media.providerAccountRef,
         media.providerMediaSid,
@@ -67990,7 +67570,7 @@ function createPostgresPersonalAssistantRepositoryStore(options = {}) {
         RETURNING public_id,version,manifest_digest,created_at
       `, [
         ownerUserId2.toString(),
-        randomUUID55(),
+        randomUUID53(),
         input.contextVersionRef,
         input.version,
         input.manifestDigest,
@@ -68019,7 +67599,7 @@ function createPostgresPersonalAssistantRepositoryStore(options = {}) {
         RETURNING public_id,state,opened_at,updated_at,closed_at
       `, [
         ownerUserId2.toString(),
-        randomUUID55(),
+        randomUUID53(),
         cycle.cycleRef,
         cycle.state,
         cycle.openedAt,
@@ -68052,7 +67632,7 @@ function createPostgresPersonalAssistantRepositoryStore(options = {}) {
             FROM assistant.wake_cycles cycle WHERE cycle.owner_user_id = $1 AND cycle.public_id = $9
           `, [
             ownerUserId2.toString(),
-            randomUUID55(),
+            randomUUID53(),
             transition.taskRef,
             title,
             transition.toState,
@@ -68086,7 +67666,7 @@ function createPostgresPersonalAssistantRepositoryStore(options = {}) {
         RETURNING public_id,state,attempt,retry_class,terminal_at
       `, [
         ownerUserId2.toString(),
-        randomUUID55(),
+        randomUUID53(),
         execution.executionRef,
         execution.planDigest,
         execution.state,
@@ -68121,7 +67701,7 @@ function createPostgresPersonalAssistantRepositoryStore(options = {}) {
           RETURNING runtime_version,health,occurred_at
         `, [
           ownerUserId2.toString(),
-          randomUUID55(),
+          randomUUID53(),
           relation.rows[0].worker_id,
           relation.rows[0].lease_id,
           heartbeat.sequence,
@@ -68206,7 +67786,7 @@ function createPostgresPersonalAssistantRepositoryStore(options = {}) {
           RETURNING id
         `, [
           ownerUserId2.toString(),
-          randomUUID55(),
+          randomUUID53(),
           plan.planRef,
           plan.planDigest,
           JSON.stringify(plan),
@@ -68225,7 +67805,7 @@ function createPostgresPersonalAssistantRepositoryStore(options = {}) {
             ) VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9::jsonb,$10,$11,$12,$13,$14)
           `, [
             ownerUserId2.toString(),
-            randomUUID55(),
+            randomUUID53(),
             step.stepRef,
             inserted.rows[0].id,
             step.position,
@@ -68265,7 +67845,7 @@ function createPostgresPersonalAssistantRepositoryStore(options = {}) {
         RETURNING required_digest,decision,reason_code
       `, [
         ownerUserId2.toString(),
-        randomUUID55(),
+        randomUUID53(),
         barrier.barrierRef,
         barrier.barrierKind,
         barrier.decision,
@@ -68296,7 +67876,7 @@ function createPostgresPersonalAssistantRepositoryStore(options = {}) {
         RETURNING public_id,authorized_minor,state
       `, [
         ownerUserId2.toString(),
-        randomUUID55(),
+        randomUUID53(),
         allocation.allocationRef,
         allocation.kind,
         allocation.idempotencyKey,
@@ -68410,7 +67990,7 @@ function createPostgresPersonalAssistantRepositoryStore(options = {}) {
             ON CONFLICT (owner_user_id, public_id) DO NOTHING
           `, [
             ownerUserId2.toString(),
-            randomUUID55(),
+            randomUUID53(),
             contact.contactRef,
             contact.displayName,
             contact.phoneCiphertext,
@@ -68438,7 +68018,7 @@ function createPostgresPersonalAssistantRepositoryStore(options = {}) {
             ON CONFLICT (owner_user_id, public_id) DO NOTHING
           `, [
             ownerUserId2.toString(),
-            randomUUID55(),
+            randomUUID53(),
             number.numberRef,
             number.providerAccountRef,
             number.providerNumberSid,
@@ -68470,7 +68050,7 @@ function createPostgresPersonalAssistantRepositoryStore(options = {}) {
             ON CONFLICT (owner_user_id, public_id) DO NOTHING
           `, [
             ownerUserId2.toString(),
-            randomUUID55(),
+            randomUUID53(),
             conversation.conversationRef,
             conversation.participantDigest,
             conversation.occurredAt,
@@ -68492,7 +68072,7 @@ function createPostgresPersonalAssistantRepositoryStore(options = {}) {
             ON CONFLICT (owner_user_id, public_id) DO NOTHING
           `, [
             ownerUserId2.toString(),
-            randomUUID55(),
+            randomUUID53(),
             message.messageRef,
             message.direction,
             message.providerAccountRef,
@@ -68521,7 +68101,7 @@ function createPostgresPersonalAssistantRepositoryStore(options = {}) {
             RETURNING id
           `, [
             ownerUserId2.toString(),
-            randomUUID55(),
+            randomUUID53(),
             schedule.scheduleRef,
             schedule.sourceSystem,
             schedule.sourceRef,
@@ -68549,7 +68129,7 @@ function createPostgresPersonalAssistantRepositoryStore(options = {}) {
               ON CONFLICT (owner_user_id, public_id) DO NOTHING
             `, [
               ownerUserId2.toString(),
-              randomUUID55(),
+              randomUUID53(),
               grant.grantRef,
               insertedSchedule.rows[0].id,
               grant.revision,
@@ -68575,7 +68155,7 @@ function createPostgresPersonalAssistantRepositoryStore(options = {}) {
             ON CONFLICT (owner_user_id, public_id) DO NOTHING
           `, [
             ownerUserId2.toString(),
-            randomUUID55(),
+            randomUUID53(),
             run.occurrenceRef,
             run.sourceRef,
             run.occurrenceKey,
@@ -68634,7 +68214,7 @@ function createPostgresPersonalAssistantRepositoryStore(options = {}) {
           INSERT INTO assistant.audit_events (
             owner_user_id,id,public_id,actor_kind,event_type,correlation_id,evidence_digest,details,occurred_at
           ) VALUES ($1,$2,$3,'operator','legacy_import_applied',$3,$4,$5::jsonb,$6)
-        `, [ownerUserId2.toString(), randomUUID55(), input.importRef, applied.classificationDigest, JSON.stringify({ receipt: applied }), appliedAt]);
+        `, [ownerUserId2.toString(), randomUUID53(), input.importRef, applied.classificationDigest, JSON.stringify({ receipt: applied }), appliedAt]);
         return applied;
       });
     }
@@ -68702,7 +68282,7 @@ async function appendPostgresReceipt(transaction2, ownerUserId2, receipt4, recei
       ) VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12::jsonb,$13,$14,$15)
     `, [
       ownerUserId2.toString(),
-      randomUUID55(),
+      randomUUID53(),
       receipt4.receiptRef,
       relation.rows[0].command_id,
       relation.rows[0].execution_id,
@@ -68735,7 +68315,7 @@ async function insertPostgresConsentEvidence(queryable, ownerUserId2, evidence)
     RETURNING public_id
   `, [
     ownerUserId2.toString(),
-    randomUUID55(),
+    randomUUID53(),
     evidence.consentRef,
     evidence.recipientHash,
     evidence.subjectKey,
@@ -68776,7 +68356,7 @@ async function insertPostgresSuppressionEvent(queryable, ownerUserId2, event2) {
     ON CONFLICT (owner_user_id, public_id) DO NOTHING RETURNING public_id
   `, [
     ownerUserId2.toString(),
-    randomUUID55(),
+    randomUUID53(),
     event2.suppressionRef,
     event2.subjectKey,
     event2.transition,
@@ -69054,10 +68634,10 @@ var AssistantWorkerStoreError = class extends Error {
 };
 function hash(value) {
   const canonical3 = JSON.stringify(value, (_key, entry) => entry && typeof entry === "object" && !Array.isArray(entry) ? Object.fromEntries(Object.entries(entry).sort(([a], [b]) => a.localeCompare(b))) : entry);
-  return createHash71("sha256").update(canonical3).digest("hex");
+  return createHash69("sha256").update(canonical3).digest("hex");
 }
 function ref2(prefix, identity) {
-  return `${prefix}_${createHash71("sha256").update(identity).digest("hex").slice(0, 32)}`;
+  return `${prefix}_${createHash69("sha256").update(identity).digest("hex").slice(0, 32)}`;
 }
 function requiredString(input, key3) {
   const value = input[key3];
@@ -69108,7 +68688,7 @@ var PostgresAssistantWorkerIdentityRegistry = class {
       RETURNING owner_user_id::text,owner_ref,subject_ref,public_id AS worker_ref,device_key_id,key_ref,
         device_public_key,state,expires_at`, [
       input.ownerUserId.toString(),
-      randomUUID56(),
+      randomUUID54(),
       input.workerRef,
       input.ownerRef,
       input.subjectRef,
@@ -69161,7 +68741,7 @@ var PostgresAssistantWorkerNonceLedger = class {
       INSERT INTO assistant.worker_nonces(owner_user_id,id,namespace,nonce_key,expires_at,consumed_at)
       SELECT owner_user_id,$1,$2,$3,$4,$5 FROM unique_candidate
       ON CONFLICT (owner_user_id,namespace,nonce_key) DO NOTHING RETURNING id`,
-      [randomUUID56(), input.namespace, input.key, input.expiresAt, now.toISOString(), workerRef]
+      [randomUUID54(), input.namespace, input.key, input.expiresAt, now.toISOString(), workerRef]
     );
     return (result3.rowCount ?? result3.rows.length) === 1;
   }
@@ -69456,7 +69036,7 @@ var INTERNAL_CAPABILITIES = /* @__PURE__ */ new Set([
   "assistant.worker_registration.revoke"
 ]);
 function actorRef(issuer, subject) {
-  return `admin_actor_${createHash72("sha256").update(`${issuer}\0${subject}`).digest("base64url").slice(0, 32)}`;
+  return `admin_actor_${createHash70("sha256").update(`${issuer}\0${subject}`).digest("base64url").slice(0, 32)}`;
 }
 var VerifiedPersonalAssistantAdminIdentityPort = class {
   constructor(verifier, configuration) {
@@ -69570,7 +69150,7 @@ function createPersonalAssistantAdminProductionDependencies(input) {
 }
 
 // src/api/personal-assistant-dispatcher.ts
-import { createHash as createHash73, randomBytes as randomBytes8, randomUUID as randomUUID57 } from "crypto";
+import { createHash as createHash71, randomBytes as randomBytes8, randomUUID as randomUUID55 } from "crypto";
 var AssistantLeaseFenceError = class extends Error {
   code = "assistant_lease_fence_rejected";
   constructor() {
@@ -69584,7 +69164,7 @@ function canonical2(value) {
   return Object.fromEntries(Object.entries(value).sort(([a], [b]) => a.localeCompare(b)).map(([key3, entry]) => [key3, canonical2(entry)]));
 }
 function digest8(value) {
-  return createHash73("sha256").update(JSON.stringify(canonical2(value))).digest("hex");
+  return createHash71("sha256").update(JSON.stringify(canonical2(value))).digest("hex");
 }
 function ref3(prefix, identity) {
   return `${prefix}_${digest8(identity).slice(0, 32)}`;
@@ -69802,7 +69382,7 @@ function createPostgresPersonalAssistantDispatchStore(options = {}) {
         const cycleRef = deterministic ? null : ref3("cycle", commandRef);
         const executionRef = deterministic ? null : ref3("execution", commandRef);
         const occurrenceRef = input.occurrenceKey ? ref3("occurrence", `${ownerId3}\0${input.scheduleRef}\0${input.occurrenceKey}`) : null;
-        const commandId = randomUUID57();
+        const commandId = randomUUID55();
         const commandPayload = {
           schemaVersion: "assistant-command.v1",
           commandRef,
@@ -69847,8 +69427,8 @@ function createPostgresPersonalAssistantDispatchStore(options = {}) {
         let cycleId = null;
         let executionId = null;
         if (!deterministic && cycleRef && executionRef) {
-          cycleId = randomUUID57();
-          executionId = randomUUID57();
+          cycleId = randomUUID55();
+          executionId = randomUUID55();
           await client2.query(
             `INSERT INTO assistant.wake_cycles
             (owner_user_id,id,public_id,assistant_id,command_id,context_version_id,state,opened_at,updated_at)
@@ -69870,7 +69450,7 @@ function createPostgresPersonalAssistantDispatchStore(options = {}) {
             ON CONFLICT (owner_user_id,schedule_ref,occurrence_key) DO UPDATE SET public_id=assistant.reminder_occurrences.public_id
             RETURNING public_id`, [
             ownerId3,
-            randomUUID57(),
+            randomUUID55(),
             occurrenceRef,
             input.occurrenceKey,
             input.scheduledFor,
@@ -69899,7 +69479,7 @@ function createPostgresPersonalAssistantDispatchStore(options = {}) {
           VALUES ($1,$2,$3,$4,$5,'assistant.execution.status','response',$6,$7,$8,$9,$10::jsonb,$11,$12)`,
           [
             ownerId3,
-            randomUUID57(),
+            randomUUID55(),
             receiptRef,
             commandId,
             executionId,
@@ -69960,7 +69540,7 @@ function createPostgresPersonalAssistantDispatchStore(options = {}) {
           (owner_user_id,id,public_id,worker_id,execution_id,lease_token_hash,state,claimed_at,heartbeat_at,expires_at)
           SELECT $1,$2,$3,$4,execution.id,$5,'active',$6,$6,$7 FROM assistant.executions execution
           WHERE execution.owner_user_id=$1 AND execution.public_id=$8`,
-          [ownerId3, randomUUID57(), leaseRef, worker.rows[0].id, tokenHash3(token7), at, expiresAt, row.execution_ref]
+          [ownerId3, randomUUID55(), leaseRef, worker.rows[0].id, tokenHash3(token7), at, expiresAt, row.execution_ref]
         );
         await client2.query(
           `UPDATE assistant.executions SET state='claimed',claimed_by_worker_id=$3,claim_token_hash=$4,
@@ -70000,7 +69580,7 @@ function createPostgresPersonalAssistantDispatchStore(options = {}) {
           SELECT $1,$2,worker.id,lease.id,$3,$4,$5::jsonb,$6 FROM assistant.worker_registrations worker
           JOIN assistant.worker_leases lease ON lease.owner_user_id=worker.owner_user_id AND lease.worker_id=worker.id
           WHERE worker.owner_user_id=$1 AND worker.public_id=$7 AND lease.public_id=$8 AND lease.state='active'`,
-          [ownerId3, randomUUID57(), input.sequence, input.runtimeVersion, JSON.stringify(input.health), occurredAt, input.workerRef, input.leaseRef]
+          [ownerId3, randomUUID55(), input.sequence, input.runtimeVersion, JSON.stringify(input.health), occurredAt, input.workerRef, input.leaseRef]
         );
         await client2.query(`UPDATE assistant.worker_leases SET heartbeat_at=$3,expires_at=$4
           WHERE owner_user_id=$1 AND public_id=$2 AND state='active'`, [ownerId3, input.leaseRef, occurredAt, expiresAt]);
@@ -70242,7 +69822,7 @@ function createPostgresAssistantReminderRuntimeStore(options = {}) {
        payload_digest,payload,parsed_intent,parsed_intent_digest,source,state,accepted_at,updated_at,terminal_at)
       SELECT $1,$2,$3,assistant.id,NULL,$4,'assistant-reminder-command.v1',$5,$6,$7::jsonb,NULL,NULL,'system','succeeded',$8,$8,$8
       FROM assistant.assistants assistant WHERE assistant.owner_user_id=$1 AND assistant.public_id=$9
-      RETURNING id`, [ownerId3, randomUUID57(), commandRef, command.kind, command.idempotencyKey, digest8(command), JSON.stringify(payload), at, assistantRef2]);
+      RETURNING id`, [ownerId3, randomUUID55(), commandRef, command.kind, command.idempotencyKey, digest8(command), JSON.stringify(payload), at, assistantRef2]);
     if (!inserted.rows[0]) throw new Error("assistant_reminder_assistant_not_found");
     return inserted.rows[0].id;
   };
@@ -70292,7 +69872,7 @@ function createPostgresAssistantReminderRuntimeStore(options = {}) {
             FROM assistant.assistants assistant WHERE assistant.owner_user_id=$1 AND assistant.public_id=$12`,
             [
               ownerId3,
-              randomUUID57(),
+              randomUUID55(),
               publicRef,
               commandRef,
               definition2.instruction,
@@ -70368,7 +69948,7 @@ function createPostgresAssistantReminderRuntimeStore(options = {}) {
               ON CONFLICT (owner_user_id,schedule_ref,occurrence_key) DO NOTHING RETURNING public_id`,
               [
                 definition.ownerId,
-                randomUUID57(),
+                randomUUID55(),
                 occurrence.occurrenceRef,
                 definition.assistantRef,
                 definition.reminderRef,
@@ -70448,10 +70028,10 @@ function createPersonalAssistantReminderRuntime(options) {
 }
 
 // src/api/personal-assistant-reconcile-cron.ts
-import { createHash as createHash75, timingSafeEqual as timingSafeEqual8 } from "crypto";
+import { createHash as createHash73, timingSafeEqual as timingSafeEqual8 } from "crypto";
 
 // src/api/personal-assistant-reconcile.ts
-import { createHash as createHash74 } from "crypto";
+import { createHash as createHash72 } from "crypto";
 var PERSONAL_ASSISTANT_RECONCILIATION_LIMITS = Object.freeze({
   defaultBatchSize: 20,
   maxBatchSize: 50,
@@ -70473,7 +70053,7 @@ var PUBLIC_REF = /^[a-z][a-z0-9_]*_[A-Za-z0-9_-]{3,128}$/u;
 var DIGEST2 = /^[a-f0-9]{64}$/u;
 var PROVIDER_REF = /^[A-Za-z0-9:_-]{3,200}$/u;
 function hash2(value) {
-  return createHash74("sha256").update(value).digest("hex");
+  return createHash72("sha256").update(value).digest("hex");
 }
 function validateCandidate(candidate) {
   if (!/^[1-9]\d*$/u.test(candidate.ownerUserId) || !PUBLIC_REF.test(candidate.candidateRef) || !/^trace_[A-Za-z0-9_-]{8,128}$/u.test(candidate.traceRef) || !PUBLIC_REF.test(candidate.claimToken) || !PROVIDER_REF.test(candidate.providerAccountRef) || !PROVIDER_REF.test(candidate.providerLocatorRef) || !DIGEST2.test(candidate.expectedDigest) || !Number.isFinite(Date.parse(candidate.stuckSince))) {
@@ -70595,8 +70175,8 @@ async function reconcilePersonalAssistantTransports(dependencies, options = {})
 // src/api/personal-assistant-reconcile-cron.ts
 function authorized(actual, expectedSecret) {
   if (!actual?.startsWith("Bearer ")) return false;
-  const actualDigest = createHash75("sha256").update(actual).digest();
-  const expectedDigest = createHash75("sha256").update(`Bearer ${expectedSecret}`).digest();
+  const actualDigest = createHash73("sha256").update(actual).digest();
+  const expectedDigest = createHash73("sha256").update(`Bearer ${expectedSecret}`).digest();
   return timingSafeEqual8(actualDigest, expectedDigest);
 }
 function createPersonalAssistantReconcileCronHandler(options) {
@@ -70658,7 +70238,7 @@ function createPersonalAssistantReminderCronHandler(options) {
 }
 
 // src/api/twilio-inbound-admission.ts
-import { createHash as createHash76, randomBytes as randomBytes9 } from "crypto";
+import { createHash as createHash74, randomBytes as randomBytes9 } from "crypto";
 var ACCOUNT_SID = /^AC[0-9a-f]{32}$/iu;
 var MESSAGE_SID = /^(?:SM|MM)[0-9a-f]{32}$/iu;
 var MESSAGING_SERVICE_SID = /^MG[0-9a-f]{32}$/iu;
@@ -70680,10 +70260,10 @@ function canonicalJson8(value) {
   });
 }
 function digest9(value) {
-  return createHash76("sha256").update(canonicalJson8(value)).digest("hex");
+  return createHash74("sha256").update(canonicalJson8(value)).digest("hex");
 }
 function stableRef(prefix, value) {
-  return `${prefix}_${createHash76("sha256").update(value).digest("hex").slice(0, 32)}`;
+  return `${prefix}_${createHash74("sha256").update(value).digest("hex").slice(0, 32)}`;
 }
 function normalizeOptionalSid(value) {
   const normalized = value?.trim() || null;
@@ -70829,8 +70409,8 @@ function createTwilioInboundIngressCronHandler(options) {
   return async (request) => {
     if (request.method !== "GET") return Response.json({ error: "method_not_allowed" }, { status: 405, headers: { Allow: "GET" } });
     const actual = request.headers.get("authorization") ?? "";
-    const actualDigest = createHash76("sha256").update(actual).digest();
-    const expectedDigest = createHash76("sha256").update(expectedAuthorization).digest();
+    const actualDigest = createHash74("sha256").update(actual).digest();
+    const expectedDigest = createHash74("sha256").update(expectedAuthorization).digest();
     if (actualDigest.length !== expectedDigest.length || !actualDigest.equals(expectedDigest)) {
       return Response.json({ error: "unauthorized" }, { status: 401 });
     }
@@ -70872,7 +70452,7 @@ function createPersonalAssistantWorkerAndCronProduction(options) {
 }
 
 // src/api/personal-assistant-control-plane-store.ts
-import { createHash as createHash77, randomUUID as randomUUID58 } from "crypto";
+import { createHash as createHash75, randomUUID as randomUUID56 } from "crypto";
 var REF = /^[a-z][A-Za-z0-9_-]{2,159}$/;
 var DIGEST4 = /^[a-f0-9]{64}$/;
 function record3(input) {
@@ -70895,7 +70475,7 @@ function ref4(value) {
   return value;
 }
 function newRef2(prefix) {
-  return `${prefix}_${randomUUID58().replaceAll("-", "")}`;
+  return `${prefix}_${randomUUID56().replaceAll("-", "")}`;
 }
 function canonicalJson9(value) {
   return JSON.stringify(value, (_key, entry) => {
@@ -70904,7 +70484,7 @@ function canonicalJson9(value) {
   });
 }
 function digest10(value) {
-  return createHash77("sha256").update(canonicalJson9(value)).digest("hex");
+  return createHash75("sha256").update(canonicalJson9(value)).digest("hex");
 }
 function normalizeE164(value) {
   const trimmed = value.trim();
@@ -70951,7 +70531,7 @@ async function audit(client2, owner5, operation, resourceRef, occurredAt) {
     `INSERT INTO assistant.audit_events (
     owner_user_id,id,public_id,actor_kind,event_type,operation,correlation_id,details,occurred_at
   ) VALUES ($1,$2,$3,'user','assistant.control_plane.mutation',$4,$5,$6::jsonb,$7::timestamptz)`,
-    [owner5, randomUUID58(), newRef2("audit"), operation, resourceRef, JSON.stringify({ resourceRef }), occurredAt]
+    [owner5, randomUUID56(), newRef2("audit"), operation, resourceRef, JSON.stringify({ resourceRef }), occurredAt]
   );
 }
 var ASSISTANT_PROJECTION = `jsonb_build_object('assistantRef', assistant.public_id, 'state', assistant.status,
@@ -71032,7 +70612,7 @@ function createPostgresPersonalAssistantControlPlaneStore(options) {
             'assistantRef',public_id,'state',status,'displayName',name,'revision',revision,'createdAt',created_at,'updatedAt',updated_at) AS projection`,
           [
             ownerUserId2.toString(),
-            randomUUID58(),
+            randomUUID56(),
             assistantRef2,
             text2(body3, "displayName", text2(body3, "name", "Personal Assistant")),
             optionalText3(body3, "timezone") ?? "UTC",
@@ -71086,7 +70666,7 @@ function createPostgresPersonalAssistantControlPlaneStore(options) {
         (owner_user_id,id,public_id,assistant_id,channel,address_ciphertext,address_hash,state,revision,created_at,updated_at)
         SELECT $1,$2,$3,assistant.id,$4,$5,$6,'active',1,$7,$7 FROM assistant.assistants assistant WHERE assistant.owner_user_id=$1 AND assistant.public_id=$8 AND assistant.deleted_at IS NULL
         RETURNING jsonb_build_object('bindingRef',public_id,'assistantRef',$8::text,'channelEndpointRef',public_id,'channel',channel,'state',state,'revision',revision) AS projection`,
-          [ownerUserId2.toString(), randomUUID58(), bindingRef, channel, protectedAddress?.ciphertext ?? null, protectedAddress?.digest ?? null, at, ref4(assistantRef2)]
+          [ownerUserId2.toString(), randomUUID56(), bindingRef, channel, protectedAddress?.ciphertext ?? null, protectedAddress?.digest ?? null, at, ref4(assistantRef2)]
         );
         if (!result3.rows[0]) throw new Error("assistant_not_found");
         await audit(client2, ownerUserId2.toString(), "assistant.channel.bind", bindingRef, at);
@@ -71143,11 +70723,11 @@ function createPostgresPersonalAssistantControlPlaneStore(options) {
         const inserted = await client2.query(`INSERT INTO assistant.contacts(owner_user_id,id,public_id,display_name,relationship,phone_ciphertext,phone_hash,timezone,attributes,created_at,updated_at)
       VALUES($1,$2,$3,$4,$5,$6,$7,$8,'{}'::jsonb,$9,$9)
       ON CONFLICT(owner_user_id,phone_hash) WHERE phone_hash IS NOT NULL DO UPDATE SET updated_at=assistant.contacts.updated_at
-      RETURNING id,public_id`, [ownerUserId2.toString(), randomUUID58(), contactRef, optionalText3(body3, "displayName"), relationship, protectedAddress.ciphertext, protectedAddress.digest, optionalText3(body3, "timezone"), at]);
+      RETURNING id,public_id`, [ownerUserId2.toString(), randomUUID56(), contactRef, optionalText3(body3, "displayName"), relationship, protectedAddress.ciphertext, protectedAddress.digest, optionalText3(body3, "timezone"), at]);
         const row = inserted.rows[0];
         if (!row) throw new Error("contact_create_failed");
         await client2.query(`INSERT INTO assistant.contact_delivery_endpoints(owner_user_id,id,public_id,endpoint_key,revision,contact_id,channel,address_ciphertext,address_hash,masked_display,state,created_at)
-      SELECT $1,$2,$3,$4,1,$5,'sms',$6,$7,$8,'unverified',$9 WHERE NOT EXISTS(SELECT 1 FROM (SELECT DISTINCT ON(endpoint_key) endpoint_key,contact_id,address_hash,state FROM assistant.contact_delivery_endpoints WHERE owner_user_id=$1 ORDER BY endpoint_key,revision DESC) effective WHERE effective.contact_id=$5 AND effective.address_hash=$7 AND effective.state<>'removed')`, [ownerUserId2.toString(), randomUUID58(), endpointRef, randomUUID58(), row.id, protectedAddress.ciphertext, protectedAddress.digest, maskedPhone(phone), at]);
+      SELECT $1,$2,$3,$4,1,$5,'sms',$6,$7,$8,'unverified',$9 WHERE NOT EXISTS(SELECT 1 FROM (SELECT DISTINCT ON(endpoint_key) endpoint_key,contact_id,address_hash,state FROM assistant.contact_delivery_endpoints WHERE owner_user_id=$1 ORDER BY endpoint_key,revision DESC) effective WHERE effective.contact_id=$5 AND effective.address_hash=$7 AND effective.state<>'removed')`, [ownerUserId2.toString(), randomUUID56(), endpointRef, randomUUID56(), row.id, protectedAddress.ciphertext, protectedAddress.digest, maskedPhone(phone), at]);
         await audit(client2, ownerUserId2.toString(), "assistant.contact.create", row.public_id, at);
         const projected = await client2.query(`SELECT ${CONTACT_PROJECTION} AS projection FROM assistant.contacts contact WHERE contact.owner_user_id=$1 AND contact.public_id=$2`, [ownerUserId2.toString(), row.public_id]);
         return projected.rows[0].projection;
@@ -71172,7 +70752,7 @@ function createPostgresPersonalAssistantControlPlaneStore(options) {
       if (!DIGEST4.test(protectedAddress.digest)) throw new TypeError("protected address digest is invalid");
       return tx(async (client2) => {
         const result3 = await client2.query(`INSERT INTO assistant.contact_delivery_endpoints(owner_user_id,id,public_id,endpoint_key,revision,contact_id,channel,address_ciphertext,address_hash,masked_display,state,created_at)
-      SELECT $1,$2,$3,$4,1,contact.id,$5,$6,$7,$8,'unverified',$9 FROM assistant.contacts contact WHERE contact.owner_user_id=$1 AND contact.public_id=$10 AND contact.deleted_at IS NULL AND NOT EXISTS(SELECT 1 FROM (SELECT DISTINCT ON(endpoint_key) endpoint_key,address_hash,state FROM assistant.contact_delivery_endpoints WHERE owner_user_id=$1 ORDER BY endpoint_key,revision DESC) effective WHERE effective.address_hash=$7 AND effective.state<>'removed')`, [ownerUserId2.toString(), randomUUID58(), endpointRef, randomUUID58(), channel, protectedAddress.ciphertext, protectedAddress.digest, maskedPhone(phone), at, ref4(contactRef)]);
+      SELECT $1,$2,$3,$4,1,contact.id,$5,$6,$7,$8,'unverified',$9 FROM assistant.contacts contact WHERE contact.owner_user_id=$1 AND contact.public_id=$10 AND contact.deleted_at IS NULL AND NOT EXISTS(SELECT 1 FROM (SELECT DISTINCT ON(endpoint_key) endpoint_key,address_hash,state FROM assistant.contact_delivery_endpoints WHERE owner_user_id=$1 ORDER BY endpoint_key,revision DESC) effective WHERE effective.address_hash=$7 AND effective.state<>'removed')`, [ownerUserId2.toString(), randomUUID56(), endpointRef, randomUUID56(), channel, protectedAddress.ciphertext, protectedAddress.digest, maskedPhone(phone), at, ref4(contactRef)]);
         if (!result3.rowCount) return null;
         await client2.query(`UPDATE assistant.contacts SET phone_ciphertext=COALESCE(phone_ciphertext,$3),phone_hash=COALESCE(phone_hash,$4),updated_at=$5 WHERE owner_user_id=$1 AND public_id=$2`, [ownerUserId2.toString(), contactRef, protectedAddress.ciphertext, protectedAddress.digest, at]);
         await audit(client2, ownerUserId2.toString(), "assistant.contact.delivery_endpoint.add", endpointRef, at);
@@ -71185,7 +70765,7 @@ function createPostgresPersonalAssistantControlPlaneStore(options) {
       if (!DIGEST4.test(protectedAddress.digest)) throw new TypeError("protected address digest is invalid");
       return tx(async (client2) => {
         const result3 = await client2.query(`INSERT INTO assistant.contact_delivery_endpoints(owner_user_id,id,public_id,endpoint_key,revision,contact_id,channel,address_ciphertext,address_hash,masked_display,state,created_at)
-      SELECT prior.owner_user_id,$4,$5,prior.endpoint_key,prior.revision+1,prior.contact_id,prior.channel,$6,$7,$8,'unverified',$9 FROM assistant.contact_delivery_endpoints prior JOIN assistant.contacts contact ON contact.owner_user_id=prior.owner_user_id AND contact.id=prior.contact_id WHERE prior.owner_user_id=$1 AND contact.public_id=$2 AND prior.public_id=$3 AND prior.state<>'removed' AND NOT EXISTS(SELECT 1 FROM (SELECT DISTINCT ON(endpoint_key) endpoint_key,address_hash,state FROM assistant.contact_delivery_endpoints WHERE owner_user_id=$1 ORDER BY endpoint_key,revision DESC) effective WHERE effective.address_hash=$7 AND effective.state<>'removed' AND effective.endpoint_key<>prior.endpoint_key)`, [ownerUserId2.toString(), ref4(contactRef), ref4(deliveryEndpointRef), randomUUID58(), nextRef, protectedAddress.ciphertext, protectedAddress.digest, maskedPhone(phone), at]);
+      SELECT prior.owner_user_id,$4,$5,prior.endpoint_key,prior.revision+1,prior.contact_id,prior.channel,$6,$7,$8,'unverified',$9 FROM assistant.contact_delivery_endpoints prior JOIN assistant.contacts contact ON contact.owner_user_id=prior.owner_user_id AND contact.id=prior.contact_id WHERE prior.owner_user_id=$1 AND contact.public_id=$2 AND prior.public_id=$3 AND prior.state<>'removed' AND NOT EXISTS(SELECT 1 FROM (SELECT DISTINCT ON(endpoint_key) endpoint_key,address_hash,state FROM assistant.contact_delivery_endpoints WHERE owner_user_id=$1 ORDER BY endpoint_key,revision DESC) effective WHERE effective.address_hash=$7 AND effective.state<>'removed' AND effective.endpoint_key<>prior.endpoint_key)`, [ownerUserId2.toString(), ref4(contactRef), ref4(deliveryEndpointRef), randomUUID56(), nextRef, protectedAddress.ciphertext, protectedAddress.digest, maskedPhone(phone), at]);
         if (!result3.rowCount) return null;
         await client2.query(`UPDATE assistant.contacts SET phone_ciphertext=$3,phone_hash=$4,updated_at=$5 WHERE owner_user_id=$1 AND public_id=$2`, [ownerUserId2.toString(), contactRef, protectedAddress.ciphertext, protectedAddress.digest, at]);
         await audit(client2, ownerUserId2.toString(), "assistant.contact.delivery_endpoint.update", nextRef, at);
@@ -71197,7 +70777,7 @@ function createPostgresPersonalAssistantControlPlaneStore(options) {
       const body3 = record3(input), at = now().toISOString(), nextRef = newRef2("delivery");
       return tx(async (client2) => {
         const result3 = await client2.query(`INSERT INTO assistant.contact_delivery_endpoints(owner_user_id,id,public_id,endpoint_key,revision,contact_id,channel,address_ciphertext,address_hash,masked_display,state,reason_code,created_at)
-      SELECT prior.owner_user_id,$4,$5,prior.endpoint_key,prior.revision+1,prior.contact_id,prior.channel,prior.address_ciphertext,prior.address_hash,prior.masked_display,'removed',$6,$7 FROM assistant.contact_delivery_endpoints prior JOIN assistant.contacts contact ON contact.owner_user_id=prior.owner_user_id AND contact.id=prior.contact_id WHERE prior.owner_user_id=$1 AND contact.public_id=$2 AND prior.public_id=$3 AND prior.state<>'removed'`, [ownerUserId2.toString(), ref4(contactRef), ref4(deliveryEndpointRef), randomUUID58(), nextRef, optionalText3(body3, "reasonCode") ?? "owner_removed", at]);
+      SELECT prior.owner_user_id,$4,$5,prior.endpoint_key,prior.revision+1,prior.contact_id,prior.channel,prior.address_ciphertext,prior.address_hash,prior.masked_display,'removed',$6,$7 FROM assistant.contact_delivery_endpoints prior JOIN assistant.contacts contact ON contact.owner_user_id=prior.owner_user_id AND contact.id=prior.contact_id WHERE prior.owner_user_id=$1 AND contact.public_id=$2 AND prior.public_id=$3 AND prior.state<>'removed'`, [ownerUserId2.toString(), ref4(contactRef), ref4(deliveryEndpointRef), randomUUID56(), nextRef, optionalText3(body3, "reasonCode") ?? "owner_removed", at]);
         if (!result3.rowCount) return null;
         await client2.query(`WITH effective AS(SELECT DISTINCT ON(endpoint_key) endpoint_key,contact_id,address_ciphertext,address_hash,state,revision FROM assistant.contact_delivery_endpoints WHERE owner_user_id=$1 ORDER BY endpoint_key,revision DESC),replacement AS(SELECT DISTINCT ON(contact_id) contact_id,address_ciphertext,address_hash FROM effective WHERE state<>'removed' ORDER BY contact_id,revision DESC) UPDATE assistant.contacts contact SET phone_ciphertext=replacement.address_ciphertext,phone_hash=replacement.address_hash,updated_at=$3 FROM replacement WHERE contact.owner_user_id=$1 AND contact.public_id=$2 AND replacement.contact_id=contact.id`, [ownerUserId2.toString(), contactRef, at]);
         await client2.query(`UPDATE assistant.contacts SET phone_ciphertext=NULL,phone_hash=NULL,updated_at=$3 WHERE owner_user_id=$1 AND public_id=$2 AND NOT EXISTS(SELECT 1 FROM (SELECT DISTINCT ON(endpoint_key) endpoint_key,contact_id,state FROM assistant.contact_delivery_endpoints WHERE owner_user_id=$1 ORDER BY endpoint_key,revision DESC) effective WHERE effective.contact_id=assistant.contacts.id AND effective.state<>'removed')`, [ownerUserId2.toString(), contactRef, at]);
@@ -71221,7 +70801,7 @@ function createPostgresPersonalAssistantControlPlaneStore(options) {
       const body3 = record3(input), contactRef = ref4(text2(body3, "contactRef")), consentRef = ref4(text2(body3, "consentRef")), at = now().toISOString();
       return tx(async (client2) => {
         const result3 = await client2.query(`INSERT INTO assistant.consent_evidence(owner_user_id,id,public_id,contact_id,sender_endpoint_id,recipient_hash,subject_key,message_class,transition,source,proof_digest,captured_at,withdrawn_at)
-      SELECT prior.owner_user_id,$3,$4,prior.contact_id,prior.sender_endpoint_id,prior.recipient_hash,prior.subject_key,prior.message_class,'withdrawn','internal_dnc',$5,$6,$6 FROM assistant.consent_evidence prior JOIN assistant.contacts contact ON contact.owner_user_id=prior.owner_user_id AND contact.id=prior.contact_id JOIN assistant.channel_endpoints endpoint ON endpoint.owner_user_id=prior.owner_user_id AND endpoint.id=prior.sender_endpoint_id WHERE prior.owner_user_id=$1 AND prior.public_id=$2 AND contact.public_id=$7 RETURNING public_id,(SELECT public_id FROM assistant.channel_endpoints WHERE owner_user_id=$1 AND id=sender_endpoint_id) sender_ref,subject_key,message_class,proof_digest`, [ownerUserId2.toString(), consentRef, randomUUID58(), newRef2("consent"), digest10({ consentRef, at }), at, contactRef]);
+      SELECT prior.owner_user_id,$3,$4,prior.contact_id,prior.sender_endpoint_id,prior.recipient_hash,prior.subject_key,prior.message_class,'withdrawn','internal_dnc',$5,$6,$6 FROM assistant.consent_evidence prior JOIN assistant.contacts contact ON contact.owner_user_id=prior.owner_user_id AND contact.id=prior.contact_id JOIN assistant.channel_endpoints endpoint ON endpoint.owner_user_id=prior.owner_user_id AND endpoint.id=prior.sender_endpoint_id WHERE prior.owner_user_id=$1 AND prior.public_id=$2 AND contact.public_id=$7 RETURNING public_id,(SELECT public_id FROM assistant.channel_endpoints WHERE owner_user_id=$1 AND id=sender_endpoint_id) sender_ref,subject_key,message_class,proof_digest`, [ownerUserId2.toString(), consentRef, randomUUID56(), newRef2("consent"), digest10({ consentRef, at }), at, contactRef]);
         if (!result3.rows[0]) throw new Error("consent_not_found");
         await audit(client2, ownerUserId2.toString(), "assistant.consent.withdraw", consentRef, at);
         const row = result3.rows[0];
@@ -71231,7 +70811,7 @@ function createPostgresPersonalAssistantControlPlaneStore(options) {
     async createSchedule(ownerUserId2, assistantRef2, input) {
       const body3 = record3(input), scheduleRef = newRef2("schedule"), at = now().toISOString();
       return tx(async (client2) => {
-        const result3 = await client2.query(`INSERT INTO assistant.schedules(owner_user_id,id,public_id,assistant_id,source_system,source_ref,source_owner_ref,description,cadence,time_of_day,timezone,logical_vault,status,next_due_at,execution_mode,artifact_selection,source_payload_digest,revision,created_at,updated_at) SELECT $1,$2,$3,assistant.id,$4,$5,$6,$7,$8,$9,$10,$11,'active',$12,$13,$14::jsonb,$15,1,$16,$16 FROM assistant.assistants assistant WHERE assistant.owner_user_id=$1 AND assistant.public_id=$17 RETURNING jsonb_build_object('scheduleRef',public_id,'assistantRef',$17::text,'state',status,'timezone',timezone,'nextDueAt',next_due_at,'revision',revision) AS projection`, [ownerUserId2.toString(), randomUUID58(), scheduleRef, optionalText3(body3, "sourceSystem") ?? "assistant", optionalText3(body3, "sourceRef") ?? scheduleRef, optionalText3(body3, "sourceOwnerRef") ?? ownerUserId2.toString(), text2(body3, "description"), text2(body3, "cadence"), optionalText3(body3, "timeOfDay"), optionalText3(body3, "timezone") ?? "UTC", optionalText3(body3, "logicalVault") ?? "Personal Assistant", text2(body3, "nextDueAt"), optionalText3(body3, "executionMode") ?? "agent", JSON.stringify(body3.artifactSelection ?? { mode: "none" }), digest10(body3), at, ref4(assistantRef2)]);
+        const result3 = await client2.query(`INSERT INTO assistant.schedules(owner_user_id,id,public_id,assistant_id,source_system,source_ref,source_owner_ref,description,cadence,time_of_day,timezone,logical_vault,status,next_due_at,execution_mode,artifact_selection,source_payload_digest,revision,created_at,updated_at) SELECT $1,$2,$3,assistant.id,$4,$5,$6,$7,$8,$9,$10,$11,'active',$12,$13,$14::jsonb,$15,1,$16,$16 FROM assistant.assistants assistant WHERE assistant.owner_user_id=$1 AND assistant.public_id=$17 RETURNING jsonb_build_object('scheduleRef',public_id,'assistantRef',$17::text,'state',status,'timezone',timezone,'nextDueAt',next_due_at,'revision',revision) AS projection`, [ownerUserId2.toString(), randomUUID56(), scheduleRef, optionalText3(body3, "sourceSystem") ?? "assistant", optionalText3(body3, "sourceRef") ?? scheduleRef, optionalText3(body3, "sourceOwnerRef") ?? ownerUserId2.toString(), text2(body3, "description"), text2(body3, "cadence"), optionalText3(body3, "timeOfDay"), optionalText3(body3, "timezone") ?? "UTC", optionalText3(body3, "logicalVault") ?? "Personal Assistant", text2(body3, "nextDueAt"), optionalText3(body3, "executionMode") ?? "agent", JSON.stringify(body3.artifactSelection ?? { mode: "none" }), digest10(body3), at, ref4(assistantRef2)]);
         if (!result3.rows[0]) throw new Error("assistant_not_found");
         await audit(client2, ownerUserId2.toString(), "assistant.schedule.create", scheduleRef, at);
         return result3.rows[0].projection;
@@ -71254,7 +70834,7 @@ function createPostgresPersonalAssistantControlPlaneStore(options) {
     async createReminder(ownerUserId2, assistantRef2, input) {
       const body3 = record3(input), reminderRef2 = newRef2("reminder"), at = now().toISOString(), scheduledFor = text2(body3, "scheduledFor");
       return tx(async (client2) => {
-        const result3 = await client2.query(`INSERT INTO assistant.reminder_occurrences(owner_user_id,id,public_id,assistant_id,schedule_id,schedule_ref,occurrence_key,instruction,scheduled_for,timezone,state,revision,created_at,updated_at) SELECT $1,$2,$3,assistant.id,schedule.id,COALESCE(schedule.public_id,$3),$4,$5,$6,$7,'materialized',1,$8,$8 FROM assistant.assistants assistant LEFT JOIN assistant.schedules schedule ON schedule.owner_user_id=assistant.owner_user_id AND schedule.public_id=$9 WHERE assistant.owner_user_id=$1 AND assistant.public_id=$10 RETURNING jsonb_build_object('reminderRef',public_id,'assistantRef',$10::text,'scheduleRef',CASE WHEN schedule_id IS NULL THEN NULL ELSE schedule_ref END,'state','scheduled','instruction',instruction,'scheduledFor',scheduled_for,'timezone',timezone,'revision',revision,'updatedAt',updated_at) AS projection`, [ownerUserId2.toString(), randomUUID58(), reminderRef2, optionalText3(body3, "occurrenceKey") ?? reminderRef2, text2(body3, "instruction"), scheduledFor, optionalText3(body3, "timezone") ?? "UTC", at, optionalText3(body3, "scheduleRef"), ref4(assistantRef2)]);
+        const result3 = await client2.query(`INSERT INTO assistant.reminder_occurrences(owner_user_id,id,public_id,assistant_id,schedule_id,schedule_ref,occurrence_key,instruction,scheduled_for,timezone,state,revision,created_at,updated_at) SELECT $1,$2,$3,assistant.id,schedule.id,COALESCE(schedule.public_id,$3),$4,$5,$6,$7,'materialized',1,$8,$8 FROM assistant.assistants assistant LEFT JOIN assistant.schedules schedule ON schedule.owner_user_id=assistant.owner_user_id AND schedule.public_id=$9 WHERE assistant.owner_user_id=$1 AND assistant.public_id=$10 RETURNING jsonb_build_object('reminderRef',public_id,'assistantRef',$10::text,'scheduleRef',CASE WHEN schedule_id IS NULL THEN NULL ELSE schedule_ref END,'state','scheduled','instruction',instruction,'scheduledFor',scheduled_for,'timezone',timezone,'revision',revision,'updatedAt',updated_at) AS projection`, [ownerUserId2.toString(), randomUUID56(), reminderRef2, optionalText3(body3, "occurrenceKey") ?? reminderRef2, text2(body3, "instruction"), scheduledFor, optionalText3(body3, "timezone") ?? "UTC", at, optionalText3(body3, "scheduleRef"), ref4(assistantRef2)]);
         if (!result3.rows[0]) throw new Error("assistant_not_found");
         await audit(client2, ownerUserId2.toString(), "assistant.reminder.create", reminderRef2, at);
         return result3.rows[0].projection;
@@ -71278,7 +70858,7 @@ function createPostgresPersonalAssistantControlPlaneStore(options) {
       const body3 = record3(input), packetRef = newRef2("packet"), at = now().toISOString(), manifestDigest = text2(body3, "manifestDigest");
       if (!DIGEST4.test(manifestDigest)) throw new TypeError("manifestDigest is invalid");
       return tx(async (client2) => {
-        const result3 = await client2.query(`INSERT INTO assistant.context_packet_pointers(owner_user_id,id,public_id,assistant_id,context_version_id,memory_vault_ref,packet_ref,packet_revision,revision,manifest_digest,label,sensitivity,state,created_at,updated_at) SELECT $1,$2,$3,assistant.id,context.id,$4,$5,$6,1,$7,$8,$9,'active',$10,$10 FROM assistant.assistants assistant JOIN LATERAL(SELECT id FROM assistant.context_versions WHERE owner_user_id=assistant.owner_user_id AND assistant_id=assistant.id ORDER BY version DESC LIMIT 1) context ON true WHERE assistant.owner_user_id=$1 AND assistant.public_id=$11 RETURNING jsonb_build_object('packetRef',public_id,'assistantRef',$11::text,'revision',revision,'state',state,'manifestDigest',manifest_digest,'label',label,'updatedAt',updated_at) AS projection`, [ownerUserId2.toString(), randomUUID58(), packetRef, text2(body3, "memoryVaultRef"), text2(body3, "memoryPacketRef", packetRef), optionalText3(body3, "packetRevision") ?? "1", manifestDigest, text2(body3, "label"), optionalText3(body3, "sensitivity") ?? "standard", at, ref4(assistantRef2)]);
+        const result3 = await client2.query(`INSERT INTO assistant.context_packet_pointers(owner_user_id,id,public_id,assistant_id,context_version_id,memory_vault_ref,packet_ref,packet_revision,revision,manifest_digest,label,sensitivity,state,created_at,updated_at) SELECT $1,$2,$3,assistant.id,context.id,$4,$5,$6,1,$7,$8,$9,'active',$10,$10 FROM assistant.assistants assistant JOIN LATERAL(SELECT id FROM assistant.context_versions WHERE owner_user_id=assistant.owner_user_id AND assistant_id=assistant.id ORDER BY version DESC LIMIT 1) context ON true WHERE assistant.owner_user_id=$1 AND assistant.public_id=$11 RETURNING jsonb_build_object('packetRef',public_id,'assistantRef',$11::text,'revision',revision,'state',state,'manifestDigest',manifest_digest,'label',label,'updatedAt',updated_at) AS projection`, [ownerUserId2.toString(), randomUUID56(), packetRef, text2(body3, "memoryVaultRef"), text2(body3, "memoryPacketRef", packetRef), optionalText3(body3, "packetRevision") ?? "1", manifestDigest, text2(body3, "label"), optionalText3(body3, "sensitivity") ?? "standard", at, ref4(assistantRef2)]);
         if (!result3.rows[0]) throw new Error("context_version_not_found");
         await audit(client2, ownerUserId2.toString(), "assistant.context.create", packetRef, at);
         return result3.rows[0].projection;
@@ -71333,7 +70913,7 @@ function createPostgresPersonalAssistantNumberPort(options) {
 }
 
 // src/api/personal-assistant-scheduling-store.ts
-import { createHash as createHash78, randomUUID as randomUUID59 } from "crypto";
+import { createHash as createHash76, randomUUID as randomUUID57 } from "crypto";
 var PersonalAssistantSchedulingStoreError = class extends Error {
   constructor(code, message = code, status = code === "schedule_not_found" ? 404 : code === "schedule_activation_unavailable" ? 503 : 409) {
     super(message);
@@ -71349,7 +70929,7 @@ function owner3(ownerUserId2) {
   return ownerUserId2.toString();
 }
 function ref5(prefix) {
-  return `${prefix}_${randomUUID59().replaceAll("-", "")}`;
+  return `${prefix}_${randomUUID57().replaceAll("-", "")}`;
 }
 function iso4(value) {
   return value instanceof Date ? value.toISOString() : new Date(value).toISOString();
@@ -71360,7 +70940,7 @@ function canonicalJson10(value) {
   return JSON.stringify(value);
 }
 function digest11(value) {
-  return createHash78("sha256").update(canonicalJson10(value)).digest("hex");
+  return createHash76("sha256").update(canonicalJson10(value)).digest("hex");
 }
 function authorityClass(value) {
   if (value === "observe") return "observe";
@@ -71473,7 +71053,7 @@ function createPostgresPersonalAssistantSchedulingStore(options) {
             RETURNING id AS schedule_id,revision AS schedule_revision`,
             [
               ownerRef,
-              randomUUID59(),
+              randomUUID57(),
               input.draft.scheduleRef,
               input.draft.instruction,
               scheduleCadence(input.draft),
@@ -71507,7 +71087,7 @@ function createPostgresPersonalAssistantSchedulingStore(options) {
         ) VALUES ($1,$2,$3,$4,$5,$6,$7::jsonb,$8,$9,$10::timestamptz,$11::timestamptz)`,
           [
             ownerRef,
-            randomUUID59(),
+            randomUUID57(),
             ref5("schedrev"),
             schedule.rows[0].schedule_id,
             input.draft.revision,
@@ -71532,7 +71112,7 @@ function createPostgresPersonalAssistantSchedulingStore(options) {
                 AND profile.deleted_at IS NULL AND login.deleted_at IS NULL`,
               [
                 ownerRef,
-                randomUUID59(),
+                randomUUID57(),
                 ref5("sbgrant"),
                 schedule.rows[0].schedule_id,
                 input.draft.revision,
@@ -71602,7 +71182,7 @@ function createPostgresPersonalAssistantSchedulingStore(options) {
           RETURNING id`,
             [
               ownerRef,
-              randomUUID59(),
+              randomUUID57(),
               ref5("sready"),
               row.schedule_id,
               row.revision,
@@ -71651,7 +71231,7 @@ function createPostgresPersonalAssistantSchedulingStore(options) {
           ) VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12::jsonb,$13::timestamptz)`,
             [
               ownerRef,
-              randomUUID59(),
+              randomUUID57(),
               ref5("sactivate"),
               row.schedule_id,
               row.revision,
@@ -71804,7 +71384,7 @@ function assertNoRawTwilioSecretEnvironment(environment2 = process.env) {
 }
 
 // src/api/twilio-messaging-service.ts
-import { createHash as createHash79 } from "crypto";
+import { createHash as createHash77 } from "crypto";
 
 // src/api/personal-assistant-policy.ts
 var AUTHORITY_RANK = {
@@ -72104,10 +71684,10 @@ function canonicalJson11(value) {
   });
 }
 function digest12(value) {
-  return createHash79("sha256").update(canonicalJson11(value)).digest("hex");
+  return createHash77("sha256").update(canonicalJson11(value)).digest("hex");
 }
 function deterministicRef3(prefix, identity) {
-  return `${prefix}_${createHash79("sha256").update(identity).digest("hex").slice(0, 32)}`;
+  return `${prefix}_${createHash77("sha256").update(identity).digest("hex").slice(0, 32)}`;
 }
 function isBoundedAuthorityRef(value) {
   return typeof value === "string" && value.length >= 3 && value.length <= 240 && !value.includes("\0");
@@ -72279,7 +71859,7 @@ function inboundIdentity(input, route) {
   };
 }
 function sha256Bytes(bytes2) {
-  return createHash79("sha256").update(bytes2).digest("hex");
+  return createHash77("sha256").update(bytes2).digest("hex");
 }
 function startsWith(bytes2, signature) {
   return signature.every((value, index) => bytes2[index] === value);
@@ -73458,11 +73038,11 @@ function createTwilioMessagingService(dependencies = {}) {
 }
 
 // src/api/twilio-memory-media.ts
-import { createHash as createHash80, randomUUID as randomUUID60 } from "crypto";
+import { createHash as createHash78, randomUUID as randomUUID58 } from "crypto";
 var IMAGE_TYPES = /* @__PURE__ */ new Set(["image/jpeg", "image/png", "image/gif", "image/webp"]);
 var FILE_TYPES = /* @__PURE__ */ new Set(["application/pdf", "text/plain"]);
 function digestBytes(bytes2) {
-  return createHash80("sha256").update(bytes2).digest("hex");
+  return createHash78("sha256").update(bytes2).digest("hex");
 }
 function publicPointer(pointer) {
   return Object.freeze({
@@ -73546,7 +73126,7 @@ function createTwilioMemoryMedia(options) {
       return publicPointer(await options.pointers.put({
         ownerBindingRef: input.ownerBindingRef,
         mediaRef: input.mediaRef,
-        renewablePointerRef: `memory_asset_${createHash80("sha256").update(`${input.ownerBindingRef}\0${asset.assetId}`).digest("hex").slice(0, 32)}`,
+        renewablePointerRef: `memory_asset_${createHash78("sha256").update(`${input.ownerBindingRef}\0${asset.assetId}`).digest("hex").slice(0, 32)}`,
         byteDigest: input.byteDigest,
         contentType: input.contentType,
         byteSize: input.bytes.byteLength,
@@ -73579,7 +73159,7 @@ function createTwilioMemoryMedia(options) {
 }
 
 // src/api/twilio-provider-facade.ts
-import { createHash as createHash81 } from "crypto";
+import { createHash as createHash79 } from "crypto";
 
 // src/api/twilio-messaging-client.ts
 import twilio4 from "twilio";
@@ -73914,7 +73494,7 @@ function validAuthority(input) {
   return /^[1-9]\d*$/u.test(input.ownerUserId) && PUBLIC_REF2.test(input.executionRef) && ACCOUNT_SID3.test(input.providerAccountRef) && PUBLIC_REF2.test(input.connectionRef) && /^[A-Za-z][A-Za-z0-9_.:-]{2,159}$/u.test(input.environmentRef);
 }
 function digest13(value) {
-  return createHash81("sha256").update(JSON.stringify(value, (_key, entry) => {
+  return createHash79("sha256").update(JSON.stringify(value, (_key, entry) => {
     if (!entry || typeof entry !== "object" || Array.isArray(entry)) return entry;
     return Object.fromEntries(Object.entries(entry).sort(([a], [b]) => a.localeCompare(b)));
   })).digest("hex");
@@ -74103,7 +73683,7 @@ function createTwilioProduction(options) {
 }
 
 // src/runtime/personal-assistant-deployment-config.ts
-import { createHash as createHash82 } from "crypto";
+import { createHash as createHash80 } from "crypto";
 import { readFileSync as readFileSync4 } from "fs";
 import { resolve as resolve2 } from "path";
 var REF_PATTERN = /^(?:[a-z][a-z0-9+.-]*:\/\/)?[A-Za-z0-9][A-Za-z0-9._:/-]{2,240}$/;
@@ -74139,7 +73719,7 @@ function databaseBinding(value) {
     const database = decodeURIComponent(parsed.pathname.replace(/^\//, ""));
     const role = decodeURIComponent(parsed.username);
     if (!database || !/^[a-z_][a-z0-9_]*$/.test(role)) return null;
-    return { fingerprint: createHash82("sha256").update(`${labels.join(".")}\0${database}`).digest("hex"), role };
+    return { fingerprint: createHash80("sha256").update(`${labels.join(".")}\0${database}`).digest("hex"), role };
   } catch {
     return null;
   }
@@ -74601,7 +74181,7 @@ function createPersonalAssistantHostedConfigurationAdapter(input) {
 }
 
 // src/api/personal-assistant-authorization.ts
-import { createHash as createHash83 } from "crypto";
+import { createHash as createHash81 } from "crypto";
 import { z as z49 } from "zod";
 var ABUSE_GATED_OPERATIONS = /* @__PURE__ */ new Set(["assistant.message.send", "assistant.bulk.send"]);
 var NORMALIZED_RECIPIENT_OPERATIONS = /* @__PURE__ */ new Set([
@@ -74779,7 +74359,7 @@ function canonicalJson12(value) {
   return JSON.stringify(value, (_key, entry) => entry && typeof entry === "object" && !Array.isArray(entry) ? Object.fromEntries(Object.entries(entry).sort(([a], [b]) => a.localeCompare(b))) : entry);
 }
 function factDigest(value) {
-  return createHash83("sha256").update(canonicalJson12(value)).digest("hex");
+  return createHash81("sha256").update(canonicalJson12(value)).digest("hex");
 }
 var PostgresPersonalAssistantPolicyFactsRepository = class {
   constructor(db, contexts, now = () => /* @__PURE__ */ new Date()) {
@@ -74969,7 +74549,7 @@ var PostgresPersonalAssistantPolicyFactsRepository = class {
 };
 
 // src/api/personal-assistant-abuse-controls.ts
-import { createHash as createHash84 } from "crypto";
+import { createHash as createHash82 } from "crypto";
 var EMPTY_STATE = () => ({
   version: 1,
   events: [],
@@ -74980,7 +74560,7 @@ var EMPTY_STATE = () => ({
   bulkIdentities: {}
 });
 function digest14(value) {
-  return createHash84("sha256").update(JSON.stringify(value)).digest("hex");
+  return createHash82("sha256").update(JSON.stringify(value)).digest("hex");
 }
 function isDigest(value) {
   return typeof value === "string" && /^[a-f0-9]{64}$/.test(value);
@@ -75069,10 +74649,10 @@ function applyRequest(state2, request, policy7) {
   const at = validateRequest(request, policy7);
   if (at === null) return decision("deny", "invalid_abuse_request", request);
   trimState(state2, at, policy7);
-  const fingerprint6 = digest14({ ...request, occurredAt: void 0 });
+  const fingerprint5 = digest14({ ...request, occurredAt: void 0 });
   const logicalFingerprint = digest14({ ...request, idempotencyKey: void 0, occurredAt: void 0 });
   const idempotent = state2.decisions[request.idempotencyKey];
-  if (idempotent && idempotent.fingerprint !== fingerprint6) return decision("deny", "invalid_abuse_request", request);
+  if (idempotent && idempotent.fingerprint !== fingerprint5) return decision("deny", "invalid_abuse_request", request);
   const logical = state2.logicalReservations[request.logicalMessageRef];
   if (logical && logical.fingerprint !== logicalFingerprint) return decision("deny", "invalid_abuse_request", request);
   let bulkIdentity = request.bulk ? state2.bulkIdentities[request.bulk.operationRef] : void 0;
@@ -75086,7 +74666,7 @@ function applyRequest(state2, request, policy7) {
   }
   if (logical && !isAdministratorKillReason(logical.decision.reason)) {
     const replay = Object.freeze({ ...logical.decision, replayed: true });
-    state2.decisions[request.idempotencyKey] = { fingerprint: fingerprint6, decision: replay };
+    state2.decisions[request.idempotencyKey] = { fingerprint: fingerprint5, decision: replay };
     return replay;
   }
   if (idempotent) delete state2.decisions[request.idempotencyKey];
@@ -75178,7 +74758,7 @@ function applyRequest(state2, request, policy7) {
       suspicious: Boolean(request.suspiciousInbound)
     });
   }
-  const stored = { fingerprint: fingerprint6, decision: result3 };
+  const stored = { fingerprint: fingerprint5, decision: result3 };
   state2.decisions[request.idempotencyKey] = stored;
   state2.logicalReservations[request.logicalMessageRef] = {
     fingerprint: digest14({ ...request, idempotencyKey: void 0, occurredAt: void 0 }),
@@ -75189,11 +74769,11 @@ function applyRequest(state2, request, policy7) {
 function applyOutcome(state2, outcome, policy7) {
   const at = Date.parse(outcome.occurredAt);
   if (!Number.isFinite(at) || !outcome.ownerUserId || !outcome.numberRef || !isDigest(outcome.recipientHash) || !outcome.logicalMessageRef || !outcome.idempotencyKey || !validPolicy(policy7)) return;
-  const fingerprint6 = digest14(outcome);
+  const fingerprint5 = digest14(outcome);
   const prior = state2.outcomeReceipts[outcome.idempotencyKey];
   if (prior) return;
   trimState(state2, at, policy7);
-  state2.outcomeReceipts[outcome.idempotencyKey] = { fingerprint: fingerprint6, at };
+  state2.outcomeReceipts[outcome.idempotencyKey] = { fingerprint: fingerprint5, at };
   if (outcome.outcome === "succeeded") {
     state2.failures = state2.failures.filter((event2) => event2.numberRef !== outcome.numberRef && event2.recipientHash !== outcome.recipientHash);
   }
@@ -75240,10 +74820,10 @@ var PostgresPersonalAssistantAbuseStore = class {
 };
 
 // src/api/twilio-authority-billing-postgres.ts
-import { createHash as createHash86, randomUUID as randomUUID61 } from "crypto";
+import { createHash as createHash84, randomUUID as randomUUID59 } from "crypto";
 
 // src/api/personal-assistant-billing.ts
-import { createHash as createHash85 } from "crypto";
+import { createHash as createHash83 } from "crypto";
 var AssistantBillingError = class extends Error {
   constructor(code, message) {
     super(message);
@@ -75260,7 +74840,7 @@ function canonicalJson13(value) {
   });
 }
 function digest15(value) {
-  return createHash85("sha256").update(canonicalJson13(value)).digest("hex");
+  return createHash83("sha256").update(canonicalJson13(value)).digest("hex");
 }
 function assertMoney(value, field) {
   if (!Number.isSafeInteger(value) || value < 0) throw new AssistantBillingError("billing_invalid_input", `${field} must be a non-negative safe integer.`);
@@ -75305,7 +74885,7 @@ function canonicalJson14(value) {
   });
 }
 function digest16(value) {
-  return createHash86("sha256").update(canonicalJson14(value)).digest("hex");
+  return createHash84("sha256").update(canonicalJson14(value)).digest("hex");
 }
 function amountFor2(usage) {
   return usage.reduce((sum2, item) => sum2 + item.units * item.rateMinorPerUnit, 0);
@@ -75377,7 +74957,7 @@ function createPostgresAssistantBillingStore(options = {}) {
           FROM assistant.commands command WHERE command.owner_user_id=$1 AND command.public_id=$14
           RETURNING *, $14::text AS command_ref`, [
           input.ownerUserId.toString(),
-          randomUUID61(),
+          randomUUID59(),
           input.billingRef,
           input.idempotencyKey,
           input.requestDigest,
@@ -75397,7 +74977,7 @@ function createPostgresAssistantBillingStore(options = {}) {
           SELECT $1,$2,billing.id,$3,$4,'authorize',$5,$6,$7 FROM assistant.billing_holds billing
           WHERE billing.owner_user_id=$1 AND billing.public_id=$8`, [
           input.ownerUserId.toString(),
-          randomUUID61(),
+          randomUUID59(),
           `authorize:${input.idempotencyKey}`,
           inputDigest,
           input.requestDigest,
@@ -75463,7 +75043,7 @@ function createPostgresAssistantBillingStore(options = {}) {
           FROM assistant.billing_holds billing WHERE billing.owner_user_id=$1 AND billing.public_id=$9`,
           [
             input.ownerUserId.toString(),
-            randomUUID61(),
+            randomUUID59(),
             input.eventKey,
             eventDigest,
             input.outcome,
@@ -75511,7 +75091,7 @@ function createPostgresAssistantBillingStore(options = {}) {
           FROM assistant.billing_holds billing WHERE billing.owner_user_id=$1 AND billing.public_id=$8`,
           [
             input.ownerUserId.toString(),
-            randomUUID61(),
+            randomUUID59(),
             input.eventKey,
             eventDigest,
             input.evidenceDigest,
@@ -75540,8 +75120,8 @@ function createPostgresAssistantBillingStore(options = {}) {
 import {
   createCipheriv as createCipheriv3,
   createDecipheriv as createDecipheriv3,
-  createHash as createHash87,
-  createHmac as createHmac15,
+  createHash as createHash85,
+  createHmac as createHmac14,
   randomBytes as randomBytes10
 } from "crypto";
 var ENVELOPE_VERSION = "pa1";
@@ -75598,7 +75178,7 @@ function canonicalContext(input) {
   });
 }
 function contextDigest(context) {
-  return createHash87("sha256").update(context, "utf8").digest("hex");
+  return createHash85("sha256").update(context, "utf8").digest("hex");
 }
 function decodeBase64Url(value, expectedBytes) {
   if (!value || !BASE64URL.test(value)) throw new PersonalAssistantProtectedDataCryptoError("protected_data_envelope_invalid");
@@ -75708,7 +75288,7 @@ function createFromKeyring(options) {
   }
   function hmacForPurpose(value, purpose) {
     const context = canonicalContext({ purpose, ownerBindingRef, environmentRef });
-    return createHmac15("sha256", materialFor().hmacKey).update(context, "utf8").update("\0").update(value, "utf8").digest("hex");
+    return createHmac14("sha256", materialFor().hmacKey).update(context, "utf8").update("\0").update(value, "utf8").digest("hex");
   }
   function twilioAad(messageRef) {
     if (!BINDING_REF.test(messageRef)) throw new PersonalAssistantProtectedDataCryptoError("protected_data_context_invalid");
@@ -75787,8 +75367,8 @@ async function resolvePersonalAssistantProtectedDataCryptoFactory(options) {
 }
 
 // src/api/twilio-first-text-context-postgres.ts
-import { createHash as createHash88 } from "crypto";
-var digest17 = (value) => createHash88("sha256").update(value).digest("hex");
+import { createHash as createHash86 } from "crypto";
+var digest17 = (value) => createHash86("sha256").update(value).digest("hex");
 function createPostgresTwilioFirstTextDiagnosticContextResolver(options = {}) {
   const queryable = options.queryable ?? getAssistantPool();
   return async (input) => {
@@ -75833,10 +75413,10 @@ function createPostgresTwilioFirstTextDiagnosticContextResolver(options = {}) {
 }
 
 // src/api/twilio-first-text-diagnostic-postgres.ts
-import { createHash as createHash90, randomBytes as randomBytes12, randomUUID as randomUUID62 } from "crypto";
+import { createHash as createHash88, randomBytes as randomBytes12, randomUUID as randomUUID60 } from "crypto";
 
 // src/api/twilio-first-text-diagnostic.ts
-import { createHash as createHash89, randomBytes as randomBytes11 } from "crypto";
+import { createHash as createHash87, randomBytes as randomBytes11 } from "crypto";
 var TWILIO_FIRST_TEXT_BODY = ASSISTANT_CONSENT_CONTENT_V1.diagnosticMessage;
 var TwilioFirstTextDiagnosticError = class extends Error {
   constructor(code) {
@@ -75847,10 +75427,10 @@ var TwilioFirstTextDiagnosticError = class extends Error {
   code;
 };
 function digest18(value) {
-  return createHash89("sha256").update(JSON.stringify(value)).digest("hex");
+  return createHash87("sha256").update(JSON.stringify(value)).digest("hex");
 }
 function stableRef2(prefix, identity) {
-  return `${prefix}_${createHash89("sha256").update(identity).digest("hex").slice(0, 32)}`;
+  return `${prefix}_${createHash87("sha256").update(identity).digest("hex").slice(0, 32)}`;
 }
 function providerSid(result3) {
   const value = result3.receipt.providerMessageSid;
@@ -75962,14 +75542,14 @@ function createTwilioFirstTextDiagnosticService(dependencies) {
 var COLUMNS = `owner_user_id::text,public_id,idempotency_key,request_digest,policy_version,recipient_ref,sender_ref,
  state,mode,stages,provider_message_sid,inbound_event_ref,routing_receipt_ref,acknowledgement_receipt_ref,
  retry_eligible,failure_code,execution_token_digest,created_at,updated_at`;
-var digest19 = (value) => createHash90("sha256").update(value).digest("hex");
+var digest19 = (value) => createHash88("sha256").update(value).digest("hex");
 var iso5 = (value) => new Date(value).toISOString();
 function receipt3(row) {
   return Object.freeze({
     diagnosticRef: row.public_id,
     ownerUserId: row.owner_user_id,
     idempotencyKey: row.idempotency_key,
-    executionRef: `execution_${createHash90("sha256").update(row.public_id).digest("hex").slice(0, 32)}`,
+    executionRef: `execution_${createHash88("sha256").update(row.public_id).digest("hex").slice(0, 32)}`,
     requestDigest: row.request_digest,
     policyVersion: row.policy_version,
     recipientRef: row.recipient_ref,
@@ -76010,7 +75590,7 @@ function createPostgresTwilioFirstTextDiagnosticStore(options = {}) {
           ON CONFLICT (owner_user_id,idempotency_key) DO NOTHING RETURNING ${COLUMNS}`,
           [
             input.ownerUserId,
-            randomUUID62(),
+            randomUUID60(),
             input.diagnosticRef,
             input.idempotencyKey,
             input.requestDigest,
@@ -76137,10 +75717,10 @@ function createTwilioInboundQuarantineClaimAuthorizer(options) {
 }
 
 // src/api/twilio-inbound-claim-control-plane-postgres.ts
-import { createHash as createHash91, randomUUID as randomUUID63 } from "crypto";
-var stableRef3 = (prefix, value) => `${prefix}_${createHash91("sha256").update(value).digest("hex").slice(0, 32)}`;
+import { createHash as createHash89, randomUUID as randomUUID61 } from "crypto";
+var stableRef3 = (prefix, value) => `${prefix}_${createHash89("sha256").update(value).digest("hex").slice(0, 32)}`;
 var stableUuid = (value) => {
-  const hex = createHash91("sha256").update(value).digest("hex").slice(0, 32).split("");
+  const hex = createHash89("sha256").update(value).digest("hex").slice(0, 32).split("");
   hex[12] = "5";
   hex[16] = (Number.parseInt(hex[16], 16) & 3 | 8).toString(16);
   return `${hex.slice(0, 8).join("")}-${hex.slice(8, 12).join("")}-${hex.slice(12, 16).join("")}-${hex.slice(16, 20).join("")}-${hex.slice(20).join("")}`;
@@ -76191,7 +75771,7 @@ function createPostgresTwilioInboundClaimControlPlane(options) {
           (owner_user_id,id,public_id,endpoint_key,revision,contact_id,channel,address_ciphertext,address_hash,masked_display,state,reason_code,created_at)
           VALUES ($1::bigint,$2,$3,$4,1,$5,'sms',$6,$7,$8,'unverified','claimed_inbound_requires_enrollment',$9::timestamptz)
           ON CONFLICT (owner_user_id,public_id) DO NOTHING`,
-          [input.ownerUserId, randomUUID63(), endpointRef, endpointKey, contact.rows[0].id, sender.ciphertext, sender.digest, mask(input.sender), input.occurredAt]
+          [input.ownerUserId, randomUUID61(), endpointRef, endpointKey, contact.rows[0].id, sender.ciphertext, sender.digest, mask(input.sender), input.occurredAt]
         );
         const route = number.rows[0];
         const conversationRef = stableRef3(
@@ -76222,12 +75802,12 @@ function createPostgresTwilioInboundClaimControlPlane(options) {
 }
 
 // src/api/twilio-inbound-envelope-postgres.ts
-import { createHash as createHash93 } from "crypto";
+import { createHash as createHash91 } from "crypto";
 
 // src/api/twilio-inbound-admission-postgres.ts
-import { createHash as createHash92, randomBytes as randomBytes13, randomUUID as randomUUID64 } from "crypto";
+import { createHash as createHash90, randomBytes as randomBytes13, randomUUID as randomUUID62 } from "crypto";
 function tokenHash4(value) {
-  return createHash92("sha256").update(value).digest("hex");
+  return createHash90("sha256").update(value).digest("hex");
 }
 function rowToRecord(row) {
   return Object.freeze({
@@ -76272,7 +75852,7 @@ function createPostgresTwilioInboundAdmissionControl(options = {}) {
         DO UPDATE SET request_count=assistant.twilio_webhook_rate_buckets.request_count+1,updated_at=EXCLUDED.updated_at
         RETURNING request_count`, [
           input.ownerUserId,
-          randomUUID64(),
+          randomUUID62(),
           input.providerAccountRef,
           input.scope,
           input.subjectKey,
@@ -76306,7 +75886,7 @@ function createPostgresTwilioInboundAdmissionStore(options = {}) {
           provider_message_sid,provider_messaging_service_sid,lane_key,routing_state,payload_digest,protected_envelope,state,attempt,admitted_at`,
           [
             input.ownerUserId,
-            randomUUID64(),
+            randomUUID62(),
             input.ingressRef,
             input.ownerBindingRef,
             input.providerAccountRef,
@@ -76396,7 +75976,7 @@ function createPostgresTwilioInboundAdmissionStore(options = {}) {
 
 // src/api/twilio-inbound-envelope-postgres.ts
 function stableRef4(prefix, identity) {
-  return `${prefix}_${createHash93("sha256").update(identity).digest("hex").slice(0, 32)}`;
+  return `${prefix}_${createHash91("sha256").update(identity).digest("hex").slice(0, 32)}`;
 }
 function parseStoredEnvelope(value) {
   let parsed;
@@ -76610,7 +76190,7 @@ function createPostgresTwilioInboundAdmissionRuntime(options) {
 }
 
 // src/api/twilio-inbound-quarantine-postgres.ts
-import { randomUUID as randomUUID65 } from "crypto";
+import { randomUUID as randomUUID63 } from "crypto";
 function createPostgresTwilioInboundQuarantineAdmissionControl(options = {}) {
   const transaction2 = options.transaction ?? ((work) => withAssistantTransaction((client2) => work(client2)));
   const windowSeconds = options.windowSeconds ?? 60;
@@ -76690,7 +76270,7 @@ function createPostgresTwilioInboundQuarantineStore(options = {}) {
         ) VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,'pending',$11,$12::timestamptz,$13::timestamptz,$14::timestamptz,$14::timestamptz)
         ON CONFLICT DO NOTHING RETURNING ${COLUMNS2}`,
           [
-            randomUUID65(),
+            randomUUID63(),
             input.quarantineRef,
             input.providerAccountDigest,
             input.providerMessageDigest,
@@ -76758,11 +76338,11 @@ function createPostgresTwilioInboundQuarantineStore(options = {}) {
 }
 
 // src/api/twilio-inbound-quarantine.ts
-import { createHash as createHash94, createHmac as createHmac16, timingSafeEqual as timingSafeEqual10 } from "crypto";
+import { createHash as createHash92, createHmac as createHmac15, timingSafeEqual as timingSafeEqual10 } from "crypto";
 var DIGEST7 = /^[a-f0-9]{64}$/u;
 var OPAQUE2 = /^[A-Za-z][A-Za-z0-9_.:-]{2,199}$/u;
 function digest20(value) {
-  return createHash94("sha256").update(value).digest("hex");
+  return createHash92("sha256").update(value).digest("hex");
 }
 function stableRef5(prefix, identity) {
   return `${prefix}_${digest20(identity).slice(0, 32)}`;
@@ -76777,14 +76357,14 @@ function tokenPayload(payload) {
 }
 function signToken(secret, payload) {
   const encoded = tokenPayload(payload);
-  return `${encoded}.${createHmac16("sha256", secret).update(encoded).digest("base64url")}`;
+  return `${encoded}.${createHmac15("sha256", secret).update(encoded).digest("base64url")}`;
 }
 function verifyToken2(secret, token7, now) {
   const [encoded, suppliedSignature, extra] = token7.split(".");
   if (!encoded || !suppliedSignature || extra !== void 0 || token7.length > 2048) {
     throw new TwilioInboundAdmissionError("inbound_claim_rejected");
   }
-  const expected = createHmac16("sha256", secret).update(encoded).digest();
+  const expected = createHmac15("sha256", secret).update(encoded).digest();
   let supplied;
   try {
     supplied = Buffer.from(suppliedSignature, "base64url");
@@ -77077,10 +76657,10 @@ async function createPersonalAssistantTwilioTransportProduction(options) {
 }
 
 // src/api/twilio-number-production.ts
-import { createHash as createHash96, randomUUID as randomUUID67 } from "crypto";
+import { createHash as createHash94, randomUUID as randomUUID65 } from "crypto";
 
 // src/api/twilio-number-repository.ts
-import { createHash as createHash95, randomUUID as randomUUID66 } from "crypto";
+import { createHash as createHash93, randomUUID as randomUUID64 } from "crypto";
 var PUBLIC_REF3 = /^[a-z][a-z0-9_]*_[A-Za-z0-9_-]{3,128}$/;
 var DIGEST8 = /^[a-f0-9]{64}$/;
 var ACCOUNT_SID4 = /^AC[0-9a-f]{32}$/i;
@@ -77169,7 +76749,7 @@ function priceValue(value) {
   }), blocker: null });
 }
 function digest21(value) {
-  return createHash95("sha256").update(JSON.stringify(value, (_key, entry) => {
+  return createHash93("sha256").update(JSON.stringify(value, (_key, entry) => {
     if (!entry || typeof entry !== "object" || Array.isArray(entry)) return entry;
     return Object.fromEntries(Object.entries(entry).sort(([a], [b]) => a.localeCompare(b)));
   })).digest("hex");
@@ -77296,7 +76876,7 @@ function createPostgresTwilioNumberOwnerRepository(options) {
   const ownerUserId2 = requireOwner(options.ownerUserId);
   const queryable = options.queryable ?? getAssistantPool();
   const transaction2 = options.transaction ?? ((work) => withAssistantTransaction((client2) => work(client2)));
-  const newId = options.newId ?? randomUUID66;
+  const newId = options.newId ?? randomUUID64;
   const now = options.now ?? (() => /* @__PURE__ */ new Date());
   const snapshot = validateSnapshot(options.resourceSnapshot, ownerUserId2, now());
   async function numberRow(numberRef) {
@@ -77956,13 +77536,13 @@ function createPostgresTwilioNumberProductionAdapters(options) {
 }
 function twilioProviderAccountDigest(providerAccountRef) {
   if (!ACCOUNT_SID4.test(providerAccountRef)) throw new TwilioNumberRepositoryError("invalid_provider_account", "Twilio account assignment is invalid.", 400);
-  return createHash95("sha256").update(providerAccountRef).digest("hex");
+  return createHash93("sha256").update(providerAccountRef).digest("hex");
 }
 
 // src/api/twilio-number-production.ts
 var DIGEST9 = /^[a-f0-9]{64}$/u;
 function hash3(value) {
-  return createHash96("sha256").update(typeof value === "string" ? value : JSON.stringify(value, (_key, entry) => {
+  return createHash94("sha256").update(typeof value === "string" ? value : JSON.stringify(value, (_key, entry) => {
     if (!entry || typeof entry !== "object" || Array.isArray(entry)) return entry;
     return Object.fromEntries(Object.entries(entry).sort(([a], [b]) => a.localeCompare(b)));
   })).digest("hex");
@@ -78215,12 +77795,12 @@ function createPostgresTwilioNumberAuthorityAdapters(options) {
           WHERE approval.owner_user_id=$1 AND approval.state IN ('pending','approved') AND command.owner_user_id=approval.owner_user_id
             AND command.id=approval.command_id AND command.assistant_id=$2`, [ownerUserId2.toString(), row.assistant_id]);
         const authorityEpoch = hash3({ ownerUserId: ownerUserId2.toString(), numberRef: input.numberRef, releaseRef: input.releaseRef, occurredAt: input.occurredAt });
-        const auditRef = `audit_${randomUUID67().replace(/-/g, "")}`;
+        const auditRef = `audit_${randomUUID65().replace(/-/g, "")}`;
         await client2.query(
           `INSERT INTO assistant.audit_events(owner_user_id,id,public_id,assistant_id,actor_kind,event_type,
           operation,decision,reason_code,correlation_id,evidence_digest,details,occurred_at)
           VALUES($1,$2,$3,$4,'system','twilio.number.release.freeze','twilio.number.release','allow','authority_invalidated',$5,$6,$7::jsonb,$8)`,
-          [ownerUserId2.toString(), randomUUID67(), auditRef, row.assistant_id, authorityEpoch, hash3(input.releaseRef), JSON.stringify({ numberRef: input.numberRef, releaseRef: input.releaseRef }), input.occurredAt]
+          [ownerUserId2.toString(), randomUUID65(), auditRef, row.assistant_id, authorityEpoch, hash3(input.releaseRef), JSON.stringify({ numberRef: input.numberRef, releaseRef: input.releaseRef }), input.occurredAt]
         );
         return {
           authorityEpoch,
@@ -78375,7 +77955,7 @@ function createTwilioNumberProductionInterfaces(options) {
 }
 
 // src/api/twilio-number-service.ts
-import { createHash as createHash97, randomUUID as randomUUID68 } from "crypto";
+import { createHash as createHash95, randomUUID as randomUUID66 } from "crypto";
 var DEFAULT_RESERVATION_TTL_MS = 5 * 60 * 1e3;
 var MIN_RESERVATION_TTL_MS = 60 * 1e3;
 var MAX_RESERVATION_TTL_MS = 10 * 60 * 1e3;
@@ -78511,7 +78091,7 @@ function canonicalJson15(value) {
   });
 }
 function digest22(value) {
-  return createHash97("sha256").update(canonicalJson15(value)).digest("hex");
+  return createHash95("sha256").update(canonicalJson15(value)).digest("hex");
 }
 function requireIdempotencyKey(value) {
   if (typeof value !== "string" || !/^[A-Za-z0-9][A-Za-z0-9:._/-]{7,239}$/.test(value)) {
@@ -78632,7 +78212,7 @@ function publicReleaseReceipt(receipt4, replayed = receipt4.replayed) {
 }
 function createTwilioNumberService(dependencies = {}) {
   const now = dependencies.now ?? (() => /* @__PURE__ */ new Date());
-  const newId = dependencies.newId ?? randomUUID68;
+  const newId = dependencies.newId ?? randomUUID66;
   const ttlMs = dependencies.reservationTtlMs ?? DEFAULT_RESERVATION_TTL_MS;
   if (!Number.isInteger(ttlMs) || ttlMs < MIN_RESERVATION_TTL_MS || ttlMs > MAX_RESERVATION_TTL_MS) {
     throw new TwilioNumberServiceError("invalid_configuration", "Number reservation lifetime must be from one through ten minutes.", 500);
@@ -79940,7 +79520,7 @@ function presence(env) {
 }
 function fingerprintDigest(env) {
   const value = env.PA_NEON_BINDING_FINGERPRINT?.trim();
-  return value ? createHash98("sha256").update("personal-assistant-binding-v1\0").update(value).digest("hex") : null;
+  return value ? createHash96("sha256").update("personal-assistant-binding-v1\0").update(value).digest("hex") : null;
 }
 function missingHostedBindings(env) {
   return Object.entries(REQUIRED_HOSTED_BINDINGS).filter(([, variable]) => !env[variable]?.trim()).map(([name]) => `binding_${name}_missing`);
@@ -80173,7 +79753,7 @@ function shouldRunSiteExtractInBackground(input) {
 }
 
 // src/api/page-media-artifacts.ts
-import { createHash as createHash99, randomBytes as randomBytes14 } from "crypto";
+import { createHash as createHash97, randomBytes as randomBytes14 } from "crypto";
 import { homedir as homedir4 } from "os";
 import { basename, extname, join as join9 } from "path";
 import pLimit6 from "p-limit";
@@ -80320,7 +79900,7 @@ async function fetchMedia(rawUrl, expectedType) {
       finalUrl: checked.parsed.href,
       width: dimensions?.width ?? null,
       height: dimensions?.height ?? null,
-      sha256: createHash99("sha256").update(bytes2).digest("hex")
+      sha256: createHash97("sha256").update(bytes2).digest("hex")
     };
   }
   throw new Error("media_redirect_rejected");
@@ -80526,13 +80106,13 @@ async function reconcileSiteExtractSettlements(limit = 25) {
 }
 
 // src/api/page-diff.ts
-import { createHash as createHash100 } from "crypto";
+import { createHash as createHash98 } from "crypto";
 import { diffLines } from "diff";
 var MAX_SNAPSHOT_CONTENT_CHARS = 25e4;
 var MAX_DIFF_HUNKS = 200;
 var MAX_DIFF_LINES_PER_RESPONSE = 2e3;
 function sha256Hex(value) {
-  return createHash100("sha256").update(value).digest("hex");
+  return createHash98("sha256").update(value).digest("hex");
 }
 function truncateForStorage(value, maxChars = MAX_SNAPSHOT_CONTENT_CHARS) {
   if (value.length <= maxChars) return { value, truncated: false };
@@ -80646,10 +80226,10 @@ async function persistScrapeBody(user, opts) {
 }
 
 // src/api/scrape-image-sink.ts
-import { createHash as createHash101 } from "crypto";
+import { createHash as createHash99 } from "crypto";
 var MAX_IMAGES_PER_SCRAPE = 25;
 function idempotencyKey3(userId, vault, input) {
-  return `scrape-image-${createHash101("sha256").update(`${userId}\0${vault}\0${input.sourceKind}\0${input.sourceUrl}\0${input.imageUrl ?? ""}\0${input.imageBase64 ?? ""}`).digest("hex")}`;
+  return `scrape-image-${createHash99("sha256").update(`${userId}\0${vault}\0${input.sourceKind}\0${input.sourceUrl}\0${input.imageUrl ?? ""}\0${input.imageBase64 ?? ""}`).digest("hex")}`;
 }
 async function persistScrapeImagesToMemory(user, inputs, vault) {
   const selected = inputs.slice(0, MAX_IMAGES_PER_SCRAPE);
@@ -81121,7 +80701,7 @@ function inferredWaybackCapturedAt(content) {
 }
 
 // src/api/connection-memory-import.ts
-import { createHash as createHash102 } from "crypto";
+import { createHash as createHash100 } from "crypto";
 var CONNECTION_MEMORY_IMPORT_MAX_ARGS_BYTES = 64 * 1024;
 var CONNECTION_MEMORY_IMPORT_MAX_RESULT_BYTES = 1e6;
 var CONNECTION_MEMORY_IMPORT_MAX_STRING_CHARS = 256e3;
@@ -81151,7 +80731,7 @@ function canonicalJson16(value) {
   return JSON.stringify(value);
 }
 function sha2562(value) {
-  return createHash102("sha256").update(value).digest("hex");
+  return createHash100("sha256").update(value).digest("hex");
 }
 function sensitiveKey(key3) {
   const normalized = key3.toLowerCase().replace(/[^a-z0-9]/g, "");
@@ -81420,7 +81000,7 @@ async function cleanupExpiredScrapeBlobs(maxAgeMs = SCRAPE_BLOB_TTL_MS) {
 }
 
 // src/api/site-export-reader.ts
-import { createHash as createHash103 } from "crypto";
+import { createHash as createHash101 } from "crypto";
 var SiteExportFormatUnavailableError = class extends Error {
   constructor(format) {
     super(`The ${format} representation was not retained for this export page.`);
@@ -81430,7 +81010,7 @@ var SiteExportFormatUnavailableError = class extends Error {
   format;
 };
 function sha2563(value) {
-  return createHash103("sha256").update(value).digest("hex");
+  return createHash101("sha256").update(value).digest("hex");
 }
 function publicPageRecord(page3) {
   const { bodyMarkdown: _body, contentRef: _contentRef, discoveryLinks: _discovery, ...metadata } = page3;
@@ -81540,7 +81120,7 @@ async function readOwnedSiteExportImage(input) {
 }
 
 // src/api/search-console-table-export.ts
-import { randomUUID as randomUUID69 } from "crypto";
+import { randomUUID as randomUUID67 } from "crypto";
 var SEARCH_CONSOLE_TABLE_EXPORT_MAX_ROWS = 5e4;
 var SEARCH_CONSOLE_TABLE_EXPORT_PAGE_SIZE = 2e3;
 var SEARCH_CONSOLE_TABLE_EXPORT_MAX_BYTES = 50 * 1024 * 1024;
@@ -81640,7 +81220,7 @@ async function exportSearchConsoleTableData(args) {
     offset += rows.length;
     if (stoppedForBytes || rows.length < limit || offset >= matchedRows) break;
   }
-  const exportId = randomUUID69();
+  const exportId = randomUUID67();
   const artifact = await args.writeArtifact({
     ownerId: args.ownerId,
     exportId,
@@ -81995,7 +81575,7 @@ async function dbUsage(identity, plan) {
 }
 
 // src/api/resend-control.ts
-import { createHash as createHash104 } from "crypto";
+import { createHash as createHash102 } from "crypto";
 var DEFAULT_CONNECTION_CONTROL_URL = "https://mcp-scraper-scheduler.vercel.app";
 var RESEND_PROVIDER_CONFIG_KEY = "resend";
 var RESEND_LOGO_URL = "https://cdn.resend.com/brand/resend-icon-black.svg";
@@ -82254,7 +81834,7 @@ async function callResendRead(identity, connectionId, tool, args) {
   return isRecord9(data) ? data.result ?? data : data;
 }
 async function callResendAction(identity, connectionId, tool, input, idempotencyKey4) {
-  const requestId = `main-resend-action:${createHash104("sha256").update(identity).update("\0").update(idempotencyKey4.trim()).digest("hex")}`;
+  const requestId = `main-resend-action:${createHash102("sha256").update(identity).update("\0").update(idempotencyKey4.trim()).digest("hex")}`;
   const body3 = await controlRequest2("/api/internal/resend/actions/call", {
     method: "POST",
     headers: { "x-request-id": requestId },
@@ -82604,6 +82184,10 @@ app.post("/account/delete", requireAllowedOrigin, sessionAuth, async (c) => {
       }
     }
   }
+  await setSubscriptionTier(user.id, null, 0, null);
+  await setConcurrencyPackQuantity(user.id, 0);
+  await setConcurrencySubId(user.id, null);
+  await setMemoryPlan(user.id, "free", null);
   await deactivateUser(user.id);
   deleteCookie(c, "session", { path: "/", secure: secureCookies2, sameSite: "Strict" });
   return c.json({ ok: true });
@@ -83063,6 +82647,15 @@ function scheduleConnectionError(c, err, fallback) {
       retryable: err.retryable
     }, err.status);
   }
+  if (err instanceof MainNangoTransportError) {
+    return c.json({
+      ok: false,
+      error: err.message,
+      code: err.code,
+      errorCode: err.code,
+      retryable: err.retryable
+    }, err.status);
+  }
   if (err instanceof ResendControlError) return c.json({ ok: false, error: err.message }, err.status);
   console.error("[schedule-connections]", err instanceof Error ? err.message : String(err));
   return c.json({ ok: false, error: fallback }, 502);
@@ -83120,7 +82713,7 @@ async function combinedConnectionCatalog() {
   }
   if (nango.status === "rejected" && resend.status === "rejected") throw nango.reason;
   return [
-    ...nango.status === "fulfilled" ? nango.value : [],
+    ...nango.status === "fulfilled" ? nango.value.filter((entry) => !isWithdrawnNangoProvider(entry.providerConfigKey)) : [],
     ...resend.status === "fulfilled" ? resend.value : []
   ];
 }
@@ -83137,7 +82730,7 @@ async function combinedConnections(identity) {
   }
   if (nango.status === "rejected" && resend.status === "rejected") throw nango.reason;
   return [
-    ...nango.status === "fulfilled" ? nango.value.map((connection) => ({ ...connection, transport: "nango", adminBlockedTools: [] })) : [],
+    ...nango.status === "fulfilled" ? nango.value.filter((connection) => !isWithdrawnNangoProvider(connection.providerConfigKey)).map((connection) => ({ ...connection, transport: "nango", adminBlockedTools: [] })) : [],
     ...resend.status === "fulfilled" ? resend.value.map((connection) => ({
       ...connection,
       toolCapabilities: [
@@ -83278,6 +82871,7 @@ app.post("/schedule-connections/session", auth5, requireIntegrationsTier, async
   const providerConfigKey = providerConfigKeyFrom(body3.providerConfigKey);
   if (!providerConfigKey) return c.json({ ok: false, error: "providerConfigKey is required." }, 400);
   try {
+    assertNangoProviderAvailable(providerConfigKey);
     if (providerConfigKey !== "resend") {
       await reconcileConnectedAccountBilling(user, await getNangoConnections(user.email, { summaryOnly: true }));
     }
@@ -83456,7 +83050,7 @@ app.post("/schedule-connections/actions/gmail/send-message", auth5, requireInteg
   }
   try {
     const result3 = await directGmailService.sendMessage({
-      ownerId: createHash105("sha256").update(user.api_key).digest("hex").slice(0, 24),
+      ownerId: createHash103("sha256").update(user.api_key).digest("hex").slice(0, 24),
       providerIdentity: user.email,
       connectionId,
       to: body3.to,
@@ -84218,7 +83812,7 @@ app.post("/harvest", auth5, async (c) => {
     if (!harvestOk) return c.json(insufficientBalanceResponse(harvestBal, harvestCost), 402);
     jobId2 = await createJob(user.id, options.query, { ...options, billingHoldMc: harvestCost }, body3.callback_url);
   } else {
-    jobId2 = derivedJobId ?? randomUUID70();
+    jobId2 = derivedJobId ?? randomUUID68();
     const billingDebitKey = `paa-harvest:${jobId2}:hold`;
     const description = `PAA harvest: ${options.query}`.slice(0, 500);
     const hold2 = await debitMcIdempotent(
@@ -84304,11 +83898,11 @@ app.post("/harvest/sync", auth5, async (c) => {
       return c.json({ error: "Idempotency-Key must contain 1-200 characters.", errorCode: "invalid_idempotency_key", retryable: false }, 400);
     }
     derivedJobId = `sync_${sha256Hex(`${user.id}\0${trimmedKey}`).slice(0, 24)}`;
-    const fingerprint6 = JSON.stringify(options);
+    const fingerprint5 = JSON.stringify(options);
     const existing = await getJob(derivedJobId, user.id);
     if (existing) {
       const existingFingerprint = JSON.stringify(existing.options);
-      if (existingFingerprint !== fingerprint6) {
+      if (existingFingerprint !== fingerprint5) {
         return c.json({ error: "Idempotency-Key was already used for a different harvest_paa/search_serp call.", errorCode: "idempotency_conflict", retryable: false }, 409);
       }
       if (existing.status === "done") {
@@ -84527,11 +84121,11 @@ app.post("/extract-url", auth5, async (c) => {
       return c.json({ error: "Idempotency-Key must contain 1-200 characters.", errorCode: "invalid_idempotency_key", retryable: false }, 400);
     }
     derivedJobId = `exurl_${sha256Hex(`${user.id}\0${trimmedKey}`).slice(0, 24)}`;
-    const fingerprint6 = JSON.stringify(bodyResult.data);
+    const fingerprint5 = JSON.stringify(bodyResult.data);
     const existing = await getJob(derivedJobId, user.id);
     if (existing) {
       const existingFingerprint = JSON.stringify(existing.options);
-      if (existingFingerprint !== fingerprint6) {
+      if (existingFingerprint !== fingerprint5) {
         return c.json({ error: "Idempotency-Key was already used for a different extract_url call.", errorCode: "idempotency_conflict", retryable: false }, 409);
       }
       if (existing.status === "done") {
@@ -85773,7 +85367,7 @@ app.get("/cron/tick", async (c) => {
     return c.json({ error: "Unauthorized" }, 401);
   }
   const startedAt = Date.now();
-  const { drainQueue } = await import("./worker-VTFGHWZL.js");
+  const { drainQueue } = await import("./worker-5A375BGN.js");
   const budget = { maxJobs: 10, deadlineMs: startedAt + CRON_TICK_DRAIN_BUDGET_MS };
   const origin = `${new URL(c.req.url).protocol}//${new URL(c.req.url).host}`;
   const unfinished = [];
@@ -85897,8 +85491,8 @@ app.post("/api/internal/extract-refinalize/:id", async (c) => {
     finishExtractJob: finishExtractJob2,
     terminalExtractJobStatus: terminalExtractJobStatus2,
     extractJobLimitInfo: extractJobLimitInfo2
-  } = await import("./site-extract-repository-3WC3VB5Y.js");
-  const { assembleExtractArtifacts } = await import("./extract-bundle-SI35H4HR.js");
+  } = await import("./site-extract-repository-DWU52BRQ.js");
+  const { assembleExtractArtifacts } = await import("./extract-bundle-NSMGHEG6.js");
   const existing = await getExtractJob2(jobId2);
   if (!existing) return c.json({ error: "job not found" }, 404);
   if (existing.status !== "failed") {
@@ -85925,7 +85519,7 @@ app.post("/api/internal/extract-refinalize/:id", async (c) => {
   if (!updated) return c.json({ error: "job state changed during re-finalization" }, 409);
   let settlement = "already_settled_or_refunded";
   if (job.billedMc == null && job.userId != null) {
-    const { settleExtractJob: settleExtractJob3, countSuccessfulPages: countSuccessfulPages2 } = await import("./site-extract-repository-3WC3VB5Y.js");
+    const { settleExtractJob: settleExtractJob3, countSuccessfulPages: countSuccessfulPages2 } = await import("./site-extract-repository-DWU52BRQ.js");
     const heldMc = Number(job.options.heldMc ?? 0);
     const successful = await countSuccessfulPages2(jobId2);
     const usedMc = Math.min(successful * MC_COSTS.page_scrape, heldMc);