mcp-scraper 0.85.0 → 0.86.1

package/dist/{server-EOPETL7Q.js → server-UQ33P5V5.js}

@@ -43,7 +43,7 @@ import {
   setExtractJobTotal,
   settleExtractJob,
   terminalExtractJobStatus
-} from "./chunk-C7OKENCR.js";
+} from "./chunk-KQWVJOVR.js";
 import {
   REQUIRED_LOCATION_STATE_CODES,
   importHostedCensusPlacesCsv,
@@ -105,7 +105,7 @@ import {
   probeNangoConnectionDirect,
   recordNangoConnectionCost,
   settleConnectedUsage
-} from "./chunk-W3SGF7GX.js";
+} from "./chunk-WFGAR4BZ.js";
 import {
   ANALYTICS_ATTRIBUTION_MODELS,
   ANALYTICS_CONTENT_SORTS,
@@ -134,6 +134,7 @@ import {
   claimAnalyticsCrmImportRows,
   claimAnalyticsFormDeliveryJobs,
   completeAnalyticsCrmImportRow,
+  completeAnalyticsFormBridgeDelivery,
   completeAnalyticsFormDelivery,
   consumeAnalyticsSurveyInvite,
   createAnalyticsActivationDestination,
@@ -148,6 +149,7 @@ import {
   deferAnalyticsCrmImportRow,
   deferAnalyticsFormDelivery,
   deleteAnalyticsSite,
+  deterministicAnalyticsCrmEntityId,
   encryptAnalyticsRestricted,
   enrichAnalyticsExistingCrmIdentity,
   getAnalyticsActivationDestinationConnectionRef,
@@ -172,9 +174,8 @@ import {
   normalizeProviderReceipt,
   pollAnalyticsActivationDiagnostics,
   prepareAnalyticsLinkerIssue,
-  queueAnalyticsFormDelivery,
+  queueAnalyticsFormBridgeTransaction,
   readImmutableConfirmedAttributionEvidence,
-  recordAnalyticsFormSubmission,
   redeemAnalyticsLinkerRecord,
   refreshAnalyticsDailyRollupsIfDue,
   requireAnalyticsAccess,
@@ -193,7 +194,7 @@ import {
   upsertAnalyticsAdSpend,
   upsertAnalyticsHostGroup,
   verifyAnalyticsWebhookSignature
-} from "./chunk-TLRJV4SL.js";
+} from "./chunk-X623GTBV.js";
 import {
   claimServiceConnectionAction,
   ensureServiceConnectionsSchema,
@@ -387,7 +388,7 @@ import {
   transcribeMediaUrl,
   transitionAnalyticsExperiment,
   validateAnalyticsRestResponseForRequest
-} from "./chunk-W4IY6CB4.js";
+} from "./chunk-3H7QTJLV.js";
 import {
   auditImageUrls,
   auditImages,
@@ -458,7 +459,7 @@ import {
   tierChangeLeavesPrivateOffer,
   tierCreditsPerInterval,
   vendorCostUsdToMc
-} from "./chunk-X5HRAAQM.js";
+} from "./chunk-NKRO2SUO.js";
 import {
   browserServiceApiKey,
   browserServiceProfileName,
@@ -508,7 +509,7 @@ import {
 } from "./chunk-GGZEC22A.js";
 import {
   PACKAGE_VERSION
-} from "./chunk-RHAOKXQK.js";
+} from "./chunk-C4C4WUTV.js";
 import {
   CaptchaError,
   MapsSearchIncompletePageError,
@@ -3971,7 +3972,7 @@ async function generateOgImage(post) {
 
 // src/api/server.ts
 import { Resend as Resend3 } from "resend";
-import { createHash as createHash103, randomUUID as randomUUID68 } from "crypto";
+import { createHash as createHash104, randomUUID as randomUUID69 } from "crypto";
 
 // src/api/kpo-extractor.ts
 import TurndownService from "turndown";
@@ -7321,7 +7322,7 @@ async function extractSite(opts) {
 }
 
 // src/api/server.ts
-import { Hono as Hono48 } from "hono";
+import { Hono as Hono49 } from "hono";
 import { serve as serveInngest } from "inngest/hono";
 
 // src/inngest/client.ts
@@ -9763,7 +9764,7 @@ var siteExtractFn = inngest.createFunction(
       });
     }) : null;
     const finalized = await step.run("finalize", async () => {
-      const { assembleExtractArtifacts } = await import("./extract-bundle-NSMGHEG6.js");
+      const { assembleExtractArtifacts } = await import("./extract-bundle-FALNLKYY.js");
       const current = await getExtractJob(jobId2);
       if (!current) throw new Error("extract job disappeared before finalization");
       const stored = await assembleExtractArtifacts(current, { branding, imageAudit });
@@ -21498,25 +21499,36 @@ async function recordPendingBrightDataRedditUsage(providerSessionId, telemetry)
 async function refreshFinalizedRedditProbeCosts() {
   const db = getDb();
   const probes = await db.execute({
-    sql: `SELECT v.probe_run_id, SUM(v.est_cost_usd) AS cost
+    sql: `SELECT v.probe_run_id,
+                 SUM(CASE WHEN v.method = ? THEN v.est_cost_usd ELSE 0 END) AS cost,
+                 SUM(CASE WHEN v.method = ? THEN 1 ELSE 0 END) AS pending_count
           FROM vendor_usage_log v JOIN cost_probe_runs p ON p.id = v.probe_run_id
-          WHERE v.method = ? AND v.probe_run_id IS NOT NULL
+          WHERE v.vendor = 'brightdata_browser_api' AND v.method IN (?, ?) AND v.probe_run_id IS NOT NULL
           GROUP BY v.probe_run_id
-          HAVING ABS(SUM(v.est_cost_usd) - MAX(p.vendor_cost_usd)) > 0.000000000001
-             OR MAX(CASE WHEN json_valid(p.notes) THEN json_extract(p.notes, '$.providerCostPending') ELSE 0 END) = 1
+          HAVING ABS(SUM(CASE WHEN v.method = ? THEN v.est_cost_usd ELSE 0 END) - MAX(p.vendor_cost_usd)) > 0.000000000001
+             OR MAX(CASE WHEN json_valid(p.notes) THEN COALESCE(json_extract(p.notes, '$.providerCostPending'), 0) ELSE 0 END)
+                != CASE WHEN SUM(CASE WHEN v.method = ? THEN 1 ELSE 0 END) > 0 THEN 1 ELSE 0 END
           LIMIT 100`,
-    args: [REDDIT_COMPLETE_METHOD]
+    args: [
+      REDDIT_COMPLETE_METHOD,
+      REDDIT_PENDING_METHOD,
+      REDDIT_COMPLETE_METHOD,
+      REDDIT_PENDING_METHOD,
+      REDDIT_COMPLETE_METHOD,
+      REDDIT_PENDING_METHOD
+    ]
   });
   for (const probe of probes.rows) {
     const cost = Number(probe.cost ?? 0);
+    const providerCostPending = Number(probe.pending_count ?? 0) > 0;
     await db.execute({
       sql: `UPDATE cost_probe_runs SET
               margin_usd_headless_starter = margin_usd_headless_starter - (? - vendor_cost_usd),
               margin_usd_headful_starter = margin_usd_headful_starter - (? - vendor_cost_usd),
               vendor_cost_usd = ?,
-              notes = CASE WHEN json_valid(notes) THEN json_set(notes, '$.providerCostPending', json('false')) ELSE notes END
+              notes = CASE WHEN json_valid(notes) THEN json_set(notes, '$.providerCostPending', json(?)) ELSE notes END
             WHERE id = ?`,
-      args: [cost, cost, cost, probe.probe_run_id]
+      args: [cost, cost, cost, providerCostPending ? "true" : "false", probe.probe_run_id]
     });
   }
 }
@@ -21724,39 +21736,77 @@ async function runBrightDataRedditThreadBackup(url2, requestedComments) {
 
 // src/reddit/thread-retrieval.ts
 async function retrieveRedditThread(kernelApiKey, input) {
-  let primaryFailure;
-  if (!kernelApiKey) primaryFailure = new Error("Kernel Reddit primary is not configured");
-  else {
-    try {
-      const primary = await runKernelRedditThread(kernelApiKey, input);
-      if (!isAcceptedRedditThread(primary.thread, input.maxComments)) {
-        throw new Error(`Kernel Reddit primary returned ${primary.thread.comments.length} comments below the ${redditThreadAcceptanceTarget(primary.thread, input.maxComments)} comment acceptance target`);
+  const kernelFailures = [];
+  let kernelAttempts = 0;
+  if (!kernelApiKey) {
+    kernelFailures.push("Kernel Reddit primary is not configured");
+  } else {
+    for (let attempt = 1; attempt <= 2; attempt += 1) {
+      kernelAttempts = attempt;
+      try {
+        const primary = await runKernelRedditThread(kernelApiKey, input);
+        if (!isAcceptedRedditThread(primary.thread, input.maxComments)) {
+          throw new Error(`Kernel Reddit primary returned ${primary.thread.comments.length} comments below the ${redditThreadAcceptanceTarget(primary.thread, input.maxComments)} comment acceptance target`);
+        }
+        return {
+          ...primary,
+          diagnostics: {
+            ...primary.diagnostics,
+            fallbackUsed: false,
+            retrievalProvider: "kernel",
+            kernelAttempts,
+            brightDataAttempts: 0,
+            totalAttempts: kernelAttempts,
+            kernelFailures
+          }
+        };
+      } catch (error) {
+        const message = sanitizeProviderLocalMessage(error instanceof Error ? error.message : String(error)) ?? "Kernel Reddit primary failed";
+        kernelFailures.push(message);
+        console.warn(JSON.stringify({
+          event: "reddit_kernel_primary_rejected",
+          attempt,
+          max_attempts: 2,
+          will_retry: attempt < 2,
+          error: message,
+          fallback: attempt === 2 ? "bright_data_browser_api" : null
+        }));
       }
+    }
+  }
+  const brightDataFailures = [];
+  for (let attempt = 1; attempt <= 2; attempt += 1) {
+    try {
+      const backup = await runBrightDataRedditThreadBackup(input.url, Math.min(input.maxComments, 25));
       return {
-        ...primary,
-        diagnostics: { ...primary.diagnostics, fallbackUsed: false, retrievalProvider: "kernel" }
+        ...backup,
+        diagnostics: {
+          ...backup.diagnostics,
+          retrievalProvider: "bright_data_browser_api",
+          primaryProvider: "kernel",
+          primaryFailure: kernelFailures.at(-1) ?? "Kernel Reddit primary failed",
+          kernelAttempts,
+          brightDataAttempts: attempt,
+          totalAttempts: kernelAttempts + attempt,
+          kernelFailures,
+          brightDataFailures
+        }
       };
     } catch (error) {
-      primaryFailure = error instanceof Error ? error : new Error(String(error));
+      const message = sanitizeProviderLocalMessage(error instanceof Error ? error.message : String(error)) ?? "Bright Data Reddit backup failed";
+      brightDataFailures.push(message);
+      console.warn(JSON.stringify({
+        event: "reddit_bright_data_backup_rejected",
+        attempt,
+        max_attempts: 2,
+        will_retry: attempt < 2,
+        error: message
+      }));
     }
   }
-  const primaryError = sanitizeProviderLocalMessage(primaryFailure.message) ?? "Kernel Reddit primary failed";
-  console.warn(JSON.stringify({ event: "reddit_kernel_primary_rejected", error: primaryError, fallback: "bright_data_browser_api" }));
-  try {
-    const backup = await runBrightDataRedditThreadBackup(input.url, Math.min(input.maxComments, 25));
-    return {
-      ...backup,
-      diagnostics: {
-        ...backup.diagnostics,
-        retrievalProvider: "bright_data_browser_api",
-        primaryProvider: "kernel",
-        primaryFailure: primaryError
-      }
-    };
-  } catch (backupError) {
-    const backupMessage = sanitizeProviderLocalMessage(backupError instanceof Error ? backupError.message : String(backupError)) ?? "Bright Data Reddit backup failed";
-    throw new Error(`Reddit retrieval failed: Kernel primary: ${primaryError}; Bright Data backup: ${backupMessage}`);
-  }
+  throw new Error(
+    `Reddit retrieval failed: Kernel attempts: ${kernelFailures.join(" | ")}; Bright Data attempts: ${brightDataFailures.join(" | ")}`
+  );
 }
 
 // src/api/reddit-routes.ts
@@ -21826,7 +21876,7 @@ redditApp.post("/thread", createApiKeyAuth(), async (c) => {
       canonicalUrl: receipt4.canonicalUrl,
       oldRedditUrl: null,
       retrievalSource: "www_reddit",
-      attempts: receipt4.diagnostics.fallbackUsed ? 2 : 1,
+      attempts: receipt4.diagnostics.totalAttempts ?? (receipt4.diagnostics.fallbackUsed ? 2 : 1),
       diagnostics: receipt4.diagnostics
     };
     const commentCount = Array.isArray(result3.comments) ? result3.comments.length : 0;
@@ -35418,17 +35468,17 @@ async function discoverAnalyticsCrmEffectiveProfile(input) {
   const publicProfile = getAnalyticsCrmProviderProfile(provider);
   const payload = provider === "highlevel" ? { locationId: input.discoveryContext?.locationId } : provider === "zoho" ? { module: input.discoveryContext?.zohoModules?.[0] ?? "Contacts" } : {};
   if (provider === "highlevel" && !safeString(payload.locationId, 128)) throw new Error("analytics_crm_highlevel_location_required");
-  const call = (actionPayload, suffix2) => input.dependencies.callAction({
+  const call2 = (actionPayload, suffix2) => input.dependencies.callAction({
     connectionId: input.connectionId,
     action: ANALYTICS_CRM_NANGO_ACTIONS.discoverSchema,
     payload: actionPayload,
     idempotencyKey: stableId("crmdiscover", { provider, connectionId: input.connectionId, actionPayload, suffix: suffix2 })
   });
-  let raw = await call(payload);
+  let raw = await call2(payload);
   if (provider === "zoho") {
     const modules = [...new Set(input.discoveryContext?.zohoModules ?? ["Contacts", "Deals"])];
     const results = [raw];
-    for (const module of modules.slice(1)) results.push(await call({ module }, module));
+    for (const module of modules.slice(1)) results.push(await call2({ module }, module));
     raw = { moduleResults: results };
   }
   const normalized = normalizeProviderSchema(provider, raw);
@@ -39772,7 +39822,7 @@ loadChannels();
 
 // src/api/vault-routes.ts
 import { Hono as Hono30 } from "hono";
-var VAULTS = ["People", "Organizations", "Deals", "Projects", "Tasks", "Communications", "Calendar"];
+var VAULTS = ["People", "Organizations", "CRM People", "CRM Organizations", "Deals", "Projects", "Tasks", "Communications", "Calendar"];
 var PROJECT_TYPES = ["codebase", "personal", "work", "client"];
 var PROJECT_KIND_BY_TYPE = {
   codebase: "codebase",
@@ -39856,6 +39906,8 @@ function normalizeRelationshipProps(vault, props) {
 }
 function defaultType(vault) {
   if (vault === "People" || vault === "Communications") return "unclassified";
+  if (vault === "CRM People") return "person";
+  if (vault === "CRM Organizations") return "organization";
   if (vault === "Organizations") return "organization";
   if (vault === "Deals") return "deal";
   if (vault === "Projects") return "project";
@@ -39864,7 +39916,7 @@ function defaultType(vault) {
   return "unclassified";
 }
 function defaultStatus(vault) {
-  if (vault === "People" || vault === "Organizations") return "active";
+  if (vault === "People" || vault === "Organizations" || vault === "CRM People" || vault === "CRM Organizations") return "active";
   if (vault === "Deals") return "lead";
   if (vault === "Projects") return "active";
   if (vault === "Tasks") return "to_do";
@@ -39939,7 +39991,7 @@ async function mapWithConcurrency3(items, limit, map) {
   await Promise.all(Array.from({ length: Math.min(limit, items.length) }, () => worker()));
   return values;
 }
-async function readVault(vault, token7) {
+async function readLegacyVault(vault, token7) {
   const list = await readMemory("listTool", { vault }, token7);
   if (!list.ok) throw new Error(list.error ?? `unable to read ${vault}`);
   const noteRefs = (list.notes ?? []).slice(0, MAX_VAULT_RECORDS);
@@ -39952,6 +40004,28 @@ async function readVault(vault, token7) {
   if (failed && !failed.ok) throw new Error(failed.error ?? `unable to read ${vault} record`);
   return notes.filter((result3) => result3.ok && !!result3.note).map((result3) => workspaceRecord(vault, result3.note));
 }
+async function readVault(vault, token7) {
+  const tool = vault === "People" ? "researchPersonSearchTool" : vault === "Organizations" ? "researchOrganizationSearchTool" : vault === "CRM People" ? "crmPersonSearchTool" : vault === "CRM Organizations" ? "crmOrganizationSearchTool" : null;
+  if (!tool) return readLegacyVault(vault, token7);
+  const result3 = await memoryCall(tool, { limit: MAX_VAULT_RECORDS }, token7);
+  if (!result3.ok) throw new Error(result3.error ?? `unable to read ${vault}`);
+  return (result3.items ?? []).map((item) => workspaceRecord(vault, {
+    path: item.entityId,
+    title: item.displayName,
+    content: item.content,
+    kind: vault.startsWith("CRM ") ? "crm" : "research",
+    updatedAt: item.updatedAt,
+    capturedAt: item.createdAt,
+    revision: item.revision,
+    props: {
+      ...item.props,
+      type: vault === "People" || vault === "CRM People" ? "person" : "organization",
+      relationship_status: item.relationshipStatus,
+      relationship_types: item.relationshipTypes,
+      commercial_lifecycle: item.commercialLifecycle
+    }
+  }));
+}
 vaultApp.get("/api/workspace", async (c) => {
   const token7 = c.req.query("token");
   if (!validToken(token7)) return c.json({ ok: false, error: "missing or malformed Vault App link" }, 401);
@@ -39976,6 +40050,9 @@ vaultApp.post("/api/records", async (c) => {
   const content = typeof body3.content === "string" && body3.content.length <= 1e5 ? body3.content : "";
   const props = propsValue(body3.props) ?? {};
   if (!isVault(vault) || !path5 || !title) return c.json({ ok: false, error: "vault, path, and title are required" }, 400);
+  if (["People", "Organizations", "CRM People", "CRM Organizations"].includes(vault)) {
+    return c.json({ ok: false, error: "Governed Research and CRM records must be created through the native Research or CRM workflow." }, 409);
+  }
   const normalizedProps = normalizeRelationshipProps(vault, props);
   const validationError2 = validateNewRecord(vault, normalizedProps);
   if (validationError2) return c.json({ ok: false, error: validationError2 }, 400);
@@ -45170,10 +45247,10 @@ function mergeArticleSections(left, right) {
     categories: uniqueStrings([...left.categories, ...right.categories]).slice(0, 50)
   };
 }
-function mergeUniqueRecords(items, keyFor) {
+function mergeUniqueRecords(items, keyFor2) {
   const map = /* @__PURE__ */ new Map();
   for (const item of items) {
-    const key3 = keyFor(item).toLowerCase().replace(/\s+/g, " ").trim();
+    const key3 = keyFor2(item).toLowerCase().replace(/\s+/g, " ").trim();
     map.set(key3, { ...map.get(key3), ...item });
   }
   return [...map.values()];
@@ -46637,10 +46714,11 @@ function previewAnalyticsManualImport(input) {
       continue;
     }
     identities.add(identityKey2);
-    const digest23 = createHash31("sha256").update(`${parsedInput.sourceSystem}:${stableIdentity}`).digest("hex").slice(0, 24);
+    const digest23 = createHash31("sha256").update(`${parsedInput.sourceSystem}:${stableIdentity}`).digest("hex");
+    const crmEntityId = `${digest23.slice(0, 8)}-${digest23.slice(8, 12)}-5${digest23.slice(13, 16)}-${(Number.parseInt(digest23.slice(16, 18), 16) & 63 | 128).toString(16)}${digest23.slice(18, 20)}-${digest23.slice(20, 32)}`;
     rows.push({
       row: rowNumber,
-      crmPersonRef: `People::Leads/person-${digest23}`,
+      crmPersonRef: crmEntityId,
       ...displayName ? { displayName } : {},
       ...firstName ? { firstName } : {},
       ...lastName ? { lastName } : {},
@@ -48410,9 +48488,9 @@ function sanitizeNangoToolDescription(body3, tool) {
       true
     );
   }
-  let serializedBytes = Number.POSITIVE_INFINITY;
+  let serializedBytes2 = Number.POSITIVE_INFINITY;
   try {
-    serializedBytes = Buffer.byteLength(JSON.stringify(rawTool), "utf8");
+    serializedBytes2 = Buffer.byteLength(JSON.stringify(rawTool), "utf8");
   } catch {
   }
   const name = cleanString3(rawTool.name, 200);
@@ -48427,7 +48505,7 @@ function sanitizeNangoToolDescription(body3, tool) {
   const outputSchema = outputSchemaValue === void 0 ? void 0 : sanitizeToolSchema(outputSchemaValue);
   const blockedReasonValue = rawTool.blockedReason ?? rawTool.blocked_reason;
   const blockedReason = blockedReasonValue === null || blockedReasonValue === void 0 ? null : blockedReasonValue === "actions_disabled" || blockedReasonValue === "inactive_connection" || blockedReasonValue === "missing_permission" || blockedReasonValue === "missing_app_feature" || blockedReasonValue === "permission_policy_missing" || blockedReasonValue === "permission_verification_unavailable" ? blockedReasonValue : void 0;
-  if (serializedBytes > 256 * 1024 || !name || name !== tool || classification !== "read" && classification !== "action" || typeof rawTool.callable !== "boolean" || blockedReason === void 0 || transport !== "nango" && transport !== "remote_mcp" || !providerConfigKey || schemaSource !== "live_tools_list" || !upstreamSchemaHash || !/^[a-f0-9]{64}$/i.test(upstreamSchemaHash) || !fetchedAt || Number.isNaN(Date.parse(fetchedAt)) || !inputSchema || outputSchemaValue !== void 0 && !outputSchema) {
+  if (serializedBytes2 > 256 * 1024 || !name || name !== tool || classification !== "read" && classification !== "action" || typeof rawTool.callable !== "boolean" || blockedReason === void 0 || transport !== "nango" && transport !== "remote_mcp" || !providerConfigKey || schemaSource !== "live_tools_list" || !upstreamSchemaHash || !/^[a-f0-9]{64}$/i.test(upstreamSchemaHash) || !fetchedAt || Number.isNaN(Date.parse(fetchedAt)) || !inputSchema || outputSchemaValue !== void 0 && !outputSchema) {
     throw new NangoControlError(
       "The connection service returned an invalid live tool description.",
       502,
@@ -48567,7 +48645,7 @@ async function callMainOwnedExportPage(identity, input) {
     });
   }
   if (connection.providerConfigKey === "google-mail" && input.dataset === "emails") {
-    const { GmailService: GmailService2 } = await import("./gmail-service-BTRAHGJS.js");
+    const { GmailService: GmailService2 } = await import("./gmail-service-BUSU4BVX.js");
     const service = new GmailService2();
     const ownerId3 = createHash32("sha256").update(identity.toLowerCase()).digest("hex").slice(0, 24);
     const after = Math.floor(Date.parse(input.from) / 1e3);
@@ -51927,7 +52005,15 @@ var ANALYTICS_PRIVACY_FIELD_REGISTRY = Object.freeze([
   {
     dataClass: "pseudonymous_identity",
     purpose: "site_analytics",
-    fields: ["identity.value_hmac", "session.visitor_hmac", "session.session_hmac", "person.public_ref"],
+    fields: [
+      "identity.value_hmac",
+      "identity.assignment_person_id",
+      "identity.assignment_crm_entity_id",
+      "identity.conflict_person_ids",
+      "session.visitor_hmac",
+      "session.session_hmac",
+      "person.public_ref"
+    ],
     storage: "pseudonymous",
     defaultRetentionDays: 395,
     readSurface: "privacy_export",
@@ -51981,7 +52067,14 @@ var ANALYTICS_PRIVACY_FIELD_REGISTRY = Object.freeze([
   {
     dataClass: "normalized_receipts",
     purpose: "necessary",
-    fields: ["ingestion.reason_codes", "webhook.signature_status", "activation.safe_error_category", "crm.safe_error_code"],
+    fields: [
+      "ingestion.reason_codes",
+      "webhook.signature_status",
+      "activation.safe_error_category",
+      "crm.safe_error_code",
+      "form_bridge.opaque_entity_id",
+      "form_bridge.safe_error_code"
+    ],
     storage: "ordinary",
     defaultRetentionDays: 30,
     readSurface: "privacy_export",
@@ -52062,7 +52155,7 @@ var ANALYTICS_PRIVACY_RELATION_REGISTRY = Object.freeze([
   `),
   ...relationPolicies("candidate_evidence", false, "expire", `analytics_runtime_rule_health`),
   ...relationPolicies("pseudonymous_identity", true, "delete", `
-    analytics_people analytics_identity_nodes analytics_identity_edges
+    analytics_people analytics_identity_nodes analytics_identity_edges analytics_identity_assignments
     analytics_crm_person_mappings analytics_consent_current_state analytics_consent_receipts analytics_provider_customer_bindings
   `),
   ...relationPolicies("pseudonymous_identity", true, "retain_legal", `analytics_identity_tombstones`),
@@ -52083,12 +52176,13 @@ var ANALYTICS_PRIVACY_RELATION_REGISTRY = Object.freeze([
     analytics_connections analytics_webhook_receipts analytics_linker_tokens analytics_thorbit_connect_states
   `),
   ...relationPolicies("access_audit", true, "anonymize", `
-    analytics_identity_profile_access_audits
+    analytics_identity_profile_access_audits analytics_identity_assignment_conflicts
   `),
   ...relationPolicies("normalized_receipts", true, "anonymize", `
     analytics_ingestion_receipts analytics_exports analytics_activation_destination_tests analytics_activation_delivery_attempts
     analytics_crm_provisioning_receipts analytics_crm_sync_receipts analytics_crm_outbound_attempts
     analytics_crm_outbound_receipts analytics_product_milestones analytics_identity_promotion_receipts
+    analytics_form_bridge_receipts
     analytics_runtime_manifest_publications analytics_experiment_receipts
     analytics_revenue_setup_receipts
   `),
@@ -52563,6 +52657,14 @@ async function drainAnalyticsPrivacyLifecycle(input = {}) {
     WHERE id IN (SELECT id FROM analytics_identity_profile_access_audits a WHERE ${policyCutoff("a", "created_at")}
       AND (a.person_id IS NOT NULL OR a.subject_ref_hmac <> md5('retained-audit:'||a.id::text))
       ORDER BY a.created_at LIMIT $4) RETURNING id`);
+  await run("identityAssignmentConflicts", "access_audit", `UPDATE analytics_identity_assignment_conflicts c
+    SET identity_node_id=NULL,active_person_id=NULL,attempted_person_id=NULL,
+        active_crm_entity_id=NULL,attempted_crm_entity_id=NULL,
+        evidence_kind='retained_audit',resolved_at=COALESCE(c.resolved_at,$1)
+    WHERE id IN (SELECT id FROM analytics_identity_assignment_conflicts c
+      WHERE c.status <> 'pending' AND ${policyCutoff("c", "observed_at")}
+        AND (c.identity_node_id IS NOT NULL OR c.active_person_id IS NOT NULL OR c.attempted_person_id IS NOT NULL)
+      ORDER BY c.observed_at LIMIT $4) RETURNING id`);
   await run("webhookPayloads", "provider_secrets", `UPDATE analytics_webhook_receipts SET payload_ciphertext=NULL
     WHERE id IN (SELECT id FROM analytics_webhook_receipts WHERE payload_ciphertext IS NOT NULL AND payload_expires_at <= $1 AND $2::text IS NOT NULL AND $3::int > 0 ORDER BY payload_expires_at LIMIT $4) RETURNING id`);
   await run("linkerTokens", "provider_secrets", `DELETE FROM analytics_linker_tokens l WHERE id IN
@@ -52574,6 +52676,9 @@ async function drainAnalyticsPrivacyLifecycle(input = {}) {
       ORDER BY r.created_at LIMIT $4) RETURNING id`);
   await run("productMilestones", "normalized_receipts", `DELETE FROM analytics_product_milestones m WHERE id IN
     (SELECT id FROM analytics_product_milestones m WHERE ${policyCutoff("m", "occurred_at")} ORDER BY m.occurred_at LIMIT $4) RETURNING id`);
+  await run("formBridgeReceipts", "normalized_receipts", `DELETE FROM analytics_form_bridge_receipts r WHERE id IN
+    (SELECT r.id FROM analytics_form_bridge_receipts r JOIN analytics_form_submissions f ON f.id=r.submission_id
+      WHERE ${joinedPolicyCutoff("r.occurred_at", "f.site_id")} ORDER BY r.occurred_at LIMIT $4) RETURNING id`);
   await run("crmSyncRuns", "delivery_jobs", `DELETE FROM analytics_crm_sync_runs r WHERE sync_id IN
     (SELECT sync_id FROM analytics_crm_sync_runs r WHERE r.state IN ('completed','degraded','cancelled','webhook_only')
       AND ${policyCutoff("r", "created_at")} ORDER BY r.created_at LIMIT $4) RETURNING sync_id`);
@@ -53497,6 +53602,7 @@ var FormSubmissionSchema = z43.object({
   medium: z43.string().trim().max(180).optional(),
   campaign: z43.string().trim().max(240).optional(),
   clickIds: z43.record(z43.string(), z43.string().trim().max(500)).optional(),
+  idempotencyKey: z43.string().trim().min(8).max(200).optional(),
   placementUrl: z43.string().url().max(3e3),
   website: z43.string().max(0).optional()
 }).strict();
@@ -53805,7 +53911,7 @@ function renderPublicForm(form, placementUrl) {
     return `<label${field.type === "checkbox" ? ' class="check"' : ""}><span>${escapeHtml7(field.label)}${field.required ? " *" : ""}</span>${control}</label>`;
   }).join("");
   const brand = form.brand;
-  return `<!doctype html><html><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><style>:root{font-family:ui-sans-serif,system-ui;color:${escapeHtml7(brand.textColor)};background:${escapeHtml7(brand.backgroundColor)}}*{box-sizing:border-box}body{margin:0;padding:18px}form{display:grid;gap:14px}label{display:grid;gap:6px;font-size:13px;font-weight:650}.check{grid-template-columns:auto 1fr;align-items:center}.check span{grid-column:2}.check input{grid-column:1;grid-row:1}input,textarea,select{width:100%;min-height:44px;padding:10px 12px;border:1px solid #ccd3df;border-radius:${brand.radius}px;background:white;color:inherit;font:inherit}textarea{min-height:110px;resize:vertical}button{min-height:46px;border:0;border-radius:${brand.radius}px;color:white;background:${escapeHtml7(brand.primaryColor)};font:inherit;font-weight:750;cursor:pointer}.consent{margin:0;color:#667085;font-size:11px;line-height:1.45}.notice{display:none;padding:12px;border-radius:${brand.radius}px;background:#edf8f2;color:#17613c}.hp{position:absolute!important;left:-9999px!important}</style></head><body><form id="mcp-form">${fields}<label class="hp">Website<input name="website" autocomplete="off" tabindex="-1"></label>${form.consent_text ? `<p class="consent">${escapeHtml7(form.consent_text)}</p>` : ""}<button>${escapeHtml7(form.submit_label)}</button><div class="notice" role="status"></div></form><script>(()=>{const form=document.querySelector('#mcp-form'),notice=form.querySelector('.notice'),q=new URLSearchParams(location.search);form.addEventListener('submit',async event=>{event.preventDefault();const button=form.querySelector('button');button.disabled=true;const raw=Object.fromEntries(new FormData(form).entries()),website=String(raw.website||''),clickIds={};delete raw.website;for(const k of ['fbclid','gclid','gbraid','wbraid','ttclid','rdt_cid','msclkid']){const v=q.get(k);if(v)clickIds[k]=v}try{const response=await fetch('/analytics/forms/${escapeHtml7(form.public_id)}/submissions',{method:'POST',headers:{'content-type':'application/json'},body:JSON.stringify({data:raw,website,placementUrl:${JSON.stringify(placementUrl)},visitorId:q.get('visitor')||undefined,sessionId:q.get('session')||undefined,source:q.get('source')||undefined,medium:q.get('medium')||undefined,campaign:q.get('campaign')||undefined,clickIds})});if(!response.ok)throw new Error('submit');notice.textContent=${JSON.stringify(form.success_message)};notice.style.display='block';form.reset();${form.redirect_url ? `setTimeout(()=>{top.location.href=${JSON.stringify(form.redirect_url)}},700);` : ""}}catch{notice.textContent='Your response could not be submitted. Please try again.';notice.style.display='block'}finally{button.disabled=false}})})()</script></body></html>`;
+  return `<!doctype html><html><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><style>:root{font-family:ui-sans-serif,system-ui;color:${escapeHtml7(brand.textColor)};background:${escapeHtml7(brand.backgroundColor)}}*{box-sizing:border-box}body{margin:0;padding:18px}form{display:grid;gap:14px}label{display:grid;gap:6px;font-size:13px;font-weight:650}.check{grid-template-columns:auto 1fr;align-items:center}.check span{grid-column:2}.check input{grid-column:1;grid-row:1}input,textarea,select{width:100%;min-height:44px;padding:10px 12px;border:1px solid #ccd3df;border-radius:${brand.radius}px;background:white;color:inherit;font:inherit}textarea{min-height:110px;resize:vertical}button{min-height:46px;border:0;border-radius:${brand.radius}px;color:white;background:${escapeHtml7(brand.primaryColor)};font:inherit;font-weight:750;cursor:pointer}.consent{margin:0;color:#667085;font-size:11px;line-height:1.45}.notice{display:none;padding:12px;border-radius:${brand.radius}px;background:#edf8f2;color:#17613c}.hp{position:absolute!important;left:-9999px!important}</style></head><body><form id="mcp-form">${fields}<label class="hp">Website<input name="website" autocomplete="off" tabindex="-1"></label>${form.consent_text ? `<p class="consent">${escapeHtml7(form.consent_text)}</p>` : ""}<button>${escapeHtml7(form.submit_label)}</button><div class="notice" role="status"></div></form><script>(()=>{const form=document.querySelector('#mcp-form'),notice=form.querySelector('.notice'),q=new URLSearchParams(location.search),id=()=>crypto.randomUUID?crypto.randomUUID():'form_'+Date.now().toString(36)+Math.random().toString(36).slice(2);let pendingKey=null;form.addEventListener('submit',async event=>{event.preventDefault();const button=form.querySelector('button');button.disabled=true;pendingKey=pendingKey||id();const raw=Object.fromEntries(new FormData(form).entries()),website=String(raw.website||''),clickIds={};delete raw.website;for(const k of ['fbclid','gclid','gbraid','wbraid','ttclid','rdt_cid','msclkid']){const v=q.get(k);if(v)clickIds[k]=v}try{const response=await fetch('/analytics/forms/${escapeHtml7(form.public_id)}/submissions',{method:'POST',headers:{'content-type':'application/json'},body:JSON.stringify({data:raw,website,idempotencyKey:pendingKey,placementUrl:${JSON.stringify(placementUrl)},visitorId:q.get('visitor')||undefined,sessionId:q.get('session')||undefined,source:q.get('source')||undefined,medium:q.get('medium')||undefined,campaign:q.get('campaign')||undefined,clickIds})});if(!response.ok)throw new Error('submit');pendingKey=null;notice.textContent=${JSON.stringify(form.success_message)};notice.style.display='block';form.reset();${form.redirect_url ? `setTimeout(()=>{top.location.href=${JSON.stringify(form.redirect_url)}},700);` : ""}}catch{notice.textContent='Your response could not be submitted. Please try again.';notice.style.display='block'}finally{button.disabled=false}})})()</script></body></html>`;
 }
 analyticsApp.get(
   "/health/live",
@@ -54212,163 +54318,64 @@ analyticsApp.post("/forms/:publicId/submissions", async (c) => {
   for (const field of allowed.values())
     if (field.required && (parsed.data.data[field.id] === void 0 || parsed.data.data[field.id] === ""))
       return c.json({ ok: false, error: `${field.label} is required.` }, 400);
-  const user = await getUserById(form.owner_user_id);
-  if (!user)
-    return c.json({ ok: false, error: "Form owner unavailable." }, 503);
   const data = parsed.data.data;
   const email = typeof data.email === "string" ? data.email.trim().toLowerCase() : "";
   const phone = typeof data.phone === "string" ? data.phone.trim() : "";
   const firstName = typeof data.first_name === "string" ? data.first_name.trim() : "";
   const lastName = typeof data.last_name === "string" ? data.last_name.trim() : "";
-  const fullName = [firstName, lastName].filter(Boolean).join(" ") || (typeof data.name === "string" ? data.name.trim() : "") || email || "Website lead";
-  const identitySeed = email || phone.replace(/\D/g, "") || randomUUID38();
-  const suffix2 = createHash43("sha256").update(identitySeed).digest("hex").slice(0, 12);
-  const path5 = `Leads/person-${suffix2}`;
-  const crmPersonRef = `People::${path5}`;
-  const { key: memoryKey, error: memoryKeyError } = await getOrCreateUserMemoryKey(user);
-  const existing = memoryKey ? await memoryCall("getTool", { vault: "People", path: path5 }, memoryKey) : { ok: false, error: memoryKeyError || "memory_credential_unavailable" };
-  const props = {
-    ...existing.note?.props ?? {},
-    type: "person",
-    status: "active",
-    person_name: fullName,
-    ...firstName ? { first_name: firstName } : {},
-    ...lastName ? { last_name: lastName } : {},
-    ...email ? { email } : {},
-    ...typeof data.phone === "string" && data.phone.trim() ? { phone: data.phone.trim(), text_phone: data.phone.trim() } : {},
-    ...typeof data.company === "string" && data.company.trim() ? { company: data.company.trim() } : {},
-    attribution_site_id: form.site_id,
-    attribution_form_id: form.id,
-    attribution_form_name: form.name,
-    attributed_source: parsed.data.source || "(direct)",
-    attributed_medium: parsed.data.medium || "(none)",
-    attributed_campaign: parsed.data.campaign || "(none)",
-    form_fields: data,
-    source_type: "analytics_form",
-    source_ref: `form:${form.public_id}`,
-    summary: `Website lead from ${form.name}`,
-    embedding_summary: `${fullName} submitted ${form.name}`,
-    related: [],
-    related_vault_notes: [],
-    embed: true,
-    embed_priority: "normal"
-  };
-  const crmPayload = {
-    vault: "People",
-    path: path5,
-    title: fullName,
-    content: existing.note?.content || `# ${fullName}
-
-## Identity
-Website lead captured through ${form.name}.
-
-## Relationship
-Attribution is linked to Site Analytics.
-
-## Known Context
-Submitted the published form.
-
-## Interaction History
-- ${(/* @__PURE__ */ new Date()).toISOString()}: Form submitted.
-
-## Open Loops
-- Review and follow up.`,
-    props,
-    ...existing.note ? { baseRevision: existing.note.revision } : {}
-  };
-  const saved = memoryKey ? await memoryCall(
-    "putTool",
-    crmPayload,
-    memoryKey
-  ) : { ok: false, error: memoryKeyError || "memory_credential_unavailable" };
-  const crmDeliveryStatus = saved.ok ? "delivered" : "pending";
-  const receipt4 = await recordAnalyticsFormSubmission({
+  const fullName = [firstName, lastName].filter(Boolean).join(" ") || (typeof data.name === "string" ? data.name.trim() : "") || "Website visitor";
+  const idempotencyKey4 = parsed.data.idempotencyKey ?? randomUUID38();
+  const identitySeed = email || phone.replace(/\D/g, "") || parsed.data.visitorId || parsed.data.sessionId || idempotencyKey4;
+  const crmEntityId = deterministicAnalyticsCrmEntityId(form.site_id, identitySeed);
+  const observedAt = (/* @__PURE__ */ new Date()).toISOString();
+  const bridge = await queueAnalyticsFormBridgeTransaction({
     form,
+    ownerUserId: form.owner_user_id,
+    idempotencyKey: idempotencyKey4,
+    crmEntityId,
     visitorId: parsed.data.visitorId,
     sessionId: parsed.data.sessionId,
-    crmPersonRef,
-    crmDeliveryStatus,
     source: parsed.data.source,
     medium: parsed.data.medium,
     campaign: parsed.data.campaign,
-    clickIds: parsed.data.clickIds
-  });
-  const identityGraph = await linkAnalyticsFormIdentity({
-    submissionId: receipt4.submissionId,
-    siteId: form.site_id,
-    crmPersonRef,
-    visitorId: parsed.data.visitorId,
-    sessionId: parsed.data.sessionId,
-    email: email || void 0,
-    phone: phone || void 0,
-    displayName: [typeof data.first_name === "string" ? data.first_name : "", typeof data.last_name === "string" ? data.last_name : ""].filter(Boolean).join(" ") || void 0,
-    evidenceType: "first_party_form",
-    clickIds: parsed.data.clickIds
-  });
-  if (!saved.ok) {
-    await queueAnalyticsFormDelivery({
-      submissionId: receipt4.submissionId,
-      ownerUserId: form.owner_user_id,
-      payloadCiphertext: encryptMemoryKey(JSON.stringify(crmPayload)),
-      errorCode: memoryKey ? "memory_write_failed" : "memory_credential_unavailable"
-    });
-  }
-  const match = {
-    ...email ? { emailSha256: createHash43("sha256").update(email).digest("hex") } : {},
-    ...phone ? {
-      phoneSha256: createHash43("sha256").update(phone.replace(/\D/g, "")).digest("hex")
-    } : {}
-  };
-  const conversionOccurredAt = (/* @__PURE__ */ new Date()).toISOString();
-  const activationIdentity = await resolveAnalyticsConfirmedActivationIdentity(getAnalyticsPool(), {
-    siteId: form.site_id,
-    subjectRef: parsed.data.visitorId,
-    personId: identityGraph.personId
-  });
-  const conversion = await createAnalyticsConversion({
-    userId: form.owner_user_id,
-    siteId: form.site_id,
-    pixelId: form.pixel_id,
-    sessionId: parsed.data.sessionId,
-    sourceEventId: `form:${receipt4.submissionId}`,
-    conversionKind: "form_submitted",
-    occurredAt: conversionOccurredAt,
-    personId: activationIdentity.personId ?? void 0,
-    activationPayloadCiphertext: activationIdentity.activationEligible && activationIdentity.personId ? encryptAnalyticsRestricted(
-      JSON.stringify({
-        eventId: `form:${receipt4.submissionId}`,
-        eventName: "form_submitted",
-        eventTime: conversionOccurredAt,
-        actionSource: "website",
-        sourceUrl: parsed.data.placementUrl,
-        match,
-        clickIds: parsed.data.clickIds ?? {},
-        personId: activationIdentity.personId,
-        identityTier: "confirmed",
-        consent: { advertisingMeasurement: true },
-        attribution: {
-          source: parsed.data.source,
-          medium: parsed.data.medium,
-          campaign: parsed.data.campaign
-        }
-      }),
-      "activation-payload"
-    ) : void 0
+    clickIds: parsed.data.clickIds,
+    occurredAt: observedAt,
+    payloadCiphertext: encryptMemoryKey(JSON.stringify({
+      displayName: fullName,
+      relationshipTypes: ["prospect"],
+      email: email || void 0,
+      phone: phone || void 0,
+      organizationName: typeof data.company === "string" && data.company.trim() ? data.company.trim() : void 0,
+      submittedFields: data,
+      visitorId: parsed.data.visitorId,
+      sessionId: parsed.data.sessionId,
+      clickIds: parsed.data.clickIds ?? {},
+      placementUrl: parsed.data.placementUrl,
+      source: {
+        kind: "xray_form",
+        siteId: form.site_id,
+        formId: form.id,
+        observedAt
+      }
+    }))
   });
   return c.json(
     {
       ok: true,
-      submissionId: receipt4.submissionId,
-      crmDeliveryStatus,
-      attribution: {
-        personId: identityGraph.personId,
-        linkedSignals: identityGraph.linkedSignals
+      submissionId: bridge.submissionId,
+      crmDeliveryStatus: "pending",
+      bridge: {
+        runId: bridge.bridgeRunId,
+        crmEntityId: bridge.crmEntityId,
+        analyticsStatus: "delivered",
+        crmStatus: "pending"
       },
-      activation: { queuedDestinations: conversion.queuedDestinations },
+      conversion: { id: bridge.conversionId, status: "recorded" },
+      activation: { status: "pending_identity_delivery" },
       message: form.success_message,
       redirectUrl: form.redirect_url
     },
-    saved.ok ? 201 : 202
+    202
   );
 });
 analyticsApp.get("/l/:shortCode", async (c) => {
@@ -56579,6 +56586,13 @@ analyticsApp.post("/sites/:siteId/identity-namespaces/:namespaceId/candidates/:a
   });
   return c.json({ ok: true, promotion }, 200, noStore);
 });
+analyticsApp.use("/sites/:siteId/crm/*", auth4, async (c) => c.json({
+  ok: false,
+  error: {
+    code: "crm_provider_unavailable",
+    message: "External CRM provider setup and synchronization are unavailable. Use the provider-neutral /crm workspace and GET /crm/connections."
+  }
+}, 410));
 analyticsApp.get("/sites/:siteId/crm/capabilities", auth4, async (c) => {
   await requireSite(c);
   const providers = ANALYTICS_PUBLIC_CRM_PROVIDER_IDS.map((provider) => ({
@@ -57486,6 +57500,640 @@ analyticsApp.onError((error, c) => {
   );
 });
 
+// src/api/governed-relationship-routes.ts
+import { randomUUID as randomUUID39 } from "crypto";
+import { Hono as Hono37 } from "hono";
+import { z as z45 } from "zod";
+
+// src/api/entity-domain-contract.ts
+var DOMAIN_VAULT_NAMES = Object.freeze({
+  research_person: "People",
+  research_organization: "Organizations",
+  crm_person: "CRM People",
+  crm_organization: "CRM Organizations"
+});
+var RESEARCH_FORBIDDEN_FIELDS = Object.freeze([
+  "relationshipTypes",
+  "relationship_types",
+  "commercialLifecycle",
+  "commercial_lifecycle",
+  "relationshipStatus",
+  "relationship_status",
+  "ownerId",
+  "owner_id",
+  "consentState",
+  "consent_state",
+  "outreachState",
+  "outreach_state",
+  "pipelineId",
+  "pipeline_id",
+  "dealIds",
+  "deal_ids",
+  "taskIds",
+  "task_ids",
+  "nextTaskId",
+  "next_task_id",
+  "openDealValue",
+  "open_deal_value"
+]);
+var CRM_FORBIDDEN_FIELDS = Object.freeze([
+  "claims",
+  "citations",
+  "sourceEvidence",
+  "source_evidence",
+  "researchRoles",
+  "research_roles",
+  "timePeriod",
+  "time_period",
+  "topics",
+  "researchSummary",
+  "research_summary"
+]);
+var GovernedContractError = class extends Error {
+  constructor(code, message, status = 422, details = {}) {
+    super(message);
+    this.code = code;
+    this.status = status;
+    this.details = details;
+    this.name = "GovernedContractError";
+  }
+  code;
+  status;
+  details;
+};
+var EMAIL_ONLY = /^[^\s@]+@[^\s@]+\.[^\s@]+$/u;
+var VAULT_REFERENCE = /^(?:[A-Za-z][A-Za-z ]{1,80})::\S+/u;
+var FILE_EXTENSION = /\.(?:md|mdx|txt|json|csv|pdf|docx?|html?|ya?ml)$/iu;
+var WINDOWS_PATH = /^(?:[A-Za-z]:\\|\\\\)/u;
+var POSIX_PATH = /^(?:\.{0,2}\/|\/|~\/)/u;
+function displayNameIssue(value) {
+  if (typeof value !== "string" || value.trim().length === 0) return "empty";
+  const name = value.trim();
+  if (EMAIL_ONLY.test(name)) return "email";
+  if (VAULT_REFERENCE.test(name)) return "vault_reference";
+  if (WINDOWS_PATH.test(name) || POSIX_PATH.test(name) || name.includes("/")) return "path";
+  if (FILE_EXTENSION.test(name)) return "filename";
+  return null;
+}
+function requireHumanDisplayName(value) {
+  const issue = displayNameIssue(value);
+  if (issue) {
+    throw new GovernedContractError(
+      issue === "empty" ? "entity_display_name_required" : "entity_display_name_invalid",
+      issue === "empty" ? "A human display name is required." : `A ${issue.replace("_", " ")} may be retained as a locator, but cannot be the display name.`,
+      422,
+      { issue }
+    );
+  }
+  return value.trim();
+}
+
+// src/api/crm-contract.ts
+var XRAY_ATTRIBUTION_MODELS = [
+  "first_touch",
+  "last_touch",
+  "last_non_direct",
+  "linear",
+  "time_decay",
+  "position_based",
+  "custom_weighted"
+];
+var DEFAULT_XRAY_ATTRIBUTION = Object.freeze({
+  model: "position_based",
+  firstWeight: 0.4,
+  middleWeight: 0.2,
+  lastWeight: 0.4
+});
+
+// src/api/crm-import-service.ts
+import { z as z44 } from "zod";
+var MAX_IMPORT_BYTES = 20 * 1024 * 1024;
+var ImportRowSchema = z44.object({
+  rowNumber: z44.number().int().min(1),
+  domain: z44.enum(["crm_person", "crm_organization"]),
+  values: z44.record(z44.string().min(1).max(120), z44.unknown())
+}).strict();
+var CrmImportPreviewSchema = z44.object({
+  idempotencyKey: z44.string().min(8).max(200),
+  ttlMinutes: z44.number().int().min(5).max(1440).default(60),
+  mapping: z44.record(z44.string().min(1).max(120), z44.string().min(1).max(120)),
+  rows: z44.array(ImportRowSchema).min(1).max(5e4)
+}).strict();
+var CrmImportApplySchema = z44.object({
+  planHandle: z44.string().min(1).max(4096),
+  digest: z44.string().regex(/^[a-f0-9]{64}$/iu),
+  confirmationToken: z44.string().min(8).max(500),
+  idempotencyKey: z44.string().min(8).max(200)
+}).strict();
+function serializedBytes(value) {
+  return Buffer.byteLength(JSON.stringify(value), "utf8");
+}
+function parseCrmImportPreview(value) {
+  if (serializedBytes(value) > MAX_IMPORT_BYTES) {
+    return { ok: false, code: "crm_import_too_large", message: "The import exceeds the 20 MiB preview limit." };
+  }
+  const parsed = CrmImportPreviewSchema.safeParse(value);
+  if (!parsed.success) {
+    return { ok: false, code: "crm_import_invalid", message: "Import rows must use the strict CRM People or CRM Organizations preview contract." };
+  }
+  return { ok: true, input: parsed.data };
+}
+function parseCrmImportApply(value) {
+  const parsed = CrmImportApplySchema.safeParse(value);
+  if (!parsed.success) {
+    return { ok: false, code: "crm_import_confirmation_invalid", message: "Import apply requires the exact preview handle, digest, confirmation token, and idempotency key." };
+  }
+  return { ok: true, input: parsed.data };
+}
+
+// src/api/governed-relationship-routes.ts
+var UuidSchema = z45.string().uuid();
+var ObjectSchema = z45.enum(["people", "organizations"]);
+var QuerySchema = z45.object({
+  query: z45.string().trim().max(300).optional(),
+  cursor: z45.string().max(2e3).optional(),
+  limit: z45.coerce.number().int().min(1).max(100).default(25)
+}).passthrough();
+var MutationSchema = z45.object({
+  idempotencyKey: z45.string().min(8).max(200),
+  baseRevision: z45.number().int().min(0)
+}).passthrough();
+var WorkPageSchema = z45.object({ cursor: z45.string().max(2048).optional(), limit: z45.coerce.number().int().min(1).max(100).default(25) }).passthrough();
+var DealQuerySchema = WorkPageSchema.extend({
+  pipelineId: z45.string().uuid().optional(),
+  stageId: z45.string().uuid().optional(),
+  minValue: z45.coerce.number().nonnegative().optional(),
+  maxValue: z45.coerce.number().nonnegative().optional()
+});
+var TaskQuerySchema = WorkPageSchema.extend({
+  query: z45.string().trim().max(300).optional(),
+  personEntityId: z45.string().uuid().optional(),
+  organizationEntityId: z45.string().uuid().optional(),
+  dealId: z45.string().uuid().optional(),
+  due: z45.enum(["overdue", "today", "week", "unscheduled"]).optional(),
+  ownerId: z45.string().trim().max(200).optional(),
+  status: z45.enum(["todo", "in_progress", "blocked", "done", "cancelled"]).optional()
+});
+var PipelineMutationSchema = z45.object({
+  pipelineId: z45.string().uuid().optional(),
+  label: z45.string().trim().min(1).max(120),
+  baseVersion: z45.number().int().min(0),
+  isDefault: z45.boolean().default(false),
+  stages: z45.array(z45.object({
+    stageId: z45.string().uuid().optional(),
+    label: z45.string().trim().min(1).max(120),
+    outcome: z45.enum(["open", "won", "lost"]),
+    probability: z45.number().min(0).max(1),
+    requiredFields: z45.array(z45.string().trim().min(1).max(120)).max(100).default([]),
+    allowedNextStageIds: z45.array(z45.string().uuid()).max(100).default([])
+  }).strict()).min(2).max(100)
+}).strict();
+var researchTools = {
+  people: { search: "researchPersonSearchTool", get: "researchPersonGetTool", write: "researchPersonCaptureTool" },
+  organizations: { search: "researchOrganizationSearchTool", get: "researchOrganizationGetTool", write: "researchOrganizationCaptureTool" }
+};
+var crmTools = {
+  people: { search: "crmPersonSearchTool", get: "crmPersonGetTool", write: "crmUpsertPersonTool" },
+  organizations: { search: "crmOrganizationSearchTool", get: "crmOrganizationGetTool", write: "crmUpsertOrganizationTool" }
+};
+function safeFailure2(message, code = "relationship_unavailable") {
+  return { ok: false, error: { code, message, requestId: randomUUID39(), retryable: code === "relationship_unavailable" } };
+}
+function resultStatus(result3) {
+  const code = String(result3.code ?? "");
+  if (/permission|owner_confirmation/iu.test(code)) return 403;
+  if (/not_found/iu.test(code)) return 404;
+  if (/conflict|digest_mismatch/iu.test(code)) return 409;
+  if (/expired/iu.test(code)) return 410;
+  if (/invalid|forbidden|mismatch|required/iu.test(code)) return 422;
+  return 502;
+}
+async function keyFor(c) {
+  const { key: key3, error } = await getOrCreateUserMemoryKey(c.get("user"));
+  if (!key3) return c.json(safeFailure2(error ?? "Memory is unavailable."), 503);
+  return key3;
+}
+async function call(c, tool, input, success = 200) {
+  const key3 = await keyFor(c);
+  if (typeof key3 !== "string") return key3;
+  const result3 = await memoryCall(tool, input, key3);
+  c.header("Cache-Control", "private, no-store");
+  if (!result3.ok) {
+    const status = resultStatus(result3);
+    return c.json(safeFailure2(
+      status === 502 ? "The governed relationship service is temporarily unavailable." : String(result3.message ?? result3.error ?? "The request was rejected."),
+      typeof result3.code === "string" ? result3.code : "relationship_unavailable"
+    ), status);
+  }
+  return c.json(result3, success);
+}
+async function readResult(c, tool, input) {
+  const key3 = await keyFor(c);
+  if (typeof key3 !== "string") return key3;
+  const result3 = await memoryCall(tool, input, key3);
+  c.header("Cache-Control", "private, no-store");
+  if (!result3.ok) {
+    const status = resultStatus(result3);
+    return c.json(safeFailure2(status === 502 ? "The governed relationship service is temporarily unavailable." : String(result3.message ?? result3.error ?? "The request was rejected."), typeof result3.code === "string" ? result3.code : "relationship_unavailable"), status);
+  }
+  return result3;
+}
+function workItems(result3) {
+  return (Array.isArray(result3.items) ? result3.items : []).filter((item) => Boolean(item && typeof item === "object" && typeof item.workId === "string"));
+}
+function pageInfo(result3) {
+  const page3 = result3.pageInfo && typeof result3.pageInfo === "object" ? result3.pageInfo : {};
+  return { endCursor: typeof page3.endCursor === "string" ? page3.endCursor : null, hasNextPage: page3.hasNextPage === true };
+}
+function stringProp(props, key3) {
+  const value = props[key3];
+  return typeof value === "string" && value.trim() ? value : null;
+}
+function numberProp(props, key3) {
+  const value = props[key3];
+  return typeof value === "number" && Number.isFinite(value) ? value : null;
+}
+function dealView(item) {
+  const fields = item.dealState?.fields ?? item.props;
+  const partyId = stringProp(fields, "party") ?? item.entities[0]?.entityId ?? "";
+  const party = item.entities.find((entity) => entity.entityId === partyId) ?? item.entities[0];
+  return {
+    dealId: item.workId,
+    title: item.title,
+    pipelineId: item.dealState?.pipelineId ?? stringProp(item.props, "pipeline_id") ?? "",
+    stageId: item.dealState?.stageId ?? stringProp(item.props, "stage_id") ?? "",
+    revision: item.revision,
+    probability: item.dealState?.probability ?? numberProp(item.props, "probability") ?? 0,
+    value: numberProp(item.props, "value"),
+    currency: stringProp(item.props, "currency"),
+    party: { entityId: party?.entityId ?? partyId, kind: party?.domain.endsWith("_organization") ? "organization" : "person", label: party?.displayName ?? partyId },
+    enteredAt: stringProp(fields, "entered_at") ?? item.createdAt,
+    lastActivityAt: stringProp(item.props, "last_activity_at"),
+    nextTask: null,
+    influencedSource: stringProp(item.props, "influenced_source") ? { label: stringProp(item.props, "influenced_source"), evidenceRef: stringProp(item.props, "influenced_evidence_ref") } : null,
+    fields
+  };
+}
+function taskView(item) {
+  const person = item.entities.find((entity) => entity.domain === "crm_person");
+  const organization = item.entities.find((entity) => entity.domain === "crm_organization");
+  const dealId = stringProp(item.props, "deal_id");
+  return {
+    taskId: item.workId,
+    title: item.title,
+    status: stringProp(item.props, "status") ?? "todo",
+    dueAt: stringProp(item.props, "due"),
+    ownerId: stringProp(item.props, "owner_id"),
+    canonicalHref: stringProp(item.props, "canonical_href"),
+    person: person ? { entityId: person.entityId, label: person.displayName } : null,
+    organization: organization ? { entityId: organization.entityId, label: organization.displayName } : null,
+    deal: dealId ? { dealId, title: stringProp(item.props, "deal_title") ?? dealId } : null,
+    sourceLabel: stringProp(item.props, "source_label") ?? "Canonical Tasks",
+    updatedAt: item.updatedAt
+  };
+}
+function parsedObject(c) {
+  const parsed = ObjectSchema.safeParse(c.req.param("object"));
+  return parsed.success ? parsed.data : null;
+}
+function stripRelationshipDeploymentQuery(query) {
+  const publicQuery = { ...query };
+  delete publicQuery.researchSubpath;
+  delete publicQuery.crmSubpath;
+  return publicQuery;
+}
+var researchApp = new Hono37();
+researchApp.use("*", createApiKeyAuth());
+for (const object2 of ["people", "organizations"]) {
+  researchApp.get(`/${object2}`, async (c) => {
+    const query = QuerySchema.safeParse(stripRelationshipDeploymentQuery(c.req.query()));
+    if (!query.success) return c.json(safeFailure2("The Research filters are invalid.", "invalid_request"), 400);
+    return call(c, researchTools[object2].search, query.data);
+  });
+  researchApp.post(`/${object2}`, async (c) => {
+    const body3 = MutationSchema.safeParse(await c.req.json().catch(() => null));
+    if (!body3.success) return c.json(safeFailure2("Research capture requires revision and idempotency.", "invalid_request"), 400);
+    try {
+      requireHumanDisplayName(body3.data.displayName);
+    } catch (error) {
+      return c.json(safeFailure2(error.message, "entity_display_name_invalid"), 422);
+    }
+    return call(c, researchTools[object2].write, body3.data, 201);
+  });
+}
+researchApp.get("/:object/:entityId", async (c) => {
+  const object2 = parsedObject(c);
+  const entityId = UuidSchema.safeParse(c.req.param("entityId"));
+  if (!object2 || !entityId.success) return c.json(safeFailure2("The Research record reference is invalid.", "invalid_request"), 400);
+  return call(c, researchTools[object2].get, { entityId: entityId.data });
+});
+var crmApp = new Hono37();
+crmApp.use("*", createApiKeyAuth());
+crmApp.get("/summary", async (c) => {
+  const generatedAt = (/* @__PURE__ */ new Date()).toISOString();
+  const [activityResult, taskResult, dealResult, peopleResult, organizationResult] = await Promise.all([
+    readResult(c, "crmWorkSearchTool", { objectKind: "activity", limit: 25 }),
+    readResult(c, "crmWorkSearchTool", { objectKind: "task", limit: 100 }),
+    readResult(c, "crmWorkSearchTool", { objectKind: "deal", limit: 100 }),
+    readResult(c, "crmPersonSearchTool", { limit: 100 }),
+    readResult(c, "crmOrganizationSearchTool", { limit: 100 })
+  ]);
+  const failed = [activityResult, taskResult, dealResult, peopleResult, organizationResult].find((result3) => result3 instanceof Response);
+  if (failed instanceof Response) return failed;
+  const activities = workItems(activityResult);
+  const tasks = workItems(taskResult);
+  const dealItems = workItems(dealResult);
+  const deals = dealItems.map(dealView);
+  const people = Array.isArray(peopleResult.items) ? peopleResult.items : [];
+  const organizations = Array.isArray(organizationResult.items) ? organizationResult.items : [];
+  const dueNow = Date.now();
+  const recentActivity = Object.values(activities.reduce((groups, item) => {
+    const occurredAt = stringProp(item.props, "occurred_at") ?? item.updatedAt;
+    const date2 = occurredAt.slice(0, 10);
+    groups[date2] ??= { date: date2, items: [] };
+    const rawKind = stringProp(item.props, "activity_type") ?? "note";
+    const kind = rawKind === "form_submission" ? "form" : rawKind === "calendar_event" ? "calendar" : rawKind === "conversion" ? "conversion" : "communication";
+    groups[date2].items.push({ activityId: item.workId, kind, occurredAt, summary: item.title, sourceLabel: stringProp(item.props, "source_label") ?? "Native CRM", xrayEvidenceRef: stringProp(item.props, "xray_evidence_ref") });
+    return groups;
+  }, {}));
+  return c.json({
+    ok: true,
+    kpis: [
+      { key: "active_relationships", label: "Active relationships", value: people.length + organizations.length, unit: "count" },
+      { key: "open_pipeline", label: "Open pipeline", value: dealItems.filter((deal) => deal.dealState?.outcome === "open").reduce((sum2, deal) => sum2 + (numberProp(deal.props, "value") ?? 0), 0), unit: "currency" },
+      { key: "followups_due", label: "Follow-ups due", value: tasks.filter((task) => {
+        const due = stringProp(task.props, "due");
+        return Boolean(due && Date.parse(due) <= dueNow && !["done", "cancelled"].includes(stringProp(task.props, "status") ?? "todo"));
+      }).length, unit: "count" },
+      { key: "xray_revenue", label: "X-Ray revenue", value: 0, unit: "currency" }
+    ],
+    visuals: [
+      { key: "source_revenue", model: DEFAULT_XRAY_ATTRIBUTION.model, evidenceClass: "observed", unit: "currency", rows: [] },
+      { key: "pipeline_velocity", model: null, evidenceClass: null, unit: "days", rows: [] },
+      { key: "lifecycle_movement", model: null, evidenceClass: null, unit: "count", rows: [] },
+      { key: "data_health", model: null, evidenceClass: null, unit: "count", rows: [] }
+    ],
+    qualityCounts: {},
+    recentActivity,
+    activityPageInfo: pageInfo(activityResult),
+    freshness: { generatedAt, sourceRevision: "memory-live", xrayObservedAt: null },
+    xray: { state: "unavailable", reason: "No X-Ray site context was selected. CRM remains available." }
+  });
+});
+for (const object2 of ["people", "organizations"]) {
+  crmApp.get(`/${object2}`, async (c) => {
+    const query = QuerySchema.safeParse(stripRelationshipDeploymentQuery(c.req.query()));
+    if (!query.success) return c.json(safeFailure2("The CRM filters are invalid.", "invalid_request"), 400);
+    return call(c, crmTools[object2].search, query.data);
+  });
+  crmApp.post(`/${object2}`, async (c) => {
+    const body3 = MutationSchema.safeParse(await c.req.json().catch(() => null));
+    if (!body3.success) return c.json(safeFailure2("CRM creation requires revision and idempotency.", "invalid_request"), 400);
+    try {
+      requireHumanDisplayName(body3.data.displayName);
+    } catch (error) {
+      return c.json(safeFailure2(error.message, "entity_display_name_invalid"), 422);
+    }
+    if (!Array.isArray(body3.data.relationshipTypes) || body3.data.relationshipTypes.length === 0) {
+      return c.json(safeFailure2("At least one relationship type is required.", "crm_relationship_type_required"), 422);
+    }
+    return call(c, crmTools[object2].write, body3.data, 201);
+  });
+}
+crmApp.get("/connections", (c) => {
+  c.header("Cache-Control", "private, no-store");
+  return c.json({
+    ok: true,
+    capabilities: [
+      { capabilityId: "external_crm_sync", state: "unavailable", reason: "No external CRM provider has passed the release readiness contract.", providerMutationAvailable: false, publicTools: [] },
+      { capabilityId: "payment_enrichment", state: "unproven", reason: "Stripe is not part of the native CRM release.", providerMutationAvailable: false, publicTools: [] }
+    ],
+    freshness: { generatedAt: (/* @__PURE__ */ new Date()).toISOString(), sourceRevision: "provider-neutral-v1", xrayObservedAt: null }
+  });
+});
+crmApp.get("/deals", async (c) => {
+  const query = DealQuerySchema.safeParse(c.req.query());
+  if (!query.success || query.data.minValue != null && query.data.maxValue != null && query.data.minValue > query.data.maxValue) return c.json(safeFailure2("The deal filters are invalid.", "invalid_request"), 400);
+  const result3 = await readResult(c, "crmWorkSearchTool", {
+    objectKind: "deal",
+    cursor: query.data.cursor,
+    limit: query.data.limit,
+    pipelineId: query.data.pipelineId,
+    stageIds: query.data.stageId ? [query.data.stageId] : void 0,
+    minValue: query.data.minValue,
+    maxValue: query.data.maxValue
+  });
+  if (result3 instanceof Response) return result3;
+  const pipelines = await readResult(c, "crmPipelineListTool", {});
+  if (pipelines instanceof Response) return pipelines;
+  return c.json({ ok: true, items: workItems(result3).map(dealView), pipelines: Array.isArray(pipelines.pipelines) ? pipelines.pipelines : [], pageInfo: pageInfo(result3), freshness: { generatedAt: (/* @__PURE__ */ new Date()).toISOString(), sourceRevision: "memory-live" } });
+});
+crmApp.get("/deals/:dealId", async (c) => {
+  const dealId = UuidSchema.safeParse(c.req.param("dealId"));
+  if (!dealId.success) return c.json(safeFailure2("The deal reference is invalid.", "invalid_request"), 400);
+  const result3 = await readResult(c, "crmWorkSearchTool", { objectKind: "deal", workId: dealId.data, limit: 1 });
+  if (result3 instanceof Response) return result3;
+  const item = workItems(result3)[0];
+  if (!item) return c.json(safeFailure2("The governed deal was not found.", "entity_not_found"), 404);
+  const pipelines = await readResult(c, "crmPipelineListTool", {});
+  if (pipelines instanceof Response) return pipelines;
+  const pipeline = (Array.isArray(pipelines.pipelines) ? pipelines.pipelines : []).find((value) => Boolean(value && typeof value === "object" && value.pipelineId === item.dealState?.pipelineId));
+  if (!pipeline) return c.json(safeFailure2("The governed pipeline for this deal was not found.", "pipeline_not_found"), 404);
+  const partyId = stringProp(item.dealState?.fields ?? item.props, "party");
+  const [activityResult, taskResult] = await Promise.all([
+    readResult(c, "crmWorkSearchTool", { objectKind: "activity", ...partyId ? { entityId: partyId } : {}, limit: 100 }),
+    readResult(c, "crmWorkSearchTool", { objectKind: "task", dealId: dealId.data, limit: 100 })
+  ]);
+  if (activityResult instanceof Response) return activityResult;
+  if (taskResult instanceof Response) return taskResult;
+  const activity = workItems(activityResult).map((activityItem) => ({
+    activityId: activityItem.workId,
+    occurredAt: stringProp(activityItem.props, "occurred_at") ?? activityItem.updatedAt,
+    summary: activityItem.title,
+    sourceLabel: stringProp(activityItem.props, "source_label") ?? "Native CRM"
+  }));
+  const tasks = workItems(taskResult).map(taskView).map((task) => ({ taskId: task.taskId, title: task.title, status: task.status, dueAt: task.dueAt, canonicalHref: task.canonicalHref }));
+  return c.json({ ok: true, deal: dealView(item), pipeline, activity, tasks });
+});
+crmApp.get("/tasks", async (c) => {
+  const query = TaskQuerySchema.safeParse(c.req.query());
+  if (!query.success) return c.json(safeFailure2("The task filters are invalid.", "invalid_request"), 400);
+  const now = /* @__PURE__ */ new Date();
+  const startToday = new Date(now);
+  startToday.setHours(0, 0, 0, 0);
+  const endToday = new Date(startToday);
+  endToday.setDate(endToday.getDate() + 1);
+  const endWeek = new Date(startToday);
+  endWeek.setDate(endWeek.getDate() + 7);
+  const dueAfter = query.data.due === "today" || query.data.due === "week" ? startToday.toISOString() : void 0;
+  const dueBefore = query.data.due === "overdue" ? startToday.toISOString() : query.data.due === "today" ? endToday.toISOString() : query.data.due === "week" ? endWeek.toISOString() : void 0;
+  const entityIds = [query.data.personEntityId, query.data.organizationEntityId].filter((value) => Boolean(value));
+  const result3 = await readResult(c, "crmWorkSearchTool", {
+    objectKind: "task",
+    cursor: query.data.cursor,
+    limit: query.data.limit,
+    query: query.data.query || void 0,
+    entityIds: entityIds.length ? entityIds : void 0,
+    dealId: query.data.dealId,
+    taskOwnerId: query.data.ownerId || void 0,
+    taskStatuses: query.data.status ? [query.data.status] : void 0,
+    dueAfter,
+    dueBefore,
+    dueUnscheduled: query.data.due === "unscheduled" || void 0
+  });
+  if (result3 instanceof Response) return result3;
+  return c.json({ ok: true, items: workItems(result3).map(taskView), pageInfo: pageInfo(result3), facets: {}, authority: "canonical_tasks", freshness: { generatedAt: (/* @__PURE__ */ new Date()).toISOString(), sourceRevision: "memory-live" } });
+});
+crmApp.get("/quality/:queue?", (c) => call(c, "crmQualityListTool", { ...c.req.param("queue") ? { queue: c.req.param("queue") } : {} }));
+crmApp.get("/audit", (c) => {
+  c.header("Cache-Control", "private, no-store");
+  return c.json({ ok: true, items: [], pageInfo: { endCursor: null, hasNextPage: false }, facets: {}, freshness: { generatedAt: (/* @__PURE__ */ new Date()).toISOString(), sourceRevision: "memory-live", xrayObservedAt: null } });
+});
+crmApp.get("/pipelines", async (c) => {
+  const result3 = await readResult(c, "crmPipelineListTool", {});
+  if (result3 instanceof Response) return result3;
+  return c.json({ ...result3, freshness: { generatedAt: (/* @__PURE__ */ new Date()).toISOString(), sourceRevision: "memory-live", xrayObservedAt: null } });
+});
+crmApp.post("/pipelines", async (c) => {
+  const body3 = PipelineMutationSchema.safeParse(await c.req.json().catch(() => null));
+  if (!body3.success) return c.json(safeFailure2("The native CRM pipeline configuration is invalid.", "invalid_request"), 400);
+  return call(c, "crmPipelineUpsertTool", body3.data, 201);
+});
+crmApp.get("/:object/:entityId", async (c) => {
+  const object2 = parsedObject(c);
+  const entityId = UuidSchema.safeParse(c.req.param("entityId"));
+  if (!object2 || !entityId.success) return c.json(safeFailure2("The CRM record reference is invalid.", "invalid_request"), 400);
+  return call(c, crmTools[object2].get, { entityId: entityId.data });
+});
+crmApp.patch("/:object/:entityId", async (c) => {
+  const object2 = parsedObject(c);
+  const entityId = UuidSchema.safeParse(c.req.param("entityId"));
+  const body3 = MutationSchema.safeParse(await c.req.json().catch(() => null));
+  if (!object2 || !entityId.success || !body3.success) return c.json(safeFailure2("The CRM update is invalid.", "invalid_request"), 400);
+  return call(c, crmTools[object2].write, { ...body3.data, entityId: entityId.data });
+});
+crmApp.get("/people/:entityId/activity", async (c) => {
+  const entityId = UuidSchema.safeParse(c.req.param("entityId"));
+  if (!entityId.success) return c.json(safeFailure2("The CRM record reference is invalid.", "invalid_request"), 400);
+  const query = WorkPageSchema.safeParse(c.req.query());
+  if (!query.success) return c.json(safeFailure2("The CRM activity filters are invalid.", "invalid_request"), 400);
+  const result3 = await readResult(c, "crmWorkSearchTool", { objectKind: "activity", entityId: entityId.data, cursor: query.data.cursor, limit: query.data.limit });
+  if (result3 instanceof Response) return result3;
+  return c.json({ ok: true, items: workItems(result3).map((item) => ({ activityId: item.workId, occurredAt: stringProp(item.props, "occurred_at") ?? item.updatedAt, summary: item.title, sourceLabel: stringProp(item.props, "source_label") ?? "Native CRM", content: item.content })), pageInfo: pageInfo(result3), facets: {}, freshness: { generatedAt: (/* @__PURE__ */ new Date()).toISOString(), sourceRevision: "memory-live" } });
+});
+crmApp.get("/people/:entityId/attribution", (c) => {
+  const entityId = UuidSchema.safeParse(c.req.param("entityId"));
+  if (!entityId.success) return c.json(safeFailure2("The CRM record reference is invalid.", "invalid_request"), 400);
+  c.header("Cache-Control", "private, no-store");
+  return c.json({ ok: true, entityId: entityId.data, selectedModel: DEFAULT_XRAY_ATTRIBUTION.model, availableModels: XRAY_ATTRIBUTION_MODELS, observed: [], reported: [], exactPaths: [], originalTouch: null, latestTouch: null, xray: { state: "unavailable", reason: "No stable X-Ray evidence is linked to this CRM record." } });
+});
+crmApp.post("/imports/preview", async (c) => {
+  const body3 = parseCrmImportPreview(await c.req.json().catch(() => null));
+  if (!body3.ok) return c.json(safeFailure2(body3.message, body3.code), body3.code === "crm_import_too_large" ? 413 : 400);
+  return call(c, "crmImportPreviewTool", body3.input, 201);
+});
+crmApp.post("/imports/:importId/confirm", async (c) => {
+  const importId = UuidSchema.safeParse(c.req.param("importId"));
+  const body3 = parseCrmImportApply(await c.req.json().catch(() => null));
+  if (!importId.success || !body3.ok) return c.json(safeFailure2(body3.ok ? "The import identifier is invalid." : body3.message, body3.ok ? "invalid_request" : body3.code), 400);
+  return call(c, "crmImportApplyTool", { ...body3.input, importId: importId.data });
+});
+crmApp.get("/imports/:importId", (c) => c.json({ ok: false, error: { code: "import_status_use_receipt", message: "Use the immutable preview/apply receipt returned by the governed import.", requestId: randomUUID39(), retryable: false } }, 404));
+crmApp.post("/counterparts/preview", async (c) => {
+  const body3 = MutationSchema.omit({ baseRevision: true }).safeParse(await c.req.json().catch(() => null));
+  if (!body3.success) return c.json(safeFailure2("The counterpart preview is invalid.", "invalid_request"), 400);
+  return call(c, "crmCounterpartPreviewTool", body3.data, 201);
+});
+crmApp.post("/counterparts/:planId/apply", async (c) => {
+  const body3 = MutationSchema.omit({ baseRevision: true }).safeParse(await c.req.json().catch(() => null));
+  if (!body3.success) return c.json(safeFailure2("The counterpart apply request is invalid.", "invalid_request"), 400);
+  return call(c, "crmCounterpartApplyTool", { ...body3.data, planId: c.req.param("planId") });
+});
+crmApp.post("/merges/preview", async (c) => {
+  const body3 = MutationSchema.omit({ baseRevision: true }).safeParse(await c.req.json().catch(() => null));
+  if (!body3.success) return c.json(safeFailure2("The merge preview is invalid.", "invalid_request"), 400);
+  return call(c, "crmMergePreviewTool", body3.data, 201);
+});
+crmApp.post("/merges/:mergeId/apply", (c) => c.json(safeFailure2("Merge apply is disabled until owner authorization Q-004 is recorded.", "crm_owner_confirmation_required"), 403));
+crmApp.post("/deals/:dealId/transitions", async (c) => {
+  const body3 = MutationSchema.safeParse(await c.req.json().catch(() => null));
+  if (!body3.success) return c.json(safeFailure2("The deal transition is invalid.", "invalid_request"), 400);
+  return call(c, "crmDealTransitionTool", { ...body3.data, dealId: c.req.param("dealId") });
+});
+
+// src/api/crm-bridge-service.ts
+import { createHash as createHash44 } from "crypto";
+var CrmBridgeError = class extends Error {
+  constructor(code, message) {
+    super(message);
+    this.code = code;
+    this.name = "CrmBridgeError";
+  }
+  code;
+};
+function stableChildId(parentId, suffix2) {
+  const bytes2 = Buffer.from(createHash44("sha256").update(`${parentId}:${suffix2}`).digest().subarray(0, 16));
+  bytes2[6] = bytes2[6] & 15 | 80;
+  bytes2[8] = bytes2[8] & 63 | 128;
+  const hex = bytes2.toString("hex");
+  return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20)}`;
+}
+function validateCrmFormBridgePayload(payload) {
+  if (!payload.bridgeRunId || !payload.crmEntityId)
+    throw new CrmBridgeError("bridge_identity_required", "Bridge run and CRM entity IDs are required.");
+  requireHumanDisplayName(payload.displayName);
+  if (payload.relationshipTypes.length === 0)
+    throw new CrmBridgeError("relationship_type_required", "A managed relationship type is required.");
+  if (payload.source.kind !== "xray_form" || !payload.source.siteId || !payload.source.formId || !payload.source.submissionId)
+    throw new CrmBridgeError("bridge_source_invalid", "The X-Ray form source receipt is incomplete.");
+  return payload;
+}
+async function applyCrmFormBridge(rawPayload, writer) {
+  const payload = validateCrmFormBridgePayload(rawPayload);
+  const person = await writer.upsertPerson({
+    entityId: payload.crmEntityId,
+    idempotencyKey: `${payload.bridgeRunId}:person`,
+    displayName: payload.displayName,
+    relationshipTypes: [...payload.relationshipTypes],
+    email: payload.email,
+    phone: payload.phone,
+    organizationName: payload.organizationName,
+    source: payload.source
+  });
+  if (person.entityId !== payload.crmEntityId)
+    throw new CrmBridgeError("crm_entity_identity_mismatch", "CRM returned a different entity identity.");
+  const requestedCommunicationId = stableChildId(payload.bridgeRunId, "communication");
+  const communication = await writer.appendCommunication({
+    entityId: requestedCommunicationId,
+    personEntityId: person.entityId,
+    idempotencyKey: `${payload.bridgeRunId}:communication`,
+    kind: "form_submission",
+    occurredAt: payload.source.observedAt,
+    submittedFields: payload.submittedFields,
+    source: payload.source
+  });
+  let task = null;
+  if (payload.followUp) {
+    task = await writer.upsertTask({
+      entityId: stableChildId(payload.bridgeRunId, "task"),
+      personEntityId: person.entityId,
+      communicationEntityId: communication.entityId,
+      idempotencyKey: `${payload.bridgeRunId}:task`,
+      title: payload.followUp.title,
+      dueAt: payload.followUp.dueAt,
+      source: payload.source
+    });
+  }
+  return {
+    crmEntityId: person.entityId,
+    personReceiptId: person.receiptId,
+    communicationEntityId: communication.entityId,
+    communicationReceiptId: communication.receiptId,
+    taskEntityId: task?.entityId ?? null,
+    taskReceiptId: task?.receiptId ?? null
+  };
+}
+
 // src/api/analytics-delivery.ts
 function safeDeliveryError(error) {
   if (!error) return "memory_write_failed";
@@ -57494,7 +58142,37 @@ function safeDeliveryError(error) {
   if (error.includes("429")) return "memory_rate_limited";
   return "memory_write_failed";
 }
-async function deliverPendingAnalyticsForms(limit = 10) {
+function memoryWriteReceipt(result3) {
+  if (result3.ok !== true) throw new Error(typeof result3.error === "string" ? result3.error : "memory_write_failed");
+  const record7 = result3.record && typeof result3.record === "object" ? result3.record : null;
+  const receipt4 = result3.receipt && typeof result3.receipt === "object" ? result3.receipt : null;
+  if (!record7 || typeof record7.entityId !== "string" || typeof record7.revision !== "number" || !receipt4 || typeof receipt4.receiptId !== "string") throw new Error("memory_write_receipt_invalid");
+  return {
+    entityId: record7.entityId,
+    receiptId: receipt4.receiptId,
+    revision: record7.revision
+  };
+}
+function hostedMemoryCrmBridgeWriter(memoryKey) {
+  return {
+    async upsertPerson(input) {
+      return memoryWriteReceipt(
+        await memoryCall("crmUpsertPersonTool", input, memoryKey)
+      );
+    },
+    async appendCommunication(input) {
+      return memoryWriteReceipt(
+        await memoryCall("crmAppendCommunicationTool", input, memoryKey)
+      );
+    },
+    async upsertTask(input) {
+      return memoryWriteReceipt(
+        await memoryCall("crmUpsertTaskTool", input, memoryKey)
+      );
+    }
+  };
+}
+async function deliverPendingAnalyticsForms(limit = 10, dependencies = {}) {
   const jobs = await claimAnalyticsFormDeliveryJobs(limit);
   let delivered = 0;
   let deferred = 0;
@@ -57515,12 +58193,62 @@ async function deliverPendingAnalyticsForms(limit = 10) {
       continue;
     }
     const { key: key3, error } = await getOrCreateUserMemoryKey(user);
-    const result3 = key3 ? await memoryCall("putTool", payload, key3) : { ok: false, error };
-    if (result3.ok) {
-      await completeAnalyticsFormDelivery(job.id, job.submissionId);
+    if (!key3) {
+      await deferAnalyticsFormDelivery(job.id, job.attempts, safeDeliveryError(error));
+      deferred += 1;
+      continue;
+    }
+    if (!job.bridgeRunId || !job.crmEntityId) {
+      const result3 = await memoryCall("putTool", payload, key3);
+      if (result3.ok) {
+        await completeAnalyticsFormDelivery(job.id, job.submissionId);
+        delivered += 1;
+      } else {
+        await deferAnalyticsFormDelivery(job.id, job.attempts, safeDeliveryError(result3.error));
+        deferred += 1;
+      }
+      continue;
+    }
+    try {
+      const source = payload.source && typeof payload.source === "object" ? payload.source : {};
+      const bridgePayload = {
+        ...payload,
+        bridgeRunId: job.bridgeRunId,
+        crmEntityId: job.crmEntityId,
+        source: {
+          ...source,
+          kind: "xray_form",
+          submissionId: job.submissionId
+        }
+      };
+      const result3 = await applyCrmFormBridge(
+        bridgePayload,
+        (dependencies.createWriter ?? hostedMemoryCrmBridgeWriter)(key3)
+      );
+      await linkAnalyticsFormIdentity({
+        submissionId: job.submissionId,
+        siteId: bridgePayload.source.siteId,
+        crmEntityId: result3.crmEntityId,
+        visitorId: typeof payload.visitorId === "string" ? payload.visitorId : void 0,
+        sessionId: typeof payload.sessionId === "string" ? payload.sessionId : void 0,
+        email: bridgePayload.email,
+        phone: bridgePayload.phone,
+        displayName: bridgePayload.displayName,
+        evidenceType: "first_party_form",
+        clickIds: payload.clickIds && typeof payload.clickIds === "object" ? payload.clickIds : void 0
+      });
+      await completeAnalyticsFormBridgeDelivery({
+        jobId: job.id,
+        submissionId: job.submissionId,
+        crmEntityId: result3.crmEntityId
+      });
       delivered += 1;
-    } else {
-      await deferAnalyticsFormDelivery(job.id, job.attempts, safeDeliveryError(result3.error));
+    } catch (bridgeError) {
+      await deferAnalyticsFormDelivery(
+        job.id,
+        job.attempts,
+        safeDeliveryError(bridgeError instanceof Error ? bridgeError.message : void 0)
+      );
       deferred += 1;
     }
   }
@@ -57560,7 +58288,7 @@ async function deliverPendingAnalyticsCrmImports(limit = 10) {
 }
 
 // src/api/analytics-activation-dispatcher.ts
-import { randomUUID as randomUUID39 } from "crypto";
+import { randomUUID as randomUUID40 } from "crypto";
 function parseAnalyticsActivationDestinationProviderConfig(platform, value) {
   if (!value || typeof value !== "object" || Array.isArray(value)) return null;
   const config = value;
@@ -57639,7 +58367,7 @@ async function claimAnalyticsActivationJobs(limit = 10) {
   }));
 }
 async function beginAttempt(job, stableEventId) {
-  const id2 = randomUUID39();
+  const id2 = randomUUID40();
   const result3 = await getAnalyticsPool().query(
     `INSERT INTO analytics_activation_delivery_attempts(
        id, job_id, destination_id, mapping_version, attempt_number, provider_event_id, actor
@@ -58024,7 +58752,7 @@ async function pollPendingGoogleActivationDiagnostics(limit = 10, deadlineMs = D
 }
 
 // src/api/analytics-reconciliation.ts
-import { createHash as createHash44, randomUUID as randomUUID40 } from "crypto";
+import { createHash as createHash45, randomUUID as randomUUID41 } from "crypto";
 var RECONCILIATION_INTERVAL_SECONDS = 15 * 60;
 var WEBHOOK_ONLY_RECHECK_SECONDS = 24 * 60 * 60;
 var LEASE_SECONDS = 90;
@@ -58048,7 +58776,7 @@ var defaultDependencies2 = {
       input: input.payload,
       classification: "read",
       operationKind: "sync",
-      requestId: randomUUID40()
+      requestId: randomUUID41()
     });
   },
   async resolveMappedCrmPerson(input) {
@@ -58151,14 +58879,14 @@ function crmReadInput(provider, sourceAccountRef, cursorValue, now) {
   }
 }
 function crmOutcomeSourceEventId(outcome) {
-  const digest23 = createHash44("sha256").update(`${outcome.provider}:${outcome.sourceRecordId}:${outcome.updatedAt}:${outcome.tombstone}`).digest("hex").slice(0, 40);
+  const digest23 = createHash45("sha256").update(`${outcome.provider}:${outcome.sourceRecordId}:${outcome.updatedAt}:${outcome.tombstone}`).digest("hex").slice(0, 40);
   return `crm:${outcome.provider}:${digest23}`;
 }
 function analyticsCrmOutcomeToExternalEvent(outcome, sourceAccountRef) {
   const sourceEventId = crmOutcomeSourceEventId(outcome);
   return {
     schemaVersion: 1,
-    eventId: `crm_${createHash44("sha256").update(sourceEventId).digest("hex").slice(0, 24)}`,
+    eventId: `crm_${createHash45("sha256").update(sourceEventId).digest("hex").slice(0, 24)}`,
     sourceEventId,
     source: outcome.provider,
     sourceAccountRef,
@@ -58315,7 +59043,7 @@ async function ensureDueJobs() {
     await db.query(
       `INSERT INTO analytics_reconciliation_jobs(id, connection_id)
        VALUES ($1,$2) ON CONFLICT(connection_id) DO NOTHING`,
-      [randomUUID40(), connection.id]
+      [randomUUID41(), connection.id]
     );
   }
 }
@@ -58458,7 +59186,7 @@ async function deferAnalyticsReconciliationJob(input) {
       connectionId: input.connectionId,
       safeErrorCode: errorCode2,
       nextRunAt: new Date(Date.now() + delaySeconds * 1e3).toISOString(),
-      receiptFingerprint: createHash44("sha256").update(`${input.jobId}:${input.attempts}:${errorCode2}`).digest("hex")
+      receiptFingerprint: createHash45("sha256").update(`${input.jobId}:${input.attempts}:${errorCode2}`).digest("hex")
     });
   }
 }
@@ -58569,7 +59297,7 @@ async function reconcileAnalyticsConnection(job, dependencies = defaultDependenc
           deduplicated: duplicates,
           rejected: page3.rejected,
           hasMore: page3.hasMore,
-          receiptFingerprint: createHash44("sha256").update(`${job.id}:${JSON.stringify(page3.nextCursor)}:${replayed}:${duplicates}`).digest("hex"),
+          receiptFingerprint: createHash45("sha256").update(`${job.id}:${JSON.stringify(page3.nextCursor)}:${replayed}:${duplicates}`).digest("hex"),
           scheduleConfigured: Boolean(scope.sync_id),
           scheduleIntervalSeconds: scope.sync_interval_seconds ?? null
         }
@@ -58606,7 +59334,7 @@ async function drainAnalyticsReconciliation(limit = 5, deadlineMs = Date.now() +
 }
 
 // src/api/analytics-scheduled-lanes.ts
-import { randomUUID as randomUUID41 } from "crypto";
+import { randomUUID as randomUUID42 } from "crypto";
 var ANALYTICS_SCHEDULED_LANES = [
   { key: "rollup", intervalMinutes: 15, catchUpIntervals: 2, maxAttempts: 4 },
   { key: "form_delivery", intervalMinutes: 1, catchUpIntervals: 3, maxAttempts: 5 },
@@ -58653,7 +59381,7 @@ var PostgresAnalyticsScheduledOccurrenceStore = class {
              (id,lane_key,scheduled_for,status,attempt_count,max_attempts,next_attempt_at,created_at,updated_at)
            VALUES ($1,$2,$3,'pending',0,$4,$3,now(),now())
            ON CONFLICT (lane_key,scheduled_for) DO NOTHING`,
-          [randomUUID41(), definition.key, scheduledFor, definition.maxAttempts]
+          [randomUUID42(), definition.key, scheduledFor, definition.maxAttempts]
         );
         inserted += Number(result3.rowCount ?? 0);
       }
@@ -58736,7 +59464,7 @@ var PostgresAnalyticsScheduledOccurrenceStore = class {
 async function runAnalyticsScheduledLanes(executors, options = {}) {
   const store = options.store ?? new PostgresAnalyticsScheduledOccurrenceStore();
   const now = options.now ?? (() => /* @__PURE__ */ new Date());
-  const owner5 = options.owner ?? `cron:${randomUUID41()}`;
+  const owner5 = options.owner ?? `cron:${randomUUID42()}`;
   const leaseMs = options.leaseMs ?? 6e4;
   const maxClaims = options.maxClaims ?? 12;
   const firstNow = now();
@@ -58782,17 +59510,17 @@ async function runAnalyticsScheduledLanes(executors, options = {}) {
 }
 
 // src/api/scheduled-result-routes.ts
-import { Hono as Hono37 } from "hono";
-import { z as z44 } from "zod";
+import { Hono as Hono38 } from "hono";
+import { z as z46 } from "zod";
 
 // src/api/scheduled-artifact-owner.ts
-import { createHash as createHash45 } from "crypto";
+import { createHash as createHash46 } from "crypto";
 function scheduledArtifactOwnerIdForApiKey(apiKey) {
-  return createHash45("sha256").update(apiKey).digest("hex").slice(0, 24);
+  return createHash46("sha256").update(apiKey).digest("hex").slice(0, 24);
 }
 
 // src/api/scheduled-run-view-links.ts
-import { createHash as createHash46, randomBytes as randomBytes6, randomUUID as randomUUID42 } from "crypto";
+import { createHash as createHash47, randomBytes as randomBytes6, randomUUID as randomUUID43 } from "crypto";
 var schemaReady3 = false;
 async function ensureScheduledRunViewLinksSchema() {
   if (schemaReady3) return;
@@ -58846,7 +59574,7 @@ async function ensureScheduledRunViewLinksSchema() {
   schemaReady3 = true;
 }
 function tokenHash2(token7) {
-  return createHash46("sha256").update(token7).digest("hex");
+  return createHash47("sha256").update(token7).digest("hex");
 }
 function mapRow(row) {
   return {
@@ -58868,7 +59596,7 @@ async function createScheduledRunViewLink(input) {
   const now = input.now ?? /* @__PURE__ */ new Date();
   const token7 = randomBytes6(32).toString("base64url");
   const record7 = {
-    shareId: randomUUID42(),
+    shareId: randomUUID43(),
     ownerId: input.ownerId,
     runId: input.runId,
     artifactId: input.artifactId,
@@ -58933,7 +59661,7 @@ async function revokeScheduledRunViewLink(ownerId3, runId, shareId, now = /* @__
 }
 
 // src/personal-authority/render.ts
-import { createHash as createHash47 } from "crypto";
+import { createHash as createHash48 } from "crypto";
 function escapeHtml8(value) {
   return value.replace(/[&<>"']/g, (character) => ({
     "&": "&amp;",
@@ -58993,13 +59721,13 @@ ${section(flags.finalCta && Boolean(finalCta), `<section class="section cta" id=
     html,
     filename: `${input.name.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "") || "personal-authority"}.html`,
     bytes: bytes2,
-    sha256: createHash47("sha256").update(html).digest("hex"),
+    sha256: createHash48("sha256").update(html).digest("hex"),
     generatedAt: generatedAtIso
   };
 }
 
 // src/personal-authority/render-v2.ts
-import { createHash as createHash48 } from "crypto";
+import { createHash as createHash49 } from "crypto";
 var FONT_STACKS = Object.freeze({
   "editorial-serif": "Iowan Old Style, Baskerville, Times New Roman, serif",
   "modern-sans": "Avenir Next, Avenir, Helvetica Neue, Arial, sans-serif",
@@ -59103,13 +59831,13 @@ ${section2(flags.finalCta && Boolean(finalCta), `<section class="section cta" id
     html,
     filename: `${input.name.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "") || "personal-authority"}.html`,
     bytes: bytes2,
-    sha256: createHash48("sha256").update(html).digest("hex"),
+    sha256: createHash49("sha256").update(html).digest("hex"),
     generatedAt: generatedAtIso
   };
 }
 
 // src/newsroom-publisher/render.ts
-import { createHash as createHash49 } from "crypto";
+import { createHash as createHash50 } from "crypto";
 function escapeHtml10(value) {
   return value.replace(/[&<>"']/g, (character) => ({
     "&": "&amp;",
@@ -59215,13 +59943,13 @@ body{overflow-x:hidden}.lead-story__body,.lead-support__item,.story-card__body{m
 @media(max-width:620px){.desk-section__grid--panorama,.desk-section__grid--mosaic,.desk-section__grid--tiles{grid-template-columns:1fr}.story-card--panorama{display:block}.story-card--panorama h3,.story-card--mosaic-lead h3{font-size:34px}.story-card--mosaic-lead{grid-column:auto;grid-row:auto}.desk-section__grid--tiles>.story-card:nth-child(3n+2){margin-top:0}}
 </style></head><body data-theme="${escapeHtml10(config.theme)}" id="top" data-scheduled-renderer="newsroom_publisher_v1">${ticker}${masthead}${navigation}<main>${leadGrid}${latest}${sections}${newsletter}${pressRoom}${trustCenter}</main>${trustFooter}</body></html>`;
   const bytes2 = Buffer.byteLength(html);
-  const sha2564 = createHash49("sha256").update(html).digest("hex");
+  const sha2564 = createHash50("sha256").update(html).digest("hex");
   const filename2 = `${brand.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "") || "newsroom"}-news-site.html`;
   return { html, filename: filename2, bytes: bytes2, sha256: sha2564, generatedAt: generatedAtIso };
 }
 
 // src/blog-article/render.ts
-import { createHash as createHash50 } from "crypto";
+import { createHash as createHash51 } from "crypto";
 function escapeHtml11(value) {
   return value.replace(
     /[&<>"']/g,
@@ -59309,7 +60037,7 @@ function renderBlogArticleV1(input, config, generatedAt) {
 :root{--ink:#10213d;--ink2:#1c355a;--blue:#2563eb;--blue2:#1749b6;--mint:#45d5aa;--paper:#f7f5f0;--line:#dce4ef;--card:#fff;--body:#475569;--serif:Iowan Old Style,Palatino Linotype,Palatino,Georgia,serif;--sans:Inter,Avenir Next,ui-sans-serif,system-ui,sans-serif}body[data-theme="slate"]{--ink:#1e293b;--ink2:#334155;--blue:#475569;--blue2:#1e293b;--mint:#94a3b8;--paper:#f8fafc}body[data-theme="forest"]{--ink:#12352e;--ink2:#23584c;--blue:#147d64;--blue2:#0c5b48;--mint:#79d8bd;--paper:#f4f8f3}*{box-sizing:border-box}html{scroll-behavior:smooth;background:var(--paper)}body{margin:0;color:#252a33;background:var(--paper);font-family:var(--sans);line-height:1.6}a{color:inherit}button{font:inherit}button:focus-visible,a:focus-visible{outline:3px solid var(--mint);outline-offset:3px}.progress{position:fixed;z-index:50;top:0;left:0;height:4px;width:0;background:var(--mint)}.hero{position:relative;overflow:hidden;color:#fff;background:var(--ink)}.hero:after{position:absolute;right:-110px;top:-150px;width:420px;height:420px;border:1px solid #ffffff1a;border-radius:50%;content:""}.hero-inner{position:relative;z-index:1;max-width:1240px;margin:auto;padding:58px 42px 126px}.breadcrumb{display:flex;gap:8px;margin-bottom:34px;color:#dbeafecc;font-size:14px}.eyebrow{display:block;color:var(--blue);font-size:12px;font-weight:800;letter-spacing:.16em;text-transform:uppercase}.hero .eyebrow{color:var(--mint)}h1,h2,h3,p{margin-top:0}.hero h1{max-width:1000px;margin:14px 0 24px;font:700 clamp(44px,6vw,78px)/.98 var(--serif);letter-spacing:-.035em}.hero .dek{max-width:780px;color:#dbeafe;font-size:20px}.contributors{margin-top:30px;color:#eff6ff;font-size:14px}.contributors a{font-weight:800}.meta{display:flex;flex-wrap:wrap;gap:12px;margin-top:6px;color:#dbeafecc}.layout{position:relative;z-index:2;display:grid;grid-template-columns:minmax(0,760px) 290px;gap:64px;max-width:1240px;margin:-78px auto 0;padding:0 42px 80px}.main{min-width:0}.takeaways{padding:38px 44px;border-radius:24px;background:#fff;box-shadow:0 24px 70px #10213d24}.takeaways h2{margin:5px 0 20px;font:700 32px/1.1 var(--serif);color:var(--ink)}.takeaways ul{display:grid;gap:16px;margin:0;padding:0;list-style:none}.takeaways li{position:relative;padding-left:26px;color:var(--body);font-size:17px}.takeaways li:before{position:absolute;left:2px;top:.7em;width:8px;height:8px;border-radius:50%;background:var(--blue);content:""}.intro{padding:40px 0 4px}.intro p,.article-section>p{margin-bottom:22px;color:var(--body);font:400 18px/1.75 var(--sans)}.article-section{scroll-margin-top:28px;padding-top:45px}.article-section h2,.faq h2{margin:6px 0 20px;color:var(--ink);font:700 38px/1.08 var(--serif);letter-spacing:-.02em}.article-section ul{display:grid;gap:10px;margin:22px 0;padding-left:24px;color:var(--body);font-size:17px}.article-section li::marker{color:var(--blue)}.callout{margin:34px 0;padding:24px 28px;border-left:4px solid var(--blue);border-radius:0 16px 16px 0;background:#fff}.callout span{color:var(--blue);font-size:11px;font-weight:800;letter-spacing:.13em;text-transform:uppercase}.callout h3{margin:5px 0 8px;color:var(--ink);font:700 24px/1.15 var(--serif)}.callout p{margin:0;color:var(--body)}.rail{padding-top:0}.sidebar-media{overflow:hidden;margin:0 0 18px;border:1px solid #dbeafe;border-radius:16px;background:#fff}.sidebar-media img,.sidebar-media svg{display:block;width:100%;aspect-ratio:16/9;object-fit:cover}.sidebar-media figcaption{padding:10px 13px;color:#64748b;font-size:11px}.disclosure{margin-bottom:28px;border-top:1px solid #dbeafe;border-bottom:1px solid #dbeafe}.disclosure button{display:flex;width:100%;align-items:center;justify-content:space-between;gap:14px;padding:15px 0;border:0;color:#64748b;background:transparent;text-align:left;font-size:12px;cursor:pointer}.disclosure button b{color:var(--blue);font-size:18px;transition:transform .2s}.disclosure button[aria-expanded="true"] b{transform:rotate(180deg)}.disclosure p{padding:0 0 16px;margin:0;color:#64748b;font-size:12px}.toc{position:sticky;top:30px;padding:22px;border:1px solid var(--line);border-radius:16px;background:#fff;box-shadow:0 2px 5px #10213d12}.toc header{display:flex;align-items:center;justify-content:space-between}.toc header strong{color:var(--ink);font:700 21px/1 var(--serif)}.toc header button{width:34px;height:34px;border:0;border-radius:50%;color:var(--blue);background:transparent;cursor:pointer}.toc nav{display:grid;margin-top:14px}.toc nav a{display:flex;align-items:flex-start;gap:11px;padding:8px 0;color:#64748b;text-decoration:none;font-size:13px;line-height:1.35}.toc nav i{width:8px;height:8px;margin-top:5px;border:2px solid #bfdbfe;border-radius:50%}.toc nav a[aria-current="location"]{color:var(--ink);font-weight:800}.toc nav a[aria-current="location"] i{border-color:var(--blue);background:var(--blue)}.back-top{width:100%;margin-top:18px;padding:16px 0 0;border:0;border-top:1px solid var(--line);color:var(--blue);background:transparent;text-align:right;font-size:13px;font-weight:800;cursor:pointer}.faq{scroll-margin-top:28px;padding-top:64px}.faq>div{border-top:1px solid var(--line);border-bottom:1px solid var(--line)}.faq article+article{border-top:1px solid var(--line)}.faq h3{margin:0}.faq h3 button{display:flex;width:100%;align-items:center;justify-content:space-between;gap:18px;padding:19px 0;border:0;color:var(--ink);background:transparent;text-align:left;font-weight:800;cursor:pointer}.faq h3 b{color:var(--blue);font-size:22px}.faq article>p{padding:0 0 20px;margin:0;color:var(--body);font-size:16px}.author-card{margin-top:64px;padding:32px 36px;border-radius:18px;background:#fff}.article-actions{display:flex;flex-wrap:wrap;justify-content:space-between;gap:14px}.article-actions button{display:inline-flex;min-height:46px;align-items:center;justify-content:center;gap:8px;padding:8px 18px;border:2px solid var(--blue);border-radius:999px;color:var(--ink);background:#fff;font-weight:800;cursor:pointer}.article-actions button:hover{color:#fff;background:var(--blue)}.action-status{min-height:20px;margin:8px 0 0;color:var(--blue);text-align:right;font-size:13px;font-weight:700}.author-grid{display:grid;grid-template-columns:auto 1fr auto;gap:22px;align-items:center;margin-top:24px}.author-portrait{width:88px;height:88px;border-radius:50%;object-fit:cover}.author-initials{display:grid;place-items:center;color:var(--ink);background:#fecdd3;font-size:22px;font-weight:900}.author-grid span{color:#64748b;font-size:13px}.author-grid h2{margin:2px 0;color:var(--ink);font:700 27px/1 var(--serif)}.author-grid h2 a{text-decoration:none}.author-grid p{margin:8px 0;color:#64748b;font-size:14px}.author-grid nav{display:flex;flex-wrap:wrap;gap:14px}.author-grid nav a{color:#64748b;font-size:12px}.author-more{display:inline-flex;min-height:48px;align-items:center;justify-content:center;padding:10px 24px;border:2px solid var(--blue);color:var(--blue);text-align:center;text-decoration:none;font-size:13px;font-weight:800}.author-bio{margin:24px 0 0!important;padding-top:20px;border-top:1px solid var(--line);color:var(--body);font-size:16px}dialog{width:min(720px,calc(100% - 30px));max-height:calc(100dvh - 30px);padding:0;border:0;border-radius:18px;color:var(--ink);background:#fff;box-shadow:0 24px 70px #10213d38}dialog::backdrop{background:#0f172a7a;backdrop-filter:blur(2px)}dialog>div{position:relative;padding:30px}dialog h2{margin:0 50px 2px 0;font:700 30px/1.1 var(--serif)}dialog>div>p{color:#64748b}.dialog-close{position:absolute;top:13px;right:13px;width:44px;height:44px;border:0;border-radius:50%;color:var(--blue);background:transparent;font-size:29px;cursor:pointer}dialog section{border-top:1px solid var(--line)}dialog section button{display:block;width:100%;padding:17px 5px;border:0;border-bottom:1px solid var(--line);color:var(--body);background:#fff;text-align:left;line-height:1.65;cursor:pointer}.citation-status{min-height:22px;margin:14px 0 0!important;color:var(--blue)!important;font-size:13px;font-weight:800}.generated{max-width:1156px;margin:-52px auto 50px;padding:0 42px;color:#94a3b8;font-size:11px}@media(max-width:900px){.layout{display:block}.rail{display:none}.hero-inner{padding-bottom:116px}}@media(max-width:620px){.hero-inner{padding:36px 20px 104px}.hero h1{font-size:46px}.hero .dek{font-size:17px}.layout{margin-top:-70px;padding:0 16px 54px}.takeaways{padding:28px 24px}.article-section h2,.faq h2{font-size:32px}.author-card{padding:24px}.article-actions{display:grid;justify-content:start}.author-grid{grid-template-columns:1fr;gap:12px}.author-more{width:100%}dialog>div{padding:24px}.generated{padding:0 20px}}
 </style></head><body data-theme="${escapeHtml11(config.theme)}" data-scheduled-renderer="blog_article_v1"><div class="progress" aria-hidden="true"></div><header class="hero"><div class="hero-inner"><nav class="breadcrumb" aria-label="Breadcrumb"><a href="${safeHref4(input.canonicalUrl)}">${escapeHtml11(input.category)}</a><span>/</span><span>Article</span></nav><span class="eyebrow">${escapeHtml11(input.eyebrow)}</span><h1>${escapeHtml11(input.title)}</h1>${input.dek ? `<p class="dek">${escapeHtml11(input.dek)}</p>` : ""}<div class="contributors">${contributorText}<div class="meta"><time datetime="${escapeHtml11(articleDate)}">Updated ${formatDate2(articleDate)}</time><span>\u2022</span><span>${input.readTimeMinutes} min read</span>${input.reviewer ? "<span>\u2022</span><strong>Expert reviewed</strong>" : ""}</div></div></div></header><main class="layout"><article class="main"><section class="takeaways"><span class="eyebrow">The short answer</span><h2>Key takeaways</h2><ul>${input.keyTakeaways.map((item) => `<li>${escapeHtml11(item)}</li>`).join("")}</ul></section><section class="intro">${input.introduction.map((paragraph) => `<p>${escapeHtml11(paragraph)}</p>`).join("")}</section>${sections}${faq}${author}</article><div class="rail">${media}${disclosure}${toc}</div></main>${config.showGeneratedAt ? `<p class="generated">Rendered ${formatDate2(generatedAtIso)} by MCP Scraper.</p>` : ""}${citationDialog}<script>(()=>{const citations=${jsonForScript(citationValues)};const canonical=${jsonForScript(input.canonicalUrl)};const title=${jsonForScript(input.title)};const progress=document.querySelector('.progress');const tocLinks=[...document.querySelectorAll('.toc nav a')];const targets=tocLinks.map(link=>document.querySelector(link.hash)).filter(Boolean);const update=()=>{const max=document.documentElement.scrollHeight-innerHeight;if(progress)progress.style.width=(max>0?scrollY/max*100:0)+'%';let active=targets[0]?.id;for(const target of targets){if(target.getBoundingClientRect().top<=innerHeight*.55)active=target.id}tocLinks.forEach(link=>link.toggleAttribute('aria-current',link.hash==='#'+active));tocLinks.forEach(link=>{if(link.hash==='#'+active)link.setAttribute('aria-current','location');else link.removeAttribute('aria-current')})};addEventListener('scroll',update,{passive:true});addEventListener('resize',update);update();document.querySelectorAll('.faq h3 button').forEach(button=>button.addEventListener('click',()=>{const panel=document.getElementById(button.getAttribute('aria-controls'));const open=button.getAttribute('aria-expanded')==='true';button.setAttribute('aria-expanded',String(!open));panel.hidden=open;button.querySelector('b').textContent=open?'+':'\u2212'}));const disclosure=document.querySelector('.disclosure button');disclosure?.addEventListener('click',()=>{const panel=document.getElementById(disclosure.getAttribute('aria-controls'));const open=disclosure.getAttribute('aria-expanded')==='true';disclosure.setAttribute('aria-expanded',String(!open));panel.hidden=open});const tocToggle=document.querySelector('.toc header button');tocToggle?.addEventListener('click',()=>{const nav=document.getElementById('toc-links');const open=tocToggle.getAttribute('aria-expanded')==='true';tocToggle.setAttribute('aria-expanded',String(!open));nav.hidden=open;tocToggle.textContent=open?'\u2304':'\u2303'});document.querySelector('.back-top')?.addEventListener('click',()=>scrollTo({top:0,behavior:'smooth'}));const copy=async text=>{try{await navigator.clipboard.writeText(text)}catch{const area=document.createElement('textarea');area.value=text;area.style.position='fixed';area.style.opacity='0';document.body.append(area);area.select();document.execCommand('copy');area.remove()}};const dialog=document.getElementById('citation-dialog');document.querySelector('[data-cite]')?.addEventListener('click',()=>dialog.showModal());document.querySelector('.dialog-close')?.addEventListener('click',()=>dialog.close());dialog?.addEventListener('click',event=>{if(event.target===dialog)dialog.close()});document.querySelectorAll('[data-citation]').forEach(button=>button.addEventListener('click',async()=>{const style=button.dataset.citation;await copy(citations[style]);document.querySelector('.citation-status').textContent=style+' citation copied to clipboard.'}));document.querySelector('[data-share]')?.addEventListener('click',async()=>{const status=document.querySelector('.action-status');if(navigator.share){try{await navigator.share({title,url:canonical});status.textContent='Sharing options opened.';return}catch(error){if(error.name==='AbortError')return}}await copy(canonical);status.textContent='Article link copied to clipboard.'})})()</script></body></html>`;
   const bytes2 = Buffer.byteLength(html);
-  const sha2564 = createHash50("sha256").update(html).digest("hex");
+  const sha2564 = createHash51("sha256").update(html).digest("hex");
   return {
     html,
     filename: "blog-article.html",
@@ -59424,15 +60152,15 @@ var scheduledArtifactTemplatePresets = [
 ];
 
 // src/api/scheduled-result-routes.ts
-var TemplateParamsSchema = z44.object({ templateId: z44.string().uuid() }).strict();
-var RunParamsSchema = z44.object({ runId: z44.string().min(1).max(200) }).strict();
-var ViewLinkParamsSchema = z44.object({
-  runId: z44.string().min(1).max(200),
-  shareId: z44.string().uuid()
+var TemplateParamsSchema = z46.object({ templateId: z46.string().uuid() }).strict();
+var RunParamsSchema = z46.object({ runId: z46.string().min(1).max(200) }).strict();
+var ViewLinkParamsSchema = z46.object({
+  runId: z46.string().min(1).max(200),
+  shareId: z46.string().uuid()
 }).strict();
-var ArtifactTemplateListQuerySchema = z44.object({
-  status: z44.enum(["active", "archived", "all"]).default("active"),
-  query: z44.string().trim().min(1).max(120).optional(),
+var ArtifactTemplateListQuerySchema = z46.object({
+  status: z46.enum(["active", "archived", "all"]).default("active"),
+  query: z46.string().trim().min(1).max(120).optional(),
   presetKey: ArtifactTemplatePresetKeySchema.optional()
 }).strict();
 function apiError(error, errorCode2 = "invalid_request") {
@@ -59462,7 +60190,7 @@ function safeMemoryFailure(result3) {
     errorCode2 in messages ? errorCode2 : "internal_error"
   );
 }
-var scheduledResultApp = new Hono37();
+var scheduledResultApp = new Hono38();
 scheduledResultApp.use("/artifact-templates", createApiKeyAuth());
 scheduledResultApp.use("/artifact-templates/*", createApiKeyAuth());
 scheduledResultApp.use("/schedule-runs", createApiKeyAuth());
@@ -59609,10 +60337,10 @@ scheduledResultApp.delete("/schedule-runs/:runId/view-links/:shareId", async (c)
 });
 
 // src/api/public-scheduled-result-routes.ts
-import { Hono as Hono38 } from "hono";
+import { Hono as Hono39 } from "hono";
 
 // src/scheduled-artifacts/scheduled-run-artifact-store.ts
-import { createHash as createHash51 } from "crypto";
+import { createHash as createHash52 } from "crypto";
 var SCHEDULED_RUN_ARTIFACT_PREFIX = "scheduled-run-artifacts/";
 var SCHEDULED_RUN_ARTIFACT_DOWNLOAD_TTL_MS = 15 * 60 * 1e3;
 var SCHEDULED_RUN_ARTIFACT_MAX_BYTES = 2e6;
@@ -59628,7 +60356,7 @@ function policy5() {
   };
 }
 function runStorageSegment(runId) {
-  return /^[a-zA-Z0-9_-]{1,160}$/.test(runId) ? runId : `run-${createHash51("sha256").update(runId).digest("hex").slice(0, 32)}`;
+  return /^[a-zA-Z0-9_-]{1,160}$/.test(runId) ? runId : `run-${createHash52("sha256").update(runId).digest("hex").slice(0, 32)}`;
 }
 async function createScheduledRunArtifact(args) {
   if (args.rendered.bytes > SCHEDULED_RUN_ARTIFACT_MAX_BYTES) {
@@ -59671,7 +60399,7 @@ async function readScheduledRunArtifact(args) {
 }
 
 // src/api/public-scheduled-result-routes.ts
-var publicScheduledResultApp = new Hono38();
+var publicScheduledResultApp = new Hono39();
 function allowedFrameAncestors() {
   const configured3 = (process.env.SCHEDULED_ARTIFACT_FRAME_ANCESTORS ?? "").split(",").map((value) => value.trim()).filter((value) => /^https?:\/\/[^/\s]+$/.test(value));
   const origins = configured3.length ? configured3 : ["https://mcpscraper.dev", "https://www.mcpscraper.dev"];
@@ -59732,8 +60460,8 @@ publicScheduledResultApp.get("/scheduled-run-view-links/:token/content", async (
 });
 
 // src/api/scheduled-artifact-internal-routes.ts
-import { Hono as Hono39 } from "hono";
-var scheduledArtifactInternalApp = new Hono39();
+import { Hono as Hono40 } from "hono";
+var scheduledArtifactInternalApp = new Hono40();
 function errorPayload(errorCode2, error, requestId) {
   return ApiErrorResponseSchema.parse({
     ok: false,
@@ -59820,19 +60548,19 @@ scheduledArtifactInternalApp.post("/render", async (c) => {
 });
 
 // src/api/personal-assistant-routes.ts
-import { createHash as createHash59, randomUUID as randomUUID44 } from "crypto";
-import { Hono as Hono41 } from "hono";
+import { createHash as createHash60, randomUUID as randomUUID45 } from "crypto";
+import { Hono as Hono42 } from "hono";
 
 // src/api/personal-assistant-schedule-readiness.ts
-import { createHash as createHash52 } from "crypto";
-import { z as z45 } from "zod";
-var opaqueRef = z45.string().trim().regex(/^[a-z][a-z0-9_]*_[A-Za-z0-9_-]{3,128}$/);
-var isoTimestamp2 = z45.iso.datetime({ offset: true });
-var reasonCode = z45.string().regex(/^[a-z][a-z0-9_]{2,80}$/);
-var ScheduleReadinessInputSchema = z45.object({
+import { createHash as createHash53 } from "crypto";
+import { z as z47 } from "zod";
+var opaqueRef = z47.string().trim().regex(/^[a-z][a-z0-9_]*_[A-Za-z0-9_-]{3,128}$/);
+var isoTimestamp2 = z47.iso.datetime({ offset: true });
+var reasonCode = z47.string().regex(/^[a-z][a-z0-9_]{2,80}$/);
+var ScheduleReadinessInputSchema = z47.object({
   draft: CanonicalScheduleDraftSchema,
   runtimeRef: opaqueRef.nullable(),
-  exactConnectionBindings: z45.array(ScheduleConnectionBindingSchema).max(100)
+  exactConnectionBindings: z47.array(ScheduleConnectionBindingSchema).max(100)
 }).strict().superRefine((value, context) => {
   const connectionRefs = value.exactConnectionBindings.map((binding) => binding.connectionRef);
   if (new Set(connectionRefs).size !== connectionRefs.length) {
@@ -59845,26 +60573,26 @@ var ScheduleReadinessInputSchema = z45.object({
     context.addIssue({ code: "custom", path: ["runtimeRef"], message: "browser jobs require a registered runtime" });
   }
 });
-var ScheduleReadinessFactSchema = z45.object({
-  key: z45.string().regex(/^[a-z][a-z0-9_.]{2,120}$/),
+var ScheduleReadinessFactSchema = z47.object({
+  key: z47.string().regex(/^[a-z][a-z0-9_.]{2,120}$/),
   subjectRef: opaqueRef.nullable(),
-  state: z45.enum(["ready", "warning", "blocked"]),
+  state: z47.enum(["ready", "warning", "blocked"]),
   reasonCode,
-  revision: z45.number().int().nonnegative().nullable(),
+  revision: z47.number().int().nonnegative().nullable(),
   evidenceDigest: DigestSchema.nullable()
 }).strict();
-var readinessIssue = z45.object({ code: reasonCode, subjectRef: opaqueRef.nullable() }).strict();
-var ScheduleReadinessReceiptSchema = z45.object({
-  schemaVersion: z45.literal("assistant-schedule-readiness.v1"),
+var readinessIssue = z47.object({ code: reasonCode, subjectRef: opaqueRef.nullable() }).strict();
+var ScheduleReadinessReceiptSchema = z47.object({
+  schemaVersion: z47.literal("assistant-schedule-readiness.v1"),
   scheduleRef: opaqueRef,
-  scheduleRevision: z45.number().int().positive(),
-  state: z45.enum(["ready", "blocked"]),
+  scheduleRevision: z47.number().int().positive(),
+  state: z47.enum(["ready", "blocked"]),
   planDigest: DigestSchema,
   grantSetDigest: DigestSchema,
   readinessDigest: DigestSchema,
-  facts: z45.array(ScheduleReadinessFactSchema).max(500),
-  blockers: z45.array(readinessIssue).max(200),
-  warnings: z45.array(readinessIssue).max(200),
+  facts: z47.array(ScheduleReadinessFactSchema).max(500),
+  blockers: z47.array(readinessIssue).max(200),
+  warnings: z47.array(readinessIssue).max(200),
   evaluatedAt: isoTimestamp2
 }).strict();
 function resolveEffectiveBrowserGrant(raw) {
@@ -59897,7 +60625,7 @@ function canonicalJson2(value) {
   return JSON.stringify(value);
 }
 function digest2(value) {
-  return createHash52("sha256").update(canonicalJson2(value)).digest("hex");
+  return createHash53("sha256").update(canonicalJson2(value)).digest("hex");
 }
 function validTimezone2(timezone) {
   try {
@@ -60158,7 +60886,7 @@ async function evaluateScheduleReadiness(rawInput, dependencies) {
 }
 
 // src/api/personal-assistant-command-builder.ts
-import { createHash as createHash53 } from "crypto";
+import { createHash as createHash54 } from "crypto";
 function canonicalJson3(value) {
   return JSON.stringify(value, (_key, entry) => {
     if (!entry || typeof entry !== "object" || Array.isArray(entry)) return entry;
@@ -60166,7 +60894,7 @@ function canonicalJson3(value) {
   });
 }
 function digest3(value) {
-  return createHash53("sha256").update(canonicalJson3(value)).digest("hex");
+  return createHash54("sha256").update(canonicalJson3(value)).digest("hex");
 }
 function explicitControlIntent(text3) {
   const normalized = text3.trim().toLowerCase();
@@ -60215,7 +60943,7 @@ async function buildPersonalAssistantCommand(context, input) {
 }
 
 // src/api/personal-assistant-consent-content.ts
-import { createHash as createHash54 } from "crypto";
+import { createHash as createHash55 } from "crypto";
 var SUBMITTED_EVIDENCE = Object.freeze({
   evidenceVersion: "twilio-toll-free-submission.2026-08-28.v1",
   policyVersion: "2026-08-28.v1",
@@ -60278,7 +61006,7 @@ var ASSISTANT_ENROLLMENT_DISCLOSURE_TEXT = Object.freeze([
   ASSISTANT_CONSENT_CONTENT_V1.retentionDisclosure,
   ASSISTANT_CONSENT_CONTENT_V1.termsDisclosure
 ].join("\n\n"));
-var ASSISTANT_ENROLLMENT_DISCLOSURE_DIGEST = createHash54("sha256").update(`${ASSISTANT_CONSENT_CONTENT_V1.policyVersion}\0${ASSISTANT_ENROLLMENT_DISCLOSURE_TEXT}`).digest("hex");
+var ASSISTANT_ENROLLMENT_DISCLOSURE_DIGEST = createHash55("sha256").update(`${ASSISTANT_CONSENT_CONTENT_V1.policyVersion}\0${ASSISTANT_ENROLLMENT_DISCLOSURE_TEXT}`).digest("hex");
 var ASSISTANT_ENROLLMENT_DISCLOSURE_PROJECTION = Object.freeze({
   policyVersion: ASSISTANT_CONSENT_CONTENT_V1.policyVersion,
   disclosureDigest: ASSISTANT_ENROLLMENT_DISCLOSURE_DIGEST,
@@ -60289,11 +61017,11 @@ var ASSISTANT_ENROLLMENT_DISCLOSURE_PROJECTION = Object.freeze({
 });
 
 // src/api/personal-assistant-lifecycle.ts
-import { createHash as createHash56, randomUUID as randomUUID43 } from "crypto";
-import { z as z46 } from "zod";
+import { createHash as createHash57, randomUUID as randomUUID44 } from "crypto";
+import { z as z48 } from "zod";
 
 // src/api/personal-assistant-db.ts
-import { createHash as createHash55 } from "crypto";
+import { createHash as createHash56 } from "crypto";
 import { Pool } from "pg";
 
 // src/api/personal-assistant-schema.ts
@@ -60415,7 +61143,7 @@ function assistantDatabaseBindingFingerprint(value) {
   if (!database) {
     throw new AssistantDatabaseError("assistant_database_binding_invalid", "Personal Assistant database name is missing.");
   }
-  return createHash55("sha256").update(`${normalizedNeonHost(parsed.hostname)}\0${database}`).digest("hex");
+  return createHash56("sha256").update(`${normalizedNeonHost(parsed.hostname)}\0${database}`).digest("hex");
 }
 function assistantDatabaseRole(value) {
   const role = decodeURIComponent(parseDatabaseUrl(value).username);
@@ -60557,10 +61285,10 @@ async function preflightAssistantRuntimeBinding() {
 }
 
 // src/api/personal-assistant-lifecycle.ts
-var opaqueRef2 = z46.string().trim().regex(/^[a-z][A-Za-z0-9_-]{2,159}$/);
-var digest4 = z46.string().regex(/^[a-f0-9]{64}$/);
-var isoTimestamp3 = z46.string().datetime({ offset: true });
-var AssistantLifecycleOperationSchema = z46.enum([
+var opaqueRef2 = z48.string().trim().regex(/^[a-z][A-Za-z0-9_-]{2,159}$/);
+var digest4 = z48.string().regex(/^[a-f0-9]{64}$/);
+var isoTimestamp3 = z48.string().datetime({ offset: true });
+var AssistantLifecycleOperationSchema = z48.enum([
   "export_data",
   "remove_recipient",
   "withdraw_consent",
@@ -60572,7 +61300,7 @@ var AssistantLifecycleOperationSchema = z46.enum([
   "detach_number",
   "release_number"
 ]);
-var AssistantLifecycleTargetKindSchema = z46.enum([
+var AssistantLifecycleTargetKindSchema = z48.enum([
   "account",
   "recipient",
   "consent",
@@ -60607,24 +61335,24 @@ var ASSISTANT_LIFECYCLE_CONFIRMATION_PHRASES = Object.freeze({
   detach_number: "DETACH NUMBER",
   release_number: "RELEASE NUMBER"
 });
-var AssistantLifecyclePreviewRequestSchema = z46.object({
+var AssistantLifecyclePreviewRequestSchema = z48.object({
   operation: AssistantLifecycleOperationSchema,
-  target: z46.object({ kind: AssistantLifecycleTargetKindSchema, targetRef: opaqueRef2 }).strict(),
-  reason: z46.string().trim().min(3).max(240).optional()
+  target: z48.object({ kind: AssistantLifecycleTargetKindSchema, targetRef: opaqueRef2 }).strict(),
+  reason: z48.string().trim().min(3).max(240).optional()
 }).strict().superRefine((value, context) => {
   if (TARGET_BY_OPERATION[value.operation] !== value.target.kind) {
     context.addIssue({ code: "custom", path: ["target", "kind"], message: "target kind does not match lifecycle operation" });
   }
 });
-var AssistantLifecycleAffectedGroupSchema = z46.object({
-  count: z46.number().int().nonnegative().max(1e6),
-  refs: z46.array(opaqueRef2).max(50),
-  truncated: z46.boolean()
+var AssistantLifecycleAffectedGroupSchema = z48.object({
+  count: z48.number().int().nonnegative().max(1e6),
+  refs: z48.array(opaqueRef2).max(50),
+  truncated: z48.boolean()
 }).strict().superRefine((value, context) => {
   if (value.refs.length > value.count) context.addIssue({ code: "custom", path: ["refs"], message: "references cannot exceed count" });
   if (!value.truncated && value.refs.length !== value.count) context.addIssue({ code: "custom", path: ["refs"], message: "complete impact groups must include every reference" });
 });
-var AssistantLifecycleImpactSchema = z46.object({
+var AssistantLifecycleImpactSchema = z48.object({
   schedules: AssistantLifecycleAffectedGroupSchema,
   grants: AssistantLifecycleAffectedGroupSchema,
   conversations: AssistantLifecycleAffectedGroupSchema,
@@ -60634,21 +61362,21 @@ var AssistantLifecycleImpactSchema = z46.object({
   connections: AssistantLifecycleAffectedGroupSchema,
   numbers: AssistantLifecycleAffectedGroupSchema
 }).strict();
-var AssistantLifecycleMinimumAuditSchema = z46.object({
-  category: z46.enum(["consent", "suppression", "approval", "receipt", "audit", "registration", "released_number"]),
-  reason: z46.string().trim().min(3).max(160),
+var AssistantLifecycleMinimumAuditSchema = z48.object({
+  category: z48.enum(["consent", "suppression", "approval", "receipt", "audit", "registration", "released_number"]),
+  reason: z48.string().trim().min(3).max(160),
   retainedUntil: isoTimestamp3.nullable()
 }).strict();
-var AssistantLifecyclePreviewSchema = z46.object({
+var AssistantLifecyclePreviewSchema = z48.object({
   lifecycleRef: opaqueRef2,
   operation: AssistantLifecycleOperationSchema,
-  target: z46.object({ kind: AssistantLifecycleTargetKindSchema, targetRef: opaqueRef2 }).strict(),
-  state: z46.literal("awaiting_confirmation"),
+  target: z48.object({ kind: AssistantLifecycleTargetKindSchema, targetRef: opaqueRef2 }).strict(),
+  state: z48.literal("awaiting_confirmation"),
   previewDigest: digest4,
-  confirmationPhrase: z46.string().min(3).max(64),
-  irreversible: z46.boolean(),
+  confirmationPhrase: z48.string().min(3).max(64),
+  irreversible: z48.boolean(),
   impact: AssistantLifecycleImpactSchema,
-  minimumAudit: z46.array(AssistantLifecycleMinimumAuditSchema).min(1).max(10),
+  minimumAudit: z48.array(AssistantLifecycleMinimumAuditSchema).min(1).max(10),
   createdAt: isoTimestamp3,
   expiresAt: isoTimestamp3
 }).strict().superRefine((value, context) => {
@@ -60659,30 +61387,30 @@ var AssistantLifecyclePreviewSchema = z46.object({
     context.addIssue({ code: "custom", path: ["expiresAt"], message: "preview must expire after creation" });
   }
 });
-var AssistantLifecycleConfirmationSchema = z46.object({
+var AssistantLifecycleConfirmationSchema = z48.object({
   previewDigest: digest4,
-  confirmationPhrase: z46.string().min(3).max(64),
-  acknowledgeIrreversible: z46.boolean()
+  confirmationPhrase: z48.string().min(3).max(64),
+  acknowledgeIrreversible: z48.boolean()
 }).strict();
-var AssistantLifecycleReconciliationItemSchema = z46.object({
+var AssistantLifecycleReconciliationItemSchema = z48.object({
   reconciliationRef: opaqueRef2,
-  kind: z46.enum(["provider_disconnect", "provider_number_detach", "provider_number_release", "artifact_purge", "memory_purge"]),
+  kind: z48.enum(["provider_disconnect", "provider_number_detach", "provider_number_release", "artifact_purge", "memory_purge"]),
   targetRef: opaqueRef2,
-  state: z46.enum(["awaiting_provider", "pending_cleanup", "outcome_unknown"]),
-  retrySafety: z46.enum(["reconcile_first", "operator_only", "not_retryable"]),
-  nextAction: z46.string().trim().min(3).max(160)
+  state: z48.enum(["awaiting_provider", "pending_cleanup", "outcome_unknown"]),
+  retrySafety: z48.enum(["reconcile_first", "operator_only", "not_retryable"]),
+  nextAction: z48.string().trim().min(3).max(160)
 }).strict();
-var AssistantLifecycleReceiptSchema = z46.object({
+var AssistantLifecycleReceiptSchema = z48.object({
   lifecycleRef: opaqueRef2,
   operation: AssistantLifecycleOperationSchema,
-  target: z46.object({ kind: AssistantLifecycleTargetKindSchema, targetRef: opaqueRef2 }).strict(),
-  state: z46.enum(["completed", "reconciliation_required", "cancelled", "failed"]),
+  target: z48.object({ kind: AssistantLifecycleTargetKindSchema, targetRef: opaqueRef2 }).strict(),
+  state: z48.enum(["completed", "reconciliation_required", "cancelled", "failed"]),
   previewDigest: digest4,
   paused: AssistantLifecycleImpactSchema,
-  deleted: z46.object({ categories: z46.array(z46.string().regex(/^[a-z][a-z0-9_]{2,63}$/)).max(20), count: z46.number().int().nonnegative() }).strict(),
+  deleted: z48.object({ categories: z48.array(z48.string().regex(/^[a-z][a-z0-9_]{2,63}$/)).max(20), count: z48.number().int().nonnegative() }).strict(),
   exportRef: opaqueRef2.nullable(),
-  minimumAudit: z46.array(AssistantLifecycleMinimumAuditSchema).min(1).max(10),
-  unresolved: z46.array(AssistantLifecycleReconciliationItemSchema).max(25),
+  minimumAudit: z48.array(AssistantLifecycleMinimumAuditSchema).min(1).max(10),
+  unresolved: z48.array(AssistantLifecycleReconciliationItemSchema).max(25),
   irreversibleAt: isoTimestamp3.nullable(),
   completedAt: isoTimestamp3
 }).strict().superRefine((value, context) => {
@@ -60703,7 +61431,7 @@ var AssistantLifecycleError = class extends Error {
 };
 
 // src/api/personal-assistant-service.ts
-import { createHash as createHash57 } from "crypto";
+import { createHash as createHash58 } from "crypto";
 var PERSONAL_ASSISTANT_INTENT_ENVELOPE_VERSION = "assistant-intent-envelope.v1";
 var CONTROL_INTENTS = /* @__PURE__ */ new Set(["help", "status", "approve", "reject", "cancel"]);
 var EXPLICIT_TASK_INTENTS = /* @__PURE__ */ new Set([
@@ -60869,7 +61597,7 @@ function canonicalServiceJson(value) {
   });
 }
 function serviceDigest(value) {
-  return createHash57("sha256").update(canonicalServiceJson(value)).digest("hex");
+  return createHash58("sha256").update(canonicalServiceJson(value)).digest("hex");
 }
 function serviceReceipt(idempotencyKey4, requestDigest2, occurredAt, state2, result3, error = null) {
   const receiptRef = `receipt_${serviceDigest({ idempotencyKey: idempotencyKey4, requestDigest: requestDigest2 }).slice(0, 32)}`;
@@ -62293,10 +63021,10 @@ function getPersonalAssistantService() {
 
 // src/api/twilio-webhook-routes.ts
 import twilio3 from "twilio";
-import { Hono as Hono40 } from "hono";
+import { Hono as Hono41 } from "hono";
 
 // src/api/personal-assistant-observability.ts
-import { createHash as createHash58 } from "crypto";
+import { createHash as createHash59 } from "crypto";
 var OPAQUE_TRACE_REF = /^trace_[A-Za-z0-9_-]{8,128}$/u;
 var KINDS = /* @__PURE__ */ new Set([
   "purchase_unknown",
@@ -62772,7 +63500,7 @@ function handlerForRuntime(runtime, kind) {
   return createTwilioWebhookHandler(kind === "inbound" ? { ...shared, handleInbound: runtime.inboundAdmissionService ? createTwilioInboundAdmissionHandler(runtime.inboundAdmissionService) : createTwilioInboundSmsHandler(runtime.messagingService) } : { ...shared, handleStatus: createTwilioDeliveryStatusHandler(runtime.messagingService) });
 }
 function buildTwilioWebhookApp(resolveRuntime) {
-  const app2 = new Hono40();
+  const app2 = new Hono41();
   app2.get("/health", (c) => c.json({ ok: true, component: "twilio-webhook-boundary" }));
   for (const [path5, kind] of [["/inbound", "inbound"], ["/status", "status"]]) {
     app2.post(path5, async (c) => {
@@ -62993,7 +63721,7 @@ function payloadWithout(input, ...keys) {
   return Object.fromEntries(Object.entries(input).filter(([key3, value]) => !omitted.has(key3) && value !== void 0));
 }
 function personalAssistantMessagingServiceReviewDigest(review) {
-  return createHash59("sha256").update(JSON.stringify({
+  return createHash60("sha256").update(JSON.stringify({
     schemaVersion: "assistant-messaging-service-review.v1",
     numberRef: review.numberRef,
     connectionRef: review.connectionRef,
@@ -63127,7 +63855,7 @@ function ownerCaller(c) {
     throw new OwnerRouteError("not_authenticated", "Authentication is required.", 401);
   }
   if (ownerUserId2 <= 0n) throw new OwnerRouteError("not_authenticated", "Authentication is required.", 401);
-  const subjectRef = `owner_${createHash59("sha256").update(ownerUserId2.toString()).digest("hex").slice(0, 24)}`;
+  const subjectRef = `owner_${createHash60("sha256").update(ownerUserId2.toString()).digest("hex").slice(0, 24)}`;
   return { kind: "owner", surface: "rest", ownerUserId: ownerUserId2, subjectRef };
 }
 function enrollmentRequesterBinding(c, caller2) {
@@ -63179,10 +63907,10 @@ function publicError2(error, requestRef) {
   } } };
 }
 function buildPersonalAssistantOwnerRoutes(options) {
-  const app2 = new Hono41();
+  const app2 = new Hono42();
   const now = options.now ?? (() => /* @__PURE__ */ new Date());
-  const nextRequestRef = options.requestRef ?? (() => `request_${randomUUID44().replaceAll("-", "")}`);
-  const route = (method, path5, mutating, call) => {
+  const nextRequestRef = options.requestRef ?? (() => `request_${randomUUID45().replaceAll("-", "")}`);
+  const route = (method, path5, mutating, call2) => {
     app2[method](path5, async (c) => {
       const requestRef = nextRequestRef();
       try {
@@ -63190,7 +63918,7 @@ function buildPersonalAssistantOwnerRoutes(options) {
         const input = mutating ? await jsonBody(c) : pageInput(c);
         input.idempotencyKey = requestIdentity(c, requestRef, mutating);
         const service = options.service();
-        const result3 = servicePayload(await call(service, caller2, input, c));
+        const result3 = servicePayload(await call2(service, caller2, input, c));
         const body3 = { data: result3.data, ...result3.receipt ? { receipt: result3.receipt } : {}, meta: {
           request_ref: requestRef,
           projection_version: PERSONAL_ASSISTANT_OWNER_PROJECTION_VERSION,
@@ -63235,10 +63963,10 @@ function buildPersonalAssistantOwnerRoutes(options) {
     idempotencyKey: i.idempotencyKey,
     assistant: payloadWithout(i)
   }));
-  const contextRoute = (method, path5, mutating, names, call) => {
+  const contextRoute = (method, path5, mutating, names, call2) => {
     route(method, path5, mutating, (service, caller2, input, context) => {
       for (const name of names) input[name] = opaqueRef3(context, name);
-      return call(service, caller2, input, context);
+      return call2(service, caller2, input, context);
     });
   };
   contextRoute("get", "/lifecycle/:lifecycleRef", false, ["lifecycleRef"], (s, c, i) => s.getDataLifecycle(c, i));
@@ -63456,8 +64184,8 @@ function buildPersonalAssistantOwnerRoutes(options) {
 var personalAssistantOwnerApp = buildPersonalAssistantOwnerRoutes({ service: getPersonalAssistantService });
 
 // src/api/personal-assistant-browser-handoff-routes.ts
-import { randomUUID as randomUUID45 } from "crypto";
-import { Hono as Hono42 } from "hono";
+import { randomUUID as randomUUID46 } from "crypto";
+import { Hono as Hono43 } from "hono";
 var PERSONAL_ASSISTANT_BROWSER_HANDOFF_PROJECTION_VERSION = "assistant-browser-handoff.v1";
 var OPAQUE_REF2 = /^[a-z][a-z0-9]{1,31}_[A-Za-z0-9_-]{3,160}$/;
 var IDEMPOTENCY_KEY2 = /^[A-Za-z0-9._~:/+-]{8,240}$/;
@@ -63567,9 +64295,9 @@ function controlUrl(raw) {
   return url2;
 }
 function buildPersonalAssistantBrowserHandoffRoutes(options) {
-  const app2 = new Hono42();
+  const app2 = new Hono43();
   const now = options.now ?? (() => /* @__PURE__ */ new Date());
-  const nextRequestRef = options.requestRef ?? (() => `request_${randomUUID45().replaceAll("-", "")}`);
+  const nextRequestRef = options.requestRef ?? (() => `request_${randomUUID46().replaceAll("-", "")}`);
   const json = async (c, operation, created = false) => {
     const requestRef = nextRequestRef();
     try {
@@ -63657,8 +64385,8 @@ function buildPersonalAssistantBrowserHandoffRoutes(options) {
 }
 
 // src/api/personal-assistant-browser-profile-routes.ts
-import { randomUUID as randomUUID46 } from "crypto";
-import { Hono as Hono43 } from "hono";
+import { randomUUID as randomUUID47 } from "crypto";
+import { Hono as Hono44 } from "hono";
 var PERSONAL_ASSISTANT_BROWSER_PROFILE_PROJECTION_VERSION = "assistant-browser-profile.v1";
 var IDEMPOTENCY_KEY3 = /^[A-Za-z0-9._~:/+-]{8,240}$/;
 var OPAQUE_REF3 = /^[a-z][a-z0-9]{1,31}_[A-Za-z0-9_-]{3,160}$/;
@@ -63817,10 +64545,10 @@ function publicError4(error, requestRef) {
   };
 }
 function buildPersonalAssistantBrowserProfileRoutes(options) {
-  const app2 = new Hono43();
+  const app2 = new Hono44();
   const now = options.now ?? (() => /* @__PURE__ */ new Date());
   const healthStaleAfterMs = options.healthStaleAfterMs ?? 15 * 6e4;
-  const requestRef = options.requestRef ?? (() => `request_${randomUUID46().replaceAll("-", "")}`);
+  const requestRef = options.requestRef ?? (() => `request_${randomUUID47().replaceAll("-", "")}`);
   const respond = async (c, operation, created = false) => {
     const ref6 = requestRef();
     try {
@@ -63903,10 +64631,10 @@ function buildPersonalAssistantBrowserProfileRoutes(options) {
 }
 
 // src/api/personal-assistant-browser-production.ts
-import { createHash as createHash63, randomUUID as randomUUID51 } from "crypto";
+import { createHash as createHash64, randomUUID as randomUUID52 } from "crypto";
 
 // src/api/personal-assistant-browser-handoff-store.ts
-import { createHmac as createHmac12, randomUUID as randomUUID47 } from "crypto";
+import { createHmac as createHmac12, randomUUID as randomUUID48 } from "crypto";
 var BrowserHandoffStoreError = class extends Error {
   constructor(code, status) {
     super(code);
@@ -63994,14 +64722,14 @@ function createPostgresPersonalAssistantBrowserHandoffStore(options) {
       [row.owner_user_id, row.handoff_id, mode, now().toISOString()]
     );
     if (existing.rows[0]) return existing.rows[0].claim_ref;
-    const claimRef = `claim_${randomUUID47().replaceAll("-", "")}`;
+    const claimRef = `claim_${randomUUID48().replaceAll("-", "")}`;
     const ceiling = Math.min(new Date(row.expires_at).getTime(), now().getTime() + (mode === "control" ? controlLifetimeMs : claimLifetimeMs));
     if (ceiling <= now().getTime()) throw new BrowserHandoffStoreError("handoff_expired", 409);
     await client2.query(
       `INSERT INTO assistant.browser_handoff_claims
       (owner_user_id,id,public_id,handoff_id,mode,state,claim_digest,expires_at,created_at)
       VALUES ($1,$2,$3,$4,$5,'available',$6,$7::timestamptz,$8::timestamptz)`,
-      [row.owner_user_id, randomUUID47(), claimRef, row.handoff_id, mode, claimDigest(claimRef), new Date(ceiling).toISOString(), now().toISOString()]
+      [row.owner_user_id, randomUUID48(), claimRef, row.handoff_id, mode, claimDigest(claimRef), new Date(ceiling).toISOString(), now().toISOString()]
     );
     return claimRef;
   }
@@ -64023,7 +64751,7 @@ function createPostgresPersonalAssistantBrowserHandoffStore(options) {
   async function create(input) {
     return transaction2(async (client2) => {
       const owner5 = positiveOwner(input.ownerUserId);
-      const takeoverRef = `takeover_${randomUUID47().replaceAll("-", "")}`;
+      const takeoverRef = `takeover_${randomUUID48().replaceAll("-", "")}`;
       const createdAt = now();
       const expiresAt = new Date(createdAt.getTime() + absoluteLifetimeMs);
       const inserted = await client2.query(
@@ -64038,7 +64766,7 @@ function createPostgresPersonalAssistantBrowserHandoffStore(options) {
       ) ${HANDOFF_SELECT} JOIN inserted ON inserted.id=handoff.id WHERE handoff.owner_user_id=$1`,
         [
           owner5,
-          randomUUID47(),
+          randomUUID48(),
           takeoverRef,
           ref(input.profileRef, PROFILE_REF),
           ref(input.loginBindingRef, LOGIN_REF),
@@ -64197,7 +64925,7 @@ function createPostgresPersonalAssistantBrowserHandoffStore(options) {
 }
 
 // src/api/personal-assistant-browser-profile-store.ts
-import { createHash as createHash60, createHmac as createHmac13, randomUUID as randomUUID48 } from "crypto";
+import { createHash as createHash61, createHmac as createHmac13, randomUUID as randomUUID49 } from "crypto";
 import { domainToASCII } from "url";
 var PersonalAssistantBrowserProfileStoreError = class extends Error {
   constructor(code, message = code, status = code.endsWith("revision_conflict") ? 409 : code.endsWith("input_rejected") ? 400 : 404) {
@@ -64239,7 +64967,7 @@ function iso2(value) {
   return value instanceof Date ? value.toISOString() : new Date(value).toISOString();
 }
 function newRef(prefix) {
-  return `${prefix}_${randomUUID48().replaceAll("-", "")}`;
+  return `${prefix}_${randomUUID49().replaceAll("-", "")}`;
 }
 function deterministicRef(prefix, key3, identity) {
   return `${prefix}_${createHmac13("sha256", key3).update(`assistant.${prefix}\0${identity}`).digest("hex").slice(0, 32)}`;
@@ -64327,7 +65055,7 @@ function deriveBrowserProviderNamespaceDigest(keyInput, ownerUserId2, profileRef
 }
 function digestEvidence(value) {
   const canonical3 = JSON.stringify(value, (_key, entry) => entry && typeof entry === "object" && !Array.isArray(entry) ? Object.fromEntries(Object.entries(entry).sort(([a], [b]) => a.localeCompare(b))) : entry);
-  return createHash60("sha256").update(canonical3).digest("hex");
+  return createHash61("sha256").update(canonical3).digest("hex");
 }
 function exactCapabilityList(value, allowed) {
   if (!Array.isArray(value)) return [];
@@ -64442,7 +65170,7 @@ function createPostgresPersonalAssistantBrowserProfileStore(options) {
       inserted.status,inserted.capability_summary,inserted.revision,inserted.last_verified_at,inserted.verification_digest,
       inserted.created_at,inserted.updated_at FROM inserted`, [
       owner5,
-      randomUUID48(),
+      randomUUID49(),
       profileRef,
       input.assistantRef,
       label2,
@@ -64521,7 +65249,7 @@ function createPostgresPersonalAssistantBrowserProfileStore(options) {
       inserted.identity_label_masked,inserted.status,inserted.capability_summary,inserted.revision,inserted.last_verified_at,
       inserted.verification_digest,inserted.created_at,inserted.updated_at FROM inserted`, [
       owner5,
-      randomUUID48(),
+      randomUUID49(),
       ref6,
       assertRef(input.profileRef, PROFILE_REF2, "profileRef"),
       canonicalizeBrowserDomain(input.canonicalDomain),
@@ -64620,7 +65348,7 @@ function createPostgresPersonalAssistantBrowserProfileStore(options) {
         verification.observed_status,verification.evidence_digest,verification.evidence_summary,verification.verified_at,
         verification.created_at FROM verification`, [
         owner5,
-        randomUUID48(),
+        randomUUID49(),
         newRef("bpver"),
         profile.rows[0].id,
         bindingId,
@@ -64678,7 +65406,7 @@ function createPostgresPersonalAssistantBrowserProfileStore(options) {
         FROM assistant.assistants assistant WHERE assistant.owner_user_id=$1 AND assistant.public_id=$4 AND assistant.deleted_at IS NULL
         ON CONFLICT (owner_user_id,public_id) DO NOTHING`, [
         owner5,
-        randomUUID48(),
+        randomUUID49(),
         profileRef,
         input.assistantRef,
         assertSafeText(input.displayLabel ?? "Imported browser profile", "displayLabel", 120),
@@ -64699,7 +65427,7 @@ function createPostgresPersonalAssistantBrowserProfileStore(options) {
           VALUES ($1,$2,$3,$4,$5,$6,$7,$8::jsonb,$9::timestamptz,$9::timestamptz)
           ON CONFLICT (owner_user_id,public_id) DO NOTHING`, [
           owner5,
-          randomUUID48(),
+          randomUUID49(),
           bindingRef,
           existing.rows[0].id,
           domain,
@@ -64733,7 +65461,7 @@ function createPostgresPersonalAssistantBrowserProfileStore(options) {
 }
 
 // src/api/personal-assistant-idempotency-store.ts
-import { createHash as createHash61, randomUUID as randomUUID49 } from "crypto";
+import { createHash as createHash62, randomUUID as randomUUID50 } from "crypto";
 var PersonalAssistantIdempotencyConflictError = class extends Error {
   code = "idempotency_conflict";
   status = 409;
@@ -64762,7 +65490,7 @@ function jsonValue(value) {
   return JSON.parse(serialized);
 }
 function resultDigest(value) {
-  return createHash61("sha256").update(canonicalJson4(value)).digest("hex");
+  return createHash62("sha256").update(canonicalJson4(value)).digest("hex");
 }
 function timestamp3(value) {
   return value instanceof Date ? value.toISOString() : new Date(value).toISOString();
@@ -64774,7 +65502,7 @@ function createPostgresPersonalAssistantIdempotencyStore(options = {}) {
   return Object.freeze({
     async run(input, work) {
       const ownerUserId2 = input.ownerUserId.toString();
-      const id2 = randomUUID49();
+      const id2 = randomUUID50();
       const claim = await transaction2(async (client2) => {
         const inserted = await client2.query(`
           INSERT INTO assistant.owner_request_idempotency (
@@ -64816,8 +65544,8 @@ function createPostgresPersonalAssistantIdempotencyStore(options = {}) {
             ) VALUES ($1, $2, $3, 'system', 'assistant.idempotency.completed', $4, $5, $6, $7::jsonb, $8::timestamptz)
           `, [
             ownerUserId2,
-            randomUUID49(),
-            `audit_${randomUUID49()}`,
+            randomUUID50(),
+            `audit_${randomUUID50()}`,
             input.action,
             input.idempotencyKey,
             input.requestDigest,
@@ -64845,7 +65573,7 @@ function createPostgresPersonalAssistantIdempotencyStore(options = {}) {
 }
 
 // src/api/personal-assistant-browser-account-cleanup.ts
-import { createHash as createHash62, randomUUID as randomUUID50 } from "crypto";
+import { createHash as createHash63, randomUUID as randomUUID51 } from "crypto";
 function positiveOwner2(value) {
   if (typeof value !== "bigint" || value <= 0n) throw new TypeError("positive ownerUserId is required");
   return value.toString();
@@ -64904,10 +65632,10 @@ function createPersonalAssistantBrowserAccountCleanup(options) {
     };
     return Object.freeze({
       schemaVersion: "assistant-browser-account-cleanup.v1",
-      cleanupRef: `cleanup_${randomUUID50().replaceAll("-", "")}`,
+      cleanupRef: `cleanup_${randomUUID51().replaceAll("-", "")}`,
       state: "confirmed",
       ...evidence,
-      evidenceDigest: createHash62("sha256").update(JSON.stringify(evidence)).digest("hex")
+      evidenceDigest: createHash63("sha256").update(JSON.stringify(evidence)).digest("hex")
     });
   };
 }
@@ -64934,7 +65662,7 @@ var VERIFIED_BROWSER_CAPABILITIES = Object.freeze([
   "download"
 ]);
 function digest5(value) {
-  return createHash63("sha256").update(JSON.stringify(value, (_key, entry) => {
+  return createHash64("sha256").update(JSON.stringify(value, (_key, entry) => {
     if (typeof entry === "bigint") return entry.toString();
     if (!entry || typeof entry !== "object" || Array.isArray(entry)) return entry;
     return Object.fromEntries(Object.entries(entry).sort(([a], [b]) => a.localeCompare(b)));
@@ -64966,13 +65694,13 @@ function handoffError(error) {
 }
 function receipt2(data, replayed, revision = 1) {
   return { data, receipt: {
-    receiptRef: `receipt_${randomUUID51().replaceAll("-", "")}`,
+    receiptRef: `receipt_${randomUUID52().replaceAll("-", "")}`,
     state: replayed ? "reused" : "confirmed",
     revision
   } };
 }
 function handoffReceipt(data, replayed) {
-  return { data, receipt: { receiptRef: `receipt_${randomUUID51().replaceAll("-", "")}`, state: replayed ? "reused" : "confirmed" } };
+  return { data, receipt: { receiptRef: `receipt_${randomUUID52().replaceAll("-", "")}`, state: replayed ? "reused" : "confirmed" } };
 }
 function loginHealth(status) {
   return status === "deleted" ? "revoked" : status;
@@ -65084,7 +65812,7 @@ function createPersonalAssistantBrowserProductionDependencies(options) {
     async createProfile(ownerUserId2, input) {
       try {
         const result3 = await run(ownerUserId2, "assistant.browser-profile.create", input.idempotencyKey, input, async () => {
-          const profileRef = `bprof_${randomUUID51().replaceAll("-", "")}`;
+          const profileRef = `bprof_${randomUUID52().replaceAll("-", "")}`;
           const scope = { ownerRef: personalAssistantBrowserOwnerRef(ownerUserId2), profileRef };
           await runtime.ensureProfile(scope);
           try {
@@ -65147,7 +65875,7 @@ function createPersonalAssistantBrowserProductionDependencies(options) {
         const result3 = await run(ownerUserId2, "assistant.browser-login.begin", input.idempotencyKey, input, async () => {
           const profile = await profiles2.getProfile(ownerUserId2, input.profileRef);
           if (!profile) throw new PersonalAssistantBrowserProfileStoreError("browser_profile_not_found");
-          const loginBindingRef = `blogin_${randomUUID51().replaceAll("-", "")}`;
+          const loginBindingRef = `blogin_${randomUUID52().replaceAll("-", "")}`;
           const session = await openLoginSetup(ownerUserId2, profile.profileRef, loginBindingRef, input.canonicalDomain);
           try {
             const binding = await profiles2.createLoginBinding({
@@ -65502,19 +66230,19 @@ var personalAssistantBrowserHandoffApp = buildPersonalAssistantBrowserHandoffRou
 });
 
 // src/api/personal-assistant-worker-composition.ts
-import { Hono as Hono45 } from "hono";
+import { Hono as Hono46 } from "hono";
 
 // src/api/personal-assistant-worker-routes.ts
-import { createHash as createHash64, createPublicKey, verify as verify2 } from "crypto";
-import { Hono as Hono44 } from "hono";
-import { z as z47 } from "zod";
+import { createHash as createHash65, createPublicKey, verify as verify2 } from "crypto";
+import { Hono as Hono45 } from "hono";
+import { z as z49 } from "zod";
 var PERSONAL_ASSISTANT_WORKER_API_PREFIX = "/api/private/v1/assistant-worker";
 var PERSONAL_ASSISTANT_WORKER_SIGNATURE_VERSION = "assistant-worker-signature.v1";
 var PERSONAL_ASSISTANT_WORKER_MAX_BODY_BYTES = 262144;
 var PERSONAL_ASSISTANT_WORKER_SIGNATURE_TTL_MS = 6e4;
 var PERSONAL_ASSISTANT_WORKER_IDENTITY_TTL_MS = 3e5;
-var OPAQUE_REF4 = z47.string().regex(/^[a-z][a-z0-9]{1,31}_[A-Za-z0-9_-]{3,160}$/);
-var ISO_TIME = z47.string().datetime({ offset: true });
+var OPAQUE_REF4 = z49.string().regex(/^[a-z][a-z0-9]{1,31}_[A-Za-z0-9_-]{3,160}$/);
+var ISO_TIME = z49.string().datetime({ offset: true });
 var FORBIDDEN_AUTHORITY_KEY2 = /^(?:owner(?:User)?Id|owner_user_id|caller|subjectRef|table|tableName|sql|query|statement)$/i;
 var PRIVATE_KEY2 = /(?:accessToken|refreshToken|authToken|accountSid|providerSid|privateKey|clientSecret|databaseUrl|signedUrl)/i;
 var AssistantWorkerRouteError = class extends Error {
@@ -65535,11 +66263,11 @@ function canonicalJson5(value) {
   return JSON.stringify(value);
 }
 function personalAssistantWorkerBodyDigest(rawBody) {
-  return createHash64("sha256").update(rawBody, "utf8").digest("hex");
+  return createHash65("sha256").update(rawBody, "utf8").digest("hex");
 }
 function personalAssistantPlanDigest(plan) {
   const { planRef: _planRef, planDigest: _planDigest, immutable: _immutable, createdAt: _createdAt, ...proposal } = plan;
-  return createHash64("sha256").update(canonicalJson5(proposal)).digest("hex");
+  return createHash65("sha256").update(canonicalJson5(proposal)).digest("hex");
 }
 function personalAssistantWorkerSigningPayload(input) {
   return [
@@ -65563,7 +66291,7 @@ function inspectWorkerInput(value) {
   }
 }
 function strictObject(shape) {
-  return z47.object(shape).strict();
+  return z49.object(shape).strict();
 }
 var BindingSchema = {
   executionRef: OPAQUE_REF4,
@@ -65573,25 +66301,25 @@ var BindingSchema = {
 };
 var RegistrationSchema = strictObject({
   idempotencyKey: IdempotencyKeySchema,
-  runtimeVersion: z47.string().trim().min(1).max(80),
-  capabilities: z47.array(z47.string().regex(/^[a-z][a-z0-9_.-]{1,80}$/)).max(100)
+  runtimeVersion: z49.string().trim().min(1).max(80),
+  capabilities: z49.array(z49.string().regex(/^[a-z][a-z0-9_.-]{1,80}$/)).max(100)
 });
 var HealthSchema = strictObject({ idempotencyKey: IdempotencyKeySchema, heartbeat: WorkerHeartbeatSchema });
 var SignedWorkerClaimSchema = strictObject({
-  schemaVersion: z47.literal("assistant-worker-claim-envelope.v1"),
+  schemaVersion: z49.literal("assistant-worker-claim-envelope.v1"),
   keyRef: OPAQUE_REF4,
   createdAt: ISO_TIME,
   bodyDigest: DigestSchema,
   body: WorkerClaimSchema,
-  signature: z47.string().regex(/^[A-Za-z0-9_-]{40,160}$/)
+  signature: z49.string().regex(/^[A-Za-z0-9_-]{40,160}$/)
 });
 var WakeSchema = strictObject({ ...BindingSchema, idempotencyKey: IdempotencyKeySchema });
 var CycleSchema = strictObject({ ...BindingSchema, idempotencyKey: IdempotencyKeySchema, cycle: CycleCommandSchema });
 var PlanSchema = strictObject({ ...BindingSchema, idempotencyKey: IdempotencyKeySchema, plan: AssistantPlanSchema });
 var PolicyLeaseRequestSchema = strictObject({
-  schemaVersion: z47.literal("assistant-policy-lease-request.v1"),
+  schemaVersion: z49.literal("assistant-policy-lease-request.v1"),
   requestRef: OPAQUE_REF4,
-  requestNonce: z47.string().regex(/^[A-Za-z0-9_-]{32,128}$/),
+  requestNonce: z49.string().regex(/^[A-Za-z0-9_-]{32,128}$/),
   ownerRef: OPAQUE_REF4,
   workerRef: OPAQUE_REF4,
   cycleRef: OPAQUE_REF4,
@@ -65603,27 +66331,27 @@ var PolicyLeaseRequestSchema = strictObject({
   planDigest: DigestSchema,
   stepRef: OPAQUE_REF4,
   actionDigest: DigestSchema,
-  operation: z47.string().min(1).max(160),
+  operation: z49.string().min(1).max(160),
   argumentDigest: DigestSchema,
   connectionRef: OPAQUE_REF4,
   profileRef: OPAQUE_REF4,
   audienceDigest: DigestSchema.nullable(),
-  estimatedSpend: z47.object({ currency: z47.string().regex(/^[A-Z]{3}$/), amountMinor: z47.number().int().nonnegative().safe() }).strict().nullable(),
-  requestedLeaseSeconds: z47.number().int().min(1).max(300)
+  estimatedSpend: z49.object({ currency: z49.string().regex(/^[A-Z]{3}$/), amountMinor: z49.number().int().nonnegative().safe() }).strict().nullable(),
+  requestedLeaseSeconds: z49.number().int().min(1).max(300)
 });
 var SignedPolicyLeaseRequestSchema = strictObject({
-  schemaVersion: z47.literal("assistant-signed-worker-request.v1"),
+  schemaVersion: z49.literal("assistant-signed-worker-request.v1"),
   keyRef: OPAQUE_REF4,
   createdAt: ISO_TIME,
   expiresAt: ISO_TIME,
   bodyDigest: DigestSchema,
   body: PolicyLeaseRequestSchema,
-  signature: z47.string().regex(/^[A-Za-z0-9_-]{40,160}$/)
+  signature: z49.string().regex(/^[A-Za-z0-9_-]{40,160}$/)
 }).superRefine((value, context) => {
   const lifetime = Date.parse(value.expiresAt) - Date.parse(value.createdAt);
   if (lifetime <= 0 || lifetime > 6e4) context.addIssue({ code: "custom", path: ["expiresAt"], message: "signed worker requests must expire within one minute" });
 });
-var MoneySchema = z47.object({ currency: z47.string().regex(/^[A-Z]{3}$/), amountMinor: z47.number().int().nonnegative().safe() }).strict();
+var MoneySchema = z49.object({ currency: z49.string().regex(/^[A-Z]{3}$/), amountMinor: z49.number().int().nonnegative().safe() }).strict();
 var ApprovalSuspensionSchema = strictObject({
   ...BindingSchema,
   idempotencyKey: IdempotencyKeySchema,
@@ -65638,8 +66366,8 @@ var ApprovalSuspensionSchema = strictObject({
   spendLimit: MoneySchema.nullable(),
   occurrenceRef: OPAQUE_REF4.nullable(),
   expiresAt: ISO_TIME,
-  nextAction: z47.string().trim().min(1).max(500),
-  prompt: z47.object({ web: z47.string().trim().min(1).max(1e3), sms: z47.string().trim().min(1).max(480).nullable() }).strict()
+  nextAction: z49.string().trim().min(1).max(500),
+  prompt: z49.object({ web: z49.string().trim().min(1).max(1e3), sms: z49.string().trim().min(1).max(480).nullable() }).strict()
 });
 var DurableApprovalSuspensionSchema = strictObject({
   approvalRef: OPAQUE_REF4,
@@ -65654,9 +66382,9 @@ var DurableApprovalSuspensionSchema = strictObject({
   spendLimit: MoneySchema.nullable(),
   occurrenceRef: OPAQUE_REF4.nullable(),
   expiresAt: ISO_TIME,
-  nextAction: z47.string().trim().min(1).max(500),
+  nextAction: z49.string().trim().min(1).max(500),
   approvalReceiptRef: OPAQUE_REF4,
-  promptReceiptRefs: z47.array(OPAQUE_REF4).min(1).max(2)
+  promptReceiptRefs: z49.array(OPAQUE_REF4).min(1).max(2)
 });
 var ApprovalResumeSchema = strictObject({
   ...BindingSchema,
@@ -65672,12 +66400,12 @@ var SettlementSchema = strictObject({
   idempotencyKey: IdempotencyKeySchema,
   allocationRef: OPAQUE_REF4,
   actionReceiptRef: OPAQUE_REF4,
-  settledMinor: z47.number().int().nonnegative().safe(),
-  currency: z47.string().regex(/^[A-Z]{3}$/)
+  settledMinor: z49.number().int().nonnegative().safe(),
+  currency: z49.string().regex(/^[A-Z]{3}$/)
 });
 function publicWorkerError(error) {
   if (error instanceof AssistantWorkerRouteError) return { status: error.status, body: { error: { code: error.code, message: error.message } } };
-  if (error instanceof z47.ZodError || error instanceof TypeError) return { status: 400, body: { error: { code: "worker_validation_failed", message: "The worker request is invalid." } } };
+  if (error instanceof z49.ZodError || error instanceof TypeError) return { status: 400, body: { error: { code: "worker_validation_failed", message: "The worker request is invalid." } } };
   return { status: 500, body: { error: { code: "worker_route_failed", message: "The worker request could not be completed." } } };
 }
 function identityKey(identity, nonce) {
@@ -65693,7 +66421,7 @@ function verifyPolicyEnvelope(identity, envelope, at) {
   if (Date.parse(envelope.expiresAt) <= at.getTime() || Math.abs(at.getTime() - Date.parse(envelope.createdAt)) > 6e4) {
     throw new AssistantWorkerRouteError("worker_policy_request_expired", "The policy request has expired.", 401);
   }
-  const expectedDigest = createHash64("sha256").update(canonicalJson5(envelope.body)).digest("hex");
+  const expectedDigest = createHash65("sha256").update(canonicalJson5(envelope.body)).digest("hex");
   if (expectedDigest !== envelope.bodyDigest) throw new AssistantWorkerRouteError("worker_policy_digest_mismatch", "The policy request digest does not match.", 401);
   const { signature, ...unsigned } = envelope;
   let valid = false;
@@ -65711,7 +66439,7 @@ function verifyClaimEnvelope(identity, envelope, at) {
   if (Math.abs(at.getTime() - Date.parse(envelope.createdAt)) > PERSONAL_ASSISTANT_WORKER_SIGNATURE_TTL_MS) {
     throw new AssistantWorkerRouteError("worker_claim_expired", "The worker claim has expired.", 401);
   }
-  const expectedDigest = createHash64("sha256").update(canonicalJson5(envelope.body)).digest("hex");
+  const expectedDigest = createHash65("sha256").update(canonicalJson5(envelope.body)).digest("hex");
   if (expectedDigest !== envelope.bodyDigest) throw new AssistantWorkerRouteError("worker_claim_digest_mismatch", "The claim digest does not match.", 401);
   const { signature, ...unsigned } = envelope;
   let valid = false;
@@ -65733,7 +66461,7 @@ function workerCaller(identity, executionRef) {
   };
 }
 function buildPersonalAssistantWorkerRoutes(options) {
-  const app2 = new Hono44();
+  const app2 = new Hono45();
   const now = options.now ?? (() => /* @__PURE__ */ new Date());
   const maxClockSkewMs = options.maxClockSkewMs ?? PERSONAL_ASSISTANT_WORKER_SIGNATURE_TTL_MS;
   const maxIdentityLifetimeMs = options.maxIdentityLifetimeMs ?? PERSONAL_ASSISTANT_WORKER_IDENTITY_TTL_MS;
@@ -65789,7 +66517,7 @@ function buildPersonalAssistantWorkerRoutes(options) {
       return c.json(mapped.body, mapped.status);
     }
   });
-  const route = (path5, schema, binding, call, rawResponse = false) => {
+  const route = (path5, schema, binding, call2, rawResponse = false) => {
     app2.post(path5, async (c) => {
       try {
         const identity = c.get("assistantWorker");
@@ -65817,7 +66545,7 @@ function buildPersonalAssistantWorkerRoutes(options) {
             throw new AssistantWorkerRouteError("worker_binding_rejected", "The worker execution binding was not found.", 404);
           }
         }
-        const data = await call(identity, parsed);
+        const data = await call2(identity, parsed);
         return c.json(rawResponse ? data : { data, meta: { signature_version: PERSONAL_ASSISTANT_WORKER_SIGNATURE_VERSION } }, 200);
       } catch (error) {
         const mapped = publicWorkerError(error);
@@ -65993,7 +66721,7 @@ var configuredWorkerGraph = null;
 function configurePersonalAssistantWorkerProduction(dependencies) {
   if (configuredWorkerGraph) throw new PersonalAssistantWorkerCompositionError("Personal assistant worker routes are already configured.");
   const routes = buildPersonalAssistantWorkerRoutes(composePersonalAssistantWorkerProduction(dependencies).routeOptions);
-  const graph = new Hono45();
+  const graph = new Hono46();
   graph.route(PERSONAL_ASSISTANT_WORKER_API_PREFIX, routes);
   configuredWorkerGraph = graph;
 }
@@ -66001,7 +66729,7 @@ function personalAssistantWorkerProductionReadiness() {
   return Object.freeze({ configured: configuredWorkerGraph !== null, durablePortsRequired: true });
 }
 var personalAssistantWorkerProductionApp = (() => {
-  const app2 = new Hono45();
+  const app2 = new Hono46();
   app2.get("/ready", (c) => {
     const readiness2 = personalAssistantWorkerProductionReadiness();
     return c.json(readiness2, readiness2.configured ? 200 : 503);
@@ -66014,12 +66742,12 @@ var personalAssistantWorkerProductionApp = (() => {
 })();
 
 // src/api/personal-assistant-admin-routes.ts
-import { createHash as createHash66, createPublicKey as createPublicKey2 } from "crypto";
-import { Hono as Hono46 } from "hono";
-import { z as z48 } from "zod";
+import { createHash as createHash67, createPublicKey as createPublicKey2 } from "crypto";
+import { Hono as Hono47 } from "hono";
+import { z as z50 } from "zod";
 
 // src/api/personal-assistant-kill-controls.ts
-import { createHash as createHash65, randomUUID as randomUUID52 } from "crypto";
+import { createHash as createHash66, randomUUID as randomUUID53 } from "crypto";
 var PERSONAL_ASSISTANT_KILL_SCOPES = [
   "global",
   "outbound",
@@ -66047,7 +66775,7 @@ function canonicalJson6(value) {
   return JSON.stringify(value);
 }
 function digest6(value) {
-  return createHash65("sha256").update(canonicalJson6(value)).digest("hex");
+  return createHash66("sha256").update(canonicalJson6(value)).digest("hex");
 }
 function validateTarget(target) {
   if (!PERSONAL_ASSISTANT_KILL_SCOPES.includes(target.scope)) throw new PersonalAssistantKillControlError("invalid_kill_control", "Invalid kill-control scope.", 400);
@@ -66167,7 +66895,7 @@ var PostgresPersonalAssistantKillControlStore = class {
       const active = input.action === "activate";
       if (state2.active === active) throw new PersonalAssistantKillControlError("kill_state_conflict", "Kill control is already in the requested state.", 409);
       const revision = Number(state2.revision) + 1;
-      const receiptRef = `kill_receipt_${randomUUID52().replaceAll("-", "")}`;
+      const receiptRef = `kill_receipt_${randomUUID53().replaceAll("-", "")}`;
       await client2.query(`UPDATE assistant.kill_switch_controls SET revision = $3, active = $4, reason_code = $5, actor_ref = $6, updated_at = $7
         WHERE scope = $1 AND target_key = $2`, [input.target.scope, input.target.targetKey, revision, active, input.reasonCode, input.actorRef, input.occurredAt]);
       const inserted = await client2.query(
@@ -66245,11 +66973,11 @@ var PersonalAssistantAdminRouteError = class extends Error {
   code;
   status;
 };
-var OPAQUE_REF6 = z48.string().regex(/^[a-z][a-z0-9]{1,31}_[A-Za-z0-9_-]{3,160}$/);
-var DigestSchema2 = z48.string().regex(/^[a-f0-9]{64}$/);
-var IdempotencyKeySchema2 = z48.string().regex(/^[A-Za-z0-9][A-Za-z0-9_.:-]{2,199}$/);
-var WorkerRegistrationSchema = z48.object({
-  schemaVersion: z48.literal("assistant-worker-registration-request.v1"),
+var OPAQUE_REF6 = z50.string().regex(/^[a-z][a-z0-9]{1,31}_[A-Za-z0-9_-]{3,160}$/);
+var DigestSchema2 = z50.string().regex(/^[a-f0-9]{64}$/);
+var IdempotencyKeySchema2 = z50.string().regex(/^[A-Za-z0-9][A-Za-z0-9_.:-]{2,199}$/);
+var WorkerRegistrationSchema = z50.object({
+  schemaVersion: z50.literal("assistant-worker-registration-request.v1"),
   idempotencyKey: IdempotencyKeySchema2,
   authorizedHostRef: OPAQUE_REF6,
   ownerRef: OPAQUE_REF6,
@@ -66257,34 +66985,34 @@ var WorkerRegistrationSchema = z48.object({
   workerRef: OPAQUE_REF6,
   deviceKeyId: OPAQUE_REF6,
   keyRef: OPAQUE_REF6,
-  algorithm: z48.literal("Ed25519"),
-  publicKeyPem: z48.string().min(80).max(2e3),
+  algorithm: z50.literal("Ed25519"),
+  publicKeyPem: z50.string().min(80).max(2e3),
   publicKeySha256: DigestSchema2,
-  runtimeVersion: z48.string().trim().min(1).max(120),
-  capabilities: z48.array(z48.enum([
+  runtimeVersion: z50.string().trim().min(1).max(120),
+  capabilities: z50.array(z50.enum([
     "assistant.claim",
     "assistant.health",
     "assistant.execute"
   ])).min(1).max(3).refine((values) => new Set(values).size === values.length),
-  expiresAt: z48.string().datetime({ offset: true })
+  expiresAt: z50.string().datetime({ offset: true })
 }).strict();
-var WorkerRevocationSchema = z48.object({
-  schemaVersion: z48.literal("assistant-worker-revocation-request.v1"),
+var WorkerRevocationSchema = z50.object({
+  schemaVersion: z50.literal("assistant-worker-revocation-request.v1"),
   idempotencyKey: IdempotencyKeySchema2,
   authorizedHostRef: OPAQUE_REF6,
   ownerRef: OPAQUE_REF6,
   workerRef: OPAQUE_REF6,
   deviceKeyId: OPAQUE_REF6,
   keyRef: OPAQUE_REF6,
-  reasonCode: z48.string().regex(/^[a-z][a-z0-9_.-]{2,80}$/)
+  reasonCode: z50.string().regex(/^[a-z][a-z0-9_.-]{2,80}$/)
 }).strict();
-var KillMutationSchema = z48.object({
-  action: z48.enum(["activate", "deactivate"]),
-  scope: z48.enum(PERSONAL_ASSISTANT_KILL_SCOPES),
+var KillMutationSchema = z50.object({
+  action: z50.enum(["activate", "deactivate"]),
+  scope: z50.enum(PERSONAL_ASSISTANT_KILL_SCOPES),
   targetRef: OPAQUE_REF6.nullable(),
   idempotencyKey: IdempotencyKeySchema2,
-  reasonCode: z48.string().regex(/^[a-z][a-z0-9_.-]{2,80}$/),
-  expectedRevision: z48.number().int().nonnegative().safe()
+  reasonCode: z50.string().regex(/^[a-z][a-z0-9_.-]{2,80}$/),
+  expectedRevision: z50.number().int().nonnegative().safe()
 }).strict().superRefine((value, context) => {
   const targeted = ["owner", "assistant", "number"].includes(value.scope);
   if (targeted !== (value.targetRef !== null)) {
@@ -66315,7 +67043,7 @@ async function strictJson2(c, maxBodyBytes) {
   }
 }
 function derivedRef(prefix, ...identity) {
-  return `${prefix}_${createHash66("sha256").update(identity.join("\0")).digest("base64url").slice(0, 32)}`;
+  return `${prefix}_${createHash67("sha256").update(identity.join("\0")).digest("base64url").slice(0, 32)}`;
 }
 function ownerUserId(target) {
   if (!/^[1-9][0-9]{0,18}$/.test(target.targetKey)) {
@@ -66343,7 +67071,7 @@ async function resolvedTarget(options, scope, targetRef) {
   return target;
 }
 function buildPersonalAssistantAdminRoutes(options) {
-  const app2 = new Hono46();
+  const app2 = new Hono47();
   const now = options.now ?? (() => /* @__PURE__ */ new Date());
   const maxBodyBytes = options.maxBodyBytes ?? PERSONAL_ASSISTANT_ADMIN_MAX_BODY_BYTES;
   app2.onError((error, c) => {
@@ -66360,7 +67088,7 @@ function buildPersonalAssistantAdminRoutes(options) {
   });
   app2.get("/kill-switches", async (c) => {
     requireCapability(c.get("assistantAdmin"), "assistant.kill_switch.read");
-    const scope = z48.enum(PERSONAL_ASSISTANT_KILL_SCOPES).safeParse(c.req.query("scope"));
+    const scope = z50.enum(PERSONAL_ASSISTANT_KILL_SCOPES).safeParse(c.req.query("scope"));
     const targetRaw = c.req.query("targetRef");
     const parsedTarget = targetRaw === void 0 || targetRaw === "" ? { success: true, data: null } : OPAQUE_REF6.safeParse(targetRaw);
     if (!scope.success) throw new PersonalAssistantAdminRouteError("invalid_kill_control", "Valid kill-control scope is required.", 400);
@@ -66401,7 +67129,7 @@ function buildPersonalAssistantAdminRoutes(options) {
     const identity = c.get("assistantAdmin");
     requireCapability(identity, "assistant.worker_registration.register");
     const parsed = WorkerRegistrationSchema.safeParse(await strictJson2(c, maxBodyBytes));
-    if (!parsed.success || Date.parse(parsed.data.expiresAt) <= now().getTime() || !/^-----BEGIN PUBLIC KEY-----\n[\s\S]+\n-----END PUBLIC KEY-----\n?$/.test(parsed.data.publicKeyPem) || /PRIVATE KEY|ENCRYPTED/.test(parsed.data.publicKeyPem) || createHash66("sha256").update(parsed.success ? parsed.data.publicKeyPem : "").digest("hex") !== (parsed.success ? parsed.data.publicKeySha256 : "")) {
+    if (!parsed.success || Date.parse(parsed.data.expiresAt) <= now().getTime() || !/^-----BEGIN PUBLIC KEY-----\n[\s\S]+\n-----END PUBLIC KEY-----\n?$/.test(parsed.data.publicKeyPem) || /PRIVATE KEY|ENCRYPTED/.test(parsed.data.publicKeyPem) || createHash67("sha256").update(parsed.success ? parsed.data.publicKeyPem : "").digest("hex") !== (parsed.success ? parsed.data.publicKeySha256 : "")) {
       throw new PersonalAssistantAdminRouteError("invalid_worker_registration", "Invalid worker registration request.", 400);
     }
     try {
@@ -66484,7 +67212,7 @@ var configuredAdminGraph = null;
 function configurePersonalAssistantAdminProduction(options) {
   if (configuredAdminGraph) throw new PersonalAssistantAdminRouteError("assistant_admin_already_configured", "Assistant administrator routes are already configured.", 409);
   const routes = buildPersonalAssistantAdminRoutes(options);
-  const graph = new Hono46();
+  const graph = new Hono47();
   graph.route(PERSONAL_ASSISTANT_ADMIN_API_PREFIX, routes);
   configuredAdminGraph = graph;
 }
@@ -66492,7 +67220,7 @@ function personalAssistantAdminReadiness() {
   return Object.freeze({ configured: configuredAdminGraph !== null, durablePortsRequired: true });
 }
 var personalAssistantAdminProductionApp = (() => {
-  const app2 = new Hono46();
+  const app2 = new Hono47();
   app2.get("/ready", (c) => {
     const readiness2 = personalAssistantAdminReadiness();
     return c.json(readiness2, readiness2.configured ? 200 : 503);
@@ -66502,7 +67230,7 @@ var personalAssistantAdminProductionApp = (() => {
 })();
 
 // src/api/personal-assistant-cron-routes.ts
-import { Hono as Hono47 } from "hono";
+import { Hono as Hono48 } from "hono";
 var PERSONAL_ASSISTANT_CRON_PREFIX = "/cron/assistant";
 var handlers = null;
 function configurePersonalAssistantCronProduction(next) {
@@ -66514,7 +67242,7 @@ function personalAssistantCronReadiness() {
   return Object.freeze({ configured: handlers !== null, durableReconciliationRequired: true });
 }
 var personalAssistantCronProductionApp = (() => {
-  const app2 = new Hono47();
+  const app2 = new Hono48();
   app2.get("/ready", (c) => {
     const readiness2 = personalAssistantCronReadiness();
     return c.json(readiness2, readiness2.configured ? 200 : 503);
@@ -66527,24 +67255,24 @@ var personalAssistantCronProductionApp = (() => {
 })();
 
 // src/api/personal-assistant-production.ts
-import { createHash as createHash96 } from "crypto";
+import { createHash as createHash97 } from "crypto";
 
 // src/api/personal-assistant-admin-production.ts
-import { createHash as createHash70 } from "crypto";
+import { createHash as createHash71 } from "crypto";
 
 // src/api/personal-assistant-worker-store.ts
-import { createHash as createHash69, randomUUID as randomUUID54 } from "crypto";
+import { createHash as createHash70, randomUUID as randomUUID55 } from "crypto";
 
 // src/api/personal-assistant-repository.ts
-import { createHash as createHash68, randomBytes as randomBytes7, randomUUID as randomUUID53 } from "crypto";
+import { createHash as createHash69, randomBytes as randomBytes7, randomUUID as randomUUID54 } from "crypto";
 
 // src/api/personal-assistant-wake-packet.ts
-import { createHash as createHash67 } from "crypto";
+import { createHash as createHash68 } from "crypto";
 function stableJson(value) {
   return JSON.stringify(value, (_key, entry) => !entry || typeof entry !== "object" || Array.isArray(entry) ? entry : Object.fromEntries(Object.entries(entry).sort(([a], [b]) => a.localeCompare(b))));
 }
 function stableDigest(value) {
-  return createHash67("sha256").update(stableJson(value)).digest("hex");
+  return createHash68("sha256").update(stableJson(value)).digest("hex");
 }
 function deterministicWakePacketRef(snapshot) {
   return `wake_${stableDigest({ assistantRef: snapshot.assistantRef, commandRef: snapshot.commandRef, cycleRef: snapshot.cycleRef, executionRef: snapshot.executionRef, contextVersionRef: snapshot.contextVersion.contextVersionRef }).slice(0, 32)}`;
@@ -66597,10 +67325,10 @@ function canonicalJson7(value) {
   });
 }
 function digest7(value) {
-  return createHash68("sha256").update(canonicalJson7(value)).digest("hex");
+  return createHash69("sha256").update(canonicalJson7(value)).digest("hex");
 }
 function deterministicRef2(prefix, identity) {
-  return `${prefix}_${createHash68("sha256").update(identity).digest("hex").slice(0, 32)}`;
+  return `${prefix}_${createHash69("sha256").update(identity).digest("hex").slice(0, 32)}`;
 }
 function messageCursor(message) {
   return Buffer.from(JSON.stringify([message.occurredAt, message.messageRef])).toString("base64url");
@@ -66985,7 +67713,7 @@ function createPostgresPersonalAssistantRepositoryStore(options = {}) {
           const stored = AssistantCommandSchema.parse(existing.rows[0].payload);
           return { command: stored, receipt: receipt4, entity: stored };
         }
-        const commandId = randomUUID53();
+        const commandId = randomUUID54();
         const inserted = await client2.query(`
           INSERT INTO assistant.commands (
             owner_user_id, id, public_id, assistant_id, conversation_id, command_type,
@@ -67027,7 +67755,7 @@ function createPostgresPersonalAssistantRepositoryStore(options = {}) {
           )
         `, [
           ownerUserId2.toString(),
-          randomUUID53(),
+          randomUUID54(),
           receipt4.receiptRef,
           commandId,
           command.operation,
@@ -67096,7 +67824,7 @@ function createPostgresPersonalAssistantRepositoryStore(options = {}) {
           `, [ownerUserId2.toString(), row.id]);
         }
         const token7 = randomBytes7(32).toString("base64url");
-        const tokenHash5 = createHash68("sha256").update(token7).digest("hex");
+        const tokenHash5 = createHash69("sha256").update(token7).digest("hex");
         const leaseRef = deterministicRef2("lease", `${input.executionRef}\0${input.workerRef}\0${input.now}`);
         const expiresAt = new Date(Date.parse(input.now) + input.leaseSeconds * 1e3).toISOString();
         await client2.query(`
@@ -67104,7 +67832,7 @@ function createPostgresPersonalAssistantRepositoryStore(options = {}) {
             owner_user_id, id, public_id, worker_id, execution_id, lease_token_hash,
             state, claimed_at, heartbeat_at, expires_at
           ) VALUES ($1, $2, $3, $4, $5, $6, 'active', $7, $7, $8)
-        `, [ownerUserId2.toString(), randomUUID53(), leaseRef, worker.rows[0].id, row.id, tokenHash5, input.now, expiresAt]);
+        `, [ownerUserId2.toString(), randomUUID54(), leaseRef, worker.rows[0].id, row.id, tokenHash5, input.now, expiresAt]);
         await client2.query(`
           UPDATE assistant.executions
           SET state = 'claimed', claimed_by_worker_id = $3, claim_token_hash = $4,
@@ -67181,7 +67909,7 @@ function createPostgresPersonalAssistantRepositoryStore(options = {}) {
           RETURNING public_id
         `, [
           ownerUserId2.toString(),
-          randomUUID53(),
+          randomUUID54(),
           grant.grantRef,
           grant.revision,
           grant.authorityClass,
@@ -67238,7 +67966,7 @@ function createPostgresPersonalAssistantRepositoryStore(options = {}) {
         RETURNING public_id
       `, [
         ownerUserId2.toString(),
-        randomUUID53(),
+        randomUUID54(),
         approval.approvalRef,
         approval.requestedActionDigest,
         approval.approvedArgumentDigest,
@@ -67371,7 +68099,7 @@ function createPostgresPersonalAssistantRepositoryStore(options = {}) {
           RETURNING public_id
         `, [
           ownerUserId2.toString(),
-          randomUUID53(),
+          randomUUID54(),
           input.conversationRef,
           input.participantDigest,
           input.occurredAt,
@@ -67419,7 +68147,7 @@ function createPostgresPersonalAssistantRepositoryStore(options = {}) {
           RETURNING public_id
         `, [
           ownerUserId2.toString(),
-          randomUUID53(),
+          randomUUID54(),
           message.messageRef,
           message.direction,
           message.providerAccountRef,
@@ -67462,7 +68190,7 @@ function createPostgresPersonalAssistantRepositoryStore(options = {}) {
             provider_message_sid,provider_event_key,error_class,occurred_at
         `, [
           ownerUserId2.toString(),
-          randomUUID53(),
+          randomUUID54(),
           event2.deliveryEventRef,
           event2.providerAccountRef,
           event2.providerMessageSid,
@@ -67511,7 +68239,7 @@ function createPostgresPersonalAssistantRepositoryStore(options = {}) {
         RETURNING public_id, byte_digest
       `, [
         ownerUserId2.toString(),
-        randomUUID53(),
+        randomUUID54(),
         media.mediaRef,
         media.providerAccountRef,
         media.providerMediaSid,
@@ -67570,7 +68298,7 @@ function createPostgresPersonalAssistantRepositoryStore(options = {}) {
         RETURNING public_id,version,manifest_digest,created_at
       `, [
         ownerUserId2.toString(),
-        randomUUID53(),
+        randomUUID54(),
         input.contextVersionRef,
         input.version,
         input.manifestDigest,
@@ -67599,7 +68327,7 @@ function createPostgresPersonalAssistantRepositoryStore(options = {}) {
         RETURNING public_id,state,opened_at,updated_at,closed_at
       `, [
         ownerUserId2.toString(),
-        randomUUID53(),
+        randomUUID54(),
         cycle.cycleRef,
         cycle.state,
         cycle.openedAt,
@@ -67632,7 +68360,7 @@ function createPostgresPersonalAssistantRepositoryStore(options = {}) {
             FROM assistant.wake_cycles cycle WHERE cycle.owner_user_id = $1 AND cycle.public_id = $9
           `, [
             ownerUserId2.toString(),
-            randomUUID53(),
+            randomUUID54(),
             transition.taskRef,
             title,
             transition.toState,
@@ -67666,7 +68394,7 @@ function createPostgresPersonalAssistantRepositoryStore(options = {}) {
         RETURNING public_id,state,attempt,retry_class,terminal_at
       `, [
         ownerUserId2.toString(),
-        randomUUID53(),
+        randomUUID54(),
         execution.executionRef,
         execution.planDigest,
         execution.state,
@@ -67701,7 +68429,7 @@ function createPostgresPersonalAssistantRepositoryStore(options = {}) {
           RETURNING runtime_version,health,occurred_at
         `, [
           ownerUserId2.toString(),
-          randomUUID53(),
+          randomUUID54(),
           relation.rows[0].worker_id,
           relation.rows[0].lease_id,
           heartbeat.sequence,
@@ -67786,7 +68514,7 @@ function createPostgresPersonalAssistantRepositoryStore(options = {}) {
           RETURNING id
         `, [
           ownerUserId2.toString(),
-          randomUUID53(),
+          randomUUID54(),
           plan.planRef,
           plan.planDigest,
           JSON.stringify(plan),
@@ -67805,7 +68533,7 @@ function createPostgresPersonalAssistantRepositoryStore(options = {}) {
             ) VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9::jsonb,$10,$11,$12,$13,$14)
           `, [
             ownerUserId2.toString(),
-            randomUUID53(),
+            randomUUID54(),
             step.stepRef,
             inserted.rows[0].id,
             step.position,
@@ -67845,7 +68573,7 @@ function createPostgresPersonalAssistantRepositoryStore(options = {}) {
         RETURNING required_digest,decision,reason_code
       `, [
         ownerUserId2.toString(),
-        randomUUID53(),
+        randomUUID54(),
         barrier.barrierRef,
         barrier.barrierKind,
         barrier.decision,
@@ -67876,7 +68604,7 @@ function createPostgresPersonalAssistantRepositoryStore(options = {}) {
         RETURNING public_id,authorized_minor,state
       `, [
         ownerUserId2.toString(),
-        randomUUID53(),
+        randomUUID54(),
         allocation.allocationRef,
         allocation.kind,
         allocation.idempotencyKey,
@@ -67990,7 +68718,7 @@ function createPostgresPersonalAssistantRepositoryStore(options = {}) {
             ON CONFLICT (owner_user_id, public_id) DO NOTHING
           `, [
             ownerUserId2.toString(),
-            randomUUID53(),
+            randomUUID54(),
             contact.contactRef,
             contact.displayName,
             contact.phoneCiphertext,
@@ -68018,7 +68746,7 @@ function createPostgresPersonalAssistantRepositoryStore(options = {}) {
             ON CONFLICT (owner_user_id, public_id) DO NOTHING
           `, [
             ownerUserId2.toString(),
-            randomUUID53(),
+            randomUUID54(),
             number.numberRef,
             number.providerAccountRef,
             number.providerNumberSid,
@@ -68050,7 +68778,7 @@ function createPostgresPersonalAssistantRepositoryStore(options = {}) {
             ON CONFLICT (owner_user_id, public_id) DO NOTHING
           `, [
             ownerUserId2.toString(),
-            randomUUID53(),
+            randomUUID54(),
             conversation.conversationRef,
             conversation.participantDigest,
             conversation.occurredAt,
@@ -68072,7 +68800,7 @@ function createPostgresPersonalAssistantRepositoryStore(options = {}) {
             ON CONFLICT (owner_user_id, public_id) DO NOTHING
           `, [
             ownerUserId2.toString(),
-            randomUUID53(),
+            randomUUID54(),
             message.messageRef,
             message.direction,
             message.providerAccountRef,
@@ -68101,7 +68829,7 @@ function createPostgresPersonalAssistantRepositoryStore(options = {}) {
             RETURNING id
           `, [
             ownerUserId2.toString(),
-            randomUUID53(),
+            randomUUID54(),
             schedule.scheduleRef,
             schedule.sourceSystem,
             schedule.sourceRef,
@@ -68129,7 +68857,7 @@ function createPostgresPersonalAssistantRepositoryStore(options = {}) {
               ON CONFLICT (owner_user_id, public_id) DO NOTHING
             `, [
               ownerUserId2.toString(),
-              randomUUID53(),
+              randomUUID54(),
               grant.grantRef,
               insertedSchedule.rows[0].id,
               grant.revision,
@@ -68155,7 +68883,7 @@ function createPostgresPersonalAssistantRepositoryStore(options = {}) {
             ON CONFLICT (owner_user_id, public_id) DO NOTHING
           `, [
             ownerUserId2.toString(),
-            randomUUID53(),
+            randomUUID54(),
             run.occurrenceRef,
             run.sourceRef,
             run.occurrenceKey,
@@ -68214,7 +68942,7 @@ function createPostgresPersonalAssistantRepositoryStore(options = {}) {
           INSERT INTO assistant.audit_events (
             owner_user_id,id,public_id,actor_kind,event_type,correlation_id,evidence_digest,details,occurred_at
           ) VALUES ($1,$2,$3,'operator','legacy_import_applied',$3,$4,$5::jsonb,$6)
-        `, [ownerUserId2.toString(), randomUUID53(), input.importRef, applied.classificationDigest, JSON.stringify({ receipt: applied }), appliedAt]);
+        `, [ownerUserId2.toString(), randomUUID54(), input.importRef, applied.classificationDigest, JSON.stringify({ receipt: applied }), appliedAt]);
         return applied;
       });
     }
@@ -68282,7 +69010,7 @@ async function appendPostgresReceipt(transaction2, ownerUserId2, receipt4, recei
       ) VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12::jsonb,$13,$14,$15)
     `, [
       ownerUserId2.toString(),
-      randomUUID53(),
+      randomUUID54(),
       receipt4.receiptRef,
       relation.rows[0].command_id,
       relation.rows[0].execution_id,
@@ -68315,7 +69043,7 @@ async function insertPostgresConsentEvidence(queryable, ownerUserId2, evidence)
     RETURNING public_id
   `, [
     ownerUserId2.toString(),
-    randomUUID53(),
+    randomUUID54(),
     evidence.consentRef,
     evidence.recipientHash,
     evidence.subjectKey,
@@ -68356,7 +69084,7 @@ async function insertPostgresSuppressionEvent(queryable, ownerUserId2, event2) {
     ON CONFLICT (owner_user_id, public_id) DO NOTHING RETURNING public_id
   `, [
     ownerUserId2.toString(),
-    randomUUID53(),
+    randomUUID54(),
     event2.suppressionRef,
     event2.subjectKey,
     event2.transition,
@@ -68634,10 +69362,10 @@ var AssistantWorkerStoreError = class extends Error {
 };
 function hash(value) {
   const canonical3 = JSON.stringify(value, (_key, entry) => entry && typeof entry === "object" && !Array.isArray(entry) ? Object.fromEntries(Object.entries(entry).sort(([a], [b]) => a.localeCompare(b))) : entry);
-  return createHash69("sha256").update(canonical3).digest("hex");
+  return createHash70("sha256").update(canonical3).digest("hex");
 }
 function ref2(prefix, identity) {
-  return `${prefix}_${createHash69("sha256").update(identity).digest("hex").slice(0, 32)}`;
+  return `${prefix}_${createHash70("sha256").update(identity).digest("hex").slice(0, 32)}`;
 }
 function requiredString(input, key3) {
   const value = input[key3];
@@ -68688,7 +69416,7 @@ var PostgresAssistantWorkerIdentityRegistry = class {
       RETURNING owner_user_id::text,owner_ref,subject_ref,public_id AS worker_ref,device_key_id,key_ref,
         device_public_key,state,expires_at`, [
       input.ownerUserId.toString(),
-      randomUUID54(),
+      randomUUID55(),
       input.workerRef,
       input.ownerRef,
       input.subjectRef,
@@ -68741,7 +69469,7 @@ var PostgresAssistantWorkerNonceLedger = class {
       INSERT INTO assistant.worker_nonces(owner_user_id,id,namespace,nonce_key,expires_at,consumed_at)
       SELECT owner_user_id,$1,$2,$3,$4,$5 FROM unique_candidate
       ON CONFLICT (owner_user_id,namespace,nonce_key) DO NOTHING RETURNING id`,
-      [randomUUID54(), input.namespace, input.key, input.expiresAt, now.toISOString(), workerRef]
+      [randomUUID55(), input.namespace, input.key, input.expiresAt, now.toISOString(), workerRef]
     );
     return (result3.rowCount ?? result3.rows.length) === 1;
   }
@@ -69036,7 +69764,7 @@ var INTERNAL_CAPABILITIES = /* @__PURE__ */ new Set([
   "assistant.worker_registration.revoke"
 ]);
 function actorRef(issuer, subject) {
-  return `admin_actor_${createHash70("sha256").update(`${issuer}\0${subject}`).digest("base64url").slice(0, 32)}`;
+  return `admin_actor_${createHash71("sha256").update(`${issuer}\0${subject}`).digest("base64url").slice(0, 32)}`;
 }
 var VerifiedPersonalAssistantAdminIdentityPort = class {
   constructor(verifier, configuration) {
@@ -69150,7 +69878,7 @@ function createPersonalAssistantAdminProductionDependencies(input) {
 }
 
 // src/api/personal-assistant-dispatcher.ts
-import { createHash as createHash71, randomBytes as randomBytes8, randomUUID as randomUUID55 } from "crypto";
+import { createHash as createHash72, randomBytes as randomBytes8, randomUUID as randomUUID56 } from "crypto";
 var AssistantLeaseFenceError = class extends Error {
   code = "assistant_lease_fence_rejected";
   constructor() {
@@ -69164,7 +69892,7 @@ function canonical2(value) {
   return Object.fromEntries(Object.entries(value).sort(([a], [b]) => a.localeCompare(b)).map(([key3, entry]) => [key3, canonical2(entry)]));
 }
 function digest8(value) {
-  return createHash71("sha256").update(JSON.stringify(canonical2(value))).digest("hex");
+  return createHash72("sha256").update(JSON.stringify(canonical2(value))).digest("hex");
 }
 function ref3(prefix, identity) {
   return `${prefix}_${digest8(identity).slice(0, 32)}`;
@@ -69382,7 +70110,7 @@ function createPostgresPersonalAssistantDispatchStore(options = {}) {
         const cycleRef = deterministic ? null : ref3("cycle", commandRef);
         const executionRef = deterministic ? null : ref3("execution", commandRef);
         const occurrenceRef = input.occurrenceKey ? ref3("occurrence", `${ownerId3}\0${input.scheduleRef}\0${input.occurrenceKey}`) : null;
-        const commandId = randomUUID55();
+        const commandId = randomUUID56();
         const commandPayload = {
           schemaVersion: "assistant-command.v1",
           commandRef,
@@ -69427,8 +70155,8 @@ function createPostgresPersonalAssistantDispatchStore(options = {}) {
         let cycleId = null;
         let executionId = null;
         if (!deterministic && cycleRef && executionRef) {
-          cycleId = randomUUID55();
-          executionId = randomUUID55();
+          cycleId = randomUUID56();
+          executionId = randomUUID56();
           await client2.query(
             `INSERT INTO assistant.wake_cycles
             (owner_user_id,id,public_id,assistant_id,command_id,context_version_id,state,opened_at,updated_at)
@@ -69450,7 +70178,7 @@ function createPostgresPersonalAssistantDispatchStore(options = {}) {
             ON CONFLICT (owner_user_id,schedule_ref,occurrence_key) DO UPDATE SET public_id=assistant.reminder_occurrences.public_id
             RETURNING public_id`, [
             ownerId3,
-            randomUUID55(),
+            randomUUID56(),
             occurrenceRef,
             input.occurrenceKey,
             input.scheduledFor,
@@ -69479,7 +70207,7 @@ function createPostgresPersonalAssistantDispatchStore(options = {}) {
           VALUES ($1,$2,$3,$4,$5,'assistant.execution.status','response',$6,$7,$8,$9,$10::jsonb,$11,$12)`,
           [
             ownerId3,
-            randomUUID55(),
+            randomUUID56(),
             receiptRef,
             commandId,
             executionId,
@@ -69540,7 +70268,7 @@ function createPostgresPersonalAssistantDispatchStore(options = {}) {
           (owner_user_id,id,public_id,worker_id,execution_id,lease_token_hash,state,claimed_at,heartbeat_at,expires_at)
           SELECT $1,$2,$3,$4,execution.id,$5,'active',$6,$6,$7 FROM assistant.executions execution
           WHERE execution.owner_user_id=$1 AND execution.public_id=$8`,
-          [ownerId3, randomUUID55(), leaseRef, worker.rows[0].id, tokenHash3(token7), at, expiresAt, row.execution_ref]
+          [ownerId3, randomUUID56(), leaseRef, worker.rows[0].id, tokenHash3(token7), at, expiresAt, row.execution_ref]
         );
         await client2.query(
           `UPDATE assistant.executions SET state='claimed',claimed_by_worker_id=$3,claim_token_hash=$4,
@@ -69580,7 +70308,7 @@ function createPostgresPersonalAssistantDispatchStore(options = {}) {
           SELECT $1,$2,worker.id,lease.id,$3,$4,$5::jsonb,$6 FROM assistant.worker_registrations worker
           JOIN assistant.worker_leases lease ON lease.owner_user_id=worker.owner_user_id AND lease.worker_id=worker.id
           WHERE worker.owner_user_id=$1 AND worker.public_id=$7 AND lease.public_id=$8 AND lease.state='active'`,
-          [ownerId3, randomUUID55(), input.sequence, input.runtimeVersion, JSON.stringify(input.health), occurredAt, input.workerRef, input.leaseRef]
+          [ownerId3, randomUUID56(), input.sequence, input.runtimeVersion, JSON.stringify(input.health), occurredAt, input.workerRef, input.leaseRef]
         );
         await client2.query(`UPDATE assistant.worker_leases SET heartbeat_at=$3,expires_at=$4
           WHERE owner_user_id=$1 AND public_id=$2 AND state='active'`, [ownerId3, input.leaseRef, occurredAt, expiresAt]);
@@ -69822,7 +70550,7 @@ function createPostgresAssistantReminderRuntimeStore(options = {}) {
        payload_digest,payload,parsed_intent,parsed_intent_digest,source,state,accepted_at,updated_at,terminal_at)
       SELECT $1,$2,$3,assistant.id,NULL,$4,'assistant-reminder-command.v1',$5,$6,$7::jsonb,NULL,NULL,'system','succeeded',$8,$8,$8
       FROM assistant.assistants assistant WHERE assistant.owner_user_id=$1 AND assistant.public_id=$9
-      RETURNING id`, [ownerId3, randomUUID55(), commandRef, command.kind, command.idempotencyKey, digest8(command), JSON.stringify(payload), at, assistantRef2]);
+      RETURNING id`, [ownerId3, randomUUID56(), commandRef, command.kind, command.idempotencyKey, digest8(command), JSON.stringify(payload), at, assistantRef2]);
     if (!inserted.rows[0]) throw new Error("assistant_reminder_assistant_not_found");
     return inserted.rows[0].id;
   };
@@ -69872,7 +70600,7 @@ function createPostgresAssistantReminderRuntimeStore(options = {}) {
             FROM assistant.assistants assistant WHERE assistant.owner_user_id=$1 AND assistant.public_id=$12`,
             [
               ownerId3,
-              randomUUID55(),
+              randomUUID56(),
               publicRef,
               commandRef,
               definition2.instruction,
@@ -69948,7 +70676,7 @@ function createPostgresAssistantReminderRuntimeStore(options = {}) {
               ON CONFLICT (owner_user_id,schedule_ref,occurrence_key) DO NOTHING RETURNING public_id`,
               [
                 definition.ownerId,
-                randomUUID55(),
+                randomUUID56(),
                 occurrence.occurrenceRef,
                 definition.assistantRef,
                 definition.reminderRef,
@@ -70028,10 +70756,10 @@ function createPersonalAssistantReminderRuntime(options) {
 }
 
 // src/api/personal-assistant-reconcile-cron.ts
-import { createHash as createHash73, timingSafeEqual as timingSafeEqual8 } from "crypto";
+import { createHash as createHash74, timingSafeEqual as timingSafeEqual8 } from "crypto";
 
 // src/api/personal-assistant-reconcile.ts
-import { createHash as createHash72 } from "crypto";
+import { createHash as createHash73 } from "crypto";
 var PERSONAL_ASSISTANT_RECONCILIATION_LIMITS = Object.freeze({
   defaultBatchSize: 20,
   maxBatchSize: 50,
@@ -70053,7 +70781,7 @@ var PUBLIC_REF = /^[a-z][a-z0-9_]*_[A-Za-z0-9_-]{3,128}$/u;
 var DIGEST2 = /^[a-f0-9]{64}$/u;
 var PROVIDER_REF = /^[A-Za-z0-9:_-]{3,200}$/u;
 function hash2(value) {
-  return createHash72("sha256").update(value).digest("hex");
+  return createHash73("sha256").update(value).digest("hex");
 }
 function validateCandidate(candidate) {
   if (!/^[1-9]\d*$/u.test(candidate.ownerUserId) || !PUBLIC_REF.test(candidate.candidateRef) || !/^trace_[A-Za-z0-9_-]{8,128}$/u.test(candidate.traceRef) || !PUBLIC_REF.test(candidate.claimToken) || !PROVIDER_REF.test(candidate.providerAccountRef) || !PROVIDER_REF.test(candidate.providerLocatorRef) || !DIGEST2.test(candidate.expectedDigest) || !Number.isFinite(Date.parse(candidate.stuckSince))) {
@@ -70175,8 +70903,8 @@ async function reconcilePersonalAssistantTransports(dependencies, options = {})
 // src/api/personal-assistant-reconcile-cron.ts
 function authorized(actual, expectedSecret) {
   if (!actual?.startsWith("Bearer ")) return false;
-  const actualDigest = createHash73("sha256").update(actual).digest();
-  const expectedDigest = createHash73("sha256").update(`Bearer ${expectedSecret}`).digest();
+  const actualDigest = createHash74("sha256").update(actual).digest();
+  const expectedDigest = createHash74("sha256").update(`Bearer ${expectedSecret}`).digest();
   return timingSafeEqual8(actualDigest, expectedDigest);
 }
 function createPersonalAssistantReconcileCronHandler(options) {
@@ -70238,7 +70966,7 @@ function createPersonalAssistantReminderCronHandler(options) {
 }
 
 // src/api/twilio-inbound-admission.ts
-import { createHash as createHash74, randomBytes as randomBytes9 } from "crypto";
+import { createHash as createHash75, randomBytes as randomBytes9 } from "crypto";
 var ACCOUNT_SID = /^AC[0-9a-f]{32}$/iu;
 var MESSAGE_SID = /^(?:SM|MM)[0-9a-f]{32}$/iu;
 var MESSAGING_SERVICE_SID = /^MG[0-9a-f]{32}$/iu;
@@ -70260,10 +70988,10 @@ function canonicalJson8(value) {
   });
 }
 function digest9(value) {
-  return createHash74("sha256").update(canonicalJson8(value)).digest("hex");
+  return createHash75("sha256").update(canonicalJson8(value)).digest("hex");
 }
 function stableRef(prefix, value) {
-  return `${prefix}_${createHash74("sha256").update(value).digest("hex").slice(0, 32)}`;
+  return `${prefix}_${createHash75("sha256").update(value).digest("hex").slice(0, 32)}`;
 }
 function normalizeOptionalSid(value) {
   const normalized = value?.trim() || null;
@@ -70409,8 +71137,8 @@ function createTwilioInboundIngressCronHandler(options) {
   return async (request) => {
     if (request.method !== "GET") return Response.json({ error: "method_not_allowed" }, { status: 405, headers: { Allow: "GET" } });
     const actual = request.headers.get("authorization") ?? "";
-    const actualDigest = createHash74("sha256").update(actual).digest();
-    const expectedDigest = createHash74("sha256").update(expectedAuthorization).digest();
+    const actualDigest = createHash75("sha256").update(actual).digest();
+    const expectedDigest = createHash75("sha256").update(expectedAuthorization).digest();
     if (actualDigest.length !== expectedDigest.length || !actualDigest.equals(expectedDigest)) {
       return Response.json({ error: "unauthorized" }, { status: 401 });
     }
@@ -70452,7 +71180,7 @@ function createPersonalAssistantWorkerAndCronProduction(options) {
 }
 
 // src/api/personal-assistant-control-plane-store.ts
-import { createHash as createHash75, randomUUID as randomUUID56 } from "crypto";
+import { createHash as createHash76, randomUUID as randomUUID57 } from "crypto";
 var REF = /^[a-z][A-Za-z0-9_-]{2,159}$/;
 var DIGEST4 = /^[a-f0-9]{64}$/;
 function record3(input) {
@@ -70475,7 +71203,7 @@ function ref4(value) {
   return value;
 }
 function newRef2(prefix) {
-  return `${prefix}_${randomUUID56().replaceAll("-", "")}`;
+  return `${prefix}_${randomUUID57().replaceAll("-", "")}`;
 }
 function canonicalJson9(value) {
   return JSON.stringify(value, (_key, entry) => {
@@ -70484,7 +71212,7 @@ function canonicalJson9(value) {
   });
 }
 function digest10(value) {
-  return createHash75("sha256").update(canonicalJson9(value)).digest("hex");
+  return createHash76("sha256").update(canonicalJson9(value)).digest("hex");
 }
 function normalizeE164(value) {
   const trimmed = value.trim();
@@ -70531,7 +71259,7 @@ async function audit(client2, owner5, operation, resourceRef, occurredAt) {
     `INSERT INTO assistant.audit_events (
     owner_user_id,id,public_id,actor_kind,event_type,operation,correlation_id,details,occurred_at
   ) VALUES ($1,$2,$3,'user','assistant.control_plane.mutation',$4,$5,$6::jsonb,$7::timestamptz)`,
-    [owner5, randomUUID56(), newRef2("audit"), operation, resourceRef, JSON.stringify({ resourceRef }), occurredAt]
+    [owner5, randomUUID57(), newRef2("audit"), operation, resourceRef, JSON.stringify({ resourceRef }), occurredAt]
   );
 }
 var ASSISTANT_PROJECTION = `jsonb_build_object('assistantRef', assistant.public_id, 'state', assistant.status,
@@ -70612,7 +71340,7 @@ function createPostgresPersonalAssistantControlPlaneStore(options) {
             'assistantRef',public_id,'state',status,'displayName',name,'revision',revision,'createdAt',created_at,'updatedAt',updated_at) AS projection`,
           [
             ownerUserId2.toString(),
-            randomUUID56(),
+            randomUUID57(),
             assistantRef2,
             text2(body3, "displayName", text2(body3, "name", "Personal Assistant")),
             optionalText3(body3, "timezone") ?? "UTC",
@@ -70666,7 +71394,7 @@ function createPostgresPersonalAssistantControlPlaneStore(options) {
         (owner_user_id,id,public_id,assistant_id,channel,address_ciphertext,address_hash,state,revision,created_at,updated_at)
         SELECT $1,$2,$3,assistant.id,$4,$5,$6,'active',1,$7,$7 FROM assistant.assistants assistant WHERE assistant.owner_user_id=$1 AND assistant.public_id=$8 AND assistant.deleted_at IS NULL
         RETURNING jsonb_build_object('bindingRef',public_id,'assistantRef',$8::text,'channelEndpointRef',public_id,'channel',channel,'state',state,'revision',revision) AS projection`,
-          [ownerUserId2.toString(), randomUUID56(), bindingRef, channel, protectedAddress?.ciphertext ?? null, protectedAddress?.digest ?? null, at, ref4(assistantRef2)]
+          [ownerUserId2.toString(), randomUUID57(), bindingRef, channel, protectedAddress?.ciphertext ?? null, protectedAddress?.digest ?? null, at, ref4(assistantRef2)]
         );
         if (!result3.rows[0]) throw new Error("assistant_not_found");
         await audit(client2, ownerUserId2.toString(), "assistant.channel.bind", bindingRef, at);
@@ -70723,11 +71451,11 @@ function createPostgresPersonalAssistantControlPlaneStore(options) {
         const inserted = await client2.query(`INSERT INTO assistant.contacts(owner_user_id,id,public_id,display_name,relationship,phone_ciphertext,phone_hash,timezone,attributes,created_at,updated_at)
       VALUES($1,$2,$3,$4,$5,$6,$7,$8,'{}'::jsonb,$9,$9)
       ON CONFLICT(owner_user_id,phone_hash) WHERE phone_hash IS NOT NULL DO UPDATE SET updated_at=assistant.contacts.updated_at
-      RETURNING id,public_id`, [ownerUserId2.toString(), randomUUID56(), contactRef, optionalText3(body3, "displayName"), relationship, protectedAddress.ciphertext, protectedAddress.digest, optionalText3(body3, "timezone"), at]);
+      RETURNING id,public_id`, [ownerUserId2.toString(), randomUUID57(), contactRef, optionalText3(body3, "displayName"), relationship, protectedAddress.ciphertext, protectedAddress.digest, optionalText3(body3, "timezone"), at]);
         const row = inserted.rows[0];
         if (!row) throw new Error("contact_create_failed");
         await client2.query(`INSERT INTO assistant.contact_delivery_endpoints(owner_user_id,id,public_id,endpoint_key,revision,contact_id,channel,address_ciphertext,address_hash,masked_display,state,created_at)
-      SELECT $1,$2,$3,$4,1,$5,'sms',$6,$7,$8,'unverified',$9 WHERE NOT EXISTS(SELECT 1 FROM (SELECT DISTINCT ON(endpoint_key) endpoint_key,contact_id,address_hash,state FROM assistant.contact_delivery_endpoints WHERE owner_user_id=$1 ORDER BY endpoint_key,revision DESC) effective WHERE effective.contact_id=$5 AND effective.address_hash=$7 AND effective.state<>'removed')`, [ownerUserId2.toString(), randomUUID56(), endpointRef, randomUUID56(), row.id, protectedAddress.ciphertext, protectedAddress.digest, maskedPhone(phone), at]);
+      SELECT $1,$2,$3,$4,1,$5,'sms',$6,$7,$8,'unverified',$9 WHERE NOT EXISTS(SELECT 1 FROM (SELECT DISTINCT ON(endpoint_key) endpoint_key,contact_id,address_hash,state FROM assistant.contact_delivery_endpoints WHERE owner_user_id=$1 ORDER BY endpoint_key,revision DESC) effective WHERE effective.contact_id=$5 AND effective.address_hash=$7 AND effective.state<>'removed')`, [ownerUserId2.toString(), randomUUID57(), endpointRef, randomUUID57(), row.id, protectedAddress.ciphertext, protectedAddress.digest, maskedPhone(phone), at]);
         await audit(client2, ownerUserId2.toString(), "assistant.contact.create", row.public_id, at);
         const projected = await client2.query(`SELECT ${CONTACT_PROJECTION} AS projection FROM assistant.contacts contact WHERE contact.owner_user_id=$1 AND contact.public_id=$2`, [ownerUserId2.toString(), row.public_id]);
         return projected.rows[0].projection;
@@ -70752,7 +71480,7 @@ function createPostgresPersonalAssistantControlPlaneStore(options) {
       if (!DIGEST4.test(protectedAddress.digest)) throw new TypeError("protected address digest is invalid");
       return tx(async (client2) => {
         const result3 = await client2.query(`INSERT INTO assistant.contact_delivery_endpoints(owner_user_id,id,public_id,endpoint_key,revision,contact_id,channel,address_ciphertext,address_hash,masked_display,state,created_at)
-      SELECT $1,$2,$3,$4,1,contact.id,$5,$6,$7,$8,'unverified',$9 FROM assistant.contacts contact WHERE contact.owner_user_id=$1 AND contact.public_id=$10 AND contact.deleted_at IS NULL AND NOT EXISTS(SELECT 1 FROM (SELECT DISTINCT ON(endpoint_key) endpoint_key,address_hash,state FROM assistant.contact_delivery_endpoints WHERE owner_user_id=$1 ORDER BY endpoint_key,revision DESC) effective WHERE effective.address_hash=$7 AND effective.state<>'removed')`, [ownerUserId2.toString(), randomUUID56(), endpointRef, randomUUID56(), channel, protectedAddress.ciphertext, protectedAddress.digest, maskedPhone(phone), at, ref4(contactRef)]);
+      SELECT $1,$2,$3,$4,1,contact.id,$5,$6,$7,$8,'unverified',$9 FROM assistant.contacts contact WHERE contact.owner_user_id=$1 AND contact.public_id=$10 AND contact.deleted_at IS NULL AND NOT EXISTS(SELECT 1 FROM (SELECT DISTINCT ON(endpoint_key) endpoint_key,address_hash,state FROM assistant.contact_delivery_endpoints WHERE owner_user_id=$1 ORDER BY endpoint_key,revision DESC) effective WHERE effective.address_hash=$7 AND effective.state<>'removed')`, [ownerUserId2.toString(), randomUUID57(), endpointRef, randomUUID57(), channel, protectedAddress.ciphertext, protectedAddress.digest, maskedPhone(phone), at, ref4(contactRef)]);
         if (!result3.rowCount) return null;
         await client2.query(`UPDATE assistant.contacts SET phone_ciphertext=COALESCE(phone_ciphertext,$3),phone_hash=COALESCE(phone_hash,$4),updated_at=$5 WHERE owner_user_id=$1 AND public_id=$2`, [ownerUserId2.toString(), contactRef, protectedAddress.ciphertext, protectedAddress.digest, at]);
         await audit(client2, ownerUserId2.toString(), "assistant.contact.delivery_endpoint.add", endpointRef, at);
@@ -70765,7 +71493,7 @@ function createPostgresPersonalAssistantControlPlaneStore(options) {
       if (!DIGEST4.test(protectedAddress.digest)) throw new TypeError("protected address digest is invalid");
       return tx(async (client2) => {
         const result3 = await client2.query(`INSERT INTO assistant.contact_delivery_endpoints(owner_user_id,id,public_id,endpoint_key,revision,contact_id,channel,address_ciphertext,address_hash,masked_display,state,created_at)
-      SELECT prior.owner_user_id,$4,$5,prior.endpoint_key,prior.revision+1,prior.contact_id,prior.channel,$6,$7,$8,'unverified',$9 FROM assistant.contact_delivery_endpoints prior JOIN assistant.contacts contact ON contact.owner_user_id=prior.owner_user_id AND contact.id=prior.contact_id WHERE prior.owner_user_id=$1 AND contact.public_id=$2 AND prior.public_id=$3 AND prior.state<>'removed' AND NOT EXISTS(SELECT 1 FROM (SELECT DISTINCT ON(endpoint_key) endpoint_key,address_hash,state FROM assistant.contact_delivery_endpoints WHERE owner_user_id=$1 ORDER BY endpoint_key,revision DESC) effective WHERE effective.address_hash=$7 AND effective.state<>'removed' AND effective.endpoint_key<>prior.endpoint_key)`, [ownerUserId2.toString(), ref4(contactRef), ref4(deliveryEndpointRef), randomUUID56(), nextRef, protectedAddress.ciphertext, protectedAddress.digest, maskedPhone(phone), at]);
+      SELECT prior.owner_user_id,$4,$5,prior.endpoint_key,prior.revision+1,prior.contact_id,prior.channel,$6,$7,$8,'unverified',$9 FROM assistant.contact_delivery_endpoints prior JOIN assistant.contacts contact ON contact.owner_user_id=prior.owner_user_id AND contact.id=prior.contact_id WHERE prior.owner_user_id=$1 AND contact.public_id=$2 AND prior.public_id=$3 AND prior.state<>'removed' AND NOT EXISTS(SELECT 1 FROM (SELECT DISTINCT ON(endpoint_key) endpoint_key,address_hash,state FROM assistant.contact_delivery_endpoints WHERE owner_user_id=$1 ORDER BY endpoint_key,revision DESC) effective WHERE effective.address_hash=$7 AND effective.state<>'removed' AND effective.endpoint_key<>prior.endpoint_key)`, [ownerUserId2.toString(), ref4(contactRef), ref4(deliveryEndpointRef), randomUUID57(), nextRef, protectedAddress.ciphertext, protectedAddress.digest, maskedPhone(phone), at]);
         if (!result3.rowCount) return null;
         await client2.query(`UPDATE assistant.contacts SET phone_ciphertext=$3,phone_hash=$4,updated_at=$5 WHERE owner_user_id=$1 AND public_id=$2`, [ownerUserId2.toString(), contactRef, protectedAddress.ciphertext, protectedAddress.digest, at]);
         await audit(client2, ownerUserId2.toString(), "assistant.contact.delivery_endpoint.update", nextRef, at);
@@ -70777,7 +71505,7 @@ function createPostgresPersonalAssistantControlPlaneStore(options) {
       const body3 = record3(input), at = now().toISOString(), nextRef = newRef2("delivery");
       return tx(async (client2) => {
         const result3 = await client2.query(`INSERT INTO assistant.contact_delivery_endpoints(owner_user_id,id,public_id,endpoint_key,revision,contact_id,channel,address_ciphertext,address_hash,masked_display,state,reason_code,created_at)
-      SELECT prior.owner_user_id,$4,$5,prior.endpoint_key,prior.revision+1,prior.contact_id,prior.channel,prior.address_ciphertext,prior.address_hash,prior.masked_display,'removed',$6,$7 FROM assistant.contact_delivery_endpoints prior JOIN assistant.contacts contact ON contact.owner_user_id=prior.owner_user_id AND contact.id=prior.contact_id WHERE prior.owner_user_id=$1 AND contact.public_id=$2 AND prior.public_id=$3 AND prior.state<>'removed'`, [ownerUserId2.toString(), ref4(contactRef), ref4(deliveryEndpointRef), randomUUID56(), nextRef, optionalText3(body3, "reasonCode") ?? "owner_removed", at]);
+      SELECT prior.owner_user_id,$4,$5,prior.endpoint_key,prior.revision+1,prior.contact_id,prior.channel,prior.address_ciphertext,prior.address_hash,prior.masked_display,'removed',$6,$7 FROM assistant.contact_delivery_endpoints prior JOIN assistant.contacts contact ON contact.owner_user_id=prior.owner_user_id AND contact.id=prior.contact_id WHERE prior.owner_user_id=$1 AND contact.public_id=$2 AND prior.public_id=$3 AND prior.state<>'removed'`, [ownerUserId2.toString(), ref4(contactRef), ref4(deliveryEndpointRef), randomUUID57(), nextRef, optionalText3(body3, "reasonCode") ?? "owner_removed", at]);
         if (!result3.rowCount) return null;
         await client2.query(`WITH effective AS(SELECT DISTINCT ON(endpoint_key) endpoint_key,contact_id,address_ciphertext,address_hash,state,revision FROM assistant.contact_delivery_endpoints WHERE owner_user_id=$1 ORDER BY endpoint_key,revision DESC),replacement AS(SELECT DISTINCT ON(contact_id) contact_id,address_ciphertext,address_hash FROM effective WHERE state<>'removed' ORDER BY contact_id,revision DESC) UPDATE assistant.contacts contact SET phone_ciphertext=replacement.address_ciphertext,phone_hash=replacement.address_hash,updated_at=$3 FROM replacement WHERE contact.owner_user_id=$1 AND contact.public_id=$2 AND replacement.contact_id=contact.id`, [ownerUserId2.toString(), contactRef, at]);
         await client2.query(`UPDATE assistant.contacts SET phone_ciphertext=NULL,phone_hash=NULL,updated_at=$3 WHERE owner_user_id=$1 AND public_id=$2 AND NOT EXISTS(SELECT 1 FROM (SELECT DISTINCT ON(endpoint_key) endpoint_key,contact_id,state FROM assistant.contact_delivery_endpoints WHERE owner_user_id=$1 ORDER BY endpoint_key,revision DESC) effective WHERE effective.contact_id=assistant.contacts.id AND effective.state<>'removed')`, [ownerUserId2.toString(), contactRef, at]);
@@ -70801,7 +71529,7 @@ function createPostgresPersonalAssistantControlPlaneStore(options) {
       const body3 = record3(input), contactRef = ref4(text2(body3, "contactRef")), consentRef = ref4(text2(body3, "consentRef")), at = now().toISOString();
       return tx(async (client2) => {
         const result3 = await client2.query(`INSERT INTO assistant.consent_evidence(owner_user_id,id,public_id,contact_id,sender_endpoint_id,recipient_hash,subject_key,message_class,transition,source,proof_digest,captured_at,withdrawn_at)
-      SELECT prior.owner_user_id,$3,$4,prior.contact_id,prior.sender_endpoint_id,prior.recipient_hash,prior.subject_key,prior.message_class,'withdrawn','internal_dnc',$5,$6,$6 FROM assistant.consent_evidence prior JOIN assistant.contacts contact ON contact.owner_user_id=prior.owner_user_id AND contact.id=prior.contact_id JOIN assistant.channel_endpoints endpoint ON endpoint.owner_user_id=prior.owner_user_id AND endpoint.id=prior.sender_endpoint_id WHERE prior.owner_user_id=$1 AND prior.public_id=$2 AND contact.public_id=$7 RETURNING public_id,(SELECT public_id FROM assistant.channel_endpoints WHERE owner_user_id=$1 AND id=sender_endpoint_id) sender_ref,subject_key,message_class,proof_digest`, [ownerUserId2.toString(), consentRef, randomUUID56(), newRef2("consent"), digest10({ consentRef, at }), at, contactRef]);
+      SELECT prior.owner_user_id,$3,$4,prior.contact_id,prior.sender_endpoint_id,prior.recipient_hash,prior.subject_key,prior.message_class,'withdrawn','internal_dnc',$5,$6,$6 FROM assistant.consent_evidence prior JOIN assistant.contacts contact ON contact.owner_user_id=prior.owner_user_id AND contact.id=prior.contact_id JOIN assistant.channel_endpoints endpoint ON endpoint.owner_user_id=prior.owner_user_id AND endpoint.id=prior.sender_endpoint_id WHERE prior.owner_user_id=$1 AND prior.public_id=$2 AND contact.public_id=$7 RETURNING public_id,(SELECT public_id FROM assistant.channel_endpoints WHERE owner_user_id=$1 AND id=sender_endpoint_id) sender_ref,subject_key,message_class,proof_digest`, [ownerUserId2.toString(), consentRef, randomUUID57(), newRef2("consent"), digest10({ consentRef, at }), at, contactRef]);
         if (!result3.rows[0]) throw new Error("consent_not_found");
         await audit(client2, ownerUserId2.toString(), "assistant.consent.withdraw", consentRef, at);
         const row = result3.rows[0];
@@ -70811,7 +71539,7 @@ function createPostgresPersonalAssistantControlPlaneStore(options) {
     async createSchedule(ownerUserId2, assistantRef2, input) {
       const body3 = record3(input), scheduleRef = newRef2("schedule"), at = now().toISOString();
       return tx(async (client2) => {
-        const result3 = await client2.query(`INSERT INTO assistant.schedules(owner_user_id,id,public_id,assistant_id,source_system,source_ref,source_owner_ref,description,cadence,time_of_day,timezone,logical_vault,status,next_due_at,execution_mode,artifact_selection,source_payload_digest,revision,created_at,updated_at) SELECT $1,$2,$3,assistant.id,$4,$5,$6,$7,$8,$9,$10,$11,'active',$12,$13,$14::jsonb,$15,1,$16,$16 FROM assistant.assistants assistant WHERE assistant.owner_user_id=$1 AND assistant.public_id=$17 RETURNING jsonb_build_object('scheduleRef',public_id,'assistantRef',$17::text,'state',status,'timezone',timezone,'nextDueAt',next_due_at,'revision',revision) AS projection`, [ownerUserId2.toString(), randomUUID56(), scheduleRef, optionalText3(body3, "sourceSystem") ?? "assistant", optionalText3(body3, "sourceRef") ?? scheduleRef, optionalText3(body3, "sourceOwnerRef") ?? ownerUserId2.toString(), text2(body3, "description"), text2(body3, "cadence"), optionalText3(body3, "timeOfDay"), optionalText3(body3, "timezone") ?? "UTC", optionalText3(body3, "logicalVault") ?? "Personal Assistant", text2(body3, "nextDueAt"), optionalText3(body3, "executionMode") ?? "agent", JSON.stringify(body3.artifactSelection ?? { mode: "none" }), digest10(body3), at, ref4(assistantRef2)]);
+        const result3 = await client2.query(`INSERT INTO assistant.schedules(owner_user_id,id,public_id,assistant_id,source_system,source_ref,source_owner_ref,description,cadence,time_of_day,timezone,logical_vault,status,next_due_at,execution_mode,artifact_selection,source_payload_digest,revision,created_at,updated_at) SELECT $1,$2,$3,assistant.id,$4,$5,$6,$7,$8,$9,$10,$11,'active',$12,$13,$14::jsonb,$15,1,$16,$16 FROM assistant.assistants assistant WHERE assistant.owner_user_id=$1 AND assistant.public_id=$17 RETURNING jsonb_build_object('scheduleRef',public_id,'assistantRef',$17::text,'state',status,'timezone',timezone,'nextDueAt',next_due_at,'revision',revision) AS projection`, [ownerUserId2.toString(), randomUUID57(), scheduleRef, optionalText3(body3, "sourceSystem") ?? "assistant", optionalText3(body3, "sourceRef") ?? scheduleRef, optionalText3(body3, "sourceOwnerRef") ?? ownerUserId2.toString(), text2(body3, "description"), text2(body3, "cadence"), optionalText3(body3, "timeOfDay"), optionalText3(body3, "timezone") ?? "UTC", optionalText3(body3, "logicalVault") ?? "Personal Assistant", text2(body3, "nextDueAt"), optionalText3(body3, "executionMode") ?? "agent", JSON.stringify(body3.artifactSelection ?? { mode: "none" }), digest10(body3), at, ref4(assistantRef2)]);
         if (!result3.rows[0]) throw new Error("assistant_not_found");
         await audit(client2, ownerUserId2.toString(), "assistant.schedule.create", scheduleRef, at);
         return result3.rows[0].projection;
@@ -70834,7 +71562,7 @@ function createPostgresPersonalAssistantControlPlaneStore(options) {
     async createReminder(ownerUserId2, assistantRef2, input) {
       const body3 = record3(input), reminderRef2 = newRef2("reminder"), at = now().toISOString(), scheduledFor = text2(body3, "scheduledFor");
       return tx(async (client2) => {
-        const result3 = await client2.query(`INSERT INTO assistant.reminder_occurrences(owner_user_id,id,public_id,assistant_id,schedule_id,schedule_ref,occurrence_key,instruction,scheduled_for,timezone,state,revision,created_at,updated_at) SELECT $1,$2,$3,assistant.id,schedule.id,COALESCE(schedule.public_id,$3),$4,$5,$6,$7,'materialized',1,$8,$8 FROM assistant.assistants assistant LEFT JOIN assistant.schedules schedule ON schedule.owner_user_id=assistant.owner_user_id AND schedule.public_id=$9 WHERE assistant.owner_user_id=$1 AND assistant.public_id=$10 RETURNING jsonb_build_object('reminderRef',public_id,'assistantRef',$10::text,'scheduleRef',CASE WHEN schedule_id IS NULL THEN NULL ELSE schedule_ref END,'state','scheduled','instruction',instruction,'scheduledFor',scheduled_for,'timezone',timezone,'revision',revision,'updatedAt',updated_at) AS projection`, [ownerUserId2.toString(), randomUUID56(), reminderRef2, optionalText3(body3, "occurrenceKey") ?? reminderRef2, text2(body3, "instruction"), scheduledFor, optionalText3(body3, "timezone") ?? "UTC", at, optionalText3(body3, "scheduleRef"), ref4(assistantRef2)]);
+        const result3 = await client2.query(`INSERT INTO assistant.reminder_occurrences(owner_user_id,id,public_id,assistant_id,schedule_id,schedule_ref,occurrence_key,instruction,scheduled_for,timezone,state,revision,created_at,updated_at) SELECT $1,$2,$3,assistant.id,schedule.id,COALESCE(schedule.public_id,$3),$4,$5,$6,$7,'materialized',1,$8,$8 FROM assistant.assistants assistant LEFT JOIN assistant.schedules schedule ON schedule.owner_user_id=assistant.owner_user_id AND schedule.public_id=$9 WHERE assistant.owner_user_id=$1 AND assistant.public_id=$10 RETURNING jsonb_build_object('reminderRef',public_id,'assistantRef',$10::text,'scheduleRef',CASE WHEN schedule_id IS NULL THEN NULL ELSE schedule_ref END,'state','scheduled','instruction',instruction,'scheduledFor',scheduled_for,'timezone',timezone,'revision',revision,'updatedAt',updated_at) AS projection`, [ownerUserId2.toString(), randomUUID57(), reminderRef2, optionalText3(body3, "occurrenceKey") ?? reminderRef2, text2(body3, "instruction"), scheduledFor, optionalText3(body3, "timezone") ?? "UTC", at, optionalText3(body3, "scheduleRef"), ref4(assistantRef2)]);
         if (!result3.rows[0]) throw new Error("assistant_not_found");
         await audit(client2, ownerUserId2.toString(), "assistant.reminder.create", reminderRef2, at);
         return result3.rows[0].projection;
@@ -70858,7 +71586,7 @@ function createPostgresPersonalAssistantControlPlaneStore(options) {
       const body3 = record3(input), packetRef = newRef2("packet"), at = now().toISOString(), manifestDigest = text2(body3, "manifestDigest");
       if (!DIGEST4.test(manifestDigest)) throw new TypeError("manifestDigest is invalid");
       return tx(async (client2) => {
-        const result3 = await client2.query(`INSERT INTO assistant.context_packet_pointers(owner_user_id,id,public_id,assistant_id,context_version_id,memory_vault_ref,packet_ref,packet_revision,revision,manifest_digest,label,sensitivity,state,created_at,updated_at) SELECT $1,$2,$3,assistant.id,context.id,$4,$5,$6,1,$7,$8,$9,'active',$10,$10 FROM assistant.assistants assistant JOIN LATERAL(SELECT id FROM assistant.context_versions WHERE owner_user_id=assistant.owner_user_id AND assistant_id=assistant.id ORDER BY version DESC LIMIT 1) context ON true WHERE assistant.owner_user_id=$1 AND assistant.public_id=$11 RETURNING jsonb_build_object('packetRef',public_id,'assistantRef',$11::text,'revision',revision,'state',state,'manifestDigest',manifest_digest,'label',label,'updatedAt',updated_at) AS projection`, [ownerUserId2.toString(), randomUUID56(), packetRef, text2(body3, "memoryVaultRef"), text2(body3, "memoryPacketRef", packetRef), optionalText3(body3, "packetRevision") ?? "1", manifestDigest, text2(body3, "label"), optionalText3(body3, "sensitivity") ?? "standard", at, ref4(assistantRef2)]);
+        const result3 = await client2.query(`INSERT INTO assistant.context_packet_pointers(owner_user_id,id,public_id,assistant_id,context_version_id,memory_vault_ref,packet_ref,packet_revision,revision,manifest_digest,label,sensitivity,state,created_at,updated_at) SELECT $1,$2,$3,assistant.id,context.id,$4,$5,$6,1,$7,$8,$9,'active',$10,$10 FROM assistant.assistants assistant JOIN LATERAL(SELECT id FROM assistant.context_versions WHERE owner_user_id=assistant.owner_user_id AND assistant_id=assistant.id ORDER BY version DESC LIMIT 1) context ON true WHERE assistant.owner_user_id=$1 AND assistant.public_id=$11 RETURNING jsonb_build_object('packetRef',public_id,'assistantRef',$11::text,'revision',revision,'state',state,'manifestDigest',manifest_digest,'label',label,'updatedAt',updated_at) AS projection`, [ownerUserId2.toString(), randomUUID57(), packetRef, text2(body3, "memoryVaultRef"), text2(body3, "memoryPacketRef", packetRef), optionalText3(body3, "packetRevision") ?? "1", manifestDigest, text2(body3, "label"), optionalText3(body3, "sensitivity") ?? "standard", at, ref4(assistantRef2)]);
         if (!result3.rows[0]) throw new Error("context_version_not_found");
         await audit(client2, ownerUserId2.toString(), "assistant.context.create", packetRef, at);
         return result3.rows[0].projection;
@@ -70913,7 +71641,7 @@ function createPostgresPersonalAssistantNumberPort(options) {
 }
 
 // src/api/personal-assistant-scheduling-store.ts
-import { createHash as createHash76, randomUUID as randomUUID57 } from "crypto";
+import { createHash as createHash77, randomUUID as randomUUID58 } from "crypto";
 var PersonalAssistantSchedulingStoreError = class extends Error {
   constructor(code, message = code, status = code === "schedule_not_found" ? 404 : code === "schedule_activation_unavailable" ? 503 : 409) {
     super(message);
@@ -70929,7 +71657,7 @@ function owner3(ownerUserId2) {
   return ownerUserId2.toString();
 }
 function ref5(prefix) {
-  return `${prefix}_${randomUUID57().replaceAll("-", "")}`;
+  return `${prefix}_${randomUUID58().replaceAll("-", "")}`;
 }
 function iso4(value) {
   return value instanceof Date ? value.toISOString() : new Date(value).toISOString();
@@ -70940,7 +71668,7 @@ function canonicalJson10(value) {
   return JSON.stringify(value);
 }
 function digest11(value) {
-  return createHash76("sha256").update(canonicalJson10(value)).digest("hex");
+  return createHash77("sha256").update(canonicalJson10(value)).digest("hex");
 }
 function authorityClass(value) {
   if (value === "observe") return "observe";
@@ -71053,7 +71781,7 @@ function createPostgresPersonalAssistantSchedulingStore(options) {
             RETURNING id AS schedule_id,revision AS schedule_revision`,
             [
               ownerRef,
-              randomUUID57(),
+              randomUUID58(),
               input.draft.scheduleRef,
               input.draft.instruction,
               scheduleCadence(input.draft),
@@ -71087,7 +71815,7 @@ function createPostgresPersonalAssistantSchedulingStore(options) {
         ) VALUES ($1,$2,$3,$4,$5,$6,$7::jsonb,$8,$9,$10::timestamptz,$11::timestamptz)`,
           [
             ownerRef,
-            randomUUID57(),
+            randomUUID58(),
             ref5("schedrev"),
             schedule.rows[0].schedule_id,
             input.draft.revision,
@@ -71112,7 +71840,7 @@ function createPostgresPersonalAssistantSchedulingStore(options) {
                 AND profile.deleted_at IS NULL AND login.deleted_at IS NULL`,
               [
                 ownerRef,
-                randomUUID57(),
+                randomUUID58(),
                 ref5("sbgrant"),
                 schedule.rows[0].schedule_id,
                 input.draft.revision,
@@ -71182,7 +71910,7 @@ function createPostgresPersonalAssistantSchedulingStore(options) {
           RETURNING id`,
             [
               ownerRef,
-              randomUUID57(),
+              randomUUID58(),
               ref5("sready"),
               row.schedule_id,
               row.revision,
@@ -71231,7 +71959,7 @@ function createPostgresPersonalAssistantSchedulingStore(options) {
           ) VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12::jsonb,$13::timestamptz)`,
             [
               ownerRef,
-              randomUUID57(),
+              randomUUID58(),
               ref5("sactivate"),
               row.schedule_id,
               row.revision,
@@ -71384,7 +72112,7 @@ function assertNoRawTwilioSecretEnvironment(environment2 = process.env) {
 }
 
 // src/api/twilio-messaging-service.ts
-import { createHash as createHash77 } from "crypto";
+import { createHash as createHash78 } from "crypto";
 
 // src/api/personal-assistant-policy.ts
 var AUTHORITY_RANK = {
@@ -71684,10 +72412,10 @@ function canonicalJson11(value) {
   });
 }
 function digest12(value) {
-  return createHash77("sha256").update(canonicalJson11(value)).digest("hex");
+  return createHash78("sha256").update(canonicalJson11(value)).digest("hex");
 }
 function deterministicRef3(prefix, identity) {
-  return `${prefix}_${createHash77("sha256").update(identity).digest("hex").slice(0, 32)}`;
+  return `${prefix}_${createHash78("sha256").update(identity).digest("hex").slice(0, 32)}`;
 }
 function isBoundedAuthorityRef(value) {
   return typeof value === "string" && value.length >= 3 && value.length <= 240 && !value.includes("\0");
@@ -71859,7 +72587,7 @@ function inboundIdentity(input, route) {
   };
 }
 function sha256Bytes(bytes2) {
-  return createHash77("sha256").update(bytes2).digest("hex");
+  return createHash78("sha256").update(bytes2).digest("hex");
 }
 function startsWith(bytes2, signature) {
   return signature.every((value, index) => bytes2[index] === value);
@@ -73038,11 +73766,11 @@ function createTwilioMessagingService(dependencies = {}) {
 }
 
 // src/api/twilio-memory-media.ts
-import { createHash as createHash78, randomUUID as randomUUID58 } from "crypto";
+import { createHash as createHash79, randomUUID as randomUUID59 } from "crypto";
 var IMAGE_TYPES = /* @__PURE__ */ new Set(["image/jpeg", "image/png", "image/gif", "image/webp"]);
 var FILE_TYPES = /* @__PURE__ */ new Set(["application/pdf", "text/plain"]);
 function digestBytes(bytes2) {
-  return createHash78("sha256").update(bytes2).digest("hex");
+  return createHash79("sha256").update(bytes2).digest("hex");
 }
 function publicPointer(pointer) {
   return Object.freeze({
@@ -73126,7 +73854,7 @@ function createTwilioMemoryMedia(options) {
       return publicPointer(await options.pointers.put({
         ownerBindingRef: input.ownerBindingRef,
         mediaRef: input.mediaRef,
-        renewablePointerRef: `memory_asset_${createHash78("sha256").update(`${input.ownerBindingRef}\0${asset.assetId}`).digest("hex").slice(0, 32)}`,
+        renewablePointerRef: `memory_asset_${createHash79("sha256").update(`${input.ownerBindingRef}\0${asset.assetId}`).digest("hex").slice(0, 32)}`,
         byteDigest: input.byteDigest,
         contentType: input.contentType,
         byteSize: input.bytes.byteLength,
@@ -73159,7 +73887,7 @@ function createTwilioMemoryMedia(options) {
 }
 
 // src/api/twilio-provider-facade.ts
-import { createHash as createHash79 } from "crypto";
+import { createHash as createHash80 } from "crypto";
 
 // src/api/twilio-messaging-client.ts
 import twilio4 from "twilio";
@@ -73340,7 +74068,7 @@ function createTwilioMessagingClient(options) {
     if (!options.accountSid || !options.authToken) throw new Error("twilio_credentials_required");
     return createOfficialAdapter(options.accountSid, options.authToken, defaultDeadlineMs);
   })();
-  async function call(operation, work, deadlineMs) {
+  async function call2(operation, work, deadlineMs) {
     const timeoutMs = boundedInteger(deadlineMs, defaultDeadlineMs, TWILIO_CLIENT_LIMITS.minDeadlineMs, TWILIO_CLIENT_LIMITS.maxDeadlineMs, "deadline_ms");
     let timer;
     try {
@@ -73372,7 +74100,7 @@ function createTwilioMessagingClient(options) {
       if (input.areaCode !== void 0 && (!Number.isInteger(input.areaCode) || input.areaCode < 100 || input.areaCode > 999)) throw new RangeError("area_code_out_of_bounds");
       if (input.contains !== void 0 && !/^[0-9A-Za-z*%+$]{2,16}$/.test(input.contains)) throw new TypeError("invalid_number_pattern");
       const bounds2 = listBounds(input.limit, input.pageSize, TWILIO_CLIENT_LIMITS.maxSearchResults);
-      const result3 = await call("number.search", () => adapter.searchAvailableNumbers({
+      const result3 = await call2("number.search", () => adapter.searchAvailableNumbers({
         countryCode,
         type: input.type,
         ...bounds2,
@@ -73386,54 +74114,54 @@ function createTwilioMessagingClient(options) {
     },
     listIncomingNumbers: async (input = {}) => {
       const bounds2 = listBounds(input.limit, input.pageSize);
-      const result3 = await call("number.list", () => adapter.listIncomingNumbers(bounds2), input.deadlineMs);
+      const result3 = await call2("number.list", () => adapter.listIncomingNumbers(bounds2), input.deadlineMs);
       return result3.slice(0, bounds2.limit).map(projectNumber);
     },
-    readIncomingNumber: async (sid, options2 = {}) => projectNumber(await call("number.read", () => adapter.fetchIncomingNumber(assertSid(sid, "number")), options2.deadlineMs)),
-    purchaseIncomingNumber: async (input) => projectNumber(await call("number.purchase", () => adapter.purchaseIncomingNumber({
+    readIncomingNumber: async (sid, options2 = {}) => projectNumber(await call2("number.read", () => adapter.fetchIncomingNumber(assertSid(sid, "number")), options2.deadlineMs)),
+    purchaseIncomingNumber: async (input) => projectNumber(await call2("number.purchase", () => adapter.purchaseIncomingNumber({
       phoneNumber: assertE164(input.phoneNumber, "phone_number"),
       ...input.friendlyName === void 0 ? {} : { friendlyName: boundedText2(input.friendlyName, TWILIO_CLIENT_LIMITS.maxFriendlyNameChars, "friendly_name") }
     }), input.deadlineMs)),
-    releaseIncomingNumber: async (sid, options2 = {}) => ({ released: await call("number.release", () => adapter.releaseIncomingNumber(assertSid(sid, "number")), options2.deadlineMs) }),
-    createMessagingService: async (input) => projectService(await call("messaging_service.create", () => adapter.createMessagingService({
+    releaseIncomingNumber: async (sid, options2 = {}) => ({ released: await call2("number.release", () => adapter.releaseIncomingNumber(assertSid(sid, "number")), options2.deadlineMs) }),
+    createMessagingService: async (input) => projectService(await call2("messaging_service.create", () => adapter.createMessagingService({
       friendlyName: boundedText2(input.friendlyName, TWILIO_CLIENT_LIMITS.maxFriendlyNameChars, "friendly_name"),
       ...input.inboundRequestUrl ? { inboundRequestUrl: assertHttpsUrl(input.inboundRequestUrl, "inbound_request_url") } : {},
       ...input.statusCallback ? { statusCallback: assertHttpsUrl(input.statusCallback, "status_callback") } : {}
     }), input.deadlineMs)),
     listMessagingServices: async (input = {}) => {
       const bounds2 = listBounds(input.limit, input.pageSize);
-      const result3 = await call("messaging_service.list", () => adapter.listMessagingServices(bounds2), input.deadlineMs);
+      const result3 = await call2("messaging_service.list", () => adapter.listMessagingServices(bounds2), input.deadlineMs);
       return result3.slice(0, bounds2.limit).map(projectService);
     },
-    readMessagingService: async (sid, options2 = {}) => projectService(await call("messaging_service.read", () => adapter.fetchMessagingService(assertSid(sid, "service")), options2.deadlineMs)),
+    readMessagingService: async (sid, options2 = {}) => projectService(await call2("messaging_service.read", () => adapter.fetchMessagingService(assertSid(sid, "service")), options2.deadlineMs)),
     updateMessagingService: async (sid, input) => {
       const patch = {};
       if (input.friendlyName !== void 0) patch.friendlyName = boundedText2(input.friendlyName, TWILIO_CLIENT_LIMITS.maxFriendlyNameChars, "friendly_name");
       if (input.inboundRequestUrl !== void 0) patch.inboundRequestUrl = assertHttpsUrl(input.inboundRequestUrl, "inbound_request_url");
       if (input.statusCallback !== void 0) patch.statusCallback = assertHttpsUrl(input.statusCallback, "status_callback");
       if (!Object.keys(patch).length) throw new TypeError("messaging_service_update_empty");
-      return projectService(await call("messaging_service.update", () => adapter.updateMessagingService(assertSid(sid, "service"), patch), input.deadlineMs));
+      return projectService(await call2("messaging_service.update", () => adapter.updateMessagingService(assertSid(sid, "service"), patch), input.deadlineMs));
     },
-    deleteMessagingService: async (sid, options2 = {}) => ({ deleted: await call("messaging_service.delete", () => adapter.deleteMessagingService(assertSid(sid, "service")), options2.deadlineMs) }),
-    bindMessagingServiceSender: async (serviceSid, phoneNumberSid, options2 = {}) => pick2(await call("messaging_service.sender.bind", () => adapter.bindMessagingServiceSender(assertSid(serviceSid, "service"), { phoneNumberSid: assertSid(phoneNumberSid, "number") }), options2.deadlineMs), ["sid", "phoneNumberSid", "dateCreated"]),
+    deleteMessagingService: async (sid, options2 = {}) => ({ deleted: await call2("messaging_service.delete", () => adapter.deleteMessagingService(assertSid(sid, "service")), options2.deadlineMs) }),
+    bindMessagingServiceSender: async (serviceSid, phoneNumberSid, options2 = {}) => pick2(await call2("messaging_service.sender.bind", () => adapter.bindMessagingServiceSender(assertSid(serviceSid, "service"), { phoneNumberSid: assertSid(phoneNumberSid, "number") }), options2.deadlineMs), ["sid", "phoneNumberSid", "dateCreated"]),
     listMessagingServiceSenders: async (serviceSid, input = {}) => {
       const bounds2 = listBounds(input.limit, input.pageSize);
-      const result3 = await call("messaging_service.sender.list", () => adapter.listMessagingServiceSenders(assertSid(serviceSid, "service"), bounds2), input.deadlineMs);
+      const result3 = await call2("messaging_service.sender.list", () => adapter.listMessagingServiceSenders(assertSid(serviceSid, "service"), bounds2), input.deadlineMs);
       return result3.slice(0, bounds2.limit).map((value) => pick2(value, ["sid", "phoneNumberSid", "dateCreated"]));
     },
-    unbindMessagingServiceSender: async (serviceSid, senderSid, options2 = {}) => ({ unbound: await call("messaging_service.sender.unbind", () => adapter.unbindMessagingServiceSender(assertSid(serviceSid, "service"), assertSid(senderSid, "sender")), options2.deadlineMs) }),
+    unbindMessagingServiceSender: async (serviceSid, senderSid, options2 = {}) => ({ unbound: await call2("messaging_service.sender.unbind", () => adapter.unbindMessagingServiceSender(assertSid(serviceSid, "service"), assertSid(senderSid, "sender")), options2.deadlineMs) }),
     createRegulatoryBundle: async (input) => {
       const isoCountry = input.isoCountry.trim().toUpperCase();
       if (!/^[A-Z]{2}$/.test(isoCountry)) throw new TypeError("invalid_country_code");
       if (!/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(input.email) || input.email.length > 254) throw new TypeError("invalid_contact_email");
-      return projectRegistration(await call("registration.bundle.create", () => adapter.createRegulatoryBundle({ friendlyName: boundedText2(input.friendlyName, TWILIO_CLIENT_LIMITS.maxFriendlyNameChars, "friendly_name"), email: input.email, endUserType: input.endUserType, isoCountry, numberType: boundedText2(input.numberType, 40, "number_type"), regulationSid: assertSid(input.regulationSid, "regulation") }), input.deadlineMs));
+      return projectRegistration(await call2("registration.bundle.create", () => adapter.createRegulatoryBundle({ friendlyName: boundedText2(input.friendlyName, TWILIO_CLIENT_LIMITS.maxFriendlyNameChars, "friendly_name"), email: input.email, endUserType: input.endUserType, isoCountry, numberType: boundedText2(input.numberType, 40, "number_type"), regulationSid: assertSid(input.regulationSid, "regulation") }), input.deadlineMs));
     },
     listRegulatoryBundles: async (input = {}) => {
       const bounds2 = listBounds(input.limit, input.pageSize);
-      const result3 = await call("registration.bundle.list", () => adapter.listRegulatoryBundles({ ...bounds2, ...input.status ? { status: boundedText2(input.status, 40, "status") } : {} }), input.deadlineMs);
+      const result3 = await call2("registration.bundle.list", () => adapter.listRegulatoryBundles({ ...bounds2, ...input.status ? { status: boundedText2(input.status, 40, "status") } : {} }), input.deadlineMs);
       return result3.slice(0, bounds2.limit).map(projectRegistration);
     },
-    readRegulatoryBundle: async (sid, options2 = {}) => projectRegistration(await call("registration.bundle.read", () => adapter.fetchRegulatoryBundle(assertSid(sid, "bundle")), options2.deadlineMs)),
+    readRegulatoryBundle: async (sid, options2 = {}) => projectRegistration(await call2("registration.bundle.read", () => adapter.fetchRegulatoryBundle(assertSid(sid, "bundle")), options2.deadlineMs)),
     updateRegulatoryBundle: async (sid, input) => {
       const patch = {};
       if (input.friendlyName !== void 0) patch.friendlyName = boundedText2(input.friendlyName, TWILIO_CLIENT_LIMITS.maxFriendlyNameChars, "friendly_name");
@@ -73442,16 +74170,16 @@ function createTwilioMessagingClient(options) {
         patch.email = input.email;
       }
       if (!Object.keys(patch).length) throw new TypeError("registration_bundle_update_empty");
-      return projectRegistration(await call("registration.bundle.update", () => adapter.updateRegulatoryBundle(assertSid(sid, "bundle"), patch), input.deadlineMs));
+      return projectRegistration(await call2("registration.bundle.update", () => adapter.updateRegulatoryBundle(assertSid(sid, "bundle"), patch), input.deadlineMs));
     },
-    submitRegulatoryBundle: async (sid, options2 = {}) => projectRegistration(await call("registration.bundle.submit", () => adapter.updateRegulatoryBundle(assertSid(sid, "bundle"), { status: "pending-review" }), options2.deadlineMs)),
-    bindRegulatoryItem: async (bundleSid, objectSid, options2 = {}) => pick2(await call("registration.item.bind", () => adapter.bindRegulatoryItem(assertSid(bundleSid, "bundle"), { objectSid: assertSid(objectSid, "regulatoryObject") }), options2.deadlineMs), ["sid", "objectSid", "bundleSid", "dateCreated"]),
+    submitRegulatoryBundle: async (sid, options2 = {}) => projectRegistration(await call2("registration.bundle.submit", () => adapter.updateRegulatoryBundle(assertSid(sid, "bundle"), { status: "pending-review" }), options2.deadlineMs)),
+    bindRegulatoryItem: async (bundleSid, objectSid, options2 = {}) => pick2(await call2("registration.item.bind", () => adapter.bindRegulatoryItem(assertSid(bundleSid, "bundle"), { objectSid: assertSid(objectSid, "regulatoryObject") }), options2.deadlineMs), ["sid", "objectSid", "bundleSid", "dateCreated"]),
     listRegulatoryItems: async (bundleSid, input = {}) => {
       const bounds2 = listBounds(input.limit, input.pageSize);
-      const result3 = await call("registration.item.list", () => adapter.listRegulatoryItems(assertSid(bundleSid, "bundle"), bounds2), input.deadlineMs);
+      const result3 = await call2("registration.item.list", () => adapter.listRegulatoryItems(assertSid(bundleSid, "bundle"), bounds2), input.deadlineMs);
       return result3.slice(0, bounds2.limit).map((value) => pick2(value, ["sid", "objectSid", "bundleSid", "dateCreated"]));
     },
-    unbindRegulatoryItem: async (bundleSid, itemSid, options2 = {}) => ({ unbound: await call("registration.item.unbind", () => adapter.unbindRegulatoryItem(assertSid(bundleSid, "bundle"), assertSid(itemSid, "item")), options2.deadlineMs) }),
+    unbindRegulatoryItem: async (bundleSid, itemSid, options2 = {}) => ({ unbound: await call2("registration.item.unbind", () => adapter.unbindRegulatoryItem(assertSid(bundleSid, "bundle"), assertSid(itemSid, "item")), options2.deadlineMs) }),
     createMessage: async (input) => {
       if (input.from === void 0 === (input.messagingServiceSid === void 0)) throw new TypeError("message_sender_requires_exactly_one_source");
       if (input.body === void 0 && (!input.mediaUrl || input.mediaUrl.length === 0)) throw new TypeError("message_content_required");
@@ -73466,21 +74194,21 @@ function createTwilioMessagingClient(options) {
         ...input.statusCallback ? { statusCallback: assertHttpsUrl(input.statusCallback, "status_callback") } : {},
         ...input.validityPeriod === void 0 ? {} : { validityPeriod: boundedInteger(input.validityPeriod, 36e3, 1, 36e3, "validity_period") }
       };
-      return projectMessage(await call("message.create", () => adapter.createMessage(request), input.deadlineMs));
+      return projectMessage(await call2("message.create", () => adapter.createMessage(request), input.deadlineMs));
     },
     listMessages: async (input = {}) => {
       const bounds2 = listBounds(input.limit, input.pageSize);
-      const result3 = await call("message.list", () => adapter.listMessages(bounds2), input.deadlineMs);
+      const result3 = await call2("message.list", () => adapter.listMessages(bounds2), input.deadlineMs);
       return result3.slice(0, bounds2.limit).map(projectMessage);
     },
-    readMessage: async (sid, options2 = {}) => projectMessage(await call("message.read", () => adapter.fetchMessage(assertSid(sid, "message")), options2.deadlineMs)),
-    cancelMessage: async (sid, options2 = {}) => projectMessage(await call("message.cancel", () => adapter.cancelMessage(assertSid(sid, "message")), options2.deadlineMs)),
+    readMessage: async (sid, options2 = {}) => projectMessage(await call2("message.read", () => adapter.fetchMessage(assertSid(sid, "message")), options2.deadlineMs)),
+    cancelMessage: async (sid, options2 = {}) => projectMessage(await call2("message.cancel", () => adapter.cancelMessage(assertSid(sid, "message")), options2.deadlineMs)),
     listMessageMedia: async (messageSid, input = {}) => {
       const bounds2 = listBounds(input.limit, input.pageSize, TWILIO_CLIENT_LIMITS.maxMediaUrls);
-      const result3 = await call("message.media.list", () => adapter.listMedia(assertSid(messageSid, "message"), bounds2), input.deadlineMs);
+      const result3 = await call2("message.media.list", () => adapter.listMedia(assertSid(messageSid, "message"), bounds2), input.deadlineMs);
       return result3.slice(0, bounds2.limit).map(projectMedia);
     },
-    readMessageMedia: async (messageSid, mediaSid, options2 = {}) => projectMedia(await call("message.media.read", () => adapter.fetchMedia(assertSid(messageSid, "message"), assertSid(mediaSid, "media")), options2.deadlineMs))
+    readMessageMedia: async (messageSid, mediaSid, options2 = {}) => projectMedia(await call2("message.media.read", () => adapter.fetchMedia(assertSid(messageSid, "message"), assertSid(mediaSid, "media")), options2.deadlineMs))
   });
 }
 
@@ -73494,7 +74222,7 @@ function validAuthority(input) {
   return /^[1-9]\d*$/u.test(input.ownerUserId) && PUBLIC_REF2.test(input.executionRef) && ACCOUNT_SID3.test(input.providerAccountRef) && PUBLIC_REF2.test(input.connectionRef) && /^[A-Za-z][A-Za-z0-9_.:-]{2,159}$/u.test(input.environmentRef);
 }
 function digest13(value) {
-  return createHash79("sha256").update(JSON.stringify(value, (_key, entry) => {
+  return createHash80("sha256").update(JSON.stringify(value, (_key, entry) => {
     if (!entry || typeof entry !== "object" || Array.isArray(entry)) return entry;
     return Object.fromEntries(Object.entries(entry).sort(([a], [b]) => a.localeCompare(b)));
   })).digest("hex");
@@ -73683,7 +74411,7 @@ function createTwilioProduction(options) {
 }
 
 // src/runtime/personal-assistant-deployment-config.ts
-import { createHash as createHash80 } from "crypto";
+import { createHash as createHash81 } from "crypto";
 import { readFileSync as readFileSync4 } from "fs";
 import { resolve as resolve2 } from "path";
 var REF_PATTERN = /^(?:[a-z][a-z0-9+.-]*:\/\/)?[A-Za-z0-9][A-Za-z0-9._:/-]{2,240}$/;
@@ -73719,7 +74447,7 @@ function databaseBinding(value) {
     const database = decodeURIComponent(parsed.pathname.replace(/^\//, ""));
     const role = decodeURIComponent(parsed.username);
     if (!database || !/^[a-z_][a-z0-9_]*$/.test(role)) return null;
-    return { fingerprint: createHash80("sha256").update(`${labels.join(".")}\0${database}`).digest("hex"), role };
+    return { fingerprint: createHash81("sha256").update(`${labels.join(".")}\0${database}`).digest("hex"), role };
   } catch {
     return null;
   }
@@ -74181,8 +74909,8 @@ function createPersonalAssistantHostedConfigurationAdapter(input) {
 }
 
 // src/api/personal-assistant-authorization.ts
-import { createHash as createHash81 } from "crypto";
-import { z as z49 } from "zod";
+import { createHash as createHash82 } from "crypto";
+import { z as z51 } from "zod";
 var ABUSE_GATED_OPERATIONS = /* @__PURE__ */ new Set(["assistant.message.send", "assistant.bulk.send"]);
 var NORMALIZED_RECIPIENT_OPERATIONS = /* @__PURE__ */ new Set([
   "assistant.message.send",
@@ -74260,27 +74988,27 @@ var RepositoryBackedPersonalAssistantAuthorization = class {
     return result3;
   }
 };
-var AuthorizationContextSchema = z49.object({
-  resourceRefs: z49.array(z49.string()).max(100),
-  contactRef: z49.string().optional(),
-  senderEndpointRef: z49.string().optional(),
-  numberRef: z49.string().optional(),
-  consentSubjectKey: z49.string().optional(),
-  messageClass: z49.enum(["administrative", "transactional", "conversational", "campaign", "compliance"]).optional(),
-  recipientHashes: z49.array(z49.string().regex(/^[a-f0-9]{64}$/)).max(1e4),
-  recipientCount: z49.number().int().nonnegative(),
-  segmentCount: z49.number().int().nonnegative(),
-  mediaCount: z49.number().int().nonnegative(),
-  byteCount: z49.number().int().nonnegative().safe(),
-  spendCurrency: z49.string().regex(/^[A-Z]{3}$/).optional(),
-  spendAmountMinor: z49.number().int().nonnegative().safe().optional(),
-  destinationCountry: z49.string().regex(/^[A-Z]{2}$/).optional(),
-  routingRef: z49.string().optional(),
-  audienceDigest: z49.string().regex(/^[a-f0-9]{64}$/).optional(),
-  occurrenceRef: z49.string().optional(),
-  currentPlanRevision: z49.number().int().positive().optional(),
-  validFrom: z49.string(),
-  expiresAt: z49.string()
+var AuthorizationContextSchema = z51.object({
+  resourceRefs: z51.array(z51.string()).max(100),
+  contactRef: z51.string().optional(),
+  senderEndpointRef: z51.string().optional(),
+  numberRef: z51.string().optional(),
+  consentSubjectKey: z51.string().optional(),
+  messageClass: z51.enum(["administrative", "transactional", "conversational", "campaign", "compliance"]).optional(),
+  recipientHashes: z51.array(z51.string().regex(/^[a-f0-9]{64}$/)).max(1e4),
+  recipientCount: z51.number().int().nonnegative(),
+  segmentCount: z51.number().int().nonnegative(),
+  mediaCount: z51.number().int().nonnegative(),
+  byteCount: z51.number().int().nonnegative().safe(),
+  spendCurrency: z51.string().regex(/^[A-Z]{3}$/).optional(),
+  spendAmountMinor: z51.number().int().nonnegative().safe().optional(),
+  destinationCountry: z51.string().regex(/^[A-Z]{2}$/).optional(),
+  routingRef: z51.string().optional(),
+  audienceDigest: z51.string().regex(/^[a-f0-9]{64}$/).optional(),
+  occurrenceRef: z51.string().optional(),
+  currentPlanRevision: z51.number().int().positive().optional(),
+  validFrom: z51.string(),
+  expiresAt: z51.string()
 }).strict().superRefine((value, context) => {
   if (value.spendCurrency === void 0 !== (value.spendAmountMinor === void 0)) {
     context.addIssue({ code: "custom", path: ["spendCurrency"], message: "spend currency and amount must be paired" });
@@ -74323,43 +75051,43 @@ var PostgresPersonalAssistantAuthorizationContextRepository = class {
     return parsed.success ? Object.freeze(parsed.data) : null;
   }
 };
-var MoneySchema2 = z49.object({ currency: z49.string().regex(/^[A-Z]{3}$/), amountMinor: z49.number().int().nonnegative().safe() }).strict();
-var DurablePolicyFactsSchema = z49.object({
-  requestedEffect: z49.string().optional(),
-  channel: z49.enum(["web", "sms", "mms", "cron", "system", "browser"]).optional(),
-  provider: z49.enum(["gmail", "calendar", "zoom", "twilio", "memory", "browser", "assistant"]).optional(),
-  accountRef: z49.string().optional(),
-  resourceRefs: z49.array(z49.string()).max(100).optional(),
-  requestedDomain: z49.string().optional(),
-  occurrenceRef: z49.string().optional(),
-  audienceDigest: z49.string().nullable().optional(),
-  operationCount: z49.number().int().nonnegative().optional(),
-  recipientCount: z49.number().int().nonnegative().optional(),
-  segmentCount: z49.number().int().nonnegative().optional(),
-  byteCount: z49.number().int().nonnegative().safe().optional(),
+var MoneySchema2 = z51.object({ currency: z51.string().regex(/^[A-Z]{3}$/), amountMinor: z51.number().int().nonnegative().safe() }).strict();
+var DurablePolicyFactsSchema = z51.object({
+  requestedEffect: z51.string().optional(),
+  channel: z51.enum(["web", "sms", "mms", "cron", "system", "browser"]).optional(),
+  provider: z51.enum(["gmail", "calendar", "zoom", "twilio", "memory", "browser", "assistant"]).optional(),
+  accountRef: z51.string().optional(),
+  resourceRefs: z51.array(z51.string()).max(100).optional(),
+  requestedDomain: z51.string().optional(),
+  occurrenceRef: z51.string().optional(),
+  audienceDigest: z51.string().nullable().optional(),
+  operationCount: z51.number().int().nonnegative().optional(),
+  recipientCount: z51.number().int().nonnegative().optional(),
+  segmentCount: z51.number().int().nonnegative().optional(),
+  byteCount: z51.number().int().nonnegative().safe().optional(),
   spend: MoneySchema2.nullable().optional(),
-  costBearing: z49.union([z49.boolean(), z49.literal("unknown")]).optional(),
-  actionDigest: z49.string().optional(),
-  argumentDigest: z49.string().optional(),
-  targetDigest: z49.string().nullable().optional(),
-  providerCapability: z49.enum(["available", "unavailable", "unknown"]).optional(),
-  actionSwitch: z49.enum(["enabled", "disabled", "unknown"]).optional(),
-  accountSwitch: z49.enum(["matched", "unbound", "mismatch", "trial", "unknown"]).optional(),
-  grants: z49.object({
-    assistant: z49.enum(["allow", "deny", "unknown", "not_applicable"]),
-    channel: z49.enum(["allow", "deny", "unknown", "not_applicable"]),
-    schedule: z49.enum(["allow", "deny", "unknown", "not_applicable"]),
-    conversation: z49.enum(["allow", "deny", "unknown", "not_applicable"])
+  costBearing: z51.union([z51.boolean(), z51.literal("unknown")]).optional(),
+  actionDigest: z51.string().optional(),
+  argumentDigest: z51.string().optional(),
+  targetDigest: z51.string().nullable().optional(),
+  providerCapability: z51.enum(["available", "unavailable", "unknown"]).optional(),
+  actionSwitch: z51.enum(["enabled", "disabled", "unknown"]).optional(),
+  accountSwitch: z51.enum(["matched", "unbound", "mismatch", "trial", "unknown"]).optional(),
+  grants: z51.object({
+    assistant: z51.enum(["allow", "deny", "unknown", "not_applicable"]),
+    channel: z51.enum(["allow", "deny", "unknown", "not_applicable"]),
+    schedule: z51.enum(["allow", "deny", "unknown", "not_applicable"]),
+    conversation: z51.enum(["allow", "deny", "unknown", "not_applicable"])
   }).strict().optional(),
-  quietHours: z49.enum(["clear", "active_defer", "timezone_unknown", "not_applicable", "unknown"]).optional(),
-  financialAuthorization: z49.enum(["authorized", "missing", "not_required", "unknown"]).optional(),
-  bulkConfirmation: z49.enum(["confirmed", "missing", "not_applicable"]).optional()
+  quietHours: z51.enum(["clear", "active_defer", "timezone_unknown", "not_applicable", "unknown"]).optional(),
+  financialAuthorization: z51.enum(["authorized", "missing", "not_required", "unknown"]).optional(),
+  bulkConfirmation: z51.enum(["confirmed", "missing", "not_applicable"]).optional()
 }).strict();
 function canonicalJson12(value) {
   return JSON.stringify(value, (_key, entry) => entry && typeof entry === "object" && !Array.isArray(entry) ? Object.fromEntries(Object.entries(entry).sort(([a], [b]) => a.localeCompare(b))) : entry);
 }
 function factDigest(value) {
-  return createHash81("sha256").update(canonicalJson12(value)).digest("hex");
+  return createHash82("sha256").update(canonicalJson12(value)).digest("hex");
 }
 var PostgresPersonalAssistantPolicyFactsRepository = class {
   constructor(db, contexts, now = () => /* @__PURE__ */ new Date()) {
@@ -74549,7 +75277,7 @@ var PostgresPersonalAssistantPolicyFactsRepository = class {
 };
 
 // src/api/personal-assistant-abuse-controls.ts
-import { createHash as createHash82 } from "crypto";
+import { createHash as createHash83 } from "crypto";
 var EMPTY_STATE = () => ({
   version: 1,
   events: [],
@@ -74560,7 +75288,7 @@ var EMPTY_STATE = () => ({
   bulkIdentities: {}
 });
 function digest14(value) {
-  return createHash82("sha256").update(JSON.stringify(value)).digest("hex");
+  return createHash83("sha256").update(JSON.stringify(value)).digest("hex");
 }
 function isDigest(value) {
   return typeof value === "string" && /^[a-f0-9]{64}$/.test(value);
@@ -74820,10 +75548,10 @@ var PostgresPersonalAssistantAbuseStore = class {
 };
 
 // src/api/twilio-authority-billing-postgres.ts
-import { createHash as createHash84, randomUUID as randomUUID59 } from "crypto";
+import { createHash as createHash85, randomUUID as randomUUID60 } from "crypto";
 
 // src/api/personal-assistant-billing.ts
-import { createHash as createHash83 } from "crypto";
+import { createHash as createHash84 } from "crypto";
 var AssistantBillingError = class extends Error {
   constructor(code, message) {
     super(message);
@@ -74840,7 +75568,7 @@ function canonicalJson13(value) {
   });
 }
 function digest15(value) {
-  return createHash83("sha256").update(canonicalJson13(value)).digest("hex");
+  return createHash84("sha256").update(canonicalJson13(value)).digest("hex");
 }
 function assertMoney(value, field) {
   if (!Number.isSafeInteger(value) || value < 0) throw new AssistantBillingError("billing_invalid_input", `${field} must be a non-negative safe integer.`);
@@ -74885,7 +75613,7 @@ function canonicalJson14(value) {
   });
 }
 function digest16(value) {
-  return createHash84("sha256").update(canonicalJson14(value)).digest("hex");
+  return createHash85("sha256").update(canonicalJson14(value)).digest("hex");
 }
 function amountFor2(usage) {
   return usage.reduce((sum2, item) => sum2 + item.units * item.rateMinorPerUnit, 0);
@@ -74957,7 +75685,7 @@ function createPostgresAssistantBillingStore(options = {}) {
           FROM assistant.commands command WHERE command.owner_user_id=$1 AND command.public_id=$14
           RETURNING *, $14::text AS command_ref`, [
           input.ownerUserId.toString(),
-          randomUUID59(),
+          randomUUID60(),
           input.billingRef,
           input.idempotencyKey,
           input.requestDigest,
@@ -74977,7 +75705,7 @@ function createPostgresAssistantBillingStore(options = {}) {
           SELECT $1,$2,billing.id,$3,$4,'authorize',$5,$6,$7 FROM assistant.billing_holds billing
           WHERE billing.owner_user_id=$1 AND billing.public_id=$8`, [
           input.ownerUserId.toString(),
-          randomUUID59(),
+          randomUUID60(),
           `authorize:${input.idempotencyKey}`,
           inputDigest,
           input.requestDigest,
@@ -75043,7 +75771,7 @@ function createPostgresAssistantBillingStore(options = {}) {
           FROM assistant.billing_holds billing WHERE billing.owner_user_id=$1 AND billing.public_id=$9`,
           [
             input.ownerUserId.toString(),
-            randomUUID59(),
+            randomUUID60(),
             input.eventKey,
             eventDigest,
             input.outcome,
@@ -75091,7 +75819,7 @@ function createPostgresAssistantBillingStore(options = {}) {
           FROM assistant.billing_holds billing WHERE billing.owner_user_id=$1 AND billing.public_id=$8`,
           [
             input.ownerUserId.toString(),
-            randomUUID59(),
+            randomUUID60(),
             input.eventKey,
             eventDigest,
             input.evidenceDigest,
@@ -75120,7 +75848,7 @@ function createPostgresAssistantBillingStore(options = {}) {
 import {
   createCipheriv as createCipheriv3,
   createDecipheriv as createDecipheriv3,
-  createHash as createHash85,
+  createHash as createHash86,
   createHmac as createHmac14,
   randomBytes as randomBytes10
 } from "crypto";
@@ -75178,7 +75906,7 @@ function canonicalContext(input) {
   });
 }
 function contextDigest(context) {
-  return createHash85("sha256").update(context, "utf8").digest("hex");
+  return createHash86("sha256").update(context, "utf8").digest("hex");
 }
 function decodeBase64Url(value, expectedBytes) {
   if (!value || !BASE64URL.test(value)) throw new PersonalAssistantProtectedDataCryptoError("protected_data_envelope_invalid");
@@ -75367,8 +76095,8 @@ async function resolvePersonalAssistantProtectedDataCryptoFactory(options) {
 }
 
 // src/api/twilio-first-text-context-postgres.ts
-import { createHash as createHash86 } from "crypto";
-var digest17 = (value) => createHash86("sha256").update(value).digest("hex");
+import { createHash as createHash87 } from "crypto";
+var digest17 = (value) => createHash87("sha256").update(value).digest("hex");
 function createPostgresTwilioFirstTextDiagnosticContextResolver(options = {}) {
   const queryable = options.queryable ?? getAssistantPool();
   return async (input) => {
@@ -75413,10 +76141,10 @@ function createPostgresTwilioFirstTextDiagnosticContextResolver(options = {}) {
 }
 
 // src/api/twilio-first-text-diagnostic-postgres.ts
-import { createHash as createHash88, randomBytes as randomBytes12, randomUUID as randomUUID60 } from "crypto";
+import { createHash as createHash89, randomBytes as randomBytes12, randomUUID as randomUUID61 } from "crypto";
 
 // src/api/twilio-first-text-diagnostic.ts
-import { createHash as createHash87, randomBytes as randomBytes11 } from "crypto";
+import { createHash as createHash88, randomBytes as randomBytes11 } from "crypto";
 var TWILIO_FIRST_TEXT_BODY = ASSISTANT_CONSENT_CONTENT_V1.diagnosticMessage;
 var TwilioFirstTextDiagnosticError = class extends Error {
   constructor(code) {
@@ -75427,10 +76155,10 @@ var TwilioFirstTextDiagnosticError = class extends Error {
   code;
 };
 function digest18(value) {
-  return createHash87("sha256").update(JSON.stringify(value)).digest("hex");
+  return createHash88("sha256").update(JSON.stringify(value)).digest("hex");
 }
 function stableRef2(prefix, identity) {
-  return `${prefix}_${createHash87("sha256").update(identity).digest("hex").slice(0, 32)}`;
+  return `${prefix}_${createHash88("sha256").update(identity).digest("hex").slice(0, 32)}`;
 }
 function providerSid(result3) {
   const value = result3.receipt.providerMessageSid;
@@ -75542,14 +76270,14 @@ function createTwilioFirstTextDiagnosticService(dependencies) {
 var COLUMNS = `owner_user_id::text,public_id,idempotency_key,request_digest,policy_version,recipient_ref,sender_ref,
  state,mode,stages,provider_message_sid,inbound_event_ref,routing_receipt_ref,acknowledgement_receipt_ref,
  retry_eligible,failure_code,execution_token_digest,created_at,updated_at`;
-var digest19 = (value) => createHash88("sha256").update(value).digest("hex");
+var digest19 = (value) => createHash89("sha256").update(value).digest("hex");
 var iso5 = (value) => new Date(value).toISOString();
 function receipt3(row) {
   return Object.freeze({
     diagnosticRef: row.public_id,
     ownerUserId: row.owner_user_id,
     idempotencyKey: row.idempotency_key,
-    executionRef: `execution_${createHash88("sha256").update(row.public_id).digest("hex").slice(0, 32)}`,
+    executionRef: `execution_${createHash89("sha256").update(row.public_id).digest("hex").slice(0, 32)}`,
     requestDigest: row.request_digest,
     policyVersion: row.policy_version,
     recipientRef: row.recipient_ref,
@@ -75590,7 +76318,7 @@ function createPostgresTwilioFirstTextDiagnosticStore(options = {}) {
           ON CONFLICT (owner_user_id,idempotency_key) DO NOTHING RETURNING ${COLUMNS}`,
           [
             input.ownerUserId,
-            randomUUID60(),
+            randomUUID61(),
             input.diagnosticRef,
             input.idempotencyKey,
             input.requestDigest,
@@ -75717,10 +76445,10 @@ function createTwilioInboundQuarantineClaimAuthorizer(options) {
 }
 
 // src/api/twilio-inbound-claim-control-plane-postgres.ts
-import { createHash as createHash89, randomUUID as randomUUID61 } from "crypto";
-var stableRef3 = (prefix, value) => `${prefix}_${createHash89("sha256").update(value).digest("hex").slice(0, 32)}`;
+import { createHash as createHash90, randomUUID as randomUUID62 } from "crypto";
+var stableRef3 = (prefix, value) => `${prefix}_${createHash90("sha256").update(value).digest("hex").slice(0, 32)}`;
 var stableUuid = (value) => {
-  const hex = createHash89("sha256").update(value).digest("hex").slice(0, 32).split("");
+  const hex = createHash90("sha256").update(value).digest("hex").slice(0, 32).split("");
   hex[12] = "5";
   hex[16] = (Number.parseInt(hex[16], 16) & 3 | 8).toString(16);
   return `${hex.slice(0, 8).join("")}-${hex.slice(8, 12).join("")}-${hex.slice(12, 16).join("")}-${hex.slice(16, 20).join("")}-${hex.slice(20).join("")}`;
@@ -75771,7 +76499,7 @@ function createPostgresTwilioInboundClaimControlPlane(options) {
           (owner_user_id,id,public_id,endpoint_key,revision,contact_id,channel,address_ciphertext,address_hash,masked_display,state,reason_code,created_at)
           VALUES ($1::bigint,$2,$3,$4,1,$5,'sms',$6,$7,$8,'unverified','claimed_inbound_requires_enrollment',$9::timestamptz)
           ON CONFLICT (owner_user_id,public_id) DO NOTHING`,
-          [input.ownerUserId, randomUUID61(), endpointRef, endpointKey, contact.rows[0].id, sender.ciphertext, sender.digest, mask(input.sender), input.occurredAt]
+          [input.ownerUserId, randomUUID62(), endpointRef, endpointKey, contact.rows[0].id, sender.ciphertext, sender.digest, mask(input.sender), input.occurredAt]
         );
         const route = number.rows[0];
         const conversationRef = stableRef3(
@@ -75802,12 +76530,12 @@ function createPostgresTwilioInboundClaimControlPlane(options) {
 }
 
 // src/api/twilio-inbound-envelope-postgres.ts
-import { createHash as createHash91 } from "crypto";
+import { createHash as createHash92 } from "crypto";
 
 // src/api/twilio-inbound-admission-postgres.ts
-import { createHash as createHash90, randomBytes as randomBytes13, randomUUID as randomUUID62 } from "crypto";
+import { createHash as createHash91, randomBytes as randomBytes13, randomUUID as randomUUID63 } from "crypto";
 function tokenHash4(value) {
-  return createHash90("sha256").update(value).digest("hex");
+  return createHash91("sha256").update(value).digest("hex");
 }
 function rowToRecord(row) {
   return Object.freeze({
@@ -75852,7 +76580,7 @@ function createPostgresTwilioInboundAdmissionControl(options = {}) {
         DO UPDATE SET request_count=assistant.twilio_webhook_rate_buckets.request_count+1,updated_at=EXCLUDED.updated_at
         RETURNING request_count`, [
           input.ownerUserId,
-          randomUUID62(),
+          randomUUID63(),
           input.providerAccountRef,
           input.scope,
           input.subjectKey,
@@ -75886,7 +76614,7 @@ function createPostgresTwilioInboundAdmissionStore(options = {}) {
           provider_message_sid,provider_messaging_service_sid,lane_key,routing_state,payload_digest,protected_envelope,state,attempt,admitted_at`,
           [
             input.ownerUserId,
-            randomUUID62(),
+            randomUUID63(),
             input.ingressRef,
             input.ownerBindingRef,
             input.providerAccountRef,
@@ -75976,7 +76704,7 @@ function createPostgresTwilioInboundAdmissionStore(options = {}) {
 
 // src/api/twilio-inbound-envelope-postgres.ts
 function stableRef4(prefix, identity) {
-  return `${prefix}_${createHash91("sha256").update(identity).digest("hex").slice(0, 32)}`;
+  return `${prefix}_${createHash92("sha256").update(identity).digest("hex").slice(0, 32)}`;
 }
 function parseStoredEnvelope(value) {
   let parsed;
@@ -76190,7 +76918,7 @@ function createPostgresTwilioInboundAdmissionRuntime(options) {
 }
 
 // src/api/twilio-inbound-quarantine-postgres.ts
-import { randomUUID as randomUUID63 } from "crypto";
+import { randomUUID as randomUUID64 } from "crypto";
 function createPostgresTwilioInboundQuarantineAdmissionControl(options = {}) {
   const transaction2 = options.transaction ?? ((work) => withAssistantTransaction((client2) => work(client2)));
   const windowSeconds = options.windowSeconds ?? 60;
@@ -76270,7 +76998,7 @@ function createPostgresTwilioInboundQuarantineStore(options = {}) {
         ) VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,'pending',$11,$12::timestamptz,$13::timestamptz,$14::timestamptz,$14::timestamptz)
         ON CONFLICT DO NOTHING RETURNING ${COLUMNS2}`,
           [
-            randomUUID63(),
+            randomUUID64(),
             input.quarantineRef,
             input.providerAccountDigest,
             input.providerMessageDigest,
@@ -76338,11 +77066,11 @@ function createPostgresTwilioInboundQuarantineStore(options = {}) {
 }
 
 // src/api/twilio-inbound-quarantine.ts
-import { createHash as createHash92, createHmac as createHmac15, timingSafeEqual as timingSafeEqual10 } from "crypto";
+import { createHash as createHash93, createHmac as createHmac15, timingSafeEqual as timingSafeEqual10 } from "crypto";
 var DIGEST7 = /^[a-f0-9]{64}$/u;
 var OPAQUE2 = /^[A-Za-z][A-Za-z0-9_.:-]{2,199}$/u;
 function digest20(value) {
-  return createHash92("sha256").update(value).digest("hex");
+  return createHash93("sha256").update(value).digest("hex");
 }
 function stableRef5(prefix, identity) {
   return `${prefix}_${digest20(identity).slice(0, 32)}`;
@@ -76657,10 +77385,10 @@ async function createPersonalAssistantTwilioTransportProduction(options) {
 }
 
 // src/api/twilio-number-production.ts
-import { createHash as createHash94, randomUUID as randomUUID65 } from "crypto";
+import { createHash as createHash95, randomUUID as randomUUID66 } from "crypto";
 
 // src/api/twilio-number-repository.ts
-import { createHash as createHash93, randomUUID as randomUUID64 } from "crypto";
+import { createHash as createHash94, randomUUID as randomUUID65 } from "crypto";
 var PUBLIC_REF3 = /^[a-z][a-z0-9_]*_[A-Za-z0-9_-]{3,128}$/;
 var DIGEST8 = /^[a-f0-9]{64}$/;
 var ACCOUNT_SID4 = /^AC[0-9a-f]{32}$/i;
@@ -76749,7 +77477,7 @@ function priceValue(value) {
   }), blocker: null });
 }
 function digest21(value) {
-  return createHash93("sha256").update(JSON.stringify(value, (_key, entry) => {
+  return createHash94("sha256").update(JSON.stringify(value, (_key, entry) => {
     if (!entry || typeof entry !== "object" || Array.isArray(entry)) return entry;
     return Object.fromEntries(Object.entries(entry).sort(([a], [b]) => a.localeCompare(b)));
   })).digest("hex");
@@ -76876,7 +77604,7 @@ function createPostgresTwilioNumberOwnerRepository(options) {
   const ownerUserId2 = requireOwner(options.ownerUserId);
   const queryable = options.queryable ?? getAssistantPool();
   const transaction2 = options.transaction ?? ((work) => withAssistantTransaction((client2) => work(client2)));
-  const newId = options.newId ?? randomUUID64;
+  const newId = options.newId ?? randomUUID65;
   const now = options.now ?? (() => /* @__PURE__ */ new Date());
   const snapshot = validateSnapshot(options.resourceSnapshot, ownerUserId2, now());
   async function numberRow(numberRef) {
@@ -77536,13 +78264,13 @@ function createPostgresTwilioNumberProductionAdapters(options) {
 }
 function twilioProviderAccountDigest(providerAccountRef) {
   if (!ACCOUNT_SID4.test(providerAccountRef)) throw new TwilioNumberRepositoryError("invalid_provider_account", "Twilio account assignment is invalid.", 400);
-  return createHash93("sha256").update(providerAccountRef).digest("hex");
+  return createHash94("sha256").update(providerAccountRef).digest("hex");
 }
 
 // src/api/twilio-number-production.ts
 var DIGEST9 = /^[a-f0-9]{64}$/u;
 function hash3(value) {
-  return createHash94("sha256").update(typeof value === "string" ? value : JSON.stringify(value, (_key, entry) => {
+  return createHash95("sha256").update(typeof value === "string" ? value : JSON.stringify(value, (_key, entry) => {
     if (!entry || typeof entry !== "object" || Array.isArray(entry)) return entry;
     return Object.fromEntries(Object.entries(entry).sort(([a], [b]) => a.localeCompare(b)));
   })).digest("hex");
@@ -77795,12 +78523,12 @@ function createPostgresTwilioNumberAuthorityAdapters(options) {
           WHERE approval.owner_user_id=$1 AND approval.state IN ('pending','approved') AND command.owner_user_id=approval.owner_user_id
             AND command.id=approval.command_id AND command.assistant_id=$2`, [ownerUserId2.toString(), row.assistant_id]);
         const authorityEpoch = hash3({ ownerUserId: ownerUserId2.toString(), numberRef: input.numberRef, releaseRef: input.releaseRef, occurredAt: input.occurredAt });
-        const auditRef = `audit_${randomUUID65().replace(/-/g, "")}`;
+        const auditRef = `audit_${randomUUID66().replace(/-/g, "")}`;
         await client2.query(
           `INSERT INTO assistant.audit_events(owner_user_id,id,public_id,assistant_id,actor_kind,event_type,
           operation,decision,reason_code,correlation_id,evidence_digest,details,occurred_at)
           VALUES($1,$2,$3,$4,'system','twilio.number.release.freeze','twilio.number.release','allow','authority_invalidated',$5,$6,$7::jsonb,$8)`,
-          [ownerUserId2.toString(), randomUUID65(), auditRef, row.assistant_id, authorityEpoch, hash3(input.releaseRef), JSON.stringify({ numberRef: input.numberRef, releaseRef: input.releaseRef }), input.occurredAt]
+          [ownerUserId2.toString(), randomUUID66(), auditRef, row.assistant_id, authorityEpoch, hash3(input.releaseRef), JSON.stringify({ numberRef: input.numberRef, releaseRef: input.releaseRef }), input.occurredAt]
         );
         return {
           authorityEpoch,
@@ -77955,7 +78683,7 @@ function createTwilioNumberProductionInterfaces(options) {
 }
 
 // src/api/twilio-number-service.ts
-import { createHash as createHash95, randomUUID as randomUUID66 } from "crypto";
+import { createHash as createHash96, randomUUID as randomUUID67 } from "crypto";
 var DEFAULT_RESERVATION_TTL_MS = 5 * 60 * 1e3;
 var MIN_RESERVATION_TTL_MS = 60 * 1e3;
 var MAX_RESERVATION_TTL_MS = 10 * 60 * 1e3;
@@ -78091,7 +78819,7 @@ function canonicalJson15(value) {
   });
 }
 function digest22(value) {
-  return createHash95("sha256").update(canonicalJson15(value)).digest("hex");
+  return createHash96("sha256").update(canonicalJson15(value)).digest("hex");
 }
 function requireIdempotencyKey(value) {
   if (typeof value !== "string" || !/^[A-Za-z0-9][A-Za-z0-9:._/-]{7,239}$/.test(value)) {
@@ -78212,7 +78940,7 @@ function publicReleaseReceipt(receipt4, replayed = receipt4.replayed) {
 }
 function createTwilioNumberService(dependencies = {}) {
   const now = dependencies.now ?? (() => /* @__PURE__ */ new Date());
-  const newId = dependencies.newId ?? randomUUID66;
+  const newId = dependencies.newId ?? randomUUID67;
   const ttlMs = dependencies.reservationTtlMs ?? DEFAULT_RESERVATION_TTL_MS;
   if (!Number.isInteger(ttlMs) || ttlMs < MIN_RESERVATION_TTL_MS || ttlMs > MAX_RESERVATION_TTL_MS) {
     throw new TwilioNumberServiceError("invalid_configuration", "Number reservation lifetime must be from one through ten minutes.", 500);
@@ -79520,7 +80248,7 @@ function presence(env) {
 }
 function fingerprintDigest(env) {
   const value = env.PA_NEON_BINDING_FINGERPRINT?.trim();
-  return value ? createHash96("sha256").update("personal-assistant-binding-v1\0").update(value).digest("hex") : null;
+  return value ? createHash97("sha256").update("personal-assistant-binding-v1\0").update(value).digest("hex") : null;
 }
 function missingHostedBindings(env) {
   return Object.entries(REQUIRED_HOSTED_BINDINGS).filter(([, variable]) => !env[variable]?.trim()).map(([name]) => `binding_${name}_missing`);
@@ -79753,7 +80481,7 @@ function shouldRunSiteExtractInBackground(input) {
 }
 
 // src/api/page-media-artifacts.ts
-import { createHash as createHash97, randomBytes as randomBytes14 } from "crypto";
+import { createHash as createHash98, randomBytes as randomBytes14 } from "crypto";
 import { homedir as homedir4 } from "os";
 import { basename, extname, join as join9 } from "path";
 import pLimit6 from "p-limit";
@@ -79900,7 +80628,7 @@ async function fetchMedia(rawUrl, expectedType) {
       finalUrl: checked.parsed.href,
       width: dimensions?.width ?? null,
       height: dimensions?.height ?? null,
-      sha256: createHash97("sha256").update(bytes2).digest("hex")
+      sha256: createHash98("sha256").update(bytes2).digest("hex")
     };
   }
   throw new Error("media_redirect_rejected");
@@ -80106,13 +80834,13 @@ async function reconcileSiteExtractSettlements(limit = 25) {
 }
 
 // src/api/page-diff.ts
-import { createHash as createHash98 } from "crypto";
+import { createHash as createHash99 } from "crypto";
 import { diffLines } from "diff";
 var MAX_SNAPSHOT_CONTENT_CHARS = 25e4;
 var MAX_DIFF_HUNKS = 200;
 var MAX_DIFF_LINES_PER_RESPONSE = 2e3;
 function sha256Hex(value) {
-  return createHash98("sha256").update(value).digest("hex");
+  return createHash99("sha256").update(value).digest("hex");
 }
 function truncateForStorage(value, maxChars = MAX_SNAPSHOT_CONTENT_CHARS) {
   if (value.length <= maxChars) return { value, truncated: false };
@@ -80226,10 +80954,10 @@ async function persistScrapeBody(user, opts) {
 }
 
 // src/api/scrape-image-sink.ts
-import { createHash as createHash99 } from "crypto";
+import { createHash as createHash100 } from "crypto";
 var MAX_IMAGES_PER_SCRAPE = 25;
 function idempotencyKey3(userId, vault, input) {
-  return `scrape-image-${createHash99("sha256").update(`${userId}\0${vault}\0${input.sourceKind}\0${input.sourceUrl}\0${input.imageUrl ?? ""}\0${input.imageBase64 ?? ""}`).digest("hex")}`;
+  return `scrape-image-${createHash100("sha256").update(`${userId}\0${vault}\0${input.sourceKind}\0${input.sourceUrl}\0${input.imageUrl ?? ""}\0${input.imageBase64 ?? ""}`).digest("hex")}`;
 }
 async function persistScrapeImagesToMemory(user, inputs, vault) {
   const selected = inputs.slice(0, MAX_IMAGES_PER_SCRAPE);
@@ -80701,7 +81429,7 @@ function inferredWaybackCapturedAt(content) {
 }
 
 // src/api/connection-memory-import.ts
-import { createHash as createHash100 } from "crypto";
+import { createHash as createHash101 } from "crypto";
 var CONNECTION_MEMORY_IMPORT_MAX_ARGS_BYTES = 64 * 1024;
 var CONNECTION_MEMORY_IMPORT_MAX_RESULT_BYTES = 1e6;
 var CONNECTION_MEMORY_IMPORT_MAX_STRING_CHARS = 256e3;
@@ -80731,7 +81459,7 @@ function canonicalJson16(value) {
   return JSON.stringify(value);
 }
 function sha2562(value) {
-  return createHash100("sha256").update(value).digest("hex");
+  return createHash101("sha256").update(value).digest("hex");
 }
 function sensitiveKey(key3) {
   const normalized = key3.toLowerCase().replace(/[^a-z0-9]/g, "");
@@ -81000,7 +81728,7 @@ async function cleanupExpiredScrapeBlobs(maxAgeMs = SCRAPE_BLOB_TTL_MS) {
 }
 
 // src/api/site-export-reader.ts
-import { createHash as createHash101 } from "crypto";
+import { createHash as createHash102 } from "crypto";
 var SiteExportFormatUnavailableError = class extends Error {
   constructor(format) {
     super(`The ${format} representation was not retained for this export page.`);
@@ -81010,7 +81738,7 @@ var SiteExportFormatUnavailableError = class extends Error {
   format;
 };
 function sha2563(value) {
-  return createHash101("sha256").update(value).digest("hex");
+  return createHash102("sha256").update(value).digest("hex");
 }
 function publicPageRecord(page3) {
   const { bodyMarkdown: _body, contentRef: _contentRef, discoveryLinks: _discovery, ...metadata } = page3;
@@ -81120,7 +81848,7 @@ async function readOwnedSiteExportImage(input) {
 }
 
 // src/api/search-console-table-export.ts
-import { randomUUID as randomUUID67 } from "crypto";
+import { randomUUID as randomUUID68 } from "crypto";
 var SEARCH_CONSOLE_TABLE_EXPORT_MAX_ROWS = 5e4;
 var SEARCH_CONSOLE_TABLE_EXPORT_PAGE_SIZE = 2e3;
 var SEARCH_CONSOLE_TABLE_EXPORT_MAX_BYTES = 50 * 1024 * 1024;
@@ -81220,7 +81948,7 @@ async function exportSearchConsoleTableData(args) {
     offset += rows.length;
     if (stoppedForBytes || rows.length < limit || offset >= matchedRows) break;
   }
-  const exportId = randomUUID67();
+  const exportId = randomUUID68();
   const artifact = await args.writeArtifact({
     ownerId: args.ownerId,
     exportId,
@@ -81575,7 +82303,7 @@ async function dbUsage(identity, plan) {
 }
 
 // src/api/resend-control.ts
-import { createHash as createHash102 } from "crypto";
+import { createHash as createHash103 } from "crypto";
 var DEFAULT_CONNECTION_CONTROL_URL = "https://mcp-scraper-scheduler.vercel.app";
 var RESEND_PROVIDER_CONFIG_KEY = "resend";
 var RESEND_LOGO_URL = "https://cdn.resend.com/brand/resend-icon-black.svg";
@@ -81834,7 +82562,7 @@ async function callResendRead(identity, connectionId, tool, args) {
   return isRecord9(data) ? data.result ?? data : data;
 }
 async function callResendAction(identity, connectionId, tool, input, idempotencyKey4) {
-  const requestId = `main-resend-action:${createHash102("sha256").update(identity).update("\0").update(idempotencyKey4.trim()).digest("hex")}`;
+  const requestId = `main-resend-action:${createHash103("sha256").update(identity).update("\0").update(idempotencyKey4.trim()).digest("hex")}`;
   const body3 = await controlRequest2("/api/internal/resend/actions/call", {
     method: "POST",
     headers: { "x-request-id": requestId },
@@ -81998,7 +82726,7 @@ var requirePaidSchedulingTier = createMiddleware5(async (c, next) => {
   if (!hasPaidSchedulingAccess(user)) return c.json(paidPlanRequiredPayload(), 403);
   return next();
 });
-var app = new Hono48();
+var app = new Hono49();
 app.use("*", async (_c, next) => {
   await personalAssistantProductionStartup;
   return next();
@@ -83050,7 +83778,7 @@ app.post("/schedule-connections/actions/gmail/send-message", auth5, requireInteg
   }
   try {
     const result3 = await directGmailService.sendMessage({
-      ownerId: createHash103("sha256").update(user.api_key).digest("hex").slice(0, 24),
+      ownerId: createHash104("sha256").update(user.api_key).digest("hex").slice(0, 24),
       providerIdentity: user.email,
       connectionId,
       to: body3.to,
@@ -83812,7 +84540,7 @@ app.post("/harvest", auth5, async (c) => {
     if (!harvestOk) return c.json(insufficientBalanceResponse(harvestBal, harvestCost), 402);
     jobId2 = await createJob(user.id, options.query, { ...options, billingHoldMc: harvestCost }, body3.callback_url);
   } else {
-    jobId2 = derivedJobId ?? randomUUID68();
+    jobId2 = derivedJobId ?? randomUUID69();
     const billingDebitKey = `paa-harvest:${jobId2}:hold`;
     const description = `PAA harvest: ${options.query}`.slice(0, 500);
     const hold2 = await debitMcIdempotent(
@@ -85367,7 +86095,7 @@ app.get("/cron/tick", async (c) => {
     return c.json({ error: "Unauthorized" }, 401);
   }
   const startedAt = Date.now();
-  const { drainQueue } = await import("./worker-5A375BGN.js");
+  const { drainQueue } = await import("./worker-OQSFSLNG.js");
   const budget = { maxJobs: 10, deadlineMs: startedAt + CRON_TICK_DRAIN_BUDGET_MS };
   const origin = `${new URL(c.req.url).protocol}//${new URL(c.req.url).host}`;
   const unfinished = [];
@@ -85491,8 +86219,8 @@ app.post("/api/internal/extract-refinalize/:id", async (c) => {
     finishExtractJob: finishExtractJob2,
     terminalExtractJobStatus: terminalExtractJobStatus2,
     extractJobLimitInfo: extractJobLimitInfo2
-  } = await import("./site-extract-repository-DWU52BRQ.js");
-  const { assembleExtractArtifacts } = await import("./extract-bundle-NSMGHEG6.js");
+  } = await import("./site-extract-repository-S5FYNFDY.js");
+  const { assembleExtractArtifacts } = await import("./extract-bundle-FALNLKYY.js");
   const existing = await getExtractJob2(jobId2);
   if (!existing) return c.json({ error: "job not found" }, 404);
   if (existing.status !== "failed") {
@@ -85519,7 +86247,7 @@ app.post("/api/internal/extract-refinalize/:id", async (c) => {
   if (!updated) return c.json({ error: "job state changed during re-finalization" }, 409);
   let settlement = "already_settled_or_refunded";
   if (job.billedMc == null && job.userId != null) {
-    const { settleExtractJob: settleExtractJob3, countSuccessfulPages: countSuccessfulPages2 } = await import("./site-extract-repository-DWU52BRQ.js");
+    const { settleExtractJob: settleExtractJob3, countSuccessfulPages: countSuccessfulPages2 } = await import("./site-extract-repository-S5FYNFDY.js");
     const heldMc = Number(job.options.heldMc ?? 0);
     const successful = await countSuccessfulPages2(jobId2);
     const usedMc = Math.min(successful * MC_COSTS.page_scrape, heldMc);
@@ -85575,6 +86303,8 @@ app.route("/workshops", workshopRegistrationApp);
 app.route("/editorial-reading-room", editorialReadingRoomApp);
 app.route("/commons", commonsApp);
 app.route("/analytics", analyticsApp);
+app.route("/crm", crmApp);
+app.route("/research", researchApp);
 app.route("/", scheduledResultApp);
 app.route("/public", publicScheduledResultApp);
 app.route("/api/internal/scheduled-artifacts", scheduledArtifactInternalApp);