@anuma/sdk 10.9.0 → 10.10.0

package/dist/expo/{chunk-4SOUKJD5.mjs → chunk-VNTEHEGI.mjs}

@@ -43,1036 +43,1036 @@ function getLogger() {
   return getLoggerState().logger;
 }
 
-// src/lib/pii/patterns.ts
-function luhnCheck(digits) {
-  let sum = 0;
-  let alternate = false;
-  for (let i = digits.length - 1; i >= 0; i--) {
-    let n = parseInt(digits[i], 10);
-    if (alternate) {
-      n *= 2;
-      if (n > 9) n -= 9;
-    }
-    sum += n;
-    alternate = !alternate;
+// src/lib/chat/endpointOverride.ts
+function validateEndpointOverride(override) {
+  const trimmed = override.trim();
+  if (trimmed === "") {
+    return {
+      valid: false,
+      message: 'endpointOverride must be a non-empty, root-relative path (e.g. "/api/v1/utility/responses"); received an empty or whitespace-only string'
+    };
   }
-  return sum % 10 === 0;
+  if (trimmed.startsWith("//") || trimmed.includes("://")) {
+    return {
+      valid: false,
+      message: `endpointOverride must be a root-relative path (e.g. "/api/v1/utility/responses"), not a protocol-relative or absolute URL; received "${trimmed}"`
+    };
+  }
+  return { valid: true, endpoint: trimmed.startsWith("/") ? trimmed : `/${trimmed}` };
 }
-var PII_PATTERNS = [
-  {
-    category: "EMAIL",
-    regex: /\b[a-zA-Z0-9._%+-]{1,64}@[a-zA-Z0-9.-]{1,255}\.[a-zA-Z]{2,24}\b/g
-  },
-  {
-    category: "SSN",
-    regex: /\b\d{3}-\d{2}-\d{4}\b/g,
-    validate: (match) => {
-      const parts = match.split("-");
-      const area = parseInt(parts[0], 10);
-      return area !== 0 && area !== 666 && area < 900;
+
+// src/lib/internalFlowMarker.ts
+var INTERNAL_FLOW_MARKER = "Anuma internal first-party flow (not user chat).";
+function withInternalFlowMarker(systemPrompt) {
+  if (systemPrompt.includes(INTERNAL_FLOW_MARKER)) return systemPrompt;
+  return `${INTERNAL_FLOW_MARKER}
+${systemPrompt}`;
+}
+
+// src/lib/taskType.ts
+var TASK_TYPE_HEADER = "X-Anuma-Task-Type";
+function taskTypeHeader(taskType) {
+  return taskType ? { [TASK_TYPE_HEADER]: taskType } : {};
+}
+
+// src/lib/memory/portalLlm.ts
+function defaultBaseUrl() {
+  return typeof process !== "undefined" && process.env?.ANUMA_PORTAL_BASE_URL || BASE_URL;
+}
+var RESPONSE_FORMAT_OK = /* @__PURE__ */ new Set(["openai", "inclusionai", "deepseek"]);
+var RESPONSE_SCHEMA_OK = /* @__PURE__ */ new Set(["openai"]);
+var JSON_CONTRACT_REMINDER = "Output ONLY the strict JSON object requested. No prose, no explanation, no markdown.";
+function supportsResponseFormat(model, variant = "json_object") {
+  const allow = variant === "json_schema" ? RESPONSE_SCHEMA_OK : RESPONSE_FORMAT_OK;
+  return model.split("/").some((seg) => allow.has(seg));
+}
+var RESPONSES_ONLY_MODEL_PREFIXES = ["gpt-5.6", "gpt-6-sol", "gpt-6-luna", "gpt-6-astra"];
+function requiresResponsesTransport(model) {
+  return model.split("/").some((seg) => RESPONSES_ONLY_MODEL_PREFIXES.some((prefix) => seg.startsWith(prefix)));
+}
+var CHAT_TO_RESPONSES_FIELDS = {
+  max_completion_tokens: "max_output_tokens"
+};
+function responsesExtra(extra) {
+  if (!extra) return {};
+  const out = {};
+  for (const [key, value] of Object.entries(extra)) {
+    const target = CHAT_TO_RESPONSES_FIELDS[key] ?? key;
+    if (target !== key && target in extra) continue;
+    out[target] = value;
+  }
+  return out;
+}
+function splitEndpoint(endpoint) {
+  const cut = endpoint.search(/[?#]/);
+  const rawPath = cut === -1 ? endpoint : endpoint.slice(0, cut);
+  return {
+    path: rawPath.replace(/\/+$/, ""),
+    rest: cut === -1 ? "" : endpoint.slice(cut)
+  };
+}
+var FOREIGN_ENDPOINT_SUFFIX = {
+  chat: "/responses",
+  responses: "/chat/completions"
+};
+function endpointForTransport(endpoint, transport) {
+  const { path, rest } = splitEndpoint(endpoint);
+  const foreign = FOREIGN_ENDPOINT_SUFFIX[transport];
+  if (!path.endsWith(foreign)) return endpoint;
+  const own = FOREIGN_ENDPOINT_SUFFIX[transport === "chat" ? "responses" : "chat"];
+  return `${path.slice(0, -foreign.length)}${own}${rest}`;
+}
+function assertTransportMatchesEndpoint(transport, endpoint) {
+  const foreign = FOREIGN_ENDPOINT_SUFFIX[transport];
+  if (!splitEndpoint(endpoint).path.endsWith(foreign)) return;
+  throw new Error(
+    `endpointOverride "${endpoint}" is the other transport's endpoint, but transport is "${transport}". The request body is built for the transport, so this sends the wrong shape and 400s without retry.`
+  );
+}
+var TIME_BUDGET_EXHAUSTED = {
+  kind: "terminal",
+  code: "time-budget-exhausted",
+  reason: "time budget exhausted"
+};
+var MAX_TIMER_DELAY_MS = 2147483647;
+var RETRYABLE_HTTP = /* @__PURE__ */ new Set([408, 409, 425, 429]);
+function isRetryableStatus(status) {
+  return status >= 500 || RETRYABLE_HTTP.has(status);
+}
+function parseRetryAfterMs(header) {
+  if (!header) return null;
+  const secs = Number(header);
+  if (Number.isFinite(secs)) return Math.max(0, secs * 1e3);
+  const dateMs = Date.parse(header);
+  if (Number.isFinite(dateMs)) return Math.max(0, dateMs - Date.now());
+  return null;
+}
+function defaultBackoffMs(attempt) {
+  const base = Math.min(2e3, 250 * 2 ** (attempt - 1));
+  return base + Math.floor(Math.random() * 100);
+}
+function sleep(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+async function resolvePortalAuthHeaders(auth, tag) {
+  if (auth.apiKey) {
+    return { "x-api-key": auth.apiKey };
+  }
+  if (auth.getToken) {
+    let token;
+    try {
+      token = await auth.getToken();
+    } catch (err) {
+      getLogger().warn(`[${tag}] getToken threw`, err);
+      return null;
     }
-  },
-  {
-    category: "SSN",
-    regex: /\b\d{3}[ ]?\d{2}[ ]?\d{4}\b/g,
-    context: /(?:\bssn\b|\bsocial\s+security(?:\s+(?:number|no\.?|#))?\b)[^\d\n]{0,12}$/i,
-    validate: (match) => {
-      const digits = match.replace(/\D/g, "");
-      if (digits.length !== 9) return false;
-      const area = parseInt(digits.slice(0, 3), 10);
-      return area !== 0 && area !== 666 && area < 900;
+    if (!token) {
+      getLogger().warn(`[${tag}] getToken returned no token`);
+      return null;
     }
-  },
-  {
-    category: "CREDIT_CARD",
-    regex: /\b\d{4}[\s-]\d{4}[\s-]\d{4}[\s-]\d{1,7}\b|\b\d{13,19}\b/g,
-    validate: (match) => {
-      const digits = match.replace(/\D/g, "");
-      if (digits.length < 13 || digits.length > 19) return false;
-      return luhnCheck(digits);
+    return { Authorization: `Bearer ${token}` };
+  }
+  throw new Error(`[${tag}] Either apiKey or getToken must be provided`);
+}
+async function callPortalJsonCompletion(req) {
+  const log = getLogger();
+  const transport = req.transport ?? (requiresResponsesTransport(req.model) ? "responses" : "chat");
+  const autoUpgraded = req.transport === void 0 && transport === "responses";
+  let endpoint = transport === "responses" ? "/api/v1/responses" : "/api/v1/chat/completions";
+  if (req.endpointOverride !== void 0) {
+    const overrideValidation = validateEndpointOverride(req.endpointOverride);
+    if (!overrideValidation.valid) {
+      throw new Error(overrideValidation.message);
     }
-  },
-  {
-    category: "IP_ADDRESS",
-    regex: /\b(?:(?:25[0-5]|2[0-4]\d|[01]?\d\d?)\.){3}(?:25[0-5]|2[0-4]\d|[01]?\d\d?)\b/g,
-    validate: (match) => {
-      return match !== "0.0.0.0" && match !== "127.0.0.1" && match !== "255.255.255.255";
+    endpoint = overrideValidation.endpoint;
+    if (autoUpgraded) endpoint = endpointForTransport(endpoint, transport);
+    assertTransportMatchesEndpoint(transport, endpoint);
+  }
+  const maxAttempts = Math.max(1, req.maxAttempts ?? 3);
+  const startedAt = Date.now();
+  const deadlineAt = req.totalTimeoutMs === void 0 ? void 0 : startedAt + req.totalTimeoutMs;
+  const overBudget = () => deadlineAt !== void 0 && Date.now() >= deadlineAt;
+  let lastFailure;
+  let reinforce = false;
+  const giveUp = () => {
+    req.onFailure?.(lastFailure ?? { reason: "network", attempts: maxAttempts });
+    return null;
+  };
+  for (let attempt = 1; attempt <= maxAttempts; attempt++) {
+    if (attempt > 1 && overBudget()) {
+      log.warn(`[${req.tag}] over time budget before attempt ${attempt}, giving up`);
+      lastFailure = { reason: "time-budget-exhausted", attempts: attempt - 1 };
+      break;
     }
-  },
-  {
-    category: "IP_ADDRESS",
-    regex: /(?:(?:[0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}|(?:[0-9a-fA-F]{1,4}:){1,7}:|(?:[0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|(?:[0-9a-fA-F]{1,4}:){1,5}(?::[0-9a-fA-F]{1,4}){1,2}|(?:[0-9a-fA-F]{1,4}:){1,4}(?::[0-9a-fA-F]{1,4}){1,3}|(?:[0-9a-fA-F]{1,4}:){1,3}(?::[0-9a-fA-F]{1,4}){1,4}|(?:[0-9a-fA-F]{1,4}:){1,2}(?::[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:(?::[0-9a-fA-F]{1,4}){1,6}|:(?:(?::[0-9a-fA-F]{1,4}){1,7}|:))/g,
-    validate: (match) => match !== "::1" && match !== "::"
-  },
-  {
-    category: "PHONE",
-    regex: /(?:\+\d{1,3}[\s.-])?\(?\d{3}\)?[\s.-]\d{3}[\s.-]\d{4}\b|\+\d{10,15}\b/g
-  },
-  {
-    category: "API_KEY",
-    regex: /\b(?:sk|pk|api|key|token|secret|bearer|access)[_-]?[a-zA-Z0-9_-]{20,}\b/gi,
-    validate: (match) => {
-      const hasDigit = /\d/.test(match);
-      const hasMixedCase = /[a-z]/.test(match) && /[A-Z]/.test(match);
-      return hasDigit || hasMixedCase;
+    const attemptReq = reinforce ? { ...req, reinforceJsonContract: true } : req;
+    const outcome = await attemptPortalJson(
+      { ...attemptReq, transport },
+      endpoint,
+      deadlineAt
+    );
+    if (outcome.kind === "ok") {
+      req.onAttempt?.({ attempt, ok: true });
+      return outcome.value;
     }
-  },
-  {
-    category: "US_ADDRESS",
-    regex: /\b\d{1,5}[ \t]+(?:[A-Z][a-z]+[ \t]+){1,3}(?:St(?:reet)?|Ave(?:nue)?|Blvd|Boulevard|Dr(?:ive)?|Ln|Lane|Rd|Road|Ct|Court|Pl(?:ace)?|Way|Cir(?:cle)?|Pkwy|Parkway|Hwy|Highway)\.?(?=[\s,.;:!?)]|$)/g,
-    validate: (match) => {
-      return !/^0/.test(match.trim());
+    req.onAttempt?.({
+      attempt,
+      ok: false,
+      reason: outcome.code,
+      ...outcome.httpStatus !== void 0 && { httpStatus: outcome.httpStatus }
+    });
+    lastFailure = {
+      reason: outcome.code,
+      ...outcome.httpStatus !== void 0 && { httpStatus: outcome.httpStatus },
+      attempts: attempt
+    };
+    if (outcome.code === "invalid-json" || outcome.code === "null-completion") reinforce = true;
+    if (outcome.kind === "terminal") {
+      log.warn(`[${req.tag}] ${outcome.reason}`);
+      return giveUp();
     }
-  },
-  {
-    category: "DATE_OF_BIRTH",
-    regex: /\b(?:(?:0?[1-9]|1[0-2])[/-](?:0?[1-9]|[12]\d|3[01])[/-](?:19|20)\d{2})\b/g,
-    context: /(?:\bdob\b|\bd\.?o\.?b\.?|\bborn\b|\bbirth\s?date\b|\bbirthdate\b|\bbirthday\b|\bdate\s+of\s+birth\b)[^\d\n]{0,12}$/i,
-    validate: (match) => {
-      const m = match.match(/(\d{1,2})[/-](\d{1,2})[/-](\d{4})/);
-      if (!m) return false;
-      const month = parseInt(m[1], 10);
-      const day = parseInt(m[2], 10);
-      const year = parseInt(m[3], 10);
-      const isLeap = year % 4 === 0 && (year % 100 !== 0 || year % 400 === 0);
-      const daysInMonth = [31, isLeap ? 29 : 28, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31];
-      return month >= 1 && month <= 12 && day >= 1 && day <= daysInMonth[month - 1];
+    if (attempt >= maxAttempts) {
+      log.warn(`[${req.tag}] ${outcome.reason} \u2014 attempt ${attempt}/${maxAttempts}, giving up`);
+      break;
     }
-  }
-];
-
-// src/lib/pii/redactor.ts
-function escapeRegExp(value) {
-  return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-}
-function isWordChar(ch) {
-  return /[A-Za-z0-9_]/.test(ch) || ch.charCodeAt(0) > 127;
-}
-var PiiRedactor = class {
-  constructor(options = {}) {
-    this.disposed = false;
-    /** Maps original PII value → placeholder tag. */
-    this.valueToPlaceholder = /* @__PURE__ */ new Map();
-    /** Maps placeholder tag → original PII value (reverse lookup for de-anonymization). */
-    this.placeholderToValue = /* @__PURE__ */ new Map();
-    /** Next index per category for placeholder numbering. */
-    this.categoryCounters = /* @__PURE__ */ new Map();
-    /**
-     * Matches any placeholder-shaped token for this redactor's categories —
-     * bracketed `[EMAIL_1]` OR bare `EMAIL_1`, case-insensitive — capturing the
-     * body. Drives {@link restoreForStorage}: the extraction / consolidation
-     * models echo placeholders mangled (brackets dropped, re-cased), and a single
-     * pass with this matcher restores the assigned ones and flags the rest in one
-     * go. Built lazily from the union of pattern categories AND any categories
-     * minted at runtime (e.g. NER `PERSON`/`LOCATION`/`ORG`): `undefined` = stale
-     * (rebuild on next use), `null` = built but there are no categories.
-     */
-    this.storagePattern = void 0;
-    /**
-     * Cached body→value lookups for {@link restoreForStorage}, built lazily from
-     * the assigned placeholders and invalidated on each mint. `exact` is keyed by
-     * the literal body (collision-proof); `ci` by upper-cased body for re-cased
-     * echoes, minus any `ciCollisions` where two distinct bodies share a form.
-     */
-    this.storageLookup = null;
-    /** Whether the non-text-content bypass warning has already been emitted. */
-    this.warnedNonText = false;
-    /** Whether the NER-detector-failure warning has already been emitted. */
-    this.warnedNerFailure = false;
-    this.nerDetector = options.nerDetector;
-    if (options.patterns) {
-      this.patterns = options.patterns;
-    } else {
-      let base = PII_PATTERNS;
-      if (options.excludeCategories?.length) {
-        const excluded = new Set(options.excludeCategories);
-        base = base.filter((p) => !excluded.has(p.category));
-      }
-      this.patterns = options.extraPatterns ? [...base, ...options.extraPatterns] : base;
+    const backoff = (req.backoffMs ?? defaultBackoffMs)(attempt);
+    const delay = Math.max(backoff, outcome.retryAfterMs ?? 0);
+    if (overBudget() || req.totalTimeoutMs !== void 0 && Date.now() - startedAt + delay >= req.totalTimeoutMs) {
+      log.warn(
+        `[${req.tag}] ${outcome.reason} \u2014 attempt ${attempt}/${maxAttempts}, over time budget, giving up`
+      );
+      lastFailure = { reason: "time-budget-exhausted", attempts: attempt };
+      break;
     }
-    this.patternCategories = [...new Set(this.patterns.map((p) => String(p.category)))];
+    log.warn(`[${req.tag}] ${outcome.reason} \u2014 attempt ${attempt}/${maxAttempts}, retrying`);
+    if (delay > 0) await sleep(delay);
   }
-  /**
-   * Build the {@link storagePattern} from the union of pattern categories and
-   * any categories minted at runtime (NER entities arrive only when redaction
-   * runs, so this can't be fixed at construction). Bracketed `[EMAIL_1]` OR
-   * bare `EMAIL_1`, capturing the body, case-insensitive, global. `\d+` (not a
-   * fixed body) spans any index; `\b` on the bare arm keeps it off prose like
-   * "email 1 of 3".
-   */
-  buildStoragePattern() {
-    const categories = [.../* @__PURE__ */ new Set([...this.patternCategories, ...this.categoryCounters.keys()])];
-    if (categories.length === 0) return null;
-    const categoryAlt = categories.sort((a, b) => b.length - a.length).map(escapeRegExp).join("|");
-    return new RegExp(`\\[((?:${categoryAlt})_\\d+)\\]|\\b((?:${categoryAlt})_\\d+)\\b`, "gi");
+  return giveUp();
+}
+async function attemptPortalJson(req, endpoint, deadlineAt) {
+  const controller = new AbortController();
+  if (deadlineAt === void 0 || deadlineAt - Date.now() > MAX_TIMER_DELAY_MS) {
+    return requestPortalJson(req, endpoint, controller);
   }
-  /**
-   * Returns the current number of unique PII values tracked.
-   */
-  get size() {
-    return this.valueToPlaceholder.size;
+  const remainingMs = deadlineAt - Date.now();
+  if (remainingMs <= 0) return TIME_BUDGET_EXHAUSTED;
+  let timer;
+  try {
+    const outcome = await Promise.race([
+      new Promise((resolve) => {
+        timer = setTimeout(() => {
+          resolve(TIME_BUDGET_EXHAUSTED);
+          controller.abort();
+        }, remainingMs);
+      }),
+      requestPortalJson(req, endpoint, controller, deadlineAt)
+    ]);
+    return Date.now() >= deadlineAt ? TIME_BUDGET_EXHAUSTED : outcome;
+  } finally {
+    clearTimeout(timer);
   }
-  /**
-   * Returns a snapshot of all placeholder → original value mappings.
-   * Useful for debugging or UI display. This is a copy — mutating it (or
-   * later redactions) does not affect the returned map and vice versa.
-   */
-  getMappings() {
-    return new Map(this.placeholderToValue);
+}
+async function requestPortalJson(req, endpoint, controller, deadlineAt) {
+  const baseUrl = req.baseUrl ?? defaultBaseUrl();
+  const fetchImpl = req.fetchFn ?? fetch;
+  const authHeaders = await resolvePortalAuthHeaders(req, req.tag);
+  const remainingMs = deadlineAt === void 0 ? Infinity : deadlineAt - Date.now();
+  if (controller.signal.aborted || remainingMs <= 0) return TIME_BUDGET_EXHAUSTED;
+  if (authHeaders === null)
+    return { kind: "terminal", code: "auth-unavailable", reason: "auth unavailable (no token)" };
+  const timeoutMs = Math.min(req.timeoutMs ?? 6e4, remainingMs);
+  const usesPrefill = req.transport !== "responses" && req.model.startsWith("anthropic/");
+  const prefill = usesPrefill ? "{" : "";
+  const messages = [
+    { role: "system", content: withInternalFlowMarker(req.systemPrompt) },
+    ...req.reinforceJsonContract ? [{ role: "system", content: JSON_CONTRACT_REMINDER }] : [],
+    { role: "user", content: req.userMessage }
+  ];
+  if (prefill) messages.push({ role: "assistant", content: prefill });
+  const supportsJsonObjectFormat = supportsResponseFormat(req.model);
+  const timer = setTimeout(() => controller.abort(), timeoutMs);
+  const requestBody = req.transport === "responses" ? {
+    model: req.model,
+    input: messages,
+    ...req.reasoning && { reasoning: req.reasoning },
+    ...responsesExtra(req.extra)
+  } : {
+    model: req.model,
+    messages,
+    ...supportsJsonObjectFormat && { response_format: { type: "json_object" } },
+    ...req.extra
+  };
+  if (req.transport === "responses" || !supportsJsonObjectFormat) {
+    delete requestBody.response_format;
   }
-  /**
-   * Get or create a placeholder for a PII value.
-   * The same value always gets the same placeholder within a redactor instance.
-   */
-  getPlaceholder(category, value) {
-    if (this.disposed) throw new Error("PII redactor session ended");
-    const normalizedValue = value.trim();
-    const existing = this.valueToPlaceholder.get(normalizedValue);
-    if (existing) return existing;
-    const existingCount = this.categoryCounters.get(category);
-    const count = (existingCount ?? 0) + 1;
-    this.categoryCounters.set(category, count);
-    if (existingCount === void 0) this.storagePattern = void 0;
-    const placeholder = `[${category}_${count}]`;
-    this.valueToPlaceholder.set(normalizedValue, placeholder);
-    this.placeholderToValue.set(placeholder, normalizedValue);
-    this.storageLookup = null;
-    return placeholder;
+  let response;
+  try {
+    response = await fetchImpl(`${baseUrl}${endpoint}`, {
+      method: "POST",
+      headers: {
+        ...authHeaders,
+        ...taskTypeHeader(req.taskType),
+        "Content-Type": "application/json"
+      },
+      body: JSON.stringify(requestBody),
+      signal: controller.signal
+    });
+  } catch (err) {
+    clearTimeout(timer);
+    return {
+      kind: "retryable",
+      code: "network",
+      reason: `fetch failed: ${err.message}`
+    };
   }
-  /**
-   * Find all matches of a single pattern in `text`, applying its `validate` and
-   * `context` guards. Matches are non-overlapping and ascending (the global
-   * regex advances `lastIndex` past each match). Shared by the sync {@link scan}
-   * (sequential, per-pattern) and the async {@link collectRegexSpans} (span)
-   * paths so the detection rules live in exactly one place.
-   */
-  findMatches(text, pattern) {
-    const regex = new RegExp(pattern.regex.source, pattern.regex.flags);
-    const found = [];
-    let m;
-    while ((m = regex.exec(text)) !== null) {
-      const value = m[0];
-      if (pattern.validate && !pattern.validate(value)) continue;
-      if (pattern.context) {
-        const before = text.slice(Math.max(0, m.index - 40), m.index);
-        if (!pattern.context.test(before)) continue;
-      }
-      found.push({ match: value, index: m.index });
+  if (!response.ok) {
+    clearTimeout(timer);
+    const reason = `portal returned ${response.status}`;
+    if (response.status === 401) {
+      const tokenAuth = !req.apiKey && !!req.getToken;
+      return tokenAuth ? {
+        kind: "retryable",
+        code: "http-retryable",
+        reason: `${reason} (token may be expired; refreshing)`,
+        httpStatus: response.status
+      } : { kind: "terminal", code: "http-terminal", reason, httpStatus: response.status };
     }
-    return found;
+    if (!isRetryableStatus(response.status))
+      return { kind: "terminal", code: "http-terminal", reason, httpStatus: response.status };
+    const retryAfterMs = parseRetryAfterMs(response.headers.get("retry-after"));
+    return {
+      kind: "retryable",
+      code: "http-retryable",
+      reason,
+      httpStatus: response.status,
+      ...retryAfterMs !== null && { retryAfterMs }
+    };
   }
-  /**
-   * Scan text for PII and rebuild it, replacing each match with whatever
-   * `makeReplacement(category, value)` returns. Shared by `redactText`
-   * (numbered, stateful placeholders) and `maskText` (unnumbered, stateless).
-   *
-   * Patterns are applied sequentially: each scans the text already rewritten by
-   * earlier patterns, so an earlier (more specific) pattern claims a region
-   * before a later one can — placeholders are inert and match no pattern.
-   */
-  scan(text, makeReplacement) {
-    const matches = [];
-    let redacted = text;
-    for (const pattern of this.patterns) {
-      const found = this.findMatches(redacted, pattern);
-      if (found.length === 0) continue;
-      let result = "";
-      let cursor = 0;
-      for (const { match, index } of found) {
-        const placeholder = makeReplacement(pattern.category, match);
-        matches.push({ category: pattern.category, original: match, placeholder });
-        result += redacted.slice(cursor, index) + placeholder;
-        cursor = index + match.length;
-      }
-      result += redacted.slice(cursor);
-      redacted = result;
-    }
-    return { text: redacted, matches };
+  let body;
+  try {
+    body = await response.json();
+  } catch (err) {
+    clearTimeout(timer);
+    return {
+      kind: "retryable",
+      code: "body-parse-failed",
+      reason: `response body parse failed: ${err.message}`
+    };
   }
-  /**
-   * Scan and redact PII from a single text string, using numbered, reversible
-   * placeholders ([EMAIL_1], …) tracked on this instance.
-   */
-  redactText(text) {
-    return this.scan(text, (category, value) => this.getPlaceholder(category, value));
+  clearTimeout(timer);
+  logPortalUsage(body, req.tag);
+  if (isModerationResponse(body)) {
+    return {
+      kind: "terminal",
+      code: "content-flagged",
+      reason: "portal moderation refused the request"
+    };
   }
-  /**
-   * Mask PII with unnumbered, NON-reversible tokens ([EMAIL], [SSN], …) without
-   * mutating this instance's state. Use for one-way purposes where the value is
-   * never restored — notably embedding inputs: it keeps real PII off the
-   * embeddings endpoint while staying deterministic, so the same content always
-   * masks identically and search stays consistent across conversations.
-   */
-  maskText(text) {
-    return this.scan(text, (category) => `[${category}]`).text;
+  const rawContent = extractCompletionContent(body);
+  if (!rawContent) {
+    return {
+      kind: "retryable",
+      code: "empty-content",
+      reason: "portal response had no completion content"
+    };
   }
-  /** All regex matches as spans on the ORIGINAL text (priority 0). Uses the
-   *  same {@link findMatches} guards as the sync scan. */
-  collectRegexSpans(text) {
-    const spans = [];
-    this.patterns.forEach((pattern, patternIndex) => {
-      for (const { match, index } of this.findMatches(text, pattern)) {
-        spans.push({
-          start: index,
-          end: index + match.length,
-          category: pattern.category,
-          priority: 0,
-          order: patternIndex
-        });
-      }
-    });
-    return spans;
+  const looksLikeContinuation = prefill && /^\s*"/.test(rawContent);
+  const content = looksLikeContinuation ? prefill + rawContent : rawContent;
+  const candidate = extractJsonCandidate(content);
+  let value;
+  try {
+    value = JSON.parse(candidate);
+  } catch {
+    return {
+      kind: "retryable",
+      code: "invalid-json",
+      reason: "invalid-json"
+    };
   }
-  /**
-   * Normalize raw NER spans: clamp to the text bounds, drop empty/categoryless
-   * spans, and snap each to whole-word boundaries. Snapping prevents a detector
-   * that tagged only part of a word (a common WordPiece artifact — e.g. "Strip"
-   * of "Stripe") from producing a corrupting partial placeholder like
-   * `[ORG_1]e`.
-   */
-  normalizeNerSpans(text, raw) {
-    if (!Array.isArray(raw)) return [];
-    const out = [];
-    raw.forEach((s, i) => {
-      if (!Number.isFinite(s.start) || !Number.isFinite(s.end)) return;
-      let start = Math.max(0, Math.min(Math.trunc(s.start), text.length));
-      let end = Math.max(0, Math.min(Math.trunc(s.end), text.length));
-      if (end <= start) return;
-      while (start > 0 && isWordChar(text[start - 1])) start--;
-      while (end < text.length && isWordChar(text[end])) end++;
-      const category = String(s.category ?? "").trim();
-      if (!category) return;
-      out.push({ start, end, category, priority: 1, order: i });
-    });
-    return out;
+  if (value === null) {
+    return { kind: "retryable", code: "null-completion", reason: "completion parsed to null" };
   }
-  /** Run the configured detector defensively: failures degrade to regex-only
-   *  (fail-open on detection, not on protection) with a one-time warning. */
-  async detectNerSpans(text) {
-    if (!this.nerDetector) return [];
-    try {
-      return this.normalizeNerSpans(text, await this.nerDetector.detect(text));
-    } catch (err) {
-      this.warnNerFailure(err);
-      return [];
+  return { kind: "ok", value };
+}
+function extractJsonCandidate(raw) {
+  const trimmed = raw.trim();
+  const fence = trimmed.match(/```(?:json)?\s*([\s\S]*?)```/i);
+  const body = fence ? fence[1].trim() : trimmed;
+  const start = body.search(/[{[]/);
+  if (start < 0) return body;
+  const open = body[start];
+  const close = open === "{" ? "}" : "]";
+  let depth = 0;
+  let inString = false;
+  let escape = false;
+  for (let i = start; i < body.length; i++) {
+    const ch = body[i];
+    if (escape) {
+      escape = false;
+      continue;
     }
-  }
-  /**
-   * Resolve overlaps by placing higher-priority spans first and dropping any
-   * span that overlaps one already placed. Regex (priority 0) is placed before
-   * NER (priority 1), and within regex by ascending pattern index — so regex
-   * always wins on overlap and the regex-only result reproduces the sync scan's
-   * sequential "earlier pattern wins". O(n²) but n (spans per message) is tiny.
-   *
-   * The returned spans stay in `(priority, order, start)` order — i.e. mint
-   * order — which {@link rebuildSpans} relies on.
-   */
-  resolveOverlaps(spans) {
-    const ordered = [...spans].sort(
-      (a, b) => a.priority - b.priority || a.order - b.order || a.start - b.start
-    );
-    const placed = [];
-    for (const s of ordered) {
-      if (!placed.some((p) => s.start < p.end && p.start < s.end)) placed.push(s);
+    if (ch === "\\" && inString) {
+      escape = true;
+      continue;
     }
-    return placed;
-  }
-  /**
-   * Rebuild `text` from resolved (non-overlapping) spans. `spans` must arrive in
-   * mint order — `(priority, order, start)`, as {@link resolveOverlaps} returns —
-   * so placeholders are MINTED by iterating it directly (regex categories first,
-   * in pattern then document order, matching the sync scan's numbering). The
-   * string is then EMITTED in document order.
-   */
-  rebuildSpans(text, spans, makeReplacement) {
-    const placeholderByStart = /* @__PURE__ */ new Map();
-    const matches = [];
-    for (const s of spans) {
-      const value = text.slice(s.start, s.end);
-      const placeholder = makeReplacement(s.category, value);
-      placeholderByStart.set(s.start, placeholder);
-      matches.push({ category: s.category, original: value, placeholder });
+    if (ch === '"') {
+      inString = !inString;
+      continue;
     }
-    const emitOrder = [...spans].sort((a, b) => a.start - b.start);
-    let result = "";
-    let cursor = 0;
-    for (const s of emitOrder) {
-      result += text.slice(cursor, s.start) + (placeholderByStart.get(s.start) ?? "");
-      cursor = s.end;
+    if (inString) continue;
+    if (ch === open) depth++;
+    else if (ch === close) {
+      depth--;
+      if (depth === 0) return body.slice(start, i + 1);
     }
-    result += text.slice(cursor);
-    return { text: result, matches };
   }
-  /** Merge regex + NER spans for `text` into a resolved, non-overlapping set. */
-  async detectAllSpans(text) {
-    const nerPromise = this.detectNerSpans(text);
-    const regexSpans = this.collectRegexSpans(text);
-    const ner = await nerPromise;
-    return this.resolveOverlaps([...regexSpans, ...ner]);
+  return body;
+}
+function asRecord(value) {
+  return typeof value === "object" && value !== null ? value : void 0;
+}
+function asCount(value) {
+  return typeof value === "number" && Number.isFinite(value) ? value : void 0;
+}
+function logPortalUsage(body, tag) {
+  try {
+    const root = asRecord(body);
+    if (!root) return;
+    const usage = asRecord(root.usage);
+    const promptTokens = asCount(usage?.prompt_tokens) ?? asCount(usage?.input_tokens);
+    const completionTokens = asCount(usage?.completion_tokens) ?? asCount(usage?.output_tokens);
+    if (promptTokens === void 0 && completionTokens === void 0) return;
+    const cachedTokens = asCount(asRecord(root.portal)?.cached_tokens) ?? asCount(asRecord(usage?.prompt_tokens_details)?.cached_tokens) ?? asCount(asRecord(usage?.input_tokens_details)?.cached_tokens) ?? 0;
+    const reasoningTokens = asCount(asRecord(usage?.output_tokens_details)?.reasoning_tokens) ?? asCount(asRecord(usage?.completion_tokens_details)?.reasoning_tokens);
+    const parts = [];
+    if (promptTokens !== void 0) parts.push(`prompt=${promptTokens}`);
+    if (completionTokens !== void 0) parts.push(`completion=${completionTokens}`);
+    if (reasoningTokens !== void 0) parts.push(`reasoning=${reasoningTokens}`);
+    parts.push(`cached=${cachedTokens}`);
+    getLogger().debug(`[${tag}] usage ${parts.join(" ")}`);
+  } catch {
   }
-  /**
-   * Async counterpart to {@link redactText}: redacts structured PII (regex) AND
-   * unstructured PII (the configured {@link NerDetector}) with numbered,
-   * reversible placeholders. With no detector, identical to `redactText`.
-   */
-  async redactTextAsync(text) {
-    if (!this.nerDetector) return this.redactText(text);
-    const spans = await this.detectAllSpans(text);
-    return this.rebuildSpans(
-      text,
-      spans,
-      (category, value) => this.getPlaceholder(category, value)
-    );
+}
+function isModerationResponse(body) {
+  return typeof body === "object" && body !== null && body.id === "moderation";
+}
+function extractCompletionContent(body) {
+  if (typeof body !== "object" || body === null) return null;
+  const responsesText = extractResponsesContent(body);
+  if (responsesText !== null) return responsesText;
+  const choices = body.choices;
+  if (!Array.isArray(choices) || choices.length === 0) return null;
+  const first = choices[0];
+  const content = first?.message?.content;
+  return typeof content === "string" ? content : null;
+}
+function extractResponsesContent(body) {
+  const root = asRecord(body);
+  if (!root) return null;
+  if (typeof root.output_text === "string" && root.output_text !== "") return root.output_text;
+  if (!Array.isArray(root.output)) return null;
+  const text = root.output.filter((item) => asRecord(item)?.type === "message").flatMap((item) => Array.isArray(item.content) ? item.content : []).map((part) => asRecord(part)?.text).filter((t) => typeof t === "string").join("");
+  return text;
+}
+
+// src/lib/pii/patterns.ts
+function luhnCheck(digits) {
+  let sum = 0;
+  let alternate = false;
+  for (let i = digits.length - 1; i >= 0; i--) {
+    let n = parseInt(digits[i], 10);
+    if (alternate) {
+      n *= 2;
+      if (n > 9) n -= 9;
+    }
+    sum += n;
+    alternate = !alternate;
   }
-  /**
-   * Async counterpart to {@link maskText}: stateless `[CATEGORY]` masking over
-   * regex + NER matches. With no detector, identical to `maskText`.
-   */
-  async maskTextAsync(text) {
-    if (!this.nerDetector) return this.maskText(text);
-    const spans = await this.detectAllSpans(text);
-    return this.rebuildSpans(text, spans, (category) => `[${category}]`).text;
+  return sum % 10 === 0;
+}
+var PII_PATTERNS = [
+  {
+    category: "EMAIL",
+    regex: /\b[a-zA-Z0-9._%+-]{1,64}@[a-zA-Z0-9.-]{1,255}\.[a-zA-Z]{2,24}\b/g
+  },
+  {
+    category: "SSN",
+    regex: /\b\d{3}-\d{2}-\d{4}\b/g,
+    validate: (match) => {
+      const parts = match.split("-");
+      const area = parseInt(parts[0], 10);
+      return area !== 0 && area !== 666 && area < 900;
+    }
+  },
+  {
+    category: "SSN",
+    regex: /\b\d{3}[ ]?\d{2}[ ]?\d{4}\b/g,
+    context: /(?:\bssn\b|\bsocial\s+security(?:\s+(?:number|no\.?|#))?\b)[^\d\n]{0,12}$/i,
+    validate: (match) => {
+      const digits = match.replace(/\D/g, "");
+      if (digits.length !== 9) return false;
+      const area = parseInt(digits.slice(0, 3), 10);
+      return area !== 0 && area !== 666 && area < 900;
+    }
+  },
+  {
+    category: "CREDIT_CARD",
+    regex: /\b\d{4}[\s-]\d{4}[\s-]\d{4}[\s-]\d{1,7}\b|\b\d{13,19}\b/g,
+    validate: (match) => {
+      const digits = match.replace(/\D/g, "");
+      if (digits.length < 13 || digits.length > 19) return false;
+      return luhnCheck(digits);
+    }
+  },
+  {
+    category: "IP_ADDRESS",
+    regex: /\b(?:(?:25[0-5]|2[0-4]\d|[01]?\d\d?)\.){3}(?:25[0-5]|2[0-4]\d|[01]?\d\d?)\b/g,
+    validate: (match) => {
+      return match !== "0.0.0.0" && match !== "127.0.0.1" && match !== "255.255.255.255";
+    }
+  },
+  {
+    category: "IP_ADDRESS",
+    regex: /(?:(?:[0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}|(?:[0-9a-fA-F]{1,4}:){1,7}:|(?:[0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|(?:[0-9a-fA-F]{1,4}:){1,5}(?::[0-9a-fA-F]{1,4}){1,2}|(?:[0-9a-fA-F]{1,4}:){1,4}(?::[0-9a-fA-F]{1,4}){1,3}|(?:[0-9a-fA-F]{1,4}:){1,3}(?::[0-9a-fA-F]{1,4}){1,4}|(?:[0-9a-fA-F]{1,4}:){1,2}(?::[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:(?::[0-9a-fA-F]{1,4}){1,6}|:(?:(?::[0-9a-fA-F]{1,4}){1,7}|:))/g,
+    validate: (match) => match !== "::1" && match !== "::"
+  },
+  {
+    category: "PHONE",
+    regex: /(?:\+\d{1,3}[\s.-])?\(?\d{3}\)?[\s.-]\d{3}[\s.-]\d{4}\b|\+\d{10,15}\b/g
+  },
+  {
+    category: "API_KEY",
+    regex: /\b(?:sk|pk|api|key|token|secret|bearer|access)[_-]?[a-zA-Z0-9_-]{20,}\b/gi,
+    validate: (match) => {
+      const hasDigit = /\d/.test(match);
+      const hasMixedCase = /[a-z]/.test(match) && /[A-Z]/.test(match);
+      return hasDigit || hasMixedCase;
+    }
+  },
+  {
+    category: "US_ADDRESS",
+    regex: /\b\d{1,5}[ \t]+(?:[A-Z][a-z]+[ \t]+){1,3}(?:St(?:reet)?|Ave(?:nue)?|Blvd|Boulevard|Dr(?:ive)?|Ln|Lane|Rd|Road|Ct|Court|Pl(?:ace)?|Way|Cir(?:cle)?|Pkwy|Parkway|Hwy|Highway)\.?(?=[\s,.;:!?)]|$)/g,
+    validate: (match) => {
+      return !/^0/.test(match.trim());
+    }
+  },
+  {
+    category: "DATE_OF_BIRTH",
+    regex: /\b(?:(?:0?[1-9]|1[0-2])[/-](?:0?[1-9]|[12]\d|3[01])[/-](?:19|20)\d{2})\b/g,
+    context: /(?:\bdob\b|\bd\.?o\.?b\.?|\bborn\b|\bbirth\s?date\b|\bbirthdate\b|\bbirthday\b|\bdate\s+of\s+birth\b)[^\d\n]{0,12}$/i,
+    validate: (match) => {
+      const m = match.match(/(\d{1,2})[/-](\d{1,2})[/-](\d{4})/);
+      if (!m) return false;
+      const month = parseInt(m[1], 10);
+      const day = parseInt(m[2], 10);
+      const year = parseInt(m[3], 10);
+      const isLeap = year % 4 === 0 && (year % 100 !== 0 || year % 400 === 0);
+      const daysInMonth = [31, isLeap ? 29 : 28, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31];
+      return month >= 1 && month <= 12 && day >= 1 && day <= daysInMonth[month - 1];
+    }
   }
-  /**
-   * Async counterpart to {@link redactMessages}. Text parts are redacted
-   * sequentially so placeholder numbering stays deterministic across the
-   * conversation. With no detector, identical to `redactMessages`.
-   */
-  async redactMessagesAsync(messages) {
-    if (!this.nerDetector) return this.redactMessages(messages);
-    const allMatches = [];
-    const redactedMessages = [];
-    for (const msg of messages) {
-      if (!msg.content) {
-        redactedMessages.push(msg);
-        continue;
-      }
-      const newContent = [];
-      for (const part of msg.content) {
-        if (part.type === "text" && part.text) {
-          const result = await this.redactTextAsync(part.text);
-          allMatches.push(...result.matches);
-          newContent.push(result.matches.length > 0 ? { ...part, text: result.text } : part);
-        } else {
-          if (part.type !== "text") this.warnNonTextBypass();
-          newContent.push(part);
-        }
+];
+
+// src/lib/pii/redactor.ts
+function escapeRegExp(value) {
+  return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function isWordChar(ch) {
+  return /[A-Za-z0-9_]/.test(ch) || ch.charCodeAt(0) > 127;
+}
+var PiiRedactor = class {
+  constructor(options = {}) {
+    this.disposed = false;
+    /** Maps original PII value → placeholder tag. */
+    this.valueToPlaceholder = /* @__PURE__ */ new Map();
+    /** Maps placeholder tag → original PII value (reverse lookup for de-anonymization). */
+    this.placeholderToValue = /* @__PURE__ */ new Map();
+    /** Next index per category for placeholder numbering. */
+    this.categoryCounters = /* @__PURE__ */ new Map();
+    /**
+     * Matches any placeholder-shaped token for this redactor's categories —
+     * bracketed `[EMAIL_1]` OR bare `EMAIL_1`, case-insensitive — capturing the
+     * body. Drives {@link restoreForStorage}: the extraction / consolidation
+     * models echo placeholders mangled (brackets dropped, re-cased), and a single
+     * pass with this matcher restores the assigned ones and flags the rest in one
+     * go. Built lazily from the union of pattern categories AND any categories
+     * minted at runtime (e.g. NER `PERSON`/`LOCATION`/`ORG`): `undefined` = stale
+     * (rebuild on next use), `null` = built but there are no categories.
+     */
+    this.storagePattern = void 0;
+    /**
+     * Cached body→value lookups for {@link restoreForStorage}, built lazily from
+     * the assigned placeholders and invalidated on each mint. `exact` is keyed by
+     * the literal body (collision-proof); `ci` by upper-cased body for re-cased
+     * echoes, minus any `ciCollisions` where two distinct bodies share a form.
+     */
+    this.storageLookup = null;
+    /** Whether the non-text-content bypass warning has already been emitted. */
+    this.warnedNonText = false;
+    /** Whether the NER-detector-failure warning has already been emitted. */
+    this.warnedNerFailure = false;
+    this.nerDetector = options.nerDetector;
+    if (options.patterns) {
+      this.patterns = options.patterns;
+    } else {
+      let base = PII_PATTERNS;
+      if (options.excludeCategories?.length) {
+        const excluded = new Set(options.excludeCategories);
+        base = base.filter((p) => !excluded.has(p.category));
       }
-      redactedMessages.push({ ...msg, content: newContent });
+      this.patterns = options.extraPatterns ? [...base, ...options.extraPatterns] : base;
     }
-    return { messages: redactedMessages, matches: allMatches };
+    this.patternCategories = [...new Set(this.patterns.map((p) => String(p.category)))];
   }
   /**
-   * Redact PII from an array of LlmapiMessage objects.
-   * Returns new message objects — originals are not mutated.
-   *
-   * All roles' text content is redacted, not just user/system: tool results
-   * can return PII fetched from external systems, and assistant history is
-   * persisted with original (de-anonymized) values, so both must be re-redacted
-   * before they go back over the wire. Placeholders the model already emitted
-   * are inert here (they don't match any PII pattern), so re-redaction is safe.
+   * Build the {@link storagePattern} from the union of pattern categories and
+   * any categories minted at runtime (NER entities arrive only when redaction
+   * runs, so this can't be fixed at construction). Bracketed `[EMAIL_1]` OR
+   * bare `EMAIL_1`, capturing the body, case-insensitive, global. `\d+` (not a
+   * fixed body) spans any index; `\b` on the bare arm keeps it off prose like
+   * "email 1 of 3".
    */
-  redactMessages(messages) {
-    const allMatches = [];
-    const redactedMessages = messages.map((msg) => {
-      if (!msg.content) return msg;
-      const newContent = msg.content.map((part) => {
-        if (part.type === "text" && part.text) {
-          const result = this.redactText(part.text);
-          allMatches.push(...result.matches);
-          if (result.matches.length > 0) {
-            return { ...part, text: result.text };
-          }
-        } else if (part.type !== "text") {
-          this.warnNonTextBypass();
-        }
-        return part;
-      });
-      return { ...msg, content: newContent };
-    });
-    return { messages: redactedMessages, matches: allMatches };
-  }
-  /** Emit the non-text bypass warning at most once per redactor instance. */
-  warnNonTextBypass() {
-    if (this.warnedNonText) return;
-    this.warnedNonText = true;
-    console.warn(
-      "[PiiRedactor] A message contains non-text content (images, files, or attachments) that is NOT scanned for PII \u2014 only text parts are redacted."
-    );
-  }
-  /** Emit the NER-detector-failure warning at most once per redactor instance. */
-  warnNerFailure(err) {
-    if (this.warnedNerFailure) return;
-    this.warnedNerFailure = true;
-    console.warn(
-      "[PiiRedactor] The NER detector threw; falling back to regex-only redaction for this call's unstructured PII. The detector is still retried on subsequent calls; this warning is emitted only once.",
-      err
-    );
+  buildStoragePattern() {
+    const categories = [.../* @__PURE__ */ new Set([...this.patternCategories, ...this.categoryCounters.keys()])];
+    if (categories.length === 0) return null;
+    const categoryAlt = categories.sort((a, b) => b.length - a.length).map(escapeRegExp).join("|");
+    return new RegExp(`\\[((?:${categoryAlt})_\\d+)\\]|\\b((?:${categoryAlt})_\\d+)\\b`, "gi");
   }
   /**
-   * Restore original PII values in text that contains placeholders.
-   * Used to de-anonymize LLM responses before displaying to the user.
-   *
-   * Exact: matches the literal `[EMAIL_1]` form only. The storage paths use
-   * {@link restoreForStorage} instead, which tolerates the mangled echoes the
-   * extraction models produce.
+   * Returns the current number of unique PII values tracked.
    */
-  deAnonymize(text) {
-    if (!text.includes("[")) return text;
-    let restored = text;
-    for (const [placeholder, original] of this.placeholderToValue) {
-      if (restored.includes(placeholder)) {
-        restored = restored.split(placeholder).join(original);
-      }
-    }
-    return restored;
+  get size() {
+    return this.valueToPlaceholder.size;
   }
   /**
-   * De-anonymize for PERSISTENCE (auto-extraction / consolidation), tolerant of
-   * the ways the extraction models mangle a placeholder when echoing it back:
-   * dropped brackets (`EMAIL_1`) and changed case (`email_1` / `Email_1`).
-   *
-   * Returns the restored text plus `unresolved` — true when a placeholder-shaped
-   * token for one of this redactor's categories was NOT assigned during
-   * redaction (a model hallucination, or an ambiguous re-cased collision).
-   * Callers drop/degrade such facts so an opaque token never reaches the vault.
-   *
-   * One left-to-right pass over the ORIGINAL text. Two properties matter:
-   * - a restored value is never re-scanned — so a real value that happens to
-   *   contain a `<CATEGORY>_<n>` substring (e.g. the email `ssn_1@example.com`,
-   *   or an API key containing `EMAIL_1`) is neither corrupted nor false-flagged;
-   * - `unresolved` is derived from the lookup miss during this pass, not from a
-   *   regex re-scan of the output — so it can't trip over a restored value.
+   * Returns a snapshot of all placeholder → original value mappings.
+   * Useful for debugging or UI display. This is a copy — mutating it (or
+   * later redactions) does not affect the returned map and vice versa.
    */
-  restoreForStorage(text) {
-    if (this.storagePattern === void 0) this.storagePattern = this.buildStoragePattern();
-    if (!this.storagePattern || this.placeholderToValue.size === 0) {
-      return { text, unresolved: false };
-    }
-    this.storageLookup ?? (this.storageLookup = this.buildStorageLookup());
-    const { exact, ci, ciCollisions } = this.storageLookup;
-    let unresolved = false;
-    const restored = text.replace(
-      this.storagePattern,
-      (match, bracketed, bare) => {
-        const body = bracketed ?? bare ?? "";
-        const exactHit = exact.get(body);
-        if (exactHit !== void 0) return exactHit;
-        const key = body.toUpperCase();
-        if (!ciCollisions.has(key)) {
-          const ciHit = ci.get(key);
-          if (ciHit !== void 0) return ciHit;
-        }
-        unresolved = true;
-        return match;
-      }
-    );
-    return { text: restored, unresolved };
+  getMappings() {
+    return new Map(this.placeholderToValue);
   }
   /**
-   * Build the {@link restoreForStorage} body→value lookups from the assigned
-   * placeholders. `exact` (literal body) is collision-proof; `ci` (upper-cased
-   * body) handles re-cased echoes, except where two distinct bodies share an
-   * upper-cased form — those are recorded in `ciCollisions` so a re-cased echo
-   * of them is left unresolved rather than resolved to the wrong value.
+   * Get or create a placeholder for a PII value.
+   * The same value always gets the same placeholder within a redactor instance.
    */
-  buildStorageLookup() {
-    const exact = /* @__PURE__ */ new Map();
-    const ci = /* @__PURE__ */ new Map();
-    const ciCollisions = /* @__PURE__ */ new Set();
-    for (const [placeholder, value] of this.placeholderToValue) {
-      const body = placeholder.slice(1, -1);
-      exact.set(body, value);
-      const key = body.toUpperCase();
-      if (ci.has(key) && ci.get(key) !== value) ciCollisions.add(key);
-      else ci.set(key, value);
-    }
-    return { exact, ci, ciCollisions };
+  getPlaceholder(category, value) {
+    if (this.disposed) throw new Error("PII redactor session ended");
+    const normalizedValue = value.trim();
+    const existing = this.valueToPlaceholder.get(normalizedValue);
+    if (existing) return existing;
+    const existingCount = this.categoryCounters.get(category);
+    const count = (existingCount ?? 0) + 1;
+    this.categoryCounters.set(category, count);
+    if (existingCount === void 0) this.storagePattern = void 0;
+    const placeholder = `[${category}_${count}]`;
+    this.valueToPlaceholder.set(normalizedValue, placeholder);
+    this.placeholderToValue.set(placeholder, normalizedValue);
+    this.storageLookup = null;
+    return placeholder;
   }
   /**
-   * Reset all state. Useful for testing or when starting a fresh conversation.
+   * Find all matches of a single pattern in `text`, applying its `validate` and
+   * `context` guards. Matches are non-overlapping and ascending (the global
+   * regex advances `lastIndex` past each match). Shared by the sync {@link scan}
+   * (sequential, per-pattern) and the async {@link collectRegexSpans} (span)
+   * paths so the detection rules live in exactly one place.
    */
-  clear() {
-    this.valueToPlaceholder.clear();
-    this.placeholderToValue.clear();
-    this.categoryCounters.clear();
-    this.storageLookup = null;
-    this.storagePattern = void 0;
-    this.warnedNonText = false;
-    this.warnedNerFailure = false;
-  }
-  /** Clear the mappings and prevent new reversible mappings. */
-  dispose() {
-    this.disposed = true;
-    this.clear();
-  }
-};
-function isPiiRedactor(value) {
-  return typeof value === "object" && value !== null && typeof value.redactMessages === "function" && typeof value.deAnonymize === "function";
-}
-function resolvePiiRedactor(piiRedaction) {
-  if (piiRedaction === true) return new PiiRedactor();
-  if (!piiRedaction) return void 0;
-  if (isPiiRedactor(piiRedaction)) return piiRedaction;
-  console.warn(
-    "[PiiRedactor] `piiRedaction` is neither `true` nor a PiiRedactor instance; PII redaction is DISABLED for this request."
-  );
-  return void 0;
-}
-function createStreamingDeAnonymizer(redactor, emit) {
-  let buffer = "";
-  const trailingFragment = /\[[A-Za-z0-9_]*$/;
-  return {
-    push(chunk) {
-      if (!chunk) return;
-      buffer += chunk;
-      const m = buffer.match(trailingFragment);
-      if (!m || m.index === void 0) {
-        emit(redactor.deAnonymize(buffer));
-        buffer = "";
-      } else if (m.index > 0) {
-        emit(redactor.deAnonymize(buffer.slice(0, m.index)));
-        buffer = buffer.slice(m.index);
+  findMatches(text, pattern) {
+    const regex = new RegExp(pattern.regex.source, pattern.regex.flags);
+    const found = [];
+    let m;
+    while ((m = regex.exec(text)) !== null) {
+      const value = m[0];
+      if (pattern.validate && !pattern.validate(value)) continue;
+      if (pattern.context) {
+        const before = text.slice(Math.max(0, m.index - 40), m.index);
+        if (!pattern.context.test(before)) continue;
       }
-    },
-    flush() {
-      if (buffer) {
-        emit(redactor.deAnonymize(buffer));
-        buffer = "";
+      found.push({ match: value, index: m.index });
+    }
+    return found;
+  }
+  /**
+   * Scan text for PII and rebuild it, replacing each match with whatever
+   * `makeReplacement(category, value)` returns. Shared by `redactText`
+   * (numbered, stateful placeholders) and `maskText` (unnumbered, stateless).
+   *
+   * Patterns are applied sequentially: each scans the text already rewritten by
+   * earlier patterns, so an earlier (more specific) pattern claims a region
+   * before a later one can — placeholders are inert and match no pattern.
+   */
+  scan(text, makeReplacement) {
+    const matches = [];
+    let redacted = text;
+    for (const pattern of this.patterns) {
+      const found = this.findMatches(redacted, pattern);
+      if (found.length === 0) continue;
+      let result = "";
+      let cursor = 0;
+      for (const { match, index } of found) {
+        const placeholder = makeReplacement(pattern.category, match);
+        matches.push({ category: pattern.category, original: match, placeholder });
+        result += redacted.slice(cursor, index) + placeholder;
+        cursor = index + match.length;
       }
+      result += redacted.slice(cursor);
+      redacted = result;
     }
-  };
-}
-
-// src/lib/chat/endpointOverride.ts
-function validateEndpointOverride(override) {
-  const trimmed = override.trim();
-  if (trimmed === "") {
-    return {
-      valid: false,
-      message: 'endpointOverride must be a non-empty, root-relative path (e.g. "/api/v1/utility/responses"); received an empty or whitespace-only string'
-    };
+    return { text: redacted, matches };
   }
-  if (trimmed.startsWith("//") || trimmed.includes("://")) {
-    return {
-      valid: false,
-      message: `endpointOverride must be a root-relative path (e.g. "/api/v1/utility/responses"), not a protocol-relative or absolute URL; received "${trimmed}"`
-    };
+  /**
+   * Scan and redact PII from a single text string, using numbered, reversible
+   * placeholders ([EMAIL_1], …) tracked on this instance.
+   */
+  redactText(text) {
+    return this.scan(text, (category, value) => this.getPlaceholder(category, value));
   }
-  return { valid: true, endpoint: trimmed.startsWith("/") ? trimmed : `/${trimmed}` };
-}
-
-// src/lib/internalFlowMarker.ts
-var INTERNAL_FLOW_MARKER = "Anuma internal first-party flow (not user chat).";
-function withInternalFlowMarker(systemPrompt) {
-  if (systemPrompt.includes(INTERNAL_FLOW_MARKER)) return systemPrompt;
-  return `${INTERNAL_FLOW_MARKER}
-${systemPrompt}`;
-}
-
-// src/lib/taskType.ts
-var TASK_TYPE_HEADER = "X-Anuma-Task-Type";
-function taskTypeHeader(taskType) {
-  return taskType ? { [TASK_TYPE_HEADER]: taskType } : {};
-}
-
-// src/lib/memory/portalLlm.ts
-function defaultBaseUrl() {
-  return typeof process !== "undefined" && process.env?.ANUMA_PORTAL_BASE_URL || BASE_URL;
-}
-var RESPONSE_FORMAT_OK = /* @__PURE__ */ new Set(["openai", "inclusionai", "deepseek"]);
-var RESPONSE_SCHEMA_OK = /* @__PURE__ */ new Set(["openai"]);
-var JSON_CONTRACT_REMINDER = "Output ONLY the strict JSON object requested. No prose, no explanation, no markdown.";
-function supportsResponseFormat(model, variant = "json_object") {
-  const allow = variant === "json_schema" ? RESPONSE_SCHEMA_OK : RESPONSE_FORMAT_OK;
-  return model.split("/").some((seg) => allow.has(seg));
-}
-var RESPONSES_ONLY_MODEL_PREFIXES = ["gpt-5.6", "gpt-6-sol", "gpt-6-luna", "gpt-6-astra"];
-function requiresResponsesTransport(model) {
-  return model.split("/").some((seg) => RESPONSES_ONLY_MODEL_PREFIXES.some((prefix) => seg.startsWith(prefix)));
-}
-var CHAT_TO_RESPONSES_FIELDS = {
-  max_completion_tokens: "max_output_tokens"
-};
-function responsesExtra(extra) {
-  if (!extra) return {};
-  const out = {};
-  for (const [key, value] of Object.entries(extra)) {
-    const target = CHAT_TO_RESPONSES_FIELDS[key] ?? key;
-    if (target !== key && target in extra) continue;
-    out[target] = value;
+  /**
+   * Mask PII with unnumbered, NON-reversible tokens ([EMAIL], [SSN], …) without
+   * mutating this instance's state. Use for one-way purposes where the value is
+   * never restored — notably embedding inputs: it keeps real PII off the
+   * embeddings endpoint while staying deterministic, so the same content always
+   * masks identically and search stays consistent across conversations.
+   */
+  maskText(text) {
+    return this.scan(text, (category) => `[${category}]`).text;
   }
-  return out;
-}
-function splitEndpoint(endpoint) {
-  const cut = endpoint.search(/[?#]/);
-  const rawPath = cut === -1 ? endpoint : endpoint.slice(0, cut);
-  return {
-    path: rawPath.replace(/\/+$/, ""),
-    rest: cut === -1 ? "" : endpoint.slice(cut)
-  };
-}
-var FOREIGN_ENDPOINT_SUFFIX = {
-  chat: "/responses",
-  responses: "/chat/completions"
-};
-function endpointForTransport(endpoint, transport) {
-  const { path, rest } = splitEndpoint(endpoint);
-  const foreign = FOREIGN_ENDPOINT_SUFFIX[transport];
-  if (!path.endsWith(foreign)) return endpoint;
-  const own = FOREIGN_ENDPOINT_SUFFIX[transport === "chat" ? "responses" : "chat"];
-  return `${path.slice(0, -foreign.length)}${own}${rest}`;
-}
-function assertTransportMatchesEndpoint(transport, endpoint) {
-  const foreign = FOREIGN_ENDPOINT_SUFFIX[transport];
-  if (!splitEndpoint(endpoint).path.endsWith(foreign)) return;
-  throw new Error(
-    `endpointOverride "${endpoint}" is the other transport's endpoint, but transport is "${transport}". The request body is built for the transport, so this sends the wrong shape and 400s without retry.`
-  );
-}
-var TIME_BUDGET_EXHAUSTED = {
-  kind: "terminal",
-  code: "time-budget-exhausted",
-  reason: "time budget exhausted"
-};
-var MAX_TIMER_DELAY_MS = 2147483647;
-var RETRYABLE_HTTP = /* @__PURE__ */ new Set([408, 409, 425, 429]);
-function isRetryableStatus(status) {
-  return status >= 500 || RETRYABLE_HTTP.has(status);
-}
-function parseRetryAfterMs(header) {
-  if (!header) return null;
-  const secs = Number(header);
-  if (Number.isFinite(secs)) return Math.max(0, secs * 1e3);
-  const dateMs = Date.parse(header);
-  if (Number.isFinite(dateMs)) return Math.max(0, dateMs - Date.now());
-  return null;
-}
-function defaultBackoffMs(attempt) {
-  const base = Math.min(2e3, 250 * 2 ** (attempt - 1));
-  return base + Math.floor(Math.random() * 100);
-}
-function sleep(ms) {
-  return new Promise((resolve) => setTimeout(resolve, ms));
-}
-async function resolvePortalAuthHeaders(auth, tag) {
-  if (auth.apiKey) {
-    return { "x-api-key": auth.apiKey };
+  /** All regex matches as spans on the ORIGINAL text (priority 0). Uses the
+   *  same {@link findMatches} guards as the sync scan. */
+  collectRegexSpans(text) {
+    const spans = [];
+    this.patterns.forEach((pattern, patternIndex) => {
+      for (const { match, index } of this.findMatches(text, pattern)) {
+        spans.push({
+          start: index,
+          end: index + match.length,
+          category: pattern.category,
+          priority: 0,
+          order: patternIndex
+        });
+      }
+    });
+    return spans;
   }
-  if (auth.getToken) {
-    let token;
+  /**
+   * Normalize raw NER spans: clamp to the text bounds, drop empty/categoryless
+   * spans, and snap each to whole-word boundaries. Snapping prevents a detector
+   * that tagged only part of a word (a common WordPiece artifact — e.g. "Strip"
+   * of "Stripe") from producing a corrupting partial placeholder like
+   * `[ORG_1]e`.
+   */
+  normalizeNerSpans(text, raw) {
+    if (!Array.isArray(raw)) return [];
+    const out = [];
+    raw.forEach((s, i) => {
+      if (!Number.isFinite(s.start) || !Number.isFinite(s.end)) return;
+      let start = Math.max(0, Math.min(Math.trunc(s.start), text.length));
+      let end = Math.max(0, Math.min(Math.trunc(s.end), text.length));
+      if (end <= start) return;
+      while (start > 0 && isWordChar(text[start - 1])) start--;
+      while (end < text.length && isWordChar(text[end])) end++;
+      const category = String(s.category ?? "").trim();
+      if (!category) return;
+      out.push({ start, end, category, priority: 1, order: i });
+    });
+    return out;
+  }
+  /** Run the configured detector defensively: failures degrade to regex-only
+   *  (fail-open on detection, not on protection) with a one-time warning. */
+  async detectNerSpans(text) {
+    if (!this.nerDetector) return [];
     try {
-      token = await auth.getToken();
+      return this.normalizeNerSpans(text, await this.nerDetector.detect(text));
     } catch (err) {
-      getLogger().warn(`[${tag}] getToken threw`, err);
-      return null;
-    }
-    if (!token) {
-      getLogger().warn(`[${tag}] getToken returned no token`);
-      return null;
-    }
-    return { Authorization: `Bearer ${token}` };
-  }
-  throw new Error(`[${tag}] Either apiKey or getToken must be provided`);
-}
-async function callPortalJsonCompletion(req) {
-  const log = getLogger();
-  const transport = req.transport ?? (requiresResponsesTransport(req.model) ? "responses" : "chat");
-  const autoUpgraded = req.transport === void 0 && transport === "responses";
-  let endpoint = transport === "responses" ? "/api/v1/responses" : "/api/v1/chat/completions";
-  if (req.endpointOverride !== void 0) {
-    const overrideValidation = validateEndpointOverride(req.endpointOverride);
-    if (!overrideValidation.valid) {
-      throw new Error(overrideValidation.message);
+      this.warnNerFailure(err);
+      return [];
     }
-    endpoint = overrideValidation.endpoint;
-    if (autoUpgraded) endpoint = endpointForTransport(endpoint, transport);
-    assertTransportMatchesEndpoint(transport, endpoint);
   }
-  const maxAttempts = Math.max(1, req.maxAttempts ?? 3);
-  const startedAt = Date.now();
-  const deadlineAt = req.totalTimeoutMs === void 0 ? void 0 : startedAt + req.totalTimeoutMs;
-  const overBudget = () => deadlineAt !== void 0 && Date.now() >= deadlineAt;
-  let lastFailure;
-  let reinforce = false;
-  const giveUp = () => {
-    req.onFailure?.(lastFailure ?? { reason: "network", attempts: maxAttempts });
-    return null;
-  };
-  for (let attempt = 1; attempt <= maxAttempts; attempt++) {
-    if (attempt > 1 && overBudget()) {
-      log.warn(`[${req.tag}] over time budget before attempt ${attempt}, giving up`);
-      lastFailure = { reason: "time-budget-exhausted", attempts: attempt - 1 };
-      break;
-    }
-    const attemptReq = reinforce ? { ...req, reinforceJsonContract: true } : req;
-    const outcome = await attemptPortalJson(
-      { ...attemptReq, transport },
-      endpoint,
-      deadlineAt
+  /**
+   * Resolve overlaps by placing higher-priority spans first and dropping any
+   * span that overlaps one already placed. Regex (priority 0) is placed before
+   * NER (priority 1), and within regex by ascending pattern index — so regex
+   * always wins on overlap and the regex-only result reproduces the sync scan's
+   * sequential "earlier pattern wins". O(n²) but n (spans per message) is tiny.
+   *
+   * The returned spans stay in `(priority, order, start)` order — i.e. mint
+   * order — which {@link rebuildSpans} relies on.
+   */
+  resolveOverlaps(spans) {
+    const ordered = [...spans].sort(
+      (a, b) => a.priority - b.priority || a.order - b.order || a.start - b.start
     );
-    if (outcome.kind === "ok") {
-      req.onAttempt?.({ attempt, ok: true });
-      return outcome.value;
-    }
-    req.onAttempt?.({
-      attempt,
-      ok: false,
-      reason: outcome.code,
-      ...outcome.httpStatus !== void 0 && { httpStatus: outcome.httpStatus }
-    });
-    lastFailure = {
-      reason: outcome.code,
-      ...outcome.httpStatus !== void 0 && { httpStatus: outcome.httpStatus },
-      attempts: attempt
-    };
-    if (outcome.code === "invalid-json" || outcome.code === "null-completion") reinforce = true;
-    if (outcome.kind === "terminal") {
-      log.warn(`[${req.tag}] ${outcome.reason}`);
-      return giveUp();
+    const placed = [];
+    for (const s of ordered) {
+      if (!placed.some((p) => s.start < p.end && p.start < s.end)) placed.push(s);
     }
-    if (attempt >= maxAttempts) {
-      log.warn(`[${req.tag}] ${outcome.reason} \u2014 attempt ${attempt}/${maxAttempts}, giving up`);
-      break;
+    return placed;
+  }
+  /**
+   * Rebuild `text` from resolved (non-overlapping) spans. `spans` must arrive in
+   * mint order — `(priority, order, start)`, as {@link resolveOverlaps} returns —
+   * so placeholders are MINTED by iterating it directly (regex categories first,
+   * in pattern then document order, matching the sync scan's numbering). The
+   * string is then EMITTED in document order.
+   */
+  rebuildSpans(text, spans, makeReplacement) {
+    const placeholderByStart = /* @__PURE__ */ new Map();
+    const matches = [];
+    for (const s of spans) {
+      const value = text.slice(s.start, s.end);
+      const placeholder = makeReplacement(s.category, value);
+      placeholderByStart.set(s.start, placeholder);
+      matches.push({ category: s.category, original: value, placeholder });
     }
-    const backoff = (req.backoffMs ?? defaultBackoffMs)(attempt);
-    const delay = Math.max(backoff, outcome.retryAfterMs ?? 0);
-    if (overBudget() || req.totalTimeoutMs !== void 0 && Date.now() - startedAt + delay >= req.totalTimeoutMs) {
-      log.warn(
-        `[${req.tag}] ${outcome.reason} \u2014 attempt ${attempt}/${maxAttempts}, over time budget, giving up`
-      );
-      lastFailure = { reason: "time-budget-exhausted", attempts: attempt };
-      break;
+    const emitOrder = [...spans].sort((a, b) => a.start - b.start);
+    let result = "";
+    let cursor = 0;
+    for (const s of emitOrder) {
+      result += text.slice(cursor, s.start) + (placeholderByStart.get(s.start) ?? "");
+      cursor = s.end;
     }
-    log.warn(`[${req.tag}] ${outcome.reason} \u2014 attempt ${attempt}/${maxAttempts}, retrying`);
-    if (delay > 0) await sleep(delay);
-  }
-  return giveUp();
-}
-async function attemptPortalJson(req, endpoint, deadlineAt) {
-  const controller = new AbortController();
-  if (deadlineAt === void 0 || deadlineAt - Date.now() > MAX_TIMER_DELAY_MS) {
-    return requestPortalJson(req, endpoint, controller);
+    result += text.slice(cursor);
+    return { text: result, matches };
   }
-  const remainingMs = deadlineAt - Date.now();
-  if (remainingMs <= 0) return TIME_BUDGET_EXHAUSTED;
-  let timer;
-  try {
-    const outcome = await Promise.race([
-      new Promise((resolve) => {
-        timer = setTimeout(() => {
-          resolve(TIME_BUDGET_EXHAUSTED);
-          controller.abort();
-        }, remainingMs);
-      }),
-      requestPortalJson(req, endpoint, controller, deadlineAt)
-    ]);
-    return Date.now() >= deadlineAt ? TIME_BUDGET_EXHAUSTED : outcome;
-  } finally {
-    clearTimeout(timer);
+  /** Merge regex + NER spans for `text` into a resolved, non-overlapping set. */
+  async detectAllSpans(text) {
+    const nerPromise = this.detectNerSpans(text);
+    const regexSpans = this.collectRegexSpans(text);
+    const ner = await nerPromise;
+    return this.resolveOverlaps([...regexSpans, ...ner]);
   }
-}
-async function requestPortalJson(req, endpoint, controller, deadlineAt) {
-  const baseUrl = req.baseUrl ?? defaultBaseUrl();
-  const fetchImpl = req.fetchFn ?? fetch;
-  const authHeaders = await resolvePortalAuthHeaders(req, req.tag);
-  const remainingMs = deadlineAt === void 0 ? Infinity : deadlineAt - Date.now();
-  if (controller.signal.aborted || remainingMs <= 0) return TIME_BUDGET_EXHAUSTED;
-  if (authHeaders === null)
-    return { kind: "terminal", code: "auth-unavailable", reason: "auth unavailable (no token)" };
-  const timeoutMs = Math.min(req.timeoutMs ?? 6e4, remainingMs);
-  const usesPrefill = req.transport !== "responses" && req.model.startsWith("anthropic/");
-  const prefill = usesPrefill ? "{" : "";
-  const messages = [
-    { role: "system", content: withInternalFlowMarker(req.systemPrompt) },
-    ...req.reinforceJsonContract ? [{ role: "system", content: JSON_CONTRACT_REMINDER }] : [],
-    { role: "user", content: req.userMessage }
-  ];
-  if (prefill) messages.push({ role: "assistant", content: prefill });
-  const supportsJsonObjectFormat = supportsResponseFormat(req.model);
-  const timer = setTimeout(() => controller.abort(), timeoutMs);
-  const requestBody = req.transport === "responses" ? {
-    model: req.model,
-    input: messages,
-    ...req.reasoning && { reasoning: req.reasoning },
-    ...responsesExtra(req.extra)
-  } : {
-    model: req.model,
-    messages,
-    ...supportsJsonObjectFormat && { response_format: { type: "json_object" } },
-    ...req.extra
-  };
-  if (req.transport === "responses" || !supportsJsonObjectFormat) {
-    delete requestBody.response_format;
+  /**
+   * Async counterpart to {@link redactText}: redacts structured PII (regex) AND
+   * unstructured PII (the configured {@link NerDetector}) with numbered,
+   * reversible placeholders. With no detector, identical to `redactText`.
+   */
+  async redactTextAsync(text) {
+    if (!this.nerDetector) return this.redactText(text);
+    const spans = await this.detectAllSpans(text);
+    return this.rebuildSpans(
+      text,
+      spans,
+      (category, value) => this.getPlaceholder(category, value)
+    );
   }
-  let response;
-  try {
-    response = await fetchImpl(`${baseUrl}${endpoint}`, {
-      method: "POST",
-      headers: {
-        ...authHeaders,
-        ...taskTypeHeader(req.taskType),
-        "Content-Type": "application/json"
-      },
-      body: JSON.stringify(requestBody),
-      signal: controller.signal
-    });
-  } catch (err) {
-    clearTimeout(timer);
-    return {
-      kind: "retryable",
-      code: "network",
-      reason: `fetch failed: ${err.message}`
-    };
+  /**
+   * Async counterpart to {@link maskText}: stateless `[CATEGORY]` masking over
+   * regex + NER matches. With no detector, identical to `maskText`.
+   */
+  async maskTextAsync(text) {
+    if (!this.nerDetector) return this.maskText(text);
+    const spans = await this.detectAllSpans(text);
+    return this.rebuildSpans(text, spans, (category) => `[${category}]`).text;
   }
-  if (!response.ok) {
-    clearTimeout(timer);
-    const reason = `portal returned ${response.status}`;
-    if (response.status === 401) {
-      const tokenAuth = !req.apiKey && !!req.getToken;
-      return tokenAuth ? {
-        kind: "retryable",
-        code: "http-retryable",
-        reason: `${reason} (token may be expired; refreshing)`,
-        httpStatus: response.status
-      } : { kind: "terminal", code: "http-terminal", reason, httpStatus: response.status };
+  /**
+   * Async counterpart to {@link redactMessages}. Text parts are redacted
+   * sequentially so placeholder numbering stays deterministic across the
+   * conversation. With no detector, identical to `redactMessages`.
+   */
+  async redactMessagesAsync(messages) {
+    if (!this.nerDetector) return this.redactMessages(messages);
+    const allMatches = [];
+    const redactedMessages = [];
+    for (const msg of messages) {
+      if (!msg.content) {
+        redactedMessages.push(msg);
+        continue;
+      }
+      const newContent = [];
+      for (const part of msg.content) {
+        if (part.type === "text" && part.text) {
+          const result = await this.redactTextAsync(part.text);
+          allMatches.push(...result.matches);
+          newContent.push(result.matches.length > 0 ? { ...part, text: result.text } : part);
+        } else {
+          if (part.type !== "text") this.warnNonTextBypass();
+          newContent.push(part);
+        }
+      }
+      redactedMessages.push({ ...msg, content: newContent });
     }
-    if (!isRetryableStatus(response.status))
-      return { kind: "terminal", code: "http-terminal", reason, httpStatus: response.status };
-    const retryAfterMs = parseRetryAfterMs(response.headers.get("retry-after"));
-    return {
-      kind: "retryable",
-      code: "http-retryable",
-      reason,
-      httpStatus: response.status,
-      ...retryAfterMs !== null && { retryAfterMs }
-    };
-  }
-  let body;
-  try {
-    body = await response.json();
-  } catch (err) {
-    clearTimeout(timer);
-    return {
-      kind: "retryable",
-      code: "body-parse-failed",
-      reason: `response body parse failed: ${err.message}`
-    };
-  }
-  clearTimeout(timer);
-  logPortalUsage(body, req.tag);
-  if (isModerationResponse(body)) {
-    return {
-      kind: "terminal",
-      code: "content-flagged",
-      reason: "portal moderation refused the request"
-    };
+    return { messages: redactedMessages, matches: allMatches };
   }
-  const rawContent = extractCompletionContent(body);
-  if (!rawContent) {
-    return {
-      kind: "retryable",
-      code: "empty-content",
-      reason: "portal response had no completion content"
-    };
+  /**
+   * Redact PII from an array of LlmapiMessage objects.
+   * Returns new message objects — originals are not mutated.
+   *
+   * All roles' text content is redacted, not just user/system: tool results
+   * can return PII fetched from external systems, and assistant history is
+   * persisted with original (de-anonymized) values, so both must be re-redacted
+   * before they go back over the wire. Placeholders the model already emitted
+   * are inert here (they don't match any PII pattern), so re-redaction is safe.
+   */
+  redactMessages(messages) {
+    const allMatches = [];
+    const redactedMessages = messages.map((msg) => {
+      if (!msg.content) return msg;
+      const newContent = msg.content.map((part) => {
+        if (part.type === "text" && part.text) {
+          const result = this.redactText(part.text);
+          allMatches.push(...result.matches);
+          if (result.matches.length > 0) {
+            return { ...part, text: result.text };
+          }
+        } else if (part.type !== "text") {
+          this.warnNonTextBypass();
+        }
+        return part;
+      });
+      return { ...msg, content: newContent };
+    });
+    return { messages: redactedMessages, matches: allMatches };
   }
-  const looksLikeContinuation = prefill && /^\s*"/.test(rawContent);
-  const content = looksLikeContinuation ? prefill + rawContent : rawContent;
-  const candidate = extractJsonCandidate(content);
-  let value;
-  try {
-    value = JSON.parse(candidate);
-  } catch {
-    return {
-      kind: "retryable",
-      code: "invalid-json",
-      reason: "invalid-json"
-    };
+  /** Emit the non-text bypass warning at most once per redactor instance. */
+  warnNonTextBypass() {
+    if (this.warnedNonText) return;
+    this.warnedNonText = true;
+    console.warn(
+      "[PiiRedactor] A message contains non-text content (images, files, or attachments) that is NOT scanned for PII \u2014 only text parts are redacted."
+    );
   }
-  if (value === null) {
-    return { kind: "retryable", code: "null-completion", reason: "completion parsed to null" };
+  /** Emit the NER-detector-failure warning at most once per redactor instance. */
+  warnNerFailure(err) {
+    if (this.warnedNerFailure) return;
+    this.warnedNerFailure = true;
+    console.warn(
+      "[PiiRedactor] The NER detector threw; falling back to regex-only redaction for this call's unstructured PII. The detector is still retried on subsequent calls; this warning is emitted only once.",
+      err
+    );
   }
-  return { kind: "ok", value };
-}
-function extractJsonCandidate(raw) {
-  const trimmed = raw.trim();
-  const fence = trimmed.match(/```(?:json)?\s*([\s\S]*?)```/i);
-  const body = fence ? fence[1].trim() : trimmed;
-  const start = body.search(/[{[]/);
-  if (start < 0) return body;
-  const open = body[start];
-  const close = open === "{" ? "}" : "]";
-  let depth = 0;
-  let inString = false;
-  let escape = false;
-  for (let i = start; i < body.length; i++) {
-    const ch = body[i];
-    if (escape) {
-      escape = false;
-      continue;
-    }
-    if (ch === "\\" && inString) {
-      escape = true;
-      continue;
+  /**
+   * Restore original PII values in text that contains placeholders.
+   * Used to de-anonymize LLM responses before displaying to the user.
+   *
+   * Exact: matches the literal `[EMAIL_1]` form only. The storage paths use
+   * {@link restoreForStorage} instead, which tolerates the mangled echoes the
+   * extraction models produce.
+   */
+  deAnonymize(text) {
+    if (!text.includes("[")) return text;
+    let restored = text;
+    for (const [placeholder, original] of this.placeholderToValue) {
+      if (restored.includes(placeholder)) {
+        restored = restored.split(placeholder).join(original);
+      }
     }
-    if (ch === '"') {
-      inString = !inString;
-      continue;
+    return restored;
+  }
+  /**
+   * De-anonymize for PERSISTENCE (auto-extraction / consolidation), tolerant of
+   * the ways the extraction models mangle a placeholder when echoing it back:
+   * dropped brackets (`EMAIL_1`) and changed case (`email_1` / `Email_1`).
+   *
+   * Returns the restored text plus `unresolved` — true when a placeholder-shaped
+   * token for one of this redactor's categories was NOT assigned during
+   * redaction (a model hallucination, or an ambiguous re-cased collision).
+   * Callers drop/degrade such facts so an opaque token never reaches the vault.
+   *
+   * One left-to-right pass over the ORIGINAL text. Two properties matter:
+   * - a restored value is never re-scanned — so a real value that happens to
+   *   contain a `<CATEGORY>_<n>` substring (e.g. the email `ssn_1@example.com`,
+   *   or an API key containing `EMAIL_1`) is neither corrupted nor false-flagged;
+   * - `unresolved` is derived from the lookup miss during this pass, not from a
+   *   regex re-scan of the output — so it can't trip over a restored value.
+   */
+  restoreForStorage(text) {
+    if (this.storagePattern === void 0) this.storagePattern = this.buildStoragePattern();
+    if (!this.storagePattern || this.placeholderToValue.size === 0) {
+      return { text, unresolved: false };
     }
-    if (inString) continue;
-    if (ch === open) depth++;
-    else if (ch === close) {
-      depth--;
-      if (depth === 0) return body.slice(start, i + 1);
+    this.storageLookup ?? (this.storageLookup = this.buildStorageLookup());
+    const { exact, ci, ciCollisions } = this.storageLookup;
+    let unresolved = false;
+    const restored = text.replace(
+      this.storagePattern,
+      (match, bracketed, bare) => {
+        const body = bracketed ?? bare ?? "";
+        const exactHit = exact.get(body);
+        if (exactHit !== void 0) return exactHit;
+        const key = body.toUpperCase();
+        if (!ciCollisions.has(key)) {
+          const ciHit = ci.get(key);
+          if (ciHit !== void 0) return ciHit;
+        }
+        unresolved = true;
+        return match;
+      }
+    );
+    return { text: restored, unresolved };
+  }
+  /**
+   * Build the {@link restoreForStorage} body→value lookups from the assigned
+   * placeholders. `exact` (literal body) is collision-proof; `ci` (upper-cased
+   * body) handles re-cased echoes, except where two distinct bodies share an
+   * upper-cased form — those are recorded in `ciCollisions` so a re-cased echo
+   * of them is left unresolved rather than resolved to the wrong value.
+   */
+  buildStorageLookup() {
+    const exact = /* @__PURE__ */ new Map();
+    const ci = /* @__PURE__ */ new Map();
+    const ciCollisions = /* @__PURE__ */ new Set();
+    for (const [placeholder, value] of this.placeholderToValue) {
+      const body = placeholder.slice(1, -1);
+      exact.set(body, value);
+      const key = body.toUpperCase();
+      if (ci.has(key) && ci.get(key) !== value) ciCollisions.add(key);
+      else ci.set(key, value);
     }
+    return { exact, ci, ciCollisions };
   }
-  return body;
-}
-function asRecord(value) {
-  return typeof value === "object" && value !== null ? value : void 0;
-}
-function asCount(value) {
-  return typeof value === "number" && Number.isFinite(value) ? value : void 0;
-}
-function logPortalUsage(body, tag) {
-  try {
-    const root = asRecord(body);
-    if (!root) return;
-    const usage = asRecord(root.usage);
-    const promptTokens = asCount(usage?.prompt_tokens) ?? asCount(usage?.input_tokens);
-    const completionTokens = asCount(usage?.completion_tokens) ?? asCount(usage?.output_tokens);
-    if (promptTokens === void 0 && completionTokens === void 0) return;
-    const cachedTokens = asCount(asRecord(root.portal)?.cached_tokens) ?? asCount(asRecord(usage?.prompt_tokens_details)?.cached_tokens) ?? asCount(asRecord(usage?.input_tokens_details)?.cached_tokens) ?? 0;
-    const reasoningTokens = asCount(asRecord(usage?.output_tokens_details)?.reasoning_tokens) ?? asCount(asRecord(usage?.completion_tokens_details)?.reasoning_tokens);
-    const parts = [];
-    if (promptTokens !== void 0) parts.push(`prompt=${promptTokens}`);
-    if (completionTokens !== void 0) parts.push(`completion=${completionTokens}`);
-    if (reasoningTokens !== void 0) parts.push(`reasoning=${reasoningTokens}`);
-    parts.push(`cached=${cachedTokens}`);
-    getLogger().debug(`[${tag}] usage ${parts.join(" ")}`);
-  } catch {
+  /**
+   * Reset all state. Useful for testing or when starting a fresh conversation.
+   */
+  clear() {
+    this.valueToPlaceholder.clear();
+    this.placeholderToValue.clear();
+    this.categoryCounters.clear();
+    this.storageLookup = null;
+    this.storagePattern = void 0;
+    this.warnedNonText = false;
+    this.warnedNerFailure = false;
   }
+  /** Clear the mappings and prevent new reversible mappings. */
+  dispose() {
+    this.disposed = true;
+    this.clear();
+  }
+};
+function isPiiRedactor(value) {
+  return typeof value === "object" && value !== null && typeof value.redactMessages === "function" && typeof value.deAnonymize === "function";
 }
-function isModerationResponse(body) {
-  return typeof body === "object" && body !== null && body.id === "moderation";
-}
-function extractCompletionContent(body) {
-  if (typeof body !== "object" || body === null) return null;
-  const responsesText = extractResponsesContent(body);
-  if (responsesText !== null) return responsesText;
-  const choices = body.choices;
-  if (!Array.isArray(choices) || choices.length === 0) return null;
-  const first = choices[0];
-  const content = first?.message?.content;
-  return typeof content === "string" ? content : null;
+function resolvePiiRedactor(piiRedaction) {
+  if (piiRedaction === true) return new PiiRedactor();
+  if (!piiRedaction) return void 0;
+  if (isPiiRedactor(piiRedaction)) return piiRedaction;
+  console.warn(
+    "[PiiRedactor] `piiRedaction` is neither `true` nor a PiiRedactor instance; PII redaction is DISABLED for this request."
+  );
+  return void 0;
 }
-function extractResponsesContent(body) {
-  const root = asRecord(body);
-  if (!root) return null;
-  if (typeof root.output_text === "string" && root.output_text !== "") return root.output_text;
-  if (!Array.isArray(root.output)) return null;
-  const text = root.output.filter((item) => asRecord(item)?.type === "message").flatMap((item) => Array.isArray(item.content) ? item.content : []).map((part) => asRecord(part)?.text).filter((t) => typeof t === "string").join("");
-  return text;
+function createStreamingDeAnonymizer(redactor, emit) {
+  let buffer = "";
+  const trailingFragment = /\[[A-Za-z0-9_]*$/;
+  return {
+    push(chunk) {
+      if (!chunk) return;
+      buffer += chunk;
+      const m = buffer.match(trailingFragment);
+      if (!m || m.index === void 0) {
+        emit(redactor.deAnonymize(buffer));
+        buffer = "";
+      } else if (m.index > 0) {
+        emit(redactor.deAnonymize(buffer.slice(0, m.index)));
+        buffer = buffer.slice(m.index);
+      }
+    },
+    flush() {
+      if (buffer) {
+        emit(redactor.deAnonymize(buffer));
+        buffer = "";
+      }
+    }
+  };
 }
 
 // src/lib/memory/consolidationFallback.ts
@@ -1100,11 +1100,6 @@ export {
   setLogger,
   getLogger,
   taskTypeHeader,
-  PII_PATTERNS,
-  PiiRedactor,
-  isPiiRedactor,
-  resolvePiiRedactor,
-  createStreamingDeAnonymizer,
   validateEndpointOverride,
   INTERNAL_FLOW_MARKER,
   withInternalFlowMarker,
@@ -1116,5 +1111,10 @@ export {
   callPortalJsonCompletion,
   extractJsonCandidate,
   extractCompletionContent,
+  PII_PATTERNS,
+  PiiRedactor,
+  isPiiRedactor,
+  resolvePiiRedactor,
+  createStreamingDeAnonymizer,
   notifyConsolidationFallback
 };