@anuma/sdk 6.14.0 → 6.14.2

package/dist/expo/{chunk-732ZLOLA.mjs → chunk-JA7CDJCA.mjs}

@@ -1,7 +1,7 @@
 import {
   callPortalJsonCompletion,
   getLogger
-} from "./chunk-CJ32HO6Q.mjs";
+} from "./chunk-O25LUKBK.mjs";
 import {
   BASE_URL,
   createClientConfig
@@ -6885,7 +6885,7 @@ function createMemoryVaultSearchTool(vaultCtx, embeddingOptions, cache, searchOp
             subQueries = decomp.subQueries;
           }
         }
-        const { recall: recall2 } = await import("./recall-PIATJ336.mjs");
+        const { recall: recall2 } = await import("./recall-JYVHWU6N.mjs");
         let recallDegraded = [];
         const result = await recall2(
           query,

package/dist/expo/{chunk-OUFITMDL.mjs → chunk-M4JSLFTQ.mjs}

@@ -1,6 +1,6 @@
 import {
   getLogger
-} from "./chunk-CJ32HO6Q.mjs";
+} from "./chunk-O25LUKBK.mjs";
 
 // src/lib/pii/patterns.ts
 function luhnCheck(digits) {

package/dist/{react/chunk-CJ32HO6Q.mjs → expo/chunk-O25LUKBK.mjs}

@@ -65,6 +65,7 @@ function defaultBaseUrl() {
 }
 var RESPONSE_FORMAT_OK = /* @__PURE__ */ new Set(["openai", "inclusionai", "deepseek"]);
 var RESPONSE_SCHEMA_OK = /* @__PURE__ */ new Set(["openai"]);
+var JSON_CONTRACT_REMINDER = "Output ONLY the strict JSON object requested. No prose, no explanation, no markdown.";
 function supportsResponseFormat(model, variant = "json_object") {
   const allow = variant === "json_schema" ? RESPONSE_SCHEMA_OK : RESPONSE_FORMAT_OK;
   return model.split("/").some((seg) => allow.has(seg));
@@ -122,6 +123,7 @@ async function callPortalJsonCompletion(req) {
   const startedAt = Date.now();
   const overBudget = () => req.totalTimeoutMs !== void 0 && Date.now() - startedAt >= req.totalTimeoutMs;
   let lastFailure;
+  let reinforce = false;
   const giveUp = () => {
     req.onFailure?.(lastFailure ?? { reason: "network", attempts: maxAttempts });
     return null;
@@ -137,8 +139,9 @@ async function callPortalJsonCompletion(req) {
       timeoutMs: Math.max(
         1,
         Math.min(req.timeoutMs ?? 6e4, req.totalTimeoutMs - (Date.now() - startedAt))
-      )
-    } : req;
+      ),
+      ...reinforce && { reinforceJsonContract: true }
+    } : reinforce ? { ...req, reinforceJsonContract: true } : req;
     const outcome = await attemptPortalJson(attemptReq, endpoint);
     if (outcome.kind === "ok") return outcome.value;
     lastFailure = {
@@ -146,6 +149,7 @@ async function callPortalJsonCompletion(req) {
       ...outcome.httpStatus !== void 0 && { httpStatus: outcome.httpStatus },
       attempts: attempt
     };
+    if (outcome.code === "invalid-json" || outcome.code === "null-completion") reinforce = true;
     if (outcome.kind === "terminal") {
       log.warn(`[${req.tag}] ${outcome.reason}`);
       return giveUp();
@@ -184,6 +188,11 @@ async function attemptPortalJson(req, endpoint) {
     // keeps the portal's detector reading them as genuine rather than markerless.
     // See ../internalFlowMarker.
     { role: "system", content: withInternalFlowMarker(req.systemPrompt) },
+    // Retry-only. Kept as a SEPARATE message rather than appended to the system
+    // prompt so the marked prompt above stays byte-identical across attempts —
+    // the portal's internal-flow detector reads that one, and rewriting it on a
+    // retry would change what the detector sees for reasons unrelated to auth.
+    ...req.reinforceJsonContract ? [{ role: "system", content: JSON_CONTRACT_REMINDER }] : [],
     { role: "user", content: req.userMessage }
   ];
   if (prefill) messages.push({ role: "assistant", content: prefill });

package/dist/{react/consolidate-5TP3J6BY.mjs → expo/consolidate-S3KFA2WT.mjs}

@@ -1,10 +1,10 @@
 import {
   notifyConsolidationFallback,
   resolvePiiRedactor
-} from "./chunk-DY5VGC6K.mjs";
+} from "./chunk-M4JSLFTQ.mjs";
 import {
   callPortalJsonCompletion
-} from "./chunk-CJ32HO6Q.mjs";
+} from "./chunk-O25LUKBK.mjs";
 import "./chunk-GYKJOWEO.mjs";
 
 // src/lib/memory/consolidate.ts

package/dist/expo/index.cjs

@@ -6197,6 +6197,7 @@ async function callPortalJsonCompletion(req) {
   const startedAt = Date.now();
   const overBudget = () => req.totalTimeoutMs !== void 0 && Date.now() - startedAt >= req.totalTimeoutMs;
   let lastFailure;
+  let reinforce = false;
   const giveUp = () => {
     req.onFailure?.(lastFailure ?? { reason: "network", attempts: maxAttempts });
     return null;
@@ -6212,8 +6213,9 @@ async function callPortalJsonCompletion(req) {
       timeoutMs: Math.max(
         1,
         Math.min(req.timeoutMs ?? 6e4, req.totalTimeoutMs - (Date.now() - startedAt))
-      )
-    } : req;
+      ),
+      ...reinforce && { reinforceJsonContract: true }
+    } : reinforce ? { ...req, reinforceJsonContract: true } : req;
     const outcome = await attemptPortalJson(attemptReq, endpoint);
     if (outcome.kind === "ok") return outcome.value;
     lastFailure = {
@@ -6221,6 +6223,7 @@ async function callPortalJsonCompletion(req) {
       ...outcome.httpStatus !== void 0 && { httpStatus: outcome.httpStatus },
       attempts: attempt
     };
+    if (outcome.code === "invalid-json" || outcome.code === "null-completion") reinforce = true;
     if (outcome.kind === "terminal") {
       log.warn(`[${req.tag}] ${outcome.reason}`);
       return giveUp();
@@ -6259,6 +6262,11 @@ async function attemptPortalJson(req, endpoint) {
     // keeps the portal's detector reading them as genuine rather than markerless.
     // See ../internalFlowMarker.
     { role: "system", content: withInternalFlowMarker(req.systemPrompt) },
+    // Retry-only. Kept as a SEPARATE message rather than appended to the system
+    // prompt so the marked prompt above stays byte-identical across attempts —
+    // the portal's internal-flow detector reads that one, and rewriting it on a
+    // retry would change what the detector sees for reasons unrelated to auth.
+    ...req.reinforceJsonContract ? [{ role: "system", content: JSON_CONTRACT_REMINDER }] : [],
     { role: "user", content: req.userMessage }
   ];
   if (prefill) messages.push({ role: "assistant", content: prefill });
@@ -6421,7 +6429,7 @@ function extractCompletionContent(body) {
   const content = first?.message?.content;
   return typeof content === "string" ? content : null;
 }
-var RESPONSE_FORMAT_OK, RESPONSE_SCHEMA_OK, RETRYABLE_HTTP;
+var RESPONSE_FORMAT_OK, RESPONSE_SCHEMA_OK, JSON_CONTRACT_REMINDER, RETRYABLE_HTTP;
 var init_portalLlm = __esm({
   "src/lib/memory/portalLlm.ts"() {
     "use strict";
@@ -6432,6 +6440,7 @@ var init_portalLlm = __esm({
     init_taskType();
     RESPONSE_FORMAT_OK = /* @__PURE__ */ new Set(["openai", "inclusionai", "deepseek"]);
     RESPONSE_SCHEMA_OK = /* @__PURE__ */ new Set(["openai"]);
+    JSON_CONTRACT_REMINDER = "Output ONLY the strict JSON object requested. No prose, no explanation, no markdown.";
     RETRYABLE_HTTP = /* @__PURE__ */ new Set([408, 409, 425, 429]);
   }
 });
@@ -15429,7 +15438,7 @@ async function ingestPublishedPhotoMemoriesOp(ctx, rows) {
       ({ row, content }) => ctx.vaultMemoryCollection.prepareCreate((record) => {
         record._raw.id = row.memoryId;
         record._setRaw("content", content);
-        record._setRaw("scope", "private");
+        record._setRaw("scope", "shared");
         record._setRaw("folder_id", null);
         record._setRaw("user_id", ctx.userId ?? null);
         record._setRaw("is_deleted", false);

package/dist/expo/index.d.mts

@@ -6335,15 +6335,26 @@ declare function extractAndRetain(messages: AutoExtractMessage[], retainCtx: Ret
 }>;
 
 /**
- * People Nearby cross-user visibility. ORTHOGONAL to `scope` (model access):
- * - `private`: local-only (default; null column grandfathered as private)
- * - `public`: embedding + plaintext may be published (compatibility matching,
- *   profile display, discovery answers, digital-twin prompts)
+ * LEGACY. This column no longer decides anything.
+ *
+ * `scope === 'shared'` is now the single publication axis: it means the memory
+ * is on the People Nearby profile, its text goes to the nearby server, and it
+ * may inform what strangers see. `scope: 'private'` means it is not. There is
+ * no second control, and scope no longer gates model access either — every
+ * model tier reads every memory. Do NOT reason about publication from this
+ * type; read `scope`.
+ *
+ * The column survives in the schema and is still stamped on writes so that
+ * stored rows stay readable by builds that predate the change. Nothing on a
+ * current build reads it to make a decision.
+ *
+ * Values, kept for tolerance of already-stored data:
+ * - `private`: local-only (a null column reads as private)
+ * - `public`: the row was published
  *
  * TWO TIERS ONLY (decided 2026-07-27). An earlier design had a middle
  * `matchable` tier that published a memory's embedding while keeping its text
- * on-device; it was dropped, so a memory either never leaves the device or is
- * published with its content. Any unrecognised stored value — including a
+ * on-device; it was dropped. Any unrecognised stored value — including a
  * `matchable` row written by a pre-release build — reads as `private`, which is
  * the fail-safe direction: it un-publishes rather than exposes.
  */
@@ -6997,12 +7008,16 @@ declare function updateVaultMemoryEmbeddingOp(ctx: VaultMemoryOperationsContext,
  *     candidate to be reconciled against the vault — it is an already-decided
  *     fact the server has published.
  *
- * The rows are written `visibility: "public"` because they genuinely ARE
- * published — the reconciler reads local visibility as the user's intent, and
- * anything else would make it immediately revoke a memory the user never turned
- * off. They carry `source: SOURCE_PHOTO`, which is what exempts them from
- * decay's auto-archive; see the note there for why archiving one would silently
- * unpublish it.
+ * The rows are written `scope: "shared"` because they genuinely ARE published.
+ * `scope === 'shared'` is the publication axis — the single one. The reconciler
+ * reads local scope as the user's intent, and it builds its `local` set from a
+ * vault read narrowed to `{scopes: ['shared']}`. A row stamped anything else
+ * never enters that read, so it is never adopted into the publish ledger, and
+ * `toRevoke` is computed only over ids the ledger holds. The user's off-toggle
+ * would then do nothing server-side while nearby kept serving the memory. The
+ * `visibility` column is legacy: nothing reads it any more. They carry
+ * `source: SOURCE_PHOTO`, which is what exempts them from decay's auto-archive;
+ * see the note there for why archiving one would silently unpublish it.
  *
  * No embedding is computed here. `searchTool`'s un-embedded lane embeds any row
  * lacking a vector at search time, uses it in that same search and persists it
@@ -7050,6 +7065,29 @@ interface PhotoIngestResult {
  * class of bug as publishing a version the user has since changed. Re-ingesting
  * changed text is a follow-up that needs a merge decision, not a clobber.
  *
+ * That skip is also why this op does NOT repair a row an older build stamped
+ * `scope: "private"`. Such a row is present, so ingest leaves it alone, and it
+ * stays outside the published-set read. The user's switch cannot revoke it.
+ * Repair belongs in a one-time pass at upgrade. Do not add it here, for two
+ * reasons:
+ *
+ *  - **The two states are indistinguishable from this op.** After this build a
+ *    `photo:` row with `scope: "private"` is also exactly what the user's own
+ *    off-toggle produces. The toggle calls `updateVaultMemoryOp`, which writes
+ *    `scope` and never touches `visibility`, so the mis-stamped row and the
+ *    turned-off row carry identical columns. No test here can tell them apart.
+ *
+ *  - **A re-stamp here would revert the off-toggle.** The pass runs ingest
+ *    BEFORE it reads the vault, so a row re-stamped `shared` re-enters the
+ *    desired set on that same pass and never reaches `toRevoke`. The switch
+ *    would spring back to "on" and nearby would keep serving the memory. That
+ *    is worse than the bug it repairs.
+ *
+ * A one-time pass does not have the ambiguity. Before this build the switch
+ * already read "off" for these rows, because it reads `scope`, so no user can
+ * have turned one off. Every `private` photo row at that instant came from the
+ * old stamp.
+ *
  * Non-`photo:` ids are ignored: everything else in the published set is a
  * client-published memory that by definition already lives in this vault (or in
  * another device's, which is not ours to recreate).

package/dist/expo/index.d.ts

@@ -6335,15 +6335,26 @@ declare function extractAndRetain(messages: AutoExtractMessage[], retainCtx: Ret
 }>;
 
 /**
- * People Nearby cross-user visibility. ORTHOGONAL to `scope` (model access):
- * - `private`: local-only (default; null column grandfathered as private)
- * - `public`: embedding + plaintext may be published (compatibility matching,
- *   profile display, discovery answers, digital-twin prompts)
+ * LEGACY. This column no longer decides anything.
+ *
+ * `scope === 'shared'` is now the single publication axis: it means the memory
+ * is on the People Nearby profile, its text goes to the nearby server, and it
+ * may inform what strangers see. `scope: 'private'` means it is not. There is
+ * no second control, and scope no longer gates model access either — every
+ * model tier reads every memory. Do NOT reason about publication from this
+ * type; read `scope`.
+ *
+ * The column survives in the schema and is still stamped on writes so that
+ * stored rows stay readable by builds that predate the change. Nothing on a
+ * current build reads it to make a decision.
+ *
+ * Values, kept for tolerance of already-stored data:
+ * - `private`: local-only (a null column reads as private)
+ * - `public`: the row was published
  *
  * TWO TIERS ONLY (decided 2026-07-27). An earlier design had a middle
  * `matchable` tier that published a memory's embedding while keeping its text
- * on-device; it was dropped, so a memory either never leaves the device or is
- * published with its content. Any unrecognised stored value — including a
+ * on-device; it was dropped. Any unrecognised stored value — including a
  * `matchable` row written by a pre-release build — reads as `private`, which is
  * the fail-safe direction: it un-publishes rather than exposes.
  */
@@ -6997,12 +7008,16 @@ declare function updateVaultMemoryEmbeddingOp(ctx: VaultMemoryOperationsContext,
  *     candidate to be reconciled against the vault — it is an already-decided
  *     fact the server has published.
  *
- * The rows are written `visibility: "public"` because they genuinely ARE
- * published — the reconciler reads local visibility as the user's intent, and
- * anything else would make it immediately revoke a memory the user never turned
- * off. They carry `source: SOURCE_PHOTO`, which is what exempts them from
- * decay's auto-archive; see the note there for why archiving one would silently
- * unpublish it.
+ * The rows are written `scope: "shared"` because they genuinely ARE published.
+ * `scope === 'shared'` is the publication axis — the single one. The reconciler
+ * reads local scope as the user's intent, and it builds its `local` set from a
+ * vault read narrowed to `{scopes: ['shared']}`. A row stamped anything else
+ * never enters that read, so it is never adopted into the publish ledger, and
+ * `toRevoke` is computed only over ids the ledger holds. The user's off-toggle
+ * would then do nothing server-side while nearby kept serving the memory. The
+ * `visibility` column is legacy: nothing reads it any more. They carry
+ * `source: SOURCE_PHOTO`, which is what exempts them from decay's auto-archive;
+ * see the note there for why archiving one would silently unpublish it.
  *
  * No embedding is computed here. `searchTool`'s un-embedded lane embeds any row
  * lacking a vector at search time, uses it in that same search and persists it
@@ -7050,6 +7065,29 @@ interface PhotoIngestResult {
  * class of bug as publishing a version the user has since changed. Re-ingesting
  * changed text is a follow-up that needs a merge decision, not a clobber.
  *
+ * That skip is also why this op does NOT repair a row an older build stamped
+ * `scope: "private"`. Such a row is present, so ingest leaves it alone, and it
+ * stays outside the published-set read. The user's switch cannot revoke it.
+ * Repair belongs in a one-time pass at upgrade. Do not add it here, for two
+ * reasons:
+ *
+ *  - **The two states are indistinguishable from this op.** After this build a
+ *    `photo:` row with `scope: "private"` is also exactly what the user's own
+ *    off-toggle produces. The toggle calls `updateVaultMemoryOp`, which writes
+ *    `scope` and never touches `visibility`, so the mis-stamped row and the
+ *    turned-off row carry identical columns. No test here can tell them apart.
+ *
+ *  - **A re-stamp here would revert the off-toggle.** The pass runs ingest
+ *    BEFORE it reads the vault, so a row re-stamped `shared` re-enters the
+ *    desired set on that same pass and never reaches `toRevoke`. The switch
+ *    would spring back to "on" and nearby would keep serving the memory. That
+ *    is worse than the bug it repairs.
+ *
+ * A one-time pass does not have the ambiguity. Before this build the switch
+ * already read "off" for these rows, because it reads `scope`, so no user can
+ * have turned one off. Every `private` photo row at that instant came from the
+ * old stamp.
+ *
  * Non-`photo:` ids are ignored: everything else in the published set is a
  * client-published memory that by definition already lives in this vault (or in
  * another device's, which is not ours to recreate).

package/dist/expo/index.mjs

@@ -132,7 +132,7 @@ import {
   upsertMessageOp,
   useEncryption,
   vaultMemoryToStored
-} from "./chunk-732ZLOLA.mjs";
+} from "./chunk-JA7CDJCA.mjs";
 import {
   PII_PATTERNS,
   PiiRedactor,
@@ -140,7 +140,7 @@ import {
   isPiiRedactor,
   notifyConsolidationFallback,
   resolvePiiRedactor
-} from "./chunk-OUFITMDL.mjs";
+} from "./chunk-M4JSLFTQ.mjs";
 import {
   INTERNAL_FLOW_MARKER,
   callPortalJsonCompletion,
@@ -154,7 +154,7 @@ import {
   taskTypeHeader,
   validateEndpointOverride,
   withInternalFlowMarker
-} from "./chunk-CJ32HO6Q.mjs";
+} from "./chunk-O25LUKBK.mjs";
 import {
   BASE_URL,
   MCP_R2_DOMAIN,
@@ -5819,7 +5819,7 @@ async function ingestPublishedPhotoMemoriesOp(ctx, rows) {
       ({ row, content }) => ctx.vaultMemoryCollection.prepareCreate((record) => {
         record._raw.id = row.memoryId;
         record._setRaw("content", content);
-        record._setRaw("scope", "private");
+        record._setRaw("scope", "shared");
         record._setRaw("folder_id", null);
         record._setRaw("user_id", ctx.userId ?? null);
         record._setRaw("is_deleted", false);
@@ -6868,7 +6868,7 @@ async function tryConsolidate(trimmed, ctx, options, prepared) {
     content: m.content,
     similarity: m.similarity
   }));
-  const { consolidateMemory: doConsolidate } = await import("./consolidate-4BMNVOL4.mjs");
+  const { consolidateMemory: doConsolidate } = await import("./consolidate-S3KFA2WT.mjs");
   const decision = await doConsolidate(trimmed, candidates, consolidateOptions);
   if (decision.action === "create") return null;
   if (decision.action === "supersede" && decision.content) {

package/dist/expo/{recall-PIATJ336.mjs → recall-JYVHWU6N.mjs}

@@ -1,7 +1,7 @@
 import {
   recall
-} from "./chunk-732ZLOLA.mjs";
-import "./chunk-CJ32HO6Q.mjs";
+} from "./chunk-JA7CDJCA.mjs";
+import "./chunk-O25LUKBK.mjs";
 import "./chunk-GYKJOWEO.mjs";
 export {
   recall

package/dist/react/{chunk-DY5VGC6K.mjs → chunk-2XLHV2XW.mjs}

@@ -1,6 +1,6 @@
 import {
   getLogger
-} from "./chunk-CJ32HO6Q.mjs";
+} from "./chunk-O25LUKBK.mjs";
 
 // src/lib/pii/patterns.ts
 function luhnCheck(digits) {

package/dist/react/{chunk-6IBFFWCE.mjs → chunk-DNSPMVBY.mjs}

@@ -1,7 +1,7 @@
 import {
   callPortalJsonCompletion,
   getLogger
-} from "./chunk-CJ32HO6Q.mjs";
+} from "./chunk-O25LUKBK.mjs";
 import {
   BASE_URL,
   createClientConfig
@@ -7169,7 +7169,7 @@ function createMemoryVaultSearchTool(vaultCtx, embeddingOptions, cache, searchOp
             subQueries = decomp.subQueries;
           }
         }
-        const { recall: recall2 } = await import("./recall-QUWN7DJ7.mjs");
+        const { recall: recall2 } = await import("./recall-2BWBJWGG.mjs");
         let recallDegraded = [];
         const result = await recall2(
           query,

package/dist/{expo/chunk-CJ32HO6Q.mjs → react/chunk-O25LUKBK.mjs}

@@ -65,6 +65,7 @@ function defaultBaseUrl() {
 }
 var RESPONSE_FORMAT_OK = /* @__PURE__ */ new Set(["openai", "inclusionai", "deepseek"]);
 var RESPONSE_SCHEMA_OK = /* @__PURE__ */ new Set(["openai"]);
+var JSON_CONTRACT_REMINDER = "Output ONLY the strict JSON object requested. No prose, no explanation, no markdown.";
 function supportsResponseFormat(model, variant = "json_object") {
   const allow = variant === "json_schema" ? RESPONSE_SCHEMA_OK : RESPONSE_FORMAT_OK;
   return model.split("/").some((seg) => allow.has(seg));
@@ -122,6 +123,7 @@ async function callPortalJsonCompletion(req) {
   const startedAt = Date.now();
   const overBudget = () => req.totalTimeoutMs !== void 0 && Date.now() - startedAt >= req.totalTimeoutMs;
   let lastFailure;
+  let reinforce = false;
   const giveUp = () => {
     req.onFailure?.(lastFailure ?? { reason: "network", attempts: maxAttempts });
     return null;
@@ -137,8 +139,9 @@ async function callPortalJsonCompletion(req) {
       timeoutMs: Math.max(
         1,
         Math.min(req.timeoutMs ?? 6e4, req.totalTimeoutMs - (Date.now() - startedAt))
-      )
-    } : req;
+      ),
+      ...reinforce && { reinforceJsonContract: true }
+    } : reinforce ? { ...req, reinforceJsonContract: true } : req;
     const outcome = await attemptPortalJson(attemptReq, endpoint);
     if (outcome.kind === "ok") return outcome.value;
     lastFailure = {
@@ -146,6 +149,7 @@ async function callPortalJsonCompletion(req) {
       ...outcome.httpStatus !== void 0 && { httpStatus: outcome.httpStatus },
       attempts: attempt
     };
+    if (outcome.code === "invalid-json" || outcome.code === "null-completion") reinforce = true;
     if (outcome.kind === "terminal") {
       log.warn(`[${req.tag}] ${outcome.reason}`);
       return giveUp();
@@ -184,6 +188,11 @@ async function attemptPortalJson(req, endpoint) {
     // keeps the portal's detector reading them as genuine rather than markerless.
     // See ../internalFlowMarker.
     { role: "system", content: withInternalFlowMarker(req.systemPrompt) },
+    // Retry-only. Kept as a SEPARATE message rather than appended to the system
+    // prompt so the marked prompt above stays byte-identical across attempts —
+    // the portal's internal-flow detector reads that one, and rewriting it on a
+    // retry would change what the detector sees for reasons unrelated to auth.
+    ...req.reinforceJsonContract ? [{ role: "system", content: JSON_CONTRACT_REMINDER }] : [],
     { role: "user", content: req.userMessage }
   ];
   if (prefill) messages.push({ role: "assistant", content: prefill });

package/dist/{expo/consolidate-4BMNVOL4.mjs → react/consolidate-LSDBMQDW.mjs}

@@ -1,10 +1,10 @@
 import {
   notifyConsolidationFallback,
   resolvePiiRedactor
-} from "./chunk-OUFITMDL.mjs";
+} from "./chunk-2XLHV2XW.mjs";
 import {
   callPortalJsonCompletion
-} from "./chunk-CJ32HO6Q.mjs";
+} from "./chunk-O25LUKBK.mjs";
 import "./chunk-GYKJOWEO.mjs";
 
 // src/lib/memory/consolidate.ts

package/dist/react/index.cjs

@@ -6481,6 +6481,7 @@ async function callPortalJsonCompletion(req) {
   const startedAt = Date.now();
   const overBudget = () => req.totalTimeoutMs !== void 0 && Date.now() - startedAt >= req.totalTimeoutMs;
   let lastFailure;
+  let reinforce = false;
   const giveUp = () => {
     req.onFailure?.(lastFailure ?? { reason: "network", attempts: maxAttempts });
     return null;
@@ -6496,8 +6497,9 @@ async function callPortalJsonCompletion(req) {
       timeoutMs: Math.max(
         1,
         Math.min(req.timeoutMs ?? 6e4, req.totalTimeoutMs - (Date.now() - startedAt))
-      )
-    } : req;
+      ),
+      ...reinforce && { reinforceJsonContract: true }
+    } : reinforce ? { ...req, reinforceJsonContract: true } : req;
     const outcome = await attemptPortalJson(attemptReq, endpoint);
     if (outcome.kind === "ok") return outcome.value;
     lastFailure = {
@@ -6505,6 +6507,7 @@ async function callPortalJsonCompletion(req) {
       ...outcome.httpStatus !== void 0 && { httpStatus: outcome.httpStatus },
       attempts: attempt
     };
+    if (outcome.code === "invalid-json" || outcome.code === "null-completion") reinforce = true;
     if (outcome.kind === "terminal") {
       log.warn(`[${req.tag}] ${outcome.reason}`);
       return giveUp();
@@ -6543,6 +6546,11 @@ async function attemptPortalJson(req, endpoint) {
     // keeps the portal's detector reading them as genuine rather than markerless.
     // See ../internalFlowMarker.
     { role: "system", content: withInternalFlowMarker(req.systemPrompt) },
+    // Retry-only. Kept as a SEPARATE message rather than appended to the system
+    // prompt so the marked prompt above stays byte-identical across attempts —
+    // the portal's internal-flow detector reads that one, and rewriting it on a
+    // retry would change what the detector sees for reasons unrelated to auth.
+    ...req.reinforceJsonContract ? [{ role: "system", content: JSON_CONTRACT_REMINDER }] : [],
     { role: "user", content: req.userMessage }
   ];
   if (prefill) messages.push({ role: "assistant", content: prefill });
@@ -6705,7 +6713,7 @@ function extractCompletionContent(body) {
   const content = first?.message?.content;
   return typeof content === "string" ? content : null;
 }
-var RESPONSE_FORMAT_OK, RESPONSE_SCHEMA_OK, RETRYABLE_HTTP;
+var RESPONSE_FORMAT_OK, RESPONSE_SCHEMA_OK, JSON_CONTRACT_REMINDER, RETRYABLE_HTTP;
 var init_portalLlm = __esm({
   "src/lib/memory/portalLlm.ts"() {
     "use strict";
@@ -6716,6 +6724,7 @@ var init_portalLlm = __esm({
     init_taskType();
     RESPONSE_FORMAT_OK = /* @__PURE__ */ new Set(["openai", "inclusionai", "deepseek"]);
     RESPONSE_SCHEMA_OK = /* @__PURE__ */ new Set(["openai"]);
+    JSON_CONTRACT_REMINDER = "Output ONLY the strict JSON object requested. No prose, no explanation, no markdown.";
     RETRYABLE_HTTP = /* @__PURE__ */ new Set([408, 409, 425, 429]);
   }
 });
@@ -17067,7 +17076,7 @@ async function ingestPublishedPhotoMemoriesOp(ctx, rows) {
       ({ row, content }) => ctx.vaultMemoryCollection.prepareCreate((record) => {
         record._raw.id = row.memoryId;
         record._setRaw("content", content);
-        record._setRaw("scope", "private");
+        record._setRaw("scope", "shared");
         record._setRaw("folder_id", null);
         record._setRaw("user_id", ctx.userId ?? null);
         record._setRaw("is_deleted", false);

package/dist/react/index.d.mts

@@ -7604,15 +7604,26 @@ declare function extractAndRetain(messages: AutoExtractMessage[], retainCtx: Ret
 }>;
 
 /**
- * People Nearby cross-user visibility. ORTHOGONAL to `scope` (model access):
- * - `private`: local-only (default; null column grandfathered as private)
- * - `public`: embedding + plaintext may be published (compatibility matching,
- *   profile display, discovery answers, digital-twin prompts)
+ * LEGACY. This column no longer decides anything.
+ *
+ * `scope === 'shared'` is now the single publication axis: it means the memory
+ * is on the People Nearby profile, its text goes to the nearby server, and it
+ * may inform what strangers see. `scope: 'private'` means it is not. There is
+ * no second control, and scope no longer gates model access either — every
+ * model tier reads every memory. Do NOT reason about publication from this
+ * type; read `scope`.
+ *
+ * The column survives in the schema and is still stamped on writes so that
+ * stored rows stay readable by builds that predate the change. Nothing on a
+ * current build reads it to make a decision.
+ *
+ * Values, kept for tolerance of already-stored data:
+ * - `private`: local-only (a null column reads as private)
+ * - `public`: the row was published
  *
  * TWO TIERS ONLY (decided 2026-07-27). An earlier design had a middle
  * `matchable` tier that published a memory's embedding while keeping its text
- * on-device; it was dropped, so a memory either never leaves the device or is
- * published with its content. Any unrecognised stored value — including a
+ * on-device; it was dropped. Any unrecognised stored value — including a
  * `matchable` row written by a pre-release build — reads as `private`, which is
  * the fail-safe direction: it un-publishes rather than exposes.
  */
@@ -8352,12 +8363,16 @@ declare function updateVaultMemoryEmbeddingOp(ctx: VaultMemoryOperationsContext,
  *     candidate to be reconciled against the vault — it is an already-decided
  *     fact the server has published.
  *
- * The rows are written `visibility: "public"` because they genuinely ARE
- * published — the reconciler reads local visibility as the user's intent, and
- * anything else would make it immediately revoke a memory the user never turned
- * off. They carry `source: SOURCE_PHOTO`, which is what exempts them from
- * decay's auto-archive; see the note there for why archiving one would silently
- * unpublish it.
+ * The rows are written `scope: "shared"` because they genuinely ARE published.
+ * `scope === 'shared'` is the publication axis — the single one. The reconciler
+ * reads local scope as the user's intent, and it builds its `local` set from a
+ * vault read narrowed to `{scopes: ['shared']}`. A row stamped anything else
+ * never enters that read, so it is never adopted into the publish ledger, and
+ * `toRevoke` is computed only over ids the ledger holds. The user's off-toggle
+ * would then do nothing server-side while nearby kept serving the memory. The
+ * `visibility` column is legacy: nothing reads it any more. They carry
+ * `source: SOURCE_PHOTO`, which is what exempts them from decay's auto-archive;
+ * see the note there for why archiving one would silently unpublish it.
  *
  * No embedding is computed here. `searchTool`'s un-embedded lane embeds any row
  * lacking a vector at search time, uses it in that same search and persists it
@@ -8405,6 +8420,29 @@ interface PhotoIngestResult {
  * class of bug as publishing a version the user has since changed. Re-ingesting
  * changed text is a follow-up that needs a merge decision, not a clobber.
  *
+ * That skip is also why this op does NOT repair a row an older build stamped
+ * `scope: "private"`. Such a row is present, so ingest leaves it alone, and it
+ * stays outside the published-set read. The user's switch cannot revoke it.
+ * Repair belongs in a one-time pass at upgrade. Do not add it here, for two
+ * reasons:
+ *
+ *  - **The two states are indistinguishable from this op.** After this build a
+ *    `photo:` row with `scope: "private"` is also exactly what the user's own
+ *    off-toggle produces. The toggle calls `updateVaultMemoryOp`, which writes
+ *    `scope` and never touches `visibility`, so the mis-stamped row and the
+ *    turned-off row carry identical columns. No test here can tell them apart.
+ *
+ *  - **A re-stamp here would revert the off-toggle.** The pass runs ingest
+ *    BEFORE it reads the vault, so a row re-stamped `shared` re-enters the
+ *    desired set on that same pass and never reaches `toRevoke`. The switch
+ *    would spring back to "on" and nearby would keep serving the memory. That
+ *    is worse than the bug it repairs.
+ *
+ * A one-time pass does not have the ambiguity. Before this build the switch
+ * already read "off" for these rows, because it reads `scope`, so no user can
+ * have turned one off. Every `private` photo row at that instant came from the
+ * old stamp.
+ *
  * Non-`photo:` ids are ignored: everything else in the published set is a
  * client-published memory that by definition already lives in this vault (or in
  * another device's, which is not ours to recreate).

package/dist/react/index.d.ts

@@ -7604,15 +7604,26 @@ declare function extractAndRetain(messages: AutoExtractMessage[], retainCtx: Ret
 }>;
 
 /**
- * People Nearby cross-user visibility. ORTHOGONAL to `scope` (model access):
- * - `private`: local-only (default; null column grandfathered as private)
- * - `public`: embedding + plaintext may be published (compatibility matching,
- *   profile display, discovery answers, digital-twin prompts)
+ * LEGACY. This column no longer decides anything.
+ *
+ * `scope === 'shared'` is now the single publication axis: it means the memory
+ * is on the People Nearby profile, its text goes to the nearby server, and it
+ * may inform what strangers see. `scope: 'private'` means it is not. There is
+ * no second control, and scope no longer gates model access either — every
+ * model tier reads every memory. Do NOT reason about publication from this
+ * type; read `scope`.
+ *
+ * The column survives in the schema and is still stamped on writes so that
+ * stored rows stay readable by builds that predate the change. Nothing on a
+ * current build reads it to make a decision.
+ *
+ * Values, kept for tolerance of already-stored data:
+ * - `private`: local-only (a null column reads as private)
+ * - `public`: the row was published
  *
  * TWO TIERS ONLY (decided 2026-07-27). An earlier design had a middle
  * `matchable` tier that published a memory's embedding while keeping its text
- * on-device; it was dropped, so a memory either never leaves the device or is
- * published with its content. Any unrecognised stored value — including a
+ * on-device; it was dropped. Any unrecognised stored value — including a
  * `matchable` row written by a pre-release build — reads as `private`, which is
  * the fail-safe direction: it un-publishes rather than exposes.
  */
@@ -8352,12 +8363,16 @@ declare function updateVaultMemoryEmbeddingOp(ctx: VaultMemoryOperationsContext,
  *     candidate to be reconciled against the vault — it is an already-decided
  *     fact the server has published.
  *
- * The rows are written `visibility: "public"` because they genuinely ARE
- * published — the reconciler reads local visibility as the user's intent, and
- * anything else would make it immediately revoke a memory the user never turned
- * off. They carry `source: SOURCE_PHOTO`, which is what exempts them from
- * decay's auto-archive; see the note there for why archiving one would silently
- * unpublish it.
+ * The rows are written `scope: "shared"` because they genuinely ARE published.
+ * `scope === 'shared'` is the publication axis — the single one. The reconciler
+ * reads local scope as the user's intent, and it builds its `local` set from a
+ * vault read narrowed to `{scopes: ['shared']}`. A row stamped anything else
+ * never enters that read, so it is never adopted into the publish ledger, and
+ * `toRevoke` is computed only over ids the ledger holds. The user's off-toggle
+ * would then do nothing server-side while nearby kept serving the memory. The
+ * `visibility` column is legacy: nothing reads it any more. They carry
+ * `source: SOURCE_PHOTO`, which is what exempts them from decay's auto-archive;
+ * see the note there for why archiving one would silently unpublish it.
  *
  * No embedding is computed here. `searchTool`'s un-embedded lane embeds any row
  * lacking a vector at search time, uses it in that same search and persists it
@@ -8405,6 +8420,29 @@ interface PhotoIngestResult {
  * class of bug as publishing a version the user has since changed. Re-ingesting
  * changed text is a follow-up that needs a merge decision, not a clobber.
  *
+ * That skip is also why this op does NOT repair a row an older build stamped
+ * `scope: "private"`. Such a row is present, so ingest leaves it alone, and it
+ * stays outside the published-set read. The user's switch cannot revoke it.
+ * Repair belongs in a one-time pass at upgrade. Do not add it here, for two
+ * reasons:
+ *
+ *  - **The two states are indistinguishable from this op.** After this build a
+ *    `photo:` row with `scope: "private"` is also exactly what the user's own
+ *    off-toggle produces. The toggle calls `updateVaultMemoryOp`, which writes
+ *    `scope` and never touches `visibility`, so the mis-stamped row and the
+ *    turned-off row carry identical columns. No test here can tell them apart.
+ *
+ *  - **A re-stamp here would revert the off-toggle.** The pass runs ingest
+ *    BEFORE it reads the vault, so a row re-stamped `shared` re-enters the
+ *    desired set on that same pass and never reaches `toRevoke`. The switch
+ *    would spring back to "on" and nearby would keep serving the memory. That
+ *    is worse than the bug it repairs.
+ *
+ * A one-time pass does not have the ambiguity. Before this build the switch
+ * already read "off" for these rows, because it reads `scope`, so no user can
+ * have turned one off. Every `private` photo row at that instant came from the
+ * old stamp.
+ *
  * Non-`photo:` ids are ignored: everything else in the published set is a
  * client-published memory that by definition already lives in this vault (or in
  * another device's, which is not ours to recreate).

package/dist/react/index.mjs

@@ -178,14 +178,14 @@ import {
   updateVaultMemoryOp,
   useEncryption,
   vaultMemoryToStored
-} from "./chunk-6IBFFWCE.mjs";
+} from "./chunk-DNSPMVBY.mjs";
 import {
   PiiRedactor,
   createStreamingDeAnonymizer,
   isPiiRedactor,
   notifyConsolidationFallback,
   resolvePiiRedactor
-} from "./chunk-DY5VGC6K.mjs";
+} from "./chunk-2XLHV2XW.mjs";
 import {
   INTERNAL_FLOW_MARKER,
   callPortalJsonCompletion,
@@ -199,7 +199,7 @@ import {
   taskTypeHeader,
   validateEndpointOverride,
   withInternalFlowMarker
-} from "./chunk-CJ32HO6Q.mjs";
+} from "./chunk-O25LUKBK.mjs";
 import {
   BASE_URL,
   MCP_R2_DOMAIN,
@@ -6976,7 +6976,7 @@ async function ingestPublishedPhotoMemoriesOp(ctx, rows) {
       ({ row, content }) => ctx.vaultMemoryCollection.prepareCreate((record) => {
         record._raw.id = row.memoryId;
         record._setRaw("content", content);
-        record._setRaw("scope", "private");
+        record._setRaw("scope", "shared");
         record._setRaw("folder_id", null);
         record._setRaw("user_id", ctx.userId ?? null);
         record._setRaw("is_deleted", false);
@@ -7686,7 +7686,7 @@ async function tryConsolidate(trimmed, ctx, options, prepared) {
     content: m.content,
     similarity: m.similarity
   }));
-  const { consolidateMemory: doConsolidate } = await import("./consolidate-5TP3J6BY.mjs");
+  const { consolidateMemory: doConsolidate } = await import("./consolidate-LSDBMQDW.mjs");
   const decision = await doConsolidate(trimmed, candidates, consolidateOptions);
   if (decision.action === "create") return null;
   if (decision.action === "supersede" && decision.content) {

package/dist/react/{recall-QUWN7DJ7.mjs → recall-2BWBJWGG.mjs}

@@ -1,7 +1,7 @@
 import {
   recall
-} from "./chunk-6IBFFWCE.mjs";
-import "./chunk-CJ32HO6Q.mjs";
+} from "./chunk-DNSPMVBY.mjs";
+import "./chunk-O25LUKBK.mjs";
 import "./chunk-GYKJOWEO.mjs";
 export {
   recall

package/dist/server/{chunk-KF5OU4IN.mjs → chunk-7D3RI25K.mjs}

@@ -52,6 +52,7 @@ function defaultBaseUrl() {
 }
 var RESPONSE_FORMAT_OK = /* @__PURE__ */ new Set(["openai", "inclusionai", "deepseek"]);
 var RESPONSE_SCHEMA_OK = /* @__PURE__ */ new Set(["openai"]);
+var JSON_CONTRACT_REMINDER = "Output ONLY the strict JSON object requested. No prose, no explanation, no markdown.";
 function supportsResponseFormat(model, variant = "json_object") {
   const allow = variant === "json_schema" ? RESPONSE_SCHEMA_OK : RESPONSE_FORMAT_OK;
   return model.split("/").some((seg) => allow.has(seg));
@@ -109,6 +110,7 @@ async function callPortalJsonCompletion(req) {
   const startedAt = Date.now();
   const overBudget = () => req.totalTimeoutMs !== void 0 && Date.now() - startedAt >= req.totalTimeoutMs;
   let lastFailure;
+  let reinforce = false;
   const giveUp = () => {
     req.onFailure?.(lastFailure ?? { reason: "network", attempts: maxAttempts });
     return null;
@@ -124,8 +126,9 @@ async function callPortalJsonCompletion(req) {
       timeoutMs: Math.max(
         1,
         Math.min(req.timeoutMs ?? 6e4, req.totalTimeoutMs - (Date.now() - startedAt))
-      )
-    } : req;
+      ),
+      ...reinforce && { reinforceJsonContract: true }
+    } : reinforce ? { ...req, reinforceJsonContract: true } : req;
     const outcome = await attemptPortalJson(attemptReq, endpoint);
     if (outcome.kind === "ok") return outcome.value;
     lastFailure = {
@@ -133,6 +136,7 @@ async function callPortalJsonCompletion(req) {
       ...outcome.httpStatus !== void 0 && { httpStatus: outcome.httpStatus },
       attempts: attempt
     };
+    if (outcome.code === "invalid-json" || outcome.code === "null-completion") reinforce = true;
     if (outcome.kind === "terminal") {
       log.warn(`[${req.tag}] ${outcome.reason}`);
       return giveUp();
@@ -171,6 +175,11 @@ async function attemptPortalJson(req, endpoint) {
     // keeps the portal's detector reading them as genuine rather than markerless.
     // See ../internalFlowMarker.
     { role: "system", content: withInternalFlowMarker(req.systemPrompt) },
+    // Retry-only. Kept as a SEPARATE message rather than appended to the system
+    // prompt so the marked prompt above stays byte-identical across attempts —
+    // the portal's internal-flow detector reads that one, and rewriting it on a
+    // retry would change what the detector sees for reasons unrelated to auth.
+    ...req.reinforceJsonContract ? [{ role: "system", content: JSON_CONTRACT_REMINDER }] : [],
     { role: "user", content: req.userMessage }
   ];
   if (prefill) messages.push({ role: "assistant", content: prefill });

package/dist/server/{chunk-MEQ2PAEX.mjs → chunk-GP6YY6H5.mjs}

@@ -1,6 +1,6 @@
 import {
   getLogger
-} from "./chunk-KF5OU4IN.mjs";
+} from "./chunk-7D3RI25K.mjs";
 
 // src/lib/pii/patterns.ts
 function luhnCheck(digits) {

package/dist/server/{chunk-7YTEE6JT.mjs → chunk-O7TB36P3.mjs}

@@ -1,7 +1,7 @@
 import {
   callPortalJsonCompletion,
   getLogger
-} from "./chunk-KF5OU4IN.mjs";
+} from "./chunk-7D3RI25K.mjs";
 import {
   BASE_URL,
   __commonJS,
@@ -20923,7 +20923,7 @@ function createMemoryVaultSearchTool(vaultCtx, embeddingOptions, cache, searchOp
             subQueries = decomp.subQueries;
           }
         }
-        const { recall: recall2 } = await import("./recall-HOVWMT4Q.mjs");
+        const { recall: recall2 } = await import("./recall-VHU372MK.mjs");
         let recallDegraded = [];
         const result = await recall2(
           query,

package/dist/server/{consolidate-QDWEYFTZ.mjs → consolidate-Z2JJP7LW.mjs}

@@ -1,10 +1,10 @@
 import {
   notifyConsolidationFallback,
   resolvePiiRedactor
-} from "./chunk-MEQ2PAEX.mjs";
+} from "./chunk-GP6YY6H5.mjs";
 import {
   callPortalJsonCompletion
-} from "./chunk-KF5OU4IN.mjs";
+} from "./chunk-7D3RI25K.mjs";
 import "./chunk-3RPGXXPZ.mjs";
 
 // src/lib/memory/consolidate.ts

package/dist/server/index.cjs

@@ -20663,6 +20663,7 @@ async function callPortalJsonCompletion(req) {
   const startedAt = Date.now();
   const overBudget = () => req.totalTimeoutMs !== void 0 && Date.now() - startedAt >= req.totalTimeoutMs;
   let lastFailure;
+  let reinforce = false;
   const giveUp = () => {
     req.onFailure?.(lastFailure ?? { reason: "network", attempts: maxAttempts });
     return null;
@@ -20678,8 +20679,9 @@ async function callPortalJsonCompletion(req) {
       timeoutMs: Math.max(
         1,
         Math.min(req.timeoutMs ?? 6e4, req.totalTimeoutMs - (Date.now() - startedAt))
-      )
-    } : req;
+      ),
+      ...reinforce && { reinforceJsonContract: true }
+    } : reinforce ? { ...req, reinforceJsonContract: true } : req;
     const outcome = await attemptPortalJson(attemptReq, endpoint);
     if (outcome.kind === "ok") return outcome.value;
     lastFailure = {
@@ -20687,6 +20689,7 @@ async function callPortalJsonCompletion(req) {
       ...outcome.httpStatus !== void 0 && { httpStatus: outcome.httpStatus },
       attempts: attempt
     };
+    if (outcome.code === "invalid-json" || outcome.code === "null-completion") reinforce = true;
     if (outcome.kind === "terminal") {
       log.warn(`[${req.tag}] ${outcome.reason}`);
       return giveUp();
@@ -20725,6 +20728,11 @@ async function attemptPortalJson(req, endpoint) {
     // keeps the portal's detector reading them as genuine rather than markerless.
     // See ../internalFlowMarker.
     { role: "system", content: withInternalFlowMarker(req.systemPrompt) },
+    // Retry-only. Kept as a SEPARATE message rather than appended to the system
+    // prompt so the marked prompt above stays byte-identical across attempts —
+    // the portal's internal-flow detector reads that one, and rewriting it on a
+    // retry would change what the detector sees for reasons unrelated to auth.
+    ...req.reinforceJsonContract ? [{ role: "system", content: JSON_CONTRACT_REMINDER }] : [],
     { role: "user", content: req.userMessage }
   ];
   if (prefill) messages.push({ role: "assistant", content: prefill });
@@ -20887,7 +20895,7 @@ function extractCompletionContent(body) {
   const content = first?.message?.content;
   return typeof content === "string" ? content : null;
 }
-var RESPONSE_FORMAT_OK, RESPONSE_SCHEMA_OK, RETRYABLE_HTTP;
+var RESPONSE_FORMAT_OK, RESPONSE_SCHEMA_OK, JSON_CONTRACT_REMINDER, RETRYABLE_HTTP;
 var init_portalLlm = __esm({
   "src/lib/memory/portalLlm.ts"() {
     "use strict";
@@ -20898,6 +20906,7 @@ var init_portalLlm = __esm({
     init_taskType();
     RESPONSE_FORMAT_OK = /* @__PURE__ */ new Set(["openai", "inclusionai", "deepseek"]);
     RESPONSE_SCHEMA_OK = /* @__PURE__ */ new Set(["openai"]);
+    JSON_CONTRACT_REMINDER = "Output ONLY the strict JSON object requested. No prose, no explanation, no markdown.";
     RETRYABLE_HTTP = /* @__PURE__ */ new Set([408, 409, 425, 429]);
   }
 });
@@ -27417,7 +27426,7 @@ async function ingestPublishedPhotoMemoriesOp(ctx, rows) {
       ({ row, content }) => ctx.vaultMemoryCollection.prepareCreate((record) => {
         record._raw.id = row.memoryId;
         record._setRaw("content", content);
-        record._setRaw("scope", "private");
+        record._setRaw("scope", "shared");
         record._setRaw("folder_id", null);
         record._setRaw("user_id", ctx.userId ?? null);
         record._setRaw("is_deleted", false);

package/dist/server/index.d.mts

@@ -6253,15 +6253,26 @@ declare function extractAndRetain(messages: AutoExtractMessage[], retainCtx: Ret
 }>;
 
 /**
- * People Nearby cross-user visibility. ORTHOGONAL to `scope` (model access):
- * - `private`: local-only (default; null column grandfathered as private)
- * - `public`: embedding + plaintext may be published (compatibility matching,
- *   profile display, discovery answers, digital-twin prompts)
+ * LEGACY. This column no longer decides anything.
+ *
+ * `scope === 'shared'` is now the single publication axis: it means the memory
+ * is on the People Nearby profile, its text goes to the nearby server, and it
+ * may inform what strangers see. `scope: 'private'` means it is not. There is
+ * no second control, and scope no longer gates model access either — every
+ * model tier reads every memory. Do NOT reason about publication from this
+ * type; read `scope`.
+ *
+ * The column survives in the schema and is still stamped on writes so that
+ * stored rows stay readable by builds that predate the change. Nothing on a
+ * current build reads it to make a decision.
+ *
+ * Values, kept for tolerance of already-stored data:
+ * - `private`: local-only (a null column reads as private)
+ * - `public`: the row was published
  *
  * TWO TIERS ONLY (decided 2026-07-27). An earlier design had a middle
  * `matchable` tier that published a memory's embedding while keeping its text
- * on-device; it was dropped, so a memory either never leaves the device or is
- * published with its content. Any unrecognised stored value — including a
+ * on-device; it was dropped. Any unrecognised stored value — including a
  * `matchable` row written by a pre-release build — reads as `private`, which is
  * the fail-safe direction: it un-publishes rather than exposes.
  */
@@ -6853,12 +6864,16 @@ declare function updateVaultMemoryEmbeddingOp(ctx: VaultMemoryOperationsContext,
  *     candidate to be reconciled against the vault — it is an already-decided
  *     fact the server has published.
  *
- * The rows are written `visibility: "public"` because they genuinely ARE
- * published — the reconciler reads local visibility as the user's intent, and
- * anything else would make it immediately revoke a memory the user never turned
- * off. They carry `source: SOURCE_PHOTO`, which is what exempts them from
- * decay's auto-archive; see the note there for why archiving one would silently
- * unpublish it.
+ * The rows are written `scope: "shared"` because they genuinely ARE published.
+ * `scope === 'shared'` is the publication axis — the single one. The reconciler
+ * reads local scope as the user's intent, and it builds its `local` set from a
+ * vault read narrowed to `{scopes: ['shared']}`. A row stamped anything else
+ * never enters that read, so it is never adopted into the publish ledger, and
+ * `toRevoke` is computed only over ids the ledger holds. The user's off-toggle
+ * would then do nothing server-side while nearby kept serving the memory. The
+ * `visibility` column is legacy: nothing reads it any more. They carry
+ * `source: SOURCE_PHOTO`, which is what exempts them from decay's auto-archive;
+ * see the note there for why archiving one would silently unpublish it.
  *
  * No embedding is computed here. `searchTool`'s un-embedded lane embeds any row
  * lacking a vector at search time, uses it in that same search and persists it
@@ -6906,6 +6921,29 @@ interface PhotoIngestResult {
  * class of bug as publishing a version the user has since changed. Re-ingesting
  * changed text is a follow-up that needs a merge decision, not a clobber.
  *
+ * That skip is also why this op does NOT repair a row an older build stamped
+ * `scope: "private"`. Such a row is present, so ingest leaves it alone, and it
+ * stays outside the published-set read. The user's switch cannot revoke it.
+ * Repair belongs in a one-time pass at upgrade. Do not add it here, for two
+ * reasons:
+ *
+ *  - **The two states are indistinguishable from this op.** After this build a
+ *    `photo:` row with `scope: "private"` is also exactly what the user's own
+ *    off-toggle produces. The toggle calls `updateVaultMemoryOp`, which writes
+ *    `scope` and never touches `visibility`, so the mis-stamped row and the
+ *    turned-off row carry identical columns. No test here can tell them apart.
+ *
+ *  - **A re-stamp here would revert the off-toggle.** The pass runs ingest
+ *    BEFORE it reads the vault, so a row re-stamped `shared` re-enters the
+ *    desired set on that same pass and never reaches `toRevoke`. The switch
+ *    would spring back to "on" and nearby would keep serving the memory. That
+ *    is worse than the bug it repairs.
+ *
+ * A one-time pass does not have the ambiguity. Before this build the switch
+ * already read "off" for these rows, because it reads `scope`, so no user can
+ * have turned one off. Every `private` photo row at that instant came from the
+ * old stamp.
+ *
  * Non-`photo:` ids are ignored: everything else in the published set is a
  * client-published memory that by definition already lives in this vault (or in
  * another device's, which is not ours to recreate).

package/dist/server/index.d.ts

@@ -6253,15 +6253,26 @@ declare function extractAndRetain(messages: AutoExtractMessage[], retainCtx: Ret
 }>;
 
 /**
- * People Nearby cross-user visibility. ORTHOGONAL to `scope` (model access):
- * - `private`: local-only (default; null column grandfathered as private)
- * - `public`: embedding + plaintext may be published (compatibility matching,
- *   profile display, discovery answers, digital-twin prompts)
+ * LEGACY. This column no longer decides anything.
+ *
+ * `scope === 'shared'` is now the single publication axis: it means the memory
+ * is on the People Nearby profile, its text goes to the nearby server, and it
+ * may inform what strangers see. `scope: 'private'` means it is not. There is
+ * no second control, and scope no longer gates model access either — every
+ * model tier reads every memory. Do NOT reason about publication from this
+ * type; read `scope`.
+ *
+ * The column survives in the schema and is still stamped on writes so that
+ * stored rows stay readable by builds that predate the change. Nothing on a
+ * current build reads it to make a decision.
+ *
+ * Values, kept for tolerance of already-stored data:
+ * - `private`: local-only (a null column reads as private)
+ * - `public`: the row was published
  *
  * TWO TIERS ONLY (decided 2026-07-27). An earlier design had a middle
  * `matchable` tier that published a memory's embedding while keeping its text
- * on-device; it was dropped, so a memory either never leaves the device or is
- * published with its content. Any unrecognised stored value — including a
+ * on-device; it was dropped. Any unrecognised stored value — including a
  * `matchable` row written by a pre-release build — reads as `private`, which is
  * the fail-safe direction: it un-publishes rather than exposes.
  */
@@ -6853,12 +6864,16 @@ declare function updateVaultMemoryEmbeddingOp(ctx: VaultMemoryOperationsContext,
  *     candidate to be reconciled against the vault — it is an already-decided
  *     fact the server has published.
  *
- * The rows are written `visibility: "public"` because they genuinely ARE
- * published — the reconciler reads local visibility as the user's intent, and
- * anything else would make it immediately revoke a memory the user never turned
- * off. They carry `source: SOURCE_PHOTO`, which is what exempts them from
- * decay's auto-archive; see the note there for why archiving one would silently
- * unpublish it.
+ * The rows are written `scope: "shared"` because they genuinely ARE published.
+ * `scope === 'shared'` is the publication axis — the single one. The reconciler
+ * reads local scope as the user's intent, and it builds its `local` set from a
+ * vault read narrowed to `{scopes: ['shared']}`. A row stamped anything else
+ * never enters that read, so it is never adopted into the publish ledger, and
+ * `toRevoke` is computed only over ids the ledger holds. The user's off-toggle
+ * would then do nothing server-side while nearby kept serving the memory. The
+ * `visibility` column is legacy: nothing reads it any more. They carry
+ * `source: SOURCE_PHOTO`, which is what exempts them from decay's auto-archive;
+ * see the note there for why archiving one would silently unpublish it.
  *
  * No embedding is computed here. `searchTool`'s un-embedded lane embeds any row
  * lacking a vector at search time, uses it in that same search and persists it
@@ -6906,6 +6921,29 @@ interface PhotoIngestResult {
  * class of bug as publishing a version the user has since changed. Re-ingesting
  * changed text is a follow-up that needs a merge decision, not a clobber.
  *
+ * That skip is also why this op does NOT repair a row an older build stamped
+ * `scope: "private"`. Such a row is present, so ingest leaves it alone, and it
+ * stays outside the published-set read. The user's switch cannot revoke it.
+ * Repair belongs in a one-time pass at upgrade. Do not add it here, for two
+ * reasons:
+ *
+ *  - **The two states are indistinguishable from this op.** After this build a
+ *    `photo:` row with `scope: "private"` is also exactly what the user's own
+ *    off-toggle produces. The toggle calls `updateVaultMemoryOp`, which writes
+ *    `scope` and never touches `visibility`, so the mis-stamped row and the
+ *    turned-off row carry identical columns. No test here can tell them apart.
+ *
+ *  - **A re-stamp here would revert the off-toggle.** The pass runs ingest
+ *    BEFORE it reads the vault, so a row re-stamped `shared` re-enters the
+ *    desired set on that same pass and never reaches `toRevoke`. The switch
+ *    would spring back to "on" and nearby would keep serving the memory. That
+ *    is worse than the bug it repairs.
+ *
+ * A one-time pass does not have the ambiguity. Before this build the switch
+ * already read "off" for these rows, because it reads `scope`, so no user can
+ * have turned one off. Every `private` photo row at that instant came from the
+ * old stamp.
+ *
  * Non-`photo:` ids are ignored: everything else in the published set is a
  * client-published memory that by definition already lives in this vault (or in
  * another device's, which is not ours to recreate).

package/dist/server/index.mjs

@@ -141,12 +141,12 @@ import {
   updateVaultMemoryOp,
   upsertMessageOp,
   vaultMemoryToStored
-} from "./chunk-7YTEE6JT.mjs";
+} from "./chunk-O7TB36P3.mjs";
 import {
   createStreamingDeAnonymizer,
   notifyConsolidationFallback,
   resolvePiiRedactor
-} from "./chunk-MEQ2PAEX.mjs";
+} from "./chunk-GP6YY6H5.mjs";
 import {
   INTERNAL_FLOW_MARKER,
   callPortalJsonCompletion,
@@ -157,7 +157,7 @@ import {
   taskTypeHeader,
   validateEndpointOverride,
   withInternalFlowMarker
-} from "./chunk-KF5OU4IN.mjs";
+} from "./chunk-7D3RI25K.mjs";
 import {
   BASE_URL,
   __commonJS,
@@ -3736,7 +3736,7 @@ async function ingestPublishedPhotoMemoriesOp(ctx, rows) {
       ({ row, content }) => ctx.vaultMemoryCollection.prepareCreate((record) => {
         record._raw.id = row.memoryId;
         record._setRaw("content", content);
-        record._setRaw("scope", "private");
+        record._setRaw("scope", "shared");
         record._setRaw("folder_id", null);
         record._setRaw("user_id", ctx.userId ?? null);
         record._setRaw("is_deleted", false);
@@ -5700,7 +5700,7 @@ async function tryConsolidate(trimmed, ctx, options, prepared) {
     content: m.content,
     similarity: m.similarity
   }));
-  const { consolidateMemory: doConsolidate } = await import("./consolidate-QDWEYFTZ.mjs");
+  const { consolidateMemory: doConsolidate } = await import("./consolidate-Z2JJP7LW.mjs");
   const decision = await doConsolidate(trimmed, candidates, consolidateOptions);
   if (decision.action === "create") return null;
   if (decision.action === "supersede" && decision.content) {

package/dist/server/{recall-HOVWMT4Q.mjs → recall-VHU372MK.mjs}

@@ -1,7 +1,7 @@
 import {
   recall
-} from "./chunk-7YTEE6JT.mjs";
-import "./chunk-KF5OU4IN.mjs";
+} from "./chunk-O7TB36P3.mjs";
+import "./chunk-7D3RI25K.mjs";
 import "./chunk-3RPGXXPZ.mjs";
 export {
   recall

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@anuma/sdk",
-  "version": "6.14.0",
+  "version": "6.14.2",
   "description": "",
   "main": "./dist/index.cjs",
   "module": "./dist/index.mjs",