@anuma/sdk 6.14.1 → 6.15.0

package/dist/expo/{chunk-O25LUKBK.mjs → chunk-3V3BBJLH.mjs}

@@ -70,6 +70,30 @@ function supportsResponseFormat(model, variant = "json_object") {
   const allow = variant === "json_schema" ? RESPONSE_SCHEMA_OK : RESPONSE_FORMAT_OK;
   return model.split("/").some((seg) => allow.has(seg));
 }
+var CHAT_TO_RESPONSES_FIELDS = {
+  max_completion_tokens: "max_output_tokens"
+};
+function responsesExtra(extra) {
+  if (!extra) return {};
+  const out = {};
+  for (const [key, value] of Object.entries(extra)) {
+    const target = CHAT_TO_RESPONSES_FIELDS[key] ?? key;
+    if (target !== key && target in extra) continue;
+    out[target] = value;
+  }
+  return out;
+}
+var FOREIGN_ENDPOINT_SUFFIX = {
+  chat: "/responses",
+  responses: "/chat/completions"
+};
+function assertTransportMatchesEndpoint(transport, endpoint) {
+  const foreign = FOREIGN_ENDPOINT_SUFFIX[transport];
+  if (!endpoint.endsWith(foreign)) return;
+  throw new Error(
+    `endpointOverride "${endpoint}" is the other transport's endpoint, but transport is "${transport}". The request body is built for the transport, so this sends the wrong shape and 400s without retry.`
+  );
+}
 var RETRYABLE_HTTP = /* @__PURE__ */ new Set([408, 409, 425, 429]);
 function isRetryableStatus(status) {
   return status >= 500 || RETRYABLE_HTTP.has(status);
@@ -111,13 +135,14 @@ async function resolvePortalAuthHeaders(auth, tag) {
 }
 async function callPortalJsonCompletion(req) {
   const log = getLogger();
-  let endpoint = "/api/v1/chat/completions";
+  let endpoint = req.transport === "responses" ? "/api/v1/responses" : "/api/v1/chat/completions";
   if (req.endpointOverride !== void 0) {
     const overrideValidation = validateEndpointOverride(req.endpointOverride);
     if (!overrideValidation.valid) {
       throw new Error(overrideValidation.message);
     }
     endpoint = overrideValidation.endpoint;
+    assertTransportMatchesEndpoint(req.transport ?? "chat", endpoint);
   }
   const maxAttempts = Math.max(1, req.maxAttempts ?? 3);
   const startedAt = Date.now();
@@ -179,8 +204,8 @@ async function attemptPortalJson(req, endpoint) {
   const authHeaders = await resolvePortalAuthHeaders(req, req.tag);
   if (authHeaders === null)
     return { kind: "terminal", code: "auth-unavailable", reason: "auth unavailable (no token)" };
-  const isAnthropic = req.model.startsWith("anthropic/");
-  const prefill = isAnthropic ? "{" : "";
+  const usesPrefill = req.transport !== "responses" && req.model.startsWith("anthropic/");
+  const prefill = usesPrefill ? "{" : "";
   const messages = [
     // Every caller of this helper is a first-party BACKGROUND op (fact extraction,
     // topic sweep, consolidation, classifiers, graph traversal, query
@@ -199,13 +224,34 @@ async function attemptPortalJson(req, endpoint) {
   const supportsJsonObjectFormat = supportsResponseFormat(req.model);
   const controller = new AbortController();
   const timer = setTimeout(() => controller.abort(), timeoutMs);
-  const requestBody = {
+  const requestBody = req.transport === "responses" ? {
+    model: req.model,
+    // Same system+user pair under the Responses-API field name. No prefill
+    // entry to strip: `usesPrefill` is false on this transport, so it was
+    // never pushed and the response-side restore is disarmed with it. An
+    // earlier version pushed it and sliced it back off here, which left
+    // `prefill` truthy and the restore still armed — the fix belonged at
+    // the decision, not at the two symptoms.
+    input: messages,
+    ...req.reasoning && { reasoning: req.reasoning },
+    // NO response_format. The Responses API spells structured output
+    // differently (`text.format`), and it is unverified against this
+    // portal — so this transport relies on the same strict-JSON system
+    // prompt plus `extractJsonCandidate` that every response_format-
+    // rejecting model already relies on. Verified end to end on dev:
+    // luna returns clean parseable JSON here without it. Add the field
+    // only with a per-provider check, exactly as RESPONSE_FORMAT_OK was
+    // earned.
+    ...responsesExtra(req.extra)
+  } : {
     model: req.model,
     messages,
     ...supportsJsonObjectFormat && { response_format: { type: "json_object" } },
     ...req.extra
   };
-  if (!supportsJsonObjectFormat) delete requestBody.response_format;
+  if (req.transport === "responses" || !supportsJsonObjectFormat) {
+    delete requestBody.response_format;
+  }
   let response;
   try {
     response = await fetchImpl(`${baseUrl}${endpoint}`, {
@@ -335,13 +381,15 @@ function logPortalUsage(body, tag) {
     const root = asRecord(body);
     if (!root) return;
     const usage = asRecord(root.usage);
-    const promptTokens = asCount(usage?.prompt_tokens);
-    const completionTokens = asCount(usage?.completion_tokens);
+    const promptTokens = asCount(usage?.prompt_tokens) ?? asCount(usage?.input_tokens);
+    const completionTokens = asCount(usage?.completion_tokens) ?? asCount(usage?.output_tokens);
     if (promptTokens === void 0 && completionTokens === void 0) return;
-    const cachedTokens = asCount(asRecord(root.portal)?.cached_tokens) ?? asCount(asRecord(usage?.prompt_tokens_details)?.cached_tokens) ?? 0;
+    const cachedTokens = asCount(asRecord(root.portal)?.cached_tokens) ?? asCount(asRecord(usage?.prompt_tokens_details)?.cached_tokens) ?? asCount(asRecord(usage?.input_tokens_details)?.cached_tokens) ?? 0;
+    const reasoningTokens = asCount(asRecord(usage?.output_tokens_details)?.reasoning_tokens) ?? asCount(asRecord(usage?.completion_tokens_details)?.reasoning_tokens);
     const parts = [];
     if (promptTokens !== void 0) parts.push(`prompt=${promptTokens}`);
     if (completionTokens !== void 0) parts.push(`completion=${completionTokens}`);
+    if (reasoningTokens !== void 0) parts.push(`reasoning=${reasoningTokens}`);
     parts.push(`cached=${cachedTokens}`);
     getLogger().debug(`[${tag}] usage ${parts.join(" ")}`);
   } catch {
@@ -349,12 +397,22 @@ function logPortalUsage(body, tag) {
 }
 function extractCompletionContent(body) {
   if (typeof body !== "object" || body === null) return null;
+  const responsesText = extractResponsesContent(body);
+  if (responsesText !== null) return responsesText;
   const choices = body.choices;
   if (!Array.isArray(choices) || choices.length === 0) return null;
   const first = choices[0];
   const content = first?.message?.content;
   return typeof content === "string" ? content : null;
 }
+function extractResponsesContent(body) {
+  const root = asRecord(body);
+  if (!root) return null;
+  if (typeof root.output_text === "string" && root.output_text !== "") return root.output_text;
+  if (!Array.isArray(root.output)) return null;
+  const text = root.output.filter((item) => asRecord(item)?.type === "message").flatMap((item) => Array.isArray(item.content) ? item.content : []).map((part) => asRecord(part)?.text).filter((t) => typeof t === "string").join("");
+  return text;
+}
 
 export {
   consoleLogger,

package/dist/expo/{chunk-M4JSLFTQ.mjs → chunk-DIUQLXEH.mjs}

@@ -1,6 +1,6 @@
 import {
   getLogger
-} from "./chunk-O25LUKBK.mjs";
+} from "./chunk-3V3BBJLH.mjs";
 
 // src/lib/pii/patterns.ts
 function luhnCheck(digits) {

package/dist/expo/{chunk-JA7CDJCA.mjs → chunk-LUSKQQDD.mjs}

@@ -1,7 +1,7 @@
 import {
   callPortalJsonCompletion,
   getLogger
-} from "./chunk-O25LUKBK.mjs";
+} from "./chunk-3V3BBJLH.mjs";
 import {
   BASE_URL,
   createClientConfig
@@ -6885,7 +6885,7 @@ function createMemoryVaultSearchTool(vaultCtx, embeddingOptions, cache, searchOp
             subQueries = decomp.subQueries;
           }
         }
-        const { recall: recall2 } = await import("./recall-JYVHWU6N.mjs");
+        const { recall: recall2 } = await import("./recall-GKYVPD2B.mjs");
         let recallDegraded = [];
         const result = await recall2(
           query,

package/dist/{react/consolidate-LSDBMQDW.mjs → expo/consolidate-GTMXZZ4C.mjs}

@@ -1,10 +1,10 @@
 import {
   notifyConsolidationFallback,
   resolvePiiRedactor
-} from "./chunk-2XLHV2XW.mjs";
+} from "./chunk-DIUQLXEH.mjs";
 import {
   callPortalJsonCompletion
-} from "./chunk-O25LUKBK.mjs";
+} from "./chunk-3V3BBJLH.mjs";
 import "./chunk-GYKJOWEO.mjs";
 
 // src/lib/memory/consolidate.ts

package/dist/expo/index.cjs

@@ -6145,6 +6145,23 @@ function supportsResponseFormat(model, variant = "json_object") {
   const allow = variant === "json_schema" ? RESPONSE_SCHEMA_OK : RESPONSE_FORMAT_OK;
   return model.split("/").some((seg) => allow.has(seg));
 }
+function responsesExtra(extra) {
+  if (!extra) return {};
+  const out = {};
+  for (const [key, value] of Object.entries(extra)) {
+    const target = CHAT_TO_RESPONSES_FIELDS[key] ?? key;
+    if (target !== key && target in extra) continue;
+    out[target] = value;
+  }
+  return out;
+}
+function assertTransportMatchesEndpoint(transport, endpoint) {
+  const foreign = FOREIGN_ENDPOINT_SUFFIX[transport];
+  if (!endpoint.endsWith(foreign)) return;
+  throw new Error(
+    `endpointOverride "${endpoint}" is the other transport's endpoint, but transport is "${transport}". The request body is built for the transport, so this sends the wrong shape and 400s without retry.`
+  );
+}
 function isRetryableStatus(status) {
   return status >= 500 || RETRYABLE_HTTP.has(status);
 }
@@ -6185,13 +6202,14 @@ async function resolvePortalAuthHeaders(auth, tag) {
 }
 async function callPortalJsonCompletion(req) {
   const log = getLogger();
-  let endpoint = "/api/v1/chat/completions";
+  let endpoint = req.transport === "responses" ? "/api/v1/responses" : "/api/v1/chat/completions";
   if (req.endpointOverride !== void 0) {
     const overrideValidation = validateEndpointOverride(req.endpointOverride);
     if (!overrideValidation.valid) {
       throw new Error(overrideValidation.message);
     }
     endpoint = overrideValidation.endpoint;
+    assertTransportMatchesEndpoint(req.transport ?? "chat", endpoint);
   }
   const maxAttempts = Math.max(1, req.maxAttempts ?? 3);
   const startedAt = Date.now();
@@ -6253,8 +6271,8 @@ async function attemptPortalJson(req, endpoint) {
   const authHeaders = await resolvePortalAuthHeaders(req, req.tag);
   if (authHeaders === null)
     return { kind: "terminal", code: "auth-unavailable", reason: "auth unavailable (no token)" };
-  const isAnthropic = req.model.startsWith("anthropic/");
-  const prefill = isAnthropic ? "{" : "";
+  const usesPrefill = req.transport !== "responses" && req.model.startsWith("anthropic/");
+  const prefill = usesPrefill ? "{" : "";
   const messages = [
     // Every caller of this helper is a first-party BACKGROUND op (fact extraction,
     // topic sweep, consolidation, classifiers, graph traversal, query
@@ -6273,13 +6291,34 @@ async function attemptPortalJson(req, endpoint) {
   const supportsJsonObjectFormat = supportsResponseFormat(req.model);
   const controller = new AbortController();
   const timer = setTimeout(() => controller.abort(), timeoutMs);
-  const requestBody = {
+  const requestBody = req.transport === "responses" ? {
+    model: req.model,
+    // Same system+user pair under the Responses-API field name. No prefill
+    // entry to strip: `usesPrefill` is false on this transport, so it was
+    // never pushed and the response-side restore is disarmed with it. An
+    // earlier version pushed it and sliced it back off here, which left
+    // `prefill` truthy and the restore still armed — the fix belonged at
+    // the decision, not at the two symptoms.
+    input: messages,
+    ...req.reasoning && { reasoning: req.reasoning },
+    // NO response_format. The Responses API spells structured output
+    // differently (`text.format`), and it is unverified against this
+    // portal — so this transport relies on the same strict-JSON system
+    // prompt plus `extractJsonCandidate` that every response_format-
+    // rejecting model already relies on. Verified end to end on dev:
+    // luna returns clean parseable JSON here without it. Add the field
+    // only with a per-provider check, exactly as RESPONSE_FORMAT_OK was
+    // earned.
+    ...responsesExtra(req.extra)
+  } : {
     model: req.model,
     messages,
     ...supportsJsonObjectFormat && { response_format: { type: "json_object" } },
     ...req.extra
   };
-  if (!supportsJsonObjectFormat) delete requestBody.response_format;
+  if (req.transport === "responses" || !supportsJsonObjectFormat) {
+    delete requestBody.response_format;
+  }
   let response;
   try {
     response = await fetchImpl(`${baseUrl}${endpoint}`, {
@@ -6409,13 +6448,15 @@ function logPortalUsage(body, tag) {
     const root = asRecord(body);
     if (!root) return;
     const usage = asRecord(root.usage);
-    const promptTokens = asCount(usage?.prompt_tokens);
-    const completionTokens = asCount(usage?.completion_tokens);
+    const promptTokens = asCount(usage?.prompt_tokens) ?? asCount(usage?.input_tokens);
+    const completionTokens = asCount(usage?.completion_tokens) ?? asCount(usage?.output_tokens);
     if (promptTokens === void 0 && completionTokens === void 0) return;
-    const cachedTokens = asCount(asRecord(root.portal)?.cached_tokens) ?? asCount(asRecord(usage?.prompt_tokens_details)?.cached_tokens) ?? 0;
+    const cachedTokens = asCount(asRecord(root.portal)?.cached_tokens) ?? asCount(asRecord(usage?.prompt_tokens_details)?.cached_tokens) ?? asCount(asRecord(usage?.input_tokens_details)?.cached_tokens) ?? 0;
+    const reasoningTokens = asCount(asRecord(usage?.output_tokens_details)?.reasoning_tokens) ?? asCount(asRecord(usage?.completion_tokens_details)?.reasoning_tokens);
     const parts = [];
     if (promptTokens !== void 0) parts.push(`prompt=${promptTokens}`);
     if (completionTokens !== void 0) parts.push(`completion=${completionTokens}`);
+    if (reasoningTokens !== void 0) parts.push(`reasoning=${reasoningTokens}`);
     parts.push(`cached=${cachedTokens}`);
     getLogger().debug(`[${tag}] usage ${parts.join(" ")}`);
   } catch {
@@ -6423,13 +6464,23 @@ function logPortalUsage(body, tag) {
 }
 function extractCompletionContent(body) {
   if (typeof body !== "object" || body === null) return null;
+  const responsesText = extractResponsesContent(body);
+  if (responsesText !== null) return responsesText;
   const choices = body.choices;
   if (!Array.isArray(choices) || choices.length === 0) return null;
   const first = choices[0];
   const content = first?.message?.content;
   return typeof content === "string" ? content : null;
 }
-var RESPONSE_FORMAT_OK, RESPONSE_SCHEMA_OK, JSON_CONTRACT_REMINDER, RETRYABLE_HTTP;
+function extractResponsesContent(body) {
+  const root = asRecord(body);
+  if (!root) return null;
+  if (typeof root.output_text === "string" && root.output_text !== "") return root.output_text;
+  if (!Array.isArray(root.output)) return null;
+  const text12 = root.output.filter((item) => asRecord(item)?.type === "message").flatMap((item) => Array.isArray(item.content) ? item.content : []).map((part) => asRecord(part)?.text).filter((t) => typeof t === "string").join("");
+  return text12;
+}
+var RESPONSE_FORMAT_OK, RESPONSE_SCHEMA_OK, JSON_CONTRACT_REMINDER, CHAT_TO_RESPONSES_FIELDS, FOREIGN_ENDPOINT_SUFFIX, RETRYABLE_HTTP;
 var init_portalLlm = __esm({
   "src/lib/memory/portalLlm.ts"() {
     "use strict";
@@ -6441,6 +6492,13 @@ var init_portalLlm = __esm({
     RESPONSE_FORMAT_OK = /* @__PURE__ */ new Set(["openai", "inclusionai", "deepseek"]);
     RESPONSE_SCHEMA_OK = /* @__PURE__ */ new Set(["openai"]);
     JSON_CONTRACT_REMINDER = "Output ONLY the strict JSON object requested. No prose, no explanation, no markdown.";
+    CHAT_TO_RESPONSES_FIELDS = {
+      max_completion_tokens: "max_output_tokens"
+    };
+    FOREIGN_ENDPOINT_SUFFIX = {
+      chat: "/responses",
+      responses: "/chat/completions"
+    };
     RETRYABLE_HTTP = /* @__PURE__ */ new Set([408, 409, 425, 429]);
   }
 });
@@ -15438,7 +15496,7 @@ async function ingestPublishedPhotoMemoriesOp(ctx, rows) {
       ({ row, content }) => ctx.vaultMemoryCollection.prepareCreate((record) => {
         record._raw.id = row.memoryId;
         record._setRaw("content", content);
-        record._setRaw("scope", "private");
+        record._setRaw("scope", "shared");
         record._setRaw("folder_id", null);
         record._setRaw("user_id", ctx.userId ?? null);
         record._setRaw("is_deleted", false);

package/dist/expo/index.d.mts

@@ -6335,15 +6335,26 @@ declare function extractAndRetain(messages: AutoExtractMessage[], retainCtx: Ret
 }>;
 
 /**
- * People Nearby cross-user visibility. ORTHOGONAL to `scope` (model access):
- * - `private`: local-only (default; null column grandfathered as private)
- * - `public`: embedding + plaintext may be published (compatibility matching,
- *   profile display, discovery answers, digital-twin prompts)
+ * LEGACY. This column no longer decides anything.
+ *
+ * `scope === 'shared'` is now the single publication axis: it means the memory
+ * is on the People Nearby profile, its text goes to the nearby server, and it
+ * may inform what strangers see. `scope: 'private'` means it is not. There is
+ * no second control, and scope no longer gates model access either — every
+ * model tier reads every memory. Do NOT reason about publication from this
+ * type; read `scope`.
+ *
+ * The column survives in the schema and is still stamped on writes so that
+ * stored rows stay readable by builds that predate the change. Nothing on a
+ * current build reads it to make a decision.
+ *
+ * Values, kept for tolerance of already-stored data:
+ * - `private`: local-only (a null column reads as private)
+ * - `public`: the row was published
  *
  * TWO TIERS ONLY (decided 2026-07-27). An earlier design had a middle
  * `matchable` tier that published a memory's embedding while keeping its text
- * on-device; it was dropped, so a memory either never leaves the device or is
- * published with its content. Any unrecognised stored value — including a
+ * on-device; it was dropped. Any unrecognised stored value — including a
  * `matchable` row written by a pre-release build — reads as `private`, which is
  * the fail-safe direction: it un-publishes rather than exposes.
  */
@@ -6997,12 +7008,16 @@ declare function updateVaultMemoryEmbeddingOp(ctx: VaultMemoryOperationsContext,
  *     candidate to be reconciled against the vault — it is an already-decided
  *     fact the server has published.
  *
- * The rows are written `visibility: "public"` because they genuinely ARE
- * published — the reconciler reads local visibility as the user's intent, and
- * anything else would make it immediately revoke a memory the user never turned
- * off. They carry `source: SOURCE_PHOTO`, which is what exempts them from
- * decay's auto-archive; see the note there for why archiving one would silently
- * unpublish it.
+ * The rows are written `scope: "shared"` because they genuinely ARE published.
+ * `scope === 'shared'` is the publication axis — the single one. The reconciler
+ * reads local scope as the user's intent, and it builds its `local` set from a
+ * vault read narrowed to `{scopes: ['shared']}`. A row stamped anything else
+ * never enters that read, so it is never adopted into the publish ledger, and
+ * `toRevoke` is computed only over ids the ledger holds. The user's off-toggle
+ * would then do nothing server-side while nearby kept serving the memory. The
+ * `visibility` column is legacy: nothing reads it any more. They carry
+ * `source: SOURCE_PHOTO`, which is what exempts them from decay's auto-archive;
+ * see the note there for why archiving one would silently unpublish it.
  *
  * No embedding is computed here. `searchTool`'s un-embedded lane embeds any row
  * lacking a vector at search time, uses it in that same search and persists it
@@ -7050,6 +7065,29 @@ interface PhotoIngestResult {
  * class of bug as publishing a version the user has since changed. Re-ingesting
  * changed text is a follow-up that needs a merge decision, not a clobber.
  *
+ * That skip is also why this op does NOT repair a row an older build stamped
+ * `scope: "private"`. Such a row is present, so ingest leaves it alone, and it
+ * stays outside the published-set read. The user's switch cannot revoke it.
+ * Repair belongs in a one-time pass at upgrade. Do not add it here, for two
+ * reasons:
+ *
+ *  - **The two states are indistinguishable from this op.** After this build a
+ *    `photo:` row with `scope: "private"` is also exactly what the user's own
+ *    off-toggle produces. The toggle calls `updateVaultMemoryOp`, which writes
+ *    `scope` and never touches `visibility`, so the mis-stamped row and the
+ *    turned-off row carry identical columns. No test here can tell them apart.
+ *
+ *  - **A re-stamp here would revert the off-toggle.** The pass runs ingest
+ *    BEFORE it reads the vault, so a row re-stamped `shared` re-enters the
+ *    desired set on that same pass and never reaches `toRevoke`. The switch
+ *    would spring back to "on" and nearby would keep serving the memory. That
+ *    is worse than the bug it repairs.
+ *
+ * A one-time pass does not have the ambiguity. Before this build the switch
+ * already read "off" for these rows, because it reads `scope`, so no user can
+ * have turned one off. Every `private` photo row at that instant came from the
+ * old stamp.
+ *
  * Non-`photo:` ids are ignored: everything else in the published set is a
  * client-published memory that by definition already lives in this vault (or in
  * another device's, which is not ours to recreate).

package/dist/expo/index.d.ts

@@ -6335,15 +6335,26 @@ declare function extractAndRetain(messages: AutoExtractMessage[], retainCtx: Ret
 }>;
 
 /**
- * People Nearby cross-user visibility. ORTHOGONAL to `scope` (model access):
- * - `private`: local-only (default; null column grandfathered as private)
- * - `public`: embedding + plaintext may be published (compatibility matching,
- *   profile display, discovery answers, digital-twin prompts)
+ * LEGACY. This column no longer decides anything.
+ *
+ * `scope === 'shared'` is now the single publication axis: it means the memory
+ * is on the People Nearby profile, its text goes to the nearby server, and it
+ * may inform what strangers see. `scope: 'private'` means it is not. There is
+ * no second control, and scope no longer gates model access either — every
+ * model tier reads every memory. Do NOT reason about publication from this
+ * type; read `scope`.
+ *
+ * The column survives in the schema and is still stamped on writes so that
+ * stored rows stay readable by builds that predate the change. Nothing on a
+ * current build reads it to make a decision.
+ *
+ * Values, kept for tolerance of already-stored data:
+ * - `private`: local-only (a null column reads as private)
+ * - `public`: the row was published
  *
  * TWO TIERS ONLY (decided 2026-07-27). An earlier design had a middle
  * `matchable` tier that published a memory's embedding while keeping its text
- * on-device; it was dropped, so a memory either never leaves the device or is
- * published with its content. Any unrecognised stored value — including a
+ * on-device; it was dropped. Any unrecognised stored value — including a
  * `matchable` row written by a pre-release build — reads as `private`, which is
  * the fail-safe direction: it un-publishes rather than exposes.
  */
@@ -6997,12 +7008,16 @@ declare function updateVaultMemoryEmbeddingOp(ctx: VaultMemoryOperationsContext,
  *     candidate to be reconciled against the vault — it is an already-decided
  *     fact the server has published.
  *
- * The rows are written `visibility: "public"` because they genuinely ARE
- * published — the reconciler reads local visibility as the user's intent, and
- * anything else would make it immediately revoke a memory the user never turned
- * off. They carry `source: SOURCE_PHOTO`, which is what exempts them from
- * decay's auto-archive; see the note there for why archiving one would silently
- * unpublish it.
+ * The rows are written `scope: "shared"` because they genuinely ARE published.
+ * `scope === 'shared'` is the publication axis — the single one. The reconciler
+ * reads local scope as the user's intent, and it builds its `local` set from a
+ * vault read narrowed to `{scopes: ['shared']}`. A row stamped anything else
+ * never enters that read, so it is never adopted into the publish ledger, and
+ * `toRevoke` is computed only over ids the ledger holds. The user's off-toggle
+ * would then do nothing server-side while nearby kept serving the memory. The
+ * `visibility` column is legacy: nothing reads it any more. They carry
+ * `source: SOURCE_PHOTO`, which is what exempts them from decay's auto-archive;
+ * see the note there for why archiving one would silently unpublish it.
  *
  * No embedding is computed here. `searchTool`'s un-embedded lane embeds any row
  * lacking a vector at search time, uses it in that same search and persists it
@@ -7050,6 +7065,29 @@ interface PhotoIngestResult {
  * class of bug as publishing a version the user has since changed. Re-ingesting
  * changed text is a follow-up that needs a merge decision, not a clobber.
  *
+ * That skip is also why this op does NOT repair a row an older build stamped
+ * `scope: "private"`. Such a row is present, so ingest leaves it alone, and it
+ * stays outside the published-set read. The user's switch cannot revoke it.
+ * Repair belongs in a one-time pass at upgrade. Do not add it here, for two
+ * reasons:
+ *
+ *  - **The two states are indistinguishable from this op.** After this build a
+ *    `photo:` row with `scope: "private"` is also exactly what the user's own
+ *    off-toggle produces. The toggle calls `updateVaultMemoryOp`, which writes
+ *    `scope` and never touches `visibility`, so the mis-stamped row and the
+ *    turned-off row carry identical columns. No test here can tell them apart.
+ *
+ *  - **A re-stamp here would revert the off-toggle.** The pass runs ingest
+ *    BEFORE it reads the vault, so a row re-stamped `shared` re-enters the
+ *    desired set on that same pass and never reaches `toRevoke`. The switch
+ *    would spring back to "on" and nearby would keep serving the memory. That
+ *    is worse than the bug it repairs.
+ *
+ * A one-time pass does not have the ambiguity. Before this build the switch
+ * already read "off" for these rows, because it reads `scope`, so no user can
+ * have turned one off. Every `private` photo row at that instant came from the
+ * old stamp.
+ *
  * Non-`photo:` ids are ignored: everything else in the published set is a
  * client-published memory that by definition already lives in this vault (or in
  * another device's, which is not ours to recreate).

package/dist/expo/index.mjs

@@ -132,7 +132,7 @@ import {
   upsertMessageOp,
   useEncryption,
   vaultMemoryToStored
-} from "./chunk-JA7CDJCA.mjs";
+} from "./chunk-LUSKQQDD.mjs";
 import {
   PII_PATTERNS,
   PiiRedactor,
@@ -140,7 +140,7 @@ import {
   isPiiRedactor,
   notifyConsolidationFallback,
   resolvePiiRedactor
-} from "./chunk-M4JSLFTQ.mjs";
+} from "./chunk-DIUQLXEH.mjs";
 import {
   INTERNAL_FLOW_MARKER,
   callPortalJsonCompletion,
@@ -154,7 +154,7 @@ import {
   taskTypeHeader,
   validateEndpointOverride,
   withInternalFlowMarker
-} from "./chunk-O25LUKBK.mjs";
+} from "./chunk-3V3BBJLH.mjs";
 import {
   BASE_URL,
   MCP_R2_DOMAIN,
@@ -5819,7 +5819,7 @@ async function ingestPublishedPhotoMemoriesOp(ctx, rows) {
       ({ row, content }) => ctx.vaultMemoryCollection.prepareCreate((record) => {
         record._raw.id = row.memoryId;
         record._setRaw("content", content);
-        record._setRaw("scope", "private");
+        record._setRaw("scope", "shared");
         record._setRaw("folder_id", null);
         record._setRaw("user_id", ctx.userId ?? null);
         record._setRaw("is_deleted", false);
@@ -6868,7 +6868,7 @@ async function tryConsolidate(trimmed, ctx, options, prepared) {
     content: m.content,
     similarity: m.similarity
   }));
-  const { consolidateMemory: doConsolidate } = await import("./consolidate-S3KFA2WT.mjs");
+  const { consolidateMemory: doConsolidate } = await import("./consolidate-GTMXZZ4C.mjs");
   const decision = await doConsolidate(trimmed, candidates, consolidateOptions);
   if (decision.action === "create") return null;
   if (decision.action === "supersede" && decision.content) {

package/dist/expo/{recall-JYVHWU6N.mjs → recall-GKYVPD2B.mjs}

@@ -1,7 +1,7 @@
 import {
   recall
-} from "./chunk-JA7CDJCA.mjs";
-import "./chunk-O25LUKBK.mjs";
+} from "./chunk-LUSKQQDD.mjs";
+import "./chunk-3V3BBJLH.mjs";
 import "./chunk-GYKJOWEO.mjs";
 export {
   recall

package/dist/react/{chunk-2XLHV2XW.mjs → chunk-2GNOTRG4.mjs}

@@ -1,6 +1,6 @@
 import {
   getLogger
-} from "./chunk-O25LUKBK.mjs";
+} from "./chunk-3V3BBJLH.mjs";
 
 // src/lib/pii/patterns.ts
 function luhnCheck(digits) {