@anuma/sdk 6.14.1 → 6.15.0

package/dist/server/{chunk-7D3RI25K.mjs → chunk-H4G3DLDJ.mjs}

@@ -57,6 +57,30 @@ function supportsResponseFormat(model, variant = "json_object") {
   const allow = variant === "json_schema" ? RESPONSE_SCHEMA_OK : RESPONSE_FORMAT_OK;
   return model.split("/").some((seg) => allow.has(seg));
 }
+var CHAT_TO_RESPONSES_FIELDS = {
+  max_completion_tokens: "max_output_tokens"
+};
+function responsesExtra(extra) {
+  if (!extra) return {};
+  const out = {};
+  for (const [key, value] of Object.entries(extra)) {
+    const target = CHAT_TO_RESPONSES_FIELDS[key] ?? key;
+    if (target !== key && target in extra) continue;
+    out[target] = value;
+  }
+  return out;
+}
+var FOREIGN_ENDPOINT_SUFFIX = {
+  chat: "/responses",
+  responses: "/chat/completions"
+};
+function assertTransportMatchesEndpoint(transport, endpoint) {
+  const foreign = FOREIGN_ENDPOINT_SUFFIX[transport];
+  if (!endpoint.endsWith(foreign)) return;
+  throw new Error(
+    `endpointOverride "${endpoint}" is the other transport's endpoint, but transport is "${transport}". The request body is built for the transport, so this sends the wrong shape and 400s without retry.`
+  );
+}
 var RETRYABLE_HTTP = /* @__PURE__ */ new Set([408, 409, 425, 429]);
 function isRetryableStatus(status) {
   return status >= 500 || RETRYABLE_HTTP.has(status);
@@ -98,13 +122,14 @@ async function resolvePortalAuthHeaders(auth, tag) {
 }
 async function callPortalJsonCompletion(req) {
   const log = getLogger();
-  let endpoint = "/api/v1/chat/completions";
+  let endpoint = req.transport === "responses" ? "/api/v1/responses" : "/api/v1/chat/completions";
   if (req.endpointOverride !== void 0) {
     const overrideValidation = validateEndpointOverride(req.endpointOverride);
     if (!overrideValidation.valid) {
       throw new Error(overrideValidation.message);
     }
     endpoint = overrideValidation.endpoint;
+    assertTransportMatchesEndpoint(req.transport ?? "chat", endpoint);
   }
   const maxAttempts = Math.max(1, req.maxAttempts ?? 3);
   const startedAt = Date.now();
@@ -166,8 +191,8 @@ async function attemptPortalJson(req, endpoint) {
   const authHeaders = await resolvePortalAuthHeaders(req, req.tag);
   if (authHeaders === null)
     return { kind: "terminal", code: "auth-unavailable", reason: "auth unavailable (no token)" };
-  const isAnthropic = req.model.startsWith("anthropic/");
-  const prefill = isAnthropic ? "{" : "";
+  const usesPrefill = req.transport !== "responses" && req.model.startsWith("anthropic/");
+  const prefill = usesPrefill ? "{" : "";
   const messages = [
     // Every caller of this helper is a first-party BACKGROUND op (fact extraction,
     // topic sweep, consolidation, classifiers, graph traversal, query
@@ -186,13 +211,34 @@ async function attemptPortalJson(req, endpoint) {
   const supportsJsonObjectFormat = supportsResponseFormat(req.model);
   const controller = new AbortController();
   const timer = setTimeout(() => controller.abort(), timeoutMs);
-  const requestBody = {
+  const requestBody = req.transport === "responses" ? {
+    model: req.model,
+    // Same system+user pair under the Responses-API field name. No prefill
+    // entry to strip: `usesPrefill` is false on this transport, so it was
+    // never pushed and the response-side restore is disarmed with it. An
+    // earlier version pushed it and sliced it back off here, which left
+    // `prefill` truthy and the restore still armed — the fix belonged at
+    // the decision, not at the two symptoms.
+    input: messages,
+    ...req.reasoning && { reasoning: req.reasoning },
+    // NO response_format. The Responses API spells structured output
+    // differently (`text.format`), and it is unverified against this
+    // portal — so this transport relies on the same strict-JSON system
+    // prompt plus `extractJsonCandidate` that every response_format-
+    // rejecting model already relies on. Verified end to end on dev:
+    // luna returns clean parseable JSON here without it. Add the field
+    // only with a per-provider check, exactly as RESPONSE_FORMAT_OK was
+    // earned.
+    ...responsesExtra(req.extra)
+  } : {
     model: req.model,
     messages,
     ...supportsJsonObjectFormat && { response_format: { type: "json_object" } },
     ...req.extra
   };
-  if (!supportsJsonObjectFormat) delete requestBody.response_format;
+  if (req.transport === "responses" || !supportsJsonObjectFormat) {
+    delete requestBody.response_format;
+  }
   let response;
   try {
     response = await fetchImpl(`${baseUrl}${endpoint}`, {
@@ -322,13 +368,15 @@ function logPortalUsage(body, tag) {
     const root = asRecord(body);
     if (!root) return;
     const usage = asRecord(root.usage);
-    const promptTokens = asCount(usage?.prompt_tokens);
-    const completionTokens = asCount(usage?.completion_tokens);
+    const promptTokens = asCount(usage?.prompt_tokens) ?? asCount(usage?.input_tokens);
+    const completionTokens = asCount(usage?.completion_tokens) ?? asCount(usage?.output_tokens);
     if (promptTokens === void 0 && completionTokens === void 0) return;
-    const cachedTokens = asCount(asRecord(root.portal)?.cached_tokens) ?? asCount(asRecord(usage?.prompt_tokens_details)?.cached_tokens) ?? 0;
+    const cachedTokens = asCount(asRecord(root.portal)?.cached_tokens) ?? asCount(asRecord(usage?.prompt_tokens_details)?.cached_tokens) ?? asCount(asRecord(usage?.input_tokens_details)?.cached_tokens) ?? 0;
+    const reasoningTokens = asCount(asRecord(usage?.output_tokens_details)?.reasoning_tokens) ?? asCount(asRecord(usage?.completion_tokens_details)?.reasoning_tokens);
     const parts = [];
     if (promptTokens !== void 0) parts.push(`prompt=${promptTokens}`);
     if (completionTokens !== void 0) parts.push(`completion=${completionTokens}`);
+    if (reasoningTokens !== void 0) parts.push(`reasoning=${reasoningTokens}`);
     parts.push(`cached=${cachedTokens}`);
     getLogger().debug(`[${tag}] usage ${parts.join(" ")}`);
   } catch {
@@ -336,12 +384,22 @@ function logPortalUsage(body, tag) {
 }
 function extractCompletionContent(body) {
   if (typeof body !== "object" || body === null) return null;
+  const responsesText = extractResponsesContent(body);
+  if (responsesText !== null) return responsesText;
   const choices = body.choices;
   if (!Array.isArray(choices) || choices.length === 0) return null;
   const first = choices[0];
   const content = first?.message?.content;
   return typeof content === "string" ? content : null;
 }
+function extractResponsesContent(body) {
+  const root = asRecord(body);
+  if (!root) return null;
+  if (typeof root.output_text === "string" && root.output_text !== "") return root.output_text;
+  if (!Array.isArray(root.output)) return null;
+  const text = root.output.filter((item) => asRecord(item)?.type === "message").flatMap((item) => Array.isArray(item.content) ? item.content : []).map((part) => asRecord(part)?.text).filter((t) => typeof t === "string").join("");
+  return text;
+}
 
 export {
   getLogger,

package/dist/server/{chunk-GP6YY6H5.mjs → chunk-JPLFOSB2.mjs}

@@ -1,6 +1,6 @@
 import {
   getLogger
-} from "./chunk-7D3RI25K.mjs";
+} from "./chunk-H4G3DLDJ.mjs";
 
 // src/lib/pii/patterns.ts
 function luhnCheck(digits) {

package/dist/server/{consolidate-Z2JJP7LW.mjs → consolidate-CMMDTZ37.mjs}

@@ -1,10 +1,10 @@
 import {
   notifyConsolidationFallback,
   resolvePiiRedactor
-} from "./chunk-GP6YY6H5.mjs";
+} from "./chunk-JPLFOSB2.mjs";
 import {
   callPortalJsonCompletion
-} from "./chunk-7D3RI25K.mjs";
+} from "./chunk-H4G3DLDJ.mjs";
 import "./chunk-3RPGXXPZ.mjs";
 
 // src/lib/memory/consolidate.ts

package/dist/server/index.cjs

@@ -20611,6 +20611,23 @@ function supportsResponseFormat(model, variant = "json_object") {
   const allow = variant === "json_schema" ? RESPONSE_SCHEMA_OK : RESPONSE_FORMAT_OK;
   return model.split("/").some((seg) => allow.has(seg));
 }
+function responsesExtra(extra) {
+  if (!extra) return {};
+  const out = {};
+  for (const [key, value] of Object.entries(extra)) {
+    const target = CHAT_TO_RESPONSES_FIELDS[key] ?? key;
+    if (target !== key && target in extra) continue;
+    out[target] = value;
+  }
+  return out;
+}
+function assertTransportMatchesEndpoint(transport, endpoint) {
+  const foreign = FOREIGN_ENDPOINT_SUFFIX[transport];
+  if (!endpoint.endsWith(foreign)) return;
+  throw new Error(
+    `endpointOverride "${endpoint}" is the other transport's endpoint, but transport is "${transport}". The request body is built for the transport, so this sends the wrong shape and 400s without retry.`
+  );
+}
 function isRetryableStatus(status) {
   return status >= 500 || RETRYABLE_HTTP.has(status);
 }
@@ -20651,13 +20668,14 @@ async function resolvePortalAuthHeaders(auth, tag) {
 }
 async function callPortalJsonCompletion(req) {
   const log = getLogger();
-  let endpoint = "/api/v1/chat/completions";
+  let endpoint = req.transport === "responses" ? "/api/v1/responses" : "/api/v1/chat/completions";
   if (req.endpointOverride !== void 0) {
     const overrideValidation = validateEndpointOverride(req.endpointOverride);
     if (!overrideValidation.valid) {
       throw new Error(overrideValidation.message);
     }
     endpoint = overrideValidation.endpoint;
+    assertTransportMatchesEndpoint(req.transport ?? "chat", endpoint);
   }
   const maxAttempts = Math.max(1, req.maxAttempts ?? 3);
   const startedAt = Date.now();
@@ -20719,8 +20737,8 @@ async function attemptPortalJson(req, endpoint) {
   const authHeaders = await resolvePortalAuthHeaders(req, req.tag);
   if (authHeaders === null)
     return { kind: "terminal", code: "auth-unavailable", reason: "auth unavailable (no token)" };
-  const isAnthropic = req.model.startsWith("anthropic/");
-  const prefill = isAnthropic ? "{" : "";
+  const usesPrefill = req.transport !== "responses" && req.model.startsWith("anthropic/");
+  const prefill = usesPrefill ? "{" : "";
   const messages = [
     // Every caller of this helper is a first-party BACKGROUND op (fact extraction,
     // topic sweep, consolidation, classifiers, graph traversal, query
@@ -20739,13 +20757,34 @@ async function attemptPortalJson(req, endpoint) {
   const supportsJsonObjectFormat = supportsResponseFormat(req.model);
   const controller = new AbortController();
   const timer = setTimeout(() => controller.abort(), timeoutMs);
-  const requestBody = {
+  const requestBody = req.transport === "responses" ? {
+    model: req.model,
+    // Same system+user pair under the Responses-API field name. No prefill
+    // entry to strip: `usesPrefill` is false on this transport, so it was
+    // never pushed and the response-side restore is disarmed with it. An
+    // earlier version pushed it and sliced it back off here, which left
+    // `prefill` truthy and the restore still armed — the fix belonged at
+    // the decision, not at the two symptoms.
+    input: messages,
+    ...req.reasoning && { reasoning: req.reasoning },
+    // NO response_format. The Responses API spells structured output
+    // differently (`text.format`), and it is unverified against this
+    // portal — so this transport relies on the same strict-JSON system
+    // prompt plus `extractJsonCandidate` that every response_format-
+    // rejecting model already relies on. Verified end to end on dev:
+    // luna returns clean parseable JSON here without it. Add the field
+    // only with a per-provider check, exactly as RESPONSE_FORMAT_OK was
+    // earned.
+    ...responsesExtra(req.extra)
+  } : {
     model: req.model,
     messages,
     ...supportsJsonObjectFormat && { response_format: { type: "json_object" } },
     ...req.extra
   };
-  if (!supportsJsonObjectFormat) delete requestBody.response_format;
+  if (req.transport === "responses" || !supportsJsonObjectFormat) {
+    delete requestBody.response_format;
+  }
   let response;
   try {
     response = await fetchImpl(`${baseUrl}${endpoint}`, {
@@ -20875,13 +20914,15 @@ function logPortalUsage(body, tag) {
     const root = asRecord(body);
     if (!root) return;
     const usage = asRecord(root.usage);
-    const promptTokens = asCount(usage?.prompt_tokens);
-    const completionTokens = asCount(usage?.completion_tokens);
+    const promptTokens = asCount(usage?.prompt_tokens) ?? asCount(usage?.input_tokens);
+    const completionTokens = asCount(usage?.completion_tokens) ?? asCount(usage?.output_tokens);
     if (promptTokens === void 0 && completionTokens === void 0) return;
-    const cachedTokens = asCount(asRecord(root.portal)?.cached_tokens) ?? asCount(asRecord(usage?.prompt_tokens_details)?.cached_tokens) ?? 0;
+    const cachedTokens = asCount(asRecord(root.portal)?.cached_tokens) ?? asCount(asRecord(usage?.prompt_tokens_details)?.cached_tokens) ?? asCount(asRecord(usage?.input_tokens_details)?.cached_tokens) ?? 0;
+    const reasoningTokens = asCount(asRecord(usage?.output_tokens_details)?.reasoning_tokens) ?? asCount(asRecord(usage?.completion_tokens_details)?.reasoning_tokens);
     const parts = [];
     if (promptTokens !== void 0) parts.push(`prompt=${promptTokens}`);
     if (completionTokens !== void 0) parts.push(`completion=${completionTokens}`);
+    if (reasoningTokens !== void 0) parts.push(`reasoning=${reasoningTokens}`);
     parts.push(`cached=${cachedTokens}`);
     getLogger().debug(`[${tag}] usage ${parts.join(" ")}`);
   } catch {
@@ -20889,13 +20930,23 @@ function logPortalUsage(body, tag) {
 }
 function extractCompletionContent(body) {
   if (typeof body !== "object" || body === null) return null;
+  const responsesText = extractResponsesContent(body);
+  if (responsesText !== null) return responsesText;
   const choices = body.choices;
   if (!Array.isArray(choices) || choices.length === 0) return null;
   const first = choices[0];
   const content = first?.message?.content;
   return typeof content === "string" ? content : null;
 }
-var RESPONSE_FORMAT_OK, RESPONSE_SCHEMA_OK, JSON_CONTRACT_REMINDER, RETRYABLE_HTTP;
+function extractResponsesContent(body) {
+  const root = asRecord(body);
+  if (!root) return null;
+  if (typeof root.output_text === "string" && root.output_text !== "") return root.output_text;
+  if (!Array.isArray(root.output)) return null;
+  const text12 = root.output.filter((item) => asRecord(item)?.type === "message").flatMap((item) => Array.isArray(item.content) ? item.content : []).map((part) => asRecord(part)?.text).filter((t) => typeof t === "string").join("");
+  return text12;
+}
+var RESPONSE_FORMAT_OK, RESPONSE_SCHEMA_OK, JSON_CONTRACT_REMINDER, CHAT_TO_RESPONSES_FIELDS, FOREIGN_ENDPOINT_SUFFIX, RETRYABLE_HTTP;
 var init_portalLlm = __esm({
   "src/lib/memory/portalLlm.ts"() {
     "use strict";
@@ -20907,6 +20958,13 @@ var init_portalLlm = __esm({
     RESPONSE_FORMAT_OK = /* @__PURE__ */ new Set(["openai", "inclusionai", "deepseek"]);
     RESPONSE_SCHEMA_OK = /* @__PURE__ */ new Set(["openai"]);
     JSON_CONTRACT_REMINDER = "Output ONLY the strict JSON object requested. No prose, no explanation, no markdown.";
+    CHAT_TO_RESPONSES_FIELDS = {
+      max_completion_tokens: "max_output_tokens"
+    };
+    FOREIGN_ENDPOINT_SUFFIX = {
+      chat: "/responses",
+      responses: "/chat/completions"
+    };
     RETRYABLE_HTTP = /* @__PURE__ */ new Set([408, 409, 425, 429]);
   }
 });
@@ -27426,7 +27484,7 @@ async function ingestPublishedPhotoMemoriesOp(ctx, rows) {
       ({ row, content }) => ctx.vaultMemoryCollection.prepareCreate((record) => {
         record._raw.id = row.memoryId;
         record._setRaw("content", content);
-        record._setRaw("scope", "private");
+        record._setRaw("scope", "shared");
         record._setRaw("folder_id", null);
         record._setRaw("user_id", ctx.userId ?? null);
         record._setRaw("is_deleted", false);

package/dist/server/index.d.mts

@@ -6253,15 +6253,26 @@ declare function extractAndRetain(messages: AutoExtractMessage[], retainCtx: Ret
 }>;
 
 /**
- * People Nearby cross-user visibility. ORTHOGONAL to `scope` (model access):
- * - `private`: local-only (default; null column grandfathered as private)
- * - `public`: embedding + plaintext may be published (compatibility matching,
- *   profile display, discovery answers, digital-twin prompts)
+ * LEGACY. This column no longer decides anything.
+ *
+ * `scope === 'shared'` is now the single publication axis: it means the memory
+ * is on the People Nearby profile, its text goes to the nearby server, and it
+ * may inform what strangers see. `scope: 'private'` means it is not. There is
+ * no second control, and scope no longer gates model access either — every
+ * model tier reads every memory. Do NOT reason about publication from this
+ * type; read `scope`.
+ *
+ * The column survives in the schema and is still stamped on writes so that
+ * stored rows stay readable by builds that predate the change. Nothing on a
+ * current build reads it to make a decision.
+ *
+ * Values, kept for tolerance of already-stored data:
+ * - `private`: local-only (a null column reads as private)
+ * - `public`: the row was published
  *
  * TWO TIERS ONLY (decided 2026-07-27). An earlier design had a middle
  * `matchable` tier that published a memory's embedding while keeping its text
- * on-device; it was dropped, so a memory either never leaves the device or is
- * published with its content. Any unrecognised stored value — including a
+ * on-device; it was dropped. Any unrecognised stored value — including a
  * `matchable` row written by a pre-release build — reads as `private`, which is
  * the fail-safe direction: it un-publishes rather than exposes.
  */
@@ -6853,12 +6864,16 @@ declare function updateVaultMemoryEmbeddingOp(ctx: VaultMemoryOperationsContext,
  *     candidate to be reconciled against the vault — it is an already-decided
  *     fact the server has published.
  *
- * The rows are written `visibility: "public"` because they genuinely ARE
- * published — the reconciler reads local visibility as the user's intent, and
- * anything else would make it immediately revoke a memory the user never turned
- * off. They carry `source: SOURCE_PHOTO`, which is what exempts them from
- * decay's auto-archive; see the note there for why archiving one would silently
- * unpublish it.
+ * The rows are written `scope: "shared"` because they genuinely ARE published.
+ * `scope === 'shared'` is the publication axis — the single one. The reconciler
+ * reads local scope as the user's intent, and it builds its `local` set from a
+ * vault read narrowed to `{scopes: ['shared']}`. A row stamped anything else
+ * never enters that read, so it is never adopted into the publish ledger, and
+ * `toRevoke` is computed only over ids the ledger holds. The user's off-toggle
+ * would then do nothing server-side while nearby kept serving the memory. The
+ * `visibility` column is legacy: nothing reads it any more. They carry
+ * `source: SOURCE_PHOTO`, which is what exempts them from decay's auto-archive;
+ * see the note there for why archiving one would silently unpublish it.
  *
  * No embedding is computed here. `searchTool`'s un-embedded lane embeds any row
  * lacking a vector at search time, uses it in that same search and persists it
@@ -6906,6 +6921,29 @@ interface PhotoIngestResult {
  * class of bug as publishing a version the user has since changed. Re-ingesting
  * changed text is a follow-up that needs a merge decision, not a clobber.
  *
+ * That skip is also why this op does NOT repair a row an older build stamped
+ * `scope: "private"`. Such a row is present, so ingest leaves it alone, and it
+ * stays outside the published-set read. The user's switch cannot revoke it.
+ * Repair belongs in a one-time pass at upgrade. Do not add it here, for two
+ * reasons:
+ *
+ *  - **The two states are indistinguishable from this op.** After this build a
+ *    `photo:` row with `scope: "private"` is also exactly what the user's own
+ *    off-toggle produces. The toggle calls `updateVaultMemoryOp`, which writes
+ *    `scope` and never touches `visibility`, so the mis-stamped row and the
+ *    turned-off row carry identical columns. No test here can tell them apart.
+ *
+ *  - **A re-stamp here would revert the off-toggle.** The pass runs ingest
+ *    BEFORE it reads the vault, so a row re-stamped `shared` re-enters the
+ *    desired set on that same pass and never reaches `toRevoke`. The switch
+ *    would spring back to "on" and nearby would keep serving the memory. That
+ *    is worse than the bug it repairs.
+ *
+ * A one-time pass does not have the ambiguity. Before this build the switch
+ * already read "off" for these rows, because it reads `scope`, so no user can
+ * have turned one off. Every `private` photo row at that instant came from the
+ * old stamp.
+ *
  * Non-`photo:` ids are ignored: everything else in the published set is a
  * client-published memory that by definition already lives in this vault (or in
  * another device's, which is not ours to recreate).

package/dist/server/index.d.ts

@@ -6253,15 +6253,26 @@ declare function extractAndRetain(messages: AutoExtractMessage[], retainCtx: Ret
 }>;
 
 /**
- * People Nearby cross-user visibility. ORTHOGONAL to `scope` (model access):
- * - `private`: local-only (default; null column grandfathered as private)
- * - `public`: embedding + plaintext may be published (compatibility matching,
- *   profile display, discovery answers, digital-twin prompts)
+ * LEGACY. This column no longer decides anything.
+ *
+ * `scope === 'shared'` is now the single publication axis: it means the memory
+ * is on the People Nearby profile, its text goes to the nearby server, and it
+ * may inform what strangers see. `scope: 'private'` means it is not. There is
+ * no second control, and scope no longer gates model access either — every
+ * model tier reads every memory. Do NOT reason about publication from this
+ * type; read `scope`.
+ *
+ * The column survives in the schema and is still stamped on writes so that
+ * stored rows stay readable by builds that predate the change. Nothing on a
+ * current build reads it to make a decision.
+ *
+ * Values, kept for tolerance of already-stored data:
+ * - `private`: local-only (a null column reads as private)
+ * - `public`: the row was published
  *
  * TWO TIERS ONLY (decided 2026-07-27). An earlier design had a middle
  * `matchable` tier that published a memory's embedding while keeping its text
- * on-device; it was dropped, so a memory either never leaves the device or is
- * published with its content. Any unrecognised stored value — including a
+ * on-device; it was dropped. Any unrecognised stored value — including a
  * `matchable` row written by a pre-release build — reads as `private`, which is
  * the fail-safe direction: it un-publishes rather than exposes.
  */
@@ -6853,12 +6864,16 @@ declare function updateVaultMemoryEmbeddingOp(ctx: VaultMemoryOperationsContext,
  *     candidate to be reconciled against the vault — it is an already-decided
  *     fact the server has published.
  *
- * The rows are written `visibility: "public"` because they genuinely ARE
- * published — the reconciler reads local visibility as the user's intent, and
- * anything else would make it immediately revoke a memory the user never turned
- * off. They carry `source: SOURCE_PHOTO`, which is what exempts them from
- * decay's auto-archive; see the note there for why archiving one would silently
- * unpublish it.
+ * The rows are written `scope: "shared"` because they genuinely ARE published.
+ * `scope === 'shared'` is the publication axis — the single one. The reconciler
+ * reads local scope as the user's intent, and it builds its `local` set from a
+ * vault read narrowed to `{scopes: ['shared']}`. A row stamped anything else
+ * never enters that read, so it is never adopted into the publish ledger, and
+ * `toRevoke` is computed only over ids the ledger holds. The user's off-toggle
+ * would then do nothing server-side while nearby kept serving the memory. The
+ * `visibility` column is legacy: nothing reads it any more. They carry
+ * `source: SOURCE_PHOTO`, which is what exempts them from decay's auto-archive;
+ * see the note there for why archiving one would silently unpublish it.
  *
  * No embedding is computed here. `searchTool`'s un-embedded lane embeds any row
  * lacking a vector at search time, uses it in that same search and persists it
@@ -6906,6 +6921,29 @@ interface PhotoIngestResult {
  * class of bug as publishing a version the user has since changed. Re-ingesting
  * changed text is a follow-up that needs a merge decision, not a clobber.
  *
+ * That skip is also why this op does NOT repair a row an older build stamped
+ * `scope: "private"`. Such a row is present, so ingest leaves it alone, and it
+ * stays outside the published-set read. The user's switch cannot revoke it.
+ * Repair belongs in a one-time pass at upgrade. Do not add it here, for two
+ * reasons:
+ *
+ *  - **The two states are indistinguishable from this op.** After this build a
+ *    `photo:` row with `scope: "private"` is also exactly what the user's own
+ *    off-toggle produces. The toggle calls `updateVaultMemoryOp`, which writes
+ *    `scope` and never touches `visibility`, so the mis-stamped row and the
+ *    turned-off row carry identical columns. No test here can tell them apart.
+ *
+ *  - **A re-stamp here would revert the off-toggle.** The pass runs ingest
+ *    BEFORE it reads the vault, so a row re-stamped `shared` re-enters the
+ *    desired set on that same pass and never reaches `toRevoke`. The switch
+ *    would spring back to "on" and nearby would keep serving the memory. That
+ *    is worse than the bug it repairs.
+ *
+ * A one-time pass does not have the ambiguity. Before this build the switch
+ * already read "off" for these rows, because it reads `scope`, so no user can
+ * have turned one off. Every `private` photo row at that instant came from the
+ * old stamp.
+ *
  * Non-`photo:` ids are ignored: everything else in the published set is a
  * client-published memory that by definition already lives in this vault (or in
  * another device's, which is not ours to recreate).

package/dist/server/index.mjs

@@ -141,12 +141,12 @@ import {
   updateVaultMemoryOp,
   upsertMessageOp,
   vaultMemoryToStored
-} from "./chunk-O7TB36P3.mjs";
+} from "./chunk-2QFK4L7Y.mjs";
 import {
   createStreamingDeAnonymizer,
   notifyConsolidationFallback,
   resolvePiiRedactor
-} from "./chunk-GP6YY6H5.mjs";
+} from "./chunk-JPLFOSB2.mjs";
 import {
   INTERNAL_FLOW_MARKER,
   callPortalJsonCompletion,
@@ -157,7 +157,7 @@ import {
   taskTypeHeader,
   validateEndpointOverride,
   withInternalFlowMarker
-} from "./chunk-7D3RI25K.mjs";
+} from "./chunk-H4G3DLDJ.mjs";
 import {
   BASE_URL,
   __commonJS,
@@ -3736,7 +3736,7 @@ async function ingestPublishedPhotoMemoriesOp(ctx, rows) {
       ({ row, content }) => ctx.vaultMemoryCollection.prepareCreate((record) => {
         record._raw.id = row.memoryId;
         record._setRaw("content", content);
-        record._setRaw("scope", "private");
+        record._setRaw("scope", "shared");
         record._setRaw("folder_id", null);
         record._setRaw("user_id", ctx.userId ?? null);
         record._setRaw("is_deleted", false);
@@ -5700,7 +5700,7 @@ async function tryConsolidate(trimmed, ctx, options, prepared) {
     content: m.content,
     similarity: m.similarity
   }));
-  const { consolidateMemory: doConsolidate } = await import("./consolidate-Z2JJP7LW.mjs");
+  const { consolidateMemory: doConsolidate } = await import("./consolidate-CMMDTZ37.mjs");
   const decision = await doConsolidate(trimmed, candidates, consolidateOptions);
   if (decision.action === "create") return null;
   if (decision.action === "supersede" && decision.content) {

package/dist/server/{recall-VHU372MK.mjs → recall-EODNEKIA.mjs}

@@ -1,7 +1,7 @@
 import {
   recall
-} from "./chunk-O7TB36P3.mjs";
-import "./chunk-7D3RI25K.mjs";
+} from "./chunk-2QFK4L7Y.mjs";
+import "./chunk-H4G3DLDJ.mjs";
 import "./chunk-3RPGXXPZ.mjs";
 export {
   recall

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@anuma/sdk",
-  "version": "6.14.1",
+  "version": "6.15.0",
   "description": "",
   "main": "./dist/index.cjs",
   "module": "./dist/index.mjs",
@@ -160,7 +160,7 @@
   "homepage": "https://github.com/anuma-ai/sdk#readme",
   "packageManager": "pnpm@10.23.0",
   "dependencies": {
-    "@anuma/portal": "1.0.0-next.20260811055217",
+    "@anuma/portal": "1.0.0-next.20260815023541",
     "@babel/parser": "^7.29.2",
     "@babel/types": "^7.29.0",
     "ai": "6.0.202",