@anuma/sdk 6.33.1 → 6.33.2

package/dist/memory/context.d.mts

@@ -174,44 +174,6 @@ interface EntityOperationsContext {
     allowUnscopedRows?: boolean;
 }
 
-/**
- * Shared portal LLM call for the memory pipeline.
- *
- * The three LLM-driven steps (`extractFacts`, `consolidateMemory`,
- * `decomposeQuery`) share the same shape: POST to `/api/v1/chat/completions`
- * with a system+user prompt and `response_format: json_object`, parse
- * `choices[0].message.content` as JSON, validate, return null on any failure.
- * This helper owns the fetch+timeout+parse+log boilerplate so each caller
- * stays focused on its prompt and validator.
- *
- * PROMPT CACHING. The portal inserts explicit prompt-cache breakpoints only for
- * `anthropic/` models. Its request schema does carry OpenAI's
- * `prompt_cache_key`, but that is a routing hint for OpenAI's own implicit
- * cache rather than a switch that enables caching, and we deliberately don't
- * send it: the memory pipeline runs open-weights models by default (gpt-oss for
- * extraction/topics, ling for consolidation), and this module already has one
- * hard lesson about OpenAI-standard fields a non-OpenAI provider hard-400s on
- * (`response_format`, below). Revisit only with a verified per-provider gate.
- *
- * So on the models this pipeline actually uses, the only cache that can hit is
- * the provider's own implicit prefix cache — which makes prefix stability the
- * one lever a caller controls. Messages are assembled system-first (below), so
- * every caller must pass a CONSTANT `systemPrompt` and keep all per-call
- * material in `userMessage`: a single interpolated timestamp, id, or count in a
- * system prompt shifts every byte after it and misses the cache on every
- * request thereafter. The memory callers are regression-gated on that property
- * in `promptPrefixStability.test.ts`.
- *
- * Whether those implicit caches hit is observable: each successful response
- * logs the portal's reported token counts at debug level, including
- * `portal.cached_tokens` (the prompt tokens the provider served from cache —
- * the portal omits the field when there was no hit). See {@link logPortalUsage}.
- *
- * There is no batch/async-bulk route on the portal, so a backfill or reindex
- * has no discounted-throughput path either; its only levers are the same stable
- * prefix and caller-side batching (e.g. topicExtract's 10-memories-per-call).
- */
-
 /**
  * Auth for portal LLM calls (extraction, consolidation, decomposition,
  * reflection). Mirrors `memoryEngine`'s `EmbeddingOptions` dual-auth:
@@ -231,16 +193,6 @@ interface PortalLlmAuth {
     getToken?: () => Promise<string | null>;
 }
 
-/**
- * Linear recency decay multiplier — applied post-fusion to nudge fresh
- * memories above stale ones with otherwise comparable scores.
- *
- * Formula:
- *   multiplier(ageDays) = max(floor, 1 - perYearDecay * (ageDays / 365))
- *
- * Memories without an `updatedAt` get a neutral 0.5 (Hindsight pattern —
- * neither boost nor penalty when freshness is unknown).
- */
 interface RecencyOptions {
     /** Override "now" — useful for deterministic tests and back-dated benchmarks. */
     now?: Date;
@@ -263,16 +215,6 @@ interface RecencyOptions {
  */
 type ObservationTrend = "new" | "strengthening" | "stable" | "weakening" | "stale";
 
-/**
- * Unified memory layer types — the Recall / Retain API.
- *
- * This module defines the public surface for the new unified memory layer
- * that sits above `memoryVault` (curated facts) and `memoryEngine` (raw
- * conversation chunks). Callers should prefer these types over the legacy
- * `VaultSearchResult` / `ChunkSearchResult` shapes; the underlying stores
- * may converge later, the API will not.
- */
-
 type MemoryKind = "fact" | "chunk";
 /**
  * Budget controls retrieval depth/cost. Higher budgets enable more
@@ -704,21 +646,6 @@ interface RecallDiagnostics {
     degraded: RecallDegradation[];
 }
 
-/**
- * Auto-extraction worker — W2.
- *
- * After each assistant turn, this pipeline reads the recent conversation,
- * asks an LLM to identify durable user facts, and writes them to the
- * vault via retain(). The user never needs to ask Anuma to remember
- * something — durable facts are captured automatically.
- *
- * Two-stage pipeline (extract → retain). The retain step uses
- * write-time auto-merge (W4) so the same fact re-observed in a later
- * conversation increments proof_count instead of duplicating.
- *
- * Spec: see `tasks/hackathon/auto-extraction-prompt.md`.
- */
-
 declare const FACT_TYPES: readonly ["identity", "preference", "relationship", "plan", "ongoing_context", "constraint", "other"];
 type FactType = (typeof FACT_TYPES)[number];
 

package/dist/memory/context.d.ts

@@ -174,44 +174,6 @@ interface EntityOperationsContext {
     allowUnscopedRows?: boolean;
 }
 
-/**
- * Shared portal LLM call for the memory pipeline.
- *
- * The three LLM-driven steps (`extractFacts`, `consolidateMemory`,
- * `decomposeQuery`) share the same shape: POST to `/api/v1/chat/completions`
- * with a system+user prompt and `response_format: json_object`, parse
- * `choices[0].message.content` as JSON, validate, return null on any failure.
- * This helper owns the fetch+timeout+parse+log boilerplate so each caller
- * stays focused on its prompt and validator.
- *
- * PROMPT CACHING. The portal inserts explicit prompt-cache breakpoints only for
- * `anthropic/` models. Its request schema does carry OpenAI's
- * `prompt_cache_key`, but that is a routing hint for OpenAI's own implicit
- * cache rather than a switch that enables caching, and we deliberately don't
- * send it: the memory pipeline runs open-weights models by default (gpt-oss for
- * extraction/topics, ling for consolidation), and this module already has one
- * hard lesson about OpenAI-standard fields a non-OpenAI provider hard-400s on
- * (`response_format`, below). Revisit only with a verified per-provider gate.
- *
- * So on the models this pipeline actually uses, the only cache that can hit is
- * the provider's own implicit prefix cache — which makes prefix stability the
- * one lever a caller controls. Messages are assembled system-first (below), so
- * every caller must pass a CONSTANT `systemPrompt` and keep all per-call
- * material in `userMessage`: a single interpolated timestamp, id, or count in a
- * system prompt shifts every byte after it and misses the cache on every
- * request thereafter. The memory callers are regression-gated on that property
- * in `promptPrefixStability.test.ts`.
- *
- * Whether those implicit caches hit is observable: each successful response
- * logs the portal's reported token counts at debug level, including
- * `portal.cached_tokens` (the prompt tokens the provider served from cache —
- * the portal omits the field when there was no hit). See {@link logPortalUsage}.
- *
- * There is no batch/async-bulk route on the portal, so a backfill or reindex
- * has no discounted-throughput path either; its only levers are the same stable
- * prefix and caller-side batching (e.g. topicExtract's 10-memories-per-call).
- */
-
 /**
  * Auth for portal LLM calls (extraction, consolidation, decomposition,
  * reflection). Mirrors `memoryEngine`'s `EmbeddingOptions` dual-auth:
@@ -231,16 +193,6 @@ interface PortalLlmAuth {
     getToken?: () => Promise<string | null>;
 }
 
-/**
- * Linear recency decay multiplier — applied post-fusion to nudge fresh
- * memories above stale ones with otherwise comparable scores.
- *
- * Formula:
- *   multiplier(ageDays) = max(floor, 1 - perYearDecay * (ageDays / 365))
- *
- * Memories without an `updatedAt` get a neutral 0.5 (Hindsight pattern —
- * neither boost nor penalty when freshness is unknown).
- */
 interface RecencyOptions {
     /** Override "now" — useful for deterministic tests and back-dated benchmarks. */
     now?: Date;
@@ -263,16 +215,6 @@ interface RecencyOptions {
  */
 type ObservationTrend = "new" | "strengthening" | "stable" | "weakening" | "stale";
 
-/**
- * Unified memory layer types — the Recall / Retain API.
- *
- * This module defines the public surface for the new unified memory layer
- * that sits above `memoryVault` (curated facts) and `memoryEngine` (raw
- * conversation chunks). Callers should prefer these types over the legacy
- * `VaultSearchResult` / `ChunkSearchResult` shapes; the underlying stores
- * may converge later, the API will not.
- */
-
 type MemoryKind = "fact" | "chunk";
 /**
  * Budget controls retrieval depth/cost. Higher budgets enable more
@@ -704,21 +646,6 @@ interface RecallDiagnostics {
     degraded: RecallDegradation[];
 }
 
-/**
- * Auto-extraction worker — W2.
- *
- * After each assistant turn, this pipeline reads the recent conversation,
- * asks an LLM to identify durable user facts, and writes them to the
- * vault via retain(). The user never needs to ask Anuma to remember
- * something — durable facts are captured automatically.
- *
- * Two-stage pipeline (extract → retain). The retain step uses
- * write-time auto-merge (W4) so the same fact re-observed in a later
- * conversation increments proof_count instead of duplicating.
- *
- * Spec: see `tasks/hackathon/auto-extraction-prompt.md`.
- */
-
 declare const FACT_TYPES: readonly ["identity", "preference", "relationship", "plan", "ongoing_context", "constraint", "other"];
 type FactType = (typeof FACT_TYPES)[number];
 

package/dist/next/index.cjs

@@ -26,14 +26,7 @@ module.exports = __toCommonJS(index_exports);
 var withAnuma = (nextConfig = {}) => {
   return {
     ...nextConfig,
-    serverExternalPackages: [
-      ...nextConfig.serverExternalPackages ?? [],
-      "sharp",
-      // exceljs pulls in unzipper → fstream which calls process.umask() at
-      // module init time, crashing Cloudflare Workers and other edge runtimes.
-      // Externalizing prevents the server bundler from including it in SSR.
-      "exceljs"
-    ],
+    serverExternalPackages: [...nextConfig.serverExternalPackages ?? [], "sharp", "exceljs"],
     webpack: (config, options) => {
       const { isServer } = options;
       if (!isServer) {

package/dist/next/index.mjs

@@ -2,14 +2,7 @@
 var withAnuma = (nextConfig = {}) => {
   return {
     ...nextConfig,
-    serverExternalPackages: [
-      ...nextConfig.serverExternalPackages ?? [],
-      "sharp",
-      // exceljs pulls in unzipper → fstream which calls process.umask() at
-      // module init time, crashing Cloudflare Workers and other edge runtimes.
-      // Externalizing prevents the server bundler from including it in SSR.
-      "exceljs"
-    ],
+    serverExternalPackages: [...nextConfig.serverExternalPackages ?? [], "sharp", "exceljs"],
     webpack: (config, options) => {
       const { isServer } = options;
       if (!isServer) {

package/dist/pii/transformers.d.mts

@@ -6,23 +6,6 @@
  */
 type PiiCategory = "EMAIL" | "PHONE" | "SSN" | "CREDIT_CARD" | "IP_ADDRESS" | "API_KEY" | "US_ADDRESS" | "DATE_OF_BIRTH";
 
-/**
- * NER detector contract for PII redaction.
- *
- * The regex layer in {@link ./patterns} handles *structured* PII (email, phone,
- * SSN, credit card, …). It cannot detect *unstructured* PII — person names,
- * locations, organizations — which need a named-entity-recognition model.
- *
- * Rather than bundle a model (and a runtime) into the SDK, we define a small
- * runtime-agnostic contract: a {@link NerDetector} takes text and returns the
- * spans it found. Consumers supply an implementation appropriate to their
- * platform — a Transformers.js model in the browser/Node (see
- * `./detectors/transformers`), an `onnxruntime-react-native` model on mobile,
- * a remote service, or a fake in tests. The SDK keeps detection *on-device* by
- * never calling out itself; it only consumes the spans a detector returns and
- * merges them into the existing placeholder map.
- */
-
 /**
  * A character-offset span of detected PII. `start`/`end` are indices into the
  * text passed to {@link NerDetector.detect} (`end` exclusive). `category`
@@ -51,21 +34,6 @@ interface NerDetector {
     detect(text: string): Promise<PiiSpan[]>;
 }
 
-/**
- * Reference {@link NerDetector} backed by Transformers.js (`@huggingface/transformers`).
- *
- * Runs a quantized BERT NER model fully on-device (browser via the
- * onnxruntime-web/WASM backend, or Node) — no network call, so PII never leaves
- * the device. The model is loaded lazily on first `detect()` and cached, so
- * importing this module is cheap and apps that never enable NER pay nothing.
- *
- * `@huggingface/transformers` is an OPTIONAL peer dependency: it is `import()`-ed
- * dynamically (matching `lib/memory/reranker.ts`) so it is only required when a
- * caller actually constructs this detector. React Native cannot use this
- * detector (its WASM backend doesn't run under Hermes) — supply an
- * `onnxruntime-react-native`-based {@link NerDetector} there instead.
- */
-
 interface TransformersNerDetectorOptions {
     /** Hugging Face model id. Default: `Xenova/bert-base-NER`. */
     model?: string;

package/dist/pii/transformers.d.ts

@@ -6,23 +6,6 @@
  */
 type PiiCategory = "EMAIL" | "PHONE" | "SSN" | "CREDIT_CARD" | "IP_ADDRESS" | "API_KEY" | "US_ADDRESS" | "DATE_OF_BIRTH";
 
-/**
- * NER detector contract for PII redaction.
- *
- * The regex layer in {@link ./patterns} handles *structured* PII (email, phone,
- * SSN, credit card, …). It cannot detect *unstructured* PII — person names,
- * locations, organizations — which need a named-entity-recognition model.
- *
- * Rather than bundle a model (and a runtime) into the SDK, we define a small
- * runtime-agnostic contract: a {@link NerDetector} takes text and returns the
- * spans it found. Consumers supply an implementation appropriate to their
- * platform — a Transformers.js model in the browser/Node (see
- * `./detectors/transformers`), an `onnxruntime-react-native` model on mobile,
- * a remote service, or a fake in tests. The SDK keeps detection *on-device* by
- * never calling out itself; it only consumes the spans a detector returns and
- * merges them into the existing placeholder map.
- */
-
 /**
  * A character-offset span of detected PII. `start`/`end` are indices into the
  * text passed to {@link NerDetector.detect} (`end` exclusive). `category`
@@ -51,21 +34,6 @@ interface NerDetector {
     detect(text: string): Promise<PiiSpan[]>;
 }
 
-/**
- * Reference {@link NerDetector} backed by Transformers.js (`@huggingface/transformers`).
- *
- * Runs a quantized BERT NER model fully on-device (browser via the
- * onnxruntime-web/WASM backend, or Node) — no network call, so PII never leaves
- * the device. The model is loaded lazily on first `detect()` and cached, so
- * importing this module is cheap and apps that never enable NER pay nothing.
- *
- * `@huggingface/transformers` is an OPTIONAL peer dependency: it is `import()`-ed
- * dynamically (matching `lib/memory/reranker.ts`) so it is only required when a
- * caller actually constructs this detector. React Native cannot use this
- * detector (its WASM backend doesn't run under Hermes) — supply an
- * `onnxruntime-react-native`-based {@link NerDetector} there instead.
- */
-
 interface TransformersNerDetectorOptions {
     /** Hugging Face model id. Default: `Xenova/bert-base-NER`. */
     model?: string;

package/dist/react/{chunk-XNQRJBIH.mjs → chunk-UFO4W3JX.mjs}

@@ -59,15 +59,10 @@ function luhnCheck(digits) {
   return sum % 10 === 0;
 }
 var PII_PATTERNS = [
-  // Email — standard RFC-ish pattern.
-  // Quantifiers are bounded (local-part ≤ 64, domain ≤ 255, TLD ≤ 24 —
-  // all at or above real RFC 5321 limits) so the engine cannot backtrack
-  // quadratically on adversarial input like "a.a.a.a…" with no "@".
   {
     category: "EMAIL",
     regex: /\b[a-zA-Z0-9._%+-]{1,64}@[a-zA-Z0-9.-]{1,255}\.[a-zA-Z]{2,24}\b/g
   },
-  // SSN — US Social Security Number, dashed form (must run before phone)
   {
     category: "SSN",
     regex: /\b\d{3}-\d{2}-\d{4}\b/g,
@@ -77,9 +72,6 @@ var PII_PATTERNS = [
       return area !== 0 && area !== 666 && area < 900;
     }
   },
-  // SSN — dashless or space-separated form. Only redacted with an "SSN" /
-  // "social security" cue nearby: a bare 9-digit run is too ambiguous
-  // (ZIP+4, account numbers, etc.) to redact unconditionally.
   {
     category: "SSN",
     regex: /\b\d{3}[ ]?\d{2}[ ]?\d{4}\b/g,
@@ -91,8 +83,6 @@ var PII_PATTERNS = [
       return area !== 0 && area !== 666 && area < 900;
     }
   },
-  // Credit card numbers — 13-19 contiguous digits or groups of 4 separated by spaces/dashes
-  // Must run before phone to avoid partial matches
   {
     category: "CREDIT_CARD",
     regex: /\b\d{4}[\s-]\d{4}[\s-]\d{4}[\s-]\d{1,7}\b|\b\d{13,19}\b/g,
@@ -102,7 +92,6 @@ var PII_PATTERNS = [
       return luhnCheck(digits);
     }
   },
-  // IPv4 addresses (must run before phone to avoid partial matches)
   {
     category: "IP_ADDRESS",
     regex: /\b(?:(?:25[0-5]|2[0-4]\d|[01]?\d\d?)\.){3}(?:25[0-5]|2[0-4]\d|[01]?\d\d?)\b/g,
@@ -110,31 +99,15 @@ var PII_PATTERNS = [
       return match !== "0.0.0.0" && match !== "127.0.0.1" && match !== "255.255.255.255";
     }
   },
-  // IPv6 addresses — full and compressed (::) forms. Each alternative requires
-  // either a full 8-group address or a "::" compression, so ordinary
-  // colon-separated text (timestamps like 12:34:56) does not match. Loopback
-  // (::1) and unspecified (::) are excluded.
   {
     category: "IP_ADDRESS",
     regex: /(?:(?:[0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}|(?:[0-9a-fA-F]{1,4}:){1,7}:|(?:[0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|(?:[0-9a-fA-F]{1,4}:){1,5}(?::[0-9a-fA-F]{1,4}){1,2}|(?:[0-9a-fA-F]{1,4}:){1,4}(?::[0-9a-fA-F]{1,4}){1,3}|(?:[0-9a-fA-F]{1,4}:){1,3}(?::[0-9a-fA-F]{1,4}){1,4}|(?:[0-9a-fA-F]{1,4}:){1,2}(?::[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:(?::[0-9a-fA-F]{1,4}){1,6}|:(?:(?::[0-9a-fA-F]{1,4}){1,7}|:))/g,
     validate: (match) => match !== "::1" && match !== "::"
   },
-  // Phone numbers. The separated form requires separator characters (dashes,
-  // spaces, dots, parens) to avoid matching bare digit sequences that are
-  // actually credit cards, IPs, or years. A second alternative matches E.164
-  // (a leading "+" then 10–15 digits, e.g. +14155552671), which is
-  // unambiguous; a bare 10-digit run with no "+" and no separators is
-  // intentionally not matched to avoid false positives.
   {
     category: "PHONE",
     regex: /(?:\+\d{1,3}[\s.-])?\(?\d{3}\)?[\s.-]\d{3}[\s.-]\d{4}\b|\+\d{10,15}\b/g
   },
-  // API keys / secrets — long token with a key-like prefix. The validator
-  // requires entropy (at least one digit, or a mix of upper- and lower-case)
-  // so long all-lowercase prose identifiers like
-  // "accessibility_is_important_for_everyone" or
-  // "access-control-list-management-feature" are not redacted. Real keys and
-  // tokens essentially always contain digits or mixed case.
   {
     category: "API_KEY",
     regex: /\b(?:sk|pk|api|key|token|secret|bearer|access)[_-]?[a-zA-Z0-9_-]{20,}\b/gi,
@@ -144,13 +117,6 @@ var PII_PATTERNS = [
       return hasDigit || hasMixedCase;
     }
   },
-  // US street addresses — house number + Title-Case street name + suffix.
-  // Intentionally NOT case-insensitive: the `[A-Z][a-z]+` guard requires
-  // properly-capitalized street words, so "123 main street", "100 MAIN
-  // STREET" and prose like "3 blocks down the road" / "5 minutes to drive"
-  // are not treated as addresses. Whitespace is `[ \t]` only (no newline
-  // spanning), and the suffix must end the segment (punctuation / newline /
-  // end of string) so "Driveway" or "Wayfair" don't match on the suffix.
   {
     category: "US_ADDRESS",
     regex: /\b\d{1,5}[ \t]+(?:[A-Z][a-z]+[ \t]+){1,3}(?:St(?:reet)?|Ave(?:nue)?|Blvd|Boulevard|Dr(?:ive)?|Ln|Lane|Rd|Road|Ct|Court|Pl(?:ace)?|Way|Cir(?:cle)?|Pkwy|Parkway|Hwy|Highway)\.?(?=[\s,.;:!?)]|$)/g,
@@ -158,11 +124,6 @@ var PII_PATTERNS = [
       return !/^0/.test(match.trim());
     }
   },
-  // Dates of birth — common US date formats. Only redacted when a birth-date
-  // cue ("DOB", "born", "birthday", "date of birth") appears just before the
-  // date, so ordinary calendar dates ("meeting 12/25/2024", deadlines,
-  // invoices) are left intact for the model. A calendar validator also rejects
-  // impossible dates like 02/31/1990.
   {
     category: "DATE_OF_BIRTH",
     regex: /\b(?:(?:0?[1-9]|1[0-2])[/-](?:0?[1-9]|[12]\d|3[01])[/-](?:19|20)\d{2})\b/g,
@@ -343,12 +304,6 @@ var PiiRedactor = class {
   maskText(text) {
     return this.scan(text, (category) => `[${category}]`).text;
   }
-  // ───────────────────────────────────────────────────────────────────────
-  // Async (regex + NER) path. Mirrors the sync API but additionally folds in
-  // an optional {@link NerDetector}'s spans. When no detector is configured,
-  // each async method delegates to its sync counterpart and is byte-for-byte
-  // identical — so it is a safe drop-in.
-  // ───────────────────────────────────────────────────────────────────────
   /** All regex matches as spans on the ORIGINAL text (priority 0). Uses the
    *  same {@link findMatches} guards as the sync scan. */
   collectRegexSpans(text) {
@@ -892,16 +847,7 @@ async function attemptPortalJson(req, endpoint) {
   const usesPrefill = req.transport !== "responses" && req.model.startsWith("anthropic/");
   const prefill = usesPrefill ? "{" : "";
   const messages = [
-    // Every caller of this helper is a first-party BACKGROUND op (fact extraction,
-    // topic sweep, consolidation, classifiers, graph traversal, query
-    // decomposition). Marking here — the one place they all funnel through — is what
-    // keeps the portal's detector reading them as genuine rather than markerless.
-    // See ../internalFlowMarker.
     { role: "system", content: withInternalFlowMarker(req.systemPrompt) },
-    // Retry-only. Kept as a SEPARATE message rather than appended to the system
-    // prompt so the marked prompt above stays byte-identical across attempts —
-    // the portal's internal-flow detector reads that one, and rewriting it on a
-    // retry would change what the detector sees for reasons unrelated to auth.
     ...req.reinforceJsonContract ? [{ role: "system", content: JSON_CONTRACT_REMINDER }] : [],
     { role: "user", content: req.userMessage }
   ];
@@ -911,22 +857,8 @@ async function attemptPortalJson(req, endpoint) {
   const timer = setTimeout(() => controller.abort(), timeoutMs);
   const requestBody = req.transport === "responses" ? {
     model: req.model,
-    // Same system+user pair under the Responses-API field name. No prefill
-    // entry to strip: `usesPrefill` is false on this transport, so it was
-    // never pushed and the response-side restore is disarmed with it. An
-    // earlier version pushed it and sliced it back off here, which left
-    // `prefill` truthy and the restore still armed — the fix belonged at
-    // the decision, not at the two symptoms.
     input: messages,
     ...req.reasoning && { reasoning: req.reasoning },
-    // NO response_format. The Responses API spells structured output
-    // differently (`text.format`), and it is unverified against this
-    // portal — so this transport relies on the same strict-JSON system
-    // prompt plus `extractJsonCandidate` that every response_format-
-    // rejecting model already relies on. Verified end to end on dev:
-    // luna returns clean parseable JSON here without it. Add the field
-    // only with a per-provider check, exactly as RESPONSE_FORMAT_OK was
-    // earned.
     ...responsesExtra(req.extra)
   } : {
     model: req.model,
@@ -941,8 +873,6 @@ async function attemptPortalJson(req, endpoint) {
   try {
     response = await fetchImpl(`${baseUrl}${endpoint}`, {
       method: "POST",
-      // Attached HERE, at the one transport every background memory op shares, so
-      // a new flow gets the provenance by construction rather than by remembering.
       headers: {
         ...authHeaders,
         ...taskTypeHeader(req.taskType),

package/dist/react/{consolidate-5DVINCUE.mjs → consolidate-RHIAUBT4.mjs}

@@ -2,7 +2,7 @@ import {
   callPortalJsonCompletion,
   notifyConsolidationFallback,
   resolvePiiRedactor
-} from "./chunk-XNQRJBIH.mjs";
+} from "./chunk-UFO4W3JX.mjs";
 import "./chunk-GYKJOWEO.mjs";
 
 // src/lib/memory/consolidate.ts
@@ -80,12 +80,6 @@ ${candidateText}`;
       systemPrompt: SYSTEM_PROMPT,
       userMessage,
       tag: "memory/consolidate",
-      // Retry TRANSIENT failures only (network/timeout/5xx/429/empty) before
-      // degrading to create — a transient blip would otherwise leave a
-      // permanent below-floor paraphrase that never self-heals (see
-      // DEFAULT_CONSOLIDATE_ATTEMPTS). The happy path still resolves in one
-      // attempt; terminal failures (400/auth) and schema violations never
-      // retry. A total budget keeps a hanging portal from stalling retain.
       maxAttempts: options.maxAttempts ?? DEFAULT_CONSOLIDATE_ATTEMPTS,
       totalTimeoutMs: options.totalTimeoutMs ?? DEFAULT_CONSOLIDATE_TOTAL_TIMEOUT_MS,
       ...options.backoffMs && { backoffMs: options.backoffMs },
@@ -162,7 +156,6 @@ function validate(parsed, newContent, validIds) {
       const positional = Array.isArray(obj.targetSubjects) ? obj.targetSubjects : [];
       const statedSubjects = [
         ...positional.map((s) => subjectKey(s)),
-        // The singular pair, which is the whole story for a one-target supersede.
         subjectKey(obj.targetSubject)
       ];
       if (statedSubjects.some((s) => s.length > 0 && s !== newSubject)) {