@anuma/sdk 9.1.5 → 9.1.7

package/dist/server/index.cjs

@@ -15742,7 +15742,8 @@ async function callPortalJsonCompletion(req) {
   }
   const maxAttempts = Math.max(1, req.maxAttempts ?? 3);
   const startedAt = Date.now();
-  const overBudget = () => req.totalTimeoutMs !== void 0 && Date.now() - startedAt >= req.totalTimeoutMs;
+  const deadlineAt = req.totalTimeoutMs === void 0 ? void 0 : startedAt + req.totalTimeoutMs;
+  const overBudget = () => deadlineAt !== void 0 && Date.now() >= deadlineAt;
   let lastFailure;
   let reinforce = false;
   const giveUp = () => {
@@ -15755,17 +15756,11 @@ async function callPortalJsonCompletion(req) {
       lastFailure = { reason: "time-budget-exhausted", attempts: attempt - 1 };
       break;
     }
-    const attemptReq = req.totalTimeoutMs !== void 0 ? {
-      ...req,
-      timeoutMs: Math.max(
-        1,
-        Math.min(req.timeoutMs ?? 6e4, req.totalTimeoutMs - (Date.now() - startedAt))
-      ),
-      ...reinforce && { reinforceJsonContract: true }
-    } : reinforce ? { ...req, reinforceJsonContract: true } : req;
+    const attemptReq = reinforce ? { ...req, reinforceJsonContract: true } : req;
     const outcome = await attemptPortalJson(
       { ...attemptReq, transport },
-      endpoint
+      endpoint,
+      deadlineAt
     );
     if (outcome.kind === "ok") {
       req.onAttempt?.({ attempt, ok: true });
@@ -15805,13 +15800,38 @@ async function callPortalJsonCompletion(req) {
   }
   return giveUp();
 }
-async function attemptPortalJson(req, endpoint) {
+async function attemptPortalJson(req, endpoint, deadlineAt) {
+  const controller = new AbortController();
+  if (deadlineAt === void 0 || deadlineAt - Date.now() > MAX_TIMER_DELAY_MS) {
+    return requestPortalJson(req, endpoint, controller);
+  }
+  const remainingMs = deadlineAt - Date.now();
+  if (remainingMs <= 0) return TIME_BUDGET_EXHAUSTED;
+  let timer;
+  try {
+    const outcome = await Promise.race([
+      new Promise((resolve) => {
+        timer = setTimeout(() => {
+          resolve(TIME_BUDGET_EXHAUSTED);
+          controller.abort();
+        }, remainingMs);
+      }),
+      requestPortalJson(req, endpoint, controller, deadlineAt)
+    ]);
+    return Date.now() >= deadlineAt ? TIME_BUDGET_EXHAUSTED : outcome;
+  } finally {
+    clearTimeout(timer);
+  }
+}
+async function requestPortalJson(req, endpoint, controller, deadlineAt) {
   const baseUrl = req.baseUrl ?? defaultBaseUrl();
   const fetchImpl = req.fetchFn ?? fetch;
-  const timeoutMs = req.timeoutMs ?? 6e4;
   const authHeaders = await resolvePortalAuthHeaders(req, req.tag);
+  const remainingMs = deadlineAt === void 0 ? Infinity : deadlineAt - Date.now();
+  if (controller.signal.aborted || remainingMs <= 0) return TIME_BUDGET_EXHAUSTED;
   if (authHeaders === null)
     return { kind: "terminal", code: "auth-unavailable", reason: "auth unavailable (no token)" };
+  const timeoutMs = Math.min(req.timeoutMs ?? 6e4, remainingMs);
   const usesPrefill = req.transport !== "responses" && req.model.startsWith("anthropic/");
   const prefill = usesPrefill ? "{" : "";
   const messages = [
@@ -15821,7 +15841,6 @@ async function attemptPortalJson(req, endpoint) {
   ];
   if (prefill) messages.push({ role: "assistant", content: prefill });
   const supportsJsonObjectFormat = supportsResponseFormat(req.model);
-  const controller = new AbortController();
   const timer = setTimeout(() => controller.abort(), timeoutMs);
   const requestBody = req.transport === "responses" ? {
     model: req.model,
@@ -16006,7 +16025,7 @@ function extractResponsesContent(body) {
   const text12 = root.output.filter((item) => asRecord(item)?.type === "message").flatMap((item) => Array.isArray(item.content) ? item.content : []).map((part) => asRecord(part)?.text).filter((t) => typeof t === "string").join("");
   return text12;
 }
-var RESPONSE_FORMAT_OK, RESPONSE_SCHEMA_OK, JSON_CONTRACT_REMINDER, RESPONSES_ONLY_MODEL_PREFIXES, CHAT_TO_RESPONSES_FIELDS, FOREIGN_ENDPOINT_SUFFIX, RETRYABLE_HTTP;
+var RESPONSE_FORMAT_OK, RESPONSE_SCHEMA_OK, JSON_CONTRACT_REMINDER, RESPONSES_ONLY_MODEL_PREFIXES, CHAT_TO_RESPONSES_FIELDS, FOREIGN_ENDPOINT_SUFFIX, TIME_BUDGET_EXHAUSTED, MAX_TIMER_DELAY_MS, RETRYABLE_HTTP;
 var init_portalLlm = __esm({
   "src/lib/memory/portalLlm.ts"() {
     "use strict";
@@ -16026,6 +16045,12 @@ var init_portalLlm = __esm({
       chat: "/responses",
       responses: "/chat/completions"
     };
+    TIME_BUDGET_EXHAUSTED = {
+      kind: "terminal",
+      code: "time-budget-exhausted",
+      reason: "time budget exhausted"
+    };
+    MAX_TIMER_DELAY_MS = 2147483647;
     RETRYABLE_HTTP = /* @__PURE__ */ new Set([408, 409, 425, 429]);
   }
 });
@@ -17661,7 +17686,14 @@ function cosineSimilarity(a, b) {
 
 // src/lib/processors/encoding.ts
 var B64_ENCODE_CHUNK = 32768 * 3;
+function assertFileUrlAllowed(dataUrl) {
+  const isNode = typeof process !== "undefined" && Boolean(process.versions?.node);
+  if (isNode && !dataUrl.startsWith("data:") && !dataUrl.startsWith("blob:")) {
+    throw new Error("Server file preprocessing requires a data URL or blob URL.");
+  }
+}
 async function dataUrlToArrayBuffer(dataUrl) {
+  assertFileUrlAllowed(dataUrl);
   if (dataUrl.startsWith("blob:") || dataUrl.startsWith("http://") || dataUrl.startsWith("https://")) {
     const response = await fetch(dataUrl);
     return response.arrayBuffer();
@@ -19991,7 +20023,7 @@ var mergeHeaders = (...headers) => {
     if (!header || typeof header !== "object") {
       continue;
     }
-    const iterator = header instanceof Headers ? headersEntries(header) : Object.entries(header);
+    const iterator = Array.isArray(header) || header instanceof Headers ? headersEntries(new Headers(header)) : Object.entries(header);
     for (const [key, value] of iterator) {
       if (value === null) {
         mergedHeaders.delete(key);
@@ -20267,13 +20299,25 @@ var createClient = (config = {}) => {
 init_clientConfig();
 var client = createClient(createClientConfig(createConfig()));
 
+// src/clientHeaders.ts
+function normalizeHeaders(headers) {
+  if (headers instanceof Headers || Array.isArray(headers)) {
+    const normalized = /* @__PURE__ */ Object.create(null);
+    new Headers(headers).forEach((value, name) => {
+      normalized[name] = value;
+    });
+    return normalized;
+  }
+  return headers;
+}
+
 // src/client/sdk.gen.ts
 var postApiV1Embeddings = (options) => (options.client ?? client).post({
   url: "/api/v1/embeddings",
   ...options,
   headers: {
     "Content-Type": "application/json",
-    ...options.headers
+    ...normalizeHeaders(options.headers)
   }
 });
 
@@ -29072,6 +29116,16 @@ async function updateVaultMemoryOp(ctx, id, opts) {
     const probe = await ctx.vaultMemoryCollection.find(id);
     if (probe.isDeleted || probe.supersededBy || !isOwnedByCtxUser(ctx, probe)) return null;
     if (opts.freeFormOnly && isKinded(probe)) return null;
+    const readStoredContent = probe._getRaw("content");
+    if (opts.expectedContent !== void 0) {
+      const current = await vaultMemoryToStored(
+        probe,
+        ctx.walletAddress,
+        ctx.signMessage,
+        ctx.embeddedWalletSigner
+      );
+      if (current.content !== opts.expectedContent) return null;
+    }
     const levelAfter = (current) => {
       if (opts.level !== void 0) return opts.level;
       if (opts.scope === void 0) return resolveMemoryLevel(current.level, current.scope);
@@ -29079,7 +29133,7 @@ async function updateVaultMemoryOp(ctx, id, opts) {
     };
     assertValidKindLevel(opts.kind !== void 0 ? opts.kind : probe.kind, levelAfter(probe));
     const encryptedKindValue = await encryptKindValue(ctx, opts.kindValue);
-    const encryptedContent = ctx.walletAddress && ctx.signMessage ? await encryptVaultMemoryContent(
+    const encryptedContent = opts.content !== void 0 && ctx.walletAddress && ctx.signMessage ? await encryptVaultMemoryContent(
       opts.content,
       ctx.walletAddress,
       ctx.signMessage,
@@ -29087,13 +29141,13 @@ async function updateVaultMemoryOp(ctx, id, opts) {
     ) : opts.content;
     let stale = false;
     const record = probe;
-    const originalUpdatedAt = record.updatedAt.getTime();
     await ctx.database.write(async () => {
       await assertCanWrite2(ctx);
-      if (record.isDeleted || record.supersededBy || !isOwnedByCtxUser(ctx, record) || opts.freeFormOnly && isKinded(record)) {
+      if (record.isDeleted || record.supersededBy || !isOwnedByCtxUser(ctx, record) || opts.freeFormOnly && isKinded(record) || opts.expectedContent !== void 0 && record._getRaw("content") !== readStoredContent) {
         stale = true;
         return;
       }
+      const originalUpdatedAt = record.updatedAt.getTime();
       const nextKind = opts.kind !== void 0 ? opts.kind : record.kind;
       const nextLevel = levelAfter(record);
       assertValidKindLevel(nextKind, nextLevel);
@@ -29109,7 +29163,7 @@ async function updateVaultMemoryOp(ctx, id, opts) {
         replayedObservation = opts.observationSourceIds.every((id2) => observedSources.includes(id2));
       }
       await record.update((r) => {
-        r._setRaw("content", encryptedContent);
+        if (encryptedContent !== void 0) r._setRaw("content", encryptedContent);
         if (opts.level !== void 0) {
           r._setRaw("level", nextLevel);
           r._setRaw("scope", scopeForLevel(nextLevel));
@@ -29877,7 +29931,7 @@ function classifyDecay(m, now, policy) {
   if (m.source === "manual" || m.source === SOURCE_PHOTO) return "keep";
   if (isTimeSensitiveType(m.factType) && m.eventTimeEnd !== null) {
     if (m.eventTimeEnd < now - resolved.pastEventGraceMs) return "archive";
-    if (m.eventTimeEnd >= now) return "keep";
+    return "keep";
   }
   if (now - lastActivityAt(m) > ttlForType(m.factType, resolved)) return "archive";
   return "keep";
@@ -33098,7 +33152,6 @@ async function retainWithPersistence(content, ctx, options = {}) {
           const factTypeUpdate = pickFactTypeUpdate(existing, options.factType);
           const resurrect = resurrectFields(existing);
           const updated = await ctx.persistence.update(targetId, {
-            content: existing.content,
             freeFormOnly: true,
             proofCountIncrement: 1,
             observationSourceIds: options.sourceChunkIds,
@@ -33337,7 +33390,6 @@ async function tryConsolidate(trimmed, ctx, options, prepared) {
     const factTypeUpdate = pickFactTypeUpdate(existing, options.factType);
     const resurrect = resurrectFields(existing);
     const updated = await ctx.persistence.update(decision.targetId, {
-      content: existing.content,
       freeFormOnly: true,
       proofCountIncrement: 1,
       observationSourceIds: options.sourceChunkIds,
@@ -33365,6 +33417,10 @@ async function tryConsolidate(trimmed, ctx, options, prepared) {
     };
   }
   if (decision.action === "update" && decision.targetId && decision.content) {
+    const expectedContent = candidates.find(
+      (candidate) => candidate.id === decision.targetId
+    )?.content;
+    if (expectedContent === void 0) return null;
     const existing = await ctx.persistence.get(decision.targetId);
     if (!existing || existing.supersededBy) {
       return abandonToRace(
@@ -33372,6 +33428,9 @@ async function tryConsolidate(trimmed, ctx, options, prepared) {
         `update: target ${decision.targetId} ${existing ? "superseded" : "deleted"} before the write`
       );
     }
+    if (existing.content !== expectedContent) {
+      return abandonToRace(options, `update: target ${decision.targetId} edited before the write`);
+    }
     const mergedSourceIds = unionStrings(
       existing.sourceChunkIds ?? [],
       options.sourceChunkIds ?? []
@@ -33384,6 +33443,7 @@ async function tryConsolidate(trimmed, ctx, options, prepared) {
     const resurrect = resurrectFields(existing);
     const updated = await ctx.persistence.update(decision.targetId, {
       content: decision.content,
+      expectedContent,
       freeFormOnly: true,
       proofCountIncrement: 1,
       observationSourceIds: options.sourceChunkIds,
@@ -33396,10 +33456,10 @@ async function tryConsolidate(trimmed, ctx, options, prepared) {
       ...factTypeUpdate !== void 0 && { factType: factTypeUpdate }
     });
     if (!updated) {
-      await assertMergeTargetGoneOrThrow(ctx, decision.targetId);
+      await assertMergeTargetGoneOrThrow(ctx, decision.targetId, expectedContent);
       return abandonToRace(
         options,
-        `update: target ${decision.targetId} deleted mid-write (consolidated rewrite lost)`
+        `update: target ${decision.targetId} changed mid-write (consolidated rewrite lost)`
       );
     }
     cacheRowVector(
@@ -33426,9 +33486,9 @@ async function tryConsolidate(trimmed, ctx, options, prepared) {
   );
   return null;
 }
-async function assertMergeTargetGoneOrThrow(ctx, targetId) {
+async function assertMergeTargetGoneOrThrow(ctx, targetId, expectedContent) {
   const stillExists = await (ctx.persistence.getFresh ? ctx.persistence.getFresh(targetId) : ctx.persistence.get(targetId));
-  if (stillExists && (stillExists.kind === null || stillExists.kind === void 0)) {
+  if (stillExists && (stillExists.kind === null || stillExists.kind === void 0) && (expectedContent === void 0 || stillExists.content === expectedContent)) {
     throw new RetainError(
       "merge-not-persisted",
       `retain: merge into memory ${targetId} failed to persist`
@@ -39030,6 +39090,7 @@ async function getPdfjs() {
   return pdfjsModule;
 }
 async function withPdfDocument(pdfDataUrl, fn) {
+  assertFileUrlAllowed(pdfDataUrl);
   const pdfjs = await getPdfjs();
   const loadingTask = pdfjs.getDocument(pdfDataUrl);
   let pdf;
@@ -39824,6 +39885,7 @@ async function preprocessFiles(files, options = {}) {
         skip("no_data");
         continue;
       }
+      assertFileUrlAllowed(file.url);
       const fileWithData = {
         ...file,
         dataUrl: file.url

package/dist/server/index.d.mts

@@ -5287,7 +5287,8 @@ interface CreateVaultMemoryOptions {
     geohash?: string;
 }
 interface UpdateVaultMemoryOptions {
-    content: string;
+    content?: string;
+    expectedContent?: string;
     /** When true, the write is skipped (returns null) if the row carries a profile kind. */
     freeFormOnly?: boolean;
     /**
@@ -5849,9 +5850,10 @@ declare function ttlForType(factType: string | null, policy?: Partial<DecayPolic
  *     null `eventTimeEnd` is still ongoing, so this rule does not fire for it.
  *  4. Age fallback — `now - updatedAt > TTL(factType)` → archive. Durable types
  *     have Infinity TTL, so this never fires for them; null/unknown use medium.
- *     EXCEPTION: a `plan`/`ongoing_context` with a still-upcoming event
- *     (`eventTimeEnd >= now`) is kept — it must not age-archive before the event
- *     happens; only rule 3 (after it passes) may archive it.
+ *     EXCEPTION: a `plan` / `ongoing_context` with an upcoming event or an event
+ *     within the grace period (`eventTimeEnd >= now - pastEventGraceMs`) stays
+ *     active, even after its activity TTL expires. Rule 3 archives it after the
+ *     grace period ends.
  *  5. Otherwise → keep.
  *
  * @param m     Plaintext decay inputs for one row.
@@ -6182,7 +6184,9 @@ type MemoryCreate = Pick<CreateVaultMemoryOptions, "content" | "scope" | "factTy
  * `embedding` (with `embeddingModel`) only when you already have the new one.
  * @public
  */
-type MemoryUpdate = Pick<UpdateVaultMemoryOptions, "content" | "scope" | "factType" | "eventTime" | "embedding" | "embeddingModel" | "kind" | "kindValue" | "level">;
+type MemoryUpdate = Pick<UpdateVaultMemoryOptions, "scope" | "factType" | "eventTime" | "embedding" | "embeddingModel" | "kind" | "kindValue" | "level"> & {
+    content: string;
+};
 /**
  * Fact-only recall. Conversation chunks are message storage, not memory, so
  * the chunk-lane knobs are not part of this surface; nor is `folderId` (see

package/dist/server/index.d.ts

@@ -5287,7 +5287,8 @@ interface CreateVaultMemoryOptions {
     geohash?: string;
 }
 interface UpdateVaultMemoryOptions {
-    content: string;
+    content?: string;
+    expectedContent?: string;
     /** When true, the write is skipped (returns null) if the row carries a profile kind. */
     freeFormOnly?: boolean;
     /**
@@ -5849,9 +5850,10 @@ declare function ttlForType(factType: string | null, policy?: Partial<DecayPolic
  *     null `eventTimeEnd` is still ongoing, so this rule does not fire for it.
  *  4. Age fallback — `now - updatedAt > TTL(factType)` → archive. Durable types
  *     have Infinity TTL, so this never fires for them; null/unknown use medium.
- *     EXCEPTION: a `plan`/`ongoing_context` with a still-upcoming event
- *     (`eventTimeEnd >= now`) is kept — it must not age-archive before the event
- *     happens; only rule 3 (after it passes) may archive it.
+ *     EXCEPTION: a `plan` / `ongoing_context` with an upcoming event or an event
+ *     within the grace period (`eventTimeEnd >= now - pastEventGraceMs`) stays
+ *     active, even after its activity TTL expires. Rule 3 archives it after the
+ *     grace period ends.
  *  5. Otherwise → keep.
  *
  * @param m     Plaintext decay inputs for one row.
@@ -6182,7 +6184,9 @@ type MemoryCreate = Pick<CreateVaultMemoryOptions, "content" | "scope" | "factTy
  * `embedding` (with `embeddingModel`) only when you already have the new one.
  * @public
  */
-type MemoryUpdate = Pick<UpdateVaultMemoryOptions, "content" | "scope" | "factType" | "eventTime" | "embedding" | "embeddingModel" | "kind" | "kindValue" | "level">;
+type MemoryUpdate = Pick<UpdateVaultMemoryOptions, "scope" | "factType" | "eventTime" | "embedding" | "embeddingModel" | "kind" | "kindValue" | "level"> & {
+    content: string;
+};
 /**
  * Fact-only recall. Conversation chunks are message storage, not memory, so
  * the chunk-lane knobs are not part of this surface; nor is `folderId` (see

package/dist/server/index.mjs

@@ -13,7 +13,7 @@ import {
   taskTypeHeader,
   validateEndpointOverride,
   withInternalFlowMarker
-} from "./chunk-AU3Z7NBC.mjs";
+} from "./chunk-QEROZ4VH.mjs";
 import {
   BASE_URL,
   __commonJS,
@@ -15987,7 +15987,14 @@ function cosineSimilarity(a, b) {
 
 // src/lib/processors/encoding.ts
 var B64_ENCODE_CHUNK = 32768 * 3;
+function assertFileUrlAllowed(dataUrl) {
+  const isNode = typeof process !== "undefined" && Boolean(process.versions?.node);
+  if (isNode && !dataUrl.startsWith("data:") && !dataUrl.startsWith("blob:")) {
+    throw new Error("Server file preprocessing requires a data URL or blob URL.");
+  }
+}
 async function dataUrlToArrayBuffer(dataUrl) {
+  assertFileUrlAllowed(dataUrl);
   if (dataUrl.startsWith("blob:") || dataUrl.startsWith("http://") || dataUrl.startsWith("https://")) {
     const response = await fetch(dataUrl);
     return response.arrayBuffer();
@@ -18311,7 +18318,7 @@ var mergeHeaders = (...headers) => {
     if (!header || typeof header !== "object") {
       continue;
     }
-    const iterator = header instanceof Headers ? headersEntries(header) : Object.entries(header);
+    const iterator = Array.isArray(header) || header instanceof Headers ? headersEntries(new Headers(header)) : Object.entries(header);
     for (const [key, value] of iterator) {
       if (value === null) {
         mergedHeaders.delete(key);
@@ -18586,13 +18593,25 @@ var createClient = (config = {}) => {
 // src/client/client.gen.ts
 var client = createClient(createClientConfig(createConfig()));
 
+// src/clientHeaders.ts
+function normalizeHeaders(headers) {
+  if (headers instanceof Headers || Array.isArray(headers)) {
+    const normalized = /* @__PURE__ */ Object.create(null);
+    new Headers(headers).forEach((value, name) => {
+      normalized[name] = value;
+    });
+    return normalized;
+  }
+  return headers;
+}
+
 // src/client/sdk.gen.ts
 var postApiV1Embeddings = (options) => (options.client ?? client).post({
   url: "/api/v1/embeddings",
   ...options,
   headers: {
     "Content-Type": "application/json",
-    ...options.headers
+    ...normalizeHeaders(options.headers)
   }
 });
 
@@ -27363,6 +27382,16 @@ async function updateVaultMemoryOp(ctx, id, opts) {
     const probe = await ctx.vaultMemoryCollection.find(id);
     if (probe.isDeleted || probe.supersededBy || !isOwnedByCtxUser(ctx, probe)) return null;
     if (opts.freeFormOnly && isKinded(probe)) return null;
+    const readStoredContent = probe._getRaw("content");
+    if (opts.expectedContent !== void 0) {
+      const current = await vaultMemoryToStored(
+        probe,
+        ctx.walletAddress,
+        ctx.signMessage,
+        ctx.embeddedWalletSigner
+      );
+      if (current.content !== opts.expectedContent) return null;
+    }
     const levelAfter = (current) => {
       if (opts.level !== void 0) return opts.level;
       if (opts.scope === void 0) return resolveMemoryLevel(current.level, current.scope);
@@ -27370,7 +27399,7 @@ async function updateVaultMemoryOp(ctx, id, opts) {
     };
     assertValidKindLevel(opts.kind !== void 0 ? opts.kind : probe.kind, levelAfter(probe));
     const encryptedKindValue = await encryptKindValue(ctx, opts.kindValue);
-    const encryptedContent = ctx.walletAddress && ctx.signMessage ? await encryptVaultMemoryContent(
+    const encryptedContent = opts.content !== void 0 && ctx.walletAddress && ctx.signMessage ? await encryptVaultMemoryContent(
       opts.content,
       ctx.walletAddress,
       ctx.signMessage,
@@ -27378,13 +27407,13 @@ async function updateVaultMemoryOp(ctx, id, opts) {
     ) : opts.content;
     let stale = false;
     const record = probe;
-    const originalUpdatedAt = record.updatedAt.getTime();
     await ctx.database.write(async () => {
       await assertCanWrite2(ctx);
-      if (record.isDeleted || record.supersededBy || !isOwnedByCtxUser(ctx, record) || opts.freeFormOnly && isKinded(record)) {
+      if (record.isDeleted || record.supersededBy || !isOwnedByCtxUser(ctx, record) || opts.freeFormOnly && isKinded(record) || opts.expectedContent !== void 0 && record._getRaw("content") !== readStoredContent) {
         stale = true;
         return;
       }
+      const originalUpdatedAt = record.updatedAt.getTime();
       const nextKind = opts.kind !== void 0 ? opts.kind : record.kind;
       const nextLevel = levelAfter(record);
       assertValidKindLevel(nextKind, nextLevel);
@@ -27400,7 +27429,7 @@ async function updateVaultMemoryOp(ctx, id, opts) {
         replayedObservation = opts.observationSourceIds.every((id2) => observedSources.includes(id2));
       }
       await record.update((r) => {
-        r._setRaw("content", encryptedContent);
+        if (encryptedContent !== void 0) r._setRaw("content", encryptedContent);
         if (opts.level !== void 0) {
           r._setRaw("level", nextLevel);
           r._setRaw("scope", scopeForLevel(nextLevel));
@@ -28167,7 +28196,7 @@ function classifyDecay(m, now, policy) {
   if (m.source === "manual" || m.source === SOURCE_PHOTO) return "keep";
   if (isTimeSensitiveType(m.factType) && m.eventTimeEnd !== null) {
     if (m.eventTimeEnd < now - resolved.pastEventGraceMs) return "archive";
-    if (m.eventTimeEnd >= now) return "keep";
+    return "keep";
   }
   if (now - lastActivityAt(m) > ttlForType(m.factType, resolved)) return "archive";
   return "keep";
@@ -31368,7 +31397,6 @@ async function retainWithPersistence(content, ctx, options = {}) {
           const factTypeUpdate = pickFactTypeUpdate(existing, options.factType);
           const resurrect = resurrectFields(existing);
           const updated = await ctx.persistence.update(targetId, {
-            content: existing.content,
             freeFormOnly: true,
             proofCountIncrement: 1,
             observationSourceIds: options.sourceChunkIds,
@@ -31572,7 +31600,7 @@ async function tryConsolidate(trimmed, ctx, options, prepared) {
     content: m.content,
     similarity: m.similarity
   }));
-  const { consolidateMemory: doConsolidate } = await import("./consolidate-B6OSCZU4.mjs");
+  const { consolidateMemory: doConsolidate } = await import("./consolidate-PYED62LW.mjs");
   const decision = await doConsolidate(trimmed, candidates, consolidateOptions);
   if (decision.action === "create") return decision.fallbackReason ? null : { create: true };
   if (decision.action === "supersede" && decision.content) {
@@ -31607,7 +31635,6 @@ async function tryConsolidate(trimmed, ctx, options, prepared) {
     const factTypeUpdate = pickFactTypeUpdate(existing, options.factType);
     const resurrect = resurrectFields(existing);
     const updated = await ctx.persistence.update(decision.targetId, {
-      content: existing.content,
       freeFormOnly: true,
       proofCountIncrement: 1,
       observationSourceIds: options.sourceChunkIds,
@@ -31635,6 +31662,10 @@ async function tryConsolidate(trimmed, ctx, options, prepared) {
     };
   }
   if (decision.action === "update" && decision.targetId && decision.content) {
+    const expectedContent = candidates.find(
+      (candidate) => candidate.id === decision.targetId
+    )?.content;
+    if (expectedContent === void 0) return null;
     const existing = await ctx.persistence.get(decision.targetId);
     if (!existing || existing.supersededBy) {
       return abandonToRace(
@@ -31642,6 +31673,9 @@ async function tryConsolidate(trimmed, ctx, options, prepared) {
         `update: target ${decision.targetId} ${existing ? "superseded" : "deleted"} before the write`
       );
     }
+    if (existing.content !== expectedContent) {
+      return abandonToRace(options, `update: target ${decision.targetId} edited before the write`);
+    }
     const mergedSourceIds = unionStrings(
       existing.sourceChunkIds ?? [],
       options.sourceChunkIds ?? []
@@ -31654,6 +31688,7 @@ async function tryConsolidate(trimmed, ctx, options, prepared) {
     const resurrect = resurrectFields(existing);
     const updated = await ctx.persistence.update(decision.targetId, {
       content: decision.content,
+      expectedContent,
       freeFormOnly: true,
       proofCountIncrement: 1,
       observationSourceIds: options.sourceChunkIds,
@@ -31666,10 +31701,10 @@ async function tryConsolidate(trimmed, ctx, options, prepared) {
       ...factTypeUpdate !== void 0 && { factType: factTypeUpdate }
     });
     if (!updated) {
-      await assertMergeTargetGoneOrThrow(ctx, decision.targetId);
+      await assertMergeTargetGoneOrThrow(ctx, decision.targetId, expectedContent);
       return abandonToRace(
         options,
-        `update: target ${decision.targetId} deleted mid-write (consolidated rewrite lost)`
+        `update: target ${decision.targetId} changed mid-write (consolidated rewrite lost)`
       );
     }
     cacheRowVector(
@@ -31696,9 +31731,9 @@ async function tryConsolidate(trimmed, ctx, options, prepared) {
   );
   return null;
 }
-async function assertMergeTargetGoneOrThrow(ctx, targetId) {
+async function assertMergeTargetGoneOrThrow(ctx, targetId, expectedContent) {
   const stillExists = await (ctx.persistence.getFresh ? ctx.persistence.getFresh(targetId) : ctx.persistence.get(targetId));
-  if (stillExists && (stillExists.kind === null || stillExists.kind === void 0)) {
+  if (stillExists && (stillExists.kind === null || stillExists.kind === void 0) && (expectedContent === void 0 || stillExists.content === expectedContent)) {
     throw new RetainError(
       "merge-not-persisted",
       `retain: merge into memory ${targetId} failed to persist`
@@ -37270,6 +37305,7 @@ async function getPdfjs() {
   return pdfjsModule;
 }
 async function withPdfDocument(pdfDataUrl, fn) {
+  assertFileUrlAllowed(pdfDataUrl);
   const pdfjs = await getPdfjs();
   const loadingTask = pdfjs.getDocument(pdfDataUrl);
   let pdf;
@@ -38058,6 +38094,7 @@ async function preprocessFiles(files, options = {}) {
         skip("no_data");
         continue;
       }
+      assertFileUrlAllowed(file.url);
       const fileWithData = {
         ...file,
         dataUrl: file.url

package/dist/tools/selection/index.cjs

@@ -643,7 +643,7 @@ var mergeHeaders = (...headers) => {
     if (!header || typeof header !== "object") {
       continue;
     }
-    const iterator = header instanceof Headers ? headersEntries(header) : Object.entries(header);
+    const iterator = Array.isArray(header) || header instanceof Headers ? headersEntries(new Headers(header)) : Object.entries(header);
     for (const [key, value] of iterator) {
       if (value === null) {
         mergedHeaders.delete(key);
@@ -919,13 +919,25 @@ var createClient = (config = {}) => {
 init_clientConfig();
 var client = createClient(createClientConfig(createConfig()));
 
+// src/clientHeaders.ts
+function normalizeHeaders(headers) {
+  if (headers instanceof Headers || Array.isArray(headers)) {
+    const normalized = /* @__PURE__ */ Object.create(null);
+    new Headers(headers).forEach((value, name) => {
+      normalized[name] = value;
+    });
+    return normalized;
+  }
+  return headers;
+}
+
 // src/client/sdk.gen.ts
 var postApiV1Embeddings = (options) => (options.client ?? client).post({
   url: "/api/v1/embeddings",
   ...options,
   headers: {
     "Content-Type": "application/json",
-    ...options.headers
+    ...normalizeHeaders(options.headers)
   }
 });
 

package/dist/tools/selection/index.mjs

@@ -525,7 +525,7 @@ var mergeHeaders = (...headers) => {
     if (!header || typeof header !== "object") {
       continue;
     }
-    const iterator = header instanceof Headers ? headersEntries(header) : Object.entries(header);
+    const iterator = Array.isArray(header) || header instanceof Headers ? headersEntries(new Headers(header)) : Object.entries(header);
     for (const [key, value] of iterator) {
       if (value === null) {
         mergedHeaders.delete(key);
@@ -800,13 +800,25 @@ var createClient = (config = {}) => {
 // src/client/client.gen.ts
 var client = createClient(createClientConfig(createConfig()));
 
+// src/clientHeaders.ts
+function normalizeHeaders(headers) {
+  if (headers instanceof Headers || Array.isArray(headers)) {
+    const normalized = /* @__PURE__ */ Object.create(null);
+    new Headers(headers).forEach((value, name) => {
+      normalized[name] = value;
+    });
+    return normalized;
+  }
+  return headers;
+}
+
 // src/client/sdk.gen.ts
 var postApiV1Embeddings = (options) => (options.client ?? client).post({
   url: "/api/v1/embeddings",
   ...options,
   headers: {
     "Content-Type": "application/json",
-    ...options.headers
+    ...normalizeHeaders(options.headers)
   }
 });
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@anuma/sdk",
-  "version": "9.1.5",
+  "version": "9.1.7",
   "description": "",
   "main": "./dist/index.cjs",
   "module": "./dist/index.mjs",