jennah-sdk-ts 0.67.0 → 0.68.0

package/dist/gen/jennah/agent/v1/agent_pb.d.ts

@@ -71,9 +71,9 @@ export declare const AgentInstanceSchema: GenMessage<AgentInstance>;
  * the per-query scan budget are measured against, reported so a caller can see it
  * before either limit refuses them.
  *
- * It counts vector chunk ROWS, including chunks retired by supersession: a retired
- * chunk still occupies a row and is still read by a search that travels back to
- * it, so it costs what a current chunk costs. It can therefore exceed the number
+ * It counts every STORED vector chunk, including chunks retired by supersession:
+ * a retired chunk is still stored and is still read by a search that travels back
+ * to it, so it costs what a current chunk costs. It can therefore exceed the number
  * of chunks an ordinary query returns. It may briefly lag a commit that just
  * landed.
  *
@@ -250,12 +250,12 @@ export declare const DeleteAgentRequestSchema: GenMessage<DeleteAgentRequest>;
  * Response message for the AgentService.DeleteAgent rpc.
  *
  * The deletion receipt: the instant the erasure committed. It deliberately does
- * NOT enumerate what was removed. The cascade prunes every table interleaved
- * under AgentInstances, including ones added after this message was written, so
- * an enumeration would have to be widened by every change that adds a table and
- * would report an internal row shape the caller cannot verify against anything.
- * What the receipt attests to is that the workspace and everything beneath it
- * were erased in one transaction, at one instant.
+ * NOT enumerate what was removed. Everything stored beneath the workspace is
+ * erased with it, including kinds of data added after this message was written,
+ * so an enumeration would have to be widened every time a new kind is added and
+ * would report counts the caller cannot verify against anything. What the
+ * receipt attests to is that the workspace and everything beneath it were erased
+ * in one transaction, at one instant.
  *
  * @generated from message jennahapi.agent.v1.DeleteAgentResponse
  */
@@ -283,8 +283,7 @@ export declare enum AgentStatus {
      */
     UNSPECIFIED = 0,
     /**
-     * Ready for use: the region's data-plane instance is provisioned and the
-     * AgentInstances row exists in the data plane.
+     * Ready for use: the workspace exists in its home region.
      *
      * @generated from enum value: AGENT_STATUS_ACTIVE = 1;
      */
@@ -298,8 +297,8 @@ export declare enum AgentStatus {
      */
     COMPLETED = 3,
     /**
-     * Provisioning is still in flight (the region's data-plane instance is being
-     * created). No data-plane row exists yet; poll GetAgent until ACTIVE.
+     * Provisioning is still in flight: the home region is being prepared and the
+     * workspace cannot hold memory yet. Poll GetAgent until ACTIVE.
      *
      * @generated from enum value: AGENT_STATUS_PROVISIONING = 4;
      */
@@ -324,12 +323,10 @@ export declare const AgentStatusSchema: GenEnum<AgentStatus>;
 export declare const AgentService: GenService<{
     /**
      * Creates a new agent workspace under the caller's enterprise. The home region
-     * is resolved from the optional `region` field (a Jennah region identifier
-     * validated against the configured allowlist) or the platform default region;
-     * the region's data-plane instance is provisioned on first use (its tables are
-     * created once per database, and tenancy is row-level: the AgentInstances row
-     * is keyed by EnterpriseId). The EnterpriseId is taken from the token, never
-     * the body.
+     * is resolved from the optional `region` field (a Jennah region identifier, one
+     * of those ListLocations reports) or the platform default region, and the
+     * region is prepared for the enterprise on first use. The enterprise is taken
+     * from the token, never the body.
      *
      * Returns the workspace synchronously. When provisioning is still in flight
      * the returned AgentInstance carries status AGENT_STATUS_PROVISIONING; poll

package/dist/gen/jennah/agent/v1/agent_pb.js

@@ -70,8 +70,7 @@ export var AgentStatus;
      */
     AgentStatus[AgentStatus["UNSPECIFIED"] = 0] = "UNSPECIFIED";
     /**
-     * Ready for use: the region's data-plane instance is provisioned and the
-     * AgentInstances row exists in the data plane.
+     * Ready for use: the workspace exists in its home region.
      *
      * @generated from enum value: AGENT_STATUS_ACTIVE = 1;
      */
@@ -85,8 +84,8 @@ export var AgentStatus;
      */
     AgentStatus[AgentStatus["COMPLETED"] = 3] = "COMPLETED";
     /**
-     * Provisioning is still in flight (the region's data-plane instance is being
-     * created). No data-plane row exists yet; poll GetAgent until ACTIVE.
+     * Provisioning is still in flight: the home region is being prepared and the
+     * workspace cannot hold memory yet. Poll GetAgent until ACTIVE.
      *
      * @generated from enum value: AGENT_STATUS_PROVISIONING = 4;
      */

package/dist/gen/jennah/agent/v1/memory_pb.d.ts

@@ -34,7 +34,7 @@ export type CommitMemoryRequest = Message<"jennahapi.agent.v1.CommitMemoryReques
      */
     log?: ExecutionLogStep | undefined;
     /**
-     * Vector section: chunks to upsert (write-or-replace) within the agent slice.
+     * Vector section: chunks to upsert (write-or-replace) within the scope.
      * Empty to commit no vectors.
      *
      * @generated from field: repeated jennahapi.agent.v1.VectorChunk vectors = 3;
@@ -59,10 +59,10 @@ export type CommitMemoryRequest = Message<"jennahapi.agent.v1.CommitMemoryReques
      * Every section of the commit is applied to this ONE scope in one transaction.
      *
      * A commit never writes more than one scope, and that holds even when two
-     * scopes happen to share a data-plane database. A commit spanning scopes is
-     * impossible across regions, so permitting it for co-resident scopes alone
-     * would make the atomicity a caller can rely on depend on deployment topology
-     * rather than on the contract. Naming a second scope is INVALID_ARGUMENT.
+     * scopes share a home region. A commit spanning scopes is impossible across
+     * regions, so permitting it for scopes in the same region alone would make the
+     * atomicity a caller can rely on depend on where scopes happen to live rather
+     * than on the contract. Naming a second scope is INVALID_ARGUMENT.
      *
      * @generated from field: string target_scope = 6;
      */
@@ -116,7 +116,7 @@ export declare const CommitMemoryRequestSchema: GenMessage<CommitMemoryRequest>;
  */
 export type ExecutionLogStep = Message<"jennahapi.agent.v1.ExecutionLogStep"> & {
     /**
-     * caller-chosen; unique within the agent slice
+     * caller-chosen; unique within the scope
      *
      * @generated from field: string step_id = 1;
      */
@@ -186,7 +186,7 @@ export declare const ExecutionLogStepSchema: GenMessage<ExecutionLogStep>;
  */
 export type VectorChunk = Message<"jennahapi.agent.v1.VectorChunk"> & {
     /**
-     * caller-chosen; unique within the agent slice
+     * caller-chosen; unique within the scope
      *
      * @generated from field: string chunk_id = 1;
      */
@@ -263,7 +263,7 @@ export type VectorChunk = Message<"jennahapi.agent.v1.VectorChunk"> & {
 export declare const VectorChunkSchema: GenMessage<VectorChunk>;
 /**
  * Graph-memory writes for one commit. Edges may only connect nodes within the
- * same (EnterpriseId, AgentInstanceId) slice. Edges carry an optional bi-temporal
+ * same scope. Edges carry an optional bi-temporal
  * validity window (see GraphEdge.valid_at/invalid_at); a plain write with neither
  * field set records an always-current fact. Replacing a fact while preserving
  * history is the caller-driven supersession operation (CommitMemoryRequest's
@@ -319,7 +319,7 @@ export type SupersessionWrite = Message<"jennahapi.agent.v1.SupersessionWrite">
 export declare const SupersessionWriteSchema: GenMessage<SupersessionWrite>;
 /**
  * One edge supersession: close `prior_edge_id`'s valid-time window at the
- * replacement's valid_at, and insert `new_edge` in the same slice. The prior edge
+ * replacement's valid_at, and insert `new_edge` in the same scope. The prior edge
  * stays stored and queryable as history, with its own transaction-time start
  * preserved.
  *
@@ -333,14 +333,14 @@ export declare const SupersessionWriteSchema: GenMessage<SupersessionWrite>;
  */
 export type EdgeSupersession = Message<"jennahapi.agent.v1.EdgeSupersession"> & {
     /**
-     * The currently-held edge to close. Resolved within the caller's slice; an
-     * unknown id is NotFound (never a cross-slice touch).
+     * The currently-held edge to close. Resolved within the caller's scope; an
+     * unknown id is NotFound (never a touch outside the scope).
      *
      * @generated from field: string prior_edge_id = 1;
      */
     priorEdgeId: string;
     /**
-     * The replacement fact, INSERTED in the same slice. new_edge.valid_at is
+     * The replacement fact, INSERTED in the same scope. new_edge.valid_at is
      * REQUIRED: it is the supersession boundary (the prior edge's invalid_at and the
      * new edge's valid_at) and must be a concrete, non-future timestamp.
      * new_edge.edge_id must be set and differ from prior_edge_id; because the
@@ -360,7 +360,7 @@ export type EdgeSupersession = Message<"jennahapi.agent.v1.EdgeSupersession"> &
 export declare const EdgeSupersessionSchema: GenMessage<EdgeSupersession>;
 /**
  * One chunk supersession: close `prior_chunk_id`'s valid-time window at the
- * replacement's valid_at, and insert `new_chunk` in the same slice. The prior
+ * replacement's valid_at, and insert `new_chunk` in the same scope. The prior
  * chunk stays stored with its CONTENT INTACT and readable as history: closing a
  * window writes the validity end and nothing else.
  *
@@ -371,14 +371,14 @@ export declare const EdgeSupersessionSchema: GenMessage<EdgeSupersession>;
  */
 export type ChunkSupersession = Message<"jennahapi.agent.v1.ChunkSupersession"> & {
     /**
-     * The currently-held chunk to close. Resolved within the caller's slice; an
-     * unknown id is NotFound (never a cross-slice touch).
+     * The currently-held chunk to close. Resolved within the caller's scope; an
+     * unknown id is NotFound (never a touch outside the scope).
      *
      * @generated from field: string prior_chunk_id = 1;
      */
     priorChunkId: string;
     /**
-     * The replacement passage, INSERTED in the same slice. new_chunk.valid_at is
+     * The replacement passage, INSERTED in the same scope. new_chunk.valid_at is
      * REQUIRED: it is the supersession boundary (the prior chunk's invalid_at and
      * the new chunk's valid_at) and must be a concrete, non-future timestamp.
      * new_chunk.chunk_id must be set and differ from prior_chunk_id; because the
@@ -406,7 +406,7 @@ export declare const ChunkSupersessionSchema: GenMessage<ChunkSupersession>;
  */
 export type GraphNode = Message<"jennahapi.agent.v1.GraphNode"> & {
     /**
-     * caller-chosen; unique within the agent slice
+     * caller-chosen; unique within the scope
      *
      * @generated from field: string node_id = 1;
      */
@@ -493,19 +493,19 @@ export declare const GraphNodeSchema: GenMessage<GraphNode>;
  */
 export type GraphEdge = Message<"jennahapi.agent.v1.GraphEdge"> & {
     /**
-     * caller-chosen; unique within the agent slice
+     * caller-chosen; unique within the scope
      *
      * @generated from field: string edge_id = 1;
      */
     edgeId: string;
     /**
-     * must reference a GraphNode in the same slice
+     * must reference a GraphNode in the same scope
      *
      * @generated from field: string source_node_id = 2;
      */
     sourceNodeId: string;
     /**
-     * must reference a GraphNode in the same slice
+     * must reference a GraphNode in the same scope
      *
      * @generated from field: string target_node_id = 3;
      */
@@ -728,18 +728,17 @@ export type QueryMemoryRequest = Message<"jennahapi.agent.v1.QueryMemoryRequest"
      *     with PERMISSION_DENIED. It is never dropped from the set, because a
      *     silently narrowed set returns a partial answer indistinguishable from a
      *     complete one.
-     *   - Every named scope must resolve to the SAME data-plane database. One
-     *     naming a scope homed in another region is refused with an error
-     *     identifying the offending scope and the mismatch, never satisfied by
-     *     reading each database separately: two databases cannot share a read
-     *     snapshot, so combining their results would present two instants as one
-     *     consistent answer. A query naming exactly ONE scope is servable from
+     *   - Every named scope must have the SAME home region. A query naming a
+     *     scope homed in another region is refused with an error identifying the
+     *     offending scope and the mismatch, never satisfied by reading each region
+     *     separately: two regions cannot share a read snapshot, so combining their
+     *     results would present two instants as one consistent answer. A query naming exactly ONE scope is servable from
      *     anywhere, because routing resolves that scope to its own region.
      *   - The number of scopes in one query is bounded by a server maximum;
      *     exceeding it is refused with an error naming the limit rather than
      *     truncated to the first N. Semantic search is exact KNN, affordable
-     *     because each scope is a small contiguous key range, and a multi-scope
-     *     query scans one such range per scope.
+     *     because each scope is searched on its own, and a multi-scope query
+     *     searches each named scope once.
      *
      * Graph traversal stays INSIDE a scope: an edge connects nodes within one
      * scope, so a multi-scope graph section returns one subgraph per requested
@@ -770,16 +769,16 @@ export type QueryMemoryRequest = Message<"jennahapi.agent.v1.QueryMemoryRequest"
 export declare const QueryMemoryRequestSchema: GenMessage<QueryMemoryRequest>;
 /**
  * Semantic-section query. Exactly one of `embedding` or `query_text` MUST be
- * supplied; when `query_text` is given the gateway embeds it server-side
+ * supplied; when `query_text` is given the platform embeds it server-side
  * (task_type RETRIEVAL_QUERY). Results are ranked by ascending cosine distance
- * and clamped to the caller's agent slice (the clamp never silently truncates
+ * and drawn only from the caller's own scope (which never silently truncates
  * below `limit`).
  *
  * @generated from message jennahapi.agent.v1.SemanticQuery
  */
 export type SemanticQuery = Message<"jennahapi.agent.v1.SemanticQuery"> & {
     /**
-     * precomputed query embedding; width must match the db
+     * precomputed query embedding; width must match the scope's embedding width
      *
      * @generated from field: repeated float embedding = 1;
      */
@@ -823,8 +822,7 @@ export type SemanticQuery = Message<"jennahapi.agent.v1.SemanticQuery"> & {
      *
      * A filtered section MAY therefore return fewer than `limit` results when fewer
      * chunks match. That is the caller's own narrowing and is reproducible from the
-     * filters; it is NOT the silent truncation the tenant/agent clamp guarantees
-     * against.
+     * filters; it is NOT a silent truncation, which the platform never applies.
      *
      * @generated from field: repeated jennahapi.agent.v1.MetadataFilter filters = 4;
      */
@@ -849,11 +847,10 @@ export type SemanticQuery = Message<"jennahapi.agent.v1.SemanticQuery"> & {
      * agent held at that instant, consistent with one another.
      *
      * This is NOT QueryMemoryRequest.as_of. That field moves the physical read
-     * snapshot and is bounded by the backend's version-retention window (about an
-     * hour); valid-time is a bound predicate over stored columns evaluated at the
-     * current snapshot, so it reaches arbitrarily far back. Both bounds bind as query
-     * parameters and are injected alongside the tenant/agent clamp, which cannot be
-     * omitted or widened.
+     * snapshot and may be at most about an hour in the past; valid-time is a bound
+     * predicate over stored columns evaluated at the current snapshot, so it
+     * reaches arbitrarily far back. Both bounds only narrow the read; they never
+     * reach outside the caller's own scope.
      *
      * @generated from field: google.protobuf.Timestamp as_of_valid = 5;
      */
@@ -878,7 +875,7 @@ export type SemanticQuery = Message<"jennahapi.agent.v1.SemanticQuery"> & {
      * Hybrid also requires the workspace's enterprise to have the lexical channel
      * enabled and its stored chunks fully indexed. Where that is not yet true the
      * request is refused rather than answered from a partial index, because a lexical
-     * channel ranking over part of a slice returns fewer results than the slice holds
+     * channel ranking over part of a scope returns fewer results than the scope holds
      * without saying so.
      *
      * @generated from field: jennahapi.agent.v1.RetrievalMode retrieval_mode = 7;
@@ -902,7 +899,7 @@ export type SemanticQuery = Message<"jennahapi.agent.v1.SemanticQuery"> & {
      * constant, not a caller knob, because its right value is a property of the
      * retrieval path rather than of any one request.
      *
-     * Reranking resolves within the workspace's own data-plane region, on the same
+     * Reranking resolves within the workspace's own home region, on the same
      * rule every other external inference follows. A region with no configured
      * reranking endpoint refuses the request rather than sending the workspace's
      * content elsewhere, and a request that opts in where reranking cannot be
@@ -1003,7 +1000,7 @@ export declare const MetadataFilter_OperatorSchema: GenEnum<MetadataFilter_Opera
 /**
  * Graph-section query: a STRUCTURED traversal over the agent's knowledge graph.
  * The platform ensures graph queries remain within the caller's authorized
- * (EnterpriseId, AgentInstanceId) slice.
+ * scope.
  *
  * A query is an anchor node set plus zero or more single-hop traversals. Each
  * hop is one `GraphStep`; multi-hop traversal is expressed as successive steps.
@@ -1038,11 +1035,10 @@ export type GraphQuery = Message<"jennahapi.agent.v1.GraphQuery"> & {
      * as_of_tx additionally constrains transaction-time ("as known at as_of_tx"),
      * and is only meaningful together with as_of_valid.
      *
-     * Graph valid-time is evaluated as a bound predicate over the validity columns
-     * at the current snapshot, never by moving
-     * the physical read timestamp. Both bounds bind as query parameters; the clamp
-     * is injected onto every hop exactly like the tenant/agent clamp and cannot be
-     * omitted or widened.
+     * Graph valid-time is evaluated as a predicate over each edge's validity window
+     * at the current snapshot, never by moving the physical read timestamp. It
+     * applies to every hop, only narrows the traversal, and never reaches outside
+     * the caller's own scope.
      *
      * @generated from field: google.protobuf.Timestamp as_of_valid = 4;
      */
@@ -1060,8 +1056,8 @@ export declare const GraphQuerySchema: GenMessage<GraphQuery>;
 /**
  * A node-pattern constraint. `label` optionally filters the node's semantic
  * `Label` property (e.g. "Person"); `filters` are optional equality predicates.
- * The gateway always adds the (EnterpriseId, AgentInstanceId) clamp to the
- * generated element: it is NOT expressible here and cannot be overridden.
+ * The platform always confines the match to the caller's own scope: that is NOT
+ * expressible here and cannot be overridden.
  *
  * @generated from message jennahapi.agent.v1.GraphNodeMatch
  */
@@ -1084,11 +1080,11 @@ export type GraphNodeMatch = Message<"jennahapi.agent.v1.GraphNodeMatch"> & {
      *
      * THIS IS A SEPARATE LIST FROM `filters`, and it stays separate deliberately.
      * `filters` names FIRST-CLASS COLUMNS and is allowlisted (`NodeId`, `Label`,
-     * `NodeType`) so that a caller cannot filter on a clamp column. If the two lists
-     * merged, resolving a key would mean asking "is this the name of a column?",
-     * which would hand a caller-chosen string the power to pick which branch it
-     * takes and make a metadata key named `AgentInstanceId` a question rather than
-     * an answer. Two lists means a key's meaning is fixed by which list it is in.
+     * `NodeType`) so that a caller cannot filter on any column the platform uses
+     * to keep scopes apart. If the two lists merged, resolving a key would mean
+     * asking "is this the name of a column?", which would hand a caller-chosen
+     * string the power to pick which branch it takes and make a metadata key that
+     * shares a column's name a question rather than an answer. Two lists means a key's meaning is fixed by which list it is in.
      *
      * The rule for choosing: filtering a stored column (`NodeId`, `Label`,
      * `NodeType`) is `filters`; filtering a tag you wrote in GraphNode.metadata is
@@ -1158,8 +1154,8 @@ export declare const GraphStepSchema: GenMessage<GraphStep>;
  * classes its current vocabulary no longer declares, and those nodes stay
  * reachable.
  *
- * The allowlist is what keeps a caller off the clamp columns, so it is narrow on
- * purpose and does not fall back to anything. In particular it does NOT reach into
+ * The allowlist is what keeps a caller off the columns that keep scopes apart, so
+ * it is narrow on purpose and does not fall back to anything. In particular it does NOT reach into
  * `properties`: that field is a payload and is not filterable at all, because
  * filtering a JSON column needs a caller-supplied key inside a JSON path and that
  * is an injection surface the platform does not open. To filter on something a
@@ -1213,7 +1209,7 @@ export type LogQuery = Message<"jennahapi.agent.v1.LogQuery"> & {
      *
      * A filtered section returning fewer steps than `limit` means fewer steps
      * matched. That is the caller's own narrowing and is reproducible from the
-     * filter; it is not the truncation the tenant clamp forbids.
+     * filter; it is not a silent truncation, which the platform never applies.
      *
      * @generated from field: repeated jennahapi.agent.v1.MetadataFilter metadata = 3;
      */
@@ -1326,7 +1322,7 @@ export type SemanticMatch = Message<"jennahapi.agent.v1.SemanticMatch"> & {
      */
     channels: RetrievalChannel[];
     /**
-     * Spanner's whole-word relevance score, set only when `channels` includes
+     * The lexical (whole-word) relevance score, set only when `channels` includes
      * RETRIEVAL_CHANNEL_LEXICAL and 0 otherwise. Higher is more relevant, OPPOSITE to
      * `distance`.
      *
@@ -1406,7 +1402,7 @@ export type SemanticMatch = Message<"jennahapi.agent.v1.SemanticMatch"> & {
      *
      * It is reported so a layer above the platform can compare WHEN a recalled
      * passage became valid against when a new statement was made, through the
-     * ordinary clamped query path rather than a privileged read. Memory formation is
+     * ordinary scope-confined query path rather than a privileged read. Memory formation is
      * the first such caller: it is how a revision knows it is not retiring something
      * newer than the conversation it came from.
      *
@@ -1439,7 +1435,7 @@ export type SemanticMatch = Message<"jennahapi.agent.v1.SemanticMatch"> & {
 export declare const SemanticMatchSchema: GenMessage<SemanticMatch>;
 /**
  * Graph traversal result rows. Each row carries the matched elements' key
- * fields (node ids and labels, and edge relationship types) keyed by gateway-
+ * fields (node ids and labels, and edge relationship types) keyed by platform-
  * assigned binding names, so the shape is carried as a structured value rather
  * than a fixed schema.
  *
@@ -1447,7 +1443,7 @@ export declare const SemanticMatchSchema: GenMessage<SemanticMatch>;
  * rather than as a field beside it: the row has no fixed schema to add a field
  * to, and a parallel array would have to stay index-aligned with one. The key
  * cannot collide with a caller's binding, because binding names are assigned by
- * the gateway and never taken from the request. Every row carries it, including
+ * the platform and never taken from the request. Every row carries it, including
  * for a single-scope query, and no returned path crosses scopes, so one row
  * names exactly one scope.
  *
@@ -1508,7 +1504,7 @@ export declare const FusedResultSchema: GenMessage<FusedResult>;
  *
  * Any subset of the three section fields may be present; at least one SHOULD
  * be. All present sections are enumerated at one read snapshot within the
- * caller's (EnterpriseId, AgentInstanceId) slice. There is no query anchor:
+ * caller's own scope. There is no query anchor:
  * unlike QueryMemory this lists stored rows for debugging, so a section is
  * requested simply by being present, bounded by its limit.
  *
@@ -1718,8 +1714,8 @@ export type InspectMemoryResponse = Message<"jennahapi.agent.v1.InspectMemoryRes
      * recent steps rather than an enumerable listing and has nothing to continue.
      *
      * CONSISTENCY: pages are independently snapshotted, so a commit landing mid-walk
-     * may appear. Set `as_of` on every request of the walk for a stable view,
-     * bounded by the backend's version-retention window (about an hour).
+     * may appear. Set `as_of` on every request of the walk for a stable view; it
+     * may be at most about an hour in the past.
      *
      * @generated from field: string next_chunk_token = 5;
      */
@@ -1898,14 +1894,14 @@ export type SupersedeEdgeRequest = Message<"jennahapi.agent.v1.SupersedeEdgeRequ
      */
     agentInstanceId: string;
     /**
-     * The currently-held edge to close. Resolved within the caller's slice; an
-     * unknown id is NotFound (never a cross-slice touch).
+     * The currently-held edge to close. Resolved within the caller's scope; an
+     * unknown id is NotFound (never a touch outside the scope).
      *
      * @generated from field: string prior_edge_id = 2;
      */
     priorEdgeId: string;
     /**
-     * The replacement fact, inserted in the same slice. new_edge.valid_at is
+     * The replacement fact, inserted in the same scope. new_edge.valid_at is
      * REQUIRED: it is the supersession boundary (the prior edge's invalid_at and
      * the new edge's valid_at) and must be a concrete timestamp. new_edge.edge_id
      * must be set and differ from prior_edge_id (the replacement is inserted, not
@@ -1971,8 +1967,8 @@ export type SupersedeChunkRequest = Message<"jennahapi.agent.v1.SupersedeChunkRe
      */
     agentInstanceId: string;
     /**
-     * The currently-held chunk to close. Resolved within the caller's slice; an
-     * unknown id is NotFound (never a cross-slice touch). Its content is left
+     * The currently-held chunk to close. Resolved within the caller's scope; an
+     * unknown id is NotFound (never a touch outside the scope). Its content is left
      * intact: closing a window writes the validity end and nothing else, so the
      * superseded passage stays readable as history.
      *
@@ -1980,7 +1976,7 @@ export type SupersedeChunkRequest = Message<"jennahapi.agent.v1.SupersedeChunkRe
      */
     priorChunkId: string;
     /**
-     * The replacement passage, inserted in the same slice. new_chunk.valid_at is
+     * The replacement passage, inserted in the same scope. new_chunk.valid_at is
      * REQUIRED: it is the supersession boundary (the prior chunk's invalid_at and the
      * new chunk's valid_at) and must be a concrete timestamp. new_chunk.chunk_id must
      * be set and differ from prior_chunk_id (the replacement is inserted, not
@@ -2113,10 +2109,10 @@ export declare const ConversationTurnSchema: GenMessage<ConversationTurn>;
 export type FormMemoryRequest = Message<"jennahapi.agent.v1.FormMemoryRequest"> & {
     /**
      * Route path parameter, never read from the body: the agent workspace this
-     * formation reads and writes. Every stage is clamped to the caller's
-     * (EnterpriseId, this scope) slice: extraction has no field that could widen
-     * it, and recall and commit take the same clamped paths CommitMemory and
-     * QueryMemory take.
+     * formation reads and writes. Every stage is confined to this scope of the
+     * caller's enterprise: extraction has no field that could widen it, and recall
+     * and commit take the same scope-confined paths CommitMemory and QueryMemory
+     * take.
      *
      * @generated from field: string scope_id = 1;
      */
@@ -2857,7 +2853,7 @@ export declare enum RetrievalMode {
      */
     UNSPECIFIED = 0,
     /**
-     * Rank by exact cosine distance over the caller's slice. The default, and what
+     * Rank by exact cosine distance over the caller's scope. The default, and what
      * the semantic section has always done.
      *
      * @generated from enum value: RETRIEVAL_MODE_VECTOR_ONLY = 1;
@@ -3075,7 +3071,8 @@ export declare const MemoryService: GenService<{
      * optional execution-log step, an optional set of vector chunks, an optional
      * set of graph writes, and an optional set of supersessions. The commit is
      * all-or-nothing: if any section fails (e.g. a vector whose width does not
-     * match the database, or a supersession naming a prior id that is not there),
+     * match the workspace's embedding width, or a supersession naming a prior id
+     * that is not there),
      * no section's rows are written. The commit is rejected, writing nothing, if
      * the target workspace does not exist under the caller's tenant. Returns a
      * receipt: the commit timestamp and per-memory-type row counts.
@@ -3094,8 +3091,7 @@ export declare const MemoryService: GenService<{
      * section. Returns one result section per requested section, plus a fused
      * result when `link` is set. An optional `as_of` timestamp is applied
      * uniformly to every section so all sections observe the same historical
-     * instant. Every section is clamped to the caller's (EnterpriseId,
-     * AgentInstanceId) slice.
+     * instant. Every section reads only the caller's own scope.
      *
      * @generated from rpc jennahapi.agent.v1.MemoryService.QueryMemory
      */
@@ -3110,7 +3106,7 @@ export declare const MemoryService: GenService<{
      * vectors are never returned), the graph nodes and edges, and the recent
      * execution-log steps. Unlike QueryMemory it takes no semantic query or graph
      * start pattern; each requested section is simply enumerated within the
-     * caller's (EnterpriseId, AgentInstanceId) slice, up to a per-section limit,
+     * caller's own scope, up to a per-section limit,
      * at ONE read snapshot so every section observes the same instant. This is a
      * read-only diagnostic surface, not a retrieval path.
      *
@@ -3125,9 +3121,8 @@ export declare const MemoryService: GenService<{
      * Replaces a currently-held graph fact WITHOUT destroying it (add-temporal-
      * graph). In one read-write transaction it closes the prior edge's valid-time
      * window (its invalid_at becomes the new edge's valid_at, its transaction-time
-     * start preserved) and inserts the replacement edge in the same
-     * (EnterpriseId, AgentInstanceId) slice with a fresh transaction-time start and
-     * an open window (unless new_edge.invalid_at is set). The prior edge stays
+     * start preserved) and inserts the replacement edge in the same scope with a
+     * fresh transaction-time start and an open window (unless new_edge.invalid_at is set). The prior edge stays
      * queryable as history via an as_of graph query. Supersession is caller-driven:
      * the platform never infers which facts conflict. new_edge.valid_at (the
      * supersession boundary) is REQUIRED and new_edge.edge_id must differ from
@@ -3153,8 +3148,7 @@ export declare const MemoryService: GenService<{
      * semantics on the same terms: in one read-write transaction it closes the prior
      * chunk's valid-time window (its invalid_at becomes the new chunk's valid_at, its
      * transaction-time start preserved) and inserts the replacement chunk in the same
-     * (EnterpriseId, AgentInstanceId) slice with a fresh transaction-time start and an
-     * open window. The prior chunk keeps its content and stays readable as history via
+     * scope with a fresh transaction-time start and an open window. The prior chunk keeps its content and stays readable as history via
      * an as_of_valid semantic query. Supersession is caller-driven: the platform never
      * infers which passages conflict, and performs no model-driven detection of it.
      * new_chunk.valid_at (the supersession boundary) is REQUIRED and new_chunk.chunk_id

package/dist/gen/jennah/agent/v1/memory_pb.js

@@ -382,7 +382,7 @@ export var RetrievalMode;
      */
     RetrievalMode[RetrievalMode["UNSPECIFIED"] = 0] = "UNSPECIFIED";
     /**
-     * Rank by exact cosine distance over the caller's slice. The default, and what
+     * Rank by exact cosine distance over the caller's scope. The default, and what
      * the semantic section has always done.
      *
      * @generated from enum value: RETRIEVAL_MODE_VECTOR_ONLY = 1;

package/dist/gen/jennah/agent/v1/scope_pb.d.ts

@@ -299,8 +299,8 @@ export declare const ScopeService: GenService<{
      * Creates a memory scope of an explicit kind under the caller's enterprise.
      * The home region is resolved exactly as it is for an agent workspace, from
      * the optional `region` field or the platform default, and is FIXED for the
-     * scope's life: a subject scope's memory lives in that region's data-plane
-     * database and is never replicated elsewhere, which is what makes a residency
+     * scope's life: a subject scope's memory is stored in that region and is never
+     * replicated elsewhere, which is what makes a residency
      * commitment about a subject hold irrespective of which agent reads it.
      *
      * The identifier space is shared across both kinds, so an id that already

package/dist/gen/jennah/auth/v1/auth_pb.d.ts

@@ -6,9 +6,8 @@ import type { Message } from "@bufbuild/protobuf";
  */
 export declare const file_jennah_auth_v1_auth: GenFile;
 /**
- * One of the caller's enterprise memberships (a row in the Memberships join
- * table), surfaced in Identity so a multi-enterprise user can pick which one to
- * switch into.
+ * One of the caller's enterprise memberships, surfaced in Identity so a
+ * multi-enterprise user can pick which one to switch into.
  *
  * @generated from message jennahapi.auth.v1.Membership
  */
@@ -1004,7 +1003,7 @@ export type Member = Message<"jennahapi.auth.v1.Member"> & {
      */
     role: Role;
     /**
-     * Memberships row creation time
+     * when the member joined the enterprise
      *
      * @generated from field: google.protobuf.Timestamp joined_at = 4;
      */
@@ -2065,7 +2064,7 @@ export declare enum ResponseMode {
 export declare const ResponseModeSchema: GenEnum<ResponseMode>;
 /**
  * A caller's role within an enterprise. Exactly one ROLE_ROOT per enterprise
- * (its creator/owner); resolved from the Memberships table, never carried in
+ * (its creator/owner); resolved from the current membership, never carried in
  * the access token (so role changes apply immediately).
  *
  * @generated from enum jennahapi.auth.v1.Role
@@ -2221,8 +2220,8 @@ export declare const AuthService: GenService<{
     };
     /**
      * Mints a new API key for the caller's active enterprise. External (gateway)
-     * RPC. Authenticated AND gated to ROLE_ROOT/ROLE_ADMIN, resolved live from the
-     * Memberships table (never trusted from a claim). The plaintext secret is
+     * RPC. Authenticated AND gated to ROLE_ROOT/ROLE_ADMIN, checked against the
+     * caller's current role (never trusted from a claim). The plaintext secret is
      * returned exactly once, in this response, and is NOT retrievable afterward,
      * only its sha256 hash is stored. The key resolves to a ROLE_MEMBER-equivalent
      * service principal scoped to the enterprise.
@@ -2266,8 +2265,8 @@ export declare const AuthService: GenService<{
     /**
      * Invites a person by email into the caller's active enterprise, granting
      * ROLE_ADMIN or ROLE_MEMBER (never ROLE_ROOT). External (gateway) RPC.
-     * Authenticated AND gated to ROLE_ROOT/ROLE_ADMIN (resolved live from the
-     * Memberships table). Membership is NOT granted by email match: this only
+     * Authenticated AND gated to ROLE_ROOT/ROLE_ADMIN (checked against the
+     * caller's current role). Membership is NOT granted by email match: this only
      * creates a pending invitation bound to a single-use token, returned exactly
      * once in the response for the inviter to share. The grant happens when the
      * invitee accepts (AcceptInvitation) while signed in. Rejects an email already
@@ -2350,7 +2349,7 @@ export declare const AuthService: GenService<{
     };
     /**
      * Removes a member from the caller's active enterprise, deleting their
-     * Memberships row and revoking their refresh sessions scoped to it (so no new
+     * membership and revoking their refresh sessions scoped to it (so no new
      * access token can be minted for it; an already-issued one lasts until it
      * expires). External (gateway) RPC. Authenticated AND gated to
      * ROLE_ROOT/ROLE_ADMIN (a member MAY remove themselves, which is a leave). The
@@ -2383,7 +2382,7 @@ export declare const AuthService: GenService<{
     /**
      * Updates mutable fields of the caller's active enterprise (currently just its
      * display name). External (gateway) RPC. Authenticated AND gated to
-     * ROLE_ROOT/ROLE_ADMIN (resolved live from the Memberships table). The target
+     * ROLE_ROOT/ROLE_ADMIN (checked against the caller's current role). The target
      * is always the caller's active enterprise (from the token), never a path/body
      * id, mirroring ListMembers/ChangeMemberRole.
      *

package/dist/gen/jennah/auth/v1/auth_pb.js

@@ -452,7 +452,7 @@ export var ResponseMode;
 export const ResponseModeSchema = /*@__PURE__*/ enumDesc(file_jennah_auth_v1_auth, 2);
 /**
  * A caller's role within an enterprise. Exactly one ROLE_ROOT per enterprise
- * (its creator/owner); resolved from the Memberships table, never carried in
+ * (its creator/owner); resolved from the current membership, never carried in
  * the access token (so role changes apply immediately).
  *
  * @generated from enum jennahapi.auth.v1.Role

package/dist/gen/jennah/billing/v1/billing_pb.d.ts

@@ -739,8 +739,9 @@ export declare const BillingService: GenService<{
      * Binds the subscription behind a single-use registration handle to the caller's
      * active enterprise and applies its resolved tier. External (gateway) RPC.
      * Authenticated AND gated to ROLE_ROOT/ROLE_ADMIN on the active enterprise,
-     * resolved live from the Memberships table. Also on the entitlement exempt
-     * allowlist, since this is the call that restores a blocked caller's access.
+     * checked against the caller's current role, so a role change applies at once.
+     * Also on the entitlement exempt allowlist, since this is the call that
+     * restores a blocked caller's access.
      *
      * The handle is a bearer capability with a deliberately small blast radius:
      * whoever presents it attaches that subscription to THEIR active enterprise.
@@ -779,7 +780,7 @@ export declare const BillingService: GenService<{
      * taken or returned.
      *
      * Only a signed-in user holding ROLE_ROOT or ROLE_ADMIN on the active
-     * enterprise can call it, resolved live from the Memberships table. It is not
+     * enterprise can call it, checked against the caller's current role. It is not
      * grantable by any permission, and an API key is refused before any role is
      * resolved, including a key created by an administrator, so an agent can never
      * raise its own spending limit.

package/dist/gen/jennah/datastore/v1/data_pb.d.ts

@@ -139,19 +139,19 @@ export declare const RowSchema: GenMessage<Row>;
 /**
  * One predicate over a column.
  *
- * The operator set is deliberately IDENTICAL to the memory plane's metadata
- * filter grammar. Predicates combine conjunctively: all must match.
+ * The operator set is deliberately IDENTICAL to agent memory's metadata filter
+ * grammar (MemoryService). Predicates combine conjunctively: all must match.
  *
  * ONE SEMANTIC DIFFERENCE, and it is deliberate. Metadata comparison is
  * LEXICOGRAPHIC, because a metadata value is an untyped string and the platform
  * refuses to guess a type for it. An application column HAS a declared type, so
  * comparison here is TYPED and natural: an INT64 column orders numerically
- * (10 > 9), a TIMESTAMP column chronologically. The metadata plane's
- * zero-pad-your-numbers advice does not apply and must not be carried over.
+ * (10 > 9), a TIMESTAMP column chronologically. The zero-pad-your-numbers advice
+ * for memory metadata filters does not apply and must not be carried over.
  *
  * A row whose column is NULL matches NO operator, including OPERATOR_EQUALS:
  * there is no value to compare or order against, so a NULL excludes. This
- * matches the metadata plane's absent-key rule.
+ * matches memory metadata filters, where an absent key matches nothing.
  *
  * @generated from message jennahapi.datastore.v1.Predicate
  */
@@ -319,18 +319,18 @@ export type RowOperation = Message<"jennahapi.datastore.v1.RowOperation"> & {
      * A SUPPLIED vector is stored exactly as given and the model is not invoked,
      * so a caller may use its own embedding model provided the width matches. The
      * platform can dimension-check a supplied vector but cannot verify which model
-     * produced it, as is already true of the memory plane.
+     * produced it, as is already true of agent memory.
      *
      * @generated from field: jennahapi.datastore.v1.Row row = 3;
      */
     row?: Row | undefined;
     /**
-     * Row selector for UPDATE and DELETE, combined conjunctively with the
-     * dataset clamp (which is injected and cannot be omitted or widened). Ignored
-     * for INSERT and UPSERT.
+     * Row selector for UPDATE and DELETE. It can only narrow within the dataset:
+     * the platform always confines the operation to this dataset, and no predicate
+     * can omit or widen that. Ignored for INSERT and UPSERT.
      *
      * An UPDATE or DELETE with no predicates affects every row of the table
-     * WITHIN THE DATASET SLICE. That is permitted and bounded, but it is rarely
+     * WITHIN THE DATASET. That is permitted and bounded, but it is rarely
      * what a caller means, so state the key explicitly unless a full-table
      * operation is intended.
      *
@@ -479,8 +479,8 @@ export type CommitDataRequest = Message<"jennahapi.datastore.v1.CommitDataReques
      * merely reported: if the model truncates any embedding the SERVER generated,
      * the commit is rejected and no row from any table in it is written.
      *
-     * Truncation policy belongs to the caller, exactly as it does on the memory
-     * plane, and the same reasoning applies: an audit-trail writer may prefer a
+     * Truncation policy belongs to the caller, exactly as it does for agent
+     * memory, and the same reasoning applies: an audit-trail writer may prefer a
      * degraded embedding over a lost commit, while a retrieval-critical writer
      * prefers to fail, split the content, and re-commit. Defaults to false, where
      * the receipt's `truncations` reports the same fact without refusing the
@@ -672,7 +672,7 @@ export type RelationalQuery = Message<"jennahapi.datastore.v1.RelationalQuery">
      */
     select: string[];
     /**
-     * Conjunctive predicates, combined with the injected dataset clamp.
+     * Conjunctive predicates. They narrow within the dataset and cannot widen it.
      *
      * @generated from field: repeated jennahapi.datastore.v1.Predicate where = 3;
      */
@@ -701,7 +701,7 @@ export type RelationalQuery = Message<"jennahapi.datastore.v1.RelationalQuery">
      * QueryDataResponse.next_page_token for the exhaustion contract. Opaque and
      * server-generated: a token the server cannot interpret is REJECTED with
      * INVALID_ARGUMENT rather than silently restarting, and a token can only
-     * narrow within the caller's slice, never widen it.
+     * narrow within the caller's dataset, never widen it.
      *
      * @generated from field: string page_token = 7;
      */
@@ -715,9 +715,9 @@ export declare const RelationalQuerySchema: GenMessage<RelationalQuery>;
 /**
  * Vector section: exact-KNN ranking over one vector column.
  *
- * Ranking is by EXACT cosine distance, not an approximate index. Each query is
- * already clamped to a dataset slice, which makes the scan small and an ANN
- * index pointless: the same conclusion the memory plane reached.
+ * Ranking is by EXACT cosine distance, not an approximate index. Each query
+ * searches one dataset only, which keeps the search small and makes an
+ * approximate index pointless: agent memory search is exact for the same reason.
  *
  * @generated from message jennahapi.datastore.v1.VectorQuery
  */
@@ -768,7 +768,7 @@ export type VectorQuery = Message<"jennahapi.datastore.v1.VectorQuery"> & {
      * the nearest `limit` rows AMONG those matching the predicates, not the
      * predicates applied to an unfiltered nearest-`limit` set, which would return
      * fewer rows (often zero) for reasons a caller could not predict. Same rule
-     * the memory plane applies to metadata filters.
+     * agent memory applies to metadata filters.
      *
      * @generated from field: repeated jennahapi.datastore.v1.Predicate where = 6;
      */
@@ -777,7 +777,7 @@ export type VectorQuery = Message<"jennahapi.datastore.v1.VectorQuery"> & {
      * Max matches to return, clamped to the tier's ceiling like the relational
      * section's. A filtered section MAY return fewer when fewer rows match; that
      * is the caller's own narrowing and is reproducible from the predicates, not
-     * the silent truncation the dataset clamp guarantees against.
+     * a silent truncation, which the platform never applies.
      *
      * @generated from field: int32 limit = 7;
      */
@@ -789,9 +789,9 @@ export type VectorQuery = Message<"jennahapi.datastore.v1.VectorQuery"> & {
  */
 export declare const VectorQuerySchema: GenMessage<VectorQuery>;
 /**
- * Read staleness for the whole query. Absent means a STRONG, externally
- * consistent read: the default, and the right one unless latency demands
- * otherwise.
+ * Read staleness for the whole query. Absent means a STRONG read, which sees
+ * every commit acknowledged before the query began: the default, and the right
+ * one unless latency demands otherwise.
  *
  * A staleness bound is applied UNIFORMLY to every section, so sections can never
  * observe different instants. Bounded staleness is what makes a multi-region
@@ -805,8 +805,9 @@ export type ReadStaleness = Message<"jennahapi.datastore.v1.ReadStaleness"> & {
      */
     mode: {
         /**
-         * Read at any timestamp at most this far in the past, letting the backend pick a
-         * replica-local timestamp. The usual choice for a low-latency global read.
+         * Read at any instant at most this far in the past, letting the platform
+         * serve the read from the nearest copy of the data. The usual choice for a
+         * low-latency global read.
          *
          * @generated from field: google.protobuf.Duration max_staleness = 1;
          */
@@ -822,8 +823,8 @@ export type ReadStaleness = Message<"jennahapi.datastore.v1.ReadStaleness"> & {
         case: "exactStaleness";
     } | {
         /**
-         * Read at this exact timestamp. Bounded by the backend's version-retention
-         * window (about an hour); an older timestamp is refused.
+         * Read at this exact timestamp, at most about an hour in the past; an older
+         * timestamp is refused.
          *
          * @generated from field: google.protobuf.Timestamp read_timestamp = 3;
          */
@@ -1034,8 +1035,8 @@ export declare enum OperationType {
 export declare const OperationTypeSchema: GenEnum<OperationType>;
 /**
  * How a join combines rows. Both sides must be tables in the SAME dataset:
- * cross-dataset joins are not expressible, because each query is clamped to one
- * dataset slice exactly as a memory query is clamped to one agent.
+ * cross-dataset joins are not expressible, because each query is confined to one
+ * dataset exactly as a memory query is confined to one agent.
  *
  * @generated from enum jennahapi.datastore.v1.JoinType
  */
@@ -1067,9 +1068,9 @@ export declare const JoinTypeSchema: GenEnum<JoinType>;
 export declare const DataService: GenService<{
     /**
      * Applies a set of structured row operations across one or more of the
-     * dataset's tables in a SINGLE read-write transaction, clamped to
-     * `(EnterpriseId, DatasetId)`. All-or-nothing: if any operation fails, no
-     * operation's rows are written.
+     * dataset's tables in a SINGLE read-write transaction, confined to that one
+     * dataset of the caller's enterprise. All-or-nothing: if any operation fails,
+     * no operation's rows are written.
      *
      * This is the atomic multi-table write a split stack cannot offer: a row, its
      * embedding, and rows in other tables land together or not at all. An
@@ -1103,7 +1104,7 @@ export declare const DataService: GenService<{
      * Evaluates a multi-section read against ONE read snapshot, so a relational
      * predicate and a vector ranking observe the same instant: an optional
      * relational section and an optional exact-KNN vector section. Every section
-     * is clamped to the caller's `(EnterpriseId, DatasetId)` slice, and joins are
+     * reads only the named dataset of the caller's enterprise, and joins are
      * restricted to tables within the same dataset.
      *
      * The request is a SECTIONED ENVELOPE for the same reason QueryMemory is: a

package/dist/gen/jennah/datastore/v1/data_pb.js

@@ -237,8 +237,8 @@ export var OperationType;
 export const OperationTypeSchema = /*@__PURE__*/ enumDesc(file_jennah_datastore_v1_data, 0);
 /**
  * How a join combines rows. Both sides must be tables in the SAME dataset:
- * cross-dataset joins are not expressible, because each query is clamped to one
- * dataset slice exactly as a memory query is clamped to one agent.
+ * cross-dataset joins are not expressible, because each query is confined to one
+ * dataset exactly as a memory query is confined to one agent.
  *
  * @generated from enum jennahapi.datastore.v1.JoinType
  */

package/dist/gen/jennah/datastore/v1/dataset_pb.d.ts

@@ -113,7 +113,7 @@ export type CreateDatasetRequest = Message<"jennahapi.datastore.v1.CreateDataset
     /**
      * Scopes for the key minted when create_api_key is set. Each MUST be a subset
      * of the caller's own effective permissions and MUST NOT be management-class.
-     * When empty the key defaults to the member-equivalent data-plane scope, which
+     * When empty the key defaults to the member-equivalent data scopes, which
      * includes datastore.data:read/write but NOT datastore.schema:manage, so a key
      * meant to declare tables must name that permission explicitly.
      *
@@ -215,8 +215,8 @@ export type ListDatasetsRequest = Message<"jennahapi.datastore.v1.ListDatasetsRe
      * one: a token the server cannot interpret is REJECTED with INVALID_ARGUMENT
      * rather than quietly restarting from the first page, because a silent restart
      * would hand a caller walking to exhaustion a partial listing that looks
-     * complete. A token can only narrow within the caller's slice; it can never
-     * widen it.
+     * complete. A token can only narrow within the caller's enterprise; it can
+     * never widen it.
      *
      * @generated from field: string page_token = 2;
      */
@@ -304,15 +304,14 @@ export declare enum DatasetStatus {
      */
     UNSPECIFIED = 0,
     /**
-     * Ready for use: the data-plane database exists and the directory row is
-     * registered. Tables may be declared and data committed.
+     * Ready for use: tables may be declared and data committed.
      *
      * @generated from enum value: DATASET_STATUS_ACTIVE = 1;
      */
     ACTIVE = 1,
     /**
-     * The data-plane database for the chosen location is being created (which can
-     * take minutes). No table may be declared yet; poll GetDataset until ACTIVE.
+     * The chosen location is being prepared (which can take minutes). No table may
+     * be declared yet; poll GetDataset until ACTIVE.
      *
      * @generated from enum value: DATASET_STATUS_PROVISIONING = 2;
      */
@@ -342,14 +341,12 @@ export declare const DatasetStatusSchema: GenEnum<DatasetStatus>;
  */
 export declare const DatasetService: GenService<{
     /**
-     * Creates a dataset under the caller's enterprise, registers it in the
-     * control-plane directory, and places it on a data-plane database compatible
-     * with the requested location. The EnterpriseId is taken from the token, never
-     * the body.
+     * Creates a dataset under the caller's enterprise and places it in the
+     * requested location. The enterprise is taken from the token, never the body.
      *
-     * Returns the dataset synchronously. When the data-plane database for the
-     * chosen location must be provisioned first, the returned Dataset carries
-     * DATASET_STATUS_PROVISIONING; poll GetDataset until DATASET_STATUS_ACTIVE.
+     * Returns the dataset synchronously. When the chosen location must be prepared
+     * first, the returned Dataset carries DATASET_STATUS_PROVISIONING; poll
+     * GetDataset until DATASET_STATUS_ACTIVE.
      *
      * Requires datastore.datasets:create AND a dataset selector already covering
      * the requested dataset_id: creating a dataset grants no access to it, for
@@ -391,7 +388,7 @@ export declare const DatasetService: GenService<{
     };
     /**
      * Deletes a dataset the caller owns: drops its declared tables and removes its
-     * catalog and directory records, cascading to all of its application rows.
+     * table catalog and the dataset itself, along with all of its application rows.
      * Every table the dataset holds is dropped, whatever their number. Returns a
      * receipt carrying the instant the teardown committed. A dataset_id not owned
      * by the caller's enterprise is treated as not found.

package/dist/gen/jennah/datastore/v1/dataset_pb.js

@@ -65,15 +65,14 @@ export var DatasetStatus;
      */
     DatasetStatus[DatasetStatus["UNSPECIFIED"] = 0] = "UNSPECIFIED";
     /**
-     * Ready for use: the data-plane database exists and the directory row is
-     * registered. Tables may be declared and data committed.
+     * Ready for use: tables may be declared and data committed.
      *
      * @generated from enum value: DATASET_STATUS_ACTIVE = 1;
      */
     DatasetStatus[DatasetStatus["ACTIVE"] = 1] = "ACTIVE";
     /**
-     * The data-plane database for the chosen location is being created (which can
-     * take minutes). No table may be declared yet; poll GetDataset until ACTIVE.
+     * The chosen location is being prepared (which can take minutes). No table may
+     * be declared yet; poll GetDataset until ACTIVE.
      *
      * @generated from enum value: DATASET_STATUS_PROVISIONING = 2;
      */

package/dist/gen/jennah/datastore/v1/schema_pb.d.ts

@@ -125,9 +125,8 @@ export type IndexDeclaration = Message<"jennahapi.datastore.v1.IndexDeclaration"
      */
     columns: string[];
     /**
-     * Uniqueness is enforced WITHIN the dataset slice, never across the shared
-     * data-plane database: the platform prepends the clamp columns to the index
-     * key, so two datasets may each hold a row with the same value.
+     * Uniqueness is enforced WITHIN the dataset, never across datasets, so two
+     * datasets may each hold a row with the same value.
      *
      * @generated from field: bool unique = 3;
      */
@@ -156,10 +155,9 @@ export type TableDeclaration = Message<"jennahapi.datastore.v1.TableDeclaration"
     columns: ColumnDeclaration[];
     /**
      * Logical column names forming the table's primary key, in order. The
-     * platform PREPENDS `(EnterpriseId, DatasetId)` to whatever is named here:
-     * that is not expressible in the declaration and cannot be overridden or
-     * reordered, because it is what makes cross-slice access structurally
-     * impossible rather than merely denied.
+     * platform additionally scopes every key to the dataset, outside the
+     * declaration: that cannot be overridden, and it is what makes access across
+     * datasets structurally impossible rather than merely denied.
      *
      * @generated from field: repeated string primary_key = 3;
      */
@@ -328,9 +326,9 @@ export type TableSchema = Message<"jennahapi.datastore.v1.TableSchema"> & {
      */
     columns: ColumnSchema[];
     /**
-     * Logical primary-key columns AS DECLARED: the `(EnterpriseId, DatasetId)`
-     * prefix the platform prepends is not listed, because it is not a tenant
-     * concept and naming it here would imply it were optional.
+     * Logical primary-key columns AS DECLARED. The platform's own scoping of the
+     * key to the dataset is not listed: it is not something a caller declares or
+     * can change.
      *
      * @generated from field: repeated string primary_key = 3;
      */
@@ -542,8 +540,8 @@ export declare const SchemaService: GenService<{
      * table reaches SCHEMA_STATUS_READY before committing data to it.
      *
      * Requires datastore.schema:manage, which is deliberately NOT part of the
-     * built-in member role: declaring a table issues DDL against a shared
-     * data-plane database, so it is always an explicit grant to a custom role or
+     * built-in member role: declaring a table changes schema on storage shared
+     * with other datasets, so it is always an explicit grant to a custom role or
      * an explicitly scoped key. It IS grantable to an API key: a machine
      * principal building an app has to be able to declare its own tables.
      *

package/dist/version.d.ts

@@ -1,2 +1,2 @@
-export declare const version = "0.67.0";
+export declare const version = "0.68.0";
 export declare const sourceCommit = "33a6dde78cb5eb3540379687e241318e0981acff";

package/dist/version.js

@@ -1,3 +1,3 @@
 // Written by jennah-api release/typescript/assemble.sh; not committed.
-export const version = "0.67.0";
+export const version = "0.68.0";
 export const sourceCommit = "33a6dde78cb5eb3540379687e241318e0981acff";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "jennah-sdk-ts",
-  "version": "0.67.0",
+  "version": "0.68.0",
   "description": "TypeScript SDK for Jennah, the memory and context platform for AI agents",
   "license": "Apache-2.0",
   "homepage": "https://github.com/alphauslabs/jennah-sdk-ts#readme",