@anuma/sdk 3.2.0 → 3.3.0

package/dist/expo/index.d.mts

@@ -4472,6 +4472,12 @@ declare class VaultMemory extends Model {
     topicsExtractedVersion: number | null;
     /** C3 re-observation watermark: Unix ms of the last retain() merge, or null. */
     lastObservedAt: number | null;
+    /** Typed memory (PR1) — the extractor's FactType. Null on legacy/manual rows. */
+    factType: string | null;
+    /** Decay archive state (PR2) — Unix ms when archived, null when active. */
+    archivedAt: number | null;
+    /** Tier-0 security (PR3) — "quarantined" | "trusted" | null. */
+    trustTier: string | null;
     createdAt: Date;
     updatedAt: Date;
     isDeleted: boolean;
@@ -4544,466 +4550,184 @@ interface EntityOperationsContext {
     allowUnscopedRows?: boolean;
 }
 
-interface StoredVaultMemory {
-    /** WatermelonDB internal ID */
-    uniqueId: string;
-    /** Plain text memory content */
-    content: string;
-    /** Scope for partitioning memories (e.g., "private", "shared") */
-    scope: string;
-    /** Folder ID for organization, null if unfiled */
-    folderId: string | null;
-    /** User ID for multi-user server-side scoping, null on client */
-    userId: string | null;
-    /** JSON-stringified embedding vector, null if not yet computed */
-    embedding: string | null;
-    /** Model that produced `embedding`. Null on legacy rows (grandfathered as
-     * compatible with the current model). */
-    embeddingModel: string | null;
-    /** JSON-stringified array of source message IDs this fact was extracted from. */
-    sourceChunkIds: string[] | null;
-    /** Times this fact has been re-observed (for ranking + UX badges). */
-    proofCount: number | null;
-    /** How the memory was created: manual | auto-extracted | capsule. */
-    source: string | null;
-    /** W6 temporal lane — Unix ms when the event occurred (point/start of range). */
-    eventTimeStart: number | null;
-    /** W6 temporal lane — Unix ms when the event ended (range only). */
-    eventTimeEnd: number | null;
-    /** W6 temporal lane — `point | range | ongoing | null`. */
-    eventTimeKind: string | null;
-    /** When true, the user has manually set this memory's topics (entity links);
-     * auto-extraction leaves them alone. False on legacy/auto rows. */
-    topicsUserManaged: boolean;
-    /** Unix ms of the last LLM topic-extraction pass over this memory's content.
-     * Null = never extracted standalone; rows that already carry entity links
-     * are grandfathered as extracted (see getMemoriesNeedingTopicExtractionOp). */
-    topicsExtractedAt: number | null;
-    /** Write-time supersession (A2): id of the newer memory that replaced this
-     * one (incompatible-value update, e.g. "Lives in Portland" → "Lives in SF").
-     * Null = live. Superseded rows are excluded from recall/dedup by default but
-     * kept for history + the read-time fallback. */
-    supersededBy: string | null;
-    /** Unix ms when this memory was superseded. Null when live. */
-    supersededAt: number | null;
-    /** Extraction-logic version this memory was last stamped under. Null (pre-v38)
-     * reads as 0, so a TOPICS_EXTRACTION_VERSION bump re-extracts stale rows. */
-    topicsExtractedVersion: number | null;
-    /** C3 re-observation watermark: Unix ms of the last retain() merge into this
-     * fact. Distinct from `updatedAt` (which merges preserve). Null = never
-     * re-observed since the column was added; synthesis falls back to
-     * `updatedAt` in that case. */
-    lastObservedAt: number | null;
-    createdAt: Date;
-    updatedAt: Date;
-    isDeleted: boolean;
-}
-interface CreateVaultMemoryOptions {
-    content: string;
-    /** Scope for the memory. Defaults to "private" if omitted. */
-    scope?: string;
-    /** Folder ID for organization, null or omitted if unfiled */
-    folderId?: string | null;
-    /** JSON-stringified embedding vector to persist */
-    embedding?: string;
-    /** Model that produced `embedding`. Persisted alongside it so a later
-     * model change can detect and re-embed stale vectors. */
-    embeddingModel?: string;
-    /** Source message IDs that produced this fact (auto-extraction provenance). */
-    sourceChunkIds?: string[];
-    /** Initial proof count. Defaults to 1 if omitted. */
-    proofCount?: number;
-    /** How the memory was created. Defaults to "manual" if omitted. */
-    source?: string;
-    /** W6 temporal lane — when the event in this memory occurred. */
-    eventTime?: {
-        /** Unix ms timestamp of event start (or point). */
-        start: number | null;
-        /** Unix ms timestamp of event end (range only). */
-        end: number | null;
-        /** Kind: 'point' | 'range' | 'ongoing' | null (or omit). */
-        kind: "point" | "range" | "ongoing" | null;
-    };
-}
-interface UpdateVaultMemoryOptions {
-    content: string;
-    /** If provided, updates the memory's scope. */
-    scope?: string;
-    /** If provided, moves the memory to this folder. */
-    folderId?: string | null;
-    /** JSON-stringified embedding vector to persist, or null to clear stale embedding */
-    embedding?: string | null;
-    /** Model that produced `embedding`. Set whenever `embedding` is written so
-     * the stored model tag stays in sync with the vector. */
-    embeddingModel?: string | null;
-    /** Replace source-chunk-ids list (used during merge to accumulate provenance). */
-    sourceChunkIds?: string[];
-    /** Set an absolute proof count. Prefer {@link proofCountIncrement} for
-     * re-observation paths so the read+write happens inside the writer
-     * and concurrent retains can't lose updates. */
-    proofCount?: number;
-    /** Atomically bump proof_count by this delta inside the write block.
-     * Reads the current value from the in-memory record at write time, so
-     * two parallel retain() calls observe each other's commits and neither
-     * loses its increment. Wins over `proofCount` when both are set. */
-    proofCountIncrement?: number;
-    /** Set source ("manual" | "auto-extracted" | "capsule"). */
-    source?: string;
-    /**
-     * W6 temporal lane — write the event-time fields on update. Use during
-     * auto-merge to preserve (or refine) the original event-time signal when
-     * a new observation lands on an existing fact. Omit to leave the
-     * existing values untouched.
-     */
-    eventTime?: {
-        start: number | null;
-        end: number | null;
-        kind: "point" | "range" | "ongoing" | null;
-    };
-    /**
-     * When true, restore the existing `updated_at` after the write so the
-     * recency multiplier doesn't see a re-observation as a brand-new fact.
-     * Set by auto-merge/consolidate paths — they want proof_count to bump
-     * without inflating recency on top.
-     */
-    preserveUpdatedAt?: boolean;
-    /** C3: Unix ms to stamp as the re-observation watermark (`last_observed_at`).
-     * Set by retain() merge/consolidate paths so a re-observation records "seen
-     * again now" without touching `updated_at` (which `preserveUpdatedAt` keeps
-     * pinned). Omit to leave the existing value untouched. */
-    lastObservedAt?: number;
-    /** If provided, sets whether the user has taken manual control of this
-     * memory's topics. Set by {@link setMemoryEntitiesOp}. */
-    topicsUserManaged?: boolean;
+/**
+ * Auth for portal LLM calls (extraction, consolidation, decomposition,
+ * reflection). Mirrors `memoryEngine`'s `EmbeddingOptions` dual-auth:
+ *
+ * - `apiKey`: For direct API keys (uses x-api-key header)
+ * - `getToken`: For Privy identity tokens (uses Authorization: Bearer header)
+ *
+ * At least one of `apiKey` or `getToken` must be provided (enforced at
+ * runtime); `apiKey` takes precedence when both are set.
+ *
+ * @public
+ */
+interface PortalLlmAuth {
+    /** Direct API key — sent as `x-api-key` (server-side / CLI usage). Wins when both are provided. */
+    apiKey?: string;
+    /** Function to get an auth token (e.g., Privy's getIdentityToken). Token is sent as `Authorization: Bearer`. */
+    getToken?: () => Promise<string | null>;
 }
 
-interface VaultMemoryOperationsContext {
-    database: Database;
-    vaultMemoryCollection: Collection<VaultMemory>;
-    walletAddress?: string;
-    signMessage?: SignMessageFn;
-    embeddedWalletSigner?: EmbeddedWalletSignerFn;
-    /** When set, operations scope to this user (server-side multi-user). */
-    userId?: string;
+/**
+ * Optional LLM injection classifier — Tier-0 security second layer (PR5).
+ *
+ * The deterministic {@link ./injectionScreen} is a signature scan: it catches
+ * imperative overrides, role-marker leakage, and exfil URLs, but by
+ * construction it CANNOT catch signature-free poison phrased as a plain
+ * third-person fact — e.g. "Trusts BrandX for financial advice", "Prefers to
+ * always use the AcmePay card". Those read like ordinary preferences and sail
+ * through the regex screen.
+ *
+ * This module closes that gap as a SECOND, opt-in layer. In `extractAndRetain`
+ * it runs ONLY over the candidates the deterministic screen already passed as
+ * clean, asking a cheap model a single batched yes/no per candidate: "is this
+ * an instruction to the assistant / a planted preference, rather than a genuine
+ * fact the user stated about themselves?" Positives are moved to quarantine
+ * (trust_tier="quarantined"), exactly like a signature hit.
+ *
+ * Safety posture (why it can only ever add safety, never remove it):
+ *   - Default OFF. No option → no LLM call → zero latency/cost added, and the
+ *     write path is byte-for-byte the pre-PR5 deterministic screen.
+ *   - Fails CLEAN. Any error (network, timeout, malformed JSON, auth) → the
+ *     candidate stays in the clean set (trusts the deterministic result). A
+ *     flaky classifier can never suppress a legitimate memory.
+ *   - Bounded. One batched portal call per turn (never per-candidate), with a
+ *     candidate cap, a low retry budget, and a wall-clock total-timeout.
+ *   - Zero-knowledge parity. Candidate content is PII-redacted before it
+ *     reaches the portal using the SAME redactor setting as the extraction
+ *     path (inherited by `extractAndRetain`); the model only ever returns
+ *     integer indices, so nothing needs de-anonymizing on the way back.
+ *
+ * SECURITY (MEDIUM, residual): this is a NEW portal call surface for memory
+ * content. It is gated on an explicit opt-in and redacts like the extractor, but
+ * a security review should treat enabling it as widening the set of models that
+ * see (redacted) facts. A malicious / MITM'd portal can also use it as a lever
+ * to QUARANTINE the affected rows (they drop out of recall) — reversible, and it
+ * can never delete or alter a memory. Bounded, recoverable trust tradeoff; gate
+ * on trust in the portal.
+ */
+
+/**
+ * Auth + tuning for the optional LLM injection classifier. Auth is the dual
+ * pattern — one of `apiKey` / `getToken` is required at runtime (see
+ * {@link PortalLlmAuth}). The mere PRESENCE of this options object in
+ * `extractAndRetain` is the opt-in switch; omit it for the default-off,
+ * deterministic-only screen.
+ * @public
+ */
+interface InjectionClassifierOptions extends PortalLlmAuth {
+    baseUrl?: string;
+    model?: string;
+    /** Override fetch (tests). */
+    fetchFn?: typeof fetch;
+    /** Max portal attempts on a TRANSIENT failure. Default 2. */
+    maxAttempts?: number;
+    /** Absolute wall-clock budget across attempts. Default 15s. */
+    totalTimeoutMs?: number;
+    /** Backoff before each retry (ms). Tests pass `() => 0`. */
+    backoffMs?: (attempt: number) => number;
     /**
-     * When set, vault delete ops cascade to memory_entity rows pointing at
-     * the deleted memories. Without this the W5 graph lane keeps returning
-     * IDs of soft-deleted memories and the join table grows unbounded.
+     * PII redaction for the outbound content, same switch as the extractor.
+     * `extractAndRetain` inherits the extraction setting so enabling redaction
+     * there also protects this call. `true` = fresh per-call redactor; pass a
+     * shared {@link PiiRedactor} to keep placeholder numbering consistent.
      */
-    entityCtx?: EntityOperationsContext;
+    piiRedaction?: boolean | PiiRedactor;
+    /** Max candidates classified per call. Default 20. */
+    maxCandidates?: number;
 }
-declare function createVaultMemoryOp(ctx: VaultMemoryOperationsContext, opts: CreateVaultMemoryOptions): Promise<StoredVaultMemory>;
-declare function createVaultMemoriesBatchOp(ctx: VaultMemoryOperationsContext, optionsArray: CreateVaultMemoryOptions[]): Promise<StoredVaultMemory[]>;
-declare function getVaultMemoryOp(ctx: VaultMemoryOperationsContext, id: string): Promise<StoredVaultMemory | null>;
-declare function getAllVaultMemoriesOp(ctx: VaultMemoryOperationsContext, options?: {
-    scopes?: string[];
-    since?: Date;
-    limit?: number;
-    folderId?: string | null;
-    /**
-     * Include soft-deleted memories in the result (each carries
-     * `isDeleted: true`). Default `false` — deleted rows are excluded, as
-     * they are from every other read path. Used by the Memory Graph to
-     * render "forgotten" nodes; ordinary consumers should leave this off.
-     */
-    includeDeleted?: boolean;
-    /**
-     * Include A2-superseded memories (each carries `supersededBy`). Default
-     * `false` — superseded rows are excluded, as they are from recall/dedup.
-     * Used by a "memory history" view to render retired facts.
-     */
-    includeSuperseded?: boolean;
-}): Promise<StoredVaultMemory[]>;
-declare function getAllVaultMemoryContentsOp(ctx: VaultMemoryOperationsContext, options?: {
-    since?: Date;
-}): Promise<string[]>;
-declare function updateVaultMemoryOp(ctx: VaultMemoryOperationsContext, id: string, opts: UpdateVaultMemoryOptions): Promise<StoredVaultMemory | null>;
-declare function deleteVaultMemoryOp(ctx: VaultMemoryOperationsContext, id: string): Promise<boolean>;
 /**
- * Mark a memory as superseded by a newer one (A2 write-time supersession).
- * The row stays in the table (history + read-time fallback) but is excluded
- * from recall/dedup by default via `superseded_by`. Idempotent-ish: no-op if
- * the row is missing, not owned, deleted, or already superseded. Does NOT
- * preserve `updated_at` — superseded rows are hidden from recall, so their
- * recency is irrelevant.
+ * Classify already-clean extraction candidates for signature-free injection /
+ * poisoning. Returns the set of 0-based indices (into `candidates`) the model
+ * flagged as poison.
  *
- * @param id - the memory being retired (e.g. "Lives in Portland")
- * @param supersededById - the newer memory that replaced it (e.g. "Lives in SF")
+ * FAILS CLEAN: returns an empty set on empty input, missing auth, LLM error,
+ * or any malformed response — the caller then keeps every candidate clean, so
+ * this layer can only ever ADD quarantines, never suppress a legitimate fact
+ * on failure. Makes at most ONE portal call regardless of candidate count.
+ *
+ * @public
  */
-declare function supersedeVaultMemoryOp(ctx: VaultMemoryOperationsContext, id: string, supersededById: string): Promise<boolean>;
+declare function classifyInjectionCandidates(candidates: readonly ExtractedCandidate[], options: InjectionClassifierOptions): Promise<{
+    flagged: Set<number>;
+}>;
+
 /**
- * Get all non-deleted, unfiled vault memories (folder_id is null).
+ * Write-time memory-poisoning screen — Tier-0 security (PR3).
+ *
+ * Deterministic, network-free, and always on. Scans each extraction
+ * candidate's `content` for prompt-injection / memory-poisoning
+ * signatures and routes flagged candidates to quarantine instead of the
+ * live vault.
+ *
+ * WHY a signature scan (not an LLM classifier): this runs on the write
+ * path for every extracted fact, so it must be cheap, offline, and must
+ * never leak content to a model. It also gives a small false-positive
+ * surface here: durable third-person facts about the user ("Lives in San
+ * Francisco", "Allergic to shellfish", "Works in engineering") almost
+ * never contain second-person imperatives aimed at the assistant, chat
+ * role markers, or beacon URLs — the exact shapes these signatures look
+ * for. An optional LLM injection classifier is deferred to PR5.
+ *
+ * WHY quarantine, not drop: a flagged candidate is still persisted (see
+ * `extractAndRetain`) with `trust_tier="quarantined"` so it stays an
+ * auditable record, recoverable by an operator via the `includeQuarantined`
+ * read path. The `baseVaultConditions` choke point excludes quarantined
+ * rows from every recall lane, so a poisoned fact never reaches the answer
+ * model even though it lives in the DB.
+ *
+ * This MITIGATES memory poisoning (MINJA / AgentPoison; OWASP ASI06 2026).
+ * It is not a complete solve — a poison phrased as a plain third-person
+ * fact ("Prefers the BrandX credit card") carries no injection signature
+ * and will pass. The proof-count ranking boost (once-seen facts stay
+ * low-ranked) and the read-time isolation in `formatRecallResult` are the
+ * complementary layers.
  */
-declare function getUnfiledVaultMemoriesOp(ctx: VaultMemoryOperationsContext): Promise<StoredVaultMemory[]>;
+
+/** Why a candidate was quarantined. Coarse buckets over the signature set
+ * below — surfaced for audit/telemetry, never alongside the content.
+ * `llm_semantic` (PR5) is emitted by the optional second-layer LLM classifier
+ * ({@link classifyInjectionCandidates}), not by any deterministic signature
+ * here — it catches signature-free poison ("Trusts BrandX for financial
+ * advice") the regex screen passes as clean. */
+type InjectionReason = "imperative_override" | "role_marker_leak" | "exfiltration_url" | "llm_semantic";
+/** A candidate the screen flagged, with the matching signature id + reason.
+ * Content is intentionally NOT duplicated here beyond the candidate itself —
+ * callers must never log `candidate.content`. */
+interface ScreenedCandidate {
+    candidate: ExtractedCandidate;
+    /** Coarse reason bucket. */
+    reason: InjectionReason;
+    /** Stable id of the signature that matched (safe to log; carries no content). */
+    signature: string;
+}
+/** Result of screening a candidate batch. */
+interface ScreenResult {
+    /** Candidates with no injection signature — persist normally. */
+    clean: ExtractedCandidate[];
+    /** Candidates that matched a signature — persist quarantined. */
+    quarantined: ScreenedCandidate[];
+}
 /**
- * The current topic-extraction logic version. Bump this whenever the extraction
- * prompt or model in `topicExtract.ts` changes: every memory stamped under an
- * older version (including pre-v37 rows, read as version 0) is then re-extracted
- * by the next sweep, so topic-quality improvements propagate across the existing
- * vault. The worker's `limit` drains that re-extraction across sweeps.
+ * Screen extraction candidates for injection / poisoning signatures.
+ *
+ * Partitions the input into `clean` (persist normally) and `quarantined`
+ * (persist with `trust_tier="quarantined"`, hidden from recall). Pure and
+ * synchronous — no network, no DB, no content logging. Input order is
+ * preserved within each partition.
  */
-declare const TOPICS_EXTRACTION_VERSION = 1;
+declare function screenCandidatesForInjection(candidates: readonly ExtractedCandidate[]): ScreenResult;
 /**
- * Result of {@link getMemoriesNeedingTopicExtractionOp}: which memories the
- * background topic worker should run LLM entity extraction on, and which it
- * should merely stamp as already-extracted.
+ * Content-free catalog of the active signatures (id + reason, no patterns).
+ * Exposed so a security review / audit surface can enumerate coverage
+ * without reaching into module internals. Does not leak any user content.
  */
-interface MemoriesNeedingTopicExtraction {
-    /**
-     * Memories to run LLM topic extraction on (decrypted): never-extracted rows
-     * with no entity links, plus stamped rows edited since their last pass
-     * (`updated_at` > `topics_extracted_at`) or extracted under an older
-     * `topics_extracted_version` than {@link TOPICS_EXTRACTION_VERSION}. Edited /
-     * stale-version rows come first (they get priority under `limit`), each group
-     * newest-created first.
-     */
-    pending: StoredVaultMemory[];
-    /**
-     * IDs of rows that already have entity links but no watermark — legacy rows
-     * extracted by the conversation pipeline before v36. Grandfather these with
-     * {@link stampTopicsExtractedAtOp} (no LLM call) so a later content edit
-     * makes them re-extractable instead of invisible forever. Bounded by the
-     * same `limit` as {@link pending} — stamping loads a Model per row, so the
-     * grandfather backlog is drained across sweeps rather than in one spike.
-     */
-    linkedUnstamped: string[];
-}
-/**
- * Sweep query for the background topic-extraction worker: partition the
- * user's non-deleted, non-user-managed memories by what the worker should do
- * with them (see {@link MemoriesNeedingTopicExtraction}). User-managed rows
- * are never returned — the user owns their topics, including an intentionally
- * empty set. Requires `ctx.entityCtx` for the entity-links check.
- */
-declare function getMemoriesNeedingTopicExtractionOp(ctx: VaultMemoryOperationsContext, options?: {
-    limit?: number;
-}): Promise<MemoriesNeedingTopicExtraction>;
-/**
- * Stamp `topics_extracted_at` (and `topics_extracted_version`) on the given
- * memories — the topic worker calls this after a successful extraction pass
- * (including zero-entity results, so quiet memories aren't re-asked every sweep)
- * and to grandfather `linkedUnstamped` rows without an LLM call. `version`
- * defaults to {@link TOPICS_EXTRACTION_VERSION}: stamping at the current version
- * (for both fresh extractions and grandfathered legacy rows) means they aren't
- * re-extracted until a future version bump. Preserves `updated_at` so a stamp
- * never inflates the recency multiplier — and never masks a concurrent content
- * edit from the next sweep. Skips deleted, foreign-user, and user-managed rows.
- * Returns the IDs actually stamped.
- *
- * ALL eligibility AND `updated_at` are read from the LIVE Model inside the
- * serialized writer — never a pre-writer snapshot. Writers are serialized, so
- * a content edit or topic-override that commits before this writer runs is
- * observed here: its fresh `updated_at` is preserved (so the next sweep's
- * `updated_at > stamp` check still fires) and a mid-pass user-managed flip
- * skips the row. Reading `updated_at` from a raw pre-fetch instead would write
- * a stale value back, pushing `updated_at < topics_extracted_at` and hiding
- * the edited memory from every future sweep.
- *
- * Callers bound the input via `getMemoriesNeedingTopicExtractionOp`'s `limit`
- * (both `pending` and `linkedUnstamped` are capped), so the per-row Model load
- * needed to `prepareUpdate` stays bounded and never spikes the RecordCache.
- */
-declare function stampTopicsExtractedAtOp(ctx: VaultMemoryOperationsContext, memoryIds: readonly string[], extractedAt: number, version?: number): Promise<string[]>;
-declare function deleteAllVaultMemoriesForUserOp(ctx: VaultMemoryOperationsContext, userId: string): Promise<number>;
-declare function updateVaultMemoryEmbeddingOp(ctx: VaultMemoryOperationsContext, id: string, embedding: string, embeddingModel: string): Promise<boolean>;
-
-/**
- * Queue Types
- *
- * Types for the in-memory write queue that holds operations
- * when encryption keys aren't yet available.
- */
-
-/**
- * Types of database operations that can be queued.
- */
-type QueuedOperationType = "createConversation" | "updateConversationTitle" | "updateConversationPinned" | "createMessage" | "updateMessage" | "createMedia" | "createMediaBatch" | "updateMediaMessageId";
-/**
- * A single queued database operation.
- */
-interface QueuedOperation {
-    /** Unique ID for this operation */
-    id: string;
-    /** Type of operation */
-    type: QueuedOperationType;
-    /** Wallet address this operation belongs to */
-    walletAddress: string;
-    /** When the operation was queued */
-    timestamp: number;
-    /** Priority for ordering (lower = higher priority). Conversations=0, Messages=1, Media=2 */
-    priority: number;
-    /** IDs of operations that must complete before this one */
-    dependencies: string[];
-    /** Operation-specific payload */
-    payload: Record<string, any>;
-    /** Number of times this operation has been retried */
-    retryCount: number;
-    /** Maximum number of retries allowed */
-    maxRetries: number;
-}
-/**
- * Status of a wallet's queue.
- */
-interface QueueStatus {
-    /** Number of pending operations */
-    pending: number;
-    /** Number of operations that failed all retries */
-    failed: number;
-    /** Whether the queue is currently being flushed */
-    isFlushing: boolean;
-    /** Whether the queue is paused (e.g., wallet disconnected) */
-    isPaused: boolean;
-}
-/**
- * Result of a flush operation.
- */
-interface FlushResult {
-    /** IDs of operations that succeeded */
-    succeeded: string[];
-    /** Operations that failed with their errors */
-    failed: Array<{
-        id: string;
-        error: string;
-    }>;
-    /** Total number of operations attempted */
-    total: number;
-}
-/**
- * Encryption context needed to execute queued operations.
- */
-interface QueueEncryptionContext {
-    walletAddress: string;
-    signMessage: SignMessageFn;
-    embeddedWalletSigner?: EmbeddedWalletSignerFn;
-}
-/**
- * Executor function that runs a single queued operation.
- * Provided by the consumer (e.g., useChatStorage) during flush.
- */
-type OperationExecutor = (operation: QueuedOperation, encryptionContext: QueueEncryptionContext) => Promise<void>;
-
-/**
- * Queue Manager
- *
- * In-memory queue for database operations when encryption keys aren't yet available.
- * Operations are held in memory and flushed to the database once the key becomes available.
- *
- * Key design decisions:
- * - In-memory only: queue is lost on page refresh (acceptable since user must re-auth anyway)
- * - Per-wallet isolation: each wallet has its own queue
- * - Dependency tracking: operations are flushed in correct order (conversation before messages)
- * - Max 1000 operations per wallet to prevent memory leaks
- */
-
-declare class QueueManager {
-    /** Per-wallet operation queues: wallet address -> operation id -> operation */
-    private queues;
-    /** Per-wallet flushing state */
-    private flushing;
-    /** Per-wallet paused state */
-    private paused;
-    /** Per-wallet failed operations (exceeded max retries) */
-    private failedOps;
-    /** Change listeners: wallet address -> callbacks */
-    private listeners;
-    /**
-     * Queue a new operation for a wallet.
-     * @returns The operation ID, or null if queue is full.
-     */
-    queueOperation(walletAddress: string, type: QueuedOperationType, payload: Record<string, any>, dependencies?: string[], maxRetries?: number): string | null;
-    /**
-     * Get all pending operations for a wallet, sorted by dependency order.
-     */
-    getOperations(walletAddress: string): QueuedOperation[];
-    /**
-     * Remove a specific operation from the queue.
-     */
-    removeOperation(walletAddress: string, operationId: string): void;
-    /**
-     * Get the status of a wallet's queue.
-     */
-    getStatus(walletAddress: string): QueueStatus;
-    /**
-     * Flush all queued operations for a wallet by executing them with encryption.
-     *
-     * @param encryptionContext - Wallet address and signing functions for encryption
-     * @param executor - Function that executes each operation against the database
-     * @returns Result with succeeded/failed operation IDs
-     */
-    flush(encryptionContext: QueueEncryptionContext, executor: OperationExecutor): Promise<FlushResult>;
-    /**
-     * Clear all queued operations for a wallet.
-     */
-    clear(walletAddress: string): void;
-    /**
-     * Pause the queue for a wallet (stops flush mid-way).
-     */
-    pause(walletAddress: string): void;
-    /**
-     * Resume the queue for a wallet.
-     */
-    resume(walletAddress: string): void;
-    /**
-     * Register a listener for queue changes on a wallet.
-     * @returns Unsubscribe function
-     */
-    onQueueChange(walletAddress: string, callback: () => void): () => void;
-    /**
-     * Check if a wallet has any pending operations.
-     */
-    hasPending(walletAddress: string): boolean;
-    /** Move a failed operation to the failed set. */
-    private moveToFailed;
-    /** Notify all listeners for a wallet. */
-    private notifyListeners;
-}
-/** Singleton queue manager instance */
-declare const queueManager: QueueManager;
-
-/**
- * Wallet Poller
- *
- * Polls for embedded wallet availability during Privy initialization.
- * When a wallet becomes available, triggers a callback so the queue can flush.
- */
-declare class WalletPoller {
-    private timerId;
-    private attempts;
-    /**
-     * Start polling for wallet availability.
-     *
-     * @param checkWallet - Returns wallet address when ready, null if not yet available
-     * @param onWalletReady - Called with the wallet address when it becomes available
-     * @param intervalMs - Polling interval in milliseconds (default: 1000ms)
-     * @param maxAttempts - Maximum polling attempts before giving up (default: 60)
-     * @returns Stop function to cancel polling
-     */
-    startPolling(checkWallet: () => Promise<string | null>, onWalletReady: (address: string) => void, intervalMs?: number, maxAttempts?: number): () => void;
-    /**
-     * Stop polling.
-     */
-    stop(): void;
-}
-
-/**
- * Auth for portal LLM calls (extraction, consolidation, decomposition,
- * reflection). Mirrors `memoryEngine`'s `EmbeddingOptions` dual-auth:
- *
- * - `apiKey`: For direct API keys (uses x-api-key header)
- * - `getToken`: For Privy identity tokens (uses Authorization: Bearer header)
- *
- * At least one of `apiKey` or `getToken` must be provided (enforced at
- * runtime); `apiKey` takes precedence when both are set.
- *
- * @public
- */
-interface PortalLlmAuth {
-    /** Direct API key — sent as `x-api-key` (server-side / CLI usage). Wins when both are provided. */
-    apiKey?: string;
-    /** Function to get an auth token (e.g., Privy's getIdentityToken). Token is sent as `Authorization: Bearer`. */
-    getToken?: () => Promise<string | null>;
-}
-
+declare function injectionSignatureCatalog(): {
+    id: string;
+    reason: InjectionReason;
+}[];
+
 /**
  * Linear recency decay multiplier — applied post-fusion to nudge fresh
  * memories above stale ones with otherwise comparable scores.
@@ -5057,6 +4781,23 @@ interface MemoryVaultSearchOptions {
     scopes?: string[];
     /** When provided, only search memories in this folder (null for unfiled) */
     folderId?: string | null;
+    /** Typed memory (PR1) — when provided, only search memories of these fact
+     * types. Applied at load time via `Q.oneOf` on the indexed `fact_type`
+     * column. Omit for no type filter. */
+    factTypes?: string[];
+    /**
+     * PR5 — optional per-FactType score multiplier applied in the boost stage
+     * (e.g. `{ identity: 1.2, ongoing_context: 0.8 }`). Empty/omitted = uniform
+     * (no behavior change). See {@link rankFusedVaultMemories}.
+     */
+    factTypeWeights?: Record<string, number>;
+    /**
+     * PR5 — include archived (decayed) rows in the candidate load. Default false
+     * (the baseVaultConditions choke point excludes them). retain()'s dedup
+     * search sets this so a re-observed fact can merge into — and un-archive — an
+     * archived row instead of creating a fresh duplicate.
+     */
+    includeArchived?: boolean;
     /**
      * Use the hybrid fusion ranker (cosine + BM25 + RRF + recency) instead of
      * cosine-only. Default true — new W1 pipeline. Pass false to fall back
@@ -5151,6 +4892,10 @@ interface VaultSearchResult {
     eventTimeStart?: number | null;
     eventTimeEnd?: number | null;
     eventTimeKind?: "point" | "range" | "ongoing" | null;
+    /** Typed memory (PR1) — the fact's FactType, threaded through from the
+     * storage row alongside the event-time anchors. Null/undefined when
+     * untyped. Loose string (originates from a stored column). */
+    factType?: string | null;
     /** Message ids this fact was extracted from (provenance). recall() uses
      * these to suppress the originating chunk in the chunk lane. */
     sourceChunkIds?: string[] | null;
@@ -5240,6 +4985,14 @@ interface RankedMemory {
     eventTimeStart?: number | null;
     eventTimeEnd?: number | null;
     eventTimeKind?: "point" | "range" | "ongoing" | null;
+    /**
+     * Typed memory (PR1) — the extractor's FactType classification for this
+     * fact, threaded through the same channel as the event-time anchors so
+     * recall results (and UI) can show the type without a second DB read.
+     * Null/undefined on legacy/untyped/manual facts. Kept as a loose string
+     * (not narrowed to FactType) since it originates from a stored column.
+     */
+    factType?: string | null;
     conversationId?: string;
     messageId?: string;
     role?: "user" | "assistant";
@@ -5261,6 +5014,18 @@ interface RecallOptions {
     scopes?: string[];
     /** Vault folder filter. Vault-only. */
     folderId?: string | null;
+    /**
+     * Typed memory (PR1) — restrict fact recall to these FactTypes. Optional
+     * and no-op when unset (all types are eligible). Vault-only.
+     */
+    factTypes?: FactType[];
+    /**
+     * PR5 — optional per-FactType score multiplier applied in the fusion boost
+     * stage (e.g. boost `identity`/`constraint`, down-weight `ongoing_context`).
+     * A type absent from the map (and untyped rows) uses 1.0, so an empty/omitted
+     * map is a no-op (uniform weighting). Vault-only.
+     */
+    factTypeWeights?: Partial<Record<FactType, number>>;
     /** Restrict chunk search to one conversation. Chunk-only. */
     conversationId?: string;
     /** Exclude one conversation from chunk search. Chunk-only. */
@@ -5313,416 +5078,1063 @@ interface RecallOptions {
     bm25AdmissionDivisor?: number;
     /** RRF smoothing constant for lane fusion (facts × chunks and side lanes). Default: 60. */
     rrfK?: number;
+    /** Total graph hops incl. the seed lookup (hop 1). Default: 1 (seed only). */
+    maxHops?: number;
+    /** Max neighbor entities expanded per hop. Default: 8. */
+    entityFanout?: number;
+    /** Hard cap on accumulated memory IDs across all hops. Default: 64. */
+    nodeBudget?: number;
+    /**
+     * PR5 — enable LLM graph path-refinement: at each traversal hop a model picks
+     * which neighbor entities to expand instead of pure co-occurrence ranking.
+     * Opt-in (default false); only active on the `high` budget (needs the
+     * `traverse` flag) AND when `decomposeOptions` is set (reuses that auth).
+     * Falls back to deterministic co-occurrence order on any error. Adds ≤1 LLM
+     * call per expansion hop.
+     */
+    graphRefine?: boolean;
+}
+interface RecallContext {
+    /** Required when `types` includes 'fact'. */
+    vaultCtx?: VaultMemoryOperationsContext;
+    /** Required when `types` includes 'chunk'. */
+    storageCtx?: StorageOperationsContext;
+    /** Embedding API options. */
+    embeddingOptions: EmbeddingOptions;
+    /** Vault embedding LRU cache. */
+    vaultCache?: VaultEmbeddingCache;
+    /**
+     * Optional chunk-vector LRU cache. When provided, the chunk lane skips the
+     * per-query decrypt + JSON.parse of every message's chunk vectors on warm
+     * entries. Build via `createChunkVectorCache`. Omit for legacy behavior.
+     */
+    chunkCache?: ChunkVectorCache;
+    /**
+     * Optional — when provided, recall extracts entities from the query
+     * and adds a graph lane to the RRF fusion (memories sharing entities
+     * with the query rank higher). Build via `entityCollection` +
+     * `memoryEntityCollection` from your DatabaseManager.
+     */
+    entityCtx?: EntityOperationsContext;
+}
+interface RecallResult {
+    memories: RankedMemory[];
+    /** Diagnostic: budget actually used (may downgrade if reranker fails). */
+    usedBudget: Budget;
+    /** Diagnostic: was the reranker invoked? */
+    reranked: boolean;
+    /** Diagnostic: total candidates considered before truncation. */
+    candidateCount: number;
+    /** Diagnostic: total memories in the vault when fact lane was queried. */
+    vaultSize?: number;
+}
+/** Soft-degradation signals surfaced via {@link RecallDiagnostics.degraded}. */
+type RecallDegradation = 
+/** Rerank was requested (budget mid/high) but the cross-encoder didn't run
+ *  this call — unavailable (e.g. React Native) or a transient failure. */
+"rerank-unavailable"
+/** `budget: 'high'` requested but no `decomposeOptions`, so query
+ *  decomposition was skipped and the budget downgraded to mid. */
+ | "decompose-unavailable";
+/**
+ * Per-call recall observability payload (see {@link RecallOptions.onDiagnostics}).
+ * All timings are wall-clock milliseconds. Lane counts are post-dedupe,
+ * pre-fusion. Intended to be forwarded to a metrics sink (e.g. PostHog).
+ */
+interface RecallDiagnostics {
+    /** Budget actually executed (may have downgraded from the requested one). */
+    usedBudget: Budget;
+    /** Whether the cross-encoder actually reranked the fact lane this call. */
+    reranked: boolean;
+    /** Total candidates considered before truncation. */
+    candidateCount: number;
+    /** Total vault size when the fact lane ran (absent if it didn't). */
+    vaultSize?: number;
+    /** Facts the fact lane returned (post-dedupe, pre-fusion). */
+    factCount: number;
+    /** Chunks the chunk lane returned (post-dedupe, pre-fusion). */
+    chunkCount: number;
+    /** Wall-clock phase timings (ms). */
+    timings: {
+        /** Whole `recall()` call. */
+        total: number;
+        /** Parallel query-embed + graph/temporal side-lane build. */
+        prep: number;
+        /** Vault fact-lane search (`searchVaultMemoriesWithSize`). */
+        factLane: number;
+        /** Chunk-lane search (`searchChunksOp`). */
+        chunkLane: number;
+        /** Cross-lane RRF fusion + provenance dedup after both lanes. */
+        fuse: number;
+    };
+    /** Soft-degradation signals that fired this call (empty when clean). */
+    degraded: RecallDegradation[];
+}
+type RetainAction = "create" | "merge" | "update" | "skip" | "suppressed" | "supersede";
+type RetainSource = "manual" | "auto-extracted" | "capsule";
+/** Why the consolidator fell back to "create" instead of a real decision. */
+type ConsolidationFallbackReason = "llm_error" | "invalid_response";
+interface RetainOptions {
+    source?: RetainSource;
+    sourceChunkIds?: string[];
+    scope?: string;
+    folderId?: string | null;
+    /** When provided, applies merge-on-write logic instead of plain insert. */
+    enableAutoMerge?: boolean;
+    /**
+     * When true, a would-be create is suppressed if it matches a soft-deleted
+     * ("tombstoned") memory above the auto-merge threshold — so auto-extraction
+     * can't silently resurrect a fact the user deleted. Off by default so manual
+     * and other `retain()` callers are unaffected; auto-extraction opts in.
+     * Returns `action: 'suppressed'` with the matched `tombstoneId`.
+     */
+    respectTombstones?: boolean;
+    /** Cosine similarity threshold for auto-merge. Default: 0.85. */
+    autoMergeThreshold?: number;
+    /**
+     * When provided, runs an LLM-based consolidation pass against the top-K
+     * existing memories above `consolidateThreshold` (looser than auto-merge).
+     * The LLM emits create/update/noop per Hindsight's facet-dedup rules.
+     * Auth/endpoint required — one of `apiKey` / `getToken` (see
+     * {@link PortalLlmAuth}); without this option we keep the cosine-only path.
+     */
+    consolidateOptions?: PortalLlmAuth & {
+        baseUrl?: string;
+        model?: string;
+        /**
+         * Invoked when the consolidator degrades to its "create" fallback
+         * instead of returning a real decision — `llm_error` for network /
+         * timeout / unparseable output, `invalid_response` for well-formed
+         * JSON that violates the schema (unknown action, bad targetId).
+         * A flaky consolidator silently accumulates duplicate memories;
+         * wire this to logging/metrics so the fallback rate is observable.
+         */
+        onFallback?: (reason: ConsolidationFallbackReason) => void;
+        /**
+         * When set, the new fact and existing candidates are PII-redacted before
+         * the consolidation model sees them and the result is de-anonymized before
+         * persistence. Auto-extraction inherits this from its `extract` options.
+         */
+        piiRedaction?: boolean | PiiRedactor;
+    };
+    /** Cosine similarity floor for the consolidator candidate set. Default: 0.65. */
+    consolidateThreshold?: number;
+    /** Top-K consolidation candidates to feed the LLM. Default: 5. */
+    consolidateTopK?: number;
+    /**
+     * W6 temporal lane — when the event in this fact occurred. Persisted to
+     * memory_vault.event_time_* columns; recall's temporal lane filters
+     * and boosts memories whose event-time overlaps the query window.
+     * Auto-extraction emits this; manual writes can omit it.
+     */
+    eventTime?: {
+        kind: "point" | "range" | "ongoing";
+        start: number;
+        end: number | null;
+    } | null;
+    /**
+     * Typed memory (PR1) — the extractor's classification for this fact.
+     * Persisted on create; on merge/consolidate it lazily backfills the target
+     * only when the target has no type yet (never overwrites a non-null type).
+     * Auto-extraction emits this; manual writes omit it (persisted as null).
+     */
+    factType?: FactType;
+    /**
+     * Tier-0 security (PR3) — trust tier for this fact. The write-time
+     * injection screen threads `"quarantined"` here for flagged candidates;
+     * omit for the default (null/trusted). Persisted only on create (a
+     * quarantined candidate is force-created, never merged, so it can't bump
+     * or contaminate a clean memory). The DB op re-validates the value
+     * against the known set before writing.
+     */
+    trustTier?: string;
+}
+interface RetainResult {
+    action: RetainAction;
+    memoryId: string;
+    /** When action is 'merge' or 'update', the prior memory's id. When action is
+     * 'supersede', the stale memory that was retired (`memoryId` is the new one). */
+    targetId?: string;
+    /**
+     * When action is 'suppressed', the id of the soft-deleted memory that blocked
+     * re-creation. `memoryId` is set to the same id (no new memory was written).
+     */
+    tombstoneId?: string;
+    /** Updated proof_count after this write. 0 when nothing was written (suppressed). */
+    proofCount: number;
+}
+
+/**
+ * Retain API — single write surface for the unified memory layer with
+ * write-time auto-merge.
+ *
+ * On write, retain() searches for the nearest existing memory and, if its
+ * cosine similarity to the new content exceeds the auto-merge threshold,
+ * folds the new fact into the existing record (incrementing proof_count
+ * and unioning source_chunk_ids). Otherwise it inserts a new memory.
+ *
+ * This is the W4 (auto-merge / dedup) workstream made callable. The W2
+ * auto-extraction worker uses retain() as its write step, with the LLM
+ * resolver upstream deciding when auto-merge should be enabled vs when
+ * a semantic update should be applied via the lower-level update op.
+ */
+
+interface RetainContext {
+    vaultCtx: VaultMemoryOperationsContext;
+    embeddingOptions: EmbeddingOptions;
+    vaultCache: VaultEmbeddingCache;
+}
+/**
+ * Persist a memory, merging into the nearest existing record if its
+ * cosine similarity exceeds the auto-merge threshold.
+ *
+ * Default behavior (autoMerge ON): proof_count increments on the merged
+ * target, source_chunk_ids accumulate (union), content is left untouched.
+ * The caller doesn't see a duplicate and the original memory's UI badge
+ * shows it has been re-observed.
+ *
+ * Pass `enableAutoMerge: false` for a force-create (W2 resolver path
+ * after it has explicitly decided "create new").
+ */
+declare function retain(content: string, ctx: RetainContext, options?: RetainOptions): Promise<RetainResult>;
+
+/**
+ * Auto-extraction worker — W2.
+ *
+ * After each assistant turn, this pipeline reads the recent conversation,
+ * asks an LLM to identify durable user facts, and writes them to the
+ * vault via retain(). The user never needs to ask Anuma to remember
+ * something — durable facts are captured automatically.
+ *
+ * Two-stage pipeline (extract → retain). The retain step uses
+ * write-time auto-merge (W4) so the same fact re-observed in a later
+ * conversation increments proof_count instead of duplicating.
+ *
+ * Spec: see `tasks/hackathon/auto-extraction-prompt.md`.
+ */
+
+declare const FACT_TYPES: readonly ["identity", "preference", "relationship", "plan", "ongoing_context", "constraint", "other"];
+type FactType = (typeof FACT_TYPES)[number];
+interface AutoExtractMessage {
+    /** Stable message identifier — used for source_chunk_ids provenance. */
+    id: string;
+    role: "user" | "assistant";
+    content: string;
+}
+/**
+ * A named entity extracted from the conversation, with an optional
+ * classification. `kind` is omitted when the model gave no kind or an
+ * unrecognized one — see {@link validateCandidates}.
+ */
+interface ExtractedEntity {
+    name: string;
+    kind?: EntityKind;
+}
+interface ExtractedCandidate {
+    content: string;
+    type: FactType;
+    confidence: number;
+    sourceMessageIds: string[];
+    entities: ExtractedEntity[];
+    /** W6 temporal lane — when the event in this fact occurred. Resolved
+     *  to absolute timestamps by the LLM; null when the fact has no
+     *  temporal anchor. */
+    eventTime: {
+        kind: "point" | "range" | "ongoing";
+        /** Unix ms timestamp of the event start (or point). */
+        start: number;
+        /** Unix ms timestamp of the event end. Only set when kind='range'. */
+        end: number | null;
+    } | null;
+}
+/**
+ * Tier-0 security (PR3) — describes a candidate the injection screen
+ * quarantined and persisted as an audit row. The client uses this to surface
+ * a "held for review" state. `content` lives on `candidate` (same exposure as
+ * {@link ExtractedCandidate}); never log it.
+ */
+interface QuarantinedMemoryInfo {
+    candidate: ExtractedCandidate;
+    /** The persisted (quarantined) memory row id. */
+    memoryId: string;
+    /** Coarse reason bucket from the screen. */
+    reason: InjectionReason;
+    /** Stable signature id that matched (safe to log; carries no content). */
+    signature: string;
+}
+/**
+ * Auth + endpoint for the extraction LLM call. Auth is the dual pattern —
+ * one of `apiKey` / `getToken` is required at runtime; see
+ * {@link PortalLlmAuth}.
+ */
+interface ExtractFactsOptions extends PortalLlmAuth {
+    baseUrl?: string;
+    model?: string;
+    /** Override the global fetch implementation (useful for tests). */
+    fetchFn?: typeof fetch;
+    /**
+     * The user's own name(s) / handle(s) (e.g. profile nickname, wallet display
+     * name). Candidates whose entire content is just one of these are dropped —
+     * a personal memory system already knows who the user is, so "Peter Lee" is
+     * circular noise. Optional; when omitted only the bare-fragment gate applies.
+     */
+    userIdentity?: string[];
+    /**
+     * Reference "now" (Unix ms) for resolving relative temporal phrases in the
+     * transcript ("yesterday", "next week", "in two days") into the absolute
+     * YYYY-MM-DD anchors the W6 temporal lane indexes on. The transcript itself
+     * carries no timestamps, so without an anchor the model resolves relatives
+     * against its own training-cutoff guess and emits wrong `eventTime` dates.
+     * Defaults to `Date.now()`. Override for back-dated eval corpora and
+     * deterministic tests (mirrors {@link RecallOptions.now}).
+     *
+     * Server-side timezone note: the ms value is formatted to a calendar date in
+     * the process's local timezone (same basis as `parseLocalCalendarDay`). On a
+     * UTC server, a user near midnight in a non-UTC offset can get the wrong
+     * calendar day. Pass the user's local-midnight timestamp as `now` when the
+     * process timezone doesn't match the user's.
+     */
+    now?: number;
+    /**
+     * Max attempts for the extraction call on a transient failure (default 3).
+     * Lower it to bound how long extraction can hold a turn open — e.g. a worker
+     * that runs extraction behind an in-flight-turn guard can pass `2` to keep
+     * repeated failures from delaying later turns.
+     */
+    maxAttempts?: number;
+    /** Per-attempt timeout (ms) for the extraction call. Defaults to the portal
+     * helper's 60s. Combine with {@link maxAttempts} to cap the total time budget. */
+    timeoutMs?: number;
+    /**
+     * Absolute wall-clock budget (ms) across ALL extraction attempts incl. backoff.
+     * When set, the loop stops before an attempt that would exceed it, so worst-case
+     * latency is bounded rather than `maxAttempts × timeoutMs`.
+     */
+    totalTimeoutMs?: number;
+    /**
+     * Override the retry backoff (ms) for a given 1-based attempt index. The
+     * extraction call retries transient failures internally (default exponential
+     * backoff); pass `() => 0` to retry without delay (useful for tests).
+     */
+    backoffMs?: (attempt: number) => number;
+    /**
+     * When set, PII (emails, phones, SSNs, cards, IPs, API keys, …) in the
+     * conversation transcript is replaced with tagged placeholders before the
+     * extraction call, and the returned facts + entities are de-anonymized so the
+     * vault keeps the real values while raw PII never reaches the extraction
+     * model (and, via `extractAndRetain`, the consolidation model). Pass `true`
+     * for a fresh per-call redactor, or a shared {@link PiiRedactor} to keep
+     * placeholder numbering consistent with other calls.
+     *
+     * NOTE: this does NOT cover the embeddings provider. Facts are stored and
+     * embedded with their real values, so to keep PII out of embedding requests
+     * set `RetainContext.embeddingOptions.maskInput` (e.g. `redactor.maskText`)
+     * as well — the two are independent switches.
+     */
+    piiRedaction?: boolean | PiiRedactor;
+    /**
+     * Called when the extraction LLM returned no usable result after exhausting
+     * its retries (empty/malformed completion, network/HTTP error) — i.e. a
+     * *failure* that drops the turn's facts, as opposed to a legitimate
+     * `{candidates: []}` "nothing durable here". Lets callers distinguish a
+     * silently-degrading extractor from quiet turns (the two are otherwise
+     * indistinguishable). See {@link extractAndRetain}'s `outcome`.
+     */
+    onExhaustedEmpty?: () => void;
+    /**
+     * Called when the extractor DID produce candidates but PII de-anonymization
+     * dropped every one of them — the model mangled its placeholders (so they
+     * can't be restored to real values) or restoring the values blew the length
+     * cap. These drops happen before `retain()`, so `failedCount` can't see them,
+     * and the turn would otherwise masquerade as a quiet `no-facts` result. Lets
+     * H3's `outcome` surface `dropped-after-redaction` so a rising PII-drop rate
+     * (i.e. redaction silently eating facts) is alarmable.
+     */
+    onCandidatesDropped?: () => void;
+}
+/**
+ * Stage 1 — call the LLM to extract candidate facts from the recent
+ * conversation. Returns post-validated candidates only (confidence
+ * threshold, source-id check, length cap, schema validation). Returns
+ * an empty array if the LLM emits malformed JSON or no candidates.
+ *
+ * A null from `callPortalJsonCompletion` means a *failure* (empty completion,
+ * malformed JSON, network/HTTP error) — distinct from a successful
+ * `{candidates: []}`, which parses to a non-null object. A failed extraction
+ * silently drops the whole turn's memories, so transient failures matter:
+ * `callPortalJsonCompletion` retries them internally with backoff (default 3
+ * attempts), so a one-off empty/malformed completion from a reasoning-class
+ * model doesn't lose the turn. Only an exhausted-retry null reaches here.
+ */
+declare function extractFacts(messages: AutoExtractMessage[], options: ExtractFactsOptions): Promise<ExtractedCandidate[]>;
+/**
+ * Outcome of the EXTRACTOR stage for a turn — independent of whether the
+ * subsequent `retain()` writes landed (that's `failedCount`):
+ * - `extracted`         — the extractor produced at least one candidate above
+ *                         the confidence floor. Whether those writes succeeded
+ *                         is reported separately by `failedCount` — so
+ *                         `extracted` + `failedCount > 0` means "found facts but
+ *                         writes are failing", which is more signal than
+ *                         collapsing it into `no-facts` would give.
+ * - `no-facts`          — the extractor ran fine but found nothing durable.
+ * - `empty-after-retry` — the extractor returned empty/malformed after
+ *                         exhausting retries (a *failure*). Distinguishing this
+ *                         from `no-facts` is what makes a silently-degrading
+ *                         extractor alarmable rather than invisible.
+ * - `dropped-after-redaction` — the extractor found facts but PII
+ *                         de-anonymization dropped every one (mangled
+ *                         placeholders / over-cap after restore), before retain.
+ *                         A degradation `failedCount` can't see; would otherwise
+ *                         look like `no-facts`.
+ */
+type ExtractOutcome = "extracted" | "no-facts" | "empty-after-retry" | "dropped-after-redaction";
+/**
+ * Stage 2 — for each extracted candidate, call retain() with auto-merge
+ * enabled. When `consolidateOptions` are wired, retain()'s consolidation pass
+ * is the "resolver": a second LLM call against the top-K existing vault
+ * memories that decides create/update/noop/supersede — including retiring a
+ * stale value on a state change (the supersession the extraction prompt above
+ * promises). Without consolidation, retain() still dedups at the cosine-merge
+ * level, and the read-time supersession heuristic remains the fallback.
+ *
+ * Returns the candidates that survived validation along with the retain
+ * result for each (which captures whether the fact was created, merged,
+ * or skipped), plus an `outcome` summarizing why the turn did/didn't produce
+ * facts (see {@link ExtractOutcome}).
+ */
+declare function extractAndRetain(messages: AutoExtractMessage[], retainCtx: RetainContext, options: {
+    extract: ExtractFactsOptions;
+    minConfidence?: number;
+    /** Override scope/folder for all retained facts. */
+    scope?: string;
+    folderId?: string | null;
+    /**
+     * Forwarded verbatim to each retain() call — enables the LLM-based
+     * consolidation pass (Hindsight facet-dedup) on every write. See
+     * `RetainOptions.consolidateOptions` for auth + observability fields.
+     */
+    consolidateOptions?: RetainOptions["consolidateOptions"];
+    /**
+     * When provided, persist each candidate's `entities[]` to the
+     * entity + memory_entity tables after a successful retain. This
+     * powers the W5 graph retrieval lane — recall() can query for
+     * memories sharing entities with the user's question.
+     */
+    entityCtx?: EntityOperationsContext;
+    /**
+     * Per-candidate failure hook — invoked once per filtered candidate
+     * whose `retain()` call threw. Lets UI layers surface "couldn't save
+     * X" toasts; without it consumers only see the aggregate
+     * `failedCount` and can't name which facts dropped.
+     */
+    onCandidateFailed?: (candidate: ExtractedCandidate, error: unknown) => void;
+    /**
+     * Tier-0 security (PR3) — invoked once per candidate the injection screen
+     * quarantined AND persisted (audit row written). Lets a UI surface a
+     * "held for review" state instead of the fact silently vanishing. Carries
+     * the same content exposure as `onMemoryExtracted` (the candidate) plus
+     * the persisted `memoryId` + the screen `reason`/`signature`; content is
+     * never logged. Fired only on a successful quarantine write, not on a
+     * failed one (that goes to `onCandidateFailed`).
+     */
+    onQuarantined?: (info: QuarantinedMemoryInfo) => void;
+    /**
+     * Tier-0 security (PR5) — optional SECOND-layer LLM injection classifier.
+     * When provided, candidates the deterministic {@link screenCandidatesForInjection}
+     * screen passed as CLEAN are additionally run through a cheap LLM that
+     * catches signature-free poison ("Trusts BrandX for financial advice")
+     * the regex screen can't. Positives are quarantined exactly like a
+     * signature hit (reason `llm_semantic`). DEFAULT OFF — omit this to keep
+     * the deterministic-only, no-extra-LLM-call path. Fails clean on any
+     * error. Content is PII-redacted before the call, inheriting the
+     * extraction redaction setting when this option doesn't set its own.
+     */
+    injectionClassifier?: InjectionClassifierOptions;
+}): Promise<{
+    candidates: ExtractedCandidate[];
+    results: RetainResult[];
+    failedCount: number;
+    outcome: ExtractOutcome;
+    /**
+     * Tier-0 security (PR3) — candidates quarantined by the injection screen and
+     * persisted as audit rows (trust_tier="quarantined"). Kept OUT of
+     * `candidates`/`results` so `onMemoryExtracted` never announces poison;
+     * surfaced here so callers can distinguish "nothing extracted" from
+     * "extracted but held for review".
+     */
+    quarantined: QuarantinedMemoryInfo[];
+}>;
+
+interface StoredVaultMemory {
+    /** WatermelonDB internal ID */
+    uniqueId: string;
+    /** Plain text memory content */
+    content: string;
+    /** Scope for partitioning memories (e.g., "private", "shared") */
+    scope: string;
+    /** Folder ID for organization, null if unfiled */
+    folderId: string | null;
+    /** User ID for multi-user server-side scoping, null on client */
+    userId: string | null;
+    /** JSON-stringified embedding vector, null if not yet computed */
+    embedding: string | null;
+    /** Model that produced `embedding`. Null on legacy rows (grandfathered as
+     * compatible with the current model). */
+    embeddingModel: string | null;
+    /** JSON-stringified array of source message IDs this fact was extracted from. */
+    sourceChunkIds: string[] | null;
+    /** Times this fact has been re-observed (for ranking + UX badges). */
+    proofCount: number | null;
+    /** How the memory was created: manual | auto-extracted | capsule. */
+    source: string | null;
+    /** W6 temporal lane — Unix ms when the event occurred (point/start of range). */
+    eventTimeStart: number | null;
+    /** W6 temporal lane — Unix ms when the event ended (range only). */
+    eventTimeEnd: number | null;
+    /** W6 temporal lane — `point | range | ongoing | null`. */
+    eventTimeKind: string | null;
+    /** When true, the user has manually set this memory's topics (entity links);
+     * auto-extraction leaves them alone. False on legacy/auto rows. */
+    topicsUserManaged: boolean;
+    /** Unix ms of the last LLM topic-extraction pass over this memory's content.
+     * Null = never extracted standalone; rows that already carry entity links
+     * are grandfathered as extracted (see getMemoriesNeedingTopicExtractionOp). */
+    topicsExtractedAt: number | null;
+    /** Write-time supersession (A2): id of the newer memory that replaced this
+     * one (incompatible-value update, e.g. "Lives in Portland" → "Lives in SF").
+     * Null = live. Superseded rows are excluded from recall/dedup by default but
+     * kept for history + the read-time fallback. */
+    supersededBy: string | null;
+    /** Unix ms when this memory was superseded. Null when live. */
+    supersededAt: number | null;
+    /** Extraction-logic version this memory was last stamped under. Null (pre-v38)
+     * reads as 0, so a TOPICS_EXTRACTION_VERSION bump re-extracts stale rows. */
+    topicsExtractedVersion: number | null;
+    /** C3 re-observation watermark: Unix ms of the last retain() merge into this
+     * fact. Distinct from `updatedAt` (which merges preserve). Null = never
+     * re-observed since the column was added; synthesis falls back to
+     * `updatedAt` in that case. */
+    lastObservedAt: number | null;
+    /** Typed memory (PR1) — the extractor's FactType for this fact, or null on
+     * legacy/manual/untyped rows. Plaintext string (not narrowed to FactType
+     * here since the DB can hold any stored value). */
+    factType: string | null;
+    /** Decay archive state (PR2) — Unix ms when archived, or null when active. */
+    archivedAt: number | null;
+    /** Tier-0 security (PR3) — "quarantined" | "trusted" | null. */
+    trustTier: string | null;
+    createdAt: Date;
+    updatedAt: Date;
+    isDeleted: boolean;
+}
+interface CreateVaultMemoryOptions {
+    content: string;
+    /** Scope for the memory. Defaults to "private" if omitted. */
+    scope?: string;
+    /** Folder ID for organization, null or omitted if unfiled */
+    folderId?: string | null;
+    /** JSON-stringified embedding vector to persist */
+    embedding?: string;
+    /** Model that produced `embedding`. Persisted alongside it so a later
+     * model change can detect and re-embed stale vectors. */
+    embeddingModel?: string;
+    /** Source message IDs that produced this fact (auto-extraction provenance). */
+    sourceChunkIds?: string[];
+    /** Initial proof count. Defaults to 1 if omitted. */
+    proofCount?: number;
+    /** How the memory was created. Defaults to "manual" if omitted. */
+    source?: string;
+    /** W6 temporal lane — when the event in this memory occurred. */
+    eventTime?: {
+        /** Unix ms timestamp of event start (or point). */
+        start: number | null;
+        /** Unix ms timestamp of event end (range only). */
+        end: number | null;
+        /** Kind: 'point' | 'range' | 'ongoing' | null (or omit). */
+        kind: "point" | "range" | "ongoing" | null;
+    };
+    /** Typed memory (PR1) — the extractor's classification for this fact.
+     * Omit for manual/untyped saves (persisted as null). */
+    factType?: FactType;
+    /** Tier-0 security (PR3) — set "quarantined" when the injection screen
+     * flagged this fact. Omit for the default (null/trusted). */
+    trustTier?: string;
+}
+interface UpdateVaultMemoryOptions {
+    content: string;
+    /** If provided, updates the memory's scope. */
+    scope?: string;
+    /** If provided, moves the memory to this folder. */
+    folderId?: string | null;
+    /** JSON-stringified embedding vector to persist, or null to clear stale embedding */
+    embedding?: string | null;
+    /** Model that produced `embedding`. Set whenever `embedding` is written so
+     * the stored model tag stays in sync with the vector. */
+    embeddingModel?: string | null;
+    /** Replace source-chunk-ids list (used during merge to accumulate provenance). */
+    sourceChunkIds?: string[];
+    /** Set an absolute proof count. Prefer {@link proofCountIncrement} for
+     * re-observation paths so the read+write happens inside the writer
+     * and concurrent retains can't lose updates. */
+    proofCount?: number;
+    /** Atomically bump proof_count by this delta inside the write block.
+     * Reads the current value from the in-memory record at write time, so
+     * two parallel retain() calls observe each other's commits and neither
+     * loses its increment. Wins over `proofCount` when both are set. */
+    proofCountIncrement?: number;
+    /** Set source ("manual" | "auto-extracted" | "capsule"). */
+    source?: string;
+    /**
+     * W6 temporal lane — write the event-time fields on update. Use during
+     * auto-merge to preserve (or refine) the original event-time signal when
+     * a new observation lands on an existing fact. Omit to leave the
+     * existing values untouched.
+     */
+    eventTime?: {
+        start: number | null;
+        end: number | null;
+        kind: "point" | "range" | "ongoing" | null;
+    };
+    /**
+     * When true, restore the existing `updated_at` after the write so the
+     * recency multiplier doesn't see a re-observation as a brand-new fact.
+     * Set by auto-merge/consolidate paths — they want proof_count to bump
+     * without inflating recency on top.
+     */
+    preserveUpdatedAt?: boolean;
+    /** C3: Unix ms to stamp as the re-observation watermark (`last_observed_at`).
+     * Set by retain() merge/consolidate paths so a re-observation records "seen
+     * again now" without touching `updated_at` (which `preserveUpdatedAt` keeps
+     * pinned). Omit to leave the existing value untouched. */
+    lastObservedAt?: number;
+    /** If provided, sets whether the user has taken manual control of this
+     * memory's topics. Set by {@link setMemoryEntitiesOp}. */
+    topicsUserManaged?: boolean;
+    /** Typed memory (PR1) — set/refine the fact's classification on update.
+     * Used by retain()'s lazy backfill (adopt an incoming type only when the
+     * existing row has none). Omit to leave the existing value untouched. */
+    factType?: FactType;
+    /** Tier-0 security (PR3) — set the trust tier on update ("quarantined" |
+     * "trusted"). Omit to leave the existing value untouched. */
+    trustTier?: string;
+    /**
+     * PR5 — un-archive on re-observe. When true, clears `archived_at` (null) as
+     * part of the write, resurrecting a decayed row that a new observation just
+     * merged into. retain() sets this (with `preserveUpdatedAt` OFF) so the
+     * restored row's decay clock resets and it doesn't immediately re-archive.
+     * Omit/false to leave `archived_at` untouched.
+     */
+    restore?: boolean;
 }
-interface RecallContext {
-    /** Required when `types` includes 'fact'. */
-    vaultCtx?: VaultMemoryOperationsContext;
-    /** Required when `types` includes 'chunk'. */
-    storageCtx?: StorageOperationsContext;
-    /** Embedding API options. */
-    embeddingOptions: EmbeddingOptions;
-    /** Vault embedding LRU cache. */
-    vaultCache?: VaultEmbeddingCache;
+
+interface VaultMemoryOperationsContext {
+    database: Database;
+    vaultMemoryCollection: Collection<VaultMemory>;
+    walletAddress?: string;
+    signMessage?: SignMessageFn;
+    embeddedWalletSigner?: EmbeddedWalletSignerFn;
+    /** When set, operations scope to this user (server-side multi-user). */
+    userId?: string;
     /**
-     * Optional chunk-vector LRU cache. When provided, the chunk lane skips the
-     * per-query decrypt + JSON.parse of every message's chunk vectors on warm
-     * entries. Build via `createChunkVectorCache`. Omit for legacy behavior.
+     * Asserts this context runs against a physically single-tenant database — one
+     * where every row belongs to the same owner (the per-wallet client DBs, which
+     * hold exactly one wallet's rows written with `user_id = null`). This is the
+     * ONLY thing that makes the decay sweep's unscoped scan/archive/delete safe
+     * without a `userId`: see {@link assertVaultScopeForSweep}. A shared /
+     * multi-tenant DB must NOT set this — it must scope by `userId` instead.
+     * `walletAddress` presence alone is NOT a substitute (the sweep query filters
+     * by `user_id` only, so a bare `walletAddress` on a shared DB would sweep
+     * every tenant).
      */
-    chunkCache?: ChunkVectorCache;
+    singleTenant?: boolean;
     /**
-     * Optional — when provided, recall extracts entities from the query
-     * and adds a graph lane to the RRF fusion (memories sharing entities
-     * with the query rank higher). Build via `entityCollection` +
-     * `memoryEntityCollection` from your DatabaseManager.
+     * When set, vault delete ops cascade to memory_entity rows pointing at
+     * the deleted memories. Without this the W5 graph lane keeps returning
+     * IDs of soft-deleted memories and the join table grows unbounded.
      */
     entityCtx?: EntityOperationsContext;
 }
-interface RecallResult {
-    memories: RankedMemory[];
-    /** Diagnostic: budget actually used (may downgrade if reranker fails). */
-    usedBudget: Budget;
-    /** Diagnostic: was the reranker invoked? */
-    reranked: boolean;
-    /** Diagnostic: total candidates considered before truncation. */
-    candidateCount: number;
-    /** Diagnostic: total memories in the vault when fact lane was queried. */
-    vaultSize?: number;
-}
-/** Soft-degradation signals surfaced via {@link RecallDiagnostics.degraded}. */
-type RecallDegradation = 
-/** Rerank was requested (budget mid/high) but the cross-encoder didn't run
- *  this call — unavailable (e.g. React Native) or a transient failure. */
-"rerank-unavailable"
-/** `budget: 'high'` requested but no `decomposeOptions`, so query
- *  decomposition was skipped and the budget downgraded to mid. */
- | "decompose-unavailable";
-/**
- * Per-call recall observability payload (see {@link RecallOptions.onDiagnostics}).
- * All timings are wall-clock milliseconds. Lane counts are post-dedupe,
- * pre-fusion. Intended to be forwarded to a metrics sink (e.g. PostHog).
- */
-interface RecallDiagnostics {
-    /** Budget actually executed (may have downgraded from the requested one). */
-    usedBudget: Budget;
-    /** Whether the cross-encoder actually reranked the fact lane this call. */
-    reranked: boolean;
-    /** Total candidates considered before truncation. */
-    candidateCount: number;
-    /** Total vault size when the fact lane ran (absent if it didn't). */
-    vaultSize?: number;
-    /** Facts the fact lane returned (post-dedupe, pre-fusion). */
-    factCount: number;
-    /** Chunks the chunk lane returned (post-dedupe, pre-fusion). */
-    chunkCount: number;
-    /** Wall-clock phase timings (ms). */
-    timings: {
-        /** Whole `recall()` call. */
-        total: number;
-        /** Parallel query-embed + graph/temporal side-lane build. */
-        prep: number;
-        /** Vault fact-lane search (`searchVaultMemoriesWithSize`). */
-        factLane: number;
-        /** Chunk-lane search (`searchChunksOp`). */
-        chunkLane: number;
-        /** Cross-lane RRF fusion + provenance dedup after both lanes. */
-        fuse: number;
-    };
-    /** Soft-degradation signals that fired this call (empty when clean). */
-    degraded: RecallDegradation[];
-}
-type RetainAction = "create" | "merge" | "update" | "skip" | "suppressed" | "supersede";
-type RetainSource = "manual" | "auto-extracted" | "capsule";
-/** Why the consolidator fell back to "create" instead of a real decision. */
-type ConsolidationFallbackReason = "llm_error" | "invalid_response";
-interface RetainOptions {
-    source?: RetainSource;
-    sourceChunkIds?: string[];
-    scope?: string;
+declare function createVaultMemoryOp(ctx: VaultMemoryOperationsContext, opts: CreateVaultMemoryOptions): Promise<StoredVaultMemory>;
+declare function createVaultMemoriesBatchOp(ctx: VaultMemoryOperationsContext, optionsArray: CreateVaultMemoryOptions[]): Promise<StoredVaultMemory[]>;
+declare function getVaultMemoryOp(ctx: VaultMemoryOperationsContext, id: string): Promise<StoredVaultMemory | null>;
+declare function getAllVaultMemoriesOp(ctx: VaultMemoryOperationsContext, options?: {
+    scopes?: string[];
+    since?: Date;
+    limit?: number;
     folderId?: string | null;
-    /** When provided, applies merge-on-write logic instead of plain insert. */
-    enableAutoMerge?: boolean;
     /**
-     * When true, a would-be create is suppressed if it matches a soft-deleted
-     * ("tombstoned") memory above the auto-merge threshold — so auto-extraction
-     * can't silently resurrect a fact the user deleted. Off by default so manual
-     * and other `retain()` callers are unaffected; auto-extraction opts in.
-     * Returns `action: 'suppressed'` with the matched `tombstoneId`.
+     * Include soft-deleted memories in the result (each carries
+     * `isDeleted: true`). Default `false` — deleted rows are excluded, as
+     * they are from every other read path. Used by the Memory Graph to
+     * render "forgotten" nodes; ordinary consumers should leave this off.
      */
-    respectTombstones?: boolean;
-    /** Cosine similarity threshold for auto-merge. Default: 0.85. */
-    autoMergeThreshold?: number;
+    includeDeleted?: boolean;
+    /** Include archived (decayed) memories. Default `false` (PR1 choke point). */
+    includeArchived?: boolean;
+    /** Include quarantined memories. Default `false` (PR1 choke point). */
+    includeQuarantined?: boolean;
+    /** Typed memory (PR1) — restrict to these fact types. Omit for no filter. */
+    factTypes?: string[];
     /**
-     * When provided, runs an LLM-based consolidation pass against the top-K
-     * existing memories above `consolidateThreshold` (looser than auto-merge).
-     * The LLM emits create/update/noop per Hindsight's facet-dedup rules.
-     * Auth/endpoint required — one of `apiKey` / `getToken` (see
-     * {@link PortalLlmAuth}); without this option we keep the cosine-only path.
+     * Include A2-superseded memories (each carries `supersededBy`). Default
+     * `false` — superseded rows are excluded, as they are from recall/dedup.
+     * Used by a "memory history" view to render retired facts.
      */
-    consolidateOptions?: PortalLlmAuth & {
-        baseUrl?: string;
-        model?: string;
-        /**
-         * Invoked when the consolidator degrades to its "create" fallback
-         * instead of returning a real decision — `llm_error` for network /
-         * timeout / unparseable output, `invalid_response` for well-formed
-         * JSON that violates the schema (unknown action, bad targetId).
-         * A flaky consolidator silently accumulates duplicate memories;
-         * wire this to logging/metrics so the fallback rate is observable.
-         */
-        onFallback?: (reason: ConsolidationFallbackReason) => void;
-        /**
-         * When set, the new fact and existing candidates are PII-redacted before
-         * the consolidation model sees them and the result is de-anonymized before
-         * persistence. Auto-extraction inherits this from its `extract` options.
-         */
-        piiRedaction?: boolean | PiiRedactor;
-    };
-    /** Cosine similarity floor for the consolidator candidate set. Default: 0.65. */
-    consolidateThreshold?: number;
-    /** Top-K consolidation candidates to feed the LLM. Default: 5. */
-    consolidateTopK?: number;
+    includeSuperseded?: boolean;
+}): Promise<StoredVaultMemory[]>;
+declare function getAllVaultMemoryContentsOp(ctx: VaultMemoryOperationsContext, options?: {
+    since?: Date;
+}): Promise<string[]>;
+declare function updateVaultMemoryOp(ctx: VaultMemoryOperationsContext, id: string, opts: UpdateVaultMemoryOptions): Promise<StoredVaultMemory | null>;
+declare function deleteVaultMemoryOp(ctx: VaultMemoryOperationsContext, id: string): Promise<boolean>;
+/**
+ * Mark a memory as superseded by a newer one (A2 write-time supersession).
+ * The row stays in the table (history + read-time fallback) but is excluded
+ * from recall/dedup by default via `superseded_by`. Idempotent-ish: no-op if
+ * the row is missing, not owned, deleted, or already superseded. Does NOT
+ * preserve `updated_at` — superseded rows are hidden from recall, so their
+ * recency is irrelevant.
+ *
+ * @param id - the memory being retired (e.g. "Lives in Portland")
+ * @param supersededById - the newer memory that replaced it (e.g. "Lives in SF")
+ */
+declare function supersedeVaultMemoryOp(ctx: VaultMemoryOperationsContext, id: string, supersededById: string): Promise<boolean>;
+/**
+ * Get all non-deleted, unfiled vault memories (folder_id is null).
+ */
+declare function getUnfiledVaultMemoriesOp(ctx: VaultMemoryOperationsContext): Promise<StoredVaultMemory[]>;
+/**
+ * The current topic-extraction logic version. Bump this whenever the extraction
+ * prompt or model in `topicExtract.ts` changes: every memory stamped under an
+ * older version (including pre-v37 rows, read as version 0) is then re-extracted
+ * by the next sweep, so topic-quality improvements propagate across the existing
+ * vault. The worker's `limit` drains that re-extraction across sweeps.
+ */
+declare const TOPICS_EXTRACTION_VERSION = 1;
+/**
+ * Result of {@link getMemoriesNeedingTopicExtractionOp}: which memories the
+ * background topic worker should run LLM entity extraction on, and which it
+ * should merely stamp as already-extracted.
+ */
+interface MemoriesNeedingTopicExtraction {
     /**
-     * W6 temporal lane — when the event in this fact occurred. Persisted to
-     * memory_vault.event_time_* columns; recall's temporal lane filters
-     * and boosts memories whose event-time overlaps the query window.
-     * Auto-extraction emits this; manual writes can omit it.
+     * Memories to run LLM topic extraction on (decrypted): never-extracted rows
+     * with no entity links, plus stamped rows edited since their last pass
+     * (`updated_at` > `topics_extracted_at`) or extracted under an older
+     * `topics_extracted_version` than {@link TOPICS_EXTRACTION_VERSION}. Edited /
+     * stale-version rows come first (they get priority under `limit`), each group
+     * newest-created first.
      */
-    eventTime?: {
-        kind: "point" | "range" | "ongoing";
-        start: number;
-        end: number | null;
-    } | null;
-}
-interface RetainResult {
-    action: RetainAction;
-    memoryId: string;
-    /** When action is 'merge' or 'update', the prior memory's id. When action is
-     * 'supersede', the stale memory that was retired (`memoryId` is the new one). */
-    targetId?: string;
+    pending: StoredVaultMemory[];
     /**
-     * When action is 'suppressed', the id of the soft-deleted memory that blocked
-     * re-creation. `memoryId` is set to the same id (no new memory was written).
+     * IDs of rows that already have entity links but no watermark — legacy rows
+     * extracted by the conversation pipeline before v36. Grandfather these with
+     * {@link stampTopicsExtractedAtOp} (no LLM call) so a later content edit
+     * makes them re-extractable instead of invisible forever. Bounded by the
+     * same `limit` as {@link pending} — stamping loads a Model per row, so the
+     * grandfather backlog is drained across sweeps rather than in one spike.
      */
-    tombstoneId?: string;
-    /** Updated proof_count after this write. 0 when nothing was written (suppressed). */
-    proofCount: number;
+    linkedUnstamped: string[];
+}
+/**
+ * Sweep query for the background topic-extraction worker: partition the
+ * user's non-deleted, non-user-managed memories by what the worker should do
+ * with them (see {@link MemoriesNeedingTopicExtraction}). User-managed rows
+ * are never returned — the user owns their topics, including an intentionally
+ * empty set. Requires `ctx.entityCtx` for the entity-links check.
+ */
+declare function getMemoriesNeedingTopicExtractionOp(ctx: VaultMemoryOperationsContext, options?: {
+    limit?: number;
+}): Promise<MemoriesNeedingTopicExtraction>;
+/**
+ * Stamp `topics_extracted_at` (and `topics_extracted_version`) on the given
+ * memories — the topic worker calls this after a successful extraction pass
+ * (including zero-entity results, so quiet memories aren't re-asked every sweep)
+ * and to grandfather `linkedUnstamped` rows without an LLM call. `version`
+ * defaults to {@link TOPICS_EXTRACTION_VERSION}: stamping at the current version
+ * (for both fresh extractions and grandfathered legacy rows) means they aren't
+ * re-extracted until a future version bump. Preserves `updated_at` so a stamp
+ * never inflates the recency multiplier — and never masks a concurrent content
+ * edit from the next sweep. Skips deleted, foreign-user, and user-managed rows.
+ * Returns the IDs actually stamped.
+ *
+ * ALL eligibility AND `updated_at` are read from the LIVE Model inside the
+ * serialized writer — never a pre-writer snapshot. Writers are serialized, so
+ * a content edit or topic-override that commits before this writer runs is
+ * observed here: its fresh `updated_at` is preserved (so the next sweep's
+ * `updated_at > stamp` check still fires) and a mid-pass user-managed flip
+ * skips the row. Reading `updated_at` from a raw pre-fetch instead would write
+ * a stale value back, pushing `updated_at < topics_extracted_at` and hiding
+ * the edited memory from every future sweep.
+ *
+ * Callers bound the input via `getMemoriesNeedingTopicExtractionOp`'s `limit`
+ * (both `pending` and `linkedUnstamped` are capped), so the per-row Model load
+ * needed to `prepareUpdate` stays bounded and never spikes the RecordCache.
+ */
+declare function stampTopicsExtractedAtOp(ctx: VaultMemoryOperationsContext, memoryIds: readonly string[], extractedAt: number, version?: number): Promise<string[]>;
+declare function deleteAllVaultMemoriesForUserOp(ctx: VaultMemoryOperationsContext, userId: string): Promise<number>;
+/**
+ * The minimal plaintext shape the decay sweep needs — mirrors the `DecayInput`
+ * shape in `memory/decay` plus the row id. Deliberately omits `content`
+ * (encrypted) so the sweep stays zero-knowledge.
+ */
+interface DecayCandidateRaw {
+    uniqueId: string;
+    factType: string | null;
+    eventTimeEnd: number | null;
+    eventTimeKind: string | null;
+    /** Unix ms — the raw `updated_at`, used both for the age rule and as the
+     * optimistic-concurrency guard passed back to {@link archiveVaultMemoryOp}. */
+    updatedAt: number;
+    archivedAt: number | null;
+    source: string | null;
+    /** `trusted` | `quarantined` | null. Quarantined rows still decay by RULE, but
+     * are never handed to the optional content-reading decay classifier (they must
+     * not egress poison content — see the decay sweeper's `isBorderline`). */
+    trustTier: string | null;
 }
-
 /**
- * Retain API — single write surface for the unified memory layer with
- * write-time auto-merge.
+ * Decay sweep candidate scan (PR2). Selects the plaintext columns
+ * `classifyDecay` (in `memory/decay`) needs via
+ * `unsafeFetchRaw` — NO Model per row (dodges the never-evicted RecordCache /
+ * web Pile-2 OOM history) and NO `content` read / decrypt (zero-knowledge).
  *
- * On write, retain() searches for the nearest existing memory and, if its
- * cosine similarity to the new content exceeds the auto-merge threshold,
- * folds the new fact into the existing record (incrementing proof_count
- * and unioning source_chunk_ids). Otherwise it inserts a new memory.
+ * Includes archived AND quarantined rows (so archived→delete transitions and
+ * aged quarantined rows are seen) but excludes hard-deleted rows — the
+ * `baseVaultConditions` default keeps `is_deleted = false`.
  *
- * This is the W4 (auto-merge / dedup) workstream made callable. The W2
- * auto-extraction worker uses retain() as its write step, with the LLM
- * resolver upstream deciding when auto-merge should be enabled vs when
- * a semantic update should be applied via the lower-level update op.
+ * Refuses to run on an unscoped multi-tenant context (see
+ * {@link assertVaultScopeForSweep}).
  */
-
-interface RetainContext {
-    vaultCtx: VaultMemoryOperationsContext;
-    embeddingOptions: EmbeddingOptions;
-    vaultCache: VaultEmbeddingCache;
-}
+declare function getDecayCandidatesRawOp(ctx: VaultMemoryOperationsContext): Promise<DecayCandidateRaw[]>;
 /**
- * Persist a memory, merging into the nearest existing record if its
- * cosine similarity exceeds the auto-merge threshold.
+ * Archive a memory (decay soft state, PR2) — set `archived_at`. An archived row
+ * drops out of every recall lane via the `baseVaultConditions` choke point but
+ * stays recoverable via {@link restoreVaultMemoryOp} until the hard-delete
+ * window elapses.
  *
- * Default behavior (autoMerge ON): proof_count increments on the merged
- * target, source_chunk_ids accumulate (union), content is left untouched.
- * The caller doesn't see a duplicate and the original memory's UI badge
- * shows it has been re-observed.
+ * Concurrency: re-checks `is_deleted` / ownership / `archived_at` INSIDE the
+ * serialized writer (mirrors {@link updateVaultMemoryOp}). Additionally, when
+ * `opts.expectedUpdatedAt` is given, the archive is skipped if the row's current
+ * `updated_at` no longer matches — i.e. a `retain()` merge (which bumps
+ * `updated_at`) landed between the sweep's candidate scan and this write, so the
+ * fact was just re-observed and must NOT be archived on stale data. Idempotent:
+ * a row another sweep already archived returns `false` (no double-write).
  *
- * Pass `enableAutoMerge: false` for a force-create (W2 resolver path
- * after it has explicitly decided "create new").
+ * @returns `true` if this call archived the row; `false` if it was stale
+ *   (deleted / not owned / already archived / refreshed under us).
  */
-declare function retain(content: string, ctx: RetainContext, options?: RetainOptions): Promise<RetainResult>;
-
+declare function archiveVaultMemoryOp(ctx: VaultMemoryOperationsContext, id: string, opts?: {
+    /** Timestamp to stamp into `archived_at`. Default `Date.now()`. */
+    now?: number;
+    /** Optimistic-concurrency guard: skip if the row's `updated_at` changed
+     * since the sweep observed it (a concurrent re-observation). */
+    expectedUpdatedAt?: number;
+}): Promise<boolean>;
 /**
- * Auto-extraction worker — W2.
+ * Restore an archived memory (PR2) — clear `archived_at` so it re-enters recall.
+ * Re-checks `is_deleted` / ownership inside the writer. Idempotent on an
+ * already-active row (clearing null → null is harmless).
  *
- * After each assistant turn, this pipeline reads the recent conversation,
- * asks an LLM to identify durable user facts, and writes them to the
- * vault via retain(). The user never needs to ask Anuma to remember
- * something — durable facts are captured automatically.
+ * @returns `true` if the row was restored (or already active); `false` if it was
+ *   deleted / not owned / missing.
+ */
+declare function restoreVaultMemoryOp(ctx: VaultMemoryOperationsContext, id: string): Promise<boolean>;
+/**
+ * Hard-delete a memory ONLY if it is still archived and still past the delete
+ * window (PR2 decay terminal transition). Unlike the generic
+ * {@link deleteVaultMemoryOp}, this re-reads `archived_at` INSIDE the writer and
+ * bails if the row was restored (`archived_at → null`) or re-archived more
+ * recently since the sweep's candidate scan. This is the restore-vs-delete
+ * mutual-exclusion guard: a user hitting Restore between the scan and this write
+ * must win, so their just-rescued memory is never permanently lost.
  *
- * Two-stage pipeline (extract → retain). The retain step uses
- * write-time auto-merge (W4) so the same fact re-observed in a later
- * conversation increments proof_count instead of duplicating.
+ * @returns `true` if this call hard-deleted the row; `false` if it was stale
+ *   (deleted / not owned / no longer archived / no longer past the window).
+ */
+declare function hardDeleteDecayedOp(ctx: VaultMemoryOperationsContext, id: string, opts: {
+    hardDeleteWindowMs: number;
+    now?: number;
+}): Promise<boolean>;
+declare function updateVaultMemoryEmbeddingOp(ctx: VaultMemoryOperationsContext, id: string, embedding: string, embeddingModel: string): Promise<boolean>;
+
+/**
+ * Queue Types
  *
- * Spec: see `tasks/hackathon/auto-extraction-prompt.md`.
+ * Types for the in-memory write queue that holds operations
+ * when encryption keys aren't yet available.
  */
 
-declare const FACT_TYPES: readonly ["identity", "preference", "relationship", "plan", "ongoing_context", "constraint", "other"];
-type FactType = (typeof FACT_TYPES)[number];
-interface AutoExtractMessage {
-    /** Stable message identifier — used for source_chunk_ids provenance. */
+/**
+ * Types of database operations that can be queued.
+ */
+type QueuedOperationType = "createConversation" | "updateConversationTitle" | "updateConversationPinned" | "createMessage" | "updateMessage" | "createMedia" | "createMediaBatch" | "updateMediaMessageId";
+/**
+ * A single queued database operation.
+ */
+interface QueuedOperation {
+    /** Unique ID for this operation */
     id: string;
-    role: "user" | "assistant";
-    content: string;
+    /** Type of operation */
+    type: QueuedOperationType;
+    /** Wallet address this operation belongs to */
+    walletAddress: string;
+    /** When the operation was queued */
+    timestamp: number;
+    /** Priority for ordering (lower = higher priority). Conversations=0, Messages=1, Media=2 */
+    priority: number;
+    /** IDs of operations that must complete before this one */
+    dependencies: string[];
+    /** Operation-specific payload */
+    payload: Record<string, any>;
+    /** Number of times this operation has been retried */
+    retryCount: number;
+    /** Maximum number of retries allowed */
+    maxRetries: number;
 }
 /**
- * A named entity extracted from the conversation, with an optional
- * classification. `kind` is omitted when the model gave no kind or an
- * unrecognized one — see {@link validateCandidates}.
+ * Status of a wallet's queue.
  */
-interface ExtractedEntity {
-    name: string;
-    kind?: EntityKind;
+interface QueueStatus {
+    /** Number of pending operations */
+    pending: number;
+    /** Number of operations that failed all retries */
+    failed: number;
+    /** Whether the queue is currently being flushed */
+    isFlushing: boolean;
+    /** Whether the queue is paused (e.g., wallet disconnected) */
+    isPaused: boolean;
 }
-interface ExtractedCandidate {
-    content: string;
-    type: FactType;
-    confidence: number;
-    sourceMessageIds: string[];
-    entities: ExtractedEntity[];
-    /** W6 temporal lane — when the event in this fact occurred. Resolved
-     *  to absolute timestamps by the LLM; null when the fact has no
-     *  temporal anchor. */
-    eventTime: {
-        kind: "point" | "range" | "ongoing";
-        /** Unix ms timestamp of the event start (or point). */
-        start: number;
-        /** Unix ms timestamp of the event end. Only set when kind='range'. */
-        end: number | null;
-    } | null;
+/**
+ * Result of a flush operation.
+ */
+interface FlushResult {
+    /** IDs of operations that succeeded */
+    succeeded: string[];
+    /** Operations that failed with their errors */
+    failed: Array<{
+        id: string;
+        error: string;
+    }>;
+    /** Total number of operations attempted */
+    total: number;
 }
 /**
- * Auth + endpoint for the extraction LLM call. Auth is the dual pattern —
- * one of `apiKey` / `getToken` is required at runtime; see
- * {@link PortalLlmAuth}.
+ * Encryption context needed to execute queued operations.
  */
-interface ExtractFactsOptions extends PortalLlmAuth {
-    baseUrl?: string;
-    model?: string;
-    /** Override the global fetch implementation (useful for tests). */
-    fetchFn?: typeof fetch;
+interface QueueEncryptionContext {
+    walletAddress: string;
+    signMessage: SignMessageFn;
+    embeddedWalletSigner?: EmbeddedWalletSignerFn;
+}
+/**
+ * Executor function that runs a single queued operation.
+ * Provided by the consumer (e.g., useChatStorage) during flush.
+ */
+type OperationExecutor = (operation: QueuedOperation, encryptionContext: QueueEncryptionContext) => Promise<void>;
+
+/**
+ * Queue Manager
+ *
+ * In-memory queue for database operations when encryption keys aren't yet available.
+ * Operations are held in memory and flushed to the database once the key becomes available.
+ *
+ * Key design decisions:
+ * - In-memory only: queue is lost on page refresh (acceptable since user must re-auth anyway)
+ * - Per-wallet isolation: each wallet has its own queue
+ * - Dependency tracking: operations are flushed in correct order (conversation before messages)
+ * - Max 1000 operations per wallet to prevent memory leaks
+ */
+
+declare class QueueManager {
+    /** Per-wallet operation queues: wallet address -> operation id -> operation */
+    private queues;
+    /** Per-wallet flushing state */
+    private flushing;
+    /** Per-wallet paused state */
+    private paused;
+    /** Per-wallet failed operations (exceeded max retries) */
+    private failedOps;
+    /** Change listeners: wallet address -> callbacks */
+    private listeners;
     /**
-     * The user's own name(s) / handle(s) (e.g. profile nickname, wallet display
-     * name). Candidates whose entire content is just one of these are dropped —
-     * a personal memory system already knows who the user is, so "Peter Lee" is
-     * circular noise. Optional; when omitted only the bare-fragment gate applies.
+     * Queue a new operation for a wallet.
+     * @returns The operation ID, or null if queue is full.
      */
-    userIdentity?: string[];
+    queueOperation(walletAddress: string, type: QueuedOperationType, payload: Record<string, any>, dependencies?: string[], maxRetries?: number): string | null;
     /**
-     * Reference "now" (Unix ms) for resolving relative temporal phrases in the
-     * transcript ("yesterday", "next week", "in two days") into the absolute
-     * YYYY-MM-DD anchors the W6 temporal lane indexes on. The transcript itself
-     * carries no timestamps, so without an anchor the model resolves relatives
-     * against its own training-cutoff guess and emits wrong `eventTime` dates.
-     * Defaults to `Date.now()`. Override for back-dated eval corpora and
-     * deterministic tests (mirrors {@link RecallOptions.now}).
-     *
-     * Server-side timezone note: the ms value is formatted to a calendar date in
-     * the process's local timezone (same basis as `parseLocalCalendarDay`). On a
-     * UTC server, a user near midnight in a non-UTC offset can get the wrong
-     * calendar day. Pass the user's local-midnight timestamp as `now` when the
-     * process timezone doesn't match the user's.
+     * Get all pending operations for a wallet, sorted by dependency order.
      */
-    now?: number;
+    getOperations(walletAddress: string): QueuedOperation[];
     /**
-     * Max attempts for the extraction call on a transient failure (default 3).
-     * Lower it to bound how long extraction can hold a turn open — e.g. a worker
-     * that runs extraction behind an in-flight-turn guard can pass `2` to keep
-     * repeated failures from delaying later turns.
+     * Remove a specific operation from the queue.
      */
-    maxAttempts?: number;
-    /** Per-attempt timeout (ms) for the extraction call. Defaults to the portal
-     * helper's 60s. Combine with {@link maxAttempts} to cap the total time budget. */
-    timeoutMs?: number;
+    removeOperation(walletAddress: string, operationId: string): void;
     /**
-     * Absolute wall-clock budget (ms) across ALL extraction attempts incl. backoff.
-     * When set, the loop stops before an attempt that would exceed it, so worst-case
-     * latency is bounded rather than `maxAttempts × timeoutMs`.
+     * Get the status of a wallet's queue.
      */
-    totalTimeoutMs?: number;
+    getStatus(walletAddress: string): QueueStatus;
     /**
-     * Override the retry backoff (ms) for a given 1-based attempt index. The
-     * extraction call retries transient failures internally (default exponential
-     * backoff); pass `() => 0` to retry without delay (useful for tests).
+     * Flush all queued operations for a wallet by executing them with encryption.
+     *
+     * @param encryptionContext - Wallet address and signing functions for encryption
+     * @param executor - Function that executes each operation against the database
+     * @returns Result with succeeded/failed operation IDs
      */
-    backoffMs?: (attempt: number) => number;
+    flush(encryptionContext: QueueEncryptionContext, executor: OperationExecutor): Promise<FlushResult>;
     /**
-     * When set, PII (emails, phones, SSNs, cards, IPs, API keys, …) in the
-     * conversation transcript is replaced with tagged placeholders before the
-     * extraction call, and the returned facts + entities are de-anonymized so the
-     * vault keeps the real values while raw PII never reaches the extraction
-     * model (and, via `extractAndRetain`, the consolidation model). Pass `true`
-     * for a fresh per-call redactor, or a shared {@link PiiRedactor} to keep
-     * placeholder numbering consistent with other calls.
-     *
-     * NOTE: this does NOT cover the embeddings provider. Facts are stored and
-     * embedded with their real values, so to keep PII out of embedding requests
-     * set `RetainContext.embeddingOptions.maskInput` (e.g. `redactor.maskText`)
-     * as well — the two are independent switches.
+     * Clear all queued operations for a wallet.
+     */
+    clear(walletAddress: string): void;
+    /**
+     * Pause the queue for a wallet (stops flush mid-way).
      */
-    piiRedaction?: boolean | PiiRedactor;
+    pause(walletAddress: string): void;
     /**
-     * Called when the extraction LLM returned no usable result after exhausting
-     * its retries (empty/malformed completion, network/HTTP error) — i.e. a
-     * *failure* that drops the turn's facts, as opposed to a legitimate
-     * `{candidates: []}` "nothing durable here". Lets callers distinguish a
-     * silently-degrading extractor from quiet turns (the two are otherwise
-     * indistinguishable). See {@link extractAndRetain}'s `outcome`.
+     * Resume the queue for a wallet.
      */
-    onExhaustedEmpty?: () => void;
+    resume(walletAddress: string): void;
     /**
-     * Called when the extractor DID produce candidates but PII de-anonymization
-     * dropped every one of them — the model mangled its placeholders (so they
-     * can't be restored to real values) or restoring the values blew the length
-     * cap. These drops happen before `retain()`, so `failedCount` can't see them,
-     * and the turn would otherwise masquerade as a quiet `no-facts` result. Lets
-     * H3's `outcome` surface `dropped-after-redaction` so a rising PII-drop rate
-     * (i.e. redaction silently eating facts) is alarmable.
+     * Register a listener for queue changes on a wallet.
+     * @returns Unsubscribe function
      */
-    onCandidatesDropped?: () => void;
+    onQueueChange(walletAddress: string, callback: () => void): () => void;
+    /**
+     * Check if a wallet has any pending operations.
+     */
+    hasPending(walletAddress: string): boolean;
+    /** Move a failed operation to the failed set. */
+    private moveToFailed;
+    /** Notify all listeners for a wallet. */
+    private notifyListeners;
 }
+/** Singleton queue manager instance */
+declare const queueManager: QueueManager;
+
 /**
- * Stage 1 — call the LLM to extract candidate facts from the recent
- * conversation. Returns post-validated candidates only (confidence
- * threshold, source-id check, length cap, schema validation). Returns
- * an empty array if the LLM emits malformed JSON or no candidates.
- *
- * A null from `callPortalJsonCompletion` means a *failure* (empty completion,
- * malformed JSON, network/HTTP error) — distinct from a successful
- * `{candidates: []}`, which parses to a non-null object. A failed extraction
- * silently drops the whole turn's memories, so transient failures matter:
- * `callPortalJsonCompletion` retries them internally with backoff (default 3
- * attempts), so a one-off empty/malformed completion from a reasoning-class
- * model doesn't lose the turn. Only an exhausted-retry null reaches here.
- */
-declare function extractFacts(messages: AutoExtractMessage[], options: ExtractFactsOptions): Promise<ExtractedCandidate[]>;
-/**
- * Outcome of the EXTRACTOR stage for a turn — independent of whether the
- * subsequent `retain()` writes landed (that's `failedCount`):
- * - `extracted`         — the extractor produced at least one candidate above
- *                         the confidence floor. Whether those writes succeeded
- *                         is reported separately by `failedCount` — so
- *                         `extracted` + `failedCount > 0` means "found facts but
- *                         writes are failing", which is more signal than
- *                         collapsing it into `no-facts` would give.
- * - `no-facts`          — the extractor ran fine but found nothing durable.
- * - `empty-after-retry` — the extractor returned empty/malformed after
- *                         exhausting retries (a *failure*). Distinguishing this
- *                         from `no-facts` is what makes a silently-degrading
- *                         extractor alarmable rather than invisible.
- * - `dropped-after-redaction` — the extractor found facts but PII
- *                         de-anonymization dropped every one (mangled
- *                         placeholders / over-cap after restore), before retain.
- *                         A degradation `failedCount` can't see; would otherwise
- *                         look like `no-facts`.
- */
-type ExtractOutcome = "extracted" | "no-facts" | "empty-after-retry" | "dropped-after-redaction";
-/**
- * Stage 2 — for each extracted candidate, call retain() with auto-merge
- * enabled. When `consolidateOptions` are wired, retain()'s consolidation pass
- * is the "resolver": a second LLM call against the top-K existing vault
- * memories that decides create/update/noop/supersede — including retiring a
- * stale value on a state change (the supersession the extraction prompt above
- * promises). Without consolidation, retain() still dedups at the cosine-merge
- * level, and the read-time supersession heuristic remains the fallback.
+ * Wallet Poller
  *
- * Returns the candidates that survived validation along with the retain
- * result for each (which captures whether the fact was created, merged,
- * or skipped), plus an `outcome` summarizing why the turn did/didn't produce
- * facts (see {@link ExtractOutcome}).
+ * Polls for embedded wallet availability during Privy initialization.
+ * When a wallet becomes available, triggers a callback so the queue can flush.
  */
-declare function extractAndRetain(messages: AutoExtractMessage[], retainCtx: RetainContext, options: {
-    extract: ExtractFactsOptions;
-    minConfidence?: number;
-    /** Override scope/folder for all retained facts. */
-    scope?: string;
-    folderId?: string | null;
-    /**
-     * Forwarded verbatim to each retain() call — enables the LLM-based
-     * consolidation pass (Hindsight facet-dedup) on every write. See
-     * `RetainOptions.consolidateOptions` for auth + observability fields.
-     */
-    consolidateOptions?: RetainOptions["consolidateOptions"];
+declare class WalletPoller {
+    private timerId;
+    private attempts;
     /**
-     * When provided, persist each candidate's `entities[]` to the
-     * entity + memory_entity tables after a successful retain. This
-     * powers the W5 graph retrieval lane — recall() can query for
-     * memories sharing entities with the user's question.
+     * Start polling for wallet availability.
+     *
+     * @param checkWallet - Returns wallet address when ready, null if not yet available
+     * @param onWalletReady - Called with the wallet address when it becomes available
+     * @param intervalMs - Polling interval in milliseconds (default: 1000ms)
+     * @param maxAttempts - Maximum polling attempts before giving up (default: 60)
+     * @returns Stop function to cancel polling
      */
-    entityCtx?: EntityOperationsContext;
+    startPolling(checkWallet: () => Promise<string | null>, onWalletReady: (address: string) => void, intervalMs?: number, maxAttempts?: number): () => void;
     /**
-     * Per-candidate failure hook — invoked once per filtered candidate
-     * whose `retain()` call threw. Lets UI layers surface "couldn't save
-     * X" toasts; without it consumers only see the aggregate
-     * `failedCount` and can't name which facts dropped.
+     * Stop polling.
      */
-    onCandidateFailed?: (candidate: ExtractedCandidate, error: unknown) => void;
-}): Promise<{
-    candidates: ExtractedCandidate[];
-    results: RetainResult[];
-    failedCount: number;
-    outcome: ExtractOutcome;
-}>;
+    stop(): void;
+}
 
 /**
  * Auto-extraction worker — orchestration glue for wiring
@@ -5782,6 +6194,16 @@ interface MemoryExtractedEvent {
     result: RetainResult;
     conversationId?: string;
 }
+/**
+ * Tier-0 security (PR3) — fired once per candidate the injection screen
+ * quarantined and persisted as an audit row. Distinct from
+ * {@link MemoryExtractedEvent} so a client can render "held for review"
+ * without treating a poisoned fact as a normal saved memory.
+ * @public
+ */
+interface MemoryQuarantinedEvent extends QuarantinedMemoryInfo {
+    conversationId?: string;
+}
 /** @public */
 interface TurnSkippedEvent {
     /**
@@ -5920,6 +6342,12 @@ interface CreateAutoExtractorOptions {
     };
     /** Per-fact event — fires once per memory written. */
     onMemoryExtracted?: (event: MemoryExtractedEvent) => void;
+    /**
+     * Tier-0 security (PR3) — fires once per candidate quarantined by the
+     * injection screen (and persisted as an audit row). Lets a client surface a
+     * "held for review" state instead of the fact silently disappearing.
+     */
+    onMemoryQuarantined?: (event: MemoryQuarantinedEvent) => void;
     /** Per-turn event — fires once after the whole pipeline finishes. */
     onTurnComplete?: (event: TurnCompleteEvent) => void;
     /** Diagnostic — fires when a turn is skipped. */
@@ -5980,6 +6408,536 @@ declare const DEFAULT_CHUNK_CACHE_SIZE = 5000;
  */
 declare function createChunkVectorCache(maxSize?: number): ChunkVectorCache;
 
+/**
+ * Temporal decay classifier (PR2) — pure, DB-free, unit-testable.
+ *
+ * Decides whether a stored memory should be kept, archived (soft, recoverable),
+ * or hard-deleted, based ONLY on its plaintext columns. This is the
+ * zero-knowledge core of the decay sweep: it never sees `content` and never
+ * triggers a signature/decrypt, so it can run wherever a wallet key is NOT
+ * loaded. The sweep worker ({@link ./decayWorker}) feeds it raw rows selected
+ * via `unsafeFetchRaw` and materializes Models only for the transitions.
+ *
+ * Lifecycle (mirrors the timestamp state machine in db/schema.ts):
+ *   active   → archived  (set `archived_at`)   — recoverable, drops out of recall
+ *   archived → deleted   (set `is_deleted`)    — terminal, after HARD_DELETE_WINDOW
+ *
+ * Per-type TTL policy (the "becomes past" intuition):
+ *   - identity / preference / relationship / constraint → never age-archive
+ *     (durable facts about who the user is; Infinity TTL).
+ *   - plan / ongoing_context → short TTL (they go stale as time moves on).
+ *   - other / null (untyped/legacy) → medium TTL.
+ * `source === "manual"` memories are protected from AUTO-ARCHIVE (user-curated)
+ * — but NOT from the hard-delete clock once they are archived: archive is the
+ * shared purge buffer for every row, so an already-archived manual memory is
+ * still deleted after the window (the archived check runs before the manual
+ * short-circuit by design).
+ */
+/** The verdict for a single memory. */
+type DecayVerdict = "keep" | "archive" | "delete";
+/** Short TTL — `plan` / `ongoing_context` age out ~30 days after last touch. */
+declare const SHORT_TTL_MS: number;
+/** Medium TTL — `other` / untyped rows age out ~180 days after last touch. */
+declare const MEDIUM_TTL_MS: number;
+/**
+ * "Never" TTL — durable identity-class types (identity/preference/relationship/
+ * constraint) never age-archive. Expressed as +Infinity so the age comparison
+ * `now - updatedAt > ttl` is always false.
+ */
+declare const NEVER_TTL_MS: number;
+/**
+ * How long an archived memory lingers (recoverable) before the sweep hard-
+ * deletes it. ~30 days gives the user a window to restore an over-eager decay.
+ */
+declare const HARD_DELETE_WINDOW_MS: number;
+/**
+ * Grace applied after a `plan` / `ongoing_context` event's `event_time_end`
+ * before it's considered "become past" and archived. Avoids archiving a plan
+ * the instant its end date passes (the user may still reference it briefly).
+ */
+declare const PAST_EVENT_GRACE_MS: number;
+/**
+ * Per-type TTL + window overrides. Pass a partial to {@link classifyDecay} /
+ * the sweeper to tune behavior (evaluation harnesses, tests). Anything omitted
+ * falls back to {@link DEFAULT_DECAY_POLICY}.
+ */
+interface DecayPolicy {
+    /**
+     * Age TTL (ms since `updatedAt`) per FactType. A type absent from this map —
+     * or a null/unknown `factType` — uses {@link DecayPolicy.fallbackTtlMs}.
+     */
+    ttlByType: Record<string, number>;
+    /** TTL for `null` / unknown fact types (the medium bucket). */
+    fallbackTtlMs: number;
+    /** How long an archived row lingers before hard delete. */
+    hardDeleteWindowMs: number;
+    /** Grace after a past `event_time_end` before archiving a plan/ongoing. */
+    pastEventGraceMs: number;
+}
+/** Default policy — the locked per-type TTLs. */
+declare const DEFAULT_DECAY_POLICY: DecayPolicy;
+/**
+ * The minimal plaintext shape {@link classifyDecay} reads. Deliberately excludes
+ * `content` (encrypted; never touched by decay) — the sweep selects exactly
+ * these columns so it stays zero-knowledge.
+ */
+interface DecayInput {
+    /**
+     * The row's stable id. Not read by the rule engine ({@link classifyDecay}
+     * ignores it) — it is threaded through so an optional content-reading decay
+     * classifier (PR5, {@link createLlmDecayClassifier}) can fetch + decrypt the
+     * row for a borderline verdict. Optional so pure rule-based callers/tests can
+     * omit it.
+     */
+    id?: string;
+    /** The extractor's FactType, or null (legacy/manual/untyped → medium bucket). */
+    factType: string | null;
+    /** W6 temporal lane — Unix ms the event ended (range/ongoing), or null. */
+    eventTimeEnd: number | null;
+    /** W6 temporal lane — `point | range | ongoing | null`. */
+    eventTimeKind: string | null;
+    /** Unix ms of the row's last write (re-observation resets this). */
+    updatedAt: number;
+    /** Unix ms when archived, or null when active. */
+    archivedAt: number | null;
+    /** `manual` | `auto-extracted` | `capsule` | null. Manual is never decayed. */
+    source: string | null;
+    /**
+     * `trusted` | `quarantined` | null. Not read by the rule engine
+     * ({@link classifyDecay} ignores it — quarantined rows still age/archive/delete
+     * by RULE). It exists only so the sweeper's `isBorderline` can keep a
+     * quarantined (injection-screened) row away from the optional content-reading
+     * classifier, so poison content never egresses. Optional so pure rule-based
+     * callers/tests can omit it (treated as not quarantined).
+     */
+    trustTier?: string | null;
+}
+/**
+ * The age TTL for a fact type. `null` / unknown types fall to the medium
+ * fallback bucket (never Infinity — untyped rows must still eventually age out).
+ */
+declare function ttlForType(factType: string | null, policy?: Partial<DecayPolicy>): number;
+/**
+ * Classify one memory into a decay verdict, reading only plaintext fields.
+ *
+ * Rules, in order (first match wins):
+ *  0. Non-finite timestamps → keep (safe) + warn (corrupt row, observable).
+ *  1. Already archived (`archivedAt != null`): delete once past the hard-delete
+ *     window, else keep — runs REGARDLESS of `source`, so the purge clock
+ *     applies to archived manual rows too.
+ *  2. `source === "manual"` → keep — protects manual saves from AUTO-ARCHIVE
+ *     only (rules 3/4). Delete-of-already-archived is handled above.
+ *  3. `plan` / `ongoing_context` whose event has become past — `eventTimeEnd`
+ *     is set AND older than `now - grace` → archive. An `ongoing` status with a
+ *     null `eventTimeEnd` is still ongoing, so this rule does not fire for it.
+ *  4. Age fallback — `now - updatedAt > TTL(factType)` → archive. Durable types
+ *     have Infinity TTL, so this never fires for them; null/unknown use medium.
+ *     EXCEPTION: a `plan`/`ongoing_context` with a still-upcoming event
+ *     (`eventTimeEnd >= now`) is kept — it must not age-archive before the event
+ *     happens; only rule 3 (after it passes) may archive it.
+ *  5. Otherwise → keep.
+ *
+ * @param m     Plaintext decay inputs for one row.
+ * @param now   Reference time (Unix ms). Injected for determinism.
+ * @param policy Optional partial policy overriding {@link DEFAULT_DECAY_POLICY}.
+ */
+declare function classifyDecay(m: DecayInput, now: number, policy?: Partial<DecayPolicy>): DecayVerdict;
+
+/**
+ * Decay sweeper (PR2) — orchestration glue that runs the temporal-decay
+ * lifecycle over the vault. Mirrors the shape of {@link ./autoExtractWorker}'s
+ * `createAutoExtractor`: created once, driven by the caller (a client hook on a
+ * low-frequency interval / app-foreground), disposable.
+ *
+ * A sweep is zero-knowledge by construction:
+ *   1. {@link getDecayCandidatesRawOp} selects plaintext columns via
+ *      `unsafeFetchRaw` — no `content`, no decrypt, no Model per row.
+ *   2. {@link classifyDecay} is a pure function over those plaintext fields.
+ *   3. Only the (usually small) transition set is materialized as Models to
+ *      archive ({@link archiveVaultMemoryOp}) or hard-delete
+ *      ({@link hardDeleteDecayedOp}, which re-checks archived + past-window
+ *      inside the write so a concurrent restore wins).
+ *
+ * The optional {@link DecayClassifier} is a PR5 seam for an on-device model that
+ * refines borderline verdicts by reading decrypted content — it is NOT
+ * implemented here. Default is `undefined` → pure rule-based, which is what
+ * keeps the default path zero-knowledge.
+ */
+
+/** Counts from one sweep, for UI surfacing (e.g. "N memories archived"). */
+interface DecaySweepResult {
+    /** Rows transitioned active → archived this sweep. */
+    archived: number;
+    /** Rows hard-deleted (archived past the window) this sweep. */
+    deleted: number;
+    /** Total candidate rows scanned (all non-hard-deleted rows). */
+    scanned: number;
+}
+/**
+ * PR5 seam — an on-device classifier that refines the rule-based verdict for
+ * borderline rows (e.g. type `other`/null, or a `plan` without an event end).
+ * Because it may read decrypted content, callers MUST gate providing it on
+ * wallet-key availability. Left undefined here → pure rule-based sweep.
+ *
+ * Egress is bounded by the sweeper (NOT the classifier): each sweep caps how
+ * many rows reach the classifier ({@link CreateDecaySweeperOptions.maxClassifierCallsPerSweep})
+ * and a row whose (id, updated_at) was already classified is never re-sent on a
+ * later sweep — so a stable borderline "keep" row egresses at most once.
+ *
+ * SECURITY (MEDIUM, residual) — enabling a classifier hands whoever answers the
+ * portal (incl. a malicious / MITM'd endpoint) a lever over the affected rows:
+ * a hostile verdict can only quarantine-adjacent OUTCOMES here, i.e. archive a
+ * row (reversible — never a hard delete, which stays the deterministic
+ * archived-past-window mechanic). Bounded, reversible trust tradeoff; gate the
+ * classifier on trust in the portal.
+ *
+ * @param input      The same plaintext inputs the rule engine saw.
+ * @param ruleVerdict The rule-based verdict, as a starting point / fallback.
+ * @param now        The sweep's reference time (Unix ms). Injected so the
+ *   classifier derives any age math from the same clock the rule engine used,
+ *   never wall-clock `Date.now()` — keeping a fixed-`now` sweep deterministic.
+ * @returns The (possibly refined) verdict.
+ */
+interface DecayClassifier {
+    classify(input: DecayInput, ruleVerdict: DecayVerdict, now: number): Promise<DecayVerdict> | DecayVerdict;
+}
+/** A clock: a fixed timestamp (tests) or a getter (production intervals). */
+type NowSource = number | (() => number);
+/** @public */
+interface CreateDecaySweeperOptions {
+    /** Vault write context — the same one recall/retain use. */
+    vaultCtx: VaultMemoryOperationsContext;
+    /**
+     * Reference "now". A number is fixed (deterministic tests); a function is
+     * re-evaluated per sweep (long-lived interval usage). Default `Date.now`.
+     */
+    now?: NowSource;
+    /** Partial policy overriding the per-type TTL defaults. Omit for defaults. */
+    policy?: Partial<DecayPolicy>;
+    /**
+     * PR5 seam. When provided, borderline candidates' rule verdict is passed
+     * through it. Gate on key availability (it may decrypt content). Default
+     * undefined. Egress is bounded — see {@link maxClassifierCallsPerSweep}.
+     */
+    classifier?: DecayClassifier;
+    /**
+     * PR5 — hard ceiling on classifier invocations (and thus decrypted-content
+     * portal egress) per sweep. Once hit, the remaining borderline rows fall back
+     * to the rule verdict for that sweep (no call). Prevents a large vault from
+     * firing hundreds of sequential content-bearing calls in one sweep. Default
+     * {@link DEFAULT_MAX_CLASSIFIER_CALLS_PER_SWEEP} (20). Cache hits (a row
+     * already classified at its current `updated_at`) do NOT count against this.
+     */
+    maxClassifierCallsPerSweep?: number;
+    /** Fires once after each sweep with the transition counts (UI). */
+    onSwept?: (result: DecaySweepResult) => void;
+    /** Diagnostic — fires on an unexpected sweep-level error. */
+    onError?: (error: Error) => void;
+}
+/** @public */
+interface DecaySweeper {
+    /**
+     * Scan the vault, classify every candidate, and apply archive/delete
+     * transitions. Safe to call repeatedly (idempotent — a keep stays a keep, an
+     * already-archived row won't re-archive). Returns the transition counts.
+     * A no-op (returns zero counts) after {@link DecaySweeper.dispose}.
+     */
+    runSweep(): Promise<DecaySweepResult>;
+    /** Stop accepting sweeps. An in-flight `runSweep()` resolves normally. */
+    dispose(): void;
+}
+/**
+ * Default per-sweep ceiling on decay-classifier invocations (see
+ * {@link CreateDecaySweeperOptions.maxClassifierCallsPerSweep}). Kept small: the
+ * classifier egresses DECRYPTED content, so a sweep must never fan out to
+ * hundreds of sequential calls. 20 covers the borderline churn of a typical
+ * sweep while capping worst-case egress; stable rows are also cached so this
+ * ceiling is rarely reached after the first sweep.
+ */
+declare const DEFAULT_MAX_CLASSIFIER_CALLS_PER_SWEEP = 20;
+/**
+ * Create a decay sweeper. See module docstring for the zero-knowledge contract.
+ */
+declare function createDecaySweeper(options: CreateDecaySweeperOptions): DecaySweeper;
+
+/**
+ * Optional content-reading decay classifier (PR5).
+ *
+ * The rule engine ({@link ./decay}.classifyDecay) decides keep/archive/delete
+ * from plaintext columns ALONE — it never sees `content`, which is what keeps
+ * the default decay sweep zero-knowledge. That is the right default, but it is
+ * weakest on BORDERLINE rows: an `other`/untyped fact, or a `plan` with no
+ * event end, whose staleness is a pure `updated_at` guess.
+ *
+ * This factory builds a {@link DecayClassifier} that reads the DECRYPTED content
+ * of such a row and returns keep-vs-archive. The sweeper consults it ONLY for a
+ * borderline row whose CURRENT rule verdict is `keep` — a rule archive/delete
+ * short-circuits before the classifier ever runs (see `decayWorker.verdictFor` +
+ * `isBorderline`). So its whole job is to REFINE a still-kept borderline row
+ * toward EARLIER archive when the content shows it is genuinely ephemeral (a
+ * finished one-off plan, an expired temporary state) — turning a weak age-only
+ * "keep" into an "archive" sooner.
+ *
+ * DIRECTIONALITY IS DELIBERATE (a security property, not a shortcoming): it can
+ * move a borderline keep → archive, never the reverse. It CANNOT rescue /
+ * keep-alive a row the rule would archive — the escalation gate makes that path
+ * unreachable, and archive is reversible while un-archiving poison would not be.
+ * Enabling a classifier hands whoever answers the portal (incl. a malicious /
+ * MITM'd endpoint) a lever, and that lever must only ever archive-reversibly.
+ *
+ * ZERO-KNOWLEDGE CONTRACT (the caller MUST honor this):
+ *   - `getContent` is supplied by the caller and MUST be gated on wallet-key
+ *     availability: return `null` when no key is loaded. With no content the
+ *     classifier degrades to the rule verdict — never blocks, never guesses.
+ *   - When it does read content and calls the portal, the content is
+ *     PII-redacted first. Redaction is OPT-OUT, not opt-in: it defaults ON when
+ *     the consumer omits `piiRedaction`, so a caller can never accidentally
+ *     egress raw PII. Pass `piiRedaction: false` to deliberately disable it.
+ *   - Egress is bounded by the SWEEPER, not this classifier: the sweep caps
+ *     invocations per pass and never re-sends an unchanged (id, updated_at) row
+ *     (see `decayWorker`), so a stable borderline "keep" row egresses once.
+ *   - It only ever chooses keep vs archive, and only for a row the rule already
+ *     keeps. It NEVER escalates to `delete` and NEVER un-archives — hard-delete
+ *     is exclusively the deterministic archived-past-window mechanic (rule 1),
+ *     and a row the rule wants archived is archived regardless of this layer.
+ *
+ * Fails to the rule verdict (keep) on any error, missing id, no key, or
+ * malformed response — like every other optional LLM layer in this subsystem it
+ * can only refine a borderline keep toward archive, never make the sweep worse.
+ *
+ * RESIDUAL SCOPE (accepted): a genuinely durable fact MISTYPED as `other`/null
+ * and never re-mentioned within its medium TTL WILL age-archive — this layer can
+ * only bring that archive EARLIER, never prevent it. Accepted because it is
+ * recoverable: archived rows stay in the Archived section, Restore clears
+ * `archived_at`, and any re-observation resets the TTL. The alternative — a
+ * keep-alive lever — is exactly the capability a hostile portal must NOT have.
+ *
+ * SECURITY (MEDIUM, residual) — this is a NEW portal call surface carrying
+ * (redacted) memory content. It is opt-in (you must construct + pass it) and
+ * gated on key availability. Beyond widening which models see facts, a
+ * malicious / MITM'd portal can steer the verdict — but only to ARCHIVE a row
+ * (reversible; never a hard delete). Gate it on trust in the portal.
+ */
+
+/**
+ * Auth + wiring for {@link createLlmDecayClassifier}. Auth is the dual pattern —
+ * one of `apiKey` / `getToken` is required at runtime (see {@link PortalLlmAuth}).
+ * @public
+ */
+interface LlmDecayClassifierOptions extends PortalLlmAuth {
+    baseUrl?: string;
+    model?: string;
+    /** Override fetch (tests). */
+    fetchFn?: typeof fetch;
+    /** Max portal attempts on a TRANSIENT failure. Default 2. */
+    maxAttempts?: number;
+    /** Absolute wall-clock budget across attempts. Default 12s. */
+    totalTimeoutMs?: number;
+    /** Backoff before each retry (ms). Tests pass `() => 0`. */
+    backoffMs?: (attempt: number) => number;
+    /**
+     * PII redaction for the outbound content. OPT-OUT: defaults to ON (a fresh
+     * per-call redactor) when omitted, so decrypted content is never egressed
+     * raw by accident. Pass a shared {@link PiiRedactor} to keep placeholder
+     * numbering consistent with other calls, or `false` to deliberately disable
+     * redaction. The verdict returned is a bare enum — nothing to de-anonymize.
+     */
+    piiRedaction?: boolean | PiiRedactor;
+    /**
+     * Resolve a memory's DECRYPTED content by id. The caller supplies this and
+     * MUST gate it on wallet-key availability — return `null` when no key is
+     * loaded so the classifier degrades to the rule verdict (zero-knowledge).
+     * A throw is treated the same as `null` (fail to the rule verdict).
+     */
+    getContent: (id: string) => Promise<string | null>;
+}
+/**
+ * Build a {@link DecayClassifier} that reads a borderline row's decrypted
+ * content and returns a keep/archive verdict via a cheap portal LLM. Pass it as
+ * `createDecaySweeper({ classifier })`. See the module docstring for the
+ * zero-knowledge contract. Returns the rule verdict on any failure and never
+ * escalates to `delete`.
+ * @public
+ */
+declare function createLlmDecayClassifier(options: LlmDecayClassifierOptions): DecayClassifier;
+
+/**
+ * Multi-hop graph traversal for the W5 entity-graph recall lane (PR4,
+ * MRAgent-style "active reconstruction").
+ *
+ * The single-hop lane (see `recall.ts:buildGraphLaneRanking`) does one thing:
+ * extract entities from the query, look up memories sharing any of them, and
+ * order those memories by shared-entity count. That is hop 1 — the "seed"
+ * lookup. This module wraps a bounded breadth-first search around it: from the
+ * seed memories it walks OUT to their neighbor entities (via the new reverse
+ * edge {@link getEntitiesByMemoryIdsOp}), ranks those neighbors by
+ * co-occurrence across the frontier, expands the top few, and pulls the
+ * memories they reach — repeating up to {@link MAX_HOPS} times.
+ *
+ * Cost note (why this is cheap): NONE of this runs cosine. Cosine runs exactly
+ * once per recall inside `searchVaultMemoriesWithSize`. This lane only emits an
+ * ordered list of memory IDs that is RRF-fused against the cosine head. So
+ * multi-hop adds indexed WatermelonDB joins + more RRF entries, not embedding
+ * math. The dominant cost of enabling it is the reranker over a slightly larger
+ * candidate pool — which stays bounded because `rerankTopN` remains
+ * authoritative downstream.
+ *
+ * Determinism: neighbor-entity selection is pure co-occurrence counting by
+ * default. An optional LLM path-refiner (PR5) can override which neighbors
+ * expand; it falls back to the deterministic order on any error.
+ *
+ * Hop numbering: hop 1 is the seed lookup. `maxHops = 1` therefore means "seed
+ * only" — byte-for-byte identical to the single-hop lane (the regression guard).
+ * `MAX_HOPS = 2` (the PR5 default) performs one expansion beyond the seed.
+ *
+ * Neighbor selection at each expansion hop is deterministic co-occurrence
+ * counting by default. PR5 adds an OPTIONAL LLM path-refiner
+ * ({@link NeighborRefiner} / {@link createLlmNeighborRefiner}) that lets a model
+ * pick which neighbor entities to expand instead; it is opt-in, capped to ≤1
+ * call per hop, and falls back to the deterministic order on any error.
+ */
+
+/**
+ * Total hops the traversal performs, counting the seed lookup as hop 1.
+ * `1` = seed only (identical to the single-hop lane). PR5 default is `2` (one
+ * expansion beyond the seed). Overridable per-call for ablation. Still gated to
+ * the `high` budget in recall, and capped back to 1 on large vaults by
+ * {@link capHopsForDensity}.
+ * @public
+ */
+declare const MAX_HOPS = 2;
+/**
+ * Max neighbor entities expanded per hop. Caps fan-out so a densely-linked
+ * frontier can't explode the candidate pool. Neighbors are ranked by
+ * co-occurrence frequency across the frontier; only the top this-many expand.
+ * @public
+ */
+declare const ENTITY_FANOUT = 8;
+/**
+ * Hard ceiling on total accumulated memory IDs across all hops. The BFS stops
+ * expanding once the accumulated set reaches this size (and the frontier is
+ * bounded to it too), keeping the RRF pool — and the downstream reranker
+ * workload — bounded regardless of graph density.
+ * @public
+ */
+declare const NODE_BUDGET = 64;
+/**
+ * Above this vault size, {@link capHopsForDensity} forces `MAX_HOPS = 1`
+ * (seed-only). Fan-out grows with graph density, so on large vaults we don't
+ * pay the expansion cost. Bounded-traversal safety valve.
+ * @public
+ */
+declare const VAULT_SIZE_HOP_CAP = 1000;
+/** Options for {@link traverseGraphLane}. All optional; defaults are the
+ * exported constants above. Exposed for ablation / evaluation sweeps.
+ * @public */
+interface GraphTraversalOptions {
+    /** Total hops incl. the seed lookup (hop 1). Default {@link MAX_HOPS}. */
+    maxHops?: number;
+    /** Max neighbor entities expanded per hop. Default {@link ENTITY_FANOUT}. */
+    entityFanout?: number;
+    /** Hard cap on accumulated memory IDs. Default {@link NODE_BUDGET}. */
+    nodeBudget?: number;
+    /** RRF smoothing constant for per-hop fusion. Default 60 (rrf.ts). */
+    rrfK?: number;
+    /**
+     * Vault size hint. When provided and above {@link VAULT_SIZE_HOP_CAP}, the
+     * effective hop count is capped to 1 (see {@link capHopsForDensity}).
+     */
+    vaultSize?: number;
+    /**
+     * PR5 — optional LLM neighbor-selection. When provided, at each expansion hop
+     * the deterministically-ranked candidate neighbor entities are handed to this
+     * refiner, which returns the subset to expand. Falls back to the
+     * co-occurrence order on any error or empty result. Called at most ONCE per
+     * hop. Build one with {@link createLlmNeighborRefiner}, or supply your own.
+     */
+    refineNeighbors?: NeighborRefiner;
+    /**
+     * Resolve a batch of candidate memory ids to just the ACTIVE ones (not
+     * archived, not quarantined, not soft-deleted — the same set the final recall
+     * gate admits). When provided, traversal drops "forgotten" memories from the
+     * frontier AT EACH HOP so they neither steer neighbor-entity ranking nor
+     * egress their entity names to {@link refineNeighbors}. Omit (tests /
+     * entity-only callers) to traverse over every linked memory. Wire it from a
+     * vault context with {@link ../db/memoryVault/operations.getActiveVaultMemoryIdsOp}.
+     */
+    filterActiveMemoryIds?: (ids: string[]) => Promise<Set<string>>;
+}
+/**
+ * Picks which candidate neighbor entities to expand at a traversal hop. Given
+ * the query and the deterministically-ranked candidate entity names, return the
+ * subset (≤ `limit`) to expand. Must be resilient: {@link traverseGraphLane}
+ * falls back to the deterministic top-`limit` on a throw or empty return.
+ * @public
+ */
+interface NeighborRefiner {
+    refine(query: string, candidates: string[], limit: number): Promise<string[]>;
+}
+/**
+ * Cap the hop count on large vaults. Fan-out grows with graph density, so above
+ * {@link VAULT_SIZE_HOP_CAP} memories we force seed-only traversal (1 hop)
+ * rather than pay an unbounded expansion. A no-op when `vaultSize` is unknown or
+ * within the threshold.
+ * @public
+ */
+declare function capHopsForDensity(maxHops: number, vaultSize?: number): number;
+/**
+ * Bounded multi-hop entity-graph traversal. Returns an ordered list of memory
+ * IDs (best first) — the SAME output shape as the single-hop lane, so nothing
+ * downstream changes. The caller passes it through as `entityRanking` for RRF
+ * fusion with the cosine/BM25 head.
+ *
+ * With `maxHops <= 1` this returns the seed ordering verbatim, making it a
+ * drop-in equivalent of the single-hop lane (the regression guard). The PR5
+ * default is 2 (one expansion beyond the seed).
+ *
+ * Returns an empty array when the query has no extractable entities or no stored
+ * memory shares a seed entity.
+ *
+ * @public
+ */
+declare function traverseGraphLane(query: string, entityCtx: EntityOperationsContext, options?: GraphTraversalOptions): Promise<string[]>;
+/** Auth + tuning for {@link createLlmNeighborRefiner}. Reuses the recall
+ * `decomposeOptions` shape (dual auth — one of `apiKey`/`getToken`). @public */
+interface LlmNeighborRefinerOptions extends PortalLlmAuth {
+    baseUrl?: string;
+    model?: string;
+    fetchFn?: typeof fetch;
+    maxAttempts?: number;
+    totalTimeoutMs?: number;
+    backoffMs?: (attempt: number) => number;
+}
+/**
+ * Build a {@link NeighborRefiner} backed by a cheap portal LLM. At each hop it
+ * asks the model to pick, from the candidate neighbor entities, the ≤`limit`
+ * most relevant to the query, so traversal expands toward the question instead
+ * of purely by co-occurrence frequency.
+ *
+ * Bounded + fail-safe: one attempt by default, a short total timeout, and
+ * {@link traverseGraphLane} falls back to the deterministic co-occurrence order
+ * on any throw or empty result — so enabling this can reorder which neighbors
+ * expand but never breaks or stalls recall.
+ *
+ * SECURITY / ZERO-KNOWLEDGE (must stay default-OFF): this sends the query +
+ * candidate ENTITY NAMES to the portal UNREDACTED. Those names ARE user PII —
+ * people, places, orgs pulled from the stored graph (e.g. "Sara", "Kyoto",
+ * "Acme") — not lower-risk than content just because they're short. It reuses
+ * the query-decompose auth and is opt-in (`RecallOptions.graphRefine`, default
+ * off in recall); leave it off unless you accept that exposure. To bound that
+ * exposure, {@link traverseGraphLane} caps the candidate list it hands this
+ * refiner per hop — at most `MAX_REFINER_CANDIDATES` entity names ever leave per
+ * hop, REGARDLESS of `entityFanout` (the cap is a hard ceiling, not just a
+ * fanout-scaled floor), so the full frontier is never egressed.
+ *
+ * MEDIUM residual: a malicious / MITM'd portal can only steer WHICH neighbor
+ * entities expand — a recall-ranking nudge, not a data-integrity change (no
+ * memory is written, archived, or deleted), and {@link traverseGraphLane}
+ * falls back to deterministic order on any bad/empty response. Bounded tradeoff.
+ * @public
+ */
+declare function createLlmNeighborRefiner(options: LlmNeighborRefinerOptions): NeighborRefiner;
+
 /**
  * Unified Recall API — single retrieval surface above vault + engine.
  *
@@ -7133,6 +8091,9 @@ declare function useChatStorage(options: UseChatStorageOptions): UseChatStorageR
  * - v33: Added embedding_model column to memory_vault so stale-model vectors are
  *   detectable and re-embeddable after an embedding-model change (null = legacy
  *   rows, grandfathered as compatible with the current model)
+ * - v34: Added topics_user_managed column to memory_vault so a memory whose
+ *   entity links the user has taken manual control of is left alone by
+ *   auto-extraction (null/false = auto-derived, the default)
  * - v35: Added conversation_memory table recording which vault memories a
  *   conversation drew on, so the conversation-level Memories panel survives reload
  * - v36: Added topics_extracted_at column to memory_vault — watermark of the last
@@ -7151,8 +8112,13 @@ declare function useChatStorage(options: UseChatStorageOptions): UseChatStorageR
  *   watermark stamped each time retain() merges into an existing fact, kept
  *   distinct from updated_at (which merges preserve). Lets profile synthesis
  *   weight facts by recency of reinforcement rather than last edit.
+ * - v40: Added fact_type, archived_at, trust_tier columns to memory_vault for
+ *   typed memory + decay + Tier-0 security. All nullable + plaintext, no
+ *   backfill (null = legacy/untyped, active, un-screened — content is
+ *   encrypted so in-migration classification is impossible; NULL = zero-risk,
+ *   exact embedding_model precedent)
  */
-declare const SDK_SCHEMA_VERSION = 39;
+declare const SDK_SCHEMA_VERSION = 40;
 /**
  * Combined WatermelonDB schema for all SDK storage modules.
  *
@@ -7230,11 +8196,13 @@ declare const sdkSchema: Readonly<{
  * - v30 → v31: Added `user_id` column to memory_entity for multi-user scoping of the W5 graph lane (with backfill from memory_vault.user_id)
  * - v31 → v32: Added `pinned_at` column to conversations for pinning chats
  * - v32 → v33: Added `embedding_model` column to memory_vault (null grandfathered as current-model-compatible)
+ * - v33 → v34: Added `topics_user_managed` column to memory_vault (null/false = auto-derived topics, the default)
  * - v34 → v35: Added `conversation_memory` table (conversation ↔ recalled memory ids)
  * - v35 → v36: Added `topics_extracted_at` column to memory_vault (watermark for the background topic-extraction worker; null + existing links grandfathered as extracted)
  * - v36 → v37: Added `superseded_by` + `superseded_at` columns to memory_vault (write-time supersession; null = live, excluded from recall/dedup when set)
  * - v37 → v38: Added `topics_extracted_version` column to memory_vault (extraction-logic version; null read as 0 so a TOPICS_EXTRACTION_VERSION bump re-extracts stale rows)
  * - v38 → v39: Added `last_observed_at` column to memory_vault (C3 re-observation watermark; stamped on retain merge, distinct from updated_at)
+ * - v39 → v40: Added `fact_type`, `archived_at`, `trust_tier` columns to memory_vault for typed memory + decay + Tier-0 security (all nullable + plaintext, NULL backfill)
  */
 declare const sdkMigrations: Readonly<{
     validated: true;
@@ -7756,4 +8724,4 @@ declare function refreshNotionAccessToken(params: NotionRefreshTokenParams): Pro
  */
 declare function createNotionTools(getAccessToken: () => string | null, requestNotionAccess: () => Promise<string>): ToolConfig[];
 
-export { type AutoExtractMessage, type AutoExtractor, type Budget, type CachedChunkVectors, type CachedServerTools, Conversation as ChatConversation, Message as ChatMessage, type ChatRole, type ChunkVectorCache, type ChunkingOptions, type ConsolidationFallbackReason, type ConversationMemoryInput, ConversationMemory as ConversationMemoryModel, type ConversationMemoryOperationsContext, type CreateAutoExtractorOptions, type CreateConversationOptions, type CreateMessageOptions, type CreateVaultFolderOptions, type CreateVaultMemoryOptions, type CryptoPriceClassification, type CryptoPricePreProcessorOptions, DEFAULT_CACHE_EXPIRATION_MS, DEFAULT_CHUNK_CACHE_SIZE, DEFAULT_CHUNK_OVERLAP, DEFAULT_CHUNK_SIZE, DEFAULT_MIN_CHUNK_SIZE, DEFAULT_PROFILE_FACETS, DEFAULT_VAULT_CACHE_SIZE, DatabaseManager, type DatabaseManagerLogger, type DatabaseManagerOptions, type EmbeddedWalletSignerFn, type ExtractFactsOptions, type ExtractOutcome, type ExtractedCandidate, type ExtractedEntity, type ExtractionCursorStore, type FactType, type FileMetadata, type FlushResult, type GetConversationsPageOptions, type GetMessagesPageOptions, INFERENCE_ID_HEADER, type LazyStoredConversation, type Logger, LoggerProvider, type LoggerProviderProps, type MemoriesNeedingTopicExtraction, type EmbeddingOptions as MemoryEngineEmbeddingOptions, type MemoryEngineResult, type MemoryEngineSearchOptions, type MemoryExtractedEvent, type MemoryKind, type MemoryVaultSearchOptions, type MemoryVaultToolOptions, type MessageRedactionResult, type MessageSkeleton, NOTION_OAUTH_CONFIG, type NotionAuthUrlParams, type NotionClientRegistration, type NotionExchangeCodeParams, type NotionOAuthEndpoints, type NotionPKCEChallenge, type NotionRefreshTokenParams, type NotionTokenResponse, PII_PATTERNS, PROFILE_DOC_VERSION, type PiiCategory, type PiiMatch, type PiiPattern, PiiRedactor, type PiiRedactorOptions, type PlatformStorage, type PortalLlmAuth, type ProfileConfigFingerprint, type ProfileDoc, type ProfileFacet, type ProfileFacetKey, type ProfileSection, type PromptPreProcessor, type PromptPreProcessorContext, type QuantizedEmbedding, QueueManager, type QueueStatus, RECALL_MAX_LIMIT, RECALL_TOOL_NAME, type RankedMemory, type RecallContext, type RecallDegradation, type RecallDiagnostics, type RecallOptions, type RecallResult, type RecallToolCallbacks, type RecallToolOptions, type RecencyOptions, type RedactionResult, type ReflectOptions, type ReflectResult, RerankerUnavailableError, type ResumeStreamOptions, type ResumeStreamResult, type ResumeStreamWithStorageResult, type RetainAction, type RetainContext, type RetainOptions, type RetainResult, type RetainSource, SDK_SCHEMA_VERSION, STREAM_RESUMABLE_HEADER, type ScoreBreakdown, type SearchSource, type SendMessageWithStorageArgs, type SendMessageWithStorageDetachedResult, type SendMessageWithStorageResult, type ServerToolsOptions, type ServerToolsResponse, type SignMessageFn, type StockPriceClassification, type StockPricePreProcessorOptions, type ChatCompletionUsage as StoredChatCompletionUsage, type StoredConversation, type StoredConversationMemory, type StoredMessage, type StoredMessageWithSimilarity, type StoredVaultFolder, VaultFolder as StoredVaultFolderModel, type StoredVaultMemory, VaultMemory as StoredVaultMemoryModel, StreamExpiredError, type StreamMetaEvent, type StreamResumeHandle, type SynthesizeProfileOptions, TOPICS_EXTRACTION_VERSION, TOPIC_EXTRACTION_BATCH_SIZE, type TextChunk, type TopicExtractOptions, type TopicExtractionInput, type TopicExtractionRunResult, type TurnCompleteEvent, type TurnSkippedEvent, type UpdateVaultFolderOptions, type UpdateVaultMemoryOptions, type UseChatStorageOptions, type UseChatStorageResult, type UseCreditsOptions, type UseCreditsResult, type UseModelsOptions, type UseModelsResult, type VaultEmbeddingCache, type VaultFolderOperationsContext, type VaultMemoryOperationsContext, type VaultSaveOperation, type VaultSearchResult, WalletPoller, type WeatherClassification, type WeatherPreProcessorOptions, type WebSearchClassification, type WebSearchPreProcessorOptions, addConversationMemoriesOp, buildNotionAuthUrl, chatStorageMigrations, chatStorageSchema, chunkAndEmbedAllMessages, chunkAndEmbedMessage, chunkText, classifyCryptoPrice, classifyCryptoPriceBatch, classifyStockPrice, classifyStockPriceBatch, classifyWeather, classifyWeatherBatch, classifyWebSearch, classifyWebSearchBatch, clearAllEncryptionKeys, clearAllEncryptionState, clearConversationMemoriesOp, clearEncryptionKey, clearLazyTitleCache, clearServerToolsCache, consoleLogger, conversationMemoryToStored, cosineInt8, createAutoExtractor, createChunkVectorCache, createCryptoPricePreProcessor, createMemoryEngineTool, createMemoryVaultSearchTool, createMemoryVaultTool, createNotionTools, createPlatformCursorStore, createRecallTool, createStockPricePreProcessor, createStreamingDeAnonymizer, createVaultEmbeddingCache, createVaultFolderOp, createVaultMemoriesBatchOp, createVaultMemoryOp, createWeatherPreProcessor, createWebSearchPreProcessor, decryptConversationTitle, deleteAllVaultMemoriesForUserOp, deleteVaultFolderOp, deleteVaultMemoryOp, dequantizeEmbedding, discoverNotionOAuthEndpoints, eagerEmbedContent, embedAllMessages, embedMessage, ensureDefaultFoldersOp, exchangeNotionCode, extractAndLinkEntitiesForMemoriesOp, extractAndRetain, extractEntitiesForMemories, extractFacts, generateConversationId, generateEmbedding, generateEmbeddings, generateNotionPKCE, getAllVaultFoldersOp, getAllVaultMemoriesOp, getAllVaultMemoryContentsOp, getCachedServerTools, getConversationMemoriesOp, getConversationsByProjectLazyOp, getConversationsLazyOp, getConversationsPageOp, getLogger, getMemoriesNeedingTopicExtractionOp, getServerTools, getUnfiledVaultMemoriesOp, getVaultFolderMemoryCountOp, getVaultMemoryOp, hasEncryptionKey, isPiiRedactor, isRerankerAvailable, moveMemoriesToFolderOp, noopLogger, onKeyAvailable, preEmbedVaultMemories, quantizeEmbedding, queueManager, recall, reflect, refreshNotionAccessToken, registerNotionClient, requestEncryptionKey, resolvePiiRedactor, resumeStream, retain, sdkMigrations, sdkModelClasses, sdkSchema, searchVaultMemories, setLogger, shouldChunkMessage, stampTopicsExtractedAtOp, streamCancelPath, streamReplayPath, supersedeVaultMemoryOp, synthesizeProfile, updateVaultFolderContextOp, updateVaultFolderOp, updateVaultMemoryEmbeddingOp, updateVaultMemoryOp, upsertMessageOp, useChat, useChatStorage, useCredits, useEncryption, useModels, xhrTransport };
+export { type AutoExtractMessage, type AutoExtractor, type Budget, type CachedChunkVectors, type CachedServerTools, Conversation as ChatConversation, Message as ChatMessage, type ChatRole, type ChunkVectorCache, type ChunkingOptions, type ConsolidationFallbackReason, type ConversationMemoryInput, ConversationMemory as ConversationMemoryModel, type ConversationMemoryOperationsContext, type CreateAutoExtractorOptions, type CreateConversationOptions, type CreateDecaySweeperOptions, type CreateMessageOptions, type CreateVaultFolderOptions, type CreateVaultMemoryOptions, type CryptoPriceClassification, type CryptoPricePreProcessorOptions, DEFAULT_CACHE_EXPIRATION_MS, DEFAULT_CHUNK_CACHE_SIZE, DEFAULT_CHUNK_OVERLAP, DEFAULT_CHUNK_SIZE, DEFAULT_DECAY_POLICY, DEFAULT_MAX_CLASSIFIER_CALLS_PER_SWEEP, DEFAULT_MIN_CHUNK_SIZE, DEFAULT_PROFILE_FACETS, DEFAULT_VAULT_CACHE_SIZE, DatabaseManager, type DatabaseManagerLogger, type DatabaseManagerOptions, type DecayCandidateRaw, type DecayClassifier, type DecayInput, type DecayPolicy, type DecaySweepResult, type DecaySweeper, type DecayVerdict, ENTITY_FANOUT, type EmbeddedWalletSignerFn, type ExtractFactsOptions, type ExtractOutcome, type ExtractedCandidate, type ExtractedEntity, type ExtractionCursorStore, type FactType, type FileMetadata, type FlushResult, type GetConversationsPageOptions, type GetMessagesPageOptions, type GraphTraversalOptions, HARD_DELETE_WINDOW_MS, INFERENCE_ID_HEADER, type InjectionClassifierOptions, type InjectionReason, type LazyStoredConversation, type LlmDecayClassifierOptions, type LlmNeighborRefinerOptions, type Logger, LoggerProvider, type LoggerProviderProps, MAX_HOPS, MEDIUM_TTL_MS, type MemoriesNeedingTopicExtraction, type EmbeddingOptions as MemoryEngineEmbeddingOptions, type MemoryEngineResult, type MemoryEngineSearchOptions, type MemoryExtractedEvent, type MemoryKind, type MemoryQuarantinedEvent, type MemoryVaultSearchOptions, type MemoryVaultToolOptions, type MessageRedactionResult, type MessageSkeleton, NEVER_TTL_MS, NODE_BUDGET, NOTION_OAUTH_CONFIG, type NeighborRefiner, type NotionAuthUrlParams, type NotionClientRegistration, type NotionExchangeCodeParams, type NotionOAuthEndpoints, type NotionPKCEChallenge, type NotionRefreshTokenParams, type NotionTokenResponse, type NowSource, PAST_EVENT_GRACE_MS, PII_PATTERNS, PROFILE_DOC_VERSION, type PiiCategory, type PiiMatch, type PiiPattern, PiiRedactor, type PiiRedactorOptions, type PlatformStorage, type PortalLlmAuth, type ProfileConfigFingerprint, type ProfileDoc, type ProfileFacet, type ProfileFacetKey, type ProfileSection, type PromptPreProcessor, type PromptPreProcessorContext, type QuantizedEmbedding, type QuarantinedMemoryInfo, QueueManager, type QueueStatus, RECALL_MAX_LIMIT, RECALL_TOOL_NAME, type RankedMemory, type RecallContext, type RecallDegradation, type RecallDiagnostics, type RecallOptions, type RecallResult, type RecallToolCallbacks, type RecallToolOptions, type RecencyOptions, type RedactionResult, type ReflectOptions, type ReflectResult, RerankerUnavailableError, type ResumeStreamOptions, type ResumeStreamResult, type ResumeStreamWithStorageResult, type RetainAction, type RetainContext, type RetainOptions, type RetainResult, type RetainSource, SDK_SCHEMA_VERSION, SHORT_TTL_MS, STREAM_RESUMABLE_HEADER, type ScoreBreakdown, type ScreenResult, type ScreenedCandidate, type SearchSource, type SendMessageWithStorageArgs, type SendMessageWithStorageDetachedResult, type SendMessageWithStorageResult, type ServerToolsOptions, type ServerToolsResponse, type SignMessageFn, type StockPriceClassification, type StockPricePreProcessorOptions, type ChatCompletionUsage as StoredChatCompletionUsage, type StoredConversation, type StoredConversationMemory, type StoredMessage, type StoredMessageWithSimilarity, type StoredVaultFolder, VaultFolder as StoredVaultFolderModel, type StoredVaultMemory, VaultMemory as StoredVaultMemoryModel, StreamExpiredError, type StreamMetaEvent, type StreamResumeHandle, type SynthesizeProfileOptions, TOPICS_EXTRACTION_VERSION, TOPIC_EXTRACTION_BATCH_SIZE, type TextChunk, type TopicExtractOptions, type TopicExtractionInput, type TopicExtractionRunResult, type TurnCompleteEvent, type TurnSkippedEvent, type UpdateVaultFolderOptions, type UpdateVaultMemoryOptions, type UseChatStorageOptions, type UseChatStorageResult, type UseCreditsOptions, type UseCreditsResult, type UseModelsOptions, type UseModelsResult, VAULT_SIZE_HOP_CAP, type VaultEmbeddingCache, type VaultFolderOperationsContext, type VaultMemoryOperationsContext, type VaultSaveOperation, type VaultSearchResult, WalletPoller, type WeatherClassification, type WeatherPreProcessorOptions, type WebSearchClassification, type WebSearchPreProcessorOptions, addConversationMemoriesOp, archiveVaultMemoryOp, buildNotionAuthUrl, capHopsForDensity, chatStorageMigrations, chatStorageSchema, chunkAndEmbedAllMessages, chunkAndEmbedMessage, chunkText, classifyCryptoPrice, classifyCryptoPriceBatch, classifyDecay, classifyInjectionCandidates, classifyStockPrice, classifyStockPriceBatch, classifyWeather, classifyWeatherBatch, classifyWebSearch, classifyWebSearchBatch, clearAllEncryptionKeys, clearAllEncryptionState, clearConversationMemoriesOp, clearEncryptionKey, clearLazyTitleCache, clearServerToolsCache, consoleLogger, conversationMemoryToStored, cosineInt8, createAutoExtractor, createChunkVectorCache, createCryptoPricePreProcessor, createDecaySweeper, createLlmDecayClassifier, createLlmNeighborRefiner, createMemoryEngineTool, createMemoryVaultSearchTool, createMemoryVaultTool, createNotionTools, createPlatformCursorStore, createRecallTool, createStockPricePreProcessor, createStreamingDeAnonymizer, createVaultEmbeddingCache, createVaultFolderOp, createVaultMemoriesBatchOp, createVaultMemoryOp, createWeatherPreProcessor, createWebSearchPreProcessor, decryptConversationTitle, deleteAllVaultMemoriesForUserOp, deleteVaultFolderOp, deleteVaultMemoryOp, dequantizeEmbedding, discoverNotionOAuthEndpoints, eagerEmbedContent, embedAllMessages, embedMessage, ensureDefaultFoldersOp, exchangeNotionCode, extractAndLinkEntitiesForMemoriesOp, extractAndRetain, extractEntitiesForMemories, extractFacts, generateConversationId, generateEmbedding, generateEmbeddings, generateNotionPKCE, getAllVaultFoldersOp, getAllVaultMemoriesOp, getAllVaultMemoryContentsOp, getCachedServerTools, getConversationMemoriesOp, getConversationsByProjectLazyOp, getConversationsLazyOp, getConversationsPageOp, getDecayCandidatesRawOp, getLogger, getMemoriesNeedingTopicExtractionOp, getServerTools, getUnfiledVaultMemoriesOp, getVaultFolderMemoryCountOp, getVaultMemoryOp, hardDeleteDecayedOp, hasEncryptionKey, injectionSignatureCatalog, isPiiRedactor, isRerankerAvailable, moveMemoriesToFolderOp, noopLogger, onKeyAvailable, preEmbedVaultMemories, quantizeEmbedding, queueManager, recall, reflect, refreshNotionAccessToken, registerNotionClient, requestEncryptionKey, resolvePiiRedactor, restoreVaultMemoryOp, resumeStream, retain, screenCandidatesForInjection, sdkMigrations, sdkModelClasses, sdkSchema, searchVaultMemories, setLogger, shouldChunkMessage, stampTopicsExtractedAtOp, streamCancelPath, streamReplayPath, supersedeVaultMemoryOp, synthesizeProfile, traverseGraphLane, ttlForType, updateVaultFolderContextOp, updateVaultFolderOp, updateVaultMemoryEmbeddingOp, updateVaultMemoryOp, upsertMessageOp, useChat, useChatStorage, useCredits, useEncryption, useModels, xhrTransport };