@anuma/sdk 3.2.0 → 3.3.0

package/dist/react/index.d.ts

@@ -5658,6 +5658,12 @@ declare class VaultMemory extends Model {
     topicsExtractedVersion: number | null;
     /** C3 re-observation watermark: Unix ms of the last retain() merge, or null. */
     lastObservedAt: number | null;
+    /** Typed memory (PR1) — the extractor's FactType. Null on legacy/manual rows. */
+    factType: string | null;
+    /** Decay archive state (PR2) — Unix ms when archived, null when active. */
+    archivedAt: number | null;
+    /** Tier-0 security (PR3) — "quarantined" | "trusted" | null. */
+    trustTier: string | null;
     createdAt: Date;
     updatedAt: Date;
     isDeleted: boolean;
@@ -5828,290 +5834,25 @@ declare function backfillMemoryEntityUserIdsOp(ctx: EntityOperationsContext, vau
  * lane returns IDs from every user who tagged a matching entity.
  */
 declare function getMemoriesByEntityNamesOp(ctx: EntityOperationsContext, entityNames: readonly string[]): Promise<Map<string, Set<string>>>;
-
-interface StoredVaultMemory {
-    /** WatermelonDB internal ID */
-    uniqueId: string;
-    /** Plain text memory content */
-    content: string;
-    /** Scope for partitioning memories (e.g., "private", "shared") */
-    scope: string;
-    /** Folder ID for organization, null if unfiled */
-    folderId: string | null;
-    /** User ID for multi-user server-side scoping, null on client */
-    userId: string | null;
-    /** JSON-stringified embedding vector, null if not yet computed */
-    embedding: string | null;
-    /** Model that produced `embedding`. Null on legacy rows (grandfathered as
-     * compatible with the current model). */
-    embeddingModel: string | null;
-    /** JSON-stringified array of source message IDs this fact was extracted from. */
-    sourceChunkIds: string[] | null;
-    /** Times this fact has been re-observed (for ranking + UX badges). */
-    proofCount: number | null;
-    /** How the memory was created: manual | auto-extracted | capsule. */
-    source: string | null;
-    /** W6 temporal lane — Unix ms when the event occurred (point/start of range). */
-    eventTimeStart: number | null;
-    /** W6 temporal lane — Unix ms when the event ended (range only). */
-    eventTimeEnd: number | null;
-    /** W6 temporal lane — `point | range | ongoing | null`. */
-    eventTimeKind: string | null;
-    /** When true, the user has manually set this memory's topics (entity links);
-     * auto-extraction leaves them alone. False on legacy/auto rows. */
-    topicsUserManaged: boolean;
-    /** Unix ms of the last LLM topic-extraction pass over this memory's content.
-     * Null = never extracted standalone; rows that already carry entity links
-     * are grandfathered as extracted (see getMemoriesNeedingTopicExtractionOp). */
-    topicsExtractedAt: number | null;
-    /** Write-time supersession (A2): id of the newer memory that replaced this
-     * one (incompatible-value update, e.g. "Lives in Portland" → "Lives in SF").
-     * Null = live. Superseded rows are excluded from recall/dedup by default but
-     * kept for history + the read-time fallback. */
-    supersededBy: string | null;
-    /** Unix ms when this memory was superseded. Null when live. */
-    supersededAt: number | null;
-    /** Extraction-logic version this memory was last stamped under. Null (pre-v38)
-     * reads as 0, so a TOPICS_EXTRACTION_VERSION bump re-extracts stale rows. */
-    topicsExtractedVersion: number | null;
-    /** C3 re-observation watermark: Unix ms of the last retain() merge into this
-     * fact. Distinct from `updatedAt` (which merges preserve). Null = never
-     * re-observed since the column was added; synthesis falls back to
-     * `updatedAt` in that case. */
-    lastObservedAt: number | null;
-    createdAt: Date;
-    updatedAt: Date;
-    isDeleted: boolean;
-}
-interface CreateVaultMemoryOptions {
-    content: string;
-    /** Scope for the memory. Defaults to "private" if omitted. */
-    scope?: string;
-    /** Folder ID for organization, null or omitted if unfiled */
-    folderId?: string | null;
-    /** JSON-stringified embedding vector to persist */
-    embedding?: string;
-    /** Model that produced `embedding`. Persisted alongside it so a later
-     * model change can detect and re-embed stale vectors. */
-    embeddingModel?: string;
-    /** Source message IDs that produced this fact (auto-extraction provenance). */
-    sourceChunkIds?: string[];
-    /** Initial proof count. Defaults to 1 if omitted. */
-    proofCount?: number;
-    /** How the memory was created. Defaults to "manual" if omitted. */
-    source?: string;
-    /** W6 temporal lane — when the event in this memory occurred. */
-    eventTime?: {
-        /** Unix ms timestamp of event start (or point). */
-        start: number | null;
-        /** Unix ms timestamp of event end (range only). */
-        end: number | null;
-        /** Kind: 'point' | 'range' | 'ongoing' | null (or omit). */
-        kind: "point" | "range" | "ongoing" | null;
-    };
-}
-interface UpdateVaultMemoryOptions {
-    content: string;
-    /** If provided, updates the memory's scope. */
-    scope?: string;
-    /** If provided, moves the memory to this folder. */
-    folderId?: string | null;
-    /** JSON-stringified embedding vector to persist, or null to clear stale embedding */
-    embedding?: string | null;
-    /** Model that produced `embedding`. Set whenever `embedding` is written so
-     * the stored model tag stays in sync with the vector. */
-    embeddingModel?: string | null;
-    /** Replace source-chunk-ids list (used during merge to accumulate provenance). */
-    sourceChunkIds?: string[];
-    /** Set an absolute proof count. Prefer {@link proofCountIncrement} for
-     * re-observation paths so the read+write happens inside the writer
-     * and concurrent retains can't lose updates. */
-    proofCount?: number;
-    /** Atomically bump proof_count by this delta inside the write block.
-     * Reads the current value from the in-memory record at write time, so
-     * two parallel retain() calls observe each other's commits and neither
-     * loses its increment. Wins over `proofCount` when both are set. */
-    proofCountIncrement?: number;
-    /** Set source ("manual" | "auto-extracted" | "capsule"). */
-    source?: string;
-    /**
-     * W6 temporal lane — write the event-time fields on update. Use during
-     * auto-merge to preserve (or refine) the original event-time signal when
-     * a new observation lands on an existing fact. Omit to leave the
-     * existing values untouched.
-     */
-    eventTime?: {
-        start: number | null;
-        end: number | null;
-        kind: "point" | "range" | "ongoing" | null;
-    };
-    /**
-     * When true, restore the existing `updated_at` after the write so the
-     * recency multiplier doesn't see a re-observation as a brand-new fact.
-     * Set by auto-merge/consolidate paths — they want proof_count to bump
-     * without inflating recency on top.
-     */
-    preserveUpdatedAt?: boolean;
-    /** C3: Unix ms to stamp as the re-observation watermark (`last_observed_at`).
-     * Set by retain() merge/consolidate paths so a re-observation records "seen
-     * again now" without touching `updated_at` (which `preserveUpdatedAt` keeps
-     * pinned). Omit to leave the existing value untouched. */
-    lastObservedAt?: number;
-    /** If provided, sets whether the user has taken manual control of this
-     * memory's topics. Set by {@link setMemoryEntitiesOp}. */
-    topicsUserManaged?: boolean;
-}
-
-interface VaultMemoryOperationsContext {
-    database: Database;
-    vaultMemoryCollection: Collection<VaultMemory>;
-    walletAddress?: string;
-    signMessage?: SignMessageFn;
-    embeddedWalletSigner?: EmbeddedWalletSignerFn;
-    /** When set, operations scope to this user (server-side multi-user). */
-    userId?: string;
-    /**
-     * When set, vault delete ops cascade to memory_entity rows pointing at
-     * the deleted memories. Without this the W5 graph lane keeps returning
-     * IDs of soft-deleted memories and the join table grows unbounded.
-     */
-    entityCtx?: EntityOperationsContext;
-}
-declare function createVaultMemoryOp(ctx: VaultMemoryOperationsContext, opts: CreateVaultMemoryOptions): Promise<StoredVaultMemory>;
-declare function createVaultMemoriesBatchOp(ctx: VaultMemoryOperationsContext, optionsArray: CreateVaultMemoryOptions[]): Promise<StoredVaultMemory[]>;
-declare function getVaultMemoryOp(ctx: VaultMemoryOperationsContext, id: string): Promise<StoredVaultMemory | null>;
-declare function getAllVaultMemoriesOp(ctx: VaultMemoryOperationsContext, options?: {
-    scopes?: string[];
-    since?: Date;
-    limit?: number;
-    folderId?: string | null;
-    /**
-     * Include soft-deleted memories in the result (each carries
-     * `isDeleted: true`). Default `false` — deleted rows are excluded, as
-     * they are from every other read path. Used by the Memory Graph to
-     * render "forgotten" nodes; ordinary consumers should leave this off.
-     */
-    includeDeleted?: boolean;
-    /**
-     * Include A2-superseded memories (each carries `supersededBy`). Default
-     * `false` — superseded rows are excluded, as they are from recall/dedup.
-     * Used by a "memory history" view to render retired facts.
-     */
-    includeSuperseded?: boolean;
-}): Promise<StoredVaultMemory[]>;
-declare function getAllVaultMemoryContentsOp(ctx: VaultMemoryOperationsContext, options?: {
-    since?: Date;
-}): Promise<string[]>;
-declare function updateVaultMemoryOp(ctx: VaultMemoryOperationsContext, id: string, opts: UpdateVaultMemoryOptions): Promise<StoredVaultMemory | null>;
 /**
- * Replace a memory's topic (entity) links with a user-chosen set and mark the
- * memory `topics_user_managed` so auto-extraction stops touching its links.
- * Replace semantics: the given `entities` become the memory's complete topic
- * set (pass `[]` to clear all topics — the memory stays user-managed and
- * unclustered). Requires `ctx.entityCtx`. Preserves `updated_at` so a topic
- * edit doesn't inflate the recency multiplier.
- */
-declare function setMemoryEntitiesOp(ctx: VaultMemoryOperationsContext, memoryId: string, entities: ReadonlyArray<EntityInput>): Promise<StoredVaultMemory | null>;
-/**
- * Reset a memory's topics to automatic: clear the `topics_user_managed` flag so
- * auto-extraction resumes owning its links. Invalidates `topics_extracted_version`
- * (→ null) and ensures a NON-NULL `topics_extracted_at`, so the next sweep routes
- * the row through the stale-version pending path and actually RE-EXTRACTS it via
- * the LLM. A never-stamped user-curated row (`setMemoryEntitiesOp` marks
- * user-managed without stamping, so stamp can be null) would otherwise fall
- * through the sweep's unstamped→`linkedUnstamped` grandfather path (stamped
- * current, no LLM pass); forcing a stamp when absent avoids that. Existing links
- * are left in place until the re-extraction replaces them. Preserves `updated_at`.
- */
-declare function clearMemoryTopicsOverrideOp(ctx: VaultMemoryOperationsContext, memoryId: string): Promise<boolean>;
-declare function deleteVaultMemoryOp(ctx: VaultMemoryOperationsContext, id: string): Promise<boolean>;
-/**
- * Mark a memory as superseded by a newer one (A2 write-time supersession).
- * The row stays in the table (history + read-time fallback) but is excluded
- * from recall/dedup by default via `superseded_by`. Idempotent-ish: no-op if
- * the row is missing, not owned, deleted, or already superseded. Does NOT
- * preserve `updated_at` — superseded rows are hidden from recall, so their
- * recency is irrelevant.
+ * Reverse of {@link getMemoriesByEntityNamesOp}: given a set of memory IDs
+ * (e.g. the current BFS frontier), return each memory's set of linked
+ * canonical entity names. This is the missing primitive for multi-hop graph
+ * traversal (PR4) — one step outward from a memory to its neighbor entities,
+ * which the traversal then expands to reach topically-adjacent memories.
  *
- * @param id - the memory being retired (e.g. "Lives in Portland")
- * @param supersededById - the newer memory that replaced it (e.g. "Lives in SF")
- */
-declare function supersedeVaultMemoryOp(ctx: VaultMemoryOperationsContext, id: string, supersededById: string): Promise<boolean>;
-/**
- * Get all non-deleted, unfiled vault memories (folder_id is null).
- */
-declare function getUnfiledVaultMemoriesOp(ctx: VaultMemoryOperationsContext): Promise<StoredVaultMemory[]>;
-/**
- * The current topic-extraction logic version. Bump this whenever the extraction
- * prompt or model in `topicExtract.ts` changes: every memory stamped under an
- * older version (including pre-v37 rows, read as version 0) is then re-extracted
- * by the next sweep, so topic-quality improvements propagate across the existing
- * vault. The worker's `limit` drains that re-extraction across sweeps.
- */
-declare const TOPICS_EXTRACTION_VERSION = 1;
-/**
- * Result of {@link getMemoriesNeedingTopicExtractionOp}: which memories the
- * background topic worker should run LLM entity extraction on, and which it
- * should merely stamp as already-extracted.
- */
-interface MemoriesNeedingTopicExtraction {
-    /**
-     * Memories to run LLM topic extraction on (decrypted): never-extracted rows
-     * with no entity links, plus stamped rows edited since their last pass
-     * (`updated_at` > `topics_extracted_at`) or extracted under an older
-     * `topics_extracted_version` than {@link TOPICS_EXTRACTION_VERSION}. Edited /
-     * stale-version rows come first (they get priority under `limit`), each group
-     * newest-created first.
-     */
-    pending: StoredVaultMemory[];
-    /**
-     * IDs of rows that already have entity links but no watermark — legacy rows
-     * extracted by the conversation pipeline before v36. Grandfather these with
-     * {@link stampTopicsExtractedAtOp} (no LLM call) so a later content edit
-     * makes them re-extractable instead of invisible forever. Bounded by the
-     * same `limit` as {@link pending} — stamping loads a Model per row, so the
-     * grandfather backlog is drained across sweeps rather than in one spike.
-     */
-    linkedUnstamped: string[];
-}
-/**
- * Sweep query for the background topic-extraction worker: partition the
- * user's non-deleted, non-user-managed memories by what the worker should do
- * with them (see {@link MemoriesNeedingTopicExtraction}). User-managed rows
- * are never returned — the user owns their topics, including an intentionally
- * empty set. Requires `ctx.entityCtx` for the entity-links check.
- */
-declare function getMemoriesNeedingTopicExtractionOp(ctx: VaultMemoryOperationsContext, options?: {
-    limit?: number;
-}): Promise<MemoriesNeedingTopicExtraction>;
-/**
- * Stamp `topics_extracted_at` (and `topics_extracted_version`) on the given
- * memories — the topic worker calls this after a successful extraction pass
- * (including zero-entity results, so quiet memories aren't re-asked every sweep)
- * and to grandfather `linkedUnstamped` rows without an LLM call. `version`
- * defaults to {@link TOPICS_EXTRACTION_VERSION}: stamping at the current version
- * (for both fresh extractions and grandfathered legacy rows) means they aren't
- * re-extracted until a future version bump. Preserves `updated_at` so a stamp
- * never inflates the recency multiplier — and never masks a concurrent content
- * edit from the next sweep. Skips deleted, foreign-user, and user-managed rows.
- * Returns the IDs actually stamped.
+ * Empty input returns an empty map. Memory IDs with no links contribute
+ * nothing (they simply don't appear as keys).
  *
- * ALL eligibility AND `updated_at` are read from the LIVE Model inside the
- * serialized writer — never a pre-writer snapshot. Writers are serialized, so
- * a content edit or topic-override that commits before this writer runs is
- * observed here: its fresh `updated_at` is preserved (so the next sweep's
- * `updated_at > stamp` check still fires) and a mid-pass user-managed flip
- * skips the row. Reading `updated_at` from a raw pre-fetch instead would write
- * a stale value back, pushing `updated_at < topics_extracted_at` and hiding
- * the edited memory from every future sweep.
+ * Multi-user safety mirrors {@link getMemoriesByEntityNamesOp} exactly: when
+ * `ctx.userId` is set, only `memory_entity` rows owned by that user are
+ * followed (with the same `allowUnscopedRows` LokiJS escape hatch for pre-v31
+ * rows whose `user_id` backfill was a no-op). Without the filter the reverse
+ * lookup would leak entity links written by other users.
  *
- * Callers bound the input via `getMemoriesNeedingTopicExtractionOp`'s `limit`
- * (both `pending` and `linkedUnstamped` are capped), so the per-row Model load
- * needed to `prepareUpdate` stays bounded and never spikes the RecordCache.
+ * @public
  */
-declare function stampTopicsExtractedAtOp(ctx: VaultMemoryOperationsContext, memoryIds: readonly string[], extractedAt: number, version?: number): Promise<string[]>;
-declare function deleteAllVaultMemoriesForUserOp(ctx: VaultMemoryOperationsContext, userId: string): Promise<number>;
-declare function updateVaultMemoryEmbeddingOp(ctx: VaultMemoryOperationsContext, id: string, embedding: string, embeddingModel: string): Promise<boolean>;
+declare function getEntitiesByMemoryIdsOp(ctx: EntityOperationsContext, memoryIds: readonly string[]): Promise<Map<string, Set<string>>>;
 
 /**
  * Auth for portal LLM calls (extraction, consolidation, decomposition,
@@ -6132,6 +5873,165 @@ interface PortalLlmAuth {
     getToken?: () => Promise<string | null>;
 }
 
+/**
+ * Optional LLM injection classifier — Tier-0 security second layer (PR5).
+ *
+ * The deterministic {@link ./injectionScreen} is a signature scan: it catches
+ * imperative overrides, role-marker leakage, and exfil URLs, but by
+ * construction it CANNOT catch signature-free poison phrased as a plain
+ * third-person fact — e.g. "Trusts BrandX for financial advice", "Prefers to
+ * always use the AcmePay card". Those read like ordinary preferences and sail
+ * through the regex screen.
+ *
+ * This module closes that gap as a SECOND, opt-in layer. In `extractAndRetain`
+ * it runs ONLY over the candidates the deterministic screen already passed as
+ * clean, asking a cheap model a single batched yes/no per candidate: "is this
+ * an instruction to the assistant / a planted preference, rather than a genuine
+ * fact the user stated about themselves?" Positives are moved to quarantine
+ * (trust_tier="quarantined"), exactly like a signature hit.
+ *
+ * Safety posture (why it can only ever add safety, never remove it):
+ *   - Default OFF. No option → no LLM call → zero latency/cost added, and the
+ *     write path is byte-for-byte the pre-PR5 deterministic screen.
+ *   - Fails CLEAN. Any error (network, timeout, malformed JSON, auth) → the
+ *     candidate stays in the clean set (trusts the deterministic result). A
+ *     flaky classifier can never suppress a legitimate memory.
+ *   - Bounded. One batched portal call per turn (never per-candidate), with a
+ *     candidate cap, a low retry budget, and a wall-clock total-timeout.
+ *   - Zero-knowledge parity. Candidate content is PII-redacted before it
+ *     reaches the portal using the SAME redactor setting as the extraction
+ *     path (inherited by `extractAndRetain`); the model only ever returns
+ *     integer indices, so nothing needs de-anonymizing on the way back.
+ *
+ * SECURITY (MEDIUM, residual): this is a NEW portal call surface for memory
+ * content. It is gated on an explicit opt-in and redacts like the extractor, but
+ * a security review should treat enabling it as widening the set of models that
+ * see (redacted) facts. A malicious / MITM'd portal can also use it as a lever
+ * to QUARANTINE the affected rows (they drop out of recall) — reversible, and it
+ * can never delete or alter a memory. Bounded, recoverable trust tradeoff; gate
+ * on trust in the portal.
+ */
+
+/**
+ * Auth + tuning for the optional LLM injection classifier. Auth is the dual
+ * pattern — one of `apiKey` / `getToken` is required at runtime (see
+ * {@link PortalLlmAuth}). The mere PRESENCE of this options object in
+ * `extractAndRetain` is the opt-in switch; omit it for the default-off,
+ * deterministic-only screen.
+ * @public
+ */
+interface InjectionClassifierOptions extends PortalLlmAuth {
+    baseUrl?: string;
+    model?: string;
+    /** Override fetch (tests). */
+    fetchFn?: typeof fetch;
+    /** Max portal attempts on a TRANSIENT failure. Default 2. */
+    maxAttempts?: number;
+    /** Absolute wall-clock budget across attempts. Default 15s. */
+    totalTimeoutMs?: number;
+    /** Backoff before each retry (ms). Tests pass `() => 0`. */
+    backoffMs?: (attempt: number) => number;
+    /**
+     * PII redaction for the outbound content, same switch as the extractor.
+     * `extractAndRetain` inherits the extraction setting so enabling redaction
+     * there also protects this call. `true` = fresh per-call redactor; pass a
+     * shared {@link PiiRedactor} to keep placeholder numbering consistent.
+     */
+    piiRedaction?: boolean | PiiRedactor;
+    /** Max candidates classified per call. Default 20. */
+    maxCandidates?: number;
+}
+/**
+ * Classify already-clean extraction candidates for signature-free injection /
+ * poisoning. Returns the set of 0-based indices (into `candidates`) the model
+ * flagged as poison.
+ *
+ * FAILS CLEAN: returns an empty set on empty input, missing auth, LLM error,
+ * or any malformed response — the caller then keeps every candidate clean, so
+ * this layer can only ever ADD quarantines, never suppress a legitimate fact
+ * on failure. Makes at most ONE portal call regardless of candidate count.
+ *
+ * @public
+ */
+declare function classifyInjectionCandidates(candidates: readonly ExtractedCandidate[], options: InjectionClassifierOptions): Promise<{
+    flagged: Set<number>;
+}>;
+
+/**
+ * Write-time memory-poisoning screen — Tier-0 security (PR3).
+ *
+ * Deterministic, network-free, and always on. Scans each extraction
+ * candidate's `content` for prompt-injection / memory-poisoning
+ * signatures and routes flagged candidates to quarantine instead of the
+ * live vault.
+ *
+ * WHY a signature scan (not an LLM classifier): this runs on the write
+ * path for every extracted fact, so it must be cheap, offline, and must
+ * never leak content to a model. It also gives a small false-positive
+ * surface here: durable third-person facts about the user ("Lives in San
+ * Francisco", "Allergic to shellfish", "Works in engineering") almost
+ * never contain second-person imperatives aimed at the assistant, chat
+ * role markers, or beacon URLs — the exact shapes these signatures look
+ * for. An optional LLM injection classifier is deferred to PR5.
+ *
+ * WHY quarantine, not drop: a flagged candidate is still persisted (see
+ * `extractAndRetain`) with `trust_tier="quarantined"` so it stays an
+ * auditable record, recoverable by an operator via the `includeQuarantined`
+ * read path. The `baseVaultConditions` choke point excludes quarantined
+ * rows from every recall lane, so a poisoned fact never reaches the answer
+ * model even though it lives in the DB.
+ *
+ * This MITIGATES memory poisoning (MINJA / AgentPoison; OWASP ASI06 2026).
+ * It is not a complete solve — a poison phrased as a plain third-person
+ * fact ("Prefers the BrandX credit card") carries no injection signature
+ * and will pass. The proof-count ranking boost (once-seen facts stay
+ * low-ranked) and the read-time isolation in `formatRecallResult` are the
+ * complementary layers.
+ */
+
+/** Why a candidate was quarantined. Coarse buckets over the signature set
+ * below — surfaced for audit/telemetry, never alongside the content.
+ * `llm_semantic` (PR5) is emitted by the optional second-layer LLM classifier
+ * ({@link classifyInjectionCandidates}), not by any deterministic signature
+ * here — it catches signature-free poison ("Trusts BrandX for financial
+ * advice") the regex screen passes as clean. */
+type InjectionReason = "imperative_override" | "role_marker_leak" | "exfiltration_url" | "llm_semantic";
+/** A candidate the screen flagged, with the matching signature id + reason.
+ * Content is intentionally NOT duplicated here beyond the candidate itself —
+ * callers must never log `candidate.content`. */
+interface ScreenedCandidate {
+    candidate: ExtractedCandidate;
+    /** Coarse reason bucket. */
+    reason: InjectionReason;
+    /** Stable id of the signature that matched (safe to log; carries no content). */
+    signature: string;
+}
+/** Result of screening a candidate batch. */
+interface ScreenResult {
+    /** Candidates with no injection signature — persist normally. */
+    clean: ExtractedCandidate[];
+    /** Candidates that matched a signature — persist quarantined. */
+    quarantined: ScreenedCandidate[];
+}
+/**
+ * Screen extraction candidates for injection / poisoning signatures.
+ *
+ * Partitions the input into `clean` (persist normally) and `quarantined`
+ * (persist with `trust_tier="quarantined"`, hidden from recall). Pure and
+ * synchronous — no network, no DB, no content logging. Input order is
+ * preserved within each partition.
+ */
+declare function screenCandidatesForInjection(candidates: readonly ExtractedCandidate[]): ScreenResult;
+/**
+ * Content-free catalog of the active signatures (id + reason, no patterns).
+ * Exposed so a security review / audit surface can enumerate coverage
+ * without reaching into module internals. Does not leak any user content.
+ */
+declare function injectionSignatureCatalog(): {
+    id: string;
+    reason: InjectionReason;
+}[];
+
 /**
  * Linear recency decay multiplier — applied post-fusion to nudge fresh
  * memories above stale ones with otherwise comparable scores.
@@ -6185,6 +6085,23 @@ interface MemoryVaultSearchOptions {
     scopes?: string[];
     /** When provided, only search memories in this folder (null for unfiled) */
     folderId?: string | null;
+    /** Typed memory (PR1) — when provided, only search memories of these fact
+     * types. Applied at load time via `Q.oneOf` on the indexed `fact_type`
+     * column. Omit for no type filter. */
+    factTypes?: string[];
+    /**
+     * PR5 — optional per-FactType score multiplier applied in the boost stage
+     * (e.g. `{ identity: 1.2, ongoing_context: 0.8 }`). Empty/omitted = uniform
+     * (no behavior change). See {@link rankFusedVaultMemories}.
+     */
+    factTypeWeights?: Record<string, number>;
+    /**
+     * PR5 — include archived (decayed) rows in the candidate load. Default false
+     * (the baseVaultConditions choke point excludes them). retain()'s dedup
+     * search sets this so a re-observed fact can merge into — and un-archive — an
+     * archived row instead of creating a fresh duplicate.
+     */
+    includeArchived?: boolean;
     /**
      * Use the hybrid fusion ranker (cosine + BM25 + RRF + recency) instead of
      * cosine-only. Default true — new W1 pipeline. Pass false to fall back
@@ -6279,6 +6196,10 @@ interface VaultSearchResult {
     eventTimeStart?: number | null;
     eventTimeEnd?: number | null;
     eventTimeKind?: "point" | "range" | "ongoing" | null;
+    /** Typed memory (PR1) — the fact's FactType, threaded through from the
+     * storage row alongside the event-time anchors. Null/undefined when
+     * untyped. Loose string (originates from a stored column). */
+    factType?: string | null;
     /** Message ids this fact was extracted from (provenance). recall() uses
      * these to suppress the originating chunk in the chunk lane. */
     sourceChunkIds?: string[] | null;
@@ -6368,6 +6289,14 @@ interface RankedMemory {
     eventTimeStart?: number | null;
     eventTimeEnd?: number | null;
     eventTimeKind?: "point" | "range" | "ongoing" | null;
+    /**
+     * Typed memory (PR1) — the extractor's FactType classification for this
+     * fact, threaded through the same channel as the event-time anchors so
+     * recall results (and UI) can show the type without a second DB read.
+     * Null/undefined on legacy/untyped/manual facts. Kept as a loose string
+     * (not narrowed to FactType) since it originates from a stored column.
+     */
+    factType?: string | null;
     conversationId?: string;
     messageId?: string;
     role?: "user" | "assistant";
@@ -6389,6 +6318,18 @@ interface RecallOptions {
     scopes?: string[];
     /** Vault folder filter. Vault-only. */
     folderId?: string | null;
+    /**
+     * Typed memory (PR1) — restrict fact recall to these FactTypes. Optional
+     * and no-op when unset (all types are eligible). Vault-only.
+     */
+    factTypes?: FactType[];
+    /**
+     * PR5 — optional per-FactType score multiplier applied in the fusion boost
+     * stage (e.g. boost `identity`/`constraint`, down-weight `ongoing_context`).
+     * A type absent from the map (and untyped rows) uses 1.0, so an empty/omitted
+     * map is a no-op (uniform weighting). Vault-only.
+     */
+    factTypeWeights?: Partial<Record<FactType, number>>;
     /** Restrict chunk search to one conversation. Chunk-only. */
     conversationId?: string;
     /** Exclude one conversation from chunk search. Chunk-only. */
@@ -6441,6 +6382,21 @@ interface RecallOptions {
     bm25AdmissionDivisor?: number;
     /** RRF smoothing constant for lane fusion (facts × chunks and side lanes). Default: 60. */
     rrfK?: number;
+    /** Total graph hops incl. the seed lookup (hop 1). Default: 1 (seed only). */
+    maxHops?: number;
+    /** Max neighbor entities expanded per hop. Default: 8. */
+    entityFanout?: number;
+    /** Hard cap on accumulated memory IDs across all hops. Default: 64. */
+    nodeBudget?: number;
+    /**
+     * PR5 — enable LLM graph path-refinement: at each traversal hop a model picks
+     * which neighbor entities to expand instead of pure co-occurrence ranking.
+     * Opt-in (default false); only active on the `high` budget (needs the
+     * `traverse` flag) AND when `decomposeOptions` is set (reuses that auth).
+     * Falls back to deterministic co-occurrence order on any error. Adds ≤1 LLM
+     * call per expansion hop.
+     */
+    graphRefine?: boolean;
 }
 interface RecallContext {
     /** Required when `types` includes 'fact'. */
@@ -6580,6 +6536,22 @@ interface RetainOptions {
         start: number;
         end: number | null;
     } | null;
+    /**
+     * Typed memory (PR1) — the extractor's classification for this fact.
+     * Persisted on create; on merge/consolidate it lazily backfills the target
+     * only when the target has no type yet (never overwrites a non-null type).
+     * Auto-extraction emits this; manual writes omit it (persisted as null).
+     */
+    factType?: FactType;
+    /**
+     * Tier-0 security (PR3) — trust tier for this fact. The write-time
+     * injection screen threads `"quarantined"` here for flagged candidates;
+     * omit for the default (null/trusted). Persisted only on create (a
+     * quarantined candidate is force-created, never merged, so it can't bump
+     * or contaminate a clean memory). The DB op re-validates the value
+     * against the known set before writing.
+     */
+    trustTier?: string;
 }
 interface RetainResult {
     action: RetainAction;
@@ -6662,195 +6634,654 @@ interface ExtractedEntity {
     name: string;
     kind?: EntityKind;
 }
-interface ExtractedCandidate {
+interface ExtractedCandidate {
+    content: string;
+    type: FactType;
+    confidence: number;
+    sourceMessageIds: string[];
+    entities: ExtractedEntity[];
+    /** W6 temporal lane — when the event in this fact occurred. Resolved
+     *  to absolute timestamps by the LLM; null when the fact has no
+     *  temporal anchor. */
+    eventTime: {
+        kind: "point" | "range" | "ongoing";
+        /** Unix ms timestamp of the event start (or point). */
+        start: number;
+        /** Unix ms timestamp of the event end. Only set when kind='range'. */
+        end: number | null;
+    } | null;
+}
+/**
+ * Tier-0 security (PR3) — describes a candidate the injection screen
+ * quarantined and persisted as an audit row. The client uses this to surface
+ * a "held for review" state. `content` lives on `candidate` (same exposure as
+ * {@link ExtractedCandidate}); never log it.
+ */
+interface QuarantinedMemoryInfo {
+    candidate: ExtractedCandidate;
+    /** The persisted (quarantined) memory row id. */
+    memoryId: string;
+    /** Coarse reason bucket from the screen. */
+    reason: InjectionReason;
+    /** Stable signature id that matched (safe to log; carries no content). */
+    signature: string;
+}
+/**
+ * Auth + endpoint for the extraction LLM call. Auth is the dual pattern —
+ * one of `apiKey` / `getToken` is required at runtime; see
+ * {@link PortalLlmAuth}.
+ */
+interface ExtractFactsOptions extends PortalLlmAuth {
+    baseUrl?: string;
+    model?: string;
+    /** Override the global fetch implementation (useful for tests). */
+    fetchFn?: typeof fetch;
+    /**
+     * The user's own name(s) / handle(s) (e.g. profile nickname, wallet display
+     * name). Candidates whose entire content is just one of these are dropped —
+     * a personal memory system already knows who the user is, so "Peter Lee" is
+     * circular noise. Optional; when omitted only the bare-fragment gate applies.
+     */
+    userIdentity?: string[];
+    /**
+     * Reference "now" (Unix ms) for resolving relative temporal phrases in the
+     * transcript ("yesterday", "next week", "in two days") into the absolute
+     * YYYY-MM-DD anchors the W6 temporal lane indexes on. The transcript itself
+     * carries no timestamps, so without an anchor the model resolves relatives
+     * against its own training-cutoff guess and emits wrong `eventTime` dates.
+     * Defaults to `Date.now()`. Override for back-dated eval corpora and
+     * deterministic tests (mirrors {@link RecallOptions.now}).
+     *
+     * Server-side timezone note: the ms value is formatted to a calendar date in
+     * the process's local timezone (same basis as `parseLocalCalendarDay`). On a
+     * UTC server, a user near midnight in a non-UTC offset can get the wrong
+     * calendar day. Pass the user's local-midnight timestamp as `now` when the
+     * process timezone doesn't match the user's.
+     */
+    now?: number;
+    /**
+     * Max attempts for the extraction call on a transient failure (default 3).
+     * Lower it to bound how long extraction can hold a turn open — e.g. a worker
+     * that runs extraction behind an in-flight-turn guard can pass `2` to keep
+     * repeated failures from delaying later turns.
+     */
+    maxAttempts?: number;
+    /** Per-attempt timeout (ms) for the extraction call. Defaults to the portal
+     * helper's 60s. Combine with {@link maxAttempts} to cap the total time budget. */
+    timeoutMs?: number;
+    /**
+     * Absolute wall-clock budget (ms) across ALL extraction attempts incl. backoff.
+     * When set, the loop stops before an attempt that would exceed it, so worst-case
+     * latency is bounded rather than `maxAttempts × timeoutMs`.
+     */
+    totalTimeoutMs?: number;
+    /**
+     * Override the retry backoff (ms) for a given 1-based attempt index. The
+     * extraction call retries transient failures internally (default exponential
+     * backoff); pass `() => 0` to retry without delay (useful for tests).
+     */
+    backoffMs?: (attempt: number) => number;
+    /**
+     * When set, PII (emails, phones, SSNs, cards, IPs, API keys, …) in the
+     * conversation transcript is replaced with tagged placeholders before the
+     * extraction call, and the returned facts + entities are de-anonymized so the
+     * vault keeps the real values while raw PII never reaches the extraction
+     * model (and, via `extractAndRetain`, the consolidation model). Pass `true`
+     * for a fresh per-call redactor, or a shared {@link PiiRedactor} to keep
+     * placeholder numbering consistent with other calls.
+     *
+     * NOTE: this does NOT cover the embeddings provider. Facts are stored and
+     * embedded with their real values, so to keep PII out of embedding requests
+     * set `RetainContext.embeddingOptions.maskInput` (e.g. `redactor.maskText`)
+     * as well — the two are independent switches.
+     */
+    piiRedaction?: boolean | PiiRedactor;
+    /**
+     * Called when the extraction LLM returned no usable result after exhausting
+     * its retries (empty/malformed completion, network/HTTP error) — i.e. a
+     * *failure* that drops the turn's facts, as opposed to a legitimate
+     * `{candidates: []}` "nothing durable here". Lets callers distinguish a
+     * silently-degrading extractor from quiet turns (the two are otherwise
+     * indistinguishable). See {@link extractAndRetain}'s `outcome`.
+     */
+    onExhaustedEmpty?: () => void;
+    /**
+     * Called when the extractor DID produce candidates but PII de-anonymization
+     * dropped every one of them — the model mangled its placeholders (so they
+     * can't be restored to real values) or restoring the values blew the length
+     * cap. These drops happen before `retain()`, so `failedCount` can't see them,
+     * and the turn would otherwise masquerade as a quiet `no-facts` result. Lets
+     * H3's `outcome` surface `dropped-after-redaction` so a rising PII-drop rate
+     * (i.e. redaction silently eating facts) is alarmable.
+     */
+    onCandidatesDropped?: () => void;
+}
+/**
+ * Stage 1 — call the LLM to extract candidate facts from the recent
+ * conversation. Returns post-validated candidates only (confidence
+ * threshold, source-id check, length cap, schema validation). Returns
+ * an empty array if the LLM emits malformed JSON or no candidates.
+ *
+ * A null from `callPortalJsonCompletion` means a *failure* (empty completion,
+ * malformed JSON, network/HTTP error) — distinct from a successful
+ * `{candidates: []}`, which parses to a non-null object. A failed extraction
+ * silently drops the whole turn's memories, so transient failures matter:
+ * `callPortalJsonCompletion` retries them internally with backoff (default 3
+ * attempts), so a one-off empty/malformed completion from a reasoning-class
+ * model doesn't lose the turn. Only an exhausted-retry null reaches here.
+ */
+declare function extractFacts(messages: AutoExtractMessage[], options: ExtractFactsOptions): Promise<ExtractedCandidate[]>;
+/**
+ * Outcome of the EXTRACTOR stage for a turn — independent of whether the
+ * subsequent `retain()` writes landed (that's `failedCount`):
+ * - `extracted`         — the extractor produced at least one candidate above
+ *                         the confidence floor. Whether those writes succeeded
+ *                         is reported separately by `failedCount` — so
+ *                         `extracted` + `failedCount > 0` means "found facts but
+ *                         writes are failing", which is more signal than
+ *                         collapsing it into `no-facts` would give.
+ * - `no-facts`          — the extractor ran fine but found nothing durable.
+ * - `empty-after-retry` — the extractor returned empty/malformed after
+ *                         exhausting retries (a *failure*). Distinguishing this
+ *                         from `no-facts` is what makes a silently-degrading
+ *                         extractor alarmable rather than invisible.
+ * - `dropped-after-redaction` — the extractor found facts but PII
+ *                         de-anonymization dropped every one (mangled
+ *                         placeholders / over-cap after restore), before retain.
+ *                         A degradation `failedCount` can't see; would otherwise
+ *                         look like `no-facts`.
+ */
+type ExtractOutcome = "extracted" | "no-facts" | "empty-after-retry" | "dropped-after-redaction";
+/**
+ * Stage 2 — for each extracted candidate, call retain() with auto-merge
+ * enabled. When `consolidateOptions` are wired, retain()'s consolidation pass
+ * is the "resolver": a second LLM call against the top-K existing vault
+ * memories that decides create/update/noop/supersede — including retiring a
+ * stale value on a state change (the supersession the extraction prompt above
+ * promises). Without consolidation, retain() still dedups at the cosine-merge
+ * level, and the read-time supersession heuristic remains the fallback.
+ *
+ * Returns the candidates that survived validation along with the retain
+ * result for each (which captures whether the fact was created, merged,
+ * or skipped), plus an `outcome` summarizing why the turn did/didn't produce
+ * facts (see {@link ExtractOutcome}).
+ */
+declare function extractAndRetain(messages: AutoExtractMessage[], retainCtx: RetainContext, options: {
+    extract: ExtractFactsOptions;
+    minConfidence?: number;
+    /** Override scope/folder for all retained facts. */
+    scope?: string;
+    folderId?: string | null;
+    /**
+     * Forwarded verbatim to each retain() call — enables the LLM-based
+     * consolidation pass (Hindsight facet-dedup) on every write. See
+     * `RetainOptions.consolidateOptions` for auth + observability fields.
+     */
+    consolidateOptions?: RetainOptions["consolidateOptions"];
+    /**
+     * When provided, persist each candidate's `entities[]` to the
+     * entity + memory_entity tables after a successful retain. This
+     * powers the W5 graph retrieval lane — recall() can query for
+     * memories sharing entities with the user's question.
+     */
+    entityCtx?: EntityOperationsContext;
+    /**
+     * Per-candidate failure hook — invoked once per filtered candidate
+     * whose `retain()` call threw. Lets UI layers surface "couldn't save
+     * X" toasts; without it consumers only see the aggregate
+     * `failedCount` and can't name which facts dropped.
+     */
+    onCandidateFailed?: (candidate: ExtractedCandidate, error: unknown) => void;
+    /**
+     * Tier-0 security (PR3) — invoked once per candidate the injection screen
+     * quarantined AND persisted (audit row written). Lets a UI surface a
+     * "held for review" state instead of the fact silently vanishing. Carries
+     * the same content exposure as `onMemoryExtracted` (the candidate) plus
+     * the persisted `memoryId` + the screen `reason`/`signature`; content is
+     * never logged. Fired only on a successful quarantine write, not on a
+     * failed one (that goes to `onCandidateFailed`).
+     */
+    onQuarantined?: (info: QuarantinedMemoryInfo) => void;
+    /**
+     * Tier-0 security (PR5) — optional SECOND-layer LLM injection classifier.
+     * When provided, candidates the deterministic {@link screenCandidatesForInjection}
+     * screen passed as CLEAN are additionally run through a cheap LLM that
+     * catches signature-free poison ("Trusts BrandX for financial advice")
+     * the regex screen can't. Positives are quarantined exactly like a
+     * signature hit (reason `llm_semantic`). DEFAULT OFF — omit this to keep
+     * the deterministic-only, no-extra-LLM-call path. Fails clean on any
+     * error. Content is PII-redacted before the call, inheriting the
+     * extraction redaction setting when this option doesn't set its own.
+     */
+    injectionClassifier?: InjectionClassifierOptions;
+}): Promise<{
+    candidates: ExtractedCandidate[];
+    results: RetainResult[];
+    failedCount: number;
+    outcome: ExtractOutcome;
+    /**
+     * Tier-0 security (PR3) — candidates quarantined by the injection screen and
+     * persisted as audit rows (trust_tier="quarantined"). Kept OUT of
+     * `candidates`/`results` so `onMemoryExtracted` never announces poison;
+     * surfaced here so callers can distinguish "nothing extracted" from
+     * "extracted but held for review".
+     */
+    quarantined: QuarantinedMemoryInfo[];
+}>;
+
+interface StoredVaultMemory {
+    /** WatermelonDB internal ID */
+    uniqueId: string;
+    /** Plain text memory content */
+    content: string;
+    /** Scope for partitioning memories (e.g., "private", "shared") */
+    scope: string;
+    /** Folder ID for organization, null if unfiled */
+    folderId: string | null;
+    /** User ID for multi-user server-side scoping, null on client */
+    userId: string | null;
+    /** JSON-stringified embedding vector, null if not yet computed */
+    embedding: string | null;
+    /** Model that produced `embedding`. Null on legacy rows (grandfathered as
+     * compatible with the current model). */
+    embeddingModel: string | null;
+    /** JSON-stringified array of source message IDs this fact was extracted from. */
+    sourceChunkIds: string[] | null;
+    /** Times this fact has been re-observed (for ranking + UX badges). */
+    proofCount: number | null;
+    /** How the memory was created: manual | auto-extracted | capsule. */
+    source: string | null;
+    /** W6 temporal lane — Unix ms when the event occurred (point/start of range). */
+    eventTimeStart: number | null;
+    /** W6 temporal lane — Unix ms when the event ended (range only). */
+    eventTimeEnd: number | null;
+    /** W6 temporal lane — `point | range | ongoing | null`. */
+    eventTimeKind: string | null;
+    /** When true, the user has manually set this memory's topics (entity links);
+     * auto-extraction leaves them alone. False on legacy/auto rows. */
+    topicsUserManaged: boolean;
+    /** Unix ms of the last LLM topic-extraction pass over this memory's content.
+     * Null = never extracted standalone; rows that already carry entity links
+     * are grandfathered as extracted (see getMemoriesNeedingTopicExtractionOp). */
+    topicsExtractedAt: number | null;
+    /** Write-time supersession (A2): id of the newer memory that replaced this
+     * one (incompatible-value update, e.g. "Lives in Portland" → "Lives in SF").
+     * Null = live. Superseded rows are excluded from recall/dedup by default but
+     * kept for history + the read-time fallback. */
+    supersededBy: string | null;
+    /** Unix ms when this memory was superseded. Null when live. */
+    supersededAt: number | null;
+    /** Extraction-logic version this memory was last stamped under. Null (pre-v38)
+     * reads as 0, so a TOPICS_EXTRACTION_VERSION bump re-extracts stale rows. */
+    topicsExtractedVersion: number | null;
+    /** C3 re-observation watermark: Unix ms of the last retain() merge into this
+     * fact. Distinct from `updatedAt` (which merges preserve). Null = never
+     * re-observed since the column was added; synthesis falls back to
+     * `updatedAt` in that case. */
+    lastObservedAt: number | null;
+    /** Typed memory (PR1) — the extractor's FactType for this fact, or null on
+     * legacy/manual/untyped rows. Plaintext string (not narrowed to FactType
+     * here since the DB can hold any stored value). */
+    factType: string | null;
+    /** Decay archive state (PR2) — Unix ms when archived, or null when active. */
+    archivedAt: number | null;
+    /** Tier-0 security (PR3) — "quarantined" | "trusted" | null. */
+    trustTier: string | null;
+    createdAt: Date;
+    updatedAt: Date;
+    isDeleted: boolean;
+}
+interface CreateVaultMemoryOptions {
     content: string;
-    type: FactType;
-    confidence: number;
-    sourceMessageIds: string[];
-    entities: ExtractedEntity[];
-    /** W6 temporal lane — when the event in this fact occurred. Resolved
-     *  to absolute timestamps by the LLM; null when the fact has no
-     *  temporal anchor. */
-    eventTime: {
-        kind: "point" | "range" | "ongoing";
-        /** Unix ms timestamp of the event start (or point). */
-        start: number;
-        /** Unix ms timestamp of the event end. Only set when kind='range'. */
+    /** Scope for the memory. Defaults to "private" if omitted. */
+    scope?: string;
+    /** Folder ID for organization, null or omitted if unfiled */
+    folderId?: string | null;
+    /** JSON-stringified embedding vector to persist */
+    embedding?: string;
+    /** Model that produced `embedding`. Persisted alongside it so a later
+     * model change can detect and re-embed stale vectors. */
+    embeddingModel?: string;
+    /** Source message IDs that produced this fact (auto-extraction provenance). */
+    sourceChunkIds?: string[];
+    /** Initial proof count. Defaults to 1 if omitted. */
+    proofCount?: number;
+    /** How the memory was created. Defaults to "manual" if omitted. */
+    source?: string;
+    /** W6 temporal lane — when the event in this memory occurred. */
+    eventTime?: {
+        /** Unix ms timestamp of event start (or point). */
+        start: number | null;
+        /** Unix ms timestamp of event end (range only). */
         end: number | null;
-    } | null;
+        /** Kind: 'point' | 'range' | 'ongoing' | null (or omit). */
+        kind: "point" | "range" | "ongoing" | null;
+    };
+    /** Typed memory (PR1) — the extractor's classification for this fact.
+     * Omit for manual/untyped saves (persisted as null). */
+    factType?: FactType;
+    /** Tier-0 security (PR3) — set "quarantined" when the injection screen
+     * flagged this fact. Omit for the default (null/trusted). */
+    trustTier?: string;
 }
-/**
- * Auth + endpoint for the extraction LLM call. Auth is the dual pattern —
- * one of `apiKey` / `getToken` is required at runtime; see
- * {@link PortalLlmAuth}.
- */
-interface ExtractFactsOptions extends PortalLlmAuth {
-    baseUrl?: string;
-    model?: string;
-    /** Override the global fetch implementation (useful for tests). */
-    fetchFn?: typeof fetch;
+interface UpdateVaultMemoryOptions {
+    content: string;
+    /** If provided, updates the memory's scope. */
+    scope?: string;
+    /** If provided, moves the memory to this folder. */
+    folderId?: string | null;
+    /** JSON-stringified embedding vector to persist, or null to clear stale embedding */
+    embedding?: string | null;
+    /** Model that produced `embedding`. Set whenever `embedding` is written so
+     * the stored model tag stays in sync with the vector. */
+    embeddingModel?: string | null;
+    /** Replace source-chunk-ids list (used during merge to accumulate provenance). */
+    sourceChunkIds?: string[];
+    /** Set an absolute proof count. Prefer {@link proofCountIncrement} for
+     * re-observation paths so the read+write happens inside the writer
+     * and concurrent retains can't lose updates. */
+    proofCount?: number;
+    /** Atomically bump proof_count by this delta inside the write block.
+     * Reads the current value from the in-memory record at write time, so
+     * two parallel retain() calls observe each other's commits and neither
+     * loses its increment. Wins over `proofCount` when both are set. */
+    proofCountIncrement?: number;
+    /** Set source ("manual" | "auto-extracted" | "capsule"). */
+    source?: string;
     /**
-     * The user's own name(s) / handle(s) (e.g. profile nickname, wallet display
-     * name). Candidates whose entire content is just one of these are dropped —
-     * a personal memory system already knows who the user is, so "Peter Lee" is
-     * circular noise. Optional; when omitted only the bare-fragment gate applies.
+     * W6 temporal lane — write the event-time fields on update. Use during
+     * auto-merge to preserve (or refine) the original event-time signal when
+     * a new observation lands on an existing fact. Omit to leave the
+     * existing values untouched.
      */
-    userIdentity?: string[];
+    eventTime?: {
+        start: number | null;
+        end: number | null;
+        kind: "point" | "range" | "ongoing" | null;
+    };
     /**
-     * Reference "now" (Unix ms) for resolving relative temporal phrases in the
-     * transcript ("yesterday", "next week", "in two days") into the absolute
-     * YYYY-MM-DD anchors the W6 temporal lane indexes on. The transcript itself
-     * carries no timestamps, so without an anchor the model resolves relatives
-     * against its own training-cutoff guess and emits wrong `eventTime` dates.
-     * Defaults to `Date.now()`. Override for back-dated eval corpora and
-     * deterministic tests (mirrors {@link RecallOptions.now}).
-     *
-     * Server-side timezone note: the ms value is formatted to a calendar date in
-     * the process's local timezone (same basis as `parseLocalCalendarDay`). On a
-     * UTC server, a user near midnight in a non-UTC offset can get the wrong
-     * calendar day. Pass the user's local-midnight timestamp as `now` when the
-     * process timezone doesn't match the user's.
+     * When true, restore the existing `updated_at` after the write so the
+     * recency multiplier doesn't see a re-observation as a brand-new fact.
+     * Set by auto-merge/consolidate paths — they want proof_count to bump
+     * without inflating recency on top.
      */
-    now?: number;
+    preserveUpdatedAt?: boolean;
+    /** C3: Unix ms to stamp as the re-observation watermark (`last_observed_at`).
+     * Set by retain() merge/consolidate paths so a re-observation records "seen
+     * again now" without touching `updated_at` (which `preserveUpdatedAt` keeps
+     * pinned). Omit to leave the existing value untouched. */
+    lastObservedAt?: number;
+    /** If provided, sets whether the user has taken manual control of this
+     * memory's topics. Set by {@link setMemoryEntitiesOp}. */
+    topicsUserManaged?: boolean;
+    /** Typed memory (PR1) — set/refine the fact's classification on update.
+     * Used by retain()'s lazy backfill (adopt an incoming type only when the
+     * existing row has none). Omit to leave the existing value untouched. */
+    factType?: FactType;
+    /** Tier-0 security (PR3) — set the trust tier on update ("quarantined" |
+     * "trusted"). Omit to leave the existing value untouched. */
+    trustTier?: string;
     /**
-     * Max attempts for the extraction call on a transient failure (default 3).
-     * Lower it to bound how long extraction can hold a turn open — e.g. a worker
-     * that runs extraction behind an in-flight-turn guard can pass `2` to keep
-     * repeated failures from delaying later turns.
+     * PR5 — un-archive on re-observe. When true, clears `archived_at` (null) as
+     * part of the write, resurrecting a decayed row that a new observation just
+     * merged into. retain() sets this (with `preserveUpdatedAt` OFF) so the
+     * restored row's decay clock resets and it doesn't immediately re-archive.
+     * Omit/false to leave `archived_at` untouched.
      */
-    maxAttempts?: number;
-    /** Per-attempt timeout (ms) for the extraction call. Defaults to the portal
-     * helper's 60s. Combine with {@link maxAttempts} to cap the total time budget. */
-    timeoutMs?: number;
+    restore?: boolean;
+}
+
+interface VaultMemoryOperationsContext {
+    database: Database;
+    vaultMemoryCollection: Collection<VaultMemory>;
+    walletAddress?: string;
+    signMessage?: SignMessageFn;
+    embeddedWalletSigner?: EmbeddedWalletSignerFn;
+    /** When set, operations scope to this user (server-side multi-user). */
+    userId?: string;
     /**
-     * Absolute wall-clock budget (ms) across ALL extraction attempts incl. backoff.
-     * When set, the loop stops before an attempt that would exceed it, so worst-case
-     * latency is bounded rather than `maxAttempts × timeoutMs`.
+     * Asserts this context runs against a physically single-tenant database — one
+     * where every row belongs to the same owner (the per-wallet client DBs, which
+     * hold exactly one wallet's rows written with `user_id = null`). This is the
+     * ONLY thing that makes the decay sweep's unscoped scan/archive/delete safe
+     * without a `userId`: see {@link assertVaultScopeForSweep}. A shared /
+     * multi-tenant DB must NOT set this — it must scope by `userId` instead.
+     * `walletAddress` presence alone is NOT a substitute (the sweep query filters
+     * by `user_id` only, so a bare `walletAddress` on a shared DB would sweep
+     * every tenant).
      */
-    totalTimeoutMs?: number;
+    singleTenant?: boolean;
     /**
-     * Override the retry backoff (ms) for a given 1-based attempt index. The
-     * extraction call retries transient failures internally (default exponential
-     * backoff); pass `() => 0` to retry without delay (useful for tests).
+     * When set, vault delete ops cascade to memory_entity rows pointing at
+     * the deleted memories. Without this the W5 graph lane keeps returning
+     * IDs of soft-deleted memories and the join table grows unbounded.
      */
-    backoffMs?: (attempt: number) => number;
+    entityCtx?: EntityOperationsContext;
+}
+declare function createVaultMemoryOp(ctx: VaultMemoryOperationsContext, opts: CreateVaultMemoryOptions): Promise<StoredVaultMemory>;
+declare function createVaultMemoriesBatchOp(ctx: VaultMemoryOperationsContext, optionsArray: CreateVaultMemoryOptions[]): Promise<StoredVaultMemory[]>;
+declare function getVaultMemoryOp(ctx: VaultMemoryOperationsContext, id: string): Promise<StoredVaultMemory | null>;
+declare function getAllVaultMemoriesOp(ctx: VaultMemoryOperationsContext, options?: {
+    scopes?: string[];
+    since?: Date;
+    limit?: number;
+    folderId?: string | null;
     /**
-     * When set, PII (emails, phones, SSNs, cards, IPs, API keys, …) in the
-     * conversation transcript is replaced with tagged placeholders before the
-     * extraction call, and the returned facts + entities are de-anonymized so the
-     * vault keeps the real values while raw PII never reaches the extraction
-     * model (and, via `extractAndRetain`, the consolidation model). Pass `true`
-     * for a fresh per-call redactor, or a shared {@link PiiRedactor} to keep
-     * placeholder numbering consistent with other calls.
-     *
-     * NOTE: this does NOT cover the embeddings provider. Facts are stored and
-     * embedded with their real values, so to keep PII out of embedding requests
-     * set `RetainContext.embeddingOptions.maskInput` (e.g. `redactor.maskText`)
-     * as well — the two are independent switches.
+     * Include soft-deleted memories in the result (each carries
+     * `isDeleted: true`). Default `false` — deleted rows are excluded, as
+     * they are from every other read path. Used by the Memory Graph to
+     * render "forgotten" nodes; ordinary consumers should leave this off.
      */
-    piiRedaction?: boolean | PiiRedactor;
+    includeDeleted?: boolean;
+    /** Include archived (decayed) memories. Default `false` (PR1 choke point). */
+    includeArchived?: boolean;
+    /** Include quarantined memories. Default `false` (PR1 choke point). */
+    includeQuarantined?: boolean;
+    /** Typed memory (PR1) — restrict to these fact types. Omit for no filter. */
+    factTypes?: string[];
     /**
-     * Called when the extraction LLM returned no usable result after exhausting
-     * its retries (empty/malformed completion, network/HTTP error) — i.e. a
-     * *failure* that drops the turn's facts, as opposed to a legitimate
-     * `{candidates: []}` "nothing durable here". Lets callers distinguish a
-     * silently-degrading extractor from quiet turns (the two are otherwise
-     * indistinguishable). See {@link extractAndRetain}'s `outcome`.
+     * Include A2-superseded memories (each carries `supersededBy`). Default
+     * `false` — superseded rows are excluded, as they are from recall/dedup.
+     * Used by a "memory history" view to render retired facts.
      */
-    onExhaustedEmpty?: () => void;
+    includeSuperseded?: boolean;
+}): Promise<StoredVaultMemory[]>;
+declare function getAllVaultMemoryContentsOp(ctx: VaultMemoryOperationsContext, options?: {
+    since?: Date;
+}): Promise<string[]>;
+declare function updateVaultMemoryOp(ctx: VaultMemoryOperationsContext, id: string, opts: UpdateVaultMemoryOptions): Promise<StoredVaultMemory | null>;
+/**
+ * Replace a memory's topic (entity) links with a user-chosen set and mark the
+ * memory `topics_user_managed` so auto-extraction stops touching its links.
+ * Replace semantics: the given `entities` become the memory's complete topic
+ * set (pass `[]` to clear all topics — the memory stays user-managed and
+ * unclustered). Requires `ctx.entityCtx`. Preserves `updated_at` so a topic
+ * edit doesn't inflate the recency multiplier.
+ */
+declare function setMemoryEntitiesOp(ctx: VaultMemoryOperationsContext, memoryId: string, entities: ReadonlyArray<EntityInput>): Promise<StoredVaultMemory | null>;
+/**
+ * Reset a memory's topics to automatic: clear the `topics_user_managed` flag so
+ * auto-extraction resumes owning its links. Invalidates `topics_extracted_version`
+ * (→ null) and ensures a NON-NULL `topics_extracted_at`, so the next sweep routes
+ * the row through the stale-version pending path and actually RE-EXTRACTS it via
+ * the LLM. A never-stamped user-curated row (`setMemoryEntitiesOp` marks
+ * user-managed without stamping, so stamp can be null) would otherwise fall
+ * through the sweep's unstamped→`linkedUnstamped` grandfather path (stamped
+ * current, no LLM pass); forcing a stamp when absent avoids that. Existing links
+ * are left in place until the re-extraction replaces them. Preserves `updated_at`.
+ */
+declare function clearMemoryTopicsOverrideOp(ctx: VaultMemoryOperationsContext, memoryId: string): Promise<boolean>;
+declare function deleteVaultMemoryOp(ctx: VaultMemoryOperationsContext, id: string): Promise<boolean>;
+/**
+ * Mark a memory as superseded by a newer one (A2 write-time supersession).
+ * The row stays in the table (history + read-time fallback) but is excluded
+ * from recall/dedup by default via `superseded_by`. Idempotent-ish: no-op if
+ * the row is missing, not owned, deleted, or already superseded. Does NOT
+ * preserve `updated_at` — superseded rows are hidden from recall, so their
+ * recency is irrelevant.
+ *
+ * @param id - the memory being retired (e.g. "Lives in Portland")
+ * @param supersededById - the newer memory that replaced it (e.g. "Lives in SF")
+ */
+declare function supersedeVaultMemoryOp(ctx: VaultMemoryOperationsContext, id: string, supersededById: string): Promise<boolean>;
+/**
+ * Get all non-deleted, unfiled vault memories (folder_id is null).
+ */
+declare function getUnfiledVaultMemoriesOp(ctx: VaultMemoryOperationsContext): Promise<StoredVaultMemory[]>;
+/**
+ * The current topic-extraction logic version. Bump this whenever the extraction
+ * prompt or model in `topicExtract.ts` changes: every memory stamped under an
+ * older version (including pre-v37 rows, read as version 0) is then re-extracted
+ * by the next sweep, so topic-quality improvements propagate across the existing
+ * vault. The worker's `limit` drains that re-extraction across sweeps.
+ */
+declare const TOPICS_EXTRACTION_VERSION = 1;
+/**
+ * Result of {@link getMemoriesNeedingTopicExtractionOp}: which memories the
+ * background topic worker should run LLM entity extraction on, and which it
+ * should merely stamp as already-extracted.
+ */
+interface MemoriesNeedingTopicExtraction {
     /**
-     * Called when the extractor DID produce candidates but PII de-anonymization
-     * dropped every one of them — the model mangled its placeholders (so they
-     * can't be restored to real values) or restoring the values blew the length
-     * cap. These drops happen before `retain()`, so `failedCount` can't see them,
-     * and the turn would otherwise masquerade as a quiet `no-facts` result. Lets
-     * H3's `outcome` surface `dropped-after-redaction` so a rising PII-drop rate
-     * (i.e. redaction silently eating facts) is alarmable.
+     * Memories to run LLM topic extraction on (decrypted): never-extracted rows
+     * with no entity links, plus stamped rows edited since their last pass
+     * (`updated_at` > `topics_extracted_at`) or extracted under an older
+     * `topics_extracted_version` than {@link TOPICS_EXTRACTION_VERSION}. Edited /
+     * stale-version rows come first (they get priority under `limit`), each group
+     * newest-created first.
+     */
+    pending: StoredVaultMemory[];
+    /**
+     * IDs of rows that already have entity links but no watermark — legacy rows
+     * extracted by the conversation pipeline before v36. Grandfather these with
+     * {@link stampTopicsExtractedAtOp} (no LLM call) so a later content edit
+     * makes them re-extractable instead of invisible forever. Bounded by the
+     * same `limit` as {@link pending} — stamping loads a Model per row, so the
+     * grandfather backlog is drained across sweeps rather than in one spike.
      */
-    onCandidatesDropped?: () => void;
+    linkedUnstamped: string[];
 }
 /**
- * Stage 1 — call the LLM to extract candidate facts from the recent
- * conversation. Returns post-validated candidates only (confidence
- * threshold, source-id check, length cap, schema validation). Returns
- * an empty array if the LLM emits malformed JSON or no candidates.
+ * Sweep query for the background topic-extraction worker: partition the
+ * user's non-deleted, non-user-managed memories by what the worker should do
+ * with them (see {@link MemoriesNeedingTopicExtraction}). User-managed rows
+ * are never returned — the user owns their topics, including an intentionally
+ * empty set. Requires `ctx.entityCtx` for the entity-links check.
+ */
+declare function getMemoriesNeedingTopicExtractionOp(ctx: VaultMemoryOperationsContext, options?: {
+    limit?: number;
+}): Promise<MemoriesNeedingTopicExtraction>;
+/**
+ * Stamp `topics_extracted_at` (and `topics_extracted_version`) on the given
+ * memories — the topic worker calls this after a successful extraction pass
+ * (including zero-entity results, so quiet memories aren't re-asked every sweep)
+ * and to grandfather `linkedUnstamped` rows without an LLM call. `version`
+ * defaults to {@link TOPICS_EXTRACTION_VERSION}: stamping at the current version
+ * (for both fresh extractions and grandfathered legacy rows) means they aren't
+ * re-extracted until a future version bump. Preserves `updated_at` so a stamp
+ * never inflates the recency multiplier — and never masks a concurrent content
+ * edit from the next sweep. Skips deleted, foreign-user, and user-managed rows.
+ * Returns the IDs actually stamped.
  *
- * A null from `callPortalJsonCompletion` means a *failure* (empty completion,
- * malformed JSON, network/HTTP error) — distinct from a successful
- * `{candidates: []}`, which parses to a non-null object. A failed extraction
- * silently drops the whole turn's memories, so transient failures matter:
- * `callPortalJsonCompletion` retries them internally with backoff (default 3
- * attempts), so a one-off empty/malformed completion from a reasoning-class
- * model doesn't lose the turn. Only an exhausted-retry null reaches here.
+ * ALL eligibility AND `updated_at` are read from the LIVE Model inside the
+ * serialized writer — never a pre-writer snapshot. Writers are serialized, so
+ * a content edit or topic-override that commits before this writer runs is
+ * observed here: its fresh `updated_at` is preserved (so the next sweep's
+ * `updated_at > stamp` check still fires) and a mid-pass user-managed flip
+ * skips the row. Reading `updated_at` from a raw pre-fetch instead would write
+ * a stale value back, pushing `updated_at < topics_extracted_at` and hiding
+ * the edited memory from every future sweep.
+ *
+ * Callers bound the input via `getMemoriesNeedingTopicExtractionOp`'s `limit`
+ * (both `pending` and `linkedUnstamped` are capped), so the per-row Model load
+ * needed to `prepareUpdate` stays bounded and never spikes the RecordCache.
  */
-declare function extractFacts(messages: AutoExtractMessage[], options: ExtractFactsOptions): Promise<ExtractedCandidate[]>;
+declare function stampTopicsExtractedAtOp(ctx: VaultMemoryOperationsContext, memoryIds: readonly string[], extractedAt: number, version?: number): Promise<string[]>;
+declare function deleteAllVaultMemoriesForUserOp(ctx: VaultMemoryOperationsContext, userId: string): Promise<number>;
 /**
- * Outcome of the EXTRACTOR stage for a turn — independent of whether the
- * subsequent `retain()` writes landed (that's `failedCount`):
- * - `extracted`         — the extractor produced at least one candidate above
- *                         the confidence floor. Whether those writes succeeded
- *                         is reported separately by `failedCount` — so
- *                         `extracted` + `failedCount > 0` means "found facts but
- *                         writes are failing", which is more signal than
- *                         collapsing it into `no-facts` would give.
- * - `no-facts`          — the extractor ran fine but found nothing durable.
- * - `empty-after-retry` — the extractor returned empty/malformed after
- *                         exhausting retries (a *failure*). Distinguishing this
- *                         from `no-facts` is what makes a silently-degrading
- *                         extractor alarmable rather than invisible.
- * - `dropped-after-redaction` — the extractor found facts but PII
- *                         de-anonymization dropped every one (mangled
- *                         placeholders / over-cap after restore), before retain.
- *                         A degradation `failedCount` can't see; would otherwise
- *                         look like `no-facts`.
+ * The minimal plaintext shape the decay sweep needs — mirrors the `DecayInput`
+ * shape in `memory/decay` plus the row id. Deliberately omits `content`
+ * (encrypted) so the sweep stays zero-knowledge.
  */
-type ExtractOutcome = "extracted" | "no-facts" | "empty-after-retry" | "dropped-after-redaction";
+interface DecayCandidateRaw {
+    uniqueId: string;
+    factType: string | null;
+    eventTimeEnd: number | null;
+    eventTimeKind: string | null;
+    /** Unix ms — the raw `updated_at`, used both for the age rule and as the
+     * optimistic-concurrency guard passed back to {@link archiveVaultMemoryOp}. */
+    updatedAt: number;
+    archivedAt: number | null;
+    source: string | null;
+    /** `trusted` | `quarantined` | null. Quarantined rows still decay by RULE, but
+     * are never handed to the optional content-reading decay classifier (they must
+     * not egress poison content — see the decay sweeper's `isBorderline`). */
+    trustTier: string | null;
+}
 /**
- * Stage 2 — for each extracted candidate, call retain() with auto-merge
- * enabled. When `consolidateOptions` are wired, retain()'s consolidation pass
- * is the "resolver": a second LLM call against the top-K existing vault
- * memories that decides create/update/noop/supersede — including retiring a
- * stale value on a state change (the supersession the extraction prompt above
- * promises). Without consolidation, retain() still dedups at the cosine-merge
- * level, and the read-time supersession heuristic remains the fallback.
+ * Decay sweep candidate scan (PR2). Selects the plaintext columns
+ * `classifyDecay` (in `memory/decay`) needs via
+ * `unsafeFetchRaw` — NO Model per row (dodges the never-evicted RecordCache /
+ * web Pile-2 OOM history) and NO `content` read / decrypt (zero-knowledge).
  *
- * Returns the candidates that survived validation along with the retain
- * result for each (which captures whether the fact was created, merged,
- * or skipped), plus an `outcome` summarizing why the turn did/didn't produce
- * facts (see {@link ExtractOutcome}).
+ * Includes archived AND quarantined rows (so archived→delete transitions and
+ * aged quarantined rows are seen) but excludes hard-deleted rows — the
+ * `baseVaultConditions` default keeps `is_deleted = false`.
+ *
+ * Refuses to run on an unscoped multi-tenant context (see
+ * {@link assertVaultScopeForSweep}).
  */
-declare function extractAndRetain(messages: AutoExtractMessage[], retainCtx: RetainContext, options: {
-    extract: ExtractFactsOptions;
-    minConfidence?: number;
-    /** Override scope/folder for all retained facts. */
-    scope?: string;
-    folderId?: string | null;
-    /**
-     * Forwarded verbatim to each retain() call — enables the LLM-based
-     * consolidation pass (Hindsight facet-dedup) on every write. See
-     * `RetainOptions.consolidateOptions` for auth + observability fields.
-     */
-    consolidateOptions?: RetainOptions["consolidateOptions"];
-    /**
-     * When provided, persist each candidate's `entities[]` to the
-     * entity + memory_entity tables after a successful retain. This
-     * powers the W5 graph retrieval lane — recall() can query for
-     * memories sharing entities with the user's question.
-     */
-    entityCtx?: EntityOperationsContext;
-    /**
-     * Per-candidate failure hook — invoked once per filtered candidate
-     * whose `retain()` call threw. Lets UI layers surface "couldn't save
-     * X" toasts; without it consumers only see the aggregate
-     * `failedCount` and can't name which facts dropped.
-     */
-    onCandidateFailed?: (candidate: ExtractedCandidate, error: unknown) => void;
-}): Promise<{
-    candidates: ExtractedCandidate[];
-    results: RetainResult[];
-    failedCount: number;
-    outcome: ExtractOutcome;
-}>;
+declare function getDecayCandidatesRawOp(ctx: VaultMemoryOperationsContext): Promise<DecayCandidateRaw[]>;
+/**
+ * Archive a memory (decay soft state, PR2) — set `archived_at`. An archived row
+ * drops out of every recall lane via the `baseVaultConditions` choke point but
+ * stays recoverable via {@link restoreVaultMemoryOp} until the hard-delete
+ * window elapses.
+ *
+ * Concurrency: re-checks `is_deleted` / ownership / `archived_at` INSIDE the
+ * serialized writer (mirrors {@link updateVaultMemoryOp}). Additionally, when
+ * `opts.expectedUpdatedAt` is given, the archive is skipped if the row's current
+ * `updated_at` no longer matches — i.e. a `retain()` merge (which bumps
+ * `updated_at`) landed between the sweep's candidate scan and this write, so the
+ * fact was just re-observed and must NOT be archived on stale data. Idempotent:
+ * a row another sweep already archived returns `false` (no double-write).
+ *
+ * @returns `true` if this call archived the row; `false` if it was stale
+ *   (deleted / not owned / already archived / refreshed under us).
+ */
+declare function archiveVaultMemoryOp(ctx: VaultMemoryOperationsContext, id: string, opts?: {
+    /** Timestamp to stamp into `archived_at`. Default `Date.now()`. */
+    now?: number;
+    /** Optimistic-concurrency guard: skip if the row's `updated_at` changed
+     * since the sweep observed it (a concurrent re-observation). */
+    expectedUpdatedAt?: number;
+}): Promise<boolean>;
+/**
+ * Restore an archived memory (PR2) — clear `archived_at` so it re-enters recall.
+ * Re-checks `is_deleted` / ownership inside the writer. Idempotent on an
+ * already-active row (clearing null → null is harmless).
+ *
+ * @returns `true` if the row was restored (or already active); `false` if it was
+ *   deleted / not owned / missing.
+ */
+declare function restoreVaultMemoryOp(ctx: VaultMemoryOperationsContext, id: string): Promise<boolean>;
+/**
+ * Hard-delete a memory ONLY if it is still archived and still past the delete
+ * window (PR2 decay terminal transition). Unlike the generic
+ * {@link deleteVaultMemoryOp}, this re-reads `archived_at` INSIDE the writer and
+ * bails if the row was restored (`archived_at → null`) or re-archived more
+ * recently since the sweep's candidate scan. This is the restore-vs-delete
+ * mutual-exclusion guard: a user hitting Restore between the scan and this write
+ * must win, so their just-rescued memory is never permanently lost.
+ *
+ * @returns `true` if this call hard-deleted the row; `false` if it was stale
+ *   (deleted / not owned / no longer archived / no longer past the window).
+ */
+declare function hardDeleteDecayedOp(ctx: VaultMemoryOperationsContext, id: string, opts: {
+    hardDeleteWindowMs: number;
+    now?: number;
+}): Promise<boolean>;
+declare function updateVaultMemoryEmbeddingOp(ctx: VaultMemoryOperationsContext, id: string, embedding: string, embeddingModel: string): Promise<boolean>;
 
 /**
  * Auto-extraction worker — orchestration glue for wiring
@@ -6910,6 +7341,16 @@ interface MemoryExtractedEvent {
     result: RetainResult;
     conversationId?: string;
 }
+/**
+ * Tier-0 security (PR3) — fired once per candidate the injection screen
+ * quarantined and persisted as an audit row. Distinct from
+ * {@link MemoryExtractedEvent} so a client can render "held for review"
+ * without treating a poisoned fact as a normal saved memory.
+ * @public
+ */
+interface MemoryQuarantinedEvent extends QuarantinedMemoryInfo {
+    conversationId?: string;
+}
 /** @public */
 interface TurnSkippedEvent {
     /**
@@ -7048,6 +7489,12 @@ interface CreateAutoExtractorOptions {
     };
     /** Per-fact event — fires once per memory written. */
     onMemoryExtracted?: (event: MemoryExtractedEvent) => void;
+    /**
+     * Tier-0 security (PR3) — fires once per candidate quarantined by the
+     * injection screen (and persisted as an audit row). Lets a client surface a
+     * "held for review" state instead of the fact silently disappearing.
+     */
+    onMemoryQuarantined?: (event: MemoryQuarantinedEvent) => void;
     /** Per-turn event — fires once after the whole pipeline finishes. */
     onTurnComplete?: (event: TurnCompleteEvent) => void;
     /** Diagnostic — fires when a turn is skipped. */
@@ -7108,6 +7555,536 @@ declare const DEFAULT_CHUNK_CACHE_SIZE = 5000;
  */
 declare function createChunkVectorCache(maxSize?: number): ChunkVectorCache;
 
+/**
+ * Temporal decay classifier (PR2) — pure, DB-free, unit-testable.
+ *
+ * Decides whether a stored memory should be kept, archived (soft, recoverable),
+ * or hard-deleted, based ONLY on its plaintext columns. This is the
+ * zero-knowledge core of the decay sweep: it never sees `content` and never
+ * triggers a signature/decrypt, so it can run wherever a wallet key is NOT
+ * loaded. The sweep worker ({@link ./decayWorker}) feeds it raw rows selected
+ * via `unsafeFetchRaw` and materializes Models only for the transitions.
+ *
+ * Lifecycle (mirrors the timestamp state machine in db/schema.ts):
+ *   active   → archived  (set `archived_at`)   — recoverable, drops out of recall
+ *   archived → deleted   (set `is_deleted`)    — terminal, after HARD_DELETE_WINDOW
+ *
+ * Per-type TTL policy (the "becomes past" intuition):
+ *   - identity / preference / relationship / constraint → never age-archive
+ *     (durable facts about who the user is; Infinity TTL).
+ *   - plan / ongoing_context → short TTL (they go stale as time moves on).
+ *   - other / null (untyped/legacy) → medium TTL.
+ * `source === "manual"` memories are protected from AUTO-ARCHIVE (user-curated)
+ * — but NOT from the hard-delete clock once they are archived: archive is the
+ * shared purge buffer for every row, so an already-archived manual memory is
+ * still deleted after the window (the archived check runs before the manual
+ * short-circuit by design).
+ */
+/** The verdict for a single memory. */
+type DecayVerdict = "keep" | "archive" | "delete";
+/** Short TTL — `plan` / `ongoing_context` age out ~30 days after last touch. */
+declare const SHORT_TTL_MS: number;
+/** Medium TTL — `other` / untyped rows age out ~180 days after last touch. */
+declare const MEDIUM_TTL_MS: number;
+/**
+ * "Never" TTL — durable identity-class types (identity/preference/relationship/
+ * constraint) never age-archive. Expressed as +Infinity so the age comparison
+ * `now - updatedAt > ttl` is always false.
+ */
+declare const NEVER_TTL_MS: number;
+/**
+ * How long an archived memory lingers (recoverable) before the sweep hard-
+ * deletes it. ~30 days gives the user a window to restore an over-eager decay.
+ */
+declare const HARD_DELETE_WINDOW_MS: number;
+/**
+ * Grace applied after a `plan` / `ongoing_context` event's `event_time_end`
+ * before it's considered "become past" and archived. Avoids archiving a plan
+ * the instant its end date passes (the user may still reference it briefly).
+ */
+declare const PAST_EVENT_GRACE_MS: number;
+/**
+ * Per-type TTL + window overrides. Pass a partial to {@link classifyDecay} /
+ * the sweeper to tune behavior (evaluation harnesses, tests). Anything omitted
+ * falls back to {@link DEFAULT_DECAY_POLICY}.
+ */
+interface DecayPolicy {
+    /**
+     * Age TTL (ms since `updatedAt`) per FactType. A type absent from this map —
+     * or a null/unknown `factType` — uses {@link DecayPolicy.fallbackTtlMs}.
+     */
+    ttlByType: Record<string, number>;
+    /** TTL for `null` / unknown fact types (the medium bucket). */
+    fallbackTtlMs: number;
+    /** How long an archived row lingers before hard delete. */
+    hardDeleteWindowMs: number;
+    /** Grace after a past `event_time_end` before archiving a plan/ongoing. */
+    pastEventGraceMs: number;
+}
+/** Default policy — the locked per-type TTLs. */
+declare const DEFAULT_DECAY_POLICY: DecayPolicy;
+/**
+ * The minimal plaintext shape {@link classifyDecay} reads. Deliberately excludes
+ * `content` (encrypted; never touched by decay) — the sweep selects exactly
+ * these columns so it stays zero-knowledge.
+ */
+interface DecayInput {
+    /**
+     * The row's stable id. Not read by the rule engine ({@link classifyDecay}
+     * ignores it) — it is threaded through so an optional content-reading decay
+     * classifier (PR5, {@link createLlmDecayClassifier}) can fetch + decrypt the
+     * row for a borderline verdict. Optional so pure rule-based callers/tests can
+     * omit it.
+     */
+    id?: string;
+    /** The extractor's FactType, or null (legacy/manual/untyped → medium bucket). */
+    factType: string | null;
+    /** W6 temporal lane — Unix ms the event ended (range/ongoing), or null. */
+    eventTimeEnd: number | null;
+    /** W6 temporal lane — `point | range | ongoing | null`. */
+    eventTimeKind: string | null;
+    /** Unix ms of the row's last write (re-observation resets this). */
+    updatedAt: number;
+    /** Unix ms when archived, or null when active. */
+    archivedAt: number | null;
+    /** `manual` | `auto-extracted` | `capsule` | null. Manual is never decayed. */
+    source: string | null;
+    /**
+     * `trusted` | `quarantined` | null. Not read by the rule engine
+     * ({@link classifyDecay} ignores it — quarantined rows still age/archive/delete
+     * by RULE). It exists only so the sweeper's `isBorderline` can keep a
+     * quarantined (injection-screened) row away from the optional content-reading
+     * classifier, so poison content never egresses. Optional so pure rule-based
+     * callers/tests can omit it (treated as not quarantined).
+     */
+    trustTier?: string | null;
+}
+/**
+ * The age TTL for a fact type. `null` / unknown types fall to the medium
+ * fallback bucket (never Infinity — untyped rows must still eventually age out).
+ */
+declare function ttlForType(factType: string | null, policy?: Partial<DecayPolicy>): number;
+/**
+ * Classify one memory into a decay verdict, reading only plaintext fields.
+ *
+ * Rules, in order (first match wins):
+ *  0. Non-finite timestamps → keep (safe) + warn (corrupt row, observable).
+ *  1. Already archived (`archivedAt != null`): delete once past the hard-delete
+ *     window, else keep — runs REGARDLESS of `source`, so the purge clock
+ *     applies to archived manual rows too.
+ *  2. `source === "manual"` → keep — protects manual saves from AUTO-ARCHIVE
+ *     only (rules 3/4). Delete-of-already-archived is handled above.
+ *  3. `plan` / `ongoing_context` whose event has become past — `eventTimeEnd`
+ *     is set AND older than `now - grace` → archive. An `ongoing` status with a
+ *     null `eventTimeEnd` is still ongoing, so this rule does not fire for it.
+ *  4. Age fallback — `now - updatedAt > TTL(factType)` → archive. Durable types
+ *     have Infinity TTL, so this never fires for them; null/unknown use medium.
+ *     EXCEPTION: a `plan`/`ongoing_context` with a still-upcoming event
+ *     (`eventTimeEnd >= now`) is kept — it must not age-archive before the event
+ *     happens; only rule 3 (after it passes) may archive it.
+ *  5. Otherwise → keep.
+ *
+ * @param m     Plaintext decay inputs for one row.
+ * @param now   Reference time (Unix ms). Injected for determinism.
+ * @param policy Optional partial policy overriding {@link DEFAULT_DECAY_POLICY}.
+ */
+declare function classifyDecay(m: DecayInput, now: number, policy?: Partial<DecayPolicy>): DecayVerdict;
+
+/**
+ * Decay sweeper (PR2) — orchestration glue that runs the temporal-decay
+ * lifecycle over the vault. Mirrors the shape of {@link ./autoExtractWorker}'s
+ * `createAutoExtractor`: created once, driven by the caller (a client hook on a
+ * low-frequency interval / app-foreground), disposable.
+ *
+ * A sweep is zero-knowledge by construction:
+ *   1. {@link getDecayCandidatesRawOp} selects plaintext columns via
+ *      `unsafeFetchRaw` — no `content`, no decrypt, no Model per row.
+ *   2. {@link classifyDecay} is a pure function over those plaintext fields.
+ *   3. Only the (usually small) transition set is materialized as Models to
+ *      archive ({@link archiveVaultMemoryOp}) or hard-delete
+ *      ({@link hardDeleteDecayedOp}, which re-checks archived + past-window
+ *      inside the write so a concurrent restore wins).
+ *
+ * The optional {@link DecayClassifier} is a PR5 seam for an on-device model that
+ * refines borderline verdicts by reading decrypted content — it is NOT
+ * implemented here. Default is `undefined` → pure rule-based, which is what
+ * keeps the default path zero-knowledge.
+ */
+
+/** Counts from one sweep, for UI surfacing (e.g. "N memories archived"). */
+interface DecaySweepResult {
+    /** Rows transitioned active → archived this sweep. */
+    archived: number;
+    /** Rows hard-deleted (archived past the window) this sweep. */
+    deleted: number;
+    /** Total candidate rows scanned (all non-hard-deleted rows). */
+    scanned: number;
+}
+/**
+ * PR5 seam — an on-device classifier that refines the rule-based verdict for
+ * borderline rows (e.g. type `other`/null, or a `plan` without an event end).
+ * Because it may read decrypted content, callers MUST gate providing it on
+ * wallet-key availability. Left undefined here → pure rule-based sweep.
+ *
+ * Egress is bounded by the sweeper (NOT the classifier): each sweep caps how
+ * many rows reach the classifier ({@link CreateDecaySweeperOptions.maxClassifierCallsPerSweep})
+ * and a row whose (id, updated_at) was already classified is never re-sent on a
+ * later sweep — so a stable borderline "keep" row egresses at most once.
+ *
+ * SECURITY (MEDIUM, residual) — enabling a classifier hands whoever answers the
+ * portal (incl. a malicious / MITM'd endpoint) a lever over the affected rows:
+ * a hostile verdict can only quarantine-adjacent OUTCOMES here, i.e. archive a
+ * row (reversible — never a hard delete, which stays the deterministic
+ * archived-past-window mechanic). Bounded, reversible trust tradeoff; gate the
+ * classifier on trust in the portal.
+ *
+ * @param input      The same plaintext inputs the rule engine saw.
+ * @param ruleVerdict The rule-based verdict, as a starting point / fallback.
+ * @param now        The sweep's reference time (Unix ms). Injected so the
+ *   classifier derives any age math from the same clock the rule engine used,
+ *   never wall-clock `Date.now()` — keeping a fixed-`now` sweep deterministic.
+ * @returns The (possibly refined) verdict.
+ */
+interface DecayClassifier {
+    classify(input: DecayInput, ruleVerdict: DecayVerdict, now: number): Promise<DecayVerdict> | DecayVerdict;
+}
+/** A clock: a fixed timestamp (tests) or a getter (production intervals). */
+type NowSource = number | (() => number);
+/** @public */
+interface CreateDecaySweeperOptions {
+    /** Vault write context — the same one recall/retain use. */
+    vaultCtx: VaultMemoryOperationsContext;
+    /**
+     * Reference "now". A number is fixed (deterministic tests); a function is
+     * re-evaluated per sweep (long-lived interval usage). Default `Date.now`.
+     */
+    now?: NowSource;
+    /** Partial policy overriding the per-type TTL defaults. Omit for defaults. */
+    policy?: Partial<DecayPolicy>;
+    /**
+     * PR5 seam. When provided, borderline candidates' rule verdict is passed
+     * through it. Gate on key availability (it may decrypt content). Default
+     * undefined. Egress is bounded — see {@link maxClassifierCallsPerSweep}.
+     */
+    classifier?: DecayClassifier;
+    /**
+     * PR5 — hard ceiling on classifier invocations (and thus decrypted-content
+     * portal egress) per sweep. Once hit, the remaining borderline rows fall back
+     * to the rule verdict for that sweep (no call). Prevents a large vault from
+     * firing hundreds of sequential content-bearing calls in one sweep. Default
+     * {@link DEFAULT_MAX_CLASSIFIER_CALLS_PER_SWEEP} (20). Cache hits (a row
+     * already classified at its current `updated_at`) do NOT count against this.
+     */
+    maxClassifierCallsPerSweep?: number;
+    /** Fires once after each sweep with the transition counts (UI). */
+    onSwept?: (result: DecaySweepResult) => void;
+    /** Diagnostic — fires on an unexpected sweep-level error. */
+    onError?: (error: Error) => void;
+}
+/** @public */
+interface DecaySweeper {
+    /**
+     * Scan the vault, classify every candidate, and apply archive/delete
+     * transitions. Safe to call repeatedly (idempotent — a keep stays a keep, an
+     * already-archived row won't re-archive). Returns the transition counts.
+     * A no-op (returns zero counts) after {@link DecaySweeper.dispose}.
+     */
+    runSweep(): Promise<DecaySweepResult>;
+    /** Stop accepting sweeps. An in-flight `runSweep()` resolves normally. */
+    dispose(): void;
+}
+/**
+ * Default per-sweep ceiling on decay-classifier invocations (see
+ * {@link CreateDecaySweeperOptions.maxClassifierCallsPerSweep}). Kept small: the
+ * classifier egresses DECRYPTED content, so a sweep must never fan out to
+ * hundreds of sequential calls. 20 covers the borderline churn of a typical
+ * sweep while capping worst-case egress; stable rows are also cached so this
+ * ceiling is rarely reached after the first sweep.
+ */
+declare const DEFAULT_MAX_CLASSIFIER_CALLS_PER_SWEEP = 20;
+/**
+ * Create a decay sweeper. See module docstring for the zero-knowledge contract.
+ */
+declare function createDecaySweeper(options: CreateDecaySweeperOptions): DecaySweeper;
+
+/**
+ * Optional content-reading decay classifier (PR5).
+ *
+ * The rule engine ({@link ./decay}.classifyDecay) decides keep/archive/delete
+ * from plaintext columns ALONE — it never sees `content`, which is what keeps
+ * the default decay sweep zero-knowledge. That is the right default, but it is
+ * weakest on BORDERLINE rows: an `other`/untyped fact, or a `plan` with no
+ * event end, whose staleness is a pure `updated_at` guess.
+ *
+ * This factory builds a {@link DecayClassifier} that reads the DECRYPTED content
+ * of such a row and returns keep-vs-archive. The sweeper consults it ONLY for a
+ * borderline row whose CURRENT rule verdict is `keep` — a rule archive/delete
+ * short-circuits before the classifier ever runs (see `decayWorker.verdictFor` +
+ * `isBorderline`). So its whole job is to REFINE a still-kept borderline row
+ * toward EARLIER archive when the content shows it is genuinely ephemeral (a
+ * finished one-off plan, an expired temporary state) — turning a weak age-only
+ * "keep" into an "archive" sooner.
+ *
+ * DIRECTIONALITY IS DELIBERATE (a security property, not a shortcoming): it can
+ * move a borderline keep → archive, never the reverse. It CANNOT rescue /
+ * keep-alive a row the rule would archive — the escalation gate makes that path
+ * unreachable, and archive is reversible while un-archiving poison would not be.
+ * Enabling a classifier hands whoever answers the portal (incl. a malicious /
+ * MITM'd endpoint) a lever, and that lever must only ever archive-reversibly.
+ *
+ * ZERO-KNOWLEDGE CONTRACT (the caller MUST honor this):
+ *   - `getContent` is supplied by the caller and MUST be gated on wallet-key
+ *     availability: return `null` when no key is loaded. With no content the
+ *     classifier degrades to the rule verdict — never blocks, never guesses.
+ *   - When it does read content and calls the portal, the content is
+ *     PII-redacted first. Redaction is OPT-OUT, not opt-in: it defaults ON when
+ *     the consumer omits `piiRedaction`, so a caller can never accidentally
+ *     egress raw PII. Pass `piiRedaction: false` to deliberately disable it.
+ *   - Egress is bounded by the SWEEPER, not this classifier: the sweep caps
+ *     invocations per pass and never re-sends an unchanged (id, updated_at) row
+ *     (see `decayWorker`), so a stable borderline "keep" row egresses once.
+ *   - It only ever chooses keep vs archive, and only for a row the rule already
+ *     keeps. It NEVER escalates to `delete` and NEVER un-archives — hard-delete
+ *     is exclusively the deterministic archived-past-window mechanic (rule 1),
+ *     and a row the rule wants archived is archived regardless of this layer.
+ *
+ * Fails to the rule verdict (keep) on any error, missing id, no key, or
+ * malformed response — like every other optional LLM layer in this subsystem it
+ * can only refine a borderline keep toward archive, never make the sweep worse.
+ *
+ * RESIDUAL SCOPE (accepted): a genuinely durable fact MISTYPED as `other`/null
+ * and never re-mentioned within its medium TTL WILL age-archive — this layer can
+ * only bring that archive EARLIER, never prevent it. Accepted because it is
+ * recoverable: archived rows stay in the Archived section, Restore clears
+ * `archived_at`, and any re-observation resets the TTL. The alternative — a
+ * keep-alive lever — is exactly the capability a hostile portal must NOT have.
+ *
+ * SECURITY (MEDIUM, residual) — this is a NEW portal call surface carrying
+ * (redacted) memory content. It is opt-in (you must construct + pass it) and
+ * gated on key availability. Beyond widening which models see facts, a
+ * malicious / MITM'd portal can steer the verdict — but only to ARCHIVE a row
+ * (reversible; never a hard delete). Gate it on trust in the portal.
+ */
+
+/**
+ * Auth + wiring for {@link createLlmDecayClassifier}. Auth is the dual pattern —
+ * one of `apiKey` / `getToken` is required at runtime (see {@link PortalLlmAuth}).
+ * @public
+ */
+interface LlmDecayClassifierOptions extends PortalLlmAuth {
+    baseUrl?: string;
+    model?: string;
+    /** Override fetch (tests). */
+    fetchFn?: typeof fetch;
+    /** Max portal attempts on a TRANSIENT failure. Default 2. */
+    maxAttempts?: number;
+    /** Absolute wall-clock budget across attempts. Default 12s. */
+    totalTimeoutMs?: number;
+    /** Backoff before each retry (ms). Tests pass `() => 0`. */
+    backoffMs?: (attempt: number) => number;
+    /**
+     * PII redaction for the outbound content. OPT-OUT: defaults to ON (a fresh
+     * per-call redactor) when omitted, so decrypted content is never egressed
+     * raw by accident. Pass a shared {@link PiiRedactor} to keep placeholder
+     * numbering consistent with other calls, or `false` to deliberately disable
+     * redaction. The verdict returned is a bare enum — nothing to de-anonymize.
+     */
+    piiRedaction?: boolean | PiiRedactor;
+    /**
+     * Resolve a memory's DECRYPTED content by id. The caller supplies this and
+     * MUST gate it on wallet-key availability — return `null` when no key is
+     * loaded so the classifier degrades to the rule verdict (zero-knowledge).
+     * A throw is treated the same as `null` (fail to the rule verdict).
+     */
+    getContent: (id: string) => Promise<string | null>;
+}
+/**
+ * Build a {@link DecayClassifier} that reads a borderline row's decrypted
+ * content and returns a keep/archive verdict via a cheap portal LLM. Pass it as
+ * `createDecaySweeper({ classifier })`. See the module docstring for the
+ * zero-knowledge contract. Returns the rule verdict on any failure and never
+ * escalates to `delete`.
+ * @public
+ */
+declare function createLlmDecayClassifier(options: LlmDecayClassifierOptions): DecayClassifier;
+
+/**
+ * Multi-hop graph traversal for the W5 entity-graph recall lane (PR4,
+ * MRAgent-style "active reconstruction").
+ *
+ * The single-hop lane (see `recall.ts:buildGraphLaneRanking`) does one thing:
+ * extract entities from the query, look up memories sharing any of them, and
+ * order those memories by shared-entity count. That is hop 1 — the "seed"
+ * lookup. This module wraps a bounded breadth-first search around it: from the
+ * seed memories it walks OUT to their neighbor entities (via the new reverse
+ * edge {@link getEntitiesByMemoryIdsOp}), ranks those neighbors by
+ * co-occurrence across the frontier, expands the top few, and pulls the
+ * memories they reach — repeating up to {@link MAX_HOPS} times.
+ *
+ * Cost note (why this is cheap): NONE of this runs cosine. Cosine runs exactly
+ * once per recall inside `searchVaultMemoriesWithSize`. This lane only emits an
+ * ordered list of memory IDs that is RRF-fused against the cosine head. So
+ * multi-hop adds indexed WatermelonDB joins + more RRF entries, not embedding
+ * math. The dominant cost of enabling it is the reranker over a slightly larger
+ * candidate pool — which stays bounded because `rerankTopN` remains
+ * authoritative downstream.
+ *
+ * Determinism: neighbor-entity selection is pure co-occurrence counting by
+ * default. An optional LLM path-refiner (PR5) can override which neighbors
+ * expand; it falls back to the deterministic order on any error.
+ *
+ * Hop numbering: hop 1 is the seed lookup. `maxHops = 1` therefore means "seed
+ * only" — byte-for-byte identical to the single-hop lane (the regression guard).
+ * `MAX_HOPS = 2` (the PR5 default) performs one expansion beyond the seed.
+ *
+ * Neighbor selection at each expansion hop is deterministic co-occurrence
+ * counting by default. PR5 adds an OPTIONAL LLM path-refiner
+ * ({@link NeighborRefiner} / {@link createLlmNeighborRefiner}) that lets a model
+ * pick which neighbor entities to expand instead; it is opt-in, capped to ≤1
+ * call per hop, and falls back to the deterministic order on any error.
+ */
+
+/**
+ * Total hops the traversal performs, counting the seed lookup as hop 1.
+ * `1` = seed only (identical to the single-hop lane). PR5 default is `2` (one
+ * expansion beyond the seed). Overridable per-call for ablation. Still gated to
+ * the `high` budget in recall, and capped back to 1 on large vaults by
+ * {@link capHopsForDensity}.
+ * @public
+ */
+declare const MAX_HOPS = 2;
+/**
+ * Max neighbor entities expanded per hop. Caps fan-out so a densely-linked
+ * frontier can't explode the candidate pool. Neighbors are ranked by
+ * co-occurrence frequency across the frontier; only the top this-many expand.
+ * @public
+ */
+declare const ENTITY_FANOUT = 8;
+/**
+ * Hard ceiling on total accumulated memory IDs across all hops. The BFS stops
+ * expanding once the accumulated set reaches this size (and the frontier is
+ * bounded to it too), keeping the RRF pool — and the downstream reranker
+ * workload — bounded regardless of graph density.
+ * @public
+ */
+declare const NODE_BUDGET = 64;
+/**
+ * Above this vault size, {@link capHopsForDensity} forces `MAX_HOPS = 1`
+ * (seed-only). Fan-out grows with graph density, so on large vaults we don't
+ * pay the expansion cost. Bounded-traversal safety valve.
+ * @public
+ */
+declare const VAULT_SIZE_HOP_CAP = 1000;
+/** Options for {@link traverseGraphLane}. All optional; defaults are the
+ * exported constants above. Exposed for ablation / evaluation sweeps.
+ * @public */
+interface GraphTraversalOptions {
+    /** Total hops incl. the seed lookup (hop 1). Default {@link MAX_HOPS}. */
+    maxHops?: number;
+    /** Max neighbor entities expanded per hop. Default {@link ENTITY_FANOUT}. */
+    entityFanout?: number;
+    /** Hard cap on accumulated memory IDs. Default {@link NODE_BUDGET}. */
+    nodeBudget?: number;
+    /** RRF smoothing constant for per-hop fusion. Default 60 (rrf.ts). */
+    rrfK?: number;
+    /**
+     * Vault size hint. When provided and above {@link VAULT_SIZE_HOP_CAP}, the
+     * effective hop count is capped to 1 (see {@link capHopsForDensity}).
+     */
+    vaultSize?: number;
+    /**
+     * PR5 — optional LLM neighbor-selection. When provided, at each expansion hop
+     * the deterministically-ranked candidate neighbor entities are handed to this
+     * refiner, which returns the subset to expand. Falls back to the
+     * co-occurrence order on any error or empty result. Called at most ONCE per
+     * hop. Build one with {@link createLlmNeighborRefiner}, or supply your own.
+     */
+    refineNeighbors?: NeighborRefiner;
+    /**
+     * Resolve a batch of candidate memory ids to just the ACTIVE ones (not
+     * archived, not quarantined, not soft-deleted — the same set the final recall
+     * gate admits). When provided, traversal drops "forgotten" memories from the
+     * frontier AT EACH HOP so they neither steer neighbor-entity ranking nor
+     * egress their entity names to {@link refineNeighbors}. Omit (tests /
+     * entity-only callers) to traverse over every linked memory. Wire it from a
+     * vault context with {@link ../db/memoryVault/operations.getActiveVaultMemoryIdsOp}.
+     */
+    filterActiveMemoryIds?: (ids: string[]) => Promise<Set<string>>;
+}
+/**
+ * Picks which candidate neighbor entities to expand at a traversal hop. Given
+ * the query and the deterministically-ranked candidate entity names, return the
+ * subset (≤ `limit`) to expand. Must be resilient: {@link traverseGraphLane}
+ * falls back to the deterministic top-`limit` on a throw or empty return.
+ * @public
+ */
+interface NeighborRefiner {
+    refine(query: string, candidates: string[], limit: number): Promise<string[]>;
+}
+/**
+ * Cap the hop count on large vaults. Fan-out grows with graph density, so above
+ * {@link VAULT_SIZE_HOP_CAP} memories we force seed-only traversal (1 hop)
+ * rather than pay an unbounded expansion. A no-op when `vaultSize` is unknown or
+ * within the threshold.
+ * @public
+ */
+declare function capHopsForDensity(maxHops: number, vaultSize?: number): number;
+/**
+ * Bounded multi-hop entity-graph traversal. Returns an ordered list of memory
+ * IDs (best first) — the SAME output shape as the single-hop lane, so nothing
+ * downstream changes. The caller passes it through as `entityRanking` for RRF
+ * fusion with the cosine/BM25 head.
+ *
+ * With `maxHops <= 1` this returns the seed ordering verbatim, making it a
+ * drop-in equivalent of the single-hop lane (the regression guard). The PR5
+ * default is 2 (one expansion beyond the seed).
+ *
+ * Returns an empty array when the query has no extractable entities or no stored
+ * memory shares a seed entity.
+ *
+ * @public
+ */
+declare function traverseGraphLane(query: string, entityCtx: EntityOperationsContext, options?: GraphTraversalOptions): Promise<string[]>;
+/** Auth + tuning for {@link createLlmNeighborRefiner}. Reuses the recall
+ * `decomposeOptions` shape (dual auth — one of `apiKey`/`getToken`). @public */
+interface LlmNeighborRefinerOptions extends PortalLlmAuth {
+    baseUrl?: string;
+    model?: string;
+    fetchFn?: typeof fetch;
+    maxAttempts?: number;
+    totalTimeoutMs?: number;
+    backoffMs?: (attempt: number) => number;
+}
+/**
+ * Build a {@link NeighborRefiner} backed by a cheap portal LLM. At each hop it
+ * asks the model to pick, from the candidate neighbor entities, the ≤`limit`
+ * most relevant to the query, so traversal expands toward the question instead
+ * of purely by co-occurrence frequency.
+ *
+ * Bounded + fail-safe: one attempt by default, a short total timeout, and
+ * {@link traverseGraphLane} falls back to the deterministic co-occurrence order
+ * on any throw or empty result — so enabling this can reorder which neighbors
+ * expand but never breaks or stalls recall.
+ *
+ * SECURITY / ZERO-KNOWLEDGE (must stay default-OFF): this sends the query +
+ * candidate ENTITY NAMES to the portal UNREDACTED. Those names ARE user PII —
+ * people, places, orgs pulled from the stored graph (e.g. "Sara", "Kyoto",
+ * "Acme") — not lower-risk than content just because they're short. It reuses
+ * the query-decompose auth and is opt-in (`RecallOptions.graphRefine`, default
+ * off in recall); leave it off unless you accept that exposure. To bound that
+ * exposure, {@link traverseGraphLane} caps the candidate list it hands this
+ * refiner per hop — at most `MAX_REFINER_CANDIDATES` entity names ever leave per
+ * hop, REGARDLESS of `entityFanout` (the cap is a hard ceiling, not just a
+ * fanout-scaled floor), so the full frontier is never egressed.
+ *
+ * MEDIUM residual: a malicious / MITM'd portal can only steer WHICH neighbor
+ * entities expand — a recall-ranking nudge, not a data-integrity change (no
+ * memory is written, archived, or deleted), and {@link traverseGraphLane}
+ * falls back to deterministic order on any bad/empty response. Bounded tradeoff.
+ * @public
+ */
+declare function createLlmNeighborRefiner(options: LlmNeighborRefinerOptions): NeighborRefiner;
+
 /**
  * Unified Recall API — single retrieval surface above vault + engine.
  *
@@ -8625,6 +9602,9 @@ declare class WatermelonChatStorageAdapter implements ChatStorageAdapter {
  * - v33: Added embedding_model column to memory_vault so stale-model vectors are
  *   detectable and re-embeddable after an embedding-model change (null = legacy
  *   rows, grandfathered as compatible with the current model)
+ * - v34: Added topics_user_managed column to memory_vault so a memory whose
+ *   entity links the user has taken manual control of is left alone by
+ *   auto-extraction (null/false = auto-derived, the default)
  * - v35: Added conversation_memory table recording which vault memories a
  *   conversation drew on, so the conversation-level Memories panel survives reload
  * - v36: Added topics_extracted_at column to memory_vault — watermark of the last
@@ -8643,8 +9623,13 @@ declare class WatermelonChatStorageAdapter implements ChatStorageAdapter {
  *   watermark stamped each time retain() merges into an existing fact, kept
  *   distinct from updated_at (which merges preserve). Lets profile synthesis
  *   weight facts by recency of reinforcement rather than last edit.
+ * - v40: Added fact_type, archived_at, trust_tier columns to memory_vault for
+ *   typed memory + decay + Tier-0 security. All nullable + plaintext, no
+ *   backfill (null = legacy/untyped, active, un-screened — content is
+ *   encrypted so in-migration classification is impossible; NULL = zero-risk,
+ *   exact embedding_model precedent)
  */
-declare const SDK_SCHEMA_VERSION = 39;
+declare const SDK_SCHEMA_VERSION = 40;
 /**
  * Combined WatermelonDB schema for all SDK storage modules.
  *
@@ -8722,11 +9707,13 @@ declare const sdkSchema: Readonly<{
  * - v30 → v31: Added `user_id` column to memory_entity for multi-user scoping of the W5 graph lane (with backfill from memory_vault.user_id)
  * - v31 → v32: Added `pinned_at` column to conversations for pinning chats
  * - v32 → v33: Added `embedding_model` column to memory_vault (null grandfathered as current-model-compatible)
+ * - v33 → v34: Added `topics_user_managed` column to memory_vault (null/false = auto-derived topics, the default)
  * - v34 → v35: Added `conversation_memory` table (conversation ↔ recalled memory ids)
  * - v35 → v36: Added `topics_extracted_at` column to memory_vault (watermark for the background topic-extraction worker; null + existing links grandfathered as extracted)
  * - v36 → v37: Added `superseded_by` + `superseded_at` columns to memory_vault (write-time supersession; null = live, excluded from recall/dedup when set)
  * - v37 → v38: Added `topics_extracted_version` column to memory_vault (extraction-logic version; null read as 0 so a TOPICS_EXTRACTION_VERSION bump re-extracts stale rows)
  * - v38 → v39: Added `last_observed_at` column to memory_vault (C3 re-observation watermark; stamped on retain merge, distinct from updated_at)
+ * - v39 → v40: Added `fact_type`, `archived_at`, `trust_tier` columns to memory_vault for typed memory + decay + Tier-0 security (all nullable + plaintext, NULL backfill)
  */
 declare const sdkMigrations: Readonly<{
     validated: true;
@@ -12875,4 +13862,4 @@ declare function renderAnumaTree(node: AnumaNode): React.ReactElement | null;
  */
 declare function renderAnumaJsx(jsx: string): React.ReactElement | null;
 
-export { Anuma, type AnumaChild, AnumaJsxError, type AnumaNode, AnumaShadowIsolationProvider, type AnumaShadowIsolationProviderProps, type AnumaTheme, AnumaThemeProvider, type AnumaThemeProviderProps, AppFile as AppFileModel, type AppFileOperationsContext, type AttrValue, type AutoExtractMessage, type AutoExtractor, DEFAULT_CONVERSATIONS_FOLDER as BACKUP_DRIVE_CONVERSATIONS_FOLDER, DEFAULT_ROOT_FOLDER as BACKUP_DRIVE_ROOT_FOLDER, DEFAULT_BACKUP_FOLDER as BACKUP_ICLOUD_FOLDER, BUILT_IN_TOOL_SETS, type BackupAuthContextValue, BackupAuthProvider, type BackupAuthProviderProps, type BackupOperationOptions, BlobUrlManager, type Budget, type CachedChunkVectors, type CachedServerTools, ChartCard, type ChartCardProps, type ChartConfig, ChartContainer, ChartLegend, ChartLegendContent, ChartStyle, ChartTooltip, ChartTooltipContent, Conversation as ChatConversation, Message as ChatMessage, type ChatRole, type ChatStorageAdapter, type ChatStorageObservable, type ChunkSearchResult, type ChunkVectorCache, type ChunkingOptions, type CircleProps, type ClientToolsFilterFn, type ConsolidationFallbackReason, type ConversationMemoryInput, ConversationMemory as ConversationMemoryModel, type ConversationMemoryOperationsContext, type ConversationQueryOptions, type CreateAutoExtractorOptions, type CreateConversationOptions, type CreateEntityOptions, type CreateMediaOptions, type CreateMessageOptions, type CreateModelPreferenceOptions, type CreateProjectOptions, type CreateSavedToolOptions, type CreateServerToolsFilterOptions, type CreateUserPreferenceOptions, type CreateVaultFolderOptions, type CreateVaultMemoryOptions, type CryptoPriceClassification, type CryptoPricePreProcessorOptions, DEFAULT_BACKUP_FOLDER$1 as DEFAULT_BACKUP_FOLDER, DEFAULT_CACHE_EXPIRATION_MS, DEFAULT_CHUNK_CACHE_SIZE, DEFAULT_CHUNK_OVERLAP, DEFAULT_CHUNK_SIZE, DEFAULT_CONVERSATIONS_FOLDER as DEFAULT_DRIVE_CONVERSATIONS_FOLDER, DEFAULT_ROOT_FOLDER as DEFAULT_DRIVE_ROOT_FOLDER, DEFAULT_BACKUP_FOLDER$1 as DEFAULT_DROPBOX_FOLDER, DEFAULT_EXCLUDED_SERVER_TOOLS, DEFAULT_BACKUP_FOLDER as DEFAULT_ICLOUD_BACKUP_FOLDER, DEFAULT_MIN_CHUNK_SIZE, DEFAULT_PERSONALITY_SETTINGS, DEFAULT_PROFILE_FACETS, DEFAULT_SERVER_TOOLS_MATCH_OPTIONS, DEFAULT_VAULT_CACHE_SIZE, DatabaseManager, type DatabaseManagerLogger, type DatabaseManagerOptions, type DeckProps, type DisplayToolMigrations, type DropboxAuthContextValue, DropboxAuthProvider, type DropboxAuthProviderProps, type DropboxExportResult, type DropboxImportResult, ENTITY_KINDS, type EmbeddedWalletSignerFn, type EntityInput, type EntityKind, Entity as EntityModel, type EntityOperationsContext, ExcelProcessor, type ExtractFactsOptions, type ExtractOutcome, type ExtractedCandidate, type ExtractedEntity, type ExtractionCursorStore, FILE_PLACEHOLDER_PREFIX, FILE_PLACEHOLDER_REGEX, type FactType, type FileMetadata, type FileProcessor, type FileTypeQuery, type FileWithData, type FlushResult, type GetConversationsPageOptions, type GetMessagesPageOptions, type GoogleDriveAuthContextValue, GoogleDriveAuthProvider, type GoogleDriveAuthProviderProps, type GoogleDriveExportResult, type GoogleDriveImportResult, type GroupProps, type ICloudAuthContextValue, ICloudAuthProvider, type ICloudAuthProviderProps, type ICloudExportResult, type ICloudImportResult, INFERENCE_ID_HEADER, type IconProps, type ImageProps, type InteractionType, type KnownTag, type LazyStoredConversation, type LineProps, type Logger, LoggerProvider, type LoggerProviderProps, type MediaDimensions, type MediaFilterOptions, type MediaMetadata, type MediaOperationsContext, type MediaRole, type MediaType, type MemoriesNeedingTopicExtraction, type EmbeddingOptions as MemoryEngineEmbeddingOptions, type MemoryEngineResult, type MemoryEngineSearchOptions, MemoryEntity as MemoryEntityModel, type MemoryExtractedEvent, type MemoryKind, type MemoryVaultSearchOptions, type MemoryVaultToolOptions, type MessageChunk, type MessageFeedback, type MessageSkeleton, type ModelLoadProgress, type OCRFile, type OperationExecutor, PROFILE_DOC_VERSION, type ParsedServerToolsResponse, type PdfExportOptions, type PdfExportProgress, type PdfExportStage, type PdfFile, PdfProcessor, type PendingInteraction, type PersonalitySettings, type PersonalitySliders, type PersonalityStyle, type PhoneCallPollingOptions, type PlatformStorage, type PortalLlmAuth, type PreprocessingOptions, type PreprocessingResult, type ProcessedFileResult, ProcessorRegistry, type ProfileConfigFingerprint, type ProfileDoc, type ProfileFacet, type ProfileFacetKey, type ProfileSection, type ProfileUpdate, type ProgressCallback, Project, type ProjectOperationsContext, type PromptPreProcessor, type PromptPreProcessorContext, type ProviderAuthState, type ProviderBackupState, ProviderStreamError, type QuantizedEmbedding, type QueueEncryptionContext, QueueManager, type QueueStatus, type QueuedOperation, type QueuedOperationType, R2_DEFAULT_TTL_MS, RECALL_MAX_LIMIT, RECALL_TOOL_NAME, type RankedMemory, type RecallContext, type RecallDegradation, type RecallDiagnostics, type RecallOptions, type RecallResult, type RecallToolCallbacks, type RecallToolOptions, type RecencyOptions, type RectProps, type ReflectOptions, type ReflectResult, RerankerUnavailableError, type ResumeStreamOptions, type ResumeStreamResult, type RetainAction, type RetainContext, type RetainOptions, type RetainResult, type RetainSource, SDK_SCHEMA_VERSION, SERVER_TOOL_DEPENDENCY_SETS, SLIDER_CONFIG, SLIDES_FILE_PATH, SLIDE_CANVAS_HEIGHT, SLIDE_CANVAS_WIDTH, STREAM_RESUMABLE_HEADER, SavedTool as SavedToolModel, type SavedToolOperationsContext, type SavedToolParameter, type ScoreBreakdown, type ScreenProps, type SearchMessagesOptions, type SearchSource, type SelectServerToolsForPromptOptions, type SendMessageWithStorageArgs, type SendMessageWithStorageResult, type ServerTool, type ServerToolsFilter, type ServerToolsFilterFn, type ServerToolsFilterFunction, type ServerToolsOptions, type ServerToolsResponse, type SignMessageFn, type SignMessageOptions, type SlideProps, type StepFinishEvent, type StockPriceClassification, type StockPricePreProcessorOptions, type StorageOperationsContext, type StoredAppFile, type ChatCompletionUsage as StoredChatCompletionUsage, type StoredConversation, type StoredConversationMemory, type StoredEntity, type StoredFileWithContext, type StoredMedia, Media as StoredMediaModel, type StoredMessage, type StoredMessageWithSimilarity, type StoredModelPreference, ModelPreference as StoredModelPreferenceModel, type StoredProject, type StoredSavedTool, type StoredUserPreference, UserPreference as StoredUserPreferenceModel, type StoredVaultFolder, VaultFolder as StoredVaultFolderModel, type StoredVaultMemory, VaultMemory as StoredVaultMemoryModel, StreamExpiredError, type StreamMetaEvent, type StreamResumeHandle, type SynthesizeProfileOptions, THEME_ATTRS, TOPICS_EXTRACTION_VERSION, TOPIC_EXTRACTION_BATCH_SIZE, type TextChunk, TextProcessor, type TextProps, type ThemeAttr, type ToolCallArgumentsDeltaEvent, type ToolMatchOptions, type ToolMatchResult, type ToolSet, type TopicExtractOptions, type TopicExtractionInput, type TopicExtractionRunResult, type TranscriptionResult, type TurnCompleteEvent, type TurnSkippedEvent, type UIInteractionContextValue, UIInteractionProvider, type UIInteractionProviderProps, type UpdateMediaOptions, type UpdateModelPreferenceOptions, type UpdateProjectOptions, type UpdateSavedToolOptions, type UpdateUserPreferenceOptions, type UpdateVaultFolderOptions, type UpdateVaultMemoryOptions, type UseBackupOptions, type UseBackupResult, type UseChatStorageOptions, type UseChatStorageResult, type UseCreditsOptions, type UseCreditsResult, type UseDropboxBackupOptions, type UseDropboxBackupResult, type UseEncryptionResult, type UseExportPdfResult, type UseFilesOptions, type UseFilesResult, type UseGoogleDriveBackupOptions, type UseGoogleDriveBackupResult, type UseICloudBackupOptions, type UseICloudBackupResult, type UseModelsResult, type UseOCRResult, type UsePdfResult, type UsePhoneCallsOptions, type UsePhoneCallsResult, type UseProjectsOptions, type UseProjectsResult, type UseSettingsOptions, type UseSettingsResult, type UseSubscriptionOptions, type UseSubscriptionResult, type UseToolsOptions, type UseToolsResult, type UseVoiceOptions, type UseVoiceResult, type UseWalletBindingOptions, type UseWalletBindingResult, type VaultEmbeddingCache, type VaultFolderOperationsContext, type VaultMemoryOperationsContext, type VaultSaveOperation, type VaultSearchResult, type VoiceRecording, WalletPoller, WatermelonChatStorageAdapter, type WatermelonChatStorageAdapterOptions, type WeatherClassification, type WeatherPreProcessorOptions, type WebSearchClassification, type WebSearchPreProcessorOptions, type WhisperModel, WordProcessor, ZipProcessor, type ZipProcessorOptions, addConversationMemoriesOp, appFileToStored, backfillMemoryEntityUserIdsOp, chatStorageMigrations, chatStorageSchema, chunkAndEmbedAllMessages, chunkAndEmbedMessage, chunkText, classifyCryptoPrice, classifyCryptoPriceBatch, classifyStockPrice, classifyStockPriceBatch, classifyWeather, classifyWeatherBatch, classifyWebSearch, classifyWebSearchBatch, clearAllEncryptionKeys, clearAllEncryptionState, clearAllKeyPairs, clearCalendarToken, clearConversationMemoriesOp, clearDriveToken, clearToken as clearDropboxToken, clearEncryptionKey, clearGithubToken, clearGoogleDriveToken, clearICloudAuth, clearKeyPair, clearLazyTitleCache, clearMemoryTopicsOverrideOp, clearNotionToken, clearServerToolsCache, consoleLogger, conversationMemoryToStored, cosineInt8, createAutoExtractor, createChunkVectorCache, createCryptoPricePreProcessor, createGitHubTools, createMediaBatchOp, createMediaOp, createMemoryEngineTool, createMemoryVaultSearchTool, createMemoryVaultTool, createPlatformCursorStore, createProjectOp, createRecallTool, createSavedToolOp, createServerToolsFilter, createStockPricePreProcessor, createVaultEmbeddingCache, createVaultFolderOp, createVaultMemoriesBatchOp, createVaultMemoryOp, createWeatherPreProcessor, createWebSearchPreProcessor, decryptConversationTitle, decryptData, decryptDataBatch, decryptDataBytes, decryptDataBytesFromBytes, decryptDataWithKey, defaultServerToolsFilter, deleteAllAppFilesOp, deleteAllVaultMemoriesForUserOp, deleteAppFileOp, deleteEncryptedFile, deleteMediaByConversationOp, deleteMediaByMessageOp, deleteMediaOp, deleteProjectOp, deleteSavedToolOp, deleteVaultFolderOp, deleteVaultMemoryOp, dequantizeEmbedding, eagerEmbedContent, embedAllMessages, embedMessage, encryptData, encryptDataBatch, encryptDataBytes, encryptDataWithKey, ensureDefaultFoldersOp, expandToolSetsAdditive, exportElementToPdf, exportMarkdownToPdf, exportPublicKey, extractAndLinkEntitiesForMemoriesOp, extractAndRetain, extractEntitiesForMemories, extractFacts, extractFileIds, fileExists, findById, findMatchingTools, findParentOfId, generateConversationId, generateEmbedding, generateEmbeddings, generateMediaId, generateProjectId, getAIGeneratedMediaOp, getAllSavedToolsOp, getAllVaultFoldersOp, getAllVaultMemoriesOp, getAllVaultMemoryContentsOp, getAndClearCalendarPendingMessage, getAndClearCalendarReturnUrl, getAndClearDrivePendingMessage, getAndClearDriveReturnUrl, getAndClearGithubPendingMessage, getAndClearGithubReturnUrl, getAndClearNotionPendingMessage, getAndClearNotionReturnUrl, getAppFileMapOp, getAppFileOp, getAppFilesOp, getAudioOp, getCachedServerTools, getCalendarAccessToken, getConversationMemoriesOp, getConversationsByProjectLazyOp, getConversationsByProjectOp, getConversationsLazyOp, getConversationsPageOp, getDocumentsOp, getDriveAccessToken, getEncryptionKey, getGithubAccessToken, getGoogleDriveStoredToken, getId, getImagesOp, getLogger, getMediaByConversationOp, getMediaByIdOp, getMediaByIdsOp, getMediaByMessageOp, getMediaByModelOp, getMediaByRoleOp, getMediaBySourceUrlOp, getMediaByTypeOp, getMediaCountOp, getMediaCountsByTypeOp, getMediaOp, getMediaTypeFromMime, getMemoriesByEntityNamesOp, getMemoriesNeedingTopicExtractionOp, getNotionAccessToken, getNotionMCPUrl, getNumberAttr, getProjectConversationCountOp, getProjectConversationsOp, getProjectOp, getProjectsOp, getRecentMediaOp, getSavedToolByIdOp, getServerTools, getStringAttr, getSupportedFileTypes, getToolsChecksum, getUnfiledVaultMemoriesOp, getUserUploadedMediaOp, getValidCalendarToken, getValidDriveToken, getValidGithubToken, getValidNotionToken, getVaultFolderMemoryCountOp, getVaultMemoryOp, getVideosOp, handleCalendarCallback, handleDriveCallback, handleGithubCallback, handleNotionCallback, hardDeleteMediaOp, hasCalendarCredentials, hasDriveCredentials, hasDropboxCredentials, hasEncryptionKey, hasGithubCredentials, hasGoogleDriveCredentials, hasICloudCredentials, hasKeyPair, hasNotionCredentials, insertAfterId, insertChild, isAnumaTag, isCalendarCallback, isDriveCallback, isGithubCallback, isHtmlTag, isNotionCallback, isOPFSSupported, isR2UrlExpired, isRerankerAvailable, isSupportedFile, isSupportedMediaType, linkMemoryEntitiesOp, mediaToStored, migrateCalendarToken, migrateDisplayResult, migrateDriveToken, migrateGithubToken, migrateNotionClientRegistration, migrateNotionToken, moveMemoriesToFolderOp, noopLogger, onKeyAvailable, parseJsx, preEmbedVaultMemories, preprocessFiles, previewToolSelection, projectToStored, putAppFileOp, quantizeEmbedding, queueManager, readEncryptedFile, recall, reflect, refreshCalendarToken, refreshDriveToken, refreshGithubToken, refreshNotionToken, relinkMisclassifiedVideosOp, removeById, renderAnumaJsx, renderAnumaTree, renderElementToCanvas, replaceById, replaceMemoryEntitiesGuardedOp, requestEncryptionKey, requestKeyPair, resolveFilePlaceholders, resolveThemeColor, resumeStream, retain, revokeCalendarToken, revokeDriveToken, revokeGithubToken, revokeNotionAccess, savedToolToStored, sdkMigrations, sdkModelClasses, sdkSchema, searchChunksOp, searchMediaOp, searchMessagesOp, searchVaultMemories, selectServerToolsForPrompt, serializeJsx, setLogger, setMemoryEntitiesOp, settingsStorageSchema, shouldChunkMessage, shouldRefreshTools, stampTopicsExtractedAtOp, startGithubAuth, startNotionAuth, storeCalendarPendingMessage, storeCalendarReturnUrl, storeCalendarToken, storeDrivePendingMessage, storeDriveReturnUrl, storeDriveToken, storeGithubPendingMessage, storeGithubReturnUrl, storeGithubToken, storeNotionPendingMessage, storeNotionReturnUrl, streamCancelPath, streamReplayPath, supersedeVaultMemoryOp, synthesizeProfile, updateAttrs, updateConversationProjectOp, updateMediaMessageIdBatchOp, updateMediaOp, updateMessageFeedbackOp, updateProjectNameOp, updateProjectOp, updateSavedToolOp, updateVaultFolderContextOp, updateVaultFolderOp, updateVaultMemoryEmbeddingOp, updateVaultMemoryOp, useAnumaTheme, useBackup, useBackupAuth, useChat, useChatStorage, useCredits, useDatabaseManager, useDropboxAuth, useDropboxBackup, useEncryption, useExportPdf, useFiles, useGoogleDriveAuth, useGoogleDriveBackup, useICloudAuth, useICloudBackup, useModels, useOCR, usePdf, usePhoneCalls, useProjects, useSettings, useSubscription, useTools, useUIInteraction, useVoice, useWalletBinding, userPreferencesStorageSchema, walk, webPlatformStorage, writeEncryptedFile };
+export { Anuma, type AnumaChild, AnumaJsxError, type AnumaNode, AnumaShadowIsolationProvider, type AnumaShadowIsolationProviderProps, type AnumaTheme, AnumaThemeProvider, type AnumaThemeProviderProps, AppFile as AppFileModel, type AppFileOperationsContext, type AttrValue, type AutoExtractMessage, type AutoExtractor, DEFAULT_CONVERSATIONS_FOLDER as BACKUP_DRIVE_CONVERSATIONS_FOLDER, DEFAULT_ROOT_FOLDER as BACKUP_DRIVE_ROOT_FOLDER, DEFAULT_BACKUP_FOLDER as BACKUP_ICLOUD_FOLDER, BUILT_IN_TOOL_SETS, type BackupAuthContextValue, BackupAuthProvider, type BackupAuthProviderProps, type BackupOperationOptions, BlobUrlManager, type Budget, type CachedChunkVectors, type CachedServerTools, ChartCard, type ChartCardProps, type ChartConfig, ChartContainer, ChartLegend, ChartLegendContent, ChartStyle, ChartTooltip, ChartTooltipContent, Conversation as ChatConversation, Message as ChatMessage, type ChatRole, type ChatStorageAdapter, type ChatStorageObservable, type ChunkSearchResult, type ChunkVectorCache, type ChunkingOptions, type CircleProps, type ClientToolsFilterFn, type ConsolidationFallbackReason, type ConversationMemoryInput, ConversationMemory as ConversationMemoryModel, type ConversationMemoryOperationsContext, type ConversationQueryOptions, type CreateAutoExtractorOptions, type CreateConversationOptions, type CreateDecaySweeperOptions, type CreateEntityOptions, type CreateMediaOptions, type CreateMessageOptions, type CreateModelPreferenceOptions, type CreateProjectOptions, type CreateSavedToolOptions, type CreateServerToolsFilterOptions, type CreateUserPreferenceOptions, type CreateVaultFolderOptions, type CreateVaultMemoryOptions, type CryptoPriceClassification, type CryptoPricePreProcessorOptions, DEFAULT_BACKUP_FOLDER$1 as DEFAULT_BACKUP_FOLDER, DEFAULT_CACHE_EXPIRATION_MS, DEFAULT_CHUNK_CACHE_SIZE, DEFAULT_CHUNK_OVERLAP, DEFAULT_CHUNK_SIZE, DEFAULT_DECAY_POLICY, DEFAULT_CONVERSATIONS_FOLDER as DEFAULT_DRIVE_CONVERSATIONS_FOLDER, DEFAULT_ROOT_FOLDER as DEFAULT_DRIVE_ROOT_FOLDER, DEFAULT_BACKUP_FOLDER$1 as DEFAULT_DROPBOX_FOLDER, DEFAULT_EXCLUDED_SERVER_TOOLS, DEFAULT_BACKUP_FOLDER as DEFAULT_ICLOUD_BACKUP_FOLDER, DEFAULT_MAX_CLASSIFIER_CALLS_PER_SWEEP, DEFAULT_MIN_CHUNK_SIZE, DEFAULT_PERSONALITY_SETTINGS, DEFAULT_PROFILE_FACETS, DEFAULT_SERVER_TOOLS_MATCH_OPTIONS, DEFAULT_VAULT_CACHE_SIZE, DatabaseManager, type DatabaseManagerLogger, type DatabaseManagerOptions, type DecayCandidateRaw, type DecayClassifier, type DecayInput, type DecayPolicy, type DecaySweepResult, type DecaySweeper, type DecayVerdict, type DeckProps, type DisplayToolMigrations, type DropboxAuthContextValue, DropboxAuthProvider, type DropboxAuthProviderProps, type DropboxExportResult, type DropboxImportResult, ENTITY_FANOUT, ENTITY_KINDS, type EmbeddedWalletSignerFn, type EntityInput, type EntityKind, Entity as EntityModel, type EntityOperationsContext, ExcelProcessor, type ExtractFactsOptions, type ExtractOutcome, type ExtractedCandidate, type ExtractedEntity, type ExtractionCursorStore, FILE_PLACEHOLDER_PREFIX, FILE_PLACEHOLDER_REGEX, type FactType, type FileMetadata, type FileProcessor, type FileTypeQuery, type FileWithData, type FlushResult, type GetConversationsPageOptions, type GetMessagesPageOptions, type GoogleDriveAuthContextValue, GoogleDriveAuthProvider, type GoogleDriveAuthProviderProps, type GoogleDriveExportResult, type GoogleDriveImportResult, type GraphTraversalOptions, type GroupProps, HARD_DELETE_WINDOW_MS, type ICloudAuthContextValue, ICloudAuthProvider, type ICloudAuthProviderProps, type ICloudExportResult, type ICloudImportResult, INFERENCE_ID_HEADER, type IconProps, type ImageProps, type InjectionClassifierOptions, type InjectionReason, type InteractionType, type KnownTag, type LazyStoredConversation, type LineProps, type LlmDecayClassifierOptions, type LlmNeighborRefinerOptions, type Logger, LoggerProvider, type LoggerProviderProps, MAX_HOPS, MEDIUM_TTL_MS, type MediaDimensions, type MediaFilterOptions, type MediaMetadata, type MediaOperationsContext, type MediaRole, type MediaType, type MemoriesNeedingTopicExtraction, type EmbeddingOptions as MemoryEngineEmbeddingOptions, type MemoryEngineResult, type MemoryEngineSearchOptions, MemoryEntity as MemoryEntityModel, type MemoryExtractedEvent, type MemoryKind, type MemoryQuarantinedEvent, type MemoryVaultSearchOptions, type MemoryVaultToolOptions, type MessageChunk, type MessageFeedback, type MessageSkeleton, type ModelLoadProgress, NEVER_TTL_MS, NODE_BUDGET, type NeighborRefiner, type NowSource, type OCRFile, type OperationExecutor, PAST_EVENT_GRACE_MS, PROFILE_DOC_VERSION, type ParsedServerToolsResponse, type PdfExportOptions, type PdfExportProgress, type PdfExportStage, type PdfFile, PdfProcessor, type PendingInteraction, type PersonalitySettings, type PersonalitySliders, type PersonalityStyle, type PhoneCallPollingOptions, type PlatformStorage, type PortalLlmAuth, type PreprocessingOptions, type PreprocessingResult, type ProcessedFileResult, ProcessorRegistry, type ProfileConfigFingerprint, type ProfileDoc, type ProfileFacet, type ProfileFacetKey, type ProfileSection, type ProfileUpdate, type ProgressCallback, Project, type ProjectOperationsContext, type PromptPreProcessor, type PromptPreProcessorContext, type ProviderAuthState, type ProviderBackupState, ProviderStreamError, type QuantizedEmbedding, type QuarantinedMemoryInfo, type QueueEncryptionContext, QueueManager, type QueueStatus, type QueuedOperation, type QueuedOperationType, R2_DEFAULT_TTL_MS, RECALL_MAX_LIMIT, RECALL_TOOL_NAME, type RankedMemory, type RecallContext, type RecallDegradation, type RecallDiagnostics, type RecallOptions, type RecallResult, type RecallToolCallbacks, type RecallToolOptions, type RecencyOptions, type RectProps, type ReflectOptions, type ReflectResult, RerankerUnavailableError, type ResumeStreamOptions, type ResumeStreamResult, type RetainAction, type RetainContext, type RetainOptions, type RetainResult, type RetainSource, SDK_SCHEMA_VERSION, SERVER_TOOL_DEPENDENCY_SETS, SHORT_TTL_MS, SLIDER_CONFIG, SLIDES_FILE_PATH, SLIDE_CANVAS_HEIGHT, SLIDE_CANVAS_WIDTH, STREAM_RESUMABLE_HEADER, SavedTool as SavedToolModel, type SavedToolOperationsContext, type SavedToolParameter, type ScoreBreakdown, type ScreenProps, type ScreenResult, type ScreenedCandidate, type SearchMessagesOptions, type SearchSource, type SelectServerToolsForPromptOptions, type SendMessageWithStorageArgs, type SendMessageWithStorageResult, type ServerTool, type ServerToolsFilter, type ServerToolsFilterFn, type ServerToolsFilterFunction, type ServerToolsOptions, type ServerToolsResponse, type SignMessageFn, type SignMessageOptions, type SlideProps, type StepFinishEvent, type StockPriceClassification, type StockPricePreProcessorOptions, type StorageOperationsContext, type StoredAppFile, type ChatCompletionUsage as StoredChatCompletionUsage, type StoredConversation, type StoredConversationMemory, type StoredEntity, type StoredFileWithContext, type StoredMedia, Media as StoredMediaModel, type StoredMessage, type StoredMessageWithSimilarity, type StoredModelPreference, ModelPreference as StoredModelPreferenceModel, type StoredProject, type StoredSavedTool, type StoredUserPreference, UserPreference as StoredUserPreferenceModel, type StoredVaultFolder, VaultFolder as StoredVaultFolderModel, type StoredVaultMemory, VaultMemory as StoredVaultMemoryModel, StreamExpiredError, type StreamMetaEvent, type StreamResumeHandle, type SynthesizeProfileOptions, THEME_ATTRS, TOPICS_EXTRACTION_VERSION, TOPIC_EXTRACTION_BATCH_SIZE, type TextChunk, TextProcessor, type TextProps, type ThemeAttr, type ToolCallArgumentsDeltaEvent, type ToolMatchOptions, type ToolMatchResult, type ToolSet, type TopicExtractOptions, type TopicExtractionInput, type TopicExtractionRunResult, type TranscriptionResult, type TurnCompleteEvent, type TurnSkippedEvent, type UIInteractionContextValue, UIInteractionProvider, type UIInteractionProviderProps, type UpdateMediaOptions, type UpdateModelPreferenceOptions, type UpdateProjectOptions, type UpdateSavedToolOptions, type UpdateUserPreferenceOptions, type UpdateVaultFolderOptions, type UpdateVaultMemoryOptions, type UseBackupOptions, type UseBackupResult, type UseChatStorageOptions, type UseChatStorageResult, type UseCreditsOptions, type UseCreditsResult, type UseDropboxBackupOptions, type UseDropboxBackupResult, type UseEncryptionResult, type UseExportPdfResult, type UseFilesOptions, type UseFilesResult, type UseGoogleDriveBackupOptions, type UseGoogleDriveBackupResult, type UseICloudBackupOptions, type UseICloudBackupResult, type UseModelsResult, type UseOCRResult, type UsePdfResult, type UsePhoneCallsOptions, type UsePhoneCallsResult, type UseProjectsOptions, type UseProjectsResult, type UseSettingsOptions, type UseSettingsResult, type UseSubscriptionOptions, type UseSubscriptionResult, type UseToolsOptions, type UseToolsResult, type UseVoiceOptions, type UseVoiceResult, type UseWalletBindingOptions, type UseWalletBindingResult, VAULT_SIZE_HOP_CAP, type VaultEmbeddingCache, type VaultFolderOperationsContext, type VaultMemoryOperationsContext, type VaultSaveOperation, type VaultSearchResult, type VoiceRecording, WalletPoller, WatermelonChatStorageAdapter, type WatermelonChatStorageAdapterOptions, type WeatherClassification, type WeatherPreProcessorOptions, type WebSearchClassification, type WebSearchPreProcessorOptions, type WhisperModel, WordProcessor, ZipProcessor, type ZipProcessorOptions, addConversationMemoriesOp, appFileToStored, archiveVaultMemoryOp, backfillMemoryEntityUserIdsOp, capHopsForDensity, chatStorageMigrations, chatStorageSchema, chunkAndEmbedAllMessages, chunkAndEmbedMessage, chunkText, classifyCryptoPrice, classifyCryptoPriceBatch, classifyDecay, classifyInjectionCandidates, classifyStockPrice, classifyStockPriceBatch, classifyWeather, classifyWeatherBatch, classifyWebSearch, classifyWebSearchBatch, clearAllEncryptionKeys, clearAllEncryptionState, clearAllKeyPairs, clearCalendarToken, clearConversationMemoriesOp, clearDriveToken, clearToken as clearDropboxToken, clearEncryptionKey, clearGithubToken, clearGoogleDriveToken, clearICloudAuth, clearKeyPair, clearLazyTitleCache, clearMemoryTopicsOverrideOp, clearNotionToken, clearServerToolsCache, consoleLogger, conversationMemoryToStored, cosineInt8, createAutoExtractor, createChunkVectorCache, createCryptoPricePreProcessor, createDecaySweeper, createGitHubTools, createLlmDecayClassifier, createLlmNeighborRefiner, createMediaBatchOp, createMediaOp, createMemoryEngineTool, createMemoryVaultSearchTool, createMemoryVaultTool, createPlatformCursorStore, createProjectOp, createRecallTool, createSavedToolOp, createServerToolsFilter, createStockPricePreProcessor, createVaultEmbeddingCache, createVaultFolderOp, createVaultMemoriesBatchOp, createVaultMemoryOp, createWeatherPreProcessor, createWebSearchPreProcessor, decryptConversationTitle, decryptData, decryptDataBatch, decryptDataBytes, decryptDataBytesFromBytes, decryptDataWithKey, defaultServerToolsFilter, deleteAllAppFilesOp, deleteAllVaultMemoriesForUserOp, deleteAppFileOp, deleteEncryptedFile, deleteMediaByConversationOp, deleteMediaByMessageOp, deleteMediaOp, deleteProjectOp, deleteSavedToolOp, deleteVaultFolderOp, deleteVaultMemoryOp, dequantizeEmbedding, eagerEmbedContent, embedAllMessages, embedMessage, encryptData, encryptDataBatch, encryptDataBytes, encryptDataWithKey, ensureDefaultFoldersOp, expandToolSetsAdditive, exportElementToPdf, exportMarkdownToPdf, exportPublicKey, extractAndLinkEntitiesForMemoriesOp, extractAndRetain, extractEntitiesForMemories, extractFacts, extractFileIds, fileExists, findById, findMatchingTools, findParentOfId, generateConversationId, generateEmbedding, generateEmbeddings, generateMediaId, generateProjectId, getAIGeneratedMediaOp, getAllSavedToolsOp, getAllVaultFoldersOp, getAllVaultMemoriesOp, getAllVaultMemoryContentsOp, getAndClearCalendarPendingMessage, getAndClearCalendarReturnUrl, getAndClearDrivePendingMessage, getAndClearDriveReturnUrl, getAndClearGithubPendingMessage, getAndClearGithubReturnUrl, getAndClearNotionPendingMessage, getAndClearNotionReturnUrl, getAppFileMapOp, getAppFileOp, getAppFilesOp, getAudioOp, getCachedServerTools, getCalendarAccessToken, getConversationMemoriesOp, getConversationsByProjectLazyOp, getConversationsByProjectOp, getConversationsLazyOp, getConversationsPageOp, getDecayCandidatesRawOp, getDocumentsOp, getDriveAccessToken, getEncryptionKey, getEntitiesByMemoryIdsOp, getGithubAccessToken, getGoogleDriveStoredToken, getId, getImagesOp, getLogger, getMediaByConversationOp, getMediaByIdOp, getMediaByIdsOp, getMediaByMessageOp, getMediaByModelOp, getMediaByRoleOp, getMediaBySourceUrlOp, getMediaByTypeOp, getMediaCountOp, getMediaCountsByTypeOp, getMediaOp, getMediaTypeFromMime, getMemoriesByEntityNamesOp, getMemoriesNeedingTopicExtractionOp, getNotionAccessToken, getNotionMCPUrl, getNumberAttr, getProjectConversationCountOp, getProjectConversationsOp, getProjectOp, getProjectsOp, getRecentMediaOp, getSavedToolByIdOp, getServerTools, getStringAttr, getSupportedFileTypes, getToolsChecksum, getUnfiledVaultMemoriesOp, getUserUploadedMediaOp, getValidCalendarToken, getValidDriveToken, getValidGithubToken, getValidNotionToken, getVaultFolderMemoryCountOp, getVaultMemoryOp, getVideosOp, handleCalendarCallback, handleDriveCallback, handleGithubCallback, handleNotionCallback, hardDeleteDecayedOp, hardDeleteMediaOp, hasCalendarCredentials, hasDriveCredentials, hasDropboxCredentials, hasEncryptionKey, hasGithubCredentials, hasGoogleDriveCredentials, hasICloudCredentials, hasKeyPair, hasNotionCredentials, injectionSignatureCatalog, insertAfterId, insertChild, isAnumaTag, isCalendarCallback, isDriveCallback, isGithubCallback, isHtmlTag, isNotionCallback, isOPFSSupported, isR2UrlExpired, isRerankerAvailable, isSupportedFile, isSupportedMediaType, linkMemoryEntitiesOp, mediaToStored, migrateCalendarToken, migrateDisplayResult, migrateDriveToken, migrateGithubToken, migrateNotionClientRegistration, migrateNotionToken, moveMemoriesToFolderOp, noopLogger, onKeyAvailable, parseJsx, preEmbedVaultMemories, preprocessFiles, previewToolSelection, projectToStored, putAppFileOp, quantizeEmbedding, queueManager, readEncryptedFile, recall, reflect, refreshCalendarToken, refreshDriveToken, refreshGithubToken, refreshNotionToken, relinkMisclassifiedVideosOp, removeById, renderAnumaJsx, renderAnumaTree, renderElementToCanvas, replaceById, replaceMemoryEntitiesGuardedOp, requestEncryptionKey, requestKeyPair, resolveFilePlaceholders, resolveThemeColor, restoreVaultMemoryOp, resumeStream, retain, revokeCalendarToken, revokeDriveToken, revokeGithubToken, revokeNotionAccess, savedToolToStored, screenCandidatesForInjection, sdkMigrations, sdkModelClasses, sdkSchema, searchChunksOp, searchMediaOp, searchMessagesOp, searchVaultMemories, selectServerToolsForPrompt, serializeJsx, setLogger, setMemoryEntitiesOp, settingsStorageSchema, shouldChunkMessage, shouldRefreshTools, stampTopicsExtractedAtOp, startGithubAuth, startNotionAuth, storeCalendarPendingMessage, storeCalendarReturnUrl, storeCalendarToken, storeDrivePendingMessage, storeDriveReturnUrl, storeDriveToken, storeGithubPendingMessage, storeGithubReturnUrl, storeGithubToken, storeNotionPendingMessage, storeNotionReturnUrl, streamCancelPath, streamReplayPath, supersedeVaultMemoryOp, synthesizeProfile, traverseGraphLane, ttlForType, updateAttrs, updateConversationProjectOp, updateMediaMessageIdBatchOp, updateMediaOp, updateMessageFeedbackOp, updateProjectNameOp, updateProjectOp, updateSavedToolOp, updateVaultFolderContextOp, updateVaultFolderOp, updateVaultMemoryEmbeddingOp, updateVaultMemoryOp, useAnumaTheme, useBackup, useBackupAuth, useChat, useChatStorage, useCredits, useDatabaseManager, useDropboxAuth, useDropboxBackup, useEncryption, useExportPdf, useFiles, useGoogleDriveAuth, useGoogleDriveBackup, useICloudAuth, useICloudBackup, useModels, useOCR, usePdf, usePhoneCalls, useProjects, useSettings, useSubscription, useTools, useUIInteraction, useVoice, useWalletBinding, userPreferencesStorageSchema, walk, webPlatformStorage, writeEncryptedFile };