@anuma/sdk 7.0.3 → 7.0.4-next.20261015012621

package/dist/server/index.mjs

@@ -14928,6 +14928,10 @@ var require_stepsForMigration = __commonJS({
   }
 });
 
+// src/lib/chat/toolResultMessage.ts
+var FOOTER = "\n\nBased on these results, continue with the task.";
+var TOOL_RESULT_FOOTER_LINE = FOOTER.trim();
+
 // src/lib/tools/toolCatalog.ts
 var TOOL_CATALOG = {
   gmail_search_messages: { label: "Search emails", provider: "gmail", connector: "Gmail" },
@@ -15104,7 +15108,32 @@ ${neutralised}
 }
 
 // src/lib/chat/toolResults.ts
+var TOOL_RESULTS_PREFIX = "[Tool Execution Results]";
+var TOOL_LINE = /^Tool "([^"]+)" returned: (.*)$/;
 var TOOL_RESULT_ORIGIN = "tool_result";
+function isToolResultsRow(row) {
+  if (row.origin === TOOL_RESULT_ORIGIN) return true;
+  if (typeof row.origin === "string") return false;
+  if (row.role !== "user" || !row.content.startsWith(TOOL_RESULTS_PREFIX)) return false;
+  return parseToolResultSegments(row.content).length > 0;
+}
+function parseToolResultSegments(content) {
+  const segments = [];
+  for (const raw of content.split("\n")) {
+    const line = raw.trim();
+    const match = TOOL_LINE.exec(line);
+    if (match) {
+      segments.push({ name: match[1], line });
+      continue;
+    }
+    const current = segments[segments.length - 1];
+    if (!current || line === "" || line === TOOL_RESULT_FOOTER_LINE) continue;
+    if (line === TOOL_RESULTS_PREFIX) continue;
+    current.line = `${current.line}
+${line}`;
+  }
+  return segments;
+}
 
 // src/lib/db/chat/operations.ts
 var import_watermelondb2 = __toESM(require_watermelondb());
@@ -16720,8 +16749,9 @@ async function getConversationsByProjectOp(ctx, projectId) {
     )
   );
 }
-async function getMessagesOp(ctx, convId) {
-  const results = await ctx.messagesCollection.query(import_watermelondb2.Q.where("conversation_id", convId), import_watermelondb2.Q.sortBy("message_id", import_watermelondb2.Q.asc)).unsafeFetchRaw();
+async function getMessagesOp(ctx, convId, opts) {
+  const fetched = await ctx.messagesCollection.query(import_watermelondb2.Q.where("conversation_id", convId), import_watermelondb2.Q.sortBy("message_id", import_watermelondb2.Q.asc)).unsafeFetchRaw();
+  const results = opts?.rawFilter ? fetched.filter(opts.rawFilter) : fetched;
   return Promise.all(
     results.map(
       (raw) => messageRawToStored(raw, ctx.walletAddress, ctx.signMessage, ctx.embeddedWalletSigner)
@@ -18448,6 +18478,22 @@ var postApiV1Embeddings = (options) => (options.client ?? client).post({
   }
 });
 
+// src/lib/memoryEngine/embeddingCacheState.ts
+var EMBEDDING_CACHE_STATE_KEY = /* @__PURE__ */ Symbol.for("@anuma/sdk/embedding-cache/v1");
+var cacheGlobal = globalThis;
+var fallbackState = {
+  scopedViews: /* @__PURE__ */ new WeakMap(),
+  inFlightByCache: /* @__PURE__ */ new WeakMap(),
+  cachedEmbeddingModels: /* @__PURE__ */ new WeakMap()
+};
+function getEmbeddingCacheState() {
+  try {
+    return cacheGlobal[EMBEDDING_CACHE_STATE_KEY] ?? (cacheGlobal[EMBEDDING_CACHE_STATE_KEY] = fallbackState);
+  } catch {
+    return fallbackState;
+  }
+}
+
 // src/lib/memoryEngine/generate.ts
 var EMBED_MAX_ATTEMPTS = 4;
 var DEFAULT_EMBEDDING_REQUEST_TIMEOUT_MS = 15e3;
@@ -18539,15 +18585,18 @@ async function generateEmbedding(text12, options) {
   if (total === void 0) return embedOne(text12, options, void 0);
   return withDeadline((signal) => embedOne(text12, options, signal), total, "embedding");
 }
-var inFlightByCache = /* @__PURE__ */ new WeakMap();
+var { inFlightByCache, cachedEmbeddingModels } = getEmbeddingCacheState();
 async function embedOne(text12, options, outer) {
   const { cache } = options;
   if (!cache) return Array.from(await requestEmbedding(text12, options, outer));
+  const model = options.model ?? DEFAULT_API_EMBEDDING_MODEL;
   const cached = cache.get(text12);
-  if (cached) return Array.from(cached);
+  const cachedModel = cached && cachedEmbeddingModels.get(cached);
+  if (cached && (cachedModel === void 0 || cachedModel === model)) return Array.from(cached);
   const inFlight = inFlightByCache.get(cache) ?? /* @__PURE__ */ new Map();
   inFlightByCache.set(cache, inFlight);
-  const pending = inFlight.get(text12);
+  const requestKey = JSON.stringify([model, text12]);
+  const pending = inFlight.get(requestKey);
   if (pending) {
     try {
       return Array.from(await pending);
@@ -18556,13 +18605,14 @@ async function embedOne(text12, options, outer) {
     }
   }
   const request = requestEmbedding(text12, options, outer);
-  inFlight.set(text12, request);
+  inFlight.set(requestKey, request);
   try {
     const embedding = await request;
+    cachedEmbeddingModels.set(embedding, model);
     cache.set(text12, embedding);
     return Array.from(embedding);
   } finally {
-    if (inFlight.get(text12) === request) inFlight.delete(text12);
+    if (inFlight.get(requestKey) === request) inFlight.delete(requestKey);
   }
 }
 async function requestEmbedding(text12, options, outer) {
@@ -18645,13 +18695,15 @@ async function embedMany(texts, options, outer) {
   const { baseUrl = BASE_URL, model, batchSize, cache } = options;
   const timeoutMs = options.timeoutMs ?? DEFAULT_EMBEDDING_REQUEST_TIMEOUT_MS;
   const chunkSize = batchSize ?? DEFAULT_EMBEDDING_BATCH_SIZE;
+  const embeddingModel = model ?? DEFAULT_API_EMBEDDING_MODEL;
   const results = new Array(texts.length).fill(null);
   const uncachedIndices = [];
   const uncachedTexts = [];
   for (let i = 0; i < texts.length; i++) {
     if (cache) {
       const cached = cache.get(texts[i]);
-      if (cached) {
+      const cachedModel = cached && cachedEmbeddingModels.get(cached);
+      if (cached && (cachedModel === void 0 || cachedModel === embeddingModel)) {
         results[i] = Array.from(cached);
         continue;
       }
@@ -18667,7 +18719,6 @@ async function embedMany(texts, options, outer) {
     ...taskTypeHeader(options.taskType)
   };
   if (outer?.aborted) throw outer.reason;
-  const embeddingModel = model ?? DEFAULT_API_EMBEDDING_MODEL;
   let newEmbeddings;
   if (uncachedTexts.length <= chunkSize) {
     newEmbeddings = await generateEmbeddingsBatch(
@@ -18715,6 +18766,7 @@ async function embedMany(texts, options, outer) {
     const f32Embedding = Float32Array.from(newEmbeddings[i]);
     results[uncachedIndices[i]] = Array.from(f32Embedding);
     if (cache) {
+      cachedEmbeddingModels.set(f32Embedding, embeddingModel);
       cache.set(uncachedTexts[i], f32Embedding);
     }
   }
@@ -18839,6 +18891,37 @@ async function chunkAndEmbedMessage(ctx, messageId, options) {
   }));
   return updateMessageChunksOp(ctx, messageId, messageChunks, embeddingModel);
 }
+var MIN_SEALED_EMBEDDING_HEX = 256;
+function rawHasEmbedding(value) {
+  if (Array.isArray(value)) return value.length > 0;
+  if (typeof value !== "string" || value.length === 0) return false;
+  if (isEncrypted(value)) {
+    return value.length - value.indexOf(":", 4) - 1 >= MIN_SEALED_EMBEDDING_HEX;
+  }
+  try {
+    const parsed = JSON.parse(value);
+    return Array.isArray(parsed) && parsed.length > 0;
+  } catch {
+    return false;
+  }
+}
+function sealedVersion(value) {
+  if (typeof value !== "string" || !isEncrypted(value)) return null;
+  return value.startsWith("enc:v2:") ? "v2" : "v3";
+}
+function mayNeedChunkEmbedding(raw, embeddingModel, filter) {
+  const role = raw.role;
+  if (role === "system") return false;
+  if (filter?.roles && !filter.roles.includes(role ?? "")) return false;
+  if (isNonEmbeddableOrigin(raw.origin, filter?.reembedDiscarded)) {
+    return false;
+  }
+  const model = raw.embedding_model;
+  if (typeof model === "string" && model !== embeddingModel) return true;
+  if (rawHasEmbedding(raw.chunks)) return false;
+  if (rawHasEmbedding(raw.vector) && !filter?.rechunkExisting) return false;
+  return true;
+}
 async function chunkAndEmbedAllMessages(ctx, options, filter) {
   const embeddingModel = options.model ?? DEFAULT_API_EMBEDDING_MODEL;
   const { chunkSize = DEFAULT_CHUNK_SIZE } = options;
@@ -18851,11 +18934,31 @@ async function chunkAndEmbedAllMessages(ctx, options, filter) {
   let considered = 0;
   let sealedRowsSeen = 0;
   let rowsSeen = 0;
+  const keptSealed = /* @__PURE__ */ new Map();
+  const candidatesStillSealed = /* @__PURE__ */ new Map();
+  const droppedSealed = /* @__PURE__ */ new Map();
+  const rawFilter = (raw) => {
+    rowsSeen++;
+    const keep = mayNeedChunkEmbedding(raw, embeddingModel, filter);
+    const version = sealedVersion(raw.content);
+    if (!version) return keep;
+    if (keep) {
+      keptSealed.set(version, (keptSealed.get(version) ?? 0) + 1);
+    } else {
+      const dropped = droppedSealed.get(version);
+      if (dropped) dropped.count++;
+      else droppedSealed.set(version, { count: 1, probeId: raw.id });
+    }
+    return keep;
+  };
   for (const conv of targetConversations) {
-    const messages = await getMessagesOp(ctx, conv.conversationId);
+    const messages = await getMessagesOp(ctx, conv.conversationId, { rawFilter });
     for (const message of messages) {
-      rowsSeen++;
-      if (isEncrypted(message.content)) sealedRowsSeen++;
+      const stillSealed = sealedVersion(message.content);
+      if (stillSealed) {
+        sealedRowsSeen++;
+        candidatesStillSealed.set(stillSealed, (candidatesStillSealed.get(stillSealed) ?? 0) + 1);
+      }
       const isStale = message.embeddingModel !== void 0 && message.embeddingModel !== null && message.embeddingModel !== embeddingModel;
       if (message.chunks && message.chunks.length > 0 && !isStale) continue;
       const hasVector = message.vector && message.vector.length > 0;
@@ -18868,6 +18971,7 @@ async function chunkAndEmbedAllMessages(ctx, options, filter) {
         stillEncrypted++;
         continue;
       }
+      if (isToolResultsRow(message)) continue;
       if (message.content.length < minLength) continue;
       if (shouldChunkMessage(message.content, chunkSize)) {
         longMessages.push({
@@ -18879,6 +18983,12 @@ async function chunkAndEmbedAllMessages(ctx, options, filter) {
       }
     }
   }
+  for (const [version, dropped] of droppedSealed) {
+    const keyOpenedACandidate = (keptSealed.get(version) ?? 0) > (candidatesStillSealed.get(version) ?? 0);
+    if (keyOpenedACandidate) continue;
+    const probe = await getMessageOp(ctx, dropped.probeId);
+    if (!probe || isEncrypted(probe.content)) sealedRowsSeen += dropped.count;
+  }
   if (stillEncrypted > 0 || sealedRowsSeen > 0) {
     getLogger().error(
       "memoryEngine: messages still encrypted (key unavailable?) \u2014 excluded from embedding",
@@ -26030,6 +26140,11 @@ function parseTopics(value) {
 }
 
 // src/lib/db/entities/operations.ts
+async function assertCanWrite(ctx) {
+  if (ctx.canWrite && !await ctx.canWrite()) {
+    throw new Error("Memory source is no longer eligible");
+  }
+}
 function entityToStored(e) {
   return {
     uniqueId: e.id,
@@ -26170,6 +26285,7 @@ async function linkMemoryEntitiesOp(ctx, memoryId, entityInputs, options) {
   let skipped = false;
   let entities = [];
   await ctx.database.write(async () => {
+    await assertCanWrite(ctx);
     const {
       entities: byName,
       operations: entityOps,
@@ -26245,6 +26361,7 @@ async function replaceMemoryEntities(ctx, memoryId, entityInputs, options) {
   let skipped = false;
   let entities = [];
   await ctx.database.write(async () => {
+    await assertCanWrite(ctx);
     const vaultRow = await findVaultRowInWrite(ctx, memoryId);
     if (options.guarded && autoLinkBlocked(vaultRow)) {
       skipped = true;
@@ -26305,6 +26422,7 @@ async function unlinkMemoryEntitiesOp(ctx, memoryIds) {
   const links = await ctx.memoryEntityCollection.query(import_watermelondb18.Q.where("memory_id", import_watermelondb18.Q.oneOf(Array.from(memoryIds)))).fetch();
   if (links.length === 0) return;
   await ctx.database.write(async () => {
+    await assertCanWrite(ctx);
     await ctx.database.batch(...links.map((l) => l.prepareDestroyPermanently()));
   });
 }
@@ -26313,6 +26431,7 @@ async function unlinkAllMemoryEntitiesForUserOp(ctx, userId) {
   const links = await ctx.memoryEntityCollection.query(import_watermelondb18.Q.where("user_id", userId)).fetch();
   if (links.length === 0) return;
   await ctx.database.write(async () => {
+    await assertCanWrite(ctx);
     await ctx.database.batch(...links.map((l) => l.prepareDestroyPermanently()));
   });
 }
@@ -26476,6 +26595,11 @@ function visibilityConditions(requested) {
 function isKinded(record) {
   return record.kind !== null && record.kind !== void 0;
 }
+async function assertCanWrite2(ctx) {
+  if (ctx.canWrite && !await ctx.canWrite()) {
+    throw new Error("Memory source is no longer eligible");
+  }
+}
 function assertValidKindLevel(kind, level) {
   const hasKind = kind !== null && kind !== void 0;
   if (hasKind && !MEMORY_KINDS.includes(kind)) {
@@ -26656,8 +26780,7 @@ async function createVaultMemoryOp(ctx, opts) {
     ctx.embeddedWalletSigner
   ) : opts.content;
   const created = await ctx.database.write(async () => {
-    if (ctx.canWrite && !await ctx.canWrite())
-      throw new Error("Memory source is no longer eligible");
+    await assertCanWrite2(ctx);
     return ctx.vaultMemoryCollection.create(
       (record) => populateNewVaultMemory(record, ctx, opts, encryptedContent, encryptedKindValue)
     );
@@ -26676,8 +26799,7 @@ async function createSupersedingMemoryOp(ctx, opts, targetId) {
   ) : opts.content;
   let createdRecord = null;
   await ctx.database.write(async () => {
-    if (ctx.canWrite && !await ctx.canWrite())
-      throw new Error("Memory source is no longer eligible");
+    await assertCanWrite2(ctx);
     let target;
     try {
       target = await ctx.vaultMemoryCollection.find(targetId);
@@ -26769,8 +26891,7 @@ async function createVaultMemoriesBatchOp(ctx, optionsArray) {
     })
   );
   const created = await ctx.database.write(async () => {
-    if (ctx.canWrite && !await ctx.canWrite())
-      throw new Error("Memory source is no longer eligible");
+    await assertCanWrite2(ctx);
     const prepared = optionsArray.map(
       (opts, i) => ctx.vaultMemoryCollection.prepareCreate(
         (record) => populateNewVaultMemory(record, ctx, opts, encryptedContents[i], encryptedKindValues[i])
@@ -27061,8 +27182,7 @@ async function updateVaultMemoryOp(ctx, id, opts) {
     const record = probe;
     const originalUpdatedAt = record.updatedAt.getTime();
     await ctx.database.write(async () => {
-      if (ctx.canWrite && !await ctx.canWrite())
-        throw new Error("Memory source is no longer eligible");
+      await assertCanWrite2(ctx);
       if (record.isDeleted || record.supersededBy || !isOwnedByCtxUser(ctx, record) || opts.freeFormOnly && isKinded(record)) {
         stale = true;
         return;
@@ -27173,6 +27293,7 @@ async function setMemoryEntitiesOp(ctx, memoryId, entities) {
   let stale = false;
   const originalUpdatedAt = record.updatedAt.getTime();
   await ctx.database.write(async (writer) => {
+    await assertCanWrite2(ctx);
     if (record.isDeleted || !isOwnedByCtxUser(ctx, record)) {
       stale = true;
       return;
@@ -27214,6 +27335,7 @@ async function clearMemoryTopicsOverrideOp(ctx, memoryId, options) {
   const originalUpdatedAt = record.updatedAt.getTime();
   let cleared = false;
   await ctx.database.write(async () => {
+    await assertCanWrite2(ctx);
     if (options?.unlessTopicsRecorded && parseTopics(record.topics) !== null) return;
     cleared = true;
     await record.update((r) => {
@@ -27237,6 +27359,7 @@ async function setMemoryVisibilityOp(ctx, id, opts) {
   if (record.isDeleted || !isOwnedByCtxUser(ctx, record)) return null;
   let stale = false;
   await ctx.database.write(async () => {
+    await assertCanWrite2(ctx);
     if (record.isDeleted || !isOwnedByCtxUser(ctx, record)) {
       stale = true;
       return;
@@ -27265,6 +27388,7 @@ async function deleteVaultMemoryOp(ctx, id) {
     if (record.isDeleted || !isOwnedByCtxUser(ctx, record)) return false;
     let stale = false;
     await ctx.database.write(async () => {
+      await assertCanWrite2(ctx);
       if (record.isDeleted || !isOwnedByCtxUser(ctx, record)) {
         stale = true;
         return;
@@ -27302,8 +27426,7 @@ async function supersedeVaultMemoryOp(ctx, id, supersededById) {
     }
     let stale = false;
     await ctx.database.write(async () => {
-      if (ctx.canWrite && !await ctx.canWrite())
-        throw new Error("Memory source is no longer eligible");
+      await assertCanWrite2(ctx);
       if (record.isDeleted || record.supersededBy || !isOwnedByCtxUser(ctx, record)) {
         stale = true;
         return;
@@ -27465,6 +27588,7 @@ async function stampTopicsExtractedAtOp(ctx, memoryIds, extractedAt, version = T
   for (let i = 0; i < uniqueIds.length; i += CHUNK) {
     const chunkIds = uniqueIds.slice(i, i + CHUNK);
     await ctx.database.write(async () => {
+      await assertCanWrite2(ctx);
       const records = [];
       for (const id of chunkIds) {
         try {
@@ -27498,6 +27622,7 @@ async function relinkMemoryTopicsOp(ctx, memoryIds) {
   for (const id of Array.from(new Set(memoryIds))) {
     try {
       await ctx.database.write(async (writer) => {
+        await assertCanWrite2(ctx);
         let record;
         try {
           record = await ctx.vaultMemoryCollection.find(id);
@@ -27528,6 +27653,7 @@ async function backfillMemoryTopicsOp(ctx, memoryIds) {
   for (let i = 0; i < uniqueIds.length; i += CHUNK) {
     const chunkIds = uniqueIds.slice(i, i + CHUNK);
     await ctx.database.write(async () => {
+      await assertCanWrite2(ctx);
       const writes = [];
       for (const id of chunkIds) {
         let record;
@@ -27560,6 +27686,7 @@ async function deleteAllVaultMemoriesForUserOp(ctx, userId) {
   const records = await ctx.vaultMemoryCollection.query(import_watermelondb19.Q.where("user_id", userId), import_watermelondb19.Q.where("is_deleted", false)).fetch();
   if (records.length === 0) return 0;
   await ctx.database.write(async () => {
+    await assertCanWrite2(ctx);
     const prepared = records.map(
       (record) => record.prepareUpdate((r) => {
         r._setRaw("is_deleted", true);
@@ -27614,6 +27741,7 @@ async function archiveVaultMemoryOp(ctx, id, opts) {
     let stale = false;
     const archivedAtValue = opts?.now ?? Date.now();
     await ctx.database.write(async () => {
+      await assertCanWrite2(ctx);
       if (record.isDeleted || !isOwnedByCtxUser(ctx, record) || record.archivedAt !== null) {
         stale = true;
         return;
@@ -27637,6 +27765,7 @@ async function restoreVaultMemoryOp(ctx, id) {
     if (record.isDeleted || !isOwnedByCtxUser(ctx, record)) return false;
     let stale = false;
     await ctx.database.write(async () => {
+      await assertCanWrite2(ctx);
       if (record.isDeleted || !isOwnedByCtxUser(ctx, record)) {
         stale = true;
         return;
@@ -27657,6 +27786,7 @@ async function hardDeleteDecayedOp(ctx, id, opts) {
     const now = opts.now ?? Date.now();
     let stale = false;
     await ctx.database.write(async () => {
+      await assertCanWrite2(ctx);
       const archivedAt = record.archivedAt;
       if (record.isDeleted || !isOwnedByCtxUser(ctx, record) || archivedAt === null || now - archivedAt <= opts.hardDeleteWindowMs) {
         stale = true;
@@ -27696,6 +27826,7 @@ async function updateVaultMemoryEmbeddingOp(ctx, id, embedding, embeddingModel,
     }
     let written = false;
     await ctx.database.write(async () => {
+      await assertCanWrite2(ctx);
       if (record.isDeleted || !isOwnedByCtxUser(ctx, record)) return;
       const originalUpdatedAt = record.updatedAt.getTime();
       if (originalUpdatedAt !== readUpdatedAt || record._getRaw("content") !== readStoredContent)
@@ -31367,6 +31498,13 @@ function restoreCandidates(candidates, redactor, ownNames) {
   ).map((c) => c.candidate);
 }
 async function extractAndRetain(messages, retainCtx, options) {
+  const { memoryStore, signal } = options;
+  if (memoryStore === null) throw new Error("Memory store is not ready");
+  if (memoryStore && options.folderId !== void 0 && options.folderId !== null)
+    throw new Error("Remote memory extraction does not support folders");
+  if (memoryStore && options.extract.piiRedaction && !memoryStore.masksEmbeddingInput)
+    throw new Error("PII-redacted extraction requires a memory store that masks embedding inputs");
+  signal?.throwIfAborted();
   const minConfidence = options.minConfidence ?? DEFAULT_MIN_CONFIDENCE;
   const resolvedConsolidatePii = options.consolidateOptions?.piiRedaction ?? options.extract.piiRedaction;
   const consolidateOptions = options.consolidateOptions !== void 0 ? {
@@ -31400,6 +31538,7 @@ async function extractAndRetain(messages, retainCtx, options) {
     }
   });
   const extractMs = Date.now() - tExtract;
+  signal?.throwIfAborted();
   const filtered = candidates.filter((c) => c.confidence >= minConfidence);
   const log = getLogger();
   const screened = screenCandidatesForInjection(filtered);
@@ -31447,16 +31586,33 @@ async function extractAndRetain(messages, retainCtx, options) {
   const results = [];
   const quarantinedInfo = [];
   let failedWrites = 0;
+  let auditRows;
   const tRetain = Date.now();
   for (const { candidate, isQuarantined, reason, signature } of toRetain) {
     try {
+      signal?.throwIfAborted();
       if (isQuarantined) {
-        const existingId = await findQuarantinedDuplicateOp(
-          retainCtx.vaultCtx,
-          candidate.content,
-          candidate.sourceMessageIds,
-          { scope: options.scope ?? "private", folderId: options.folderId ?? null }
-        ).catch(() => null);
+        let existingId;
+        if (memoryStore) {
+          auditRows ?? (auditRows = memoryStore.list({
+            scopes: [options.scope ?? "private"],
+            includeArchived: true,
+            includeQuarantined: true,
+            includeSuperseded: true
+          }));
+          const sourceKey = [...new Set(candidate.sourceMessageIds)].sort().join("\0");
+          const normalize = (value) => value.normalize("NFKC").trim().replace(/\s+/g, " ").toLowerCase();
+          existingId = (await auditRows).find(
+            (row) => row.trustTier === "quarantined" && row.scope === (options.scope ?? "private") && [...new Set(row.sourceChunkIds ?? [])].sort().join("\0") === sourceKey && normalize(row.content) === normalize(candidate.content)
+          )?.uniqueId ?? null;
+        } else {
+          existingId = await findQuarantinedDuplicateOp(
+            retainCtx.vaultCtx,
+            candidate.content,
+            candidate.sourceMessageIds,
+            { scope: options.scope ?? "private", folderId: options.folderId ?? null }
+          ).catch(() => null);
+        }
         if (existingId) {
           quarantinedInfo.push({
             candidate,
@@ -31467,18 +31623,26 @@ async function extractAndRetain(messages, retainCtx, options) {
           continue;
         }
       }
-      const result = await retain(candidate.content, retainCtx, {
+      const retainOptions = {
         source: "auto-extracted",
         sourceChunkIds: candidate.sourceMessageIds,
         respectTombstones: true,
         ...options.scope !== void 0 && { scope: options.scope },
-        ...options.folderId !== void 0 && { folderId: options.folderId },
         ...consolidateOptions !== void 0 && { consolidateOptions },
         ...candidate.eventTime !== null && { eventTime: candidate.eventTime },
         factType: candidate.type,
         ...isQuarantined && { trustTier: "quarantined", enableAutoMerge: false }
+      };
+      const result = memoryStore ? await memoryStore.retain(candidate.content, {
+        ...retainOptions,
+        canWrite: retainCtx.vaultCtx.canWrite,
+        signal
+      }) : await retain(candidate.content, retainCtx, {
+        ...retainOptions,
+        ...options.folderId !== void 0 && { folderId: options.folderId }
       });
       if (isQuarantined) {
+        auditRows = void 0;
         const info = {
           candidate,
           memoryId: result.memoryId,
@@ -31497,9 +31661,16 @@ async function extractAndRetain(messages, retainCtx, options) {
       }
       succeededCandidates.push(candidate);
       results.push(result);
-      if (result.action !== "suppressed" && options.entityCtx && candidate.entities.length > 0) {
+      if (result.action !== "suppressed" && candidate.entities.length > 0) {
         try {
-          if (!await isMemoryTopicsUserManaged(options.entityCtx, result.memoryId)) {
+          signal?.throwIfAborted();
+          if (memoryStore) {
+            await memoryStore.addTopics(result.memoryId, candidate.entities, {
+              unlessUserManaged: true,
+              canWrite: retainCtx.vaultCtx.canWrite,
+              signal
+            });
+          } else if (options.entityCtx && !await isMemoryTopicsUserManaged(options.entityCtx, result.memoryId)) {
             await linkMemoryEntitiesOp(options.entityCtx, result.memoryId, candidate.entities, {
               unlessTopicsUserManaged: true
             });
@@ -31747,7 +31918,7 @@ function createAutoExtractor(options) {
   };
   const consolidateOptions = options.consolidate ? { ...options.consolidate, ...subPassAuth(options.consolidate.baseUrl) } : void 0;
   const injectionClassifierOptions = options.injectionClassifier ? { ...options.injectionClassifier, ...subPassAuth(options.injectionClassifier.baseUrl) } : void 0;
-  if (options.retainCtx.vaultCtx.entityCtx && !options.entityCtx) {
+  if (!options.memoryStore && options.retainCtx.vaultCtx.entityCtx && !options.entityCtx) {
     getLogger().warn(
       "[memory/extract] retainCtx.vaultCtx.entityCtx is set but extractor was created without `entityCtx` \u2014 W5 graph lane will receive no writes"
     );
@@ -31792,6 +31963,8 @@ function createAutoExtractor(options) {
       try {
         const { candidates, results, failedCount, outcome, failure, funnel, timings, model } = await extractAndRetain(window2, retainCtx, {
           extract,
+          memoryStore: options.memoryStore,
+          signal: options.signal,
           ...options.minConfidence !== void 0 && { minConfidence: options.minConfidence },
           ...options.entityCtx !== void 0 && { entityCtx: options.entityCtx },
           ...options.scope !== void 0 && { scope: options.scope },
@@ -32444,7 +32617,7 @@ var MaskScopedEmbeddingCache = class extends Map {
     return this;
   }
 };
-var scopedViews = /* @__PURE__ */ new WeakMap();
+var { scopedViews } = getEmbeddingCacheState();
 function maskScopedEmbeddingCache(cache, masked) {
   const views = scopedViews.get(cache) ?? {};
   scopedViews.set(cache, views);
@@ -32866,44 +33039,48 @@ async function recall(query, ctx, options = {}) {
       embeddingOptions,
       ctx.vaultCache,
       searchOptions
-    )))(query, {
-      limit: types.includes("chunk") ? Math.max(limit * 2, 16) : limit,
-      minSimilarity: vaultMinScore,
-      useFusion: true,
-      rerank: flags.rerank,
-      ...options.rerankTopN !== void 0 && { rerankTopN: options.rerankTopN },
-      ...options.ceWeight !== void 0 && { ceWeight: options.ceWeight },
-      ...options.rerankLoadTimeoutMs !== void 0 && {
-        rerankLoadTimeoutMs: options.rerankLoadTimeoutMs
-      },
-      ...options.recencyAlpha !== void 0 && { recencyAlpha: options.recencyAlpha },
-      ...options.recency && { recency: options.recency },
-      ...options.mmr !== void 0 && { mmr: options.mmr },
-      ...options.supersessionBoost !== void 0 && {
-        supersessionBoost: options.supersessionBoost
-      },
-      ...options.supersessionWindow !== void 0 && {
-        supersessionWindow: options.supersessionWindow
-      },
-      ...options.proofCountAlpha !== void 0 && {
-        proofCountAlpha: options.proofCountAlpha
-      },
-      ...options.bm25AdmissionDivisor !== void 0 && {
-        bm25AdmissionDivisor: options.bm25AdmissionDivisor
+    )))(
+      query,
+      {
+        limit: types.includes("chunk") ? Math.max(limit * 2, 16) : limit,
+        minSimilarity: vaultMinScore,
+        useFusion: true,
+        rerank: flags.rerank,
+        ...options.rerankTopN !== void 0 && { rerankTopN: options.rerankTopN },
+        ...options.ceWeight !== void 0 && { ceWeight: options.ceWeight },
+        ...options.rerankLoadTimeoutMs !== void 0 && {
+          rerankLoadTimeoutMs: options.rerankLoadTimeoutMs
+        },
+        ...options.recencyAlpha !== void 0 && { recencyAlpha: options.recencyAlpha },
+        ...options.recency && { recency: options.recency },
+        ...options.mmr !== void 0 && { mmr: options.mmr },
+        ...options.supersessionBoost !== void 0 && {
+          supersessionBoost: options.supersessionBoost
+        },
+        ...options.supersessionWindow !== void 0 && {
+          supersessionWindow: options.supersessionWindow
+        },
+        ...options.proofCountAlpha !== void 0 && {
+          proofCountAlpha: options.proofCountAlpha
+        },
+        ...options.bm25AdmissionDivisor !== void 0 && {
+          bm25AdmissionDivisor: options.bm25AdmissionDivisor
+        },
+        ...options.rrfK !== void 0 && { rrfK: options.rrfK },
+        ...options.decryptLast !== void 0 && { decryptLast: options.decryptLast },
+        ...subQueries && { subQueries },
+        ...options.scopes && { scopes: options.scopes },
+        ...options.folderId !== void 0 && { folderId: options.folderId },
+        ...options.factTypes?.length && { factTypes: options.factTypes },
+        ...options.memoryIds !== void 0 && { memoryIds: options.memoryIds },
+        ...options.factTypeWeights && { factTypeWeights: options.factTypeWeights },
+        ...entityRanking.length > 0 && { entityRanking },
+        ...temporalRanking.length > 0 && { temporalRanking },
+        ...needsChunkEmbedding && { queryEmbedding: queryEmbedding ?? [] },
+        queryEmbedTotalTimeoutMs
       },
-      ...options.rrfK !== void 0 && { rrfK: options.rrfK },
-      ...options.decryptLast !== void 0 && { decryptLast: options.decryptLast },
-      ...subQueries && { subQueries },
-      ...options.scopes && { scopes: options.scopes },
-      ...options.folderId !== void 0 && { folderId: options.folderId },
-      ...options.factTypes?.length && { factTypes: options.factTypes },
-      ...options.memoryIds !== void 0 && { memoryIds: options.memoryIds },
-      ...options.factTypeWeights && { factTypeWeights: options.factTypeWeights },
-      ...entityRanking.length > 0 && { entityRanking },
-      ...temporalRanking.length > 0 && { temporalRanking },
-      ...needsChunkEmbedding && { queryEmbedding: queryEmbedding ?? [] },
-      queryEmbedTotalTimeoutMs
-    });
+      options.embeddingCache
+    );
     factResults.push(
       ...dedupeBy(
         results,
@@ -33900,6 +34077,7 @@ function createLocalMemoryStore(options) {
     database,
     entityCollection: database.get("entity"),
     memoryEntityCollection: database.get("memory_entity"),
+    canWrite: options.canWrite,
     ...userId !== void 0 && { userId },
     ...options.allowUnscopedRows !== void 0 && {
       allowUnscopedRows: options.allowUnscopedRows
@@ -33911,10 +34089,21 @@ function createLocalMemoryStore(options) {
     walletAddress: options.walletAddress,
     signMessage: options.signMessage,
     embeddedWalletSigner: options.embeddedWalletSigner,
+    canWrite: options.canWrite,
     ...userId !== void 0 && { userId },
     ...options.singleTenant !== void 0 && { singleTenant: options.singleTenant },
     entityCtx
   };
+  const assertWrite = async (writeOptions) => {
+    writeOptions?.signal?.throwIfAborted();
+    if (writeOptions?.canWrite && !await writeOptions.canWrite()) {
+      throw new Error("Memory source is no longer eligible");
+    }
+    if (options.canWrite && !await options.canWrite()) {
+      throw new Error("Memory source is no longer eligible");
+    }
+    writeOptions?.signal?.throwIfAborted();
+  };
   const vaultCache = options.vaultCache ?? createVaultEmbeddingCache();
   const ownedBy = userId !== void 0 ? [import_watermelondb24.Q.where("user_id", userId)] : [];
   const linksOwnedBy = userId === void 0 ? [] : options.allowUnscopedRows ? [import_watermelondb24.Q.or(import_watermelondb24.Q.where("user_id", userId), import_watermelondb24.Q.where("user_id", null))] : [import_watermelondb24.Q.where("user_id", userId)];
@@ -34026,9 +34215,25 @@ function createLocalMemoryStore(options) {
     archive: (id) => archiveVaultMemoryOp(vaultCtx, id),
     restore: (id) => restoreVaultMemoryOp(vaultCtx, id),
     setTopics: (memoryId, topics) => setMemoryEntitiesOp(vaultCtx, memoryId, topics),
-    addTopics: (memoryId, topics) => database.write(async (writer) => {
+    addTopics: (memoryId, topics, writeOptions) => database.write(async (writer) => {
+      await assertWrite(writeOptions);
       const owned = await vaultCtx.vaultMemoryCollection.query(import_watermelondb24.Q.where("id", memoryId), import_watermelondb24.Q.where("is_deleted", false), ...ownedBy).fetchCount();
-      return owned > 0 ? writer.callWriter(() => linkMemoryEntitiesOp(entityCtx, memoryId, topics)) : [];
+      return owned > 0 ? writer.callWriter(
+        () => linkMemoryEntitiesOp(
+          {
+            ...entityCtx,
+            canWrite: async () => {
+              await assertWrite(writeOptions);
+              return true;
+            }
+          },
+          memoryId,
+          topics,
+          {
+            unlessTopicsUserManaged: writeOptions?.unlessUserManaged
+          }
+        )
+      ) : [];
     }),
     setVisibility: (id, visibility, visibilityOptions) => setMemoryVisibilityOp(vaultCtx, id, { visibility, ...visibilityOptions }),
     recall: (query, recallOptions) => recall(
@@ -34038,14 +34243,33 @@ function createLocalMemoryStore(options) {
     ),
     retain: (content, retainOptions) => retain(
       content,
-      { vaultCtx, embeddingOptions: options.embeddingOptions, vaultCache },
+      {
+        vaultCtx: {
+          ...vaultCtx,
+          canWrite: async () => {
+            await assertWrite(retainOptions);
+            return true;
+          }
+        },
+        embeddingOptions: options.embeddingOptions,
+        vaultCache
+      },
       retainOptions
     ),
     factSource: {
-      search: (query, searchOptions) => searchVaultMemoriesWithSize(
+      search: (query, searchOptions, embeddingCache) => searchVaultMemoriesWithSize(
         query,
         vaultCtx,
-        { ...options.embeddingOptions, taskType: "memory_recall_embed" },
+        {
+          ...options.embeddingOptions,
+          taskType: "memory_recall_embed",
+          ...embeddingCache && !options.embeddingOptions.cache && {
+            cache: maskScopedEmbeddingCache(
+              embeddingCache,
+              Boolean(options.embeddingOptions.maskInput)
+            )
+          }
+        },
         vaultCache,
         searchOptions
       ),
@@ -34879,6 +35103,7 @@ function createDurableAutoExtractor(options) {
   };
   const folderId = options.folderId ?? null;
   let disposed = false;
+  let activeBatch = null;
   let running = false;
   let wakeRequested = false;
   let timer;
@@ -34915,14 +35140,18 @@ function createDurableAutoExtractor(options) {
     }, delay);
   }
   async function extractBatch(messages, conversationId, ids, jobScope, jobFolderId) {
+    if (disposed) throw new Error("Extraction session was disposed");
     let watchdog;
     let cancelled = false;
+    const controller = new AbortController();
+    activeBatch = controller;
     const model = options.modelForScope?.(jobScope) ?? options.extract.model;
     try {
       return await Promise.race([
         new Promise((resolve, reject) => {
           const worker = createAutoExtractor({
             ...options,
+            signal: controller.signal,
             retainCtx: {
               ...options.retainCtx,
               vaultCtx: {
@@ -34951,6 +35180,8 @@ function createDurableAutoExtractor(options) {
       ]);
     } finally {
       cancelled = true;
+      controller.abort();
+      if (activeBatch === controller) activeBatch = null;
       if (watchdog !== void 0) clearTimeout(watchdog);
     }
   }
@@ -34962,6 +35193,7 @@ function createDurableAutoExtractor(options) {
     for (const message of loaded)
       if (message && message.messageId > 0) sequences.set(message.uniqueId, message.messageId);
     await database.write(async () => {
+      if (disposed) return;
       const current = idsOf(job);
       const acknowledged = ids.filter((id) => current.includes(id));
       if (!acknowledged.length) return;
@@ -35134,6 +35366,7 @@ function createDurableAutoExtractor(options) {
               jobScope,
               jobFolderId
             );
+            if (disposed) throw new Error("Extraction session was disposed");
             options.onTurnComplete?.(result);
             return result;
           };
@@ -35170,6 +35403,7 @@ function createDurableAutoExtractor(options) {
           );
           scheduleAfterSuccess = true;
         } catch (error) {
+          if (disposed) break;
           attempts.set(job.id, attempted + 1);
           retry = true;
           reportError(error, conversationId);
@@ -35192,6 +35426,14 @@ function createDurableAutoExtractor(options) {
         schedule(retry ? options.retryDelayMs ?? 3e4 : 0);
     }
   }
+  function dispose() {
+    disposed = true;
+    activeBatch?.abort(options.signal?.reason);
+    if (timer !== void 0) clearTimeout(timer);
+    options.signal?.removeEventListener("abort", dispose);
+  }
+  if (options.signal?.aborted) dispose();
+  else options.signal?.addEventListener("abort", dispose, { once: true });
   schedule(0);
   return {
     processTurn(messages, conversationId) {
@@ -35271,10 +35513,7 @@ function createDurableAutoExtractor(options) {
       return true;
     },
     isProcessing: () => running,
-    dispose() {
-      disposed = true;
-      if (timer !== void 0) clearTimeout(timer);
-    }
+    dispose
   };
 }