@remnic/core 9.23.4 → 9.25.0

package/dist/{types-Bbs0qz6b.d.ts → types-DHBxIF0s.d.ts}

@@ -1,5 +1,6 @@
 import { LcmMessagePartInput, MessagePartSourceFormat } from './message-parts/index.js';
 import { BoundedJsonlStateConfig } from './bounded-jsonl-state.js';
+import { OperatorDoctorCheck } from './operator-doctor-types.js';
 import './types-continuity.js';
 
 interface BulkImportSource {
@@ -945,6 +946,182 @@ interface WearableSourceStatus {
     transcriptDays: number;
 }
 
+interface ExtractionLivenessConfig {
+    /** Master gate. When false, liveness is never reported degraded. Default true. */
+    enabled: boolean;
+    /**
+     * How stale the last-successful-extraction watermark may get (ms) before a
+     * non-empty buffer flags the pipeline degraded. Default 24h.
+     */
+    staleWindowMs: number;
+}
+/**
+ * A read-only snapshot of buffered, not-yet-extracted work. Structurally
+ * satisfied by `SmartBuffer.getBufferSnapshot()` so callers can pass the live
+ * buffer without this module depending on the buffer implementation.
+ */
+interface ExtractionBufferSnapshot {
+    bufferedSessionCount: number;
+    pendingTurnCount: number;
+    oldestTurnTimestamp: string | null;
+    /**
+     * Set by the liveness reader (never by `SmartBuffer`) when the buffer exists
+     * but its snapshot read threw. An unreadable buffer is a pipeline fault, not
+     * an empty queue (§22): it degrades the pipeline with a distinct reason
+     * instead of masquerading as a zero-backlog (healthy) snapshot.
+     */
+    readFailed?: boolean;
+    /** Read-failure detail, surfaced in the degraded reason when `readFailed`. */
+    readError?: string;
+}
+interface ExtractionBufferSource {
+    getBufferSnapshot(): Promise<ExtractionBufferSnapshot>;
+}
+/**
+ * The liveness payload surfaced on `/health.extraction` and in the doctor/stats
+ * details.
+ *
+ * DAEMON-SCOPED SIGNAL: a daemon exposes a single extraction verdict; the
+ * last-extraction watermark is read from the daemon's default/root store, so
+ * `/health` returns the same `extraction` block for every namespace argument.
+ *
+ * KNOWN LIMITATION (issue #2159): extraction stamps `lastExtractionAt` on the
+ * PER-NAMESPACE store (`storageFor(selfNamespace)`), so this watermark reflects
+ * only extraction that stamped the root store (default-namespace work). On a
+ * single-namespace deployment (the common case) the watermark and buffer share
+ * one scope and the verdict is exact. On a multi-namespace deployment the verdict
+ * is NOT guaranteed correct for work isolated to a non-default namespace: it can
+ * over-report `degraded` (the default namespace idle while another is extracting)
+ * or miss a stall confined to a non-default namespace. Aggregating the watermark
+ * across namespace stores is tracked in #2159.
+ */
+interface ExtractionLivenessStatus {
+    lastExtractionAt: string | null;
+    bufferedSessionCount: number;
+    pendingTurnCount: number;
+    oldestBufferedTurnAgeMs: number | null;
+    degraded: boolean;
+    degradedReason: string | null;
+    /**
+     * Scope of the last-extraction watermark: `root-store` today (read from the
+     * daemon's default/root store only), `aggregate` once it is resolved across
+     * every namespace store (#2159). A monitor can alert on
+     * `watermarkScope !== "aggregate"` while namespaces are enabled instead of
+     * trusting a number that may be wrong in either direction.
+     */
+    watermarkScope: "root-store" | "aggregate";
+}
+interface ExtractionLivenessStorageLike {
+    loadMeta(): Promise<Pick<MetaState, "lastExtractionAt">>;
+}
+interface ExtractionLivenessOrchestratorLike {
+    config: Pick<PluginConfig, "extractionLiveness">;
+    buffer?: ExtractionBufferSource;
+}
+/**
+ * Parse the `extractionLiveness` config block. Follows the nested-block shape
+ * validation used elsewhere in `config.ts` and coerces string booleans (§24:
+ * CLI/JSON deliver `"false"`/`"0"` as strings, which must read as falsy).
+ */
+declare function parseExtractionLivenessConfig(cfg: Record<string, unknown>): ExtractionLivenessConfig;
+/** Compact human-readable duration ("3d", "5h", "12m", "45s") for logs and CLI output. */
+declare function formatAgeMs(ms: number): string;
+/**
+ * Pure liveness verdict. Degraded when the feature is enabled AND any of: the
+ * last-extraction watermark could not be READ (a storage fault, §22), the buffer
+ * read failed (a pipeline fault, §22), or the buffer is non-empty and the
+ * watermark is absent or stale. Each cause yields a DISTINCT reason so an
+ * operator can tell a meta-read failure from a buffer-read failure from a
+ * pipeline that has genuinely never extracted.
+ *
+ * Staleness uses a half-open freshness window (§23): an extraction is fresh
+ * while its age is in `[0, staleWindowMs)`, so an age of EXACTLY `staleWindowMs`
+ * is stale (the upper bound on "fresh" is exclusive). A null/unparsable watermark
+ * means "never succeeded" and is treated as stale — as is a FUTURE watermark (a
+ * clock-skewed or corrupt timestamp ahead of now must not read as a fresh
+ * extraction and hide a real backlog stall).
+ */
+declare function evaluateExtractionLiveness(input: {
+    config: ExtractionLivenessConfig;
+    lastExtractionAt: string | null;
+    snapshot: ExtractionBufferSnapshot;
+    nowMs: number;
+    metaReadFailed?: boolean;
+    metaReadError?: string;
+    watermarkScope?: "root-store" | "aggregate";
+}): ExtractionLivenessStatus;
+/**
+ * Gather the liveness status from a meta store (last-extraction watermark) and
+ * an optional buffer (backlog). A read failure on EITHER side is captured and
+ * surfaced as a DEGRADED status with a distinct reason (§22) rather than being
+ * swallowed into a healthy-looking verdict; no failure path throws.
+ */
+declare function gatherExtractionLivenessStatus(input: {
+    config: ExtractionLivenessConfig;
+    storage: ExtractionLivenessStorageLike;
+    buffer: ExtractionBufferSource | undefined;
+    nowMs: number;
+}): Promise<ExtractionLivenessStatus>;
+/**
+ * Aggregated-WARN throttle (issue #2151): emit at most ONE warning per
+ * staleness window while degraded — not one line per failed extraction attempt.
+ * State is instance-scoped (held by the owning service), never a module global
+ * (§5), so multiple service instances throttle independently.
+ */
+declare class ExtractionLivenessWarnThrottle {
+    private lastWarnAtMs;
+    /** Warn if degraded and outside the throttle window; returns whether a WARN was emitted. */
+    maybeWarn(status: ExtractionLivenessStatus, staleWindowMs: number, nowMs: number): boolean;
+}
+/**
+ * Normalize the `extractionLiveness` block at the read boundary. `parseConfig`
+ * always populates it, but a host adapter, an older persisted config, or a
+ * hand-built `PluginConfig` can hand us an absent, partial, or loosely-typed
+ * block - and every liveness surface (/health, doctor, stats) must degrade to
+ * the documented default (enabled, 24h window) rather than throw. Both fields
+ * are coerced with the same rules as `parseExtractionLivenessConfig` (§24:
+ * `"false"`/`"0"` read as falsy; a numeric string like `"5000"` parses), except a
+ * present but non-integer or non-positive `staleWindowMs` falls back to the
+ * default here rather than throwing.
+ */
+declare function resolveExtractionLivenessConfig(block: {
+    enabled?: unknown;
+    staleWindowMs?: unknown;
+} | undefined): ExtractionLivenessConfig;
+/**
+ * Compute the liveness status for the authenticated `/health` payload and emit
+ * the throttled aggregated WARN.
+ *
+ * The watermark is read from the daemon's default/root store (`orchestrator.storage`),
+ * which is why `/health` returns the same `extraction` block for any namespace
+ * argument. KNOWN LIMITATION (issue #2159): extraction writes `lastExtractionAt`
+ * per-namespace, so this watermark reflects only default-namespace extraction and
+ * the verdict is exact only for a single-namespace daemon (see
+ * `ExtractionLivenessStatus`).
+ */
+declare function computeExtractionLivenessStatus(orchestrator: ExtractionLivenessOrchestratorLike & {
+    storage: ExtractionLivenessStorageLike;
+}, throttle?: ExtractionLivenessWarnThrottle, nowMs?: number): Promise<ExtractionLivenessStatus>;
+/**
+ * `remnic doctor` check for extraction-pipeline liveness. Status `warn` when
+ * degraded (with a remediation hint), `ok` otherwise.
+ */
+declare function summarizeExtractionLiveness(config: Pick<PluginConfig, "extractionLiveness">, storage: ExtractionLivenessStorageLike, buffer?: ExtractionBufferSource, nowMs?: number): Promise<OperatorDoctorCheck>;
+/** Meta fields the `remnic stats` view renders directly, beyond the liveness watermark. */
+type ExtractionStatsMeta = Pick<MetaState, "extractionCount" | "lastExtractionAt" | "lastConsolidationAt">;
+/**
+ * Lines for `remnic stats`: extraction watermark, buffer backlog, and the
+ * liveness verdict so dashboards can alert on a stalled pipeline. The meta
+ * watermark is loaded HERE (not by the caller) so a meta-read failure surfaces
+ * as an explicit DEGRADED verdict plus "unavailable" counts (§22) instead of
+ * crashing the whole `stats` command.
+ */
+declare function renderExtractionLivenessStats(orchestrator: ExtractionLivenessOrchestratorLike & {
+    storage: {
+        loadMeta(): Promise<ExtractionStatsMeta>;
+    };
+}, nowMs?: number): Promise<string[]>;
+
 /**
  * dreams-ledger.ts — per-phase telemetry for the Dreams consolidation pipeline.
  *
@@ -2092,10 +2269,9 @@ interface PluginConfig extends BoundedJsonlStateConfig {
      */
     dreamsPhases: DreamsPhasesConfig;
     procedural: ProceduralConfig;
-    /**
-     * Claim-level provenance spans (issue #1575). Parsed from the
-     * `provenance` config block; see `ProvenanceConfig` for the documented
-     * defaults. PR 1 parses + persists only; extraction wiring lands in PR 2.
+    extractionLiveness: ExtractionLivenessConfig;
+    /** Claim-level provenance spans (#1575); see `ProvenanceConfig` for defaults.
+     * PR 1 parses + persists only; extraction wiring lands in PR 2.
      */
     provenance: ProvenanceConfig;
     /**
@@ -4450,4 +4626,4 @@ interface HourlySummary {
     generatedAt: string;
 }
 
-export { type BehaviorSignalEvent as $, type ActiveRecallChatType as A, type BriefingSections as B, type CalendarSource as C, type DreamsPhase as D, type EntityFile as E, type FaithfulnessFrontmatter as F, type GatewayConfig as G, type HourlySummary as H, type IdentityInjectionMode as I, type ExtractionResult as J, type ConsolidationResult as K, type LiveConnectorsConfig as L, type MemoryFile as M, type DaySummaryResult as N, type ProvenanceSource as O, type PluginConfig as P, type QmdSearchResult as Q, type RecallPlanMode as R, type SessionObserverBandConfig as S, type TranscriptEntry as T, type TrustWeights as U, type ConversationThread as V, type LifecycleState as W, type VerificationState as X, type PolicyClass as Y, type ExtractionFailureClass as Z, type ImportanceLevel as _, type DreamsRunResult as a, type MeetingActivitySnapshot as a$, type BufferSurpriseEvent as a0, type ImportTurn as a1, type BulkImportOptions as a2, type BulkImportSource as a3, type BulkImportResult as a4, type SecretRef as a5, type AgentAccessAuthToken as a6, type CompressionGuidelineOptimizerEventCounts as a7, type CompressionGuidelineOptimizerActionSummary as a8, type CompressionGuidelineOptimizerRuleUpdate as a9, type FusedDayFile as aA, type MeetingRecord as aB, type MeetingDetectionSource as aC, type FusedMeeting as aD, type EntityTimelineEntry as aE, type MemoryLink as aF, type BufferState as aG, type MetaState as aH, type FileHygieneConfig as aI, type EntityRelationship as aJ, type EntityActivityEntry as aK, type AccessTrackingEntry as aL, type MemorySummary as aM, type WearableConversation as aN, type WearableSourceSettings as aO, type WearableNativeMemory as aP, type WearableMemoryMode as aQ, type WearableSourceConnector as aR, type WearablesConfig as aS, type WearableSyncSummary as aT, type WearableSourceStatus as aU, type WearableDayTranscript as aV, type WearableCorrectionRule as aW, type MeetingBuildInput as aX, type MeetingsConfig as aY, type MeetingsDetectionInput as aZ, type FusionConversationInput as a_, type MemoryActionType as aa, type MemoryActionEvent as ab, type CompressionGuidelineOptimizerState as ac, type EntityMention as ad, type EntitySchemaDefinition as ae, type EntitySchemaSectionDefinition as af, type EntityStructuredSection as ag, type ImportanceScore as ah, type MemoryIntent as ai, type MemoryActionEligibilityContext as aj, type MemoryActionPolicyResult as ak, type MemoryLifecycleEventType as al, type MemoryLifecycleStateSummary as am, type ModelProviderConfig as an, type NativeKnowledgeConfig as ao, type ProvenanceConfig as ap, type RetrievalTier as aq, type SignalScanResult as ar, type TopicScore as as, type QmdSearchExplain as at, type ActivitySnapshot as au, type ActivityConfig as av, type ActivitySourceConfig as aw, type ActivitySourceClient as ax, type FusedWearableConversation as ay, type FusedDayMeta as az, type RecallDisclosure as b, type BufferEntryState as b$, type DetectedMeeting as b0, type CodingContext as b1, type DreamsStatusResult as b2, type RecallSectionConfig as b3, type BootstrapOptions as b4, type BootstrapResult as b5, type ConsolidationObservation as b6, type CodingModeConfig as b7, type FusedSpeaker as b8, type FusedSegment as b9, type FusedSegmentProvenance as bA, type FusionSegmentInput as bB, type ImportSourceRole as bC, type ImportTurnValidationIssue as bD, type MeetingScreenContextEvent as bE, type MeetingSummaryMode as bF, type MemoryActionEligibilitySource as bG, type MemoryObservation as bH, type MemoryScope as bI, RECALL_DISCLOSURE_LEVELS as bJ, type SegmentPickReason as bK, type WearableAuthCheck as bL, type WearableFetchOptions as bM, type WearableFetchPage as bN, type WearableNativeMemoryPage as bO, type WearableTranscriptSegment as bP, isImportRole as bQ, isRecallDisclosure as bR, parseIsoTimestamp as bS, validateImportTurn as bT, type AgentAccessHttpConfig as bU, type AgentDefaultsConfig as bV, type AgentPersona as bW, type BehaviorLoopAdjustment as bX, type BehaviorSignalDirection as bY, type BehaviorSignalType as bZ, type BriefingCalendarSourceError as b_, type FusedDisagreement as ba, type FusionOptions as bb, type FusionDayResult as bc, type CodingKnowledgeConfig as bd, type WearableCleanupSettings as be, type WearableFusionConfig as bf, type WearableDayTranscriptMeta as bg, type ActivityDayMeta as bh, type ActivityDayDigest as bi, type ActivitySourceCheck as bj, type ActivitySnapshotPage as bk, type MeetingsDetectionConfig as bl, type MeetingAudioWindow as bm, type MeetingAppSpan as bn, type ActivityExtractionMode as bo, type BriefingConfig as bp, type BriefingOpenCommitment as bq, type BriefingWindow as br, type BulkImportError as bs, type BulkImportSourceAdapter as bt, type CodexCompatConfig as bu, DEFAULT_RECALL_DISCLOSURE as bv, type DisagreementKind as bw, type ExtractedFact as bx, type FusedContribution as by, type FusedConversationProvenance as bz, type ActiveRecallQueryMode as c, type SlotBehaviorConfig as c$, type CaptureMode as c0, type ChatConfig as c1, type CodexCliReasoningEffort as c2, type CodexCompactionFlushMode as c3, type CodexConnectorConfig as c4, type CodingGraphLspConfig as c5, type CompressionGuidelineActivationState as c6, type CompressionGuidelineOptimizerSourceWindow as c7, type ConfidenceTier as c8, type ConsolidationAction as c9, type MemoryActionPolicyDecision as cA, type MemoryActionStatus as cB, type MemoryLinkType as cC, type MemoryOsPresetName as cD, type ModelApi as cE, type ModelDefinitionConfig as cF, type ModelProviderAuthMode as cG, type NamespacePolicy as cH, type NativeKnowledgeFolderRuleConfig as cI, type NativeKnowledgeObsidianVaultConfig as cJ, type NativeKnowledgeOpenClawWorkspaceConfig as cK, type NotionLiveConnectorConfig as cL, type PrincipalFromSessionKeyMode as cM, type PrincipalRule as cN, type ProceduralConfig as cO, type QuestionEntry as cP, type ReasoningEffort as cQ, type RecallPipelineConfig as cR, type RecallTraceEvent as cS, type RelevanceFeedback as cT, SPECULATIVE_TTL_DAYS as cU, type ScopeProfileAutoPromoteConfig as cV, type ScopeProfileTeamProjectConfig as cW, type ScopeTeamConfig as cX, type ScoredEntity as cY, type SemanticChunkingConfigShape as cZ, type SignalLevel as c_, type ConsolidationItem as ca, type ContradictionScanConfig as cb, type CronConversationRecallMode as cc, type CronRecallMode as cd, type DreamingConfig as ce, type DreamingNarrativePromptStyle as cf, type DreamsDeepSleepConfig as cg, type DreamsLightSleepConfig as ch, type DreamsPhaseStatus as ci, type DreamsPhasesConfig as cj, type DreamsRemConfig as ck, type EngramTraceEvent as cl, type ExtractedProcedureStep as cm, type ExtractedQuestion as cn, type ExtractedReasoningTrace as co, type ExtractedReasoningTraceStep as cp, type ExtractedRelationship as cq, type ExtractionPassSource as cr, type GitHubLiveConnectorConfig as cs, type GmailLiveConnectorConfig as ct, type GoogleDriveLiveConnectorConfig as cu, type HeartbeatConfig as cv, type HeartbeatDetectionMode as cw, type LlmTraceCallback as cx, type LlmTraceEvent as cy, type MemoryActionOutcome as cz, type ActiveRecallPromptStyle as d, type SlotMismatchMode as d0, type TriggerMode as d1, confidenceTier as d2, type ActiveRecallThinking as e, type ActiveRecallModelFallbackPolicy as f, type RecallTierExplain as g, type BriefingFollowup as h, type BriefingFocus as i, type CalendarEvent as j, type BriefingActiveThread as k, type BriefingResult as l, type BriefingRecentEntity as m, type BufferTurn as n, type MemoryFrontmatter as o, type Checkpoint as p, type AgentPersonaModelConfig as q, type SourceConnectorProvenance as r, type ScopeProfileConfig as s, type ScopeProfileLayerId as t, type ScopeProfilePromotionTarget as u, type BehaviorLoopPolicyState as v, type MemoryCategory as w, type MemoryStatus as x, type MemoryProjectionCurrentState as y, type MemoryLifecycleEvent as z };
+export { type ActiveRecallThinking as $, type AgentPersonaModelConfig as A, type BriefingSections as B, type CalendarSource as C, type DreamsPhase as D, type EntityFile as E, type FaithfulnessFrontmatter as F, type GatewayConfig as G, type HourlySummary as H, type IdentityInjectionMode as I, type ProvenanceSource as J, type TrustWeights as K, type LiveConnectorsConfig as L, type MemoryFile as M, type ConversationThread as N, type LifecycleState as O, type PluginConfig as P, type QmdSearchResult as Q, type RecallPlanMode as R, type SessionObserverBandConfig as S, type TranscriptEntry as T, type PolicyClass as U, type VerificationState as V, type ExtractionFailureClass as W, type ImportanceLevel as X, type ActiveRecallChatType as Y, type ActiveRecallQueryMode as Z, type ActiveRecallPromptStyle as _, type DreamsRunResult as a, type MeetingBuildInput as a$, type ActiveRecallModelFallbackPolicy as a0, type BehaviorSignalEvent as a1, type BufferSurpriseEvent as a2, type ImportTurn as a3, type BulkImportOptions as a4, type BulkImportSource as a5, type BulkImportResult as a6, type SecretRef as a7, type AgentAccessAuthToken as a8, type CompressionGuidelineOptimizerEventCounts as a9, type ActivitySourceConfig as aA, type ActivitySourceClient as aB, type FusedWearableConversation as aC, type FusedDayMeta as aD, type FusedDayFile as aE, type MeetingRecord as aF, type MeetingDetectionSource as aG, type FusedMeeting as aH, type EntityTimelineEntry as aI, type MemoryLink as aJ, type BufferState as aK, type MetaState as aL, type FileHygieneConfig as aM, type EntityRelationship as aN, type EntityActivityEntry as aO, type AccessTrackingEntry as aP, type MemorySummary as aQ, type WearableConversation as aR, type WearableSourceSettings as aS, type WearableNativeMemory as aT, type WearableMemoryMode as aU, type WearableSourceConnector as aV, type WearablesConfig as aW, type WearableSyncSummary as aX, type WearableSourceStatus as aY, type WearableDayTranscript as aZ, type WearableCorrectionRule as a_, type CompressionGuidelineOptimizerActionSummary as aa, type CompressionGuidelineOptimizerRuleUpdate as ab, type MemoryActionType as ac, type MemoryActionEvent as ad, type CompressionGuidelineOptimizerState as ae, type EntityMention as af, type EntitySchemaDefinition as ag, type EntitySchemaSectionDefinition as ah, type EntityStructuredSection as ai, type ImportanceScore as aj, type MemoryIntent as ak, type MemoryActionEligibilityContext as al, type MemoryActionPolicyResult as am, type MemoryLifecycleEventType as an, type MemoryLifecycleStateSummary as ao, type ModelProviderConfig as ap, type NativeKnowledgeConfig as aq, type ExtractionBufferSource as ar, summarizeExtractionLiveness as as, type ProvenanceConfig as at, type RetrievalTier as au, type SignalScanResult as av, type TopicScore as aw, type QmdSearchExplain as ax, type ActivitySnapshot as ay, type ActivityConfig as az, type RecallDisclosure as b, evaluateExtractionLiveness as b$, type MeetingsConfig as b0, type MeetingsDetectionInput as b1, type FusionConversationInput as b2, type MeetingActivitySnapshot as b3, type DetectedMeeting as b4, type CodingContext as b5, type DreamsStatusResult as b6, type RecallSectionConfig as b7, type BootstrapOptions as b8, type BootstrapResult as b9, type DisagreementKind as bA, type ExtractedFact as bB, type FusedContribution as bC, type FusedConversationProvenance as bD, type FusedSegmentProvenance as bE, type FusionSegmentInput as bF, type ImportSourceRole as bG, type ImportTurnValidationIssue as bH, type MeetingScreenContextEvent as bI, type MeetingSummaryMode as bJ, type MemoryActionEligibilitySource as bK, type MemoryObservation as bL, type MemoryScope as bM, RECALL_DISCLOSURE_LEVELS as bN, type SegmentPickReason as bO, type WearableAuthCheck as bP, type WearableFetchOptions as bQ, type WearableFetchPage as bR, type WearableNativeMemoryPage as bS, type WearableTranscriptSegment as bT, isImportRole as bU, isRecallDisclosure as bV, parseIsoTimestamp as bW, validateImportTurn as bX, type ExtractionLivenessConfig as bY, ExtractionLivenessWarnThrottle as bZ, computeExtractionLivenessStatus as b_, type ConsolidationObservation as ba, type CodingModeConfig as bb, type FusedSpeaker as bc, type FusedSegment as bd, type FusedDisagreement as be, type FusionOptions as bf, type FusionDayResult as bg, type CodingKnowledgeConfig as bh, type WearableCleanupSettings as bi, type WearableFusionConfig as bj, type WearableDayTranscriptMeta as bk, type ActivityDayMeta as bl, type ActivityDayDigest as bm, type ActivitySourceCheck as bn, type ActivitySnapshotPage as bo, type MeetingsDetectionConfig as bp, type MeetingAudioWindow as bq, type MeetingAppSpan as br, type ActivityExtractionMode as bs, type BriefingConfig as bt, type BriefingOpenCommitment as bu, type BriefingWindow as bv, type BulkImportError as bw, type BulkImportSourceAdapter as bx, type CodexCompatConfig as by, DEFAULT_RECALL_DISCLOSURE as bz, type RecallTierExplain as c, type ProceduralConfig as c$, formatAgeMs as c0, gatherExtractionLivenessStatus as c1, parseExtractionLivenessConfig as c2, renderExtractionLivenessStats as c3, resolveExtractionLivenessConfig as c4, type AgentAccessHttpConfig as c5, type AgentDefaultsConfig as c6, type AgentPersona as c7, type BehaviorLoopAdjustment as c8, type BehaviorSignalDirection as c9, type ExtractedQuestion as cA, type ExtractedReasoningTrace as cB, type ExtractedReasoningTraceStep as cC, type ExtractedRelationship as cD, type ExtractionPassSource as cE, type GitHubLiveConnectorConfig as cF, type GmailLiveConnectorConfig as cG, type GoogleDriveLiveConnectorConfig as cH, type HeartbeatConfig as cI, type HeartbeatDetectionMode as cJ, type LlmTraceCallback as cK, type LlmTraceEvent as cL, type MemoryActionOutcome as cM, type MemoryActionPolicyDecision as cN, type MemoryActionStatus as cO, type MemoryLinkType as cP, type MemoryOsPresetName as cQ, type ModelApi as cR, type ModelDefinitionConfig as cS, type ModelProviderAuthMode as cT, type NamespacePolicy as cU, type NativeKnowledgeFolderRuleConfig as cV, type NativeKnowledgeObsidianVaultConfig as cW, type NativeKnowledgeOpenClawWorkspaceConfig as cX, type NotionLiveConnectorConfig as cY, type PrincipalFromSessionKeyMode as cZ, type PrincipalRule as c_, type BehaviorSignalType as ca, type BriefingCalendarSourceError as cb, type BufferEntryState as cc, type CaptureMode as cd, type ChatConfig as ce, type CodexCliReasoningEffort as cf, type CodexCompactionFlushMode as cg, type CodexConnectorConfig as ch, type CodingGraphLspConfig as ci, type CompressionGuidelineActivationState as cj, type CompressionGuidelineOptimizerSourceWindow as ck, type ConfidenceTier as cl, type ConsolidationAction as cm, type ConsolidationItem as cn, type ContradictionScanConfig as co, type CronConversationRecallMode as cp, type CronRecallMode as cq, type DreamingConfig as cr, type DreamingNarrativePromptStyle as cs, type DreamsDeepSleepConfig as ct, type DreamsLightSleepConfig as cu, type DreamsPhaseStatus as cv, type DreamsPhasesConfig as cw, type DreamsRemConfig as cx, type EngramTraceEvent as cy, type ExtractedProcedureStep as cz, type BriefingFollowup as d, type QuestionEntry as d0, type ReasoningEffort as d1, type RecallPipelineConfig as d2, type RecallTraceEvent as d3, type RelevanceFeedback as d4, SPECULATIVE_TTL_DAYS as d5, type ScopeProfileAutoPromoteConfig as d6, type ScopeProfileTeamProjectConfig as d7, type ScopeTeamConfig as d8, type ScoredEntity as d9, type SemanticChunkingConfigShape as da, type SignalLevel as db, type SlotBehaviorConfig as dc, type SlotMismatchMode as dd, type TriggerMode as de, confidenceTier as df, type BriefingFocus as e, type CalendarEvent as f, type BriefingActiveThread as g, type BriefingResult as h, type BriefingRecentEntity as i, type BufferTurn as j, type ExtractionBufferSnapshot as k, type MemoryFrontmatter as l, type Checkpoint as m, type SourceConnectorProvenance as n, type ScopeProfileConfig as o, type ScopeProfileLayerId as p, type ScopeProfilePromotionTarget as q, type BehaviorLoopPolicyState as r, type ExtractionLivenessStatus as s, type MemoryCategory as t, type MemoryStatus as u, type MemoryProjectionCurrentState as v, type MemoryLifecycleEvent as w, type ExtractionResult as x, type ConsolidationResult as y, type DaySummaryResult as z };

package/dist/types.d.ts

@@ -1,4 +1,5 @@
-export { aL as AccessTrackingEntry, A as ActiveRecallChatType, f as ActiveRecallModelFallbackPolicy, d as ActiveRecallPromptStyle, c as ActiveRecallQueryMode, e as ActiveRecallThinking, a6 as AgentAccessAuthToken, bU as AgentAccessHttpConfig, bV as AgentDefaultsConfig, bW as AgentPersona, q as AgentPersonaModelConfig, bX as BehaviorLoopAdjustment, v as BehaviorLoopPolicyState, bY as BehaviorSignalDirection, $ as BehaviorSignalEvent, bZ as BehaviorSignalType, b4 as BootstrapOptions, b5 as BootstrapResult, k as BriefingActiveThread, b_ as BriefingCalendarSourceError, bp as BriefingConfig, i as BriefingFocus, h as BriefingFollowup, bq as BriefingOpenCommitment, m as BriefingRecentEntity, l as BriefingResult, B as BriefingSections, br as BriefingWindow, b$ as BufferEntryState, aG as BufferState, a0 as BufferSurpriseEvent, n as BufferTurn, j as CalendarEvent, C as CalendarSource, c0 as CaptureMode, c1 as ChatConfig, p as Checkpoint, c2 as CodexCliReasoningEffort, c3 as CodexCompactionFlushMode, bu as CodexCompatConfig, c4 as CodexConnectorConfig, b1 as CodingContext, c5 as CodingGraphLspConfig, bd as CodingKnowledgeConfig, b7 as CodingModeConfig, c6 as CompressionGuidelineActivationState, a8 as CompressionGuidelineOptimizerActionSummary, a7 as CompressionGuidelineOptimizerEventCounts, a9 as CompressionGuidelineOptimizerRuleUpdate, c7 as CompressionGuidelineOptimizerSourceWindow, ac as CompressionGuidelineOptimizerState, c8 as ConfidenceTier, c9 as ConsolidationAction, ca as ConsolidationItem, b6 as ConsolidationObservation, K as ConsolidationResult, cb as ContradictionScanConfig, V as ConversationThread, cc as CronConversationRecallMode, cd as CronRecallMode, bv as DEFAULT_RECALL_DISCLOSURE, N as DaySummaryResult, ce as DreamingConfig, cf as DreamingNarrativePromptStyle, cg as DreamsDeepSleepConfig, ch as DreamsLightSleepConfig, D as DreamsPhase, ci as DreamsPhaseStatus, cj as DreamsPhasesConfig, ck as DreamsRemConfig, a as DreamsRunResult, b2 as DreamsStatusResult, cl as EngramTraceEvent, aK as EntityActivityEntry, E as EntityFile, ad as EntityMention, aJ as EntityRelationship, ae as EntitySchemaDefinition, af as EntitySchemaSectionDefinition, ag as EntityStructuredSection, aE as EntityTimelineEntry, bx as ExtractedFact, cm as ExtractedProcedureStep, cn as ExtractedQuestion, co as ExtractedReasoningTrace, cp as ExtractedReasoningTraceStep, cq as ExtractedRelationship, Z as ExtractionFailureClass, cr as ExtractionPassSource, J as ExtractionResult, F as FaithfulnessFrontmatter, aI as FileHygieneConfig, G as GatewayConfig, cs as GitHubLiveConnectorConfig, ct as GmailLiveConnectorConfig, cu as GoogleDriveLiveConnectorConfig, cv as HeartbeatConfig, cw as HeartbeatDetectionMode, H as HourlySummary, I as IdentityInjectionMode, _ as ImportanceLevel, ah as ImportanceScore, W as LifecycleState, L as LiveConnectorsConfig, cx as LlmTraceCallback, cy as LlmTraceEvent, aj as MemoryActionEligibilityContext, bG as MemoryActionEligibilitySource, ab as MemoryActionEvent, cz as MemoryActionOutcome, cA as MemoryActionPolicyDecision, ak as MemoryActionPolicyResult, cB as MemoryActionStatus, aa as MemoryActionType, w as MemoryCategory, M as MemoryFile, o as MemoryFrontmatter, ai as MemoryIntent, z as MemoryLifecycleEvent, al as MemoryLifecycleEventType, am as MemoryLifecycleStateSummary, aF as MemoryLink, cC as MemoryLinkType, bH as MemoryObservation, cD as MemoryOsPresetName, y as MemoryProjectionCurrentState, bI as MemoryScope, x as MemoryStatus, aM as MemorySummary, aH as MetaState, cE as ModelApi, cF as ModelDefinitionConfig, cG as ModelProviderAuthMode, an as ModelProviderConfig, cH as NamespacePolicy, ao as NativeKnowledgeConfig, cI as NativeKnowledgeFolderRuleConfig, cJ as NativeKnowledgeObsidianVaultConfig, cK as NativeKnowledgeOpenClawWorkspaceConfig, cL as NotionLiveConnectorConfig, P as PluginConfig, Y as PolicyClass, cM as PrincipalFromSessionKeyMode, cN as PrincipalRule, cO as ProceduralConfig, ap as ProvenanceConfig, O as ProvenanceSource, at as QmdSearchExplain, Q as QmdSearchResult, cP as QuestionEntry, bJ as RECALL_DISCLOSURE_LEVELS, cQ as ReasoningEffort, b as RecallDisclosure, cR as RecallPipelineConfig, R as RecallPlanMode, b3 as RecallSectionConfig, g as RecallTierExplain, cS as RecallTraceEvent, cT as RelevanceFeedback, aq as RetrievalTier, cU as SPECULATIVE_TTL_DAYS, cV as ScopeProfileAutoPromoteConfig, s as ScopeProfileConfig, t as ScopeProfileLayerId, u as ScopeProfilePromotionTarget, cW as ScopeProfileTeamProjectConfig, cX as ScopeTeamConfig, cY as ScoredEntity, a5 as SecretRef, cZ as SemanticChunkingConfigShape, S as SessionObserverBandConfig, c_ as SignalLevel, ar as SignalScanResult, c$ as SlotBehaviorConfig, d0 as SlotMismatchMode, r as SourceConnectorProvenance, as as TopicScore, T as TranscriptEntry, d1 as TriggerMode, U as TrustWeights, X as VerificationState, d2 as confidenceTier, bR as isRecallDisclosure } from './types-Bbs0qz6b.js';
+export { aP as AccessTrackingEntry, Y as ActiveRecallChatType, a0 as ActiveRecallModelFallbackPolicy, _ as ActiveRecallPromptStyle, Z as ActiveRecallQueryMode, $ as ActiveRecallThinking, a8 as AgentAccessAuthToken, c5 as AgentAccessHttpConfig, c6 as AgentDefaultsConfig, c7 as AgentPersona, A as AgentPersonaModelConfig, c8 as BehaviorLoopAdjustment, r as BehaviorLoopPolicyState, c9 as BehaviorSignalDirection, a1 as BehaviorSignalEvent, ca as BehaviorSignalType, b8 as BootstrapOptions, b9 as BootstrapResult, g as BriefingActiveThread, cb as BriefingCalendarSourceError, bt as BriefingConfig, e as BriefingFocus, d as BriefingFollowup, bu as BriefingOpenCommitment, i as BriefingRecentEntity, h as BriefingResult, B as BriefingSections, bv as BriefingWindow, cc as BufferEntryState, aK as BufferState, a2 as BufferSurpriseEvent, j as BufferTurn, f as CalendarEvent, C as CalendarSource, cd as CaptureMode, ce as ChatConfig, m as Checkpoint, cf as CodexCliReasoningEffort, cg as CodexCompactionFlushMode, by as CodexCompatConfig, ch as CodexConnectorConfig, b5 as CodingContext, ci as CodingGraphLspConfig, bh as CodingKnowledgeConfig, bb as CodingModeConfig, cj as CompressionGuidelineActivationState, aa as CompressionGuidelineOptimizerActionSummary, a9 as CompressionGuidelineOptimizerEventCounts, ab as CompressionGuidelineOptimizerRuleUpdate, ck as CompressionGuidelineOptimizerSourceWindow, ae as CompressionGuidelineOptimizerState, cl as ConfidenceTier, cm as ConsolidationAction, cn as ConsolidationItem, ba as ConsolidationObservation, y as ConsolidationResult, co as ContradictionScanConfig, N as ConversationThread, cp as CronConversationRecallMode, cq as CronRecallMode, bz as DEFAULT_RECALL_DISCLOSURE, z as DaySummaryResult, cr as DreamingConfig, cs as DreamingNarrativePromptStyle, ct as DreamsDeepSleepConfig, cu as DreamsLightSleepConfig, D as DreamsPhase, cv as DreamsPhaseStatus, cw as DreamsPhasesConfig, cx as DreamsRemConfig, a as DreamsRunResult, b6 as DreamsStatusResult, cy as EngramTraceEvent, aO as EntityActivityEntry, E as EntityFile, af as EntityMention, aN as EntityRelationship, ag as EntitySchemaDefinition, ah as EntitySchemaSectionDefinition, ai as EntityStructuredSection, aI as EntityTimelineEntry, bB as ExtractedFact, cz as ExtractedProcedureStep, cA as ExtractedQuestion, cB as ExtractedReasoningTrace, cC as ExtractedReasoningTraceStep, cD as ExtractedRelationship, W as ExtractionFailureClass, cE as ExtractionPassSource, x as ExtractionResult, F as FaithfulnessFrontmatter, aM as FileHygieneConfig, G as GatewayConfig, cF as GitHubLiveConnectorConfig, cG as GmailLiveConnectorConfig, cH as GoogleDriveLiveConnectorConfig, cI as HeartbeatConfig, cJ as HeartbeatDetectionMode, H as HourlySummary, I as IdentityInjectionMode, X as ImportanceLevel, aj as ImportanceScore, O as LifecycleState, L as LiveConnectorsConfig, cK as LlmTraceCallback, cL as LlmTraceEvent, al as MemoryActionEligibilityContext, bK as MemoryActionEligibilitySource, ad as MemoryActionEvent, cM as MemoryActionOutcome, cN as MemoryActionPolicyDecision, am as MemoryActionPolicyResult, cO as MemoryActionStatus, ac as MemoryActionType, t as MemoryCategory, M as MemoryFile, l as MemoryFrontmatter, ak as MemoryIntent, w as MemoryLifecycleEvent, an as MemoryLifecycleEventType, ao as MemoryLifecycleStateSummary, aJ as MemoryLink, cP as MemoryLinkType, bL as MemoryObservation, cQ as MemoryOsPresetName, v as MemoryProjectionCurrentState, bM as MemoryScope, u as MemoryStatus, aQ as MemorySummary, aL as MetaState, cR as ModelApi, cS as ModelDefinitionConfig, cT as ModelProviderAuthMode, ap as ModelProviderConfig, cU as NamespacePolicy, aq as NativeKnowledgeConfig, cV as NativeKnowledgeFolderRuleConfig, cW as NativeKnowledgeObsidianVaultConfig, cX as NativeKnowledgeOpenClawWorkspaceConfig, cY as NotionLiveConnectorConfig, P as PluginConfig, U as PolicyClass, cZ as PrincipalFromSessionKeyMode, c_ as PrincipalRule, c$ as ProceduralConfig, at as ProvenanceConfig, J as ProvenanceSource, ax as QmdSearchExplain, Q as QmdSearchResult, d0 as QuestionEntry, bN as RECALL_DISCLOSURE_LEVELS, d1 as ReasoningEffort, b as RecallDisclosure, d2 as RecallPipelineConfig, R as RecallPlanMode, b7 as RecallSectionConfig, c as RecallTierExplain, d3 as RecallTraceEvent, d4 as RelevanceFeedback, au as RetrievalTier, d5 as SPECULATIVE_TTL_DAYS, d6 as ScopeProfileAutoPromoteConfig, o as ScopeProfileConfig, p as ScopeProfileLayerId, q as ScopeProfilePromotionTarget, d7 as ScopeProfileTeamProjectConfig, d8 as ScopeTeamConfig, d9 as ScoredEntity, a7 as SecretRef, da as SemanticChunkingConfigShape, S as SessionObserverBandConfig, db as SignalLevel, av as SignalScanResult, dc as SlotBehaviorConfig, dd as SlotMismatchMode, n as SourceConnectorProvenance, aw as TopicScore, T as TranscriptEntry, de as TriggerMode, K as TrustWeights, V as VerificationState, df as confidenceTier, bV as isRecallDisclosure } from './types-DHBxIF0s.js';
 import './message-parts/index.js';
 import './bounded-jsonl-state.js';
 export { ContinuityImprovementLoop, ContinuityIncidentCloseInput, ContinuityIncidentOpenInput, ContinuityIncidentRecord, ContinuityIncidentState, ContinuityLoopCadence, ContinuityLoopReviewInput, ContinuityLoopStatus, ContinuityLoopUpsertInput } from './types-continuity.js';
+import './operator-doctor-types.js';

package/dist/types.js

@@ -4,7 +4,7 @@ import {
   SPECULATIVE_TTL_DAYS,
   confidenceTier,
   isRecallDisclosure
-} from "./chunk-SCOT5DTA.js";
+} from "./chunk-V25OWXAC.js";
 import "./chunk-PZ5AY32C.js";
 export {
   DEFAULT_RECALL_DISCLOSURE,

package/dist/utility-runtime.d.ts

@@ -1,7 +1,8 @@
 import { TierRoutingPolicy } from './tier-routing.js';
-import './types-Bbs0qz6b.js';
+import './types-DHBxIF0s.js';
 import './message-parts/index.js';
 import './bounded-jsonl-state.js';
+import './operator-doctor-types.js';
 import './types-continuity.js';
 import './lifecycle.js';
 

package/dist/verified-recall.js

@@ -1,10 +1,10 @@
 import {
   compareVerifiedEpisodeResults,
   searchVerifiedEpisodes
-} from "./chunk-3UD5ZAUA.js";
+} from "./chunk-VY6SDKWZ.js";
 import "./chunk-B7RWBZXW.js";
 import "./chunk-ZBJMUXZH.js";
-import "./chunk-GCQIMJFH.js";
+import "./chunk-XTAAG4SQ.js";
 import "./chunk-UHVXE24Y.js";
 import "./chunk-2QMKMVHH.js";
 import "./chunk-DEBHXHJR.js";
@@ -12,7 +12,7 @@ import "./chunk-DNHVPZOD.js";
 import "./chunk-6CIAGZ6X.js";
 import "./chunk-J6A3CX5N.js";
 import "./chunk-HKF5VASQ.js";
-import "./chunk-SCOT5DTA.js";
+import "./chunk-V25OWXAC.js";
 import "./chunk-XKGPIWGI.js";
 import "./chunk-EGGE52UU.js";
 import "./chunk-GCASGYIO.js";
@@ -28,31 +28,31 @@ import "./chunk-R3DJVOSM.js";
 import "./chunk-BT7NVCML.js";
 import "./chunk-JYIJNNN3.js";
 import "./chunk-AAD2ZS6P.js";
-import "./chunk-G7D6GZ5J.js";
+import "./chunk-W5H6ZRPT.js";
 import "./chunk-5VQJBH2G.js";
 import "./chunk-AITCS2RC.js";
 import "./chunk-XMMESCPD.js";
 import "./chunk-42JKGUFJ.js";
 import "./chunk-PDJTHRAW.js";
-import "./chunk-W5H6ZRPT.js";
+import "./chunk-G7D6GZ5J.js";
 import "./chunk-C23BYTJV.js";
 import "./chunk-QIEUU4UK.js";
 import "./chunk-L2EXJQJP.js";
 import "./chunk-45GF7Y3V.js";
 import "./chunk-RGMVMVMF.js";
 import "./chunk-N7RWREIQ.js";
-import "./chunk-BJMBJZ2Y.js";
-import "./chunk-UKJAGEXH.js";
-import "./chunk-FP2373TW.js";
 import "./chunk-5I4M26Q7.js";
 import "./chunk-5GKPFL3S.js";
 import "./chunk-4DJQYKMN.js";
 import "./chunk-PQVCH2AE.js";
 import "./chunk-EYIEWJNI.js";
 import "./chunk-JUC24CTX.js";
-import "./chunk-P7FMDTKL.js";
 import "./chunk-6MKAMLQL.js";
 import "./chunk-JAKIDQB2.js";
+import "./chunk-BJMBJZ2Y.js";
+import "./chunk-UKJAGEXH.js";
+import "./chunk-FP2373TW.js";
+import "./chunk-P7FMDTKL.js";
 import "./chunk-RDQGLJRR.js";
 import "./chunk-FF4KLI5W.js";
 import "./chunk-AIK5W3IW.js";

package/dist/write-envelope.d.ts

@@ -1,6 +1,7 @@
-import { w as MemoryCategory } from './types-Bbs0qz6b.js';
+import { t as MemoryCategory } from './types-DHBxIF0s.js';
 import './message-parts/index.js';
 import './bounded-jsonl-state.js';
+import './operator-doctor-types.js';
 import './types-continuity.js';
 
 /**

package/dist/write-envelope.js

@@ -15,8 +15,8 @@ import {
 import "./chunk-R3DJVOSM.js";
 import "./chunk-BT7NVCML.js";
 import "./chunk-5GKPFL3S.js";
-import "./chunk-P7FMDTKL.js";
 import "./chunk-JAKIDQB2.js";
+import "./chunk-P7FMDTKL.js";
 import "./chunk-PZ5AY32C.js";
 export {
   FINGERPRINT_EXEMPT_FIELDS,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@remnic/core",
-  "version": "9.23.4",
+  "version": "9.25.0",
   "description": "Framework-agnostic Remnic memory engine — orchestrator, storage, extraction, search, trust zones",
   "type": "module",
   "main": "dist/index.js",
@@ -3056,7 +3056,7 @@
     "core"
   ],
   "peerDependencies": {
-    "@remnic/coding-graph": "^9.23.4"
+    "@remnic/coding-graph": "^9.25.0"
   },
   "peerDependenciesMeta": {
     "@remnic/coding-graph": {

package/src/access-authorization-probe.ts

@@ -0,0 +1,43 @@
+import { getOperation, type OperationName, OPERATION_NAMES } from "./access-boundary.js";
+import { EngramAccessInputError } from "./access-errors.js";
+import {
+  assertOperationAuthorizationAllowed,
+  type TokenCapabilities,
+} from "./access-token-capabilities.js";
+
+export interface AuthorizationProbeResponse {
+  readonly authorized: true;
+  readonly operations: readonly OperationName[];
+}
+
+/**
+ * Verify that the presenting token may call every requested operation without
+ * invoking any operation handler.
+ */
+export function probeOperationAuthorization(
+  capabilities: TokenCapabilities | undefined | null,
+  requestedOperations: readonly string[],
+): AuthorizationProbeResponse {
+  const operations: OperationName[] = [];
+  for (const candidate of requestedOperations) {
+    if (!OPERATION_NAMES.includes(candidate as OperationName)) {
+      throw new EngramAccessInputError(`unsupported operation: ${candidate}`);
+    }
+    const operation = candidate as OperationName;
+    if (!operations.includes(operation)) operations.push(operation);
+  }
+
+  if (operations.length === 0) {
+    throw new EngramAccessInputError("at least one operation is required");
+  }
+
+  for (const operation of operations) {
+    const boundOperation = getOperation(operation);
+    if (!boundOperation) {
+      throw new Error(`authorization probe operation is not registered: ${operation}`);
+    }
+    assertOperationAuthorizationAllowed(capabilities, boundOperation.spec);
+  }
+
+  return { authorized: true, operations };
+}

package/src/access-boundary.ts

@@ -16,12 +16,9 @@
  */
 
 import { z } from "zod";
-import { EngramAccessForbiddenError } from "./access-errors.js";
 import { EngramAccessInputError, type EngramAccessService } from "./access-service.js";
 import {
-  assertFleetWideOperationAllowed,
-  assertOperationAllowed,
-  capabilityAllowsOp,
+  assertOperationAuthorizationAllowed,
   tokenCapabilityStore,
 } from "./access-token-capabilities.js";
 import { expandTildePath } from "./utils/path.js";
@@ -423,33 +420,7 @@ export function defineOperation<In, Out>(spec: OperationSpec<In, Out>): BoundOpe
       if (!parseResult.success) {
         throw new EngramAccessInputError(formatZodIssues(parseResult.error));
       }
-      // Per-token capability enforcement (issue #1837): when the presenting
-      // token carries an ops allow-list, reject operations not in it. The
-      // capability record is carried via AsyncLocalStorage, set once per
-      // authorized HTTP/MCP request; absent (CLI/tests/direct callers) ⇒
-      // unrestricted. Default-deny ONLY when an ops axis is present — legacy
-      // tokens (absent record) and explicit-unrestricted new tokens are
-      // unaffected.
-      // When the op declares alternate grant ops, permit any of them (so the
-      // batch/MCP path matches an HTTP transport that relaxes the same op);
-      // otherwise the token must carry the op's own name. Unrestricted/legacy
-      // tokens pass either way (capabilityAllowsOp is true when no ops axis).
-      if (spec.allowedByOps && spec.allowedByOps.length > 0) {
-        const store = tokenCapabilityStore.getStore();
-        if (!spec.allowedByOps.some((op) => capabilityAllowsOp(store, op))) {
-          throw new EngramAccessForbiddenError(`token is not permitted to call operation: ${spec.name}`);
-        }
-      } else {
-        assertOperationAllowed(tokenCapabilityStore.getStore(), spec.name);
-      }
-      // Fleet-wide / global maintenance ops (issue #1850 round 10): these run
-      // across all namespaces with no `namespace` arg, so the tools/call
-      // effective-namespace gate never fires. A namespace-SCOPED token must not
-      // trigger cross-namespace maintenance — fail closed BEFORE the handler so
-      // a denial never leaks a partial mutation. No-op for unrestricted/legacy.
-      if (spec.fleetWide) {
-        assertFleetWideOperationAllowed(tokenCapabilityStore.getStore());
-      }
+      assertOperationAuthorizationAllowed(tokenCapabilityStore.getStore(), spec);
       return spec.handler(parseResult.data, ctx);
     },
   };

package/src/access-health-types.ts

@@ -0,0 +1,51 @@
+/**
+ * Health-response types for the authenticated Engram access surface.
+ *
+ * Extracted verbatim from access-service.ts when PR #2151 (extraction liveness)
+ * merged with #2149 (corpus watermarks): both features add a field to
+ * EngramAccessHealthResponse, and the two together pushed access-service.ts past
+ * its grandfathered line ceiling (issue #1520/#1995). Relocating this
+ * self-contained type cluster keeps that god-file shrinking; the three types are
+ * re-exported from access-service.ts so existing importers resolve unchanged.
+ */
+import type { ExtractionLivenessStatus } from "./extraction-liveness.js";
+import type { CorpusWatermark } from "./corpus-watermark.js";
+
+export interface EngramAccessHealthResponse {
+  ok: true;
+  memoryDir: string;
+  namespacesEnabled: boolean;
+  defaultNamespace: string;
+  searchBackend: string;
+  qmdEnabled: boolean;
+  qmd: EngramAccessQmdHealthResponse;
+  nativeKnowledgeEnabled: boolean;
+  projectionAvailable: boolean;
+  extraction: ExtractionLivenessStatus;
+  corpus: CorpusWatermark[];
+}
+
+export type EngramAccessQmdCollectionState =
+  | "present"
+  | "missing"
+  | "unknown"
+  | "skipped";
+
+export interface EngramAccessQmdHealthResponse {
+  enabled: boolean;
+  active: boolean;
+  degraded: boolean;
+  mode: "cli" | "daemon" | "fallback" | "disabled" | "not-selected";
+  collection: string;
+  collectionState: EngramAccessQmdCollectionState;
+  installedVersion: string | null;
+  supportedVersion: string | null;
+  supported: boolean | null;
+  upgradeAvailable: boolean | null;
+  doctorAvailable: boolean | null;
+  debugStatus: string;
+  pendingEmbeddings: number | null;
+  oldestPendingAgeMs: number | null;
+  embeddingBacklogThreshold: number;
+  degradedReason?: string;
+}