@remnic/core 9.69.56 → 9.69.57

package/dist/access-service-CUNM5RfA.d.ts

@@ -1,4700 +0,0 @@
-import { P as PluginConfig, C as CodingContext, M as MemoryFile, u as MemoryCategory, G as GatewayConfig, N as MemorySubject, aD as SubjectGuardMode, aU as DaySummaryResult, o as RecallDisclosure, R as RecallPlanMode, K as MemoryLifecycleEvent, E as EntityFile, x as MemoryStatus, p as SourceConnectorProvenance, bA as DreamsStatusResult, D as DreamsPhase, a as DreamsRunResult } from './types-Du6VdoAg.js';
-import { O as Orchestrator, I as IntentDebugSnapshot, G as GraphRecallSnapshot, P as PatternReinforcementResult } from './orchestrator-iexgVLow.js';
-import { S as ScopeProfileLayerResolution, a as ScopeProfilePromotionResolution, R as ResolvedScopeProfilePlan } from './scope-profiles-BN1Dgfha.js';
-import { S as StorageManager } from './storage-CMm-3aD3.js';
-import { a as SemanticDedupLookup } from './semantic-BalR6EXU.js';
-import { L as LocalLlmClient } from './local-llm-BkkEK9rn.js';
-import { FallbackLlmClient } from './fallback-llm.js';
-import { TrustZoneStoreStatus, TrustZoneName, TrustZoneRecordKind, TrustZoneSourceClass, TrustZoneProvenanceScore, TrustZonePromotionResult, TrustZoneDemoSeedResult } from './trust-zones.js';
-import { LcmMessagePartInput, MessagePartSourceFormat } from './message-parts/index.js';
-import { RecallRequest, CategoryAliasCoercion, ObserveRequest } from './access-schema.js';
-import { z } from 'zod';
-import { ResolveSecretRefFn } from './resolve-auth-token.js';
-import { RecallContextComposition } from './recall-context-composition.js';
-import { RecallXraySnapshot } from './recall-xray.js';
-import { Readable, Writable } from 'node:stream';
-import { ActionConfidenceInput, ActionConfidenceResult } from './action-confidence.js';
-import { OfflineSyncFileState, OfflineSyncSnapshot, OfflineSyncFileRecord, OfflineSyncFileContentChunk, OfflineSyncApplyFileContentChunkResult, OfflineSyncApplyChangesetResult } from './offline-sync.js';
-import { LiveConnectorsRunSummary } from './live-connectors-runner.js';
-import { readMemoryGovernanceRunArtifact } from './maintenance/memory-governance.js';
-import { LastRecallSnapshot } from './recall-state.js';
-import { W as WearablesService, c as MeetingsListResult, b as MeetingsGetResult, a as MeetingsDayBuildSummary } from './service-VealHeqO.js';
-import { MemoryOutcomeKind, RecordMemoryOutcomeResult } from './memory-worth-outcomes.js';
-import { BudgetWarning } from './cross-namespace-budget.js';
-import { AnomalyDetectorResult } from './recall-audit-anomaly.js';
-import { a as Peer, b as PeerProfile } from './types-B1VHaf2w.js';
-import { ImportCapsuleOptions, ImportCapsuleResult } from './transfer/capsule-import.js';
-import { RecallNavigationRequest, RecallNavigationResult } from './recall-navigation.js';
-import { b as NamespaceRecord } from './catalog-BuMyYPUn.js';
-import { S as ScopePlan, E as EngramAccessNamespaceWritableRequest, W as WritableNamespaceResult } from './access-namespace-preflight-U9RAdxqZ.js';
-import { RecallExplainJsonPayload } from './recall-explain-renderer.js';
-import { CitationUsageRequest, CitationUsageResult } from './access-citation.js';
-import { EngramAccessHealthResponse } from './access-health-types.js';
-import { e as LocationContextRequestOptions } from './tagging-BjsNFKWz.js';
-import { ExplicitCaptureInput } from './explicit-capture.js';
-import { WearablesMeetingsScope } from './access-wearables-meetings-surface.js';
-import { DeepRecallResult } from './deep-recall.js';
-import { MemoryStoreBrowseRequest, MemoryStoreBrowseResult } from './memory-browse.js';
-import { GraphSnapshotRequest, GraphSnapshotResponse } from './graph-snapshot.js';
-import { OfflineSyncManifestStreamResponse } from './access-offline-manifest.js';
-import { CapsuleListEntry } from './capsule-cli.js';
-import { withHeldFileLock } from './utils/serialize-mutations.js';
-import { ExportCapsuleOptions, ExportCapsuleResult } from './transfer/capsule-export.js';
-import './access-errors.js';
-
-/**
- * One layer's contribution to the effective scope, with a human-readable
- * reason it was included or skipped. Mirrors the layer set surfaced by the
- * scope-profile plan plus the coding overlay and explicit override.
- */
-interface ScopeInspectionLayer {
-    /** Layer id — `userProject` / `teamProject` / `userGlobal` / `serverShared` / `coding` / `explicit` / `self`. */
-    id: string;
-    /** Resolved namespace for the layer, when applicable. */
-    namespace?: string;
-    /** Whether the layer is in the active read set. */
-    readable: boolean;
-    /** Whether the layer is the effective write target. */
-    writable: boolean;
-    /** Whether the layer is an authorized promotion target. */
-    promotable: boolean;
-    /** Human-readable explanation — used verbatim by the console "why" column. */
-    reason: string;
-}
-/** Promotion target resolved against policy + scope profile. */
-interface ScopeInspectionPromotionTarget {
-    target: string;
-    namespace?: string;
-    authorized: boolean;
-    reason: string;
-}
-/** Output of {@link inspectScope}. */
-interface ScopeInspection {
-    /** Resolved principal (or `undefined` in single-user mode). */
-    principal: string | undefined;
-    /** Explicit namespace override, when readable. */
-    namespaceOverride: string | undefined;
-    /** Effective write namespace. */
-    writeNamespace: string;
-    /** Read namespaces in the order recall searches them. */
-    readNamespaces: string[];
-    /** Coding overlay details (branch → project → root fallbacks). */
-    codingOverlay: {
-        namespace: string;
-        readFallbacks: readonly string[];
-    } | null;
-    /** Active scope profile id, if any. */
-    scopeProfileId: string | null;
-    /** Per-layer explanations. */
-    layers: ScopeInspectionLayer[];
-    /** Promotion targets available for this session/principal. */
-    promotionTargets: ScopeInspectionPromotionTarget[];
-    /** Operator warnings (missing project, disabled scope, auth failures, …). */
-    warnings: string[];
-    /**
-     * Frozen copy of the {@link ScopePlan} the runtime resolver produced. The
-     * dashboard MUST display this verbatim — never a re-derived copy — so the
-     * "scope inspector returns the same plan as runtime resolver" acceptance
-     * test (issue #1502) holds by construction.
-     */
-    plan: ScopePlan;
-}
-/** Operation type the caller intends to inspect (informational only). */
-type ScopeInspectionOperation = "recall" | "observe" | "memory_store" | "maintenance" | "dashboard";
-/** Inputs for {@link inspectScope}. */
-interface InspectScopeOptions {
-    readonly config: PluginConfig;
-    readonly sessionKey?: string;
-    readonly namespace?: string;
-    readonly principalOverride?: string;
-    readonly codingContext?: CodingContext | null;
-    readonly operation?: ScopeInspectionOperation;
-    /**
-     * Whether namespace routing is enabled. Callers that already resolved the
-     * flag (e.g. the access-service layer, threading it through the shared
-     * scope-plan chokepoint) pass it here so this pure helper does not need to
-     * re-read the namespace gate. Defaults to reading the config flag when
-     * omitted so direct callers (tests, CLI) keep working.
-     */
-    readonly namespacesEnabled?: boolean;
-}
-/** Filters the namespace browser accepts (superset of {@link NamespaceCatalogFilter}). */
-interface AdminNamespaceFilter {
-    kind?: NamespaceRecord["kind"];
-    discoveredBy?: NamespaceRecord["discoveredBy"];
-    /** Only namespaces with a write at/after this instant. */
-    writtenSince?: Date;
-    /** Only namespaces whose last write is older than this instant (stale). */
-    staleBefore?: Date;
-}
-/** One namespace row augmented with the operator-facing diagnostics the issue lists. */
-interface AdminNamespaceEntry {
-    namespace: string;
-    identityToken: string;
-    kind: NamespaceRecord["kind"];
-    createdAt: string;
-    lastReadAt?: string;
-    lastWriteAt?: string;
-    lastMaintenanceAt?: Record<string, string>;
-    storageDir: string;
-    discoveredBy: NamespaceRecord["discoveredBy"];
-    /** True when last write is older than `staleThresholdDays` (or never written). */
-    stale: boolean;
-}
-/** Output of {@link listAdminNamespaces}. */
-interface AdminNamespaceList {
-    /** Whether the namespace catalog is enabled. `false` collapses the list. */
-    enabled: boolean;
-    entries: AdminNamespaceEntry[];
-}
-/**
- * Honest, distinguishable classification of a namespace's QMD/search health
- * (issue #1658 thread 1). A single `qmdDegraded` bit collapses the legitimate
- * transient "unknown" (QMD reachable but collection status not yet populated,
- * normal during startup/reindex) together with the actionable "missing"
- * (collection not built — operator must act) and "unavailable" (backend down).
- * Surfacing a classified state lets the dashboard render each case honestly
- * instead of a flat degraded flag or a silent blank.
- */
-type AdminNamespaceQmdState = 
-/** Backend reachable and collection present (or intentionally skipped). */
-"healthy"
-/** Backend reachable but collection status not yet determined (transient). */
- | "unknown"
-/** Backend reachable but the collection is not built for this namespace. */
- | "missing"
-/** Backend unreachable / probe threw. */
- | "unavailable"
-/** No QMD probe was run for this report (provider omitted or returned null). */
- | "not_probed";
-/** QMD/search health snapshot for one namespace (delegated to NamespaceSearchRouter). */
-interface AdminNamespaceQmdHealth {
-    namespace: string;
-    collection: string;
-    available: boolean;
-    collectionState: string;
-    debugStatus: string;
-    installedVersion: string | null;
-    supportedVersion: string | null;
-    supported: boolean | null;
-    upgradeAvailable: boolean | null;
-    daemonMode: boolean | null;
-}
-/** Maintenance + QMD health for one namespace. */
-interface AdminNamespaceHealth {
-    namespace: string;
-    kind?: NamespaceRecord["kind"];
-    lastMaintenanceAt?: Record<string, string>;
-    /** True when no maintenance has ever been recorded. */
-    maintenanceMissing: boolean;
-    /**
-     * True when QMD is unavailable OR its collection is missing/unknown for this
-     * namespace. Matches the NamespaceSearchRouter health path so the aggregate
-     * `degradedMode` flag stays consistent with runtime alerting.
-     */
-    qmdDegraded: boolean;
-    /**
-     * Honest, distinguishable QMD state (issue #1658 thread 1). Complements
-     * `qmdDegraded` so the dashboard can render "unknown" (transient) separately
-     * from "missing"/"unavailable" (action needed) instead of a flat bit.
-     */
-    qmdState: AdminNamespaceQmdState;
-    /** Human-readable explanation of {@link qmdState}, safe to show operators. */
-    qmdStateReason: string;
-    qmd?: AdminNamespaceQmdHealth;
-    /** Reason the QMD probe failed, when it did. */
-    qmdError?: string;
-}
-/** Output of {@link gatherMaintenanceHealth}. */
-interface MaintenanceHealthReport {
-    /** Whether the catalog is enabled. */
-    enabled: boolean;
-    /** Aggregate degraded-mode flag — true when ANY namespace is QMD-degraded. */
-    degradedMode: boolean;
-    perNamespace: AdminNamespaceHealth[];
-}
-/** One file the dry-run migration planner would re-home. */
-interface TranscriptAuditFile {
-    sourceRelPath: string;
-    fileName: string;
-    distinctSessions: number;
-    movedEntries: number;
-    unmovableLines: number;
-}
-/** Output of {@link auditTranscripts}. */
-interface TranscriptAuditReport {
-    /** Generated timestamp (ISO). */
-    generatedAt: string;
-    /** Always true — the admin surface is dry-run only. */
-    dryRun: true;
-    /** Absolute transcripts directory scanned. */
-    transcriptsDir: string;
-    /** True when any legacy fallback file (e.g. `other/default`) holds mixed sessions. */
-    mixedOtherDefault: boolean;
-    /** Distinct sessions the planner would re-home. */
-    distinctSessions: number;
-    /** Total JSONL entries that would move. */
-    movedEntries: number;
-    /** Per-file plans with at least one entry to move. */
-    files: TranscriptAuditFile[];
-    /** Operator-facing summary of the risk. */
-    summary: string;
-}
-/** Promotion target kind the console can request. */
-type MemoryPromotionTargetKind = "teamProject" | "serverShared" | "userProject" | "userGlobal" | "explicit";
-/** Result of one promotion attempt. */
-interface MemoryPromotionTargetResult {
-    target: MemoryPromotionTargetKind;
-    namespace: string;
-    authorized: boolean;
-    promoted: boolean;
-    promotedMemoryId?: string;
-    reason: string;
-}
-/** Output of {@link promoteMemory}. */
-interface MemoryPromotionResult {
-    /** Whether the caller-supplied reason was accepted. */
-    ok: boolean;
-    /** Source memory id. */
-    sourceMemoryId: string;
-    /** Source namespace the memory was read from. */
-    sourceNamespace: string;
-    /** Per-target outcomes. Empty when authorization fails up front. */
-    targets: MemoryPromotionTargetResult[];
-    /** Audit record — caller appends to the access audit log. */
-    audit: MemoryPromotionAudit;
-}
-/** Audit trail for a promotion operation. */
-interface MemoryPromotionAudit {
-    at: string;
-    actor: string;
-    sourceMemoryId: string;
-    sourceNamespace: string;
-    reason: string;
-    targets: Array<{
-        target: MemoryPromotionTargetKind;
-        namespace: string;
-        promoted: boolean;
-    }>;
-}
-
-/**
- * Procedural memory stats surface (issue #567 PR 5/5).
- *
- * Pure helper that tallies procedure memories by status and summarizes the
- * current `procedural.*` config so operators (and the dashboard) can see,
- * in one call, how procedural memory is behaving in a namespace.
- *
- * Consumed by:
- *   - CLI `remnic procedural stats`
- *   - HTTP `GET /engram/v1/procedural/stats`
- *   - MCP `remnic.procedural_stats` (+ `engram.procedural_stats` alias)
- */
-
-interface ProcedureStatusCounts {
-    total: number;
-    active: number;
-    pending_review: number;
-    rejected: number;
-    quarantined: number;
-    superseded: number;
-    archived: number;
-    /** Any status the enum doesn't yet cover. */
-    other: number;
-}
-interface ProcedureStatsConfigSnapshot {
-    enabled: boolean;
-    minOccurrences: number;
-    successFloor: number;
-    autoPromoteOccurrences: number;
-    autoPromoteEnabled: boolean;
-    lookbackDays: number;
-    recallMaxProcedures: number;
-}
-interface ProcedureStatsRecent {
-    /** ISO 8601 timestamp of the most recent procedure write, or null. */
-    lastWriteAt: string | null;
-    /** Count of procedure files with `created` (or `updated`) in the last 7 days. */
-    writesLast7Days: number;
-    /** Count of procedures whose `source` is the procedure miner. */
-    minerSourced: number;
-}
-interface ProcedureStatsReport {
-    schemaVersion: 1;
-    generatedAt: string;
-    counts: ProcedureStatusCounts;
-    recent: ProcedureStatsRecent;
-    config: ProcedureStatsConfigSnapshot;
-    /** ISO timestamp of the last library-maintenance run marker, or null (issue #2370). */
-    lastMaintenanceAt: string | null;
-    /** Active procedures currently carrying a `needsRepair` flag (issue #2370). */
-    needsRepairFlags: number;
-}
-/**
- * Read all memories from storage and tally procedures by status + recency.
- * `nowMs` is injectable so tests can pin the "last 7 days" window.
- */
-declare function computeProcedureStats(options: {
-    storage: StorageManager;
-    config: PluginConfig;
-    nowMs?: number;
-}): Promise<ProcedureStatsReport>;
-/**
- * Render `ProcedureStatsReport` as a human-friendly plain-text block for CLI
- * operators. Keep it deterministic — no colors, no ANSI. Used by `--format text`.
- */
-declare function formatProcedureStatsText(report: ProcedureStatsReport): string;
-
-/**
- * Procedure library health maintenance (issue #2370).
- *
- * The library-health loop the agent-memory survey describes: consume the
- * telemetry Remnic already records (Memory Worth counters, access
- * timestamps, causal trajectories) and propose merge / repair-flag /
- * retire transitions for ACTIVE procedure memories.
- *
- * Shadow-first contract (mirrors `memory_governance_run`): the default run
- * mode produces a JSON report and writes NOTHING — not even the run
- * marker. Applying requires `apply: true` AND
- * `procedural.maintenance.enabled: true`.
- *
- * Actions, evaluated in this order per run:
- *   1. Merge   — cluster active procedures by normalized trigger phrase +
- *                step signature; most-recently-updated member becomes the
- *                canonical, the rest are superseded pointing at it. The
- *                canonical is stamped with the issue-#687 frontmatter
- *                contract (`reinforcement_count`, `last_reinforced_at`,
- *                `derived_via`, `derived_from`) so `patterns explain` reads
- *                procedure canonicals unchanged. A user-edited body never
- *                merges — the cluster is flagged instead.
- *   2. Repair  — flag (never rewrite) procedures whose `ProcedureStep`
- *                toolCall tools no longer appear in recent causal
- *                trajectories, via `structuredAttributes.needsRepair`.
- *   3. Retire  — demote to `archived` when failure-dominant past the
- *                configured thresholds, or idle past `retireIdleDays` with
- *                zero recorded outcomes. Demotion, never deletion; page
- *                versioning snapshots every overwrite. User-edited
- *                procedures are exempt and flagged instead.
- *
- * Deliberately NOT part of `runMemoryGovernance` — same isolation decision
- * as procedure mining (docs/procedural-memory.md).
- */
-
-type ProcedureLibraryStorage = {
-    readAllMemories: () => Promise<MemoryFile[]>;
-    writeMemoryFrontmatter: (memory: MemoryFile, patch: Record<string, unknown>, extras?: Record<string, unknown>) => Promise<unknown>;
-    archiveMemory: (memory: MemoryFile, opts: {
-        at: Date;
-        actor: string;
-        reasonCode: string;
-        ruleVersion?: string;
-        relatedMemoryIds?: string[];
-    }) => Promise<string | null>;
-};
-type ProcedureMaintenanceActionKind = "merge" | "retire" | "flag_repair" | "flag_user_edited";
-type ProcedureMaintenanceReasonCode = "merge_duplicate_signature" | "retire_failure_dominant" | "retire_idle" | "needs_repair_stale_tools" | "user_edited_protected";
-interface ProcedureMaintenanceEvidence {
-    memoryId: string;
-    mwSuccess: number;
-    mwFail: number;
-    lastAccessed: string | null;
-    updated: string | null;
-}
-interface ProcedureMaintenanceAction {
-    action: ProcedureMaintenanceActionKind;
-    reasonCode: ProcedureMaintenanceReasonCode;
-    /** Canonical first for merges; otherwise the single targeted memory. */
-    memoryIds: string[];
-    canonicalId?: string;
-    reason: string;
-    evidence: ProcedureMaintenanceEvidence[];
-}
-interface ProcedureLibraryMaintenanceReport {
-    schemaVersion: 1;
-    generatedAt: string;
-    mode: "shadow" | "apply";
-    scannedProcedures: number;
-    proposed: ProcedureMaintenanceAction[];
-    applied: ProcedureMaintenanceAction[];
-    appliedCount: number;
-    skippedReason?: "procedural_disabled" | "maintenance_disabled";
-}
-interface ProcedureMaintenanceMarker {
-    schemaVersion: 1;
-    lastRunAt: string;
-    lastApplyAt: string | null;
-    appliedCount: number;
-}
-/**
- * Run one library-health maintenance pass over the procedures in a storage.
- * Shadow mode performs NO writes (not even the state marker).
- */
-declare function runProcedureLibraryMaintenance(options: {
-    storage: ProcedureLibraryStorage;
-    memoryDir: string;
-    config: PluginConfig;
-    apply?: boolean;
-    now?: Date;
-}): Promise<ProcedureLibraryMaintenanceReport>;
-
-interface ConsoleBufferState {
-    /** Number of turns currently held in the default buffer slot. */
-    turnsCount: number;
-    /** Approximate byte size of buffered content (UTF-8). */
-    byteCount: number;
-}
-interface ConsoleExtractionVerdict {
-    /** ISO-8601 timestamp the verdict was recorded. */
-    ts: string;
-    /** Verdict kind — typically "accept" | "reject" | "defer". */
-    kind: string;
-    /** Optional short reason from the judge or fallback. */
-    reason?: string;
-}
-interface ConsoleExtractionQueueState {
-    /** Number of pending extraction tasks queued in the orchestrator. */
-    depth: number;
-    /** Most recent judge verdicts, newest last. Capped at 25 entries. */
-    recentVerdicts: ConsoleExtractionVerdict[];
-}
-interface ConsoleDedupDecision {
-    /** ISO-8601 timestamp the decision was recorded. */
-    ts: string;
-    /** Outcome of the dedup check — "duplicate" | "novel" | etc. */
-    decision: string;
-    /** Optional content fingerprint (first 16 chars of a hash). */
-    fingerprint?: string;
-    /** Optional similarity score that drove the decision. */
-    similarity?: number;
-}
-interface ConsoleMaintenanceLedgerEvent {
-    /** ISO-8601 timestamp from the ledger row. */
-    ts: string;
-    /** Event category (e.g. "EXTRACTION_JUDGE_VERDICT"). */
-    category: string;
-    /** Compact one-line summary. */
-    summary: string;
-}
-interface ConsoleQmdProbeState {
-    /** Whether QMD is reachable via CLI or daemon. */
-    available: boolean;
-    /** Whether the daemon transport is in use. */
-    daemonMode: boolean;
-    /** Raw debug-status string from `qmd.debugStatus()`. */
-    debug: string;
-}
-interface ConsoleDaemonInfo {
-    /** Process uptime in milliseconds. */
-    uptimeMs: number;
-    /** Package / daemon version (best-effort). */
-    version: string;
-}
-/**
- * Faithfulness gate verdict distribution (issue #1576). Surfaced via
- * console_state so `remnic doctor` can render how the gate is performing.
- */
-interface ConsoleFaithfulnessDistribution {
-    entailed: number;
-    contradicted: number;
-    unsupported: number;
-    unchecked: number;
-    skippedNoSpan: number;
-}
-interface ConsoleStateSnapshot {
-    /** ISO-8601 capture timestamp. */
-    capturedAt: string;
-    bufferState: ConsoleBufferState;
-    extractionQueue: ConsoleExtractionQueueState;
-    dedupRecent: ConsoleDedupDecision[];
-    maintenanceLedgerTail: ConsoleMaintenanceLedgerEvent[];
-    qmdProbe: ConsoleQmdProbeState;
-    daemon: ConsoleDaemonInfo;
-    /** Faithfulness gate distribution (issue #1576). Absent when the gate is off. */
-    faithfulness?: ConsoleFaithfulnessDistribution;
-    /**
-     * Subsystem read errors. One entry per failed reader keyed by
-     * subsystem name (e.g. `"bufferState: ..."`). An empty array means
-     * every section was read cleanly.
-     */
-    errors: string[];
-}
-
-/**
- * Architecture-card surface contract + handler (issue #1548 Track A PR 3).
- *
- * Mirrors the decision-surfaces pattern (PR 2): one shared implementation
- * behind the MCP, HTTP, and CLI surfaces. All three transports dispatch
- * through the `coding_architecture` boundary operation, which calls
- * {@link handleCodingArchitecture} via the service delegate.
- *
- * Gate (rule 39): `codingKnowledge.enabled + architectureCard + coding
- * context` — one predicate, identical on every surface. The tools/list
- * visibility gate checks conditions 1–2 only (config-level).
- *
- * Persistence (rule 43): the card is written through the storage
- * manager's normal persist pipeline (writeMemory for the initial card,
- * updateMemory for refreshes) so catalog recording + reindex fire. No
- * direct `fs` writes of memory content. Each refresh snapshots the
- * prior content via page-versioning before overwriting (rule 25 —
- * preserve the old before the new is ready).
- *
- * Subcommands:
- *  - `get`: return the current architecture card (or not-found).
- *  - `refresh`: build a fresh card from the repo, persist it, and
- *    snapshot the prior version.
- */
-
-declare const ARCHITECTURE_SUBCOMMANDS: readonly ["get", "refresh"];
-type ArchitectureSubcommand = (typeof ARCHITECTURE_SUBCOMMANDS)[number];
-/** Canonical surface request — one shape for all three transports. */
-interface ArchitectureSurfaceRequest {
-    subcommand: ArchitectureSubcommand;
-    sessionKey?: string;
-    namespace?: string;
-}
-/** Surface response — discriminated union on `subcommand`. */
-type ArchitectureSurfaceResponse = {
-    subcommand: "get";
-    found: boolean;
-    card?: {
-        content: string;
-        generatedAt: string;
-        byteSize: number;
-        truncated: boolean;
-    };
-} | {
-    subcommand: "refresh";
-    refreshed: boolean;
-    memoryId: string;
-    byteSize: number;
-    truncated: boolean;
-    buildCode?: string;
-    /**
-     * Present when the refresh was tombstone-blocked (#1579): the new card
-     * content landed pending_review (no active overwrite). Callers/UI surface
-     * this so operators see why the active card didn't update (#1645).
-     */
-    blockedReason?: string;
-    /** The tombstone id that blocked the write, when `blockedReason` is set. */
-    blockedBy?: string;
-};
-
-/**
- * Decision-record surface contract + handler (issue #1548 Track A PR 2).
- *
- * Rule 39: one gate predicate, checked identically on every surface. Rule 22
- * spirit: one implementation behind three thin wirings. The service holds
- * only a thin delegate that builds a {@link DecisionSurfaceContext} and calls
- * {@link handleCodingDecision}; the handler logic lives here so the
- * access-service god file gains thin wiring only.
- *
- * No orchestrator imports (rule 11 — no shared mutable state). No circular
- * dependency on access-service.ts: validation errors are thrown via
- * `ctx.throwInputError`, which the service wires to EngramAccessInputError.
- */
-
-declare const DECISION_SUBCOMMANDS: readonly ["list", "get", "record", "supersede"];
-type DecisionSubcommand = (typeof DECISION_SUBCOMMANDS)[number];
-/**
- * Canonical surface request — one shape for all three transports. The
- * `subcommand` field selects which operation runs; the remaining fields are
- * optional depending on the subcommand.
- *
- * `sessionKey` identifies the session whose coding context scopes the
- * operation. `namespace` overrides the coding-scoped namespace (same
- * precedence as `memory_store` — explicit namespace wins).
- */
-interface DecisionSurfaceRequest {
-    subcommand: DecisionSubcommand;
-    sessionKey?: string;
-    namespace?: string;
-    id?: string;
-    title?: string;
-    status?: string;
-    context?: string;
-    decision?: string;
-    consequences?: string;
-    entityRefs?: string[];
-    supersedesId?: string;
-}
-/**
- * Surface response — a discriminated union on `subcommand`. Each surface
- * serializes this to its transport-appropriate shape.
- */
-type DecisionSurfaceResponse = {
-    subcommand: "list";
-    records: DecisionSurfaceRecord[];
-    count: number;
-} | {
-    subcommand: "get";
-    found: boolean;
-    record?: DecisionSurfaceRecord;
-} | {
-    subcommand: "record";
-    memoryId: string;
-    status: string;
-} | {
-    subcommand: "supersede";
-    supersededMemoryId: string;
-    replacementMemoryId: string;
-};
-/**
- * Flattened record projection surfaced to clients. Stored as markdown +
- * frontmatter memory files (category `"decision"`) — this shape is the
- * read-side projection, not the storage format.
- */
-interface DecisionSurfaceRecord {
-    id: string;
-    title: string;
-    status: string;
-    context?: string;
-    decision?: string;
-    consequences?: string;
-    entityRefs: string[];
-    supersedes?: string;
-}
-
-/**
- * Codegraph parity surface contract + handler (issue #1554).
- *
- * Mirrors the decision-surfaces.ts / architecture-surfaces.ts pattern: one
- * shared implementation behind the MCP, HTTP, and CLI surfaces. All three
- * transports dispatch through the `codegraph_*` boundary operations, which
- * call {@link handleCodegraphTool} via the service delegate.
- *
- * Gate (rule 39): `codingKnowledge.enabled + codegraphTools + runtime
- * availability` -- one predicate (`codegraphSurfaceVisible`), checked
- * identically on every surface. The tools/list visibility gate uses the
- * config-only predicate; the call-time gate re-checks config AND runtime
- * availability AND (for tools that touch a per-session project) a coding
- * context.
- *
- * Reuse, don't fork (rule 22): `manage_adr` reuses Track A's decision
- * records (`coding/decision-records.ts`); `get_architecture` composes
- * Track A's architecture card with live graph stats. Zero duplicated ADR
- * or architecture-card logic.
- */
-
-declare const CODEGRAPH_TOOL_NAMES: readonly ["index", "list_projects", "delete_project", "index_status", "search_graph", "trace_path", "detect_changes", "query_graph", "get_schema", "get_snippet", "get_architecture", "search_code", "manage_adr", "ingest_traces"];
-type CodegraphToolName = (typeof CODEGRAPH_TOOL_NAMES)[number];
-/**
- * Canonical surface request — one shape for all three transports. `tool`
- * selects which codegraph operation runs; `sessionKey`/`principal`/`project`
- * scope the per-project GraphStore lookup; remaining fields are
- * tool-specific and validated by the handler.
- */
-interface CodegraphSurfaceRequest {
-    readonly tool: CodegraphToolName;
-    readonly sessionKey?: string;
-    readonly principal?: string;
-    /** Explicit project id; defaults to the session's coding-context projectId. */
-    readonly project?: string;
-    readonly query?: string;
-    readonly limit?: number;
-    readonly start?: string;
-    readonly direction?: string;
-    readonly depth?: number;
-    readonly qualifiedName?: string;
-    readonly path?: string;
-    readonly structuredQuery?: Record<string, unknown>;
-    readonly head?: string;
-    readonly repoRoot?: string;
-    readonly mode?: string;
-    readonly confirm?: boolean;
-    readonly subcommand?: string;
-    readonly id?: string;
-    readonly title?: string;
-    readonly status?: string;
-    readonly context?: string;
-    readonly decision?: string;
-    readonly consequences?: string;
-    readonly entityRefs?: string[];
-    readonly supersedesId?: string;
-    readonly traces?: unknown[];
-}
-type CodegraphSurfaceResponse = {
-    tool: CodegraphToolName;
-    ok: true;
-    result: unknown;
-} | {
-    tool: CodegraphToolName;
-    ok: false;
-    code: string;
-    message: string;
-};
-
-/** Persisted marker: the HEAD we last computed a delta against, and when. */
-interface LastSeenState {
-    /** HEAD SHA at the time of the last delta. */
-    head: string;
-    /** ISO timestamp of the last delta computation. */
-    at: string;
-}
-
-/**
- * Session-delta surface contract + handler (issue #1548 Track A PR 4).
- *
- * The single shared implementation behind the MCP, HTTP, and CLI
- * session-delta surfaces. All three transports dispatch through the
- * `coding_delta` boundary operation, which calls {@link handleCodingDelta}
- * via the service delegate.
- *
- * Gate (rule 39): `codingKnowledge.enabled + sessionDelta + coding
- * context` — one predicate, identical on every surface. The tools/list
- * visibility gate checks conditions 1–2 only (config-level).
- *
- * Persistence (rule 25): the new last-seen-head marker is written AFTER
- * the delta is computed from the old one. State writes use temp-file-then-
- * rename (rule 54) via the pure module's `writeLastSeenState`.
- *
- * Subcommand: `get` — computes the delta against the persisted last-seen
- * head and updates the marker in the same call (so the NEXT session sees
- * this one as the baseline). Read-only semantically, but it mutates the
- * state file: it is therefore NOT counted against the write-quota (the
- * state file is operator-side bookkeeping, not user memory content — the
- * same way `calibration.ts` writes are uncounted).
- */
-
-declare const DELTA_SUBCOMMANDS: readonly ["get"];
-type DeltaSubcommand = (typeof DELTA_SUBCOMMANDS)[number];
-/** Canonical surface request — one shape for all three transports. */
-interface DeltaSurfaceRequest {
-    subcommand: DeltaSubcommand;
-    sessionKey?: string;
-    namespace?: string;
-}
-/**
- * Surface response. Mirrors {@link SessionDeltaResult} but flattened for
- * transport: every outcome carries `nextState` so callers can observe the
- * new marker even on failure (the head still advanced).
- */
-type DeltaSurfaceResponse = {
-    subcommand: "get";
-    ok: true;
-    /** A real delta was computed. */
-    kind: "changed";
-    delta: {
-        commits: ReadonlyArray<{
-            sha: string;
-            subject: string;
-        }>;
-        touchedFiles: readonly string[];
-        /**
-         * Uncapped total commit count (the {@link commits} slice is capped
-         * for transport). Issue #1630 fix 1.
-         */
-        totalCommits: number;
-        /**
-         * Uncapped total touched-file count (the {@link touchedFiles} slice
-         * is capped for transport). Issue #1630 fix 1.
-         */
-        totalTouchedFiles: number;
-        summaryLine: string;
-    };
-    nextState: LastSeenState;
-} | {
-    subcommand: "get";
-    ok: true;
-    /** Prior head equals current — no changes. */
-    kind: "unchanged";
-    nextState: LastSeenState;
-} | {
-    subcommand: "get";
-    ok: true;
-    /** No prior state — first session for this namespace. */
-    kind: "first_run";
-    nextState: LastSeenState;
-} | {
-    subcommand: "get";
-    /**
-     * Delta unavailable. `code` is one of `unreachable_head` (force-push/
-     * rebase erased the prior head) or `git_failed` (invoker error). The
-     * state file is still advanced when `nextState` is present.
-     */
-    ok: false;
-    code: "unreachable_head" | "git_failed";
-    detail: string;
-    nextState?: LastSeenState;
-};
-
-/**
- * correction/correction-contract.ts — Types for the Correction Contract
- * (issue #1580).
- *
- * The Correction Contract is the SINGLE plan/apply pipeline every memory
- * correction flows through: supersession, invalidation, tombstone, edit,
- * rescope, redaction. A correction arrives as a plain-language statement
- * ("we migrated to MySQL in March"); the planner turns it into a structured
- * {@link CorrectionPlan}; the executor applies the plan in non-destructive
- * order through the existing storage/orchestrator chokepoints.
- *
- * This module is PURE types + validation helpers — no I/O, no side effects.
- * The planner and executor live in sibling modules and inject their own
- * collaborators so the contract is testable in isolation (rule 33).
- *
- * Design rules honored (issue #1580 design section):
- *   - Plans are per-request state on disk, never module-level (rules 11/47).
- *   - Caller-supplied namespaces are NEVER trusted raw — the service
- *     resolves them through the normal namespace policy (rule 42).
- *   - Bulk operations refuse past maxAffected (no silent truncation, §39).
- *   - `never_store` redaction patterns must be bounded and safe (§34).
- */
-
-/**
- * The user-facing input: a plain-language correction plus optional explicit
- * targets. This is what every surface (MCP / HTTP / CLI) collects before
- * handing off to the planner.
- */
-interface CorrectionRequest {
-    /** Natural-language correction statement. Required, non-empty. */
-    text: string;
-    /**
-     * Explicit target memory ids (or handles via #1582). When present the
-     * planner resolves these directly; an unknown id is an explicit error
-     * (rule 34), never a silent empty plan. When absent the planner searches.
-     */
-    targetIds?: string[];
-    /** Session key for namespace/principal resolution. */
-    sessionKey?: string;
-    /** Authenticated principal (resolved by the service, never trusted raw). */
-    principal?: string;
-    /**
-     * Caller-suggested namespace. ALWAYS re-resolved through the namespace
-     * policy by the service before reaching the planner (rule 42). The
-     * planner only sees the ALREADY-AUTHORIZED namespace.
-     */
-    namespace?: string;
-}
-type CorrectionClassification = "wrong" | "outdated" | "incomplete" | "wrong_scope" | "never_store";
-/**
- * A draft for a replacement memory (supersede action). Mirrors the subset of
- * {@link MemoryFrontmatter} a correction caller may legitimately set; the
- * executor fills in id/created/updated/source.
- */
-interface MemoryDraft {
-    content: string;
-    category?: MemoryCategory;
-    confidence?: number;
-    tags?: string[];
-    entityRef?: string;
-    /** Optional event-time anchor for bi-temporal supersession (#1578). */
-    validAt?: string;
-    /** Optional observed-at anchor for bi-temporal supersession (#1578). */
-    observedAt?: string;
-    structuredAttributes?: Record<string, string>;
-}
-type CorrectionAction = 
-/** Outdated: a new fact replaces the loser. */
-{
-    kind: "supersede";
-    loserId: string;
-    replacement?: MemoryDraft;
-}
-/** Incomplete / minor-wrong: a versioned edit to an existing memory. */
- | {
-    kind: "edit";
-    memoryId: string;
-    patch: string;
-}
-/** Wrong: retire + tombstone. */
- | {
-    kind: "retract";
-    memoryId: string;
-}
-/** Wrong scope: move to a different namespace. */
- | {
-    kind: "rescope";
-    memoryId: string;
-    toNamespace: string;
-}
-/** Never-store: a future-extraction redaction rule. */
- | {
-    kind: "redaction_rule";
-    pattern: string;
-};
-/**
- * One affected memory in a plan: where it lives, an excerpt, why it is
- * affected, and (when available) the source quote that supports the
- * correction (#1575 provenance).
- */
-interface CorrectionAffectedEntry {
-    memoryId: string;
-    /** File path relative to the storage dir, for diff rendering. */
-    path: string;
-    excerpt: string;
-    why: string;
-    sourceQuote?: string;
-}
-/**
- * A persisted, expiring correction plan. Read-only artifact produced by the
- * planner; consumed (once) by the executor.
- */
-interface CorrectionPlan {
-    planId: string;
-    request: CorrectionRequest;
-    /** Authorized namespace the plan is scoped to (resolved by the service). */
-    namespace: string;
-    affected: CorrectionAffectedEntry[];
-    classification: CorrectionClassification;
-    actions: CorrectionAction[];
-    /** Human-readable diff preview rendered via page-versioning. */
-    diff: string;
-    /** Planner confidence in [0, 1]. `0` means manual selection required. */
-    confidence: number;
-    warnings: string[];
-    createdAt: string;
-    /** ISO timestamp after which apply rejects the plan as expired. */
-    expiresAt: string;
-    /**
-     * Lifecycle: `pending` → `applying` → `applied`|`partial` (or `discarded`).
-     * The executor flips a plan to `applying` BEFORE running any mutation
-     * (review thread OgIqt): if the process dies mid-apply, the plan stays
-     * `applying` and is NOT silently retryable — a partially-applied plan must
-     * never be re-applied wholesale (it would duplicate succeeded actions).
-     */
-    status?: "pending" | "applying" | "applied" | "discarded" | "partial";
-    /**
-     * ISO timestamp recorded when the plan transitioned to `applying` (#1713
-     * Item 2). Startup recovery uses this to detect plans stuck in `applying`
-     * past the stale-applying TTL (process died mid-apply) and discard+scrub
-     * them. Absent on plans that never entered `applying`.
-     */
-    applyingAt?: string;
-}
-/**
- * Per-action outcome recorded by the executor. An action whose new-state
- * write failed is `failed`; the executor never destroys old state for a
- * failed action (rule 25 / checklist §14).
- */
-interface CorrectionActionResult {
-    action: CorrectionAction;
-    status: "applied" | "failed" | "skipped";
-    /** For supersede: the new memory id. For edit: the memory id. */
-    memoryId?: string;
-    /** For supersede/retract: the emitted tombstone id (if any). */
-    tombstoneId?: string;
-    error?: string;
-}
-interface CorrectionOutcome {
-    planId: string;
-    status: "applied" | "partial";
-    results: CorrectionActionResult[];
-    /** Audit-record memory id (corrections are themselves memories). */
-    auditMemoryId: string;
-    /** ISO timestamp of the apply. */
-    appliedAt: string;
-}
-
-interface EngramAccessLcmCompactionFlushRequest extends CodingScopedWriteInput {
-    sessionKey: string;
-    namespace?: string;
-    authenticatedPrincipal?: string;
-}
-interface EngramAccessLcmCompactionFlushResponse {
-    enabled: boolean;
-    flushed: boolean;
-    sessionKey: string;
-    namespace: string;
-    reason?: string;
-}
-interface EngramAccessExtractionForceFlushRequest extends CodingScopedWriteInput {
-    sessionKey: string;
-    namespace?: string;
-    authenticatedPrincipal?: string;
-    deadlineMs?: number;
-    abortSignal?: AbortSignal;
-    /** Internal HTTP hook invoked at the durable commit boundary. */
-    onCommitted?: () => void;
-}
-interface EngramAccessExtractionForceFlushResponse {
-    flushed: boolean;
-    sessionKey: string;
-    namespace: string;
-    effectiveNamespace: string;
-}
-interface ExtractionForceFlushDelegate {
-    extractionForceFlush(request: EngramAccessExtractionForceFlushRequest): Promise<EngramAccessExtractionForceFlushResponse>;
-}
-declare function delegateExtractionForceFlush(delegate: ExtractionForceFlushDelegate, request: EngramAccessExtractionForceFlushRequest): Promise<EngramAccessExtractionForceFlushResponse>;
-
-type SupportPassportErrorCode = "card_data_invalid" | "card_not_found" | "consent_required" | "feature_disabled" | "forbidden" | "grant_expired" | "grant_gone" | "grant_not_found" | "grant_stale" | "invalid_card_status" | "invalid_input" | "model_output_invalid" | "provider_unavailable" | "rate_limited" | "revision_conflict" | "state_conflict" | "storage_conflict";
-declare class SupportPassportError extends Error {
-    readonly code: SupportPassportErrorCode;
-    readonly status: number;
-    constructor(code: SupportPassportErrorCode, message: string, status: number);
-}
-
-declare const SUPPORT_PASSPORT_NOT_IN_GUIDE_ANSWER = "That is not covered in this person's support guide.";
-declare const SUPPORT_PASSPORT_DRAFT_MAX_MEMORIES = 20;
-declare const SUPPORT_PASSPORT_DRAFT_MAX_CONTENT_CHARACTERS = 100000;
-declare const SupportPassportDraftCardSchema: z.ZodEffects<z.ZodObject<{
-    title: z.ZodEffects<z.ZodString, string, string>;
-    statement: z.ZodString;
-    category: z.ZodEnum<["communication", "environment", "transitions", "sensory", "regulation", "interests", "other"]>;
-    sourceMemoryIds: z.ZodArray<z.ZodString, "many">;
-}, "strict", z.ZodTypeAny, {
-    category: "other" | "communication" | "environment" | "transitions" | "sensory" | "regulation" | "interests";
-    title: string;
-    sourceMemoryIds: string[];
-    statement: string;
-}, {
-    category: "other" | "communication" | "environment" | "transitions" | "sensory" | "regulation" | "interests";
-    title: string;
-    sourceMemoryIds: string[];
-    statement: string;
-}>, {
-    category: "other" | "communication" | "environment" | "transitions" | "sensory" | "regulation" | "interests";
-    title: string;
-    sourceMemoryIds: string[];
-    statement: string;
-}, {
-    category: "other" | "communication" | "environment" | "transitions" | "sensory" | "regulation" | "interests";
-    title: string;
-    sourceMemoryIds: string[];
-    statement: string;
-}>;
-declare const SupportPassportDraftOutputSchema: z.ZodObject<{
-    cards: z.ZodArray<z.ZodEffects<z.ZodObject<{
-        title: z.ZodEffects<z.ZodString, string, string>;
-        statement: z.ZodString;
-        category: z.ZodEnum<["communication", "environment", "transitions", "sensory", "regulation", "interests", "other"]>;
-        sourceMemoryIds: z.ZodArray<z.ZodString, "many">;
-    }, "strict", z.ZodTypeAny, {
-        category: "other" | "communication" | "environment" | "transitions" | "sensory" | "regulation" | "interests";
-        title: string;
-        sourceMemoryIds: string[];
-        statement: string;
-    }, {
-        category: "other" | "communication" | "environment" | "transitions" | "sensory" | "regulation" | "interests";
-        title: string;
-        sourceMemoryIds: string[];
-        statement: string;
-    }>, {
-        category: "other" | "communication" | "environment" | "transitions" | "sensory" | "regulation" | "interests";
-        title: string;
-        sourceMemoryIds: string[];
-        statement: string;
-    }, {
-        category: "other" | "communication" | "environment" | "transitions" | "sensory" | "regulation" | "interests";
-        title: string;
-        sourceMemoryIds: string[];
-        statement: string;
-    }>, "many">;
-}, "strict", z.ZodTypeAny, {
-    cards: {
-        category: "other" | "communication" | "environment" | "transitions" | "sensory" | "regulation" | "interests";
-        title: string;
-        sourceMemoryIds: string[];
-        statement: string;
-    }[];
-}, {
-    cards: {
-        category: "other" | "communication" | "environment" | "transitions" | "sensory" | "regulation" | "interests";
-        title: string;
-        sourceMemoryIds: string[];
-        statement: string;
-    }[];
-}>;
-declare const SupportPassportDraftModelInputSchema: z.ZodEffects<z.ZodObject<{
-    consent: z.ZodLiteral<true>;
-    memories: z.ZodArray<z.ZodObject<{
-        memoryId: z.ZodString;
-        content: z.ZodString;
-    }, "strict", z.ZodTypeAny, {
-        content: string;
-        memoryId: string;
-    }, {
-        content: string;
-        memoryId: string;
-    }>, "many">;
-}, "strict", z.ZodTypeAny, {
-    memories: {
-        content: string;
-        memoryId: string;
-    }[];
-    consent: true;
-}, {
-    memories: {
-        content: string;
-        memoryId: string;
-    }[];
-    consent: true;
-}>, {
-    memories: {
-        content: string;
-        memoryId: string;
-    }[];
-    consent: true;
-}, {
-    memories: {
-        content: string;
-        memoryId: string;
-    }[];
-    consent: true;
-}>;
-declare const SupportPassportAnswerOutputSchema: z.ZodEffects<z.ZodObject<{
-    answer: z.ZodString;
-    citedCardIds: z.ZodArray<z.ZodString, "many">;
-    coverage: z.ZodEnum<["grounded", "not_in_guide"]>;
-}, "strict", z.ZodTypeAny, {
-    coverage: "grounded" | "not_in_guide";
-    answer: string;
-    citedCardIds: string[];
-}, {
-    coverage: "grounded" | "not_in_guide";
-    answer: string;
-    citedCardIds: string[];
-}>, {
-    coverage: "grounded" | "not_in_guide";
-    answer: string;
-    citedCardIds: string[];
-}, {
-    coverage: "grounded" | "not_in_guide";
-    answer: string;
-    citedCardIds: string[];
-}>;
-declare const SupportPassportAnswerModelInputSchema: z.ZodObject<{
-    guide: z.ZodObject<{
-        schemaVersion: z.ZodLiteral<1>;
-        grantId: z.ZodEffects<z.ZodString, string, string>;
-        expiresAt: z.ZodEffects<z.ZodString, string, string>;
-        updatedAt: z.ZodEffects<z.ZodString, string, string>;
-        cards: z.ZodArray<z.ZodObject<{
-            cardId: z.ZodString;
-            title: z.ZodString;
-            statement: z.ZodString;
-            category: z.ZodEnum<["communication", "environment", "transitions", "sensory", "regulation", "interests", "other"]>;
-            updatedAt: z.ZodEffects<z.ZodString, string, string>;
-        }, "strict", z.ZodTypeAny, {
-            category: "other" | "communication" | "environment" | "transitions" | "sensory" | "regulation" | "interests";
-            title: string;
-            updatedAt: string;
-            cardId: string;
-            statement: string;
-        }, {
-            category: "other" | "communication" | "environment" | "transitions" | "sensory" | "regulation" | "interests";
-            title: string;
-            updatedAt: string;
-            cardId: string;
-            statement: string;
-        }>, "many">;
-    }, "strict", z.ZodTypeAny, {
-        expiresAt: string;
-        schemaVersion: 1;
-        updatedAt: string;
-        cards: {
-            category: "other" | "communication" | "environment" | "transitions" | "sensory" | "regulation" | "interests";
-            title: string;
-            updatedAt: string;
-            cardId: string;
-            statement: string;
-        }[];
-        grantId: string;
-    }, {
-        expiresAt: string;
-        schemaVersion: 1;
-        updatedAt: string;
-        cards: {
-            category: "other" | "communication" | "environment" | "transitions" | "sensory" | "regulation" | "interests";
-            title: string;
-            updatedAt: string;
-            cardId: string;
-            statement: string;
-        }[];
-        grantId: string;
-    }>;
-    question: z.ZodString;
-}, "strict", z.ZodTypeAny, {
-    question: string;
-    guide: {
-        expiresAt: string;
-        schemaVersion: 1;
-        updatedAt: string;
-        cards: {
-            category: "other" | "communication" | "environment" | "transitions" | "sensory" | "regulation" | "interests";
-            title: string;
-            updatedAt: string;
-            cardId: string;
-            statement: string;
-        }[];
-        grantId: string;
-    };
-}, {
-    question: string;
-    guide: {
-        expiresAt: string;
-        schemaVersion: 1;
-        updatedAt: string;
-        cards: {
-            category: "other" | "communication" | "environment" | "transitions" | "sensory" | "regulation" | "interests";
-            title: string;
-            updatedAt: string;
-            cardId: string;
-            statement: string;
-        }[];
-        grantId: string;
-    };
-}>;
-type SupportPassportDraftCard = z.infer<typeof SupportPassportDraftCardSchema>;
-type SupportPassportDraftModelInput = Omit<z.input<typeof SupportPassportDraftModelInputSchema>, "consent"> & {
-    consent: boolean;
-};
-type SupportPassportAnswerOutput = z.infer<typeof SupportPassportAnswerOutputSchema>;
-type SupportPassportAnswerModelInput = z.input<typeof SupportPassportAnswerModelInputSchema>;
-
-type SupportPassportModelMessage = {
-    role: "system" | "user" | "assistant";
-    content: string;
-};
-type SupportPassportModelRouteKind = "local" | "direct" | "gateway";
-interface SupportPassportJsonSchema {
-    name: string;
-    schema: Record<string, unknown>;
-}
-interface SupportPassportModelUsage {
-    inputTokens?: number;
-    outputTokens?: number;
-    totalTokens?: number;
-}
-interface SupportPassportModelRouteResult {
-    content: string;
-    modelUsed: string;
-    usage?: SupportPassportModelUsage;
-}
-interface SupportPassportModelRoute {
-    kind: SupportPassportModelRouteKind;
-    timeoutMs?: number;
-    invoke(messages: SupportPassportModelMessage[], options: {
-        temperature: number;
-        maxTokens: number;
-        timeoutMs: number;
-        signal?: AbortSignal;
-        operation: string;
-        jsonSchema: SupportPassportJsonSchema;
-        acceptResponse?: (response: SupportPassportModelRouteResult) => boolean;
-    }): Promise<SupportPassportModelRouteResult | null>;
-}
-interface SupportPassportModelResultMetadata {
-    modelUsed: string;
-    route: SupportPassportModelRouteKind;
-    latencyMs: number;
-    usage?: SupportPassportModelUsage;
-}
-interface SupportPassportDraftResult extends SupportPassportModelResultMetadata {
-    cards: SupportPassportDraftCard[];
-}
-interface SupportPassportAnswerResult extends SupportPassportModelResultMetadata, SupportPassportAnswerOutput {
-}
-interface SupportPassportModelAdapterOptions {
-    routes: SupportPassportModelRoute[];
-    timeoutMs?: number;
-    nowMs?: () => number;
-}
-interface SupportPassportModelFailureMetadata extends Omit<SupportPassportModelResultMetadata, "route"> {
-    route: SupportPassportModelRouteKind | "unavailable";
-    errorClass: string;
-}
-declare class SupportPassportModelCallError extends SupportPassportError {
-    readonly metadata: SupportPassportModelFailureMetadata;
-    constructor(code: "model_output_invalid" | "provider_unavailable", message: string, status: number, metadata: SupportPassportModelFailureMetadata);
-}
-type ModelRoutePlanConfig = Pick<PluginConfig, "modelSource" | "localLlmEnabled" | "localLlmFallback" | "openaiApiKey">;
-interface SupportPassportModelClients {
-    localLlm?: LocalLlmClient;
-    gatewayRoute?: SupportPassportModelRoute;
-    directLlm?: FallbackLlmClient;
-}
-/**
- * Rebuild the route's synchronous output check after a provider-neutral model
- * request crosses a process boundary. The check uses the same schemas and
- * selected IDs as the in-process adapter.
- */
-declare function acceptsSupportPassportModelResponse(operation: string, messages: SupportPassportModelMessage[], content: string): boolean;
-declare function resolveSupportPassportModelRoutePlan(config: ModelRoutePlanConfig, availability?: {
-    gateway: boolean;
-}): SupportPassportModelRouteKind[];
-declare function buildSupportPassportDirectGatewayConfig(config: Pick<PluginConfig, "openaiApiKey" | "openaiBaseUrl" | "model">): GatewayConfig | undefined;
-declare function createSupportPassportModelAdapter(config: PluginConfig, clients?: SupportPassportModelClients): SupportPassportModelAdapter;
-declare class SupportPassportModelAdapter {
-    private readonly routes;
-    private readonly timeoutMs;
-    private readonly nowMs;
-    constructor(options: SupportPassportModelAdapterOptions);
-    draftCards(input: SupportPassportDraftModelInput, signal?: AbortSignal): Promise<SupportPassportDraftResult>;
-    answerQuestion(input: SupportPassportAnswerModelInput, signal?: AbortSignal): Promise<SupportPassportAnswerResult>;
-    private runStructured;
-    private invokeRoute;
-}
-
-type ReviewDeckChoice = "keep" | "prepare_fix" | "not_true";
-type ReviewDeckRisk = "reversible";
-interface ReviewDeckEvidence {
-    sourceMemoryId?: string;
-    sourceDate?: string;
-    excerpt?: string;
-    relation: "supports" | "conflicts" | "origin";
-}
-interface ReviewDeckItem {
-    schemaVersion: 1;
-    itemId: string;
-    source: "review";
-    sourceId: string;
-    memoryId?: string;
-    content: string;
-    category?: string;
-    lifecycleState?: string;
-    confidence?: number;
-    confidenceTier?: string;
-    reviewReason: string;
-    reviewReasonLabel: string;
-    supportCount: number;
-    provenance: readonly ReviewDeckEvidence[];
-    allowedChoices: readonly ReviewDeckChoice[];
-    choiceRisk: Readonly<Record<ReviewDeckChoice, ReviewDeckRisk | "unavailable">>;
-    namespace: string;
-    revision: string;
-}
-interface ReviewDeckPage {
-    schemaVersion: 1;
-    items: readonly ReviewDeckItem[];
-    nextCursor?: string;
-    total: number;
-}
-type ReviewDeckActionRequest = {
-    schemaVersion: 1;
-    itemId: string;
-    revision: string;
-    action: "keep" | "not_true";
-    idempotencyKey: string;
-} | {
-    schemaVersion: 1;
-    itemId: string;
-    revision: string;
-    action: "prepare_fix";
-    correctionText: string;
-    idempotencyKey: string;
-};
-interface ReviewDeckActionReceipt {
-    schemaVersion: 1;
-    receiptId: string;
-    itemId: string;
-    action: "keep" | "not_true" | "prepare_fix" | "undo";
-    outcome: "planned" | "applied" | "conflict" | "failed";
-    effect: string;
-    undoAvailable: boolean;
-    appliedRevision?: string;
-    correctionPlanId?: string;
-    correctionPreview?: unknown;
-}
-interface ReviewDeckUndoRequest {
-    schemaVersion: 1;
-    receiptId: string;
-    expectedRevision: string;
-    idempotencyKey: string;
-}
-interface ReviewDeckSourceRow {
-    itemId: string;
-    filePath: string;
-    fileContent: string;
-    revision: string;
-    content: string;
-    category?: string;
-    confidence?: number;
-    confidenceTier?: string;
-    reviewReason: string;
-    created: string;
-    source?: string;
-    blockedBy?: string;
-    lifecycleState?: string;
-    context?: string;
-}
-interface ReviewDeckSnapshot {
-    corpusVersion: string;
-    total: number;
-    rows: readonly ReviewDeckSourceRow[];
-}
-interface ReviewDeckCursorScope {
-    principalDigest: string;
-    namespace: string;
-    filterDigest: string;
-    corpusVersion: string;
-}
-declare class ReviewDeckCursorError extends Error {
-    constructor(message?: string);
-}
-declare function computeReviewItemRevision(fileContent: string): string;
-declare function projectReviewDeckItem(row: ReviewDeckSourceRow, namespace: string): ReviewDeckItem;
-declare function compareReviewDeckRows(a: ReviewDeckSourceRow, b: ReviewDeckSourceRow): number;
-declare function encodeReviewDeckCursor(scope: ReviewDeckCursorScope, lastSortKey: string): string;
-declare function decodeReviewDeckCursor(cursor: string, scope: ReviewDeckCursorScope): string;
-declare function buildReviewDeckPage(rows: readonly ReviewDeckSourceRow[], opts: {
-    scope: ReviewDeckCursorScope;
-    cursor?: string;
-    limit: number;
-}): ReviewDeckPage;
-
-interface ReviewDeckSurfaceDeps {
-    readonly orchestrator: Orchestrator;
-    resolveReadableNamespace(namespace: string | undefined, principal?: string): string;
-    writableNamespaceFor(namespace: string | undefined, sessionKey: string | undefined, authenticatedPrincipal?: string): string;
-    correctionPlan(request: CorrectionRequest, opts?: {
-        abortSignal?: AbortSignal;
-    }): Promise<CorrectionPlan>;
-}
-declare class ReviewDeckSurface {
-    private readonly deps;
-    constructor(deps: ReviewDeckSurfaceDeps);
-    list(opts: {
-        namespace?: string;
-        principal?: string;
-        cursor?: string;
-        limit: number;
-    }): Promise<ReviewDeckPage>;
-    action(req: ReviewDeckActionRequest, opts: {
-        namespace?: string;
-        principal?: string;
-        signal?: AbortSignal;
-    }): Promise<ReviewDeckActionReceipt>;
-    undo(req: ReviewDeckUndoRequest, opts: {
-        namespace?: string;
-        principal?: string;
-        signal?: AbortSignal;
-    }): Promise<ReviewDeckActionReceipt>;
-    private mutationContext;
-}
-
-/**
- * Single input-validation and error boundary for the CLI/MCP/HTTP access
- * surfaces (issue #1525, epic #1520 Phase 1).
- *
- * Every operation that crosses the access-service facade passes through ONE
- * registry entry: a zod-validated request envelope, a shared error mapper,
- * and the "reject invalid input and list valid options" behavior that
- * CLAUDE.md rules 14/17/24/28/36/48/51 previously had to be re-implemented
- * per handler. The three surfaces become thin adapters — one operation
- * definition, three transports — so a validation fix lands everywhere at
- * once.
- *
- * Host-agnostic (rule 31): operation names carry no `openclaw-*`/`engram-*`
- * prefix. Session/namespace tenancy stays in the handler layer (resolved via
- * ScopePlan #1521); the boundary validates SHAPE, not tenancy.
- */
-
-/**
- * Canonical operation ids. One id is shared by the MCP tool, the HTTP route,
- * and the CLI command that expose the same operation. Add to this union as
- * each domain-group migration PR (memory ops → connectors → namespaces …)
- * lands; the fitness test in `access-surface-catalog.test.ts` treats the
- * registered set as the migration state.
- */
-declare const OPERATION_NAMES: readonly ["memory_get", "memory_search", "external_wiki_search", "memory_store", "coding_decision", "coding_architecture", "codegraph_index", "codegraph_list_projects", "codegraph_delete_project", "codegraph_index_status", "codegraph_search_graph", "codegraph_trace_path", "codegraph_detect_changes", "codegraph_query_graph", "codegraph_get_schema", "codegraph_get_snippet", "codegraph_get_architecture", "codegraph_search_code", "codegraph_manage_adr", "codegraph_ingest_traces", "memory_correct_plan", "memory_correct_apply", "coding_delta", "recall", "recall_explain", "set_coding_context", "recall_tier_explain", "recall_xray", "who_knows", "promotion_candidates", "namespace_writable", "wearables_status", "wearables_sync", "transcript_day", "transcript_search", "transcript_memories", "location_status", "location_check", "location_sync", "location_backfill", "location_day", "meetings_list", "meetings_get", "meetings_build", "deep_recall", "memory_expand", "memory_traverse", "memory_ls", "memory_tree", "memory_find", "standup", "action_confidence", "chatgpt_memory_inspector", "day_summary", "capsule_export", "capsule_import", "capsule_list", "memory_governance_run", "entity_synthesis_run", "procedure_mining_run", "pattern_reinforcement_run", "procedural_stats", "procedure_library_maintenance", "memory_timeline", "suggestion_submit", "entity_get", "review_queue_list", "correction_pending", "observe", "lcm_search", "lcm_compaction_flush", "extraction_force_flush", "lcm_compaction_record", "continuity_audit_generate", "continuity_incident_open", "continuity_incident_close", "continuity_incident_list", "continuity_loop_add_or_update", "continuity_loop_review", "identity_anchor_get", "identity_anchor_update", "memory_identity", "work_task", "work_project", "work_board", "shared_context_write_output", "shared_feedback_record", "shared_priorities_append", "relay_mission_append", "relay_mission_read", "shared_context_cross_signals_run", "shared_context_curate_daily", "compounding_weekly_synthesize", "compounding_promote_candidate", "compression_guidelines_optimize", "compression_guidelines_activate", "memory_profile", "memory_entities_list", "memory_questions", "memory_last_recall", "memory_intent_debug", "memory_qmd_debug", "memory_graph_explain", "graph_snapshot", "memory_feedback", "memory_promote", "memory_outcome", "memory_action_apply", "context_checkpoint", "briefing", "review_list", "review_resolve", "contradiction_scan_run", "preference_drift_scan", "memory_summarize_hourly", "conversation_index_update", "profiling_report", "graph_edge_decay_run", "live_connectors_run", "peer_list", "peer_get", "peer_set", "peer_delete", "peer_profile_get", "peer_forget", "console_state", "dreams_status", "dreams_run", "support_passport_memory_preview", "support_passport_cards_list", "support_passport_draft_create", "support_passport_drafts_generate", "support_passport_card_replace", "support_passport_card_approve", "support_passport_card_reject", "support_passport_card_withdraw", "support_passport_grant_create", "support_passport_grants_list", "support_passport_grant_revoke", "support_passport_grant_read", "support_passport_grant_ask", "adapters_status", "offline_sync_snapshot", "offline_sync_snapshot_stream", "offline_sync_files", "offline_sync_file_content", "offline_sync_apply_file_content", "offline_sync_apply", "lcm_status", "memory_list", "recall_timings", "entity_list", "maintenance_status", "quality_status", "trust_zones_status", "trust_zones_records", "review_disposition", "review_deck_list", "review_deck_action", "review_deck_undo", "trust_zones_promote", "trust_zones_demo_seed", "citations_observed", "contradiction_detail", "graph_events", "chat_message", "chat_events"];
-/**
- * Canonical operation ids. One id is shared by the MCP tool, the HTTP route,
- * and the CLI command that expose the same operation. Derived from
- * {@link OPERATION_NAMES} (single source of truth) so the runtime catalog
- * used for token-capability validation cannot drift from the type. The
- * fitness test in `access-surface-catalog.test.ts` treats the registered set
- * as the migration state.
- */
-type OperationName = (typeof OPERATION_NAMES)[number];
-/**
- * Per-call context. `service` is the facade the handler delegates to; the
- * boundary never reaches past it. `authenticatedPrincipal` is resolved by
- * the SURFACE (MCP header / HTTP identity / CLI flag) before the boundary
- * runs, so handlers stay principal-source-agnostic. `hooks` carries
- * transport-level callbacks (e.g. HTTP write-quota enforcement) that must
- * fire atomically inside the service call; surfaces that have no such hook
- * leave it undefined.
- */
-interface OperationContext {
-    readonly service: EngramAccessService;
-    readonly authenticatedPrincipal?: string;
-    readonly operatorPrincipal?: string;
-    /** Per-request cancellation supplied by transports that own a request lifecycle. */
-    readonly abortSignal?: AbortSignal;
-    /** Server-resolved connector identity (Phase 1 provenance). Set by the HTTP auth boundary from the matched token's connector; flows to write handlers so frontmatter records which connector submitted the memory. Client-supplied values are always overridden. */
-    readonly sourceConnector?: string;
-    /**
-     * The PRE-validation raw envelope exactly as the transport supplied it
-     * (issue #2829). Handlers use it to retain input spellings the schema's
-     * transforms canonicalize — e.g. the memory-store category aliases — so
-     * diagnostics can name what the caller actually sent. Never trust it for
-     * behavior; only the parsed `input` is validated.
-     */
-    readonly rawInput?: unknown;
-    readonly hooks?: OperationHooks;
-}
-/**
- * Transport-level callbacks a handler forwards into the service call. Kept
- * narrow on purpose: the boundary owns validation + dispatch shape, not
- * transport policy. Add fields here only when a surface genuinely needs a
- * callback the service itself consumes.
- */
-interface OperationHooks {
-    /** HTTP write-quota gate; throws to reject the write when exhausted. */
-    readonly enforceWriteQuota?: () => void | Promise<void>;
-    /** Commit-boundary accounting for writes that can fail after durability. */
-    readonly recordWriteCommit?: () => void;
-}
-interface OperationSpec<In, Out> {
-    /** Canonical operation id; matches an {@link OperationName}. */
-    readonly name: OperationName;
-    readonly description: string;
-    /**
-     * Zod schema validating the raw request envelope. Input type may differ
-     * from the output `In` — schemas that canonicalize during parsing (issue
-     * #2829 category aliases) are first-class, declared truthfully instead of
-     * cast into an input-equals-output shape.
-     */
-    readonly schema: z.ZodType<In, z.ZodTypeDef, unknown>;
-    /** Handler invoked with the parsed input; throws EngramAccessInputError for domain faults. */
-    readonly handler: (input: In, ctx: OperationContext) => Promise<Out>;
-    /**
-     * Marks an operation as inherently FLEET-WIDE / global — it runs across ALL
-     * namespaces (or against a single non-namespaced global layer) and carries no
-     * `namespace` argument, so the MCP `tools/call` effective-namespace chokepoint
-     * never applies. When set, {@link defineOperation}'s run wrapper rejects any
-     * namespace-SCOPED token (fail closed) via assertFleetWideOperationAllowed
-     * BEFORE the handler — no side effect on denial. Unrestricted/legacy tokens
-     * (cron, internal callers, no capability record) are unaffected (issue #1850).
-     */
-    readonly fleetWide?: boolean;
-    /**
-     * Alternate op allow-list: when set, the token may invoke this operation if
-     * its ops allow-list permits ANY of these ops (instead of the default rule
-     * that requires the op's own {@link name}). Lets a read-only diagnostic be
-     * granted by the write ops it diagnoses — e.g. `namespace_writable` is
-     * runnable by any token permitted to `observe`/`memory_store`, so a token
-     * minted before the diagnostic op existed can still call it. Unrestricted /
-     * legacy tokens (no ops axis) are unaffected. Keeps the boundary and any HTTP
-     * transport for the same op enforcing ONE policy.
-     */
-    readonly allowedByOps?: readonly OperationName[];
-}
-interface BoundOperation<In = unknown, Out = unknown> {
-    readonly spec: OperationSpec<In, Out>;
-    /** Validate the raw envelope, then invoke the handler. Throws EngramAccessInputError on any validation failure. */
-    readonly run: (rawInput: unknown, ctx: OperationContext) => Promise<Out>;
-}
-/**
- * Coerce boolean-like strings at the edge (rule 36). Accepts actual booleans
- * and the string spellings clients send ("true"/"false"/"1"/"0"/"yes"/"no"/
- * "on"/"off", case-insensitive). Rejects anything else loudly — `Boolean("false")`
- * would silently be `true`, which is the bug rule 36 exists to prevent.
- *
- * `undefined`/`null`/`""` → `undefined`, so callers can keep treating an
- * absent flag as "use the default" without a separate presence check.
- */
-declare function coerceBooleanLike(value: unknown): boolean | undefined;
-/**
- * Coerce + validate a positive integer from a numeric string or number
- * (rule 28). Loosely-typed MCP/CLI clients send `"5"`; `typeof saved === "number"`
- * on read-back would reject it later, so we coerce at the edge and reject
- * booleans/objects loudly (`Number(true) === 1` would silently pass otherwise).
- *
- * `undefined`/`null`/`""` → `undefined`.
- */
-declare function coercePositiveInteger(value: unknown, label: string): number | undefined;
-/**
- * Expand `~` in a path-shaped input (rule 17). Node `fs` does NOT expand `~`;
- * ad-hoc regex drifts. `undefined`/`null`/`""` → `undefined`.
- */
-declare function normalizeOptionalPath(value: unknown): string | undefined;
-/**
- * Turn a zod failure into an {@link EngramAccessInputError} whose message
- * names the offending field and — for enum/union issues — lists the valid
- * options, so the caller can correct rather than guess (rule 51).
- */
-declare function formatZodIssues(error: z.ZodError): string;
-declare function defineOperation<In, Out>(spec: OperationSpec<In, Out>): BoundOperation<In, Out>;
-/** Look up a registered operation by canonical name. */
-declare function getOperation(name: OperationName): BoundOperation | undefined;
-/** Whether a probe must authorize an operation's effective namespace. */
-declare function operationRequiresAuthorizedNamespace(name: OperationName): boolean;
-/** Whether an operation resolves its namespace from the authenticated principal. */
-declare function operationUsesPrincipalNamespace(name: OperationName): boolean;
-/** All registered operation names. */
-declare function listRegisteredOperations(): readonly OperationName[];
-/** Test-only: clear the registry so pilot definitions can be re-registered. */
-declare function __resetRegistryForTest(): void;
-
-declare const SUPPORT_PASSPORT_CARD_CATEGORIES: readonly ["communication", "environment", "transitions", "sensory", "regulation", "interests", "other"];
-declare const SUPPORT_PASSPORT_CARD_STATUSES: readonly ["pending_review", "active", "rejected", "superseded", "archived"];
-declare const SupportPassportCardCategorySchema: z.ZodEnum<["communication", "environment", "transitions", "sensory", "regulation", "interests", "other"]>;
-declare const SupportPassportCardStatusSchema: z.ZodEnum<["pending_review", "active", "rejected", "superseded", "archived"]>;
-declare const SupportPassportCardTitleSchema: z.ZodEffects<z.ZodString, string, string>;
-declare const SupportPassportNamespaceSchema: z.ZodEffects<z.ZodString, string, string>;
-declare const SupportPassportMemoryIdSchema: z.ZodString;
-declare const SUPPORT_PASSPORT_SOURCE_MEMORY_ID_MAX_LENGTH = 512;
-declare const SupportPassportSourceMemoryIdSchema: z.ZodString;
-declare const SupportPassportCardSchema: z.ZodObject<{
-    cardId: z.ZodString;
-    title: z.ZodEffects<z.ZodString, string, string>;
-    statement: z.ZodString;
-    category: z.ZodEnum<["communication", "environment", "transitions", "sensory", "regulation", "interests", "other"]>;
-    status: z.ZodEnum<["pending_review", "active", "rejected", "superseded", "archived"]>;
-    updatedAt: z.ZodEffects<z.ZodString, string, string>;
-    reviewBy: z.ZodEffects<z.ZodString, string, string>;
-    revision: z.ZodString;
-}, "strict", z.ZodTypeAny, {
-    category: "other" | "communication" | "environment" | "transitions" | "sensory" | "regulation" | "interests";
-    status: "active" | "pending_review" | "rejected" | "superseded" | "archived";
-    title: string;
-    updatedAt: string;
-    revision: string;
-    cardId: string;
-    statement: string;
-    reviewBy: string;
-}, {
-    category: "other" | "communication" | "environment" | "transitions" | "sensory" | "regulation" | "interests";
-    status: "active" | "pending_review" | "rejected" | "superseded" | "archived";
-    title: string;
-    updatedAt: string;
-    revision: string;
-    cardId: string;
-    statement: string;
-    reviewBy: string;
-}>;
-declare const SupportPassportCardListSchema: z.ZodEffects<z.ZodArray<z.ZodObject<{
-    cardId: z.ZodString;
-    title: z.ZodEffects<z.ZodString, string, string>;
-    statement: z.ZodString;
-    category: z.ZodEnum<["communication", "environment", "transitions", "sensory", "regulation", "interests", "other"]>;
-    status: z.ZodEnum<["pending_review", "active", "rejected", "superseded", "archived"]>;
-    updatedAt: z.ZodEffects<z.ZodString, string, string>;
-    reviewBy: z.ZodEffects<z.ZodString, string, string>;
-    revision: z.ZodString;
-}, "strict", z.ZodTypeAny, {
-    category: "other" | "communication" | "environment" | "transitions" | "sensory" | "regulation" | "interests";
-    status: "active" | "pending_review" | "rejected" | "superseded" | "archived";
-    title: string;
-    updatedAt: string;
-    revision: string;
-    cardId: string;
-    statement: string;
-    reviewBy: string;
-}, {
-    category: "other" | "communication" | "environment" | "transitions" | "sensory" | "regulation" | "interests";
-    status: "active" | "pending_review" | "rejected" | "superseded" | "archived";
-    title: string;
-    updatedAt: string;
-    revision: string;
-    cardId: string;
-    statement: string;
-    reviewBy: string;
-}>, "many">, {
-    category: "other" | "communication" | "environment" | "transitions" | "sensory" | "regulation" | "interests";
-    status: "active" | "pending_review" | "rejected" | "superseded" | "archived";
-    title: string;
-    updatedAt: string;
-    revision: string;
-    cardId: string;
-    statement: string;
-    reviewBy: string;
-}[], {
-    category: "other" | "communication" | "environment" | "transitions" | "sensory" | "regulation" | "interests";
-    status: "active" | "pending_review" | "rejected" | "superseded" | "archived";
-    title: string;
-    updatedAt: string;
-    revision: string;
-    cardId: string;
-    statement: string;
-    reviewBy: string;
-}[]>;
-declare const SupportPassportListCardsInputSchema: z.ZodObject<{
-    principal: z.ZodString;
-}, "strict", z.ZodTypeAny, {
-    principal: string;
-}, {
-    principal: string;
-}>;
-declare const SupportPassportManualDraftInputSchema: z.ZodObject<{
-    principal: z.ZodString;
-    title: z.ZodEffects<z.ZodString, string, string>;
-    statement: z.ZodString;
-    category: z.ZodEnum<["communication", "environment", "transitions", "sensory", "regulation", "interests", "other"]>;
-    reviewBy: z.ZodEffects<z.ZodString, string, string>;
-}, "strict", z.ZodTypeAny, {
-    category: "other" | "communication" | "environment" | "transitions" | "sensory" | "regulation" | "interests";
-    title: string;
-    statement: string;
-    reviewBy: string;
-    principal: string;
-}, {
-    category: "other" | "communication" | "environment" | "transitions" | "sensory" | "regulation" | "interests";
-    title: string;
-    statement: string;
-    reviewBy: string;
-    principal: string;
-}>;
-declare const SupportPassportCardMutationInputSchema: z.ZodObject<{
-    principal: z.ZodString;
-    cardId: z.ZodString;
-    expectedRevision: z.ZodString;
-    reasonCode: z.ZodOptional<z.ZodString>;
-}, "strict", z.ZodTypeAny, {
-    cardId: string;
-    principal: string;
-    expectedRevision: string;
-    reasonCode?: string | undefined;
-}, {
-    cardId: string;
-    principal: string;
-    expectedRevision: string;
-    reasonCode?: string | undefined;
-}>;
-declare const SupportPassportReplaceCardInputSchema: z.ZodObject<{
-    principal: z.ZodString;
-    cardId: z.ZodString;
-    expectedRevision: z.ZodString;
-    reasonCode: z.ZodOptional<z.ZodString>;
-} & {
-    title: z.ZodEffects<z.ZodString, string, string>;
-    statement: z.ZodString;
-    category: z.ZodEnum<["communication", "environment", "transitions", "sensory", "regulation", "interests", "other"]>;
-    reviewBy: z.ZodEffects<z.ZodString, string, string>;
-}, "strict", z.ZodTypeAny, {
-    category: "other" | "communication" | "environment" | "transitions" | "sensory" | "regulation" | "interests";
-    title: string;
-    cardId: string;
-    statement: string;
-    reviewBy: string;
-    principal: string;
-    expectedRevision: string;
-    reasonCode?: string | undefined;
-}, {
-    category: "other" | "communication" | "environment" | "transitions" | "sensory" | "regulation" | "interests";
-    title: string;
-    cardId: string;
-    statement: string;
-    reviewBy: string;
-    principal: string;
-    expectedRevision: string;
-    reasonCode?: string | undefined;
-}>;
-type SupportPassportCard = z.infer<typeof SupportPassportCardSchema>;
-type SupportPassportCardCategory = z.infer<typeof SupportPassportCardCategorySchema>;
-type SupportPassportCardStatus = z.infer<typeof SupportPassportCardStatusSchema>;
-type SupportPassportManualDraftInput = z.input<typeof SupportPassportManualDraftInputSchema>;
-type SupportPassportCardMutationInput = z.input<typeof SupportPassportCardMutationInputSchema>;
-type SupportPassportReplaceCardInput = z.input<typeof SupportPassportReplaceCardInputSchema>;
-type RevisionFields = Omit<SupportPassportCard, "revision">;
-declare function computeSupportPassportCardRevision(fields: RevisionFields): string;
-
-interface SupportPassportOwnerScope {
-    principal: string;
-    namespace: string;
-    storage: StorageManager;
-}
-interface SupportPassportCardServiceDependencies {
-    resolveOwner(principal: string): Promise<SupportPassportOwnerScope>;
-    now?: () => Date;
-}
-
-declare const SupportPassportGrantCardRefSchema: z.ZodObject<{
-    cardId: z.ZodString;
-    revision: z.ZodString;
-}, "strict", z.ZodTypeAny, {
-    revision: string;
-    cardId: string;
-}, {
-    revision: string;
-    cardId: string;
-}>;
-declare const SupportPassportGrantStateSchema: z.ZodEffects<z.ZodObject<{
-    schemaVersion: z.ZodLiteral<1>;
-    stateVersion: z.ZodNumber;
-    grantId: z.ZodEffects<z.ZodString, string, string>;
-    namespace: z.ZodEffects<z.ZodString, string, string>;
-    principalHash: z.ZodString;
-    ownerLockKey: z.ZodString;
-    secretHash: z.ZodString;
-    cards: z.ZodArray<z.ZodObject<{
-        cardId: z.ZodString;
-        revision: z.ZodString;
-    }, "strict", z.ZodTypeAny, {
-        revision: string;
-        cardId: string;
-    }, {
-        revision: string;
-        cardId: string;
-    }>, "many">;
-    createdAt: z.ZodEffects<z.ZodString, string, string>;
-    expiresAt: z.ZodEffects<z.ZodString, string, string>;
-    revokedAt: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
-}, "strict", z.ZodTypeAny, {
-    namespace: string;
-    createdAt: string;
-    expiresAt: string;
-    schemaVersion: 1;
-    cards: {
-        revision: string;
-        cardId: string;
-    }[];
-    stateVersion: number;
-    grantId: string;
-    principalHash: string;
-    ownerLockKey: string;
-    secretHash: string;
-    revokedAt?: string | undefined;
-}, {
-    namespace: string;
-    createdAt: string;
-    expiresAt: string;
-    schemaVersion: 1;
-    cards: {
-        revision: string;
-        cardId: string;
-    }[];
-    stateVersion: number;
-    grantId: string;
-    principalHash: string;
-    ownerLockKey: string;
-    secretHash: string;
-    revokedAt?: string | undefined;
-}>, {
-    namespace: string;
-    createdAt: string;
-    expiresAt: string;
-    schemaVersion: 1;
-    cards: {
-        revision: string;
-        cardId: string;
-    }[];
-    stateVersion: number;
-    grantId: string;
-    principalHash: string;
-    ownerLockKey: string;
-    secretHash: string;
-    revokedAt?: string | undefined;
-}, {
-    namespace: string;
-    createdAt: string;
-    expiresAt: string;
-    schemaVersion: 1;
-    cards: {
-        revision: string;
-        cardId: string;
-    }[];
-    stateVersion: number;
-    grantId: string;
-    principalHash: string;
-    ownerLockKey: string;
-    secretHash: string;
-    revokedAt?: string | undefined;
-}>;
-declare const SupportPassportCreateGrantInputSchema: z.ZodEffects<z.ZodObject<{
-    principal: z.ZodString;
-    cards: z.ZodArray<z.ZodObject<{
-        cardId: z.ZodString;
-        revision: z.ZodString;
-    }, "strict", z.ZodTypeAny, {
-        revision: string;
-        cardId: string;
-    }, {
-        revision: string;
-        cardId: string;
-    }>, "many">;
-    expiresAt: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
-    durationMs: z.ZodOptional<z.ZodNumber>;
-}, "strict", z.ZodTypeAny, {
-    principal: string;
-    cards: {
-        revision: string;
-        cardId: string;
-    }[];
-    durationMs?: number | undefined;
-    expiresAt?: string | undefined;
-}, {
-    principal: string;
-    cards: {
-        revision: string;
-        cardId: string;
-    }[];
-    durationMs?: number | undefined;
-    expiresAt?: string | undefined;
-}>, {
-    principal: string;
-    cards: {
-        revision: string;
-        cardId: string;
-    }[];
-    durationMs?: number | undefined;
-    expiresAt?: string | undefined;
-}, {
-    principal: string;
-    cards: {
-        revision: string;
-        cardId: string;
-    }[];
-    durationMs?: number | undefined;
-    expiresAt?: string | undefined;
-}>;
-declare const SupportPassportCreateGrantRequestSchema: z.ZodEffects<z.ZodObject<{
-    cardIds: z.ZodArray<z.ZodString, "many">;
-    cardRevisions: z.ZodArray<z.ZodObject<{
-        cardId: z.ZodString;
-        revision: z.ZodString;
-    }, "strict", z.ZodTypeAny, {
-        revision: string;
-        cardId: string;
-    }, {
-        revision: string;
-        cardId: string;
-    }>, "many">;
-    expiresAt: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
-    durationMs: z.ZodOptional<z.ZodNumber>;
-}, "strict", z.ZodTypeAny, {
-    cardIds: string[];
-    cardRevisions: {
-        revision: string;
-        cardId: string;
-    }[];
-    durationMs?: number | undefined;
-    expiresAt?: string | undefined;
-}, {
-    cardIds: string[];
-    cardRevisions: {
-        revision: string;
-        cardId: string;
-    }[];
-    durationMs?: number | undefined;
-    expiresAt?: string | undefined;
-}>, {
-    cardIds: string[];
-    cardRevisions: {
-        revision: string;
-        cardId: string;
-    }[];
-    durationMs?: number | undefined;
-    expiresAt?: string | undefined;
-}, {
-    cardIds: string[];
-    cardRevisions: {
-        revision: string;
-        cardId: string;
-    }[];
-    durationMs?: number | undefined;
-    expiresAt?: string | undefined;
-}>;
-declare const SupportPassportOwnerCreateGrantRequestSchema: z.ZodEffects<z.ZodObject<{
-    cardIds: z.ZodArray<z.ZodString, "many">;
-    cardRevisions: z.ZodArray<z.ZodObject<{
-        cardId: z.ZodString;
-        revision: z.ZodString;
-    }, "strict", z.ZodTypeAny, {
-        revision: string;
-        cardId: string;
-    }, {
-        revision: string;
-        cardId: string;
-    }>, "many">;
-    expiresAt: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
-    durationMs: z.ZodOptional<z.ZodNumber>;
-}, "strict", z.ZodTypeAny, {
-    cardIds: string[];
-    cardRevisions: {
-        revision: string;
-        cardId: string;
-    }[];
-    durationMs?: number | undefined;
-    expiresAt?: string | undefined;
-}, {
-    cardIds: string[];
-    cardRevisions: {
-        revision: string;
-        cardId: string;
-    }[];
-    durationMs?: number | undefined;
-    expiresAt?: string | undefined;
-}>, {
-    cardIds: string[];
-    cardRevisions: {
-        revision: string;
-        cardId: string;
-    }[];
-    durationMs?: number | undefined;
-    expiresAt?: string | undefined;
-}, {
-    cardIds: string[];
-    cardRevisions: {
-        revision: string;
-        cardId: string;
-    }[];
-    durationMs?: number | undefined;
-    expiresAt?: string | undefined;
-}>;
-declare const SupportPassportOwnerGrantSchema: z.ZodObject<{
-    grantId: z.ZodEffects<z.ZodString, string, string>;
-    stateVersion: z.ZodNumber;
-    cards: z.ZodArray<z.ZodObject<{
-        cardId: z.ZodString;
-        revision: z.ZodString;
-    }, "strict", z.ZodTypeAny, {
-        revision: string;
-        cardId: string;
-    }, {
-        revision: string;
-        cardId: string;
-    }>, "many">;
-    createdAt: z.ZodEffects<z.ZodString, string, string>;
-    expiresAt: z.ZodEffects<z.ZodString, string, string>;
-    revokedAt: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
-    status: z.ZodEnum<["active", "expired", "revoked"]>;
-}, "strict", z.ZodTypeAny, {
-    createdAt: string;
-    expiresAt: string;
-    status: "active" | "expired" | "revoked";
-    cards: {
-        revision: string;
-        cardId: string;
-    }[];
-    stateVersion: number;
-    grantId: string;
-    revokedAt?: string | undefined;
-}, {
-    createdAt: string;
-    expiresAt: string;
-    status: "active" | "expired" | "revoked";
-    cards: {
-        revision: string;
-        cardId: string;
-    }[];
-    stateVersion: number;
-    grantId: string;
-    revokedAt?: string | undefined;
-}>;
-declare const SupportPassportCreatedGrantSchema: z.ZodObject<{
-    grant: z.ZodObject<{
-        grantId: z.ZodEffects<z.ZodString, string, string>;
-        stateVersion: z.ZodNumber;
-        cards: z.ZodArray<z.ZodObject<{
-            cardId: z.ZodString;
-            revision: z.ZodString;
-        }, "strict", z.ZodTypeAny, {
-            revision: string;
-            cardId: string;
-        }, {
-            revision: string;
-            cardId: string;
-        }>, "many">;
-        createdAt: z.ZodEffects<z.ZodString, string, string>;
-        expiresAt: z.ZodEffects<z.ZodString, string, string>;
-        revokedAt: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
-        status: z.ZodEnum<["active", "expired", "revoked"]>;
-    }, "strict", z.ZodTypeAny, {
-        createdAt: string;
-        expiresAt: string;
-        status: "active" | "expired" | "revoked";
-        cards: {
-            revision: string;
-            cardId: string;
-        }[];
-        stateVersion: number;
-        grantId: string;
-        revokedAt?: string | undefined;
-    }, {
-        createdAt: string;
-        expiresAt: string;
-        status: "active" | "expired" | "revoked";
-        cards: {
-            revision: string;
-            cardId: string;
-        }[];
-        stateVersion: number;
-        grantId: string;
-        revokedAt?: string | undefined;
-    }>;
-    secret: z.ZodString;
-}, "strict", z.ZodTypeAny, {
-    secret: string;
-    grant: {
-        createdAt: string;
-        expiresAt: string;
-        status: "active" | "expired" | "revoked";
-        cards: {
-            revision: string;
-            cardId: string;
-        }[];
-        stateVersion: number;
-        grantId: string;
-        revokedAt?: string | undefined;
-    };
-}, {
-    secret: string;
-    grant: {
-        createdAt: string;
-        expiresAt: string;
-        status: "active" | "expired" | "revoked";
-        cards: {
-            revision: string;
-            cardId: string;
-        }[];
-        stateVersion: number;
-        grantId: string;
-        revokedAt?: string | undefined;
-    };
-}>;
-declare const SupportPassportPublicCardSchema: z.ZodObject<{
-    cardId: z.ZodString;
-    title: z.ZodString;
-    statement: z.ZodString;
-    category: z.ZodEnum<["communication", "environment", "transitions", "sensory", "regulation", "interests", "other"]>;
-    updatedAt: z.ZodEffects<z.ZodString, string, string>;
-}, "strict", z.ZodTypeAny, {
-    category: "other" | "communication" | "environment" | "transitions" | "sensory" | "regulation" | "interests";
-    title: string;
-    updatedAt: string;
-    cardId: string;
-    statement: string;
-}, {
-    category: "other" | "communication" | "environment" | "transitions" | "sensory" | "regulation" | "interests";
-    title: string;
-    updatedAt: string;
-    cardId: string;
-    statement: string;
-}>;
-declare const SupportPassportPublicGuideSchema: z.ZodObject<{
-    schemaVersion: z.ZodLiteral<1>;
-    grantId: z.ZodEffects<z.ZodString, string, string>;
-    expiresAt: z.ZodEffects<z.ZodString, string, string>;
-    updatedAt: z.ZodEffects<z.ZodString, string, string>;
-    cards: z.ZodArray<z.ZodObject<{
-        cardId: z.ZodString;
-        title: z.ZodString;
-        statement: z.ZodString;
-        category: z.ZodEnum<["communication", "environment", "transitions", "sensory", "regulation", "interests", "other"]>;
-        updatedAt: z.ZodEffects<z.ZodString, string, string>;
-    }, "strict", z.ZodTypeAny, {
-        category: "other" | "communication" | "environment" | "transitions" | "sensory" | "regulation" | "interests";
-        title: string;
-        updatedAt: string;
-        cardId: string;
-        statement: string;
-    }, {
-        category: "other" | "communication" | "environment" | "transitions" | "sensory" | "regulation" | "interests";
-        title: string;
-        updatedAt: string;
-        cardId: string;
-        statement: string;
-    }>, "many">;
-}, "strict", z.ZodTypeAny, {
-    expiresAt: string;
-    schemaVersion: 1;
-    updatedAt: string;
-    cards: {
-        category: "other" | "communication" | "environment" | "transitions" | "sensory" | "regulation" | "interests";
-        title: string;
-        updatedAt: string;
-        cardId: string;
-        statement: string;
-    }[];
-    grantId: string;
-}, {
-    expiresAt: string;
-    schemaVersion: 1;
-    updatedAt: string;
-    cards: {
-        category: "other" | "communication" | "environment" | "transitions" | "sensory" | "regulation" | "interests";
-        title: string;
-        updatedAt: string;
-        cardId: string;
-        statement: string;
-    }[];
-    grantId: string;
-}>;
-declare const SupportPassportRevokeGrantInputSchema: z.ZodObject<{
-    principal: z.ZodString;
-    grantId: z.ZodEffects<z.ZodString, string, string>;
-    expectedStateVersion: z.ZodOptional<z.ZodNumber>;
-}, "strict", z.ZodTypeAny, {
-    principal: string;
-    grantId: string;
-    expectedStateVersion?: number | undefined;
-}, {
-    principal: string;
-    grantId: string;
-    expectedStateVersion?: number | undefined;
-}>;
-declare const SupportPassportListGrantsInputSchema: z.ZodObject<{
-    principal: z.ZodString;
-}, "strict", z.ZodTypeAny, {
-    principal: string;
-}, {
-    principal: string;
-}>;
-type SupportPassportGrantCardRef = z.infer<typeof SupportPassportGrantCardRefSchema>;
-type SupportPassportGrantState = z.infer<typeof SupportPassportGrantStateSchema>;
-type SupportPassportCreateGrantInput = z.input<typeof SupportPassportCreateGrantInputSchema>;
-type SupportPassportCreateGrantRequest = z.input<typeof SupportPassportCreateGrantRequestSchema>;
-type SupportPassportOwnerCreateGrantRequest = z.input<typeof SupportPassportOwnerCreateGrantRequestSchema>;
-type SupportPassportOwnerGrant = z.infer<typeof SupportPassportOwnerGrantSchema>;
-type SupportPassportCreatedGrant = z.infer<typeof SupportPassportCreatedGrantSchema>;
-type SupportPassportPublicGuide = z.infer<typeof SupportPassportPublicGuideSchema>;
-type SupportPassportRevokeGrantInput = z.input<typeof SupportPassportRevokeGrantInputSchema>;
-
-declare const SupportPassportModelAuditRecordSchema: z.ZodEffects<z.ZodObject<{
-    schemaVersion: z.ZodLiteral<1>;
-    operation: z.ZodEnum<["draft_cards", "answer_question"]>;
-    actorHash: z.ZodString;
-    subjectIdsHash: z.ZodString;
-    modelUsed: z.ZodString;
-    route: z.ZodEnum<["local", "direct", "gateway", "unavailable"]>;
-    outputSchemaVersion: z.ZodLiteral<1>;
-    outcome: z.ZodEnum<["success", "error"]>;
-    errorClass: z.ZodOptional<z.ZodString>;
-    occurredAt: z.ZodString;
-    latencyMs: z.ZodNumber;
-    usage: z.ZodOptional<z.ZodObject<{
-        inputTokens: z.ZodOptional<z.ZodNumber>;
-        outputTokens: z.ZodOptional<z.ZodNumber>;
-        totalTokens: z.ZodOptional<z.ZodNumber>;
-    }, "strict", z.ZodTypeAny, {
-        inputTokens?: number | undefined;
-        outputTokens?: number | undefined;
-        totalTokens?: number | undefined;
-    }, {
-        inputTokens?: number | undefined;
-        outputTokens?: number | undefined;
-        totalTokens?: number | undefined;
-    }>>;
-}, "strict", z.ZodTypeAny, {
-    schemaVersion: 1;
-    outcome: "error" | "success";
-    latencyMs: number;
-    modelUsed: string;
-    operation: "draft_cards" | "answer_question";
-    route: "unavailable" | "direct" | "local" | "gateway";
-    actorHash: string;
-    subjectIdsHash: string;
-    outputSchemaVersion: 1;
-    occurredAt: string;
-    usage?: {
-        inputTokens?: number | undefined;
-        outputTokens?: number | undefined;
-        totalTokens?: number | undefined;
-    } | undefined;
-    errorClass?: string | undefined;
-}, {
-    schemaVersion: 1;
-    outcome: "error" | "success";
-    latencyMs: number;
-    modelUsed: string;
-    operation: "draft_cards" | "answer_question";
-    route: "unavailable" | "direct" | "local" | "gateway";
-    actorHash: string;
-    subjectIdsHash: string;
-    outputSchemaVersion: 1;
-    occurredAt: string;
-    usage?: {
-        inputTokens?: number | undefined;
-        outputTokens?: number | undefined;
-        totalTokens?: number | undefined;
-    } | undefined;
-    errorClass?: string | undefined;
-}>, {
-    schemaVersion: 1;
-    outcome: "error" | "success";
-    latencyMs: number;
-    modelUsed: string;
-    operation: "draft_cards" | "answer_question";
-    route: "unavailable" | "direct" | "local" | "gateway";
-    actorHash: string;
-    subjectIdsHash: string;
-    outputSchemaVersion: 1;
-    occurredAt: string;
-    usage?: {
-        inputTokens?: number | undefined;
-        outputTokens?: number | undefined;
-        totalTokens?: number | undefined;
-    } | undefined;
-    errorClass?: string | undefined;
-}, {
-    schemaVersion: 1;
-    outcome: "error" | "success";
-    latencyMs: number;
-    modelUsed: string;
-    operation: "draft_cards" | "answer_question";
-    route: "unavailable" | "direct" | "local" | "gateway";
-    actorHash: string;
-    subjectIdsHash: string;
-    outputSchemaVersion: 1;
-    occurredAt: string;
-    usage?: {
-        inputTokens?: number | undefined;
-        outputTokens?: number | undefined;
-        totalTokens?: number | undefined;
-    } | undefined;
-    errorClass?: string | undefined;
-}>;
-type SupportPassportModelAuditRecord = z.infer<typeof SupportPassportModelAuditRecordSchema>;
-interface SupportPassportModelAuditSink {
-    record(record: SupportPassportModelAuditRecord): Promise<void>;
-}
-declare function hashSupportPassportAuditValues(domain: string, values: string[]): string;
-declare class SupportPassportModelAuditStore implements SupportPassportModelAuditSink {
-    private memoryDir;
-    private auditDir;
-    private memoryRootReady?;
-    private readonly runWithHeldFileLock;
-    constructor(options: {
-        memoryDir: string;
-        withHeldFileLock?: typeof withHeldFileLock;
-    });
-    record(input: SupportPassportModelAuditRecord): Promise<void>;
-    private ensureSafeDirectories;
-    private ensureMemoryRoot;
-}
-
-interface SupportPassportAccessSurfaceDependencies {
-    config: PluginConfig;
-    resolveOwner(principal: string): Promise<SupportPassportOwnerScope>;
-    resolveNamespace(namespace: string): Promise<StorageManager>;
-    modelAdapter?: SupportPassportModelAdapter;
-    audit?: SupportPassportModelAuditSink;
-    now?: () => Date;
-    platform?: NodeJS.Platform;
-}
-interface SupportPassportCreateGrantResult {
-    grantId: string;
-    secret: string;
-    expiresAt: string;
-    version: number;
-}
-interface SupportPassportRevokeGrantResult {
-    grantId: string;
-    revokedAt: string;
-    version: number;
-}
-type SupportPassportMemoryPreview = {
-    found: false;
-} | {
-    found: true;
-    memory: {
-        id: string;
-        content: string;
-        revision: string;
-    };
-};
-declare class SupportPassportAccessSurface {
-    private readonly config;
-    private readonly cardService;
-    private readonly grantService;
-    private readonly draftService;
-    private readonly questionService;
-    private readonly resolveOwner;
-    private readonly now;
-    private readonly platformSupported;
-    constructor(dependencies: SupportPassportAccessSurfaceDependencies);
-    listCards(principal: string): Promise<SupportPassportCard[]>;
-    previewMemory(principal: string, memoryId: string): Promise<SupportPassportMemoryPreview>;
-    createManualDraft(principal: string, input: {
-        title: string;
-        statement: string;
-        category: SupportPassportCardCategory;
-        reviewBy: string;
-    }, options?: {
-        signal?: AbortSignal;
-        onCommitted?: () => void;
-    }): Promise<SupportPassportCard>;
-    generateDrafts(principal: string, input: {
-        sourceMemoryIds: string[];
-        sourceMemoryRevisions: Array<{
-            memoryId: string;
-            revision: string;
-        }>;
-        consent: boolean;
-        signal?: AbortSignal;
-        onCommitted?: () => void;
-    }): Promise<SupportPassportCard[]>;
-    replaceCard(principal: string, cardId: string, input: {
-        title: string;
-        statement: string;
-        category: SupportPassportCardCategory;
-        reviewBy: string;
-        expectedRevision: string;
-    }, options?: {
-        signal?: AbortSignal;
-        onCommitted?: () => void;
-    }): Promise<SupportPassportCard>;
-    approveCard(principal: string, cardId: string, input: {
-        expectedRevision: string;
-        reasonCode?: string;
-    }, options?: {
-        signal?: AbortSignal;
-        onCommitted?: () => void;
-    }): Promise<SupportPassportCard>;
-    rejectCard(principal: string, cardId: string, input: {
-        expectedRevision: string;
-        reasonCode?: string;
-    }, options?: {
-        signal?: AbortSignal;
-        onCommitted?: () => void;
-    }): Promise<SupportPassportCard>;
-    withdrawCard(principal: string, cardId: string, input: {
-        expectedRevision: string;
-        reasonCode?: string;
-    }, options?: {
-        signal?: AbortSignal;
-        onCommitted?: () => void;
-    }): Promise<SupportPassportCard>;
-    createGrant(principal: string, input: SupportPassportCreateGrantRequest, options?: {
-        signal?: AbortSignal;
-        onCommitted?: () => void;
-    }): Promise<SupportPassportCreateGrantResult>;
-    listGrants(principal: string): Promise<SupportPassportOwnerGrant[]>;
-    revokeGrant(principal: string, grantId: string, input: {
-        expectedVersion?: number;
-    }, options?: {
-        signal?: AbortSignal;
-        onCommitted?: () => void;
-    }): Promise<SupportPassportRevokeGrantResult>;
-    readGrant(grantId: string, secret: string): Promise<SupportPassportPublicGuide>;
-    askGrant(grantId: string, secret: string, question: string, signal?: AbortSignal): Promise<SupportPassportAnswerOutput>;
-    private requireEnabled;
-    private requirePrincipal;
-    private invalidGrantInput;
-}
-
-type JsonRpcId = string | number | null;
-type JsonRpcRequest = {
-    jsonrpc?: string;
-    id?: JsonRpcId;
-    method?: string;
-    params?: Record<string, unknown>;
-};
-type McpRequestOptions = {
-    principalOverride?: string;
-    namespaceOverride?: string;
-    sessionKeyOverride?: string;
-    sessionId?: string;
-    correlationId?: string;
-    /**
-     * Write-quota enforcer forwarded into observe's idempotency lock
-     * (issue #1649). Only the MCP-over-HTTP transport supplies this (it owns
-     * the write-rate-limit window); the standalone MCP server has no quota.
-     */
-    enforceWriteQuota?: () => void | Promise<void>;
-    /**
-     * Called once when a lifecycle write reaches its durable commit boundary.
-     * HTTP transports use this to account writes even when post-commit work
-     * fails or the client disconnects before a response is available.
-     */
-    recordWriteCommit?: () => void;
-    /**
-     * Server-resolved connector identity (Phase 1 provenance). Set by the HTTP
-     * auth boundary from the matched token entry's connector; threaded into
-     * the operation context so write handlers stamp it onto frontmatter.
-     */
-    sourceConnector?: string;
-    /** HTTP request lifetime; absent for the standalone stdio transport. */
-    abortSignal?: AbortSignal;
-};
-type McpTool = {
-    name: string;
-    title?: string;
-    description: string;
-    inputSchema: Record<string, unknown>;
-    outputSchema?: Record<string, unknown>;
-    annotations?: Record<string, unknown>;
-    _meta?: Record<string, unknown>;
-};
-/**
- * MCP protocol versions this server understands, ordered newest → oldest.
- * Exported so the HTTP transport can validate the `MCP-Protocol-Version`
- * header and reject requests advertising an unknown version.
- */
-declare const MCP_SUPPORTED_PROTOCOL_VERSIONS: readonly string[];
-declare const MCP_MIGRATED_OPERATIONS: Readonly<Record<string, OperationName>>;
-declare class EngramMcpServer {
-    private readonly service;
-    private buffer;
-    private flushTask;
-    private readonly tools;
-    private readonly resources;
-    private readonly resourceTextByUri;
-    private readonly authenticatedPrincipal?;
-    /**
-     * MCP client info keyed by server-assigned session ID. On each `initialize`
-     * handshake the server generates a UUID, stores the client's clientInfo
-     * against it, and returns the ID as `Mcp-Session-Id` in the response
-     * metadata. Subsequent requests from the same client include this header,
-     * allowing per-session clientInfo lookup without cross-session leaks.
-     */
-    private clientInfoBySession;
-    /**
-     * Session IDs generated during initialize, keyed by caller-supplied correlation
-     * ID (unique per HTTP request) to avoid collisions when multiple clients send
-     * initialize with the same JSON-RPC id concurrently.
-     */
-    private initSessionIds;
-    /**
-     * Whether oai-mem-citation guidance is explicitly enabled via config.
-     */
-    private readonly citationsEnabled;
-    /** Whether to auto-enable citations for Codex adapter connections. */
-    private readonly citationsAutoDetect;
-    /**
-     * Whether to advertise legacy `engram.*` tool aliases alongside the canonical
-     * `remnic.*` names (issue #1427). Defaults to true for backward compatibility;
-     * set false to halve the advertised `tools/list` surface.
-     */
-    private readonly emitLegacyTools;
-    /**
-     * Whether the `coding_decision` tool should appear in `tools/list`. Gated on
-     * `codingKnowledge.enabled && codingKnowledge.decisionRecords` (issue #1548
-     * Track A PR 2, rule 39). When false the tools array is byte-identical to
-     * pre-feature.
-     */
-    private readonly codingDecisionVisible;
-    /**
-     * Whether the `coding_architecture` tool should appear in `tools/list`.
-     * Gated on `codingKnowledge.enabled && codingKnowledge.architectureCard`
-     * (issue #1548 Track A PR 3, rule 39).
-     */
-    private readonly architectureCardVisible;
-    /**
-     * Whether the 14 codegraph parity tools should appear in `tools/list`
-     * (issue #1554). Config-only -- runtime availability is checked at call
-     * time. When false the tools array is byte-identical to pre-feature.
-     */
-    private readonly codegraphVisible;
-    private readonly sessionDeltaVisible;
-    /**
-     * Whether the two correction tools (memory_correct_plan / memory_correct_apply)
-     * should appear in `tools/list` (issue #1580). Gated on `correction.enabled`
-     * (default true — plan is read-only; safe on). When false the tools array is
-     * byte-identical to pre-feature.
-     */
-    private readonly correctionVisible;
-    /**
-     * Whether the `memory_chat` tool should appear in `tools/list` (issue
-     * #1583). Gated on `chat.enabled`. When false the tools array is
-     * byte-identical to pre-feature (rule 39).
-     */
-    private readonly chatVisible;
-    constructor(service: EngramAccessService, options?: {
-        principal?: string;
-        citationsEnabled?: boolean;
-        citationsAutoDetect?: boolean;
-        emitLegacyTools?: boolean;
-        codingDecisionVisible?: boolean;
-        architectureCardVisible?: boolean;
-        codegraphVisible?: boolean;
-        sessionDeltaVisible?: boolean;
-        correctionVisible?: boolean;
-        chatVisible?: boolean;
-    });
-    /** Get clientInfo for a specific MCP session. Returns undefined for non-MCP requests. */
-    getClientInfo(sessionId?: string): {
-        name: string;
-        version?: string;
-    } | undefined;
-    /** Pop the session ID generated during an initialize handshake, keyed by correlation ID. */
-    popInitSessionId(correlationId: string): string | undefined;
-    handleRequest(request: JsonRpcRequest, options?: McpRequestOptions): Promise<Record<string, unknown> | null>;
-    runStdio(input: Readable, output: Writable): Promise<void>;
-    private scheduleFlush;
-    private flushBuffer;
-    private writeMessage;
-    private toolAcceptsArgument;
-    /**
-     * Whether a tool accepts a `namespace` argument — i.e. it is a
-     * namespace-scoped operation whose effective namespace MUST be gated by the
-     * per-token allow-list. Exposed (public) so the HTTP MCP transport can run
-     * the SAME effective-namespace enforcement the REST surface runs, without
-     * duplicating the tool-schema introspection (issue #1850). Namespace-
-     * agnostic tools (peer/wearables/etc.) return false and stay ungated,
-     * matching the REST surface where those routes never call resolveNamespace.
-     */
-    toolAcceptsNamespace(name: string): boolean;
-    /**
-     * Determine whether oai-mem-citation guidance should be appended to recall.
-     * Returns true when explicitly enabled via config OR when auto-detect is
-     * active and the current MCP session belongs to a Codex adapter client.
-     *
-     * When no sessionId is provided (e.g., stdio transport where there are no
-     * HTTP headers carrying mcp-session-id), fall back to checking if there is
-     * exactly one known session whose clientInfo matches the Codex pattern.
-     * This covers the common stdio case where a single client connection exists.
-     */
-    private shouldEmitCitations;
-    /** Check whether a clientInfo record identifies a Codex adapter client. */
-    private isCodexClient;
-    /**
-     * Build citation metadata for each recall result that has a path.
-     * Line range defaults to 1-1 when not determinable from the summary.
-     */
-    private buildRecallCitations;
-    private callTool;
-}
-
-/**
- * `who_knows` — rank entities by demonstrated expertise for a topic
- * (issue #2057).
- *
- * Deterministic scoring over existing entity + fact data. No LLM, no QMD:
- * a single pass over the namespace-scoped corpus (`readAllMemories`) plus
- * entity files. Signals:
- *
- * 1. Entity mentions co-occurring with topic tokens (entityRef + name/alias
- *    mention in matching memory content).
- * 2. Speaker/authorship attribution ("Alice said/explained/…") when present —
- *    small multiplicative bonus.
- * 3. Recency as a tie-break only (per the issue): newer evidence ranks higher
- *    when scores tie; entity id is the final stable key (total order).
- * 4. Existing importance + confidence frontmatter weight each evidence item.
- *
- * Pure functions live here so tests can exercise scoring without booting an
- * orchestrator; the access service supplies namespace-scoped data. MCP tool
- * definitions are exported for access-mcp.ts to spread into `tools/list`
- * (same pattern as `meetings/mcp-tools.ts`).
- */
-
-/** Default result count (issue #2057: "small ranked list"). */
-declare const WHO_KNOWS_DEFAULT_LIMIT = 5;
-/** Upper bound for `limit`. Rejects unbounded fan-out without silently clamping. */
-declare const WHO_KNOWS_MAX_LIMIT = 50;
-/** Evidence refs retained per hit. Independent of the result limit. */
-declare const WHO_KNOWS_MAX_EVIDENCE = 50;
-/** Multiplicative bonus for evidence with direct speaker attribution. */
-declare const WHO_KNOWS_AUTHORSHIP_BONUS = 1.5;
-/** Minimal storage surface `who_knows` needs — satisfied by `StorageManager`. */
-interface WhoKnowsStorage {
-    readAllMemories(): Promise<MemoryFile[]>;
-    listEntityNames(): Promise<string[]>;
-    readEntity(name: string): Promise<string>;
-}
-/** Flattened entity input for scoring. `id` is the entity key (file stem). */
-interface WhoKnowsEntity {
-    id: string;
-    name: string;
-    aliases: readonly string[];
-}
-/** Evidence reference — ids/paths/timestamps only, no raw content. */
-interface WhoKnowsEvidence {
-    id: string;
-    path: string;
-    updated: string;
-}
-interface WhoKnowsHit {
-    entityId: string;
-    entityName: string | null;
-    /** Normalized 0–1 relative to the top hit (top = 1). */
-    score: number;
-    rationale: string;
-    evidenceCount: number;
-    lastSeen: string | null;
-    evidence: WhoKnowsEvidence[];
-}
-interface WhoKnowsResult {
-    topic: string;
-    results: WhoKnowsHit[];
-}
-/** Load all entities for a namespace-scoped storage as scoring input. */
-declare function loadWhoKnowsEntities(storage: WhoKnowsStorage, entitySchemas?: PluginConfig["entitySchemas"]): Promise<WhoKnowsEntity[]>;
-/** Validate topic + limit at every entrypoint. Shared by service/CLI/HTTP. */
-declare function validateWhoKnowsInput(topic: string, limit: number): void;
-/** Lowercase alphanumeric topic tokens, stopwords dropped, deduplicated. */
-declare function tokenizeTopic(topic: string): string[];
-/**
- * Deterministic ranking. Pure: same inputs → same output, total order via
- * (score desc, lastSeen desc, entityId asc) so ties never depend on scan
- * order (sort-stability rule).
- */
-declare function computeWhoKnows(input: {
-    topic: string;
-    limit: number;
-    memories: readonly MemoryFile[];
-    entities: readonly WhoKnowsEntity[];
-}): WhoKnowsResult;
-declare const WHO_KNOWS_MCP_TOOLS: McpTool[];
-interface WhoKnowsHttpOutcome {
-    status: number;
-    body: unknown;
-}
-declare function handleWhoKnowsHttpQuery(deps: {
-    getParam: (name: string) => string | null;
-    resolveNamespace: (namespace: string | undefined) => string | undefined;
-    principal?: string;
-    run: (request: {
-        topic: string;
-        limit?: number;
-        namespace?: string;
-        authenticatedPrincipal?: string;
-    }) => Promise<WhoKnowsResult>;
-}): Promise<WhoKnowsHttpOutcome>;
-
-/**
- * Memory subject: user-centric vs agent-centric classification (issue #2372).
- *
- * Scope says WHERE a memory lives; subject says WHOM it is about — and that
- * is what determines where it may safely go. `user` memories model one
- * person (preferences, relationships, biography, moments, commitments);
- * `agent` memories model how to operate (procedures, principles,
- * tool-usage lessons, debugging strategies, environment facts with no
- * personal content).
- *
- * This module owns, in one place:
- *  - the deterministic write-time classification (category defaults with an
- *    optional extractor override),
- *  - the promotion guard shared by EVERY promotion surface (spaces promote
- *    AND scope-profile promotion targets — AGENTS.md §27 uniform gating),
- *  - read-only promotion-candidate surfacing (reuse-signaled agent-subject
- *    memories with no equivalent in the target layer), and
- *  - the deterministic backfill pass (shadow/apply, no LLM).
- */
-
-declare const SUBJECT_VALUES: readonly ["user", "agent"];
-declare const SUBJECT_GUARD_MODES: readonly ["off", "warn", "enforce"];
-/** The CLI / per-call override that permits a user-subject promotion. */
-declare const SUBJECT_GUARD_OVERRIDE_FLAG = "--allow-user-subject";
-declare function isMemorySubject(value: unknown): value is MemorySubject;
-declare function isSubjectGuardMode(value: unknown): value is SubjectGuardMode;
-declare function subjectDefaultForCategory(category: MemoryCategory): MemorySubject;
-/**
- * Resolve the write-time subject: the extractor's single-token value when it
- * emitted a valid one, else the category default. Never reclassifies on read.
- */
-declare function resolveWriteSubject(category: MemoryCategory, extractorValue: unknown): MemorySubject;
-/** Scope-profile promotion targets that are shared layers. */
-declare function isSharedPromotionTarget(target: string): boolean;
-interface SubjectGuardDecision {
-    action: "allow" | "warn" | "reject";
-    /** Effective subject — an absent subject resolves to "user" (fail closed, §36). */
-    effectiveSubject: MemorySubject;
-    /** Structured reason; empty string when action === "allow". */
-    reason: string;
-    /** The override that permits this promotion when action is reject/warn. */
-    override: typeof SUBJECT_GUARD_OVERRIDE_FLAG;
-}
-/**
- * Evaluate one promotion against the subject guard. Shared by the spaces
- * promotion workflow and the scope-profile promotion targets so the two
- * surfaces cannot drift (issue #2372 acceptance 2, AGENTS.md §27).
- *
- *  - mode "off", non-shared targets, agent-subject memories, and explicit
- *    `allowUserSubject` overrides all allow.
- *  - a `user`-subject memory (or a memory with NO subject — fail closed)
- *    promoted to a shared layer warns under "warn" and rejects under
- *    "enforce", with the override named in the reason (§39: never a silent
- *    accept).
- */
-declare function evaluateSubjectGuard(params: {
-    subject: MemorySubject | undefined;
-    sharedTarget: boolean;
-    mode: SubjectGuardMode;
-    allowUserSubject?: boolean;
-}): SubjectGuardDecision;
-type PromotionReuseSignal = "reinforcement" | "memory_worth" | "access_count";
-interface PromotionCandidate {
-    id: string;
-    path: string;
-    category: MemoryCategory;
-    content: string;
-    accessCount: number;
-    reinforcementCount: number;
-    mwSuccess: number;
-    mwFail: number;
-    reuseSignal: PromotionReuseSignal;
-}
-/** Default reuse-signal threshold for `accessCount` (config `promotionCandidates.minAccessCount`). */
-declare const PROMOTION_CANDIDATES_DEFAULT_MIN_ACCESS = 3;
-/** Canonical content form for target-equivalence checks (same normalize pipeline as dedup). */
-declare function promotionCandidateKey(content: string): string;
-/**
- * List `subject: "agent"` memories that (a) are active, (b) show a reuse
- * signal (`reinforcement_count > 0` OR `mw_success > mw_fail` OR
- * `accessCount >= minAccessCount`), and (c) have no equivalent already in
- * the promotion target layer (content-hash check via the dedup normalizer).
- * Pure over the two memory lists; callers resolve namespaces.
- */
-declare function computePromotionCandidates(options: {
-    memories: MemoryFile[];
-    targetMemories: MemoryFile[];
-    minAccessCount: number;
-    limit?: number;
-}): PromotionCandidate[];
-interface PromotionCandidatesResult {
-    namespace: string;
-    targetNamespace: string;
-    minAccessCount: number;
-    candidates: PromotionCandidate[];
-}
-declare const PROMOTION_CANDIDATES_MCP_TOOLS: McpTool[];
-/**
- * Storage surface the backfill needs (mirrors pattern-reinforcement's
- * structural interface so tests can pass an in-memory stub).
- * `writeMemoryFrontmatter` invalidates caches and syncs the fact-hash index
- * (§25/§31), so a stamped memory is immediately discoverable.
- */
-interface SubjectBackfillStorage {
-    readAllMemories(): Promise<MemoryFile[]>;
-    writeMemoryFrontmatter(memory: MemoryFile, patch: Partial<MemoryFile["frontmatter"]>): Promise<boolean>;
-}
-interface SubjectBackfillReport {
-    mode: "shadow" | "apply";
-    scanned: number;
-    stamped: number;
-    alreadyStamped: number;
-    stamps: Array<{
-        id: string;
-        category: MemoryCategory;
-        subject: MemorySubject;
-        path: string;
-    }>;
-}
-/**
- * Stamp `subject` on memories that have none, using ONLY the deterministic
- * category defaults (never an LLM, never reclassifying an existing subject —
- * issue #2372 §1.3). `shadow` reports the intended stamps without writing;
- * `apply` writes through `writeMemoryFrontmatter`, which invalidates the
- * memory caches and re-syncs the fact-hash index.
- */
-declare function backfillMemorySubjects(options: {
-    storage: SubjectBackfillStorage;
-    mode: "shadow" | "apply";
-}): Promise<SubjectBackfillReport>;
-
-declare abstract class SupportPassportAccessServiceBase {
-    private _supportPassportSurface;
-    abstract get configRef(): PluginConfig;
-    abstract get localLlmRef(): LocalLlmClient | null;
-    abstract getWritableStorageForNamespace(namespace?: string, principal?: string): Promise<SupportPassportOwnerScope>;
-    abstract getStorageForResolvedNamespace(namespace: string): Promise<StorageManager>;
-    get supportPassportGatewayRouteRef(): SupportPassportModelRoute | null;
-    get supportPassportPlatformRef(): NodeJS.Platform;
-    private getSupportPassportSurface;
-    get supportPassportEnabled(): boolean;
-    supportPassportListCards(principal: string): Promise<SupportPassportCard[]>;
-    supportPassportPreviewMemory(principal: string, memoryId: string): Promise<SupportPassportMemoryPreview>;
-    supportPassportCreateManualDraft(principal: string, input: {
-        title: string;
-        statement: string;
-        category: SupportPassportCardCategory;
-        reviewBy: string;
-    }, options?: {
-        signal?: AbortSignal;
-        onCommitted?: () => void;
-    }): Promise<SupportPassportCard>;
-    supportPassportGenerateDrafts(principal: string, input: {
-        sourceMemoryIds: string[];
-        sourceMemoryRevisions: Array<{
-            memoryId: string;
-            revision: string;
-        }>;
-        consent: boolean;
-        signal?: AbortSignal;
-        onCommitted?: () => void;
-    }): Promise<SupportPassportCard[]>;
-    supportPassportReplaceCard(principal: string, cardId: string, input: {
-        title: string;
-        statement: string;
-        category: SupportPassportCardCategory;
-        reviewBy: string;
-        expectedRevision: string;
-    }, options?: {
-        signal?: AbortSignal;
-        onCommitted?: () => void;
-    }): Promise<SupportPassportCard>;
-    supportPassportApproveCard(principal: string, cardId: string, input: {
-        expectedRevision: string;
-        reasonCode?: string;
-    }, options?: {
-        signal?: AbortSignal;
-        onCommitted?: () => void;
-    }): Promise<SupportPassportCard>;
-    supportPassportRejectCard(principal: string, cardId: string, input: {
-        expectedRevision: string;
-        reasonCode?: string;
-    }, options?: {
-        signal?: AbortSignal;
-        onCommitted?: () => void;
-    }): Promise<SupportPassportCard>;
-    supportPassportWithdrawCard(principal: string, cardId: string, input: {
-        expectedRevision: string;
-        reasonCode?: string;
-    }, options?: {
-        signal?: AbortSignal;
-        onCommitted?: () => void;
-    }): Promise<SupportPassportCard>;
-    supportPassportCreateGrant(principal: string, input: SupportPassportCreateGrantRequest, options?: {
-        signal?: AbortSignal;
-        onCommitted?: () => void;
-    }): Promise<SupportPassportCreateGrantResult>;
-    supportPassportListGrants(principal: string): Promise<SupportPassportOwnerGrant[]>;
-    supportPassportRevokeGrant(principal: string, grantId: string, input: {
-        expectedVersion?: number;
-    }, options?: {
-        signal?: AbortSignal;
-        onCommitted?: () => void;
-    }): Promise<SupportPassportRevokeGrantResult>;
-    supportPassportReadGrant(grantId: string, secret: string): Promise<SupportPassportPublicGuide>;
-    supportPassportAskGrant(grantId: string, secret: string, question: string, signal?: AbortSignal): Promise<SupportPassportAnswerOutput>;
-}
-
-type AccessProfilingReportRequest = {
-    format?: string;
-    limit?: number;
-};
-type AccessProfilingReportResponse = {
-    enabled: boolean;
-    format?: "ascii" | "json";
-    report?: string;
-    traces?: unknown[];
-    stats?: unknown;
-    bottleneck?: string | null;
-    reason?: string;
-    message?: string;
-};
-declare const ENGRAM_ACCESS_WRITE_SCHEMA_VERSION = 1;
-/**
- * Recall request. Wire fields derive from the canonical zod schema
- * (`recallRequestSchema`, access-schema.ts — issue #2482) so the HTTP body,
- * the MCP args, and the service share ONE model. The overlay below carries
- * server-resolved transport fields no client may set.
- */
-interface EngramAccessRecallRequest extends RecallRequest {
-    authenticatedPrincipal?: string;
-    /** Trusted connector identity resolved at the transport boundary. */
-    sourceConnector?: string;
-    abortSignal?: AbortSignal;
-    /**
-     * Internal, server-set field (issue #1906): wall-clock ms the caller
-     * waited for a per-principal recall slot / single-flight leader before
-     * execution. Set by `recall()`, forwarded into `RecallInvocationOptions`,
-     * and folded additively into recall-timings. Not part of the zod schema
-     * (same pattern as `abortSignal`).
-     */
-    queueWaitMs?: number;
-}
-/**
- * Standalone request to attach / clear the coding context for a session
- * without performing a recall. Used by the Claude Code / Codex connectors
- * at session start, and by the `remnic.set_coding_context` MCP tool (PR 7).
- */
-interface EngramAccessSetCodingContextRequest {
-    sessionKey: string;
-    codingContext: {
-        projectId: string;
-        branch: string | null;
-        rootPath: string;
-        defaultBranch: string | null;
-    } | null;
-}
-interface EngramAccessRecallResponse {
-    query: string;
-    sessionKey?: string;
-    namespace: string;
-    context: string;
-    /** Request-local split used by adapters that must re-render a tighter prompt budget. */
-    contextComposition?: RecallContextComposition;
-    count: number;
-    memoryIds: string[];
-    results: EngramAccessMemorySummary[];
-    recordedAt?: string;
-    traceId?: string;
-    plannerMode?: RecallPlanMode;
-    fallbackUsed: boolean;
-    sourcesUsed: string[];
-    /**
-     * Disclosure depth applied to this recall (issue #677).  Reflects the
-     * caller-requested level after defaulting; useful for surfaces that want
-     * to render a "served at depth X" hint without re-deriving it.  PR 1 of
-     * #677 wires this end-to-end for plumbing only — section/raw payload
-     * shaping ships in later PRs.
-     */
-    disclosure: RecallDisclosure;
-    budgetsApplied?: LastRecallSnapshot["budgetsApplied"];
-    auditAnomalies?: AnomalyDetectorResult;
-    budgetWarning?: BudgetWarning;
-    latencyMs?: number;
-    debug?: {
-        snapshot?: LastRecallSnapshot;
-        intent?: IntentDebugSnapshot | null;
-        graph?: GraphRecallSnapshot | null;
-    };
-}
-interface EngramAccessRecallExplainRequest {
-    sessionKey?: string;
-    namespace?: string;
-    /** Caller principal for namespace access checks. Transport-bound; never from untrusted payloads. */
-    authenticatedPrincipal?: string;
-}
-interface EngramAccessRecallExplainResponse {
-    found: boolean;
-    snapshot?: LastRecallSnapshot;
-    intent?: IntentDebugSnapshot | null;
-    graph?: GraphRecallSnapshot | null;
-}
-interface EngramAccessDaySummaryRequest extends LocationContextRequestOptions {
-    memories?: string;
-    sessionKey?: string;
-    namespace?: string;
-    timeZone?: string;
-}
-/** Inputs accepted by the `remnic_briefing` MCP tool. */
-interface EngramAccessBriefingRequest extends LocationContextRequestOptions {
-    since?: string;
-    focus?: string;
-    namespace?: string;
-    format?: "markdown" | "json";
-    maxFollowups?: number;
-    /** Caller principal for namespace access checks. Transport-bound — never from untrusted payloads. */
-    principal?: string;
-}
-/** Response for `remnic_briefing`. */
-interface EngramAccessBriefingResponse {
-    format: "markdown" | "json";
-    window: {
-        from: string;
-        to: string;
-    };
-    namespace: string;
-    markdown: string;
-    json: Record<string, unknown>;
-    followupsUnavailableReason?: string;
-}
-interface EngramAccessMemoryRecord {
-    id: string;
-    path: string;
-    category: string;
-    status?: string;
-    created?: string;
-    updated?: string;
-    content: string;
-    frontmatter: MemoryFile["frontmatter"];
-}
-interface EngramAccessMemorySummary {
-    id: string;
-    path: string;
-    category: string;
-    status: string;
-    created?: string;
-    updated?: string;
-    tags: string[];
-    entityRef?: string;
-    preview: string;
-    /**
-     * Disclosure depth at which this result was served (issue #677).  Set by
-     * recall paths; omitted on non-recall surfaces (e.g. memory browse) where
-     * the concept does not apply.  PR 1 of #677 always reports the
-     * request-level disclosure on recall results; per-result divergence is
-     * reserved for the auto-escalation policy that ships in PR 4/4.
-     */
-    disclosure?: RecallDisclosure;
-    /**
-     * Full memory content (markdown body) — populated when `disclosure` is
-     * `"section"` or `"raw"` (issue #677 PR 2/4).  At `"chunk"` depth callers
-     * only receive the short `preview`, preserving the cheap-by-default
-     * recall payload.  Browse/non-recall paths leave `content` undefined.
-     */
-    content?: string;
-    /**
-     * Raw transcript excerpts surfaced from the LCM archive when `disclosure`
-     * is `"raw"` and the LCM engine is enabled (issue #677 PR 2/4).  Each
-     * entry is a per-message excerpt sized by the LCM archive's
-     * configured excerpt window.  Empty array when LCM is disabled or has
-     * no matching transcript content.  Always omitted at chunk/section.
-     */
-    rawExcerpts?: Array<{
-        turnIndex: number;
-        role: string;
-        content: string;
-        sessionId: string;
-    }>;
-}
-interface EngramAccessMemoryBrowseRequest {
-    query?: string;
-    status?: string;
-    category?: string;
-    namespace?: string;
-    authenticatedPrincipal?: string;
-    sort?: "updated_desc" | "updated_asc" | "created_desc" | "created_asc";
-    limit?: number;
-    offset?: number;
-}
-interface EngramAccessMemoryBrowseResponse {
-    namespace: string;
-    sort: "updated_desc" | "updated_asc" | "created_desc" | "created_asc";
-    total: number;
-    count: number;
-    limit: number;
-    offset: number;
-    memories: EngramAccessMemorySummary[];
-}
-interface EngramAccessMemoryResponse {
-    found: boolean;
-    namespace: string;
-    memory?: EngramAccessMemoryRecord;
-}
-interface EngramAccessTimelineResponse {
-    found: boolean;
-    namespace: string;
-    count: number;
-    timeline: MemoryLifecycleEvent[];
-}
-interface EngramAccessEntitySummary {
-    name: string;
-    type: string;
-    updated: string;
-    summary?: string;
-    aliases: string[];
-}
-interface EngramAccessEntityListResponse {
-    namespace: string;
-    total: number;
-    count: number;
-    limit: number;
-    offset: number;
-    entities: EngramAccessEntitySummary[];
-}
-interface EngramAccessEntityResponse {
-    found: boolean;
-    namespace: string;
-    entity?: EntityFile;
-}
-interface EngramAccessReviewQueueResponse {
-    found: boolean;
-    namespace?: string;
-    runId?: string;
-    summary?: Awaited<ReturnType<typeof readMemoryGovernanceRunArtifact>>["summary"];
-    metrics?: Awaited<ReturnType<typeof readMemoryGovernanceRunArtifact>>["metrics"];
-    qualityScore?: Awaited<ReturnType<typeof readMemoryGovernanceRunArtifact>>["qualityScore"];
-    reviewQueue?: Awaited<ReturnType<typeof readMemoryGovernanceRunArtifact>>["reviewQueue"];
-    appliedActions?: Awaited<ReturnType<typeof readMemoryGovernanceRunArtifact>>["appliedActions"];
-    transitionReport?: Awaited<ReturnType<typeof readMemoryGovernanceRunArtifact>>["transitionReport"];
-    report?: string;
-}
-interface EngramAccessMaintenanceResponse {
-    namespace: string;
-    health: EngramAccessHealthResponse;
-    latestGovernanceRun: EngramAccessReviewQueueResponse;
-}
-interface EngramAccessTrustZoneStatusResponse {
-    namespace: string;
-    status: TrustZoneStoreStatus;
-}
-interface EngramAccessTrustZoneRecordSummary {
-    recordId: string;
-    filePath: string;
-    zone: TrustZoneName;
-    recordedAt: string;
-    kind: TrustZoneRecordKind;
-    summary: string;
-    sourceClass: TrustZoneSourceClass;
-    sessionKey?: string;
-    sourceId?: string;
-    evidenceHashPresent: boolean;
-    anchored: boolean;
-    entityRefs: string[];
-    tags: string[];
-    metadata?: Record<string, string>;
-    trustScore?: TrustZoneProvenanceScore;
-    nextPromotionTarget?: TrustZoneName;
-    nextPromotionAllowed: boolean;
-    nextPromotionReasons: string[];
-    corroborationCount?: number;
-    corroborationSourceClasses?: TrustZoneSourceClass[];
-}
-interface EngramAccessTrustZoneBrowseRequest {
-    query?: string;
-    zone?: TrustZoneName;
-    kind?: TrustZoneRecordKind;
-    sourceClass?: TrustZoneSourceClass;
-    namespace?: string;
-    limit?: number;
-    offset?: number;
-}
-interface EngramAccessTrustZoneBrowseResponse {
-    namespace: string;
-    total: number;
-    count: number;
-    limit: number;
-    offset: number;
-    records: EngramAccessTrustZoneRecordSummary[];
-}
-interface EngramAccessTrustZonePromoteRequest {
-    recordId: string;
-    targetZone: TrustZoneName;
-    promotionReason: string;
-    recordedAt?: string;
-    summary?: string;
-    dryRun?: boolean;
-    namespace?: string;
-    authenticatedPrincipal?: string;
-}
-interface EngramAccessTrustZonePromoteResponse extends TrustZonePromotionResult {
-    namespace: string;
-    dryRun: boolean;
-}
-interface EngramAccessTrustZoneDemoSeedRequest {
-    scenario?: string;
-    recordedAt?: string;
-    dryRun?: boolean;
-    namespace?: string;
-    authenticatedPrincipal?: string;
-}
-interface EngramAccessTrustZoneDemoSeedResponse extends TrustZoneDemoSeedResult {
-    namespace: string;
-}
-interface EngramAccessQualityResponse {
-    namespace: string;
-    totalMemories: number;
-    statusCounts: Record<string, number>;
-    categoryCounts: Record<string, number>;
-    confidenceTierCounts: Record<string, number>;
-    ageBucketCounts: Record<string, number>;
-    archivePressure: {
-        pendingReview: number;
-        quarantined: number;
-        archived: number;
-        staleActive: number;
-        lowConfidenceActive: number;
-    };
-    latestGovernanceRun: {
-        found: boolean;
-        runId?: string;
-        qualityScore?: EngramAccessReviewQueueResponse["qualityScore"];
-        reviewQueueCount: number;
-    };
-}
-interface EngramAccessCapsuleListResponse {
-    namespace: string;
-    capsulesDir: string;
-    capsules: CapsuleListEntry[];
-}
-interface EngramAccessOfflineSyncSnapshotRequest {
-    namespace?: string;
-    principal?: string;
-    includeTranscripts?: boolean;
-    includeContent?: boolean;
-    baseCapturedAt?: Date;
-    baseFiles?: OfflineSyncFileState[];
-}
-interface EngramAccessOfflineSyncManifestRequest {
-    namespace?: string;
-    principal?: string;
-    includeTranscripts?: boolean;
-}
-interface EngramAccessOfflineSyncFilesRequest {
-    namespace?: string;
-    principal?: string;
-    includeTranscripts?: boolean;
-    paths: string[];
-}
-interface EngramAccessOfflineSyncFileContentRequest {
-    namespace?: string;
-    principal?: string;
-    includeTranscripts?: boolean;
-    path: string;
-    offset?: number;
-    length?: number;
-}
-interface EngramAccessOfflineSyncApplyFileContentRequest {
-    namespace?: string;
-    principal?: string;
-    includeTranscripts?: boolean;
-    sourceId: string;
-    path: string;
-    sha256: string;
-    bytes: number;
-    mtimeMs: number;
-    offset?: number;
-    baseSha256?: string;
-    content: Buffer;
-}
-interface EngramAccessOfflineSyncApplyRequest {
-    namespace?: string;
-    principal?: string;
-    changeset: unknown;
-    returnCurrentFiles?: boolean;
-}
-interface EngramAccessOfflineSyncFinalizeConvergenceRequest {
-    namespaces?: string[];
-    principal?: string;
-    sourceId: string;
-}
-interface EngramAccessOfflineSyncSnapshotResponse extends OfflineSyncSnapshot {
-    namespace: string;
-}
-interface EngramAccessOfflineSyncSnapshotStreamResponse extends Omit<OfflineSyncSnapshot, "files"> {
-    namespace: string;
-    files: AsyncIterable<OfflineSyncFileRecord>;
-}
-interface EngramAccessOfflineSyncFilesResponse extends OfflineSyncSnapshot {
-    namespace: string;
-}
-interface EngramAccessOfflineSyncFileContentResponse extends OfflineSyncFileContentChunk {
-    namespace: string;
-}
-interface EngramAccessOfflineSyncApplyFileContentResponse extends OfflineSyncApplyFileContentChunkResult {
-    namespace: string;
-}
-interface EngramAccessOfflineSyncApplyResponse extends OfflineSyncApplyChangesetResult {
-    namespace: string;
-}
-interface EngramAccessOfflineSyncFinalizeConvergenceResponse {
-    namespaces: string[];
-    refreshed: true;
-}
-type EngramAccessActionConfidenceRequest = ActionConfidenceInput;
-type EngramAccessActionConfidenceResponse = ActionConfidenceResult;
-declare function buildProjectedGovernanceProposedActions(storage: Awaited<ReturnType<Orchestrator["getStorage"]>>, projected: NonNullable<Awaited<ReturnType<Awaited<ReturnType<Orchestrator["getStorage"]>>["getProjectedGovernanceRecord"]>>>): Promise<Awaited<ReturnType<typeof readMemoryGovernanceRunArtifact>>["appliedActions"]>;
-declare function hasGroupedGovernanceActions(grouped?: Awaited<ReturnType<typeof readMemoryGovernanceRunArtifact>>["transitionReport"]["proposed"]): boolean;
-interface EngramAccessReviewDispositionRequest {
-    memoryId: string;
-    status: MemoryStatus | "archived";
-    reasonCode: string;
-    namespace?: string;
-    /**
-     * Trusted transport-bound principal. This must never come from untrusted client payloads.
-     * When present, write authorization is evaluated against this principal instead of sessionKey.
-     */
-    authenticatedPrincipal?: string;
-}
-interface EngramAccessReviewDispositionResponse {
-    ok: boolean;
-    namespace: string;
-    memoryId: string;
-    status: MemoryStatus | "archived";
-    previousStatus: MemoryStatus;
-    currentPath?: string;
-}
-interface EngramAccessWriteEnvelope {
-    schemaVersion?: number;
-    idempotencyKey?: string;
-    dryRun?: boolean;
-    sessionKey?: string;
-    /** Trusted transport-bound principal (never from client payloads); authorizes writes instead of sessionKey. */
-    authenticatedPrincipal?: string;
-    /** When set, an ACL rejection is NOT dead-lettered (#1888) so `remnic quarantine replay` can re-submit through this same surface without re-quarantining and duplicating the parked record. */
-    readonly suppressQuarantine?: boolean;
-}
-/**
- * Optional git/project context for project-scoped writes (#1434). When no
- * explicit `namespace` is supplied, these route the write to the same project
- * namespace recall/observe resolve from `cwd`/`projectTag` (rule 42 symmetry).
- */
-interface CodingScopedWriteInput {
-    cwd?: string;
-    projectTag?: string;
-}
-
-/**
- * Internal, single-resolution plan describing the effective memory scope for a
- * write-producing access request (#1495, seed for epic #1494). One plan is
- * resolved per request and EVERY side effect (LCM archival, extraction replay,
- * objective-state snapshot, response) consumes the same `writeNamespace`, so an
- * observed turn and its extracted memories never drift away from the namespace a
- * same-session project-scoped recall searches (rule 39 / 42).
- *
- * The resolver that produces this is READ-ONLY with respect to namespace
- * authorization: an explicit namespace is authorized through the existing
- * `canWriteNamespace` policy path, and a coding overlay is always REBUILT from
- * the authenticated principal's base — never accepted as a caller string — so a
- * caller can never reach another principal's overlay by forging an
- * overlay-shaped namespace (rule 42 / 47 / 48).
- */
-interface MemoryScopePlan {
-    /** Resolved request principal (auth precedence applied), or undefined. */
-    principal?: string;
-    /** Explicit `namespace` supplied by the caller, if any (already authorized). */
-    explicitNamespace?: string;
-    /** Principal self base namespace before any coding overlay. */
-    baseNamespace: string;
-    /** Effective write namespace — what every side effect must use. */
-    writeNamespace: string;
-    /**
-     * Effective namespace the objective-state snapshot writer must target.
-     *
-     * Objective-state has a STRICTER, pre-#1495 contract than the LCM/extraction
-     * write path (#928): an IMPLICIT (no explicit `namespace`) snapshot is based
-     * on the PRINCIPAL SELF namespace (`defaultNamespaceForPrincipal`) and is
-     * authorized against THAT base (rule 48, least-privilege) — never silently
-     * routed to `config.defaultNamespace`. Only the LCM/extraction/response path
-     * collapses an unqualified write to `config.defaultNamespace` (memory_store
-     * parity, rule 39). With an explicit namespace, or once a coding overlay
-     * applies, both targets converge: `objectiveStateNamespace === writeNamespace`.
-     *
-     * Keeping the two as separate fields of ONE plan preserves rule 22 (single
-     * resolution point) while honoring each consumer's historical contract.
-     */
-    objectiveStateNamespace: string;
-    /** Namespaces a same-session recall would read (cheap subset). */
-    readNamespaces: string[];
-    /** Active scope profile id, when `defaultScopeProfile` is configured. */
-    scopeProfile?: string;
-    /** Internal resolved profile used to keep scoped extraction persistence aligned with access resolution. */
-    scopeProfilePlan?: ResolvedScopeProfilePlan | null;
-    /** Resolved profile layer that supplied `writeNamespace`. */
-    writeLayer?: string;
-    /** Resolved profile layers in the active profile contract. */
-    layers?: ScopeProfileLayerResolution[];
-    /** Authorized promotion targets from the active profile contract. */
-    promotionTargets?: ScopeProfilePromotionResolution[];
-    /** Whether the coding overlay changed the base namespace. */
-    codingOverlayApplied: boolean;
-    /** Non-fatal diagnostics surfaced during resolution. */
-    warnings: string[];
-}
-/**
- * Raw `category` spelling retained at the request boundary when the wire
- * schema's canonicalizing transform mapped a compat alias to "fact"
- * (issue #2829). Diagnostic only: drives the response's `categoryCoercion`
- * note and survives quarantine parking for replay. Never reaches the write
- * candidate or the idempotency fingerprint, and never parses from client
- * input (the wire schema strips it).
- */
-interface RetainedCategorySpelling {
-    rawCategory?: string;
-}
-interface EngramAccessMemoryStoreRequest extends EngramAccessWriteEnvelope, ExplicitCaptureInput, CodingScopedWriteInput, RetainedCategorySpelling {
-}
-interface EngramAccessSuggestionSubmitRequest extends EngramAccessWriteEnvelope, ExplicitCaptureInput, CodingScopedWriteInput, RetainedCategorySpelling {
-}
-interface EngramAccessWriteResponse {
-    schemaVersion: 1;
-    operation: "memory_store" | "suggestion_submit";
-    namespace: string;
-    dryRun: boolean;
-    accepted: boolean;
-    queued: boolean;
-    status: "validated" | "stored" | "duplicate" | "queued_for_review";
-    memoryId?: string;
-    duplicateOf?: string;
-    idempotencyKey?: string;
-    idempotencyReplay?: boolean;
-    /** Present when a project-shaped category alias was coerced to "fact" (#2780/#2829). */
-    categoryCoercion?: CategoryAliasCoercion;
-}
-interface EngramAccessObserveMessage {
-    role: "user" | "assistant";
-    content: string;
-    parts?: LcmMessagePartInput[];
-    rawContent?: unknown;
-    sourceFormat?: MessagePartSourceFormat;
-}
-/**
- * Observe request. Wire fields derive from the canonical zod schema
- * (`observeRequestSchema`, access-schema.ts — issue #2482); the service
- * consumes the transport-cleaned message form (the wire schema tolerates
- * nullable `parts`/`sourceFormat`, the service maps them to `undefined`).
- */
-interface EngramAccessObserveRequest extends Omit<ObserveRequest, "messages">, SourceConnectorProvenance {
-    messages: EngramAccessObserveMessage[];
-    authenticatedPrincipal?: string;
-    readonly suppressQuarantine?: boolean;
-}
-/**
- * Additive diagnostic view of the effective {@link MemoryScopePlan} resolved for
- * an `observe` request (#1495 / epic #1494). Lets callers and tests inspect
- * which namespace the operation actually wrote to without changing the
- * backward-compatible `namespace` field. Purely informational — never gates
- * authorization.
- */
-interface EngramAccessScopeDebug {
-    /** Resolved principal, or `undefined` when none could be derived. */
-    principal?: string;
-    /** Explicit `namespace` from the request, if one was supplied. */
-    explicitNamespace?: string;
-    /** Principal self base before any coding overlay. */
-    baseNamespace: string;
-    /** Effective write namespace every side effect of the request uses. */
-    writeNamespace: string;
-    /** Whether the coding (project/branch) overlay changed the base namespace. */
-    codingOverlayApplied: boolean;
-    /** Namespaces a same-session recall would read, when cheap to compute. */
-    readNamespaces?: string[];
-    scopeProfile?: string;
-    writeLayer?: string;
-    layers?: ScopeProfileLayerResolution[];
-    promotionTargets?: ScopeProfilePromotionResolution[];
-}
-interface EngramAccessObserveResponse {
-    accepted: number;
-    sessionKey: string;
-    /**
-     * Backward-compatible base writable namespace (pre-#1495 semantics). Kept
-     * unchanged so existing callers/tests are not broken. The namespace the
-     * operation ACTUALLY wrote to is {@link EngramAccessObserveResponse.effectiveNamespace}.
-     */
-    namespace: string;
-    /**
-     * Effective write namespace every memory-producing side effect of this
-     * request used (LCM archival, extraction replay, objective-state snapshot).
-     * Equals the namespace a same-session project-scoped recall searches (#1495).
-     */
-    effectiveNamespace: string;
-    /** Additive diagnostic view of the resolved scope plan (#1495). */
-    scopeDebug?: EngramAccessScopeDebug;
-    lcmArchived: boolean;
-    extractionQueued: boolean;
-    /** True when at least one observe-derived turn was appended to the transcript store (issue #2783). False when the transcript capability is off, every message was filtered/deduped, or every append failed. */
-    transcriptPersisted: boolean;
-    /** True when replayed from the idempotency cache (issue #1649); lets the HTTP surface skip the write-quota slot, matching memory_store replay semantics. */
-    idempotencyReplay?: boolean;
-}
-interface EngramAccessLcmSearchRequest {
-    query: string;
-    sessionKey?: string;
-    sessionPrefix?: string;
-    namespace?: string;
-    limit?: number;
-    authenticatedPrincipal?: string;
-}
-interface EngramAccessLcmSearchResponse {
-    query: string;
-    namespace: string;
-    results: Array<{
-        sessionId: string;
-        content: string;
-        turnIndex?: number;
-    }>;
-    count: number;
-    lcmEnabled: boolean;
-}
-interface EngramAccessLcmStatusResponse {
-    enabled: boolean;
-    archiveAvailable: boolean;
-    stats?: {
-        totalTurns?: number;
-    };
-}
-interface EngramAccessLcmCompactionRecordRequest {
-    sessionKey: string;
-    namespace?: string;
-    tokensBefore: number;
-    tokensAfter: number;
-    authenticatedPrincipal?: string;
-}
-interface EngramAccessLcmCompactionRecordResponse {
-    enabled: boolean;
-    recorded: boolean;
-    sessionKey: string;
-    namespace: string;
-    reason?: string;
-}
-type EngramAccessIdempotencyStatus = "miss" | "replay" | "conflict";
-/**
- * Pure helper that shapes a {@link EngramAccessMemorySummary} from a
- * {@link MemoryFile} based on the requested disclosure depth (issue #677
- * PR 2/4).  Extracted so the shaping invariants — chunk emits preview
- * only, section attaches `content`, raw also surfaces `rawExcerpts` when
- * the caller passes them — can be unit-tested without booting an
- * orchestrator.
- *
- * Browse / non-recall paths pass `disclosure === undefined` so the
- * `disclosure`, `content`, and `rawExcerpts` fields are all omitted —
- * preserving the cheap-by-default browse projection.
- */
-declare function shapeMemorySummary(memory: MemoryFile, baseDir: string, disclosure?: RecallDisclosure, rawExcerpts?: EngramAccessMemorySummary["rawExcerpts"]): EngramAccessMemorySummary;
-declare class EngramAccessService extends SupportPassportAccessServiceBase {
-    private readonly orchestrator;
-    private readonly idempotency;
-    private readonly idempotencyLocks;
-    private readonly recallSemaphores;
-    private readonly recallInFlight;
-    private readonly budget;
-    private readonly auditAdapter;
-    private readonly corpusWatermarkCache;
-    private readonly replicaDivergenceMonitor;
-    private readonly injectedSupportPassportGatewayRoute;
-    readonly reviewDeckEnabled: boolean;
-    readonly recallNavigationEnabled: boolean;
-    /** AccessObserveWriteSurface (access-service decomposition). Lazy; selfDeps live wiring. */
-    private _accessObserveWriteSurface;
-    private get accessObserveWriteSurface();
-    /** AccessLcmSurface (access-service decomposition). Lazy; selfDeps live wiring. */
-    private _accessLcmSurface;
-    private get accessLcmSurface();
-    /** AccessAdminOpsSurface (access-service decomposition). Lazy; selfDeps live wiring. */
-    private _accessAdminOpsSurface;
-    private get accessAdminOpsSurface();
-    private _reviewDeckSurface;
-    private get reviewDeckSurface();
-    /** AccessRecallSurface (access-service decomposition). Lazy; selfDeps live wiring. */
-    private _accessRecallSurface;
-    private get accessRecallSurface();
-    /** AccessIdentityContinuitySurface (access-service decomposition). Lazy; selfDeps live wiring. */
-    private _accessIdentityContinuitySurface;
-    private get accessIdentityContinuitySurface();
-    private readonly extractionLivenessWarn;
-    constructor(orchestrator: Orchestrator, options?: {
-        resolveSecretRef?: ResolveSecretRefFn | null;
-        supportPassportGatewayRoute?: SupportPassportModelRoute | null;
-        reviewDeckEnabled?: boolean;
-    });
-    get supportPassportGatewayRouteRef(): SupportPassportModelRoute | null;
-    get briefingEnabled(): boolean;
-    private resolveNamespace;
-    private normalizeRecallMode;
-    private resolveRecallNamespace;
-    private resolveRequestPrincipal;
-    private writableNamespaceFor;
-    /** Shared coding-scope derivation for the read/write resolvers below —
-     *  coding context, overlay, principal, scope-profile plan for an IMPLICIT
-     *  request, IDENTICAL to recall precedence (session-first, per-call fallback)
-     *  so a scoped store is discoverable by scoped recall (#1434). Single source
-     *  of truth for the namespacesEnabled/projectScope gates (rule 22; keeps the
-     *  scattered-config-read ratchet flat). READ-ONLY: never mutates session. */
-    private resolveCodingScopeInputs;
-    private assertTokenCanWriteNamespace;
-    /**
-     * Resolve the write namespace for explicit-write tools (memory_store /
-     * suggestion_submit), project-scoping the write the same way recall does so a
-     * memory stored with a client-injected `cwd`/`projectTag` is discoverable by
-     * project-scoped recall (#1434, rule 42). Shared derivation lives in
-     * {@link resolveCodingScopeInputs}; this method enforces the WRITE acl
-     * (`canWriteNamespace` / profile-layer writability). Read-only: never mutates
-     * session coding context.
-     */
-    private resolveCodingScopedWriteNamespace;
-    namespaceWritablePreflight(request: EngramAccessNamespaceWritableRequest): Promise<WritableNamespaceResult>;
-    /**
-     *  `list`/`get` use this so a record written by a project-scoped session is
-     *  listable/fetchable by the SAME session without manually supplying the
-     *  overlaid namespace (review P2). Derivation is IDENTICAL to the write path
-     *  (shared via {@link resolveCodingScopeInputs}); the only difference is the
-     *  ACL — reads enforce {@link canReadNamespace}, so a read-but-not-write
-     *  principal can still list/fetch (rule 42). */
-    private resolveCodingScopedReadableNamespace;
-    /**
-     * Resolve ONE effective memory scope plan for a write-producing request
-     * (#1495 / seed for epic #1494). The returned {@link MemoryScopePlan} is the
-     * single source of truth `observe` (and, later, other write surfaces) consume
-     * so every side effect lands in `plan.writeNamespace`.
-     *
-     * Authorization mirrors {@link resolveCodingScopedWriteNamespace} EXACTLY so
-     * `observe`'s scoping is identical to `memory_store`/`suggestion_submit`
-     * (rule 39 — feature gates identical across code paths):
-     *  - an explicit `namespace` always wins and is authorized strictly through
-     *    `resolveWritableNamespace` → `canWriteNamespace`; an overlay-shaped string
-     *    is never a writable target (rule 42 / 47 / 48);
-     *  - with NO overlay, the base stays on `config.defaultNamespace` (pre-#1434
-     *    behavior), auth-checked;
-     *  - WITH an overlay, the base is the principal self namespace and the overlay
-     *    is REBUILT from that authorized base — never accepted as a caller string.
-     *
-     * READ-ONLY: this never mutates session coding context. Callers that need the
-     * `cwd`/`projectTag` bound to the session (so a later bare recall is scoped)
-     * must attach it via `maybeAttachCodingContext` BEFORE calling this, which
-     * also preserves the no-orphan-context guard (attach only after auth passes).
-     * The overlay here reads the session's attached context first (matching recall
-     * precedence), falling back to the per-call `cwd`/`projectTag`.
-     */
-    private resolveMemoryScopePlan;
-    private legacyResponseNamespaceForScope;
-    private objectiveStateStoreLocationForNamespace;
-    private resolveReadableNamespace;
-    private resolveReadableNamespacesForSearch;
-    private resolveAllReadableConfiguredNamespaces;
-    private resolveMemorySearchNamespacesForCollection;
-    private buildRecallDebug;
-    private buildRecallResponseFromXraySnapshot;
-    private serializeRecallResults;
-    private storageForAbsoluteRecallPath;
-    private fetchRawExcerpts;
-    private handleIdempotentWrite;
-    private handleIdempotentRead;
-    private peekIdempotentWrite;
-    private withIdempotencyLock;
-    health(namespace?: string): Promise<EngramAccessHealthResponse>;
-    private qmdCollectionForHealth;
-    private qmdHealth;
-    private namespaceQmdHealth;
-    private qmdCollectionState;
-    private qmdProbeAvailable;
-    actionConfidence(request?: EngramAccessActionConfidenceRequest): Promise<EngramAccessActionConfidenceResponse>;
-    daySummary(request: EngramAccessDaySummaryRequest): Promise<DaySummaryResult | null>;
-    briefing(request: EngramAccessBriefingRequest): Promise<EngramAccessBriefingResponse>;
-    /**
-     * Attach a coding context to a session (issue #569). Used by the Claude
-     * Code / Codex / generic-MCP connectors at session start so that recall +
-     * write paths can route to a project- / branch-scoped namespace.
-     *
-     * Validates the input shape and rejects malformed payloads rather than
-     * silently accepting them (CLAUDE.md #51). Pass `codingContext: null` to
-     * clear.
-     */
-    setCodingContext(request: EngramAccessSetCodingContextRequest): void;
-    /**
-     * Auto-resolve and attach a coding context for a session when one is not
-     * already present. Resolves from `projectTag` (highest priority after
-     * explicit `codingContext`), then from `cwd` via git detection.
-     *
-     * This is a no-op when:
-     *   - `sessionKey` is missing
-     *   - the session already has a coding context attached
-     *   - codingMode.projectScope is disabled (CLAUDE.md #30)
-     *   - neither `cwd` nor `projectTag` is provided
-     *
-     * Never throws — git resolution failures are silently ignored because not
-     * being in a repo is a normal runtime state.
-     */
-    private maybeAttachCodingContext;
-    /**
-     * Seed the session's coding binding AFTER a committed, project-scoped explicit
-     * write (memory_store / suggestion_submit), mirroring the recall path's
-     * `maybeAttachCodingContext` so a later bare recall/write on the same session
-     * is scoped to the same project. Called only from the post-persist path, so it
-     * never fires on dryRun, replay/conflict, or quota-rejected requests. Skips
-     * when an explicit `namespace` was supplied — that write bypassed the coding
-     * overlay, so binding the session to a project it never wrote to would make
-     * later bare recalls miss (Codex review).
-     */
-    private attachCodingContextAfterScopedWrite;
-    recall(request: EngramAccessRecallRequest): Promise<EngramAccessRecallResponse>;
-    private executeRecall;
-    recallExplain(request?: EngramAccessRecallExplainRequest): Promise<EngramAccessRecallExplainResponse>;
-    recallTierExplain(sessionKey?: string, namespace?: string, authenticatedPrincipal?: string): Promise<RecallExplainJsonPayload>;
-    /**
-     * Budgeted REFINE/EXPAND/STOP deep recall (issue #2332). Deep surface
-     * only — never called from the recall hot path. Single implementation
-     * for MCP, HTTP, and CLI (rule 22: one renderer, one service method).
-     */
-    deepRecall(request: {
-        query: string;
-        namespace?: string;
-        sessionKey?: string;
-        authenticatedPrincipal?: string;
-        maxSteps?: number;
-        /** Transport cancellation (issue #2915): MCP tools/call cancelled, HTTP disconnect. */
-        abortSignal?: AbortSignal;
-    }): Promise<DeepRecallResult & {
-        rendered: string;
-    }>;
-    recallNavigate(request: RecallNavigationRequest): Promise<RecallNavigationResult>;
-    /** Memory-store browse verbs (issue #2978): ls/tree/find over ONE resolved namespace. */
-    memoryStoreBrowse(request: MemoryStoreBrowseRequest): Promise<MemoryStoreBrowseResult>;
-    recallXray(request: {
-        query: string;
-        sessionKey?: string;
-        namespace?: string;
-        budget?: number;
-        authenticatedPrincipal?: string;
-        sourceConnector?: string;
-        /**
-         * Disclosure depth used to shape per-result payload (issue #677
-         * PR 3/4).  When set, each X-ray result is decorated with the
-         * matching `disclosure` field and `estimatedTokens` computed from
-         * the actual rendered content at that depth, so the renderer's
-         * "Token spend by disclosure" summary reflects real spend rather
-         * than staying empty when no caller wires the depth knob through.
-         */
-        disclosure?: RecallDisclosure;
-        /**
-         * Free-form recall tag filter (issue #689). Mirrors the field on
-         * `EngramAccessRecallRequest`. When non-empty, the captured X-ray
-         * snapshot's `results` are filtered down to memories whose
-         * frontmatter tags satisfy `tagMatch` ("any" by default), and a
-         * `tag-filter` entry is appended to `filters`.
-         */
-        tags?: string[];
-        /** Match mode for `tags`. See `EngramAccessRecallRequest.tagMatch`. */
-        tagMatch?: "any" | "all";
-        /** Recall planner mode override. Mirrors `EngramAccessRecallRequest.mode`. */
-        mode?: RecallPlanMode | "auto";
-        /**
-         * User-aware context scopes active for this recall. Forwarded into
-         * provenance construction so boundary scopes are evaluated against
-         * the caller's real context instead of an empty-context default.
-         */
-        currentContextScopes?: readonly unknown[];
-        /**
-         * Internal inspector affordance: include a recall-shaped response
-         * derived from the same X-ray snapshot. Left off by default so the
-         * regular X-ray API/CLI/MCP surfaces keep their existing payload shape.
-         */
-        includeRecall?: boolean;
-        /** Cancel the capture before it starts and propagate cancellation to recall. */
-        abortSignal?: AbortSignal;
-    }): Promise<{
-        snapshotFound: boolean;
-        snapshot?: RecallXraySnapshot;
-        recall?: EngramAccessRecallResponse;
-    }>;
-    /**
-     * Rank entities by demonstrated expertise for a topic (issue #2057).
-     * Deterministic — no LLM, no QMD. Reads the namespace-scoped corpus and
-     * entity files only; namespace resolution + ACL mirror recall semantics
-     * (`resolveReadableNamespace`), so a principal cannot rank outside a
-     * namespace it cannot read.
-     */
-    whoKnows(request: {
-        topic: string;
-        limit?: number;
-        namespace?: string;
-        authenticatedPrincipal?: string;
-    }): Promise<WhoKnowsResult>;
-    /**
-     * Read-only promotion-candidate surfacing (issue #2372): agent-subject,
-     * active, reuse-signaled memories in the caller's namespace with no
-     * equivalent in the target layer. No auto-promotion — callers use the
-     * existing promotion commands.
-     */
-    promotionCandidates(request: {
-        namespace?: string;
-        targetNamespace?: string;
-        limit?: number;
-        authenticatedPrincipal?: string;
-    }): Promise<PromotionCandidatesResult>;
-    memoryStore(request: EngramAccessMemoryStoreRequest, hooks?: {
-        enforceWriteQuota?: () => void | Promise<void>;
-    }): Promise<EngramAccessWriteResponse>;
-    peekMemoryStoreIdempotency(rawRequest: EngramAccessMemoryStoreRequest): Promise<EngramAccessIdempotencyStatus>;
-    suggestionSubmit(request: EngramAccessSuggestionSubmitRequest, hooks?: {
-        enforceWriteQuota?: () => void | Promise<void>;
-    }): Promise<EngramAccessWriteResponse>;
-    peekSuggestionSubmitIdempotency(rawRequest: EngramAccessSuggestionSubmitRequest): Promise<EngramAccessIdempotencyStatus>;
-    private validateWriteCandidate;
-    memoryGet(memoryId: string, namespace?: string, principal?: string, sessionKey?: string): Promise<EngramAccessMemoryResponse>;
-    /**
-     * Codegraph parity tool delegate (issue #1554). All three surfaces (MCP,
-     * HTTP, CLI) arrive here via the codegraph_* boundary operations. The
-     * handler lives in coding/codegraph-surfaces.ts; this method just wires
-     * the context. Memory dir + principal + coding-context lookup come from
-     * the orchestrator/access-service fabric -- no handler-side state.
-     */
-    codegraphTool(request: CodegraphSurfaceRequest, authenticatedPrincipal?: string, sourceConnector?: string): Promise<CodegraphSurfaceResponse>;
-    /** Whether the coding_decision tool should appear in tools/list (rule 39). */
-    get decisionRecordSurfaceVisible(): boolean;
-    /**
-     * Thin delegate — handler logic in coding/decision-surfaces.ts (#1548 PR2).
-     * All three surfaces (MCP/HTTP/CLI) arrive here via the boundary operation.
-     * Namespace resolution uses the SAME path as memory_store (principal ACL +
-     * coding overlay + default fallback) so decision records land in the same
-     * storage root.
-     */
-    codingDecision(request: DecisionSurfaceRequest, authenticatedPrincipal?: string, sourceConnector?: string): Promise<DecisionSurfaceResponse>;
-    /** Whether the coding_architecture tool should appear in tools/list (rule 39). */
-    get architectureCardSurfaceVisible(): boolean;
-    /**
-     * Whether the 14 codegraph parity tools should appear in tools/list
-     * (rule 39). Config-only -- runtime availability is checked at call time.
-     * When false the tools array is byte-identical to pre-feature.
-     */
-    get codegraphSurfaceVisible(): boolean;
-    /**
-     * Thin delegate — handler logic in coding/architecture-surfaces.ts (#1548 PR3).
-     * All three surfaces (MCP/HTTP/CLI) arrive here via the boundary operation.
-     * Namespace resolution uses the SAME coding-scoped path as decision records.
-     */
-    codingArchitecture(request: ArchitectureSurfaceRequest, authenticatedPrincipal?: string, sourceConnector?: string): Promise<ArchitectureSurfaceResponse>;
-    /** Whether the coding_delta tool should appear in tools/list (rule 39). */
-    get sessionDeltaSurfaceVisible(): boolean;
-    /**
-     * Thin delegate — handler logic in coding/session-delta-surfaces.ts (#1548 PR4).
-     * All three surfaces (MCP/HTTP/CLI) arrive here via the boundary operation.
-     * Namespace resolution uses the SAME coding-scoped read path as the other
-     * coding surfaces; the delta state file lives under
-     * `<memoryDir>/state/coding-knowledge/<namespace>.json`.
-     */
-    codingDelta(request: DeltaSurfaceRequest, authenticatedPrincipal?: string): Promise<DeltaSurfaceResponse>;
-    /** Whether the memory_correct_plan / memory_correct_apply tools should appear in tools/list (rule 39). Same reader as the runtime gate so visibility + enforcement stay in sync. */
-    get correctionSurfaceVisible(): boolean;
-    private _correctionService;
-    /** Lazily construct + cache the CorrectionService with deps wired from the orchestrator. */
-    private correctionService;
-    /**
-     * Issue #1582 — resolve a single memoryId-or-handle reference to a concrete
-     * memory id. Handles resolve against the session's recall history via the
-     * orchestrator's shared helper (rule 22); raw ids pass through unchanged. A
-     * handle that misses or is ambiguous becomes an EngramAccessInputError so the
-     * boundary maps it to a 400 (rule 34/51 — list candidates, never guess).
-     */
-    private resolveMemoryIdOrHandleInput;
-    correctionPlan(request: CorrectionRequest, opts?: {
-        abortSignal?: AbortSignal;
-    }): Promise<CorrectionPlan>;
-    correctionApply(planId: string, opts: {
-        confirm?: boolean;
-        namespace?: string;
-        sessionKey?: string;
-        principal?: string;
-        abortSignal?: AbortSignal;
-    }): Promise<CorrectionOutcome>;
-    correctionListPending(opts: {
-        namespace?: string;
-        sessionKey?: string;
-        principal?: string;
-    }): Promise<CorrectionPlan[]>;
-    correctionDiscard(planId: string, opts: {
-        namespace?: string;
-        sessionKey?: string;
-        principal?: string;
-    }): Promise<void>;
-    memoryBrowse(request?: EngramAccessMemoryBrowseRequest): Promise<EngramAccessMemoryBrowseResponse>;
-    memoryTimeline(memoryId: string, namespace?: string, limit?: number, principal?: string): Promise<EngramAccessTimelineResponse>;
-    entityList(options?: {
-        namespace?: string;
-        query?: string;
-        limit?: number;
-        offset?: number;
-    }): Promise<EngramAccessEntityListResponse>;
-    entityGet(name: string, namespace?: string): Promise<EngramAccessEntityResponse>;
-    reviewQueue(runId?: string, namespace?: string, principal?: string): Promise<EngramAccessReviewQueueResponse>;
-    maintenance(namespace?: string, principal?: string): Promise<EngramAccessMaintenanceResponse>;
-    quality(namespace?: string, principal?: string): Promise<EngramAccessQualityResponse>;
-    governanceRun(request: {
-        namespace?: string;
-        mode?: "shadow" | "apply";
-        recentDays?: number;
-        maxMemories?: number;
-        batchSize?: number;
-        authenticatedPrincipal?: string;
-    }, principal?: string): Promise<{
-        namespace: string;
-        runId: string;
-        traceId: string;
-        mode: "shadow" | "apply";
-        reviewQueueCount: number;
-        proposedActionCount: number;
-        appliedActionCount: number;
-        summaryPath: string;
-        reportPath: string;
-    }>;
-    entitySynthesisRun(request: {
-        namespace?: string;
-        maxEntities?: number;
-        authenticatedPrincipal?: string;
-    }, principal?: string): Promise<{
-        namespace: string;
-        requested: number;
-        processed: number;
-        remaining: number;
-    }>;
-    procedureMiningRun(request: {
-        namespace?: string;
-        authenticatedPrincipal?: string;
-    }, principal?: string): Promise<{
-        namespace: string;
-        clustersProcessed: number;
-        proceduresWritten: number;
-        skippedReason?: string;
-    }>;
-    liveConnectorsRun(request?: {
-        authenticatedPrincipal?: string;
-        force?: boolean;
-    }, principal?: string): Promise<LiveConnectorsRunSummary>;
-    /**
-     * Run the pattern-reinforcement maintenance job (issue #687 PR 2/4).
-     *
-     * Cluster duplicate non-procedural memories and reinforce the
-     * canonical (most-recent) member.  Gated on
-     * `patternReinforcementEnabled` — when disabled, returns
-     * `{ ran: false, skippedReason: "disabled" }` so the cron payload
-     * surface in CI logs cleanly.
-     *
-     * Resolves the namespace via the same writable path used by
-     * `procedureMiningRun` so cross-tenant writes are impossible
-     * (CLAUDE.md rule 42).
-     *
-     * Delegates the run to `orchestrator.runPatternReinforcement` so
-     * the cadence floor (`patternReinforcementCadenceMs`) is enforced
-     * uniformly across cron + MCP paths (PR #730 review feedback,
-     * Codex P2).  Accepts `force: true` for ad-hoc operator runs that
-     * must bypass the cadence floor — mirrors the pattern used by
-     * other maintenance MCP tools.
-     */
-    patternReinforcementRun(request?: {
-        namespace?: string;
-        authenticatedPrincipal?: string;
-        force?: boolean;
-    }, principal?: string): Promise<{
-        namespace: string;
-        ran: boolean;
-        skippedReason?: "disabled" | "cadence";
-        clustersFound: number;
-        canonicalsUpdated: number;
-        duplicatesSuperseded: number;
-        result?: PatternReinforcementResult;
-    }>;
-    /**
-     * Procedural memory stats (issue #567 PR 5/5). Read-only — resolves the
-     * namespace via the same path used by `recallExplain` / `trustZoneStatus`
-     * so cross-tenant reads are impossible (CLAUDE.md rule 42).
-     */
-    procedureStats(request?: {
-        namespace?: string;
-    }, principal?: string): Promise<ProcedureStatsReport & {
-        namespace: string;
-    }>;
-    /**
-     * Procedure library health maintenance (issue #2370). Shadow-first: the
-     * gate is checked BEFORE any storage read, so `maintenance.enabled=false`
-     * returns `{ enabled: false }` having touched nothing but config. Apply
-     * mode additionally requires `apply: true`; `dryRun: true` forces shadow.
-     *
-     * The authenticated principal (never a client-supplied actor) drives the
-     * namespace via the same writable resolver `procedureMiningRun` uses, so
-     * cross-tenant writes are impossible.
-     */
-    procedureLibraryMaintenance(request: {
-        namespace?: string;
-        apply?: boolean;
-        dryRun?: boolean;
-        authenticatedPrincipal?: string;
-    }, principal?: string): Promise<{
-        enabled: false;
-    } | {
-        enabled: true;
-        namespace: string;
-        report: ProcedureLibraryMaintenanceReport;
-    }>;
-    memorySummarizeHourly(): Promise<{
-        ok: true;
-        message: string;
-        sessionsConsidered: number;
-        sessionsWithEntries: number;
-        summariesWritten: number;
-        staleStore: boolean;
-        newestEntryTimestamp: string | null;
-        scanFailed: boolean;
-        warning?: string;
-    }>;
-    conversationIndexUpdate(request?: {
-        sessionKey?: string;
-        hours?: number;
-        embed?: boolean;
-    }): Promise<{
-        enabled: boolean;
-        sessionKey?: string;
-        sessions: number;
-        chunks: number;
-        skipped: number;
-        skippedSessionKeys: string[];
-        embeddedRuns: number;
-        reason?: string;
-        retryAfterMs?: number;
-    }>;
-    profilingReport(request?: AccessProfilingReportRequest): Promise<AccessProfilingReportResponse>;
-    trustZoneStatus(namespace?: string, principal?: string): Promise<EngramAccessTrustZoneStatusResponse>;
-    trustZoneBrowse(request: EngramAccessTrustZoneBrowseRequest, principal?: string): Promise<EngramAccessTrustZoneBrowseResponse>;
-    trustZonePromote(request: EngramAccessTrustZonePromoteRequest): Promise<EngramAccessTrustZonePromoteResponse>;
-    trustZoneDemoSeed(request: EngramAccessTrustZoneDemoSeedRequest): Promise<EngramAccessTrustZoneDemoSeedResponse>;
-    reviewDisposition(request: EngramAccessReviewDispositionRequest): Promise<EngramAccessReviewDispositionResponse>;
-    private serializeMemory;
-    private serializeMemorySummary;
-    observe(request: EngramAccessObserveRequest, hooks?: {
-        enforceWriteQuota?: () => void | Promise<void>;
-    }): Promise<EngramAccessObserveResponse>;
-    private runObserve;
-    lcmSearch(request: EngramAccessLcmSearchRequest): Promise<EngramAccessLcmSearchResponse>;
-    /**
-     * Resolve the LCM `session_id` a same-session READER (compaction flush/record,
-     * `lcmSearch`, raw-excerpt lookup) must target so it matches the key `observe`
-     * archived under (#1495 thread 2 + #1505 round 3, rule 42). One helper for
-     * EVERY access-surface LCM read so the read key cannot drift from the write key
-     * (rule 22).
-     *
-     * Precedence mirrors `observe`'s effective write namespace:
-     *  - With an explicit `request.namespace`, use the already-authorized
-     *    `resolvedNamespace` (the overlay never applies to an explicit write).
-     *  - With NO explicit namespace, an auto-scoped session was archived under
-     *    its coding-overlay namespace, so overlay the session's bound coding
-     *    context onto the principal self base — the SAME resolution
-     *    `resolveMemoryScopePlan`/recall use. `applyCodingNamespaceOverlay`
-     *    returns the base unchanged when projectScope/namespaces are off or no
-     *    context is bound, so single-store / no-overlay flows collapse to the raw
-     *    sessionKey exactly as before.
-     *
-     * Then encode the `${namespace}:${sessionKey}` prefix via the shared helper
-     * so the read key is byte-for-byte what the LCM write and the recall readers
-     * use.
-     */
-    private resolveLcmReadNamespace;
-    private resolveRawExcerptReadNamespace;
-    /**
-     * The base `resolvedNamespace` an IMPLICIT (no explicit `namespace`)
-     * same-session LCM READER (`resolveRawExcerptReadNamespace`, `lcmSearch`)
-     * passes into {@link resolveLcmReadNamespace} — WITHOUT pre-authorizing
-     * `default` (#1505 thread NBHWz). It decides PROCEED vs SUPPRESS only; the
-     * actual LCM prefix is then resolved by `resolveLcmReadNamespace`, which
-     * mirrors the orchestrator's `lcmReadNamespaceForSession` EXACTLY (rule 39 /
-     * 42): the coding overlay when the principal SELF base is in the readable
-     * recall set, else `config.defaultNamespace` (the raw key).
-     *
-     * Returns `config.defaultNamespace` (PROCEED) whenever the principal has ANY
-     * readable LCM access — either `default` itself is readable, OR a coding
-     * overlay / self base is in the readable recall set. The returned value is
-     * ALWAYS `config.defaultNamespace`, NEVER an arbitrary readable recall
-     * namespace (e.g. `shared`): `resolveLcmReadNamespace` returns this fallback
-     * verbatim only on the overlay-applies-but-self-unreadable branch, where the
-     * orchestrator collapses to the default store — so returning anything but the
-     * default store there would prefix LCM reads with `shared:sessionKey` while
-     * in-prompt recall uses the raw `sessionKey`, diverging the two (cursor
-     * "LCM read gate wrong fallback").
-     *
-     * Returns `undefined` (SUPPRESS) only when NO readable LCM namespace exists —
-     * a restrictive `default` READ policy AND no readable overlay/self — so the
-     * caller emits NO rows instead of throwing `namespace is not readable:
-     * default`. Normal recall still succeeds through the readable self namespace.
-     *
-     * Single-store / namespaces-disabled deployments resolve to
-     * `config.defaultNamespace`, keeping single-user recall byte-for-byte
-     * unchanged.
-     */
-    private resolveImplicitLcmReadFallbackNamespace;
-    private resolveLcmReadSessionKey;
-    /**
-     * Resolve the ORDERED, read-authorized set of LCM `session_id`s a same-session
-     * READER (`lcmSearch`, raw-excerpt disclosure) must query so it matches every
-     * key `observe` archived under across the coding scope (#1505 thread "Include
-     * coding fallback namespaces in LCM reads").
-     *
-     * Mirrors the orchestrator recall path exactly (rule 39): `observe` archives
-     * each turn under `${effectiveNamespace}:${sessionKey}` for whichever namespace
-     * was effective at write time, and normal QMD/file recall searches the primary
-     * coding-overlay namespace AND `codingOverlay.readFallbacks` (project → root).
-     * A single overlay key therefore MISSES rows a branch-scoped session archived at
-     * project/root scope. This returns the primary overlay LCM key first, then one
-     * per read fallback, deduped + ordered so the caller can short-circuit on the
-     * first hit.
-     *
-     * READ-AUTHORIZATION (preserved from the round-3..5 `resolveLcmReadNamespace`
-     * "read" gate; rule 42 / 48): the overlay + fallbacks are `<principal>-project-*`
-     * sub-namespaces authorized transitively by the principal SELF base. They are
-     * included ONLY when the self base is in the readable recall set
-     * (`recallNamespacesForPrincipal`). When the self base is NOT readable (write-
-     * only / self-omitted principal), or when an explicit namespace was supplied,
-     * or no overlay applies, this collapses to the single key
-     * {@link resolveLcmReadSessionKey} returns — byte-for-byte the prior behavior
-     * (single-store / no-overlay flows stay the raw `sessionKey`). No
-     * `<principal>-project-*` key is ever searched for an unauthorized reader (no
-     * cross-tenant read leak).
-     */
-    private resolveScopeProfileLcmReadNamespaces;
-    private lcmSessionIdsForNamespaces;
-    private resolveLcmReadSessionIds;
-    lcmCompactionFlush(request: EngramAccessLcmCompactionFlushRequest): Promise<EngramAccessLcmCompactionFlushResponse>;
-    extractionForceFlush(request: EngramAccessExtractionForceFlushRequest): Promise<EngramAccessExtractionForceFlushResponse>;
-    cancelPendingObservePreparations(sessionKey: string, scopeHint?: string): void;
-    cancelPendingObserveExtractions(sessionKey: string, principal?: string, namespace?: string, scopeHint?: string): void;
-    lcmCompactionRecord(request: EngramAccessLcmCompactionRecordRequest): Promise<EngramAccessLcmCompactionRecordResponse>;
-    continuityAuditGenerate(request: {
-        period?: "weekly" | "monthly";
-        key?: string;
-    }): Promise<{
-        enabled: boolean;
-        reason?: string;
-        period?: string;
-        key?: string;
-        reportPath?: string;
-    }>;
-    continuityIncidentOpen(request: {
-        symptom: string;
-        namespace?: string;
-        principal?: string;
-        triggerWindow?: string;
-        suspectedCause?: string;
-    }): Promise<unknown>;
-    continuityIncidentClose(request: {
-        id: string;
-        namespace?: string;
-        principal?: string;
-        fixApplied: string;
-        verificationResult: string;
-        preventiveRule?: string;
-    }): Promise<unknown>;
-    continuityIncidentList(request: {
-        state?: "open" | "closed" | "all";
-        namespace?: string;
-        principal?: string;
-        limit?: number;
-    }): Promise<unknown>;
-    continuityLoopAddOrUpdate(request: {
-        id: string;
-        cadence: "daily" | "weekly" | "monthly" | "quarterly";
-        purpose: string;
-        status: "active" | "paused" | "retired";
-        killCondition: string;
-        namespace?: string;
-        principal?: string;
-        lastReviewed?: string;
-        notes?: string;
-    }): Promise<unknown>;
-    continuityLoopReview(request: {
-        id: string;
-        namespace?: string;
-        principal?: string;
-        status?: "active" | "paused" | "retired";
-        notes?: string;
-        reviewedAt?: string;
-    }): Promise<unknown>;
-    identityAnchorGet(request: {
-        namespace?: string;
-        principal?: string;
-    }): Promise<unknown>;
-    /**
-     * @deprecated since issue #679 PR 5/5 — the identity-anchor model is
-     * superseded by the peer registry. Use `peerSet({ id: "self", ... })` or
-     * `remnic peer set self` to update the self peer's identity kernel, and
-     * `remnic peer migrate` to seed `peers/self/identity.md` from existing
-     * legacy anchor data. This method continues to function for backward
-     * compatibility but will be removed in a future major version.
-     */
-    identityAnchorUpdate(request: {
-        namespace?: string;
-        principal?: string;
-        identityTraits?: string;
-        communicationPreferences?: string;
-        operatingPrinciples?: string;
-        continuityNotes?: string;
-    }): Promise<unknown>;
-    memoryIdentity(request: {
-        namespace?: string;
-        principal?: string;
-    }): Promise<unknown>;
-    workTask(request: {
-        action: "create" | "get" | "list" | "update" | "transition" | "delete";
-        id?: string;
-        title?: string;
-        description?: string;
-        status?: string;
-        priority?: string;
-        owner?: string;
-        assignee?: string;
-        projectId?: string;
-        tags?: string[];
-        dueAt?: string;
-    }): Promise<unknown>;
-    workProject(request: {
-        action: "create" | "get" | "list" | "update" | "delete" | "link_task";
-        id?: string;
-        name?: string;
-        description?: string;
-        status?: string;
-        owner?: string;
-        tags?: string[];
-        taskId?: string;
-        projectId?: string;
-    }): Promise<unknown>;
-    workBoard(request: {
-        action: "export_markdown" | "export_snapshot" | "import_snapshot";
-        projectId?: string;
-        snapshotJson?: string;
-        linkToMemory?: boolean;
-    }): Promise<unknown>;
-    sharedContextWriteOutput(request: {
-        agentId: string;
-        title: string;
-        content: string;
-        authority?: string;
-        expiresAt?: string;
-        supersedes?: string;
-        /** Authenticated principal resolved by the surface, never client-supplied. */
-        principal?: string;
-    }): Promise<unknown>;
-    sharedFeedbackRecord(request: {
-        agent: string;
-        decision: "approved" | "approved_with_feedback" | "rejected";
-        reason: string;
-        date?: string;
-        learning?: string;
-        outcome?: string;
-        severity?: "low" | "medium" | "high";
-        confidence?: number;
-        workflow?: string;
-        tags?: string[];
-        evidenceWindowStart?: string;
-        evidenceWindowEnd?: string;
-        refs?: string[];
-    }): Promise<unknown>;
-    sharedPrioritiesAppend(request: {
-        agentId: string;
-        text: string;
-    }): Promise<unknown>;
-    sharedContextCrossSignalsRun(request: {
-        date?: string;
-    }): Promise<unknown>;
-    sharedContextCurateDaily(request: {
-        date?: string;
-    }): Promise<unknown>;
-    compoundingWeeklySynthesize(request: {
-        weekId?: string;
-    }): Promise<unknown>;
-    compoundingPromoteCandidate(request: {
-        weekId: string;
-        candidateId: string;
-        dryRun?: boolean;
-    }): Promise<unknown>;
-    compressionGuidelinesOptimize(request: {
-        dryRun?: boolean;
-        eventLimit?: number;
-    }): Promise<unknown>;
-    compressionGuidelinesActivate(request: {
-        expectedContentHash?: string;
-        expectedGuidelineVersion?: number;
-    }): Promise<unknown>;
-    memorySearch(request: {
-        query: string;
-        namespace?: string;
-        maxResults?: number;
-        collection?: string;
-        mode?: "search" | "hybrid" | "bm25" | "vector";
-        principal?: string;
-    }): Promise<{
-        query: string;
-        results: Array<{
-            path: string;
-            score: number;
-            snippet: string;
-        }>;
-        count: number;
-    }>;
-    memoryProfile(namespace?: string, principal?: string): Promise<Record<string, unknown>>;
-    memoryEntitiesList(namespace?: string, principal?: string): Promise<{
-        entities: string[];
-        count: number;
-    }>;
-    memoryQuestions(namespace?: string, principal?: string): Promise<{
-        questions: Array<{
-            id: string;
-            question: string;
-            resolved: boolean;
-        }>;
-        count: number;
-    }>;
-    lastRecallSnapshot(sessionKey?: string): Promise<unknown>;
-    intentDebug(namespace?: string): Promise<unknown>;
-    qmdDebug(namespace?: string): Promise<unknown>;
-    graphExplainLastRecall(namespace?: string): Promise<unknown>;
-    graphSnapshot(request: GraphSnapshotRequest & {
-        namespace?: string;
-    }, authenticatedPrincipal?: string): Promise<GraphSnapshotResponse>;
-    memoryFeedback(request: {
-        memoryId: string;
-        vote: "up" | "down";
-        note?: string;
-    }): Promise<{
-        recorded: boolean;
-        enabled?: boolean;
-        reason?: string;
-    }>;
-    /**
-     * Record a Memory Worth outcome observation (issue #560 PR 3).
-     *
-     * This is distinct from `memoryFeedback` — feedback is a human thumbs
-     * up/down on whether a recalled memory was relevant; outcome is an
-     * automated signal about whether the session that consumed the memory
-     * ultimately succeeded or failed. Outcomes feed the Laplace-smoothed
-     * worth score (`computeMemoryWorth`, PR 2) that PR 4 will use to
-     * downweight memories correlated with bad sessions.
-     *
-     * The underlying writer only touches fact-category memories. Corrections,
-     * procedures, and other kinds return `{ ok: false, reason:
-     * "ineligible_category" }` so a ledger drainer doesn't need to pre-filter.
-     */
-    memoryOutcome(request: {
-        memoryId: string;
-        outcome: MemoryOutcomeKind;
-        namespace?: string;
-        principal?: string;
-        sessionKey?: string;
-        timestamp?: string;
-    }): Promise<RecordMemoryOutcomeResult>;
-    memoryPromote(request: {
-        memoryId: string;
-        namespace?: string;
-        principal?: string;
-        sessionKey?: string;
-    }): Promise<unknown>;
-    memoryActionApply(request: {
-        action: string;
-        outcome?: string;
-        reason?: string;
-        memoryId?: string;
-        namespace?: string;
-        principal?: string;
-        sessionKey?: string;
-        content?: string;
-        category?: string;
-        linkTargetId?: string;
-        linkType?: string;
-        linkStrength?: number;
-        artifactType?: string;
-        execute?: boolean;
-        sourcePrompt?: string;
-        dryRun?: boolean;
-    }): Promise<unknown>;
-    contextCheckpoint(request: {
-        sessionKey: string;
-        context: string;
-        namespace?: string;
-        principal?: string;
-    }): Promise<{
-        saved: boolean;
-    }>;
-    lcmStatus(): Promise<EngramAccessLcmStatusResponse>;
-    recordCitationUsage(request: CitationUsageRequest): Promise<CitationUsageResult>;
-    /**
-     * Gather a point-in-time `ConsoleStateSnapshot` from the orchestrator.
-     *
-     * Principal-aware: `resolveReadableNamespace` enforces ACL before the
-     * snapshot is gathered, so callers cannot read a namespace they don't
-     * have read access to (CLAUDE.md rule 42).  The resolved namespace's
-     * storage directory is forwarded as `config.memoryDir` so the ledger-
-     * tail reader in `gatherConsoleState` scans the correct namespace root
-     * rather than the global root.  Read-only — never mutates orchestrator state.
-     */
-    consoleState(namespace?: string, principal?: string): Promise<ConsoleStateSnapshot>;
-    /**
-     * List all registered peers. Returns the array of `Peer` objects in
-     * deterministic alphabetical order (mirroring `listPeers` storage semantics).
-     */
-    peerList(): Promise<{
-        peers: Peer[];
-    }>;
-    /**
-     * Get a single peer by id. Returns `{ found: false }` when the peer does
-     * not exist rather than throwing, matching the `memoryGet` / `entityGet`
-     * pattern used throughout the service.
-     */
-    peerGet(peerId: string): Promise<{
-        found: true;
-        peer: Peer;
-    } | {
-        found: false;
-    }>;
-    /**
-     * Upsert a peer. Writes `peers/{id}/identity.md`. On first write the
-     * `createdAt` timestamp is set to now; on subsequent writes only
-     * `displayName` and `notes` are mutated (kind and createdAt are immutable
-     * once set, per the storage contract).
-     *
-     * Returns `{ created: true }` on first write, `{ created: false }` on update.
-     */
-    peerSet(input: {
-        id: string;
-        kind?: string;
-        displayName?: string;
-        notes?: string;
-    }): Promise<{
-        ok: true;
-        created: boolean;
-        peer: Peer;
-    }>;
-    /**
-     * Delete a peer by removing `peers/{id}/identity.md`. If the file does not
-     * exist the call is a no-op (idempotent). The peer directory itself
-     * (`peers/{id}/`) is intentionally left in place — profile and interaction
-     * log data are not destroyed.
-     */
-    peerDelete(peerId: string): Promise<{
-        ok: true;
-        deleted: boolean;
-    }>;
-    /**
-     * Destructively purge the entire peer directory for a given peerId —
-     * `identity.md`, `profile.md`, `interactions.log.md`, and any other
-     * files in `peers/{id}/`. Requires `confirm: "yes"` to prevent
-     * accidental invocation.
-     *
-     * This is the DESTRUCTIVE counterpart to `peerDelete`, which only
-     * removes `identity.md`. All companion files are permanently removed.
-     *
-     * Returns `{ ok: true, purged: true }` when the directory existed and
-     * was removed; `{ ok: true, purged: false }` when the directory did
-     * not exist (idempotent no-op).
-     */
-    peerForget(peerId: string, opts: {
-        confirm: string;
-    }): Promise<{
-        ok: true;
-        purged: boolean;
-    }>;
-    /**
-     * Get the evolving cognitive profile for a peer. Returns `{ found: false }`
-     * when no profile file exists yet (profile is written by the async reasoner,
-     * PR 2/5). The peer identity itself need not exist for a profile to exist,
-     * but in practice the reasoner only writes profiles for registered peers.
-     */
-    peerProfileGet(peerId: string): Promise<{
-        found: true;
-        profile: PeerProfile;
-    } | {
-        found: false;
-    }>;
-    get memoryDir(): string;
-    /**
-     * Resolve the storage directory for a given namespace.  Used by the SSE
-     * graph-event handler to subscribe to the correct per-namespace bus rather
-     * than the global root (CLAUDE.md rule 42 — read/write paths must resolve
-     * through the same namespace layer).
-     *
-     * `principal` must be the transport-bound request principal (from
-     * `resolveRequestPrincipal`).  When namespaces are enabled, an absent
-     * principal causes `resolveReadableNamespace` to throw an auth error,
-     * matching the behaviour of every other authenticated read path.
-     *
-     * Falls back to `this.memoryDir` when namespaces are disabled or the
-     * namespace is absent, matching the behaviour of every other read path.
-     */
-    getMemoryDirForNamespace(namespace?: string, principal?: string): Promise<string>;
-    getReadableStorageForNamespace(namespace?: string, principal?: string): Promise<{
-        namespace: string;
-        storage: StorageManager;
-    }>;
-    getWritableStorageForNamespace(namespace?: string, principal?: string): Promise<{
-        principal: string;
-        namespace: string;
-        storage: StorageManager;
-    }>;
-    get storageRef(): StorageManager;
-    get configRef(): PluginConfig;
-    getStorageForResolvedNamespace(namespace: string): Promise<StorageManager>;
-    get localLlmRef(): LocalLlmClient | null;
-    get fallbackLlmRef(): FallbackLlmClient | null;
-    get embeddingLookupFactoryRef(): (storage: StorageManager) => SemanticDedupLookup | undefined;
-    /**
-     * Import a capsule archive into the orchestrator's memory directory.
-     *
-     * Delegates directly to the standalone {@link importCapsuleFn} function.
-     * The `root` parameter defaults to the orchestrator's `memoryDir` when
-     * omitted, so callers that only have access to the service do not need to
-     * thread the config value through.
-     *
-     * `versioning` defaults to the orchestrator's page-versioning config so
-     * `mode: "overwrite"` automatically snapshots prior content without the
-     * caller having to construct the config object.
-     */
-    capsuleImport(opts: Omit<ImportCapsuleOptions, "root" | "memoryDir"> & {
-        root?: string;
-        memoryDir?: string;
-        namespace?: string;
-        principal?: string;
-    }): Promise<ImportCapsuleResult>;
-    private validateCapsuleImportArchivePath;
-    private isCapsuleImportPathInputFsError;
-    private isCapsuleImportArchiveInputError;
-    /**
-     * Export a capsule archive from the orchestrator's memory directory.
-     *
-     * HTTP and future MCP surfaces use this rather than calling the transfer
-     * helper directly so namespace ACL checks stay consistent with the archive
-     * write side effect. The exporter still owns archive construction and
-     * validation.
-     */
-    capsuleExport(opts: Omit<ExportCapsuleOptions, "root" | "memoryDir"> & {
-        root?: string;
-        memoryDir?: string;
-        namespace?: string;
-        principal?: string;
-    }): Promise<ExportCapsuleResult>;
-    capsuleList(options?: {
-        namespace?: string;
-        principal?: string;
-    }): Promise<EngramAccessCapsuleListResponse>;
-    /**
-     * Operator-configured offline-sync excludes (#1786), compiled once per
-     * service instance. Applied to push-side (snapshot/read) enumeration
-     * only — apply-side stays permissive so remote-authoritative runtime
-     * files keep flowing in.
-     */
-    private _offlineSyncUserExcludes;
-    private get offlineSyncUserExcludes();
-    offlineSyncSnapshot(options?: EngramAccessOfflineSyncSnapshotRequest & {
-        signal?: AbortSignal;
-    }): Promise<EngramAccessOfflineSyncSnapshotResponse>;
-    offlineSyncSnapshotStream(options?: Omit<EngramAccessOfflineSyncSnapshotRequest, "baseCapturedAt" | "baseFiles"> & {
-        signal?: AbortSignal;
-    }): Promise<EngramAccessOfflineSyncSnapshotStreamResponse>;
-    offlineSyncManifestStream(options?: EngramAccessOfflineSyncManifestRequest & {
-        signal?: AbortSignal;
-    }): Promise<OfflineSyncManifestStreamResponse>;
-    offlineSyncFiles(options: EngramAccessOfflineSyncFilesRequest): Promise<EngramAccessOfflineSyncFilesResponse>;
-    offlineSyncFileContent(options: EngramAccessOfflineSyncFileContentRequest): Promise<EngramAccessOfflineSyncFileContentResponse>;
-    offlineSyncApplyFileContent(options: EngramAccessOfflineSyncApplyFileContentRequest): Promise<EngramAccessOfflineSyncApplyFileContentResponse>;
-    offlineSyncFinalizeConvergence(options: EngramAccessOfflineSyncFinalizeConvergenceRequest): Promise<EngramAccessOfflineSyncFinalizeConvergenceResponse>;
-    offlineSyncApply(options: EngramAccessOfflineSyncApplyRequest): Promise<EngramAccessOfflineSyncApplyResponse>;
-    /**
-     * Return per-phase Dreams telemetry for the last N hours (default 24).
-     */
-    dreamsStatus(options?: {
-        windowHours?: number;
-        namespace?: string;
-        principal?: string;
-    }): Promise<DreamsStatusResult>;
-    dreamsRun(options: {
-        phase: DreamsPhase;
-        dryRun?: boolean;
-        namespace?: string;
-        authenticatedPrincipal?: string;
-    }): Promise<DreamsRunResult>;
-    /**
-     * Structural host bound per call so the wearables + meetings ops (issue
-     * #2123) delegate to the pure surface module while the namespace/principal
-     * resolvers stay private.
-     */
-    private get wmHost();
-    wearablesStatus(scope?: WearablesMeetingsScope): Promise<Awaited<ReturnType<WearablesService["status"]>>>;
-    wearablesSync(request: {
-        source?: string;
-        date?: string;
-        days?: number;
-        forceMemories?: boolean;
-    } & WearablesMeetingsScope): Promise<Awaited<ReturnType<WearablesService["sync"]>>>;
-    wearablesTranscriptDay(request: {
-        date: string;
-        source?: string;
-    } & WearablesMeetingsScope): Promise<Awaited<ReturnType<WearablesService["dayTranscript"]>>>;
-    wearablesTranscriptSearch(request: {
-        query: string;
-        source?: string;
-        from?: string;
-        to?: string;
-        limit?: number;
-    } & WearablesMeetingsScope): Promise<Awaited<ReturnType<WearablesService["searchTranscripts"]>>>;
-    wearablesTranscriptMemories(request: {
-        source?: string;
-        date?: string;
-        limit?: number;
-    } & WearablesMeetingsScope): Promise<Awaited<ReturnType<WearablesService["transcriptMemories"]>>>;
-    meetingsList(date?: string, scope?: WearablesMeetingsScope): Promise<MeetingsListResult>;
-    meetingsGet(id: string, scope?: WearablesMeetingsScope): Promise<MeetingsGetResult>;
-    meetingsBuild(date: string, scope?: WearablesMeetingsScope): Promise<MeetingsDayBuildSummary>;
-    /**
-     * Resolve an effective scope inspection for the console. Inputs are
-     * redacted before return so an operator-supplied principal preview /
-     * namespace override never echoes a pasted credential back.
-     */
-    adminInspectScope(options: {
-        sessionKey?: string;
-        namespace?: string;
-        principalOverride?: string;
-        operation?: InspectScopeOptions["operation"];
-    }): Promise<ScopeInspection>;
-    /**
-     * List configured + discovered namespaces from the catalog with the
-     * admin filters the console exposes.
-     */
-    adminListNamespaces(filter?: AdminNamespaceFilter): Promise<AdminNamespaceList>;
-    /**
-     * Per-namespace maintenance + QMD health. QMD diagnostics are probed via
-     * the orchestrator's search health accessor (one probe per namespace).
-     */
-    adminMaintenanceHealth(): Promise<MaintenanceHealthReport>;
-    /**
-     * Dry-run transcript/session audit. Detects mixed `other/default` data
-     * and legacy stranded directories. Never applies a migration.
-     */
-    adminTranscriptAudit(): Promise<TranscriptAuditReport>;
-    adminPromoteMemory(request: {
-        sourceMemoryId: string;
-        namespace?: string;
-        principal?: string;
-        sessionKey?: string;
-        targets: ReadonlyArray<{
-            kind: MemoryPromotionTargetKind;
-            namespace?: string;
-        }>;
-        reason: string;
-        actor?: never;
-    }): Promise<MemoryPromotionResult>;
-    reviewDeckList(opts: Parameters<ReviewDeckSurface["list"]>[0]): Promise<ReviewDeckPage>;
-    reviewDeckAction(...args: Parameters<ReviewDeckSurface["action"]>): Promise<ReviewDeckActionReceipt>;
-    reviewDeckUndo(...args: Parameters<ReviewDeckSurface["undo"]>): Promise<ReviewDeckActionReceipt>;
-}
-
-export { type ProcedureMaintenanceReasonCode as $, type AccessProfilingReportRequest as A, type BoundOperation as B, type CodingScopedWriteInput as C, type DecisionSurfaceRequest as D, type EngramAccessReviewQueueResponse as E, type CodegraphSurfaceRequest as F, type CodegraphSurfaceResponse as G, type EngramAccessRecallResponse as H, type EngramAccessRecallRequest as I, type EngramAccessMemorySummary as J, type EngramAccessSetCodingContextRequest as K, type ReviewDeckSnapshot as L, type MemoryPromotionTargetKind as M, EngramMcpServer as N, type OperationName as O, type PromotionCandidatesResult as P, OPERATION_NAMES as Q, type ReviewDeckSourceRow as R, type SubjectBackfillReport as S, PROMOTION_CANDIDATES_DEFAULT_MIN_ACCESS as T, PROMOTION_CANDIDATES_MCP_TOOLS as U, type ProcedureLibraryMaintenanceReport as V, type WhoKnowsResult as W, type ProcedureMaintenanceAction as X, type ProcedureMaintenanceActionKind as Y, type ProcedureMaintenanceEvidence as Z, type ProcedureMaintenanceMarker as _, type AccessProfilingReportResponse as a, SupportPassportGrantStateSchema as a$, type ProcedureStatsConfigSnapshot as a0, type ProcedureStatsRecent as a1, type ProcedureStatsReport as a2, type ProcedureStatusCounts as a3, type PromotionCandidate as a4, type PromotionReuseSignal as a5, type ReviewDeckActionReceipt as a6, type ReviewDeckActionRequest as a7, type ReviewDeckChoice as a8, ReviewDeckCursorError as a9, SupportPassportCardCategorySchema as aA, SupportPassportCardListSchema as aB, type SupportPassportCardMutationInput as aC, SupportPassportCardMutationInputSchema as aD, SupportPassportCardSchema as aE, type SupportPassportCardServiceDependencies as aF, type SupportPassportCardStatus as aG, SupportPassportCardStatusSchema as aH, SupportPassportCardTitleSchema as aI, type SupportPassportCreateGrantInput as aJ, SupportPassportCreateGrantInputSchema as aK, type SupportPassportCreateGrantRequest as aL, SupportPassportCreateGrantRequestSchema as aM, type SupportPassportCreateGrantResult as aN, type SupportPassportCreatedGrant as aO, SupportPassportCreatedGrantSchema as aP, type SupportPassportDraftCard as aQ, SupportPassportDraftCardSchema as aR, type SupportPassportDraftModelInput as aS, SupportPassportDraftModelInputSchema as aT, SupportPassportDraftOutputSchema as aU, type SupportPassportDraftResult as aV, SupportPassportError as aW, type SupportPassportErrorCode as aX, type SupportPassportGrantCardRef as aY, SupportPassportGrantCardRefSchema as aZ, type SupportPassportGrantState as a_, type ReviewDeckCursorScope as aa, type ReviewDeckEvidence as ab, type ReviewDeckItem as ac, type ReviewDeckPage as ad, type ReviewDeckRisk as ae, type ReviewDeckUndoRequest as af, SUBJECT_GUARD_MODES as ag, SUBJECT_GUARD_OVERRIDE_FLAG as ah, SUBJECT_VALUES as ai, SUPPORT_PASSPORT_CARD_CATEGORIES as aj, SUPPORT_PASSPORT_CARD_STATUSES as ak, SUPPORT_PASSPORT_DRAFT_MAX_CONTENT_CHARACTERS as al, SUPPORT_PASSPORT_DRAFT_MAX_MEMORIES as am, SUPPORT_PASSPORT_NOT_IN_GUIDE_ANSWER as an, SUPPORT_PASSPORT_SOURCE_MEMORY_ID_MAX_LENGTH as ao, type SubjectBackfillStorage as ap, type SubjectGuardDecision as aq, SupportPassportAccessSurface as ar, type SupportPassportAccessSurfaceDependencies as as, type SupportPassportAnswerModelInput as at, SupportPassportAnswerModelInputSchema as au, type SupportPassportAnswerOutput as av, SupportPassportAnswerOutputSchema as aw, type SupportPassportAnswerResult as ax, type SupportPassportCard as ay, type SupportPassportCardCategory as az, type EngramAccessCapsuleListResponse as b, isMemorySubject as b$, SupportPassportListCardsInputSchema as b0, SupportPassportListGrantsInputSchema as b1, type SupportPassportManualDraftInput as b2, SupportPassportManualDraftInputSchema as b3, SupportPassportMemoryIdSchema as b4, type SupportPassportMemoryPreview as b5, SupportPassportModelAdapter as b6, type SupportPassportModelAdapterOptions as b7, type SupportPassportModelAuditRecord as b8, SupportPassportModelAuditRecordSchema as b9, WHO_KNOWS_AUTHORSHIP_BONUS as bA, WHO_KNOWS_DEFAULT_LIMIT as bB, WHO_KNOWS_MAX_EVIDENCE as bC, WHO_KNOWS_MAX_LIMIT as bD, WHO_KNOWS_MCP_TOOLS as bE, type WhoKnowsEntity as bF, type WhoKnowsEvidence as bG, type WhoKnowsHit as bH, type WhoKnowsHttpOutcome as bI, type WhoKnowsStorage as bJ, acceptsSupportPassportModelResponse as bK, backfillMemorySubjects as bL, buildReviewDeckPage as bM, buildSupportPassportDirectGatewayConfig as bN, compareReviewDeckRows as bO, computeProcedureStats as bP, computePromotionCandidates as bQ, computeReviewItemRevision as bR, computeSupportPassportCardRevision as bS, computeWhoKnows as bT, createSupportPassportModelAdapter as bU, decodeReviewDeckCursor as bV, encodeReviewDeckCursor as bW, evaluateSubjectGuard as bX, formatProcedureStatsText as bY, handleWhoKnowsHttpQuery as bZ, hashSupportPassportAuditValues as b_, type SupportPassportModelAuditSink as ba, SupportPassportModelAuditStore as bb, SupportPassportModelCallError as bc, type SupportPassportModelClients as bd, type SupportPassportModelFailureMetadata as be, type SupportPassportModelMessage as bf, type SupportPassportModelResultMetadata as bg, type SupportPassportModelRoute as bh, type SupportPassportModelRouteKind as bi, type SupportPassportModelRouteResult as bj, type SupportPassportModelUsage as bk, SupportPassportNamespaceSchema as bl, type SupportPassportOwnerCreateGrantRequest as bm, SupportPassportOwnerCreateGrantRequestSchema as bn, type SupportPassportOwnerGrant as bo, SupportPassportOwnerGrantSchema as bp, type SupportPassportOwnerScope as bq, SupportPassportPublicCardSchema as br, type SupportPassportPublicGuide as bs, SupportPassportPublicGuideSchema as bt, type SupportPassportReplaceCardInput as bu, SupportPassportReplaceCardInputSchema as bv, type SupportPassportRevokeGrantInput as bw, SupportPassportRevokeGrantInputSchema as bx, type SupportPassportRevokeGrantResult as by, SupportPassportSourceMemoryIdSchema as bz, type MemoryPromotionResult as c, type EngramAccessTrustZoneBrowseRequest as c$, isSharedPromotionTarget as c0, isSubjectGuardMode as c1, loadWhoKnowsEntities as c2, projectReviewDeckItem as c3, promotionCandidateKey as c4, resolveSupportPassportModelRoutePlan as c5, resolveWriteSubject as c6, runProcedureLibraryMaintenance as c7, subjectDefaultForCategory as c8, tokenizeTopic as c9, type EngramAccessLcmCompactionRecordRequest as cA, type EngramAccessLcmStatusResponse as cB, type EngramAccessMaintenanceResponse as cC, type EngramAccessMemoryBrowseRequest as cD, type EngramAccessMemoryBrowseResponse as cE, type EngramAccessMemoryRecord as cF, type EngramAccessObserveMessage as cG, type EngramAccessOfflineSyncApplyFileContentRequest as cH, type EngramAccessOfflineSyncApplyFileContentResponse as cI, type EngramAccessOfflineSyncApplyRequest as cJ, type EngramAccessOfflineSyncApplyResponse as cK, type EngramAccessOfflineSyncFileContentRequest as cL, type EngramAccessOfflineSyncFileContentResponse as cM, type EngramAccessOfflineSyncFilesRequest as cN, type EngramAccessOfflineSyncFilesResponse as cO, type EngramAccessOfflineSyncFinalizeConvergenceRequest as cP, type EngramAccessOfflineSyncFinalizeConvergenceResponse as cQ, type EngramAccessOfflineSyncManifestRequest as cR, type EngramAccessOfflineSyncSnapshotRequest as cS, type EngramAccessOfflineSyncSnapshotResponse as cT, type EngramAccessQualityResponse as cU, type EngramAccessRecallExplainRequest as cV, type EngramAccessRecallExplainResponse as cW, type EngramAccessReviewDispositionRequest as cX, type EngramAccessReviewDispositionResponse as cY, type EngramAccessScopeDebug as cZ, type EngramAccessTimelineResponse as c_, validateWhoKnowsInput as ca, type EngramAccessLcmCompactionFlushRequest as cb, type ExtractionForceFlushDelegate as cc, delegateExtractionForceFlush as cd, type OperationContext as ce, type OperationHooks as cf, type OperationSpec as cg, __resetRegistryForTest as ch, coerceBooleanLike as ci, coercePositiveInteger as cj, defineOperation as ck, formatZodIssues as cl, getOperation as cm, listRegisteredOperations as cn, normalizeOptionalPath as co, operationRequiresAuthorizedNamespace as cp, operationUsesPrincipalNamespace as cq, MCP_MIGRATED_OPERATIONS as cr, MCP_SUPPORTED_PROTOCOL_VERSIONS as cs, ENGRAM_ACCESS_WRITE_SCHEMA_VERSION as ct, type EngramAccessActionConfidenceRequest as cu, type EngramAccessActionConfidenceResponse as cv, type EngramAccessDaySummaryRequest as cw, type EngramAccessEntityListResponse as cx, type EngramAccessEntityResponse as cy, type EngramAccessEntitySummary as cz, type EngramAccessExtractionForceFlushRequest as d, type EngramAccessTrustZoneBrowseResponse as d0, type EngramAccessTrustZoneDemoSeedRequest as d1, type EngramAccessTrustZoneDemoSeedResponse as d2, type EngramAccessTrustZonePromoteRequest as d3, type EngramAccessTrustZonePromoteResponse as d4, type EngramAccessTrustZoneRecordSummary as d5, type EngramAccessTrustZoneStatusResponse as d6, type EngramAccessWriteEnvelope as d7, type RetainedCategorySpelling as d8, buildProjectedGovernanceProposedActions as d9, hasGroupedGovernanceActions as da, shapeMemorySummary as db, type EngramAccessExtractionForceFlushResponse as e, EngramAccessService as f, type EngramAccessLcmCompactionFlushResponse as g, type EngramAccessLcmCompactionRecordResponse as h, type EngramAccessOfflineSyncSnapshotStreamResponse as i, type EngramAccessLcmSearchRequest as j, type EngramAccessLcmSearchResponse as k, type McpTool as l, type MemoryScopePlan as m, type EngramAccessMemoryStoreRequest as n, type EngramAccessSuggestionSubmitRequest as o, type EngramAccessBriefingRequest as p, type EngramAccessBriefingResponse as q, type EngramAccessWriteResponse as r, type EngramAccessObserveRequest as s, type EngramAccessObserveResponse as t, type ArchitectureSurfaceRequest as u, type ArchitectureSurfaceResponse as v, type DecisionSurfaceResponse as w, type DeltaSurfaceRequest as x, type DeltaSurfaceResponse as y, type EngramAccessMemoryResponse as z };