@remnic/core 9.14.0 → 9.15.1

package/dist/transfer/capsule-export.js

@@ -1,9 +1,9 @@
 import {
   exportCapsule,
   isValidCapsuleSince
-} from "../chunk-5W7CTZ2E.js";
-import "../chunk-UVYI6VIX.js";
+} from "../chunk-KQAFEZQX.js";
 import "../chunk-WEHSQBFR.js";
+import "../chunk-X7Y7WX73.js";
 import "../chunk-J4EB7DNW.js";
 import "../chunk-BJMBJZ2Y.js";
 import "../chunk-UKJAGEXH.js";

package/dist/transfer/capsule-import.js

@@ -1,13 +1,13 @@
 import {
   importCapsule
-} from "../chunk-ALSGMEJR.js";
+} from "../chunk-7CPOZH6Y.js";
 import "../chunk-5VQJBH2G.js";
 import "../chunk-AITCS2RC.js";
 import "../chunk-XMMESCPD.js";
 import "../chunk-42JKGUFJ.js";
 import "../chunk-PDJTHRAW.js";
-import "../chunk-UVYI6VIX.js";
 import "../chunk-WEHSQBFR.js";
+import "../chunk-X7Y7WX73.js";
 import "../chunk-BJMBJZ2Y.js";
 import "../chunk-UKJAGEXH.js";
 import "../chunk-FP2373TW.js";

package/dist/transfer/import-sqlite.js

@@ -1,8 +1,8 @@
 import {
   importSqlite
-} from "../chunk-PYHOAXTI.js";
-import "../chunk-Z734BLO3.js";
+} from "../chunk-LRGSLV7M.js";
 import "../chunk-G4IAEX6D.js";
+import "../chunk-Z734BLO3.js";
 import "../chunk-RL6NEVXT.js";
 import "../chunk-GCGJW34D.js";
 import "../chunk-PZ5AY32C.js";

package/dist/transfer/types.d.ts

@@ -20,26 +20,26 @@ declare const ExportManifestV1Schema: z.ZodObject<{
         bytes: number;
     }>, "many">;
 }, "strip", z.ZodTypeAny, {
-    format: "openclaw-engram-export";
+    schemaVersion: 1;
     createdAt: string;
-    pluginVersion: string;
     files: {
         path: string;
         sha256: string;
         bytes: number;
     }[];
-    schemaVersion: 1;
+    format: "openclaw-engram-export";
+    pluginVersion: string;
     includesTranscripts: boolean;
 }, {
-    format: "openclaw-engram-export";
+    schemaVersion: 1;
     createdAt: string;
-    pluginVersion: string;
     files: {
         path: string;
         sha256: string;
         bytes: number;
     }[];
-    schemaVersion: 1;
+    format: "openclaw-engram-export";
+    pluginVersion: string;
     includesTranscripts: boolean;
 }>;
 type ExportManifestV1 = z.infer<typeof ExportManifestV1Schema>;
@@ -75,26 +75,26 @@ declare const ExportBundleV1Schema: z.ZodObject<{
             bytes: number;
         }>, "many">;
     }, "strip", z.ZodTypeAny, {
-        format: "openclaw-engram-export";
+        schemaVersion: 1;
         createdAt: string;
-        pluginVersion: string;
         files: {
             path: string;
             sha256: string;
             bytes: number;
         }[];
-        schemaVersion: 1;
+        format: "openclaw-engram-export";
+        pluginVersion: string;
         includesTranscripts: boolean;
     }, {
-        format: "openclaw-engram-export";
+        schemaVersion: 1;
         createdAt: string;
-        pluginVersion: string;
         files: {
             path: string;
             sha256: string;
             bytes: number;
         }[];
-        schemaVersion: 1;
+        format: "openclaw-engram-export";
+        pluginVersion: string;
         includesTranscripts: boolean;
     }>;
     records: z.ZodArray<z.ZodObject<{
@@ -109,15 +109,15 @@ declare const ExportBundleV1Schema: z.ZodObject<{
     }>, "many">;
 }, "strip", z.ZodTypeAny, {
     manifest: {
-        format: "openclaw-engram-export";
+        schemaVersion: 1;
         createdAt: string;
-        pluginVersion: string;
         files: {
             path: string;
             sha256: string;
             bytes: number;
         }[];
-        schemaVersion: 1;
+        format: "openclaw-engram-export";
+        pluginVersion: string;
         includesTranscripts: boolean;
     };
     records: {
@@ -126,15 +126,15 @@ declare const ExportBundleV1Schema: z.ZodObject<{
     }[];
 }, {
     manifest: {
-        format: "openclaw-engram-export";
+        schemaVersion: 1;
         createdAt: string;
-        pluginVersion: string;
         files: {
             path: string;
             sha256: string;
             bytes: number;
         }[];
-        schemaVersion: 1;
+        format: "openclaw-engram-export";
+        pluginVersion: string;
         includesTranscripts: boolean;
     };
     records: {
@@ -319,10 +319,10 @@ declare const CapsuleBlockSchema: z.ZodObject<{
         identityAnchors: boolean;
         peerProfiles: boolean;
     };
-    description: string;
-    id: string;
     schemaVersion: string;
+    id: string;
     version: string;
+    description: string;
     parentCapsule: string | null;
     parent: {
         version: string;
@@ -340,10 +340,10 @@ declare const CapsuleBlockSchema: z.ZodObject<{
         identityAnchors: boolean;
         peerProfiles: boolean;
     };
-    description: string;
-    id: string;
     schemaVersion: string;
+    id: string;
     version: string;
+    description: string;
     parentCapsule: string | null;
     retrievalPolicy: {
         tierWeights: Record<string, number>;
@@ -470,10 +470,10 @@ declare const ExportManifestV2Schema: z.ZodObject<{
             identityAnchors: boolean;
             peerProfiles: boolean;
         };
-        description: string;
-        id: string;
         schemaVersion: string;
+        id: string;
         version: string;
+        description: string;
         parentCapsule: string | null;
         parent: {
             version: string;
@@ -491,10 +491,10 @@ declare const ExportManifestV2Schema: z.ZodObject<{
             identityAnchors: boolean;
             peerProfiles: boolean;
         };
-        description: string;
-        id: string;
         schemaVersion: string;
+        id: string;
         version: string;
+        description: string;
         parentCapsule: string | null;
         retrievalPolicy: {
             tierWeights: Record<string, number>;
@@ -507,14 +507,16 @@ declare const ExportManifestV2Schema: z.ZodObject<{
         } | null | undefined;
     }>;
 }, "strip", z.ZodTypeAny, {
-    format: "openclaw-engram-export";
+    schemaVersion: 2;
     createdAt: string;
-    pluginVersion: string;
     files: {
         path: string;
         sha256: string;
         bytes: number;
     }[];
+    format: "openclaw-engram-export";
+    pluginVersion: string;
+    includesTranscripts: boolean;
     capsule: {
         includes: {
             procedural: boolean;
@@ -522,10 +524,10 @@ declare const ExportManifestV2Schema: z.ZodObject<{
             identityAnchors: boolean;
             peerProfiles: boolean;
         };
-        description: string;
-        id: string;
         schemaVersion: string;
+        id: string;
         version: string;
+        description: string;
         parentCapsule: string | null;
         parent: {
             version: string;
@@ -537,17 +539,17 @@ declare const ExportManifestV2Schema: z.ZodObject<{
             directAnswerEnabled: boolean;
         };
     };
-    schemaVersion: 2;
-    includesTranscripts: boolean;
 }, {
-    format: "openclaw-engram-export";
+    schemaVersion: 2;
     createdAt: string;
-    pluginVersion: string;
     files: {
         path: string;
         sha256: string;
         bytes: number;
     }[];
+    format: "openclaw-engram-export";
+    pluginVersion: string;
+    includesTranscripts: boolean;
     capsule: {
         includes: {
             procedural: boolean;
@@ -555,10 +557,10 @@ declare const ExportManifestV2Schema: z.ZodObject<{
             identityAnchors: boolean;
             peerProfiles: boolean;
         };
-        description: string;
-        id: string;
         schemaVersion: string;
+        id: string;
         version: string;
+        description: string;
         parentCapsule: string | null;
         retrievalPolicy: {
             tierWeights: Record<string, number>;
@@ -570,8 +572,6 @@ declare const ExportManifestV2Schema: z.ZodObject<{
             forkRoot: string;
         } | null | undefined;
     };
-    schemaVersion: 2;
-    includesTranscripts: boolean;
 }>;
 type ExportManifestV2 = z.infer<typeof ExportManifestV2Schema>;
 declare const ExportBundleV2Schema: z.ZodObject<{
@@ -689,10 +689,10 @@ declare const ExportBundleV2Schema: z.ZodObject<{
                 identityAnchors: boolean;
                 peerProfiles: boolean;
             };
-            description: string;
-            id: string;
             schemaVersion: string;
+            id: string;
             version: string;
+            description: string;
             parentCapsule: string | null;
             parent: {
                 version: string;
@@ -710,10 +710,10 @@ declare const ExportBundleV2Schema: z.ZodObject<{
                 identityAnchors: boolean;
                 peerProfiles: boolean;
             };
-            description: string;
-            id: string;
             schemaVersion: string;
+            id: string;
             version: string;
+            description: string;
             parentCapsule: string | null;
             retrievalPolicy: {
                 tierWeights: Record<string, number>;
@@ -726,14 +726,16 @@ declare const ExportBundleV2Schema: z.ZodObject<{
             } | null | undefined;
         }>;
     }, "strip", z.ZodTypeAny, {
-        format: "openclaw-engram-export";
+        schemaVersion: 2;
         createdAt: string;
-        pluginVersion: string;
         files: {
             path: string;
             sha256: string;
             bytes: number;
         }[];
+        format: "openclaw-engram-export";
+        pluginVersion: string;
+        includesTranscripts: boolean;
         capsule: {
             includes: {
                 procedural: boolean;
@@ -741,10 +743,10 @@ declare const ExportBundleV2Schema: z.ZodObject<{
                 identityAnchors: boolean;
                 peerProfiles: boolean;
             };
-            description: string;
-            id: string;
             schemaVersion: string;
+            id: string;
             version: string;
+            description: string;
             parentCapsule: string | null;
             parent: {
                 version: string;
@@ -756,17 +758,17 @@ declare const ExportBundleV2Schema: z.ZodObject<{
                 directAnswerEnabled: boolean;
             };
         };
-        schemaVersion: 2;
-        includesTranscripts: boolean;
     }, {
-        format: "openclaw-engram-export";
+        schemaVersion: 2;
         createdAt: string;
-        pluginVersion: string;
         files: {
             path: string;
             sha256: string;
             bytes: number;
         }[];
+        format: "openclaw-engram-export";
+        pluginVersion: string;
+        includesTranscripts: boolean;
         capsule: {
             includes: {
                 procedural: boolean;
@@ -774,10 +776,10 @@ declare const ExportBundleV2Schema: z.ZodObject<{
                 identityAnchors: boolean;
                 peerProfiles: boolean;
             };
-            description: string;
-            id: string;
             schemaVersion: string;
+            id: string;
             version: string;
+            description: string;
             parentCapsule: string | null;
             retrievalPolicy: {
                 tierWeights: Record<string, number>;
@@ -789,8 +791,6 @@ declare const ExportBundleV2Schema: z.ZodObject<{
                 forkRoot: string;
             } | null | undefined;
         };
-        schemaVersion: 2;
-        includesTranscripts: boolean;
     }>;
     records: z.ZodArray<z.ZodObject<{
         path: z.ZodString;
@@ -804,14 +804,16 @@ declare const ExportBundleV2Schema: z.ZodObject<{
     }>, "many">;
 }, "strip", z.ZodTypeAny, {
     manifest: {
-        format: "openclaw-engram-export";
+        schemaVersion: 2;
         createdAt: string;
-        pluginVersion: string;
         files: {
             path: string;
             sha256: string;
             bytes: number;
         }[];
+        format: "openclaw-engram-export";
+        pluginVersion: string;
+        includesTranscripts: boolean;
         capsule: {
             includes: {
                 procedural: boolean;
@@ -819,10 +821,10 @@ declare const ExportBundleV2Schema: z.ZodObject<{
                 identityAnchors: boolean;
                 peerProfiles: boolean;
             };
-            description: string;
-            id: string;
             schemaVersion: string;
+            id: string;
             version: string;
+            description: string;
             parentCapsule: string | null;
             parent: {
                 version: string;
@@ -834,8 +836,6 @@ declare const ExportBundleV2Schema: z.ZodObject<{
                 directAnswerEnabled: boolean;
             };
         };
-        schemaVersion: 2;
-        includesTranscripts: boolean;
     };
     records: {
         content: string;
@@ -843,14 +843,16 @@ declare const ExportBundleV2Schema: z.ZodObject<{
     }[];
 }, {
     manifest: {
-        format: "openclaw-engram-export";
+        schemaVersion: 2;
         createdAt: string;
-        pluginVersion: string;
         files: {
             path: string;
             sha256: string;
             bytes: number;
         }[];
+        format: "openclaw-engram-export";
+        pluginVersion: string;
+        includesTranscripts: boolean;
         capsule: {
             includes: {
                 procedural: boolean;
@@ -858,10 +860,10 @@ declare const ExportBundleV2Schema: z.ZodObject<{
                 identityAnchors: boolean;
                 peerProfiles: boolean;
             };
-            description: string;
-            id: string;
             schemaVersion: string;
+            id: string;
             version: string;
+            description: string;
             parentCapsule: string | null;
             retrievalPolicy: {
                 tierWeights: Record<string, number>;
@@ -873,8 +875,6 @@ declare const ExportBundleV2Schema: z.ZodObject<{
                 forkRoot: string;
             } | null | undefined;
         };
-        schemaVersion: 2;
-        includesTranscripts: boolean;
     };
     records: {
         content: string;

package/dist/verified-recall.js

@@ -1,9 +1,9 @@
 import {
   compareVerifiedEpisodeResults,
   searchVerifiedEpisodes
-} from "./chunk-W2OST2HH.js";
+} from "./chunk-QLOOCKKE.js";
 import "./chunk-B7RWBZXW.js";
-import "./chunk-7HZMTXXB.js";
+import "./chunk-RWSLO24I.js";
 import "./chunk-B3ABVQ36.js";
 import "./chunk-2QMKMVHH.js";
 import "./chunk-DEBHXHJR.js";
@@ -12,14 +12,14 @@ import "./chunk-6CIAGZ6X.js";
 import "./chunk-J6A3CX5N.js";
 import "./chunk-V57NLO5P.js";
 import "./chunk-YVKF3HEW.js";
-import "./chunk-AVPXXV6J.js";
+import "./chunk-XKGPIWGI.js";
 import "./chunk-EGGE52UU.js";
 import "./chunk-GCASGYIO.js";
 import "./chunk-WL5EBRDH.js";
+import "./chunk-ILGC6JH6.js";
 import "./chunk-SCU65EZI.js";
 import "./chunk-347WD2LE.js";
 import "./chunk-RL6NEVXT.js";
-import "./chunk-ILGC6JH6.js";
 import "./chunk-DM2T26WE.js";
 import "./chunk-LDXUBPMO.js";
 import "./chunk-CGASUJVP.js";
@@ -41,8 +41,8 @@ import "./chunk-45GF7Y3V.js";
 import "./chunk-RGMVMVMF.js";
 import "./chunk-N7RWREIQ.js";
 import "./chunk-5I4M26Q7.js";
-import "./chunk-5GKPFL3S.js";
 import "./chunk-4DJQYKMN.js";
+import "./chunk-5GKPFL3S.js";
 import "./chunk-PQVCH2AE.js";
 import "./chunk-EYIEWJNI.js";
 import "./chunk-JUC24CTX.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@remnic/core",
-  "version": "9.14.0",
+  "version": "9.15.1",
   "description": "Framework-agnostic Remnic memory engine — orchestrator, storage, extraction, search, trust zones",
   "type": "module",
   "main": "dist/index.js",
@@ -3045,7 +3045,7 @@
     "core"
   ],
   "peerDependencies": {
-    "@remnic/coding-graph": "^9.14.0"
+    "@remnic/coding-graph": "^9.15.1"
   },
   "peerDependenciesMeta": {
     "@remnic/coding-graph": {

package/src/access-http.test.ts

@@ -2727,6 +2727,10 @@ test("HTTP namespace/writable preflight returns the structured writability resul
   // is a valid 200 answer (read via `ok`), not an HTTP error.
   const service = {
     configRef: parseConfig({ memoryDir: "/tmp/remnic-http-preflight-test", defaultNamespace: "default" }),
+    namespaceWritablePreflight: async ({ namespace }: { namespace?: string }) =>
+      namespace && namespace !== "default"
+        ? { ok: false as const, reason: "not_writable" as const, namespace }
+        : { ok: true as const, namespace: "default" },
   } as unknown as EngramAccessService;
   const server = new EngramAccessHttpServer({
     service,
@@ -2757,9 +2761,90 @@ test("HTTP namespace/writable preflight returns the structured writability resul
   }
 });
 
+test("HTTP namespace/writable forwards project context to the scoped write preflight", async () => {
+  let received:
+    | {
+        namespace?: string;
+        sessionKey?: string;
+        projectTag?: string;
+        cwd?: string;
+      }
+    | undefined;
+  const service = {
+    configRef: parseConfig({ memoryDir: "/tmp/remnic-http-preflight-context", defaultNamespace: "default" }),
+    namespaceWritablePreflight: async (request: {
+      namespace?: string;
+      sessionKey?: string;
+      projectTag?: string;
+      cwd?: string;
+    }) => {
+      received = request;
+      return { ok: true as const, namespace: "derived-project-namespace" };
+    },
+  } as unknown as EngramAccessService;
+  const server = new EngramAccessHttpServer({
+    service,
+    port: 0,
+    authToken: "test-token",
+    adminConsoleEnabled: false,
+  });
+
+  const status = await server.start();
+  try {
+    const response = await fetch(
+      `http://127.0.0.1:${status.port}/engram/v1/namespace/writable?session=s-1&projectTag=Acme%2FWebshop&cwd=%2Ftmp%2Frepo`,
+      { headers: { authorization: "Bearer test-token" } },
+    );
+    assert.deepEqual(await response.json(), { ok: true, namespace: "derived-project-namespace" });
+    assert.deepEqual(received, {
+      namespace: undefined,
+      sessionKey: "s-1",
+      authenticatedPrincipal: undefined,
+      projectTag: "Acme/Webshop",
+      cwd: "/tmp/repo",
+    });
+  } finally {
+    await server.stop();
+  }
+});
+
+test("HTTP namespace/writable checks token scope against the effective scoped namespace", async () => {
+  const service = {
+    configRef: parseConfig({ memoryDir: "/tmp/remnic-http-preflight-effective", defaultNamespace: "default" }),
+    namespaceWritablePreflight: async () => ({
+      ok: true as const,
+      namespace: "principal-project-derived",
+    }),
+  } as unknown as EngramAccessService;
+  const server = new EngramAccessHttpServer({
+    service,
+    port: 0,
+    authTokenEntriesGetter: () => [
+      { token: "default-only", capabilities: { version: 1, ops: ["observe"], namespaces: ["default"] } },
+    ],
+    adminConsoleEnabled: false,
+  });
+
+  const status = await server.start();
+  try {
+    const response = await fetch(
+      `http://127.0.0.1:${status.port}/engram/v1/namespace/writable?session=s-1&projectTag=Acme%2FWebshop`,
+      { headers: { authorization: "Bearer default-only" } },
+    );
+    assert.deepEqual(await response.json(), {
+      ok: false,
+      reason: "not_writable",
+      namespace: "principal-project-derived",
+    });
+  } finally {
+    await server.stop();
+  }
+});
+
 test("HTTP namespace/writable preflight admits write-scoped tokens and rejects read-only ops", async () => {
   const service = {
     configRef: parseConfig({ memoryDir: "/tmp/remnic-http-preflight-ops-test", defaultNamespace: "default" }),
+    namespaceWritablePreflight: async () => ({ ok: true as const, namespace: "default" }),
   } as unknown as EngramAccessService;
   const server = new EngramAccessHttpServer({
     service,
@@ -2800,6 +2885,12 @@ test("HTTP namespace/writable preflight admits write-scoped tokens and rejects r
     assert.equal(await okOf(diag), false);
     // A read-only token cannot write, so it has nothing to preflight → 403.
     assert.equal((await request("read-only")).status, 403);
+    const invalidOp = await request("write-scoped", "memory_stroe");
+    assert.equal(invalidOp.status, 400);
+    assert.match(
+      JSON.stringify(await invalidOp.json()),
+      /unsupported namespace preflight operation: memory_stroe/,
+    );
   } finally {
     await server.stop();
   }

package/src/access-http.ts

@@ -37,7 +37,7 @@ import {
 import { expandTildePath } from "./utils/path.js";
 import { projectTagProjectId } from "./coding/coding-namespace.js";
 import { getOperation, type OperationName } from "./access-boundary.js";
-import { resolveNamespacePreflight } from "./scopes/scope-plan.js";
+import { resolveQueryNamespaceWritablePreflight } from "./access-namespace-preflight.js";
 import {
   assertOperationAllowed,
   capabilityAllowsOp,
@@ -1467,20 +1467,19 @@ export class EngramAccessHttpServer {
       return;
     }
 
-    // Namespace-writability preflight (issue #1888 part 3): would the client's
-    // enabled write (`?op=observe|memory_store`, default observe) to the
-    // requested namespace by THIS token succeed? Out-of-allow-list → 200
-    // {ok:false}; any allowedByOps token may run it (HTTP + batch admit alike).
     if (req.method === "GET" && pathname === "/engram/v1/namespace/writable") {
-      const preflightOp = getOperation("namespace_writable"); // boundary marker (catalog parity, issue #1888)
-      const caps = tokenCapabilityStore.getStore();
-      if (!(preflightOp?.spec.allowedByOps ?? []).some((op) => capabilityAllowsOp(caps, op))) {
-        throw new EngramAccessForbiddenError("token is not permitted to run the namespace preflight");
-      }
-      const ns = parsed.searchParams.get("namespace") || undefined;
-      const sk = parsed.searchParams.get("session") || undefined;
-      const writeOp = parsed.searchParams.get("op") === "memory_store" ? "memory_store" : "observe";
-      this.respondJson(res, 200, resolveNamespacePreflight(caps, ns, sk, this.resolveRequestPrincipal(req), this.service.configRef, writeOp));
+      if (!getOperation("namespace_writable")) throw new Error("namespace_writable operation is not registered");
+      this.respondJson(
+        res,
+        200,
+        await resolveQueryNamespaceWritablePreflight(
+          tokenCapabilityStore.getStore(),
+          parsed.searchParams,
+          this.resolveRequestPrincipal(req),
+          this.service.configRef.defaultNamespace,
+          (request) => this.service.namespaceWritablePreflight(request),
+        ),
+      );
       return;
     }