@remnic/core 9.15.0 → 9.15.1

package/dist/semantic-rule-promotion.js

@@ -1,8 +1,8 @@
 import {
   promoteSemanticRuleFromMemory,
   setSemanticRulePromotionTestHooks
-} from "./chunk-AS6UOOXF.js";
-import "./chunk-7HZMTXXB.js";
+} from "./chunk-FMMZQDCT.js";
+import "./chunk-RWSLO24I.js";
 import "./chunk-B3ABVQ36.js";
 import "./chunk-2QMKMVHH.js";
 import "./chunk-DEBHXHJR.js";
@@ -11,14 +11,14 @@ import "./chunk-6CIAGZ6X.js";
 import "./chunk-J6A3CX5N.js";
 import "./chunk-V57NLO5P.js";
 import "./chunk-YVKF3HEW.js";
-import "./chunk-AVPXXV6J.js";
+import "./chunk-XKGPIWGI.js";
 import "./chunk-EGGE52UU.js";
 import "./chunk-GCASGYIO.js";
 import "./chunk-WL5EBRDH.js";
+import "./chunk-ILGC6JH6.js";
 import "./chunk-SCU65EZI.js";
 import "./chunk-347WD2LE.js";
 import "./chunk-RL6NEVXT.js";
-import "./chunk-ILGC6JH6.js";
 import "./chunk-DM2T26WE.js";
 import "./chunk-LDXUBPMO.js";
 import "./chunk-CGASUJVP.js";
@@ -40,8 +40,8 @@ import "./chunk-45GF7Y3V.js";
 import "./chunk-RGMVMVMF.js";
 import "./chunk-N7RWREIQ.js";
 import "./chunk-5I4M26Q7.js";
-import "./chunk-5GKPFL3S.js";
 import "./chunk-4DJQYKMN.js";
+import "./chunk-5GKPFL3S.js";
 import "./chunk-PQVCH2AE.js";
 import "./chunk-EYIEWJNI.js";
 import "./chunk-JUC24CTX.js";

package/dist/semantic-rule-verifier.js

@@ -1,8 +1,8 @@
 import {
   compareVerifiedSemanticRuleResults,
   searchVerifiedSemanticRules
-} from "./chunk-IQFS4AU7.js";
-import "./chunk-7HZMTXXB.js";
+} from "./chunk-YEU4VEU4.js";
+import "./chunk-RWSLO24I.js";
 import "./chunk-B3ABVQ36.js";
 import "./chunk-2QMKMVHH.js";
 import "./chunk-DEBHXHJR.js";
@@ -11,14 +11,14 @@ import "./chunk-6CIAGZ6X.js";
 import "./chunk-J6A3CX5N.js";
 import "./chunk-V57NLO5P.js";
 import "./chunk-YVKF3HEW.js";
-import "./chunk-AVPXXV6J.js";
+import "./chunk-XKGPIWGI.js";
 import "./chunk-EGGE52UU.js";
 import "./chunk-GCASGYIO.js";
 import "./chunk-WL5EBRDH.js";
+import "./chunk-ILGC6JH6.js";
 import "./chunk-SCU65EZI.js";
 import "./chunk-347WD2LE.js";
 import "./chunk-RL6NEVXT.js";
-import "./chunk-ILGC6JH6.js";
 import "./chunk-DM2T26WE.js";
 import "./chunk-LDXUBPMO.js";
 import "./chunk-CGASUJVP.js";
@@ -40,8 +40,8 @@ import "./chunk-45GF7Y3V.js";
 import "./chunk-RGMVMVMF.js";
 import "./chunk-N7RWREIQ.js";
 import "./chunk-5I4M26Q7.js";
-import "./chunk-5GKPFL3S.js";
 import "./chunk-4DJQYKMN.js";
+import "./chunk-5GKPFL3S.js";
 import "./chunk-PQVCH2AE.js";
 import "./chunk-EYIEWJNI.js";
 import "./chunk-JUC24CTX.js";

package/dist/storage.js

@@ -16,7 +16,7 @@ import {
   parseFrontmatter,
   parseFrontmatterStringValue,
   serializeEntityFile
-} from "./chunk-7HZMTXXB.js";
+} from "./chunk-RWSLO24I.js";
 import "./chunk-B3ABVQ36.js";
 import "./chunk-2QMKMVHH.js";
 import "./chunk-DEBHXHJR.js";
@@ -25,14 +25,14 @@ import "./chunk-6CIAGZ6X.js";
 import "./chunk-J6A3CX5N.js";
 import "./chunk-V57NLO5P.js";
 import "./chunk-YVKF3HEW.js";
-import "./chunk-AVPXXV6J.js";
+import "./chunk-XKGPIWGI.js";
 import "./chunk-EGGE52UU.js";
 import "./chunk-GCASGYIO.js";
 import "./chunk-WL5EBRDH.js";
+import "./chunk-ILGC6JH6.js";
 import "./chunk-SCU65EZI.js";
 import "./chunk-347WD2LE.js";
 import "./chunk-RL6NEVXT.js";
-import "./chunk-ILGC6JH6.js";
 import "./chunk-DM2T26WE.js";
 import "./chunk-LDXUBPMO.js";
 import "./chunk-CGASUJVP.js";
@@ -57,8 +57,8 @@ import "./chunk-45GF7Y3V.js";
 import "./chunk-RGMVMVMF.js";
 import "./chunk-N7RWREIQ.js";
 import "./chunk-5I4M26Q7.js";
-import "./chunk-5GKPFL3S.js";
 import "./chunk-4DJQYKMN.js";
+import "./chunk-5GKPFL3S.js";
 import "./chunk-PQVCH2AE.js";
 import "./chunk-EYIEWJNI.js";
 import "./chunk-JUC24CTX.js";

package/dist/transfer/backup.js

@@ -1,8 +1,8 @@
 import {
   backupMemoryDir
-} from "../chunk-OWHERGF2.js";
+} from "../chunk-2NLLXCJG.js";
 import "../chunk-765K3SAT.js";
-import "../chunk-UVYI6VIX.js";
+import "../chunk-X7Y7WX73.js";
 import "../chunk-J4EB7DNW.js";
 import "../chunk-BJMBJZ2Y.js";
 import "../chunk-UKJAGEXH.js";

package/dist/transfer/capsule-export.js

@@ -1,9 +1,9 @@
 import {
   exportCapsule,
   isValidCapsuleSince
-} from "../chunk-5W7CTZ2E.js";
-import "../chunk-UVYI6VIX.js";
+} from "../chunk-KQAFEZQX.js";
 import "../chunk-WEHSQBFR.js";
+import "../chunk-X7Y7WX73.js";
 import "../chunk-J4EB7DNW.js";
 import "../chunk-BJMBJZ2Y.js";
 import "../chunk-UKJAGEXH.js";

package/dist/transfer/capsule-import.js

@@ -1,13 +1,13 @@
 import {
   importCapsule
-} from "../chunk-ALSGMEJR.js";
+} from "../chunk-7CPOZH6Y.js";
 import "../chunk-5VQJBH2G.js";
 import "../chunk-AITCS2RC.js";
 import "../chunk-XMMESCPD.js";
 import "../chunk-42JKGUFJ.js";
 import "../chunk-PDJTHRAW.js";
-import "../chunk-UVYI6VIX.js";
 import "../chunk-WEHSQBFR.js";
+import "../chunk-X7Y7WX73.js";
 import "../chunk-BJMBJZ2Y.js";
 import "../chunk-UKJAGEXH.js";
 import "../chunk-FP2373TW.js";

package/dist/transfer/import-sqlite.js

@@ -1,8 +1,8 @@
 import {
   importSqlite
-} from "../chunk-PYHOAXTI.js";
-import "../chunk-Z734BLO3.js";
+} from "../chunk-LRGSLV7M.js";
 import "../chunk-G4IAEX6D.js";
+import "../chunk-Z734BLO3.js";
 import "../chunk-RL6NEVXT.js";
 import "../chunk-GCGJW34D.js";
 import "../chunk-PZ5AY32C.js";

package/dist/transfer/types.d.ts

@@ -313,13 +313,13 @@ declare const CapsuleBlockSchema: z.ZodObject<{
         peerProfiles: boolean;
     }>;
 }, "strip", z.ZodTypeAny, {
-    schemaVersion: string;
     includes: {
         procedural: boolean;
         taxonomy: boolean;
         identityAnchors: boolean;
         peerProfiles: boolean;
     };
+    schemaVersion: string;
     id: string;
     version: string;
     description: string;
@@ -334,13 +334,13 @@ declare const CapsuleBlockSchema: z.ZodObject<{
         directAnswerEnabled: boolean;
     };
 }, {
-    schemaVersion: string;
     includes: {
         procedural: boolean;
         taxonomy: boolean;
         identityAnchors: boolean;
         peerProfiles: boolean;
     };
+    schemaVersion: string;
     id: string;
     version: string;
     description: string;
@@ -464,13 +464,13 @@ declare const ExportManifestV2Schema: z.ZodObject<{
             peerProfiles: boolean;
         }>;
     }, "strip", z.ZodTypeAny, {
-        schemaVersion: string;
         includes: {
             procedural: boolean;
             taxonomy: boolean;
             identityAnchors: boolean;
             peerProfiles: boolean;
         };
+        schemaVersion: string;
         id: string;
         version: string;
         description: string;
@@ -485,13 +485,13 @@ declare const ExportManifestV2Schema: z.ZodObject<{
             directAnswerEnabled: boolean;
         };
     }, {
-        schemaVersion: string;
         includes: {
             procedural: boolean;
             taxonomy: boolean;
             identityAnchors: boolean;
             peerProfiles: boolean;
         };
+        schemaVersion: string;
         id: string;
         version: string;
         description: string;
@@ -518,13 +518,13 @@ declare const ExportManifestV2Schema: z.ZodObject<{
     pluginVersion: string;
     includesTranscripts: boolean;
     capsule: {
-        schemaVersion: string;
         includes: {
             procedural: boolean;
             taxonomy: boolean;
             identityAnchors: boolean;
             peerProfiles: boolean;
         };
+        schemaVersion: string;
         id: string;
         version: string;
         description: string;
@@ -551,13 +551,13 @@ declare const ExportManifestV2Schema: z.ZodObject<{
     pluginVersion: string;
     includesTranscripts: boolean;
     capsule: {
-        schemaVersion: string;
         includes: {
             procedural: boolean;
             taxonomy: boolean;
             identityAnchors: boolean;
             peerProfiles: boolean;
         };
+        schemaVersion: string;
         id: string;
         version: string;
         description: string;
@@ -683,13 +683,13 @@ declare const ExportBundleV2Schema: z.ZodObject<{
                 peerProfiles: boolean;
             }>;
         }, "strip", z.ZodTypeAny, {
-            schemaVersion: string;
             includes: {
                 procedural: boolean;
                 taxonomy: boolean;
                 identityAnchors: boolean;
                 peerProfiles: boolean;
             };
+            schemaVersion: string;
             id: string;
             version: string;
             description: string;
@@ -704,13 +704,13 @@ declare const ExportBundleV2Schema: z.ZodObject<{
                 directAnswerEnabled: boolean;
             };
         }, {
-            schemaVersion: string;
             includes: {
                 procedural: boolean;
                 taxonomy: boolean;
                 identityAnchors: boolean;
                 peerProfiles: boolean;
             };
+            schemaVersion: string;
             id: string;
             version: string;
             description: string;
@@ -737,13 +737,13 @@ declare const ExportBundleV2Schema: z.ZodObject<{
         pluginVersion: string;
         includesTranscripts: boolean;
         capsule: {
-            schemaVersion: string;
             includes: {
                 procedural: boolean;
                 taxonomy: boolean;
                 identityAnchors: boolean;
                 peerProfiles: boolean;
             };
+            schemaVersion: string;
             id: string;
             version: string;
             description: string;
@@ -770,13 +770,13 @@ declare const ExportBundleV2Schema: z.ZodObject<{
         pluginVersion: string;
         includesTranscripts: boolean;
         capsule: {
-            schemaVersion: string;
             includes: {
                 procedural: boolean;
                 taxonomy: boolean;
                 identityAnchors: boolean;
                 peerProfiles: boolean;
             };
+            schemaVersion: string;
             id: string;
             version: string;
             description: string;
@@ -815,13 +815,13 @@ declare const ExportBundleV2Schema: z.ZodObject<{
         pluginVersion: string;
         includesTranscripts: boolean;
         capsule: {
-            schemaVersion: string;
             includes: {
                 procedural: boolean;
                 taxonomy: boolean;
                 identityAnchors: boolean;
                 peerProfiles: boolean;
             };
+            schemaVersion: string;
             id: string;
             version: string;
             description: string;
@@ -854,13 +854,13 @@ declare const ExportBundleV2Schema: z.ZodObject<{
         pluginVersion: string;
         includesTranscripts: boolean;
         capsule: {
-            schemaVersion: string;
             includes: {
                 procedural: boolean;
                 taxonomy: boolean;
                 identityAnchors: boolean;
                 peerProfiles: boolean;
             };
+            schemaVersion: string;
             id: string;
             version: string;
             description: string;

package/dist/verified-recall.js

@@ -1,9 +1,9 @@
 import {
   compareVerifiedEpisodeResults,
   searchVerifiedEpisodes
-} from "./chunk-W2OST2HH.js";
+} from "./chunk-QLOOCKKE.js";
 import "./chunk-B7RWBZXW.js";
-import "./chunk-7HZMTXXB.js";
+import "./chunk-RWSLO24I.js";
 import "./chunk-B3ABVQ36.js";
 import "./chunk-2QMKMVHH.js";
 import "./chunk-DEBHXHJR.js";
@@ -12,14 +12,14 @@ import "./chunk-6CIAGZ6X.js";
 import "./chunk-J6A3CX5N.js";
 import "./chunk-V57NLO5P.js";
 import "./chunk-YVKF3HEW.js";
-import "./chunk-AVPXXV6J.js";
+import "./chunk-XKGPIWGI.js";
 import "./chunk-EGGE52UU.js";
 import "./chunk-GCASGYIO.js";
 import "./chunk-WL5EBRDH.js";
+import "./chunk-ILGC6JH6.js";
 import "./chunk-SCU65EZI.js";
 import "./chunk-347WD2LE.js";
 import "./chunk-RL6NEVXT.js";
-import "./chunk-ILGC6JH6.js";
 import "./chunk-DM2T26WE.js";
 import "./chunk-LDXUBPMO.js";
 import "./chunk-CGASUJVP.js";
@@ -41,8 +41,8 @@ import "./chunk-45GF7Y3V.js";
 import "./chunk-RGMVMVMF.js";
 import "./chunk-N7RWREIQ.js";
 import "./chunk-5I4M26Q7.js";
-import "./chunk-5GKPFL3S.js";
 import "./chunk-4DJQYKMN.js";
+import "./chunk-5GKPFL3S.js";
 import "./chunk-PQVCH2AE.js";
 import "./chunk-EYIEWJNI.js";
 import "./chunk-JUC24CTX.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@remnic/core",
-  "version": "9.15.0",
+  "version": "9.15.1",
   "description": "Framework-agnostic Remnic memory engine — orchestrator, storage, extraction, search, trust zones",
   "type": "module",
   "main": "dist/index.js",
@@ -3045,7 +3045,7 @@
     "core"
   ],
   "peerDependencies": {
-    "@remnic/coding-graph": "^9.15.0"
+    "@remnic/coding-graph": "^9.15.1"
   },
   "peerDependenciesMeta": {
     "@remnic/coding-graph": {

package/src/access-http.test.ts

@@ -2727,6 +2727,10 @@ test("HTTP namespace/writable preflight returns the structured writability resul
   // is a valid 200 answer (read via `ok`), not an HTTP error.
   const service = {
     configRef: parseConfig({ memoryDir: "/tmp/remnic-http-preflight-test", defaultNamespace: "default" }),
+    namespaceWritablePreflight: async ({ namespace }: { namespace?: string }) =>
+      namespace && namespace !== "default"
+        ? { ok: false as const, reason: "not_writable" as const, namespace }
+        : { ok: true as const, namespace: "default" },
   } as unknown as EngramAccessService;
   const server = new EngramAccessHttpServer({
     service,
@@ -2757,9 +2761,90 @@ test("HTTP namespace/writable preflight returns the structured writability resul
   }
 });
 
+test("HTTP namespace/writable forwards project context to the scoped write preflight", async () => {
+  let received:
+    | {
+        namespace?: string;
+        sessionKey?: string;
+        projectTag?: string;
+        cwd?: string;
+      }
+    | undefined;
+  const service = {
+    configRef: parseConfig({ memoryDir: "/tmp/remnic-http-preflight-context", defaultNamespace: "default" }),
+    namespaceWritablePreflight: async (request: {
+      namespace?: string;
+      sessionKey?: string;
+      projectTag?: string;
+      cwd?: string;
+    }) => {
+      received = request;
+      return { ok: true as const, namespace: "derived-project-namespace" };
+    },
+  } as unknown as EngramAccessService;
+  const server = new EngramAccessHttpServer({
+    service,
+    port: 0,
+    authToken: "test-token",
+    adminConsoleEnabled: false,
+  });
+
+  const status = await server.start();
+  try {
+    const response = await fetch(
+      `http://127.0.0.1:${status.port}/engram/v1/namespace/writable?session=s-1&projectTag=Acme%2FWebshop&cwd=%2Ftmp%2Frepo`,
+      { headers: { authorization: "Bearer test-token" } },
+    );
+    assert.deepEqual(await response.json(), { ok: true, namespace: "derived-project-namespace" });
+    assert.deepEqual(received, {
+      namespace: undefined,
+      sessionKey: "s-1",
+      authenticatedPrincipal: undefined,
+      projectTag: "Acme/Webshop",
+      cwd: "/tmp/repo",
+    });
+  } finally {
+    await server.stop();
+  }
+});
+
+test("HTTP namespace/writable checks token scope against the effective scoped namespace", async () => {
+  const service = {
+    configRef: parseConfig({ memoryDir: "/tmp/remnic-http-preflight-effective", defaultNamespace: "default" }),
+    namespaceWritablePreflight: async () => ({
+      ok: true as const,
+      namespace: "principal-project-derived",
+    }),
+  } as unknown as EngramAccessService;
+  const server = new EngramAccessHttpServer({
+    service,
+    port: 0,
+    authTokenEntriesGetter: () => [
+      { token: "default-only", capabilities: { version: 1, ops: ["observe"], namespaces: ["default"] } },
+    ],
+    adminConsoleEnabled: false,
+  });
+
+  const status = await server.start();
+  try {
+    const response = await fetch(
+      `http://127.0.0.1:${status.port}/engram/v1/namespace/writable?session=s-1&projectTag=Acme%2FWebshop`,
+      { headers: { authorization: "Bearer default-only" } },
+    );
+    assert.deepEqual(await response.json(), {
+      ok: false,
+      reason: "not_writable",
+      namespace: "principal-project-derived",
+    });
+  } finally {
+    await server.stop();
+  }
+});
+
 test("HTTP namespace/writable preflight admits write-scoped tokens and rejects read-only ops", async () => {
   const service = {
     configRef: parseConfig({ memoryDir: "/tmp/remnic-http-preflight-ops-test", defaultNamespace: "default" }),
+    namespaceWritablePreflight: async () => ({ ok: true as const, namespace: "default" }),
   } as unknown as EngramAccessService;
   const server = new EngramAccessHttpServer({
     service,
@@ -2800,6 +2885,12 @@ test("HTTP namespace/writable preflight admits write-scoped tokens and rejects r
     assert.equal(await okOf(diag), false);
     // A read-only token cannot write, so it has nothing to preflight → 403.
     assert.equal((await request("read-only")).status, 403);
+    const invalidOp = await request("write-scoped", "memory_stroe");
+    assert.equal(invalidOp.status, 400);
+    assert.match(
+      JSON.stringify(await invalidOp.json()),
+      /unsupported namespace preflight operation: memory_stroe/,
+    );
   } finally {
     await server.stop();
   }

package/src/access-http.ts

@@ -37,7 +37,7 @@ import {
 import { expandTildePath } from "./utils/path.js";
 import { projectTagProjectId } from "./coding/coding-namespace.js";
 import { getOperation, type OperationName } from "./access-boundary.js";
-import { resolveNamespacePreflight } from "./scopes/scope-plan.js";
+import { resolveQueryNamespaceWritablePreflight } from "./access-namespace-preflight.js";
 import {
   assertOperationAllowed,
   capabilityAllowsOp,
@@ -1467,20 +1467,19 @@ export class EngramAccessHttpServer {
       return;
     }
 
-    // Namespace-writability preflight (issue #1888 part 3): would the client's
-    // enabled write (`?op=observe|memory_store`, default observe) to the
-    // requested namespace by THIS token succeed? Out-of-allow-list → 200
-    // {ok:false}; any allowedByOps token may run it (HTTP + batch admit alike).
     if (req.method === "GET" && pathname === "/engram/v1/namespace/writable") {
-      const preflightOp = getOperation("namespace_writable"); // boundary marker (catalog parity, issue #1888)
-      const caps = tokenCapabilityStore.getStore();
-      if (!(preflightOp?.spec.allowedByOps ?? []).some((op) => capabilityAllowsOp(caps, op))) {
-        throw new EngramAccessForbiddenError("token is not permitted to run the namespace preflight");
-      }
-      const ns = parsed.searchParams.get("namespace") || undefined;
-      const sk = parsed.searchParams.get("session") || undefined;
-      const writeOp = parsed.searchParams.get("op") === "memory_store" ? "memory_store" : "observe";
-      this.respondJson(res, 200, resolveNamespacePreflight(caps, ns, sk, this.resolveRequestPrincipal(req), this.service.configRef, writeOp));
+      if (!getOperation("namespace_writable")) throw new Error("namespace_writable operation is not registered");
+      this.respondJson(
+        res,
+        200,
+        await resolveQueryNamespaceWritablePreflight(
+          tokenCapabilityStore.getStore(),
+          parsed.searchParams,
+          this.resolveRequestPrincipal(req),
+          this.service.configRef.defaultNamespace,
+          (request) => this.service.namespaceWritablePreflight(request),
+        ),
+      );
       return;
     }
 

package/src/access-namespace-preflight.test.ts

@@ -0,0 +1,111 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+
+import "./access-operations.js";
+import { getOperation } from "./access-boundary.js";
+import { tokenCapabilityStore, type TokenCapabilities } from "./access-token-capabilities.js";
+import {
+  assertNamespacePreflightPermitted,
+  resolveAuthorizedNamespaceWritablePreflight,
+  resolveQueryNamespaceWritablePreflight,
+  type EngramAccessNamespaceWritableRequest,
+} from "./access-namespace-preflight.js";
+import type { EngramAccessService } from "./access-service.js";
+
+test("namespace_writable forwards coding context through the batch boundary", async () => {
+  let received: EngramAccessNamespaceWritableRequest | undefined;
+  const service = {
+    configRef: { defaultNamespace: "default" },
+    namespaceWritablePreflight: async (request: EngramAccessNamespaceWritableRequest) => {
+      received = request;
+      return { ok: true as const, namespace: "principal-project" };
+    },
+  } as unknown as EngramAccessService;
+  const operation = getOperation("namespace_writable");
+  assert.ok(operation);
+
+  const caps: TokenCapabilities = { version: 1, ops: ["observe"] };
+  const output = await tokenCapabilityStore.run(caps, () =>
+    operation.run(
+      {
+        sessionKey: "session-1",
+        cwd: "/workspace/project",
+        projectTag: "project-tag",
+      },
+      { service, authenticatedPrincipal: "principal" },
+    ),
+  );
+
+  assert.deepEqual(output, { result: { ok: true, namespace: "principal-project" } });
+  assert.deepEqual(received, {
+    sessionKey: "session-1",
+    authenticatedPrincipal: "principal",
+    cwd: "/workspace/project",
+    projectTag: "project-tag",
+  });
+});
+
+test("namespace_writable rejects unsupported write operations", async () => {
+  const operation = getOperation("namespace_writable");
+  assert.ok(operation);
+  const service = {
+    configRef: { defaultNamespace: "default" },
+    namespaceWritablePreflight: async () => ({ ok: true as const, namespace: "default" }),
+  } as unknown as EngramAccessService;
+
+  await assert.rejects(
+    () =>
+      tokenCapabilityStore.run({ version: 1, ops: ["observe"] }, () =>
+        operation.run({ op: "memory_stroe" }, { service }),
+      ),
+    /unsupported namespace preflight operation: memory_stroe/,
+  );
+  assert.throws(
+    () =>
+      resolveQueryNamespaceWritablePreflight(
+        { version: 1, ops: ["observe"] },
+        new URLSearchParams({ op: "memory_stroe" }),
+        undefined,
+        "default",
+        async () => ({ ok: true, namespace: "default" }),
+      ),
+    /unsupported namespace preflight operation: memory_stroe/,
+  );
+});
+
+test("namespace_writable rejects unavailable preflight and denied write scope", async () => {
+  assert.throws(
+    () => assertNamespacePreflightPermitted({ version: 1, ops: ["memory_get"] }),
+    /token is not permitted to run the namespace preflight/,
+  );
+  assert.deepEqual(
+    await resolveAuthorizedNamespaceWritablePreflight(
+      { version: 1, ops: ["observe"] },
+      { namespace: "default" },
+      "default",
+      "memory_store",
+      async () => ({ ok: true, namespace: "default" }),
+    ),
+    { ok: false, reason: "not_writable", namespace: "default" },
+  );
+  assert.deepEqual(
+    await resolveAuthorizedNamespaceWritablePreflight(
+      { version: 1, ops: ["observe"], namespaces: ["team-a"] },
+      {},
+      "default",
+      "observe",
+      async () => ({ ok: true, namespace: "default" }),
+    ),
+    { ok: false, reason: "not_writable", namespace: "default" },
+  );
+  assert.deepEqual(
+    await resolveAuthorizedNamespaceWritablePreflight(
+      { version: 1, ops: ["observe"], namespaces: ["team-a"] },
+      { namespace: "outside-scope" },
+      "default",
+      "observe",
+      async () => ({ ok: false, reason: "unsupported", namespace: "outside-scope" }),
+    ),
+    { ok: false, reason: "not_writable", namespace: "outside-scope" },
+  );
+});