@remnic/core 9.3.733 → 9.3.735

package/src/access-service.ts

@@ -5,7 +5,12 @@ import { readdirSync, unlinkSync } from "node:fs";
 import { createHash } from "node:crypto";
 import { ZodError } from "zod";
 import { AccessIdempotencyStore, hashAccessIdempotencyPayload } from "./access-idempotency.js";
-import { resolveMemoryLifecycleCapabilities } from "./capabilities.js";
+import {
+  resolveNamespaceCapabilities,
+  resolveMemoryLifecycleCapabilities,
+  resolveQmdCapabilities,
+  resolveIdentityContinuityCapabilities,
+  resolveSecurityCapabilities, resolveObjectiveStateCapabilities, resolveCompressionCapabilities} from "./capabilities.js";
 import { AccessAuditAdapter, type AccessAuditConfig, type AccessAuditResult } from "./access-audit.js";
 import type { AnomalyDetectorResult } from "./recall-audit-anomaly.js";
 import { resolveGitContext } from "./coding/git-context.js";
@@ -1339,7 +1344,7 @@ export class EngramAccessService {
   private resolveNamespace(namespace?: string): string {
     const requested = namespace?.trim();
     if (!requested) return this.orchestrator.config.defaultNamespace;
-    if (!this.orchestrator.config.namespacesEnabled && requested !== this.orchestrator.config.defaultNamespace) {
+    if (!resolveNamespaceCapabilities(this.orchestrator.config).namespaces && requested !== this.orchestrator.config.defaultNamespace) {
       throw new EngramAccessInputError(`unsupported namespace: ${requested}`);
     }
     return requested;
@@ -1458,14 +1463,14 @@ export class EngramAccessService {
       typeof request.sessionKey === "string" && request.sessionKey.length > 0;
     const codingContext =
       hasSession &&
-      this.orchestrator.config.namespacesEnabled &&
+      resolveNamespaceCapabilities(this.orchestrator.config).namespaces &&
       this.orchestrator.config.codingMode?.projectScope
         ? this.orchestrator.getCodingContextForSession(request.sessionKey) ??
           (await this.resolveCodingContextFromOptions(request))
         : null;
     const overlay =
       hasSession &&
-      this.orchestrator.config.namespacesEnabled &&
+      resolveNamespaceCapabilities(this.orchestrator.config).namespaces &&
       this.orchestrator.config.codingMode?.projectScope
         ? resolveCodingNamespaceOverlay(
             codingContext,
@@ -1686,7 +1691,7 @@ export class EngramAccessService {
       typeof request.sessionKey === "string" && request.sessionKey.length > 0;
     const overlayEligible =
       hasSession &&
-      this.orchestrator.config.namespacesEnabled === true &&
+      resolveNamespaceCapabilities(this.orchestrator.config).namespaces === true &&
       this.orchestrator.config.codingMode?.projectScope === true;
 
     // Resolve the coding context the overlay must use: the session's ATTACHED
@@ -1818,11 +1823,11 @@ export class EngramAccessService {
       // are off the self base collapses to config.defaultNamespace, so this is a
       // no-op for single-store deployments either way.
       const willWriteObjectiveState =
-        this.orchestrator.config.objectiveStateMemoryEnabled === true &&
-        this.orchestrator.config.objectiveStateSnapshotWritesEnabled === true;
+        resolveObjectiveStateCapabilities(this.orchestrator.config).objectiveStateMemory === true &&
+        resolveObjectiveStateCapabilities(this.orchestrator.config).objectiveStateSnapshotWrites === true;
       if (
         willWriteObjectiveState &&
-        this.orchestrator.config.namespacesEnabled === true &&
+        resolveNamespaceCapabilities(this.orchestrator.config).namespaces === true &&
         !canWriteNamespace(principal, baseNamespace, this.orchestrator.config)
       ) {
         clearSeededContext();
@@ -1897,7 +1902,7 @@ export class EngramAccessService {
     memoryDir: string;
     objectiveStateStoreDir?: string;
   }> {
-    if (!this.orchestrator.config.namespacesEnabled) {
+    if (!resolveNamespaceCapabilities(this.orchestrator.config).namespaces) {
       return {
         memoryDir: this.orchestrator.config.memoryDir,
         objectiveStateStoreDir: this.orchestrator.config.objectiveStateStoreDir,
@@ -1909,7 +1914,7 @@ export class EngramAccessService {
       objectiveStateStoreDir: objectiveStateStoreOverrideForNamespace({
         memoryDir: this.orchestrator.config.memoryDir,
         configuredStoreDir: this.orchestrator.config.objectiveStateStoreDir,
-        namespacesEnabled: this.orchestrator.config.namespacesEnabled,
+        namespacesEnabled: resolveNamespaceCapabilities(this.orchestrator.config).namespaces,
         namespace,
       }),
     };
@@ -1917,7 +1922,7 @@ export class EngramAccessService {
 
   private resolveReadableNamespace(namespace: string | undefined, principal?: string): string {
     const resolved = this.resolveNamespace(namespace);
-    const namespacesEnabled = this.orchestrator.config.namespacesEnabled;
+    const namespacesEnabled = resolveNamespaceCapabilities(this.orchestrator.config).namespaces;
 
     if (!namespacesEnabled) {
       // Namespaces are disabled globally — no ACL needed for any caller.
@@ -1946,7 +1951,7 @@ export class EngramAccessService {
       return [this.resolveReadableNamespace(requested, principal)];
     }
 
-    if (!this.orchestrator.config.namespacesEnabled) {
+    if (!resolveNamespaceCapabilities(this.orchestrator.config).namespaces) {
       return [this.resolveNamespace(undefined)];
     }
 
@@ -1998,7 +2003,7 @@ export class EngramAccessService {
     namespaces: string[],
     collectionPrincipal?: string,
   ): string[] {
-    if (!this.orchestrator.config.namespacesEnabled) {
+    if (!resolveNamespaceCapabilities(this.orchestrator.config).namespaces) {
       return namespaces;
     }
 
@@ -2702,7 +2707,7 @@ export class EngramAccessService {
     const resolvedNamespace = this.resolveNamespace(namespace);
     const storage = await this.orchestrator.getStorage(resolvedNamespace);
     const searchBackend = this.orchestrator.config.searchBackend ?? "qmd";
-    const qmdEnabled = this.orchestrator.config.qmdEnabled === true;
+    const qmdEnabled = resolveQmdCapabilities(this.orchestrator.config).qmd === true;
     let projectionAvailable = false;
     try {
       await stat(getMemoryProjectionPath(storage.dir));
@@ -2714,7 +2719,7 @@ export class EngramAccessService {
     return {
       ok: true,
       memoryDir: storage.dir,
-      namespacesEnabled: this.orchestrator.config.namespacesEnabled === true,
+      namespacesEnabled: resolveNamespaceCapabilities(this.orchestrator.config).namespaces === true,
       defaultNamespace: this.orchestrator.config.defaultNamespace,
       searchBackend,
       qmdEnabled,
@@ -2730,7 +2735,7 @@ export class EngramAccessService {
   }
 
   private qmdCollectionForHealth(namespace: string, storageDir: string): string {
-    if (this.orchestrator.config.namespacesEnabled !== true) {
+    if (resolveNamespaceCapabilities(this.orchestrator.config).namespaces !== true) {
       return this.orchestrator.config.qmdCollection;
     }
 
@@ -2766,7 +2771,7 @@ export class EngramAccessService {
       };
     }
 
-    if (this.orchestrator.config.namespacesEnabled === true) {
+    if (resolveNamespaceCapabilities(this.orchestrator.config).namespaces === true) {
       const namespaceHealth = await this.namespaceQmdHealth(searchBackend, qmdEnabled, namespace, collection);
       if (namespaceHealth) return namespaceHealth;
     }
@@ -3224,7 +3229,7 @@ export class EngramAccessService {
     const normalizedRequest = { ...request, query };
     const authenticatedPrincipal = request.authenticatedPrincipal?.trim();
     const principal = this.resolveRequestPrincipal(request.sessionKey, authenticatedPrincipal);
-    if (this.orchestrator.config.namespacesEnabled && !principal) {
+    if (resolveNamespaceCapabilities(this.orchestrator.config).namespaces && !principal) {
       throw new EngramAccessInputError(
         "authentication required: namespaces are enabled and no principal was supplied",
       );
@@ -3307,7 +3312,7 @@ export class EngramAccessService {
     // accounting (Codex P1: budget recorded before mode validation).
     const mode = this.normalizeRecallMode(request.mode);
     const maybePrincipal = this.resolveRequestPrincipal(request.sessionKey, authenticatedPrincipal);
-    if (this.orchestrator.config.namespacesEnabled && !maybePrincipal) {
+    if (resolveNamespaceCapabilities(this.orchestrator.config).namespaces && !maybePrincipal) {
       throw new EngramAccessInputError(
         "authentication required: namespaces are enabled and no principal was supplied",
       );
@@ -3321,7 +3326,7 @@ export class EngramAccessService {
     const profileCodingOverlay =
       !namespaceOverride &&
       profileCodingContext &&
-      this.orchestrator.config.namespacesEnabled &&
+      resolveNamespaceCapabilities(this.orchestrator.config).namespaces &&
       this.orchestrator.config.codingMode?.projectScope
         ? resolveCodingNamespaceOverlay(
             profileCodingContext,
@@ -3725,7 +3730,7 @@ export class EngramAccessService {
         return { found: false };
       }
     } else if (
-      this.orchestrator.config.namespacesEnabled
+      resolveNamespaceCapabilities(this.orchestrator.config).namespaces
       && !principal
     ) {
       return { found: false };
@@ -3744,7 +3749,7 @@ export class EngramAccessService {
         return candidate.namespace === requestedNamespace ? candidate : null;
       })();
     const readableSnapshot = (() => {
-      if (!snapshot || !this.orchestrator.config.namespacesEnabled) return snapshot;
+      if (!snapshot || !resolveNamespaceCapabilities(this.orchestrator.config).namespaces) return snapshot;
       const snapshotNamespace = snapshot.namespace ?? this.orchestrator.config.defaultNamespace;
       return canReadNamespace(principal, snapshotNamespace, this.orchestrator.config)
         ? snapshot
@@ -3754,7 +3759,7 @@ export class EngramAccessService {
       if (requestedNamespace) return requestedNamespace;
       if (readableSnapshot?.namespace) return readableSnapshot.namespace;
       const fallbackNamespace = this.orchestrator.config.defaultNamespace;
-      if (!this.orchestrator.config.namespacesEnabled) return fallbackNamespace;
+      if (!resolveNamespaceCapabilities(this.orchestrator.config).namespaces) return fallbackNamespace;
       return canReadNamespace(principal, fallbackNamespace, this.orchestrator.config)
         ? fallbackNamespace
         : null;
@@ -3773,7 +3778,7 @@ export class EngramAccessService {
     namespace?: string,
     authenticatedPrincipal?: string,
   ) {
-    const namespacesEnabled = this.orchestrator.config.namespacesEnabled;
+    const namespacesEnabled = resolveNamespaceCapabilities(this.orchestrator.config).namespaces;
     const requestedNamespace = namespace?.trim()
       ? this.resolveNamespace(namespace)
       : undefined;
@@ -3882,7 +3887,7 @@ export class EngramAccessService {
       );
     }
 
-    const namespacesEnabled = this.orchestrator.config.namespacesEnabled;
+    const namespacesEnabled = resolveNamespaceCapabilities(this.orchestrator.config).namespaces;
     const requestedNamespace = request.namespace?.trim()
       ? this.resolveNamespace(request.namespace)
       : undefined;
@@ -5573,9 +5578,9 @@ export class EngramAccessService {
       status: await getTrustZoneStoreStatus({
         memoryDir: storage.dir,
         trustZoneStoreDir: this.orchestrator.config.trustZoneStoreDir,
-        enabled: this.orchestrator.config.trustZonesEnabled === true,
-        promotionEnabled: this.orchestrator.config.quarantinePromotionEnabled === true,
-        poisoningDefenseEnabled: this.orchestrator.config.memoryPoisoningDefenseEnabled === true,
+        enabled: resolveSecurityCapabilities(this.orchestrator.config).trustZones === true,
+        promotionEnabled: resolveSecurityCapabilities(this.orchestrator.config).quarantinePromotion === true,
+        poisoningDefenseEnabled: resolveSecurityCapabilities(this.orchestrator.config).memoryPoisoningDefense === true,
       }),
     };
   }
@@ -5607,9 +5612,9 @@ export class EngramAccessService {
           entry.record,
           entry.filePath,
           result.allRecords,
-          this.orchestrator.config.memoryPoisoningDefenseEnabled === true,
-          this.orchestrator.config.trustZonesEnabled === true,
-          this.orchestrator.config.quarantinePromotionEnabled === true,
+          resolveSecurityCapabilities(this.orchestrator.config).memoryPoisoningDefense === true,
+          resolveSecurityCapabilities(this.orchestrator.config).trustZones === true,
+          resolveSecurityCapabilities(this.orchestrator.config).quarantinePromotion === true,
         )),
     };
   }
@@ -5631,9 +5636,9 @@ export class EngramAccessService {
       result = await promoteTrustZoneRecord({
         memoryDir: storage.dir,
         trustZoneStoreDir: this.orchestrator.config.trustZoneStoreDir,
-        enabled: this.orchestrator.config.trustZonesEnabled === true,
-        promotionEnabled: this.orchestrator.config.quarantinePromotionEnabled === true,
-        poisoningDefenseEnabled: this.orchestrator.config.memoryPoisoningDefenseEnabled === true,
+        enabled: resolveSecurityCapabilities(this.orchestrator.config).trustZones === true,
+        promotionEnabled: resolveSecurityCapabilities(this.orchestrator.config).quarantinePromotion === true,
+        poisoningDefenseEnabled: resolveSecurityCapabilities(this.orchestrator.config).memoryPoisoningDefense === true,
         sourceRecordId: request.recordId,
         targetZone: request.targetZone,
         recordedAt: request.recordedAt ?? new Date().toISOString(),
@@ -5665,7 +5670,7 @@ export class EngramAccessService {
       result = await seedTrustZoneDemoDataset({
         memoryDir: storage.dir,
         trustZoneStoreDir: this.orchestrator.config.trustZoneStoreDir,
-        enabled: this.orchestrator.config.trustZonesEnabled === true,
+        enabled: resolveSecurityCapabilities(this.orchestrator.config).trustZones === true,
         scenario: request.scenario,
         recordedAt: request.recordedAt,
         dryRun: request.dryRun === true,
@@ -5874,8 +5879,8 @@ export class EngramAccessService {
     // overlay-compatible base namespace for those writes.
     const namespace = this.legacyResponseNamespaceForScope(scope);
     const shouldWriteObjectiveState =
-      this.orchestrator.config.objectiveStateMemoryEnabled === true &&
-      this.orchestrator.config.objectiveStateSnapshotWritesEnabled === true;
+      resolveObjectiveStateCapabilities(this.orchestrator.config).objectiveStateMemory === true &&
+      resolveObjectiveStateCapabilities(this.orchestrator.config).objectiveStateSnapshotWrites === true;
 
     // 2. Auto-resolve coding context from cwd/projectTag so a LATER bare recall
     //    on the same session is project-scoped (rule 42: same namespace layer as
@@ -5914,9 +5919,9 @@ export class EngramAccessService {
         await recordObjectiveStateSnapshotsFromObservedMessages({
           memoryDir: objectiveStateLocation.memoryDir,
           objectiveStateStoreDir: objectiveStateLocation.objectiveStateStoreDir,
-          objectiveStateMemoryEnabled: this.orchestrator.config.objectiveStateMemoryEnabled,
+          objectiveStateMemoryEnabled: resolveObjectiveStateCapabilities(this.orchestrator.config).objectiveStateMemory,
           objectiveStateSnapshotWritesEnabled:
-            this.orchestrator.config.objectiveStateSnapshotWritesEnabled,
+            resolveObjectiveStateCapabilities(this.orchestrator.config).objectiveStateSnapshotWrites,
           sessionKey: request.sessionKey,
           recordedAt: new Date().toISOString(),
           messages: request.messages,
@@ -5983,7 +5988,7 @@ export class EngramAccessService {
       // namespace to one store, so leaving the override undefined preserves the
       // existing single-store routing byte-for-byte.
       const writeNamespaceOverride =
-        this.orchestrator.config.namespacesEnabled === true
+        resolveNamespaceCapabilities(this.orchestrator.config).namespaces === true
           ? writeNamespace
           : undefined;
       // Pin provenance PRINCIPAL to the scope plan's resolved principal (#1505
@@ -6188,7 +6193,7 @@ export class EngramAccessService {
       (typeof request.sessionKey === "string" &&
         request.sessionKey.length > 0) ||
       lcmSessionPrefixes.some((prefix) => typeof prefix === "string" && prefix.length > 0);
-    if (!hasScopedSession && this.orchestrator.config.namespacesEnabled === true) {
+    if (!hasScopedSession && resolveNamespaceCapabilities(this.orchestrator.config).namespaces === true) {
       return {
         query: request.query,
         namespace,
@@ -6483,7 +6488,7 @@ export class EngramAccessService {
     principal: string | undefined,
   ): string | undefined {
     const config = this.orchestrator.config;
-    if (!config.namespacesEnabled) return config.defaultNamespace;
+    if (!resolveNamespaceCapabilities(config).namespaces) return config.defaultNamespace;
     // PROCEED when `default` is readable (single-store / readable-default flows)
     // — the LCM prefix resolves to the overlay when self-authorized, else the
     // default raw key.
@@ -6824,7 +6829,7 @@ export class EngramAccessService {
     period?: "weekly" | "monthly";
     key?: string;
   }): Promise<{ enabled: boolean; reason?: string; period?: string; key?: string; reportPath?: string }> {
-    if (!this.orchestrator.config.identityContinuityEnabled) {
+    if (!resolveIdentityContinuityCapabilities(this.orchestrator.config).identityContinuity) {
       return { enabled: false, reason: "Identity continuity is disabled. Enable `identityContinuityEnabled: true`." };
     }
     if (!this.orchestrator.config.continuityAuditEnabled) {
@@ -6846,7 +6851,7 @@ export class EngramAccessService {
     triggerWindow?: string;
     suspectedCause?: string;
   }): Promise<unknown> {
-    if (!this.orchestrator.config.identityContinuityEnabled) {
+    if (!resolveIdentityContinuityCapabilities(this.orchestrator.config).identityContinuity) {
       return { enabled: false, reason: "Identity continuity is disabled. Enable `identityContinuityEnabled: true`." };
     }
     if (!this.orchestrator.config.continuityIncidentLoggingEnabled) {
@@ -6872,7 +6877,7 @@ export class EngramAccessService {
     verificationResult: string;
     preventiveRule?: string;
   }): Promise<unknown> {
-    if (!this.orchestrator.config.identityContinuityEnabled) {
+    if (!resolveIdentityContinuityCapabilities(this.orchestrator.config).identityContinuity) {
       return { enabled: false, reason: "Identity continuity is disabled." };
     }
     if (!this.orchestrator.config.continuityIncidentLoggingEnabled) {
@@ -6901,7 +6906,7 @@ export class EngramAccessService {
     principal?: string;
     limit?: number;
   }): Promise<unknown> {
-    if (!this.orchestrator.config.identityContinuityEnabled) {
+    if (!resolveIdentityContinuityCapabilities(this.orchestrator.config).identityContinuity) {
       return { enabled: false, reason: "Identity continuity is disabled." };
     }
     const state = request.state === "closed" || request.state === "all" ? request.state : "open";
@@ -6923,7 +6928,7 @@ export class EngramAccessService {
     lastReviewed?: string;
     notes?: string;
   }): Promise<unknown> {
-    if (!this.orchestrator.config.identityContinuityEnabled) {
+    if (!resolveIdentityContinuityCapabilities(this.orchestrator.config).identityContinuity) {
       return { enabled: false, reason: "Identity continuity is disabled." };
     }
     const resolvedNs = this.writableNamespaceFor(request.namespace, undefined, request.principal);
@@ -6948,7 +6953,7 @@ export class EngramAccessService {
     notes?: string;
     reviewedAt?: string;
   }): Promise<unknown> {
-    if (!this.orchestrator.config.identityContinuityEnabled) {
+    if (!resolveIdentityContinuityCapabilities(this.orchestrator.config).identityContinuity) {
       return { enabled: false, reason: "Identity continuity is disabled." };
     }
     const id = request.id?.trim();
@@ -6968,7 +6973,7 @@ export class EngramAccessService {
     namespace?: string;
     principal?: string;
   }): Promise<unknown> {
-    if (!this.orchestrator.config.identityContinuityEnabled) {
+    if (!resolveIdentityContinuityCapabilities(this.orchestrator.config).identityContinuity) {
       return { enabled: false, reason: "Identity continuity is disabled." };
     }
     const resolvedNs = this.resolveReadableNamespace(request.namespace, request.principal);
@@ -6994,7 +6999,7 @@ export class EngramAccessService {
     operatingPrinciples?: string;
     continuityNotes?: string;
   }): Promise<unknown> {
-    if (!this.orchestrator.config.identityContinuityEnabled) {
+    if (!resolveIdentityContinuityCapabilities(this.orchestrator.config).identityContinuity) {
       return { enabled: false, reason: "Identity continuity is disabled." };
     }
 
@@ -7337,7 +7342,7 @@ export class EngramAccessService {
     dryRun?: boolean;
     eventLimit?: number;
   }): Promise<unknown> {
-    if (!this.orchestrator.config.compressionGuidelineLearningEnabled) {
+    if (!resolveCompressionCapabilities(this.orchestrator.config).compressionGuidelineLearning) {
       return { enabled: false, reason: "Compression guideline learning is disabled. Enable `compressionGuidelineLearningEnabled: true`." };
     }
     return await this.orchestrator.optimizeCompressionGuidelines({
@@ -7350,7 +7355,7 @@ export class EngramAccessService {
     expectedContentHash?: string;
     expectedGuidelineVersion?: number;
   }): Promise<unknown> {
-    if (!this.orchestrator.config.compressionGuidelineLearningEnabled) {
+    if (!resolveCompressionCapabilities(this.orchestrator.config).compressionGuidelineLearning) {
       return { enabled: false, reason: "Compression guideline learning is disabled." };
     }
     return await this.orchestrator.activateCompressionGuidelineDraft({
@@ -7419,7 +7424,7 @@ export class EngramAccessService {
     }
 
     let results: Array<{ path: string; score: number; snippet?: string }>;
-    if (!this.orchestrator.config.namespacesEnabled) {
+    if (!resolveNamespaceCapabilities(this.orchestrator.config).namespaces) {
       this.resolveReadableNamespace(namespace, principal);
       results = collection === "global"
         ? await this.orchestrator.qmd.searchGlobal(query, maxResults)
@@ -7744,7 +7749,7 @@ export class EngramAccessService {
       );
     }
 
-    if (this.orchestrator.config.contextCompressionActionsEnabled !== true) {
+    if (resolveCompressionCapabilities(this.orchestrator.config).contextCompressionActions !== true) {
       throw new EngramAccessInputError(
         "memory_action_apply is disabled; enable contextCompressionActionsEnabled to use this tool",
       );
@@ -8162,7 +8167,7 @@ export class EngramAccessService {
     namespace: string;
     storage: StorageManager;
   }> {
-    if (this.orchestrator.config.namespacesEnabled && !principal?.trim()) {
+    if (resolveNamespaceCapabilities(this.orchestrator.config).namespaces && !principal?.trim()) {
       throw new EngramAccessInputError(
         "authentication required: namespaces are enabled and no principal was supplied",
       );
@@ -8902,7 +8907,7 @@ export class EngramAccessService {
     actor?: never; // ignored — actor is derived from the authenticated principal
   }) {
     const config = this.orchestrator.config;
-    const namespacesEnabled = config.namespacesEnabled === true;
+    const namespacesEnabled = resolveNamespaceCapabilities(config).namespaces === true;
     // Fix OdCl3: when no namespace is supplied, resolve the source via the
     // scope plan (principal self / scope-profile write layer / coding overlay)
     // instead of falling through to config.defaultNamespace. This matches the

package/src/active-memory-bridge.ts

@@ -1,3 +1,4 @@
+import { resolveNamespaceCapabilities } from "./capabilities.js";
 import { canReadNamespace, defaultNamespaceForPrincipal, resolvePrincipal } from "./namespaces/principal.js";
 import type { MemoryFile, PluginConfig } from "./types.js";
 import { collapseWhitespace, truncateCodePointSafe } from "./whitespace.js";
@@ -106,7 +107,7 @@ function resolveActiveMemoryNamespace(
     typeof orchestrator.resolvePrincipal === "function"
       ? orchestrator.resolvePrincipal(sessionKey)
       : resolvePrincipal(sessionKey, config);
-  if (config.namespacesEnabled && !principal) {
+  if (resolveNamespaceCapabilities(config).namespaces && !principal) {
     throw new Error("authentication required: namespaces are enabled and no principal was supplied");
   }
   if (explicitNamespace) {

package/src/admin/admin-surfaces.ts

@@ -23,6 +23,7 @@
  * NamespaceSearchRouter health. No new scope-resolution or namespace-listing
  * logic is introduced.
  */
+import { resolveNamespaceCapabilities } from "../capabilities.js";
 import path from "node:path";
 import type { NamespaceCatalog, NamespaceRecord } from "../namespaces/catalog.js";
 import { canReadNamespace, canWriteNamespace } from "../namespaces/principal.js";
@@ -190,7 +191,7 @@ export function inspectScope(options: InspectScopeOptions): ScopeInspection {
   const { config } = options;
   // Honour the pre-read flag when the caller supplied one (avoids a scattered
   // read here); fall back to the config flag for direct callers (tests/CLI).
-  const namespacesEnabled = options.namespacesEnabled ?? config.namespacesEnabled === true;
+  const namespacesEnabled = options.namespacesEnabled ?? resolveNamespaceCapabilities(config).namespaces === true;
 
   const plan = resolveScopePlan({
     config,