@remnic/core 9.3.654 → 9.3.656

package/dist/{chunk-LJCEWTG3.js → chunk-4UL7VPTD.js}

@@ -14,7 +14,7 @@ import {
 } from "./chunk-H7XKCNR6.js";
 import {
   toRecallExplainJson
-} from "./chunk-ENV6RDTD.js";
+} from "./chunk-TIJYQXDI.js";
 import {
   applyTagFilter,
   normalizeTags,
@@ -27,15 +27,17 @@ import {
   listMemoryGovernanceRuns,
   readMemoryGovernanceRunArtifact,
   runMemoryGovernance
-} from "./chunk-XWQ6ERUG.js";
+} from "./chunk-QZRKNA5F.js";
 import {
   clusterByKey,
   combineNamespaces,
+  expandScopeProfileReadNamespaces,
   lcmSessionKeyForNamespace,
   projectTagProjectId,
   resolveCodingNamespaceOverlay,
-  resolveGitContext
-} from "./chunk-MMJANTJX.js";
+  resolveGitContext,
+  resolveScopeProfilePlan
+} from "./chunk-GYSYLGNE.js";
 import {
   getTrustZoneStoreStatus,
   isTrustZoneName,
@@ -50,10 +52,10 @@ import {
 } from "./chunk-FF4KLI5W.js";
 import {
   estimateRecallTokens
-} from "./chunk-FVRBLJP6.js";
+} from "./chunk-2MXEVL75.js";
 import {
   namespaceCollectionName
-} from "./chunk-JVRPJ7D4.js";
+} from "./chunk-EKQMQQ3U.js";
 import {
   namespaceIdentityFromToken
 } from "./chunk-ZFXCQPNO.js";
@@ -92,14 +94,14 @@ import {
   buildBriefing,
   parseBriefingFocus,
   parseBriefingWindow
-} from "./chunk-Y2RIIF6H.js";
+} from "./chunk-Z6UDTNY6.js";
 import {
   parseEntityFile
-} from "./chunk-6CVI6BP6.js";
+} from "./chunk-NXCK7DO7.js";
 import {
   DEFAULT_RECALL_DISCLOSURE,
   isRecallDisclosure
-} from "./chunk-NE2JBMLN.js";
+} from "./chunk-AZBV4RRY.js";
 import {
   inferMemoryStatus,
   toMemoryPathRel
@@ -789,11 +791,32 @@ var EngramAccessService = class {
       );
     }
     const hasSession = typeof request.sessionKey === "string" && request.sessionKey.length > 0;
+    const codingContext = hasSession && this.orchestrator.config.namespacesEnabled && this.orchestrator.config.codingMode?.projectScope ? this.orchestrator.getCodingContextForSession(request.sessionKey) ?? await this.resolveCodingContextFromOptions(request) : null;
     const overlay = hasSession && this.orchestrator.config.namespacesEnabled && this.orchestrator.config.codingMode?.projectScope ? resolveCodingNamespaceOverlay(
-      this.orchestrator.getCodingContextForSession(request.sessionKey) ?? await this.resolveCodingContextFromOptions(request),
+      codingContext,
       this.orchestrator.config.codingMode,
       this.orchestrator.config.defaultNamespace
     ) : null;
+    const principal = this.resolveRequestPrincipal(
+      request.sessionKey,
+      request.authenticatedPrincipal
+    );
+    const profilePlan = resolveScopeProfilePlan({
+      config: this.orchestrator.config,
+      principal,
+      codingContext,
+      codingOverlay: overlay
+    });
+    if (profilePlan) {
+      const selectedLayer = profilePlan.layers.find((layer) => layer.id === profilePlan.writeLayer);
+      const writeNamespaceReadable = profilePlan.writeNamespace.length > 0 && profilePlan.readNamespaces.includes(profilePlan.writeNamespace);
+      if (!selectedLayer?.writable || !writeNamespaceReadable) {
+        throw new EngramAccessInputError(
+          `scope profile ${profilePlan.profileId} has no writable layer inside the profile read stack for principal ${principal ?? "anonymous"}`
+        );
+      }
+      return profilePlan.writeNamespace;
+    }
     if (!overlay) {
       return this.resolveWritableNamespace(
         void 0,
@@ -801,10 +824,6 @@ var EngramAccessService = class {
         request.authenticatedPrincipal
       );
     }
-    const principal = this.resolveRequestPrincipal(
-      request.sessionKey,
-      request.authenticatedPrincipal
-    );
     const base = defaultNamespaceForPrincipal(principal, this.orchestrator.config);
     if (!canWriteNamespace(principal, base, this.orchestrator.config)) {
       throw new EngramAccessInputError(`namespace is not writable: ${base}`);
@@ -887,6 +906,55 @@ var EngramAccessService = class {
       baseNamespace
     );
     const codingOverlayApplied = overlaidBase !== baseNamespace;
+    const codingOverlay = overlayEligible ? resolveCodingNamespaceOverlay(
+      attachedContext,
+      this.orchestrator.config.codingMode,
+      this.orchestrator.config.defaultNamespace
+    ) : null;
+    const profilePlan = resolveScopeProfilePlan({
+      config: this.orchestrator.config,
+      principal,
+      codingContext: attachedContext,
+      codingOverlay
+    });
+    if (profilePlan) {
+      const selectedLayer = profilePlan.layers.find((layer) => layer.id === profilePlan.writeLayer);
+      const writeNamespaceReadable = profilePlan.writeNamespace.length > 0 && profilePlan.readNamespaces.includes(profilePlan.writeNamespace);
+      if (!selectedLayer?.writable || !writeNamespaceReadable) {
+        clearSeededContext();
+        throw new EngramAccessInputError(
+          `scope profile ${profilePlan.profileId} has no writable layer inside the profile read stack for principal ${principal ?? "anonymous"}`
+        );
+      }
+      const legacyRecallNamespaces = Array.isArray(this.orchestrator.config.defaultRecallNamespaces) ? recallNamespacesForPrincipal(principal, this.orchestrator.config) : [];
+      const expandedReadNamespaces = expandScopeProfileReadNamespaces({
+        profilePlan,
+        principalSelfNamespace: profilePlan.baseNamespace,
+        config: this.orchestrator.config,
+        principal,
+        codingOverlay,
+        legacyRecallNamespaces
+      });
+      const readNamespaces2 = expandedReadNamespaces;
+      const profileCodingOverlayApplied = Boolean(
+        codingOverlay && profilePlan.layers.some(
+          (layer) => (layer.id === "userProject" || layer.id === "teamProject") && layer.readable && layer.namespace && readNamespaces2.includes(layer.namespace)
+        )
+      );
+      return {
+        principal,
+        baseNamespace: profilePlan.baseNamespace,
+        writeNamespace: profilePlan.writeNamespace,
+        objectiveStateNamespace: profilePlan.writeNamespace,
+        readNamespaces: readNamespaces2,
+        scopeProfile: profilePlan.profileId,
+        writeLayer: profilePlan.writeLayer,
+        layers: profilePlan.layers,
+        promotionTargets: profilePlan.promotionTargets,
+        codingOverlayApplied: profileCodingOverlayApplied,
+        warnings: [...warnings, ...profilePlan.warnings]
+      };
+    }
     if (!codingOverlayApplied) {
       const writeNamespace2 = this.resolveWritableNamespace(
         void 0,
@@ -926,12 +994,7 @@ var EngramAccessService = class {
     }
     const writeNamespace = overlaidBase;
     const readNamespaces = [writeNamespace];
-    const overlay = resolveCodingNamespaceOverlay(
-      attachedContext,
-      this.orchestrator.config.codingMode,
-      this.orchestrator.config.defaultNamespace
-    );
-    for (const fallback of overlay?.readFallbacks ?? []) {
+    for (const fallback of codingOverlay?.readFallbacks ?? []) {
       const ns = combineNamespaces(baseNamespace, fallback);
       if (!readNamespaces.includes(ns)) readNamespaces.push(ns);
     }
@@ -945,6 +1008,13 @@ var EngramAccessService = class {
       warnings
     };
   }
+  legacyResponseNamespaceForScope(scope) {
+    if (scope.explicitNamespace) return scope.writeNamespace;
+    if (scope.scopeProfile && scope.writeLayer !== "userProject") {
+      return scope.writeNamespace;
+    }
+    return scope.codingOverlayApplied ? this.orchestrator.config.defaultNamespace : scope.writeNamespace;
+  }
   async objectiveStateStoreLocationForNamespace(namespace) {
     if (!this.orchestrator.config.namespacesEnabled) {
       return {
@@ -992,7 +1062,28 @@ var EngramAccessService = class {
         "authentication required: namespaces are enabled and no principal was supplied"
       );
     }
-    return recallNamespacesForPrincipal(principal, this.orchestrator.config).filter((ns) => canReadNamespace(principal, ns, this.orchestrator.config));
+    const legacyRecallNamespaces = recallNamespacesForPrincipal(
+      principal,
+      this.orchestrator.config
+    );
+    const profilePlan = resolveScopeProfilePlan({
+      config: this.orchestrator.config,
+      principal,
+      codingContext: null,
+      codingOverlay: null
+    });
+    const namespaces = profilePlan ? expandScopeProfileReadNamespaces({
+      profilePlan,
+      principalSelfNamespace: profilePlan.baseNamespace,
+      config: this.orchestrator.config,
+      principal,
+      codingOverlay: null,
+      legacyRecallNamespaces
+    }) : legacyRecallNamespaces;
+    if (profilePlan) return namespaces;
+    return namespaces.filter(
+      (ns) => canReadNamespace(principal, ns, this.orchestrator.config)
+    );
   }
   resolveAllReadableConfiguredNamespaces(principal) {
     const config = this.orchestrator.config;
@@ -1011,7 +1102,13 @@ var EngramAccessService = class {
     if (!collection || collection === "global" || collection === baseCollection) {
       return namespaces;
     }
-    const candidates = collectionPrincipal ? this.resolveAllReadableConfiguredNamespaces(collectionPrincipal) : namespaces;
+    const activeScopeProfilePlan = collectionPrincipal ? resolveScopeProfilePlan({
+      config: this.orchestrator.config,
+      principal: collectionPrincipal,
+      codingContext: null,
+      codingOverlay: null
+    }) : null;
+    const candidates = collectionPrincipal ? activeScopeProfilePlan ? namespaces : this.resolveAllReadableConfiguredNamespaces(collectionPrincipal) : namespaces;
     const matchedNamespaces = candidates.filter((namespace) => {
       const canonical = namespaceCollectionName(baseCollection, namespace, {
         defaultNamespace: this.orchestrator.config.defaultNamespace,
@@ -1078,7 +1175,7 @@ var EngramAccessService = class {
         query: options.query,
         ...options.sessionKey ? { sessionKey: options.sessionKey } : {},
         ...options.rawExcerptNamespace ? { rawExcerptNamespace: options.rawExcerptNamespace } : {},
-        ...options.rawExcerptSessionIds ? { rawExcerptSessionIds: options.rawExcerptSessionIds } : {},
+        ...options.rawExcerptSessionIds !== void 0 ? { rawExcerptSessionIds: options.rawExcerptSessionIds } : {},
         ...options.rawExcerptsSuppressed ? { rawExcerptsSuppressed: options.rawExcerptsSuppressed } : {}
       }
     );
@@ -1222,7 +1319,7 @@ var EngramAccessService = class {
         query: rawContext.query,
         ...rawContext.sessionKey ? { sessionKey: rawContext.sessionKey } : {},
         namespace: rawContext.rawExcerptNamespace ?? namespace,
-        ...rawContext.rawExcerptSessionIds ? { lcmSessionIds: rawContext.rawExcerptSessionIds } : {}
+        ...rawContext.rawExcerptSessionIds !== void 0 ? { lcmSessionIds: rawContext.rawExcerptSessionIds } : {}
       } : null
     );
     const rawExcerpts = rawExcerptsResult ?? void 0;
@@ -1322,18 +1419,19 @@ var EngramAccessService = class {
     if (!lcm || !lcm.enabled) return [];
     try {
       const legacyKey = context.namespace && context.namespace !== this.orchestrator.config.defaultNamespace ? `${context.namespace}:${context.sessionKey}` : context.sessionKey;
-      const lcmSessionIds = context.lcmSessionIds && context.lcmSessionIds.length > 0 ? context.lcmSessionIds : [legacyKey];
+      const lcmSessionIds = context.lcmSessionIds !== void 0 ? context.lcmSessionIds : [legacyKey];
       const limit = 5;
       const seenRows = /* @__PURE__ */ new Set();
       const excerpts = [];
-      for (const lcmSessionKey of lcmSessionIds) {
+      const settledRows = await Promise.allSettled(
+        lcmSessionIds.map(
+          async (lcmSessionKey) => lcm.searchContextFull(context.query, limit, lcmSessionKey)
+        )
+      );
+      for (const result of settledRows) {
         if (excerpts.length >= limit) break;
-        const rows = await lcm.searchContextFull(
-          context.query,
-          limit,
-          lcmSessionKey
-        );
-        for (const r of rows) {
+        if (result.status !== "fulfilled") continue;
+        for (const r of result.value) {
           const dedupeKey = `${r.session_id} ${r.turn_index}`;
           if (seenRows.has(dedupeKey)) continue;
           seenRows.add(dedupeKey);
@@ -1923,8 +2021,29 @@ var EngramAccessService = class {
     }
     const principal = maybePrincipal ?? "default";
     const principalNamespace = defaultNamespaceForPrincipal(principal, this.orchestrator.config);
+    const profileCodingContext = request.sessionKey && typeof this.orchestrator.getCodingContextForSession === "function" ? this.orchestrator.getCodingContextForSession(request.sessionKey) : null;
+    const profileCodingOverlay = !namespaceOverride && profileCodingContext && this.orchestrator.config.namespacesEnabled && this.orchestrator.config.codingMode?.projectScope ? resolveCodingNamespaceOverlay(
+      profileCodingContext,
+      this.orchestrator.config.codingMode,
+      this.orchestrator.config.defaultNamespace
+    ) : null;
+    const profilePlan = namespaceOverride ? null : resolveScopeProfilePlan({
+      config: this.orchestrator.config,
+      principal,
+      codingContext: profileCodingContext,
+      codingOverlay: profileCodingOverlay
+    });
     const modeSkipsBudget = mode === "no_recall";
-    const effectiveNamespaces = namespaceOverride ? [namespaceOverride] : recallNamespacesForPrincipal(principal, this.orchestrator.config);
+    const legacyRecallNamespaces = Array.isArray(this.orchestrator.config.defaultRecallNamespaces) ? recallNamespacesForPrincipal(principal, this.orchestrator.config) : [];
+    const effectiveNamespaces = namespaceOverride ? [namespaceOverride] : profilePlan ? expandScopeProfileReadNamespaces({
+      profilePlan,
+      principalSelfNamespace: profilePlan.baseNamespace,
+      config: this.orchestrator.config,
+      principal,
+      codingOverlay: profileCodingOverlay,
+      legacyRecallNamespaces
+    }) : legacyRecallNamespaces;
+    const budgetPrincipalNamespace = profilePlan?.baseNamespace ?? principalNamespace;
     let budgetDecision;
     let recordBudgetAfterSuccess = false;
     if (modeSkipsBudget) {
@@ -1945,7 +2064,7 @@ var EngramAccessService = class {
       for (const ns of effectiveNamespaces) {
         const peek = this.budget.peek({
           principal,
-          principalNamespace,
+          principalNamespace: budgetPrincipalNamespace,
           queryNamespace: ns
         });
         if (peek.reason !== "allowed-same-namespace") {
@@ -2049,7 +2168,7 @@ var EngramAccessService = class {
       query,
       sessionKey: trimmedSessionKey,
       ...rawExcerptNamespace ? { rawExcerptNamespace } : {},
-      ...rawExcerptSessionIds ? { rawExcerptSessionIds } : {},
+      ...rawExcerptSessionIds !== void 0 ? { rawExcerptSessionIds } : {},
       ...rawExcerptsSuppressed ? { rawExcerptsSuppressed } : {}
     });
     const filterTags = normalizeTags(request.tags);
@@ -2347,7 +2466,7 @@ var EngramAccessService = class {
             query,
             ...trimmedSessionKey ? { sessionKey: trimmedSessionKey } : {},
             ...rawExcerptNamespace ? { namespace: rawExcerptNamespace } : {},
-            ...rawExcerptSessionIds ? { lcmSessionIds: rawExcerptSessionIds } : {}
+            ...rawExcerptSessionIds !== void 0 ? { lcmSessionIds: rawExcerptSessionIds } : {}
           }) : disclosure2 === "raw" ? [] : null;
           const rawExcerptText = rawExcerpts && rawExcerpts.length > 0 ? rawExcerpts.map((e) => e.content).join("\n") : "";
           const memoryByIndex = await Promise.all(
@@ -2426,7 +2545,7 @@ var EngramAccessService = class {
           requestedMode: request.mode,
           normalizedMode: mode,
           ...xrayRawExcerptNamespace ? { rawExcerptNamespace: xrayRawExcerptNamespace } : {},
-          ...xrayRawExcerptSessionIds ? { rawExcerptSessionIds: xrayRawExcerptSessionIds } : {},
+          ...xrayRawExcerptSessionIds !== void 0 ? { rawExcerptSessionIds: xrayRawExcerptSessionIds } : {},
           ...xrayRawExcerptsSuppressed ? { rawExcerptsSuppressed: xrayRawExcerptsSuppressed } : {}
         })
       };
@@ -3366,7 +3485,7 @@ var EngramAccessService = class {
     }
     const scope = await this.resolveMemoryScopePlan(request);
     const writeNamespace = scope.writeNamespace;
-    const namespace = scope.explicitNamespace ? scope.writeNamespace : scope.codingOverlayApplied ? this.orchestrator.config.defaultNamespace : scope.writeNamespace;
+    const namespace = this.legacyResponseNamespaceForScope(scope);
     const shouldWriteObjectiveState = this.orchestrator.config.objectiveStateMemoryEnabled === true && this.orchestrator.config.objectiveStateSnapshotWritesEnabled === true;
     await this.maybeAttachCodingContext(request.sessionKey, {
       cwd: request.cwd,
@@ -3455,7 +3574,11 @@ var EngramAccessService = class {
         baseNamespace: scope.baseNamespace,
         writeNamespace: scope.writeNamespace,
         codingOverlayApplied: scope.codingOverlayApplied,
-        readNamespaces: scope.readNamespaces
+        readNamespaces: scope.readNamespaces,
+        scopeProfile: scope.scopeProfile,
+        writeLayer: scope.writeLayer,
+        layers: scope.layers,
+        promotionTargets: scope.promotionTargets
       },
       lcmArchived,
       extractionQueued
@@ -3467,7 +3590,11 @@ var EngramAccessService = class {
     }
     const principal = this.resolveRequestPrincipal(request.sessionKey, request.authenticatedPrincipal);
     const hasExplicitNamespace = typeof request.namespace === "string" && request.namespace.trim().length > 0;
-    const namespace = hasExplicitNamespace ? this.resolveReadableNamespace(request.namespace, principal) : this.resolveImplicitLcmReadFallbackNamespace(principal);
+    const profileLcmReadNamespaces = hasExplicitNamespace ? null : this.resolveScopeProfileLcmReadNamespaces(
+      request.sessionKey,
+      request.authenticatedPrincipal
+    );
+    const namespace = hasExplicitNamespace ? this.resolveReadableNamespace(request.namespace, principal) : profileLcmReadNamespaces !== null ? profileLcmReadNamespaces[0] : this.resolveImplicitLcmReadFallbackNamespace(principal);
     if (!this.orchestrator.lcmEngine || !this.orchestrator.lcmEngine.enabled) {
       return {
         query: request.query,
@@ -3477,6 +3604,15 @@ var EngramAccessService = class {
         lcmEnabled: false
       };
     }
+    if (profileLcmReadNamespaces !== null && profileLcmReadNamespaces.length === 0) {
+      return {
+        query: request.query,
+        namespace: this.orchestrator.config.defaultNamespace,
+        results: [],
+        count: 0,
+        lcmEnabled: true
+      };
+    }
     if (namespace === void 0) {
       return {
         query: request.query,
@@ -3487,24 +3623,32 @@ var EngramAccessService = class {
       };
     }
     const limit = Math.max(1, Math.min(request.limit ?? 10, 100));
-    const lcmReadNamespace = this.resolveLcmReadNamespace(
+    const lcmReadNamespace = profileLcmReadNamespaces !== null ? profileLcmReadNamespaces[0] ?? this.orchestrator.config.defaultNamespace : this.resolveLcmReadNamespace(
       request.namespace,
       namespace,
       request.sessionKey,
       request.authenticatedPrincipal
     );
-    const lcmSessionKeyIds = request.sessionKey ? this.resolveLcmReadSessionIds(
+    const lcmSessionKeyIds = request.sessionKey ? profileLcmReadNamespaces !== null ? this.lcmSessionIdsForNamespaces(
+      profileLcmReadNamespaces,
+      request.sessionKey
+    ) : this.resolveLcmReadSessionIds(
       request.namespace,
       namespace,
       request.sessionKey,
       request.authenticatedPrincipal
     ) : [void 0];
-    const lcmSessionPrefix = request.sessionPrefix ? lcmSessionKeyForNamespace(
-      lcmReadNamespace,
-      request.sessionPrefix,
-      this.orchestrator.config.defaultNamespace
-    ) ?? request.sessionPrefix : request.sessionPrefix;
-    const hasScopedSession = typeof request.sessionKey === "string" && request.sessionKey.length > 0 || typeof lcmSessionPrefix === "string" && lcmSessionPrefix.length > 0;
+    const lcmSessionPrefixes = request.sessionPrefix ? profileLcmReadNamespaces !== null && !request.sessionKey ? this.lcmSessionIdsForNamespaces(
+      profileLcmReadNamespaces,
+      request.sessionPrefix
+    ) : [
+      lcmSessionKeyForNamespace(
+        lcmReadNamespace,
+        request.sessionPrefix,
+        this.orchestrator.config.defaultNamespace
+      ) ?? request.sessionPrefix
+    ] : [void 0];
+    const hasScopedSession = typeof request.sessionKey === "string" && request.sessionKey.length > 0 || lcmSessionPrefixes.some((prefix) => typeof prefix === "string" && prefix.length > 0);
     if (!hasScopedSession && this.orchestrator.config.namespacesEnabled === true) {
       return {
         query: request.query,
@@ -3516,15 +3660,35 @@ var EngramAccessService = class {
     }
     const seenRows = /* @__PURE__ */ new Set();
     const results = [];
+    const lcmSearches = [];
     for (const lcmSessionKey of lcmSessionKeyIds) {
+      for (const lcmSessionPrefix of lcmSessionPrefixes) {
+        lcmSearches.push({
+          key: lcmSessionKey,
+          prefix: lcmSessionPrefix,
+          promise: this.orchestrator.lcmEngine.searchContextFull(
+            request.query,
+            limit,
+            lcmSessionKey,
+            lcmSessionPrefix
+          )
+        });
+      }
+    }
+    const settledSearches = await Promise.allSettled(
+      lcmSearches.map((search) => search.promise)
+    );
+    for (let i = 0; i < settledSearches.length; i += 1) {
       if (results.length >= limit) break;
-      const rawResults = await this.orchestrator.lcmEngine.searchContextFull(
-        request.query,
-        limit,
-        lcmSessionKey,
-        lcmSessionPrefix
-      );
-      for (const r of rawResults) {
+      const settled = settledSearches[i];
+      if (!settled || settled.status === "rejected") {
+        const failed = lcmSearches[i];
+        log.warn(
+          `lcmSearch: failed for key=${failed?.key ?? "<none>"} prefix=${failed?.prefix ?? "<none>"}: ${settled?.status === "rejected" ? settled.reason : "missing result"}`
+        );
+        continue;
+      }
+      for (const r of settled.value) {
         const dedupeKey = `${r.session_id}\0${r.turn_index}`;
         if (seenRows.has(dedupeKey)) continue;
         seenRows.add(dedupeKey);
@@ -3669,6 +3833,11 @@ var EngramAccessService = class {
         "read"
       );
     }
+    const profileReadNamespaces = this.resolveScopeProfileLcmReadNamespaces(
+      sessionKey,
+      authenticatedPrincipal
+    );
+    if (profileReadNamespaces !== null) return profileReadNamespaces[0];
     const fallbackNamespace = this.resolveImplicitLcmReadFallbackNamespace(principal);
     if (fallbackNamespace === void 0) return void 0;
     return this.resolveLcmReadNamespace(
@@ -3763,6 +3932,49 @@ var EngramAccessService = class {
    * `<principal>-project-*` key is ever searched for an unauthorized reader (no
    * cross-tenant read leak).
    */
+  resolveScopeProfileLcmReadNamespaces(sessionKey, authenticatedPrincipal) {
+    const config = this.orchestrator.config;
+    const principal = this.resolveRequestPrincipal(sessionKey, authenticatedPrincipal);
+    const codingContext = sessionKey ? this.orchestrator.getCodingContextForSession(sessionKey) : null;
+    const codingOverlay = resolveCodingNamespaceOverlay(
+      codingContext,
+      config.codingMode,
+      config.defaultNamespace
+    );
+    const profilePlan = resolveScopeProfilePlan({
+      config,
+      principal,
+      codingContext,
+      codingOverlay
+    });
+    if (!profilePlan) return null;
+    const principalSelfNamespace = defaultNamespaceForPrincipal(principal, config);
+    const legacyRecallNamespaces = Array.isArray(config.defaultRecallNamespaces) ? recallNamespacesForPrincipal(principal, config) : [];
+    return expandScopeProfileReadNamespaces({
+      profilePlan,
+      principalSelfNamespace: profilePlan.baseNamespace,
+      config,
+      principal,
+      codingOverlay,
+      legacyRecallNamespaces
+    });
+  }
+  lcmSessionIdsForNamespaces(namespaces, sessionKey) {
+    const out = [];
+    const seen = /* @__PURE__ */ new Set();
+    for (const namespace of namespaces) {
+      const key = lcmSessionKeyForNamespace(
+        namespace,
+        sessionKey,
+        this.orchestrator.config.defaultNamespace
+      ) ?? sessionKey;
+      if (!seen.has(key)) {
+        seen.add(key);
+        out.push(key);
+      }
+    }
+    return out;
+  }
   resolveLcmReadSessionIds(explicitNamespace, resolvedNamespace, sessionKey, authenticatedPrincipal) {
     const primary = this.resolveLcmReadSessionKey(
       explicitNamespace,
@@ -3773,6 +3985,13 @@ var EngramAccessService = class {
     );
     const hasExplicitNamespace = typeof explicitNamespace === "string" && explicitNamespace.trim().length > 0;
     if (hasExplicitNamespace) return [primary];
+    const profileReadNamespaces = this.resolveScopeProfileLcmReadNamespaces(
+      sessionKey,
+      authenticatedPrincipal
+    );
+    if (profileReadNamespaces !== null) {
+      return this.lcmSessionIdsForNamespaces(profileReadNamespaces, sessionKey);
+    }
     const principal = this.resolveRequestPrincipal(
       sessionKey,
       authenticatedPrincipal
@@ -3819,7 +4038,7 @@ var EngramAccessService = class {
       throw new EngramAccessInputError("sessionKey is required and must be a non-empty string");
     }
     const scope = await this.resolveMemoryScopePlan(request);
-    const namespace = scope.explicitNamespace ? scope.writeNamespace : scope.codingOverlayApplied ? this.orchestrator.config.defaultNamespace : scope.writeNamespace;
+    const namespace = this.legacyResponseNamespaceForScope(scope);
     if (!this.orchestrator.lcmEngine || !this.orchestrator.lcmEngine.enabled) {
       return {
         enabled: false,
@@ -3854,7 +4073,7 @@ var EngramAccessService = class {
       throw new EngramAccessInputError("tokensAfter must be a non-negative integer");
     }
     const scope = await this.resolveMemoryScopePlan(request);
-    const namespace = scope.explicitNamespace ? scope.writeNamespace : scope.codingOverlayApplied ? this.orchestrator.config.defaultNamespace : scope.writeNamespace;
+    const namespace = this.legacyResponseNamespaceForScope(scope);
     if (!this.orchestrator.lcmEngine || !this.orchestrator.lcmEngine.enabled) {
       return {
         enabled: false,
@@ -5360,4 +5579,4 @@ export {
   shapeMemorySummary,
   EngramAccessService
 };
-//# sourceMappingURL=chunk-LJCEWTG3.js.map
+//# sourceMappingURL=chunk-4UL7VPTD.js.map