@axiom-lattice/core 4.4.0 → 6.0.0

package/dist/index.js

@@ -1811,7 +1811,6 @@ __export(index_exports, {
   createSandboxProvider: () => createSandboxProvider,
   createSandboxResolver: () => createSandboxResolver,
   createSchedulerMiddleware: () => createSchedulerMiddleware,
-  createSemanticMetricsMiddleware: () => createSemanticMetricsMiddleware,
   createSharePayload: () => createSharePayload,
   createTaskExecutionService: () => createTaskExecutionService,
   createTaskLifecycleService: () => createTaskLifecycleService,
@@ -1895,6 +1894,7 @@ __export(index_exports, {
   invokeWithRetry: () => invokeWithRetry,
   isBuiltInSkill: () => isBuiltInSkill,
   isDirectRoom: () => isDirectRoom,
+  isMcpConnectionError: () => isMcpConnectionError,
   isPluginSkillAuthorizedInSandbox: () => isPluginSkillAuthorizedInSandbox,
   isPluginSkillManagedInSandbox: () => isPluginSkillManagedInSandbox,
   isUsingDefaultKey: () => isUsingDefaultKey,
@@ -1917,7 +1917,6 @@ __export(index_exports, {
   parallelLimit: () => parallelLimit,
   parseCronExpression: () => parseCronExpression,
   parseDirectRoomType: () => parseDirectRoomType,
-  parseExternalDependency: () => parseExternalDependency,
   parseJudgeVerdict: () => parseJudgeVerdict,
   parsePackSize: () => parsePackSize,
   parseQueuedExecutionMode: () => import_protocols2.parseQueuedExecutionMode,
@@ -1970,7 +1969,6 @@ __export(index_exports, {
   sandboxLatticeManager: () => sandboxLatticeManager,
   sanitizeToolCallId: () => sanitizeToolCallId,
   scheduleLatticeManager: () => scheduleLatticeManager,
-  semanticMetricsPlugin: () => semanticMetricsPlugin,
   serializePluginMeta: () => serializePluginMeta,
   serializeTaskMutationSuccess: () => serializeTaskMutationSuccess,
   serializeTaskNormalizationFallback: () => serializeTaskNormalizationFallback,
@@ -2424,11 +2422,11 @@ var ToolLatticeManager = class _ToolLatticeManager extends BaseLatticeManager {
    * @param key Lattice键名
    * @param tool 已有的StructuredTool实例
    */
-  registerExistingTool(key5, tool71) {
+  registerExistingTool(key5, tool68) {
     const config = {
-      name: tool71.name,
-      description: tool71.description,
-      schema: tool71.schema,
+      name: tool68.name,
+      description: tool68.description,
+      schema: tool68.schema,
       // StructuredTool的schema已经是Zod兼容的
       needUserApprove: false
       // MCP工具默认不需要用户批准
@@ -2436,7 +2434,7 @@ var ToolLatticeManager = class _ToolLatticeManager extends BaseLatticeManager {
     const toolLattice = {
       key: key5,
       config,
-      client: tool71
+      client: tool68
     };
     this.register(key5, toolLattice);
   }
@@ -2447,14 +2445,14 @@ var ToolLatticeManager = class _ToolLatticeManager extends BaseLatticeManager {
    * @param key - tool lattice key (no tenant prefix)
    * @param tool - the StructuredTool client
    */
-  registerExistingToolWithTenant(tenantId2, key5, tool71) {
+  registerExistingToolWithTenant(tenantId2, key5, tool68) {
     const config = {
-      name: tool71.name,
-      description: tool71.description,
-      schema: tool71.schema,
+      name: tool68.name,
+      description: tool68.description,
+      schema: tool68.schema,
       needUserApprove: false
     };
-    const toolLattice = { key: key5, config, client: tool71 };
+    const toolLattice = { key: key5, config, client: tool68 };
     this.registerWithTenant(tenantId2, key5, toolLattice);
   }
   /**
@@ -2504,8 +2502,8 @@ var ToolLatticeManager = class _ToolLatticeManager extends BaseLatticeManager {
 };
 var toolLatticeManager = ToolLatticeManager.getInstance();
 var registerToolLattice = (key5, config, executor) => toolLatticeManager.registerLattice(key5, config, executor);
-var registerExistingTool = (key5, tool71) => toolLatticeManager.registerExistingTool(key5, tool71);
-var registerExistingToolWithTenant = (tenantId2, key5, tool71) => toolLatticeManager.registerExistingToolWithTenant(tenantId2, key5, tool71);
+var registerExistingTool = (key5, tool68) => toolLatticeManager.registerExistingTool(key5, tool68);
+var registerExistingToolWithTenant = (tenantId2, key5, tool68) => toolLatticeManager.registerExistingToolWithTenant(tenantId2, key5, tool68);
 var getToolLattice = (key5) => toolLatticeManager.getToolLattice(key5);
 var getToolClientWithTenant = (tenantId2, key5) => toolLatticeManager.getToolClientWithTenant(tenantId2, key5);
 var getToolDefinition = (key5) => toolLatticeManager.getToolDefinition(key5);
@@ -3345,15 +3343,15 @@ ${body}` : `${frontmatter}
     const resourcesDir = path.join(skillDir, "resources");
     try {
       const entries = await fs.readdir(resourcesDir, { withFileTypes: true, recursive: true });
-      const resources3 = [];
+      const resources2 = [];
       for (const entry of entries) {
         if (!entry.isDirectory()) {
           const fullPath = path.join(entry.path, entry.name);
           const relativePath = path.relative(resourcesDir, fullPath);
-          resources3.push(relativePath.replace(/\\/g, "/"));
+          resources2.push(relativePath.replace(/\\/g, "/"));
         }
       }
-      return resources3.sort();
+      return resources2.sort();
     } catch (error) {
       if (error.code === "ENOENT") {
         return [];
@@ -13632,11 +13630,11 @@ var PluginRegistry = class {
         if (!isRecord2(rawDefinition) || typeof rawDefinition.version !== "string" || rawDefinition.version.trim().length === 0 || typeof rawDefinition.content !== "string") {
           throw new Error(`Plugin "${key5}": skill "${name}" version and content must be a string`);
         }
-        const resources3 = rawDefinition.resources;
-        if (resources3 !== void 0 && !isRecord2(resources3)) {
+        const resources2 = rawDefinition.resources;
+        if (resources2 !== void 0 && !isRecord2(resources2)) {
           throw new Error(`Plugin "${key5}": skill "${name}" resources must be an object`);
         }
-        for (const [path8, resource] of Object.entries(resources3 ?? {})) {
+        for (const [path8, resource] of Object.entries(resources2 ?? {})) {
           try {
             validateRelativePath(path8, "resource");
           } catch {
@@ -14789,7 +14787,7 @@ function isSafeUiPath(path8) {
 }
 function validateSandboxPluginManifest(args) {
   const diagnostics = [];
-  const error = (code, message, pluginType, tool71) => diagnostics.push({ level: "error", code, message, pluginType, tool: tool71 });
+  const error = (code, message, pluginType, tool68) => diagnostics.push({ level: "error", code, message, pluginType, tool: tool68 });
   const raw = args.raw;
   if (!isRecord5(raw)) {
     error("MANIFEST_NOT_OBJECT", "manifest must be a JSON object", args.dirName);
@@ -15797,9 +15795,9 @@ function freezeMetadata(metadata) {
     ...resourceSelector ? { resourceSelector } : {}
   });
 }
-function toolName(tool71) {
-  if (typeof tool71 !== "object" || tool71 === null || !("name" in tool71)) return void 0;
-  return typeof tool71.name === "string" ? tool71.name : void 0;
+function toolName(tool68) {
+  if (typeof tool68 !== "object" || tool68 === null || !("name" in tool68)) return void 0;
+  return typeof tool68.name === "string" ? tool68.name : void 0;
 }
 function schemaHasConnectionKey(schema6) {
   const definition = isRecord7(schema6._def) ? schema6._def : void 0;
@@ -15807,10 +15805,10 @@ function schemaHasConnectionKey(schema6) {
   const fields = typeof shape === "function" ? shape() : shape;
   return isRecord7(fields) && Object.prototype.hasOwnProperty.call(fields, "connectionKey");
 }
-function hasConnectionKeySchema(tool71) {
-  if (!isRecord7(tool71) || !isRecord7(tool71.schema)) return false;
-  if (schemaHasConnectionKey(tool71.schema)) return true;
-  const definition = isRecord7(tool71.schema._def) ? tool71.schema._def : void 0;
+function hasConnectionKeySchema(tool68) {
+  if (!isRecord7(tool68) || !isRecord7(tool68.schema)) return false;
+  if (schemaHasConnectionKey(tool68.schema)) return true;
+  const definition = isRecord7(tool68.schema._def) ? tool68.schema._def : void 0;
   if (Array.isArray(definition?.options) && definition.options.length > 0) {
     return definition.options.every(
       (option) => isRecord7(option) && schemaHasConnectionKey(option)
@@ -15865,8 +15863,8 @@ var CapabilityToolRegistry = class {
    * @remarks Standard connection authorization is captured only for tools whose
    * schema declares `connectionKey`; legacy selectors remain explicit metadata.
    */
-  register(name, metadata, tool71) {
-    this.registerInternal(name, metadata, hasConnectionKeySchema(tool71));
+  register(name, metadata, tool68) {
+    this.registerInternal(name, metadata, hasConnectionKeySchema(tool68));
   }
   /**
    * Registers all tools actually exposed by a middleware instance.
@@ -15877,13 +15875,13 @@ var CapabilityToolRegistry = class {
    * @returns Nothing.
    */
   registerMiddleware(capabilityType, middleware, resourceSelectors = {}) {
-    for (const tool71 of middleware.tools ?? []) {
-      const name = toolName(tool71);
+    for (const tool68 of middleware.tools ?? []) {
+      const name = toolName(tool68);
       if (name) {
         this.registerInternal(name, {
           capabilityType,
           resourceSelector: resourceSelectors[name]
-        }, hasConnectionKeySchema(tool71));
+        }, hasConnectionKeySchema(tool68));
       }
     }
   }
@@ -16575,9 +16573,9 @@ var ReActAgentGraphBuilder = class {
    */
   async build(agentLattice, params) {
     const tools = params.tools.map((t) => {
-      const tool71 = getToolClientWithTenant(params.tenantId ?? "default", t.key);
-      return tool71;
-    }).filter((tool71) => tool71 !== void 0);
+      const tool68 = getToolClientWithTenant(params.tenantId ?? "default", t.key);
+      return tool68;
+    }).filter((tool68) => tool68 !== void 0);
     const stateSchema2 = createReactAgentSchema(params.stateSchema);
     const middlewareConfigs = params.middleware || [];
     const filesystemBackend = createFilesystemBackendFactory(middlewareConfigs);
@@ -17734,8 +17732,8 @@ function validateCapability(value, index) {
         fieldPath: `/capabilities/${index}/allowedTools`
       });
     }
-    for (const [toolIndex, tool71] of capability.allowedTools.entries()) {
-      if (typeof tool71 !== "string") {
+    for (const [toolIndex, tool68] of capability.allowedTools.entries()) {
+      if (typeof tool68 !== "string") {
         throw new CapabilityBundleValidationError(
           "CAPABILITY_BUNDLE_INVALID_CAPABILITY",
           "allowedTools entries must be strings",
@@ -17749,10 +17747,10 @@ function validateCapability(value, index) {
         fieldPath: `/capabilities/${index}/allowedTools`
       });
     }
-    const toolNames = new Set(plugin.meta.tools.map((tool71) => tool71.name));
-    for (const [toolIndex, tool71] of capability.allowedTools.entries()) {
-      if (typeof tool71 !== "string" || !toolNames.has(tool71)) {
-        throw new CapabilityBundleValidationError("CAPABILITY_BUNDLE_UNKNOWN_TOOL", `Unknown tool '${String(tool71)}'`, {
+    const toolNames = new Set(plugin.meta.tools.map((tool68) => tool68.name));
+    for (const [toolIndex, tool68] of capability.allowedTools.entries()) {
+      if (typeof tool68 !== "string" || !toolNames.has(tool68)) {
+        throw new CapabilityBundleValidationError("CAPABILITY_BUNDLE_UNKNOWN_TOOL", `Unknown tool '${String(tool68)}'`, {
           capabilityType,
           fieldPath: `/capabilities/${index}/allowedTools/${toolIndex}`
         });
@@ -18235,7 +18233,7 @@ function applyStaticCeiling(capabilities, staticMiddleware) {
     const projectTools = capability.allowedTools;
     const staticTools = ceiling.allowedTools;
     const effectiveStaticTools = staticTools?.length === 0 ? void 0 : staticTools;
-    const allowedTools = projectTools === void 0 ? effectiveStaticTools : effectiveStaticTools === void 0 ? projectTools : projectTools.filter((tool71) => effectiveStaticTools.includes(tool71));
+    const allowedTools = projectTools === void 0 ? effectiveStaticTools : effectiveStaticTools === void 0 ? projectTools : projectTools.filter((tool68) => effectiveStaticTools.includes(tool68));
     runtime[capability.type] = structuredClone({
       ...capability,
       config: applyStaticResourceCeiling(capability, ceiling),
@@ -23990,7 +23988,7 @@ var DeepAgentGraphBuilder = class {
     const tools = params.tools.map((t) => {
       const toolClient = getToolClientWithTenant(params.tenantId ?? "default", t.key);
       return toolClient;
-    }).filter((tool71) => tool71 !== void 0);
+    }).filter((tool68) => tool68 !== void 0);
     const subagents = await Promise.all(params.subAgents.map(async (sa) => {
       if (sa.client) {
         return {
@@ -25642,7 +25640,7 @@ var TeamAgentGraphBuilder = class {
     const tools = params.tools.map((t) => {
       const toolClient = getToolClientWithTenant(params.tenantId ?? "default", t.key);
       return toolClient;
-    }).filter((tool71) => tool71 !== void 0);
+    }).filter((tool68) => tool68 !== void 0);
     const teammates = params.subAgents.map((sa) => {
       const baseConfig = sa.config;
       return {
@@ -30039,7 +30037,7 @@ function requireSkillDeclaration(skillLoaded) {
   return void 0;
 }
 async function validateAgentReferences(input, tenantId2) {
-  const availableTools = getAvailableTools(tenantId2).map((tool71) => tool71.key);
+  const availableTools = getAvailableTools(tenantId2).map((tool68) => tool68.key);
   const availableMiddlewareTypes = getAvailableMiddlewareTypes();
   const availableCustomMiddlewareKeys = CustomMiddlewareRegistry.list().filter(
     (key5) => CustomMiddlewareRegistry.get(key5) !== void 0
@@ -30806,7 +30804,7 @@ var agentArchitectConfig = {
     "delete_agent",
     "manage_binding"
   ],
-  subAgents: ["document-parser-benchmark"],
+  subAgents: ["document-parser", "document-parser-benchmark"],
   middleware: [
     {
       id: "filesystem",
@@ -32515,6 +32513,7 @@ async function removeCollectionVectorStore(name, tenantId2) {
 
 // src/mcp_lattice/McpLatticeManager.ts
 var import_mcp_adapters = require("@langchain/mcp-adapters");
+var import_tools3 = require("@langchain/core/tools");
 init_BaseLatticeManager();
 
 // src/mcp_lattice/reconnectPolicy.ts
@@ -32524,6 +32523,13 @@ var DEFAULT_DELAY_MS = 1e3;
 var MAX_BACKOFF_MS = 3e4;
 var HEALTH_CHECK_INTERVAL_MS = 3e4;
 var HEALTH_CHECK_TIMEOUT_MS = 5e3;
+function isMcpConnectionError(error) {
+  const message = error instanceof Error ? error.message : typeof error === "string" ? error : "";
+  if (!message) return false;
+  return /not connected|connection closed|session not found|no session|maximum reconnection/i.test(
+    message
+  );
+}
 function nextBackoffDelay(attempt, base = DEFAULT_DELAY_MS, max = MAX_BACKOFF_MS) {
   if (attempt <= 0) return base;
   return Math.min(base * Math.pow(2, attempt - 1), max);
@@ -32548,12 +32554,21 @@ async function withTimeout2(operation, ms, onTimeout) {
 
 // src/mcp_lattice/McpLatticeManager.ts
 var realClientFactory = ({ mcpServers }) => new import_mcp_adapters.MultiServerMCPClient({ mcpServers });
+function extractRawCall(tool68) {
+  const rawCall = tool68._call;
+  if (typeof rawCall === "function") return rawCall.bind(tool68);
+  return async (...args) => {
+    const invoke = tool68.invoke.bind(tool68);
+    return invoke(args[0], args[2]);
+  };
+}
 var McpLatticeManager = class _McpLatticeManager extends BaseLatticeManager {
   constructor() {
     super(...arguments);
     this.runtimes = /* @__PURE__ */ new Map();
     this.clientFactory = realClientFactory;
     this.healthCheckInFlight = false;
+    this.reconnectPromises = /* @__PURE__ */ new Map();
   }
   static getInstance() {
     if (!_McpLatticeManager._instance) {
@@ -32811,6 +32826,64 @@ var McpLatticeManager = class _McpLatticeManager extends BaseLatticeManager {
     rt.attempt = 0;
     await this.reconnectRuntime(rt);
   }
+  /**
+   * Single-flight a forced reconnect per `(tenantId, serverKey)` so concurrent
+   * tool calls that all hit the same dead session reconnect once, not once each.
+   */
+  reconnectShared(rt) {
+    const key5 = this.compositeKey(rt.id.tenantId, rt.id.serverKey);
+    const existing = this.reconnectPromises.get(key5);
+    if (existing) return existing;
+    const work = this.reconnectServer(rt.id.tenantId, rt.id.serverKey).finally(() => {
+      if (this.reconnectPromises.get(key5) === work) this.reconnectPromises.delete(key5);
+    });
+    this.reconnectPromises.set(key5, work);
+    return work;
+  }
+  /**
+   * Wrap a raw MCP tool so a call landing on a torn-down session
+   * (`Not connected` / `Connection closed` / session expiry) transparently
+   * forces a reconnect and retries once against the fresh client, instead of
+   * failing the surrounding run. Non-connection errors propagate untouched.
+   */
+  wrapToolForResilience(rt, raw) {
+    const call = extractRawCall(raw);
+    return new import_tools3.DynamicStructuredTool({
+      name: raw.name,
+      description: raw.description,
+      schema: raw.schema,
+      responseFormat: raw.responseFormat,
+      defaultConfig: raw.defaultConfig,
+      metadata: raw.metadata,
+      returnDirect: raw.returnDirect,
+      func: async (...args) => this.invokeResilient(rt, raw.name, call, args)
+    });
+  }
+  async invokeResilient(rt, toolName2, call, args) {
+    try {
+      await this.ensureConnected(rt.id.tenantId, rt.id.serverKey);
+      return await call(...args);
+    } catch (error) {
+      if (!isMcpConnectionError(error) || !this.isActive(rt)) throw error;
+      console.warn(
+        `[MCP] ${rt.id.tenantId}/${rt.id.serverKey}: tool "${toolName2}" hit a dead session; reconnecting and retrying once`,
+        error instanceof Error ? error.message : error
+      );
+      try {
+        await this.reconnectShared(rt);
+      } catch (reconnectError) {
+        console.warn(
+          `[MCP] ${rt.id.tenantId}/${rt.id.serverKey}: reconnect for tool "${toolName2}" failed`,
+          reconnectError instanceof Error ? reconnectError.message : reconnectError
+        );
+        throw error;
+      }
+      const fresh = await this.getRawTools(rt.id.tenantId, rt.id.serverKey);
+      const match = fresh.find((t) => t.name === toolName2);
+      if (!match) throw error;
+      return await extractRawCall(match)(...args);
+    }
+  }
   async checkHealth() {
     if (this.healthCheckInFlight) return;
     this.healthCheckInFlight = true;
@@ -32829,8 +32902,12 @@ var McpLatticeManager = class _McpLatticeManager extends BaseLatticeManager {
           await withTimeout2(session.listTools(), HEALTH_CHECK_TIMEOUT_MS, async () => {
           });
           if (!this.isActive(rt) || rt.state !== "connected") continue;
-        } catch {
+        } catch (error) {
           if (this.isActive(rt) && rt.state === "connected") {
+            console.warn(
+              `[MCP] ${rt.id.tenantId}/${rt.id.serverKey}: health check failed; scheduling reconnect`,
+              error instanceof Error ? error.message : error
+            );
             rt.state = "failed";
             this.scheduleReconnect(rt);
           }
@@ -33029,15 +33106,16 @@ var McpLatticeManager = class _McpLatticeManager extends BaseLatticeManager {
     const metaByName = new Map(metaList.map((m) => [m.name, m.meta]));
     this.unregisterServerTools(tenantId2, serverKey);
     const keys = [];
-    for (const tool71 of tools) {
-      if (rt.selectedTools && !rt.selectedTools.includes(tool71.name)) continue;
-      const meta = metaByName.get(tool71.name);
+    for (const tool68 of tools) {
+      if (rt.selectedTools && !rt.selectedTools.includes(tool68.name)) continue;
+      const meta = metaByName.get(tool68.name);
       const rawVisibility = meta?.ui?.visibility;
       const visibility = Array.isArray(rawVisibility) ? rawVisibility : typeof rawVisibility === "string" ? [rawVisibility] : void 0;
       if (visibility && !visibility.includes("model")) continue;
       const ref = extractAppsRef(meta, serverKey);
-      const registered = ref ? wrapMcpToolWithUi(tool71, ref) : tool71;
-      const toolKey = _McpLatticeManager.buildToolKey(serverKey, tool71.name);
+      const resilient = this.wrapToolForResilience(rt, tool68);
+      const registered = ref ? wrapMcpToolWithUi(resilient, ref) : resilient;
+      const toolKey = _McpLatticeManager.buildToolKey(serverKey, tool68.name);
       try {
         toolLatticeManager.registerExistingToolWithTenant(tenantId2, toolKey, registered);
         keys.push(toolKey);
@@ -33105,6 +33183,7 @@ var McpLatticeManager = class _McpLatticeManager extends BaseLatticeManager {
       }
     }
     this.runtimes.clear();
+    this.reconnectPromises.clear();
   }
 };
 var mcpManager = McpLatticeManager.getInstance();
@@ -37316,14 +37395,6 @@ async function applyBeliefImpacts(taskStore, owner, impacts) {
   }
   return { description: current.description ?? "", task: current };
 }
-function parseExternalDependency(value) {
-  const row = (0, import_protocols31.snapshotExactRecord)(value, ["type", "summary", "requestedAt", "dependencyTaskIds"]);
-  const ids = (0, import_protocols31.snapshotExactArray)(row?.dependencyTaskIds);
-  if (!row || row.type !== "external_dependency" || typeof row.summary !== "string" || !row.summary.trim() || typeof row.requestedAt !== "string" || !Number.isFinite(Date.parse(row.requestedAt)) || !ids || ids.length === 0 || ids.some((id) => typeof id !== "string" || !id.trim())) return void 0;
-  const trimmed = ids.map((id) => id.trim());
-  if (new Set(trimmed).size !== trimmed.length) return void 0;
-  return { type: "external_dependency", summary: row.summary, requestedAt: row.requestedAt, dependencyTaskIds: trimmed };
-}
 function unsupportedTaskStatus() {
   return failure2(
     "TASK_STATUS_UNSUPPORTED",
@@ -37622,9 +37693,6 @@ var TaskLifecycleService = class {
       if (interruption && typeof interruption === "object" && interruption.type === "review_required") {
         return failure2("REVIEW_APPROVAL_REQUIRED", "Review interruption requires explicit approval or rejection.");
       }
-      if (interruption && typeof interruption === "object" && interruption.type === "external_dependency" && !parseExternalDependency(interruption)) {
-        return failure2("INVALID_EXTERNAL_DEPENDENCY", "Stored external dependency interruption is malformed.");
-      }
       const previousInterruption = interruption && typeof interruption === "object" ? interruption : {};
       const resumeKey = this.resumeEventKey(task);
       const audit = { eventKey: resumeKey, previousInterruption };
@@ -37805,6 +37873,108 @@ var TaskLifecycleService = class {
       detail: { previousStatus: "failed" }
     });
   }
+  /**
+   * Reopens a terminal agent task by returning it to in_progress.
+   *
+   * @param input Task, actor, and optional thread.
+   * @returns Structured lifecycle result. `completed` and `cancelled` tasks
+   *   reopen to `in_progress`; an already-`in_progress` task is acknowledged
+   *   without mutation; any other status or a lost CAS yields
+   *   `TASK_STATUS_CONFLICT`.
+   * @remarks This is the single reverse edge of the terminal-irreversibility
+   *   relaxation. It records the status change only; re-dispatch is owned by
+   *   the application layer and is never triggered here.
+   */
+  async reopenTask(input) {
+    return this.transitionAgentTask({
+      ...input,
+      targetStatus: "in_progress",
+      expectedStatuses: ["completed", "cancelled"],
+      updates: { status: "in_progress", failureReason: null, result: null },
+      summary: "Task reopened",
+      detail: { type: "reopen" }
+    });
+  }
+  /**
+   * Transfers a human-authored task's ownership to a chosen Agent before dispatch.
+   *
+   * @param input Task, actor, destination Agent, and optional Task Thread.
+   * @returns Structured result with the reassigned owner and an `owner_assigned` audit.
+   * @remarks Only tasks with `context.source === "user"` can be assigned this way.
+   *   Repeated assignment to the same owner is idempotent (repair-writes the audit
+   *   without a CAS). This changes owner only, never status, so it publishes no
+   *   Project lifecycle notification.
+   */
+  async assignOwner(input) {
+    let task;
+    try {
+      task = await this.deps.taskStore.getById(input.tenantId, input.taskId);
+    } catch {
+      return failure2("TASK_STORE_READ_FAILED", "Failed to read task lifecycle state.");
+    }
+    if (!task) return failure2("TASK_NOT_FOUND", "Task was not found.");
+    if (task.context?.source !== "user") {
+      return failure2("TASK_NOT_HUMAN_MANAGED", "Only user-authored tasks can be assigned to an Agent.");
+    }
+    const storedThreadId = typeof task.context?.thread_id === "string" && task.context.thread_id.length > 0 ? task.context.thread_id : void 0;
+    const effectiveThreadId = storedThreadId ?? input.threadId;
+    const detail = { type: "owner_assigned", fromOwnerType: task.ownerType, toOwnerId: input.ownerId };
+    if (task.ownerType === "agent" && task.ownerId === input.ownerId && (input.threadId === void 0 || storedThreadId === input.threadId)) {
+      const eventKey2 = this.statusEventKey(task, "owner_assigned", detail);
+      const event2 = await this.writeStatusEvent(
+        task,
+        input.actor,
+        effectiveThreadId,
+        "activity",
+        "Task owner assigned",
+        detail,
+        eventKey2
+      );
+      return {
+        success: true,
+        task,
+        mutated: false,
+        eventKey: event2.eventKey,
+        ...event2.warning ? { warnings: [event2.warning] } : {}
+      };
+    }
+    const context = { ...task.context ?? {} };
+    if (input.threadId && !storedThreadId) context.thread_id = input.threadId;
+    let updated;
+    try {
+      updated = await this.deps.taskStore.updateIfStatusAndUpdatedAt(
+        input.tenantId,
+        input.taskId,
+        { ownerType: "agent", ownerId: input.ownerId, context },
+        [task.status],
+        task.updatedAt
+      );
+    } catch {
+      return failure2(
+        "TASK_STORE_WRITE_FAILED",
+        "Failed to assign the task owner.",
+        "The store rejected the write."
+      );
+    }
+    if (!updated) return failure2("TASK_STATUS_CONFLICT", "Task changed concurrently.");
+    const eventKey = this.statusEventKey(updated, "owner_assigned", detail);
+    const event = await this.writeStatusEvent(
+      updated,
+      input.actor,
+      effectiveThreadId,
+      "activity",
+      "Task owner assigned",
+      detail,
+      eventKey
+    );
+    return {
+      success: true,
+      task: updated,
+      mutated: true,
+      eventKey: event.eventKey,
+      ...event.warning ? { warnings: [event.warning] } : {}
+    };
+  }
   /** Atomically cancels a nonterminal agent task and records an idempotent status event. */
   async cancelTask(input) {
     return this.transitionAgentTask({
@@ -37885,19 +38055,7 @@ var TaskLifecycleService = class {
   async interruptTask(input) {
     const summary = input.summary.trim();
     if (!summary) return failure2("MISSING_INTERRUPTION_SUMMARY", "Agent interruption requires a nonblank summary.");
-    if (input.type !== "external_dependency" && input.dependencyTaskIds !== void 0) {
-      return failure2("INVALID_EXTERNAL_DEPENDENCY", "dependencyTaskIds are only valid for external dependencies.");
-    }
     const requestedAt = this.now().toISOString();
-    const external = input.type === "external_dependency" ? parseExternalDependency({
-      type: input.type,
-      summary,
-      requestedAt,
-      dependencyTaskIds: input.dependencyTaskIds
-    }) : void 0;
-    if (input.type === "external_dependency" && !external) {
-      return failure2("INVALID_EXTERNAL_DEPENDENCY", "External dependencies require exact, unique nonblank task IDs.");
-    }
     let task;
     try {
       task = await this.deps.taskStore.getById(input.tenantId, input.taskId);
@@ -37911,29 +38069,17 @@ var TaskLifecycleService = class {
     if (threadFailure) return threadFailure;
     const currentInterruption = task.context?.interruption;
     if (task.status === "interrupted" && currentInterruption && typeof currentInterruption === "object") {
-      const storedExternal = parseExternalDependency(currentInterruption);
-      if (input.type === "external_dependency") {
-        if (!external || !storedExternal || storedExternal.summary !== external.summary || canonicalJson(storedExternal.dependencyTaskIds) !== canonicalJson(external.dependencyTaskIds)) {
-          return failure2(
-            "TASK_STATUS_CONFLICT",
-            "Task is already interrupted by a different or malformed external dependency.",
-            "Use manage_task get to inspect the existing interruption in task context.interruption."
-          );
-        }
-      } else if (currentInterruption.type !== input.type || currentInterruption.summary !== summary) {
+      if (currentInterruption.type !== input.type || currentInterruption.summary !== summary) {
         return failure2(
           "TASK_STATUS_CONFLICT",
           "Task is already interrupted by a different request.",
           "Use manage_task get to inspect the existing interruption, or resume it first."
         );
       }
-      const detail = storedExternal ? { ...storedExternal } : currentInterruption;
+      const detail = currentInterruption;
       const eventKey2 = this.statusEventKey(task, "interrupted", detail);
       const event2 = await this.writeStatusEvent(task, input.actor, input.threadId, "interrupted", summary, detail, eventKey2);
       const warnings2 = event2.warning ? [event2.warning] : [];
-      if (storedExternal && task.workspaceId && task.projectId) {
-        return this.finishExternalDependencyInterruption(task, input, storedExternal, event2, warnings2, false);
-      }
       return {
         success: true,
         task,
@@ -37949,11 +38095,7 @@ var TaskLifecycleService = class {
         "Only pending or in_progress tasks can be interrupted. Use manage_task get to check the current status."
       );
     }
-    if (external && task.workspaceId && task.projectId) {
-      const dependencyFailure = await this.validateExternalDependencies(task, external.dependencyTaskIds);
-      if (dependencyFailure) return dependencyFailure;
-    }
-    const interruption = external ? { ...external } : { type: input.type, summary, requestedAt };
+    const interruption = { type: input.type, summary, requestedAt };
     let updated;
     try {
       updated = await this.deps.taskStore.updateIfStatusAndUpdatedAt(input.tenantId, input.taskId, {
@@ -37975,9 +38117,6 @@ var TaskLifecycleService = class {
     const eventKey = this.statusEventKey(updated, "interrupted", interruption);
     const event = await this.writeStatusEvent(updated, input.actor, input.threadId, "interrupted", summary, interruption, eventKey);
     const warnings = event.warning ? [event.warning] : await this.notifyWinningTransition(updated, "interrupted", event);
-    if (external && updated.workspaceId && updated.projectId) {
-      return this.finishExternalDependencyInterruption(updated, input, external, event, warnings, true);
-    }
     return {
       success: true,
       task: updated,
@@ -39216,7 +39355,9 @@ var TaskLifecycleService = class {
       };
     }
     if (!input.expectedStatuses.includes(task.status)) return failure2("TASK_STATUS_CONFLICT", "Task status cannot make this transition.");
-    const updates = { ...input.updates, context: clearInterruptionContext(task.context) };
+    const clearedContext = clearInterruptionContext(task.context);
+    const withThread = input.threadId && task.context?.thread_id === void 0 ? { ...clearedContext ?? {}, thread_id: input.threadId } : clearedContext;
+    const updates = { ...input.updates, context: withThread };
     let updated;
     try {
       updated = await this.deps.taskStore.updateIfStatusAndUpdatedAt(
@@ -39304,85 +39445,6 @@ var TaskLifecycleService = class {
       return [{ code: "LIFECYCLE_NOTIFICATION_FAILED", taskId: task.id, eventKey: event.eventKey }];
     }
   }
-  async validateExternalDependencies(task, dependencyTaskIds) {
-    const declared = new Set(task.dependencies ?? []);
-    if (dependencyTaskIds.some((id) => id === task.id || !declared.has(id))) {
-      return failure2("INVALID_EXTERNAL_DEPENDENCY", "External dependency IDs must be declared non-self dependencies.");
-    }
-    try {
-      for (const id of dependencyTaskIds) {
-        const dependency = await this.deps.taskStore.getById(task.tenantId, id);
-        if (!dependency || dependency.workspaceId !== task.workspaceId || dependency.projectId !== task.projectId || dependency.status === "completed") {
-          return failure2("INVALID_EXTERNAL_DEPENDENCY", "External dependencies must exist, remain incomplete, and share exact scope.");
-        }
-      }
-    } catch {
-      return failure2("TASK_STORE_READ_FAILED", "Failed to validate external dependencies.");
-    }
-    return void 0;
-  }
-  async externalDependencyReadiness(task, dependencyTaskIds) {
-    try {
-      for (const id of dependencyTaskIds) {
-        const dependency = await this.deps.taskStore.getById(task.tenantId, id);
-        if (!dependency || dependency.workspaceId !== task.workspaceId || dependency.projectId !== task.projectId || dependency.status !== "completed") return { kind: "blocked" };
-      }
-      return { kind: "ready" };
-    } catch {
-      return {
-        kind: "error",
-        warning: { code: "DEPENDENCY_READ_FAILED", taskId: task.id }
-      };
-    }
-  }
-  async finishExternalDependencyInterruption(task, input, interruption, event, warnings, mutated) {
-    if (event.warning) {
-      return { success: true, task, mutated, eventKey: event.eventKey, warnings };
-    }
-    const readiness = await this.externalDependencyReadiness(task, interruption.dependencyTaskIds);
-    if (readiness.kind === "blocked") {
-      return { success: true, task, mutated, eventKey: event.eventKey, ...warnings.length ? { warnings } : {} };
-    }
-    if (readiness.kind === "error") {
-      return {
-        success: true,
-        task,
-        mutated,
-        eventKey: event.eventKey,
-        warnings: [...warnings, { ...readiness.warning, eventKey: event.eventKey }]
-      };
-    }
-    const resumed = await this.resumeInterruption({
-      tenantId: input.tenantId,
-      taskId: input.taskId,
-      actor: input.actor,
-      threadId: input.threadId
-    });
-    if (resumed.success) {
-      const combined = [...warnings, ...resumed.warnings ?? []];
-      return {
-        ...resumed,
-        mutated: mutated || resumed.mutated,
-        ...combined.length ? { warnings: combined } : {}
-      };
-    }
-    let current;
-    try {
-      current = await this.deps.taskStore.getById(input.tenantId, input.taskId);
-    } catch {
-      return resumed;
-    }
-    if (current?.status === "in_progress" && (!current.context?.thread_id || current.context?.thread_id === input.threadId)) {
-      return {
-        success: true,
-        task: current,
-        mutated,
-        eventKey: event.eventKey,
-        ...warnings.length ? { warnings } : {}
-      };
-    }
-    return resumed;
-  }
   async clearAuditMarker(task, key5) {
     const context = withoutContextKey(task.context, key5);
     try {
@@ -40826,10 +40888,10 @@ var createLoadSkillContentTool = (pluginSkills, pluginSkillOwnersOrStaticSelecti
             lockIdentity
           );
           let result2 = pluginSkill.definition.content;
-          const resources3 = Object.entries(pluginSkill.definition.resources ?? {});
-          if (resources3.length > 0) {
+          const resources2 = Object.entries(pluginSkill.definition.resources ?? {});
+          if (resources2.length > 0) {
             result2 += "\n\n---\n\n**Resources** (synced to the sandbox; use `read_file` to access):\n";
-            for (const [resourcePath, resource] of resources3) {
+            for (const [resourcePath, resource] of resources2) {
               result2 += `- ${resourcePath} (mime type: ${resource.mimeType ?? "not specified"})
 `;
             }
@@ -40856,10 +40918,10 @@ var createLoadSkillContentTool = (pluginSkills, pluginSkillOwnersOrStaticSelecti
             `/root/.agents/skills/${input.skill_name}/resources`,
             { recursive: false }
           );
-          const resources3 = resourcesResult.files.map((f) => f.path.split("/").pop()).filter(Boolean);
-          if (resources3.length > 0) {
+          const resources2 = resourcesResult.files.map((f) => f.path.split("/").pop()).filter(Boolean);
+          if (resources2.length > 0) {
             result += "\n\n---\n\n**Resources** (use `read_file` tool to access):\n";
-            resources3.forEach((r) => {
+            resources2.forEach((r) => {
               result += `- ${r}
 `;
             });
@@ -41181,1553 +41243,12 @@ var skillPlugin = {
   })
 };
 
-// src/middlewares/semanticMetricsMiddleware.ts
-var import_langchain70 = require("langchain");
-
-// src/tool_lattice/semantic_metrics/metrics_datasource_tool.ts
-var import_zod55 = __toESM(require("zod"));
-var import_langchain67 = require("langchain");
-
-// src/tool_lattice/semantic_metrics/types.ts
-function readToolRunConfig(exeConfig) {
-  return exeConfig?.configurable?.runConfig;
-}
-function resolveDatasourceId(input, exeConfig) {
-  const id = input.datasourceId ?? readToolRunConfig(exeConfig)?.metricsDataSource?.datasourceId;
-  if (id === void 0 || id === null || id === "") {
-    throw new Error("datasourceId is required (provide it or set runConfig.metricsDataSource.datasourceId)");
-  }
-  return Number(id);
-}
-function assertDatasourceSelected(scope, datasourceId) {
-  if (scope.unrestricted) return;
-  if (!scope.ids.includes(datasourceId)) {
-    throw new Error(
-      `DATASOURCE_NOT_SELECTED: datasource ${datasourceId} is not in the effective scope [${scope.ids.join(", ")}]`
-    );
-  }
-}
-function effectiveDatasourceScope(connectionScope) {
-  return connectionScope.length > 0 ? { unrestricted: false, ids: [...connectionScope] } : { unrestricted: true, ids: [] };
-}
-var DDL_DML_KEYWORDS = [
-  "insert",
-  "update",
-  "delete",
-  "drop",
-  "alter",
-  "create",
-  "truncate",
-  "grant",
-  "revoke",
-  "merge",
-  "replace",
-  "upsert"
-];
-var DDL_DML_RE = new RegExp(`\\b(?:${DDL_DML_KEYWORDS.join("|")})\\b`, "i");
-var SELECT_INTO_RE = /\bselect\b[\s\S]*?\binto\b/i;
-function validateSql(sql) {
-  const trimmed = sql.trim();
-  if (!trimmed) {
-    return { ok: false, reason: "SQL is empty" };
-  }
-  const withoutComments = trimmed.replace(/--[^\n]*/g, " ").replace(/\/\*[\s\S]*?\*\//g, " ");
-  const statements = withoutComments.split(";").map((s) => s.trim()).filter(Boolean);
-  if (statements.length > 1) {
-    return { ok: false, reason: "Multiple statements are not allowed" };
-  }
-  const firstKeyword = withoutComments.trim().split(/\s+/)[0].toLowerCase();
-  if (firstKeyword !== "select" && firstKeyword !== "with") {
-    return { ok: false, reason: `Only SELECT or WITH queries are allowed (got "${firstKeyword}")` };
-  }
-  if (SELECT_INTO_RE.test(withoutComments)) {
-    return { ok: false, reason: "SELECT INTO is not allowed (creates a table)" };
-  }
-  if (DDL_DML_RE.test(withoutComments)) {
-    return { ok: false, reason: "Only read-only queries are allowed (DML/DDL detected)" };
-  }
-  return { ok: true };
-}
-
-// src/tool_lattice/semantic_metrics/SemanticMetricsV2Client.ts
-var NO_CONNECTION_HINT = "No semantic-metrics connection is configured for this tenant. Add a connection of type 'semantic-metrics' for the tenant, then select it (connections) or enable connectAll in the agent's middleware config.";
-async function resolveMetricsClientFromSelector(selector, scope, connectionKey) {
-  let resolved;
-  try {
-    resolved = await resolvePluginConnections(selector.connectionType, selector, scope);
-  } catch (error) {
-    if (error instanceof Error && error.message === "ConnectionStore not configured") {
-      throw new Error(NO_CONNECTION_HINT);
-    }
-    throw error;
-  }
-  const available = resolved.map((c) => c.key).join(", ");
-  if (resolved.length === 0) {
-    throw new Error(NO_CONNECTION_HINT);
-  }
-  const key5 = connectionKey?.trim() || (resolved.length === 1 ? resolved[0].key : "");
-  if (!key5) {
-    throw new Error(
-      `connectionKey is required. Available connections: ${available}`
-    );
-  }
-  const entry = resolved.find((c) => c.key === key5);
-  if (!entry) {
-    throw new Error(`Connection "${key5}" not found. Available connections: ${available}`);
-  }
-  const config = entry.config;
-  return new SemanticMetricsV2Client(config);
-}
-var SemanticMetricsV2Client = class {
-  /**
-   * @param config - Connection configuration (server URL, optional API key and headers).
-   */
-  constructor(config) {
-    this.config = config;
-    this.baseUrl = config.serverUrl.replace(/\/$/, "");
-  }
-  /**
-   * Build default request headers: `Accept: application/json`, custom headers,
-   * and a Bearer `Authorization` header when an API key is configured.
-   *
-   * @returns Merged headers.
-   */
-  getHeaders() {
-    const headers = {
-      Accept: "application/json",
-      ...this.config.headers ?? {}
-    };
-    if (this.config.apiKey) {
-      headers["Authorization"] = `Bearer ${this.config.apiKey}`;
-    }
-    return headers;
-  }
-  /**
-   * Numeric selected resource ids of this connection (normalized).
-   *
-   * Reads `selectedEntities` — the standard connection resource-selection
-   * field written by the connection UI (`connection.discover` + selection).
-   *
-   * @returns The selected resource ids; empty when unrestricted.
-   */
-  getSelectedEntities() {
-    const raw = this.config.selectedEntities;
-    if (!Array.isArray(raw)) return [];
-    return raw.map((v) => Number(v)).filter((n) => Number.isFinite(n));
-  }
-  /**
-   * Perform a JSON request against the base URL.
-   *
-   * The Metrics Server wraps every response as `{ code, message, data }`. A
-   * `code` of 200 resolves to `data`; any other `code` throws a business error
-   * carrying the server message (regardless of HTTP status). Non-envelope
-   * bodies are returned as-is.
-   *
-   * @param path - Path appended to the base URL (must start with `/`).
-   * @param init - Optional `fetch` init overrides (method, body, per-call headers).
-   * @returns The unwrapped `data` payload of the response envelope.
-   * @throws When the server returns a non-200 `code`, or the HTTP response is not OK.
-   */
-  async request(path8, init = {}) {
-    const response = await fetch(`${this.baseUrl}${path8}`, {
-      ...init,
-      method: init.method ?? "GET",
-      headers: { ...this.getHeaders(), ...init.headers ?? {} }
-    });
-    const text = await response.text().catch(() => "");
-    const parsed = this.parseBody(text);
-    if (parsed?.envelope === true) {
-      if (parsed.code !== 200) {
-        throw new Error(`API ${parsed.code}: ${parsed.message || "Unknown error"}`);
-      }
-      return parsed.data;
-    }
-    if (!response.ok) {
-      throw new Error(`HTTP ${response.status}: ${text || response.statusText}`);
-    }
-    return parsed?.value ?? void 0;
-  }
-  /**
-   * Parse a response body text. Detects the server envelope `{ code, message, data }`.
-   *
-   * @param text - Raw response body text.
-   * @returns `{ envelope: true, code, message, data }` for an envelope body,
-   *   `{ envelope: false, value }` for anything else (or `{ envelope: false }` when empty/invalid).
-   */
-  parseBody(text) {
-    if (!text.trim()) return { envelope: false };
-    try {
-      const value = JSON.parse(text);
-      if (value !== null && typeof value === "object" && !Array.isArray(value)) {
-        const record = value;
-        if (typeof record.code === "number") {
-          return {
-            envelope: true,
-            code: record.code,
-            message: typeof record.message === "string" ? record.message : void 0,
-            data: record.data
-          };
-        }
-      }
-      return { envelope: false, value };
-    } catch {
-      return { envelope: false, value: text };
-    }
-  }
-  /**
-   * POST a JSON body to a path.
-   *
-   * @param path - Path appended to the base URL.
-   * @param body - Payload serialized as JSON.
-   * @returns Parsed JSON response body.
-   */
-  post(path8, body) {
-    return this.request(path8, {
-      method: "POST",
-      headers: { "Content-Type": "application/json" },
-      body: JSON.stringify(body)
-    });
-  }
-  /**
-   * PUT a JSON body to a path.
-   *
-   * @param path - Path appended to the base URL.
-   * @param body - Payload serialized as JSON.
-   * @returns Parsed JSON response body.
-   */
-  put(path8, body) {
-    return this.request(path8, {
-      method: "PUT",
-      headers: { "Content-Type": "application/json" },
-      body: JSON.stringify(body)
-    });
-  }
-  /**
-   * List all datasources.
-   *
-   * @returns Parsed JSON response body.
-   */
-  listDatasources() {
-    return this.request("/datasources");
-  }
-  /**
-   * Get table grants for a datasource.
-   *
-   * @param datasourceId - Datasource identifier.
-   * @returns Parsed JSON response body.
-   */
-  getTableGrants(datasourceId) {
-    return this.request(`/datasources/${encodeURIComponent(datasourceId)}/table-grants`);
-  }
-  /**
-   * Run a read-only SQL query against a datasource.
-   *
-   * @param datasourceId - Datasource identifier.
-   * @param input - Query input: `sql` (SELECT/WITH only), optional `params`, `maxRows`, `debug`.
-   * @returns Parsed JSON response body.
-   * @throws When `sql` fails read-only validation (rejected before any fetch).
-   */
-  async queryDatasource(datasourceId, input) {
-    const validation = validateSql(input.sql);
-    if (!validation.ok) throw new Error(`SQL_NOT_ALLOWED: ${validation.reason}`);
-    return this.post(`/datasources/${encodeURIComponent(datasourceId)}/query`, input);
-  }
-  /**
-   * Test a datasource connection.
-   *
-   * @param datasourceId - Datasource identifier.
-   * @returns Parsed JSON response body.
-   */
-  testDatasource(datasourceId) {
-    return this.post(`/datasources/${encodeURIComponent(datasourceId)}/test`, {});
-  }
-  /**
-   * Get connection-pool status for a datasource.
-   *
-   * @param datasourceId - Datasource identifier.
-   * @returns Parsed JSON response body.
-   */
-  getPoolStatus(datasourceId) {
-    return this.request(`/datasources/${encodeURIComponent(datasourceId)}/pool`);
-  }
-  /**
-   * List table metadata for a datasource, auto-paginating.
-   *
-   * The server pages this collection (`page`/`pageSize`, default page size 20),
-   * so requests aggregate every page into one `{ items, total }` result.
-   *
-   * @param datasourceId - Datasource identifier.
-   * @returns `{ items: [...], total }` covering all pages.
-   */
-  async listTables(datasourceId) {
-    return this.listMetaPage(`/datasources/${encodeURIComponent(datasourceId)}/meta/tables`);
-  }
-  /**
-   * Shared pagination walk for the paged meta collections (`{items,total,page,pageSize}`).
-   *
-   * @param basePath - Collection path (tables or metrics).
-   * @returns `{ items, total }` aggregated across all pages.
-   */
-  async listMetaPage(basePath) {
-    const pageSize = 100;
-    const items = [];
-    let total = Number.POSITIVE_INFINITY;
-    for (let page = 1; items.length < total; page += 1) {
-      const body = await this.request(`${basePath}?page=${page}&pageSize=${pageSize}`);
-      const record = body !== null && typeof body === "object" ? body : {};
-      const batch = Array.isArray(record.items) ? record.items : [];
-      items.push(...batch);
-      total = typeof record.total === "number" ? record.total : items.length;
-      if (batch.length === 0) break;
-    }
-    return { items, total: items.length };
-  }
-  /**
-   * Get metadata for a single table.
-   *
-   * @param datasourceId - Datasource identifier.
-   * @param tableKey - Table key.
-   * @returns Parsed JSON response body.
-   */
-  getTable(datasourceId, tableKey) {
-    return this.request(
-      `/datasources/${encodeURIComponent(datasourceId)}/meta/tables/${encodeURIComponent(tableKey)}`
-    );
-  }
-  /**
-   * Create a table definition for a datasource.
-   *
-   * @param datasourceId - Datasource identifier.
-   * @param payload - Table definition payload.
-   * @returns Parsed JSON response body.
-   */
-  createTable(datasourceId, payload) {
-    return this.post(`/datasources/${encodeURIComponent(datasourceId)}/meta/tables`, payload);
-  }
-  /**
-   * Update a table definition for a datasource.
-   *
-   * @param datasourceId - Datasource identifier.
-   * @param tableKey - Table key.
-   * @param payload - Table definition payload.
-   * @returns Parsed JSON response body.
-   */
-  /**
-   * Update a published table meta via read-modify-write.
-   *
-   * The server's PUT replaces the whole payload, so the current payload is
-   * fetched first and the incoming fields are merged on top; fields not
-   * mentioned are preserved.
-   */
-  async updateTable(datasourceId, tableKey, payload) {
-    const existing = await this.readMetaPayload(`${this.baseUrl}/datasources/${encodeURIComponent(datasourceId)}/meta/tables/${encodeURIComponent(tableKey)}`);
-    return this.put(
-      `/datasources/${encodeURIComponent(datasourceId)}/meta/tables/${encodeURIComponent(tableKey)}`,
-      { payload: { ...existing, ...payload } }
-    );
-  }
-  /**
-   * List metric definitions for a datasource.
-   *
-   * @param datasourceId - Datasource identifier.
-   * @returns Parsed JSON response body.
-   */
-  /**
-   * List metric metadata for a datasource, auto-paginating.
-   *
-   * The server pages this collection (`page`/`pageSize`, default page size 20),
-   * so requests aggregate every page into one `{ items, total }` result.
-   *
-   * @param datasourceId - Datasource identifier.
-   * @returns `{ items: [...], total }` covering all pages.
-   */
-  async listMetrics(datasourceId) {
-    return this.listMetaPage(`/datasources/${encodeURIComponent(datasourceId)}/meta/metrics`);
-  }
-  /**
-   * Get a single metric definition.
-   *
-   * @param datasourceId - Datasource identifier.
-   * @param metricKey - Metric key.
-   * @returns Parsed JSON response body.
-   */
-  getMetric(datasourceId, metricKey) {
-    return this.request(
-      `/datasources/${encodeURIComponent(datasourceId)}/meta/metrics/${encodeURIComponent(metricKey)}`
-    );
-  }
-  /**
-   * Create a metric definition for a datasource.
-   *
-   * @param datasourceId - Datasource identifier.
-   * @param payload - Metric definition payload.
-   * @returns Parsed JSON response body.
-   */
-  createMetric(datasourceId, payload) {
-    return this.post(`/datasources/${encodeURIComponent(datasourceId)}/meta/metrics`, payload);
-  }
-  /**
-   * Update a metric definition for a datasource.
-   *
-   * @param datasourceId - Datasource identifier.
-   * @param metricKey - Metric key.
-   * @param payload - Metric definition payload.
-   * @returns Parsed JSON response body.
-   */
-  /**
-   * Update a published metric meta via read-modify-write.
-   *
-   * The server's PUT replaces the whole payload, so the current payload is
-   * fetched first and the incoming fields are merged on top; fields not
-   * mentioned are preserved.
-   */
-  async updateMetric(datasourceId, metricKey, payload) {
-    const existing = await this.readMetaPayload(`${this.baseUrl}/datasources/${encodeURIComponent(datasourceId)}/meta/metrics/${encodeURIComponent(metricKey)}`);
-    return this.put(
-      `/datasources/${encodeURIComponent(datasourceId)}/meta/metrics/${encodeURIComponent(metricKey)}`,
-      { payload: { ...existing, ...payload } }
-    );
-  }
-  /**
-   * Fetch the current `payload` object of a published meta entry.
-   *
-   * The single-entry read returns `{ code, data: [entry] }` (already unwrapped
-   * to the array by {@link request}); the payload lives on the first entry.
-   *
-   * @param absoluteUrl - Full URL of the single-entry meta read.
-   * @returns The stored payload object (empty when none exists).
-   */
-  async readMetaPayload(absoluteUrl) {
-    const response = await fetch(absoluteUrl, { headers: this.getHeaders() });
-    const text = await response.text().catch(() => "");
-    if (!response.ok) {
-      throw new Error(`HTTP ${response.status}: ${text || response.statusText}`);
-    }
-    const parsed = this.parseBody(text);
-    const data = parsed?.envelope === true ? parsed.data : parsed?.value;
-    const entry = Array.isArray(data) ? data[0] : data;
-    const payload = entry?.payload;
-    return payload !== null && typeof payload === "object" && !Array.isArray(payload) ? payload : {};
-  }
-  /**
-   * Get runtime metadata for a datasource.
-   *
-   * @param datasourceId - Datasource identifier.
-   * @returns Parsed JSON response body.
-   */
-  getRuntimeMeta(datasourceId) {
-    return this.request(`/datasources/${encodeURIComponent(datasourceId)}/meta`);
-  }
-  /**
-   * Run a metrics query.
-   *
-   * @param request - Metrics query request payload.
-   * @returns Parsed JSON response body.
-   */
-  queryMetrics(request) {
-    return this.post("/metrics/query", request);
-  }
-  /**
-   * Run an ad-hoc custom SQL query, validated as read-only before sending.
-   *
-   * @param request - Request with `datasourceId`, `customSql` (SELECT/WITH only),
-   * and optional `limit` / `debug`.
-   * @returns Parsed JSON response body.
-   * @throws When `customSql` fails read-only validation (rejected before any fetch).
-   */
-  async customSql(request) {
-    const validation = validateSql(request.customSql);
-    if (!validation.ok) throw new Error(`SQL_NOT_ALLOWED: ${validation.reason}`);
-    return this.post("/metrics/query", request);
-  }
-};
-
-// src/tool_lattice/semantic_metrics/metrics_datasource_tool.ts
-var DESCRIPTION = `PHYSICAL LAYER EXPLORATION \u2014 the only tool for probing raw datasource structure (Builder/Admin only; business agents do not need it).
-
-OWNS: discovering datasources, reading table-grants (the exploration boundary for this tenant), and running read-only SQL (SELECT/WITH only) to inspect physical tables, columns, sample rows, and value distributions. Also: per-datasource connection test and pool status.
-
-DOES NOT OWN:
-- Published semantic assets (table meta / metric meta) \u2192 use metrics_meta_tool.
-- Runtime meta and business metric queries \u2192 use metrics_runtime_tool.
-
-USE WHEN: starting a modeling task \u2014 \`list_datasources\` is always the FIRST step: it returns the datasource ids that every other action and tool requires (get_grants, query_sql here; read_semantic_catalog, query_metrics in metrics_runtime_tool; the meta actions in metrics_meta_tool). Read grants next, then probe tables, columns, samples, and distributions within the grant. If a field's business meaning is unclear, probe sample values and distributions here before publishing anything.
-
-COMMON MISTAKES (do not):
-- Do not answer business metric questions here (e.g. "monthly sales by region") \u2014 that is metrics_runtime_tool \`query\` against published metrics, NOT this tool's \`query_sql\` (physical-table SQL).
-- Do not read or publish semantic meta through this tool \u2014 metrics_meta_tool owns the semantic layer.
-- Do not probe tables outside the tenant's table-grants; un-granted probes are rejected and break the exploration boundary.
-- Do not attempt writes \u2014 SQL is validated read-only and rejected before sending.`;
-function createMetricsDatasourceTool(params) {
-  const { connectionType, connections, connectAll } = params;
-  return (0, import_langchain67.tool)(
-    async (input, exeConfig) => {
-      try {
-        const client = await resolveMetricsClientFromSelector(
-          { connectionType, connections, connectAll },
-          readToolRunConfig(exeConfig) ?? {},
-          input.connectionKey
-        );
-        const scope = effectiveDatasourceScope(client.getSelectedEntities());
-        switch (input.action) {
-          case "list_datasources": {
-            const result = await client.listDatasources();
-            const filtered = scope.unrestricted ? result : result.filter((d) => scope.ids.includes(Number(d.id)));
-            const safe = filtered.map((d) => ({
-              id: d.id,
-              name: d.name,
-              sourceType: d.sourceType,
-              description: d.description,
-              statusLabel: d.statusLabel
-            }));
-            return JSON.stringify(safe, null, 2);
-          }
-          case "get_grants": {
-            const ds = resolveDatasourceId(input, exeConfig);
-            assertDatasourceSelected(scope, ds);
-            const result = await client.getTableGrants(ds);
-            return JSON.stringify(result, null, 2);
-          }
-          case "query_sql": {
-            const ds = resolveDatasourceId(input, exeConfig);
-            assertDatasourceSelected(scope, ds);
-            if (!input.sql) throw new Error("sql is required for the 'query_sql' action");
-            const result = await client.queryDatasource(ds, {
-              sql: input.sql,
-              params: input.params,
-              maxRows: input.maxRows
-            });
-            return JSON.stringify(result, null, 2);
-          }
-          case "test_connection": {
-            const ds = resolveDatasourceId(input, exeConfig);
-            assertDatasourceSelected(scope, ds);
-            const result = await client.testDatasource(ds);
-            return JSON.stringify(result, null, 2);
-          }
-          case "pool_status": {
-            const ds = resolveDatasourceId(input, exeConfig);
-            assertDatasourceSelected(scope, ds);
-            const result = await client.getPoolStatus(ds);
-            return JSON.stringify(result, null, 2);
-          }
-        }
-      } catch (error) {
-        return `Error: ${error instanceof Error ? error.message : String(error)}`;
-      }
-    },
-    {
-      name: "metrics_datasource_tool",
-      description: DESCRIPTION,
-      schema: import_zod55.default.object({
-        action: import_zod55.default.enum(["list_datasources", "get_grants", "query_sql", "test_connection", "pool_status"]).describe(
-          "list_datasources: list datasources \u2014 ALWAYS call this first to obtain the datasource id used by every other action and tool; get_grants: read table-grants; query_sql: run read-only SQL against PHYSICAL tables (note: this is query_sql, NOT the semantic 'query' action of metrics_runtime_tool); test_connection: test the datasource; pool_status: connection-pool status"
-        ),
-        connectionKey: import_zod55.default.string().optional().describe("Connection key. Omit when only one semantic-metrics connection exists"),
-        datasourceId: import_zod55.default.coerce.number().optional().describe("Numeric datasource id, e.g. 15 (required for all actions except list_datasources; optional if set in runConfig.metricsDataSource)"),
-        sql: import_zod55.default.string().optional().describe("Read-only SQL (SELECT/WITH only). Required for the query action. Metadata templates \u2014 PostgreSQL/SQL Server columns: select column_name, data_type from information_schema.columns where table_schema = :schemaName and table_name = :tableName order by ordinal_position; HANA columns: select column_name, data_type_name from table_columns where schema_name = :schemaName and table_name = :tableName order by position; distributions: select <dim>, count(*) as row_count from <table> group by <dim> order by row_count desc limit :maxRows"),
-        params: import_zod55.default.record(import_zod55.default.union([import_zod55.default.string(), import_zod55.default.number(), import_zod55.default.boolean()])).optional().describe("Named :param values for the SQL"),
-        maxRows: import_zod55.default.number().optional().describe("Max rows to return")
-      })
-    }
-  );
-}
-
-// src/tool_lattice/semantic_metrics/metrics_meta_tool.ts
-var import_zod56 = __toESM(require("zod"));
-var import_langchain68 = require("langchain");
-var DESCRIPTION2 = `SEMANTIC ASSET REGISTRY (Builder/Admin only) \u2014 the only tool for reading and publishing the runtime's semantic layer: table meta (meta/tables) and metric meta (meta/metrics).
-
-OWNS: listing published tables and metrics, reading one by objectKey, publishing a semantic table (create_table: columns tagged with role dimension|measure), publishing a metric (create_metric: a metric_index payload then a metric_detail payload using the SQL-free calculation DSL), and correcting published assets (update_table / update_metric).
-
-DOES NOT OWN:
-- Running queries or reading the aggregated runtime view \u2192 metrics_runtime_tool (get_meta / query / custom_sql).
-- Probing physical tables, columns, grants, or samples \u2192 metrics_datasource_tool.
-
-USE WHEN: physical exploration is done and the model has been proposed and confirmed by the user \u2014 to publish the semantic table and metrics, or to correct published assets afterwards.
-
-COMMON MISTAKES (do not):
-- Do not call get_meta here \u2014 that action belongs to metrics_runtime_tool, not this tool.
-- Do not try to "query numbers" through this tool \u2014 list/read actions return definitions only; use metrics_runtime_tool query for data.
-- Do not publish a metric whose sourceTable has no published table meta, or whose dimensions are not published columns with role dimension \u2014 the server will reject it.
-- The builder assistant must load the semantic-metrics-modeling skill and pass modelingSkillLoaded: true on write actions; no removal actions are exposed on purpose.`;
-var MODELING_SKILL_NAME = "semantic-metrics-modeling";
-var BUILDER_ASSISTANT_ID = "semantic-metrics-builder";
-function requireModelingSkillLoaded(action, input, exeConfig) {
-  const isWriteAction = action === "create_table" || action === "update_table" || action === "create_metric" || action === "update_metric";
-  if (!isWriteAction) return void 0;
-  const runConfig = readToolRunConfig(exeConfig);
-  const assistantId = runConfig?.assistant_id;
-  if (assistantId === BUILDER_ASSISTANT_ID && input.modelingSkillLoaded !== true) {
-    return JSON.stringify({
-      success: false,
-      error: `Load the '${MODELING_SKILL_NAME}' skill before publishing meta.`
-    });
-  }
-  return void 0;
-}
-function actionRequiresPayload(action) {
-  return action === "create_table" || action === "update_table" || action === "create_metric" || action === "update_metric";
-}
-function createMetricsMetaTool(params) {
-  const { connectionType, connections, connectAll } = params;
-  return (0, import_langchain68.tool)(
-    async (input, exeConfig) => {
-      try {
-        const guardError = requireModelingSkillLoaded(input.action, input, exeConfig);
-        if (guardError !== void 0) return guardError;
-        const client = await resolveMetricsClientFromSelector(
-          { connectionType, connections, connectAll },
-          readToolRunConfig(exeConfig) ?? {},
-          input.connectionKey
-        );
-        const ds = resolveDatasourceId(input, exeConfig);
-        assertDatasourceSelected(effectiveDatasourceScope(client.getSelectedEntities()), ds);
-        if (actionRequiresPayload(input.action) && input.payload === void 0) {
-          throw new Error(`payload is required for ${input.action}`);
-        }
-        const payload = input.payload ?? {};
-        switch (input.action) {
-          case "list_tables": {
-            return JSON.stringify(await client.listTables(ds), null, 2);
-          }
-          case "read_table_meta": {
-            if (!input.objectKey) throw new Error("objectKey is required for read_table_meta");
-            return JSON.stringify(await client.getTable(ds, input.objectKey), null, 2);
-          }
-          case "create_table": {
-            return JSON.stringify(await client.createTable(ds, payload), null, 2);
-          }
-          case "update_table": {
-            if (!input.objectKey) throw new Error("objectKey is required for update_table");
-            return JSON.stringify(await client.updateTable(ds, input.objectKey, payload), null, 2);
-          }
-          case "list_metrics": {
-            return JSON.stringify(await client.listMetrics(ds), null, 2);
-          }
-          case "read_metric_meta": {
-            if (!input.objectKey) throw new Error("objectKey is required for read_metric_meta");
-            return JSON.stringify(await client.getMetric(ds, input.objectKey), null, 2);
-          }
-          case "create_metric": {
-            return JSON.stringify(await client.createMetric(ds, payload), null, 2);
-          }
-          case "update_metric": {
-            if (!input.objectKey) throw new Error("objectKey is required for update_metric");
-            return JSON.stringify(await client.updateMetric(ds, input.objectKey, payload), null, 2);
-          }
-        }
-      } catch (error) {
-        return `Error: ${error instanceof Error ? error.message : String(error)}`;
-      }
-    },
-    {
-      name: "metrics_meta_tool",
-      description: DESCRIPTION2,
-      schema: import_zod56.default.object({
-        action: import_zod56.default.enum([
-          "list_tables",
-          "read_table_meta",
-          "create_table",
-          "update_table",
-          "list_metrics",
-          "read_metric_meta",
-          "create_metric",
-          "update_metric"
-        ]).describe(
-          "Actions ONLY in this meta tool (runtime query actions like get_meta/query belong to metrics_runtime_tool): list_tables/list_metrics (browse published assets), read_table_meta/read_metric_meta (details by objectKey), create_table/create_metric (publish), update_table/update_metric (correct)"
-        ),
-        connectionKey: import_zod56.default.string().optional().describe("Connection key. Omit when only one semantic-metrics connection exists"),
-        datasourceId: import_zod56.default.coerce.number().optional().describe("Numeric datasource id, e.g. 15 (optional if set in runConfig.metricsDataSource)"),
-        objectKey: import_zod56.default.string().optional().describe("Semantic table/metric key (required for read_table_meta/update_table/read_metric_meta/update_metric)"),
-        payload: import_zod56.default.record(import_zod56.default.unknown()).optional().describe("Meta payload (required for create/update actions; objectType/objectKey/status/payload/accessGrant)"),
-        modelingSkillLoaded: import_zod56.default.literal(true).optional().describe("Set true after loading the semantic-metrics-modeling skill (required for the builder assistant on write actions)")
-      })
-    }
-  );
-}
-
-// src/tool_lattice/semantic_metrics/metrics_runtime_tool.ts
-var import_zod57 = __toESM(require("zod"));
-var import_langchain69 = require("langchain");
-var DESCRIPTION3 = `RUNTIME QUERY SURFACE \u2014 read what is published and answer business questions with numbers. Business agents use ONLY this tool; Builder agents also use it to verify freshly published metrics.
-
-OWNS: list_datasources (self-contained datasource discovery \u2014 redacted output, the first step before anything else), read_semantic_catalog (the published semantic model for a datasource: tables, metrics, dimensions, filters) and query_metrics (the semantic metric query: metrics / groupBy / filters / orderBy / limit \u2014 the server generates the SQL, so there is no free-form SQL here).
-
-DOES NOT OWN:
-- Publishing or correcting semantic tables/metrics \u2192 metrics_meta_tool (create_table/update_table/create_metric/update_metric/list_tables/read_table_meta/list_metrics/read_metric_meta).
-- Physical exploration of raw tables, grants, or samples \u2192 metrics_datasource_tool (query_sql).
-- Free-form custom SQL \u2014 intentionally not provided; use query against published metrics.
-
-USE WHEN: read_semantic_catalog to see what is published before asking numbers; query_metrics to answer a business question from already-published metrics (Business) or to verify a just-published metric against its acceptance evidence (Builder).
-
-COMMON MISTAKES (do not):
-- Do not call meta-tool actions here (create_table / update_table / create_metric / update_metric / list_tables / read_table_meta / list_metrics / read_metric_meta) \u2014 they live in metrics_meta_tool and will fail schema validation here.
-- Do not look for a custom-SQL action \u2014 there is none; explore physical data with metrics_datasource_tool query_sql, and query business numbers with the semantic query action.
-- Metrics and dimensions in query_metrics must already be published; querying an unpublished metric fails with "not found in catalog".`;
-function createMetricsRuntimeTool(params) {
-  const { connectionType, connections, connectAll } = params;
-  return (0, import_langchain69.tool)(
-    async (input, exeConfig) => {
-      try {
-        const client = await resolveMetricsClientFromSelector(
-          { connectionType, connections, connectAll },
-          readToolRunConfig(exeConfig) ?? {},
-          input.connectionKey
-        );
-        const scope = effectiveDatasourceScope(client.getSelectedEntities());
-        switch (input.action) {
-          case "list_datasources": {
-            const result = await client.listDatasources();
-            const filtered = scope.unrestricted ? result : result.filter((d) => scope.ids.includes(Number(d.id)));
-            const safe = filtered.map((d) => ({
-              id: d.id,
-              name: d.name,
-              sourceType: d.sourceType,
-              description: d.description,
-              statusLabel: d.statusLabel
-            }));
-            return JSON.stringify(safe, null, 2);
-          }
-          case "read_semantic_catalog": {
-            const ds = resolveDatasourceId(input, exeConfig);
-            assertDatasourceSelected(scope, ds);
-            return JSON.stringify(await client.getRuntimeMeta(ds), null, 2);
-          }
-          case "query_metrics": {
-            if (!input.query) throw new Error("query is required for the 'query_metrics' action");
-            const bodyDatasourceId = input.query.datasourceId;
-            if (bodyDatasourceId !== void 0) {
-              assertDatasourceSelected(scope, Number(bodyDatasourceId));
-            }
-            return JSON.stringify(await client.queryMetrics(input.query), null, 2);
-          }
-        }
-      } catch (error) {
-        return `Error: ${error instanceof Error ? error.message : String(error)}`;
-      }
-    },
-    {
-      name: "metrics_runtime_tool",
-      description: DESCRIPTION3,
-      schema: import_zod57.default.object({
-        action: import_zod57.default.enum(["list_datasources", "read_semantic_catalog", "query_metrics"]).describe(
-          "Actions ONLY in this runtime tool: list_datasources (list available datasources \u2014 ALWAYS call this first to obtain the datasourceId; output is redacted to non-sensitive fields), read_semantic_catalog (read the published semantic model: tables, metrics, dimensions), query_metrics (run a semantic metric query \u2014 the only way to get business numbers). Do NOT put meta-tool actions (list_tables/read_table_meta/create_table/update_table/list_metrics/read_metric_meta/create_metric/update_metric) here"
-        ),
-        connectionKey: import_zod57.default.string().optional().describe("Connection key. Omit when only one semantic-metrics connection exists"),
-        datasourceId: import_zod57.default.coerce.number().optional().describe("Numeric datasource id, e.g. 15 (required for read_semantic_catalog; optional if set in runConfig.metricsDataSource)"),
-        query: import_zod57.default.record(import_zod57.default.unknown()).optional().describe('Semantic metric query request. Required for the query_metrics action, e.g. { datasourceId: 15, metrics: ["sell_in_nes"], groupBy: ["sales_team"], filters: [{ dimension: "posting_year", operator: "GTE", values: [2024] }], limit: 10 }')
-      })
-    }
-  );
-}
-
-// src/middlewares/semanticMetricsModelingSkill.ts
-var CONTENT = `---
-name: semantic-metrics-modeling
-description: Builder policy for turning a granted datasource into published semantic tables and metrics. Defines the orchestrator/worker contract \u2014 the orchestrator agrees goals, proposes the model, plans persistent tasks, and delegates execution to general-purpose workers with self-contained briefs; workers execute one bound brief each. Governs goal agreement, delegation, FEP verification, belief-state reconciliation, and continuous refinement until acceptance evidence is met.
----
-
-# Semantic Metrics Modeling
-
-You are the Semantic Metrics Builder. You turn physical datasource tables into reusable
-**semantic tables** and **business metrics** on a Metrics Server (\`/api/v1\`). Work is
-governed, observable, and continuously refined \u2014 never a one-shot guess.
-
-You always operate in exactly ONE of two roles:
-
-- **Orchestrator** (default; no \`## Bound Task\` section in your context): you face the
-  user. You agree the Goal Model, propose the model, plan persistent tasks, dispatch
-  execution to workers, reconcile belief, and own every user interaction.
-- **Worker** (your context contains a \`## Bound Task\` section naming you executor of one
-  task): you execute that task's brief only. See **Worker mode** \u2014 its rules override the
-  orchestrator policy.
-
-## Goal Model
-
-Before any exploration or publishing, agree with the user on:
-- **Real goal**: the business outcome (which metrics, for what decision), not just "make a table".
-- **Consumer**: who reads the result and how.
-- **Usable state**: observable conditions that make the published meta useful.
-- **Scope**: which datasource/tables, and what is explicitly out of scope.
-- **Acceptance evidence**: objective criteria (e.g. "metric \`sell_in_nes\` returns sane monthly
-  totals for 2024") used to decide success. Verbatim acceptance evidence is required later by
-  the Verify dispatch \u2014 record it exactly.
-Do not guess material goals, consumers, or acceptance evidence.
-
-**Vague requests** (e.g. "build the metric layer") \u2014 do not act and do not ask blind questions.
-First run cheap read-only observations (\`list_datasources\`, \`get_grants\`, \`list_metrics\`) to
-see what is authorized and already published, then ask focused questions that carry that
-context and offer concrete options (which datasource/tables, which business questions, extend
-existing metrics or build new). Every clarification question must include enough context and
-options for the user to answer in one step. Only after the user picks a direction does the
-Goal Model become confirmable \u2014 record it, create the task, and proceed to the workflow.
-
-## Target model and quality bar
-
-Your goal is a specific, verifiable artifact, not "some tables and metrics".
-
-**Target shape** \u2014 one delivery is:
-- a published \`table_view_detail\` meta per logical table, with every column tagged
-  \`role\` (dimension | measure) and a business-readable \`label\`;
-- a \`metric_index\` + \`metric_detail\` pair per metric, using the SQL-free \`calculation\` DSL;
-- the set, taken together, answers the user's concrete business question.
-
-**Publish gate (self-check every metric before create)** \u2014 if any fails, do **not** publish; go
-explore or ask the user:
-1. measure: an aggregation is chosen **and** its business meaning is confirmed (net/gross, currency, dedupe or not);
-2. dimension: has a business meaning and a grain (day/month/year/\u2026);
-3. \`displayName\`/\`label\` are business-readable;
-4. the metric answers one concrete question from the user's stated goal;
-5. a runtime \`query\` returns numbers consistent with the confirmed meaning.
-
-**Intent gaps first** \u2014 before diving into exploration, list the inputs you still need to meet the
-quality bar (business meaning, grain, target metric list, table scope, consumer) and ask for them
-explicitly. Exploration and user questions are both driven by this target shape and quality bar:
-missing business meaning \u2192 ask; unclear field semantics \u2192 probe or ask; right shape but it does not
-answer the business question \u2192 do not publish.
-
-## FEP Loop
-
-Apply this loop to every step (explore, publish table, publish metric, verify):
-**OBSERVE \u2192 HYPOTHESIZE \u2192 ACT \u2192 VERIFY \u2192 DECIDE \u2192 RECONCILE**
-
-- **Observe**: current state, grants, published meta, and decision-relevant uncertainty.
-- **Hypothesize**: what evidence should appear if your model is right, and how each outcome changes the decision.
-- **Act**: one proportional action \u2014 no more than necessary.
-- **Verify**: compare the observed result (e.g. a runtime \`query\`) against the prediction.
-- **Decide**: classify as **RETAIN** (confirmed), **REVERT** (rejected), or **INCONCLUSIVE**.
-- **Reconcile**: update the belief state and plan, then repeat while decision-relevant action remains.
-
-The orchestrator applies the loop **between dispatches** (each observation updates the plan
-before the next brief is written). A worker applies it **inside its brief**.
-
-Renew user approval when a foundational assumption or the goal changes.
-
-## Orchestrator: Task Policy
-
-You are an orchestrator, not the hands. Exactly five duties:
-
-1. **Goal Model agreement** \u2014 including cheap read-only observation for vague requests
-   (\`list_datasources\`, \`get_grants\`, \`list_metrics\`). This is your ONLY inline datasource
-   access; do not use \`write_todos\`.
-2. **Propose the model** and get user approval.
-3. **Task tree** \u2014 parent task = contract + \`## Belief State\`; child tasks = independently
-   verifiable outcomes (explore / publish-table / publish-metric / verify), one per dispatch.
-   See the \`task-definition\` skill for \`manage_task\` operation details.
-4. **Dispatch and collect** \u2014 \`task { taskId, agentId: "general-purpose" }\`; read the
-   observation; record the \`executionResultId\` on the child task with \`manage_task update\` or
-   \`add_activity\`; reconcile \`## Belief State\`.
-5. **HITL** \u2014 every \`ask_user_to_clarify\` is yours. Workers never ask the user.
-
-Hard rules:
-- Never run exploration SQL inline. Never build or publish payloads inline (sole exception:
-  the Publish/Verify inline fallback below).
-- **Belief State: you are the sole writer.** Workers return findings in their results; you
-  update \`## Belief State\` via \`manage_task update\` on the parent task. Workers never touch it.
-- **Dispatch serially** \u2014 one worker at a time; reconcile belief before writing the next brief.
-- **Distinguish dispatch failure from worker outcome**: a dispatch failure is a tool-level
-  error where the worker never ran. A worker returning INCONCLUSIVE or failed is a normal FEP
-  input \u2014 reconcile it, never treat it as a dispatch failure.
-
-Dispatch failure handling (worker never ran, tool error):
-1. Retry the dispatch once (recreate the child task if the store reports it unusable).
-2. **Explore: never execute inline.** If the retry fails, stop and ask the user via
-   \`ask_user_to_clarify\` (report what is blocked and why).
-3. **Publish/Verify: after a failed retry you MAY execute inline** to preserve delivery \u2014
-   the payload decisions are already in your context. Follow the same gate self-check as a
-   worker would.
-
-## Delegation Protocol
-
-Mechanics every brief must be designed around:
-
-- A worker sees ONLY: its task title + description, the parent task's description, and the
-  results of completed dependency tasks. It does NOT see this conversation.
-- Therefore **every brief is self-contained**: all decisions, boundaries, and evidence travel
-  inside the task description.
-- Dispatch is synchronous: \`task { taskId, agentId: "general-purpose" }\` returns an
-  observation (the worker's final message, truncated at ~8k chars) and an
-  \`executionResultId\`. Record the id on the child task (\`manage_task update\`/\`add_activity\`).
-- The worker settles its own task (\`set_status\` with \`result\`/\`failureReason\`). Read both the
-  observation and the task result before reconciling.
-
-Write briefs as field checklists adapted to the situation \u2014 decisions and evidence, not prose.
-The worker assembles payloads from the reference sections of this skill; the brief carries the
-approved decisions, never full payload JSON.
-
-### Explore brief (\`Explore <schema>.<table> for <goal>\`)
-
-Required fields:
-1. Datasource: serverKey/connectionKey + datasourceId (and \`runConfig.metricsDataSource\` preset if present).
-2. Grant boundary: the allowed schema + table pattern from \`get_grants\`, verbatim; never probe outside it.
-3. Target table(s): schema-qualified names; one brief per table.
-4. Question list: per column (or column group) \u2014 business meaning candidates, expected role
-   (dimension | measure | time), net/gross, grain.
-5. Method: read-only SELECT/WITH only; use the \`references/metadata-sql.md\` templates
-   (columns, sample rows, value distribution); cap sample size (e.g. \u22641000 rows, \u226450 groups).
-   Prefer targeted queries over bulk catalog dumps. A large single read (e.g. full
-   \`read_semantic_catalog\` detail) is allowed \u2014 your isolation protects the orchestrator's
-   context \u2014 but findings must be compressed to conclusion level.
-6. Output contract: structured findings \u2014 per column: observed type, sample values,
-   distribution highlights, role candidate + evidence, \`INCONCLUSIVE\` marking for unresolved
-   semantics.
-7. Invariants: read-only only; grant boundary absolute; never guess \u2014 \`INCONCLUSIVE\` instead.
-8. Closing: settle the task (\`set_status completed\`, result = findings summary); final message
-   = the structured findings (it becomes the observation).
-
-### Publish-table brief (\`Publish table meta <objectKey>\`)
-
-Required fields:
-1. Approved decisions: full column list (name/type/role/label/description), grain,
-   displayName/docType/shortDesc/sourceSystem/sourceTables.
-2. Identity: \`objectKey\` (stable, unique per datasource) + \`schemaName.tableName\`.
-3. Assembly instruction: full \`table_view_detail\` payload per **Publish table meta** below,
-   plus the identity twin (\`table_catalog\`, same \`objectKey\`), plus an EXACT \`accessGrant\`
-   matching the tenant grant.
-4. Gate self-check: publish gate items 1\u20133 \u2014 do not publish if any fails.
-5. Publish via \`metrics_meta_tool\` \`create_table\`; then \`get_meta\` to confirm visibility.
-6. Mistakes: fix with \`update_table\`; never leave a partial publish.
-7. Invariants: EXACT patternType; every column tagged and labeled.
-8. Closing: settle the task; final message = receipts (objectKeys + get_meta confirmation).
-
-### Publish-metric brief (\`Publish metric <objectKey>\`)
-
-Required fields (per metric):
-1. Identity: \`objectKey\` = \`metric_name\`, display_name, domain, description, data_type, format.
-2. Source: schema-qualified \`source.table_view\` (must match the published table meta).
-3. Calculation: aggregate (\`aggregation\` + \`measure\`, with the confirmed business meaning) or
-   derived (ratio references / formula) \u2014 exactly as approved in Propose the model.
-4. \`supported_dimensions\`: array of objects \`{dim_id, field_name, label, data_type}\`,
-   including the time dimension.
-5. \`default_time_context\`: time_dimension + granularity + supported_grains (+ window if requested).
-6. \`ai_agent_context\`: polarity, synonyms, human_readable_explanation.
-7. Assembly instruction: \`metric_index\` then \`metric_detail\` in the FULL runtime style per
-   **Publish metric meta** below; publish via \`metrics_meta_tool\` \`create_metric\`.
-8. Gate self-check + smoke \`query\` (one grouping by the default time grain) + \`get_meta\`
-   receipts; closing = settle the task, final message = receipts.
-
-### Verify brief (\`Verify <metric> against acceptance evidence\`)
-
-Required fields:
-1. Acceptance evidence verbatim (from the Goal Model).
-2. Queries to run (semantic \`query\` via \`metrics_runtime_tool\`) and the expected shape/values.
-3. Report contract: PASS/FAIL verdict + actual vs expected; on FAIL include the differences
-   and a suspicion list \u2014 do NOT modify meta (fixes are new Publish tasks).
-4. Invariants: read-only only.
-5. Closing: settle the task; final message = the verdict summary.
-
-### Brief closing (all types)
-
-- Invariants line: grant boundary + read-only SQL + publish gate before any create.
-- Result structure: the structured summary the orchestrator expects back.
-- Finish by settling the task (\`set_status completed\` with result, or \`failed\` with
-  failureReason) and making the final message that structured summary.
-
-## Worker mode
-
-Trigger: your context contains \`## Bound Task\`. You are a worker; these rules override the
-orchestrator policy (Safety and the reference sections still apply):
-
-- Execute the bound task's brief only. Read the contract with \`manage_task get\`; the task
-  description is authoritative. Load this skill if the bootstrap asks \u2014 you need its payload
-  reference sections.
-- Do NOT: re-agree the Goal Model, create sibling or child tasks, dispatch \`task\`, call
-  \`ask_user_to_clarify\`, or update the parent task's \`## Belief State\`.
-- Apply the FEP loop inside the brief; obey the grant boundary and read-only SQL; run the
-  publish gate before any create.
-- Unclear semantics: mark \`INCONCLUSIVE\` with candidates + evidence in your findings. Never
-  guess, never publish on a guess.
-- Finish: \`set_status completed\` with a structured result (or \`failed\` with failureReason),
-  and make your final message the structured summary \u2014 it is the observation your
-  orchestrator reads.
-
-## Belief State (orchestrator-owned)
-
-The parent task's description carries a \`## Belief State\` section as a Markdown table:
-
-\`\`\`
-| Belief Key | Probability | Target | Basis |
-|---|---|---|---|
-| sell-in-nes-source-table | 70% | 100% | column \`nes\` probed as numeric measure in grant |
-\`\`\`
-
-Rules: belief keys are lowercase kebab-case; probability/target are percentages 0\u2013100% that
-represent evidence support, not calibrated probability. Only the orchestrator writes this
-section \u2014 after each dispatch it folds the worker's findings into the table so the parent
-task always reflects the current evidence.
-
-## Workflow
-
-1. **Pick the datasource + cheap observation.** \`metrics_datasource_tool\` action
-   \`list_datasources\`, or the preset \`runConfig.metricsDataSource\` (\`serverKey\`\u2192connectionKey,
-   \`datasourceId\`). Inline, read-only.
-2. **Agree the Goal Model.** (HITL)
-3. **Create the parent task** \u2014 contract + \`## Belief State\` (seeded from the Goal Model).
-4. **Explore by dispatch** \u2014 one Explore brief per table, serial; collect findings; reconcile
-   \`## Belief State\`; collect \`INCONCLUSIVE\` columns.
-5. **Propose the model** (HITL) \u2014 present table columns (with \`role: dimension | measure\`)
-   and the metrics (aggregate/derived) for approval; include clarify questions for
-   \`INCONCLUSIVE\` columns in the same ask.
-6. **Publish tables by dispatch** \u2014 one Publish-table brief per table; check receipts.
-7. **Publish metrics by dispatch** \u2014 one Publish-metric brief per metric; receipts + smoke query.
-8. **Verify by dispatch** \u2014 Verify brief against acceptance evidence. FAIL \u2192 reconcile
-   belief \u2192 fix decisions \u2192 new Publish task (\`update_table\`/\`update_metric\`) \u2192 re-Verify.
-   PASS \u2192 complete the parent task (result = acceptance evidence met).
-
-## Explore (reference)
-
-Read \`table-grants\`, then probe with \`query\`. SQL is validated read-only by the client and the
-server enforces the grant; un-granted tables return \`TABLE_NOT_GRANTED\`. Prefer the
-\`references/metadata-sql.md\` templates because dialect varies (PostgreSQL / SQL Server / HANA).
-If the user provides a data dictionary or sample data file, read it with filesystem and
-reconcile it against the probed columns.
-
-## Unclear field semantics
-
-A probed column name may not reveal its business meaning (e.g. whether \`nes\` is a net amount to
-sum, a rate to average, or an enum to filter). Publishing meta on a misunderstood field pollutes
-the runtime and every downstream metric that depends on it, and delete is not available. Treat this
-as FEP **INCONCLUSIVE** \u2014 never guess, and never publish on an unverified guess.
-
-Resolve in order of increasing cost (inside the Explore brief):
-1. **Probe sample values and distribution** (\`query\`, templates in \`references/metadata-sql.md\`):
-   - numbers in (0,1) or clustered near 100 \u2192 likely a ratio/percentage \u2192 dimension or \`avg\`, rarely \`sum\`;
-   - large additive amounts (currency, counts) \u2192 measure with \`sum\`;
-   - small enumerations (year 2023/2024, 0/1 flags, codes) \u2192 dimension.
-   The share of zeros/negatives and the value scale usually disambiguate semantics.
-2. **Read user-provided docs**: if the user supplied a data dictionary or sample file, read it via
-   filesystem and reconcile it against the probed columns.
-3. **Cross-field correlation**: compare the unclear field with fields whose semantics are confirmed.
-
-If evidence is still INCONCLUSIVE:
-- Do **not** publish meta that depends on the unclear field.
-- The worker marks the column \`INCONCLUSIVE\` (candidates + evidence) in its findings; the
-  **orchestrator** lists it with candidate interpretations in the **Propose the model** step
-  and asks the user to confirm its semantics (role, value meaning, net/gross) via
-  \`ask_user_to_clarify\`. The user does not need to see the table \u2014 probed schema, samples, and
-  candidates are enough.
-- The orchestrator records a low-probability belief entry (e.g.
-  \`| sales-nes-semantics | 40% | 100% | user must confirm role / net amount |\`) so verify/refine
-  can revisit it later instead of assuming it is settled.
-
-## Publish table meta (\`create_table\`)
-
-Publish the authoritative shape below (objectType \`table_view_detail\`, with an EXACT accessGrant):
-
-\`\`\`json
-{
-  "objectType": "table_view_detail",
-  "objectKey": "hankel_view_sales_summary",
-  "status": 1,
-  "payload": {
-    "schemaName": "public",
-    "tableName": "hankel_view_sales_summary",
-    "displayName": "Hankel Sales Summary",
-    "docType": "Sales Summary",
-    "docTypeEn": "Sales Summary",
-    "shortDesc": "Sales-level progress summary.",
-    "grain": "canonical_sales_name",
-    "sourceSystem": "Hankel Run for Gold",
-    "sourceTables": ["hankel_project_opportunity_lines", "hankel_new_order_lines"],
-    "columns": [
-      { "name": "canonical_sales_name", "label": "Canonical Sales Name", "type": "string", "role": "dimension", "description": "Standardized sales name used for grouping." },
-      { "name": "nes", "label": "NES", "type": "number", "role": "measure", "description": "Net external sales amount." },
-      { "name": "report_cutoff_date", "label": "Report Cutoff Date", "type": "date", "role": "time", "description": "Cutoff date of the report snapshot." }
-    ]
-  },
-  "accessGrant": {
-    "schemaName": "public",
-    "tablePattern": "hankel_view_sales_summary",
-    "patternType": "EXACT",
-    "caseSensitive": false,
-    "status": 1
-  }
-}
-\`\`\`
-
-Design rules:
-- \`objectKey\` is stable and unique per datasource (the view/table key).
-- \`columns[].role\` has THREE values: \`dimension\` (grouping/filtering), \`measure\` (aggregated numbers), \`time\` (the report cutoff/snapshot date used by default_time_context).
-- Give every column a business \`description\`.
-- Lineage fields (\`docType\`, \`shortDesc\`, \`grain\`, \`sourceSystem\`, \`sourceTables\`) make the asset findable and trustworthy \u2014 fill them from exploration evidence.
-- Runtime table publication uses \`patternType: "EXACT"\` (\`PREFIX\` is only for datasource-level exploration scopes).
-- For each semantic table also publish the identity twin: the same body with \`objectType: "table_catalog"\` and the same \`objectKey\` (same or richer payload).
-
-## Publish metric meta (\`create_metric\`)
-
-Two steps for the same \`objectKey\`.
-
-### 3a. Metric index (for lists/search)
-
-\`\`\`json
-{
-  "objectType": "metric_index",
-  "objectKey": "sell_in_nes",
-  "status": 1,
-  "payload": {
-    "metric_name": "sell_in_nes",
-    "display_name": "Sell-in NES",
-    "domain": "sales",
-    "short_desc": "Net external sales amount from distributor sell-in rows.",
-    "search_keywords": ["sell in", "nes", "net external sales"],
-    "source_type": "cdp_postgres",
-    "source": { "table_view": "public.hankel_distr_sell_in" }
-  }
-}
-\`\`\`
-
-\`search_keywords\` drive metric retrieval for natural-language questions \u2014 include business synonyms.
-
-### 3b. Metric detail (the calculation)
-
-IMPORTANT \u2014 runtime schema requirement: the Metrics Server query runtime only recognizes metrics
-published in the FULL runtime style below (the same shape as existing working metrics, with
-snake_case fields like \`metric_name\`, \`source.table_view\`, \`supported_dimensions\` objects, and
-\`default_time_context\`). A minimal \`{name, sourceTable, calculation, dimensions}\` payload is
-accepted by the publish API but is NOT queryable \u2014 querying it returns 403 "not authorized".
-
-Aggregate metric (full runtime style):
-
-\`\`\`json
-{
-  "objectType": "metric_detail",
-  "objectKey": "sell_in_nes",
-  "status": 1,
-  "payload": {
-    "metric_name": "sell_in_nes",
-    "display_name": "Sell-in NES",
-    "domain": "sales",
-    "description": "Net external sales amount from distributor sell-in rows.",
-    "data_type": "numeric",
-    "format": "currency",
-    "source_type": "cdp_postgres",
-    "source": { "table_view": "public.hankel_distr_sell_in", "base_filters": [] },
-    "calculation": { "type": "aggregate", "aggregation": "sum", "measure": "nes" },
-    "supported_dimensions": [
-      { "dim_id": "posting_year", "field_name": "posting_year", "label": "Posting Year", "data_type": "number" },
-      { "dim_id": "sales_team", "field_name": "sales_team", "label": "Sales Team", "data_type": "string" }
-    ],
-    "default_time_context": {
-      "time_dimension": "posting_date",
-      "label": "Posting date",
-      "granularity": "month",
-      "window": "YTD",
-      "supported_grains": ["month", "year"]
-    },
-    "ai_agent_context": {
-      "polarity": "positive",
-      "synonyms": ["sell in", "nes", "net external sales"],
-      "human_readable_explanation": "Higher sell-in NES means more goods purchased from the distributor."
-    }
-  }
-}
-\`\`\`
-
-Derived ratio metric (references two aggregate metrics):
-
-\`\`\`json
-{
-  "objectType": "metric_detail",
-  "objectKey": "gross_margin_rate",
-  "status": 1,
-  "payload": {
-    "metric_name": "gross_margin_rate",
-    "display_name": "Gross Margin Rate",
-    "description": "Gross margin divided by sell-in NES.",
-    "domain": "sales",
-    "data_type": "numeric",
-    "format": "percent",
-    "source_type": "cdp_postgres",
-    "source": { "table_view": "public.hankel_distr_sell_in", "base_filters": [] },
-    "calculation": { "type": "derived", "operator": "ratio", "numerator": "gross_margin", "denominator": "sell_in_nes" },
-    "supported_dimensions": [
-      { "dim_id": "posting_year", "field_name": "posting_year", "label": "Posting Year", "data_type": "number" }
-    ],
-    "default_time_context": { "time_dimension": "posting_date", "granularity": "month", "supported_grains": ["month", "year"] }
-  }
-}
-\`\`\`
-
-Design rules:
-- \`objectKey\` unique per datasource (index and detail share it).
-- \`payload.metric_name\` must equal \`objectKey\`.
-- \`source.table_view\` must be schema-qualified and match the published table meta's physical table.
-- \`supported_dimensions\` is an array of OBJECTS ({dim_id, field_name, label, data_type}); include the time dimension too; each must be a published column of that table meta.
-- \`calculation.type: "aggregate"\` = one measure + aggregation (sum/avg/count/min/max/count_distinct).
-- \`calculation.type: "derived"\` operator \`ratio\` references existing metric objectKeys (numerator/denominator); a \`formula\` variant takes an expression of metric names, numbers, parentheses, and + - * / \u2014 referenced metrics must share the same source.table_view.
-- \`default_time_context\` (\`time_dimension\` + \`granularity\` + \`supported_grains\`, optionally \`window\`) is required by the query runtime; its \`time_dimension\` must appear in supported_dimensions.
-- \`ai_agent_context\` (\`polarity\`, \`synonyms\`, \`human_readable_explanation\`) improves natural-language metric retrieval \u2014 always provide it.
-- One semantic query can only combine metrics sharing the same source.table_view; groupBy values must be dim_ids or time-grain expressions like \`posting_date__month\`.
-- Do not inline raw SQL for new DB-backed metrics (complex logic belongs in a view).
-- Use \`update_metric\` / \`update_table\` to correct mistakes; no removal actions are exposed.
-
-## Verify and refine
-
-- Verify is **dispatched** (Verify brief). The worker runs \`get_meta\` \u2192 confirms the table and
-  metric are visible, then \`query\`es the metric against acceptance evidence.
-- On FAIL the worker reports differences; the **orchestrator** applies the FEP reconcile:
-  update \`## Belief State\`, fix the decisions, and dispatch a new Publish task
-  (\`update_table\`/\`update_metric\`) \u2014 then re-Verify \u2014 until acceptance evidence is met.
-
-## Troubleshooting
-
-| Symptom | Cause / fix |
-|---|---|
-| \`TABLE_NOT_GRANTED\` | SQL referenced a table outside the tenant grant; pick an in-grant table |
-| metric create fails: sourceTable missing | publish the table meta first |
-| metric create fails: unknown dimension | publish the dimension column with \`role: dimension\` |
-| derived metric create fails | numerator/denominator metrics don't exist yet \u2014 publish them first |
-| datasource \`query\` rejected | SQL was not read-only (SELECT/WITH only) or multi-statement |
-| \`403 Metric is not authorized\` on query_metrics | the metric meta is not in the queryable runtime schema (e.g. missing \`source.table_view\` / \`supported_dimensions\` / \`default_time_context\`) or genuinely unauthorized \u2014 re-publish with the full runtime payload and verify; never retry blindly |
-| worker observation truncated | findings exceeded ~8k chars; worker must keep the final message a compact structured summary |
-| dispatch failed (tool error) | retry once; Explore never goes inline \u2014 ask the user; Publish/Verify may go inline after the failed retry |
-
-## Safety
-
-- Only query tables that match the tenant's \`table-grants\`.
-- Never return a full physical-table inventory or reveal whether an un-granted table exists.
-- SQL is validated read-only; let the server reject anything outside that.
-`;
-var resources = {
-  "references/metadata-sql.md": {
-    content: `# Datasource exploration SQL templates (read-only)
-
-Pick the block matching the server's database. These run through the datasource \`query\` action;
-the SQL is validated read-only.
-
-## PostgreSQL
-- Tables: \`select table_schema, table_name from information_schema.tables where table_schema not in ('pg_catalog','information_schema') order by table_schema, table_name\`
-- Columns: \`select column_name, data_type from information_schema.columns where table_schema = :schemaName and table_name = :tableName order by ordinal_position\`
-- Sample: \`select * from :schemaName.:tableName limit :maxRows\` \u2014 pass a concrete table, not a bound param, if the server does not support binding identifiers.
-
-## SQL Server
-- Tables: \`select table_schema, table_name from information_schema.tables order by table_schema, table_name\`
-- Columns: \`select column_name, data_type from information_schema.columns where table_schema = :schemaName and table_name = :tableName order by ordinal_position\`
-
-## HANA
-- Tables: \`select schema_name, table_name from sys.tables where schema_name = :schemaName order by table_name\`
-- Columns: \`select column_name, data_type_name from table_columns where schema_name = :schemaName and table_name = :tableName order by position\`
-
-## Value distribution (any dialect)
-\`select <dim>, count(*) as row_count from <table> group by <dim> order by row_count desc limit :maxRows\`
-`
-  },
-  "examples/table-meta.json": {
-    content: `{
-  "objectType": "table_view_detail",
-  "objectKey": "hankel_distr_sell_in",
-  "status": 1,
-  "payload": {
-    "schemaName": "public",
-    "tableName": "hankel_distr_sell_in",
-    "displayName": "Hankel Distributor Sell In",
-    "description": "Distributor sell-in transaction rows for the Hankel tenant.",
-    "columns": [
-      { "name": "posting_year", "label": "Posting Year", "type": "number", "role": "dimension" },
-      { "name": "posting_month", "label": "Posting Month", "type": "number", "role": "dimension" },
-      { "name": "sales_team", "label": "Sales Team", "type": "string", "role": "dimension" },
-      { "name": "region", "label": "Region", "type": "string", "role": "dimension" },
-      { "name": "nes", "label": "Net External Sales", "type": "number", "role": "measure" },
-      { "name": "gross_margin", "label": "Gross Margin", "type": "number", "role": "measure" }
-    ]
-  }
-}
-`
-  },
-  "examples/metric-aggregate.json": {
-    content: `{
-  "objectType": "metric_detail",
-  "objectKey": "sell_in_nes",
-  "status": 1,
-  "payload": {
-    "metric_name": "sell_in_nes",
-    "display_name": "Sell-in NES",
-    "domain": "sales",
-    "description": "Net external sales amount from distributor sell-in rows.",
-    "data_type": "numeric",
-    "format": "currency",
-    "source_type": "cdp_postgres",
-    "source": { "table_view": "public.hankel_distr_sell_in", "base_filters": [] },
-    "calculation": { "type": "aggregate", "aggregation": "sum", "measure": "nes" },
-    "supported_dimensions": [
-      { "dim_id": "posting_year", "field_name": "posting_year", "label": "Posting Year", "data_type": "number" },
-      { "dim_id": "sales_team", "field_name": "sales_team", "label": "Sales Team", "data_type": "string" },
-      { "dim_id": "posting_date", "field_name": "posting_date", "label": "Posting Date", "data_type": "string" }
-    ],
-    "default_time_context": {
-      "time_dimension": "posting_date",
-      "label": "Posting date",
-      "granularity": "month",
-      "window": "YTD",
-      "supported_grains": ["month", "year"]
-    },
-    "ai_agent_context": {
-      "polarity": "positive",
-      "synonyms": ["sell in", "nes", "net external sales"],
-      "human_readable_explanation": "Higher sell-in NES means more goods purchased from the distributor."
-    }
-  }
-}
-`
-  },
-  "examples/metric-derived.json": {
-    content: `{
-  "objectType": "metric_detail",
-  "objectKey": "gross_margin_rate",
-  "status": 1,
-  "payload": {
-    "metric_name": "gross_margin_rate",
-    "display_name": "Gross Margin Rate",
-    "domain": "sales",
-    "description": "Gross margin divided by sell-in NES.",
-    "data_type": "numeric",
-    "format": "percent",
-    "source_type": "cdp_postgres",
-    "source": { "table_view": "public.hankel_distr_sell_in", "base_filters": [] },
-    "calculation": { "type": "derived", "operator": "ratio", "numerator": "gross_margin", "denominator": "sell_in_nes" },
-    "supported_dimensions": [
-      { "dim_id": "posting_year", "field_name": "posting_year", "label": "Posting Year", "data_type": "number" },
-      { "dim_id": "posting_date", "field_name": "posting_date", "label": "Posting Date", "data_type": "string" }
-    ],
-    "default_time_context": {
-      "time_dimension": "posting_date",
-      "label": "Posting date",
-      "granularity": "month",
-      "supported_grains": ["month", "year"]
-    },
-    "ai_agent_context": {
-      "polarity": "positive",
-      "synonyms": ["gross margin rate", "margin rate"],
-      "human_readable_explanation": "Gross margin rate divides gross margin by sell-in NES; higher means more margin retained on sold-in goods."
-    }
-  }
-}
-`
-  }
-};
-var SEMANTIC_METRICS_MODELING_SKILL = {
-  version: "1.1.2",
-  content: CONTENT,
-  resources
-};
-
-// src/middlewares/semanticMetricsBuilderPrompt.ts
-var SEMANTIC_METRICS_BUILDER_PROMPT = `You are the Semantic Metrics Builder.
-
-CRITICAL FIRST ACTION: Before any response or other action, call the \`skill\`
-tool with skill_name: "semantic-metrics-modeling" to load semantic-metrics-modeling and follow it.
-Never announce the skill load. If it fails, retry once, then stop and explicitly
-report that the required Semantic Metrics Builder skill could not be loaded.`;
-
-// src/middlewares/semanticMetricsMiddleware.ts
-var import_protocols33 = require("@axiom-lattice/protocols");
-function createSemanticMetricsMiddleware(config) {
-  const connections = config.connections ?? [];
-  const connectAll = config.connectAll === true;
-  const selector = { connectionType: "semantic-metrics", connections, connectAll };
-  return (0, import_langchain70.createMiddleware)({
-    name: "SemanticMetrics",
-    contextSchema,
-    tools: [
-      createMetricsDatasourceTool(selector),
-      createMetricsMetaTool(selector),
-      createMetricsRuntimeTool(selector)
-    ]
-  });
-}
-function buildConnectionHeaders(config) {
-  const headers = {
-    Accept: "application/json",
-    ...config.headers !== void 0 && config.headers !== null ? config.headers : {}
-  };
-  if (config.apiKey) headers["Authorization"] = `Bearer ${config.apiKey}`;
-  return headers;
-}
-function resolveBaseUrl(config) {
-  const serverUrl = config.serverUrl;
-  if (!serverUrl) {
-    throw new Error("serverUrl is required");
-  }
-  return serverUrl.replace(/\/$/, "");
-}
-var semanticMetricsPlugin = {
-  meta: {
-    type: "semantic-metrics",
-    category: "data",
-    capabilityBundleEligible: true,
-    openExpose: [
-      // Query-only surface: no writes reach either tool (SQL is read-only).
-      { name: "metrics_datasource_tool", readOnly: true },
-      { name: "metrics_runtime_tool", readOnly: true }
-    ],
-    name: "Semantic Metrics",
-    description: "Semantic metrics datasource exploration, meta publishing, and runtime querying. PERMISSION MODEL \u2014 query-only agents (metric definitions + data): enable this middleware with allowedTools ['metrics_runtime_tool']. Metric designers (Builder): keep all three tools (metrics_datasource_tool, metrics_meta_tool, metrics_runtime_tool) for exploration, publishing, and verification, or use the built-in 'semantic-metrics-builder' agent.",
-    version: "1.0.0",
-    tools: [
-      { name: "metrics_datasource_tool", description: "Explore datasource structure within the tenant's granted scope" },
-      { name: "metrics_meta_tool", description: "Publish and maintain runtime semantic tables and metrics" },
-      { name: "metrics_runtime_tool", description: "Read runtime meta and execute semantic metric queries" }
-    ],
-    configSchema: {
-      type: "object",
-      title: "Semantic Metrics Configuration",
-      description: "First select connections (connections or connectAll). Then scope tools by role via allowedTools: QUERY-ONLY agents (metric definitions + data) set allowedTools to ['metrics_runtime_tool'] \u2014 it is self-contained (list_datasources, read_semantic_catalog, query_metrics); metric DESIGNERS keep all three tools (datasource exploration, meta publishing, runtime verification).",
-      properties: {
-        connections: {
-          type: "array",
-          title: "Connections",
-          items: { type: "string" },
-          widget: "connectionSelect"
-        },
-        connectAll: {
-          type: "boolean",
-          title: "Connect All",
-          default: false,
-          widget: "switch"
-        }
-      }
-    },
-    defaultConfig: { connections: [], connectAll: false }
-  },
-  connection: {
-    // PluginConnectionFieldSchema.type supports only string/number/boolean/password,
-    // so headers is NOT a form field; the V2 client still reads config.headers at runtime.
-    fields: [
-      { key: "serverUrl", type: "string", title: "Metrics Server Base URL (include /api/v1)", required: true },
-      { key: "apiKey", type: "password", title: "API Key (optional)" }
-    ],
-    test: async (config) => {
-      try {
-        const baseUrl = resolveBaseUrl(config);
-        const res = await fetch(`${baseUrl}/datasources`, {
-          headers: buildConnectionHeaders(config)
-        });
-        const text = await res.text().catch(() => "");
-        let ok = res.ok;
-        let detail = "";
-        try {
-          const parsed = JSON.parse(text);
-          if (parsed !== null && typeof parsed === "object" && !Array.isArray(parsed)) {
-            const code = parsed.code;
-            if (typeof code === "number") {
-              ok = res.ok && code === 200;
-              if (!ok) detail = ` (${parsed.message ?? code})`;
-            }
-          }
-        } catch {
-        }
-        return {
-          ok,
-          message: ok ? `Reachable at ${baseUrl}` : `HTTP ${res.status}${detail}`
-        };
-      } catch (err) {
-        return {
-          ok: false,
-          message: `Cannot connect: ${err instanceof Error ? err.message : String(err)}`
-        };
-      }
-    },
-    discover: async (config) => {
-      try {
-        const baseUrl = resolveBaseUrl(config);
-        const res = await fetch(`${baseUrl}/datasources`, {
-          headers: buildConnectionHeaders(config)
-        });
-        const text = await res.text();
-        if (!res.ok) {
-          throw new Error(`HTTP ${res.status}${text ? `: ${text.slice(0, 200)}` : ""}`);
-        }
-        const parsed = JSON.parse(text);
-        if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
-          throw new Error("Metrics server returned an unexpected payload (expected a JSON envelope)");
-        }
-        const envelope = parsed;
-        if (typeof envelope.code === "number" && envelope.code !== 200) {
-          throw new Error(envelope.message || `API ${envelope.code}`);
-        }
-        const data = envelope.data;
-        if (!Array.isArray(data)) {
-          throw new Error("Metrics server returned an unexpected payload (expected a datasource array)");
-        }
-        return data.filter((d) => {
-          if (d === null || typeof d !== "object") return false;
-          const id = d.id;
-          return id !== void 0 && id !== null && id !== "";
-        }).map((item) => ({
-          id: String(item.id),
-          name: item.name ?? String(item.id)
-        }));
-      } catch (err) {
-        throw new Error(
-          `Cannot discover datasources: ${err instanceof Error ? err.message : String(err)}`
-        );
-      }
-    }
-  },
-  skills: {
-    "semantic-metrics-modeling": SEMANTIC_METRICS_MODELING_SKILL
-  },
-  agents: {
-    "semantic-metrics-builder": {
-      key: "semantic-metrics-builder",
-      name: "Semantic Metrics Builder",
-      description: "Explore a granted datasource and build semantic tables and metrics interactively, tracking the work as persistent tasks with belief state and verifying each step.",
-      type: import_protocols33.AgentType.DEEP_AGENT,
-      prompt: SEMANTIC_METRICS_BUILDER_PROMPT,
-      middleware: [
-        {
-          id: "semantic-metrics",
-          type: "semantic-metrics",
-          name: "Semantic Metrics",
-          description: "Explore datasources, publish table/meta metrics, query runtime",
-          enabled: true,
-          config: { connections: [], connectAll: true }
-        },
-        {
-          id: "skill",
-          type: "skill",
-          name: "Skill",
-          description: "Load the semantic-metrics-modeling policy and task-definition reference",
-          enabled: true,
-          config: { readAll: false, skills: ["semantic-metrics-modeling", "task-definition"] }
-        },
-        {
-          id: "task",
-          type: "task",
-          name: "Task",
-          description: "Persistent TaskItems as the planning surface; update Belief State in task descriptions",
-          enabled: true,
-          config: {}
-        },
-        {
-          id: "ask_user_to_clarify",
-          type: "ask_user_to_clarify",
-          name: "Ask User",
-          description: "Wait for user input at modeling approval gates",
-          enabled: true,
-          config: {}
-        },
-        {
-          id: "filesystem",
-          type: "filesystem",
-          name: "Filesystem",
-          description: "Read user-provided schema docs, data dictionaries, or sample data files",
-          enabled: true,
-          config: {}
-        }
-      ]
-    }
-  },
-  middleware: (config) => createSemanticMetricsMiddleware(config)
-};
-
 // src/middlewares/collectionMiddleware.ts
-var import_langchain81 = require("langchain");
+var import_langchain77 = require("langchain");
 
 // src/tool_lattice/collection/list_collections.ts
-var import_zod58 = __toESM(require("zod"));
-var import_langchain71 = require("langchain");
+var import_zod55 = __toESM(require("zod"));
+var import_langchain67 = require("langchain");
 
 // src/tool_lattice/collection/utils.ts
 function getEffectiveCollectionScope(exeConfig, staticScope) {
@@ -42750,7 +41271,7 @@ var createListCollectionsTool = ({
   collectionKeys,
   connectAll
 }) => {
-  return (0, import_langchain71.tool)(
+  return (0, import_langchain67.tool)(
     async (_input, _exeConfig) => {
       try {
         const tenantId2 = _exeConfig?.configurable?.runConfig?.tenantId || "default";
@@ -42785,23 +41306,23 @@ var createListCollectionsTool = ({
     {
       name: "list_collections",
       description: LIST_COLLECTIONS_DESCRIPTION,
-      schema: import_zod58.default.object({})
+      schema: import_zod55.default.object({})
     }
   );
 };
 
 // src/tool_lattice/collection/search_collection.ts
-var import_zod59 = __toESM(require("zod"));
-var import_langchain72 = require("langchain");
+var import_zod56 = __toESM(require("zod"));
+var import_langchain68 = require("langchain");
 var SEARCH_COLLECTION_DESCRIPTION = `Search for content within a specific collection using semantic (vector) similarity. Use the 'filter' parameter to narrow results by metadata fields (e.g., {"category": "cardiovascular"}). Returns the most relevant content entries with similarity scores.`;
-var searchSchema = import_zod59.default.object({
-  collection: import_zod59.default.string().describe("The collection name to search in"),
-  query: import_zod59.default.string().describe("The search query text"),
-  filter: import_zod59.default.record(import_zod59.default.unknown()).optional().describe("Metadata filter conditions"),
-  top_k: import_zod59.default.number().optional().default(5).describe("Number of results to return")
+var searchSchema = import_zod56.default.object({
+  collection: import_zod56.default.string().describe("The collection name to search in"),
+  query: import_zod56.default.string().describe("The search query text"),
+  filter: import_zod56.default.record(import_zod56.default.unknown()).optional().describe("Metadata filter conditions"),
+  top_k: import_zod56.default.number().optional().default(5).describe("Number of results to return")
 });
 var createSearchCollectionTool = (scope = { collectionKeys: [], connectAll: true }) => {
-  return (0, import_langchain72.tool)(
+  return (0, import_langchain68.tool)(
     async (input, _exeConfig) => {
       try {
         const { collection, query, filter: filter2, top_k } = input;
@@ -42867,10 +41388,10 @@ var createSearchCollectionTool = (scope = { collectionKeys: [], connectAll: true
 };
 
 // src/tool_lattice/collection/get_collection.ts
-var import_zod60 = __toESM(require("zod"));
-var import_langchain73 = require("langchain");
+var import_zod57 = __toESM(require("zod"));
+var import_langchain69 = require("langchain");
 var GET_COLLECTION_DESCRIPTION = `Get a collection's full definition including its custom fields schema. Use this to discover what metadata fields are available before adding entries.`;
-var createGetCollectionTool = (scope = { collectionKeys: [], connectAll: true }) => (0, import_langchain73.tool)(
+var createGetCollectionTool = (scope = { collectionKeys: [], connectAll: true }) => (0, import_langchain69.tool)(
   async (input, _exeConfig) => {
     try {
       const scopeError = validateCollectionScope(input.name, _exeConfig, scope);
@@ -42895,24 +41416,24 @@ Embedding: ${c.embeddingKey}${fieldsDesc}`;
       return `Error: ${error.message}`;
     }
   },
-  { name: "get_collection", description: GET_COLLECTION_DESCRIPTION, schema: import_zod60.default.object({ name: import_zod60.default.string().describe("Collection name") }) }
+  { name: "get_collection", description: GET_COLLECTION_DESCRIPTION, schema: import_zod57.default.object({ name: import_zod57.default.string().describe("Collection name") }) }
 );
 
 // src/tool_lattice/collection/create_collection.ts
-var import_zod61 = __toESM(require("zod"));
-var import_langchain74 = require("langchain");
-var createSchema = import_zod61.default.object({
-  name: import_zod61.default.string().describe("Collection name (lowercase, underscores only)"),
-  label: import_zod61.default.string().describe("Display name"),
-  embeddingKey: import_zod61.default.string().describe("Embedding model key"),
-  fields: import_zod61.default.array(import_zod61.default.object({
-    key: import_zod61.default.string().describe("Field key name"),
-    type: import_zod61.default.enum(["string", "number", "enum"]).describe("Field data type"),
-    enumValues: import_zod61.default.array(import_zod61.default.string()).optional().describe("Valid values for enum type"),
-    required: import_zod61.default.boolean().optional().default(false).describe("Whether field is required")
+var import_zod58 = __toESM(require("zod"));
+var import_langchain70 = require("langchain");
+var createSchema = import_zod58.default.object({
+  name: import_zod58.default.string().describe("Collection name (lowercase, underscores only)"),
+  label: import_zod58.default.string().describe("Display name"),
+  embeddingKey: import_zod58.default.string().describe("Embedding model key"),
+  fields: import_zod58.default.array(import_zod58.default.object({
+    key: import_zod58.default.string().describe("Field key name"),
+    type: import_zod58.default.enum(["string", "number", "enum"]).describe("Field data type"),
+    enumValues: import_zod58.default.array(import_zod58.default.string()).optional().describe("Valid values for enum type"),
+    required: import_zod58.default.boolean().optional().default(false).describe("Whether field is required")
   })).optional().describe("Custom field definitions for entries in this collection")
 });
-var createCreateCollectionTool = (scope = {}) => (0, import_langchain74.tool)(
+var createCreateCollectionTool = (scope = {}) => (0, import_langchain70.tool)(
   async (input, _exeConfig) => {
     try {
       const tenantId2 = _exeConfig?.configurable?.runConfig?.tenantId || "default";
@@ -42938,20 +41459,20 @@ var createCreateCollectionTool = (scope = {}) => (0, import_langchain74.tool)(
 );
 
 // src/tool_lattice/collection/update_collection.ts
-var import_zod62 = __toESM(require("zod"));
-var import_langchain75 = require("langchain");
-var schema = import_zod62.default.object({
-  name: import_zod62.default.string().describe("Collection name"),
-  label: import_zod62.default.string().optional().describe("New display name"),
-  embeddingKey: import_zod62.default.string().optional().describe("New embedding model key"),
-  fields: import_zod62.default.array(import_zod62.default.object({
-    key: import_zod62.default.string().describe("Field key name"),
-    type: import_zod62.default.enum(["string", "number", "enum"]).describe("Field data type"),
-    enumValues: import_zod62.default.array(import_zod62.default.string()).optional().describe("Valid values for enum type"),
-    required: import_zod62.default.boolean().optional().default(false).describe("Whether field is required")
+var import_zod59 = __toESM(require("zod"));
+var import_langchain71 = require("langchain");
+var schema = import_zod59.default.object({
+  name: import_zod59.default.string().describe("Collection name"),
+  label: import_zod59.default.string().optional().describe("New display name"),
+  embeddingKey: import_zod59.default.string().optional().describe("New embedding model key"),
+  fields: import_zod59.default.array(import_zod59.default.object({
+    key: import_zod59.default.string().describe("Field key name"),
+    type: import_zod59.default.enum(["string", "number", "enum"]).describe("Field data type"),
+    enumValues: import_zod59.default.array(import_zod59.default.string()).optional().describe("Valid values for enum type"),
+    required: import_zod59.default.boolean().optional().default(false).describe("Whether field is required")
   })).optional().describe("Custom field definitions for entries (replaces existing schema)")
 });
-var createUpdateCollectionTool = (scope = { collectionKeys: [], connectAll: true }) => (0, import_langchain75.tool)(
+var createUpdateCollectionTool = (scope = { collectionKeys: [], connectAll: true }) => (0, import_langchain71.tool)(
   async (input, _exeConfig) => {
     try {
       const scopeError = validateCollectionScope(input.name, _exeConfig, scope);
@@ -42972,9 +41493,9 @@ var createUpdateCollectionTool = (scope = { collectionKeys: [], connectAll: true
 );
 
 // src/tool_lattice/collection/delete_collection.ts
-var import_zod63 = __toESM(require("zod"));
-var import_langchain76 = require("langchain");
-var createDeleteCollectionTool = (scope = { collectionKeys: [], connectAll: true }) => (0, import_langchain76.tool)(
+var import_zod60 = __toESM(require("zod"));
+var import_langchain72 = require("langchain");
+var createDeleteCollectionTool = (scope = { collectionKeys: [], connectAll: true }) => (0, import_langchain72.tool)(
   async (input, _exeConfig) => {
     try {
       const scopeError = validateCollectionScope(input.name, _exeConfig, scope);
@@ -42986,19 +41507,19 @@ var createDeleteCollectionTool = (scope = { collectionKeys: [], connectAll: true
       return `Error: ${e.message}`;
     }
   },
-  { name: "delete_collection", description: `Delete a collection and all its entries. This cannot be undone.`, schema: import_zod63.default.object({ name: import_zod63.default.string().describe("Collection name") }) }
+  { name: "delete_collection", description: `Delete a collection and all its entries. This cannot be undone.`, schema: import_zod60.default.object({ name: import_zod60.default.string().describe("Collection name") }) }
 );
 
 // src/tool_lattice/collection/list_entries.ts
-var import_zod64 = __toESM(require("zod"));
-var import_langchain77 = require("langchain");
-var schema2 = import_zod64.default.object({
-  collection: import_zod64.default.string().describe("Collection name")
+var import_zod61 = __toESM(require("zod"));
+var import_langchain73 = require("langchain");
+var schema2 = import_zod61.default.object({
+  collection: import_zod61.default.string().describe("Collection name")
 });
 function buildKey2(tenantId2, name) {
   return `${tenantId2}:${name}`;
 }
-var createListEntriesTool = (scope = { collectionKeys: [], connectAll: true }) => (0, import_langchain77.tool)(
+var createListEntriesTool = (scope = { collectionKeys: [], connectAll: true }) => (0, import_langchain73.tool)(
   async (input, _exeConfig) => {
     try {
       const scopeError = validateCollectionScope(input.collection, _exeConfig, scope);
@@ -43027,19 +41548,19 @@ var createListEntriesTool = (scope = { collectionKeys: [], connectAll: true }) =
 );
 
 // src/tool_lattice/collection/add_entry.ts
-var import_zod65 = __toESM(require("zod"));
-var import_langchain78 = require("langchain");
+var import_zod62 = __toESM(require("zod"));
+var import_langchain74 = require("langchain");
 var import_documents = require("@langchain/core/documents");
 var import_uuid12 = require("uuid");
-var schema3 = import_zod65.default.object({
-  collection: import_zod65.default.string().describe("Collection name"),
-  content: import_zod65.default.string().describe("Entry content text"),
-  metadata: import_zod65.default.record(import_zod65.default.unknown()).optional().describe("Metadata fields matching the collection schema")
+var schema3 = import_zod62.default.object({
+  collection: import_zod62.default.string().describe("Collection name"),
+  content: import_zod62.default.string().describe("Entry content text"),
+  metadata: import_zod62.default.record(import_zod62.default.unknown()).optional().describe("Metadata fields matching the collection schema")
 });
 function key2(t, n) {
   return `${t}:${n}`;
 }
-var createAddEntryTool = (scope = { collectionKeys: [], connectAll: true }) => (0, import_langchain78.tool)(
+var createAddEntryTool = (scope = { collectionKeys: [], connectAll: true }) => (0, import_langchain74.tool)(
   async (input, _exeConfig) => {
     try {
       const scopeError = validateCollectionScope(input.collection, _exeConfig, scope);
@@ -43071,18 +41592,18 @@ var createAddEntryTool = (scope = { collectionKeys: [], connectAll: true }) => (
 );
 
 // src/tool_lattice/collection/update_entry.ts
-var import_zod66 = __toESM(require("zod"));
-var import_langchain79 = require("langchain");
-var schema4 = import_zod66.default.object({
-  collection: import_zod66.default.string().describe("Collection name"),
-  entryId: import_zod66.default.string().describe("Entry ID to update"),
-  content: import_zod66.default.string().optional().describe("New content"),
-  metadata: import_zod66.default.record(import_zod66.default.unknown()).optional().describe("New metadata")
+var import_zod63 = __toESM(require("zod"));
+var import_langchain75 = require("langchain");
+var schema4 = import_zod63.default.object({
+  collection: import_zod63.default.string().describe("Collection name"),
+  entryId: import_zod63.default.string().describe("Entry ID to update"),
+  content: import_zod63.default.string().optional().describe("New content"),
+  metadata: import_zod63.default.record(import_zod63.default.unknown()).optional().describe("New metadata")
 });
 function key3(t, n) {
   return `${t}:${n}`;
 }
-var createUpdateEntryTool = (scope = { collectionKeys: [], connectAll: true }) => (0, import_langchain79.tool)(
+var createUpdateEntryTool = (scope = { collectionKeys: [], connectAll: true }) => (0, import_langchain75.tool)(
   async (input, _exeConfig) => {
     try {
       const scopeError = validateCollectionScope(input.collection, _exeConfig, scope);
@@ -43103,16 +41624,16 @@ var createUpdateEntryTool = (scope = { collectionKeys: [], connectAll: true }) =
 );
 
 // src/tool_lattice/collection/delete_entry.ts
-var import_zod67 = __toESM(require("zod"));
-var import_langchain80 = require("langchain");
-var schema5 = import_zod67.default.object({
-  collection: import_zod67.default.string().describe("Collection name"),
-  entryId: import_zod67.default.string().describe("Entry ID to delete")
+var import_zod64 = __toESM(require("zod"));
+var import_langchain76 = require("langchain");
+var schema5 = import_zod64.default.object({
+  collection: import_zod64.default.string().describe("Collection name"),
+  entryId: import_zod64.default.string().describe("Entry ID to delete")
 });
 function key4(t, n) {
   return `${t}:${n}`;
 }
-var createDeleteEntryTool = (scope = { collectionKeys: [], connectAll: true }) => (0, import_langchain80.tool)(
+var createDeleteEntryTool = (scope = { collectionKeys: [], connectAll: true }) => (0, import_langchain76.tool)(
   async (input, _exeConfig) => {
     try {
       const scopeError = validateCollectionScope(input.collection, _exeConfig, scope);
@@ -43132,7 +41653,7 @@ var createDeleteEntryTool = (scope = { collectionKeys: [], connectAll: true }) =
 function createCollectionMiddleware(params) {
   const { collectionKeys, connectAll, compileStableCandidateTools = false } = params;
   if (!compileStableCandidateTools && !connectAll && (!collectionKeys || collectionKeys.length === 0)) {
-    return (0, import_langchain81.createMiddleware)({
+    return (0, import_langchain77.createMiddleware)({
       name: "collectionMiddleware",
       contextSchema,
       tools: [
@@ -43142,7 +41663,7 @@ function createCollectionMiddleware(params) {
     });
   }
   const toolParams = { collectionKeys, connectAll };
-  return (0, import_langchain81.createMiddleware)({
+  return (0, import_langchain77.createMiddleware)({
     name: "collectionMiddleware",
     contextSchema,
     tools: [
@@ -43205,24 +41726,24 @@ var collectionPlugin = {
 };
 
 // src/middlewares/askUserClarifyMiddleware.ts
-var import_langchain83 = require("langchain");
+var import_langchain79 = require("langchain");
 var import_langgraph15 = require("@langchain/langgraph");
 
 // src/tool_lattice/ask_user_to_clarify/index.ts
-var import_langchain82 = require("langchain");
-var import_zod68 = __toESM(require("zod"));
-var questionSchema = import_zod68.default.object({
-  question: import_zod68.default.string().describe("The question text to ask the user. MUST include the specific context, options, or details being clarified \u2014 never use a bare generic label. Good: 'Confirm the plan: use Redis cache + PostgreSQL primary, split microservices as needed?' Bad: 'Confirm the plan?'"),
-  options: import_zod68.default.array(import_zod68.default.string()).optional().default([]).describe("List of EXACT, selectable values. Maximum 3 options allowed. DO NOT include placeholder values like 'Other' or 'Enter manually'. For free-text with predefined choices, use allowOther=true (works with 'single' and 'multiple'). For pure free-text without choices, use type='input' instead. For file_upload and input, pass an empty array."),
-  type: import_zod68.default.enum(["single", "multiple", "file_upload", "input"]).describe("The question format. 'single' = pick one from options (default, see tool description for guidance). 'multiple' = pick several from options. 'input' = free-text field (only when options cannot express the answer). 'file_upload' = file picker."),
-  required: import_zod68.default.boolean().optional().default(false).describe("Whether this question must be answered"),
-  allowOther: import_zod68.default.boolean().optional().default(true).describe("Set to true to append an 'Other' checkbox with a free-text input field. Works with 'single' and 'multiple' types. Use for open-ended answers or when the options cannot cover all possibilities. Not applicable for 'input' or 'file_upload' types.")
+var import_langchain78 = require("langchain");
+var import_zod65 = __toESM(require("zod"));
+var questionSchema = import_zod65.default.object({
+  question: import_zod65.default.string().describe("The question text to ask the user. MUST include the specific context, options, or details being clarified \u2014 never use a bare generic label. Good: 'Confirm the plan: use Redis cache + PostgreSQL primary, split microservices as needed?' Bad: 'Confirm the plan?'"),
+  options: import_zod65.default.array(import_zod65.default.string()).optional().default([]).describe("List of EXACT, selectable values. Maximum 3 options allowed. DO NOT include placeholder values like 'Other' or 'Enter manually'. For free-text with predefined choices, use allowOther=true (works with 'single' and 'multiple'). For pure free-text without choices, use type='input' instead. For file_upload and input, pass an empty array."),
+  type: import_zod65.default.enum(["single", "multiple", "file_upload", "input"]).describe("The question format. 'single' = pick one from options (default, see tool description for guidance). 'multiple' = pick several from options. 'input' = free-text field (only when options cannot express the answer). 'file_upload' = file picker."),
+  required: import_zod65.default.boolean().optional().default(false).describe("Whether this question must be answered"),
+  allowOther: import_zod65.default.boolean().optional().default(true).describe("Set to true to append an 'Other' checkbox with a free-text input field. Works with 'single' and 'multiple' types. Use for open-ended answers or when the options cannot cover all possibilities. Not applicable for 'input' or 'file_upload' types.")
 });
-var inputSchema = import_zod68.default.object({
-  questions: import_zod68.default.array(questionSchema).min(1, "At least one question is required").describe("A structured sequence of clarification questions. Use these to gather missing parameters or disambiguate user intent before proceeding.")
+var inputSchema = import_zod65.default.object({
+  questions: import_zod65.default.array(questionSchema).min(1, "At least one question is required").describe("A structured sequence of clarification questions. Use these to gather missing parameters or disambiguate user intent before proceeding.")
 });
 function createAskUserToClarifyTool() {
-  return (0, import_langchain82.tool)(
+  return (0, import_langchain78.tool)(
     async (input) => {
       return JSON.stringify(input);
     },
@@ -43247,7 +41768,7 @@ function isProjectRoomRun(request) {
   return isRecord9(runConfig?.projectRoom);
 }
 function createAskUserClarifyMiddleware() {
-  return (0, import_langchain83.createMiddleware)({
+  return (0, import_langchain79.createMiddleware)({
     name: "AskUserClarifyMiddleware",
     tools: [createAskUserToClarifyTool()],
     wrapToolCall: async (request, handler) => {
@@ -43257,7 +41778,7 @@ function createAskUserClarifyMiddleware() {
         return handler(request);
       }
       if (isProjectRoomRun(request)) {
-        return new import_langchain83.ToolMessage({
+        return new import_langchain79.ToolMessage({
           content: "You are replying inside a project room, which has no interactive clarification UI. Ask your clarifying questions directly in your reply text and stop; the user's next room message will continue the conversation.",
           tool_call_id: toolCall?.id,
           name: toolName2
@@ -43265,7 +41786,7 @@ function createAskUserClarifyMiddleware() {
       }
       const parsed = inputSchema.safeParse(toolCall?.args);
       if (!parsed.success) {
-        return new import_langchain83.ToolMessage({
+        return new import_langchain79.ToolMessage({
           content: `Invalid clarify tool arguments: ${parsed.error.message}`,
           tool_call_id: toolCall?.id,
           name: toolName2
@@ -43285,7 +41806,7 @@ function createAskUserClarifyMiddleware() {
       const result = await (0, import_langgraph15.interrupt)(md);
       const response = result.data;
       if (!response?.answers || response.answers.length === 0) {
-        return new import_langchain83.ToolMessage({
+        return new import_langchain79.ToolMessage({
           content: "No clarification questions were answered.",
           tool_call_id: toolCall?.id,
           name: toolName2
@@ -43295,7 +41816,7 @@ function createAskUserClarifyMiddleware() {
         (answer) => (answer.selectedOptions?.length ?? 0) > 0 || answer.otherText && answer.otherText.trim() !== "" || answer.filePath && answer.filePath.trim() !== ""
       );
       if (answeredQuestions.length === 0) {
-        return new import_langchain83.ToolMessage({
+        return new import_langchain79.ToolMessage({
           content: "No clarification questions were answered.",
           tool_call_id: toolCall?.id,
           name: toolName2
@@ -43325,7 +41846,7 @@ function createAskUserClarifyMiddleware() {
         }
         lines.push("");
       }
-      return new import_langchain83.ToolMessage({
+      return new import_langchain79.ToolMessage({
         content: lines.join("\n"),
         tool_call_id: toolCall?.id,
         name: toolName2
@@ -43351,11 +41872,11 @@ var askUserClarifyPlugin = {
 };
 
 // src/middlewares/widgetMiddleware.ts
-var import_langchain86 = require("langchain");
+var import_langchain82 = require("langchain");
 
 // src/tool_lattice/widget/loadGuidelines.ts
-var import_langchain84 = require("langchain");
-var import_zod69 = require("zod");
+var import_langchain80 = require("langchain");
+var import_zod66 = require("zod");
 
 // src/middlewares/guidelines/index.ts
 var CORE = `# Imagine \u2014 Visual Creation Suite
@@ -44146,13 +42667,13 @@ function getGuidelines(modules) {
 var AVAILABLE_MODULES = Object.keys(MODULE_SECTIONS);
 
 // src/tool_lattice/widget/loadGuidelines.ts
-var LoadGuidelinesInputSchema = import_zod69.z.object({
-  modules: import_zod69.z.array(import_zod69.z.string()).describe(
+var LoadGuidelinesInputSchema = import_zod66.z.object({
+  modules: import_zod66.z.array(import_zod66.z.string()).describe(
     "Which design modules to load. Choose all that apply. Available modules: [" + AVAILABLE_MODULES.join(",") + "]"
   )
 });
 function createLoadGuidelinesTool() {
-  return (0, import_langchain84.tool)(
+  return (0, import_langchain80.tool)(
     async (input) => {
       const result = getGuidelines(input.modules);
       return result;
@@ -44166,8 +42687,8 @@ function createLoadGuidelinesTool() {
 }
 
 // src/tool_lattice/widget/showWidget.ts
-var import_langchain85 = require("langchain");
-var import_zod70 = require("zod");
+var import_langchain81 = require("langchain");
+var import_zod67 = require("zod");
 function containsForbiddenTags(code) {
   const forbiddenPatterns = [
     /<!DOCTYPE/i,
@@ -44189,20 +42710,20 @@ function validateWidgetCode(code) {
   }
   return { valid: true };
 }
-var ShowWidgetInputSchema = import_zod70.z.object({
-  i_have_seen_guidelines: import_zod70.z.boolean().describe(
+var ShowWidgetInputSchema = import_zod67.z.object({
+  i_have_seen_guidelines: import_zod67.z.boolean().describe(
     "Must be true. Confirm you have called load_guidelines first."
   ),
-  title: import_zod70.z.string().describe("Title displayed above the widget"),
-  loading_messages: import_zod70.z.array(import_zod70.z.string()).optional().describe(
+  title: import_zod67.z.string().describe("Title displayed above the widget"),
+  loading_messages: import_zod67.z.array(import_zod67.z.string()).optional().describe(
     "1-4 short strings shown while the widget renders"
   ),
-  widget_code: import_zod70.z.string().describe(
+  widget_code: import_zod67.z.string().describe(
     "HTML fragment to render. Rules: 1. No DOCTYPE, <html>, <head>, or <body> tags. 2. Order: <style> block first, then HTML content, then <script> last. 3. Use only CSS variables for colors (e.g. var(--color-accent)). 4. No gradients, shadows, or blur effects. For SVG: start directly with <svg> tag."
   )
 });
 function createShowWidgetTool() {
-  return (0, import_langchain85.tool)(
+  return (0, import_langchain81.tool)(
     async (input) => {
       if (!input.i_have_seen_guidelines) {
         return "Error: You must call load_guidelines before using show_widget. Set i_have_seen_guidelines to true only after loading guidelines.";
@@ -44233,7 +42754,7 @@ function createWidgetMiddleware() {
     createLoadGuidelinesTool(),
     createShowWidgetTool()
   ];
-  return (0, import_langchain86.createMiddleware)({
+  return (0, import_langchain82.createMiddleware)({
     name: "widgetMiddleware",
     contextSchema,
     tools
@@ -44257,8 +42778,8 @@ var widgetPlugin = {
 };
 
 // src/middlewares/taskMiddleware.ts
-var import_langchain87 = require("langchain");
-var import_zod71 = require("zod");
+var import_langchain83 = require("langchain");
+var import_zod68 = require("zod");
 var import_langgraph16 = require("@langchain/langgraph");
 
 // src/util/truncateForJson.ts
@@ -44318,7 +42839,7 @@ function truncateForJson(value, options = {}) {
 }
 
 // src/middlewares/taskMiddleware.ts
-var import_protocols34 = require("@axiom-lattice/protocols");
+var import_protocols33 = require("@axiom-lattice/protocols");
 
 // src/middlewares/taskResponseSerialization.ts
 var TASK_RESPONSE_SCALAR_MAX_BYTES = 4096;
@@ -44786,7 +43307,7 @@ function classifyTaskAuthority(runConfig) {
     return delegatedTaskId ? { kind: "delegated", taskId: delegatedTaskId } : { kind: "ordinary" };
   }
   try {
-    const trusted = (0, import_protocols34.parseTrustedRunContext)(hasProjectTask ? { projectTask: runConfig.projectTask } : { projectRoom: runConfig.projectRoom });
+    const trusted = (0, import_protocols33.parseTrustedRunContext)(hasProjectTask ? { projectTask: runConfig.projectTask } : { projectRoom: runConfig.projectRoom });
     return { kind: hasProjectTask ? "projectTask" : "projectRoom", trusted };
   } catch {
     return { kind: "invalid" };
@@ -44816,6 +43337,9 @@ function trustedRosterScope(trusted) {
     callerAssistantId: context.assistantId
   };
 }
+function trustedRosterExempt(trusted) {
+  return trusted.projectTask?.rosterExempt === true;
+}
 async function requireTrustedOwner(trusted, targetAssistantId) {
   const context = trusted.projectTask ?? trusted.projectRoom;
   const memberships = getStoreLattice("default", "projectBotMembership").store;
@@ -45080,6 +43604,7 @@ async function validateTrustedChildDependencyWait(store, tenantId2, parent, depe
     if (dependency.status === "completed") continue;
     if (!["pending", "in_progress", "interrupted"].includes(dependency.status) || dependency.parentId !== parent.id || dependency.ownerType !== "agent" || !hasExactContextSource(dependency, expectedSource)) return void 0;
     incompleteChildren += 1;
+    if (trustedRosterExempt(trusted)) continue;
     try {
       await requireTrustedOwner(trusted, dependency.ownerId);
     } catch (error) {
@@ -45119,7 +43644,7 @@ function getTaskWorkItemStore() {
   return getStoreLattice("default", "taskWorkItem").store;
 }
 function getProjectTaskWorkItemStore() {
-  return (0, import_protocols34.requireProjectTaskWorkItemStore)(getTaskWorkItemStore());
+  return (0, import_protocols33.requireProjectTaskWorkItemStore)(getTaskWorkItemStore());
 }
 function reviewInterruption(task) {
   const value = task.context?.interruption;
@@ -45135,73 +43660,72 @@ function buildReviewMarkdown(task) {
     result: task.result
   });
 }
-var manageTaskSchema = import_zod71.z.object({
-  action: import_zod71.z.enum(["create", "get", "list", "update", "set_status", "add_activity", "delete"]).describe("Action to perform. Available: create, get, list, update, set_status, add_activity, delete. To change status, use set_status. To change content fields, use update."),
-  id: import_zod71.z.string().optional().describe("Task ID (required for get, update, add_activity; required for delete unless ids is given)"),
-  title: import_zod71.z.string().optional().describe("Task title (required for create)"),
-  description: import_zod71.z.string().optional().describe("Task description in Markdown"),
-  priority: import_zod71.z.enum(["low", "medium", "high"]).optional().describe("Priority level"),
-  status: import_zod71.z.enum(["pending", "in_progress", "review", "failed", "interrupted", "completed", "cancelled"]).optional().describe("Task status. For status-only changes, prefer set_status action. Set 'in_progress' when you start processing a task you hold; 'completed'/'failed' require the task to be 'in_progress'. Agent summary-only interrupted updates default to missing_input"),
-  dueDate: import_zod71.z.string().optional().describe("Due date (ISO 8601 format)"),
-  metadata: import_zod71.z.record(import_zod71.z.unknown()).optional().describe("Structured metadata (e.g. projectId, module)"),
-  metadataFilter: import_zod71.z.record(
-    import_zod71.z.union([import_zod71.z.string(), import_zod71.z.number(), import_zod71.z.boolean()])
+var manageTaskSchema = import_zod68.z.object({
+  action: import_zod68.z.enum(["create", "get", "list", "update", "set_status", "add_activity", "delete"]).describe("Action to perform. Available: create, get, list, update, set_status, add_activity, delete. To change status, use set_status. To change content fields, use update."),
+  id: import_zod68.z.string().optional().describe("Task ID (required for get, update, add_activity; required for delete unless ids is given)"),
+  title: import_zod68.z.string().optional().describe("Task title (required for create)"),
+  description: import_zod68.z.string().optional().describe("Task description in Markdown"),
+  priority: import_zod68.z.enum(["low", "medium", "high"]).optional().describe("Priority level"),
+  status: import_zod68.z.enum(["pending", "in_progress", "review", "failed", "interrupted", "completed", "cancelled"]).optional().describe("Task status. For status-only changes, prefer set_status action. Set 'in_progress' when you start processing a task you hold; 'completed'/'failed' require the task to be 'in_progress'. Agent summary-only interrupted updates default to missing_input"),
+  dueDate: import_zod68.z.string().optional().describe("Due date (ISO 8601 format)"),
+  metadata: import_zod68.z.record(import_zod68.z.unknown()).optional().describe("Structured metadata (e.g. projectId, module)"),
+  metadataFilter: import_zod68.z.record(
+    import_zod68.z.union([import_zod68.z.string(), import_zod68.z.number(), import_zod68.z.boolean()])
   ).optional().describe("List-only filter. Every key must equal the task metadata value, e.g. {projectId:'p1', retries:2}. Multiple keys AND together."),
-  parentId: import_zod71.z.string().optional().describe("Parent task ID for grouping subtasks"),
-  sourceId: import_zod71.z.string().optional().describe("Source session/thread ID"),
-  context: import_zod71.z.record(import_zod71.z.unknown()).optional().describe("Additional context data"),
-  ownerType: import_zod71.z.enum(["user", "agent"]).optional().describe("Owner type. Defaults to 'user' if omitted"),
-  ownerId: import_zod71.z.string().optional().describe("Owner ID. Auto-filled from current user/agent if omitted"),
-  requireReview: import_zod71.z.boolean().optional().describe("If true, agent completion pauses as interrupted(review_required) for HITL approval"),
-  dependencies: import_zod71.z.array(import_zod71.z.string()).optional().describe("List of task IDs that must be completed before this task can start"),
-  dependencyTaskIds: import_zod71.z.array(import_zod71.z.string().trim().min(1)).optional().describe("Exact blocking task IDs required for an external_dependency interruption"),
-  result: import_zod71.z.string().optional().describe("Result summary. Used with set_status status='completed' or update status='completed'"),
-  failureReason: import_zod71.z.string().optional().describe("Failure reason. Used with set_status status='failed' or update status='failed'"),
-  files: import_zod71.z.array(import_zod71.z.object({
-    uri: import_zod71.z.string().describe("Uniquely locates the resource: http(s):// URL, /s/:token share, or sandbox path"),
-    name: import_zod71.z.string().optional().describe("Display name"),
-    addedBy: import_zod71.z.enum(["user", "agent"]).optional().describe("Who attached the file")
+  parentId: import_zod68.z.string().optional().describe("Parent task ID for grouping subtasks"),
+  sourceId: import_zod68.z.string().optional().describe("Source session/thread ID"),
+  context: import_zod68.z.record(import_zod68.z.unknown()).optional().describe("Additional context data"),
+  ownerType: import_zod68.z.enum(["user", "agent"]).optional().describe("Owner type. Defaults to 'user' if omitted"),
+  ownerId: import_zod68.z.string().optional().describe("Owner ID. Auto-filled from current user/agent if omitted"),
+  requireReview: import_zod68.z.boolean().optional().describe("If true, agent completion pauses as interrupted(review_required) for HITL approval"),
+  dependencies: import_zod68.z.array(import_zod68.z.string()).optional().describe("List of task IDs that must be completed before this task can start"),
+  result: import_zod68.z.string().optional().describe("Result summary. Used with set_status status='completed' or update status='completed'"),
+  failureReason: import_zod68.z.string().optional().describe("Failure reason. Used with set_status status='failed' or update status='failed'"),
+  files: import_zod68.z.array(import_zod68.z.object({
+    uri: import_zod68.z.string().describe("Uniquely locates the resource: http(s):// URL, /s/:token share, or sandbox path"),
+    name: import_zod68.z.string().optional().describe("Display name"),
+    addedBy: import_zod68.z.enum(["user", "agent"]).optional().describe("Who attached the file")
   })).optional().describe("File references attached to this task"),
-  beliefImpact: import_zod71.z.array(import_zod71.z.object({
-    key: import_zod71.z.string().regex(/^[a-z0-9]+(?:-[a-z0-9]+)*$/),
-    after: import_zod71.z.number().int().min(0).max(100),
-    basis: import_zod71.z.string().trim().min(1).max(1e3),
-    isNew: import_zod71.z.boolean().optional().describe("Set true only to add a belief key that is absent from the belief owner's Belief State; omit for keys that already exist")
+  beliefImpact: import_zod68.z.array(import_zod68.z.object({
+    key: import_zod68.z.string().regex(/^[a-z0-9]+(?:-[a-z0-9]+)*$/),
+    after: import_zod68.z.number().int().min(0).max(100),
+    basis: import_zod68.z.string().trim().min(1).max(1e3),
+    isNew: import_zod68.z.boolean().optional().describe("Set true only to add a belief key that is absent from the belief owner's Belief State; omit for keys that already exist")
   })).optional().describe("Structured belief reports required when an agent-owned task completes; existing keys update the belief owner's table, and a brand-new key must be declared with isNew: true"),
-  content: import_zod71.z.string().optional().describe("Markdown content required for add_activity"),
-  summary: import_zod71.z.string().optional().describe("Brief summary of the operation"),
-  executionResultId: import_zod71.z.string().refine(import_protocols34.isExecutionResultEventKey, {
+  content: import_zod68.z.string().optional().describe("Markdown content required for add_activity"),
+  summary: import_zod68.z.string().optional().describe("Brief summary of the operation"),
+  executionResultId: import_zod68.z.string().refine(import_protocols33.isExecutionResultEventKey, {
     message: "executionResultId must be the execution-result:<threadId> event key returned by task()"
   }).optional().describe(
     "Canonical ASCII `execution-result:<suffix>` event key returned by task(); the nonempty suffix allows only A-Z, a-z, 0-9, period, underscore, colon, and hyphen, and is not a database row ID"
   ),
-  ids: import_zod71.z.array(import_zod71.z.string().trim().min(1)).optional().describe("Task IDs to delete in one batch (delete action only). Use with or instead of id.")
+  ids: import_zod68.z.array(import_zod68.z.string().trim().min(1)).optional().describe("Task IDs to delete in one batch (delete action only). Use with or instead of id.")
 }).superRefine((input, context) => {
   if (input.executionResultId && input.action !== "update" && input.action !== "set_status" && input.action !== "add_activity") {
     context.addIssue({
-      code: import_zod71.z.ZodIssueCode.custom,
+      code: import_zod68.z.ZodIssueCode.custom,
       path: ["executionResultId"],
       message: "executionResultId is valid only for update, set_status, or add_activity"
     });
   }
   if (input.metadataFilter && input.action !== "list") {
     context.addIssue({
-      code: import_zod71.z.ZodIssueCode.custom,
+      code: import_zod68.z.ZodIssueCode.custom,
       path: ["metadataFilter"],
       message: "metadataFilter is valid only for list"
     });
   }
   if (input.ids && input.action !== "delete") {
     context.addIssue({
-      code: import_zod71.z.ZodIssueCode.custom,
+      code: import_zod68.z.ZodIssueCode.custom,
       path: ["ids"],
       message: "ids is valid only for delete"
     });
   }
 });
-var startTaskSchema = import_zod71.z.object({
-  taskId: import_zod71.z.string().trim().min(1).describe("ID of the persisted TaskItem to start"),
-  agentId: import_zod71.z.string().trim().min(1).describe(
+var startTaskSchema = import_zod68.z.object({
+  taskId: import_zod68.z.string().trim().min(1).describe("ID of the persisted TaskItem to start"),
+  agentId: import_zod68.z.string().trim().min(1).describe(
     `ID of the Agent that should execute the task. Use "general-purpose" to run the caller's own capabilities as an isolated worker.`
   )
 });
@@ -45235,7 +43759,7 @@ async function getPendingExecutionResultIds(store, tenantId2, taskId) {
         order: "desc",
         limit: PENDING_EXECUTION_RESULT_LIMIT + 1
       });
-      const canonicalCandidates = candidates.slice(0, PENDING_EXECUTION_RESULT_LIMIT + 1).filter((item) => (0, import_protocols34.isExecutionResultEventKey)(item.eventKey));
+      const canonicalCandidates = candidates.slice(0, PENDING_EXECUTION_RESULT_LIMIT + 1).filter((item) => (0, import_protocols33.isExecutionResultEventKey)(item.eventKey));
       const reconciliationRows = new Array(canonicalCandidates.length);
       let nextCandidateIndex = 0;
       let firstError;
@@ -45323,7 +43847,7 @@ function createTaskMiddleware(options = {}) {
     const workspaceId = trustedScope?.workspaceId ?? rc.workspaceId;
     const projectId = trustedScope?.projectId ?? rc.projectId;
     const revalidateCaller = async () => {
-      if (!trustedProject) return void 0;
+      if (!trustedProject || trustedRosterExempt(trustedProject)) return void 0;
       try {
         await createProjectTaskOwnerPolicy().requireCaller(trustedRosterScope(trustedProject));
       } catch (error) {
@@ -45331,7 +43855,7 @@ function createTaskMiddleware(options = {}) {
       }
       return void 0;
     };
-    if (trustedProject) {
+    if (trustedProject && !trustedRosterExempt(trustedProject)) {
       try {
         await createProjectTaskOwnerPolicy().requireCaller(trustedRosterScope(trustedProject));
       } catch (error) {
@@ -45364,10 +43888,12 @@ function createTaskMiddleware(options = {}) {
       if (trustedProject) {
         const snapshot = taskMutationSnapshot(existing);
         if (!snapshot) return trustedContextError();
-        try {
-          await createProjectTaskOwnerPolicy().requireCaller(trustedRosterScope(trustedProject));
-        } catch (error) {
-          return projectPolicyError(error);
+        if (!trustedRosterExempt(trustedProject)) {
+          try {
+            await createProjectTaskOwnerPolicy().requireCaller(trustedRosterScope(trustedProject));
+          } catch (error) {
+            return projectPolicyError(error);
+          }
         }
         deleted = await store.deleteIfSnapshot(tenantId2, id, snapshot);
       } else {
@@ -45420,13 +43946,15 @@ function createTaskMiddleware(options = {}) {
               "Target Project task owner is not active in the exact roster."
             ));
           }
-          try {
-            await requireTrustedOwner(trustedProject, ownerId);
-          } catch (error) {
-            return projectPolicyError(error instanceof ProjectTaskOwnerPolicyError ? error : new ProjectTaskOwnerPolicyError(
-              "PROJECT_TASK_OWNER_INACTIVE",
-              "Target Project task owner is not active in the exact roster."
-            ));
+          if (!trustedRosterExempt(trustedProject)) {
+            try {
+              await requireTrustedOwner(trustedProject, ownerId);
+            } catch (error) {
+              return projectPolicyError(error instanceof ProjectTaskOwnerPolicyError ? error : new ProjectTaskOwnerPolicyError(
+                "PROJECT_TASK_OWNER_INACTIVE",
+                "Target Project task owner is not active in the exact roster."
+              ));
+            }
           }
         }
         if (effectiveOwnerType === "agent" && (input.result !== void 0 || input.failureReason !== void 0)) {
@@ -45474,10 +44002,12 @@ function createTaskMiddleware(options = {}) {
             )) return trustedContextError("Parent or dependency task changed before creation.");
             const callerError = await revalidateCaller();
             if (callerError) return callerError;
-            try {
-              await requireTrustedOwner(trustedProject, ownerId);
-            } catch (error) {
-              return projectPolicyError(error);
+            if (!trustedRosterExempt(trustedProject)) {
+              try {
+                await requireTrustedOwner(trustedProject, ownerId);
+              } catch (error) {
+                return projectPolicyError(error);
+              }
             }
           }
           return store.create({
@@ -45735,18 +44265,6 @@ function createTaskMiddleware(options = {}) {
             return trustedFailure;
           }
         }
-        if (trustedProject && input.dependencyTaskIds !== void 0) {
-          const interruption = input.context?.interruption;
-          const interruptionType2 = interruption && typeof interruption === "object" ? interruption.type : void 0;
-          if (input.status !== "interrupted" || interruptionType2 !== "external_dependency") {
-            taskUpdateBlocked(input.id, "INVALID_EXTERNAL_DEPENDENCY", {});
-            return JSON.stringify({
-              success: false,
-              code: "INVALID_EXTERNAL_DEPENDENCY",
-              error: "dependencyTaskIds are only valid for external dependency interruptions."
-            });
-          }
-        }
         if (trustedProject && (input.ownerType !== void 0 && input.ownerType !== existing.ownerType || input.ownerId !== void 0 && input.ownerId !== existing.ownerId)) {
           taskUpdateBlocked(input.id, "TASK_OWNERSHIP_VIA_DISPATCH_REQUIRED", {
             inputOwnerType: input.ownerType,
@@ -45877,8 +44395,8 @@ function createTaskMiddleware(options = {}) {
         let reconciliationMetadata = {};
         let descriptionMutated = false;
         if (isAgentTask && input.description !== void 0 && !valuesEqual(input.description, existing.description)) {
-          const oldBelief = (0, import_protocols34.parseTaskBeliefState)(existing.description ?? "");
-          const newBelief = (0, import_protocols34.parseTaskBeliefState)(input.description);
+          const oldBelief = (0, import_protocols33.parseTaskBeliefState)(existing.description ?? "");
+          const newBelief = (0, import_protocols33.parseTaskBeliefState)(input.description);
           const hasBeliefState = oldBelief.success || newBelief.success;
           if (hasBeliefState) {
             await validateExecutionResult();
@@ -45938,7 +44456,7 @@ function createTaskMiddleware(options = {}) {
             return trustedContextError("Parent or dependency task changed before update.");
           }
         }
-        if (trustedProject) {
+        if (trustedProject && !trustedRosterExempt(trustedProject)) {
           try {
             await createProjectTaskOwnerPolicy().requireCaller(trustedRosterScope(trustedProject));
           } catch (error) {
@@ -45978,7 +44496,7 @@ function createTaskMiddleware(options = {}) {
         const workItemSummary = input.summary;
         let activityWarnings;
         try {
-          if (trustedProject) {
+          if (trustedProject && !trustedRosterExempt(trustedProject)) {
             try {
               await createProjectTaskOwnerPolicy().requireCaller(trustedRosterScope(trustedProject));
             } catch (error) {
@@ -46063,18 +44581,6 @@ function createTaskMiddleware(options = {}) {
             return trustedFailure;
           }
         }
-        if (trustedProject && input.dependencyTaskIds !== void 0) {
-          const interruption = input.context?.interruption;
-          const interruptionType2 = interruption && typeof interruption === "object" ? interruption.type : void 0;
-          if (input.status !== "interrupted" || interruptionType2 !== "external_dependency") {
-            taskUpdateBlocked(input.id, "INVALID_EXTERNAL_DEPENDENCY", {});
-            return JSON.stringify({
-              success: false,
-              code: "INVALID_EXTERNAL_DEPENDENCY",
-              error: "dependencyTaskIds are only valid for external dependency interruptions."
-            });
-          }
-        }
         if (trustedProject && (input.ownerType !== void 0 && input.ownerType !== existing.ownerType || input.ownerId !== void 0 && input.ownerId !== existing.ownerId)) {
           taskUpdateBlocked(input.id, "TASK_OWNERSHIP_VIA_DISPATCH_REQUIRED", {});
           return JSON.stringify({
@@ -46156,11 +44662,11 @@ function createTaskMiddleware(options = {}) {
           const interruption = input.context?.interruption;
           const explicitType = interruption && typeof interruption === "object" ? interruption.type : void 0;
           const type = explicitType ?? "missing_input";
-          if (type !== "missing_input" && type !== "external_dependency" && type !== "user_decision") {
+          if (type !== "missing_input" && type !== "user_decision") {
             return JSON.stringify({
               success: false,
               code: "INVALID_INTERRUPTION_TYPE",
-              error: "Agent interruption type must be missing_input, external_dependency, or user_decision."
+              error: "Agent interruption type must be missing_input or user_decision."
             });
           }
           await validateExecutionResult();
@@ -46172,8 +44678,7 @@ function createTaskMiddleware(options = {}) {
             type,
             summary: input.summary ?? "",
             actor,
-            threadId: statusThreadId,
-            dependencyTaskIds: input.dependencyTaskIds
+            threadId: statusThreadId
           });
           return lifecycleMutationResponse(interrupted);
         }
@@ -46576,12 +45081,12 @@ function createTaskMiddleware(options = {}) {
       ...trustedCaller ? { callerMembershipId: trustedCaller.membershipId, callerAssistantId: trustedCaller.assistantId } : {}
     }));
   };
-  return (0, import_langchain87.createMiddleware)({
+  return (0, import_langchain83.createMiddleware)({
     name: "TaskMiddleware",
     contextSchema,
     // Persisted between invocations (ADRs: the run↔task binding survives turns).
-    stateSchema: import_zod71.z.object({
-      taskId: import_zod71.z.string().default("")
+    stateSchema: import_zod68.z.object({
+      taskId: import_zod68.z.string().default("")
     }),
     // CLAIM: a run that holds a task moves it to in_progress (idempotent).
     beforeAgent: async (state, runtime) => {
@@ -46691,7 +45196,7 @@ ${TASK_CONVERGENCE_GUIDANCE}
       });
     },
     tools: [
-      (0, import_langchain87.tool)(
+      (0, import_langchain83.tool)(
         handleManageTask,
         {
           name: "manage_task",
@@ -46737,7 +45242,7 @@ to an expert \u2014 never re-dispatch the task you are processing.`,
           schema: manageTaskSchema
         }
       ),
-      (0, import_langchain87.tool)(handleStartTask, {
+      (0, import_langchain83.tool)(handleStartTask, {
         name: "task",
         description: `Start a persisted TaskItem with any existing Agent in a fresh isolated thread. Use this to delegate work \u2014 dispatch a subtask you created to the agent that should execute it; never re-dispatch the task you are currently processing (give the expert a child task instead). Pass agentId "general-purpose" for the general-purpose worker \u2014 ${DEFAULT_GENERAL_PURPOSE_DESCRIPTION} It has access to all the caller's tools, model, and middleware, so use it for general-purpose subtasks, to isolate context and token usage, and whenever no specialized agent fits. The target does NOT need task-management tools: it runs and returns an observation plus an executionResultId, and the caller passes that executionResultId to the manage_task update or add_activity that interprets and records it. A project task instead returns a managed result (success:true, managed:true) because the project-lifecycle queue owns execution.`,
         schema: startTaskSchema
@@ -46881,8 +45386,7 @@ canonical Belief State:
 };
 
 // src/middlewares/documentLearningMiddleware.ts
-var import_protocols35 = require("@axiom-lattice/protocols");
-var import_langchain88 = require("langchain");
+var import_langchain84 = require("langchain");
 
 // src/middlewares/documentLearningSkills.ts
 var LEARN_CAPABILITY_SKILL = `---
@@ -47121,20 +45625,11 @@ patterns discovered, recommendations. Include validation coverage: user-sample N
 `;
 
 // src/middlewares/documentLearningMiddleware.ts
-var createDocumentLearningMiddleware = () => (0, import_langchain88.createMiddleware)({
+var createDocumentLearningMiddleware = () => (0, import_langchain84.createMiddleware)({
   name: "DocumentLearningMiddleware",
   contextSchema,
   tools: []
 });
-var DOCUMENT_LEARNER_SYSTEM_PROMPT = `You are a capability learning specialist.
-
-CRITICAL FIRST ACTION \u2014 before any response about the task:
-1. Call the \`skill\` tool with skill_name: "agent-architecture" to load the
-authoritative Charter.
-2. Call the \`skill\` tool with skill_name: "document-learning-learn-capability" to
-load the source-to-capability workflow.
-Never announce that you will follow a skill. Load both in this order and follow
-their content. If either load fails, retry it once, then report the failure.`;
 var documentLearningPlugin = {
   meta: {
     type: "document-learning",
@@ -47143,92 +45638,6 @@ var documentLearningPlugin = {
     description: "\u4ECE\u6587\u6863\u4E2D\u5B66\u4E60\u77E5\u8BC6\uFF0C\u81EA\u52A8\u6784\u5EFA\u6280\u80FD\u4F53\u7CFB\u548C\u8BC4\u6D4B\u3002 Learn knowledge from documents and build structured skill systems with evaluations.",
     recommends: ["skill", "eval"]
   },
-  agents: {
-    "document-learner": {
-      key: "document-learner",
-      name: "Document Learning Agent",
-      description: "Read documents and build structured skill systems with evaluations. Use this agent when you need to extract knowledge from documents and turn it into reusable, testable agent skills.",
-      type: import_protocols35.AgentType.DEEP_AGENT,
-      prompt: DOCUMENT_LEARNER_SYSTEM_PROMPT,
-      subAgents: ["document-parser-benchmark"],
-      tools: [
-        "invoke_agent",
-        "list_agents",
-        "create_agent",
-        "update_agent",
-        "delete_agent",
-        "get_agent",
-        "list_tools",
-        "list_middleware_types"
-      ],
-      middleware: [
-        {
-          id: "skill",
-          type: "skill",
-          name: "Skill",
-          description: "Skill creation and loading",
-          enabled: true,
-          config: { readAll: true }
-        },
-        {
-          id: "document-learning",
-          type: "document-learning",
-          name: "Document Learning",
-          description: "Source-to-capability learning workflow",
-          enabled: true,
-          config: {}
-        },
-        {
-          id: "eval",
-          type: "eval",
-          name: "Eval",
-          description: "Evaluation design and execution",
-          enabled: true,
-          config: {}
-        },
-        {
-          id: "task",
-          type: "task",
-          name: "Task",
-          description: "Training process tracking with approval gates",
-          enabled: true,
-          config: {}
-        },
-        {
-          id: "widget",
-          type: "widget",
-          name: "Widget",
-          description: "Visualize benchmark results and eval dashboards",
-          enabled: true,
-          config: {}
-        },
-        {
-          id: "ask_user_to_clarify",
-          type: "ask_user_to_clarify",
-          name: "Ask User",
-          description: "Wait for user input at approval gates",
-          enabled: true,
-          config: {}
-        },
-        {
-          id: "filesystem",
-          type: "filesystem",
-          name: "Filesystem",
-          description: "Read documents, write skill files",
-          enabled: true,
-          config: {}
-        },
-        {
-          id: "document-parser",
-          type: "document-parser",
-          name: "Document Parser",
-          description: "Parse documents with the chosen engine",
-          enabled: true,
-          config: { connectAll: true }
-        }
-      ]
-    }
-  },
   skills: {
     "document-learning-learn-capability": {
       version: "1.0.0",
@@ -47239,12 +45648,12 @@ var documentLearningPlugin = {
 };
 
 // src/middlewares/documentParserMiddleware.ts
-var import_langchain90 = require("langchain");
+var import_langchain86 = require("langchain");
 
 // src/tool_lattice/document_parser/index.ts
 var path7 = __toESM(require("path"));
-var import_zod72 = __toESM(require("zod"));
-var import_langchain89 = require("langchain");
+var import_zod69 = __toESM(require("zod"));
+var import_langchain85 = require("langchain");
 var PARSE_DOCUMENT_DESCRIPTION = `Parse a document file (docx, pdf) into structured Markdown using a remote document parsing service.
 This tool handles the full pipeline internally: file upload \u2192 document parsing \u2192 polling until complete \u2192 download result \u2192 save to filesystem.
 
@@ -47367,7 +45776,7 @@ function createParseDocumentTool({
   baseUrl = "",
   apiKey = ""
 }) {
-  return (0, import_langchain89.tool)(
+  return (0, import_langchain85.tool)(
     async (input, exe_config) => {
       try {
         const runConfig = exe_config?.configurable?.runConfig ?? { assistant_id: "", thread_id: "" };
@@ -47438,17 +45847,17 @@ function createParseDocumentTool({
     {
       name: "parse_document",
       description: PARSE_DOCUMENT_DESCRIPTION,
-      schema: import_zod72.default.object({
-        file_path: import_zod72.default.string().describe(
+      schema: import_zod69.default.object({
+        file_path: import_zod69.default.string().describe(
           'Absolute path to the document file. Must point to an existing .docx or .pdf file. Example: "/project/reports/contract.docx". The file must be accessible from the current workspace.'
         ),
-        engine: import_zod72.default.string().describe(
+        engine: import_zod69.default.string().describe(
           'Parsing engine to use. Available options: "textin" (recommended, works with local files, supports docx/pdf), "datalab" (alternative engine for docx/pdf), "mineru" (requires public URL, use only if textin/datalab fail), "paddleocr_remote" (PaddleOCR, good for scanned documents), "qwen_ocr" (OCR-focused, best for image-heavy PDFs).'
         ),
-        output_path: import_zod72.default.string().optional().describe(
+        output_path: import_zod69.default.string().optional().describe(
           'Path to save the parsed result. If not specified, the input extension is replaced with .md. Example: "/project/report.docx" becomes "/project/report.md". Parent directories are created automatically.'
         ),
-        output_format: import_zod72.default.enum(["markdown", "json"]).optional().default("markdown").describe(
+        output_format: import_zod69.default.enum(["markdown", "json"]).optional().default("markdown").describe(
           'Output format. "markdown": structured Markdown with tables, headers, formatting preserved (recommended). "json": raw JSON output from the parsing engine (for programmatic use).'
         )
       })
@@ -47457,7 +45866,7 @@ function createParseDocumentTool({
 }
 
 // src/middlewares/documentParserMiddleware.ts
-var import_protocols36 = require("@axiom-lattice/protocols");
+var import_protocols34 = require("@axiom-lattice/protocols");
 
 // src/middlewares/documentBenchmarkWorkflow.ts
 var DOCUMENT_PARSER_BENCHMARK_YAML = `name: document-parser-benchmark
@@ -47866,7 +46275,7 @@ def main() -> None:
 if __name__ == "__main__":
     main()
 `;
-var resources2 = {
+var resources = {
   "references/api_reference.md": { mimeType: "text/markdown", content: `# API reference
 
 The supported command-line form is 'markitdown input -o output.md'. The Python API uses 'MarkItDown().convert(path)' upstream, but this runtime prefers the installed CLI and does not provide direct Python SDK LLM calls. Use local conversion for local files and keep output as Markdown.` },
@@ -47895,7 +46304,7 @@ Single file: 'markitdown input -o output.md'. Ordinary directory: 'scripts/batch
 var DOCUMENT_PARSER_MARKITDOWN_SKILL = {
   version: "1.1.0",
   content: MARKITDOWN_SKILL_CONTENT,
-  resources: resources2
+  resources
 };
 
 // src/middlewares/documentParserMiddleware.ts
@@ -47904,12 +46313,29 @@ function createDocumentParserMiddleware(config) {
   const baseUrl = config.baseUrl || "";
   const apiKey = config.apiKey || "";
   const connections = Array.isArray(config.connections) ? config.connections.filter((key5) => typeof key5 === "string") : [];
-  return (0, import_langchain90.createMiddleware)({
+  return (0, import_langchain86.createMiddleware)({
     name: "DocumentParser",
     contextSchema,
     tools: [createParseDocumentTool({ connectAll, connections, baseUrl, apiKey })]
   });
 }
+var DOCUMENT_PARSER_SYSTEM_PROMPT = `You are the Document Parser. Turn documents (pdf, docx, images, spreadsheets, and similar) into clean Markdown.
+
+CRITICAL FIRST ACTION: call the \`skill\` tool with skill_name: "document-parser-markitdown" and follow it. Never announce skill loads.
+
+DEFAULT \u2014 local MarkItDown:
+- Single file: run \`markitdown <input> -o <output.md>\` via shell.
+- Batch or literature collections: use the scripts bundled in the skill.
+- After converting, verify the output is non-empty and its structure/tables are intact, then report the exact input -> output paths.
+
+ESCALATION \u2014 remote parse_document:
+- Call parse_document only when local conversion fails, the format is unsupported, the output is empty or materially incomplete, the structure is badly damaged, OCR quality is inadequate, or the user explicitly asks for professional parsing.
+- When the user is unsatisfied with quality, use ask_user_to_clarify to ask whether to switch to a remote engine, and recommend one engine based on the observed file features and the user's feedback. If the user names an engine, use it.
+
+BENCHMARK:
+- Only when the user explicitly asks to compare engines. Confirm with ask_user_to_clarify first, then delegate to the document-parser-benchmark subagent. Never benchmark by default.
+
+Report only what you actually produced; never claim success without inspecting the output file.`;
 var documentParserPlugin = {
   meta: {
     type: "document-parser",
@@ -47980,9 +46406,59 @@ var documentParserPlugin = {
   },
   middleware: (config) => createDocumentParserMiddleware(config),
   agents: {
+    "document-parser": {
+      key: "document-parser",
+      type: import_protocols34.AgentType.DEEP_AGENT,
+      name: "Document Parser",
+      description: "Parse documents (pdf, docx, images, spreadsheets) into clean Markdown. Defaults to local MarkItDown; escalates to remote engines only when quality or format needs it; runs engine benchmarking only on explicit request.",
+      prompt: DOCUMENT_PARSER_SYSTEM_PROMPT,
+      subAgents: ["document-parser-benchmark"],
+      middleware: [
+        {
+          id: "skill",
+          type: "skill",
+          name: "Skill",
+          description: "Load the local MarkItDown parsing procedure",
+          enabled: true,
+          config: { readAll: true }
+        },
+        {
+          id: "filesystem",
+          type: "filesystem",
+          name: "Filesystem",
+          description: "Read source documents and write Markdown output",
+          enabled: true,
+          config: { vmIsolation: "project" }
+        },
+        {
+          id: "code_eval",
+          type: "code_eval",
+          name: "Code Runner",
+          description: "Run the markitdown CLI and bundled conversion scripts",
+          enabled: true,
+          config: { vmIsolation: "project" }
+        },
+        {
+          id: "document-parser",
+          type: "document-parser",
+          name: "Document Parser",
+          description: "Remote parse_document fallback for hard documents",
+          enabled: true,
+          config: { connectAll: true }
+        },
+        {
+          id: "ask_user_to_clarify",
+          type: "ask_user_to_clarify",
+          name: "Ask User",
+          description: "Confirm engine switches and benchmark runs",
+          enabled: true,
+          config: {}
+        }
+      ]
+    },
     "document-parser-benchmark": {
       key: "document-parser-benchmark",
-      type: import_protocols36.AgentType.WORKFLOW,
+      type: import_protocols34.AgentType.WORKFLOW,
       name: "Document Parser Benchmark",
       description: "Benchmark document parsing engines. Parses a document with 5 engines in parallel, scores results, and produces a ranking report. Use this when you need to evaluate which parsing engine works best for a given document.",
       prompt: "Benchmark document parsing engines: parse with 5 engines, score, and rank results.",
@@ -48019,9 +46495,9 @@ var documentParserPlugin = {
 
 // src/middlewares/projectRoomMiddleware.ts
 var import_crypto10 = require("crypto");
-var import_protocols37 = require("@axiom-lattice/protocols");
-var import_langchain91 = require("langchain");
-var import_zod73 = require("zod");
+var import_protocols35 = require("@axiom-lattice/protocols");
+var import_langchain87 = require("langchain");
+var import_zod70 = require("zod");
 var PROJECT_ROOM_CONTEXT_REQUIRED = "PROJECT_ROOM_CONTEXT_REQUIRED";
 var PROJECT_ROOM_POST_FAILED = "PROJECT_ROOM_POST_FAILED";
 var PROJECT_ROOM_ROSTER_FAILED = "PROJECT_ROOM_ROSTER_FAILED";
@@ -48041,15 +46517,15 @@ var ROSTER_FAILED = JSON.stringify({
   error: PROJECT_ROOM_ROSTER_FAILED,
   message: PROJECT_ROOM_ROSTER_FAILED_MESSAGE
 });
-var postSchema = import_zod73.z.object({
-  text: import_zod73.z.string().trim().min(1).max(2e4)
+var postSchema = import_zod70.z.object({
+  text: import_zod70.z.string().trim().min(1).max(2e4)
 }).strict();
-var listSchema = import_zod73.z.object({}).strict();
+var listSchema = import_zod70.z.object({}).strict();
 function ownDataValue2(record, key5) {
   if (typeof record !== "object" || record === null || Array.isArray(record)) return void 0;
   try {
     const descriptor = Object.getOwnPropertyDescriptor(record, key5);
-    return (0, import_protocols37.descriptorDataValue)(descriptor)?.value;
+    return (0, import_protocols35.descriptorDataValue)(descriptor)?.value;
   } catch {
     return void 0;
   }
@@ -48059,14 +46535,14 @@ function readTrustedRoomScope(config) {
   const runConfig = ownDataValue2(configurable, "runConfig");
   const projectRoom = ownDataValue2(runConfig, "projectRoom");
   try {
-    return (0, import_protocols37.parseTrustedRunContext)({ projectRoom }).projectRoom;
+    return (0, import_protocols35.parseTrustedRunContext)({ projectRoom }).projectRoom;
   } catch {
     return void 0;
   }
 }
 function exactValues2(value, required, optional = []) {
   try {
-    return (0, import_protocols37.snapshotExactRecord)(value, required, optional);
+    return (0, import_protocols35.snapshotExactRecord)(value, required, optional);
   } catch {
     return void 0;
   }
@@ -48102,7 +46578,7 @@ function snapshotMembership3(value) {
   return { ...values, joinedAt, updatedAt };
 }
 function snapshotRows(value) {
-  return (0, import_protocols37.snapshotExactArray)(value) ?? [];
+  return (0, import_protocols35.snapshotExactArray)(value) ?? [];
 }
 async function hasActiveCurrentMembership(scope) {
   const memberships = getStoreLattice("default", "projectBotMembership").store;
@@ -48111,10 +46587,10 @@ async function hasActiveCurrentMembership(scope) {
   return true;
 }
 function createProjectRoomMiddleware() {
-  return (0, import_langchain91.createMiddleware)({
+  return (0, import_langchain87.createMiddleware)({
     name: "ProjectRoomMiddleware",
     tools: [
-      (0, import_langchain91.tool)(async (input, config) => {
+      (0, import_langchain87.tool)(async (input, config) => {
         const { text } = input;
         const scope = readTrustedRoomScope(config);
         if (!scope) return CONTEXT_REQUIRED;
@@ -48145,7 +46621,7 @@ function createProjectRoomMiddleware() {
         description: "Post a text reply to the current trusted Project Room message",
         schema: postSchema
       }),
-      (0, import_langchain91.tool)(async (_input, config) => {
+      (0, import_langchain87.tool)(async (_input, config) => {
         const scope = readTrustedRoomScope(config);
         if (!scope) return CONTEXT_REQUIRED;
         try {
@@ -48187,9 +46663,9 @@ var projectRoomPlugin = {
 };
 
 // src/middlewares/sandboxPluginsMiddleware.ts
-var import_langchain92 = require("langchain");
-var import_zod74 = require("zod");
-var import_protocols38 = require("@axiom-lattice/protocols");
+var import_langchain88 = require("langchain");
+var import_zod71 = require("zod");
+var import_protocols36 = require("@axiom-lattice/protocols");
 
 // src/middlewares/sandboxPluginsSkills.ts
 var PLUGIN_JSON_TEMPLATE = `{
@@ -48910,16 +47386,16 @@ function tenantIdFrom(exeConfig) {
   const c = exeConfig;
   return c?.configurable?.runConfig?.tenantId ?? "default";
 }
-var managePluginSchema = import_zod74.z.object({
-  action: import_zod74.z.enum(["list", "get", "validate", "create", "update", "delete", "reload", "test"]),
-  type: import_zod74.z.string().optional(),
-  manifest: import_zod74.z.record(import_zod74.z.unknown()).optional(),
-  handlers: import_zod74.z.record(import_zod74.z.string()).optional(),
-  target: import_zod74.z.object({
-    kind: import_zod74.z.enum(["tool", "connection-test", "connection-discover"]),
-    name: import_zod74.z.string().optional(),
-    input: import_zod74.z.unknown().optional(),
-    connectionKey: import_zod74.z.string().optional()
+var managePluginSchema = import_zod71.z.object({
+  action: import_zod71.z.enum(["list", "get", "validate", "create", "update", "delete", "reload", "test"]),
+  type: import_zod71.z.string().optional(),
+  manifest: import_zod71.z.record(import_zod71.z.unknown()).optional(),
+  handlers: import_zod71.z.record(import_zod71.z.string()).optional(),
+  target: import_zod71.z.object({
+    kind: import_zod71.z.enum(["tool", "connection-test", "connection-discover"]),
+    name: import_zod71.z.string().optional(),
+    input: import_zod71.z.unknown().optional(),
+    connectionKey: import_zod71.z.string().optional()
   }).optional()
 });
 var sandboxPluginsPlugin = {
@@ -48939,7 +47415,7 @@ var sandboxPluginsPlugin = {
       key: "plugin-builder",
       name: "Plugin Builder",
       description: "Author and manage tenant plugins in the shared sandbox: clarify goal, inputs/outputs, credentials, and whether a UI is needed; then write the manifest and JS handlers, add an optional HTML MCP App UI, and validate/test with the manage_plugin tool.",
-      type: import_protocols38.AgentType.DEEP_AGENT,
+      type: import_protocols36.AgentType.DEEP_AGENT,
       prompt: PLUGIN_BUILDER_PROMPT,
       middleware: [
         {
@@ -48993,10 +47469,10 @@ var sandboxPluginsPlugin = {
       ]
     }
   },
-  middleware: () => (0, import_langchain92.createMiddleware)({
+  middleware: () => (0, import_langchain88.createMiddleware)({
     name: "SandboxPluginsMiddleware",
     tools: [
-      (0, import_langchain92.tool)(
+      (0, import_langchain88.tool)(
         async (input, exeConfig) => {
           const tenantId2 = tenantIdFrom(exeConfig);
           const catalog2 = getSandboxPluginCatalog();
@@ -49137,7 +47613,6 @@ var BUILTIN_PLUGINS = [
   sqlPlugin,
   skillPlugin,
   metricsPlugin,
-  semanticMetricsPlugin,
   askUserClarifyPlugin,
   widgetPlugin,
   clawPlugin,
@@ -49777,7 +48252,6 @@ registerBuiltinPlugins();
   createSandboxProvider,
   createSandboxResolver,
   createSchedulerMiddleware,
-  createSemanticMetricsMiddleware,
   createSharePayload,
   createTaskExecutionService,
   createTaskLifecycleService,
@@ -49861,6 +48335,7 @@ registerBuiltinPlugins();
   invokeWithRetry,
   isBuiltInSkill,
   isDirectRoom,
+  isMcpConnectionError,
   isPluginSkillAuthorizedInSandbox,
   isPluginSkillManagedInSandbox,
   isUsingDefaultKey,
@@ -49883,7 +48358,6 @@ registerBuiltinPlugins();
   parallelLimit,
   parseCronExpression,
   parseDirectRoomType,
-  parseExternalDependency,
   parseJudgeVerdict,
   parsePackSize,
   parseQueuedExecutionMode,
@@ -49936,7 +48410,6 @@ registerBuiltinPlugins();
   sandboxLatticeManager,
   sanitizeToolCallId,
   scheduleLatticeManager,
-  semanticMetricsPlugin,
   serializePluginMeta,
   serializeTaskMutationSuccess,
   serializeTaskNormalizationFallback,