@axiom-lattice/gateway 10.3.0 → 11.0.0

package/dist/index.mjs

@@ -1,14 +1,11 @@
 import {
   invalidateAgentReflectionCache
-} from "./chunk-YR32MWEJ.mjs";
+} from "./chunk-JQWIJDZN.mjs";
 import {
   getContentTypeFromFilename,
   getFilenameFromPath,
   sendBufferWithRange
 } from "./chunk-EMYRCJOI.mjs";
-import {
-  createRecoveryCallerDeps
-} from "./chunk-NOXGKYUV.mjs";
 import {
   Logger,
   getQrCode,
@@ -47,11 +44,8 @@ import {
 } from "./chunk-P4JEGK74.mjs";
 import {
   buildPreviewTokenScript
-} from "./chunk-7CG57LEF.mjs";
+} from "./chunk-WKHTSTB6.mjs";
 import "./chunk-EXPERMZR.mjs";
-import {
-  CollectionService
-} from "./chunk-PWHUWFXL.mjs";
 import {
   A2A_KEY_CHANGED_TOPIC,
   ProjectAccessService,
@@ -60,19 +54,19 @@ import {
   publishA2AKeyChanged,
   refreshStoreKeyMap,
   setA2AProjectAccess
-} from "./chunk-NYYSBNDG.mjs";
+} from "./chunk-Q5ADRJ3T.mjs";
 import {
   A2AAuthService,
   parseEnvKeys
-} from "./chunk-LCM4OQTI.mjs";
+} from "./chunk-NQS3U4KP.mjs";
 import {
   getMcpUiResourceResolver,
   listTenantPlugins,
   registerMcpAppRoutes,
   resolveTenantPluginByType
-} from "./chunk-BIMO2ILH.mjs";
+} from "./chunk-5EXTBV2Z.mjs";
 import "./chunk-XUWD4VKY.mjs";
-import "./chunk-MFWTGNQR.mjs";
+import "./chunk-HBDRSIPK.mjs";
 import {
   createOrphanRecoveryRuntime,
   createTaskRunLiveness,
@@ -84,6 +78,9 @@ import {
   resolveTopCaller,
   runOrphanRecovery
 } from "./chunk-NZXKECNN.mjs";
+import {
+  createRecoveryCallerDeps
+} from "./chunk-NOXGKYUV.mjs";
 import "./chunk-NFEGQTCC.mjs";
 
 // src/index.ts
@@ -2368,6 +2365,7 @@ function rejectProtectedTenantScope(request, reply) {
 }
 async function rejectProtectedTenantScopeUnlessPlatformRoute(request, reply) {
   if (await allowsPlatformScopeRoute(request)) return false;
+  if (await allowsPlatformOpsMcpAppRequest(request)) return false;
   return rejectProtectedTenantScope(request, reply);
 }
 async function platformTenantPlaneGuard(request, reply) {
@@ -2389,6 +2387,41 @@ function isPlatformScopeRoutePath(path5) {
 async function allowsPlatformScopeRoute(request) {
   const path5 = (typeof request.url === "string" ? request.url : "").split("?", 1)[0];
   if (!path5 || !isPlatformScopeRoutePath(path5)) return false;
+  return hasLivePlatformRole(request);
+}
+var PLATFORM_OPS_MCP_APP_PATHS = /* @__PURE__ */ new Set([
+  "/api/mcp-apps/resource",
+  "/api/mcp-apps/rpc"
+]);
+var PLATFORM_OPS_PLUGIN_TYPE = "platform-ops";
+function readMcpAppRef(body) {
+  let parsed = body;
+  if (typeof parsed === "string") {
+    try {
+      parsed = JSON.parse(parsed);
+    } catch {
+      return void 0;
+    }
+  }
+  if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
+    return void 0;
+  }
+  const ref = parsed.ref;
+  if (ref === null || typeof ref !== "object" || Array.isArray(ref)) {
+    return void 0;
+  }
+  return ref;
+}
+async function allowsPlatformOpsMcpAppRequest(request) {
+  const path5 = (typeof request.url === "string" ? request.url : "").split("?", 1)[0];
+  if (!PLATFORM_OPS_MCP_APP_PATHS.has(path5)) return false;
+  const ref = readMcpAppRef(request.body);
+  if (!ref || ref.kind !== "plugin" || ref.pluginType !== PLATFORM_OPS_PLUGIN_TYPE) {
+    return false;
+  }
+  return hasLivePlatformRole(request);
+}
+async function hasLivePlatformRole(request) {
   const user = request.user;
   if (typeof user?.id !== "string" || user.tenantId !== PLATFORM_TENANT_ID) {
     return false;
@@ -2412,6 +2445,7 @@ async function platformTenantGlobalGuard(request, reply) {
     return;
   }
   if (await allowsPlatformScopeRoute(request)) return;
+  if (await allowsPlatformOpsMcpAppRequest(request)) return;
   rejectProtectedTenantScope(request, reply);
 }
 
@@ -9220,6 +9254,277 @@ async function filterSkillsByLicense(request, reply) {
   }
 }
 
+// src/services/collection_service.ts
+import { v4 as uuidv4 } from "uuid";
+import { Document } from "@langchain/core/documents";
+import {
+  collectionLatticeManager,
+  embeddingsLatticeManager,
+  getOrCreateCollectionVectorStore,
+  getCollectionEntryCount,
+  listCollectionEntries,
+  removeCollectionVectorStore,
+  deleteCollectionEntryIds
+} from "@axiom-lattice/core";
+
+// src/services/collection_entry_batch.ts
+import { COLLECTION_ENTRY_BATCH_MAX } from "@axiom-lattice/protocols";
+function isRecord8(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function validateCollectionEntryBatch(entries) {
+  if (!Array.isArray(entries) || entries.length < 1 || entries.length > COLLECTION_ENTRY_BATCH_MAX) {
+    return `entries must contain between 1 and ${COLLECTION_ENTRY_BATCH_MAX} items`;
+  }
+  if (entries.some(
+    (entry) => !isRecord8(entry) || typeof entry.content !== "string" || entry.content.trim() === ""
+  )) {
+    return "each entry requires non-empty content";
+  }
+  if (entries.some((entry) => entry.metadata !== void 0 && !isRecord8(entry.metadata))) {
+    return "entry metadata must be an object";
+  }
+  return null;
+}
+function validateCollectionEntryDeleteBatch(entryIds) {
+  if (!Array.isArray(entryIds) || entryIds.length < 1 || entryIds.length > COLLECTION_ENTRY_BATCH_MAX) {
+    return `entryIds must contain between 1 and ${COLLECTION_ENTRY_BATCH_MAX} items`;
+  }
+  if (entryIds.some(
+    (entryId) => typeof entryId !== "string" || entryId.trim() === ""
+  )) {
+    return "each entry id must be a non-empty string";
+  }
+  return null;
+}
+
+// src/services/collection_service.ts
+function getTenantId14(request) {
+  return request.user?.tenantId || request.headers["x-tenant-id"] || "default";
+}
+var CollectionService = class {
+  // ─── Collection CRUD ──────────────────────────────────────────
+  async getAllCollections(request) {
+    const tenantId = getTenantId14(request);
+    const collections = await collectionLatticeManager.getAllCollections(tenantId);
+    for (const c2 of collections) {
+      try {
+        c2._entryCount = await getCollectionEntryCount(c2.name, c2.embeddingKey, c2.tenantId);
+      } catch {
+        c2._entryCount = 0;
+      }
+    }
+    return collections;
+  }
+  async getCollectionByName(request, name) {
+    const tenantId = getTenantId14(request);
+    return collectionLatticeManager.getCollection(tenantId, name);
+  }
+  async createCollection(request, data) {
+    const tenantId = getTenantId14(request);
+    const collection = await collectionLatticeManager.registerCollection(tenantId, data);
+    try {
+      await getOrCreateCollectionVectorStore(data.name, data.embeddingKey, tenantId);
+    } catch (err) {
+      console.warn(`[CollectionService] Failed to init vector store for ${data.name}:`, err);
+    }
+    return collection;
+  }
+  async updateCollection(request, name, updates) {
+    const tenantId = getTenantId14(request);
+    return collectionLatticeManager.updateCollection(tenantId, name, updates);
+  }
+  async deleteCollection(request, name) {
+    const tenantId = getTenantId14(request);
+    const removed = await collectionLatticeManager.removeCollection(tenantId, name);
+    if (!removed) return false;
+    await removeCollectionVectorStore(name, tenantId);
+    return true;
+  }
+  // ─── Entry CRUD ───────────────────────────────────────────────
+  async getEntries(request, collectionName) {
+    const collection = await this.getCollectionByName(request, collectionName);
+    if (!collection) throw new Error(`Collection "${collectionName}" not found`);
+    const docs = await listCollectionEntries(collectionName, collection.embeddingKey, collection.tenantId);
+    return docs.map((doc) => ({
+      id: doc.metadata._id || "",
+      content: doc.pageContent,
+      metadata: Object.fromEntries(
+        Object.entries(doc.metadata).filter(([k]) => !k.startsWith("_"))
+      )
+    }));
+  }
+  async createEntry(request, collectionName, data) {
+    const collection = await this.getCollectionByName(request, collectionName);
+    if (!collection) throw new Error(`Collection "${collectionName}" not found`);
+    const vectorStore = await getOrCreateCollectionVectorStore(
+      collectionName,
+      collection.embeddingKey,
+      collection.tenantId
+    );
+    const entryId = uuidv4();
+    const now = (/* @__PURE__ */ new Date()).toISOString();
+    const doc = new Document({
+      pageContent: data.content,
+      metadata: {
+        ...data.metadata || {},
+        _id: entryId,
+        _created_at: now,
+        _updated_at: now
+      }
+    });
+    await vectorStore.addDocuments([doc]);
+    return {
+      id: entryId,
+      content: data.content,
+      metadata: Object.fromEntries(
+        Object.entries(data.metadata || {}).filter(([key]) => !key.startsWith("_"))
+      )
+    };
+  }
+  async createEntries(request, collectionName, data) {
+    const validationError = validateCollectionEntryBatch(data.entries);
+    if (validationError) throw new Error(validationError);
+    const collection = await this.getCollectionByName(request, collectionName);
+    if (!collection) throw new Error(`Collection "${collectionName}" not found`);
+    const vectorStore = await getOrCreateCollectionVectorStore(
+      collectionName,
+      collection.embeddingKey,
+      collection.tenantId
+    );
+    const documents = data.entries.map((entry) => {
+      const entryId = uuidv4();
+      return {
+        entry,
+        entryId,
+        document: new Document({
+          pageContent: entry.content,
+          metadata: {
+            ...entry.metadata || {},
+            _id: entryId,
+            _created_at: (/* @__PURE__ */ new Date()).toISOString()
+          }
+        })
+      };
+    });
+    await vectorStore.addDocuments(documents.map((item) => item.document));
+    return documents.map(({ entry, entryId }) => ({
+      id: entryId,
+      content: entry.content,
+      metadata: Object.fromEntries(
+        Object.entries(entry.metadata || {}).filter(([key]) => !key.startsWith("_"))
+      )
+    }));
+  }
+  async getEntry(request, collectionName, entryId) {
+    const collection = await this.getCollectionByName(request, collectionName);
+    if (!collection) throw new Error(`Collection "${collectionName}" not found`);
+    const docs = await listCollectionEntries(collectionName, collection.embeddingKey, collection.tenantId);
+    const doc = docs.find((d) => d.metadata._id === entryId);
+    if (!doc) return null;
+    return {
+      id: entryId,
+      content: doc.pageContent,
+      metadata: Object.fromEntries(
+        Object.entries(doc.metadata).filter(([k]) => !k.startsWith("_"))
+      )
+    };
+  }
+  async updateEntry(request, collectionName, entryId, data) {
+    const existing = await this.getEntry(request, collectionName, entryId);
+    if (!existing) return null;
+    const collection = await this.getCollectionByName(request, collectionName);
+    if (!collection) throw new Error(`Collection "${collectionName}" not found`);
+    const vectorStore = await getOrCreateCollectionVectorStore(
+      collectionName,
+      collection.embeddingKey,
+      collection.tenantId
+    );
+    await vectorStore.delete({ filter: { _id: entryId } });
+    const now = (/* @__PURE__ */ new Date()).toISOString();
+    const callerMetadata = Object.fromEntries(
+      Object.entries(data.metadata || {}).filter(([key]) => !key.startsWith("_"))
+    );
+    const mergedMetadata = { ...existing.metadata, ...callerMetadata };
+    const doc = new Document({
+      pageContent: data.content ?? existing.content,
+      metadata: { ...mergedMetadata, _id: entryId, _created_at: now, _updated_at: now }
+    });
+    try {
+      await vectorStore.addDocuments([doc]);
+    } catch (error) {
+      try {
+        await vectorStore.addDocuments([
+          new Document({
+            pageContent: existing.content,
+            metadata: { ...existing.metadata, _id: entryId, _updated_at: now }
+          })
+        ]);
+      } catch {
+      }
+      throw error;
+    }
+    return { id: entryId, content: data.content ?? existing.content, metadata: mergedMetadata };
+  }
+  async deleteEntry(request, collectionName, entryId) {
+    const collection = await this.getCollectionByName(request, collectionName);
+    if (!collection) throw new Error(`Collection "${collectionName}" not found`);
+    const vectorStore = await getOrCreateCollectionVectorStore(
+      collectionName,
+      collection.embeddingKey,
+      collection.tenantId
+    );
+    try {
+      await vectorStore.delete({ filter: { _id: entryId } });
+      return true;
+    } catch {
+      return false;
+    }
+  }
+  async deleteEntries(request, collectionName, data) {
+    const validationError = validateCollectionEntryDeleteBatch(data.entryIds);
+    if (validationError) throw new Error(validationError);
+    const collection = await this.getCollectionByName(request, collectionName);
+    if (!collection) throw new Error(`Collection "${collectionName}" not found`);
+    const vectorStore = await getOrCreateCollectionVectorStore(
+      collectionName,
+      collection.embeddingKey,
+      collection.tenantId
+    );
+    await deleteCollectionEntryIds(vectorStore, data.entryIds);
+    return data.entryIds.length;
+  }
+  async searchEntries(request, collectionName, params) {
+    const collection = await this.getCollectionByName(request, collectionName);
+    if (!collection) throw new Error(`Collection "${collectionName}" not found`);
+    const vectorStore = await getOrCreateCollectionVectorStore(
+      collectionName,
+      collection.embeddingKey,
+      collection.tenantId
+    );
+    let embeddings;
+    try {
+      embeddings = embeddingsLatticeManager.getEmbeddingsClient(collection.embeddingKey);
+    } catch {
+      embeddings = embeddingsLatticeManager.getEmbeddingsClient("default");
+    }
+    const queryVector = await embeddings.embedQuery(params.query);
+    const results = await vectorStore.similaritySearchVectorWithScore(
+      queryVector,
+      params.top_k || 5,
+      params.filter
+    );
+    return results.map(([doc, score]) => ({
+      id: doc.metadata._id || uuidv4(),
+      content: doc.pageContent,
+      metadata: Object.fromEntries(
+        Object.entries(doc.metadata).filter(([k]) => !k.startsWith("_"))
+      ),
+      score
+    }));
+  }
+};
+
 // src/controllers/collections.ts
 var collectionService = new CollectionService();
 function serializeCollection(collection) {
@@ -9341,10 +9646,10 @@ async function deleteCollection(request, reply) {
 }
 
 // src/controllers/embeddings.ts
-import { embeddingsLatticeManager } from "@axiom-lattice/core";
+import { embeddingsLatticeManager as embeddingsLatticeManager2 } from "@axiom-lattice/core";
 async function listEmbeddings(_request, _reply) {
   try {
-    const info = embeddingsLatticeManager.getAllEmbeddingsInfo();
+    const info = embeddingsLatticeManager2.getAllEmbeddingsInfo();
     return {
       success: true,
       message: "Successfully retrieved embedding models",
@@ -9401,6 +9706,37 @@ async function createEntry(request, reply) {
     });
   }
 }
+async function createEntries(request, reply) {
+  try {
+    const { name } = request.params;
+    const entries = request.body?.entries;
+    const validationError = validateCollectionEntryBatch(entries);
+    if (validationError) {
+      return reply.status(400).send({
+        success: false,
+        message: validationError
+      });
+    }
+    const created = await collectionService2.createEntries(
+      request,
+      name,
+      { entries }
+    );
+    return reply.status(201).send({
+      success: true,
+      message: "Successfully created entries",
+      data: { records: created, total: created.length }
+    });
+  } catch (error) {
+    if (error.message?.includes("not found")) {
+      return reply.status(404).send({ success: false, message: error.message });
+    }
+    return reply.status(500).send({
+      success: false,
+      message: `Failed to create entries: ${error.message}`
+    });
+  }
+}
 async function getEntry(request, reply) {
   try {
     const { name, id: id3 } = request.params;
@@ -9458,6 +9794,37 @@ async function deleteEntry(request, reply) {
     });
   }
 }
+async function deleteEntries(request, reply) {
+  try {
+    const { name } = request.params;
+    const entryIds = request.body?.entryIds;
+    const validationError = validateCollectionEntryDeleteBatch(entryIds);
+    if (validationError) {
+      return reply.status(400).send({
+        success: false,
+        message: validationError
+      });
+    }
+    const deleted = await collectionService2.deleteEntries(
+      request,
+      name,
+      { entryIds }
+    );
+    return {
+      success: true,
+      message: "Successfully deleted entries",
+      data: { processed: deleted }
+    };
+  } catch (error) {
+    if (error.message?.includes("not found")) {
+      return reply.status(404).send({ success: false, message: error.message });
+    }
+    return reply.status(500).send({
+      success: false,
+      message: `Failed to delete entries: ${error.message}`
+    });
+  }
+}
 async function searchEntries(request, reply) {
   try {
     const { name } = request.params;
@@ -9582,11 +9949,11 @@ import {
   getStoreLattice as getStoreLattice16,
   metricsServerManager
 } from "@axiom-lattice/core";
-function getTenantId14(request) {
+function getTenantId15(request) {
   return request.headers["x-tenant-id"] || "default";
 }
 async function executeDataQuery(request, reply) {
-  const tenantId = getTenantId14(request);
+  const tenantId = getTenantId15(request);
   const body = request.body;
   try {
     if (!body.serverKey && !body.datasourceId) {
@@ -9806,7 +10173,7 @@ function buildClarifySkipCommand(interruptId) {
 }
 
 // src/controllers/workflow-tracking.ts
-function getTenantId15(request) {
+function getTenantId16(request) {
   const userTenantId = request.user?.tenantId;
   if (userTenantId) return userTenantId;
   return request.headers["x-tenant-id"] || "default";
@@ -9820,7 +10187,7 @@ function getTrackingStore() {
   }
 }
 async function getAllWorkflowRuns(request, reply) {
-  const tenantId = getTenantId15(request);
+  const tenantId = getTenantId16(request);
   const { assistantId, status } = request.query;
   try {
     const store2 = getTrackingStore();
@@ -9874,7 +10241,7 @@ async function getAllWorkflowRuns(request, reply) {
 var INBOX_DEFAULT_PAGE_SIZE = 20;
 var INBOX_MAX_PAGE_SIZE = 100;
 async function getInboxItems(request, reply) {
-  const tenantId = getTenantId15(request);
+  const tenantId = getTenantId16(request);
   try {
     const store2 = getTrackingStore();
     if (!store2) {
@@ -9982,7 +10349,7 @@ async function getInboxItems(request, reply) {
 }
 async function getWorkflowRuns(request, reply) {
   const { threadId } = request.params;
-  const tenantId = getTenantId15(request);
+  const tenantId = getTenantId16(request);
   try {
     const store2 = getTrackingStore();
     if (!store2) {
@@ -10018,7 +10385,7 @@ async function getWorkflowRun(request, reply) {
 }
 async function deleteWorkflowRun(request, reply) {
   const { runId } = request.params;
-  const tenantId = getTenantId15(request);
+  const tenantId = getTenantId16(request);
   try {
     const store2 = getTrackingStore();
     if (!store2) {
@@ -10101,7 +10468,7 @@ async function getRunTasks(request, reply) {
 }
 async function replyInboxTask(request, reply) {
   const { runId, answers } = request.body;
-  const tenantId = getTenantId15(request);
+  const tenantId = getTenantId16(request);
   try {
     const store2 = getTrackingStore();
     if (!store2) {
@@ -10265,7 +10632,7 @@ async function requestWorkflowCancel(request, tenantId, run2) {
 async function abortWorkflowRun(request, reply) {
   try {
     const { runId } = request.params;
-    const tenantId = getTenantId15(request);
+    const tenantId = getTenantId16(request);
     const store2 = getTrackingStore();
     if (!store2) {
       return reply.status(404).send({
@@ -10318,7 +10685,7 @@ import { randomUUID as randomUUID12 } from "crypto";
 function getWorkspaceId2(request) {
   return request.headers["x-workspace-id"] || "default";
 }
-function getTenantId16(request) {
+function getTenantId17(request) {
   const userTenantId = request.user?.tenantId;
   if (userTenantId) return userTenantId;
   return request.headers["x-tenant-id"] || "default";
@@ -10351,7 +10718,7 @@ async function updateLinkMeta(userId, tenantId, meta) {
   await getLinkStore().updateLink(userId, tenantId, { metadata: meta });
 }
 async function createPersonalAssistant(request, reply) {
-  const tenantId = getTenantId16(request);
+  const tenantId = getTenantId17(request);
   const userId = getUserId6(request);
   const { name, personality } = request.body;
   if (!name || !personality) {
@@ -10426,7 +10793,7 @@ async function createPersonalAssistant(request, reply) {
   });
 }
 async function getPersonalAssistant(request, reply) {
-  const tenantId = getTenantId16(request);
+  const tenantId = getTenantId17(request);
   const userId = getUserId6(request);
   const store2 = getAssistantStore2();
   const assistant = await store2.getByOwner(tenantId, userId);
@@ -10443,7 +10810,7 @@ async function getPersonalAssistant(request, reply) {
   };
 }
 async function deletePersonalAssistant(request, reply) {
-  const tenantId = getTenantId16(request);
+  const tenantId = getTenantId17(request);
   const userId = getUserId6(request);
   const store2 = getAssistantStore2();
   const assistant = await store2.getByOwner(tenantId, userId);
@@ -11930,7 +12297,7 @@ import * as os2 from "os";
 import { getStoreLattice as getStoreLattice19 } from "@axiom-lattice/core";
 import { SandboxFilesystem, FilesystemBackend } from "@axiom-lattice/core";
 import { getSandBoxManager as getSandBoxManager3, resolveSandboxAgentsPathAlias as resolveSandboxAgentsPathAlias2 } from "@axiom-lattice/core";
-import { v4 as uuidv4 } from "uuid";
+import { v4 as uuidv42 } from "uuid";
 
 // src/services/collaboration/RoomCoordinatorProvisioner.ts
 import { roomCoordinatorConfig } from "@axiom-lattice/core";
@@ -12253,7 +12620,7 @@ var ProjectCollaborationInitializationError = class extends Error {
   }
 };
 function createProjectCollaborationInitializer(deps) {
-  const idFactory = deps.idFactory ?? uuidv4;
+  const idFactory = deps.idFactory ?? uuidv42;
   return {
     authorizeCreator: async ({ tenantId, userId }) => await deps.userTenantLinkStore.getLink(userId, tenantId) !== null,
     initialize: async ({ tenantId, userId, project }) => {
@@ -12400,7 +12767,7 @@ var WorkspaceController = class {
   async createWorkspace(request, reply) {
     const tenantId = this.getTenantId(request);
     const data = request.body;
-    const id3 = uuidv4();
+    const id3 = uuidv42();
     const workspace = await this.workspaceStore.createWorkspace(
       tenantId,
       id3,
@@ -12477,7 +12844,7 @@ var WorkspaceController = class {
     if (existing.length > 0) {
       return;
     }
-    await this.projectStore.createProject(tenantId, workspaceId, uuidv4(), {
+    await this.projectStore.createProject(tenantId, workspaceId, uuidv42(), {
       name: "Training",
       description: "Shared workspace for agent training",
       kind: "training"
@@ -12520,7 +12887,7 @@ var WorkspaceController = class {
         });
       }
     }
-    const id3 = uuidv4();
+    const id3 = uuidv42();
     const project = await this.projectStore.createProject(
       tenantId,
       workspaceId,
@@ -13377,7 +13744,7 @@ import {
   sqlDatabaseManager
 } from "@axiom-lattice/core";
 import { randomUUID as randomUUID15 } from "crypto";
-function getTenantId17(request) {
+function getTenantId18(request) {
   const userTenantId = request.user?.tenantId;
   if (userTenantId) {
     return userTenantId;
@@ -13385,7 +13752,7 @@ function getTenantId17(request) {
   return request.headers["x-tenant-id"] || "default";
 }
 async function getDatabaseConfigList(request, reply) {
-  const tenantId = getTenantId17(request);
+  const tenantId = getTenantId18(request);
   try {
     const storeLattice = getStoreLattice20("default", "database");
     const store2 = storeLattice.store;
@@ -13415,7 +13782,7 @@ async function getDatabaseConfigList(request, reply) {
   }
 }
 async function getDatabaseConfig(request, reply) {
-  const tenantId = getTenantId17(request);
+  const tenantId = getTenantId18(request);
   const { key } = request.params;
   try {
     const storeLattice = getStoreLattice20("default", "database");
@@ -13441,7 +13808,7 @@ async function getDatabaseConfig(request, reply) {
   }
 }
 async function createDatabaseConfig(request, reply) {
-  const tenantId = getTenantId17(request);
+  const tenantId = getTenantId18(request);
   const body = request.body;
   try {
     const storeLattice = getStoreLattice20("default", "database");
@@ -13476,7 +13843,7 @@ async function createDatabaseConfig(request, reply) {
   }
 }
 async function updateDatabaseConfig(request, reply) {
-  const tenantId = getTenantId17(request);
+  const tenantId = getTenantId18(request);
   const { key } = request.params;
   const updates = request.body;
   try {
@@ -13518,7 +13885,7 @@ async function updateDatabaseConfig(request, reply) {
   }
 }
 async function deleteDatabaseConfig(request, reply) {
-  const tenantId = getTenantId17(request);
+  const tenantId = getTenantId18(request);
   const { keyOrId } = request.params;
   try {
     const storeLattice = getStoreLattice20("default", "database");
@@ -13567,7 +13934,7 @@ async function deleteDatabaseConfig(request, reply) {
   }
 }
 async function testDatabaseConnection(request, reply) {
-  const tenantId = getTenantId17(request);
+  const tenantId = getTenantId18(request);
   const { key } = request.params;
   try {
     const storeLattice = getStoreLattice20("default", "database");
@@ -13660,7 +14027,7 @@ import {
   SemanticMetricsClient as SemanticMetricsClient2
 } from "@axiom-lattice/core";
 import { randomUUID as randomUUID16 } from "crypto";
-function getTenantId18(request) {
+function getTenantId19(request) {
   const userTenantId = request.user?.tenantId;
   if (userTenantId) {
     return userTenantId;
@@ -13668,7 +14035,7 @@ function getTenantId18(request) {
   return request.headers["x-tenant-id"] || "default";
 }
 async function getMetricsServerConfigList(request, reply) {
-  const tenantId = getTenantId18(request);
+  const tenantId = getTenantId19(request);
   try {
     const storeLattice = getStoreLattice21("default", "metrics");
     const store2 = storeLattice.store;
@@ -13694,7 +14061,7 @@ async function getMetricsServerConfigList(request, reply) {
   }
 }
 async function getMetricsServerConfig(request, reply) {
-  const tenantId = getTenantId18(request);
+  const tenantId = getTenantId19(request);
   const { key } = request.params;
   try {
     const storeLattice = getStoreLattice21("default", "metrics");
@@ -13720,7 +14087,7 @@ async function getMetricsServerConfig(request, reply) {
   }
 }
 async function createMetricsServerConfig(request, reply) {
-  const tenantId = getTenantId18(request);
+  const tenantId = getTenantId19(request);
   const body = request.body;
   try {
     const storeLattice = getStoreLattice21("default", "metrics");
@@ -13771,7 +14138,7 @@ async function createMetricsServerConfig(request, reply) {
   }
 }
 async function updateMetricsServerConfig(request, reply) {
-  const tenantId = getTenantId18(request);
+  const tenantId = getTenantId19(request);
   const { key } = request.params;
   const updates = request.body;
   try {
@@ -13822,7 +14189,7 @@ async function updateMetricsServerConfig(request, reply) {
   }
 }
 async function deleteMetricsServerConfig(request, reply) {
-  const tenantId = getTenantId18(request);
+  const tenantId = getTenantId19(request);
   const { keyOrId } = request.params;
   try {
     const storeLattice = getStoreLattice21("default", "metrics");
@@ -13869,7 +14236,7 @@ async function deleteMetricsServerConfig(request, reply) {
   }
 }
 async function testMetricsServerConnection(request, reply) {
-  const tenantId = getTenantId18(request);
+  const tenantId = getTenantId19(request);
   const { key } = request.params;
   try {
     const storeLattice = getStoreLattice21("default", "metrics");
@@ -13920,7 +14287,7 @@ async function testMetricsServerConnection(request, reply) {
   }
 }
 async function listAvailableMetrics(request, reply) {
-  const tenantId = getTenantId18(request);
+  const tenantId = getTenantId19(request);
   const { key } = request.params;
   try {
     const storeLattice = getStoreLattice21("default", "metrics");
@@ -13958,7 +14325,7 @@ async function listAvailableMetrics(request, reply) {
   }
 }
 async function queryMetricsData(request, reply) {
-  const tenantId = getTenantId18(request);
+  const tenantId = getTenantId19(request);
   const { key } = request.params;
   const { metricName, startTime, endTime, step, labels: labels2 } = request.body;
   try {
@@ -14006,7 +14373,7 @@ async function queryMetricsData(request, reply) {
   }
 }
 async function getDataSources(request, reply) {
-  const tenantId = getTenantId18(request);
+  const tenantId = getTenantId19(request);
   const { key } = request.params;
   try {
     const storeLattice = getStoreLattice21("default", "metrics");
@@ -14047,7 +14414,7 @@ async function getDataSources(request, reply) {
   }
 }
 async function getDatasourceMetrics(request, reply) {
-  const tenantId = getTenantId18(request);
+  const tenantId = getTenantId19(request);
   const { key, datasourceId } = request.params;
   try {
     const storeLattice = getStoreLattice21("default", "metrics");
@@ -14084,7 +14451,7 @@ async function getDatasourceMetrics(request, reply) {
   }
 }
 async function querySemanticMetrics(request, reply) {
-  const tenantId = getTenantId18(request);
+  const tenantId = getTenantId19(request);
   const { key } = request.params;
   const body = request.body;
   try {
@@ -14397,7 +14764,7 @@ function connectionRoutes(fastify2) {
 
 // src/controllers/eval.ts
 import { getStoreLattice as getStoreLattice23, hasModelLatticeForTenant as hasModelLatticeForTenant2, modelLatticeManager as modelLatticeManager2 } from "@axiom-lattice/core";
-import { v4 as uuidv43 } from "uuid";
+import { v4 as uuidv44 } from "uuid";
 
 // src/services/eval-runner.ts
 import { EventEmitter } from "events";
@@ -14410,7 +14777,7 @@ import {
   tenantHasOwnModelSupply
 } from "@axiom-lattice/core";
 import { PLATFORM_MODEL_TENANT_ID } from "@axiom-lattice/protocols";
-import { v4 as uuidv42 } from "uuid";
+import { v4 as uuidv43 } from "uuid";
 var TERMINAL_PERSIST_ATTEMPTS = 2;
 var EVAL_EXECUTION_LEASE = "eval:execution";
 var EVAL_LEASE_TTL_MS = 6e4;
@@ -14471,7 +14838,7 @@ var EvalRunner = class {
   /** One eval at a time across replicas; the executing worker holds this lease. */
   async acquireExecutionLease() {
     const store2 = this.getLeaseStore();
-    const holder = `${getReplicaId6()}#${uuidv42()}`;
+    const holder = `${getReplicaId6()}#${uuidv43()}`;
     if (!await store2.tryAcquire(EVAL_EXECUTION_LEASE, holder, EVAL_LEASE_TTL_MS)) {
       throw new Error("An evaluation run is already in progress");
     }
@@ -14576,7 +14943,7 @@ var EvalRunner = class {
         console.warn(`[eval-runner] Project "${project.name}" has no judge modelKey and no default model \u2014 falling back to "${resolvedJudgeModelKey}"`);
       }
     }
-    const runId = uuidv42();
+    const runId = uuidv43();
     const concurrency = Math.max(1, Math.floor(project.concurrency) || 3);
     const isHoldout = suites.length > 0 && suites.every((s) => s.name.endsWith("-validation"));
     const workspaceId = runConfig?.workspaceId || "";
@@ -14633,7 +15000,7 @@ var EvalRunner = class {
       if (terminalUnavailable()) return;
       const passed = result.result?.pass ?? false;
       const score = result.result?.final_score ?? 0;
-      await store2.createRunResult(tenantId, runId, uuidv42(), {
+      await store2.createRunResult(tenantId, runId, uuidv43(), {
         suiteName,
         caseId: result.caseId,
         pass: passed,
@@ -14802,7 +15169,7 @@ var EvalRunner = class {
 var evalRunner = new EvalRunner();
 
 // src/controllers/eval.ts
-function getTenantId19(request) {
+function getTenantId20(request) {
   const userTenantId = request.user?.tenantId;
   if (userTenantId) {
     return userTenantId;
@@ -14826,9 +15193,9 @@ async function getOwnedCase(store2, tenantId, projectId, suiteId, caseId) {
 }
 async function createProject(request, reply) {
   try {
-    const tenantId = getTenantId19(request);
+    const tenantId = getTenantId20(request);
     const store2 = getEvalStore();
-    const id3 = uuidv43();
+    const id3 = uuidv44();
     const data = request.body;
     const existing = await store2.getProjectsByTenant(tenantId);
     if (existing.some((p) => p.name === data.name)) {
@@ -14882,7 +15249,7 @@ async function createProject(request, reply) {
 }
 async function listProjects(request, reply) {
   try {
-    const tenantId = getTenantId19(request);
+    const tenantId = getTenantId20(request);
     const store2 = getEvalStore();
     let projects = await store2.getProjectsByTenant(tenantId);
     if (projects.length === 0) {
@@ -14892,7 +15259,7 @@ async function listProjects(request, reply) {
         const judgeModel = first ? { modelKey: first.key } : {};
         const host = request.hostname || "localhost";
         const baseUrl = `http://${host}:${process.env.PORT || 4001}`;
-        await store2.createProject(tenantId, uuidv43(), {
+        await store2.createProject(tenantId, uuidv44(), {
           name: "Default",
           description: "Built-in project for testing eval against this server",
           judgeModelConfig: judgeModel,
@@ -14915,7 +15282,7 @@ async function listProjects(request, reply) {
 }
 async function getProject(request, reply) {
   try {
-    const tenantId = getTenantId19(request);
+    const tenantId = getTenantId20(request);
     const store2 = getEvalStore();
     const { pid } = request.params;
     const project = await store2.getProjectById(tenantId, pid);
@@ -14935,7 +15302,7 @@ async function getProject(request, reply) {
 }
 async function updateProject(request, reply) {
   try {
-    const tenantId = getTenantId19(request);
+    const tenantId = getTenantId20(request);
     const store2 = getEvalStore();
     const { pid } = request.params;
     const existing = await store2.getProjectById(tenantId, pid);
@@ -14978,7 +15345,7 @@ async function updateProject(request, reply) {
 async function deleteProject(request, reply) {
   let releaseDeletion;
   try {
-    const tenantId = getTenantId19(request);
+    const tenantId = getTenantId20(request);
     const store2 = getEvalStore();
     const { pid } = request.params;
     const existing = await store2.getProjectById(tenantId, pid);
@@ -15016,14 +15383,14 @@ async function deleteProject(request, reply) {
 }
 async function createSuite(request, reply) {
   try {
-    const tenantId = getTenantId19(request);
+    const tenantId = getTenantId20(request);
     const store2 = getEvalStore();
     const { pid } = request.params;
     const project = await store2.getProjectById(tenantId, pid);
     if (!project) {
       return reply.status(404).send({ success: false, message: "Project not found" });
     }
-    const id3 = uuidv43();
+    const id3 = uuidv44();
     const data = request.body;
     const suite = await store2.createSuite(tenantId, pid, id3, { name: data.name });
     return reply.status(201).send({
@@ -15038,7 +15405,7 @@ async function createSuite(request, reply) {
 }
 async function updateSuite(request, reply) {
   try {
-    const tenantId = getTenantId19(request);
+    const tenantId = getTenantId20(request);
     const store2 = getEvalStore();
     const { pid, sid } = request.params;
     const existing = await getOwnedSuite(store2, tenantId, pid, sid);
@@ -15058,7 +15425,7 @@ async function updateSuite(request, reply) {
 }
 async function deleteSuite(request, reply) {
   try {
-    const tenantId = getTenantId19(request);
+    const tenantId = getTenantId20(request);
     const store2 = getEvalStore();
     const { pid, sid } = request.params;
     const existing = await getOwnedSuite(store2, tenantId, pid, sid);
@@ -15077,14 +15444,14 @@ async function deleteSuite(request, reply) {
 }
 async function createCase(request, reply) {
   try {
-    const tenantId = getTenantId19(request);
+    const tenantId = getTenantId20(request);
     const store2 = getEvalStore();
     const { pid, sid } = request.params;
     const suite = await getOwnedSuite(store2, tenantId, pid, sid);
     if (!suite) {
       return reply.status(404).send({ success: false, message: "Suite not found" });
     }
-    const id3 = uuidv43();
+    const id3 = uuidv44();
     const data = request.body;
     const created = await store2.createCase(tenantId, sid, id3, {
       inputMessage: data.inputMessage,
@@ -15107,7 +15474,7 @@ async function createCase(request, reply) {
 }
 async function listCasesForSuite(request, reply) {
   try {
-    const tenantId = getTenantId19(request);
+    const tenantId = getTenantId20(request);
     const store2 = getEvalStore();
     const { pid, sid } = request.params;
     const suite = await getOwnedSuite(store2, tenantId, pid, sid);
@@ -15127,7 +15494,7 @@ async function listCasesForSuite(request, reply) {
 }
 async function updateCase(request, reply) {
   try {
-    const tenantId = getTenantId19(request);
+    const tenantId = getTenantId20(request);
     const store2 = getEvalStore();
     const { pid, sid, cid } = request.params;
     const existing = await getOwnedCase(store2, tenantId, pid, sid, cid);
@@ -15147,7 +15514,7 @@ async function updateCase(request, reply) {
 }
 async function deleteCase(request, reply) {
   try {
-    const tenantId = getTenantId19(request);
+    const tenantId = getTenantId20(request);
     const store2 = getEvalStore();
     const { pid, sid, cid } = request.params;
     const existing = await getOwnedCase(store2, tenantId, pid, sid, cid);
@@ -15179,7 +15546,7 @@ function registerEvalRoutes(app2) {
   app2.delete("/api/eval/projects/:pid/suites/:sid/cases/:cid", deleteCase);
   app2.post("/api/eval/projects/:pid/runs", async (request, reply) => {
     try {
-      const tenantId = getTenantId19(request);
+      const tenantId = getTenantId20(request);
       const { pid } = request.params;
       const body = request.body ?? {};
       const bodyWs = request.headers["x-workspace-id"] || "";
@@ -15198,7 +15565,7 @@ function registerEvalRoutes(app2) {
   });
   app2.get("/api/eval/runs", async (request, reply) => {
     try {
-      const tenantId = getTenantId19(request);
+      const tenantId = getTenantId20(request);
       const query = request.query;
       const runs = await getEvalStore().getRunsByTenant(tenantId, { projectId: query.project_id, status: query.status });
       reply.send({ success: true, message: "Ok", data: { records: runs, total: runs.length } });
@@ -15208,7 +15575,7 @@ function registerEvalRoutes(app2) {
   });
   app2.get("/api/eval/runs/:rid", async (request, reply) => {
     try {
-      const tenantId = getTenantId19(request);
+      const tenantId = getTenantId20(request);
       const { rid } = request.params;
       const run2 = await getEvalStore().getRunById(tenantId, rid);
       if (!run2) return reply.status(404).send({ success: false, message: "Run not found" });
@@ -15219,7 +15586,7 @@ function registerEvalRoutes(app2) {
     }
   });
   app2.get("/api/eval/runs/:rid/stream", async (request, reply) => {
-    const tenantId = getTenantId19(request);
+    const tenantId = getTenantId20(request);
     const { rid } = request.params;
     const store2 = getEvalStore();
     const initial = await store2.getRunById(tenantId, rid);
@@ -15302,7 +15669,7 @@ data: ${JSON.stringify(data)}
   });
   app2.post("/api/eval/runs/:rid/abort", async (request, reply) => {
     try {
-      const tenantId = getTenantId19(request);
+      const tenantId = getTenantId20(request);
       const { rid } = request.params;
       const run2 = await getEvalStore().getRunById(tenantId, rid);
       if (!run2) return reply.status(404).send({ success: false, message: "Run not found" });
@@ -15315,7 +15682,7 @@ data: ${JSON.stringify(data)}
   });
   app2.delete("/api/eval/runs/:rid", async (request, reply) => {
     try {
-      const tenantId = getTenantId19(request);
+      const tenantId = getTenantId20(request);
       const { rid } = request.params;
       const store2 = getEvalStore();
       const run2 = await store2.getRunById(tenantId, rid);
@@ -15332,7 +15699,7 @@ data: ${JSON.stringify(data)}
   });
   app2.get("/api/eval/reports/projects/:pid", async (request, reply) => {
     try {
-      const tenantId = getTenantId19(request);
+      const tenantId = getTenantId20(request);
       const { pid } = request.params;
       const report = await getEvalStore().getProjectReport(tenantId, pid);
       if (!report) return reply.status(404).send({ success: false, message: "Project not found" });
@@ -15345,11 +15712,11 @@ data: ${JSON.stringify(data)}
 
 // src/controllers/users.ts
 import { getStoreLattice as getStoreLattice25 } from "@axiom-lattice/core";
-import { v4 as uuidv45 } from "uuid";
+import { v4 as uuidv46 } from "uuid";
 
 // src/controllers/auth.ts
 import { getStoreLattice as getStoreLattice24 } from "@axiom-lattice/core";
-import { v4 as uuidv44 } from "uuid";
+import { v4 as uuidv45 } from "uuid";
 import { createHmac, randomBytes, timingSafeEqual } from "crypto";
 import {
   PLATFORM_TENANT_ID as PLATFORM_TENANT_ID2,
@@ -15472,7 +15839,7 @@ var AuthController = class {
           error: "User with this email already exists"
         });
       }
-      const userId = uuidv44();
+      const userId = uuidv45();
       const userStatus = this.config.autoApproveUsers ? "active" : "pending";
       const userData = {
         email,
@@ -16263,7 +16630,7 @@ var UsersController = class {
   async createUser(request, reply) {
     if (!await this.requireAdmin(request, reply)) return;
     const data = request.body;
-    const id3 = uuidv45();
+    const id3 = uuidv46();
     if (this.isReservedPlatformEmail(data.email)) {
       return reply.status(403).send({
         success: false,
@@ -16449,7 +16816,7 @@ import {
   PLATFORM_TENANT_PROTECTED_ERROR as PLATFORM_TENANT_PROTECTED_ERROR3,
   isPlatformTenantId as isPlatformTenantId3
 } from "@axiom-lattice/protocols";
-import { v4 as uuidv46 } from "uuid";
+import { v4 as uuidv47 } from "uuid";
 
 // src/services/auth/AdminRouteGuard.ts
 function allowedForRole(role, access) {
@@ -16563,7 +16930,7 @@ var TenantsController = class {
   }
   async createTenant(request, reply) {
     const data = request.body;
-    const id3 = uuidv46();
+    const id3 = uuidv47();
     const tenant2 = await this.tenantStore.createTenant(id3, data);
     return reply.status(201).send({ success: true, data: tenant2 });
   }
@@ -16661,7 +17028,7 @@ function registerTenantRoutes(app2, options) {
 }
 
 // src/controllers/platform-admin.ts
-import { v4 as uuidv47 } from "uuid";
+import { v4 as uuidv48 } from "uuid";
 import { getStoreLattice as getStoreLattice27 } from "@axiom-lattice/core";
 import {
   PLATFORM_TENANT_PROTECTED_ERROR as PLATFORM_TENANT_PROTECTED_ERROR4,
@@ -16937,11 +17304,11 @@ var PlatformAdminError = class extends Error {
 function inputError(code, message, statusCode = 400) {
   return new PlatformAdminError(code, message, statusCode);
 }
-function isRecord8(value) {
+function isRecord9(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function bodyRecord(body) {
-  if (!isRecord8(body)) {
+  if (!isRecord9(body)) {
     throw inputError("INVALID_INPUT", "Request body must be an object");
   }
   return body;
@@ -17064,7 +17431,7 @@ var PlatformAdminController = class {
         );
       }
       const metadata = typeof password === "string" ? { passwordHash: await hashLegacyPassword(password) } : {};
-      const user = await this.options.userStore.createUser(uuidv47(), {
+      const user = await this.options.userStore.createUser(uuidv48(), {
         email,
         name,
         status,
@@ -17572,7 +17939,7 @@ var PlatformAdminController = class {
     }
   }
   pathParam(request, name) {
-    const params = isRecord8(request.params) ? request.params : {};
+    const params = isRecord9(request.params) ? request.params : {};
     const value = optionalString(params[name]);
     if (!value) {
       throw inputError(
@@ -18009,9 +18376,11 @@ import {
 // src/services/settings/PlatformSettingsService.ts
 import {
   DEFAULT_PLATFORM_BRANDING,
+  MAX_CUSTOM_CSS_LENGTH,
   PLATFORM_SETTINGS_DEFAULTS,
   PlatformSettingsVersionConflictError,
-  normalizeBrandingHost
+  normalizeBrandingHost,
+  validateCustomCss
 } from "@axiom-lattice/protocols";
 var PLATFORM_SETTINGS_CHANGED_TOPIC = "platform.settings.changed";
 var PlatformSettingsValidationError = class extends Error {
@@ -18043,7 +18412,8 @@ var BRANDING_KEYS = [
   "primaryColor",
   "backgroundColor",
   "loginTitle",
-  "loginSubtitle"
+  "loginSubtitle",
+  "customCss"
 ];
 var BRANDING_DOMAIN_KEYS = [
   "host",
@@ -18100,6 +18470,15 @@ function isHttpUrl(value) {
     return false;
   }
 }
+function isRootRelativeUrl(value) {
+  if (typeof value !== "string" || value.length === 0 || value.length > MAX_BRANDING_URL_LENGTH) {
+    return false;
+  }
+  return /^\/(?!\/)(?!\\)[^\s\\]*$/.test(value);
+}
+function isBrandAssetUrl(value) {
+  return isHttpUrl(value) || isRootRelativeUrl(value);
+}
 function isHexColor(value) {
   return typeof value === "string" && HEX_COLOR_PATTERN.test(value);
 }
@@ -18130,7 +18509,7 @@ function sanitizeBranding(value) {
     }
   }
   for (const key of BRANDING_URL_KEYS) {
-    if (isHttpUrl(value[key])) branding[key] = value[key];
+    if (isBrandAssetUrl(value[key])) branding[key] = value[key];
   }
   for (const key of BRANDING_COLOR_KEYS) {
     if (isHexColor(value[key])) branding[key] = value[key];
@@ -18141,6 +18520,9 @@ function sanitizeBranding(value) {
       branding[key] = text;
     }
   }
+  if (typeof value.customCss === "string" && value.customCss.trim().length > 0 && validateCustomCss(value.customCss).ok) {
+    branding.customCss = value.customCss;
+  }
   return Object.keys(branding).length > 0 ? branding : void 0;
 }
 function sanitizeBrandingDomain(value) {
@@ -18412,10 +18794,19 @@ function validateBrandingFields(value, prefix, issues) {
     }
   }
   for (const key of BRANDING_URL_KEYS) {
-    if (value[key] !== void 0 && !isHttpUrl(value[key])) {
+    if (value[key] !== void 0 && !isBrandAssetUrl(value[key])) {
       issues.push({
         path: `${prefix}.${key}`,
-        message: "must be an http(s) URL of at most 2048 characters"
+        message: "must be an http(s) or root-relative URL of at most 2048 characters"
+      });
+    }
+  }
+  if (value.customCss !== void 0) {
+    const result = validateCustomCss(value.customCss);
+    if (!result.ok) {
+      issues.push({
+        path: `${prefix}.customCss`,
+        message: result.reason === "length" ? `must be a string of at most ${MAX_CUSTOM_CSS_LENGTH} characters` : result.reason === "import" ? "must not contain @import" : "must not contain </style"
       });
     }
   }
@@ -18990,14 +19381,14 @@ var RESETTABLE_PATHS = /* @__PURE__ */ new Set([
   "rateLimits.maxActiveRunTasksPerTenant"
 ]);
 var RESET_PATH_PATTERN = /^[a-zA-Z][a-zA-Z0-9]*\.[a-zA-Z][a-zA-Z0-9]*$/;
-function isRecord9(value) {
+function isRecord10(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function invalid(issues) {
   throw new PlatformSettingsValidationError(issues);
 }
 function parseUpdateBody(body) {
-  if (!isRecord9(body)) {
+  if (!isRecord10(body)) {
     invalid([{ path: "", message: "must be an object" }]);
   }
   const expectedVersion = body.expectedVersion;
@@ -19006,7 +19397,7 @@ function parseUpdateBody(body) {
       { path: "expectedVersion", message: "must be a non-negative integer" }
     ]);
   }
-  if (body.patch !== void 0 && !isRecord9(body.patch)) {
+  if (body.patch !== void 0 && !isRecord10(body.patch)) {
     invalid([{ path: "patch", message: "must be an object" }]);
   }
   if (body.reset !== void 0 && !Array.isArray(body.reset)) {
@@ -19036,13 +19427,13 @@ function parseResetPaths(reset) {
   return paths;
 }
 function buildDocumentPatch(patch, resetPaths) {
-  const document = isRecord9(patch) ? { ...patch } : {};
+  const document = isRecord10(patch) ? { ...patch } : {};
   for (const path5 of resetPaths) {
     const dot = path5.indexOf(".");
     const section = path5.slice(0, dot);
     const leaf = path5.slice(dot + 1);
     const current3 = document[section];
-    if (current3 !== void 0 && !isRecord9(current3)) {
+    if (current3 !== void 0 && !isRecord10(current3)) {
       continue;
     }
     document[section] = { ...current3 ?? {}, [leaf]: void 0 };
@@ -19052,7 +19443,7 @@ function buildDocumentPatch(patch, resetPaths) {
 function collectChangedKeys(patch, resetPaths) {
   const keys2 = new Set(resetPaths);
   for (const [section, value] of Object.entries(patch)) {
-    if (!isRecord9(value)) continue;
+    if (!isRecord10(value)) continue;
     for (const [leaf, leafValue2] of Object.entries(value)) {
       if (leafValue2 !== void 0) keys2.add(`${section}.${leaf}`);
     }
@@ -19242,7 +19633,7 @@ function registerPlatformSettingsRoutes(app2, options) {
 }
 
 // src/controllers/branding.ts
-function isRecord10(value) {
+function isRecord11(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function firstHeaderValue(value) {
@@ -19255,7 +19646,7 @@ function resolveBrandingRequestHost(request) {
   return firstHeaderValue(request.headers["x-axiom-host"]) ?? firstHeaderValue(request.headers["x-forwarded-host"]) ?? firstHeaderValue(request.headers.host) ?? request.hostname ?? "";
 }
 function parseUpdateBody2(body) {
-  if (!isRecord10(body)) {
+  if (!isRecord11(body)) {
     throw new PlatformSettingsValidationError([
       { path: "", message: "must be an object" }
     ]);
@@ -19266,7 +19657,7 @@ function parseUpdateBody2(body) {
       { path: "expectedVersion", message: "must be a non-negative integer" }
     ]);
   }
-  if (!isRecord10(body.branding)) {
+  if (!isRecord11(body.branding)) {
     throw new PlatformSettingsValidationError([
       { path: "branding", message: "must be an object" }
     ]);
@@ -20326,11 +20717,11 @@ var OidcProviderInputError = class extends Error {
 function inputError2(code, message, statusCode = 400) {
   return new OidcProviderInputError(code, message, statusCode);
 }
-function isRecord11(value) {
+function isRecord12(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function bodyRecord2(body) {
-  if (!isRecord11(body)) {
+  if (!isRecord12(body)) {
     throw inputError2("INVALID_INPUT", "Request body must be an object");
   }
   return body;
@@ -20390,6 +20781,13 @@ function normalizeIssuer(raw, allowInsecure, allowedPrivateHosts = []) {
 function normalizeClientId(value) {
   return requiredString2(value, "INVALID_CLIENT_ID", "Client id");
 }
+function normalizeClientSecret(value) {
+  if (value === void 0 || value === null) return "";
+  if (typeof value !== "string") {
+    throw inputError2("INVALID_CLIENT_SECRET", "Client secret must be a string");
+  }
+  return value.trim();
+}
 function normalizeScopes(value, fallback) {
   if (value === void 0 || value === null) {
     if (fallback) return fallback;
@@ -20823,11 +21221,7 @@ var OidcProviderAdminController = class {
       allowedPrivateHosts ?? this.allowedPrivateHosts
     );
     const clientId = normalizeClientId(body.clientId);
-    const clientSecret = requiredString2(
-      body.clientSecret,
-      "CLIENT_SECRET_REQUIRED",
-      "Client secret"
-    );
+    const clientSecret = normalizeClientSecret(body.clientSecret);
     const scopes = normalizeScopes(body.scopes, DEFAULT_SCOPES);
     const enabled = optionalBoolean(
       body.enabled,
@@ -20981,11 +21375,7 @@ var OidcProviderAdminController = class {
         allowedPrivateHosts
       ),
       clientId: normalizeClientId(body.clientId),
-      clientSecret: requiredString2(
-        body.clientSecret,
-        "CLIENT_SECRET_REQUIRED",
-        "Client secret"
-      ),
+      clientSecret: normalizeClientSecret(body.clientSecret),
       allowInsecure: this.options.allowInsecure,
       ...allowedPrivateHosts.length ? { allowedPrivateHosts } : {}
     };
@@ -23364,7 +23754,7 @@ async function notifyInstallationChanged(tenantId, installationId) {
     console.error("Failed to notify channel installation change:", error);
   }
 }
-function getTenantId20(request) {
+function getTenantId21(request) {
   const userTenantId = request.user?.tenantId;
   if (typeof userTenantId === "string" && userTenantId) {
     return userTenantId;
@@ -23500,7 +23890,7 @@ async function getInstallationStore() {
   });
 }
 async function getChannelInstallationList(request) {
-  const tenantId = getTenantId20(request);
+  const tenantId = getTenantId21(request);
   const { channel } = request.query;
   try {
     const store2 = await getInstallationStore();
@@ -23526,7 +23916,7 @@ async function getChannelInstallationList(request) {
   }
 }
 async function getChannelInstallation(request, reply) {
-  const tenantId = getTenantId20(request);
+  const tenantId = getTenantId21(request);
   const { installationId } = request.params;
   try {
     const store2 = await getInstallationStore();
@@ -23553,7 +23943,7 @@ async function getChannelInstallation(request, reply) {
   }
 }
 async function createChannelInstallation(request, reply) {
-  const tenantId = getTenantId20(request);
+  const tenantId = getTenantId21(request);
   try {
     const body = snapshotPublicCreateRequest(request.body);
     if (!body) {
@@ -23614,7 +24004,7 @@ async function createChannelInstallation(request, reply) {
   }
 }
 async function updateChannelInstallation(request, reply) {
-  const tenantId = getTenantId20(request);
+  const tenantId = getTenantId21(request);
   const { installationId } = request.params;
   try {
     const store2 = await getInstallationStore();
@@ -23751,7 +24141,7 @@ async function updateChannelInstallation(request, reply) {
   }
 }
 async function deleteChannelInstallation(request, reply) {
-  const tenantId = getTenantId20(request);
+  const tenantId = getTenantId21(request);
   const { installationId } = request.params;
   try {
     const store2 = await getInstallationStore();
@@ -23824,7 +24214,7 @@ import {
   descriptorDataValue as descriptorDataValue2
 } from "@axiom-lattice/protocols";
 import { getBindingRegistry, getStoreLattice as getStoreLattice29 } from "@axiom-lattice/core";
-function getTenantId21(request) {
+function getTenantId22(request) {
   const userTenantId = request.user?.tenantId;
   if (typeof userTenantId === "string" && userTenantId) return userTenantId;
   return request.headers["x-tenant-id"] || "default";
@@ -23897,7 +24287,7 @@ function invalidCreateRequest(reply) {
 }
 async function getBindingList(request, _reply) {
   void _reply;
-  const tenantId = getTenantId21(request);
+  const tenantId = getTenantId22(request);
   const { channel, agentId, channelInstallationId, limit, offset } = request.query;
   try {
     const registry = getBindingRegistry();
@@ -23917,7 +24307,7 @@ async function getBindingList(request, _reply) {
   }
 }
 async function getBinding(request, reply) {
-  const tenantId = getTenantId21(request);
+  const tenantId = getTenantId22(request);
   try {
     const registry = getBindingRegistry();
     const binding = await registry.findById(tenantId, request.params.id);
@@ -23932,7 +24322,7 @@ async function getBinding(request, reply) {
   }
 }
 async function createBinding(request, reply) {
-  const tenantId = getTenantId21(request);
+  const tenantId = getTenantId22(request);
   try {
     const input = snapshotPublicCreate(request.body);
     if (!input) return invalidCreateRequest(reply);
@@ -23957,7 +24347,7 @@ async function createBinding(request, reply) {
 }
 async function updateBinding(request, reply) {
   try {
-    const tenantId = getTenantId21(request);
+    const tenantId = getTenantId22(request);
     const registry = getBindingRegistry();
     const existing = await registry.findById(tenantId, request.params.id);
     if (!existing || isInternalBinding(existing)) {
@@ -23984,7 +24374,7 @@ async function updateBinding(request, reply) {
 }
 async function deleteBinding(request, reply) {
   try {
-    const tenantId = getTenantId21(request);
+    const tenantId = getTenantId22(request);
     const registry = getBindingRegistry();
     const existing = await registry.findById(tenantId, request.params.id);
     if (!existing || isInternalBinding(existing)) {
@@ -24001,7 +24391,7 @@ async function deleteBinding(request, reply) {
 }
 async function resolveBinding(request, _reply) {
   void _reply;
-  const tenantId = getTenantId21(request);
+  const tenantId = getTenantId22(request);
   const { channel, senderId, channelInstallationId } = request.query;
   if (channel === "room") {
     return { success: false, message: "No binding found", data: null };
@@ -24031,7 +24421,7 @@ function registerChannelBindingRoutes(app2) {
 
 // src/controllers/menu-items.ts
 import { getMenuRegistry } from "@axiom-lattice/core";
-function getTenantId22(request) {
+function getTenantId23(request) {
   const userTenantId = request.user?.tenantId;
   if (userTenantId) return userTenantId;
   return request.headers["x-tenant-id"] || "default";
@@ -24046,7 +24436,7 @@ function sanitizeUpdatePatch(body) {
   return patch;
 }
 async function getMenuItemList(request, _reply) {
-  const tenantId = getTenantId22(request);
+  const tenantId = getTenantId23(request);
   try {
     const registry = getMenuRegistry();
     const items = await registry.list({ tenantId, menuTarget: request.query.menuTarget });
@@ -24058,7 +24448,7 @@ async function getMenuItemList(request, _reply) {
   }
 }
 async function getMenuItem(request, reply) {
-  const tenantId = getTenantId22(request);
+  const tenantId = getTenantId23(request);
   try {
     const registry = getMenuRegistry();
     const item = await registry.getById(request.params.id);
@@ -24075,7 +24465,7 @@ async function getMenuItem(request, reply) {
   }
 }
 async function createMenuItem(request, reply) {
-  const tenantId = getTenantId22(request);
+  const tenantId = getTenantId23(request);
   try {
     const registry = getMenuRegistry();
     const item = await registry.create({ ...request.body, tenantId });
@@ -24090,7 +24480,7 @@ async function createMenuItem(request, reply) {
 }
 async function updateMenuItem(request, reply) {
   try {
-    const tenantId = getTenantId22(request);
+    const tenantId = getTenantId23(request);
     const registry = getMenuRegistry();
     const existing = await registry.getById(request.params.id);
     if (!existing || existing.tenantId !== tenantId) {
@@ -24111,7 +24501,7 @@ async function updateMenuItem(request, reply) {
 }
 async function deleteMenuItem(request, reply) {
   try {
-    const tenantId = getTenantId22(request);
+    const tenantId = getTenantId23(request);
     const registry = getMenuRegistry();
     const existing = await registry.getById(request.params.id);
     if (!existing || existing.tenantId !== tenantId) {
@@ -24410,7 +24800,7 @@ import { getStoreLattice as getStoreLattice30 } from "@axiom-lattice/core";
 import {
   AgentType as AgentType2
 } from "@axiom-lattice/protocols";
-function getTenantId23(request) {
+function getTenantId24(request) {
   const userTenantId = request.user?.tenantId;
   if (userTenantId) return userTenantId;
   return request.headers["x-tenant-id"] || "default";
@@ -24447,7 +24837,7 @@ async function requireManagedAssistant(request, reply) {
     reply.status(400).send({ success: false, error: "assistantId is required" });
     return null;
   }
-  const registered = await getLocalA2AAssistant(getTenantId23(request), assistantId);
+  const registered = await getLocalA2AAssistant(getTenantId24(request), assistantId);
   if (!registered) {
     reply.status(404).send({
       success: false,
@@ -24458,7 +24848,7 @@ async function requireManagedAssistant(request, reply) {
   return { assistantId, localRuntime: registered.localRuntime };
 }
 async function getLocalA2AStatus(request, reply) {
-  const tenantId = getTenantId23(request);
+  const tenantId = getTenantId24(request);
   const managed = await getLocalA2AAssistants(tenantId);
   const states = await Promise.all(
     managed.map(
@@ -24679,7 +25069,7 @@ function registerTaskRoutes(app2, controller) {
 import {
   agentInstanceManager as agentInstanceManager9,
   agentLatticeManager as agentLatticeManager7,
-  embeddingsLatticeManager as embeddingsLatticeManager2,
+  embeddingsLatticeManager as embeddingsLatticeManager3,
   sttModelLatticeManager as sttModelLatticeManager2,
   vectorStoreLatticeManager,
   createProjectTaskReassignmentAuthorizer,
@@ -24791,7 +25181,7 @@ function snapshotTaskItem(value) {
   try {
     const metadata = row.metadata === void 0 ? void 0 : snapshotJsonValue(row.metadata);
     const context2 = row.context === void 0 ? void 0 : snapshotJsonValue(row.context);
-    if (metadata !== void 0 && !isRecord12(metadata) || context2 !== void 0 && !isRecord12(context2)) return void 0;
+    if (metadata !== void 0 && !isRecord13(metadata) || context2 !== void 0 && !isRecord13(context2)) return void 0;
     const dependencies = row.dependencies === void 0 ? void 0 : snapshotJsonValue(row.dependencies);
     if (dependencies !== void 0 && (!Array.isArray(dependencies) || dependencies.some((id3) => typeof id3 !== "string"))) return void 0;
     const files = row.files === void 0 ? void 0 : snapshotJsonValue(row.files);
@@ -24891,7 +25281,7 @@ function snapshotThread(value) {
   if (!row || !createdAt || !updatedAt || row.expiresAt !== void 0 && !expiresAt || typeof row.id !== "string" || !row.id || typeof row.tenantId !== "string" || !row.tenantId || typeof row.assistantId !== "string" || !row.assistantId) return void 0;
   try {
     const metadata = row.metadata === void 0 ? void 0 : snapshotJsonValue(row.metadata);
-    if (metadata !== void 0 && !isRecord12(metadata)) return void 0;
+    if (metadata !== void 0 && !isRecord13(metadata)) return void 0;
     return {
       id: row.id,
       tenantId: row.tenantId,
@@ -24905,7 +25295,7 @@ function snapshotThread(value) {
     return void 0;
   }
 }
-function isRecord12(value) {
+function isRecord13(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function isTaskFileRef(value) {
@@ -26343,7 +26733,7 @@ var protectedLifecycleKeys = /* @__PURE__ */ new Set([
   "status",
   "interruptedAt"
 ]);
-function getTenantId24(request) {
+function getTenantId25(request) {
   const user = request.user;
   const value = user?.tenantId ?? request.headers["x-tenant-id"] ?? "default";
   if (typeof value !== "string" || !value) throw new HttpTaskError(400, "INVALID_TASK_INPUT");
@@ -26585,7 +26975,7 @@ async function validateReferences(store2, task, parentId, dependencies) {
 function createTaskController(deps) {
   const mutationMutex = deps.projectMutationMutex ?? projectMutationMutex;
   const authorize2 = async (request, projectId, capability2) => deps.access.requireProjectAccess({
-    tenantId: getTenantId24(request),
+    tenantId: getTenantId25(request),
     userId: getUserId7(request),
     projectId,
     capability: capability2
@@ -26603,7 +26993,7 @@ function createTaskController(deps) {
     });
   };
   const list = withErrors(async (request) => {
-    const tenantId = getTenantId24(request);
+    const tenantId = getTenantId25(request);
     const userId = getUserId7(request);
     const query = exactObject(request.query, ["projectId", "status", "priority", "limit", "offset", "ownerType", "ownerId", "parentId", "metadata"]);
     const projectId = typeof query.projectId === "string" ? query.projectId : void 0;
@@ -26675,14 +27065,14 @@ function createTaskController(deps) {
   });
   const get = withErrors(async (request, reply) => {
     await preauthorizeExplicitProject(request, authorize2);
-    const current3 = await deps.tasks.getById(getTenantId24(request), request.params.id);
+    const current3 = await deps.tasks.getById(getTenantId25(request), request.params.id);
     if (!current3) return sendNotFound(reply);
     await authorizeRead(request, current3, authorize2);
     return { success: true, data: current3 };
   });
   const create = withErrors(async (request, reply) => {
     const body = snapshotCreate(request.body);
-    const tenantId = getTenantId24(request);
+    const tenantId = getTenantId25(request);
     const userId = getUserId7(request);
     const governed = governedCreate(body);
     if (governed) return reply.code(409).send({ success: false, code: governed });
@@ -26738,7 +27128,7 @@ function createTaskController(deps) {
     const body = snapshotUpdate(request.body);
     if ("status" in body) throw new HttpTaskError(400, "STATUS_USES_COMMAND");
     await preauthorizeExplicitProject(request, authorize2);
-    const current3 = await deps.tasks.getById(getTenantId24(request), request.params.id);
+    const current3 = await deps.tasks.getById(getTenantId25(request), request.params.id);
     if (!current3) return sendNotFound(reply);
     await authorizeMutation(request, current3, authorize2);
     return lockedTask(request, current3, async (locked) => {
@@ -26754,7 +27144,7 @@ function createTaskController(deps) {
   });
   const remove = withErrors(async (request, reply) => {
     await preauthorizeExplicitProject(request, authorize2);
-    const current3 = await deps.tasks.getById(getTenantId24(request), request.params.id);
+    const current3 = await deps.tasks.getById(getTenantId25(request), request.params.id);
     if (!current3) return sendNotFound(reply);
     await authorizeMutation(request, current3, authorize2);
     return lockedTask(request, current3, async (locked) => {
@@ -26773,7 +27163,7 @@ function createTaskController(deps) {
   const complete = withErrors(async (request, reply) => {
     const body = snapshotComplete(request.body);
     await preauthorizeExplicitProject(request, authorize2);
-    const current3 = await deps.tasks.getById(getTenantId24(request), request.params.id);
+    const current3 = await deps.tasks.getById(getTenantId25(request), request.params.id);
     if (!current3) return sendNotFound(reply);
     await authorizeMutation(request, current3, authorize2);
     return lockedTask(request, current3, async (locked) => {
@@ -26791,7 +27181,7 @@ function createTaskController(deps) {
   const command = withErrors(async (request, reply) => {
     const body = snapshotCommand(request.body);
     await preauthorizeExplicitProject(request, authorize2);
-    const current3 = await deps.tasks.getById(getTenantId24(request), request.params.id);
+    const current3 = await deps.tasks.getById(getTenantId25(request), request.params.id);
     if (!current3) return sendNotFound(reply);
     const capability2 = commandCapability(body.type);
     await authorizeCommand(request, current3, authorize2, capability2);
@@ -26806,7 +27196,7 @@ function createTaskController(deps) {
   });
   const workItems = withErrors(async (request, reply) => {
     await preauthorizeExplicitProject(request, authorize2);
-    const current3 = await deps.tasks.getById(getTenantId24(request), request.params.id);
+    const current3 = await deps.tasks.getById(getTenantId25(request), request.params.id);
     if (!current3) return sendNotFound(reply);
     await authorizeRead(request, current3, authorize2);
     const query = exactObject(request.query, ["action", "limit", "offset"]);
@@ -27140,8 +27530,9 @@ function normalizeError(reply, error) {
       error: { code: error.code, message: error.message, retryable: false }
     });
   }
-  if (error.statusCode && error.statusCode >= 400 && error.statusCode < 500) {
-    return invalidRequest2(reply, error.statusCode);
+  const statusCode = typeof error === "object" && error !== null && "statusCode" in error ? error.statusCode : void 0;
+  if (typeof statusCode === "number" && statusCode >= 400 && statusCode < 500) {
+    return invalidRequest2(reply, statusCode);
   }
   return reply.code(500).send({
     success: false,
@@ -27163,7 +27554,7 @@ import { z as z5, ZodError as ZodError2 } from "zod";
 import { createHash as createHash6, randomUUID as randomUUID27 } from "crypto";
 import { MessageChunkTypes as MessageChunkTypes4, parseAgentWebAppGenUIBlock, buildAffinityMissChunk as buildAffinityMissChunk2 } from "@axiom-lattice/protocols";
 import { getReplicaId as getReplicaId7, getThreadRunOwner as getThreadRunOwner2, normalizeAgentInterrupts as normalizeAgentInterrupts2 } from "@axiom-lattice/core";
-function isRecord13(value) {
+function isRecord14(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 var AgentWebAppRuntimeError = class extends Error {
@@ -27309,7 +27700,7 @@ var AgentWebAppRuntimeService = class {
       projectId: runtime.project.id
     });
     return messages.flatMap((message) => {
-      if (!isRecord13(message) || typeof message.id !== "string" || message.role !== "human" && message.role !== "ai") return [];
+      if (!isRecord14(message) || typeof message.id !== "string" || message.role !== "human" && message.role !== "ai") return [];
       const content = typeof message.content === "string" ? message.content : runtime.webApp.features.genUI && Array.isArray(message.content) ? message.content.map(parseAgentWebAppGenUIBlock).filter((block) => block !== void 0) : void 0;
       return [{ id: message.id, role: message.role, ...content && (typeof content === "string" || content.length > 0) ? { content } : {} }];
     });
@@ -28110,7 +28501,7 @@ function registerAgentWebAppRuntimeRoutes(app2, deps) {
     }
     const mirrorThreadParams = z5.object({ webAppId: idSchema, assistantId: idSchema, threadId: idSchema }).strict();
     const mirrorRunParams = mirrorThreadParams.extend({ runId: idSchema }).strict();
-    const isRecord19 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+    const isRecord20 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
     const scopedConsoleRequest = (request, scope) => {
       const proxy = Object.create(request);
       const runId = request.params.runId;
@@ -28129,22 +28520,22 @@ function registerAgentWebAppRuntimeRoutes(app2, deps) {
       return proxy;
     };
     const withRuntimeModel = (body, scope) => {
-      if (scope.modelKey === void 0 || !isRecord19(body) || !isRecord19(body.args)) return body;
+      if (scope.modelKey === void 0 || !isRecord20(body) || !isRecord20(body.args)) return body;
       const args = body.args;
-      if (!isRecord19(args.config)) {
+      if (!isRecord20(args.config)) {
         return { ...body, args: { ...args, config: { modelConfig: { modelKey: scope.modelKey } } } };
       }
       const config = args.config;
-      const modelConfig = isRecord19(config.modelConfig) ? config.modelConfig : {};
+      const modelConfig = isRecord20(config.modelConfig) ? config.modelConfig : {};
       return {
         ...body,
         args: { ...args, config: { ...config, modelConfig: { ...modelConfig, modelKey: scope.modelKey } } }
       };
     };
     const withRunModel = (body, scope) => {
-      if (scope.modelKey === void 0 || !isRecord19(body)) return body;
-      const config = isRecord19(body.config) ? body.config : {};
-      const modelConfig = isRecord19(config.modelConfig) ? config.modelConfig : {};
+      if (scope.modelKey === void 0 || !isRecord20(body)) return body;
+      const config = isRecord20(body.config) ? body.config : {};
+      const modelConfig = isRecord20(config.modelConfig) ? config.modelConfig : {};
       return { ...body, config: { ...config, modelConfig: { ...modelConfig, modelKey: scope.modelKey } } };
     };
     const selectionFor = (request) => projectQueryLenientSchema.parse(request.query);
@@ -28235,7 +28626,7 @@ function registerAgentWebAppRuntimeRoutes(app2, deps) {
         const selection = withPreview(selectionFor(request), identity.preview);
         const scope = await deps.service.authorizeThread(webAppId, identity.userId, threadId, selection);
         if (scope.assistantId !== assistantId) throw new AgentWebAppRuntimeError("THREAD_NOT_FOUND", 404, "Thread not found");
-        const command = isRecord19(request.body) && typeof request.body.command === "string" ? request.body.command : void 0;
+        const command = isRecord20(request.body) && typeof request.body.command === "string" ? request.body.command : void 0;
         if (command === "input.respond" && !scope.hitl) {
           throw new AgentWebAppRuntimeError("FEATURE_DISABLED", 403, "HITL is disabled");
         }
@@ -28283,7 +28674,7 @@ function registerAgentWebAppRuntimeRoutes(app2, deps) {
           const params = mirrorThreadParams.parse(request.params);
           const { proxy, scope } = await authorizeRunMirror(request, params);
           const body = request.body;
-          if (isRecord19(body) && body.command !== void 0 && body.command !== null && scope.hitl === false) {
+          if (isRecord20(body) && body.command !== void 0 && body.command !== null && scope.hitl === false) {
             throw new AgentWebAppRuntimeError(
               "FEATURE_DISABLED",
               403,
@@ -28548,9 +28939,10 @@ function resolveBundledEmbedDir() {
   }
   return null;
 }
+var EMBED_ASSET_BASE = "../../../embed";
 function renderChatShell(chunkCssFiles) {
   const chunkCssLinks = chunkCssFiles.map(
-    (name) => `    <link rel="stylesheet" href="/embed/${name}" />`
+    (name) => `    <link rel="stylesheet" href="${EMBED_ASSET_BASE}/${name}" />`
   );
   return [
     "<!doctype html>",
@@ -28559,7 +28951,7 @@ function renderChatShell(chunkCssFiles) {
     '    <meta charset="utf-8" />',
     '    <meta name="viewport" content="width=device-width, initial-scale=1" />',
     "    <title>Agent chat</title>",
-    '    <link rel="stylesheet" href="/embed/embed-page.css" />',
+    `    <link rel="stylesheet" href="${EMBED_ASSET_BASE}/embed-page.css" />`,
     ...chunkCssLinks,
     "  </head>",
     "  <body>",
@@ -28567,7 +28959,7 @@ function renderChatShell(chunkCssFiles) {
     "      <noscript>This chat requires JavaScript.</noscript>",
     '      <p class="axiom-embed-loading">Loading chat\u2026</p>',
     "    </div>",
-    '    <script type="module" src="/embed/embed-page.js"></script>',
+    `    <script type="module" src="${EMBED_ASSET_BASE}/embed-page.js"></script>`,
     "  </body>",
     "</html>"
   ].join("\n");
@@ -35159,7 +35551,7 @@ function snapshotProjectableWorkItem(value) {
   if (!row || !createdAt || typeof row.id !== "string" || !row.id || typeof row.taskId !== "string" || !row.taskId || typeof row.tenantId !== "string" || !row.tenantId || typeof row.workspaceId !== "string" || !row.workspaceId || typeof row.projectId !== "string" || !row.projectId || typeof row.actor !== "string" || !row.actor || typeof row.eventKey !== "string" || !row.eventKey || !PROJECT_TASK_LIFECYCLE_ACTIONS.includes(row.action) || row.threadId !== void 0 && typeof row.threadId !== "string" || row.summary !== void 0 && typeof row.summary !== "string" || row.attempt !== void 0 && (typeof row.attempt !== "number" || !Number.isFinite(row.attempt))) return void 0;
   try {
     const detail = row.detail === void 0 ? void 0 : snapshotJsonValue(row.detail);
-    if (detail !== void 0 && !isRecord14(detail)) return void 0;
+    if (detail !== void 0 && !isRecord15(detail)) return void 0;
     return {
       id: row.id,
       taskId: row.taskId,
@@ -35282,7 +35674,7 @@ function snapshotLifecycleCursor(value) {
   const createdAt = cloneExactDate(row?.createdAt);
   return row && typeof row.id === "string" && row.id.length > 0 && createdAt ? { id: row.id, createdAt } : void 0;
 }
-function isRecord14(value) {
+function isRecord15(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 
@@ -37325,7 +37717,7 @@ var registerLatticeRoutes = (app2, channelDeps, options = {}) => {
       forgetTenantDefaultMiss: (tenantId) => modelLatticeManager3.forgetTenantDefaultMiss(tenantId),
       evictProviderCache: (tenantId, providerId2) => {
         modelLatticeManager3.evictProviderCache(tenantId, providerId2);
-        embeddingsLatticeManager2.evictProviderCache(tenantId, providerId2);
+        embeddingsLatticeManager3.evictProviderCache(tenantId, providerId2);
         sttModelLatticeManager2.evictProviderCache(tenantId, providerId2);
         vectorStoreLatticeManager.clearTenantVectorStores(tenantId);
       }
@@ -37662,6 +38054,8 @@ var registerLatticeRoutes = (app2, channelDeps, options = {}) => {
   app2.get("/api/embeddings", listEmbeddings);
   app2.get("/api/collections/:name/entries", listEntries);
   app2.post("/api/collections/:name/entries", createEntry);
+  app2.post("/api/collections/:name/entries/batch", createEntries);
+  app2.delete("/api/collections/:name/entries/batch", deleteEntries);
   app2.get("/api/collections/:name/entries/:id", getEntry);
   app2.put("/api/collections/:name/entries/:id", updateEntry);
   app2.delete("/api/collections/:name/entries/:id", deleteEntry);
@@ -40062,7 +40456,7 @@ var MAX_TRACKED_STREAMS = 1e3;
 var sentCardsByTaskId = /* @__PURE__ */ new Map();
 var handledCardEventKeys = /* @__PURE__ */ new Map();
 var ACKNOWLEDGED_TTL_MS = 10 * 6e4;
-function isRecord15(value) {
+function isRecord16(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value);
 }
 function replyKeyOf(installationId, reqId) {
@@ -40225,7 +40619,7 @@ function acknowledgedCard(taskId, eventKey) {
   const desc = eventKey ? `\u5DF2\u6536\u5230\uFF1A${eventKey}` : "\u5DF2\u63D0\u4EA4\uFF0C\u6B63\u5728\u5904\u7406\u2026";
   const original = sentCardForTask(taskId);
   if (original) {
-    const mainTitle = isRecord15(original.main_title) ? original.main_title : {};
+    const mainTitle = isRecord16(original.main_title) ? original.main_title : {};
     return { ...original, main_title: { ...mainTitle, desc } };
   }
   return {
@@ -40235,7 +40629,7 @@ function acknowledgedCard(taskId, eventKey) {
   };
 }
 function cardEventFields(event) {
-  const nested = isRecord15(event?.template_card_event) ? event.template_card_event : event;
+  const nested = isRecord16(event?.template_card_event) ? event.template_card_event : event;
   const source = nested ?? {};
   return {
     cardEvent: source,
@@ -42559,7 +42953,7 @@ function errorMessage6(error) {
 
 // src/services/channel-reply/loadFinalReplyText.ts
 import { agentInstanceManager as agentInstanceManager11 } from "@axiom-lattice/core";
-function isRecord16(value) {
+function isRecord17(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function contentToText(content) {
@@ -42571,27 +42965,27 @@ function contentToText(content) {
       parts.push(block);
       continue;
     }
-    if (isRecord16(block) && typeof block.text === "string") {
+    if (isRecord17(block) && typeof block.text === "string") {
       parts.push(block.text);
     }
   }
   return parts.join("");
 }
 function messageContent(message) {
-  if (!isRecord16(message)) return void 0;
+  if (!isRecord17(message)) return void 0;
   if ("content" in message) return message.content;
   const kwargs = message.kwargs;
-  return isRecord16(kwargs) ? kwargs.content : void 0;
+  return isRecord17(kwargs) ? kwargs.content : void 0;
 }
 function isAiMessage(message) {
-  if (!isRecord16(message)) return false;
+  if (!isRecord17(message)) return false;
   if (message.role === "ai" || message.type === "ai") return true;
   return typeof message.getType === "function" && message.getType() === "ai";
 }
 function extractLastAiMessageText(state) {
-  if (!isRecord16(state)) return "";
+  if (!isRecord17(state)) return "";
   const values = state.values;
-  if (!isRecord16(values) || !Array.isArray(values.messages)) return "";
+  if (!isRecord17(values) || !Array.isArray(values.messages)) return "";
   for (let index = values.messages.length - 1; index >= 0; index -= 1) {
     const message = values.messages[index];
     if (!isAiMessage(message)) continue;
@@ -42628,7 +43022,7 @@ async function prepareProjectTaskRuntime(runtime, log2) {
 // src/services/platform-ops/PlatformOpsPlugin.ts
 import { AgentType as AgentType3, PLATFORM_OPS_AGENT_ID as PLATFORM_OPS_AGENT_ID3 } from "@axiom-lattice/protocols";
 
-// ../../node_modules/.pnpm/langchain@1.6.0_@langchain+core@1.3.2_@opentelemetry+api@1.9.1_@opentelemetry+exporter-_e9e367f3add88b95581927e1733bf88f/node_modules/langchain/dist/chat_models/universal.js
+// ../../node_modules/.pnpm/langchain@1.6.0_@langchain+core@1.3.2_@opentelemetry+api@1.9.1_@opentelemetry+exporter-_6b2dc0e1062c573b01467361cb243c19/node_modules/langchain/dist/chat_models/universal.js
 import { BaseChatModel } from "@langchain/core/language_models/chat_models";
 import { RunnableBinding, ensureConfig } from "@langchain/core/runnables";
 import { AsyncGeneratorWithSetup, IterableReadableStream } from "@langchain/core/utils/stream";
@@ -42724,7 +43118,7 @@ var MODEL_PROVIDER_CONFIG = {
 };
 var SUPPORTED_PROVIDERS = Object.keys(MODEL_PROVIDER_CONFIG);
 
-// ../../node_modules/.pnpm/langchain@1.6.0_@langchain+core@1.3.2_@opentelemetry+api@1.9.1_@opentelemetry+exporter-_e9e367f3add88b95581927e1733bf88f/node_modules/langchain/dist/tools/headless.js
+// ../../node_modules/.pnpm/langchain@1.6.0_@langchain+core@1.3.2_@opentelemetry+api@1.9.1_@opentelemetry+exporter-_6b2dc0e1062c573b01467361cb243c19/node_modules/langchain/dist/tools/headless.js
 import { tool } from "@langchain/core/tools";
 function createHeadlessTool(fields) {
   const { name, description, schema: schema2 } = fields;
@@ -42755,30 +43149,30 @@ var tool$1 = ((funcOrFields, fields) => {
   return tool(funcOrFields, fields);
 });
 
-// ../../node_modules/.pnpm/langchain@1.6.0_@langchain+core@1.3.2_@opentelemetry+api@1.9.1_@opentelemetry+exporter-_e9e367f3add88b95581927e1733bf88f/node_modules/langchain/dist/agents/errors.js
+// ../../node_modules/.pnpm/langchain@1.6.0_@langchain+core@1.3.2_@opentelemetry+api@1.9.1_@opentelemetry+exporter-_6b2dc0e1062c573b01467361cb243c19/node_modules/langchain/dist/agents/errors.js
 import { isGraphBubbleUp } from "@langchain/langgraph";
 
-// ../../node_modules/.pnpm/langchain@1.6.0_@langchain+core@1.3.2_@opentelemetry+api@1.9.1_@opentelemetry+exporter-_e9e367f3add88b95581927e1733bf88f/node_modules/langchain/dist/agents/responses.js
+// ../../node_modules/.pnpm/langchain@1.6.0_@langchain+core@1.3.2_@opentelemetry+api@1.9.1_@opentelemetry+exporter-_6b2dc0e1062c573b01467361cb243c19/node_modules/langchain/dist/agents/responses.js
 import { isInteropZodObject, isInteropZodSchema } from "@langchain/core/utils/types";
 import { Validator, toJsonSchema } from "@langchain/core/utils/json_schema";
 import { isSerializableSchema } from "@langchain/core/utils/standard_schema";
 
-// ../../node_modules/.pnpm/langchain@1.6.0_@langchain+core@1.3.2_@opentelemetry+api@1.9.1_@opentelemetry+exporter-_e9e367f3add88b95581927e1733bf88f/node_modules/langchain/dist/agents/middleware/utils.js
+// ../../node_modules/.pnpm/langchain@1.6.0_@langchain+core@1.3.2_@opentelemetry+api@1.9.1_@opentelemetry+exporter-_6b2dc0e1062c573b01467361cb243c19/node_modules/langchain/dist/agents/middleware/utils.js
 import { AIMessage, ToolMessage } from "@langchain/core/messages";
 import { isLangChainTool } from "@langchain/core/tools";
 import { convertToOpenAITool } from "@langchain/core/utils/function_calling";
 
-// ../../node_modules/.pnpm/langchain@1.6.0_@langchain+core@1.3.2_@opentelemetry+api@1.9.1_@opentelemetry+exporter-_e9e367f3add88b95581927e1733bf88f/node_modules/langchain/dist/agents/transformers/tool-call.js
+// ../../node_modules/.pnpm/langchain@1.6.0_@langchain+core@1.3.2_@opentelemetry+api@1.9.1_@opentelemetry+exporter-_6b2dc0e1062c573b01467361cb243c19/node_modules/langchain/dist/agents/transformers/tool-call.js
 import { ToolMessage as ToolMessage2 } from "@langchain/core/messages";
 import { StreamChannel } from "@langchain/langgraph";
 
-// ../../node_modules/.pnpm/langchain@1.6.0_@langchain+core@1.3.2_@opentelemetry+api@1.9.1_@opentelemetry+exporter-_e9e367f3add88b95581927e1733bf88f/node_modules/langchain/dist/agents/transformers/subagent.js
+// ../../node_modules/.pnpm/langchain@1.6.0_@langchain+core@1.3.2_@opentelemetry+api@1.9.1_@opentelemetry+exporter-_6b2dc0e1062c573b01467361cb243c19/node_modules/langchain/dist/agents/transformers/subagent.js
 import { StreamChannel as StreamChannel2, createMessagesTransformer } from "@langchain/langgraph";
 
-// ../../node_modules/.pnpm/langchain@1.6.0_@langchain+core@1.3.2_@opentelemetry+api@1.9.1_@opentelemetry+exporter-_e9e367f3add88b95581927e1733bf88f/node_modules/langchain/dist/agents/middleware/types.js
+// ../../node_modules/.pnpm/langchain@1.6.0_@langchain+core@1.3.2_@opentelemetry+api@1.9.1_@opentelemetry+exporter-_6b2dc0e1062c573b01467361cb243c19/node_modules/langchain/dist/agents/middleware/types.js
 var MIDDLEWARE_BRAND = Symbol.for("AgentMiddleware");
 
-// ../../node_modules/.pnpm/langchain@1.6.0_@langchain+core@1.3.2_@opentelemetry+api@1.9.1_@opentelemetry+exporter-_e9e367f3add88b95581927e1733bf88f/node_modules/langchain/dist/agents/middleware.js
+// ../../node_modules/.pnpm/langchain@1.6.0_@langchain+core@1.3.2_@opentelemetry+api@1.9.1_@opentelemetry+exporter-_6b2dc0e1062c573b01467361cb243c19/node_modules/langchain/dist/agents/middleware.js
 function createMiddleware(config) {
   return {
     [MIDDLEWARE_BRAND]: true,
@@ -42796,25 +43190,25 @@ function createMiddleware(config) {
   };
 }
 
-// ../../node_modules/.pnpm/langchain@1.6.0_@langchain+core@1.3.2_@opentelemetry+api@1.9.1_@opentelemetry+exporter-_e9e367f3add88b95581927e1733bf88f/node_modules/langchain/dist/agents/tests/utils.js
+// ../../node_modules/.pnpm/langchain@1.6.0_@langchain+core@1.3.2_@opentelemetry+api@1.9.1_@opentelemetry+exporter-_6b2dc0e1062c573b01467361cb243c19/node_modules/langchain/dist/agents/tests/utils.js
 import { AIMessage as AIMessage2, HumanMessage } from "@langchain/core/messages";
 import { BaseChatModel as BaseChatModel2 } from "@langchain/core/language_models/chat_models";
 import { RunnableLambda } from "@langchain/core/runnables";
 import "@langchain/core/tools";
 
-// ../../node_modules/.pnpm/@langchain+langgraph-checkpoint@1.2.1_@langchain+core@1.3.2_@opentelemetry+api@1.9.1_@o_3c2d31ea38adcb814a776743edbe30f6/node_modules/@langchain/langgraph-checkpoint/dist/id.js
+// ../../node_modules/.pnpm/@langchain+langgraph-checkpoint@1.2.1_@langchain+core@1.3.2_@opentelemetry+api@1.9.1_@o_21f4cb933fdb001300ead1c867120b5d/node_modules/@langchain/langgraph-checkpoint/dist/id.js
 import { v5, v6 } from "@langchain/core/utils/uuid";
 
-// ../../node_modules/.pnpm/@langchain+langgraph-checkpoint@1.2.1_@langchain+core@1.3.2_@opentelemetry+api@1.9.1_@o_3c2d31ea38adcb814a776743edbe30f6/node_modules/@langchain/langgraph-checkpoint/dist/serde/types.js
+// ../../node_modules/.pnpm/@langchain+langgraph-checkpoint@1.2.1_@langchain+core@1.3.2_@opentelemetry+api@1.9.1_@o_21f4cb933fdb001300ead1c867120b5d/node_modules/@langchain/langgraph-checkpoint/dist/serde/types.js
 var ERROR = "__error__";
 var SCHEDULED = "__scheduled__";
 var INTERRUPT = "__interrupt__";
 var RESUME = "__resume__";
 
-// ../../node_modules/.pnpm/@langchain+langgraph-checkpoint@1.2.1_@langchain+core@1.3.2_@opentelemetry+api@1.9.1_@o_3c2d31ea38adcb814a776743edbe30f6/node_modules/@langchain/langgraph-checkpoint/dist/serde/jsonplus.js
+// ../../node_modules/.pnpm/@langchain+langgraph-checkpoint@1.2.1_@langchain+core@1.3.2_@opentelemetry+api@1.9.1_@o_21f4cb933fdb001300ead1c867120b5d/node_modules/@langchain/langgraph-checkpoint/dist/serde/jsonplus.js
 import { load } from "@langchain/core/load";
 
-// ../../node_modules/.pnpm/@langchain+langgraph-checkpoint@1.2.1_@langchain+core@1.3.2_@opentelemetry+api@1.9.1_@o_3c2d31ea38adcb814a776743edbe30f6/node_modules/@langchain/langgraph-checkpoint/dist/base.js
+// ../../node_modules/.pnpm/@langchain+langgraph-checkpoint@1.2.1_@langchain+core@1.3.2_@opentelemetry+api@1.9.1_@o_21f4cb933fdb001300ead1c867120b5d/node_modules/@langchain/langgraph-checkpoint/dist/base.js
 var WRITES_IDX_MAP = {
   [ERROR]: -1,
   [SCHEDULED]: -2,
@@ -42822,52 +43216,52 @@ var WRITES_IDX_MAP = {
   [RESUME]: -4
 };
 
-// ../../node_modules/.pnpm/langchain@1.6.0_@langchain+core@1.3.2_@opentelemetry+api@1.9.1_@opentelemetry+exporter-_e9e367f3add88b95581927e1733bf88f/node_modules/langchain/dist/agents/tests/utils.js
+// ../../node_modules/.pnpm/langchain@1.6.0_@langchain+core@1.3.2_@opentelemetry+api@1.9.1_@opentelemetry+exporter-_6b2dc0e1062c573b01467361cb243c19/node_modules/langchain/dist/agents/tests/utils.js
 import "zod/v3";
 
-// ../../node_modules/.pnpm/langchain@1.6.0_@langchain+core@1.3.2_@opentelemetry+api@1.9.1_@opentelemetry+exporter-_e9e367f3add88b95581927e1733bf88f/node_modules/langchain/dist/agents/annotation.js
+// ../../node_modules/.pnpm/langchain@1.6.0_@langchain+core@1.3.2_@opentelemetry+api@1.9.1_@opentelemetry+exporter-_6b2dc0e1062c573b01467361cb243c19/node_modules/langchain/dist/agents/annotation.js
 import { MessagesValue, ReducedValue, StateSchema, UntrackedValue } from "@langchain/langgraph";
 import { schemaMetaRegistry } from "@langchain/langgraph/zod";
 import { getInteropZodObjectShape, isInteropZodObject as isInteropZodObject2, isZodSchemaV4 } from "@langchain/core/utils/types";
 
-// ../../node_modules/.pnpm/langchain@1.6.0_@langchain+core@1.3.2_@opentelemetry+api@1.9.1_@opentelemetry+exporter-_e9e367f3add88b95581927e1733bf88f/node_modules/langchain/dist/agents/utils.js
+// ../../node_modules/.pnpm/langchain@1.6.0_@langchain+core@1.3.2_@opentelemetry+api@1.9.1_@opentelemetry+exporter-_6b2dc0e1062c573b01467361cb243c19/node_modules/langchain/dist/agents/utils.js
 import { AIMessage as AIMessage3, AIMessageChunk, SystemMessage, ToolMessage as ToolMessage3 } from "@langchain/core/messages";
 import { Runnable, RunnableBinding as RunnableBinding2, RunnableSequence } from "@langchain/core/runnables";
 import { StateSchema as StateSchema2, isCommand } from "@langchain/langgraph";
 import { interopParse, isInteropZodSchema as isInteropZodSchema2 } from "@langchain/core/utils/types";
 
-// ../../node_modules/.pnpm/langchain@1.6.0_@langchain+core@1.3.2_@opentelemetry+api@1.9.1_@opentelemetry+exporter-_e9e367f3add88b95581927e1733bf88f/node_modules/langchain/dist/agents/nodes/utils.js
+// ../../node_modules/.pnpm/langchain@1.6.0_@langchain+core@1.3.2_@opentelemetry+api@1.9.1_@opentelemetry+exporter-_6b2dc0e1062c573b01467361cb243c19/node_modules/langchain/dist/agents/nodes/utils.js
 import { END, ReducedValue as ReducedValue2, StateSchema as StateSchema3 } from "@langchain/langgraph";
 import { getInteropZodObjectShape as getInteropZodObjectShape2, interopSafeParseAsync, interopZodObjectMakeFieldsOptional, interopZodObjectPartial, isInteropZodObject as isInteropZodObject3, isZodSchemaV4 as isZodSchemaV42 } from "@langchain/core/utils/types";
 import { z as z15 } from "zod/v4";
 
-// ../../node_modules/.pnpm/langchain@1.6.0_@langchain+core@1.3.2_@opentelemetry+api@1.9.1_@opentelemetry+exporter-_e9e367f3add88b95581927e1733bf88f/node_modules/langchain/dist/agents/RunnableCallable.js
+// ../../node_modules/.pnpm/langchain@1.6.0_@langchain+core@1.3.2_@opentelemetry+api@1.9.1_@opentelemetry+exporter-_6b2dc0e1062c573b01467361cb243c19/node_modules/langchain/dist/agents/RunnableCallable.js
 import { Runnable as Runnable2, mergeConfigs } from "@langchain/core/runnables";
 import { AsyncLocalStorageProviderSingleton } from "@langchain/core/singletons";
 
-// ../../node_modules/.pnpm/langchain@1.6.0_@langchain+core@1.3.2_@opentelemetry+api@1.9.1_@opentelemetry+exporter-_e9e367f3add88b95581927e1733bf88f/node_modules/langchain/dist/agents/withAgentName.js
+// ../../node_modules/.pnpm/langchain@1.6.0_@langchain+core@1.3.2_@opentelemetry+api@1.9.1_@opentelemetry+exporter-_6b2dc0e1062c573b01467361cb243c19/node_modules/langchain/dist/agents/withAgentName.js
 import { RunnableLambda as RunnableLambda2, RunnableSequence as RunnableSequence2 } from "@langchain/core/runnables";
 
-// ../../node_modules/.pnpm/langchain@1.6.0_@langchain+core@1.3.2_@opentelemetry+api@1.9.1_@opentelemetry+exporter-_e9e367f3add88b95581927e1733bf88f/node_modules/langchain/dist/agents/nodes/AgentNode.js
+// ../../node_modules/.pnpm/langchain@1.6.0_@langchain+core@1.3.2_@opentelemetry+api@1.9.1_@opentelemetry+exporter-_6b2dc0e1062c573b01467361cb243c19/node_modules/langchain/dist/agents/nodes/AgentNode.js
 import { AIMessage as AIMessage4, SystemMessage as SystemMessage2, ToolMessage as ToolMessage4 } from "@langchain/core/messages";
 import { raceWithSignal } from "@langchain/core/runnables";
 import { Command, isCommand as isCommand2 } from "@langchain/langgraph";
 import { getSchemaDescription, interopParse as interopParse2 } from "@langchain/core/utils/types";
 
-// ../../node_modules/.pnpm/langchain@1.6.0_@langchain+core@1.3.2_@opentelemetry+api@1.9.1_@opentelemetry+exporter-_e9e367f3add88b95581927e1733bf88f/node_modules/langchain/dist/agents/nodes/ToolNode.js
+// ../../node_modules/.pnpm/langchain@1.6.0_@langchain+core@1.3.2_@opentelemetry+api@1.9.1_@opentelemetry+exporter-_6b2dc0e1062c573b01467361cb243c19/node_modules/langchain/dist/agents/nodes/ToolNode.js
 import { AIMessage as AIMessage5, BaseMessage, ToolMessage as ToolMessage5 } from "@langchain/core/messages";
 import { ToolInputParsingException } from "@langchain/core/tools";
 import { Command as Command2, Send, isCommand as isCommand3, isGraphDrained, isGraphInterrupt } from "@langchain/langgraph";
 
-// ../../node_modules/.pnpm/langchain@1.6.0_@langchain+core@1.3.2_@opentelemetry+api@1.9.1_@opentelemetry+exporter-_e9e367f3add88b95581927e1733bf88f/node_modules/langchain/dist/agents/nodes/middleware.js
+// ../../node_modules/.pnpm/langchain@1.6.0_@langchain+core@1.3.2_@opentelemetry+api@1.9.1_@opentelemetry+exporter-_6b2dc0e1062c573b01467361cb243c19/node_modules/langchain/dist/agents/nodes/middleware.js
 import { getInteropZodObjectShape as getInteropZodObjectShape3, interopParse as interopParse3, isInteropZodObject as isInteropZodObject4 } from "@langchain/core/utils/types";
 
-// ../../node_modules/.pnpm/langchain@1.6.0_@langchain+core@1.3.2_@opentelemetry+api@1.9.1_@opentelemetry+exporter-_e9e367f3add88b95581927e1733bf88f/node_modules/langchain/dist/agents/ReactAgent.js
+// ../../node_modules/.pnpm/langchain@1.6.0_@langchain+core@1.3.2_@opentelemetry+api@1.9.1_@opentelemetry+exporter-_6b2dc0e1062c573b01467361cb243c19/node_modules/langchain/dist/agents/ReactAgent.js
 import { AIMessage as AIMessage6, ToolMessage as ToolMessage6 } from "@langchain/core/messages";
 import { mergeConfigs as mergeConfigs2 } from "@langchain/core/runnables";
 import { END as END2, START, Send as Send2, StateGraph, isCommand as isCommand4 } from "@langchain/langgraph";
 
-// ../../node_modules/.pnpm/langchain@1.6.0_@langchain+core@1.3.2_@opentelemetry+api@1.9.1_@opentelemetry+exporter-_e9e367f3add88b95581927e1733bf88f/node_modules/langchain/dist/agents/middleware/hitl.js
+// ../../node_modules/.pnpm/langchain@1.6.0_@langchain+core@1.3.2_@opentelemetry+api@1.9.1_@opentelemetry+exporter-_6b2dc0e1062c573b01467361cb243c19/node_modules/langchain/dist/agents/middleware/hitl.js
 import { AIMessage as AIMessage7, ToolMessage as ToolMessage7 } from "@langchain/core/messages";
 import { Command as Command3, interrupt, isCommand as isCommand5 } from "@langchain/langgraph";
 import { interopParse as interopParse4, interopZodTransformInputSchema, isZodSchemaV4 as isZodSchemaV43 } from "@langchain/core/utils/types";
@@ -42996,7 +43390,7 @@ var contextSchema = z$1.object({
   descriptionPrefix: z$1.string().default("Tool execution requires approval")
 });
 
-// ../../node_modules/.pnpm/langchain@1.6.0_@langchain+core@1.3.2_@opentelemetry+api@1.9.1_@opentelemetry+exporter-_e9e367f3add88b95581927e1733bf88f/node_modules/langchain/dist/agents/middleware/constants.js
+// ../../node_modules/.pnpm/langchain@1.6.0_@langchain+core@1.3.2_@opentelemetry+api@1.9.1_@opentelemetry+exporter-_6b2dc0e1062c573b01467361cb243c19/node_modules/langchain/dist/agents/middleware/constants.js
 import { z as z17 } from "zod/v3";
 import { getRetryable } from "@langchain/core/errors";
 var RetrySchema = z17.object({
@@ -43033,7 +43427,7 @@ var RetrySchema = z17.object({
   jitter: z17.boolean().default(true)
 });
 
-// ../../node_modules/.pnpm/langchain@1.6.0_@langchain+core@1.3.2_@opentelemetry+api@1.9.1_@opentelemetry+exporter-_e9e367f3add88b95581927e1733bf88f/node_modules/langchain/dist/agents/middleware/summarization.js
+// ../../node_modules/.pnpm/langchain@1.6.0_@langchain+core@1.3.2_@opentelemetry+api@1.9.1_@opentelemetry+exporter-_6b2dc0e1062c573b01467361cb243c19/node_modules/langchain/dist/agents/middleware/summarization.js
 import { AIMessage as AIMessage8, HumanMessage as HumanMessage2, RemoveMessage, SystemMessage as SystemMessage3, ToolMessage as ToolMessage8, getBufferString, trimMessages } from "@langchain/core/messages";
 import { mergeConfigs as mergeConfigs3, pickRunnableConfigKeys } from "@langchain/core/runnables";
 import { REMOVE_ALL_MESSAGES } from "@langchain/langgraph";
@@ -43160,10 +43554,10 @@ var contextSchema2 = z$12.object({
   messagesToKeep: z$12.number().optional()
 });
 
-// ../../node_modules/.pnpm/langchain@1.6.0_@langchain+core@1.3.2_@opentelemetry+api@1.9.1_@opentelemetry+exporter-_e9e367f3add88b95581927e1733bf88f/node_modules/langchain/dist/agents/middleware/dynamicSystemPrompt.js
+// ../../node_modules/.pnpm/langchain@1.6.0_@langchain+core@1.3.2_@opentelemetry+api@1.9.1_@opentelemetry+exporter-_6b2dc0e1062c573b01467361cb243c19/node_modules/langchain/dist/agents/middleware/dynamicSystemPrompt.js
 import { SystemMessage as SystemMessage4 } from "@langchain/core/messages";
 
-// ../../node_modules/.pnpm/langchain@1.6.0_@langchain+core@1.3.2_@opentelemetry+api@1.9.1_@opentelemetry+exporter-_e9e367f3add88b95581927e1733bf88f/node_modules/langchain/dist/agents/middleware/llmToolSelector.js
+// ../../node_modules/.pnpm/langchain@1.6.0_@langchain+core@1.3.2_@opentelemetry+api@1.9.1_@opentelemetry+exporter-_6b2dc0e1062c573b01467361cb243c19/node_modules/langchain/dist/agents/middleware/llmToolSelector.js
 import { HumanMessage as HumanMessage3 } from "@langchain/core/messages";
 import { mergeConfigs as mergeConfigs4, pickRunnableConfigKeys as pickRunnableConfigKeys2 } from "@langchain/core/runnables";
 import { z as z19 } from "zod/v3";
@@ -43189,7 +43583,7 @@ var LLMToolSelectorOptionsSchema = z19.object({
   alwaysInclude: z19.array(z19.string()).optional()
 });
 
-// ../../node_modules/.pnpm/langchain@1.6.0_@langchain+core@1.3.2_@opentelemetry+api@1.9.1_@opentelemetry+exporter-_e9e367f3add88b95581927e1733bf88f/node_modules/langchain/dist/agents/middleware/pii.js
+// ../../node_modules/.pnpm/langchain@1.6.0_@langchain+core@1.3.2_@opentelemetry+api@1.9.1_@opentelemetry+exporter-_6b2dc0e1062c573b01467361cb243c19/node_modules/langchain/dist/agents/middleware/pii.js
 import { AIMessage as AIMessage9, HumanMessage as HumanMessage4, ToolMessage as ToolMessage9 } from "@langchain/core/messages";
 import { z as z20 } from "zod/v3";
 import { sha256 } from "@langchain/core/utils/hash";
@@ -43208,7 +43602,7 @@ var contextSchema3 = z20.object({
   applyToToolResults: z20.boolean().optional()
 });
 
-// ../../node_modules/.pnpm/langchain@1.6.0_@langchain+core@1.3.2_@opentelemetry+api@1.9.1_@opentelemetry+exporter-_e9e367f3add88b95581927e1733bf88f/node_modules/langchain/dist/agents/middleware/piiRedaction.js
+// ../../node_modules/.pnpm/langchain@1.6.0_@langchain+core@1.3.2_@opentelemetry+api@1.9.1_@opentelemetry+exporter-_6b2dc0e1062c573b01467361cb243c19/node_modules/langchain/dist/agents/middleware/piiRedaction.js
 import { AIMessage as AIMessage10, HumanMessage as HumanMessage5, RemoveMessage as RemoveMessage2, SystemMessage as SystemMessage5, ToolMessage as ToolMessage10 } from "@langchain/core/messages";
 import { z as z21 } from "zod/v3";
 var contextSchema4 = z21.object({
@@ -43219,10 +43613,10 @@ var contextSchema4 = z21.object({
   rules: z21.record(z21.string(), z21.instanceof(RegExp).describe("Regular expression pattern to match PII")).optional()
 });
 
-// ../../node_modules/.pnpm/langchain@1.6.0_@langchain+core@1.3.2_@opentelemetry+api@1.9.1_@opentelemetry+exporter-_e9e367f3add88b95581927e1733bf88f/node_modules/langchain/dist/agents/middleware/contextEditing.js
+// ../../node_modules/.pnpm/langchain@1.6.0_@langchain+core@1.3.2_@opentelemetry+api@1.9.1_@opentelemetry+exporter-_6b2dc0e1062c573b01467361cb243c19/node_modules/langchain/dist/agents/middleware/contextEditing.js
 import { AIMessage as AIMessage11, SystemMessage as SystemMessage6, ToolMessage as ToolMessage11 } from "@langchain/core/messages";
 
-// ../../node_modules/.pnpm/langchain@1.6.0_@langchain+core@1.3.2_@opentelemetry+api@1.9.1_@opentelemetry+exporter-_e9e367f3add88b95581927e1733bf88f/node_modules/langchain/dist/agents/middleware/toolCallLimit.js
+// ../../node_modules/.pnpm/langchain@1.6.0_@langchain+core@1.3.2_@opentelemetry+api@1.9.1_@opentelemetry+exporter-_6b2dc0e1062c573b01467361cb243c19/node_modules/langchain/dist/agents/middleware/toolCallLimit.js
 import { AIMessage as AIMessage12, ToolMessage as ToolMessage12 } from "@langchain/core/messages";
 import { z as z22 } from "zod/v4";
 import { z as z$13 } from "zod/v3";
@@ -43265,7 +43659,7 @@ var stateSchema = z$13.object({
   runToolCallCount: z$13.record(z$13.string(), z$13.number()).default({})
 });
 
-// ../../node_modules/.pnpm/langchain@1.6.0_@langchain+core@1.3.2_@opentelemetry+api@1.9.1_@opentelemetry+exporter-_e9e367f3add88b95581927e1733bf88f/node_modules/langchain/dist/agents/middleware/todoListMiddleware.js
+// ../../node_modules/.pnpm/langchain@1.6.0_@langchain+core@1.3.2_@opentelemetry+api@1.9.1_@opentelemetry+exporter-_6b2dc0e1062c573b01467361cb243c19/node_modules/langchain/dist/agents/middleware/todoListMiddleware.js
 import { AIMessage as AIMessage13, ToolMessage as ToolMessage13 } from "@langchain/core/messages";
 import { tool as tool2 } from "@langchain/core/tools";
 import { Command as Command4 } from "@langchain/langgraph";
@@ -43281,7 +43675,7 @@ var TodoSchema = z23.object({
 });
 var stateSchema2 = z23.object({ todos: z23.array(TodoSchema).default([]) });
 
-// ../../node_modules/.pnpm/langchain@1.6.0_@langchain+core@1.3.2_@opentelemetry+api@1.9.1_@opentelemetry+exporter-_e9e367f3add88b95581927e1733bf88f/node_modules/langchain/dist/agents/middleware/modelCallLimit.js
+// ../../node_modules/.pnpm/langchain@1.6.0_@langchain+core@1.3.2_@opentelemetry+api@1.9.1_@opentelemetry+exporter-_6b2dc0e1062c573b01467361cb243c19/node_modules/langchain/dist/agents/middleware/modelCallLimit.js
 import { AIMessage as AIMessage14 } from "@langchain/core/messages";
 import { z as z24 } from "zod/v3";
 var contextSchema5 = z24.object({
@@ -43306,10 +43700,10 @@ var stateSchema3 = z24.object({
   runModelCallCount: z24.number().default(0)
 });
 
-// ../../node_modules/.pnpm/langchain@1.6.0_@langchain+core@1.3.2_@opentelemetry+api@1.9.1_@opentelemetry+exporter-_e9e367f3add88b95581927e1733bf88f/node_modules/langchain/dist/agents/middleware/error.js
+// ../../node_modules/.pnpm/langchain@1.6.0_@langchain+core@1.3.2_@opentelemetry+api@1.9.1_@opentelemetry+exporter-_6b2dc0e1062c573b01467361cb243c19/node_modules/langchain/dist/agents/middleware/error.js
 import { z as z25 } from "zod/v4";
 
-// ../../node_modules/.pnpm/langchain@1.6.0_@langchain+core@1.3.2_@opentelemetry+api@1.9.1_@opentelemetry+exporter-_e9e367f3add88b95581927e1733bf88f/node_modules/langchain/dist/agents/middleware/modelRetry.js
+// ../../node_modules/.pnpm/langchain@1.6.0_@langchain+core@1.3.2_@opentelemetry+api@1.9.1_@opentelemetry+exporter-_6b2dc0e1062c573b01467361cb243c19/node_modules/langchain/dist/agents/middleware/modelRetry.js
 import { AIMessage as AIMessage15 } from "@langchain/core/messages";
 import { z as z26 } from "zod/v3";
 var ModelRetryMiddlewareOptionsSchema = z26.object({
@@ -43328,7 +43722,7 @@ var ModelRetryMiddlewareOptionsSchema = z26.object({
   ]).default("continue")
 }).merge(RetrySchema);
 
-// ../../node_modules/.pnpm/langchain@1.6.0_@langchain+core@1.3.2_@opentelemetry+api@1.9.1_@opentelemetry+exporter-_e9e367f3add88b95581927e1733bf88f/node_modules/langchain/dist/agents/middleware/toolRetry.js
+// ../../node_modules/.pnpm/langchain@1.6.0_@langchain+core@1.3.2_@opentelemetry+api@1.9.1_@opentelemetry+exporter-_6b2dc0e1062c573b01467361cb243c19/node_modules/langchain/dist/agents/middleware/toolRetry.js
 import { ToolMessage as ToolMessage14 } from "@langchain/core/messages";
 import { isGraphBubbleUp as isGraphBubbleUp2 } from "@langchain/langgraph";
 import { z as z27 } from "zod/v3";
@@ -43364,21 +43758,21 @@ var ToolRetryMiddlewareOptionsSchema = z27.object({
   ]).default("continue")
 }).merge(RetrySchema);
 
-// ../../node_modules/.pnpm/langchain@1.6.0_@langchain+core@1.3.2_@opentelemetry+api@1.9.1_@opentelemetry+exporter-_e9e367f3add88b95581927e1733bf88f/node_modules/langchain/dist/agents/middleware/toolError.js
+// ../../node_modules/.pnpm/langchain@1.6.0_@langchain+core@1.3.2_@opentelemetry+api@1.9.1_@opentelemetry+exporter-_6b2dc0e1062c573b01467361cb243c19/node_modules/langchain/dist/agents/middleware/toolError.js
 import { ToolMessage as ToolMessage15 } from "@langchain/core/messages";
 import { isGraphBubbleUp as isGraphBubbleUp3 } from "@langchain/langgraph";
 
-// ../../node_modules/.pnpm/langchain@1.6.0_@langchain+core@1.3.2_@opentelemetry+api@1.9.1_@opentelemetry+exporter-_e9e367f3add88b95581927e1733bf88f/node_modules/langchain/dist/agents/middleware/toolEmulator.js
+// ../../node_modules/.pnpm/langchain@1.6.0_@langchain+core@1.3.2_@opentelemetry+api@1.9.1_@opentelemetry+exporter-_6b2dc0e1062c573b01467361cb243c19/node_modules/langchain/dist/agents/middleware/toolEmulator.js
 import { HumanMessage as HumanMessage6, ToolMessage as ToolMessage16 } from "@langchain/core/messages";
 import { mergeConfigs as mergeConfigs5, pickRunnableConfigKeys as pickRunnableConfigKeys3 } from "@langchain/core/runnables";
 
-// ../../node_modules/.pnpm/langchain@1.6.0_@langchain+core@1.3.2_@opentelemetry+api@1.9.1_@opentelemetry+exporter-_e9e367f3add88b95581927e1733bf88f/node_modules/langchain/dist/agents/middleware/providerToolSearch.js
+// ../../node_modules/.pnpm/langchain@1.6.0_@langchain+core@1.3.2_@opentelemetry+api@1.9.1_@opentelemetry+exporter-_6b2dc0e1062c573b01467361cb243c19/node_modules/langchain/dist/agents/middleware/providerToolSearch.js
 import { isLangChainTool as isLangChainTool2 } from "@langchain/core/utils/function_calling";
 
-// ../../node_modules/.pnpm/langchain@1.6.0_@langchain+core@1.3.2_@opentelemetry+api@1.9.1_@opentelemetry+exporter-_e9e367f3add88b95581927e1733bf88f/node_modules/langchain/dist/agents/middleware/provider/openai/moderation.js
+// ../../node_modules/.pnpm/langchain@1.6.0_@langchain+core@1.3.2_@opentelemetry+api@1.9.1_@opentelemetry+exporter-_6b2dc0e1062c573b01467361cb243c19/node_modules/langchain/dist/agents/middleware/provider/openai/moderation.js
 import { AIMessage as AIMessage16, HumanMessage as HumanMessage7, ToolMessage as ToolMessage17 } from "@langchain/core/messages";
 
-// ../../node_modules/.pnpm/langchain@1.6.0_@langchain+core@1.3.2_@opentelemetry+api@1.9.1_@opentelemetry+exporter-_e9e367f3add88b95581927e1733bf88f/node_modules/langchain/dist/agents/middleware/provider/anthropic/promptCaching.js
+// ../../node_modules/.pnpm/langchain@1.6.0_@langchain+core@1.3.2_@opentelemetry+api@1.9.1_@opentelemetry+exporter-_6b2dc0e1062c573b01467361cb243c19/node_modules/langchain/dist/agents/middleware/provider/anthropic/promptCaching.js
 import { z as z28 } from "zod/v3";
 var contextSchema6 = z28.object({
   /**
@@ -43410,7 +43804,7 @@ var contextSchema6 = z28.object({
   ]).optional()
 });
 
-// ../../node_modules/.pnpm/langchain@1.6.0_@langchain+core@1.3.2_@opentelemetry+api@1.9.1_@opentelemetry+exporter-_e9e367f3add88b95581927e1733bf88f/node_modules/langchain/dist/agents/middleware/provider/aws/promptCaching.js
+// ../../node_modules/.pnpm/langchain@1.6.0_@langchain+core@1.3.2_@opentelemetry+api@1.9.1_@opentelemetry+exporter-_6b2dc0e1062c573b01467361cb243c19/node_modules/langchain/dist/agents/middleware/provider/aws/promptCaching.js
 import { z as z29 } from "zod/v3";
 var contextSchema7 = z29.object({
   /**
@@ -43442,10 +43836,10 @@ var contextSchema7 = z29.object({
   ]).optional()
 });
 
-// ../../node_modules/.pnpm/langchain@1.6.0_@langchain+core@1.3.2_@opentelemetry+api@1.9.1_@opentelemetry+exporter-_e9e367f3add88b95581927e1733bf88f/node_modules/langchain/dist/agents/middleware/provider/openai/autoMode.js
+// ../../node_modules/.pnpm/langchain@1.6.0_@langchain+core@1.3.2_@opentelemetry+api@1.9.1_@opentelemetry+exporter-_6b2dc0e1062c573b01467361cb243c19/node_modules/langchain/dist/agents/middleware/provider/openai/autoMode.js
 import { ToolMessage as ToolMessage18 } from "@langchain/core/messages";
 
-// ../../node_modules/.pnpm/langchain@1.6.0_@langchain+core@1.3.2_@opentelemetry+api@1.9.1_@opentelemetry+exporter-_e9e367f3add88b95581927e1733bf88f/node_modules/langchain/dist/agents/middleware/provider/openai/modelRouter.js
+// ../../node_modules/.pnpm/langchain@1.6.0_@langchain+core@1.3.2_@opentelemetry+api@1.9.1_@opentelemetry+exporter-_6b2dc0e1062c573b01467361cb243c19/node_modules/langchain/dist/agents/middleware/provider/openai/modelRouter.js
 import { HumanMessage as HumanMessage8 } from "@langchain/core/messages";
 import { z as z30 } from "zod/v4";
 var routeSchema = z30.object({
@@ -43457,24 +43851,27 @@ var routeSchema = z30.object({
   }))
 });
 
-// ../../node_modules/.pnpm/langchain@1.6.0_@langchain+core@1.3.2_@opentelemetry+api@1.9.1_@opentelemetry+exporter-_e9e367f3add88b95581927e1733bf88f/node_modules/langchain/dist/index.js
+// ../../node_modules/.pnpm/langchain@1.6.0_@langchain+core@1.3.2_@opentelemetry+api@1.9.1_@opentelemetry+exporter-_6b2dc0e1062c573b01467361cb243c19/node_modules/langchain/dist/index.js
 import { AIMessage as AIMessage17, AIMessageChunk as AIMessageChunk2, BaseMessage as BaseMessage2, BaseMessageChunk, HumanMessage as HumanMessage9, HumanMessageChunk, SystemMessage as SystemMessage7, SystemMessageChunk, ToolMessage as ToolMessage19, ToolMessageChunk, filterMessages, trimMessages as trimMessages2 } from "@langchain/core/messages";
 import { DynamicStructuredTool, DynamicTool, StructuredTool, Tool } from "@langchain/core/tools";
 import { context } from "@langchain/core/utils/context";
 import { InMemoryStore as InMemoryStore2 } from "@langchain/core/stores";
-import { Document } from "@langchain/core/documents";
+import { Document as Document2 } from "@langchain/core/documents";
 import { fakeModel, langchainMatchers } from "@langchain/core/testing";
 
 // src/services/platform-ops/PlatformOpsTools.ts
 import { randomUUID as randomUUID41 } from "crypto";
 import { isIP as isIP2 } from "net";
 import { GraphInterrupt, interrupt as interrupt2 } from "@langchain/langgraph";
-import { genUIMarkdown } from "@axiom-lattice/core";
+import { appendUiFence, genUIMarkdown } from "@axiom-lattice/core";
 import { z as z31 } from "zod";
 import {
+  MAX_CUSTOM_CSS_LENGTH as MAX_CUSTOM_CSS_LENGTH2,
   PLATFORM_TENANT_PROTECTED_ERROR as PLATFORM_TENANT_PROTECTED_ERROR7,
   isPlatformTenantId as isPlatformTenantId8,
-  normalizeAllowedPrivateHosts as normalizeAllowedPrivateHosts2
+  normalizeAllowedPrivateHosts as normalizeAllowedPrivateHosts2,
+  normalizeBrandingHost as normalizeBrandingHost2,
+  validateCustomCss as validateCustomCss2
 } from "@axiom-lattice/protocols";
 import {
   assertSafeEndpointSyntax as assertSafeEndpointSyntax3,
@@ -43483,11 +43880,92 @@ import {
   probeOidcProvider as probeOidcProvider2
 } from "@axiom-lattice/auth-oidc";
 import { getStoreLattice as getStoreLattice43 } from "@axiom-lattice/core";
+
+// src/services/platform-ops/loginPreviewApp.ts
+var LOGIN_PREVIEW_UI_RESOURCE = "ui://platform-ops/login-preview";
+var LOGIN_PREVIEW_APP_HTML = `<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="utf-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1" />
+    <style>
+      html, body { margin: 0; height: 100%; font-family: Inter, system-ui, sans-serif; }
+      iframe { width: 100%; height: 480px; border: 0; display: block; border-radius: 12px; }
+      .bar { display:flex; justify-content:space-between; align-items:center; padding:8px 12px; font-size:12px; color:#667085; }
+      a { color:#5b50c6; }
+    </style>
+  </head>
+  <body>
+    <div class="bar"><span>Login preview</span><a id="open" target="_blank" rel="noreferrer">Open in new tab</a></div>
+    <iframe id="preview"></iframe>
+    <script>
+      (function () {
+        var payload = null;
+        var frame = document.getElementById("preview");
+        var open = document.getElementById("open");
+
+        function apply(data) {
+          if (!data || !data.previewUrl) return;
+          payload = data;
+          open.href = data.previewUrl;
+          frame.src = data.previewUrl;
+        }
+
+        function sendPayload() {
+          if (!payload || !frame.contentWindow) return;
+          frame.contentWindow.postMessage({
+            type: "axiom:branding-preview",
+            contract: 1,
+            nonce: payload.nonce,
+            surface: payload.surface,
+            branding: payload.branding,
+            customCss: payload.customCss
+          }, payload.origin);
+        }
+
+        frame.addEventListener("load", sendPayload);
+
+        window.addEventListener("message", function (event) {
+          var data = event.data;
+          if (!data || typeof data !== "object") return;
+          if (data.type === "axiom:branding-preview-ready" && data.contract === 1) {
+            if (event.source === frame.contentWindow) sendPayload();
+            return;
+          }
+          if (data.method === "ui/notifications/tool-result") {
+            var params = data.params || {};
+            var structured = params.structuredContent;
+            if (!structured && Array.isArray(params.content)) {
+              for (var i = 0; i < params.content.length; i += 1) {
+                var block = params.content[i];
+                if (block && block.type === "text" && typeof block.text === "string") {
+                  try {
+                    var parsed = JSON.parse(block.text);
+                    if (parsed && parsed.data) structured = parsed.data;
+                  } catch (ignored) {}
+                }
+              }
+            }
+            apply(structured || {});
+          }
+        });
+
+        window.parent.postMessage({ jsonrpc: "2.0", id: 1, method: "ui/initialize", params: { protocolVersion: "2025-01-01" } }, "*");
+        window.parent.postMessage({ jsonrpc: "2.0", method: "ui/notifications/initialized" }, "*");
+      })();
+    </script>
+  </body>
+</html>`;
+
+// src/services/platform-ops/PlatformOpsTools.ts
 var PLATFORM_ROLE_REQUIRED = "PLATFORM_ROLE_REQUIRED";
 var PLATFORM_OPS_RATE_LIMITED = "PLATFORM_OPS_RATE_LIMITED";
 var PLATFORM_OPS_DEPENDENCY_UNAVAILABLE = "PLATFORM_OPS_DEPENDENCY_UNAVAILABLE";
 var PLATFORM_ENVIRONMENT_UNAVAILABLE = "PLATFORM_ENVIRONMENT_UNAVAILABLE";
 var PLATFORM_BRANDING_UNAVAILABLE = "PLATFORM_BRANDING_UNAVAILABLE";
+var BRANDING_DOMAIN_NOT_FOUND = "BRANDING_DOMAIN_NOT_FOUND";
+var AUTH_PREVIEW_UNAVAILABLE = "AUTH_PREVIEW_UNAVAILABLE";
+var PLATFORM_OPS_UI_PLUGIN_TYPE = "platform-ops";
 var PlatformOpsToolError = class extends Error {
   constructor(code, message) {
     super(message ?? code);
@@ -44942,7 +45420,7 @@ var createOidcProviderSchema = z31.object({
   displayName: z31.string().trim().min(1),
   issuer: z31.string().trim().min(1),
   clientId: z31.string().trim().min(1),
-  clientSecret: z31.string().min(1),
+  clientSecret: z31.string().optional(),
   scopes: z31.string().optional(),
   enabled: z31.boolean().optional(),
   jitProvisioning: z31.boolean().optional(),
@@ -44967,7 +45445,7 @@ var testOidcProviderSchema = z31.object({
   providerId: z31.string().trim().min(1).optional(),
   issuer: z31.string().trim().min(1).optional(),
   clientId: z31.string().trim().min(1).optional(),
-  clientSecret: z31.string().min(1).optional(),
+  clientSecret: z31.string().optional(),
   allowedPrivateHosts: z31.array(z31.string()).optional()
 }).strict();
 var ssoClaimTargetSchema = z31.object({ claimId: z31.string().trim().min(1) }).strict();
@@ -44993,9 +45471,76 @@ var resetSettingSchema = z31.object({
   path: z31.string().trim().min(1),
   expectedVersion: z31.number().int().nonnegative().optional()
 }).strict();
-var updateBrandingSchema = z31.object({
+var brandingFieldsSchema = z31.object({
+  brandName: z31.string().min(1).max(80).nullable().optional(),
+  logoUrl: z31.string().nullable().optional(),
+  faviconUrl: z31.string().nullable().optional(),
+  primaryColor: z31.string().nullable().optional(),
+  backgroundColor: z31.string().nullable().optional(),
+  loginTitle: z31.string().max(200).nullable().optional(),
+  loginSubtitle: z31.string().max(200).nullable().optional(),
+  customCss: z31.string().max(MAX_CUSTOM_CSS_LENGTH2).nullable().optional()
+}).strict();
+var BRANDING_PATCH_KEYS = [
+  "brandName",
+  "logoUrl",
+  "faviconUrl",
+  "primaryColor",
+  "backgroundColor",
+  "loginTitle",
+  "loginSubtitle",
+  "customCss"
+];
+function brandingPatchMessage(error) {
+  const unknown = error.issues.filter((issue2) => issue2.code === "unrecognized_keys").flatMap(
+    (issue2) => issue2.code === "unrecognized_keys" ? issue2.keys : []
+  );
+  if (unknown.length > 0) {
+    return `Unknown branding field(s): ${unknown.join(", ")}. Use ${BRANDING_PATCH_KEYS.join(", ")}; map productName -> brandName, tagline -> loginSubtitle, accentColor -> primaryColor.`;
+  }
+  return error.issues.map((issue2) => `${issue2.path.join(".")}: ${issue2.message}`).join("; ");
+}
+function parseBrandingPatch(value) {
+  const parsed = brandingFieldsSchema.safeParse(value);
+  if (!parsed.success) {
+    throw new PlatformOpsToolError(
+      PLATFORM_OPS_INVALID_INPUT,
+      brandingPatchMessage(parsed.error)
+    );
+  }
+  return parsed.data;
+}
+function applyBrandingFields(target, patch) {
+  const next = { ...target ?? {} };
+  for (const key of BRANDING_PATCH_KEYS) {
+    const value = patch[key];
+    if (value === void 0) continue;
+    if (value === null) delete next[key];
+    else next[key] = value;
+  }
+  return Object.keys(next).length > 0 ? next : void 0;
+}
+var updateBrandingDefaultSchema = z31.object({
+  expectedVersion: z31.number().int().nonnegative().optional(),
+  patch: z31.record(z31.string(), z31.unknown())
+}).strict();
+var updateBrandingDomainSchema = z31.object({
+  expectedVersion: z31.number().int().nonnegative().optional(),
+  host: z31.string().trim().min(1),
+  status: z31.enum(["active", "pending"]).nullable().optional(),
+  publicGatewayUrl: z31.string().nullable().optional(),
+  publicConsoleUrl: z31.string().nullable().optional(),
+  branding: z31.record(z31.string(), z31.unknown()).optional()
+}).strict();
+var removeBrandingDomainSchema = z31.object({
   expectedVersion: z31.number().int().nonnegative().optional(),
-  branding: z31.record(z31.string(), z31.unknown())
+  host: z31.string().trim().min(1)
+}).strict();
+var setBrandingCustomCssSchema = z31.object({
+  expectedVersion: z31.number().int().nonnegative().optional(),
+  scope: z31.enum(["default", "domain"]),
+  host: z31.string().trim().min(1).optional(),
+  customCss: z31.string().nullable()
 }).strict();
 var transferPlatformOwnerSchema = z31.object({
   fromUserId: z31.string().trim().min(1),
@@ -45016,6 +45561,55 @@ var resetPlatformSettingsPlaybookSchema = z31.object({
   paths: z31.array(z31.string().trim().min(1)).optional(),
   expectedVersion: z31.number().int().nonnegative().optional()
 }).strict();
+function readBrandingSettings(settings) {
+  const snapshot = settings.getBrandingSettings?.();
+  if (!snapshot) {
+    throw new PlatformOpsToolError(PLATFORM_BRANDING_UNAVAILABLE);
+  }
+  return structuredClone(snapshot.branding);
+}
+function serializeBrandingSnapshot(snapshot) {
+  return {
+    version: snapshot.version,
+    branding: snapshot.branding,
+    ...snapshot.updatedBy === void 0 ? {} : { updatedBy: snapshot.updatedBy },
+    ...snapshot.updatedAt === void 0 ? {} : { updatedAt: timestamp(snapshot.updatedAt) }
+  };
+}
+async function commitBranding(settings, branding, expectedVersion, caller, summary) {
+  const update = settings.updateWithResult;
+  if (!update) {
+    throw new PlatformOpsToolError(
+      PLATFORM_SETTINGS_WRITE_UNAVAILABLE,
+      "The platform settings writer is unavailable"
+    );
+  }
+  const before = settings.getBrandingSettings?.();
+  const version = expectedVersion ?? settings.getSnapshot().version;
+  const result = await update.bind(settings)(
+    { branding },
+    version,
+    caller.userId
+  );
+  const after = settings.getBrandingSettings?.();
+  return {
+    data: after ? serializeBrandingSnapshot(after) : { version: result.snapshot.version, branding },
+    ...before === void 0 ? {} : {
+      before: {
+        version: before.version,
+        branding: before.branding
+      }
+    },
+    summary: {
+      ...summary,
+      version: result.snapshot.version
+    },
+    after: {
+      version: result.snapshot.version,
+      changed: result.changed
+    }
+  };
+}
 function createPlatformOpsTools(deps = {}) {
   const overviewTool = readTool(
     "ops_get_overview",
@@ -45260,6 +45854,57 @@ function createPlatformOpsTools(deps = {}) {
       };
     }
   );
+  const previewLoginSchema = z31.object({
+    surface: z31.enum(["login", "register"]).optional(),
+    host: z31.string().trim().min(1).optional(),
+    branding: z31.record(z31.string(), z31.unknown()).optional(),
+    customCss: z31.string().optional()
+  }).strict();
+  const previewLoginTool = tool$1(
+    async (input, exeConfig) => {
+      try {
+        await authorize(exeConfig, deps);
+        const consoleUrl = process.env.PUBLIC_CONSOLE_URL?.replace(/\/$/, "");
+        if (!consoleUrl) return failure3(AUTH_PREVIEW_UNAVAILABLE);
+        const settings = required(resolveSettings(deps));
+        const snapshot = settings.getBrandingSettings?.();
+        const resolved = input.host && settings.getBrandingForHost ? settings.getBrandingForHost(input.host) : void 0;
+        const base = resolved?.branding ?? snapshot?.branding.default ?? {};
+        const { customCss: baseCss, ...baseFields } = base;
+        const draft = input.branding ?? {};
+        const { customCss: draftCss, ...draftFields } = draft;
+        const branding = { ...baseFields, ...draftFields };
+        const css = input.customCss !== void 0 ? input.customCss : typeof draftCss === "string" ? draftCss : baseCss ?? "";
+        if (!validateCustomCss2(css).ok) {
+          throw new PlatformOpsToolError(PLATFORM_OPS_INVALID_INPUT);
+        }
+        const nonce = randomUUID41();
+        const payload = {
+          previewUrl: `${consoleUrl}/auth-preview?nonce=${encodeURIComponent(nonce)}`,
+          origin: new URL(consoleUrl).origin,
+          nonce,
+          surface: input.surface ?? "login",
+          branding,
+          customCss: css
+        };
+        return appendUiFence(JSON.stringify({ success: true, data: payload }), {
+          kind: "plugin",
+          pluginType: PLATFORM_OPS_UI_PLUGIN_TYPE,
+          resource: LOGIN_PREVIEW_UI_RESOURCE,
+          displayMode: "inline",
+          toolName: "ops_preview_login"
+        });
+      } catch (error) {
+        if (error instanceof PlatformOpsToolError) return failure3(error.code);
+        return failure3(PLATFORM_OPS_DEPENDENCY_UNAVAILABLE);
+      }
+    },
+    {
+      name: "ops_preview_login",
+      description: "Render a login-page preview. Omitted branding/customCss inherit the current saved branding (default, or the host override when host is supplied); pass draft fields only for unsaved overrides. Read-only; drafts are not persisted.",
+      schema: previewLoginSchema
+    }
+  );
   const createUserTool = writeTool(
     "ops_create_user",
     "Create a platform user. Owner/admin only; auditors cannot write. Never returns passwords or metadata.",
@@ -45895,13 +46540,7 @@ function createPlatformOpsTools(deps = {}) {
       const probeHosts = allowedPrivateHosts ?? options.allowedPrivateHosts ?? [];
       const issuer = normalizeOidcIssuer(input.issuer, options, probeHosts);
       const clientId = input.clientId.trim();
-      const clientSecret = input.clientSecret.trim();
-      if (!clientSecret) {
-        throw new PlatformOpsToolError(
-          PLATFORM_OPS_INVALID_INPUT,
-          "Client secret is required"
-        );
-      }
+      const clientSecret = input.clientSecret?.trim() ?? "";
       const displayName2 = normalizeOidcDisplayName(input.displayName);
       const scopes = normalizeOidcScopes(input.scopes);
       const enabled = input.enabled ?? false;
@@ -46082,16 +46721,16 @@ function createPlatformOpsTools(deps = {}) {
         clientSecret = overrideSecret !== void 0 && overrideSecret !== "" ? overrideSecret : stored.clientSecret;
       } else {
         source = "unsaved";
-        if (input.issuer === void 0 || input.clientId === void 0 || input.clientSecret === void 0) {
+        if (input.issuer === void 0 || input.clientId === void 0) {
           throw new PlatformOpsToolError(
             PLATFORM_OPS_INVALID_INPUT,
-            "providerId or issuer, clientId, and clientSecret are required"
+            "providerId or issuer and clientId are required"
           );
         }
         hosts = normalizeOidcOptionalHosts(input.allowedPrivateHosts) ?? options.allowedPrivateHosts ?? [];
         issuer = normalizeOidcIssuer(input.issuer, options, hosts);
         clientId = input.clientId;
-        clientSecret = input.clientSecret;
+        clientSecret = input.clientSecret?.trim() ?? "";
       }
       const result = await runOidcProbe(deps, {
         issuer,
@@ -46264,59 +46903,177 @@ function createPlatformOpsTools(deps = {}) {
       };
     }
   );
-  const updateBrandingTool = writeTool(
-    "ops_update_branding",
-    "Update platform branding with optimistic concurrency. Logo URLs and colors are validated by the settings service.",
-    updateBrandingSchema,
+  const updateBrandingDefaultTool = writeTool(
+    "ops_update_branding_default",
+    "Partially update the platform default brand. Omit a field to keep it; null clears it. Valid fields: brandName, logoUrl, faviconUrl, primaryColor, backgroundColor, loginTitle, loginSubtitle, customCss. Use brandName/loginTitle/loginSubtitle/primaryColor; do not invent productName/tagline/accentColor.",
+    updateBrandingDefaultSchema,
     deps,
     async (input, caller) => {
       const settings = required(
         resolveSettings(deps),
         PLATFORM_SETTINGS_WRITE_UNAVAILABLE
       );
-      const update = settings.updateWithResult;
-      if (!update) {
-        throw new PlatformOpsToolError(
-          PLATFORM_SETTINGS_WRITE_UNAVAILABLE,
-          "The platform settings writer is unavailable"
-        );
-      }
-      const before = settings.getBrandingSettings?.();
-      const expectedVersion = input.expectedVersion ?? settings.getSnapshot().version;
-      const result = await update.bind(settings)(
-        { branding: input.branding },
-        expectedVersion,
-        caller.userId
+      const current3 = readBrandingSettings(settings);
+      const patch = parseBrandingPatch(input.patch);
+      const nextDefault = applyBrandingFields(current3.default, patch);
+      const branding = { ...current3 };
+      if (nextDefault === void 0) delete branding.default;
+      else branding.default = nextDefault;
+      return commitBranding(
+        settings,
+        branding,
+        input.expectedVersion,
+        caller,
+        {
+          tool: "ops_update_branding_default",
+          fields: Object.keys(patch)
+        }
       );
-      const after = settings.getBrandingSettings?.();
-      return {
-        data: after ? {
-          version: after.version,
-          branding: after.branding,
-          ...after.updatedBy === void 0 ? {} : { updatedBy: after.updatedBy },
-          ...after.updatedAt === void 0 ? {} : { updatedAt: timestamp(after.updatedAt) }
-        } : {
-          version: result.snapshot.version,
-          branding: input.branding
-        },
-        ...before === void 0 ? {} : {
-          before: {
-            version: before.version,
-            branding: before.branding
-          }
-        },
-        summary: {
-          tool: "ops_update_branding",
-          version: result.snapshot.version,
-          changed: result.changed
-        },
-        after: {
-          version: result.snapshot.version,
-          changed: result.changed
+    }
+  );
+  const updateBrandingDomainTool = writeTool(
+    "ops_update_branding_domain",
+    "Create or partially update a per-host branding override. Omit a field to keep it; null clears it. The branding object accepts brandName, logoUrl, faviconUrl, primaryColor, backgroundColor, loginTitle, loginSubtitle, customCss.",
+    updateBrandingDomainSchema,
+    deps,
+    async (input, caller) => {
+      const settings = required(
+        resolveSettings(deps),
+        PLATFORM_SETTINGS_WRITE_UNAVAILABLE
+      );
+      const current3 = readBrandingSettings(settings);
+      const patch = parseBrandingPatch(input.branding ?? {});
+      const normalized = normalizeBrandingHost2(input.host);
+      const domains = [...current3.domains ?? []];
+      const index = domains.findIndex(
+        (domain) => normalizeBrandingHost2(domain.host) === normalized
+      );
+      const existing = index >= 0 ? domains[index] : { host: input.host, status: "active" };
+      const next = { ...existing };
+      if (input.status !== void 0) {
+        if (input.status === null) delete next.status;
+        else next.status = input.status;
+      }
+      if (input.publicGatewayUrl !== void 0) {
+        if (input.publicGatewayUrl === null) delete next.publicGatewayUrl;
+        else next.publicGatewayUrl = input.publicGatewayUrl;
+      }
+      if (input.publicConsoleUrl !== void 0) {
+        if (input.publicConsoleUrl === null) delete next.publicConsoleUrl;
+        else next.publicConsoleUrl = input.publicConsoleUrl;
+      }
+      const nextBranding = applyBrandingFields(next.branding, patch);
+      if (nextBranding === void 0) delete next.branding;
+      else next.branding = nextBranding;
+      if (index >= 0) domains[index] = next;
+      else domains.push(next);
+      const branding = { ...current3, domains };
+      return commitBranding(
+        settings,
+        branding,
+        input.expectedVersion,
+        caller,
+        {
+          tool: "ops_update_branding_domain",
+          host: next.host,
+          fields: Object.keys(patch)
         }
+      );
+    }
+  );
+  const removeBrandingDomainTool = writeTool(
+    "ops_remove_branding_domain",
+    "Remove a per-host branding override by exact host. Idempotent: reports removed=false when no override exists.",
+    removeBrandingDomainSchema,
+    deps,
+    async (input, caller) => {
+      const settings = required(
+        resolveSettings(deps),
+        PLATFORM_SETTINGS_WRITE_UNAVAILABLE
+      );
+      const current3 = readBrandingSettings(settings);
+      const normalized = normalizeBrandingHost2(input.host);
+      const existing = current3.domains ?? [];
+      const domains = existing.filter(
+        (domain) => normalizeBrandingHost2(domain.host) !== normalized
+      );
+      const removed = domains.length !== existing.length;
+      const branding = { ...current3 };
+      if (domains.length > 0) branding.domains = domains;
+      else delete branding.domains;
+      const outcome = await commitBranding(
+        settings,
+        branding,
+        input.expectedVersion,
+        caller,
+        {
+          tool: "ops_remove_branding_domain",
+          host: input.host,
+          removed
+        }
+      );
+      return {
+        ...outcome,
+        data: { ...outcome.data, removed }
       };
     }
   );
+  const setBrandingCustomCssTool = writeTool(
+    "ops_set_branding_custom_css",
+    "Set or clear custom CSS for the default brand or one domain. Pass customCss: null to clear. CSS only; no @import and no </style; at most 65,536 characters.",
+    setBrandingCustomCssSchema,
+    deps,
+    async (input, caller) => {
+      const settings = required(
+        resolveSettings(deps),
+        PLATFORM_SETTINGS_WRITE_UNAVAILABLE
+      );
+      const current3 = readBrandingSettings(settings);
+      const patch = { customCss: input.customCss };
+      let branding = { ...current3 };
+      if (input.scope === "default") {
+        const nextDefault = applyBrandingFields(current3.default, patch);
+        if (nextDefault === void 0) delete branding.default;
+        else branding.default = nextDefault;
+      } else {
+        if (!input.host) {
+          throw new PlatformOpsToolError(
+            PLATFORM_OPS_INVALID_INPUT,
+            "host is required when scope is domain"
+          );
+        }
+        const normalized = normalizeBrandingHost2(input.host);
+        const domains = [...current3.domains ?? []];
+        const index = domains.findIndex(
+          (domain2) => normalizeBrandingHost2(domain2.host) === normalized
+        );
+        if (index < 0) {
+          throw new PlatformOpsToolError(
+            BRANDING_DOMAIN_NOT_FOUND,
+            `No domain branding override exists for ${input.host}`
+          );
+        }
+        const domain = { ...domains[index] };
+        const nextBranding = applyBrandingFields(domain.branding, patch);
+        if (nextBranding === void 0) delete domain.branding;
+        else domain.branding = nextBranding;
+        domains[index] = domain;
+        branding = { ...branding, domains };
+      }
+      return commitBranding(
+        settings,
+        branding,
+        input.expectedVersion,
+        caller,
+        {
+          tool: "ops_set_branding_custom_css",
+          scope: input.scope,
+          ...input.host === void 0 ? {} : { host: input.host },
+          cleared: input.customCss === null
+        }
+      );
+    }
+  );
   const transferPlatformOwnerTool = playbookTool(
     "ops_playbook_transfer_platform_owner",
     "Preflight a one-time-confirmed transfer of the platform owner role from one owner to another active user. Requires a platform owner.",
@@ -46595,6 +47352,7 @@ function createPlatformOpsTools(deps = {}) {
     auditTool,
     settingsTool,
     brandingTool,
+    previewLoginTool,
     createUserTool,
     updateUserTool,
     deleteUserTool,
@@ -46619,7 +47377,10 @@ function createPlatformOpsTools(deps = {}) {
     rejectSsoClaimTool,
     patchPlatformSettingsTool,
     resetPlatformSettingTool,
-    updateBrandingTool,
+    updateBrandingDefaultTool,
+    updateBrandingDomainTool,
+    removeBrandingDomainTool,
+    setBrandingCustomCssTool,
     transferPlatformOwnerTool,
     offboardPlatformMemberTool,
     deleteTenantPlaybookTool,
@@ -46658,13 +47419,34 @@ var PLATFORM_OPS_AGENT_PROMPT = [
   "first call: they return confirmationRequired with a confirmationId and an",
   "impact preview. Only the initiating user can confirm or cancel through the",
   "Admin Center, and a confirmation is single-use and expires after ten minutes.",
-  "Summarize successful writes concisely and include the audit id when present."
+  "Summarize successful writes concisely and include the audit id when present.",
+  "Branding writes are granular: ops_update_branding_default, ops_update_branding_domain, ops_remove_branding_domain, and ops_set_branding_custom_css. Omit fields to keep them; null clears them. Use brandName/logoUrl/faviconUrl/primaryColor/backgroundColor/loginTitle/loginSubtitle/customCss; never invent productName/tagline/accentColor. customCss only accepts CSS, rejects @import, and is capped at 64 KiB.",
+  "For login theme design, load the platform-ops-branding-design skill, use the widget middleware (load_guidelines then show_widget) to iterate on an interactive mockup, then use ops_preview_login for the real page and save only after explicit approval.",
+  "After reading or changing branding customCss, call ops_preview_login so the inline MCP UI card renders the result. It inherits the saved branding when fields are omitted; pass host to preview a domain override. If it reports AUTH_PREVIEW_UNAVAILABLE, tell the user PUBLIC_CONSOLE_URL is not configured."
 ].join("\n");
 
 // src/services/platform-ops/PlatformOpsSkill.ts
+import {
+  AUTH_CSS_CONTRACT_PARTS,
+  AUTH_CSS_CONTRACT_VARIABLES
+} from "@axiom-lattice/protocols";
 var PLATFORM_OPS_SKILL_KEY = "platform-ops-usage";
+var PLATFORM_OPS_AUTH_CSS_CONTRACT = `# Auth login CSS contract v1
+Surfaces (data-axiom-surface): login, register, invite, oidc-email, tenant-select, platform-admin-login
+Root: #axiom-auth-root[data-axiom-auth-contract="1"][data-axiom-surface="..."]
+Parts (attribute values of [data-axiom-part="..."]): ${AUTH_CSS_CONTRACT_PARTS.join("|")}
+Variables: ${AUTH_CSS_CONTRACT_VARIABLES.join(", ")}
+Rules: CSS only; no @import; no </style; at most 65,536 characters.
+
+Propagation:
+- Stored as branding.default.customCss or branding.domains[].branding.customCss; a domain value replaces (does not concatenate) the default, and an empty/missing domain value inherits the default.
+- Public GET /api/branding resolves by host (x-axiom-host -> x-forwarded-host -> host).
+- Applied only while an auth surface is mounted: login, register, invite (unauthenticated), OIDC email completion, standalone tenant selection, platform-admin login. It does not style the authenticated workspace or the authenticated invite-claim view.
+- Invite links still use PUBLIC_CONSOLE_URL, so their landing page uses that host's branding.
+- url(...) resolves against the page origin; use absolute URLs for cross-host assets (subject to the deployment CSP).
+- The Admin preview shows the selected surface as an approximation (stub auth providers, en-US copy); the Ops MCP preview supports login/register.`;
 var PLATFORM_OPS_SKILL = {
-  version: "1.0.0",
+  version: "1.6.0",
   content: `---
 name: platform-ops-usage
 description: Use the Platform Ops tools safely from the Admin Center Ops Agent.
@@ -46683,15 +47465,89 @@ description: Use the Platform Ops tools safely from the Admin Center Ops Agent.
 - Tool failures return \`{ success: false, error: { code, message } }\`.
 - Invite-link creation returns a one-time URL/token. Present it once with a copy warning; never repeat it later.
 - Never echo API keys, passwords, client secrets, or other credentials.
+- For login theme design, use the \`platform-ops-branding-design\` skill and the widget middleware: load mockup guidelines, show an interactive mockup, iterate, then confirm with \`ops_preview_login\` before saving.
+- Branding writes are granular: \`ops_update_branding_default\` (partial default patch), \`ops_update_branding_domain\` (create/update one host override), \`ops_remove_branding_domain\`, and \`ops_set_branding_custom_css\` (default or domain). Omit a field to keep it; pass null to clear it. Use \`brandName\`, \`logoUrl\`, \`faviconUrl\`, \`primaryColor\`, \`backgroundColor\`, \`loginTitle\`, \`loginSubtitle\`, and \`customCss\`; never invent \`productName\`, \`tagline\`, or \`accentColor\`.
+- \`ops_preview_login\` inherits the current saved branding when \`branding\`/\`customCss\` are omitted; pass only draft fields for unsaved overrides, and pass \`host\` to preview that domain override.
+- Branding \`customCss\` themes the login, register, invite, OIDC email-completion, tenant-select, and platform-admin-login surfaces. Use \`auth-login-css-contract.md\` for stable selectors/variables (the \`data-axiom-part\` values are attribute values); CSS only, no @import, no </style, at most 65,536 characters. Visual results cannot be verified by the agent; use \`ops_preview_login\` to render the inline MCP UI preview and ask the user to confirm the final result in the Admin Center Branding preview or the real \`/login\` page.
+`,
+  resources: {
+    "auth-login-css-contract.md": {
+      content: PLATFORM_OPS_AUTH_CSS_CONTRACT,
+      mimeType: "text/markdown"
+    }
+  }
+};
+
+// src/services/platform-ops/PlatformOpsBrandingDesignSkill.ts
+var PLATFORM_OPS_BRANDING_DESIGN_SKILL_KEY = "platform-ops-branding-design";
+var PLATFORM_OPS_BRANDING_DESIGN_SKILL = {
+  version: "1.0.0",
+  content: `---
+name: platform-ops-branding-design
+description: Design login-page branding with an interactive widget mockup, then confirm on the real page before saving.
+---
+
+# Login branding design
+
+Use this when the user wants to design or redesign the login page theme.
+
+## Workflow
+
+1. Read the current settings with \`ops_get_branding\`.
+2. Use the **widget** middleware for the discussion mockup:
+   - Call \`load_guidelines({ modules: ["mockup"] })\` first.
+   - Then call \`show_widget\` with \`i_have_seen_guidelines: true\`, a title, and an interactive HTML mockup.
+3. Iterate in the chat. When the design changes, show a new widget instead of describing it.
+4. When the user settles on a design, call \`ops_preview_login\` with the draft \`branding\` and \`customCss\` so they see the **real** login page.
+5. Save only after explicit approval:
+   - default brand: \`ops_update_branding_default\` + \`ops_set_branding_custom_css\`
+   - per-host override: \`ops_update_branding_domain\` (+ \`ops_set_branding_custom_css\` with \`scope: "domain"\`)
+6. Never persist from the widget.
+
+## Widget mockup rules
+
+- \`show_widget\` code is body-only: no DOCTYPE, \`<html>\`, \`<head>\`, or \`<body>\`.
+- Use inline CSS and inline JS only. No network calls.
+- Use the real auth contract so the design maps 1:1 to the login page:
+  - root: \`#axiom-auth-root[data-axiom-auth-contract="1"][data-axiom-surface="login"]\`
+  - parts: \`[data-axiom-part="page|card|header|logo|title|subtitle|form|field|input|submit|footer|link"]\`
+  - variables: \`--axiom-auth-primary\`, \`--axiom-auth-primary-hover\`, \`--axiom-auth-primary-active\`, \`--axiom-auth-bg\`, \`--axiom-auth-surface\`, \`--axiom-auth-text\`, \`--axiom-auth-text-secondary\`, \`--axiom-auth-border\`, \`--axiom-auth-radius\`, \`--axiom-auth-page-padding\`, \`--axiom-auth-card-width\`, \`--axiom-auth-card-padding\`, \`--axiom-auth-card-shadow\`, \`--axiom-auth-card-shadow-hover\`, \`--axiom-auth-logo-size\`, \`--axiom-auth-input-height\`
+- Provide structured controls and a small preset row (Default / Dark / Minimal / Brand):
+  - colors: primary, background, surface, text, text-secondary, border
+  - shape: radius, card width, card padding, input height
+  - brand: logo URL, brand name, login title, login subtitle
+- The mockup should look like a real sign-in card (logo, title, subtitle, email/password inputs, primary button, footer link). Controls update the mockup live.
+- If the user asks for raw CSS beyond the tokens, include it in the draft \`customCss\` sent to \`ops_preview_login\`; the real page is the source of truth.
+
+## Field names
+
+Use only: \`brandName\`, \`logoUrl\`, \`faviconUrl\`, \`primaryColor\`, \`backgroundColor\`, \`loginTitle\`, \`loginSubtitle\`, \`customCss\`.
+
+Map user language: product name -> \`brandName\`, tagline -> \`loginSubtitle\`, accent color -> \`primaryColor\`. Never send \`productName\`, \`tagline\`, or \`accentColor\` to the tools.
+
+## Boundaries
+
+- The widget is an approximation for discussion; the real \`/auth-preview\` page is the confirmation step.
+- Do not claim the design is applied until the save tool succeeds.
+- Do not hide or overwrite existing branding fields the user did not ask to change; use partial updates.
 `
 };
 
 // src/services/platform-ops/PlatformOpsPlugin.ts
-var PLATFORM_OPS_PLUGIN_TYPE = "platform-ops";
+var PLATFORM_OPS_PLUGIN_TYPE2 = "platform-ops";
+function resolveConsoleOrigin(env = process.env) {
+  const raw = env.PUBLIC_CONSOLE_URL;
+  if (!raw) return void 0;
+  try {
+    return new URL(raw).origin;
+  } catch {
+    return void 0;
+  }
+}
 var PLATFORM_OPS_AGENT_MIDDLEWARE = [
   {
     id: "platform-ops-tools",
-    type: PLATFORM_OPS_PLUGIN_TYPE,
+    type: PLATFORM_OPS_PLUGIN_TYPE2,
     name: "Platform Ops",
     description: "Role-inherited platform read and write tools for the Ops Agent",
     enabled: true,
@@ -46709,9 +47565,17 @@ var PLATFORM_OPS_AGENT_MIDDLEWARE = [
     id: "skill",
     type: "skill",
     name: "Skill",
-    description: "Load the Platform Ops usage guidance",
+    description: "Load the Platform Ops usage and branding-design guidance",
     enabled: true,
     config: { readAll: true }
+  },
+  {
+    id: "widget",
+    type: "widget",
+    name: "Widget",
+    description: "Render interactive HTML mockups for design discussion",
+    enabled: true,
+    config: {}
   }
 ];
 function buildPlatformOpsAgentConfig(env = process.env) {
@@ -46727,17 +47591,33 @@ function buildPlatformOpsAgentConfig(env = process.env) {
   };
 }
 function createPlatformOpsPlugin(deps = {}, env = process.env) {
+  const consoleOrigin = resolveConsoleOrigin(env);
   return {
     meta: {
-      type: PLATFORM_OPS_PLUGIN_TYPE,
+      type: PLATFORM_OPS_PLUGIN_TYPE2,
       name: "Platform Ops",
       description: "Role-inherited platform operations agent, tools, and usage skill for Admin Center",
       source: "builtin:gateway",
-      category: "platform"
+      category: "platform",
+      tools: [
+        {
+          name: "ops_preview_login",
+          description: "Render a login-page preview with unsaved branding/customCss overrides.",
+          ui: {
+            resource: LOGIN_PREVIEW_UI_RESOURCE,
+            csp: consoleOrigin ? { frameDomains: [consoleOrigin], resourceDomains: [consoleOrigin] } : {},
+            trustedSameOrigin: true
+          }
+        }
+      ],
+      uiResources: {
+        [LOGIN_PREVIEW_UI_RESOURCE]: { html: LOGIN_PREVIEW_APP_HTML }
+      }
     },
     middleware: () => createPlatformOpsMiddleware(deps),
     skills: {
-      [PLATFORM_OPS_SKILL_KEY]: PLATFORM_OPS_SKILL
+      [PLATFORM_OPS_SKILL_KEY]: PLATFORM_OPS_SKILL,
+      [PLATFORM_OPS_BRANDING_DESIGN_SKILL_KEY]: PLATFORM_OPS_BRANDING_DESIGN_SKILL
     },
     agents: {
       [PLATFORM_OPS_AGENT_ID3]: buildPlatformOpsAgentConfig(env)
@@ -46790,7 +47670,7 @@ var PluginDeploymentError = class extends Error {
     this.code = code;
   }
 };
-function isRecord17(value) {
+function isRecord18(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function buildBootstrapEntrypoint(pluginType) {
@@ -47344,7 +48224,7 @@ var PluginDeploymentService = class {
         return { ok: false, error: `health responded with HTTP ${response.status}` };
       }
       const body = await response.json().catch(() => void 0);
-      if (isRecord17(body) && body.ok === true) {
+      if (isRecord18(body) && body.ok === true) {
         return { ok: true };
       }
       return { ok: false, error: "health returned an invalid envelope" };
@@ -49904,7 +50784,7 @@ function installAgentLifecycleSync(params) {
     void publishAgentLifecycle(params.outbox, params.owner, event);
   });
 }
-function isRecord18(value) {
+function isRecord19(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function nonEmptyString(value) {
@@ -49914,7 +50794,7 @@ function isMirroredEvent(value) {
   return typeof value === "string" && MIRRORED_EVENT_SET.has(value);
 }
 function handleAgentLifecycle(payload, deps = {}) {
-  if (!isRecord18(payload)) return false;
+  if (!isRecord19(payload)) return false;
   const tenantId = payload.tenantId;
   const assistantId = payload.assistantId;
   const threadId = payload.threadId;
@@ -51169,9 +52049,9 @@ var start = async (config) => {
       });
     }
     try {
-      const { A2AAuthService: A2AAuthService2, parseEnvKeys: parseEnvKeys2 } = await import("./A2AAuthService-UKN53ZGP.mjs");
-      const { registerA2AStandardRoutes } = await import("./a2a-standard-ELY7MTJB.mjs");
-      const a2a = await import("./a2a-YLKZE5JG.mjs");
+      const { A2AAuthService: A2AAuthService2, parseEnvKeys: parseEnvKeys2 } = await import("./A2AAuthService-UYWSDE5L.mjs");
+      const { registerA2AStandardRoutes } = await import("./a2a-standard-2IJP4JG5.mjs");
+      const a2a = await import("./a2a-OCCSVNWB.mjs");
       const a2aKeyStore = getStoreLattice46("default", "a2aApiKey").store;
       const assistantStore = getStoreLattice46("default", "assistant").store;
       const projectStore = getStoreLattice46("default", "project").store;
@@ -51200,19 +52080,16 @@ var start = async (config) => {
       });
     }
     try {
-      const { registerOpenRoutes } = await import("./open-Y7PAA2VJ.mjs");
-      const { registerOpenSessionRoutes } = await import("./open-session-CLZT3HVG.mjs");
-      const { registerOpenCatalogRoutes } = await import("./open-catalog-NVGP6SQP.mjs");
-      const { registerOpenFilesRoutes } = await import("./open-files-WK4SQHE3.mjs");
+      const { registerOpenRoutes } = await import("./open-TJLQARLV.mjs");
+      const { registerOpenSessionRoutes } = await import("./open-session-F5H6PFSN.mjs");
+      const { registerOpenCatalogRoutes } = await import("./open-catalog-LLTMSZGH.mjs");
+      const { registerOpenFilesRoutes } = await import("./open-files-QIMOTHSN.mjs");
       const { registerOpenAuditRoutes } = await import("./open-audit-UJ3NXCGW.mjs");
-      const { registerOpenExposureRoutes } = await import("./open-exposure-HGYT5VFC.mjs");
-      const { openLattice } = await import("./openLattice-D5YTSZBY.mjs");
-      const { createKbProvider } = await import("./kbProvider-2D6DZ34N.mjs");
+      const { registerOpenExposureRoutes } = await import("./open-exposure-2CSXJTM3.mjs");
+      const { openLattice } = await import("./openLattice-KFUREFWM.mjs");
       const { createOpenSandboxProvider } = await import("./sandboxProvider-LA6B5SKU.mjs");
       const { createAgentProvider } = await import("./agentProvider-X4FVQPKW.mjs");
-      const { registerExposedPluginTools } = await import("./registerExposedPlugins-2JGXSMAL.mjs");
-      const { CollectionService: CollectionService2 } = await import("./collection_service-RTRJEQFL.mjs");
-      openLattice.register(createKbProvider(new CollectionService2()));
+      const { registerExposedPluginTools } = await import("./registerExposedPlugins-N6ENBBKN.mjs");
       openLattice.register(createOpenSandboxProvider());
       const threadStore = getStoreLattice46("default", "thread").store;
       const assistantStore = getStoreLattice46("default", "assistant").store;
@@ -51232,14 +52109,14 @@ var start = async (config) => {
       registerOpenFilesRoutes(app);
       registerOpenAuditRoutes(app);
       registerOpenExposureRoutes(app);
-      logger8.info("Open API routes registered (kb + sandbox providers, session exchange)");
+      logger8.info("Open API routes registered (sandbox + agent providers, plugin tools, session exchange)");
     } catch (err) {
       logger8.warn("Open API routes unavailable", {
         error: err instanceof Error ? err.message : String(err)
       });
     }
     try {
-      const { registerGatewaySandboxOpenCredentialProvider } = await import("./sandboxOpenCredentialProvider-RTYOYRCT.mjs");
+      const { registerGatewaySandboxOpenCredentialProvider } = await import("./sandboxOpenCredentialProvider-3CUISBEL.mjs");
       registerGatewaySandboxOpenCredentialProvider((error) => {
         logger8.warn("sandbox open-credential provider failed", { error });
       });
@@ -51298,7 +52175,7 @@ var start = async (config) => {
       }
     }
     try {
-      const { ResourceController } = await import("./resources-YD5DOPGD.mjs");
+      const { ResourceController } = await import("./resources-53PXMFQI.mjs");
       const sharedResourceStore = getStoreLattice46("default", "sharedResource").store;
       const cache = new TokenCache();
       const resourceController = new ResourceController({
@@ -51309,7 +52186,7 @@ var start = async (config) => {
       });
       registerResourceRoutes(app, resourceController);
       const { registerMcpAppShareRoutes } = await import("./mcp-app-shares-M45HR4ZV.mjs");
-      const { makeMcpAppHandlers, resolveMcpAppDeps } = await import("./mcp-apps-MZECSNN2.mjs");
+      const { makeMcpAppHandlers, resolveMcpAppDeps } = await import("./mcp-apps-MKHHUJE4.mjs");
       registerMcpAppShareRoutes(app, {
         store: sharedResourceStore,
         handlers: makeMcpAppHandlers(resolveMcpAppDeps()),