@axiom-lattice/gateway 3.0.10 → 4.0.0

package/dist/index.mjs

@@ -6,6 +6,15 @@ import {
   getQrCode,
   getQrCodeStatus
 } from "./chunk-6CUQGDJI.mjs";
+import {
+  PathOutsideRootError,
+  ProjectFileValidationError,
+  filesystemRootDirectory,
+  isBinaryContentType,
+  isPathWithinRoot,
+  resolvePathWithinRoot,
+  saveProjectFile
+} from "./chunk-IDOEIBCF.mjs";
 import {
   getContentTypeFromFilename,
   getFilenameFromPath
@@ -59,8 +68,8 @@ function resolveLocalA2AWorkingDirectory(options) {
 }
 function validateWorkingDirectory(cwd) {
   try {
-    const stat2 = statSync(cwd);
-    if (!stat2.isDirectory()) {
+    const stat = statSync(cwd);
+    if (!stat.isDirectory()) {
       return `Working directory is not a directory: ${cwd}`;
     }
     return null;
@@ -739,17 +748,17 @@ async function getAssistantStats(request, reply) {
         try {
           const threads = await threadStore.getThreadsByAssistantId(tenantId, assistant.id);
           threadCount = threads.length;
-          for (const t of threads) {
-            const created = new Date(t.createdAt).getTime();
+          for (const t2 of threads) {
+            const created = new Date(t2.createdAt).getTime();
             if (created >= now - ms7d) last7d++;
             if (created >= now - ms30d) last30d++;
             const idx7 = Math.floor((now - created) / 864e5);
             if (idx7 >= 0 && idx7 < 7) daily7d[6 - idx7]++;
             const idx30 = Math.floor((now - created) / 864e5);
             if (idx30 >= 0 && idx30 < 30) daily30d[29 - idx30]++;
-            const updated = new Date(t.updatedAt).getTime();
+            const updated = new Date(t2.updatedAt).getTime();
             if (lastActive === null || updated > lastActive.getTime()) {
-              lastActive = new Date(t.updatedAt);
+              lastActive = new Date(t2.updatedAt);
             }
           }
         } catch {
@@ -895,7 +904,7 @@ var createRun = async (request, reply) => {
 
 `);
           if (!success) {
-            await new Promise((resolve3) => reply.raw.once("drain", resolve3));
+            await new Promise((resolve2) => reply.raw.once("drain", resolve2));
           }
         }
       } catch (error) {
@@ -2183,11 +2192,11 @@ var CollectionService = class {
   async getAllCollections(request) {
     const tenantId = getTenantId5(request);
     const collections = await collectionLatticeManager.getAllCollections(tenantId);
-    for (const c of collections) {
+    for (const c2 of collections) {
       try {
-        c._entryCount = await getCollectionEntryCount(c.name, c.embeddingKey, c.tenantId);
+        c2._entryCount = await getCollectionEntryCount(c2.name, c2.embeddingKey, c2.tenantId);
       } catch {
-        c._entryCount = 0;
+        c2._entryCount = 0;
       }
     }
     return collections;
@@ -3041,7 +3050,7 @@ async function getInboxItems(request, reply) {
         const runStatus = await agent.getRunStatus();
         if (runStatus !== "interrupted") return [];
         const state = await agent.getCurrentState();
-        const interrupts = state.tasks?.flatMap((t) => t.interrupts || []) || [];
+        const interrupts = state.tasks?.flatMap((t2) => t2.interrupts || []) || [];
         return interrupts.map((i) => ({
           runId: r.id,
           assistantId: r.assistantId,
@@ -3398,7 +3407,8 @@ async function createPersonalAssistant(request, reply) {
   const wsId = getWorkspaceId2(request);
   await projectStore.createProject(tenantId, wsId, projectId, {
     name: `${name}'s Space`,
-    description: "Personal workspace for your assistant"
+    description: "Personal workspace for your assistant",
+    kind: "personal"
   });
   const config = PersonalAssistantConfig.get();
   config.key = assistantId;
@@ -3448,8 +3458,8 @@ async function deletePersonalAssistant(request, reply) {
   const threadStore = getStoreLattice5("default", "thread").store;
   try {
     const threads = await threadStore.getThreadsByAssistantId(tenantId, assistant.id);
-    for (const t of threads) {
-      await threadStore.deleteThread(tenantId, t.id);
+    for (const t2 of threads) {
+      await threadStore.deleteThread(tenantId, t2.id);
     }
   } catch {
   }
@@ -3469,170 +3479,19 @@ async function deletePersonalAssistant(request, reply) {
   return { success: true, message: "Personal assistant deleted" };
 }
 
-// src/controllers/tasks.ts
-import { getStoreLattice as getStoreLattice6 } from "@axiom-lattice/core";
-function getTenantId9(request) {
-  const userTenantId = request.user?.tenantId;
-  if (userTenantId) return userTenantId;
-  return request.headers["x-tenant-id"] || "default";
-}
-function getUserId4(request) {
-  const userId = request.user?.id || request.headers["x-user-id"];
-  if (!userId) throw new Error("User ID is required");
-  return userId;
-}
-function getStore() {
-  return getStoreLattice6("default", "task").store;
-}
-async function listTasks(request, reply) {
-  try {
-    const tenantId = getTenantId9(request);
-    const query = request.query;
-    const store = getStore();
-    const tasks = await store.list({
-      tenantId,
-      status: query.status,
-      priority: query.priority,
-      ...query.ownerId && { ownerId: query.ownerId },
-      ...query.ownerType && { ownerType: query.ownerType },
-      ...query.parentId && { parentId: query.parentId },
-      metadata: query.metadata ? JSON.parse(query.metadata) : void 0,
-      projectId: query.projectId,
-      limit: query.limit ? parseInt(query.limit) : void 0,
-      offset: query.offset ? parseInt(query.offset) : void 0
-    });
-    return { success: true, data: tasks, count: tasks.length };
-  } catch (error) {
-    return { success: false, error: error.message };
-  }
-}
-async function getTask(request, reply) {
-  try {
-    const tenantId = getTenantId9(request);
-    const userId = getUserId4(request);
-    const { id } = request.params;
-    const store = getStore();
-    const task = await store.getById(tenantId, id);
-    if (!task) {
-      return reply.status(404).send({ success: false, error: "Task not found" });
-    }
-    if (task.ownerType === "user" && task.ownerId !== userId) {
-      return reply.status(403).send({ success: false, error: "Access denied" });
-    }
-    return { success: true, data: task };
-  } catch (error) {
-    return { success: false, error: error.message };
-  }
-}
-async function createTask(request, reply) {
-  try {
-    const tenantId = getTenantId9(request);
-    const userId = getUserId4(request);
-    const body = request.body;
-    if (!body.title) {
-      return reply.status(400).send({ success: false, error: "title is required" });
-    }
-    const store = getStore();
-    const task = await store.create({
-      ...body,
-      tenantId,
-      ownerType: body.ownerType || "user",
-      ownerId: body.ownerId || userId
-    });
-    return reply.status(201).send({ success: true, data: task });
-  } catch (error) {
-    return reply.status(500).send({ success: false, error: error.message });
-  }
-}
-async function updateTask(request, reply) {
-  try {
-    const tenantId = getTenantId9(request);
-    const userId = getUserId4(request);
-    const { id } = request.params;
-    const store = getStore();
-    const existing = await store.getById(tenantId, id);
-    if (!existing) {
-      return reply.status(404).send({ success: false, error: "Task not found" });
-    }
-    if (existing.ownerType === "user" && existing.ownerId !== userId) {
-      return reply.status(403).send({ success: false, error: "Access denied" });
-    }
-    const task = await store.update(tenantId, id, request.body);
-    if (!task) {
-      return reply.status(404).send({ success: false, error: "Task not found" });
-    }
-    return { success: true, data: task };
-  } catch (error) {
-    return reply.status(500).send({ success: false, error: error.message });
-  }
-}
-async function deleteTask(request, reply) {
-  try {
-    const tenantId = getTenantId9(request);
-    const userId = getUserId4(request);
-    const { id } = request.params;
-    const store = getStore();
-    const existing = await store.getById(tenantId, id);
-    if (!existing) {
-      return reply.status(404).send({ success: false, error: "Task not found" });
-    }
-    if (existing.ownerType === "user" && existing.ownerId !== userId) {
-      return reply.status(403).send({ success: false, error: "Access denied" });
-    }
-    const deleted = await store.delete(tenantId, id);
-    if (!deleted) {
-      return reply.status(404).send({ success: false, error: "Task not found" });
-    }
-    return { success: true, message: "Task deleted" };
-  } catch (error) {
-    return reply.status(500).send({ success: false, error: error.message });
-  }
-}
-async function completeTask(request, reply) {
-  try {
-    const tenantId = getTenantId9(request);
-    const userId = getUserId4(request);
-    const { id } = request.params;
-    const store = getStore();
-    const existing = await store.getById(tenantId, id);
-    if (!existing) {
-      return reply.status(404).send({ success: false, error: "Task not found" });
-    }
-    if (existing.ownerType === "user" && existing.ownerId !== userId) {
-      return reply.status(403).send({ success: false, error: "Access denied" });
-    }
-    const task = await store.update(tenantId, id, { status: "completed" });
-    if (!task) {
-      return reply.status(404).send({ success: false, error: "Task not found" });
-    }
-    return { success: true, data: task };
-  } catch (error) {
-    return reply.status(500).send({ success: false, error: error.message });
-  }
-}
-function getTaskWorkItemStore() {
-  return getStoreLattice6("default", "taskWorkItem").store;
-}
-async function listTaskWorkItems(request, reply) {
-  const tenantId = getTenantId9(request);
-  const { id } = request.params;
-  const { action, limit, offset } = request.query;
-  const store = getTaskWorkItemStore();
-  const items = await store.list({
-    tenantId,
-    taskId: id,
-    action,
-    limit: limit ? Number(limit) : void 0,
-    offset: offset ? Number(offset) : void 0
-  });
-  return reply.send({ success: true, data: items });
-}
-
 // src/services/ExportImportService.ts
-import { ExportableEntityRegistry, DependencyResolver, IdRemapper } from "@axiom-lattice/core";
+import { ExportableEntityRegistry, DependencyResolver, IdRemapper, isBuiltInSkill } from "@axiom-lattice/core";
 import { randomUUID as randomUUID4 } from "crypto";
+import * as fs from "fs/promises";
+import * as os from "os";
+import * as path from "path";
+import * as tar from "tar";
+import * as zlib from "zlib";
 var exportJobs = /* @__PURE__ */ new Map();
 var JOB_TTL_MS = 60 * 60 * 1e3;
+var MAX_ARCHIVE_ENTRIES = 1e4;
+var MAX_ARCHIVE_FILE_BYTES = 100 * 1024 * 1024;
+var MAX_ARCHIVE_TOTAL_BYTES = 512 * 1024 * 1024;
 function cleanExpiredJobs() {
   const now = Date.now();
   for (const [id, entry] of exportJobs) {
@@ -3641,6 +3500,9 @@ function cleanExpiredJobs() {
     }
   }
 }
+function archiveFileKey(entityType, entityId, relPath) {
+  return `files/${entityType}/${entityId}/${relPath}`;
+}
 var ExportImportService = class {
   constructor() {
     this.registry = ExportableEntityRegistry.getInstance();
@@ -3648,40 +3510,44 @@ var ExportImportService = class {
   /**
    * Preview an export: check which types would be auto-included, which dependencies are missing.
    */
-  async exportPreview(tenantId, selectedTypes) {
+  async exportPreview(tenantId, selectedTypes, entityIds, context) {
     const allDefs = this.registry.getAll();
     const expanded = DependencyResolver.expandCascade(allDefs, selectedTypes);
-    const cascadeAdditions = expanded.filter((t) => !selectedTypes.includes(t));
+    const cascadeAdditions = expanded.filter((t2) => !selectedTypes.includes(t2));
     const deps = DependencyResolver.computeDependencies(allDefs, expanded);
     const registeredTypes = new Set(allDefs.map((d) => d.entityType));
-    const missingDependencies = deps.missing.filter((t) => registeredTypes.has(t));
+    const missingDependencies = deps.missing.filter((t2) => registeredTypes.has(t2));
+    await this.resolveExportSelection(tenantId, selectedTypes, entityIds, context);
     return { missingDependencies, cascadeAdditions };
   }
   /**
-   * Generate a full ExportBundle for the given tenant and entity types.
-   * Stores the bundle in-memory and returns a jobId for download.
+   * Generate a full export (bundle + file content) for the given tenant and entity types.
+   * Stores the data in-memory and returns a jobId for download.
    */
-  async export(tenantId, entityTypes, entityIds) {
-    const allDefs = this.registry.getAll();
-    const expanded = DependencyResolver.expandCascade(allDefs, entityTypes);
-    const finalTypes = [.../* @__PURE__ */ new Set([...expanded, ...entityTypes])];
-    const dependencyOrder = DependencyResolver.resolveOrder(
-      finalTypes.map((t) => this.registry.get(t))
+  async export(tenantId, entityTypes, entityIds, context) {
+    const { dependencyOrder, entities: rawEntities } = await this.resolveExportSelection(
+      tenantId,
+      entityTypes,
+      entityIds,
+      context
     );
     const entities = {};
+    const files = /* @__PURE__ */ new Map();
     let exportCounter = 0;
     for (const type of dependencyOrder) {
       const def = this.registry.get(type);
-      let raw = await def.listForExport(tenantId);
-      if (entityIds && entityIds[type] && entityIds[type].length > 0) {
-        const idSet = new Set(entityIds[type]);
-        raw = raw.filter((e) => idSet.has(e.data.id));
-      }
+      const raw = rawEntities[type];
       entities[type] = raw.map((e) => ({
         ...e,
         _exportId: `exp-${type}-${String(++exportCounter).padStart(3, "0")}`,
         data: this.sanitizeEntityData(e.data)
       }));
+      if (def.listFilesForExport && entities[type].length > 0) {
+        const entityFiles = await def.listFilesForExport(tenantId, entities[type], context);
+        for (const f of entityFiles) {
+          files.set(archiveFileKey(type, f.entityId, f.path), f.content);
+        }
+      }
     }
     const rawIdToExportId = /* @__PURE__ */ new Map();
     for (const [, entityList] of Object.entries(entities)) {
@@ -3716,31 +3582,193 @@ var ExportImportService = class {
       _warning: "This file contains plaintext secrets (passwords, API keys, tokens). Store it securely and delete after import."
     };
     const jobId = randomUUID4();
-    exportJobs.set(jobId, { bundle, tenantId, createdAt: Date.now() });
-    return { jobId, bundle };
+    exportJobs.set(jobId, { data: { bundle, files }, tenantId, createdAt: Date.now() });
+    return { jobId, data: { bundle, files } };
   }
   /**
-   * Retrieve a previously generated export bundle by jobId with tenant validation.
+   * Retrieve a previously generated export job data by jobId with tenant validation.
    */
   getExportJob(jobId, tenantId) {
     cleanExpiredJobs();
     const entry = exportJobs.get(jobId);
     if (!entry || entry.tenantId !== tenantId) return void 0;
-    return entry.bundle;
+    return entry.data;
+  }
+  /**
+   * Pack an ExportJobData into a tar.gz buffer.
+   * Layout: bundle.json at root, files under files/{entityType}/{entityId}/{path}.
+   */
+  async packTarGz(data) {
+    const { bundle, files } = data;
+    const tmpDir = await fs.mkdtemp(path.join(os.tmpdir(), "lattice-export-"));
+    try {
+      await fs.writeFile(path.join(tmpDir, "bundle.json"), JSON.stringify(bundle, null, 2), "utf-8");
+      for (const [relPath, content] of files.entries()) {
+        const fullPath = path.join(tmpDir, relPath);
+        await fs.mkdir(path.dirname(fullPath), { recursive: true });
+        await fs.writeFile(fullPath, content);
+      }
+      const stream = tar.c({ gzip: true, portable: true, cwd: tmpDir }, ["./bundle.json", ...Array.from(files.keys())]);
+      const chunks = [];
+      for await (const chunk of stream) {
+        chunks.push(Buffer.from(chunk));
+      }
+      return Buffer.concat(chunks);
+    } finally {
+      await fs.rm(tmpDir, { recursive: true, force: true });
+    }
+  }
+  /**
+   * Unpack a tar.gz buffer into an ExportJobData (bundle + files).
+   */
+  async unpackTarGz(buffer) {
+    const files = /* @__PURE__ */ new Map();
+    let bundle;
+    const gunzip = zlib.createGunzip();
+    await new Promise((resolve2, reject) => {
+      let settled = false;
+      let entryCount = 0;
+      let declaredTotalBytes = 0;
+      let decompressedBytes = 0;
+      let activeEntry;
+      const paths = /* @__PURE__ */ new Set();
+      const fail = (reason) => {
+        if (settled) return;
+        settled = true;
+        const error = reason instanceof Error ? reason : new Error(String(reason));
+        reject(error);
+        try {
+          activeEntry?.destroy(error);
+        } catch {
+        }
+        try {
+          parser.abort(error);
+        } catch {
+        }
+        gunzip.destroy(error);
+      };
+      const countEntry = () => {
+        entryCount += 1;
+        if (entryCount <= MAX_ARCHIVE_ENTRIES) return true;
+        fail(new Error(`Invalid export archive: exceeds ${MAX_ARCHIVE_ENTRIES.toLocaleString("en-US")} entries`));
+        return false;
+      };
+      const parser = tar.t({
+        gzip: false,
+        onentry: (entry) => {
+          activeEntry = entry;
+          if (!countEntry()) return;
+          entry.on("error", fail);
+          entry.on("end", () => {
+            if (activeEntry === entry) activeEntry = void 0;
+          });
+          const isDirectory = entry.type === "Directory";
+          if (!isDirectory && entry.type !== "File" && entry.type !== "OldFile") {
+            fail(new Error(`Invalid export archive: unsupported entry type "${entry.type}"`));
+            return;
+          }
+          const rawPath = entry.path;
+          if (rawPath.startsWith("/") || rawPath.includes("\\") || rawPath.includes("\0")) {
+            fail(new Error(`Invalid export archive path: "${rawPath}"`));
+            return;
+          }
+          const entryPath = rawPath.startsWith("./") ? rawPath.slice(2) : rawPath;
+          const pathToValidate = isDirectory && entryPath.endsWith("/") ? entryPath.slice(0, -1) : entryPath;
+          const segments = pathToValidate.split("/");
+          if (segments.some((segment) => segment === "" || segment === "." || segment === "..") || (isDirectory ? !(pathToValidate === "files" || pathToValidate.startsWith("files/")) : entryPath !== "bundle.json" && !(entryPath.startsWith("files/") && segments.length > 1))) {
+            fail(new Error(`Invalid export archive path: "${rawPath}"`));
+            return;
+          }
+          if (isDirectory) {
+            entry.resume();
+            return;
+          }
+          if (paths.has(entryPath)) {
+            fail(new Error(`Invalid export archive: duplicate path "${entryPath}"`));
+            return;
+          }
+          paths.add(entryPath);
+          if (!Number.isSafeInteger(entry.size) || entry.size < 0 || entry.size > MAX_ARCHIVE_FILE_BYTES) {
+            fail(new Error("Invalid export archive: regular file size exceeds 100 MB"));
+            return;
+          }
+          declaredTotalBytes += entry.size;
+          if (declaredTotalBytes > MAX_ARCHIVE_TOTAL_BYTES) {
+            fail(new Error("Invalid export archive: total uncompressed size exceeds 512 MB"));
+            return;
+          }
+          const chunks = [];
+          let streamedEntryBytes = 0;
+          entry.on("data", (chunk) => {
+            if (settled) return;
+            streamedEntryBytes += chunk.length;
+            if (streamedEntryBytes > MAX_ARCHIVE_FILE_BYTES) {
+              fail(new Error("Invalid export archive: regular file size exceeds 100 MB"));
+              return;
+            }
+            chunks.push(chunk);
+          });
+          entry.on("end", () => {
+            if (settled) return;
+            const content = Buffer.concat(chunks, streamedEntryBytes);
+            if (entryPath === "bundle.json") {
+              try {
+                bundle = JSON.parse(content.toString("utf-8"));
+              } catch (error) {
+                fail(new Error(
+                  `Invalid export archive: malformed bundle.json: ${error instanceof Error ? error.message : String(error)}`
+                ));
+              }
+            } else {
+              files.set(entryPath, content);
+            }
+          });
+        }
+      });
+      gunzip.on("data", (chunk) => {
+        if (settled) return;
+        decompressedBytes += chunk.length;
+        if (decompressedBytes > MAX_ARCHIVE_TOTAL_BYTES) {
+          fail(new Error("Invalid export archive: total uncompressed size exceeds 512 MB"));
+        }
+      });
+      gunzip.on("error", fail);
+      parser.on("ignoredEntry", (entry) => {
+        if (!countEntry()) return;
+        fail(new Error(`Invalid export archive: unsupported entry type "${entry.type}"`));
+      });
+      parser.on("meta", () => {
+        if (!countEntry()) return;
+        fail(new Error("Invalid export archive: unsupported metadata entry"));
+      });
+      parser.on("error", fail);
+      parser.on("end", () => {
+        if (settled) return;
+        settled = true;
+        resolve2();
+      });
+      gunzip.pipe(parser);
+      gunzip.end(buffer);
+    });
+    if (!bundle) {
+      throw new Error("Invalid export archive: missing bundle.json");
+    }
+    return { bundle, files };
   }
   /**
    * Preview import: validate bundle and detect conflicts.
    */
-  async previewImport(tenantId, bundle) {
-    this.validateBundle(bundle);
+  async previewImport(tenantId, bundle, context) {
+    const dependencyOrder = this.validateBundle(bundle);
     const allConflicts = [];
     const allInsertions = [];
     const allErrors = [];
-    for (const [entityType, entities] of Object.entries(bundle.entities)) {
+    for (const entityType of dependencyOrder) {
+      const entities = bundle.entities[entityType];
       if (entities.length === 0) continue;
       try {
         const def = this.registry.get(entityType);
-        const result = await def.previewImport(tenantId, entities);
+        const result = await def.previewImport(tenantId, entities, context);
         allConflicts.push(...result.conflicts);
         allInsertions.push(...result.insertions);
         allErrors.push(...result.errors);
@@ -3758,25 +3786,132 @@ var ExportImportService = class {
   }
   /**
    * Apply import: create entities in dependency order with ID remapping.
+   * File content (if any) is passed to registrations via the `files` map.
    */
-  async applyImport(tenantId, bundle, resolutions) {
-    this.validateBundle(bundle);
+  async applyImport(tenantId, bundle, resolutions, files, context) {
+    const dependencyOrder = this.validateBundle(bundle);
     const results = [];
     const idMap = {};
+    const unresolvedExportIds = /* @__PURE__ */ new Set();
     const skillIdRemap = {};
-    for (const entityType of bundle.dependencyOrder) {
+    const skillSourceToTarget = /* @__PURE__ */ new Map();
+    const unresolvedSkillReferences = /* @__PURE__ */ new Map();
+    const skillEntities = bundle.entities.skill ?? [];
+    const skillConflicts = skillEntities.length > 0 ? await this.registry.get("skill").previewImport(tenantId, skillEntities, context) : { conflicts: [] };
+    const skillConflictByExportId = new Map(
+      skillConflicts.conflicts.map((conflict) => [conflict._exportId, conflict])
+    );
+    for (const entity of skillEntities) {
+      const resolution = resolutions[entity._exportId];
+      const sourceId = entity.data.id;
+      const targetId = resolution?.action === "skip" ? skillConflictByExportId.get(entity._exportId)?.existingId : resolution?.action === "rename" && resolution.newId ? resolution.newId : sourceId;
+      if (targetId) skillSourceToTarget.set(sourceId, targetId);
+    }
+    for (const entity of skillEntities) {
+      const subSkills = entity.data.subSkills;
+      if (!Array.isArray(subSkills)) continue;
+      const unresolved = subSkills.find((id) => typeof id === "string" && !skillSourceToTarget.has(id) && !isBuiltInSkill(id));
+      if (unresolved) unresolvedSkillReferences.set(entity._exportId, unresolved);
+    }
+    for (const entityType of dependencyOrder) {
       const entities = bundle.entities[entityType];
       if (!entities || entities.length === 0) continue;
       const def = this.registry.get(entityType);
       const remapper = new IdRemapper(idMap);
+      let insertions = /* @__PURE__ */ new Set();
+      let conflicts = /* @__PURE__ */ new Set();
+      let conflictByExportId = /* @__PURE__ */ new Map();
+      let previewError;
+      try {
+        const preview = await def.previewImport(tenantId, entities, context);
+        insertions = new Set(preview.insertions.map((item) => item._exportId));
+        conflicts = new Set(preview.conflicts.map((item) => item._exportId));
+        conflictByExportId = new Map(preview.conflicts.map((item) => [item._exportId, item]));
+      } catch (err) {
+        previewError = err.message;
+      }
       for (const entity of entities) {
-        const resolution = resolutions[entity._exportId];
+        let resolution = resolutions[entity._exportId];
         if (resolution?.action === "skip") {
-          results.push({ _exportId: entity._exportId, entityType, status: "skipped" });
+          const conflict = conflictByExportId.get(entity._exportId);
+          if (conflict && !conflict.existingId) {
+            unresolvedExportIds.add(entity._exportId);
+            results.push({
+              _exportId: entity._exportId,
+              entityType,
+              status: "failed",
+              error: "Cannot skip conflict without an existing ID"
+            });
+            continue;
+          }
+          if (conflict?.existingId) {
+            idMap[entity._exportId] = conflict.existingId;
+          }
+          results.push({
+            _exportId: entity._exportId,
+            entityType,
+            status: "skipped",
+            newId: conflict?.existingId
+          });
+          continue;
+        }
+        const pendingValues = [entity.data];
+        let unresolvedReference;
+        while (pendingValues.length > 0 && !unresolvedReference) {
+          const value = pendingValues.pop();
+          if (typeof value === "string") {
+            const match = value.match(/^@\w+\/(.+)$/);
+            if (match && unresolvedExportIds.has(match[1])) {
+              unresolvedReference = match[1];
+            }
+          } else if (Array.isArray(value)) {
+            pendingValues.push(...value);
+          } else if (value && typeof value === "object") {
+            pendingValues.push(...Object.values(value));
+          }
+        }
+        if (unresolvedReference) {
+          unresolvedExportIds.add(entity._exportId);
+          results.push({
+            _exportId: entity._exportId,
+            entityType,
+            status: "failed",
+            error: `Unresolved reference to failed import entity "${unresolvedReference}"`
+          });
           continue;
         }
+        if (!resolution) {
+          if (previewError || conflicts.has(entity._exportId) || !insertions.has(entity._exportId)) {
+            results.push({
+              _exportId: entity._exportId,
+              entityType,
+              status: "failed",
+              error: previewError ? `Unable to verify missing conflict resolution: ${previewError}` : "Missing conflict resolution"
+            });
+            continue;
+          }
+          resolution = {
+            _exportId: entity._exportId,
+            action: "insert"
+          };
+        }
         try {
           const remappedData = remapper.remapReferences(entity.data);
+          if (entityType === "skill") {
+            const unresolvedSkill = unresolvedSkillReferences.get(entity._exportId);
+            if (unresolvedSkill) {
+              results.push({
+                _exportId: entity._exportId,
+                entityType,
+                status: "failed",
+                error: `Unresolved subSkill reference "${unresolvedSkill}"`
+              });
+              continue;
+            }
+            if (Array.isArray(remappedData.subSkills)) {
+              remappedData.subSkills = remappedData.subSkills.map((id) => typeof id === "string" ? skillSourceToTarget.get(id) ?? id : id);
+            }
+          }
           if (entityType === "agent" && Object.keys(skillIdRemap).length > 0) {
             const skillRemapper = new IdRemapper({});
             remappedData.graphDefinition = skillRemapper.remapSkillIds(
@@ -3784,19 +3919,26 @@ var ExportImportService = class {
               skillIdRemap
             );
           }
-          if (resolution?.action === "rename" && resolution.newId) {
+          if (resolution.action === "rename" && resolution.newId) {
             remappedData.id = resolution.newId;
           }
+          const entityFiles = this.extractEntityFiles(
+            entityType,
+            entity.data.id,
+            files
+          );
           const entityWithRemappedData = { ...entity, data: remappedData };
           const { newId } = await def.applyImport(
             tenantId,
             entityWithRemappedData,
-            resolution ?? { _exportId: entity._exportId, action: "overwrite" }
+            resolution,
+            entityFiles,
+            context
           );
           if (newId) {
             idMap[entity._exportId] = newId;
             if (entityType === "skill" && newId) {
-              const oldSkillId = remappedData.id;
+              const oldSkillId = entity.data.id;
               if (oldSkillId !== newId) {
                 skillIdRemap[oldSkillId] = newId;
               }
@@ -3804,7 +3946,7 @@ var ExportImportService = class {
             results.push({
               _exportId: entity._exportId,
               entityType,
-              status: resolution?.action === "overwrite" ? "updated" : "created",
+              status: resolution.action === "overwrite" ? "updated" : "created",
               newId
             });
           }
@@ -3826,43 +3968,292 @@ var ExportImportService = class {
   listExportableTypes() {
     return this.registry.listTypes();
   }
-  validateBundle(bundle) {
-    if (bundle.version !== 1) {
-      throw new Error(`Unsupported bundle version: ${bundle.version}. Expected: 1`);
-    }
-    if (!bundle.entities || typeof bundle.entities !== "object") {
-      throw new Error("Invalid bundle: missing entities");
-    }
-    if (!Array.isArray(bundle.dependencyOrder)) {
-      throw new Error("Invalid bundle: missing dependencyOrder");
+  /**
+   * Extract file content for a single entity from the archive files map.
+   * Keys are `files/{entityType}/{entityId}/{path}`; returns a Map of relative path → Buffer.
+   */
+  extractEntityFiles(entityType, entityId, files) {
+    if (!files || files.size === 0) return void 0;
+    const prefix = `files/${entityType}/${entityId}/`;
+    const result = /* @__PURE__ */ new Map();
+    for (const [path4, content] of files.entries()) {
+      if (path4.startsWith(prefix)) {
+        result.set(path4.slice(prefix.length), content);
+      }
     }
+    return result.size > 0 ? result : void 0;
   }
-  sanitizeEntityData(data) {
-    const sanitized = { ...data };
-    delete sanitized.tenantId;
-    delete sanitized.createdAt;
-    delete sanitized.updatedAt;
-    return sanitized;
-  }
-};
+  async resolveExportSelection(tenantId, entityTypes, entityIds, context) {
+    const allDefs = this.registry.getAll();
+    const registeredTypes = new Set(allDefs.map((def) => def.entityType));
+    for (const type of entityTypes) {
+      if (!registeredTypes.has(type)) {
+        throw new Error(`Exportable entity type is not registered: "${type}"`);
+      }
+    }
+    const expanded = DependencyResolver.expandCascade(allDefs, entityTypes);
+    const dependencies = DependencyResolver.computeDependencies(allDefs, expanded).missing;
+    const finalTypeSet = /* @__PURE__ */ new Set([...expanded, ...dependencies]);
+    const dependencyOrder = DependencyResolver.resolveOrder(
+      allDefs.filter((def) => finalTypeSet.has(def.entityType))
+    );
+    const availableByType = /* @__PURE__ */ new Map();
+    const selectedIds = /* @__PURE__ */ new Map();
+    const processedIds = /* @__PURE__ */ new Map();
+    for (const type of dependencyOrder) {
+      const raw = await this.registry.get(type).listForExport(tenantId, context);
+      availableByType.set(type, new Map(raw.map((entity) => [entity.data.id, entity])));
+      if (entityIds && Object.prototype.hasOwnProperty.call(entityIds, type)) {
+        selectedIds.set(type, new Set(entityIds[type]));
+      } else if (expanded.includes(type)) {
+        selectedIds.set(type, new Set(raw.map((entity) => entity.data.id)));
+      } else {
+        selectedIds.set(type, /* @__PURE__ */ new Set());
+      }
+      processedIds.set(type, /* @__PURE__ */ new Set());
+    }
+    let referencesAdded = true;
+    while (referencesAdded) {
+      referencesAdded = false;
+      for (const type of dependencyOrder) {
+        const def = this.registry.get(type);
+        if (!def.getReferencedEntityIds) continue;
+        const processed = processedIds.get(type);
+        const available = availableByType.get(type);
+        const unprocessed = [...selectedIds.get(type)].filter((id) => !processed.has(id)).map((id) => available.get(id)).filter((entity) => entity !== void 0);
+        if (unprocessed.length === 0) continue;
+        for (const entity of unprocessed) processed.add(entity.data.id);
+        const references = await def.getReferencedEntityIds(tenantId, unprocessed, context);
+        for (const [referencedType, ids] of Object.entries(references)) {
+          if (!finalTypeSet.has(referencedType)) {
+            throw new Error(
+              `Unresolved reference from ${type}: entity type "${referencedType}" is not in its registered dependency closure`
+            );
+          }
+          const targetSelection = selectedIds.get(referencedType);
+          const targetEntities = availableByType.get(referencedType);
+          const explicitSelection = entityIds && Object.prototype.hasOwnProperty.call(entityIds, referencedType) ? new Set(entityIds[referencedType]) : void 0;
+          for (const id of new Set(ids)) {
+            if (referencedType === "skill" && isBuiltInSkill(id)) continue;
+            if (explicitSelection && !explicitSelection.has(id)) {
+              throw new Error(
+                `Required reference from ${type} to ${referencedType} "${id}" is omitted by entityIds.${referencedType}`
+              );
+            }
+            if (!targetEntities.has(id)) {
+              throw new Error(`Unresolved reference from ${type} to ${referencedType} "${id}"`);
+            }
+            if (!targetSelection.has(id)) {
+              targetSelection.add(id);
+              referencesAdded = true;
+            }
+          }
+        }
+      }
+    }
+    const entities = {};
+    for (const type of dependencyOrder) {
+      const ids = selectedIds.get(type);
+      entities[type] = [...availableByType.get(type).values()].filter((entity) => ids.has(entity.data.id));
+    }
+    return { dependencyOrder, entities };
+  }
+  validateBundle(bundle) {
+    if (bundle.version !== 1) {
+      throw new Error(`Unsupported bundle version: ${bundle.version}. Expected: 1`);
+    }
+    if (!bundle.entities || typeof bundle.entities !== "object" || Array.isArray(bundle.entities)) {
+      throw new Error("Invalid bundle: missing entities");
+    }
+    if (!Array.isArray(bundle.dependencyOrder)) {
+      throw new Error("Invalid bundle: missing dependencyOrder");
+    }
+    const orderSet = new Set(bundle.dependencyOrder);
+    if (orderSet.size !== bundle.dependencyOrder.length) {
+      throw new Error("Invalid bundle: duplicate type in dependencyOrder");
+    }
+    const entityTypes = Object.keys(bundle.entities);
+    for (const entityType of entityTypes) {
+      if (!Array.isArray(bundle.entities[entityType])) {
+        throw new Error(`Invalid bundle: entities.${entityType} must be an array`);
+      }
+      if (!orderSet.has(entityType)) {
+        throw new Error(`Invalid bundle: dependencyOrder omits entities type "${entityType}"`);
+      }
+    }
+    for (const entityType of bundle.dependencyOrder) {
+      if (!Object.prototype.hasOwnProperty.call(bundle.entities, entityType)) {
+        throw new Error(`Invalid bundle: missing entities key for dependencyOrder type "${entityType}"`);
+      }
+      const def = this.registry.getAll().find((candidate) => candidate.entityType === entityType);
+      if (!def) {
+        throw new Error(`Invalid bundle: unregistered entity type "${entityType}"`);
+      }
+      for (const dependency of def.dependsOn) {
+        const dependencyRegistered = this.registry.getAll().some((candidate) => candidate.entityType === dependency);
+        if (dependencyRegistered && !orderSet.has(dependency)) {
+          throw new Error(
+            `Invalid bundle: missing registered dependency "${dependency}" required by "${entityType}"`
+          );
+        }
+      }
+    }
+    const exportIds = /* @__PURE__ */ new Set();
+    for (const entityType of entityTypes) {
+      const ids = /* @__PURE__ */ new Set();
+      for (const entity of bundle.entities[entityType]) {
+        if (!entity || typeof entity !== "object" || typeof entity._exportId !== "string") {
+          throw new Error(`Invalid bundle: malformed entity in "${entityType}"`);
+        }
+        if (exportIds.has(entity._exportId)) {
+          throw new Error(`Invalid bundle: duplicate _exportId "${entity._exportId}"`);
+        }
+        exportIds.add(entity._exportId);
+        const id = entity.data?.id;
+        if (typeof id !== "string") {
+          throw new Error(`Invalid bundle: entity ID in "${entityType}" must be a string`);
+        }
+        if (ids.has(id)) {
+          throw new Error(`Invalid bundle: duplicate entity ID in "${entityType}": "${id}"`);
+        }
+        ids.add(id);
+      }
+    }
+    const typeSet = new Set(entityTypes);
+    const canonicalOrder = DependencyResolver.resolveOrder(
+      this.registry.getAll().filter((def) => typeSet.has(def.entityType))
+    );
+    if (canonicalOrder.length !== bundle.dependencyOrder.length || canonicalOrder.some((type, index) => bundle.dependencyOrder[index] !== type)) {
+      throw new Error(
+        `Invalid bundle: dependencyOrder is not canonical; expected ${canonicalOrder.join(", ")}`
+      );
+    }
+    return canonicalOrder;
+  }
+  sanitizeEntityData(data) {
+    const sanitized = { ...data };
+    delete sanitized.tenantId;
+    delete sanitized.createdAt;
+    delete sanitized.updatedAt;
+    return sanitized;
+  }
+};
 
 // src/controllers/export-import.ts
 import { ExportableEntityRegistry as ExportableEntityRegistry2 } from "@axiom-lattice/core";
 var service = new ExportImportService();
-function getTenantId10(request) {
-  return request.user?.tenantId || request.headers["x-tenant-id"] || "default";
+var TenantScopeError = class extends Error {
+  constructor() {
+    super(...arguments);
+    this.statusCode = 403;
+  }
+};
+function resolveTenantId(request, routeTenantId) {
+  const authenticatedTenantId = request.user?.tenantId;
+  const header = request.headers["x-tenant-id"];
+  const headerTenantId = Array.isArray(header) ? header[0] : header;
+  if (authenticatedTenantId) {
+    if (headerTenantId && headerTenantId !== authenticatedTenantId) {
+      throw new TenantScopeError(
+        `Tenant scope mismatch: header tenant "${headerTenantId}" does not match authenticated tenant "${authenticatedTenantId}"`
+      );
+    }
+    if (routeTenantId && routeTenantId !== authenticatedTenantId) {
+      throw new TenantScopeError(
+        `Tenant scope mismatch: route tenant "${routeTenantId}" does not match authenticated tenant "${authenticatedTenantId}"`
+      );
+    }
+    return authenticatedTenantId;
+  }
+  return headerTenantId || routeTenantId || "default";
+}
+function getContext(request) {
+  return {
+    workspaceId: request.headers["x-workspace-id"] || void 0,
+    projectId: request.headers["x-project-id"] || void 0
+  };
+}
+function safeArchiveFilename(sourceTenantId) {
+  const safeTenantId = sourceTenantId.replace(/[^A-Za-z0-9._-]/g, "_");
+  return `tenant-export-${safeTenantId}.tar.gz`;
+}
+function assertCompleteFile(file) {
+  if (file.truncated) {
+    throw new Error("Uploaded file was truncated because it exceeds the configured file size limit");
+  }
+}
+function parseResolutions(value) {
+  let parsed = value;
+  if (typeof value === "string") {
+    try {
+      parsed = JSON.parse(value);
+    } catch {
+      throw new Error("resolutions must be valid JSON");
+    }
+  }
+  if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
+    throw new Error("resolutions must be a JSON object");
+  }
+  return parsed;
+}
+function requireJsonBundle(request, body) {
+  const contentType = request.headers["content-type"]?.split(";", 1)[0]?.trim().toLowerCase();
+  if (contentType !== "application/json" || body.bundle === void 0) {
+    throw new Error('Provide a multipart tar.gz file or an application/json body with "bundle"');
+  }
+  return body.bundle;
+}
+async function readPreviewArchive(request) {
+  const part = await request.file();
+  if (!part || part.fieldname !== "file") {
+    throw new Error('Multipart import requires a tar.gz file field named "file"');
+  }
+  const archive = await part.toBuffer();
+  assertCompleteFile(part.file);
+  return archive;
+}
+async function readApplyMultipart(request) {
+  let archive;
+  let resolutionsValue;
+  for await (const part of request.parts()) {
+    if (part.type === "file") {
+      if (part.fieldname !== "file" || archive !== void 0) {
+        part.file.resume();
+        throw new Error('Multipart import requires exactly one tar.gz file field named "file"');
+      }
+      archive = await part.toBuffer();
+      assertCompleteFile(part.file);
+    } else if (part.fieldname === "resolutions") {
+      if (resolutionsValue !== void 0) {
+        throw new Error('Multipart import requires exactly one "resolutions" field');
+      }
+      resolutionsValue = part.value;
+    }
+  }
+  if (!archive) {
+    throw new Error('Multipart import requires a tar.gz file field named "file"');
+  }
+  if (resolutionsValue === void 0) {
+    throw new Error('Multipart import requires a "resolutions" JSON field');
+  }
+  return { archive, resolutions: parseResolutions(resolutionsValue) };
 }
 async function getExportableTypes(_request, reply) {
   const types = service.listExportableTypes();
   return reply.send({ success: true, data: types });
 }
 async function exportConfig(request, reply) {
-  const tenantId = getTenantId10(request) || request.params.tenantId;
+  const tenantId = resolveTenantId(request, request.params.tenantId);
   const { entityTypes, entityIds } = request.body;
   if (!Array.isArray(entityTypes) || entityTypes.length === 0) {
     return reply.status(400).send({ success: false, message: "entityTypes must be a non-empty array" });
   }
-  const preview = await service.exportPreview(tenantId, entityTypes);
+  const preview = await service.exportPreview(
+    tenantId,
+    entityTypes,
+    entityIds,
+    getContext(request)
+  );
   if (preview.missingDependencies.length > 0 || preview.cascadeAdditions.length > 0) {
     return reply.send({
       success: true,
@@ -3873,40 +4264,41 @@ async function exportConfig(request, reply) {
       }
     });
   }
-  const { jobId, bundle } = await service.export(tenantId, entityTypes, entityIds);
+  const { jobId, data } = await service.export(tenantId, entityTypes, entityIds, getContext(request));
   return reply.send({
     success: true,
     data: {
       jobId,
       summary: Object.fromEntries(
-        Object.entries(bundle.entities).map(([type, entities]) => [type, entities.length])
+        Object.entries(data.bundle.entities).map(([type, entities]) => [type, entities.length])
       )
     }
   });
 }
 async function exportConfigConfirm(request, reply) {
-  const tenantId = getTenantId10(request) || request.params.tenantId;
+  const tenantId = resolveTenantId(request, request.params.tenantId);
   const { entityTypes, entityIds } = request.body;
-  const { jobId, bundle } = await service.export(tenantId, entityTypes, entityIds);
+  const { jobId, data } = await service.export(tenantId, entityTypes, entityIds, getContext(request));
   return reply.send({
     success: true,
     data: {
       jobId,
       summary: Object.fromEntries(
-        Object.entries(bundle.entities).map(([type, entities]) => [type, entities.length])
+        Object.entries(data.bundle.entities).map(([type, entities]) => [type, entities.length])
       )
     }
   });
 }
 async function previewEntities(request, reply) {
-  const tenantId = getTenantId10(request) || request.params.tenantId;
+  const tenantId = resolveTenantId(request, request.params.tenantId);
   const { entityTypes } = request.body;
+  const context = getContext(request);
   try {
     const registry = ExportableEntityRegistry2.getInstance();
     const result = {};
     for (const type of entityTypes) {
       const def = registry.get(type);
-      const entities = await def.listForExport(tenantId);
+      const entities = await def.listForExport(tenantId, context);
       result[type] = entities.map((e) => ({
         id: e.data.id,
         name: e.data.name || e.data.id,
@@ -3919,21 +4311,22 @@ async function previewEntities(request, reply) {
   }
 }
 async function downloadExport(request, reply) {
-  const tenantId = getTenantId10(request) || request.params.tenantId;
-  const bundle = service.getExportJob(request.params.jobId, tenantId);
-  if (!bundle) {
+  const tenantId = resolveTenantId(request, request.params.tenantId);
+  const data = service.getExportJob(request.params.jobId, tenantId);
+  if (!data) {
     return reply.status(404).send({ success: false, message: "Export job not found or expired" });
   }
-  return reply.header("Content-Type", "application/json").header("Content-Disposition", `attachment; filename="tenant-export-${bundle.sourceTenantId}.json"`).send({ success: true, data: bundle });
+  const tarGz = await service.packTarGz(data);
+  const filename = safeArchiveFilename(data.bundle.sourceTenantId);
+  reply.type("application/gzip");
+  reply.header("Content-Disposition", `attachment; filename="${filename}"`);
+  return reply.send(tarGz);
 }
 async function importPreview(request, reply) {
-  const tenantId = getTenantId10(request) || request.params.tenantId;
-  const { bundle } = request.body;
-  if (!bundle) {
-    return reply.status(400).send({ success: false, message: "No bundle provided in request body" });
-  }
+  const tenantId = resolveTenantId(request, request.params.tenantId);
   try {
-    const preview = await service.previewImport(tenantId, bundle);
+    const data = request.isMultipart() ? await service.unpackTarGz(await readPreviewArchive(request)) : { bundle: requireJsonBundle(request, request.body), files: void 0 };
+    const preview = await service.previewImport(tenantId, data.bundle, getContext(request));
     return reply.send({ success: true, data: preview });
   } catch (err) {
     return reply.status(400).send({
@@ -3943,10 +4336,12 @@ async function importPreview(request, reply) {
   }
 }
 async function importApply(request, reply) {
-  const tenantId = getTenantId10(request) || request.params.tenantId;
+  const tenantId = resolveTenantId(request, request.params.tenantId);
   try {
-    const { bundle, resolutions } = request.body;
-    const result = await service.applyImport(tenantId, bundle, resolutions);
+    const multipart2 = request.isMultipart() ? await readApplyMultipart(request) : void 0;
+    const data = multipart2 ? await service.unpackTarGz(multipart2.archive) : { bundle: requireJsonBundle(request, request.body), files: void 0 };
+    const resolutions = multipart2?.resolutions ?? parseResolutions(request.body.resolutions);
+    const result = await service.applyImport(tenantId, data.bundle, resolutions, data.files, getContext(request));
     return reply.send({ success: true, data: result });
   } catch (err) {
     return reply.status(400).send({
@@ -4632,43 +5027,15 @@ function registerSandboxProxyRoutes(app2) {
 // src/controllers/workspace.ts
 import * as fs2 from "fs/promises";
 import * as path2 from "path";
-import * as os from "os";
-import { getStoreLattice as getStoreLattice7 } from "@axiom-lattice/core";
+import * as os2 from "os";
+import { getStoreLattice as getStoreLattice6 } from "@axiom-lattice/core";
 import { SandboxFilesystem, FilesystemBackend } from "@axiom-lattice/core";
 import { getSandBoxManager as getSandBoxManager3 } from "@axiom-lattice/core";
 import { v4 as uuidv42 } from "uuid";
-
-// src/utils/path-containment.ts
-import * as fs from "fs/promises";
-import * as path from "path";
-var PathOutsideRootError = class extends Error {
-  constructor(rootPath, targetPath) {
-    super(`Path is outside the allowed root: ${targetPath}`);
-    this.rootPath = rootPath;
-    this.targetPath = targetPath;
-    this.name = "PathOutsideRootError";
-  }
-};
-function isPathWithinRoot(rootPath, targetPath) {
-  const relative2 = path.relative(rootPath, targetPath);
-  return relative2 === "" || relative2 !== ".." && !relative2.startsWith(`..${path.sep}`) && !path.isAbsolute(relative2);
-}
-async function resolvePathWithinRoot(rootPath, targetPath) {
-  const [resolvedRoot, resolvedTarget] = await Promise.all([
-    fs.realpath(rootPath),
-    fs.realpath(targetPath)
-  ]);
-  if (!isPathWithinRoot(resolvedRoot, resolvedTarget)) {
-    throw new PathOutsideRootError(resolvedRoot, resolvedTarget);
-  }
-  return { rootPath: resolvedRoot, targetPath: resolvedTarget };
-}
-
-// src/controllers/workspace.ts
 var WorkspaceController = class {
   constructor() {
-    this.workspaceStore = getStoreLattice7("default", "workspace").store;
-    this.projectStore = getStoreLattice7("default", "project").store;
+    this.workspaceStore = getStoreLattice6("default", "workspace").store;
+    this.projectStore = getStoreLattice6("default", "project").store;
   }
   getTenantId(request) {
     const userTenantId = request.user?.tenantId;
@@ -4740,11 +5107,33 @@ var WorkspaceController = class {
   async listProjects(request, reply) {
     const tenantId = this.getTenantId(request);
     const { workspaceId } = request.params;
-    const projects = await this.projectStore.getProjectsByWorkspace(
+    const kindFilter = request.query.kind;
+    await this.ensureTrainingProject(tenantId, workspaceId);
+    const projects = kindFilter ? await this.projectStore.getProjectsByWorkspace(tenantId, workspaceId, {
+      kind: kindFilter
+    }) : await this.projectStore.getProjectsByWorkspace(tenantId, workspaceId);
+    return { success: true, data: projects };
+  }
+  /**
+   * Ensure at least one training project exists per tenant/workspace.
+   *
+   * Multiple training projects are allowed; this only creates the first one
+   * when none exist so the frontend always has a default to select.
+   */
+  async ensureTrainingProject(tenantId, workspaceId) {
+    const existing = await this.projectStore.getProjectsByWorkspace(
       tenantId,
-      workspaceId
+      workspaceId,
+      { kind: "training" }
     );
-    return { success: true, data: projects };
+    if (existing.length > 0) {
+      return;
+    }
+    await this.projectStore.createProject(tenantId, workspaceId, uuidv42(), {
+      name: "Training",
+      description: "Shared workspace for agent training",
+      kind: "training"
+    });
   }
   async createProject(request, reply) {
     const tenantId = this.getTenantId(request);
@@ -4784,7 +5173,24 @@ var WorkspaceController = class {
   }
   async deleteProject(request, reply) {
     const tenantId = this.getTenantId(request);
-    const { projectId } = request.params;
+    const { workspaceId, projectId } = request.params;
+    const project = await this.projectStore.getProjectById(tenantId, projectId);
+    if (!project) {
+      return reply.status(404).send({ success: false, error: "Project not found" });
+    }
+    if (project.kind === "training") {
+      const training = await this.projectStore.getProjectsByWorkspace(
+        tenantId,
+        workspaceId,
+        { kind: "training" }
+      );
+      if (training.length <= 1) {
+        return reply.status(409).send({
+          success: false,
+          error: "The last training project cannot be deleted"
+        });
+      }
+    }
     const deleted = await this.projectStore.deleteProject(tenantId, projectId);
     if (!deleted) {
       return reply.status(404).send({ success: false, error: "Project not found" });
@@ -4826,7 +5232,7 @@ var WorkspaceController = class {
         workspace
       };
     }
-    const rootDir = await this.getFilesystemRootDirectory(
+    const rootDir = filesystemRootDirectory(
       tenantId,
       workspaceId,
       projectId
@@ -4840,41 +5246,6 @@ var WorkspaceController = class {
       workspace
     };
   }
-  async getFilesystemRootDirectory(tenantId, workspaceId, projectId) {
-    return `/lattice_store/tenants/${tenantId}/workspaces/${workspaceId}/${projectId}`;
-  }
-  isBinaryContentType(filename) {
-    const ext = filename.split(".").pop()?.toLowerCase() || "";
-    const binaryExtensions = /* @__PURE__ */ new Set([
-      "pdf",
-      "xlsx",
-      "xls",
-      "docx",
-      "doc",
-      "pptx",
-      "ppt",
-      "png",
-      "jpg",
-      "jpeg",
-      "gif",
-      "bmp",
-      "ico",
-      "webp",
-      "mp3",
-      "mp4",
-      "webm",
-      "ogg",
-      "wav",
-      "avi",
-      "mov",
-      "zip",
-      "tar",
-      "gz",
-      "rar",
-      "7z"
-    ]);
-    return binaryExtensions.has(ext);
-  }
   async downloadFile(request, reply) {
     const tenantId = this.getTenantId(request);
     const { workspaceId, projectId } = request.params;
@@ -4951,7 +5322,7 @@ var WorkspaceController = class {
           projectId
         };
         const filename2 = getFilenameFromPath(resolvedPath);
-        const isBinary = this.isBinaryContentType(filename2);
+        const isBinary = isBinaryContentType(filename2);
         const volumeBackend = await sandboxManager.getVolumeBackendForPath(volumeConfig, resolvedPath);
         let buf;
         if (volumeBackend) {
@@ -5082,80 +5453,29 @@ var WorkspaceController = class {
       if (pathValue && !/^[a-zA-Z0-9_./~-]+$/.test(pathValue)) {
         return reply.status(400).send({ success: false, error: "Invalid path parameter" });
       }
-      if (workspace.storageType === "sandbox") {
-        const sandboxManager = getSandBoxManager3();
-        const volumeConfig = {
-          assistant_id: assistantId || "",
-          thread_id: "",
-          tenantId,
-          workspaceId,
-          projectId
-        };
-        const realPath = pathValue ? path2.posix.join(pathValue, filename) : path2.posix.join("/project/uploads", filename);
-        const isBinary = this.isBinaryContentType(filename);
-        const volumeBackend = await sandboxManager.getVolumeBackendForPath(volumeConfig, realPath);
-        if (volumeBackend && !isBinary) {
-          await volumeBackend.write(realPath, buffer.toString("utf-8"));
-        } else if (volumeBackend && volumeBackend.writeBinary) {
-          await volumeBackend.writeBinary(realPath, buffer);
-        } else {
-          const sandbox = await sandboxManager.getSandboxFromConfig(volumeConfig);
-          await sandbox.file.uploadFile({ file: realPath, data: buffer });
-        }
-        const relativePath = pathValue ? path2.posix.join(pathValue, filename) : path2.posix.join("/project/uploads", filename);
-        const result2 = {
-          path: relativePath,
-          name: filename,
-          is_dir: false,
-          size: buffer.length,
-          modified_at: (/* @__PURE__ */ new Date()).toISOString()
-        };
-        return reply.status(200).send({ success: true, data: result2 });
-      }
-      const rootDir = await this.getFilesystemRootDirectory(
+      const saved = await saveProjectFile({
         tenantId,
         workspaceId,
-        projectId
-      );
-      await fs2.mkdir(rootDir, { recursive: true });
-      const relativeDirectory = pathValue?.replace(/^[/\\]+/, "") || ".";
-      const targetDir = path2.resolve(rootDir, relativeDirectory);
-      if (!isPathWithinRoot(path2.resolve(rootDir), targetDir)) {
-        return reply.status(400).send({
-          success: false,
-          error: "Upload path must stay within the project directory"
-        });
-      }
-      await fs2.mkdir(targetDir, { recursive: true });
-      const [resolvedRoot, resolvedTargetDir] = await Promise.all([
-        fs2.realpath(rootDir),
-        fs2.realpath(targetDir)
-      ]);
-      if (!isPathWithinRoot(resolvedRoot, resolvedTargetDir)) {
-        return reply.status(400).send({
-          success: false,
-          error: "Upload path must stay within the project directory"
-        });
-      }
-      const safeFilename = path2.basename(filename);
-      if (safeFilename !== filename) {
-        return reply.status(400).send({
-          success: false,
-          error: "Invalid filename"
-        });
-      }
-      const targetPath = path2.join(resolvedTargetDir, safeFilename);
-      await fs2.writeFile(targetPath, buffer);
-      const stat2 = await fs2.stat(targetPath);
-      const result = {
-        path: path2.posix.join("/", relativeDirectory, safeFilename),
+        projectId,
         name: filename,
-        is_dir: false,
-        size: stat2.size,
-        modified_at: stat2.mtime.toISOString()
-      };
-      return reply.status(200).send({ success: true, data: result });
+        bytes: buffer,
+        ...pathValue ? { path: pathValue } : {},
+        assistantId
+      });
+      return reply.status(200).send({
+        success: true,
+        data: {
+          path: saved.uri,
+          name: saved.name,
+          is_dir: false,
+          size: saved.size,
+          modified_at: (/* @__PURE__ */ new Date()).toISOString()
+        }
+      });
     } catch (error) {
+      if (error instanceof ProjectFileValidationError) {
+        return reply.status(400).send({ success: false, error: error.message });
+      }
       const message = error instanceof Error ? error.message : String(error);
       return reply.status(500).send({
         success: false,
@@ -5172,7 +5492,7 @@ var WorkspaceController = class {
    * - Returns only directory names, no file contents or hidden files
    */
   async browseFilesystem(request, reply) {
-    const homeDir = os.homedir();
+    const homeDir = os2.homedir();
     const requestedPath = request.query.path || homeDir;
     const SYSTEM_BLACKLIST = ["/etc", "/sys", "/proc", "/var", "/tmp", "/dev"];
     try {
@@ -5281,11 +5601,11 @@ function registerWorkspaceRoutes(app2) {
 
 // src/controllers/database-configs.ts
 import {
-  getStoreLattice as getStoreLattice8,
+  getStoreLattice as getStoreLattice7,
   sqlDatabaseManager
 } from "@axiom-lattice/core";
 import { randomUUID as randomUUID5 } from "crypto";
-function getTenantId11(request) {
+function getTenantId9(request) {
   const userTenantId = request.user?.tenantId;
   if (userTenantId) {
     return userTenantId;
@@ -5293,9 +5613,9 @@ function getTenantId11(request) {
   return request.headers["x-tenant-id"] || "default";
 }
 async function getDatabaseConfigList(request, reply) {
-  const tenantId = getTenantId11(request);
+  const tenantId = getTenantId9(request);
   try {
-    const storeLattice = getStoreLattice8("default", "database");
+    const storeLattice = getStoreLattice7("default", "database");
     const store = storeLattice.store;
     const configs = await store.getAllConfigs(tenantId);
     console.log("Backend: getAllConfigs returned:", configs);
@@ -5323,10 +5643,10 @@ async function getDatabaseConfigList(request, reply) {
   }
 }
 async function getDatabaseConfig(request, reply) {
-  const tenantId = getTenantId11(request);
+  const tenantId = getTenantId9(request);
   const { key } = request.params;
   try {
-    const storeLattice = getStoreLattice8("default", "database");
+    const storeLattice = getStoreLattice7("default", "database");
     const store = storeLattice.store;
     const config = await store.getConfigByKey(tenantId, key);
     if (!config) {
@@ -5349,10 +5669,10 @@ async function getDatabaseConfig(request, reply) {
   }
 }
 async function createDatabaseConfig(request, reply) {
-  const tenantId = getTenantId11(request);
+  const tenantId = getTenantId9(request);
   const body = request.body;
   try {
-    const storeLattice = getStoreLattice8("default", "database");
+    const storeLattice = getStoreLattice7("default", "database");
     const store = storeLattice.store;
     const existing = await store.getConfigByKey(tenantId, body.key);
     if (existing) {
@@ -5384,11 +5704,11 @@ async function createDatabaseConfig(request, reply) {
   }
 }
 async function updateDatabaseConfig(request, reply) {
-  const tenantId = getTenantId11(request);
+  const tenantId = getTenantId9(request);
   const { key } = request.params;
   const updates = request.body;
   try {
-    const storeLattice = getStoreLattice8("default", "database");
+    const storeLattice = getStoreLattice7("default", "database");
     const store = storeLattice.store;
     const existing = await store.getConfigByKey(tenantId, key);
     if (!existing) {
@@ -5426,10 +5746,10 @@ async function updateDatabaseConfig(request, reply) {
   }
 }
 async function deleteDatabaseConfig(request, reply) {
-  const tenantId = getTenantId11(request);
+  const tenantId = getTenantId9(request);
   const { keyOrId } = request.params;
   try {
-    const storeLattice = getStoreLattice8("default", "database");
+    const storeLattice = getStoreLattice7("default", "database");
     const store = storeLattice.store;
     console.log("Delete request - keyOrId:", keyOrId);
     let config = await store.getConfigByKey(tenantId, keyOrId);
@@ -5475,10 +5795,10 @@ async function deleteDatabaseConfig(request, reply) {
   }
 }
 async function testDatabaseConnection(request, reply) {
-  const tenantId = getTenantId11(request);
+  const tenantId = getTenantId9(request);
   const { key } = request.params;
   try {
-    const storeLattice = getStoreLattice8("default", "database");
+    const storeLattice = getStoreLattice7("default", "database");
     const store = storeLattice.store;
     const config = await store.getConfigByKey(tenantId, key);
     if (!config) {
@@ -5496,7 +5816,7 @@ async function testDatabaseConnection(request, reply) {
       await db.connect();
       await db.listTables();
       const latency = Date.now() - startTime;
-      await new Promise((resolve3) => setTimeout(resolve3, 100));
+      await new Promise((resolve2) => setTimeout(resolve2, 100));
       await db.disconnect();
       await sqlDatabaseManager.removeDatabase(tenantId, testKey);
       return {
@@ -5563,12 +5883,12 @@ function registerDatabaseConfigRoutes(app2) {
 
 // src/controllers/metrics-configs.ts
 import {
-  getStoreLattice as getStoreLattice9,
+  getStoreLattice as getStoreLattice8,
   metricsServerManager as metricsServerManager2,
   SemanticMetricsClient as SemanticMetricsClient2
 } from "@axiom-lattice/core";
 import { randomUUID as randomUUID6 } from "crypto";
-function getTenantId12(request) {
+function getTenantId10(request) {
   const userTenantId = request.user?.tenantId;
   if (userTenantId) {
     return userTenantId;
@@ -5576,9 +5896,9 @@ function getTenantId12(request) {
   return request.headers["x-tenant-id"] || "default";
 }
 async function getMetricsServerConfigList(request, reply) {
-  const tenantId = getTenantId12(request);
+  const tenantId = getTenantId10(request);
   try {
-    const storeLattice = getStoreLattice9("default", "metrics");
+    const storeLattice = getStoreLattice8("default", "metrics");
     const store = storeLattice.store;
     const configs = await store.getAllConfigs(tenantId);
     return {
@@ -5602,10 +5922,10 @@ async function getMetricsServerConfigList(request, reply) {
   }
 }
 async function getMetricsServerConfig(request, reply) {
-  const tenantId = getTenantId12(request);
+  const tenantId = getTenantId10(request);
   const { key } = request.params;
   try {
-    const storeLattice = getStoreLattice9("default", "metrics");
+    const storeLattice = getStoreLattice8("default", "metrics");
     const store = storeLattice.store;
     const config = await store.getConfigByKey(tenantId, key);
     if (!config) {
@@ -5628,10 +5948,10 @@ async function getMetricsServerConfig(request, reply) {
   }
 }
 async function createMetricsServerConfig(request, reply) {
-  const tenantId = getTenantId12(request);
+  const tenantId = getTenantId10(request);
   const body = request.body;
   try {
-    const storeLattice = getStoreLattice9("default", "metrics");
+    const storeLattice = getStoreLattice8("default", "metrics");
     const store = storeLattice.store;
     const existing = await store.getConfigByKey(tenantId, body.key);
     if (existing) {
@@ -5679,11 +5999,11 @@ async function createMetricsServerConfig(request, reply) {
   }
 }
 async function updateMetricsServerConfig(request, reply) {
-  const tenantId = getTenantId12(request);
+  const tenantId = getTenantId10(request);
   const { key } = request.params;
   const updates = request.body;
   try {
-    const storeLattice = getStoreLattice9("default", "metrics");
+    const storeLattice = getStoreLattice8("default", "metrics");
     const store = storeLattice.store;
     const existing = await store.getConfigByKey(tenantId, key);
     if (!existing) {
@@ -5730,10 +6050,10 @@ async function updateMetricsServerConfig(request, reply) {
   }
 }
 async function deleteMetricsServerConfig(request, reply) {
-  const tenantId = getTenantId12(request);
+  const tenantId = getTenantId10(request);
   const { keyOrId } = request.params;
   try {
-    const storeLattice = getStoreLattice9("default", "metrics");
+    const storeLattice = getStoreLattice8("default", "metrics");
     const store = storeLattice.store;
     let config = await store.getConfigByKey(tenantId, keyOrId);
     let configKey = keyOrId;
@@ -5777,10 +6097,10 @@ async function deleteMetricsServerConfig(request, reply) {
   }
 }
 async function testMetricsServerConnection(request, reply) {
-  const tenantId = getTenantId12(request);
+  const tenantId = getTenantId10(request);
   const { key } = request.params;
   try {
-    const storeLattice = getStoreLattice9("default", "metrics");
+    const storeLattice = getStoreLattice8("default", "metrics");
     const store = storeLattice.store;
     const config = await store.getConfigByKey(tenantId, key);
     if (!config) {
@@ -5828,10 +6148,10 @@ async function testMetricsServerConnection(request, reply) {
   }
 }
 async function listAvailableMetrics(request, reply) {
-  const tenantId = getTenantId12(request);
+  const tenantId = getTenantId10(request);
   const { key } = request.params;
   try {
-    const storeLattice = getStoreLattice9("default", "metrics");
+    const storeLattice = getStoreLattice8("default", "metrics");
     const store = storeLattice.store;
     const config = await store.getConfigByKey(tenantId, key);
     if (!config) {
@@ -5866,11 +6186,11 @@ async function listAvailableMetrics(request, reply) {
   }
 }
 async function queryMetricsData(request, reply) {
-  const tenantId = getTenantId12(request);
+  const tenantId = getTenantId10(request);
   const { key } = request.params;
   const { metricName, startTime, endTime, step, labels } = request.body;
   try {
-    const storeLattice = getStoreLattice9("default", "metrics");
+    const storeLattice = getStoreLattice8("default", "metrics");
     const store = storeLattice.store;
     const config = await store.getConfigByKey(tenantId, key);
     if (!config) {
@@ -5914,10 +6234,10 @@ async function queryMetricsData(request, reply) {
   }
 }
 async function getDataSources(request, reply) {
-  const tenantId = getTenantId12(request);
+  const tenantId = getTenantId10(request);
   const { key } = request.params;
   try {
-    const storeLattice = getStoreLattice9("default", "metrics");
+    const storeLattice = getStoreLattice8("default", "metrics");
     const store = storeLattice.store;
     const config = await store.getConfigByKey(tenantId, key);
     if (!config) {
@@ -5955,10 +6275,10 @@ async function getDataSources(request, reply) {
   }
 }
 async function getDatasourceMetrics(request, reply) {
-  const tenantId = getTenantId12(request);
+  const tenantId = getTenantId10(request);
   const { key, datasourceId } = request.params;
   try {
-    const storeLattice = getStoreLattice9("default", "metrics");
+    const storeLattice = getStoreLattice8("default", "metrics");
     const store = storeLattice.store;
     const config = await store.getConfigByKey(tenantId, key);
     if (!config) {
@@ -5992,11 +6312,11 @@ async function getDatasourceMetrics(request, reply) {
   }
 }
 async function querySemanticMetrics(request, reply) {
-  const tenantId = getTenantId12(request);
+  const tenantId = getTenantId10(request);
   const { key } = request.params;
   const body = request.body;
   try {
-    const storeLattice = getStoreLattice9("default", "metrics");
+    const storeLattice = getStoreLattice8("default", "metrics");
     const store = storeLattice.store;
     const config = await store.getConfigByKey(tenantId, key);
     if (!config) {
@@ -6307,13 +6627,13 @@ function connectionRoutes(fastify2) {
 }
 
 // src/controllers/eval.ts
-import { getStoreLattice as getStoreLattice11 } from "@axiom-lattice/core";
+import { getStoreLattice as getStoreLattice10 } from "@axiom-lattice/core";
 import { v4 as uuidv44 } from "uuid";
 
 // src/services/eval-runner.ts
 import { EventEmitter } from "events";
 import {
-  getStoreLattice as getStoreLattice10,
+  getStoreLattice as getStoreLattice9,
   modelLatticeManager as modelLatticeManager2,
   LatticeEvalProject
 } from "@axiom-lattice/core";
@@ -6371,21 +6691,21 @@ var EvalRunner = class {
     for (const suite of suites) {
       let cases = await store.getCasesBySuite(tenantId, suite.id);
       if (caseIds && caseIds.length > 0) {
-        cases = cases.filter((c) => caseIds.includes(c.id));
+        cases = cases.filter((c2) => caseIds.includes(c2.id));
         if (cases.length === 0) continue;
       }
       totalCases += cases.length;
       evalSuites.push({
         suiteName: suite.name,
-        cases: cases.map((c) => ({
-          caseId: c.id,
-          input: { message: c.inputMessage, files: c.inputFiles },
-          steps: c.steps,
+        cases: cases.map((c2) => ({
+          caseId: c2.id,
+          input: { message: c2.inputMessage, files: c2.inputFiles },
+          steps: c2.steps,
           output: { type: "message_content" },
-          interruptPolicy: c.interruptPolicy,
+          interruptPolicy: c2.interruptPolicy,
           eval: {
-            content_assertion: c.contentAssertion,
-            eval_rubrics: c.rubrics?.map((r) => ({
+            content_assertion: c2.contentAssertion,
+            eval_rubrics: c2.rubrics?.map((r) => ({
               dimension: r.name,
               weight: r.weight,
               description: r.description
@@ -6557,13 +6877,13 @@ var EvalRunner = class {
     return this.runs.has(runId);
   }
   getEvalStore() {
-    return getStoreLattice10("default", "eval").store;
+    return getStoreLattice9("default", "eval").store;
   }
 };
 var evalRunner = new EvalRunner();
 
 // src/controllers/eval.ts
-function getTenantId13(request) {
+function getTenantId11(request) {
   const userTenantId = request.user?.tenantId;
   if (userTenantId) {
     return userTenantId;
@@ -6571,11 +6891,11 @@ function getTenantId13(request) {
   return request.headers["x-tenant-id"] || "default";
 }
 function getEvalStore() {
-  return getStoreLattice11("default", "eval").store;
+  return getStoreLattice10("default", "eval").store;
 }
 async function createProject(request, reply) {
   try {
-    const tenantId = getTenantId13(request);
+    const tenantId = getTenantId11(request);
     const store = getEvalStore();
     const id = uuidv44();
     const data = request.body;
@@ -6632,7 +6952,7 @@ async function createProject(request, reply) {
 }
 async function listProjects(request, reply) {
   try {
-    const tenantId = getTenantId13(request);
+    const tenantId = getTenantId11(request);
     const store = getEvalStore();
     let projects = await store.getProjectsByTenant(tenantId);
     if (projects.length === 0) {
@@ -6666,7 +6986,7 @@ async function listProjects(request, reply) {
 }
 async function getProject(request, reply) {
   try {
-    const tenantId = getTenantId13(request);
+    const tenantId = getTenantId11(request);
     const store = getEvalStore();
     const { pid } = request.params;
     const project = await store.getProjectById(tenantId, pid);
@@ -6686,7 +7006,7 @@ async function getProject(request, reply) {
 }
 async function updateProject(request, reply) {
   try {
-    const tenantId = getTenantId13(request);
+    const tenantId = getTenantId11(request);
     const store = getEvalStore();
     const { pid } = request.params;
     const existing = await store.getProjectById(tenantId, pid);
@@ -6729,7 +7049,7 @@ async function updateProject(request, reply) {
 }
 async function deleteProject(request, reply) {
   try {
-    const tenantId = getTenantId13(request);
+    const tenantId = getTenantId11(request);
     const store = getEvalStore();
     const { pid } = request.params;
     const existing = await store.getProjectById(tenantId, pid);
@@ -6748,7 +7068,7 @@ async function deleteProject(request, reply) {
 }
 async function createSuite(request, reply) {
   try {
-    const tenantId = getTenantId13(request);
+    const tenantId = getTenantId11(request);
     const store = getEvalStore();
     const { pid } = request.params;
     const project = await store.getProjectById(tenantId, pid);
@@ -6770,7 +7090,7 @@ async function createSuite(request, reply) {
 }
 async function updateSuite(request, reply) {
   try {
-    const tenantId = getTenantId13(request);
+    const tenantId = getTenantId11(request);
     const store = getEvalStore();
     const { sid } = request.params;
     const existing = await store.getSuiteById(tenantId, sid);
@@ -6790,7 +7110,7 @@ async function updateSuite(request, reply) {
 }
 async function deleteSuite(request, reply) {
   try {
-    const tenantId = getTenantId13(request);
+    const tenantId = getTenantId11(request);
     const store = getEvalStore();
     const { sid } = request.params;
     const existing = await store.getSuiteById(tenantId, sid);
@@ -6809,7 +7129,7 @@ async function deleteSuite(request, reply) {
 }
 async function createCase(request, reply) {
   try {
-    const tenantId = getTenantId13(request);
+    const tenantId = getTenantId11(request);
     const store = getEvalStore();
     const { sid } = request.params;
     const suite = await store.getSuiteById(tenantId, sid);
@@ -6839,7 +7159,7 @@ async function createCase(request, reply) {
 }
 async function listCasesForSuite(request, reply) {
   try {
-    const tenantId = getTenantId13(request);
+    const tenantId = getTenantId11(request);
     const store = getEvalStore();
     const { sid } = request.params;
     const cases = await store.getCasesBySuite(tenantId, sid);
@@ -6855,7 +7175,7 @@ async function listCasesForSuite(request, reply) {
 }
 async function updateCase(request, reply) {
   try {
-    const tenantId = getTenantId13(request);
+    const tenantId = getTenantId11(request);
     const store = getEvalStore();
     const { cid } = request.params;
     const existing = await store.getCaseById(tenantId, cid);
@@ -6875,7 +7195,7 @@ async function updateCase(request, reply) {
 }
 async function deleteCase(request, reply) {
   try {
-    const tenantId = getTenantId13(request);
+    const tenantId = getTenantId11(request);
     const store = getEvalStore();
     const { cid } = request.params;
     const existing = await store.getCaseById(tenantId, cid);
@@ -6907,7 +7227,7 @@ function registerEvalRoutes(app2) {
   app2.delete("/api/eval/projects/:pid/suites/:sid/cases/:cid", deleteCase);
   app2.post("/api/eval/projects/:pid/runs", async (request, reply) => {
     try {
-      const tenantId = getTenantId13(request);
+      const tenantId = getTenantId11(request);
       const { pid } = request.params;
       const body = request.body ?? {};
       const bodyWs = request.headers["x-workspace-id"] || "";
@@ -6926,7 +7246,7 @@ function registerEvalRoutes(app2) {
   });
   app2.get("/api/eval/runs", async (request, reply) => {
     try {
-      const tenantId = getTenantId13(request);
+      const tenantId = getTenantId11(request);
       const query = request.query;
       const runs = await getEvalStore().getRunsByTenant(tenantId, { projectId: query.project_id, status: query.status });
       reply.send({ success: true, message: "Ok", data: { records: runs, total: runs.length } });
@@ -6936,7 +7256,7 @@ function registerEvalRoutes(app2) {
   });
   app2.get("/api/eval/runs/:rid", async (request, reply) => {
     try {
-      const tenantId = getTenantId13(request);
+      const tenantId = getTenantId11(request);
       const { rid } = request.params;
       const run = await getEvalStore().getRunById(tenantId, rid);
       if (!run) return reply.status(404).send({ success: false, message: "Run not found" });
@@ -6958,7 +7278,7 @@ function registerEvalRoutes(app2) {
     const emitter = evalRunner.getEventEmitter();
     const eventKey = `run:${rid}`;
     if (!evalRunner.isRunning(rid)) {
-      const tenantId = getTenantId13(request);
+      const tenantId = getTenantId11(request);
       const run = await getEvalStore().getRunById(tenantId, rid);
       if (run) {
         const eventType = run.status === "completed" ? "completed" : "error";
@@ -6997,7 +7317,7 @@ data: ${JSON.stringify(event.data)}
   });
   app2.delete("/api/eval/runs/:rid", async (request, reply) => {
     try {
-      const tenantId = getTenantId13(request);
+      const tenantId = getTenantId11(request);
       const { rid } = request.params;
       const deleted = await getEvalStore().deleteRun(tenantId, rid);
       if (!deleted) return reply.status(404).send({ success: false, message: "Run not found" });
@@ -7008,7 +7328,7 @@ data: ${JSON.stringify(event.data)}
   });
   app2.get("/api/eval/reports/projects/:pid", async (request, reply) => {
     try {
-      const tenantId = getTenantId13(request);
+      const tenantId = getTenantId11(request);
       const { pid } = request.params;
       const report = await getEvalStore().getProjectReport(tenantId, pid);
       if (!report) return reply.status(404).send({ success: false, message: "Project not found" });
@@ -7020,11 +7340,11 @@ data: ${JSON.stringify(event.data)}
 }
 
 // src/controllers/users.ts
-import { getStoreLattice as getStoreLattice12 } from "@axiom-lattice/core";
+import { getStoreLattice as getStoreLattice11 } from "@axiom-lattice/core";
 import { v4 as uuidv45 } from "uuid";
 var UsersController = class {
   constructor() {
-    this.userStore = getStoreLattice12("default", "user").store;
+    this.userStore = getStoreLattice11("default", "user").store;
   }
   async listUsers(request, reply) {
     const { email } = request.query;
@@ -7102,11 +7422,11 @@ function registerUserRoutes(app2) {
 }
 
 // src/controllers/tenants.ts
-import { getStoreLattice as getStoreLattice13 } from "@axiom-lattice/core";
+import { getStoreLattice as getStoreLattice12 } from "@axiom-lattice/core";
 import { v4 as uuidv46 } from "uuid";
 var TenantsController = class {
   constructor() {
-    this.tenantStore = getStoreLattice13("default", "tenant").store;
+    this.tenantStore = getStoreLattice12("default", "tenant").store;
   }
   // ==================== Tenant CRUD ====================
   async listTenants(request, reply) {
@@ -7170,8 +7490,9 @@ function registerTenantRoutes(app2) {
 }
 
 // src/controllers/auth.ts
-import { getStoreLattice as getStoreLattice14 } from "@axiom-lattice/core";
+import { getStoreLattice as getStoreLattice13 } from "@axiom-lattice/core";
 import { v4 as uuidv47 } from "uuid";
+import { createHmac, randomBytes, timingSafeEqual } from "crypto";
 var defaultAuthConfig = {
   autoApproveUsers: true,
   allowTenantRegistration: true,
@@ -7179,9 +7500,9 @@ var defaultAuthConfig = {
 };
 var AuthController = class {
   constructor(config = {}) {
-    this.userStore = getStoreLattice14("default", "user").store;
-    this.tenantStore = getStoreLattice14("default", "tenant").store;
-    this.userTenantLinkStore = getStoreLattice14("default", "userTenantLink").store;
+    this.userStore = getStoreLattice13("default", "user").store;
+    this.tenantStore = getStoreLattice13("default", "tenant").store;
+    this.userTenantLinkStore = getStoreLattice13("default", "userTenantLink").store;
     this.config = { ...defaultAuthConfig, ...config };
   }
   async register(request, reply) {
@@ -7252,7 +7573,8 @@ var AuthController = class {
         });
       }
       const tenantLinks = await this.userTenantLinkStore.getTenantsByUser(user.id);
-      const token = await this.generateToken(user.id);
+      const singleTenantId = tenantLinks.length === 1 ? tenantLinks[0].tenantId : void 0;
+      const token = await this.generateToken(user.id, singleTenantId);
       return {
         success: true,
         data: {
@@ -7339,7 +7661,7 @@ var AuthController = class {
       const linkMeta = link?.metadata || {};
       let personalAssistant = null;
       if (linkMeta.personalAssistantId) {
-        const assistantStore = getStoreLattice14("default", "assistant").store;
+        const assistantStore = getStoreLattice13("default", "assistant").store;
         const exists = await assistantStore.hasAssistant(tenantId, linkMeta.personalAssistantId);
         if (exists) {
           personalAssistant = {
@@ -7458,6 +7780,9 @@ var AuthController = class {
     return hashedPassword === hash;
   }
   async generateToken(userId, tenantId) {
+    if (!this.config.jwtSecret) {
+      throw new Error("AUTH_TOKEN_SECRET is required to issue console sessions");
+    }
     const payload = {
       userId,
       exp: Date.now() + this.config.tokenExpiration * 1e3
@@ -7465,7 +7790,7 @@ var AuthController = class {
     if (tenantId) {
       payload.tenantId = tenantId;
     }
-    return btoa(JSON.stringify(payload));
+    return createConsoleSessionToken(payload, this.config.jwtSecret);
   }
   async changePassword(request, reply) {
     const userId = request.user?.id;
@@ -7519,12 +7844,46 @@ var AuthController = class {
     }
   }
 };
-function extractUserFromAuthHeader(authHeader) {
-  if (!authHeader?.startsWith("Bearer ")) return void 0;
+function resolveConsoleTokenSecret(_authRequired) {
+  const configured = process.env.AUTH_TOKEN_SECRET || process.env.JWT_SECRET;
+  if (configured) return configured;
+  devSessionSecret ?? (devSessionSecret = randomBytes(32).toString("hex"));
+  console.warn(
+    "[auth] AUTH_TOKEN_SECRET/JWT_SECRET is not set; using an in-process generated signing secret (sessions are invalidated on restart). Set AUTH_TOKEN_SECRET for production."
+  );
+  return devSessionSecret;
+}
+var devSessionSecret;
+function createConsoleSessionToken(payload, secret) {
+  const encodedPayload = Buffer.from(JSON.stringify(payload)).toString("base64url");
+  const signature = createHmac("sha256", secret).update(encodedPayload).digest("base64url");
+  return `${encodedPayload}.${signature}`;
+}
+function isConsoleSessionPayload(value) {
+  if (typeof value !== "object" || value === null) return false;
+  const payload = value;
+  return typeof payload.userId === "string" && payload.userId.length > 0 && typeof payload.exp === "number" && (payload.tenantId === void 0 || typeof payload.tenantId === "string");
+}
+function extractUserFromAuthHeader(authHeader, secret) {
+  if (!secret || !authHeader?.startsWith("Bearer ")) return void 0;
   const token = authHeader.substring(7);
-  try {
-    const payload = JSON.parse(atob(token));
-    if (payload.exp && payload.exp < Date.now()) return void 0;
+  const parts = token.split(".");
+  if (parts.length !== 2) return void 0;
+  const [encodedPayload, encodedSignature] = parts;
+  if (!/^[A-Za-z0-9_-]{43}$/.test(encodedSignature)) return void 0;
+  try {
+    const actualSignature = Buffer.from(encodedSignature, "base64url");
+    if (actualSignature.toString("base64url") !== encodedSignature) return void 0;
+    const expectedSignature = createHmac("sha256", secret).update(encodedPayload).digest();
+    if (actualSignature.length !== expectedSignature.length || !timingSafeEqual(actualSignature, expectedSignature)) {
+      return void 0;
+    }
+    const payload = JSON.parse(
+      Buffer.from(encodedPayload, "base64url").toString("utf8")
+    );
+    if (!isConsoleSessionPayload(payload) || payload.exp < Date.now()) {
+      return void 0;
+    }
     return {
       id: payload.userId,
       tenantId: payload.tenantId
@@ -7533,10 +7892,43 @@ function extractUserFromAuthHeader(authHeader) {
     return void 0;
   }
 }
+var PUBLIC_ROUTES = ["/api/auth/login", "/api/auth/register", "/health", "/api/stt/models"];
+function bypassesConsoleAuth(request) {
+  const path4 = request.url.split("?")[0];
+  if (request.method === "GET" && /^\/api\/a2a\/agents\/[^/]+\/\.well-known\/agent-card\.json$/.test(path4)) {
+    return true;
+  }
+  return request.method === "POST" && /^\/api\/a2a\/agents\/[^/]+\/jsonrpc$/.test(path4);
+}
+function registerConsoleAuthHook(app2, options) {
+  app2.addHook("preHandler", async (request, reply) => {
+    if (bypassesConsoleAuth(request)) return;
+    const secret = options.tokenSecret ?? resolveConsoleTokenSecret(options.authRequired);
+    const user = extractUserFromAuthHeader(request.headers.authorization, secret);
+    if (user) {
+      request.user = user;
+      return;
+    }
+    if (!options.authRequired || request.method === "OPTIONS") return;
+    if (PUBLIC_ROUTES.some((route) => request.url === route)) return;
+    if (request.url.startsWith("/s/")) return;
+    const path4 = request.url.split("?")[0];
+    if (path4.includes("/viewfile") || path4.includes("/downloadfile") || path4.includes("/uploadfile") || path4.startsWith("/f/") || path4 === "/f") {
+      return;
+    }
+    await reply.status(401).send({
+      success: false,
+      error: "Unauthorized - Missing or invalid token"
+    });
+  });
+}
 function registerAuthRoutes(app2, config) {
   const controller = new AuthController(config);
   const authHook = async (request, reply) => {
-    const user = extractUserFromAuthHeader(request.headers.authorization);
+    const user = extractUserFromAuthHeader(
+      request.headers.authorization,
+      config?.jwtSecret
+    );
     if (!user) {
       return reply.status(401).send({
         success: false,
@@ -7889,16 +8281,32 @@ function setChannelControllerDeps(deps) {
   _adapterRegistry = deps.adapterRegistry;
   _router = deps.router;
 }
-function getTenantId14(request) {
+function getTenantId12(request) {
   const userTenantId = request.user?.tenantId;
   if (userTenantId) {
     return userTenantId;
   }
   return request.headers["x-tenant-id"] || "default";
 }
+function snapshotPlainObject(value) {
+  try {
+    if (value === null || typeof value !== "object" || Array.isArray(value)) return null;
+    const prototype = Object.getPrototypeOf(value);
+    if (prototype !== Object.prototype && prototype !== null) return null;
+    const snapshot = {};
+    for (const [key, descriptor] of Object.entries(Object.getOwnPropertyDescriptors(value))) {
+      if (!descriptor.enumerable) continue;
+      if (!("value" in descriptor)) return null;
+      snapshot[key] = descriptor.value;
+    }
+    return snapshot;
+  } catch {
+    return null;
+  }
+}
 async function getInstallationStore() {
-  const { getStoreLattice: getStoreLattice31 } = await import("@axiom-lattice/core");
-  const store = getStoreLattice31("default", "channelInstallation").store;
+  const { getStoreLattice: getStoreLattice27 } = await import("@axiom-lattice/core");
+  const store = getStoreLattice27("default", "channelInstallation").store;
   if (store) return store;
   const { PostgreSQLChannelInstallationStore } = await import("@axiom-lattice/pg-stores");
   const databaseUrl = process.env.DATABASE_URL;
@@ -7910,7 +8318,7 @@ async function getInstallationStore() {
   });
 }
 async function getChannelInstallationList(request, reply) {
-  const tenantId = getTenantId14(request);
+  const tenantId = getTenantId12(request);
   const { channel } = request.query;
   try {
     const store = await getInstallationStore();
@@ -7936,7 +8344,7 @@ async function getChannelInstallationList(request, reply) {
   }
 }
 async function getChannelInstallation(request, reply) {
-  const tenantId = getTenantId14(request);
+  const tenantId = getTenantId12(request);
   const { installationId } = request.params;
   try {
     const store = await getInstallationStore();
@@ -7969,9 +8377,25 @@ async function getChannelInstallation(request, reply) {
   }
 }
 async function createChannelInstallation(request, reply) {
-  const tenantId = getTenantId14(request);
-  const body = request.body;
-  try {
+  const tenantId = getTenantId12(request);
+  const bodySnapshot = snapshotPlainObject(request.body);
+  try {
+    const allowedKeys = /* @__PURE__ */ new Set([
+      "channel",
+      "name",
+      "config",
+      "enabled",
+      "fallbackAgentId",
+      "rejectWhenNoBinding"
+    ]);
+    if (!bodySnapshot || Object.keys(bodySnapshot).some((key) => !allowedKeys.has(key))) {
+      reply.code(400);
+      return {
+        success: false,
+        message: "Invalid request body"
+      };
+    }
+    const body = bodySnapshot;
     if (!body.channel) {
       reply.code(400);
       return {
@@ -8004,7 +8428,7 @@ async function createChannelInstallation(request, reply) {
       }
     }
     const store = await getInstallationStore();
-    const installationId = body.id || randomUUID7();
+    const installationId = randomUUID7();
     const installation = await store.createInstallation(
       tenantId,
       installationId,
@@ -8028,7 +8452,8 @@ async function createChannelInstallation(request, reply) {
     };
   } catch (error) {
     console.error("Failed to create channel installation:", error);
-    if (error.message?.includes("duplicate") || error.code === "23505") {
+    const errorMessage2 = error.message?.toLowerCase();
+    if (errorMessage2?.includes("duplicate") || errorMessage2?.includes("unique constraint") || error.code === "23505") {
       reply.code(409);
       return {
         success: false,
@@ -8042,7 +8467,7 @@ async function createChannelInstallation(request, reply) {
   }
 }
 async function updateChannelInstallation(request, reply) {
-  const tenantId = getTenantId14(request);
+  const tenantId = getTenantId12(request);
   const { installationId } = request.params;
   const body = request.body;
   try {
@@ -8096,7 +8521,7 @@ async function updateChannelInstallation(request, reply) {
   }
 }
 async function deleteChannelInstallation(request, reply) {
-  const tenantId = getTenantId14(request);
+  const tenantId = getTenantId12(request);
   const { installationId } = request.params;
   try {
     const store = await getInstallationStore();
@@ -8157,13 +8582,13 @@ function registerChannelInstallationRoutes(app2) {
 
 // src/controllers/channel-bindings.ts
 import { getBindingRegistry } from "@axiom-lattice/core";
-function getTenantId15(request) {
+function getTenantId13(request) {
   const userTenantId = request.user?.tenantId;
   if (userTenantId) return userTenantId;
   return request.headers["x-tenant-id"] || "default";
 }
 async function getBindingList(request, _reply) {
-  const tenantId = getTenantId15(request);
+  const tenantId = getTenantId13(request);
   const { channel, agentId, channelInstallationId, limit, offset } = request.query;
   try {
     const registry = getBindingRegistry();
@@ -8175,7 +8600,7 @@ async function getBindingList(request, _reply) {
   }
 }
 async function getBinding(request, reply) {
-  const tenantId = getTenantId15(request);
+  const tenantId = getTenantId13(request);
   try {
     const registry = getBindingRegistry();
     const bindings = await registry.list({ tenantId });
@@ -8191,7 +8616,7 @@ async function getBinding(request, reply) {
   }
 }
 async function createBinding(request, reply) {
-  const tenantId = getTenantId15(request);
+  const tenantId = getTenantId13(request);
   try {
     const registry = getBindingRegistry();
     const binding = await registry.create({ ...request.body, tenantId });
@@ -8205,7 +8630,7 @@ async function createBinding(request, reply) {
 }
 async function updateBinding(request, reply) {
   try {
-    const tenantId = getTenantId15(request);
+    const tenantId = getTenantId13(request);
     const registry = getBindingRegistry();
     const bindings = await registry.list({ tenantId });
     const existing = bindings.find((b) => b.id === request.params.id);
@@ -8223,7 +8648,7 @@ async function updateBinding(request, reply) {
 }
 async function deleteBinding(request, reply) {
   try {
-    const tenantId = getTenantId15(request);
+    const tenantId = getTenantId13(request);
     const registry = getBindingRegistry();
     const bindings = await registry.list({ tenantId });
     const existing = bindings.find((b) => b.id === request.params.id);
@@ -8240,7 +8665,7 @@ async function deleteBinding(request, reply) {
   }
 }
 async function resolveBinding(request, _reply) {
-  const tenantId = getTenantId15(request);
+  const tenantId = getTenantId13(request);
   const { channel, senderId, channelInstallationId } = request.query;
   try {
     const registry = getBindingRegistry();
@@ -8267,7 +8692,7 @@ function registerChannelBindingRoutes(app2) {
 
 // src/controllers/menu-items.ts
 import { getMenuRegistry } from "@axiom-lattice/core";
-function getTenantId16(request) {
+function getTenantId14(request) {
   const userTenantId = request.user?.tenantId;
   if (userTenantId) return userTenantId;
   return request.headers["x-tenant-id"] || "default";
@@ -8276,7 +8701,7 @@ function errorMessage(err) {
   return err instanceof Error ? err.message : "Unexpected error";
 }
 async function getMenuItemList(request, _reply) {
-  const tenantId = getTenantId16(request);
+  const tenantId = getTenantId14(request);
   try {
     const registry = getMenuRegistry();
     const items = await registry.list({ tenantId, menuTarget: request.query.menuTarget });
@@ -8288,7 +8713,7 @@ async function getMenuItemList(request, _reply) {
   }
 }
 async function getMenuItem(request, reply) {
-  const tenantId = getTenantId16(request);
+  const tenantId = getTenantId14(request);
   try {
     const registry = getMenuRegistry();
     const item = await registry.getById(request.params.id);
@@ -8305,7 +8730,7 @@ async function getMenuItem(request, reply) {
   }
 }
 async function createMenuItem(request, reply) {
-  const tenantId = getTenantId16(request);
+  const tenantId = getTenantId14(request);
   try {
     const registry = getMenuRegistry();
     const item = await registry.create({ ...request.body, tenantId });
@@ -8320,7 +8745,7 @@ async function createMenuItem(request, reply) {
 }
 async function updateMenuItem(request, reply) {
   try {
-    const tenantId = getTenantId16(request);
+    const tenantId = getTenantId14(request);
     const registry = getMenuRegistry();
     const existing = await registry.getById(request.params.id);
     if (!existing || existing.tenantId !== tenantId) {
@@ -8338,7 +8763,7 @@ async function updateMenuItem(request, reply) {
 }
 async function deleteMenuItem(request, reply) {
   try {
-    const tenantId = getTenantId16(request);
+    const tenantId = getTenantId14(request);
     const registry = getMenuRegistry();
     const existing = await registry.getById(request.params.id);
     if (!existing || existing.tenantId !== tenantId) {
@@ -8488,12 +8913,12 @@ async function handleBridgeProxy(request, reply) {
   };
   const timeout = 3e5;
   try {
-    const response = await new Promise((resolve3, reject) => {
+    const response = await new Promise((resolve2, reject) => {
       const timer = setTimeout(() => {
         pending.delete(requestId);
         reject(new Error(`Bridge request timeout after ${timeout}ms`));
       }, timeout);
-      pending.set(requestId, { resolve: resolve3, reject, timer, agentId });
+      pending.set(requestId, { resolve: resolve2, reject, timer, agentId });
       try {
         if (conn.ws.readyState !== conn.ws.OPEN) {
           pending.delete(requestId);
@@ -8617,11 +9042,11 @@ var registerSTTRoutes = (app2) => {
 };
 
 // src/controllers/local-a2a.ts
-import { getStoreLattice as getStoreLattice15 } from "@axiom-lattice/core";
+import { getStoreLattice as getStoreLattice14 } from "@axiom-lattice/core";
 import {
   AgentType as AgentType2
 } from "@axiom-lattice/protocols";
-function getTenantId17(request) {
+function getTenantId15(request) {
   const userTenantId = request.user?.tenantId;
   if (userTenantId) return userTenantId;
   return request.headers["x-tenant-id"] || "default";
@@ -8633,7 +9058,7 @@ function getLocalRuntime(assistant) {
   return graphDefinition.localRuntime;
 }
 async function getLocalA2AAssistants(tenantId) {
-  const storeLattice = getStoreLattice15("default", "assistant");
+  const storeLattice = getStoreLattice14("default", "assistant");
   const assistants = await storeLattice.store.getAllAssistants(tenantId);
   const results = [];
   for (const assistant of assistants) {
@@ -8645,7 +9070,7 @@ async function getLocalA2AAssistants(tenantId) {
   return results;
 }
 async function getLocalA2AAssistant(tenantId, assistantId) {
-  const storeLattice = getStoreLattice15("default", "assistant");
+  const storeLattice = getStoreLattice14("default", "assistant");
   const assistant = await storeLattice.store.getAssistantById(tenantId, assistantId);
   if (!assistant) return null;
   const runtime = getLocalRuntime(assistant);
@@ -8658,7 +9083,7 @@ async function requireManagedAssistant(request, reply) {
     reply.status(400).send({ success: false, error: "assistantId is required" });
     return null;
   }
-  const registered = await getLocalA2AAssistant(getTenantId17(request), assistantId);
+  const registered = await getLocalA2AAssistant(getTenantId15(request), assistantId);
   if (!registered) {
     reply.status(404).send({
       success: false,
@@ -8669,7 +9094,7 @@ async function requireManagedAssistant(request, reply) {
   return { assistantId, localRuntime: registered.localRuntime };
 }
 async function getLocalA2AStatus(request, reply) {
-  const tenantId = getTenantId17(request);
+  const tenantId = getTenantId15(request);
   const managed = await getLocalA2AAssistants(tenantId);
   const states = await Promise.all(
     managed.map(
@@ -8873,6 +9298,294 @@ function registerA2ATestConnectionRoute(app2) {
   });
 }
 
+// src/controllers/tasks.ts
+import {
+  getStoreLattice as getStoreLattice15
+} from "@axiom-lattice/core";
+var AGENT_CREATE_STATUSES = /* @__PURE__ */ new Set(["pending"]);
+var FORBIDDEN_AGENT_CREATE_KEYS = /* @__PURE__ */ new Set([
+  "beliefImpact",
+  "beliefState",
+  "cancelledAt",
+  "completedAt",
+  "completionEvidence",
+  "evidenceId",
+  "failureReason",
+  "failedAt",
+  "interruption",
+  "lifecycle_completion_audit",
+  "lifecycle_resume_audit",
+  "requireReview",
+  "result",
+  "reviewedAt",
+  "status",
+  "interruptedAt"
+]);
+function containsLifecycleField(value) {
+  if (!value || typeof value !== "object") return false;
+  if (Array.isArray(value)) return value.some(containsLifecycleField);
+  return Object.entries(value).some(([key, nested]) => FORBIDDEN_AGENT_CREATE_KEYS.has(key) || key.startsWith("lifecycle_") || containsLifecycleField(nested));
+}
+function governedAgentCreateError(body) {
+  if (body.ownerType !== "agent") return void 0;
+  if (body.status && !AGENT_CREATE_STATUSES.has(body.status)) {
+    return {
+      code: "TASK_LIFECYCLE_TRANSITION_REQUIRED",
+      error: "Public agent tasks can only be created pending."
+    };
+  }
+  const raw = body;
+  if (Object.prototype.hasOwnProperty.call(raw, "result") || Object.prototype.hasOwnProperty.call(raw, "failureReason") || Object.prototype.hasOwnProperty.call(raw, "requireReview") || Object.prototype.hasOwnProperty.call(raw, "createdAt") || Object.prototype.hasOwnProperty.call(raw, "updatedAt") || containsLifecycleField(body.context) || containsLifecycleField(body.metadata)) {
+    return {
+      code: "TASK_LIFECYCLE_CONTEXT_FORBIDDEN",
+      error: "Agent lifecycle results, review policy, interruption state, and audit fields require a trusted lifecycle adapter."
+    };
+  }
+  return void 0;
+}
+function getTenantId16(request) {
+  const userTenantId = request.user?.tenantId;
+  if (userTenantId) return userTenantId;
+  return request.headers["x-tenant-id"] || "default";
+}
+function getUserId4(request) {
+  const userId = request.user?.id || request.headers["x-user-id"];
+  if (!userId) throw new Error("User ID is required");
+  return userId;
+}
+function getStore() {
+  return getStoreLattice15("default", "task").store;
+}
+function getAssistantStore2() {
+  return getStoreLattice15("default", "assistant").store;
+}
+function governedAgentUpdateError(task, updates) {
+  const has = (key) => Object.prototype.hasOwnProperty.call(updates, key);
+  if (has("ownerType") && updates.ownerType !== task.ownerType || has("ownerId") && updates.ownerId !== task.ownerId) {
+    return "TASK_OWNERSHIP_IMMUTABLE";
+  }
+  if (task.ownerType !== "agent") return void 0;
+  if (has("parentId") && updates.parentId !== task.parentId || has("requireReview") && updates.requireReview !== task.requireReview || has("result") || has("failureReason") || has("status")) {
+    return "TASK_LIFECYCLE_TRANSITION_REQUIRED";
+  }
+  if (has("context") || has("description")) {
+    return "COMPLETION_CONTEXT_MUTATION";
+  }
+  return void 0;
+}
+async function listTasks(request) {
+  try {
+    const tenantId = getTenantId16(request);
+    const userId = getUserId4(request);
+    const query = request.query;
+    const ownerType = query.ownerType;
+    const mixedOwnership = ownerType === void 0;
+    const limit = query.limit ? parseInt(query.limit) : void 0;
+    const offset = query.offset ? parseInt(query.offset) : void 0;
+    const store = getStore();
+    const tasks = await store.list({
+      tenantId,
+      status: query.status,
+      priority: query.priority,
+      ...ownerType === "user" ? { ownerType, ownerId: userId } : {},
+      ...ownerType === "agent" ? { ownerType, ...query.ownerId && { ownerId: query.ownerId } } : {},
+      ...mixedOwnership && query.ownerId ? { ownerId: query.ownerId } : {},
+      ...query.parentId && { parentId: query.parentId },
+      metadata: query.metadata ? JSON.parse(query.metadata) : void 0,
+      projectId: query.projectId,
+      ...!mixedOwnership && limit !== void 0 ? { limit } : {},
+      ...!mixedOwnership && offset !== void 0 ? { offset } : {}
+    });
+    const visibleTasks = mixedOwnership ? tasks.filter((task) => task.ownerType === "agent" || task.ownerType === "user" && task.ownerId === userId) : tasks;
+    const pageOffset = mixedOwnership ? offset ?? 0 : 0;
+    const page = mixedOwnership ? visibleTasks.slice(pageOffset, limit === void 0 ? void 0 : pageOffset + limit) : visibleTasks;
+    return { success: true, data: page, count: page.length };
+  } catch (error) {
+    return { success: false, error: error.message };
+  }
+}
+async function getTask(request, reply) {
+  try {
+    const tenantId = getTenantId16(request);
+    const userId = getUserId4(request);
+    const { id } = request.params;
+    const store = getStore();
+    const task = await store.getById(tenantId, id);
+    if (!task) {
+      return reply.status(404).send({ success: false, error: "Task not found" });
+    }
+    if (task.ownerType === "user" && task.ownerId !== userId) {
+      return reply.status(403).send({ success: false, error: "Access denied" });
+    }
+    return { success: true, data: task };
+  } catch (error) {
+    return { success: false, error: error.message };
+  }
+}
+async function createTask(request, reply) {
+  try {
+    const tenantId = getTenantId16(request);
+    const userId = getUserId4(request);
+    const body = request.body;
+    if (!body.title) {
+      return reply.status(400).send({ success: false, error: "title is required" });
+    }
+    const lifecycleError = governedAgentCreateError(body);
+    if (lifecycleError) {
+      return reply.status(409).send({ success: false, ...lifecycleError });
+    }
+    const ownerType = body.ownerType || "user";
+    const ownerId = body.ownerId || userId;
+    if (ownerType === "agent") {
+      const assistant = await getAssistantStore2().getAssistantById(tenantId, ownerId);
+      if (!assistant || assistant.tenantId !== tenantId) {
+        return reply.status(404).send({
+          success: false,
+          code: "AGENT_OWNER_NOT_FOUND",
+          error: "Agent owner was not found in the current tenant."
+        });
+      }
+    }
+    const store = getStore();
+    const task = await store.create({
+      ...body,
+      tenantId,
+      ownerType,
+      ownerId
+    });
+    return reply.status(201).send({ success: true, data: task });
+  } catch (error) {
+    return reply.status(500).send({ success: false, error: error.message });
+  }
+}
+async function updateTask(request, reply) {
+  try {
+    const tenantId = getTenantId16(request);
+    const userId = getUserId4(request);
+    const { id } = request.params;
+    const store = getStore();
+    const existing = await store.getById(tenantId, id);
+    if (!existing) {
+      return reply.status(404).send({ success: false, error: "Task not found" });
+    }
+    if (existing.ownerType === "user" && existing.ownerId !== userId) {
+      return reply.status(403).send({ success: false, error: "Access denied" });
+    }
+    const lifecycleError = governedAgentUpdateError(existing, request.body);
+    if (lifecycleError) {
+      return reply.status(409).send({
+        success: false,
+        code: lifecycleError,
+        error: lifecycleError === "COMPLETION_CONTEXT_MUTATION" ? "Agent completion context is owned by the task lifecycle service." : lifecycleError === "TASK_OWNERSHIP_IMMUTABLE" ? "Task ownership is immutable after creation." : "Agent ownership, hierarchy, and lifecycle transitions require a trusted lifecycle adapter."
+      });
+    }
+    const task = await store.update(tenantId, id, request.body);
+    if (!task) {
+      return reply.status(404).send({ success: false, error: "Task not found" });
+    }
+    return { success: true, data: task };
+  } catch (error) {
+    return reply.status(500).send({ success: false, error: error.message });
+  }
+}
+async function deleteTask(request, reply) {
+  try {
+    const tenantId = getTenantId16(request);
+    const userId = getUserId4(request);
+    const { id } = request.params;
+    const store = getStore();
+    const existing = await store.getById(tenantId, id);
+    if (!existing) {
+      return reply.status(404).send({ success: false, error: "Task not found" });
+    }
+    if (existing.ownerType === "user" && existing.ownerId !== userId) {
+      return reply.status(403).send({ success: false, error: "Access denied" });
+    }
+    if (existing.ownerType === "agent") {
+      return reply.status(403).send({
+        success: false,
+        code: "AGENT_RUNTIME_REQUIRED",
+        error: "Agent-owned tasks can only be deleted by a trusted agent runtime."
+      });
+    }
+    const deleted = await store.delete(tenantId, id);
+    if (!deleted) {
+      return reply.status(404).send({ success: false, error: "Task not found" });
+    }
+    return { success: true, message: "Task deleted" };
+  } catch (error) {
+    return reply.status(500).send({ success: false, error: error.message });
+  }
+}
+async function completeTask(request, reply) {
+  try {
+    const tenantId = getTenantId16(request);
+    const userId = getUserId4(request);
+    const { id } = request.params;
+    const store = getStore();
+    const existing = await store.getById(tenantId, id);
+    if (!existing) {
+      return reply.status(404).send({ success: false, error: "Task not found" });
+    }
+    if (existing.ownerType === "user" && existing.ownerId !== userId) {
+      return reply.status(403).send({ success: false, error: "Access denied" });
+    }
+    const body = request.body ?? {};
+    if (existing.ownerType === "user") {
+      const task = await store.update(tenantId, id, {
+        status: "completed",
+        ...body.result === void 0 ? {} : { result: body.result }
+      });
+      if (!task) return reply.status(404).send({ success: false, error: "Task not found" });
+      return { success: true, data: task };
+    }
+    return reply.status(403).send({
+      success: false,
+      code: "AGENT_RUNTIME_REQUIRED",
+      error: "Agent-owned tasks can only be completed by a trusted agent runtime."
+    });
+  } catch (error) {
+    return reply.status(500).send({ success: false, error: error.message });
+  }
+}
+function getTaskWorkItemStore() {
+  return getStoreLattice15("default", "taskWorkItem").store;
+}
+async function listTaskWorkItems(request, reply) {
+  const tenantId = getTenantId16(request);
+  const userId = getUserId4(request);
+  const { id } = request.params;
+  const { action, limit, offset } = request.query;
+  const task = await getStore().getById(tenantId, id);
+  if (!task) {
+    return reply.status(404).send({ success: false, error: "Task not found" });
+  }
+  if (task.ownerType === "user" && task.ownerId !== userId) {
+    return reply.status(403).send({ success: false, error: "Access denied" });
+  }
+  const store = getTaskWorkItemStore();
+  const items = await store.list({
+    tenantId,
+    taskId: id,
+    action,
+    limit: limit ? Number(limit) : void 0,
+    offset: offset ? Number(offset) : void 0
+  });
+  return reply.send({ success: true, data: items });
+}
+
+// src/routes/task-routes.ts
+function registerTaskRoutes(app2) {
+  app2.get("/api/tasks", listTasks);
+  app2.get("/api/tasks/:id", getTask);
+  app2.post("/api/tasks", createTask);
+  app2.put("/api/tasks/:id", updateTask);
+  app2.patch("/api/tasks/:id", updateTask);
+  app2.delete("/api/tasks/:id", deleteTask);
+  app2.patch("/api/tasks/:id/complete", completeTask);
+  app2.get("/api/tasks/:id/work-items", listTaskWorkItems);
+}
+
 // src/routes/index.ts
 var registerLatticeRoutes = (app2, channelDeps) => {
   registerA2ABridgeRoutes(app2);
@@ -8927,13 +9640,7 @@ var registerLatticeRoutes = (app2, channelDeps) => {
   app2.post("/api/personal-assistant", createPersonalAssistant);
   app2.get("/api/personal-assistant", getPersonalAssistant);
   app2.delete("/api/personal-assistant", deletePersonalAssistant);
-  app2.get("/api/tasks", listTasks);
-  app2.get("/api/tasks/:id", getTask);
-  app2.post("/api/tasks", createTask);
-  app2.put("/api/tasks/:id", updateTask);
-  app2.delete("/api/tasks/:id", deleteTask);
-  app2.patch("/api/tasks/:id/complete", completeTask);
-  app2.get("/api/tasks/:id/work-items", listTaskWorkItems);
+  registerTaskRoutes(app2);
   app2.get(
     "/api/assistants/:assistantId/graph",
     { schema: getAgentGraphSchema },
@@ -9042,7 +9749,8 @@ var registerLatticeRoutes = (app2, channelDeps) => {
   registerTenantRoutes(app2);
   registerAuthRoutes(app2, {
     autoApproveUsers: process.env.AUTO_APPROVE_USERS !== "false",
-    allowTenantRegistration: process.env.ALLOW_TENANT_REGISTRATION !== "false"
+    allowTenantRegistration: process.env.ALLOW_TENANT_REGISTRATION !== "false",
+    jwtSecret: resolveConsoleTokenSecret(process.env.AUTH_REQUIRED === "true")
   });
   registerChannelRoutes(app2, channelDeps);
   registerChannelInstallationRoutes(app2);
@@ -9179,9 +9887,16 @@ function registerResourceRoutes(app2, controller) {
 import { ExportableEntityRegistry as ExportableEntityRegistry3 } from "@axiom-lattice/core";
 
 // src/export_registrations/skill.registration.ts
-import { getStoreLattice as getStoreLattice16 } from "@axiom-lattice/core";
-function getStore2() {
-  return getStoreLattice16("default", "skill").store;
+import { SandboxSkillStore as SandboxSkillStore2, isBuiltInSkill as isBuiltInSkill2 } from "@axiom-lattice/core";
+function getStore2(context) {
+  return new SandboxSkillStore2({
+    workspaceId: context?.workspaceId,
+    projectId: context?.projectId
+  });
+}
+function toStoreContext(context) {
+  if (!context) return void 0;
+  return { workspaceId: context.workspaceId, projectId: context.projectId };
 }
 var skillRegistration = {
   entityType: "skill",
@@ -9189,10 +9904,10 @@ var skillRegistration = {
   category: "core",
   dependsOn: [],
   cascadeParents: [],
-  async listForExport(tenantId) {
-    const store = getStore2();
-    const skills = await store.getAllSkills(tenantId);
-    return skills.map((s) => ({
+  async listForExport(tenantId, context) {
+    const store = getStore2(context);
+    const skills = await store.getAllSkills(tenantId, toStoreContext(context));
+    return skills.filter((s) => !isBuiltInSkill2(s.id)).map((s) => ({
       _exportId: "",
       data: {
         id: s.id,
@@ -9206,14 +9921,58 @@ var skillRegistration = {
       }
     }));
   },
-  async previewImport(tenantId, entities) {
-    const store = getStore2();
-    const existing = await store.getAllSkills(tenantId);
+  async getReferencedEntityIds(_tenantId, entities) {
+    const subSkillIds = /* @__PURE__ */ new Set();
+    for (const entity of entities) {
+      const subSkills = entity.data.subSkills;
+      if (!Array.isArray(subSkills)) continue;
+      for (const id of subSkills) {
+        if (typeof id === "string" && id) subSkillIds.add(id);
+      }
+    }
+    return { skill: [...subSkillIds] };
+  },
+  async listFilesForExport(tenantId, entities, context) {
+    const store = getStore2(context);
+    const ctx = toStoreContext(context);
+    const files = [];
+    for (const entity of entities) {
+      const skillId = entity.data.id;
+      if (!skillId) continue;
+      const content = entity.data.content;
+      files.push({
+        entityId: skillId,
+        path: "SKILL.md",
+        content: Buffer.from(content ?? "", "utf-8")
+      });
+      try {
+        const resources = await store.listSkillResources?.(tenantId, skillId, ctx);
+        if (resources) {
+          for (const resourcePath of resources) {
+            const resourceContent = typeof store.loadSkillResourceRaw === "function" ? await store.loadSkillResourceRaw(tenantId, skillId, resourcePath, ctx) : await store.loadSkillResource?.(tenantId, skillId, resourcePath, ctx);
+            if (resourceContent !== null && resourceContent !== void 0) {
+              files.push({
+                entityId: skillId,
+                path: `resources/${resourcePath}`,
+                content: Buffer.isBuffer(resourceContent) ? resourceContent : Buffer.from(resourceContent, "utf-8")
+              });
+            }
+          }
+        }
+      } catch {
+      }
+    }
+    return files;
+  },
+  async previewImport(tenantId, entities, context) {
+    const store = getStore2(context);
+    const existing = await store.getAllSkills(tenantId, toStoreContext(context));
     const existingIds = new Set(existing.map((s) => s.id));
     const conflicts = [];
     const insertions = [];
     for (const entity of entities) {
       const id = entity.data.id;
+      if (isBuiltInSkill2(id)) continue;
       if (existingIds.has(id)) {
         conflicts.push({
           _exportId: entity._exportId,
@@ -9232,33 +9991,49 @@ var skillRegistration = {
     }
     return { conflicts, insertions, errors: [] };
   },
-  async applyImport(tenantId, entity, resolution) {
-    const store = getStore2();
+  async applyImport(tenantId, entity, resolution, files, context) {
+    const store = getStore2(context);
+    const ctx = toStoreContext(context);
     const data = entity.data;
-    const id = resolution.action === "rename" && resolution.newId ? resolution.newId : data.id;
-    if (resolution.action === "overwrite") {
-      try {
-        await store.deleteSkill(tenantId, id);
-      } catch {
-      }
+    const originalName = data.name;
+    const targetName = resolution.action === "rename" ? resolution.newId : originalName;
+    if (typeof targetName !== "string" || targetName.trim().length === 0) {
+      throw new Error("Skill import target name must not be empty");
     }
-    await store.createSkill(tenantId, id, {
-      name: data.name,
+    await store.createSkill(tenantId, targetName, {
+      name: targetName,
       description: data.description,
       license: data.license,
       compatibility: data.compatibility,
       metadata: data.metadata,
       content: data.content,
       subSkills: data.subSkills
-    });
-    return { newId: id };
+    }, ctx);
+    if (files && files.size > 0) {
+      for (const [relPath, content] of files.entries()) {
+        if (relPath === "SKILL.md") {
+          const fileContent = content.toString("utf-8");
+          if (fileContent !== data.content && typeof store.updateSkill === "function") {
+            await store.updateSkill(tenantId, targetName, { content: fileContent }, ctx);
+          }
+        } else if (relPath.startsWith("resources/")) {
+          const resourcePath = relPath.slice("resources/".length);
+          if (typeof store.writeSkillResourceRaw === "function") {
+            await store.writeSkillResourceRaw(tenantId, targetName, resourcePath, content, ctx);
+          } else if (typeof store.writeSkillResource === "function") {
+            await store.writeSkillResource(tenantId, targetName, resourcePath, content.toString("utf-8"), ctx);
+          }
+        }
+      }
+    }
+    return { newId: targetName };
   }
 };
 
 // src/export_registrations/agent.registration.ts
-import { getStoreLattice as getStoreLattice17 } from "@axiom-lattice/core";
+import { getStoreLattice as getStoreLattice16 } from "@axiom-lattice/core";
 function getStore3() {
-  return getStoreLattice17("default", "assistant").store;
+  return getStoreLattice16("default", "assistant").store;
 }
 var agentRegistration = {
   entityType: "agent",
@@ -9279,145 +10054,68 @@ var agentRegistration = {
       }
     }));
   },
-  async previewImport(tenantId, entities) {
-    const store = getStore3();
-    const existing = await store.getAllAssistants(tenantId);
-    const existingIds = new Set(existing.map((a) => a.id));
-    const conflicts = [];
-    const insertions = [];
+  async getReferencedEntityIds(_tenantId, entities) {
+    const skillIds = /* @__PURE__ */ new Set();
     for (const entity of entities) {
-      const id = entity.data.id;
-      if (existingIds.has(id)) {
-        conflicts.push({
-          _exportId: entity._exportId,
-          entityType: "agent",
-          conflictType: "id_exists",
-          existingId: id,
-          existingName: entity.data.name || id
-        });
-      } else {
-        insertions.push({
-          _exportId: entity._exportId,
-          entityType: "agent",
-          name: entity.data.name || id
-        });
-      }
-    }
-    return { conflicts, insertions, errors: [] };
-  },
-  async applyImport(tenantId, entity, resolution) {
-    const store = getStore3();
-    const data = entity.data;
-    const id = resolution.action === "rename" && resolution.newId ? resolution.newId : data.id;
-    if (resolution.action === "overwrite") {
-      try {
-        await store.deleteAssistant(tenantId, id);
-      } catch {
+      const graphDefinition = entity.data.graphDefinition;
+      if (!graphDefinition || typeof graphDefinition !== "object") continue;
+      const ids = graphDefinition.skillIds;
+      if (!Array.isArray(ids)) continue;
+      for (const id of ids) {
+        if (typeof id === "string" && id) skillIds.add(id);
       }
     }
-    await store.createAssistant(tenantId, id, {
-      name: data.name,
-      description: data.description || "",
-      graphDefinition: data.graphDefinition
-    });
-    return { newId: id };
-  }
-};
-
-// src/export_registrations/binding.registration.ts
-import { getStoreLattice as getStoreLattice18 } from "@axiom-lattice/core";
-function getStore4() {
-  return getStoreLattice18("default", "channelBinding").store;
-}
-var bindingRegistration = {
-  entityType: "binding",
-  label: "Binding(\u6E20\u9053\u7ED1\u5B9A)",
-  category: "core",
-  dependsOn: ["agent", "channel_installation"],
-  cascadeParents: [],
-  referenceFields: { agentId: "agent", channelInstallationId: "channel_installation" },
-  async listForExport(tenantId) {
-    const store = getStore4();
-    const bindings = await store.list({ tenantId, limit: 1e4, offset: 0 });
-    return bindings.map((b) => ({
-      _exportId: "",
-      data: {
-        channel: b.channel,
-        channelInstallationId: b.channelInstallationId,
-        senderId: b.senderId,
-        agentId: b.agentId,
-        threadId: b.threadId,
-        workspaceId: b.workspaceId,
-        projectId: b.projectId,
-        threadMode: b.threadMode,
-        senderDisplayName: b.senderDisplayName,
-        senderMetadata: b.senderMetadata,
-        enabled: b.enabled
-      }
-    }));
+    return { skill: [...skillIds] };
   },
   async previewImport(tenantId, entities) {
-    const store = getStore4();
-    const existing = await store.list({ tenantId, limit: 1e4, offset: 0 });
-    const existingKeys = new Set(
-      existing.map((b) => `${b.channel}:${b.channelInstallationId}:${b.senderId}`)
-    );
+    const store = getStore3();
+    const existing = await store.getAllAssistants(tenantId);
+    const existingIds = new Set(existing.map((a) => a.id));
     const conflicts = [];
     const insertions = [];
     for (const entity of entities) {
-      const d = entity.data;
-      const key = `${d.channel}:${d.channelInstallationId}:${d.senderId}`;
-      if (existingKeys.has(key)) {
+      const id = entity.data.id;
+      if (existingIds.has(id)) {
         conflicts.push({
           _exportId: entity._exportId,
-          entityType: "binding",
-          conflictType: "unique_constraint",
-          existingName: `${d.channel}:${d.senderId}`,
-          field: "channel+channelInstallationId+senderId"
+          entityType: "agent",
+          conflictType: "id_exists",
+          existingId: id,
+          existingName: entity.data.name || id
         });
       } else {
         insertions.push({
           _exportId: entity._exportId,
-          entityType: "binding",
-          name: `${d.channel}:${d.senderId}`
+          entityType: "agent",
+          name: entity.data.name || id
         });
       }
     }
     return { conflicts, insertions, errors: [] };
   },
   async applyImport(tenantId, entity, resolution) {
-    if (resolution.action === "skip") return {};
-    const store = getStore4();
-    const d = entity.data;
+    const store = getStore3();
+    const data = entity.data;
+    const id = resolution.action === "rename" && resolution.newId ? resolution.newId : data.id;
     if (resolution.action === "overwrite") {
-      const existing = await store.list({ tenantId, limit: 1e4, offset: 0 });
-      const match = existing.find(
-        (b) => b.channel === d.channel && b.channelInstallationId === d.channelInstallationId && b.senderId === d.senderId
-      );
-      if (match) {
-        await store.delete(match.id);
+      try {
+        await store.deleteAssistant(tenantId, id);
+      } catch {
       }
     }
-    await store.create({
-      channel: d.channel,
-      channelInstallationId: d.channelInstallationId,
-      tenantId,
-      senderId: d.senderId,
-      agentId: d.agentId,
-      threadMode: d.threadMode || "fixed",
-      senderDisplayName: d.senderDisplayName,
-      senderMetadata: d.senderMetadata,
-      workspaceId: d.workspaceId,
-      projectId: d.projectId
+    await store.createAssistant(tenantId, id, {
+      name: data.name,
+      description: data.description || "",
+      graphDefinition: data.graphDefinition
     });
-    return { newId: void 0 };
+    return { newId: id };
   }
 };
 
 // src/export_registrations/database-config.registration.ts
-import { getStoreLattice as getStoreLattice19 } from "@axiom-lattice/core";
-function getStore5() {
-  return getStoreLattice19("default", "database").store;
+import { getStoreLattice as getStoreLattice17 } from "@axiom-lattice/core";
+function getStore4() {
+  return getStoreLattice17("default", "database").store;
 }
 var databaseConfigRegistration = {
   entityType: "database_config",
@@ -9426,24 +10124,24 @@ var databaseConfigRegistration = {
   dependsOn: [],
   cascadeParents: [],
   async listForExport(tenantId) {
-    const store = getStore5();
+    const store = getStore4();
     const configs = await store.getAllConfigs(tenantId);
-    return configs.map((c) => ({
+    return configs.map((c2) => ({
       _exportId: "",
       data: {
-        id: c.id,
-        key: c.key,
-        name: c.name,
-        description: c.description,
-        config: c.config
+        id: c2.id,
+        key: c2.key,
+        name: c2.name,
+        description: c2.description,
+        config: c2.config
       }
     }));
   },
   async previewImport(tenantId, entities) {
-    const store = getStore5();
+    const store = getStore4();
     const existing = await store.getAllConfigs(tenantId);
-    const existingIds = new Set(existing.map((c) => c.id));
-    const existingKeys = new Set(existing.map((c) => c.key));
+    const existingIds = new Set(existing.map((c2) => c2.id));
+    const existingKeys = new Set(existing.map((c2) => c2.key));
     const conflicts = [];
     const insertions = [];
     for (const entity of entities) {
@@ -9477,7 +10175,7 @@ var databaseConfigRegistration = {
     return { conflicts, insertions, errors: [] };
   },
   async applyImport(tenantId, entity, resolution) {
-    const store = getStore5();
+    const store = getStore4();
     const data = entity.data;
     const id = resolution.action === "rename" && resolution.newId ? resolution.newId : data.id;
     if (resolution.action === "overwrite") {
@@ -9497,9 +10195,9 @@ var databaseConfigRegistration = {
 };
 
 // src/export_registrations/metrics-config.registration.ts
-import { getStoreLattice as getStoreLattice20 } from "@axiom-lattice/core";
-function getStore6() {
-  return getStoreLattice20("default", "metrics").store;
+import { getStoreLattice as getStoreLattice18 } from "@axiom-lattice/core";
+function getStore5() {
+  return getStoreLattice18("default", "metrics").store;
 }
 var metricsConfigRegistration = {
   entityType: "metrics_config",
@@ -9508,24 +10206,24 @@ var metricsConfigRegistration = {
   dependsOn: [],
   cascadeParents: [],
   async listForExport(tenantId) {
-    const store = getStore6();
+    const store = getStore5();
     const configs = await store.getAllConfigs(tenantId);
-    return configs.map((c) => ({
+    return configs.map((c2) => ({
       _exportId: "",
       data: {
-        id: c.id,
-        key: c.key,
-        name: c.name,
-        description: c.description,
-        config: c.config
+        id: c2.id,
+        key: c2.key,
+        name: c2.name,
+        description: c2.description,
+        config: c2.config
       }
     }));
   },
   async previewImport(tenantId, entities) {
-    const store = getStore6();
+    const store = getStore5();
     const existing = await store.getAllConfigs(tenantId);
-    const existingIds = new Set(existing.map((c) => c.id));
-    const existingKeys = new Set(existing.map((c) => c.key));
+    const existingIds = new Set(existing.map((c2) => c2.id));
+    const existingKeys = new Set(existing.map((c2) => c2.key));
     const conflicts = [];
     const insertions = [];
     for (const entity of entities) {
@@ -9559,7 +10257,7 @@ var metricsConfigRegistration = {
     return { conflicts, insertions, errors: [] };
   },
   async applyImport(tenantId, entity, resolution) {
-    const store = getStore6();
+    const store = getStore5();
     const data = entity.data;
     const id = resolution.action === "rename" && resolution.newId ? resolution.newId : data.id;
     if (resolution.action === "overwrite") {
@@ -9579,9 +10277,9 @@ var metricsConfigRegistration = {
 };
 
 // src/export_registrations/mcp-config.registration.ts
-import { getStoreLattice as getStoreLattice21 } from "@axiom-lattice/core";
-function getStore7() {
-  return getStoreLattice21("default", "mcp").store;
+import { getStoreLattice as getStoreLattice19 } from "@axiom-lattice/core";
+function getStore6() {
+  return getStoreLattice19("default", "mcp").store;
 }
 var mcpConfigRegistration = {
   entityType: "mcp_config",
@@ -9590,26 +10288,26 @@ var mcpConfigRegistration = {
   dependsOn: [],
   cascadeParents: [],
   async listForExport(tenantId) {
-    const store = getStore7();
+    const store = getStore6();
     const configs = await store.getAllConfigs(tenantId);
-    return configs.map((c) => ({
+    return configs.map((c2) => ({
       _exportId: "",
       data: {
-        id: c.id,
-        key: c.key,
-        name: c.name,
-        description: c.description,
-        config: c.config,
-        selectedTools: c.selectedTools,
-        status: c.status
+        id: c2.id,
+        key: c2.key,
+        name: c2.name,
+        description: c2.description,
+        config: c2.config,
+        selectedTools: c2.selectedTools,
+        status: c2.status
       }
     }));
   },
   async previewImport(tenantId, entities) {
-    const store = getStore7();
+    const store = getStore6();
     const existing = await store.getAllConfigs(tenantId);
-    const existingIds = new Set(existing.map((c) => c.id));
-    const existingKeys = new Set(existing.map((c) => c.key));
+    const existingIds = new Set(existing.map((c2) => c2.id));
+    const existingKeys = new Set(existing.map((c2) => c2.key));
     const conflicts = [];
     const insertions = [];
     for (const entity of entities) {
@@ -9643,7 +10341,7 @@ var mcpConfigRegistration = {
     return { conflicts, insertions, errors: [] };
   },
   async applyImport(tenantId, entity, resolution) {
-    const store = getStore7();
+    const store = getStore6();
     const data = entity.data;
     const id = resolution.action === "rename" && resolution.newId ? resolution.newId : data.id;
     if (resolution.action === "overwrite") {
@@ -9664,12 +10362,12 @@ var mcpConfigRegistration = {
 };
 
 // src/export_registrations/connection.registration.ts
-import { getStoreLattice as getStoreLattice22 } from "@axiom-lattice/core";
-function getStore8() {
-  return getStoreLattice22("default", "connection").store;
+import { getStoreLattice as getStoreLattice20 } from "@axiom-lattice/core";
+function getStore7() {
+  return getStoreLattice20("default", "connection").store;
 }
 async function listAllConnections(tenantId) {
-  const store = getStore8();
+  const store = getStore7();
   if (typeof store.listByTenant !== "function") {
     throw new Error("ConnectionStore.listByTenant is not implemented. SQL bypass removed \u2014 upgrade your store adapter.");
   }
@@ -9683,22 +10381,22 @@ var connectionRegistration = {
   cascadeParents: [],
   async listForExport(tenantId) {
     const connections2 = await listAllConnections(tenantId);
-    return connections2.map((c) => ({
+    return connections2.map((c2) => ({
       _exportId: "",
       data: {
-        id: c.id,
-        type: c.type,
-        key: c.key,
-        name: c.name,
-        description: c.description,
-        config: c.config
+        id: c2.id,
+        type: c2.type,
+        key: c2.key,
+        name: c2.name,
+        description: c2.description,
+        config: c2.config
       }
     }));
   },
   async previewImport(tenantId, entities) {
     const existing = await listAllConnections(tenantId);
     const existingCompositeKeys = new Set(
-      existing.map((c) => `${c.type}:${c.key}`)
+      existing.map((c2) => `${c2.type}:${c2.key}`)
     );
     const conflicts = [];
     const insertions = [];
@@ -9725,7 +10423,7 @@ var connectionRegistration = {
   },
   async applyImport(tenantId, entity, resolution) {
     if (resolution.action === "skip") return {};
-    const store = getStore8();
+    const store = getStore7();
     const d = entity.data;
     const type = d.type;
     const key = d.key;
@@ -9748,9 +10446,9 @@ var connectionRegistration = {
 };
 
 // src/export_registrations/collection.registration.ts
-import { getStoreLattice as getStoreLattice23 } from "@axiom-lattice/core";
-function getStore9() {
-  return getStoreLattice23("default", "collection").store;
+import { getStoreLattice as getStoreLattice21 } from "@axiom-lattice/core";
+function getStore8() {
+  return getStoreLattice21("default", "collection").store;
 }
 var collectionRegistration = {
   entityType: "collection",
@@ -9759,23 +10457,23 @@ var collectionRegistration = {
   dependsOn: [],
   cascadeParents: [],
   async listForExport(tenantId) {
-    const store = getStore9();
+    const store = getStore8();
     const collections = await store.getAllCollections(tenantId);
-    return collections.map((c) => ({
+    return collections.map((c2) => ({
       _exportId: "",
       data: {
-        id: c.id,
-        name: c.name,
-        label: c.label,
-        embeddingKey: c.embeddingKey,
-        schema: c.schema
+        id: c2.id,
+        name: c2.name,
+        label: c2.label,
+        embeddingKey: c2.embeddingKey,
+        schema: c2.schema
       }
     }));
   },
   async previewImport(tenantId, entities) {
-    const store = getStore9();
+    const store = getStore8();
     const existing = await store.getAllCollections(tenantId);
-    const existingNames = new Set(existing.map((c) => c.name));
+    const existingNames = new Set(existing.map((c2) => c2.name));
     const conflicts = [];
     const insertions = [];
     for (const entity of entities) {
@@ -9801,7 +10499,7 @@ var collectionRegistration = {
   },
   async applyImport(tenantId, entity, resolution) {
     if (resolution.action === "skip") return {};
-    const store = getStore9();
+    const store = getStore8();
     const d = entity.data;
     const name = d.name;
     if (resolution.action === "overwrite") {
@@ -9821,9 +10519,11 @@ var collectionRegistration = {
 };
 
 // src/export_registrations/channel-installation.registration.ts
-import { getStoreLattice as getStoreLattice24 } from "@axiom-lattice/core";
-function getStore10() {
-  return getStoreLattice24("default", "channelInstallation").store;
+import { getStoreLattice as getStoreLattice22 } from "@axiom-lattice/core";
+import { randomUUID as randomUUID9 } from "crypto";
+var UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+function getStore9() {
+  return getStoreLattice22("default", "channelInstallation").store;
 }
 var channelInstallationRegistration = {
   entityType: "channel_installation",
@@ -9833,7 +10533,7 @@ var channelInstallationRegistration = {
   cascadeParents: [],
   referenceFields: { fallbackAgentId: "agent" },
   async listForExport(tenantId) {
-    const store = getStore10();
+    const store = getStore9();
     const installations = await store.getInstallationsByTenant(tenantId);
     return installations.map((i) => ({
       _exportId: "",
@@ -9849,21 +10549,20 @@ var channelInstallationRegistration = {
     }));
   },
   async previewImport(tenantId, entities) {
-    const store = getStore10();
-    const existing = await store.getInstallationsByTenant(tenantId);
-    const existingIds = new Set(existing.map((i) => i.id));
+    const store = getStore9();
     const conflicts = [];
     const insertions = [];
     for (const entity of entities) {
       const d = entity.data;
       const id = d.id;
-      if (existingIds.has(id)) {
+      const existing = UUID_PATTERN.test(id) ? await store.getInstallationById(id) : null;
+      if (existing) {
         conflicts.push({
           _exportId: entity._exportId,
           entityType: "channel_installation",
           conflictType: "id_exists",
           existingId: id,
-          existingName: d.name || id
+          existingName: existing.name || id
         });
       } else {
         insertions.push({
@@ -9876,31 +10575,56 @@ var channelInstallationRegistration = {
     return { conflicts, insertions, errors: [] };
   },
   async applyImport(tenantId, entity, resolution) {
-    const store = getStore10();
+    const store = getStore9();
     const data = entity.data;
-    const id = resolution.action === "rename" && resolution.newId ? resolution.newId : data.id;
+    const sourceId = data.id;
+    const commonData = {
+      name: data.name,
+      enabled: data.enabled,
+      fallbackAgentId: data.fallbackAgentId,
+      rejectWhenNoBinding: data.rejectWhenNoBinding
+    };
     if (resolution.action === "overwrite") {
-      try {
-        await store.deleteInstallation(tenantId, id);
-      } catch {
+      const existing = await store.getInstallationById(sourceId);
+      if (!existing || !UUID_PATTERN.test(existing.id)) {
+        throw new Error("Channel installation overwrite target must be an existing UUID");
+      }
+      const updated = await store.updateInstallation(tenantId, existing.id, {
+        ...commonData,
+        config: data.config
+      });
+      if (!updated) {
+        throw new Error("Channel installation overwrite target is not available in the target tenant");
       }
+      return { newId: existing.id };
+    }
+    let id;
+    if (resolution.action === "rename") {
+      if (!resolution.newId || !UUID_PATTERN.test(resolution.newId)) {
+        throw new Error("Channel installation rename ID must be a valid UUID");
+      }
+      id = resolution.newId;
+    } else if (UUID_PATTERN.test(sourceId)) {
+      if (await store.getInstallationById(sourceId)) {
+        throw new Error(`Channel installation UUID already exists: ${sourceId}`);
+      }
+      id = sourceId;
+    } else {
+      id = randomUUID9();
     }
     await store.createInstallation(tenantId, id, {
       channel: data.channel,
-      name: data.name,
-      config: data.config,
-      enabled: data.enabled,
-      fallbackAgentId: data.fallbackAgentId,
-      rejectWhenNoBinding: data.rejectWhenNoBinding
+      ...commonData,
+      config: data.config
     });
     return { newId: id };
   }
 };
 
 // src/export_registrations/menu.registration.ts
-import { getStoreLattice as getStoreLattice25 } from "@axiom-lattice/core";
-function getStore11() {
-  return getStoreLattice25("default", "menu").store;
+import { getStoreLattice as getStoreLattice23 } from "@axiom-lattice/core";
+function getStore10() {
+  return getStoreLattice23("default", "menu").store;
 }
 var menuRegistration = {
   entityType: "menu",
@@ -9909,7 +10633,7 @@ var menuRegistration = {
   dependsOn: ["agent"],
   cascadeParents: [],
   async listForExport(tenantId) {
-    const store = getStore11();
+    const store = getStore10();
     const menus = await store.list({ tenantId });
     return menus.map((m) => ({
       _exportId: "",
@@ -9927,7 +10651,7 @@ var menuRegistration = {
     }));
   },
   async previewImport(tenantId, entities) {
-    const store = getStore11();
+    const store = getStore10();
     const existing = await store.list({ tenantId });
     const existingIds = new Set(existing.map((m) => m.id));
     const conflicts = [];
@@ -9954,7 +10678,7 @@ var menuRegistration = {
     return { conflicts, insertions, errors: [] };
   },
   async applyImport(tenantId, entity, resolution) {
-    const store = getStore11();
+    const store = getStore10();
     const d = entity.data;
     const id = resolution.action === "rename" && resolution.newId ? resolution.newId : d.id;
     if (resolution.action === "overwrite") {
@@ -9977,171 +10701,10 @@ var menuRegistration = {
   }
 };
 
-// src/export_registrations/task.registration.ts
-import { getStoreLattice as getStoreLattice26 } from "@axiom-lattice/core";
-function getStore12() {
-  return getStoreLattice26("default", "task").store;
-}
-var taskRegistration = {
-  entityType: "task",
-  label: "Task(\u4EFB\u52A1)",
-  category: "core",
-  dependsOn: ["agent"],
-  cascadeParents: [],
-  referenceFields: { ownerId: "agent", parentId: "task" },
-  async listForExport(tenantId) {
-    const store = getStore12();
-    const tasks = await store.list({ tenantId, limit: 1e4, offset: 0 });
-    return tasks.map((t) => ({
-      _exportId: "",
-      data: {
-        id: t.id,
-        title: t.title,
-        description: t.description,
-        status: t.status,
-        priority: t.priority,
-        dueDate: t.dueDate,
-        ownerType: t.ownerType,
-        ownerId: t.ownerId,
-        metadata: t.metadata,
-        parentId: t.parentId,
-        sourceId: t.sourceId,
-        context: t.context
-      }
-    }));
-  },
-  async previewImport(tenantId, entities) {
-    const store = getStore12();
-    const existing = await store.list({ tenantId, limit: 1e4, offset: 0 });
-    const existingIds = new Set(existing.map((t) => t.id));
-    const conflicts = [];
-    const insertions = [];
-    for (const entity of entities) {
-      const d = entity.data;
-      const id = d.id;
-      if (existingIds.has(id)) {
-        conflicts.push({
-          _exportId: entity._exportId,
-          entityType: "task",
-          conflictType: "id_exists",
-          existingId: id,
-          existingName: d.title || id
-        });
-      } else {
-        insertions.push({
-          _exportId: entity._exportId,
-          entityType: "task",
-          name: d.title || id
-        });
-      }
-    }
-    return { conflicts, insertions, errors: [] };
-  },
-  async applyImport(tenantId, entity, resolution) {
-    const store = getStore12();
-    const data = entity.data;
-    const id = resolution.action === "rename" && resolution.newId ? resolution.newId : data.id;
-    if (resolution.action === "overwrite") {
-      try {
-        await store.delete(tenantId, id);
-      } catch {
-      }
-    }
-    await store.create({
-      tenantId,
-      ownerType: data.ownerType || "user",
-      ownerId: data.ownerId || "",
-      title: data.title,
-      description: data.description,
-      status: data.status,
-      priority: data.priority,
-      dueDate: data.dueDate,
-      metadata: data.metadata,
-      parentId: data.parentId,
-      sourceId: data.sourceId,
-      context: data.context
-    });
-    return { newId: id };
-  }
-};
-
-// src/export_registrations/a2a-api-key.registration.ts
-import { getStoreLattice as getStoreLattice27 } from "@axiom-lattice/core";
-function getStore13() {
-  return getStoreLattice27("default", "a2aApiKey").store;
-}
-var a2aApiKeyRegistration = {
-  entityType: "a2a_api_key",
-  label: "A2A API Key(API\u5BC6\u94A5)",
-  category: "core",
-  dependsOn: [],
-  cascadeParents: [],
-  async listForExport(tenantId) {
-    const store = getStore13();
-    const keys = await store.list({ tenantId, limit: 1e4, offset: 0 });
-    return keys.map((k) => ({
-      _exportId: "",
-      data: {
-        id: k.id,
-        tenantId: k.tenantId,
-        projectId: k.projectId,
-        workspaceId: k.workspaceId,
-        label: k.label,
-        enabled: k.enabled
-      }
-    }));
-  },
-  async previewImport(tenantId, entities) {
-    const store = getStore13();
-    const existing = await store.list({ tenantId, limit: 1e4, offset: 0 });
-    const existingIds = new Set(existing.map((k) => k.id));
-    const conflicts = [];
-    const insertions = [];
-    for (const entity of entities) {
-      const d = entity.data;
-      const id = d.id;
-      if (existingIds.has(id)) {
-        conflicts.push({
-          _exportId: entity._exportId,
-          entityType: "a2a_api_key",
-          conflictType: "id_exists",
-          existingId: id,
-          existingName: d.label || id
-        });
-      } else {
-        insertions.push({
-          _exportId: entity._exportId,
-          entityType: "a2a_api_key",
-          name: d.label || id
-        });
-      }
-    }
-    return { conflicts, insertions, errors: [] };
-  },
-  async applyImport(tenantId, entity, resolution) {
-    if (resolution.action === "skip") return {};
-    const store = getStore13();
-    const d = entity.data;
-    if (resolution.action === "overwrite") {
-      try {
-        await store.delete(d.id);
-      } catch {
-      }
-    }
-    await store.create({
-      tenantId,
-      projectId: d.projectId,
-      workspaceId: d.workspaceId,
-      label: d.label
-    });
-    return { newId: void 0 };
-  }
-};
-
 // src/export_registrations/eval.registration.ts
-import { getStoreLattice as getStoreLattice28 } from "@axiom-lattice/core";
-function getStore14() {
-  return getStoreLattice28("default", "eval").store;
+import { getStoreLattice as getStoreLattice24 } from "@axiom-lattice/core";
+function getStore11() {
+  return getStoreLattice24("default", "eval").store;
 }
 var evalRegistration = {
   entityType: "eval",
@@ -10151,7 +10714,7 @@ var evalRegistration = {
   cascadeParents: [],
   referenceFields: { suiteId: "eval_suite", projectId: "eval_project", runId: "eval_run", caseId: "eval_case" },
   async listForExport(tenantId) {
-    const store = getStore14();
+    const store = getStore11();
     const projects = await store.getProjectsByTenant(tenantId);
     const entities = [];
     for (const project of projects) {
@@ -10181,19 +10744,19 @@ var evalRegistration = {
           }
         });
         const cases = await store.getCasesBySuite(tenantId, suite.id);
-        for (const c of cases) {
+        for (const c2 of cases) {
           entities.push({
             _exportId: "",
             data: {
               _subType: "eval_case",
-              id: c.id,
-              suiteId: c.suiteId,
-              inputMessage: c.inputMessage,
-              inputFiles: c.inputFiles,
-              steps: c.steps,
-              outputType: c.outputType,
-              contentAssertion: c.contentAssertion,
-              rubrics: c.rubrics
+              id: c2.id,
+              suiteId: c2.suiteId,
+              inputMessage: c2.inputMessage,
+              inputFiles: c2.inputFiles,
+              steps: c2.steps,
+              outputType: c2.outputType,
+              contentAssertion: c2.contentAssertion,
+              rubrics: c2.rubrics
             }
           });
         }
@@ -10241,7 +10804,7 @@ var evalRegistration = {
     return entities;
   },
   async previewImport(tenantId, entities) {
-    const store = getStore14();
+    const store = getStore11();
     const existingProjects = await store.getProjectsByTenant(tenantId);
     const existingProjectIds = new Set(existingProjects.map((p) => p.id));
     const existingProjectNames = new Set(existingProjects.map((p) => p.name));
@@ -10257,7 +10820,7 @@ var evalRegistration = {
         existingSuiteIds.add(s.id);
         try {
           const cases = await store.getCasesBySuite(tenantId, s.id);
-          for (const c of cases) existingCaseIds.add(c.id);
+          for (const c2 of cases) existingCaseIds.add(c2.id);
         } catch {
         }
       }
@@ -10374,7 +10937,7 @@ var evalRegistration = {
   },
   async applyImport(tenantId, entity, resolution) {
     if (resolution.action === "skip") return {};
-    const store = getStore14();
+    const store = getStore11();
     const d = entity.data;
     const subType = d._subType;
     const id = resolution.action === "rename" && resolution.newId ? resolution.newId : d.id;
@@ -10470,7 +11033,6 @@ function registerAllBuiltinEntities() {
   const registry = ExportableEntityRegistry3.getInstance();
   registry.register(skillRegistration);
   registry.register(agentRegistration);
-  registry.register(bindingRegistration);
   registry.register(databaseConfigRegistration);
   registry.register(metricsConfigRegistration);
   registry.register(mcpConfigRegistration);
@@ -10478,23 +11040,33 @@ function registerAllBuiltinEntities() {
   registry.register(collectionRegistration);
   registry.register(channelInstallationRegistration);
   registry.register(menuRegistration);
-  registry.register(taskRegistration);
-  registry.register(a2aApiKeyRegistration);
   registry.register(evalRegistration);
 }
 
 // src/router/MessageRouter.ts
 import {
-  getStoreLattice as getStoreLattice29,
+  getStoreLattice as getStoreLattice25,
   agentInstanceManager as agentInstanceManager6
 } from "@axiom-lattice/core";
-import { randomUUID as randomUUID9 } from "crypto";
+import { randomUUID as randomUUID10 } from "crypto";
 var BindingNotFoundError = class extends Error {
   constructor(message) {
     super(message);
     this.name = "BindingNotFoundError";
   }
 };
+var ChannelInstallationNotFoundError = class extends Error {
+  constructor() {
+    super("Channel installation is unavailable");
+    this.name = "ChannelInstallationNotFoundError";
+  }
+};
+var InvalidChannelInstallationError = class extends Error {
+  constructor(message = "Channel installation is not valid for this message") {
+    super(message);
+    this.name = "InvalidChannelInstallationError";
+  }
+};
 var MessageRouter = class {
   constructor(config) {
     /**
@@ -10539,20 +11111,20 @@ var MessageRouter = class {
     let threadId;
     let agentId;
     try {
+      const installation = await this.installationStore.getInstallationById(
+        message.channelInstallationId
+      );
+      if (!installation) {
+        throw new ChannelInstallationNotFoundError();
+      }
+      if (installation.enabled !== true) {
+        throw new InvalidChannelInstallationError("Channel installation is disabled");
+      }
+      if (installation.channel !== message.channel || message.tenantId !== void 0 && message.tenantId !== installation.tenantId) {
+        throw new InvalidChannelInstallationError();
+      }
+      const tenantId = installation.tenantId;
       await this.runMiddlewares(ctx, async () => {
-        const tenantId = message.tenantId || (await this.installationStore.getInstallationById(message.channelInstallationId))?.tenantId;
-        if (!tenantId) {
-          console.error({
-            event: "dispatch:error",
-            error: "tenantId missing",
-            channel: message.channel,
-            channelInstallationId: message.channelInstallationId,
-            senderId: message.sender.id
-          }, "tenantId is required");
-          throw new Error(
-            "tenantId is required: provide it in the message or ensure the channelInstallation has a tenantId"
-          );
-        }
         console.log({ event: "dispatch:start", channel: message.channel, senderId: message.sender.id, tenantId }, "Message dispatch started");
         const adapter = this.adapterRegistry.get(message.channel);
         const hasAdapterThreadStrategy = !!adapter?.resolveThreadId;
@@ -10562,11 +11134,8 @@ var MessageRouter = class {
           channelInstallationId: message.channelInstallationId,
           tenantId
         });
-        const installation = await this.installationStore.getInstallationById(
-          message.channelInstallationId
-        );
         if (!binding) {
-          if (installation?.rejectWhenNoBinding) {
+          if (installation.rejectWhenNoBinding) {
             console.warn({
               event: "dispatch:no_binding",
               channel: message.channel,
@@ -10578,7 +11147,7 @@ var MessageRouter = class {
               `No binding for sender "${message.sender.id}" on channel "${message.channel}"`
             );
           }
-          if (installation?.fallbackAgentId) {
+          if (installation.fallbackAgentId) {
             console.warn({
               event: "dispatch:fallback",
               channel: message.channel,
@@ -10633,7 +11202,7 @@ var MessageRouter = class {
             );
           }
         }
-        agentId = binding?.agentId ?? installation?.fallbackAgentId;
+        agentId = binding?.agentId ?? installation.fallbackAgentId;
         if (!agentId) {
           throw new BindingNotFoundError(
             `No agent configured for sender "${message.sender.id}"`
@@ -10648,7 +11217,7 @@ var MessageRouter = class {
             channel: message.channel,
             adapterChannel: adapter.channel
           }, "Thread resolved by adapter strategy");
-          const threadStore = getStoreLattice29("default", "thread").store;
+          const threadStore = getStoreLattice25("default", "thread").store;
           try {
             await threadStore.createThread(
               tenantId,
@@ -10685,8 +11254,8 @@ var MessageRouter = class {
           }
         }
         if (!threadId) {
-          const threadStore = getStoreLattice29("default", "thread").store;
-          const newThreadId = randomUUID9();
+          const threadStore = getStoreLattice25("default", "thread").store;
+          const newThreadId = randomUUID10();
           console.log({
             event: "dispatch:thread:create",
             agentId,
@@ -10736,78 +11305,73 @@ var MessageRouter = class {
           const replySubKey = `${threadId}:${message.replyTarget.adapterChannel}:reply`;
           const adapter2 = this.adapterRegistry.get(message.replyTarget.adapterChannel);
           if (adapter2) {
-            const installation2 = await this.installationStore.getInstallationById(
-              message.channelInstallationId
-            );
-            if (installation2) {
-              const existing = this._replySubs.get(replySubKey);
-              if (!existing || existing.count === 0) {
-                const timer = setTimeout(() => {
-                  const entry = this._replySubs.get(replySubKey);
-                  if (entry) {
+            const existing = this._replySubs.get(replySubKey);
+            if (!existing || existing.count === 0) {
+              const timer = setTimeout(() => {
+                const entry = this._replySubs.get(replySubKey);
+                if (entry) {
+                  this._replySubs.delete(replySubKey);
+                  console.warn({
+                    event: "dispatch:reply:timeout",
+                    threadId,
+                    channel: message.replyTarget.adapterChannel
+                  }, "Reply subscription timed out \u2014 no reply:ready fired within 1h");
+                }
+              }, 36e5);
+              this._replySubs.set(replySubKey, { count: 1, timer });
+              console.log({
+                event: "dispatch:reply:subscribed",
+                threadId,
+                channel: message.replyTarget.adapterChannel,
+                senderId: message.sender.id
+              }, "Subscribed to reply:ready for thread");
+              agent.subscribeOnce("reply:ready", (data) => {
+                const messages = data.state?.values?.messages;
+                const lastAI = messages?.filter((m) => m.type === "ai" || m.getType?.() === "ai").pop();
+                const replyText = lastAI?.content ?? "";
+                const entry = this._replySubs.get(replySubKey);
+                if (entry) {
+                  entry.count--;
+                  if (entry.count <= 0) {
+                    clearTimeout(entry.timer);
                     this._replySubs.delete(replySubKey);
-                    console.warn({
-                      event: "dispatch:reply:timeout",
-                      threadId,
-                      channel: message.replyTarget.adapterChannel
-                    }, "Reply subscription timed out \u2014 no reply:ready fired within 1h");
                   }
-                }, 36e5);
-                this._replySubs.set(replySubKey, { count: 1, timer });
-                console.log({
-                  event: "dispatch:reply:subscribed",
-                  threadId,
-                  channel: message.replyTarget.adapterChannel,
-                  senderId: message.sender.id
-                }, "Subscribed to reply:ready for thread");
-                agent.subscribeOnce("reply:ready", (data) => {
-                  const messages = data.state?.values?.messages;
-                  const lastAI = messages?.filter((m) => m.type === "ai" || m.getType?.() === "ai").pop();
-                  const replyText = lastAI?.content ?? "";
-                  const entry = this._replySubs.get(replySubKey);
-                  if (entry) {
-                    entry.count--;
-                    if (entry.count <= 0) {
-                      clearTimeout(entry.timer);
-                      this._replySubs.delete(replySubKey);
-                    }
-                  }
-                  if (replyText) {
+                }
+                if (replyText) {
+                  console.log({
+                    event: "dispatch:reply:sending",
+                    threadId,
+                    channel: message.replyTarget.adapterChannel,
+                    replyLength: replyText.length
+                  }, "Sending channel reply");
+                  adapter2.sendReply(message.replyTarget, { text: replyText }, installation).then(() => {
                     console.log({
-                      event: "dispatch:reply:sending",
-                      threadId,
-                      channel: message.replyTarget.adapterChannel,
-                      replyLength: replyText.length
-                    }, "Sending channel reply");
-                    adapter2.sendReply(message.replyTarget, { text: replyText }, installation2).then(() => {
-                      console.log({
-                        event: "dispatch:reply:sent",
-                        threadId,
-                        channel: message.replyTarget.adapterChannel
-                      }, "Channel reply sent successfully");
-                    }).catch((err) => console.error({
-                      event: "dispatch:reply:failed",
-                      threadId,
-                      channel: message.replyTarget.adapterChannel,
-                      error: err instanceof Error ? err.message : String(err)
-                    }, "Failed to send channel reply"));
-                  } else {
-                    console.warn({
-                      event: "dispatch:reply:empty",
+                      event: "dispatch:reply:sent",
                       threadId,
                       channel: message.replyTarget.adapterChannel
-                    }, "Agent produced no text output \u2014 skipping reply");
-                  }
-                });
-              } else {
-                existing.count++;
-                console.log({
-                  event: "dispatch:reply:incremented",
-                  threadId,
-                  channel: message.replyTarget.adapterChannel,
-                  count: existing.count
-                }, "Incremented reply counter for thread (already subscribed)");
-              }
+                    }, "Channel reply sent successfully");
+                  }).catch((err) => console.error({
+                    event: "dispatch:reply:failed",
+                    threadId,
+                    channel: message.replyTarget.adapterChannel,
+                    error: err instanceof Error ? err.message : String(err)
+                  }, "Failed to send channel reply"));
+                } else {
+                  console.warn({
+                    event: "dispatch:reply:empty",
+                    threadId,
+                    channel: message.replyTarget.adapterChannel
+                  }, "Agent produced no text output \u2014 skipping reply");
+                }
+              });
+            } else {
+              existing.count++;
+              console.log({
+                event: "dispatch:reply:incremented",
+                threadId,
+                channel: message.replyTarget.adapterChannel,
+                count: existing.count
+              }, "Incremented reply counter for thread (already subscribed)");
             }
           }
         }
@@ -11111,7 +11675,7 @@ ${summary}`
       console.log(
         `\u5C06\u5728 ${delayMs}ms \u540E\u91CD\u8BD5\u4EFB\u52A1 (${nextRetryCount}/${maxRetries})`
       );
-      await new Promise((resolve3) => setTimeout(resolve3, delayMs));
+      await new Promise((resolve2) => setTimeout(resolve2, delayMs));
       return handleAgentTask(taskRequest, nextRetryCount);
     }
     if (callback_event) {
@@ -11291,7 +11855,7 @@ import {
   getLoggerLattice,
   loggerLatticeManager,
   sandboxLatticeManager as sandboxLatticeManager2,
-  getStoreLattice as getStoreLattice30,
+  getStoreLattice as getStoreLattice26,
   agentInstanceManager as agentInstanceManager8,
   createSandboxProvider,
   TokenCache,
@@ -11341,26 +11905,8 @@ var getHeaderValue = (header) => {
   }
   return header;
 };
-var PUBLIC_ROUTES = ["/api/auth/login", "/api/auth/register", "/health", "/api/stt/models"];
-app.addHook("preHandler", async (request, reply) => {
-  const user = extractUserFromAuthHeader(request.headers.authorization);
-  if (user) {
-    request.user = user;
-    return;
-  }
-  const authRequired = process.env.AUTH_REQUIRED === "true";
-  if (!authRequired) return;
-  if (request.method === "OPTIONS") return;
-  if (PUBLIC_ROUTES.some((r) => request.url === r)) return;
-  if (request.url.startsWith("/s/")) return;
-  const urlPath = request.url.split("?")[0];
-  if (urlPath.includes("/viewfile") || urlPath.includes("/downloadfile") || urlPath.includes("/uploadfile")) return;
-  if (urlPath.startsWith("/f/") || urlPath === "/f") return;
-  return reply.status(401).send({
-    success: false,
-    error: "Unauthorized - Missing or invalid token"
-  });
-});
+var authRequired = process.env.AUTH_REQUIRED === "true";
+registerConsoleAuthHook(app, { authRequired });
 app.addHook("onRequest", (request, reply, done) => {
   if (!request.headers["x-project-id"]) {
     request.headers["x-project-id"] = "default";
@@ -11390,7 +11936,7 @@ app.register(cors, {
   origin: true,
   methods: ["GET", "POST", "PUT", "DELETE", "OPTIONS", "PATCH"],
   allowedHeaders: "*",
-  exposedHeaders: ["Content-Type"],
+  exposedHeaders: ["Content-Type", "Content-Disposition"],
   credentials: true
 });
 app.register(sensible);
@@ -11444,14 +11990,14 @@ function getConfiguredSandboxProvider() {
 }
 async function restoreMcpConnections() {
   try {
-    const storeLattice = getStoreLattice30("default", "mcp");
+    const storeLattice = getStoreLattice26("default", "mcp");
     const store = storeLattice.store;
     if (!store) {
       logger4.info("MCP store not configured, skipping connection restoration");
       return;
     }
     const configs = await store.getAllConfigs("default");
-    const connectedConfigs = configs.filter((c) => c.status === "connected");
+    const connectedConfigs = configs.filter((c2) => c2.status === "connected");
     if (connectedConfigs.length === 0) return;
     logger4.info(`Restoring ${connectedConfigs.length} MCP server connections...`);
     const { convertToConnection } = await import("./mcp-configs-SHRMQHIL.mjs");
@@ -11496,9 +12042,9 @@ var start = async (config) => {
     const { wechatChannelAdapter } = await import("./WechatChannelAdapter-WSDKR4OA.mjs");
     adapterRegistry.register(wechatChannelAdapter);
     try {
-      const { getStoreLattice: getStore15 } = await import("@axiom-lattice/core");
-      const bindingStore = getStore15("default", "channelBinding").store;
-      const installationStore = getStore15("default", "channelInstallation").store;
+      const { getStoreLattice: getStore12 } = await import("@axiom-lattice/core");
+      const bindingStore = getStore12("default", "channelBinding").store;
+      const installationStore = getStore12("default", "channelInstallation").store;
       setBindingRegistry(bindingStore);
       const router = new MessageRouter({
         middlewares: [
@@ -11511,14 +12057,6 @@ var start = async (config) => {
         installationStore
       });
       channelDeps = { router, installationStore };
-      try {
-        const a2aKeyStore = getStore15("default", "a2aApiKey").store;
-        const a2a = await import("./a2a-QMHEH3ZT.mjs");
-        a2a.setA2AKeyStore(a2aKeyStore);
-        await a2a.refreshStoreKeyMap();
-        logger4.info("A2A key store initialized");
-      } catch {
-      }
     } catch (err) {
       logger4.warn("Channel infrastructure unavailable", {
         error: err instanceof Error ? err.message : String(err)
@@ -11526,7 +12064,7 @@ var start = async (config) => {
     }
     setEvalRunService(evalRunner);
     try {
-      const menuStore = getStoreLattice30("default", "menu").store;
+      const menuStore = getStoreLattice26("default", "menu").store;
       setMenuRegistry(menuStore);
       logger4.info("Menu registry initialized");
     } catch {
@@ -11536,13 +12074,44 @@ var start = async (config) => {
       setChannelControllerDeps({ adapterRegistry, router: channelDeps.router });
     }
     registerLatticeRoutes(app, channelDeps);
+    try {
+      const { A2AAuthService, parseEnvKeys } = await import("./A2AAuthService-DK5X6VIL.mjs");
+      const { registerA2AStandardRoutes } = await import("./a2a-standard-U2XYG45L.mjs");
+      const a2a = await import("./a2a-7N3WDAOP.mjs");
+      const a2aKeyStore = getStoreLattice26("default", "a2aApiKey").store;
+      const assistantStore = getStoreLattice26("default", "assistant").store;
+      const projectStore = getStoreLattice26("default", "project").store;
+      const taskStore = getStoreLattice26("default", "task").store;
+      const authService = new A2AAuthService({
+        keyStore: a2aKeyStore,
+        assistantStore,
+        projectStore,
+        envKeyMap: parseEnvKeys(process.env.A2A_API_KEYS || ""),
+        allowUnauthenticated: process.env.A2A_ALLOW_UNAUTHENTICATED === "true"
+      });
+      await authService.refresh();
+      a2a.setA2AKeyStore(a2aKeyStore);
+      a2a.setA2AAuthService(authService);
+      registerA2AStandardRoutes(app, {
+        authService,
+        getTaskStoreLattice: () => taskStore,
+        getAssistantStore: () => assistantStore,
+        getProjectStore: () => projectStore
+      });
+      a2a.registerA2ARoutes(app);
+      logger4.info("A2A standard routes registered");
+    } catch (err) {
+      logger4.warn("A2A standard routes unavailable", {
+        error: err instanceof Error ? err.message : String(err)
+      });
+    }
     if (!sandboxLatticeManager2.hasLattice("default")) {
       sandboxLatticeManager2.registerLattice("default", getConfiguredSandboxProvider());
       logger4.info("Registered sandbox manager from env configuration");
     }
     try {
       const { ResourceController } = await import("./resources-VA7LSDKN.mjs");
-      const sharedResourceStore = getStoreLattice30("default", "sharedResource").store;
+      const sharedResourceStore = getStoreLattice26("default", "sharedResource").store;
       const cache = new TokenCache();
       const resourceController = new ResourceController({
         store: sharedResourceStore,