@axiom-lattice/gateway 4.0.0 → 4.0.2

package/dist/index.js

@@ -958,6 +958,21 @@ var init_wechat_client = __esm({
   }
 });
 
+// src/services/files/task-file-refs.ts
+function formatFileRefsSection(refs) {
+  const lines = refs.map((ref) => {
+    const label = ref.name ?? ref.uri;
+    const mime = ref.mimeType ? ` (${ref.mimeType})` : "";
+    return `- ${label}${mime}: ${ref.uri}`;
+  });
+  return ["[\u9644\u4EF6]", ...lines].join("\n");
+}
+var init_task_file_refs = __esm({
+  "src/services/files/task-file-refs.ts"() {
+    "use strict";
+  }
+});
+
 // src/channels/wechat/context-store.ts
 function makeKey(installationId, senderId) {
   return `${installationId}::${senderId}`;
@@ -1025,18 +1040,18 @@ function extractText(msg) {
   }
   return null;
 }
-var import_zod3, logger4, wechatConfigSchema, MAX_RECONNECT_DELAY_MS, BASE_RECONNECT_DELAY_MS, HEARTBEAT_INTERVAL_MS, MSG_TYPE_USER, MSG_ITEM_TEXT, activeConnections2, seenClientIds, wechatChannelAdapter;
+var import_zod6, logger4, wechatConfigSchema, MAX_RECONNECT_DELAY_MS, BASE_RECONNECT_DELAY_MS, HEARTBEAT_INTERVAL_MS, MSG_TYPE_USER, MSG_ITEM_TEXT, activeConnections2, seenClientIds, wechatChannelAdapter;
 var init_WechatChannelAdapter = __esm({
   "src/channels/wechat/WechatChannelAdapter.ts"() {
     "use strict";
-    import_zod3 = require("zod");
+    import_zod6 = require("zod");
     init_wechat_client();
     init_context_store();
     init_Logger();
     logger4 = new Logger({ serviceName: "lattice/gateway/wechat" });
-    wechatConfigSchema = import_zod3.z.object({
-      botToken: import_zod3.z.string(),
-      uin: import_zod3.z.string().optional()
+    wechatConfigSchema = import_zod6.z.object({
+      botToken: import_zod6.z.string(),
+      uin: import_zod6.z.string().optional()
     });
     MAX_RECONNECT_DELAY_MS = 3e4;
     BASE_RECONNECT_DELAY_MS = 1e3;
@@ -1497,7 +1512,7 @@ function extractFailureReason(task) {
   return extractText2(task.status.message.parts);
 }
 function observationEventKey(task, result, failureReason) {
-  const digest = (0, import_node_crypto3.createHash)("sha256").update(JSON.stringify({
+  const digest = (0, import_node_crypto5.createHash)("sha256").update(JSON.stringify({
     state: task.status.state,
     timestamp: task.status.timestamp,
     message: task.status.message,
@@ -1507,7 +1522,7 @@ function observationEventKey(task, result, failureReason) {
   return `a2a-status-observation:${task.id}:${digest}`;
 }
 function snapshotEventKey(task) {
-  const digest = (0, import_node_crypto3.createHash)("sha256").update(JSON.stringify(task)).digest("hex");
+  const digest = (0, import_node_crypto5.createHash)("sha256").update(JSON.stringify(task)).digest("hex");
   return `a2a-task-snapshot:${task.id}:${digest}`;
 }
 function isGovernedObservation(state) {
@@ -1519,11 +1534,11 @@ function isA2ATaskSnapshot(value) {
 function snapshotSequence(value) {
   return typeof value === "number" && Number.isSafeInteger(value) && value >= 0 ? value : void 0;
 }
-var import_node_crypto3, import_node_util, TASK_STATUS_TO_A2A_STATE, TITLE_MAX_LENGTH, A2ATaskScopeConflictError, A2ATaskStoreAdapter;
+var import_node_crypto5, import_node_util, TASK_STATUS_TO_A2A_STATE, TITLE_MAX_LENGTH, A2ATaskScopeConflictError, A2ATaskStoreAdapter;
 var init_A2ATaskStoreAdapter = __esm({
   "src/services/a2a/A2ATaskStoreAdapter.ts"() {
     "use strict";
-    import_node_crypto3 = require("crypto");
+    import_node_crypto5 = require("crypto");
     import_node_util = require("util");
     TASK_STATUS_TO_A2A_STATE = {
       pending: "submitted",
@@ -1842,14 +1857,6 @@ function filePartsToRefs(parts, addedBy) {
   }
   return refs;
 }
-function formatFileRefsSection(refs) {
-  const lines = refs.map((ref) => {
-    const label = ref.name ?? ref.uri;
-    const mime = ref.mimeType ? ` (${ref.mimeType})` : "";
-    return `- ${label}${mime}: ${ref.uri}`;
-  });
-  return ["[\u9644\u4EF6]", ...lines].join("\n");
-}
 async function filePartsToRefsWithIngest(parts, addedBy, ingestor, dedupeKeyBase, projectId) {
   if (!ingestor) {
     return filePartsToRefs(parts, addedBy);
@@ -1866,6 +1873,7 @@ async function filePartsToRefsWithIngest(parts, addedBy, ingestor, dedupeKeyBase
 var init_a2aFileRefs = __esm({
   "src/services/a2a/a2aFileRefs.ts"() {
     "use strict";
+    init_task_file_refs();
   }
 });
 
@@ -1887,14 +1895,15 @@ function agentMessage(text) {
     parts: [{ kind: "text", text }]
   };
 }
-var import_uuid10, import_core54, import_protocols6, _AxiomAgentExecutor, AxiomAgentExecutor;
+var import_uuid10, import_core55, import_protocols8, _AxiomAgentExecutor, AxiomAgentExecutor;
 var init_AxiomAgentExecutor = __esm({
   "src/services/a2a/AxiomAgentExecutor.ts"() {
     "use strict";
     import_uuid10 = require("uuid");
-    import_core54 = require("@axiom-lattice/core");
-    import_protocols6 = require("@axiom-lattice/protocols");
+    import_core55 = require("@axiom-lattice/core");
+    import_protocols8 = require("@axiom-lattice/protocols");
     init_a2aFileRefs();
+    init_task_file_refs();
     _AxiomAgentExecutor = class _AxiomAgentExecutor {
       constructor(options) {
         this.scope = options.scope;
@@ -1978,7 +1987,7 @@ var init_AxiomAgentExecutor = __esm({
           await this.taskStore.save(initialTask);
           bus.publish(initialTask);
           try {
-            const agent = import_core54.agentInstanceManager.getAgent({
+            const agent = import_core55.agentInstanceManager.getAgent({
               assistant_id: this.scope.assistantId,
               thread_id: threadId,
               tenant_id: this.scope.tenantId,
@@ -2001,16 +2010,16 @@ ${formatFileRefsSection(inputFiles)}` : text;
               custom_run_config: { taskId: ctx.taskId }
             });
             const stream = agent.chunkStream(messageId, [
-              import_protocols6.MessageChunkTypes.MESSAGE_COMPLETED
+              import_protocols8.MessageChunkTypes.MESSAGE_COMPLETED
             ]);
             for await (const chunk of stream) {
               if (execution.canceled) return;
               const chunkType = chunk.type;
               const chunkText = chunk.data?.content ?? "";
-              if (chunkType === import_protocols6.MessageChunkTypes.INTERRUPT) {
+              if (chunkType === import_protocols8.MessageChunkTypes.INTERRUPT) {
                 break;
               }
-              if (chunkType === import_protocols6.MessageChunkTypes.AI || chunkType === import_protocols6.MessageChunkTypes.TOOL) {
+              if (chunkType === import_protocols8.MessageChunkTypes.AI || chunkType === import_protocols8.MessageChunkTypes.TOOL) {
                 if (chunkText) {
                   bus.publish({
                     kind: "status-update",
@@ -2128,7 +2137,7 @@ ${formatFileRefsSection(inputFiles)}` : text;
         const threadId = task ? asString2(task.metadata?.threadId) : void 0;
         if (threadId) {
           try {
-            const agent = import_core54.agentInstanceManager.getAgent({
+            const agent = import_core55.agentInstanceManager.getAgent({
               assistant_id: this.scope.assistantId,
               thread_id: threadId,
               tenant_id: this.scope.tenantId,
@@ -2490,13 +2499,13 @@ function isAsyncGenerator(value) {
 }
 function registerA2AStandardRoutes(app2, deps) {
   const authService = deps.authService;
-  const getTaskStore = deps.getTaskStoreLattice ?? (() => (0, import_core55.getStoreLattice)("default", "task").store);
-  const getTaskWorkItemStore2 = deps.getTaskWorkItemStore ?? (() => (0, import_core55.getStoreLattice)("default", "taskWorkItem").store);
-  const getAssistantStore3 = deps.getAssistantStore ?? (() => (0, import_core55.getStoreLattice)("default", "assistant").store);
-  const getProjectStore2 = deps.getProjectStore ?? (() => (0, import_core55.getStoreLattice)("default", "project").store);
+  const getTaskStore = deps.getTaskStoreLattice ?? (() => (0, import_core56.getStoreLattice)("default", "task").store);
+  const getTaskWorkItemStore2 = deps.getTaskWorkItemStore ?? (() => (0, import_core56.getStoreLattice)("default", "taskWorkItem").store);
+  const getAssistantStore3 = deps.getAssistantStore ?? (() => (0, import_core56.getStoreLattice)("default", "assistant").store);
+  const getProjectStore2 = deps.getProjectStore ?? (() => (0, import_core56.getStoreLattice)("default", "project").store);
   const getTenantStore = deps.getTenantStore ?? (() => {
     try {
-      return (0, import_core55.getStoreLattice)("default", "tenant").store;
+      return (0, import_core56.getStoreLattice)("default", "tenant").store;
     } catch {
       return void 0;
     }
@@ -2588,7 +2597,7 @@ function registerA2AStandardRoutes(app2, deps) {
       const taskStore = new A2ATaskStoreAdapter({
         taskStore: internalTaskStore,
         workItemStore,
-        lifecycle: (0, import_core55.createTaskLifecycleService)({
+        lifecycle: (0, import_core56.createTaskLifecycleService)({
           taskStore: internalTaskStore,
           workItemStore
         }),
@@ -2707,7 +2716,7 @@ data: ${JSON.stringify(errorResponse)}
       const taskStore = new A2ATaskStoreAdapter({
         taskStore: internalTaskStore,
         workItemStore,
-        lifecycle: (0, import_core55.createTaskLifecycleService)({
+        lifecycle: (0, import_core56.createTaskLifecycleService)({
           taskStore: internalTaskStore,
           workItemStore
         }),
@@ -2752,13 +2761,13 @@ data: ${JSON.stringify(data)}
     }
   );
 }
-var import_uuid11, import_server2, import_core55, SSE_HEADERS;
+var import_uuid11, import_server2, import_core56, SSE_HEADERS;
 var init_a2a_standard = __esm({
   "src/routes/a2a-standard.ts"() {
     "use strict";
     import_uuid11 = require("uuid");
     import_server2 = require("@a2a-js/sdk/server");
-    import_core55 = require("@axiom-lattice/core");
+    import_core56 = require("@axiom-lattice/core");
     init_A2AAuthService();
     init_A2AAgentCardBuilder();
     init_A2ATaskStoreAdapter();
@@ -2932,12 +2941,12 @@ var resources_exports = {};
 __export(resources_exports, {
   ResourceController: () => ResourceController
 });
-var import_bcryptjs, import_core56, ResourceController;
+var import_bcryptjs, import_core57, ResourceController;
 var init_resources = __esm({
   "src/controllers/resources.ts"() {
     "use strict";
     import_bcryptjs = __toESM(require("bcryptjs"));
-    import_core56 = require("@axiom-lattice/core");
+    import_core57 = require("@axiom-lattice/core");
     init_mime();
     ResourceController = class {
       constructor(deps) {
@@ -2952,14 +2961,14 @@ var init_resources = __esm({
         if (!workspaceId || !projectId) {
           return reply.status(400).send({ error: "x-workspace-id and x-project-id headers required" });
         }
-        const payload = (0, import_core56.createSharePayload)(
+        const payload = (0, import_core57.createSharePayload)(
           tenantId,
           workspaceId,
           projectId,
           userId,
           body
         );
-        const token = (0, import_core56.generateToken)();
+        const token = (0, import_core57.generateToken)();
         try {
           await this.deps.store.create({ ...payload, token });
           this.deps.logger.info(
@@ -3111,7 +3120,7 @@ var init_resources = __esm({
             resourcePath: subPath
           }, subPath, ext, request, reply);
         }
-        const volume = (0, import_core56.buildNamedVolumeName)("p", "project", tenantId, workspaceId, projectId);
+        const volume = (0, import_core57.buildNamedVolumeName)("p", "project", tenantId, workspaceId, projectId);
         return this._resolveAndServe(
           volume,
           subPath,
@@ -4098,6 +4107,90 @@ async function getAssistantStats(request, reply) {
 var import_uuid = require("uuid");
 var import_core3 = require("@axiom-lattice/core");
 var import_protocols2 = require("@axiom-lattice/protocols");
+
+// src/services/agents/ScopedAgentExecution.ts
+async function executeScopedAgentMessage(agent, request, stopTypes, options) {
+  const { messageId } = options === void 0 ? await agent.addMessage(request) : await agent.addMessage(request, options.queueMode);
+  return { messageId, stream: agent.chunkStream(messageId, stopTypes) };
+}
+
+// src/services/streaming/pipeAsyncIterableToSse.ts
+async function pipeAsyncIterableToSse(raw, stream, options = {}) {
+  const iterator = stream[Symbol.asyncIterator]();
+  const project = options.project ?? ((value) => [value]);
+  const serialize = options.serialize ?? ((event) => `data: ${JSON.stringify(event)}
+
+`);
+  const closeSources = options.closeSource && options.closeSource !== raw ? [raw, options.closeSource] : [raw];
+  let closed = raw.destroyed || raw.writableEnded;
+  let returned = false;
+  let resolveClosed;
+  const closedPromise = new Promise((resolve3) => {
+    resolveClosed = resolve3;
+  });
+  const returnConsumer = () => {
+    if (returned) return;
+    returned = true;
+    void Promise.resolve(iterator.return?.()).catch(() => void 0);
+  };
+  const onClose = () => {
+    closed = true;
+    returnConsumer();
+    resolveClosed?.();
+  };
+  for (const source of closeSources) {
+    source.on("close", onClose);
+    source.on("error", onClose);
+  }
+  try {
+    while (!closed) {
+      const next = await Promise.race([
+        iterator.next().then((result) => ({ kind: "next", result })),
+        closedPromise.then(() => ({ kind: "closed" }))
+      ]);
+      if (next.kind === "closed" || next.result.done) break;
+      for (const event of project(next.result.value)) {
+        if (!await writeSse(raw, serialize(event), closedPromise)) {
+          closed = true;
+          returnConsumer();
+          break;
+        }
+      }
+    }
+  } catch (error) {
+    if (!options.onError) throw error;
+    if (!closed && !raw.destroyed && !raw.writableEnded) {
+      for (const event of options.onError(error)) {
+        if (!await writeSse(raw, serialize(event), closedPromise)) break;
+      }
+    }
+    returnConsumer();
+  } finally {
+    for (const source of closeSources) {
+      source.removeListener("close", onClose);
+      source.removeListener("error", onClose);
+    }
+    if (!closed && !raw.destroyed && !raw.writableEnded) raw.end();
+  }
+}
+async function writeSse(raw, value, closed) {
+  if (raw.destroyed || raw.writableEnded) return false;
+  if (raw.write(value)) return true;
+  return new Promise((resolve3) => {
+    let settled = false;
+    const onDrain = () => finish(!raw.destroyed && !raw.writableEnded);
+    const finish = (writable) => {
+      if (settled) return;
+      settled = true;
+      raw.removeListener("drain", onDrain);
+      resolve3(writable);
+    };
+    raw.once("drain", onDrain);
+    void closed.then(() => finish(false));
+  });
+}
+
+// src/controllers/run.ts
 function getUserId2(request) {
   const authUser = request.user;
   if (authUser?.id) return authUser.id;
@@ -4164,20 +4257,22 @@ var createRun = async (request, reply) => {
       });
       try {
         const messageInput = message_id ? { ...input, id: message_id } : input;
-        const result = await agent.addMessage({
+        const result = await executeScopedAgentMessage(agent, {
           input: messageInput,
           command,
           custom_run_config: mergedConfig
-        }, mode);
-        const stream = agent.chunkStream(result.messageId, [import_protocols2.MessageChunkTypes.MESSAGE_COMPLETED, import_protocols2.MessageChunkTypes.INTERRUPT, import_protocols2.MessageChunkTypes.MESSAGE_FAILED]);
-        for await (const chunk of stream) {
-          const success = reply.raw.write(`data: ${JSON.stringify(chunk)}
-
-`);
-          if (!success) {
-            await new Promise((resolve3) => reply.raw.once("drain", resolve3));
-          }
-        }
+        }, [import_protocols2.MessageChunkTypes.MESSAGE_COMPLETED, import_protocols2.MessageChunkTypes.INTERRUPT, import_protocols2.MessageChunkTypes.MESSAGE_FAILED], {
+          queueMode: mode
+        });
+        await pipeAsyncIterableToSse(reply.raw, result.stream, {
+          onError: (error) => [{
+            type: "error",
+            data: {
+              id: (0, import_uuid.v4)(),
+              content: error instanceof Error ? error.message : "Stream processing error"
+            }
+          }]
+        });
       } catch (error) {
         const errorEvent = {
           type: "error",
@@ -4190,7 +4285,7 @@ var createRun = async (request, reply) => {
 
 `);
       } finally {
-        reply.raw.end();
+        if (!reply.raw.writableEnded && !reply.raw.destroyed) reply.raw.end();
       }
     } else {
       const { message: msg, ...restInputNonStream } = input;
@@ -4239,17 +4334,16 @@ var resumeStream = async (request, reply) => {
         workspace_id,
         project_id
       });
-      const stream = agent.chunkStream(message_id, []);
-      let closed = false;
-      request.raw.on("close", () => {
-        closed = true;
+      await pipeAsyncIterableToSse(reply.raw, agent.chunkStream(message_id, []), {
+        closeSource: request.raw,
+        onError: (error) => [{
+          type: "error",
+          data: {
+            id: (0, import_uuid.v4)(),
+            content: error instanceof Error ? error.message : "Resume stream processing error"
+          }
+        }]
       });
-      for await (const chunk of stream) {
-        if (closed || reply.raw.destroyed) break;
-        reply.raw.write(`data: ${JSON.stringify(chunk)}
-
-`);
-      }
     } catch (error) {
       const errorEvent = {
         type: "error",
@@ -4262,7 +4356,7 @@ var resumeStream = async (request, reply) => {
 
 `);
     } finally {
-      reply.raw.end();
+      if (!reply.raw.writableEnded && !reply.raw.destroyed) reply.raw.end();
     }
   } catch (error) {
     reply.status(500).send({
@@ -6712,6 +6806,7 @@ async function deletePersonalAssistant(request, reply) {
   if (!deleted) {
     return reply.status(500).send({ success: false, message: "Failed to delete personal assistant" });
   }
+  import_core16.eventBus.publish("assistant:deleted", { id: assistant.id, tenantId });
   const threadStore = (0, import_core16.getStoreLattice)("default", "thread").store;
   try {
     const threads = await threadStore.getThreadsByAssistantId(tenantId, assistant.id);
@@ -10161,11 +10256,11 @@ async function createProject(request, reply) {
     }
     const serverCfg = data.targetServerConfig || {};
     const judgeCfg = data.judgeModelConfig || {};
-    const modelKey = judgeCfg.modelKey || "";
-    if (modelKey) {
-      const { modelLatticeManager: modelLatticeManager3 } = await import("@axiom-lattice/core");
-      if (!modelLatticeManager3.hasLattice(modelKey)) {
-        return reply.status(400).send({ success: false, message: `Judge model "${modelKey}" is not registered` });
+    const modelKey2 = judgeCfg.modelKey || "";
+    if (modelKey2) {
+      const { modelLatticeManager: modelLatticeManager4 } = await import("@axiom-lattice/core");
+      if (!modelLatticeManager4.hasLattice(modelKey2)) {
+        return reply.status(400).send({ success: false, message: `Judge model "${modelKey2}" is not registered` });
       }
     }
     const project = await store2.createProject(tenantId, id, {
@@ -10173,7 +10268,7 @@ async function createProject(request, reply) {
       description: data.description,
       version: data.version,
       judgeModelConfig: {
-        modelKey,
+        modelKey: modelKey2,
         displayName: judgeCfg.displayName || ""
       },
       targetServerConfig: {
@@ -10210,8 +10305,8 @@ async function listProjects(request, reply) {
     let projects = await store2.getProjectsByTenant(tenantId);
     if (projects.length === 0) {
       try {
-        const { modelLatticeManager: modelLatticeManager3 } = await import("@axiom-lattice/core");
-        const models = modelLatticeManager3.getAllLattices();
+        const { modelLatticeManager: modelLatticeManager4 } = await import("@axiom-lattice/core");
+        const models = modelLatticeManager4.getAllLattices();
         const first = models[0];
         const judgeModel = first ? { modelKey: first.key } : {};
         const host = request.hostname || "localhost";
@@ -10277,15 +10372,15 @@ async function updateProject(request, reply) {
     }
     if (body.judgeModelConfig !== void 0) {
       const judgeCfg = body.judgeModelConfig || {};
-      const modelKey = judgeCfg.modelKey || "";
-      if (modelKey) {
-        const { modelLatticeManager: modelLatticeManager3 } = await import("@axiom-lattice/core");
-        if (!modelLatticeManager3.hasLattice(modelKey)) {
-          return reply.status(400).send({ success: false, message: `Judge model "${modelKey}" is not registered` });
+      const modelKey2 = judgeCfg.modelKey || "";
+      if (modelKey2) {
+        const { modelLatticeManager: modelLatticeManager4 } = await import("@axiom-lattice/core");
+        if (!modelLatticeManager4.hasLattice(modelKey2)) {
+          return reply.status(400).send({ success: false, message: `Judge model "${modelKey2}" is not registered` });
         }
       }
       updateData.judgeModelConfig = {
-        modelKey,
+        modelKey: modelKey2,
         displayName: judgeCfg.displayName || ""
       };
     }
@@ -11148,6 +11243,8 @@ function extractUserFromAuthHeader(authHeader, secret) {
 var PUBLIC_ROUTES = ["/api/auth/login", "/api/auth/register", "/health", "/api/stt/models"];
 function bypassesConsoleAuth(request) {
   const path6 = request.url.split("?")[0];
+  const method = request.method;
+  if (method === "GET" && /^\/api\/web-apps\/[^/]+\/runtime\/bootstrap$/.test(path6) || (method === "GET" || method === "POST") && /^\/api\/web-apps\/[^/]+\/runtime\/threads$/.test(path6) || (method === "PATCH" || method === "DELETE") && /^\/api\/web-apps\/[^/]+\/runtime\/threads\/[^/]+$/.test(path6) || method === "GET" && /^\/api\/web-apps\/[^/]+\/runtime\/threads\/[^/]+\/messages$/.test(path6) || method === "POST" && /^\/api\/web-apps\/[^/]+\/runtime\/threads\/[^/]+\/(messages\/stream|abort|attachments)$/.test(path6) || method === "POST" && /^\/api\/web-apps\/[^/]+\/runtime\/threads\/[^/]+\/interrupts\/[^/]+\/resume$/.test(path6)) return true;
   if (request.method === "GET" && /^\/api\/a2a\/agents\/[^/]+\/\.well-known\/agent-card\.json$/.test(path6)) {
     return true;
   }
@@ -11155,13 +11252,13 @@ function bypassesConsoleAuth(request) {
 }
 function registerConsoleAuthHook(app2, options) {
   app2.addHook("preHandler", async (request, reply) => {
-    if (bypassesConsoleAuth(request)) return;
     const secret = options.tokenSecret ?? resolveConsoleTokenSecret(options.authRequired);
     const user = extractUserFromAuthHeader(request.headers.authorization, secret);
     if (user) {
       request.user = user;
-      return;
     }
+    if (bypassesConsoleAuth(request)) return;
+    if (user) return;
     if (!options.authRequired || request.method === "OPTIONS") return;
     if (PUBLIC_ROUTES.some((route) => request.url === route)) return;
     if (request.url.startsWith("/s/")) return;
@@ -11561,8 +11658,8 @@ function snapshotPlainObject(value) {
   }
 }
 async function getInstallationStore() {
-  const { getStoreLattice: getStoreLattice30 } = await import("@axiom-lattice/core");
-  const store2 = getStoreLattice30("default", "channelInstallation").store;
+  const { getStoreLattice: getStoreLattice31 } = await import("@axiom-lattice/core");
+  const store2 = getStoreLattice31("default", "channelInstallation").store;
   if (store2) return store2;
   const { PostgreSQLChannelInstallationStore } = await import("@axiom-lattice/pg-stores");
   const databaseUrl = process.env.DATABASE_URL;
@@ -12258,7 +12355,7 @@ var registerSTTRoutes = (app2) => {
       }
     },
     async (request, reply) => {
-      const modelKey = request.query.model || "default";
+      const modelKey2 = request.query.model || "default";
       const data = await request.file({
         limits: { fileSize: MAX_AUDIO_FILE_SIZE }
       });
@@ -12276,9 +12373,9 @@ var registerSTTRoutes = (app2) => {
       try {
         let client;
         try {
-          client = (0, import_core38.getSTTClient)(modelKey);
+          client = (0, import_core38.getSTTClient)(modelKey2);
         } catch {
-          return reply.status(404).send({ error: `STT model "${modelKey}" not found` });
+          return reply.status(404).send({ error: `STT model "${modelKey2}" not found` });
         }
         const result = await client.transcribe(buffer, format);
         return reply.send({
@@ -12689,8 +12786,10 @@ async function createTask(request, reply) {
     const ownerType = body.ownerType || "user";
     const ownerId = body.ownerId || userId;
     if (ownerType === "agent") {
+      (0, import_core40.ensureBuiltinAgentsForTenant)(tenantId);
       const assistant = await getAssistantStore2().getAssistantById(tenantId, ownerId);
-      if (!assistant || assistant.tenantId !== tenantId) {
+      const configuredAgent = import_core40.agentLatticeManager.getAgentConfigWithTenant(tenantId, ownerId);
+      if ((!assistant || assistant.tenantId !== tenantId) && !configuredAgent) {
         return reply.status(404).send({
           success: false,
           code: "AGENT_OWNER_NOT_FOUND",
@@ -12839,7 +12938,1032 @@ function registerTaskRoutes(app2) {
 }
 
 // src/routes/index.ts
+var import_core41 = require("@axiom-lattice/core");
+
+// src/services/agent-web-app/AgentWebAppService.ts
+function createConfiguredAgentResolver(registry) {
+  return {
+    async exists(tenantId, assistantId) {
+      await registry.hydrate(tenantId);
+      return registry.has(tenantId, assistantId);
+    }
+  };
+}
+var AgentWebAppError = class extends Error {
+  constructor(code, statusCode, message) {
+    super(message);
+    this.code = code;
+    this.statusCode = statusCode;
+    this.name = "AgentWebAppError";
+  }
+};
+var AgentWebAppService = class {
+  constructor(deps) {
+    this.deps = deps;
+  }
+  async create(context, input) {
+    await this.validateAssistant(context, input.assistantId);
+    const normalized = await this.validateConfig(context.tenantId, input);
+    return this.deps.webAppStore.create(context.tenantId, normalized);
+  }
+  async list(context, assistantId) {
+    const records = await this.deps.webAppStore.list(context.tenantId, assistantId);
+    const visible = [];
+    for (const record of records) {
+      if (await this.canAccessAssistant(context, record.assistantId)) visible.push(record);
+    }
+    return visible;
+  }
+  async get(context, webAppId) {
+    return this.requireAuthorizedWebApp(context, webAppId);
+  }
+  async update(context, webAppId, patch) {
+    const current = await this.requireAuthorizedWebApp(context, webAppId);
+    const effective = {
+      assistantId: current.assistantId,
+      name: patch.name ?? current.name,
+      description: Object.prototype.hasOwnProperty.call(patch, "description") ? patch.description : current.description,
+      integration: current.integration,
+      scope: { ...current.scope, ...patch.scope },
+      features: { ...current.features, ...patch.features },
+      appearance: { ...current.appearance, ...patch.appearance }
+    };
+    await this.validateAssistant(context, current.assistantId);
+    const validated = await this.validateConfig(context.tenantId, effective);
+    const update = {
+      ...patch.name !== void 0 ? { name: validated.name } : {},
+      ...Object.prototype.hasOwnProperty.call(patch, "description") ? { description: validated.description } : {},
+      ...patch.scope ? { scope: validated.scope } : {},
+      ...patch.features ? { features: validated.features } : {},
+      ...patch.appearance ? { appearance: validated.appearance } : {}
+    };
+    return this.writeSnapshot(context, current, update);
+  }
+  async enable(context, webAppId) {
+    const current = await this.requireAuthorizedWebApp(context, webAppId);
+    await this.validateConfig(context.tenantId, current);
+    return this.writeSnapshot(context, current, { status: "active" });
+  }
+  async disable(context, webAppId) {
+    const current = await this.requireAuthorizedWebApp(context, webAppId);
+    return this.writeSnapshot(context, current, { status: "disabled" });
+  }
+  async delete(context, webAppId) {
+    await this.requireAuthorizedWebApp(context, webAppId);
+    if (!await this.deps.webAppStore.delete(context.tenantId, webAppId)) this.notFound();
+  }
+  async validateAssistant(context, assistantId) {
+    const assistant = await this.deps.assistantStore.getAssistantById(context.tenantId, assistantId);
+    if (assistant) {
+      if (assistant.ownerUserId && assistant.ownerUserId !== context.userId) {
+        throw new AgentWebAppError("ASSISTANT_FORBIDDEN", 403, "Assistant is not available to this user");
+      }
+      return;
+    }
+    if (await this.deps.configuredAgentResolver.exists(context.tenantId, assistantId)) return;
+    throw new AgentWebAppError("ASSISTANT_NOT_FOUND", 404, "Assistant not found");
+  }
+  async validateConfig(tenantId, input) {
+    const allowedProjectIds = [...new Set(input.scope.allowedProjectIds)];
+    if (!allowedProjectIds.length || !allowedProjectIds.includes(input.scope.defaultProjectId)) {
+      throw new AgentWebAppError("PROJECT_SCOPE_INVALID", 400, "Default project must be in the project allowlist");
+    }
+    if (!input.features.projectSelector && allowedProjectIds.length !== 1) {
+      throw new AgentWebAppError("PROJECT_SCOPE_INVALID", 400, "Disabled project selection requires exactly one project");
+    }
+    for (const projectId of allowedProjectIds) {
+      if (!await this.deps.projectStore.getProjectById(tenantId, projectId)) {
+        throw new AgentWebAppError("PROJECT_NOT_FOUND", 404, "Project not found");
+      }
+    }
+    const scope = this.validateModels(input.scope, input.features.modelSelector);
+    return { ...input, scope: { ...scope, allowedProjectIds } };
+  }
+  validateModels(scope, modelSelector) {
+    const allowedModelKeys = scope.allowedModelKeys ? [...new Set(scope.allowedModelKeys)] : void 0;
+    if (!allowedModelKeys?.length) {
+      if (scope.defaultModelKey || modelSelector) {
+        throw new AgentWebAppError("MODEL_SCOPE_INVALID", 400, "Agent-default models cannot enable model selection or set a default");
+      }
+      return { ...scope, defaultModelKey: void 0, allowedModelKeys: void 0 };
+    }
+    if (!modelSelector && allowedModelKeys.length > 1) {
+      throw new AgentWebAppError("MODEL_SCOPE_INVALID", 400, "Disabled model selection allows at most one model");
+    }
+    if (scope.defaultModelKey && !allowedModelKeys.includes(scope.defaultModelKey)) {
+      throw new AgentWebAppError("MODEL_SCOPE_INVALID", 400, "Default model must be in the model allowlist");
+    }
+    for (const key of allowedModelKeys) {
+      if (!this.deps.modelRegistry.has(key)) {
+        throw new AgentWebAppError("MODEL_NOT_FOUND", 400, "Configured model is not registered");
+      }
+    }
+    return { ...scope, allowedModelKeys };
+  }
+  async requireWebApp(tenantId, webAppId) {
+    return await this.deps.webAppStore.getById(tenantId, webAppId) ?? this.notFound();
+  }
+  async requireAuthorizedWebApp(context, webAppId) {
+    const webApp = await this.requireWebApp(context.tenantId, webAppId);
+    if (!await this.canAccessAssistant(context, webApp.assistantId)) this.notFound();
+    return webApp;
+  }
+  async canAccessAssistant(context, assistantId) {
+    const assistant = await this.deps.assistantStore.getAssistantById(context.tenantId, assistantId);
+    if (assistant) return !assistant.ownerUserId || assistant.ownerUserId === context.userId;
+    return this.deps.configuredAgentResolver.exists(context.tenantId, assistantId);
+  }
+  async writeSnapshot(context, current, patch) {
+    const updated = await this.deps.webAppStore.update(
+      context.tenantId,
+      current.id,
+      patch,
+      { expectedUpdatedAt: current.updatedAt }
+    );
+    if (updated) return updated;
+    await this.requireAuthorizedWebApp(context, current.id);
+    throw new AgentWebAppError("WEB_APP_CONFLICT", 409, "Agent Web App was modified concurrently");
+  }
+  notFound() {
+    throw new AgentWebAppError("WEB_APP_NOT_FOUND", 404, "Agent Web App not found");
+  }
+};
+
+// src/routes/agent-web-apps.ts
+var import_zod4 = require("zod");
+
+// src/schemas/agent-web-app.ts
+var import_zod3 = require("zod");
+var externalId = import_zod3.z.string().min(1).max(128).regex(/^[A-Za-z0-9._:@-]+$/);
+var modelKey = import_zod3.z.string().min(1).max(128);
+var agentWebAppScopeSchema = import_zod3.z.object({
+  defaultProjectId: externalId,
+  allowedProjectIds: import_zod3.z.array(externalId).min(1).max(100),
+  defaultModelKey: modelKey.optional(),
+  allowedModelKeys: import_zod3.z.array(modelKey).max(100).optional()
+}).strict();
+var agentWebAppFeaturesSchema = import_zod3.z.object({
+  projectSelector: import_zod3.z.boolean(),
+  modelSelector: import_zod3.z.boolean(),
+  threadManagement: import_zod3.z.boolean(),
+  attachments: import_zod3.z.boolean(),
+  hitl: import_zod3.z.boolean(),
+  genUI: import_zod3.z.boolean()
+}).strict();
+var agentWebAppAppearanceSchema = import_zod3.z.object({
+  title: import_zod3.z.string().max(120).optional(),
+  welcomeMessage: import_zod3.z.string().max(1e3).optional(),
+  primaryColor: import_zod3.z.string().regex(/^#[0-9A-Fa-f]{6}$/).optional()
+}).strict();
+var createAgentWebAppSchema = import_zod3.z.object({
+  assistantId: externalId,
+  name: import_zod3.z.string().min(1).max(120),
+  description: import_zod3.z.string().max(1e3).optional(),
+  integration: import_zod3.z.object({ type: import_zod3.z.literal("react_sdk") }).strict(),
+  scope: agentWebAppScopeSchema,
+  features: agentWebAppFeaturesSchema,
+  appearance: agentWebAppAppearanceSchema
+}).strict();
+var updateAgentWebAppSchema = import_zod3.z.object({
+  name: import_zod3.z.string().min(1).max(120).optional(),
+  description: import_zod3.z.string().max(1e3).optional(),
+  scope: agentWebAppScopeSchema.partial().strict().optional(),
+  features: agentWebAppFeaturesSchema.partial().strict().optional(),
+  appearance: agentWebAppAppearanceSchema.partial().strict().optional()
+}).strict().refine((value) => Object.keys(value).length > 0, "Patch must not be empty");
+var listAgentWebAppsQuerySchema = import_zod3.z.object({
+  assistantId: externalId.optional()
+}).strict();
+
+// src/routes/agent-web-apps.ts
+function registerAgentWebAppRoutes(app2, deps) {
+  app2.register(async (routes) => {
+    routes.setErrorHandler((error, _request, reply) => normalizeError(reply, error));
+    registerScopedRoutes(routes, deps.service);
+  });
+}
+function registerScopedRoutes(app2, service2) {
+  app2.post("/api/web-apps", async (request, reply) => handle(reply, async () => ({
+    statusCode: 201,
+    data: await service2.create(requireContext(request), createAgentWebAppSchema.parse(request.body))
+  })));
+  app2.get("/api/web-apps", async (request, reply) => handle(reply, async () => {
+    const context = requireContext(request);
+    const query = listAgentWebAppsQuerySchema.parse(request.query);
+    const records = await service2.list(context, query.assistantId);
+    return { data: { records, total: records.length } };
+  }));
+  app2.get("/api/web-apps/:webAppId", async (request, reply) => handle(reply, async () => ({ data: await service2.get(requireContext(request), request.params.webAppId) })));
+  app2.patch("/api/web-apps/:webAppId", async (request, reply) => handle(reply, async () => ({
+    data: await service2.update(
+      requireContext(request),
+      request.params.webAppId,
+      updateAgentWebAppSchema.parse(request.body)
+    )
+  })));
+  app2.post("/api/web-apps/:webAppId/enable", async (request, reply) => handle(reply, async () => ({ data: await service2.enable(requireContext(request), request.params.webAppId) })));
+  app2.post("/api/web-apps/:webAppId/disable", async (request, reply) => handle(reply, async () => ({ data: await service2.disable(requireContext(request), request.params.webAppId) })));
+  app2.delete("/api/web-apps/:webAppId", async (request, reply) => handle(reply, async () => {
+    await service2.delete(requireContext(request), request.params.webAppId);
+    return { data: { id: request.params.webAppId } };
+  }));
+}
+function requireContext(request) {
+  const user = request.user;
+  const userId = user?.id ?? user?.userId;
+  if (!userId || !user?.tenantId) {
+    throw new AgentWebAppError("UNAUTHORIZED", 401, "Console session required");
+  }
+  return { tenantId: user.tenantId, userId };
+}
+async function handle(reply, operation) {
+  try {
+    const result = await operation();
+    return reply.code(result.statusCode ?? 200).send({ success: true, data: result.data });
+  } catch (error) {
+    if (error instanceof import_zod4.ZodError) {
+      return invalidRequest(reply, 400);
+    }
+    if (error instanceof AgentWebAppError) {
+      return reply.code(error.statusCode).send({
+        success: false,
+        error: { code: error.code, message: error.message, retryable: false }
+      });
+    }
+    throw error;
+  }
+}
+function normalizeError(reply, error) {
+  if (error instanceof AgentWebAppError) {
+    return reply.code(error.statusCode).send({
+      success: false,
+      error: { code: error.code, message: error.message, retryable: false }
+    });
+  }
+  if (error.statusCode && error.statusCode >= 400 && error.statusCode < 500) {
+    return invalidRequest(reply, error.statusCode);
+  }
+  return reply.code(500).send({
+    success: false,
+    error: { code: "INTERNAL_ERROR", message: "Internal server error", retryable: false }
+  });
+}
+function invalidRequest(reply, statusCode) {
+  return reply.code(statusCode).send({
+    success: false,
+    error: { code: "INVALID_REQUEST", message: "Invalid request", retryable: false }
+  });
+}
+
+// src/routes/agent-web-app-runtime.ts
+var import_zod5 = require("zod");
+
+// src/services/agent-web-app/AgentWebAppRuntimeService.ts
+var import_node_crypto3 = require("crypto");
+var import_protocols6 = require("@axiom-lattice/protocols");
+init_task_file_refs();
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+var AgentWebAppRuntimeError = class extends Error {
+  constructor(code, statusCode, message) {
+    super(message);
+    this.code = code;
+    this.statusCode = statusCode;
+    this.name = "AgentWebAppRuntimeError";
+  }
+};
+var AgentWebAppRuntimeService = class {
+  constructor(deps) {
+    this.deps = deps;
+  }
+  async bootstrap(webAppId, userId, selection) {
+    const runtime = await this.resolveRuntime(webAppId, selection);
+    const assistant = await this.deps.assistantResolver.resolve(
+      runtime.webApp.tenantId,
+      runtime.webApp.assistantId
+    );
+    if (!assistant) this.fail("WEB_APP_DISABLED", 403, "Agent Web App is unavailable");
+    const publicProjectIds = runtime.webApp.features.projectSelector ? runtime.webApp.scope.allowedProjectIds : [runtime.webApp.scope.defaultProjectId];
+    const projects = await Promise.all(publicProjectIds.map(async (id) => {
+      const project = await this.deps.projectStore.getProjectById(runtime.webApp.tenantId, id);
+      if (!project) this.fail("PROJECT_NOT_ALLOWED", 400, "Project is not available");
+      return { id: project.id, name: project.name };
+    }));
+    const defaultModelKey = runtime.webApp.scope.defaultModelKey;
+    if (defaultModelKey && !this.deps.modelRegistry.has(defaultModelKey)) {
+      this.fail("MODEL_NOT_ALLOWED", 400, "Default model is not available");
+    }
+    const configuredPublicModelKeys = runtime.webApp.features.modelSelector ? runtime.webApp.scope.allowedModelKeys ?? [] : defaultModelKey ? [defaultModelKey] : [];
+    const publicModelKeys = [...new Set(configuredPublicModelKeys)].filter((key) => this.deps.modelRegistry.has(key));
+    const models = publicModelKeys.map((key) => ({
+      key,
+      label: this.deps.modelRegistry.label(key)
+    }));
+    const result = {
+      webApp: {
+        id: runtime.webApp.id,
+        name: runtime.webApp.name,
+        description: runtime.webApp.description,
+        assistant,
+        defaultProjectId: runtime.webApp.scope.defaultProjectId,
+        defaultModelKey: runtime.webApp.scope.defaultModelKey,
+        features: runtime.webApp.features,
+        appearance: runtime.webApp.appearance,
+        identityAssurance: "unverified"
+      },
+      projects,
+      models
+    };
+    if (!runtime.webApp.features.threadManagement) {
+      result.thread = await this.resolveImplicitThread(runtime, userId);
+    }
+    return result;
+  }
+  async listThreads(webAppId, userId, selection) {
+    const runtime = await this.resolveRuntime(webAppId, selection);
+    this.requireFeature(runtime.webApp.features.threadManagement);
+    const threads = await this.ownedThreads(runtime, userId);
+    return threads.sort(compareThreads).map(toRuntimeThread);
+  }
+  async createThread(webAppId, userId, input) {
+    const runtime = await this.resolveRuntime(webAppId, input);
+    this.requireFeature(runtime.webApp.features.threadManagement);
+    return this.createOwnedThread(runtime, userId, input.label);
+  }
+  /** Update a thread label; omitted or blank labels preserve the existing label. */
+  async updateThread(webAppId, userId, threadId, input) {
+    const runtime = await this.resolveRuntime(webAppId, input);
+    this.requireFeature(runtime.webApp.features.threadManagement);
+    const thread = await this.requireOwnedThread(runtime, userId, threadId);
+    const label = normalizeLabel(input.label);
+    const updated = await this.deps.threadStore.updateThread(runtime.webApp.tenantId, thread.id, {
+      metadata: this.metadata(runtime, userId, label)
+    });
+    if (!updated) this.threadNotFound();
+    return toRuntimeThread(updated);
+  }
+  async deleteThread(webAppId, userId, threadId, selection) {
+    const runtime = await this.resolveRuntime(webAppId, selection);
+    this.requireFeature(runtime.webApp.features.threadManagement);
+    await this.requireOwnedThread(runtime, userId, threadId);
+    if (!await this.deps.threadStore.deleteThread(runtime.webApp.tenantId, threadId)) this.threadNotFound();
+  }
+  async getMessages(webAppId, userId, threadId, selection) {
+    const runtime = await this.resolveRuntime(webAppId, selection);
+    await this.requireOwnedThread(runtime, userId, threadId);
+    const messages = await this.deps.messageReader.getCurrentMessages({
+      tenantId: runtime.webApp.tenantId,
+      assistantId: runtime.webApp.assistantId,
+      threadId,
+      workspaceId: runtime.project.workspaceId,
+      projectId: runtime.project.id
+    });
+    return messages.flatMap((message) => {
+      if (!isRecord(message) || typeof message.id !== "string" || message.role !== "human" && message.role !== "ai") return [];
+      const content = typeof message.content === "string" ? message.content : runtime.webApp.features.genUI && Array.isArray(message.content) ? message.content.map(import_protocols6.parseAgentWebAppGenUIBlock).filter((block) => block !== void 0) : void 0;
+      return [{ id: message.id, role: message.role, ...content && (typeof content === "string" || content.length > 0) ? { content } : {} }];
+    });
+  }
+  async streamMessage(webAppId, userId, threadId, input) {
+    const runtime = await this.resolveOwnedRuntime(webAppId, userId, threadId, input);
+    const refs = this.resolveAttachmentRefs(runtime, userId, threadId, input.attachmentRefs ?? []);
+    const agent = this.resolveAgent(runtime, threadId);
+    const content = refs.length ? `${input.content}
+
+${formatFileRefsSection(refs)}` : input.content;
+    const execution = await this.execute(agent, runtime, { input: { message: content } });
+    return { ...execution, allowInterrupts: runtime.webApp.features.hitl, allowGenUI: runtime.webApp.features.genUI };
+  }
+  async abort(webAppId, userId, threadId, selection) {
+    const { agent } = await this.resolveOwnedAgent(webAppId, userId, threadId, selection);
+    await agent.abort();
+  }
+  async uploadAttachment(webAppId, userId, threadId, selection, file) {
+    const runtime = await this.resolveOwnedRuntime(webAppId, userId, threadId, selection);
+    this.requireNamedFeature(runtime.webApp.features.attachments, "Attachments are disabled");
+    if (!this.deps.saveProjectFile || !this.deps.attachmentRefs) this.fail("INTERNAL_ERROR", 500, "Attachment service is unavailable");
+    const userDigest = (0, import_node_crypto3.createHash)("sha256").update(userId, "utf8").digest("hex");
+    const contentDigest = (0, import_node_crypto3.createHash)("sha256").update(file.bytes).digest("hex");
+    const displayName = file.name;
+    const physicalName = `${(0, import_node_crypto3.randomUUID)()}-${sanitizePhysicalFilename(file.name)}`;
+    const saved = await this.deps.saveProjectFile({
+      tenantId: runtime.webApp.tenantId,
+      workspaceId: runtime.project.workspaceId,
+      projectId: runtime.project.id,
+      assistantId: runtime.webApp.assistantId,
+      name: physicalName,
+      mimeType: file.mimeType,
+      bytes: file.bytes,
+      path: `/project/web-apps/${runtime.webApp.id}/${userDigest}/${threadId}`
+    });
+    const ref = this.deps.attachmentRefs.sign({
+      webAppId: runtime.webApp.id,
+      userId,
+      threadId,
+      projectId: runtime.project.id,
+      uri: saved.uri,
+      name: displayName,
+      mimeType: file.mimeType,
+      size: saved.size,
+      contentDigest
+    });
+    return { ref, name: displayName, mimeType: file.mimeType, size: saved.size };
+  }
+  async resumeInterrupt(webAppId, userId, threadId, interruptId, selection, input) {
+    const { runtime, agent } = await this.resolveOwnedAgent(webAppId, userId, threadId, selection);
+    this.requireNamedFeature(runtime.webApp.features.hitl, "Human review is disabled");
+    const state = await agent.getCurrentState();
+    if (!hasInterrupt(state, interruptId)) this.fail("INVALID_REQUEST", 400, "Interrupt not found");
+    const execution = await this.execute(agent, runtime, {
+      input: { message: input.message },
+      command: { resume: input.response }
+    });
+    return { ...execution, allowInterrupts: true, allowGenUI: runtime.webApp.features.genUI };
+  }
+  execute(agent, runtime, request) {
+    return executeScopedAgentMessage(agent, {
+      ...request,
+      ...runtime.modelKey ? { custom_run_config: { modelConfig: { modelKey: runtime.modelKey } } } : {}
+    }, [import_protocols6.MessageChunkTypes.MESSAGE_COMPLETED, import_protocols6.MessageChunkTypes.INTERRUPT, import_protocols6.MessageChunkTypes.MESSAGE_FAILED]);
+  }
+  async resolveRuntime(webAppId, selection) {
+    const webApp = await this.deps.webAppStore.findById(webAppId);
+    if (!webApp) this.fail("WEB_APP_NOT_FOUND", 404, "Agent Web App not found");
+    const previewAllowed = webApp.status === "draft" && selection.preview?.tenantId === webApp.tenantId && await this.deps.authorizePreview?.(webApp, selection.preview) === true;
+    if (webApp.status !== "active" && !previewAllowed) this.fail("WEB_APP_DISABLED", 403, "Agent Web App is disabled");
+    if (!webApp.features.projectSelector && selection.projectId !== void 0) {
+      this.fail("PROJECT_SELECTOR_DISABLED", 400, "Project selection is disabled");
+    }
+    const projectId = selection.projectId ?? webApp.scope.defaultProjectId;
+    if (!webApp.scope.allowedProjectIds.includes(projectId)) {
+      this.fail("PROJECT_NOT_ALLOWED", 400, "Project is not allowed");
+    }
+    const project = await this.deps.projectStore.getProjectById(webApp.tenantId, projectId);
+    if (!project) this.fail("PROJECT_NOT_ALLOWED", 400, "Project is not available");
+    if (!webApp.features.modelSelector && selection.modelKey !== void 0) {
+      this.fail("MODEL_NOT_ALLOWED", 400, "Model selection is disabled");
+    }
+    const modelKey2 = selection.modelKey ?? webApp.scope.defaultModelKey;
+    const allowedModels = webApp.scope.allowedModelKeys;
+    if (modelKey2 && (!allowedModels?.includes(modelKey2) || !this.deps.modelRegistry.has(modelKey2))) {
+      this.fail("MODEL_NOT_ALLOWED", 400, "Model is not allowed");
+    }
+    return { webApp, project, modelKey: modelKey2 };
+  }
+  async resolveOwnedAgent(webAppId, userId, threadId, selection) {
+    const runtime = await this.resolveOwnedRuntime(webAppId, userId, threadId, selection);
+    return { runtime, agent: this.resolveAgent(runtime, threadId) };
+  }
+  async resolveOwnedRuntime(webAppId, userId, threadId, selection) {
+    const runtime = await this.resolveRuntime(webAppId, selection);
+    await this.requireOwnedThread(runtime, userId, threadId);
+    return runtime;
+  }
+  resolveAgent(runtime, threadId) {
+    if (!this.deps.agentResolver) this.fail("INTERNAL_ERROR", 500, "Agent runtime is unavailable");
+    return this.deps.agentResolver.getAgent({
+      tenantId: runtime.webApp.tenantId,
+      assistantId: runtime.webApp.assistantId,
+      threadId,
+      workspaceId: runtime.project.workspaceId,
+      projectId: runtime.project.id,
+      ...runtime.modelKey ? { modelKey: runtime.modelKey } : {}
+    });
+  }
+  resolveAttachmentRefs(runtime, userId, threadId, refs) {
+    if (refs.length === 0) return [];
+    this.requireNamedFeature(runtime.webApp.features.attachments, "Attachments are disabled");
+    if (!this.deps.attachmentRefs) this.fail("INTERNAL_ERROR", 500, "Attachment service is unavailable");
+    try {
+      return refs.map((ref) => ({
+        ...this.deps.attachmentRefs.verify(ref, {
+          webAppId: runtime.webApp.id,
+          userId,
+          threadId,
+          projectId: runtime.project.id
+        }),
+        addedBy: "user"
+      }));
+    } catch {
+      return this.fail("INVALID_REQUEST", 400, "Invalid attachment reference");
+    }
+  }
+  async ownedThreads(runtime, userId) {
+    return this.deps.threadStore.getThreadsByAssistantId(
+      runtime.webApp.tenantId,
+      runtime.webApp.assistantId,
+      {
+        source: "web_app",
+        webAppId: runtime.webApp.id,
+        userId,
+        projectId: runtime.project.id
+      }
+    );
+  }
+  async requireOwnedThread(runtime, userId, threadId) {
+    const thread = await this.deps.threadStore.getThreadById(runtime.webApp.tenantId, threadId);
+    const metadata = thread?.metadata;
+    if (!thread || thread.assistantId !== runtime.webApp.assistantId || metadata?.source !== "web_app" || metadata.webAppId !== runtime.webApp.id || metadata.userId !== userId || metadata.projectId !== runtime.project.id) this.threadNotFound();
+    return thread;
+  }
+  async resolveImplicitThread(runtime, userId) {
+    const latest = (await this.ownedThreads(runtime, userId)).sort(compareThreads)[0];
+    if (latest) return toRuntimeThread(latest);
+    const threadId = implicitThreadId(runtime, userId);
+    const existing = await this.deps.threadStore.getThreadById(
+      runtime.webApp.tenantId,
+      threadId
+    );
+    if (existing) return toRuntimeThread(this.requireImplicitOwnership(runtime, userId, existing));
+    await this.deps.threadStore.createThread(
+      runtime.webApp.tenantId,
+      runtime.webApp.assistantId,
+      threadId,
+      { metadata: this.metadata(runtime, userId) }
+    );
+    const persisted = await this.deps.threadStore.getThreadById(
+      runtime.webApp.tenantId,
+      threadId
+    );
+    if (!persisted) this.fail("INTERNAL_ERROR", 500, "Implicit thread could not be resolved");
+    return toRuntimeThread(this.requireImplicitOwnership(runtime, userId, persisted));
+  }
+  requireImplicitOwnership(runtime, userId, thread) {
+    const metadata = thread.metadata;
+    if (thread.assistantId !== runtime.webApp.assistantId || metadata?.source !== "web_app" || metadata.webAppId !== runtime.webApp.id || metadata.userId !== userId || metadata.projectId !== runtime.project.id) this.fail("INTERNAL_ERROR", 500, "Implicit thread identity conflict");
+    return thread;
+  }
+  async createOwnedThread(runtime, userId, rawLabel) {
+    const thread = await this.deps.threadStore.createThread(
+      runtime.webApp.tenantId,
+      runtime.webApp.assistantId,
+      (0, import_node_crypto3.randomUUID)(),
+      { metadata: this.metadata(runtime, userId, normalizeLabel(rawLabel)) }
+    );
+    return toRuntimeThread(thread);
+  }
+  metadata(runtime, userId, label) {
+    return {
+      source: "web_app",
+      webAppId: runtime.webApp.id,
+      userId,
+      projectId: runtime.project.id,
+      ...label ? { label } : {}
+    };
+  }
+  requireFeature(enabled) {
+    if (!enabled) this.fail("FEATURE_DISABLED", 403, "Thread management is disabled");
+  }
+  requireNamedFeature(enabled, message) {
+    if (!enabled) this.fail("FEATURE_DISABLED", 403, message);
+  }
+  threadNotFound() {
+    return this.fail("THREAD_NOT_FOUND", 404, "Thread not found");
+  }
+  fail(code, statusCode, message) {
+    throw new AgentWebAppRuntimeError(code, statusCode, message);
+  }
+};
+function hasInterrupt(state, interruptId) {
+  if (typeof state !== "object" || state === null || !("tasks" in state) || !Array.isArray(state.tasks)) return false;
+  return state.tasks.some((task) => {
+    if (typeof task !== "object" || task === null || !("interrupts" in task) || !Array.isArray(task.interrupts)) return false;
+    return task.interrupts.some((interrupt) => typeof interrupt === "object" && interrupt !== null && "id" in interrupt && interrupt.id === interruptId);
+  });
+}
+function sanitizePhysicalFilename(name) {
+  const sanitized = name.replace(/[^A-Za-z0-9._-]/g, "_").replace(/^\.+/, "");
+  return sanitized || "file";
+}
+function normalizeLabel(label) {
+  const normalized = label?.trim();
+  return normalized || void 0;
+}
+function implicitThreadId(runtime, userId) {
+  const canonicalTuple = JSON.stringify([
+    "axiom.agent-web-app.implicit-thread",
+    1,
+    runtime.webApp.tenantId,
+    runtime.webApp.assistantId,
+    runtime.webApp.id,
+    userId,
+    runtime.project.id
+  ]);
+  const bytes = (0, import_node_crypto3.createHash)("sha256").update(canonicalTuple, "utf8").digest().subarray(0, 16);
+  bytes[6] = bytes[6] & 15 | 128;
+  bytes[8] = bytes[8] & 63 | 128;
+  const hex = bytes.toString("hex");
+  return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20)}`;
+}
+function compareThreads(left, right) {
+  return right.updatedAt.getTime() - left.updatedAt.getTime() || right.id.localeCompare(left.id);
+}
+function toRuntimeThread(thread) {
+  return {
+    id: thread.id,
+    projectId: String(thread.metadata?.projectId),
+    ...typeof thread.metadata?.label === "string" ? { label: thread.metadata.label } : {},
+    createdAt: thread.createdAt,
+    updatedAt: thread.updatedAt
+  };
+}
+
+// src/services/agent-web-app/AgentWebAppStreamProjector.ts
+var import_protocols7 = require("@axiom-lattice/protocols");
+function createAgentWebAppStreamProjectionContext(options = {}) {
+  return { startedToolIds: /* @__PURE__ */ new Set(), allowInterrupts: options.allowInterrupts ?? true, allowGenUI: options.allowGenUI ?? false };
+}
+function projectAgentWebAppChunk(chunk, context) {
+  if (chunk.type === import_protocols7.MessageChunkTypes.AI) {
+    const events = [];
+    const startedToolIds = context?.startedToolIds ?? /* @__PURE__ */ new Set();
+    if (typeof chunk.data.content === "string" && chunk.data.content) events.push({ type: "message.delta", text: chunk.data.content });
+    if (context?.allowGenUI && Array.isArray(chunk.data.content)) {
+      for (const value of chunk.data.content) {
+        const block = (0, import_protocols7.parseAgentWebAppGenUIBlock)(value);
+        if (block) events.push({ type: "genui.render", block });
+      }
+    }
+    for (const call of chunk.data.tool_call_chunks ?? []) {
+      if (call.id && call.name && !startedToolIds.has(call.id)) {
+        startedToolIds.add(call.id);
+        events.push({ type: "tool.started", id: call.id, name: call.name });
+      }
+    }
+    for (const call of chunk.data.tool_calls ?? []) {
+      if (!startedToolIds.has(call.id)) {
+        startedToolIds.add(call.id);
+        events.push({ type: "tool.started", id: call.id, name: call.name });
+      }
+    }
+    return events;
+  }
+  if (chunk.type === import_protocols7.MessageChunkTypes.TOOL && chunk.data.tool_call_id) {
+    return [{ type: "tool.completed", id: chunk.data.tool_call_id }];
+  }
+  if (chunk.type === import_protocols7.MessageChunkTypes.INTERRUPT) {
+    if (context && !context.allowInterrupts) return [{ type: "stream.completed" }];
+    const interrupt = publicInterrupt(chunk);
+    return interrupt ? [{ type: "interrupt.created", interrupt }, { type: "stream.completed" }] : [{ type: "stream.completed" }];
+  }
+  if (chunk.type === import_protocols7.MessageChunkTypes.MESSAGE_COMPLETED) {
+    return [
+      { type: "message.completed", messageId: chunk.data.id },
+      { type: "stream.completed" }
+    ];
+  }
+  if (chunk.type === import_protocols7.MessageChunkTypes.MESSAGE_FAILED) {
+    return [
+      { type: "error", error: { code: "STREAM_FAILED", message: "Stream failed", retryable: true } },
+      { type: "stream.completed" }
+    ];
+  }
+  return [];
+}
+function publicInterrupt(chunk) {
+  const value = parseInterruptContent(chunk.data.content);
+  if (!value) return void 0;
+  const topLevelId = chunk.id;
+  const id = typeof topLevelId === "string" ? topLevelId : chunk.data.id;
+  if (!id) return void 0;
+  return {
+    id,
+    type: typeof value.type === "string" ? value.type : "input",
+    prompt: typeof value.prompt === "string" ? value.prompt : typeof value.message === "string" ? value.message : "Input required",
+    ...isRecord2(value.data) ? { data: value.data } : {}
+  };
+}
+function parseInterruptContent(content) {
+  if (!content) return {};
+  if (isRecord2(content)) return content;
+  if (typeof content !== "string") return void 0;
+  try {
+    const parsed = JSON.parse(content);
+    return isRecord2(parsed) ? parsed : { prompt: content };
+  } catch {
+    return { prompt: content };
+  }
+}
+function isRecord2(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+// src/routes/agent-web-app-runtime.ts
+var idSchema = import_zod5.z.string().min(1).max(128);
+var paramsSchema = import_zod5.z.object({ webAppId: idSchema }).strict();
+var threadParamsSchema = import_zod5.z.object({ webAppId: idSchema, threadId: idSchema }).strict();
+var interruptParamsSchema = import_zod5.z.object({ webAppId: idSchema, threadId: idSchema, interruptId: idSchema }).strict();
+var bootstrapQuerySchema = import_zod5.z.object({ projectId: idSchema.optional(), modelKey: idSchema.optional() }).strict();
+var projectQuerySchema = import_zod5.z.object({ projectId: idSchema.optional() }).strict();
+var threadBodySchema = import_zod5.z.object({ projectId: idSchema.optional(), label: import_zod5.z.string().max(128).optional() }).strict();
+var streamBodySchema = import_zod5.z.object({
+  content: import_zod5.z.string().trim().min(1).max(32768),
+  projectId: idSchema.optional(),
+  modelKey: idSchema.optional(),
+  attachmentRefs: import_zod5.z.array(import_zod5.z.string().min(1).max(8192)).max(10).optional()
+}).strict();
+var resumeBodySchema = import_zod5.z.object({
+  projectId: idSchema.optional(),
+  modelKey: idSchema.optional(),
+  message: import_zod5.z.string().trim().min(1).max(4096),
+  response: import_zod5.z.union([
+    import_zod5.z.boolean(),
+    import_zod5.z.string().max(4096),
+    import_zod5.z.object({ approved: import_zod5.z.boolean(), feedback: import_zod5.z.string().max(4096).optional() }).strict()
+  ])
+}).strict();
+var MAX_ATTACHMENT_BYTES = 10 * 1024 * 1024;
+function createExternalHeaderIdentityResolver() {
+  return { resolve(request) {
+    const raw = request.headers["x-axiom-external-user-id"];
+    if (raw === void 0) throw new AgentWebAppRuntimeError("USER_ID_REQUIRED", 401, "External user id is required");
+    if (Array.isArray(raw) || typeof raw !== "string") throw new AgentWebAppRuntimeError("INVALID_USER_ID", 400, "External user id is invalid");
+    const userId = raw.trim();
+    if (!/^[A-Za-z0-9._:@-]+$/.test(userId) || userId.length > 128) throw new AgentWebAppRuntimeError("INVALID_USER_ID", 400, "External user id is invalid");
+    return { userId, assurance: "unverified" };
+  } };
+}
+function registerAgentWebAppRuntimeRoutes(app2, deps) {
+  const identities = deps.identityResolver ?? createExternalHeaderIdentityResolver();
+  app2.register(async (routes) => {
+    routes.setErrorHandler((error, _request, reply) => normalizeError2(reply, error));
+    routes.get("/api/web-apps/:webAppId/runtime/bootstrap", async (request, reply) => handle2(reply, async () => {
+      const { webAppId } = paramsSchema.parse(request.params);
+      const identity = resolveRuntimeIdentity(request, webAppId, identities);
+      return { data: await deps.service.bootstrap(webAppId, identity.userId, withPreview(bootstrapQuerySchema.parse(request.query), identity.preview)) };
+    }));
+    routes.get("/api/web-apps/:webAppId/runtime/threads", async (request, reply) => handle2(reply, async () => {
+      const { webAppId } = paramsSchema.parse(request.params);
+      const identity = resolveRuntimeIdentity(request, webAppId, identities);
+      const records = await deps.service.listThreads(webAppId, identity.userId, withPreview(projectQuerySchema.parse(request.query), identity.preview));
+      return { data: { records, total: records.length } };
+    }));
+    routes.post("/api/web-apps/:webAppId/runtime/threads", async (request, reply) => handle2(reply, async () => {
+      const { webAppId } = paramsSchema.parse(request.params);
+      const identity = resolveRuntimeIdentity(request, webAppId, identities);
+      return { statusCode: 201, data: await deps.service.createThread(webAppId, identity.userId, withPreview(threadBodySchema.parse(request.body), identity.preview)) };
+    }));
+    routes.patch("/api/web-apps/:webAppId/runtime/threads/:threadId", async (request, reply) => handle2(reply, async () => {
+      const { webAppId, threadId } = threadParamsSchema.parse(request.params);
+      const identity = resolveRuntimeIdentity(request, webAppId, identities);
+      return { data: await deps.service.updateThread(webAppId, identity.userId, threadId, withPreview(threadBodySchema.parse(request.body), identity.preview)) };
+    }));
+    routes.delete("/api/web-apps/:webAppId/runtime/threads/:threadId", async (request, reply) => handle2(reply, async () => {
+      const { webAppId, threadId } = threadParamsSchema.parse(request.params);
+      const identity = resolveRuntimeIdentity(request, webAppId, identities);
+      await deps.service.deleteThread(webAppId, identity.userId, threadId, withPreview(projectQuerySchema.parse(request.query), identity.preview));
+      return { data: { id: threadId } };
+    }));
+    routes.get("/api/web-apps/:webAppId/runtime/threads/:threadId/messages", async (request, reply) => handle2(reply, async () => {
+      const { webAppId, threadId } = threadParamsSchema.parse(request.params);
+      const identity = resolveRuntimeIdentity(request, webAppId, identities);
+      const messages = await deps.service.getMessages(webAppId, identity.userId, threadId, withPreview(projectQuerySchema.parse(request.query), identity.preview));
+      return { data: { messages } };
+    }));
+    routes.post("/api/web-apps/:webAppId/runtime/threads/:threadId/messages/stream", async (request, reply) => {
+      try {
+        const { webAppId, threadId } = threadParamsSchema.parse(request.params);
+        const identity = resolveRuntimeIdentity(request, webAppId, identities);
+        const input = streamBodySchema.parse(request.body);
+        const result = await deps.service.streamMessage(webAppId, identity.userId, threadId, withPreview(input, identity.preview));
+        beginSse(reply);
+        await pipeAgentWebAppStream(reply.raw, result.stream, result);
+      } catch (error) {
+        return normalizeError2(reply, error);
+      }
+    });
+    routes.post("/api/web-apps/:webAppId/runtime/threads/:threadId/abort", async (request, reply) => handle2(reply, async () => {
+      const { webAppId, threadId } = threadParamsSchema.parse(request.params);
+      const identity = resolveRuntimeIdentity(request, webAppId, identities);
+      await deps.service.abort(webAppId, identity.userId, threadId, withPreview(projectQuerySchema.parse(request.query), identity.preview));
+      return { data: { aborted: true } };
+    }));
+    routes.post("/api/web-apps/:webAppId/runtime/threads/:threadId/attachments", async (request, reply) => handle2(reply, async () => {
+      const { webAppId, threadId } = threadParamsSchema.parse(request.params);
+      const identity = resolveRuntimeIdentity(request, webAppId, identities);
+      if (!request.isMultipart()) throw new import_zod5.ZodError([]);
+      const part = await request.file({ limits: { files: 1, fileSize: MAX_ATTACHMENT_BYTES } });
+      if (!part || !part.filename || part.filename.length > 255) throw new import_zod5.ZodError([]);
+      const bytes = await part.toBuffer();
+      if (bytes.length === 0 || part.file.truncated) throw new import_zod5.ZodError([]);
+      const data = await deps.service.uploadAttachment(webAppId, identity.userId, threadId, withPreview(projectQuerySchema.parse(request.query), identity.preview), {
+        name: part.filename,
+        mimeType: part.mimetype || "application/octet-stream",
+        bytes
+      });
+      return { statusCode: 201, data };
+    }));
+    routes.post("/api/web-apps/:webAppId/runtime/threads/:threadId/interrupts/:interruptId/resume", async (request, reply) => {
+      try {
+        const { webAppId, threadId, interruptId } = interruptParamsSchema.parse(request.params);
+        const identity = resolveRuntimeIdentity(request, webAppId, identities);
+        const { projectId, modelKey: modelKey2, message, response } = resumeBodySchema.parse(request.body);
+        const result = await deps.service.resumeInterrupt(webAppId, identity.userId, threadId, interruptId, withPreview({ projectId, modelKey: modelKey2 }, identity.preview), { message, response });
+        beginSse(reply);
+        await pipeAgentWebAppStream(reply.raw, result.stream, result);
+      } catch (error) {
+        return normalizeError2(reply, error);
+      }
+    });
+  });
+}
+function resolveRuntimeIdentity(request, webAppId, identities) {
+  if (request.headers["x-axiom-web-app-preview"] !== "true") return identities.resolve(request);
+  const user = request.user;
+  if (!user?.id || !user.tenantId) throw new AgentWebAppRuntimeError("USER_ID_REQUIRED", 401, "Authenticated Console preview is required");
+  return { userId: `console-preview:${user.id}:${webAppId}`, preview: { tenantId: user.tenantId, userId: user.id } };
+}
+function withPreview(selection, preview) {
+  return { ...selection, ...preview ? { preview } : {} };
+}
+async function pipeAgentWebAppStream(raw, stream, options = {}) {
+  const projection = createAgentWebAppStreamProjectionContext(options);
+  await pipeAsyncIterableToSse(raw, stream, {
+    project: (chunk) => projectAgentWebAppChunk(chunk, projection),
+    onError: () => [
+      { type: "error", error: { code: "STREAM_FAILED", message: "Stream failed", retryable: true } },
+      { type: "stream.completed" }
+    ]
+  });
+}
+function beginSse(reply) {
+  reply.hijack();
+  reply.raw.writeHead(200, {
+    "Content-Type": "text/event-stream; charset=utf-8",
+    "Cache-Control": "no-cache, no-transform",
+    Connection: "keep-alive",
+    "X-Accel-Buffering": "no"
+  });
+}
+async function handle2(reply, operation) {
+  try {
+    const result = await operation();
+    return reply.code(result.statusCode ?? 200).send({ success: true, data: result.data });
+  } catch (error) {
+    return normalizeError2(reply, error);
+  }
+}
+function normalizeError2(reply, error) {
+  if (error instanceof AgentWebAppRuntimeError) return reply.code(error.statusCode).send({ success: false, error: { code: error.code, message: error.message, retryable: false } });
+  if (error instanceof import_zod5.ZodError) return reply.code(400).send({ success: false, error: { code: "INVALID_REQUEST", message: "Invalid request", retryable: false } });
+  if (isMultipartRequestError(error)) return reply.code(400).send({ success: false, error: { code: "INVALID_REQUEST", message: "Invalid request", retryable: false } });
+  return reply.code(500).send({ success: false, error: { code: "INTERNAL_ERROR", message: "Internal server error", retryable: false } });
+}
+function isMultipartRequestError(error) {
+  return typeof error === "object" && error !== null && "code" in error && typeof error.code === "string" && error.code.startsWith("FST_");
+}
+
+// src/services/agent-web-app/AgentWebAppAttachmentRef.ts
+var import_node_crypto4 = require("crypto");
+var TTL_MS = 15 * 6e4;
+function resolveAgentWebAppAttachmentSecret(consoleSecret) {
+  return process.env.WEB_APP_ATTACHMENT_SECRET || process.env.AUTH_TOKEN_SECRET || process.env.JWT_SECRET || consoleSecret;
+}
+var AgentWebAppAttachmentRefService = class {
+  constructor(secret, now = Date.now) {
+    this.now = now;
+    if (!secret) throw new Error("Attachment signing secret is required");
+    this.key = (0, import_node_crypto4.createHash)("sha256").update(secret, "utf8").digest();
+  }
+  sign(input) {
+    const payload = {
+      webAppId: input.webAppId,
+      userDigest: digestUser(input.userId),
+      threadId: input.threadId,
+      projectId: input.projectId,
+      uri: input.uri,
+      name: input.name,
+      mimeType: input.mimeType,
+      size: input.size,
+      contentDigest: input.contentDigest,
+      exp: this.now() + TTL_MS
+    };
+    const iv = (0, import_node_crypto4.randomBytes)(12);
+    const cipher = (0, import_node_crypto4.createCipheriv)("aes-256-gcm", this.key, iv);
+    const ciphertext = Buffer.concat([
+      cipher.update(JSON.stringify(payload), "utf8"),
+      cipher.final()
+    ]);
+    const tag = cipher.getAuthTag();
+    return `v1.${iv.toString("base64url")}.${ciphertext.toString("base64url")}.${tag.toString("base64url")}`;
+  }
+  verify(ref, scope) {
+    const [version, encodedIv, encodedCiphertext, encodedTag, extra] = ref.split(".");
+    if (version !== "v1" || !encodedIv || !encodedCiphertext || !encodedTag || extra !== void 0 || !/^[A-Za-z0-9_-]{16}$/.test(encodedIv) || !/^[A-Za-z0-9_-]+$/.test(encodedCiphertext) || !/^[A-Za-z0-9_-]{22}$/.test(encodedTag)) this.invalid();
+    try {
+      const iv = decodeCanonical(encodedIv, 12);
+      const ciphertext = decodeCanonical(encodedCiphertext);
+      const tag = decodeCanonical(encodedTag, 16);
+      const decipher = (0, import_node_crypto4.createDecipheriv)("aes-256-gcm", this.key, iv);
+      decipher.setAuthTag(tag);
+      const plaintext = Buffer.concat([decipher.update(ciphertext), decipher.final()]);
+      const value = JSON.parse(plaintext.toString("utf8"));
+      if (!isAttachmentPayload(value)) this.invalid();
+      if (value.exp <= this.now()) throw new Error("Attachment reference expired");
+      if (value.webAppId !== scope.webAppId || value.userDigest !== digestUser(scope.userId) || value.threadId !== scope.threadId || value.projectId !== scope.projectId) this.invalid();
+      return {
+        uri: value.uri,
+        name: value.name,
+        mimeType: value.mimeType,
+        size: value.size,
+        contentDigest: value.contentDigest
+      };
+    } catch (error) {
+      if (error instanceof Error && error.message === "Attachment reference expired") throw error;
+      this.invalid();
+    }
+  }
+  invalid() {
+    throw new Error("Invalid attachment reference");
+  }
+};
+function decodeCanonical(value, expectedBytes) {
+  const decoded = Buffer.from(value, "base64url");
+  if (decoded.toString("base64url") !== value || expectedBytes !== void 0 && decoded.length !== expectedBytes) {
+    throw new Error("Invalid attachment reference");
+  }
+  return decoded;
+}
+function digestUser(userId) {
+  return (0, import_node_crypto4.createHash)("sha256").update(userId, "utf8").digest("hex");
+}
+function isAttachmentPayload(value) {
+  if (typeof value !== "object" || value === null || Array.isArray(value)) return false;
+  const record = value;
+  if (Object.keys(record).sort().join(",") !== "contentDigest,exp,mimeType,name,projectId,size,threadId,uri,userDigest,webAppId") return false;
+  return typeof record.webAppId === "string" && typeof record.userDigest === "string" && /^[a-f0-9]{64}$/.test(record.userDigest) && typeof record.threadId === "string" && typeof record.projectId === "string" && typeof record.uri === "string" && record.uri.startsWith("/") && typeof record.name === "string" && record.name.length > 0 && typeof record.mimeType === "string" && record.mimeType.length > 0 && typeof record.size === "number" && Number.isSafeInteger(record.size) && record.size >= 0 && typeof record.contentDigest === "string" && /^[a-f0-9]{64}$/.test(record.contentDigest) && typeof record.exp === "number" && Number.isSafeInteger(record.exp);
+}
+
+// src/routes/index.ts
+init_workspace_file_service();
 var registerLatticeRoutes = (app2, channelDeps) => {
+  const webAppStore = (0, import_core41.getStoreLattice)("default", "agentWebApp").store;
+  const assistantStore = (0, import_core41.getStoreLattice)("default", "assistant").store;
+  const projectStore = (0, import_core41.getStoreLattice)("default", "project").store;
+  registerAgentWebAppRoutes(app2, {
+    service: new AgentWebAppService({
+      webAppStore,
+      assistantStore,
+      projectStore,
+      modelRegistry: { has: (key) => import_core41.modelLatticeManager.hasLattice(key) },
+      configuredAgentResolver: createConfiguredAgentResolver({
+        hydrate: (tenantId) => import_core41.agentLatticeManager.initializeStoredAssistantsForTenant(tenantId),
+        has: (tenantId, assistantId) => import_core41.agentLatticeManager.hasAgentLatticeWithTenant(tenantId, assistantId)
+      })
+    })
+  });
+  registerAgentWebAppRuntimeRoutes(app2, {
+    service: new AgentWebAppRuntimeService({
+      webAppStore,
+      threadStore: (0, import_core41.getStoreLattice)("default", "thread").store,
+      projectStore,
+      assistantResolver: {
+        resolve: async (tenantId, assistantId) => {
+          const stored = await assistantStore.getAssistantById(tenantId, assistantId);
+          if (stored) return stored;
+          await import_core41.agentLatticeManager.initializeStoredAssistantsForTenant(tenantId);
+          const config = import_core41.agentLatticeManager.getAgentConfigWithTenant(tenantId, assistantId);
+          return config ? { id: assistantId, name: config.name, description: config.description } : null;
+        }
+      },
+      modelRegistry: {
+        has: (key) => import_core41.modelLatticeManager.hasLattice(key),
+        label: (key) => key
+      },
+      messageReader: {
+        getCurrentMessages: ({ tenantId, assistantId, threadId, workspaceId, projectId }) => import_core41.agentInstanceManager.getAgent({
+          tenant_id: tenantId,
+          assistant_id: assistantId,
+          thread_id: threadId,
+          workspace_id: workspaceId,
+          project_id: projectId
+        }).getCurrentMessages()
+      },
+      agentResolver: {
+        getAgent: ({ tenantId, assistantId, threadId, workspaceId, projectId }) => import_core41.agentInstanceManager.getAgent({
+          tenant_id: tenantId,
+          assistant_id: assistantId,
+          thread_id: threadId,
+          workspace_id: workspaceId,
+          project_id: projectId
+        })
+      },
+      attachmentRefs: new AgentWebAppAttachmentRefService(
+        resolveAgentWebAppAttachmentSecret(
+          resolveConsoleTokenSecret(process.env.AUTH_REQUIRED === "true")
+        )
+      ),
+      saveProjectFile,
+      authorizePreview: async (webApp, preview) => {
+        if (webApp.tenantId !== preview.tenantId) return false;
+        const assistant = await assistantStore.getAssistantById(preview.tenantId, webApp.assistantId);
+        if (assistant) return !assistant.ownerUserId || assistant.ownerUserId === preview.userId;
+        await import_core41.agentLatticeManager.initializeStoredAssistantsForTenant(preview.tenantId);
+        return import_core41.agentLatticeManager.hasAgentLatticeWithTenant(preview.tenantId, webApp.assistantId);
+      }
+    })
+  });
   registerA2ABridgeRoutes(app2);
   registerSTTRoutes(app2);
   app2.get("/api/local-a2a", getLocalA2AStatus);
@@ -13136,12 +14260,12 @@ function registerResourceRoutes(app2, controller) {
 }
 
 // src/export_registrations/index.ts
-var import_core51 = require("@axiom-lattice/core");
+var import_core52 = require("@axiom-lattice/core");
 
 // src/export_registrations/skill.registration.ts
-var import_core41 = require("@axiom-lattice/core");
+var import_core42 = require("@axiom-lattice/core");
 function getStore2(context) {
-  return new import_core41.SandboxSkillStore({
+  return new import_core42.SandboxSkillStore({
     workspaceId: context?.workspaceId,
     projectId: context?.projectId
   });
@@ -13159,7 +14283,7 @@ var skillRegistration = {
   async listForExport(tenantId, context) {
     const store2 = getStore2(context);
     const skills = await store2.getAllSkills(tenantId, toStoreContext(context));
-    return skills.filter((s) => !(0, import_core41.isBuiltInSkill)(s.id)).map((s) => ({
+    return skills.filter((s) => !(0, import_core42.isBuiltInSkill)(s.id)).map((s) => ({
       _exportId: "",
       data: {
         id: s.id,
@@ -13224,7 +14348,7 @@ var skillRegistration = {
     const insertions = [];
     for (const entity of entities) {
       const id = entity.data.id;
-      if ((0, import_core41.isBuiltInSkill)(id)) continue;
+      if ((0, import_core42.isBuiltInSkill)(id)) continue;
       if (existingIds.has(id)) {
         conflicts.push({
           _exportId: entity._exportId,
@@ -13283,9 +14407,9 @@ var skillRegistration = {
 };
 
 // src/export_registrations/agent.registration.ts
-var import_core42 = require("@axiom-lattice/core");
+var import_core43 = require("@axiom-lattice/core");
 function getStore3() {
-  return (0, import_core42.getStoreLattice)("default", "assistant").store;
+  return (0, import_core43.getStoreLattice)("default", "assistant").store;
 }
 var agentRegistration = {
   entityType: "agent",
@@ -13365,9 +14489,9 @@ var agentRegistration = {
 };
 
 // src/export_registrations/database-config.registration.ts
-var import_core43 = require("@axiom-lattice/core");
+var import_core44 = require("@axiom-lattice/core");
 function getStore4() {
-  return (0, import_core43.getStoreLattice)("default", "database").store;
+  return (0, import_core44.getStoreLattice)("default", "database").store;
 }
 var databaseConfigRegistration = {
   entityType: "database_config",
@@ -13447,9 +14571,9 @@ var databaseConfigRegistration = {
 };
 
 // src/export_registrations/metrics-config.registration.ts
-var import_core44 = require("@axiom-lattice/core");
+var import_core45 = require("@axiom-lattice/core");
 function getStore5() {
-  return (0, import_core44.getStoreLattice)("default", "metrics").store;
+  return (0, import_core45.getStoreLattice)("default", "metrics").store;
 }
 var metricsConfigRegistration = {
   entityType: "metrics_config",
@@ -13529,9 +14653,9 @@ var metricsConfigRegistration = {
 };
 
 // src/export_registrations/mcp-config.registration.ts
-var import_core45 = require("@axiom-lattice/core");
+var import_core46 = require("@axiom-lattice/core");
 function getStore6() {
-  return (0, import_core45.getStoreLattice)("default", "mcp").store;
+  return (0, import_core46.getStoreLattice)("default", "mcp").store;
 }
 var mcpConfigRegistration = {
   entityType: "mcp_config",
@@ -13614,9 +14738,9 @@ var mcpConfigRegistration = {
 };
 
 // src/export_registrations/connection.registration.ts
-var import_core46 = require("@axiom-lattice/core");
+var import_core47 = require("@axiom-lattice/core");
 function getStore7() {
-  return (0, import_core46.getStoreLattice)("default", "connection").store;
+  return (0, import_core47.getStoreLattice)("default", "connection").store;
 }
 async function listAllConnections(tenantId) {
   const store2 = getStore7();
@@ -13698,9 +14822,9 @@ var connectionRegistration = {
 };
 
 // src/export_registrations/collection.registration.ts
-var import_core47 = require("@axiom-lattice/core");
+var import_core48 = require("@axiom-lattice/core");
 function getStore8() {
-  return (0, import_core47.getStoreLattice)("default", "collection").store;
+  return (0, import_core48.getStoreLattice)("default", "collection").store;
 }
 var collectionRegistration = {
   entityType: "collection",
@@ -13771,11 +14895,11 @@ var collectionRegistration = {
 };
 
 // src/export_registrations/channel-installation.registration.ts
-var import_core48 = require("@axiom-lattice/core");
+var import_core49 = require("@axiom-lattice/core");
 var import_crypto10 = require("crypto");
 var UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
 function getStore9() {
-  return (0, import_core48.getStoreLattice)("default", "channelInstallation").store;
+  return (0, import_core49.getStoreLattice)("default", "channelInstallation").store;
 }
 var channelInstallationRegistration = {
   entityType: "channel_installation",
@@ -13874,9 +14998,9 @@ var channelInstallationRegistration = {
 };
 
 // src/export_registrations/menu.registration.ts
-var import_core49 = require("@axiom-lattice/core");
+var import_core50 = require("@axiom-lattice/core");
 function getStore10() {
-  return (0, import_core49.getStoreLattice)("default", "menu").store;
+  return (0, import_core50.getStoreLattice)("default", "menu").store;
 }
 var menuRegistration = {
   entityType: "menu",
@@ -13954,9 +15078,9 @@ var menuRegistration = {
 };
 
 // src/export_registrations/eval.registration.ts
-var import_core50 = require("@axiom-lattice/core");
+var import_core51 = require("@axiom-lattice/core");
 function getStore11() {
-  return (0, import_core50.getStoreLattice)("default", "eval").store;
+  return (0, import_core51.getStoreLattice)("default", "eval").store;
 }
 var evalRegistration = {
   entityType: "eval",
@@ -14282,7 +15406,7 @@ var evalRegistration = {
 
 // src/export_registrations/index.ts
 function registerAllBuiltinEntities() {
-  const registry = import_core51.ExportableEntityRegistry.getInstance();
+  const registry = import_core52.ExportableEntityRegistry.getInstance();
   registry.register(skillRegistration);
   registry.register(agentRegistration);
   registry.register(databaseConfigRegistration);
@@ -14296,7 +15420,7 @@ function registerAllBuiltinEntities() {
 }
 
 // src/router/MessageRouter.ts
-var import_core52 = require("@axiom-lattice/core");
+var import_core53 = require("@axiom-lattice/core");
 var import_crypto11 = require("crypto");
 var BindingNotFoundError = class extends Error {
   constructor(message) {
@@ -14466,7 +15590,7 @@ var MessageRouter = class {
             channel: message.channel,
             adapterChannel: adapter.channel
           }, "Thread resolved by adapter strategy");
-          const threadStore = (0, import_core52.getStoreLattice)("default", "thread").store;
+          const threadStore = (0, import_core53.getStoreLattice)("default", "thread").store;
           try {
             await threadStore.createThread(
               tenantId,
@@ -14503,7 +15627,7 @@ var MessageRouter = class {
           }
         }
         if (!threadId) {
-          const threadStore = (0, import_core52.getStoreLattice)("default", "thread").store;
+          const threadStore = (0, import_core53.getStoreLattice)("default", "thread").store;
           const newThreadId = (0, import_crypto11.randomUUID)();
           console.log({
             event: "dispatch:thread:create",
@@ -14543,7 +15667,7 @@ var MessageRouter = class {
           senderId: message.sender.id,
           contentLength: message.content.text.length
         }, "Dispatching to agent");
-        const agent = import_core52.agentInstanceManager.getAgent({
+        const agent = import_core53.agentInstanceManager.getAgent({
           tenant_id: tenantId,
           assistant_id: agentId,
           thread_id: threadId,
@@ -14783,7 +15907,7 @@ function createAuditLoggerMiddleware() {
 }
 
 // src/index.ts
-var import_core57 = require("@axiom-lattice/core");
+var import_core58 = require("@axiom-lattice/core");
 
 // src/swagger.ts
 var import_swagger = __toESM(require("@fastify/swagger"));
@@ -14848,7 +15972,7 @@ var configureSwagger = async (app2, customSwaggerConfig, customSwaggerUiConfig)
 };
 
 // src/services/agent_task_consumer.ts
-var import_core53 = require("@axiom-lattice/core");
+var import_core54 = require("@axiom-lattice/core");
 var handleAgentTask = async (taskRequest, retryCount = 0) => {
   const {
     assistant_id,
@@ -14866,17 +15990,17 @@ var handleAgentTask = async (taskRequest, retryCount = 0) => {
     console.log(
       `\u5F00\u59CB\u5904\u7406\u4EFB\u52A1 [assistant_id: ${assistant_id}, thread_id: ${thread_id}]`
     );
-    const agent = import_core53.agentInstanceManager.getAgent({ assistant_id, thread_id, tenant_id, workspace_id: runConfig?.workspaceId, project_id: runConfig?.projectId, custom_run_config: runConfig });
-    await agent.addMessage({ input, command, custom_run_config: runConfig }, import_core53.QueueMode.STEER);
+    const agent = import_core54.agentInstanceManager.getAgent({ assistant_id, thread_id, tenant_id, workspace_id: runConfig?.workspaceId, project_id: runConfig?.projectId, custom_run_config: runConfig });
+    await agent.addMessage({ input, command, custom_run_config: runConfig }, import_core54.QueueMode.STEER);
     if (callback_event) {
       agent.subscribeOnce("message:completed", (evt) => {
-        import_core53.eventBus.publish(callback_event, {
+        import_core54.eventBus.publish(callback_event, {
           success: true,
           state: evt.state
         });
         if (main_thread_id && main_tenant_id) {
           try {
-            const mainAgent = import_core53.agentInstanceManager.getAgent({
+            const mainAgent = import_core54.agentInstanceManager.getAgent({
               assistant_id: main_assistant_id ?? assistant_id,
               thread_id: main_thread_id,
               tenant_id: main_tenant_id,
@@ -14906,7 +16030,7 @@ ${summary}`
         }
       });
       agent.subscribeOnce("message:interrupted", (evt) => {
-        import_core53.eventBus.publish(callback_event, {
+        import_core54.eventBus.publish(callback_event, {
           success: true,
           state: evt.state
         });
@@ -14929,7 +16053,7 @@ ${summary}`
       return handleAgentTask(taskRequest, nextRetryCount);
     }
     if (callback_event) {
-      import_core53.eventBus.publish(callback_event, {
+      import_core54.eventBus.publish(callback_event, {
         success: false,
         error: error instanceof Error ? error.message : String(error)
       });
@@ -14966,7 +16090,7 @@ var _AgentTaskConsumer = class _AgentTaskConsumer {
    * 初始化事件监听和队列轮询
    */
   initialize() {
-    import_core53.eventBus.subscribe(import_core53.AGENT_TASK_EVENT, this.trigger_agent_task.bind(this));
+    import_core54.eventBus.subscribe(import_core54.AGENT_TASK_EVENT, this.trigger_agent_task.bind(this));
     this.startPollingQueue();
     console.log("Agent\u4EFB\u52A1\u6D88\u8D39\u8005\u5DF2\u542F\u52A8\u5E76\u76D1\u542C\u4EFB\u52A1\u4E8B\u4EF6\u548C\u961F\u5217");
   }
@@ -15085,7 +16209,7 @@ var _AgentTaskConsumer = class _AgentTaskConsumer {
     handleAgentTask(taskRequest).catch((error) => {
       console.error("\u5904\u7406Agent\u4EFB\u52A1\u65F6\u53D1\u751F\u672A\u6355\u83B7\u7684\u9519\u8BEF:", error);
       if (taskRequest.callback_event) {
-        import_core53.eventBus.publish(taskRequest.callback_event, {
+        import_core54.eventBus.publish(taskRequest.callback_event, {
           success: false,
           error: error instanceof Error ? error.message : String(error)
         });
@@ -15100,8 +16224,8 @@ _AgentTaskConsumer.agent_run_endpoint = "http://localhost:4001/api/runs";
 var AgentTaskConsumer = _AgentTaskConsumer;
 
 // src/index.ts
-var import_core58 = require("@axiom-lattice/core");
-var import_protocols7 = require("@axiom-lattice/protocols");
+var import_core59 = require("@axiom-lattice/core");
+var import_protocols9 = require("@axiom-lattice/protocols");
 var import_meta = {};
 process.on("unhandledRejection", (reason, promise) => {
   console.error("\u672A\u5904\u7406\u7684Promise\u62D2\u7EDD:", reason);
@@ -15109,18 +16233,18 @@ process.on("unhandledRejection", (reason, promise) => {
 var DEFAULT_LOGGER_CONFIG = {
   name: "default",
   description: "Default logger for lattice-gateway service",
-  type: import_protocols7.LoggerType.PINO,
+  type: import_protocols9.LoggerType.PINO,
   serviceName: "lattice/gateway",
   loggerName: "lattice/gateway"
 };
 var loggerLattice = initializeLogger(DEFAULT_LOGGER_CONFIG);
 var logger5 = loggerLattice.client;
 function initializeLogger(config) {
-  if (import_core58.loggerLatticeManager.hasLattice("default")) {
-    import_core58.loggerLatticeManager.removeLattice("default");
+  if (import_core59.loggerLatticeManager.hasLattice("default")) {
+    import_core59.loggerLatticeManager.removeLattice("default");
   }
-  (0, import_core58.registerLoggerLattice)("default", config);
-  return (0, import_core58.getLoggerLattice)("default");
+  (0, import_core59.registerLoggerLattice)("default", config);
+  return (0, import_core59.getLoggerLattice)("default");
 }
 var app = (0, import_fastify.default)({
   logger: false,
@@ -15213,7 +16337,7 @@ app.setErrorHandler((error, request, reply) => {
 });
 function getConfiguredSandboxProvider() {
   const sandboxProviderType = process.env.SANDBOX_PROVIDER_TYPE || "microsandbox-remote";
-  return (0, import_core58.createSandboxProvider)({
+  return (0, import_core59.createSandboxProvider)({
     type: sandboxProviderType,
     remoteBaseURL: process.env.SANDBOX_BASE_URL,
     microsandboxServiceBaseURL: process.env.MICROSANDBOX_SERVICE_BASE_URL,
@@ -15229,7 +16353,7 @@ function getConfiguredSandboxProvider() {
 }
 async function restoreMcpConnections() {
   try {
-    const storeLattice = (0, import_core58.getStoreLattice)("default", "mcp");
+    const storeLattice = (0, import_core59.getStoreLattice)("default", "mcp");
     const store2 = storeLattice.store;
     if (!store2) {
       logger5.info("MCP store not configured, skipping connection restoration");
@@ -15243,15 +16367,15 @@ async function restoreMcpConnections() {
     for (const config of connectedConfigs) {
       try {
         const connection = convertToConnection2(config.config);
-        import_core58.mcpManager.addServer(config.key, connection);
+        import_core59.mcpManager.addServer(config.key, connection);
       } catch (err) {
         logger5.warn(`Failed to prepare MCP server "${config.key}" for restoration`, { error: err });
       }
     }
-    await import_core58.mcpManager.connect();
+    await import_core59.mcpManager.connect();
     for (const config of connectedConfigs) {
       try {
-        await import_core58.mcpManager.registerToolsToToolLattice(config.key, config.selectedTools);
+        await import_core59.mcpManager.registerToolsToToolLattice(config.key, config.selectedTools);
         logger5.info(`MCP server "${config.key}" restored with ${config.selectedTools.length} tools`);
       } catch (err) {
         logger5.warn(`Failed to register tools for MCP server "${config.key}"`, { error: err });
@@ -15284,7 +16408,7 @@ var start = async (config) => {
       const { getStoreLattice: getStore12 } = await import("@axiom-lattice/core");
       const bindingStore = getStore12("default", "channelBinding").store;
       const installationStore = getStore12("default", "channelInstallation").store;
-      (0, import_core57.setBindingRegistry)(bindingStore);
+      (0, import_core58.setBindingRegistry)(bindingStore);
       const router = new MessageRouter({
         middlewares: [
           createDeduplicationMiddleware(),
@@ -15301,10 +16425,10 @@ var start = async (config) => {
         error: err instanceof Error ? err.message : String(err)
       });
     }
-    (0, import_core57.setEvalRunService)(evalRunner);
+    (0, import_core58.setEvalRunService)(evalRunner);
     try {
-      const menuStore = (0, import_core58.getStoreLattice)("default", "menu").store;
-      (0, import_core57.setMenuRegistry)(menuStore);
+      const menuStore = (0, import_core59.getStoreLattice)("default", "menu").store;
+      (0, import_core58.setMenuRegistry)(menuStore);
       logger5.info("Menu registry initialized");
     } catch {
     }
@@ -15317,10 +16441,10 @@ var start = async (config) => {
       const { A2AAuthService: A2AAuthService2, parseEnvKeys: parseEnvKeys2 } = await Promise.resolve().then(() => (init_A2AAuthService(), A2AAuthService_exports));
       const { registerA2AStandardRoutes: registerA2AStandardRoutes2 } = await Promise.resolve().then(() => (init_a2a_standard(), a2a_standard_exports));
       const a2a = await Promise.resolve().then(() => (init_a2a(), a2a_exports));
-      const a2aKeyStore = (0, import_core58.getStoreLattice)("default", "a2aApiKey").store;
-      const assistantStore = (0, import_core58.getStoreLattice)("default", "assistant").store;
-      const projectStore = (0, import_core58.getStoreLattice)("default", "project").store;
-      const taskStore = (0, import_core58.getStoreLattice)("default", "task").store;
+      const a2aKeyStore = (0, import_core59.getStoreLattice)("default", "a2aApiKey").store;
+      const assistantStore = (0, import_core59.getStoreLattice)("default", "assistant").store;
+      const projectStore = (0, import_core59.getStoreLattice)("default", "project").store;
+      const taskStore = (0, import_core59.getStoreLattice)("default", "task").store;
       const authService = new A2AAuthService2({
         keyStore: a2aKeyStore,
         assistantStore,
@@ -15344,17 +16468,17 @@ var start = async (config) => {
         error: err instanceof Error ? err.message : String(err)
       });
     }
-    if (!import_core58.sandboxLatticeManager.hasLattice("default")) {
-      import_core58.sandboxLatticeManager.registerLattice("default", getConfiguredSandboxProvider());
+    if (!import_core59.sandboxLatticeManager.hasLattice("default")) {
+      import_core59.sandboxLatticeManager.registerLattice("default", getConfiguredSandboxProvider());
       logger5.info("Registered sandbox manager from env configuration");
     }
     try {
       const { ResourceController: ResourceController2 } = await Promise.resolve().then(() => (init_resources(), resources_exports));
-      const sharedResourceStore = (0, import_core58.getStoreLattice)("default", "sharedResource").store;
-      const cache = new import_core58.TokenCache();
+      const sharedResourceStore = (0, import_core59.getStoreLattice)("default", "sharedResource").store;
+      const cache = new import_core59.TokenCache();
       const resourceController = new ResourceController2({
         store: sharedResourceStore,
-        sandboxManager: import_core58.sandboxLatticeManager,
+        sandboxManager: import_core59.sandboxLatticeManager,
         cache,
         logger: logger5
       });
@@ -15390,7 +16514,7 @@ var start = async (config) => {
       }
     }
     if (process.env.AXIOM_RESTORE_PENDING_ON_STARTUP === "true") {
-      import_core58.agentInstanceManager.restore().then((stats) => {
+      import_core59.agentInstanceManager.restore().then((stats) => {
         logger5.info(`Agent recovery complete: ${stats.restored} threads restored, ${stats.errors} errors`);
       }).catch((error) => {
         logger5.error("Agent recovery failed", { error });