@axiom-lattice/gateway 4.0.0 → 4.0.2

package/dist/index.mjs

@@ -10,11 +10,12 @@ import {
   PathOutsideRootError,
   ProjectFileValidationError,
   filesystemRootDirectory,
+  formatFileRefsSection,
   isBinaryContentType,
   isPathWithinRoot,
   resolvePathWithinRoot,
   saveProjectFile
-} from "./chunk-IDOEIBCF.mjs";
+} from "./chunk-J4BK77PA.mjs";
 import {
   getContentTypeFromFilename,
   getFilenameFromPath
@@ -827,6 +828,90 @@ import {
   agentInstanceManager as agentInstanceManager2
 } from "@axiom-lattice/core";
 import { MessageChunkTypes } from "@axiom-lattice/protocols";
+
+// src/services/agents/ScopedAgentExecution.ts
+async function executeScopedAgentMessage(agent, request, stopTypes, options) {
+  const { messageId } = options === void 0 ? await agent.addMessage(request) : await agent.addMessage(request, options.queueMode);
+  return { messageId, stream: agent.chunkStream(messageId, stopTypes) };
+}
+
+// src/services/streaming/pipeAsyncIterableToSse.ts
+async function pipeAsyncIterableToSse(raw, stream, options = {}) {
+  const iterator = stream[Symbol.asyncIterator]();
+  const project = options.project ?? ((value) => [value]);
+  const serialize = options.serialize ?? ((event) => `data: ${JSON.stringify(event)}
+
+`);
+  const closeSources = options.closeSource && options.closeSource !== raw ? [raw, options.closeSource] : [raw];
+  let closed = raw.destroyed || raw.writableEnded;
+  let returned = false;
+  let resolveClosed;
+  const closedPromise = new Promise((resolve2) => {
+    resolveClosed = resolve2;
+  });
+  const returnConsumer = () => {
+    if (returned) return;
+    returned = true;
+    void Promise.resolve(iterator.return?.()).catch(() => void 0);
+  };
+  const onClose = () => {
+    closed = true;
+    returnConsumer();
+    resolveClosed?.();
+  };
+  for (const source of closeSources) {
+    source.on("close", onClose);
+    source.on("error", onClose);
+  }
+  try {
+    while (!closed) {
+      const next = await Promise.race([
+        iterator.next().then((result) => ({ kind: "next", result })),
+        closedPromise.then(() => ({ kind: "closed" }))
+      ]);
+      if (next.kind === "closed" || next.result.done) break;
+      for (const event of project(next.result.value)) {
+        if (!await writeSse(raw, serialize(event), closedPromise)) {
+          closed = true;
+          returnConsumer();
+          break;
+        }
+      }
+    }
+  } catch (error) {
+    if (!options.onError) throw error;
+    if (!closed && !raw.destroyed && !raw.writableEnded) {
+      for (const event of options.onError(error)) {
+        if (!await writeSse(raw, serialize(event), closedPromise)) break;
+      }
+    }
+    returnConsumer();
+  } finally {
+    for (const source of closeSources) {
+      source.removeListener("close", onClose);
+      source.removeListener("error", onClose);
+    }
+    if (!closed && !raw.destroyed && !raw.writableEnded) raw.end();
+  }
+}
+async function writeSse(raw, value, closed) {
+  if (raw.destroyed || raw.writableEnded) return false;
+  if (raw.write(value)) return true;
+  return new Promise((resolve2) => {
+    let settled = false;
+    const onDrain = () => finish(!raw.destroyed && !raw.writableEnded);
+    const finish = (writable) => {
+      if (settled) return;
+      settled = true;
+      raw.removeListener("drain", onDrain);
+      resolve2(writable);
+    };
+    raw.once("drain", onDrain);
+    void closed.then(() => finish(false));
+  });
+}
+
+// src/controllers/run.ts
 function getUserId2(request) {
   const authUser = request.user;
   if (authUser?.id) return authUser.id;
@@ -893,20 +978,22 @@ var createRun = async (request, reply) => {
       });
       try {
         const messageInput = message_id ? { ...input, id: message_id } : input;
-        const result = await agent.addMessage({
+        const result = await executeScopedAgentMessage(agent, {
           input: messageInput,
           command,
           custom_run_config: mergedConfig
-        }, mode);
-        const stream = agent.chunkStream(result.messageId, [MessageChunkTypes.MESSAGE_COMPLETED, MessageChunkTypes.INTERRUPT, MessageChunkTypes.MESSAGE_FAILED]);
-        for await (const chunk of stream) {
-          const success = reply.raw.write(`data: ${JSON.stringify(chunk)}
-
-`);
-          if (!success) {
-            await new Promise((resolve2) => reply.raw.once("drain", resolve2));
-          }
-        }
+        }, [MessageChunkTypes.MESSAGE_COMPLETED, MessageChunkTypes.INTERRUPT, MessageChunkTypes.MESSAGE_FAILED], {
+          queueMode: mode
+        });
+        await pipeAsyncIterableToSse(reply.raw, result.stream, {
+          onError: (error) => [{
+            type: "error",
+            data: {
+              id: v4(),
+              content: error instanceof Error ? error.message : "Stream processing error"
+            }
+          }]
+        });
       } catch (error) {
         const errorEvent = {
           type: "error",
@@ -919,7 +1006,7 @@ var createRun = async (request, reply) => {
 
 `);
       } finally {
-        reply.raw.end();
+        if (!reply.raw.writableEnded && !reply.raw.destroyed) reply.raw.end();
       }
     } else {
       const { message: msg, ...restInputNonStream } = input;
@@ -968,17 +1055,16 @@ var resumeStream = async (request, reply) => {
         workspace_id,
         project_id
       });
-      const stream = agent.chunkStream(message_id, []);
-      let closed = false;
-      request.raw.on("close", () => {
-        closed = true;
+      await pipeAsyncIterableToSse(reply.raw, agent.chunkStream(message_id, []), {
+        closeSource: request.raw,
+        onError: (error) => [{
+          type: "error",
+          data: {
+            id: v4(),
+            content: error instanceof Error ? error.message : "Resume stream processing error"
+          }
+        }]
       });
-      for await (const chunk of stream) {
-        if (closed || reply.raw.destroyed) break;
-        reply.raw.write(`data: ${JSON.stringify(chunk)}
-
-`);
-      }
     } catch (error) {
       const errorEvent = {
         type: "error",
@@ -991,7 +1077,7 @@ var resumeStream = async (request, reply) => {
 
 `);
     } finally {
-      reply.raw.end();
+      if (!reply.raw.writableEnded && !reply.raw.destroyed) reply.raw.end();
     }
   } catch (error) {
     reply.status(500).send({
@@ -3358,7 +3444,7 @@ async function abortWorkflowRun(request, reply) {
 }
 
 // src/controllers/personal-assistant.ts
-import { getStoreLattice as getStoreLattice5, PersonalAssistantConfig } from "@axiom-lattice/core";
+import { eventBus as eventBus2, getStoreLattice as getStoreLattice5, PersonalAssistantConfig } from "@axiom-lattice/core";
 import { randomUUID as randomUUID3 } from "crypto";
 function getWorkspaceId2(request) {
   return request.headers["x-workspace-id"] || "default";
@@ -3455,6 +3541,7 @@ async function deletePersonalAssistant(request, reply) {
   if (!deleted) {
     return reply.status(500).send({ success: false, message: "Failed to delete personal assistant" });
   }
+  eventBus2.publish("assistant:deleted", { id: assistant.id, tenantId });
   const threadStore = getStoreLattice5("default", "thread").store;
   try {
     const threads = await threadStore.getThreadsByAssistantId(tenantId, assistant.id);
@@ -6908,11 +6995,11 @@ async function createProject(request, reply) {
     }
     const serverCfg = data.targetServerConfig || {};
     const judgeCfg = data.judgeModelConfig || {};
-    const modelKey = judgeCfg.modelKey || "";
-    if (modelKey) {
-      const { modelLatticeManager: modelLatticeManager3 } = await import("@axiom-lattice/core");
-      if (!modelLatticeManager3.hasLattice(modelKey)) {
-        return reply.status(400).send({ success: false, message: `Judge model "${modelKey}" is not registered` });
+    const modelKey2 = judgeCfg.modelKey || "";
+    if (modelKey2) {
+      const { modelLatticeManager: modelLatticeManager4 } = await import("@axiom-lattice/core");
+      if (!modelLatticeManager4.hasLattice(modelKey2)) {
+        return reply.status(400).send({ success: false, message: `Judge model "${modelKey2}" is not registered` });
       }
     }
     const project = await store.createProject(tenantId, id, {
@@ -6920,7 +7007,7 @@ async function createProject(request, reply) {
       description: data.description,
       version: data.version,
       judgeModelConfig: {
-        modelKey,
+        modelKey: modelKey2,
         displayName: judgeCfg.displayName || ""
       },
       targetServerConfig: {
@@ -6957,8 +7044,8 @@ async function listProjects(request, reply) {
     let projects = await store.getProjectsByTenant(tenantId);
     if (projects.length === 0) {
       try {
-        const { modelLatticeManager: modelLatticeManager3 } = await import("@axiom-lattice/core");
-        const models = modelLatticeManager3.getAllLattices();
+        const { modelLatticeManager: modelLatticeManager4 } = await import("@axiom-lattice/core");
+        const models = modelLatticeManager4.getAllLattices();
         const first = models[0];
         const judgeModel = first ? { modelKey: first.key } : {};
         const host = request.hostname || "localhost";
@@ -7024,15 +7111,15 @@ async function updateProject(request, reply) {
     }
     if (body.judgeModelConfig !== void 0) {
       const judgeCfg = body.judgeModelConfig || {};
-      const modelKey = judgeCfg.modelKey || "";
-      if (modelKey) {
-        const { modelLatticeManager: modelLatticeManager3 } = await import("@axiom-lattice/core");
-        if (!modelLatticeManager3.hasLattice(modelKey)) {
-          return reply.status(400).send({ success: false, message: `Judge model "${modelKey}" is not registered` });
+      const modelKey2 = judgeCfg.modelKey || "";
+      if (modelKey2) {
+        const { modelLatticeManager: modelLatticeManager4 } = await import("@axiom-lattice/core");
+        if (!modelLatticeManager4.hasLattice(modelKey2)) {
+          return reply.status(400).send({ success: false, message: `Judge model "${modelKey2}" is not registered` });
         }
       }
       updateData.judgeModelConfig = {
-        modelKey,
+        modelKey: modelKey2,
         displayName: judgeCfg.displayName || ""
       };
     }
@@ -7895,6 +7982,8 @@ function extractUserFromAuthHeader(authHeader, secret) {
 var PUBLIC_ROUTES = ["/api/auth/login", "/api/auth/register", "/health", "/api/stt/models"];
 function bypassesConsoleAuth(request) {
   const path4 = request.url.split("?")[0];
+  const method = request.method;
+  if (method === "GET" && /^\/api\/web-apps\/[^/]+\/runtime\/bootstrap$/.test(path4) || (method === "GET" || method === "POST") && /^\/api\/web-apps\/[^/]+\/runtime\/threads$/.test(path4) || (method === "PATCH" || method === "DELETE") && /^\/api\/web-apps\/[^/]+\/runtime\/threads\/[^/]+$/.test(path4) || method === "GET" && /^\/api\/web-apps\/[^/]+\/runtime\/threads\/[^/]+\/messages$/.test(path4) || method === "POST" && /^\/api\/web-apps\/[^/]+\/runtime\/threads\/[^/]+\/(messages\/stream|abort|attachments)$/.test(path4) || method === "POST" && /^\/api\/web-apps\/[^/]+\/runtime\/threads\/[^/]+\/interrupts\/[^/]+\/resume$/.test(path4)) return true;
   if (request.method === "GET" && /^\/api\/a2a\/agents\/[^/]+\/\.well-known\/agent-card\.json$/.test(path4)) {
     return true;
   }
@@ -7902,13 +7991,13 @@ function bypassesConsoleAuth(request) {
 }
 function registerConsoleAuthHook(app2, options) {
   app2.addHook("preHandler", async (request, reply) => {
-    if (bypassesConsoleAuth(request)) return;
     const secret = options.tokenSecret ?? resolveConsoleTokenSecret(options.authRequired);
     const user = extractUserFromAuthHeader(request.headers.authorization, secret);
     if (user) {
       request.user = user;
-      return;
     }
+    if (bypassesConsoleAuth(request)) return;
+    if (user) return;
     if (!options.authRequired || request.method === "OPTIONS") return;
     if (PUBLIC_ROUTES.some((route) => request.url === route)) return;
     if (request.url.startsWith("/s/")) return;
@@ -8305,8 +8394,8 @@ function snapshotPlainObject(value) {
   }
 }
 async function getInstallationStore() {
-  const { getStoreLattice: getStoreLattice27 } = await import("@axiom-lattice/core");
-  const store = getStoreLattice27("default", "channelInstallation").store;
+  const { getStoreLattice: getStoreLattice28 } = await import("@axiom-lattice/core");
+  const store = getStoreLattice28("default", "channelInstallation").store;
   if (store) return store;
   const { PostgreSQLChannelInstallationStore } = await import("@axiom-lattice/pg-stores");
   const databaseUrl = process.env.DATABASE_URL;
@@ -9002,7 +9091,7 @@ var registerSTTRoutes = (app2) => {
       }
     },
     async (request, reply) => {
-      const modelKey = request.query.model || "default";
+      const modelKey2 = request.query.model || "default";
       const data = await request.file({
         limits: { fileSize: MAX_AUDIO_FILE_SIZE }
       });
@@ -9020,9 +9109,9 @@ var registerSTTRoutes = (app2) => {
       try {
         let client;
         try {
-          client = getSTTClient(modelKey);
+          client = getSTTClient(modelKey2);
         } catch {
-          return reply.status(404).send({ error: `STT model "${modelKey}" not found` });
+          return reply.status(404).send({ error: `STT model "${modelKey2}" not found` });
         }
         const result = await client.transcribe(buffer, format);
         return reply.send({
@@ -9300,6 +9389,8 @@ function registerA2ATestConnectionRoute(app2) {
 
 // src/controllers/tasks.ts
 import {
+  agentLatticeManager as agentLatticeManager4,
+  ensureBuiltinAgentsForTenant,
   getStoreLattice as getStoreLattice15
 } from "@axiom-lattice/core";
 var AGENT_CREATE_STATUSES = /* @__PURE__ */ new Set(["pending"]);
@@ -9437,8 +9528,10 @@ async function createTask(request, reply) {
     const ownerType = body.ownerType || "user";
     const ownerId = body.ownerId || userId;
     if (ownerType === "agent") {
+      ensureBuiltinAgentsForTenant(tenantId);
       const assistant = await getAssistantStore2().getAssistantById(tenantId, ownerId);
-      if (!assistant || assistant.tenantId !== tenantId) {
+      const configuredAgent = agentLatticeManager4.getAgentConfigWithTenant(tenantId, ownerId);
+      if ((!assistant || assistant.tenantId !== tenantId) && !configuredAgent) {
         return reply.status(404).send({
           success: false,
           code: "AGENT_OWNER_NOT_FOUND",
@@ -9586,8 +9679,1034 @@ function registerTaskRoutes(app2) {
   app2.get("/api/tasks/:id/work-items", listTaskWorkItems);
 }
 
+// src/routes/index.ts
+import { agentInstanceManager as agentInstanceManager6, agentLatticeManager as agentLatticeManager5, getStoreLattice as getStoreLattice16, modelLatticeManager as modelLatticeManager3 } from "@axiom-lattice/core";
+
+// src/services/agent-web-app/AgentWebAppService.ts
+function createConfiguredAgentResolver(registry) {
+  return {
+    async exists(tenantId, assistantId) {
+      await registry.hydrate(tenantId);
+      return registry.has(tenantId, assistantId);
+    }
+  };
+}
+var AgentWebAppError = class extends Error {
+  constructor(code, statusCode, message) {
+    super(message);
+    this.code = code;
+    this.statusCode = statusCode;
+    this.name = "AgentWebAppError";
+  }
+};
+var AgentWebAppService = class {
+  constructor(deps) {
+    this.deps = deps;
+  }
+  async create(context, input) {
+    await this.validateAssistant(context, input.assistantId);
+    const normalized = await this.validateConfig(context.tenantId, input);
+    return this.deps.webAppStore.create(context.tenantId, normalized);
+  }
+  async list(context, assistantId) {
+    const records = await this.deps.webAppStore.list(context.tenantId, assistantId);
+    const visible = [];
+    for (const record of records) {
+      if (await this.canAccessAssistant(context, record.assistantId)) visible.push(record);
+    }
+    return visible;
+  }
+  async get(context, webAppId) {
+    return this.requireAuthorizedWebApp(context, webAppId);
+  }
+  async update(context, webAppId, patch) {
+    const current = await this.requireAuthorizedWebApp(context, webAppId);
+    const effective = {
+      assistantId: current.assistantId,
+      name: patch.name ?? current.name,
+      description: Object.prototype.hasOwnProperty.call(patch, "description") ? patch.description : current.description,
+      integration: current.integration,
+      scope: { ...current.scope, ...patch.scope },
+      features: { ...current.features, ...patch.features },
+      appearance: { ...current.appearance, ...patch.appearance }
+    };
+    await this.validateAssistant(context, current.assistantId);
+    const validated = await this.validateConfig(context.tenantId, effective);
+    const update = {
+      ...patch.name !== void 0 ? { name: validated.name } : {},
+      ...Object.prototype.hasOwnProperty.call(patch, "description") ? { description: validated.description } : {},
+      ...patch.scope ? { scope: validated.scope } : {},
+      ...patch.features ? { features: validated.features } : {},
+      ...patch.appearance ? { appearance: validated.appearance } : {}
+    };
+    return this.writeSnapshot(context, current, update);
+  }
+  async enable(context, webAppId) {
+    const current = await this.requireAuthorizedWebApp(context, webAppId);
+    await this.validateConfig(context.tenantId, current);
+    return this.writeSnapshot(context, current, { status: "active" });
+  }
+  async disable(context, webAppId) {
+    const current = await this.requireAuthorizedWebApp(context, webAppId);
+    return this.writeSnapshot(context, current, { status: "disabled" });
+  }
+  async delete(context, webAppId) {
+    await this.requireAuthorizedWebApp(context, webAppId);
+    if (!await this.deps.webAppStore.delete(context.tenantId, webAppId)) this.notFound();
+  }
+  async validateAssistant(context, assistantId) {
+    const assistant = await this.deps.assistantStore.getAssistantById(context.tenantId, assistantId);
+    if (assistant) {
+      if (assistant.ownerUserId && assistant.ownerUserId !== context.userId) {
+        throw new AgentWebAppError("ASSISTANT_FORBIDDEN", 403, "Assistant is not available to this user");
+      }
+      return;
+    }
+    if (await this.deps.configuredAgentResolver.exists(context.tenantId, assistantId)) return;
+    throw new AgentWebAppError("ASSISTANT_NOT_FOUND", 404, "Assistant not found");
+  }
+  async validateConfig(tenantId, input) {
+    const allowedProjectIds = [...new Set(input.scope.allowedProjectIds)];
+    if (!allowedProjectIds.length || !allowedProjectIds.includes(input.scope.defaultProjectId)) {
+      throw new AgentWebAppError("PROJECT_SCOPE_INVALID", 400, "Default project must be in the project allowlist");
+    }
+    if (!input.features.projectSelector && allowedProjectIds.length !== 1) {
+      throw new AgentWebAppError("PROJECT_SCOPE_INVALID", 400, "Disabled project selection requires exactly one project");
+    }
+    for (const projectId of allowedProjectIds) {
+      if (!await this.deps.projectStore.getProjectById(tenantId, projectId)) {
+        throw new AgentWebAppError("PROJECT_NOT_FOUND", 404, "Project not found");
+      }
+    }
+    const scope = this.validateModels(input.scope, input.features.modelSelector);
+    return { ...input, scope: { ...scope, allowedProjectIds } };
+  }
+  validateModels(scope, modelSelector) {
+    const allowedModelKeys = scope.allowedModelKeys ? [...new Set(scope.allowedModelKeys)] : void 0;
+    if (!allowedModelKeys?.length) {
+      if (scope.defaultModelKey || modelSelector) {
+        throw new AgentWebAppError("MODEL_SCOPE_INVALID", 400, "Agent-default models cannot enable model selection or set a default");
+      }
+      return { ...scope, defaultModelKey: void 0, allowedModelKeys: void 0 };
+    }
+    if (!modelSelector && allowedModelKeys.length > 1) {
+      throw new AgentWebAppError("MODEL_SCOPE_INVALID", 400, "Disabled model selection allows at most one model");
+    }
+    if (scope.defaultModelKey && !allowedModelKeys.includes(scope.defaultModelKey)) {
+      throw new AgentWebAppError("MODEL_SCOPE_INVALID", 400, "Default model must be in the model allowlist");
+    }
+    for (const key of allowedModelKeys) {
+      if (!this.deps.modelRegistry.has(key)) {
+        throw new AgentWebAppError("MODEL_NOT_FOUND", 400, "Configured model is not registered");
+      }
+    }
+    return { ...scope, allowedModelKeys };
+  }
+  async requireWebApp(tenantId, webAppId) {
+    return await this.deps.webAppStore.getById(tenantId, webAppId) ?? this.notFound();
+  }
+  async requireAuthorizedWebApp(context, webAppId) {
+    const webApp = await this.requireWebApp(context.tenantId, webAppId);
+    if (!await this.canAccessAssistant(context, webApp.assistantId)) this.notFound();
+    return webApp;
+  }
+  async canAccessAssistant(context, assistantId) {
+    const assistant = await this.deps.assistantStore.getAssistantById(context.tenantId, assistantId);
+    if (assistant) return !assistant.ownerUserId || assistant.ownerUserId === context.userId;
+    return this.deps.configuredAgentResolver.exists(context.tenantId, assistantId);
+  }
+  async writeSnapshot(context, current, patch) {
+    const updated = await this.deps.webAppStore.update(
+      context.tenantId,
+      current.id,
+      patch,
+      { expectedUpdatedAt: current.updatedAt }
+    );
+    if (updated) return updated;
+    await this.requireAuthorizedWebApp(context, current.id);
+    throw new AgentWebAppError("WEB_APP_CONFLICT", 409, "Agent Web App was modified concurrently");
+  }
+  notFound() {
+    throw new AgentWebAppError("WEB_APP_NOT_FOUND", 404, "Agent Web App not found");
+  }
+};
+
+// src/routes/agent-web-apps.ts
+import { ZodError } from "zod";
+
+// src/schemas/agent-web-app.ts
+import { z as z3 } from "zod";
+var externalId = z3.string().min(1).max(128).regex(/^[A-Za-z0-9._:@-]+$/);
+var modelKey = z3.string().min(1).max(128);
+var agentWebAppScopeSchema = z3.object({
+  defaultProjectId: externalId,
+  allowedProjectIds: z3.array(externalId).min(1).max(100),
+  defaultModelKey: modelKey.optional(),
+  allowedModelKeys: z3.array(modelKey).max(100).optional()
+}).strict();
+var agentWebAppFeaturesSchema = z3.object({
+  projectSelector: z3.boolean(),
+  modelSelector: z3.boolean(),
+  threadManagement: z3.boolean(),
+  attachments: z3.boolean(),
+  hitl: z3.boolean(),
+  genUI: z3.boolean()
+}).strict();
+var agentWebAppAppearanceSchema = z3.object({
+  title: z3.string().max(120).optional(),
+  welcomeMessage: z3.string().max(1e3).optional(),
+  primaryColor: z3.string().regex(/^#[0-9A-Fa-f]{6}$/).optional()
+}).strict();
+var createAgentWebAppSchema = z3.object({
+  assistantId: externalId,
+  name: z3.string().min(1).max(120),
+  description: z3.string().max(1e3).optional(),
+  integration: z3.object({ type: z3.literal("react_sdk") }).strict(),
+  scope: agentWebAppScopeSchema,
+  features: agentWebAppFeaturesSchema,
+  appearance: agentWebAppAppearanceSchema
+}).strict();
+var updateAgentWebAppSchema = z3.object({
+  name: z3.string().min(1).max(120).optional(),
+  description: z3.string().max(1e3).optional(),
+  scope: agentWebAppScopeSchema.partial().strict().optional(),
+  features: agentWebAppFeaturesSchema.partial().strict().optional(),
+  appearance: agentWebAppAppearanceSchema.partial().strict().optional()
+}).strict().refine((value) => Object.keys(value).length > 0, "Patch must not be empty");
+var listAgentWebAppsQuerySchema = z3.object({
+  assistantId: externalId.optional()
+}).strict();
+
+// src/routes/agent-web-apps.ts
+function registerAgentWebAppRoutes(app2, deps) {
+  app2.register(async (routes) => {
+    routes.setErrorHandler((error, _request, reply) => normalizeError(reply, error));
+    registerScopedRoutes(routes, deps.service);
+  });
+}
+function registerScopedRoutes(app2, service2) {
+  app2.post("/api/web-apps", async (request, reply) => handle(reply, async () => ({
+    statusCode: 201,
+    data: await service2.create(requireContext(request), createAgentWebAppSchema.parse(request.body))
+  })));
+  app2.get("/api/web-apps", async (request, reply) => handle(reply, async () => {
+    const context = requireContext(request);
+    const query = listAgentWebAppsQuerySchema.parse(request.query);
+    const records = await service2.list(context, query.assistantId);
+    return { data: { records, total: records.length } };
+  }));
+  app2.get("/api/web-apps/:webAppId", async (request, reply) => handle(reply, async () => ({ data: await service2.get(requireContext(request), request.params.webAppId) })));
+  app2.patch("/api/web-apps/:webAppId", async (request, reply) => handle(reply, async () => ({
+    data: await service2.update(
+      requireContext(request),
+      request.params.webAppId,
+      updateAgentWebAppSchema.parse(request.body)
+    )
+  })));
+  app2.post("/api/web-apps/:webAppId/enable", async (request, reply) => handle(reply, async () => ({ data: await service2.enable(requireContext(request), request.params.webAppId) })));
+  app2.post("/api/web-apps/:webAppId/disable", async (request, reply) => handle(reply, async () => ({ data: await service2.disable(requireContext(request), request.params.webAppId) })));
+  app2.delete("/api/web-apps/:webAppId", async (request, reply) => handle(reply, async () => {
+    await service2.delete(requireContext(request), request.params.webAppId);
+    return { data: { id: request.params.webAppId } };
+  }));
+}
+function requireContext(request) {
+  const user = request.user;
+  const userId = user?.id ?? user?.userId;
+  if (!userId || !user?.tenantId) {
+    throw new AgentWebAppError("UNAUTHORIZED", 401, "Console session required");
+  }
+  return { tenantId: user.tenantId, userId };
+}
+async function handle(reply, operation) {
+  try {
+    const result = await operation();
+    return reply.code(result.statusCode ?? 200).send({ success: true, data: result.data });
+  } catch (error) {
+    if (error instanceof ZodError) {
+      return invalidRequest(reply, 400);
+    }
+    if (error instanceof AgentWebAppError) {
+      return reply.code(error.statusCode).send({
+        success: false,
+        error: { code: error.code, message: error.message, retryable: false }
+      });
+    }
+    throw error;
+  }
+}
+function normalizeError(reply, error) {
+  if (error instanceof AgentWebAppError) {
+    return reply.code(error.statusCode).send({
+      success: false,
+      error: { code: error.code, message: error.message, retryable: false }
+    });
+  }
+  if (error.statusCode && error.statusCode >= 400 && error.statusCode < 500) {
+    return invalidRequest(reply, error.statusCode);
+  }
+  return reply.code(500).send({
+    success: false,
+    error: { code: "INTERNAL_ERROR", message: "Internal server error", retryable: false }
+  });
+}
+function invalidRequest(reply, statusCode) {
+  return reply.code(statusCode).send({
+    success: false,
+    error: { code: "INVALID_REQUEST", message: "Invalid request", retryable: false }
+  });
+}
+
+// src/routes/agent-web-app-runtime.ts
+import { z as z4, ZodError as ZodError2 } from "zod";
+
+// src/services/agent-web-app/AgentWebAppRuntimeService.ts
+import { createHash, randomUUID as randomUUID9 } from "crypto";
+import { MessageChunkTypes as MessageChunkTypes3, parseAgentWebAppGenUIBlock } from "@axiom-lattice/protocols";
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+var AgentWebAppRuntimeError = class extends Error {
+  constructor(code, statusCode, message) {
+    super(message);
+    this.code = code;
+    this.statusCode = statusCode;
+    this.name = "AgentWebAppRuntimeError";
+  }
+};
+var AgentWebAppRuntimeService = class {
+  constructor(deps) {
+    this.deps = deps;
+  }
+  async bootstrap(webAppId, userId, selection) {
+    const runtime = await this.resolveRuntime(webAppId, selection);
+    const assistant = await this.deps.assistantResolver.resolve(
+      runtime.webApp.tenantId,
+      runtime.webApp.assistantId
+    );
+    if (!assistant) this.fail("WEB_APP_DISABLED", 403, "Agent Web App is unavailable");
+    const publicProjectIds = runtime.webApp.features.projectSelector ? runtime.webApp.scope.allowedProjectIds : [runtime.webApp.scope.defaultProjectId];
+    const projects = await Promise.all(publicProjectIds.map(async (id) => {
+      const project = await this.deps.projectStore.getProjectById(runtime.webApp.tenantId, id);
+      if (!project) this.fail("PROJECT_NOT_ALLOWED", 400, "Project is not available");
+      return { id: project.id, name: project.name };
+    }));
+    const defaultModelKey = runtime.webApp.scope.defaultModelKey;
+    if (defaultModelKey && !this.deps.modelRegistry.has(defaultModelKey)) {
+      this.fail("MODEL_NOT_ALLOWED", 400, "Default model is not available");
+    }
+    const configuredPublicModelKeys = runtime.webApp.features.modelSelector ? runtime.webApp.scope.allowedModelKeys ?? [] : defaultModelKey ? [defaultModelKey] : [];
+    const publicModelKeys = [...new Set(configuredPublicModelKeys)].filter((key) => this.deps.modelRegistry.has(key));
+    const models = publicModelKeys.map((key) => ({
+      key,
+      label: this.deps.modelRegistry.label(key)
+    }));
+    const result = {
+      webApp: {
+        id: runtime.webApp.id,
+        name: runtime.webApp.name,
+        description: runtime.webApp.description,
+        assistant,
+        defaultProjectId: runtime.webApp.scope.defaultProjectId,
+        defaultModelKey: runtime.webApp.scope.defaultModelKey,
+        features: runtime.webApp.features,
+        appearance: runtime.webApp.appearance,
+        identityAssurance: "unverified"
+      },
+      projects,
+      models
+    };
+    if (!runtime.webApp.features.threadManagement) {
+      result.thread = await this.resolveImplicitThread(runtime, userId);
+    }
+    return result;
+  }
+  async listThreads(webAppId, userId, selection) {
+    const runtime = await this.resolveRuntime(webAppId, selection);
+    this.requireFeature(runtime.webApp.features.threadManagement);
+    const threads = await this.ownedThreads(runtime, userId);
+    return threads.sort(compareThreads).map(toRuntimeThread);
+  }
+  async createThread(webAppId, userId, input) {
+    const runtime = await this.resolveRuntime(webAppId, input);
+    this.requireFeature(runtime.webApp.features.threadManagement);
+    return this.createOwnedThread(runtime, userId, input.label);
+  }
+  /** Update a thread label; omitted or blank labels preserve the existing label. */
+  async updateThread(webAppId, userId, threadId, input) {
+    const runtime = await this.resolveRuntime(webAppId, input);
+    this.requireFeature(runtime.webApp.features.threadManagement);
+    const thread = await this.requireOwnedThread(runtime, userId, threadId);
+    const label = normalizeLabel(input.label);
+    const updated = await this.deps.threadStore.updateThread(runtime.webApp.tenantId, thread.id, {
+      metadata: this.metadata(runtime, userId, label)
+    });
+    if (!updated) this.threadNotFound();
+    return toRuntimeThread(updated);
+  }
+  async deleteThread(webAppId, userId, threadId, selection) {
+    const runtime = await this.resolveRuntime(webAppId, selection);
+    this.requireFeature(runtime.webApp.features.threadManagement);
+    await this.requireOwnedThread(runtime, userId, threadId);
+    if (!await this.deps.threadStore.deleteThread(runtime.webApp.tenantId, threadId)) this.threadNotFound();
+  }
+  async getMessages(webAppId, userId, threadId, selection) {
+    const runtime = await this.resolveRuntime(webAppId, selection);
+    await this.requireOwnedThread(runtime, userId, threadId);
+    const messages = await this.deps.messageReader.getCurrentMessages({
+      tenantId: runtime.webApp.tenantId,
+      assistantId: runtime.webApp.assistantId,
+      threadId,
+      workspaceId: runtime.project.workspaceId,
+      projectId: runtime.project.id
+    });
+    return messages.flatMap((message) => {
+      if (!isRecord(message) || typeof message.id !== "string" || message.role !== "human" && message.role !== "ai") return [];
+      const content = typeof message.content === "string" ? message.content : runtime.webApp.features.genUI && Array.isArray(message.content) ? message.content.map(parseAgentWebAppGenUIBlock).filter((block) => block !== void 0) : void 0;
+      return [{ id: message.id, role: message.role, ...content && (typeof content === "string" || content.length > 0) ? { content } : {} }];
+    });
+  }
+  async streamMessage(webAppId, userId, threadId, input) {
+    const runtime = await this.resolveOwnedRuntime(webAppId, userId, threadId, input);
+    const refs = this.resolveAttachmentRefs(runtime, userId, threadId, input.attachmentRefs ?? []);
+    const agent = this.resolveAgent(runtime, threadId);
+    const content = refs.length ? `${input.content}
+
+${formatFileRefsSection(refs)}` : input.content;
+    const execution = await this.execute(agent, runtime, { input: { message: content } });
+    return { ...execution, allowInterrupts: runtime.webApp.features.hitl, allowGenUI: runtime.webApp.features.genUI };
+  }
+  async abort(webAppId, userId, threadId, selection) {
+    const { agent } = await this.resolveOwnedAgent(webAppId, userId, threadId, selection);
+    await agent.abort();
+  }
+  async uploadAttachment(webAppId, userId, threadId, selection, file) {
+    const runtime = await this.resolveOwnedRuntime(webAppId, userId, threadId, selection);
+    this.requireNamedFeature(runtime.webApp.features.attachments, "Attachments are disabled");
+    if (!this.deps.saveProjectFile || !this.deps.attachmentRefs) this.fail("INTERNAL_ERROR", 500, "Attachment service is unavailable");
+    const userDigest = createHash("sha256").update(userId, "utf8").digest("hex");
+    const contentDigest = createHash("sha256").update(file.bytes).digest("hex");
+    const displayName = file.name;
+    const physicalName = `${randomUUID9()}-${sanitizePhysicalFilename(file.name)}`;
+    const saved = await this.deps.saveProjectFile({
+      tenantId: runtime.webApp.tenantId,
+      workspaceId: runtime.project.workspaceId,
+      projectId: runtime.project.id,
+      assistantId: runtime.webApp.assistantId,
+      name: physicalName,
+      mimeType: file.mimeType,
+      bytes: file.bytes,
+      path: `/project/web-apps/${runtime.webApp.id}/${userDigest}/${threadId}`
+    });
+    const ref = this.deps.attachmentRefs.sign({
+      webAppId: runtime.webApp.id,
+      userId,
+      threadId,
+      projectId: runtime.project.id,
+      uri: saved.uri,
+      name: displayName,
+      mimeType: file.mimeType,
+      size: saved.size,
+      contentDigest
+    });
+    return { ref, name: displayName, mimeType: file.mimeType, size: saved.size };
+  }
+  async resumeInterrupt(webAppId, userId, threadId, interruptId, selection, input) {
+    const { runtime, agent } = await this.resolveOwnedAgent(webAppId, userId, threadId, selection);
+    this.requireNamedFeature(runtime.webApp.features.hitl, "Human review is disabled");
+    const state = await agent.getCurrentState();
+    if (!hasInterrupt(state, interruptId)) this.fail("INVALID_REQUEST", 400, "Interrupt not found");
+    const execution = await this.execute(agent, runtime, {
+      input: { message: input.message },
+      command: { resume: input.response }
+    });
+    return { ...execution, allowInterrupts: true, allowGenUI: runtime.webApp.features.genUI };
+  }
+  execute(agent, runtime, request) {
+    return executeScopedAgentMessage(agent, {
+      ...request,
+      ...runtime.modelKey ? { custom_run_config: { modelConfig: { modelKey: runtime.modelKey } } } : {}
+    }, [MessageChunkTypes3.MESSAGE_COMPLETED, MessageChunkTypes3.INTERRUPT, MessageChunkTypes3.MESSAGE_FAILED]);
+  }
+  async resolveRuntime(webAppId, selection) {
+    const webApp = await this.deps.webAppStore.findById(webAppId);
+    if (!webApp) this.fail("WEB_APP_NOT_FOUND", 404, "Agent Web App not found");
+    const previewAllowed = webApp.status === "draft" && selection.preview?.tenantId === webApp.tenantId && await this.deps.authorizePreview?.(webApp, selection.preview) === true;
+    if (webApp.status !== "active" && !previewAllowed) this.fail("WEB_APP_DISABLED", 403, "Agent Web App is disabled");
+    if (!webApp.features.projectSelector && selection.projectId !== void 0) {
+      this.fail("PROJECT_SELECTOR_DISABLED", 400, "Project selection is disabled");
+    }
+    const projectId = selection.projectId ?? webApp.scope.defaultProjectId;
+    if (!webApp.scope.allowedProjectIds.includes(projectId)) {
+      this.fail("PROJECT_NOT_ALLOWED", 400, "Project is not allowed");
+    }
+    const project = await this.deps.projectStore.getProjectById(webApp.tenantId, projectId);
+    if (!project) this.fail("PROJECT_NOT_ALLOWED", 400, "Project is not available");
+    if (!webApp.features.modelSelector && selection.modelKey !== void 0) {
+      this.fail("MODEL_NOT_ALLOWED", 400, "Model selection is disabled");
+    }
+    const modelKey2 = selection.modelKey ?? webApp.scope.defaultModelKey;
+    const allowedModels = webApp.scope.allowedModelKeys;
+    if (modelKey2 && (!allowedModels?.includes(modelKey2) || !this.deps.modelRegistry.has(modelKey2))) {
+      this.fail("MODEL_NOT_ALLOWED", 400, "Model is not allowed");
+    }
+    return { webApp, project, modelKey: modelKey2 };
+  }
+  async resolveOwnedAgent(webAppId, userId, threadId, selection) {
+    const runtime = await this.resolveOwnedRuntime(webAppId, userId, threadId, selection);
+    return { runtime, agent: this.resolveAgent(runtime, threadId) };
+  }
+  async resolveOwnedRuntime(webAppId, userId, threadId, selection) {
+    const runtime = await this.resolveRuntime(webAppId, selection);
+    await this.requireOwnedThread(runtime, userId, threadId);
+    return runtime;
+  }
+  resolveAgent(runtime, threadId) {
+    if (!this.deps.agentResolver) this.fail("INTERNAL_ERROR", 500, "Agent runtime is unavailable");
+    return this.deps.agentResolver.getAgent({
+      tenantId: runtime.webApp.tenantId,
+      assistantId: runtime.webApp.assistantId,
+      threadId,
+      workspaceId: runtime.project.workspaceId,
+      projectId: runtime.project.id,
+      ...runtime.modelKey ? { modelKey: runtime.modelKey } : {}
+    });
+  }
+  resolveAttachmentRefs(runtime, userId, threadId, refs) {
+    if (refs.length === 0) return [];
+    this.requireNamedFeature(runtime.webApp.features.attachments, "Attachments are disabled");
+    if (!this.deps.attachmentRefs) this.fail("INTERNAL_ERROR", 500, "Attachment service is unavailable");
+    try {
+      return refs.map((ref) => ({
+        ...this.deps.attachmentRefs.verify(ref, {
+          webAppId: runtime.webApp.id,
+          userId,
+          threadId,
+          projectId: runtime.project.id
+        }),
+        addedBy: "user"
+      }));
+    } catch {
+      return this.fail("INVALID_REQUEST", 400, "Invalid attachment reference");
+    }
+  }
+  async ownedThreads(runtime, userId) {
+    return this.deps.threadStore.getThreadsByAssistantId(
+      runtime.webApp.tenantId,
+      runtime.webApp.assistantId,
+      {
+        source: "web_app",
+        webAppId: runtime.webApp.id,
+        userId,
+        projectId: runtime.project.id
+      }
+    );
+  }
+  async requireOwnedThread(runtime, userId, threadId) {
+    const thread = await this.deps.threadStore.getThreadById(runtime.webApp.tenantId, threadId);
+    const metadata = thread?.metadata;
+    if (!thread || thread.assistantId !== runtime.webApp.assistantId || metadata?.source !== "web_app" || metadata.webAppId !== runtime.webApp.id || metadata.userId !== userId || metadata.projectId !== runtime.project.id) this.threadNotFound();
+    return thread;
+  }
+  async resolveImplicitThread(runtime, userId) {
+    const latest = (await this.ownedThreads(runtime, userId)).sort(compareThreads)[0];
+    if (latest) return toRuntimeThread(latest);
+    const threadId = implicitThreadId(runtime, userId);
+    const existing = await this.deps.threadStore.getThreadById(
+      runtime.webApp.tenantId,
+      threadId
+    );
+    if (existing) return toRuntimeThread(this.requireImplicitOwnership(runtime, userId, existing));
+    await this.deps.threadStore.createThread(
+      runtime.webApp.tenantId,
+      runtime.webApp.assistantId,
+      threadId,
+      { metadata: this.metadata(runtime, userId) }
+    );
+    const persisted = await this.deps.threadStore.getThreadById(
+      runtime.webApp.tenantId,
+      threadId
+    );
+    if (!persisted) this.fail("INTERNAL_ERROR", 500, "Implicit thread could not be resolved");
+    return toRuntimeThread(this.requireImplicitOwnership(runtime, userId, persisted));
+  }
+  requireImplicitOwnership(runtime, userId, thread) {
+    const metadata = thread.metadata;
+    if (thread.assistantId !== runtime.webApp.assistantId || metadata?.source !== "web_app" || metadata.webAppId !== runtime.webApp.id || metadata.userId !== userId || metadata.projectId !== runtime.project.id) this.fail("INTERNAL_ERROR", 500, "Implicit thread identity conflict");
+    return thread;
+  }
+  async createOwnedThread(runtime, userId, rawLabel) {
+    const thread = await this.deps.threadStore.createThread(
+      runtime.webApp.tenantId,
+      runtime.webApp.assistantId,
+      randomUUID9(),
+      { metadata: this.metadata(runtime, userId, normalizeLabel(rawLabel)) }
+    );
+    return toRuntimeThread(thread);
+  }
+  metadata(runtime, userId, label) {
+    return {
+      source: "web_app",
+      webAppId: runtime.webApp.id,
+      userId,
+      projectId: runtime.project.id,
+      ...label ? { label } : {}
+    };
+  }
+  requireFeature(enabled) {
+    if (!enabled) this.fail("FEATURE_DISABLED", 403, "Thread management is disabled");
+  }
+  requireNamedFeature(enabled, message) {
+    if (!enabled) this.fail("FEATURE_DISABLED", 403, message);
+  }
+  threadNotFound() {
+    return this.fail("THREAD_NOT_FOUND", 404, "Thread not found");
+  }
+  fail(code, statusCode, message) {
+    throw new AgentWebAppRuntimeError(code, statusCode, message);
+  }
+};
+function hasInterrupt(state, interruptId) {
+  if (typeof state !== "object" || state === null || !("tasks" in state) || !Array.isArray(state.tasks)) return false;
+  return state.tasks.some((task) => {
+    if (typeof task !== "object" || task === null || !("interrupts" in task) || !Array.isArray(task.interrupts)) return false;
+    return task.interrupts.some((interrupt) => typeof interrupt === "object" && interrupt !== null && "id" in interrupt && interrupt.id === interruptId);
+  });
+}
+function sanitizePhysicalFilename(name) {
+  const sanitized = name.replace(/[^A-Za-z0-9._-]/g, "_").replace(/^\.+/, "");
+  return sanitized || "file";
+}
+function normalizeLabel(label) {
+  const normalized = label?.trim();
+  return normalized || void 0;
+}
+function implicitThreadId(runtime, userId) {
+  const canonicalTuple = JSON.stringify([
+    "axiom.agent-web-app.implicit-thread",
+    1,
+    runtime.webApp.tenantId,
+    runtime.webApp.assistantId,
+    runtime.webApp.id,
+    userId,
+    runtime.project.id
+  ]);
+  const bytes = createHash("sha256").update(canonicalTuple, "utf8").digest().subarray(0, 16);
+  bytes[6] = bytes[6] & 15 | 128;
+  bytes[8] = bytes[8] & 63 | 128;
+  const hex = bytes.toString("hex");
+  return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20)}`;
+}
+function compareThreads(left, right) {
+  return right.updatedAt.getTime() - left.updatedAt.getTime() || right.id.localeCompare(left.id);
+}
+function toRuntimeThread(thread) {
+  return {
+    id: thread.id,
+    projectId: String(thread.metadata?.projectId),
+    ...typeof thread.metadata?.label === "string" ? { label: thread.metadata.label } : {},
+    createdAt: thread.createdAt,
+    updatedAt: thread.updatedAt
+  };
+}
+
+// src/services/agent-web-app/AgentWebAppStreamProjector.ts
+import {
+  MessageChunkTypes as MessageChunkTypes4,
+  parseAgentWebAppGenUIBlock as parseAgentWebAppGenUIBlock2
+} from "@axiom-lattice/protocols";
+function createAgentWebAppStreamProjectionContext(options = {}) {
+  return { startedToolIds: /* @__PURE__ */ new Set(), allowInterrupts: options.allowInterrupts ?? true, allowGenUI: options.allowGenUI ?? false };
+}
+function projectAgentWebAppChunk(chunk, context) {
+  if (chunk.type === MessageChunkTypes4.AI) {
+    const events = [];
+    const startedToolIds = context?.startedToolIds ?? /* @__PURE__ */ new Set();
+    if (typeof chunk.data.content === "string" && chunk.data.content) events.push({ type: "message.delta", text: chunk.data.content });
+    if (context?.allowGenUI && Array.isArray(chunk.data.content)) {
+      for (const value of chunk.data.content) {
+        const block = parseAgentWebAppGenUIBlock2(value);
+        if (block) events.push({ type: "genui.render", block });
+      }
+    }
+    for (const call of chunk.data.tool_call_chunks ?? []) {
+      if (call.id && call.name && !startedToolIds.has(call.id)) {
+        startedToolIds.add(call.id);
+        events.push({ type: "tool.started", id: call.id, name: call.name });
+      }
+    }
+    for (const call of chunk.data.tool_calls ?? []) {
+      if (!startedToolIds.has(call.id)) {
+        startedToolIds.add(call.id);
+        events.push({ type: "tool.started", id: call.id, name: call.name });
+      }
+    }
+    return events;
+  }
+  if (chunk.type === MessageChunkTypes4.TOOL && chunk.data.tool_call_id) {
+    return [{ type: "tool.completed", id: chunk.data.tool_call_id }];
+  }
+  if (chunk.type === MessageChunkTypes4.INTERRUPT) {
+    if (context && !context.allowInterrupts) return [{ type: "stream.completed" }];
+    const interrupt = publicInterrupt(chunk);
+    return interrupt ? [{ type: "interrupt.created", interrupt }, { type: "stream.completed" }] : [{ type: "stream.completed" }];
+  }
+  if (chunk.type === MessageChunkTypes4.MESSAGE_COMPLETED) {
+    return [
+      { type: "message.completed", messageId: chunk.data.id },
+      { type: "stream.completed" }
+    ];
+  }
+  if (chunk.type === MessageChunkTypes4.MESSAGE_FAILED) {
+    return [
+      { type: "error", error: { code: "STREAM_FAILED", message: "Stream failed", retryable: true } },
+      { type: "stream.completed" }
+    ];
+  }
+  return [];
+}
+function publicInterrupt(chunk) {
+  const value = parseInterruptContent(chunk.data.content);
+  if (!value) return void 0;
+  const topLevelId = chunk.id;
+  const id = typeof topLevelId === "string" ? topLevelId : chunk.data.id;
+  if (!id) return void 0;
+  return {
+    id,
+    type: typeof value.type === "string" ? value.type : "input",
+    prompt: typeof value.prompt === "string" ? value.prompt : typeof value.message === "string" ? value.message : "Input required",
+    ...isRecord2(value.data) ? { data: value.data } : {}
+  };
+}
+function parseInterruptContent(content) {
+  if (!content) return {};
+  if (isRecord2(content)) return content;
+  if (typeof content !== "string") return void 0;
+  try {
+    const parsed = JSON.parse(content);
+    return isRecord2(parsed) ? parsed : { prompt: content };
+  } catch {
+    return { prompt: content };
+  }
+}
+function isRecord2(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+// src/routes/agent-web-app-runtime.ts
+var idSchema = z4.string().min(1).max(128);
+var paramsSchema = z4.object({ webAppId: idSchema }).strict();
+var threadParamsSchema = z4.object({ webAppId: idSchema, threadId: idSchema }).strict();
+var interruptParamsSchema = z4.object({ webAppId: idSchema, threadId: idSchema, interruptId: idSchema }).strict();
+var bootstrapQuerySchema = z4.object({ projectId: idSchema.optional(), modelKey: idSchema.optional() }).strict();
+var projectQuerySchema = z4.object({ projectId: idSchema.optional() }).strict();
+var threadBodySchema = z4.object({ projectId: idSchema.optional(), label: z4.string().max(128).optional() }).strict();
+var streamBodySchema = z4.object({
+  content: z4.string().trim().min(1).max(32768),
+  projectId: idSchema.optional(),
+  modelKey: idSchema.optional(),
+  attachmentRefs: z4.array(z4.string().min(1).max(8192)).max(10).optional()
+}).strict();
+var resumeBodySchema = z4.object({
+  projectId: idSchema.optional(),
+  modelKey: idSchema.optional(),
+  message: z4.string().trim().min(1).max(4096),
+  response: z4.union([
+    z4.boolean(),
+    z4.string().max(4096),
+    z4.object({ approved: z4.boolean(), feedback: z4.string().max(4096).optional() }).strict()
+  ])
+}).strict();
+var MAX_ATTACHMENT_BYTES = 10 * 1024 * 1024;
+function createExternalHeaderIdentityResolver() {
+  return { resolve(request) {
+    const raw = request.headers["x-axiom-external-user-id"];
+    if (raw === void 0) throw new AgentWebAppRuntimeError("USER_ID_REQUIRED", 401, "External user id is required");
+    if (Array.isArray(raw) || typeof raw !== "string") throw new AgentWebAppRuntimeError("INVALID_USER_ID", 400, "External user id is invalid");
+    const userId = raw.trim();
+    if (!/^[A-Za-z0-9._:@-]+$/.test(userId) || userId.length > 128) throw new AgentWebAppRuntimeError("INVALID_USER_ID", 400, "External user id is invalid");
+    return { userId, assurance: "unverified" };
+  } };
+}
+function registerAgentWebAppRuntimeRoutes(app2, deps) {
+  const identities = deps.identityResolver ?? createExternalHeaderIdentityResolver();
+  app2.register(async (routes) => {
+    routes.setErrorHandler((error, _request, reply) => normalizeError2(reply, error));
+    routes.get("/api/web-apps/:webAppId/runtime/bootstrap", async (request, reply) => handle2(reply, async () => {
+      const { webAppId } = paramsSchema.parse(request.params);
+      const identity = resolveRuntimeIdentity(request, webAppId, identities);
+      return { data: await deps.service.bootstrap(webAppId, identity.userId, withPreview(bootstrapQuerySchema.parse(request.query), identity.preview)) };
+    }));
+    routes.get("/api/web-apps/:webAppId/runtime/threads", async (request, reply) => handle2(reply, async () => {
+      const { webAppId } = paramsSchema.parse(request.params);
+      const identity = resolveRuntimeIdentity(request, webAppId, identities);
+      const records = await deps.service.listThreads(webAppId, identity.userId, withPreview(projectQuerySchema.parse(request.query), identity.preview));
+      return { data: { records, total: records.length } };
+    }));
+    routes.post("/api/web-apps/:webAppId/runtime/threads", async (request, reply) => handle2(reply, async () => {
+      const { webAppId } = paramsSchema.parse(request.params);
+      const identity = resolveRuntimeIdentity(request, webAppId, identities);
+      return { statusCode: 201, data: await deps.service.createThread(webAppId, identity.userId, withPreview(threadBodySchema.parse(request.body), identity.preview)) };
+    }));
+    routes.patch("/api/web-apps/:webAppId/runtime/threads/:threadId", async (request, reply) => handle2(reply, async () => {
+      const { webAppId, threadId } = threadParamsSchema.parse(request.params);
+      const identity = resolveRuntimeIdentity(request, webAppId, identities);
+      return { data: await deps.service.updateThread(webAppId, identity.userId, threadId, withPreview(threadBodySchema.parse(request.body), identity.preview)) };
+    }));
+    routes.delete("/api/web-apps/:webAppId/runtime/threads/:threadId", async (request, reply) => handle2(reply, async () => {
+      const { webAppId, threadId } = threadParamsSchema.parse(request.params);
+      const identity = resolveRuntimeIdentity(request, webAppId, identities);
+      await deps.service.deleteThread(webAppId, identity.userId, threadId, withPreview(projectQuerySchema.parse(request.query), identity.preview));
+      return { data: { id: threadId } };
+    }));
+    routes.get("/api/web-apps/:webAppId/runtime/threads/:threadId/messages", async (request, reply) => handle2(reply, async () => {
+      const { webAppId, threadId } = threadParamsSchema.parse(request.params);
+      const identity = resolveRuntimeIdentity(request, webAppId, identities);
+      const messages = await deps.service.getMessages(webAppId, identity.userId, threadId, withPreview(projectQuerySchema.parse(request.query), identity.preview));
+      return { data: { messages } };
+    }));
+    routes.post("/api/web-apps/:webAppId/runtime/threads/:threadId/messages/stream", async (request, reply) => {
+      try {
+        const { webAppId, threadId } = threadParamsSchema.parse(request.params);
+        const identity = resolveRuntimeIdentity(request, webAppId, identities);
+        const input = streamBodySchema.parse(request.body);
+        const result = await deps.service.streamMessage(webAppId, identity.userId, threadId, withPreview(input, identity.preview));
+        beginSse(reply);
+        await pipeAgentWebAppStream(reply.raw, result.stream, result);
+      } catch (error) {
+        return normalizeError2(reply, error);
+      }
+    });
+    routes.post("/api/web-apps/:webAppId/runtime/threads/:threadId/abort", async (request, reply) => handle2(reply, async () => {
+      const { webAppId, threadId } = threadParamsSchema.parse(request.params);
+      const identity = resolveRuntimeIdentity(request, webAppId, identities);
+      await deps.service.abort(webAppId, identity.userId, threadId, withPreview(projectQuerySchema.parse(request.query), identity.preview));
+      return { data: { aborted: true } };
+    }));
+    routes.post("/api/web-apps/:webAppId/runtime/threads/:threadId/attachments", async (request, reply) => handle2(reply, async () => {
+      const { webAppId, threadId } = threadParamsSchema.parse(request.params);
+      const identity = resolveRuntimeIdentity(request, webAppId, identities);
+      if (!request.isMultipart()) throw new ZodError2([]);
+      const part = await request.file({ limits: { files: 1, fileSize: MAX_ATTACHMENT_BYTES } });
+      if (!part || !part.filename || part.filename.length > 255) throw new ZodError2([]);
+      const bytes = await part.toBuffer();
+      if (bytes.length === 0 || part.file.truncated) throw new ZodError2([]);
+      const data = await deps.service.uploadAttachment(webAppId, identity.userId, threadId, withPreview(projectQuerySchema.parse(request.query), identity.preview), {
+        name: part.filename,
+        mimeType: part.mimetype || "application/octet-stream",
+        bytes
+      });
+      return { statusCode: 201, data };
+    }));
+    routes.post("/api/web-apps/:webAppId/runtime/threads/:threadId/interrupts/:interruptId/resume", async (request, reply) => {
+      try {
+        const { webAppId, threadId, interruptId } = interruptParamsSchema.parse(request.params);
+        const identity = resolveRuntimeIdentity(request, webAppId, identities);
+        const { projectId, modelKey: modelKey2, message, response } = resumeBodySchema.parse(request.body);
+        const result = await deps.service.resumeInterrupt(webAppId, identity.userId, threadId, interruptId, withPreview({ projectId, modelKey: modelKey2 }, identity.preview), { message, response });
+        beginSse(reply);
+        await pipeAgentWebAppStream(reply.raw, result.stream, result);
+      } catch (error) {
+        return normalizeError2(reply, error);
+      }
+    });
+  });
+}
+function resolveRuntimeIdentity(request, webAppId, identities) {
+  if (request.headers["x-axiom-web-app-preview"] !== "true") return identities.resolve(request);
+  const user = request.user;
+  if (!user?.id || !user.tenantId) throw new AgentWebAppRuntimeError("USER_ID_REQUIRED", 401, "Authenticated Console preview is required");
+  return { userId: `console-preview:${user.id}:${webAppId}`, preview: { tenantId: user.tenantId, userId: user.id } };
+}
+function withPreview(selection, preview) {
+  return { ...selection, ...preview ? { preview } : {} };
+}
+async function pipeAgentWebAppStream(raw, stream, options = {}) {
+  const projection = createAgentWebAppStreamProjectionContext(options);
+  await pipeAsyncIterableToSse(raw, stream, {
+    project: (chunk) => projectAgentWebAppChunk(chunk, projection),
+    onError: () => [
+      { type: "error", error: { code: "STREAM_FAILED", message: "Stream failed", retryable: true } },
+      { type: "stream.completed" }
+    ]
+  });
+}
+function beginSse(reply) {
+  reply.hijack();
+  reply.raw.writeHead(200, {
+    "Content-Type": "text/event-stream; charset=utf-8",
+    "Cache-Control": "no-cache, no-transform",
+    Connection: "keep-alive",
+    "X-Accel-Buffering": "no"
+  });
+}
+async function handle2(reply, operation) {
+  try {
+    const result = await operation();
+    return reply.code(result.statusCode ?? 200).send({ success: true, data: result.data });
+  } catch (error) {
+    return normalizeError2(reply, error);
+  }
+}
+function normalizeError2(reply, error) {
+  if (error instanceof AgentWebAppRuntimeError) return reply.code(error.statusCode).send({ success: false, error: { code: error.code, message: error.message, retryable: false } });
+  if (error instanceof ZodError2) return reply.code(400).send({ success: false, error: { code: "INVALID_REQUEST", message: "Invalid request", retryable: false } });
+  if (isMultipartRequestError(error)) return reply.code(400).send({ success: false, error: { code: "INVALID_REQUEST", message: "Invalid request", retryable: false } });
+  return reply.code(500).send({ success: false, error: { code: "INTERNAL_ERROR", message: "Internal server error", retryable: false } });
+}
+function isMultipartRequestError(error) {
+  return typeof error === "object" && error !== null && "code" in error && typeof error.code === "string" && error.code.startsWith("FST_");
+}
+
+// src/services/agent-web-app/AgentWebAppAttachmentRef.ts
+import { createCipheriv, createDecipheriv, createHash as createHash2, randomBytes as randomBytes2 } from "crypto";
+var TTL_MS = 15 * 6e4;
+function resolveAgentWebAppAttachmentSecret(consoleSecret) {
+  return process.env.WEB_APP_ATTACHMENT_SECRET || process.env.AUTH_TOKEN_SECRET || process.env.JWT_SECRET || consoleSecret;
+}
+var AgentWebAppAttachmentRefService = class {
+  constructor(secret, now = Date.now) {
+    this.now = now;
+    if (!secret) throw new Error("Attachment signing secret is required");
+    this.key = createHash2("sha256").update(secret, "utf8").digest();
+  }
+  sign(input) {
+    const payload = {
+      webAppId: input.webAppId,
+      userDigest: digestUser(input.userId),
+      threadId: input.threadId,
+      projectId: input.projectId,
+      uri: input.uri,
+      name: input.name,
+      mimeType: input.mimeType,
+      size: input.size,
+      contentDigest: input.contentDigest,
+      exp: this.now() + TTL_MS
+    };
+    const iv = randomBytes2(12);
+    const cipher = createCipheriv("aes-256-gcm", this.key, iv);
+    const ciphertext = Buffer.concat([
+      cipher.update(JSON.stringify(payload), "utf8"),
+      cipher.final()
+    ]);
+    const tag = cipher.getAuthTag();
+    return `v1.${iv.toString("base64url")}.${ciphertext.toString("base64url")}.${tag.toString("base64url")}`;
+  }
+  verify(ref, scope) {
+    const [version, encodedIv, encodedCiphertext, encodedTag, extra] = ref.split(".");
+    if (version !== "v1" || !encodedIv || !encodedCiphertext || !encodedTag || extra !== void 0 || !/^[A-Za-z0-9_-]{16}$/.test(encodedIv) || !/^[A-Za-z0-9_-]+$/.test(encodedCiphertext) || !/^[A-Za-z0-9_-]{22}$/.test(encodedTag)) this.invalid();
+    try {
+      const iv = decodeCanonical(encodedIv, 12);
+      const ciphertext = decodeCanonical(encodedCiphertext);
+      const tag = decodeCanonical(encodedTag, 16);
+      const decipher = createDecipheriv("aes-256-gcm", this.key, iv);
+      decipher.setAuthTag(tag);
+      const plaintext = Buffer.concat([decipher.update(ciphertext), decipher.final()]);
+      const value = JSON.parse(plaintext.toString("utf8"));
+      if (!isAttachmentPayload(value)) this.invalid();
+      if (value.exp <= this.now()) throw new Error("Attachment reference expired");
+      if (value.webAppId !== scope.webAppId || value.userDigest !== digestUser(scope.userId) || value.threadId !== scope.threadId || value.projectId !== scope.projectId) this.invalid();
+      return {
+        uri: value.uri,
+        name: value.name,
+        mimeType: value.mimeType,
+        size: value.size,
+        contentDigest: value.contentDigest
+      };
+    } catch (error) {
+      if (error instanceof Error && error.message === "Attachment reference expired") throw error;
+      this.invalid();
+    }
+  }
+  invalid() {
+    throw new Error("Invalid attachment reference");
+  }
+};
+function decodeCanonical(value, expectedBytes) {
+  const decoded = Buffer.from(value, "base64url");
+  if (decoded.toString("base64url") !== value || expectedBytes !== void 0 && decoded.length !== expectedBytes) {
+    throw new Error("Invalid attachment reference");
+  }
+  return decoded;
+}
+function digestUser(userId) {
+  return createHash2("sha256").update(userId, "utf8").digest("hex");
+}
+function isAttachmentPayload(value) {
+  if (typeof value !== "object" || value === null || Array.isArray(value)) return false;
+  const record = value;
+  if (Object.keys(record).sort().join(",") !== "contentDigest,exp,mimeType,name,projectId,size,threadId,uri,userDigest,webAppId") return false;
+  return typeof record.webAppId === "string" && typeof record.userDigest === "string" && /^[a-f0-9]{64}$/.test(record.userDigest) && typeof record.threadId === "string" && typeof record.projectId === "string" && typeof record.uri === "string" && record.uri.startsWith("/") && typeof record.name === "string" && record.name.length > 0 && typeof record.mimeType === "string" && record.mimeType.length > 0 && typeof record.size === "number" && Number.isSafeInteger(record.size) && record.size >= 0 && typeof record.contentDigest === "string" && /^[a-f0-9]{64}$/.test(record.contentDigest) && typeof record.exp === "number" && Number.isSafeInteger(record.exp);
+}
+
 // src/routes/index.ts
 var registerLatticeRoutes = (app2, channelDeps) => {
+  const webAppStore = getStoreLattice16("default", "agentWebApp").store;
+  const assistantStore = getStoreLattice16("default", "assistant").store;
+  const projectStore = getStoreLattice16("default", "project").store;
+  registerAgentWebAppRoutes(app2, {
+    service: new AgentWebAppService({
+      webAppStore,
+      assistantStore,
+      projectStore,
+      modelRegistry: { has: (key) => modelLatticeManager3.hasLattice(key) },
+      configuredAgentResolver: createConfiguredAgentResolver({
+        hydrate: (tenantId) => agentLatticeManager5.initializeStoredAssistantsForTenant(tenantId),
+        has: (tenantId, assistantId) => agentLatticeManager5.hasAgentLatticeWithTenant(tenantId, assistantId)
+      })
+    })
+  });
+  registerAgentWebAppRuntimeRoutes(app2, {
+    service: new AgentWebAppRuntimeService({
+      webAppStore,
+      threadStore: getStoreLattice16("default", "thread").store,
+      projectStore,
+      assistantResolver: {
+        resolve: async (tenantId, assistantId) => {
+          const stored = await assistantStore.getAssistantById(tenantId, assistantId);
+          if (stored) return stored;
+          await agentLatticeManager5.initializeStoredAssistantsForTenant(tenantId);
+          const config = agentLatticeManager5.getAgentConfigWithTenant(tenantId, assistantId);
+          return config ? { id: assistantId, name: config.name, description: config.description } : null;
+        }
+      },
+      modelRegistry: {
+        has: (key) => modelLatticeManager3.hasLattice(key),
+        label: (key) => key
+      },
+      messageReader: {
+        getCurrentMessages: ({ tenantId, assistantId, threadId, workspaceId, projectId }) => agentInstanceManager6.getAgent({
+          tenant_id: tenantId,
+          assistant_id: assistantId,
+          thread_id: threadId,
+          workspace_id: workspaceId,
+          project_id: projectId
+        }).getCurrentMessages()
+      },
+      agentResolver: {
+        getAgent: ({ tenantId, assistantId, threadId, workspaceId, projectId }) => agentInstanceManager6.getAgent({
+          tenant_id: tenantId,
+          assistant_id: assistantId,
+          thread_id: threadId,
+          workspace_id: workspaceId,
+          project_id: projectId
+        })
+      },
+      attachmentRefs: new AgentWebAppAttachmentRefService(
+        resolveAgentWebAppAttachmentSecret(
+          resolveConsoleTokenSecret(process.env.AUTH_REQUIRED === "true")
+        )
+      ),
+      saveProjectFile,
+      authorizePreview: async (webApp, preview) => {
+        if (webApp.tenantId !== preview.tenantId) return false;
+        const assistant = await assistantStore.getAssistantById(preview.tenantId, webApp.assistantId);
+        if (assistant) return !assistant.ownerUserId || assistant.ownerUserId === preview.userId;
+        await agentLatticeManager5.initializeStoredAssistantsForTenant(preview.tenantId);
+        return agentLatticeManager5.hasAgentLatticeWithTenant(preview.tenantId, webApp.assistantId);
+      }
+    })
+  });
   registerA2ABridgeRoutes(app2);
   registerSTTRoutes(app2);
   app2.get("/api/local-a2a", getLocalA2AStatus);
@@ -10031,9 +11150,9 @@ var skillRegistration = {
 };
 
 // src/export_registrations/agent.registration.ts
-import { getStoreLattice as getStoreLattice16 } from "@axiom-lattice/core";
+import { getStoreLattice as getStoreLattice17 } from "@axiom-lattice/core";
 function getStore3() {
-  return getStoreLattice16("default", "assistant").store;
+  return getStoreLattice17("default", "assistant").store;
 }
 var agentRegistration = {
   entityType: "agent",
@@ -10113,9 +11232,9 @@ var agentRegistration = {
 };
 
 // src/export_registrations/database-config.registration.ts
-import { getStoreLattice as getStoreLattice17 } from "@axiom-lattice/core";
+import { getStoreLattice as getStoreLattice18 } from "@axiom-lattice/core";
 function getStore4() {
-  return getStoreLattice17("default", "database").store;
+  return getStoreLattice18("default", "database").store;
 }
 var databaseConfigRegistration = {
   entityType: "database_config",
@@ -10195,9 +11314,9 @@ var databaseConfigRegistration = {
 };
 
 // src/export_registrations/metrics-config.registration.ts
-import { getStoreLattice as getStoreLattice18 } from "@axiom-lattice/core";
+import { getStoreLattice as getStoreLattice19 } from "@axiom-lattice/core";
 function getStore5() {
-  return getStoreLattice18("default", "metrics").store;
+  return getStoreLattice19("default", "metrics").store;
 }
 var metricsConfigRegistration = {
   entityType: "metrics_config",
@@ -10277,9 +11396,9 @@ var metricsConfigRegistration = {
 };
 
 // src/export_registrations/mcp-config.registration.ts
-import { getStoreLattice as getStoreLattice19 } from "@axiom-lattice/core";
+import { getStoreLattice as getStoreLattice20 } from "@axiom-lattice/core";
 function getStore6() {
-  return getStoreLattice19("default", "mcp").store;
+  return getStoreLattice20("default", "mcp").store;
 }
 var mcpConfigRegistration = {
   entityType: "mcp_config",
@@ -10362,9 +11481,9 @@ var mcpConfigRegistration = {
 };
 
 // src/export_registrations/connection.registration.ts
-import { getStoreLattice as getStoreLattice20 } from "@axiom-lattice/core";
+import { getStoreLattice as getStoreLattice21 } from "@axiom-lattice/core";
 function getStore7() {
-  return getStoreLattice20("default", "connection").store;
+  return getStoreLattice21("default", "connection").store;
 }
 async function listAllConnections(tenantId) {
   const store = getStore7();
@@ -10446,9 +11565,9 @@ var connectionRegistration = {
 };
 
 // src/export_registrations/collection.registration.ts
-import { getStoreLattice as getStoreLattice21 } from "@axiom-lattice/core";
+import { getStoreLattice as getStoreLattice22 } from "@axiom-lattice/core";
 function getStore8() {
-  return getStoreLattice21("default", "collection").store;
+  return getStoreLattice22("default", "collection").store;
 }
 var collectionRegistration = {
   entityType: "collection",
@@ -10519,11 +11638,11 @@ var collectionRegistration = {
 };
 
 // src/export_registrations/channel-installation.registration.ts
-import { getStoreLattice as getStoreLattice22 } from "@axiom-lattice/core";
-import { randomUUID as randomUUID9 } from "crypto";
+import { getStoreLattice as getStoreLattice23 } from "@axiom-lattice/core";
+import { randomUUID as randomUUID10 } from "crypto";
 var UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
 function getStore9() {
-  return getStoreLattice22("default", "channelInstallation").store;
+  return getStoreLattice23("default", "channelInstallation").store;
 }
 var channelInstallationRegistration = {
   entityType: "channel_installation",
@@ -10610,7 +11729,7 @@ var channelInstallationRegistration = {
       }
       id = sourceId;
     } else {
-      id = randomUUID9();
+      id = randomUUID10();
     }
     await store.createInstallation(tenantId, id, {
       channel: data.channel,
@@ -10622,9 +11741,9 @@ var channelInstallationRegistration = {
 };
 
 // src/export_registrations/menu.registration.ts
-import { getStoreLattice as getStoreLattice23 } from "@axiom-lattice/core";
+import { getStoreLattice as getStoreLattice24 } from "@axiom-lattice/core";
 function getStore10() {
-  return getStoreLattice23("default", "menu").store;
+  return getStoreLattice24("default", "menu").store;
 }
 var menuRegistration = {
   entityType: "menu",
@@ -10702,9 +11821,9 @@ var menuRegistration = {
 };
 
 // src/export_registrations/eval.registration.ts
-import { getStoreLattice as getStoreLattice24 } from "@axiom-lattice/core";
+import { getStoreLattice as getStoreLattice25 } from "@axiom-lattice/core";
 function getStore11() {
-  return getStoreLattice24("default", "eval").store;
+  return getStoreLattice25("default", "eval").store;
 }
 var evalRegistration = {
   entityType: "eval",
@@ -11045,10 +12164,10 @@ function registerAllBuiltinEntities() {
 
 // src/router/MessageRouter.ts
 import {
-  getStoreLattice as getStoreLattice25,
-  agentInstanceManager as agentInstanceManager6
+  getStoreLattice as getStoreLattice26,
+  agentInstanceManager as agentInstanceManager7
 } from "@axiom-lattice/core";
-import { randomUUID as randomUUID10 } from "crypto";
+import { randomUUID as randomUUID11 } from "crypto";
 var BindingNotFoundError = class extends Error {
   constructor(message) {
     super(message);
@@ -11217,7 +12336,7 @@ var MessageRouter = class {
             channel: message.channel,
             adapterChannel: adapter.channel
           }, "Thread resolved by adapter strategy");
-          const threadStore = getStoreLattice25("default", "thread").store;
+          const threadStore = getStoreLattice26("default", "thread").store;
           try {
             await threadStore.createThread(
               tenantId,
@@ -11254,8 +12373,8 @@ var MessageRouter = class {
           }
         }
         if (!threadId) {
-          const threadStore = getStoreLattice25("default", "thread").store;
-          const newThreadId = randomUUID10();
+          const threadStore = getStoreLattice26("default", "thread").store;
+          const newThreadId = randomUUID11();
           console.log({
             event: "dispatch:thread:create",
             agentId,
@@ -11294,7 +12413,7 @@ var MessageRouter = class {
           senderId: message.sender.id,
           contentLength: message.content.text.length
         }, "Dispatching to agent");
-        const agent = agentInstanceManager6.getAgent({
+        const agent = agentInstanceManager7.getAgent({
           tenant_id: tenantId,
           assistant_id: agentId,
           thread_id: threadId,
@@ -11598,7 +12717,7 @@ var configureSwagger = async (app2, customSwaggerConfig, customSwaggerUiConfig)
 };
 
 // src/services/agent_task_consumer.ts
-import { eventBus as eventBus2, AGENT_TASK_EVENT, agentInstanceManager as agentInstanceManager7, QueueMode as QueueMode2 } from "@axiom-lattice/core";
+import { eventBus as eventBus3, AGENT_TASK_EVENT, agentInstanceManager as agentInstanceManager8, QueueMode as QueueMode2 } from "@axiom-lattice/core";
 var handleAgentTask = async (taskRequest, retryCount = 0) => {
   const {
     assistant_id,
@@ -11616,17 +12735,17 @@ var handleAgentTask = async (taskRequest, retryCount = 0) => {
     console.log(
       `\u5F00\u59CB\u5904\u7406\u4EFB\u52A1 [assistant_id: ${assistant_id}, thread_id: ${thread_id}]`
     );
-    const agent = agentInstanceManager7.getAgent({ assistant_id, thread_id, tenant_id, workspace_id: runConfig?.workspaceId, project_id: runConfig?.projectId, custom_run_config: runConfig });
+    const agent = agentInstanceManager8.getAgent({ assistant_id, thread_id, tenant_id, workspace_id: runConfig?.workspaceId, project_id: runConfig?.projectId, custom_run_config: runConfig });
     await agent.addMessage({ input, command, custom_run_config: runConfig }, QueueMode2.STEER);
     if (callback_event) {
       agent.subscribeOnce("message:completed", (evt) => {
-        eventBus2.publish(callback_event, {
+        eventBus3.publish(callback_event, {
           success: true,
           state: evt.state
         });
         if (main_thread_id && main_tenant_id) {
           try {
-            const mainAgent = agentInstanceManager7.getAgent({
+            const mainAgent = agentInstanceManager8.getAgent({
               assistant_id: main_assistant_id ?? assistant_id,
               thread_id: main_thread_id,
               tenant_id: main_tenant_id,
@@ -11656,7 +12775,7 @@ ${summary}`
         }
       });
       agent.subscribeOnce("message:interrupted", (evt) => {
-        eventBus2.publish(callback_event, {
+        eventBus3.publish(callback_event, {
           success: true,
           state: evt.state
         });
@@ -11679,7 +12798,7 @@ ${summary}`
       return handleAgentTask(taskRequest, nextRetryCount);
     }
     if (callback_event) {
-      eventBus2.publish(callback_event, {
+      eventBus3.publish(callback_event, {
         success: false,
         error: error instanceof Error ? error.message : String(error)
       });
@@ -11716,7 +12835,7 @@ var _AgentTaskConsumer = class _AgentTaskConsumer {
    * 初始化事件监听和队列轮询
    */
   initialize() {
-    eventBus2.subscribe(AGENT_TASK_EVENT, this.trigger_agent_task.bind(this));
+    eventBus3.subscribe(AGENT_TASK_EVENT, this.trigger_agent_task.bind(this));
     this.startPollingQueue();
     console.log("Agent\u4EFB\u52A1\u6D88\u8D39\u8005\u5DF2\u542F\u52A8\u5E76\u76D1\u542C\u4EFB\u52A1\u4E8B\u4EF6\u548C\u961F\u5217");
   }
@@ -11835,7 +12954,7 @@ var _AgentTaskConsumer = class _AgentTaskConsumer {
     handleAgentTask(taskRequest).catch((error) => {
       console.error("\u5904\u7406Agent\u4EFB\u52A1\u65F6\u53D1\u751F\u672A\u6355\u83B7\u7684\u9519\u8BEF:", error);
       if (taskRequest.callback_event) {
-        eventBus2.publish(taskRequest.callback_event, {
+        eventBus3.publish(taskRequest.callback_event, {
           success: false,
           error: error instanceof Error ? error.message : String(error)
         });
@@ -11855,8 +12974,8 @@ import {
   getLoggerLattice,
   loggerLatticeManager,
   sandboxLatticeManager as sandboxLatticeManager2,
-  getStoreLattice as getStoreLattice26,
-  agentInstanceManager as agentInstanceManager8,
+  getStoreLattice as getStoreLattice27,
+  agentInstanceManager as agentInstanceManager9,
   createSandboxProvider,
   TokenCache,
   mcpManager
@@ -11990,7 +13109,7 @@ function getConfiguredSandboxProvider() {
 }
 async function restoreMcpConnections() {
   try {
-    const storeLattice = getStoreLattice26("default", "mcp");
+    const storeLattice = getStoreLattice27("default", "mcp");
     const store = storeLattice.store;
     if (!store) {
       logger4.info("MCP store not configured, skipping connection restoration");
@@ -12064,7 +13183,7 @@ var start = async (config) => {
     }
     setEvalRunService(evalRunner);
     try {
-      const menuStore = getStoreLattice26("default", "menu").store;
+      const menuStore = getStoreLattice27("default", "menu").store;
       setMenuRegistry(menuStore);
       logger4.info("Menu registry initialized");
     } catch {
@@ -12076,12 +13195,12 @@ var start = async (config) => {
     registerLatticeRoutes(app, channelDeps);
     try {
       const { A2AAuthService, parseEnvKeys } = await import("./A2AAuthService-DK5X6VIL.mjs");
-      const { registerA2AStandardRoutes } = await import("./a2a-standard-U2XYG45L.mjs");
+      const { registerA2AStandardRoutes } = await import("./a2a-standard-VYQCHMBV.mjs");
       const a2a = await import("./a2a-7N3WDAOP.mjs");
-      const a2aKeyStore = getStoreLattice26("default", "a2aApiKey").store;
-      const assistantStore = getStoreLattice26("default", "assistant").store;
-      const projectStore = getStoreLattice26("default", "project").store;
-      const taskStore = getStoreLattice26("default", "task").store;
+      const a2aKeyStore = getStoreLattice27("default", "a2aApiKey").store;
+      const assistantStore = getStoreLattice27("default", "assistant").store;
+      const projectStore = getStoreLattice27("default", "project").store;
+      const taskStore = getStoreLattice27("default", "task").store;
       const authService = new A2AAuthService({
         keyStore: a2aKeyStore,
         assistantStore,
@@ -12111,7 +13230,7 @@ var start = async (config) => {
     }
     try {
       const { ResourceController } = await import("./resources-VA7LSDKN.mjs");
-      const sharedResourceStore = getStoreLattice26("default", "sharedResource").store;
+      const sharedResourceStore = getStoreLattice27("default", "sharedResource").store;
       const cache = new TokenCache();
       const resourceController = new ResourceController({
         store: sharedResourceStore,
@@ -12151,7 +13270,7 @@ var start = async (config) => {
       }
     }
     if (process.env.AXIOM_RESTORE_PENDING_ON_STARTUP === "true") {
-      agentInstanceManager8.restore().then((stats) => {
+      agentInstanceManager9.restore().then((stats) => {
         logger4.info(`Agent recovery complete: ${stats.restored} threads restored, ${stats.errors} errors`);
       }).catch((error) => {
         logger4.error("Agent recovery failed", { error });