@axiom-lattice/gateway 4.0.2 → 4.1.1

package/dist/index.js

@@ -195,9 +195,9 @@ async function saveProjectFile(params) {
   }
   const targetPath = path3.join(resolvedTargetDir, filename);
   await fs3.writeFile(targetPath, buffer);
-  const stat2 = await fs3.stat(targetPath);
+  const stat3 = await fs3.stat(targetPath);
   const uri = path3.posix.join("/", relativeDirectory, filename);
-  return { uri, name: filename, size: stat2.size };
+  return { uri, name: filename, size: stat3.size };
 }
 var fs3, path3, import_core23, BINARY_EXTENSIONS, ProjectFileValidationError;
 var init_workspace_file_service = __esm({
@@ -1040,18 +1040,18 @@ function extractText(msg) {
   }
   return null;
 }
-var import_zod6, logger4, wechatConfigSchema, MAX_RECONNECT_DELAY_MS, BASE_RECONNECT_DELAY_MS, HEARTBEAT_INTERVAL_MS, MSG_TYPE_USER, MSG_ITEM_TEXT, activeConnections2, seenClientIds, wechatChannelAdapter;
+var import_zod8, logger5, wechatConfigSchema, MAX_RECONNECT_DELAY_MS, BASE_RECONNECT_DELAY_MS, HEARTBEAT_INTERVAL_MS, MSG_TYPE_USER, MSG_ITEM_TEXT, activeConnections2, seenClientIds, wechatChannelAdapter;
 var init_WechatChannelAdapter = __esm({
   "src/channels/wechat/WechatChannelAdapter.ts"() {
     "use strict";
-    import_zod6 = require("zod");
+    import_zod8 = require("zod");
     init_wechat_client();
     init_context_store();
     init_Logger();
-    logger4 = new Logger({ serviceName: "lattice/gateway/wechat" });
-    wechatConfigSchema = import_zod6.z.object({
-      botToken: import_zod6.z.string(),
-      uin: import_zod6.z.string().optional()
+    logger5 = new Logger({ serviceName: "lattice/gateway/wechat" });
+    wechatConfigSchema = import_zod8.z.object({
+      botToken: import_zod8.z.string(),
+      uin: import_zod8.z.string().optional()
     });
     MAX_RECONNECT_DELAY_MS = 3e4;
     BASE_RECONNECT_DELAY_MS = 1e3;
@@ -1099,7 +1099,7 @@ var init_WechatChannelAdapter = __esm({
         const senderId = replyTarget.rawTarget.senderId;
         const contextToken = getContextToken(installation.id, senderId);
         if (!contextToken) {
-          logger4.warn("WeChat context token expired, cannot send reply", {
+          logger5.warn("WeChat context token expired, cannot send reply", {
             installationId: installation.id,
             senderId
           });
@@ -1117,14 +1117,14 @@ var init_WechatChannelAdapter = __esm({
       async connect(installation, deps) {
         const { id: installationId, tenantId, config } = installation;
         if (!config.botToken) {
-          logger4.warn("WeChat installation missing botToken, skipping", { installationId });
+          logger5.warn("WeChat installation missing botToken, skipping", { installationId });
           return;
         }
         if (activeConnections2.has(installationId)) {
-          logger4.warn("WeChat polling already running for installation, skipping", { installationId });
+          logger5.warn("WeChat polling already running for installation, skipping", { installationId });
           return;
         }
-        logger4.info("WeChat polling starting", { installationId, tenantId });
+        logger5.info("WeChat polling starting", { installationId, tenantId });
         const abortController = new AbortController();
         const heartbeatTimer = setInterval(() => {
           const state2 = activeConnections2.get(installationId);
@@ -1134,7 +1134,7 @@ var init_WechatChannelAdapter = __esm({
           }
           const elapsed = Date.now() - state2.lastActivity;
           if (elapsed > HEARTBEAT_INTERVAL_MS * 2) {
-            logger4.error("WeChat polling heartbeat lost \u2014 no activity", {
+            logger5.error("WeChat polling heartbeat lost \u2014 no activity", {
               installationId,
               elapsedMs: elapsed
             });
@@ -1153,7 +1153,7 @@ var init_WechatChannelAdapter = __esm({
         let reconnectDelay = BASE_RECONNECT_DELAY_MS;
         const scheduleNextPoll = () => {
           poll().catch((err) => {
-            logger4.error("WeChat poll iteration crashed", {
+            logger5.error("WeChat poll iteration crashed", {
               installationId,
               error: err instanceof Error ? err.message : String(err)
             });
@@ -1166,7 +1166,7 @@ var init_WechatChannelAdapter = __esm({
         const poll = async () => {
           const currentState = activeConnections2.get(installationId);
           if (!currentState || currentState.abortController.signal.aborted) {
-            logger4.info("WeChat polling aborted", { installationId });
+            logger5.info("WeChat polling aborted", { installationId });
             return;
           }
           try {
@@ -1179,7 +1179,7 @@ var init_WechatChannelAdapter = __esm({
             reconnectDelay = BASE_RECONNECT_DELAY_MS;
             currentState.lastActivity = Date.now();
             if (result.msgs.length > 0) {
-              logger4.info("WeChat poll received messages", {
+              logger5.info("WeChat poll received messages", {
                 installationId,
                 count: result.msgs.length
               });
@@ -1196,7 +1196,7 @@ var init_WechatChannelAdapter = __esm({
               if (inbound && router) {
                 const dispatchResult = await router.dispatch(inbound);
                 if (!dispatchResult.success) {
-                  logger4.warn("WeChat dispatch failed", {
+                  logger5.warn("WeChat dispatch failed", {
                     installationId,
                     error: dispatchResult.error?.message
                   });
@@ -1205,32 +1205,32 @@ var init_WechatChannelAdapter = __esm({
             }
           } catch (err) {
             if (err instanceof Error && err.name === "AbortError") {
-              logger4.info("WeChat poll aborted by signal", { installationId });
+              logger5.info("WeChat poll aborted by signal", { installationId });
               return;
             }
-            logger4.error("WeChat poll error", {
+            logger5.error("WeChat poll error", {
               installationId,
               error: err instanceof Error ? err.message : String(err)
             });
-            await new Promise((resolve3) => setTimeout(resolve3, reconnectDelay));
+            await new Promise((resolve4) => setTimeout(resolve4, reconnectDelay));
             reconnectDelay = Math.min(reconnectDelay * 2, MAX_RECONNECT_DELAY_MS);
           }
           scheduleNextPoll();
         };
         scheduleNextPoll();
-        logger4.info("WeChat polling started", { installationId });
+        logger5.info("WeChat polling started", { installationId });
       },
       async disconnect(installationId) {
         const state = activeConnections2.get(installationId);
         if (!state) {
-          logger4.warn("WeChat polling not running, nothing to disconnect", { installationId });
+          logger5.warn("WeChat polling not running, nothing to disconnect", { installationId });
           return;
         }
-        logger4.info("WeChat polling disconnecting", { installationId });
+        logger5.info("WeChat polling disconnecting", { installationId });
         state.abortController.abort();
         clearInterval(state.heartbeatTimer);
         activeConnections2.delete(installationId);
-        logger4.info("WeChat polling disconnected", { installationId });
+        logger5.info("WeChat polling disconnected", { installationId });
       }
     };
   }
@@ -1895,12 +1895,12 @@ function agentMessage(text) {
     parts: [{ kind: "text", text }]
   };
 }
-var import_uuid10, import_core55, import_protocols8, _AxiomAgentExecutor, AxiomAgentExecutor;
+var import_uuid10, import_core56, import_protocols8, _AxiomAgentExecutor, AxiomAgentExecutor;
 var init_AxiomAgentExecutor = __esm({
   "src/services/a2a/AxiomAgentExecutor.ts"() {
     "use strict";
     import_uuid10 = require("uuid");
-    import_core55 = require("@axiom-lattice/core");
+    import_core56 = require("@axiom-lattice/core");
     import_protocols8 = require("@axiom-lattice/protocols");
     init_a2aFileRefs();
     init_task_file_refs();
@@ -1987,7 +1987,7 @@ var init_AxiomAgentExecutor = __esm({
           await this.taskStore.save(initialTask);
           bus.publish(initialTask);
           try {
-            const agent = import_core55.agentInstanceManager.getAgent({
+            const agent = import_core56.agentInstanceManager.getAgent({
               assistant_id: this.scope.assistantId,
               thread_id: threadId,
               tenant_id: this.scope.tenantId,
@@ -2137,7 +2137,7 @@ ${formatFileRefsSection(inputFiles)}` : text;
         const threadId = task ? asString2(task.metadata?.threadId) : void 0;
         if (threadId) {
           try {
-            const agent = import_core55.agentInstanceManager.getAgent({
+            const agent = import_core56.agentInstanceManager.getAgent({
               assistant_id: this.scope.assistantId,
               thread_id: threadId,
               tenant_id: this.scope.tenantId,
@@ -2499,13 +2499,13 @@ function isAsyncGenerator(value) {
 }
 function registerA2AStandardRoutes(app2, deps) {
   const authService = deps.authService;
-  const getTaskStore = deps.getTaskStoreLattice ?? (() => (0, import_core56.getStoreLattice)("default", "task").store);
-  const getTaskWorkItemStore2 = deps.getTaskWorkItemStore ?? (() => (0, import_core56.getStoreLattice)("default", "taskWorkItem").store);
-  const getAssistantStore3 = deps.getAssistantStore ?? (() => (0, import_core56.getStoreLattice)("default", "assistant").store);
-  const getProjectStore2 = deps.getProjectStore ?? (() => (0, import_core56.getStoreLattice)("default", "project").store);
+  const getTaskStore = deps.getTaskStoreLattice ?? (() => (0, import_core57.getStoreLattice)("default", "task").store);
+  const getTaskWorkItemStore2 = deps.getTaskWorkItemStore ?? (() => (0, import_core57.getStoreLattice)("default", "taskWorkItem").store);
+  const getAssistantStore3 = deps.getAssistantStore ?? (() => (0, import_core57.getStoreLattice)("default", "assistant").store);
+  const getProjectStore2 = deps.getProjectStore ?? (() => (0, import_core57.getStoreLattice)("default", "project").store);
   const getTenantStore = deps.getTenantStore ?? (() => {
     try {
-      return (0, import_core56.getStoreLattice)("default", "tenant").store;
+      return (0, import_core57.getStoreLattice)("default", "tenant").store;
     } catch {
       return void 0;
     }
@@ -2520,10 +2520,10 @@ function registerA2AStandardRoutes(app2, deps) {
     const tenantStore = getTenantStore();
     if (!tenantStore) return null;
     const tenants = await tenantStore.getAllTenants();
-    for (const tenant of tenants) {
-      if (tenant.id === tenantId) continue;
+    for (const tenant2 of tenants) {
+      if (tenant2.id === tenantId) continue;
       const found = await getAssistantStore3().getAssistantById(
-        tenant.id,
+        tenant2.id,
         assistantId
       );
       if (found) return found;
@@ -2597,7 +2597,7 @@ function registerA2AStandardRoutes(app2, deps) {
       const taskStore = new A2ATaskStoreAdapter({
         taskStore: internalTaskStore,
         workItemStore,
-        lifecycle: (0, import_core56.createTaskLifecycleService)({
+        lifecycle: (0, import_core57.createTaskLifecycleService)({
           taskStore: internalTaskStore,
           workItemStore
         }),
@@ -2716,7 +2716,7 @@ data: ${JSON.stringify(errorResponse)}
       const taskStore = new A2ATaskStoreAdapter({
         taskStore: internalTaskStore,
         workItemStore,
-        lifecycle: (0, import_core56.createTaskLifecycleService)({
+        lifecycle: (0, import_core57.createTaskLifecycleService)({
           taskStore: internalTaskStore,
           workItemStore
         }),
@@ -2761,13 +2761,13 @@ data: ${JSON.stringify(data)}
     }
   );
 }
-var import_uuid11, import_server2, import_core56, SSE_HEADERS;
+var import_uuid11, import_server2, import_core57, SSE_HEADERS;
 var init_a2a_standard = __esm({
   "src/routes/a2a-standard.ts"() {
     "use strict";
     import_uuid11 = require("uuid");
     import_server2 = require("@a2a-js/sdk/server");
-    import_core56 = require("@axiom-lattice/core");
+    import_core57 = require("@axiom-lattice/core");
     init_A2AAuthService();
     init_A2AAgentCardBuilder();
     init_A2ATaskStoreAdapter();
@@ -2941,12 +2941,12 @@ var resources_exports = {};
 __export(resources_exports, {
   ResourceController: () => ResourceController
 });
-var import_bcryptjs, import_core57, ResourceController;
+var import_bcryptjs, import_core58, ResourceController;
 var init_resources = __esm({
   "src/controllers/resources.ts"() {
     "use strict";
     import_bcryptjs = __toESM(require("bcryptjs"));
-    import_core57 = require("@axiom-lattice/core");
+    import_core58 = require("@axiom-lattice/core");
     init_mime();
     ResourceController = class {
       constructor(deps) {
@@ -2961,14 +2961,14 @@ var init_resources = __esm({
         if (!workspaceId || !projectId) {
           return reply.status(400).send({ error: "x-workspace-id and x-project-id headers required" });
         }
-        const payload = (0, import_core57.createSharePayload)(
+        const payload = (0, import_core58.createSharePayload)(
           tenantId,
           workspaceId,
           projectId,
           userId,
           body
         );
-        const token = (0, import_core57.generateToken)();
+        const token = (0, import_core58.generateToken)();
         try {
           await this.deps.store.create({ ...payload, token });
           this.deps.logger.info(
@@ -3120,7 +3120,7 @@ var init_resources = __esm({
             resourcePath: subPath
           }, subPath, ext, request, reply);
         }
-        const volume = (0, import_core57.buildNamedVolumeName)("p", "project", tenantId, workspaceId, projectId);
+        const volume = (0, import_core58.buildNamedVolumeName)("p", "project", tenantId, workspaceId, projectId);
         return this._resolveAndServe(
           volume,
           subPath,
@@ -3350,8 +3350,8 @@ function resolveLocalA2AWorkingDirectory(options) {
 }
 function validateWorkingDirectory(cwd) {
   try {
-    const stat2 = (0, import_node_fs.statSync)(cwd);
-    if (!stat2.isDirectory()) {
+    const stat3 = (0, import_node_fs.statSync)(cwd);
+    if (!stat3.isDirectory()) {
       return `Working directory is not a directory: ${cwd}`;
     }
     return null;
@@ -4125,8 +4125,8 @@ async function pipeAsyncIterableToSse(raw, stream, options = {}) {
   let closed = raw.destroyed || raw.writableEnded;
   let returned = false;
   let resolveClosed;
-  const closedPromise = new Promise((resolve3) => {
-    resolveClosed = resolve3;
+  const closedPromise = new Promise((resolve4) => {
+    resolveClosed = resolve4;
   });
   const returnConsumer = () => {
     if (returned) return;
@@ -4176,14 +4176,14 @@ async function pipeAsyncIterableToSse(raw, stream, options = {}) {
 async function writeSse(raw, value, closed) {
   if (raw.destroyed || raw.writableEnded) return false;
   if (raw.write(value)) return true;
-  return new Promise((resolve3) => {
+  return new Promise((resolve4) => {
     let settled = false;
     const onDrain = () => finish(!raw.destroyed && !raw.writableEnded);
     const finish = (writable) => {
       if (settled) return;
       settled = true;
       raw.removeListener("drain", onDrain);
-      resolve3(writable);
+      resolve4(writable);
     };
     raw.once("drain", onDrain);
     void closed.then(() => finish(false));
@@ -4395,7 +4395,7 @@ var recoverRun = async (request, reply) => {
     const { assistantId, threadId } = request.params;
     const tenant_id = request.headers["x-tenant-id"];
     const workspace_id = request.headers["x-workspace-id"] || "default";
-    const project_id = request.headers["x-project-id"] || "default";
+    const project_id = request.headers["x-project-id"];
     const agent = import_core3.agentInstanceManager.getAgent({
       assistant_id: assistantId,
       thread_id: threadId,
@@ -4403,8 +4403,7 @@ var recoverRun = async (request, reply) => {
       workspace_id,
       project_id
     });
-    await agent.resumeTask();
-    const status = await agent.getRunStatus();
+    const { status } = await agent.resumeTask();
     reply.status(200).send({
       success: true,
       threadId,
@@ -5291,6 +5290,7 @@ async function getHealth(request, reply) {
 
 // src/services/skill_service.ts
 var import_core10 = require("@axiom-lattice/core");
+var PLUGIN_SKILL_SOURCE = "builtin-plugin";
 function getTenantId4(request) {
   return request.user?.tenantId || request.headers["x-tenant-id"] || "default";
 }
@@ -5306,28 +5306,63 @@ function buildContext(request) {
     projectId: getProjectId(request)
   };
 }
+function pluginSkillToSkill(item, tenantId, content) {
+  return {
+    id: item.id,
+    tenantId,
+    name: item.name,
+    description: item.description,
+    version: item.version,
+    pluginType: item.pluginType,
+    resourcePaths: item.resourcePaths,
+    source: PLUGIN_SKILL_SOURCE,
+    readOnly: true,
+    content,
+    createdAt: /* @__PURE__ */ new Date(0),
+    updatedAt: /* @__PURE__ */ new Date(0)
+  };
+}
 var SkillService = class {
   constructor() {
     this.store = new import_core10.SandboxSkillStore();
   }
   async getAllSkills(request) {
     const tenantId = getTenantId4(request);
-    return this.store.getAllSkills(tenantId, buildContext(request));
+    const storeSkills = await this.store.getAllSkills(tenantId, buildContext(request));
+    const merged = /* @__PURE__ */ new Map();
+    for (const skill of storeSkills) {
+      merged.set(skill.id, skill);
+    }
+    for (const item of import_core10.PluginRegistry.listSkills()) {
+      merged.set(item.id, pluginSkillToSkill(item, tenantId));
+    }
+    return Array.from(merged.values());
   }
   async getSkillById(request, id) {
     const tenantId = getTenantId4(request);
+    const plugin = import_core10.PluginRegistry.getSkill(id);
+    if (plugin) {
+      const { definition } = plugin;
+      const item = import_core10.PluginRegistry.listSkills().find((entry) => entry.id === id);
+      if (item) {
+        return pluginSkillToSkill(item, tenantId, definition.content);
+      }
+    }
     return this.store.getSkillById(tenantId, id, buildContext(request));
   }
   async createSkill(request, id, data) {
     const tenantId = getTenantId4(request);
+    this.assertNotPluginSkill(id, "created");
     return this.store.createSkill(tenantId, id, data, buildContext(request));
   }
   async updateSkill(request, id, updates) {
     const tenantId = getTenantId4(request);
+    this.assertNotPluginSkill(id, "modified");
     return this.store.updateSkill(tenantId, id, updates, buildContext(request));
   }
   async deleteSkill(request, id) {
     const tenantId = getTenantId4(request);
+    this.assertNotPluginSkill(id, "deleted");
     return this.store.deleteSkill(tenantId, id, buildContext(request));
   }
   async searchByMetadata(request, key, value) {
@@ -5342,6 +5377,16 @@ var SkillService = class {
     const tenantId = getTenantId4(request);
     return this.store.filterByLicense(tenantId, license, buildContext(request));
   }
+  /**
+   * Guard against mutating a registered plugin skill.
+   * Message style mirrors SandboxSkillStore built-in errors so the controller's
+   * existing "built-in skill" -> 403 mapping applies.
+   */
+  assertNotPluginSkill(id, action) {
+    if (import_core10.PluginRegistry.getSkill(id)) {
+      throw new Error(`Skill "${id}" is a built-in skill and cannot be ${action}`);
+    }
+  }
 };
 
 // src/controllers/skills.ts
@@ -5356,6 +5401,11 @@ function serializeSkill(skill) {
     metadata: skill.metadata || {},
     content: skill.content,
     subSkills: skill.subSkills,
+    source: skill.source,
+    pluginType: skill.pluginType,
+    version: skill.version,
+    resources: skill.resourcePaths,
+    readOnly: skill.readOnly,
     createdAt: skill.createdAt instanceof Date ? skill.createdAt.toISOString() : (/* @__PURE__ */ new Date()).toISOString(),
     updatedAt: skill.updatedAt instanceof Date ? skill.updatedAt.toISOString() : (/* @__PURE__ */ new Date()).toISOString()
   };
@@ -6977,7 +7027,7 @@ var ExportImportService = class {
     const files = /* @__PURE__ */ new Map();
     let bundle;
     const gunzip = zlib.createGunzip();
-    await new Promise((resolve3, reject) => {
+    await new Promise((resolve4, reject) => {
       let settled = false;
       let entryCount = 0;
       let declaredTotalBytes = 0;
@@ -7097,7 +7147,7 @@ var ExportImportService = class {
       parser.on("end", () => {
         if (settled) return;
         settled = true;
-        resolve3();
+        resolve4();
       });
       gunzip.pipe(parser);
       gunzip.end(buffer);
@@ -7782,6 +7832,20 @@ var dataQuerySchema = {
 };
 
 // src/schemas/index.ts
+var downloadFolderSchema = {
+  description: "Download a workspace project folder as a ZIP archive",
+  tags: ["Workspace"],
+  querystring: {
+    type: "object",
+    properties: {
+      path: { type: "string", minLength: 1 },
+      assistantId: { type: "string", minLength: 1 },
+      tenantId: { type: "string", minLength: 1 }
+    },
+    required: ["path"],
+    additionalProperties: false
+  }
+};
 var getAllMemoryItemsSchema = {
   description: "Get all memory items for an assistant thread",
   tags: ["Memory"],
@@ -8380,6 +8444,7 @@ function registerSandboxProxyRoutes(app2) {
 // src/controllers/workspace.ts
 var fs4 = __toESM(require("fs/promises"));
 var path4 = __toESM(require("path"));
+var import_fs = require("fs");
 var os2 = __toESM(require("os"));
 var import_core24 = require("@axiom-lattice/core");
 var import_core25 = require("@axiom-lattice/core");
@@ -8388,6 +8453,87 @@ var import_uuid3 = require("uuid");
 init_mime();
 init_workspace_file_service();
 init_path_containment();
+var MAX_ZIP_ENTRIES = 1e4;
+var MAX_ZIP_FILE_SIZE = 100 * 1024 * 1024;
+var MAX_ZIP_TOTAL_SIZE = 512 * 1024 * 1024;
+var FolderDownloadError = class extends Error {
+  constructor(statusCode, code, message) {
+    super(message);
+    this.statusCode = statusCode;
+    this.code = code;
+    this.name = "FolderDownloadError";
+  }
+};
+function zipCrc32(data) {
+  let crc = 4294967295;
+  for (const byte of data) {
+    crc ^= byte;
+    for (let bit = 0; bit < 8; bit += 1) {
+      crc = crc >>> 1 ^ 3988292384 & -(crc & 1);
+    }
+  }
+  return (crc ^ 4294967295) >>> 0;
+}
+function createZip(entries) {
+  const localParts = [];
+  const centralParts = [];
+  let offset = 0;
+  for (const entry of entries) {
+    const name = Buffer.from(entry.name, "utf8");
+    const data = entry.data;
+    const crc = zipCrc32(data);
+    const local = Buffer.alloc(30 + name.length + data.length);
+    local.writeUInt32LE(67324752, 0);
+    local.writeUInt16LE(20, 4);
+    local.writeUInt16LE(0, 6);
+    local.writeUInt16LE(2048, 8);
+    local.writeUInt16LE(0, 10);
+    local.writeUInt16LE(0, 12);
+    local.writeUInt32LE(crc, 14);
+    local.writeUInt32LE(data.length, 18);
+    local.writeUInt32LE(data.length, 22);
+    local.writeUInt16LE(name.length, 26);
+    local.writeUInt16LE(0, 28);
+    name.copy(local, 30);
+    data.copy(local, 30 + name.length);
+    localParts.push(local);
+    const central = Buffer.alloc(46 + name.length);
+    central.writeUInt32LE(33639248, 0);
+    central.writeUInt16LE(20, 4);
+    central.writeUInt16LE(20, 6);
+    central.writeUInt16LE(0, 8);
+    central.writeUInt16LE(2048, 10);
+    central.writeUInt16LE(0, 12);
+    central.writeUInt16LE(0, 14);
+    central.writeUInt32LE(crc, 16);
+    central.writeUInt32LE(data.length, 20);
+    central.writeUInt32LE(data.length, 24);
+    central.writeUInt16LE(name.length, 28);
+    central.writeUInt16LE(0, 30);
+    central.writeUInt16LE(0, 32);
+    central.writeUInt16LE(0, 34);
+    central.writeUInt16LE(entry.directory ? 16 : 0, 36);
+    central.writeUInt32LE(entry.directory ? 16 : 0, 38);
+    central.writeUInt32LE(offset, 42);
+    name.copy(central, 46);
+    centralParts.push(central);
+    offset += local.length;
+  }
+  const centralDirectory = Buffer.concat(centralParts);
+  const end = Buffer.alloc(22);
+  end.writeUInt32LE(101010256, 0);
+  end.writeUInt16LE(0, 4);
+  end.writeUInt16LE(0, 6);
+  end.writeUInt16LE(entries.length, 8);
+  end.writeUInt16LE(entries.length, 10);
+  end.writeUInt32LE(centralDirectory.length, 12);
+  end.writeUInt32LE(offset, 16);
+  return Buffer.concat([...localParts, centralDirectory, end]);
+}
+var CAPABILITY_BUNDLE_CONFIG_MESSAGE = "Use /api/projects/:projectId/capability-bundles to update capability bundle IDs";
+function writesCapabilityBundleIds(config) {
+  return config !== void 0 && Object.prototype.hasOwnProperty.call(config, "capabilityBundleIds");
+}
 var WorkspaceController = class {
   constructor() {
     this.workspaceStore = (0, import_core24.getStoreLattice)("default", "workspace").store;
@@ -8495,6 +8641,13 @@ var WorkspaceController = class {
     const tenantId = this.getTenantId(request);
     const { workspaceId } = request.params;
     const data = request.body;
+    if (writesCapabilityBundleIds(data.config)) {
+      return reply.status(400).send({
+        success: false,
+        code: "INVALID_BUNDLE_CONFIG",
+        message: CAPABILITY_BUNDLE_CONFIG_MESSAGE
+      });
+    }
     const id = (0, import_uuid3.v4)();
     const project = await this.projectStore.createProject(
       tenantId,
@@ -8517,6 +8670,13 @@ var WorkspaceController = class {
     const tenantId = this.getTenantId(request);
     const { projectId } = request.params;
     const updates = request.body;
+    if (writesCapabilityBundleIds(updates.config)) {
+      return reply.status(400).send({
+        success: false,
+        code: "INVALID_BUNDLE_CONFIG",
+        message: CAPABILITY_BUNDLE_CONFIG_MESSAGE
+      });
+    }
     const project = await this.projectStore.updateProject(
       tenantId,
       projectId,
@@ -8653,6 +8813,293 @@ var WorkspaceController = class {
       return reply.status(502).send({ success: false, error: `Download proxy error: ${message}` });
     }
   }
+  async downloadFolder(request, reply) {
+    const tenantId = this.getTenantId(request);
+    const { workspaceId, projectId } = request.params;
+    const folderPath = request.query.path;
+    const assistantId = request.query.assistantId;
+    if (!folderPath || folderPath.includes("\\") || folderPath.split("/").includes("..")) {
+      return reply.status(400).send({
+        success: false,
+        error: "Invalid folder path",
+        code: "INVALID_PATH"
+      });
+    }
+    try {
+      const storedWorkspace = await this.workspaceStore.getWorkspaceById(tenantId, workspaceId);
+      if (!storedWorkspace) {
+        throw new FolderDownloadError(404, "WORKSPACE_NOT_FOUND", "Workspace not found");
+      }
+      const project = await this.projectStore.getProjectById(tenantId, projectId);
+      if (!project || project.workspaceId !== workspaceId) {
+        throw new FolderDownloadError(404, "PROJECT_NOT_FOUND", "Project not found");
+      }
+      if (storedWorkspace.storageType === "sandbox") {
+        const sandboxManager = (0, import_core26.getSandBoxManager)();
+        const volumeConfig = {
+          assistant_id: assistantId || "",
+          thread_id: "",
+          tenantId,
+          workspaceId,
+          projectId
+        };
+        const sandbox = await sandboxManager.getSandboxFromConfig(volumeConfig);
+        if (!sandbox.packDirectory || !sandbox.file.deleteFile) {
+          throw new FolderDownloadError(502, "BACKEND_UNSUPPORTED", "Backend does not support folder archive cleanup");
+        }
+        let packed;
+        try {
+          packed = await sandbox.packDirectory(folderPath);
+          if (packed.size === void 0) {
+            throw new FolderDownloadError(502, "BACKEND_UNSUPPORTED", "Backend does not report packed archive size");
+          }
+          if (!Number.isFinite(packed.size) || packed.size < 0 || packed.size > MAX_ZIP_TOTAL_SIZE) {
+            throw new FolderDownloadError(400, "SIZE_LIMIT", "Packed folder exceeds download size limits");
+          }
+          const buffer = await sandbox.file.downloadFile({ file: packed.path });
+          return reply.status(200).type("application/zip").header("Content-Disposition", `attachment; filename*=UTF-8''${encodeURIComponent(packed.filename)}`).send(buffer);
+        } finally {
+          if (packed) {
+            try {
+              await sandbox.file.deleteFile(packed.path);
+            } catch (cleanupError) {
+              console.warn("Failed to clean up packed sandbox folder archive", cleanupError);
+            }
+          }
+        }
+      }
+      const { backend, workspace } = await this.getBackend(
+        tenantId,
+        workspaceId,
+        projectId,
+        assistantId,
+        folderPath
+      );
+      if (!backend.lsInfo) {
+        throw new FolderDownloadError(502, "BACKEND_UNSUPPORTED", "Backend does not support folder downloads");
+      }
+      let listEntries2;
+      if (workspace.storageType !== "sandbox") {
+        const root = filesystemRootDirectory(tenantId, workspaceId, projectId);
+        const target = path4.resolve(root, `.${folderPath.startsWith("/") ? folderPath : `/${folderPath}`}`);
+        const contained = await resolvePathWithinRoot(root, target).catch((error) => {
+          if (error instanceof Error && error.code === "ENOENT") {
+            throw new FolderDownloadError(404, "FOLDER_NOT_FOUND", "Folder not found");
+          }
+          throw error;
+        });
+        let stat3;
+        try {
+          stat3 = await fs4.stat(contained.targetPath);
+        } catch (error) {
+          if (error instanceof Error && error.code === "ENOENT") {
+            throw new FolderDownloadError(404, "FOLDER_NOT_FOUND", "Folder not found");
+          }
+          throw error;
+        }
+        if (!stat3.isDirectory()) {
+          throw new FolderDownloadError(400, "NOT_A_FOLDER", "Path is not a folder");
+        }
+      } else if (folderPath) {
+        const sandboxManager = (0, import_core26.getSandBoxManager)();
+        const volumeConfig = {
+          assistant_id: assistantId || "",
+          thread_id: "",
+          tenantId,
+          workspaceId,
+          projectId
+        };
+        const volume = await sandboxManager.getVolumeBackendForPath(volumeConfig, folderPath);
+        if (!volume) {
+          const sandbox = await sandboxManager.getSandboxFromConfig(volumeConfig);
+          try {
+            await sandbox.file.listPath(folderPath, { recursive: false });
+          } catch (error) {
+            const code = error instanceof Error ? error.code : void 0;
+            const message = error instanceof Error ? error.message : String(error);
+            if (code === "ENOENT" || /not found|no such file|enoent/i.test(message)) {
+              throw new FolderDownloadError(404, "FOLDER_NOT_FOUND", "Folder not found");
+            }
+            throw error;
+          }
+          listEntries2 = async (directoryPath) => {
+            const result = await sandbox.file.listPath(directoryPath, { recursive: false });
+            return result.files;
+          };
+        } else {
+          listEntries2 = async (directoryPath) => backend.lsInfo(directoryPath);
+        }
+      }
+      if (!listEntries2) {
+        listEntries2 = async (directoryPath) => backend.lsInfo(directoryPath);
+      }
+      const folderName = path4.basename(folderPath.replace(/\/$/, "")) || "folder";
+      const prefix = `${folderName}/`;
+      const entries = [{ name: prefix, data: Buffer.alloc(0), directory: true }];
+      let totalSize = 0;
+      const filesystemRoot = workspace.storageType === "sandbox" ? void 0 : filesystemRootDirectory(tenantId, workspaceId, projectId);
+      const addFile = (archivePath, data) => {
+        if (data.length > MAX_ZIP_FILE_SIZE || totalSize + data.length > MAX_ZIP_TOTAL_SIZE) {
+          throw new FolderDownloadError(400, "SIZE_LIMIT", "Folder exceeds download size limits");
+        }
+        totalSize += data.length;
+        entries.push({ name: archivePath, data, directory: false });
+      };
+      const collectFilesystem = async (directoryPath, archivePath) => {
+        let children;
+        try {
+          children = await fs4.readdir(directoryPath, { withFileTypes: true });
+        } catch (error) {
+          if (error instanceof Error && error.code === "ENOENT") {
+            throw new FolderDownloadError(404, "FOLDER_NOT_FOUND", "Folder not found");
+          }
+          throw error;
+        }
+        for (const child of children) {
+          if (entries.length >= MAX_ZIP_ENTRIES) {
+            throw new FolderDownloadError(400, "ENTRY_LIMIT", "Folder contains too many entries");
+          }
+          const childPath = path4.join(directoryPath, child.name);
+          const archiveChildPath = `${archivePath}${child.name}`;
+          let resolvedChild;
+          try {
+            resolvedChild = await resolvePathWithinRoot(filesystemRoot, childPath);
+          } catch (error) {
+            if (error instanceof Error && error.code === "ENOENT") {
+              throw new FolderDownloadError(404, "FOLDER_NOT_FOUND", "Folder not found");
+            }
+            throw new FolderDownloadError(400, "INVALID_PATH", "Folder contains a path outside the project");
+          }
+          let childStat;
+          try {
+            childStat = await fs4.lstat(resolvedChild.targetPath);
+          } catch (error) {
+            if (error instanceof Error && error.code === "ENOENT") {
+              throw new FolderDownloadError(404, "FOLDER_NOT_FOUND", "Folder not found");
+            }
+            throw error;
+          }
+          if (childStat.isSymbolicLink() || child.isSymbolicLink()) {
+            throw new FolderDownloadError(400, "INVALID_PATH", "Symbolic links are not allowed in folder downloads");
+          }
+          if (child.isDirectory()) {
+            entries.push({ name: `${archiveChildPath}/`, data: Buffer.alloc(0), directory: true });
+            await collectFilesystem(resolvedChild.targetPath, `${archiveChildPath}/`);
+          } else if (child.isFile()) {
+            if (childStat.size > MAX_ZIP_FILE_SIZE || totalSize + childStat.size > MAX_ZIP_TOTAL_SIZE) {
+              throw new FolderDownloadError(400, "SIZE_LIMIT", "Folder exceeds download size limits");
+            }
+            const flags = import_fs.constants.O_NOFOLLOW === void 0 ? import_fs.constants.O_RDONLY : import_fs.constants.O_RDONLY | import_fs.constants.O_NOFOLLOW;
+            let handle3;
+            try {
+              handle3 = await fs4.open(resolvedChild.targetPath, flags);
+            } catch (error) {
+              if (error instanceof Error && error.code === "ENOENT") {
+                throw new FolderDownloadError(404, "FOLDER_NOT_FOUND", "Folder not found");
+              }
+              throw error;
+            }
+            try {
+              const openedStat = await handle3.stat();
+              if (!openedStat.isFile() || openedStat.size > MAX_ZIP_FILE_SIZE || totalSize + openedStat.size > MAX_ZIP_TOTAL_SIZE) {
+                throw new FolderDownloadError(400, "SIZE_LIMIT", "Folder exceeds download size limits");
+              }
+              const readLimit = MAX_ZIP_FILE_SIZE + 1;
+              const dataBuffer = Buffer.alloc(Math.min(openedStat.size + 1, readLimit));
+              let bytesRead = 0;
+              while (bytesRead < dataBuffer.length) {
+                const result = await handle3.read(
+                  dataBuffer,
+                  bytesRead,
+                  dataBuffer.length - bytesRead,
+                  bytesRead
+                );
+                if (result.bytesRead === 0) break;
+                bytesRead += result.bytesRead;
+              }
+              const data = dataBuffer.subarray(0, bytesRead);
+              const finalStat = await handle3.stat();
+              if (finalStat.size > MAX_ZIP_FILE_SIZE || totalSize + finalStat.size > MAX_ZIP_TOTAL_SIZE || finalStat.size > data.length) {
+                throw new FolderDownloadError(400, "SIZE_LIMIT", "Folder exceeds download size limits");
+              }
+              addFile(archiveChildPath, data);
+            } finally {
+              await handle3.close();
+            }
+          }
+        }
+      };
+      const collect = async (currentPath, archivePath) => {
+        let children;
+        try {
+          children = await listEntries2(currentPath);
+        } catch (error) {
+          const message = error instanceof Error ? error.message : String(error);
+          if (/not found|enoent|no such file/i.test(message)) {
+            throw new FolderDownloadError(404, "FOLDER_NOT_FOUND", "Folder not found");
+          }
+          throw error;
+        }
+        for (const child of children) {
+          if (entries.length >= MAX_ZIP_ENTRIES) {
+            throw new FolderDownloadError(400, "ENTRY_LIMIT", "Folder contains too many entries");
+          }
+          const childPath = child.path;
+          if (childPath.includes("\\") || childPath.split("/").includes("..") || !childPath.startsWith(folderPath.endsWith("/") ? folderPath : `${folderPath}/`)) {
+            throw new FolderDownloadError(400, "INVALID_PATH", "Folder contains an unsafe child path");
+          }
+          if (workspace.storageType !== "sandbox") {
+            const root = filesystemRootDirectory(tenantId, workspaceId, projectId);
+            const virtualChildPath = childPath.startsWith("/") ? childPath : `/${childPath}`;
+            const target = path4.resolve(root, `.${virtualChildPath}`);
+            try {
+              await resolvePathWithinRoot(root, target);
+              const childStat = await fs4.lstat(target);
+              if (childStat.isSymbolicLink()) {
+                throw new FolderDownloadError(400, "INVALID_PATH", "Symbolic links are not allowed in folder downloads");
+              }
+            } catch (error) {
+              if (error instanceof FolderDownloadError) throw error;
+              if (error instanceof Error && error.code === "ENOENT") {
+                throw new FolderDownloadError(404, "FOLDER_NOT_FOUND", "Folder not found");
+              }
+              throw new FolderDownloadError(400, "INVALID_PATH", "Folder contains a path outside the project");
+            }
+          }
+          const childName = path4.basename(childPath.replace(/\/$/, ""));
+          const childArchivePath = `${archivePath}${childName}`;
+          if (child.is_dir) {
+            entries.push({ name: `${childArchivePath}/`, data: Buffer.alloc(0), directory: true });
+            await collect(childPath, `${childArchivePath}/`);
+          } else {
+            const size = child.size ?? 0;
+            if (size > MAX_ZIP_FILE_SIZE || totalSize + size > MAX_ZIP_TOTAL_SIZE) {
+              throw new FolderDownloadError(400, "SIZE_LIMIT", "Folder exceeds download size limits");
+            }
+            const data = await backend.readBinary(childPath);
+            addFile(childArchivePath, data);
+          }
+        }
+      };
+      if (workspace.storageType === "sandbox") {
+        await collect(folderPath, prefix);
+      } else {
+        const root = filesystemRoot;
+        const target = path4.resolve(root, `.${folderPath.startsWith("/") ? folderPath : `/${folderPath}`}`);
+        await collectFilesystem(target, prefix);
+      }
+      const zip = createZip(entries);
+      const downloadName = `${folderName}.zip`;
+      return reply.status(200).type("application/zip").header("Content-Disposition", `attachment; filename*=UTF-8''${encodeURIComponent(downloadName)}`).send(zip);
+    } catch (error) {
+      const folderError = error instanceof FolderDownloadError ? error : error instanceof PathOutsideRootError || error instanceof Error && ["ELOOP", "ENOTDIR", "EACCES"].includes(error.code || "") ? new FolderDownloadError(400, "INVALID_PATH", "Folder contains a path outside the project") : new FolderDownloadError(502, "DOWNLOAD_FAILED", error instanceof Error ? error.message : String(error));
+      return reply.status(folderError.statusCode).send({
+        success: false,
+        error: folderError.message,
+        code: folderError.code
+      });
+    }
+  }
   /**
    * View a file inline in the browser (not download).
    * Returns file content with inline Content-Disposition for preview.
@@ -8945,6 +9392,11 @@ function registerWorkspaceRoutes(app2) {
     "/api/workspaces/:workspaceId/projects/:projectId/downloadfile",
     controller.downloadFile.bind(controller)
   );
+  app2.get(
+    "/api/workspaces/:workspaceId/projects/:projectId/downloadfolder",
+    { schema: downloadFolderSchema },
+    controller.downloadFolder.bind(controller)
+  );
   app2.get(
     "/api/workspaces/:workspaceId/projects/:projectId/viewfile",
     controller.viewFile.bind(controller)
@@ -9169,7 +9621,7 @@ async function testDatabaseConnection(request, reply) {
       await db.connect();
       await db.listTables();
       const latency = Date.now() - startTime;
-      await new Promise((resolve3) => setTimeout(resolve3, 100));
+      await new Promise((resolve4) => setTimeout(resolve4, 100));
       await db.disconnect();
       await import_core27.sqlDatabaseManager.removeDatabase(tenantId, testKey);
       return {
@@ -9986,6 +10438,7 @@ var import_uuid5 = require("uuid");
 var import_events = require("events");
 var import_core31 = require("@axiom-lattice/core");
 var import_uuid4 = require("uuid");
+var TERMINAL_PERSIST_ATTEMPTS = 2;
 function mapLogs(logs) {
   return logs.map((l) => ({
     timestamp: l.ts,
@@ -9997,18 +10450,42 @@ function mapLogs(logs) {
 var EvalRunner = class {
   constructor() {
     this.runs = /* @__PURE__ */ new Map();
+    this.projectLeases = /* @__PURE__ */ new Map();
     this.eventEmitter = new import_events.EventEmitter();
     this.processStartedAt = /* @__PURE__ */ new Date();
   }
   getEventEmitter() {
     return this.eventEmitter;
   }
+  reserveProjectDeletion(tenantId, projectId) {
+    const leaseKey = `${tenantId}:${projectId}`;
+    if (this.projectLeases.has(leaseKey) || [...this.runs.values()].some(
+      (ctx) => ctx.tenantId === tenantId && ctx.projectId === projectId && !ctx.terminal.workerSettled
+    )) return null;
+    const leaseToken = Symbol(`delete:${leaseKey}`);
+    this.projectLeases.set(leaseKey, leaseToken);
+    return () => this.releaseProjectLease(leaseKey, leaseToken);
+  }
   async startRun(tenantId, projectId, suiteIds, caseIds, runConfig, taskId) {
+    const leaseKey = `${tenantId}:${projectId}`;
+    if (this.projectLeases.has(leaseKey)) {
+      throw new Error("A run is already in progress for this project");
+    }
+    const leaseToken = Symbol(leaseKey);
+    this.projectLeases.set(leaseKey, leaseToken);
+    try {
+      return await this.startLeasedRun(tenantId, projectId, suiteIds, caseIds, runConfig, taskId, leaseKey, leaseToken);
+    } catch (error) {
+      this.releaseProjectLease(leaseKey, leaseToken);
+      throw error;
+    }
+  }
+  async startLeasedRun(tenantId, projectId, suiteIds, caseIds, runConfig, taskId, leaseKey, leaseToken) {
     const store2 = this.getEvalStore();
     const project = await store2.getProjectById(tenantId, projectId);
     if (!project) throw new Error("Project not found");
     for (const ctx of this.runs.values()) {
-      if (ctx.projectId === projectId) {
+      if (ctx.projectId === projectId && !ctx.terminal.persisted) {
         throw new Error("A run is already in progress for this project");
       }
     }
@@ -10112,14 +10589,35 @@ var EvalRunner = class {
     };
     const abortController = new AbortController();
     const stats = { passed: 0, failed: 0, interrupted: 0, totalScore: 0 };
+    const terminal = { claiming: false, persisted: false, workerSettled: false };
+    const terminalUnavailable = () => terminal.claiming || terminal.persisted;
+    const persistTerminal = async (update, event) => {
+      if (terminalUnavailable()) return false;
+      terminal.claiming = true;
+      try {
+        let lastError;
+        for (let attempt = 0; attempt < TERMINAL_PERSIST_ATTEMPTS; attempt++) {
+          try {
+            const persistedRun = await store2.updateRunStatus(tenantId, runId, update);
+            if (!persistedRun) throw new Error(`Evaluation run ${runId} no longer exists`);
+            lastError = void 0;
+            break;
+          } catch (error) {
+            lastError = error;
+          }
+        }
+        if (lastError) throw lastError;
+        terminal.persisted = true;
+        this.eventEmitter.emit(`run:${runId}`, event);
+        return true;
+      } finally {
+        terminal.claiming = false;
+      }
+    };
     const onCaseComplete = async (result, suiteName) => {
+      if (terminalUnavailable()) return;
       const passed = result.result?.pass ?? false;
       const score = result.result?.final_score ?? 0;
-      if (passed) stats.passed++;
-      else stats.failed++;
-      stats.totalScore += score;
-      if (result.interrupted) stats.interrupted++;
-      const completedCount = stats.passed + stats.failed;
       await store2.createRunResult(tenantId, runId, (0, import_uuid4.v4)(), {
         suiteName,
         caseId: result.caseId,
@@ -10137,13 +10635,22 @@ var EvalRunner = class {
         error: result.error,
         interrupted: result.interrupted
       });
+      if (terminalUnavailable()) return;
+      if (passed) stats.passed++;
+      else stats.failed++;
+      stats.totalScore += score;
+      if (result.interrupted) stats.interrupted++;
+      const completedCount = stats.passed + stats.failed;
+      if (terminalUnavailable()) return;
       const avgScore = completedCount > 0 ? stats.totalScore / completedCount : 0;
-      await store2.updateRunStatus(tenantId, runId, {
+      const persistedRun = await store2.updateRunStatus(tenantId, runId, {
         passedCases: stats.passed,
         failedCases: stats.failed,
         interruptedCases: stats.interrupted,
         avgScore
       });
+      if (!persistedRun) throw new Error(`Evaluation run ${runId} no longer exists`);
+      if (terminalUnavailable()) return;
       this.eventEmitter.emit(`run:${runId}`, {
         type: "progress",
         runId,
@@ -10155,65 +10662,86 @@ var EvalRunner = class {
         const evalProject = new import_core31.LatticeEvalProject(projectConfig, onCaseComplete);
         const calibration = await evalProject.calibrateJudge();
         if (!calibration.ok && !calibration.bypassed) {
-          await store2.updateRunStatus(tenantId, runId, {
-            status: "failed",
-            error: `Judge calibration failed: ${calibration.reason}`,
-            completedAt: /* @__PURE__ */ new Date()
-          });
           throw new Error(`Judge calibration failed: ${calibration.reason}`);
         }
         if (calibration.bypassed) {
           console.warn(`[eval-runner] Judge calibration bypassed \u2014 judge may be unreliable: ${calibration.reason}`);
         }
         const { report } = await evalProject.runAllSuitesBatch(concurrency, abortController.signal);
-        if (!abortController.signal.aborted) {
-          const completedCount = stats.passed + stats.failed;
-          await store2.updateRunStatus(tenantId, runId, {
-            status: "completed",
-            completedAt: /* @__PURE__ */ new Date(),
-            passedCases: stats.passed,
-            failedCases: stats.failed,
-            interruptedCases: stats.interrupted,
-            avgScore: completedCount > 0 ? stats.totalScore / completedCount : 0
-          });
-          this.eventEmitter.emit(`run:${runId}`, {
-            type: "completed",
-            runId,
-            data: { passed: stats.passed, failed: stats.failed, avgScore: completedCount > 0 ? stats.totalScore / completedCount : 0 }
-          });
-        }
+        const completedCount = stats.passed + stats.failed;
+        await persistTerminal({
+          status: "completed",
+          completedAt: /* @__PURE__ */ new Date(),
+          passedCases: stats.passed,
+          failedCases: stats.failed,
+          interruptedCases: stats.interrupted,
+          avgScore: completedCount > 0 ? stats.totalScore / completedCount : 0
+        }, {
+          type: "completed",
+          runId,
+          data: { passed: stats.passed, failed: stats.failed, avgScore: completedCount > 0 ? stats.totalScore / completedCount : 0 }
+        });
         return { report };
       } catch (err) {
         const errorMsg = err.message;
-        if (!abortController.signal.aborted) {
-          await store2.updateRunStatus(tenantId, runId, {
+        try {
+          await persistTerminal({
             status: "failed",
             error: errorMsg,
             completedAt: /* @__PURE__ */ new Date()
-          });
-          this.eventEmitter.emit(`run:${runId}`, {
+          }, {
             type: "error",
             runId,
             data: { message: errorMsg }
           });
+        } catch {
         }
         throw err;
       } finally {
-        this.runs.delete(runId);
+        terminal.workerSettled = true;
+        if (terminal.persisted) {
+          this.runs.delete(runId);
+          this.releaseProjectLease(leaseKey, leaseToken);
+        }
       }
     })();
-    this.runs.set(runId, { runId, projectId, tenantId, abortController, promise: runPromise, taskId });
+    this.runs.set(runId, { runId, projectId, tenantId, abortController, promise: runPromise, terminal, leaseKey, leaseToken, taskId });
     runPromise.catch(() => {
     });
     return runId;
   }
-  async abortRun(runId) {
+  async abortRun(runId, tenantId) {
     const ctx = this.runs.get(runId);
-    if (!ctx) return false;
+    if (!ctx || tenantId !== void 0 && ctx.tenantId !== tenantId) return false;
+    if (ctx.terminal.claiming || ctx.terminal.persisted) return false;
     ctx.abortController.abort();
     const store2 = this.getEvalStore();
-    await store2.updateRunStatus(ctx.tenantId, runId, { status: "aborted", completedAt: /* @__PURE__ */ new Date() });
-    return true;
+    ctx.terminal.claiming = true;
+    try {
+      let lastError;
+      for (let attempt = 0; attempt < TERMINAL_PERSIST_ATTEMPTS; attempt++) {
+        try {
+          const persistedRun = await store2.updateRunStatus(ctx.tenantId, runId, { status: "aborted", completedAt: /* @__PURE__ */ new Date() });
+          if (!persistedRun) throw new Error(`Evaluation run ${runId} no longer exists`);
+          lastError = void 0;
+          break;
+        } catch (error) {
+          lastError = error;
+        }
+      }
+      if (lastError) throw lastError;
+      ctx.terminal.persisted = true;
+      this.eventEmitter.emit(`run:${runId}`, {
+        type: "error",
+        runId,
+        data: { message: "Run aborted" }
+      });
+      this.releaseProjectLease(ctx.leaseKey, ctx.leaseToken);
+      if (ctx.terminal.workerSettled) this.runs.delete(runId);
+      return true;
+    } finally {
+      ctx.terminal.claiming = false;
+    }
   }
   async waitForRun(runId) {
     const ctx = this.runs.get(runId);
@@ -10221,12 +10749,25 @@ var EvalRunner = class {
     const { report } = await ctx.promise;
     return report;
   }
-  isRunning(runId) {
-    return this.runs.has(runId);
+  /**
+   * Whether the run can still be controlled or observed as a non-terminal run.
+   * Acknowledged aborts return false even while their worker is unwinding.
+   */
+  isRunning(runId, tenantId) {
+    const ctx = this.runs.get(runId);
+    return ctx !== void 0 && !ctx.terminal.persisted && (tenantId === void 0 || ctx.tenantId === tenantId);
+  }
+  /** Whether the run's worker promise has not yet reached its finally block. */
+  hasActiveExecution(runId, tenantId) {
+    const ctx = this.runs.get(runId);
+    return ctx !== void 0 && !ctx.terminal.workerSettled && (tenantId === void 0 || ctx.tenantId === tenantId);
   }
   getEvalStore() {
     return (0, import_core31.getStoreLattice)("default", "eval").store;
   }
+  releaseProjectLease(leaseKey, leaseToken) {
+    if (this.projectLeases.get(leaseKey) === leaseToken) this.projectLeases.delete(leaseKey);
+  }
 };
 var evalRunner = new EvalRunner();
 
@@ -10241,6 +10782,18 @@ function getTenantId12(request) {
 function getEvalStore() {
   return (0, import_core32.getStoreLattice)("default", "eval").store;
 }
+async function getOwnedSuite(store2, tenantId, projectId, suiteId) {
+  const project = await store2.getProjectById(tenantId, projectId);
+  if (!project) return null;
+  const suite = await store2.getSuiteById(tenantId, suiteId);
+  return suite?.projectId === projectId ? suite : null;
+}
+async function getOwnedCase(store2, tenantId, projectId, suiteId, caseId) {
+  const suite = await getOwnedSuite(store2, tenantId, projectId, suiteId);
+  if (!suite) return null;
+  const evalCase = await store2.getCaseById(tenantId, caseId);
+  return evalCase?.suiteId === suiteId ? evalCase : null;
+}
 async function createProject(request, reply) {
   try {
     const tenantId = getTenantId12(request);
@@ -10396,6 +10949,7 @@ async function updateProject(request, reply) {
   }
 }
 async function deleteProject(request, reply) {
+  let releaseDeletion;
   try {
     const tenantId = getTenantId12(request);
     const store2 = getEvalStore();
@@ -10404,6 +10958,23 @@ async function deleteProject(request, reply) {
     if (!existing) {
       return reply.status(404).send({ success: false, message: "Project not found" });
     }
+    releaseDeletion = evalRunner.reserveProjectDeletion(tenantId, pid) ?? void 0;
+    if (!releaseDeletion) {
+      return reply.status(409).send({
+        success: false,
+        message: "Cannot delete an evaluation project with an active run"
+      });
+    }
+    const runs = await store2.getRunsByTenant(tenantId, { projectId: pid });
+    const hasActiveRun = runs.some(
+      (run) => run.status === "running" || evalRunner.hasActiveExecution(run.id, tenantId)
+    );
+    if (hasActiveRun) {
+      return reply.status(409).send({
+        success: false,
+        message: "Cannot delete an evaluation project with an active run"
+      });
+    }
     const deleted = await store2.deleteProject(tenantId, pid);
     if (!deleted) {
       return reply.status(500).send({ success: false, message: "Failed to delete project" });
@@ -10412,6 +10983,8 @@ async function deleteProject(request, reply) {
   } catch (err) {
     const message = err instanceof Error ? err.message : "Failed to delete project";
     return reply.status(500).send({ success: false, message });
+  } finally {
+    releaseDeletion?.();
   }
 }
 async function createSuite(request, reply) {
@@ -10440,8 +11013,8 @@ async function updateSuite(request, reply) {
   try {
     const tenantId = getTenantId12(request);
     const store2 = getEvalStore();
-    const { sid } = request.params;
-    const existing = await store2.getSuiteById(tenantId, sid);
+    const { pid, sid } = request.params;
+    const existing = await getOwnedSuite(store2, tenantId, pid, sid);
     if (!existing) {
       return reply.status(404).send({ success: false, message: "Suite not found" });
     }
@@ -10460,8 +11033,8 @@ async function deleteSuite(request, reply) {
   try {
     const tenantId = getTenantId12(request);
     const store2 = getEvalStore();
-    const { sid } = request.params;
-    const existing = await store2.getSuiteById(tenantId, sid);
+    const { pid, sid } = request.params;
+    const existing = await getOwnedSuite(store2, tenantId, pid, sid);
     if (!existing) {
       return reply.status(404).send({ success: false, message: "Suite not found" });
     }
@@ -10479,8 +11052,8 @@ async function createCase(request, reply) {
   try {
     const tenantId = getTenantId12(request);
     const store2 = getEvalStore();
-    const { sid } = request.params;
-    const suite = await store2.getSuiteById(tenantId, sid);
+    const { pid, sid } = request.params;
+    const suite = await getOwnedSuite(store2, tenantId, pid, sid);
     if (!suite) {
       return reply.status(404).send({ success: false, message: "Suite not found" });
     }
@@ -10509,7 +11082,11 @@ async function listCasesForSuite(request, reply) {
   try {
     const tenantId = getTenantId12(request);
     const store2 = getEvalStore();
-    const { sid } = request.params;
+    const { pid, sid } = request.params;
+    const suite = await getOwnedSuite(store2, tenantId, pid, sid);
+    if (!suite) {
+      return reply.status(404).send({ success: false, message: "Suite not found" });
+    }
     const cases = await store2.getCasesBySuite(tenantId, sid);
     return {
       success: true,
@@ -10525,8 +11102,8 @@ async function updateCase(request, reply) {
   try {
     const tenantId = getTenantId12(request);
     const store2 = getEvalStore();
-    const { cid } = request.params;
-    const existing = await store2.getCaseById(tenantId, cid);
+    const { pid, sid, cid } = request.params;
+    const existing = await getOwnedCase(store2, tenantId, pid, sid, cid);
     if (!existing) {
       return reply.status(404).send({ success: false, message: "Case not found" });
     }
@@ -10545,8 +11122,8 @@ async function deleteCase(request, reply) {
   try {
     const tenantId = getTenantId12(request);
     const store2 = getEvalStore();
-    const { cid } = request.params;
-    const existing = await store2.getCaseById(tenantId, cid);
+    const { pid, sid, cid } = request.params;
+    const existing = await getOwnedCase(store2, tenantId, pid, sid, cid);
     if (!existing) {
       return reply.status(404).send({ success: false, message: "Case not found" });
     }
@@ -10615,6 +11192,11 @@ function registerEvalRoutes(app2) {
     }
   });
   app2.get("/api/eval/runs/:rid/stream", async (request, reply) => {
+    const tenantId = getTenantId12(request);
+    const { rid } = request.params;
+    const store2 = getEvalStore();
+    const ownedRun = await store2.getRunById(tenantId, rid);
+    if (!ownedRun) return reply.status(404).send({ success: false, message: "Run not found" });
     reply.hijack();
     reply.raw.writeHead(200, {
       "Content-Type": "text/event-stream",
@@ -10622,41 +11204,75 @@ function registerEvalRoutes(app2) {
       Connection: "keep-alive",
       "Access-Control-Allow-Origin": "*"
     });
-    const { rid } = request.params;
     const emitter = evalRunner.getEventEmitter();
     const eventKey = `run:${rid}`;
-    if (!evalRunner.isRunning(rid)) {
-      const tenantId = getTenantId12(request);
-      const run = await getEvalStore().getRunById(tenantId, rid);
-      if (run) {
-        const eventType = run.status === "completed" ? "completed" : "error";
-        reply.raw.write(`event: ${eventType}
-data: ${JSON.stringify({ passed: run.passedCases, failed: run.failedCases, avgScore: run.avgScore })}
+    let settled = false;
+    const cleanup = () => {
+      emitter.off(eventKey, handler);
+      request.raw.off("close", disconnect);
+    };
+    const disconnect = () => {
+      if (settled) return;
+      settled = true;
+      cleanup();
+    };
+    const finish = (type, data) => {
+      if (settled) return;
+      settled = true;
+      cleanup();
+      reply.raw.write(`event: ${type}
+data: ${JSON.stringify(data)}
 
 `);
-      }
       reply.raw.end();
-      return;
-    }
+    };
     const handler = (event) => {
-      reply.raw.write(`event: ${event.type}
+      if (event.type === "completed" || event.type === "error") {
+        finish(event.type, event.data);
+        return;
+      }
+      if (!settled) reply.raw.write(`event: ${event.type}
 data: ${JSON.stringify(event.data)}
 
 `);
-      if (event.type === "completed" || event.type === "error") {
-        emitter.off(eventKey, handler);
-        reply.raw.end();
-      }
     };
     emitter.on(eventKey, handler);
-    request.raw.on("close", () => {
-      emitter.off(eventKey, handler);
-    });
+    request.raw.on("close", disconnect);
+    let reconciledRun;
+    try {
+      reconciledRun = await store2.getRunById(tenantId, rid);
+    } catch (error) {
+      finish("error", { message: error.message });
+      return;
+    }
+    if (settled) return;
+    if (!reconciledRun) {
+      cleanup();
+      reply.raw.end();
+      return;
+    }
+    if (reconciledRun.status === "completed") {
+      finish("completed", {
+        passed: reconciledRun.passedCases,
+        failed: reconciledRun.failedCases,
+        avgScore: reconciledRun.avgScore
+      });
+    } else if (reconciledRun.status === "failed") {
+      finish("error", { message: reconciledRun.error ?? "Evaluation failed" });
+    } else if (reconciledRun.status === "aborted") {
+      finish("error", { message: "Run aborted" });
+    } else if (!evalRunner.isRunning(rid, tenantId)) {
+      cleanup();
+      reply.raw.end();
+    }
   });
   app2.post("/api/eval/runs/:rid/abort", async (request, reply) => {
     try {
+      const tenantId = getTenantId12(request);
       const { rid } = request.params;
-      const aborted = await evalRunner.abortRun(rid);
+      const run = await getEvalStore().getRunById(tenantId, rid);
+      if (!run) return reply.status(404).send({ success: false, message: "Run not found" });
+      const aborted = await evalRunner.abortRun(rid, tenantId);
       if (!aborted) return reply.status(404).send({ success: false, message: "Run not found or not running" });
       reply.send({ success: true, message: "Run aborted" });
     } catch (err) {
@@ -10667,7 +11283,13 @@ data: ${JSON.stringify(event.data)}
     try {
       const tenantId = getTenantId12(request);
       const { rid } = request.params;
-      const deleted = await getEvalStore().deleteRun(tenantId, rid);
+      const store2 = getEvalStore();
+      const run = await store2.getRunById(tenantId, rid);
+      if (!run) return reply.status(404).send({ success: false, message: "Run not found" });
+      if (run.status === "running" || evalRunner.hasActiveExecution(rid, tenantId)) {
+        return reply.status(409).send({ success: false, message: "Cannot delete an active evaluation run" });
+      }
+      const deleted = await store2.deleteRun(tenantId, rid);
       if (!deleted) return reply.status(404).send({ success: false, message: "Run not found" });
       reply.send({ success: true, message: "Run deleted" });
     } catch (err) {
@@ -10784,31 +11406,31 @@ var TenantsController = class {
   async createTenant(request, reply) {
     const data = request.body;
     const id = (0, import_uuid7.v4)();
-    const tenant = await this.tenantStore.createTenant(id, data);
-    return reply.status(201).send({ success: true, data: tenant });
+    const tenant2 = await this.tenantStore.createTenant(id, data);
+    return reply.status(201).send({ success: true, data: tenant2 });
   }
   async getTenant(request, reply) {
     const { tenantId } = request.params;
-    const tenant = await this.tenantStore.getTenantById(tenantId);
-    if (!tenant) {
+    const tenant2 = await this.tenantStore.getTenantById(tenantId);
+    if (!tenant2) {
       return reply.status(404).send({
         success: false,
         error: "Tenant not found"
       });
     }
-    return { success: true, data: tenant };
+    return { success: true, data: tenant2 };
   }
   async updateTenant(request, reply) {
     const { tenantId } = request.params;
     const updates = request.body;
-    const tenant = await this.tenantStore.updateTenant(tenantId, updates);
-    if (!tenant) {
+    const tenant2 = await this.tenantStore.updateTenant(tenantId, updates);
+    if (!tenant2) {
       return reply.status(404).send({
         success: false,
         error: "Tenant not found"
       });
     }
-    return { success: true, data: tenant };
+    return { success: true, data: tenant2 };
   }
   async deleteTenant(request, reply) {
     const { tenantId } = request.params;
@@ -10961,10 +11583,10 @@ var AuthController = class {
       const links = await this.userTenantLinkStore.getTenantsByUser(userId);
       const tenantsWithDetails = await Promise.all(
         links.map(async (link) => {
-          const tenant = await this.tenantStore.getTenantById(link.tenantId);
+          const tenant2 = await this.tenantStore.getTenantById(link.tenantId);
           return {
             ...link,
-            tenant: tenant || null
+            tenant: tenant2 || null
           };
         })
       );
@@ -10997,8 +11619,8 @@ var AuthController = class {
           error: "You do not have access to this tenant"
         });
       }
-      const tenant = await this.tenantStore.getTenantById(tenantId);
-      if (!tenant) {
+      const tenant2 = await this.tenantStore.getTenantById(tenantId);
+      if (!tenant2) {
         return reply.status(404).send({
           success: false,
           error: "Tenant not found"
@@ -11022,7 +11644,7 @@ var AuthController = class {
       return {
         success: true,
         data: {
-          tenant,
+          tenant: tenant2,
           token,
           personalAssistant
         }
@@ -11092,8 +11714,8 @@ var AuthController = class {
           error: "User not found"
         });
       }
-      const tenant = await this.tenantStore.getTenantById(tenantId);
-      if (!tenant) {
+      const tenant2 = await this.tenantStore.getTenantById(tenantId);
+      if (!tenant2) {
         return reply.status(404).send({
           success: false,
           error: "Tenant not found"
@@ -11263,7 +11885,7 @@ function registerConsoleAuthHook(app2, options) {
     if (PUBLIC_ROUTES.some((route) => request.url === route)) return;
     if (request.url.startsWith("/s/")) return;
     const path6 = request.url.split("?")[0];
-    if (path6.includes("/viewfile") || path6.includes("/downloadfile") || path6.includes("/uploadfile") || path6.startsWith("/f/") || path6 === "/f") {
+    if (request.method === "GET" && /^\/api\/workspaces\/[^/]+\/projects\/[^/]+\/viewfile$/.test(path6) || request.method === "GET" && /^\/api\/workspaces\/[^/]+\/projects\/[^/]+\/downloadfile$/.test(path6) || request.method === "POST" && /^\/api\/workspaces\/[^/]+\/projects\/[^/]+\/uploadfile$/.test(path6) || path6.startsWith("/f/") || path6 === "/f") {
       return;
     }
     await reply.status(401).send({
@@ -12266,12 +12888,12 @@ async function handleBridgeProxy(request, reply) {
   };
   const timeout = 3e5;
   try {
-    const response = await new Promise((resolve3, reject) => {
+    const response = await new Promise((resolve4, reject) => {
       const timer = setTimeout(() => {
         pending.delete(requestId);
         reject(new Error(`Bridge request timeout after ${timeout}ms`));
       }, timeout);
-      pending.set(requestId, { resolve: resolve3, reject, timer, agentId });
+      pending.set(requestId, { resolve: resolve4, reject, timer, agentId });
       try {
         if (conn.ws.readyState !== conn.ws.OPEN) {
           pending.delete(requestId);
@@ -12938,7 +13560,7 @@ function registerTaskRoutes(app2) {
 }
 
 // src/routes/index.ts
-var import_core41 = require("@axiom-lattice/core");
+var import_core42 = require("@axiom-lattice/core");
 
 // src/services/agent-web-app/AgentWebAppService.ts
 function createConfiguredAgentResolver(registry) {
@@ -13897,42 +14519,399 @@ function isAttachmentPayload(value) {
 
 // src/routes/index.ts
 init_workspace_file_service();
+
+// src/controllers/capability-bundles.ts
+var import_zod7 = require("zod");
+
+// src/services/capability/CapabilityBundleService.ts
+var import_zod6 = require("zod");
+var import_core41 = require("@axiom-lattice/core");
+var CapabilityBundleServiceError = class extends Error {
+  constructor(code, message, statusCode) {
+    super(message);
+    this.code = code;
+    this.statusCode = statusCode;
+    this.name = "CapabilityBundleServiceError";
+  }
+};
+var uuid = import_zod6.z.string().uuid();
+function ownRecord(value) {
+  if (value === void 0 || value === null) return {};
+  if (typeof value !== "object" || Array.isArray(value)) throw new CapabilityBundleServiceError("INVALID_BUNDLE_CONFIG", "Project config must be an object", 409);
+  const result = {};
+  for (const [key, entry] of Object.entries(value)) {
+    if (key !== "__proto__" && key !== "constructor" && key !== "prototype") result[key] = entry;
+  }
+  return result;
+}
+function isDuplicate(error) {
+  return error instanceof Error && /already exists|unique|duplicate/i.test(error.message);
+}
+function rejectStableKey(input) {
+  if (input !== null && typeof input === "object" && !Array.isArray(input) && Object.prototype.hasOwnProperty.call(input, "key")) {
+    throw new CapabilityBundleServiceError("INVALID_INPUT", "Capability bundle key is generated and cannot be supplied or changed", 400);
+  }
+}
+function slugify(name) {
+  const slug = name.trim().toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
+  return slug || "runtime-profile";
+}
+function projectBundleIds(config) {
+  const record = ownRecord(config);
+  if (!Object.prototype.hasOwnProperty.call(record, "capabilityBundleIds")) return [];
+  const value = record.capabilityBundleIds;
+  if (!Array.isArray(value) || value.some((id) => typeof id !== "string" || !uuid.safeParse(id).success) || new Set(value).size !== value.length) {
+    throw new CapabilityBundleServiceError("INVALID_BUNDLE_CONFIG", "Project capabilityBundleIds must be a unique array of UUIDs", 409);
+  }
+  return [...value];
+}
+function issue(error) {
+  if (error instanceof import_core41.CapabilityBundleMergeError || error instanceof import_core41.CapabilityBundleValidationError) return { code: error instanceof import_core41.CapabilityBundleValidationError && error.code === "CAPABILITY_BUNDLE_INVALID_CONFIG" ? "INVALID_BUNDLE_CONFIG" : error.code, message: error.message, bundleId: error instanceof import_core41.CapabilityBundleMergeError ? error.bundleId : void 0, capabilityType: error.capabilityType, fieldPath: error.fieldPath };
+  return { code: "CAPABILITY_BUNDLE_CONFIGURATION_ERROR", message: error instanceof Error ? error.message : "Invalid capability bundle configuration" };
+}
+var CapabilityBundleService = class {
+  constructor(deps) {
+    this.deps = deps;
+  }
+  async list(tenantId) {
+    const values = await this.deps.bundleStore.listByTenant(tenantId);
+    const bundles = [];
+    const errors = [];
+    for (const value of values) {
+      try {
+        (0, import_core41.validateCapabilityBundleInput)(value);
+        bundles.push(value);
+      } catch {
+        errors.push({ bundleId: value.id, code: "INVALID_BUNDLE_CONFIG", message: "Capability bundle record is invalid" });
+      }
+    }
+    return { bundles, errors };
+  }
+  async get(tenantId, id) {
+    const value = await this.deps.bundleStore.getById(tenantId, id);
+    if (!value) throw new CapabilityBundleServiceError("BUNDLE_NOT_FOUND", "Capability bundle not found", 404);
+    try {
+      (0, import_core41.validateCapabilityBundleInput)(value);
+    } catch {
+      throw new CapabilityBundleServiceError("INVALID_BUNDLE_CONFIG", "Capability bundle record is invalid", 422);
+    }
+    return value;
+  }
+  async create(tenantId, input) {
+    rejectStableKey(input);
+    (0, import_core41.validateCapabilityBundleInput)(input);
+    const value = input;
+    const name = value.name.trim();
+    const base = slugify(name);
+    for (let attempt = 0; attempt < 5; attempt += 1) {
+      const existing = await this.deps.bundleStore.listByTenant(tenantId) ?? [];
+      const keys = new Set(existing.map((bundle) => bundle.key));
+      let key = base;
+      let suffix = 2;
+      while (keys.has(key)) key = `${base}-${suffix++}`;
+      const normalized = { ...value, key, name };
+      (0, import_core41.validateCapabilityBundleInput)(normalized);
+      try {
+        const result = await this.deps.bundleStore.create(tenantId, normalized);
+        (0, import_core41.validateCapabilityBundleInput)(result);
+        return result;
+      } catch (error) {
+        if (!isDuplicate(error)) throw error;
+        if (attempt === 4) throw new CapabilityBundleServiceError("DUPLICATE_BUNDLE_KEY", "Capability bundle key already exists", 409);
+      }
+    }
+    throw new CapabilityBundleServiceError("DUPLICATE_BUNDLE_KEY", "Capability bundle key already exists", 409);
+  }
+  async update(tenantId, id, input) {
+    rejectStableKey(input);
+    (0, import_core41.validateCapabilityBundleInput)(input, { partial: true });
+    if (!input || typeof input !== "object" || Array.isArray(input) || typeof input.expectedUpdatedAt !== "string" || !input.expectedUpdatedAt.trim()) throw new CapabilityBundleServiceError("INVALID_BUNDLE_CONFIG", "expectedUpdatedAt is required for capability bundle updates", 400);
+    const value = input;
+    const normalized = { ...value, ...value.name === void 0 ? {} : { name: value.name.trim() }, ...Object.prototype.hasOwnProperty.call(value, "description") ? { description: value.description?.trim() || void 0 } : {} };
+    (0, import_core41.validateCapabilityBundleInput)(normalized, { partial: true });
+    try {
+      const result = await this.deps.bundleStore.update(tenantId, id, normalized);
+      if (!result) throw new CapabilityBundleServiceError("BUNDLE_NOT_FOUND", "Capability bundle not found", 404);
+      if ("status" in result && result.status === "conflict") throw new CapabilityBundleServiceError("BUNDLE_CONFLICT", "Capability bundle changed after it was loaded; reload before saving", 409);
+      (0, import_core41.validateCapabilityBundleInput)(result);
+      return result;
+    } catch (error) {
+      if (error instanceof CapabilityBundleServiceError) throw error;
+      if (isDuplicate(error)) throw new CapabilityBundleServiceError("DUPLICATE_BUNDLE_KEY", "Capability bundle key already exists", 409);
+      throw error;
+    }
+  }
+  async remove(tenantId, id) {
+    const result = await this.deps.bundleStore.deleteIfUnreferenced(tenantId, id);
+    if (result === "not_found") throw new CapabilityBundleServiceError("BUNDLE_NOT_FOUND", "Capability bundle not found", 404);
+    if (result === "in_use") throw new CapabilityBundleServiceError("BUNDLE_IN_USE", "Capability bundle is in use", 409);
+  }
+  async getProjectBundles(tenantId, projectId) {
+    const project = await this.deps.projectStore.getProjectById(tenantId, projectId);
+    if (!project) throw new CapabilityBundleServiceError("PROJECT_NOT_FOUND", "Project not found", 404);
+    const ids = projectBundleIds(project.config);
+    const stored = await this.deps.bundleStore.getManyByIds(tenantId, ids) ?? [];
+    return this.compose(project, ids, stored);
+  }
+  async previewProject(tenantId, projectId) {
+    const project = await this.deps.projectStore.getProjectById(tenantId, projectId);
+    if (!project) throw new CapabilityBundleServiceError("PROJECT_NOT_FOUND", "Project not found", 404);
+    let ids;
+    try {
+      ids = projectBundleIds(project.config);
+    } catch (error) {
+      return { bundleIds: [], capabilities: [], overrides: [], sources: [], warnings: [], errors: [{ code: "INVALID_BUNDLE_CONFIG", message: error instanceof Error ? error.message : "Invalid project capability configuration" }], revision: "" };
+    }
+    const stored = await this.deps.bundleStore.getManyByIds(tenantId, ids) ?? [];
+    const byId = new Map(stored.map((value) => [value.id, value]));
+    const missing = ids.filter((id) => !byId.has(id));
+    if (missing.length > 0) return { bundleIds: ids, capabilities: [], overrides: [], sources: [], warnings: [], errors: missing.map((id) => ({ code: "BUNDLE_NOT_FOUND", message: `Persisted capability bundle '${id}' is missing`, bundleId: id })), revision: "" };
+    try {
+      const ordered = ids.map((id) => byId.get(id));
+      ordered.forEach((bundle) => (0, import_core41.validateCapabilityBundleInput)(bundle));
+      return (0, import_core41.mergeCapabilityBundles)(ordered);
+    } catch (error) {
+      return { bundleIds: ids, capabilities: [], overrides: [], sources: [], warnings: [], errors: [issue(error)], revision: "" };
+    }
+  }
+  async project(tenantId, projectId, ids, persist, expectedRevisions) {
+    const current = await this.deps.projectStore.getProjectById(tenantId, projectId);
+    if (!current) throw new CapabilityBundleServiceError("PROJECT_NOT_FOUND", "Project not found", 404);
+    if (new Set(ids).size !== ids.length) throw new CapabilityBundleServiceError("DUPLICATE_PROJECT_BUNDLE", "Duplicate capability bundle ID", 400);
+    if (persist) this.assertExpectedRevisions(ids, expectedRevisions);
+    const ordered = await this.loadOrderedBundles(tenantId, ids);
+    let resultProject = current;
+    if (persist) {
+      projectBundleIds(current.config);
+      const update = await this.deps.projectStore.updateCapabilityBundleIds(tenantId, projectId, ids, expectedRevisions);
+      if (update.status === "project_not_found") throw new CapabilityBundleServiceError("PROJECT_NOT_FOUND", "Project not found", 404);
+      if (update.status === "bundle_not_found") throw new CapabilityBundleServiceError("BUNDLE_NOT_FOUND", "Capability bundle not found", 404);
+      if (update.status === "bundle_conflict") throw new CapabilityBundleServiceError("BUNDLE_CONFLICT", "Capability bundle changed after preview; preview the current bundle contents before saving", 409);
+      resultProject = update.project;
+    }
+    return this.compose(resultProject, ids, ordered);
+  }
+  assertExpectedRevisions(ids, revisions) {
+    if (!revisions || Object.keys(revisions).length !== ids.length || ids.some((id) => typeof revisions[id] !== "string" || !revisions[id].trim()) || Object.keys(revisions).some((id) => !ids.includes(id))) {
+      throw new CapabilityBundleServiceError("BUNDLE_CONFLICT", "Expected revisions must exactly match the selected capability bundles", 409);
+    }
+  }
+  async loadOrderedBundles(tenantId, ids) {
+    const stored = await this.deps.bundleStore.getManyByIds(tenantId, ids) ?? [];
+    const byId = new Map(stored.map((value) => [value.id, value]));
+    return ids.map((id) => {
+      const value = byId.get(id);
+      if (!value) throw new CapabilityBundleServiceError("BUNDLE_NOT_FOUND", "Capability bundle not found", 404);
+      (0, import_core41.validateCapabilityBundleInput)(value);
+      return value;
+    });
+  }
+  compose(project, ids, bundles) {
+    const valid = [];
+    const errors = [];
+    const byId = new Map(bundles.map((bundle) => [bundle.id, bundle]));
+    for (const id of ids) {
+      const bundle = byId.get(id);
+      if (!bundle) {
+        errors.push({ code: "BUNDLE_NOT_FOUND", message: `Persisted capability bundle '${id}' is missing`, bundleId: id });
+        continue;
+      }
+      try {
+        (0, import_core41.validateCapabilityBundleInput)(bundle);
+        valid.push(bundle);
+      } catch (error) {
+        errors.push({ ...issue(error), bundleId: id });
+      }
+    }
+    let preview;
+    try {
+      preview = (0, import_core41.mergeCapabilityBundles)(valid);
+    } catch (error) {
+      preview = { bundleIds: ids, capabilities: [], overrides: [], sources: [], warnings: [], errors: [issue(error)], revision: "" };
+    }
+    preview = { ...preview, bundleIds: ids, errors: [...errors, ...preview.errors] };
+    return { project, persistedBundleIds: ids, bundles: valid, preview };
+  }
+};
+
+// src/controllers/capability-bundles.ts
+init_Logger();
+var logger3 = new Logger({ serviceName: "lattice/gateway/capability-bundles" });
+var capability = import_zod7.z.unknown();
+var createSchema = import_zod7.z.object({ name: import_zod7.z.string(), description: import_zod7.z.string().optional(), capabilities: import_zod7.z.array(capability) }).strict();
+var updateSchema = createSchema.partial().extend({ expectedUpdatedAt: import_zod7.z.string().optional() });
+var bundleIdSchema = import_zod7.z.string().uuid();
+var bundleParamsSchema = import_zod7.z.object({ bundleId: bundleIdSchema });
+var projectSchema = import_zod7.z.object({ bundleIds: import_zod7.z.array(bundleIdSchema), expectedRevisions: import_zod7.z.record(import_zod7.z.string()).optional() }).strict();
+function tenant(request, authRequired2) {
+  const authenticated = request.user?.tenantId;
+  const header = request.headers["x-tenant-id"];
+  const requested = Array.isArray(header) ? header[0] : header;
+  if (authenticated) {
+    if (requested && requested !== authenticated) throw new CapabilityBundleServiceError("INVALID_INPUT", "Forbidden", 403);
+    return authenticated;
+  }
+  if (authRequired2) throw new CapabilityBundleServiceError("INVALID_INPUT", "Unauthorized", 401);
+  return requested || "default";
+}
+function sendError(reply, error) {
+  if (error instanceof CapabilityBundleServiceError) return reply.status(error.statusCode).send({ success: false, code: error.code, message: error.message });
+  if (error instanceof Error && error.name === "CapabilityBundleValidationError") {
+    const validationError = error;
+    const code = validationError.code === "CAPABILITY_BUNDLE_INELIGIBLE_CAPABILITY" ? "BUNDLE_PLUGIN_NOT_ELIGIBLE" : validationError.code === "CAPABILITY_BUNDLE_CREDENTIALS_FORBIDDEN" || validationError.code === "CAPABILITY_BUNDLE_INVALID_CONFIG" ? "INVALID_BUNDLE_CONFIG" : validationError.code;
+    return reply.status(400).send({ success: false, code, message: error.message, capabilityType: validationError.capabilityType, fieldPath: validationError.fieldPath });
+  }
+  logger3.error("Capability bundle controller error", { error: error instanceof Error ? error : new Error(String(error)) });
+  return reply.status(500).send({ success: false, code: "INTERNAL_ERROR", message: "Internal server error" });
+}
+var CapabilityBundleController = class {
+  constructor(deps, options = {}) {
+    this.service = new CapabilityBundleService(deps);
+    this.authRequired = options.authRequired ?? true;
+  }
+  async listBundles(request, reply) {
+    try {
+      const result = await this.service.list(tenant(request, this.authRequired));
+      return reply.send({ success: true, data: result.bundles, errors: result.errors });
+    } catch (error) {
+      return sendError(reply, error);
+    }
+  }
+  async getBundle(request, reply) {
+    try {
+      const tenantId = tenant(request, this.authRequired);
+      const parsed = bundleParamsSchema.safeParse(request.params);
+      if (!parsed.success) return reply.status(400).send({ success: false, code: "INVALID_INPUT", message: "Invalid capability bundle ID" });
+      return reply.send({ success: true, data: await this.service.get(tenantId, parsed.data.bundleId) });
+    } catch (error) {
+      return sendError(reply, error);
+    }
+  }
+  async createBundle(request, reply) {
+    try {
+      const tenantId = tenant(request, this.authRequired);
+      const parsed = createSchema.safeParse(request.body);
+      if (!parsed.success) return reply.status(400).send({ success: false, code: "INVALID_INPUT", message: "Invalid capability bundle body" });
+      return reply.status(201).send({ success: true, data: await this.service.create(tenantId, parsed.data) });
+    } catch (error) {
+      return sendError(reply, error);
+    }
+  }
+  async updateBundle(request, reply) {
+    try {
+      const tenantId = tenant(request, this.authRequired);
+      const params = bundleParamsSchema.safeParse(request.params);
+      const parsed = updateSchema.safeParse(request.body);
+      if (!params.success || !parsed.success) return reply.status(400).send({ success: false, code: "INVALID_INPUT", message: "Invalid capability bundle request" });
+      return reply.send({ success: true, data: await this.service.update(tenantId, params.data.bundleId, parsed.data) });
+    } catch (error) {
+      return sendError(reply, error);
+    }
+  }
+  async deleteBundle(request, reply) {
+    try {
+      const tenantId = tenant(request, this.authRequired);
+      const parsed = bundleParamsSchema.safeParse(request.params);
+      if (!parsed.success) return reply.status(400).send({ success: false, code: "INVALID_INPUT", message: "Invalid capability bundle ID" });
+      await this.service.remove(tenantId, parsed.data.bundleId);
+      return reply.send({ success: true, data: null });
+    } catch (error) {
+      return sendError(reply, error);
+    }
+  }
+  async updateProjectBundles(request, reply) {
+    try {
+      const tenantId = tenant(request, this.authRequired);
+      const parsed = projectSchema.safeParse(request.body);
+      if (!parsed.success) return reply.status(400).send({ success: false, code: "INVALID_INPUT", message: "Invalid project capability bundle body" });
+      const result = await this.service.project(tenantId, request.params.projectId, parsed.data.bundleIds, true, parsed.data.expectedRevisions);
+      return reply.send({ success: true, data: { project: result.project, persistedBundleIds: result.persistedBundleIds, bundles: result.bundles, preview: result.preview } });
+    } catch (error) {
+      return sendError(reply, error);
+    }
+  }
+  async getProjectBundles(request, reply) {
+    try {
+      const result = await this.service.getProjectBundles(tenant(request, this.authRequired), request.params.projectId);
+      if (result.preview.errors.some((issue2) => issue2.code === "CAPABILITY_BUNDLE_CREDENTIALS_FORBIDDEN")) return reply.status(400).send({ success: false, code: "INVALID_BUNDLE_CONFIG", message: "Capability bundle record is invalid" });
+      return reply.send({ success: true, data: { project: result.project, persistedBundleIds: result.persistedBundleIds, bundles: result.bundles, preview: result.preview } });
+    } catch (error) {
+      return sendError(reply, error);
+    }
+  }
+  async getProjectPreview(request, reply) {
+    try {
+      const preview = await this.service.previewProject(tenant(request, this.authRequired), request.params.projectId);
+      return reply.send({ success: true, data: preview });
+    } catch (error) {
+      return sendError(reply, error);
+    }
+  }
+  async postProjectPreview(request, reply) {
+    try {
+      const tenantId = tenant(request, this.authRequired);
+      const parsed = projectSchema.safeParse(request.body);
+      if (!parsed.success) return reply.status(400).send({ success: false, code: "INVALID_INPUT", message: "Invalid project capability bundle body" });
+      const result = await this.service.project(tenantId, request.params.projectId, parsed.data.bundleIds, false);
+      return reply.send({ success: true, data: result.preview });
+    } catch (error) {
+      return sendError(reply, error);
+    }
+  }
+};
+function registerCapabilityBundleRoutes(app2, controller) {
+  app2.get("/api/capability-bundles", controller.listBundles.bind(controller));
+  app2.post("/api/capability-bundles", controller.createBundle.bind(controller));
+  app2.get("/api/capability-bundles/:bundleId", controller.getBundle.bind(controller));
+  app2.put("/api/capability-bundles/:bundleId", controller.updateBundle.bind(controller));
+  app2.delete("/api/capability-bundles/:bundleId", controller.deleteBundle.bind(controller));
+  app2.get("/api/projects/:projectId/capability-bundles", controller.getProjectBundles.bind(controller));
+  app2.put("/api/projects/:projectId/capability-bundles", controller.updateProjectBundles.bind(controller));
+  app2.get("/api/projects/:projectId/capability-preview", controller.getProjectPreview.bind(controller));
+  app2.post("/api/projects/:projectId/capability-preview", controller.postProjectPreview.bind(controller));
+}
+
+// src/routes/index.ts
 var registerLatticeRoutes = (app2, channelDeps) => {
-  const webAppStore = (0, import_core41.getStoreLattice)("default", "agentWebApp").store;
-  const assistantStore = (0, import_core41.getStoreLattice)("default", "assistant").store;
-  const projectStore = (0, import_core41.getStoreLattice)("default", "project").store;
+  const webAppStore = (0, import_core42.getStoreLattice)("default", "agentWebApp").store;
+  const assistantStore = (0, import_core42.getStoreLattice)("default", "assistant").store;
+  const projectStore = (0, import_core42.getStoreLattice)("default", "project").store;
+  registerCapabilityBundleRoutes(app2, new CapabilityBundleController({
+    bundleStore: (0, import_core42.getStoreLattice)("default", "capabilityBundle").store,
+    projectStore
+  }, { authRequired: process.env.AUTH_REQUIRED === "true" }));
   registerAgentWebAppRoutes(app2, {
     service: new AgentWebAppService({
       webAppStore,
       assistantStore,
       projectStore,
-      modelRegistry: { has: (key) => import_core41.modelLatticeManager.hasLattice(key) },
+      modelRegistry: { has: (key) => import_core42.modelLatticeManager.hasLattice(key) },
       configuredAgentResolver: createConfiguredAgentResolver({
-        hydrate: (tenantId) => import_core41.agentLatticeManager.initializeStoredAssistantsForTenant(tenantId),
-        has: (tenantId, assistantId) => import_core41.agentLatticeManager.hasAgentLatticeWithTenant(tenantId, assistantId)
+        hydrate: (tenantId) => import_core42.agentLatticeManager.initializeStoredAssistantsForTenant(tenantId),
+        has: (tenantId, assistantId) => import_core42.agentLatticeManager.hasAgentLatticeWithTenant(tenantId, assistantId)
       })
     })
   });
   registerAgentWebAppRuntimeRoutes(app2, {
     service: new AgentWebAppRuntimeService({
       webAppStore,
-      threadStore: (0, import_core41.getStoreLattice)("default", "thread").store,
+      threadStore: (0, import_core42.getStoreLattice)("default", "thread").store,
       projectStore,
       assistantResolver: {
         resolve: async (tenantId, assistantId) => {
           const stored = await assistantStore.getAssistantById(tenantId, assistantId);
           if (stored) return stored;
-          await import_core41.agentLatticeManager.initializeStoredAssistantsForTenant(tenantId);
-          const config = import_core41.agentLatticeManager.getAgentConfigWithTenant(tenantId, assistantId);
+          await import_core42.agentLatticeManager.initializeStoredAssistantsForTenant(tenantId);
+          const config = import_core42.agentLatticeManager.getAgentConfigWithTenant(tenantId, assistantId);
           return config ? { id: assistantId, name: config.name, description: config.description } : null;
         }
       },
       modelRegistry: {
-        has: (key) => import_core41.modelLatticeManager.hasLattice(key),
+        has: (key) => import_core42.modelLatticeManager.hasLattice(key),
         label: (key) => key
       },
       messageReader: {
-        getCurrentMessages: ({ tenantId, assistantId, threadId, workspaceId, projectId }) => import_core41.agentInstanceManager.getAgent({
+        getCurrentMessages: ({ tenantId, assistantId, threadId, workspaceId, projectId }) => import_core42.agentInstanceManager.getAgent({
           tenant_id: tenantId,
           assistant_id: assistantId,
           thread_id: threadId,
@@ -13941,7 +14920,7 @@ var registerLatticeRoutes = (app2, channelDeps) => {
         }).getCurrentMessages()
       },
       agentResolver: {
-        getAgent: ({ tenantId, assistantId, threadId, workspaceId, projectId }) => import_core41.agentInstanceManager.getAgent({
+        getAgent: ({ tenantId, assistantId, threadId, workspaceId, projectId }) => import_core42.agentInstanceManager.getAgent({
           tenant_id: tenantId,
           assistant_id: assistantId,
           thread_id: threadId,
@@ -13959,8 +14938,8 @@ var registerLatticeRoutes = (app2, channelDeps) => {
         if (webApp.tenantId !== preview.tenantId) return false;
         const assistant = await assistantStore.getAssistantById(preview.tenantId, webApp.assistantId);
         if (assistant) return !assistant.ownerUserId || assistant.ownerUserId === preview.userId;
-        await import_core41.agentLatticeManager.initializeStoredAssistantsForTenant(preview.tenantId);
-        return import_core41.agentLatticeManager.hasAgentLatticeWithTenant(preview.tenantId, webApp.assistantId);
+        await import_core42.agentLatticeManager.initializeStoredAssistantsForTenant(preview.tenantId);
+        return import_core42.agentLatticeManager.hasAgentLatticeWithTenant(preview.tenantId, webApp.assistantId);
       }
     })
   });
@@ -14260,12 +15239,12 @@ function registerResourceRoutes(app2, controller) {
 }
 
 // src/export_registrations/index.ts
-var import_core52 = require("@axiom-lattice/core");
+var import_core53 = require("@axiom-lattice/core");
 
 // src/export_registrations/skill.registration.ts
-var import_core42 = require("@axiom-lattice/core");
+var import_core43 = require("@axiom-lattice/core");
 function getStore2(context) {
-  return new import_core42.SandboxSkillStore({
+  return new import_core43.SandboxSkillStore({
     workspaceId: context?.workspaceId,
     projectId: context?.projectId
   });
@@ -14283,7 +15262,7 @@ var skillRegistration = {
   async listForExport(tenantId, context) {
     const store2 = getStore2(context);
     const skills = await store2.getAllSkills(tenantId, toStoreContext(context));
-    return skills.filter((s) => !(0, import_core42.isBuiltInSkill)(s.id)).map((s) => ({
+    return skills.filter((s) => !(0, import_core43.isBuiltInSkill)(s.id)).map((s) => ({
       _exportId: "",
       data: {
         id: s.id,
@@ -14348,7 +15327,7 @@ var skillRegistration = {
     const insertions = [];
     for (const entity of entities) {
       const id = entity.data.id;
-      if ((0, import_core42.isBuiltInSkill)(id)) continue;
+      if ((0, import_core43.isBuiltInSkill)(id)) continue;
       if (existingIds.has(id)) {
         conflicts.push({
           _exportId: entity._exportId,
@@ -14407,9 +15386,9 @@ var skillRegistration = {
 };
 
 // src/export_registrations/agent.registration.ts
-var import_core43 = require("@axiom-lattice/core");
+var import_core44 = require("@axiom-lattice/core");
 function getStore3() {
-  return (0, import_core43.getStoreLattice)("default", "assistant").store;
+  return (0, import_core44.getStoreLattice)("default", "assistant").store;
 }
 var agentRegistration = {
   entityType: "agent",
@@ -14489,9 +15468,9 @@ var agentRegistration = {
 };
 
 // src/export_registrations/database-config.registration.ts
-var import_core44 = require("@axiom-lattice/core");
+var import_core45 = require("@axiom-lattice/core");
 function getStore4() {
-  return (0, import_core44.getStoreLattice)("default", "database").store;
+  return (0, import_core45.getStoreLattice)("default", "database").store;
 }
 var databaseConfigRegistration = {
   entityType: "database_config",
@@ -14571,9 +15550,9 @@ var databaseConfigRegistration = {
 };
 
 // src/export_registrations/metrics-config.registration.ts
-var import_core45 = require("@axiom-lattice/core");
+var import_core46 = require("@axiom-lattice/core");
 function getStore5() {
-  return (0, import_core45.getStoreLattice)("default", "metrics").store;
+  return (0, import_core46.getStoreLattice)("default", "metrics").store;
 }
 var metricsConfigRegistration = {
   entityType: "metrics_config",
@@ -14653,9 +15632,9 @@ var metricsConfigRegistration = {
 };
 
 // src/export_registrations/mcp-config.registration.ts
-var import_core46 = require("@axiom-lattice/core");
+var import_core47 = require("@axiom-lattice/core");
 function getStore6() {
-  return (0, import_core46.getStoreLattice)("default", "mcp").store;
+  return (0, import_core47.getStoreLattice)("default", "mcp").store;
 }
 var mcpConfigRegistration = {
   entityType: "mcp_config",
@@ -14738,9 +15717,9 @@ var mcpConfigRegistration = {
 };
 
 // src/export_registrations/connection.registration.ts
-var import_core47 = require("@axiom-lattice/core");
+var import_core48 = require("@axiom-lattice/core");
 function getStore7() {
-  return (0, import_core47.getStoreLattice)("default", "connection").store;
+  return (0, import_core48.getStoreLattice)("default", "connection").store;
 }
 async function listAllConnections(tenantId) {
   const store2 = getStore7();
@@ -14822,9 +15801,9 @@ var connectionRegistration = {
 };
 
 // src/export_registrations/collection.registration.ts
-var import_core48 = require("@axiom-lattice/core");
+var import_core49 = require("@axiom-lattice/core");
 function getStore8() {
-  return (0, import_core48.getStoreLattice)("default", "collection").store;
+  return (0, import_core49.getStoreLattice)("default", "collection").store;
 }
 var collectionRegistration = {
   entityType: "collection",
@@ -14895,11 +15874,11 @@ var collectionRegistration = {
 };
 
 // src/export_registrations/channel-installation.registration.ts
-var import_core49 = require("@axiom-lattice/core");
+var import_core50 = require("@axiom-lattice/core");
 var import_crypto10 = require("crypto");
 var UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
 function getStore9() {
-  return (0, import_core49.getStoreLattice)("default", "channelInstallation").store;
+  return (0, import_core50.getStoreLattice)("default", "channelInstallation").store;
 }
 var channelInstallationRegistration = {
   entityType: "channel_installation",
@@ -14998,9 +15977,9 @@ var channelInstallationRegistration = {
 };
 
 // src/export_registrations/menu.registration.ts
-var import_core50 = require("@axiom-lattice/core");
+var import_core51 = require("@axiom-lattice/core");
 function getStore10() {
-  return (0, import_core50.getStoreLattice)("default", "menu").store;
+  return (0, import_core51.getStoreLattice)("default", "menu").store;
 }
 var menuRegistration = {
   entityType: "menu",
@@ -15078,9 +16057,9 @@ var menuRegistration = {
 };
 
 // src/export_registrations/eval.registration.ts
-var import_core51 = require("@axiom-lattice/core");
+var import_core52 = require("@axiom-lattice/core");
 function getStore11() {
-  return (0, import_core51.getStoreLattice)("default", "eval").store;
+  return (0, import_core52.getStoreLattice)("default", "eval").store;
 }
 var evalRegistration = {
   entityType: "eval",
@@ -15406,7 +16385,7 @@ var evalRegistration = {
 
 // src/export_registrations/index.ts
 function registerAllBuiltinEntities() {
-  const registry = import_core52.ExportableEntityRegistry.getInstance();
+  const registry = import_core53.ExportableEntityRegistry.getInstance();
   registry.register(skillRegistration);
   registry.register(agentRegistration);
   registry.register(databaseConfigRegistration);
@@ -15420,7 +16399,7 @@ function registerAllBuiltinEntities() {
 }
 
 // src/router/MessageRouter.ts
-var import_core53 = require("@axiom-lattice/core");
+var import_core54 = require("@axiom-lattice/core");
 var import_crypto11 = require("crypto");
 var BindingNotFoundError = class extends Error {
   constructor(message) {
@@ -15590,7 +16569,7 @@ var MessageRouter = class {
             channel: message.channel,
             adapterChannel: adapter.channel
           }, "Thread resolved by adapter strategy");
-          const threadStore = (0, import_core53.getStoreLattice)("default", "thread").store;
+          const threadStore = (0, import_core54.getStoreLattice)("default", "thread").store;
           try {
             await threadStore.createThread(
               tenantId,
@@ -15627,7 +16606,7 @@ var MessageRouter = class {
           }
         }
         if (!threadId) {
-          const threadStore = (0, import_core53.getStoreLattice)("default", "thread").store;
+          const threadStore = (0, import_core54.getStoreLattice)("default", "thread").store;
           const newThreadId = (0, import_crypto11.randomUUID)();
           console.log({
             event: "dispatch:thread:create",
@@ -15667,7 +16646,7 @@ var MessageRouter = class {
           senderId: message.sender.id,
           contentLength: message.content.text.length
         }, "Dispatching to agent");
-        const agent = import_core53.agentInstanceManager.getAgent({
+        const agent = import_core54.agentInstanceManager.getAgent({
           tenant_id: tenantId,
           assistant_id: agentId,
           thread_id: threadId,
@@ -15875,13 +16854,13 @@ function createRateLimitMiddleware(maxRequests = 10, windowMs = 60 * 1e3, maxEnt
 
 // src/router/middlewares/auditLogger.ts
 init_Logger();
-var logger3 = new Logger({ serviceName: "lattice/gateway/audit" });
+var logger4 = new Logger({ serviceName: "lattice/gateway/audit" });
 function createAuditLoggerMiddleware() {
   return async (ctx, next) => {
     const start2 = Date.now();
     try {
       await next();
-      logger3.info("message routed", {
+      logger4.info("message routed", {
         event: "message:routed",
         channel: ctx.inboundMessage.channel,
         senderId: ctx.inboundMessage.sender.id,
@@ -15891,7 +16870,7 @@ function createAuditLoggerMiddleware() {
         status: "success"
       });
     } catch (error) {
-      logger3.error(
+      logger4.error(
         error instanceof Error ? error.message : String(error),
         {
           event: "message:error",
@@ -15907,7 +16886,7 @@ function createAuditLoggerMiddleware() {
 }
 
 // src/index.ts
-var import_core58 = require("@axiom-lattice/core");
+var import_core59 = require("@axiom-lattice/core");
 
 // src/swagger.ts
 var import_swagger = __toESM(require("@fastify/swagger"));
@@ -15972,7 +16951,7 @@ var configureSwagger = async (app2, customSwaggerConfig, customSwaggerUiConfig)
 };
 
 // src/services/agent_task_consumer.ts
-var import_core54 = require("@axiom-lattice/core");
+var import_core55 = require("@axiom-lattice/core");
 var handleAgentTask = async (taskRequest, retryCount = 0) => {
   const {
     assistant_id,
@@ -15990,17 +16969,17 @@ var handleAgentTask = async (taskRequest, retryCount = 0) => {
     console.log(
       `\u5F00\u59CB\u5904\u7406\u4EFB\u52A1 [assistant_id: ${assistant_id}, thread_id: ${thread_id}]`
     );
-    const agent = import_core54.agentInstanceManager.getAgent({ assistant_id, thread_id, tenant_id, workspace_id: runConfig?.workspaceId, project_id: runConfig?.projectId, custom_run_config: runConfig });
-    await agent.addMessage({ input, command, custom_run_config: runConfig }, import_core54.QueueMode.STEER);
+    const agent = import_core55.agentInstanceManager.getAgent({ assistant_id, thread_id, tenant_id, workspace_id: runConfig?.workspaceId, project_id: runConfig?.projectId, custom_run_config: runConfig });
+    await agent.addMessage({ input, command, custom_run_config: runConfig }, import_core55.QueueMode.STEER);
     if (callback_event) {
       agent.subscribeOnce("message:completed", (evt) => {
-        import_core54.eventBus.publish(callback_event, {
+        import_core55.eventBus.publish(callback_event, {
           success: true,
           state: evt.state
         });
         if (main_thread_id && main_tenant_id) {
           try {
-            const mainAgent = import_core54.agentInstanceManager.getAgent({
+            const mainAgent = import_core55.agentInstanceManager.getAgent({
               assistant_id: main_assistant_id ?? assistant_id,
               thread_id: main_thread_id,
               tenant_id: main_tenant_id,
@@ -16030,7 +17009,7 @@ ${summary}`
         }
       });
       agent.subscribeOnce("message:interrupted", (evt) => {
-        import_core54.eventBus.publish(callback_event, {
+        import_core55.eventBus.publish(callback_event, {
           success: true,
           state: evt.state
         });
@@ -16049,11 +17028,11 @@ ${summary}`
       console.log(
         `\u5C06\u5728 ${delayMs}ms \u540E\u91CD\u8BD5\u4EFB\u52A1 (${nextRetryCount}/${maxRetries})`
       );
-      await new Promise((resolve3) => setTimeout(resolve3, delayMs));
+      await new Promise((resolve4) => setTimeout(resolve4, delayMs));
       return handleAgentTask(taskRequest, nextRetryCount);
     }
     if (callback_event) {
-      import_core54.eventBus.publish(callback_event, {
+      import_core55.eventBus.publish(callback_event, {
         success: false,
         error: error instanceof Error ? error.message : String(error)
       });
@@ -16090,7 +17069,7 @@ var _AgentTaskConsumer = class _AgentTaskConsumer {
    * 初始化事件监听和队列轮询
    */
   initialize() {
-    import_core54.eventBus.subscribe(import_core54.AGENT_TASK_EVENT, this.trigger_agent_task.bind(this));
+    import_core55.eventBus.subscribe(import_core55.AGENT_TASK_EVENT, this.trigger_agent_task.bind(this));
     this.startPollingQueue();
     console.log("Agent\u4EFB\u52A1\u6D88\u8D39\u8005\u5DF2\u542F\u52A8\u5E76\u76D1\u542C\u4EFB\u52A1\u4E8B\u4EF6\u548C\u961F\u5217");
   }
@@ -16209,7 +17188,7 @@ var _AgentTaskConsumer = class _AgentTaskConsumer {
     handleAgentTask(taskRequest).catch((error) => {
       console.error("\u5904\u7406Agent\u4EFB\u52A1\u65F6\u53D1\u751F\u672A\u6355\u83B7\u7684\u9519\u8BEF:", error);
       if (taskRequest.callback_event) {
-        import_core54.eventBus.publish(taskRequest.callback_event, {
+        import_core55.eventBus.publish(taskRequest.callback_event, {
           success: false,
           error: error instanceof Error ? error.message : String(error)
         });
@@ -16224,7 +17203,7 @@ _AgentTaskConsumer.agent_run_endpoint = "http://localhost:4001/api/runs";
 var AgentTaskConsumer = _AgentTaskConsumer;
 
 // src/index.ts
-var import_core59 = require("@axiom-lattice/core");
+var import_core60 = require("@axiom-lattice/core");
 var import_protocols9 = require("@axiom-lattice/protocols");
 var import_meta = {};
 process.on("unhandledRejection", (reason, promise) => {
@@ -16238,13 +17217,13 @@ var DEFAULT_LOGGER_CONFIG = {
   loggerName: "lattice/gateway"
 };
 var loggerLattice = initializeLogger(DEFAULT_LOGGER_CONFIG);
-var logger5 = loggerLattice.client;
+var logger6 = loggerLattice.client;
 function initializeLogger(config) {
-  if (import_core59.loggerLatticeManager.hasLattice("default")) {
-    import_core59.loggerLatticeManager.removeLattice("default");
+  if (import_core60.loggerLatticeManager.hasLattice("default")) {
+    import_core60.loggerLatticeManager.removeLattice("default");
   }
-  (0, import_core59.registerLoggerLattice)("default", config);
-  return (0, import_core59.getLoggerLattice)("default");
+  (0, import_core60.registerLoggerLattice)("default", config);
+  return (0, import_core60.getLoggerLattice)("default");
 }
 var app = (0, import_fastify.default)({
   logger: false,
@@ -16271,7 +17250,9 @@ var getHeaderValue = (header) => {
 var authRequired = process.env.AUTH_REQUIRED === "true";
 registerConsoleAuthHook(app, { authRequired });
 app.addHook("onRequest", (request, reply, done) => {
-  if (!request.headers["x-project-id"]) {
+  const requestPath = request.url.split("?", 1)[0];
+  const isAgentRunRequest = requestPath === "/api/runs" || requestPath === "/api/resume_stream" || requestPath.includes("/threads/") && requestPath.endsWith("/recover");
+  if (!request.headers["x-project-id"] && !isAgentRunRequest) {
     request.headers["x-project-id"] = "default";
   }
   done();
@@ -16321,7 +17302,7 @@ app.setErrorHandler((error, request, reply) => {
     "x-request-id": getHeaderValue(request.headers["x-request-id"]),
     "x-user-id": getHeaderValue(request.headers["x-user-id"])
   };
-  logger5.error(
+  logger6.error(
     `\u8BF7\u6C42\u9519\u8BEF: ${request.method} ${request.url} error:${error.message}`,
     {
       ...context,
@@ -16337,7 +17318,7 @@ app.setErrorHandler((error, request, reply) => {
 });
 function getConfiguredSandboxProvider() {
   const sandboxProviderType = process.env.SANDBOX_PROVIDER_TYPE || "microsandbox-remote";
-  return (0, import_core59.createSandboxProvider)({
+  return (0, import_core60.createSandboxProvider)({
     type: sandboxProviderType,
     remoteBaseURL: process.env.SANDBOX_BASE_URL,
     microsandboxServiceBaseURL: process.env.MICROSANDBOX_SERVICE_BASE_URL,
@@ -16353,37 +17334,37 @@ function getConfiguredSandboxProvider() {
 }
 async function restoreMcpConnections() {
   try {
-    const storeLattice = (0, import_core59.getStoreLattice)("default", "mcp");
+    const storeLattice = (0, import_core60.getStoreLattice)("default", "mcp");
     const store2 = storeLattice.store;
     if (!store2) {
-      logger5.info("MCP store not configured, skipping connection restoration");
+      logger6.info("MCP store not configured, skipping connection restoration");
       return;
     }
     const configs = await store2.getAllConfigs("default");
     const connectedConfigs = configs.filter((c2) => c2.status === "connected");
     if (connectedConfigs.length === 0) return;
-    logger5.info(`Restoring ${connectedConfigs.length} MCP server connections...`);
+    logger6.info(`Restoring ${connectedConfigs.length} MCP server connections...`);
     const { convertToConnection: convertToConnection2 } = await Promise.resolve().then(() => (init_mcp_configs(), mcp_configs_exports));
     for (const config of connectedConfigs) {
       try {
         const connection = convertToConnection2(config.config);
-        import_core59.mcpManager.addServer(config.key, connection);
+        import_core60.mcpManager.addServer(config.key, connection);
       } catch (err) {
-        logger5.warn(`Failed to prepare MCP server "${config.key}" for restoration`, { error: err });
+        logger6.warn(`Failed to prepare MCP server "${config.key}" for restoration`, { error: err });
       }
     }
-    await import_core59.mcpManager.connect();
+    await import_core60.mcpManager.connect();
     for (const config of connectedConfigs) {
       try {
-        await import_core59.mcpManager.registerToolsToToolLattice(config.key, config.selectedTools);
-        logger5.info(`MCP server "${config.key}" restored with ${config.selectedTools.length} tools`);
+        await import_core60.mcpManager.registerToolsToToolLattice(config.key, config.selectedTools);
+        logger6.info(`MCP server "${config.key}" restored with ${config.selectedTools.length} tools`);
       } catch (err) {
-        logger5.warn(`Failed to register tools for MCP server "${config.key}"`, { error: err });
+        logger6.warn(`Failed to register tools for MCP server "${config.key}"`, { error: err });
       }
     }
-    logger5.info(`MCP connection restoration complete: ${connectedConfigs.length} servers`);
+    logger6.info(`MCP connection restoration complete: ${connectedConfigs.length} servers`);
   } catch (err) {
-    logger5.error("MCP connection restoration failed", { error: err });
+    logger6.error("MCP connection restoration failed", { error: err });
   }
 }
 var start = async (config) => {
@@ -16396,7 +17377,7 @@ var start = async (config) => {
         file: config.loggerConfig.file || DEFAULT_LOGGER_CONFIG.file
       };
       loggerLattice = initializeLogger(loggerConfig);
-      logger5 = loggerLattice.client;
+      logger6 = loggerLattice.client;
     }
     app.decorate("loggerLattice", loggerLattice);
     let channelDeps;
@@ -16408,7 +17389,7 @@ var start = async (config) => {
       const { getStoreLattice: getStore12 } = await import("@axiom-lattice/core");
       const bindingStore = getStore12("default", "channelBinding").store;
       const installationStore = getStore12("default", "channelInstallation").store;
-      (0, import_core58.setBindingRegistry)(bindingStore);
+      (0, import_core59.setBindingRegistry)(bindingStore);
       const router = new MessageRouter({
         middlewares: [
           createDeduplicationMiddleware(),
@@ -16421,15 +17402,15 @@ var start = async (config) => {
       });
       channelDeps = { router, installationStore };
     } catch (err) {
-      logger5.warn("Channel infrastructure unavailable", {
+      logger6.warn("Channel infrastructure unavailable", {
         error: err instanceof Error ? err.message : String(err)
       });
     }
-    (0, import_core58.setEvalRunService)(evalRunner);
+    (0, import_core59.setEvalRunService)(evalRunner);
     try {
-      const menuStore = (0, import_core59.getStoreLattice)("default", "menu").store;
-      (0, import_core58.setMenuRegistry)(menuStore);
-      logger5.info("Menu registry initialized");
+      const menuStore = (0, import_core60.getStoreLattice)("default", "menu").store;
+      (0, import_core59.setMenuRegistry)(menuStore);
+      logger6.info("Menu registry initialized");
     } catch {
     }
     registerAllBuiltinEntities();
@@ -16441,10 +17422,10 @@ var start = async (config) => {
       const { A2AAuthService: A2AAuthService2, parseEnvKeys: parseEnvKeys2 } = await Promise.resolve().then(() => (init_A2AAuthService(), A2AAuthService_exports));
       const { registerA2AStandardRoutes: registerA2AStandardRoutes2 } = await Promise.resolve().then(() => (init_a2a_standard(), a2a_standard_exports));
       const a2a = await Promise.resolve().then(() => (init_a2a(), a2a_exports));
-      const a2aKeyStore = (0, import_core59.getStoreLattice)("default", "a2aApiKey").store;
-      const assistantStore = (0, import_core59.getStoreLattice)("default", "assistant").store;
-      const projectStore = (0, import_core59.getStoreLattice)("default", "project").store;
-      const taskStore = (0, import_core59.getStoreLattice)("default", "task").store;
+      const a2aKeyStore = (0, import_core60.getStoreLattice)("default", "a2aApiKey").store;
+      const assistantStore = (0, import_core60.getStoreLattice)("default", "assistant").store;
+      const projectStore = (0, import_core60.getStoreLattice)("default", "project").store;
+      const taskStore = (0, import_core60.getStoreLattice)("default", "task").store;
       const authService = new A2AAuthService2({
         keyStore: a2aKeyStore,
         assistantStore,
@@ -16462,30 +17443,30 @@ var start = async (config) => {
         getProjectStore: () => projectStore
       });
       a2a.registerA2ARoutes(app);
-      logger5.info("A2A standard routes registered");
+      logger6.info("A2A standard routes registered");
     } catch (err) {
-      logger5.warn("A2A standard routes unavailable", {
+      logger6.warn("A2A standard routes unavailable", {
         error: err instanceof Error ? err.message : String(err)
       });
     }
-    if (!import_core59.sandboxLatticeManager.hasLattice("default")) {
-      import_core59.sandboxLatticeManager.registerLattice("default", getConfiguredSandboxProvider());
-      logger5.info("Registered sandbox manager from env configuration");
+    if (!import_core60.sandboxLatticeManager.hasLattice("default")) {
+      import_core60.sandboxLatticeManager.registerLattice("default", getConfiguredSandboxProvider());
+      logger6.info("Registered sandbox manager from env configuration");
     }
     try {
       const { ResourceController: ResourceController2 } = await Promise.resolve().then(() => (init_resources(), resources_exports));
-      const sharedResourceStore = (0, import_core59.getStoreLattice)("default", "sharedResource").store;
-      const cache = new import_core59.TokenCache();
+      const sharedResourceStore = (0, import_core60.getStoreLattice)("default", "sharedResource").store;
+      const cache = new import_core60.TokenCache();
       const resourceController = new ResourceController2({
         store: sharedResourceStore,
-        sandboxManager: import_core59.sandboxLatticeManager,
+        sandboxManager: import_core60.sandboxLatticeManager,
         cache,
-        logger: logger5
+        logger: logger6
       });
       registerResourceRoutes(app, resourceController);
-      logger5.info("Resource share routes registered");
+      logger6.info("Resource share routes registered");
     } catch (err) {
-      logger5.warn("Resource share infrastructure unavailable", {
+      logger6.warn("Resource share infrastructure unavailable", {
         error: err instanceof Error ? err.message : String(err)
       });
     }
@@ -16497,14 +17478,14 @@ var start = async (config) => {
           { deps: { router: channelDeps.router } }
         );
       } catch (err) {
-        logger5.error("Failed to start channel connections", {
+        logger6.error("Failed to start channel connections", {
           error: err instanceof Error ? err.message : String(err)
         });
       }
     }
     const target_port = config?.port || Number(process.env.PORT) || 4001;
     await app.listen({ port: target_port, host: "0.0.0.0" });
-    logger5.info(`Lattice Gateway is running on port: ${target_port}`);
+    logger6.info(`Lattice Gateway is running on port: ${target_port}`);
     const queueServiceConfig = config?.queueServiceConfig;
     if (queueServiceConfig) {
       setQueueServiceType(queueServiceConfig.type);
@@ -16514,17 +17495,17 @@ var start = async (config) => {
       }
     }
     if (process.env.AXIOM_RESTORE_PENDING_ON_STARTUP === "true") {
-      import_core59.agentInstanceManager.restore().then((stats) => {
-        logger5.info(`Agent recovery complete: ${stats.restored} threads restored, ${stats.errors} errors`);
+      import_core60.agentInstanceManager.restore().then((stats) => {
+        logger6.info(`Agent recovery complete: ${stats.restored} threads restored, ${stats.errors} errors`);
       }).catch((error) => {
-        logger5.error("Agent recovery failed", { error });
+        logger6.error("Agent recovery failed", { error });
       });
     }
     restoreMcpConnections().catch((error) => {
-      logger5.error("MCP connection restoration failed", { error });
+      logger6.error("MCP connection restoration failed", { error });
     });
   } catch (err) {
-    logger5.error("Server start failed", { error: err });
+    logger6.error("Server start failed", { error: err });
     process.exit(1);
   }
 };