@axiom-lattice/gateway 4.0.2 → 4.1.1

package/dist/index.mjs

@@ -69,8 +69,8 @@ function resolveLocalA2AWorkingDirectory(options) {
 }
 function validateWorkingDirectory(cwd) {
   try {
-    const stat = statSync(cwd);
-    if (!stat.isDirectory()) {
+    const stat2 = statSync(cwd);
+    if (!stat2.isDirectory()) {
       return `Working directory is not a directory: ${cwd}`;
     }
     return null;
@@ -846,8 +846,8 @@ async function pipeAsyncIterableToSse(raw, stream, options = {}) {
   let closed = raw.destroyed || raw.writableEnded;
   let returned = false;
   let resolveClosed;
-  const closedPromise = new Promise((resolve2) => {
-    resolveClosed = resolve2;
+  const closedPromise = new Promise((resolve3) => {
+    resolveClosed = resolve3;
   });
   const returnConsumer = () => {
     if (returned) return;
@@ -897,14 +897,14 @@ async function pipeAsyncIterableToSse(raw, stream, options = {}) {
 async function writeSse(raw, value, closed) {
   if (raw.destroyed || raw.writableEnded) return false;
   if (raw.write(value)) return true;
-  return new Promise((resolve2) => {
+  return new Promise((resolve3) => {
     let settled = false;
     const onDrain = () => finish(!raw.destroyed && !raw.writableEnded);
     const finish = (writable) => {
       if (settled) return;
       settled = true;
       raw.removeListener("drain", onDrain);
-      resolve2(writable);
+      resolve3(writable);
     };
     raw.once("drain", onDrain);
     void closed.then(() => finish(false));
@@ -1116,7 +1116,7 @@ var recoverRun = async (request, reply) => {
     const { assistantId, threadId } = request.params;
     const tenant_id = request.headers["x-tenant-id"];
     const workspace_id = request.headers["x-workspace-id"] || "default";
-    const project_id = request.headers["x-project-id"] || "default";
+    const project_id = request.headers["x-project-id"];
     const agent = agentInstanceManager2.getAgent({
       assistant_id: assistantId,
       thread_id: threadId,
@@ -1124,8 +1124,7 @@ var recoverRun = async (request, reply) => {
       workspace_id,
       project_id
     });
-    await agent.resumeTask();
-    const status = await agent.getRunStatus();
+    const { status } = await agent.resumeTask();
     reply.status(200).send({
       success: true,
       threadId,
@@ -2015,7 +2014,8 @@ async function getHealth(request, reply) {
 }
 
 // src/services/skill_service.ts
-import { SandboxSkillStore } from "@axiom-lattice/core";
+import { SandboxSkillStore, PluginRegistry } from "@axiom-lattice/core";
+var PLUGIN_SKILL_SOURCE = "builtin-plugin";
 function getTenantId4(request) {
   return request.user?.tenantId || request.headers["x-tenant-id"] || "default";
 }
@@ -2031,28 +2031,63 @@ function buildContext(request) {
     projectId: getProjectId(request)
   };
 }
+function pluginSkillToSkill(item, tenantId, content) {
+  return {
+    id: item.id,
+    tenantId,
+    name: item.name,
+    description: item.description,
+    version: item.version,
+    pluginType: item.pluginType,
+    resourcePaths: item.resourcePaths,
+    source: PLUGIN_SKILL_SOURCE,
+    readOnly: true,
+    content,
+    createdAt: /* @__PURE__ */ new Date(0),
+    updatedAt: /* @__PURE__ */ new Date(0)
+  };
+}
 var SkillService = class {
   constructor() {
     this.store = new SandboxSkillStore();
   }
   async getAllSkills(request) {
     const tenantId = getTenantId4(request);
-    return this.store.getAllSkills(tenantId, buildContext(request));
+    const storeSkills = await this.store.getAllSkills(tenantId, buildContext(request));
+    const merged = /* @__PURE__ */ new Map();
+    for (const skill of storeSkills) {
+      merged.set(skill.id, skill);
+    }
+    for (const item of PluginRegistry.listSkills()) {
+      merged.set(item.id, pluginSkillToSkill(item, tenantId));
+    }
+    return Array.from(merged.values());
   }
   async getSkillById(request, id) {
     const tenantId = getTenantId4(request);
+    const plugin = PluginRegistry.getSkill(id);
+    if (plugin) {
+      const { definition } = plugin;
+      const item = PluginRegistry.listSkills().find((entry) => entry.id === id);
+      if (item) {
+        return pluginSkillToSkill(item, tenantId, definition.content);
+      }
+    }
     return this.store.getSkillById(tenantId, id, buildContext(request));
   }
   async createSkill(request, id, data) {
     const tenantId = getTenantId4(request);
+    this.assertNotPluginSkill(id, "created");
     return this.store.createSkill(tenantId, id, data, buildContext(request));
   }
   async updateSkill(request, id, updates) {
     const tenantId = getTenantId4(request);
+    this.assertNotPluginSkill(id, "modified");
     return this.store.updateSkill(tenantId, id, updates, buildContext(request));
   }
   async deleteSkill(request, id) {
     const tenantId = getTenantId4(request);
+    this.assertNotPluginSkill(id, "deleted");
     return this.store.deleteSkill(tenantId, id, buildContext(request));
   }
   async searchByMetadata(request, key, value) {
@@ -2067,6 +2102,16 @@ var SkillService = class {
     const tenantId = getTenantId4(request);
     return this.store.filterByLicense(tenantId, license, buildContext(request));
   }
+  /**
+   * Guard against mutating a registered plugin skill.
+   * Message style mirrors SandboxSkillStore built-in errors so the controller's
+   * existing "built-in skill" -> 403 mapping applies.
+   */
+  assertNotPluginSkill(id, action) {
+    if (PluginRegistry.getSkill(id)) {
+      throw new Error(`Skill "${id}" is a built-in skill and cannot be ${action}`);
+    }
+  }
 };
 
 // src/controllers/skills.ts
@@ -2081,6 +2126,11 @@ function serializeSkill(skill) {
     metadata: skill.metadata || {},
     content: skill.content,
     subSkills: skill.subSkills,
+    source: skill.source,
+    pluginType: skill.pluginType,
+    version: skill.version,
+    resources: skill.resourcePaths,
+    readOnly: skill.readOnly,
     createdAt: skill.createdAt instanceof Date ? skill.createdAt.toISOString() : (/* @__PURE__ */ new Date()).toISOString(),
     updatedAt: skill.updatedAt instanceof Date ? skill.updatedAt.toISOString() : (/* @__PURE__ */ new Date()).toISOString()
   };
@@ -3712,7 +3762,7 @@ var ExportImportService = class {
     const files = /* @__PURE__ */ new Map();
     let bundle;
     const gunzip = zlib.createGunzip();
-    await new Promise((resolve2, reject) => {
+    await new Promise((resolve3, reject) => {
       let settled = false;
       let entryCount = 0;
       let declaredTotalBytes = 0;
@@ -3832,7 +3882,7 @@ var ExportImportService = class {
       parser.on("end", () => {
         if (settled) return;
         settled = true;
-        resolve2();
+        resolve3();
       });
       gunzip.pipe(parser);
       gunzip.end(buffer);
@@ -4439,10 +4489,10 @@ async function importApply(request, reply) {
 }
 
 // src/controllers/middleware-types.ts
-import { PluginRegistry } from "@axiom-lattice/core";
+import { PluginRegistry as PluginRegistry2 } from "@axiom-lattice/core";
 function middlewareTypesRoutes(fastify2) {
   fastify2.get("/api/middleware-types", async (_request, reply) => {
-    const metas = PluginRegistry.listMeta();
+    const metas = PluginRegistry2.listMeta();
     return reply.send(metas);
   });
 }
@@ -4517,6 +4567,20 @@ var dataQuerySchema = {
 };
 
 // src/schemas/index.ts
+var downloadFolderSchema = {
+  description: "Download a workspace project folder as a ZIP archive",
+  tags: ["Workspace"],
+  querystring: {
+    type: "object",
+    properties: {
+      path: { type: "string", minLength: 1 },
+      assistantId: { type: "string", minLength: 1 },
+      tenantId: { type: "string", minLength: 1 }
+    },
+    required: ["path"],
+    additionalProperties: false
+  }
+};
 var getAllMemoryItemsSchema = {
   description: "Get all memory items for an assistant thread",
   tags: ["Memory"],
@@ -5114,11 +5178,93 @@ function registerSandboxProxyRoutes(app2) {
 // src/controllers/workspace.ts
 import * as fs2 from "fs/promises";
 import * as path2 from "path";
+import { constants as fsConstants } from "fs";
 import * as os2 from "os";
 import { getStoreLattice as getStoreLattice6 } from "@axiom-lattice/core";
 import { SandboxFilesystem, FilesystemBackend } from "@axiom-lattice/core";
 import { getSandBoxManager as getSandBoxManager3 } from "@axiom-lattice/core";
 import { v4 as uuidv42 } from "uuid";
+var MAX_ZIP_ENTRIES = 1e4;
+var MAX_ZIP_FILE_SIZE = 100 * 1024 * 1024;
+var MAX_ZIP_TOTAL_SIZE = 512 * 1024 * 1024;
+var FolderDownloadError = class extends Error {
+  constructor(statusCode, code, message) {
+    super(message);
+    this.statusCode = statusCode;
+    this.code = code;
+    this.name = "FolderDownloadError";
+  }
+};
+function zipCrc32(data) {
+  let crc = 4294967295;
+  for (const byte of data) {
+    crc ^= byte;
+    for (let bit = 0; bit < 8; bit += 1) {
+      crc = crc >>> 1 ^ 3988292384 & -(crc & 1);
+    }
+  }
+  return (crc ^ 4294967295) >>> 0;
+}
+function createZip(entries) {
+  const localParts = [];
+  const centralParts = [];
+  let offset = 0;
+  for (const entry of entries) {
+    const name = Buffer.from(entry.name, "utf8");
+    const data = entry.data;
+    const crc = zipCrc32(data);
+    const local = Buffer.alloc(30 + name.length + data.length);
+    local.writeUInt32LE(67324752, 0);
+    local.writeUInt16LE(20, 4);
+    local.writeUInt16LE(0, 6);
+    local.writeUInt16LE(2048, 8);
+    local.writeUInt16LE(0, 10);
+    local.writeUInt16LE(0, 12);
+    local.writeUInt32LE(crc, 14);
+    local.writeUInt32LE(data.length, 18);
+    local.writeUInt32LE(data.length, 22);
+    local.writeUInt16LE(name.length, 26);
+    local.writeUInt16LE(0, 28);
+    name.copy(local, 30);
+    data.copy(local, 30 + name.length);
+    localParts.push(local);
+    const central = Buffer.alloc(46 + name.length);
+    central.writeUInt32LE(33639248, 0);
+    central.writeUInt16LE(20, 4);
+    central.writeUInt16LE(20, 6);
+    central.writeUInt16LE(0, 8);
+    central.writeUInt16LE(2048, 10);
+    central.writeUInt16LE(0, 12);
+    central.writeUInt16LE(0, 14);
+    central.writeUInt32LE(crc, 16);
+    central.writeUInt32LE(data.length, 20);
+    central.writeUInt32LE(data.length, 24);
+    central.writeUInt16LE(name.length, 28);
+    central.writeUInt16LE(0, 30);
+    central.writeUInt16LE(0, 32);
+    central.writeUInt16LE(0, 34);
+    central.writeUInt16LE(entry.directory ? 16 : 0, 36);
+    central.writeUInt32LE(entry.directory ? 16 : 0, 38);
+    central.writeUInt32LE(offset, 42);
+    name.copy(central, 46);
+    centralParts.push(central);
+    offset += local.length;
+  }
+  const centralDirectory = Buffer.concat(centralParts);
+  const end = Buffer.alloc(22);
+  end.writeUInt32LE(101010256, 0);
+  end.writeUInt16LE(0, 4);
+  end.writeUInt16LE(0, 6);
+  end.writeUInt16LE(entries.length, 8);
+  end.writeUInt16LE(entries.length, 10);
+  end.writeUInt32LE(centralDirectory.length, 12);
+  end.writeUInt32LE(offset, 16);
+  return Buffer.concat([...localParts, centralDirectory, end]);
+}
+var CAPABILITY_BUNDLE_CONFIG_MESSAGE = "Use /api/projects/:projectId/capability-bundles to update capability bundle IDs";
+function writesCapabilityBundleIds(config) {
+  return config !== void 0 && Object.prototype.hasOwnProperty.call(config, "capabilityBundleIds");
+}
 var WorkspaceController = class {
   constructor() {
     this.workspaceStore = getStoreLattice6("default", "workspace").store;
@@ -5226,6 +5372,13 @@ var WorkspaceController = class {
     const tenantId = this.getTenantId(request);
     const { workspaceId } = request.params;
     const data = request.body;
+    if (writesCapabilityBundleIds(data.config)) {
+      return reply.status(400).send({
+        success: false,
+        code: "INVALID_BUNDLE_CONFIG",
+        message: CAPABILITY_BUNDLE_CONFIG_MESSAGE
+      });
+    }
     const id = uuidv42();
     const project = await this.projectStore.createProject(
       tenantId,
@@ -5248,6 +5401,13 @@ var WorkspaceController = class {
     const tenantId = this.getTenantId(request);
     const { projectId } = request.params;
     const updates = request.body;
+    if (writesCapabilityBundleIds(updates.config)) {
+      return reply.status(400).send({
+        success: false,
+        code: "INVALID_BUNDLE_CONFIG",
+        message: CAPABILITY_BUNDLE_CONFIG_MESSAGE
+      });
+    }
     const project = await this.projectStore.updateProject(
       tenantId,
       projectId,
@@ -5384,6 +5544,293 @@ var WorkspaceController = class {
       return reply.status(502).send({ success: false, error: `Download proxy error: ${message}` });
     }
   }
+  async downloadFolder(request, reply) {
+    const tenantId = this.getTenantId(request);
+    const { workspaceId, projectId } = request.params;
+    const folderPath = request.query.path;
+    const assistantId = request.query.assistantId;
+    if (!folderPath || folderPath.includes("\\") || folderPath.split("/").includes("..")) {
+      return reply.status(400).send({
+        success: false,
+        error: "Invalid folder path",
+        code: "INVALID_PATH"
+      });
+    }
+    try {
+      const storedWorkspace = await this.workspaceStore.getWorkspaceById(tenantId, workspaceId);
+      if (!storedWorkspace) {
+        throw new FolderDownloadError(404, "WORKSPACE_NOT_FOUND", "Workspace not found");
+      }
+      const project = await this.projectStore.getProjectById(tenantId, projectId);
+      if (!project || project.workspaceId !== workspaceId) {
+        throw new FolderDownloadError(404, "PROJECT_NOT_FOUND", "Project not found");
+      }
+      if (storedWorkspace.storageType === "sandbox") {
+        const sandboxManager = getSandBoxManager3();
+        const volumeConfig = {
+          assistant_id: assistantId || "",
+          thread_id: "",
+          tenantId,
+          workspaceId,
+          projectId
+        };
+        const sandbox = await sandboxManager.getSandboxFromConfig(volumeConfig);
+        if (!sandbox.packDirectory || !sandbox.file.deleteFile) {
+          throw new FolderDownloadError(502, "BACKEND_UNSUPPORTED", "Backend does not support folder archive cleanup");
+        }
+        let packed;
+        try {
+          packed = await sandbox.packDirectory(folderPath);
+          if (packed.size === void 0) {
+            throw new FolderDownloadError(502, "BACKEND_UNSUPPORTED", "Backend does not report packed archive size");
+          }
+          if (!Number.isFinite(packed.size) || packed.size < 0 || packed.size > MAX_ZIP_TOTAL_SIZE) {
+            throw new FolderDownloadError(400, "SIZE_LIMIT", "Packed folder exceeds download size limits");
+          }
+          const buffer = await sandbox.file.downloadFile({ file: packed.path });
+          return reply.status(200).type("application/zip").header("Content-Disposition", `attachment; filename*=UTF-8''${encodeURIComponent(packed.filename)}`).send(buffer);
+        } finally {
+          if (packed) {
+            try {
+              await sandbox.file.deleteFile(packed.path);
+            } catch (cleanupError) {
+              console.warn("Failed to clean up packed sandbox folder archive", cleanupError);
+            }
+          }
+        }
+      }
+      const { backend, workspace } = await this.getBackend(
+        tenantId,
+        workspaceId,
+        projectId,
+        assistantId,
+        folderPath
+      );
+      if (!backend.lsInfo) {
+        throw new FolderDownloadError(502, "BACKEND_UNSUPPORTED", "Backend does not support folder downloads");
+      }
+      let listEntries2;
+      if (workspace.storageType !== "sandbox") {
+        const root = filesystemRootDirectory(tenantId, workspaceId, projectId);
+        const target = path2.resolve(root, `.${folderPath.startsWith("/") ? folderPath : `/${folderPath}`}`);
+        const contained = await resolvePathWithinRoot(root, target).catch((error) => {
+          if (error instanceof Error && error.code === "ENOENT") {
+            throw new FolderDownloadError(404, "FOLDER_NOT_FOUND", "Folder not found");
+          }
+          throw error;
+        });
+        let stat2;
+        try {
+          stat2 = await fs2.stat(contained.targetPath);
+        } catch (error) {
+          if (error instanceof Error && error.code === "ENOENT") {
+            throw new FolderDownloadError(404, "FOLDER_NOT_FOUND", "Folder not found");
+          }
+          throw error;
+        }
+        if (!stat2.isDirectory()) {
+          throw new FolderDownloadError(400, "NOT_A_FOLDER", "Path is not a folder");
+        }
+      } else if (folderPath) {
+        const sandboxManager = getSandBoxManager3();
+        const volumeConfig = {
+          assistant_id: assistantId || "",
+          thread_id: "",
+          tenantId,
+          workspaceId,
+          projectId
+        };
+        const volume = await sandboxManager.getVolumeBackendForPath(volumeConfig, folderPath);
+        if (!volume) {
+          const sandbox = await sandboxManager.getSandboxFromConfig(volumeConfig);
+          try {
+            await sandbox.file.listPath(folderPath, { recursive: false });
+          } catch (error) {
+            const code = error instanceof Error ? error.code : void 0;
+            const message = error instanceof Error ? error.message : String(error);
+            if (code === "ENOENT" || /not found|no such file|enoent/i.test(message)) {
+              throw new FolderDownloadError(404, "FOLDER_NOT_FOUND", "Folder not found");
+            }
+            throw error;
+          }
+          listEntries2 = async (directoryPath) => {
+            const result = await sandbox.file.listPath(directoryPath, { recursive: false });
+            return result.files;
+          };
+        } else {
+          listEntries2 = async (directoryPath) => backend.lsInfo(directoryPath);
+        }
+      }
+      if (!listEntries2) {
+        listEntries2 = async (directoryPath) => backend.lsInfo(directoryPath);
+      }
+      const folderName = path2.basename(folderPath.replace(/\/$/, "")) || "folder";
+      const prefix = `${folderName}/`;
+      const entries = [{ name: prefix, data: Buffer.alloc(0), directory: true }];
+      let totalSize = 0;
+      const filesystemRoot = workspace.storageType === "sandbox" ? void 0 : filesystemRootDirectory(tenantId, workspaceId, projectId);
+      const addFile = (archivePath, data) => {
+        if (data.length > MAX_ZIP_FILE_SIZE || totalSize + data.length > MAX_ZIP_TOTAL_SIZE) {
+          throw new FolderDownloadError(400, "SIZE_LIMIT", "Folder exceeds download size limits");
+        }
+        totalSize += data.length;
+        entries.push({ name: archivePath, data, directory: false });
+      };
+      const collectFilesystem = async (directoryPath, archivePath) => {
+        let children;
+        try {
+          children = await fs2.readdir(directoryPath, { withFileTypes: true });
+        } catch (error) {
+          if (error instanceof Error && error.code === "ENOENT") {
+            throw new FolderDownloadError(404, "FOLDER_NOT_FOUND", "Folder not found");
+          }
+          throw error;
+        }
+        for (const child of children) {
+          if (entries.length >= MAX_ZIP_ENTRIES) {
+            throw new FolderDownloadError(400, "ENTRY_LIMIT", "Folder contains too many entries");
+          }
+          const childPath = path2.join(directoryPath, child.name);
+          const archiveChildPath = `${archivePath}${child.name}`;
+          let resolvedChild;
+          try {
+            resolvedChild = await resolvePathWithinRoot(filesystemRoot, childPath);
+          } catch (error) {
+            if (error instanceof Error && error.code === "ENOENT") {
+              throw new FolderDownloadError(404, "FOLDER_NOT_FOUND", "Folder not found");
+            }
+            throw new FolderDownloadError(400, "INVALID_PATH", "Folder contains a path outside the project");
+          }
+          let childStat;
+          try {
+            childStat = await fs2.lstat(resolvedChild.targetPath);
+          } catch (error) {
+            if (error instanceof Error && error.code === "ENOENT") {
+              throw new FolderDownloadError(404, "FOLDER_NOT_FOUND", "Folder not found");
+            }
+            throw error;
+          }
+          if (childStat.isSymbolicLink() || child.isSymbolicLink()) {
+            throw new FolderDownloadError(400, "INVALID_PATH", "Symbolic links are not allowed in folder downloads");
+          }
+          if (child.isDirectory()) {
+            entries.push({ name: `${archiveChildPath}/`, data: Buffer.alloc(0), directory: true });
+            await collectFilesystem(resolvedChild.targetPath, `${archiveChildPath}/`);
+          } else if (child.isFile()) {
+            if (childStat.size > MAX_ZIP_FILE_SIZE || totalSize + childStat.size > MAX_ZIP_TOTAL_SIZE) {
+              throw new FolderDownloadError(400, "SIZE_LIMIT", "Folder exceeds download size limits");
+            }
+            const flags = fsConstants.O_NOFOLLOW === void 0 ? fsConstants.O_RDONLY : fsConstants.O_RDONLY | fsConstants.O_NOFOLLOW;
+            let handle3;
+            try {
+              handle3 = await fs2.open(resolvedChild.targetPath, flags);
+            } catch (error) {
+              if (error instanceof Error && error.code === "ENOENT") {
+                throw new FolderDownloadError(404, "FOLDER_NOT_FOUND", "Folder not found");
+              }
+              throw error;
+            }
+            try {
+              const openedStat = await handle3.stat();
+              if (!openedStat.isFile() || openedStat.size > MAX_ZIP_FILE_SIZE || totalSize + openedStat.size > MAX_ZIP_TOTAL_SIZE) {
+                throw new FolderDownloadError(400, "SIZE_LIMIT", "Folder exceeds download size limits");
+              }
+              const readLimit = MAX_ZIP_FILE_SIZE + 1;
+              const dataBuffer = Buffer.alloc(Math.min(openedStat.size + 1, readLimit));
+              let bytesRead = 0;
+              while (bytesRead < dataBuffer.length) {
+                const result = await handle3.read(
+                  dataBuffer,
+                  bytesRead,
+                  dataBuffer.length - bytesRead,
+                  bytesRead
+                );
+                if (result.bytesRead === 0) break;
+                bytesRead += result.bytesRead;
+              }
+              const data = dataBuffer.subarray(0, bytesRead);
+              const finalStat = await handle3.stat();
+              if (finalStat.size > MAX_ZIP_FILE_SIZE || totalSize + finalStat.size > MAX_ZIP_TOTAL_SIZE || finalStat.size > data.length) {
+                throw new FolderDownloadError(400, "SIZE_LIMIT", "Folder exceeds download size limits");
+              }
+              addFile(archiveChildPath, data);
+            } finally {
+              await handle3.close();
+            }
+          }
+        }
+      };
+      const collect = async (currentPath, archivePath) => {
+        let children;
+        try {
+          children = await listEntries2(currentPath);
+        } catch (error) {
+          const message = error instanceof Error ? error.message : String(error);
+          if (/not found|enoent|no such file/i.test(message)) {
+            throw new FolderDownloadError(404, "FOLDER_NOT_FOUND", "Folder not found");
+          }
+          throw error;
+        }
+        for (const child of children) {
+          if (entries.length >= MAX_ZIP_ENTRIES) {
+            throw new FolderDownloadError(400, "ENTRY_LIMIT", "Folder contains too many entries");
+          }
+          const childPath = child.path;
+          if (childPath.includes("\\") || childPath.split("/").includes("..") || !childPath.startsWith(folderPath.endsWith("/") ? folderPath : `${folderPath}/`)) {
+            throw new FolderDownloadError(400, "INVALID_PATH", "Folder contains an unsafe child path");
+          }
+          if (workspace.storageType !== "sandbox") {
+            const root = filesystemRootDirectory(tenantId, workspaceId, projectId);
+            const virtualChildPath = childPath.startsWith("/") ? childPath : `/${childPath}`;
+            const target = path2.resolve(root, `.${virtualChildPath}`);
+            try {
+              await resolvePathWithinRoot(root, target);
+              const childStat = await fs2.lstat(target);
+              if (childStat.isSymbolicLink()) {
+                throw new FolderDownloadError(400, "INVALID_PATH", "Symbolic links are not allowed in folder downloads");
+              }
+            } catch (error) {
+              if (error instanceof FolderDownloadError) throw error;
+              if (error instanceof Error && error.code === "ENOENT") {
+                throw new FolderDownloadError(404, "FOLDER_NOT_FOUND", "Folder not found");
+              }
+              throw new FolderDownloadError(400, "INVALID_PATH", "Folder contains a path outside the project");
+            }
+          }
+          const childName = path2.basename(childPath.replace(/\/$/, ""));
+          const childArchivePath = `${archivePath}${childName}`;
+          if (child.is_dir) {
+            entries.push({ name: `${childArchivePath}/`, data: Buffer.alloc(0), directory: true });
+            await collect(childPath, `${childArchivePath}/`);
+          } else {
+            const size = child.size ?? 0;
+            if (size > MAX_ZIP_FILE_SIZE || totalSize + size > MAX_ZIP_TOTAL_SIZE) {
+              throw new FolderDownloadError(400, "SIZE_LIMIT", "Folder exceeds download size limits");
+            }
+            const data = await backend.readBinary(childPath);
+            addFile(childArchivePath, data);
+          }
+        }
+      };
+      if (workspace.storageType === "sandbox") {
+        await collect(folderPath, prefix);
+      } else {
+        const root = filesystemRoot;
+        const target = path2.resolve(root, `.${folderPath.startsWith("/") ? folderPath : `/${folderPath}`}`);
+        await collectFilesystem(target, prefix);
+      }
+      const zip = createZip(entries);
+      const downloadName = `${folderName}.zip`;
+      return reply.status(200).type("application/zip").header("Content-Disposition", `attachment; filename*=UTF-8''${encodeURIComponent(downloadName)}`).send(zip);
+    } catch (error) {
+      const folderError = error instanceof FolderDownloadError ? error : error instanceof PathOutsideRootError || error instanceof Error && ["ELOOP", "ENOTDIR", "EACCES"].includes(error.code || "") ? new FolderDownloadError(400, "INVALID_PATH", "Folder contains a path outside the project") : new FolderDownloadError(502, "DOWNLOAD_FAILED", error instanceof Error ? error.message : String(error));
+      return reply.status(folderError.statusCode).send({
+        success: false,
+        error: folderError.message,
+        code: folderError.code
+      });
+    }
+  }
   /**
    * View a file inline in the browser (not download).
    * Returns file content with inline Content-Disposition for preview.
@@ -5676,6 +6123,11 @@ function registerWorkspaceRoutes(app2) {
     "/api/workspaces/:workspaceId/projects/:projectId/downloadfile",
     controller.downloadFile.bind(controller)
   );
+  app2.get(
+    "/api/workspaces/:workspaceId/projects/:projectId/downloadfolder",
+    { schema: downloadFolderSchema },
+    controller.downloadFolder.bind(controller)
+  );
   app2.get(
     "/api/workspaces/:workspaceId/projects/:projectId/viewfile",
     controller.viewFile.bind(controller)
@@ -5903,7 +6355,7 @@ async function testDatabaseConnection(request, reply) {
       await db.connect();
       await db.listTables();
       const latency = Date.now() - startTime;
-      await new Promise((resolve2) => setTimeout(resolve2, 100));
+      await new Promise((resolve3) => setTimeout(resolve3, 100));
       await db.disconnect();
       await sqlDatabaseManager.removeDatabase(tenantId, testKey);
       return {
@@ -6556,7 +7008,7 @@ function registerMetricsServerConfigRoutes(app2) {
 }
 
 // src/controllers/connections.ts
-import { ConnectionRegistry, PluginRegistry as PluginRegistry2 } from "@axiom-lattice/core";
+import { ConnectionRegistry, PluginRegistry as PluginRegistry3 } from "@axiom-lattice/core";
 import { z } from "zod";
 var createBody = z.object({
   type: z.string().min(1),
@@ -6659,7 +7111,7 @@ function connectionRoutes(fastify2) {
   fastify2.post("/api/connections/test", async (request, reply) => {
     const { type } = request.query;
     if (!type) return reply.status(400).send({ error: "query 'type' required" });
-    const plugin = PluginRegistry2.get(type);
+    const plugin = PluginRegistry3.get(type);
     if (!plugin?.connection?.test) {
       return reply.status(400).send({ error: "plugin does not support connection testing" });
     }
@@ -6687,7 +7139,7 @@ function connectionRoutes(fastify2) {
   fastify2.post("/api/connections/discover", async (request, reply) => {
     const { type } = request.query;
     if (!type) return reply.status(400).send({ error: "query 'type' required" });
-    const plugin = PluginRegistry2.get(type);
+    const plugin = PluginRegistry3.get(type);
     if (!plugin?.connection?.discover) {
       return reply.status(400).send({ error: "plugin does not support resource discovery" });
     }
@@ -6725,6 +7177,7 @@ import {
   LatticeEvalProject
 } from "@axiom-lattice/core";
 import { v4 as uuidv43 } from "uuid";
+var TERMINAL_PERSIST_ATTEMPTS = 2;
 function mapLogs(logs) {
   return logs.map((l) => ({
     timestamp: l.ts,
@@ -6736,18 +7189,42 @@ function mapLogs(logs) {
 var EvalRunner = class {
   constructor() {
     this.runs = /* @__PURE__ */ new Map();
+    this.projectLeases = /* @__PURE__ */ new Map();
     this.eventEmitter = new EventEmitter();
     this.processStartedAt = /* @__PURE__ */ new Date();
   }
   getEventEmitter() {
     return this.eventEmitter;
   }
+  reserveProjectDeletion(tenantId, projectId) {
+    const leaseKey = `${tenantId}:${projectId}`;
+    if (this.projectLeases.has(leaseKey) || [...this.runs.values()].some(
+      (ctx) => ctx.tenantId === tenantId && ctx.projectId === projectId && !ctx.terminal.workerSettled
+    )) return null;
+    const leaseToken = Symbol(`delete:${leaseKey}`);
+    this.projectLeases.set(leaseKey, leaseToken);
+    return () => this.releaseProjectLease(leaseKey, leaseToken);
+  }
   async startRun(tenantId, projectId, suiteIds, caseIds, runConfig, taskId) {
+    const leaseKey = `${tenantId}:${projectId}`;
+    if (this.projectLeases.has(leaseKey)) {
+      throw new Error("A run is already in progress for this project");
+    }
+    const leaseToken = Symbol(leaseKey);
+    this.projectLeases.set(leaseKey, leaseToken);
+    try {
+      return await this.startLeasedRun(tenantId, projectId, suiteIds, caseIds, runConfig, taskId, leaseKey, leaseToken);
+    } catch (error) {
+      this.releaseProjectLease(leaseKey, leaseToken);
+      throw error;
+    }
+  }
+  async startLeasedRun(tenantId, projectId, suiteIds, caseIds, runConfig, taskId, leaseKey, leaseToken) {
     const store = this.getEvalStore();
     const project = await store.getProjectById(tenantId, projectId);
     if (!project) throw new Error("Project not found");
     for (const ctx of this.runs.values()) {
-      if (ctx.projectId === projectId) {
+      if (ctx.projectId === projectId && !ctx.terminal.persisted) {
         throw new Error("A run is already in progress for this project");
       }
     }
@@ -6851,14 +7328,35 @@ var EvalRunner = class {
     };
     const abortController = new AbortController();
     const stats = { passed: 0, failed: 0, interrupted: 0, totalScore: 0 };
+    const terminal = { claiming: false, persisted: false, workerSettled: false };
+    const terminalUnavailable = () => terminal.claiming || terminal.persisted;
+    const persistTerminal = async (update, event) => {
+      if (terminalUnavailable()) return false;
+      terminal.claiming = true;
+      try {
+        let lastError;
+        for (let attempt = 0; attempt < TERMINAL_PERSIST_ATTEMPTS; attempt++) {
+          try {
+            const persistedRun = await store.updateRunStatus(tenantId, runId, update);
+            if (!persistedRun) throw new Error(`Evaluation run ${runId} no longer exists`);
+            lastError = void 0;
+            break;
+          } catch (error) {
+            lastError = error;
+          }
+        }
+        if (lastError) throw lastError;
+        terminal.persisted = true;
+        this.eventEmitter.emit(`run:${runId}`, event);
+        return true;
+      } finally {
+        terminal.claiming = false;
+      }
+    };
     const onCaseComplete = async (result, suiteName) => {
+      if (terminalUnavailable()) return;
       const passed = result.result?.pass ?? false;
       const score = result.result?.final_score ?? 0;
-      if (passed) stats.passed++;
-      else stats.failed++;
-      stats.totalScore += score;
-      if (result.interrupted) stats.interrupted++;
-      const completedCount = stats.passed + stats.failed;
       await store.createRunResult(tenantId, runId, uuidv43(), {
         suiteName,
         caseId: result.caseId,
@@ -6876,13 +7374,22 @@ var EvalRunner = class {
         error: result.error,
         interrupted: result.interrupted
       });
+      if (terminalUnavailable()) return;
+      if (passed) stats.passed++;
+      else stats.failed++;
+      stats.totalScore += score;
+      if (result.interrupted) stats.interrupted++;
+      const completedCount = stats.passed + stats.failed;
+      if (terminalUnavailable()) return;
       const avgScore = completedCount > 0 ? stats.totalScore / completedCount : 0;
-      await store.updateRunStatus(tenantId, runId, {
+      const persistedRun = await store.updateRunStatus(tenantId, runId, {
         passedCases: stats.passed,
         failedCases: stats.failed,
         interruptedCases: stats.interrupted,
         avgScore
       });
+      if (!persistedRun) throw new Error(`Evaluation run ${runId} no longer exists`);
+      if (terminalUnavailable()) return;
       this.eventEmitter.emit(`run:${runId}`, {
         type: "progress",
         runId,
@@ -6894,65 +7401,86 @@ var EvalRunner = class {
         const evalProject = new LatticeEvalProject(projectConfig, onCaseComplete);
         const calibration = await evalProject.calibrateJudge();
         if (!calibration.ok && !calibration.bypassed) {
-          await store.updateRunStatus(tenantId, runId, {
-            status: "failed",
-            error: `Judge calibration failed: ${calibration.reason}`,
-            completedAt: /* @__PURE__ */ new Date()
-          });
           throw new Error(`Judge calibration failed: ${calibration.reason}`);
         }
         if (calibration.bypassed) {
           console.warn(`[eval-runner] Judge calibration bypassed \u2014 judge may be unreliable: ${calibration.reason}`);
         }
         const { report } = await evalProject.runAllSuitesBatch(concurrency, abortController.signal);
-        if (!abortController.signal.aborted) {
-          const completedCount = stats.passed + stats.failed;
-          await store.updateRunStatus(tenantId, runId, {
-            status: "completed",
-            completedAt: /* @__PURE__ */ new Date(),
-            passedCases: stats.passed,
-            failedCases: stats.failed,
-            interruptedCases: stats.interrupted,
-            avgScore: completedCount > 0 ? stats.totalScore / completedCount : 0
-          });
-          this.eventEmitter.emit(`run:${runId}`, {
-            type: "completed",
-            runId,
-            data: { passed: stats.passed, failed: stats.failed, avgScore: completedCount > 0 ? stats.totalScore / completedCount : 0 }
-          });
-        }
+        const completedCount = stats.passed + stats.failed;
+        await persistTerminal({
+          status: "completed",
+          completedAt: /* @__PURE__ */ new Date(),
+          passedCases: stats.passed,
+          failedCases: stats.failed,
+          interruptedCases: stats.interrupted,
+          avgScore: completedCount > 0 ? stats.totalScore / completedCount : 0
+        }, {
+          type: "completed",
+          runId,
+          data: { passed: stats.passed, failed: stats.failed, avgScore: completedCount > 0 ? stats.totalScore / completedCount : 0 }
+        });
         return { report };
       } catch (err) {
         const errorMsg = err.message;
-        if (!abortController.signal.aborted) {
-          await store.updateRunStatus(tenantId, runId, {
+        try {
+          await persistTerminal({
             status: "failed",
             error: errorMsg,
             completedAt: /* @__PURE__ */ new Date()
-          });
-          this.eventEmitter.emit(`run:${runId}`, {
+          }, {
             type: "error",
             runId,
             data: { message: errorMsg }
           });
+        } catch {
         }
         throw err;
       } finally {
-        this.runs.delete(runId);
+        terminal.workerSettled = true;
+        if (terminal.persisted) {
+          this.runs.delete(runId);
+          this.releaseProjectLease(leaseKey, leaseToken);
+        }
       }
     })();
-    this.runs.set(runId, { runId, projectId, tenantId, abortController, promise: runPromise, taskId });
+    this.runs.set(runId, { runId, projectId, tenantId, abortController, promise: runPromise, terminal, leaseKey, leaseToken, taskId });
     runPromise.catch(() => {
     });
     return runId;
   }
-  async abortRun(runId) {
+  async abortRun(runId, tenantId) {
     const ctx = this.runs.get(runId);
-    if (!ctx) return false;
+    if (!ctx || tenantId !== void 0 && ctx.tenantId !== tenantId) return false;
+    if (ctx.terminal.claiming || ctx.terminal.persisted) return false;
     ctx.abortController.abort();
     const store = this.getEvalStore();
-    await store.updateRunStatus(ctx.tenantId, runId, { status: "aborted", completedAt: /* @__PURE__ */ new Date() });
-    return true;
+    ctx.terminal.claiming = true;
+    try {
+      let lastError;
+      for (let attempt = 0; attempt < TERMINAL_PERSIST_ATTEMPTS; attempt++) {
+        try {
+          const persistedRun = await store.updateRunStatus(ctx.tenantId, runId, { status: "aborted", completedAt: /* @__PURE__ */ new Date() });
+          if (!persistedRun) throw new Error(`Evaluation run ${runId} no longer exists`);
+          lastError = void 0;
+          break;
+        } catch (error) {
+          lastError = error;
+        }
+      }
+      if (lastError) throw lastError;
+      ctx.terminal.persisted = true;
+      this.eventEmitter.emit(`run:${runId}`, {
+        type: "error",
+        runId,
+        data: { message: "Run aborted" }
+      });
+      this.releaseProjectLease(ctx.leaseKey, ctx.leaseToken);
+      if (ctx.terminal.workerSettled) this.runs.delete(runId);
+      return true;
+    } finally {
+      ctx.terminal.claiming = false;
+    }
   }
   async waitForRun(runId) {
     const ctx = this.runs.get(runId);
@@ -6960,12 +7488,25 @@ var EvalRunner = class {
     const { report } = await ctx.promise;
     return report;
   }
-  isRunning(runId) {
-    return this.runs.has(runId);
+  /**
+   * Whether the run can still be controlled or observed as a non-terminal run.
+   * Acknowledged aborts return false even while their worker is unwinding.
+   */
+  isRunning(runId, tenantId) {
+    const ctx = this.runs.get(runId);
+    return ctx !== void 0 && !ctx.terminal.persisted && (tenantId === void 0 || ctx.tenantId === tenantId);
+  }
+  /** Whether the run's worker promise has not yet reached its finally block. */
+  hasActiveExecution(runId, tenantId) {
+    const ctx = this.runs.get(runId);
+    return ctx !== void 0 && !ctx.terminal.workerSettled && (tenantId === void 0 || ctx.tenantId === tenantId);
   }
   getEvalStore() {
     return getStoreLattice9("default", "eval").store;
   }
+  releaseProjectLease(leaseKey, leaseToken) {
+    if (this.projectLeases.get(leaseKey) === leaseToken) this.projectLeases.delete(leaseKey);
+  }
 };
 var evalRunner = new EvalRunner();
 
@@ -6980,6 +7521,18 @@ function getTenantId11(request) {
 function getEvalStore() {
   return getStoreLattice10("default", "eval").store;
 }
+async function getOwnedSuite(store, tenantId, projectId, suiteId) {
+  const project = await store.getProjectById(tenantId, projectId);
+  if (!project) return null;
+  const suite = await store.getSuiteById(tenantId, suiteId);
+  return suite?.projectId === projectId ? suite : null;
+}
+async function getOwnedCase(store, tenantId, projectId, suiteId, caseId) {
+  const suite = await getOwnedSuite(store, tenantId, projectId, suiteId);
+  if (!suite) return null;
+  const evalCase = await store.getCaseById(tenantId, caseId);
+  return evalCase?.suiteId === suiteId ? evalCase : null;
+}
 async function createProject(request, reply) {
   try {
     const tenantId = getTenantId11(request);
@@ -7135,6 +7688,7 @@ async function updateProject(request, reply) {
   }
 }
 async function deleteProject(request, reply) {
+  let releaseDeletion;
   try {
     const tenantId = getTenantId11(request);
     const store = getEvalStore();
@@ -7143,6 +7697,23 @@ async function deleteProject(request, reply) {
     if (!existing) {
       return reply.status(404).send({ success: false, message: "Project not found" });
     }
+    releaseDeletion = evalRunner.reserveProjectDeletion(tenantId, pid) ?? void 0;
+    if (!releaseDeletion) {
+      return reply.status(409).send({
+        success: false,
+        message: "Cannot delete an evaluation project with an active run"
+      });
+    }
+    const runs = await store.getRunsByTenant(tenantId, { projectId: pid });
+    const hasActiveRun = runs.some(
+      (run) => run.status === "running" || evalRunner.hasActiveExecution(run.id, tenantId)
+    );
+    if (hasActiveRun) {
+      return reply.status(409).send({
+        success: false,
+        message: "Cannot delete an evaluation project with an active run"
+      });
+    }
     const deleted = await store.deleteProject(tenantId, pid);
     if (!deleted) {
       return reply.status(500).send({ success: false, message: "Failed to delete project" });
@@ -7151,6 +7722,8 @@ async function deleteProject(request, reply) {
   } catch (err) {
     const message = err instanceof Error ? err.message : "Failed to delete project";
     return reply.status(500).send({ success: false, message });
+  } finally {
+    releaseDeletion?.();
   }
 }
 async function createSuite(request, reply) {
@@ -7179,8 +7752,8 @@ async function updateSuite(request, reply) {
   try {
     const tenantId = getTenantId11(request);
     const store = getEvalStore();
-    const { sid } = request.params;
-    const existing = await store.getSuiteById(tenantId, sid);
+    const { pid, sid } = request.params;
+    const existing = await getOwnedSuite(store, tenantId, pid, sid);
     if (!existing) {
       return reply.status(404).send({ success: false, message: "Suite not found" });
     }
@@ -7199,8 +7772,8 @@ async function deleteSuite(request, reply) {
   try {
     const tenantId = getTenantId11(request);
     const store = getEvalStore();
-    const { sid } = request.params;
-    const existing = await store.getSuiteById(tenantId, sid);
+    const { pid, sid } = request.params;
+    const existing = await getOwnedSuite(store, tenantId, pid, sid);
     if (!existing) {
       return reply.status(404).send({ success: false, message: "Suite not found" });
     }
@@ -7218,8 +7791,8 @@ async function createCase(request, reply) {
   try {
     const tenantId = getTenantId11(request);
     const store = getEvalStore();
-    const { sid } = request.params;
-    const suite = await store.getSuiteById(tenantId, sid);
+    const { pid, sid } = request.params;
+    const suite = await getOwnedSuite(store, tenantId, pid, sid);
     if (!suite) {
       return reply.status(404).send({ success: false, message: "Suite not found" });
     }
@@ -7248,7 +7821,11 @@ async function listCasesForSuite(request, reply) {
   try {
     const tenantId = getTenantId11(request);
     const store = getEvalStore();
-    const { sid } = request.params;
+    const { pid, sid } = request.params;
+    const suite = await getOwnedSuite(store, tenantId, pid, sid);
+    if (!suite) {
+      return reply.status(404).send({ success: false, message: "Suite not found" });
+    }
     const cases = await store.getCasesBySuite(tenantId, sid);
     return {
       success: true,
@@ -7264,8 +7841,8 @@ async function updateCase(request, reply) {
   try {
     const tenantId = getTenantId11(request);
     const store = getEvalStore();
-    const { cid } = request.params;
-    const existing = await store.getCaseById(tenantId, cid);
+    const { pid, sid, cid } = request.params;
+    const existing = await getOwnedCase(store, tenantId, pid, sid, cid);
     if (!existing) {
       return reply.status(404).send({ success: false, message: "Case not found" });
     }
@@ -7284,8 +7861,8 @@ async function deleteCase(request, reply) {
   try {
     const tenantId = getTenantId11(request);
     const store = getEvalStore();
-    const { cid } = request.params;
-    const existing = await store.getCaseById(tenantId, cid);
+    const { pid, sid, cid } = request.params;
+    const existing = await getOwnedCase(store, tenantId, pid, sid, cid);
     if (!existing) {
       return reply.status(404).send({ success: false, message: "Case not found" });
     }
@@ -7354,6 +7931,11 @@ function registerEvalRoutes(app2) {
     }
   });
   app2.get("/api/eval/runs/:rid/stream", async (request, reply) => {
+    const tenantId = getTenantId11(request);
+    const { rid } = request.params;
+    const store = getEvalStore();
+    const ownedRun = await store.getRunById(tenantId, rid);
+    if (!ownedRun) return reply.status(404).send({ success: false, message: "Run not found" });
     reply.hijack();
     reply.raw.writeHead(200, {
       "Content-Type": "text/event-stream",
@@ -7361,41 +7943,75 @@ function registerEvalRoutes(app2) {
       Connection: "keep-alive",
       "Access-Control-Allow-Origin": "*"
     });
-    const { rid } = request.params;
     const emitter = evalRunner.getEventEmitter();
     const eventKey = `run:${rid}`;
-    if (!evalRunner.isRunning(rid)) {
-      const tenantId = getTenantId11(request);
-      const run = await getEvalStore().getRunById(tenantId, rid);
-      if (run) {
-        const eventType = run.status === "completed" ? "completed" : "error";
-        reply.raw.write(`event: ${eventType}
-data: ${JSON.stringify({ passed: run.passedCases, failed: run.failedCases, avgScore: run.avgScore })}
+    let settled = false;
+    const cleanup = () => {
+      emitter.off(eventKey, handler);
+      request.raw.off("close", disconnect);
+    };
+    const disconnect = () => {
+      if (settled) return;
+      settled = true;
+      cleanup();
+    };
+    const finish = (type, data) => {
+      if (settled) return;
+      settled = true;
+      cleanup();
+      reply.raw.write(`event: ${type}
+data: ${JSON.stringify(data)}
 
 `);
-      }
       reply.raw.end();
-      return;
-    }
+    };
     const handler = (event) => {
-      reply.raw.write(`event: ${event.type}
+      if (event.type === "completed" || event.type === "error") {
+        finish(event.type, event.data);
+        return;
+      }
+      if (!settled) reply.raw.write(`event: ${event.type}
 data: ${JSON.stringify(event.data)}
 
 `);
-      if (event.type === "completed" || event.type === "error") {
-        emitter.off(eventKey, handler);
-        reply.raw.end();
-      }
     };
     emitter.on(eventKey, handler);
-    request.raw.on("close", () => {
-      emitter.off(eventKey, handler);
-    });
+    request.raw.on("close", disconnect);
+    let reconciledRun;
+    try {
+      reconciledRun = await store.getRunById(tenantId, rid);
+    } catch (error) {
+      finish("error", { message: error.message });
+      return;
+    }
+    if (settled) return;
+    if (!reconciledRun) {
+      cleanup();
+      reply.raw.end();
+      return;
+    }
+    if (reconciledRun.status === "completed") {
+      finish("completed", {
+        passed: reconciledRun.passedCases,
+        failed: reconciledRun.failedCases,
+        avgScore: reconciledRun.avgScore
+      });
+    } else if (reconciledRun.status === "failed") {
+      finish("error", { message: reconciledRun.error ?? "Evaluation failed" });
+    } else if (reconciledRun.status === "aborted") {
+      finish("error", { message: "Run aborted" });
+    } else if (!evalRunner.isRunning(rid, tenantId)) {
+      cleanup();
+      reply.raw.end();
+    }
   });
   app2.post("/api/eval/runs/:rid/abort", async (request, reply) => {
     try {
+      const tenantId = getTenantId11(request);
       const { rid } = request.params;
-      const aborted = await evalRunner.abortRun(rid);
+      const run = await getEvalStore().getRunById(tenantId, rid);
+      if (!run) return reply.status(404).send({ success: false, message: "Run not found" });
+      const aborted = await evalRunner.abortRun(rid, tenantId);
       if (!aborted) return reply.status(404).send({ success: false, message: "Run not found or not running" });
       reply.send({ success: true, message: "Run aborted" });
     } catch (err) {
@@ -7406,7 +8022,13 @@ data: ${JSON.stringify(event.data)}
     try {
       const tenantId = getTenantId11(request);
       const { rid } = request.params;
-      const deleted = await getEvalStore().deleteRun(tenantId, rid);
+      const store = getEvalStore();
+      const run = await store.getRunById(tenantId, rid);
+      if (!run) return reply.status(404).send({ success: false, message: "Run not found" });
+      if (run.status === "running" || evalRunner.hasActiveExecution(rid, tenantId)) {
+        return reply.status(409).send({ success: false, message: "Cannot delete an active evaluation run" });
+      }
+      const deleted = await store.deleteRun(tenantId, rid);
       if (!deleted) return reply.status(404).send({ success: false, message: "Run not found" });
       reply.send({ success: true, message: "Run deleted" });
     } catch (err) {
@@ -7523,31 +8145,31 @@ var TenantsController = class {
   async createTenant(request, reply) {
     const data = request.body;
     const id = uuidv46();
-    const tenant = await this.tenantStore.createTenant(id, data);
-    return reply.status(201).send({ success: true, data: tenant });
+    const tenant2 = await this.tenantStore.createTenant(id, data);
+    return reply.status(201).send({ success: true, data: tenant2 });
   }
   async getTenant(request, reply) {
     const { tenantId } = request.params;
-    const tenant = await this.tenantStore.getTenantById(tenantId);
-    if (!tenant) {
+    const tenant2 = await this.tenantStore.getTenantById(tenantId);
+    if (!tenant2) {
       return reply.status(404).send({
         success: false,
         error: "Tenant not found"
       });
     }
-    return { success: true, data: tenant };
+    return { success: true, data: tenant2 };
   }
   async updateTenant(request, reply) {
     const { tenantId } = request.params;
     const updates = request.body;
-    const tenant = await this.tenantStore.updateTenant(tenantId, updates);
-    if (!tenant) {
+    const tenant2 = await this.tenantStore.updateTenant(tenantId, updates);
+    if (!tenant2) {
       return reply.status(404).send({
         success: false,
         error: "Tenant not found"
       });
     }
-    return { success: true, data: tenant };
+    return { success: true, data: tenant2 };
   }
   async deleteTenant(request, reply) {
     const { tenantId } = request.params;
@@ -7700,10 +8322,10 @@ var AuthController = class {
       const links = await this.userTenantLinkStore.getTenantsByUser(userId);
       const tenantsWithDetails = await Promise.all(
         links.map(async (link) => {
-          const tenant = await this.tenantStore.getTenantById(link.tenantId);
+          const tenant2 = await this.tenantStore.getTenantById(link.tenantId);
           return {
             ...link,
-            tenant: tenant || null
+            tenant: tenant2 || null
           };
         })
       );
@@ -7736,8 +8358,8 @@ var AuthController = class {
           error: "You do not have access to this tenant"
         });
       }
-      const tenant = await this.tenantStore.getTenantById(tenantId);
-      if (!tenant) {
+      const tenant2 = await this.tenantStore.getTenantById(tenantId);
+      if (!tenant2) {
         return reply.status(404).send({
           success: false,
           error: "Tenant not found"
@@ -7761,7 +8383,7 @@ var AuthController = class {
       return {
         success: true,
         data: {
-          tenant,
+          tenant: tenant2,
           token,
           personalAssistant
         }
@@ -7831,8 +8453,8 @@ var AuthController = class {
           error: "User not found"
         });
       }
-      const tenant = await this.tenantStore.getTenantById(tenantId);
-      if (!tenant) {
+      const tenant2 = await this.tenantStore.getTenantById(tenantId);
+      if (!tenant2) {
         return reply.status(404).send({
           success: false,
           error: "Tenant not found"
@@ -8002,7 +8624,7 @@ function registerConsoleAuthHook(app2, options) {
     if (PUBLIC_ROUTES.some((route) => request.url === route)) return;
     if (request.url.startsWith("/s/")) return;
     const path4 = request.url.split("?")[0];
-    if (path4.includes("/viewfile") || path4.includes("/downloadfile") || path4.includes("/uploadfile") || path4.startsWith("/f/") || path4 === "/f") {
+    if (request.method === "GET" && /^\/api\/workspaces\/[^/]+\/projects\/[^/]+\/viewfile$/.test(path4) || request.method === "GET" && /^\/api\/workspaces\/[^/]+\/projects\/[^/]+\/downloadfile$/.test(path4) || request.method === "POST" && /^\/api\/workspaces\/[^/]+\/projects\/[^/]+\/uploadfile$/.test(path4) || path4.startsWith("/f/") || path4 === "/f") {
       return;
     }
     await reply.status(401).send({
@@ -9002,12 +9624,12 @@ async function handleBridgeProxy(request, reply) {
   };
   const timeout = 3e5;
   try {
-    const response = await new Promise((resolve2, reject) => {
+    const response = await new Promise((resolve3, reject) => {
       const timer = setTimeout(() => {
         pending.delete(requestId);
         reject(new Error(`Bridge request timeout after ${timeout}ms`));
       }, timeout);
-      pending.set(requestId, { resolve: resolve2, reject, timer, agentId });
+      pending.set(requestId, { resolve: resolve3, reject, timer, agentId });
       try {
         if (conn.ws.readyState !== conn.ws.OPEN) {
           pending.delete(requestId);
@@ -10639,11 +11261,365 @@ function isAttachmentPayload(value) {
   return typeof record.webAppId === "string" && typeof record.userDigest === "string" && /^[a-f0-9]{64}$/.test(record.userDigest) && typeof record.threadId === "string" && typeof record.projectId === "string" && typeof record.uri === "string" && record.uri.startsWith("/") && typeof record.name === "string" && record.name.length > 0 && typeof record.mimeType === "string" && record.mimeType.length > 0 && typeof record.size === "number" && Number.isSafeInteger(record.size) && record.size >= 0 && typeof record.contentDigest === "string" && /^[a-f0-9]{64}$/.test(record.contentDigest) && typeof record.exp === "number" && Number.isSafeInteger(record.exp);
 }
 
+// src/controllers/capability-bundles.ts
+import { z as z6 } from "zod";
+
+// src/services/capability/CapabilityBundleService.ts
+import { z as z5 } from "zod";
+import { CapabilityBundleMergeError, CapabilityBundleValidationError, mergeCapabilityBundles, validateCapabilityBundleInput } from "@axiom-lattice/core";
+var CapabilityBundleServiceError = class extends Error {
+  constructor(code, message, statusCode) {
+    super(message);
+    this.code = code;
+    this.statusCode = statusCode;
+    this.name = "CapabilityBundleServiceError";
+  }
+};
+var uuid = z5.string().uuid();
+function ownRecord(value) {
+  if (value === void 0 || value === null) return {};
+  if (typeof value !== "object" || Array.isArray(value)) throw new CapabilityBundleServiceError("INVALID_BUNDLE_CONFIG", "Project config must be an object", 409);
+  const result = {};
+  for (const [key, entry] of Object.entries(value)) {
+    if (key !== "__proto__" && key !== "constructor" && key !== "prototype") result[key] = entry;
+  }
+  return result;
+}
+function isDuplicate(error) {
+  return error instanceof Error && /already exists|unique|duplicate/i.test(error.message);
+}
+function rejectStableKey(input) {
+  if (input !== null && typeof input === "object" && !Array.isArray(input) && Object.prototype.hasOwnProperty.call(input, "key")) {
+    throw new CapabilityBundleServiceError("INVALID_INPUT", "Capability bundle key is generated and cannot be supplied or changed", 400);
+  }
+}
+function slugify(name) {
+  const slug = name.trim().toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
+  return slug || "runtime-profile";
+}
+function projectBundleIds(config) {
+  const record = ownRecord(config);
+  if (!Object.prototype.hasOwnProperty.call(record, "capabilityBundleIds")) return [];
+  const value = record.capabilityBundleIds;
+  if (!Array.isArray(value) || value.some((id) => typeof id !== "string" || !uuid.safeParse(id).success) || new Set(value).size !== value.length) {
+    throw new CapabilityBundleServiceError("INVALID_BUNDLE_CONFIG", "Project capabilityBundleIds must be a unique array of UUIDs", 409);
+  }
+  return [...value];
+}
+function issue(error) {
+  if (error instanceof CapabilityBundleMergeError || error instanceof CapabilityBundleValidationError) return { code: error instanceof CapabilityBundleValidationError && error.code === "CAPABILITY_BUNDLE_INVALID_CONFIG" ? "INVALID_BUNDLE_CONFIG" : error.code, message: error.message, bundleId: error instanceof CapabilityBundleMergeError ? error.bundleId : void 0, capabilityType: error.capabilityType, fieldPath: error.fieldPath };
+  return { code: "CAPABILITY_BUNDLE_CONFIGURATION_ERROR", message: error instanceof Error ? error.message : "Invalid capability bundle configuration" };
+}
+var CapabilityBundleService = class {
+  constructor(deps) {
+    this.deps = deps;
+  }
+  async list(tenantId) {
+    const values = await this.deps.bundleStore.listByTenant(tenantId);
+    const bundles = [];
+    const errors = [];
+    for (const value of values) {
+      try {
+        validateCapabilityBundleInput(value);
+        bundles.push(value);
+      } catch {
+        errors.push({ bundleId: value.id, code: "INVALID_BUNDLE_CONFIG", message: "Capability bundle record is invalid" });
+      }
+    }
+    return { bundles, errors };
+  }
+  async get(tenantId, id) {
+    const value = await this.deps.bundleStore.getById(tenantId, id);
+    if (!value) throw new CapabilityBundleServiceError("BUNDLE_NOT_FOUND", "Capability bundle not found", 404);
+    try {
+      validateCapabilityBundleInput(value);
+    } catch {
+      throw new CapabilityBundleServiceError("INVALID_BUNDLE_CONFIG", "Capability bundle record is invalid", 422);
+    }
+    return value;
+  }
+  async create(tenantId, input) {
+    rejectStableKey(input);
+    validateCapabilityBundleInput(input);
+    const value = input;
+    const name = value.name.trim();
+    const base = slugify(name);
+    for (let attempt = 0; attempt < 5; attempt += 1) {
+      const existing = await this.deps.bundleStore.listByTenant(tenantId) ?? [];
+      const keys = new Set(existing.map((bundle) => bundle.key));
+      let key = base;
+      let suffix = 2;
+      while (keys.has(key)) key = `${base}-${suffix++}`;
+      const normalized = { ...value, key, name };
+      validateCapabilityBundleInput(normalized);
+      try {
+        const result = await this.deps.bundleStore.create(tenantId, normalized);
+        validateCapabilityBundleInput(result);
+        return result;
+      } catch (error) {
+        if (!isDuplicate(error)) throw error;
+        if (attempt === 4) throw new CapabilityBundleServiceError("DUPLICATE_BUNDLE_KEY", "Capability bundle key already exists", 409);
+      }
+    }
+    throw new CapabilityBundleServiceError("DUPLICATE_BUNDLE_KEY", "Capability bundle key already exists", 409);
+  }
+  async update(tenantId, id, input) {
+    rejectStableKey(input);
+    validateCapabilityBundleInput(input, { partial: true });
+    if (!input || typeof input !== "object" || Array.isArray(input) || typeof input.expectedUpdatedAt !== "string" || !input.expectedUpdatedAt.trim()) throw new CapabilityBundleServiceError("INVALID_BUNDLE_CONFIG", "expectedUpdatedAt is required for capability bundle updates", 400);
+    const value = input;
+    const normalized = { ...value, ...value.name === void 0 ? {} : { name: value.name.trim() }, ...Object.prototype.hasOwnProperty.call(value, "description") ? { description: value.description?.trim() || void 0 } : {} };
+    validateCapabilityBundleInput(normalized, { partial: true });
+    try {
+      const result = await this.deps.bundleStore.update(tenantId, id, normalized);
+      if (!result) throw new CapabilityBundleServiceError("BUNDLE_NOT_FOUND", "Capability bundle not found", 404);
+      if ("status" in result && result.status === "conflict") throw new CapabilityBundleServiceError("BUNDLE_CONFLICT", "Capability bundle changed after it was loaded; reload before saving", 409);
+      validateCapabilityBundleInput(result);
+      return result;
+    } catch (error) {
+      if (error instanceof CapabilityBundleServiceError) throw error;
+      if (isDuplicate(error)) throw new CapabilityBundleServiceError("DUPLICATE_BUNDLE_KEY", "Capability bundle key already exists", 409);
+      throw error;
+    }
+  }
+  async remove(tenantId, id) {
+    const result = await this.deps.bundleStore.deleteIfUnreferenced(tenantId, id);
+    if (result === "not_found") throw new CapabilityBundleServiceError("BUNDLE_NOT_FOUND", "Capability bundle not found", 404);
+    if (result === "in_use") throw new CapabilityBundleServiceError("BUNDLE_IN_USE", "Capability bundle is in use", 409);
+  }
+  async getProjectBundles(tenantId, projectId) {
+    const project = await this.deps.projectStore.getProjectById(tenantId, projectId);
+    if (!project) throw new CapabilityBundleServiceError("PROJECT_NOT_FOUND", "Project not found", 404);
+    const ids = projectBundleIds(project.config);
+    const stored = await this.deps.bundleStore.getManyByIds(tenantId, ids) ?? [];
+    return this.compose(project, ids, stored);
+  }
+  async previewProject(tenantId, projectId) {
+    const project = await this.deps.projectStore.getProjectById(tenantId, projectId);
+    if (!project) throw new CapabilityBundleServiceError("PROJECT_NOT_FOUND", "Project not found", 404);
+    let ids;
+    try {
+      ids = projectBundleIds(project.config);
+    } catch (error) {
+      return { bundleIds: [], capabilities: [], overrides: [], sources: [], warnings: [], errors: [{ code: "INVALID_BUNDLE_CONFIG", message: error instanceof Error ? error.message : "Invalid project capability configuration" }], revision: "" };
+    }
+    const stored = await this.deps.bundleStore.getManyByIds(tenantId, ids) ?? [];
+    const byId = new Map(stored.map((value) => [value.id, value]));
+    const missing = ids.filter((id) => !byId.has(id));
+    if (missing.length > 0) return { bundleIds: ids, capabilities: [], overrides: [], sources: [], warnings: [], errors: missing.map((id) => ({ code: "BUNDLE_NOT_FOUND", message: `Persisted capability bundle '${id}' is missing`, bundleId: id })), revision: "" };
+    try {
+      const ordered = ids.map((id) => byId.get(id));
+      ordered.forEach((bundle) => validateCapabilityBundleInput(bundle));
+      return mergeCapabilityBundles(ordered);
+    } catch (error) {
+      return { bundleIds: ids, capabilities: [], overrides: [], sources: [], warnings: [], errors: [issue(error)], revision: "" };
+    }
+  }
+  async project(tenantId, projectId, ids, persist, expectedRevisions) {
+    const current = await this.deps.projectStore.getProjectById(tenantId, projectId);
+    if (!current) throw new CapabilityBundleServiceError("PROJECT_NOT_FOUND", "Project not found", 404);
+    if (new Set(ids).size !== ids.length) throw new CapabilityBundleServiceError("DUPLICATE_PROJECT_BUNDLE", "Duplicate capability bundle ID", 400);
+    if (persist) this.assertExpectedRevisions(ids, expectedRevisions);
+    const ordered = await this.loadOrderedBundles(tenantId, ids);
+    let resultProject = current;
+    if (persist) {
+      projectBundleIds(current.config);
+      const update = await this.deps.projectStore.updateCapabilityBundleIds(tenantId, projectId, ids, expectedRevisions);
+      if (update.status === "project_not_found") throw new CapabilityBundleServiceError("PROJECT_NOT_FOUND", "Project not found", 404);
+      if (update.status === "bundle_not_found") throw new CapabilityBundleServiceError("BUNDLE_NOT_FOUND", "Capability bundle not found", 404);
+      if (update.status === "bundle_conflict") throw new CapabilityBundleServiceError("BUNDLE_CONFLICT", "Capability bundle changed after preview; preview the current bundle contents before saving", 409);
+      resultProject = update.project;
+    }
+    return this.compose(resultProject, ids, ordered);
+  }
+  assertExpectedRevisions(ids, revisions) {
+    if (!revisions || Object.keys(revisions).length !== ids.length || ids.some((id) => typeof revisions[id] !== "string" || !revisions[id].trim()) || Object.keys(revisions).some((id) => !ids.includes(id))) {
+      throw new CapabilityBundleServiceError("BUNDLE_CONFLICT", "Expected revisions must exactly match the selected capability bundles", 409);
+    }
+  }
+  async loadOrderedBundles(tenantId, ids) {
+    const stored = await this.deps.bundleStore.getManyByIds(tenantId, ids) ?? [];
+    const byId = new Map(stored.map((value) => [value.id, value]));
+    return ids.map((id) => {
+      const value = byId.get(id);
+      if (!value) throw new CapabilityBundleServiceError("BUNDLE_NOT_FOUND", "Capability bundle not found", 404);
+      validateCapabilityBundleInput(value);
+      return value;
+    });
+  }
+  compose(project, ids, bundles) {
+    const valid = [];
+    const errors = [];
+    const byId = new Map(bundles.map((bundle) => [bundle.id, bundle]));
+    for (const id of ids) {
+      const bundle = byId.get(id);
+      if (!bundle) {
+        errors.push({ code: "BUNDLE_NOT_FOUND", message: `Persisted capability bundle '${id}' is missing`, bundleId: id });
+        continue;
+      }
+      try {
+        validateCapabilityBundleInput(bundle);
+        valid.push(bundle);
+      } catch (error) {
+        errors.push({ ...issue(error), bundleId: id });
+      }
+    }
+    let preview;
+    try {
+      preview = mergeCapabilityBundles(valid);
+    } catch (error) {
+      preview = { bundleIds: ids, capabilities: [], overrides: [], sources: [], warnings: [], errors: [issue(error)], revision: "" };
+    }
+    preview = { ...preview, bundleIds: ids, errors: [...errors, ...preview.errors] };
+    return { project, persistedBundleIds: ids, bundles: valid, preview };
+  }
+};
+
+// src/controllers/capability-bundles.ts
+var logger3 = new Logger({ serviceName: "lattice/gateway/capability-bundles" });
+var capability = z6.unknown();
+var createSchema = z6.object({ name: z6.string(), description: z6.string().optional(), capabilities: z6.array(capability) }).strict();
+var updateSchema = createSchema.partial().extend({ expectedUpdatedAt: z6.string().optional() });
+var bundleIdSchema = z6.string().uuid();
+var bundleParamsSchema = z6.object({ bundleId: bundleIdSchema });
+var projectSchema = z6.object({ bundleIds: z6.array(bundleIdSchema), expectedRevisions: z6.record(z6.string()).optional() }).strict();
+function tenant(request, authRequired2) {
+  const authenticated = request.user?.tenantId;
+  const header = request.headers["x-tenant-id"];
+  const requested = Array.isArray(header) ? header[0] : header;
+  if (authenticated) {
+    if (requested && requested !== authenticated) throw new CapabilityBundleServiceError("INVALID_INPUT", "Forbidden", 403);
+    return authenticated;
+  }
+  if (authRequired2) throw new CapabilityBundleServiceError("INVALID_INPUT", "Unauthorized", 401);
+  return requested || "default";
+}
+function sendError(reply, error) {
+  if (error instanceof CapabilityBundleServiceError) return reply.status(error.statusCode).send({ success: false, code: error.code, message: error.message });
+  if (error instanceof Error && error.name === "CapabilityBundleValidationError") {
+    const validationError = error;
+    const code = validationError.code === "CAPABILITY_BUNDLE_INELIGIBLE_CAPABILITY" ? "BUNDLE_PLUGIN_NOT_ELIGIBLE" : validationError.code === "CAPABILITY_BUNDLE_CREDENTIALS_FORBIDDEN" || validationError.code === "CAPABILITY_BUNDLE_INVALID_CONFIG" ? "INVALID_BUNDLE_CONFIG" : validationError.code;
+    return reply.status(400).send({ success: false, code, message: error.message, capabilityType: validationError.capabilityType, fieldPath: validationError.fieldPath });
+  }
+  logger3.error("Capability bundle controller error", { error: error instanceof Error ? error : new Error(String(error)) });
+  return reply.status(500).send({ success: false, code: "INTERNAL_ERROR", message: "Internal server error" });
+}
+var CapabilityBundleController = class {
+  constructor(deps, options = {}) {
+    this.service = new CapabilityBundleService(deps);
+    this.authRequired = options.authRequired ?? true;
+  }
+  async listBundles(request, reply) {
+    try {
+      const result = await this.service.list(tenant(request, this.authRequired));
+      return reply.send({ success: true, data: result.bundles, errors: result.errors });
+    } catch (error) {
+      return sendError(reply, error);
+    }
+  }
+  async getBundle(request, reply) {
+    try {
+      const tenantId = tenant(request, this.authRequired);
+      const parsed = bundleParamsSchema.safeParse(request.params);
+      if (!parsed.success) return reply.status(400).send({ success: false, code: "INVALID_INPUT", message: "Invalid capability bundle ID" });
+      return reply.send({ success: true, data: await this.service.get(tenantId, parsed.data.bundleId) });
+    } catch (error) {
+      return sendError(reply, error);
+    }
+  }
+  async createBundle(request, reply) {
+    try {
+      const tenantId = tenant(request, this.authRequired);
+      const parsed = createSchema.safeParse(request.body);
+      if (!parsed.success) return reply.status(400).send({ success: false, code: "INVALID_INPUT", message: "Invalid capability bundle body" });
+      return reply.status(201).send({ success: true, data: await this.service.create(tenantId, parsed.data) });
+    } catch (error) {
+      return sendError(reply, error);
+    }
+  }
+  async updateBundle(request, reply) {
+    try {
+      const tenantId = tenant(request, this.authRequired);
+      const params = bundleParamsSchema.safeParse(request.params);
+      const parsed = updateSchema.safeParse(request.body);
+      if (!params.success || !parsed.success) return reply.status(400).send({ success: false, code: "INVALID_INPUT", message: "Invalid capability bundle request" });
+      return reply.send({ success: true, data: await this.service.update(tenantId, params.data.bundleId, parsed.data) });
+    } catch (error) {
+      return sendError(reply, error);
+    }
+  }
+  async deleteBundle(request, reply) {
+    try {
+      const tenantId = tenant(request, this.authRequired);
+      const parsed = bundleParamsSchema.safeParse(request.params);
+      if (!parsed.success) return reply.status(400).send({ success: false, code: "INVALID_INPUT", message: "Invalid capability bundle ID" });
+      await this.service.remove(tenantId, parsed.data.bundleId);
+      return reply.send({ success: true, data: null });
+    } catch (error) {
+      return sendError(reply, error);
+    }
+  }
+  async updateProjectBundles(request, reply) {
+    try {
+      const tenantId = tenant(request, this.authRequired);
+      const parsed = projectSchema.safeParse(request.body);
+      if (!parsed.success) return reply.status(400).send({ success: false, code: "INVALID_INPUT", message: "Invalid project capability bundle body" });
+      const result = await this.service.project(tenantId, request.params.projectId, parsed.data.bundleIds, true, parsed.data.expectedRevisions);
+      return reply.send({ success: true, data: { project: result.project, persistedBundleIds: result.persistedBundleIds, bundles: result.bundles, preview: result.preview } });
+    } catch (error) {
+      return sendError(reply, error);
+    }
+  }
+  async getProjectBundles(request, reply) {
+    try {
+      const result = await this.service.getProjectBundles(tenant(request, this.authRequired), request.params.projectId);
+      if (result.preview.errors.some((issue2) => issue2.code === "CAPABILITY_BUNDLE_CREDENTIALS_FORBIDDEN")) return reply.status(400).send({ success: false, code: "INVALID_BUNDLE_CONFIG", message: "Capability bundle record is invalid" });
+      return reply.send({ success: true, data: { project: result.project, persistedBundleIds: result.persistedBundleIds, bundles: result.bundles, preview: result.preview } });
+    } catch (error) {
+      return sendError(reply, error);
+    }
+  }
+  async getProjectPreview(request, reply) {
+    try {
+      const preview = await this.service.previewProject(tenant(request, this.authRequired), request.params.projectId);
+      return reply.send({ success: true, data: preview });
+    } catch (error) {
+      return sendError(reply, error);
+    }
+  }
+  async postProjectPreview(request, reply) {
+    try {
+      const tenantId = tenant(request, this.authRequired);
+      const parsed = projectSchema.safeParse(request.body);
+      if (!parsed.success) return reply.status(400).send({ success: false, code: "INVALID_INPUT", message: "Invalid project capability bundle body" });
+      const result = await this.service.project(tenantId, request.params.projectId, parsed.data.bundleIds, false);
+      return reply.send({ success: true, data: result.preview });
+    } catch (error) {
+      return sendError(reply, error);
+    }
+  }
+};
+function registerCapabilityBundleRoutes(app2, controller) {
+  app2.get("/api/capability-bundles", controller.listBundles.bind(controller));
+  app2.post("/api/capability-bundles", controller.createBundle.bind(controller));
+  app2.get("/api/capability-bundles/:bundleId", controller.getBundle.bind(controller));
+  app2.put("/api/capability-bundles/:bundleId", controller.updateBundle.bind(controller));
+  app2.delete("/api/capability-bundles/:bundleId", controller.deleteBundle.bind(controller));
+  app2.get("/api/projects/:projectId/capability-bundles", controller.getProjectBundles.bind(controller));
+  app2.put("/api/projects/:projectId/capability-bundles", controller.updateProjectBundles.bind(controller));
+  app2.get("/api/projects/:projectId/capability-preview", controller.getProjectPreview.bind(controller));
+  app2.post("/api/projects/:projectId/capability-preview", controller.postProjectPreview.bind(controller));
+}
+
 // src/routes/index.ts
 var registerLatticeRoutes = (app2, channelDeps) => {
   const webAppStore = getStoreLattice16("default", "agentWebApp").store;
   const assistantStore = getStoreLattice16("default", "assistant").store;
   const projectStore = getStoreLattice16("default", "project").store;
+  registerCapabilityBundleRoutes(app2, new CapabilityBundleController({
+    bundleStore: getStoreLattice16("default", "capabilityBundle").store,
+    projectStore
+  }, { authRequired: process.env.AUTH_REQUIRED === "true" }));
   registerAgentWebAppRoutes(app2, {
     service: new AgentWebAppService({
       webAppStore,
@@ -12620,13 +13596,13 @@ function createRateLimitMiddleware(maxRequests = 10, windowMs = 60 * 1e3, maxEnt
 }
 
 // src/router/middlewares/auditLogger.ts
-var logger3 = new Logger({ serviceName: "lattice/gateway/audit" });
+var logger4 = new Logger({ serviceName: "lattice/gateway/audit" });
 function createAuditLoggerMiddleware() {
   return async (ctx, next) => {
     const start2 = Date.now();
     try {
       await next();
-      logger3.info("message routed", {
+      logger4.info("message routed", {
         event: "message:routed",
         channel: ctx.inboundMessage.channel,
         senderId: ctx.inboundMessage.sender.id,
@@ -12636,7 +13612,7 @@ function createAuditLoggerMiddleware() {
         status: "success"
       });
     } catch (error) {
-      logger3.error(
+      logger4.error(
         error instanceof Error ? error.message : String(error),
         {
           event: "message:error",
@@ -12794,7 +13770,7 @@ ${summary}`
       console.log(
         `\u5C06\u5728 ${delayMs}ms \u540E\u91CD\u8BD5\u4EFB\u52A1 (${nextRetryCount}/${maxRetries})`
       );
-      await new Promise((resolve2) => setTimeout(resolve2, delayMs));
+      await new Promise((resolve3) => setTimeout(resolve3, delayMs));
       return handleAgentTask(taskRequest, nextRetryCount);
     }
     if (callback_event) {
@@ -12994,7 +13970,7 @@ var DEFAULT_LOGGER_CONFIG = {
   loggerName: "lattice/gateway"
 };
 var loggerLattice = initializeLogger(DEFAULT_LOGGER_CONFIG);
-var logger4 = loggerLattice.client;
+var logger5 = loggerLattice.client;
 function initializeLogger(config) {
   if (loggerLatticeManager.hasLattice("default")) {
     loggerLatticeManager.removeLattice("default");
@@ -13027,7 +14003,9 @@ var getHeaderValue = (header) => {
 var authRequired = process.env.AUTH_REQUIRED === "true";
 registerConsoleAuthHook(app, { authRequired });
 app.addHook("onRequest", (request, reply, done) => {
-  if (!request.headers["x-project-id"]) {
+  const requestPath = request.url.split("?", 1)[0];
+  const isAgentRunRequest = requestPath === "/api/runs" || requestPath === "/api/resume_stream" || requestPath.includes("/threads/") && requestPath.endsWith("/recover");
+  if (!request.headers["x-project-id"] && !isAgentRunRequest) {
     request.headers["x-project-id"] = "default";
   }
   done();
@@ -13077,7 +14055,7 @@ app.setErrorHandler((error, request, reply) => {
     "x-request-id": getHeaderValue(request.headers["x-request-id"]),
     "x-user-id": getHeaderValue(request.headers["x-user-id"])
   };
-  logger4.error(
+  logger5.error(
     `\u8BF7\u6C42\u9519\u8BEF: ${request.method} ${request.url} error:${error.message}`,
     {
       ...context,
@@ -13112,34 +14090,34 @@ async function restoreMcpConnections() {
     const storeLattice = getStoreLattice27("default", "mcp");
     const store = storeLattice.store;
     if (!store) {
-      logger4.info("MCP store not configured, skipping connection restoration");
+      logger5.info("MCP store not configured, skipping connection restoration");
       return;
     }
     const configs = await store.getAllConfigs("default");
     const connectedConfigs = configs.filter((c2) => c2.status === "connected");
     if (connectedConfigs.length === 0) return;
-    logger4.info(`Restoring ${connectedConfigs.length} MCP server connections...`);
+    logger5.info(`Restoring ${connectedConfigs.length} MCP server connections...`);
     const { convertToConnection } = await import("./mcp-configs-SHRMQHIL.mjs");
     for (const config of connectedConfigs) {
       try {
         const connection = convertToConnection(config.config);
         mcpManager.addServer(config.key, connection);
       } catch (err) {
-        logger4.warn(`Failed to prepare MCP server "${config.key}" for restoration`, { error: err });
+        logger5.warn(`Failed to prepare MCP server "${config.key}" for restoration`, { error: err });
       }
     }
     await mcpManager.connect();
     for (const config of connectedConfigs) {
       try {
         await mcpManager.registerToolsToToolLattice(config.key, config.selectedTools);
-        logger4.info(`MCP server "${config.key}" restored with ${config.selectedTools.length} tools`);
+        logger5.info(`MCP server "${config.key}" restored with ${config.selectedTools.length} tools`);
       } catch (err) {
-        logger4.warn(`Failed to register tools for MCP server "${config.key}"`, { error: err });
+        logger5.warn(`Failed to register tools for MCP server "${config.key}"`, { error: err });
       }
     }
-    logger4.info(`MCP connection restoration complete: ${connectedConfigs.length} servers`);
+    logger5.info(`MCP connection restoration complete: ${connectedConfigs.length} servers`);
   } catch (err) {
-    logger4.error("MCP connection restoration failed", { error: err });
+    logger5.error("MCP connection restoration failed", { error: err });
   }
 }
 var start = async (config) => {
@@ -13152,7 +14130,7 @@ var start = async (config) => {
         file: config.loggerConfig.file || DEFAULT_LOGGER_CONFIG.file
       };
       loggerLattice = initializeLogger(loggerConfig);
-      logger4 = loggerLattice.client;
+      logger5 = loggerLattice.client;
     }
     app.decorate("loggerLattice", loggerLattice);
     let channelDeps;
@@ -13177,7 +14155,7 @@ var start = async (config) => {
       });
       channelDeps = { router, installationStore };
     } catch (err) {
-      logger4.warn("Channel infrastructure unavailable", {
+      logger5.warn("Channel infrastructure unavailable", {
         error: err instanceof Error ? err.message : String(err)
       });
     }
@@ -13185,7 +14163,7 @@ var start = async (config) => {
     try {
       const menuStore = getStoreLattice27("default", "menu").store;
       setMenuRegistry(menuStore);
-      logger4.info("Menu registry initialized");
+      logger5.info("Menu registry initialized");
     } catch {
     }
     registerAllBuiltinEntities();
@@ -13218,15 +14196,15 @@ var start = async (config) => {
         getProjectStore: () => projectStore
       });
       a2a.registerA2ARoutes(app);
-      logger4.info("A2A standard routes registered");
+      logger5.info("A2A standard routes registered");
     } catch (err) {
-      logger4.warn("A2A standard routes unavailable", {
+      logger5.warn("A2A standard routes unavailable", {
         error: err instanceof Error ? err.message : String(err)
       });
     }
     if (!sandboxLatticeManager2.hasLattice("default")) {
       sandboxLatticeManager2.registerLattice("default", getConfiguredSandboxProvider());
-      logger4.info("Registered sandbox manager from env configuration");
+      logger5.info("Registered sandbox manager from env configuration");
     }
     try {
       const { ResourceController } = await import("./resources-VA7LSDKN.mjs");
@@ -13236,12 +14214,12 @@ var start = async (config) => {
         store: sharedResourceStore,
         sandboxManager: sandboxLatticeManager2,
         cache,
-        logger: logger4
+        logger: logger5
       });
       registerResourceRoutes(app, resourceController);
-      logger4.info("Resource share routes registered");
+      logger5.info("Resource share routes registered");
     } catch (err) {
-      logger4.warn("Resource share infrastructure unavailable", {
+      logger5.warn("Resource share infrastructure unavailable", {
         error: err instanceof Error ? err.message : String(err)
       });
     }
@@ -13253,14 +14231,14 @@ var start = async (config) => {
           { deps: { router: channelDeps.router } }
         );
       } catch (err) {
-        logger4.error("Failed to start channel connections", {
+        logger5.error("Failed to start channel connections", {
           error: err instanceof Error ? err.message : String(err)
         });
       }
     }
     const target_port = config?.port || Number(process.env.PORT) || 4001;
     await app.listen({ port: target_port, host: "0.0.0.0" });
-    logger4.info(`Lattice Gateway is running on port: ${target_port}`);
+    logger5.info(`Lattice Gateway is running on port: ${target_port}`);
     const queueServiceConfig = config?.queueServiceConfig;
     if (queueServiceConfig) {
       setQueueServiceType(queueServiceConfig.type);
@@ -13271,16 +14249,16 @@ var start = async (config) => {
     }
     if (process.env.AXIOM_RESTORE_PENDING_ON_STARTUP === "true") {
       agentInstanceManager9.restore().then((stats) => {
-        logger4.info(`Agent recovery complete: ${stats.restored} threads restored, ${stats.errors} errors`);
+        logger5.info(`Agent recovery complete: ${stats.restored} threads restored, ${stats.errors} errors`);
       }).catch((error) => {
-        logger4.error("Agent recovery failed", { error });
+        logger5.error("Agent recovery failed", { error });
       });
     }
     restoreMcpConnections().catch((error) => {
-      logger4.error("MCP connection restoration failed", { error });
+      logger5.error("MCP connection restoration failed", { error });
     });
   } catch (err) {
-    logger4.error("Server start failed", { error: err });
+    logger5.error("Server start failed", { error: err });
     process.exit(1);
   }
 };