@axiom-lattice/gateway 4.1.4 → 4.1.6

package/dist/index.js

@@ -1512,7 +1512,7 @@ function extractFailureReason(task) {
   return extractText2(task.status.message.parts);
 }
 function observationEventKey(task, result, failureReason) {
-  const digest = (0, import_node_crypto17.createHash)("sha256").update(JSON.stringify({
+  const digest = (0, import_node_crypto19.createHash)("sha256").update(JSON.stringify({
     state: task.status.state,
     timestamp: task.status.timestamp,
     message: task.status.message,
@@ -1522,7 +1522,7 @@ function observationEventKey(task, result, failureReason) {
   return `a2a-status-observation:${task.id}:${digest}`;
 }
 function snapshotEventKey(task) {
-  const digest = (0, import_node_crypto17.createHash)("sha256").update(JSON.stringify(task)).digest("hex");
+  const digest = (0, import_node_crypto19.createHash)("sha256").update(JSON.stringify(task)).digest("hex");
   return `a2a-task-snapshot:${task.id}:${digest}`;
 }
 function isGovernedObservation(state) {
@@ -1534,11 +1534,11 @@ function isA2ATaskSnapshot(value) {
 function snapshotSequence(value) {
   return typeof value === "number" && Number.isSafeInteger(value) && value >= 0 ? value : void 0;
 }
-var import_node_crypto17, import_node_util, TASK_STATUS_TO_A2A_STATE, TITLE_MAX_LENGTH, A2ATaskScopeConflictError, A2ATaskStoreAdapter;
+var import_node_crypto19, import_node_util, TASK_STATUS_TO_A2A_STATE, TITLE_MAX_LENGTH, A2ATaskScopeConflictError, A2ATaskStoreAdapter;
 var init_A2ATaskStoreAdapter = __esm({
   "src/services/a2a/A2ATaskStoreAdapter.ts"() {
     "use strict";
-    import_node_crypto17 = require("crypto");
+    import_node_crypto19 = require("crypto");
     import_node_util = require("util");
     TASK_STATUS_TO_A2A_STATE = {
       pending: "submitted",
@@ -3313,7 +3313,7 @@ var import_static = __toESM(require("@fastify/static"));
 var import_path = __toESM(require("path"));
 
 // src/routes/index.ts
-var import_node_crypto16 = require("crypto");
+var import_node_crypto18 = require("crypto");
 var import_protocols24 = require("@axiom-lattice/protocols");
 
 // src/controllers/assistant.ts
@@ -8485,6 +8485,113 @@ var import_uuid3 = require("uuid");
 init_mime();
 init_workspace_file_service();
 init_path_containment();
+
+// src/services/collaboration/RoomCoordinatorProvisioner.ts
+var ROOM_COORDINATOR_KEY = "room-coordinator";
+var RoomCoordinatorProvisioner = class {
+  /** Creates a provisioner over the tenant-scoped assistant store operations. */
+  constructor(deps) {
+    this.deps = deps;
+  }
+  /**
+   * Ensures the Room Coordinator assistant exists, reusing an existing record
+   * and reconciling concurrent create races by rereading the winner.
+   *
+   * @param tenantId Tenant to provision the coordinator for.
+   * @returns The persisted Room Coordinator assistant.
+   */
+  async ensure(tenantId) {
+    const existing = await this.deps.getAssistantById(tenantId, ROOM_COORDINATOR_KEY);
+    if (existing) return existing;
+    try {
+      return await this.deps.createAssistant(tenantId, ROOM_COORDINATOR_KEY, {
+        name: "Room Coordinator",
+        description: "Coordinates project room conversations and organizes room work.",
+        graphDefinition: {}
+      });
+    } catch (error) {
+      const winner = await this.deps.getAssistantById(tenantId, ROOM_COORDINATOR_KEY);
+      if (winner) return winner;
+      throw error;
+    }
+  }
+};
+
+// src/services/collaboration/WorkspacePublicRoomService.ts
+var import_node_crypto = require("crypto");
+var import_node_crypto2 = require("crypto");
+var WORKSPACE_PUBLIC_ROOM_PROJECT_PREFIX = "workspace_public_";
+var PUBLIC_ROOM_PROJECT_NAME = "General";
+var PUBLIC_ROOM_PROJECT_DESCRIPTION = "Public room for everyone in the workspace";
+function workspacePublicRoomProjectId(tenantId, workspaceId) {
+  const hash = (0, import_node_crypto.createHash)("sha256").update([tenantId, workspaceId].join(":")).digest("hex");
+  return `${WORKSPACE_PUBLIC_ROOM_PROJECT_PREFIX}${hash}`;
+}
+var WorkspacePublicRoomService = class {
+  /** Creates the service from explicitly injected stores and provisioners. */
+  constructor(deps) {
+    this.deps = deps;
+    this.idFactory = deps.idFactory ?? import_node_crypto2.randomUUID;
+  }
+  /**
+   * Returns the workspace's public room project and room, creating them on first call.
+   *
+   * @param tenantId Tenant owning the workspace.
+   * @param workspaceId Workspace hosting the public room.
+   * @returns The ensured project and room.
+   */
+  async ensure(tenantId, workspaceId) {
+    const projectId = workspacePublicRoomProjectId(tenantId, workspaceId);
+    const project = await this.ensureProject(tenantId, workspaceId, projectId);
+    const room = await this.deps.ensureMainRoom({
+      id: this.idFactory(),
+      tenantId,
+      workspaceId,
+      projectId,
+      name: project.name
+    });
+    await this.ensureCoordinatorBot(tenantId, workspaceId, projectId, room.id);
+    return { project, room };
+  }
+  async ensureProject(tenantId, workspaceId, projectId) {
+    const existing = await this.deps.getProjectById(tenantId, projectId);
+    if (existing && existing.kind === "public") return existing;
+    try {
+      return await this.deps.createProject(tenantId, workspaceId, projectId, {
+        name: PUBLIC_ROOM_PROJECT_NAME,
+        description: PUBLIC_ROOM_PROJECT_DESCRIPTION,
+        kind: "public"
+      });
+    } catch (error) {
+      const winner = await this.deps.getProjectById(tenantId, projectId);
+      if (winner && winner.kind === "public") return winner;
+      throw Object.assign(new Error("Workspace public room project could not be ensured"), { cause: error });
+    }
+  }
+  async ensureCoordinatorBot(tenantId, workspaceId, projectId, roomId) {
+    const coordinator = await this.deps.ensureCoordinator(tenantId);
+    const existing = await this.deps.findBotByAssistant(tenantId, projectId, coordinator.id);
+    if (existing && existing.status !== "removed") return;
+    const saved = await this.deps.saveBot({
+      id: this.idFactory(),
+      tenantId,
+      workspaceId,
+      projectId,
+      roomId,
+      assistantId: coordinator.id,
+      role: "coordinator",
+      title: coordinator.name,
+      mentionName: ROOM_COORDINATOR_KEY,
+      status: "active",
+      roomThreadId: this.idFactory()
+    });
+    if (saved.kind === "coordinator_conflict" || saved.kind === "mention_conflict") {
+      throw new Error(`Workspace public room coordinator bot could not be ensured: ${saved.kind}`);
+    }
+  }
+};
+
+// src/controllers/workspace.ts
 var MAX_ZIP_ENTRIES = 1e4;
 var MAX_ZIP_FILE_SIZE = 100 * 1024 * 1024;
 var MAX_ZIP_TOTAL_SIZE = 512 * 1024 * 1024;
@@ -8619,6 +8726,21 @@ var WorkspaceController = class {
     this.projectCollaboration = projectCollaboration;
     this.workspaceStore = (0, import_core24.getStoreLattice)("default", "workspace").store;
     this.projectStore = (0, import_core24.getStoreLattice)("default", "project").store;
+    const roomStore = (0, import_core24.getStoreLattice)("default", "projectRoom").store;
+    const botMembershipStore = (0, import_core24.getStoreLattice)("default", "projectBotMembership").store;
+    const assistantStore = (0, import_core24.getStoreLattice)("default", "assistant").store;
+    const coordinatorProvisioner = new RoomCoordinatorProvisioner({
+      getAssistantById: assistantStore.getAssistantById.bind(assistantStore),
+      createAssistant: assistantStore.createAssistant.bind(assistantStore)
+    });
+    this.publicRoom = new WorkspacePublicRoomService({
+      getProjectById: this.projectStore.getProjectById.bind(this.projectStore),
+      createProject: this.projectStore.createProject.bind(this.projectStore),
+      ensureMainRoom: roomStore.ensureMainRoom.bind(roomStore),
+      findBotByAssistant: botMembershipStore.findByAssistant.bind(botMembershipStore),
+      saveBot: botMembershipStore.save.bind(botMembershipStore),
+      ensureCoordinator: (tenantId) => coordinatorProvisioner.ensure(tenantId)
+    });
   }
   getTenantId(request) {
     const userTenantId = request.user?.tenantId;
@@ -8692,6 +8814,7 @@ var WorkspaceController = class {
     const { workspaceId } = request.params;
     const kindFilter = request.query.kind;
     await this.ensureTrainingProject(tenantId, workspaceId);
+    await this.publicRoom.ensure(tenantId, workspaceId);
     const projects = kindFilter ? await this.projectStore.getProjectsByWorkspace(tenantId, workspaceId, {
       kind: kindFilter
     }) : await this.projectStore.getProjectsByWorkspace(tenantId, workspaceId);
@@ -8735,6 +8858,12 @@ var WorkspaceController = class {
         message: CAPABILITY_BUNDLE_CONFIG_MESSAGE
       });
     }
+    if (data.kind === "public") {
+      return reply.status(409).send({
+        success: false,
+        error: "The public room project is managed automatically"
+      });
+    }
     if (user?.id && this.projectCollaboration) {
       try {
         const authorized = await this.projectCollaboration.authorizeCreator({ tenantId, userId: user.id });
@@ -8810,6 +8939,21 @@ var WorkspaceController = class {
         message: CAPABILITY_BUNDLE_CONFIG_MESSAGE
       });
     }
+    if (updates.kind !== void 0) {
+      const existingProject = await this.projectStore.getProjectById(tenantId, projectId);
+      if (existingProject && updates.kind === "public") {
+        return reply.status(409).send({
+          success: false,
+          error: "kind public is reserved for the workspace public room"
+        });
+      }
+      if (existingProject?.kind === "public") {
+        return reply.status(409).send({
+          success: false,
+          error: "The public room project classification cannot be changed"
+        });
+      }
+    }
     const project = await this.projectStore.updateProject(
       tenantId,
       projectId,
@@ -8840,6 +8984,12 @@ var WorkspaceController = class {
         });
       }
     }
+    if (project.kind === "public") {
+      return reply.status(409).send({
+        success: false,
+        error: "The public room project cannot be deleted"
+      });
+    }
     const deleted = await this.projectStore.deleteProject(tenantId, projectId);
     if (!deleted) {
       return reply.status(404).send({ success: false, error: "Project not found" });
@@ -11595,7 +11745,7 @@ function registerTenantRoutes(app2) {
 // src/controllers/auth.ts
 var import_core35 = require("@axiom-lattice/core");
 var import_uuid8 = require("uuid");
-var import_node_crypto = require("crypto");
+var import_node_crypto3 = require("crypto");
 var defaultAuthConfig = {
   autoApproveUsers: true,
   allowTenantRegistration: true,
@@ -11950,7 +12100,7 @@ var AuthController = class {
 function resolveConsoleTokenSecret(_authRequired) {
   const configured = process.env.AUTH_TOKEN_SECRET || process.env.JWT_SECRET;
   if (configured) return configured;
-  devSessionSecret ?? (devSessionSecret = (0, import_node_crypto.randomBytes)(32).toString("hex"));
+  devSessionSecret ?? (devSessionSecret = (0, import_node_crypto3.randomBytes)(32).toString("hex"));
   console.warn(
     "[auth] AUTH_TOKEN_SECRET/JWT_SECRET is not set; using an in-process generated signing secret (sessions are invalidated on restart). Set AUTH_TOKEN_SECRET for production."
   );
@@ -11959,7 +12109,7 @@ function resolveConsoleTokenSecret(_authRequired) {
 var devSessionSecret;
 function createConsoleSessionToken(payload, secret) {
   const encodedPayload = Buffer.from(JSON.stringify(payload)).toString("base64url");
-  const signature = (0, import_node_crypto.createHmac)("sha256", secret).update(encodedPayload).digest("base64url");
+  const signature = (0, import_node_crypto3.createHmac)("sha256", secret).update(encodedPayload).digest("base64url");
   return `${encodedPayload}.${signature}`;
 }
 function isConsoleSessionPayload(value) {
@@ -11986,8 +12136,8 @@ function verifySignedConsoleSession(authHeader, secret) {
   try {
     const actualSignature = Buffer.from(encodedSignature, "base64url");
     if (actualSignature.toString("base64url") !== encodedSignature) return void 0;
-    const expectedSignature = (0, import_node_crypto.createHmac)("sha256", secret).update(encodedPayload).digest();
-    if (actualSignature.length !== expectedSignature.length || !(0, import_node_crypto.timingSafeEqual)(actualSignature, expectedSignature)) {
+    const expectedSignature = (0, import_node_crypto3.createHmac)("sha256", secret).update(encodedPayload).digest();
+    if (actualSignature.length !== expectedSignature.length || !(0, import_node_crypto3.timingSafeEqual)(actualSignature, expectedSignature)) {
       return void 0;
     }
     const payload = JSON.parse(
@@ -13568,7 +13718,7 @@ async function getLocalA2ATemplates(_request, reply) {
 }
 
 // src/routes/a2a-test-connection.ts
-var import_node_crypto2 = require("crypto");
+var import_node_crypto4 = require("crypto");
 function describeTestConnectionError(error, agentCardUrl) {
   if (!(error instanceof Error)) {
     return `Failed to fetch agent card from ${agentCardUrl}: ${String(error)}`;
@@ -13608,7 +13758,7 @@ async function ensureLocalRuntimeForConnectionTest(localRuntime, agentCardUrl) {
     return { error: portValidation.error };
   }
   const state = await localA2AService.startProvider(
-    `test-${(0, import_node_crypto2.randomUUID)()}`,
+    `test-${(0, import_node_crypto4.randomUUID)()}`,
     testRuntime
   );
   if (state.status === "running") return { runtimeId: state.runtimeId };
@@ -13686,7 +13836,7 @@ var import_protocols10 = require("@axiom-lattice/protocols");
 var import_core42 = require("@axiom-lattice/core");
 
 // src/services/collaboration/ProjectAccessService.ts
-var import_node_crypto3 = require("crypto");
+var import_node_crypto5 = require("crypto");
 var ProjectCollaborationError = class extends Error {
   /** Creates a project collaboration error. */
   constructor(code, statusCode, message) {
@@ -13712,7 +13862,7 @@ var ProjectAccessService = class {
   /** Creates a project access service from explicitly injected stores. */
   constructor(deps) {
     this.deps = deps;
-    this.idFactory = deps.idFactory ?? import_node_crypto3.randomUUID;
+    this.idFactory = deps.idFactory ?? import_node_crypto5.randomUUID;
   }
   /** Returns the project and active membership when the user has the requested capability. */
   async requireProjectAccess(input) {
@@ -13720,6 +13870,9 @@ var ProjectAccessService = class {
     if (!project) {
       throw new ProjectCollaborationError("PROJECT_NOT_FOUND", 404, "Project not found");
     }
+    if (project.kind === "public") {
+      return this.requirePublicProjectAccess(project, input);
+    }
     const membership = await this.deps.membershipStore.findByUser(
       input.tenantId,
       input.projectId,
@@ -13764,10 +13917,13 @@ var ProjectAccessService = class {
     this.requireCapability(racedMembership, input.capability);
     return { project, membership: racedMembership };
   }
-  /** Authorizes only an already-existing active membership and never mutates persistence. */
+  /** Authorizes an already-existing membership, or any tenant member for public rooms; never mutates persistence. */
   async requireExistingProjectAccess(input) {
     const project = await this.deps.projectStore.getProjectById(input.tenantId, input.projectId);
     if (!project) throw new ProjectCollaborationError("PROJECT_NOT_FOUND", 404, "Project not found");
+    if (project.kind === "public") {
+      return this.requireExistingPublicProjectAccess(project, input);
+    }
     const membership = await this.deps.membershipStore.findByUser(
       input.tenantId,
       input.projectId,
@@ -13777,6 +13933,87 @@ var ProjectAccessService = class {
     this.requireCapability(membership, input.capability);
     return { project, membership };
   }
+  /** Authorizes roster visibility: read for public rooms, manage elsewhere. */
+  async requireRosterAccess(input) {
+    const project = await this.deps.projectStore.getProjectById(input.tenantId, input.projectId);
+    if (!project) throw new ProjectCollaborationError("PROJECT_NOT_FOUND", 404, "Project not found");
+    return this.requireProjectAccess({
+      ...input,
+      capability: project.kind === "public" ? "read" : "manage"
+    });
+  }
+  async requirePublicProjectAccess(project, input) {
+    const membership = await this.deps.membershipStore.findByUser(
+      input.tenantId,
+      input.projectId,
+      input.userId
+    );
+    if (membership?.status === "active") {
+      this.requireCapability(membership, input.capability);
+      return { project, membership };
+    }
+    const materialized = await this.materializePublicMembership(input);
+    this.requireCapability(materialized, input.capability);
+    return { project, membership: materialized };
+  }
+  async requireExistingPublicProjectAccess(project, input) {
+    const membership = await this.deps.membershipStore.findByUser(
+      input.tenantId,
+      input.projectId,
+      input.userId
+    );
+    if (membership?.status === "active") {
+      this.requireCapability(membership, input.capability);
+      return { project, membership };
+    }
+    if (membership) this.accessDenied();
+    const tenantLink = await this.deps.userTenantLinkStore.getLink(input.userId, input.tenantId);
+    if (!tenantLink) this.accessDenied();
+    const role = tenantLink.role === "owner" || tenantLink.role === "admin" ? "admin" : "member";
+    const synthetic = {
+      id: `public:${input.userId}`,
+      tenantId: input.tenantId,
+      projectId: input.projectId,
+      userId: input.userId,
+      role,
+      status: "active",
+      joinedAt: project.createdAt,
+      updatedAt: project.updatedAt
+    };
+    this.requireCapability(synthetic, input.capability);
+    return { project, membership: synthetic };
+  }
+  async materializePublicMembership(input) {
+    const tenantLink = await this.deps.userTenantLinkStore.getLink(input.userId, input.tenantId);
+    if (!tenantLink) this.accessDenied();
+    const existing = await this.deps.membershipStore.findByUser(
+      input.tenantId,
+      input.projectId,
+      input.userId
+    );
+    if (existing) this.accessDenied();
+    const role = tenantLink.role === "owner" || tenantLink.role === "admin" ? "admin" : "member";
+    try {
+      return await this.deps.membershipStore.create({
+        id: this.idFactory(),
+        tenantId: input.tenantId,
+        projectId: input.projectId,
+        userId: input.userId,
+        role,
+        status: "active"
+      });
+    } catch (error) {
+      if (isProjectMembershipConflict(error)) {
+        const raced = await this.deps.membershipStore.findByUser(
+          input.tenantId,
+          input.projectId,
+          input.userId
+        );
+        if (raced?.status === "active") return raced;
+      }
+      throw error;
+    }
+  }
   requireCapability(membership, capability2) {
     if (!allowedRoles[capability2].has(membership.role)) this.accessDenied();
   }
@@ -14992,7 +15229,7 @@ function invalidRequest(reply, statusCode) {
 var import_zod6 = require("zod");
 
 // src/services/agent-web-app/AgentWebAppRuntimeService.ts
-var import_node_crypto4 = require("crypto");
+var import_node_crypto6 = require("crypto");
 var import_protocols11 = require("@axiom-lattice/protocols");
 init_task_file_refs();
 function isRecord2(value) {
@@ -15116,10 +15353,10 @@ ${formatFileRefsSection(refs)}` : input.content;
     const runtime = await this.resolveOwnedRuntime(webAppId, userId, threadId, selection);
     this.requireNamedFeature(runtime.webApp.features.attachments, "Attachments are disabled");
     if (!this.deps.saveProjectFile || !this.deps.attachmentRefs) this.fail("INTERNAL_ERROR", 500, "Attachment service is unavailable");
-    const userDigest = (0, import_node_crypto4.createHash)("sha256").update(userId, "utf8").digest("hex");
-    const contentDigest = (0, import_node_crypto4.createHash)("sha256").update(file.bytes).digest("hex");
+    const userDigest = (0, import_node_crypto6.createHash)("sha256").update(userId, "utf8").digest("hex");
+    const contentDigest = (0, import_node_crypto6.createHash)("sha256").update(file.bytes).digest("hex");
     const displayName = file.name;
-    const physicalName = `${(0, import_node_crypto4.randomUUID)()}-${sanitizePhysicalFilename(file.name)}`;
+    const physicalName = `${(0, import_node_crypto6.randomUUID)()}-${sanitizePhysicalFilename(file.name)}`;
     const saved = await this.deps.saveProjectFile({
       tenantId: runtime.webApp.tenantId,
       workspaceId: runtime.project.workspaceId,
@@ -15271,7 +15508,7 @@ ${formatFileRefsSection(refs)}` : input.content;
     const thread = await this.deps.threadStore.createThread(
       runtime.webApp.tenantId,
       runtime.webApp.assistantId,
-      (0, import_node_crypto4.randomUUID)(),
+      (0, import_node_crypto6.randomUUID)(),
       { metadata: this.metadata(runtime, userId, normalizeLabel(rawLabel)) }
     );
     return toRuntimeThread(thread);
@@ -15323,7 +15560,7 @@ function implicitThreadId(runtime, userId) {
     userId,
     runtime.project.id
   ]);
-  const bytes = (0, import_node_crypto4.createHash)("sha256").update(canonicalTuple, "utf8").digest().subarray(0, 16);
+  const bytes = (0, import_node_crypto6.createHash)("sha256").update(canonicalTuple, "utf8").digest().subarray(0, 16);
   bytes[6] = bytes[6] & 15 | 128;
   bytes[8] = bytes[8] & 63 | 128;
   const hex = bytes.toString("hex");
@@ -15588,7 +15825,7 @@ function isMultipartRequestError(error) {
 }
 
 // src/services/agent-web-app/AgentWebAppAttachmentRef.ts
-var import_node_crypto5 = require("crypto");
+var import_node_crypto7 = require("crypto");
 var TTL_MS = 15 * 6e4;
 function resolveAgentWebAppAttachmentSecret(consoleSecret) {
   return process.env.WEB_APP_ATTACHMENT_SECRET || process.env.AUTH_TOKEN_SECRET || process.env.JWT_SECRET || consoleSecret;
@@ -15597,7 +15834,7 @@ var AgentWebAppAttachmentRefService = class {
   constructor(secret, now = Date.now) {
     this.now = now;
     if (!secret) throw new Error("Attachment signing secret is required");
-    this.key = (0, import_node_crypto5.createHash)("sha256").update(secret, "utf8").digest();
+    this.key = (0, import_node_crypto7.createHash)("sha256").update(secret, "utf8").digest();
   }
   sign(input) {
     const payload = {
@@ -15612,8 +15849,8 @@ var AgentWebAppAttachmentRefService = class {
       contentDigest: input.contentDigest,
       exp: this.now() + TTL_MS
     };
-    const iv = (0, import_node_crypto5.randomBytes)(12);
-    const cipher = (0, import_node_crypto5.createCipheriv)("aes-256-gcm", this.key, iv);
+    const iv = (0, import_node_crypto7.randomBytes)(12);
+    const cipher = (0, import_node_crypto7.createCipheriv)("aes-256-gcm", this.key, iv);
     const ciphertext = Buffer.concat([
       cipher.update(JSON.stringify(payload), "utf8"),
       cipher.final()
@@ -15628,7 +15865,7 @@ var AgentWebAppAttachmentRefService = class {
       const iv = decodeCanonical(encodedIv, 12);
       const ciphertext = decodeCanonical(encodedCiphertext);
       const tag = decodeCanonical(encodedTag, 16);
-      const decipher = (0, import_node_crypto5.createDecipheriv)("aes-256-gcm", this.key, iv);
+      const decipher = (0, import_node_crypto7.createDecipheriv)("aes-256-gcm", this.key, iv);
       decipher.setAuthTag(tag);
       const plaintext = Buffer.concat([decipher.update(ciphertext), decipher.final()]);
       const value = JSON.parse(plaintext.toString("utf8"));
@@ -15659,7 +15896,7 @@ function decodeCanonical(value, expectedBytes) {
   return decoded;
 }
 function digestUser(userId) {
-  return (0, import_node_crypto5.createHash)("sha256").update(userId, "utf8").digest("hex");
+  return (0, import_node_crypto7.createHash)("sha256").update(userId, "utf8").digest("hex");
 }
 function isAttachmentPayload(value) {
   if (typeof value !== "object" || value === null || Array.isArray(value)) return false;
@@ -16023,12 +16260,12 @@ function registerCapabilityBundleRoutes(app2, controller) {
 }
 
 // src/services/collaboration/ProjectRoomService.ts
-var import_node_crypto6 = require("crypto");
+var import_node_crypto8 = require("crypto");
 var ProjectRoomService = class {
   /** Creates a project room service from explicitly injected collaborators. */
   constructor(deps) {
     this.deps = deps;
-    this.idFactory = deps.idFactory ?? import_node_crypto6.randomUUID;
+    this.idFactory = deps.idFactory ?? import_node_crypto8.randomUUID;
   }
   /** Authorizes read access and atomically ensures the project's main room. */
   async ensureMainRoom(input) {
@@ -16047,7 +16284,7 @@ var ProjectRoomService = class {
 };
 
 // src/services/collaboration/ProjectMembershipService.ts
-var import_node_crypto7 = require("crypto");
+var import_node_crypto9 = require("crypto");
 var ProjectMembershipServiceError = class extends Error {
   constructor(code, statusCode, message) {
     super(message);
@@ -16063,11 +16300,13 @@ function isMembershipConflict(error) {
 var ProjectMembershipService = class {
   constructor(deps) {
     this.deps = deps;
-    this.idFactory = deps.idFactory ?? import_node_crypto7.randomUUID;
+    this.idFactory = deps.idFactory ?? import_node_crypto9.randomUUID;
     this.mutationMutex = deps.projectMutationMutex ?? import_core41.projectMutationMutex;
   }
   async list(actor2) {
-    await this.authorize(actor2);
+    await this.deps.accessService.requireRosterAccess(actor2);
+    const membership = await this.deps.membershipStore.findByUser(actor2.tenantId, actor2.projectId, actor2.userId);
+    if (!membership || membership.status !== "active") this.accessDenied();
     return this.deps.membershipStore.list(actor2.tenantId, actor2.projectId);
   }
   async add(actor2, input) {
@@ -16187,7 +16426,7 @@ var ProjectMembershipService = class {
 };
 
 // src/services/collaboration/ProjectRosterService.ts
-var import_node_crypto8 = require("crypto");
+var import_node_crypto10 = require("crypto");
 var ProjectRosterServiceError = class extends Error {
   /** Creates a stable roster service error. */
   constructor(code, statusCode, message) {
@@ -16204,7 +16443,7 @@ var ProjectRosterService = class {
   /** Creates a roster service from explicitly injected collaborators. */
   constructor(deps) {
     this.deps = deps;
-    this.idFactory = deps.idFactory ?? import_node_crypto8.randomUUID;
+    this.idFactory = deps.idFactory ?? import_node_crypto10.randomUUID;
     this.mutationMutex = deps.projectMutationMutex ?? import_core41.projectMutationMutex;
   }
   /** Lists all bot memberships visible to a project reader. */
@@ -16424,7 +16663,7 @@ var ProjectRosterService = class {
 };
 
 // src/services/collaboration/RoomMessageService.ts
-var import_node_crypto9 = require("crypto");
+var import_node_crypto11 = require("crypto");
 
 // src/services/collaboration/ProjectBotMembershipSnapshot.ts
 var import_protocols13 = require("@axiom-lattice/protocols");
@@ -16513,7 +16752,7 @@ var RoomMessageService = class {
   constructor(deps, options = {}) {
     this.deps = deps;
     this.idempotentOutcomes = /* @__PURE__ */ new Map();
-    this.idFactory = deps.idFactory ?? import_node_crypto9.randomUUID;
+    this.idFactory = deps.idFactory ?? import_node_crypto11.randomUUID;
     const limit = options.idempotentOutcomeLimit ?? 1e3;
     if (!Number.isSafeInteger(limit) || limit < 1) throw new RangeError("idempotentOutcomeLimit must be a positive safe integer");
     this.idempotentOutcomeLimit = limit;
@@ -16694,7 +16933,7 @@ var RoomMessageService = class {
     let idempotencyKey;
     if (value.requestIdempotencyKey !== void 0) {
       if (typeof value.requestIdempotencyKey !== "string" || !/^[\x21-\x7e]{1,200}$/.test(value.requestIdempotencyKey.trim())) throw new RoomMessageServiceError("INVALID_MESSAGE", 400, "Invalid idempotency key");
-      idempotencyKey = `room-human:${actor2.userId}:${(0, import_node_crypto9.createHash)("sha256").update(value.requestIdempotencyKey.trim(), "utf8").digest("hex")}`;
+      idempotencyKey = `room-human:${actor2.userId}:${(0, import_node_crypto11.createHash)("sha256").update(value.requestIdempotencyKey.trim(), "utf8").digest("hex")}`;
     }
     return { text, mentions, botIds, ...value.replyToMessageId === void 0 ? {} : { replyToMessageId: value.replyToMessageId }, ...idempotencyKey === void 0 ? {} : { idempotencyKey } };
   }
@@ -16751,7 +16990,7 @@ function cloneRoomMessage(message) {
   };
 }
 function fingerprintRequest(input) {
-  return (0, import_node_crypto9.createHash)("sha256").update(JSON.stringify({
+  return (0, import_node_crypto11.createHash)("sha256").update(JSON.stringify({
     text: input.text,
     mentions: input.mentions,
     replyToMessageId: input.replyToMessageId ?? null
@@ -16920,42 +17159,9 @@ async function execute(reply, operation) {
 }
 
 // src/routes/cospace.ts
-var import_node_crypto10 = require("crypto");
+var import_node_crypto12 = require("crypto");
 var import_zod12 = require("zod");
 var import_core44 = require("@axiom-lattice/core");
-
-// src/services/collaboration/RoomCoordinatorProvisioner.ts
-var ROOM_COORDINATOR_KEY = "room-coordinator";
-var RoomCoordinatorProvisioner = class {
-  /** Creates a provisioner over the tenant-scoped assistant store operations. */
-  constructor(deps) {
-    this.deps = deps;
-  }
-  /**
-   * Ensures the Room Coordinator assistant exists, reusing an existing record
-   * and reconciling concurrent create races by rereading the winner.
-   *
-   * @param tenantId Tenant to provision the coordinator for.
-   * @returns The persisted Room Coordinator assistant.
-   */
-  async ensure(tenantId) {
-    const existing = await this.deps.getAssistantById(tenantId, ROOM_COORDINATOR_KEY);
-    if (existing) return existing;
-    try {
-      return await this.deps.createAssistant(tenantId, ROOM_COORDINATOR_KEY, {
-        name: "Room Coordinator",
-        description: "Coordinates project room conversations and organizes room work.",
-        graphDefinition: {}
-      });
-    } catch (error) {
-      const winner = await this.deps.getAssistantById(tenantId, ROOM_COORDINATOR_KEY);
-      if (winner) return winner;
-      throw error;
-    }
-  }
-};
-
-// src/routes/cospace.ts
 var CoSpaceAuthError = class extends Error {
   constructor() {
     super(...arguments);
@@ -16971,7 +17177,7 @@ function getActor2(request) {
   return { tenantId: user.tenantId, userId: user.id };
 }
 function registerCoSpaceRoutes(app2, deps) {
-  const idFactory = deps.idFactory ?? (() => (0, import_node_crypto10.randomUUID)());
+  const idFactory = deps.idFactory ?? (() => (0, import_node_crypto12.randomUUID)());
   app2.get(
     "/api/workspaces/:workspaceId/rooms",
     async (request, reply) => {
@@ -16996,6 +17202,7 @@ function registerCoSpaceRoutes(app2, deps) {
         );
         const accessibleProjects = [];
         for (const project of allProjects) {
+          if (project.kind === "public") continue;
           const membership = await deps.membershipStore.findByUser(
             actor2.tenantId,
             project.id,
@@ -17049,6 +17256,34 @@ function registerCoSpaceRoutes(app2, deps) {
           const bTime = b.lastMessage?.createdAt?.getTime() ?? 0;
           return bTime - aTime;
         });
+        const publicRoom = await deps.publicRoom.ensure(actor2.tenantId, params.workspaceId);
+        if (publicRoom) {
+          const publicMessages = await deps.messageStore.list({
+            tenantId: actor2.tenantId,
+            roomId: publicRoom.room.id,
+            limit: 1
+          });
+          const publicMemberships = await deps.membershipStore.list(
+            actor2.tenantId,
+            publicRoom.project.id
+          );
+          const publicParticipantNames = [];
+          for (const m of publicMemberships) {
+            if (m.status !== "active") continue;
+            const user = await deps.userStore.getUserById(m.userId);
+            if (user) {
+              publicParticipantNames.push(user.name);
+            }
+          }
+          rooms.unshift({
+            project: publicRoom.project,
+            room: publicRoom.room,
+            lastMessage: publicMessages[0],
+            participantCount: publicMemberships.filter((m) => m.status === "active").length,
+            participantNames: publicParticipantNames,
+            isPublic: true
+          });
+        }
         return { data: { rooms } };
       });
     }
@@ -17805,7 +18040,7 @@ function exactValues(value, required, optional = []) {
 }
 
 // src/services/collaboration/CoordinatorWakeNotifier.ts
-var import_node_crypto11 = require("crypto");
+var import_node_crypto13 = require("crypto");
 var import_core45 = require("@axiom-lattice/core");
 var import_protocols15 = require("@axiom-lattice/protocols");
 var SYNTHETIC_WAKE_AUTHOR = "coordinator-wake";
@@ -17820,7 +18055,7 @@ var CoordinatorWakeNotifier = class {
     this.accepted = /* @__PURE__ */ new Set();
     this.maxPending = deps.maxPending ?? 1024;
     if (!Number.isSafeInteger(this.maxPending) || this.maxPending < 1) throw new RangeError("maxPending must be a positive safe integer");
-    this.idFactory = deps.idFactory ?? import_node_crypto11.randomUUID;
+    this.idFactory = deps.idFactory ?? import_node_crypto13.randomUUID;
   }
   /** Admits one notification without awaiting any store or dispatch operation. */
   handle(value) {
@@ -18683,7 +18918,7 @@ function validRecoveryRow(row, task, thread) {
 }
 
 // src/services/collaboration/ProjectTaskObserver.ts
-var import_node_crypto12 = require("crypto");
+var import_node_crypto14 = require("crypto");
 var import_core47 = require("@axiom-lattice/core");
 var SYSTEM_ACTOR2 = "system";
 var TERMINAL_ACTIONS = ["completed", "failed", "interrupted", "cancelled"];
@@ -19220,7 +19455,7 @@ var ProjectTaskObserver = class {
       action: "activity",
       summary: "Project task recovery warning",
       detail: { type: "project_task_recovery_warning", phase, message },
-      eventKey: `project-task-recovery-warning:${task.id}:${phase}:${(0, import_node_crypto12.createHash)("sha256").update(message).digest("hex")}`
+      eventKey: `project-task-recovery-warning:${task.id}:${phase}:${(0, import_node_crypto14.createHash)("sha256").update(message).digest("hex")}`
     });
   }
   async safeWarning(task, phase, error) {
@@ -19287,7 +19522,7 @@ var ProjectTaskObserver = class {
     }
   }
   async persistOverflowWarning(event) {
-    const scopeDigest = (0, import_node_crypto12.createHash)("sha256").update(JSON.stringify([event.tenantId, event.workspaceId, event.projectId])).digest("hex");
+    const scopeDigest = (0, import_node_crypto14.createHash)("sha256").update(JSON.stringify([event.tenantId, event.workspaceId, event.projectId])).digest("hex");
     try {
       await this.deps.workItems.createIfAbsentByEventKey({
         tenantId: event.tenantId,
@@ -19388,7 +19623,7 @@ function combineSignals(left, right) {
 }
 
 // src/services/collaboration/RoomProjectionService.ts
-var import_node_crypto13 = require("crypto");
+var import_node_crypto15 = require("crypto");
 var import_core48 = require("@axiom-lattice/core");
 var import_protocols18 = require("@axiom-lattice/protocols");
 var RoomProjectionService = class {
@@ -19557,7 +19792,7 @@ function safeRepairIdentity(value, scope) {
   return taskId && eventKey && tenantId === scope.tenantId && workspaceId === scope.workspaceId && projectId === scope.projectId ? { taskId, eventKey } : void 0;
 }
 function tupleKey(prefix, values) {
-  const digest = (0, import_node_crypto13.createHash)("sha256").update(JSON.stringify(values)).digest("hex");
+  const digest = (0, import_node_crypto15.createHash)("sha256").update(JSON.stringify(values)).digest("hex");
   return `${prefix}:${digest}`;
 }
 function parseProjectionInput(taskValue, itemValue) {
@@ -19740,7 +19975,7 @@ function isRecord4(value) {
 var import_core50 = require("@axiom-lattice/core");
 
 // src/services/collaboration/ProjectRoomEventBroker.ts
-var import_node_crypto14 = require("crypto");
+var import_node_crypto16 = require("crypto");
 var import_protocols19 = require("@axiom-lattice/protocols");
 var DEFAULT_MAX_EVENTS_PER_ROOM = 1e3;
 var DEFAULT_MAX_EVENT_AGE_MS = 10 * 60 * 1e3;
@@ -19765,7 +20000,7 @@ var ProjectRoomEventBroker = class {
     this.subscriberCount = 0;
     this.usageClock = 0;
     this.closed = false;
-    this.epoch = options.epoch ?? (0, import_node_crypto14.randomUUID)();
+    this.epoch = options.epoch ?? (0, import_node_crypto16.randomUUID)();
     if (!UUID_PATTERN.test(this.epoch)) {
       throw new TypeError("Project Room event epoch must be a lowercase canonical UUID");
     }
@@ -20083,7 +20318,7 @@ function snapshotJson(value, ancestors = /* @__PURE__ */ new Set()) {
 }
 
 // src/services/collaboration/ProjectRoomRealtimePublisher.ts
-var import_node_crypto15 = require("crypto");
+var import_node_crypto17 = require("crypto");
 var import_protocols20 = require("@axiom-lattice/protocols");
 var BrokerProjectRoomRealtimePublisher = class {
   /** Creates a publisher around a broker and structured warning logger. */
@@ -20159,7 +20394,7 @@ var BrokerProjectRoomRealtimePublisher = class {
     try {
       event = build();
       if (!event) throw new Error("Invalid Project Room realtime projection");
-      const dedupeKey = (0, import_node_crypto15.createHash)("sha256").update(JSON.stringify([type, event.scope.tenantId, event.scope.projectId, event.scope.roomId, event.sourceKey])).digest("hex");
+      const dedupeKey = (0, import_node_crypto17.createHash)("sha256").update(JSON.stringify([type, event.scope.tenantId, event.scope.projectId, event.scope.roomId, event.sourceKey])).digest("hex");
       if (this.sourceKeys.has(dedupeKey)) return;
       this.deps.broker.publish(event.scope, event.draft);
       this.sourceKeys.set(dedupeKey, true);
@@ -21098,12 +21333,24 @@ var registerLatticeRoutes = (app2, channelDeps, options = {}) => {
     });
   }
   if (projectTaskComposition) app2.addHook("onClose", async () => projectTaskComposition.lease.release());
-  const taskThreadService = projectTaskComposition?.lease.runtime.threads ?? new ProjectTaskThreadService({ threads: threadStore, idFactory: import_node_crypto16.randomUUID });
+  const taskThreadService = projectTaskComposition?.lease.runtime.threads ?? new ProjectTaskThreadService({ threads: threadStore, idFactory: import_node_crypto18.randomUUID });
   const taskLifecycle = projectTaskComposition?.lease.runtime.lifecycle ?? (0, import_core51.createTaskLifecycleService)({ taskStore, workItemStore: taskWorkItemStore });
   const reassignmentAuthorizer = (0, import_core51.createProjectTaskReassignmentAuthorizer)(
     new import_core51.ProjectTaskOwnerPolicy(projectBotMembershipStore),
     (input) => validateReassignmentThread(threadStore, input)
   );
+  const coordinatorProvisioner = new RoomCoordinatorProvisioner({
+    getAssistantById: assistantStore.getAssistantById.bind(assistantStore),
+    createAssistant: assistantStore.createAssistant.bind(assistantStore)
+  });
+  const publicRoomService = new WorkspacePublicRoomService({
+    getProjectById: projectStore.getProjectById.bind(projectStore),
+    createProject: projectStore.createProject.bind(projectStore),
+    ensureMainRoom: projectRoomStore.ensureMainRoom.bind(projectRoomStore),
+    findBotByAssistant: projectBotMembershipStore.findByAssistant.bind(projectBotMembershipStore),
+    saveBot: projectBotMembershipStore.save.bind(projectBotMembershipStore),
+    ensureCoordinator: (tenantId) => coordinatorProvisioner.ensure(tenantId)
+  });
   registerProjectRoomRoutes(app2, { roomService, membershipService, messageService });
   registerProjectRosterRoutes(app2, { service: rosterService });
   registerCoSpaceRoutes(app2, {
@@ -21142,14 +21389,14 @@ var registerLatticeRoutes = (app2, channelDeps, options = {}) => {
       findByAssistant: projectBotMembershipStore.findByAssistant.bind(projectBotMembershipStore),
       save: projectBotMembershipStore.save.bind(projectBotMembershipStore)
     },
-    coordinatorProvisioner: new RoomCoordinatorProvisioner({
-      getAssistantById: assistantStore.getAssistantById.bind(assistantStore),
-      createAssistant: assistantStore.createAssistant.bind(assistantStore)
-    }),
+    coordinatorProvisioner,
     rosterService: {
       addBot: async (actor2, input) => {
         await rosterService.add(actor2, input);
       }
+    },
+    publicRoom: {
+      ensure: (tenantId, workspaceId) => publicRoomService.ensure(tenantId, workspaceId)
     }
   });
   registerCapabilityBundleRoutes(app2, new CapabilityBundleController({
@@ -21590,7 +21837,7 @@ function tryCreateProjectTaskRuntime(input) {
 function createRuntime(input, stores, log2) {
   const controller = new AbortController();
   const mutex = new ProjectTaskExecutionMutex();
-  const threads = new ProjectTaskThreadService({ threads: input.threadStore, idFactory: import_node_crypto16.randomUUID });
+  const threads = new ProjectTaskThreadService({ threads: input.threadStore, idFactory: import_node_crypto18.randomUUID });
   const lifecycle = (0, import_core51.createTaskLifecycleService)({ taskStore: input.taskStore, workItemStore: input.taskWorkItemStore });
   const projection = new RoomProjectionService({
     messages: input.projectRoomMessageStore,
@@ -21599,7 +21846,7 @@ function createRuntime(input, stores, log2) {
     warnings: input.taskWorkItemStore,
     log: log2,
     realtime: input.realtime,
-    idFactory: import_node_crypto16.randomUUID
+    idFactory: import_node_crypto18.randomUUID
   });
   const agentFor = (task, thread) => import_core51.agentInstanceManager.getAgent({
     tenant_id: task.tenantId,
@@ -24036,7 +24283,11 @@ function initializeLogger(config) {
 }
 var app = (0, import_fastify.default)({
   logger: false,
-  bodyLimit: Number(process.env.BODY_LIMIT) || 50 * 1024 * 1024
+  bodyLimit: Number(process.env.BODY_LIMIT) || 50 * 1024 * 1024,
+  // Composite subagent thread IDs ({mainThread}____{assistant}-general-purpose_{toolCallId})
+  // can exceed the 100-char default, which makes the router 404 before any
+  // handler runs. Allow the longest IDs the conventions can produce.
+  routerOptions: { maxParamLength: 512 }
 });
 app.addContentTypeParser("application/json", { parseAs: "string" }, function(request, body, done) {
   if (request.method === "DELETE" || !body || body.length === 0) {