@axiom-lattice/gateway 4.1.5 → 4.1.6

package/dist/index.mjs

@@ -32,7 +32,7 @@ import staticPlugin from "@fastify/static";
 import path3 from "path";
 
 // src/routes/index.ts
-import { randomUUID as randomUUID18 } from "crypto";
+import { randomUUID as randomUUID19 } from "crypto";
 import {
   descriptorDataValue as descriptorDataValue3,
   snapshotExactRecord as snapshotExactRecord13,
@@ -5221,6 +5221,113 @@ import { getStoreLattice as getStoreLattice6 } from "@axiom-lattice/core";
 import { SandboxFilesystem, FilesystemBackend } from "@axiom-lattice/core";
 import { getSandBoxManager as getSandBoxManager3 } from "@axiom-lattice/core";
 import { v4 as uuidv42 } from "uuid";
+
+// src/services/collaboration/RoomCoordinatorProvisioner.ts
+var ROOM_COORDINATOR_KEY = "room-coordinator";
+var RoomCoordinatorProvisioner = class {
+  /** Creates a provisioner over the tenant-scoped assistant store operations. */
+  constructor(deps) {
+    this.deps = deps;
+  }
+  /**
+   * Ensures the Room Coordinator assistant exists, reusing an existing record
+   * and reconciling concurrent create races by rereading the winner.
+   *
+   * @param tenantId Tenant to provision the coordinator for.
+   * @returns The persisted Room Coordinator assistant.
+   */
+  async ensure(tenantId) {
+    const existing = await this.deps.getAssistantById(tenantId, ROOM_COORDINATOR_KEY);
+    if (existing) return existing;
+    try {
+      return await this.deps.createAssistant(tenantId, ROOM_COORDINATOR_KEY, {
+        name: "Room Coordinator",
+        description: "Coordinates project room conversations and organizes room work.",
+        graphDefinition: {}
+      });
+    } catch (error) {
+      const winner = await this.deps.getAssistantById(tenantId, ROOM_COORDINATOR_KEY);
+      if (winner) return winner;
+      throw error;
+    }
+  }
+};
+
+// src/services/collaboration/WorkspacePublicRoomService.ts
+import { createHash } from "crypto";
+import { randomUUID as randomUUID5 } from "crypto";
+var WORKSPACE_PUBLIC_ROOM_PROJECT_PREFIX = "workspace_public_";
+var PUBLIC_ROOM_PROJECT_NAME = "General";
+var PUBLIC_ROOM_PROJECT_DESCRIPTION = "Public room for everyone in the workspace";
+function workspacePublicRoomProjectId(tenantId, workspaceId) {
+  const hash = createHash("sha256").update([tenantId, workspaceId].join(":")).digest("hex");
+  return `${WORKSPACE_PUBLIC_ROOM_PROJECT_PREFIX}${hash}`;
+}
+var WorkspacePublicRoomService = class {
+  /** Creates the service from explicitly injected stores and provisioners. */
+  constructor(deps) {
+    this.deps = deps;
+    this.idFactory = deps.idFactory ?? randomUUID5;
+  }
+  /**
+   * Returns the workspace's public room project and room, creating them on first call.
+   *
+   * @param tenantId Tenant owning the workspace.
+   * @param workspaceId Workspace hosting the public room.
+   * @returns The ensured project and room.
+   */
+  async ensure(tenantId, workspaceId) {
+    const projectId = workspacePublicRoomProjectId(tenantId, workspaceId);
+    const project = await this.ensureProject(tenantId, workspaceId, projectId);
+    const room = await this.deps.ensureMainRoom({
+      id: this.idFactory(),
+      tenantId,
+      workspaceId,
+      projectId,
+      name: project.name
+    });
+    await this.ensureCoordinatorBot(tenantId, workspaceId, projectId, room.id);
+    return { project, room };
+  }
+  async ensureProject(tenantId, workspaceId, projectId) {
+    const existing = await this.deps.getProjectById(tenantId, projectId);
+    if (existing && existing.kind === "public") return existing;
+    try {
+      return await this.deps.createProject(tenantId, workspaceId, projectId, {
+        name: PUBLIC_ROOM_PROJECT_NAME,
+        description: PUBLIC_ROOM_PROJECT_DESCRIPTION,
+        kind: "public"
+      });
+    } catch (error) {
+      const winner = await this.deps.getProjectById(tenantId, projectId);
+      if (winner && winner.kind === "public") return winner;
+      throw Object.assign(new Error("Workspace public room project could not be ensured"), { cause: error });
+    }
+  }
+  async ensureCoordinatorBot(tenantId, workspaceId, projectId, roomId) {
+    const coordinator = await this.deps.ensureCoordinator(tenantId);
+    const existing = await this.deps.findBotByAssistant(tenantId, projectId, coordinator.id);
+    if (existing && existing.status !== "removed") return;
+    const saved = await this.deps.saveBot({
+      id: this.idFactory(),
+      tenantId,
+      workspaceId,
+      projectId,
+      roomId,
+      assistantId: coordinator.id,
+      role: "coordinator",
+      title: coordinator.name,
+      mentionName: ROOM_COORDINATOR_KEY,
+      status: "active",
+      roomThreadId: this.idFactory()
+    });
+    if (saved.kind === "coordinator_conflict" || saved.kind === "mention_conflict") {
+      throw new Error(`Workspace public room coordinator bot could not be ensured: ${saved.kind}`);
+    }
+  }
+};
+
+// src/controllers/workspace.ts
 var MAX_ZIP_ENTRIES = 1e4;
 var MAX_ZIP_FILE_SIZE = 100 * 1024 * 1024;
 var MAX_ZIP_TOTAL_SIZE = 512 * 1024 * 1024;
@@ -5355,6 +5462,21 @@ var WorkspaceController = class {
     this.projectCollaboration = projectCollaboration;
     this.workspaceStore = getStoreLattice6("default", "workspace").store;
     this.projectStore = getStoreLattice6("default", "project").store;
+    const roomStore = getStoreLattice6("default", "projectRoom").store;
+    const botMembershipStore = getStoreLattice6("default", "projectBotMembership").store;
+    const assistantStore = getStoreLattice6("default", "assistant").store;
+    const coordinatorProvisioner = new RoomCoordinatorProvisioner({
+      getAssistantById: assistantStore.getAssistantById.bind(assistantStore),
+      createAssistant: assistantStore.createAssistant.bind(assistantStore)
+    });
+    this.publicRoom = new WorkspacePublicRoomService({
+      getProjectById: this.projectStore.getProjectById.bind(this.projectStore),
+      createProject: this.projectStore.createProject.bind(this.projectStore),
+      ensureMainRoom: roomStore.ensureMainRoom.bind(roomStore),
+      findBotByAssistant: botMembershipStore.findByAssistant.bind(botMembershipStore),
+      saveBot: botMembershipStore.save.bind(botMembershipStore),
+      ensureCoordinator: (tenantId) => coordinatorProvisioner.ensure(tenantId)
+    });
   }
   getTenantId(request) {
     const userTenantId = request.user?.tenantId;
@@ -5428,6 +5550,7 @@ var WorkspaceController = class {
     const { workspaceId } = request.params;
     const kindFilter = request.query.kind;
     await this.ensureTrainingProject(tenantId, workspaceId);
+    await this.publicRoom.ensure(tenantId, workspaceId);
     const projects = kindFilter ? await this.projectStore.getProjectsByWorkspace(tenantId, workspaceId, {
       kind: kindFilter
     }) : await this.projectStore.getProjectsByWorkspace(tenantId, workspaceId);
@@ -5471,6 +5594,12 @@ var WorkspaceController = class {
         message: CAPABILITY_BUNDLE_CONFIG_MESSAGE
       });
     }
+    if (data.kind === "public") {
+      return reply.status(409).send({
+        success: false,
+        error: "The public room project is managed automatically"
+      });
+    }
     if (user?.id && this.projectCollaboration) {
       try {
         const authorized = await this.projectCollaboration.authorizeCreator({ tenantId, userId: user.id });
@@ -5546,6 +5675,21 @@ var WorkspaceController = class {
         message: CAPABILITY_BUNDLE_CONFIG_MESSAGE
       });
     }
+    if (updates.kind !== void 0) {
+      const existingProject = await this.projectStore.getProjectById(tenantId, projectId);
+      if (existingProject && updates.kind === "public") {
+        return reply.status(409).send({
+          success: false,
+          error: "kind public is reserved for the workspace public room"
+        });
+      }
+      if (existingProject?.kind === "public") {
+        return reply.status(409).send({
+          success: false,
+          error: "The public room project classification cannot be changed"
+        });
+      }
+    }
     const project = await this.projectStore.updateProject(
       tenantId,
       projectId,
@@ -5576,6 +5720,12 @@ var WorkspaceController = class {
         });
       }
     }
+    if (project.kind === "public") {
+      return reply.status(409).send({
+        success: false,
+        error: "The public room project cannot be deleted"
+      });
+    }
     const deleted = await this.projectStore.deleteProject(tenantId, projectId);
     if (!deleted) {
       return reply.status(404).send({ success: false, error: "Project not found" });
@@ -6281,7 +6431,7 @@ import {
   getStoreLattice as getStoreLattice7,
   sqlDatabaseManager
 } from "@axiom-lattice/core";
-import { randomUUID as randomUUID5 } from "crypto";
+import { randomUUID as randomUUID6 } from "crypto";
 function getTenantId9(request) {
   const userTenantId = request.user?.tenantId;
   if (userTenantId) {
@@ -6359,7 +6509,7 @@ async function createDatabaseConfig(request, reply) {
         message: "Database configuration with this key already exists"
       };
     }
-    const id3 = body.id || randomUUID5();
+    const id3 = body.id || randomUUID6();
     const config = await store.createConfig(tenantId, id3, body);
     try {
       sqlDatabaseManager.registerDatabase(tenantId, config.key, config.config);
@@ -6564,7 +6714,7 @@ import {
   metricsServerManager as metricsServerManager2,
   SemanticMetricsClient as SemanticMetricsClient2
 } from "@axiom-lattice/core";
-import { randomUUID as randomUUID6 } from "crypto";
+import { randomUUID as randomUUID7 } from "crypto";
 function getTenantId10(request) {
   const userTenantId = request.user?.tenantId;
   if (userTenantId) {
@@ -6645,7 +6795,7 @@ async function createMetricsServerConfig(request, reply) {
         message: "selectedDataSources is required for semantic metrics servers"
       };
     }
-    const id3 = body.id || randomUUID6();
+    const id3 = body.id || randomUUID7();
     const configData = {
       key: body.key,
       name: body.name,
@@ -9152,7 +9302,7 @@ function registerChannelRoutes(app2, dependencies) {
 }
 
 // src/controllers/channel-installations.ts
-import { randomUUID as randomUUID7 } from "crypto";
+import { randomUUID as randomUUID8 } from "crypto";
 import {
   descriptorDataValue
 } from "@axiom-lattice/protocols";
@@ -9356,7 +9506,7 @@ async function createChannelInstallation(request, reply) {
       };
     }
     const store = await getInstallationStore();
-    const installationId = randomUUID7();
+    const installationId = randomUUID8();
     const createInput = {
       channel: body.channel,
       name: body.name,
@@ -10316,7 +10466,7 @@ async function getLocalA2ATemplates(_request, reply) {
 }
 
 // src/routes/a2a-test-connection.ts
-import { randomUUID as randomUUID8 } from "crypto";
+import { randomUUID as randomUUID9 } from "crypto";
 function describeTestConnectionError(error, agentCardUrl) {
   if (!(error instanceof Error)) {
     return `Failed to fetch agent card from ${agentCardUrl}: ${String(error)}`;
@@ -10356,7 +10506,7 @@ async function ensureLocalRuntimeForConnectionTest(localRuntime, agentCardUrl) {
     return { error: portValidation.error };
   }
   const state = await localA2AService.startProvider(
-    `test-${randomUUID8()}`,
+    `test-${randomUUID9()}`,
     testRuntime
   );
   if (state.status === "running") return { runtimeId: state.runtimeId };
@@ -10446,7 +10596,7 @@ import { snapshotExactRecord as snapshotExactRecord3 } from "@axiom-lattice/prot
 import { ProjectTaskOwnerPolicyError, projectTaskAdmissionNotifier } from "@axiom-lattice/core";
 
 // src/services/collaboration/ProjectAccessService.ts
-import { randomUUID as randomUUID9 } from "crypto";
+import { randomUUID as randomUUID10 } from "crypto";
 var ProjectCollaborationError = class extends Error {
   /** Creates a project collaboration error. */
   constructor(code, statusCode, message) {
@@ -10472,7 +10622,7 @@ var ProjectAccessService = class {
   /** Creates a project access service from explicitly injected stores. */
   constructor(deps) {
     this.deps = deps;
-    this.idFactory = deps.idFactory ?? randomUUID9;
+    this.idFactory = deps.idFactory ?? randomUUID10;
   }
   /** Returns the project and active membership when the user has the requested capability. */
   async requireProjectAccess(input) {
@@ -10480,6 +10630,9 @@ var ProjectAccessService = class {
     if (!project) {
       throw new ProjectCollaborationError("PROJECT_NOT_FOUND", 404, "Project not found");
     }
+    if (project.kind === "public") {
+      return this.requirePublicProjectAccess(project, input);
+    }
     const membership = await this.deps.membershipStore.findByUser(
       input.tenantId,
       input.projectId,
@@ -10524,10 +10677,13 @@ var ProjectAccessService = class {
     this.requireCapability(racedMembership, input.capability);
     return { project, membership: racedMembership };
   }
-  /** Authorizes only an already-existing active membership and never mutates persistence. */
+  /** Authorizes an already-existing membership, or any tenant member for public rooms; never mutates persistence. */
   async requireExistingProjectAccess(input) {
     const project = await this.deps.projectStore.getProjectById(input.tenantId, input.projectId);
     if (!project) throw new ProjectCollaborationError("PROJECT_NOT_FOUND", 404, "Project not found");
+    if (project.kind === "public") {
+      return this.requireExistingPublicProjectAccess(project, input);
+    }
     const membership = await this.deps.membershipStore.findByUser(
       input.tenantId,
       input.projectId,
@@ -10537,6 +10693,87 @@ var ProjectAccessService = class {
     this.requireCapability(membership, input.capability);
     return { project, membership };
   }
+  /** Authorizes roster visibility: read for public rooms, manage elsewhere. */
+  async requireRosterAccess(input) {
+    const project = await this.deps.projectStore.getProjectById(input.tenantId, input.projectId);
+    if (!project) throw new ProjectCollaborationError("PROJECT_NOT_FOUND", 404, "Project not found");
+    return this.requireProjectAccess({
+      ...input,
+      capability: project.kind === "public" ? "read" : "manage"
+    });
+  }
+  async requirePublicProjectAccess(project, input) {
+    const membership = await this.deps.membershipStore.findByUser(
+      input.tenantId,
+      input.projectId,
+      input.userId
+    );
+    if (membership?.status === "active") {
+      this.requireCapability(membership, input.capability);
+      return { project, membership };
+    }
+    const materialized = await this.materializePublicMembership(input);
+    this.requireCapability(materialized, input.capability);
+    return { project, membership: materialized };
+  }
+  async requireExistingPublicProjectAccess(project, input) {
+    const membership = await this.deps.membershipStore.findByUser(
+      input.tenantId,
+      input.projectId,
+      input.userId
+    );
+    if (membership?.status === "active") {
+      this.requireCapability(membership, input.capability);
+      return { project, membership };
+    }
+    if (membership) this.accessDenied();
+    const tenantLink = await this.deps.userTenantLinkStore.getLink(input.userId, input.tenantId);
+    if (!tenantLink) this.accessDenied();
+    const role = tenantLink.role === "owner" || tenantLink.role === "admin" ? "admin" : "member";
+    const synthetic = {
+      id: `public:${input.userId}`,
+      tenantId: input.tenantId,
+      projectId: input.projectId,
+      userId: input.userId,
+      role,
+      status: "active",
+      joinedAt: project.createdAt,
+      updatedAt: project.updatedAt
+    };
+    this.requireCapability(synthetic, input.capability);
+    return { project, membership: synthetic };
+  }
+  async materializePublicMembership(input) {
+    const tenantLink = await this.deps.userTenantLinkStore.getLink(input.userId, input.tenantId);
+    if (!tenantLink) this.accessDenied();
+    const existing = await this.deps.membershipStore.findByUser(
+      input.tenantId,
+      input.projectId,
+      input.userId
+    );
+    if (existing) this.accessDenied();
+    const role = tenantLink.role === "owner" || tenantLink.role === "admin" ? "admin" : "member";
+    try {
+      return await this.deps.membershipStore.create({
+        id: this.idFactory(),
+        tenantId: input.tenantId,
+        projectId: input.projectId,
+        userId: input.userId,
+        role,
+        status: "active"
+      });
+    } catch (error) {
+      if (isProjectMembershipConflict(error)) {
+        const raced = await this.deps.membershipStore.findByUser(
+          input.tenantId,
+          input.projectId,
+          input.userId
+        );
+        if (raced?.status === "active") return raced;
+      }
+      throw error;
+    }
+  }
   requireCapability(membership, capability2) {
     if (!allowedRoles[capability2].has(membership.role)) this.accessDenied();
   }
@@ -11759,7 +11996,7 @@ function invalidRequest(reply, statusCode) {
 import { z as z5, ZodError as ZodError2 } from "zod";
 
 // src/services/agent-web-app/AgentWebAppRuntimeService.ts
-import { createHash, randomUUID as randomUUID10 } from "crypto";
+import { createHash as createHash2, randomUUID as randomUUID11 } from "crypto";
 import { MessageChunkTypes as MessageChunkTypes3, parseAgentWebAppGenUIBlock } from "@axiom-lattice/protocols";
 function isRecord2(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
@@ -11882,10 +12119,10 @@ ${formatFileRefsSection(refs)}` : input.content;
     const runtime = await this.resolveOwnedRuntime(webAppId, userId, threadId, selection);
     this.requireNamedFeature(runtime.webApp.features.attachments, "Attachments are disabled");
     if (!this.deps.saveProjectFile || !this.deps.attachmentRefs) this.fail("INTERNAL_ERROR", 500, "Attachment service is unavailable");
-    const userDigest = createHash("sha256").update(userId, "utf8").digest("hex");
-    const contentDigest = createHash("sha256").update(file.bytes).digest("hex");
+    const userDigest = createHash2("sha256").update(userId, "utf8").digest("hex");
+    const contentDigest = createHash2("sha256").update(file.bytes).digest("hex");
     const displayName = file.name;
-    const physicalName = `${randomUUID10()}-${sanitizePhysicalFilename(file.name)}`;
+    const physicalName = `${randomUUID11()}-${sanitizePhysicalFilename(file.name)}`;
     const saved = await this.deps.saveProjectFile({
       tenantId: runtime.webApp.tenantId,
       workspaceId: runtime.project.workspaceId,
@@ -12037,7 +12274,7 @@ ${formatFileRefsSection(refs)}` : input.content;
     const thread = await this.deps.threadStore.createThread(
       runtime.webApp.tenantId,
       runtime.webApp.assistantId,
-      randomUUID10(),
+      randomUUID11(),
       { metadata: this.metadata(runtime, userId, normalizeLabel(rawLabel)) }
     );
     return toRuntimeThread(thread);
@@ -12089,7 +12326,7 @@ function implicitThreadId(runtime, userId) {
     userId,
     runtime.project.id
   ]);
-  const bytes = createHash("sha256").update(canonicalTuple, "utf8").digest().subarray(0, 16);
+  const bytes = createHash2("sha256").update(canonicalTuple, "utf8").digest().subarray(0, 16);
   bytes[6] = bytes[6] & 15 | 128;
   bytes[8] = bytes[8] & 63 | 128;
   const hex = bytes.toString("hex");
@@ -12357,7 +12594,7 @@ function isMultipartRequestError(error) {
 }
 
 // src/services/agent-web-app/AgentWebAppAttachmentRef.ts
-import { createCipheriv, createDecipheriv, createHash as createHash2, randomBytes as randomBytes2 } from "crypto";
+import { createCipheriv, createDecipheriv, createHash as createHash3, randomBytes as randomBytes2 } from "crypto";
 var TTL_MS = 15 * 6e4;
 function resolveAgentWebAppAttachmentSecret(consoleSecret) {
   return process.env.WEB_APP_ATTACHMENT_SECRET || process.env.AUTH_TOKEN_SECRET || process.env.JWT_SECRET || consoleSecret;
@@ -12366,7 +12603,7 @@ var AgentWebAppAttachmentRefService = class {
   constructor(secret, now = Date.now) {
     this.now = now;
     if (!secret) throw new Error("Attachment signing secret is required");
-    this.key = createHash2("sha256").update(secret, "utf8").digest();
+    this.key = createHash3("sha256").update(secret, "utf8").digest();
   }
   sign(input) {
     const payload = {
@@ -12428,7 +12665,7 @@ function decodeCanonical(value, expectedBytes) {
   return decoded;
 }
 function digestUser(userId) {
-  return createHash2("sha256").update(userId, "utf8").digest("hex");
+  return createHash3("sha256").update(userId, "utf8").digest("hex");
 }
 function isAttachmentPayload(value) {
   if (typeof value !== "object" || value === null || Array.isArray(value)) return false;
@@ -12788,12 +13025,12 @@ function registerCapabilityBundleRoutes(app2, controller) {
 }
 
 // src/services/collaboration/ProjectRoomService.ts
-import { randomUUID as randomUUID11 } from "crypto";
+import { randomUUID as randomUUID12 } from "crypto";
 var ProjectRoomService = class {
   /** Creates a project room service from explicitly injected collaborators. */
   constructor(deps) {
     this.deps = deps;
-    this.idFactory = deps.idFactory ?? randomUUID11;
+    this.idFactory = deps.idFactory ?? randomUUID12;
   }
   /** Authorizes read access and atomically ensures the project's main room. */
   async ensureMainRoom(input) {
@@ -12812,7 +13049,7 @@ var ProjectRoomService = class {
 };
 
 // src/services/collaboration/ProjectMembershipService.ts
-import { randomUUID as randomUUID12 } from "crypto";
+import { randomUUID as randomUUID13 } from "crypto";
 var ProjectMembershipServiceError = class extends Error {
   constructor(code, statusCode, message) {
     super(message);
@@ -12828,11 +13065,13 @@ function isMembershipConflict(error) {
 var ProjectMembershipService = class {
   constructor(deps) {
     this.deps = deps;
-    this.idFactory = deps.idFactory ?? randomUUID12;
+    this.idFactory = deps.idFactory ?? randomUUID13;
     this.mutationMutex = deps.projectMutationMutex ?? projectMutationMutex;
   }
   async list(actor2) {
-    await this.authorize(actor2);
+    await this.deps.accessService.requireRosterAccess(actor2);
+    const membership = await this.deps.membershipStore.findByUser(actor2.tenantId, actor2.projectId, actor2.userId);
+    if (!membership || membership.status !== "active") this.accessDenied();
     return this.deps.membershipStore.list(actor2.tenantId, actor2.projectId);
   }
   async add(actor2, input) {
@@ -12952,7 +13191,7 @@ var ProjectMembershipService = class {
 };
 
 // src/services/collaboration/ProjectRosterService.ts
-import { randomUUID as randomUUID13 } from "crypto";
+import { randomUUID as randomUUID14 } from "crypto";
 var ProjectRosterServiceError = class extends Error {
   /** Creates a stable roster service error. */
   constructor(code, statusCode, message) {
@@ -12969,7 +13208,7 @@ var ProjectRosterService = class {
   /** Creates a roster service from explicitly injected collaborators. */
   constructor(deps) {
     this.deps = deps;
-    this.idFactory = deps.idFactory ?? randomUUID13;
+    this.idFactory = deps.idFactory ?? randomUUID14;
     this.mutationMutex = deps.projectMutationMutex ?? projectMutationMutex;
   }
   /** Lists all bot memberships visible to a project reader. */
@@ -13189,7 +13428,7 @@ var ProjectRosterService = class {
 };
 
 // src/services/collaboration/RoomMessageService.ts
-import { createHash as createHash3, randomUUID as randomUUID14 } from "crypto";
+import { createHash as createHash4, randomUUID as randomUUID15 } from "crypto";
 
 // src/services/collaboration/ProjectBotMembershipSnapshot.ts
 import { snapshotExactRecord as snapshotExactRecord4 } from "@axiom-lattice/protocols";
@@ -13278,7 +13517,7 @@ var RoomMessageService = class {
   constructor(deps, options = {}) {
     this.deps = deps;
     this.idempotentOutcomes = /* @__PURE__ */ new Map();
-    this.idFactory = deps.idFactory ?? randomUUID14;
+    this.idFactory = deps.idFactory ?? randomUUID15;
     const limit = options.idempotentOutcomeLimit ?? 1e3;
     if (!Number.isSafeInteger(limit) || limit < 1) throw new RangeError("idempotentOutcomeLimit must be a positive safe integer");
     this.idempotentOutcomeLimit = limit;
@@ -13459,7 +13698,7 @@ var RoomMessageService = class {
     let idempotencyKey;
     if (value.requestIdempotencyKey !== void 0) {
       if (typeof value.requestIdempotencyKey !== "string" || !/^[\x21-\x7e]{1,200}$/.test(value.requestIdempotencyKey.trim())) throw new RoomMessageServiceError("INVALID_MESSAGE", 400, "Invalid idempotency key");
-      idempotencyKey = `room-human:${actor2.userId}:${createHash3("sha256").update(value.requestIdempotencyKey.trim(), "utf8").digest("hex")}`;
+      idempotencyKey = `room-human:${actor2.userId}:${createHash4("sha256").update(value.requestIdempotencyKey.trim(), "utf8").digest("hex")}`;
     }
     return { text, mentions, botIds, ...value.replyToMessageId === void 0 ? {} : { replyToMessageId: value.replyToMessageId }, ...idempotencyKey === void 0 ? {} : { idempotencyKey } };
   }
@@ -13516,7 +13755,7 @@ function cloneRoomMessage(message) {
   };
 }
 function fingerprintRequest(input) {
-  return createHash3("sha256").update(JSON.stringify({
+  return createHash4("sha256").update(JSON.stringify({
     text: input.text,
     mentions: input.mentions,
     replyToMessageId: input.replyToMessageId ?? null
@@ -13685,45 +13924,12 @@ async function execute(reply, operation) {
 }
 
 // src/routes/cospace.ts
-import { randomUUID as randomUUID15 } from "crypto";
+import { randomUUID as randomUUID16 } from "crypto";
 import { ZodError as ZodError5 } from "zod";
 import {
   generateDirectHumanProjectId,
   generateDirectBotProjectId
 } from "@axiom-lattice/core";
-
-// src/services/collaboration/RoomCoordinatorProvisioner.ts
-var ROOM_COORDINATOR_KEY = "room-coordinator";
-var RoomCoordinatorProvisioner = class {
-  /** Creates a provisioner over the tenant-scoped assistant store operations. */
-  constructor(deps) {
-    this.deps = deps;
-  }
-  /**
-   * Ensures the Room Coordinator assistant exists, reusing an existing record
-   * and reconciling concurrent create races by rereading the winner.
-   *
-   * @param tenantId Tenant to provision the coordinator for.
-   * @returns The persisted Room Coordinator assistant.
-   */
-  async ensure(tenantId) {
-    const existing = await this.deps.getAssistantById(tenantId, ROOM_COORDINATOR_KEY);
-    if (existing) return existing;
-    try {
-      return await this.deps.createAssistant(tenantId, ROOM_COORDINATOR_KEY, {
-        name: "Room Coordinator",
-        description: "Coordinates project room conversations and organizes room work.",
-        graphDefinition: {}
-      });
-    } catch (error) {
-      const winner = await this.deps.getAssistantById(tenantId, ROOM_COORDINATOR_KEY);
-      if (winner) return winner;
-      throw error;
-    }
-  }
-};
-
-// src/routes/cospace.ts
 var CoSpaceAuthError = class extends Error {
   constructor() {
     super(...arguments);
@@ -13739,7 +13945,7 @@ function getActor2(request) {
   return { tenantId: user.tenantId, userId: user.id };
 }
 function registerCoSpaceRoutes(app2, deps) {
-  const idFactory = deps.idFactory ?? (() => randomUUID15());
+  const idFactory = deps.idFactory ?? (() => randomUUID16());
   app2.get(
     "/api/workspaces/:workspaceId/rooms",
     async (request, reply) => {
@@ -13764,6 +13970,7 @@ function registerCoSpaceRoutes(app2, deps) {
         );
         const accessibleProjects = [];
         for (const project of allProjects) {
+          if (project.kind === "public") continue;
           const membership = await deps.membershipStore.findByUser(
             actor2.tenantId,
             project.id,
@@ -13817,6 +14024,34 @@ function registerCoSpaceRoutes(app2, deps) {
           const bTime = b.lastMessage?.createdAt?.getTime() ?? 0;
           return bTime - aTime;
         });
+        const publicRoom = await deps.publicRoom.ensure(actor2.tenantId, params.workspaceId);
+        if (publicRoom) {
+          const publicMessages = await deps.messageStore.list({
+            tenantId: actor2.tenantId,
+            roomId: publicRoom.room.id,
+            limit: 1
+          });
+          const publicMemberships = await deps.membershipStore.list(
+            actor2.tenantId,
+            publicRoom.project.id
+          );
+          const publicParticipantNames = [];
+          for (const m of publicMemberships) {
+            if (m.status !== "active") continue;
+            const user = await deps.userStore.getUserById(m.userId);
+            if (user) {
+              publicParticipantNames.push(user.name);
+            }
+          }
+          rooms.unshift({
+            project: publicRoom.project,
+            room: publicRoom.room,
+            lastMessage: publicMessages[0],
+            participantCount: publicMemberships.filter((m) => m.status === "active").length,
+            participantNames: publicParticipantNames,
+            isPublic: true
+          });
+        }
         return { data: { rooms } };
       });
     }
@@ -14573,7 +14808,7 @@ function exactValues(value, required, optional = []) {
 }
 
 // src/services/collaboration/CoordinatorWakeNotifier.ts
-import { randomUUID as randomUUID16 } from "crypto";
+import { randomUUID as randomUUID17 } from "crypto";
 import { isProjectLifecycleTask as isProjectLifecycleTask2 } from "@axiom-lattice/core";
 import {
   snapshotExactRecord as snapshotExactRecord6
@@ -14590,7 +14825,7 @@ var CoordinatorWakeNotifier = class {
     this.accepted = /* @__PURE__ */ new Set();
     this.maxPending = deps.maxPending ?? 1024;
     if (!Number.isSafeInteger(this.maxPending) || this.maxPending < 1) throw new RangeError("maxPending must be a positive safe integer");
-    this.idFactory = deps.idFactory ?? randomUUID16;
+    this.idFactory = deps.idFactory ?? randomUUID17;
   }
   /** Admits one notification without awaiting any store or dispatch operation. */
   handle(value) {
@@ -15460,7 +15695,7 @@ function validRecoveryRow(row, task, thread) {
 }
 
 // src/services/collaboration/ProjectTaskObserver.ts
-import { createHash as createHash4 } from "crypto";
+import { createHash as createHash5 } from "crypto";
 import {
   isProjectLifecycleTask as isProjectLifecycleTask4,
   parseExternalDependency as parseExternalDependency2
@@ -16000,7 +16235,7 @@ var ProjectTaskObserver = class {
       action: "activity",
       summary: "Project task recovery warning",
       detail: { type: "project_task_recovery_warning", phase, message },
-      eventKey: `project-task-recovery-warning:${task.id}:${phase}:${createHash4("sha256").update(message).digest("hex")}`
+      eventKey: `project-task-recovery-warning:${task.id}:${phase}:${createHash5("sha256").update(message).digest("hex")}`
     });
   }
   async safeWarning(task, phase, error) {
@@ -16067,7 +16302,7 @@ var ProjectTaskObserver = class {
     }
   }
   async persistOverflowWarning(event) {
-    const scopeDigest = createHash4("sha256").update(JSON.stringify([event.tenantId, event.workspaceId, event.projectId])).digest("hex");
+    const scopeDigest = createHash5("sha256").update(JSON.stringify([event.tenantId, event.workspaceId, event.projectId])).digest("hex");
     try {
       await this.deps.workItems.createIfAbsentByEventKey({
         tenantId: event.tenantId,
@@ -16168,7 +16403,7 @@ function combineSignals(left, right) {
 }
 
 // src/services/collaboration/RoomProjectionService.ts
-import { createHash as createHash5 } from "crypto";
+import { createHash as createHash6 } from "crypto";
 import { isProjectLifecycleTask as isProjectLifecycleTask5 } from "@axiom-lattice/core";
 import {
   PROJECT_TASK_LIFECYCLE_ACTIONS,
@@ -16341,7 +16576,7 @@ function safeRepairIdentity(value, scope) {
   return taskId && eventKey && tenantId === scope.tenantId && workspaceId === scope.workspaceId && projectId === scope.projectId ? { taskId, eventKey } : void 0;
 }
 function tupleKey(prefix, values) {
-  const digest = createHash5("sha256").update(JSON.stringify(values)).digest("hex");
+  const digest = createHash6("sha256").update(JSON.stringify(values)).digest("hex");
   return `${prefix}:${digest}`;
 }
 function parseProjectionInput(taskValue, itemValue) {
@@ -16524,7 +16759,7 @@ function isRecord4(value) {
 import { taskLifecycleNotifier } from "@axiom-lattice/core";
 
 // src/services/collaboration/ProjectRoomEventBroker.ts
-import { randomUUID as randomUUID17 } from "crypto";
+import { randomUUID as randomUUID18 } from "crypto";
 import {
   parseProjectRoomEventId,
   ProjectRoomBrokerCapacityError,
@@ -16553,7 +16788,7 @@ var ProjectRoomEventBroker = class {
     this.subscriberCount = 0;
     this.usageClock = 0;
     this.closed = false;
-    this.epoch = options.epoch ?? randomUUID17();
+    this.epoch = options.epoch ?? randomUUID18();
     if (!UUID_PATTERN.test(this.epoch)) {
       throw new TypeError("Project Room event epoch must be a lowercase canonical UUID");
     }
@@ -16871,7 +17106,7 @@ function snapshotJson(value, ancestors = /* @__PURE__ */ new Set()) {
 }
 
 // src/services/collaboration/ProjectRoomRealtimePublisher.ts
-import { createHash as createHash6 } from "crypto";
+import { createHash as createHash7 } from "crypto";
 import {
   snapshotExactRecord as snapshotExactRecord10,
   snapshotProjectRoomBotMembershipRealtime,
@@ -16952,7 +17187,7 @@ var BrokerProjectRoomRealtimePublisher = class {
     try {
       event = build();
       if (!event) throw new Error("Invalid Project Room realtime projection");
-      const dedupeKey = createHash6("sha256").update(JSON.stringify([type, event.scope.tenantId, event.scope.projectId, event.scope.roomId, event.sourceKey])).digest("hex");
+      const dedupeKey = createHash7("sha256").update(JSON.stringify([type, event.scope.tenantId, event.scope.projectId, event.scope.roomId, event.sourceKey])).digest("hex");
       if (this.sourceKeys.has(dedupeKey)) return;
       this.deps.broker.publish(event.scope, event.draft);
       this.sourceKeys.set(dedupeKey, true);
@@ -17891,12 +18126,24 @@ var registerLatticeRoutes = (app2, channelDeps, options = {}) => {
     });
   }
   if (projectTaskComposition) app2.addHook("onClose", async () => projectTaskComposition.lease.release());
-  const taskThreadService = projectTaskComposition?.lease.runtime.threads ?? new ProjectTaskThreadService({ threads: threadStore, idFactory: randomUUID18 });
+  const taskThreadService = projectTaskComposition?.lease.runtime.threads ?? new ProjectTaskThreadService({ threads: threadStore, idFactory: randomUUID19 });
   const taskLifecycle = projectTaskComposition?.lease.runtime.lifecycle ?? createTaskLifecycleService({ taskStore, workItemStore: taskWorkItemStore });
   const reassignmentAuthorizer = createProjectTaskReassignmentAuthorizer(
     new ProjectTaskOwnerPolicy(projectBotMembershipStore),
     (input) => validateReassignmentThread(threadStore, input)
   );
+  const coordinatorProvisioner = new RoomCoordinatorProvisioner({
+    getAssistantById: assistantStore.getAssistantById.bind(assistantStore),
+    createAssistant: assistantStore.createAssistant.bind(assistantStore)
+  });
+  const publicRoomService = new WorkspacePublicRoomService({
+    getProjectById: projectStore.getProjectById.bind(projectStore),
+    createProject: projectStore.createProject.bind(projectStore),
+    ensureMainRoom: projectRoomStore.ensureMainRoom.bind(projectRoomStore),
+    findBotByAssistant: projectBotMembershipStore.findByAssistant.bind(projectBotMembershipStore),
+    saveBot: projectBotMembershipStore.save.bind(projectBotMembershipStore),
+    ensureCoordinator: (tenantId) => coordinatorProvisioner.ensure(tenantId)
+  });
   registerProjectRoomRoutes(app2, { roomService, membershipService, messageService });
   registerProjectRosterRoutes(app2, { service: rosterService });
   registerCoSpaceRoutes(app2, {
@@ -17935,14 +18182,14 @@ var registerLatticeRoutes = (app2, channelDeps, options = {}) => {
       findByAssistant: projectBotMembershipStore.findByAssistant.bind(projectBotMembershipStore),
       save: projectBotMembershipStore.save.bind(projectBotMembershipStore)
     },
-    coordinatorProvisioner: new RoomCoordinatorProvisioner({
-      getAssistantById: assistantStore.getAssistantById.bind(assistantStore),
-      createAssistant: assistantStore.createAssistant.bind(assistantStore)
-    }),
+    coordinatorProvisioner,
     rosterService: {
       addBot: async (actor2, input) => {
         await rosterService.add(actor2, input);
       }
+    },
+    publicRoom: {
+      ensure: (tenantId, workspaceId) => publicRoomService.ensure(tenantId, workspaceId)
     }
   });
   registerCapabilityBundleRoutes(app2, new CapabilityBundleController({
@@ -18383,7 +18630,7 @@ function tryCreateProjectTaskRuntime(input) {
 function createRuntime(input, stores, log2) {
   const controller = new AbortController();
   const mutex = new ProjectTaskExecutionMutex();
-  const threads = new ProjectTaskThreadService({ threads: input.threadStore, idFactory: randomUUID18 });
+  const threads = new ProjectTaskThreadService({ threads: input.threadStore, idFactory: randomUUID19 });
   const lifecycle = createTaskLifecycleService({ taskStore: input.taskStore, workItemStore: input.taskWorkItemStore });
   const projection = new RoomProjectionService({
     messages: input.projectRoomMessageStore,
@@ -18392,7 +18639,7 @@ function createRuntime(input, stores, log2) {
     warnings: input.taskWorkItemStore,
     log: log2,
     realtime: input.realtime,
-    idFactory: randomUUID18
+    idFactory: randomUUID19
   });
   const agentFor = (task, thread) => agentInstanceManager6.getAgent({
     tenant_id: task.tenantId,
@@ -19217,7 +19464,7 @@ var collectionRegistration = {
 
 // src/export_registrations/channel-installation.registration.ts
 import { getStoreLattice as getStoreLattice23 } from "@axiom-lattice/core";
-import { randomUUID as randomUUID19 } from "crypto";
+import { randomUUID as randomUUID20 } from "crypto";
 var UUID_PATTERN2 = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
 var PUBLIC_CHANNELS = /* @__PURE__ */ new Set(["lark", "email", "slack", "wechat"]);
 function isPublicChannel(channel) {
@@ -19376,7 +19623,7 @@ var channelInstallationRegistration = {
       }
       id3 = sourceId;
     } else {
-      id3 = randomUUID19();
+      id3 = randomUUID20();
     }
     await store.createInstallation(tenantId, id3, createInput);
     return { newId: id3 };
@@ -20264,7 +20511,7 @@ import {
   snapshotExactArray as snapshotExactArray3,
   snapshotExactRecord as snapshotExactRecord14
 } from "@axiom-lattice/protocols";
-import { randomUUID as randomUUID20 } from "crypto";
+import { randomUUID as randomUUID21 } from "crypto";
 var BindingNotFoundError = class extends Error {
   constructor(message) {
     super(message);
@@ -20579,7 +20826,7 @@ var MessageRouter = class {
         }
         if (!threadId) {
           const threadStore = getStoreLattice26("default", "thread").store;
-          const newThreadId = randomUUID20();
+          const newThreadId = randomUUID21();
           console.log({
             event: "dispatch:thread:create",
             agentId,
@@ -20625,7 +20872,7 @@ var MessageRouter = class {
           workspace_id: binding?.workspaceId || "",
           project_id: binding?.projectId || ""
         });
-        const inputMessageId = randomUUID20();
+        const inputMessageId = randomUUID21();
         const replyTarget = internalRoom ? correlatedRoomReplyTarget(message.replyTarget, inputMessageId) : message.replyTarget;
         const replyAdapter = replyTarget ? this.adapterRegistry.get(replyTarget.adapterChannel) : void 0;
         if (options.trustedMessageOptions && (!this.trustedDispatcher || !replyTarget || !replyAdapter)) {