@axiom-lattice/gateway 4.1.5 → 4.1.7

package/dist/index.mjs

@@ -32,7 +32,7 @@ import staticPlugin from "@fastify/static";
 import path3 from "path";
 
 // src/routes/index.ts
-import { randomUUID as randomUUID18 } from "crypto";
+import { randomUUID as randomUUID19 } from "crypto";
 import {
   descriptorDataValue as descriptorDataValue3,
   snapshotExactRecord as snapshotExactRecord13,
@@ -5221,6 +5221,113 @@ import { getStoreLattice as getStoreLattice6 } from "@axiom-lattice/core";
 import { SandboxFilesystem, FilesystemBackend } from "@axiom-lattice/core";
 import { getSandBoxManager as getSandBoxManager3 } from "@axiom-lattice/core";
 import { v4 as uuidv42 } from "uuid";
+
+// src/services/collaboration/RoomCoordinatorProvisioner.ts
+var ROOM_COORDINATOR_KEY = "room-coordinator";
+var RoomCoordinatorProvisioner = class {
+  /** Creates a provisioner over the tenant-scoped assistant store operations. */
+  constructor(deps) {
+    this.deps = deps;
+  }
+  /**
+   * Ensures the Room Coordinator assistant exists, reusing an existing record
+   * and reconciling concurrent create races by rereading the winner.
+   *
+   * @param tenantId Tenant to provision the coordinator for.
+   * @returns The persisted Room Coordinator assistant.
+   */
+  async ensure(tenantId) {
+    const existing = await this.deps.getAssistantById(tenantId, ROOM_COORDINATOR_KEY);
+    if (existing) return existing;
+    try {
+      return await this.deps.createAssistant(tenantId, ROOM_COORDINATOR_KEY, {
+        name: "Room Coordinator",
+        description: "Coordinates project room conversations and organizes room work.",
+        graphDefinition: {}
+      });
+    } catch (error) {
+      const winner = await this.deps.getAssistantById(tenantId, ROOM_COORDINATOR_KEY);
+      if (winner) return winner;
+      throw error;
+    }
+  }
+};
+
+// src/services/collaboration/WorkspacePublicRoomService.ts
+import { createHash } from "crypto";
+import { randomUUID as randomUUID5 } from "crypto";
+var WORKSPACE_PUBLIC_ROOM_PROJECT_PREFIX = "workspace_public_";
+var PUBLIC_ROOM_PROJECT_NAME = "General";
+var PUBLIC_ROOM_PROJECT_DESCRIPTION = "Public room for everyone in the workspace";
+function workspacePublicRoomProjectId(tenantId, workspaceId) {
+  const hash = createHash("sha256").update([tenantId, workspaceId].join(":")).digest("hex");
+  return `${WORKSPACE_PUBLIC_ROOM_PROJECT_PREFIX}${hash}`;
+}
+var WorkspacePublicRoomService = class {
+  /** Creates the service from explicitly injected stores and provisioners. */
+  constructor(deps) {
+    this.deps = deps;
+    this.idFactory = deps.idFactory ?? randomUUID5;
+  }
+  /**
+   * Returns the workspace's public room project and room, creating them on first call.
+   *
+   * @param tenantId Tenant owning the workspace.
+   * @param workspaceId Workspace hosting the public room.
+   * @returns The ensured project and room.
+   */
+  async ensure(tenantId, workspaceId) {
+    const projectId = workspacePublicRoomProjectId(tenantId, workspaceId);
+    const project = await this.ensureProject(tenantId, workspaceId, projectId);
+    const room = await this.deps.ensureMainRoom({
+      id: this.idFactory(),
+      tenantId,
+      workspaceId,
+      projectId,
+      name: project.name
+    });
+    await this.ensureCoordinatorBot(tenantId, workspaceId, projectId, room.id);
+    return { project, room };
+  }
+  async ensureProject(tenantId, workspaceId, projectId) {
+    const existing = await this.deps.getProjectById(tenantId, projectId);
+    if (existing && existing.kind === "public") return existing;
+    try {
+      return await this.deps.createProject(tenantId, workspaceId, projectId, {
+        name: PUBLIC_ROOM_PROJECT_NAME,
+        description: PUBLIC_ROOM_PROJECT_DESCRIPTION,
+        kind: "public"
+      });
+    } catch (error) {
+      const winner = await this.deps.getProjectById(tenantId, projectId);
+      if (winner && winner.kind === "public") return winner;
+      throw Object.assign(new Error("Workspace public room project could not be ensured"), { cause: error });
+    }
+  }
+  async ensureCoordinatorBot(tenantId, workspaceId, projectId, roomId) {
+    const coordinator = await this.deps.ensureCoordinator(tenantId);
+    const existing = await this.deps.findBotByAssistant(tenantId, projectId, coordinator.id);
+    if (existing && existing.status !== "removed") return;
+    const saved = await this.deps.saveBot({
+      id: this.idFactory(),
+      tenantId,
+      workspaceId,
+      projectId,
+      roomId,
+      assistantId: coordinator.id,
+      role: "coordinator",
+      title: coordinator.name,
+      mentionName: ROOM_COORDINATOR_KEY,
+      status: "active",
+      roomThreadId: this.idFactory()
+    });
+    if (saved.kind === "coordinator_conflict" || saved.kind === "mention_conflict") {
+      throw new Error(`Workspace public room coordinator bot could not be ensured: ${saved.kind}`);
+    }
+  }
+};
+
+// src/controllers/workspace.ts
 var MAX_ZIP_ENTRIES = 1e4;
 var MAX_ZIP_FILE_SIZE = 100 * 1024 * 1024;
 var MAX_ZIP_TOTAL_SIZE = 512 * 1024 * 1024;
@@ -5355,6 +5462,21 @@ var WorkspaceController = class {
     this.projectCollaboration = projectCollaboration;
     this.workspaceStore = getStoreLattice6("default", "workspace").store;
     this.projectStore = getStoreLattice6("default", "project").store;
+    const roomStore = getStoreLattice6("default", "projectRoom").store;
+    const botMembershipStore = getStoreLattice6("default", "projectBotMembership").store;
+    const assistantStore = getStoreLattice6("default", "assistant").store;
+    const coordinatorProvisioner = new RoomCoordinatorProvisioner({
+      getAssistantById: assistantStore.getAssistantById.bind(assistantStore),
+      createAssistant: assistantStore.createAssistant.bind(assistantStore)
+    });
+    this.publicRoom = new WorkspacePublicRoomService({
+      getProjectById: this.projectStore.getProjectById.bind(this.projectStore),
+      createProject: this.projectStore.createProject.bind(this.projectStore),
+      ensureMainRoom: roomStore.ensureMainRoom.bind(roomStore),
+      findBotByAssistant: botMembershipStore.findByAssistant.bind(botMembershipStore),
+      saveBot: botMembershipStore.save.bind(botMembershipStore),
+      ensureCoordinator: (tenantId) => coordinatorProvisioner.ensure(tenantId)
+    });
   }
   getTenantId(request) {
     const userTenantId = request.user?.tenantId;
@@ -5428,6 +5550,7 @@ var WorkspaceController = class {
     const { workspaceId } = request.params;
     const kindFilter = request.query.kind;
     await this.ensureTrainingProject(tenantId, workspaceId);
+    await this.publicRoom.ensure(tenantId, workspaceId);
     const projects = kindFilter ? await this.projectStore.getProjectsByWorkspace(tenantId, workspaceId, {
       kind: kindFilter
     }) : await this.projectStore.getProjectsByWorkspace(tenantId, workspaceId);
@@ -5471,6 +5594,12 @@ var WorkspaceController = class {
         message: CAPABILITY_BUNDLE_CONFIG_MESSAGE
       });
     }
+    if (data.kind === "public") {
+      return reply.status(409).send({
+        success: false,
+        error: "The public room project is managed automatically"
+      });
+    }
     if (user?.id && this.projectCollaboration) {
       try {
         const authorized = await this.projectCollaboration.authorizeCreator({ tenantId, userId: user.id });
@@ -5546,6 +5675,21 @@ var WorkspaceController = class {
         message: CAPABILITY_BUNDLE_CONFIG_MESSAGE
       });
     }
+    if (updates.kind !== void 0) {
+      const existingProject = await this.projectStore.getProjectById(tenantId, projectId);
+      if (existingProject && updates.kind === "public") {
+        return reply.status(409).send({
+          success: false,
+          error: "kind public is reserved for the workspace public room"
+        });
+      }
+      if (existingProject?.kind === "public") {
+        return reply.status(409).send({
+          success: false,
+          error: "The public room project classification cannot be changed"
+        });
+      }
+    }
     const project = await this.projectStore.updateProject(
       tenantId,
       projectId,
@@ -5576,6 +5720,12 @@ var WorkspaceController = class {
         });
       }
     }
+    if (project.kind === "public") {
+      return reply.status(409).send({
+        success: false,
+        error: "The public room project cannot be deleted"
+      });
+    }
     const deleted = await this.projectStore.deleteProject(tenantId, projectId);
     if (!deleted) {
       return reply.status(404).send({ success: false, error: "Project not found" });
@@ -6274,14 +6424,202 @@ function registerWorkspaceRoutes(app2, projectCollaboration) {
     "/api/filesystem/browse",
     controller.browseFilesystem.bind(controller)
   );
+  return controller;
+}
+
+// src/services/collaboration/ProjectAccessService.ts
+import { randomUUID as randomUUID6 } from "crypto";
+var ProjectCollaborationError = class extends Error {
+  /** Creates a project collaboration error. */
+  constructor(code, statusCode, message) {
+    super(message);
+    this.code = code;
+    this.statusCode = statusCode;
+    this.name = "ProjectCollaborationError";
+  }
+};
+var allowedRoles = {
+  read: /* @__PURE__ */ new Set(["owner", "admin", "member", "viewer"]),
+  send: /* @__PURE__ */ new Set(["owner", "admin", "member"]),
+  manage: /* @__PURE__ */ new Set(["owner", "admin"])
+};
+var membershipConflictNames = /* @__PURE__ */ new Set([
+  "DuplicateProjectMembershipError",
+  "ProjectMembershipIdConflictError"
+]);
+function isProjectMembershipConflict(error) {
+  return error instanceof Error && membershipConflictNames.has(error.name);
 }
+var ProjectAccessService = class {
+  /** Creates a project access service from explicitly injected stores. */
+  constructor(deps) {
+    this.deps = deps;
+    this.idFactory = deps.idFactory ?? randomUUID6;
+  }
+  /** Returns the project and active membership when the user has the requested capability. */
+  async requireProjectAccess(input) {
+    const project = await this.deps.projectStore.getProjectById(input.tenantId, input.projectId);
+    if (!project) {
+      throw new ProjectCollaborationError("PROJECT_NOT_FOUND", 404, "Project not found");
+    }
+    if (project.kind === "public") {
+      return this.requirePublicProjectAccess(project, input);
+    }
+    const membership = await this.deps.membershipStore.findByUser(
+      input.tenantId,
+      input.projectId,
+      input.userId
+    );
+    if (membership?.status === "active") {
+      this.requireCapability(membership, input.capability);
+      return { project, membership };
+    }
+    const memberships = await this.deps.membershipStore.list(input.tenantId, input.projectId);
+    if (memberships.length !== 0) this.accessDenied();
+    if (project.kind === "personal") this.accessDenied();
+    const tenantLink = await this.deps.userTenantLinkStore.getLink(input.userId, input.tenantId);
+    if (tenantLink?.role !== "owner" && tenantLink?.role !== "admin") this.accessDenied();
+    let claim;
+    try {
+      claim = await this.deps.membershipStore.createInitialOwner({
+        id: this.idFactory(),
+        tenantId: input.tenantId,
+        projectId: input.projectId,
+        userId: input.userId
+      });
+    } catch (error) {
+      if (isProjectMembershipConflict(error)) {
+        throw new ProjectCollaborationError(
+          "PROJECT_MEMBERSHIP_CONFLICT",
+          409,
+          "Project membership could not be initialized"
+        );
+      }
+      throw error;
+    }
+    if (claim.kind === "created" || claim.kind === "existing") {
+      return { project, membership: claim.membership };
+    }
+    const racedMembership = await this.deps.membershipStore.findByUser(
+      input.tenantId,
+      input.projectId,
+      input.userId
+    );
+    if (racedMembership?.status !== "active") this.accessDenied();
+    this.requireCapability(racedMembership, input.capability);
+    return { project, membership: racedMembership };
+  }
+  /** Authorizes an already-existing membership, or any tenant member for public rooms; never mutates persistence. */
+  async requireExistingProjectAccess(input) {
+    const project = await this.deps.projectStore.getProjectById(input.tenantId, input.projectId);
+    if (!project) throw new ProjectCollaborationError("PROJECT_NOT_FOUND", 404, "Project not found");
+    if (project.kind === "public") {
+      return this.requireExistingPublicProjectAccess(project, input);
+    }
+    const membership = await this.deps.membershipStore.findByUser(
+      input.tenantId,
+      input.projectId,
+      input.userId
+    );
+    if (!membership || membership.tenantId !== input.tenantId || membership.projectId !== input.projectId || membership.userId !== input.userId || membership.status !== "active") this.accessDenied();
+    this.requireCapability(membership, input.capability);
+    return { project, membership };
+  }
+  /** Authorizes roster visibility: read for public rooms, manage elsewhere. */
+  async requireRosterAccess(input) {
+    const project = await this.deps.projectStore.getProjectById(input.tenantId, input.projectId);
+    if (!project) throw new ProjectCollaborationError("PROJECT_NOT_FOUND", 404, "Project not found");
+    return this.requireProjectAccess({
+      ...input,
+      capability: project.kind === "public" ? "read" : "manage"
+    });
+  }
+  async requirePublicProjectAccess(project, input) {
+    const membership = await this.deps.membershipStore.findByUser(
+      input.tenantId,
+      input.projectId,
+      input.userId
+    );
+    if (membership?.status === "active") {
+      this.requireCapability(membership, input.capability);
+      return { project, membership };
+    }
+    const materialized = await this.materializePublicMembership(input);
+    this.requireCapability(materialized, input.capability);
+    return { project, membership: materialized };
+  }
+  async requireExistingPublicProjectAccess(project, input) {
+    const membership = await this.deps.membershipStore.findByUser(
+      input.tenantId,
+      input.projectId,
+      input.userId
+    );
+    if (membership?.status === "active") {
+      this.requireCapability(membership, input.capability);
+      return { project, membership };
+    }
+    if (membership) this.accessDenied();
+    const tenantLink = await this.deps.userTenantLinkStore.getLink(input.userId, input.tenantId);
+    if (!tenantLink) this.accessDenied();
+    const role = tenantLink.role === "owner" || tenantLink.role === "admin" ? "admin" : "member";
+    const synthetic = {
+      id: `public:${input.userId}`,
+      tenantId: input.tenantId,
+      projectId: input.projectId,
+      userId: input.userId,
+      role,
+      status: "active",
+      joinedAt: project.createdAt,
+      updatedAt: project.updatedAt
+    };
+    this.requireCapability(synthetic, input.capability);
+    return { project, membership: synthetic };
+  }
+  async materializePublicMembership(input) {
+    const tenantLink = await this.deps.userTenantLinkStore.getLink(input.userId, input.tenantId);
+    if (!tenantLink) this.accessDenied();
+    const existing = await this.deps.membershipStore.findByUser(
+      input.tenantId,
+      input.projectId,
+      input.userId
+    );
+    if (existing) this.accessDenied();
+    const role = tenantLink.role === "owner" || tenantLink.role === "admin" ? "admin" : "member";
+    try {
+      return await this.deps.membershipStore.create({
+        id: this.idFactory(),
+        tenantId: input.tenantId,
+        projectId: input.projectId,
+        userId: input.userId,
+        role,
+        status: "active"
+      });
+    } catch (error) {
+      if (isProjectMembershipConflict(error)) {
+        const raced = await this.deps.membershipStore.findByUser(
+          input.tenantId,
+          input.projectId,
+          input.userId
+        );
+        if (raced?.status === "active") return raced;
+      }
+      throw error;
+    }
+  }
+  requireCapability(membership, capability2) {
+    if (!allowedRoles[capability2].has(membership.role)) this.accessDenied();
+  }
+  accessDenied() {
+    throw new ProjectCollaborationError("PROJECT_ACCESS_DENIED", 403, "Project access denied");
+  }
+};
 
 // src/controllers/database-configs.ts
 import {
   getStoreLattice as getStoreLattice7,
   sqlDatabaseManager
 } from "@axiom-lattice/core";
-import { randomUUID as randomUUID5 } from "crypto";
+import { randomUUID as randomUUID7 } from "crypto";
 function getTenantId9(request) {
   const userTenantId = request.user?.tenantId;
   if (userTenantId) {
@@ -6359,7 +6697,7 @@ async function createDatabaseConfig(request, reply) {
         message: "Database configuration with this key already exists"
       };
     }
-    const id3 = body.id || randomUUID5();
+    const id3 = body.id || randomUUID7();
     const config = await store.createConfig(tenantId, id3, body);
     try {
       sqlDatabaseManager.registerDatabase(tenantId, config.key, config.config);
@@ -6564,7 +6902,7 @@ import {
   metricsServerManager as metricsServerManager2,
   SemanticMetricsClient as SemanticMetricsClient2
 } from "@axiom-lattice/core";
-import { randomUUID as randomUUID6 } from "crypto";
+import { randomUUID as randomUUID8 } from "crypto";
 function getTenantId10(request) {
   const userTenantId = request.user?.tenantId;
   if (userTenantId) {
@@ -6645,7 +6983,7 @@ async function createMetricsServerConfig(request, reply) {
         message: "selectedDataSources is required for semantic metrics servers"
       };
     }
-    const id3 = body.id || randomUUID6();
+    const id3 = body.id || randomUUID8();
     const configData = {
       key: body.key,
       name: body.name,
@@ -9152,7 +9490,7 @@ function registerChannelRoutes(app2, dependencies) {
 }
 
 // src/controllers/channel-installations.ts
-import { randomUUID as randomUUID7 } from "crypto";
+import { randomUUID as randomUUID9 } from "crypto";
 import {
   descriptorDataValue
 } from "@axiom-lattice/protocols";
@@ -9356,7 +9694,7 @@ async function createChannelInstallation(request, reply) {
       };
     }
     const store = await getInstallationStore();
-    const installationId = randomUUID7();
+    const installationId = randomUUID9();
     const createInput = {
       channel: body.channel,
       name: body.name,
@@ -10316,7 +10654,7 @@ async function getLocalA2ATemplates(_request, reply) {
 }
 
 // src/routes/a2a-test-connection.ts
-import { randomUUID as randomUUID8 } from "crypto";
+import { randomUUID as randomUUID10 } from "crypto";
 function describeTestConnectionError(error, agentCardUrl) {
   if (!(error instanceof Error)) {
     return `Failed to fetch agent card from ${agentCardUrl}: ${String(error)}`;
@@ -10356,7 +10694,7 @@ async function ensureLocalRuntimeForConnectionTest(localRuntime, agentCardUrl) {
     return { error: portValidation.error };
   }
   const state = await localA2AService.startProvider(
-    `test-${randomUUID8()}`,
+    `test-${randomUUID10()}`,
     testRuntime
   );
   if (state.status === "running") return { runtimeId: state.runtimeId };
@@ -10445,106 +10783,6 @@ import {
 import { snapshotExactRecord as snapshotExactRecord3 } from "@axiom-lattice/protocols";
 import { ProjectTaskOwnerPolicyError, projectTaskAdmissionNotifier } from "@axiom-lattice/core";
 
-// src/services/collaboration/ProjectAccessService.ts
-import { randomUUID as randomUUID9 } from "crypto";
-var ProjectCollaborationError = class extends Error {
-  /** Creates a project collaboration error. */
-  constructor(code, statusCode, message) {
-    super(message);
-    this.code = code;
-    this.statusCode = statusCode;
-    this.name = "ProjectCollaborationError";
-  }
-};
-var allowedRoles = {
-  read: /* @__PURE__ */ new Set(["owner", "admin", "member", "viewer"]),
-  send: /* @__PURE__ */ new Set(["owner", "admin", "member"]),
-  manage: /* @__PURE__ */ new Set(["owner", "admin"])
-};
-var membershipConflictNames = /* @__PURE__ */ new Set([
-  "DuplicateProjectMembershipError",
-  "ProjectMembershipIdConflictError"
-]);
-function isProjectMembershipConflict(error) {
-  return error instanceof Error && membershipConflictNames.has(error.name);
-}
-var ProjectAccessService = class {
-  /** Creates a project access service from explicitly injected stores. */
-  constructor(deps) {
-    this.deps = deps;
-    this.idFactory = deps.idFactory ?? randomUUID9;
-  }
-  /** Returns the project and active membership when the user has the requested capability. */
-  async requireProjectAccess(input) {
-    const project = await this.deps.projectStore.getProjectById(input.tenantId, input.projectId);
-    if (!project) {
-      throw new ProjectCollaborationError("PROJECT_NOT_FOUND", 404, "Project not found");
-    }
-    const membership = await this.deps.membershipStore.findByUser(
-      input.tenantId,
-      input.projectId,
-      input.userId
-    );
-    if (membership?.status === "active") {
-      this.requireCapability(membership, input.capability);
-      return { project, membership };
-    }
-    const memberships = await this.deps.membershipStore.list(input.tenantId, input.projectId);
-    if (memberships.length !== 0) this.accessDenied();
-    if (project.kind === "personal") this.accessDenied();
-    const tenantLink = await this.deps.userTenantLinkStore.getLink(input.userId, input.tenantId);
-    if (tenantLink?.role !== "owner" && tenantLink?.role !== "admin") this.accessDenied();
-    let claim;
-    try {
-      claim = await this.deps.membershipStore.createInitialOwner({
-        id: this.idFactory(),
-        tenantId: input.tenantId,
-        projectId: input.projectId,
-        userId: input.userId
-      });
-    } catch (error) {
-      if (isProjectMembershipConflict(error)) {
-        throw new ProjectCollaborationError(
-          "PROJECT_MEMBERSHIP_CONFLICT",
-          409,
-          "Project membership could not be initialized"
-        );
-      }
-      throw error;
-    }
-    if (claim.kind === "created" || claim.kind === "existing") {
-      return { project, membership: claim.membership };
-    }
-    const racedMembership = await this.deps.membershipStore.findByUser(
-      input.tenantId,
-      input.projectId,
-      input.userId
-    );
-    if (racedMembership?.status !== "active") this.accessDenied();
-    this.requireCapability(racedMembership, input.capability);
-    return { project, membership: racedMembership };
-  }
-  /** Authorizes only an already-existing active membership and never mutates persistence. */
-  async requireExistingProjectAccess(input) {
-    const project = await this.deps.projectStore.getProjectById(input.tenantId, input.projectId);
-    if (!project) throw new ProjectCollaborationError("PROJECT_NOT_FOUND", 404, "Project not found");
-    const membership = await this.deps.membershipStore.findByUser(
-      input.tenantId,
-      input.projectId,
-      input.userId
-    );
-    if (!membership || membership.tenantId !== input.tenantId || membership.projectId !== input.projectId || membership.userId !== input.userId || membership.status !== "active") this.accessDenied();
-    this.requireCapability(membership, input.capability);
-    return { project, membership };
-  }
-  requireCapability(membership, capability2) {
-    if (!allowedRoles[capability2].has(membership.role)) this.accessDenied();
-  }
-  accessDenied() {
-    throw new ProjectCollaborationError("PROJECT_ACCESS_DENIED", 403, "Project access denied");
-  }
-};
-
 // src/services/collaboration/ProjectTaskThreadService.ts
 import { isProjectLifecycleTask } from "@axiom-lattice/core";
 import {
@@ -11083,9 +11321,6 @@ function governedUpdate(task, body) {
   if (has("ownerType") && body.ownerType !== task.ownerType || has("ownerId") && body.ownerId !== task.ownerId) {
     return "TASK_OWNERSHIP_IMMUTABLE";
   }
-  if (task.ownerType !== "agent") return void 0;
-  if (has("parentId") && body.parentId !== task.parentId || has("dependencies") || has("requireReview") || has("result") || has("failureReason") || has("status")) return "TASK_LIFECYCLE_TRANSITION_REQUIRED";
-  if (has("context") || has("description")) return "COMPLETION_CONTEXT_MUTATION";
   return void 0;
 }
 function lifecycleStatus(code) {
@@ -11526,7 +11761,8 @@ var AgentWebAppService = class {
       integration: current.integration,
       scope: { ...current.scope, ...patch.scope },
       features: { ...current.features, ...patch.features },
-      appearance: { ...current.appearance, ...patch.appearance }
+      appearance: { ...current.appearance, ...patch.appearance },
+      identity: patch.identity ?? current.identity
     };
     await this.validateAssistant(context, current.assistantId);
     const validated = await this.validateConfig(context.tenantId, effective);
@@ -11535,7 +11771,8 @@ var AgentWebAppService = class {
       ...Object.prototype.hasOwnProperty.call(patch, "description") ? { description: validated.description } : {},
       ...patch.scope ? { scope: validated.scope } : {},
       ...patch.features ? { features: validated.features } : {},
-      ...patch.appearance ? { appearance: validated.appearance } : {}
+      ...patch.appearance ? { appearance: validated.appearance } : {},
+      ...patch.identity !== void 0 ? { identity: patch.identity } : {}
     };
     return this.writeSnapshot(context, current, update);
   }
@@ -11648,13 +11885,28 @@ var agentWebAppFeaturesSchema = z4.object({
   threadManagement: z4.boolean(),
   attachments: z4.boolean(),
   hitl: z4.boolean(),
-  genUI: z4.boolean()
+  genUI: z4.boolean(),
+  files: z4.boolean().optional()
 }).strict();
 var agentWebAppAppearanceSchema = z4.object({
   title: z4.string().max(120).optional(),
   welcomeMessage: z4.string().max(1e3).optional(),
   primaryColor: z4.string().regex(/^#[0-9A-Fa-f]{6}$/).optional()
 }).strict();
+var agentWebAppIssuerSchema = z4.object({
+  iss: z4.string().min(1).max(255),
+  aud: z4.string().min(1).max(255),
+  alg: z4.enum(["HS256", "RS256"]),
+  secret: z4.string().min(1).max(512).optional(),
+  jwksUrl: z4.string().url().max(2048).optional()
+}).strict().refine(
+  (value) => value.alg === "HS256" ? value.secret !== void 0 : value.jwksUrl !== void 0,
+  { message: "HS256 requires secret; RS256 requires jwksUrl" }
+);
+var agentWebAppIdentitySchema = z4.object({
+  policy: z4.enum(["unverified", "verified", "both"]),
+  issuers: z4.array(agentWebAppIssuerSchema).min(1).max(10)
+}).strict();
 var createAgentWebAppSchema = z4.object({
   assistantId: externalId,
   name: z4.string().min(1).max(120),
@@ -11662,14 +11914,16 @@ var createAgentWebAppSchema = z4.object({
   integration: z4.object({ type: z4.literal("react_sdk") }).strict(),
   scope: agentWebAppScopeSchema,
   features: agentWebAppFeaturesSchema,
-  appearance: agentWebAppAppearanceSchema
+  appearance: agentWebAppAppearanceSchema,
+  identity: agentWebAppIdentitySchema.optional()
 }).strict();
 var updateAgentWebAppSchema = z4.object({
   name: z4.string().min(1).max(120).optional(),
   description: z4.string().max(1e3).optional(),
   scope: agentWebAppScopeSchema.partial().strict().optional(),
   features: agentWebAppFeaturesSchema.partial().strict().optional(),
-  appearance: agentWebAppAppearanceSchema.partial().strict().optional()
+  appearance: agentWebAppAppearanceSchema.partial().strict().optional(),
+  identity: agentWebAppIdentitySchema.optional()
 }).strict().refine((value) => Object.keys(value).length > 0, "Patch must not be empty");
 var listAgentWebAppsQuerySchema = z4.object({
   assistantId: externalId.optional()
@@ -11756,10 +12010,11 @@ function invalidRequest(reply, statusCode) {
 }
 
 // src/routes/agent-web-app-runtime.ts
+import { createHmac as createHmac3 } from "crypto";
 import { z as z5, ZodError as ZodError2 } from "zod";
 
 // src/services/agent-web-app/AgentWebAppRuntimeService.ts
-import { createHash, randomUUID as randomUUID10 } from "crypto";
+import { createHash as createHash2, randomUUID as randomUUID11 } from "crypto";
 import { MessageChunkTypes as MessageChunkTypes3, parseAgentWebAppGenUIBlock } from "@axiom-lattice/protocols";
 function isRecord2(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
@@ -11776,7 +12031,16 @@ var AgentWebAppRuntimeService = class {
   constructor(deps) {
     this.deps = deps;
   }
-  async bootstrap(webAppId, userId, selection) {
+  /** Identity policy configuration for the web app, or null when the app is missing/unconfigured. */
+  async getIdentityConfig(webAppId) {
+    try {
+      const runtime = await this.resolveRuntime(webAppId, {});
+      return runtime.webApp.identity ?? null;
+    } catch {
+      return null;
+    }
+  }
+  async bootstrap(webAppId, userId, selection, identity) {
     const runtime = await this.resolveRuntime(webAppId, selection);
     const assistant = await this.deps.assistantResolver.resolve(
       runtime.webApp.tenantId,
@@ -11809,7 +12073,7 @@ var AgentWebAppRuntimeService = class {
         defaultModelKey: runtime.webApp.scope.defaultModelKey,
         features: runtime.webApp.features,
         appearance: runtime.webApp.appearance,
-        identityAssurance: "unverified"
+        identityAssurance: identity?.assurance ?? "unverified"
       },
       projects,
       models
@@ -11830,6 +12094,14 @@ var AgentWebAppRuntimeService = class {
     this.requireFeature(runtime.webApp.features.threadManagement);
     return this.createOwnedThread(runtime, userId, input.label);
   }
+  /** Fetch one owned thread. */
+  async getThread(webAppId, userId, threadId, selection) {
+    const runtime = await this.resolveRuntime(webAppId, selection);
+    await this.requireOwnedThread(runtime, userId, threadId);
+    const thread = await this.deps.threadStore.getThreadById(runtime.webApp.tenantId, threadId);
+    if (!thread) this.threadNotFound();
+    return toRuntimeThread(thread);
+  }
   /** Update a thread label; omitted or blank labels preserve the existing label. */
   async updateThread(webAppId, userId, threadId, input) {
     const runtime = await this.resolveRuntime(webAppId, input);
@@ -11864,6 +12136,60 @@ var AgentWebAppRuntimeService = class {
       return [{ id: message.id, role: message.role, ...content && (typeof content === "string" || content.length > 0) ? { content } : {} }];
     });
   }
+  async getState(webAppId, userId, threadId, selection) {
+    const runtime = await this.resolveRuntime(webAppId, selection);
+    await this.requireOwnedThread(runtime, userId, threadId);
+    const agent = this.resolveAgent(runtime, threadId);
+    const state = await agent.getCurrentState();
+    const pendingMessages = await agent.getPendingMessages();
+    const normalized = pendingMessages.map((message) => ({
+      ...message,
+      content: typeof message.content === "object" && message.content !== null ? "message" in message.content ? message.content.message : JSON.stringify(message.content) : String(message.content ?? "")
+    }));
+    return { ...state && typeof state === "object" ? state : {}, pendingMessages: normalized };
+  }
+  /** Raw stored messages (Console memory contract, tool/interrupt preserved). */
+  async getConsoleMessages(webAppId, userId, threadId, selection) {
+    const runtime = await this.resolveRuntime(webAppId, selection);
+    await this.requireOwnedThread(runtime, userId, threadId);
+    return this.deps.messageReader.getCurrentMessages({
+      tenantId: runtime.webApp.tenantId,
+      assistantId: runtime.webApp.assistantId,
+      threadId,
+      workspaceId: runtime.project.workspaceId,
+      projectId: runtime.project.id
+    });
+  }
+  /** Background enqueue only (ADR-026): returns the message id; delivery happens over resume_stream. */
+  async enqueueMessage(webAppId, userId, threadId, content, selection) {
+    const runtime = await this.resolveOwnedRuntime(webAppId, userId, threadId, selection);
+    const agent = this.resolveAgent(runtime, threadId);
+    const execution = await this.execute(agent, runtime, { input: { message: content } });
+    return { messageId: execution.messageId };
+  }
+  async removePendingMessage(webAppId, userId, threadId, messageId, selection) {
+    const runtime = await this.resolveRuntime(webAppId, selection);
+    await this.requireOwnedThread(runtime, userId, threadId);
+    const agent = this.resolveAgent(runtime, threadId);
+    if (!await agent.removePendingMessage(messageId)) this.threadNotFound();
+  }
+  /** Thread-lifetime SSE resume from the last known client message id. */
+  async resumeStream(webAppId, userId, threadId, messageId, selection) {
+    const runtime = await this.resolveRuntime(webAppId, selection);
+    await this.requireOwnedThread(runtime, userId, threadId);
+    const agent = this.resolveAgent(runtime, threadId);
+    return { stream: agent.chunkStream(messageId, []) };
+  }
+  async resolveFileScope(webAppId, selection) {
+    const runtime = await this.resolveRuntime(webAppId, selection);
+    return {
+      tenantId: runtime.webApp.tenantId,
+      workspaceId: runtime.project.workspaceId,
+      projectId: runtime.project.id,
+      assistantId: runtime.webApp.assistantId,
+      enabled: runtime.webApp.features.files === true
+    };
+  }
   async streamMessage(webAppId, userId, threadId, input) {
     const runtime = await this.resolveOwnedRuntime(webAppId, userId, threadId, input);
     const refs = this.resolveAttachmentRefs(runtime, userId, threadId, input.attachmentRefs ?? []);
@@ -11882,10 +12208,10 @@ ${formatFileRefsSection(refs)}` : input.content;
     const runtime = await this.resolveOwnedRuntime(webAppId, userId, threadId, selection);
     this.requireNamedFeature(runtime.webApp.features.attachments, "Attachments are disabled");
     if (!this.deps.saveProjectFile || !this.deps.attachmentRefs) this.fail("INTERNAL_ERROR", 500, "Attachment service is unavailable");
-    const userDigest = createHash("sha256").update(userId, "utf8").digest("hex");
-    const contentDigest = createHash("sha256").update(file.bytes).digest("hex");
+    const userDigest = createHash2("sha256").update(userId, "utf8").digest("hex");
+    const contentDigest = createHash2("sha256").update(file.bytes).digest("hex");
     const displayName = file.name;
-    const physicalName = `${randomUUID10()}-${sanitizePhysicalFilename(file.name)}`;
+    const physicalName = `${randomUUID11()}-${sanitizePhysicalFilename(file.name)}`;
     const saved = await this.deps.saveProjectFile({
       tenantId: runtime.webApp.tenantId,
       workspaceId: runtime.project.workspaceId,
@@ -12037,7 +12363,7 @@ ${formatFileRefsSection(refs)}` : input.content;
     const thread = await this.deps.threadStore.createThread(
       runtime.webApp.tenantId,
       runtime.webApp.assistantId,
-      randomUUID10(),
+      randomUUID11(),
       { metadata: this.metadata(runtime, userId, normalizeLabel(rawLabel)) }
     );
     return toRuntimeThread(thread);
@@ -12089,7 +12415,7 @@ function implicitThreadId(runtime, userId) {
     userId,
     runtime.project.id
   ]);
-  const bytes = createHash("sha256").update(canonicalTuple, "utf8").digest().subarray(0, 16);
+  const bytes = createHash2("sha256").update(canonicalTuple, "utf8").digest().subarray(0, 16);
   bytes[6] = bytes[6] & 15 | 128;
   bytes[8] = bytes[8] & 63 | 128;
   const hex = bytes.toString("hex");
@@ -12108,96 +12434,102 @@ function toRuntimeThread(thread) {
   };
 }
 
-// src/services/agent-web-app/AgentWebAppStreamProjector.ts
-import {
-  MessageChunkTypes as MessageChunkTypes4,
-  parseAgentWebAppGenUIBlock as parseAgentWebAppGenUIBlock2
-} from "@axiom-lattice/protocols";
-function createAgentWebAppStreamProjectionContext(options = {}) {
-  return { startedToolIds: /* @__PURE__ */ new Set(), allowInterrupts: options.allowInterrupts ?? true, allowGenUI: options.allowGenUI ?? false };
-}
-function projectAgentWebAppChunk(chunk, context) {
-  if (chunk.type === MessageChunkTypes4.AI) {
-    const events = [];
-    const startedToolIds = context?.startedToolIds ?? /* @__PURE__ */ new Set();
-    if (typeof chunk.data.content === "string" && chunk.data.content) events.push({ type: "message.delta", text: chunk.data.content });
-    if (context?.allowGenUI && Array.isArray(chunk.data.content)) {
-      for (const value of chunk.data.content) {
-        const block = parseAgentWebAppGenUIBlock2(value);
-        if (block) events.push({ type: "genui.render", block });
-      }
-    }
-    for (const call of chunk.data.tool_call_chunks ?? []) {
-      if (call.id && call.name && !startedToolIds.has(call.id)) {
-        startedToolIds.add(call.id);
-        events.push({ type: "tool.started", id: call.id, name: call.name });
-      }
-    }
-    for (const call of chunk.data.tool_calls ?? []) {
-      if (!startedToolIds.has(call.id)) {
-        startedToolIds.add(call.id);
-        events.push({ type: "tool.started", id: call.id, name: call.name });
-      }
-    }
-    return events;
-  }
-  if (chunk.type === MessageChunkTypes4.TOOL && chunk.data.tool_call_id) {
-    return [{ type: "tool.completed", id: chunk.data.tool_call_id }];
-  }
-  if (chunk.type === MessageChunkTypes4.INTERRUPT) {
-    if (context && !context.allowInterrupts) return [{ type: "stream.completed" }];
-    const interrupt = publicInterrupt(chunk);
-    return interrupt ? [{ type: "interrupt.created", interrupt }, { type: "stream.completed" }] : [{ type: "stream.completed" }];
-  }
-  if (chunk.type === MessageChunkTypes4.MESSAGE_COMPLETED) {
-    return [
-      { type: "message.completed", messageId: chunk.data.id },
-      { type: "stream.completed" }
-    ];
-  }
-  if (chunk.type === MessageChunkTypes4.MESSAGE_FAILED) {
-    return [
-      { type: "error", error: { code: "STREAM_FAILED", message: "Stream failed", retryable: true } },
-      { type: "stream.completed" }
-    ];
+// src/services/agent-web-app/AgentWebAppTokenVerifier.ts
+import { createHmac as createHmac2, createPublicKey, timingSafeEqual as timingSafeEqual2, verify as cryptoVerify } from "crypto";
+var WebAppTokenError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "WebAppTokenError";
   }
-  return [];
-}
-function publicInterrupt(chunk) {
-  const value = parseInterruptContent(chunk.data.content);
-  if (!value) return void 0;
-  const topLevelId = chunk.id;
-  const id3 = typeof topLevelId === "string" ? topLevelId : chunk.data.id;
-  if (!id3) return void 0;
-  return {
-    id: id3,
-    type: typeof value.type === "string" ? value.type : "input",
-    prompt: typeof value.prompt === "string" ? value.prompt : typeof value.message === "string" ? value.message : "Input required",
-    ...isRecord3(value.data) ? { data: value.data } : {}
-  };
-}
-function parseInterruptContent(content) {
-  if (!content) return {};
-  if (isRecord3(content)) return content;
-  if (typeof content !== "string") return void 0;
+};
+var MAX_TOKEN_BYTES = 8 * 1024;
+var CLOCK_SKEW_SECONDS = 60;
+var JWKS_TTL_MS = 10 * 60 * 1e3;
+var jwksCache = /* @__PURE__ */ new Map();
+function decodeSegment(segment) {
+  const json = Buffer.from(segment, "base64url").toString("utf8");
+  let value;
   try {
-    const parsed = JSON.parse(content);
-    return isRecord3(parsed) ? parsed : { prompt: content };
+    value = JSON.parse(json);
   } catch {
-    return { prompt: content };
+    throw new WebAppTokenError("Malformed token segment");
   }
+  if (typeof value !== "object" || value === null) throw new WebAppTokenError("Malformed token segment");
+  return value;
 }
-function isRecord3(value) {
-  return typeof value === "object" && value !== null && !Array.isArray(value);
+async function resolveKey(issuer, kid, fetchImpl) {
+  const cacheKey = issuer.jwksUrl ?? "";
+  const load = async () => {
+    const response = await fetchImpl(issuer.jwksUrl ?? "");
+    if (!response.ok) throw new WebAppTokenError("JWKS fetch failed");
+    const document = await response.json();
+    const keys2 = document.keys;
+    const entry2 = { keys: Array.isArray(keys2) ? keys2 : [], fetchedAt: Date.now() };
+    jwksCache.set(cacheKey, entry2);
+    return entry2;
+  };
+  const cached = jwksCache.get(cacheKey);
+  let entry = cached && Date.now() - cached.fetchedAt < JWKS_TTL_MS ? cached : await load();
+  let jwk = entry.keys.find((key) => kid === void 0 ? true : key.kid === kid);
+  if (!jwk && kid !== void 0) {
+    entry = await load();
+    jwk = entry.keys.find((key) => key.kid === kid);
+  }
+  if (!jwk) throw new WebAppTokenError("No matching JWKS key");
+  return createPublicKey({ key: jwk, format: "jwk" });
+}
+async function verifyWebAppToken(token, issuer, options = {}) {
+  const nowMs = options.now ? options.now() : Date.now();
+  const now = Math.floor(nowMs / 1e3);
+  if (token.length === 0 || Buffer.byteLength(token) > MAX_TOKEN_BYTES) throw new WebAppTokenError("Token size invalid");
+  const parts = token.split(".");
+  if (parts.length !== 3) throw new WebAppTokenError("Token structure invalid");
+  const [rawHeader, rawPayload, rawSignature] = parts;
+  const header2 = decodeSegment(rawHeader);
+  const payload = decodeSegment(rawPayload);
+  if (header2.alg !== issuer.alg) throw new WebAppTokenError("Token algorithm mismatch");
+  if (payload.iss !== issuer.iss) throw new WebAppTokenError("Token issuer mismatch");
+  if (payload.aud !== issuer.aud) throw new WebAppTokenError("Token audience mismatch");
+  const exp = typeof payload.exp === "number" ? payload.exp : void 0;
+  if (exp === void 0 || exp + CLOCK_SKEW_SECONDS < now) throw new WebAppTokenError("Token expired");
+  const nbf = typeof payload.nbf === "number" ? payload.nbf : void 0;
+  if (nbf !== void 0 && nbf - CLOCK_SKEW_SECONDS > now) throw new WebAppTokenError("Token not yet valid");
+  const signature = Buffer.from(rawSignature, "base64url");
+  const data = Buffer.from(`${rawHeader}.${rawPayload}`);
+  if (issuer.alg === "HS256") {
+    if (typeof issuer.secret !== "string" || issuer.secret.length === 0) throw new WebAppTokenError("Issuer secret missing");
+    const expected = createHmac2("sha256", issuer.secret).update(data).digest();
+    if (signature.length !== expected.length || !timingSafeEqual2(signature, expected)) {
+      throw new WebAppTokenError("Token signature invalid");
+    }
+  } else {
+    if (typeof issuer.jwksUrl !== "string") throw new WebAppTokenError("Issuer JWKS URL missing");
+    const key = await resolveKey(issuer, typeof header2.kid === "string" ? header2.kid : void 0, options.fetchImpl ?? fetch);
+    let valid = false;
+    try {
+      valid = cryptoVerify("RSA-SHA256", data, key, signature);
+    } catch {
+      valid = false;
+    }
+    if (!valid) throw new WebAppTokenError("Token signature invalid");
+  }
+  const sub = payload.sub;
+  if (typeof sub !== "string" || sub.length === 0 || sub.length > 128 || !/^[A-Za-z0-9._:@-]+$/.test(sub)) {
+    throw new WebAppTokenError("Token subject invalid");
+  }
+  return sub;
 }
 
 // src/routes/agent-web-app-runtime.ts
+import { createAgentWebAppStreamProjectionContext, projectAgentWebAppChunk } from "@axiom-lattice/protocols";
 var idSchema = z5.string().min(1).max(128);
 var paramsSchema = z5.object({ webAppId: idSchema }).strict();
 var threadParamsSchema = z5.object({ webAppId: idSchema, threadId: idSchema }).strict();
 var interruptParamsSchema = z5.object({ webAppId: idSchema, threadId: idSchema, interruptId: idSchema }).strict();
+var pendingMessageParamsSchema = z5.object({ webAppId: idSchema, threadId: idSchema, messageId: idSchema }).strict();
 var bootstrapQuerySchema = z5.object({ projectId: idSchema.optional(), modelKey: idSchema.optional() }).strict();
 var projectQuerySchema = z5.object({ projectId: idSchema.optional() }).strict();
+var projectQueryLenientSchema = projectQuerySchema.passthrough();
 var threadBodySchema = z5.object({ projectId: idSchema.optional(), label: z5.string().max(128).optional() }).strict();
 var streamBodySchema = z5.object({
   content: z5.string().trim().min(1).max(32768),
@@ -12216,8 +12548,27 @@ var resumeBodySchema = z5.object({
   ])
 }).strict();
 var MAX_ATTACHMENT_BYTES = 10 * 1024 * 1024;
+var stateQuerySchema = z5.object({
+  threadId: idSchema,
+  projectId: idSchema.optional(),
+  modelKey: idSchema.optional()
+}).strict();
+var resumeSchema = z5.object({
+  messageId: idSchema,
+  projectId: idSchema.optional(),
+  modelKey: idSchema.optional()
+}).strict();
+var devTokenSchema = z5.object({
+  iss: z5.string().min(1).max(255).optional(),
+  sub: z5.string().regex(/^[A-Za-z0-9._:@-]+$/).max(128).optional(),
+  hours: z5.number().gt(0).max(720).optional()
+}).strict();
+var fileQuerySchema = z5.object({
+  projectId: idSchema.optional(),
+  modelKey: idSchema.optional()
+}).passthrough();
 function createExternalHeaderIdentityResolver() {
-  return { resolve(request) {
+  return { async resolve(request) {
     const raw = request.headers["x-axiom-external-user-id"];
     if (raw === void 0) throw new AgentWebAppRuntimeError("USER_ID_REQUIRED", 401, "External user id is required");
     if (Array.isArray(raw) || typeof raw !== "string") throw new AgentWebAppRuntimeError("INVALID_USER_ID", 400, "External user id is invalid");
@@ -12226,47 +12577,109 @@ function createExternalHeaderIdentityResolver() {
     return { userId, assurance: "unverified" };
   } };
 }
+function createWebAppIdentityResolver(deps) {
+  const headerResolver = createExternalHeaderIdentityResolver();
+  return {
+    async resolve(request, webAppId) {
+      let config;
+      try {
+        config = await deps.getIdentityConfig(webAppId);
+      } catch {
+        config = void 0;
+      }
+      const policy = config?.policy ?? "unverified";
+      const authHeader = request.headers.authorization;
+      const bearer = typeof authHeader === "string" && authHeader.startsWith("Bearer ") ? authHeader.slice(7).trim() : void 0;
+      if (policy !== "unverified" && bearer !== void 0) {
+        const issuers = config?.issuers ?? [];
+        if (issuers.length === 0) throw new AgentWebAppRuntimeError("INVALID_REQUEST", 401, "No trusted issuer configured");
+        let lastError = new AgentWebAppRuntimeError("INVALID_REQUEST", 401, "Invalid identity token");
+        for (const issuer of issuers) {
+          try {
+            const sub = await verifyWebAppToken(bearer, issuer);
+            return { userId: sub, assurance: "verified" };
+          } catch (error) {
+            if (error instanceof WebAppTokenError) {
+              lastError = error;
+              continue;
+            }
+            throw error;
+          }
+        }
+        const message = lastError instanceof WebAppTokenError ? `Invalid identity token: ${lastError.message}` : "Invalid identity token";
+        throw new AgentWebAppRuntimeError("INVALID_REQUEST", 401, message);
+      }
+      if (policy === "verified") throw new AgentWebAppRuntimeError("USER_ID_REQUIRED", 401, "A verified identity token is required");
+      return headerResolver.resolve(request, webAppId);
+    }
+  };
+}
 function registerAgentWebAppRuntimeRoutes(app2, deps) {
-  const identities = deps.identityResolver ?? createExternalHeaderIdentityResolver();
+  const identities = deps.identityResolver ?? createWebAppIdentityResolver({ getIdentityConfig: (webAppId) => deps.service.getIdentityConfig(webAppId) });
   app2.register(async (routes) => {
     routes.setErrorHandler((error, _request, reply) => normalizeError2(reply, error));
     routes.get("/api/web-apps/:webAppId/runtime/bootstrap", async (request, reply) => handle2(reply, async () => {
       const { webAppId } = paramsSchema.parse(request.params);
-      const identity = resolveRuntimeIdentity(request, webAppId, identities);
-      return { data: await deps.service.bootstrap(webAppId, identity.userId, withPreview(bootstrapQuerySchema.parse(request.query), identity.preview)) };
+      const identity = await resolveRuntimeIdentity(request, webAppId, identities);
+      return { data: await deps.service.bootstrap(webAppId, identity.userId, withPreview(bootstrapQuerySchema.parse(request.query), identity.preview), { assurance: identity.assurance ?? "unverified" }) };
     }));
     routes.get("/api/web-apps/:webAppId/runtime/threads", async (request, reply) => handle2(reply, async () => {
       const { webAppId } = paramsSchema.parse(request.params);
-      const identity = resolveRuntimeIdentity(request, webAppId, identities);
+      const identity = await resolveRuntimeIdentity(request, webAppId, identities);
       const records = await deps.service.listThreads(webAppId, identity.userId, withPreview(projectQuerySchema.parse(request.query), identity.preview));
       return { data: { records, total: records.length } };
     }));
     routes.post("/api/web-apps/:webAppId/runtime/threads", async (request, reply) => handle2(reply, async () => {
       const { webAppId } = paramsSchema.parse(request.params);
-      const identity = resolveRuntimeIdentity(request, webAppId, identities);
+      const identity = await resolveRuntimeIdentity(request, webAppId, identities);
       return { statusCode: 201, data: await deps.service.createThread(webAppId, identity.userId, withPreview(threadBodySchema.parse(request.body), identity.preview)) };
     }));
     routes.patch("/api/web-apps/:webAppId/runtime/threads/:threadId", async (request, reply) => handle2(reply, async () => {
       const { webAppId, threadId } = threadParamsSchema.parse(request.params);
-      const identity = resolveRuntimeIdentity(request, webAppId, identities);
+      const identity = await resolveRuntimeIdentity(request, webAppId, identities);
       return { data: await deps.service.updateThread(webAppId, identity.userId, threadId, withPreview(threadBodySchema.parse(request.body), identity.preview)) };
     }));
     routes.delete("/api/web-apps/:webAppId/runtime/threads/:threadId", async (request, reply) => handle2(reply, async () => {
       const { webAppId, threadId } = threadParamsSchema.parse(request.params);
-      const identity = resolveRuntimeIdentity(request, webAppId, identities);
+      const identity = await resolveRuntimeIdentity(request, webAppId, identities);
       await deps.service.deleteThread(webAppId, identity.userId, threadId, withPreview(projectQuerySchema.parse(request.query), identity.preview));
       return { data: { id: threadId } };
     }));
     routes.get("/api/web-apps/:webAppId/runtime/threads/:threadId/messages", async (request, reply) => handle2(reply, async () => {
       const { webAppId, threadId } = threadParamsSchema.parse(request.params);
-      const identity = resolveRuntimeIdentity(request, webAppId, identities);
+      const identity = await resolveRuntimeIdentity(request, webAppId, identities);
       const messages = await deps.service.getMessages(webAppId, identity.userId, threadId, withPreview(projectQuerySchema.parse(request.query), identity.preview));
       return { data: { messages } };
     }));
+    routes.get("/api/web-apps/:webAppId/runtime/state", async (request, reply) => handle2(reply, async () => {
+      const { webAppId } = paramsSchema.parse(request.params);
+      const identity = await resolveRuntimeIdentity(request, webAppId, identities);
+      const { threadId, projectId, modelKey: modelKey2 } = stateQuerySchema.parse(request.query);
+      const state = await deps.service.getState(webAppId, identity.userId, threadId, withPreview({ projectId, modelKey: modelKey2 }, identity.preview));
+      return { data: state };
+    }));
+    routes.delete("/api/web-apps/:webAppId/runtime/threads/:threadId/pending-messages/:messageId", async (request, reply) => handle2(reply, async () => {
+      const { webAppId, threadId, messageId } = pendingMessageParamsSchema.parse(request.params);
+      const identity = await resolveRuntimeIdentity(request, webAppId, identities);
+      await deps.service.removePendingMessage(webAppId, identity.userId, threadId, messageId, withPreview(projectQuerySchema.parse(request.query), identity.preview));
+      return { data: { removed: true } };
+    }));
     routes.post("/api/web-apps/:webAppId/runtime/threads/:threadId/messages/stream", async (request, reply) => {
       try {
         const { webAppId, threadId } = threadParamsSchema.parse(request.params);
-        const identity = resolveRuntimeIdentity(request, webAppId, identities);
+        const identity = await resolveRuntimeIdentity(request, webAppId, identities);
+        const input = streamBodySchema.parse(request.body);
+        const result = await deps.service.streamMessage(webAppId, identity.userId, threadId, withPreview(input, identity.preview));
+        beginSse(reply);
+        await pipeNativeWebAppStream(reply.raw, result.stream);
+      } catch (error) {
+        return normalizeError2(reply, error);
+      }
+    });
+    routes.post("/api/web-apps/:webAppId/runtime/v1/threads/:threadId/messages/stream", async (request, reply) => {
+      try {
+        const { webAppId, threadId } = threadParamsSchema.parse(request.params);
+        const identity = await resolveRuntimeIdentity(request, webAppId, identities);
         const input = streamBodySchema.parse(request.body);
         const result = await deps.service.streamMessage(webAppId, identity.userId, threadId, withPreview(input, identity.preview));
         beginSse(reply);
@@ -12275,15 +12688,27 @@ function registerAgentWebAppRuntimeRoutes(app2, deps) {
         return normalizeError2(reply, error);
       }
     });
+    routes.post("/api/web-apps/:webAppId/runtime/threads/:threadId/resume", async (request, reply) => {
+      try {
+        const { webAppId, threadId } = threadParamsSchema.parse(request.params);
+        const identity = await resolveRuntimeIdentity(request, webAppId, identities);
+        const { messageId, projectId, modelKey: modelKey2 } = resumeSchema.parse(request.body);
+        const result = await deps.service.resumeStream(webAppId, identity.userId, threadId, messageId, withPreview({ projectId, modelKey: modelKey2 }, identity.preview));
+        beginSse(reply);
+        await pipeNativeWebAppStream(reply.raw, result.stream);
+      } catch (error) {
+        return normalizeError2(reply, error);
+      }
+    });
     routes.post("/api/web-apps/:webAppId/runtime/threads/:threadId/abort", async (request, reply) => handle2(reply, async () => {
       const { webAppId, threadId } = threadParamsSchema.parse(request.params);
-      const identity = resolveRuntimeIdentity(request, webAppId, identities);
+      const identity = await resolveRuntimeIdentity(request, webAppId, identities);
       await deps.service.abort(webAppId, identity.userId, threadId, withPreview(projectQuerySchema.parse(request.query), identity.preview));
       return { data: { aborted: true } };
     }));
     routes.post("/api/web-apps/:webAppId/runtime/threads/:threadId/attachments", async (request, reply) => handle2(reply, async () => {
       const { webAppId, threadId } = threadParamsSchema.parse(request.params);
-      const identity = resolveRuntimeIdentity(request, webAppId, identities);
+      const identity = await resolveRuntimeIdentity(request, webAppId, identities);
       if (!request.isMultipart()) throw new ZodError2([]);
       const part = await request.file({ limits: { files: 1, fileSize: MAX_ATTACHMENT_BYTES } });
       if (!part || !part.filename || part.filename.length > 255) throw new ZodError2([]);
@@ -12299,7 +12724,7 @@ function registerAgentWebAppRuntimeRoutes(app2, deps) {
     routes.post("/api/web-apps/:webAppId/runtime/threads/:threadId/interrupts/:interruptId/resume", async (request, reply) => {
       try {
         const { webAppId, threadId, interruptId } = interruptParamsSchema.parse(request.params);
-        const identity = resolveRuntimeIdentity(request, webAppId, identities);
+        const identity = await resolveRuntimeIdentity(request, webAppId, identities);
         const { projectId, modelKey: modelKey2, message, response } = resumeBodySchema.parse(request.body);
         const result = await deps.service.resumeInterrupt(webAppId, identity.userId, threadId, interruptId, withPreview({ projectId, modelKey: modelKey2 }, identity.preview), { message, response });
         beginSse(reply);
@@ -12308,13 +12733,257 @@ function registerAgentWebAppRuntimeRoutes(app2, deps) {
         return normalizeError2(reply, error);
       }
     });
+    routes.post("/api/web-apps/:webAppId/dev/token", async (request, reply) => handle2(reply, async () => {
+      if (process.env.WEB_APP_DEV_TOKEN_ENABLED !== "true") {
+        throw new AgentWebAppRuntimeError("FEATURE_DISABLED", 403, "Dev token issuance is disabled (set WEB_APP_DEV_TOKEN_ENABLED=true)");
+      }
+      const { webAppId } = paramsSchema.parse(request.params);
+      const { iss, sub, hours } = devTokenSchema.parse(request.body ?? {});
+      const config = await deps.service.getIdentityConfig(webAppId);
+      const issuer = (config?.issuers ?? []).find((entry) => entry.alg === "HS256" && (iss === void 0 || entry.iss === iss));
+      if (!issuer || typeof issuer.secret !== "string") {
+        throw new AgentWebAppRuntimeError("INVALID_REQUEST", 400, "Web app has no HS256 issuer configured");
+      }
+      const now = Math.floor(Date.now() / 1e3);
+      const expiresIn = (hours ?? 24) * 3600;
+      const subject = sub ?? "dev-user";
+      const b64url = (input) => Buffer.from(input).toString("base64url");
+      const body = `${b64url(JSON.stringify({ alg: "HS256", typ: "JWT" }))}.${b64url(JSON.stringify({ sub: subject, iss: issuer.iss, aud: issuer.aud, iat: now, exp: now + expiresIn }))}`;
+      const token = `${body}.${createHmac3("sha256", issuer.secret).update(body).digest("base64url")}`;
+      return { data: { token, tokenType: "Bearer", expiresIn, subject } };
+    }));
+    if (deps.taskController) {
+      const tasks = deps.taskController;
+      const withSubject = (handler) => async (request, reply) => {
+        const { webAppId } = paramsSchema.parse(request.params);
+        const identity = await resolveRuntimeIdentity(request, webAppId, identities);
+        const proxy = Object.create(request);
+        proxy.headers = { ...request.headers, "x-user-id": identity.userId };
+        return handler(proxy, reply);
+      };
+      routes.get("/api/web-apps/:webAppId/runtime/tasks", withSubject((request, reply) => tasks.list(request, reply)));
+      routes.post("/api/web-apps/:webAppId/runtime/tasks", withSubject((request, reply) => tasks.create(request, reply)));
+      routes.get("/api/web-apps/:webAppId/runtime/tasks/:taskId", withSubject((request, reply) => tasks.get(request, reply)));
+      routes.put("/api/web-apps/:webAppId/runtime/tasks/:taskId", withSubject((request, reply) => tasks.update(request, reply)));
+      routes.patch("/api/web-apps/:webAppId/runtime/tasks/:taskId", withSubject((request, reply) => tasks.update(request, reply)));
+      routes.delete("/api/web-apps/:webAppId/runtime/tasks/:taskId", withSubject((request, reply) => tasks.remove(request, reply)));
+      routes.patch("/api/web-apps/:webAppId/runtime/tasks/:taskId/complete", withSubject((request, reply) => tasks.complete(request, reply)));
+      routes.get("/api/web-apps/:webAppId/runtime/tasks/:taskId/work-items", withSubject((request, reply) => tasks.workItems(request, reply)));
+    }
+    if (deps.workspaceController) {
+      const workspace = deps.workspaceController;
+      const fileScope = async (webAppId, selection) => {
+        const scope = await deps.service.resolveFileScope(webAppId, selection);
+        if (!scope.enabled) throw new AgentWebAppRuntimeError("FEATURE_DISABLED", 403, "Files are disabled for this web app");
+        return scope;
+      };
+      const scopedRequest = (request, scope, params, query) => {
+        const proxy = Object.create(request);
+        proxy.params = params;
+        proxy.query = query;
+        proxy.headers = { ...request.headers, "x-tenant-id": scope.tenantId };
+        return proxy;
+      };
+      const unwrap = (result) => ({ data: result.data });
+      routes.get("/api/web-apps/:webAppId/runtime/files/listpath", async (request) => {
+        const { webAppId } = paramsSchema.parse(request.params);
+        const identity = await resolveRuntimeIdentity(request, webAppId, identities);
+        const scope = await fileScope(webAppId, fileQuerySchema.parse(request.query));
+        const query = { ...request.query, assistantId: scope.assistantId };
+        const result = await workspace.listPath(scopedRequest(request, scope, { workspaceId: scope.workspaceId, projectId: scope.projectId }, query));
+        return unwrap(result);
+      });
+      routes.get("/api/web-apps/:webAppId/runtime/files/readfile", async (request) => {
+        const { webAppId } = paramsSchema.parse(request.params);
+        const identity = await resolveRuntimeIdentity(request, webAppId, identities);
+        const scope = await fileScope(webAppId, fileQuerySchema.parse(request.query));
+        const query = { ...request.query, assistantId: scope.assistantId };
+        const result = await workspace.readFile(scopedRequest(request, scope, { workspaceId: scope.workspaceId, projectId: scope.projectId }, query));
+        return unwrap(result);
+      });
+      routes.post("/api/web-apps/:webAppId/runtime/files/uploadfile", async (request, reply) => {
+        const { webAppId } = paramsSchema.parse(request.params);
+        const identity = await resolveRuntimeIdentity(request, webAppId, identities);
+        const scope = await fileScope(webAppId, fileQuerySchema.parse(request.query));
+        const scoped = scopedRequest(request, scope, { workspaceId: scope.workspaceId, projectId: scope.projectId }, { assistantId: scope.assistantId });
+        await workspace.uploadFile(scoped, reply);
+        return reply;
+      });
+      routes.get("/api/web-apps/:webAppId/runtime/files/viewfile", async (request, reply) => {
+        const { webAppId } = paramsSchema.parse(request.params);
+        const identity = await resolveRuntimeIdentity(request, webAppId, identities);
+        const scope = await fileScope(webAppId, fileQuerySchema.parse(request.query));
+        const query = { ...request.query, assistantId: scope.assistantId };
+        await workspace.viewFile(scopedRequest(request, scope, { workspaceId: scope.workspaceId, projectId: scope.projectId }, query), reply);
+        return reply;
+      });
+      routes.get("/api/web-apps/:webAppId/runtime/files/downloadfile", async (request, reply) => {
+        const { webAppId } = paramsSchema.parse(request.params);
+        const identity = await resolveRuntimeIdentity(request, webAppId, identities);
+        const scope = await fileScope(webAppId, fileQuerySchema.parse(request.query));
+        const query = { ...request.query, assistantId: scope.assistantId };
+        await workspace.downloadFile(scopedRequest(request, scope, { workspaceId: scope.workspaceId, projectId: scope.projectId }, query), reply);
+        return reply;
+      });
+      routes.get("/api/web-apps/:webAppId/runtime/files/downloadfolder", async (request, reply) => {
+        const { webAppId } = paramsSchema.parse(request.params);
+        const identity = await resolveRuntimeIdentity(request, webAppId, identities);
+        const scope = await fileScope(webAppId, fileQuerySchema.parse(request.query));
+        const query = { ...request.query, assistantId: scope.assistantId };
+        await workspace.downloadFolder(scopedRequest(request, scope, { workspaceId: scope.workspaceId, projectId: scope.projectId }, query), reply);
+        return reply;
+      });
+      const genuiSandboxParams = z5.object({ webAppId: idSchema, assistantId: idSchema, threadId: idSchema }).strict();
+      const delegateGenuiFile = (method) => async (request, reply) => {
+        const { webAppId } = genuiSandboxParams.parse(request.params);
+        const identity = await resolveRuntimeIdentity(request, webAppId, identities);
+        const scope = await fileScope(webAppId, fileQuerySchema.parse(request.query));
+        const query = { ...request.query, assistantId: scope.assistantId };
+        await method(scopedRequest(request, scope, { workspaceId: scope.workspaceId, projectId: scope.projectId }, query), reply);
+        return reply;
+      };
+      routes.get("/api/web-apps/:webAppId/runtime/assistants/:assistantId/threads/:threadId/sandbox/downloadfile", delegateGenuiFile(workspace.downloadFile.bind(workspace)));
+      routes.get("/api/web-apps/:webAppId/runtime/assistants/:assistantId/threads/:threadId/sandbox/viewfile", delegateGenuiFile(workspace.viewFile.bind(workspace)));
+    }
+    const mirrorThreadParams = z5.object({ webAppId: idSchema, assistantId: idSchema, threadId: idSchema }).strict();
+    const mirrorBody = z5.object({ metadata: z5.object({ label: z5.string().max(300).optional() }).strict().optional(), projectId: idSchema.optional(), modelKey: idSchema.optional() }).strict();
+    const toConsoleThread = (thread, assistantId) => ({
+      id: thread.id,
+      assistantId,
+      metadata: thread.label ? { label: thread.label } : {},
+      createdAt: thread.createdAt,
+      updatedAt: thread.updatedAt
+    });
+    const mirrorAssistantParams = z5.object({ webAppId: idSchema, assistantId: idSchema }).strict();
+    const mirrorPendingParams = z5.object({ webAppId: idSchema, assistantId: idSchema, threadId: idSchema, messageId: idSchema }).strict();
+    const registerMirror = (prefix) => {
+      routes.get(`${prefix}/assistants/:assistantId/threads`, async (request, reply) => handle2(reply, async () => {
+        const { webAppId, assistantId } = mirrorAssistantParams.parse(request.params);
+        const identity = await resolveRuntimeIdentity(request, webAppId, identities);
+        const threads = await deps.service.listThreads(webAppId, identity.userId, projectQueryLenientSchema.parse(request.query));
+        return { data: { records: threads.map((thread) => toConsoleThread(thread, assistantId)) } };
+      }));
+      routes.post(`${prefix}/assistants/:assistantId/threads`, async (request, reply) => handle2(reply, async () => {
+        const { webAppId, assistantId } = mirrorAssistantParams.parse(request.params);
+        const identity = await resolveRuntimeIdentity(request, webAppId, identities);
+        const body = mirrorBody.parse(request.body ?? {});
+        const created = await deps.service.createThread(webAppId, identity.userId, { label: body.metadata?.label, ...body.projectId ? { projectId: body.projectId } : {} });
+        return { statusCode: 201, data: { id: created.id } };
+      }));
+      routes.get(`${prefix}/assistants/:assistantId/threads/:threadId`, async (request, reply) => handle2(reply, async () => {
+        const { webAppId, assistantId, threadId } = mirrorThreadParams.parse(request.params);
+        const identity = await resolveRuntimeIdentity(request, webAppId, identities);
+        const thread = await deps.service.getThread(webAppId, identity.userId, threadId, projectQueryLenientSchema.parse(request.query));
+        return { data: toConsoleThread(thread, assistantId) };
+      }));
+      routes.put(`${prefix}/assistants/:assistantId/threads/:threadId`, async (request, reply) => handle2(reply, async () => {
+        const { webAppId, assistantId, threadId } = mirrorThreadParams.parse(request.params);
+        const identity = await resolveRuntimeIdentity(request, webAppId, identities);
+        const body = mirrorBody.parse(request.body ?? {});
+        const updated = await deps.service.updateThread(webAppId, identity.userId, threadId, { label: body.metadata?.label, ...body.projectId ? { projectId: body.projectId } : {} });
+        return { data: toConsoleThread(updated, assistantId) };
+      }));
+      routes.delete(`${prefix}/assistants/:assistantId/threads/:threadId`, async (request, reply) => handle2(reply, async () => {
+        const { webAppId, threadId } = mirrorThreadParams.parse(request.params);
+        const identity = await resolveRuntimeIdentity(request, webAppId, identities);
+        await deps.service.deleteThread(webAppId, identity.userId, threadId, projectQueryLenientSchema.parse(request.query));
+        return { data: { success: true, message: "Thread deleted" } };
+      }));
+      routes.post(`${prefix}/assistants/:assistantId/threads/:threadId/sandbox/uploadfile`, async (request, reply) => handle2(reply, async () => {
+        const { webAppId, threadId } = mirrorThreadParams.parse(request.params);
+        const identity = await resolveRuntimeIdentity(request, webAppId, identities);
+        if (!request.isMultipart()) throw new ZodError2([]);
+        const part = await request.file({ limits: { files: 1, fileSize: MAX_ATTACHMENT_BYTES } });
+        if (!part || !part.filename || part.filename.length > 255) throw new ZodError2([]);
+        const bytes = await part.toBuffer();
+        if (bytes.length === 0 || part.file.truncated) throw new ZodError2([]);
+        const uploaded = await deps.service.uploadAttachment(webAppId, identity.userId, threadId, projectQueryLenientSchema.parse(request.query), {
+          name: part.filename,
+          mimeType: part.mimetype || "application/octet-stream",
+          bytes
+        });
+        return { statusCode: 201, data: { id: uploaded.ref, path: uploaded.ref, name: uploaded.name, mimeType: uploaded.mimeType, size: uploaded.size } };
+      }));
+      routes.get(`${prefix}/assistants/:assistantId/:threadId/memory`, async (request) => {
+        const { webAppId, threadId } = mirrorThreadParams.parse(request.params);
+        const identity = await resolveRuntimeIdentity(request, webAppId, identities);
+        const messages = await deps.service.getConsoleMessages(webAppId, identity.userId, threadId, projectQueryLenientSchema.parse(request.query));
+        return messages;
+      });
+      routes.get(`${prefix}/assistants/:assistantId/:threadId/state`, async (request) => {
+        const { webAppId, threadId } = mirrorThreadParams.parse(request.params);
+        const identity = await resolveRuntimeIdentity(request, webAppId, identities);
+        return deps.service.getState(webAppId, identity.userId, threadId, projectQueryLenientSchema.parse(request.query));
+      });
+      routes.delete(`${prefix}/assistants/:assistantId/threads/:threadId/pending-messages/:messageId`, async (request, reply) => handle2(reply, async () => {
+        const { webAppId, threadId, messageId } = mirrorPendingParams.parse(request.params);
+        const identity = await resolveRuntimeIdentity(request, webAppId, identities);
+        await deps.service.removePendingMessage(webAppId, identity.userId, threadId, messageId, projectQueryLenientSchema.parse(request.query));
+        return { data: { removed: true } };
+      }));
+      routes.post(`${prefix}/assistants/:assistantId/threads/:threadId/abort`, async (request, reply) => handle2(reply, async () => {
+        const { webAppId, threadId } = mirrorThreadParams.parse(request.params);
+        const identity = await resolveRuntimeIdentity(request, webAppId, identities);
+        await deps.service.abort(webAppId, identity.userId, threadId, projectQueryLenientSchema.parse(request.query));
+        return { data: { aborted: true } };
+      }));
+      const runsBodySchema = z5.object({
+        thread_id: idSchema.optional(),
+        assistant_id: idSchema.optional(),
+        messages: z5.array(z5.object({ content: z5.string().min(1).max(32768) }).passthrough()).min(1).max(20),
+        background: z5.boolean().optional(),
+        streaming: z5.boolean().optional(),
+        projectId: idSchema.optional(),
+        modelKey: idSchema.optional()
+      }).passthrough();
+      routes.post(`${prefix}/runs`, async (request, reply) => {
+        try {
+          const { webAppId } = paramsSchema.parse(request.params);
+          const identity = await resolveRuntimeIdentity(request, webAppId, identities);
+          const body = runsBodySchema.parse(request.body ?? {});
+          if (!body.background || body.streaming) {
+            throw new AgentWebAppRuntimeError("INVALID_REQUEST", 400, "Mirror runs supports only background enqueue (stream via resume_stream)");
+          }
+          const threadId = body.thread_id ?? "";
+          if (!threadId) throw new AgentWebAppRuntimeError("INVALID_REQUEST", 400, "thread_id is required");
+          const content = body.messages.map((message) => message.content).join("\n");
+          const { messageId } = await deps.service.enqueueMessage(webAppId, identity.userId, threadId, content, { projectId: body.projectId, modelKey: body.modelKey });
+          return reply.code(202).send({ success: true, messageId, queued: true });
+        } catch (error) {
+          return normalizeError2(reply, error);
+        }
+      });
+      const resumeStreamSchema2 = z5.object({
+        assistant_id: idSchema.optional(),
+        thread_id: idSchema,
+        message_id: idSchema,
+        known_content: z5.string().optional(),
+        poll_interval: z5.number().optional(),
+        projectId: idSchema.optional(),
+        modelKey: idSchema.optional()
+      }).strict();
+      routes.post(`${prefix}/resume_stream`, async (request, reply) => {
+        try {
+          const { webAppId } = paramsSchema.parse(request.params);
+          const identity = await resolveRuntimeIdentity(request, webAppId, identities);
+          const body = resumeStreamSchema2.parse(request.body ?? {});
+          const result = await deps.service.resumeStream(webAppId, identity.userId, body.thread_id, body.message_id, { projectId: body.projectId, modelKey: body.modelKey });
+          beginSse(reply);
+          await pipeNativeWebAppStream(reply.raw, result.stream);
+        } catch (error) {
+          return normalizeError2(reply, error);
+        }
+      });
+    };
+    registerMirror("/api/web-apps/:webAppId/runtime");
+    registerMirror("/api/web-apps/:webAppId/runtime/api");
   });
 }
-function resolveRuntimeIdentity(request, webAppId, identities) {
-  if (request.headers["x-axiom-web-app-preview"] !== "true") return identities.resolve(request);
+async function resolveRuntimeIdentity(request, webAppId, identities) {
+  if (request.headers["x-axiom-web-app-preview"] !== "true") return identities.resolve(request, webAppId);
   const user = request.user;
   if (!user?.id || !user.tenantId) throw new AgentWebAppRuntimeError("USER_ID_REQUIRED", 401, "Authenticated Console preview is required");
-  return { userId: `console-preview:${user.id}:${webAppId}`, preview: { tenantId: user.tenantId, userId: user.id } };
+  return { userId: `console-preview:${user.id}:${webAppId}`, assurance: "unverified", preview: { tenantId: user.tenantId, userId: user.id } };
 }
 function withPreview(selection, preview) {
   return { ...selection, ...preview ? { preview } : {} };
@@ -12329,13 +12998,22 @@ async function pipeAgentWebAppStream(raw, stream, options = {}) {
     ]
   });
 }
+async function pipeNativeWebAppStream(raw, stream) {
+  await pipeAsyncIterableToSse(raw, stream, {
+    onError: () => [{
+      type: "error",
+      data: { id: "", content: "Stream failed" }
+    }]
+  });
+}
 function beginSse(reply) {
   reply.hijack();
   reply.raw.writeHead(200, {
     "Content-Type": "text/event-stream; charset=utf-8",
     "Cache-Control": "no-cache, no-transform",
     Connection: "keep-alive",
-    "X-Accel-Buffering": "no"
+    "X-Accel-Buffering": "no",
+    "Access-Control-Allow-Origin": "*"
   });
 }
 async function handle2(reply, operation) {
@@ -12357,7 +13035,7 @@ function isMultipartRequestError(error) {
 }
 
 // src/services/agent-web-app/AgentWebAppAttachmentRef.ts
-import { createCipheriv, createDecipheriv, createHash as createHash2, randomBytes as randomBytes2 } from "crypto";
+import { createCipheriv, createDecipheriv, createHash as createHash3, randomBytes as randomBytes2 } from "crypto";
 var TTL_MS = 15 * 6e4;
 function resolveAgentWebAppAttachmentSecret(consoleSecret) {
   return process.env.WEB_APP_ATTACHMENT_SECRET || process.env.AUTH_TOKEN_SECRET || process.env.JWT_SECRET || consoleSecret;
@@ -12366,7 +13044,7 @@ var AgentWebAppAttachmentRefService = class {
   constructor(secret, now = Date.now) {
     this.now = now;
     if (!secret) throw new Error("Attachment signing secret is required");
-    this.key = createHash2("sha256").update(secret, "utf8").digest();
+    this.key = createHash3("sha256").update(secret, "utf8").digest();
   }
   sign(input) {
     const payload = {
@@ -12428,7 +13106,7 @@ function decodeCanonical(value, expectedBytes) {
   return decoded;
 }
 function digestUser(userId) {
-  return createHash2("sha256").update(userId, "utf8").digest("hex");
+  return createHash3("sha256").update(userId, "utf8").digest("hex");
 }
 function isAttachmentPayload(value) {
   if (typeof value !== "object" || value === null || Array.isArray(value)) return false;
@@ -12788,12 +13466,12 @@ function registerCapabilityBundleRoutes(app2, controller) {
 }
 
 // src/services/collaboration/ProjectRoomService.ts
-import { randomUUID as randomUUID11 } from "crypto";
+import { randomUUID as randomUUID12 } from "crypto";
 var ProjectRoomService = class {
   /** Creates a project room service from explicitly injected collaborators. */
   constructor(deps) {
     this.deps = deps;
-    this.idFactory = deps.idFactory ?? randomUUID11;
+    this.idFactory = deps.idFactory ?? randomUUID12;
   }
   /** Authorizes read access and atomically ensures the project's main room. */
   async ensureMainRoom(input) {
@@ -12812,7 +13490,7 @@ var ProjectRoomService = class {
 };
 
 // src/services/collaboration/ProjectMembershipService.ts
-import { randomUUID as randomUUID12 } from "crypto";
+import { randomUUID as randomUUID13 } from "crypto";
 var ProjectMembershipServiceError = class extends Error {
   constructor(code, statusCode, message) {
     super(message);
@@ -12828,11 +13506,13 @@ function isMembershipConflict(error) {
 var ProjectMembershipService = class {
   constructor(deps) {
     this.deps = deps;
-    this.idFactory = deps.idFactory ?? randomUUID12;
+    this.idFactory = deps.idFactory ?? randomUUID13;
     this.mutationMutex = deps.projectMutationMutex ?? projectMutationMutex;
   }
   async list(actor2) {
-    await this.authorize(actor2);
+    await this.deps.accessService.requireRosterAccess(actor2);
+    const membership = await this.deps.membershipStore.findByUser(actor2.tenantId, actor2.projectId, actor2.userId);
+    if (!membership || membership.status !== "active") this.accessDenied();
     return this.deps.membershipStore.list(actor2.tenantId, actor2.projectId);
   }
   async add(actor2, input) {
@@ -12952,7 +13632,7 @@ var ProjectMembershipService = class {
 };
 
 // src/services/collaboration/ProjectRosterService.ts
-import { randomUUID as randomUUID13 } from "crypto";
+import { randomUUID as randomUUID14 } from "crypto";
 var ProjectRosterServiceError = class extends Error {
   /** Creates a stable roster service error. */
   constructor(code, statusCode, message) {
@@ -12969,7 +13649,7 @@ var ProjectRosterService = class {
   /** Creates a roster service from explicitly injected collaborators. */
   constructor(deps) {
     this.deps = deps;
-    this.idFactory = deps.idFactory ?? randomUUID13;
+    this.idFactory = deps.idFactory ?? randomUUID14;
     this.mutationMutex = deps.projectMutationMutex ?? projectMutationMutex;
   }
   /** Lists all bot memberships visible to a project reader. */
@@ -13189,7 +13869,7 @@ var ProjectRosterService = class {
 };
 
 // src/services/collaboration/RoomMessageService.ts
-import { createHash as createHash3, randomUUID as randomUUID14 } from "crypto";
+import { createHash as createHash4, randomUUID as randomUUID15 } from "crypto";
 
 // src/services/collaboration/ProjectBotMembershipSnapshot.ts
 import { snapshotExactRecord as snapshotExactRecord4 } from "@axiom-lattice/protocols";
@@ -13278,7 +13958,7 @@ var RoomMessageService = class {
   constructor(deps, options = {}) {
     this.deps = deps;
     this.idempotentOutcomes = /* @__PURE__ */ new Map();
-    this.idFactory = deps.idFactory ?? randomUUID14;
+    this.idFactory = deps.idFactory ?? randomUUID15;
     const limit = options.idempotentOutcomeLimit ?? 1e3;
     if (!Number.isSafeInteger(limit) || limit < 1) throw new RangeError("idempotentOutcomeLimit must be a positive safe integer");
     this.idempotentOutcomeLimit = limit;
@@ -13459,7 +14139,7 @@ var RoomMessageService = class {
     let idempotencyKey;
     if (value.requestIdempotencyKey !== void 0) {
       if (typeof value.requestIdempotencyKey !== "string" || !/^[\x21-\x7e]{1,200}$/.test(value.requestIdempotencyKey.trim())) throw new RoomMessageServiceError("INVALID_MESSAGE", 400, "Invalid idempotency key");
-      idempotencyKey = `room-human:${actor2.userId}:${createHash3("sha256").update(value.requestIdempotencyKey.trim(), "utf8").digest("hex")}`;
+      idempotencyKey = `room-human:${actor2.userId}:${createHash4("sha256").update(value.requestIdempotencyKey.trim(), "utf8").digest("hex")}`;
     }
     return { text, mentions, botIds, ...value.replyToMessageId === void 0 ? {} : { replyToMessageId: value.replyToMessageId }, ...idempotencyKey === void 0 ? {} : { idempotencyKey } };
   }
@@ -13516,7 +14196,7 @@ function cloneRoomMessage(message) {
   };
 }
 function fingerprintRequest(input) {
-  return createHash3("sha256").update(JSON.stringify({
+  return createHash4("sha256").update(JSON.stringify({
     text: input.text,
     mentions: input.mentions,
     replyToMessageId: input.replyToMessageId ?? null
@@ -13685,45 +14365,12 @@ async function execute(reply, operation) {
 }
 
 // src/routes/cospace.ts
-import { randomUUID as randomUUID15 } from "crypto";
+import { randomUUID as randomUUID16 } from "crypto";
 import { ZodError as ZodError5 } from "zod";
 import {
   generateDirectHumanProjectId,
   generateDirectBotProjectId
 } from "@axiom-lattice/core";
-
-// src/services/collaboration/RoomCoordinatorProvisioner.ts
-var ROOM_COORDINATOR_KEY = "room-coordinator";
-var RoomCoordinatorProvisioner = class {
-  /** Creates a provisioner over the tenant-scoped assistant store operations. */
-  constructor(deps) {
-    this.deps = deps;
-  }
-  /**
-   * Ensures the Room Coordinator assistant exists, reusing an existing record
-   * and reconciling concurrent create races by rereading the winner.
-   *
-   * @param tenantId Tenant to provision the coordinator for.
-   * @returns The persisted Room Coordinator assistant.
-   */
-  async ensure(tenantId) {
-    const existing = await this.deps.getAssistantById(tenantId, ROOM_COORDINATOR_KEY);
-    if (existing) return existing;
-    try {
-      return await this.deps.createAssistant(tenantId, ROOM_COORDINATOR_KEY, {
-        name: "Room Coordinator",
-        description: "Coordinates project room conversations and organizes room work.",
-        graphDefinition: {}
-      });
-    } catch (error) {
-      const winner = await this.deps.getAssistantById(tenantId, ROOM_COORDINATOR_KEY);
-      if (winner) return winner;
-      throw error;
-    }
-  }
-};
-
-// src/routes/cospace.ts
 var CoSpaceAuthError = class extends Error {
   constructor() {
     super(...arguments);
@@ -13739,7 +14386,7 @@ function getActor2(request) {
   return { tenantId: user.tenantId, userId: user.id };
 }
 function registerCoSpaceRoutes(app2, deps) {
-  const idFactory = deps.idFactory ?? (() => randomUUID15());
+  const idFactory = deps.idFactory ?? (() => randomUUID16());
   app2.get(
     "/api/workspaces/:workspaceId/rooms",
     async (request, reply) => {
@@ -13764,6 +14411,7 @@ function registerCoSpaceRoutes(app2, deps) {
         );
         const accessibleProjects = [];
         for (const project of allProjects) {
+          if (project.kind === "public") continue;
           const membership = await deps.membershipStore.findByUser(
             actor2.tenantId,
             project.id,
@@ -13817,6 +14465,34 @@ function registerCoSpaceRoutes(app2, deps) {
           const bTime = b.lastMessage?.createdAt?.getTime() ?? 0;
           return bTime - aTime;
         });
+        const publicRoom = await deps.publicRoom.ensure(actor2.tenantId, params.workspaceId);
+        if (publicRoom) {
+          const publicMessages = await deps.messageStore.list({
+            tenantId: actor2.tenantId,
+            roomId: publicRoom.room.id,
+            limit: 1
+          });
+          const publicMemberships = await deps.membershipStore.list(
+            actor2.tenantId,
+            publicRoom.project.id
+          );
+          const publicParticipantNames = [];
+          for (const m of publicMemberships) {
+            if (m.status !== "active") continue;
+            const user = await deps.userStore.getUserById(m.userId);
+            if (user) {
+              publicParticipantNames.push(user.name);
+            }
+          }
+          rooms.unshift({
+            project: publicRoom.project,
+            room: publicRoom.room,
+            lastMessage: publicMessages[0],
+            participantCount: publicMemberships.filter((m) => m.status === "active").length,
+            participantNames: publicParticipantNames,
+            isPublic: true
+          });
+        }
         return { data: { rooms } };
       });
     }
@@ -14573,7 +15249,7 @@ function exactValues(value, required, optional = []) {
 }
 
 // src/services/collaboration/CoordinatorWakeNotifier.ts
-import { randomUUID as randomUUID16 } from "crypto";
+import { randomUUID as randomUUID17 } from "crypto";
 import { isProjectLifecycleTask as isProjectLifecycleTask2 } from "@axiom-lattice/core";
 import {
   snapshotExactRecord as snapshotExactRecord6
@@ -14590,7 +15266,7 @@ var CoordinatorWakeNotifier = class {
     this.accepted = /* @__PURE__ */ new Set();
     this.maxPending = deps.maxPending ?? 1024;
     if (!Number.isSafeInteger(this.maxPending) || this.maxPending < 1) throw new RangeError("maxPending must be a positive safe integer");
-    this.idFactory = deps.idFactory ?? randomUUID16;
+    this.idFactory = deps.idFactory ?? randomUUID17;
   }
   /** Admits one notification without awaiting any store or dispatch operation. */
   handle(value) {
@@ -15460,7 +16136,7 @@ function validRecoveryRow(row, task, thread) {
 }
 
 // src/services/collaboration/ProjectTaskObserver.ts
-import { createHash as createHash4 } from "crypto";
+import { createHash as createHash5 } from "crypto";
 import {
   isProjectLifecycleTask as isProjectLifecycleTask4,
   parseExternalDependency as parseExternalDependency2
@@ -16000,7 +16676,7 @@ var ProjectTaskObserver = class {
       action: "activity",
       summary: "Project task recovery warning",
       detail: { type: "project_task_recovery_warning", phase, message },
-      eventKey: `project-task-recovery-warning:${task.id}:${phase}:${createHash4("sha256").update(message).digest("hex")}`
+      eventKey: `project-task-recovery-warning:${task.id}:${phase}:${createHash5("sha256").update(message).digest("hex")}`
     });
   }
   async safeWarning(task, phase, error) {
@@ -16067,7 +16743,7 @@ var ProjectTaskObserver = class {
     }
   }
   async persistOverflowWarning(event) {
-    const scopeDigest = createHash4("sha256").update(JSON.stringify([event.tenantId, event.workspaceId, event.projectId])).digest("hex");
+    const scopeDigest = createHash5("sha256").update(JSON.stringify([event.tenantId, event.workspaceId, event.projectId])).digest("hex");
     try {
       await this.deps.workItems.createIfAbsentByEventKey({
         tenantId: event.tenantId,
@@ -16168,7 +16844,7 @@ function combineSignals(left, right) {
 }
 
 // src/services/collaboration/RoomProjectionService.ts
-import { createHash as createHash5 } from "crypto";
+import { createHash as createHash6 } from "crypto";
 import { isProjectLifecycleTask as isProjectLifecycleTask5 } from "@axiom-lattice/core";
 import {
   PROJECT_TASK_LIFECYCLE_ACTIONS,
@@ -16341,7 +17017,7 @@ function safeRepairIdentity(value, scope) {
   return taskId && eventKey && tenantId === scope.tenantId && workspaceId === scope.workspaceId && projectId === scope.projectId ? { taskId, eventKey } : void 0;
 }
 function tupleKey(prefix, values) {
-  const digest = createHash5("sha256").update(JSON.stringify(values)).digest("hex");
+  const digest = createHash6("sha256").update(JSON.stringify(values)).digest("hex");
   return `${prefix}:${digest}`;
 }
 function parseProjectionInput(taskValue, itemValue) {
@@ -16369,7 +17045,7 @@ function snapshotProjectableWorkItem(value) {
   if (!row || !createdAt || typeof row.id !== "string" || !row.id || typeof row.taskId !== "string" || !row.taskId || typeof row.tenantId !== "string" || !row.tenantId || typeof row.workspaceId !== "string" || !row.workspaceId || typeof row.projectId !== "string" || !row.projectId || typeof row.actor !== "string" || !row.actor || typeof row.eventKey !== "string" || !row.eventKey || !PROJECT_TASK_LIFECYCLE_ACTIONS.includes(row.action) || row.threadId !== void 0 && typeof row.threadId !== "string" || row.summary !== void 0 && typeof row.summary !== "string" || row.attempt !== void 0 && (typeof row.attempt !== "number" || !Number.isFinite(row.attempt))) return void 0;
   try {
     const detail = row.detail === void 0 ? void 0 : snapshotJsonValue(row.detail);
-    if (detail !== void 0 && !isRecord4(detail)) return void 0;
+    if (detail !== void 0 && !isRecord3(detail)) return void 0;
     return {
       id: row.id,
       taskId: row.taskId,
@@ -16516,7 +17192,7 @@ function snapshotLifecycleCursor(value) {
   const createdAt = cloneExactDate(row?.createdAt);
   return row && typeof row.id === "string" && row.id.length > 0 && createdAt ? { id: row.id, createdAt } : void 0;
 }
-function isRecord4(value) {
+function isRecord3(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 
@@ -16524,7 +17200,7 @@ function isRecord4(value) {
 import { taskLifecycleNotifier } from "@axiom-lattice/core";
 
 // src/services/collaboration/ProjectRoomEventBroker.ts
-import { randomUUID as randomUUID17 } from "crypto";
+import { randomUUID as randomUUID18 } from "crypto";
 import {
   parseProjectRoomEventId,
   ProjectRoomBrokerCapacityError,
@@ -16553,7 +17229,7 @@ var ProjectRoomEventBroker = class {
     this.subscriberCount = 0;
     this.usageClock = 0;
     this.closed = false;
-    this.epoch = options.epoch ?? randomUUID17();
+    this.epoch = options.epoch ?? randomUUID18();
     if (!UUID_PATTERN.test(this.epoch)) {
       throw new TypeError("Project Room event epoch must be a lowercase canonical UUID");
     }
@@ -16871,7 +17547,7 @@ function snapshotJson(value, ancestors = /* @__PURE__ */ new Set()) {
 }
 
 // src/services/collaboration/ProjectRoomRealtimePublisher.ts
-import { createHash as createHash6 } from "crypto";
+import { createHash as createHash7 } from "crypto";
 import {
   snapshotExactRecord as snapshotExactRecord10,
   snapshotProjectRoomBotMembershipRealtime,
@@ -16952,7 +17628,7 @@ var BrokerProjectRoomRealtimePublisher = class {
     try {
       event = build();
       if (!event) throw new Error("Invalid Project Room realtime projection");
-      const dedupeKey = createHash6("sha256").update(JSON.stringify([type, event.scope.tenantId, event.scope.projectId, event.scope.roomId, event.sourceKey])).digest("hex");
+      const dedupeKey = createHash7("sha256").update(JSON.stringify([type, event.scope.tenantId, event.scope.projectId, event.scope.roomId, event.sourceKey])).digest("hex");
       if (this.sourceKeys.has(dedupeKey)) return;
       this.deps.broker.publish(event.scope, event.draft);
       this.sourceKeys.set(dedupeKey, true);
@@ -17891,12 +18567,24 @@ var registerLatticeRoutes = (app2, channelDeps, options = {}) => {
     });
   }
   if (projectTaskComposition) app2.addHook("onClose", async () => projectTaskComposition.lease.release());
-  const taskThreadService = projectTaskComposition?.lease.runtime.threads ?? new ProjectTaskThreadService({ threads: threadStore, idFactory: randomUUID18 });
+  const taskThreadService = projectTaskComposition?.lease.runtime.threads ?? new ProjectTaskThreadService({ threads: threadStore, idFactory: randomUUID19 });
   const taskLifecycle = projectTaskComposition?.lease.runtime.lifecycle ?? createTaskLifecycleService({ taskStore, workItemStore: taskWorkItemStore });
   const reassignmentAuthorizer = createProjectTaskReassignmentAuthorizer(
     new ProjectTaskOwnerPolicy(projectBotMembershipStore),
     (input) => validateReassignmentThread(threadStore, input)
   );
+  const coordinatorProvisioner = new RoomCoordinatorProvisioner({
+    getAssistantById: assistantStore.getAssistantById.bind(assistantStore),
+    createAssistant: assistantStore.createAssistant.bind(assistantStore)
+  });
+  const publicRoomService = new WorkspacePublicRoomService({
+    getProjectById: projectStore.getProjectById.bind(projectStore),
+    createProject: projectStore.createProject.bind(projectStore),
+    ensureMainRoom: projectRoomStore.ensureMainRoom.bind(projectRoomStore),
+    findBotByAssistant: projectBotMembershipStore.findByAssistant.bind(projectBotMembershipStore),
+    saveBot: projectBotMembershipStore.save.bind(projectBotMembershipStore),
+    ensureCoordinator: (tenantId) => coordinatorProvisioner.ensure(tenantId)
+  });
   registerProjectRoomRoutes(app2, { roomService, membershipService, messageService });
   registerProjectRosterRoutes(app2, { service: rosterService });
   registerCoSpaceRoutes(app2, {
@@ -17935,14 +18623,14 @@ var registerLatticeRoutes = (app2, channelDeps, options = {}) => {
       findByAssistant: projectBotMembershipStore.findByAssistant.bind(projectBotMembershipStore),
       save: projectBotMembershipStore.save.bind(projectBotMembershipStore)
     },
-    coordinatorProvisioner: new RoomCoordinatorProvisioner({
-      getAssistantById: assistantStore.getAssistantById.bind(assistantStore),
-      createAssistant: assistantStore.createAssistant.bind(assistantStore)
-    }),
+    coordinatorProvisioner,
     rosterService: {
       addBot: async (actor2, input) => {
         await rosterService.add(actor2, input);
       }
+    },
+    publicRoom: {
+      ensure: (tenantId, workspaceId) => publicRoomService.ensure(tenantId, workspaceId)
     }
   });
   registerCapabilityBundleRoutes(app2, new CapabilityBundleController({
@@ -17962,6 +18650,46 @@ var registerLatticeRoutes = (app2, channelDeps, options = {}) => {
     })
   });
   registerAgentWebAppRuntimeRoutes(app2, {
+    workspaceController: new WorkspaceController(createProjectCollaborationInitializer({
+      membershipStore: projectMembershipStore,
+      roomStore: projectRoomStore,
+      userTenantLinkStore
+    })),
+    taskController: createTaskController({
+      access: {
+        requireProjectAccess: async (input) => {
+          const apps = await webAppStore.list(input.tenantId);
+          const allowed = apps.some((app3) => app3.status === "active" && app3.scope.allowedProjectIds.includes(input.projectId));
+          if (!allowed) throw new ProjectCollaborationError("PROJECT_ACCESS_DENIED", 403, "Project is not exposed through this web app");
+          const project = await projectStore.getProjectById(input.tenantId, input.projectId);
+          if (!project) throw new ProjectCollaborationError("PROJECT_NOT_FOUND", 404, "Project not found");
+          return {
+            project,
+            membership: {
+              id: `webapp_guest_${input.projectId}_${input.userId}`,
+              tenantId: input.tenantId,
+              projectId: input.projectId,
+              userId: input.userId,
+              role: "member",
+              status: "active",
+              joinedAt: /* @__PURE__ */ new Date(),
+              updatedAt: /* @__PURE__ */ new Date()
+            }
+          };
+        }
+      },
+      tasks: taskStore,
+      workItems: taskWorkItemStore,
+      bots: projectBotMembershipStore,
+      rooms: projectRoomStore,
+      threadService: taskThreadService,
+      reassignmentAuthorizer,
+      lifecycle: taskLifecycle,
+      projectMutationMutex: projectMutationMutex2,
+      executionMutex: projectTaskComposition?.mutex ?? {
+        runExclusive: (_scope, operation) => operation()
+      }
+    }),
     service: new AgentWebAppRuntimeService({
       webAppStore,
       threadStore: getStoreLattice16("default", "thread").store,
@@ -17969,7 +18697,7 @@ var registerLatticeRoutes = (app2, channelDeps, options = {}) => {
       assistantResolver: {
         resolve: async (tenantId, assistantId) => {
           const stored = await assistantStore.getAssistantById(tenantId, assistantId);
-          if (stored) return stored;
+          if (stored) return { id: stored.id, name: stored.name, description: stored.description };
           await agentLatticeManager4.initializeStoredAssistantsForTenant(tenantId);
           const config = agentLatticeManager4.getAgentConfigWithTenant(tenantId, assistantId);
           return config ? { id: assistantId, name: config.name, description: config.description } : null;
@@ -18383,7 +19111,7 @@ function tryCreateProjectTaskRuntime(input) {
 function createRuntime(input, stores, log2) {
   const controller = new AbortController();
   const mutex = new ProjectTaskExecutionMutex();
-  const threads = new ProjectTaskThreadService({ threads: input.threadStore, idFactory: randomUUID18 });
+  const threads = new ProjectTaskThreadService({ threads: input.threadStore, idFactory: randomUUID19 });
   const lifecycle = createTaskLifecycleService({ taskStore: input.taskStore, workItemStore: input.taskWorkItemStore });
   const projection = new RoomProjectionService({
     messages: input.projectRoomMessageStore,
@@ -18392,7 +19120,7 @@ function createRuntime(input, stores, log2) {
     warnings: input.taskWorkItemStore,
     log: log2,
     realtime: input.realtime,
-    idFactory: randomUUID18
+    idFactory: randomUUID19
   });
   const agentFor = (task, thread) => agentInstanceManager6.getAgent({
     tenant_id: task.tenantId,
@@ -19217,7 +19945,7 @@ var collectionRegistration = {
 
 // src/export_registrations/channel-installation.registration.ts
 import { getStoreLattice as getStoreLattice23 } from "@axiom-lattice/core";
-import { randomUUID as randomUUID19 } from "crypto";
+import { randomUUID as randomUUID20 } from "crypto";
 var UUID_PATTERN2 = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
 var PUBLIC_CHANNELS = /* @__PURE__ */ new Set(["lark", "email", "slack", "wechat"]);
 function isPublicChannel(channel) {
@@ -19376,7 +20104,7 @@ var channelInstallationRegistration = {
       }
       id3 = sourceId;
     } else {
-      id3 = randomUUID19();
+      id3 = randomUUID20();
     }
     await store.createInstallation(tenantId, id3, createInput);
     return { newId: id3 };
@@ -20264,7 +20992,7 @@ import {
   snapshotExactArray as snapshotExactArray3,
   snapshotExactRecord as snapshotExactRecord14
 } from "@axiom-lattice/protocols";
-import { randomUUID as randomUUID20 } from "crypto";
+import { randomUUID as randomUUID21 } from "crypto";
 var BindingNotFoundError = class extends Error {
   constructor(message) {
     super(message);
@@ -20579,7 +21307,7 @@ var MessageRouter = class {
         }
         if (!threadId) {
           const threadStore = getStoreLattice26("default", "thread").store;
-          const newThreadId = randomUUID20();
+          const newThreadId = randomUUID21();
           console.log({
             event: "dispatch:thread:create",
             agentId,
@@ -20625,7 +21353,7 @@ var MessageRouter = class {
           workspace_id: binding?.workspaceId || "",
           project_id: binding?.projectId || ""
         });
-        const inputMessageId = randomUUID20();
+        const inputMessageId = randomUUID21();
         const replyTarget = internalRoom ? correlatedRoomReplyTarget(message.replyTarget, inputMessageId) : message.replyTarget;
         const replyAdapter = replyTarget ? this.adapterRegistry.get(replyTarget.adapterChannel) : void 0;
         if (options.trustedMessageOptions && (!this.trustedDispatcher || !replyTarget || !replyAdapter)) {
@@ -21082,7 +21810,7 @@ var start = async (config) => {
     });
     try {
       const { A2AAuthService, parseEnvKeys } = await import("./A2AAuthService-DK5X6VIL.mjs");
-      const { registerA2AStandardRoutes } = await import("./a2a-standard-G3J5ZHQ7.mjs");
+      const { registerA2AStandardRoutes } = await import("./a2a-standard-WC2BSOFV.mjs");
       const a2a = await import("./a2a-7N3WDAOP.mjs");
       const a2aKeyStore = getStoreLattice27("default", "a2aApiKey").store;
       const assistantStore = getStoreLattice27("default", "assistant").store;