@axiom-lattice/gateway 4.1.7 → 4.2.0

package/dist/index.js

@@ -35,8 +35,8 @@ function getContentTypeFromFilename(filename) {
   const ext = filename.includes(".") ? filename.slice(filename.lastIndexOf(".")).toLowerCase() : "";
   return EXT_TO_MIME[ext] ?? "application/octet-stream";
 }
-function getFilenameFromPath(path6) {
-  const segments = path6.replace(/\/+$/, "").split("/");
+function getFilenameFromPath(path7) {
+  const segments = path7.replace(/\/+$/, "").split("/");
   return segments[segments.length - 1] || "download";
 }
 var EXT_TO_MIME;
@@ -647,7 +647,8 @@ function convertToConnection(config) {
     return {
       ...baseConfig,
       transport: config.transport === "streamable_http" ? "http" : config.transport,
-      url: config.url
+      url: config.url,
+      headers: config.headers
     };
   }
 }
@@ -869,17 +870,17 @@ function generateWechatUin() {
   buf.writeUInt32BE(Math.floor(Math.random() * 4294967295), 0);
   return buf.toString("base64url");
 }
-async function apiGet(path6, extraHeaders) {
-  const url = `${getBaseUrl()}${path6}`;
+async function apiGet(path7, extraHeaders) {
+  const url = `${getBaseUrl()}${path7}`;
   const headers = { ...extraHeaders };
   const res = await fetch(url, { headers });
   if (!res.ok) {
-    throw new Error(`iLink GET ${path6} failed: ${res.status} ${res.statusText}`);
+    throw new Error(`iLink GET ${path7} failed: ${res.status} ${res.statusText}`);
   }
   return res.json();
 }
-async function apiPost(path6, body, botToken, signal) {
-  const url = `${getBaseUrl()}${path6}`;
+async function apiPost(path7, body, botToken, signal) {
+  const url = `${getBaseUrl()}${path7}`;
   const headers = {
     "Content-Type": "application/json",
     "AuthorizationType": "ilink_bot_token",
@@ -893,7 +894,7 @@ async function apiPost(path6, body, botToken, signal) {
     signal
   });
   if (!res.ok) {
-    throw new Error(`iLink POST ${path6} failed: ${res.status} ${res.statusText}`);
+    throw new Error(`iLink POST ${path7} failed: ${res.status} ${res.statusText}`);
   }
   return res.json();
 }
@@ -1040,18 +1041,18 @@ function extractText(msg) {
   }
   return null;
 }
-var import_zod14, logger5, wechatConfigSchema, MAX_RECONNECT_DELAY_MS, BASE_RECONNECT_DELAY_MS, HEARTBEAT_INTERVAL_MS, MSG_TYPE_USER, MSG_ITEM_TEXT, activeConnections2, seenClientIds, wechatChannelAdapter;
+var import_zod15, logger5, wechatConfigSchema, MAX_RECONNECT_DELAY_MS, BASE_RECONNECT_DELAY_MS, HEARTBEAT_INTERVAL_MS, MSG_TYPE_USER, MSG_ITEM_TEXT, activeConnections2, seenClientIds, wechatChannelAdapter;
 var init_WechatChannelAdapter = __esm({
   "src/channels/wechat/WechatChannelAdapter.ts"() {
     "use strict";
-    import_zod14 = require("zod");
+    import_zod15 = require("zod");
     init_wechat_client();
     init_context_store();
     init_Logger();
     logger5 = new Logger({ serviceName: "lattice/gateway/wechat" });
-    wechatConfigSchema = import_zod14.z.object({
-      botToken: import_zod14.z.string(),
-      uin: import_zod14.z.string().optional()
+    wechatConfigSchema = import_zod15.z.object({
+      botToken: import_zod15.z.string(),
+      uin: import_zod15.z.string().optional()
     });
     MAX_RECONNECT_DELAY_MS = 3e4;
     BASE_RECONNECT_DELAY_MS = 1e3;
@@ -1641,11 +1642,11 @@ var init_A2ATaskStoreAdapter = __esm({
       async recordSnapshot(task, item) {
         const incomingSequence = snapshotSequence(task.metadata?.snapshotSequence) ?? 0;
         const currentSequence = this.snapshotSequences.get(task.id) ?? 0;
-        const sequence2 = Math.max(incomingSequence, currentSequence) + 1;
-        this.snapshotSequences.set(task.id, sequence2);
+        const sequence = Math.max(incomingSequence, currentSequence) + 1;
+        this.snapshotSequences.set(task.id, sequence);
         const sequencedTask = {
           ...task,
-          metadata: { ...task.metadata ?? {}, snapshotSequence: sequence2 }
+          metadata: { ...task.metadata ?? {}, snapshotSequence: sequence }
         };
         const eventKey = snapshotEventKey(sequencedTask);
         await this.workItemStore.createIfAbsentByEventKey({
@@ -1655,7 +1656,7 @@ var init_A2ATaskStoreAdapter = __esm({
           action: "activity",
           actor: `a2a:${this.scope.assistantId}`,
           summary: "A2A task snapshot",
-          detail: { type: "a2a_task_snapshot", snapshotSequence: sequence2, eventKey, task: sequencedTask },
+          detail: { type: "a2a_task_snapshot", snapshotSequence: sequence, eventKey, task: sequencedTask },
           eventKey,
           ...asString(task.metadata?.threadId) ? { threadId: asString(task.metadata?.threadId) } : {},
           ...item.workspaceId ? { workspaceId: item.workspaceId } : {}
@@ -1762,10 +1763,10 @@ var init_A2ATaskStoreAdapter = __esm({
           });
           for (const activity of activities) {
             if (activity.detail?.type !== "a2a_task_snapshot" || !isA2ATaskSnapshot(activity.detail.task)) continue;
-            const sequence2 = snapshotSequence(activity.detail.snapshotSequence) ?? snapshotSequence(activity.detail.task.metadata?.snapshotSequence);
+            const sequence = snapshotSequence(activity.detail.snapshotSequence) ?? snapshotSequence(activity.detail.task.metadata?.snapshotSequence);
             const candidate = {
               task: activity.detail.task,
-              sequence: sequence2,
+              sequence,
               eventKey: asString(activity.detail.eventKey) ?? activity.eventKey ?? snapshotEventKey(activity.detail.task),
               statusTimestamp: Date.parse(activity.detail.task.status.timestamp ?? ""),
               createdAt: activity.createdAt,
@@ -1895,13 +1896,13 @@ function agentMessage(text) {
     parts: [{ kind: "text", text }]
   };
 }
-var import_uuid11, import_core66, import_protocols27, _AxiomAgentExecutor, AxiomAgentExecutor;
+var import_uuid11, import_core66, import_protocols29, _AxiomAgentExecutor, AxiomAgentExecutor;
 var init_AxiomAgentExecutor = __esm({
   "src/services/a2a/AxiomAgentExecutor.ts"() {
     "use strict";
     import_uuid11 = require("uuid");
     import_core66 = require("@axiom-lattice/core");
-    import_protocols27 = require("@axiom-lattice/protocols");
+    import_protocols29 = require("@axiom-lattice/protocols");
     init_a2aFileRefs();
     init_task_file_refs();
     _AxiomAgentExecutor = class _AxiomAgentExecutor {
@@ -2010,16 +2011,16 @@ ${formatFileRefsSection(inputFiles)}` : text;
               custom_run_config: { taskId: ctx.taskId }
             });
             const stream = agent.chunkStream(messageId, [
-              import_protocols27.MessageChunkTypes.MESSAGE_COMPLETED
+              import_protocols29.MessageChunkTypes.MESSAGE_COMPLETED
             ]);
             for await (const chunk of stream) {
               if (execution.canceled) return;
               const chunkType = chunk.type;
               const chunkText = chunk.data?.content ?? "";
-              if (chunkType === import_protocols27.MessageChunkTypes.INTERRUPT) {
+              if (chunkType === import_protocols29.MessageChunkTypes.INTERRUPT) {
                 break;
               }
-              if (chunkType === import_protocols27.MessageChunkTypes.AI || chunkType === import_protocols27.MessageChunkTypes.TOOL) {
+              if (chunkType === import_protocols29.MessageChunkTypes.AI || chunkType === import_protocols29.MessageChunkTypes.TOOL) {
                 if (chunkText) {
                   bus.publish({
                     kind: "status-update",
@@ -2936,6 +2937,236 @@ var init_a2a = __esm({
   }
 });
 
+// src/services/open/openCredentials.ts
+function resolveSpikeCredential(token) {
+  if (!token) return null;
+  return SPIKE_CREDENTIALS.get(token) ?? null;
+}
+var SPIKE_CREDENTIALS;
+var init_openCredentials = __esm({
+  "src/services/open/openCredentials.ts"() {
+    "use strict";
+    SPIKE_CREDENTIALS = /* @__PURE__ */ new Map([
+      [
+        "spike_all",
+        {
+          credentialId: "spike_all",
+          kind: "api_key",
+          tenantId: "spike-tenant",
+          projectId: "spike-project",
+          grants: [{ domain: "kb" }, { domain: "sandbox" }]
+        }
+      ],
+      [
+        "spike_kb",
+        {
+          credentialId: "spike_kb",
+          kind: "api_key",
+          tenantId: "spike-tenant",
+          projectId: "spike-project",
+          grants: [{ domain: "kb" }]
+        }
+      ]
+    ]);
+  }
+});
+
+// src/services/open/mcpTransportRegistry.ts
+var mcpTransportRegistry_exports = {};
+__export(mcpTransportRegistry_exports, {
+  clearSessions: () => clearSessions,
+  deleteSession: () => deleteSession,
+  getSession: () => getSession,
+  registerSession: () => registerSession
+});
+async function registerSession(sessionId, credential, parts) {
+  sessions.set(sessionId, { ...parts, credential });
+}
+async function getSession(sessionId) {
+  return sessions.get(sessionId) ?? null;
+}
+async function deleteSession(sessionId) {
+  const entry = sessions.get(sessionId);
+  if (!entry) return;
+  sessions.delete(sessionId);
+  await entry.transport.close().catch(() => void 0);
+  await entry.server.close().catch(() => void 0);
+}
+async function clearSessions() {
+  for (const sessionId of [...sessions.keys()]) {
+    await deleteSession(sessionId);
+  }
+}
+var sessions;
+var init_mcpTransportRegistry = __esm({
+  "src/services/open/mcpTransportRegistry.ts"() {
+    "use strict";
+    sessions = /* @__PURE__ */ new Map();
+  }
+});
+
+// src/services/open/mcpCatalog.ts
+function textResult(text) {
+  return [{ type: "text", text }];
+}
+function filterCatalogByGrants(credential) {
+  const domains = new Set(credential.grants.map((g) => g.domain));
+  return SPIKE_TOOL_CATALOG.filter((tool) => domains.has(tool.domain));
+}
+var import_zod16, SPIKE_TOOL_CATALOG;
+var init_mcpCatalog = __esm({
+  "src/services/open/mcpCatalog.ts"() {
+    "use strict";
+    import_zod16 = require("zod");
+    SPIKE_TOOL_CATALOG = [
+      {
+        toolName: "kb_search",
+        domain: "kb",
+        description: "Spike: pretend knowledge-base search.",
+        schema: {
+          query: import_zod16.z.string(),
+          limit: import_zod16.z.number().int().optional()
+        },
+        annotations: { readOnlyHint: true, destructiveHint: false },
+        execute: async (args) => {
+          const { query } = args;
+          return textResult(`kb_search spike result for: ${query}`);
+        }
+      },
+      {
+        toolName: "echo",
+        domain: "sandbox",
+        description: "Spike: echoes the message back.",
+        schema: { message: import_zod16.z.string() },
+        annotations: { readOnlyHint: true, destructiveHint: false },
+        execute: async (args) => {
+          const { message } = args;
+          return textResult(`echo: ${message}`);
+        }
+      }
+    ];
+  }
+});
+
+// src/services/open/openMcpServer.ts
+function registerTools(server, tools) {
+  for (const tool of tools) {
+    server.registerTool(
+      tool.toolName,
+      {
+        description: tool.description,
+        inputSchema: tool.schema,
+        annotations: {
+          readOnlyHint: tool.annotations.readOnlyHint,
+          destructiveHint: tool.annotations.destructiveHint
+        }
+      },
+      async (args) => ({ content: await tool.execute(args) })
+    );
+  }
+}
+async function buildSessionServer(credential) {
+  const tools = filterCatalogByGrants(credential);
+  const server = new import_mcp.McpServer(OPEN_MCP_SERVER_INFO);
+  registerTools(server, tools);
+  const transport = new import_streamableHttp.StreamableHTTPServerTransport({
+    sessionIdGenerator: () => {
+      const sessionId = (0, import_crypto12.randomUUID)();
+      void registerSession(
+        sessionId,
+        { credentialId: credential.credentialId, kind: credential.kind },
+        { server, transport }
+      );
+      return sessionId;
+    },
+    enableJsonResponse: true,
+    onsessionclosed: (closedId) => {
+      void Promise.resolve().then(() => (init_mcpTransportRegistry(), mcpTransportRegistry_exports)).then(
+        ({ deleteSession: deleteSession2 }) => deleteSession2(closedId)
+      );
+    }
+  });
+  await server.connect(transport);
+  return { server, transport, tools };
+}
+var import_mcp, import_streamableHttp, import_crypto12, OPEN_MCP_SERVER_INFO;
+var init_openMcpServer = __esm({
+  "src/services/open/openMcpServer.ts"() {
+    "use strict";
+    import_mcp = require("@modelcontextprotocol/sdk/server/mcp.js");
+    import_streamableHttp = require("@modelcontextprotocol/sdk/server/streamableHttp.js");
+    import_crypto12 = require("crypto");
+    init_mcpTransportRegistry();
+    init_mcpCatalog();
+    OPEN_MCP_SERVER_INFO = {
+      name: "axiom-open",
+      version: "0.1.0"
+    };
+  }
+});
+
+// src/routes/open.ts
+var open_exports = {};
+__export(open_exports, {
+  registerOpenRoutes: () => registerOpenRoutes
+});
+function extractBearer(request) {
+  const header2 = request.headers.authorization;
+  if (!header2?.startsWith("Bearer ")) return void 0;
+  return header2.slice("Bearer ".length).trim() || void 0;
+}
+function readSessionId(request) {
+  const raw = request.headers["mcp-session-id"];
+  const value = Array.isArray(raw) ? raw[0] : raw;
+  return typeof value === "string" && value.length > 0 ? value : void 0;
+}
+function registerOpenRoutes(app2) {
+  app2.post("/open/mcp", async (request, reply) => {
+    const credential = resolveSpikeCredential(extractBearer(request));
+    if (!credential) {
+      return reply.status(401).send({ error: "AUTH_FAILED" });
+    }
+    const body = request.body;
+    const sessionId = readSessionId(request);
+    if (sessionId) {
+      const session = await getSession(sessionId);
+      if (!session || session.credential.credentialId !== credential.credentialId) {
+        return reply.status(404).send({ error: "SESSION_NOT_FOUND" });
+      }
+      reply.hijack();
+      await session.transport.handleRequest(request.raw, reply.raw, body);
+      return;
+    }
+    if (!(0, import_types.isInitializeRequest)(body)) {
+      return reply.status(400).send({ error: "SESSION_REQUIRED" });
+    }
+    const built = await buildSessionServer(credential);
+    reply.hijack();
+    await built.transport.handleRequest(request.raw, reply.raw, body);
+  });
+  app2.delete(
+    "/open/mcp",
+    async (request, reply) => {
+      const sessionId = readSessionId(request);
+      if (!sessionId) {
+        return reply.status(400).send({ error: "SESSION_REQUIRED" });
+      }
+      await deleteSession(sessionId);
+      return reply.status(204).send();
+    }
+  );
+}
+var import_types;
+var init_open = __esm({
+  "src/routes/open.ts"() {
+    "use strict";
+    import_types = require("@modelcontextprotocol/sdk/types.js");
+    init_openCredentials();
+    init_openMcpServer();
+    init_mcpTransportRegistry();
+  }
+});
+
 // src/controllers/resources.ts
 var resources_exports = {};
 __export(resources_exports, {
@@ -3171,8 +3402,8 @@ var init_resources = __esm({
         return cookie.includes(`share_unlock_${token}=1`);
       }
       /** Returns true if the path has a file extension indicating it's a file, not a directory */
-      _isFilePath(path6) {
-        return /\.[a-zA-Z0-9]+$/.test(path6);
+      _isFilePath(path7) {
+        return /\.[a-zA-Z0-9]+$/.test(path7);
       }
       /**
        * Shared file resolution: directory → index.html, volume FS → sandbox, base tag, response.
@@ -3314,7 +3545,7 @@ var import_path = __toESM(require("path"));
 
 // src/routes/index.ts
 var import_node_crypto20 = require("crypto");
-var import_protocols24 = require("@axiom-lattice/protocols");
+var import_protocols26 = require("@axiom-lattice/protocols");
 
 // src/controllers/assistant.ts
 var import_core = require("@axiom-lattice/core");
@@ -7381,9 +7612,9 @@ var ExportImportService = class {
     if (!files || files.size === 0) return void 0;
     const prefix = `files/${entityType}/${entityId}/`;
     const result = /* @__PURE__ */ new Map();
-    for (const [path6, content] of files.entries()) {
-      if (path6.startsWith(prefix)) {
-        result.set(path6.slice(prefix.length), content);
+    for (const [path7, content] of files.entries()) {
+      if (path7.startsWith(prefix)) {
+        result.set(path7.slice(prefix.length), content);
       }
     }
     return result.size > 0 ? result : void 0;
@@ -9488,21 +9719,21 @@ var WorkspaceController = class {
   async listPath(request) {
     const tenantId = this.getTenantId(request);
     const { workspaceId, projectId } = request.params;
-    const path6 = request.query.path || "/";
+    const path7 = request.query.path || "/";
     const assistantId = request.query.assistantId;
-    console.log(`[listPath] tenantId=${tenantId} workspaceId=${workspaceId} projectId=${projectId} path=${path6} assistantId=${assistantId}`);
-    const { backend } = await this.getBackend(tenantId, workspaceId, projectId, assistantId, path6);
-    console.log(`[listPath] backend type=${backend.constructor.name} calling lsInfo(${path6})`);
-    const files = await backend.lsInfo(path6);
+    console.log(`[listPath] tenantId=${tenantId} workspaceId=${workspaceId} projectId=${projectId} path=${path7} assistantId=${assistantId}`);
+    const { backend } = await this.getBackend(tenantId, workspaceId, projectId, assistantId, path7);
+    console.log(`[listPath] backend type=${backend.constructor.name} calling lsInfo(${path7})`);
+    const files = await backend.lsInfo(path7);
     console.log(`[listPath] result count=${files.length}`);
     return { success: true, data: files };
   }
   async readFile(request) {
     const tenantId = this.getTenantId(request);
     const { workspaceId, projectId } = request.params;
-    const { path: path6, offset = 0, limit = 1e3, assistantId } = request.query;
-    const { backend } = await this.getBackend(tenantId, workspaceId, projectId, assistantId, path6);
-    const content = await backend.read(path6, Number(offset), Number(limit));
+    const { path: path7, offset = 0, limit = 1e3, assistantId } = request.query;
+    const { backend } = await this.getBackend(tenantId, workspaceId, projectId, assistantId, path7);
+    const content = await backend.read(path7, Number(offset), Number(limit));
     return { success: true, data: { content, offset, limit } };
   }
   /**
@@ -12355,13 +12586,13 @@ function isStaleConsoleSessionCredential(authHeader) {
   }
 }
 function bypassesConsoleAuth(request) {
-  const path6 = request.url.split("?")[0];
+  const path7 = request.url.split("?")[0];
   const method = request.method;
-  if (method === "GET" && /^\/api\/web-apps\/[^/]+\/runtime\/bootstrap$/.test(path6) || (method === "GET" || method === "POST") && /^\/api\/web-apps\/[^/]+\/runtime\/threads$/.test(path6) || (method === "PATCH" || method === "DELETE") && /^\/api\/web-apps\/[^/]+\/runtime\/threads\/[^/]+$/.test(path6) || method === "GET" && /^\/api\/web-apps\/[^/]+\/runtime\/threads\/[^/]+\/messages$/.test(path6) || method === "POST" && /^\/api\/web-apps\/[^/]+\/runtime\/threads\/[^/]+\/(messages\/stream|abort|attachments)$/.test(path6) || method === "POST" && /^\/api\/web-apps\/[^/]+\/runtime\/threads\/[^/]+\/interrupts\/[^/]+\/resume$/.test(path6)) return true;
-  if (request.method === "GET" && /^\/api\/a2a\/agents\/[^/]+\/\.well-known\/agent-card\.json$/.test(path6)) {
+  if (method === "GET" && /^\/api\/web-apps\/[^/]+\/runtime\/bootstrap$/.test(path7) || (method === "GET" || method === "POST") && /^\/api\/web-apps\/[^/]+\/runtime\/threads$/.test(path7) || (method === "PATCH" || method === "DELETE") && /^\/api\/web-apps\/[^/]+\/runtime\/threads\/[^/]+$/.test(path7) || method === "GET" && /^\/api\/web-apps\/[^/]+\/runtime\/threads\/[^/]+\/messages$/.test(path7) || method === "GET" && /^\/api\/web-apps\/[^/]+\/runtime\/files\/(viewfile|downloadfile)$/.test(path7) || method === "GET" && /^\/api\/web-apps\/[^/]+\/runtime\/api\/assistants\/[^/]+\/threads\/[^/]+\/sandbox\/(viewfile|downloadfile)$/.test(path7) || method === "POST" && /^\/api\/web-apps\/[^/]+\/runtime\/threads\/[^/]+\/(messages\/stream|abort|attachments)$/.test(path7) || method === "POST" && /^\/api\/web-apps\/[^/]+\/runtime\/threads\/[^/]+\/interrupts\/[^/]+\/resume$/.test(path7) || method === "GET" && /^\/api\/web-apps\/[^/]+\/chat$/.test(path7) || method === "GET" && /^\/embed\/[^/]+$/.test(path7) || (method === "POST" || method === "DELETE") && path7 === "/open/mcp") return true;
+  if (request.method === "GET" && /^\/api\/a2a\/agents\/[^/]+\/\.well-known\/agent-card\.json$/.test(path7)) {
     return true;
   }
-  return request.method === "POST" && /^\/api\/a2a\/agents\/[^/]+\/jsonrpc$/.test(path6);
+  return request.method === "POST" && /^\/api\/a2a\/agents\/[^/]+\/jsonrpc$/.test(path7);
 }
 function registerConsoleAuthHook(app2, options) {
   app2.addHook("preHandler", async (request, reply) => {
@@ -12384,8 +12615,8 @@ function registerConsoleAuthHook(app2, options) {
     }
     if (PUBLIC_ROUTES.some((route) => request.url === route)) return;
     if (request.url.startsWith("/s/")) return;
-    const path6 = request.url.split("?")[0];
-    if (request.method === "GET" && /^\/api\/workspaces\/[^/]+\/projects\/[^/]+\/viewfile$/.test(path6) || request.method === "GET" && /^\/api\/workspaces\/[^/]+\/projects\/[^/]+\/downloadfile$/.test(path6) || request.method === "POST" && /^\/api\/workspaces\/[^/]+\/projects\/[^/]+\/uploadfile$/.test(path6) || path6.startsWith("/f/") || path6 === "/f") {
+    const path7 = request.url.split("?")[0];
+    if (request.method === "GET" && /^\/api\/workspaces\/[^/]+\/projects\/[^/]+\/viewfile$/.test(path7) || request.method === "GET" && /^\/api\/workspaces\/[^/]+\/projects\/[^/]+\/downloadfile$/.test(path7) || request.method === "POST" && /^\/api\/workspaces\/[^/]+\/projects\/[^/]+\/uploadfile$/.test(path7) || path7.startsWith("/f/") || path7 === "/f") {
       return;
     }
     await reply.status(401).send({
@@ -13511,8 +13742,8 @@ var log = {
 };
 var connections = /* @__PURE__ */ new Map();
 var pending = /* @__PURE__ */ new Map();
-function getAgentIdFromPath(path6) {
-  const match = path6.match(/^\/api\/a2a\/bridge\/proxy\/([^/]+)/);
+function getAgentIdFromPath(path7) {
+  const match = path7.match(/^\/api\/a2a\/bridge\/proxy\/([^/]+)/);
   return match ? match[1] : null;
 }
 function handleBridgeConnection(socket, _request) {
@@ -16045,7 +16276,6 @@ function registerAgentWebAppRuntimeRoutes(app2, deps) {
       });
       routes.get("/api/web-apps/:webAppId/runtime/files/viewfile", async (request, reply) => {
         const { webAppId } = paramsSchema.parse(request.params);
-        const identity = await resolveRuntimeIdentity(request, webAppId, identities);
         const scope = await fileScope(webAppId, fileQuerySchema.parse(request.query));
         const query = { ...request.query, assistantId: scope.assistantId };
         await workspace.viewFile(scopedRequest(request, scope, { workspaceId: scope.workspaceId, projectId: scope.projectId }, query), reply);
@@ -16053,7 +16283,6 @@ function registerAgentWebAppRuntimeRoutes(app2, deps) {
       });
       routes.get("/api/web-apps/:webAppId/runtime/files/downloadfile", async (request, reply) => {
         const { webAppId } = paramsSchema.parse(request.params);
-        const identity = await resolveRuntimeIdentity(request, webAppId, identities);
         const scope = await fileScope(webAppId, fileQuerySchema.parse(request.query));
         const query = { ...request.query, assistantId: scope.assistantId };
         await workspace.downloadFile(scopedRequest(request, scope, { workspaceId: scope.workspaceId, projectId: scope.projectId }, query), reply);
@@ -16078,6 +16307,15 @@ function registerAgentWebAppRuntimeRoutes(app2, deps) {
       };
       routes.get("/api/web-apps/:webAppId/runtime/assistants/:assistantId/threads/:threadId/sandbox/downloadfile", delegateGenuiFile(workspace.downloadFile.bind(workspace)));
       routes.get("/api/web-apps/:webAppId/runtime/assistants/:assistantId/threads/:threadId/sandbox/viewfile", delegateGenuiFile(workspace.viewFile.bind(workspace)));
+      const delegateAnonGenuiFile = (method) => async (request, reply) => {
+        const { webAppId } = genuiSandboxParams.parse(request.params);
+        const scope = await fileScope(webAppId, fileQuerySchema.parse(request.query));
+        const query = { ...request.query, assistantId: scope.assistantId };
+        await method(scopedRequest(request, scope, { workspaceId: scope.workspaceId, projectId: scope.projectId }, query), reply);
+        return reply;
+      };
+      routes.get("/api/web-apps/:webAppId/runtime/api/assistants/:assistantId/threads/:threadId/sandbox/downloadfile", delegateAnonGenuiFile(workspace.downloadFile.bind(workspace)));
+      routes.get("/api/web-apps/:webAppId/runtime/api/assistants/:assistantId/threads/:threadId/sandbox/viewfile", delegateAnonGenuiFile(workspace.viewFile.bind(workspace)));
     }
     const mirrorThreadParams = import_zod6.z.object({ webAppId: idSchema, assistantId: idSchema, threadId: idSchema }).strict();
     const mirrorBody = import_zod6.z.object({ metadata: import_zod6.z.object({ label: import_zod6.z.string().max(300).optional() }).strict().optional(), projectId: idSchema.optional(), modelKey: idSchema.optional() }).strict();
@@ -16268,6 +16506,105 @@ function isMultipartRequestError(error) {
   return typeof error === "object" && error !== null && "code" in error && typeof error.code === "string" && error.code.startsWith("FST_");
 }
 
+// src/routes/agent-web-app-embed.ts
+var import_node_fs2 = require("fs");
+var import_promises2 = require("fs/promises");
+var import_node_path2 = __toESM(require("path"));
+var import_zod7 = require("zod");
+var idSchema2 = import_zod7.z.string().min(1).max(128).regex(/^[A-Za-z0-9._:@-]+$/);
+var JS_CONTENT_TYPE = "application/javascript; charset=utf-8";
+var CSS_CONTENT_TYPE = "text/css; charset=utf-8";
+var EXACT_ASSETS = {
+  "agent-chat-loader.js": { contentType: JS_CONTENT_TYPE },
+  "embed-page.js": { contentType: JS_CONTENT_TYPE },
+  "embed-page.css": { contentType: CSS_CONTENT_TYPE }
+};
+var HASHED_CHUNK_PATTERN = /^embed-page-[A-Za-z0-9._-]+\.(js|css)$/;
+var CHUNK_CSS_PATTERN = /^embed-page-[A-Za-z0-9._-]+\.css$/;
+function resolveAsset(asset) {
+  if (asset.includes("..")) return null;
+  const exact2 = EXACT_ASSETS[asset];
+  if (exact2 !== void 0) return { contentType: exact2.contentType, immutable: false };
+  const hashed = HASHED_CHUNK_PATTERN.exec(asset);
+  if (hashed) {
+    return { contentType: hashed[1] === "css" ? CSS_CONTENT_TYPE : JS_CONTENT_TYPE, immutable: true };
+  }
+  return null;
+}
+async function listChunkCssFiles(assetsDir) {
+  try {
+    return (await (0, import_promises2.readdir)(assetsDir)).filter((name) => CHUNK_CSS_PATTERN.test(name) && !name.includes("..")).sort();
+  } catch {
+    return [];
+  }
+}
+var BUNDLED_MARKER = "agent-chat-loader.js";
+function resolveBundledEmbedDir() {
+  if (typeof __dirname === "string") {
+    const compiled = import_node_path2.default.resolve(__dirname, "embed");
+    if ((0, import_node_fs2.existsSync)(import_node_path2.default.join(compiled, BUNDLED_MARKER))) return compiled;
+  }
+  let dir = import_node_path2.default.dirname(import_node_path2.default.resolve(process.argv[1] ?? process.cwd()));
+  for (let depth = 0; depth < 8; depth += 1) {
+    const candidate = import_node_path2.default.join(dir, "packages", "gateway", "dist", "embed");
+    if ((0, import_node_fs2.existsSync)(import_node_path2.default.join(candidate, BUNDLED_MARKER))) return candidate;
+    const parent = import_node_path2.default.dirname(dir);
+    if (parent === dir) break;
+    dir = parent;
+  }
+  return null;
+}
+function renderChatShell(chunkCssFiles) {
+  const chunkCssLinks = chunkCssFiles.map(
+    (name) => `    <link rel="stylesheet" href="/embed/${name}" />`
+  );
+  return [
+    "<!doctype html>",
+    '<html lang="en">',
+    "  <head>",
+    '    <meta charset="utf-8" />',
+    '    <meta name="viewport" content="width=device-width, initial-scale=1" />',
+    "    <title>Agent chat</title>",
+    '    <link rel="stylesheet" href="/embed/embed-page.css" />',
+    ...chunkCssLinks,
+    "  </head>",
+    "  <body>",
+    '    <div id="axiom-embed-root">',
+    "      <noscript>This chat requires JavaScript.</noscript>",
+    '      <p class="axiom-embed-loading">Loading chat\u2026</p>',
+    "    </div>",
+    '    <script type="module" src="/embed/embed-page.js"></script>',
+    "  </body>",
+    "</html>"
+  ].join("\n");
+}
+function registerAgentWebAppEmbedRoutes(app2, deps = {}) {
+  const bundledDir = resolveBundledEmbedDir();
+  const assetsDir = deps.assetsDir ?? process.env.AXIOM_EMBED_ASSETS_DIR ?? bundledDir ?? import_node_path2.default.resolve(process.cwd(), "assets/embed");
+  let chunkCssFiles = null;
+  app2.get("/api/web-apps/:webAppId/chat", async (request, reply) => {
+    const parsed = idSchema2.safeParse(request.params.webAppId);
+    if (!parsed.success) {
+      return reply.code(400).send({ success: false, error: { code: "INVALID_REQUEST", message: "Invalid web app id", retryable: false } });
+    }
+    chunkCssFiles ?? (chunkCssFiles = await listChunkCssFiles(assetsDir));
+    return reply.header("content-type", "text/html; charset=utf-8").header("cache-control", "no-store").send(renderChatShell(chunkCssFiles));
+  });
+  app2.get("/embed/:asset", async (request, reply) => {
+    const asset = request.params.asset ?? "";
+    const resolved = resolveAsset(asset);
+    if (resolved === null) {
+      return reply.code(404).send({ success: false, error: { code: "INVALID_REQUEST", message: "Unknown embed asset", retryable: false } });
+    }
+    try {
+      const body = await (0, import_promises2.readFile)(import_node_path2.default.join(assetsDir, asset));
+      return reply.header("content-type", resolved.contentType).header("cache-control", resolved.immutable ? "public, max-age=31536000, immutable" : "public, max-age=300").send(body);
+    } catch {
+      return reply.code(404).send({ success: false, error: { code: "INVALID_REQUEST", message: "Embed asset not built", retryable: false } });
+    }
+  });
+}
+
 // src/services/agent-web-app/AgentWebAppAttachmentRef.ts
 var import_node_crypto9 = require("crypto");
 var TTL_MS = 15 * 6e4;
@@ -16353,10 +16690,10 @@ function isAttachmentPayload(value) {
 init_workspace_file_service();
 
 // src/controllers/capability-bundles.ts
-var import_zod8 = require("zod");
+var import_zod9 = require("zod");
 
 // src/services/capability/CapabilityBundleService.ts
-var import_zod7 = require("zod");
+var import_zod8 = require("zod");
 var import_core43 = require("@axiom-lattice/core");
 var CapabilityBundleServiceError = class extends Error {
   constructor(code, message, statusCode) {
@@ -16366,7 +16703,7 @@ var CapabilityBundleServiceError = class extends Error {
     this.name = "CapabilityBundleServiceError";
   }
 };
-var uuid = import_zod7.z.string().uuid();
+var uuid = import_zod8.z.string().uuid();
 function ownRecord(value) {
   if (value === void 0 || value === null) return {};
   if (typeof value !== "object" || Array.isArray(value)) throw new CapabilityBundleServiceError("INVALID_BUNDLE_CONFIG", "Project config must be an object", 409);
@@ -16569,12 +16906,12 @@ var CapabilityBundleService = class {
 // src/controllers/capability-bundles.ts
 init_Logger();
 var logger3 = new Logger({ serviceName: "lattice/gateway/capability-bundles" });
-var capability = import_zod8.z.unknown();
-var createSchema = import_zod8.z.object({ name: import_zod8.z.string(), description: import_zod8.z.string().optional(), capabilities: import_zod8.z.array(capability) }).strict();
-var updateSchema = createSchema.partial().extend({ expectedUpdatedAt: import_zod8.z.string().optional() });
-var bundleIdSchema = import_zod8.z.string().uuid();
-var bundleParamsSchema = import_zod8.z.object({ bundleId: bundleIdSchema });
-var projectSchema = import_zod8.z.object({ bundleIds: import_zod8.z.array(bundleIdSchema), expectedRevisions: import_zod8.z.record(import_zod8.z.string()).optional() }).strict();
+var capability = import_zod9.z.unknown();
+var createSchema = import_zod9.z.object({ name: import_zod9.z.string(), description: import_zod9.z.string().optional(), capabilities: import_zod9.z.array(capability) }).strict();
+var updateSchema = createSchema.partial().extend({ expectedUpdatedAt: import_zod9.z.string().optional() });
+var bundleIdSchema = import_zod9.z.string().uuid();
+var bundleParamsSchema = import_zod9.z.object({ bundleId: bundleIdSchema });
+var projectSchema = import_zod9.z.object({ bundleIds: import_zod9.z.array(bundleIdSchema), expectedRevisions: import_zod9.z.record(import_zod9.z.string()).optional() }).strict();
 function tenant(request, authRequired2) {
   const authenticated = request.user?.tenantId;
   const header2 = request.headers["x-tenant-id"];
@@ -16842,6 +17179,14 @@ var ProjectMembershipService = class {
       const room = await this.deps.roomStore.getMainRoom(membership.tenantId, membership.projectId);
       if (!room) throw new Error("Project main room not found");
       this.deps.realtime.membershipChanged({ tenantId: membership.tenantId, roomId: room.id, membership, change, sourceKey });
+      this.deps.realtime.membershipAffected({
+        tenantId: membership.tenantId,
+        userId: membership.userId,
+        change,
+        projectId: membership.projectId,
+        roomId: room.id,
+        sourceKey: `membership-affected:${sourceKey}`
+      });
     }).catch((error) => {
       this.reportRealtimeFailure(membership.id);
     });
@@ -17445,46 +17790,47 @@ function matchesNormalizedPayload(message, input) {
 }
 
 // src/routes/project-rooms.ts
-var import_zod10 = require("zod");
+var import_zod11 = require("zod");
+var import_protocols14 = require("@axiom-lattice/protocols");
 
 // src/schemas/project-room.ts
-var import_zod9 = require("zod");
-var id2 = import_zod9.z.string().trim().min(1).max(128);
-var isoDate = import_zod9.z.string().datetime({ offset: true }).transform((value) => new Date(value));
-var expectedUpdatedAt = import_zod9.z.object({ expectedUpdatedAt: isoDate }).strict();
-var projectRoomParamsSchema = import_zod9.z.object({ projectId: id2 }).strict();
-var membershipParamsSchema = import_zod9.z.object({ projectId: id2, membershipId: id2 }).strict();
-var roomMessagesQuerySchema = import_zod9.z.object({
-  beforeCreatedAt: import_zod9.z.string().datetime({ offset: true }).transform((value) => new Date(value)).optional(),
+var import_zod10 = require("zod");
+var id2 = import_zod10.z.string().trim().min(1).max(128);
+var isoDate = import_zod10.z.string().datetime({ offset: true }).transform((value) => new Date(value));
+var expectedUpdatedAt = import_zod10.z.object({ expectedUpdatedAt: isoDate }).strict();
+var projectRoomParamsSchema = import_zod10.z.object({ projectId: id2 }).strict();
+var membershipParamsSchema = import_zod10.z.object({ projectId: id2, membershipId: id2 }).strict();
+var roomMessagesQuerySchema = import_zod10.z.object({
+  beforeCreatedAt: import_zod10.z.string().datetime({ offset: true }).transform((value) => new Date(value)).optional(),
   beforeId: id2.optional(),
-  limit: import_zod9.z.coerce.number().int().min(1).max(100).optional()
+  limit: import_zod10.z.coerce.number().int().min(1).max(100).optional()
 }).strict().refine((value) => value.beforeCreatedAt === void 0 === (value.beforeId === void 0), { message: "Both cursor fields are required" });
-var createRoomMessageSchema = import_zod9.z.object({
-  text: import_zod9.z.string(),
-  mentions: import_zod9.z.array(import_zod9.z.union([
-    import_zod9.z.object({ type: import_zod9.z.literal("team") }).strict(),
-    import_zod9.z.object({ type: import_zod9.z.literal("bot"), membershipId: id2 }).strict()
+var createRoomMessageSchema = import_zod10.z.object({
+  text: import_zod10.z.string(),
+  mentions: import_zod10.z.array(import_zod10.z.union([
+    import_zod10.z.object({ type: import_zod10.z.literal("team") }).strict(),
+    import_zod10.z.object({ type: import_zod10.z.literal("bot"), membershipId: id2 }).strict()
   ])).optional(),
   replyToMessageId: id2.optional()
 }).strict();
-var addProjectMemberSchema = import_zod9.z.object({ userId: id2, role: import_zod9.z.enum(["owner", "admin", "member", "viewer"]) }).strict();
-var updateProjectMemberSchema = import_zod9.z.object({ role: import_zod9.z.enum(["owner", "admin", "member", "viewer"]), expectedUpdatedAt: isoDate }).strict();
+var addProjectMemberSchema = import_zod10.z.object({ userId: id2, role: import_zod10.z.enum(["owner", "admin", "member", "viewer"]) }).strict();
+var updateProjectMemberSchema = import_zod10.z.object({ role: import_zod10.z.enum(["owner", "admin", "member", "viewer"]), expectedUpdatedAt: isoDate }).strict();
 var mutationExpectedUpdatedAtSchema = expectedUpdatedAt;
-var roomMessageRetryParamsSchema = import_zod9.z.object({ projectId: id2, messageId: id2 }).strict();
-var emptyObjectSchema = import_zod9.z.object({}).strict();
-var idempotencyKeySchema = import_zod9.z.string().refine((value) => value.trim().length >= 1 && value.trim().length <= 200 && /^[\x20-\x7e]+$/.test(value.trim()), "Invalid idempotency key").transform((value) => value.trim());
-var addProjectBotSchema = import_zod9.z.object({
+var roomMessageRetryParamsSchema = import_zod10.z.object({ projectId: id2, messageId: id2 }).strict();
+var emptyObjectSchema = import_zod10.z.object({}).strict();
+var idempotencyKeySchema = import_zod10.z.string().refine((value) => value.trim().length >= 1 && value.trim().length <= 200 && /^[\x20-\x7e]+$/.test(value.trim()), "Invalid idempotency key").transform((value) => value.trim());
+var addProjectBotSchema = import_zod10.z.object({
   assistantId: id2,
-  role: import_zod9.z.enum(["coordinator", "specialist"]),
-  title: import_zod9.z.string(),
-  responsibility: import_zod9.z.string().optional(),
-  mentionName: import_zod9.z.string()
+  role: import_zod10.z.enum(["coordinator", "specialist"]),
+  title: import_zod10.z.string(),
+  responsibility: import_zod10.z.string().optional(),
+  mentionName: import_zod10.z.string()
 }).strict();
-var updateProjectBotSchema = import_zod9.z.object({
-  role: import_zod9.z.enum(["coordinator", "specialist"]).optional(),
-  title: import_zod9.z.string().optional(),
-  responsibility: import_zod9.z.string().optional(),
-  mentionName: import_zod9.z.string().optional(),
+var updateProjectBotSchema = import_zod10.z.object({
+  role: import_zod10.z.enum(["coordinator", "specialist"]).optional(),
+  title: import_zod10.z.string().optional(),
+  responsibility: import_zod10.z.string().optional(),
+  mentionName: import_zod10.z.string().optional(),
   expectedUpdatedAt: isoDate
 }).strict().refine((value) => value.role !== void 0 || value.title !== void 0 || value.responsibility !== void 0 || value.mentionName !== void 0, { message: "At least one mutable field is required" });
 
@@ -17502,7 +17848,8 @@ function registerProjectRoomRoutes(app2, deps) {
     const params = projectRoomParamsSchema.parse(request.params);
     const query = roomMessagesQuerySchema.parse(request.query);
     const before = query.beforeCreatedAt === void 0 && query.beforeId === void 0 ? void 0 : { createdAt: query.beforeCreatedAt, id: query.beforeId };
-    return { data: await deps.messageService.list(actor(request, params.projectId), { ...before ? { before } : {}, ...query.limit === void 0 ? {} : { limit: query.limit } }) };
+    const messages = await deps.messageService.list(actor(request, params.projectId), { ...before ? { before } : {}, ...query.limit === void 0 ? {} : { limit: query.limit } });
+    return { data: messages.map(toProjectRoomMessage) };
   }));
   app2.post("/api/projects/:projectId/room/messages", async (request, reply) => run(reply, async () => {
     const params = projectRoomParamsSchema.parse(request.params);
@@ -17513,7 +17860,7 @@ function registerProjectRoomRoutes(app2, deps) {
     const idempotencyKey = rawIdempotencyKey === void 0 ? void 0 : idempotencyKeySchema.parse(rawIdempotencyKey);
     const result = await deps.messageService.createAndDispatch(requestActor, { ...input, ...idempotencyKey === void 0 ? {} : { requestIdempotencyKey: idempotencyKey } });
     const allSucceeded = result.dispatch.length > 0 && result.dispatch.every((entry) => entry.success);
-    return { statusCode: allSucceeded ? result.replayed ? 200 : 201 : 202, data: result };
+    return { statusCode: allSucceeded ? result.replayed ? 200 : 201 : 202, data: { message: toProjectRoomMessage(result.message), dispatch: result.dispatch, replayed: result.replayed } };
   }));
   app2.post("/api/projects/:projectId/room/messages/:messageId/retry", async (request, reply) => run(reply, async () => {
     const params = roomMessageRetryParamsSchema.parse(request.params);
@@ -17522,6 +17869,12 @@ function registerProjectRoomRoutes(app2, deps) {
     const dispatch = await deps.messageService.retry(actor(request, params.projectId), params.messageId);
     return { statusCode: dispatch.length > 0 && dispatch.every((entry) => entry.success) ? 200 : 202, data: dispatch };
   }));
+  app2.post("/api/projects/:projectId/room/read-state", async (request, reply) => run(reply, async () => {
+    const params = projectRoomParamsSchema.parse(request.params);
+    emptyObjectSchema.parse(request.body ?? {});
+    await deps.readStateService.mark(actor(request, params.projectId));
+    return { data: { marked: true } };
+  }));
   app2.get("/api/projects/:projectId/members", async (request, reply) => run(reply, async () => ({ data: await deps.membershipService.list(actor(request, projectRoomParamsSchema.parse(request.params).projectId)) })));
   app2.post("/api/projects/:projectId/members", async (request, reply) => run(reply, async () => {
     const p = projectRoomParamsSchema.parse(request.params);
@@ -17544,19 +17897,24 @@ function actor(request, projectId) {
   projectRoomParamsSchema.parse({ projectId });
   return { tenantId: user.tenantId, userId: user.id, projectId };
 }
+function toProjectRoomMessage(message) {
+  const publicMessage = (0, import_protocols14.toProjectRoomPublicMessage)(message);
+  if (publicMessage === void 0) throw new Error("Room message could not be mapped to its public DTO");
+  return publicMessage;
+}
 async function run(reply, operation) {
   try {
     const result = await operation();
     return reply.code(result.statusCode ?? 200).send({ success: true, data: result.data });
   } catch (error) {
-    if (error instanceof import_zod10.ZodError) return reply.code(400).send({ success: false, error: { code: "INVALID_REQUEST", message: "Invalid request", retryable: false } });
+    if (error instanceof import_zod11.ZodError) return reply.code(400).send({ success: false, error: { code: "INVALID_REQUEST", message: "Invalid request", retryable: false } });
     if (error instanceof ProjectRoomAuthError || error instanceof ProjectCollaborationError || error instanceof ProjectMembershipServiceError || error instanceof ProjectRosterServiceError || error instanceof RoomMessageServiceError) return reply.code(error.statusCode).send({ success: false, error: { code: error.code, message: error.message, retryable: error instanceof RoomMessageServiceError && error.retryable } });
     return reply.code(500).send({ success: false, error: { code: "INTERNAL_ERROR", message: "Internal server error", retryable: false } });
   }
 }
 
 // src/routes/project-roster.ts
-var import_zod11 = require("zod");
+var import_zod12 = require("zod");
 var ProjectRosterAuthError = class extends Error {
   constructor() {
     super(...arguments);
@@ -17596,7 +17954,7 @@ async function execute(reply, operation) {
     const result = await operation();
     return reply.code(result.statusCode ?? 200).send({ success: true, data: result.data });
   } catch (error) {
-    if (error instanceof import_zod11.ZodError) return reply.code(400).send({ success: false, error: { code: "INVALID_REQUEST", message: "Invalid request", retryable: false } });
+    if (error instanceof import_zod12.ZodError) return reply.code(400).send({ success: false, error: { code: "INVALID_REQUEST", message: "Invalid request", retryable: false } });
     if (error instanceof ProjectRosterAuthError || error instanceof ProjectCollaborationError || error instanceof ProjectRosterServiceError) return reply.code(error.statusCode).send({ success: false, error: { code: error.code, message: error.message, retryable: false } });
     return reply.code(500).send({ success: false, error: { code: "INTERNAL_ERROR", message: "Internal server error", retryable: false } });
   }
@@ -17604,8 +17962,9 @@ async function execute(reply, operation) {
 
 // src/routes/cospace.ts
 var import_node_crypto14 = require("crypto");
-var import_zod12 = require("zod");
+var import_zod13 = require("zod");
 var import_core44 = require("@axiom-lattice/core");
+var import_protocols15 = require("@axiom-lattice/protocols");
 var CoSpaceAuthError = class extends Error {
   constructor() {
     super(...arguments);
@@ -17620,6 +17979,18 @@ function getActor2(request) {
   }
   return { tenantId: user.tenantId, userId: user.id };
 }
+async function computeUnread(deps, tenantId, userId, roomId, lastMessage) {
+  if (!lastMessage) return 0;
+  const readState = await deps.readStateStore.get(tenantId, roomId, userId);
+  const horizon = readState?.lastReadAt;
+  if (horizon && lastMessage.createdAt.getTime() <= horizon.getTime()) return 0;
+  return deps.messageStore.countAfter({
+    tenantId,
+    roomId,
+    after: horizon ?? /* @__PURE__ */ new Date(0),
+    excludeAuthorUserId: userId
+  });
+}
 function registerCoSpaceRoutes(app2, deps) {
   const idFactory = deps.idFactory ?? (() => (0, import_node_crypto14.randomUUID)());
   app2.get(
@@ -17670,6 +18041,7 @@ function registerCoSpaceRoutes(app2, deps) {
               limit: 1
             });
             const lastMessage = messages[0];
+            const publicLastMessage = lastMessage === void 0 ? void 0 : (0, import_protocols15.toProjectRoomPublicMessage)(lastMessage);
             const memberships = await deps.membershipStore.list(
               actor2.tenantId,
               project.id
@@ -17685,19 +18057,26 @@ function registerCoSpaceRoutes(app2, deps) {
             rooms.push({
               project,
               room,
-              lastMessage,
+              lastMessage: publicLastMessage,
               participantCount: memberships.filter(
                 (m) => m.status === "active"
               ).length,
-              participantNames
+              participantNames,
+              unreadCount: await computeUnread(
+                deps,
+                actor2.tenantId,
+                actor2.userId,
+                room.id,
+                lastMessage
+              )
             });
           } catch (e) {
             console.error("[CoSpace] Failed to process room for project:", project.id, e);
           }
         }
         rooms.sort((a, b) => {
-          const aTime = a.lastMessage?.createdAt?.getTime() ?? 0;
-          const bTime = b.lastMessage?.createdAt?.getTime() ?? 0;
+          const aTime = a.lastMessage ? Date.parse(a.lastMessage.createdAt) : 0;
+          const bTime = b.lastMessage ? Date.parse(b.lastMessage.createdAt) : 0;
           return bTime - aTime;
         });
         const publicRoom = await deps.publicRoom.ensure(actor2.tenantId, params.workspaceId);
@@ -17707,6 +18086,7 @@ function registerCoSpaceRoutes(app2, deps) {
             roomId: publicRoom.room.id,
             limit: 1
           });
+          const publicLastMessage = publicMessages[0];
           const publicMemberships = await deps.membershipStore.list(
             actor2.tenantId,
             publicRoom.project.id
@@ -17722,10 +18102,17 @@ function registerCoSpaceRoutes(app2, deps) {
           rooms.unshift({
             project: publicRoom.project,
             room: publicRoom.room,
-            lastMessage: publicMessages[0],
+            lastMessage: publicLastMessage === void 0 ? void 0 : (0, import_protocols15.toProjectRoomPublicMessage)(publicLastMessage),
             participantCount: publicMemberships.filter((m) => m.status === "active").length,
             participantNames: publicParticipantNames,
-            isPublic: true
+            isPublic: true,
+            unreadCount: await computeUnread(
+              deps,
+              actor2.tenantId,
+              actor2.userId,
+              publicRoom.room.id,
+              publicLastMessage
+            )
           });
         }
         return { data: { rooms } };
@@ -18090,7 +18477,7 @@ function registerCoSpaceRoutes(app2, deps) {
         data: result.data
       });
     } catch (error) {
-      if (error instanceof import_zod12.ZodError) {
+      if (error instanceof import_zod13.ZodError) {
         return reply.code(400).send({
           success: false,
           error: {
@@ -18361,7 +18748,7 @@ var RoomTargetResolver = class {
 };
 
 // src/services/collaboration/RoomDispatchService.ts
-var import_protocols14 = require("@axiom-lattice/protocols");
+var import_protocols16 = require("@axiom-lattice/protocols");
 
 // src/router/InternalRoomDispatch.ts
 var INTERNAL_ROOM_DISPATCH = Symbol("internal-room-dispatch");
@@ -18459,7 +18846,7 @@ function snapshotDispatchSource(value) {
   };
 }
 function snapshotMentions(value) {
-  const rows = (0, import_protocols14.snapshotExactArray)(value);
+  const rows = (0, import_protocols16.snapshotExactArray)(value);
   if (!rows) return void 0;
   const result = [];
   for (const row of rows) {
@@ -18477,7 +18864,7 @@ function snapshotMentions(value) {
 function exactValues(value, required, optional = []) {
   try {
     if (typeof value !== "object" || value === null || Array.isArray(value)) return void 0;
-    return (0, import_protocols14.snapshotExactRecord)(value, required, optional);
+    return (0, import_protocols16.snapshotExactRecord)(value, required, optional);
   } catch {
     return void 0;
   }
@@ -18486,7 +18873,7 @@ function exactValues(value, required, optional = []) {
 // src/services/collaboration/CoordinatorWakeNotifier.ts
 var import_node_crypto15 = require("crypto");
 var import_core45 = require("@axiom-lattice/core");
-var import_protocols15 = require("@axiom-lattice/protocols");
+var import_protocols17 = require("@axiom-lattice/protocols");
 var SYNTHETIC_WAKE_AUTHOR = "coordinator-wake";
 var CoordinatorWakeNotifier = class {
   /** Creates a bounded Project Task lifecycle observer that wakes the Room Coordinator. */
@@ -18640,7 +19027,7 @@ var CoordinatorWakeNotifier = class {
     }
   }
   parse(value) {
-    const row = (0, import_protocols15.snapshotExactRecord)(value, ["tenantId", "workspaceId", "projectId", "taskId", "status", "action", "eventKey", "updatedAt"], ["threadId"]);
+    const row = (0, import_protocols17.snapshotExactRecord)(value, ["tenantId", "workspaceId", "projectId", "taskId", "status", "action", "eventKey", "updatedAt"], ["threadId"]);
     const actions = ["in_progress", "interrupted", "failed", "completed", "cancelled", "reassigned"];
     const statuses = ["pending", "in_progress", "review", "failed", "interrupted", "completed", "cancelled"];
     if (!row || !actions.includes(String(row.action)) || !statuses.includes(String(row.status)) || !["tenantId", "workspaceId", "projectId", "taskId", "eventKey", "updatedAt"].every((key) => typeof row[key] === "string" && row[key].length > 0) || !Number.isFinite(Date.parse(row.updatedAt)) || row.threadId !== void 0 && typeof row.threadId !== "string") return void 0;
@@ -18678,9 +19065,9 @@ function safeId(value) {
 }
 
 // src/services/collaboration/ProjectTaskExecutionMutex.ts
-var import_protocols16 = require("@axiom-lattice/protocols");
+var import_protocols18 = require("@axiom-lattice/protocols");
 function machineKey(scope) {
-  const snapshot = (0, import_protocols16.snapshotExactRecord)(scope, ["tenantId", "assistantId", "projectId"]);
+  const snapshot = (0, import_protocols18.snapshotExactRecord)(scope, ["tenantId", "assistantId", "projectId"]);
   if (!snapshot) throw new Error("Invalid Project task machine scope");
   const values = [snapshot.tenantId, snapshot.assistantId, snapshot.projectId];
   for (const value of values) {
@@ -18757,7 +19144,7 @@ var ProjectTaskExecutionMutex = class {
 
 // src/services/collaboration/ProjectTaskExecutionService.ts
 var import_core46 = require("@axiom-lattice/core");
-var import_protocols17 = require("@axiom-lattice/protocols");
+var import_protocols19 = require("@axiom-lattice/protocols");
 var SYSTEM_ACTOR = "system";
 var QUEUE_CLASSIFICATION_ATTEMPTS = 3;
 var ProjectTaskExecutionError = class extends Error {
@@ -19312,7 +19699,7 @@ function buildTrustedTaskContext(task, thread, inputMessageId) {
   };
 }
 function taskThreadMetadata(thread) {
-  const row = (0, import_protocols17.snapshotExactRecord)(thread.metadata, [
+  const row = (0, import_protocols19.snapshotExactRecord)(thread.metadata, [
     "source",
     "kind",
     "workspaceId",
@@ -19353,7 +19740,7 @@ function classifyRecoveryRows(task, thread, pending2, processingBefore, processi
 }
 function validRecoveryRow(row, task, thread) {
   try {
-    const trusted = (0, import_protocols17.parseTrustedRunContext)(row.trusted_run_context).projectTask;
+    const trusted = (0, import_protocols19.parseTrustedRunContext)(row.trusted_run_context).projectTask;
     const metadata = taskThreadMetadata(thread);
     return row.execution_mode === "followup" && !!trusted && trusted.tenantId === task.tenantId && trusted.workspaceId === task.workspaceId && trusted.projectId === task.projectId && trusted.assistantId === task.ownerId && trusted.taskId === task.id && trusted.threadId === thread.id && trusted.inputMessageId === row.id && !!metadata && trusted.roomId === metadata.roomId && trusted.membershipId === metadata.membershipId && metadata.assistantId === task.ownerId && metadata.taskId === task.id;
   } catch {
@@ -20069,7 +20456,7 @@ function combineSignals(left, right) {
 // src/services/collaboration/RoomProjectionService.ts
 var import_node_crypto17 = require("crypto");
 var import_core48 = require("@axiom-lattice/core");
-var import_protocols18 = require("@axiom-lattice/protocols");
+var import_protocols20 = require("@axiom-lattice/protocols");
 var RoomProjectionService = class {
   /** @param deps Message, lifecycle-event, Task, warning, logging, and ID dependencies. */
   constructor(deps) {
@@ -20129,7 +20516,7 @@ var RoomProjectionService = class {
         tenantId: input.tenantId,
         workspaceId: input.workspaceId,
         projectId: input.projectId,
-        actions: [...import_protocols18.PROJECT_TASK_LIFECYCLE_ACTIONS],
+        actions: [...import_protocols20.PROJECT_TASK_LIFECYCLE_ACTIONS],
         before,
         limit: input.pageSize
       });
@@ -20251,7 +20638,7 @@ function parseProjectionInput(taskValue, itemValue) {
   }
 }
 function snapshotProjectableWorkItem(value) {
-  const row = (0, import_protocols18.snapshotExactRecord)(value, ["id", "taskId", "tenantId", "action", "actor", "createdAt"], [
+  const row = (0, import_protocols20.snapshotExactRecord)(value, ["id", "taskId", "tenantId", "action", "actor", "createdAt"], [
     "workspaceId",
     "projectId",
     "threadId",
@@ -20261,7 +20648,7 @@ function snapshotProjectableWorkItem(value) {
     "eventKey"
   ]);
   const createdAt = cloneExactDate(row?.createdAt);
-  if (!row || !createdAt || typeof row.id !== "string" || !row.id || typeof row.taskId !== "string" || !row.taskId || typeof row.tenantId !== "string" || !row.tenantId || typeof row.workspaceId !== "string" || !row.workspaceId || typeof row.projectId !== "string" || !row.projectId || typeof row.actor !== "string" || !row.actor || typeof row.eventKey !== "string" || !row.eventKey || !import_protocols18.PROJECT_TASK_LIFECYCLE_ACTIONS.includes(row.action) || row.threadId !== void 0 && typeof row.threadId !== "string" || row.summary !== void 0 && typeof row.summary !== "string" || row.attempt !== void 0 && (typeof row.attempt !== "number" || !Number.isFinite(row.attempt))) return void 0;
+  if (!row || !createdAt || typeof row.id !== "string" || !row.id || typeof row.taskId !== "string" || !row.taskId || typeof row.tenantId !== "string" || !row.tenantId || typeof row.workspaceId !== "string" || !row.workspaceId || typeof row.projectId !== "string" || !row.projectId || typeof row.actor !== "string" || !row.actor || typeof row.eventKey !== "string" || !row.eventKey || !import_protocols20.PROJECT_TASK_LIFECYCLE_ACTIONS.includes(row.action) || row.threadId !== void 0 && typeof row.threadId !== "string" || row.summary !== void 0 && typeof row.summary !== "string" || row.attempt !== void 0 && (typeof row.attempt !== "number" || !Number.isFinite(row.attempt))) return void 0;
   try {
     const detail = row.detail === void 0 ? void 0 : snapshotJsonValue(row.detail);
     if (detail !== void 0 && !isRecord3(detail)) return void 0;
@@ -20288,12 +20675,12 @@ function parseIso(value) {
   return typeof value === "string" && value.length > 0 && Number.isFinite(Date.parse(value));
 }
 function parseInterruption(value) {
-  const common = (0, import_protocols18.snapshotExactRecord)(value, ["type", "summary", "requestedAt"]);
+  const common = (0, import_protocols20.snapshotExactRecord)(value, ["type", "summary", "requestedAt"]);
   if (common && (common.type === "missing_input" || common.type === "user_decision") && typeof common.summary === "string" && common.summary.length > 0 && parseIso(common.requestedAt)) {
     return { type: common.type, summary: common.summary, requestedAt: common.requestedAt };
   }
-  const external = (0, import_protocols18.snapshotExactRecord)(value, ["type", "summary", "requestedAt", "dependencyTaskIds"]);
-  const ids = (0, import_protocols18.snapshotExactArray)(external?.dependencyTaskIds);
+  const external = (0, import_protocols20.snapshotExactRecord)(value, ["type", "summary", "requestedAt", "dependencyTaskIds"]);
+  const ids = (0, import_protocols20.snapshotExactArray)(external?.dependencyTaskIds);
   if (external?.type === "external_dependency" && typeof external.summary === "string" && external.summary.length > 0 && parseIso(external.requestedAt) && ids && ids.length > 0 && ids.every((id3) => typeof id3 === "string" && id3.length > 0) && new Set(ids).size === ids.length) {
     return {
       type: "external_dependency",
@@ -20302,58 +20689,58 @@ function parseInterruption(value) {
       dependencyTaskIds: [...ids]
     };
   }
-  const review = (0, import_protocols18.snapshotExactRecord)(value, ["type", "evidenceId"]);
+  const review = (0, import_protocols20.snapshotExactRecord)(value, ["type", "evidenceId"]);
   return review?.type === "review_required" && typeof review.evidenceId === "string" && review.evidenceId.length > 0 ? { type: "review_required", evidenceId: review.evidenceId } : void 0;
 }
 function parseBeliefImpact(value) {
-  const rows = (0, import_protocols18.snapshotExactArray)(value);
+  const rows = (0, import_protocols20.snapshotExactArray)(value);
   if (!rows) return void 0;
   const impacts = [];
   for (const row of rows) {
-    const entry = (0, import_protocols18.snapshotExactRecord)(row, ["key", "after", "basis"]);
+    const entry = (0, import_protocols20.snapshotExactRecord)(row, ["key", "after", "basis"]);
     if (!entry || typeof entry.key !== "string" || !entry.key || typeof entry.after !== "number" || !Number.isFinite(entry.after) || typeof entry.basis !== "string" || !entry.basis) return void 0;
     impacts.push({ key: entry.key, after: entry.after, basis: entry.basis });
   }
   return impacts;
 }
 function parseCompletion(item) {
-  const row = (0, import_protocols18.snapshotExactRecord)(item.detail, ["evidenceId", "eventKey", "result", "beliefImpact"]);
+  const row = (0, import_protocols20.snapshotExactRecord)(item.detail, ["evidenceId", "eventKey", "result", "beliefImpact"]);
   const beliefImpact = parseBeliefImpact(row?.beliefImpact);
   if (!row || typeof row.evidenceId !== "string" || !row.evidenceId || typeof row.eventKey !== "string" || !row.eventKey || item.eventKey !== `${row.eventKey}:completed` || typeof row.result !== "string" || !beliefImpact) return void 0;
   return { evidenceId: row.evidenceId, eventKey: row.eventKey, result: row.result, beliefImpact };
 }
 function parseProjection(item) {
   if (item.action === "in_progress") {
-    const started = (0, import_protocols18.snapshotExactRecord)(item.detail, ["previousStatus"]);
+    const started = (0, import_protocols20.snapshotExactRecord)(item.detail, ["previousStatus"]);
     if (started?.previousStatus === "pending") return { kind: "started", text: "Task started" };
-    const resumed = (0, import_protocols18.snapshotExactRecord)(item.detail, ["type", "previousInterruption"]);
+    const resumed = (0, import_protocols20.snapshotExactRecord)(item.detail, ["type", "previousInterruption"]);
     if (resumed?.type === "interruption_resume" && parseInterruption(resumed.previousInterruption)) {
       return { kind: "resumed", text: "Task resumed" };
     }
-    const rejected = (0, import_protocols18.snapshotExactRecord)(item.detail, ["type", "evidenceId", "note"]);
+    const rejected = (0, import_protocols20.snapshotExactRecord)(item.detail, ["type", "evidenceId", "note"]);
     if (rejected?.type === "review_rejected" && typeof rejected.evidenceId === "string" && rejected.evidenceId && typeof rejected.note === "string" && rejected.note) {
       return { kind: "resumed", text: "Task resumed after review rejection" };
     }
-    const stale = (0, import_protocols18.snapshotExactRecord)(item.detail, ["type", "evidenceId"]);
+    const stale = (0, import_protocols20.snapshotExactRecord)(item.detail, ["type", "evidenceId"]);
     return stale?.type === "review_stale" && typeof stale.evidenceId === "string" && stale.evidenceId ? { kind: "resumed", text: "Task resumed after stale review" } : void 0;
   }
   if (item.action === "interrupted") {
     return parseInterruption(item.detail) ? { kind: "interrupted", text: "Task interrupted" } : void 0;
   }
   if (item.action === "failed") {
-    const row = (0, import_protocols18.snapshotExactRecord)(item.detail, ["failureReason"]);
+    const row = (0, import_protocols20.snapshotExactRecord)(item.detail, ["failureReason"]);
     return typeof row?.failureReason === "string" && row.failureReason ? { kind: "failed", text: "Task failed" } : void 0;
   }
   if (item.action === "completed") {
     return parseCompletion(item) ? { kind: "completed", text: "Task completed" } : void 0;
   }
   if (item.action === "cancelled") {
-    const empty = (0, import_protocols18.snapshotExactRecord)(item.detail, []);
-    const summarized = (0, import_protocols18.snapshotExactRecord)(item.detail, ["summary"]);
+    const empty = (0, import_protocols20.snapshotExactRecord)(item.detail, []);
+    const summarized = (0, import_protocols20.snapshotExactRecord)(item.detail, ["summary"]);
     return empty || typeof summarized?.summary === "string" && summarized.summary ? { kind: "cancelled", text: "Task cancelled" } : void 0;
   }
   if (item.action === "reassigned") {
-    const row = (0, import_protocols18.snapshotExactRecord)(
+    const row = (0, import_protocols20.snapshotExactRecord)(
       item.detail,
       ["previousOwnerId", "previousThreadId", "ownerId", "membershipId", "threadId"]
     );
@@ -20362,7 +20749,7 @@ function parseProjection(item) {
   return void 0;
 }
 function assertCanonicalProjection(value, expected) {
-  const row = (0, import_protocols18.snapshotExactRecord)(value, [
+  const row = (0, import_protocols20.snapshotExactRecord)(value, [
     "id",
     "tenantId",
     "workspaceId",
@@ -20376,9 +20763,9 @@ function assertCanonicalProjection(value, expected) {
     "idempotencyKey",
     "createdAt"
   ]);
-  const author = (0, import_protocols18.snapshotExactRecord)(row?.author, ["type"]);
-  const content = (0, import_protocols18.snapshotExactRecord)(row?.content, ["type", "text"]);
-  const mentions = (0, import_protocols18.snapshotExactArray)(row?.mentions);
+  const author = (0, import_protocols20.snapshotExactRecord)(row?.author, ["type"]);
+  const content = (0, import_protocols20.snapshotExactRecord)(row?.content, ["type", "text"]);
+  const mentions = (0, import_protocols20.snapshotExactArray)(row?.mentions);
   const createdAt = cloneExactDate(row?.createdAt);
   if (!row || !createdAt || author?.type !== "system" || content?.type !== "text" || content.text !== expected.content.text || !mentions || mentions.length !== 0 || typeof row.id !== "string" || !row.id || row.tenantId !== expected.tenantId || row.workspaceId !== expected.workspaceId || row.projectId !== expected.projectId || row.roomId !== expected.roomId || row.source !== "task" || row.sourceId !== expected.sourceId || row.idempotencyKey !== expected.idempotencyKey) {
     throw new Error("Invalid canonical task projection");
@@ -20399,7 +20786,7 @@ function assertCanonicalProjection(value, expected) {
   };
 }
 function snapshotLifecycleCursor(value) {
-  const row = (0, import_protocols18.snapshotExactRecord)(value, ["id", "taskId", "tenantId", "action", "actor", "createdAt"], [
+  const row = (0, import_protocols20.snapshotExactRecord)(value, ["id", "taskId", "tenantId", "action", "actor", "createdAt"], [
     "workspaceId",
     "projectId",
     "threadId",
@@ -20420,7 +20807,7 @@ var import_core50 = require("@axiom-lattice/core");
 
 // src/services/collaboration/ProjectRoomEventBroker.ts
 var import_node_crypto18 = require("crypto");
-var import_protocols19 = require("@axiom-lattice/protocols");
+var import_protocols21 = require("@axiom-lattice/protocols");
 var DEFAULT_MAX_EVENTS_PER_ROOM = 1e3;
 var DEFAULT_MAX_EVENT_AGE_MS = 10 * 60 * 1e3;
 var DEFAULT_MAX_ROOMS = 1e3;
@@ -20483,7 +20870,7 @@ var ProjectRoomEventBroker = class {
     const canonicalScope = snapshotScope(scope);
     const key = scopeKey2(canonicalScope);
     const now = this.currentTime();
-    if (this.sequence >= Number.MAX_SAFE_INTEGER) throw new import_protocols19.ProjectRoomBrokerCapacityError();
+    if (this.sequence >= Number.MAX_SAFE_INTEGER) throw new import_protocols21.ProjectRoomBrokerCapacityError();
     const nextSequence = this.sequence + 1;
     const event = snapshotJson({
       ...snapshotDraft(draft),
@@ -20666,11 +21053,11 @@ var ProjectRoomEventBroker = class {
   }
   resolveCursor(key, afterEventId, plan) {
     if (afterEventId === void 0) return void 0;
-    const cursor = (0, import_protocols19.parseProjectRoomEventId)(afterEventId);
-    if (!cursor) throw new import_protocols19.ProjectRoomCursorError("CURSOR_EXPIRED");
-    if (cursor.epoch !== this.epoch) throw new import_protocols19.ProjectRoomCursorError("SERVER_RESTART");
+    const cursor = (0, import_protocols21.parseProjectRoomEventId)(afterEventId);
+    if (!cursor) throw new import_protocols21.ProjectRoomCursorError("CURSOR_EXPIRED");
+    if (cursor.epoch !== this.epoch) throw new import_protocols21.ProjectRoomCursorError("SERVER_RESTART");
     if (plan.sequences.has(cursor.sequence) || this.sequenceScopes.get(cursor.sequence) !== key) {
-      throw new import_protocols19.ProjectRoomCursorError("CURSOR_EXPIRED");
+      throw new import_protocols21.ProjectRoomCursorError("CURSOR_EXPIRED");
     }
     return cursor.sequence;
   }
@@ -20763,7 +21150,7 @@ function snapshotJson(value, ancestors = /* @__PURE__ */ new Set()) {
 
 // src/services/collaboration/ProjectRoomRealtimePublisher.ts
 var import_node_crypto19 = require("crypto");
-var import_protocols20 = require("@axiom-lattice/protocols");
+var import_protocols22 = require("@axiom-lattice/protocols");
 var BrokerProjectRoomRealtimePublisher = class {
   /** Creates a publisher around a broker and structured warning logger. */
   constructor(deps) {
@@ -20777,7 +21164,7 @@ var BrokerProjectRoomRealtimePublisher = class {
   /** Publishes a canonical message after projecting it to its public shape. */
   messageCreated(message) {
     this.publish("message.created", () => {
-      const projection = (0, import_protocols20.snapshotProjectRoomMessageRealtime)(message);
+      const projection = (0, import_protocols22.snapshotProjectRoomMessageRealtime)(message);
       if (!projection) return void 0;
       return {
         sourceKey: `message:${projection.publicMessage.id}`,
@@ -20792,7 +21179,7 @@ var BrokerProjectRoomRealtimePublisher = class {
     this.publish("roster.changed", () => {
       const membership = snapshotInput(input, "roster");
       if (membership.membership.tenantId !== membership.tenantId || membership.membership.roomId !== membership.roomId || !safeId2(membership.membership.projectId)) throw new TypeError("Invalid roster scope");
-      const projection = (0, import_protocols20.snapshotProjectRoomBotMembershipRealtime)(membership.membership);
+      const projection = (0, import_protocols22.snapshotProjectRoomBotMembershipRealtime)(membership.membership);
       if (!projection) return void 0;
       return {
         sourceKey: membership.sourceKey,
@@ -20807,7 +21194,7 @@ var BrokerProjectRoomRealtimePublisher = class {
     this.publish("membership.changed", () => {
       const membership = snapshotInput(input, "membership");
       if (membership.membership.tenantId !== membership.tenantId || !safeId2(membership.membership.projectId)) throw new TypeError("Invalid membership scope");
-      const projection = (0, import_protocols20.snapshotProjectRoomMembershipRealtime)(membership.membership);
+      const projection = (0, import_protocols22.snapshotProjectRoomMembershipRealtime)(membership.membership);
       if (!projection) return void 0;
       return {
         sourceKey: membership.sourceKey,
@@ -20833,6 +21220,46 @@ var BrokerProjectRoomRealtimePublisher = class {
       };
     });
   }
+  /** Publishes a membership notice onto the affected user's channel scope. */
+  membershipAffected(input) {
+    this.publish("membership.affected", () => {
+      const value = (0, import_protocols22.snapshotExactRecord)(input, ["tenantId", "userId", "change", "projectId", "roomId", "sourceKey"]);
+      if (!value || !safeId2(value.tenantId) || !safeId2(value.userId) || !safeId2(value.projectId) || !safeId2(value.roomId) || !safeSourceKey(value.sourceKey) || !["added", "removed", "role_changed"].includes(value.change)) {
+        throw new TypeError("Invalid membership input");
+      }
+      const scope = (0, import_protocols22.projectRoomUserEventScope)(value.tenantId, value.userId);
+      return {
+        sourceKey: value.sourceKey,
+        id: value.sourceKey,
+        scope,
+        draft: {
+          type: "membership.affected",
+          occurredAt: (/* @__PURE__ */ new Date()).toISOString(),
+          data: { change: value.change, projectId: value.projectId, roomId: value.roomId }
+        }
+      };
+    });
+  }
+  /** Publishes a read-marker update onto the acting user's channel scope. */
+  readChanged(input) {
+    this.publish("read.changed", () => {
+      const value = (0, import_protocols22.snapshotExactRecord)(input, ["tenantId", "userId", "projectId", "roomId", "lastReadAt", "sourceKey"]);
+      if (!value || !safeId2(value.tenantId) || !safeId2(value.userId) || !safeId2(value.projectId) || !safeId2(value.roomId) || !safeSourceKey(value.sourceKey) || typeof value.lastReadAt !== "string" || !Number.isFinite(Date.parse(value.lastReadAt))) {
+        throw new TypeError("Invalid read input");
+      }
+      const scope = (0, import_protocols22.projectRoomUserEventScope)(value.tenantId, value.userId);
+      return {
+        sourceKey: value.sourceKey,
+        id: value.sourceKey,
+        scope,
+        draft: {
+          type: "read.changed",
+          occurredAt: (/* @__PURE__ */ new Date()).toISOString(),
+          data: { projectId: value.projectId, roomId: value.roomId, lastReadAt: new Date(Date.parse(value.lastReadAt)).toISOString() }
+        }
+      };
+    });
+  }
   publish(type, build) {
     let event;
     try {
@@ -20861,13 +21288,13 @@ var BrokerProjectRoomRealtimePublisher = class {
 };
 function snapshotInput(input, kind) {
   const keys2 = kind === "message" ? ["tenantId", "roomId", "message", "sourceKey"] : kind === "roster" ? ["tenantId", "roomId", "membership", "sourceKey"] : ["tenantId", "roomId", "membership", "sourceKey"];
-  const value = (0, import_protocols20.snapshotExactRecord)(input, [...keys2, "change"]);
+  const value = (0, import_protocols22.snapshotExactRecord)(input, [...keys2, "change"]);
   const validChange = kind === "roster" ? ["added", "updated", "paused", "resumed", "removed"].includes(value?.change) : ["added", "role_changed", "removed"].includes(value?.change);
   if (!value || !safeId2(value.tenantId) || !safeId2(value.roomId) || !safeSourceKey(value.sourceKey) || !validChange) throw new TypeError(`Invalid ${kind} input`);
   return value;
 }
 function snapshotTaskInput(input) {
-  const value = (0, import_protocols20.snapshotExactRecord)(input, ["tenantId", "roomId", "projectId", "taskId", "status", "ownerMembershipId", "updatedAt", "sourceKey"]);
+  const value = (0, import_protocols22.snapshotExactRecord)(input, ["tenantId", "roomId", "projectId", "taskId", "status", "ownerMembershipId", "updatedAt", "sourceKey"]);
   if (!value || !safeId2(value.tenantId) || !safeId2(value.roomId) || !safeSourceKey(value.sourceKey)) throw new TypeError("Invalid task input");
   if (!safeId2(value.projectId) || !safeId2(value.taskId) || !safeId2(value.ownerMembershipId) || !["pending", "in_progress", "review", "failed", "interrupted", "completed", "cancelled"].includes(value.status)) throw new TypeError("Invalid task input");
   if (typeof value.updatedAt !== "string") throw new TypeError("Invalid task timestamp");
@@ -20891,61 +21318,269 @@ function safeErrorCode(error) {
   return error instanceof Error && error.name === "Error" ? "Error" : "UnknownError";
 }
 
-// src/services/collaboration/ProjectRoomRealtimeService.ts
-var import_protocols21 = require("@axiom-lattice/protocols");
-
-// src/services/collaboration/ProjectRoomSseWriter.ts
-var DEFAULT_MAX_FRAMES = 256;
-var DEFAULT_MAX_BYTES = 1024 * 1024;
-var DEFAULT_DRAIN_TIMEOUT_MS = 1e4;
-function serializeBusiness(event) {
-  return `id: ${event.id}
-event: ${event.type}
-data: ${JSON.stringify(event)}
-
-`;
-}
-function serializeControl(event) {
-  return `event: ${event.type}
-data: ${JSON.stringify(event.data)}
-
-`;
-}
-var ProjectRoomSseWriter = class {
-  /** Creates a writer over a raw HTTP response/socket. */
-  constructor(raw, options = {}) {
-    this.raw = raw;
-    this.frames = [];
-    this.queuedBytes = 0;
-    this.blockedBytes = 0;
-    this.writing = false;
+// src/services/collaboration/ProjectRoomTaskEventSubscriber.ts
+var import_core49 = require("@axiom-lattice/core");
+var import_protocols23 = require("@axiom-lattice/protocols");
+var ProjectRoomTaskEventSubscriber = class {
+  /** Creates a bounded Project task lifecycle observer. */
+  constructor(deps) {
+    this.deps = deps;
+    this.queues = /* @__PURE__ */ new Map();
+    this.pendingCount = 0;
+    this.accepting = true;
     this.closed = false;
-    this.terminal = false;
-    this.slowConsumerAttempted = false;
-    this.closeListener = () => this.close();
-    this.errorListener = () => this.close();
-    this.drainListener = () => {
-      if (this.closed || !this.writing) return;
-      this.clearDrainTimer();
-      this.blockedBytes = 0;
-      this.writing = false;
-      this.flush();
-    };
-    this.maxFrames = positive(options.maxFrames ?? DEFAULT_MAX_FRAMES, "maxFrames");
-    this.maxBytes = positive(options.maxBytes ?? DEFAULT_MAX_BYTES, "maxBytes");
-    this.drainTimeoutMs = positive(options.drainTimeoutMs ?? DEFAULT_DRAIN_TIMEOUT_MS, "drainTimeoutMs");
-    this.onClose = options.onClose;
-    raw.on("close", this.closeListener).on("error", this.errorListener).on("drain", this.drainListener);
+    this.accepted = /* @__PURE__ */ new Set();
+    this.maxPending = deps.maxPending ?? 1024;
+    if (!Number.isSafeInteger(this.maxPending) || this.maxPending < 1) throw new RangeError("maxPending must be a positive safe integer");
   }
-  /** Enqueues one public business event. */
-  enqueueBusiness(event) {
-    this.enqueue(serializeBusiness(event));
+  /** Admits one notification without awaiting any store operation. */
+  handle(value) {
+    const event = this.parse(value);
+    if (!event) {
+      this.warn("Project task realtime notification rejected", { code: "INVALID_TASK_REALTIME_EVENT" });
+      return Promise.resolve();
+    }
+    if (!this.accepting || this.closed) return Promise.resolve();
+    const scopeKey3 = JSON.stringify([event.tenantId, event.workspaceId, event.projectId, event.taskId]);
+    const eventKey = event.eventKey;
+    let queue = this.queues.get(scopeKey3);
+    if (!queue) {
+      if (this.pendingCount >= this.maxPending) return this.overflow(event.taskId);
+      queue = { events: [], keys: /* @__PURE__ */ new Set(), tail: Promise.resolve() };
+      this.queues.set(scopeKey3, queue);
+    }
+    if (queue.keys.has(eventKey)) return queue.tail;
+    if (this.pendingCount >= this.maxPending) return this.overflow(event.taskId);
+    queue.keys.add(eventKey);
+    queue.events.push(event);
+    this.pendingCount += 1;
+    const previousTail = queue.tail;
+    queue.tail = previousTail.then(() => this.processQueue(scopeKey3, queue)).catch((error) => {
+      this.warn("project-room:task-realtime-failed", { code: "TASK_REALTIME_NOTIFICATION_FAILED", error: error instanceof Error ? error.name : "UnknownError" });
+    });
+    const accepted = queue.tail;
+    this.accepted.add(accepted);
+    void accepted.finally(() => this.accepted.delete(accepted));
+    return accepted;
   }
-  /** Enqueues one connection control event. */
-  enqueueControl(event) {
-    this.enqueue(serializeControl(event));
+  /** Closes admission without interrupting accepted work. */
+  closeAdmission() {
+    this.accepting = false;
   }
-  /** Writes a heartbeat comment when the socket is not currently blocked. */
+  /** Drains accepted work, closing permanently if the bound expires. */
+  async drain(timeoutMs = 5e3) {
+    const work = Promise.allSettled([...this.accepted]).then(() => void 0);
+    let timer;
+    const timeout = new Promise((resolve4) => {
+      timer = setTimeout(() => resolve4("timeout"), timeoutMs);
+      timer.unref?.();
+    });
+    const outcome = await Promise.race([work.then(() => "drained"), timeout]);
+    if (timer) clearTimeout(timer);
+    this.closed = true;
+    if (outcome === "timeout") this.queues.clear();
+  }
+  /** Closes admission and drains accepted work. */
+  async dispose() {
+    this.closeAdmission();
+    await this.drain();
+    this.closed = true;
+  }
+  async processQueue(scopeKey3, queue) {
+    while (queue.events.length > 0) {
+      const event = queue.events.shift();
+      try {
+        if (!this.closed) await this.publish(event);
+      } finally {
+        queue.keys.delete(event.eventKey);
+        this.pendingCount -= 1;
+      }
+    }
+    if (queue.events.length === 0 && this.queues.get(scopeKey3) === queue) this.queues.delete(scopeKey3);
+  }
+  async publish(event) {
+    try {
+      const taskValue = await this.deps.tasks.getById(event.tenantId, event.taskId);
+      const task = taskValue === null ? void 0 : snapshotTaskItem(taskValue);
+      if (this.closed) return;
+      if (!task || !(0, import_core49.isProjectLifecycleTask)(task) || task.tenantId !== event.tenantId || task.workspaceId !== event.workspaceId || task.projectId !== event.projectId || task.status !== event.status || task.updatedAt.toISOString() !== event.updatedAt || event.threadId !== void 0 && task.context?.thread_id !== event.threadId) {
+        this.warn("project-room:task-event-stale", { taskId: safeId3(event.taskId), eventKey: safeId3(event.eventKey) });
+        return;
+      }
+      const roomValue = await this.deps.rooms.getMainRoom(event.tenantId, event.projectId);
+      const room = snapshotProjectRoom(roomValue);
+      if (this.closed) return;
+      if (!room || room.tenantId !== event.tenantId || room.workspaceId !== event.workspaceId || room.projectId !== event.projectId) return;
+      const membershipValue = await this.deps.memberships.findByAssistant(event.tenantId, event.projectId, task.ownerId);
+      const membership = snapshotProjectBotMembership(membershipValue);
+      if (this.closed) return;
+      if (!membership || membership.tenantId !== event.tenantId || membership.workspaceId !== event.workspaceId || membership.projectId !== event.projectId || membership.roomId !== room.id || membership.assistantId !== task.ownerId) return;
+      this.deps.realtime.taskChanged({
+        tenantId: event.tenantId,
+        roomId: room.id,
+        projectId: event.projectId,
+        taskId: task.id,
+        status: task.status,
+        ownerMembershipId: membership.id,
+        updatedAt: task.updatedAt.toISOString(),
+        sourceKey: `task:${task.id}:${event.eventKey}`
+      });
+    } catch (error) {
+      this.warn("project-room:task-realtime-failed", { code: "TASK_REALTIME_NOTIFICATION_FAILED", taskId: safeId3(event.taskId), error: error instanceof Error ? error.name : "UnknownError" });
+    }
+  }
+  parse(value) {
+    const row = (0, import_protocols23.snapshotExactRecord)(value, ["tenantId", "workspaceId", "projectId", "taskId", "status", "action", "eventKey", "updatedAt"], ["threadId"]);
+    const actions = ["in_progress", "interrupted", "failed", "completed", "cancelled", "reassigned"];
+    const statuses = ["pending", "in_progress", "review", "failed", "interrupted", "completed", "cancelled"];
+    if (!row || !actions.includes(String(row.action)) || !statuses.includes(String(row.status)) || !["tenantId", "workspaceId", "projectId", "taskId", "eventKey", "updatedAt"].every((key) => typeof row[key] === "string" && row[key].length > 0) || !Number.isFinite(Date.parse(row.updatedAt)) || row.threadId !== void 0 && typeof row.threadId !== "string") return void 0;
+    return row;
+  }
+  warn(message, context) {
+    try {
+      this.deps.log.warn(message, context);
+    } catch {
+    }
+  }
+  overflow(taskId) {
+    this.warn("project-room:task-realtime-overflow", { code: "TASK_REALTIME_QUEUE_FULL", taskId });
+    return Promise.resolve();
+  }
+};
+function safeId3(value) {
+  return typeof value === "string" && value.length > 0 ? value : void 0;
+}
+
+// src/services/collaboration/ProjectRoomRealtimeRuntime.ts
+var ProjectRoomRealtimeRuntime = class {
+  constructor(deps) {
+    this.deps = deps;
+    this.accepted = /* @__PURE__ */ new Set();
+    this.broker = deps.broker;
+    this.publisher = deps.publisher;
+    this.shutdownTimeoutMs = deps.shutdownTimeoutMs ?? 5e3;
+    this.unsubscribe = deps.subscribe(((event) => {
+      let work;
+      try {
+        work = Promise.resolve(deps.subscriber.handle(event));
+      } catch (error) {
+        work = Promise.reject(error);
+      }
+      const accepted = work.catch((error) => {
+        deps.log.warn("project-room:task-subscriber-failed", { error: error instanceof Error ? error.name : "UnknownError" });
+      });
+      this.accepted.add(accepted);
+      void accepted.finally(() => this.accepted.delete(accepted));
+    }));
+  }
+  /** Stops admission, drains accepted work, and closes transport resources exactly once. */
+  close() {
+    this.closing ?? (this.closing = this.dispose());
+    return this.closing;
+  }
+  async dispose() {
+    this.unsubscribe();
+    this.deps.subscriber.closeAdmission();
+    const accepted = [...this.accepted];
+    const drained = await boundedAllSettled(accepted, this.shutdownTimeoutMs);
+    if (!drained) this.deps.log.warn("project-room:runtime-drain-timeout", {
+      timeoutMs: this.shutdownTimeoutMs,
+      pending: accepted.length
+    });
+    await this.deps.subscriber.drain(drained ? this.shutdownTimeoutMs : 0);
+    this.broker.close();
+  }
+};
+function createProjectRoomRealtimeRuntime(deps) {
+  const broker = new ProjectRoomEventBroker({ log: deps.log });
+  const publisher = new BrokerProjectRoomRealtimePublisher({ broker, log: deps.log });
+  const subscriber = new ProjectRoomTaskEventSubscriber({
+    tasks: deps.tasks,
+    rooms: deps.rooms,
+    memberships: deps.memberships,
+    realtime: publisher,
+    log: deps.log
+  });
+  return new ProjectRoomRealtimeRuntime({
+    broker,
+    publisher,
+    subscriber,
+    subscribe: (listener) => import_core50.taskLifecycleNotifier.subscribe(listener),
+    log: deps.log,
+    shutdownTimeoutMs: deps.shutdownTimeoutMs
+  });
+}
+async function boundedAllSettled(promises, timeoutMs) {
+  if (promises.length === 0) return true;
+  let timer;
+  const timeout = new Promise((resolve4) => {
+    timer = setTimeout(() => resolve4(false), timeoutMs);
+    timer.unref?.();
+  });
+  const result = await Promise.race([Promise.allSettled(promises).then(() => true), timeout]);
+  if (timer) clearTimeout(timer);
+  return result;
+}
+
+// src/services/collaboration/WorkspaceRoomEventsService.ts
+var import_protocols24 = require("@axiom-lattice/protocols");
+
+// src/services/collaboration/ProjectRoomSseWriter.ts
+var DEFAULT_MAX_FRAMES = 256;
+var DEFAULT_MAX_BYTES = 1024 * 1024;
+var DEFAULT_DRAIN_TIMEOUT_MS = 1e4;
+function serializeBusiness(event) {
+  return `id: ${event.id}
+event: ${event.type}
+data: ${JSON.stringify(event)}
+
+`;
+}
+function serializeControl(event) {
+  return `event: ${event.type}
+data: ${JSON.stringify(event.data)}
+
+`;
+}
+var ProjectRoomSseWriter = class {
+  /** Creates a writer over a raw HTTP response/socket. */
+  constructor(raw, options = {}) {
+    this.raw = raw;
+    this.frames = [];
+    this.queuedBytes = 0;
+    this.blockedBytes = 0;
+    this.writing = false;
+    this.closed = false;
+    this.terminal = false;
+    this.slowConsumerAttempted = false;
+    this.closeListener = () => this.close();
+    this.errorListener = () => this.close();
+    this.drainListener = () => {
+      if (this.closed || !this.writing) return;
+      this.clearDrainTimer();
+      this.blockedBytes = 0;
+      this.writing = false;
+      this.flush();
+    };
+    this.maxFrames = positive(options.maxFrames ?? DEFAULT_MAX_FRAMES, "maxFrames");
+    this.maxBytes = positive(options.maxBytes ?? DEFAULT_MAX_BYTES, "maxBytes");
+    this.drainTimeoutMs = positive(options.drainTimeoutMs ?? DEFAULT_DRAIN_TIMEOUT_MS, "drainTimeoutMs");
+    this.onClose = options.onClose;
+    raw.on("close", this.closeListener).on("error", this.errorListener).on("drain", this.drainListener);
+  }
+  /** Enqueues one public business event. */
+  enqueueBusiness(event) {
+    this.enqueue(serializeBusiness(event));
+  }
+  /** Enqueues one connection control event. */
+  enqueueControl(event) {
+    this.enqueue(serializeControl(event));
+  }
+  /** Enqueues a pre-serialized SSE frame (used by scoped multi-room streams). */
+  enqueueRaw(frame) {
+    this.enqueue(frame);
+  }
+  /** Writes a heartbeat comment when the socket is not currently blocked. */
   heartbeat() {
     if (!this.closed && !this.writing) this.writeFrame(": heartbeat\n\n");
   }
@@ -21030,458 +21665,274 @@ var ProjectRoomSseWriter = class {
       if (!this.raw.write(frame)) {
         this.writing = true;
         this.blockedBytes = Buffer.byteLength(frame, "utf8");
-      } else {
-        this.writing = false;
-        this.blockedBytes = 0;
-        (finish ?? (() => this.close()))();
-      }
-    } catch {
-      this.close();
-    }
-  }
-  armTerminalDeadline(deadlineMs, finish) {
-    this.terminalTimer = setTimeout(finish, deadlineMs);
-    this.terminalTimer.unref?.();
-  }
-  writeFrame(frame) {
-    if (this.closed) return;
-    try {
-      if (!this.raw.write(frame)) {
-        this.writing = true;
-        this.blockedBytes = Buffer.byteLength(frame, "utf8");
-        this.drainTimer = setTimeout(() => {
-          this.drainTimer = void 0;
-          this.failSlowConsumer();
-        }, this.drainTimeoutMs);
-        this.drainTimer.unref?.();
-      } else {
-        this.writing = false;
-        this.blockedBytes = 0;
-        this.flush();
-      }
-    } catch {
-      this.close();
-    }
-  }
-  clearDrainTimer() {
-    if (this.drainTimer !== void 0) clearTimeout(this.drainTimer);
-    this.drainTimer = void 0;
-  }
-  failSlowConsumer() {
-    if (this.closed) return;
-    this.frames.length = 0;
-    this.queuedBytes = 0;
-    if (!this.slowConsumerAttempted) {
-      this.slowConsumerAttempted = true;
-      try {
-        this.raw.write(serializeControl({ type: "resync", data: { reason: "SLOW_CONSUMER" } }));
-      } catch {
-      }
-    }
-    this.close();
-  }
-};
-function positive(value, name) {
-  if (!Number.isSafeInteger(value) || value <= 0) throw new RangeError(`${name} must be positive`);
-  return value;
-}
-
-// src/services/collaboration/ProjectRoomRealtimeService.ts
-var MAX_REPLAY_EVENTS = 1e4;
-var MAX_NODE_TIMER_DELAY = 2147e6;
-var ProjectRoomRealtimeService = class {
-  /** Creates a service using one process-local broker and read-only authorizer. */
-  constructor(deps) {
-    this.deps = deps;
-    this.connections = /* @__PURE__ */ new Set();
-    this.closed = false;
-    this.activeConnections = /* @__PURE__ */ new Map();
-    this.now = deps.now ?? Date.now;
-    this.authRecheckMs = deps.authRecheckMs ?? 15e3;
-    this.heartbeatMs = deps.heartbeatMs ?? 15e3;
-  }
-  /** Returns whether the actor's tenant/user/project stream quota has capacity. */
-  canConnect(actor2) {
-    if (this.closed) return false;
-    return (this.activeConnections.get(connectionKey(actor2)) ?? 0) < (this.deps.maxConnectionsPerUserProject ?? 5);
-  }
-  /** Starts a connection; authorization is assumed to have been performed by the route. */
-  connect(input) {
-    if (!this.canConnect(input.actor)) {
-      input.raw.end();
-      return;
-    }
-    const quotaKey = connectionKey(input.actor);
-    this.activeConnections.set(quotaKey, (this.activeConnections.get(quotaKey) ?? 0) + 1);
-    const writer = new ProjectRoomSseWriter(input.raw, { onClose: () => connection.close() });
-    let phase = "initializing";
-    let subscription;
-    let accessTimer;
-    let heartbeatTimer;
-    let expiryTimer;
-    const lifetimeAbort = new AbortController();
-    let accessAbort;
-    let closed = false;
-    const buffered = [];
-    const clearTimer = (timer) => {
-      if (timer !== void 0) clearTimeout(timer);
-    };
-    const cleanup = () => {
-      if (closed) return;
-      closed = true;
-      phase = "closed";
-      clearTimer(accessTimer);
-      clearTimer(heartbeatTimer);
-      clearTimer(expiryTimer);
-      lifetimeAbort.abort();
-      accessAbort?.abort();
-      subscription?.unsubscribe();
-      writer.close();
-      this.connections.delete(connection);
-      const remainingConnections = (this.activeConnections.get(quotaKey) ?? 1) - 1;
-      if (remainingConnections === 0) this.activeConnections.delete(quotaKey);
-      else this.activeConnections.set(quotaKey, remainingConnections);
-    };
-    const revoke = (reason) => {
-      if (closed) return;
-      void writer.closeWithControl({ type: "access.revoked", data: { reason } }).then(cleanup, cleanup);
-    };
-    const scheduleAccessCheck = () => {
-      if (closed) return;
-      accessTimer = setTimeout(() => {
-        accessTimer = void 0;
-        if (closed) return;
-        accessAbort = new AbortController();
-        const combined = combineSignals2(lifetimeAbort.signal, accessAbort.signal);
-        Promise.resolve().then(() => this.deps.requireReadAccess(input.actor, combined.signal)).then(() => {
-          combined.cleanup();
-          accessAbort = void 0;
-          scheduleAccessCheck();
-        }, (_error) => {
-          combined.cleanup();
-          accessAbort = void 0;
-          if (!closed) revoke("PROJECT_ACCESS_REVOKED");
-        });
-      }, this.authRecheckMs);
-      accessTimer.unref?.();
-    };
-    const connection = { close: cleanup };
-    this.connections.add(connection);
-    const scheduleHeartbeat = () => {
-      if (closed) return;
-      heartbeatTimer = setTimeout(() => {
-        heartbeatTimer = void 0;
-        if (closed) return;
-        writer.heartbeat();
-        scheduleHeartbeat();
-      }, this.heartbeatMs);
-      heartbeatTimer.unref?.();
-    };
-    scheduleHeartbeat();
-    const remaining = input.actor.tokenExpiresAt - this.now();
-    if (remaining <= 0) {
-      revoke("TOKEN_EXPIRED");
-      return;
-    }
-    const maxTimerDelay = this.deps.maxTimerDelay ?? MAX_NODE_TIMER_DELAY;
-    const scheduleExpiry = () => {
-      if (closed) return;
-      const delay2 = input.actor.tokenExpiresAt - this.now();
-      if (delay2 <= 0) {
-        revoke("TOKEN_EXPIRED");
-        return;
-      }
-      expiryTimer = setTimeout(() => {
-        expiryTimer = void 0;
-        scheduleExpiry();
-      }, Math.min(delay2, maxTimerDelay));
-      expiryTimer.unref?.();
-    };
-    scheduleExpiry();
-    try {
-      subscription = this.deps.broker.subscribe(
-        { tenantId: input.actor.tenantId, roomId: input.roomId, projectId: input.actor.projectId },
-        input.lastEventId,
-        (event) => {
-          if (phase === "initializing") buffered.push(event);
-          else if (phase === "direct") writer.enqueueBusiness(event);
-        }
-      );
-      if (subscription.replay.length > MAX_REPLAY_EVENTS) {
-        void writer.closeWithControl({ type: "resync", data: { reason: "CURSOR_EXPIRED" } }).then(cleanup, cleanup);
-        return;
-      }
-      let lastSequence = sequence(subscription.headEventId);
-      for (const event of subscription.replay) {
-        writer.enqueueBusiness(event);
-        lastSequence = sequence(event.id);
-      }
-      writer.enqueueControl({ type: "ready", data: { epoch: this.deps.broker.epoch, headEventId: subscription.headEventId } });
-      while (buffered.length > 0) {
-        for (const event of buffered.splice(0).sort((left, right) => sequence(left.id) - sequence(right.id))) {
-          if (sequence(event.id) > lastSequence) {
-            writer.enqueueBusiness(event);
-            lastSequence = sequence(event.id);
-          }
-        }
-      }
-      phase = "direct";
-      scheduleAccessCheck();
-    } catch (error) {
-      if (error instanceof import_protocols21.ProjectRoomCursorError) void writer.closeWithControl({ type: "resync", data: { reason: error.code } }).then(cleanup, cleanup);
-      else cleanup();
-    }
-  }
-  /** Closes every connection and prevents new connections. */
-  close() {
-    if (this.closed) return;
-    this.closed = true;
-    for (const connection of [...this.connections]) connection.close();
-  }
-};
-function sequence(id3) {
-  return id3 === null ? 0 : Number(id3.slice(id3.lastIndexOf(":") + 1));
-}
-function connectionKey(actor2) {
-  return JSON.stringify([actor2.tenantId, actor2.userId, actor2.projectId]);
-}
-function combineSignals2(first, second) {
-  const controller = new AbortController();
-  const abort = () => controller.abort();
-  if (first.aborted || second.aborted) abort();
-  else {
-    first.addEventListener("abort", abort, { once: true });
-    second.addEventListener("abort", abort, { once: true });
-  }
-  return { signal: controller.signal, cleanup: () => {
-    first.removeEventListener("abort", abort);
-    second.removeEventListener("abort", abort);
-  } };
-}
-
-// src/services/collaboration/ProjectRoomTaskEventSubscriber.ts
-var import_core49 = require("@axiom-lattice/core");
-var import_protocols22 = require("@axiom-lattice/protocols");
-var ProjectRoomTaskEventSubscriber = class {
-  /** Creates a bounded Project task lifecycle observer. */
-  constructor(deps) {
-    this.deps = deps;
-    this.queues = /* @__PURE__ */ new Map();
-    this.pendingCount = 0;
-    this.accepting = true;
-    this.closed = false;
-    this.accepted = /* @__PURE__ */ new Set();
-    this.maxPending = deps.maxPending ?? 1024;
-    if (!Number.isSafeInteger(this.maxPending) || this.maxPending < 1) throw new RangeError("maxPending must be a positive safe integer");
-  }
-  /** Admits one notification without awaiting any store operation. */
-  handle(value) {
-    const event = this.parse(value);
-    if (!event) {
-      this.warn("Project task realtime notification rejected", { code: "INVALID_TASK_REALTIME_EVENT" });
-      return Promise.resolve();
-    }
-    if (!this.accepting || this.closed) return Promise.resolve();
-    const scopeKey3 = JSON.stringify([event.tenantId, event.workspaceId, event.projectId, event.taskId]);
-    const eventKey = event.eventKey;
-    let queue = this.queues.get(scopeKey3);
-    if (!queue) {
-      if (this.pendingCount >= this.maxPending) return this.overflow(event.taskId);
-      queue = { events: [], keys: /* @__PURE__ */ new Set(), tail: Promise.resolve() };
-      this.queues.set(scopeKey3, queue);
-    }
-    if (queue.keys.has(eventKey)) return queue.tail;
-    if (this.pendingCount >= this.maxPending) return this.overflow(event.taskId);
-    queue.keys.add(eventKey);
-    queue.events.push(event);
-    this.pendingCount += 1;
-    const previousTail = queue.tail;
-    queue.tail = previousTail.then(() => this.processQueue(scopeKey3, queue)).catch((error) => {
-      this.warn("project-room:task-realtime-failed", { code: "TASK_REALTIME_NOTIFICATION_FAILED", error: error instanceof Error ? error.name : "UnknownError" });
-    });
-    const accepted = queue.tail;
-    this.accepted.add(accepted);
-    void accepted.finally(() => this.accepted.delete(accepted));
-    return accepted;
-  }
-  /** Closes admission without interrupting accepted work. */
-  closeAdmission() {
-    this.accepting = false;
-  }
-  /** Drains accepted work, closing permanently if the bound expires. */
-  async drain(timeoutMs = 5e3) {
-    const work = Promise.allSettled([...this.accepted]).then(() => void 0);
-    let timer;
-    const timeout = new Promise((resolve4) => {
-      timer = setTimeout(() => resolve4("timeout"), timeoutMs);
-      timer.unref?.();
-    });
-    const outcome = await Promise.race([work.then(() => "drained"), timeout]);
-    if (timer) clearTimeout(timer);
-    this.closed = true;
-    if (outcome === "timeout") this.queues.clear();
-  }
-  /** Closes admission and drains accepted work. */
-  async dispose() {
-    this.closeAdmission();
-    await this.drain();
-    this.closed = true;
-  }
-  async processQueue(scopeKey3, queue) {
-    while (queue.events.length > 0) {
-      const event = queue.events.shift();
-      try {
-        if (!this.closed) await this.publish(event);
-      } finally {
-        queue.keys.delete(event.eventKey);
-        this.pendingCount -= 1;
-      }
-    }
-    if (queue.events.length === 0 && this.queues.get(scopeKey3) === queue) this.queues.delete(scopeKey3);
-  }
-  async publish(event) {
-    try {
-      const taskValue = await this.deps.tasks.getById(event.tenantId, event.taskId);
-      const task = taskValue === null ? void 0 : snapshotTaskItem(taskValue);
-      if (this.closed) return;
-      if (!task || !(0, import_core49.isProjectLifecycleTask)(task) || task.tenantId !== event.tenantId || task.workspaceId !== event.workspaceId || task.projectId !== event.projectId || task.status !== event.status || task.updatedAt.toISOString() !== event.updatedAt || event.threadId !== void 0 && task.context?.thread_id !== event.threadId) {
-        this.warn("project-room:task-event-stale", { taskId: safeId3(event.taskId), eventKey: safeId3(event.eventKey) });
-        return;
-      }
-      const roomValue = await this.deps.rooms.getMainRoom(event.tenantId, event.projectId);
-      const room = snapshotProjectRoom(roomValue);
-      if (this.closed) return;
-      if (!room || room.tenantId !== event.tenantId || room.workspaceId !== event.workspaceId || room.projectId !== event.projectId) return;
-      const membershipValue = await this.deps.memberships.findByAssistant(event.tenantId, event.projectId, task.ownerId);
-      const membership = snapshotProjectBotMembership(membershipValue);
-      if (this.closed) return;
-      if (!membership || membership.tenantId !== event.tenantId || membership.workspaceId !== event.workspaceId || membership.projectId !== event.projectId || membership.roomId !== room.id || membership.assistantId !== task.ownerId) return;
-      this.deps.realtime.taskChanged({
-        tenantId: event.tenantId,
-        roomId: room.id,
-        projectId: event.projectId,
-        taskId: task.id,
-        status: task.status,
-        ownerMembershipId: membership.id,
-        updatedAt: task.updatedAt.toISOString(),
-        sourceKey: `task:${task.id}:${event.eventKey}`
-      });
-    } catch (error) {
-      this.warn("project-room:task-realtime-failed", { code: "TASK_REALTIME_NOTIFICATION_FAILED", taskId: safeId3(event.taskId), error: error instanceof Error ? error.name : "UnknownError" });
+      } else {
+        this.writing = false;
+        this.blockedBytes = 0;
+        (finish ?? (() => this.close()))();
+      }
+    } catch {
+      this.close();
     }
   }
-  parse(value) {
-    const row = (0, import_protocols22.snapshotExactRecord)(value, ["tenantId", "workspaceId", "projectId", "taskId", "status", "action", "eventKey", "updatedAt"], ["threadId"]);
-    const actions = ["in_progress", "interrupted", "failed", "completed", "cancelled", "reassigned"];
-    const statuses = ["pending", "in_progress", "review", "failed", "interrupted", "completed", "cancelled"];
-    if (!row || !actions.includes(String(row.action)) || !statuses.includes(String(row.status)) || !["tenantId", "workspaceId", "projectId", "taskId", "eventKey", "updatedAt"].every((key) => typeof row[key] === "string" && row[key].length > 0) || !Number.isFinite(Date.parse(row.updatedAt)) || row.threadId !== void 0 && typeof row.threadId !== "string") return void 0;
-    return row;
+  armTerminalDeadline(deadlineMs, finish) {
+    this.terminalTimer = setTimeout(finish, deadlineMs);
+    this.terminalTimer.unref?.();
   }
-  warn(message, context) {
+  writeFrame(frame) {
+    if (this.closed) return;
     try {
-      this.deps.log.warn(message, context);
+      if (!this.raw.write(frame)) {
+        this.writing = true;
+        this.blockedBytes = Buffer.byteLength(frame, "utf8");
+        this.drainTimer = setTimeout(() => {
+          this.drainTimer = void 0;
+          this.failSlowConsumer();
+        }, this.drainTimeoutMs);
+        this.drainTimer.unref?.();
+      } else {
+        this.writing = false;
+        this.blockedBytes = 0;
+        this.flush();
+      }
     } catch {
+      this.close();
     }
   }
-  overflow(taskId) {
-    this.warn("project-room:task-realtime-overflow", { code: "TASK_REALTIME_QUEUE_FULL", taskId });
-    return Promise.resolve();
+  clearDrainTimer() {
+    if (this.drainTimer !== void 0) clearTimeout(this.drainTimer);
+    this.drainTimer = void 0;
+  }
+  failSlowConsumer() {
+    if (this.closed) return;
+    this.frames.length = 0;
+    this.queuedBytes = 0;
+    if (!this.slowConsumerAttempted) {
+      this.slowConsumerAttempted = true;
+      try {
+        this.raw.write(serializeControl({ type: "resync", data: { reason: "SLOW_CONSUMER" } }));
+      } catch {
+      }
+    }
+    this.close();
   }
 };
-function safeId3(value) {
-  return typeof value === "string" && value.length > 0 ? value : void 0;
+function positive(value, name) {
+  if (!Number.isSafeInteger(value) || value <= 0) throw new RangeError(`${name} must be positive`);
+  return value;
 }
 
-// src/services/collaboration/ProjectRoomRealtimeRuntime.ts
-var ProjectRoomRealtimeRuntime = class {
+// src/services/collaboration/WorkspaceRoomEventsService.ts
+var MAX_NODE_TIMER_DELAY = 2147e6;
+var WorkspaceRoomEventsService = class {
+  /** Creates a service over the shared process-local broker. */
   constructor(deps) {
     this.deps = deps;
-    this.accepted = /* @__PURE__ */ new Set();
-    this.broker = deps.broker;
-    this.publisher = deps.publisher;
-    this.service = deps.service;
-    this.shutdownTimeoutMs = deps.shutdownTimeoutMs ?? 5e3;
-    this.unsubscribe = deps.subscribe(((event) => {
-      let work;
-      try {
-        work = Promise.resolve(deps.subscriber.handle(event));
-      } catch (error) {
-        work = Promise.reject(error);
-      }
-      const accepted = work.catch((error) => {
-        deps.log.warn("project-room:task-subscriber-failed", { error: error instanceof Error ? error.name : "UnknownError" });
-      });
-      this.accepted.add(accepted);
-      void accepted.finally(() => this.accepted.delete(accepted));
-    }));
+    this.connections = /* @__PURE__ */ new Map();
+    this.closed = false;
+    this.now = deps.now ?? Date.now;
+    this.heartbeatMs = deps.heartbeatMs ?? 15e3;
+    this.authRecheckMs = deps.authRecheckMs ?? 15e3;
+    this.maxConnectionsPerUser = deps.maxConnectionsPerUser ?? 2;
+    this.maxTimerDelay = deps.maxTimerDelay ?? MAX_NODE_TIMER_DELAY;
   }
-  /** Stops admission, drains accepted work, and closes transport resources exactly once. */
+  /** Starts a live-only connection; the route performs authentication beforehand. */
+  connect(input) {
+    if (this.closed) {
+      input.raw.end();
+      return;
+    }
+    const userKey = JSON.stringify([input.actor.tenantId, input.actor.userId]);
+    const active = this.connections.get(userKey) ?? /* @__PURE__ */ new Set();
+    if (active.size >= this.maxConnectionsPerUser) {
+      const oldest = [...active].sort((left, right) => left.startedAt - right.startedAt)[0];
+      oldest?.supersede();
+    }
+    const connection = this.buildConnection(input.actor, input.workspaceId, input.raw);
+    active.add(connection);
+    this.connections.set(userKey, active);
+  }
+  /** Closes every connection and stops admitting new ones. */
   close() {
-    this.closing ?? (this.closing = this.dispose());
-    return this.closing;
+    if (this.closed) return;
+    this.closed = true;
+    for (const active of [...this.connections.values()]) for (const connection of [...active]) connection.close();
+    this.connections.clear();
   }
-  async dispose() {
-    this.unsubscribe();
-    this.deps.subscriber.closeAdmission();
-    const accepted = [...this.accepted];
-    const drained = await boundedAllSettled(accepted, this.shutdownTimeoutMs);
-    if (!drained) this.deps.log.warn("project-room:runtime-drain-timeout", {
-      timeoutMs: this.shutdownTimeoutMs,
-      pending: accepted.length
+  buildConnection(actor2, workspaceId, raw) {
+    let phase = "initializing";
+    const subscriptions = /* @__PURE__ */ new Map();
+    let heartbeatTimer;
+    let accessTimer;
+    let expiryTimer;
+    let closed = false;
+    const recordRef = {};
+    let rebuildTail = Promise.resolve(true);
+    const lifetimeAbort = new AbortController();
+    const clear = (timer) => {
+      if (timer !== void 0) clearTimeout(timer);
+    };
+    const userScope = (0, import_protocols24.projectRoomUserEventScope)(actor2.tenantId, actor2.userId);
+    const userScopeKey = JSON.stringify([userScope.tenantId, userScope.roomId, userScope.projectId]);
+    const roomScopeKey = (scope) => JSON.stringify([scope.tenantId, scope.roomId, scope.projectId]);
+    const serializeScoped = (scope, event) => scope === null ? `id: ${event.id}
+event: ${event.type}
+data: ${JSON.stringify(event)}
+
+` : `id: ${event.id}
+event: ${event.type}
+data: ${JSON.stringify({ ...event, scope })}
+
+`;
+    const writer = new ProjectRoomSseWriter(raw, { onClose: () => cleanup() });
+    const cleanup = () => {
+      if (closed) return;
+      closed = true;
+      phase = "closed";
+      clear(heartbeatTimer);
+      clear(accessTimer);
+      clear(expiryTimer);
+      lifetimeAbort.abort();
+      for (const entry of subscriptions.values()) entry.unsubscribe();
+      subscriptions.clear();
+      writer.close();
+      const userKey = JSON.stringify([actor2.tenantId, actor2.userId]);
+      const active = this.connections.get(userKey);
+      if (active && recordRef.current !== void 0) {
+        active.delete(recordRef.current);
+        if (active.size === 0) this.connections.delete(userKey);
+      }
+    };
+    const revoke = (reason) => {
+      if (closed) return;
+      void writer.closeWithControl({ type: "access.revoked", data: { reason } }).then(cleanup, cleanup);
+    };
+    const record = {
+      startedAt: this.now(),
+      supersede: () => revoke("CONNECTION_SUPERSEDED"),
+      close: cleanup
+    };
+    recordRef.current = record;
+    const rebuildSubscriptions = async () => {
+      try {
+        const rooms = await this.deps.listMemberRooms({ tenantId: actor2.tenantId, userId: actor2.userId, workspaceId });
+        if (closed) return true;
+        const wanted = /* @__PURE__ */ new Map();
+        for (const room of rooms) {
+          const scope = { tenantId: actor2.tenantId, roomId: room.roomId, projectId: room.projectId };
+          wanted.set(roomScopeKey(scope), scope);
+        }
+        for (const [key, entry] of [...subscriptions]) {
+          if (key === userScopeKey || wanted.has(key)) continue;
+          entry.unsubscribe();
+          subscriptions.delete(key);
+        }
+        for (const [key, scope] of wanted) {
+          if (subscriptions.has(key)) continue;
+          const subscription = this.deps.broker.subscribe(scope, void 0, roomListener(scope));
+          subscriptions.set(key, { scope, unsubscribe: subscription.unsubscribe });
+        }
+        if (!subscriptions.has(userScopeKey)) {
+          const subscription = this.deps.broker.subscribe(userScope, void 0, userListener);
+          subscriptions.set(userScopeKey, { scope: userScope, unsubscribe: subscription.unsubscribe });
+        }
+        return true;
+      } catch (error) {
+        this.deps.log.warn("workspace-room-events:resubscribe-failed", {
+          error: error instanceof Error ? error.message : String(error)
+        });
+        return false;
+      }
+    };
+    const enqueueRebuild = () => {
+      rebuildTail = rebuildTail.then(rebuildSubscriptions, rebuildSubscriptions);
+    };
+    const userListener = (event) => {
+      if (phase === "live") writer.enqueueRaw(serializeScoped(null, event));
+      if (event.type === "membership.affected") enqueueRebuild();
+    };
+    const roomListener = (scope) => (event) => {
+      if (phase === "live") writer.enqueueRaw(serializeScoped(scope, event));
+    };
+    const scheduleExpiry = () => {
+      if (closed) return;
+      const delay2 = actor2.tokenExpiresAt - this.now();
+      if (delay2 <= 0) {
+        revoke("TOKEN_EXPIRED");
+        return;
+      }
+      expiryTimer = setTimeout(() => {
+        expiryTimer = void 0;
+        scheduleExpiry();
+      }, Math.min(delay2, this.maxTimerDelay));
+      expiryTimer.unref?.();
+    };
+    const scheduleHeartbeat = () => {
+      if (closed) return;
+      heartbeatTimer = setTimeout(() => {
+        heartbeatTimer = void 0;
+        if (closed) return;
+        writer.heartbeat();
+        scheduleHeartbeat();
+      }, this.heartbeatMs);
+      heartbeatTimer.unref?.();
+    };
+    const scheduleAccessCheck = () => {
+      if (closed) return;
+      accessTimer = setTimeout(() => {
+        accessTimer = void 0;
+        if (closed) return;
+        const projectIds = [...subscriptions.values()].map((entry) => entry.scope.projectId).filter((projectId) => projectId !== import_protocols24.PROJECT_ROOM_USER_CHANNEL_PROJECT);
+        Promise.all(projectIds.map((projectId) => Promise.resolve().then(() => this.deps.requireReadAccess({ tenantId: actor2.tenantId, userId: actor2.userId, projectId })))).then(() => {
+          if (!closed) scheduleAccessCheck();
+        }, () => {
+          if (!closed) revoke("PROJECT_ACCESS_REVOKED");
+        });
+      }, this.authRecheckMs);
+      accessTimer.unref?.();
+    };
+    scheduleHeartbeat();
+    enqueueRebuild();
+    const initialRebuild = rebuildTail;
+    void initialRebuild.then((ok) => {
+      if (closed) return;
+      if (!ok) {
+        cleanup();
+        return;
+      }
+      writer.enqueueControl({ type: "ready", data: { epoch: this.deps.broker.epoch, headEventId: null } });
+      phase = "live";
+      scheduleExpiry();
+      scheduleAccessCheck();
     });
-    await this.deps.subscriber.drain(drained ? this.shutdownTimeoutMs : 0);
-    this.service.close();
-    this.broker.close();
+    return record;
   }
 };
-function createProjectRoomRealtimeRuntime(deps) {
-  const broker = new ProjectRoomEventBroker({ log: deps.log });
-  const publisher = new BrokerProjectRoomRealtimePublisher({ broker, log: deps.log });
-  const service2 = new ProjectRoomRealtimeService({ broker, log: deps.log, requireReadAccess: deps.requireReadAccess });
-  const subscriber = new ProjectRoomTaskEventSubscriber({
-    tasks: deps.tasks,
-    rooms: deps.rooms,
-    memberships: deps.memberships,
-    realtime: publisher,
-    log: deps.log
-  });
-  return new ProjectRoomRealtimeRuntime({
-    broker,
-    publisher,
-    service: service2,
-    subscriber,
-    subscribe: (listener) => import_core50.taskLifecycleNotifier.subscribe(listener),
-    log: deps.log,
-    shutdownTimeoutMs: deps.shutdownTimeoutMs
-  });
-}
-async function boundedAllSettled(promises, timeoutMs) {
-  if (promises.length === 0) return true;
-  let timer;
-  const timeout = new Promise((resolve4) => {
-    timer = setTimeout(() => resolve4(false), timeoutMs);
-    timer.unref?.();
-  });
-  const result = await Promise.race([Promise.allSettled(promises).then(() => true), timeout]);
-  if (timer) clearTimeout(timer);
-  return result;
+
+// src/services/collaboration/WorkspaceMemberRoomLister.ts
+function createWorkspaceMemberRoomLister(deps) {
+  return async (input) => {
+    const projects = await deps.projects.getProjectsByWorkspace(input.tenantId, input.workspaceId);
+    const memberRooms = [];
+    for (const project of projects) {
+      const membership = await deps.memberships.findByUser(input.tenantId, project.id, input.userId);
+      if (!membership || membership.status !== "active") continue;
+      const room = await deps.rooms.getMainRoom(input.tenantId, project.id);
+      if (room) memberRooms.push({ projectId: project.id, roomId: room.id });
+    }
+    return memberRooms;
+  };
 }
 
-// src/routes/project-room-events.ts
-var import_protocols23 = require("@axiom-lattice/protocols");
-function registerProjectRoomEventRoutes(app2, deps) {
-  app2.get("/api/projects/:projectId/room/events", async (request, reply) => {
+// src/routes/workspace-room-events.ts
+var import_protocols25 = require("@axiom-lattice/protocols");
+function registerWorkspaceRoomEventRoutes(app2, deps) {
+  app2.get("/api/workspaces/:workspaceId/room-events", async (request, reply) => {
     try {
-      const projectId = exactProjectId(request.params);
-      const headers = strictHeaders(request, true);
+      const params = exactParams(request.params);
+      const headers = strictHeaders(request);
       if (request.body !== void 0 || Object.keys(request.query).length !== 0) return invalid(reply);
       const session = verifyConsoleSessionAuthHeader(headers.authorization, deps.tokenSecret);
       if (!session?.tenantId) return unauthorized(reply);
-      await deps.access.requireExistingProjectAccess({ tenantId: session.tenantId, userId: session.id, projectId, capability: "read" });
-      const room = exactRoom(await deps.rooms.getMainRoom(session.tenantId, projectId), session.tenantId, projectId);
-      if (!room) return reply.code(404).send({ success: false, error: { code: "PROJECT_ROOM_NOT_FOUND", message: "Project room not found", retryable: false } });
-      const actor2 = { tenantId: session.tenantId, userId: session.id, projectId, tokenExpiresAt: session.expiresAt };
-      if (!deps.realtime.canConnect(actor2)) return reply.code(429).send({ success: false, error: { code: "PROJECT_ROOM_STREAM_LIMIT", message: "Project room stream limit reached", retryable: true } });
       reply.hijack();
       reply.raw.writeHead(200, {
         "Content-Type": "text/event-stream",
@@ -21490,53 +21941,35 @@ function registerProjectRoomEventRoutes(app2, deps) {
         "X-Accel-Buffering": "no",
         "Access-Control-Allow-Origin": "*"
       });
-      deps.realtime.connect({ actor: actor2, roomId: room.id, ...headers.lastEventId ? { lastEventId: headers.lastEventId } : {}, raw: reply.raw });
-    } catch (error) {
-      return routeError(reply, error);
-    }
-  });
-  app2.get("/api/projects/:projectId/room/realtime-mode", async (request, reply) => {
-    try {
-      const projectId = exactProjectId(request.params);
-      const headers = strictHeaders(request, false);
-      if (request.body !== void 0 || Object.keys(request.query).length !== 0) return invalid(reply);
-      const session = verifyConsoleSessionAuthHeader(headers.authorization, deps.tokenSecret);
-      if (!session?.tenantId) return unauthorized(reply);
-      await deps.access.requireExistingProjectAccess({ tenantId: session.tenantId, userId: session.id, projectId, capability: "read" });
-      return reply.send({ success: true, data: { mode: "single-gateway", supportedGatewayProcesses: 1, durableReplay: false, epoch: deps.broker.epoch } });
+      deps.service.connect({
+        actor: { tenantId: session.tenantId, userId: session.id, tokenExpiresAt: session.expiresAt },
+        workspaceId: params.workspaceId,
+        raw: reply.raw
+      });
     } catch (error) {
       return routeError(reply, error);
     }
   });
 }
-function strictHeaders(request, requireSse) {
+function exactParams(params) {
+  const value = (0, import_protocols25.snapshotExactRecord)(params, ["workspaceId"]);
+  if (!value || typeof value.workspaceId !== "string" || !value.workspaceId.trim()) throw new InvalidRealtimeRequestError();
+  return { workspaceId: value.workspaceId };
+}
+function strictHeaders(request) {
   const raw = request.raw.rawHeaders;
   const values = (name) => raw.flatMap((value, index) => index % 2 === 0 && value.toLowerCase() === name ? [raw[index + 1]] : []);
   const authorization = values("authorization");
   const accept = values("accept");
   const cursor = values("last-event-id");
-  if (authorization.length !== 1 || authorization[0].includes(",") || cursor.length > 1 || cursor.some((value) => value.includes(",")) || requireSse && (accept.length !== 1 || !isSseAccept(accept[0]))) {
-    throw new InvalidRealtimeRequestError();
-  }
-  const lastEventId = cursor[0]?.trim();
-  if (lastEventId !== void 0 && (!lastEventId || !(0, import_protocols23.isProjectRoomEventId)(lastEventId))) throw new InvalidRealtimeRequestError();
-  return { authorization: authorization[0], ...lastEventId ? { lastEventId } : {} };
+  if (authorization.length !== 1 || authorization[0].includes(",") || cursor.length > 0 || accept.length !== 1 || !isSseAccept(accept[0])) throw new InvalidRealtimeRequestError();
+  return { authorization: authorization[0] };
 }
 function isSseAccept(value) {
   if (value.includes(",")) return false;
   const [mediaType, ...parameters] = value.split(";");
   return mediaType.trim() === "text/event-stream" && parameters.every((parameter) => /^[!#$%&'*+.^_`|~0-9A-Za-z-]+\s*=\s*(?:[!#$%&'*+.^_`|~0-9A-Za-z-]+|"[^"]*")$/.test(parameter.trim()));
 }
-function exactProjectId(params) {
-  const value = (0, import_protocols23.snapshotExactRecord)(params, ["projectId"]);
-  if (!value || typeof value.projectId !== "string" || !value.projectId.trim()) throw new InvalidRealtimeRequestError();
-  return value.projectId;
-}
-function exactRoom(value, tenantId, projectId) {
-  if (!value || typeof value !== "object") return void 0;
-  const room = value;
-  return typeof room.id === "string" && room.id && room.tenantId === tenantId && room.projectId === projectId ? { id: room.id } : void 0;
-}
 var InvalidRealtimeRequestError = class extends Error {
 };
 function invalid(reply) {
@@ -21547,7 +21980,6 @@ function unauthorized(reply) {
 }
 function routeError(reply, error) {
   if (error instanceof InvalidRealtimeRequestError) return invalid(reply);
-  if (error instanceof ProjectCollaborationError) return reply.code(error.statusCode).send({ success: false, error: { code: error.code, message: error.message, retryable: false } });
   return reply.code(500).send({ success: false, error: { code: "INTERNAL_ERROR", message: "Internal server error", retryable: false } });
 }
 
@@ -21648,7 +22080,7 @@ function snapshotDataRecord(value) {
     for (const key of Reflect.ownKeys(descriptors)) {
       if (typeof key !== "string") return void 0;
       const descriptor = descriptors[key];
-      const data = (0, import_protocols24.descriptorDataValue)(descriptor);
+      const data = (0, import_protocols26.descriptorDataValue)(descriptor);
       if (!data) return void 0;
       result[key] = data.value;
     }
@@ -21663,7 +22095,7 @@ function isPublicRoomAddress(message) {
 }
 async function validateReassignmentThread(threads, input) {
   const thread = snapshotThread(await threads.getThreadById(input.tenantId, input.newThreadId));
-  const metadata = (0, import_protocols24.snapshotExactRecord)(thread?.metadata, [
+  const metadata = (0, import_protocols26.snapshotExactRecord)(thread?.metadata, [
     "source",
     "kind",
     "workspaceId",
@@ -21686,6 +22118,7 @@ var registerLatticeRoutes = (app2, channelDeps, options = {}) => {
   const projectRoomStore = (0, import_core51.getStoreLattice)("default", "projectRoom").store;
   const projectBotMembershipStore = (0, import_core51.getStoreLattice)("default", "projectBotMembership").store;
   const projectRoomMessageStore = (0, import_core51.getStoreLattice)("default", "projectRoomMessage").store;
+  const projectRoomReadStateStore = (0, import_core51.getStoreLattice)("default", "projectRoomReadState").store;
   const threadStore = (0, import_core51.getStoreLattice)("default", "thread").store;
   const taskStore = (0, import_core51.getStoreLattice)("default", "task").store;
   const taskWorkItemStore = (0, import_core51.getStoreLattice)("default", "taskWorkItem").store;
@@ -21697,23 +22130,30 @@ var registerLatticeRoutes = (app2, channelDeps, options = {}) => {
     tasks: taskStore,
     rooms: projectRoomStore,
     memberships: projectBotMembershipStore,
-    log: realtimeLog,
-    requireReadAccess: async (actor2) => {
-      await accessService.requireExistingProjectAccess({
-        tenantId: actor2.tenantId,
-        userId: actor2.userId,
-        projectId: actor2.projectId,
-        capability: "read"
-      });
-    }
+    log: realtimeLog
   }) : void 0;
   if (projectRoomRealtimeRuntime) {
     app2.addHook("onClose", async () => projectRoomRealtimeRuntime?.close());
-    registerProjectRoomEventRoutes(app2, {
-      access: accessService,
-      rooms: projectRoomStore,
-      realtime: projectRoomRealtimeRuntime.service,
+    const workspaceRoomEventsService = new WorkspaceRoomEventsService({
       broker: projectRoomRealtimeRuntime.broker,
+      listMemberRooms: createWorkspaceMemberRoomLister({
+        projects: projectStore,
+        memberships: projectMembershipStore,
+        rooms: projectRoomStore
+      }),
+      requireReadAccess: async (input) => {
+        await accessService.requireExistingProjectAccess({
+          tenantId: input.tenantId,
+          userId: input.userId,
+          projectId: input.projectId,
+          capability: "read"
+        });
+      },
+      log: realtimeLog
+    });
+    app2.addHook("onClose", async () => workspaceRoomEventsService.close());
+    registerWorkspaceRoomEventRoutes(app2, {
+      service: workspaceRoomEventsService,
       tokenSecret: resolveConsoleTokenSecret(process.env.AUTH_REQUIRED === "true")
     });
   }
@@ -21795,7 +22235,24 @@ var registerLatticeRoutes = (app2, channelDeps, options = {}) => {
     saveBot: projectBotMembershipStore.save.bind(projectBotMembershipStore),
     ensureCoordinator: (tenantId) => coordinatorProvisioner.ensure(tenantId)
   });
-  registerProjectRoomRoutes(app2, { roomService, membershipService, messageService });
+  const readStateService = {
+    mark: async (actorRef) => {
+      await accessService.requireExistingProjectAccess({ ...actorRef, capability: "read" });
+      const room = await projectRoomStore.getMainRoom(actorRef.tenantId, actorRef.projectId);
+      if (!room) return;
+      const lastReadAt = /* @__PURE__ */ new Date();
+      await projectRoomReadStateStore.markRead({ tenantId: actorRef.tenantId, roomId: room.id, userId: actorRef.userId, lastReadAt });
+      projectRoomRealtimeRuntime?.publisher.readChanged({
+        tenantId: actorRef.tenantId,
+        userId: actorRef.userId,
+        projectId: actorRef.projectId,
+        roomId: room.id,
+        lastReadAt: lastReadAt.toISOString(),
+        sourceKey: `read:${actorRef.userId}:${room.id}:${lastReadAt.getTime()}`
+      });
+    }
+  };
+  registerProjectRoomRoutes(app2, { roomService, membershipService, messageService, readStateService });
   registerProjectRosterRoutes(app2, { service: rosterService });
   registerCoSpaceRoutes(app2, {
     projectStore: {
@@ -21817,7 +22274,11 @@ var registerLatticeRoutes = (app2, channelDeps, options = {}) => {
     },
     messageStore: {
       list: projectRoomMessageStore.list.bind(projectRoomMessageStore),
-      create: projectRoomMessageStore.create.bind(projectRoomMessageStore)
+      create: projectRoomMessageStore.create.bind(projectRoomMessageStore),
+      countAfter: projectRoomMessageStore.countAfter.bind(projectRoomMessageStore)
+    },
+    readStateStore: {
+      get: projectRoomReadStateStore.get.bind(projectRoomReadStateStore)
     },
     userTenantLinkStore: {
       getUsersByTenant: userTenantLinkStore.getUsersByTenant.bind(userTenantLinkStore)
@@ -21950,6 +22411,7 @@ var registerLatticeRoutes = (app2, channelDeps, options = {}) => {
       }
     })
   });
+  registerAgentWebAppEmbedRoutes(app2, {});
   registerA2ABridgeRoutes(app2);
   registerSTTRoutes(app2);
   app2.get("/api/local-a2a", getLocalA2AStatus);
@@ -22274,9 +22736,9 @@ var registerLatticeRoutes = (app2, channelDeps, options = {}) => {
 function tryCreateProjectTaskRuntime(input) {
   let projectWorkItems;
   try {
-    projectWorkItems = (0, import_protocols24.requireProjectTaskWorkItemStore)(input.taskWorkItemStore);
+    projectWorkItems = (0, import_protocols26.requireProjectTaskWorkItemStore)(input.taskWorkItemStore);
   } catch (error) {
-    if (error instanceof import_protocols24.ProjectTaskStoreUnsupportedError) {
+    if (error instanceof import_protocols26.ProjectTaskStoreUnsupportedError) {
       input.log?.warn("project-task:runtime-unavailable", {
         code: error.code,
         missingMethods: error.missingMethods
@@ -24185,7 +24647,7 @@ var import_core65 = require("@axiom-lattice/core");
 
 // src/router/MessageRouter.ts
 var import_core64 = require("@axiom-lattice/core");
-var import_protocols25 = require("@axiom-lattice/protocols");
+var import_protocols27 = require("@axiom-lattice/protocols");
 var import_crypto11 = require("crypto");
 var BindingNotFoundError = class extends Error {
   constructor(message) {
@@ -24215,10 +24677,10 @@ var CORRELATED_REPLY_REQUIRED_KEYS = [
   "state"
 ];
 function exactDataValues(value, required, optional = []) {
-  return (0, import_protocols25.snapshotExactRecord)(value, required, optional);
+  return (0, import_protocols27.snapshotExactRecord)(value, required, optional);
 }
 function uniqueNonemptyStrings(value) {
-  const snapshot = (0, import_protocols25.snapshotExactArray)(value);
+  const snapshot = (0, import_protocols27.snapshotExactArray)(value);
   if (!snapshot || snapshot.length === 0 || snapshot.some((entry) => typeof entry !== "string" || entry.length === 0)) return void 0;
   const values = snapshot;
   return new Set(values).size === values.length ? values : void 0;
@@ -24655,9 +25117,9 @@ var MessageRouter = class {
 };
 
 // src/channels/room/RoomChannelAdapter.ts
-var import_zod13 = require("zod");
-var import_protocols26 = require("@axiom-lattice/protocols");
-var roomConfigSchema = import_zod13.z.object({}).strict();
+var import_zod14 = require("zod");
+var import_protocols28 = require("@axiom-lattice/protocols");
+var roomConfigSchema = import_zod14.z.object({}).strict();
 function createRoomChannelAdapter(writer) {
   return {
     channel: "room",
@@ -24700,7 +25162,7 @@ function exactStrings(value, keys2) {
 function exactValues2(value, required, optional = []) {
   try {
     if (typeof value !== "object" || value === null || Array.isArray(value)) return void 0;
-    return (0, import_protocols26.snapshotExactRecord)(value, required, optional);
+    return (0, import_protocols28.snapshotExactRecord)(value, required, optional);
   } catch {
     return void 0;
   }
@@ -24745,14 +25207,14 @@ async function prepareProjectTaskRuntime(runtime, log2) {
 }
 
 // src/index.ts
-var import_protocols28 = require("@axiom-lattice/protocols");
+var import_protocols30 = require("@axiom-lattice/protocols");
 process.on("unhandledRejection", (reason, promise) => {
   console.error("\u672A\u5904\u7406\u7684Promise\u62D2\u7EDD:", reason);
 });
 var DEFAULT_LOGGER_CONFIG = {
   name: "default",
   description: "Default logger for lattice-gateway service",
-  type: import_protocols28.LoggerType.PINO,
+  type: import_protocols30.LoggerType.PINO,
   serviceName: "lattice/gateway",
   loggerName: "lattice/gateway"
 };
@@ -24925,26 +25387,11 @@ var start = async (config) => {
     const projectRoomRealtimeMode = resolveProjectRoomRealtimeMode();
     let projectRoomRealtimeRuntime;
     if (projectRoomRealtimeMode === "single-gateway") {
-      const projectStore = (0, import_core70.getStoreLattice)("default", "project").store;
-      const membershipStore = (0, import_core70.getStoreLattice)("default", "projectMembership").store;
-      const access = new ProjectAccessService({
-        projectStore,
-        membershipStore,
-        userTenantLinkStore: (0, import_core70.getStoreLattice)("default", "userTenantLink").store
-      });
       projectRoomRealtimeRuntime = createProjectRoomRealtimeRuntime({
         tasks: (0, import_core70.getStoreLattice)("default", "task").store,
         rooms: (0, import_core70.getStoreLattice)("default", "projectRoom").store,
         memberships: (0, import_core70.getStoreLattice)("default", "projectBotMembership").store,
-        log: { warn: (message, context) => logger6.warn(message, context) },
-        requireReadAccess: async (actor2) => {
-          await access.requireExistingProjectAccess({
-            tenantId: actor2.tenantId,
-            userId: actor2.userId,
-            projectId: actor2.projectId,
-            capability: "read"
-          });
-        }
+        log: { warn: (message, context) => logger6.warn(message, context) }
       });
     }
     let channelDeps;
@@ -25031,6 +25478,15 @@ var start = async (config) => {
         error: err instanceof Error ? err.message : String(err)
       });
     }
+    try {
+      const { registerOpenRoutes: registerOpenRoutes2 } = await Promise.resolve().then(() => (init_open(), open_exports));
+      registerOpenRoutes2(app);
+      logger6.info("Open MCP spike routes registered");
+    } catch (err) {
+      logger6.warn("Open MCP spike routes unavailable", {
+        error: err instanceof Error ? err.message : String(err)
+      });
+    }
     if (!import_core70.sandboxLatticeManager.hasLattice("default")) {
       import_core70.sandboxLatticeManager.registerLattice("default", getConfiguredSandboxProvider());
       logger6.info("Registered sandbox manager from env configuration");