@axiom-lattice/gateway 4.1.7 → 4.2.1

package/dist/index.mjs

@@ -1,6 +1,17 @@
+import {
+  getContentTypeFromFilename,
+  getFilenameFromPath
+} from "./chunk-LHQY46YB.mjs";
+import {
+  buildPreviewTokenScript
+} from "./chunk-2POW27EI.mjs";
+import "./chunk-WKNZ7GBC.mjs";
+import {
+  CollectionService
+} from "./chunk-PWHUWFXL.mjs";
 import {
   registerMcpServerConfigRoutes
-} from "./chunk-K4XELOSO.mjs";
+} from "./chunk-QKPZWWHH.mjs";
 import {
   Logger,
   getQrCode,
@@ -16,10 +27,7 @@ import {
   resolvePathWithinRoot,
   saveProjectFile
 } from "./chunk-J4BK77PA.mjs";
-import {
-  getContentTypeFromFilename,
-  getFilenameFromPath
-} from "./chunk-LHQY46YB.mjs";
+import "./chunk-NFEGQTCC.mjs";
 
 // src/index.ts
 import "dotenv/config";
@@ -29,7 +37,7 @@ import multipart from "@fastify/multipart";
 import sensible from "@fastify/sensible";
 import websocket from "@fastify/websocket";
 import staticPlugin from "@fastify/static";
-import path3 from "path";
+import path4 from "path";
 
 // src/routes/index.ts
 import { randomUUID as randomUUID19 } from "crypto";
@@ -2022,7 +2030,12 @@ async function getHealth(request, reply) {
 }
 
 // src/services/skill_service.ts
-import { SandboxSkillStore, PluginRegistry } from "@axiom-lattice/core";
+import {
+  SandboxSkillStore,
+  PluginRegistry,
+  getSandboxPluginCatalog,
+  parseSkillFrontmatter
+} from "@axiom-lattice/core";
 var PLUGIN_SKILL_SOURCE = "builtin-plugin";
 function getTenantId4(request) {
   return request.user?.tenantId || request.headers["x-tenant-id"] || "default";
@@ -2059,6 +2072,36 @@ var SkillService = class {
   constructor() {
     this.store = new SandboxSkillStore();
   }
+  /**
+   * Read the read-only skills contributed by the tenant's sandbox plugins.
+   * Sandbox failures degrade silently so the system view still returns
+   * built-in and store skills.
+   */
+  async tenantPluginSkills(tenantId) {
+    const items = [];
+    try {
+      const loaded = await getSandboxPluginCatalog().ensureLoaded(tenantId);
+      for (const plugin of loaded.plugins) {
+        for (const [name, definition] of Object.entries(plugin.skills ?? {})) {
+          const { meta } = parseSkillFrontmatter(definition.content);
+          items.push({
+            id: name,
+            name: meta.name || name,
+            description: meta.description || "",
+            version: definition.version,
+            pluginType: plugin.meta.type,
+            resourcePaths: Object.entries(definition.resources ?? {}).map(([path5, resource]) => ({
+              path: path5,
+              mimeType: resource.mimeType
+            })),
+            content: definition.content
+          });
+        }
+      }
+    } catch {
+    }
+    return items;
+  }
   async getAllSkills(request) {
     const tenantId = getTenantId4(request);
     const storeSkills = await this.store.getAllSkills(tenantId, buildContext(request));
@@ -2069,6 +2112,9 @@ var SkillService = class {
     for (const item of PluginRegistry.listSkills()) {
       merged.set(item.id, pluginSkillToSkill(item, tenantId));
     }
+    for (const item of await this.tenantPluginSkills(tenantId)) {
+      merged.set(item.id, pluginSkillToSkill(item, tenantId, item.content));
+    }
     return Array.from(merged.values());
   }
   async getSkillById(request, id3) {
@@ -2081,21 +2127,23 @@ var SkillService = class {
         return pluginSkillToSkill(item, tenantId, definition.content);
       }
     }
+    const tenantItem = (await this.tenantPluginSkills(tenantId)).find((entry) => entry.id === id3);
+    if (tenantItem) return pluginSkillToSkill(tenantItem, tenantId, tenantItem.content);
     return this.store.getSkillById(tenantId, id3, buildContext(request));
   }
   async createSkill(request, id3, data) {
     const tenantId = getTenantId4(request);
-    this.assertNotPluginSkill(id3, "created");
+    await this.assertMutable(tenantId, id3, "created");
     return this.store.createSkill(tenantId, id3, data, buildContext(request));
   }
   async updateSkill(request, id3, updates) {
     const tenantId = getTenantId4(request);
-    this.assertNotPluginSkill(id3, "modified");
+    await this.assertMutable(tenantId, id3, "modified");
     return this.store.updateSkill(tenantId, id3, updates, buildContext(request));
   }
   async deleteSkill(request, id3) {
     const tenantId = getTenantId4(request);
-    this.assertNotPluginSkill(id3, "deleted");
+    await this.assertMutable(tenantId, id3, "deleted");
     return this.store.deleteSkill(tenantId, id3, buildContext(request));
   }
   async searchByMetadata(request, key, value) {
@@ -2111,7 +2159,18 @@ var SkillService = class {
     return this.store.filterByLicense(tenantId, license, buildContext(request));
   }
   /**
-   * Guard against mutating a registered plugin skill.
+   * Guard against mutating a built-in or tenant-plugin skill.
+   * Message style mirrors SandboxSkillStore built-in errors so the controller's
+   * existing "built-in skill" -> 403 mapping applies. Runs before any store write.
+   */
+  async assertMutable(tenantId, id3, action) {
+    this.assertNotPluginSkill(id3, action);
+    if ((await this.tenantPluginSkills(tenantId)).some((skill) => skill.id === id3)) {
+      throw new Error(`Skill "${id3}" is a built-in skill and cannot be ${action}`);
+    }
+  }
+  /**
+   * Guard against mutating a globally registered plugin skill.
    * Message style mirrors SandboxSkillStore built-in errors so the controller's
    * existing "built-in skill" -> 403 mapping applies.
    */
@@ -2317,175 +2376,6 @@ async function filterSkillsByLicense(request, reply) {
   }
 }
 
-// src/services/collection_service.ts
-import { v4 as uuidv4 } from "uuid";
-import { Document } from "@langchain/core/documents";
-import {
-  collectionLatticeManager,
-  embeddingsLatticeManager,
-  getOrCreateCollectionVectorStore,
-  getCollectionEntryCount,
-  listCollectionEntries,
-  removeCollectionVectorStore
-} from "@axiom-lattice/core";
-function getTenantId5(request) {
-  return request.user?.tenantId || request.headers["x-tenant-id"] || "default";
-}
-var CollectionService = class {
-  // ─── Collection CRUD ──────────────────────────────────────────
-  async getAllCollections(request) {
-    const tenantId = getTenantId5(request);
-    const collections = await collectionLatticeManager.getAllCollections(tenantId);
-    for (const c2 of collections) {
-      try {
-        c2._entryCount = await getCollectionEntryCount(c2.name, c2.embeddingKey, c2.tenantId);
-      } catch {
-        c2._entryCount = 0;
-      }
-    }
-    return collections;
-  }
-  async getCollectionByName(request, name) {
-    const tenantId = getTenantId5(request);
-    return collectionLatticeManager.getCollection(tenantId, name);
-  }
-  async createCollection(request, data) {
-    const tenantId = getTenantId5(request);
-    const collection = await collectionLatticeManager.registerCollection(tenantId, data);
-    try {
-      await getOrCreateCollectionVectorStore(data.name, data.embeddingKey, tenantId);
-    } catch (err) {
-      console.warn(`[CollectionService] Failed to init vector store for ${data.name}:`, err);
-    }
-    return collection;
-  }
-  async updateCollection(request, name, updates) {
-    const tenantId = getTenantId5(request);
-    return collectionLatticeManager.updateCollection(tenantId, name, updates);
-  }
-  async deleteCollection(request, name) {
-    const tenantId = getTenantId5(request);
-    await removeCollectionVectorStore(name, tenantId);
-    return collectionLatticeManager.removeCollection(tenantId, name);
-  }
-  // ─── Entry CRUD ───────────────────────────────────────────────
-  async getEntries(request, collectionName) {
-    const collection = await this.getCollectionByName(request, collectionName);
-    if (!collection) throw new Error(`Collection "${collectionName}" not found`);
-    const docs = await listCollectionEntries(collectionName, collection.embeddingKey, collection.tenantId);
-    return docs.map((doc) => ({
-      id: doc.metadata._id || "",
-      content: doc.pageContent,
-      metadata: Object.fromEntries(
-        Object.entries(doc.metadata).filter(([k]) => !k.startsWith("_"))
-      )
-    }));
-  }
-  async createEntry(request, collectionName, data) {
-    const collection = await this.getCollectionByName(request, collectionName);
-    if (!collection) throw new Error(`Collection "${collectionName}" not found`);
-    const vectorStore = await getOrCreateCollectionVectorStore(
-      collectionName,
-      collection.embeddingKey,
-      collection.tenantId
-    );
-    const entryId = uuidv4();
-    const now = (/* @__PURE__ */ new Date()).toISOString();
-    const doc = new Document({
-      pageContent: data.content,
-      metadata: {
-        _id: entryId,
-        _created_at: now,
-        _updated_at: now,
-        ...data.metadata || {}
-      }
-    });
-    await vectorStore.addDocuments([doc]);
-    return { id: entryId, content: data.content, metadata: data.metadata || {} };
-  }
-  async getEntry(request, collectionName, entryId) {
-    const collection = await this.getCollectionByName(request, collectionName);
-    if (!collection) throw new Error(`Collection "${collectionName}" not found`);
-    const docs = await listCollectionEntries(collectionName, collection.embeddingKey, collection.tenantId);
-    const doc = docs.find((d) => d.metadata._id === entryId);
-    if (!doc) return null;
-    return {
-      id: entryId,
-      content: doc.pageContent,
-      metadata: Object.fromEntries(
-        Object.entries(doc.metadata).filter(([k]) => !k.startsWith("_"))
-      )
-    };
-  }
-  async updateEntry(request, collectionName, entryId, data) {
-    const existing = await this.getEntry(request, collectionName, entryId);
-    if (!existing) return null;
-    const collection = await this.getCollectionByName(request, collectionName);
-    if (!collection) throw new Error(`Collection "${collectionName}" not found`);
-    const vectorStore = await getOrCreateCollectionVectorStore(
-      collectionName,
-      collection.embeddingKey,
-      collection.tenantId
-    );
-    try {
-      await vectorStore.delete({ filter: { _id: entryId } });
-    } catch {
-    }
-    const now = (/* @__PURE__ */ new Date()).toISOString();
-    const mergedMetadata = { ...existing.metadata, ...data.metadata || {} };
-    const doc = new Document({
-      pageContent: data.content ?? existing.content,
-      metadata: { _id: entryId, _created_at: now, _updated_at: now, ...mergedMetadata }
-    });
-    await vectorStore.addDocuments([doc]);
-    return { id: entryId, content: data.content ?? existing.content, metadata: mergedMetadata };
-  }
-  async deleteEntry(request, collectionName, entryId) {
-    const collection = await this.getCollectionByName(request, collectionName);
-    if (!collection) throw new Error(`Collection "${collectionName}" not found`);
-    const vectorStore = await getOrCreateCollectionVectorStore(
-      collectionName,
-      collection.embeddingKey,
-      collection.tenantId
-    );
-    try {
-      await vectorStore.delete({ filter: { _id: entryId } });
-      return true;
-    } catch {
-      return false;
-    }
-  }
-  async searchEntries(request, collectionName, params) {
-    const collection = await this.getCollectionByName(request, collectionName);
-    if (!collection) throw new Error(`Collection "${collectionName}" not found`);
-    const vectorStore = await getOrCreateCollectionVectorStore(
-      collectionName,
-      collection.embeddingKey,
-      collection.tenantId
-    );
-    let embeddings;
-    try {
-      embeddings = embeddingsLatticeManager.getEmbeddingsClient(collection.embeddingKey);
-    } catch {
-      embeddings = embeddingsLatticeManager.getEmbeddingsClient("default");
-    }
-    const queryVector = await embeddings.embedQuery(params.query);
-    const results = await vectorStore.similaritySearchVectorWithScore(
-      queryVector,
-      params.top_k || 5,
-      params.filter
-    );
-    return results.map(([doc, score]) => ({
-      id: doc.metadata._id || uuidv4(),
-      content: doc.pageContent,
-      metadata: Object.fromEntries(
-        Object.entries(doc.metadata).filter(([k]) => !k.startsWith("_"))
-      ),
-      score
-    }));
-  }
-};
-
 // src/controllers/collections.ts
 var collectionService = new CollectionService();
 function serializeCollection(collection) {
@@ -2607,10 +2497,10 @@ async function deleteCollection(request, reply) {
 }
 
 // src/controllers/embeddings.ts
-import { embeddingsLatticeManager as embeddingsLatticeManager2 } from "@axiom-lattice/core";
+import { embeddingsLatticeManager } from "@axiom-lattice/core";
 async function listEmbeddings(_request, _reply) {
   try {
-    const info = embeddingsLatticeManager2.getAllEmbeddingsInfo();
+    const info = embeddingsLatticeManager.getAllEmbeddingsInfo();
     return {
       success: true,
       message: "Successfully retrieved embedding models",
@@ -2840,11 +2730,11 @@ import {
   getStoreLattice as getStoreLattice3,
   metricsServerManager
 } from "@axiom-lattice/core";
-function getTenantId6(request) {
+function getTenantId5(request) {
   return request.headers["x-tenant-id"] || "default";
 }
 async function executeDataQuery(request, reply) {
-  const tenantId = getTenantId6(request);
+  const tenantId = getTenantId5(request);
   const body = request.body;
   try {
     if (!body.serverKey && !body.datasourceId) {
@@ -2980,7 +2870,7 @@ async function executeSqlQuery(client, body, reply) {
 // src/controllers/workflow-tracking.ts
 import { getStoreLattice as getStoreLattice4, agentInstanceManager as agentInstanceManager4, ThreadStatus as ThreadStatus2, abortWorkflowRun as signalAbort } from "@axiom-lattice/core";
 import { MessageChunkTypes as MessageChunkTypes2 } from "@axiom-lattice/protocols";
-function getTenantId7(request) {
+function getTenantId6(request) {
   const userTenantId = request.user?.tenantId;
   if (userTenantId) return userTenantId;
   return request.headers["x-tenant-id"] || "default";
@@ -3021,7 +2911,7 @@ async function getDefinitionsFromAssistants(tenantId) {
   }
 }
 async function getAllWorkflowDefinitions(request, reply) {
-  const tenantId = getTenantId7(request);
+  const tenantId = getTenantId6(request);
   try {
     const configDefs = await getDefinitionsFromAssistants(tenantId);
     if (configDefs.length === 0) {
@@ -3066,7 +2956,7 @@ async function getAllWorkflowDefinitions(request, reply) {
   }
 }
 async function getAllWorkflowRuns(request, reply) {
-  const tenantId = getTenantId7(request);
+  const tenantId = getTenantId6(request);
   const { assistantId, status } = request.query;
   try {
     const store = getTrackingStore();
@@ -3120,7 +3010,7 @@ async function getAllWorkflowRuns(request, reply) {
 var INBOX_DEFAULT_PAGE_SIZE = 20;
 var INBOX_MAX_PAGE_SIZE = 100;
 async function getInboxItems(request, reply) {
-  const tenantId = getTenantId7(request);
+  const tenantId = getTenantId6(request);
   try {
     const store = getTrackingStore();
     if (!store) {
@@ -3228,7 +3118,7 @@ async function getInboxItems(request, reply) {
 }
 async function getWorkflowDefinitions(request, reply) {
   const { assistantId } = request.params;
-  const tenantId = getTenantId7(request);
+  const tenantId = getTenantId6(request);
   try {
     const store = getTrackingStore();
     if (!store) {
@@ -3259,7 +3149,7 @@ async function getWorkflowDefinitions(request, reply) {
 }
 async function getWorkflowRuns(request, reply) {
   const { threadId } = request.params;
-  const tenantId = getTenantId7(request);
+  const tenantId = getTenantId6(request);
   try {
     const store = getTrackingStore();
     if (!store) {
@@ -3295,7 +3185,7 @@ async function getWorkflowRun(request, reply) {
 }
 async function deleteWorkflowRun(request, reply) {
   const { runId } = request.params;
-  const tenantId = getTenantId7(request);
+  const tenantId = getTenantId6(request);
   try {
     const store = getTrackingStore();
     if (!store) {
@@ -3378,7 +3268,7 @@ async function getRunTasks(request, reply) {
 }
 async function replyInboxTask(request, reply) {
   const { runId, answers } = request.body;
-  const tenantId = getTenantId7(request);
+  const tenantId = getTenantId6(request);
   try {
     const store = getTrackingStore();
     if (!store) {
@@ -3455,7 +3345,7 @@ async function replyInboxTask(request, reply) {
 async function abortWorkflowRun(request, reply) {
   try {
     const { runId } = request.params;
-    const tenantId = getTenantId7(request);
+    const tenantId = getTenantId6(request);
     const store = getTrackingStore();
     if (!store) {
       return reply.status(404).send({
@@ -3507,7 +3397,7 @@ import { randomUUID as randomUUID3 } from "crypto";
 function getWorkspaceId2(request) {
   return request.headers["x-workspace-id"] || "default";
 }
-function getTenantId8(request) {
+function getTenantId7(request) {
   const userTenantId = request.user?.tenantId;
   if (userTenantId) return userTenantId;
   return request.headers["x-tenant-id"] || "default";
@@ -3534,7 +3424,7 @@ async function updateLinkMeta(userId, tenantId, meta) {
   await getLinkStore().updateLink(userId, tenantId, { metadata: meta });
 }
 async function createPersonalAssistant(request, reply) {
-  const tenantId = getTenantId8(request);
+  const tenantId = getTenantId7(request);
   const userId = getUserId3(request);
   const { name, personality } = request.body;
   if (!name || !personality) {
@@ -3571,7 +3461,7 @@ async function createPersonalAssistant(request, reply) {
   });
 }
 async function getPersonalAssistant(request, reply) {
-  const tenantId = getTenantId8(request);
+  const tenantId = getTenantId7(request);
   const userId = getUserId3(request);
   const store = getAssistantStore();
   const assistant = await store.getByOwner(tenantId, userId);
@@ -3588,7 +3478,7 @@ async function getPersonalAssistant(request, reply) {
   };
 }
 async function deletePersonalAssistant(request, reply) {
-  const tenantId = getTenantId8(request);
+  const tenantId = getTenantId7(request);
   const userId = getUserId3(request);
   const store = getAssistantStore();
   const assistant = await store.getByOwner(tenantId, userId);
@@ -4121,9 +4011,9 @@ var ExportImportService = class {
     if (!files || files.size === 0) return void 0;
     const prefix = `files/${entityType}/${entityId}/`;
     const result = /* @__PURE__ */ new Map();
-    for (const [path4, content] of files.entries()) {
-      if (path4.startsWith(prefix)) {
-        result.set(path4.slice(prefix.length), content);
+    for (const [path5, content] of files.entries()) {
+      if (path5.startsWith(prefix)) {
+        result.set(path5.slice(prefix.length), content);
       }
     }
     return result.size > 0 ? result : void 0;
@@ -4497,11 +4387,26 @@ async function importApply(request, reply) {
 }
 
 // src/controllers/middleware-types.ts
-import { PluginRegistry as PluginRegistry2 } from "@axiom-lattice/core";
+import {
+  PluginRegistry as PluginRegistry2,
+  getSandboxPluginCatalog as getSandboxPluginCatalog2,
+  mergePluginSources,
+  serializePluginMeta
+} from "@axiom-lattice/core";
+async function collectMiddlewareMetas(tenantId) {
+  let tenantPlugins = [];
+  try {
+    tenantPlugins = (await getSandboxPluginCatalog2().ensureLoaded(tenantId)).plugins;
+  } catch {
+    tenantPlugins = [];
+  }
+  const globalPlugins = PluginRegistry2.list().map((type) => PluginRegistry2.get(type)).filter((p) => Boolean(p));
+  return mergePluginSources(globalPlugins, tenantPlugins).map(serializePluginMeta);
+}
 function middlewareTypesRoutes(fastify2) {
-  fastify2.get("/api/middleware-types", async (_request, reply) => {
-    const metas = PluginRegistry2.listMeta();
-    return reply.send(metas);
+  fastify2.get("/api/middleware-types", async (request, reply) => {
+    const tenantId = request.user?.tenantId || request.headers["x-tenant-id"] || "default";
+    return reply.send(await collectMiddlewareMetas(tenantId));
   });
 }
 
@@ -5220,7 +5125,7 @@ import * as os2 from "os";
 import { getStoreLattice as getStoreLattice6 } from "@axiom-lattice/core";
 import { SandboxFilesystem, FilesystemBackend } from "@axiom-lattice/core";
 import { getSandBoxManager as getSandBoxManager3 } from "@axiom-lattice/core";
-import { v4 as uuidv42 } from "uuid";
+import { v4 as uuidv4 } from "uuid";
 
 // src/services/collaboration/RoomCoordinatorProvisioner.ts
 var ROOM_COORDINATOR_KEY = "room-coordinator";
@@ -5423,7 +5328,7 @@ var ProjectCollaborationInitializationError = class extends Error {
   }
 };
 function createProjectCollaborationInitializer(deps) {
-  const idFactory = deps.idFactory ?? uuidv42;
+  const idFactory = deps.idFactory ?? uuidv4;
   return {
     authorizeCreator: async ({ tenantId, userId }) => await deps.userTenantLinkStore.getLink(userId, tenantId) !== null,
     initialize: async ({ tenantId, userId, project }) => {
@@ -5498,7 +5403,7 @@ var WorkspaceController = class {
   async createWorkspace(request, reply) {
     const tenantId = this.getTenantId(request);
     const data = request.body;
-    const id3 = uuidv42();
+    const id3 = uuidv4();
     const workspace = await this.workspaceStore.createWorkspace(
       tenantId,
       id3,
@@ -5571,7 +5476,7 @@ var WorkspaceController = class {
     if (existing.length > 0) {
       return;
     }
-    await this.projectStore.createProject(tenantId, workspaceId, uuidv42(), {
+    await this.projectStore.createProject(tenantId, workspaceId, uuidv4(), {
       name: "Training",
       description: "Shared workspace for agent training",
       kind: "training"
@@ -5624,7 +5529,7 @@ var WorkspaceController = class {
         });
       }
     }
-    const id3 = uuidv42();
+    const id3 = uuidv4();
     const project = await this.projectStore.createProject(
       tenantId,
       workspaceId,
@@ -6171,7 +6076,7 @@ var WorkspaceController = class {
               workspaceId,
               projectId,
               timestamp: Date.now()
-            })};</script>`;
+            })};</script>` + buildPreviewTokenScript({ tenantId, workspaceId, projectId });
             if (content2.toLowerCase().includes("</head>")) {
               content2 = content2.replace(/<\/head>/i, `${contextScript}</head>`);
               console.log(`[viewFile] Context script injected before </head>`);
@@ -6202,7 +6107,7 @@ var WorkspaceController = class {
           workspaceId,
           projectId,
           timestamp: Date.now()
-        })};</script>`;
+        })};</script>` + buildPreviewTokenScript({ tenantId, workspaceId, projectId });
         if (content.toLowerCase().includes("</head>")) {
           finalContent = content.replace(/<\/head>/i, `${contextScript}</head>`);
           console.log(`[viewFile] Context script injected before </head>`);
@@ -6224,21 +6129,21 @@ var WorkspaceController = class {
   async listPath(request) {
     const tenantId = this.getTenantId(request);
     const { workspaceId, projectId } = request.params;
-    const path4 = request.query.path || "/";
+    const path5 = request.query.path || "/";
     const assistantId = request.query.assistantId;
-    console.log(`[listPath] tenantId=${tenantId} workspaceId=${workspaceId} projectId=${projectId} path=${path4} assistantId=${assistantId}`);
-    const { backend } = await this.getBackend(tenantId, workspaceId, projectId, assistantId, path4);
-    console.log(`[listPath] backend type=${backend.constructor.name} calling lsInfo(${path4})`);
-    const files = await backend.lsInfo(path4);
+    console.log(`[listPath] tenantId=${tenantId} workspaceId=${workspaceId} projectId=${projectId} path=${path5} assistantId=${assistantId}`);
+    const { backend } = await this.getBackend(tenantId, workspaceId, projectId, assistantId, path5);
+    console.log(`[listPath] backend type=${backend.constructor.name} calling lsInfo(${path5})`);
+    const files = await backend.lsInfo(path5);
     console.log(`[listPath] result count=${files.length}`);
     return { success: true, data: files };
   }
   async readFile(request) {
     const tenantId = this.getTenantId(request);
     const { workspaceId, projectId } = request.params;
-    const { path: path4, offset = 0, limit = 1e3, assistantId } = request.query;
-    const { backend } = await this.getBackend(tenantId, workspaceId, projectId, assistantId, path4);
-    const content = await backend.read(path4, Number(offset), Number(limit));
+    const { path: path5, offset = 0, limit = 1e3, assistantId } = request.query;
+    const { backend } = await this.getBackend(tenantId, workspaceId, projectId, assistantId, path5);
+    const content = await backend.read(path5, Number(offset), Number(limit));
     return { success: true, data: { content, offset, limit } };
   }
   /**
@@ -6525,13 +6430,17 @@ var ProjectAccessService = class {
     this.requireCapability(membership, input.capability);
     return { project, membership };
   }
-  /** Authorizes roster visibility: read for public rooms, manage elsewhere. */
+  /**
+   * Authorizes roster visibility for any active participant (owner/admin/member/viewer).
+   * Mutating the roster requires `manage` separately; reading it never does, because every
+   * room participant needs the member list to render the room and derive their own capabilities.
+   */
   async requireRosterAccess(input) {
     const project = await this.deps.projectStore.getProjectById(input.tenantId, input.projectId);
     if (!project) throw new ProjectCollaborationError("PROJECT_NOT_FOUND", 404, "Project not found");
     return this.requireProjectAccess({
       ...input,
-      capability: project.kind === "public" ? "read" : "manage"
+      capability: "read"
     });
   }
   async requirePublicProjectAccess(project, input) {
@@ -6620,7 +6529,7 @@ import {
   sqlDatabaseManager
 } from "@axiom-lattice/core";
 import { randomUUID as randomUUID7 } from "crypto";
-function getTenantId9(request) {
+function getTenantId8(request) {
   const userTenantId = request.user?.tenantId;
   if (userTenantId) {
     return userTenantId;
@@ -6628,7 +6537,7 @@ function getTenantId9(request) {
   return request.headers["x-tenant-id"] || "default";
 }
 async function getDatabaseConfigList(request, reply) {
-  const tenantId = getTenantId9(request);
+  const tenantId = getTenantId8(request);
   try {
     const storeLattice = getStoreLattice7("default", "database");
     const store = storeLattice.store;
@@ -6658,7 +6567,7 @@ async function getDatabaseConfigList(request, reply) {
   }
 }
 async function getDatabaseConfig(request, reply) {
-  const tenantId = getTenantId9(request);
+  const tenantId = getTenantId8(request);
   const { key } = request.params;
   try {
     const storeLattice = getStoreLattice7("default", "database");
@@ -6684,7 +6593,7 @@ async function getDatabaseConfig(request, reply) {
   }
 }
 async function createDatabaseConfig(request, reply) {
-  const tenantId = getTenantId9(request);
+  const tenantId = getTenantId8(request);
   const body = request.body;
   try {
     const storeLattice = getStoreLattice7("default", "database");
@@ -6719,7 +6628,7 @@ async function createDatabaseConfig(request, reply) {
   }
 }
 async function updateDatabaseConfig(request, reply) {
-  const tenantId = getTenantId9(request);
+  const tenantId = getTenantId8(request);
   const { key } = request.params;
   const updates = request.body;
   try {
@@ -6761,7 +6670,7 @@ async function updateDatabaseConfig(request, reply) {
   }
 }
 async function deleteDatabaseConfig(request, reply) {
-  const tenantId = getTenantId9(request);
+  const tenantId = getTenantId8(request);
   const { keyOrId } = request.params;
   try {
     const storeLattice = getStoreLattice7("default", "database");
@@ -6810,7 +6719,7 @@ async function deleteDatabaseConfig(request, reply) {
   }
 }
 async function testDatabaseConnection(request, reply) {
-  const tenantId = getTenantId9(request);
+  const tenantId = getTenantId8(request);
   const { key } = request.params;
   try {
     const storeLattice = getStoreLattice7("default", "database");
@@ -6903,7 +6812,7 @@ import {
   SemanticMetricsClient as SemanticMetricsClient2
 } from "@axiom-lattice/core";
 import { randomUUID as randomUUID8 } from "crypto";
-function getTenantId10(request) {
+function getTenantId9(request) {
   const userTenantId = request.user?.tenantId;
   if (userTenantId) {
     return userTenantId;
@@ -6911,7 +6820,7 @@ function getTenantId10(request) {
   return request.headers["x-tenant-id"] || "default";
 }
 async function getMetricsServerConfigList(request, reply) {
-  const tenantId = getTenantId10(request);
+  const tenantId = getTenantId9(request);
   try {
     const storeLattice = getStoreLattice8("default", "metrics");
     const store = storeLattice.store;
@@ -6937,7 +6846,7 @@ async function getMetricsServerConfigList(request, reply) {
   }
 }
 async function getMetricsServerConfig(request, reply) {
-  const tenantId = getTenantId10(request);
+  const tenantId = getTenantId9(request);
   const { key } = request.params;
   try {
     const storeLattice = getStoreLattice8("default", "metrics");
@@ -6963,7 +6872,7 @@ async function getMetricsServerConfig(request, reply) {
   }
 }
 async function createMetricsServerConfig(request, reply) {
-  const tenantId = getTenantId10(request);
+  const tenantId = getTenantId9(request);
   const body = request.body;
   try {
     const storeLattice = getStoreLattice8("default", "metrics");
@@ -7014,7 +6923,7 @@ async function createMetricsServerConfig(request, reply) {
   }
 }
 async function updateMetricsServerConfig(request, reply) {
-  const tenantId = getTenantId10(request);
+  const tenantId = getTenantId9(request);
   const { key } = request.params;
   const updates = request.body;
   try {
@@ -7065,7 +6974,7 @@ async function updateMetricsServerConfig(request, reply) {
   }
 }
 async function deleteMetricsServerConfig(request, reply) {
-  const tenantId = getTenantId10(request);
+  const tenantId = getTenantId9(request);
   const { keyOrId } = request.params;
   try {
     const storeLattice = getStoreLattice8("default", "metrics");
@@ -7112,7 +7021,7 @@ async function deleteMetricsServerConfig(request, reply) {
   }
 }
 async function testMetricsServerConnection(request, reply) {
-  const tenantId = getTenantId10(request);
+  const tenantId = getTenantId9(request);
   const { key } = request.params;
   try {
     const storeLattice = getStoreLattice8("default", "metrics");
@@ -7163,7 +7072,7 @@ async function testMetricsServerConnection(request, reply) {
   }
 }
 async function listAvailableMetrics(request, reply) {
-  const tenantId = getTenantId10(request);
+  const tenantId = getTenantId9(request);
   const { key } = request.params;
   try {
     const storeLattice = getStoreLattice8("default", "metrics");
@@ -7201,7 +7110,7 @@ async function listAvailableMetrics(request, reply) {
   }
 }
 async function queryMetricsData(request, reply) {
-  const tenantId = getTenantId10(request);
+  const tenantId = getTenantId9(request);
   const { key } = request.params;
   const { metricName, startTime, endTime, step, labels } = request.body;
   try {
@@ -7249,7 +7158,7 @@ async function queryMetricsData(request, reply) {
   }
 }
 async function getDataSources(request, reply) {
-  const tenantId = getTenantId10(request);
+  const tenantId = getTenantId9(request);
   const { key } = request.params;
   try {
     const storeLattice = getStoreLattice8("default", "metrics");
@@ -7290,7 +7199,7 @@ async function getDataSources(request, reply) {
   }
 }
 async function getDatasourceMetrics(request, reply) {
-  const tenantId = getTenantId10(request);
+  const tenantId = getTenantId9(request);
   const { key, datasourceId } = request.params;
   try {
     const storeLattice = getStoreLattice8("default", "metrics");
@@ -7327,7 +7236,7 @@ async function getDatasourceMetrics(request, reply) {
   }
 }
 async function querySemanticMetrics(request, reply) {
-  const tenantId = getTenantId10(request);
+  const tenantId = getTenantId9(request);
   const { key } = request.params;
   const body = request.body;
   try {
@@ -7484,7 +7393,7 @@ function registerMetricsServerConfigRoutes(app2) {
 }
 
 // src/controllers/connections.ts
-import { ConnectionRegistry, PluginRegistry as PluginRegistry3 } from "@axiom-lattice/core";
+import { ConnectionRegistry, PluginRegistry as PluginRegistry3, getSandboxPluginCatalog as getSandboxPluginCatalog3, mergePluginSources as mergePluginSources2 } from "@axiom-lattice/core";
 import { z as z2 } from "zod";
 var createBody = z2.object({
   type: z2.string().min(1),
@@ -7504,6 +7413,17 @@ function getTenant(request) {
   }
   return request.headers["x-tenant-id"] || "default";
 }
+async function getTenantPlugin(request, type) {
+  const tenantId = getTenant(request);
+  let tenantPlugins = [];
+  try {
+    tenantPlugins = (await getSandboxPluginCatalog3().ensureLoaded(tenantId)).plugins;
+  } catch {
+    tenantPlugins = [];
+  }
+  const globalPlugins = PluginRegistry3.list().map((t2) => PluginRegistry3.get(t2)).filter((p) => Boolean(p));
+  return mergePluginSources2(globalPlugins, tenantPlugins).find((p) => p.meta.type === type);
+}
 function maskSecrets(config) {
   const sensitive = /* @__PURE__ */ new Set([
     "password",
@@ -7587,7 +7507,7 @@ function connectionRoutes(fastify2) {
   fastify2.post("/api/connections/test", async (request, reply) => {
     const { type } = request.query;
     if (!type) return reply.status(400).send({ error: "query 'type' required" });
-    const plugin = PluginRegistry3.get(type);
+    const plugin = await getTenantPlugin(request, type);
     if (!plugin?.connection?.test) {
       return reply.status(400).send({ error: "plugin does not support connection testing" });
     }
@@ -7615,7 +7535,7 @@ function connectionRoutes(fastify2) {
   fastify2.post("/api/connections/discover", async (request, reply) => {
     const { type } = request.query;
     if (!type) return reply.status(400).send({ error: "query 'type' required" });
-    const plugin = PluginRegistry3.get(type);
+    const plugin = await getTenantPlugin(request, type);
     if (!plugin?.connection?.discover) {
       return reply.status(400).send({ error: "plugin does not support resource discovery" });
     }
@@ -7643,7 +7563,7 @@ function connectionRoutes(fastify2) {
 
 // src/controllers/eval.ts
 import { getStoreLattice as getStoreLattice10 } from "@axiom-lattice/core";
-import { v4 as uuidv44 } from "uuid";
+import { v4 as uuidv43 } from "uuid";
 
 // src/services/eval-runner.ts
 import { EventEmitter } from "events";
@@ -7652,7 +7572,7 @@ import {
   modelLatticeManager as modelLatticeManager2,
   LatticeEvalProject
 } from "@axiom-lattice/core";
-import { v4 as uuidv43 } from "uuid";
+import { v4 as uuidv42 } from "uuid";
 var TERMINAL_PERSIST_ATTEMPTS = 2;
 function mapLogs(logs) {
   return logs.map((l) => ({
@@ -7776,7 +7696,7 @@ var EvalRunner = class {
         console.warn(`[eval-runner] Project "${project.name}" has no judge modelKey and no "default" model \u2014 falling back to first registered model "${resolvedJudgeModelKey}"`);
       }
     }
-    const runId = uuidv43();
+    const runId = uuidv42();
     const concurrency = Math.max(1, Math.floor(project.concurrency) || 3);
     const isHoldout = suites.length > 0 && suites.every((s) => s.name.endsWith("-validation"));
     const workspaceId = runConfig?.workspaceId || "";
@@ -7833,7 +7753,7 @@ var EvalRunner = class {
       if (terminalUnavailable()) return;
       const passed = result.result?.pass ?? false;
       const score = result.result?.final_score ?? 0;
-      await store.createRunResult(tenantId, runId, uuidv43(), {
+      await store.createRunResult(tenantId, runId, uuidv42(), {
         suiteName,
         caseId: result.caseId,
         pass: passed,
@@ -7987,7 +7907,7 @@ var EvalRunner = class {
 var evalRunner = new EvalRunner();
 
 // src/controllers/eval.ts
-function getTenantId11(request) {
+function getTenantId10(request) {
   const userTenantId = request.user?.tenantId;
   if (userTenantId) {
     return userTenantId;
@@ -8011,9 +7931,9 @@ async function getOwnedCase(store, tenantId, projectId, suiteId, caseId) {
 }
 async function createProject(request, reply) {
   try {
-    const tenantId = getTenantId11(request);
+    const tenantId = getTenantId10(request);
     const store = getEvalStore();
-    const id3 = uuidv44();
+    const id3 = uuidv43();
     const data = request.body;
     const existing = await store.getProjectsByTenant(tenantId);
     if (existing.some((p) => p.name === data.name)) {
@@ -8068,7 +7988,7 @@ async function createProject(request, reply) {
 }
 async function listProjects(request, reply) {
   try {
-    const tenantId = getTenantId11(request);
+    const tenantId = getTenantId10(request);
     const store = getEvalStore();
     let projects = await store.getProjectsByTenant(tenantId);
     if (projects.length === 0) {
@@ -8079,7 +7999,7 @@ async function listProjects(request, reply) {
         const judgeModel = first ? { modelKey: first.key } : {};
         const host = request.hostname || "localhost";
         const baseUrl = `http://${host}:${process.env.PORT || 4001}`;
-        await store.createProject(tenantId, uuidv44(), {
+        await store.createProject(tenantId, uuidv43(), {
           name: "Default",
           description: "Built-in project for testing eval against this server",
           judgeModelConfig: judgeModel,
@@ -8102,7 +8022,7 @@ async function listProjects(request, reply) {
 }
 async function getProject(request, reply) {
   try {
-    const tenantId = getTenantId11(request);
+    const tenantId = getTenantId10(request);
     const store = getEvalStore();
     const { pid } = request.params;
     const project = await store.getProjectById(tenantId, pid);
@@ -8122,7 +8042,7 @@ async function getProject(request, reply) {
 }
 async function updateProject(request, reply) {
   try {
-    const tenantId = getTenantId11(request);
+    const tenantId = getTenantId10(request);
     const store = getEvalStore();
     const { pid } = request.params;
     const existing = await store.getProjectById(tenantId, pid);
@@ -8166,7 +8086,7 @@ async function updateProject(request, reply) {
 async function deleteProject(request, reply) {
   let releaseDeletion;
   try {
-    const tenantId = getTenantId11(request);
+    const tenantId = getTenantId10(request);
     const store = getEvalStore();
     const { pid } = request.params;
     const existing = await store.getProjectById(tenantId, pid);
@@ -8204,14 +8124,14 @@ async function deleteProject(request, reply) {
 }
 async function createSuite(request, reply) {
   try {
-    const tenantId = getTenantId11(request);
+    const tenantId = getTenantId10(request);
     const store = getEvalStore();
     const { pid } = request.params;
     const project = await store.getProjectById(tenantId, pid);
     if (!project) {
       return reply.status(404).send({ success: false, message: "Project not found" });
     }
-    const id3 = uuidv44();
+    const id3 = uuidv43();
     const data = request.body;
     const suite = await store.createSuite(tenantId, pid, id3, { name: data.name });
     return reply.status(201).send({
@@ -8226,7 +8146,7 @@ async function createSuite(request, reply) {
 }
 async function updateSuite(request, reply) {
   try {
-    const tenantId = getTenantId11(request);
+    const tenantId = getTenantId10(request);
     const store = getEvalStore();
     const { pid, sid } = request.params;
     const existing = await getOwnedSuite(store, tenantId, pid, sid);
@@ -8246,7 +8166,7 @@ async function updateSuite(request, reply) {
 }
 async function deleteSuite(request, reply) {
   try {
-    const tenantId = getTenantId11(request);
+    const tenantId = getTenantId10(request);
     const store = getEvalStore();
     const { pid, sid } = request.params;
     const existing = await getOwnedSuite(store, tenantId, pid, sid);
@@ -8265,14 +8185,14 @@ async function deleteSuite(request, reply) {
 }
 async function createCase(request, reply) {
   try {
-    const tenantId = getTenantId11(request);
+    const tenantId = getTenantId10(request);
     const store = getEvalStore();
     const { pid, sid } = request.params;
     const suite = await getOwnedSuite(store, tenantId, pid, sid);
     if (!suite) {
       return reply.status(404).send({ success: false, message: "Suite not found" });
     }
-    const id3 = uuidv44();
+    const id3 = uuidv43();
     const data = request.body;
     const created = await store.createCase(tenantId, sid, id3, {
       inputMessage: data.inputMessage,
@@ -8295,7 +8215,7 @@ async function createCase(request, reply) {
 }
 async function listCasesForSuite(request, reply) {
   try {
-    const tenantId = getTenantId11(request);
+    const tenantId = getTenantId10(request);
     const store = getEvalStore();
     const { pid, sid } = request.params;
     const suite = await getOwnedSuite(store, tenantId, pid, sid);
@@ -8315,7 +8235,7 @@ async function listCasesForSuite(request, reply) {
 }
 async function updateCase(request, reply) {
   try {
-    const tenantId = getTenantId11(request);
+    const tenantId = getTenantId10(request);
     const store = getEvalStore();
     const { pid, sid, cid } = request.params;
     const existing = await getOwnedCase(store, tenantId, pid, sid, cid);
@@ -8335,7 +8255,7 @@ async function updateCase(request, reply) {
 }
 async function deleteCase(request, reply) {
   try {
-    const tenantId = getTenantId11(request);
+    const tenantId = getTenantId10(request);
     const store = getEvalStore();
     const { pid, sid, cid } = request.params;
     const existing = await getOwnedCase(store, tenantId, pid, sid, cid);
@@ -8367,7 +8287,7 @@ function registerEvalRoutes(app2) {
   app2.delete("/api/eval/projects/:pid/suites/:sid/cases/:cid", deleteCase);
   app2.post("/api/eval/projects/:pid/runs", async (request, reply) => {
     try {
-      const tenantId = getTenantId11(request);
+      const tenantId = getTenantId10(request);
       const { pid } = request.params;
       const body = request.body ?? {};
       const bodyWs = request.headers["x-workspace-id"] || "";
@@ -8386,7 +8306,7 @@ function registerEvalRoutes(app2) {
   });
   app2.get("/api/eval/runs", async (request, reply) => {
     try {
-      const tenantId = getTenantId11(request);
+      const tenantId = getTenantId10(request);
       const query = request.query;
       const runs = await getEvalStore().getRunsByTenant(tenantId, { projectId: query.project_id, status: query.status });
       reply.send({ success: true, message: "Ok", data: { records: runs, total: runs.length } });
@@ -8396,7 +8316,7 @@ function registerEvalRoutes(app2) {
   });
   app2.get("/api/eval/runs/:rid", async (request, reply) => {
     try {
-      const tenantId = getTenantId11(request);
+      const tenantId = getTenantId10(request);
       const { rid } = request.params;
       const run2 = await getEvalStore().getRunById(tenantId, rid);
       if (!run2) return reply.status(404).send({ success: false, message: "Run not found" });
@@ -8407,7 +8327,7 @@ function registerEvalRoutes(app2) {
     }
   });
   app2.get("/api/eval/runs/:rid/stream", async (request, reply) => {
-    const tenantId = getTenantId11(request);
+    const tenantId = getTenantId10(request);
     const { rid } = request.params;
     const store = getEvalStore();
     const ownedRun = await store.getRunById(tenantId, rid);
@@ -8483,7 +8403,7 @@ data: ${JSON.stringify(event.data)}
   });
   app2.post("/api/eval/runs/:rid/abort", async (request, reply) => {
     try {
-      const tenantId = getTenantId11(request);
+      const tenantId = getTenantId10(request);
       const { rid } = request.params;
       const run2 = await getEvalStore().getRunById(tenantId, rid);
       if (!run2) return reply.status(404).send({ success: false, message: "Run not found" });
@@ -8496,7 +8416,7 @@ data: ${JSON.stringify(event.data)}
   });
   app2.delete("/api/eval/runs/:rid", async (request, reply) => {
     try {
-      const tenantId = getTenantId11(request);
+      const tenantId = getTenantId10(request);
       const { rid } = request.params;
       const store = getEvalStore();
       const run2 = await store.getRunById(tenantId, rid);
@@ -8513,7 +8433,7 @@ data: ${JSON.stringify(event.data)}
   });
   app2.get("/api/eval/reports/projects/:pid", async (request, reply) => {
     try {
-      const tenantId = getTenantId11(request);
+      const tenantId = getTenantId10(request);
       const { pid } = request.params;
       const report = await getEvalStore().getProjectReport(tenantId, pid);
       if (!report) return reply.status(404).send({ success: false, message: "Project not found" });
@@ -8526,7 +8446,7 @@ data: ${JSON.stringify(event.data)}
 
 // src/controllers/users.ts
 import { getStoreLattice as getStoreLattice11 } from "@axiom-lattice/core";
-import { v4 as uuidv45 } from "uuid";
+import { v4 as uuidv44 } from "uuid";
 var UsersController = class {
   constructor() {
     this.userStore = getStoreLattice11("default", "user").store;
@@ -8542,7 +8462,7 @@ var UsersController = class {
   }
   async createUser(request, reply) {
     const data = request.body;
-    const id3 = uuidv45();
+    const id3 = uuidv44();
     const existingUser = await this.userStore.getUserByEmail(data.email);
     if (existingUser) {
       return reply.status(409).send({
@@ -8608,7 +8528,7 @@ function registerUserRoutes(app2) {
 
 // src/controllers/tenants.ts
 import { getStoreLattice as getStoreLattice12 } from "@axiom-lattice/core";
-import { v4 as uuidv46 } from "uuid";
+import { v4 as uuidv45 } from "uuid";
 var TenantsController = class {
   constructor() {
     this.tenantStore = getStoreLattice12("default", "tenant").store;
@@ -8620,7 +8540,7 @@ var TenantsController = class {
   }
   async createTenant(request, reply) {
     const data = request.body;
-    const id3 = uuidv46();
+    const id3 = uuidv45();
     const tenant2 = await this.tenantStore.createTenant(id3, data);
     return reply.status(201).send({ success: true, data: tenant2 });
   }
@@ -8676,7 +8596,7 @@ function registerTenantRoutes(app2) {
 
 // src/controllers/auth.ts
 import { getStoreLattice as getStoreLattice13 } from "@axiom-lattice/core";
-import { v4 as uuidv47 } from "uuid";
+import { v4 as uuidv46 } from "uuid";
 import { createHmac, randomBytes, timingSafeEqual } from "crypto";
 var defaultAuthConfig = {
   autoApproveUsers: true,
@@ -8700,7 +8620,7 @@ var AuthController = class {
           error: "User with this email already exists"
         });
       }
-      const userId = uuidv47();
+      const userId = uuidv46();
       const userStatus = this.config.autoApproveUsers ? "active" : "pending";
       const userData = {
         email,
@@ -9099,13 +9019,13 @@ function isStaleConsoleSessionCredential(authHeader) {
   }
 }
 function bypassesConsoleAuth(request) {
-  const path4 = request.url.split("?")[0];
+  const path5 = request.url.split("?")[0];
   const method = request.method;
-  if (method === "GET" && /^\/api\/web-apps\/[^/]+\/runtime\/bootstrap$/.test(path4) || (method === "GET" || method === "POST") && /^\/api\/web-apps\/[^/]+\/runtime\/threads$/.test(path4) || (method === "PATCH" || method === "DELETE") && /^\/api\/web-apps\/[^/]+\/runtime\/threads\/[^/]+$/.test(path4) || method === "GET" && /^\/api\/web-apps\/[^/]+\/runtime\/threads\/[^/]+\/messages$/.test(path4) || method === "POST" && /^\/api\/web-apps\/[^/]+\/runtime\/threads\/[^/]+\/(messages\/stream|abort|attachments)$/.test(path4) || method === "POST" && /^\/api\/web-apps\/[^/]+\/runtime\/threads\/[^/]+\/interrupts\/[^/]+\/resume$/.test(path4)) return true;
-  if (request.method === "GET" && /^\/api\/a2a\/agents\/[^/]+\/\.well-known\/agent-card\.json$/.test(path4)) {
+  if (method === "GET" && /^\/api\/web-apps\/[^/]+\/runtime\/bootstrap$/.test(path5) || (method === "GET" || method === "POST") && /^\/api\/web-apps\/[^/]+\/runtime\/threads$/.test(path5) || (method === "PATCH" || method === "DELETE") && /^\/api\/web-apps\/[^/]+\/runtime\/threads\/[^/]+$/.test(path5) || method === "GET" && /^\/api\/web-apps\/[^/]+\/runtime\/threads\/[^/]+\/messages$/.test(path5) || method === "GET" && /^\/api\/web-apps\/[^/]+\/runtime\/files\/(viewfile|downloadfile)$/.test(path5) || method === "GET" && /^\/api\/web-apps\/[^/]+\/runtime\/api\/assistants\/[^/]+\/threads\/[^/]+\/sandbox\/(viewfile|downloadfile)$/.test(path5) || method === "POST" && /^\/api\/web-apps\/[^/]+\/runtime\/threads\/[^/]+\/(messages\/stream|abort|attachments)$/.test(path5) || method === "POST" && /^\/api\/web-apps\/[^/]+\/runtime\/threads\/[^/]+\/interrupts\/[^/]+\/resume$/.test(path5) || method === "GET" && /^\/api\/web-apps\/[^/]+\/chat$/.test(path5) || method === "GET" && /^\/embed\/[^/]+$/.test(path5) || (method === "POST" || method === "DELETE") && path5 === "/open/mcp" || method === "POST" && path5 === "/open/session" || (method === "GET" || method === "POST") && path5.startsWith("/open/sandbox/files/")) return true;
+  if (request.method === "GET" && /^\/api\/a2a\/agents\/[^/]+\/\.well-known\/agent-card\.json$/.test(path5)) {
     return true;
   }
-  return request.method === "POST" && /^\/api\/a2a\/agents\/[^/]+\/jsonrpc$/.test(path4);
+  return request.method === "POST" && /^\/api\/a2a\/agents\/[^/]+\/jsonrpc$/.test(path5);
 }
 function registerConsoleAuthHook(app2, options) {
   app2.addHook("preHandler", async (request, reply) => {
@@ -9128,8 +9048,8 @@ function registerConsoleAuthHook(app2, options) {
     }
     if (PUBLIC_ROUTES.some((route) => request.url === route)) return;
     if (request.url.startsWith("/s/")) return;
-    const path4 = request.url.split("?")[0];
-    if (request.method === "GET" && /^\/api\/workspaces\/[^/]+\/projects\/[^/]+\/viewfile$/.test(path4) || request.method === "GET" && /^\/api\/workspaces\/[^/]+\/projects\/[^/]+\/downloadfile$/.test(path4) || request.method === "POST" && /^\/api\/workspaces\/[^/]+\/projects\/[^/]+\/uploadfile$/.test(path4) || path4.startsWith("/f/") || path4 === "/f") {
+    const path5 = request.url.split("?")[0];
+    if (request.method === "GET" && /^\/api\/workspaces\/[^/]+\/projects\/[^/]+\/viewfile$/.test(path5) || request.method === "GET" && /^\/api\/workspaces\/[^/]+\/projects\/[^/]+\/downloadfile$/.test(path5) || request.method === "POST" && /^\/api\/workspaces\/[^/]+\/projects\/[^/]+\/uploadfile$/.test(path5) || path5.startsWith("/f/") || path5 === "/f") {
       return;
     }
     await reply.status(401).send({
@@ -9277,7 +9197,7 @@ var larkChannelAdapter = {
     };
   },
   async sendReply(replyTarget, message, installation) {
-    const { createLarkSender } = await import("./sender-PX32VSHB.mjs");
+    const { createLarkSender } = await import("./sender-PLDU5EZ3.mjs");
     const sender = await createLarkSender(installation.config);
     await sender.sendTextReply({
       chatId: replyTarget.rawTarget.chatId,
@@ -9500,7 +9420,7 @@ function setChannelControllerDeps(deps) {
   _adapterRegistry = deps.adapterRegistry;
   _router = deps.router;
 }
-function getTenantId12(request) {
+function getTenantId11(request) {
   const userTenantId = request.user?.tenantId;
   if (typeof userTenantId === "string" && userTenantId) {
     return userTenantId;
@@ -9630,7 +9550,7 @@ async function getInstallationStore() {
   });
 }
 async function getChannelInstallationList(request) {
-  const tenantId = getTenantId12(request);
+  const tenantId = getTenantId11(request);
   const { channel } = request.query;
   try {
     const store = await getInstallationStore();
@@ -9656,7 +9576,7 @@ async function getChannelInstallationList(request) {
   }
 }
 async function getChannelInstallation(request, reply) {
-  const tenantId = getTenantId12(request);
+  const tenantId = getTenantId11(request);
   const { installationId } = request.params;
   try {
     const store = await getInstallationStore();
@@ -9683,7 +9603,7 @@ async function getChannelInstallation(request, reply) {
   }
 }
 async function createChannelInstallation(request, reply) {
-  const tenantId = getTenantId12(request);
+  const tenantId = getTenantId11(request);
   try {
     const body = snapshotPublicCreateRequest(request.body);
     if (!body) {
@@ -9742,7 +9662,7 @@ async function createChannelInstallation(request, reply) {
   }
 }
 async function updateChannelInstallation(request, reply) {
-  const tenantId = getTenantId12(request);
+  const tenantId = getTenantId11(request);
   const { installationId } = request.params;
   try {
     const store = await getInstallationStore();
@@ -9866,7 +9786,7 @@ async function updateChannelInstallation(request, reply) {
   }
 }
 async function deleteChannelInstallation(request, reply) {
-  const tenantId = getTenantId12(request);
+  const tenantId = getTenantId11(request);
   const { installationId } = request.params;
   try {
     const store = await getInstallationStore();
@@ -9938,7 +9858,7 @@ import {
   descriptorDataValue as descriptorDataValue2
 } from "@axiom-lattice/protocols";
 import { getBindingRegistry, getStoreLattice as getStoreLattice14 } from "@axiom-lattice/core";
-function getTenantId13(request) {
+function getTenantId12(request) {
   const userTenantId = request.user?.tenantId;
   if (typeof userTenantId === "string" && userTenantId) return userTenantId;
   return request.headers["x-tenant-id"] || "default";
@@ -10011,7 +9931,7 @@ function invalidCreateRequest(reply) {
 }
 async function getBindingList(request, _reply) {
   void _reply;
-  const tenantId = getTenantId13(request);
+  const tenantId = getTenantId12(request);
   const { channel, agentId, channelInstallationId, limit, offset } = request.query;
   try {
     const registry = getBindingRegistry();
@@ -10031,7 +9951,7 @@ async function getBindingList(request, _reply) {
   }
 }
 async function getBinding(request, reply) {
-  const tenantId = getTenantId13(request);
+  const tenantId = getTenantId12(request);
   try {
     const registry = getBindingRegistry();
     const binding = await registry.findById(tenantId, request.params.id);
@@ -10046,7 +9966,7 @@ async function getBinding(request, reply) {
   }
 }
 async function createBinding(request, reply) {
-  const tenantId = getTenantId13(request);
+  const tenantId = getTenantId12(request);
   try {
     const input = snapshotPublicCreate(request.body);
     if (!input) return invalidCreateRequest(reply);
@@ -10071,7 +9991,7 @@ async function createBinding(request, reply) {
 }
 async function updateBinding(request, reply) {
   try {
-    const tenantId = getTenantId13(request);
+    const tenantId = getTenantId12(request);
     const registry = getBindingRegistry();
     const existing = await registry.findById(tenantId, request.params.id);
     if (!existing || isInternalBinding(existing)) {
@@ -10098,7 +10018,7 @@ async function updateBinding(request, reply) {
 }
 async function deleteBinding(request, reply) {
   try {
-    const tenantId = getTenantId13(request);
+    const tenantId = getTenantId12(request);
     const registry = getBindingRegistry();
     const existing = await registry.findById(tenantId, request.params.id);
     if (!existing || isInternalBinding(existing)) {
@@ -10115,7 +10035,7 @@ async function deleteBinding(request, reply) {
 }
 async function resolveBinding(request, _reply) {
   void _reply;
-  const tenantId = getTenantId13(request);
+  const tenantId = getTenantId12(request);
   const { channel, senderId, channelInstallationId } = request.query;
   if (channel === "room") {
     return { success: false, message: "No binding found", data: null };
@@ -10145,7 +10065,7 @@ function registerChannelBindingRoutes(app2) {
 
 // src/controllers/menu-items.ts
 import { getMenuRegistry } from "@axiom-lattice/core";
-function getTenantId14(request) {
+function getTenantId13(request) {
   const userTenantId = request.user?.tenantId;
   if (userTenantId) return userTenantId;
   return request.headers["x-tenant-id"] || "default";
@@ -10154,7 +10074,7 @@ function errorMessage(err) {
   return err instanceof Error ? err.message : "Unexpected error";
 }
 async function getMenuItemList(request, _reply) {
-  const tenantId = getTenantId14(request);
+  const tenantId = getTenantId13(request);
   try {
     const registry = getMenuRegistry();
     const items = await registry.list({ tenantId, menuTarget: request.query.menuTarget });
@@ -10166,7 +10086,7 @@ async function getMenuItemList(request, _reply) {
   }
 }
 async function getMenuItem(request, reply) {
-  const tenantId = getTenantId14(request);
+  const tenantId = getTenantId13(request);
   try {
     const registry = getMenuRegistry();
     const item = await registry.getById(request.params.id);
@@ -10183,7 +10103,7 @@ async function getMenuItem(request, reply) {
   }
 }
 async function createMenuItem(request, reply) {
-  const tenantId = getTenantId14(request);
+  const tenantId = getTenantId13(request);
   try {
     const registry = getMenuRegistry();
     const item = await registry.create({ ...request.body, tenantId });
@@ -10198,7 +10118,7 @@ async function createMenuItem(request, reply) {
 }
 async function updateMenuItem(request, reply) {
   try {
-    const tenantId = getTenantId14(request);
+    const tenantId = getTenantId13(request);
     const registry = getMenuRegistry();
     const existing = await registry.getById(request.params.id);
     if (!existing || existing.tenantId !== tenantId) {
@@ -10216,7 +10136,7 @@ async function updateMenuItem(request, reply) {
 }
 async function deleteMenuItem(request, reply) {
   try {
-    const tenantId = getTenantId14(request);
+    const tenantId = getTenantId13(request);
     const registry = getMenuRegistry();
     const existing = await registry.getById(request.params.id);
     if (!existing || existing.tenantId !== tenantId) {
@@ -10257,8 +10177,8 @@ var log = {
 };
 var connections = /* @__PURE__ */ new Map();
 var pending = /* @__PURE__ */ new Map();
-function getAgentIdFromPath(path4) {
-  const match = path4.match(/^\/api\/a2a\/bridge\/proxy\/([^/]+)/);
+function getAgentIdFromPath(path5) {
+  const match = path5.match(/^\/api\/a2a\/bridge\/proxy\/([^/]+)/);
   return match ? match[1] : null;
 }
 function handleBridgeConnection(socket, _request) {
@@ -10499,7 +10419,7 @@ import { getStoreLattice as getStoreLattice15 } from "@axiom-lattice/core";
 import {
   AgentType as AgentType2
 } from "@axiom-lattice/protocols";
-function getTenantId15(request) {
+function getTenantId14(request) {
   const userTenantId = request.user?.tenantId;
   if (userTenantId) return userTenantId;
   return request.headers["x-tenant-id"] || "default";
@@ -10536,7 +10456,7 @@ async function requireManagedAssistant(request, reply) {
     reply.status(400).send({ success: false, error: "assistantId is required" });
     return null;
   }
-  const registered = await getLocalA2AAssistant(getTenantId15(request), assistantId);
+  const registered = await getLocalA2AAssistant(getTenantId14(request), assistantId);
   if (!registered) {
     reply.status(404).send({
       success: false,
@@ -10547,7 +10467,7 @@ async function requireManagedAssistant(request, reply) {
   return { assistantId, localRuntime: registered.localRuntime };
 }
 async function getLocalA2AStatus(request, reply) {
-  const tenantId = getTenantId15(request);
+  const tenantId = getTenantId14(request);
   const managed = await getLocalA2AAssistants(tenantId);
   const states = await Promise.all(
     managed.map(
@@ -11186,7 +11106,7 @@ function notifyProjectTaskAdmission(task) {
   } catch {
   }
 }
-function getTenantId16(request) {
+function getTenantId15(request) {
   const user = request.user;
   const value = user?.tenantId ?? request.headers["x-tenant-id"] ?? "default";
   if (typeof value !== "string" || !value) throw new HttpTaskError(400, "INVALID_TASK_INPUT");
@@ -11427,7 +11347,7 @@ async function validateReferences(store, task, parentId, dependencies) {
 function createTaskController(deps) {
   const mutationMutex = deps.projectMutationMutex ?? projectMutationMutex;
   const authorize = async (request, projectId, capability2) => deps.access.requireProjectAccess({
-    tenantId: getTenantId16(request),
+    tenantId: getTenantId15(request),
     userId: getUserId4(request),
     projectId,
     capability: capability2
@@ -11444,7 +11364,7 @@ function createTaskController(deps) {
     });
   };
   const list = withErrors(async (request) => {
-    const tenantId = getTenantId16(request);
+    const tenantId = getTenantId15(request);
     const userId = getUserId4(request);
     const query = exactObject(request.query, ["projectId", "status", "priority", "limit", "offset", "ownerType", "ownerId", "parentId", "metadata"]);
     const projectId = typeof query.projectId === "string" ? query.projectId : void 0;
@@ -11516,14 +11436,14 @@ function createTaskController(deps) {
   });
   const get = withErrors(async (request, reply) => {
     await preauthorizeExplicitProject(request, authorize);
-    const current = await deps.tasks.getById(getTenantId16(request), request.params.id);
+    const current = await deps.tasks.getById(getTenantId15(request), request.params.id);
     if (!current) return sendNotFound(reply);
     await authorizeRead(request, current, authorize);
     return { success: true, data: current };
   });
   const create = withErrors(async (request, reply) => {
     const body = snapshotCreate(request.body);
-    const tenantId = getTenantId16(request);
+    const tenantId = getTenantId15(request);
     const userId = getUserId4(request);
     const governed = governedCreate(body);
     if (governed) return reply.code(409).send({ success: false, code: governed });
@@ -11576,7 +11496,7 @@ function createTaskController(deps) {
   const update = withErrors(async (request, reply) => {
     const body = snapshotUpdate(request.body);
     await preauthorizeExplicitProject(request, authorize);
-    const current = await deps.tasks.getById(getTenantId16(request), request.params.id);
+    const current = await deps.tasks.getById(getTenantId15(request), request.params.id);
     if (!current) return sendNotFound(reply);
     await authorizeMutation(request, current, authorize);
     return lockedTask(request, current, async (locked) => {
@@ -11594,7 +11514,7 @@ function createTaskController(deps) {
   });
   const remove = withErrors(async (request, reply) => {
     await preauthorizeExplicitProject(request, authorize);
-    const current = await deps.tasks.getById(getTenantId16(request), request.params.id);
+    const current = await deps.tasks.getById(getTenantId15(request), request.params.id);
     if (!current) return sendNotFound(reply);
     await authorizeMutation(request, current, authorize);
     return lockedTask(request, current, async (locked) => {
@@ -11608,7 +11528,7 @@ function createTaskController(deps) {
   const complete = withErrors(async (request, reply) => {
     const body = snapshotComplete(request.body);
     await preauthorizeExplicitProject(request, authorize);
-    const current = await deps.tasks.getById(getTenantId16(request), request.params.id);
+    const current = await deps.tasks.getById(getTenantId15(request), request.params.id);
     if (!current) return sendNotFound(reply);
     await authorizeMutation(request, current, authorize);
     return lockedTask(request, current, async (locked) => {
@@ -11625,7 +11545,7 @@ function createTaskController(deps) {
   });
   const workItems = withErrors(async (request, reply) => {
     await preauthorizeExplicitProject(request, authorize);
-    const current = await deps.tasks.getById(getTenantId16(request), request.params.id);
+    const current = await deps.tasks.getById(getTenantId15(request), request.params.id);
     if (!current) return sendNotFound(reply);
     await authorizeRead(request, current, authorize);
     const query = exactObject(request.query, ["action", "limit", "offset"]);
@@ -11645,7 +11565,7 @@ function createTaskController(deps) {
     const body = snapshotReassign(request.body);
     const pathProject = request.params.projectId;
     const access = await authorize(request, pathProject, "manage");
-    const snapshot = await deps.tasks.getById(getTenantId16(request), request.params.id);
+    const snapshot = await deps.tasks.getById(getTenantId15(request), request.params.id);
     if (!snapshot || snapshot.projectId !== access.project.id || snapshot.workspaceId !== access.project.workspaceId || snapshot.ownerType !== "agent") throw notFound();
     const projectId = snapshot.projectId;
     return deps.executionMutex.runExclusive({
@@ -12811,7 +12731,6 @@ function registerAgentWebAppRuntimeRoutes(app2, deps) {
       });
       routes.get("/api/web-apps/:webAppId/runtime/files/viewfile", async (request, reply) => {
         const { webAppId } = paramsSchema.parse(request.params);
-        const identity = await resolveRuntimeIdentity(request, webAppId, identities);
         const scope = await fileScope(webAppId, fileQuerySchema.parse(request.query));
         const query = { ...request.query, assistantId: scope.assistantId };
         await workspace.viewFile(scopedRequest(request, scope, { workspaceId: scope.workspaceId, projectId: scope.projectId }, query), reply);
@@ -12819,7 +12738,6 @@ function registerAgentWebAppRuntimeRoutes(app2, deps) {
       });
       routes.get("/api/web-apps/:webAppId/runtime/files/downloadfile", async (request, reply) => {
         const { webAppId } = paramsSchema.parse(request.params);
-        const identity = await resolveRuntimeIdentity(request, webAppId, identities);
         const scope = await fileScope(webAppId, fileQuerySchema.parse(request.query));
         const query = { ...request.query, assistantId: scope.assistantId };
         await workspace.downloadFile(scopedRequest(request, scope, { workspaceId: scope.workspaceId, projectId: scope.projectId }, query), reply);
@@ -12844,6 +12762,15 @@ function registerAgentWebAppRuntimeRoutes(app2, deps) {
       };
       routes.get("/api/web-apps/:webAppId/runtime/assistants/:assistantId/threads/:threadId/sandbox/downloadfile", delegateGenuiFile(workspace.downloadFile.bind(workspace)));
       routes.get("/api/web-apps/:webAppId/runtime/assistants/:assistantId/threads/:threadId/sandbox/viewfile", delegateGenuiFile(workspace.viewFile.bind(workspace)));
+      const delegateAnonGenuiFile = (method) => async (request, reply) => {
+        const { webAppId } = genuiSandboxParams.parse(request.params);
+        const scope = await fileScope(webAppId, fileQuerySchema.parse(request.query));
+        const query = { ...request.query, assistantId: scope.assistantId };
+        await method(scopedRequest(request, scope, { workspaceId: scope.workspaceId, projectId: scope.projectId }, query), reply);
+        return reply;
+      };
+      routes.get("/api/web-apps/:webAppId/runtime/api/assistants/:assistantId/threads/:threadId/sandbox/downloadfile", delegateAnonGenuiFile(workspace.downloadFile.bind(workspace)));
+      routes.get("/api/web-apps/:webAppId/runtime/api/assistants/:assistantId/threads/:threadId/sandbox/viewfile", delegateAnonGenuiFile(workspace.viewFile.bind(workspace)));
     }
     const mirrorThreadParams = z5.object({ webAppId: idSchema, assistantId: idSchema, threadId: idSchema }).strict();
     const mirrorBody = z5.object({ metadata: z5.object({ label: z5.string().max(300).optional() }).strict().optional(), projectId: idSchema.optional(), modelKey: idSchema.optional() }).strict();
@@ -13034,6 +12961,105 @@ function isMultipartRequestError(error) {
   return typeof error === "object" && error !== null && "code" in error && typeof error.code === "string" && error.code.startsWith("FST_");
 }
 
+// src/routes/agent-web-app-embed.ts
+import { existsSync as existsSync2 } from "fs";
+import { readFile, readdir as readdir2 } from "fs/promises";
+import path3 from "path";
+import { z as z6 } from "zod";
+var idSchema2 = z6.string().min(1).max(128).regex(/^[A-Za-z0-9._:@-]+$/);
+var JS_CONTENT_TYPE = "application/javascript; charset=utf-8";
+var CSS_CONTENT_TYPE = "text/css; charset=utf-8";
+var EXACT_ASSETS = {
+  "agent-chat-loader.js": { contentType: JS_CONTENT_TYPE },
+  "embed-page.js": { contentType: JS_CONTENT_TYPE },
+  "embed-page.css": { contentType: CSS_CONTENT_TYPE }
+};
+var HASHED_CHUNK_PATTERN = /^embed-page-[A-Za-z0-9._-]+\.(js|css)$/;
+var CHUNK_CSS_PATTERN = /^embed-page-[A-Za-z0-9._-]+\.css$/;
+function resolveAsset(asset) {
+  if (asset.includes("..")) return null;
+  const exact2 = EXACT_ASSETS[asset];
+  if (exact2 !== void 0) return { contentType: exact2.contentType, immutable: false };
+  const hashed = HASHED_CHUNK_PATTERN.exec(asset);
+  if (hashed) {
+    return { contentType: hashed[1] === "css" ? CSS_CONTENT_TYPE : JS_CONTENT_TYPE, immutable: true };
+  }
+  return null;
+}
+async function listChunkCssFiles(assetsDir) {
+  try {
+    return (await readdir2(assetsDir)).filter((name) => CHUNK_CSS_PATTERN.test(name) && !name.includes("..")).sort();
+  } catch {
+    return [];
+  }
+}
+var BUNDLED_MARKER = "agent-chat-loader.js";
+function resolveBundledEmbedDir() {
+  if (typeof __dirname === "string") {
+    const compiled = path3.resolve(__dirname, "embed");
+    if (existsSync2(path3.join(compiled, BUNDLED_MARKER))) return compiled;
+  }
+  let dir = path3.dirname(path3.resolve(process.argv[1] ?? process.cwd()));
+  for (let depth = 0; depth < 8; depth += 1) {
+    const candidate = path3.join(dir, "packages", "gateway", "dist", "embed");
+    if (existsSync2(path3.join(candidate, BUNDLED_MARKER))) return candidate;
+    const parent = path3.dirname(dir);
+    if (parent === dir) break;
+    dir = parent;
+  }
+  return null;
+}
+function renderChatShell(chunkCssFiles) {
+  const chunkCssLinks = chunkCssFiles.map(
+    (name) => `    <link rel="stylesheet" href="/embed/${name}" />`
+  );
+  return [
+    "<!doctype html>",
+    '<html lang="en">',
+    "  <head>",
+    '    <meta charset="utf-8" />',
+    '    <meta name="viewport" content="width=device-width, initial-scale=1" />',
+    "    <title>Agent chat</title>",
+    '    <link rel="stylesheet" href="/embed/embed-page.css" />',
+    ...chunkCssLinks,
+    "  </head>",
+    "  <body>",
+    '    <div id="axiom-embed-root">',
+    "      <noscript>This chat requires JavaScript.</noscript>",
+    '      <p class="axiom-embed-loading">Loading chat\u2026</p>',
+    "    </div>",
+    '    <script type="module" src="/embed/embed-page.js"></script>',
+    "  </body>",
+    "</html>"
+  ].join("\n");
+}
+function registerAgentWebAppEmbedRoutes(app2, deps = {}) {
+  const bundledDir = resolveBundledEmbedDir();
+  const assetsDir = deps.assetsDir ?? process.env.AXIOM_EMBED_ASSETS_DIR ?? bundledDir ?? path3.resolve(process.cwd(), "assets/embed");
+  let chunkCssFiles = null;
+  app2.get("/api/web-apps/:webAppId/chat", async (request, reply) => {
+    const parsed = idSchema2.safeParse(request.params.webAppId);
+    if (!parsed.success) {
+      return reply.code(400).send({ success: false, error: { code: "INVALID_REQUEST", message: "Invalid web app id", retryable: false } });
+    }
+    chunkCssFiles ?? (chunkCssFiles = await listChunkCssFiles(assetsDir));
+    return reply.header("content-type", "text/html; charset=utf-8").header("cache-control", "no-store").send(renderChatShell(chunkCssFiles));
+  });
+  app2.get("/embed/:asset", async (request, reply) => {
+    const asset = request.params.asset ?? "";
+    const resolved = resolveAsset(asset);
+    if (resolved === null) {
+      return reply.code(404).send({ success: false, error: { code: "INVALID_REQUEST", message: "Unknown embed asset", retryable: false } });
+    }
+    try {
+      const body = await readFile(path3.join(assetsDir, asset));
+      return reply.header("content-type", resolved.contentType).header("cache-control", resolved.immutable ? "public, max-age=31536000, immutable" : "public, max-age=300").send(body);
+    } catch {
+      return reply.code(404).send({ success: false, error: { code: "INVALID_REQUEST", message: "Embed asset not built", retryable: false } });
+    }
+  });
+}
+
 // src/services/agent-web-app/AgentWebAppAttachmentRef.ts
 import { createCipheriv, createDecipheriv, createHash as createHash3, randomBytes as randomBytes2 } from "crypto";
 var TTL_MS = 15 * 6e4;
@@ -13116,10 +13142,10 @@ function isAttachmentPayload(value) {
 }
 
 // src/controllers/capability-bundles.ts
-import { z as z7 } from "zod";
+import { z as z8 } from "zod";
 
 // src/services/capability/CapabilityBundleService.ts
-import { z as z6 } from "zod";
+import { z as z7 } from "zod";
 import { CapabilityBundleMergeError, CapabilityBundleValidationError, mergeCapabilityBundles, validateCapabilityBundleInput } from "@axiom-lattice/core";
 var CapabilityBundleServiceError = class extends Error {
   constructor(code, message, statusCode) {
@@ -13129,7 +13155,7 @@ var CapabilityBundleServiceError = class extends Error {
     this.name = "CapabilityBundleServiceError";
   }
 };
-var uuid = z6.string().uuid();
+var uuid = z7.string().uuid();
 function ownRecord(value) {
   if (value === void 0 || value === null) return {};
   if (typeof value !== "object" || Array.isArray(value)) throw new CapabilityBundleServiceError("INVALID_BUNDLE_CONFIG", "Project config must be an object", 409);
@@ -13331,12 +13357,12 @@ var CapabilityBundleService = class {
 
 // src/controllers/capability-bundles.ts
 var logger3 = new Logger({ serviceName: "lattice/gateway/capability-bundles" });
-var capability = z7.unknown();
-var createSchema = z7.object({ name: z7.string(), description: z7.string().optional(), capabilities: z7.array(capability) }).strict();
-var updateSchema = createSchema.partial().extend({ expectedUpdatedAt: z7.string().optional() });
-var bundleIdSchema = z7.string().uuid();
-var bundleParamsSchema = z7.object({ bundleId: bundleIdSchema });
-var projectSchema = z7.object({ bundleIds: z7.array(bundleIdSchema), expectedRevisions: z7.record(z7.string()).optional() }).strict();
+var capability = z8.unknown();
+var createSchema = z8.object({ name: z8.string(), description: z8.string().optional(), capabilities: z8.array(capability) }).strict();
+var updateSchema = createSchema.partial().extend({ expectedUpdatedAt: z8.string().optional() });
+var bundleIdSchema = z8.string().uuid();
+var bundleParamsSchema = z8.object({ bundleId: bundleIdSchema });
+var projectSchema = z8.object({ bundleIds: z8.array(bundleIdSchema), expectedRevisions: z8.record(z8.string()).optional() }).strict();
 function tenant(request, authRequired2) {
   const authenticated = request.user?.tenantId;
   const header2 = request.headers["x-tenant-id"];
@@ -13604,6 +13630,14 @@ var ProjectMembershipService = class {
       const room = await this.deps.roomStore.getMainRoom(membership.tenantId, membership.projectId);
       if (!room) throw new Error("Project main room not found");
       this.deps.realtime.membershipChanged({ tenantId: membership.tenantId, roomId: room.id, membership, change, sourceKey });
+      this.deps.realtime.membershipAffected({
+        tenantId: membership.tenantId,
+        userId: membership.userId,
+        change,
+        projectId: membership.projectId,
+        roomId: room.id,
+        sourceKey: `membership-affected:${sourceKey}`
+      });
     }).catch((error) => {
       this.reportRealtimeFailure(membership.id);
     });
@@ -14208,45 +14242,46 @@ function matchesNormalizedPayload(message, input) {
 
 // src/routes/project-rooms.ts
 import { ZodError as ZodError3 } from "zod";
+import { toProjectRoomPublicMessage } from "@axiom-lattice/protocols";
 
 // src/schemas/project-room.ts
-import { z as z8 } from "zod";
-var id2 = z8.string().trim().min(1).max(128);
-var isoDate = z8.string().datetime({ offset: true }).transform((value) => new Date(value));
-var expectedUpdatedAt = z8.object({ expectedUpdatedAt: isoDate }).strict();
-var projectRoomParamsSchema = z8.object({ projectId: id2 }).strict();
-var membershipParamsSchema = z8.object({ projectId: id2, membershipId: id2 }).strict();
-var roomMessagesQuerySchema = z8.object({
-  beforeCreatedAt: z8.string().datetime({ offset: true }).transform((value) => new Date(value)).optional(),
+import { z as z9 } from "zod";
+var id2 = z9.string().trim().min(1).max(128);
+var isoDate = z9.string().datetime({ offset: true }).transform((value) => new Date(value));
+var expectedUpdatedAt = z9.object({ expectedUpdatedAt: isoDate }).strict();
+var projectRoomParamsSchema = z9.object({ projectId: id2 }).strict();
+var membershipParamsSchema = z9.object({ projectId: id2, membershipId: id2 }).strict();
+var roomMessagesQuerySchema = z9.object({
+  beforeCreatedAt: z9.string().datetime({ offset: true }).transform((value) => new Date(value)).optional(),
   beforeId: id2.optional(),
-  limit: z8.coerce.number().int().min(1).max(100).optional()
+  limit: z9.coerce.number().int().min(1).max(100).optional()
 }).strict().refine((value) => value.beforeCreatedAt === void 0 === (value.beforeId === void 0), { message: "Both cursor fields are required" });
-var createRoomMessageSchema = z8.object({
-  text: z8.string(),
-  mentions: z8.array(z8.union([
-    z8.object({ type: z8.literal("team") }).strict(),
-    z8.object({ type: z8.literal("bot"), membershipId: id2 }).strict()
+var createRoomMessageSchema = z9.object({
+  text: z9.string(),
+  mentions: z9.array(z9.union([
+    z9.object({ type: z9.literal("team") }).strict(),
+    z9.object({ type: z9.literal("bot"), membershipId: id2 }).strict()
   ])).optional(),
   replyToMessageId: id2.optional()
 }).strict();
-var addProjectMemberSchema = z8.object({ userId: id2, role: z8.enum(["owner", "admin", "member", "viewer"]) }).strict();
-var updateProjectMemberSchema = z8.object({ role: z8.enum(["owner", "admin", "member", "viewer"]), expectedUpdatedAt: isoDate }).strict();
+var addProjectMemberSchema = z9.object({ userId: id2, role: z9.enum(["owner", "admin", "member", "viewer"]) }).strict();
+var updateProjectMemberSchema = z9.object({ role: z9.enum(["owner", "admin", "member", "viewer"]), expectedUpdatedAt: isoDate }).strict();
 var mutationExpectedUpdatedAtSchema = expectedUpdatedAt;
-var roomMessageRetryParamsSchema = z8.object({ projectId: id2, messageId: id2 }).strict();
-var emptyObjectSchema = z8.object({}).strict();
-var idempotencyKeySchema = z8.string().refine((value) => value.trim().length >= 1 && value.trim().length <= 200 && /^[\x20-\x7e]+$/.test(value.trim()), "Invalid idempotency key").transform((value) => value.trim());
-var addProjectBotSchema = z8.object({
+var roomMessageRetryParamsSchema = z9.object({ projectId: id2, messageId: id2 }).strict();
+var emptyObjectSchema = z9.object({}).strict();
+var idempotencyKeySchema = z9.string().refine((value) => value.trim().length >= 1 && value.trim().length <= 200 && /^[\x20-\x7e]+$/.test(value.trim()), "Invalid idempotency key").transform((value) => value.trim());
+var addProjectBotSchema = z9.object({
   assistantId: id2,
-  role: z8.enum(["coordinator", "specialist"]),
-  title: z8.string(),
-  responsibility: z8.string().optional(),
-  mentionName: z8.string()
+  role: z9.enum(["coordinator", "specialist"]),
+  title: z9.string(),
+  responsibility: z9.string().optional(),
+  mentionName: z9.string()
 }).strict();
-var updateProjectBotSchema = z8.object({
-  role: z8.enum(["coordinator", "specialist"]).optional(),
-  title: z8.string().optional(),
-  responsibility: z8.string().optional(),
-  mentionName: z8.string().optional(),
+var updateProjectBotSchema = z9.object({
+  role: z9.enum(["coordinator", "specialist"]).optional(),
+  title: z9.string().optional(),
+  responsibility: z9.string().optional(),
+  mentionName: z9.string().optional(),
   expectedUpdatedAt: isoDate
 }).strict().refine((value) => value.role !== void 0 || value.title !== void 0 || value.responsibility !== void 0 || value.mentionName !== void 0, { message: "At least one mutable field is required" });
 
@@ -14264,7 +14299,8 @@ function registerProjectRoomRoutes(app2, deps) {
     const params = projectRoomParamsSchema.parse(request.params);
     const query = roomMessagesQuerySchema.parse(request.query);
     const before = query.beforeCreatedAt === void 0 && query.beforeId === void 0 ? void 0 : { createdAt: query.beforeCreatedAt, id: query.beforeId };
-    return { data: await deps.messageService.list(actor(request, params.projectId), { ...before ? { before } : {}, ...query.limit === void 0 ? {} : { limit: query.limit } }) };
+    const messages = await deps.messageService.list(actor(request, params.projectId), { ...before ? { before } : {}, ...query.limit === void 0 ? {} : { limit: query.limit } });
+    return { data: messages.map(toProjectRoomMessage) };
   }));
   app2.post("/api/projects/:projectId/room/messages", async (request, reply) => run(reply, async () => {
     const params = projectRoomParamsSchema.parse(request.params);
@@ -14275,7 +14311,7 @@ function registerProjectRoomRoutes(app2, deps) {
     const idempotencyKey = rawIdempotencyKey === void 0 ? void 0 : idempotencyKeySchema.parse(rawIdempotencyKey);
     const result = await deps.messageService.createAndDispatch(requestActor, { ...input, ...idempotencyKey === void 0 ? {} : { requestIdempotencyKey: idempotencyKey } });
     const allSucceeded = result.dispatch.length > 0 && result.dispatch.every((entry) => entry.success);
-    return { statusCode: allSucceeded ? result.replayed ? 200 : 201 : 202, data: result };
+    return { statusCode: allSucceeded ? result.replayed ? 200 : 201 : 202, data: { message: toProjectRoomMessage(result.message), dispatch: result.dispatch, replayed: result.replayed } };
   }));
   app2.post("/api/projects/:projectId/room/messages/:messageId/retry", async (request, reply) => run(reply, async () => {
     const params = roomMessageRetryParamsSchema.parse(request.params);
@@ -14284,7 +14320,20 @@ function registerProjectRoomRoutes(app2, deps) {
     const dispatch = await deps.messageService.retry(actor(request, params.projectId), params.messageId);
     return { statusCode: dispatch.length > 0 && dispatch.every((entry) => entry.success) ? 200 : 202, data: dispatch };
   }));
-  app2.get("/api/projects/:projectId/members", async (request, reply) => run(reply, async () => ({ data: await deps.membershipService.list(actor(request, projectRoomParamsSchema.parse(request.params).projectId)) })));
+  app2.post("/api/projects/:projectId/room/read-state", async (request, reply) => run(reply, async () => {
+    const params = projectRoomParamsSchema.parse(request.params);
+    emptyObjectSchema.parse(request.body ?? {});
+    await deps.readStateService.mark(actor(request, params.projectId));
+    return { data: { marked: true } };
+  }));
+  app2.get("/api/projects/:projectId/members", async (request, reply) => run(reply, async () => {
+    const memberships = await deps.membershipService.list(actor(request, projectRoomParamsSchema.parse(request.params).projectId));
+    const enriched = await Promise.all(memberships.map(async (membership) => {
+      const user = await deps.userDirectory.getUserById(membership.userId);
+      return user === null ? membership : { ...membership, name: user.name };
+    }));
+    return { data: enriched };
+  }));
   app2.post("/api/projects/:projectId/members", async (request, reply) => run(reply, async () => {
     const p = projectRoomParamsSchema.parse(request.params);
     return { statusCode: 201, data: await deps.membershipService.add(actor(request, p.projectId), addProjectMemberSchema.parse(request.body)) };
@@ -14306,6 +14355,11 @@ function actor(request, projectId) {
   projectRoomParamsSchema.parse({ projectId });
   return { tenantId: user.tenantId, userId: user.id, projectId };
 }
+function toProjectRoomMessage(message) {
+  const publicMessage = toProjectRoomPublicMessage(message);
+  if (publicMessage === void 0) throw new Error("Room message could not be mapped to its public DTO");
+  return publicMessage;
+}
 async function run(reply, operation) {
   try {
     const result = await operation();
@@ -14371,6 +14425,7 @@ import {
   generateDirectHumanProjectId,
   generateDirectBotProjectId
 } from "@axiom-lattice/core";
+import { toProjectRoomPublicMessage as toProjectRoomPublicMessage2 } from "@axiom-lattice/protocols";
 var CoSpaceAuthError = class extends Error {
   constructor() {
     super(...arguments);
@@ -14385,6 +14440,18 @@ function getActor2(request) {
   }
   return { tenantId: user.tenantId, userId: user.id };
 }
+async function computeUnread(deps, tenantId, userId, roomId, lastMessage) {
+  if (!lastMessage) return 0;
+  const readState = await deps.readStateStore.get(tenantId, roomId, userId);
+  const horizon = readState?.lastReadAt;
+  if (horizon && lastMessage.createdAt.getTime() <= horizon.getTime()) return 0;
+  return deps.messageStore.countAfter({
+    tenantId,
+    roomId,
+    after: horizon ?? /* @__PURE__ */ new Date(0),
+    excludeAuthorUserId: userId
+  });
+}
 function registerCoSpaceRoutes(app2, deps) {
   const idFactory = deps.idFactory ?? (() => randomUUID16());
   app2.get(
@@ -14435,67 +14502,91 @@ function registerCoSpaceRoutes(app2, deps) {
               limit: 1
             });
             const lastMessage = messages[0];
+            const publicLastMessage = lastMessage === void 0 ? void 0 : toProjectRoomPublicMessage2(lastMessage);
             const memberships = await deps.membershipStore.list(
               actor2.tenantId,
               project.id
             );
             const participantNames = [];
+            const otherHumanNames = [];
             for (const m of memberships) {
               if (m.status !== "active") continue;
               const user = await deps.userStore.getUserById(m.userId);
               if (user) {
                 participantNames.push(user.name);
+                if (m.userId !== actor2.userId) otherHumanNames.push(user.name);
               }
             }
+            const displayName = project.kind === "personal" && otherHumanNames.length === 1 ? otherHumanNames[0] : void 0;
             rooms.push({
               project,
               room,
-              lastMessage,
+              lastMessage: publicLastMessage,
               participantCount: memberships.filter(
                 (m) => m.status === "active"
               ).length,
-              participantNames
+              participantNames,
+              ...displayName === void 0 ? {} : { displayName },
+              unreadCount: await computeUnread(
+                deps,
+                actor2.tenantId,
+                actor2.userId,
+                room.id,
+                lastMessage
+              )
             });
           } catch (e) {
             console.error("[CoSpace] Failed to process room for project:", project.id, e);
           }
         }
         rooms.sort((a, b) => {
-          const aTime = a.lastMessage?.createdAt?.getTime() ?? 0;
-          const bTime = b.lastMessage?.createdAt?.getTime() ?? 0;
+          const aTime = a.lastMessage ? Date.parse(a.lastMessage.createdAt) : 0;
+          const bTime = b.lastMessage ? Date.parse(b.lastMessage.createdAt) : 0;
           return bTime - aTime;
         });
-        const publicRoom = await deps.publicRoom.ensure(actor2.tenantId, params.workspaceId);
-        if (publicRoom) {
-          const publicMessages = await deps.messageStore.list({
-            tenantId: actor2.tenantId,
-            roomId: publicRoom.room.id,
-            limit: 1
-          });
-          const publicMemberships = await deps.membershipStore.list(
-            actor2.tenantId,
-            publicRoom.project.id
-          );
-          const publicParticipantNames = [];
-          for (const m of publicMemberships) {
-            if (m.status !== "active") continue;
-            const user = await deps.userStore.getUserById(m.userId);
-            if (user) {
-              publicParticipantNames.push(user.name);
-            }
-          }
-          rooms.unshift({
-            project: publicRoom.project,
-            room: publicRoom.room,
-            lastMessage: publicMessages[0],
-            participantCount: publicMemberships.filter((m) => m.status === "active").length,
-            participantNames: publicParticipantNames,
-            isPublic: true
-          });
-        }
-        return { data: { rooms } };
-      });
-    }
+        try {
+          const publicRoom = await deps.publicRoom.ensure(actor2.tenantId, params.workspaceId);
+          if (publicRoom) {
+            const publicMessages = await deps.messageStore.list({
+              tenantId: actor2.tenantId,
+              roomId: publicRoom.room.id,
+              limit: 1
+            });
+            const publicLastMessage = publicMessages[0];
+            const publicMemberships = await deps.membershipStore.list(
+              actor2.tenantId,
+              publicRoom.project.id
+            );
+            const publicParticipantNames = [];
+            for (const m of publicMemberships) {
+              if (m.status !== "active") continue;
+              const user = await deps.userStore.getUserById(m.userId);
+              if (user) {
+                publicParticipantNames.push(user.name);
+              }
+            }
+            rooms.unshift({
+              project: publicRoom.project,
+              room: publicRoom.room,
+              lastMessage: publicLastMessage === void 0 ? void 0 : toProjectRoomPublicMessage2(publicLastMessage),
+              participantCount: publicMemberships.filter((m) => m.status === "active").length,
+              participantNames: publicParticipantNames,
+              isPublic: true,
+              unreadCount: await computeUnread(
+                deps,
+                actor2.tenantId,
+                actor2.userId,
+                publicRoom.room.id,
+                publicLastMessage
+              )
+            });
+          }
+        } catch (e) {
+          console.error("[CoSpace] Failed to assemble public room:", e);
+        }
+        return { data: { rooms } };
+      });
+    }
   );
   app2.post(
     "/api/workspaces/:workspaceId/direct",
@@ -14516,7 +14607,6 @@ function registerCoSpaceRoutes(app2, deps) {
           );
         }
         let projectId;
-        let otherPartyId;
         if (body.type === "human") {
           projectId = generateDirectHumanProjectId(
             actor2.tenantId,
@@ -14524,7 +14614,6 @@ function registerCoSpaceRoutes(app2, deps) {
             actor2.userId,
             body.targetUserId
           );
-          otherPartyId = body.targetUserId;
         } else {
           projectId = generateDirectBotProjectId(
             actor2.tenantId,
@@ -14532,14 +14621,24 @@ function registerCoSpaceRoutes(app2, deps) {
             actor2.userId,
             body.assistantId
           );
-          otherPartyId = body.assistantId;
         }
         let project = await deps.projectStore.getProjectById(
           actor2.tenantId,
           projectId
         );
         if (!project) {
-          const name = body.type === "human" ? `Direct with ${otherPartyId}` : `Chat with ${otherPartyId}`;
+          let displayName;
+          if (body.type === "human") {
+            const targetUser = await deps.userStore.getUserById(body.targetUserId);
+            displayName = targetUser?.name ?? body.targetUserId;
+          } else {
+            const targetAssistant = await deps.assistantStore.getAssistantById(
+              actor2.tenantId,
+              body.assistantId
+            );
+            displayName = targetAssistant?.name ?? body.assistantId;
+          }
+          const name = body.type === "human" ? `Direct with ${displayName}` : `Chat with ${displayName}`;
           project = await deps.projectStore.createProject(
             actor2.tenantId,
             params.workspaceId,
@@ -14732,12 +14831,28 @@ function registerCoSpaceRoutes(app2, deps) {
             actor2.tenantId,
             directProjectId
           );
-          bots.push({
+          const bot = {
             assistantId: assistant.id,
             name: assistant.name,
             description: assistant.description,
             hasDirectRoom: existingProject !== null
-          });
+          };
+          if (assistant.createdAt) bot.createdAt = assistant.createdAt.toISOString();
+          if (existingProject) {
+            const membership = await deps.botMembershipStore.findByAssistant(
+              actor2.tenantId,
+              directProjectId,
+              assistant.id
+            );
+            if (membership) {
+              if (membership.role) bot.role = membership.role;
+              if (membership.mentionName) bot.mentionName = membership.mentionName;
+              if (membership.responsibility) bot.responsibility = membership.responsibility;
+              bot.status = membership.status;
+              if (membership.joinedAt) bot.joinedAt = membership.joinedAt.toISOString();
+            }
+          }
+          bots.push(bot);
         }
         return { data: { bots } };
       });
@@ -14778,13 +14893,15 @@ function registerCoSpaceRoutes(app2, deps) {
             actor2.tenantId,
             directProjectId
           );
-          members.push({
+          const member = {
             userId: link.userId,
             name: user.name,
             email: user.email,
             role: link.role,
             hasDirectRoom: existingProject !== null
-          });
+          };
+          if (link.joinedAt) member.joinedAt = link.joinedAt.toISOString();
+          members.push(member);
         }
         return { data: { members } };
       });
@@ -17549,6 +17666,7 @@ function snapshotJson(value, ancestors = /* @__PURE__ */ new Set()) {
 // src/services/collaboration/ProjectRoomRealtimePublisher.ts
 import { createHash as createHash7 } from "crypto";
 import {
+  projectRoomUserEventScope,
   snapshotExactRecord as snapshotExactRecord10,
   snapshotProjectRoomBotMembershipRealtime,
   snapshotProjectRoomMembershipRealtime,
@@ -17623,6 +17741,46 @@ var BrokerProjectRoomRealtimePublisher = class {
       };
     });
   }
+  /** Publishes a membership notice onto the affected user's channel scope. */
+  membershipAffected(input) {
+    this.publish("membership.affected", () => {
+      const value = snapshotExactRecord10(input, ["tenantId", "userId", "change", "projectId", "roomId", "sourceKey"]);
+      if (!value || !safeId2(value.tenantId) || !safeId2(value.userId) || !safeId2(value.projectId) || !safeId2(value.roomId) || !safeSourceKey(value.sourceKey) || !["added", "removed", "role_changed"].includes(value.change)) {
+        throw new TypeError("Invalid membership input");
+      }
+      const scope = projectRoomUserEventScope(value.tenantId, value.userId);
+      return {
+        sourceKey: value.sourceKey,
+        id: value.sourceKey,
+        scope,
+        draft: {
+          type: "membership.affected",
+          occurredAt: (/* @__PURE__ */ new Date()).toISOString(),
+          data: { change: value.change, projectId: value.projectId, roomId: value.roomId }
+        }
+      };
+    });
+  }
+  /** Publishes a read-marker update onto the acting user's channel scope. */
+  readChanged(input) {
+    this.publish("read.changed", () => {
+      const value = snapshotExactRecord10(input, ["tenantId", "userId", "projectId", "roomId", "lastReadAt", "sourceKey"]);
+      if (!value || !safeId2(value.tenantId) || !safeId2(value.userId) || !safeId2(value.projectId) || !safeId2(value.roomId) || !safeSourceKey(value.sourceKey) || typeof value.lastReadAt !== "string" || !Number.isFinite(Date.parse(value.lastReadAt))) {
+        throw new TypeError("Invalid read input");
+      }
+      const scope = projectRoomUserEventScope(value.tenantId, value.userId);
+      return {
+        sourceKey: value.sourceKey,
+        id: value.sourceKey,
+        scope,
+        draft: {
+          type: "read.changed",
+          occurredAt: (/* @__PURE__ */ new Date()).toISOString(),
+          data: { projectId: value.projectId, roomId: value.roomId, lastReadAt: new Date(Date.parse(value.lastReadAt)).toISOString() }
+        }
+      };
+    });
+  }
   publish(type, build) {
     let event;
     try {
@@ -17681,8 +17839,212 @@ function safeErrorCode(error) {
   return error instanceof Error && error.name === "Error" ? "Error" : "UnknownError";
 }
 
-// src/services/collaboration/ProjectRoomRealtimeService.ts
-import { ProjectRoomCursorError as ProjectRoomCursorError2 } from "@axiom-lattice/protocols";
+// src/services/collaboration/ProjectRoomTaskEventSubscriber.ts
+import { isProjectLifecycleTask as isProjectLifecycleTask6 } from "@axiom-lattice/core";
+import { snapshotExactRecord as snapshotExactRecord11 } from "@axiom-lattice/protocols";
+var ProjectRoomTaskEventSubscriber = class {
+  /** Creates a bounded Project task lifecycle observer. */
+  constructor(deps) {
+    this.deps = deps;
+    this.queues = /* @__PURE__ */ new Map();
+    this.pendingCount = 0;
+    this.accepting = true;
+    this.closed = false;
+    this.accepted = /* @__PURE__ */ new Set();
+    this.maxPending = deps.maxPending ?? 1024;
+    if (!Number.isSafeInteger(this.maxPending) || this.maxPending < 1) throw new RangeError("maxPending must be a positive safe integer");
+  }
+  /** Admits one notification without awaiting any store operation. */
+  handle(value) {
+    const event = this.parse(value);
+    if (!event) {
+      this.warn("Project task realtime notification rejected", { code: "INVALID_TASK_REALTIME_EVENT" });
+      return Promise.resolve();
+    }
+    if (!this.accepting || this.closed) return Promise.resolve();
+    const scopeKey3 = JSON.stringify([event.tenantId, event.workspaceId, event.projectId, event.taskId]);
+    const eventKey = event.eventKey;
+    let queue = this.queues.get(scopeKey3);
+    if (!queue) {
+      if (this.pendingCount >= this.maxPending) return this.overflow(event.taskId);
+      queue = { events: [], keys: /* @__PURE__ */ new Set(), tail: Promise.resolve() };
+      this.queues.set(scopeKey3, queue);
+    }
+    if (queue.keys.has(eventKey)) return queue.tail;
+    if (this.pendingCount >= this.maxPending) return this.overflow(event.taskId);
+    queue.keys.add(eventKey);
+    queue.events.push(event);
+    this.pendingCount += 1;
+    const previousTail = queue.tail;
+    queue.tail = previousTail.then(() => this.processQueue(scopeKey3, queue)).catch((error) => {
+      this.warn("project-room:task-realtime-failed", { code: "TASK_REALTIME_NOTIFICATION_FAILED", error: error instanceof Error ? error.name : "UnknownError" });
+    });
+    const accepted = queue.tail;
+    this.accepted.add(accepted);
+    void accepted.finally(() => this.accepted.delete(accepted));
+    return accepted;
+  }
+  /** Closes admission without interrupting accepted work. */
+  closeAdmission() {
+    this.accepting = false;
+  }
+  /** Drains accepted work, closing permanently if the bound expires. */
+  async drain(timeoutMs = 5e3) {
+    const work = Promise.allSettled([...this.accepted]).then(() => void 0);
+    let timer;
+    const timeout = new Promise((resolve3) => {
+      timer = setTimeout(() => resolve3("timeout"), timeoutMs);
+      timer.unref?.();
+    });
+    const outcome = await Promise.race([work.then(() => "drained"), timeout]);
+    if (timer) clearTimeout(timer);
+    this.closed = true;
+    if (outcome === "timeout") this.queues.clear();
+  }
+  /** Closes admission and drains accepted work. */
+  async dispose() {
+    this.closeAdmission();
+    await this.drain();
+    this.closed = true;
+  }
+  async processQueue(scopeKey3, queue) {
+    while (queue.events.length > 0) {
+      const event = queue.events.shift();
+      try {
+        if (!this.closed) await this.publish(event);
+      } finally {
+        queue.keys.delete(event.eventKey);
+        this.pendingCount -= 1;
+      }
+    }
+    if (queue.events.length === 0 && this.queues.get(scopeKey3) === queue) this.queues.delete(scopeKey3);
+  }
+  async publish(event) {
+    try {
+      const taskValue = await this.deps.tasks.getById(event.tenantId, event.taskId);
+      const task = taskValue === null ? void 0 : snapshotTaskItem(taskValue);
+      if (this.closed) return;
+      if (!task || !isProjectLifecycleTask6(task) || task.tenantId !== event.tenantId || task.workspaceId !== event.workspaceId || task.projectId !== event.projectId || task.status !== event.status || task.updatedAt.toISOString() !== event.updatedAt || event.threadId !== void 0 && task.context?.thread_id !== event.threadId) {
+        this.warn("project-room:task-event-stale", { taskId: safeId3(event.taskId), eventKey: safeId3(event.eventKey) });
+        return;
+      }
+      const roomValue = await this.deps.rooms.getMainRoom(event.tenantId, event.projectId);
+      const room = snapshotProjectRoom(roomValue);
+      if (this.closed) return;
+      if (!room || room.tenantId !== event.tenantId || room.workspaceId !== event.workspaceId || room.projectId !== event.projectId) return;
+      const membershipValue = await this.deps.memberships.findByAssistant(event.tenantId, event.projectId, task.ownerId);
+      const membership = snapshotProjectBotMembership(membershipValue);
+      if (this.closed) return;
+      if (!membership || membership.tenantId !== event.tenantId || membership.workspaceId !== event.workspaceId || membership.projectId !== event.projectId || membership.roomId !== room.id || membership.assistantId !== task.ownerId) return;
+      this.deps.realtime.taskChanged({
+        tenantId: event.tenantId,
+        roomId: room.id,
+        projectId: event.projectId,
+        taskId: task.id,
+        status: task.status,
+        ownerMembershipId: membership.id,
+        updatedAt: task.updatedAt.toISOString(),
+        sourceKey: `task:${task.id}:${event.eventKey}`
+      });
+    } catch (error) {
+      this.warn("project-room:task-realtime-failed", { code: "TASK_REALTIME_NOTIFICATION_FAILED", taskId: safeId3(event.taskId), error: error instanceof Error ? error.name : "UnknownError" });
+    }
+  }
+  parse(value) {
+    const row = snapshotExactRecord11(value, ["tenantId", "workspaceId", "projectId", "taskId", "status", "action", "eventKey", "updatedAt"], ["threadId"]);
+    const actions = ["in_progress", "interrupted", "failed", "completed", "cancelled", "reassigned"];
+    const statuses = ["pending", "in_progress", "review", "failed", "interrupted", "completed", "cancelled"];
+    if (!row || !actions.includes(String(row.action)) || !statuses.includes(String(row.status)) || !["tenantId", "workspaceId", "projectId", "taskId", "eventKey", "updatedAt"].every((key) => typeof row[key] === "string" && row[key].length > 0) || !Number.isFinite(Date.parse(row.updatedAt)) || row.threadId !== void 0 && typeof row.threadId !== "string") return void 0;
+    return row;
+  }
+  warn(message, context) {
+    try {
+      this.deps.log.warn(message, context);
+    } catch {
+    }
+  }
+  overflow(taskId) {
+    this.warn("project-room:task-realtime-overflow", { code: "TASK_REALTIME_QUEUE_FULL", taskId });
+    return Promise.resolve();
+  }
+};
+function safeId3(value) {
+  return typeof value === "string" && value.length > 0 ? value : void 0;
+}
+
+// src/services/collaboration/ProjectRoomRealtimeRuntime.ts
+var ProjectRoomRealtimeRuntime = class {
+  constructor(deps) {
+    this.deps = deps;
+    this.accepted = /* @__PURE__ */ new Set();
+    this.broker = deps.broker;
+    this.publisher = deps.publisher;
+    this.shutdownTimeoutMs = deps.shutdownTimeoutMs ?? 5e3;
+    this.unsubscribe = deps.subscribe(((event) => {
+      let work;
+      try {
+        work = Promise.resolve(deps.subscriber.handle(event));
+      } catch (error) {
+        work = Promise.reject(error);
+      }
+      const accepted = work.catch((error) => {
+        deps.log.warn("project-room:task-subscriber-failed", { error: error instanceof Error ? error.name : "UnknownError" });
+      });
+      this.accepted.add(accepted);
+      void accepted.finally(() => this.accepted.delete(accepted));
+    }));
+  }
+  /** Stops admission, drains accepted work, and closes transport resources exactly once. */
+  close() {
+    this.closing ?? (this.closing = this.dispose());
+    return this.closing;
+  }
+  async dispose() {
+    this.unsubscribe();
+    this.deps.subscriber.closeAdmission();
+    const accepted = [...this.accepted];
+    const drained = await boundedAllSettled(accepted, this.shutdownTimeoutMs);
+    if (!drained) this.deps.log.warn("project-room:runtime-drain-timeout", {
+      timeoutMs: this.shutdownTimeoutMs,
+      pending: accepted.length
+    });
+    await this.deps.subscriber.drain(drained ? this.shutdownTimeoutMs : 0);
+    this.broker.close();
+  }
+};
+function createProjectRoomRealtimeRuntime(deps) {
+  const broker = new ProjectRoomEventBroker({ log: deps.log });
+  const publisher = new BrokerProjectRoomRealtimePublisher({ broker, log: deps.log });
+  const subscriber = new ProjectRoomTaskEventSubscriber({
+    tasks: deps.tasks,
+    rooms: deps.rooms,
+    memberships: deps.memberships,
+    realtime: publisher,
+    log: deps.log
+  });
+  return new ProjectRoomRealtimeRuntime({
+    broker,
+    publisher,
+    subscriber,
+    subscribe: (listener) => taskLifecycleNotifier.subscribe(listener),
+    log: deps.log,
+    shutdownTimeoutMs: deps.shutdownTimeoutMs
+  });
+}
+async function boundedAllSettled(promises, timeoutMs) {
+  if (promises.length === 0) return true;
+  let timer;
+  const timeout = new Promise((resolve3) => {
+    timer = setTimeout(() => resolve3(false), timeoutMs);
+    timer.unref?.();
+  });
+  const result = await Promise.race([Promise.allSettled(promises).then(() => true), timeout]);
+  if (timer) clearTimeout(timer);
+  return result;
+}
+
+// src/services/collaboration/WorkspaceRoomEventsService.ts
+import { PROJECT_ROOM_USER_CHANNEL_PROJECT, projectRoomUserEventScope as projectRoomUserEventScope2 } from "@axiom-lattice/protocols";
 
 // src/services/collaboration/ProjectRoomSseWriter.ts
 var DEFAULT_MAX_FRAMES = 256;
@@ -17735,6 +18097,10 @@ var ProjectRoomSseWriter = class {
   enqueueControl(event) {
     this.enqueue(serializeControl(event));
   }
+  /** Enqueues a pre-serialized SSE frame (used by scoped multi-room streams). */
+  enqueueRaw(frame) {
+    this.enqueue(frame);
+  }
   /** Writes a heartbeat comment when the socket is not currently blocked. */
   heartbeat() {
     if (!this.closed && !this.writing) this.writeFrame(": heartbeat\n\n");
@@ -17825,453 +18191,269 @@ var ProjectRoomSseWriter = class {
         this.blockedBytes = 0;
         (finish ?? (() => this.close()))();
       }
-    } catch {
-      this.close();
-    }
-  }
-  armTerminalDeadline(deadlineMs, finish) {
-    this.terminalTimer = setTimeout(finish, deadlineMs);
-    this.terminalTimer.unref?.();
-  }
-  writeFrame(frame) {
-    if (this.closed) return;
-    try {
-      if (!this.raw.write(frame)) {
-        this.writing = true;
-        this.blockedBytes = Buffer.byteLength(frame, "utf8");
-        this.drainTimer = setTimeout(() => {
-          this.drainTimer = void 0;
-          this.failSlowConsumer();
-        }, this.drainTimeoutMs);
-        this.drainTimer.unref?.();
-      } else {
-        this.writing = false;
-        this.blockedBytes = 0;
-        this.flush();
-      }
-    } catch {
-      this.close();
-    }
-  }
-  clearDrainTimer() {
-    if (this.drainTimer !== void 0) clearTimeout(this.drainTimer);
-    this.drainTimer = void 0;
-  }
-  failSlowConsumer() {
-    if (this.closed) return;
-    this.frames.length = 0;
-    this.queuedBytes = 0;
-    if (!this.slowConsumerAttempted) {
-      this.slowConsumerAttempted = true;
-      try {
-        this.raw.write(serializeControl({ type: "resync", data: { reason: "SLOW_CONSUMER" } }));
-      } catch {
-      }
-    }
-    this.close();
-  }
-};
-function positive(value, name) {
-  if (!Number.isSafeInteger(value) || value <= 0) throw new RangeError(`${name} must be positive`);
-  return value;
-}
-
-// src/services/collaboration/ProjectRoomRealtimeService.ts
-var MAX_REPLAY_EVENTS = 1e4;
-var MAX_NODE_TIMER_DELAY = 2147e6;
-var ProjectRoomRealtimeService = class {
-  /** Creates a service using one process-local broker and read-only authorizer. */
-  constructor(deps) {
-    this.deps = deps;
-    this.connections = /* @__PURE__ */ new Set();
-    this.closed = false;
-    this.activeConnections = /* @__PURE__ */ new Map();
-    this.now = deps.now ?? Date.now;
-    this.authRecheckMs = deps.authRecheckMs ?? 15e3;
-    this.heartbeatMs = deps.heartbeatMs ?? 15e3;
-  }
-  /** Returns whether the actor's tenant/user/project stream quota has capacity. */
-  canConnect(actor2) {
-    if (this.closed) return false;
-    return (this.activeConnections.get(connectionKey(actor2)) ?? 0) < (this.deps.maxConnectionsPerUserProject ?? 5);
-  }
-  /** Starts a connection; authorization is assumed to have been performed by the route. */
-  connect(input) {
-    if (!this.canConnect(input.actor)) {
-      input.raw.end();
-      return;
-    }
-    const quotaKey = connectionKey(input.actor);
-    this.activeConnections.set(quotaKey, (this.activeConnections.get(quotaKey) ?? 0) + 1);
-    const writer = new ProjectRoomSseWriter(input.raw, { onClose: () => connection.close() });
-    let phase = "initializing";
-    let subscription;
-    let accessTimer;
-    let heartbeatTimer;
-    let expiryTimer;
-    const lifetimeAbort = new AbortController();
-    let accessAbort;
-    let closed = false;
-    const buffered = [];
-    const clearTimer = (timer) => {
-      if (timer !== void 0) clearTimeout(timer);
-    };
-    const cleanup = () => {
-      if (closed) return;
-      closed = true;
-      phase = "closed";
-      clearTimer(accessTimer);
-      clearTimer(heartbeatTimer);
-      clearTimer(expiryTimer);
-      lifetimeAbort.abort();
-      accessAbort?.abort();
-      subscription?.unsubscribe();
-      writer.close();
-      this.connections.delete(connection);
-      const remainingConnections = (this.activeConnections.get(quotaKey) ?? 1) - 1;
-      if (remainingConnections === 0) this.activeConnections.delete(quotaKey);
-      else this.activeConnections.set(quotaKey, remainingConnections);
-    };
-    const revoke = (reason) => {
-      if (closed) return;
-      void writer.closeWithControl({ type: "access.revoked", data: { reason } }).then(cleanup, cleanup);
-    };
-    const scheduleAccessCheck = () => {
-      if (closed) return;
-      accessTimer = setTimeout(() => {
-        accessTimer = void 0;
-        if (closed) return;
-        accessAbort = new AbortController();
-        const combined = combineSignals2(lifetimeAbort.signal, accessAbort.signal);
-        Promise.resolve().then(() => this.deps.requireReadAccess(input.actor, combined.signal)).then(() => {
-          combined.cleanup();
-          accessAbort = void 0;
-          scheduleAccessCheck();
-        }, (_error) => {
-          combined.cleanup();
-          accessAbort = void 0;
-          if (!closed) revoke("PROJECT_ACCESS_REVOKED");
-        });
-      }, this.authRecheckMs);
-      accessTimer.unref?.();
-    };
-    const connection = { close: cleanup };
-    this.connections.add(connection);
-    const scheduleHeartbeat = () => {
-      if (closed) return;
-      heartbeatTimer = setTimeout(() => {
-        heartbeatTimer = void 0;
-        if (closed) return;
-        writer.heartbeat();
-        scheduleHeartbeat();
-      }, this.heartbeatMs);
-      heartbeatTimer.unref?.();
-    };
-    scheduleHeartbeat();
-    const remaining = input.actor.tokenExpiresAt - this.now();
-    if (remaining <= 0) {
-      revoke("TOKEN_EXPIRED");
-      return;
-    }
-    const maxTimerDelay = this.deps.maxTimerDelay ?? MAX_NODE_TIMER_DELAY;
-    const scheduleExpiry = () => {
-      if (closed) return;
-      const delay2 = input.actor.tokenExpiresAt - this.now();
-      if (delay2 <= 0) {
-        revoke("TOKEN_EXPIRED");
-        return;
-      }
-      expiryTimer = setTimeout(() => {
-        expiryTimer = void 0;
-        scheduleExpiry();
-      }, Math.min(delay2, maxTimerDelay));
-      expiryTimer.unref?.();
-    };
-    scheduleExpiry();
-    try {
-      subscription = this.deps.broker.subscribe(
-        { tenantId: input.actor.tenantId, roomId: input.roomId, projectId: input.actor.projectId },
-        input.lastEventId,
-        (event) => {
-          if (phase === "initializing") buffered.push(event);
-          else if (phase === "direct") writer.enqueueBusiness(event);
-        }
-      );
-      if (subscription.replay.length > MAX_REPLAY_EVENTS) {
-        void writer.closeWithControl({ type: "resync", data: { reason: "CURSOR_EXPIRED" } }).then(cleanup, cleanup);
-        return;
-      }
-      let lastSequence = sequence(subscription.headEventId);
-      for (const event of subscription.replay) {
-        writer.enqueueBusiness(event);
-        lastSequence = sequence(event.id);
-      }
-      writer.enqueueControl({ type: "ready", data: { epoch: this.deps.broker.epoch, headEventId: subscription.headEventId } });
-      while (buffered.length > 0) {
-        for (const event of buffered.splice(0).sort((left, right) => sequence(left.id) - sequence(right.id))) {
-          if (sequence(event.id) > lastSequence) {
-            writer.enqueueBusiness(event);
-            lastSequence = sequence(event.id);
-          }
-        }
-      }
-      phase = "direct";
-      scheduleAccessCheck();
-    } catch (error) {
-      if (error instanceof ProjectRoomCursorError2) void writer.closeWithControl({ type: "resync", data: { reason: error.code } }).then(cleanup, cleanup);
-      else cleanup();
-    }
-  }
-  /** Closes every connection and prevents new connections. */
-  close() {
-    if (this.closed) return;
-    this.closed = true;
-    for (const connection of [...this.connections]) connection.close();
-  }
-};
-function sequence(id3) {
-  return id3 === null ? 0 : Number(id3.slice(id3.lastIndexOf(":") + 1));
-}
-function connectionKey(actor2) {
-  return JSON.stringify([actor2.tenantId, actor2.userId, actor2.projectId]);
-}
-function combineSignals2(first, second) {
-  const controller = new AbortController();
-  const abort = () => controller.abort();
-  if (first.aborted || second.aborted) abort();
-  else {
-    first.addEventListener("abort", abort, { once: true });
-    second.addEventListener("abort", abort, { once: true });
-  }
-  return { signal: controller.signal, cleanup: () => {
-    first.removeEventListener("abort", abort);
-    second.removeEventListener("abort", abort);
-  } };
-}
-
-// src/services/collaboration/ProjectRoomTaskEventSubscriber.ts
-import { isProjectLifecycleTask as isProjectLifecycleTask6 } from "@axiom-lattice/core";
-import { snapshotExactRecord as snapshotExactRecord11 } from "@axiom-lattice/protocols";
-var ProjectRoomTaskEventSubscriber = class {
-  /** Creates a bounded Project task lifecycle observer. */
-  constructor(deps) {
-    this.deps = deps;
-    this.queues = /* @__PURE__ */ new Map();
-    this.pendingCount = 0;
-    this.accepting = true;
-    this.closed = false;
-    this.accepted = /* @__PURE__ */ new Set();
-    this.maxPending = deps.maxPending ?? 1024;
-    if (!Number.isSafeInteger(this.maxPending) || this.maxPending < 1) throw new RangeError("maxPending must be a positive safe integer");
-  }
-  /** Admits one notification without awaiting any store operation. */
-  handle(value) {
-    const event = this.parse(value);
-    if (!event) {
-      this.warn("Project task realtime notification rejected", { code: "INVALID_TASK_REALTIME_EVENT" });
-      return Promise.resolve();
-    }
-    if (!this.accepting || this.closed) return Promise.resolve();
-    const scopeKey3 = JSON.stringify([event.tenantId, event.workspaceId, event.projectId, event.taskId]);
-    const eventKey = event.eventKey;
-    let queue = this.queues.get(scopeKey3);
-    if (!queue) {
-      if (this.pendingCount >= this.maxPending) return this.overflow(event.taskId);
-      queue = { events: [], keys: /* @__PURE__ */ new Set(), tail: Promise.resolve() };
-      this.queues.set(scopeKey3, queue);
-    }
-    if (queue.keys.has(eventKey)) return queue.tail;
-    if (this.pendingCount >= this.maxPending) return this.overflow(event.taskId);
-    queue.keys.add(eventKey);
-    queue.events.push(event);
-    this.pendingCount += 1;
-    const previousTail = queue.tail;
-    queue.tail = previousTail.then(() => this.processQueue(scopeKey3, queue)).catch((error) => {
-      this.warn("project-room:task-realtime-failed", { code: "TASK_REALTIME_NOTIFICATION_FAILED", error: error instanceof Error ? error.name : "UnknownError" });
-    });
-    const accepted = queue.tail;
-    this.accepted.add(accepted);
-    void accepted.finally(() => this.accepted.delete(accepted));
-    return accepted;
-  }
-  /** Closes admission without interrupting accepted work. */
-  closeAdmission() {
-    this.accepting = false;
-  }
-  /** Drains accepted work, closing permanently if the bound expires. */
-  async drain(timeoutMs = 5e3) {
-    const work = Promise.allSettled([...this.accepted]).then(() => void 0);
-    let timer;
-    const timeout = new Promise((resolve3) => {
-      timer = setTimeout(() => resolve3("timeout"), timeoutMs);
-      timer.unref?.();
-    });
-    const outcome = await Promise.race([work.then(() => "drained"), timeout]);
-    if (timer) clearTimeout(timer);
-    this.closed = true;
-    if (outcome === "timeout") this.queues.clear();
-  }
-  /** Closes admission and drains accepted work. */
-  async dispose() {
-    this.closeAdmission();
-    await this.drain();
-    this.closed = true;
-  }
-  async processQueue(scopeKey3, queue) {
-    while (queue.events.length > 0) {
-      const event = queue.events.shift();
-      try {
-        if (!this.closed) await this.publish(event);
-      } finally {
-        queue.keys.delete(event.eventKey);
-        this.pendingCount -= 1;
-      }
-    }
-    if (queue.events.length === 0 && this.queues.get(scopeKey3) === queue) this.queues.delete(scopeKey3);
-  }
-  async publish(event) {
-    try {
-      const taskValue = await this.deps.tasks.getById(event.tenantId, event.taskId);
-      const task = taskValue === null ? void 0 : snapshotTaskItem(taskValue);
-      if (this.closed) return;
-      if (!task || !isProjectLifecycleTask6(task) || task.tenantId !== event.tenantId || task.workspaceId !== event.workspaceId || task.projectId !== event.projectId || task.status !== event.status || task.updatedAt.toISOString() !== event.updatedAt || event.threadId !== void 0 && task.context?.thread_id !== event.threadId) {
-        this.warn("project-room:task-event-stale", { taskId: safeId3(event.taskId), eventKey: safeId3(event.eventKey) });
-        return;
-      }
-      const roomValue = await this.deps.rooms.getMainRoom(event.tenantId, event.projectId);
-      const room = snapshotProjectRoom(roomValue);
-      if (this.closed) return;
-      if (!room || room.tenantId !== event.tenantId || room.workspaceId !== event.workspaceId || room.projectId !== event.projectId) return;
-      const membershipValue = await this.deps.memberships.findByAssistant(event.tenantId, event.projectId, task.ownerId);
-      const membership = snapshotProjectBotMembership(membershipValue);
-      if (this.closed) return;
-      if (!membership || membership.tenantId !== event.tenantId || membership.workspaceId !== event.workspaceId || membership.projectId !== event.projectId || membership.roomId !== room.id || membership.assistantId !== task.ownerId) return;
-      this.deps.realtime.taskChanged({
-        tenantId: event.tenantId,
-        roomId: room.id,
-        projectId: event.projectId,
-        taskId: task.id,
-        status: task.status,
-        ownerMembershipId: membership.id,
-        updatedAt: task.updatedAt.toISOString(),
-        sourceKey: `task:${task.id}:${event.eventKey}`
-      });
-    } catch (error) {
-      this.warn("project-room:task-realtime-failed", { code: "TASK_REALTIME_NOTIFICATION_FAILED", taskId: safeId3(event.taskId), error: error instanceof Error ? error.name : "UnknownError" });
+    } catch {
+      this.close();
     }
   }
-  parse(value) {
-    const row = snapshotExactRecord11(value, ["tenantId", "workspaceId", "projectId", "taskId", "status", "action", "eventKey", "updatedAt"], ["threadId"]);
-    const actions = ["in_progress", "interrupted", "failed", "completed", "cancelled", "reassigned"];
-    const statuses = ["pending", "in_progress", "review", "failed", "interrupted", "completed", "cancelled"];
-    if (!row || !actions.includes(String(row.action)) || !statuses.includes(String(row.status)) || !["tenantId", "workspaceId", "projectId", "taskId", "eventKey", "updatedAt"].every((key) => typeof row[key] === "string" && row[key].length > 0) || !Number.isFinite(Date.parse(row.updatedAt)) || row.threadId !== void 0 && typeof row.threadId !== "string") return void 0;
-    return row;
+  armTerminalDeadline(deadlineMs, finish) {
+    this.terminalTimer = setTimeout(finish, deadlineMs);
+    this.terminalTimer.unref?.();
   }
-  warn(message, context) {
+  writeFrame(frame) {
+    if (this.closed) return;
     try {
-      this.deps.log.warn(message, context);
+      if (!this.raw.write(frame)) {
+        this.writing = true;
+        this.blockedBytes = Buffer.byteLength(frame, "utf8");
+        this.drainTimer = setTimeout(() => {
+          this.drainTimer = void 0;
+          this.failSlowConsumer();
+        }, this.drainTimeoutMs);
+        this.drainTimer.unref?.();
+      } else {
+        this.writing = false;
+        this.blockedBytes = 0;
+        this.flush();
+      }
     } catch {
+      this.close();
     }
   }
-  overflow(taskId) {
-    this.warn("project-room:task-realtime-overflow", { code: "TASK_REALTIME_QUEUE_FULL", taskId });
-    return Promise.resolve();
+  clearDrainTimer() {
+    if (this.drainTimer !== void 0) clearTimeout(this.drainTimer);
+    this.drainTimer = void 0;
+  }
+  failSlowConsumer() {
+    if (this.closed) return;
+    this.frames.length = 0;
+    this.queuedBytes = 0;
+    if (!this.slowConsumerAttempted) {
+      this.slowConsumerAttempted = true;
+      try {
+        this.raw.write(serializeControl({ type: "resync", data: { reason: "SLOW_CONSUMER" } }));
+      } catch {
+      }
+    }
+    this.close();
   }
 };
-function safeId3(value) {
-  return typeof value === "string" && value.length > 0 ? value : void 0;
+function positive(value, name) {
+  if (!Number.isSafeInteger(value) || value <= 0) throw new RangeError(`${name} must be positive`);
+  return value;
 }
 
-// src/services/collaboration/ProjectRoomRealtimeRuntime.ts
-var ProjectRoomRealtimeRuntime = class {
+// src/services/collaboration/WorkspaceRoomEventsService.ts
+var MAX_NODE_TIMER_DELAY = 2147e6;
+var WorkspaceRoomEventsService = class {
+  /** Creates a service over the shared process-local broker. */
   constructor(deps) {
     this.deps = deps;
-    this.accepted = /* @__PURE__ */ new Set();
-    this.broker = deps.broker;
-    this.publisher = deps.publisher;
-    this.service = deps.service;
-    this.shutdownTimeoutMs = deps.shutdownTimeoutMs ?? 5e3;
-    this.unsubscribe = deps.subscribe(((event) => {
-      let work;
-      try {
-        work = Promise.resolve(deps.subscriber.handle(event));
-      } catch (error) {
-        work = Promise.reject(error);
-      }
-      const accepted = work.catch((error) => {
-        deps.log.warn("project-room:task-subscriber-failed", { error: error instanceof Error ? error.name : "UnknownError" });
-      });
-      this.accepted.add(accepted);
-      void accepted.finally(() => this.accepted.delete(accepted));
-    }));
+    this.connections = /* @__PURE__ */ new Map();
+    this.closed = false;
+    this.now = deps.now ?? Date.now;
+    this.heartbeatMs = deps.heartbeatMs ?? 15e3;
+    this.authRecheckMs = deps.authRecheckMs ?? 15e3;
+    this.maxConnectionsPerUser = deps.maxConnectionsPerUser ?? 2;
+    this.maxTimerDelay = deps.maxTimerDelay ?? MAX_NODE_TIMER_DELAY;
   }
-  /** Stops admission, drains accepted work, and closes transport resources exactly once. */
+  /** Starts a live-only connection; the route performs authentication beforehand. */
+  connect(input) {
+    if (this.closed) {
+      input.raw.end();
+      return;
+    }
+    const userKey = JSON.stringify([input.actor.tenantId, input.actor.userId]);
+    const active = this.connections.get(userKey) ?? /* @__PURE__ */ new Set();
+    if (active.size >= this.maxConnectionsPerUser) {
+      const oldest = [...active].sort((left, right) => left.startedAt - right.startedAt)[0];
+      oldest?.supersede();
+    }
+    const connection = this.buildConnection(input.actor, input.workspaceId, input.raw);
+    active.add(connection);
+    this.connections.set(userKey, active);
+  }
+  /** Closes every connection and stops admitting new ones. */
   close() {
-    this.closing ?? (this.closing = this.dispose());
-    return this.closing;
+    if (this.closed) return;
+    this.closed = true;
+    for (const active of [...this.connections.values()]) for (const connection of [...active]) connection.close();
+    this.connections.clear();
   }
-  async dispose() {
-    this.unsubscribe();
-    this.deps.subscriber.closeAdmission();
-    const accepted = [...this.accepted];
-    const drained = await boundedAllSettled(accepted, this.shutdownTimeoutMs);
-    if (!drained) this.deps.log.warn("project-room:runtime-drain-timeout", {
-      timeoutMs: this.shutdownTimeoutMs,
-      pending: accepted.length
+  buildConnection(actor2, workspaceId, raw) {
+    let phase = "initializing";
+    const subscriptions = /* @__PURE__ */ new Map();
+    let heartbeatTimer;
+    let accessTimer;
+    let expiryTimer;
+    let closed = false;
+    const recordRef = {};
+    let rebuildTail = Promise.resolve(true);
+    const lifetimeAbort = new AbortController();
+    const clear = (timer) => {
+      if (timer !== void 0) clearTimeout(timer);
+    };
+    const userScope = projectRoomUserEventScope2(actor2.tenantId, actor2.userId);
+    const userScopeKey = JSON.stringify([userScope.tenantId, userScope.roomId, userScope.projectId]);
+    const roomScopeKey = (scope) => JSON.stringify([scope.tenantId, scope.roomId, scope.projectId]);
+    const serializeScoped = (scope, event) => scope === null ? `id: ${event.id}
+event: ${event.type}
+data: ${JSON.stringify(event)}
+
+` : `id: ${event.id}
+event: ${event.type}
+data: ${JSON.stringify({ ...event, scope })}
+
+`;
+    const writer = new ProjectRoomSseWriter(raw, { onClose: () => cleanup() });
+    const cleanup = () => {
+      if (closed) return;
+      closed = true;
+      phase = "closed";
+      clear(heartbeatTimer);
+      clear(accessTimer);
+      clear(expiryTimer);
+      lifetimeAbort.abort();
+      for (const entry of subscriptions.values()) entry.unsubscribe();
+      subscriptions.clear();
+      writer.close();
+      const userKey = JSON.stringify([actor2.tenantId, actor2.userId]);
+      const active = this.connections.get(userKey);
+      if (active && recordRef.current !== void 0) {
+        active.delete(recordRef.current);
+        if (active.size === 0) this.connections.delete(userKey);
+      }
+    };
+    const revoke = (reason) => {
+      if (closed) return;
+      void writer.closeWithControl({ type: "access.revoked", data: { reason } }).then(cleanup, cleanup);
+    };
+    const record = {
+      startedAt: this.now(),
+      supersede: () => revoke("CONNECTION_SUPERSEDED"),
+      close: cleanup
+    };
+    recordRef.current = record;
+    const rebuildSubscriptions = async () => {
+      try {
+        const rooms = await this.deps.listMemberRooms({ tenantId: actor2.tenantId, userId: actor2.userId, workspaceId });
+        if (closed) return true;
+        const wanted = /* @__PURE__ */ new Map();
+        for (const room of rooms) {
+          const scope = { tenantId: actor2.tenantId, roomId: room.roomId, projectId: room.projectId };
+          wanted.set(roomScopeKey(scope), scope);
+        }
+        for (const [key, entry] of [...subscriptions]) {
+          if (key === userScopeKey || wanted.has(key)) continue;
+          entry.unsubscribe();
+          subscriptions.delete(key);
+        }
+        for (const [key, scope] of wanted) {
+          if (subscriptions.has(key)) continue;
+          const subscription = this.deps.broker.subscribe(scope, void 0, roomListener(scope));
+          subscriptions.set(key, { scope, unsubscribe: subscription.unsubscribe });
+        }
+        if (!subscriptions.has(userScopeKey)) {
+          const subscription = this.deps.broker.subscribe(userScope, void 0, userListener);
+          subscriptions.set(userScopeKey, { scope: userScope, unsubscribe: subscription.unsubscribe });
+        }
+        return true;
+      } catch (error) {
+        this.deps.log.warn("workspace-room-events:resubscribe-failed", {
+          error: error instanceof Error ? error.message : String(error)
+        });
+        return false;
+      }
+    };
+    const enqueueRebuild = () => {
+      rebuildTail = rebuildTail.then(rebuildSubscriptions, rebuildSubscriptions);
+    };
+    const userListener = (event) => {
+      if (phase === "live") writer.enqueueRaw(serializeScoped(null, event));
+      if (event.type === "membership.affected") enqueueRebuild();
+    };
+    const roomListener = (scope) => (event) => {
+      if (phase === "live") writer.enqueueRaw(serializeScoped(scope, event));
+    };
+    const scheduleExpiry = () => {
+      if (closed) return;
+      const delay2 = actor2.tokenExpiresAt - this.now();
+      if (delay2 <= 0) {
+        revoke("TOKEN_EXPIRED");
+        return;
+      }
+      expiryTimer = setTimeout(() => {
+        expiryTimer = void 0;
+        scheduleExpiry();
+      }, Math.min(delay2, this.maxTimerDelay));
+      expiryTimer.unref?.();
+    };
+    const scheduleHeartbeat = () => {
+      if (closed) return;
+      heartbeatTimer = setTimeout(() => {
+        heartbeatTimer = void 0;
+        if (closed) return;
+        writer.heartbeat();
+        scheduleHeartbeat();
+      }, this.heartbeatMs);
+      heartbeatTimer.unref?.();
+    };
+    const scheduleAccessCheck = () => {
+      if (closed) return;
+      accessTimer = setTimeout(() => {
+        accessTimer = void 0;
+        if (closed) return;
+        const projectIds = [...subscriptions.values()].map((entry) => entry.scope.projectId).filter((projectId) => projectId !== PROJECT_ROOM_USER_CHANNEL_PROJECT);
+        Promise.all(projectIds.map((projectId) => Promise.resolve().then(() => this.deps.requireReadAccess({ tenantId: actor2.tenantId, userId: actor2.userId, projectId })))).then(() => {
+          if (!closed) scheduleAccessCheck();
+        }, () => {
+          if (!closed) revoke("PROJECT_ACCESS_REVOKED");
+        });
+      }, this.authRecheckMs);
+      accessTimer.unref?.();
+    };
+    scheduleHeartbeat();
+    enqueueRebuild();
+    const initialRebuild = rebuildTail;
+    void initialRebuild.then((ok) => {
+      if (closed) return;
+      if (!ok) {
+        cleanup();
+        return;
+      }
+      writer.enqueueControl({ type: "ready", data: { epoch: this.deps.broker.epoch, headEventId: null } });
+      phase = "live";
+      scheduleExpiry();
+      scheduleAccessCheck();
     });
-    await this.deps.subscriber.drain(drained ? this.shutdownTimeoutMs : 0);
-    this.service.close();
-    this.broker.close();
+    return record;
   }
 };
-function createProjectRoomRealtimeRuntime(deps) {
-  const broker = new ProjectRoomEventBroker({ log: deps.log });
-  const publisher = new BrokerProjectRoomRealtimePublisher({ broker, log: deps.log });
-  const service2 = new ProjectRoomRealtimeService({ broker, log: deps.log, requireReadAccess: deps.requireReadAccess });
-  const subscriber = new ProjectRoomTaskEventSubscriber({
-    tasks: deps.tasks,
-    rooms: deps.rooms,
-    memberships: deps.memberships,
-    realtime: publisher,
-    log: deps.log
-  });
-  return new ProjectRoomRealtimeRuntime({
-    broker,
-    publisher,
-    service: service2,
-    subscriber,
-    subscribe: (listener) => taskLifecycleNotifier.subscribe(listener),
-    log: deps.log,
-    shutdownTimeoutMs: deps.shutdownTimeoutMs
-  });
-}
-async function boundedAllSettled(promises, timeoutMs) {
-  if (promises.length === 0) return true;
-  let timer;
-  const timeout = new Promise((resolve3) => {
-    timer = setTimeout(() => resolve3(false), timeoutMs);
-    timer.unref?.();
-  });
-  const result = await Promise.race([Promise.allSettled(promises).then(() => true), timeout]);
-  if (timer) clearTimeout(timer);
-  return result;
+
+// src/services/collaboration/WorkspaceMemberRoomLister.ts
+function createWorkspaceMemberRoomLister(deps) {
+  return async (input) => {
+    const projects = await deps.projects.getProjectsByWorkspace(input.tenantId, input.workspaceId);
+    const memberRooms = [];
+    for (const project of projects) {
+      const membership = await deps.memberships.findByUser(input.tenantId, project.id, input.userId);
+      if (!membership || membership.status !== "active") continue;
+      const room = await deps.rooms.getMainRoom(input.tenantId, project.id);
+      if (room) memberRooms.push({ projectId: project.id, roomId: room.id });
+    }
+    return memberRooms;
+  };
 }
 
-// src/routes/project-room-events.ts
-import { isProjectRoomEventId, snapshotExactRecord as snapshotExactRecord12 } from "@axiom-lattice/protocols";
-function registerProjectRoomEventRoutes(app2, deps) {
-  app2.get("/api/projects/:projectId/room/events", async (request, reply) => {
+// src/routes/workspace-room-events.ts
+import { snapshotExactRecord as snapshotExactRecord12 } from "@axiom-lattice/protocols";
+function registerWorkspaceRoomEventRoutes(app2, deps) {
+  app2.get("/api/workspaces/:workspaceId/room-events", async (request, reply) => {
     try {
-      const projectId = exactProjectId(request.params);
-      const headers = strictHeaders(request, true);
+      const params = exactParams(request.params);
+      const headers = strictHeaders(request);
       if (request.body !== void 0 || Object.keys(request.query).length !== 0) return invalid(reply);
       const session = verifyConsoleSessionAuthHeader(headers.authorization, deps.tokenSecret);
       if (!session?.tenantId) return unauthorized(reply);
-      await deps.access.requireExistingProjectAccess({ tenantId: session.tenantId, userId: session.id, projectId, capability: "read" });
-      const room = exactRoom(await deps.rooms.getMainRoom(session.tenantId, projectId), session.tenantId, projectId);
-      if (!room) return reply.code(404).send({ success: false, error: { code: "PROJECT_ROOM_NOT_FOUND", message: "Project room not found", retryable: false } });
-      const actor2 = { tenantId: session.tenantId, userId: session.id, projectId, tokenExpiresAt: session.expiresAt };
-      if (!deps.realtime.canConnect(actor2)) return reply.code(429).send({ success: false, error: { code: "PROJECT_ROOM_STREAM_LIMIT", message: "Project room stream limit reached", retryable: true } });
       reply.hijack();
       reply.raw.writeHead(200, {
         "Content-Type": "text/event-stream",
@@ -18280,53 +18462,35 @@ function registerProjectRoomEventRoutes(app2, deps) {
         "X-Accel-Buffering": "no",
         "Access-Control-Allow-Origin": "*"
       });
-      deps.realtime.connect({ actor: actor2, roomId: room.id, ...headers.lastEventId ? { lastEventId: headers.lastEventId } : {}, raw: reply.raw });
-    } catch (error) {
-      return routeError(reply, error);
-    }
-  });
-  app2.get("/api/projects/:projectId/room/realtime-mode", async (request, reply) => {
-    try {
-      const projectId = exactProjectId(request.params);
-      const headers = strictHeaders(request, false);
-      if (request.body !== void 0 || Object.keys(request.query).length !== 0) return invalid(reply);
-      const session = verifyConsoleSessionAuthHeader(headers.authorization, deps.tokenSecret);
-      if (!session?.tenantId) return unauthorized(reply);
-      await deps.access.requireExistingProjectAccess({ tenantId: session.tenantId, userId: session.id, projectId, capability: "read" });
-      return reply.send({ success: true, data: { mode: "single-gateway", supportedGatewayProcesses: 1, durableReplay: false, epoch: deps.broker.epoch } });
+      deps.service.connect({
+        actor: { tenantId: session.tenantId, userId: session.id, tokenExpiresAt: session.expiresAt },
+        workspaceId: params.workspaceId,
+        raw: reply.raw
+      });
     } catch (error) {
       return routeError(reply, error);
     }
   });
 }
-function strictHeaders(request, requireSse) {
+function exactParams(params) {
+  const value = snapshotExactRecord12(params, ["workspaceId"]);
+  if (!value || typeof value.workspaceId !== "string" || !value.workspaceId.trim()) throw new InvalidRealtimeRequestError();
+  return { workspaceId: value.workspaceId };
+}
+function strictHeaders(request) {
   const raw = request.raw.rawHeaders;
   const values = (name) => raw.flatMap((value, index) => index % 2 === 0 && value.toLowerCase() === name ? [raw[index + 1]] : []);
   const authorization = values("authorization");
   const accept = values("accept");
   const cursor = values("last-event-id");
-  if (authorization.length !== 1 || authorization[0].includes(",") || cursor.length > 1 || cursor.some((value) => value.includes(",")) || requireSse && (accept.length !== 1 || !isSseAccept(accept[0]))) {
-    throw new InvalidRealtimeRequestError();
-  }
-  const lastEventId = cursor[0]?.trim();
-  if (lastEventId !== void 0 && (!lastEventId || !isProjectRoomEventId(lastEventId))) throw new InvalidRealtimeRequestError();
-  return { authorization: authorization[0], ...lastEventId ? { lastEventId } : {} };
+  if (authorization.length !== 1 || authorization[0].includes(",") || cursor.length > 0 || accept.length !== 1 || !isSseAccept(accept[0])) throw new InvalidRealtimeRequestError();
+  return { authorization: authorization[0] };
 }
 function isSseAccept(value) {
   if (value.includes(",")) return false;
   const [mediaType, ...parameters] = value.split(";");
   return mediaType.trim() === "text/event-stream" && parameters.every((parameter) => /^[!#$%&'*+.^_`|~0-9A-Za-z-]+\s*=\s*(?:[!#$%&'*+.^_`|~0-9A-Za-z-]+|"[^"]*")$/.test(parameter.trim()));
 }
-function exactProjectId(params) {
-  const value = snapshotExactRecord12(params, ["projectId"]);
-  if (!value || typeof value.projectId !== "string" || !value.projectId.trim()) throw new InvalidRealtimeRequestError();
-  return value.projectId;
-}
-function exactRoom(value, tenantId, projectId) {
-  if (!value || typeof value !== "object") return void 0;
-  const room = value;
-  return typeof room.id === "string" && room.id && room.tenantId === tenantId && room.projectId === projectId ? { id: room.id } : void 0;
-}
 var InvalidRealtimeRequestError = class extends Error {
 };
 function invalid(reply) {
@@ -18337,7 +18501,6 @@ function unauthorized(reply) {
 }
 function routeError(reply, error) {
   if (error instanceof InvalidRealtimeRequestError) return invalid(reply);
-  if (error instanceof ProjectCollaborationError) return reply.code(error.statusCode).send({ success: false, error: { code: error.code, message: error.message, retryable: false } });
   return reply.code(500).send({ success: false, error: { code: "INTERNAL_ERROR", message: "Internal server error", retryable: false } });
 }
 
@@ -18476,6 +18639,7 @@ var registerLatticeRoutes = (app2, channelDeps, options = {}) => {
   const projectRoomStore = getStoreLattice16("default", "projectRoom").store;
   const projectBotMembershipStore = getStoreLattice16("default", "projectBotMembership").store;
   const projectRoomMessageStore = getStoreLattice16("default", "projectRoomMessage").store;
+  const projectRoomReadStateStore = getStoreLattice16("default", "projectRoomReadState").store;
   const threadStore = getStoreLattice16("default", "thread").store;
   const taskStore = getStoreLattice16("default", "task").store;
   const taskWorkItemStore = getStoreLattice16("default", "taskWorkItem").store;
@@ -18487,23 +18651,30 @@ var registerLatticeRoutes = (app2, channelDeps, options = {}) => {
     tasks: taskStore,
     rooms: projectRoomStore,
     memberships: projectBotMembershipStore,
-    log: realtimeLog,
-    requireReadAccess: async (actor2) => {
-      await accessService.requireExistingProjectAccess({
-        tenantId: actor2.tenantId,
-        userId: actor2.userId,
-        projectId: actor2.projectId,
-        capability: "read"
-      });
-    }
+    log: realtimeLog
   }) : void 0;
   if (projectRoomRealtimeRuntime) {
     app2.addHook("onClose", async () => projectRoomRealtimeRuntime?.close());
-    registerProjectRoomEventRoutes(app2, {
-      access: accessService,
-      rooms: projectRoomStore,
-      realtime: projectRoomRealtimeRuntime.service,
+    const workspaceRoomEventsService = new WorkspaceRoomEventsService({
       broker: projectRoomRealtimeRuntime.broker,
+      listMemberRooms: createWorkspaceMemberRoomLister({
+        projects: projectStore,
+        memberships: projectMembershipStore,
+        rooms: projectRoomStore
+      }),
+      requireReadAccess: async (input) => {
+        await accessService.requireExistingProjectAccess({
+          tenantId: input.tenantId,
+          userId: input.userId,
+          projectId: input.projectId,
+          capability: "read"
+        });
+      },
+      log: realtimeLog
+    });
+    app2.addHook("onClose", async () => workspaceRoomEventsService.close());
+    registerWorkspaceRoomEventRoutes(app2, {
+      service: workspaceRoomEventsService,
       tokenSecret: resolveConsoleTokenSecret(process.env.AUTH_REQUIRED === "true")
     });
   }
@@ -18585,7 +18756,32 @@ var registerLatticeRoutes = (app2, channelDeps, options = {}) => {
     saveBot: projectBotMembershipStore.save.bind(projectBotMembershipStore),
     ensureCoordinator: (tenantId) => coordinatorProvisioner.ensure(tenantId)
   });
-  registerProjectRoomRoutes(app2, { roomService, membershipService, messageService });
+  const readStateService = {
+    mark: async (actorRef) => {
+      await accessService.requireExistingProjectAccess({ ...actorRef, capability: "read" });
+      const room = await projectRoomStore.getMainRoom(actorRef.tenantId, actorRef.projectId);
+      if (!room) return;
+      const lastReadAt = /* @__PURE__ */ new Date();
+      await projectRoomReadStateStore.markRead({ tenantId: actorRef.tenantId, roomId: room.id, userId: actorRef.userId, lastReadAt });
+      projectRoomRealtimeRuntime?.publisher.readChanged({
+        tenantId: actorRef.tenantId,
+        userId: actorRef.userId,
+        projectId: actorRef.projectId,
+        roomId: room.id,
+        lastReadAt: lastReadAt.toISOString(),
+        sourceKey: `read:${actorRef.userId}:${room.id}:${lastReadAt.getTime()}`
+      });
+    }
+  };
+  registerProjectRoomRoutes(app2, {
+    roomService,
+    membershipService,
+    messageService,
+    readStateService,
+    userDirectory: {
+      getUserById: (id3) => getStoreLattice16("default", "user").store.getUserById(id3).then((u) => u ? { name: u.name } : null)
+    }
+  });
   registerProjectRosterRoutes(app2, { service: rosterService });
   registerCoSpaceRoutes(app2, {
     projectStore: {
@@ -18607,7 +18803,11 @@ var registerLatticeRoutes = (app2, channelDeps, options = {}) => {
     },
     messageStore: {
       list: projectRoomMessageStore.list.bind(projectRoomMessageStore),
-      create: projectRoomMessageStore.create.bind(projectRoomMessageStore)
+      create: projectRoomMessageStore.create.bind(projectRoomMessageStore),
+      countAfter: projectRoomMessageStore.countAfter.bind(projectRoomMessageStore)
+    },
+    readStateStore: {
+      get: projectRoomReadStateStore.get.bind(projectRoomReadStateStore)
     },
     userTenantLinkStore: {
       getUsersByTenant: userTenantLinkStore.getUsersByTenant.bind(userTenantLinkStore)
@@ -18740,6 +18940,7 @@ var registerLatticeRoutes = (app2, channelDeps, options = {}) => {
       }
     })
   });
+  registerAgentWebAppEmbedRoutes(app2, {});
   registerA2ABridgeRoutes(app2);
   registerSTTRoutes(app2);
   app2.get("/api/local-a2a", getLocalA2AStatus);
@@ -21461,9 +21662,9 @@ var MessageRouter = class {
 };
 
 // src/channels/room/RoomChannelAdapter.ts
-import { z as z9 } from "zod";
+import { z as z10 } from "zod";
 import { snapshotExactRecord as snapshotExactRecord15 } from "@axiom-lattice/protocols";
-var roomConfigSchema = z9.object({}).strict();
+var roomConfigSchema = z10.object({}).strict();
 function createRoomChannelAdapter(writer) {
   return {
     channel: "room",
@@ -21643,7 +21844,7 @@ app.register(multipart, {
 });
 app.register(websocket);
 app.register(staticPlugin, {
-  root: typeof __dirname === "string" ? path3.join(__dirname, "../public") : path3.resolve(process.cwd(), "public"),
+  root: typeof __dirname === "string" ? path4.join(__dirname, "../public") : path4.resolve(process.cwd(), "public"),
   prefix: "/"
 });
 app.setErrorHandler((error, request, reply) => {
@@ -21694,7 +21895,7 @@ async function restoreMcpConnections() {
     const connectedConfigs = configs.filter((c2) => c2.status === "connected");
     if (connectedConfigs.length === 0) return;
     logger5.info(`Restoring ${connectedConfigs.length} MCP server connections...`);
-    const { convertToConnection } = await import("./mcp-configs-SHRMQHIL.mjs");
+    const { convertToConnection } = await import("./mcp-configs-WCY5EXCW.mjs");
     for (const config of connectedConfigs) {
       try {
         const connection = convertToConnection(config.config);
@@ -21733,32 +21934,17 @@ var start = async (config) => {
     const projectRoomRealtimeMode = resolveProjectRoomRealtimeMode();
     let projectRoomRealtimeRuntime;
     if (projectRoomRealtimeMode === "single-gateway") {
-      const projectStore = getStoreLattice27("default", "project").store;
-      const membershipStore = getStoreLattice27("default", "projectMembership").store;
-      const access = new ProjectAccessService({
-        projectStore,
-        membershipStore,
-        userTenantLinkStore: getStoreLattice27("default", "userTenantLink").store
-      });
       projectRoomRealtimeRuntime = createProjectRoomRealtimeRuntime({
         tasks: getStoreLattice27("default", "task").store,
         rooms: getStoreLattice27("default", "projectRoom").store,
         memberships: getStoreLattice27("default", "projectBotMembership").store,
-        log: { warn: (message, context) => logger5.warn(message, context) },
-        requireReadAccess: async (actor2) => {
-          await access.requireExistingProjectAccess({
-            tenantId: actor2.tenantId,
-            userId: actor2.userId,
-            projectId: actor2.projectId,
-            capability: "read"
-          });
-        }
+        log: { warn: (message, context) => logger5.warn(message, context) }
       });
     }
     let channelDeps;
     const adapterRegistry = new ChannelAdapterRegistry();
     adapterRegistry.register(larkChannelAdapter);
-    const { wechatChannelAdapter } = await import("./WechatChannelAdapter-WSDKR4OA.mjs");
+    const { wechatChannelAdapter } = await import("./WechatChannelAdapter-7WHE5UGY.mjs");
     adapterRegistry.register(wechatChannelAdapter);
     try {
       const { getStoreLattice: getStore11 } = await import("@axiom-lattice/core");
@@ -21809,9 +21995,9 @@ var start = async (config) => {
       projectRoomRealtimeRuntime
     });
     try {
-      const { A2AAuthService, parseEnvKeys } = await import("./A2AAuthService-DK5X6VIL.mjs");
-      const { registerA2AStandardRoutes } = await import("./a2a-standard-WC2BSOFV.mjs");
-      const a2a = await import("./a2a-7N3WDAOP.mjs");
+      const { A2AAuthService, parseEnvKeys } = await import("./A2AAuthService-7UGQ7GMW.mjs");
+      const { registerA2AStandardRoutes } = await import("./a2a-standard-VEQBXBMM.mjs");
+      const a2a = await import("./a2a-FGYX2HH3.mjs");
       const a2aKeyStore = getStoreLattice27("default", "a2aApiKey").store;
       const assistantStore = getStoreLattice27("default", "assistant").store;
       const projectStore = getStoreLattice27("default", "project").store;
@@ -21839,12 +22025,51 @@ var start = async (config) => {
         error: err instanceof Error ? err.message : String(err)
       });
     }
+    try {
+      const { registerOpenRoutes } = await import("./open-HH7RKGML.mjs");
+      const { registerOpenSessionRoutes } = await import("./open-session-3VN65PRR.mjs");
+      const { registerOpenCatalogRoutes } = await import("./open-catalog-WYS2AENM.mjs");
+      const { registerOpenFilesRoutes } = await import("./open-files-GVRMK5PL.mjs");
+      const { registerOpenAuditRoutes } = await import("./open-audit-UJ3NXCGW.mjs");
+      const { registerOpenExposureRoutes } = await import("./open-exposure-FK4G6O6L.mjs");
+      const { openLattice } = await import("./openLattice-GAAGQJST.mjs");
+      const { createKbProvider } = await import("./kbProvider-2D6DZ34N.mjs");
+      const { createOpenSandboxProvider } = await import("./sandboxProvider-I3P66VXT.mjs");
+      const { createAgentProvider } = await import("./agentProvider-X4FVQPKW.mjs");
+      const { registerExposedPluginTools } = await import("./registerExposedPlugins-63EUF4VS.mjs");
+      const { CollectionService: CollectionService2 } = await import("./collection_service-RTRJEQFL.mjs");
+      openLattice.register(createKbProvider(new CollectionService2()));
+      openLattice.register(createOpenSandboxProvider());
+      const threadStore = getStoreLattice27("default", "thread").store;
+      const assistantStore = getStoreLattice27("default", "assistant").store;
+      openLattice.register(
+        createAgentProvider({
+          threadStore,
+          resolveAssistant: async (tenantId, assistantId) => {
+            const assistant = await assistantStore.getAssistantById(tenantId, assistantId);
+            return assistant ? { name: assistant.name, description: assistant.description } : null;
+          }
+        })
+      );
+      await registerExposedPluginTools();
+      registerOpenRoutes(app);
+      registerOpenSessionRoutes(app);
+      registerOpenCatalogRoutes(app);
+      registerOpenFilesRoutes(app);
+      registerOpenAuditRoutes(app);
+      registerOpenExposureRoutes(app);
+      logger5.info("Open API routes registered (kb + sandbox providers, session exchange)");
+    } catch (err) {
+      logger5.warn("Open API routes unavailable", {
+        error: err instanceof Error ? err.message : String(err)
+      });
+    }
     if (!sandboxLatticeManager2.hasLattice("default")) {
       sandboxLatticeManager2.registerLattice("default", getConfiguredSandboxProvider());
       logger5.info("Registered sandbox manager from env configuration");
     }
     try {
-      const { ResourceController } = await import("./resources-VA7LSDKN.mjs");
+      const { ResourceController } = await import("./resources-SRQRKW5G.mjs");
       const sharedResourceStore = getStoreLattice27("default", "sharedResource").store;
       const cache = new TokenCache();
       const resourceController = new ResourceController({