@axiom-lattice/gateway 4.2.0 → 4.2.2

package/dist/index.mjs

@@ -2,6 +2,13 @@ import {
   getContentTypeFromFilename,
   getFilenameFromPath
 } from "./chunk-LHQY46YB.mjs";
+import {
+  buildPreviewTokenScript
+} from "./chunk-2POW27EI.mjs";
+import "./chunk-WKNZ7GBC.mjs";
+import {
+  CollectionService
+} from "./chunk-PWHUWFXL.mjs";
 import {
   registerMcpServerConfigRoutes
 } from "./chunk-QKPZWWHH.mjs";
@@ -20,6 +27,7 @@ import {
   resolvePathWithinRoot,
   saveProjectFile
 } from "./chunk-J4BK77PA.mjs";
+import "./chunk-NFEGQTCC.mjs";
 
 // src/index.ts
 import "dotenv/config";
@@ -2022,7 +2030,12 @@ async function getHealth(request, reply) {
 }
 
 // src/services/skill_service.ts
-import { SandboxSkillStore, PluginRegistry } from "@axiom-lattice/core";
+import {
+  SandboxSkillStore,
+  PluginRegistry,
+  getSandboxPluginCatalog,
+  parseSkillFrontmatter
+} from "@axiom-lattice/core";
 var PLUGIN_SKILL_SOURCE = "builtin-plugin";
 function getTenantId4(request) {
   return request.user?.tenantId || request.headers["x-tenant-id"] || "default";
@@ -2059,6 +2072,36 @@ var SkillService = class {
   constructor() {
     this.store = new SandboxSkillStore();
   }
+  /**
+   * Read the read-only skills contributed by the tenant's sandbox plugins.
+   * Sandbox failures degrade silently so the system view still returns
+   * built-in and store skills.
+   */
+  async tenantPluginSkills(tenantId) {
+    const items = [];
+    try {
+      const loaded = await getSandboxPluginCatalog().ensureLoaded(tenantId);
+      for (const plugin of loaded.plugins) {
+        for (const [name, definition] of Object.entries(plugin.skills ?? {})) {
+          const { meta } = parseSkillFrontmatter(definition.content);
+          items.push({
+            id: name,
+            name: meta.name || name,
+            description: meta.description || "",
+            version: definition.version,
+            pluginType: plugin.meta.type,
+            resourcePaths: Object.entries(definition.resources ?? {}).map(([path5, resource]) => ({
+              path: path5,
+              mimeType: resource.mimeType
+            })),
+            content: definition.content
+          });
+        }
+      }
+    } catch {
+    }
+    return items;
+  }
   async getAllSkills(request) {
     const tenantId = getTenantId4(request);
     const storeSkills = await this.store.getAllSkills(tenantId, buildContext(request));
@@ -2069,6 +2112,9 @@ var SkillService = class {
     for (const item of PluginRegistry.listSkills()) {
       merged.set(item.id, pluginSkillToSkill(item, tenantId));
     }
+    for (const item of await this.tenantPluginSkills(tenantId)) {
+      merged.set(item.id, pluginSkillToSkill(item, tenantId, item.content));
+    }
     return Array.from(merged.values());
   }
   async getSkillById(request, id3) {
@@ -2081,21 +2127,23 @@ var SkillService = class {
         return pluginSkillToSkill(item, tenantId, definition.content);
       }
     }
+    const tenantItem = (await this.tenantPluginSkills(tenantId)).find((entry) => entry.id === id3);
+    if (tenantItem) return pluginSkillToSkill(tenantItem, tenantId, tenantItem.content);
     return this.store.getSkillById(tenantId, id3, buildContext(request));
   }
   async createSkill(request, id3, data) {
     const tenantId = getTenantId4(request);
-    this.assertNotPluginSkill(id3, "created");
+    await this.assertMutable(tenantId, id3, "created");
     return this.store.createSkill(tenantId, id3, data, buildContext(request));
   }
   async updateSkill(request, id3, updates) {
     const tenantId = getTenantId4(request);
-    this.assertNotPluginSkill(id3, "modified");
+    await this.assertMutable(tenantId, id3, "modified");
     return this.store.updateSkill(tenantId, id3, updates, buildContext(request));
   }
   async deleteSkill(request, id3) {
     const tenantId = getTenantId4(request);
-    this.assertNotPluginSkill(id3, "deleted");
+    await this.assertMutable(tenantId, id3, "deleted");
     return this.store.deleteSkill(tenantId, id3, buildContext(request));
   }
   async searchByMetadata(request, key, value) {
@@ -2111,7 +2159,18 @@ var SkillService = class {
     return this.store.filterByLicense(tenantId, license, buildContext(request));
   }
   /**
-   * Guard against mutating a registered plugin skill.
+   * Guard against mutating a built-in or tenant-plugin skill.
+   * Message style mirrors SandboxSkillStore built-in errors so the controller's
+   * existing "built-in skill" -> 403 mapping applies. Runs before any store write.
+   */
+  async assertMutable(tenantId, id3, action) {
+    this.assertNotPluginSkill(id3, action);
+    if ((await this.tenantPluginSkills(tenantId)).some((skill) => skill.id === id3)) {
+      throw new Error(`Skill "${id3}" is a built-in skill and cannot be ${action}`);
+    }
+  }
+  /**
+   * Guard against mutating a globally registered plugin skill.
    * Message style mirrors SandboxSkillStore built-in errors so the controller's
    * existing "built-in skill" -> 403 mapping applies.
    */
@@ -2317,175 +2376,6 @@ async function filterSkillsByLicense(request, reply) {
   }
 }
 
-// src/services/collection_service.ts
-import { v4 as uuidv4 } from "uuid";
-import { Document } from "@langchain/core/documents";
-import {
-  collectionLatticeManager,
-  embeddingsLatticeManager,
-  getOrCreateCollectionVectorStore,
-  getCollectionEntryCount,
-  listCollectionEntries,
-  removeCollectionVectorStore
-} from "@axiom-lattice/core";
-function getTenantId5(request) {
-  return request.user?.tenantId || request.headers["x-tenant-id"] || "default";
-}
-var CollectionService = class {
-  // ─── Collection CRUD ──────────────────────────────────────────
-  async getAllCollections(request) {
-    const tenantId = getTenantId5(request);
-    const collections = await collectionLatticeManager.getAllCollections(tenantId);
-    for (const c2 of collections) {
-      try {
-        c2._entryCount = await getCollectionEntryCount(c2.name, c2.embeddingKey, c2.tenantId);
-      } catch {
-        c2._entryCount = 0;
-      }
-    }
-    return collections;
-  }
-  async getCollectionByName(request, name) {
-    const tenantId = getTenantId5(request);
-    return collectionLatticeManager.getCollection(tenantId, name);
-  }
-  async createCollection(request, data) {
-    const tenantId = getTenantId5(request);
-    const collection = await collectionLatticeManager.registerCollection(tenantId, data);
-    try {
-      await getOrCreateCollectionVectorStore(data.name, data.embeddingKey, tenantId);
-    } catch (err) {
-      console.warn(`[CollectionService] Failed to init vector store for ${data.name}:`, err);
-    }
-    return collection;
-  }
-  async updateCollection(request, name, updates) {
-    const tenantId = getTenantId5(request);
-    return collectionLatticeManager.updateCollection(tenantId, name, updates);
-  }
-  async deleteCollection(request, name) {
-    const tenantId = getTenantId5(request);
-    await removeCollectionVectorStore(name, tenantId);
-    return collectionLatticeManager.removeCollection(tenantId, name);
-  }
-  // ─── Entry CRUD ───────────────────────────────────────────────
-  async getEntries(request, collectionName) {
-    const collection = await this.getCollectionByName(request, collectionName);
-    if (!collection) throw new Error(`Collection "${collectionName}" not found`);
-    const docs = await listCollectionEntries(collectionName, collection.embeddingKey, collection.tenantId);
-    return docs.map((doc) => ({
-      id: doc.metadata._id || "",
-      content: doc.pageContent,
-      metadata: Object.fromEntries(
-        Object.entries(doc.metadata).filter(([k]) => !k.startsWith("_"))
-      )
-    }));
-  }
-  async createEntry(request, collectionName, data) {
-    const collection = await this.getCollectionByName(request, collectionName);
-    if (!collection) throw new Error(`Collection "${collectionName}" not found`);
-    const vectorStore = await getOrCreateCollectionVectorStore(
-      collectionName,
-      collection.embeddingKey,
-      collection.tenantId
-    );
-    const entryId = uuidv4();
-    const now = (/* @__PURE__ */ new Date()).toISOString();
-    const doc = new Document({
-      pageContent: data.content,
-      metadata: {
-        _id: entryId,
-        _created_at: now,
-        _updated_at: now,
-        ...data.metadata || {}
-      }
-    });
-    await vectorStore.addDocuments([doc]);
-    return { id: entryId, content: data.content, metadata: data.metadata || {} };
-  }
-  async getEntry(request, collectionName, entryId) {
-    const collection = await this.getCollectionByName(request, collectionName);
-    if (!collection) throw new Error(`Collection "${collectionName}" not found`);
-    const docs = await listCollectionEntries(collectionName, collection.embeddingKey, collection.tenantId);
-    const doc = docs.find((d) => d.metadata._id === entryId);
-    if (!doc) return null;
-    return {
-      id: entryId,
-      content: doc.pageContent,
-      metadata: Object.fromEntries(
-        Object.entries(doc.metadata).filter(([k]) => !k.startsWith("_"))
-      )
-    };
-  }
-  async updateEntry(request, collectionName, entryId, data) {
-    const existing = await this.getEntry(request, collectionName, entryId);
-    if (!existing) return null;
-    const collection = await this.getCollectionByName(request, collectionName);
-    if (!collection) throw new Error(`Collection "${collectionName}" not found`);
-    const vectorStore = await getOrCreateCollectionVectorStore(
-      collectionName,
-      collection.embeddingKey,
-      collection.tenantId
-    );
-    try {
-      await vectorStore.delete({ filter: { _id: entryId } });
-    } catch {
-    }
-    const now = (/* @__PURE__ */ new Date()).toISOString();
-    const mergedMetadata = { ...existing.metadata, ...data.metadata || {} };
-    const doc = new Document({
-      pageContent: data.content ?? existing.content,
-      metadata: { _id: entryId, _created_at: now, _updated_at: now, ...mergedMetadata }
-    });
-    await vectorStore.addDocuments([doc]);
-    return { id: entryId, content: data.content ?? existing.content, metadata: mergedMetadata };
-  }
-  async deleteEntry(request, collectionName, entryId) {
-    const collection = await this.getCollectionByName(request, collectionName);
-    if (!collection) throw new Error(`Collection "${collectionName}" not found`);
-    const vectorStore = await getOrCreateCollectionVectorStore(
-      collectionName,
-      collection.embeddingKey,
-      collection.tenantId
-    );
-    try {
-      await vectorStore.delete({ filter: { _id: entryId } });
-      return true;
-    } catch {
-      return false;
-    }
-  }
-  async searchEntries(request, collectionName, params) {
-    const collection = await this.getCollectionByName(request, collectionName);
-    if (!collection) throw new Error(`Collection "${collectionName}" not found`);
-    const vectorStore = await getOrCreateCollectionVectorStore(
-      collectionName,
-      collection.embeddingKey,
-      collection.tenantId
-    );
-    let embeddings;
-    try {
-      embeddings = embeddingsLatticeManager.getEmbeddingsClient(collection.embeddingKey);
-    } catch {
-      embeddings = embeddingsLatticeManager.getEmbeddingsClient("default");
-    }
-    const queryVector = await embeddings.embedQuery(params.query);
-    const results = await vectorStore.similaritySearchVectorWithScore(
-      queryVector,
-      params.top_k || 5,
-      params.filter
-    );
-    return results.map(([doc, score]) => ({
-      id: doc.metadata._id || uuidv4(),
-      content: doc.pageContent,
-      metadata: Object.fromEntries(
-        Object.entries(doc.metadata).filter(([k]) => !k.startsWith("_"))
-      ),
-      score
-    }));
-  }
-};
-
 // src/controllers/collections.ts
 var collectionService = new CollectionService();
 function serializeCollection(collection) {
@@ -2607,10 +2497,10 @@ async function deleteCollection(request, reply) {
 }
 
 // src/controllers/embeddings.ts
-import { embeddingsLatticeManager as embeddingsLatticeManager2 } from "@axiom-lattice/core";
+import { embeddingsLatticeManager } from "@axiom-lattice/core";
 async function listEmbeddings(_request, _reply) {
   try {
-    const info = embeddingsLatticeManager2.getAllEmbeddingsInfo();
+    const info = embeddingsLatticeManager.getAllEmbeddingsInfo();
     return {
       success: true,
       message: "Successfully retrieved embedding models",
@@ -2840,11 +2730,11 @@ import {
   getStoreLattice as getStoreLattice3,
   metricsServerManager
 } from "@axiom-lattice/core";
-function getTenantId6(request) {
+function getTenantId5(request) {
   return request.headers["x-tenant-id"] || "default";
 }
 async function executeDataQuery(request, reply) {
-  const tenantId = getTenantId6(request);
+  const tenantId = getTenantId5(request);
   const body = request.body;
   try {
     if (!body.serverKey && !body.datasourceId) {
@@ -2980,7 +2870,7 @@ async function executeSqlQuery(client, body, reply) {
 // src/controllers/workflow-tracking.ts
 import { getStoreLattice as getStoreLattice4, agentInstanceManager as agentInstanceManager4, ThreadStatus as ThreadStatus2, abortWorkflowRun as signalAbort } from "@axiom-lattice/core";
 import { MessageChunkTypes as MessageChunkTypes2 } from "@axiom-lattice/protocols";
-function getTenantId7(request) {
+function getTenantId6(request) {
   const userTenantId = request.user?.tenantId;
   if (userTenantId) return userTenantId;
   return request.headers["x-tenant-id"] || "default";
@@ -3021,7 +2911,7 @@ async function getDefinitionsFromAssistants(tenantId) {
   }
 }
 async function getAllWorkflowDefinitions(request, reply) {
-  const tenantId = getTenantId7(request);
+  const tenantId = getTenantId6(request);
   try {
     const configDefs = await getDefinitionsFromAssistants(tenantId);
     if (configDefs.length === 0) {
@@ -3066,7 +2956,7 @@ async function getAllWorkflowDefinitions(request, reply) {
   }
 }
 async function getAllWorkflowRuns(request, reply) {
-  const tenantId = getTenantId7(request);
+  const tenantId = getTenantId6(request);
   const { assistantId, status } = request.query;
   try {
     const store = getTrackingStore();
@@ -3120,7 +3010,7 @@ async function getAllWorkflowRuns(request, reply) {
 var INBOX_DEFAULT_PAGE_SIZE = 20;
 var INBOX_MAX_PAGE_SIZE = 100;
 async function getInboxItems(request, reply) {
-  const tenantId = getTenantId7(request);
+  const tenantId = getTenantId6(request);
   try {
     const store = getTrackingStore();
     if (!store) {
@@ -3228,7 +3118,7 @@ async function getInboxItems(request, reply) {
 }
 async function getWorkflowDefinitions(request, reply) {
   const { assistantId } = request.params;
-  const tenantId = getTenantId7(request);
+  const tenantId = getTenantId6(request);
   try {
     const store = getTrackingStore();
     if (!store) {
@@ -3259,7 +3149,7 @@ async function getWorkflowDefinitions(request, reply) {
 }
 async function getWorkflowRuns(request, reply) {
   const { threadId } = request.params;
-  const tenantId = getTenantId7(request);
+  const tenantId = getTenantId6(request);
   try {
     const store = getTrackingStore();
     if (!store) {
@@ -3295,7 +3185,7 @@ async function getWorkflowRun(request, reply) {
 }
 async function deleteWorkflowRun(request, reply) {
   const { runId } = request.params;
-  const tenantId = getTenantId7(request);
+  const tenantId = getTenantId6(request);
   try {
     const store = getTrackingStore();
     if (!store) {
@@ -3378,7 +3268,7 @@ async function getRunTasks(request, reply) {
 }
 async function replyInboxTask(request, reply) {
   const { runId, answers } = request.body;
-  const tenantId = getTenantId7(request);
+  const tenantId = getTenantId6(request);
   try {
     const store = getTrackingStore();
     if (!store) {
@@ -3455,7 +3345,7 @@ async function replyInboxTask(request, reply) {
 async function abortWorkflowRun(request, reply) {
   try {
     const { runId } = request.params;
-    const tenantId = getTenantId7(request);
+    const tenantId = getTenantId6(request);
     const store = getTrackingStore();
     if (!store) {
       return reply.status(404).send({
@@ -3507,7 +3397,7 @@ import { randomUUID as randomUUID3 } from "crypto";
 function getWorkspaceId2(request) {
   return request.headers["x-workspace-id"] || "default";
 }
-function getTenantId8(request) {
+function getTenantId7(request) {
   const userTenantId = request.user?.tenantId;
   if (userTenantId) return userTenantId;
   return request.headers["x-tenant-id"] || "default";
@@ -3534,7 +3424,7 @@ async function updateLinkMeta(userId, tenantId, meta) {
   await getLinkStore().updateLink(userId, tenantId, { metadata: meta });
 }
 async function createPersonalAssistant(request, reply) {
-  const tenantId = getTenantId8(request);
+  const tenantId = getTenantId7(request);
   const userId = getUserId3(request);
   const { name, personality } = request.body;
   if (!name || !personality) {
@@ -3571,7 +3461,7 @@ async function createPersonalAssistant(request, reply) {
   });
 }
 async function getPersonalAssistant(request, reply) {
-  const tenantId = getTenantId8(request);
+  const tenantId = getTenantId7(request);
   const userId = getUserId3(request);
   const store = getAssistantStore();
   const assistant = await store.getByOwner(tenantId, userId);
@@ -3588,7 +3478,7 @@ async function getPersonalAssistant(request, reply) {
   };
 }
 async function deletePersonalAssistant(request, reply) {
-  const tenantId = getTenantId8(request);
+  const tenantId = getTenantId7(request);
   const userId = getUserId3(request);
   const store = getAssistantStore();
   const assistant = await store.getByOwner(tenantId, userId);
@@ -4497,11 +4387,26 @@ async function importApply(request, reply) {
 }
 
 // src/controllers/middleware-types.ts
-import { PluginRegistry as PluginRegistry2 } from "@axiom-lattice/core";
+import {
+  PluginRegistry as PluginRegistry2,
+  getSandboxPluginCatalog as getSandboxPluginCatalog2,
+  mergePluginSources,
+  serializePluginMeta
+} from "@axiom-lattice/core";
+async function collectMiddlewareMetas(tenantId) {
+  let tenantPlugins = [];
+  try {
+    tenantPlugins = (await getSandboxPluginCatalog2().ensureLoaded(tenantId)).plugins;
+  } catch {
+    tenantPlugins = [];
+  }
+  const globalPlugins = PluginRegistry2.list().map((type) => PluginRegistry2.get(type)).filter((p) => Boolean(p));
+  return mergePluginSources(globalPlugins, tenantPlugins).map(serializePluginMeta);
+}
 function middlewareTypesRoutes(fastify2) {
-  fastify2.get("/api/middleware-types", async (_request, reply) => {
-    const metas = PluginRegistry2.listMeta();
-    return reply.send(metas);
+  fastify2.get("/api/middleware-types", async (request, reply) => {
+    const tenantId = request.user?.tenantId || request.headers["x-tenant-id"] || "default";
+    return reply.send(await collectMiddlewareMetas(tenantId));
   });
 }
 
@@ -5220,7 +5125,7 @@ import * as os2 from "os";
 import { getStoreLattice as getStoreLattice6 } from "@axiom-lattice/core";
 import { SandboxFilesystem, FilesystemBackend } from "@axiom-lattice/core";
 import { getSandBoxManager as getSandBoxManager3 } from "@axiom-lattice/core";
-import { v4 as uuidv42 } from "uuid";
+import { v4 as uuidv4 } from "uuid";
 
 // src/services/collaboration/RoomCoordinatorProvisioner.ts
 var ROOM_COORDINATOR_KEY = "room-coordinator";
@@ -5423,7 +5328,7 @@ var ProjectCollaborationInitializationError = class extends Error {
   }
 };
 function createProjectCollaborationInitializer(deps) {
-  const idFactory = deps.idFactory ?? uuidv42;
+  const idFactory = deps.idFactory ?? uuidv4;
   return {
     authorizeCreator: async ({ tenantId, userId }) => await deps.userTenantLinkStore.getLink(userId, tenantId) !== null,
     initialize: async ({ tenantId, userId, project }) => {
@@ -5498,7 +5403,7 @@ var WorkspaceController = class {
   async createWorkspace(request, reply) {
     const tenantId = this.getTenantId(request);
     const data = request.body;
-    const id3 = uuidv42();
+    const id3 = uuidv4();
     const workspace = await this.workspaceStore.createWorkspace(
       tenantId,
       id3,
@@ -5571,7 +5476,7 @@ var WorkspaceController = class {
     if (existing.length > 0) {
       return;
     }
-    await this.projectStore.createProject(tenantId, workspaceId, uuidv42(), {
+    await this.projectStore.createProject(tenantId, workspaceId, uuidv4(), {
       name: "Training",
       description: "Shared workspace for agent training",
       kind: "training"
@@ -5624,7 +5529,7 @@ var WorkspaceController = class {
         });
       }
     }
-    const id3 = uuidv42();
+    const id3 = uuidv4();
     const project = await this.projectStore.createProject(
       tenantId,
       workspaceId,
@@ -6171,7 +6076,7 @@ var WorkspaceController = class {
               workspaceId,
               projectId,
               timestamp: Date.now()
-            })};</script>`;
+            })};</script>` + buildPreviewTokenScript({ tenantId, workspaceId, projectId });
             if (content2.toLowerCase().includes("</head>")) {
               content2 = content2.replace(/<\/head>/i, `${contextScript}</head>`);
               console.log(`[viewFile] Context script injected before </head>`);
@@ -6202,7 +6107,7 @@ var WorkspaceController = class {
           workspaceId,
           projectId,
           timestamp: Date.now()
-        })};</script>`;
+        })};</script>` + buildPreviewTokenScript({ tenantId, workspaceId, projectId });
         if (content.toLowerCase().includes("</head>")) {
           finalContent = content.replace(/<\/head>/i, `${contextScript}</head>`);
           console.log(`[viewFile] Context script injected before </head>`);
@@ -6525,13 +6430,17 @@ var ProjectAccessService = class {
     this.requireCapability(membership, input.capability);
     return { project, membership };
   }
-  /** Authorizes roster visibility: read for public rooms, manage elsewhere. */
+  /**
+   * Authorizes roster visibility for any active participant (owner/admin/member/viewer).
+   * Mutating the roster requires `manage` separately; reading it never does, because every
+   * room participant needs the member list to render the room and derive their own capabilities.
+   */
   async requireRosterAccess(input) {
     const project = await this.deps.projectStore.getProjectById(input.tenantId, input.projectId);
     if (!project) throw new ProjectCollaborationError("PROJECT_NOT_FOUND", 404, "Project not found");
     return this.requireProjectAccess({
       ...input,
-      capability: project.kind === "public" ? "read" : "manage"
+      capability: "read"
     });
   }
   async requirePublicProjectAccess(project, input) {
@@ -6620,7 +6529,7 @@ import {
   sqlDatabaseManager
 } from "@axiom-lattice/core";
 import { randomUUID as randomUUID7 } from "crypto";
-function getTenantId9(request) {
+function getTenantId8(request) {
   const userTenantId = request.user?.tenantId;
   if (userTenantId) {
     return userTenantId;
@@ -6628,7 +6537,7 @@ function getTenantId9(request) {
   return request.headers["x-tenant-id"] || "default";
 }
 async function getDatabaseConfigList(request, reply) {
-  const tenantId = getTenantId9(request);
+  const tenantId = getTenantId8(request);
   try {
     const storeLattice = getStoreLattice7("default", "database");
     const store = storeLattice.store;
@@ -6658,7 +6567,7 @@ async function getDatabaseConfigList(request, reply) {
   }
 }
 async function getDatabaseConfig(request, reply) {
-  const tenantId = getTenantId9(request);
+  const tenantId = getTenantId8(request);
   const { key } = request.params;
   try {
     const storeLattice = getStoreLattice7("default", "database");
@@ -6684,7 +6593,7 @@ async function getDatabaseConfig(request, reply) {
   }
 }
 async function createDatabaseConfig(request, reply) {
-  const tenantId = getTenantId9(request);
+  const tenantId = getTenantId8(request);
   const body = request.body;
   try {
     const storeLattice = getStoreLattice7("default", "database");
@@ -6719,7 +6628,7 @@ async function createDatabaseConfig(request, reply) {
   }
 }
 async function updateDatabaseConfig(request, reply) {
-  const tenantId = getTenantId9(request);
+  const tenantId = getTenantId8(request);
   const { key } = request.params;
   const updates = request.body;
   try {
@@ -6761,7 +6670,7 @@ async function updateDatabaseConfig(request, reply) {
   }
 }
 async function deleteDatabaseConfig(request, reply) {
-  const tenantId = getTenantId9(request);
+  const tenantId = getTenantId8(request);
   const { keyOrId } = request.params;
   try {
     const storeLattice = getStoreLattice7("default", "database");
@@ -6810,7 +6719,7 @@ async function deleteDatabaseConfig(request, reply) {
   }
 }
 async function testDatabaseConnection(request, reply) {
-  const tenantId = getTenantId9(request);
+  const tenantId = getTenantId8(request);
   const { key } = request.params;
   try {
     const storeLattice = getStoreLattice7("default", "database");
@@ -6903,7 +6812,7 @@ import {
   SemanticMetricsClient as SemanticMetricsClient2
 } from "@axiom-lattice/core";
 import { randomUUID as randomUUID8 } from "crypto";
-function getTenantId10(request) {
+function getTenantId9(request) {
   const userTenantId = request.user?.tenantId;
   if (userTenantId) {
     return userTenantId;
@@ -6911,7 +6820,7 @@ function getTenantId10(request) {
   return request.headers["x-tenant-id"] || "default";
 }
 async function getMetricsServerConfigList(request, reply) {
-  const tenantId = getTenantId10(request);
+  const tenantId = getTenantId9(request);
   try {
     const storeLattice = getStoreLattice8("default", "metrics");
     const store = storeLattice.store;
@@ -6937,7 +6846,7 @@ async function getMetricsServerConfigList(request, reply) {
   }
 }
 async function getMetricsServerConfig(request, reply) {
-  const tenantId = getTenantId10(request);
+  const tenantId = getTenantId9(request);
   const { key } = request.params;
   try {
     const storeLattice = getStoreLattice8("default", "metrics");
@@ -6963,7 +6872,7 @@ async function getMetricsServerConfig(request, reply) {
   }
 }
 async function createMetricsServerConfig(request, reply) {
-  const tenantId = getTenantId10(request);
+  const tenantId = getTenantId9(request);
   const body = request.body;
   try {
     const storeLattice = getStoreLattice8("default", "metrics");
@@ -7014,7 +6923,7 @@ async function createMetricsServerConfig(request, reply) {
   }
 }
 async function updateMetricsServerConfig(request, reply) {
-  const tenantId = getTenantId10(request);
+  const tenantId = getTenantId9(request);
   const { key } = request.params;
   const updates = request.body;
   try {
@@ -7065,7 +6974,7 @@ async function updateMetricsServerConfig(request, reply) {
   }
 }
 async function deleteMetricsServerConfig(request, reply) {
-  const tenantId = getTenantId10(request);
+  const tenantId = getTenantId9(request);
   const { keyOrId } = request.params;
   try {
     const storeLattice = getStoreLattice8("default", "metrics");
@@ -7112,7 +7021,7 @@ async function deleteMetricsServerConfig(request, reply) {
   }
 }
 async function testMetricsServerConnection(request, reply) {
-  const tenantId = getTenantId10(request);
+  const tenantId = getTenantId9(request);
   const { key } = request.params;
   try {
     const storeLattice = getStoreLattice8("default", "metrics");
@@ -7163,7 +7072,7 @@ async function testMetricsServerConnection(request, reply) {
   }
 }
 async function listAvailableMetrics(request, reply) {
-  const tenantId = getTenantId10(request);
+  const tenantId = getTenantId9(request);
   const { key } = request.params;
   try {
     const storeLattice = getStoreLattice8("default", "metrics");
@@ -7201,7 +7110,7 @@ async function listAvailableMetrics(request, reply) {
   }
 }
 async function queryMetricsData(request, reply) {
-  const tenantId = getTenantId10(request);
+  const tenantId = getTenantId9(request);
   const { key } = request.params;
   const { metricName, startTime, endTime, step, labels } = request.body;
   try {
@@ -7249,7 +7158,7 @@ async function queryMetricsData(request, reply) {
   }
 }
 async function getDataSources(request, reply) {
-  const tenantId = getTenantId10(request);
+  const tenantId = getTenantId9(request);
   const { key } = request.params;
   try {
     const storeLattice = getStoreLattice8("default", "metrics");
@@ -7290,7 +7199,7 @@ async function getDataSources(request, reply) {
   }
 }
 async function getDatasourceMetrics(request, reply) {
-  const tenantId = getTenantId10(request);
+  const tenantId = getTenantId9(request);
   const { key, datasourceId } = request.params;
   try {
     const storeLattice = getStoreLattice8("default", "metrics");
@@ -7327,7 +7236,7 @@ async function getDatasourceMetrics(request, reply) {
   }
 }
 async function querySemanticMetrics(request, reply) {
-  const tenantId = getTenantId10(request);
+  const tenantId = getTenantId9(request);
   const { key } = request.params;
   const body = request.body;
   try {
@@ -7484,7 +7393,7 @@ function registerMetricsServerConfigRoutes(app2) {
 }
 
 // src/controllers/connections.ts
-import { ConnectionRegistry, PluginRegistry as PluginRegistry3 } from "@axiom-lattice/core";
+import { ConnectionRegistry, PluginRegistry as PluginRegistry3, getSandboxPluginCatalog as getSandboxPluginCatalog3, mergePluginSources as mergePluginSources2 } from "@axiom-lattice/core";
 import { z as z2 } from "zod";
 var createBody = z2.object({
   type: z2.string().min(1),
@@ -7504,6 +7413,17 @@ function getTenant(request) {
   }
   return request.headers["x-tenant-id"] || "default";
 }
+async function getTenantPlugin(request, type) {
+  const tenantId = getTenant(request);
+  let tenantPlugins = [];
+  try {
+    tenantPlugins = (await getSandboxPluginCatalog3().ensureLoaded(tenantId)).plugins;
+  } catch {
+    tenantPlugins = [];
+  }
+  const globalPlugins = PluginRegistry3.list().map((t2) => PluginRegistry3.get(t2)).filter((p) => Boolean(p));
+  return mergePluginSources2(globalPlugins, tenantPlugins).find((p) => p.meta.type === type);
+}
 function maskSecrets(config) {
   const sensitive = /* @__PURE__ */ new Set([
     "password",
@@ -7587,7 +7507,7 @@ function connectionRoutes(fastify2) {
   fastify2.post("/api/connections/test", async (request, reply) => {
     const { type } = request.query;
     if (!type) return reply.status(400).send({ error: "query 'type' required" });
-    const plugin = PluginRegistry3.get(type);
+    const plugin = await getTenantPlugin(request, type);
     if (!plugin?.connection?.test) {
       return reply.status(400).send({ error: "plugin does not support connection testing" });
     }
@@ -7615,7 +7535,7 @@ function connectionRoutes(fastify2) {
   fastify2.post("/api/connections/discover", async (request, reply) => {
     const { type } = request.query;
     if (!type) return reply.status(400).send({ error: "query 'type' required" });
-    const plugin = PluginRegistry3.get(type);
+    const plugin = await getTenantPlugin(request, type);
     if (!plugin?.connection?.discover) {
       return reply.status(400).send({ error: "plugin does not support resource discovery" });
     }
@@ -7643,7 +7563,7 @@ function connectionRoutes(fastify2) {
 
 // src/controllers/eval.ts
 import { getStoreLattice as getStoreLattice10 } from "@axiom-lattice/core";
-import { v4 as uuidv44 } from "uuid";
+import { v4 as uuidv43 } from "uuid";
 
 // src/services/eval-runner.ts
 import { EventEmitter } from "events";
@@ -7652,7 +7572,7 @@ import {
   modelLatticeManager as modelLatticeManager2,
   LatticeEvalProject
 } from "@axiom-lattice/core";
-import { v4 as uuidv43 } from "uuid";
+import { v4 as uuidv42 } from "uuid";
 var TERMINAL_PERSIST_ATTEMPTS = 2;
 function mapLogs(logs) {
   return logs.map((l) => ({
@@ -7776,7 +7696,7 @@ var EvalRunner = class {
         console.warn(`[eval-runner] Project "${project.name}" has no judge modelKey and no "default" model \u2014 falling back to first registered model "${resolvedJudgeModelKey}"`);
       }
     }
-    const runId = uuidv43();
+    const runId = uuidv42();
     const concurrency = Math.max(1, Math.floor(project.concurrency) || 3);
     const isHoldout = suites.length > 0 && suites.every((s) => s.name.endsWith("-validation"));
     const workspaceId = runConfig?.workspaceId || "";
@@ -7833,7 +7753,7 @@ var EvalRunner = class {
       if (terminalUnavailable()) return;
       const passed = result.result?.pass ?? false;
       const score = result.result?.final_score ?? 0;
-      await store.createRunResult(tenantId, runId, uuidv43(), {
+      await store.createRunResult(tenantId, runId, uuidv42(), {
         suiteName,
         caseId: result.caseId,
         pass: passed,
@@ -7987,7 +7907,7 @@ var EvalRunner = class {
 var evalRunner = new EvalRunner();
 
 // src/controllers/eval.ts
-function getTenantId11(request) {
+function getTenantId10(request) {
   const userTenantId = request.user?.tenantId;
   if (userTenantId) {
     return userTenantId;
@@ -8011,9 +7931,9 @@ async function getOwnedCase(store, tenantId, projectId, suiteId, caseId) {
 }
 async function createProject(request, reply) {
   try {
-    const tenantId = getTenantId11(request);
+    const tenantId = getTenantId10(request);
     const store = getEvalStore();
-    const id3 = uuidv44();
+    const id3 = uuidv43();
     const data = request.body;
     const existing = await store.getProjectsByTenant(tenantId);
     if (existing.some((p) => p.name === data.name)) {
@@ -8068,7 +7988,7 @@ async function createProject(request, reply) {
 }
 async function listProjects(request, reply) {
   try {
-    const tenantId = getTenantId11(request);
+    const tenantId = getTenantId10(request);
     const store = getEvalStore();
     let projects = await store.getProjectsByTenant(tenantId);
     if (projects.length === 0) {
@@ -8079,7 +7999,7 @@ async function listProjects(request, reply) {
         const judgeModel = first ? { modelKey: first.key } : {};
         const host = request.hostname || "localhost";
         const baseUrl = `http://${host}:${process.env.PORT || 4001}`;
-        await store.createProject(tenantId, uuidv44(), {
+        await store.createProject(tenantId, uuidv43(), {
           name: "Default",
           description: "Built-in project for testing eval against this server",
           judgeModelConfig: judgeModel,
@@ -8102,7 +8022,7 @@ async function listProjects(request, reply) {
 }
 async function getProject(request, reply) {
   try {
-    const tenantId = getTenantId11(request);
+    const tenantId = getTenantId10(request);
     const store = getEvalStore();
     const { pid } = request.params;
     const project = await store.getProjectById(tenantId, pid);
@@ -8122,7 +8042,7 @@ async function getProject(request, reply) {
 }
 async function updateProject(request, reply) {
   try {
-    const tenantId = getTenantId11(request);
+    const tenantId = getTenantId10(request);
     const store = getEvalStore();
     const { pid } = request.params;
     const existing = await store.getProjectById(tenantId, pid);
@@ -8166,7 +8086,7 @@ async function updateProject(request, reply) {
 async function deleteProject(request, reply) {
   let releaseDeletion;
   try {
-    const tenantId = getTenantId11(request);
+    const tenantId = getTenantId10(request);
     const store = getEvalStore();
     const { pid } = request.params;
     const existing = await store.getProjectById(tenantId, pid);
@@ -8204,14 +8124,14 @@ async function deleteProject(request, reply) {
 }
 async function createSuite(request, reply) {
   try {
-    const tenantId = getTenantId11(request);
+    const tenantId = getTenantId10(request);
     const store = getEvalStore();
     const { pid } = request.params;
     const project = await store.getProjectById(tenantId, pid);
     if (!project) {
       return reply.status(404).send({ success: false, message: "Project not found" });
     }
-    const id3 = uuidv44();
+    const id3 = uuidv43();
     const data = request.body;
     const suite = await store.createSuite(tenantId, pid, id3, { name: data.name });
     return reply.status(201).send({
@@ -8226,7 +8146,7 @@ async function createSuite(request, reply) {
 }
 async function updateSuite(request, reply) {
   try {
-    const tenantId = getTenantId11(request);
+    const tenantId = getTenantId10(request);
     const store = getEvalStore();
     const { pid, sid } = request.params;
     const existing = await getOwnedSuite(store, tenantId, pid, sid);
@@ -8246,7 +8166,7 @@ async function updateSuite(request, reply) {
 }
 async function deleteSuite(request, reply) {
   try {
-    const tenantId = getTenantId11(request);
+    const tenantId = getTenantId10(request);
     const store = getEvalStore();
     const { pid, sid } = request.params;
     const existing = await getOwnedSuite(store, tenantId, pid, sid);
@@ -8265,14 +8185,14 @@ async function deleteSuite(request, reply) {
 }
 async function createCase(request, reply) {
   try {
-    const tenantId = getTenantId11(request);
+    const tenantId = getTenantId10(request);
     const store = getEvalStore();
     const { pid, sid } = request.params;
     const suite = await getOwnedSuite(store, tenantId, pid, sid);
     if (!suite) {
       return reply.status(404).send({ success: false, message: "Suite not found" });
     }
-    const id3 = uuidv44();
+    const id3 = uuidv43();
     const data = request.body;
     const created = await store.createCase(tenantId, sid, id3, {
       inputMessage: data.inputMessage,
@@ -8295,7 +8215,7 @@ async function createCase(request, reply) {
 }
 async function listCasesForSuite(request, reply) {
   try {
-    const tenantId = getTenantId11(request);
+    const tenantId = getTenantId10(request);
     const store = getEvalStore();
     const { pid, sid } = request.params;
     const suite = await getOwnedSuite(store, tenantId, pid, sid);
@@ -8315,7 +8235,7 @@ async function listCasesForSuite(request, reply) {
 }
 async function updateCase(request, reply) {
   try {
-    const tenantId = getTenantId11(request);
+    const tenantId = getTenantId10(request);
     const store = getEvalStore();
     const { pid, sid, cid } = request.params;
     const existing = await getOwnedCase(store, tenantId, pid, sid, cid);
@@ -8335,7 +8255,7 @@ async function updateCase(request, reply) {
 }
 async function deleteCase(request, reply) {
   try {
-    const tenantId = getTenantId11(request);
+    const tenantId = getTenantId10(request);
     const store = getEvalStore();
     const { pid, sid, cid } = request.params;
     const existing = await getOwnedCase(store, tenantId, pid, sid, cid);
@@ -8367,7 +8287,7 @@ function registerEvalRoutes(app2) {
   app2.delete("/api/eval/projects/:pid/suites/:sid/cases/:cid", deleteCase);
   app2.post("/api/eval/projects/:pid/runs", async (request, reply) => {
     try {
-      const tenantId = getTenantId11(request);
+      const tenantId = getTenantId10(request);
       const { pid } = request.params;
       const body = request.body ?? {};
       const bodyWs = request.headers["x-workspace-id"] || "";
@@ -8386,7 +8306,7 @@ function registerEvalRoutes(app2) {
   });
   app2.get("/api/eval/runs", async (request, reply) => {
     try {
-      const tenantId = getTenantId11(request);
+      const tenantId = getTenantId10(request);
       const query = request.query;
       const runs = await getEvalStore().getRunsByTenant(tenantId, { projectId: query.project_id, status: query.status });
       reply.send({ success: true, message: "Ok", data: { records: runs, total: runs.length } });
@@ -8396,7 +8316,7 @@ function registerEvalRoutes(app2) {
   });
   app2.get("/api/eval/runs/:rid", async (request, reply) => {
     try {
-      const tenantId = getTenantId11(request);
+      const tenantId = getTenantId10(request);
       const { rid } = request.params;
       const run2 = await getEvalStore().getRunById(tenantId, rid);
       if (!run2) return reply.status(404).send({ success: false, message: "Run not found" });
@@ -8407,7 +8327,7 @@ function registerEvalRoutes(app2) {
     }
   });
   app2.get("/api/eval/runs/:rid/stream", async (request, reply) => {
-    const tenantId = getTenantId11(request);
+    const tenantId = getTenantId10(request);
     const { rid } = request.params;
     const store = getEvalStore();
     const ownedRun = await store.getRunById(tenantId, rid);
@@ -8483,7 +8403,7 @@ data: ${JSON.stringify(event.data)}
   });
   app2.post("/api/eval/runs/:rid/abort", async (request, reply) => {
     try {
-      const tenantId = getTenantId11(request);
+      const tenantId = getTenantId10(request);
       const { rid } = request.params;
       const run2 = await getEvalStore().getRunById(tenantId, rid);
       if (!run2) return reply.status(404).send({ success: false, message: "Run not found" });
@@ -8496,7 +8416,7 @@ data: ${JSON.stringify(event.data)}
   });
   app2.delete("/api/eval/runs/:rid", async (request, reply) => {
     try {
-      const tenantId = getTenantId11(request);
+      const tenantId = getTenantId10(request);
       const { rid } = request.params;
       const store = getEvalStore();
       const run2 = await store.getRunById(tenantId, rid);
@@ -8513,7 +8433,7 @@ data: ${JSON.stringify(event.data)}
   });
   app2.get("/api/eval/reports/projects/:pid", async (request, reply) => {
     try {
-      const tenantId = getTenantId11(request);
+      const tenantId = getTenantId10(request);
       const { pid } = request.params;
       const report = await getEvalStore().getProjectReport(tenantId, pid);
       if (!report) return reply.status(404).send({ success: false, message: "Project not found" });
@@ -8526,7 +8446,7 @@ data: ${JSON.stringify(event.data)}
 
 // src/controllers/users.ts
 import { getStoreLattice as getStoreLattice11 } from "@axiom-lattice/core";
-import { v4 as uuidv45 } from "uuid";
+import { v4 as uuidv44 } from "uuid";
 var UsersController = class {
   constructor() {
     this.userStore = getStoreLattice11("default", "user").store;
@@ -8542,7 +8462,7 @@ var UsersController = class {
   }
   async createUser(request, reply) {
     const data = request.body;
-    const id3 = uuidv45();
+    const id3 = uuidv44();
     const existingUser = await this.userStore.getUserByEmail(data.email);
     if (existingUser) {
       return reply.status(409).send({
@@ -8608,7 +8528,7 @@ function registerUserRoutes(app2) {
 
 // src/controllers/tenants.ts
 import { getStoreLattice as getStoreLattice12 } from "@axiom-lattice/core";
-import { v4 as uuidv46 } from "uuid";
+import { v4 as uuidv45 } from "uuid";
 var TenantsController = class {
   constructor() {
     this.tenantStore = getStoreLattice12("default", "tenant").store;
@@ -8620,7 +8540,7 @@ var TenantsController = class {
   }
   async createTenant(request, reply) {
     const data = request.body;
-    const id3 = uuidv46();
+    const id3 = uuidv45();
     const tenant2 = await this.tenantStore.createTenant(id3, data);
     return reply.status(201).send({ success: true, data: tenant2 });
   }
@@ -8676,7 +8596,7 @@ function registerTenantRoutes(app2) {
 
 // src/controllers/auth.ts
 import { getStoreLattice as getStoreLattice13 } from "@axiom-lattice/core";
-import { v4 as uuidv47 } from "uuid";
+import { v4 as uuidv46 } from "uuid";
 import { createHmac, randomBytes, timingSafeEqual } from "crypto";
 var defaultAuthConfig = {
   autoApproveUsers: true,
@@ -8700,7 +8620,7 @@ var AuthController = class {
           error: "User with this email already exists"
         });
       }
-      const userId = uuidv47();
+      const userId = uuidv46();
       const userStatus = this.config.autoApproveUsers ? "active" : "pending";
       const userData = {
         email,
@@ -9101,7 +9021,7 @@ function isStaleConsoleSessionCredential(authHeader) {
 function bypassesConsoleAuth(request) {
   const path5 = request.url.split("?")[0];
   const method = request.method;
-  if (method === "GET" && /^\/api\/web-apps\/[^/]+\/runtime\/bootstrap$/.test(path5) || (method === "GET" || method === "POST") && /^\/api\/web-apps\/[^/]+\/runtime\/threads$/.test(path5) || (method === "PATCH" || method === "DELETE") && /^\/api\/web-apps\/[^/]+\/runtime\/threads\/[^/]+$/.test(path5) || method === "GET" && /^\/api\/web-apps\/[^/]+\/runtime\/threads\/[^/]+\/messages$/.test(path5) || method === "GET" && /^\/api\/web-apps\/[^/]+\/runtime\/files\/(viewfile|downloadfile)$/.test(path5) || method === "GET" && /^\/api\/web-apps\/[^/]+\/runtime\/api\/assistants\/[^/]+\/threads\/[^/]+\/sandbox\/(viewfile|downloadfile)$/.test(path5) || method === "POST" && /^\/api\/web-apps\/[^/]+\/runtime\/threads\/[^/]+\/(messages\/stream|abort|attachments)$/.test(path5) || method === "POST" && /^\/api\/web-apps\/[^/]+\/runtime\/threads\/[^/]+\/interrupts\/[^/]+\/resume$/.test(path5) || method === "GET" && /^\/api\/web-apps\/[^/]+\/chat$/.test(path5) || method === "GET" && /^\/embed\/[^/]+$/.test(path5) || (method === "POST" || method === "DELETE") && path5 === "/open/mcp") return true;
+  if (method === "GET" && /^\/api\/web-apps\/[^/]+\/runtime\/bootstrap$/.test(path5) || (method === "GET" || method === "POST") && /^\/api\/web-apps\/[^/]+\/runtime\/threads$/.test(path5) || (method === "PATCH" || method === "DELETE") && /^\/api\/web-apps\/[^/]+\/runtime\/threads\/[^/]+$/.test(path5) || method === "GET" && /^\/api\/web-apps\/[^/]+\/runtime\/threads\/[^/]+\/messages$/.test(path5) || method === "GET" && /^\/api\/web-apps\/[^/]+\/runtime\/files\/(viewfile|downloadfile)$/.test(path5) || method === "GET" && /^\/api\/web-apps\/[^/]+\/runtime\/api\/assistants\/[^/]+\/threads\/[^/]+\/sandbox\/(viewfile|downloadfile)$/.test(path5) || method === "POST" && /^\/api\/web-apps\/[^/]+\/runtime\/threads\/[^/]+\/(messages\/stream|abort|attachments)$/.test(path5) || method === "POST" && /^\/api\/web-apps\/[^/]+\/runtime\/threads\/[^/]+\/interrupts\/[^/]+\/resume$/.test(path5) || method === "GET" && /^\/api\/web-apps\/[^/]+\/chat$/.test(path5) || method === "GET" && /^\/embed\/[^/]+$/.test(path5) || (method === "POST" || method === "DELETE") && path5 === "/open/mcp" || method === "POST" && path5 === "/open/session" || (method === "GET" || method === "POST") && path5.startsWith("/open/sandbox/files/")) return true;
   if (request.method === "GET" && /^\/api\/a2a\/agents\/[^/]+\/\.well-known\/agent-card\.json$/.test(path5)) {
     return true;
   }
@@ -9277,7 +9197,7 @@ var larkChannelAdapter = {
     };
   },
   async sendReply(replyTarget, message, installation) {
-    const { createLarkSender } = await import("./sender-PX32VSHB.mjs");
+    const { createLarkSender } = await import("./sender-PLDU5EZ3.mjs");
     const sender = await createLarkSender(installation.config);
     await sender.sendTextReply({
       chatId: replyTarget.rawTarget.chatId,
@@ -9500,7 +9420,7 @@ function setChannelControllerDeps(deps) {
   _adapterRegistry = deps.adapterRegistry;
   _router = deps.router;
 }
-function getTenantId12(request) {
+function getTenantId11(request) {
   const userTenantId = request.user?.tenantId;
   if (typeof userTenantId === "string" && userTenantId) {
     return userTenantId;
@@ -9630,7 +9550,7 @@ async function getInstallationStore() {
   });
 }
 async function getChannelInstallationList(request) {
-  const tenantId = getTenantId12(request);
+  const tenantId = getTenantId11(request);
   const { channel } = request.query;
   try {
     const store = await getInstallationStore();
@@ -9656,7 +9576,7 @@ async function getChannelInstallationList(request) {
   }
 }
 async function getChannelInstallation(request, reply) {
-  const tenantId = getTenantId12(request);
+  const tenantId = getTenantId11(request);
   const { installationId } = request.params;
   try {
     const store = await getInstallationStore();
@@ -9683,7 +9603,7 @@ async function getChannelInstallation(request, reply) {
   }
 }
 async function createChannelInstallation(request, reply) {
-  const tenantId = getTenantId12(request);
+  const tenantId = getTenantId11(request);
   try {
     const body = snapshotPublicCreateRequest(request.body);
     if (!body) {
@@ -9742,7 +9662,7 @@ async function createChannelInstallation(request, reply) {
   }
 }
 async function updateChannelInstallation(request, reply) {
-  const tenantId = getTenantId12(request);
+  const tenantId = getTenantId11(request);
   const { installationId } = request.params;
   try {
     const store = await getInstallationStore();
@@ -9866,7 +9786,7 @@ async function updateChannelInstallation(request, reply) {
   }
 }
 async function deleteChannelInstallation(request, reply) {
-  const tenantId = getTenantId12(request);
+  const tenantId = getTenantId11(request);
   const { installationId } = request.params;
   try {
     const store = await getInstallationStore();
@@ -9938,7 +9858,7 @@ import {
   descriptorDataValue as descriptorDataValue2
 } from "@axiom-lattice/protocols";
 import { getBindingRegistry, getStoreLattice as getStoreLattice14 } from "@axiom-lattice/core";
-function getTenantId13(request) {
+function getTenantId12(request) {
   const userTenantId = request.user?.tenantId;
   if (typeof userTenantId === "string" && userTenantId) return userTenantId;
   return request.headers["x-tenant-id"] || "default";
@@ -10011,7 +9931,7 @@ function invalidCreateRequest(reply) {
 }
 async function getBindingList(request, _reply) {
   void _reply;
-  const tenantId = getTenantId13(request);
+  const tenantId = getTenantId12(request);
   const { channel, agentId, channelInstallationId, limit, offset } = request.query;
   try {
     const registry = getBindingRegistry();
@@ -10031,7 +9951,7 @@ async function getBindingList(request, _reply) {
   }
 }
 async function getBinding(request, reply) {
-  const tenantId = getTenantId13(request);
+  const tenantId = getTenantId12(request);
   try {
     const registry = getBindingRegistry();
     const binding = await registry.findById(tenantId, request.params.id);
@@ -10046,7 +9966,7 @@ async function getBinding(request, reply) {
   }
 }
 async function createBinding(request, reply) {
-  const tenantId = getTenantId13(request);
+  const tenantId = getTenantId12(request);
   try {
     const input = snapshotPublicCreate(request.body);
     if (!input) return invalidCreateRequest(reply);
@@ -10071,7 +9991,7 @@ async function createBinding(request, reply) {
 }
 async function updateBinding(request, reply) {
   try {
-    const tenantId = getTenantId13(request);
+    const tenantId = getTenantId12(request);
     const registry = getBindingRegistry();
     const existing = await registry.findById(tenantId, request.params.id);
     if (!existing || isInternalBinding(existing)) {
@@ -10098,7 +10018,7 @@ async function updateBinding(request, reply) {
 }
 async function deleteBinding(request, reply) {
   try {
-    const tenantId = getTenantId13(request);
+    const tenantId = getTenantId12(request);
     const registry = getBindingRegistry();
     const existing = await registry.findById(tenantId, request.params.id);
     if (!existing || isInternalBinding(existing)) {
@@ -10115,7 +10035,7 @@ async function deleteBinding(request, reply) {
 }
 async function resolveBinding(request, _reply) {
   void _reply;
-  const tenantId = getTenantId13(request);
+  const tenantId = getTenantId12(request);
   const { channel, senderId, channelInstallationId } = request.query;
   if (channel === "room") {
     return { success: false, message: "No binding found", data: null };
@@ -10145,7 +10065,7 @@ function registerChannelBindingRoutes(app2) {
 
 // src/controllers/menu-items.ts
 import { getMenuRegistry } from "@axiom-lattice/core";
-function getTenantId14(request) {
+function getTenantId13(request) {
   const userTenantId = request.user?.tenantId;
   if (userTenantId) return userTenantId;
   return request.headers["x-tenant-id"] || "default";
@@ -10154,7 +10074,7 @@ function errorMessage(err) {
   return err instanceof Error ? err.message : "Unexpected error";
 }
 async function getMenuItemList(request, _reply) {
-  const tenantId = getTenantId14(request);
+  const tenantId = getTenantId13(request);
   try {
     const registry = getMenuRegistry();
     const items = await registry.list({ tenantId, menuTarget: request.query.menuTarget });
@@ -10166,7 +10086,7 @@ async function getMenuItemList(request, _reply) {
   }
 }
 async function getMenuItem(request, reply) {
-  const tenantId = getTenantId14(request);
+  const tenantId = getTenantId13(request);
   try {
     const registry = getMenuRegistry();
     const item = await registry.getById(request.params.id);
@@ -10183,7 +10103,7 @@ async function getMenuItem(request, reply) {
   }
 }
 async function createMenuItem(request, reply) {
-  const tenantId = getTenantId14(request);
+  const tenantId = getTenantId13(request);
   try {
     const registry = getMenuRegistry();
     const item = await registry.create({ ...request.body, tenantId });
@@ -10198,7 +10118,7 @@ async function createMenuItem(request, reply) {
 }
 async function updateMenuItem(request, reply) {
   try {
-    const tenantId = getTenantId14(request);
+    const tenantId = getTenantId13(request);
     const registry = getMenuRegistry();
     const existing = await registry.getById(request.params.id);
     if (!existing || existing.tenantId !== tenantId) {
@@ -10216,7 +10136,7 @@ async function updateMenuItem(request, reply) {
 }
 async function deleteMenuItem(request, reply) {
   try {
-    const tenantId = getTenantId14(request);
+    const tenantId = getTenantId13(request);
     const registry = getMenuRegistry();
     const existing = await registry.getById(request.params.id);
     if (!existing || existing.tenantId !== tenantId) {
@@ -10499,7 +10419,7 @@ import { getStoreLattice as getStoreLattice15 } from "@axiom-lattice/core";
 import {
   AgentType as AgentType2
 } from "@axiom-lattice/protocols";
-function getTenantId15(request) {
+function getTenantId14(request) {
   const userTenantId = request.user?.tenantId;
   if (userTenantId) return userTenantId;
   return request.headers["x-tenant-id"] || "default";
@@ -10536,7 +10456,7 @@ async function requireManagedAssistant(request, reply) {
     reply.status(400).send({ success: false, error: "assistantId is required" });
     return null;
   }
-  const registered = await getLocalA2AAssistant(getTenantId15(request), assistantId);
+  const registered = await getLocalA2AAssistant(getTenantId14(request), assistantId);
   if (!registered) {
     reply.status(404).send({
       success: false,
@@ -10547,7 +10467,7 @@ async function requireManagedAssistant(request, reply) {
   return { assistantId, localRuntime: registered.localRuntime };
 }
 async function getLocalA2AStatus(request, reply) {
-  const tenantId = getTenantId15(request);
+  const tenantId = getTenantId14(request);
   const managed = await getLocalA2AAssistants(tenantId);
   const states = await Promise.all(
     managed.map(
@@ -11186,7 +11106,7 @@ function notifyProjectTaskAdmission(task) {
   } catch {
   }
 }
-function getTenantId16(request) {
+function getTenantId15(request) {
   const user = request.user;
   const value = user?.tenantId ?? request.headers["x-tenant-id"] ?? "default";
   if (typeof value !== "string" || !value) throw new HttpTaskError(400, "INVALID_TASK_INPUT");
@@ -11427,7 +11347,7 @@ async function validateReferences(store, task, parentId, dependencies) {
 function createTaskController(deps) {
   const mutationMutex = deps.projectMutationMutex ?? projectMutationMutex;
   const authorize = async (request, projectId, capability2) => deps.access.requireProjectAccess({
-    tenantId: getTenantId16(request),
+    tenantId: getTenantId15(request),
     userId: getUserId4(request),
     projectId,
     capability: capability2
@@ -11444,7 +11364,7 @@ function createTaskController(deps) {
     });
   };
   const list = withErrors(async (request) => {
-    const tenantId = getTenantId16(request);
+    const tenantId = getTenantId15(request);
     const userId = getUserId4(request);
     const query = exactObject(request.query, ["projectId", "status", "priority", "limit", "offset", "ownerType", "ownerId", "parentId", "metadata"]);
     const projectId = typeof query.projectId === "string" ? query.projectId : void 0;
@@ -11516,14 +11436,14 @@ function createTaskController(deps) {
   });
   const get = withErrors(async (request, reply) => {
     await preauthorizeExplicitProject(request, authorize);
-    const current = await deps.tasks.getById(getTenantId16(request), request.params.id);
+    const current = await deps.tasks.getById(getTenantId15(request), request.params.id);
     if (!current) return sendNotFound(reply);
     await authorizeRead(request, current, authorize);
     return { success: true, data: current };
   });
   const create = withErrors(async (request, reply) => {
     const body = snapshotCreate(request.body);
-    const tenantId = getTenantId16(request);
+    const tenantId = getTenantId15(request);
     const userId = getUserId4(request);
     const governed = governedCreate(body);
     if (governed) return reply.code(409).send({ success: false, code: governed });
@@ -11576,7 +11496,7 @@ function createTaskController(deps) {
   const update = withErrors(async (request, reply) => {
     const body = snapshotUpdate(request.body);
     await preauthorizeExplicitProject(request, authorize);
-    const current = await deps.tasks.getById(getTenantId16(request), request.params.id);
+    const current = await deps.tasks.getById(getTenantId15(request), request.params.id);
     if (!current) return sendNotFound(reply);
     await authorizeMutation(request, current, authorize);
     return lockedTask(request, current, async (locked) => {
@@ -11594,7 +11514,7 @@ function createTaskController(deps) {
   });
   const remove = withErrors(async (request, reply) => {
     await preauthorizeExplicitProject(request, authorize);
-    const current = await deps.tasks.getById(getTenantId16(request), request.params.id);
+    const current = await deps.tasks.getById(getTenantId15(request), request.params.id);
     if (!current) return sendNotFound(reply);
     await authorizeMutation(request, current, authorize);
     return lockedTask(request, current, async (locked) => {
@@ -11608,7 +11528,7 @@ function createTaskController(deps) {
   const complete = withErrors(async (request, reply) => {
     const body = snapshotComplete(request.body);
     await preauthorizeExplicitProject(request, authorize);
-    const current = await deps.tasks.getById(getTenantId16(request), request.params.id);
+    const current = await deps.tasks.getById(getTenantId15(request), request.params.id);
     if (!current) return sendNotFound(reply);
     await authorizeMutation(request, current, authorize);
     return lockedTask(request, current, async (locked) => {
@@ -11625,7 +11545,7 @@ function createTaskController(deps) {
   });
   const workItems = withErrors(async (request, reply) => {
     await preauthorizeExplicitProject(request, authorize);
-    const current = await deps.tasks.getById(getTenantId16(request), request.params.id);
+    const current = await deps.tasks.getById(getTenantId15(request), request.params.id);
     if (!current) return sendNotFound(reply);
     await authorizeRead(request, current, authorize);
     const query = exactObject(request.query, ["action", "limit", "offset"]);
@@ -11645,7 +11565,7 @@ function createTaskController(deps) {
     const body = snapshotReassign(request.body);
     const pathProject = request.params.projectId;
     const access = await authorize(request, pathProject, "manage");
-    const snapshot = await deps.tasks.getById(getTenantId16(request), request.params.id);
+    const snapshot = await deps.tasks.getById(getTenantId15(request), request.params.id);
     if (!snapshot || snapshot.projectId !== access.project.id || snapshot.workspaceId !== access.project.workspaceId || snapshot.ownerType !== "agent") throw notFound();
     const projectId = snapshot.projectId;
     return deps.executionMutex.runExclusive({
@@ -13045,6 +12965,7 @@ function isMultipartRequestError(error) {
 import { existsSync as existsSync2 } from "fs";
 import { readFile, readdir as readdir2 } from "fs/promises";
 import path3 from "path";
+import { fileURLToPath } from "url";
 import { z as z6 } from "zod";
 var idSchema2 = z6.string().min(1).max(128).regex(/^[A-Za-z0-9._:@-]+$/);
 var JS_CONTENT_TYPE = "application/javascript; charset=utf-8";
@@ -13074,10 +12995,36 @@ async function listChunkCssFiles(assetsDir) {
   }
 }
 var BUNDLED_MARKER = "agent-chat-loader.js";
+function selfModuleDir() {
+  try {
+    const target = {};
+    const originalPrepare = Error.prepareStackTrace;
+    Error.captureStackTrace(target, selfModuleDir);
+    Error.prepareStackTrace = (error, frames2) => frames2;
+    const frames = target.stack;
+    Error.prepareStackTrace = originalPrepare;
+    if (!Array.isArray(frames)) return null;
+    for (const frame of frames) {
+      const callSite = frame;
+      if (typeof callSite.getFileName !== "function") continue;
+      const fileName = callSite.getFileName();
+      if (typeof fileName !== "string" || fileName.length === 0) continue;
+      const filePath = fileName.startsWith("file://") ? fileURLToPath(fileName) : fileName;
+      return path3.dirname(filePath);
+    }
+  } catch {
+  }
+  return null;
+}
 function resolveBundledEmbedDir() {
+  const candidates = [];
   if (typeof __dirname === "string") {
-    const compiled = path3.resolve(__dirname, "embed");
-    if (existsSync2(path3.join(compiled, BUNDLED_MARKER))) return compiled;
+    candidates.push(path3.resolve(__dirname, "embed"));
+  }
+  const selfDir = selfModuleDir();
+  if (selfDir !== null) candidates.push(path3.resolve(selfDir, "embed"));
+  for (const candidate of candidates) {
+    if (existsSync2(path3.join(candidate, BUNDLED_MARKER))) return candidate;
   }
   let dir = path3.dirname(path3.resolve(process.argv[1] ?? process.cwd()));
   for (let depth = 0; depth < 8; depth += 1) {
@@ -14406,7 +14353,14 @@ function registerProjectRoomRoutes(app2, deps) {
     await deps.readStateService.mark(actor(request, params.projectId));
     return { data: { marked: true } };
   }));
-  app2.get("/api/projects/:projectId/members", async (request, reply) => run(reply, async () => ({ data: await deps.membershipService.list(actor(request, projectRoomParamsSchema.parse(request.params).projectId)) })));
+  app2.get("/api/projects/:projectId/members", async (request, reply) => run(reply, async () => {
+    const memberships = await deps.membershipService.list(actor(request, projectRoomParamsSchema.parse(request.params).projectId));
+    const enriched = await Promise.all(memberships.map(async (membership) => {
+      const user = await deps.userDirectory.getUserById(membership.userId);
+      return user === null ? membership : { ...membership, name: user.name };
+    }));
+    return { data: enriched };
+  }));
   app2.post("/api/projects/:projectId/members", async (request, reply) => run(reply, async () => {
     const p = projectRoomParamsSchema.parse(request.params);
     return { statusCode: 201, data: await deps.membershipService.add(actor(request, p.projectId), addProjectMemberSchema.parse(request.body)) };
@@ -14581,13 +14535,16 @@ function registerCoSpaceRoutes(app2, deps) {
               project.id
             );
             const participantNames = [];
+            const otherHumanNames = [];
             for (const m of memberships) {
               if (m.status !== "active") continue;
               const user = await deps.userStore.getUserById(m.userId);
               if (user) {
                 participantNames.push(user.name);
+                if (m.userId !== actor2.userId) otherHumanNames.push(user.name);
               }
             }
+            const displayName = project.kind === "personal" && otherHumanNames.length === 1 ? otherHumanNames[0] : void 0;
             rooms.push({
               project,
               room,
@@ -14596,6 +14553,7 @@ function registerCoSpaceRoutes(app2, deps) {
                 (m) => m.status === "active"
               ).length,
               participantNames,
+              ...displayName === void 0 ? {} : { displayName },
               unreadCount: await computeUnread(
                 deps,
                 actor2.tenantId,
@@ -14613,41 +14571,45 @@ function registerCoSpaceRoutes(app2, deps) {
           const bTime = b.lastMessage ? Date.parse(b.lastMessage.createdAt) : 0;
           return bTime - aTime;
         });
-        const publicRoom = await deps.publicRoom.ensure(actor2.tenantId, params.workspaceId);
-        if (publicRoom) {
-          const publicMessages = await deps.messageStore.list({
-            tenantId: actor2.tenantId,
-            roomId: publicRoom.room.id,
-            limit: 1
-          });
-          const publicLastMessage = publicMessages[0];
-          const publicMemberships = await deps.membershipStore.list(
-            actor2.tenantId,
-            publicRoom.project.id
-          );
-          const publicParticipantNames = [];
-          for (const m of publicMemberships) {
-            if (m.status !== "active") continue;
-            const user = await deps.userStore.getUserById(m.userId);
-            if (user) {
-              publicParticipantNames.push(user.name);
+        try {
+          const publicRoom = await deps.publicRoom.ensure(actor2.tenantId, params.workspaceId);
+          if (publicRoom) {
+            const publicMessages = await deps.messageStore.list({
+              tenantId: actor2.tenantId,
+              roomId: publicRoom.room.id,
+              limit: 1
+            });
+            const publicLastMessage = publicMessages[0];
+            const publicMemberships = await deps.membershipStore.list(
+              actor2.tenantId,
+              publicRoom.project.id
+            );
+            const publicParticipantNames = [];
+            for (const m of publicMemberships) {
+              if (m.status !== "active") continue;
+              const user = await deps.userStore.getUserById(m.userId);
+              if (user) {
+                publicParticipantNames.push(user.name);
+              }
             }
+            rooms.unshift({
+              project: publicRoom.project,
+              room: publicRoom.room,
+              lastMessage: publicLastMessage === void 0 ? void 0 : toProjectRoomPublicMessage2(publicLastMessage),
+              participantCount: publicMemberships.filter((m) => m.status === "active").length,
+              participantNames: publicParticipantNames,
+              isPublic: true,
+              unreadCount: await computeUnread(
+                deps,
+                actor2.tenantId,
+                actor2.userId,
+                publicRoom.room.id,
+                publicLastMessage
+              )
+            });
           }
-          rooms.unshift({
-            project: publicRoom.project,
-            room: publicRoom.room,
-            lastMessage: publicLastMessage === void 0 ? void 0 : toProjectRoomPublicMessage2(publicLastMessage),
-            participantCount: publicMemberships.filter((m) => m.status === "active").length,
-            participantNames: publicParticipantNames,
-            isPublic: true,
-            unreadCount: await computeUnread(
-              deps,
-              actor2.tenantId,
-              actor2.userId,
-              publicRoom.room.id,
-              publicLastMessage
-            )
-          });
+        } catch (e) {
+          console.error("[CoSpace] Failed to assemble public room:", e);
         }
         return { data: { rooms } };
       });
@@ -14672,7 +14634,6 @@ function registerCoSpaceRoutes(app2, deps) {
           );
         }
         let projectId;
-        let otherPartyId;
         if (body.type === "human") {
           projectId = generateDirectHumanProjectId(
             actor2.tenantId,
@@ -14680,7 +14641,6 @@ function registerCoSpaceRoutes(app2, deps) {
             actor2.userId,
             body.targetUserId
           );
-          otherPartyId = body.targetUserId;
         } else {
           projectId = generateDirectBotProjectId(
             actor2.tenantId,
@@ -14688,14 +14648,24 @@ function registerCoSpaceRoutes(app2, deps) {
             actor2.userId,
             body.assistantId
           );
-          otherPartyId = body.assistantId;
         }
         let project = await deps.projectStore.getProjectById(
           actor2.tenantId,
           projectId
         );
         if (!project) {
-          const name = body.type === "human" ? `Direct with ${otherPartyId}` : `Chat with ${otherPartyId}`;
+          let displayName;
+          if (body.type === "human") {
+            const targetUser = await deps.userStore.getUserById(body.targetUserId);
+            displayName = targetUser?.name ?? body.targetUserId;
+          } else {
+            const targetAssistant = await deps.assistantStore.getAssistantById(
+              actor2.tenantId,
+              body.assistantId
+            );
+            displayName = targetAssistant?.name ?? body.assistantId;
+          }
+          const name = body.type === "human" ? `Direct with ${displayName}` : `Chat with ${displayName}`;
           project = await deps.projectStore.createProject(
             actor2.tenantId,
             params.workspaceId,
@@ -14888,12 +14858,28 @@ function registerCoSpaceRoutes(app2, deps) {
             actor2.tenantId,
             directProjectId
           );
-          bots.push({
+          const bot = {
             assistantId: assistant.id,
             name: assistant.name,
             description: assistant.description,
             hasDirectRoom: existingProject !== null
-          });
+          };
+          if (assistant.createdAt) bot.createdAt = assistant.createdAt.toISOString();
+          if (existingProject) {
+            const membership = await deps.botMembershipStore.findByAssistant(
+              actor2.tenantId,
+              directProjectId,
+              assistant.id
+            );
+            if (membership) {
+              if (membership.role) bot.role = membership.role;
+              if (membership.mentionName) bot.mentionName = membership.mentionName;
+              if (membership.responsibility) bot.responsibility = membership.responsibility;
+              bot.status = membership.status;
+              if (membership.joinedAt) bot.joinedAt = membership.joinedAt.toISOString();
+            }
+          }
+          bots.push(bot);
         }
         return { data: { bots } };
       });
@@ -14934,13 +14920,15 @@ function registerCoSpaceRoutes(app2, deps) {
             actor2.tenantId,
             directProjectId
           );
-          members.push({
+          const member = {
             userId: link.userId,
             name: user.name,
             email: user.email,
             role: link.role,
             hasDirectRoom: existingProject !== null
-          });
+          };
+          if (link.joinedAt) member.joinedAt = link.joinedAt.toISOString();
+          members.push(member);
         }
         return { data: { members } };
       });
@@ -18812,7 +18800,15 @@ var registerLatticeRoutes = (app2, channelDeps, options = {}) => {
       });
     }
   };
-  registerProjectRoomRoutes(app2, { roomService, membershipService, messageService, readStateService });
+  registerProjectRoomRoutes(app2, {
+    roomService,
+    membershipService,
+    messageService,
+    readStateService,
+    userDirectory: {
+      getUserById: (id3) => getStoreLattice16("default", "user").store.getUserById(id3).then((u) => u ? { name: u.name } : null)
+    }
+  });
   registerProjectRosterRoutes(app2, { service: rosterService });
   registerCoSpaceRoutes(app2, {
     projectStore: {
@@ -21926,7 +21922,7 @@ async function restoreMcpConnections() {
     const connectedConfigs = configs.filter((c2) => c2.status === "connected");
     if (connectedConfigs.length === 0) return;
     logger5.info(`Restoring ${connectedConfigs.length} MCP server connections...`);
-    const { convertToConnection } = await import("./mcp-configs-IIKQM5GM.mjs");
+    const { convertToConnection } = await import("./mcp-configs-WCY5EXCW.mjs");
     for (const config of connectedConfigs) {
       try {
         const connection = convertToConnection(config.config);
@@ -21975,7 +21971,7 @@ var start = async (config) => {
     let channelDeps;
     const adapterRegistry = new ChannelAdapterRegistry();
     adapterRegistry.register(larkChannelAdapter);
-    const { wechatChannelAdapter } = await import("./WechatChannelAdapter-WSDKR4OA.mjs");
+    const { wechatChannelAdapter } = await import("./WechatChannelAdapter-7WHE5UGY.mjs");
     adapterRegistry.register(wechatChannelAdapter);
     try {
       const { getStoreLattice: getStore11 } = await import("@axiom-lattice/core");
@@ -22026,9 +22022,9 @@ var start = async (config) => {
       projectRoomRealtimeRuntime
     });
     try {
-      const { A2AAuthService, parseEnvKeys } = await import("./A2AAuthService-DK5X6VIL.mjs");
-      const { registerA2AStandardRoutes } = await import("./a2a-standard-WC2BSOFV.mjs");
-      const a2a = await import("./a2a-7N3WDAOP.mjs");
+      const { A2AAuthService, parseEnvKeys } = await import("./A2AAuthService-7UGQ7GMW.mjs");
+      const { registerA2AStandardRoutes } = await import("./a2a-standard-VEQBXBMM.mjs");
+      const a2a = await import("./a2a-FGYX2HH3.mjs");
       const a2aKeyStore = getStoreLattice27("default", "a2aApiKey").store;
       const assistantStore = getStoreLattice27("default", "assistant").store;
       const projectStore = getStoreLattice27("default", "project").store;
@@ -22057,11 +22053,41 @@ var start = async (config) => {
       });
     }
     try {
-      const { registerOpenRoutes } = await import("./open-DCAOL5CG.mjs");
+      const { registerOpenRoutes } = await import("./open-HH7RKGML.mjs");
+      const { registerOpenSessionRoutes } = await import("./open-session-3VN65PRR.mjs");
+      const { registerOpenCatalogRoutes } = await import("./open-catalog-WYS2AENM.mjs");
+      const { registerOpenFilesRoutes } = await import("./open-files-GVRMK5PL.mjs");
+      const { registerOpenAuditRoutes } = await import("./open-audit-UJ3NXCGW.mjs");
+      const { registerOpenExposureRoutes } = await import("./open-exposure-FK4G6O6L.mjs");
+      const { openLattice } = await import("./openLattice-GAAGQJST.mjs");
+      const { createKbProvider } = await import("./kbProvider-2D6DZ34N.mjs");
+      const { createOpenSandboxProvider } = await import("./sandboxProvider-I3P66VXT.mjs");
+      const { createAgentProvider } = await import("./agentProvider-X4FVQPKW.mjs");
+      const { registerExposedPluginTools } = await import("./registerExposedPlugins-63EUF4VS.mjs");
+      const { CollectionService: CollectionService2 } = await import("./collection_service-RTRJEQFL.mjs");
+      openLattice.register(createKbProvider(new CollectionService2()));
+      openLattice.register(createOpenSandboxProvider());
+      const threadStore = getStoreLattice27("default", "thread").store;
+      const assistantStore = getStoreLattice27("default", "assistant").store;
+      openLattice.register(
+        createAgentProvider({
+          threadStore,
+          resolveAssistant: async (tenantId, assistantId) => {
+            const assistant = await assistantStore.getAssistantById(tenantId, assistantId);
+            return assistant ? { name: assistant.name, description: assistant.description } : null;
+          }
+        })
+      );
+      await registerExposedPluginTools();
       registerOpenRoutes(app);
-      logger5.info("Open MCP spike routes registered");
+      registerOpenSessionRoutes(app);
+      registerOpenCatalogRoutes(app);
+      registerOpenFilesRoutes(app);
+      registerOpenAuditRoutes(app);
+      registerOpenExposureRoutes(app);
+      logger5.info("Open API routes registered (kb + sandbox providers, session exchange)");
     } catch (err) {
-      logger5.warn("Open MCP spike routes unavailable", {
+      logger5.warn("Open API routes unavailable", {
         error: err instanceof Error ? err.message : String(err)
       });
     }
@@ -22070,7 +22096,7 @@ var start = async (config) => {
       logger5.info("Registered sandbox manager from env configuration");
     }
     try {
-      const { ResourceController } = await import("./resources-VA7LSDKN.mjs");
+      const { ResourceController } = await import("./resources-SRQRKW5G.mjs");
       const sharedResourceStore = getStoreLattice27("default", "sharedResource").store;
       const cache = new TokenCache();
       const resourceController = new ResourceController({