@axiom-lattice/gateway 4.5.0 → 4.6.0

package/dist/index.js

@@ -956,18 +956,18 @@ function extractText(msg) {
   }
   return null;
 }
-var import_zod16, logger5, wechatConfigSchema, MAX_RECONNECT_DELAY_MS, BASE_RECONNECT_DELAY_MS, HEARTBEAT_INTERVAL_MS, MSG_TYPE_USER, MSG_ITEM_TEXT, activeConnections2, seenClientIds, wechatChannelAdapter;
+var import_zod18, logger6, wechatConfigSchema, MAX_RECONNECT_DELAY_MS, BASE_RECONNECT_DELAY_MS, HEARTBEAT_INTERVAL_MS, MSG_TYPE_USER, MSG_ITEM_TEXT, activeConnections2, seenClientIds, wechatChannelAdapter;
 var init_WechatChannelAdapter = __esm({
   "src/channels/wechat/WechatChannelAdapter.ts"() {
     "use strict";
-    import_zod16 = require("zod");
+    import_zod18 = require("zod");
     init_wechat_client();
     init_context_store();
     init_Logger();
-    logger5 = new Logger({ serviceName: "lattice/gateway/wechat" });
-    wechatConfigSchema = import_zod16.z.object({
-      botToken: import_zod16.z.string(),
-      uin: import_zod16.z.string().optional()
+    logger6 = new Logger({ serviceName: "lattice/gateway/wechat" });
+    wechatConfigSchema = import_zod18.z.object({
+      botToken: import_zod18.z.string(),
+      uin: import_zod18.z.string().optional()
     });
     MAX_RECONNECT_DELAY_MS = 3e4;
     BASE_RECONNECT_DELAY_MS = 1e3;
@@ -1015,7 +1015,7 @@ var init_WechatChannelAdapter = __esm({
         const senderId = replyTarget.rawTarget.senderId;
         const contextToken = getContextToken(installation.id, senderId);
         if (!contextToken) {
-          logger5.warn("WeChat context token expired, cannot send reply", {
+          logger6.warn("WeChat context token expired, cannot send reply", {
             installationId: installation.id,
             senderId
           });
@@ -1033,14 +1033,14 @@ var init_WechatChannelAdapter = __esm({
       async connect(installation, deps) {
         const { id: installationId, tenantId, config } = installation;
         if (!config.botToken) {
-          logger5.warn("WeChat installation missing botToken, skipping", { installationId });
+          logger6.warn("WeChat installation missing botToken, skipping", { installationId });
           return;
         }
         if (activeConnections2.has(installationId)) {
-          logger5.warn("WeChat polling already running for installation, skipping", { installationId });
+          logger6.warn("WeChat polling already running for installation, skipping", { installationId });
           return;
         }
-        logger5.info("WeChat polling starting", { installationId, tenantId });
+        logger6.info("WeChat polling starting", { installationId, tenantId });
         const abortController = new AbortController();
         const heartbeatTimer = setInterval(() => {
           const state2 = activeConnections2.get(installationId);
@@ -1050,7 +1050,7 @@ var init_WechatChannelAdapter = __esm({
           }
           const elapsed = Date.now() - state2.lastActivity;
           if (elapsed > HEARTBEAT_INTERVAL_MS * 2) {
-            logger5.error("WeChat polling heartbeat lost \u2014 no activity", {
+            logger6.error("WeChat polling heartbeat lost \u2014 no activity", {
               installationId,
               elapsedMs: elapsed
             });
@@ -1069,7 +1069,7 @@ var init_WechatChannelAdapter = __esm({
         let reconnectDelay = BASE_RECONNECT_DELAY_MS;
         const scheduleNextPoll = () => {
           poll().catch((err) => {
-            logger5.error("WeChat poll iteration crashed", {
+            logger6.error("WeChat poll iteration crashed", {
               installationId,
               error: err instanceof Error ? err.message : String(err)
             });
@@ -1082,7 +1082,7 @@ var init_WechatChannelAdapter = __esm({
         const poll = async () => {
           const currentState = activeConnections2.get(installationId);
           if (!currentState || currentState.abortController.signal.aborted) {
-            logger5.info("WeChat polling aborted", { installationId });
+            logger6.info("WeChat polling aborted", { installationId });
             return;
           }
           try {
@@ -1095,7 +1095,7 @@ var init_WechatChannelAdapter = __esm({
             reconnectDelay = BASE_RECONNECT_DELAY_MS;
             currentState.lastActivity = Date.now();
             if (result.msgs.length > 0) {
-              logger5.info("WeChat poll received messages", {
+              logger6.info("WeChat poll received messages", {
                 installationId,
                 count: result.msgs.length
               });
@@ -1112,7 +1112,7 @@ var init_WechatChannelAdapter = __esm({
               if (inbound && router) {
                 const dispatchResult = await router.dispatch(inbound);
                 if (!dispatchResult.success) {
-                  logger5.warn("WeChat dispatch failed", {
+                  logger6.warn("WeChat dispatch failed", {
                     installationId,
                     error: dispatchResult.error?.message
                   });
@@ -1121,10 +1121,10 @@ var init_WechatChannelAdapter = __esm({
             }
           } catch (err) {
             if (err instanceof Error && err.name === "AbortError") {
-              logger5.info("WeChat poll aborted by signal", { installationId });
+              logger6.info("WeChat poll aborted by signal", { installationId });
               return;
             }
-            logger5.error("WeChat poll error", {
+            logger6.error("WeChat poll error", {
               installationId,
               error: err instanceof Error ? err.message : String(err)
             });
@@ -1134,19 +1134,19 @@ var init_WechatChannelAdapter = __esm({
           scheduleNextPoll();
         };
         scheduleNextPoll();
-        logger5.info("WeChat polling started", { installationId });
+        logger6.info("WeChat polling started", { installationId });
       },
       async disconnect(installationId) {
         const state = activeConnections2.get(installationId);
         if (!state) {
-          logger5.warn("WeChat polling not running, nothing to disconnect", { installationId });
+          logger6.warn("WeChat polling not running, nothing to disconnect", { installationId });
           return;
         }
-        logger5.info("WeChat polling disconnecting", { installationId });
+        logger6.info("WeChat polling disconnecting", { installationId });
         state.abortController.abort();
         clearInterval(state.heartbeatTimer);
         activeConnections2.delete(installationId);
-        logger5.info("WeChat polling disconnected", { installationId });
+        logger6.info("WeChat polling disconnected", { installationId });
       }
     };
   }
@@ -1179,11 +1179,11 @@ function devModeDefaults() {
   const projectId = process.env[DEFAULT_PROJECT_ENV] || void 0;
   return { tenantId, projectId };
 }
-var import_protocols32, A2AAuthError, DEFAULT_TENANT_ENV, DEFAULT_TENANT_ID, DEFAULT_PROJECT_ENV, BEARER_SCHEME_RE, A2AAuthService;
+var import_protocols33, A2AAuthError, DEFAULT_TENANT_ENV, DEFAULT_TENANT_ID, DEFAULT_PROJECT_ENV, BEARER_SCHEME_RE, A2AAuthService;
 var init_A2AAuthService = __esm({
   "src/services/a2a/A2AAuthService.ts"() {
     "use strict";
-    import_protocols32 = require("@axiom-lattice/protocols");
+    import_protocols33 = require("@axiom-lattice/protocols");
     A2AAuthError = class extends Error {
       constructor(message, statusCode) {
         super(message);
@@ -1238,7 +1238,7 @@ var init_A2AAuthService = __esm({
         const entry = merged.get(token);
         if (!entry) return { authenticated: false };
         const hasExplicitGrants = Array.isArray(entry.grants) && entry.grants.length > 0;
-        const agentGrant = (0, import_protocols32.effectiveGrants)(entry).find((g) => g.domain === "agent");
+        const agentGrant = (0, import_protocols33.effectiveGrants)(entry).find((g) => g.domain === "agent");
         const assistantIds = hasExplicitGrants ? agentGrant?.items ?? [] : entry.assistantIds;
         return {
           authenticated: true,
@@ -1453,7 +1453,7 @@ function extractFailureReason(task) {
   return extractText2(task.status.message.parts);
 }
 function observationEventKey(task, result, failureReason) {
-  const digest = (0, import_node_crypto26.createHash)("sha256").update(JSON.stringify({
+  const digest = (0, import_node_crypto28.createHash)("sha256").update(JSON.stringify({
     state: task.status.state,
     timestamp: task.status.timestamp,
     message: task.status.message,
@@ -1463,7 +1463,7 @@ function observationEventKey(task, result, failureReason) {
   return `a2a-status-observation:${task.id}:${digest}`;
 }
 function snapshotEventKey(task) {
-  const digest = (0, import_node_crypto26.createHash)("sha256").update(JSON.stringify(task)).digest("hex");
+  const digest = (0, import_node_crypto28.createHash)("sha256").update(JSON.stringify(task)).digest("hex");
   return `a2a-task-snapshot:${task.id}:${digest}`;
 }
 function isGovernedObservation(state) {
@@ -1475,13 +1475,13 @@ function isA2ATaskSnapshot(value) {
 function snapshotSequence(value) {
   return typeof value === "number" && Number.isSafeInteger(value) && value >= 0 ? value : void 0;
 }
-var import_node_crypto26, import_node_util, import_core65, TASK_STATUS_TO_A2A_STATE, TITLE_MAX_LENGTH, A2ATaskScopeConflictError, A2ATaskStoreAdapter;
+var import_node_crypto28, import_node_util, import_core66, TASK_STATUS_TO_A2A_STATE, TITLE_MAX_LENGTH, A2ATaskScopeConflictError, A2ATaskStoreAdapter;
 var init_A2ATaskStoreAdapter = __esm({
   "src/services/a2a/A2ATaskStoreAdapter.ts"() {
     "use strict";
-    import_node_crypto26 = require("crypto");
+    import_node_crypto28 = require("crypto");
     import_node_util = require("util");
-    import_core65 = require("@axiom-lattice/core");
+    import_core66 = require("@axiom-lattice/core");
     TASK_STATUS_TO_A2A_STATE = {
       pending: "submitted",
       in_progress: "working",
@@ -1507,7 +1507,7 @@ var init_A2ATaskStoreAdapter = __esm({
         this.workItemStore = options.workItemStore;
         this.lifecycle = options.lifecycle;
         this.scope = options.scope;
-        this.runBridge = (0, import_core65.createTaskRunBridge)({
+        this.runBridge = (0, import_core66.createTaskRunBridge)({
           lifecycle: this.lifecycle,
           taskStore: this.taskStore,
           workItemStore: this.workItemStore
@@ -1858,13 +1858,13 @@ function assistantHasGovernedTask(assistant) {
   const allowedTools = taskMiddleware?.allowedTools;
   return !!taskMiddleware && (allowedTools === void 0 || Array.isArray(allowedTools) && (allowedTools.length === 0 || allowedTools.includes("manage_task")));
 }
-var import_uuid11, import_core66, import_protocols33, _AxiomAgentExecutor, AxiomAgentExecutor;
+var import_uuid11, import_core67, import_protocols34, _AxiomAgentExecutor, AxiomAgentExecutor;
 var init_AxiomAgentExecutor = __esm({
   "src/services/a2a/AxiomAgentExecutor.ts"() {
     "use strict";
     import_uuid11 = require("uuid");
-    import_core66 = require("@axiom-lattice/core");
-    import_protocols33 = require("@axiom-lattice/protocols");
+    import_core67 = require("@axiom-lattice/core");
+    import_protocols34 = require("@axiom-lattice/protocols");
     init_a2aFileRefs();
     init_task_file_refs();
     _AxiomAgentExecutor = class _AxiomAgentExecutor {
@@ -1945,7 +1945,7 @@ var init_AxiomAgentExecutor = __esm({
           await this.taskStore.save(initialTask);
           bus.publish(initialTask);
           try {
-            const agent = import_core66.agentInstanceManager.getAgent(this.agentParams(threadId));
+            const agent = import_core67.agentInstanceManager.getAgent(this.agentParams(threadId));
             const requestText = inputFiles.length > 0 ? `${text}
 
 ${formatFileRefsSection(inputFiles)}` : text;
@@ -1963,7 +1963,7 @@ ${formatFileRefsSection(inputFiles)}` : text;
               custom_run_config: { taskId: ctx.taskId, execution: { taskId: ctx.taskId } }
             });
             const stream = agent.chunkStream(messageId, [
-              import_protocols33.MessageChunkTypes.MESSAGE_COMPLETED
+              import_protocols34.MessageChunkTypes.MESSAGE_COMPLETED
             ]);
             let outputText = "";
             let interrupted = false;
@@ -1971,14 +1971,14 @@ ${formatFileRefsSection(inputFiles)}` : text;
               if (execution.canceled) return;
               const chunkType = chunk.type;
               const chunkText = chunk.data?.content ?? "";
-              if (chunkType === import_protocols33.MessageChunkTypes.INTERRUPT) {
+              if (chunkType === import_protocols34.MessageChunkTypes.INTERRUPT) {
                 interrupted = true;
                 break;
               }
-              if (chunkType === import_protocols33.MessageChunkTypes.AI && chunkText) {
+              if (chunkType === import_protocols34.MessageChunkTypes.AI && chunkText) {
                 outputText += chunkText;
               }
-              if (chunkType === import_protocols33.MessageChunkTypes.AI || chunkType === import_protocols33.MessageChunkTypes.TOOL) {
+              if (chunkType === import_protocols34.MessageChunkTypes.AI || chunkType === import_protocols34.MessageChunkTypes.TOOL) {
                 if (chunkText) {
                   bus.publish({
                     kind: "status-update",
@@ -2140,7 +2140,7 @@ ${formatFileRefsSection(inputFiles)}` : text;
         const threadId = task ? asString2(task.metadata?.threadId) : void 0;
         if (threadId) {
           try {
-            const agent = import_core66.agentInstanceManager.getAgent(this.agentParams(threadId));
+            const agent = import_core67.agentInstanceManager.getAgent(this.agentParams(threadId));
             await agent.abort();
           } catch (err) {
             console.warn({
@@ -2494,10 +2494,10 @@ function isAsyncGenerator(value) {
 }
 function registerA2AStandardRoutes(app2, deps) {
   const authService = deps.authService;
-  const resolveTasks = deps.getTaskStoreLattice ?? (() => (0, import_core67.getStoreLattice)("default", "task").store);
-  const resolveTaskWorkItems = deps.getTaskWorkItemStore ?? (() => (0, import_core67.getStoreLattice)("default", "taskWorkItem").store);
-  const getAssistantStore2 = deps.getAssistantStore ?? (() => (0, import_core67.getStoreLattice)("default", "assistant").store);
-  const getProjectStore2 = deps.getProjectStore ?? (() => (0, import_core67.getStoreLattice)("default", "project").store);
+  const resolveTasks = deps.getTaskStoreLattice ?? (() => (0, import_core68.getStoreLattice)("default", "task").store);
+  const resolveTaskWorkItems = deps.getTaskWorkItemStore ?? (() => (0, import_core68.getStoreLattice)("default", "taskWorkItem").store);
+  const getAssistantStore2 = deps.getAssistantStore ?? (() => (0, import_core68.getStoreLattice)("default", "assistant").store);
+  const getProjectStore2 = deps.getProjectStore ?? (() => (0, import_core68.getStoreLattice)("default", "project").store);
   const runtimeRegistry = deps.runtimeRegistry ?? new A2ARuntimeRegistry();
   app2.addHook("onClose", async () => {
     runtimeRegistry.close();
@@ -2580,7 +2580,7 @@ function registerA2AStandardRoutes(app2, deps) {
       const taskStore = assistantHasGovernedTask(assistant) ? new A2ATaskStoreAdapter({
         taskStore: internalTasks,
         workItemStore: workItems,
-        lifecycle: (0, import_core67.createTaskLifecycleService)({
+        lifecycle: (0, import_core68.createTaskLifecycleService)({
           taskStore: internalTasks,
           workItemStore: workItems
         }),
@@ -2699,7 +2699,7 @@ data: ${JSON.stringify(errorResponse)}
       const taskStore = assistantHasGovernedTask(assistant) ? new A2ATaskStoreAdapter({
         taskStore: internalTasks,
         workItemStore: workItems,
-        lifecycle: (0, import_core67.createTaskLifecycleService)({
+        lifecycle: (0, import_core68.createTaskLifecycleService)({
           taskStore: internalTasks,
           workItemStore: workItems
         }),
@@ -2744,13 +2744,13 @@ data: ${JSON.stringify(data)}
     }
   );
 }
-var import_uuid12, import_server2, import_core67, SSE_HEADERS;
+var import_uuid12, import_server2, import_core68, SSE_HEADERS;
 var init_a2a_standard = __esm({
   "src/routes/a2a-standard.ts"() {
     "use strict";
     import_uuid12 = require("uuid");
     import_server2 = require("@a2a-js/sdk/server");
-    import_core67 = require("@axiom-lattice/core");
+    import_core68 = require("@axiom-lattice/core");
     init_A2AAuthService();
     init_A2AAgentCardBuilder();
     init_A2ATaskStoreAdapter();
@@ -2958,11 +2958,11 @@ var init_a2a = __esm({
 });
 
 // src/services/open/openAuthService.ts
-var import_protocols34, OpenAuthService;
+var import_protocols35, OpenAuthService;
 var init_openAuthService = __esm({
   "src/services/open/openAuthService.ts"() {
     "use strict";
-    import_protocols34 = require("@axiom-lattice/protocols");
+    import_protocols35 = require("@axiom-lattice/protocols");
     OpenAuthService = class {
       constructor(keyStore) {
         this.keyStore = keyStore;
@@ -2976,7 +2976,7 @@ var init_openAuthService = __esm({
           kind: "api_key",
           tenantId: record.tenantId,
           projectId: record.projectId,
-          grants: (0, import_protocols34.effectiveGrants)(record)
+          grants: (0, import_protocols35.effectiveGrants)(record)
         };
       }
     };
@@ -2984,11 +2984,11 @@ var init_openAuthService = __esm({
 });
 
 // src/services/open/openCredentialService.ts
-var import_protocols35, OpenCredentialService;
+var import_protocols36, OpenCredentialService;
 var init_openCredentialService = __esm({
   "src/services/open/openCredentialService.ts"() {
     "use strict";
-    import_protocols35 = require("@axiom-lattice/protocols");
+    import_protocols36 = require("@axiom-lattice/protocols");
     init_openToken();
     init_openAuthService();
     OpenCredentialService = class {
@@ -3147,11 +3147,11 @@ function grantCovers(grants, domain, action) {
     (g) => g.domain === domain && (!g.items || g.items.length === 0 || g.items.includes(action))
   );
 }
-var import_zod17, GrantDeniedError, ValidationError, ActionNotFoundError, OpenLattice, openLattice;
+var import_zod19, GrantDeniedError, ValidationError, ActionNotFoundError, OpenLattice, openLattice;
 var init_openLattice = __esm({
   "src/services/open/openLattice.ts"() {
     "use strict";
-    import_zod17 = require("zod");
+    import_zod19 = require("zod");
     GrantDeniedError = class extends Error {
       constructor(toolName) {
         super(`GRANT_DENIED: no grant covers ${toolName}`);
@@ -3291,7 +3291,7 @@ var init_openLattice = __esm({
           throw new GrantDeniedError(toolName);
         }
         const resolvedSchema = resolved.action.schema;
-        const parsed = "safeParse" in resolvedSchema ? resolvedSchema.safeParse(args) : import_zod17.z.object(resolvedSchema).safeParse(args);
+        const parsed = "safeParse" in resolvedSchema ? resolvedSchema.safeParse(args) : import_zod19.z.object(resolvedSchema).safeParse(args);
         if (!parsed.success) {
           throw new ValidationError(parsed.error.issues.map((i) => `${i.path.join(".")}: ${i.message}`).join("; "));
         }
@@ -3424,7 +3424,7 @@ var init_openMcpServer = __esm({
 
 // src/services/open/pluginExposeAdapter.ts
 function schemaOf(tool) {
-  return tool.lc_kwargs?.schema ?? tool.schema ?? import_zod18.z.object({}).passthrough();
+  return tool.lc_kwargs?.schema ?? tool.schema ?? import_zod20.z.object({}).passthrough();
 }
 function createPluginProvider(domain, tools, options = {}) {
   function toAction(info) {
@@ -3472,11 +3472,11 @@ function createPluginProvider(domain, tools, options = {}) {
     }
   };
 }
-var import_zod18;
+var import_zod20;
 var init_pluginExposeAdapter = __esm({
   "src/services/open/pluginExposeAdapter.ts"() {
     "use strict";
-    import_zod18 = require("zod");
+    import_zod20 = require("zod");
   }
 });
 
@@ -3501,8 +3501,8 @@ function exposedDeclarations(plugin) {
   return (plugin.meta.tools ?? []).filter((t2) => t2.expose);
 }
 async function registerExposedPluginTools() {
-  for (const key of import_core68.PluginRegistry.list()) {
-    const plugin = import_core68.PluginRegistry.get(key);
+  for (const key of import_core69.PluginRegistry.list()) {
+    const plugin = import_core69.PluginRegistry.get(key);
     if (!plugin?.middleware) continue;
     const exposed = exposedDeclarations(plugin);
     if (exposed.length === 0) continue;
@@ -3537,8 +3537,8 @@ async function registerExposedPluginTools() {
 }
 function collectExposedPluginUiResources(grants) {
   const resources = /* @__PURE__ */ new Map();
-  for (const type of import_core68.PluginRegistry.list()) {
-    const plugin = import_core68.PluginRegistry.get(type);
+  for (const type of import_core69.PluginRegistry.list()) {
+    const plugin = import_core69.PluginRegistry.get(type);
     if (!plugin?.middleware) continue;
     const exposedNames = new Set(exposedDeclarations(plugin).map((d) => d.name));
     if (exposedNames.size === 0) continue;
@@ -3562,11 +3562,11 @@ function collectExposedPluginUiResources(grants) {
   }
   return resources;
 }
-var import_core68;
+var import_core69;
 var init_registerExposedPlugins = __esm({
   "src/services/open/registerExposedPlugins.ts"() {
     "use strict";
-    import_core68 = require("@axiom-lattice/core");
+    import_core69 = require("@axiom-lattice/core");
     init_openLattice();
     init_pluginExposeAdapter();
   }
@@ -3581,14 +3581,14 @@ function toText(result) {
 }
 function defaultCatalog() {
   return {
-    getValidatedManifest: (tenantId, type) => (0, import_core69.getSandboxPluginCatalog)().getValidatedManifest(tenantId, type),
-    getExecutor: () => (0, import_core69.getSandboxPluginCatalog)().getExecutor(),
-    readPluginFile: (tenantId, type, relPath) => (0, import_core69.getSandboxPluginCatalog)().readPluginFile(tenantId, type, relPath)
+    getValidatedManifest: (tenantId, type) => (0, import_core70.getSandboxPluginCatalog)().getValidatedManifest(tenantId, type),
+    getExecutor: () => (0, import_core70.getSandboxPluginCatalog)().getExecutor(),
+    readPluginFile: (tenantId, type, relPath) => (0, import_core70.getSandboxPluginCatalog)().readPluginFile(tenantId, type, relPath)
   };
 }
 async function defaultResolveConnections(pluginType, ctx) {
   try {
-    return await (0, import_core69.resolveSandboxPluginConnections)(
+    return await (0, import_core70.resolveSandboxPluginConnections)(
       pluginType,
       { connectAll: true },
       {
@@ -3617,7 +3617,7 @@ function mergeOpenCatalog(globalCatalog, tenantTools) {
 async function buildTenantOpenPlugins(tenantId, grants, deps = {}) {
   const catalog = deps.catalog ?? defaultCatalog();
   const listPlugins = deps.listPlugins ?? (async (tenant2) => {
-    const snapshot = await (0, import_core69.getSandboxPluginCatalog)().ensureLoaded(tenant2);
+    const snapshot = await (0, import_core70.getSandboxPluginCatalog)().ensureLoaded(tenant2);
     return { plugins: snapshot.plugins, diagnostics: snapshot.diagnostics };
   });
   const resolveConnections = deps.resolveConnections ?? defaultResolveConnections;
@@ -3659,7 +3659,7 @@ async function buildTenantOpenPlugins(tenantId, grants, deps = {}) {
         domain,
         action: tool.name,
         description: tool.description,
-        schema: (0, import_core69.jsonSchemaToZod)(tool.schema),
+        schema: (0, import_core70.jsonSchemaToZod)(tool.schema),
         annotations: {
           readOnlyHint: tool.readOnly ?? false,
           destructiveHint: tool.destructive ?? false
@@ -3710,11 +3710,11 @@ async function buildTenantOpenPlugins(tenantId, grants, deps = {}) {
     }
   };
 }
-var import_core69;
+var import_core70;
 var init_tenantOpenPlugins = __esm({
   "src/services/open/tenantOpenPlugins.ts"() {
     "use strict";
-    import_core69 = require("@axiom-lattice/core");
+    import_core70 = require("@axiom-lattice/core");
     init_openLattice();
     init_pluginToolExecution();
   }
@@ -3751,13 +3751,13 @@ function emptyTenantPlugins() {
 }
 function registerOpenRoutes(app2, deps = {}) {
   const openAuth = deps.openAuth ?? new OpenCredentialService(
-    (0, import_core70.getStoreLattice)("default", "a2aApiKey").store,
-    (0, import_core70.getStoreLattice)("default", "project").store
+    (0, import_core71.getStoreLattice)("default", "a2aApiKey").store,
+    (0, import_core71.getStoreLattice)("default", "project").store
   );
   const grantsSource = deps.grantsSource ?? ((ctx) => ctx.grants);
   const audit = deps.audit ?? (() => {
     try {
-      const store2 = (0, import_core70.getStoreLattice)("default", "openAudit").store;
+      const store2 = (0, import_core71.getStoreLattice)("default", "openAudit").store;
       return new OpenAuditService(store2);
     } catch {
       return void 0;
@@ -3911,12 +3911,12 @@ function registerOpenRoutes(app2, deps = {}) {
     }
   );
 }
-var import_types, import_core70, RPC_ERROR;
+var import_types, import_core71, RPC_ERROR;
 var init_open = __esm({
   "src/routes/open.ts"() {
     "use strict";
     import_types = require("@modelcontextprotocol/sdk/types.js");
-    import_core70 = require("@axiom-lattice/core");
+    import_core71 = require("@axiom-lattice/core");
     init_openCredentialService();
     init_openAuditService();
     init_openRateLimiter();
@@ -3949,7 +3949,7 @@ function registerOpenSessionRoutes(app2) {
       if (typeof shareToken !== "string" || shareToken.length === 0) {
         return reply.status(400).send({ error: "SHARE_TOKEN_REQUIRED" });
       }
-      const store2 = (0, import_core71.getStoreLattice)("default", "sharedResource").store;
+      const store2 = (0, import_core72.getStoreLattice)("default", "sharedResource").store;
       const record = await store2.findByToken(shareToken);
       if (!record || record.revoked) {
         return reply.status(404).send({ error: "SHARE_NOT_FOUND" });
@@ -3974,11 +3974,11 @@ function registerOpenSessionRoutes(app2) {
     }
   );
 }
-var import_core71;
+var import_core72;
 var init_open_session = __esm({
   "src/routes/open-session.ts"() {
     "use strict";
-    import_core71 = require("@axiom-lattice/core");
+    import_core72 = require("@axiom-lattice/core");
     init_openToken();
     init_previewToken();
     init_openLattice();
@@ -3987,13 +3987,13 @@ var init_open_session = __esm({
 
 // src/services/open/openCatalogService.ts
 async function defaultListTenantPlugins(tenantId) {
-  return (await (0, import_core72.getSandboxPluginCatalog)().ensureLoaded(tenantId)).plugins;
+  return (await (0, import_core73.getSandboxPluginCatalog)().ensureLoaded(tenantId)).plugins;
 }
-var import_core72, OpenCatalogService;
+var import_core73, OpenCatalogService;
 var init_openCatalogService = __esm({
   "src/services/open/openCatalogService.ts"() {
     "use strict";
-    import_core72 = require("@axiom-lattice/core");
+    import_core73 = require("@axiom-lattice/core");
     init_openLattice();
     OpenCatalogService = class {
       constructor(assistantStore, lattice = openLattice, listTenantPlugins2 = defaultListTenantPlugins) {
@@ -4068,17 +4068,17 @@ function registerOpenCatalogRoutes(app2) {
     if (!tenantId) {
       return reply.status(401).send({ success: false, error: "Unauthorized" });
     }
-    const assistantStore = (0, import_core73.getStoreLattice)("default", "assistant").store;
+    const assistantStore = (0, import_core74.getStoreLattice)("default", "assistant").store;
     const service2 = new OpenCatalogService(assistantStore);
     const catalog = await service2.buildForTenant(tenantId);
     return reply.status(200).send({ success: true, data: catalog });
   });
 }
-var import_core73;
+var import_core74;
 var init_open_catalog = __esm({
   "src/routes/open-catalog.ts"() {
     "use strict";
-    import_core73 = require("@axiom-lattice/core");
+    import_core74 = require("@axiom-lattice/core");
     init_openCatalogService();
   }
 });
@@ -4090,7 +4090,7 @@ __export(sandboxProvider_exports, {
   resolveContextSandbox: () => resolveContextSandbox
 });
 async function resolveContextSandbox(ctx) {
-  return import_core74.sandboxLatticeManager.getSandboxFromConfig({
+  return import_core75.sandboxLatticeManager.getSandboxFromConfig({
     assistant_id: "",
     thread_id: "",
     tenantId: ctx.tenantId,
@@ -4109,21 +4109,21 @@ function createOpenSandboxProvider() {
         name: "files_read",
         label: "Read files",
         description: "Read a file from the project sandbox.",
-        schema: { path: import_zod19.z.string().min(1) },
+        schema: { path: import_zod21.z.string().min(1) },
         annotations: { readOnlyHint: true, destructiveHint: false }
       },
       {
         name: "files_list",
         label: "List files",
         description: "List files under a directory in the project sandbox.",
-        schema: { path: import_zod19.z.string(), recursive: import_zod19.z.boolean().optional() },
+        schema: { path: import_zod21.z.string(), recursive: import_zod21.z.boolean().optional() },
         annotations: { readOnlyHint: true, destructiveHint: false }
       },
       {
         name: "files_write",
         label: "Write files",
         description: "Write content to a file in the project sandbox.",
-        schema: { path: import_zod19.z.string().min(1), content: import_zod19.z.string() },
+        schema: { path: import_zod21.z.string().min(1), content: import_zod21.z.string() },
         annotations: { readOnlyHint: false, destructiveHint: true }
       },
       {
@@ -4131,9 +4131,9 @@ function createOpenSandboxProvider() {
         label: "Run shell commands",
         description: "Execute a shell command in the project sandbox. Returns stdout (up to 64KB) and exit code.",
         schema: {
-          command: import_zod19.z.string().min(1),
-          exec_dir: import_zod19.z.string().optional(),
-          timeout: import_zod19.z.number().int().min(1e3).optional()
+          command: import_zod21.z.string().min(1),
+          exec_dir: import_zod21.z.string().optional(),
+          timeout: import_zod21.z.number().int().min(1e3).optional()
         },
         annotations: { readOnlyHint: false, destructiveHint: true }
       }
@@ -4188,12 +4188,12 @@ ${truncated}`
     }
   };
 }
-var import_zod19, import_core74, MAX_OUTPUT_BYTES;
+var import_zod21, import_core75, MAX_OUTPUT_BYTES;
 var init_sandboxProvider = __esm({
   "src/services/open/providers/sandboxProvider.ts"() {
     "use strict";
-    import_zod19 = require("zod");
-    import_core74 = require("@axiom-lattice/core");
+    import_zod21 = require("zod");
+    import_core75 = require("@axiom-lattice/core");
     MAX_OUTPUT_BYTES = 64e3;
   }
 });
@@ -4215,12 +4215,12 @@ function safePath(raw) {
 }
 function registerOpenFilesRoutes(app2, deps = {}) {
   const openAuth = deps.openAuth ?? new OpenCredentialService(
-    (0, import_core75.getStoreLattice)("default", "a2aApiKey").store,
-    (0, import_core75.getStoreLattice)("default", "project").store
+    (0, import_core76.getStoreLattice)("default", "a2aApiKey").store,
+    (0, import_core76.getStoreLattice)("default", "project").store
   );
   const audit = deps.audit ?? (() => {
     try {
-      const store2 = (0, import_core75.getStoreLattice)("default", "openAudit").store;
+      const store2 = (0, import_core76.getStoreLattice)("default", "openAudit").store;
       return new OpenAuditService(store2);
     } catch {
       return void 0;
@@ -4330,11 +4330,11 @@ function registerOpenFilesRoutes(app2, deps = {}) {
     }
   });
 }
-var import_core75;
+var import_core76;
 var init_open_files = __esm({
   "src/routes/open-files.ts"() {
     "use strict";
-    import_core75 = require("@axiom-lattice/core");
+    import_core76 = require("@axiom-lattice/core");
     init_openCredentialService();
     init_openLattice();
     init_sandboxProvider();
@@ -4356,7 +4356,7 @@ function registerOpenAuditRoutes(app2) {
         return reply.status(401).send({ success: false, error: "Unauthorized" });
       }
       const status = request.query.status === "ok" || request.query.status === "error" ? request.query.status : void 0;
-      const store2 = (0, import_core76.getStoreLattice)("default", "openAudit").store;
+      const store2 = (0, import_core77.getStoreLattice)("default", "openAudit").store;
       const records = await store2.query({
         tenantId,
         credentialId: request.query.credentialId,
@@ -4371,11 +4371,11 @@ function registerOpenAuditRoutes(app2) {
     }
   );
 }
-var import_core76;
+var import_core77;
 var init_open_audit = __esm({
   "src/routes/open-audit.ts"() {
     "use strict";
-    import_core76 = require("@axiom-lattice/core");
+    import_core77 = require("@axiom-lattice/core");
   }
 });
 
@@ -4392,12 +4392,12 @@ function registerOpenExposureRoutes(app2, deps = {}) {
       if (!tenantId) {
         return reply.status(401).send({ success: false, error: "Unauthorized" });
       }
-      const keyStore = (0, import_core77.getStoreLattice)("default", "a2aApiKey").store;
+      const keyStore = (0, import_core78.getStoreLattice)("default", "a2aApiKey").store;
       const record = await keyStore.findById(request.params.id);
       if (!record || record.tenantId !== tenantId) {
         return reply.status(404).send({ success: false, error: "Key not found" });
       }
-      const grants = (0, import_protocols36.effectiveGrants)(record);
+      const grants = (0, import_protocols37.effectiveGrants)(record);
       const forwardedHost = request.headers["x-forwarded-host"];
       const host = (Array.isArray(forwardedHost) ? forwardedHost[0] : forwardedHost) ?? (Array.isArray(request.headers.host) ? request.headers.host[0] : request.headers.host) ?? request.hostname;
       const baseUrl = `${request.protocol}://${host}`;
@@ -4426,7 +4426,7 @@ function registerOpenExposureRoutes(app2, deps = {}) {
         hasUi: Boolean(t2.ui)
       }));
       const agentGrant = grants.find((g) => g.domain === "agent");
-      const assistantStore = (0, import_core77.getStoreLattice)("default", "assistant").store;
+      const assistantStore = (0, import_core78.getStoreLattice)("default", "assistant").store;
       const agents = [];
       for (const assistantId of agentGrant?.items ?? []) {
         const assistant = await assistantStore.getAssistantById(
@@ -4461,12 +4461,12 @@ function registerOpenExposureRoutes(app2, deps = {}) {
     }
   );
 }
-var import_core77, import_protocols36;
+var import_core78, import_protocols37;
 var init_open_exposure = __esm({
   "src/routes/open-exposure.ts"() {
     "use strict";
-    import_core77 = require("@axiom-lattice/core");
-    import_protocols36 = require("@axiom-lattice/protocols");
+    import_core78 = require("@axiom-lattice/core");
+    import_protocols37 = require("@axiom-lattice/protocols");
     init_openLattice();
     init_tenantOpenPlugins();
     init_A2AAgentCardBuilder();
@@ -4490,9 +4490,9 @@ function createKbProvider(collectionService3) {
         label: "Search collections",
         description: "Search a knowledge base collection. Returns matched entries with content, metadata and similarity score.",
         schema: {
-          collection: import_zod20.z.string().min(1),
-          query: import_zod20.z.string().min(1),
-          limit: import_zod20.z.number().int().min(1).max(50).optional()
+          collection: import_zod22.z.string().min(1),
+          query: import_zod22.z.string().min(1),
+          limit: import_zod22.z.number().int().min(1).max(50).optional()
         },
         annotations: { readOnlyHint: true, destructiveHint: false }
       }
@@ -4520,11 +4520,11 @@ function createKbProvider(collectionService3) {
     }
   };
 }
-var import_zod20;
+var import_zod22;
 var init_kbProvider = __esm({
   "src/services/open/providers/kbProvider.ts"() {
     "use strict";
-    import_zod20 = require("zod");
+    import_zod22 = require("zod");
   }
 });
 
@@ -4562,7 +4562,7 @@ function createAgentProvider(deps = {}) {
             toolName: `invoke_${assistantId}`,
             label: name,
             description: `Invoke the "${name}" agent${description ? ` \u2014 ${description}` : ""}. Returns its final reply.`,
-            schema: { message: import_zod21.z.string().min(1) },
+            schema: { message: import_zod23.z.string().min(1) },
             annotations: { readOnlyHint: false, destructiveHint: false }
           };
         })
@@ -4585,7 +4585,7 @@ function createAgentProvider(deps = {}) {
         } catch {
         }
       }
-      const agent = import_core78.agentInstanceManager.getAgent({
+      const agent = import_core79.agentInstanceManager.getAgent({
         tenant_id: ctx.tenantId,
         assistant_id: assistantId,
         thread_id: threadId,
@@ -4599,8 +4599,8 @@ function createAgentProvider(deps = {}) {
       const stream = agent.chunkStream(messageId, [...STOP_TYPES]);
       for await (const chunk of stream) {
         const text = chunk.data?.content;
-        if (chunk.type === import_protocols37.MessageChunkTypes.INTERRUPT) break;
-        if (chunk.type === import_protocols37.MessageChunkTypes.AI && text) {
+        if (chunk.type === import_protocols38.MessageChunkTypes.INTERRUPT) break;
+        if (chunk.type === import_protocols38.MessageChunkTypes.AI && text) {
           parts.push(text);
         }
       }
@@ -4610,14 +4610,14 @@ function createAgentProvider(deps = {}) {
     }
   };
 }
-var import_zod21, import_core78, import_protocols37, STOP_TYPES;
+var import_zod23, import_core79, import_protocols38, STOP_TYPES;
 var init_agentProvider = __esm({
   "src/services/open/providers/agentProvider.ts"() {
     "use strict";
-    import_zod21 = require("zod");
-    import_core78 = require("@axiom-lattice/core");
-    import_protocols37 = require("@axiom-lattice/protocols");
-    STOP_TYPES = [import_protocols37.MessageChunkTypes.MESSAGE_COMPLETED];
+    import_zod23 = require("zod");
+    import_core79 = require("@axiom-lattice/core");
+    import_protocols38 = require("@axiom-lattice/protocols");
+    STOP_TYPES = [import_protocols38.MessageChunkTypes.MESSAGE_COMPLETED];
   }
 });
 
@@ -4647,12 +4647,12 @@ var resources_exports = {};
 __export(resources_exports, {
   ResourceController: () => ResourceController
 });
-var import_bcryptjs, import_core79, ResourceController;
+var import_bcryptjs, import_core80, ResourceController;
 var init_resources = __esm({
   "src/controllers/resources.ts"() {
     "use strict";
     import_bcryptjs = __toESM(require("bcryptjs"));
-    import_core79 = require("@axiom-lattice/core");
+    import_core80 = require("@axiom-lattice/core");
     init_mime();
     init_http_range();
     init_sandboxGrants();
@@ -4669,14 +4669,14 @@ var init_resources = __esm({
         if (!workspaceId || !projectId) {
           return reply.status(400).send({ error: "x-workspace-id and x-project-id headers required" });
         }
-        const payload = (0, import_core79.createSharePayload)(
+        const payload = (0, import_core80.createSharePayload)(
           tenantId,
           workspaceId,
           projectId,
           userId,
           body
         );
-        const token = (0, import_core79.generateToken)();
+        const token = (0, import_core80.generateToken)();
         try {
           await this.deps.store.create({ ...payload, token });
           this.deps.logger.info(
@@ -4828,7 +4828,7 @@ var init_resources = __esm({
             resourcePath: subPath
           }, subPath, ext, request, reply);
         }
-        const volume = (0, import_core79.buildNamedVolumeName)("p", "project", tenantId, workspaceId, projectId);
+        const volume = (0, import_core80.buildNamedVolumeName)("p", "project", tenantId, workspaceId, projectId);
         return this._resolveAndServe(
           volume,
           subPath,
@@ -5052,8 +5052,8 @@ var import_static = __toESM(require("@fastify/static"));
 var import_path = __toESM(require("path"));
 
 // src/routes/index.ts
-var import_node_crypto25 = require("crypto");
-var import_protocols29 = require("@axiom-lattice/protocols");
+var import_node_crypto26 = require("crypto");
+var import_protocols30 = require("@axiom-lattice/protocols");
 
 // src/controllers/assistant.ts
 var import_core = require("@axiom-lattice/core");
@@ -6910,9 +6910,9 @@ async function getConfig(request, reply) {
 var import_core9 = require("@axiom-lattice/core");
 async function getModels(request, reply) {
   try {
-    const allLattices = import_core9.modelLatticeManager.getAllLattices();
+    const allLattices = import_core9.modelLatticeManager.getAllLatticesByTenant("default");
     const models = allLattices.map((lattice) => {
-      const config = lattice.client.config || {};
+      const config = lattice.client.getConfig();
       const displayName = config.displayName || lattice.key.split("-").map((word) => word.charAt(0).toUpperCase() + word.slice(1)).join(" ");
       return {
         key: lattice.key,
@@ -6920,7 +6920,13 @@ async function getModels(request, reply) {
         provider: config.provider || "openai",
         displayName,
         streaming: config.streaming || false,
-        apiKey: config.apiKey || "",
+        // The key itself is NOT returned. `hasApiKey` is what a client needs to
+        // render "configured — leave blank to keep"; the value was previously
+        // sent in cleartext to every caller of this endpoint, which put provider
+        // credentials in any browser that loaded the model settings. Clients
+        // that edit a model therefore leave the key field empty, which
+        // `updateModels` reads as "keep the existing one".
+        hasApiKey: Boolean(config.apiKey),
         baseURL: config.baseURL || "",
         maxTokens: config.maxTokens,
         temperature: config.temperature,
@@ -6962,6 +6968,8 @@ async function updateModels(request, reply) {
         continue;
       }
       try {
+        const existingConfig = import_core9.modelLatticeManager.hasLattice(modelConfig.key) ? import_core9.modelLatticeManager.getModelLattice(modelConfig.key).client.getConfig() : void 0;
+        const effectiveApiKey = modelConfig.clearApiKey ? void 0 : modelConfig.apiKey || existingConfig?.apiKey;
         if (import_core9.modelLatticeManager.hasLattice(modelConfig.key)) {
           import_core9.modelLatticeManager.removeLattice(modelConfig.key);
         }
@@ -6970,7 +6978,7 @@ async function updateModels(request, reply) {
           model: modelConfig.model,
           displayName: modelConfig.displayName,
           streaming: modelConfig.streaming ?? false,
-          apiKey: modelConfig.apiKey,
+          apiKey: effectiveApiKey,
           baseURL: modelConfig.baseURL,
           maxTokens: modelConfig.maxTokens,
           temperature: modelConfig.temperature,
@@ -16712,7 +16720,7 @@ function registerTaskRoutes(app2, controller) {
 }
 
 // src/routes/index.ts
-var import_core50 = require("@axiom-lattice/core");
+var import_core51 = require("@axiom-lattice/core");
 
 // src/controllers/tasks.ts
 var import_protocols13 = require("@axiom-lattice/protocols");
@@ -20612,177 +20620,1298 @@ function registerCapabilityBundleRoutes(app2, controller) {
   app2.post("/api/projects/:projectId/capability-preview", controller.postProjectPreview.bind(controller));
 }
 
-// src/services/collaboration/ProjectRoomService.ts
+// src/controllers/model-providers.ts
+var import_zod11 = require("zod");
+
+// src/services/model-provider/ModelProviderService.ts
 var import_node_crypto14 = require("crypto");
-var ProjectRoomService = class {
-  /** Creates a project room service from explicitly injected collaborators. */
-  constructor(deps) {
-    this.deps = deps;
-    this.idFactory = deps.idFactory ?? import_node_crypto14.randomUUID;
-  }
-  /**
-   * Authorizes read access and ensures the project's main room.
-   *
-   * @remarks
-   * This method is safe to call while holding the process-wide Project
-   * mutation mutex: it never re-enters it. Coordinator backfill is a separate
-   * entry point ({@link ensureMainRoomWithCoordinator}) because it acquires
-   * that mutex internally.
-   */
-  async ensureMainRoom(input) {
-    const { room } = await this.authorizedRoom(input);
-    return room;
-  }
-  /**
-   * Authorizes read access, ensures the main room, and lazily backfills the
-   * built-in coordinator for business projects.
-   *
-   * @remarks
-   * Only call this outside the Project mutation mutex (room open / bootstrap
-   * paths); calling it under the mutex deadlocks on the coordinator ensurer.
-   */
-  async ensureMainRoomWithCoordinator(input) {
-    const { project, room } = await this.authorizedRoom(input);
-    if ((project.kind === "business" || project.kind === "public") && this.deps.ensureCoordinator) {
-      try {
-        await this.deps.ensureCoordinator({
-          tenantId: input.tenantId,
-          workspaceId: project.workspaceId,
-          projectId: project.id,
-          roomId: room.id
-        });
-      } catch (error) {
-        this.deps.log?.warn("project-room:coordinator-ensure-failed", {
-          tenantId: input.tenantId,
-          projectId: project.id,
-          errorName: error instanceof Error ? error.name : "UnknownError"
-        });
-      }
-    }
-    return room;
-  }
-  async authorizedRoom(input) {
-    const { project } = await this.deps.accessService.requireProjectAccess({
-      ...input,
-      capability: "read"
-    });
-    const room = await this.deps.roomStore.ensureMainRoom({
-      id: this.idFactory(),
-      tenantId: input.tenantId,
-      workspaceId: project.workspaceId,
-      projectId: project.id,
-      name: project.name
-    });
-    return { project, room };
-  }
-};
+var import_protocols16 = require("@axiom-lattice/protocols");
+var import_core47 = require("@axiom-lattice/core");
 
-// src/services/collaboration/ProjectMembershipService.ts
-var import_node_crypto15 = require("crypto");
-var ProjectMembershipServiceError = class extends Error {
-  constructor(code, statusCode, message) {
+// src/services/model-provider/errors.ts
+var ModelProviderServiceError = class extends Error {
+  /** Creates a model provider service error. */
+  constructor(code, statusCode, message, retryable = false) {
     super(message);
     this.code = code;
     this.statusCode = statusCode;
-    this.name = "ProjectMembershipServiceError";
+    this.retryable = retryable;
+    this.name = "ModelProviderServiceError";
   }
 };
-var membershipConflictNames2 = /* @__PURE__ */ new Set(["DuplicateProjectMembershipError", "ProjectMembershipIdConflictError"]);
-function isMembershipConflict(error) {
-  return error instanceof Error && membershipConflictNames2.has(error.name);
-}
-var ProjectMembershipService = class {
-  constructor(deps) {
-    this.deps = deps;
-    this.idFactory = deps.idFactory ?? import_node_crypto15.randomUUID;
-    this.mutationMutex = deps.projectMutationMutex ?? import_core26.projectMutationMutex;
-  }
-  async list(actor3) {
-    await this.deps.accessService.requireRosterAccess(actor3);
-    const membership = await this.deps.membershipStore.findByUser(actor3.tenantId, actor3.projectId, actor3.userId);
-    if (!membership || membership.status !== "active") this.accessDenied();
-    return this.deps.membershipStore.list(actor3.tenantId, actor3.projectId);
-  }
-  async add(actor3, input) {
-    return this.withProjectLock(actor3, async () => {
-      const access = await this.authorize(actor3);
-      if (input.role === "owner" && access.role !== "owner") this.accessDenied();
-      if (!await this.deps.userTenantLinkStore.getLink(input.userId, actor3.tenantId)) {
-        throw new ProjectMembershipServiceError("TARGET_USER_NOT_IN_TENANT", 400, "Target user is not in the tenant");
-      }
-      if (await this.deps.membershipStore.findByUser(actor3.tenantId, actor3.projectId, input.userId)) {
-        throw new ProjectMembershipServiceError("MEMBERSHIP_EXISTS", 409, "Project membership already exists");
-      }
-      try {
-        const created = await this.deps.membershipStore.create({
-          id: this.idFactory(),
-          tenantId: actor3.tenantId,
-          projectId: actor3.projectId,
-          userId: input.userId,
-          role: input.role,
-          status: "active"
-        });
-        this.publish(created, "added", `membership:${created.id}:add:${created.joinedAt.toISOString()}`);
-        return created;
-      } catch (error) {
-        if (error instanceof Error && error.name === "DuplicateProjectMembershipError") {
-          throw new ProjectMembershipServiceError("MEMBERSHIP_EXISTS", 409, "Project membership already exists");
-        }
-        if (isMembershipConflict(error)) {
-          throw new ProjectMembershipServiceError("MEMBERSHIP_CONFLICT", 409, "Project membership could not be created");
-        }
-        throw error;
-      }
-    });
+
+// src/services/model-provider/discovery.ts
+var MAX_DISCOVERED_MODELS = 1e3;
+var MAX_RESPONSE_BYTES = 2 * 1024 * 1024;
+var DEFAULT_DISCOVERY_TIMEOUT_MS = 8e3;
+function resolveDiscoveryTimeoutMs(raw = process.env.LATTICE_MODEL_DISCOVERY_TIMEOUT_MS) {
+  if (!raw) {
+    return DEFAULT_DISCOVERY_TIMEOUT_MS;
+  }
+  const parsed = Number.parseInt(raw, 10);
+  if (!Number.isFinite(parsed) || parsed <= 0) {
+    return DEFAULT_DISCOVERY_TIMEOUT_MS;
   }
-  async updateRole(actor3, input) {
-    return this.withProjectLock(actor3, async () => {
-      const access = await this.authorize(actor3);
-      const target = await this.target(actor3, input.membershipId);
-      this.requireActiveAndCurrent(target, input.expectedUpdatedAt);
-      if ((target.role === "owner" || input.role === "owner") && access.role !== "owner") this.accessDenied();
-      const updated = await this.mapMutation(await this.deps.membershipStore.updateRole({ tenantId: actor3.tenantId, id: input.membershipId, role: input.role, expectedUpdatedAt: input.expectedUpdatedAt }));
-      this.publish(updated, "role_changed", `membership:${updated.id}:role:${updated.role}:${input.expectedUpdatedAt.toISOString()}`);
-      return updated;
-    });
+  return parsed;
+}
+function buildModelsEndpoint(baseURL) {
+  const url = new URL(baseURL);
+  const trimmed = url.pathname.replace(/\/+$/, "");
+  url.pathname = trimmed.endsWith("/v1") ? `${trimmed}/models` : `${trimmed}/v1/models`;
+  url.search = "";
+  url.hash = "";
+  return url.toString();
+}
+function parseModelsPayload(payload) {
+  const entries = Array.isArray(payload) ? payload : typeof payload === "object" && payload !== null ? payload.data : void 0;
+  if (!Array.isArray(entries)) {
+    throw new ModelProviderServiceError(
+      "UPSTREAM_INVALID_RESPONSE",
+      502,
+      "Upstream did not return a model list"
+    );
   }
-  async remove(actor3, input) {
-    return this.withProjectLock(actor3, async () => {
-      const access = await this.authorize(actor3);
-      const target = await this.target(actor3, input.membershipId);
-      this.requireActiveAndCurrent(target, input.expectedUpdatedAt);
-      if (target.role === "owner" && access.role !== "owner") this.accessDenied();
-      const removed = await this.mapMutation(await this.deps.membershipStore.remove({ tenantId: actor3.tenantId, id: input.membershipId, expectedUpdatedAt: input.expectedUpdatedAt }));
-      this.publish(removed, "removed", `membership:${removed.id}:remove:${input.expectedUpdatedAt.toISOString()}`);
-      return removed;
+  const models = [];
+  for (const entry of entries.slice(0, MAX_DISCOVERED_MODELS)) {
+    if (typeof entry !== "object" || entry === null) {
+      continue;
+    }
+    const record = entry;
+    const id3 = typeof record.id === "string" ? record.id.trim() : "";
+    if (id3.length === 0) {
+      continue;
+    }
+    models.push({
+      id: id3,
+      displayName: typeof record.name === "string" ? record.name : void 0,
+      ownedBy: typeof record.owned_by === "string" ? record.owned_by : void 0,
+      createdAt: parseUpstreamCreated(record.created),
+      raw: record
     });
   }
-  async authorize(actor3) {
-    await this.deps.accessService.requireProjectAccess({ ...actor3, capability: "manage" });
-    const membership = await this.deps.membershipStore.findByUser(actor3.tenantId, actor3.projectId, actor3.userId);
-    if (!membership || membership.status !== "active") this.accessDenied();
-    return membership;
-  }
-  async target(actor3, id3) {
-    const target = (await this.deps.membershipStore.list(actor3.tenantId, actor3.projectId)).find((item) => item.id === id3);
-    if (!target) throw new ProjectMembershipServiceError("MEMBERSHIP_NOT_FOUND", 404, "Project membership not found");
-    return target;
+  return models;
+}
+function parseUpstreamCreated(created) {
+  if (typeof created !== "number" || !Number.isFinite(created)) {
+    return void 0;
   }
-  requireActiveAndCurrent(target, expectedUpdatedAt2) {
-    if (target.status !== "active") {
-      throw new ProjectMembershipServiceError("MEMBERSHIP_NOT_FOUND", 404, "Project membership not found");
+  const date = new Date(created * 1e3);
+  return Number.isNaN(date.getTime()) ? void 0 : date.toISOString();
+}
+var openAiCompatibleAdapter = {
+  protocol: "openai-compatible",
+  async discover({ baseURL, apiKey, signal }) {
+    const endpoint = buildModelsEndpoint(baseURL);
+    const headers = { Accept: "application/json" };
+    if (apiKey) {
+      headers.Authorization = `Bearer ${apiKey}`;
     }
-    if (!Number.isFinite(expectedUpdatedAt2.getTime()) || target.updatedAt.getTime() !== expectedUpdatedAt2.getTime()) {
-      throw new ProjectMembershipServiceError("MEMBERSHIP_CONFLICT", 409, "Project membership changed; reload before saving");
+    let response;
+    try {
+      response = await fetch(endpoint, {
+        method: "GET",
+        headers,
+        // Never follow redirects: a redirected request could reach an
+        // address that bypassed the SSRF checks.
+        redirect: "manual",
+        signal
+      });
+    } catch (error) {
+      if (error instanceof Error && error.name === "AbortError") {
+        throw new ModelProviderServiceError(
+          "UPSTREAM_TIMEOUT",
+          504,
+          "Upstream did not respond in time",
+          true
+        );
+      }
+      throw new ModelProviderServiceError(
+        "UPSTREAM_UNREACHABLE",
+        502,
+        "Upstream could not be reached",
+        true
+      );
+    }
+    if (response.status >= 300 && response.status < 400) {
+      throw new ModelProviderServiceError(
+        "UPSTREAM_REDIRECT_BLOCKED",
+        502,
+        "Upstream returned a redirect; configure the final URL directly"
+      );
+    }
+    if (response.status === 401 || response.status === 403) {
+      throw new ModelProviderServiceError(
+        "UPSTREAM_AUTH_FAILED",
+        502,
+        "Upstream rejected the configured credentials"
+      );
+    }
+    if (response.status === 429) {
+      throw new ModelProviderServiceError(
+        "UPSTREAM_RATE_LIMITED",
+        502,
+        "Upstream rate limited the request",
+        true
+      );
+    }
+    if (!response.ok) {
+      throw new ModelProviderServiceError(
+        "UPSTREAM_UNREACHABLE",
+        502,
+        "Upstream returned an error response",
+        response.status >= 500
+      );
+    }
+    const body = await readBodyWithLimit(response, MAX_RESPONSE_BYTES);
+    let payload;
+    try {
+      payload = JSON.parse(body);
+    } catch {
+      throw new ModelProviderServiceError(
+        "UPSTREAM_INVALID_RESPONSE",
+        502,
+        "Upstream response was not valid JSON"
+      );
     }
+    return parseModelsPayload(payload);
   }
-  async mapMutation(result) {
-    if (result.kind === "updated" || result.kind === "removed") return result.membership;
-    if (result.kind === "not_found") throw new ProjectMembershipServiceError("MEMBERSHIP_NOT_FOUND", 404, "Project membership not found");
-    if (result.kind === "conflict") throw new ProjectMembershipServiceError("MEMBERSHIP_CONFLICT", 409, "Project membership changed; reload before saving");
-    throw new ProjectMembershipServiceError("LAST_OWNER", 409, "The project must retain an owner");
+};
+async function readBodyWithLimit(response, maxBytes) {
+  if (!response.body) {
+    return response.text();
   }
-  publish(membership, change, sourceKey) {
+  const reader = response.body.getReader();
+  const decoder = new TextDecoder();
+  let received = 0;
+  let text = "";
+  try {
+    for (; ; ) {
+      const { done, value } = await reader.read();
+      if (done) {
+        break;
+      }
+      if (!value) {
+        continue;
+      }
+      received += value.byteLength;
+      if (received > maxBytes) {
+        await reader.cancel();
+        throw new ModelProviderServiceError(
+          "UPSTREAM_INVALID_RESPONSE",
+          502,
+          "Upstream response was too large"
+        );
+      }
+      text += decoder.decode(value, { stream: true });
+    }
+  } finally {
+    reader.releaseLock();
+  }
+  return text + decoder.decode();
+}
+var adapters = /* @__PURE__ */ new Map([
+  [openAiCompatibleAdapter.protocol, openAiCompatibleAdapter]
+]);
+function getDiscoveryAdapter(protocol) {
+  return adapters.get(protocol);
+}
+
+// src/services/model-provider/ModelProviderService.ts
+var PHASE1_REGISTRY_TENANT = "default";
+var ALLOWED_LLM_PROVIDERS = /* @__PURE__ */ new Set(["openai"]);
+var unsafeReasonToErrorCode = {
+  INVALID_BASE_URL: "INVALID_BASE_URL",
+  UNSUPPORTED_SCHEME: "INVALID_BASE_URL",
+  CREDENTIALS_IN_URL: "INVALID_BASE_URL"
+};
+var ModelProviderService = class {
+  constructor(deps) {
+    this.deps = deps;
+    this.idFactory = deps.idFactory ?? (() => (0, import_node_crypto14.randomUUID)());
+  }
+  /**
+   * List the tenant's provider configurations.
+   */
+  async list(userId, tenantId) {
+    await this.assertMember(userId, tenantId);
+    const providers = await this.deps.providerStore.listProviders(tenantId);
+    const models = await this.deps.providerStore.listModels(tenantId);
+    const modelCounts = /* @__PURE__ */ new Map();
+    for (const model of models) {
+      modelCounts.set(
+        model.providerId,
+        (modelCounts.get(model.providerId) ?? 0) + 1
+      );
+    }
+    return providers.map(
+      (provider) => this.toPublicEntry(provider, modelCounts.get(provider.id) ?? 0)
+    );
+  }
+  /**
+   * Read one provider configuration.
+   */
+  async get(userId, tenantId, id3) {
+    await this.assertMember(userId, tenantId);
+    const provider = await this.requireProvider(tenantId, id3);
+    const models = await this.deps.providerStore.listModels(tenantId, id3);
+    return this.toPublicEntry(provider, models.length);
+  }
+  /**
+   * The full model catalog visible to a tenant.
+   */
+  async catalog(userId, tenantId) {
+    await this.assertMember(userId, tenantId);
+    const providers = await this.deps.providerStore.listProviders(tenantId);
+    const snapshot = await this.deps.providerStore.listModels(tenantId);
+    const providerNames = new Map(
+      providers.map((provider) => [provider.id, provider.name])
+    );
+    const disabledProviderIds = new Set(
+      providers.filter((provider) => !provider.enabled).map((p) => p.id)
+    );
+    const modelCounts = /* @__PURE__ */ new Map();
+    for (const model of snapshot) {
+      modelCounts.set(
+        model.providerId,
+        (modelCounts.get(model.providerId) ?? 0) + 1
+      );
+    }
+    const models = snapshot.map((model) => ({
+      modelKey: (0, import_protocols16.toModelKey)(model.providerId, model.modelId),
+      displayName: model.displayName,
+      providerId: model.providerId,
+      providerName: providerNames.get(model.providerId) ?? model.providerId,
+      ownedBy: model.ownedBy,
+      source: "snapshot",
+      enabled: model.enabled,
+      stale: model.stale ?? false,
+      executable: model.enabled && // A disabled provider is a kill switch: its models stay visible in the
+      // catalog but are no longer reported as runnable.
+      !disabledProviderIds.has(model.providerId) && this.deps.registry.has(
+        tenantId,
+        (0, import_protocols16.toModelKey)(model.providerId, model.modelId)
+      )
+    }));
+    const known = new Set(models.map((model) => model.modelKey));
+    for (const modelKey2 of this.deps.registry.listRegistered(tenantId)) {
+      if (known.has(modelKey2)) {
+        continue;
+      }
+      models.push({
+        modelKey: modelKey2,
+        providerId: "",
+        providerName: "registered",
+        source: "registered",
+        enabled: true,
+        stale: false,
+        executable: true
+      });
+    }
+    return {
+      providers: providers.map(
+        (provider) => this.toPublicEntry(provider, modelCounts.get(provider.id) ?? 0)
+      ),
+      models
+    };
+  }
+  /**
+   * Create a provider configuration. Does not run discovery.
+   */
+  async create(userId, tenantId, input) {
+    await this.assertAdmin(userId, tenantId);
+    this.assertHasApiKey(input.apiKey);
+    if (!getDiscoveryAdapter(input.protocol)) {
+      throw new ModelProviderServiceError(
+        "UNSUPPORTED_PROTOCOL",
+        400,
+        `Unsupported provider protocol`
+      );
+    }
+    await this.assertSafeUrl(input.baseURL);
+    const existing = await this.deps.providerStore.getProviderByName(
+      tenantId,
+      input.name
+    );
+    if (existing) {
+      throw new ModelProviderServiceError(
+        "PROVIDER_NAME_CONFLICT",
+        409,
+        "A provider with this name already exists"
+      );
+    }
+    const id3 = this.idFactory();
+    try {
+      const created = await this.deps.providerStore.createProvider(
+        tenantId,
+        id3,
+        { ...input, enabled: input.enabled ?? true }
+      );
+      return this.toPublicEntry(created, 0);
+    } catch (error) {
+      throw this.mapStoreError(error);
+    }
+  }
+  /**
+   * Update a provider configuration.
+   * An omitted or empty `apiKey` keeps the stored key.
+   */
+  async update(userId, tenantId, id3, updates) {
+    await this.assertAdmin(userId, tenantId);
+    const existing = await this.requireProvider(tenantId, id3);
+    if (updates.clearApiKey || !(updates.apiKey?.trim() || existing.apiKey)) {
+      this.assertHasApiKey(void 0);
+    }
+    if (updates.protocol && !getDiscoveryAdapter(updates.protocol)) {
+      throw new ModelProviderServiceError(
+        "UNSUPPORTED_PROTOCOL",
+        400,
+        `Unsupported provider protocol`
+      );
+    }
+    if (updates.baseURL && updates.baseURL !== existing.baseURL) {
+      await this.assertSafeUrl(updates.baseURL);
+    }
+    if (updates.name && updates.name !== existing.name) {
+      const conflicting = await this.deps.providerStore.getProviderByName(
+        tenantId,
+        updates.name
+      );
+      if (conflicting && conflicting.id !== id3) {
+        throw new ModelProviderServiceError(
+          "PROVIDER_NAME_CONFLICT",
+          409,
+          "A provider with this name already exists"
+        );
+      }
+    }
+    try {
+      const updated = await this.deps.providerStore.updateProvider(
+        tenantId,
+        id3,
+        updates
+      );
+      if (!updated) {
+        throw new ModelProviderServiceError(
+          "PROVIDER_NOT_FOUND",
+          404,
+          "Model provider not found"
+        );
+      }
+      const models = await this.deps.providerStore.listModels(tenantId, id3);
+      this.syncRegistry(tenantId, updated, models);
+      return this.toPublicEntry(updated, models.length);
+    } catch (error) {
+      throw this.mapStoreError(error);
+    }
+  }
+  /**
+   * Delete a provider configuration, its snapshot, and any registry entries
+   * that no other provider in the tenant still supplies.
+   */
+  async remove(userId, tenantId, id3) {
+    await this.assertAdmin(userId, tenantId);
+    await this.requireProvider(tenantId, id3);
+    const snapshot = await this.deps.providerStore.listModels(tenantId, id3);
+    await this.deps.providerStore.deleteProvider(tenantId, id3);
+    for (const model of snapshot) {
+      this.deps.registry.remove(tenantId, (0, import_protocols16.toModelKey)(id3, model.modelId));
+    }
+  }
+  /**
+   * Discover the provider's models and replace its snapshot.
+   */
+  async discover(userId, tenantId, id3) {
+    await this.assertAdmin(userId, tenantId);
+    const provider = await this.requireProvider(tenantId, id3);
+    if (!provider.enabled) {
+      throw new ModelProviderServiceError(
+        "PROVIDER_DISABLED",
+        400,
+        "Model provider is disabled"
+      );
+    }
+    const adapter = getDiscoveryAdapter(provider.protocol);
+    if (!adapter) {
+      throw new ModelProviderServiceError(
+        "UNSUPPORTED_PROTOCOL",
+        400,
+        `Unsupported provider protocol`
+      );
+    }
+    await this.assertSafeUrl(provider.baseURL);
+    const controller = new AbortController();
+    const timeout = setTimeout(
+      () => controller.abort(),
+      resolveDiscoveryTimeoutMs()
+    );
+    const previous = this.shouldRegister(tenantId) ? await this.deps.providerStore.listModels(tenantId, id3) : [];
+    let discovered;
+    try {
+      discovered = await adapter.discover({
+        baseURL: provider.baseURL,
+        apiKey: provider.apiKey,
+        signal: controller.signal
+      });
+    } catch (error) {
+      if (error instanceof ModelProviderServiceError) {
+        await this.deps.providerStore.markProviderStatus(
+          tenantId,
+          id3,
+          "error",
+          error.code
+        );
+        throw error;
+      }
+      throw error;
+    } finally {
+      clearTimeout(timeout);
+    }
+    const now = /* @__PURE__ */ new Date();
+    const inserted = await this.deps.providerStore.replaceProviderModels(
+      tenantId,
+      id3,
+      discovered
+    );
+    await this.deps.providerStore.markProviderStatus(
+      tenantId,
+      id3,
+      "ok",
+      void 0,
+      now
+    );
+    const registered = [];
+    if (this.shouldRegister(tenantId)) {
+      const snapshot = await this.deps.providerStore.listModels(tenantId, id3);
+      const currentKeys = new Set(
+        snapshot.map((model) => (0, import_protocols16.toModelKey)(id3, model.modelId))
+      );
+      for (const model of previous) {
+        const modelKey2 = (0, import_protocols16.toModelKey)(id3, model.modelId);
+        if (!currentKeys.has(modelKey2)) {
+          this.deps.registry.remove(tenantId, modelKey2);
+        }
+      }
+      registered.push(...this.syncRegistry(tenantId, provider, snapshot));
+    }
+    return {
+      discovered,
+      registered,
+      status: "ok"
+    };
+  }
+  /**
+   * Bring the execution registry in line with a provider's current state.
+   *
+   * Registration copies `apiKey` and `baseURL` by value, so a rotated
+   * credential or a changed endpoint only takes effect once the model is
+   * re-registered. Disabled models — and every model of a disabled provider —
+   * are removed instead.
+   *
+   * @returns The model keys left registered
+   */
+  /**
+   * Probe an upstream without touching the store.
+   *
+   * Powers the provider form's "test latency" and "list models" actions, which
+   * validate a base URL and API key the user has typed but not yet saved. The
+   * URL is validated exactly as on create/update and is never persisted, so the
+   * "discover resolves its URL from the store" rule is not weakened — nothing
+   * a probe learns can reach the snapshot.
+   */
+  async probe(userId, tenantId, input) {
+    await this.assertAdmin(userId, tenantId);
+    const protocol = input.protocol ?? "openai-compatible";
+    const adapter = getDiscoveryAdapter(protocol);
+    if (!adapter) {
+      throw new ModelProviderServiceError(
+        "UNSUPPORTED_PROTOCOL",
+        400,
+        `Unsupported provider protocol`
+      );
+    }
+    await this.assertSafeUrl(input.baseURL);
+    let apiKey = input.apiKey || void 0;
+    if (!apiKey && input.providerId) {
+      const existing = await this.requireProvider(tenantId, input.providerId);
+      apiKey = existing.apiKey;
+    }
+    const controller = new AbortController();
+    const timeout = setTimeout(
+      () => controller.abort(),
+      resolveDiscoveryTimeoutMs()
+    );
+    const startedAt = Date.now();
+    try {
+      const models = await adapter.discover({
+        baseURL: input.baseURL,
+        apiKey,
+        signal: controller.signal
+      });
+      return {
+        reachable: true,
+        latencyMs: Date.now() - startedAt,
+        models
+      };
+    } catch (error) {
+      if (error instanceof ModelProviderServiceError) {
+        return {
+          reachable: false,
+          latencyMs: Date.now() - startedAt,
+          models: [],
+          error: error.code
+        };
+      }
+      throw error;
+    } finally {
+      clearTimeout(timeout);
+    }
+  }
+  /**
+   * Set exactly which models this provider contributes.
+   *
+   * This is the "add model" action: the caller passes the ids it picked from
+   * the live list, and the provider's model set becomes precisely those. Ids
+   * are expected to have come from a probe — model names cannot be guessed,
+   * since a wrong id surfaces later as "model not found" or an authorisation
+   * error rather than at configuration time.
+   */
+  async setModels(userId, tenantId, id3, selection) {
+    await this.assertAdmin(userId, tenantId);
+    const provider = await this.requireProvider(tenantId, id3);
+    const previous = await this.deps.providerStore.listModels(tenantId, id3);
+    const previousById = new Map(
+      previous.map((model) => [model.modelId, model])
+    );
+    await this.deps.providerStore.replaceProviderModels(
+      tenantId,
+      id3,
+      selection.map((entry) => ({
+        id: entry.modelId,
+        enabled: entry.enabled,
+        // A model the upstream stopped offering stays in the set, flagged
+        // rather than dropped: deleting it would silently break anything
+        // referencing its key.
+        stale: entry.stale ?? false,
+        // The selection carries only ids and states, so a model already in the
+        // snapshot keeps the metadata discovery gave it.
+        displayName: previousById.get(entry.modelId)?.displayName,
+        ownedBy: previousById.get(entry.modelId)?.ownedBy
+      }))
+    );
+    const models = await this.deps.providerStore.listModels(tenantId, id3);
+    const kept = new Set(models.map((model) => model.modelId));
+    for (const model of previous) {
+      if (!kept.has(model.modelId)) {
+        this.deps.registry.remove(
+          tenantId,
+          (0, import_protocols16.toModelKey)(provider.id, model.modelId)
+        );
+      }
+    }
+    this.syncRegistry(tenantId, provider, models);
+    return this.toPublicEntry(provider, models.length);
+  }
+  syncRegistry(tenantId, provider, models) {
+    if (!this.shouldRegister(tenantId)) {
+      return [];
+    }
+    const registered = [];
+    for (const model of models) {
+      const modelKey2 = (0, import_protocols16.toModelKey)(provider.id, model.modelId);
+      if (!provider.enabled || !model.enabled) {
+        this.deps.registry.remove(tenantId, modelKey2);
+        continue;
+      }
+      this.deps.registry.register(
+        tenantId,
+        modelKey2,
+        this.toLlmConfig(provider, model.modelId)
+      );
+      registered.push(modelKey2);
+    }
+    return registered;
+  }
+  /**
+   * Enable or disable a single discovered model.
+   */
+  async setModelEnabled(userId, tenantId, id3, modelId, enabled) {
+    await this.assertAdmin(userId, tenantId);
+    const provider = await this.requireProvider(tenantId, id3);
+    const updated = await this.deps.providerStore.setModelEnabled(
+      tenantId,
+      id3,
+      modelId,
+      enabled
+    );
+    if (!updated) {
+      throw new ModelProviderServiceError(
+        "MODEL_KEY_CONFLICT",
+        404,
+        "Model not found for this provider"
+      );
+    }
+    const models = await this.deps.providerStore.listModels(tenantId, id3);
+    this.syncRegistry(tenantId, provider, models);
+    return this.toPublicEntry(provider, models.length);
+  }
+  /**
+   * Whether discovered models should be registered for execution.
+   */
+  shouldRegister(tenantId) {
+    return tenantId === PHASE1_REGISTRY_TENANT;
+  }
+  /**
+   * Build the runtime LLM config for a discovered model.
+   *
+   * `apiKeyEnvName`, `extra` and `modelKwargs` are deliberately omitted — they
+   * would let a tenant name an arbitrary process environment variable to read
+   * credentials from, or inject arbitrary constructor options.
+   */
+  toLlmConfig(provider, modelId) {
+    if (!ALLOWED_LLM_PROVIDERS.has(provider.llmProvider)) {
+      throw new ModelProviderServiceError(
+        "UNSUPPORTED_PROTOCOL",
+        400,
+        "Provider is configured with an unsupported LLM provider"
+      );
+    }
+    return {
+      provider: provider.llmProvider,
+      model: modelId,
+      displayName: modelId,
+      streaming: true,
+      apiKey: provider.apiKey,
+      baseURL: provider.baseURL,
+      // Chat Completions and the Responses API are different routes with
+      // different request fields; without this the gateway would post
+      // `messages` to an endpoint expecting `input`.
+      ...provider.apiStyle === "responses" ? { useResponsesApi: true } : {}
+    };
+  }
+  /**
+   * The sole projection from an internal provider entry to an API-safe shape.
+   */
+  toPublicEntry(provider, modelCount) {
+    return {
+      id: provider.id,
+      tenantId: provider.tenantId,
+      name: provider.name,
+      displayName: provider.displayName,
+      protocol: provider.protocol,
+      apiStyle: provider.apiStyle,
+      llmProvider: provider.llmProvider,
+      baseURL: provider.baseURL,
+      hasApiKey: Boolean(provider.apiKey),
+      apiKeyHint: provider.apiKeyHint,
+      enabled: provider.enabled,
+      status: provider.status,
+      lastError: provider.lastError,
+      lastDiscoveredAt: provider.lastDiscoveredAt?.toISOString(),
+      modelCount,
+      createdAt: provider.createdAt.toISOString(),
+      updatedAt: provider.updatedAt.toISOString()
+    };
+  }
+  /**
+   * Reject a provider that would end up without a credential.
+   *
+   * @param apiKey - The key the provider would hold, if any
+   * @throws {ModelProviderServiceError} When no key is present
+   */
+  assertHasApiKey(apiKey) {
+    if (!apiKey?.trim()) {
+      throw new ModelProviderServiceError(
+        "INVALID_INPUT",
+        400,
+        "A model provider must have an API key"
+      );
+    }
+  }
+  /**
+   * Load a provider or fail with 404.
+   *
+   * Callers always pass the session's tenant, so a provider belonging to
+   * another tenant is indistinguishable from a missing one.
+   */
+  async requireProvider(tenantId, id3) {
+    const provider = await this.deps.providerStore.getProviderById(tenantId, id3);
+    if (!provider) {
+      throw new ModelProviderServiceError(
+        "PROVIDER_NOT_FOUND",
+        404,
+        "Model provider not found"
+      );
+    }
+    return provider;
+  }
+  /**
+   * Require that the caller belongs to the tenant.
+   * An absent userId means the unauthenticated development fallback.
+   */
+  async assertMember(userId, tenantId) {
+    if (!userId) {
+      return;
+    }
+    const link = await this.deps.userTenantLinkStore.getLink(userId, tenantId);
+    if (!link) {
+      throw new ModelProviderServiceError(
+        "TENANT_ACCESS_DENIED",
+        403,
+        "Tenant access denied"
+      );
+    }
+  }
+  /**
+   * Require that the caller is a tenant owner or admin.
+   * Roles are read from the tenant link, never from the session token.
+   */
+  async assertAdmin(userId, tenantId) {
+    await this.assertMember(userId, tenantId);
+    if (!userId) {
+      return;
+    }
+    const link = await this.deps.userTenantLinkStore.getLink(userId, tenantId);
+    if (link?.role !== "owner" && link?.role !== "admin") {
+      throw new ModelProviderServiceError(
+        "FORBIDDEN_ROLE",
+        403,
+        "Only tenant owner or admin can manage model providers"
+      );
+    }
+  }
+  /**
+   * Validate the shape of an upstream URL and translate failures into service
+   * errors.
+   *
+   * Addresses are deliberately not restricted: other tenant-configured URLs in
+   * this platform (metrics servers, MCP servers) reach wherever they point, and
+   * self-hosted model servers normally sit on the gateway's own network.
+   *
+   * The mapping is explicit so the public error codes stay decoupled from the
+   * reasons the URL utility happens to use internally.
+   */
+  async assertSafeUrl(baseURL) {
+    try {
+      await (0, import_core47.assertSafeUpstreamUrl)(baseURL);
+    } catch (error) {
+      if (error instanceof import_core47.UnsafeUpstreamUrlError) {
+        throw new ModelProviderServiceError(
+          unsafeReasonToErrorCode[error.reason],
+          400,
+          error.message
+        );
+      }
+      throw error;
+    }
+  }
+  /**
+   * Translate a store-level unique violation into a stable service error.
+   */
+  mapStoreError(error) {
+    if (error instanceof ModelProviderServiceError) {
+      return error;
+    }
+    const code = error?.code;
+    if (code === "23505") {
+      return new ModelProviderServiceError(
+        "PROVIDER_NAME_CONFLICT",
+        409,
+        "A provider with this name already exists"
+      );
+    }
+    if (code === "23503") {
+      return new ModelProviderServiceError(
+        "INVALID_INPUT",
+        400,
+        "Model provider references a missing record"
+      );
+    }
+    throw error;
+  }
+};
+
+// src/schemas/model-provider.ts
+var import_zod10 = require("zod");
+var providerId = import_zod10.z.string().trim().min(1).max(255);
+var providerParamsSchema = import_zod10.z.object({ providerId }).strict();
+var protocolSchema = import_zod10.z.enum(["openai-compatible"]);
+var apiStyleSchema = import_zod10.z.enum(["chat-completions", "responses"]);
+var createProviderSchema = import_zod10.z.object({
+  name: import_zod10.z.string().trim().min(1).max(255),
+  displayName: import_zod10.z.string().trim().max(255).optional(),
+  protocol: protocolSchema,
+  apiStyle: apiStyleSchema.optional(),
+  baseURL: import_zod10.z.string().trim().min(1).max(2048),
+  // Required, not optional: see CreateModelProviderRequest.apiKey — a
+  // keyless provider would make the gateway send its own env credential.
+  apiKey: import_zod10.z.string().trim().min(1).max(1024),
+  enabled: import_zod10.z.boolean().optional()
+}).strict();
+var updateProviderSchema = createProviderSchema.partial().extend({
+  /**
+   * Remove the stored API key. Needed because an empty `apiKey` means "keep":
+   * without this a leaked credential could not be revoked.
+   */
+  clearApiKey: import_zod10.z.boolean().optional()
+}).strict();
+var setModelEnabledSchema = import_zod10.z.object({
+  modelId: import_zod10.z.string().trim().min(1).max(512),
+  enabled: import_zod10.z.boolean()
+}).strict();
+var discoverSchema = import_zod10.z.object({}).strict();
+var setModelsSchema = import_zod10.z.object({
+  models: import_zod10.z.array(
+    import_zod10.z.object({
+      modelId: import_zod10.z.string().trim().min(1).max(512),
+      enabled: import_zod10.z.boolean(),
+      stale: import_zod10.z.boolean().optional()
+    }).strict()
+  ).max(1e3)
+}).strict();
+var probeProviderSchema = import_zod10.z.object({
+  baseURL: import_zod10.z.string().trim().min(1).max(2048),
+  apiKey: import_zod10.z.string().max(1024).optional(),
+  providerId: import_zod10.z.string().trim().min(1).max(255).optional(),
+  protocol: protocolSchema.optional()
+}).strict();
+
+// src/controllers/tenant-scope.ts
+var TenantScopeError2 = class extends Error {
+  /** Creates a tenant scope error. */
+  constructor(code, statusCode, message) {
+    super(message);
+    this.code = code;
+    this.statusCode = statusCode;
+    this.name = "TenantScopeError";
+  }
+};
+function resolveTenantScope(request, authRequired2) {
+  const authenticated = request.user?.tenantId;
+  const header2 = request.headers["x-tenant-id"];
+  const requested = Array.isArray(header2) ? header2[0] : header2;
+  if (authenticated) {
+    if (requested && requested !== authenticated) {
+      throw new TenantScopeError2(
+        "TENANT_ACCESS_DENIED",
+        403,
+        "Tenant access denied"
+      );
+    }
+    return { tenantId: authenticated, userId: request.user?.id };
+  }
+  if (authRequired2) {
+    throw new TenantScopeError2(
+      "UNAUTHENTICATED",
+      401,
+      "Console session required"
+    );
+  }
+  return { tenantId: requested || "default" };
+}
+
+// src/controllers/model-providers.ts
+init_Logger();
+var logger4 = new Logger({ serviceName: "lattice/gateway/model-providers" });
+function sendError2(reply, error) {
+  if (error instanceof ModelProviderServiceError) {
+    return reply.status(error.statusCode).send({
+      success: false,
+      error: {
+        code: error.code,
+        message: error.message,
+        retryable: error.retryable
+      }
+    });
+  }
+  if (error instanceof TenantScopeError2) {
+    return reply.status(error.statusCode).send({
+      success: false,
+      error: {
+        code: error.code,
+        message: error.message,
+        retryable: false
+      }
+    });
+  }
+  if (error instanceof import_zod11.ZodError) {
+    return reply.status(400).send({
+      success: false,
+      error: {
+        code: "INVALID_INPUT",
+        message: "Invalid request",
+        retryable: false
+      }
+    });
+  }
+  logger4.error("Model provider controller error", {
+    error: error instanceof Error ? error : new Error(String(error))
+  });
+  return reply.status(500).send({
+    success: false,
+    error: {
+      code: "INTERNAL_ERROR",
+      message: "Internal server error",
+      retryable: false
+    }
+  });
+}
+var ModelProviderController = class {
+  constructor(deps, options = {}) {
+    this.service = new ModelProviderService(deps);
+    this.authRequired = options.authRequired ?? true;
+  }
+  /** GET /api/tenant-models */
+  async getCatalog(request, reply) {
+    try {
+      const scope = resolveTenantScope(request, this.authRequired);
+      const catalog = await this.service.catalog(scope.userId, scope.tenantId);
+      return reply.send({ success: true, data: catalog });
+    } catch (error) {
+      return sendError2(reply, error);
+    }
+  }
+  /** GET /api/model-providers */
+  async listProviders(request, reply) {
+    try {
+      const scope = resolveTenantScope(request, this.authRequired);
+      const records = await this.service.list(scope.userId, scope.tenantId);
+      return reply.send({
+        success: true,
+        data: { records, total: records.length }
+      });
+    } catch (error) {
+      return sendError2(reply, error);
+    }
+  }
+  /** GET /api/model-providers/:providerId */
+  async getProvider(request, reply) {
+    try {
+      const scope = resolveTenantScope(request, this.authRequired);
+      const { providerId: providerId2 } = providerParamsSchema.parse(request.params);
+      return reply.send({
+        success: true,
+        data: await this.service.get(scope.userId, scope.tenantId, providerId2)
+      });
+    } catch (error) {
+      return sendError2(reply, error);
+    }
+  }
+  /** POST /api/model-providers */
+  async createProvider(request, reply) {
+    try {
+      const scope = resolveTenantScope(request, this.authRequired);
+      const input = createProviderSchema.parse(request.body);
+      return reply.status(201).send({
+        success: true,
+        data: await this.service.create(scope.userId, scope.tenantId, input)
+      });
+    } catch (error) {
+      return sendError2(reply, error);
+    }
+  }
+  /** PUT /api/model-providers/:providerId */
+  async updateProvider(request, reply) {
+    try {
+      const scope = resolveTenantScope(request, this.authRequired);
+      const { providerId: providerId2 } = providerParamsSchema.parse(request.params);
+      const input = updateProviderSchema.parse(request.body);
+      return reply.send({
+        success: true,
+        data: await this.service.update(
+          scope.userId,
+          scope.tenantId,
+          providerId2,
+          input
+        )
+      });
+    } catch (error) {
+      return sendError2(reply, error);
+    }
+  }
+  /** DELETE /api/model-providers/:providerId */
+  async deleteProvider(request, reply) {
+    try {
+      const scope = resolveTenantScope(request, this.authRequired);
+      const { providerId: providerId2 } = providerParamsSchema.parse(request.params);
+      await this.service.remove(scope.userId, scope.tenantId, providerId2);
+      return reply.send({ success: true, data: null });
+    } catch (error) {
+      return sendError2(reply, error);
+    }
+  }
+  /** POST /api/model-providers/probe */
+  async probeProvider(request, reply) {
+    try {
+      const scope = resolveTenantScope(request, this.authRequired);
+      const input = probeProviderSchema.parse(request.body);
+      return reply.send({
+        success: true,
+        data: await this.service.probe(scope.userId, scope.tenantId, input)
+      });
+    } catch (error) {
+      return sendError2(reply, error);
+    }
+  }
+  /** PUT /api/model-providers/:providerId/models */
+  async setProviderModels(request, reply) {
+    try {
+      const scope = resolveTenantScope(request, this.authRequired);
+      const { providerId: providerId2 } = providerParamsSchema.parse(request.params);
+      const { models } = setModelsSchema.parse(request.body);
+      return reply.send({
+        success: true,
+        data: await this.service.setModels(
+          scope.userId,
+          scope.tenantId,
+          providerId2,
+          models
+        )
+      });
+    } catch (error) {
+      return sendError2(reply, error);
+    }
+  }
+  /** POST /api/model-providers/:providerId/discover */
+  async discoverProvider(request, reply) {
+    try {
+      const scope = resolveTenantScope(request, this.authRequired);
+      const { providerId: providerId2 } = providerParamsSchema.parse(request.params);
+      discoverSchema.parse(request.body ?? {});
+      return reply.send({
+        success: true,
+        data: await this.service.discover(
+          scope.userId,
+          scope.tenantId,
+          providerId2
+        )
+      });
+    } catch (error) {
+      return sendError2(reply, error);
+    }
+  }
+  /** POST /api/model-providers/:providerId/models/enabled */
+  async setModelEnabled(request, reply) {
+    try {
+      const scope = resolveTenantScope(request, this.authRequired);
+      const { providerId: providerId2 } = providerParamsSchema.parse(request.params);
+      const { modelId, enabled } = setModelEnabledSchema.parse(request.body);
+      return reply.send({
+        success: true,
+        data: await this.service.setModelEnabled(
+          scope.userId,
+          scope.tenantId,
+          providerId2,
+          modelId,
+          enabled
+        )
+      });
+    } catch (error) {
+      return sendError2(reply, error);
+    }
+  }
+};
+function registerModelProviderRoutes(app2, controller) {
+  app2.get("/api/tenant-models", controller.getCatalog.bind(controller));
+  app2.get("/api/model-providers", controller.listProviders.bind(controller));
+  app2.post("/api/model-providers", controller.createProvider.bind(controller));
+  app2.post("/api/model-providers/probe", controller.probeProvider.bind(controller));
+  app2.get(
+    "/api/model-providers/:providerId",
+    controller.getProvider.bind(controller)
+  );
+  app2.put(
+    "/api/model-providers/:providerId",
+    controller.updateProvider.bind(controller)
+  );
+  app2.delete(
+    "/api/model-providers/:providerId",
+    controller.deleteProvider.bind(controller)
+  );
+  app2.post(
+    "/api/model-providers/:providerId/discover",
+    controller.discoverProvider.bind(controller)
+  );
+  app2.put(
+    "/api/model-providers/:providerId/models",
+    controller.setProviderModels.bind(controller)
+  );
+  app2.post(
+    "/api/model-providers/:providerId/models/enabled",
+    controller.setModelEnabled.bind(controller)
+  );
+}
+
+// src/services/collaboration/ProjectRoomService.ts
+var import_node_crypto15 = require("crypto");
+var ProjectRoomService = class {
+  /** Creates a project room service from explicitly injected collaborators. */
+  constructor(deps) {
+    this.deps = deps;
+    this.idFactory = deps.idFactory ?? import_node_crypto15.randomUUID;
+  }
+  /**
+   * Authorizes read access and ensures the project's main room.
+   *
+   * @remarks
+   * This method is safe to call while holding the process-wide Project
+   * mutation mutex: it never re-enters it. Coordinator backfill is a separate
+   * entry point ({@link ensureMainRoomWithCoordinator}) because it acquires
+   * that mutex internally.
+   */
+  async ensureMainRoom(input) {
+    const { room } = await this.authorizedRoom(input);
+    return room;
+  }
+  /**
+   * Authorizes read access, ensures the main room, and lazily backfills the
+   * built-in coordinator for business projects.
+   *
+   * @remarks
+   * Only call this outside the Project mutation mutex (room open / bootstrap
+   * paths); calling it under the mutex deadlocks on the coordinator ensurer.
+   */
+  async ensureMainRoomWithCoordinator(input) {
+    const { project, room } = await this.authorizedRoom(input);
+    if ((project.kind === "business" || project.kind === "public") && this.deps.ensureCoordinator) {
+      try {
+        await this.deps.ensureCoordinator({
+          tenantId: input.tenantId,
+          workspaceId: project.workspaceId,
+          projectId: project.id,
+          roomId: room.id
+        });
+      } catch (error) {
+        this.deps.log?.warn("project-room:coordinator-ensure-failed", {
+          tenantId: input.tenantId,
+          projectId: project.id,
+          errorName: error instanceof Error ? error.name : "UnknownError"
+        });
+      }
+    }
+    return room;
+  }
+  async authorizedRoom(input) {
+    const { project } = await this.deps.accessService.requireProjectAccess({
+      ...input,
+      capability: "read"
+    });
+    const room = await this.deps.roomStore.ensureMainRoom({
+      id: this.idFactory(),
+      tenantId: input.tenantId,
+      workspaceId: project.workspaceId,
+      projectId: project.id,
+      name: project.name
+    });
+    return { project, room };
+  }
+};
+
+// src/services/collaboration/ProjectMembershipService.ts
+var import_node_crypto16 = require("crypto");
+var ProjectMembershipServiceError = class extends Error {
+  constructor(code, statusCode, message) {
+    super(message);
+    this.code = code;
+    this.statusCode = statusCode;
+    this.name = "ProjectMembershipServiceError";
+  }
+};
+var membershipConflictNames2 = /* @__PURE__ */ new Set(["DuplicateProjectMembershipError", "ProjectMembershipIdConflictError"]);
+function isMembershipConflict(error) {
+  return error instanceof Error && membershipConflictNames2.has(error.name);
+}
+var ProjectMembershipService = class {
+  constructor(deps) {
+    this.deps = deps;
+    this.idFactory = deps.idFactory ?? import_node_crypto16.randomUUID;
+    this.mutationMutex = deps.projectMutationMutex ?? import_core26.projectMutationMutex;
+  }
+  async list(actor3) {
+    await this.deps.accessService.requireRosterAccess(actor3);
+    const membership = await this.deps.membershipStore.findByUser(actor3.tenantId, actor3.projectId, actor3.userId);
+    if (!membership || membership.status !== "active") this.accessDenied();
+    return this.deps.membershipStore.list(actor3.tenantId, actor3.projectId);
+  }
+  async add(actor3, input) {
+    return this.withProjectLock(actor3, async () => {
+      const access = await this.authorize(actor3);
+      if (input.role === "owner" && access.role !== "owner") this.accessDenied();
+      if (!await this.deps.userTenantLinkStore.getLink(input.userId, actor3.tenantId)) {
+        throw new ProjectMembershipServiceError("TARGET_USER_NOT_IN_TENANT", 400, "Target user is not in the tenant");
+      }
+      if (await this.deps.membershipStore.findByUser(actor3.tenantId, actor3.projectId, input.userId)) {
+        throw new ProjectMembershipServiceError("MEMBERSHIP_EXISTS", 409, "Project membership already exists");
+      }
+      try {
+        const created = await this.deps.membershipStore.create({
+          id: this.idFactory(),
+          tenantId: actor3.tenantId,
+          projectId: actor3.projectId,
+          userId: input.userId,
+          role: input.role,
+          status: "active"
+        });
+        this.publish(created, "added", `membership:${created.id}:add:${created.joinedAt.toISOString()}`);
+        return created;
+      } catch (error) {
+        if (error instanceof Error && error.name === "DuplicateProjectMembershipError") {
+          throw new ProjectMembershipServiceError("MEMBERSHIP_EXISTS", 409, "Project membership already exists");
+        }
+        if (isMembershipConflict(error)) {
+          throw new ProjectMembershipServiceError("MEMBERSHIP_CONFLICT", 409, "Project membership could not be created");
+        }
+        throw error;
+      }
+    });
+  }
+  async updateRole(actor3, input) {
+    return this.withProjectLock(actor3, async () => {
+      const access = await this.authorize(actor3);
+      const target = await this.target(actor3, input.membershipId);
+      this.requireActiveAndCurrent(target, input.expectedUpdatedAt);
+      if ((target.role === "owner" || input.role === "owner") && access.role !== "owner") this.accessDenied();
+      const updated = await this.mapMutation(await this.deps.membershipStore.updateRole({ tenantId: actor3.tenantId, id: input.membershipId, role: input.role, expectedUpdatedAt: input.expectedUpdatedAt }));
+      this.publish(updated, "role_changed", `membership:${updated.id}:role:${updated.role}:${input.expectedUpdatedAt.toISOString()}`);
+      return updated;
+    });
+  }
+  async remove(actor3, input) {
+    return this.withProjectLock(actor3, async () => {
+      const access = await this.authorize(actor3);
+      const target = await this.target(actor3, input.membershipId);
+      this.requireActiveAndCurrent(target, input.expectedUpdatedAt);
+      if (target.role === "owner" && access.role !== "owner") this.accessDenied();
+      const removed = await this.mapMutation(await this.deps.membershipStore.remove({ tenantId: actor3.tenantId, id: input.membershipId, expectedUpdatedAt: input.expectedUpdatedAt }));
+      this.publish(removed, "removed", `membership:${removed.id}:remove:${input.expectedUpdatedAt.toISOString()}`);
+      return removed;
+    });
+  }
+  async authorize(actor3) {
+    await this.deps.accessService.requireProjectAccess({ ...actor3, capability: "manage" });
+    const membership = await this.deps.membershipStore.findByUser(actor3.tenantId, actor3.projectId, actor3.userId);
+    if (!membership || membership.status !== "active") this.accessDenied();
+    return membership;
+  }
+  async target(actor3, id3) {
+    const target = (await this.deps.membershipStore.list(actor3.tenantId, actor3.projectId)).find((item) => item.id === id3);
+    if (!target) throw new ProjectMembershipServiceError("MEMBERSHIP_NOT_FOUND", 404, "Project membership not found");
+    return target;
+  }
+  requireActiveAndCurrent(target, expectedUpdatedAt2) {
+    if (target.status !== "active") {
+      throw new ProjectMembershipServiceError("MEMBERSHIP_NOT_FOUND", 404, "Project membership not found");
+    }
+    if (!Number.isFinite(expectedUpdatedAt2.getTime()) || target.updatedAt.getTime() !== expectedUpdatedAt2.getTime()) {
+      throw new ProjectMembershipServiceError("MEMBERSHIP_CONFLICT", 409, "Project membership changed; reload before saving");
+    }
+  }
+  async mapMutation(result) {
+    if (result.kind === "updated" || result.kind === "removed") return result.membership;
+    if (result.kind === "not_found") throw new ProjectMembershipServiceError("MEMBERSHIP_NOT_FOUND", 404, "Project membership not found");
+    if (result.kind === "conflict") throw new ProjectMembershipServiceError("MEMBERSHIP_CONFLICT", 409, "Project membership changed; reload before saving");
+    throw new ProjectMembershipServiceError("LAST_OWNER", 409, "The project must retain an owner");
+  }
+  publish(membership, change, sourceKey) {
     if (!this.deps.realtime) return;
     if (!this.deps.roomStore) {
       this.reportRealtimeFailure(membership.id);
@@ -20828,7 +21957,7 @@ var ProjectMembershipService = class {
 };
 
 // src/services/collaboration/ProjectRosterService.ts
-var import_node_crypto16 = require("crypto");
+var import_node_crypto17 = require("crypto");
 var ProjectRosterServiceError = class extends Error {
   /** Creates a stable roster service error. */
   constructor(code, statusCode, message) {
@@ -20847,7 +21976,7 @@ var ProjectRosterService = class {
   /** Creates a roster service from explicitly injected collaborators. */
   constructor(deps) {
     this.deps = deps;
-    this.idFactory = deps.idFactory ?? import_node_crypto16.randomUUID;
+    this.idFactory = deps.idFactory ?? import_node_crypto17.randomUUID;
     this.mutationMutex = deps.projectMutationMutex ?? import_core26.projectMutationMutex;
   }
   /**
@@ -21113,15 +22242,15 @@ function publicProjectBot(project, roomId, agent, now) {
 }
 
 // src/services/collaboration/RoomMessageService.ts
-var import_node_crypto17 = require("crypto");
+var import_node_crypto18 = require("crypto");
 
 // src/services/collaboration/ProjectBotMembershipSnapshot.ts
-var import_protocols16 = require("@axiom-lattice/protocols");
+var import_protocols17 = require("@axiom-lattice/protocols");
 var requiredKeys = ["assistantId", "id", "joinedAt", "mentionName", "projectId", "role", "roomId", "roomThreadId", "status", "tenantId", "title", "updatedAt", "workspaceId"];
 function snapshotProjectBotMembership(value) {
   try {
     if (typeof value !== "object" || value === null || Array.isArray(value)) return void 0;
-    const values = (0, import_protocols16.snapshotExactRecord)(value, requiredKeys, ["responsibility"]);
+    const values = (0, import_protocols17.snapshotExactRecord)(value, requiredKeys, ["responsibility"]);
     if (!values) return void 0;
     const read = (key) => values[key];
     const id3 = read("id");
@@ -21202,7 +22331,7 @@ var RoomMessageService = class {
   constructor(deps, options = {}) {
     this.deps = deps;
     this.idempotentOutcomes = /* @__PURE__ */ new Map();
-    this.idFactory = deps.idFactory ?? import_node_crypto17.randomUUID;
+    this.idFactory = deps.idFactory ?? import_node_crypto18.randomUUID;
     const limit = options.idempotentOutcomeLimit ?? 1e3;
     if (!Number.isSafeInteger(limit) || limit < 1) throw new RangeError("idempotentOutcomeLimit must be a positive safe integer");
     this.idempotentOutcomeLimit = limit;
@@ -21383,7 +22512,7 @@ var RoomMessageService = class {
     let idempotencyKey;
     if (value.requestIdempotencyKey !== void 0) {
       if (typeof value.requestIdempotencyKey !== "string" || !/^[\x21-\x7e]{1,200}$/.test(value.requestIdempotencyKey.trim())) throw new RoomMessageServiceError("INVALID_MESSAGE", 400, "Invalid idempotency key");
-      idempotencyKey = `room-human:${actor3.userId}:${(0, import_node_crypto17.createHash)("sha256").update(value.requestIdempotencyKey.trim(), "utf8").digest("hex")}`;
+      idempotencyKey = `room-human:${actor3.userId}:${(0, import_node_crypto18.createHash)("sha256").update(value.requestIdempotencyKey.trim(), "utf8").digest("hex")}`;
     }
     return { text, mentions, botIds, ...value.replyToMessageId === void 0 ? {} : { replyToMessageId: value.replyToMessageId }, ...idempotencyKey === void 0 ? {} : { idempotencyKey } };
   }
@@ -21440,7 +22569,7 @@ function cloneRoomMessage(message) {
   };
 }
 function fingerprintRequest(input) {
-  return (0, import_node_crypto17.createHash)("sha256").update(JSON.stringify({
+  return (0, import_node_crypto18.createHash)("sha256").update(JSON.stringify({
     text: input.text,
     mentions: input.mentions,
     replyToMessageId: input.replyToMessageId ?? null
@@ -21451,11 +22580,11 @@ function matchesNormalizedPayload(message, input) {
 }
 
 // src/routes/project-rooms.ts
-var import_zod11 = require("zod");
-var import_protocols17 = require("@axiom-lattice/protocols");
+var import_zod13 = require("zod");
+var import_protocols18 = require("@axiom-lattice/protocols");
 
 // src/services/collaboration/RoomInterruptService.ts
-var import_node_crypto18 = require("crypto");
+var import_node_crypto19 = require("crypto");
 var RoomInterruptServiceError = class extends Error {
   /** Creates a stable room interrupt error. */
   constructor(code, statusCode, message) {
@@ -21469,7 +22598,7 @@ var RoomInterruptService = class {
   /** Creates the service from explicitly injected stores and dispatcher. */
   constructor(deps) {
     this.deps = deps;
-    this.idFactory = deps.idFactory ?? import_node_crypto18.randomUUID;
+    this.idFactory = deps.idFactory ?? import_node_crypto19.randomUUID;
   }
   /** Resolves a pending clarify interrupt with no answers. */
   async skip(input) {
@@ -21527,52 +22656,52 @@ var RoomInterruptService = class {
 };
 
 // src/schemas/project-room.ts
-var import_zod10 = require("zod");
-var id2 = import_zod10.z.string().trim().min(1).max(128);
-var isoDate = import_zod10.z.string().datetime({ offset: true }).transform((value) => new Date(value));
-var expectedUpdatedAt = import_zod10.z.object({ expectedUpdatedAt: isoDate }).strict();
-var projectRoomParamsSchema = import_zod10.z.object({ projectId: id2 }).strict();
-var membershipParamsSchema = import_zod10.z.object({ projectId: id2, membershipId: id2 }).strict();
-var roomMessagesQuerySchema = import_zod10.z.object({
-  beforeCreatedAt: import_zod10.z.string().datetime({ offset: true }).transform((value) => new Date(value)).optional(),
+var import_zod12 = require("zod");
+var id2 = import_zod12.z.string().trim().min(1).max(128);
+var isoDate = import_zod12.z.string().datetime({ offset: true }).transform((value) => new Date(value));
+var expectedUpdatedAt = import_zod12.z.object({ expectedUpdatedAt: isoDate }).strict();
+var projectRoomParamsSchema = import_zod12.z.object({ projectId: id2 }).strict();
+var membershipParamsSchema = import_zod12.z.object({ projectId: id2, membershipId: id2 }).strict();
+var roomMessagesQuerySchema = import_zod12.z.object({
+  beforeCreatedAt: import_zod12.z.string().datetime({ offset: true }).transform((value) => new Date(value)).optional(),
   beforeId: id2.optional(),
-  limit: import_zod10.z.coerce.number().int().min(1).max(100).optional()
+  limit: import_zod12.z.coerce.number().int().min(1).max(100).optional()
 }).strict().refine((value) => value.beforeCreatedAt === void 0 === (value.beforeId === void 0), { message: "Both cursor fields are required" });
-var createRoomMessageSchema = import_zod10.z.object({
-  text: import_zod10.z.string(),
-  mentions: import_zod10.z.array(import_zod10.z.union([
-    import_zod10.z.object({ type: import_zod10.z.literal("team") }).strict(),
-    import_zod10.z.object({ type: import_zod10.z.literal("bot"), membershipId: id2 }).strict()
+var createRoomMessageSchema = import_zod12.z.object({
+  text: import_zod12.z.string(),
+  mentions: import_zod12.z.array(import_zod12.z.union([
+    import_zod12.z.object({ type: import_zod12.z.literal("team") }).strict(),
+    import_zod12.z.object({ type: import_zod12.z.literal("bot"), membershipId: id2 }).strict()
   ])).optional(),
   replyToMessageId: id2.optional()
 }).strict();
-var addProjectMemberSchema = import_zod10.z.object({ userId: id2, role: import_zod10.z.enum(["owner", "admin", "member", "viewer"]) }).strict();
-var updateProjectMemberSchema = import_zod10.z.object({ role: import_zod10.z.enum(["owner", "admin", "member", "viewer"]), expectedUpdatedAt: isoDate }).strict();
+var addProjectMemberSchema = import_zod12.z.object({ userId: id2, role: import_zod12.z.enum(["owner", "admin", "member", "viewer"]) }).strict();
+var updateProjectMemberSchema = import_zod12.z.object({ role: import_zod12.z.enum(["owner", "admin", "member", "viewer"]), expectedUpdatedAt: isoDate }).strict();
 var mutationExpectedUpdatedAtSchema = expectedUpdatedAt;
-var roomMessageRetryParamsSchema = import_zod10.z.object({ projectId: id2, messageId: id2 }).strict();
-var emptyObjectSchema = import_zod10.z.object({}).strict();
-var idempotencyKeySchema = import_zod10.z.string().refine((value) => value.trim().length >= 1 && value.trim().length <= 200 && /^[\x20-\x7e]+$/.test(value.trim()), "Invalid idempotency key").transform((value) => value.trim());
-var addProjectBotSchema = import_zod10.z.object({
+var roomMessageRetryParamsSchema = import_zod12.z.object({ projectId: id2, messageId: id2 }).strict();
+var emptyObjectSchema = import_zod12.z.object({}).strict();
+var idempotencyKeySchema = import_zod12.z.string().refine((value) => value.trim().length >= 1 && value.trim().length <= 200 && /^[\x20-\x7e]+$/.test(value.trim()), "Invalid idempotency key").transform((value) => value.trim());
+var addProjectBotSchema = import_zod12.z.object({
   assistantId: id2,
-  role: import_zod10.z.enum(["coordinator", "specialist"]),
-  title: import_zod10.z.string(),
-  responsibility: import_zod10.z.string().optional(),
-  mentionName: import_zod10.z.string()
+  role: import_zod12.z.enum(["coordinator", "specialist"]),
+  title: import_zod12.z.string(),
+  responsibility: import_zod12.z.string().optional(),
+  mentionName: import_zod12.z.string()
 }).strict();
-var updateProjectBotSchema = import_zod10.z.object({
-  role: import_zod10.z.enum(["coordinator", "specialist"]).optional(),
-  title: import_zod10.z.string().optional(),
-  responsibility: import_zod10.z.string().optional(),
-  mentionName: import_zod10.z.string().optional(),
+var updateProjectBotSchema = import_zod12.z.object({
+  role: import_zod12.z.enum(["coordinator", "specialist"]).optional(),
+  title: import_zod12.z.string().optional(),
+  responsibility: import_zod12.z.string().optional(),
+  mentionName: import_zod12.z.string().optional(),
   expectedUpdatedAt: isoDate
 }).strict().refine((value) => value.role !== void 0 || value.title !== void 0 || value.responsibility !== void 0 || value.mentionName !== void 0, { message: "At least one mutable field is required" });
-var resumeInterruptSchema = import_zod10.z.object({
+var resumeInterruptSchema = import_zod12.z.object({
   membershipId: id2,
-  answers: import_zod10.z.array(import_zod10.z.object({
-    questionIndex: import_zod10.z.number().int().nonnegative(),
-    otherText: import_zod10.z.string().optional(),
-    selectedOptions: import_zod10.z.array(import_zod10.z.string()).optional(),
-    filePath: import_zod10.z.string().optional()
+  answers: import_zod12.z.array(import_zod12.z.object({
+    questionIndex: import_zod12.z.number().int().nonnegative(),
+    otherText: import_zod12.z.string().optional(),
+    selectedOptions: import_zod12.z.array(import_zod12.z.string()).optional(),
+    filePath: import_zod12.z.string().optional()
   }).strict()).optional()
 }).strict();
 
@@ -21661,7 +22790,7 @@ function actor(request, projectId) {
   return { tenantId: user.tenantId, userId: user.id, projectId };
 }
 function toProjectRoomMessage(message) {
-  const publicMessage = (0, import_protocols17.toProjectRoomPublicMessage)(message);
+  const publicMessage = (0, import_protocols18.toProjectRoomPublicMessage)(message);
   if (publicMessage === void 0) throw new Error("Room message could not be mapped to its public DTO");
   return publicMessage;
 }
@@ -21670,7 +22799,7 @@ async function run(reply, operation) {
     const result = await operation();
     return reply.code(result.statusCode ?? 200).send({ success: true, data: result.data });
   } catch (error) {
-    if (error instanceof import_zod11.ZodError) return reply.code(400).send({ success: false, error: { code: "INVALID_REQUEST", message: "Invalid request", retryable: false } });
+    if (error instanceof import_zod13.ZodError) return reply.code(400).send({ success: false, error: { code: "INVALID_REQUEST", message: "Invalid request", retryable: false } });
     if (error instanceof RoomInterruptServiceError) return reply.code(error.statusCode).send({ success: false, error: { code: error.code, message: error.message, retryable: false } });
     if (error instanceof ProjectRoomAuthError || error instanceof ProjectCollaborationError || error instanceof ProjectMembershipServiceError || error instanceof ProjectRosterServiceError || error instanceof RoomMessageServiceError) return reply.code(error.statusCode).send({ success: false, error: { code: error.code, message: error.message, retryable: error instanceof RoomMessageServiceError && error.retryable } });
     return reply.code(500).send({ success: false, error: { code: "INTERNAL_ERROR", message: "Internal server error", retryable: false } });
@@ -21678,7 +22807,7 @@ async function run(reply, operation) {
 }
 
 // src/routes/project-roster.ts
-var import_zod12 = require("zod");
+var import_zod14 = require("zod");
 var ProjectRosterAuthError = class extends Error {
   constructor() {
     super(...arguments);
@@ -21718,17 +22847,17 @@ async function execute(reply, operation) {
     const result = await operation();
     return reply.code(result.statusCode ?? 200).send({ success: true, data: result.data });
   } catch (error) {
-    if (error instanceof import_zod12.ZodError) return reply.code(400).send({ success: false, error: { code: "INVALID_REQUEST", message: "Invalid request", retryable: false } });
+    if (error instanceof import_zod14.ZodError) return reply.code(400).send({ success: false, error: { code: "INVALID_REQUEST", message: "Invalid request", retryable: false } });
     if (error instanceof ProjectRosterAuthError || error instanceof ProjectCollaborationError || error instanceof ProjectRosterServiceError) return reply.code(error.statusCode).send({ success: false, error: { code: error.code, message: error.message, retryable: false } });
     return reply.code(500).send({ success: false, error: { code: "INTERNAL_ERROR", message: "Internal server error", retryable: false } });
   }
 }
 
 // src/routes/cospace.ts
-var import_node_crypto19 = require("crypto");
-var import_zod13 = require("zod");
-var import_core47 = require("@axiom-lattice/core");
-var import_protocols18 = require("@axiom-lattice/protocols");
+var import_node_crypto20 = require("crypto");
+var import_zod15 = require("zod");
+var import_core48 = require("@axiom-lattice/core");
+var import_protocols19 = require("@axiom-lattice/protocols");
 var CoSpaceAuthError = class extends Error {
   constructor() {
     super(...arguments);
@@ -21756,7 +22885,7 @@ async function computeUnread(deps, tenantId, userId, roomId, lastMessage) {
   });
 }
 function registerCoSpaceRoutes(app2, deps) {
-  const idFactory = deps.idFactory ?? (() => (0, import_node_crypto19.randomUUID)());
+  const idFactory = deps.idFactory ?? (() => (0, import_node_crypto20.randomUUID)());
   app2.get(
     "/api/workspaces/:workspaceId/rooms",
     async (request, reply) => {
@@ -21805,7 +22934,7 @@ function registerCoSpaceRoutes(app2, deps) {
               limit: 1
             });
             const lastMessage = messages[0];
-            const publicLastMessage = lastMessage === void 0 ? void 0 : (0, import_protocols18.toProjectRoomPublicMessage)(lastMessage);
+            const publicLastMessage = lastMessage === void 0 ? void 0 : (0, import_protocols19.toProjectRoomPublicMessage)(lastMessage);
             const memberships = await deps.membershipStore.list(
               actor3.tenantId,
               project.id
@@ -21872,7 +23001,7 @@ function registerCoSpaceRoutes(app2, deps) {
             rooms.unshift({
               project: publicRoom.project,
               room: publicRoom.room,
-              lastMessage: publicLastMessage === void 0 ? void 0 : (0, import_protocols18.toProjectRoomPublicMessage)(publicLastMessage),
+              lastMessage: publicLastMessage === void 0 ? void 0 : (0, import_protocols19.toProjectRoomPublicMessage)(publicLastMessage),
               participantCount: publicMemberships.filter((m) => m.status === "active").length,
               participantNames: publicParticipantNames,
               isPublic: true,
@@ -21912,14 +23041,14 @@ function registerCoSpaceRoutes(app2, deps) {
         }
         let projectId;
         if (body.type === "human") {
-          projectId = (0, import_core47.generateDirectHumanProjectId)(
+          projectId = (0, import_core48.generateDirectHumanProjectId)(
             actor3.tenantId,
             params.workspaceId,
             actor3.userId,
             body.targetUserId
           );
         } else {
-          projectId = (0, import_core47.generateDirectBotProjectId)(
+          projectId = (0, import_core48.generateDirectBotProjectId)(
             actor3.tenantId,
             params.workspaceId,
             actor3.userId,
@@ -22126,7 +23255,7 @@ function registerCoSpaceRoutes(app2, deps) {
         );
         const bots = [];
         for (const assistant of assistants) {
-          const directProjectId = (0, import_core47.generateDirectBotProjectId)(
+          const directProjectId = (0, import_core48.generateDirectBotProjectId)(
             actor3.tenantId,
             params.workspaceId,
             actor3.userId,
@@ -22188,7 +23317,7 @@ function registerCoSpaceRoutes(app2, deps) {
           if (link.userId === actor3.userId) continue;
           const user = await deps.userStore.getUserById(link.userId);
           if (!user) continue;
-          const directProjectId = (0, import_core47.generateDirectHumanProjectId)(
+          const directProjectId = (0, import_core48.generateDirectHumanProjectId)(
             actor3.tenantId,
             params.workspaceId,
             actor3.userId,
@@ -22277,7 +23406,7 @@ function registerCoSpaceRoutes(app2, deps) {
         data: result.data
       });
     } catch (error) {
-      if (error instanceof import_zod13.ZodError) {
+      if (error instanceof import_zod15.ZodError) {
         return reply.code(400).send({
           success: false,
           error: {
@@ -22310,9 +23439,9 @@ function registerCoSpaceRoutes(app2, deps) {
 }
 
 // src/routes/push-notifications.ts
-var import_zod14 = require("zod");
-var subscriptionSchema = import_zod14.z.object({ endpoint: import_zod14.z.string().min(1), keys: import_zod14.z.object({ p256dh: import_zod14.z.string().min(1), auth: import_zod14.z.string().min(1) }).strict() }).strict();
-var deleteSchema = import_zod14.z.object({ endpoint: import_zod14.z.string().min(1) }).strict();
+var import_zod16 = require("zod");
+var subscriptionSchema = import_zod16.z.object({ endpoint: import_zod16.z.string().min(1), keys: import_zod16.z.object({ p256dh: import_zod16.z.string().min(1), auth: import_zod16.z.string().min(1) }).strict() }).strict();
+var deleteSchema = import_zod16.z.object({ endpoint: import_zod16.z.string().min(1) }).strict();
 function actor2(request) {
   const user = request.user;
   return user?.id && user.tenantId ? { tenantId: user.tenantId, userId: user.id } : null;
@@ -22340,7 +23469,7 @@ function registerPushNotificationRoutes(app2, deps) {
       });
       return reply.code(204).send();
     } catch (error) {
-      if (error instanceof import_zod14.ZodError) {
+      if (error instanceof import_zod16.ZodError) {
         return reply.code(400).send({ success: false, error: { code: "INVALID_REQUEST", message: "Invalid request", retryable: false } });
       }
       return reply.code(500).send({ success: false, error: { code: "INTERNAL_ERROR", message: "Internal server error", retryable: false } });
@@ -22354,7 +23483,7 @@ function registerPushNotificationRoutes(app2, deps) {
       await deps.subscriptionStore.delete(current.tenantId, current.userId, body.endpoint);
       return reply.code(204).send();
     } catch (error) {
-      if (error instanceof import_zod14.ZodError) {
+      if (error instanceof import_zod16.ZodError) {
         return reply.code(400).send({ success: false, error: { code: "INVALID_REQUEST", message: "Invalid request", retryable: false } });
       }
       return reply.code(500).send({ success: false, error: { code: "INTERNAL_ERROR", message: "Internal server error", retryable: false } });
@@ -22585,7 +23714,7 @@ var RoomTargetResolver = class {
 };
 
 // src/services/collaboration/RoomDispatchService.ts
-var import_protocols19 = require("@axiom-lattice/protocols");
+var import_protocols20 = require("@axiom-lattice/protocols");
 
 // src/router/InternalRoomDispatch.ts
 var INTERNAL_ROOM_DISPATCH = Symbol("internal-room-dispatch");
@@ -22687,7 +23816,7 @@ function snapshotDispatchSource(value) {
   };
 }
 function snapshotMentions(value) {
-  const rows = (0, import_protocols19.snapshotExactArray)(value);
+  const rows = (0, import_protocols20.snapshotExactArray)(value);
   if (!rows) return void 0;
   const result = [];
   for (const row of rows) {
@@ -22705,15 +23834,15 @@ function snapshotMentions(value) {
 function exactValues(value, required, optional = []) {
   try {
     if (typeof value !== "object" || value === null || Array.isArray(value)) return void 0;
-    return (0, import_protocols19.snapshotExactRecord)(value, required, optional);
+    return (0, import_protocols20.snapshotExactRecord)(value, required, optional);
   } catch {
     return void 0;
   }
 }
 
 // src/services/collaboration/CoordinatorWakeNotifier.ts
-var import_node_crypto20 = require("crypto");
-var import_protocols20 = require("@axiom-lattice/protocols");
+var import_node_crypto21 = require("crypto");
+var import_protocols21 = require("@axiom-lattice/protocols");
 var SYNTHETIC_WAKE_AUTHOR = "coordinator-wake";
 var CoordinatorWakeNotifier = class {
   /** Creates a bounded Project Task lifecycle observer that wakes the Room Coordinator. */
@@ -22726,7 +23855,7 @@ var CoordinatorWakeNotifier = class {
     this.accepted = /* @__PURE__ */ new Set();
     this.maxPending = deps.maxPending ?? 1024;
     if (!Number.isSafeInteger(this.maxPending) || this.maxPending < 1) throw new RangeError("maxPending must be a positive safe integer");
-    this.idFactory = deps.idFactory ?? import_node_crypto20.randomUUID;
+    this.idFactory = deps.idFactory ?? import_node_crypto21.randomUUID;
   }
   /** Admits one notification without awaiting any store or dispatch operation. */
   handle(value, anchorMessageId) {
@@ -22869,7 +23998,7 @@ var CoordinatorWakeNotifier = class {
     }
   }
   parse(value) {
-    const row = (0, import_protocols20.snapshotExactRecord)(value, ["tenantId", "workspaceId", "projectId", "taskId", "status", "action", "eventKey", "updatedAt"], ["threadId"]);
+    const row = (0, import_protocols21.snapshotExactRecord)(value, ["tenantId", "workspaceId", "projectId", "taskId", "status", "action", "eventKey", "updatedAt"], ["threadId"]);
     const actions = ["in_progress", "interrupted", "failed", "completed", "cancelled", "reassigned"];
     const statuses = ["pending", "in_progress", "review", "failed", "interrupted", "completed", "cancelled"];
     if (!row || !actions.includes(String(row.action)) || !statuses.includes(String(row.status)) || !["tenantId", "workspaceId", "projectId", "taskId", "eventKey", "updatedAt"].every((key) => typeof row[key] === "string" && row[key].length > 0) || !Number.isFinite(Date.parse(row.updatedAt)) || row.threadId !== void 0 && typeof row.threadId !== "string") return void 0;
@@ -23003,9 +24132,9 @@ function createRoomMessageRetentionJob(input) {
 }
 
 // src/services/collaboration/ProjectTaskExecutionMutex.ts
-var import_protocols21 = require("@axiom-lattice/protocols");
+var import_protocols22 = require("@axiom-lattice/protocols");
 function machineKey(scope) {
-  const snapshot = (0, import_protocols21.snapshotExactRecord)(scope, ["tenantId", "assistantId", "projectId"]);
+  const snapshot = (0, import_protocols22.snapshotExactRecord)(scope, ["tenantId", "assistantId", "projectId"]);
   if (!snapshot) throw new Error("Invalid Project task machine scope");
   const values = [snapshot.tenantId, snapshot.assistantId, snapshot.projectId];
   for (const value of values) {
@@ -23081,9 +24210,9 @@ var ProjectTaskExecutionMutex = class {
 };
 
 // src/services/collaboration/ProjectTaskObserver.ts
-var import_node_crypto21 = require("crypto");
-var import_core48 = require("@axiom-lattice/core");
-var import_protocols22 = require("@axiom-lattice/protocols");
+var import_node_crypto22 = require("crypto");
+var import_core49 = require("@axiom-lattice/core");
+var import_protocols23 = require("@axiom-lattice/protocols");
 var SYSTEM_ACTOR2 = "system";
 var TERMINAL_ACTIONS = ["completed", "failed", "interrupted", "cancelled"];
 var ProjectTaskObserver = class {
@@ -23104,7 +24233,7 @@ var ProjectTaskObserver = class {
         throw new Error(`Invalid Project task observer bound: ${name}`);
       }
     }
-    this.runBridge = (0, import_core48.createTaskRunBridge)({ lifecycle: this.deps.lifecycle });
+    this.runBridge = (0, import_core49.createTaskRunBridge)({ lifecycle: this.deps.lifecycle });
   }
   /** Fire-and-forget notifier adapter that never waits for observer work or machine acquisition. */
   async listener(event) {
@@ -23634,7 +24763,7 @@ var ProjectTaskObserver = class {
       action: "activity",
       summary: "Project task recovery warning",
       detail: { type: "project_task_recovery_warning", phase, message },
-      eventKey: `project-task-recovery-warning:${task.id}:${phase}:${(0, import_node_crypto21.createHash)("sha256").update(message).digest("hex")}`
+      eventKey: `project-task-recovery-warning:${task.id}:${phase}:${(0, import_node_crypto22.createHash)("sha256").update(message).digest("hex")}`
     });
   }
   async safeWarning(task, phase, error) {
@@ -23838,7 +24967,7 @@ var ProjectTaskObserver = class {
     }
   }
   async persistOverflowWarning(event) {
-    const scopeDigest = (0, import_node_crypto21.createHash)("sha256").update(JSON.stringify([event.tenantId, event.workspaceId, event.projectId])).digest("hex");
+    const scopeDigest = (0, import_node_crypto22.createHash)("sha256").update(JSON.stringify([event.tenantId, event.workspaceId, event.projectId])).digest("hex");
     try {
       await this.deps.workItems.createIfAbsentByEventKey({
         tenantId: event.tenantId,
@@ -23929,7 +25058,7 @@ function errorMessage3(error) {
 }
 function readCreatedBy(value) {
   try {
-    const row = (0, import_protocols22.snapshotExactRecord)(value, ["assistantId", "membershipId"]);
+    const row = (0, import_protocols23.snapshotExactRecord)(value, ["assistantId", "membershipId"]);
     return row && typeof row.assistantId === "string" && row.assistantId.length > 0 && typeof row.membershipId === "string" && row.membershipId.length > 0 ? { assistantId: row.assistantId, membershipId: row.membershipId } : void 0;
   } catch {
     return void 0;
@@ -23943,8 +25072,8 @@ function combineSignals(left, right) {
 }
 
 // src/services/collaboration/RoomProjectionService.ts
-var import_node_crypto22 = require("crypto");
-var import_protocols23 = require("@axiom-lattice/protocols");
+var import_node_crypto23 = require("crypto");
+var import_protocols24 = require("@axiom-lattice/protocols");
 var ROOM_PROJECTABLE_ACTIONS = [
   "interrupted",
   "failed",
@@ -24023,7 +25152,7 @@ var RoomProjectionService = class {
         projectId: task.projectId,
         roomId: room.id,
         author: { type: "system" },
-        content: { type: "text", text: `${import_protocols23.PROJECT_ROOM_TASK_DELEGATED_LABEL}${import_protocols23.PROJECT_ROOM_TASK_DELEGATED_SEPARATOR}${input.fromLabel} \u2192 ${input.toLabel}` },
+        content: { type: "text", text: `${import_protocols24.PROJECT_ROOM_TASK_DELEGATED_LABEL}${import_protocols24.PROJECT_ROOM_TASK_DELEGATED_SEPARATOR}${input.fromLabel} \u2192 ${input.toLabel}` },
         mentions: [],
         source: "task",
         sourceId: task.id,
@@ -24158,7 +25287,7 @@ function safeRepairIdentity(value, scope) {
   return taskId && eventKey && tenantId === scope.tenantId && workspaceId === scope.workspaceId && projectId === scope.projectId ? { taskId, eventKey } : void 0;
 }
 function tupleKey(prefix, values) {
-  const digest = (0, import_node_crypto22.createHash)("sha256").update(JSON.stringify(values)).digest("hex");
+  const digest = (0, import_node_crypto23.createHash)("sha256").update(JSON.stringify(values)).digest("hex");
   return `${prefix}:${digest}`;
 }
 function parseProjectionInput(taskValue, itemValue) {
@@ -24174,7 +25303,7 @@ function parseProjectionInput(taskValue, itemValue) {
   }
 }
 function snapshotProjectableWorkItem(value) {
-  const row = (0, import_protocols23.snapshotExactRecord)(value, ["id", "taskId", "tenantId", "action", "actor", "createdAt"], [
+  const row = (0, import_protocols24.snapshotExactRecord)(value, ["id", "taskId", "tenantId", "action", "actor", "createdAt"], [
     "workspaceId",
     "projectId",
     "threadId",
@@ -24184,7 +25313,7 @@ function snapshotProjectableWorkItem(value) {
     "eventKey"
   ]);
   const createdAt = cloneExactDate(row?.createdAt);
-  if (!row || !createdAt || typeof row.id !== "string" || !row.id || typeof row.taskId !== "string" || !row.taskId || typeof row.tenantId !== "string" || !row.tenantId || typeof row.workspaceId !== "string" || !row.workspaceId || typeof row.projectId !== "string" || !row.projectId || typeof row.actor !== "string" || !row.actor || typeof row.eventKey !== "string" || !row.eventKey || !import_protocols23.PROJECT_TASK_LIFECYCLE_ACTIONS.includes(row.action) || row.threadId !== void 0 && typeof row.threadId !== "string" || row.summary !== void 0 && typeof row.summary !== "string" || row.attempt !== void 0 && (typeof row.attempt !== "number" || !Number.isFinite(row.attempt))) return void 0;
+  if (!row || !createdAt || typeof row.id !== "string" || !row.id || typeof row.taskId !== "string" || !row.taskId || typeof row.tenantId !== "string" || !row.tenantId || typeof row.workspaceId !== "string" || !row.workspaceId || typeof row.projectId !== "string" || !row.projectId || typeof row.actor !== "string" || !row.actor || typeof row.eventKey !== "string" || !row.eventKey || !import_protocols24.PROJECT_TASK_LIFECYCLE_ACTIONS.includes(row.action) || row.threadId !== void 0 && typeof row.threadId !== "string" || row.summary !== void 0 && typeof row.summary !== "string" || row.attempt !== void 0 && (typeof row.attempt !== "number" || !Number.isFinite(row.attempt))) return void 0;
   try {
     const detail = row.detail === void 0 ? void 0 : snapshotJsonValue(row.detail);
     if (detail !== void 0 && !isRecord3(detail)) return void 0;
@@ -24211,26 +25340,26 @@ function parseIso(value) {
   return typeof value === "string" && value.length > 0 && Number.isFinite(Date.parse(value));
 }
 function parseInterruption(value) {
-  const common = (0, import_protocols23.snapshotExactRecord)(value, ["type", "summary", "requestedAt"]);
+  const common = (0, import_protocols24.snapshotExactRecord)(value, ["type", "summary", "requestedAt"]);
   if (common && (common.type === "missing_input" || common.type === "user_decision") && typeof common.summary === "string" && common.summary.length > 0 && parseIso(common.requestedAt)) {
     return { type: common.type, summary: common.summary, requestedAt: common.requestedAt };
   }
-  const review = (0, import_protocols23.snapshotExactRecord)(value, ["type", "evidenceId"]);
+  const review = (0, import_protocols24.snapshotExactRecord)(value, ["type", "evidenceId"]);
   return review?.type === "review_required" && typeof review.evidenceId === "string" && review.evidenceId.length > 0 ? { type: "review_required", evidenceId: review.evidenceId } : void 0;
 }
 function parseBeliefImpact(value) {
-  const rows = (0, import_protocols23.snapshotExactArray)(value);
+  const rows = (0, import_protocols24.snapshotExactArray)(value);
   if (!rows) return void 0;
   const impacts = [];
   for (const row of rows) {
-    const entry = (0, import_protocols23.snapshotExactRecord)(row, ["key", "after", "basis"]);
+    const entry = (0, import_protocols24.snapshotExactRecord)(row, ["key", "after", "basis"]);
     if (!entry || typeof entry.key !== "string" || !entry.key || typeof entry.after !== "number" || !Number.isFinite(entry.after) || typeof entry.basis !== "string" || !entry.basis) return void 0;
     impacts.push({ key: entry.key, after: entry.after, basis: entry.basis });
   }
   return impacts;
 }
 function parseCompletion(item) {
-  const row = (0, import_protocols23.snapshotExactRecord)(item.detail, ["evidenceId", "eventKey", "result", "beliefImpact"]);
+  const row = (0, import_protocols24.snapshotExactRecord)(item.detail, ["evidenceId", "eventKey", "result", "beliefImpact"]);
   const beliefImpact = parseBeliefImpact(row?.beliefImpact);
   if (!row || typeof row.evidenceId !== "string" || !row.evidenceId || typeof row.eventKey !== "string" || !row.eventKey || item.eventKey !== `${row.eventKey}:completed` || typeof row.result !== "string" || !beliefImpact) return void 0;
   return { evidenceId: row.evidenceId, eventKey: row.eventKey, result: row.result, beliefImpact };
@@ -24240,19 +25369,19 @@ function parseProjection(item) {
     return parseInterruption(item.detail) ? { kind: "interrupted", text: "Task interrupted" } : void 0;
   }
   if (item.action === "failed") {
-    const row = (0, import_protocols23.snapshotExactRecord)(item.detail, ["failureReason"]);
+    const row = (0, import_protocols24.snapshotExactRecord)(item.detail, ["failureReason"]);
     return typeof row?.failureReason === "string" && row.failureReason ? { kind: "failed", text: "Task failed" } : void 0;
   }
   if (item.action === "completed") {
     return parseCompletion(item) ? { kind: "completed", text: "Task completed" } : void 0;
   }
   if (item.action === "cancelled") {
-    const empty = (0, import_protocols23.snapshotExactRecord)(item.detail, []);
-    const summarized = (0, import_protocols23.snapshotExactRecord)(item.detail, ["summary"]);
+    const empty = (0, import_protocols24.snapshotExactRecord)(item.detail, []);
+    const summarized = (0, import_protocols24.snapshotExactRecord)(item.detail, ["summary"]);
     return empty || typeof summarized?.summary === "string" && summarized.summary ? { kind: "cancelled", text: "Task cancelled" } : void 0;
   }
   if (item.action === "reassigned") {
-    const row = (0, import_protocols23.snapshotExactRecord)(
+    const row = (0, import_protocols24.snapshotExactRecord)(
       item.detail,
       ["previousOwnerId", "previousThreadId", "ownerId", "membershipId", "threadId"]
     );
@@ -24261,7 +25390,7 @@ function parseProjection(item) {
   return void 0;
 }
 function assertCanonicalProjection(value, expected) {
-  const row = (0, import_protocols23.snapshotExactRecord)(value, [
+  const row = (0, import_protocols24.snapshotExactRecord)(value, [
     "id",
     "tenantId",
     "workspaceId",
@@ -24275,9 +25404,9 @@ function assertCanonicalProjection(value, expected) {
     "idempotencyKey",
     "createdAt"
   ]);
-  const author = (0, import_protocols23.snapshotExactRecord)(row?.author, ["type"]);
-  const content = (0, import_protocols23.snapshotExactRecord)(row?.content, ["type", "text"]);
-  const mentions = (0, import_protocols23.snapshotExactArray)(row?.mentions);
+  const author = (0, import_protocols24.snapshotExactRecord)(row?.author, ["type"]);
+  const content = (0, import_protocols24.snapshotExactRecord)(row?.content, ["type", "text"]);
+  const mentions = (0, import_protocols24.snapshotExactArray)(row?.mentions);
   const createdAt = cloneExactDate(row?.createdAt);
   if (!row || !createdAt || author?.type !== "system" || content?.type !== "text" || content.text !== expected.content.text || !mentions || mentions.length !== 0 || typeof row.id !== "string" || !row.id || row.tenantId !== expected.tenantId || row.workspaceId !== expected.workspaceId || row.projectId !== expected.projectId || row.roomId !== expected.roomId || row.source !== "task" || row.sourceId !== expected.sourceId || row.idempotencyKey !== expected.idempotencyKey) {
     throw new Error("Invalid canonical task projection");
@@ -24298,7 +25427,7 @@ function assertCanonicalProjection(value, expected) {
   };
 }
 function snapshotLifecycleCursor(value) {
-  const row = (0, import_protocols23.snapshotExactRecord)(value, ["id", "taskId", "tenantId", "action", "actor", "createdAt"], [
+  const row = (0, import_protocols24.snapshotExactRecord)(value, ["id", "taskId", "tenantId", "action", "actor", "createdAt"], [
     "workspaceId",
     "projectId",
     "threadId",
@@ -24315,11 +25444,11 @@ function isRecord3(value) {
 }
 
 // src/services/collaboration/ProjectRoomRealtimeRuntime.ts
-var import_core49 = require("@axiom-lattice/core");
+var import_core50 = require("@axiom-lattice/core");
 
 // src/services/collaboration/ProjectRoomEventBroker.ts
-var import_node_crypto23 = require("crypto");
-var import_protocols24 = require("@axiom-lattice/protocols");
+var import_node_crypto24 = require("crypto");
+var import_protocols25 = require("@axiom-lattice/protocols");
 var DEFAULT_MAX_EVENTS_PER_ROOM = 1e3;
 var DEFAULT_MAX_EVENT_AGE_MS = 10 * 60 * 1e3;
 var DEFAULT_MAX_ROOMS = 1e3;
@@ -24343,7 +25472,7 @@ var ProjectRoomEventBroker = class {
     this.subscriberCount = 0;
     this.usageClock = 0;
     this.closed = false;
-    this.epoch = options.epoch ?? (0, import_node_crypto23.randomUUID)();
+    this.epoch = options.epoch ?? (0, import_node_crypto24.randomUUID)();
     if (!UUID_PATTERN.test(this.epoch)) {
       throw new TypeError("Project Room event epoch must be a lowercase canonical UUID");
     }
@@ -24382,7 +25511,7 @@ var ProjectRoomEventBroker = class {
     const canonicalScope = snapshotScope(scope);
     const key = scopeKey2(canonicalScope);
     const now = this.currentTime();
-    if (this.sequence >= Number.MAX_SAFE_INTEGER) throw new import_protocols24.ProjectRoomBrokerCapacityError();
+    if (this.sequence >= Number.MAX_SAFE_INTEGER) throw new import_protocols25.ProjectRoomBrokerCapacityError();
     const nextSequence = this.sequence + 1;
     const event = snapshotJson({
       ...snapshotDraft(draft),
@@ -24565,11 +25694,11 @@ var ProjectRoomEventBroker = class {
   }
   resolveCursor(key, afterEventId, plan) {
     if (afterEventId === void 0) return void 0;
-    const cursor = (0, import_protocols24.parseProjectRoomEventId)(afterEventId);
-    if (!cursor) throw new import_protocols24.ProjectRoomCursorError("CURSOR_EXPIRED");
-    if (cursor.epoch !== this.epoch) throw new import_protocols24.ProjectRoomCursorError("SERVER_RESTART");
+    const cursor = (0, import_protocols25.parseProjectRoomEventId)(afterEventId);
+    if (!cursor) throw new import_protocols25.ProjectRoomCursorError("CURSOR_EXPIRED");
+    if (cursor.epoch !== this.epoch) throw new import_protocols25.ProjectRoomCursorError("SERVER_RESTART");
     if (plan.sequences.has(cursor.sequence) || this.sequenceScopes.get(cursor.sequence) !== key) {
-      throw new import_protocols24.ProjectRoomCursorError("CURSOR_EXPIRED");
+      throw new import_protocols25.ProjectRoomCursorError("CURSOR_EXPIRED");
     }
     return cursor.sequence;
   }
@@ -24661,8 +25790,8 @@ function snapshotJson(value, ancestors = /* @__PURE__ */ new Set()) {
 }
 
 // src/services/collaboration/ProjectRoomRealtimePublisher.ts
-var import_node_crypto24 = require("crypto");
-var import_protocols25 = require("@axiom-lattice/protocols");
+var import_node_crypto25 = require("crypto");
+var import_protocols26 = require("@axiom-lattice/protocols");
 var BrokerProjectRoomRealtimePublisher = class {
   /** Creates a publisher around a broker and structured warning logger. */
   constructor(deps) {
@@ -24676,7 +25805,7 @@ var BrokerProjectRoomRealtimePublisher = class {
   /** Publishes a canonical message after projecting it to its public shape. */
   messageCreated(message) {
     this.publish("message.created", () => {
-      const projection = (0, import_protocols25.snapshotProjectRoomMessageRealtime)(message);
+      const projection = (0, import_protocols26.snapshotProjectRoomMessageRealtime)(message);
       if (!projection) return void 0;
       return {
         sourceKey: `message:${projection.publicMessage.id}`,
@@ -24691,7 +25820,7 @@ var BrokerProjectRoomRealtimePublisher = class {
     this.publish("roster.changed", () => {
       const membership = snapshotInput(input, "roster");
       if (membership.membership.tenantId !== membership.tenantId || membership.membership.roomId !== membership.roomId || !safeId2(membership.membership.projectId)) throw new TypeError("Invalid roster scope");
-      const projection = (0, import_protocols25.snapshotProjectRoomBotMembershipRealtime)(membership.membership);
+      const projection = (0, import_protocols26.snapshotProjectRoomBotMembershipRealtime)(membership.membership);
       if (!projection) return void 0;
       return {
         sourceKey: membership.sourceKey,
@@ -24706,7 +25835,7 @@ var BrokerProjectRoomRealtimePublisher = class {
     this.publish("membership.changed", () => {
       const membership = snapshotInput(input, "membership");
       if (membership.membership.tenantId !== membership.tenantId || !safeId2(membership.membership.projectId)) throw new TypeError("Invalid membership scope");
-      const projection = (0, import_protocols25.snapshotProjectRoomMembershipRealtime)(membership.membership);
+      const projection = (0, import_protocols26.snapshotProjectRoomMembershipRealtime)(membership.membership);
       if (!projection) return void 0;
       return {
         sourceKey: membership.sourceKey,
@@ -24735,11 +25864,11 @@ var BrokerProjectRoomRealtimePublisher = class {
   /** Publishes a membership notice onto the affected user's channel scope. */
   membershipAffected(input) {
     this.publish("membership.affected", () => {
-      const value = (0, import_protocols25.snapshotExactRecord)(input, ["tenantId", "userId", "change", "projectId", "roomId", "sourceKey"]);
+      const value = (0, import_protocols26.snapshotExactRecord)(input, ["tenantId", "userId", "change", "projectId", "roomId", "sourceKey"]);
       if (!value || !safeId2(value.tenantId) || !safeId2(value.userId) || !safeId2(value.projectId) || !safeId2(value.roomId) || !safeSourceKey(value.sourceKey) || !["added", "removed", "role_changed"].includes(value.change)) {
         throw new TypeError("Invalid membership input");
       }
-      const scope = (0, import_protocols25.projectRoomUserEventScope)(value.tenantId, value.userId);
+      const scope = (0, import_protocols26.projectRoomUserEventScope)(value.tenantId, value.userId);
       return {
         sourceKey: value.sourceKey,
         id: value.sourceKey,
@@ -24755,11 +25884,11 @@ var BrokerProjectRoomRealtimePublisher = class {
   /** Publishes a read-marker update onto the acting user's channel scope. */
   readChanged(input) {
     this.publish("read.changed", () => {
-      const value = (0, import_protocols25.snapshotExactRecord)(input, ["tenantId", "userId", "projectId", "roomId", "lastReadAt", "sourceKey"]);
+      const value = (0, import_protocols26.snapshotExactRecord)(input, ["tenantId", "userId", "projectId", "roomId", "lastReadAt", "sourceKey"]);
       if (!value || !safeId2(value.tenantId) || !safeId2(value.userId) || !safeId2(value.projectId) || !safeId2(value.roomId) || !safeSourceKey(value.sourceKey) || typeof value.lastReadAt !== "string" || !Number.isFinite(Date.parse(value.lastReadAt))) {
         throw new TypeError("Invalid read input");
       }
-      const scope = (0, import_protocols25.projectRoomUserEventScope)(value.tenantId, value.userId);
+      const scope = (0, import_protocols26.projectRoomUserEventScope)(value.tenantId, value.userId);
       return {
         sourceKey: value.sourceKey,
         id: value.sourceKey,
@@ -24777,7 +25906,7 @@ var BrokerProjectRoomRealtimePublisher = class {
     try {
       event = build();
       if (!event) throw new Error("Invalid Project Room realtime projection");
-      const dedupeKey = (0, import_node_crypto24.createHash)("sha256").update(JSON.stringify([type, event.scope.tenantId, event.scope.projectId, event.scope.roomId, event.sourceKey])).digest("hex");
+      const dedupeKey = (0, import_node_crypto25.createHash)("sha256").update(JSON.stringify([type, event.scope.tenantId, event.scope.projectId, event.scope.roomId, event.sourceKey])).digest("hex");
       if (this.sourceKeys.has(dedupeKey)) return;
       this.deps.broker.publish(event.scope, event.draft);
       this.sourceKeys.set(dedupeKey, true);
@@ -24800,13 +25929,13 @@ var BrokerProjectRoomRealtimePublisher = class {
 };
 function snapshotInput(input, kind) {
   const keys2 = kind === "message" ? ["tenantId", "roomId", "message", "sourceKey"] : kind === "roster" ? ["tenantId", "roomId", "membership", "sourceKey"] : ["tenantId", "roomId", "membership", "sourceKey"];
-  const value = (0, import_protocols25.snapshotExactRecord)(input, [...keys2, "change"]);
+  const value = (0, import_protocols26.snapshotExactRecord)(input, [...keys2, "change"]);
   const validChange = kind === "roster" ? ["added", "updated", "paused", "resumed", "removed"].includes(value?.change) : ["added", "role_changed", "removed"].includes(value?.change);
   if (!value || !safeId2(value.tenantId) || !safeId2(value.roomId) || !safeSourceKey(value.sourceKey) || !validChange) throw new TypeError(`Invalid ${kind} input`);
   return value;
 }
 function snapshotTaskInput(input) {
-  const value = (0, import_protocols25.snapshotExactRecord)(input, ["tenantId", "roomId", "projectId", "taskId", "status", "ownerMembershipId", "updatedAt", "sourceKey"]);
+  const value = (0, import_protocols26.snapshotExactRecord)(input, ["tenantId", "roomId", "projectId", "taskId", "status", "ownerMembershipId", "updatedAt", "sourceKey"]);
   if (!value || !safeId2(value.tenantId) || !safeId2(value.roomId) || !safeSourceKey(value.sourceKey)) throw new TypeError("Invalid task input");
   if (!safeId2(value.projectId) || !safeId2(value.taskId) || !safeId2(value.ownerMembershipId) || !["pending", "in_progress", "review", "failed", "interrupted", "completed", "cancelled"].includes(value.status)) throw new TypeError("Invalid task input");
   if (typeof value.updatedAt !== "string") throw new TypeError("Invalid task timestamp");
@@ -24831,7 +25960,7 @@ function safeErrorCode(error) {
 }
 
 // src/services/collaboration/ProjectRoomTaskEventSubscriber.ts
-var import_protocols26 = require("@axiom-lattice/protocols");
+var import_protocols27 = require("@axiom-lattice/protocols");
 var ProjectRoomTaskEventSubscriber = class {
   /** Creates a bounded Project task lifecycle observer. */
   constructor(deps) {
@@ -24941,7 +26070,7 @@ var ProjectRoomTaskEventSubscriber = class {
     }
   }
   parse(value) {
-    const row = (0, import_protocols26.snapshotExactRecord)(value, ["tenantId", "workspaceId", "projectId", "taskId", "status", "action", "eventKey", "updatedAt"], ["threadId"]);
+    const row = (0, import_protocols27.snapshotExactRecord)(value, ["tenantId", "workspaceId", "projectId", "taskId", "status", "action", "eventKey", "updatedAt"], ["threadId"]);
     const actions = ["in_progress", "interrupted", "failed", "completed", "cancelled", "reassigned"];
     const statuses = ["pending", "in_progress", "review", "failed", "interrupted", "completed", "cancelled"];
     if (!row || !actions.includes(String(row.action)) || !statuses.includes(String(row.status)) || !["tenantId", "workspaceId", "projectId", "taskId", "eventKey", "updatedAt"].every((key) => typeof row[key] === "string" && row[key].length > 0) || !Number.isFinite(Date.parse(row.updatedAt)) || row.threadId !== void 0 && typeof row.threadId !== "string") return void 0;
@@ -25017,7 +26146,7 @@ function createProjectRoomRealtimeRuntime(deps) {
     broker,
     publisher,
     subscriber,
-    subscribe: (listener) => import_core49.taskLifecycleNotifier.subscribe(listener),
+    subscribe: (listener) => import_core50.taskLifecycleNotifier.subscribe(listener),
     log: deps.log,
     shutdownTimeoutMs: deps.shutdownTimeoutMs
   });
@@ -25137,7 +26266,7 @@ function createRoomPushNotifier(input) {
 }
 
 // src/services/collaboration/WorkspaceRoomEventsService.ts
-var import_protocols27 = require("@axiom-lattice/protocols");
+var import_protocols28 = require("@axiom-lattice/protocols");
 
 // src/services/collaboration/ProjectRoomSseWriter.ts
 var DEFAULT_MAX_FRAMES = 256;
@@ -25385,7 +26514,7 @@ var WorkspaceRoomEventsService = class {
     const clear = (timer) => {
       if (timer !== void 0) clearTimeout(timer);
     };
-    const userScope = (0, import_protocols27.projectRoomUserEventScope)(actor3.tenantId, actor3.userId);
+    const userScope = (0, import_protocols28.projectRoomUserEventScope)(actor3.tenantId, actor3.userId);
     const userScopeKey = JSON.stringify([userScope.tenantId, userScope.roomId, userScope.projectId]);
     const roomScopeKey = (scope) => JSON.stringify([scope.tenantId, scope.roomId, scope.projectId]);
     const serializeScoped = (scope, event) => scope === null ? `id: ${event.id}
@@ -25495,7 +26624,7 @@ data: ${JSON.stringify({ ...event, scope })}
       accessTimer = setTimeout(() => {
         accessTimer = void 0;
         if (closed) return;
-        const projectIds = [...subscriptions.values()].map((entry) => entry.scope.projectId).filter((projectId) => projectId !== import_protocols27.PROJECT_ROOM_USER_CHANNEL_PROJECT);
+        const projectIds = [...subscriptions.values()].map((entry) => entry.scope.projectId).filter((projectId) => projectId !== import_protocols28.PROJECT_ROOM_USER_CHANNEL_PROJECT);
         Promise.all(projectIds.map((projectId) => Promise.resolve().then(() => this.deps.requireReadAccess({ tenantId: actor3.tenantId, userId: actor3.userId, projectId })))).then(() => {
           if (!closed) scheduleAccessCheck();
         }, () => {
@@ -25538,7 +26667,7 @@ function createWorkspaceMemberRoomLister(deps) {
 }
 
 // src/routes/workspace-room-events.ts
-var import_protocols28 = require("@axiom-lattice/protocols");
+var import_protocols29 = require("@axiom-lattice/protocols");
 function registerWorkspaceRoomEventRoutes(app2, deps) {
   app2.get("/api/workspaces/:workspaceId/room-events", async (request, reply) => {
     try {
@@ -25566,7 +26695,7 @@ function registerWorkspaceRoomEventRoutes(app2, deps) {
   });
 }
 function exactParams(params) {
-  const value = (0, import_protocols28.snapshotExactRecord)(params, ["workspaceId"]);
+  const value = (0, import_protocols29.snapshotExactRecord)(params, ["workspaceId"]);
   if (!value || typeof value.workspaceId !== "string" || !value.workspaceId.trim()) throw new InvalidRealtimeRequestError();
   return { workspaceId: value.workspaceId };
 }
@@ -25694,7 +26823,7 @@ function snapshotDataRecord(value) {
     for (const key of Reflect.ownKeys(descriptors)) {
       if (typeof key !== "string") return void 0;
       const descriptor = descriptors[key];
-      const data = (0, import_protocols29.descriptorDataValue)(descriptor);
+      const data = (0, import_protocols30.descriptorDataValue)(descriptor);
       if (!data) return void 0;
       result[key] = data.value;
     }
@@ -25709,7 +26838,7 @@ function isPublicRoomAddress(message) {
 }
 async function validateReassignmentThread(threads, input) {
   const thread = snapshotThread(await threads.getThreadById(input.tenantId, input.newThreadId));
-  const metadata = (0, import_protocols29.snapshotExactRecord)(thread?.metadata, [
+  const metadata = (0, import_protocols30.snapshotExactRecord)(thread?.metadata, [
     "source",
     "kind",
     "workspaceId",
@@ -25755,35 +26884,35 @@ function hookErrorMessage(error) {
 function wrapReassignmentThreadError(error) {
   if (error instanceof ProjectTaskThreadError) {
     if (error.code === "PROJECT_TASK_THREAD_SCOPE_INVALID") {
-      return new import_core50.ManagedTaskStartError("PROJECT_TASK_CONTEXT_INVALID", error.message, {
+      return new import_core51.ManagedTaskStartError("PROJECT_TASK_CONTEXT_INVALID", error.message, {
         hint: "Project task, room, or roster scope changed; re-read the task and retry."
       });
     }
     if (error.code === "PROJECT_TASK_THREAD_OWNER_INVALID") {
-      return new import_core50.ManagedTaskStartError("TASK_REASSIGN_NO_CHANGE", error.message, {
+      return new import_core51.ManagedTaskStartError("TASK_REASSIGN_NO_CHANGE", error.message, {
         hint: "The target already owns this task; re-read before dispatching."
       });
     }
-    return new import_core50.ManagedTaskStartError("TASK_THREAD_CONFLICT", error.message, {
+    return new import_core51.ManagedTaskStartError("TASK_THREAD_CONFLICT", error.message, {
       hint: "Task Thread changed concurrently; re-read the task and retry."
     });
   }
-  return new import_core50.ManagedTaskStartError("TASK_EXECUTION_ENQUEUE_FAILED", hookErrorMessage(error), {
+  return new import_core51.ManagedTaskStartError("TASK_EXECUTION_ENQUEUE_FAILED", hookErrorMessage(error), {
     hint: "Re-read the task and retry the dispatch."
   });
 }
 function wrapReassignmentAuthorizationError(error) {
-  if (error instanceof import_core50.ProjectTaskOwnerPolicyError) {
+  if (error instanceof import_core51.ProjectTaskOwnerPolicyError) {
     if (error.code === "PROJECT_TASK_CALLER_INACTIVE") {
-      return new import_core50.ManagedTaskStartError("PROJECT_TASK_CALLER_INACTIVE", error.message, {
+      return new import_core51.ManagedTaskStartError("PROJECT_TASK_CALLER_INACTIVE", error.message, {
         hint: "Dispatch from an active Project Room member bot."
       });
     }
-    return new import_core50.ManagedTaskStartError("PROJECT_TASK_OWNER_INACTIVE", error.message, {
+    return new import_core51.ManagedTaskStartError("PROJECT_TASK_OWNER_INACTIVE", error.message, {
       hint: "Dispatch to an active bot in this Project's roster."
     });
   }
-  return new import_core50.ManagedTaskStartError("PROJECT_TASK_CONTEXT_INVALID", hookErrorMessage(error), {
+  return new import_core51.ManagedTaskStartError("PROJECT_TASK_CONTEXT_INVALID", hookErrorMessage(error), {
     hint: "Re-read the task and roster, then retry the dispatch."
   });
 }
@@ -25812,43 +26941,43 @@ async function transferGovernedDispatchOwner(task, options, deps) {
   const agentId = options?.agentId;
   if (!agentId || agentId === task.ownerId) return void 0;
   if (!task.workspaceId || !task.projectId) {
-    throw new import_core50.ManagedTaskStartError("PROJECT_TASK_CONTEXT_INVALID", "Task is not governed by a Project lifecycle.", {
+    throw new import_core51.ManagedTaskStartError("PROJECT_TASK_CONTEXT_INVALID", "Task is not governed by a Project lifecycle.", {
       hint: "Dispatch governed tasks from a trusted Project run; ordinary tasks execute immediately."
     });
   }
   return deps.mutex.runExclusive({ tenantId: task.tenantId, projectId: task.projectId }, async () => {
     const current = await deps.tasks.getById(task.tenantId, task.id);
     if (!current || !isProjectLifecycleTask(current) || current.workspaceId !== task.workspaceId || current.projectId !== task.projectId) {
-      throw new import_core50.ManagedTaskStartError("PROJECT_TASK_CONTEXT_INVALID", "Task is no longer a Project lifecycle task.", {
+      throw new import_core51.ManagedTaskStartError("PROJECT_TASK_CONTEXT_INVALID", "Task is no longer a Project lifecycle task.", {
         hint: "Re-read the task and confirm it still belongs to this Project before dispatching."
       });
     }
     if (current.ownerType !== "agent") {
-      throw new import_core50.ManagedTaskStartError("AGENT_TASK_REQUIRED", "Project task owner must be an Agent.", {
+      throw new import_core51.ManagedTaskStartError("AGENT_TASK_REQUIRED", "Project task owner must be an Agent.", {
         hint: "Assign the task to an Agent before dispatching."
       });
     }
     if (current.status !== "pending") {
-      throw new import_core50.ManagedTaskStartError("TASK_NOT_DISPATCHABLE", "Only a `pending` Project task can be dispatched.", {
+      throw new import_core51.ManagedTaskStartError("TASK_NOT_DISPATCHABLE", "Only a `pending` Project task can be dispatched.", {
         hint: `This task is '${current.status}'. Resolve it or create a new task before dispatching.`
       });
     }
     if (agentId === current.ownerId) return current;
     const room = await deps.rooms.getMainRoom(current.tenantId, current.projectId);
     if (!room || room.tenantId !== current.tenantId || room.workspaceId !== current.workspaceId || room.projectId !== current.projectId || room.type !== "main") {
-      throw new import_core50.ManagedTaskStartError("PROJECT_TASK_CONTEXT_INVALID", "Project main room is unavailable.", {
+      throw new import_core51.ManagedTaskStartError("PROJECT_TASK_CONTEXT_INVALID", "Project main room is unavailable.", {
         hint: "Open or repair the Project Room before dispatching."
       });
     }
     const target = await deps.botMemberships.findByAssistant(current.tenantId, current.projectId, agentId);
     if (!target || target.status !== "active" || target.tenantId !== current.tenantId || target.workspaceId !== current.workspaceId || target.projectId !== current.projectId || target.assistantId !== agentId || target.roomId !== room.id) {
-      throw new import_core50.ManagedTaskStartError("PROJECT_TASK_OWNER_INACTIVE", "Target Project task owner is not active in the exact roster.", {
+      throw new import_core51.ManagedTaskStartError("PROJECT_TASK_OWNER_INACTIVE", "Target Project task owner is not active in the exact roster.", {
         hint: "Dispatch to an active bot in this Project's roster."
       });
     }
     const caller = options?.callerMembershipId ? await deps.botMemberships.findById(current.tenantId, options.callerMembershipId) : null;
     if (!caller || !options?.callerAssistantId || caller.id !== options.callerMembershipId || caller.assistantId !== options.callerAssistantId || caller.status !== "active" || caller.tenantId !== current.tenantId || caller.workspaceId !== current.workspaceId || caller.projectId !== current.projectId || caller.roomId !== room.id) {
-      throw new import_core50.ManagedTaskStartError("PROJECT_TASK_CALLER_INACTIVE", "Current Project task caller is not active in the exact roster.", {
+      throw new import_core51.ManagedTaskStartError("PROJECT_TASK_CALLER_INACTIVE", "Current Project task caller is not active in the exact roster.", {
         hint: "Dispatch from an active Project Room member bot."
       });
     }
@@ -25883,7 +27012,7 @@ async function transferGovernedDispatchOwner(task, options, deps) {
       actor: `agent:${caller.assistantId}`
     });
     if (!result.success) {
-      throw new import_core50.ManagedTaskStartError(result.code, result.error, {
+      throw new import_core51.ManagedTaskStartError(result.code, result.error, {
         hint: result.hint ?? reassignmentFailureHint(result.code),
         ...result.retryable !== void 0 ? { retryable: result.retryable } : {}
       });
@@ -25892,19 +27021,19 @@ async function transferGovernedDispatchOwner(task, options, deps) {
   });
 }
 var registerLatticeRoutes = (app2, channelDeps, options = {}) => {
-  const webAppStore = (0, import_core50.getStoreLattice)("default", "agentWebApp").store;
-  const assistantStore = (0, import_core50.getStoreLattice)("default", "assistant").store;
-  const projectStore = (0, import_core50.getStoreLattice)("default", "project").store;
-  const projectMembershipStore = (0, import_core50.getStoreLattice)("default", "projectMembership").store;
-  const userTenantLinkStore = (0, import_core50.getStoreLattice)("default", "userTenantLink").store;
-  const projectRoomStore = (0, import_core50.getStoreLattice)("default", "projectRoom").store;
-  const projectBotMembershipStore = (0, import_core50.getStoreLattice)("default", "projectBotMembership").store;
-  const projectRoomMessageStore = (0, import_core50.getStoreLattice)("default", "projectRoomMessage").store;
-  const projectRoomReadStateStore = (0, import_core50.getStoreLattice)("default", "projectRoomReadState").store;
-  const userPushSubscriptionStore = (0, import_core50.getStoreLattice)("default", "userPushSubscription").store;
-  const threadStore = (0, import_core50.getStoreLattice)("default", "thread").store;
-  const taskStore = (0, import_core50.getStoreLattice)("default", "task").store;
-  const taskWorkItemStore = (0, import_core50.getStoreLattice)("default", "taskWorkItem").store;
+  const webAppStore = (0, import_core51.getStoreLattice)("default", "agentWebApp").store;
+  const assistantStore = (0, import_core51.getStoreLattice)("default", "assistant").store;
+  const projectStore = (0, import_core51.getStoreLattice)("default", "project").store;
+  const projectMembershipStore = (0, import_core51.getStoreLattice)("default", "projectMembership").store;
+  const userTenantLinkStore = (0, import_core51.getStoreLattice)("default", "userTenantLink").store;
+  const projectRoomStore = (0, import_core51.getStoreLattice)("default", "projectRoom").store;
+  const projectBotMembershipStore = (0, import_core51.getStoreLattice)("default", "projectBotMembership").store;
+  const projectRoomMessageStore = (0, import_core51.getStoreLattice)("default", "projectRoomMessage").store;
+  const projectRoomReadStateStore = (0, import_core51.getStoreLattice)("default", "projectRoomReadState").store;
+  const userPushSubscriptionStore = (0, import_core51.getStoreLattice)("default", "userPushSubscription").store;
+  const threadStore = (0, import_core51.getStoreLattice)("default", "thread").store;
+  const taskStore = (0, import_core51.getStoreLattice)("default", "task").store;
+  const taskWorkItemStore = (0, import_core51.getStoreLattice)("default", "taskWorkItem").store;
   const projectTaskEnabled = options.projectTaskEnabled ?? process.env.AXIOM_PROJECT_TASK_EXECUTION_ENABLED !== "false";
   const accessService = new ProjectAccessService({ projectStore, membershipStore: projectMembershipStore, userTenantLinkStore });
   const realtimeMode = resolveProjectRoomRealtimeMode();
@@ -25970,7 +27099,7 @@ var registerLatticeRoutes = (app2, channelDeps, options = {}) => {
     updateAssistant: assistantStore.updateAssistant.bind(assistantStore)
   });
   const resolveCoordinatorMentionName = async (tenantId) => {
-    const tenant2 = await (0, import_core50.getStoreLattice)("default", "tenant").store.getTenantById(tenantId);
+    const tenant2 = await (0, import_core51.getStoreLattice)("default", "tenant").store.getTenantById(tenantId);
     const value = tenant2?.metadata?.coordinatorMentionName;
     return typeof value === "string" && value.length > 0 ? value : void 0;
   };
@@ -25997,7 +27126,7 @@ var registerLatticeRoutes = (app2, channelDeps, options = {}) => {
       return membership !== null && membership.projectId === projectId ? membership : null;
     },
     getThreadStatus: async ({ tenantId, assistantId, threadId, workspaceId, projectId }) => {
-      const agent = import_core50.agentInstanceManager.getAgent({
+      const agent = import_core51.agentInstanceManager.getAgent({
         tenant_id: tenantId,
         assistant_id: assistantId,
         thread_id: threadId,
@@ -26006,9 +27135,9 @@ var registerLatticeRoutes = (app2, channelDeps, options = {}) => {
       });
       return String(await agent.getRunStatus());
     },
-    dispatcher: (0, import_core50.createTrustedAgentMessageDispatcher)((scope) => import_core50.agentInstanceManager.getAgent(scope))
+    dispatcher: (0, import_core51.createTrustedAgentMessageDispatcher)((scope) => import_core51.agentInstanceManager.getAgent(scope))
   });
-  const membershipService = new ProjectMembershipService({ membershipStore: projectMembershipStore, userTenantLinkStore, accessService, projectMutationMutex: import_core50.projectMutationMutex, roomStore: projectRoomStore, realtime, onRealtimeFailure: realtime && channelDeps?.warn ? ({ code, membershipId }) => channelDeps.warn?.("project-room:membership-realtime-failed", { code, membershipId }) : void 0 });
+  const membershipService = new ProjectMembershipService({ membershipStore: projectMembershipStore, userTenantLinkStore, accessService, projectMutationMutex: import_core51.projectMutationMutex, roomStore: projectRoomStore, realtime, onRealtimeFailure: realtime && channelDeps?.warn ? ({ code, membershipId }) => channelDeps.warn?.("project-room:membership-realtime-failed", { code, membershipId }) : void 0 });
   const rosterService = new ProjectRosterService({
     accessService,
     roomService,
@@ -26019,7 +27148,7 @@ var registerLatticeRoutes = (app2, channelDeps, options = {}) => {
     assistantStore,
     taskStore,
     bindingLifecycle,
-    projectMutationMutex: import_core50.projectMutationMutex,
+    projectMutationMutex: import_core51.projectMutationMutex,
     realtime,
     onRealtimeFailure: realtime && channelDeps?.warn ? ({ code, membershipId }) => channelDeps.warn?.("project-room:roster-realtime-failed", { code, membershipId }) : void 0
   });
@@ -26074,10 +27203,10 @@ var registerLatticeRoutes = (app2, channelDeps, options = {}) => {
     });
   }
   if (projectTaskComposition) app2.addHook("onClose", async () => projectTaskComposition.lease.release());
-  const taskThreadService = projectTaskComposition?.lease.runtime.threads ?? new ProjectTaskThreadService({ threads: threadStore, idFactory: import_node_crypto25.randomUUID });
-  const taskLifecycle = projectTaskComposition?.lease.runtime.lifecycle ?? (0, import_core50.createTaskLifecycleService)({ taskStore, workItemStore: taskWorkItemStore });
-  const reassignmentAuthorizer = (0, import_core50.createProjectTaskReassignmentAuthorizer)(
-    new import_core50.ProjectTaskOwnerPolicy(projectBotMembershipStore),
+  const taskThreadService = projectTaskComposition?.lease.runtime.threads ?? new ProjectTaskThreadService({ threads: threadStore, idFactory: import_node_crypto26.randomUUID });
+  const taskLifecycle = projectTaskComposition?.lease.runtime.lifecycle ?? (0, import_core51.createTaskLifecycleService)({ taskStore, workItemStore: taskWorkItemStore });
+  const reassignmentAuthorizer = (0, import_core51.createProjectTaskReassignmentAuthorizer)(
+    new import_core51.ProjectTaskOwnerPolicy(projectBotMembershipStore),
     (input) => validateReassignmentThread(threadStore, input)
   );
   const taskCommandService = new TaskCommandService({
@@ -26086,7 +27215,7 @@ var registerLatticeRoutes = (app2, channelDeps, options = {}) => {
     lifecycle: taskLifecycle,
     execution: projectTaskComposition?.lease.runtime.execution,
     threads: taskThreadService,
-    agents: { getAgent: (params) => import_core50.agentInstanceManager.getAgent(params) },
+    agents: { getAgent: (params) => import_core51.agentInstanceManager.getAgent(params) },
     taskScope: (task) => resolveCommandTaskScope(task, {
       rooms: projectRoomStore,
       bots: projectBotMembershipStore,
@@ -26124,7 +27253,7 @@ var registerLatticeRoutes = (app2, channelDeps, options = {}) => {
     readStateService,
     interruptService: roomInterruptService,
     userDirectory: {
-      getUserById: (id3) => (0, import_core50.getStoreLattice)("default", "user").store.getUserById(id3).then((u) => u ? { name: u.name } : null)
+      getUserById: (id3) => (0, import_core51.getStoreLattice)("default", "user").store.getUserById(id3).then((u) => u ? { name: u.name } : null)
     }
   });
   registerProjectRosterRoutes(app2, { service: rosterService });
@@ -26135,7 +27264,7 @@ var registerLatticeRoutes = (app2, channelDeps, options = {}) => {
       createProject: projectStore.createProject.bind(projectStore)
     },
     workspaceStore: {
-      getWorkspaceById: (tenantId, id3) => (0, import_core50.getStoreLattice)("default", "workspace").store.getWorkspaceById(tenantId, id3)
+      getWorkspaceById: (tenantId, id3) => (0, import_core51.getStoreLattice)("default", "workspace").store.getWorkspaceById(tenantId, id3)
     },
     membershipStore: {
       list: projectMembershipStore.list.bind(projectMembershipStore),
@@ -26158,7 +27287,7 @@ var registerLatticeRoutes = (app2, channelDeps, options = {}) => {
       getUsersByTenant: userTenantLinkStore.getUsersByTenant.bind(userTenantLinkStore)
     },
     userStore: {
-      getUserById: (id3) => (0, import_core50.getStoreLattice)("default", "user").store.getUserById(id3).then((u) => u ? { id: u.id, name: u.name, email: u.email } : null)
+      getUserById: (id3) => (0, import_core51.getStoreLattice)("default", "user").store.getUserById(id3).then((u) => u ? { id: u.id, name: u.name, email: u.email } : null)
     },
     assistantStore: {
       getAssistantById: assistantStore.getAssistantById.bind(assistantStore),
@@ -26180,18 +27309,28 @@ var registerLatticeRoutes = (app2, channelDeps, options = {}) => {
     }
   });
   registerCapabilityBundleRoutes(app2, new CapabilityBundleController({
-    bundleStore: (0, import_core50.getStoreLattice)("default", "capabilityBundle").store,
+    bundleStore: (0, import_core51.getStoreLattice)("default", "capabilityBundle").store,
     projectStore
   }, { authRequired: process.env.AUTH_REQUIRED === "true" }));
+  registerModelProviderRoutes(app2, new ModelProviderController({
+    providerStore: (0, import_core51.getStoreLattice)("default", "modelProvider").store,
+    userTenantLinkStore,
+    registry: {
+      register: (tenantId, modelKey2, config) => import_core51.modelLatticeManager.registerLatticeWithTenant(tenantId, modelKey2, config),
+      has: (tenantId, modelKey2) => import_core51.modelLatticeManager.hasLatticeWithTenant(tenantId, modelKey2),
+      remove: (tenantId, modelKey2) => import_core51.modelLatticeManager.removeLatticeWithTenant(tenantId, modelKey2),
+      listRegistered: (tenantId) => import_core51.modelLatticeManager.getLatticeKeysByTenant(tenantId)
+    }
+  }, { authRequired: process.env.AUTH_REQUIRED === "true" }));
   registerAgentWebAppRoutes(app2, {
     service: new AgentWebAppService({
       webAppStore,
       assistantStore,
       projectStore,
-      modelRegistry: { has: (key) => import_core50.modelLatticeManager.hasLattice(key) },
+      modelRegistry: { has: (key) => import_core51.modelLatticeManager.hasLattice(key) },
       configuredAgentResolver: createConfiguredAgentResolver({
-        hydrate: (tenantId) => import_core50.agentLatticeManager.initializeStoredAssistantsForTenant(tenantId),
-        has: (tenantId, assistantId) => import_core50.agentLatticeManager.hasAgentLatticeWithTenant(tenantId, assistantId)
+        hydrate: (tenantId) => import_core51.agentLatticeManager.initializeStoredAssistantsForTenant(tenantId),
+        has: (tenantId, assistantId) => import_core51.agentLatticeManager.hasAgentLatticeWithTenant(tenantId, assistantId)
       })
     })
   });
@@ -26228,28 +27367,28 @@ var registerLatticeRoutes = (app2, channelDeps, options = {}) => {
       },
       tasks: taskStore,
       workItems: taskWorkItemStore,
-      projectMutationMutex: import_core50.projectMutationMutex,
+      projectMutationMutex: import_core51.projectMutationMutex,
       ...projectTaskComposition ? { commands: taskCommandService } : {}
     }),
     service: new AgentWebAppRuntimeService({
       webAppStore,
-      threadStore: (0, import_core50.getStoreLattice)("default", "thread").store,
+      threadStore: (0, import_core51.getStoreLattice)("default", "thread").store,
       projectStore,
       assistantResolver: {
         resolve: async (tenantId, assistantId) => {
           const stored = await assistantStore.getAssistantById(tenantId, assistantId);
           if (stored) return { id: stored.id, name: stored.name, description: stored.description };
-          await import_core50.agentLatticeManager.initializeStoredAssistantsForTenant(tenantId);
-          const config = import_core50.agentLatticeManager.getAgentConfigWithTenant(tenantId, assistantId);
+          await import_core51.agentLatticeManager.initializeStoredAssistantsForTenant(tenantId);
+          const config = import_core51.agentLatticeManager.getAgentConfigWithTenant(tenantId, assistantId);
           return config ? { id: assistantId, name: config.name, description: config.description } : null;
         }
       },
       modelRegistry: {
-        has: (key) => import_core50.modelLatticeManager.hasLattice(key),
+        has: (key) => import_core51.modelLatticeManager.hasLattice(key),
         label: (key) => key
       },
       messageReader: {
-        getCurrentMessages: ({ tenantId, assistantId, threadId, workspaceId, projectId }) => import_core50.agentInstanceManager.getAgent({
+        getCurrentMessages: ({ tenantId, assistantId, threadId, workspaceId, projectId }) => import_core51.agentInstanceManager.getAgent({
           tenant_id: tenantId,
           assistant_id: assistantId,
           thread_id: threadId,
@@ -26258,7 +27397,7 @@ var registerLatticeRoutes = (app2, channelDeps, options = {}) => {
         }).getCurrentMessages()
       },
       agentResolver: {
-        getAgent: ({ tenantId, assistantId, threadId, workspaceId, projectId }) => import_core50.agentInstanceManager.getAgent({
+        getAgent: ({ tenantId, assistantId, threadId, workspaceId, projectId }) => import_core51.agentInstanceManager.getAgent({
           tenant_id: tenantId,
           assistant_id: assistantId,
           thread_id: threadId,
@@ -26276,8 +27415,8 @@ var registerLatticeRoutes = (app2, channelDeps, options = {}) => {
         if (webApp.tenantId !== preview.tenantId) return false;
         const assistant = await assistantStore.getAssistantById(preview.tenantId, webApp.assistantId);
         if (assistant) return !assistant.ownerUserId || assistant.ownerUserId === preview.userId;
-        await import_core50.agentLatticeManager.initializeStoredAssistantsForTenant(preview.tenantId);
-        return import_core50.agentLatticeManager.hasAgentLatticeWithTenant(preview.tenantId, webApp.assistantId);
+        await import_core51.agentLatticeManager.initializeStoredAssistantsForTenant(preview.tenantId);
+        return import_core51.agentLatticeManager.hasAgentLatticeWithTenant(preview.tenantId, webApp.assistantId);
       }
     })
   });
@@ -26334,14 +27473,14 @@ var registerLatticeRoutes = (app2, channelDeps, options = {}) => {
   app2.post("/api/personal-assistant", createPersonalAssistant);
   app2.get("/api/personal-assistant", getPersonalAssistant);
   app2.delete("/api/personal-assistant", deletePersonalAssistant);
-  import_core50.executionAuthorityRegistry.register({
+  import_core51.executionAuthorityRegistry.register({
     id: "project-lifecycle",
     matches: isProjectLifecycleTask,
     code: "PROJECT_TASK_EXECUTION_MANAGED",
     message: "Project tasks are executed by the durable Project queue runtime",
     onManagedStart: async (task, options2) => {
       if (!projectTaskComposition && options2?.agentId && options2.agentId !== task.ownerId) {
-        throw new import_core50.ManagedTaskStartError(
+        throw new import_core51.ManagedTaskStartError(
           "PROJECT_TASK_RUNTIME_UNAVAILABLE",
           "Project task ownership transfer requires the Project task runtime.",
           { hint: "Project task execution is disabled; enable the Project task runtime or dispatch to the current owner." }
@@ -26354,11 +27493,11 @@ var registerLatticeRoutes = (app2, channelDeps, options = {}) => {
         threads: taskThreadService,
         reassignmentAuthorizer,
         lifecycle: taskLifecycle,
-        mutex: import_core50.projectMutationMutex
+        mutex: import_core51.projectMutationMutex
       }) : void 0;
       const admitted = transferred ?? task;
       if (!admitted.workspaceId || !admitted.projectId) return;
-      void import_core50.projectTaskAdmissionNotifier.publish({
+      void import_core51.projectTaskAdmissionNotifier.publish({
         tenantId: admitted.tenantId,
         workspaceId: admitted.workspaceId,
         projectId: admitted.projectId,
@@ -26372,7 +27511,7 @@ var registerLatticeRoutes = (app2, channelDeps, options = {}) => {
     access: accessService,
     tasks: taskStore,
     workItems: taskWorkItemStore,
-    projectMutationMutex: import_core50.projectMutationMutex,
+    projectMutationMutex: import_core51.projectMutationMutex,
     commands: taskCommandService,
     readableProjects: async ({ tenantId, userId, workspaceId }) => {
       const projects = await projectStore.getProjectsByWorkspace(tenantId, workspaceId);
@@ -26640,9 +27779,9 @@ var registerLatticeRoutes = (app2, channelDeps, options = {}) => {
 function tryCreateProjectTaskRuntime(input) {
   let projectWorkItems;
   try {
-    projectWorkItems = (0, import_protocols29.requireProjectTaskWorkItemStore)(input.taskWorkItemStore);
+    projectWorkItems = (0, import_protocols30.requireProjectTaskWorkItemStore)(input.taskWorkItemStore);
   } catch (error) {
-    if (error instanceof import_protocols29.ProjectTaskStoreUnsupportedError) {
+    if (error instanceof import_protocols30.ProjectTaskStoreUnsupportedError) {
       input.log?.warn("project-task:runtime-unavailable", {
         code: error.code,
         missingMethods: error.missingMethods
@@ -26654,9 +27793,9 @@ function tryCreateProjectTaskRuntime(input) {
   let stores;
   try {
     stores = {
-      tenants: (0, import_core50.getStoreLattice)("default", "tenant").store,
-      workspaces: (0, import_core50.getStoreLattice)("default", "workspace").store,
-      queue: (0, import_core50.getStoreLattice)("default", "threadMessageQueue").store
+      tenants: (0, import_core51.getStoreLattice)("default", "tenant").store,
+      workspaces: (0, import_core51.getStoreLattice)("default", "workspace").store,
+      queue: (0, import_core51.getStoreLattice)("default", "threadMessageQueue").store
     };
     const missing = missingRuntimeMethod(input, stores);
     if (missing) return { reason: missing };
@@ -26687,8 +27826,8 @@ function tryCreateProjectTaskRuntime(input) {
 function createRuntime(input, stores, log2) {
   const controller = new AbortController();
   const mutex = new ProjectTaskExecutionMutex();
-  const threads = new ProjectTaskThreadService({ threads: input.threadStore, idFactory: import_node_crypto25.randomUUID });
-  const lifecycle = (0, import_core50.createTaskLifecycleService)({ taskStore: input.taskStore, workItemStore: input.taskWorkItemStore });
+  const threads = new ProjectTaskThreadService({ threads: input.threadStore, idFactory: import_node_crypto26.randomUUID });
+  const lifecycle = (0, import_core51.createTaskLifecycleService)({ taskStore: input.taskStore, workItemStore: input.taskWorkItemStore });
   const projection = new RoomProjectionService({
     messages: input.projectRoomMessageStore,
     events: input.taskWorkItemStore,
@@ -26696,9 +27835,9 @@ function createRuntime(input, stores, log2) {
     warnings: input.taskWorkItemStore,
     log: log2,
     realtime: input.realtime,
-    idFactory: import_node_crypto25.randomUUID
+    idFactory: import_node_crypto26.randomUUID
   });
-  const agentFor = (task, thread) => import_core50.agentInstanceManager.getAgent({
+  const agentFor = (task, thread) => import_core51.agentInstanceManager.getAgent({
     tenant_id: task.tenantId,
     assistant_id: task.ownerId,
     thread_id: thread.id,
@@ -26712,7 +27851,7 @@ function createRuntime(input, stores, log2) {
     bots: input.projectBotMembershipStore,
     threads,
     lifecycle,
-    dispatcher: (0, import_core50.createTrustedAgentMessageDispatcher)((scope) => import_core50.agentInstanceManager.getAgent(scope)),
+    dispatcher: (0, import_core51.createTrustedAgentMessageDispatcher)((scope) => import_core51.agentInstanceManager.getAgent(scope)),
     queue: stores.queue,
     agentFor
   }, {
@@ -26739,8 +27878,8 @@ function createRuntime(input, stores, log2) {
   const taskLifecycleListener = ((event) => {
     void observer.listener(event);
   });
-  const unsubscribe = import_core50.taskLifecycleNotifier.subscribe(taskLifecycleListener);
-  const unsubscribeAdmission = import_core50.projectTaskAdmissionNotifier.subscribe((event, signal) => {
+  const unsubscribe = import_core51.taskLifecycleNotifier.subscribe(taskLifecycleListener);
+  const unsubscribeAdmission = import_core51.projectTaskAdmissionNotifier.subscribe((event, signal) => {
     observer.admit(event, signal);
   });
   let reconciliationWork;
@@ -26887,12 +28026,12 @@ function registerResourceRoutes(app2, controller) {
 }
 
 // src/export_registrations/index.ts
-var import_core61 = require("@axiom-lattice/core");
+var import_core62 = require("@axiom-lattice/core");
 
 // src/export_registrations/skill.registration.ts
-var import_core51 = require("@axiom-lattice/core");
+var import_core52 = require("@axiom-lattice/core");
 function getStore(context) {
-  return new import_core51.SandboxSkillStore({
+  return new import_core52.SandboxSkillStore({
     workspaceId: context?.workspaceId,
     projectId: context?.projectId
   });
@@ -26910,7 +28049,7 @@ var skillRegistration = {
   async listForExport(tenantId, context) {
     const store2 = getStore(context);
     const skills = await store2.getAllSkills(tenantId, toStoreContext(context));
-    return skills.filter((s) => !(0, import_core51.isBuiltInSkill)(s.id)).map((s) => ({
+    return skills.filter((s) => !(0, import_core52.isBuiltInSkill)(s.id)).map((s) => ({
       _exportId: "",
       data: {
         id: s.id,
@@ -26975,7 +28114,7 @@ var skillRegistration = {
     const insertions = [];
     for (const entity of entities) {
       const id3 = entity.data.id;
-      if ((0, import_core51.isBuiltInSkill)(id3)) continue;
+      if ((0, import_core52.isBuiltInSkill)(id3)) continue;
       if (existingIds.has(id3)) {
         conflicts.push({
           _exportId: entity._exportId,
@@ -27034,9 +28173,9 @@ var skillRegistration = {
 };
 
 // src/export_registrations/agent.registration.ts
-var import_core52 = require("@axiom-lattice/core");
+var import_core53 = require("@axiom-lattice/core");
 function getStore2() {
-  return (0, import_core52.getStoreLattice)("default", "assistant").store;
+  return (0, import_core53.getStoreLattice)("default", "assistant").store;
 }
 var agentRegistration = {
   entityType: "agent",
@@ -27116,9 +28255,9 @@ var agentRegistration = {
 };
 
 // src/export_registrations/database-config.registration.ts
-var import_core53 = require("@axiom-lattice/core");
+var import_core54 = require("@axiom-lattice/core");
 function getStore3() {
-  return (0, import_core53.getStoreLattice)("default", "database").store;
+  return (0, import_core54.getStoreLattice)("default", "database").store;
 }
 var databaseConfigRegistration = {
   entityType: "database_config",
@@ -27198,9 +28337,9 @@ var databaseConfigRegistration = {
 };
 
 // src/export_registrations/metrics-config.registration.ts
-var import_core54 = require("@axiom-lattice/core");
+var import_core55 = require("@axiom-lattice/core");
 function getStore4() {
-  return (0, import_core54.getStoreLattice)("default", "metrics").store;
+  return (0, import_core55.getStoreLattice)("default", "metrics").store;
 }
 var metricsConfigRegistration = {
   entityType: "metrics_config",
@@ -27280,9 +28419,9 @@ var metricsConfigRegistration = {
 };
 
 // src/export_registrations/mcp-config.registration.ts
-var import_core55 = require("@axiom-lattice/core");
+var import_core56 = require("@axiom-lattice/core");
 function getStore5() {
-  return (0, import_core55.getStoreLattice)("default", "mcp").store;
+  return (0, import_core56.getStoreLattice)("default", "mcp").store;
 }
 var mcpConfigRegistration = {
   entityType: "mcp_config",
@@ -27365,9 +28504,9 @@ var mcpConfigRegistration = {
 };
 
 // src/export_registrations/connection.registration.ts
-var import_core56 = require("@axiom-lattice/core");
+var import_core57 = require("@axiom-lattice/core");
 function getStore6() {
-  return (0, import_core56.getStoreLattice)("default", "connection").store;
+  return (0, import_core57.getStoreLattice)("default", "connection").store;
 }
 async function listAllConnections(tenantId) {
   const store2 = getStore6();
@@ -27449,9 +28588,9 @@ var connectionRegistration = {
 };
 
 // src/export_registrations/collection.registration.ts
-var import_core57 = require("@axiom-lattice/core");
+var import_core58 = require("@axiom-lattice/core");
 function getStore7() {
-  return (0, import_core57.getStoreLattice)("default", "collection").store;
+  return (0, import_core58.getStoreLattice)("default", "collection").store;
 }
 var collectionRegistration = {
   entityType: "collection",
@@ -27522,7 +28661,7 @@ var collectionRegistration = {
 };
 
 // src/export_registrations/channel-installation.registration.ts
-var import_core58 = require("@axiom-lattice/core");
+var import_core59 = require("@axiom-lattice/core");
 var import_crypto11 = require("crypto");
 var UUID_PATTERN2 = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
 var PUBLIC_CHANNELS = /* @__PURE__ */ new Set(["lark", "email", "slack", "wechat"]);
@@ -27556,7 +28695,7 @@ function validateImportData(data) {
   };
 }
 function getStore8() {
-  return (0, import_core58.getStoreLattice)("default", "channelInstallation").store;
+  return (0, import_core59.getStoreLattice)("default", "channelInstallation").store;
 }
 function getOverwriteError(tenantId, incomingChannel, existing) {
   if (!existing) return "Channel installation overwrite target must exist";
@@ -27690,9 +28829,9 @@ var channelInstallationRegistration = {
 };
 
 // src/export_registrations/menu.registration.ts
-var import_core59 = require("@axiom-lattice/core");
+var import_core60 = require("@axiom-lattice/core");
 function getStore9() {
-  return (0, import_core59.getStoreLattice)("default", "menu").store;
+  return (0, import_core60.getStoreLattice)("default", "menu").store;
 }
 var menuRegistration = {
   entityType: "menu",
@@ -27770,9 +28909,9 @@ var menuRegistration = {
 };
 
 // src/export_registrations/eval.registration.ts
-var import_core60 = require("@axiom-lattice/core");
+var import_core61 = require("@axiom-lattice/core");
 function getStore10() {
-  return (0, import_core60.getStoreLattice)("default", "eval").store;
+  return (0, import_core61.getStoreLattice)("default", "eval").store;
 }
 var evalRegistration = {
   entityType: "eval",
@@ -28098,7 +29237,7 @@ var evalRegistration = {
 
 // src/export_registrations/index.ts
 function registerAllBuiltinEntities() {
-  const registry = import_core61.ExportableEntityRegistry.getInstance();
+  const registry = import_core62.ExportableEntityRegistry.getInstance();
   registry.register(skillRegistration);
   registry.register(agentRegistration);
   registry.register(databaseConfigRegistration);
@@ -28197,13 +29336,13 @@ function createRateLimitMiddleware(maxRequests = 10, windowMs = 60 * 1e3, maxEnt
 
 // src/router/middlewares/auditLogger.ts
 init_Logger();
-var logger4 = new Logger({ serviceName: "lattice/gateway/audit" });
+var logger5 = new Logger({ serviceName: "lattice/gateway/audit" });
 function createAuditLoggerMiddleware() {
   return async (ctx, next) => {
     const start2 = Date.now();
     try {
       await next();
-      logger4.info("message routed", {
+      logger5.info("message routed", {
         event: "message:routed",
         channel: ctx.inboundMessage.channel,
         senderId: ctx.inboundMessage.sender.id,
@@ -28213,7 +29352,7 @@ function createAuditLoggerMiddleware() {
         status: "success"
       });
     } catch (error) {
-      logger4.error(
+      logger5.error(
         error instanceof Error ? error.message : String(error),
         {
           event: "message:error",
@@ -28229,7 +29368,7 @@ function createAuditLoggerMiddleware() {
 }
 
 // src/index.ts
-var import_core80 = require("@axiom-lattice/core");
+var import_core81 = require("@axiom-lattice/core");
 
 // src/swagger.ts
 var import_swagger = __toESM(require("@fastify/swagger"));
@@ -28294,7 +29433,8 @@ var configureSwagger = async (app2, customSwaggerConfig, customSwaggerUiConfig)
 };
 
 // src/services/agent_task_consumer.ts
-var import_core62 = require("@axiom-lattice/core");
+var import_node_crypto27 = require("crypto");
+var import_core63 = require("@axiom-lattice/core");
 var handleAgentTask = async (taskRequest, retryCount = 0) => {
   const {
     assistant_id,
@@ -28312,51 +29452,97 @@ var handleAgentTask = async (taskRequest, retryCount = 0) => {
     console.log(
       `\u5F00\u59CB\u5904\u7406\u4EFB\u52A1 [assistant_id: ${assistant_id}, thread_id: ${thread_id}]`
     );
-    const agent = import_core62.agentInstanceManager.getAgent({ assistant_id, thread_id, tenant_id, workspace_id: runConfig?.workspaceId, project_id: runConfig?.projectId, custom_run_config: runConfig });
-    await agent.addMessage({ input, command, custom_run_config: runConfig }, import_core62.QueueMode.STEER);
+    const agent = import_core63.agentInstanceManager.getAgent({ assistant_id, thread_id, tenant_id, workspace_id: runConfig?.workspaceId, project_id: runConfig?.projectId, custom_run_config: runConfig });
     if (callback_event) {
-      agent.subscribeOnce("message:completed", (evt) => {
-        import_core62.eventBus.publish(callback_event, {
-          success: true,
-          state: evt.state
-        });
-        if (main_thread_id && main_tenant_id) {
-          try {
-            const mainAgent = import_core62.agentInstanceManager.getAgent({
-              assistant_id: main_assistant_id ?? assistant_id,
-              thread_id: main_thread_id,
-              tenant_id: main_tenant_id,
-              workspace_id: runConfig?.workspaceId,
-              project_id: runConfig?.projectId
-            });
-            if (mainAgent) {
-              const messages = evt.state?.values?.messages;
-              const lastAIMessage = messages?.filter((m) => m.type === "ai" || m.getType?.() === "ai").pop();
-              const summary = lastAIMessage?.content?.substring(0, 500) ?? "(no output)";
-              mainAgent.addMessage(
-                {
-                  input: {
-                    message: `[Async task completed]
+      const callbackEvent = callback_event;
+      const messageId = typeof input?.id === "string" && input.id !== "" ? input.id : (0, import_node_crypto27.randomUUID)();
+      let settled = false;
+      const subscriptions = [];
+      const dispose = () => {
+        for (const [eventName, handler] of subscriptions) {
+          agent.unsubscribe(eventName, handler);
+        }
+      };
+      const settle = (publish) => {
+        if (settled) return;
+        settled = true;
+        dispose();
+        publish();
+      };
+      const belongsToMessage = (evt) => evt?.messageId === messageId;
+      const onCompleted = (evt) => {
+        if (!belongsToMessage(evt)) return;
+        settle(() => {
+          import_core63.eventBus.publish(callbackEvent, {
+            success: true,
+            state: evt.state
+          });
+          if (main_thread_id && main_tenant_id) {
+            try {
+              const mainAgent = import_core63.agentInstanceManager.getAgent({
+                assistant_id: main_assistant_id ?? assistant_id,
+                thread_id: main_thread_id,
+                tenant_id: main_tenant_id,
+                workspace_id: runConfig?.workspaceId,
+                project_id: runConfig?.projectId
+              });
+              if (mainAgent) {
+                const messages = evt.state?.values?.messages;
+                const lastAIMessage = messages?.filter((m) => m.type === "ai" || m.getType?.() === "ai").pop();
+                const summary = lastAIMessage?.content?.substring(0, 500) ?? "(no output)";
+                mainAgent.addMessage(
+                  {
+                    input: {
+                      message: `[Async task completed]
 task_id: ${thread_id}
 ${summary}`
+                    }
                   }
-                }
-              ).catch((err) => {
-                console.error("Failed to notify main thread:", err);
-              });
-              mainAgent.updateAsyncTaskStatus(thread_id, "completed");
+                ).catch((err) => {
+                  console.error("Failed to notify main thread:", err);
+                });
+                mainAgent.updateAsyncTaskStatus(thread_id, "completed");
+              }
+            } catch (err) {
+              console.error("Failed to notify main thread:", err);
             }
-          } catch (err) {
-            console.error("Failed to notify main thread:", err);
           }
-        }
-      });
-      agent.subscribeOnce("message:interrupted", (evt) => {
-        import_core62.eventBus.publish(callback_event, {
-          success: true,
-          state: evt.state
         });
-      });
+      };
+      const onInterrupted = (evt) => {
+        if (!belongsToMessage(evt)) return;
+        settle(() => {
+          import_core63.eventBus.publish(callbackEvent, {
+            success: true,
+            state: evt.state
+          });
+        });
+      };
+      const onFailed = (evt) => {
+        if (!belongsToMessage(evt)) return;
+        settle(() => {
+          import_core63.eventBus.publish(callbackEvent, {
+            success: false,
+            error: evt?.error instanceof Error ? evt.error.message : typeof evt?.error === "string" ? evt.error : "Agent execution failed"
+          });
+        });
+      };
+      subscriptions.push(
+        ["message:completed", onCompleted],
+        ["message:interrupted", onInterrupted],
+        ["message:failed", onFailed]
+      );
+      agent.subscribe("message:completed", onCompleted);
+      agent.subscribe("message:interrupted", onInterrupted);
+      agent.subscribe("message:failed", onFailed);
+      try {
+        await agent.addMessage({ input: { ...input, id: messageId }, command, custom_run_config: runConfig }, import_core63.QueueMode.STEER);
+      } catch (error) {
+        dispose();
+        throw error;
+      }
+    } else {
+      await agent.addMessage({ input, command, custom_run_config: runConfig }, import_core63.QueueMode.STEER);
     }
     return true;
   } catch (error) {
@@ -28375,7 +29561,7 @@ ${summary}`
       return handleAgentTask(taskRequest, nextRetryCount);
     }
     if (callback_event) {
-      import_core62.eventBus.publish(callback_event, {
+      import_core63.eventBus.publish(callback_event, {
         success: false,
         error: error instanceof Error ? error.message : String(error)
       });
@@ -28412,7 +29598,7 @@ var _AgentTaskConsumer = class _AgentTaskConsumer {
    * 初始化事件监听和队列轮询
    */
   initialize() {
-    import_core62.eventBus.subscribe(import_core62.AGENT_TASK_EVENT, this.trigger_agent_task.bind(this));
+    import_core63.eventBus.subscribe(import_core63.AGENT_TASK_EVENT, this.trigger_agent_task.bind(this));
     this.startPollingQueue();
     console.log("Agent\u4EFB\u52A1\u6D88\u8D39\u8005\u5DF2\u542F\u52A8\u5E76\u76D1\u542C\u4EFB\u52A1\u4E8B\u4EF6\u548C\u961F\u5217");
   }
@@ -28531,7 +29717,7 @@ var _AgentTaskConsumer = class _AgentTaskConsumer {
     handleAgentTask(taskRequest).catch((error) => {
       console.error("\u5904\u7406Agent\u4EFB\u52A1\u65F6\u53D1\u751F\u672A\u6355\u83B7\u7684\u9519\u8BEF:", error);
       if (taskRequest.callback_event) {
-        import_core62.eventBus.publish(taskRequest.callback_event, {
+        import_core63.eventBus.publish(taskRequest.callback_event, {
           success: false,
           error: error instanceof Error ? error.message : String(error)
         });
@@ -28546,14 +29732,14 @@ _AgentTaskConsumer.agent_run_endpoint = "http://localhost:4001/api/runs";
 var AgentTaskConsumer = _AgentTaskConsumer;
 
 // src/index.ts
-var import_core81 = require("@axiom-lattice/core");
+var import_core82 = require("@axiom-lattice/core");
 
 // src/channels/ChannelInfrastructure.ts
-var import_core64 = require("@axiom-lattice/core");
+var import_core65 = require("@axiom-lattice/core");
 
 // src/router/MessageRouter.ts
-var import_core63 = require("@axiom-lattice/core");
-var import_protocols30 = require("@axiom-lattice/protocols");
+var import_core64 = require("@axiom-lattice/core");
+var import_protocols31 = require("@axiom-lattice/protocols");
 var import_crypto12 = require("crypto");
 var BindingNotFoundError = class extends Error {
   constructor(message) {
@@ -28588,10 +29774,10 @@ function clarifyText(clarify) {
   return ["```clarify", JSON.stringify({ questions: clarify.questions }), "```"].join("\n");
 }
 function exactDataValues(value, required, optional = []) {
-  return (0, import_protocols30.snapshotExactRecord)(value, required, optional);
+  return (0, import_protocols31.snapshotExactRecord)(value, required, optional);
 }
 function uniqueNonemptyStrings(value) {
-  const snapshot = (0, import_protocols30.snapshotExactArray)(value);
+  const snapshot = (0, import_protocols31.snapshotExactArray)(value);
   if (!snapshot || snapshot.length === 0 || snapshot.some((entry) => typeof entry !== "string" || entry.length === 0)) return void 0;
   const values = snapshot;
   return new Set(values).size === values.length ? values : void 0;
@@ -28838,7 +30024,7 @@ var MessageRouter = class {
             channel: message.channel,
             adapterChannel: adapter.channel
           }, "Thread resolved by adapter strategy");
-          const threadStore = (0, import_core63.getStoreLattice)("default", "thread").store;
+          const threadStore = (0, import_core64.getStoreLattice)("default", "thread").store;
           try {
             await threadStore.createThread(
               tenantId,
@@ -28875,7 +30061,7 @@ var MessageRouter = class {
           }
         }
         if (!threadId) {
-          const threadStore = (0, import_core63.getStoreLattice)("default", "thread").store;
+          const threadStore = (0, import_core64.getStoreLattice)("default", "thread").store;
           const newThreadId = (0, import_crypto12.randomUUID)();
           console.log({
             event: "dispatch:thread:create",
@@ -28915,7 +30101,7 @@ var MessageRouter = class {
           senderId: message.sender.id,
           contentLength: message.content.text.length
         }, "Dispatching to agent");
-        const agent = import_core63.agentInstanceManager.getAgent({
+        const agent = import_core64.agentInstanceManager.getAgent({
           tenant_id: tenantId,
           assistant_id: agentId,
           thread_id: threadId,
@@ -29102,9 +30288,9 @@ var MessageRouter = class {
 };
 
 // src/channels/room/RoomChannelAdapter.ts
-var import_zod15 = require("zod");
-var import_protocols31 = require("@axiom-lattice/protocols");
-var roomConfigSchema = import_zod15.z.object({}).strict();
+var import_zod17 = require("zod");
+var import_protocols32 = require("@axiom-lattice/protocols");
+var roomConfigSchema = import_zod17.z.object({}).strict();
 function createRoomChannelAdapter(writer) {
   return {
     channel: "room",
@@ -29164,7 +30350,7 @@ function exactStrings(value, keys2) {
 function exactValues2(value, required, optional = []) {
   try {
     if (typeof value !== "object" || value === null || Array.isArray(value)) return void 0;
-    return (0, import_protocols31.snapshotExactRecord)(value, required, optional);
+    return (0, import_protocols32.snapshotExactRecord)(value, required, optional);
   } catch {
     return void 0;
   }
@@ -29188,7 +30374,7 @@ function createChannelInfrastructure(deps) {
       onMessageCommitted: deps.onMessageCommitted ?? (deps.realtime ? (message) => deps.realtime?.messageCreated(message) : void 0),
       onCallbackFailure: (event) => deps.warn("project-room:message-commit-callback-failed", event)
     };
-    deps.adapterRegistry.register(createRoomChannelAdapter(new import_core64.RoomAgentMessageService(writerDeps)));
+    deps.adapterRegistry.register(createRoomChannelAdapter(new import_core65.RoomAgentMessageService(writerDeps)));
   } catch (error) {
     deps.warn("Room channel unavailable", { error: error instanceof Error ? error.message : String(error) });
   }
@@ -29209,25 +30395,25 @@ async function prepareProjectTaskRuntime(runtime, log2) {
 }
 
 // src/index.ts
-var import_protocols38 = require("@axiom-lattice/protocols");
+var import_protocols39 = require("@axiom-lattice/protocols");
 process.on("unhandledRejection", (reason, promise) => {
   console.error("\u672A\u5904\u7406\u7684Promise\u62D2\u7EDD:", reason);
 });
 var DEFAULT_LOGGER_CONFIG = {
   name: "default",
   description: "Default logger for lattice-gateway service",
-  type: import_protocols38.LoggerType.PINO,
+  type: import_protocols39.LoggerType.PINO,
   serviceName: "lattice/gateway",
   loggerName: "lattice/gateway"
 };
 var loggerLattice = initializeLogger(DEFAULT_LOGGER_CONFIG);
-var logger6 = loggerLattice.client;
+var logger7 = loggerLattice.client;
 function initializeLogger(config) {
-  if (import_core81.loggerLatticeManager.hasLattice("default")) {
-    import_core81.loggerLatticeManager.removeLattice("default");
+  if (import_core82.loggerLatticeManager.hasLattice("default")) {
+    import_core82.loggerLatticeManager.removeLattice("default");
   }
-  (0, import_core81.registerLoggerLattice)("default", config);
-  return (0, import_core81.getLoggerLattice)("default");
+  (0, import_core82.registerLoggerLattice)("default", config);
+  return (0, import_core82.getLoggerLattice)("default");
 }
 var app = (0, import_fastify.default)({
   logger: false,
@@ -29308,7 +30494,7 @@ app.setErrorHandler((error, request, reply) => {
     "x-request-id": getHeaderValue(request.headers["x-request-id"]),
     "x-user-id": getHeaderValue(request.headers["x-user-id"])
   };
-  logger6.error(
+  logger7.error(
     `\u8BF7\u6C42\u9519\u8BEF: ${request.method} ${request.url} error:${error.message}`,
     {
       ...context,
@@ -29324,7 +30510,7 @@ app.setErrorHandler((error, request, reply) => {
 });
 function getConfiguredSandboxProvider() {
   const sandboxProviderType = process.env.SANDBOX_PROVIDER_TYPE || "microsandbox-remote";
-  return (0, import_core81.createSandboxProvider)({
+  return (0, import_core82.createSandboxProvider)({
     type: sandboxProviderType,
     remoteBaseURL: process.env.SANDBOX_BASE_URL,
     microsandboxServiceBaseURL: process.env.MICROSANDBOX_SERVICE_BASE_URL,
@@ -29340,33 +30526,33 @@ function getConfiguredSandboxProvider() {
 }
 async function restoreMcpConnections() {
   try {
-    const storeLattice = (0, import_core81.getStoreLattice)("default", "mcp");
+    const storeLattice = (0, import_core82.getStoreLattice)("default", "mcp");
     const store2 = storeLattice.store;
     if (!store2) {
-      logger6.info("MCP store not configured, skipping connection restoration");
+      logger7.info("MCP store not configured, skipping connection restoration");
       return;
     }
     const configs = (await store2.getAllConfigsWithoutTenant()).filter(
       (c2) => c2.status === "connected"
     );
     if (configs.length === 0) return;
-    logger6.info(`Restoring ${configs.length} MCP server connections...`);
+    logger7.info(`Restoring ${configs.length} MCP server connections...`);
     for (const config of configs) {
       try {
-        const connection = (0, import_core81.convertToConnection)(config.config);
-        import_core81.mcpManager.registerServer(config.tenantId, config.key, connection, {
+        const connection = (0, import_core82.convertToConnection)(config.config);
+        import_core82.mcpManager.registerServer(config.tenantId, config.key, connection, {
           timeoutMs: config.config.timeout,
           maxAttempts: config.config.retryAttempts,
           selectedTools: config.selectedTools
         });
       } catch (err) {
-        logger6.warn(`Failed to prepare MCP server "${config.tenantId}/${config.key}"`, { error: err });
+        logger7.warn(`Failed to prepare MCP server "${config.tenantId}/${config.key}"`, { error: err });
       }
     }
-    await import_core81.mcpManager.connectAll();
+    await import_core82.mcpManager.connectAll();
     const results = await Promise.allSettled(
       configs.map(
-        (config) => import_core81.mcpManager.registerToolsToToolLattice(
+        (config) => import_core82.mcpManager.registerToolsToToolLattice(
           config.tenantId,
           config.key,
           config.selectedTools
@@ -29376,15 +30562,15 @@ async function restoreMcpConnections() {
     results.forEach((result, index) => {
       if (result.status === "rejected") {
         const config = configs[index];
-        logger6.warn(
+        logger7.warn(
           `Failed to register tools for MCP server "${config.tenantId}/${config.key}"`,
           { error: result.reason }
         );
       }
     });
-    logger6.info(`MCP connection restoration complete: ${configs.length} servers`);
+    logger7.info(`MCP connection restoration complete: ${configs.length} servers`);
   } catch (err) {
-    logger6.error("MCP connection restoration failed", { error: err });
+    logger7.error("MCP connection restoration failed", { error: err });
   }
 }
 var start = async (config) => {
@@ -29397,17 +30583,17 @@ var start = async (config) => {
         file: config.loggerConfig.file || DEFAULT_LOGGER_CONFIG.file
       };
       loggerLattice = initializeLogger(loggerConfig);
-      logger6 = loggerLattice.client;
+      logger7 = loggerLattice.client;
     }
     app.decorate("loggerLattice", loggerLattice);
     const projectRoomRealtimeMode = resolveProjectRoomRealtimeMode();
     let projectRoomRealtimeRuntime;
     if (projectRoomRealtimeMode === "single-gateway") {
       projectRoomRealtimeRuntime = createProjectRoomRealtimeRuntime({
-        tasks: (0, import_core81.getStoreLattice)("default", "task").store,
-        rooms: (0, import_core81.getStoreLattice)("default", "projectRoom").store,
-        memberships: (0, import_core81.getStoreLattice)("default", "projectBotMembership").store,
-        log: { warn: (message, context) => logger6.warn(message, context) }
+        tasks: (0, import_core82.getStoreLattice)("default", "task").store,
+        rooms: (0, import_core82.getStoreLattice)("default", "projectRoom").store,
+        memberships: (0, import_core82.getStoreLattice)("default", "projectBotMembership").store,
+        log: { warn: (message, context) => logger7.warn(message, context) }
       });
     }
     let channelDeps;
@@ -29420,18 +30606,18 @@ var start = async (config) => {
       const infrastructure = createChannelInfrastructure({
         adapterRegistry,
         getStore: ((kind) => getStore11("default", kind).store),
-        trustedDispatcher: (0, import_core81.createTrustedAgentMessageDispatcher)((scope) => import_core81.agentInstanceManager.getAgent(scope)),
+        trustedDispatcher: (0, import_core82.createTrustedAgentMessageDispatcher)((scope) => import_core82.agentInstanceManager.getAgent(scope)),
         middlewares: [
           createDeduplicationMiddleware(),
           createRateLimitMiddleware(),
           createAuditLoggerMiddleware()
         ],
-        warn: (message, context) => logger6.warn(message, context),
+        warn: (message, context) => logger7.warn(message, context),
         realtime: projectRoomRealtimeRuntime?.publisher
       });
       const bindingStore = infrastructure.bindingRegistry;
       const installationStore = infrastructure.installationStore;
-      (0, import_core80.setBindingRegistry)(bindingStore);
+      (0, import_core81.setBindingRegistry)(bindingStore);
       const router = infrastructure.router;
       app.addHook("onClose", async () => router.dispose());
       channelDeps = {
@@ -29440,18 +30626,18 @@ var start = async (config) => {
         installationStore,
         bindingRegistry: bindingStore,
         realtime: projectRoomRealtimeRuntime?.publisher,
-        warn: (message, context) => logger6.warn(message, context)
+        warn: (message, context) => logger7.warn(message, context)
       };
     } catch (err) {
-      logger6.warn("Channel infrastructure unavailable", {
+      logger7.warn("Channel infrastructure unavailable", {
         error: err instanceof Error ? err.message : String(err)
       });
     }
-    (0, import_core80.setEvalRunService)(evalRunner);
+    (0, import_core81.setEvalRunService)(evalRunner);
     try {
-      const menuStore = (0, import_core81.getStoreLattice)("default", "menu").store;
-      (0, import_core80.setMenuRegistry)(menuStore);
-      logger6.info("Menu registry initialized");
+      const menuStore = (0, import_core82.getStoreLattice)("default", "menu").store;
+      (0, import_core81.setMenuRegistry)(menuStore);
+      logger7.info("Menu registry initialized");
     } catch {
     }
     registerAllBuiltinEntities();
@@ -29460,17 +30646,17 @@ var start = async (config) => {
     }
     const routes = registerLatticeRoutes(app, channelDeps, {
       projectTaskEnabled: process.env.AXIOM_PROJECT_TASK_EXECUTION_ENABLED !== "false",
-      projectTaskLog: { warn: (message, context) => logger6.warn(message, context) },
+      projectTaskLog: { warn: (message, context) => logger7.warn(message, context) },
       projectRoomRealtimeRuntime
     });
     try {
       const { A2AAuthService: A2AAuthService2, parseEnvKeys: parseEnvKeys2 } = await Promise.resolve().then(() => (init_A2AAuthService(), A2AAuthService_exports));
       const { registerA2AStandardRoutes: registerA2AStandardRoutes2 } = await Promise.resolve().then(() => (init_a2a_standard(), a2a_standard_exports));
       const a2a = await Promise.resolve().then(() => (init_a2a(), a2a_exports));
-      const a2aKeyStore = (0, import_core81.getStoreLattice)("default", "a2aApiKey").store;
-      const assistantStore = (0, import_core81.getStoreLattice)("default", "assistant").store;
-      const projectStore = (0, import_core81.getStoreLattice)("default", "project").store;
-      const taskStore = (0, import_core81.getStoreLattice)("default", "task").store;
+      const a2aKeyStore = (0, import_core82.getStoreLattice)("default", "a2aApiKey").store;
+      const assistantStore = (0, import_core82.getStoreLattice)("default", "assistant").store;
+      const projectStore = (0, import_core82.getStoreLattice)("default", "project").store;
+      const taskStore = (0, import_core82.getStoreLattice)("default", "task").store;
       const authService = new A2AAuthService2({
         keyStore: a2aKeyStore,
         assistantStore,
@@ -29488,9 +30674,9 @@ var start = async (config) => {
         getProjectStore: () => projectStore
       });
       a2a.registerA2ARoutes(app);
-      logger6.info("A2A standard routes registered");
+      logger7.info("A2A standard routes registered");
     } catch (err) {
-      logger6.warn("A2A standard routes unavailable", {
+      logger7.warn("A2A standard routes unavailable", {
         error: err instanceof Error ? err.message : String(err)
       });
     }
@@ -29509,8 +30695,8 @@ var start = async (config) => {
       const { CollectionService: CollectionService2 } = await Promise.resolve().then(() => (init_collection_service(), collection_service_exports));
       openLattice2.register(createKbProvider2(new CollectionService2()));
       openLattice2.register(createOpenSandboxProvider2());
-      const threadStore = (0, import_core81.getStoreLattice)("default", "thread").store;
-      const assistantStore = (0, import_core81.getStoreLattice)("default", "assistant").store;
+      const threadStore = (0, import_core82.getStoreLattice)("default", "thread").store;
+      const assistantStore = (0, import_core82.getStoreLattice)("default", "assistant").store;
       openLattice2.register(
         createAgentProvider2({
           threadStore,
@@ -29527,30 +30713,30 @@ var start = async (config) => {
       registerOpenFilesRoutes2(app);
       registerOpenAuditRoutes2(app);
       registerOpenExposureRoutes2(app);
-      logger6.info("Open API routes registered (kb + sandbox providers, session exchange)");
+      logger7.info("Open API routes registered (kb + sandbox providers, session exchange)");
     } catch (err) {
-      logger6.warn("Open API routes unavailable", {
+      logger7.warn("Open API routes unavailable", {
         error: err instanceof Error ? err.message : String(err)
       });
     }
-    if (!import_core81.sandboxLatticeManager.hasLattice("default")) {
-      import_core81.sandboxLatticeManager.registerLattice("default", getConfiguredSandboxProvider());
-      logger6.info("Registered sandbox manager from env configuration");
+    if (!import_core82.sandboxLatticeManager.hasLattice("default")) {
+      import_core82.sandboxLatticeManager.registerLattice("default", getConfiguredSandboxProvider());
+      logger7.info("Registered sandbox manager from env configuration");
     }
     try {
       const { ResourceController: ResourceController2 } = await Promise.resolve().then(() => (init_resources(), resources_exports));
-      const sharedResourceStore = (0, import_core81.getStoreLattice)("default", "sharedResource").store;
-      const cache = new import_core81.TokenCache();
+      const sharedResourceStore = (0, import_core82.getStoreLattice)("default", "sharedResource").store;
+      const cache = new import_core82.TokenCache();
       const resourceController = new ResourceController2({
         store: sharedResourceStore,
-        sandboxManager: import_core81.sandboxLatticeManager,
+        sandboxManager: import_core82.sandboxLatticeManager,
         cache,
-        logger: logger6
+        logger: logger7
       });
       registerResourceRoutes(app, resourceController);
-      logger6.info("Resource share routes registered");
+      logger7.info("Resource share routes registered");
     } catch (err) {
-      logger6.warn("Resource share infrastructure unavailable", {
+      logger7.warn("Resource share infrastructure unavailable", {
         error: err instanceof Error ? err.message : String(err)
       });
     }
@@ -29562,17 +30748,17 @@ var start = async (config) => {
           { deps: { router: channelDeps.router } }
         );
       } catch (err) {
-        logger6.error("Failed to start channel connections", {
+        logger7.error("Failed to start channel connections", {
           error: err instanceof Error ? err.message : String(err)
         });
       }
     }
     const target_port = config?.port || Number(process.env.PORT) || 4001;
     if (routes.projectTaskRuntime) {
-      await prepareProjectTaskRuntime(routes.projectTaskRuntime, logger6);
+      await prepareProjectTaskRuntime(routes.projectTaskRuntime, logger7);
     }
     await app.listen({ port: target_port, host: "0.0.0.0" });
-    logger6.info(`Lattice Gateway is running on port: ${target_port}`);
+    logger7.info(`Lattice Gateway is running on port: ${target_port}`);
     const queueServiceConfig = config?.queueServiceConfig;
     if (queueServiceConfig) {
       setQueueServiceType(queueServiceConfig.type);
@@ -29582,17 +30768,17 @@ var start = async (config) => {
       }
     }
     if (process.env.AXIOM_RESTORE_PENDING_ON_STARTUP === "true") {
-      import_core81.agentInstanceManager.restore().then((stats) => {
-        logger6.info(`Agent recovery complete: ${stats.restored} threads restored, ${stats.errors} errors`);
+      import_core82.agentInstanceManager.restore().then((stats) => {
+        logger7.info(`Agent recovery complete: ${stats.restored} threads restored, ${stats.errors} errors`);
       }).catch((error) => {
-        logger6.error("Agent recovery failed", { error });
+        logger7.error("Agent recovery failed", { error });
       });
     }
     restoreMcpConnections().catch((error) => {
-      logger6.error("MCP connection restoration failed", { error });
+      logger7.error("MCP connection restoration failed", { error });
     });
   } catch (err) {
-    logger6.error("Server start failed", { error: err });
+    logger7.error("Server start failed", { error: err });
     process.exit(1);
   }
 };