@axiom-lattice/gateway 4.5.0 → 4.6.0

package/dist/index.mjs

@@ -42,7 +42,7 @@ import staticPlugin from "@fastify/static";
 import path4 from "path";
 
 // src/routes/index.ts
-import { randomUUID as randomUUID23 } from "crypto";
+import { randomUUID as randomUUID24 } from "crypto";
 import {
   descriptorDataValue as descriptorDataValue3,
   snapshotExactRecord as snapshotExactRecord14,
@@ -1911,9 +1911,9 @@ async function getConfig(request, reply) {
 import { registerModelLattice, modelLatticeManager } from "@axiom-lattice/core";
 async function getModels(request, reply) {
   try {
-    const allLattices = modelLatticeManager.getAllLattices();
+    const allLattices = modelLatticeManager.getAllLatticesByTenant("default");
     const models = allLattices.map((lattice) => {
-      const config = lattice.client.config || {};
+      const config = lattice.client.getConfig();
       const displayName = config.displayName || lattice.key.split("-").map((word) => word.charAt(0).toUpperCase() + word.slice(1)).join(" ");
       return {
         key: lattice.key,
@@ -1921,7 +1921,13 @@ async function getModels(request, reply) {
         provider: config.provider || "openai",
         displayName,
         streaming: config.streaming || false,
-        apiKey: config.apiKey || "",
+        // The key itself is NOT returned. `hasApiKey` is what a client needs to
+        // render "configured — leave blank to keep"; the value was previously
+        // sent in cleartext to every caller of this endpoint, which put provider
+        // credentials in any browser that loaded the model settings. Clients
+        // that edit a model therefore leave the key field empty, which
+        // `updateModels` reads as "keep the existing one".
+        hasApiKey: Boolean(config.apiKey),
         baseURL: config.baseURL || "",
         maxTokens: config.maxTokens,
         temperature: config.temperature,
@@ -1963,6 +1969,8 @@ async function updateModels(request, reply) {
         continue;
       }
       try {
+        const existingConfig = modelLatticeManager.hasLattice(modelConfig.key) ? modelLatticeManager.getModelLattice(modelConfig.key).client.getConfig() : void 0;
+        const effectiveApiKey = modelConfig.clearApiKey ? void 0 : modelConfig.apiKey || existingConfig?.apiKey;
         if (modelLatticeManager.hasLattice(modelConfig.key)) {
           modelLatticeManager.removeLattice(modelConfig.key);
         }
@@ -1971,7 +1979,7 @@ async function updateModels(request, reply) {
           model: modelConfig.model,
           displayName: modelConfig.displayName,
           streaming: modelConfig.streaming ?? false,
-          apiKey: modelConfig.apiKey,
+          apiKey: effectiveApiKey,
           baseURL: modelConfig.baseURL,
           maxTokens: modelConfig.maxTokens,
           temperature: modelConfig.temperature,
@@ -15659,13 +15667,1136 @@ function registerCapabilityBundleRoutes(app2, controller) {
   app2.post("/api/projects/:projectId/capability-preview", controller.postProjectPreview.bind(controller));
 }
 
-// src/services/collaboration/ProjectRoomService.ts
+// src/controllers/model-providers.ts
+import { ZodError as ZodError3 } from "zod";
+
+// src/services/model-provider/ModelProviderService.ts
 import { randomUUID as randomUUID15 } from "crypto";
+import { toModelKey } from "@axiom-lattice/protocols";
+import {
+  assertSafeUpstreamUrl,
+  UnsafeUpstreamUrlError
+} from "@axiom-lattice/core";
+
+// src/services/model-provider/errors.ts
+var ModelProviderServiceError = class extends Error {
+  /** Creates a model provider service error. */
+  constructor(code, statusCode, message, retryable = false) {
+    super(message);
+    this.code = code;
+    this.statusCode = statusCode;
+    this.retryable = retryable;
+    this.name = "ModelProviderServiceError";
+  }
+};
+
+// src/services/model-provider/discovery.ts
+var MAX_DISCOVERED_MODELS = 1e3;
+var MAX_RESPONSE_BYTES = 2 * 1024 * 1024;
+var DEFAULT_DISCOVERY_TIMEOUT_MS = 8e3;
+function resolveDiscoveryTimeoutMs(raw = process.env.LATTICE_MODEL_DISCOVERY_TIMEOUT_MS) {
+  if (!raw) {
+    return DEFAULT_DISCOVERY_TIMEOUT_MS;
+  }
+  const parsed = Number.parseInt(raw, 10);
+  if (!Number.isFinite(parsed) || parsed <= 0) {
+    return DEFAULT_DISCOVERY_TIMEOUT_MS;
+  }
+  return parsed;
+}
+function buildModelsEndpoint(baseURL) {
+  const url = new URL(baseURL);
+  const trimmed = url.pathname.replace(/\/+$/, "");
+  url.pathname = trimmed.endsWith("/v1") ? `${trimmed}/models` : `${trimmed}/v1/models`;
+  url.search = "";
+  url.hash = "";
+  return url.toString();
+}
+function parseModelsPayload(payload) {
+  const entries = Array.isArray(payload) ? payload : typeof payload === "object" && payload !== null ? payload.data : void 0;
+  if (!Array.isArray(entries)) {
+    throw new ModelProviderServiceError(
+      "UPSTREAM_INVALID_RESPONSE",
+      502,
+      "Upstream did not return a model list"
+    );
+  }
+  const models = [];
+  for (const entry of entries.slice(0, MAX_DISCOVERED_MODELS)) {
+    if (typeof entry !== "object" || entry === null) {
+      continue;
+    }
+    const record = entry;
+    const id3 = typeof record.id === "string" ? record.id.trim() : "";
+    if (id3.length === 0) {
+      continue;
+    }
+    models.push({
+      id: id3,
+      displayName: typeof record.name === "string" ? record.name : void 0,
+      ownedBy: typeof record.owned_by === "string" ? record.owned_by : void 0,
+      createdAt: parseUpstreamCreated(record.created),
+      raw: record
+    });
+  }
+  return models;
+}
+function parseUpstreamCreated(created) {
+  if (typeof created !== "number" || !Number.isFinite(created)) {
+    return void 0;
+  }
+  const date = new Date(created * 1e3);
+  return Number.isNaN(date.getTime()) ? void 0 : date.toISOString();
+}
+var openAiCompatibleAdapter = {
+  protocol: "openai-compatible",
+  async discover({ baseURL, apiKey, signal }) {
+    const endpoint = buildModelsEndpoint(baseURL);
+    const headers = { Accept: "application/json" };
+    if (apiKey) {
+      headers.Authorization = `Bearer ${apiKey}`;
+    }
+    let response;
+    try {
+      response = await fetch(endpoint, {
+        method: "GET",
+        headers,
+        // Never follow redirects: a redirected request could reach an
+        // address that bypassed the SSRF checks.
+        redirect: "manual",
+        signal
+      });
+    } catch (error) {
+      if (error instanceof Error && error.name === "AbortError") {
+        throw new ModelProviderServiceError(
+          "UPSTREAM_TIMEOUT",
+          504,
+          "Upstream did not respond in time",
+          true
+        );
+      }
+      throw new ModelProviderServiceError(
+        "UPSTREAM_UNREACHABLE",
+        502,
+        "Upstream could not be reached",
+        true
+      );
+    }
+    if (response.status >= 300 && response.status < 400) {
+      throw new ModelProviderServiceError(
+        "UPSTREAM_REDIRECT_BLOCKED",
+        502,
+        "Upstream returned a redirect; configure the final URL directly"
+      );
+    }
+    if (response.status === 401 || response.status === 403) {
+      throw new ModelProviderServiceError(
+        "UPSTREAM_AUTH_FAILED",
+        502,
+        "Upstream rejected the configured credentials"
+      );
+    }
+    if (response.status === 429) {
+      throw new ModelProviderServiceError(
+        "UPSTREAM_RATE_LIMITED",
+        502,
+        "Upstream rate limited the request",
+        true
+      );
+    }
+    if (!response.ok) {
+      throw new ModelProviderServiceError(
+        "UPSTREAM_UNREACHABLE",
+        502,
+        "Upstream returned an error response",
+        response.status >= 500
+      );
+    }
+    const body = await readBodyWithLimit(response, MAX_RESPONSE_BYTES);
+    let payload;
+    try {
+      payload = JSON.parse(body);
+    } catch {
+      throw new ModelProviderServiceError(
+        "UPSTREAM_INVALID_RESPONSE",
+        502,
+        "Upstream response was not valid JSON"
+      );
+    }
+    return parseModelsPayload(payload);
+  }
+};
+async function readBodyWithLimit(response, maxBytes) {
+  if (!response.body) {
+    return response.text();
+  }
+  const reader = response.body.getReader();
+  const decoder = new TextDecoder();
+  let received = 0;
+  let text = "";
+  try {
+    for (; ; ) {
+      const { done, value } = await reader.read();
+      if (done) {
+        break;
+      }
+      if (!value) {
+        continue;
+      }
+      received += value.byteLength;
+      if (received > maxBytes) {
+        await reader.cancel();
+        throw new ModelProviderServiceError(
+          "UPSTREAM_INVALID_RESPONSE",
+          502,
+          "Upstream response was too large"
+        );
+      }
+      text += decoder.decode(value, { stream: true });
+    }
+  } finally {
+    reader.releaseLock();
+  }
+  return text + decoder.decode();
+}
+var adapters = /* @__PURE__ */ new Map([
+  [openAiCompatibleAdapter.protocol, openAiCompatibleAdapter]
+]);
+function getDiscoveryAdapter(protocol) {
+  return adapters.get(protocol);
+}
+
+// src/services/model-provider/ModelProviderService.ts
+var PHASE1_REGISTRY_TENANT = "default";
+var ALLOWED_LLM_PROVIDERS = /* @__PURE__ */ new Set(["openai"]);
+var unsafeReasonToErrorCode = {
+  INVALID_BASE_URL: "INVALID_BASE_URL",
+  UNSUPPORTED_SCHEME: "INVALID_BASE_URL",
+  CREDENTIALS_IN_URL: "INVALID_BASE_URL"
+};
+var ModelProviderService = class {
+  constructor(deps) {
+    this.deps = deps;
+    this.idFactory = deps.idFactory ?? (() => randomUUID15());
+  }
+  /**
+   * List the tenant's provider configurations.
+   */
+  async list(userId, tenantId) {
+    await this.assertMember(userId, tenantId);
+    const providers = await this.deps.providerStore.listProviders(tenantId);
+    const models = await this.deps.providerStore.listModels(tenantId);
+    const modelCounts = /* @__PURE__ */ new Map();
+    for (const model of models) {
+      modelCounts.set(
+        model.providerId,
+        (modelCounts.get(model.providerId) ?? 0) + 1
+      );
+    }
+    return providers.map(
+      (provider) => this.toPublicEntry(provider, modelCounts.get(provider.id) ?? 0)
+    );
+  }
+  /**
+   * Read one provider configuration.
+   */
+  async get(userId, tenantId, id3) {
+    await this.assertMember(userId, tenantId);
+    const provider = await this.requireProvider(tenantId, id3);
+    const models = await this.deps.providerStore.listModels(tenantId, id3);
+    return this.toPublicEntry(provider, models.length);
+  }
+  /**
+   * The full model catalog visible to a tenant.
+   */
+  async catalog(userId, tenantId) {
+    await this.assertMember(userId, tenantId);
+    const providers = await this.deps.providerStore.listProviders(tenantId);
+    const snapshot = await this.deps.providerStore.listModels(tenantId);
+    const providerNames = new Map(
+      providers.map((provider) => [provider.id, provider.name])
+    );
+    const disabledProviderIds = new Set(
+      providers.filter((provider) => !provider.enabled).map((p) => p.id)
+    );
+    const modelCounts = /* @__PURE__ */ new Map();
+    for (const model of snapshot) {
+      modelCounts.set(
+        model.providerId,
+        (modelCounts.get(model.providerId) ?? 0) + 1
+      );
+    }
+    const models = snapshot.map((model) => ({
+      modelKey: toModelKey(model.providerId, model.modelId),
+      displayName: model.displayName,
+      providerId: model.providerId,
+      providerName: providerNames.get(model.providerId) ?? model.providerId,
+      ownedBy: model.ownedBy,
+      source: "snapshot",
+      enabled: model.enabled,
+      stale: model.stale ?? false,
+      executable: model.enabled && // A disabled provider is a kill switch: its models stay visible in the
+      // catalog but are no longer reported as runnable.
+      !disabledProviderIds.has(model.providerId) && this.deps.registry.has(
+        tenantId,
+        toModelKey(model.providerId, model.modelId)
+      )
+    }));
+    const known = new Set(models.map((model) => model.modelKey));
+    for (const modelKey2 of this.deps.registry.listRegistered(tenantId)) {
+      if (known.has(modelKey2)) {
+        continue;
+      }
+      models.push({
+        modelKey: modelKey2,
+        providerId: "",
+        providerName: "registered",
+        source: "registered",
+        enabled: true,
+        stale: false,
+        executable: true
+      });
+    }
+    return {
+      providers: providers.map(
+        (provider) => this.toPublicEntry(provider, modelCounts.get(provider.id) ?? 0)
+      ),
+      models
+    };
+  }
+  /**
+   * Create a provider configuration. Does not run discovery.
+   */
+  async create(userId, tenantId, input) {
+    await this.assertAdmin(userId, tenantId);
+    this.assertHasApiKey(input.apiKey);
+    if (!getDiscoveryAdapter(input.protocol)) {
+      throw new ModelProviderServiceError(
+        "UNSUPPORTED_PROTOCOL",
+        400,
+        `Unsupported provider protocol`
+      );
+    }
+    await this.assertSafeUrl(input.baseURL);
+    const existing = await this.deps.providerStore.getProviderByName(
+      tenantId,
+      input.name
+    );
+    if (existing) {
+      throw new ModelProviderServiceError(
+        "PROVIDER_NAME_CONFLICT",
+        409,
+        "A provider with this name already exists"
+      );
+    }
+    const id3 = this.idFactory();
+    try {
+      const created = await this.deps.providerStore.createProvider(
+        tenantId,
+        id3,
+        { ...input, enabled: input.enabled ?? true }
+      );
+      return this.toPublicEntry(created, 0);
+    } catch (error) {
+      throw this.mapStoreError(error);
+    }
+  }
+  /**
+   * Update a provider configuration.
+   * An omitted or empty `apiKey` keeps the stored key.
+   */
+  async update(userId, tenantId, id3, updates) {
+    await this.assertAdmin(userId, tenantId);
+    const existing = await this.requireProvider(tenantId, id3);
+    if (updates.clearApiKey || !(updates.apiKey?.trim() || existing.apiKey)) {
+      this.assertHasApiKey(void 0);
+    }
+    if (updates.protocol && !getDiscoveryAdapter(updates.protocol)) {
+      throw new ModelProviderServiceError(
+        "UNSUPPORTED_PROTOCOL",
+        400,
+        `Unsupported provider protocol`
+      );
+    }
+    if (updates.baseURL && updates.baseURL !== existing.baseURL) {
+      await this.assertSafeUrl(updates.baseURL);
+    }
+    if (updates.name && updates.name !== existing.name) {
+      const conflicting = await this.deps.providerStore.getProviderByName(
+        tenantId,
+        updates.name
+      );
+      if (conflicting && conflicting.id !== id3) {
+        throw new ModelProviderServiceError(
+          "PROVIDER_NAME_CONFLICT",
+          409,
+          "A provider with this name already exists"
+        );
+      }
+    }
+    try {
+      const updated = await this.deps.providerStore.updateProvider(
+        tenantId,
+        id3,
+        updates
+      );
+      if (!updated) {
+        throw new ModelProviderServiceError(
+          "PROVIDER_NOT_FOUND",
+          404,
+          "Model provider not found"
+        );
+      }
+      const models = await this.deps.providerStore.listModels(tenantId, id3);
+      this.syncRegistry(tenantId, updated, models);
+      return this.toPublicEntry(updated, models.length);
+    } catch (error) {
+      throw this.mapStoreError(error);
+    }
+  }
+  /**
+   * Delete a provider configuration, its snapshot, and any registry entries
+   * that no other provider in the tenant still supplies.
+   */
+  async remove(userId, tenantId, id3) {
+    await this.assertAdmin(userId, tenantId);
+    await this.requireProvider(tenantId, id3);
+    const snapshot = await this.deps.providerStore.listModels(tenantId, id3);
+    await this.deps.providerStore.deleteProvider(tenantId, id3);
+    for (const model of snapshot) {
+      this.deps.registry.remove(tenantId, toModelKey(id3, model.modelId));
+    }
+  }
+  /**
+   * Discover the provider's models and replace its snapshot.
+   */
+  async discover(userId, tenantId, id3) {
+    await this.assertAdmin(userId, tenantId);
+    const provider = await this.requireProvider(tenantId, id3);
+    if (!provider.enabled) {
+      throw new ModelProviderServiceError(
+        "PROVIDER_DISABLED",
+        400,
+        "Model provider is disabled"
+      );
+    }
+    const adapter = getDiscoveryAdapter(provider.protocol);
+    if (!adapter) {
+      throw new ModelProviderServiceError(
+        "UNSUPPORTED_PROTOCOL",
+        400,
+        `Unsupported provider protocol`
+      );
+    }
+    await this.assertSafeUrl(provider.baseURL);
+    const controller = new AbortController();
+    const timeout = setTimeout(
+      () => controller.abort(),
+      resolveDiscoveryTimeoutMs()
+    );
+    const previous = this.shouldRegister(tenantId) ? await this.deps.providerStore.listModels(tenantId, id3) : [];
+    let discovered;
+    try {
+      discovered = await adapter.discover({
+        baseURL: provider.baseURL,
+        apiKey: provider.apiKey,
+        signal: controller.signal
+      });
+    } catch (error) {
+      if (error instanceof ModelProviderServiceError) {
+        await this.deps.providerStore.markProviderStatus(
+          tenantId,
+          id3,
+          "error",
+          error.code
+        );
+        throw error;
+      }
+      throw error;
+    } finally {
+      clearTimeout(timeout);
+    }
+    const now = /* @__PURE__ */ new Date();
+    const inserted = await this.deps.providerStore.replaceProviderModels(
+      tenantId,
+      id3,
+      discovered
+    );
+    await this.deps.providerStore.markProviderStatus(
+      tenantId,
+      id3,
+      "ok",
+      void 0,
+      now
+    );
+    const registered = [];
+    if (this.shouldRegister(tenantId)) {
+      const snapshot = await this.deps.providerStore.listModels(tenantId, id3);
+      const currentKeys = new Set(
+        snapshot.map((model) => toModelKey(id3, model.modelId))
+      );
+      for (const model of previous) {
+        const modelKey2 = toModelKey(id3, model.modelId);
+        if (!currentKeys.has(modelKey2)) {
+          this.deps.registry.remove(tenantId, modelKey2);
+        }
+      }
+      registered.push(...this.syncRegistry(tenantId, provider, snapshot));
+    }
+    return {
+      discovered,
+      registered,
+      status: "ok"
+    };
+  }
+  /**
+   * Bring the execution registry in line with a provider's current state.
+   *
+   * Registration copies `apiKey` and `baseURL` by value, so a rotated
+   * credential or a changed endpoint only takes effect once the model is
+   * re-registered. Disabled models — and every model of a disabled provider —
+   * are removed instead.
+   *
+   * @returns The model keys left registered
+   */
+  /**
+   * Probe an upstream without touching the store.
+   *
+   * Powers the provider form's "test latency" and "list models" actions, which
+   * validate a base URL and API key the user has typed but not yet saved. The
+   * URL is validated exactly as on create/update and is never persisted, so the
+   * "discover resolves its URL from the store" rule is not weakened — nothing
+   * a probe learns can reach the snapshot.
+   */
+  async probe(userId, tenantId, input) {
+    await this.assertAdmin(userId, tenantId);
+    const protocol = input.protocol ?? "openai-compatible";
+    const adapter = getDiscoveryAdapter(protocol);
+    if (!adapter) {
+      throw new ModelProviderServiceError(
+        "UNSUPPORTED_PROTOCOL",
+        400,
+        `Unsupported provider protocol`
+      );
+    }
+    await this.assertSafeUrl(input.baseURL);
+    let apiKey = input.apiKey || void 0;
+    if (!apiKey && input.providerId) {
+      const existing = await this.requireProvider(tenantId, input.providerId);
+      apiKey = existing.apiKey;
+    }
+    const controller = new AbortController();
+    const timeout = setTimeout(
+      () => controller.abort(),
+      resolveDiscoveryTimeoutMs()
+    );
+    const startedAt = Date.now();
+    try {
+      const models = await adapter.discover({
+        baseURL: input.baseURL,
+        apiKey,
+        signal: controller.signal
+      });
+      return {
+        reachable: true,
+        latencyMs: Date.now() - startedAt,
+        models
+      };
+    } catch (error) {
+      if (error instanceof ModelProviderServiceError) {
+        return {
+          reachable: false,
+          latencyMs: Date.now() - startedAt,
+          models: [],
+          error: error.code
+        };
+      }
+      throw error;
+    } finally {
+      clearTimeout(timeout);
+    }
+  }
+  /**
+   * Set exactly which models this provider contributes.
+   *
+   * This is the "add model" action: the caller passes the ids it picked from
+   * the live list, and the provider's model set becomes precisely those. Ids
+   * are expected to have come from a probe — model names cannot be guessed,
+   * since a wrong id surfaces later as "model not found" or an authorisation
+   * error rather than at configuration time.
+   */
+  async setModels(userId, tenantId, id3, selection) {
+    await this.assertAdmin(userId, tenantId);
+    const provider = await this.requireProvider(tenantId, id3);
+    const previous = await this.deps.providerStore.listModels(tenantId, id3);
+    const previousById = new Map(
+      previous.map((model) => [model.modelId, model])
+    );
+    await this.deps.providerStore.replaceProviderModels(
+      tenantId,
+      id3,
+      selection.map((entry) => ({
+        id: entry.modelId,
+        enabled: entry.enabled,
+        // A model the upstream stopped offering stays in the set, flagged
+        // rather than dropped: deleting it would silently break anything
+        // referencing its key.
+        stale: entry.stale ?? false,
+        // The selection carries only ids and states, so a model already in the
+        // snapshot keeps the metadata discovery gave it.
+        displayName: previousById.get(entry.modelId)?.displayName,
+        ownedBy: previousById.get(entry.modelId)?.ownedBy
+      }))
+    );
+    const models = await this.deps.providerStore.listModels(tenantId, id3);
+    const kept = new Set(models.map((model) => model.modelId));
+    for (const model of previous) {
+      if (!kept.has(model.modelId)) {
+        this.deps.registry.remove(
+          tenantId,
+          toModelKey(provider.id, model.modelId)
+        );
+      }
+    }
+    this.syncRegistry(tenantId, provider, models);
+    return this.toPublicEntry(provider, models.length);
+  }
+  syncRegistry(tenantId, provider, models) {
+    if (!this.shouldRegister(tenantId)) {
+      return [];
+    }
+    const registered = [];
+    for (const model of models) {
+      const modelKey2 = toModelKey(provider.id, model.modelId);
+      if (!provider.enabled || !model.enabled) {
+        this.deps.registry.remove(tenantId, modelKey2);
+        continue;
+      }
+      this.deps.registry.register(
+        tenantId,
+        modelKey2,
+        this.toLlmConfig(provider, model.modelId)
+      );
+      registered.push(modelKey2);
+    }
+    return registered;
+  }
+  /**
+   * Enable or disable a single discovered model.
+   */
+  async setModelEnabled(userId, tenantId, id3, modelId, enabled) {
+    await this.assertAdmin(userId, tenantId);
+    const provider = await this.requireProvider(tenantId, id3);
+    const updated = await this.deps.providerStore.setModelEnabled(
+      tenantId,
+      id3,
+      modelId,
+      enabled
+    );
+    if (!updated) {
+      throw new ModelProviderServiceError(
+        "MODEL_KEY_CONFLICT",
+        404,
+        "Model not found for this provider"
+      );
+    }
+    const models = await this.deps.providerStore.listModels(tenantId, id3);
+    this.syncRegistry(tenantId, provider, models);
+    return this.toPublicEntry(provider, models.length);
+  }
+  /**
+   * Whether discovered models should be registered for execution.
+   */
+  shouldRegister(tenantId) {
+    return tenantId === PHASE1_REGISTRY_TENANT;
+  }
+  /**
+   * Build the runtime LLM config for a discovered model.
+   *
+   * `apiKeyEnvName`, `extra` and `modelKwargs` are deliberately omitted — they
+   * would let a tenant name an arbitrary process environment variable to read
+   * credentials from, or inject arbitrary constructor options.
+   */
+  toLlmConfig(provider, modelId) {
+    if (!ALLOWED_LLM_PROVIDERS.has(provider.llmProvider)) {
+      throw new ModelProviderServiceError(
+        "UNSUPPORTED_PROTOCOL",
+        400,
+        "Provider is configured with an unsupported LLM provider"
+      );
+    }
+    return {
+      provider: provider.llmProvider,
+      model: modelId,
+      displayName: modelId,
+      streaming: true,
+      apiKey: provider.apiKey,
+      baseURL: provider.baseURL,
+      // Chat Completions and the Responses API are different routes with
+      // different request fields; without this the gateway would post
+      // `messages` to an endpoint expecting `input`.
+      ...provider.apiStyle === "responses" ? { useResponsesApi: true } : {}
+    };
+  }
+  /**
+   * The sole projection from an internal provider entry to an API-safe shape.
+   */
+  toPublicEntry(provider, modelCount) {
+    return {
+      id: provider.id,
+      tenantId: provider.tenantId,
+      name: provider.name,
+      displayName: provider.displayName,
+      protocol: provider.protocol,
+      apiStyle: provider.apiStyle,
+      llmProvider: provider.llmProvider,
+      baseURL: provider.baseURL,
+      hasApiKey: Boolean(provider.apiKey),
+      apiKeyHint: provider.apiKeyHint,
+      enabled: provider.enabled,
+      status: provider.status,
+      lastError: provider.lastError,
+      lastDiscoveredAt: provider.lastDiscoveredAt?.toISOString(),
+      modelCount,
+      createdAt: provider.createdAt.toISOString(),
+      updatedAt: provider.updatedAt.toISOString()
+    };
+  }
+  /**
+   * Reject a provider that would end up without a credential.
+   *
+   * @param apiKey - The key the provider would hold, if any
+   * @throws {ModelProviderServiceError} When no key is present
+   */
+  assertHasApiKey(apiKey) {
+    if (!apiKey?.trim()) {
+      throw new ModelProviderServiceError(
+        "INVALID_INPUT",
+        400,
+        "A model provider must have an API key"
+      );
+    }
+  }
+  /**
+   * Load a provider or fail with 404.
+   *
+   * Callers always pass the session's tenant, so a provider belonging to
+   * another tenant is indistinguishable from a missing one.
+   */
+  async requireProvider(tenantId, id3) {
+    const provider = await this.deps.providerStore.getProviderById(tenantId, id3);
+    if (!provider) {
+      throw new ModelProviderServiceError(
+        "PROVIDER_NOT_FOUND",
+        404,
+        "Model provider not found"
+      );
+    }
+    return provider;
+  }
+  /**
+   * Require that the caller belongs to the tenant.
+   * An absent userId means the unauthenticated development fallback.
+   */
+  async assertMember(userId, tenantId) {
+    if (!userId) {
+      return;
+    }
+    const link = await this.deps.userTenantLinkStore.getLink(userId, tenantId);
+    if (!link) {
+      throw new ModelProviderServiceError(
+        "TENANT_ACCESS_DENIED",
+        403,
+        "Tenant access denied"
+      );
+    }
+  }
+  /**
+   * Require that the caller is a tenant owner or admin.
+   * Roles are read from the tenant link, never from the session token.
+   */
+  async assertAdmin(userId, tenantId) {
+    await this.assertMember(userId, tenantId);
+    if (!userId) {
+      return;
+    }
+    const link = await this.deps.userTenantLinkStore.getLink(userId, tenantId);
+    if (link?.role !== "owner" && link?.role !== "admin") {
+      throw new ModelProviderServiceError(
+        "FORBIDDEN_ROLE",
+        403,
+        "Only tenant owner or admin can manage model providers"
+      );
+    }
+  }
+  /**
+   * Validate the shape of an upstream URL and translate failures into service
+   * errors.
+   *
+   * Addresses are deliberately not restricted: other tenant-configured URLs in
+   * this platform (metrics servers, MCP servers) reach wherever they point, and
+   * self-hosted model servers normally sit on the gateway's own network.
+   *
+   * The mapping is explicit so the public error codes stay decoupled from the
+   * reasons the URL utility happens to use internally.
+   */
+  async assertSafeUrl(baseURL) {
+    try {
+      await assertSafeUpstreamUrl(baseURL);
+    } catch (error) {
+      if (error instanceof UnsafeUpstreamUrlError) {
+        throw new ModelProviderServiceError(
+          unsafeReasonToErrorCode[error.reason],
+          400,
+          error.message
+        );
+      }
+      throw error;
+    }
+  }
+  /**
+   * Translate a store-level unique violation into a stable service error.
+   */
+  mapStoreError(error) {
+    if (error instanceof ModelProviderServiceError) {
+      return error;
+    }
+    const code = error?.code;
+    if (code === "23505") {
+      return new ModelProviderServiceError(
+        "PROVIDER_NAME_CONFLICT",
+        409,
+        "A provider with this name already exists"
+      );
+    }
+    if (code === "23503") {
+      return new ModelProviderServiceError(
+        "INVALID_INPUT",
+        400,
+        "Model provider references a missing record"
+      );
+    }
+    throw error;
+  }
+};
+
+// src/schemas/model-provider.ts
+import { z as z9 } from "zod";
+var providerId = z9.string().trim().min(1).max(255);
+var providerParamsSchema = z9.object({ providerId }).strict();
+var protocolSchema = z9.enum(["openai-compatible"]);
+var apiStyleSchema = z9.enum(["chat-completions", "responses"]);
+var createProviderSchema = z9.object({
+  name: z9.string().trim().min(1).max(255),
+  displayName: z9.string().trim().max(255).optional(),
+  protocol: protocolSchema,
+  apiStyle: apiStyleSchema.optional(),
+  baseURL: z9.string().trim().min(1).max(2048),
+  // Required, not optional: see CreateModelProviderRequest.apiKey — a
+  // keyless provider would make the gateway send its own env credential.
+  apiKey: z9.string().trim().min(1).max(1024),
+  enabled: z9.boolean().optional()
+}).strict();
+var updateProviderSchema = createProviderSchema.partial().extend({
+  /**
+   * Remove the stored API key. Needed because an empty `apiKey` means "keep":
+   * without this a leaked credential could not be revoked.
+   */
+  clearApiKey: z9.boolean().optional()
+}).strict();
+var setModelEnabledSchema = z9.object({
+  modelId: z9.string().trim().min(1).max(512),
+  enabled: z9.boolean()
+}).strict();
+var discoverSchema = z9.object({}).strict();
+var setModelsSchema = z9.object({
+  models: z9.array(
+    z9.object({
+      modelId: z9.string().trim().min(1).max(512),
+      enabled: z9.boolean(),
+      stale: z9.boolean().optional()
+    }).strict()
+  ).max(1e3)
+}).strict();
+var probeProviderSchema = z9.object({
+  baseURL: z9.string().trim().min(1).max(2048),
+  apiKey: z9.string().max(1024).optional(),
+  providerId: z9.string().trim().min(1).max(255).optional(),
+  protocol: protocolSchema.optional()
+}).strict();
+
+// src/controllers/tenant-scope.ts
+var TenantScopeError2 = class extends Error {
+  /** Creates a tenant scope error. */
+  constructor(code, statusCode, message) {
+    super(message);
+    this.code = code;
+    this.statusCode = statusCode;
+    this.name = "TenantScopeError";
+  }
+};
+function resolveTenantScope(request, authRequired2) {
+  const authenticated = request.user?.tenantId;
+  const header2 = request.headers["x-tenant-id"];
+  const requested = Array.isArray(header2) ? header2[0] : header2;
+  if (authenticated) {
+    if (requested && requested !== authenticated) {
+      throw new TenantScopeError2(
+        "TENANT_ACCESS_DENIED",
+        403,
+        "Tenant access denied"
+      );
+    }
+    return { tenantId: authenticated, userId: request.user?.id };
+  }
+  if (authRequired2) {
+    throw new TenantScopeError2(
+      "UNAUTHENTICATED",
+      401,
+      "Console session required"
+    );
+  }
+  return { tenantId: requested || "default" };
+}
+
+// src/controllers/model-providers.ts
+var logger4 = new Logger({ serviceName: "lattice/gateway/model-providers" });
+function sendError2(reply, error) {
+  if (error instanceof ModelProviderServiceError) {
+    return reply.status(error.statusCode).send({
+      success: false,
+      error: {
+        code: error.code,
+        message: error.message,
+        retryable: error.retryable
+      }
+    });
+  }
+  if (error instanceof TenantScopeError2) {
+    return reply.status(error.statusCode).send({
+      success: false,
+      error: {
+        code: error.code,
+        message: error.message,
+        retryable: false
+      }
+    });
+  }
+  if (error instanceof ZodError3) {
+    return reply.status(400).send({
+      success: false,
+      error: {
+        code: "INVALID_INPUT",
+        message: "Invalid request",
+        retryable: false
+      }
+    });
+  }
+  logger4.error("Model provider controller error", {
+    error: error instanceof Error ? error : new Error(String(error))
+  });
+  return reply.status(500).send({
+    success: false,
+    error: {
+      code: "INTERNAL_ERROR",
+      message: "Internal server error",
+      retryable: false
+    }
+  });
+}
+var ModelProviderController = class {
+  constructor(deps, options = {}) {
+    this.service = new ModelProviderService(deps);
+    this.authRequired = options.authRequired ?? true;
+  }
+  /** GET /api/tenant-models */
+  async getCatalog(request, reply) {
+    try {
+      const scope = resolveTenantScope(request, this.authRequired);
+      const catalog = await this.service.catalog(scope.userId, scope.tenantId);
+      return reply.send({ success: true, data: catalog });
+    } catch (error) {
+      return sendError2(reply, error);
+    }
+  }
+  /** GET /api/model-providers */
+  async listProviders(request, reply) {
+    try {
+      const scope = resolveTenantScope(request, this.authRequired);
+      const records = await this.service.list(scope.userId, scope.tenantId);
+      return reply.send({
+        success: true,
+        data: { records, total: records.length }
+      });
+    } catch (error) {
+      return sendError2(reply, error);
+    }
+  }
+  /** GET /api/model-providers/:providerId */
+  async getProvider(request, reply) {
+    try {
+      const scope = resolveTenantScope(request, this.authRequired);
+      const { providerId: providerId2 } = providerParamsSchema.parse(request.params);
+      return reply.send({
+        success: true,
+        data: await this.service.get(scope.userId, scope.tenantId, providerId2)
+      });
+    } catch (error) {
+      return sendError2(reply, error);
+    }
+  }
+  /** POST /api/model-providers */
+  async createProvider(request, reply) {
+    try {
+      const scope = resolveTenantScope(request, this.authRequired);
+      const input = createProviderSchema.parse(request.body);
+      return reply.status(201).send({
+        success: true,
+        data: await this.service.create(scope.userId, scope.tenantId, input)
+      });
+    } catch (error) {
+      return sendError2(reply, error);
+    }
+  }
+  /** PUT /api/model-providers/:providerId */
+  async updateProvider(request, reply) {
+    try {
+      const scope = resolveTenantScope(request, this.authRequired);
+      const { providerId: providerId2 } = providerParamsSchema.parse(request.params);
+      const input = updateProviderSchema.parse(request.body);
+      return reply.send({
+        success: true,
+        data: await this.service.update(
+          scope.userId,
+          scope.tenantId,
+          providerId2,
+          input
+        )
+      });
+    } catch (error) {
+      return sendError2(reply, error);
+    }
+  }
+  /** DELETE /api/model-providers/:providerId */
+  async deleteProvider(request, reply) {
+    try {
+      const scope = resolveTenantScope(request, this.authRequired);
+      const { providerId: providerId2 } = providerParamsSchema.parse(request.params);
+      await this.service.remove(scope.userId, scope.tenantId, providerId2);
+      return reply.send({ success: true, data: null });
+    } catch (error) {
+      return sendError2(reply, error);
+    }
+  }
+  /** POST /api/model-providers/probe */
+  async probeProvider(request, reply) {
+    try {
+      const scope = resolveTenantScope(request, this.authRequired);
+      const input = probeProviderSchema.parse(request.body);
+      return reply.send({
+        success: true,
+        data: await this.service.probe(scope.userId, scope.tenantId, input)
+      });
+    } catch (error) {
+      return sendError2(reply, error);
+    }
+  }
+  /** PUT /api/model-providers/:providerId/models */
+  async setProviderModels(request, reply) {
+    try {
+      const scope = resolveTenantScope(request, this.authRequired);
+      const { providerId: providerId2 } = providerParamsSchema.parse(request.params);
+      const { models } = setModelsSchema.parse(request.body);
+      return reply.send({
+        success: true,
+        data: await this.service.setModels(
+          scope.userId,
+          scope.tenantId,
+          providerId2,
+          models
+        )
+      });
+    } catch (error) {
+      return sendError2(reply, error);
+    }
+  }
+  /** POST /api/model-providers/:providerId/discover */
+  async discoverProvider(request, reply) {
+    try {
+      const scope = resolveTenantScope(request, this.authRequired);
+      const { providerId: providerId2 } = providerParamsSchema.parse(request.params);
+      discoverSchema.parse(request.body ?? {});
+      return reply.send({
+        success: true,
+        data: await this.service.discover(
+          scope.userId,
+          scope.tenantId,
+          providerId2
+        )
+      });
+    } catch (error) {
+      return sendError2(reply, error);
+    }
+  }
+  /** POST /api/model-providers/:providerId/models/enabled */
+  async setModelEnabled(request, reply) {
+    try {
+      const scope = resolveTenantScope(request, this.authRequired);
+      const { providerId: providerId2 } = providerParamsSchema.parse(request.params);
+      const { modelId, enabled } = setModelEnabledSchema.parse(request.body);
+      return reply.send({
+        success: true,
+        data: await this.service.setModelEnabled(
+          scope.userId,
+          scope.tenantId,
+          providerId2,
+          modelId,
+          enabled
+        )
+      });
+    } catch (error) {
+      return sendError2(reply, error);
+    }
+  }
+};
+function registerModelProviderRoutes(app2, controller) {
+  app2.get("/api/tenant-models", controller.getCatalog.bind(controller));
+  app2.get("/api/model-providers", controller.listProviders.bind(controller));
+  app2.post("/api/model-providers", controller.createProvider.bind(controller));
+  app2.post("/api/model-providers/probe", controller.probeProvider.bind(controller));
+  app2.get(
+    "/api/model-providers/:providerId",
+    controller.getProvider.bind(controller)
+  );
+  app2.put(
+    "/api/model-providers/:providerId",
+    controller.updateProvider.bind(controller)
+  );
+  app2.delete(
+    "/api/model-providers/:providerId",
+    controller.deleteProvider.bind(controller)
+  );
+  app2.post(
+    "/api/model-providers/:providerId/discover",
+    controller.discoverProvider.bind(controller)
+  );
+  app2.put(
+    "/api/model-providers/:providerId/models",
+    controller.setProviderModels.bind(controller)
+  );
+  app2.post(
+    "/api/model-providers/:providerId/models/enabled",
+    controller.setModelEnabled.bind(controller)
+  );
+}
+
+// src/services/collaboration/ProjectRoomService.ts
+import { randomUUID as randomUUID16 } from "crypto";
 var ProjectRoomService = class {
   /** Creates a project room service from explicitly injected collaborators. */
   constructor(deps) {
     this.deps = deps;
-    this.idFactory = deps.idFactory ?? randomUUID15;
+    this.idFactory = deps.idFactory ?? randomUUID16;
   }
   /**
    * Authorizes read access and ensures the project's main room.
@@ -15725,7 +16856,7 @@ var ProjectRoomService = class {
 };
 
 // src/services/collaboration/ProjectMembershipService.ts
-import { randomUUID as randomUUID16 } from "crypto";
+import { randomUUID as randomUUID17 } from "crypto";
 var ProjectMembershipServiceError = class extends Error {
   constructor(code, statusCode, message) {
     super(message);
@@ -15741,7 +16872,7 @@ function isMembershipConflict(error) {
 var ProjectMembershipService = class {
   constructor(deps) {
     this.deps = deps;
-    this.idFactory = deps.idFactory ?? randomUUID16;
+    this.idFactory = deps.idFactory ?? randomUUID17;
     this.mutationMutex = deps.projectMutationMutex ?? projectMutationMutex;
   }
   async list(actor3) {
@@ -15875,7 +17006,7 @@ var ProjectMembershipService = class {
 };
 
 // src/services/collaboration/ProjectRosterService.ts
-import { randomUUID as randomUUID17 } from "crypto";
+import { randomUUID as randomUUID18 } from "crypto";
 var ProjectRosterServiceError = class extends Error {
   /** Creates a stable roster service error. */
   constructor(code, statusCode, message) {
@@ -15894,7 +17025,7 @@ var ProjectRosterService = class {
   /** Creates a roster service from explicitly injected collaborators. */
   constructor(deps) {
     this.deps = deps;
-    this.idFactory = deps.idFactory ?? randomUUID17;
+    this.idFactory = deps.idFactory ?? randomUUID18;
     this.mutationMutex = deps.projectMutationMutex ?? projectMutationMutex;
   }
   /**
@@ -16160,7 +17291,7 @@ function publicProjectBot(project, roomId, agent, now) {
 }
 
 // src/services/collaboration/RoomMessageService.ts
-import { createHash as createHash6, randomUUID as randomUUID18 } from "crypto";
+import { createHash as createHash6, randomUUID as randomUUID19 } from "crypto";
 
 // src/services/collaboration/ProjectBotMembershipSnapshot.ts
 import { snapshotExactRecord as snapshotExactRecord5 } from "@axiom-lattice/protocols";
@@ -16249,7 +17380,7 @@ var RoomMessageService = class {
   constructor(deps, options = {}) {
     this.deps = deps;
     this.idempotentOutcomes = /* @__PURE__ */ new Map();
-    this.idFactory = deps.idFactory ?? randomUUID18;
+    this.idFactory = deps.idFactory ?? randomUUID19;
     const limit = options.idempotentOutcomeLimit ?? 1e3;
     if (!Number.isSafeInteger(limit) || limit < 1) throw new RangeError("idempotentOutcomeLimit must be a positive safe integer");
     this.idempotentOutcomeLimit = limit;
@@ -16498,11 +17629,11 @@ function matchesNormalizedPayload(message, input) {
 }
 
 // src/routes/project-rooms.ts
-import { ZodError as ZodError3 } from "zod";
+import { ZodError as ZodError4 } from "zod";
 import { toProjectRoomPublicMessage } from "@axiom-lattice/protocols";
 
 // src/services/collaboration/RoomInterruptService.ts
-import { randomUUID as randomUUID19 } from "crypto";
+import { randomUUID as randomUUID20 } from "crypto";
 var RoomInterruptServiceError = class extends Error {
   /** Creates a stable room interrupt error. */
   constructor(code, statusCode, message) {
@@ -16516,7 +17647,7 @@ var RoomInterruptService = class {
   /** Creates the service from explicitly injected stores and dispatcher. */
   constructor(deps) {
     this.deps = deps;
-    this.idFactory = deps.idFactory ?? randomUUID19;
+    this.idFactory = deps.idFactory ?? randomUUID20;
   }
   /** Resolves a pending clarify interrupt with no answers. */
   async skip(input) {
@@ -16574,52 +17705,52 @@ var RoomInterruptService = class {
 };
 
 // src/schemas/project-room.ts
-import { z as z9 } from "zod";
-var id2 = z9.string().trim().min(1).max(128);
-var isoDate = z9.string().datetime({ offset: true }).transform((value) => new Date(value));
-var expectedUpdatedAt = z9.object({ expectedUpdatedAt: isoDate }).strict();
-var projectRoomParamsSchema = z9.object({ projectId: id2 }).strict();
-var membershipParamsSchema = z9.object({ projectId: id2, membershipId: id2 }).strict();
-var roomMessagesQuerySchema = z9.object({
-  beforeCreatedAt: z9.string().datetime({ offset: true }).transform((value) => new Date(value)).optional(),
+import { z as z10 } from "zod";
+var id2 = z10.string().trim().min(1).max(128);
+var isoDate = z10.string().datetime({ offset: true }).transform((value) => new Date(value));
+var expectedUpdatedAt = z10.object({ expectedUpdatedAt: isoDate }).strict();
+var projectRoomParamsSchema = z10.object({ projectId: id2 }).strict();
+var membershipParamsSchema = z10.object({ projectId: id2, membershipId: id2 }).strict();
+var roomMessagesQuerySchema = z10.object({
+  beforeCreatedAt: z10.string().datetime({ offset: true }).transform((value) => new Date(value)).optional(),
   beforeId: id2.optional(),
-  limit: z9.coerce.number().int().min(1).max(100).optional()
+  limit: z10.coerce.number().int().min(1).max(100).optional()
 }).strict().refine((value) => value.beforeCreatedAt === void 0 === (value.beforeId === void 0), { message: "Both cursor fields are required" });
-var createRoomMessageSchema = z9.object({
-  text: z9.string(),
-  mentions: z9.array(z9.union([
-    z9.object({ type: z9.literal("team") }).strict(),
-    z9.object({ type: z9.literal("bot"), membershipId: id2 }).strict()
+var createRoomMessageSchema = z10.object({
+  text: z10.string(),
+  mentions: z10.array(z10.union([
+    z10.object({ type: z10.literal("team") }).strict(),
+    z10.object({ type: z10.literal("bot"), membershipId: id2 }).strict()
   ])).optional(),
   replyToMessageId: id2.optional()
 }).strict();
-var addProjectMemberSchema = z9.object({ userId: id2, role: z9.enum(["owner", "admin", "member", "viewer"]) }).strict();
-var updateProjectMemberSchema = z9.object({ role: z9.enum(["owner", "admin", "member", "viewer"]), expectedUpdatedAt: isoDate }).strict();
+var addProjectMemberSchema = z10.object({ userId: id2, role: z10.enum(["owner", "admin", "member", "viewer"]) }).strict();
+var updateProjectMemberSchema = z10.object({ role: z10.enum(["owner", "admin", "member", "viewer"]), expectedUpdatedAt: isoDate }).strict();
 var mutationExpectedUpdatedAtSchema = expectedUpdatedAt;
-var roomMessageRetryParamsSchema = z9.object({ projectId: id2, messageId: id2 }).strict();
-var emptyObjectSchema = z9.object({}).strict();
-var idempotencyKeySchema = z9.string().refine((value) => value.trim().length >= 1 && value.trim().length <= 200 && /^[\x20-\x7e]+$/.test(value.trim()), "Invalid idempotency key").transform((value) => value.trim());
-var addProjectBotSchema = z9.object({
+var roomMessageRetryParamsSchema = z10.object({ projectId: id2, messageId: id2 }).strict();
+var emptyObjectSchema = z10.object({}).strict();
+var idempotencyKeySchema = z10.string().refine((value) => value.trim().length >= 1 && value.trim().length <= 200 && /^[\x20-\x7e]+$/.test(value.trim()), "Invalid idempotency key").transform((value) => value.trim());
+var addProjectBotSchema = z10.object({
   assistantId: id2,
-  role: z9.enum(["coordinator", "specialist"]),
-  title: z9.string(),
-  responsibility: z9.string().optional(),
-  mentionName: z9.string()
+  role: z10.enum(["coordinator", "specialist"]),
+  title: z10.string(),
+  responsibility: z10.string().optional(),
+  mentionName: z10.string()
 }).strict();
-var updateProjectBotSchema = z9.object({
-  role: z9.enum(["coordinator", "specialist"]).optional(),
-  title: z9.string().optional(),
-  responsibility: z9.string().optional(),
-  mentionName: z9.string().optional(),
+var updateProjectBotSchema = z10.object({
+  role: z10.enum(["coordinator", "specialist"]).optional(),
+  title: z10.string().optional(),
+  responsibility: z10.string().optional(),
+  mentionName: z10.string().optional(),
   expectedUpdatedAt: isoDate
 }).strict().refine((value) => value.role !== void 0 || value.title !== void 0 || value.responsibility !== void 0 || value.mentionName !== void 0, { message: "At least one mutable field is required" });
-var resumeInterruptSchema = z9.object({
+var resumeInterruptSchema = z10.object({
   membershipId: id2,
-  answers: z9.array(z9.object({
-    questionIndex: z9.number().int().nonnegative(),
-    otherText: z9.string().optional(),
-    selectedOptions: z9.array(z9.string()).optional(),
-    filePath: z9.string().optional()
+  answers: z10.array(z10.object({
+    questionIndex: z10.number().int().nonnegative(),
+    otherText: z10.string().optional(),
+    selectedOptions: z10.array(z10.string()).optional(),
+    filePath: z10.string().optional()
   }).strict()).optional()
 }).strict();
 
@@ -16717,7 +17848,7 @@ async function run(reply, operation) {
     const result = await operation();
     return reply.code(result.statusCode ?? 200).send({ success: true, data: result.data });
   } catch (error) {
-    if (error instanceof ZodError3) return reply.code(400).send({ success: false, error: { code: "INVALID_REQUEST", message: "Invalid request", retryable: false } });
+    if (error instanceof ZodError4) return reply.code(400).send({ success: false, error: { code: "INVALID_REQUEST", message: "Invalid request", retryable: false } });
     if (error instanceof RoomInterruptServiceError) return reply.code(error.statusCode).send({ success: false, error: { code: error.code, message: error.message, retryable: false } });
     if (error instanceof ProjectRoomAuthError || error instanceof ProjectCollaborationError || error instanceof ProjectMembershipServiceError || error instanceof ProjectRosterServiceError || error instanceof RoomMessageServiceError) return reply.code(error.statusCode).send({ success: false, error: { code: error.code, message: error.message, retryable: error instanceof RoomMessageServiceError && error.retryable } });
     return reply.code(500).send({ success: false, error: { code: "INTERNAL_ERROR", message: "Internal server error", retryable: false } });
@@ -16725,7 +17856,7 @@ async function run(reply, operation) {
 }
 
 // src/routes/project-roster.ts
-import { ZodError as ZodError4 } from "zod";
+import { ZodError as ZodError5 } from "zod";
 var ProjectRosterAuthError = class extends Error {
   constructor() {
     super(...arguments);
@@ -16765,15 +17896,15 @@ async function execute(reply, operation) {
     const result = await operation();
     return reply.code(result.statusCode ?? 200).send({ success: true, data: result.data });
   } catch (error) {
-    if (error instanceof ZodError4) return reply.code(400).send({ success: false, error: { code: "INVALID_REQUEST", message: "Invalid request", retryable: false } });
+    if (error instanceof ZodError5) return reply.code(400).send({ success: false, error: { code: "INVALID_REQUEST", message: "Invalid request", retryable: false } });
     if (error instanceof ProjectRosterAuthError || error instanceof ProjectCollaborationError || error instanceof ProjectRosterServiceError) return reply.code(error.statusCode).send({ success: false, error: { code: error.code, message: error.message, retryable: false } });
     return reply.code(500).send({ success: false, error: { code: "INTERNAL_ERROR", message: "Internal server error", retryable: false } });
   }
 }
 
 // src/routes/cospace.ts
-import { randomUUID as randomUUID20 } from "crypto";
-import { ZodError as ZodError5 } from "zod";
+import { randomUUID as randomUUID21 } from "crypto";
+import { ZodError as ZodError6 } from "zod";
 import {
   generateDirectHumanProjectId,
   generateDirectBotProjectId
@@ -16806,7 +17937,7 @@ async function computeUnread(deps, tenantId, userId, roomId, lastMessage) {
   });
 }
 function registerCoSpaceRoutes(app2, deps) {
-  const idFactory = deps.idFactory ?? (() => randomUUID20());
+  const idFactory = deps.idFactory ?? (() => randomUUID21());
   app2.get(
     "/api/workspaces/:workspaceId/rooms",
     async (request, reply) => {
@@ -17327,7 +18458,7 @@ function registerCoSpaceRoutes(app2, deps) {
         data: result.data
       });
     } catch (error) {
-      if (error instanceof ZodError5) {
+      if (error instanceof ZodError6) {
         return reply.code(400).send({
           success: false,
           error: {
@@ -17360,9 +18491,9 @@ function registerCoSpaceRoutes(app2, deps) {
 }
 
 // src/routes/push-notifications.ts
-import { ZodError as ZodError6, z as z10 } from "zod";
-var subscriptionSchema = z10.object({ endpoint: z10.string().min(1), keys: z10.object({ p256dh: z10.string().min(1), auth: z10.string().min(1) }).strict() }).strict();
-var deleteSchema = z10.object({ endpoint: z10.string().min(1) }).strict();
+import { ZodError as ZodError7, z as z11 } from "zod";
+var subscriptionSchema = z11.object({ endpoint: z11.string().min(1), keys: z11.object({ p256dh: z11.string().min(1), auth: z11.string().min(1) }).strict() }).strict();
+var deleteSchema = z11.object({ endpoint: z11.string().min(1) }).strict();
 function actor2(request) {
   const user = request.user;
   return user?.id && user.tenantId ? { tenantId: user.tenantId, userId: user.id } : null;
@@ -17390,7 +18521,7 @@ function registerPushNotificationRoutes(app2, deps) {
       });
       return reply.code(204).send();
     } catch (error) {
-      if (error instanceof ZodError6) {
+      if (error instanceof ZodError7) {
         return reply.code(400).send({ success: false, error: { code: "INVALID_REQUEST", message: "Invalid request", retryable: false } });
       }
       return reply.code(500).send({ success: false, error: { code: "INTERNAL_ERROR", message: "Internal server error", retryable: false } });
@@ -17404,7 +18535,7 @@ function registerPushNotificationRoutes(app2, deps) {
       await deps.subscriptionStore.delete(current.tenantId, current.userId, body.endpoint);
       return reply.code(204).send();
     } catch (error) {
-      if (error instanceof ZodError6) {
+      if (error instanceof ZodError7) {
         return reply.code(400).send({ success: false, error: { code: "INVALID_REQUEST", message: "Invalid request", retryable: false } });
       }
       return reply.code(500).send({ success: false, error: { code: "INTERNAL_ERROR", message: "Internal server error", retryable: false } });
@@ -17762,7 +18893,7 @@ function exactValues(value, required, optional = []) {
 }
 
 // src/services/collaboration/CoordinatorWakeNotifier.ts
-import { randomUUID as randomUUID21 } from "crypto";
+import { randomUUID as randomUUID22 } from "crypto";
 import {
   snapshotExactRecord as snapshotExactRecord7
 } from "@axiom-lattice/protocols";
@@ -17778,7 +18909,7 @@ var CoordinatorWakeNotifier = class {
     this.accepted = /* @__PURE__ */ new Set();
     this.maxPending = deps.maxPending ?? 1024;
     if (!Number.isSafeInteger(this.maxPending) || this.maxPending < 1) throw new RangeError("maxPending must be a positive safe integer");
-    this.idFactory = deps.idFactory ?? randomUUID21;
+    this.idFactory = deps.idFactory ?? randomUUID22;
   }
   /** Admits one notification without awaiting any store or dispatch operation. */
   handle(value, anchorMessageId) {
@@ -19380,7 +20511,7 @@ function isRecord3(value) {
 import { taskLifecycleNotifier } from "@axiom-lattice/core";
 
 // src/services/collaboration/ProjectRoomEventBroker.ts
-import { randomUUID as randomUUID22 } from "crypto";
+import { randomUUID as randomUUID23 } from "crypto";
 import {
   parseProjectRoomEventId,
   ProjectRoomBrokerCapacityError,
@@ -19409,7 +20540,7 @@ var ProjectRoomEventBroker = class {
     this.subscriberCount = 0;
     this.usageClock = 0;
     this.closed = false;
-    this.epoch = options.epoch ?? randomUUID22();
+    this.epoch = options.epoch ?? randomUUID23();
     if (!UUID_PATTERN.test(this.epoch)) {
       throw new TypeError("Project Room event epoch must be a lowercase canonical UUID");
     }
@@ -21146,7 +22277,7 @@ var registerLatticeRoutes = (app2, channelDeps, options = {}) => {
     });
   }
   if (projectTaskComposition) app2.addHook("onClose", async () => projectTaskComposition.lease.release());
-  const taskThreadService = projectTaskComposition?.lease.runtime.threads ?? new ProjectTaskThreadService({ threads: threadStore, idFactory: randomUUID23 });
+  const taskThreadService = projectTaskComposition?.lease.runtime.threads ?? new ProjectTaskThreadService({ threads: threadStore, idFactory: randomUUID24 });
   const taskLifecycle = projectTaskComposition?.lease.runtime.lifecycle ?? createTaskLifecycleService({ taskStore, workItemStore: taskWorkItemStore });
   const reassignmentAuthorizer = createProjectTaskReassignmentAuthorizer(
     new ProjectTaskOwnerPolicy(projectBotMembershipStore),
@@ -21255,6 +22386,16 @@ var registerLatticeRoutes = (app2, channelDeps, options = {}) => {
     bundleStore: getStoreLattice17("default", "capabilityBundle").store,
     projectStore
   }, { authRequired: process.env.AUTH_REQUIRED === "true" }));
+  registerModelProviderRoutes(app2, new ModelProviderController({
+    providerStore: getStoreLattice17("default", "modelProvider").store,
+    userTenantLinkStore,
+    registry: {
+      register: (tenantId, modelKey2, config) => modelLatticeManager3.registerLatticeWithTenant(tenantId, modelKey2, config),
+      has: (tenantId, modelKey2) => modelLatticeManager3.hasLatticeWithTenant(tenantId, modelKey2),
+      remove: (tenantId, modelKey2) => modelLatticeManager3.removeLatticeWithTenant(tenantId, modelKey2),
+      listRegistered: (tenantId) => modelLatticeManager3.getLatticeKeysByTenant(tenantId)
+    }
+  }, { authRequired: process.env.AUTH_REQUIRED === "true" }));
   registerAgentWebAppRoutes(app2, {
     service: new AgentWebAppService({
       webAppStore,
@@ -21759,7 +22900,7 @@ function tryCreateProjectTaskRuntime(input) {
 function createRuntime(input, stores, log2) {
   const controller = new AbortController();
   const mutex = new ProjectTaskExecutionMutex();
-  const threads = new ProjectTaskThreadService({ threads: input.threadStore, idFactory: randomUUID23 });
+  const threads = new ProjectTaskThreadService({ threads: input.threadStore, idFactory: randomUUID24 });
   const lifecycle = createTaskLifecycleService({ taskStore: input.taskStore, workItemStore: input.taskWorkItemStore });
   const projection = new RoomProjectionService({
     messages: input.projectRoomMessageStore,
@@ -21768,7 +22909,7 @@ function createRuntime(input, stores, log2) {
     warnings: input.taskWorkItemStore,
     log: log2,
     realtime: input.realtime,
-    idFactory: randomUUID23
+    idFactory: randomUUID24
   });
   const agentFor = (task, thread) => agentInstanceManager6.getAgent({
     tenant_id: task.tenantId,
@@ -22595,7 +23736,7 @@ var collectionRegistration = {
 
 // src/export_registrations/channel-installation.registration.ts
 import { getStoreLattice as getStoreLattice24 } from "@axiom-lattice/core";
-import { randomUUID as randomUUID24 } from "crypto";
+import { randomUUID as randomUUID25 } from "crypto";
 var UUID_PATTERN2 = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
 var PUBLIC_CHANNELS = /* @__PURE__ */ new Set(["lark", "email", "slack", "wechat"]);
 function isPublicChannel(channel) {
@@ -22754,7 +23895,7 @@ var channelInstallationRegistration = {
       }
       id3 = sourceId;
     } else {
-      id3 = randomUUID24();
+      id3 = randomUUID25();
     }
     await store.createInstallation(tenantId, id3, createInput);
     return { newId: id3 };
@@ -23268,13 +24409,13 @@ function createRateLimitMiddleware(maxRequests = 10, windowMs = 60 * 1e3, maxEnt
 }
 
 // src/router/middlewares/auditLogger.ts
-var logger4 = new Logger({ serviceName: "lattice/gateway/audit" });
+var logger5 = new Logger({ serviceName: "lattice/gateway/audit" });
 function createAuditLoggerMiddleware() {
   return async (ctx, next) => {
     const start2 = Date.now();
     try {
       await next();
-      logger4.info("message routed", {
+      logger5.info("message routed", {
         event: "message:routed",
         channel: ctx.inboundMessage.channel,
         senderId: ctx.inboundMessage.sender.id,
@@ -23284,7 +24425,7 @@ function createAuditLoggerMiddleware() {
         status: "success"
       });
     } catch (error) {
-      logger4.error(
+      logger5.error(
         error instanceof Error ? error.message : String(error),
         {
           event: "message:error",
@@ -23365,6 +24506,7 @@ var configureSwagger = async (app2, customSwaggerConfig, customSwaggerUiConfig)
 };
 
 // src/services/agent_task_consumer.ts
+import { randomUUID as randomUUID26 } from "crypto";
 import { eventBus as eventBus3, AGENT_TASK_EVENT, agentInstanceManager as agentInstanceManager7, QueueMode as QueueMode2 } from "@axiom-lattice/core";
 var handleAgentTask = async (taskRequest, retryCount = 0) => {
   const {
@@ -23384,50 +24526,96 @@ var handleAgentTask = async (taskRequest, retryCount = 0) => {
       `\u5F00\u59CB\u5904\u7406\u4EFB\u52A1 [assistant_id: ${assistant_id}, thread_id: ${thread_id}]`
     );
     const agent = agentInstanceManager7.getAgent({ assistant_id, thread_id, tenant_id, workspace_id: runConfig?.workspaceId, project_id: runConfig?.projectId, custom_run_config: runConfig });
-    await agent.addMessage({ input, command, custom_run_config: runConfig }, QueueMode2.STEER);
     if (callback_event) {
-      agent.subscribeOnce("message:completed", (evt) => {
-        eventBus3.publish(callback_event, {
-          success: true,
-          state: evt.state
-        });
-        if (main_thread_id && main_tenant_id) {
-          try {
-            const mainAgent = agentInstanceManager7.getAgent({
-              assistant_id: main_assistant_id ?? assistant_id,
-              thread_id: main_thread_id,
-              tenant_id: main_tenant_id,
-              workspace_id: runConfig?.workspaceId,
-              project_id: runConfig?.projectId
-            });
-            if (mainAgent) {
-              const messages = evt.state?.values?.messages;
-              const lastAIMessage = messages?.filter((m) => m.type === "ai" || m.getType?.() === "ai").pop();
-              const summary = lastAIMessage?.content?.substring(0, 500) ?? "(no output)";
-              mainAgent.addMessage(
-                {
-                  input: {
-                    message: `[Async task completed]
+      const callbackEvent = callback_event;
+      const messageId = typeof input?.id === "string" && input.id !== "" ? input.id : randomUUID26();
+      let settled = false;
+      const subscriptions = [];
+      const dispose = () => {
+        for (const [eventName, handler] of subscriptions) {
+          agent.unsubscribe(eventName, handler);
+        }
+      };
+      const settle = (publish) => {
+        if (settled) return;
+        settled = true;
+        dispose();
+        publish();
+      };
+      const belongsToMessage = (evt) => evt?.messageId === messageId;
+      const onCompleted = (evt) => {
+        if (!belongsToMessage(evt)) return;
+        settle(() => {
+          eventBus3.publish(callbackEvent, {
+            success: true,
+            state: evt.state
+          });
+          if (main_thread_id && main_tenant_id) {
+            try {
+              const mainAgent = agentInstanceManager7.getAgent({
+                assistant_id: main_assistant_id ?? assistant_id,
+                thread_id: main_thread_id,
+                tenant_id: main_tenant_id,
+                workspace_id: runConfig?.workspaceId,
+                project_id: runConfig?.projectId
+              });
+              if (mainAgent) {
+                const messages = evt.state?.values?.messages;
+                const lastAIMessage = messages?.filter((m) => m.type === "ai" || m.getType?.() === "ai").pop();
+                const summary = lastAIMessage?.content?.substring(0, 500) ?? "(no output)";
+                mainAgent.addMessage(
+                  {
+                    input: {
+                      message: `[Async task completed]
 task_id: ${thread_id}
 ${summary}`
+                    }
                   }
-                }
-              ).catch((err) => {
-                console.error("Failed to notify main thread:", err);
-              });
-              mainAgent.updateAsyncTaskStatus(thread_id, "completed");
+                ).catch((err) => {
+                  console.error("Failed to notify main thread:", err);
+                });
+                mainAgent.updateAsyncTaskStatus(thread_id, "completed");
+              }
+            } catch (err) {
+              console.error("Failed to notify main thread:", err);
             }
-          } catch (err) {
-            console.error("Failed to notify main thread:", err);
           }
-        }
-      });
-      agent.subscribeOnce("message:interrupted", (evt) => {
-        eventBus3.publish(callback_event, {
-          success: true,
-          state: evt.state
         });
-      });
+      };
+      const onInterrupted = (evt) => {
+        if (!belongsToMessage(evt)) return;
+        settle(() => {
+          eventBus3.publish(callbackEvent, {
+            success: true,
+            state: evt.state
+          });
+        });
+      };
+      const onFailed = (evt) => {
+        if (!belongsToMessage(evt)) return;
+        settle(() => {
+          eventBus3.publish(callbackEvent, {
+            success: false,
+            error: evt?.error instanceof Error ? evt.error.message : typeof evt?.error === "string" ? evt.error : "Agent execution failed"
+          });
+        });
+      };
+      subscriptions.push(
+        ["message:completed", onCompleted],
+        ["message:interrupted", onInterrupted],
+        ["message:failed", onFailed]
+      );
+      agent.subscribe("message:completed", onCompleted);
+      agent.subscribe("message:interrupted", onInterrupted);
+      agent.subscribe("message:failed", onFailed);
+      try {
+        await agent.addMessage({ input: { ...input, id: messageId }, command, custom_run_config: runConfig }, QueueMode2.STEER);
+      } catch (error) {
+        dispose();
+        throw error;
+      }
+    } else {
+      await agent.addMessage({ input, command, custom_run_config: runConfig }, QueueMode2.STEER);
     }
     return true;
   } catch (error) {
@@ -23643,7 +24831,7 @@ import {
   snapshotExactArray as snapshotExactArray3,
   snapshotExactRecord as snapshotExactRecord15
 } from "@axiom-lattice/protocols";
-import { randomUUID as randomUUID25 } from "crypto";
+import { randomUUID as randomUUID27 } from "crypto";
 var BindingNotFoundError = class extends Error {
   constructor(message) {
     super(message);
@@ -23965,7 +25153,7 @@ var MessageRouter = class {
         }
         if (!threadId) {
           const threadStore = getStoreLattice27("default", "thread").store;
-          const newThreadId = randomUUID25();
+          const newThreadId = randomUUID27();
           console.log({
             event: "dispatch:thread:create",
             agentId,
@@ -24011,7 +25199,7 @@ var MessageRouter = class {
           workspace_id: binding?.workspaceId || "",
           project_id: binding?.projectId || ""
         });
-        const inputMessageId = randomUUID25();
+        const inputMessageId = randomUUID27();
         const replyTarget = internalRoom ? correlatedRoomReplyTarget(message.replyTarget, inputMessageId) : message.replyTarget;
         const replyAdapter = replyTarget ? this.adapterRegistry.get(replyTarget.adapterChannel) : void 0;
         if (options.trustedMessageOptions && (!this.trustedDispatcher || !replyTarget || !replyAdapter)) {
@@ -24191,9 +25379,9 @@ var MessageRouter = class {
 };
 
 // src/channels/room/RoomChannelAdapter.ts
-import { z as z11 } from "zod";
+import { z as z12 } from "zod";
 import { snapshotExactRecord as snapshotExactRecord16 } from "@axiom-lattice/protocols";
-var roomConfigSchema = z11.object({}).strict();
+var roomConfigSchema = z12.object({}).strict();
 function createRoomChannelAdapter(writer) {
   return {
     channel: "room",
@@ -24312,7 +25500,7 @@ var DEFAULT_LOGGER_CONFIG = {
   loggerName: "lattice/gateway"
 };
 var loggerLattice = initializeLogger(DEFAULT_LOGGER_CONFIG);
-var logger5 = loggerLattice.client;
+var logger6 = loggerLattice.client;
 function initializeLogger(config) {
   if (loggerLatticeManager.hasLattice("default")) {
     loggerLatticeManager.removeLattice("default");
@@ -24399,7 +25587,7 @@ app.setErrorHandler((error, request, reply) => {
     "x-request-id": getHeaderValue(request.headers["x-request-id"]),
     "x-user-id": getHeaderValue(request.headers["x-user-id"])
   };
-  logger5.error(
+  logger6.error(
     `\u8BF7\u6C42\u9519\u8BEF: ${request.method} ${request.url} error:${error.message}`,
     {
       ...context,
@@ -24434,14 +25622,14 @@ async function restoreMcpConnections() {
     const storeLattice = getStoreLattice28("default", "mcp");
     const store = storeLattice.store;
     if (!store) {
-      logger5.info("MCP store not configured, skipping connection restoration");
+      logger6.info("MCP store not configured, skipping connection restoration");
       return;
     }
     const configs = (await store.getAllConfigsWithoutTenant()).filter(
       (c2) => c2.status === "connected"
     );
     if (configs.length === 0) return;
-    logger5.info(`Restoring ${configs.length} MCP server connections...`);
+    logger6.info(`Restoring ${configs.length} MCP server connections...`);
     for (const config of configs) {
       try {
         const connection = convertToConnection2(config.config);
@@ -24451,7 +25639,7 @@ async function restoreMcpConnections() {
           selectedTools: config.selectedTools
         });
       } catch (err) {
-        logger5.warn(`Failed to prepare MCP server "${config.tenantId}/${config.key}"`, { error: err });
+        logger6.warn(`Failed to prepare MCP server "${config.tenantId}/${config.key}"`, { error: err });
       }
     }
     await mcpManager3.connectAll();
@@ -24467,15 +25655,15 @@ async function restoreMcpConnections() {
     results.forEach((result, index) => {
       if (result.status === "rejected") {
         const config = configs[index];
-        logger5.warn(
+        logger6.warn(
           `Failed to register tools for MCP server "${config.tenantId}/${config.key}"`,
           { error: result.reason }
         );
       }
     });
-    logger5.info(`MCP connection restoration complete: ${configs.length} servers`);
+    logger6.info(`MCP connection restoration complete: ${configs.length} servers`);
   } catch (err) {
-    logger5.error("MCP connection restoration failed", { error: err });
+    logger6.error("MCP connection restoration failed", { error: err });
   }
 }
 var start = async (config) => {
@@ -24488,7 +25676,7 @@ var start = async (config) => {
         file: config.loggerConfig.file || DEFAULT_LOGGER_CONFIG.file
       };
       loggerLattice = initializeLogger(loggerConfig);
-      logger5 = loggerLattice.client;
+      logger6 = loggerLattice.client;
     }
     app.decorate("loggerLattice", loggerLattice);
     const projectRoomRealtimeMode = resolveProjectRoomRealtimeMode();
@@ -24498,7 +25686,7 @@ var start = async (config) => {
         tasks: getStoreLattice28("default", "task").store,
         rooms: getStoreLattice28("default", "projectRoom").store,
         memberships: getStoreLattice28("default", "projectBotMembership").store,
-        log: { warn: (message, context) => logger5.warn(message, context) }
+        log: { warn: (message, context) => logger6.warn(message, context) }
       });
     }
     let channelDeps;
@@ -24517,7 +25705,7 @@ var start = async (config) => {
           createRateLimitMiddleware(),
           createAuditLoggerMiddleware()
         ],
-        warn: (message, context) => logger5.warn(message, context),
+        warn: (message, context) => logger6.warn(message, context),
         realtime: projectRoomRealtimeRuntime?.publisher
       });
       const bindingStore = infrastructure.bindingRegistry;
@@ -24531,10 +25719,10 @@ var start = async (config) => {
         installationStore,
         bindingRegistry: bindingStore,
         realtime: projectRoomRealtimeRuntime?.publisher,
-        warn: (message, context) => logger5.warn(message, context)
+        warn: (message, context) => logger6.warn(message, context)
       };
     } catch (err) {
-      logger5.warn("Channel infrastructure unavailable", {
+      logger6.warn("Channel infrastructure unavailable", {
         error: err instanceof Error ? err.message : String(err)
       });
     }
@@ -24542,7 +25730,7 @@ var start = async (config) => {
     try {
       const menuStore = getStoreLattice28("default", "menu").store;
       setMenuRegistry(menuStore);
-      logger5.info("Menu registry initialized");
+      logger6.info("Menu registry initialized");
     } catch {
     }
     registerAllBuiltinEntities();
@@ -24551,7 +25739,7 @@ var start = async (config) => {
     }
     const routes = registerLatticeRoutes(app, channelDeps, {
       projectTaskEnabled: process.env.AXIOM_PROJECT_TASK_EXECUTION_ENABLED !== "false",
-      projectTaskLog: { warn: (message, context) => logger5.warn(message, context) },
+      projectTaskLog: { warn: (message, context) => logger6.warn(message, context) },
       projectRoomRealtimeRuntime
     });
     try {
@@ -24579,9 +25767,9 @@ var start = async (config) => {
         getProjectStore: () => projectStore
       });
       a2a.registerA2ARoutes(app);
-      logger5.info("A2A standard routes registered");
+      logger6.info("A2A standard routes registered");
     } catch (err) {
-      logger5.warn("A2A standard routes unavailable", {
+      logger6.warn("A2A standard routes unavailable", {
         error: err instanceof Error ? err.message : String(err)
       });
     }
@@ -24618,15 +25806,15 @@ var start = async (config) => {
       registerOpenFilesRoutes(app);
       registerOpenAuditRoutes(app);
       registerOpenExposureRoutes(app);
-      logger5.info("Open API routes registered (kb + sandbox providers, session exchange)");
+      logger6.info("Open API routes registered (kb + sandbox providers, session exchange)");
     } catch (err) {
-      logger5.warn("Open API routes unavailable", {
+      logger6.warn("Open API routes unavailable", {
         error: err instanceof Error ? err.message : String(err)
       });
     }
     if (!sandboxLatticeManager2.hasLattice("default")) {
       sandboxLatticeManager2.registerLattice("default", getConfiguredSandboxProvider());
-      logger5.info("Registered sandbox manager from env configuration");
+      logger6.info("Registered sandbox manager from env configuration");
     }
     try {
       const { ResourceController } = await import("./resources-DXPXAXEZ.mjs");
@@ -24636,12 +25824,12 @@ var start = async (config) => {
         store: sharedResourceStore,
         sandboxManager: sandboxLatticeManager2,
         cache,
-        logger: logger5
+        logger: logger6
       });
       registerResourceRoutes(app, resourceController);
-      logger5.info("Resource share routes registered");
+      logger6.info("Resource share routes registered");
     } catch (err) {
-      logger5.warn("Resource share infrastructure unavailable", {
+      logger6.warn("Resource share infrastructure unavailable", {
         error: err instanceof Error ? err.message : String(err)
       });
     }
@@ -24653,17 +25841,17 @@ var start = async (config) => {
           { deps: { router: channelDeps.router } }
         );
       } catch (err) {
-        logger5.error("Failed to start channel connections", {
+        logger6.error("Failed to start channel connections", {
           error: err instanceof Error ? err.message : String(err)
         });
       }
     }
     const target_port = config?.port || Number(process.env.PORT) || 4001;
     if (routes.projectTaskRuntime) {
-      await prepareProjectTaskRuntime(routes.projectTaskRuntime, logger5);
+      await prepareProjectTaskRuntime(routes.projectTaskRuntime, logger6);
     }
     await app.listen({ port: target_port, host: "0.0.0.0" });
-    logger5.info(`Lattice Gateway is running on port: ${target_port}`);
+    logger6.info(`Lattice Gateway is running on port: ${target_port}`);
     const queueServiceConfig = config?.queueServiceConfig;
     if (queueServiceConfig) {
       setQueueServiceType(queueServiceConfig.type);
@@ -24674,16 +25862,16 @@ var start = async (config) => {
     }
     if (process.env.AXIOM_RESTORE_PENDING_ON_STARTUP === "true") {
       agentInstanceManager9.restore().then((stats) => {
-        logger5.info(`Agent recovery complete: ${stats.restored} threads restored, ${stats.errors} errors`);
+        logger6.info(`Agent recovery complete: ${stats.restored} threads restored, ${stats.errors} errors`);
       }).catch((error) => {
-        logger5.error("Agent recovery failed", { error });
+        logger6.error("Agent recovery failed", { error });
       });
     }
     restoreMcpConnections().catch((error) => {
-      logger5.error("MCP connection restoration failed", { error });
+      logger6.error("MCP connection restoration failed", { error });
     });
   } catch (err) {
-    logger5.error("Server start failed", { error: err });
+    logger6.error("Server start failed", { error: err });
     process.exit(1);
   }
 };