@axiom-lattice/gateway 4.9.1 → 4.10.0

package/dist/index.js

@@ -1731,25 +1731,25 @@ function extractText(msg) {
   }
   return null;
 }
-var import_zod18, logger6, wechatConfigSchema, MAX_RECONNECT_DELAY_MS, BASE_RECONNECT_DELAY_MS, HEARTBEAT_INTERVAL_MS, MSG_TYPE_USER, MSG_ITEM_TEXT, activeConnections2, seenClientIds, wechatChannelAdapter;
+var import_zod19, logger7, wechatConfigSchema, MAX_RECONNECT_DELAY_MS, BASE_RECONNECT_DELAY_MS, HEARTBEAT_INTERVAL_MS, MSG_TYPE_USER, MSG_ITEM_TEXT, activeConnections3, seenClientIds, wechatChannelAdapter;
 var init_WechatChannelAdapter = __esm({
   "src/channels/wechat/WechatChannelAdapter.ts"() {
     "use strict";
-    import_zod18 = require("zod");
+    import_zod19 = require("zod");
     init_wechat_client();
     init_context_store();
     init_Logger();
-    logger6 = new Logger({ serviceName: "lattice/gateway/wechat" });
-    wechatConfigSchema = import_zod18.z.object({
-      botToken: import_zod18.z.string(),
-      uin: import_zod18.z.string().optional()
+    logger7 = new Logger({ serviceName: "lattice/gateway/wechat" });
+    wechatConfigSchema = import_zod19.z.object({
+      botToken: import_zod19.z.string(),
+      uin: import_zod19.z.string().optional()
     });
     MAX_RECONNECT_DELAY_MS = 3e4;
     BASE_RECONNECT_DELAY_MS = 1e3;
     HEARTBEAT_INTERVAL_MS = 6e4;
     MSG_TYPE_USER = 1;
     MSG_ITEM_TEXT = 1;
-    activeConnections2 = /* @__PURE__ */ new Map();
+    activeConnections3 = /* @__PURE__ */ new Map();
     seenClientIds = /* @__PURE__ */ new Set();
     wechatChannelAdapter = {
       channel: "wechat",
@@ -1790,7 +1790,7 @@ var init_WechatChannelAdapter = __esm({
         const senderId = replyTarget.rawTarget.senderId;
         const contextToken = getContextToken(installation.id, senderId);
         if (!contextToken) {
-          logger6.warn("WeChat context token expired, cannot send reply", {
+          logger7.warn("WeChat context token expired, cannot send reply", {
             installationId: installation.id,
             senderId
           });
@@ -1808,24 +1808,24 @@ var init_WechatChannelAdapter = __esm({
       async connect(installation, deps) {
         const { id: installationId, tenantId, config } = installation;
         if (!config.botToken) {
-          logger6.warn("WeChat installation missing botToken, skipping", { installationId });
+          logger7.warn("WeChat installation missing botToken, skipping", { installationId });
           return;
         }
-        if (activeConnections2.has(installationId)) {
-          logger6.warn("WeChat polling already running for installation, skipping", { installationId });
+        if (activeConnections3.has(installationId)) {
+          logger7.warn("WeChat polling already running for installation, skipping", { installationId });
           return;
         }
-        logger6.info("WeChat polling starting", { installationId, tenantId });
+        logger7.info("WeChat polling starting", { installationId, tenantId });
         const abortController = new AbortController();
         const heartbeatTimer = setInterval(() => {
-          const state2 = activeConnections2.get(installationId);
+          const state2 = activeConnections3.get(installationId);
           if (!state2) {
             clearInterval(heartbeatTimer);
             return;
           }
           const elapsed = Date.now() - state2.lastActivity;
           if (elapsed > HEARTBEAT_INTERVAL_MS * 2) {
-            logger6.error("WeChat polling heartbeat lost \u2014 no activity", {
+            logger7.error("WeChat polling heartbeat lost \u2014 no activity", {
               installationId,
               elapsedMs: elapsed
             });
@@ -1838,26 +1838,26 @@ var init_WechatChannelAdapter = __esm({
           lastActivity: Date.now(),
           heartbeatTimer
         };
-        activeConnections2.set(installationId, state);
+        activeConnections3.set(installationId, state);
         const router = deps?.router;
         let syncBuffer = "";
         let reconnectDelay = BASE_RECONNECT_DELAY_MS;
         const scheduleNextPoll = () => {
           poll().catch((err) => {
-            logger6.error("WeChat poll iteration crashed", {
+            logger7.error("WeChat poll iteration crashed", {
               installationId,
               error: err instanceof Error ? err.message : String(err)
             });
-            const currentState = activeConnections2.get(installationId);
+            const currentState = activeConnections3.get(installationId);
             if (currentState && !currentState.abortController.signal.aborted) {
               setTimeout(scheduleNextPoll, reconnectDelay);
             }
           });
         };
         const poll = async () => {
-          const currentState = activeConnections2.get(installationId);
+          const currentState = activeConnections3.get(installationId);
           if (!currentState || currentState.abortController.signal.aborted) {
-            logger6.info("WeChat polling aborted", { installationId });
+            logger7.info("WeChat polling aborted", { installationId });
             return;
           }
           try {
@@ -1870,7 +1870,7 @@ var init_WechatChannelAdapter = __esm({
             reconnectDelay = BASE_RECONNECT_DELAY_MS;
             currentState.lastActivity = Date.now();
             if (result.msgs.length > 0) {
-              logger6.info("WeChat poll received messages", {
+              logger7.info("WeChat poll received messages", {
                 installationId,
                 count: result.msgs.length
               });
@@ -1887,7 +1887,7 @@ var init_WechatChannelAdapter = __esm({
               if (inbound && router) {
                 const dispatchResult = await router.dispatch(inbound);
                 if (!dispatchResult.success) {
-                  logger6.warn("WeChat dispatch failed", {
+                  logger7.warn("WeChat dispatch failed", {
                     installationId,
                     error: dispatchResult.error?.message
                   });
@@ -1896,10 +1896,10 @@ var init_WechatChannelAdapter = __esm({
             }
           } catch (err) {
             if (err instanceof Error && err.name === "AbortError") {
-              logger6.info("WeChat poll aborted by signal", { installationId });
+              logger7.info("WeChat poll aborted by signal", { installationId });
               return;
             }
-            logger6.error("WeChat poll error", {
+            logger7.error("WeChat poll error", {
               installationId,
               error: err instanceof Error ? err.message : String(err)
             });
@@ -1909,19 +1909,19 @@ var init_WechatChannelAdapter = __esm({
           scheduleNextPoll();
         };
         scheduleNextPoll();
-        logger6.info("WeChat polling started", { installationId });
+        logger7.info("WeChat polling started", { installationId });
       },
       async disconnect(installationId) {
-        const state = activeConnections2.get(installationId);
+        const state = activeConnections3.get(installationId);
         if (!state) {
-          logger6.warn("WeChat polling not running, nothing to disconnect", { installationId });
+          logger7.warn("WeChat polling not running, nothing to disconnect", { installationId });
           return;
         }
-        logger6.info("WeChat polling disconnecting", { installationId });
+        logger7.info("WeChat polling disconnecting", { installationId });
         state.abortController.abort();
         clearInterval(state.heartbeatTimer);
-        activeConnections2.delete(installationId);
-        logger6.info("WeChat polling disconnected", { installationId });
+        activeConnections3.delete(installationId);
+        logger7.info("WeChat polling disconnected", { installationId });
       }
     };
   }
@@ -3601,11 +3601,11 @@ function grantCovers(grants, domain, action) {
     (g) => g.domain === domain && (!g.items || g.items.length === 0 || g.items.includes(action))
   );
 }
-var import_zod19, GrantDeniedError, ValidationError, ActionNotFoundError, OpenLattice, openLattice;
+var import_zod20, GrantDeniedError, ValidationError, ActionNotFoundError, OpenLattice, openLattice;
 var init_openLattice = __esm({
   "src/services/open/openLattice.ts"() {
     "use strict";
-    import_zod19 = require("zod");
+    import_zod20 = require("zod");
     GrantDeniedError = class extends Error {
       constructor(toolName) {
         super(`GRANT_DENIED: no grant covers ${toolName}`);
@@ -3745,7 +3745,7 @@ var init_openLattice = __esm({
           throw new GrantDeniedError(toolName);
         }
         const resolvedSchema = resolved.action.schema;
-        const parsed = "safeParse" in resolvedSchema ? resolvedSchema.safeParse(args) : import_zod19.z.object(resolvedSchema).safeParse(args);
+        const parsed = "safeParse" in resolvedSchema ? resolvedSchema.safeParse(args) : import_zod20.z.object(resolvedSchema).safeParse(args);
         if (!parsed.success) {
           throw new ValidationError(parsed.error.issues.map((i) => `${i.path.join(".")}: ${i.message}`).join("; "));
         }
@@ -3878,7 +3878,7 @@ var init_openMcpServer = __esm({
 
 // src/services/open/pluginExposeAdapter.ts
 function schemaOf(tool) {
-  return tool.lc_kwargs?.schema ?? tool.schema ?? import_zod20.z.object({}).passthrough();
+  return tool.lc_kwargs?.schema ?? tool.schema ?? import_zod21.z.object({}).passthrough();
 }
 function createPluginProvider(domain, tools, options = {}) {
   function toAction(info) {
@@ -3926,11 +3926,11 @@ function createPluginProvider(domain, tools, options = {}) {
     }
   };
 }
-var import_zod20;
+var import_zod21;
 var init_pluginExposeAdapter = __esm({
   "src/services/open/pluginExposeAdapter.ts"() {
     "use strict";
-    import_zod20 = require("zod");
+    import_zod21 = require("zod");
   }
 });
 
@@ -4571,21 +4571,21 @@ function createOpenSandboxProvider() {
         name: "files_read",
         label: "Read files",
         description: "Read a file from the project sandbox.",
-        schema: { path: import_zod21.z.string().min(1) },
+        schema: { path: import_zod22.z.string().min(1) },
         annotations: { readOnlyHint: true, destructiveHint: false }
       },
       {
         name: "files_list",
         label: "List files",
         description: "List files under a directory in the project sandbox.",
-        schema: { path: import_zod21.z.string(), recursive: import_zod21.z.boolean().optional() },
+        schema: { path: import_zod22.z.string(), recursive: import_zod22.z.boolean().optional() },
         annotations: { readOnlyHint: true, destructiveHint: false }
       },
       {
         name: "files_write",
         label: "Write files",
         description: "Write content to a file in the project sandbox.",
-        schema: { path: import_zod21.z.string().min(1), content: import_zod21.z.string() },
+        schema: { path: import_zod22.z.string().min(1), content: import_zod22.z.string() },
         annotations: { readOnlyHint: false, destructiveHint: true }
       },
       {
@@ -4593,9 +4593,9 @@ function createOpenSandboxProvider() {
         label: "Run shell commands",
         description: "Execute a shell command in the project sandbox. Returns stdout (up to 64KB) and exit code.",
         schema: {
-          command: import_zod21.z.string().min(1),
-          exec_dir: import_zod21.z.string().optional(),
-          timeout: import_zod21.z.number().int().min(1e3).optional()
+          command: import_zod22.z.string().min(1),
+          exec_dir: import_zod22.z.string().optional(),
+          timeout: import_zod22.z.number().int().min(1e3).optional()
         },
         annotations: { readOnlyHint: false, destructiveHint: true }
       }
@@ -4625,7 +4625,7 @@ function createOpenSandboxProvider() {
           const result = await sandbox.shell.execCommand({
             command,
             exec_dir,
-            timeout: timeout ?? 12e4
+            timeoutMs: timeout ?? 12e4
           });
           const truncated = result.output.length > MAX_OUTPUT_BYTES ? result.output.slice(0, MAX_OUTPUT_BYTES) + `
 ...[truncated ${result.output.length - MAX_OUTPUT_BYTES} bytes]` : result.output;
@@ -4650,11 +4650,11 @@ ${truncated}`
     }
   };
 }
-var import_zod21, import_core89, MAX_OUTPUT_BYTES;
+var import_zod22, import_core89, MAX_OUTPUT_BYTES;
 var init_sandboxProvider = __esm({
   "src/services/open/providers/sandboxProvider.ts"() {
     "use strict";
-    import_zod21 = require("zod");
+    import_zod22 = require("zod");
     import_core89 = require("@axiom-lattice/core");
     MAX_OUTPUT_BYTES = 64e3;
   }
@@ -4952,9 +4952,9 @@ function createKbProvider(collectionService3) {
         label: "Search collections",
         description: "Search a knowledge base collection. Returns matched entries with content, metadata and similarity score.",
         schema: {
-          collection: import_zod22.z.string().min(1),
-          query: import_zod22.z.string().min(1),
-          limit: import_zod22.z.number().int().min(1).max(50).optional()
+          collection: import_zod23.z.string().min(1),
+          query: import_zod23.z.string().min(1),
+          limit: import_zod23.z.number().int().min(1).max(50).optional()
         },
         annotations: { readOnlyHint: true, destructiveHint: false }
       }
@@ -4982,11 +4982,11 @@ function createKbProvider(collectionService3) {
     }
   };
 }
-var import_zod22;
+var import_zod23;
 var init_kbProvider = __esm({
   "src/services/open/providers/kbProvider.ts"() {
     "use strict";
-    import_zod22 = require("zod");
+    import_zod23 = require("zod");
   }
 });
 
@@ -5024,7 +5024,7 @@ function createAgentProvider(deps = {}) {
             toolName: `invoke_${assistantId}`,
             label: name,
             description: `Invoke the "${name}" agent${description ? ` \u2014 ${description}` : ""}. Returns its final reply.`,
-            schema: { message: import_zod23.z.string().min(1) },
+            schema: { message: import_zod24.z.string().min(1) },
             annotations: { readOnlyHint: false, destructiveHint: false }
           };
         })
@@ -5072,11 +5072,11 @@ function createAgentProvider(deps = {}) {
     }
   };
 }
-var import_zod23, import_core93, import_protocols39, STOP_TYPES;
+var import_zod24, import_core93, import_protocols39, STOP_TYPES;
 var init_agentProvider = __esm({
   "src/services/open/providers/agentProvider.ts"() {
     "use strict";
-    import_zod23 = require("zod");
+    import_zod24 = require("zod");
     import_core93 = require("@axiom-lattice/core");
     import_protocols39 = require("@axiom-lattice/protocols");
     STOP_TYPES = [import_protocols39.MessageChunkTypes.MESSAGE_COMPLETED];
@@ -14567,19 +14567,19 @@ var EvalRunner = class {
     const judgeModelKey = judgeCfg.modelKey || "";
     let resolvedJudgeModelKey;
     if (judgeModelKey) {
-      if (!import_core37.modelLatticeManager.hasLattice(judgeModelKey)) {
+      if (!await (0, import_core37.hasModelLatticeForTenant)(tenantId, judgeModelKey)) {
         throw new Error(`Judge model "${judgeModelKey}" is not registered`);
       }
       resolvedJudgeModelKey = judgeModelKey;
     } else {
-      const models = import_core37.modelLatticeManager.getAllLattices();
-      const defaultModel = models.find((m) => m.key === "default");
-      resolvedJudgeModelKey = defaultModel?.key ?? models[0]?.key ?? "";
-      if (!resolvedJudgeModelKey) {
-        throw new Error("No model registered \u2014 cannot run eval without a judge model");
-      }
-      if (!defaultModel) {
-        console.warn(`[eval-runner] Project "${project.name}" has no judge modelKey and no "default" model \u2014 falling back to first registered model "${resolvedJudgeModelKey}"`);
+      resolvedJudgeModelKey = "default";
+      if (!await (0, import_core37.hasModelLatticeForTenant)(tenantId, resolvedJudgeModelKey)) {
+        const models = (0, import_core37.listModelLatticesForTenant)(tenantId);
+        resolvedJudgeModelKey = models[0]?.key ?? "";
+        if (!resolvedJudgeModelKey) {
+          throw new Error("No model registered \u2014 cannot run eval without a judge model");
+        }
+        console.warn(`[eval-runner] Project "${project.name}" has no judge modelKey and no default model \u2014 falling back to "${resolvedJudgeModelKey}"`);
       }
     }
     const runId = (0, import_uuid4.v4)();
@@ -14832,7 +14832,7 @@ async function createProject(request, reply) {
     const judgeCfg = data.judgeModelConfig || {};
     const modelKey2 = judgeCfg.modelKey || "";
     if (modelKey2) {
-      if (!import_core38.modelLatticeManager.hasLattice(modelKey2)) {
+      if (!await (0, import_core38.hasModelLatticeForTenant)(tenantId, modelKey2)) {
         return reply.status(400).send({ success: false, message: `Judge model "${modelKey2}" is not registered` });
       }
     }
@@ -16375,6 +16375,9 @@ function isLarkConfig(config) {
 function isWechatConfig(config) {
   return isString(config.botToken) && isOptionalString(config.uin);
 }
+function isWecomConfig(config) {
+  return isString(config.botId) && isString(config.secret) && isOptionalString(config.assistantId);
+}
 function snapshotPublicCreateRequest(value) {
   const body = snapshotPlainObject(value);
   const allowedKeys = /* @__PURE__ */ new Set([
@@ -16401,6 +16404,9 @@ function snapshotPublicCreateRequest(value) {
   if (body.channel === "wechat" && isWechatConfig(config)) {
     return { ...base, channel: "wechat", config };
   }
+  if (body.channel === "wecom" && isWecomConfig(config)) {
+    return { ...base, channel: "wecom", config };
+  }
   if (body.channel === "email" || body.channel === "slack") return { ...base, channel: body.channel, config };
   return null;
 }
@@ -16421,6 +16427,7 @@ function snapshotPublicUpdateRequest(value, channel) {
     if (!config) return null;
     if (channel === "lark" && !isLarkConfig(config)) return null;
     if (channel === "wechat" && !isWechatConfig(config)) return null;
+    if (channel === "wecom" && !isWecomConfig(config)) return null;
   }
   return {
     name: body.name,
@@ -16773,7 +16780,7 @@ function registerChannelInstallationRoutes(app2) {
         type: "object",
         additionalProperties: false,
         properties: {
-          channel: { type: "string", enum: ["lark", "email", "slack", "wechat"] }
+          channel: { type: "string", enum: ["lark", "email", "slack", "wechat", "wecom"] }
         }
       }
     }
@@ -19710,10 +19717,14 @@ var AgentWebAppService = class {
         throw new AgentWebAppError("PROJECT_NOT_FOUND", 404, "Project not found");
       }
     }
-    const scope = this.validateModels(input.scope, input.features.modelSelector);
+    const scope = await this.validateModels(
+      tenantId,
+      input.scope,
+      input.features.modelSelector
+    );
     return { ...input, scope: { ...scope, allowedProjectIds } };
   }
-  validateModels(scope, modelSelector) {
+  async validateModels(tenantId, scope, modelSelector) {
     const allowedModelKeys = scope.allowedModelKeys ? [...new Set(scope.allowedModelKeys)] : void 0;
     if (!allowedModelKeys?.length) {
       if (scope.defaultModelKey || modelSelector) {
@@ -19728,7 +19739,7 @@ var AgentWebAppService = class {
       throw new AgentWebAppError("MODEL_SCOPE_INVALID", 400, "Default model must be in the model allowlist");
     }
     for (const key of allowedModelKeys) {
-      if (!this.deps.modelRegistry.has(key)) {
+      if (!await this.deps.modelRegistry.has(tenantId, key)) {
         throw new AgentWebAppError("MODEL_NOT_FOUND", 400, "Configured model is not registered");
       }
     }
@@ -19958,15 +19969,22 @@ var AgentWebAppRuntimeService = class {
       return { id: project.id, name: project.name };
     }));
     const defaultModelKey = runtime.webApp.scope.defaultModelKey;
-    if (defaultModelKey && !this.deps.modelRegistry.has(defaultModelKey)) {
+    const tenantId = runtime.webApp.tenantId;
+    if (defaultModelKey && !await this.deps.modelRegistry.has(tenantId, defaultModelKey)) {
       this.fail("MODEL_NOT_ALLOWED", 400, "Default model is not available");
     }
     const configuredPublicModelKeys = runtime.webApp.features.modelSelector ? runtime.webApp.scope.allowedModelKeys ?? [] : defaultModelKey ? [defaultModelKey] : [];
-    const publicModelKeys = [...new Set(configuredPublicModelKeys)].filter((key) => this.deps.modelRegistry.has(key));
-    const models = publicModelKeys.map((key) => ({
-      key,
-      label: this.deps.modelRegistry.label(key)
-    }));
+    const candidateModelKeys = [...new Set(configuredPublicModelKeys)];
+    const resolvable = await Promise.all(
+      candidateModelKeys.map((key) => this.deps.modelRegistry.has(tenantId, key))
+    );
+    const publicModelKeys = candidateModelKeys.filter((_, index) => resolvable[index]);
+    const models = await Promise.all(
+      publicModelKeys.map(async (key) => ({
+        key,
+        label: await this.deps.modelRegistry.label(tenantId, key)
+      }))
+    );
     const result = {
       webApp: {
         id: runtime.webApp.id,
@@ -20189,7 +20207,7 @@ ${formatFileRefsSection(refs)}` : input.content;
     }
     const modelKey2 = selection.modelKey ?? webApp.scope.defaultModelKey;
     const allowedModels = webApp.scope.allowedModelKeys;
-    if (modelKey2 && (!allowedModels?.includes(modelKey2) || !this.deps.modelRegistry.has(modelKey2))) {
+    if (modelKey2 && (!allowedModels?.includes(modelKey2) || !await this.deps.modelRegistry.has(webApp.tenantId, modelKey2))) {
       this.fail("MODEL_NOT_ALLOWED", 400, "Model is not allowed");
     }
     return { webApp, project, modelKey: modelKey2 };
@@ -21752,7 +21770,6 @@ function getDiscoveryAdapter(protocol) {
 
 // src/services/model-provider/ModelProviderService.ts
 var PHASE1_REGISTRY_TENANT = "default";
-var ALLOWED_LLM_PROVIDERS = /* @__PURE__ */ new Set(["openai"]);
 var unsafeReasonToErrorCode = {
   INVALID_BASE_URL: "INVALID_BASE_URL",
   UNSUPPORTED_SCHEME: "INVALID_BASE_URL",
@@ -21819,6 +21836,8 @@ var ModelProviderService = class {
       source: "snapshot",
       enabled: model.enabled,
       stale: model.stale ?? false,
+      extra: model.extra,
+      isDefault: model.isDefault,
       executable: model.enabled && // A disabled provider is a kill switch: its models stay visible in the
       // catalog but are no longer reported as runnable.
       !disabledProviderIds.has(model.providerId) && this.deps.registry.has(
@@ -21826,20 +21845,20 @@ var ModelProviderService = class {
         (0, import_protocols16.toModelKey)(model.providerId, model.modelId)
       )
     }));
-    const known = new Set(models.map((model) => model.modelKey));
-    for (const modelKey2 of this.deps.registry.listRegistered(tenantId)) {
-      if (known.has(modelKey2)) {
-        continue;
+    if (models.length === 0) {
+      for (const modelKey2 of this.deps.registry.listRegistered(
+        PHASE1_REGISTRY_TENANT
+      )) {
+        models.push({
+          modelKey: modelKey2,
+          providerId: "",
+          providerName: "registered",
+          source: "registered",
+          enabled: true,
+          stale: false,
+          executable: true
+        });
       }
-      models.push({
-        modelKey: modelKey2,
-        providerId: "",
-        providerName: "registered",
-        source: "registered",
-        enabled: true,
-        stale: false,
-        executable: true
-      });
     }
     return {
       providers: providers.map(
@@ -21916,7 +21935,6 @@ var ModelProviderService = class {
    */
   async create(userId, tenantId, input) {
     await this.assertAdmin(userId, tenantId);
-    this.assertHasApiKey(input.apiKey);
     if (!getDiscoveryAdapter(input.protocol)) {
       throw new ModelProviderServiceError(
         "UNSUPPORTED_PROTOCOL",
@@ -21957,9 +21975,6 @@ var ModelProviderService = class {
   async update(userId, tenantId, id3, updates) {
     await this.assertAdmin(userId, tenantId);
     const existing = await this.requireProvider(tenantId, id3);
-    if (updates.clearApiKey || !(updates.apiKey?.trim() || existing.apiKey)) {
-      this.assertHasApiKey(void 0);
-    }
     if (updates.protocol && !getDiscoveryAdapter(updates.protocol)) {
       throw new ModelProviderServiceError(
         "UNSUPPORTED_PROTOCOL",
@@ -22080,6 +22095,8 @@ var ModelProviderService = class {
       void 0,
       now
     );
+    await this.ensureDefaultModel(tenantId);
+    this.deps.registry.forgetTenantDefaultMiss?.(tenantId);
     const registered = [];
     if (this.shouldRegister(tenantId)) {
       const snapshot = await this.deps.providerStore.listModels(tenantId, id3);
@@ -22180,6 +22197,13 @@ var ModelProviderService = class {
   async setModels(userId, tenantId, id3, selection) {
     await this.assertAdmin(userId, tenantId);
     const provider = await this.requireProvider(tenantId, id3);
+    if (selection.filter((entry) => entry.isDefault === true).length > 1) {
+      throw new ModelProviderServiceError(
+        "INVALID_INPUT",
+        400,
+        "Only one model can be the tenant's default"
+      );
+    }
     const previous = await this.deps.providerStore.listModels(tenantId, id3);
     const previousById = new Map(
       previous.map((model) => [model.modelId, model])
@@ -22197,9 +22221,18 @@ var ModelProviderService = class {
         // The selection carries only ids and states, so a model already in the
         // snapshot keeps the metadata discovery gave it.
         displayName: previousById.get(entry.modelId)?.displayName,
-        ownedBy: previousById.get(entry.modelId)?.ownedBy
+        ownedBy: previousById.get(entry.modelId)?.ownedBy,
+        // An omitted `extra` means "keep what is stored" — the picker sends no
+        // config, and a sync must not wipe one set by hand. The store resolves
+        // the fallback against the row's current value.
+        extra: entry.extra,
+        // Same rule: omitted leaves the flag alone, so a sync cannot quietly
+        // move the tenant's default.
+        isDefault: entry.isDefault
       }))
     );
+    await this.ensureDefaultModel(tenantId);
+    this.deps.registry.forgetTenantDefaultMiss?.(tenantId);
     const models = await this.deps.providerStore.listModels(tenantId, id3);
     const kept = new Set(models.map((model) => model.modelId));
     for (const model of previous) {
@@ -22214,6 +22247,40 @@ var ModelProviderService = class {
     this.notifyChanged(tenantId, id3);
     return this.toPublicEntry(provider, models.length);
   }
+  /**
+   * Give a tenant's sole model the default flag.
+   *
+   * A tenant with exactly one runnable model has an obvious default, and saying
+   * so is what keeps the invariant the rest of the feature leans on: a tenant
+   * either has no models at all — and falls back to the deployment's default —
+   * or has a default, which cannot be deleted. Without this a tenant could sit
+   * with one model and no default, and deleting that model would leave nothing
+   * behind.
+   *
+   * Deliberately narrow: more than one model is the tenant's choice to make,
+   * and a disabled model is not a candidate for "the model this tenant runs".
+   *
+   * @param tenantId - The tenant whose model set just changed
+   */
+  async ensureDefaultModel(tenantId) {
+    const models = await this.deps.providerStore.listModels(tenantId);
+    if (models.length !== 1) {
+      return;
+    }
+    const [only] = models;
+    if (only.isDefault || !only.enabled) {
+      return;
+    }
+    await this.deps.providerStore.replaceProviderModels(tenantId, only.providerId, [
+      {
+        id: only.modelId,
+        enabled: only.enabled,
+        stale: only.stale,
+        extra: only.extra,
+        isDefault: true
+      }
+    ]);
+  }
   syncRegistry(tenantId, provider, models) {
     if (!this.shouldRegister(tenantId)) {
       return [];
@@ -22228,7 +22295,7 @@ var ModelProviderService = class {
       this.deps.registry.register(
         tenantId,
         modelKey2,
-        this.toLlmConfig(provider, model.modelId)
+        this.buildLlmConfig(provider, model)
       );
       registered.push(modelKey2);
     }
@@ -22241,6 +22308,28 @@ var ModelProviderService = class {
     } catch {
     }
   }
+  /**
+   * Build a model's runtime config, keeping this service's error contract.
+   *
+   * The builder itself lives in core, because the registry's lazy loader needs
+   * the same one when a replica materialises a model it never discovered.
+   * Wrapping here preserves the `ModelProviderServiceError` the API layer
+   * renders — core cannot import a gateway error type.
+   */
+  buildLlmConfig(provider, model) {
+    try {
+      return (0, import_core52.buildModelLlmConfig)(provider, model);
+    } catch (error) {
+      if (error instanceof import_core52.UnsupportedModelProviderError) {
+        throw new ModelProviderServiceError(
+          "UNSUPPORTED_PROTOCOL",
+          400,
+          "Provider is configured with an unsupported LLM provider"
+        );
+      }
+      throw error;
+    }
+  }
   /**
    * Enable or disable a single discovered model.
    */
@@ -22271,34 +22360,6 @@ var ModelProviderService = class {
   shouldRegister(tenantId) {
     return tenantId === PHASE1_REGISTRY_TENANT;
   }
-  /**
-   * Build the runtime LLM config for a discovered model.
-   *
-   * `apiKeyEnvName`, `extra` and `modelKwargs` are deliberately omitted — they
-   * would let a tenant name an arbitrary process environment variable to read
-   * credentials from, or inject arbitrary constructor options.
-   */
-  toLlmConfig(provider, modelId) {
-    if (!ALLOWED_LLM_PROVIDERS.has(provider.llmProvider)) {
-      throw new ModelProviderServiceError(
-        "UNSUPPORTED_PROTOCOL",
-        400,
-        "Provider is configured with an unsupported LLM provider"
-      );
-    }
-    return {
-      provider: provider.llmProvider,
-      model: modelId,
-      displayName: modelId,
-      streaming: true,
-      apiKey: provider.apiKey,
-      baseURL: provider.baseURL,
-      // Chat Completions and the Responses API are different routes with
-      // different request fields; without this the gateway would post
-      // `messages` to an endpoint expecting `input`.
-      ...provider.apiStyle === "responses" ? { useResponsesApi: true } : {}
-    };
-  }
   /**
    * The sole projection from an internal provider entry to an API-safe shape.
    */
@@ -22323,21 +22384,6 @@ var ModelProviderService = class {
       updatedAt: provider.updatedAt.toISOString()
     };
   }
-  /**
-   * Reject a provider that would end up without a credential.
-   *
-   * @param apiKey - The key the provider would hold, if any
-   * @throws {ModelProviderServiceError} When no key is present
-   */
-  assertHasApiKey(apiKey) {
-    if (!apiKey?.trim()) {
-      throw new ModelProviderServiceError(
-        "INVALID_INPUT",
-        400,
-        "A model provider must have an API key"
-      );
-    }
-  }
   /**
    * Load a provider or fail with 404.
    *
@@ -22447,15 +22493,18 @@ var providerId = import_zod10.z.string().trim().min(1).max(255);
 var providerParamsSchema = import_zod10.z.object({ providerId }).strict();
 var protocolSchema = import_zod10.z.enum(["openai-compatible"]);
 var apiStyleSchema = import_zod10.z.enum(["chat-completions", "responses"]);
+var extraSchema = import_zod10.z.record(import_zod10.z.string(), import_zod10.z.unknown());
 var createProviderSchema = import_zod10.z.object({
   name: import_zod10.z.string().trim().min(1).max(255),
   displayName: import_zod10.z.string().trim().max(255).optional(),
   protocol: protocolSchema,
   apiStyle: apiStyleSchema.optional(),
   baseURL: import_zod10.z.string().trim().min(1).max(2048),
-  // Required, not optional: see CreateModelProviderRequest.apiKey — a
-  // keyless provider would make the gateway send its own env credential.
-  apiKey: import_zod10.z.string().trim().min(1).max(1024),
+  // Optional: omitting it means the upstream needs no authentication, which
+  // is the normal case for a locally hosted model server. The service turns
+  // that into an explicit no-auth marker rather than an absent key, so the
+  // runtime never falls back to the gateway's own environment credentials.
+  apiKey: import_zod10.z.string().trim().max(1024).optional(),
   enabled: import_zod10.z.boolean().optional()
 }).strict();
 var updateProviderSchema = createProviderSchema.partial().extend({
@@ -22475,7 +22524,15 @@ var setModelsSchema = import_zod10.z.object({
     import_zod10.z.object({
       modelId: import_zod10.z.string().trim().min(1).max(512),
       enabled: import_zod10.z.boolean(),
-      stale: import_zod10.z.boolean().optional()
+      stale: import_zod10.z.boolean().optional(),
+      // Omitted means "leave the stored config alone" — the picker sends
+      // only ids and states, and must not wipe a config set by hand.
+      extra: extraSchema.optional(),
+      // At most one per tenant; the service rejects a tie with a
+      // readable error rather than letting the unique index raise one.
+      // Omitted means "leave the stored flag alone", which is what a
+      // sync carries.
+      isDefault: import_zod10.z.boolean().optional()
     }).strict()
   ).max(1e3)
 }).strict();
@@ -28852,7 +28909,8 @@ var registerLatticeRoutes = (app2, channelDeps, options = {}) => {
       register: (tenantId, modelKey2, config) => import_core57.modelLatticeManager.registerLatticeWithTenant(tenantId, modelKey2, config),
       has: (tenantId, modelKey2) => import_core57.modelLatticeManager.hasLatticeWithTenant(tenantId, modelKey2),
       remove: (tenantId, modelKey2) => import_core57.modelLatticeManager.removeLatticeWithTenant(tenantId, modelKey2),
-      listRegistered: (tenantId) => import_core57.modelLatticeManager.getLatticeKeysByTenant(tenantId)
+      listRegistered: (tenantId) => import_core57.modelLatticeManager.getLatticeKeysByTenant(tenantId),
+      forgetTenantDefaultMiss: (tenantId) => import_core57.modelLatticeManager.forgetTenantDefaultMiss(tenantId)
     },
     onChanged: (tenantId, providerId2) => broadcastModelProviderChanged(tenantId, providerId2)
   }, { authRequired: process.env.AUTH_REQUIRED === "true" });
@@ -28863,7 +28921,9 @@ var registerLatticeRoutes = (app2, channelDeps, options = {}) => {
       webAppStore,
       assistantStore,
       projectStore,
-      modelRegistry: { has: (key) => import_core57.modelLatticeManager.hasLattice(key) },
+      modelRegistry: {
+        has: (tenantId, key) => (0, import_core57.hasModelLatticeForTenant)(tenantId, key)
+      },
       configuredAgentResolver: createConfiguredAgentResolver({
         hydrate: (tenantId) => import_core57.agentLatticeManager.initializeStoredAssistantsForTenant(tenantId),
         has: (tenantId, assistantId) => import_core57.agentLatticeManager.hasAgentLatticeWithTenant(tenantId, assistantId)
@@ -28920,8 +28980,8 @@ var registerLatticeRoutes = (app2, channelDeps, options = {}) => {
         }
       },
       modelRegistry: {
-        has: (key) => import_core57.modelLatticeManager.hasLattice(key),
-        label: (key) => key
+        has: (tenantId, key) => (0, import_core57.hasModelLatticeForTenant)(tenantId, key),
+        label: async (tenantId, key) => (await (0, import_core57.resolveModelLatticeForTenant)(tenantId, key))?.client.getConfig().displayName ?? key
       },
       messageReader: {
         getCurrentMessages: ({ tenantId, assistantId, threadId, workspaceId, projectId }) => import_core57.agentInstanceManager.getAgentForRead({
@@ -30217,7 +30277,7 @@ var collectionRegistration = {
 var import_core66 = require("@axiom-lattice/core");
 var import_crypto11 = require("crypto");
 var UUID_PATTERN2 = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
-var PUBLIC_CHANNELS = /* @__PURE__ */ new Set(["lark", "email", "slack", "wechat"]);
+var PUBLIC_CHANNELS = /* @__PURE__ */ new Set(["lark", "email", "slack", "wechat", "wecom"]);
 function isPublicChannel(channel) {
   return typeof channel === "string" && PUBLIC_CHANNELS.has(channel);
 }
@@ -30238,6 +30298,9 @@ function validateImportData(data) {
   if (channel === "wechat" && typeof configRecord.botToken !== "string") {
     throw new Error("WeChat channel installation config requires botToken");
   }
+  if (channel === "wecom" && (typeof configRecord.botId !== "string" || typeof configRecord.secret !== "string")) {
+    throw new Error("WeCom channel installation config requires botId and secret");
+  }
   return {
     channel,
     name: typeof data.name === "string" ? data.name : void 0,
@@ -30923,6 +30986,192 @@ function createAuditLoggerMiddleware() {
 // src/index.ts
 var import_core97 = require("@axiom-lattice/core");
 
+// src/channels/wecom/WecomChannelAdapter.ts
+var import_zod17 = require("zod");
+var WecomAiBot = __toESM(require("@wecom/aibot-node-sdk"));
+
+// src/channels/wecom/parser.ts
+function parseWecomTextFrame(frame) {
+  if (!frame || typeof frame !== "object") return null;
+  const { headers, body } = frame;
+  const reqId = headers?.req_id;
+  if (typeof reqId !== "string" || !body) return null;
+  if (body.msgtype !== "text") return null;
+  const fromUserId = body.from?.userid;
+  const content = body.text?.content;
+  if (typeof fromUserId !== "string" || typeof content !== "string") {
+    return null;
+  }
+  return {
+    reqId,
+    msgId: typeof body.msgid === "string" ? body.msgid : "",
+    fromUserId,
+    chatId: typeof body.chatid === "string" ? body.chatid : void 0,
+    chatType: body.chattype === "group" ? "group" : "direct",
+    text: content
+  };
+}
+
+// src/channels/wecom/WecomChannelAdapter.ts
+init_Logger();
+var logger6 = new Logger({ serviceName: "lattice/gateway/wecom" });
+var wecomConfigSchema = import_zod17.z.object({
+  botId: import_zod17.z.string(),
+  secret: import_zod17.z.string()
+});
+var RECONNECT_BASE_MS = 5e3;
+var RECONNECT_MAX_MS = 6e4;
+var activeConnections2 = /* @__PURE__ */ new Map();
+var wecomChannelAdapter = {
+  channel: "wecom",
+  configSchema: wecomConfigSchema,
+  async receive(rawPayload, installation) {
+    const parsed = parseWecomTextFrame(rawPayload);
+    if (!parsed) return null;
+    return {
+      channel: "wecom",
+      channelInstallationId: installation.id,
+      tenantId: installation.tenantId,
+      sender: { id: parsed.fromUserId },
+      content: {
+        text: parsed.text,
+        // `messageId` 供去重中间件使用（企业微信可能重投同一 msgid）。
+        metadata: {
+          messageId: parsed.msgId,
+          chatId: parsed.chatId,
+          chatType: parsed.chatType
+        }
+      },
+      conversation: {
+        id: parsed.chatId ?? parsed.fromUserId,
+        type: parsed.chatType
+      },
+      replyTarget: {
+        adapterChannel: "wecom",
+        channelInstallationId: installation.id,
+        // 回复需原样带回入站帧（含 `headers.req_id`）。frame 是纯 JSON，
+        // replyTarget 仅在内存流转，不落库。
+        rawTarget: { frame: rawPayload }
+      }
+    };
+  },
+  async sendReply(replyTarget, message, installation) {
+    const connection = activeConnections2.get(installation.id);
+    if (!connection) {
+      logger6.warn("WeCom bot not connected, cannot reply", {
+        installationId: installation.id
+      });
+      return;
+    }
+    connection.client.reply(replyTarget.rawTarget.frame, {
+      msgtype: "text",
+      text: { content: message.text }
+    });
+  },
+  resolveThreadId(message, binding) {
+    const date = (/* @__PURE__ */ new Date()).toISOString().split("T")[0];
+    const agentId = binding.agentId;
+    if (message.conversation?.type === "group") {
+      return `wecom:group:${message.conversation.id}:${agentId}:${date}`;
+    }
+    return `wecom:dm:${message.sender.id}:${agentId}:${date}`;
+  },
+  async connect(installation, deps) {
+    const { id: installationId, tenantId, config } = installation;
+    if (!config.botId || !config.secret) {
+      logger6.warn("WeCom installation missing botId/secret, skipping", { installationId });
+      return;
+    }
+    if (activeConnections2.has(installationId)) {
+      logger6.warn("WeCom long connection already running, skipping", { installationId });
+      return;
+    }
+    const { router, wsClientFactory } = deps ?? {};
+    const client = (wsClientFactory ?? createDefaultWecomClient)(config);
+    const connection = { client, intentional: false, attempts: 0 };
+    client.on("message.text", (frame) => {
+      wecomChannelAdapter.receive(frame, installation).then((inbound) => {
+        if (!inbound || !router) return void 0;
+        return router.dispatch(inbound);
+      }).catch((error) => {
+        logger6.error("WeCom message dispatch error", {
+          installationId,
+          error: error instanceof Error ? error.message : String(error)
+        });
+      });
+    });
+    client.on("authenticated", () => {
+      connection.attempts = 0;
+    });
+    client.on("event.disconnected_event", () => {
+      logger6.warn("WeCom connection kicked by a newer connection; will reconnect", {
+        installationId
+      });
+      scheduleReconnect(installationId, connection);
+    });
+    activeConnections2.set(installationId, connection);
+    client.connect();
+    logger6.info("WeCom long connection starting", { installationId, tenantId });
+  },
+  async disconnect(installationId) {
+    const connection = activeConnections2.get(installationId);
+    if (!connection) {
+      logger6.warn("WeCom long connection not running, nothing to disconnect", { installationId });
+      return;
+    }
+    connection.intentional = true;
+    if (connection.timer) {
+      clearTimeout(connection.timer);
+      connection.timer = void 0;
+    }
+    try {
+      connection.client.disconnect();
+    } catch (error) {
+      logger6.error("WeCom long connection stop error", {
+        installationId,
+        error: error instanceof Error ? error.message : String(error)
+      });
+    }
+    activeConnections2.delete(installationId);
+    logger6.info("WeCom long connection disconnected", { installationId });
+  }
+};
+function scheduleReconnect(installationId, connection) {
+  if (connection.intentional || connection.timer) return;
+  const delay2 = Math.min(RECONNECT_BASE_MS * 2 ** connection.attempts, RECONNECT_MAX_MS);
+  connection.attempts += 1;
+  logger6.info("WeCom reconnect scheduled", {
+    installationId,
+    delayMs: delay2,
+    attempt: connection.attempts
+  });
+  const timer = setTimeout(() => {
+    connection.timer = void 0;
+    if (connection.intentional || activeConnections2.get(installationId) !== connection) {
+      return;
+    }
+    try {
+      connection.client.connect();
+    } catch (error) {
+      logger6.error("WeCom reconnect failed", {
+        installationId,
+        error: error instanceof Error ? error.message : String(error)
+      });
+      scheduleReconnect(installationId, connection);
+    }
+  }, delay2);
+  timer.unref?.();
+  connection.timer = timer;
+}
+function createDefaultWecomClient(config) {
+  return new WecomAiBot.WSClient({
+    botId: config.botId,
+    secret: config.secret,
+    // 断网无限重连；被踢（disconnected_event）由 scheduleReconnect 兜底。
+    maxReconnectAttempts: -1
+  });
+}
+
 // src/swagger.ts
 var import_swagger = __toESM(require("@fastify/swagger"));
 var import_swagger_ui = __toESM(require("@fastify/swagger-ui"));
@@ -31877,9 +32126,9 @@ var MessageRouter = class {
 };
 
 // src/channels/room/RoomChannelAdapter.ts
-var import_zod17 = require("zod");
+var import_zod18 = require("zod");
 var import_protocols34 = require("@axiom-lattice/protocols");
-var roomConfigSchema = import_zod17.z.object({}).strict();
+var roomConfigSchema = import_zod18.z.object({}).strict();
 function createRoomChannelAdapter(writer) {
   return {
     channel: "room",
@@ -32765,11 +33014,11 @@ function readPluginDeploymentLimits(env = process.env) {
   };
 }
 function startPluginDeploymentRuntime(options) {
-  const { lease, holder, logger: logger8 } = options;
+  const { lease, holder, logger: logger9 } = options;
   const forcedOn = process.env[PLUGIN_DEPLOYMENT_RUNTIME_FLAG] === "true" || process.env[PLUGIN_DEPLOYMENT_RUNTIME_FLAG] === "1";
   const effectiveServiceBaseUrl = options.wiring.serviceBaseUrl ?? process.env.MICROSANDBOX_SERVICE_BASE_URL;
   if (forcedOn && !effectiveServiceBaseUrl) {
-    logger8.warn(
+    logger9.warn(
       `${PLUGIN_DEPLOYMENT_RUNTIME_FLAG} is enabled but MICROSANDBOX_SERVICE_BASE_URL is empty; skipping plugin deployment runtime`,
       { holder }
     );
@@ -32788,8 +33037,8 @@ function startPluginDeploymentRuntime(options) {
   };
   const service2 = createService(deps);
   register(service2);
-  logger8.info("plugin deployment runtime started", { holder });
-  const reconcile = runStartupReconcile(service2, reconcileDeadlineMs, logger8, holder);
+  logger9.info("plugin deployment runtime started", { holder });
+  const reconcile = runStartupReconcile(service2, reconcileDeadlineMs, logger9, holder);
   let held = false;
   let inFlight = false;
   const tick = async () => {
@@ -32797,18 +33046,18 @@ function startPluginDeploymentRuntime(options) {
     inFlight = true;
     try {
       if (held) {
-        held = await renewLease(lease, holder, logger8);
+        held = await renewLease(lease, holder, logger9);
         if (!held) {
-          logger8.warn("plugin deployment lease lost; watchdog paused", { holder });
+          logger9.warn("plugin deployment lease lost; watchdog paused", { holder });
         }
       } else {
-        held = await acquireLease(lease, holder, logger8);
+        held = await acquireLease(lease, holder, logger9);
         if (held) {
-          logger8.info("plugin deployment lease acquired", { holder });
+          logger9.info("plugin deployment lease acquired", { holder });
         }
       }
       if (!held) return;
-      await runWatchdog(service2, holder, logger8);
+      await runWatchdog(service2, holder, logger9);
     } finally {
       inFlight = false;
     }
@@ -32824,7 +33073,7 @@ function startPluginDeploymentRuntime(options) {
         try {
           await lease.release(PLUGIN_DEPLOYMENT_LEASE_KEY, holder);
         } catch (error) {
-          logger8.warn("plugin deployment lease release failed", {
+          logger9.warn("plugin deployment lease release failed", {
             holder,
             error: errorMessage5(error)
           });
@@ -32832,16 +33081,16 @@ function startPluginDeploymentRuntime(options) {
         held = false;
       }
       register(void 0);
-      logger8.info("plugin deployment runtime stopped", { holder });
+      logger9.info("plugin deployment runtime stopped", { holder });
     }
   };
 }
-async function runStartupReconcile(service2, deadlineMs, logger8, holder) {
+async function runStartupReconcile(service2, deadlineMs, logger9, holder) {
   try {
     await withDeadline(service2.startupReconcile(), deadlineMs);
-    logger8.info("plugin deployment startup reconcile complete", { holder });
+    logger9.info("plugin deployment startup reconcile complete", { holder });
   } catch (error) {
-    logger8.warn("plugin deployment startup reconcile failed", {
+    logger9.warn("plugin deployment startup reconcile failed", {
       holder,
       error: errorMessage5(error)
     });
@@ -32864,7 +33113,7 @@ async function withDeadline(work, deadlineMs) {
     if (timer !== void 0) clearTimeout(timer);
   }
 }
-async function acquireLease(lease, holder, logger8) {
+async function acquireLease(lease, holder, logger9) {
   try {
     return await lease.tryAcquire(
       PLUGIN_DEPLOYMENT_LEASE_KEY,
@@ -32872,14 +33121,14 @@ async function acquireLease(lease, holder, logger8) {
       PLUGIN_DEPLOYMENT_LEASE_TTL_MS
     );
   } catch (error) {
-    logger8.warn("plugin deployment lease acquire failed", {
+    logger9.warn("plugin deployment lease acquire failed", {
       holder,
       error: errorMessage5(error)
     });
     return false;
   }
 }
-async function renewLease(lease, holder, logger8) {
+async function renewLease(lease, holder, logger9) {
   try {
     return await lease.renew(
       PLUGIN_DEPLOYMENT_LEASE_KEY,
@@ -32887,18 +33136,18 @@ async function renewLease(lease, holder, logger8) {
       PLUGIN_DEPLOYMENT_LEASE_TTL_MS
     );
   } catch (error) {
-    logger8.warn("plugin deployment lease renew failed", {
+    logger9.warn("plugin deployment lease renew failed", {
       holder,
       error: errorMessage5(error)
     });
     return false;
   }
 }
-async function runWatchdog(service2, holder, logger8) {
+async function runWatchdog(service2, holder, logger9) {
   try {
     await service2.healthWatchdog();
   } catch (error) {
-    logger8.warn("plugin deployment health watchdog failed", {
+    logger9.warn("plugin deployment health watchdog failed", {
       holder,
       error: errorMessage5(error)
     });
@@ -32936,29 +33185,29 @@ function storeClassName(kind) {
     return void 0;
   }
 }
-function warnMultiReplicaReadiness(logger8) {
+function warnMultiReplicaReadiness(logger9) {
   if (typeof process.env.AXIOM_REPLICA_ID !== "string" || process.env.AXIOM_REPLICA_ID.trim() === "") return;
   for (const kind of SHARED_STORE_KINDS) {
     const name = storeClassName(kind);
     if (name === void 0 || !name.startsWith("InMemory")) continue;
-    logger8.warn(`Multi-replica: store '${kind}' is ${name} (not shared); configure a shared store`, {
+    logger9.warn(`Multi-replica: store '${kind}' is ${name} (not shared); configure a shared store`, {
       phase: "multi_replica_readiness",
       store: kind
     });
   }
   if (!process.env.AUTH_TOKEN_SECRET?.trim() && !process.env.JWT_SECRET?.trim()) {
-    logger8.warn(
+    logger9.warn(
       "Multi-replica: AUTH_TOKEN_SECRET/JWT_SECRET unset; console sessions are signed per-process and will not verify across replicas",
       { phase: "multi_replica_readiness", env: "AUTH_TOKEN_SECRET" }
     );
   }
   if (!process.env.LATTICE_ENCRYPTION_KEY?.trim()) {
-    logger8.warn(
+    logger9.warn(
       "Multi-replica: LATTICE_ENCRYPTION_KEY unset; stored credentials use the shared dev default and may not decrypt across differing keys",
       { phase: "multi_replica_readiness", env: "LATTICE_ENCRYPTION_KEY" }
     );
   }
-  logger8.warn(
+  logger9.warn(
     "Multi-replica: agent run SSE and resume_stream are process-local; route a thread's follow-up runs to the replica streaming it (sticky routing) or share the stream/queue state",
     { phase: "multi_replica_readiness", feature: "agent-run-sse" }
   );
@@ -33101,7 +33350,7 @@ var DEFAULT_LOGGER_CONFIG = {
   loggerName: "lattice/gateway"
 };
 var loggerLattice = initializeLogger(DEFAULT_LOGGER_CONFIG);
-var logger7 = loggerLattice.client;
+var logger8 = loggerLattice.client;
 function initializeLogger(config) {
   if (import_core98.loggerLatticeManager.hasLattice("default")) {
     import_core98.loggerLatticeManager.removeLattice("default");
@@ -33188,7 +33437,7 @@ app.setErrorHandler((error, request, reply) => {
     "x-request-id": getHeaderValue(request.headers["x-request-id"]),
     "x-user-id": getHeaderValue(request.headers["x-user-id"])
   };
-  logger7.error(
+  logger8.error(
     `\u8BF7\u6C42\u9519\u8BEF: ${request.method} ${request.url} error:${error.message}`,
     {
       ...context,
@@ -33224,14 +33473,14 @@ async function restoreMcpConnections() {
     const storeLattice = (0, import_core98.getStoreLattice)("default", "mcp");
     const store2 = storeLattice.store;
     if (!store2) {
-      logger7.info("MCP store not configured, skipping connection restoration");
+      logger8.info("MCP store not configured, skipping connection restoration");
       return;
     }
     const configs = (await store2.getAllConfigsWithoutTenant()).filter(
       (c2) => c2.status === "connected"
     );
     if (configs.length === 0) return;
-    logger7.info(`Restoring ${configs.length} MCP server connections...`);
+    logger8.info(`Restoring ${configs.length} MCP server connections...`);
     const deps = {
       store: store2,
       manager: import_core98.mcpManager,
@@ -33248,15 +33497,15 @@ async function restoreMcpConnections() {
     results.forEach((result, index) => {
       if (result.status === "rejected") {
         const config = configs[index];
-        logger7.warn(
+        logger8.warn(
           `Failed to restore MCP server "${config.tenantId}/${config.key}"`,
           { error: result.reason }
         );
       }
     });
-    logger7.info(`MCP connection restoration complete: ${configs.length} servers`);
+    logger8.info(`MCP connection restoration complete: ${configs.length} servers`);
   } catch (err) {
-    logger7.error("MCP connection restoration failed", { error: err });
+    logger8.error("MCP connection restoration failed", { error: err });
   }
 }
 var start = async (config) => {
@@ -33269,7 +33518,7 @@ var start = async (config) => {
         file: config.loggerConfig.file || DEFAULT_LOGGER_CONFIG.file
       };
       loggerLattice = initializeLogger(loggerConfig);
-      logger7 = loggerLattice.client;
+      logger8 = loggerLattice.client;
     }
     app.decorate("loggerLattice", loggerLattice);
     const projectRoomRealtimeMode = resolveProjectRoomRealtimeMode();
@@ -33279,12 +33528,13 @@ var start = async (config) => {
         tasks: (0, import_core98.getStoreLattice)("default", "task").store,
         rooms: (0, import_core98.getStoreLattice)("default", "projectRoom").store,
         memberships: (0, import_core98.getStoreLattice)("default", "projectBotMembership").store,
-        log: { warn: (message, context) => logger7.warn(message, context) }
+        log: { warn: (message, context) => logger8.warn(message, context) }
       });
     }
     let channelDeps;
     const adapterRegistry = new ChannelAdapterRegistry();
     adapterRegistry.register(larkChannelAdapter);
+    adapterRegistry.register(wecomChannelAdapter);
     const { wechatChannelAdapter: wechatChannelAdapter2 } = await Promise.resolve().then(() => (init_WechatChannelAdapter(), WechatChannelAdapter_exports));
     adapterRegistry.register(wechatChannelAdapter2);
     try {
@@ -33297,7 +33547,7 @@ var start = async (config) => {
           createRateLimitMiddleware(),
           createAuditLoggerMiddleware()
         ],
-        warn: (message, context) => logger7.warn(message, context),
+        warn: (message, context) => logger8.warn(message, context),
         realtime: projectRoomRealtimeRuntime?.publisher
       });
       const bindingStore = infrastructure.bindingRegistry;
@@ -33311,10 +33561,10 @@ var start = async (config) => {
         installationStore,
         bindingRegistry: bindingStore,
         realtime: projectRoomRealtimeRuntime?.publisher,
-        warn: (message, context) => logger7.warn(message, context)
+        warn: (message, context) => logger8.warn(message, context)
       };
     } catch (err) {
-      logger7.warn("Channel infrastructure unavailable", {
+      logger8.warn("Channel infrastructure unavailable", {
         error: err instanceof Error ? err.message : String(err)
       });
     }
@@ -33322,7 +33572,7 @@ var start = async (config) => {
     try {
       const menuStore = (0, import_core98.getStoreLattice)("default", "menu").store;
       (0, import_core97.setMenuRegistry)(menuStore);
-      logger7.info("Menu registry initialized");
+      logger8.info("Menu registry initialized");
     } catch {
     }
     registerAllBuiltinEntities();
@@ -33331,7 +33581,7 @@ var start = async (config) => {
     }
     const routes = registerLatticeRoutes(app, channelDeps, {
       projectTaskEnabled: process.env.AXIOM_PROJECT_TASK_EXECUTION_ENABLED !== "false",
-      projectTaskLog: { warn: (message, context) => logger7.warn(message, context) },
+      projectTaskLog: { warn: (message, context) => logger8.warn(message, context) },
       projectRoomRealtimeRuntime
     });
     try {
@@ -33359,9 +33609,9 @@ var start = async (config) => {
         getProjectStore: () => projectStore
       });
       a2a.registerA2ARoutes(app);
-      logger7.info("A2A standard routes registered");
+      logger8.info("A2A standard routes registered");
     } catch (err) {
-      logger7.warn("A2A standard routes unavailable", {
+      logger8.warn("A2A standard routes unavailable", {
         error: err instanceof Error ? err.message : String(err)
       });
     }
@@ -33398,26 +33648,26 @@ var start = async (config) => {
       registerOpenFilesRoutes2(app);
       registerOpenAuditRoutes2(app);
       registerOpenExposureRoutes2(app);
-      logger7.info("Open API routes registered (kb + sandbox providers, session exchange)");
+      logger8.info("Open API routes registered (kb + sandbox providers, session exchange)");
     } catch (err) {
-      logger7.warn("Open API routes unavailable", {
+      logger8.warn("Open API routes unavailable", {
         error: err instanceof Error ? err.message : String(err)
       });
     }
     try {
       const { registerGatewaySandboxOpenCredentialProvider: registerGatewaySandboxOpenCredentialProvider2 } = await Promise.resolve().then(() => (init_sandboxOpenCredentialProvider(), sandboxOpenCredentialProvider_exports));
       registerGatewaySandboxOpenCredentialProvider2((error) => {
-        logger7.warn("sandbox open-credential provider failed", { error });
+        logger8.warn("sandbox open-credential provider failed", { error });
       });
-      logger7.info("Sandbox open-credential provider registered");
+      logger8.info("Sandbox open-credential provider registered");
     } catch (err) {
-      logger7.warn("Sandbox open-credential provider unavailable", {
+      logger8.warn("Sandbox open-credential provider unavailable", {
         error: err instanceof Error ? err.message : String(err)
       });
     }
     if (!import_core98.sandboxLatticeManager.hasLattice("default")) {
       import_core98.sandboxLatticeManager.registerLattice("default", getConfiguredSandboxProvider());
-      logger7.info("Registered sandbox manager from env configuration");
+      logger8.info("Registered sandbox manager from env configuration");
     }
     if (isPluginDeploymentRuntimeEnabled()) {
       try {
@@ -33444,21 +33694,21 @@ var start = async (config) => {
             listAllDeployments,
             // The service logs fields-first; the gateway logger is message-first.
             logger: {
-              info: (fields, message) => logger7.info(message ?? "plugin deployment", fields),
-              warn: (fields, message) => logger7.warn(message ?? "plugin deployment", fields),
-              error: (fields, message) => logger7.error(message ?? "plugin deployment", fields)
+              info: (fields, message) => logger8.info(message ?? "plugin deployment", fields),
+              warn: (fields, message) => logger8.warn(message ?? "plugin deployment", fields),
+              error: (fields, message) => logger8.error(message ?? "plugin deployment", fields)
             }
           },
           lease: leaseStore2,
           holder: (0, import_core98.getReplicaId)(),
-          logger: logger7
+          logger: logger8
         });
         app.addHook("onClose", async () => {
           await pluginDeploymentRuntime.dispose();
         });
-        logger7.info("Plugin deployment runtime started");
+        logger8.info("Plugin deployment runtime started");
       } catch (err) {
-        logger7.warn("Plugin deployment runtime unavailable", {
+        logger8.warn("Plugin deployment runtime unavailable", {
           error: err instanceof Error ? err.message : String(err)
         });
       }
@@ -33471,12 +33721,12 @@ var start = async (config) => {
         store: sharedResourceStore,
         sandboxManager: import_core98.sandboxLatticeManager,
         cache: cache2,
-        logger: logger7
+        logger: logger8
       });
       registerResourceRoutes(app, resourceController);
-      logger7.info("Resource share routes registered");
+      logger8.info("Resource share routes registered");
     } catch (err) {
-      logger7.warn("Resource share infrastructure unavailable", {
+      logger8.warn("Resource share infrastructure unavailable", {
         error: err instanceof Error ? err.message : String(err)
       });
     }
@@ -33489,14 +33739,14 @@ var start = async (config) => {
             deps: { router: channelDeps.router }
           }),
           disconnect: () => (0, import_core98.disconnectAllChannels)((channel) => adapterRegistry.get(channel)),
-          log: { warn: (message, context) => logger7.warn(message, context) }
+          log: { warn: (message, context) => logger8.warn(message, context) }
         });
         app.addHook("onClose", async () => {
           await channelLeader.stop();
         });
         channelLeader.start();
       } catch (err) {
-        logger7.error("Failed to start channel connections", {
+        logger8.error("Failed to start channel connections", {
           error: err instanceof Error ? err.message : String(err)
         });
       }
@@ -33543,24 +33793,24 @@ var start = async (config) => {
           await handleModelProviderChanged(payload, (tenantId, providerId2) => controller.reconcileProvider(tenantId, providerId2));
         }
       },
-      log: logger7
+      log: logger8
     });
     try {
       await outboxPoller.start();
     } catch (err) {
-      logger7.warn("Outbox poller failed to start", { error: err instanceof Error ? err.message : String(err) });
+      logger8.warn("Outbox poller failed to start", { error: err instanceof Error ? err.message : String(err) });
     }
     const leaseStore = (0, import_core98.getStoreLattice)("default", "lease").store;
     if (leaseStore.constructor?.name === "InMemoryLeaseStore") {
-      logger7.warn(
+      logger8.warn(
         "Startup recovery leader gate uses a non-distributed lease store (per-process only); configure a shared 'lease' store for multi-replica deployments",
         { phase: "startup_recovery" }
       );
     }
-    warnMultiReplicaReadiness(logger7);
+    warnMultiReplicaReadiness(logger8);
     const startup = await (0, import_core98.runAsLeader)(leaseStore, "startup-recovery", async () => {
       if (routes.projectTaskRuntime) {
-        await prepareProjectTaskRuntime(routes.projectTaskRuntime, logger7);
+        await prepareProjectTaskRuntime(routes.projectTaskRuntime, logger8);
       }
       if (process.env.AXIOM_TASK_ORPHAN_RECOVERY === "true") {
         try {
@@ -33571,19 +33821,19 @@ var start = async (config) => {
             workItemStore: (0, import_core98.getStoreLattice)("default", "taskWorkItem").store,
             tenantStore: (0, import_core98.getStoreLattice)("default", "tenant").store,
             ...createRecoveryCallerDeps2(),
-            log: logger7
+            log: logger8
           });
           await runtime.recoverAll();
         } catch (err) {
-          logger7.warn("Task orphan recovery failed", { error: err instanceof Error ? err.message : String(err) });
+          logger8.warn("Task orphan recovery failed", { error: err instanceof Error ? err.message : String(err) });
         }
       }
       if (import_core98.scheduleLatticeManager.hasLattice("default")) {
         try {
           const restored = await import_core98.scheduleLatticeManager.getScheduleLattice("default").restore();
-          logger7.info("Scheduled tasks restored", { phase: "startup_recovery", restored });
+          logger8.info("Scheduled tasks restored", { phase: "startup_recovery", restored });
         } catch (err) {
-          logger7.warn("Scheduled task restore failed", {
+          logger8.warn("Scheduled task restore failed", {
             phase: "startup_recovery",
             error: err instanceof Error ? err.message : String(err)
           });
@@ -33591,13 +33841,13 @@ var start = async (config) => {
       }
     }, { hold: true, ttlMs: 5 * 6e4 });
     if (!startup.ran) {
-      logger7.info("Startup recovery skipped (another replica leads)", { phase: "startup_recovery" });
+      logger8.info("Startup recovery skipped (another replica leads)", { phase: "startup_recovery" });
     }
     await app.listen({ port: target_port, host: "0.0.0.0" });
-    logger7.info(`Lattice Gateway is running on port: ${target_port}`);
+    logger8.info(`Lattice Gateway is running on port: ${target_port}`);
     const outboxRetention = createOutboxRetentionJob({
       outbox: outboxStore,
-      log: logger7
+      log: logger8
     });
     outboxRetention.start();
     let agentTaskConsumer;
@@ -33610,15 +33860,15 @@ var start = async (config) => {
       }
     }
     restoreMcpConnections().catch((error) => {
-      logger7.error("MCP connection restoration failed", { error });
+      logger8.error("MCP connection restoration failed", { error });
     });
     if (config?.gracefulShutdown !== false && !shutdownHandlersInstalled) {
       shutdownHandlersInstalled = true;
       const gracefulShutdown = createGracefulShutdown({
         timeoutMs: config?.gracefulShutdownTimeoutMs ?? 1e4,
         log: {
-          info: (message, context) => logger7.info(message, context),
-          warn: (message, context) => logger7.warn(message, context)
+          info: (message, context) => logger8.info(message, context),
+          warn: (message, context) => logger8.warn(message, context)
         },
         steps: [
           async () => {
@@ -33636,7 +33886,7 @@ var start = async (config) => {
       process.once("SIGINT", () => void gracefulShutdown("SIGINT"));
     }
   } catch (err) {
-    logger7.error("Server start failed", { error: err });
+    logger8.error("Server start failed", { error: err });
     process.exit(1);
   }
 };