@axiom-lattice/gateway 8.4.0 → 9.0.0

package/dist/index.mjs

@@ -48,23 +48,26 @@ import "./chunk-EXPERMZR.mjs";
 import {
   CollectionService
 } from "./chunk-PWHUWFXL.mjs";
-import {
-  getMcpUiResourceResolver,
-  listTenantPlugins,
-  registerMcpAppRoutes,
-  resolveTenantPluginByType
-} from "./chunk-T2HIWZGP.mjs";
-import "./chunk-XUWD4VKY.mjs";
 import {
   A2A_KEY_CHANGED_TOPIC,
+  ProjectAccessService,
+  ProjectCollaborationError,
   handleA2AKeyChanged,
   publishA2AKeyChanged,
-  refreshStoreKeyMap
-} from "./chunk-OBODBHIS.mjs";
+  refreshStoreKeyMap,
+  setA2AProjectAccess
+} from "./chunk-NYYSBNDG.mjs";
 import {
   A2AAuthService,
   parseEnvKeys
 } from "./chunk-LCM4OQTI.mjs";
+import {
+  getMcpUiResourceResolver,
+  listTenantPlugins,
+  registerMcpAppRoutes,
+  resolveTenantPluginByType
+} from "./chunk-T2HIWZGP.mjs";
+import "./chunk-XUWD4VKY.mjs";
 import "./chunk-MFWTGNQR.mjs";
 import {
   createOrphanRecoveryRuntime,
@@ -90,7 +93,7 @@ import staticPlugin from "@fastify/static";
 import path4 from "path";
 
 // src/routes/index.ts
-import { randomUUID as randomUUID32 } from "crypto";
+import { randomUUID as randomUUID31 } from "crypto";
 import {
   descriptorDataValue as descriptorDataValue3,
   snapshotExactRecord as snapshotExactRecord14,
@@ -11000,8 +11003,9 @@ function createProjectCollaborationInitializer(deps) {
   };
 }
 var WorkspaceController = class {
-  constructor(projectCollaboration) {
+  constructor(projectCollaboration, projectAccess) {
     this.projectCollaboration = projectCollaboration;
+    this.projectAccess = projectAccess;
     this.workspaceStore = getStoreLattice16("default", "workspace").store;
     this.projectStore = getStoreLattice16("default", "project").store;
     const roomStore = getStoreLattice16("default", "projectRoom").store;
@@ -11043,6 +11047,48 @@ var WorkspaceController = class {
     }
     return request.headers["x-tenant-id"] || "default";
   }
+  requireActor(request, reply) {
+    const user = request.user;
+    if (!user?.id || !user.tenantId) {
+      void reply.status(401).send({
+        success: false,
+        code: "UNAUTHORIZED",
+        error: "Unauthorized"
+      });
+      return null;
+    }
+    return { tenantId: user.tenantId, userId: user.id };
+  }
+  accessService() {
+    if (!this.projectAccess) {
+      throw new Error("Project access service is not configured");
+    }
+    return this.projectAccess;
+  }
+  async requireReadableProject(actor3, workspaceId, projectId, capability2) {
+    try {
+      const result = await this.accessService().requireExistingProjectAccess({
+        tenantId: actor3.tenantId,
+        userId: actor3.userId,
+        projectId,
+        capability: capability2
+      });
+      if (result.project.workspaceId !== workspaceId) return null;
+      return result.project;
+    } catch (error) {
+      if (error instanceof ProjectCollaborationError && (error.code === "PROJECT_ACCESS_DENIED" || error.code === "PROJECT_NOT_FOUND")) {
+        return null;
+      }
+      throw error;
+    }
+  }
+  projectNotFound(reply) {
+    return reply.status(404).send({
+      success: false,
+      code: "PROJECT_NOT_FOUND",
+      error: "Project not found"
+    });
+  }
   // ==================== Workspace CRUD ====================
   async listWorkspaces(request, reply) {
     const tenantId = this.getTenantId(request);
@@ -11100,14 +11146,18 @@ var WorkspaceController = class {
   }
   // ==================== Project CRUD ====================
   async listProjects(request, reply) {
-    const tenantId = this.getTenantId(request);
+    const actor3 = this.requireActor(request, reply);
+    if (!actor3) return;
     const { workspaceId } = request.params;
     const kindFilter = request.query.kind;
-    await this.ensureTrainingProject(tenantId, workspaceId);
-    await this.publicRoom.ensure(tenantId, workspaceId);
-    const projects = kindFilter ? await this.projectStore.getProjectsByWorkspace(tenantId, workspaceId, {
+    await this.ensureTrainingProject(actor3.tenantId, workspaceId);
+    await this.publicRoom.ensure(actor3.tenantId, workspaceId);
+    const projects = await this.accessService().listReadableProjects({
+      tenantId: actor3.tenantId,
+      userId: actor3.userId,
+      workspaceId,
       kind: kindFilter
-    }) : await this.projectStore.getProjectsByWorkspace(tenantId, workspaceId);
+    });
     return { success: true, data: projects };
   }
   /**
@@ -11132,13 +11182,9 @@ var WorkspaceController = class {
     });
   }
   async createProject(request, reply) {
-    const user = request.user;
-    const requestedTenantId = request.query?.tenantId ?? request.headers["x-tenant-id"];
-    const selectedTenantId = requestedTenantId === void 0 ? void 0 : String(requestedTenantId);
-    if (user?.tenantId && selectedTenantId && user.tenantId !== selectedTenantId) {
-      return reply.status(403).send({ success: false, code: "TENANT_ACCESS_DENIED", error: "Tenant access denied" });
-    }
-    const tenantId = user?.tenantId ?? selectedTenantId ?? "default";
+    const actor3 = this.requireActor(request, reply);
+    if (!actor3) return;
+    const tenantId = actor3.tenantId;
     const { workspaceId } = request.params;
     const data = request.body;
     if (writesCapabilityBundleIds(data.config)) {
@@ -11148,9 +11194,9 @@ var WorkspaceController = class {
         message: CAPABILITY_BUNDLE_CONFIG_MESSAGE
       });
     }
-    if (user?.id && this.projectCollaboration) {
+    if (this.projectCollaboration) {
       try {
-        const authorized = await this.projectCollaboration.authorizeCreator({ tenantId, userId: user.id });
+        const authorized = await this.projectCollaboration.authorizeCreator({ tenantId, userId: actor3.userId });
         if (!authorized) {
           return reply.status(403).send({ success: false, code: "TENANT_ACCESS_DENIED", error: "Tenant access denied" });
         }
@@ -11161,7 +11207,7 @@ var WorkspaceController = class {
         console.error({
           event: "project:collaboration-preflight-failed",
           tenantId,
-          userId: user.id,
+          userId: actor3.userId,
           errorName: error instanceof Error ? error.name : "UnknownError"
         });
         return reply.status(500).send({
@@ -11179,42 +11225,72 @@ var WorkspaceController = class {
       id3,
       data
     );
-    if (user?.id && this.projectCollaboration) {
+    if (this.projectCollaboration) {
       try {
-        await this.projectCollaboration.initialize({ tenantId, userId: user.id, project });
+        await this.projectCollaboration.initialize({ tenantId, userId: actor3.userId, project });
       } catch (error) {
-        const phase = error instanceof ProjectCollaborationInitializationError ? error.phase : "owner";
+        const phase = error instanceof ProjectCollaborationInitializationError ? error.phase : void 0;
+        let rolledBack = false;
+        if (phase === "owner") {
+          try {
+            rolledBack = await this.projectStore.deleteProject(tenantId, project.id);
+            if (!rolledBack) {
+              console.error({
+                event: "project:owner-initialization-rollback-missed",
+                tenantId,
+                projectId: project.id
+              });
+            }
+          } catch (cleanupError) {
+            console.error({
+              event: "project:owner-initialization-rollback-failed",
+              tenantId,
+              projectId: project.id,
+              errorName: cleanupError instanceof Error ? cleanupError.name : "UnknownError"
+            });
+          }
+        }
         console.error({
           event: "project:collaboration-initialization-failed",
           phase,
           tenantId,
           projectId: project.id,
-          userId: user.id,
+          userId: actor3.userId,
           errorName: error instanceof Error ? error.name : "UnknownError"
         });
         return reply.status(500).send({
           success: false,
           error: "Internal server error",
-          code: phase === "owner" ? "PROJECT_OWNER_INITIALIZATION_FAILED" : "PROJECT_ROOM_INITIALIZATION_FAILED",
+          code: phase === "owner" ? "PROJECT_OWNER_INITIALIZATION_FAILED" : phase === "room" ? "PROJECT_ROOM_INITIALIZATION_FAILED" : "PROJECT_COLLABORATION_INITIALIZATION_FAILED",
           projectId: project.id,
-          retryable: phase === "room"
+          retryable: phase === "room" || rolledBack
         });
       }
     }
     return reply.status(201).send({ success: true, data: project });
   }
   async getProject(request, reply) {
-    const tenantId = this.getTenantId(request);
-    const { projectId } = request.params;
-    const project = await this.projectStore.getProjectById(tenantId, projectId);
-    if (!project) {
-      return reply.status(404).send({ success: false, error: "Project not found" });
-    }
+    const actor3 = this.requireActor(request, reply);
+    if (!actor3) return;
+    const project = await this.requireReadableProject(
+      actor3,
+      request.params.workspaceId,
+      request.params.projectId,
+      "read"
+    );
+    if (!project) return this.projectNotFound(reply);
     return { success: true, data: project };
   }
   async updateProject(request, reply) {
-    const tenantId = this.getTenantId(request);
-    const { projectId } = request.params;
+    const actor3 = this.requireActor(request, reply);
+    if (!actor3) return;
+    const project = await this.requireReadableProject(
+      actor3,
+      request.params.workspaceId,
+      request.params.projectId,
+      "manage"
+    );
+    if (!project) return this.projectNotFound(reply);
     const updates = request.body;
     if (writesCapabilityBundleIds(updates.config)) {
       return reply.status(400).send({
@@ -11223,36 +11299,35 @@ var WorkspaceController = class {
         message: CAPABILITY_BUNDLE_CONFIG_MESSAGE
       });
     }
-    if (updates.kind !== void 0) {
-      const existingProject = await this.projectStore.getProjectById(tenantId, projectId);
-      if (existingProject && existingProject.id === workspacePublicRoomProjectId(tenantId, existingProject.workspaceId)) {
-        return reply.status(409).send({
-          success: false,
-          error: "The workspace public room classification cannot be changed"
-        });
-      }
+    if (project.id === workspacePublicRoomProjectId(actor3.tenantId, project.workspaceId) && (updates.kind !== void 0 || updates.name !== void 0)) {
+      return reply.status(409).send({
+        success: false,
+        error: "The workspace public room cannot be renamed or reclassified"
+      });
     }
-    const project = await this.projectStore.updateProject(
-      tenantId,
-      projectId,
+    const updated = await this.projectStore.updateProject(
+      actor3.tenantId,
+      project.id,
       updates
     );
-    if (!project) {
-      return reply.status(404).send({ success: false, error: "Project not found" });
-    }
-    return { success: true, data: project };
+    if (!updated) return this.projectNotFound(reply);
+    return { success: true, data: updated };
   }
   async deleteProject(request, reply) {
-    const tenantId = this.getTenantId(request);
-    const { workspaceId, projectId } = request.params;
-    const project = await this.projectStore.getProjectById(tenantId, projectId);
-    if (!project) {
-      return reply.status(404).send({ success: false, error: "Project not found" });
-    }
+    const actor3 = this.requireActor(request, reply);
+    if (!actor3) return;
+    const project = await this.requireReadableProject(
+      actor3,
+      request.params.workspaceId,
+      request.params.projectId,
+      "manage"
+    );
+    if (!project) return this.projectNotFound(reply);
+    const { workspaceId } = request.params;
     if (project.kind === "training") {
       const training = await this.projectStore.getProjectsByWorkspace(
-        tenantId,
-        workspaceId,
+        actor3.tenantId,
+        project.workspaceId,
         { kind: "training" }
       );
       if (training.length <= 1) {
@@ -11262,16 +11337,14 @@ var WorkspaceController = class {
         });
       }
     }
-    if (project.id === workspacePublicRoomProjectId(tenantId, project.workspaceId ?? workspaceId)) {
+    if (project.id === workspacePublicRoomProjectId(actor3.tenantId, project.workspaceId ?? workspaceId)) {
       return reply.status(409).send({
         success: false,
         error: "The workspace public room cannot be deleted"
       });
     }
-    const deleted = await this.projectStore.deleteProject(tenantId, projectId);
-    if (!deleted) {
-      return reply.status(404).send({ success: false, error: "Project not found" });
-    }
+    const deleted = await this.projectStore.deleteProject(actor3.tenantId, project.id);
+    if (!deleted) return this.projectNotFound(reply);
     return { success: true };
   }
   // ==================== File Operations ====================
@@ -11909,8 +11982,8 @@ var WorkspaceController = class {
     }
   }
 };
-function registerWorkspaceRoutes(app2, projectCollaboration) {
-  const controller = new WorkspaceController(projectCollaboration);
+function registerWorkspaceRoutes(app2, projectCollaboration, projectAccess) {
+  const controller = new WorkspaceController(projectCollaboration, projectAccess);
   app2.get("/api/workspaces", controller.listWorkspaces.bind(controller));
   app2.post("/api/workspaces", controller.createWorkspace.bind(controller));
   app2.get(
@@ -11977,250 +12050,12 @@ function registerWorkspaceRoutes(app2, projectCollaboration) {
   return controller;
 }
 
-// src/services/collaboration/ProjectAccessService.ts
-import { randomUUID as randomUUID14 } from "crypto";
-var ProjectCollaborationError = class extends Error {
-  /** Creates a project collaboration error. */
-  constructor(code, statusCode, message) {
-    super(message);
-    this.code = code;
-    this.statusCode = statusCode;
-    this.name = "ProjectCollaborationError";
-  }
-};
-var allowedRoles = {
-  read: /* @__PURE__ */ new Set(["owner", "admin", "member", "viewer"]),
-  send: /* @__PURE__ */ new Set(["owner", "admin", "member"]),
-  manage: /* @__PURE__ */ new Set(["owner", "admin"])
-};
-var membershipConflictNames = /* @__PURE__ */ new Set([
-  "DuplicateProjectMembershipError",
-  "ProjectMembershipIdConflictError"
-]);
-function isProjectMembershipConflict(error) {
-  return error instanceof Error && membershipConflictNames.has(error.name);
-}
-var ProjectAccessService = class {
-  /** Creates a project access service from explicitly injected stores. */
-  constructor(deps) {
-    this.deps = deps;
-    this.idFactory = deps.idFactory ?? randomUUID14;
-  }
-  /** Returns the project and active membership when the user has the requested capability. */
-  async requireProjectAccess(input) {
-    const project = await this.deps.projectStore.getProjectById(input.tenantId, input.projectId);
-    if (!project) {
-      throw new ProjectCollaborationError("PROJECT_NOT_FOUND", 404, "Project not found");
-    }
-    if (project.kind === "public") {
-      return this.requirePublicProjectAccess(project, input);
-    }
-    const membership = await this.deps.membershipStore.findByUser(
-      input.tenantId,
-      input.projectId,
-      input.userId
-    );
-    if (project.kind === "personal") {
-      if (!this.isActiveMembership(membership, input)) this.accessDenied();
-      this.requireCapability(membership, input.capability);
-      return { project, membership };
-    }
-    if (this.isActiveMembership(membership, input) && this.hasCapability(membership, input.capability)) {
-      return { project, membership };
-    }
-    const tenantAdmin = await this.tenantAdminMembership(project, input);
-    if (this.isActiveMembership(membership, input)) {
-      if (tenantAdmin) return { project, membership: tenantAdmin };
-      this.requireCapability(membership, input.capability);
-    }
-    const memberships = await this.deps.membershipStore.list(input.tenantId, input.projectId);
-    if (memberships.length !== 0) {
-      if (tenantAdmin) return { project, membership: tenantAdmin };
-      this.accessDenied();
-    }
-    if (!tenantAdmin) this.accessDenied();
-    let claim;
-    try {
-      claim = await this.deps.membershipStore.createInitialOwner({
-        id: this.idFactory(),
-        tenantId: input.tenantId,
-        projectId: input.projectId,
-        userId: input.userId
-      });
-    } catch (error) {
-      if (isProjectMembershipConflict(error)) {
-        throw new ProjectCollaborationError(
-          "PROJECT_MEMBERSHIP_CONFLICT",
-          409,
-          "Project membership could not be initialized"
-        );
-      }
-      throw error;
-    }
-    if (claim.kind === "created" || claim.kind === "existing") {
-      return { project, membership: claim.membership };
-    }
-    const racedMembership = await this.deps.membershipStore.findByUser(
-      input.tenantId,
-      input.projectId,
-      input.userId
-    );
-    if (racedMembership?.status !== "active") this.accessDenied();
-    this.requireCapability(racedMembership, input.capability);
-    return { project, membership: racedMembership };
-  }
-  /** Authorizes an already-existing membership, or any tenant member for public rooms; never mutates persistence. */
-  async requireExistingProjectAccess(input) {
-    const project = await this.deps.projectStore.getProjectById(input.tenantId, input.projectId);
-    if (!project) throw new ProjectCollaborationError("PROJECT_NOT_FOUND", 404, "Project not found");
-    if (project.kind === "public") {
-      return this.requireExistingPublicProjectAccess(project, input);
-    }
-    const membership = await this.deps.membershipStore.findByUser(
-      input.tenantId,
-      input.projectId,
-      input.userId
-    );
-    const activeMembership = this.isActiveMembership(membership, input) ? membership : void 0;
-    if (project.kind === "personal") {
-      if (!activeMembership) this.accessDenied();
-      this.requireCapability(activeMembership, input.capability);
-      return { project, membership: activeMembership };
-    }
-    if (activeMembership && this.hasCapability(activeMembership, input.capability)) {
-      return { project, membership: activeMembership };
-    }
-    const tenantAdmin = await this.tenantAdminMembership(project, input);
-    if (tenantAdmin) return { project, membership: tenantAdmin };
-    if (activeMembership) this.requireCapability(activeMembership, input.capability);
-    this.accessDenied();
-  }
-  /**
-   * Authorizes roster visibility for any active participant (owner/admin/member/viewer).
-   * Mutating the roster requires `manage` separately; reading it never does, because every
-   * room participant needs the member list to render the room and derive their own capabilities.
-   */
-  async requireRosterAccess(input) {
-    const project = await this.deps.projectStore.getProjectById(input.tenantId, input.projectId);
-    if (!project) throw new ProjectCollaborationError("PROJECT_NOT_FOUND", 404, "Project not found");
-    return this.requireProjectAccess({
-      ...input,
-      capability: "read"
-    });
-  }
-  async requirePublicProjectAccess(project, input) {
-    const membership = await this.deps.membershipStore.findByUser(
-      input.tenantId,
-      input.projectId,
-      input.userId
-    );
-    if (membership?.status === "active") {
-      if (this.hasCapability(membership, input.capability)) return { project, membership };
-      const tenantAdmin = await this.tenantAdminMembership(project, input);
-      if (tenantAdmin) return { project, membership: tenantAdmin };
-      this.requireCapability(membership, input.capability);
-      return { project, membership };
-    }
-    const materialized = await this.materializePublicMembership(input);
-    this.requireCapability(materialized, input.capability);
-    return { project, membership: materialized };
-  }
-  async requireExistingPublicProjectAccess(project, input) {
-    const membership = await this.deps.membershipStore.findByUser(
-      input.tenantId,
-      input.projectId,
-      input.userId
-    );
-    if (membership?.status === "active") {
-      if (this.hasCapability(membership, input.capability)) return { project, membership };
-      const tenantAdmin = await this.tenantAdminMembership(project, input);
-      if (tenantAdmin) return { project, membership: tenantAdmin };
-      this.requireCapability(membership, input.capability);
-      return { project, membership };
-    }
-    if (membership) this.accessDenied();
-    const tenantLink = await this.deps.userTenantLinkStore.getLink(input.userId, input.tenantId);
-    if (!tenantLink) this.accessDenied();
-    const role = tenantLink.role === "owner" || tenantLink.role === "admin" ? "admin" : "member";
-    const synthetic = {
-      id: `public:${input.userId}`,
-      tenantId: input.tenantId,
-      projectId: input.projectId,
-      userId: input.userId,
-      role,
-      status: "active",
-      joinedAt: project.createdAt,
-      updatedAt: project.updatedAt
-    };
-    this.requireCapability(synthetic, input.capability);
-    return { project, membership: synthetic };
-  }
-  async materializePublicMembership(input) {
-    const tenantLink = await this.deps.userTenantLinkStore.getLink(input.userId, input.tenantId);
-    if (!tenantLink) this.accessDenied();
-    const existing = await this.deps.membershipStore.findByUser(
-      input.tenantId,
-      input.projectId,
-      input.userId
-    );
-    if (existing) this.accessDenied();
-    const role = tenantLink.role === "owner" || tenantLink.role === "admin" ? "admin" : "member";
-    try {
-      return await this.deps.membershipStore.create({
-        id: this.idFactory(),
-        tenantId: input.tenantId,
-        projectId: input.projectId,
-        userId: input.userId,
-        role,
-        status: "active"
-      });
-    } catch (error) {
-      if (isProjectMembershipConflict(error)) {
-        const raced = await this.deps.membershipStore.findByUser(
-          input.tenantId,
-          input.projectId,
-          input.userId
-        );
-        if (raced?.status === "active") return raced;
-      }
-      throw error;
-    }
-  }
-  hasCapability(membership, capability2) {
-    return allowedRoles[capability2].has(membership.role);
-  }
-  requireCapability(membership, capability2) {
-    if (!this.hasCapability(membership, capability2)) this.accessDenied();
-  }
-  async tenantAdminMembership(project, input) {
-    if (project.kind === "personal") return void 0;
-    const tenantLink = await this.deps.userTenantLinkStore.getLink(input.userId, input.tenantId);
-    if (tenantLink?.role !== "owner" && tenantLink?.role !== "admin") return void 0;
-    return {
-      id: `tenant-admin:${input.userId}`,
-      tenantId: input.tenantId,
-      projectId: project.id,
-      userId: input.userId,
-      role: "admin",
-      status: "active",
-      joinedAt: project.createdAt,
-      updatedAt: project.updatedAt
-    };
-  }
-  isActiveMembership(membership, input) {
-    return membership != null && membership.tenantId === input.tenantId && membership.projectId === input.projectId && membership.userId === input.userId && membership.status === "active";
-  }
-  accessDenied() {
-    throw new ProjectCollaborationError("PROJECT_ACCESS_DENIED", 403, "Project access denied");
-  }
-};
-
 // src/controllers/database-configs.ts
 import {
   getStoreLattice as getStoreLattice17,
   sqlDatabaseManager
 } from "@axiom-lattice/core";
-import { randomUUID as randomUUID15 } from "crypto";
+import { randomUUID as randomUUID14 } from "crypto";
 function getTenantId16(request) {
   const userTenantId = request.user?.tenantId;
   if (userTenantId) {
@@ -12298,7 +12133,7 @@ async function createDatabaseConfig(request, reply) {
         message: "Database configuration with this key already exists"
       };
     }
-    const id3 = body.id || randomUUID15();
+    const id3 = body.id || randomUUID14();
     const config = await store2.createConfig(tenantId, id3, body);
     try {
       sqlDatabaseManager.registerDatabase(tenantId, config.key, config.config);
@@ -12503,7 +12338,7 @@ import {
   metricsServerManager as metricsServerManager2,
   SemanticMetricsClient as SemanticMetricsClient2
 } from "@axiom-lattice/core";
-import { randomUUID as randomUUID16 } from "crypto";
+import { randomUUID as randomUUID15 } from "crypto";
 function getTenantId17(request) {
   const userTenantId = request.user?.tenantId;
   if (userTenantId) {
@@ -12584,7 +12419,7 @@ async function createMetricsServerConfig(request, reply) {
         message: "selectedDataSources is required for semantic metrics servers"
       };
     }
-    const id3 = body.id || randomUUID16();
+    const id3 = body.id || randomUUID15();
     const configData = {
       key: body.key,
       name: body.name,
@@ -13247,7 +13082,7 @@ import {
   McpLatticeManager,
   convertToConnection
 } from "@axiom-lattice/core";
-import { randomUUID as randomUUID17 } from "crypto";
+import { randomUUID as randomUUID16 } from "crypto";
 
 // src/services/mcpConfigSync.ts
 var MCP_CONFIG_CHANGED_TOPIC = "mcp-config-changed";
@@ -13366,7 +13201,7 @@ async function createMcpServerConfig(request, reply) {
         message: "MCP server configuration with this key already exists"
       };
     }
-    const id3 = body.id || randomUUID17();
+    const id3 = body.id || randomUUID16();
     const config = await store2.createConfig(tenantId, id3, body);
     try {
       await connectAndRegisterTools(config);
@@ -15677,7 +15512,7 @@ function registerChannelRoutes(app2, dependencies) {
 }
 
 // src/controllers/channel-installations.ts
-import { randomUUID as randomUUID18 } from "crypto";
+import { randomUUID as randomUUID17 } from "crypto";
 import {
   descriptorDataValue
 } from "@axiom-lattice/protocols";
@@ -15898,7 +15733,7 @@ async function createChannelInstallation(request, reply) {
       };
     }
     const store2 = await getInstallationStore();
-    const installationId = randomUUID18();
+    const installationId = randomUUID17();
     const createInput = {
       channel: body.channel,
       name: body.name,
@@ -16890,7 +16725,7 @@ async function getLocalA2ATemplates(_request, reply) {
 }
 
 // src/routes/a2a-test-connection.ts
-import { randomUUID as randomUUID19 } from "crypto";
+import { randomUUID as randomUUID18 } from "crypto";
 function describeTestConnectionError(error, agentCardUrl) {
   if (!(error instanceof Error)) {
     return `Failed to fetch agent card from ${agentCardUrl}: ${String(error)}`;
@@ -16930,7 +16765,7 @@ async function ensureLocalRuntimeForConnectionTest(localRuntime, agentCardUrl) {
     return { error: portValidation.error };
   }
   const state = await localA2AService.startProvider(
-    `test-${randomUUID19()}`,
+    `test-${randomUUID18()}`,
     testRuntime
   );
   if (state.status === "running") return { runtimeId: state.runtimeId };
@@ -17363,13 +17198,13 @@ function snapshotEnsureInput(input) {
 import { createHash as createHash3 } from "crypto";
 
 // src/services/collaboration/ProjectTaskRunService.ts
-import { randomUUID as randomUUID21 } from "crypto";
+import { randomUUID as randomUUID20 } from "crypto";
 import {
   createTaskRunBridge
 } from "@axiom-lattice/core";
 
 // src/services/collaboration/ProjectTaskRunPlanner.ts
-import { randomUUID as randomUUID20 } from "crypto";
+import { randomUUID as randomUUID19 } from "crypto";
 
 // src/services/collaboration/ProjectTaskRunProtocol.ts
 import {
@@ -17685,7 +17520,7 @@ var ProjectTaskRunPlanner = class {
     } catch (error) {
       throw asPlanError(error);
     }
-    const inputId = (this.deps.idFactory ?? randomUUID20)();
+    const inputId = (this.deps.idFactory ?? randomUUID19)();
     const actor3 = input.actor ?? SYSTEM_ACTOR;
     const userId = actor3.startsWith("user:") && actor3.length > "user:".length ? actor3.slice("user:".length) : void 0;
     const trustedContext = {
@@ -17828,7 +17663,7 @@ var ProjectTaskRunService = class {
       ...deps.idFactory === void 0 ? {} : { idFactory: deps.idFactory }
     });
     this.runBridge = createTaskRunBridge({ lifecycle: deps.lifecycle });
-    this.idFactory = deps.idFactory ?? randomUUID21;
+    this.idFactory = deps.idFactory ?? randomUUID20;
     this.log = deps.log ?? { warn: () => void 0 };
   }
   /**
@@ -19185,7 +19020,7 @@ var AgentWebAppService = class {
   }
   async create(context, input) {
     await this.validateAssistant(context, input.assistantId);
-    const normalized = await this.validateConfig(context.tenantId, input);
+    const normalized = await this.validateConfig(context, input);
     return this.deps.webAppStore.create(context.tenantId, normalized);
   }
   async list(context, assistantId) {
@@ -19212,7 +19047,7 @@ var AgentWebAppService = class {
       identity: patch.identity ?? current3.identity
     };
     await this.validateAssistant(context, current3.assistantId);
-    const validated = await this.validateConfig(context.tenantId, effective);
+    const validated = await this.validateConfig(context, effective, current3);
     const update = {
       ...patch.name !== void 0 ? { name: validated.name } : {},
       ...Object.prototype.hasOwnProperty.call(patch, "description") ? { description: validated.description } : {},
@@ -19225,7 +19060,7 @@ var AgentWebAppService = class {
   }
   async enable(context, webAppId) {
     const current3 = await this.requireAuthorizedWebApp(context, webAppId);
-    await this.validateConfig(context.tenantId, current3);
+    await this.validateConfig(context, current3, current3);
     return this.writeSnapshot(context, current3, { status: "active" });
   }
   async disable(context, webAppId) {
@@ -19247,7 +19082,7 @@ var AgentWebAppService = class {
     if (await this.deps.configuredAgentResolver.exists(context.tenantId, assistantId)) return;
     throw new AgentWebAppError("ASSISTANT_NOT_FOUND", 404, "Assistant not found");
   }
-  async validateConfig(tenantId, input) {
+  async validateConfig(context, input, existing) {
     const allowedProjectIds = [...new Set(input.scope.allowedProjectIds)];
     if (!allowedProjectIds.length || !allowedProjectIds.includes(input.scope.defaultProjectId)) {
       throw new AgentWebAppError("PROJECT_SCOPE_INVALID", 400, "Default project must be in the project allowlist");
@@ -19255,13 +19090,28 @@ var AgentWebAppService = class {
     if (!input.features.projectSelector && allowedProjectIds.length !== 1) {
       throw new AgentWebAppError("PROJECT_SCOPE_INVALID", 400, "Disabled project selection requires exactly one project");
     }
+    const existingIds = new Set(existing?.scope.allowedProjectIds ?? []);
     for (const projectId of allowedProjectIds) {
-      if (!await this.deps.projectStore.getProjectById(tenantId, projectId)) {
+      if (!await this.deps.projectStore.getProjectById(context.tenantId, projectId)) {
         throw new AgentWebAppError("PROJECT_NOT_FOUND", 404, "Project not found");
       }
+      if (existingIds.has(projectId)) continue;
+      try {
+        await this.deps.projectAccess.requireExistingProjectAccess({
+          tenantId: context.tenantId,
+          userId: context.userId,
+          projectId,
+          capability: "read"
+        });
+      } catch (error) {
+        if (error instanceof ProjectCollaborationError) {
+          throw new AgentWebAppError("PROJECT_NOT_FOUND", 404, "Project not found");
+        }
+        throw error;
+      }
     }
     const scope = await this.validateModels(
-      tenantId,
+      context.tenantId,
       input.scope,
       input.features.modelSelector
     );
@@ -19470,7 +19320,7 @@ import { createHmac as createHmac3 } from "crypto";
 import { z as z5, ZodError as ZodError2 } from "zod";
 
 // src/services/agent-web-app/AgentWebAppRuntimeService.ts
-import { createHash as createHash4, randomUUID as randomUUID22 } from "crypto";
+import { createHash as createHash4, randomUUID as randomUUID21 } from "crypto";
 import { MessageChunkTypes as MessageChunkTypes3, parseAgentWebAppGenUIBlock, buildAffinityMissChunk as buildAffinityMissChunk2 } from "@axiom-lattice/protocols";
 import { getReplicaId as getReplicaId7, getThreadRunOwner as getThreadRunOwner2, normalizeAgentInterrupts as normalizeAgentInterrupts2 } from "@axiom-lattice/core";
 function isRecord9(value) {
@@ -19768,7 +19618,7 @@ ${formatFileRefsSection(refs)}` : input.content;
     const userDigest = createHash4("sha256").update(userId, "utf8").digest("hex");
     const contentDigest = createHash4("sha256").update(file.bytes).digest("hex");
     const displayName = file.name;
-    const physicalName = `${randomUUID22()}-${sanitizePhysicalFilename(file.name)}`;
+    const physicalName = `${randomUUID21()}-${sanitizePhysicalFilename(file.name)}`;
     const saved = await this.deps.saveProjectFile({
       tenantId: runtime.webApp.tenantId,
       workspaceId: runtime.project.workspaceId,
@@ -19929,7 +19779,7 @@ ${formatFileRefsSection(refs)}` : input.content;
     const thread = await this.deps.threadStore.createThread(
       runtime.webApp.tenantId,
       runtime.webApp.assistantId,
-      randomUUID22(),
+      randomUUID21(),
       { metadata: this.metadata(runtime, userId, normalizeLabel(rawLabel)) }
     );
     return toRuntimeThread(thread);
@@ -21339,7 +21189,7 @@ function registerCapabilityBundleRoutes(app2, controller) {
 import { ZodError as ZodError3 } from "zod";
 
 // src/services/model-provider/ModelProviderService.ts
-import { randomUUID as randomUUID23 } from "crypto";
+import { randomUUID as randomUUID22 } from "crypto";
 import { toModelKey } from "@axiom-lattice/protocols";
 import {
   assertSafeUpstreamUrl,
@@ -21678,7 +21528,7 @@ var unsafeReasonToErrorCode = {
 var ModelProviderService = class {
   constructor(deps) {
     this.deps = deps;
-    this.idFactory = deps.idFactory ?? (() => randomUUID23());
+    this.idFactory = deps.idFactory ?? (() => randomUUID22());
   }
   /**
    * List the tenant's provider configurations.
@@ -22869,12 +22719,12 @@ async function handleModelProviderChanged(payload, reconcile) {
 }
 
 // src/services/collaboration/ProjectRoomService.ts
-import { randomUUID as randomUUID24 } from "crypto";
+import { randomUUID as randomUUID23 } from "crypto";
 var ProjectRoomService = class {
   /** Creates a project room service from explicitly injected collaborators. */
   constructor(deps) {
     this.deps = deps;
-    this.idFactory = deps.idFactory ?? randomUUID24;
+    this.idFactory = deps.idFactory ?? randomUUID23;
   }
   /**
    * Authorizes read access and ensures the project's main room.
@@ -22934,7 +22784,7 @@ var ProjectRoomService = class {
 };
 
 // src/services/collaboration/ProjectMembershipService.ts
-import { randomUUID as randomUUID25 } from "crypto";
+import { randomUUID as randomUUID24 } from "crypto";
 var ProjectMembershipServiceError = class extends Error {
   constructor(code, statusCode, message) {
     super(message);
@@ -22943,14 +22793,14 @@ var ProjectMembershipServiceError = class extends Error {
     this.name = "ProjectMembershipServiceError";
   }
 };
-var membershipConflictNames2 = /* @__PURE__ */ new Set(["DuplicateProjectMembershipError", "ProjectMembershipIdConflictError"]);
+var membershipConflictNames = /* @__PURE__ */ new Set(["DuplicateProjectMembershipError", "ProjectMembershipIdConflictError"]);
 function isMembershipConflict(error) {
-  return error instanceof Error && membershipConflictNames2.has(error.name);
+  return error instanceof Error && membershipConflictNames.has(error.name);
 }
 var ProjectMembershipService = class {
   constructor(deps) {
     this.deps = deps;
-    this.idFactory = deps.idFactory ?? randomUUID25;
+    this.idFactory = deps.idFactory ?? randomUUID24;
     this.mutationMutex = deps.projectMutationMutex ?? projectMutationMutex;
   }
   async list(actor3) {
@@ -23080,7 +22930,7 @@ var ProjectMembershipService = class {
 };
 
 // src/services/collaboration/ProjectRosterService.ts
-import { randomUUID as randomUUID26 } from "crypto";
+import { randomUUID as randomUUID25 } from "crypto";
 var ProjectRosterServiceError = class extends Error {
   /** Creates a stable roster service error. */
   constructor(code, statusCode, message) {
@@ -23099,7 +22949,7 @@ var ProjectRosterService = class {
   /** Creates a roster service from explicitly injected collaborators. */
   constructor(deps) {
     this.deps = deps;
-    this.idFactory = deps.idFactory ?? randomUUID26;
+    this.idFactory = deps.idFactory ?? randomUUID25;
     this.mutationMutex = deps.projectMutationMutex ?? projectMutationMutex;
   }
   /**
@@ -23206,7 +23056,7 @@ var ProjectRosterService = class {
     const agent = (await this.deps.agents.list(actor3.tenantId, actor3.userId)).find((item) => item.assistantId === assistantId);
     if (!agent || agent.ownerUserId !== void 0) throw new ProjectRosterServiceError("ASSISTANT_NOT_FOUND", 404, "Agent not found");
     const room = await this.deps.roomStore.ensureMainRoom({
-      id: randomUUID26(),
+      id: randomUUID25(),
       tenantId: actor3.tenantId,
       workspaceId: project.workspaceId,
       projectId: actor3.projectId,
@@ -23550,7 +23400,7 @@ function virtualPublicProjectBot(project, room, agent, mentionName, now) {
 }
 
 // src/services/collaboration/RoomMessageService.ts
-import { createHash as createHash6, randomUUID as randomUUID27 } from "crypto";
+import { createHash as createHash6, randomUUID as randomUUID26 } from "crypto";
 
 // src/services/collaboration/ProjectBotMembershipSnapshot.ts
 import { snapshotExactRecord as snapshotExactRecord5 } from "@axiom-lattice/protocols";
@@ -23639,7 +23489,7 @@ var RoomMessageService = class {
   constructor(deps, options = {}) {
     this.deps = deps;
     this.idempotentOutcomes = /* @__PURE__ */ new Map();
-    this.idFactory = deps.idFactory ?? randomUUID27;
+    this.idFactory = deps.idFactory ?? randomUUID26;
     const limit = options.idempotentOutcomeLimit ?? 1e3;
     if (!Number.isSafeInteger(limit) || limit < 1) throw new RangeError("idempotentOutcomeLimit must be a positive safe integer");
     this.idempotentOutcomeLimit = limit;
@@ -23925,7 +23775,7 @@ import { ZodError as ZodError4 } from "zod";
 import { toProjectRoomPublicMessage } from "@axiom-lattice/protocols";
 
 // src/services/collaboration/RoomInterruptService.ts
-import { randomUUID as randomUUID28 } from "crypto";
+import { randomUUID as randomUUID27 } from "crypto";
 var RESUMABLE_TASK_INTERRUPT_CODES = /* @__PURE__ */ new Set([
   "PROJECT_TASK_NOT_RESUMABLE",
   "PROJECT_TASK_NOT_READY",
@@ -23963,7 +23813,7 @@ var RoomInterruptService = class {
   /** Creates the service from explicitly injected stores and dispatcher. */
   constructor(deps) {
     this.deps = deps;
-    this.idFactory = deps.idFactory ?? randomUUID28;
+    this.idFactory = deps.idFactory ?? randomUUID27;
   }
   /** Resolves a pending clarify interrupt with no answers. */
   async skip(input) {
@@ -24326,7 +24176,7 @@ async function execute(reply, operation) {
 }
 
 // src/routes/cospace.ts
-import { randomUUID as randomUUID29 } from "crypto";
+import { randomUUID as randomUUID28 } from "crypto";
 import { ZodError as ZodError6 } from "zod";
 import {
   generateDirectHumanProjectId,
@@ -24360,7 +24210,7 @@ async function computeUnread(deps, tenantId, userId, roomId, lastMessage) {
   });
 }
 function registerCoSpaceRoutes(app2, deps) {
-  const idFactory = deps.idFactory ?? (() => randomUUID29());
+  const idFactory = deps.idFactory ?? (() => randomUUID28());
   app2.get(
     "/api/workspaces/:workspaceId/rooms",
     async (request, reply) => {
@@ -25327,7 +25177,7 @@ function exactValues(value, required, optional = []) {
 }
 
 // src/services/collaboration/CoordinatorWakeNotifier.ts
-import { randomUUID as randomUUID30 } from "crypto";
+import { randomUUID as randomUUID29 } from "crypto";
 import {
   snapshotExactRecord as snapshotExactRecord7
 } from "@axiom-lattice/protocols";
@@ -25343,7 +25193,7 @@ var CoordinatorWakeNotifier = class {
     this.accepted = /* @__PURE__ */ new Set();
     this.maxPending = deps.maxPending ?? 1024;
     if (!Number.isSafeInteger(this.maxPending) || this.maxPending < 1) throw new RangeError("maxPending must be a positive safe integer");
-    this.idFactory = deps.idFactory ?? randomUUID30;
+    this.idFactory = deps.idFactory ?? randomUUID29;
   }
   /** Admits one notification without awaiting any store or dispatch operation. */
   handle(value, anchorMessageId) {
@@ -27274,7 +27124,7 @@ function isRecord10(value) {
 import { taskLifecycleNotifier } from "@axiom-lattice/core";
 
 // src/services/collaboration/ProjectRoomEventBroker.ts
-import { randomUUID as randomUUID31 } from "crypto";
+import { randomUUID as randomUUID30 } from "crypto";
 import {
   parseProjectRoomEventId,
   ProjectRoomBrokerCapacityError,
@@ -27305,7 +27155,7 @@ var ProjectRoomEventBroker = class {
     this.subscriberCount = 0;
     this.usageClock = 0;
     this.closed = false;
-    this.epoch = options.epoch ?? randomUUID31();
+    this.epoch = options.epoch ?? randomUUID30();
     if (!UUID_PATTERN.test(this.epoch)) {
       throw new TypeError("Project Room event epoch must be a lowercase canonical UUID");
     }
@@ -28959,6 +28809,7 @@ var registerLatticeRoutes = (app2, channelDeps, options = {}) => {
   const taskWorkItemStore = getStoreLattice28("default", "taskWorkItem").store;
   const projectTaskEnabled = options.projectTaskEnabled ?? process.env.AXIOM_PROJECT_TASK_EXECUTION_ENABLED !== "false";
   const accessService = new ProjectAccessService({ projectStore, membershipStore: projectMembershipStore, userTenantLinkStore });
+  setA2AProjectAccess(accessService);
   const realtimeMode = resolveProjectRoomRealtimeMode();
   const realtimeLog = options.projectTaskLog ?? { warn: () => void 0 };
   const roomMessageRetention = createRoomMessageRetentionJob({
@@ -29139,7 +28990,7 @@ var registerLatticeRoutes = (app2, channelDeps, options = {}) => {
     });
   }
   if (projectTaskComposition) app2.addHook("onClose", async () => projectTaskComposition.lease.release());
-  const taskThreadService = projectTaskComposition?.lease.runtime.threads ?? new ProjectTaskThreadService({ threads: threadStore, idFactory: randomUUID32 });
+  const taskThreadService = projectTaskComposition?.lease.runtime.threads ?? new ProjectTaskThreadService({ threads: threadStore, idFactory: randomUUID31 });
   const taskLifecycle = projectTaskComposition?.lease.runtime.lifecycle ?? createTaskLifecycleService({ taskStore, workItemStore: taskWorkItemStore });
   const reassignmentAuthorizer = createProjectTaskReassignmentAuthorizer(
     new ProjectTaskOwnerPolicy(projectBotMembershipStore),
@@ -29320,7 +29171,8 @@ var registerLatticeRoutes = (app2, channelDeps, options = {}) => {
       configuredAgentResolver: createConfiguredAgentResolver({
         hydrate: (tenantId) => agentLatticeManager5.initializeStoredAssistantsForTenant(tenantId),
         has: (tenantId, assistantId) => agentLatticeManager5.hasAgentLatticeWithTenant(tenantId, assistantId)
-      })
+      }),
+      projectAccess: accessService
     })
   });
   registerAgentWebAppRuntimeRoutes(app2, {
@@ -29330,7 +29182,7 @@ var registerLatticeRoutes = (app2, channelDeps, options = {}) => {
       userTenantLinkStore,
       ensureCoordinator: (scope) => coordinatorEnsurer.ensure(scope),
       log: realtimeLog
-    })),
+    }), accessService),
     taskController: createTaskController({
       access: {
         requireProjectAccess: async (input) => {
@@ -29626,7 +29478,7 @@ var registerLatticeRoutes = (app2, channelDeps, options = {}) => {
     userTenantLinkStore,
     ensureCoordinator: (scope) => coordinatorEnsurer.ensure(scope),
     log: realtimeLog
-  }));
+  }), accessService);
   registerDatabaseConfigRoutes(app2);
   registerMetricsServerConfigRoutes(app2);
   connectionRoutes(app2);
@@ -29824,7 +29676,7 @@ function tryCreateProjectTaskRuntime(input) {
 function createRuntime(input, stores, log2) {
   const controller = new AbortController();
   const mutex = new ProjectTaskExecutionMutex();
-  const threads = new ProjectTaskThreadService({ threads: input.threadStore, idFactory: randomUUID32 });
+  const threads = new ProjectTaskThreadService({ threads: input.threadStore, idFactory: randomUUID31 });
   const lifecycle = createTaskLifecycleService({ taskStore: input.taskStore, workItemStore: input.taskWorkItemStore });
   const projection = new RoomProjectionService({
     messages: input.projectRoomMessageStore,
@@ -29833,7 +29685,7 @@ function createRuntime(input, stores, log2) {
     warnings: input.taskWorkItemStore,
     log: log2,
     realtime: input.realtime,
-    idFactory: randomUUID32
+    idFactory: randomUUID31
   });
   const runService = new ProjectTaskRunService({
     tasks: input.taskStore,
@@ -30657,7 +30509,7 @@ var collectionRegistration = {
 
 // src/export_registrations/channel-installation.registration.ts
 import { getStoreLattice as getStoreLattice35 } from "@axiom-lattice/core";
-import { randomUUID as randomUUID33 } from "crypto";
+import { randomUUID as randomUUID32 } from "crypto";
 var UUID_PATTERN2 = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
 var PUBLIC_CHANNELS = /* @__PURE__ */ new Set(["lark", "email", "slack", "wechat", "wecom"]);
 function isPublicChannel(channel) {
@@ -30819,7 +30671,7 @@ var channelInstallationRegistration = {
       }
       id3 = sourceId;
     } else {
-      id3 = randomUUID33();
+      id3 = randomUUID32();
     }
     await store2.createInstallation(tenantId, id3, createInput);
     return { newId: id3 };
@@ -31379,7 +31231,7 @@ function createAuditLoggerMiddleware() {
 import { setBindingRegistry, setMenuRegistry, setEvalRunService } from "@axiom-lattice/core";
 
 // src/channels/wecom/WecomChannelAdapter.ts
-import { randomUUID as randomUUID34 } from "crypto";
+import { randomUUID as randomUUID33 } from "crypto";
 import { z as z13 } from "zod";
 import * as WecomAiBot from "@wecom/aibot-node-sdk";
 
@@ -31743,7 +31595,7 @@ function streamIdFor(replyTarget) {
   const key = replyKeyForTarget(replyTarget);
   let streamId = streamIdsByReqId.get(key);
   if (!streamId) {
-    streamId = randomUUID34();
+    streamId = randomUUID33();
     streamIdsByReqId.set(key, streamId);
     if (streamIdsByReqId.size > MAX_TRACKED_STREAMS) {
       const oldest = streamIdsByReqId.keys().next().value;
@@ -33038,7 +32890,7 @@ import {
   snapshotExactRecord as snapshotExactRecord15,
   MessageChunkTypes as MessageChunkTypes4
 } from "@axiom-lattice/protocols";
-import { randomUUID as randomUUID35 } from "crypto";
+import { randomUUID as randomUUID34 } from "crypto";
 
 // src/services/channel-reply/channelReplyRuntimeRegistry.ts
 var active;
@@ -33393,7 +33245,7 @@ var _MessageRouter = class _MessageRouter {
         }
         if (!threadId) {
           const threadStore = getStoreLattice39("default", "thread").store;
-          const newThreadId = randomUUID35();
+          const newThreadId = randomUUID34();
           console.log({
             event: "dispatch:thread:create",
             agentId,
@@ -33432,7 +33284,7 @@ var _MessageRouter = class _MessageRouter {
           senderId: message.sender.id,
           contentLength: message.content.text.length
         }, "Dispatching to agent");
-        const inputMessageId = randomUUID35();
+        const inputMessageId = randomUUID34();
         const replyTarget = internalRoom ? correlatedRoomReplyTarget(message.replyTarget, inputMessageId) : message.replyTarget;
         const replyAdapter = replyTarget ? this.adapterRegistry.get(replyTarget.adapterChannel) : void 0;
         if (options.trustedMessageOptions && (!this.trustedDispatcher || !replyTarget || !replyAdapter)) {
@@ -33629,7 +33481,7 @@ var _MessageRouter = class _MessageRouter {
     };
     const runLedger = getStoreLattice39("default", "agentRun").store;
     const jobStore = getStoreLattice39("default", "channelReplyJob").store;
-    const runId = randomUUID35();
+    const runId = randomUUID34();
     await jobStore.create({
       runId,
       tenantId,
@@ -34281,7 +34133,7 @@ async function prepareProjectTaskRuntime(runtime, log2) {
 import { setPluginDeploymentService } from "@axiom-lattice/core";
 
 // src/services/plugins/PluginDeploymentService.ts
-import { randomUUID as randomUUID36 } from "crypto";
+import { randomUUID as randomUUID35 } from "crypto";
 import {
   PLUGIN_HOST_DIR,
   PluginDeploymentRuntimeRegistry
@@ -34425,7 +34277,7 @@ var PluginDeploymentService = class {
       const failedAt = this.nowIso();
       await this.store.upsert(
         this.buildRecord({
-          id: existing?.id ?? randomUUID36(),
+          id: existing?.id ?? randomUUID35(),
           tenantId,
           pluginType,
           pluginVersion: manifest.version,
@@ -34447,7 +34299,7 @@ var PluginDeploymentService = class {
       );
     }
     const record = this.buildRecord({
-      id: existing?.id ?? randomUUID36(),
+      id: existing?.id ?? randomUUID35(),
       tenantId,
       pluginType,
       pluginVersion: manifest.version,
@@ -38639,8 +38491,8 @@ var start = async (config) => {
     });
     try {
       const { A2AAuthService: A2AAuthService2, parseEnvKeys: parseEnvKeys2 } = await import("./A2AAuthService-UKN53ZGP.mjs");
-      const { registerA2AStandardRoutes } = await import("./a2a-standard-INVCUSAW.mjs");
-      const a2a = await import("./a2a-TDZ3TT6H.mjs");
+      const { registerA2AStandardRoutes } = await import("./a2a-standard-MD7WNDTP.mjs");
+      const a2a = await import("./a2a-YLKZE5JG.mjs");
       const a2aKeyStore = getStoreLattice42("default", "a2aApiKey").store;
       const assistantStore = getStoreLattice42("default", "assistant").store;
       const projectStore = getStoreLattice42("default", "project").store;
@@ -38674,7 +38526,7 @@ var start = async (config) => {
       const { registerOpenCatalogRoutes } = await import("./open-catalog-NVGP6SQP.mjs");
       const { registerOpenFilesRoutes } = await import("./open-files-JPB2NBL6.mjs");
       const { registerOpenAuditRoutes } = await import("./open-audit-UJ3NXCGW.mjs");
-      const { registerOpenExposureRoutes } = await import("./open-exposure-BPLYUIX6.mjs");
+      const { registerOpenExposureRoutes } = await import("./open-exposure-HGYT5VFC.mjs");
       const { openLattice } = await import("./openLattice-D5YTSZBY.mjs");
       const { createKbProvider } = await import("./kbProvider-2D6DZ34N.mjs");
       const { createOpenSandboxProvider } = await import("./sandboxProvider-FILMFVIM.mjs");