@happyvertical/smrt-chat 0.51.9 → 0.51.14

package/AGENTS.md

@@ -13,6 +13,14 @@ through `createChatStreamHandler` in plain mode, so an embedded `SmrtChatBackend
 client can exercise token streaming locally. `/previews` hosts the shared
 component playground entries from `src/svelte/playground.ts`.
 
+The root route also drives the **browser inference path**
+(`@happyvertical/smrt-web/ai`: bitgpu, WebLLM, and route backends composed by
+`createInferencePath`) and an **agent-addressable draft form** (`useViewIntent`
+over `src/routes/chat-dev.intents.ts`, #2588). Their dev-config dependencies
+(static optional-peer imports, `workspace-aliases.js` prefix rules, the theme
+stylesheet import) and the stage→apply tool-call gotchas are in
+[agents/dev-workbench.md](agents/dev-workbench.md).
+
 The root workbench also has a dev-only voice conversation mode. It reads voice
 gateway connection details through `/api/dev-voice/config`, streams browser mic
 audio to `WS /ws/voice` as PCM16 mono, appends gateway transcripts/responses to
@@ -37,7 +45,7 @@ by the module-local `sendAgentReply` function.
 - **ChatParticipant**: `role` (owner/admin/member/viewer), `onlineStatus`, `lastReadMessageId`, `isMuted`. Tenant-scoped (required).
 - **ChatThread**: `rootMessageId`, `isResolved`, `messageCount`. Created via `ChatService.startThread()` (member-checked). Tenant-scoped (required).
 - **ChatReaction**: `messageId`, `profileId`, `emoji`. Added/removed via `ChatService.addReaction()`/`removeReaction()` (member-checked, self-keyed). Tenant-scoped (required).
-- **AgentSession**: `agentId` (string ref, not FK), `allowedTools` (JSON string array), `sessionContext` (JSON), `systemPrompt`, limits (`maxTokens`/`maxMessages`/`expiresAt`). Optional tenancy.
+- **AgentSession**: `agentId` (application slug, string ref, not FK), `agentProfileId` (nullable `crossPackageRef` to `Profile` — the `bot` profile the agent AUTHORS as, #2995), `allowedTools` (JSON string array), `sessionContext` (JSON), `systemPrompt`, limits (`maxTokens`/`maxMessages`/`expiresAt`). Optional tenancy.
 - **VoiceSession**: short-lived voice-gateway binding over `(tenant, actorProfileId, personaId, room/thread/agentSession)` plus a persona snapshot, gateway `session_id`, expiry, replay tracking, and metadata. Tenant-scoped (required). Generated surface is read-only; creation and turns go through `createVoiceChatSession()` / `handleVoiceGatewayTurn()`.
 
 ## ChatService
@@ -69,7 +77,8 @@ membership of the server-supplied actor, not a caller-selected subject.
 
 Trusted agent runtime imports `sendAgentReply(service, params)` only from
 `@happyvertical/smrt-chat/internal/agent-runtime`. It is not a `ChatService`
-method or package-index export. It authors as `session.agentId`, accepts a
+method or package-index export. It authors as `session.agentProfileId` — the
+agent's resolved `bot` Profile, NEVER the `agentId` slug (#2995) — accepts a
 same-room/tenant thread, and enforces `allowedTools` fail-closed.
 
 Private `#writeMessage` alone can select arbitrary authors/roles or bypass
@@ -94,7 +103,7 @@ The `AgentSession` runtime depends on personas, agents, and users. Keep those
 edges acyclic: none of those packages may depend back on chat.
 
 - **`runToolLoop(options)`** (`tool-loop.ts`) — a bounded `tool_call → observe → respond` loop. Tools are **manifest operations** of installed packages: `buildManifestToolCatalog({ allowedTools })` reads the `PermissionCatalogService` catalog and keeps only the `(collection, action)` entries named in the persona's allow-list (the **offer gate**; absent/empty ⇒ NO tools). The loop runs inside one `executeAsPrincipal` context, and `invokeManifestTool` executes each op **in-process ("side door")** against `run.context.database` (the RLS tx when Postgres RLS is on), after re-asserting the fail-closed allow-list (`run.assertToolAllowed`) AND the catalog permission (`run.assertOperation`) — the **execution gate**. Bounded by a max-steps ceiling (`DEFAULT_MAX_STEPS = 8`): on the ceiling it disables tools for one final completion so the turn always terminates with text.
-- **`runPersonaConversationTurn(options)`** (`persona-conversation.ts`) — binds a conversation to an `AgentPersona`/`ResolvedPersona`: runs as its principal (`runAsUserId`), offers only its `allowedTools`, speaks its instructions (`resolvePersonaInstructions`, layering approved learned directives), and injects its **recalled learning memory** (`personaLearningMemory`, isolated per `memoryScope`) into the system prompt. `bindPersonaToSession()` mirrors the persona's `allowedTools`/instructions onto the `AgentSession` so the chat authoring gate agrees with the loop's offer gate. Authors the reply (and each executed tool) via the internal `sendAgentReply` bridge.
+- **`runPersonaConversationTurn(options)`** (`persona-conversation.ts`) — binds a conversation to an `AgentPersona`/`ResolvedPersona`: runs as its principal (`runAsUserId`), offers only its `allowedTools`, speaks its instructions (`resolvePersonaInstructions`, layering approved learned directives), and injects its **recalled learning memory** (`personaLearningMemory`, isolated per `memoryScope`) into the system prompt. `bindPersonaToSession()` mirrors the persona's `allowedTools`/instructions onto the `AgentSession` so the chat authoring gate agrees with the loop's offer gate. Authors the reply (and each executed tool) via the internal `sendAgentReply` bridge. Tools run with the run-as user's **live** permissions unless the host passes a `permissions` snapshot (#2978), which `runToolLoop` forwards to `executeAsPrincipal` so a narrowed principal (e.g. a shared station) cannot reach grants — such as `readPermission`-gated data-surface fields — beyond that snapshot, including through `agents.invoke` delegation (the snapshot becomes the worker's permission ceiling).
 - **Agent orchestration** (L3, #1892) — the loop accepts non-manifest **`extraTools`** (`PrincipalTool[]`, from `@happyvertical/smrt-agents`), gated by the *same* fail-closed allow-list. The standard **`invoke-agent`** tool (`createInvokeAgentTool`, slug `agents.invoke`) lets a conversational agent delegate to a **worker agent under its own principal** — the worker runs via `executeAsPrincipal` as the originating user (never its own authority), the principal is immutable along the chain, and its completion is surfaced back into the conversation. `runPersonaConversationTurn` filters `extraTools` by the persona's `allowedTools` (offer gate); the tool's `execute` re-asserts `assertToolAllowed` (execution gate). See `@happyvertical/smrt-agents` for the delegation envelope + transports.
 - **Chat feedback capture** (`chat-feedback.ts`) — `captureChatFeedback()` + `acceptAppliedChange`/`rejectAppliedChange`/`correctResponse`/`rateResponse`/`thumbsUp`/`thumbsDown` write a `Feedback` row (personas) carrying the conversation's **correlation-id**, and (by default) reinforce the persona's learning memory (`reinforceFromFeedback`). So an in-chat reject decays a strategy below the reuse floor and it stops being recalled; a correction supersedes its stored value.
 
@@ -137,6 +146,8 @@ reconnaissance, and open gaps.
 
 - **sessionContext, not context**: `context` is reserved for slug scoping. Use `getSessionContext()`/`updateSessionContext()` for agent memory.
 - **Agent rooms auto-created**: `roomType: 'agent'`, `maxParticipants` defaults to 2; the agent is enrolled as a member so its replies pass the membership check. `createAgentSession()` re-enrolls the participant AND the agent on the existing-session path, so legacy sessions created before the agent was enrolled self-heal.
+- **The agent's author is a Profile, not `agentId` (#2995)**: `senderProfileId`/`profileId` are `crossPackageRef`s to `Profile` and therefore uuid columns on PostgreSQL, so the slug fails the cast (`22P02`) and no agent reply can persist. `createAgentSession()` resolves the agent's `bot` Profile through `resolveAgentProfile()` in `@happyvertical/smrt-profiles` (created on first use, tenant-bound) and records it as `AgentSession.agentProfileId`; both enrolment and `sendAgentReply` use that uuid. A consumer whose agent already has an acting identity passes `agentProfileId` to skip resolution — the voice path does this with the persona's `actsAsProfileId`, so persona replies stay attributed to the configured acting profile. Like `actorProfileId`, `agentProfileId` is SERVER-supplied, never request input: it selects the author of every later assistant message. It is validated (`#requireAgentProfile`) to exist and be visible in the tenant and to differ from the acting participant, and it can never re-point a session that already resolved one — only a pre-#2995 session with none is backfilled. **Migration**: `agent_profile_id` is an ordinary additive manifest field, so a consumer adopts it the same way as any other — `smrt db:migrate` generates and applies the column from the manifest, and `db:status --parity` verifies it; the framework never creates application schema at runtime. It is nullable and needs no offline DATA backfill — a session created before #2995 resolves and persists its `agentProfileId`, and re-enrols the agent, on its first agent turn after the upgrade. Two pre-#2995 cohorts: a session whose `agentId` is an ordinary slug never committed an author on PostgreSQL (the cast failed), so there is nothing to repair there, while SQLite/DuckDB may hold `chat_messages`/`chat_participants` rows whose id column holds the slug — readable, but not joinable to `profiles`. A session whose `agentId` is already a Profile uuid (the voice path used to collapse a persona's `actsAsProfileId` into it) DID commit on PostgreSQL; that profile is ADOPTED as the author, tenant-checked and never the participant, so the conversation's author does not change and the two-seat room gains no third identity. Known one-time effect: because `voice.ts` no longer derives `agentId` from `actsAsProfileId`, a keyless `createVoiceChatSession()` for such a persona opens a new session and room instead of reusing the legacy one; the old room and its messages stay intact and readable, and resuming with an explicit `agentSessionId` is unaffected.
+- **Only SQLite-backed tests would miss this class of bug**: uuid columns accept any text on SQLite. `src/__tests__/agent-reply-postgres.test.ts` (`pnpm --filter @happyvertical/smrt-chat test:postgres`) pins the agent-reply path against real PostgreSQL. That suite is NOT part of required PR CI — it runs in `postgres-tests.yml`, gated on `vars.CI_POSTGRES_ENABLED` / manual dispatch — so keep a cheap SQLite assertion alongside it (`chat-service.test.ts` asserts the author is the profile uuid, not the slug).
 - **Per-subject sessions need `sessionKey`**: `createAgentSession()` reuses ANY active session for the same `(agentId, participantProfileId, tenantId)`. Callers that open separate conversations per subject (e.g. one content-editor session per content id) MUST pass a stable `sessionKey` (stored in `sessionContext.__sessionKey`, read via `AgentSession.getSessionKey()`); otherwise a session opened for one subject is reused and its context overwritten for another, surfacing the wrong room/threads (S5 #1392). A keyed create never reuses a keyless/legacy session.
 - **Session expiry**: check `isActive()` before allowing messages (expiresAt or limit-based)
 - **DM identity**: derived from the deterministic per-tenant `canonicalDmRoomId()` and the authoritative `chat_participants` join, not client metadata; concurrent creates upsert onto one row.

package/agents/dev-workbench.md

@@ -0,0 +1,71 @@
+# Chat dev workbench: browser inference and draft form
+
+Reference for the `pnpm --dir packages/chat dev` workbench root route
+(`src/routes/+page.svelte`). Linked from [../AGENTS.md](../AGENTS.md).
+
+## Browser inference path
+
+The root route drives the **browser inference path**
+(`@happyvertical/smrt-web/ai`) end to end, which is what the workbench exists to
+exercise now: THREE backends — `createBitGpuInferenceBackend()` (Bonsai 1.7B,
+~237 MB, the dev-loop default), `createWebLlmInferenceBackend()`, and
+`createRouteInferenceBackend()` over `/api/dev-chat-stream` — composed by
+`createInferencePath({ backends: [bitgpu, local, route] })`. The local backends
+are listed first, so `auto` prefers one whenever it is READY; the route backend is
+always ready, so `auto` always has somewhere to land. The status panel's Inference
+selector pins `auto` / `bitgpu` / `local` / `route`, it renders a
+`ModelStatusControl` per local backend, and the reply is rendered as it streams.
+`/api/dev-chat` is retained as the non-streaming reference endpoint; the workbench
+no longer calls it.
+
+Four dev-config facts this depends on:
+
+- The workbench injects `loadModule: () => import('@mlc-ai/web-llm')` and, for
+  bitgpu, `loadBitGpu`/`loadChat` as `() => import('bitgpu')` /
+  `() => import('bitgpu/chat')`. A browser resolves only STATIC specifiers — the
+  adapters' own optional-import helpers use variable ones — so without these the
+  optional peers fail to load and (for WebLLM) the error misreports the package as
+  "not installed".
+- bitgpu's per-model `manifest.json` + `.aux.bin` come from its repo via jsDelivr;
+  the Bonsai GGUF streams from the Hub; the tokenizer comes from
+  `onnx-community/Bonsai-1.7B-ONNX` because `prism-ml/Bonsai-1.7B-gguf` ships no
+  `tokenizer.json`.
+- `workspace-aliases.js` must list every deep `@happyvertical/smrt-ui/*` subpath
+  a consumer reaches. A string alias is a PREFIX match, so the bare
+  `@happyvertical/smrt-ui` entry rewrites any unlisted subpath under it into a
+  bogus path under `src/index.ts`. That includes STYLESHEETS:
+  `@happyvertical/smrt-ui/themes/styles/all.css` needs its own entry or the app
+  renders with no theme variables at all.
+- The workbench imports `@happyvertical/smrt-ui/themes/styles/{all,fonts}.css`.
+  `ThemeProvider` for a BUILT-IN preset only sets `data-theme` /
+  `data-color-scheme` on its wrapper — it deliberately emits no inline variables,
+  because built-ins ship their palette as static CSS. Without the import the
+  attributes are present, `--smrt-color-*` resolves to nothing, and every themed
+  surface paints transparent (which reads as "dark mode is broken" in a dark
+  scheme). `smrt-workbench/host` is the reference for this.
+
+## Agent-addressable draft form
+
+The workbench also carries an **agent-addressable draft form**: an `Input` inside
+a `Form`, bound by `useViewIntent` to the intent declared in
+`src/routes/chat-dev.intents.ts` (#2588). It is the end-to-end demonstration of the
+control-interaction stack — an agent stages, a human applies. Four things about it
+are non-obvious and cost time to find:
+
+- **No `<Provider>` here, so both seams must be explicit.** `useViewIntent` is a
+  documented silent no-op without a Provider ancestor, so the binding passes
+  `controlRegistry` directly; and `effects: ['read', 'write']` supplies the
+  exposure policy, because the default is read-only and would exclude a `stage`.
+- **`inputSchema` on the declaration is REQUIRED for the tool to be callable.**
+  `compileViewIntentToolSpec` passes it through verbatim, but
+  `buildControlCommand` throws `IntentArgumentError('value')` for a `stage` with
+  no `value`. Without it the tool registers, advertises
+  `{"type":"object","properties":{}}`, and fails at call time with Chrome's
+  `UnknownError: Failed to parse input arguments`.
+- **`document.modelContext.executeTool(tool, args)` takes the tool OBJECT from
+  `getTools()` and the arguments as a JSON STRING** — an object as the second
+  argument fails the same way.
+- **Apply needs a genuinely trusted gesture.** The registry refuses a
+  programmatic `element.click()` (`event.isTrusted === false`) for `apply`, which
+  is the stage→apply consent split doing its job. Verification must use a real
+  input event, not `evaluate(() => button.click())`.

package/dist/chunks/{ChatService-B2piYas4.js → ChatService-D48KBDZy.js}

@@ -1,5 +1,6 @@
 import { ObjectRegistry, SmrtCollection, SmrtObject, crossPackageRef, field, foreignKey, smrt } from "@happyvertical/smrt-core";
 import { TenantScoped, tenantId } from "@happyvertical/smrt-tenancy";
+import { ProfileCollection, resolveAgentProfileId } from "@happyvertical/smrt-profiles";
 import { createHash } from "node:crypto";
 //#region \0rolldown/runtime.js
 var __defProp$7 = Object.defineProperty;
@@ -32,6 +33,7 @@ var __publicField = (obj, key, value) => __defNormalProp(obj, typeof key !== "sy
 var AgentSession = class extends SmrtObject {
 	tenantId = null;
 	agentId = "";
+	agentProfileId = null;
 	participantProfileId = "";
 	chatRoomId = null;
 	status = "active";
@@ -49,6 +51,7 @@ var AgentSession = class extends SmrtObject {
 		super(options);
 		if (options.tenantId !== void 0) this.tenantId = options.tenantId;
 		if (options.agentId !== void 0) this.agentId = options.agentId;
+		if (options.agentProfileId !== void 0) this.agentProfileId = options.agentProfileId;
 		if (options.participantProfileId !== void 0) this.participantProfileId = options.participantProfileId;
 		if (options.chatRoomId !== void 0) this.chatRoomId = options.chatRoomId;
 		if (options.status !== void 0) this.status = options.status;
@@ -154,6 +157,7 @@ var AgentSession = class extends SmrtObject {
 __publicField(AgentSession, "SESSION_KEY_CONTEXT_FIELD", "__sessionKey");
 __decorateClass$6([tenantId({ nullable: true })], AgentSession.prototype, "tenantId", 2);
 __decorateClass$6([field({ required: true })], AgentSession.prototype, "agentId", 2);
+__decorateClass$6([crossPackageRef("@happyvertical/smrt-profiles:Profile")], AgentSession.prototype, "agentProfileId", 2);
 __decorateClass$6([crossPackageRef("@happyvertical/smrt-profiles:Profile", { required: true })], AgentSession.prototype, "participantProfileId", 2);
 __decorateClass$6([foreignKey("ChatRoom")], AgentSession.prototype, "chatRoomId", 2);
 __decorateClass$6([field({ required: true })], AgentSession.prototype, "status", 2);
@@ -732,6 +736,7 @@ var AgentSessionCollection = class extends SmrtCollection {
 		const sessionContext = params.sessionKey != null ? JSON.stringify({ [AgentSession.SESSION_KEY_CONTEXT_FIELD]: params.sessionKey }) : void 0;
 		return await this.create({
 			agentId: params.agentId,
+			agentProfileId: params.agentProfileId ?? null,
 			participantProfileId: params.participantProfileId,
 			tenantId: params.tenantId ?? null,
 			allowedTools: JSON.stringify(params.allowedTools ?? []),
@@ -1230,6 +1235,7 @@ var ChatService_exports = /* @__PURE__ */ __exportAll({
 	sendAgentReply: () => sendAgentReply
 });
 var RUN_AGENT_REPLY = /* @__PURE__ */ Symbol("smrt-chat.runAgentReply");
+var UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/iu;
 var ChatService = class ChatService {
 	#rooms;
 	#messages;
@@ -1238,7 +1244,13 @@ var ChatService = class ChatService {
 	#agentSessions;
 	#reactions;
 	#voiceSessions;
-	constructor(rooms, messages, participants, threads, agentSessions, reactions, voiceSessions) {
+	/**
+	* Profiles of the OWNING package (`@happyvertical/smrt-profiles`), used only
+	* to resolve the `bot` Profile an agent authors as (#2995). Private for the
+	* same reason as the chat collections: it can mint/read profile rows.
+	*/
+	#profiles;
+	constructor(rooms, messages, participants, threads, agentSessions, reactions, voiceSessions, profiles) {
 		this.#rooms = rooms;
 		this.#messages = messages;
 		this.#participants = participants;
@@ -1246,6 +1258,7 @@ var ChatService = class ChatService {
 		this.#agentSessions = agentSessions;
 		this.#reactions = reactions;
 		this.#voiceSessions = voiceSessions;
+		this.#profiles = profiles;
 	}
 	static async create(options) {
 		ObjectRegistry.registerCollection("@happyvertical/smrt-chat:ChatRoom", ChatRoomCollection);
@@ -1262,7 +1275,8 @@ var ChatService = class ChatService {
 		const agentSessions = await ObjectRegistry.getCollection("@happyvertical/smrt-chat:AgentSession", options);
 		const reactions = await ObjectRegistry.getCollection("@happyvertical/smrt-chat:ChatReaction", options);
 		const voiceSessions = await ObjectRegistry.getCollection("@happyvertical/smrt-chat:VoiceSession", options);
-		return new ChatService(rooms, messages, participants, threads, agentSessions, reactions, voiceSessions);
+		const profiles = await ProfileCollection.create(options);
+		return new ChatService(rooms, messages, participants, threads, agentSessions, reactions, voiceSessions, profiles);
 	}
 	/** Initialize all underlying collections (table creation) */
 	async initialize() {
@@ -1602,6 +1616,7 @@ var ChatService = class ChatService {
 	async createAgentSession(params) {
 		const participantProfileId = params.actorProfileId;
 		const sessionKey = params.sessionKey ?? null;
+		const suppliedAgentProfileId = params.agentProfileId ? await this.#requireAgentProfile(params.agentProfileId, params.tenantId, participantProfileId) : null;
 		const existingSession = await this.#agentSessions.findActiveSession(params.agentId, participantProfileId, params.tenantId, sessionKey);
 		if (existingSession && existingSession.tenantId === params.tenantId) {
 			if (existingSession.chatRoomId) {
@@ -1616,10 +1631,14 @@ var ChatService = class ChatService {
 						profileId: participantProfileId,
 						role: "owner"
 					});
+					if (!existingSession.agentProfileId) if (suppliedAgentProfileId) {
+						existingSession.agentProfileId = suppliedAgentProfileId;
+						await existingSession.save();
+					} else await this.#resolveAgentProfileId(existingSession);
 					await this.#enrollParticipant({
 						tenantId: params.tenantId,
 						roomId: existingRoom.id,
-						profileId: params.agentId,
+						profileId: existingSession.agentProfileId,
 						role: "member"
 					});
 					return {
@@ -1630,6 +1649,10 @@ var ChatService = class ChatService {
 			}
 			await existingSession.expire();
 		}
+		const agentProfileId = suppliedAgentProfileId ?? await resolveAgentProfileId(this.#profiles, {
+			agentId: params.agentId,
+			tenantId: params.tenantId
+		});
 		const room = await this.#rooms.create({
 			tenantId: params.tenantId,
 			name: "",
@@ -1647,11 +1670,12 @@ var ChatService = class ChatService {
 		await this.#enrollParticipant({
 			tenantId: params.tenantId,
 			roomId: room.id,
-			profileId: params.agentId,
+			profileId: agentProfileId,
 			role: "member"
 		});
 		const session = await this.#agentSessions.findOrCreate({
 			agentId: params.agentId,
+			agentProfileId,
 			participantProfileId,
 			tenantId: params.tenantId,
 			allowedTools: params.allowedTools,
@@ -1695,7 +1719,8 @@ var ChatService = class ChatService {
 	*
 	* INTERNAL authority: this is the only path that authors a message as the
 	* agent, and it is not reachable with a caller-supplied `senderProfileId`/
-	* `role`. The author is always `session.agentId`. Tool calls are gated
+	* `role`. The author is always the session's resolved agent Profile
+	* (`session.agentProfileId`), never the `agentId` slug (#2995). Tool calls are gated
 	* fail-closed against the session's allow-list. Intended for the trusted
 	* agent-runtime, never a per-tenant request handler driven by client-supplied
 	* role/sender.
@@ -1713,10 +1738,17 @@ var ChatService = class ChatService {
 			if (!toolName) throw new Error("Tool call is missing a tool name");
 			if (!session.isToolAllowed(toolName)) throw new Error(`Tool '${toolName}' is not allowed for this agent session (authorization denied)`);
 		}
+		const agentProfileId = await this.#resolveAgentProfileId(session);
+		await this.#enrollParticipant({
+			tenantId: params.tenantId,
+			roomId: session.chatRoomId,
+			profileId: agentProfileId,
+			role: "member"
+		});
 		return this.#writeMessage({
 			tenantId: params.tenantId,
 			roomId: session.chatRoomId,
-			senderProfileId: session.agentId,
+			senderProfileId: agentProfileId,
 			content: params.content,
 			role,
 			messageType: params.messageType ?? "text",
@@ -1725,6 +1757,77 @@ var ChatService = class ChatService {
 			toolCallData: params.toolCallData ?? null
 		});
 	}
+	/**
+	* Validate a SERVER-supplied agent authoring Profile (S5 #1392, #2995).
+	*
+	* `agentProfileId` selects the author of every later assistant message in the
+	* session and is enrolled as a room member, so it is held to the same
+	* standard as `actorProfileId`: it must resolve to a Profile that is VISIBLE
+	* IN THIS TENANT (the model uses optional tenancy, so an untenanted profile
+	* is legitimate and a profile owned by another tenant is not), and it must
+	* not be the acting participant — an agent room has exactly two identities.
+	*
+	* The `bot` profile type is deliberately NOT required: a persona's
+	* `actsAsProfileId` is an ordinary `crossPackageRef` to `Profile` with no
+	* type constraint anywhere in the framework, and demanding one here would
+	* reject the framework's own acting identities.
+	*/
+	async #requireAgentProfile(agentProfileId, tenantId, actorProfileId) {
+		if (agentProfileId === actorProfileId) throw new Error("agentProfileId must not be the acting participant (authorization denied)");
+		const profile = await this.#profiles.get({ id: agentProfileId });
+		if (!profile) throw new Error("agentProfileId does not resolve to a profile (authorization denied)");
+		if (profile.tenantId !== null && profile.tenantId !== tenantId) throw new Error("agentProfileId belongs to another tenant (authorization denied)");
+		return agentProfileId;
+	}
+	/**
+	* Resolve the Profile uuid an agent session's agent authors as (#2995).
+	*
+	* `agentId` is an application slug; every authoring seam is a uuid column
+	* referencing `Profile`, so the slug can never be the author. The agent's
+	* `bot` Profile is resolved — created on first use, tenant-bound — through
+	* the owning package's `resolveAgentProfile()` API.
+	*
+	* Sessions created before #2995 carry no `agentProfileId`. They are backfilled
+	* lazily here, on the first agent turn after the upgrade, so an existing
+	* conversation keeps working without an offline migration.
+	*
+	* One pre-#2995 cohort must be ADOPTED rather than resolved: the voice path
+	* used to collapse a persona's `actsAsProfileId` into `agentId`, so those
+	* sessions carry a real Profile uuid there — and on PostgreSQL those rows
+	* committed, because the uuid cast succeeded. Minting a fresh `bot` profile
+	* for them would change the author mid-conversation, permanently (the
+	* no-re-point rule), and enrol a third identity in a two-seat room. When
+	* `agentId` already names a Profile visible in this tenant that is not the
+	* session participant, that Profile IS the author and is adopted as-is.
+	*/
+	async #resolveAgentProfileId(session) {
+		if (session.agentProfileId) return session.agentProfileId;
+		const agentProfileId = await this.#adoptLegacyAgentIdProfile(session) ?? await resolveAgentProfileId(this.#profiles, {
+			agentId: session.agentId,
+			tenantId: session.tenantId
+		});
+		session.agentProfileId = agentProfileId;
+		await session.save();
+		return agentProfileId;
+	}
+	/**
+	* Adopt a pre-#2995 session whose `agentId` is already a Profile uuid, or
+	* return `null` when it is an ordinary agent slug.
+	*
+	* Held to the same standard as a caller-supplied `agentProfileId`: the
+	* Profile must be visible in the session's tenant and must not be the session
+	* participant, so an `agentId` that happens to collide with a human profile
+	* cannot make that human the author.
+	*/
+	async #adoptLegacyAgentIdProfile(session) {
+		const candidate = session.agentId;
+		if (!UUID_PATTERN.test(candidate)) return null;
+		if (candidate === session.participantProfileId) return null;
+		const profile = await this.#profiles.get({ id: candidate });
+		if (!profile) return null;
+		if (profile.tenantId !== null && profile.tenantId !== session.tenantId) return null;
+		return candidate;
+	}
 	/** Load an active agent session by id, tenant-bound, or throw. */
 	async #loadActiveSession(agentSessionId, tenantId) {
 		const session = await this.#agentSessions.get({
@@ -1914,4 +2017,4 @@ function sendAgentReply(service, params) {
 //#endregion
 export { VoiceSession as a, ChatReaction as c, AgentSession as d, VoiceSessionCollection as i, ChatParticipant as l, ChatService_exports as n, ChatThread as o, sendAgentReply as r, ChatRoom as s, ChatService as t, ChatMessage as u };
 
-//# sourceMappingURL=ChatService-B2piYas4.js.map
+//# sourceMappingURL=ChatService-D48KBDZy.js.map