@axiom-lattice/local-stores 3.1.6 → 3.1.9

package/dist/index.js

@@ -44,9 +44,11 @@ __export(index_exports, {
   LocalEvalStore: () => LocalEvalStore,
   LocalMcpServerConfigStore: () => LocalMcpServerConfigStore,
   LocalMetricsServerConfigStore: () => LocalMetricsServerConfigStore,
+  LocalOpenAuditStore: () => LocalOpenAuditStore,
   LocalProjectBotMembershipStore: () => LocalProjectBotMembershipStore,
   LocalProjectMembershipStore: () => LocalProjectMembershipStore,
   LocalProjectRoomMessageStore: () => LocalProjectRoomMessageStore,
+  LocalProjectRoomReadStateStore: () => LocalProjectRoomReadStateStore,
   LocalProjectRoomStore: () => LocalProjectRoomStore,
   LocalProjectStore: () => LocalProjectStore,
   LocalScheduleStorage: () => LocalScheduleStorage,
@@ -886,12 +888,20 @@ CREATE UNIQUE INDEX IF NOT EXISTS uq_lt_project_room_messages_idempotency
   ON lt_project_room_messages (tenant_id, room_id, idempotency_key) WHERE idempotency_key IS NOT NULL;
 CREATE INDEX IF NOT EXISTS idx_lt_project_room_messages_room_created
   ON lt_project_room_messages (tenant_id, room_id, created_at DESC, id DESC);
+CREATE TABLE IF NOT EXISTS lt_project_room_read_states (
+  tenant_id TEXT NOT NULL, room_id TEXT NOT NULL, user_id TEXT NOT NULL,
+  last_read_at TEXT NOT NULL, updated_at TEXT NOT NULL,
+  PRIMARY KEY (tenant_id, room_id, user_id)
+);
+CREATE INDEX IF NOT EXISTS idx_lt_project_room_read_states_user
+  ON lt_project_room_read_states (tenant_id, user_id);
 `;
 var tableColumns = {
   lt_project_rooms: ["id", "tenant_id", "workspace_id", "project_id", "type", "name", "created_at", "updated_at"],
   lt_project_memberships: ["id", "tenant_id", "project_id", "user_id", "role", "status", "joined_at", "updated_at"],
   lt_project_bot_memberships: ["id", "tenant_id", "workspace_id", "project_id", "room_id", "assistant_id", "role", "title", "responsibility", "mention_name", "status", "room_thread_id", "joined_at", "updated_at"],
-  lt_project_room_messages: ["id", "tenant_id", "workspace_id", "project_id", "room_id", "author", "content", "mentions", "reply_to_message_id", "source", "source_id", "idempotency_key", "created_at"]
+  lt_project_room_messages: ["id", "tenant_id", "workspace_id", "project_id", "room_id", "author", "content", "mentions", "reply_to_message_id", "source", "source_id", "idempotency_key", "created_at"],
+  lt_project_room_read_states: ["tenant_id", "room_id", "user_id", "last_read_at", "updated_at"]
 };
 var indexes = {
   idx_lt_project_memberships_project: { table: "lt_project_memberships", columns: ["tenant_id", "project_id"], unique: false, partial: false },
@@ -900,13 +910,15 @@ var indexes = {
   idx_lt_project_bot_memberships_project: { table: "lt_project_bot_memberships", columns: ["tenant_id", "project_id"], unique: false, partial: false },
   idx_lt_project_bot_memberships_room: { table: "lt_project_bot_memberships", columns: ["tenant_id", "room_id"], unique: false, partial: false },
   uq_lt_project_room_messages_idempotency: { table: "lt_project_room_messages", columns: ["tenant_id", "room_id", "idempotency_key"], unique: true, partial: true, sql: ["idempotency_key is not null"] },
-  idx_lt_project_room_messages_room_created: { table: "lt_project_room_messages", columns: ["tenant_id", "room_id", "created_at", "id"], unique: false, partial: false, sql: ["created_at desc", "id desc"] }
+  idx_lt_project_room_messages_room_created: { table: "lt_project_room_messages", columns: ["tenant_id", "room_id", "created_at", "id"], unique: false, partial: false, sql: ["created_at desc", "id desc"] },
+  idx_lt_project_room_read_states_user: { table: "lt_project_room_read_states", columns: ["tenant_id", "user_id"], unique: false, partial: false }
 };
 var uniqueConstraints = {
   lt_project_rooms: [["tenant_id", "id"], ["tenant_id", "project_id", "type"]],
   lt_project_memberships: [["tenant_id", "id"], ["tenant_id", "project_id", "user_id"]],
   lt_project_bot_memberships: [["tenant_id", "id"], ["tenant_id", "project_id", "assistant_id"]],
-  lt_project_room_messages: [["tenant_id", "id"]]
+  lt_project_room_messages: [["tenant_id", "id"]],
+  lt_project_room_read_states: [["tenant_id", "room_id", "user_id"]]
 };
 var checkConstraints = {
   lt_project_rooms: [{ name: "type", fragment: "type='main'" }],
@@ -918,7 +930,8 @@ var checkConstraints = {
     { name: "role", fragment: "role in ('coordinator','specialist')" },
     { name: "status", fragment: "status in ('active','paused','removed')" }
   ],
-  lt_project_room_messages: [{ name: "source", fragment: "source in ('user','agent','task','routine','system')" }]
+  lt_project_room_messages: [{ name: "source", fragment: "source in ('user','agent','task','routine','system')" }],
+  lt_project_room_read_states: []
 };
 function rows(db, sql) {
   const result = db.getRawDb().exec(sql);
@@ -990,10 +1003,10 @@ function validateProjectRoomSchema(db) {
   }
   for (const [name, expected] of Object.entries(indexes)) {
     const listed = rows(db, `PRAGMA index_list(${expected.table})`).find((index) => index.name === name);
-    const columns5 = rows(db, `PRAGMA index_info(${name})`).map((column) => column.name);
+    const columns6 = rows(db, `PRAGMA index_info(${name})`).map((column) => column.name);
     const definition = rows(db, `SELECT sql FROM sqlite_master WHERE type = 'index' AND name = '${name}'`)[0]?.sql;
     const normalized = typeof definition === "string" ? definition.toLowerCase().replace(/\s+/g, " ") : "";
-    if (!listed || listed.unique !== Number(expected.unique) || listed.partial !== Number(expected.partial) || columns5.join(",") !== expected.columns.join(",") || expected.sql?.some((fragment) => !normalized.includes(fragment))) {
+    if (!listed || listed.unique !== Number(expected.unique) || listed.partial !== Number(expected.partial) || columns6.join(",") !== expected.columns.join(",") || expected.sql?.some((fragment) => !normalized.includes(fragment))) {
       throw new Error(`Invalid project room schema: index '${name}' is incompatible`);
     }
   }
@@ -1006,6 +1019,30 @@ function ensureProjectRoomSchema(db) {
   const applied = hasMigrationTable ? rows(db, `SELECT name, version FROM lattice_schema_migrations WHERE store_name = 'project_room' AND name = '${migrationName}'`)[0] : void 0;
   if (applied) {
     if (applied.version !== 1) throw new Error(`Invalid project room schema migration version: ${String(applied.version)}`);
+    const hasReadStates = rows(db, "SELECT name FROM sqlite_master WHERE type = 'table' AND name = 'lt_project_room_read_states'").length > 0;
+    if (!hasReadStates) {
+      raw.exec("BEGIN IMMEDIATE");
+      try {
+        raw.exec(`CREATE TABLE IF NOT EXISTS lt_project_room_read_states (
+          tenant_id TEXT NOT NULL, room_id TEXT NOT NULL, user_id TEXT NOT NULL,
+          last_read_at TEXT NOT NULL, updated_at TEXT NOT NULL,
+          PRIMARY KEY (tenant_id, room_id, user_id)
+        ); CREATE INDEX IF NOT EXISTS idx_lt_project_room_read_states_user
+          ON lt_project_room_read_states (tenant_id, user_id);`);
+        raw.run(
+          "INSERT INTO lattice_schema_migrations (store_name, name, version, applied_at) VALUES (?, ?, ?, ?)",
+          ["project_room", "create_project_room_read_states", 2, (/* @__PURE__ */ new Date()).toISOString()]
+        );
+        raw.exec("COMMIT");
+        db.save();
+      } catch (error) {
+        try {
+          raw.exec("ROLLBACK");
+        } catch {
+        }
+        throw error;
+      }
+    }
     validateProjectRoomSchema(db);
     marked[schemaMarker] = true;
     return;
@@ -1424,6 +1461,22 @@ function mapRow4(row) {
     createdAt
   };
 }
+function mapRowsTolerant(rows2, scope) {
+  const messages = [];
+  for (const row of rows2) {
+    try {
+      messages.push(mapRow4(row));
+    } catch (error) {
+      console.warn("[ProjectRoomMessageStore] Skipping invalid message row", {
+        tenantId: scope.tenantId,
+        roomId: scope.roomId,
+        rowId: typeof row.id === "string" ? row.id : void 0,
+        reason: error instanceof Error ? error.message : String(error)
+      });
+    }
+  }
+  return messages;
+}
 var LocalProjectRoomMessageStore = class {
   constructor(db) {
     this.db = db;
@@ -1439,12 +1492,24 @@ var LocalProjectRoomMessageStore = class {
     if (input.before && !validDate(input.before.createdAt)) throw new RangeError("Project room message cursor date is invalid");
     const limit = Math.min(100, Math.max(1, Math.trunc(Number.isFinite(input.limit) ? input.limit : 1)));
     const rows2 = input.before ? this.db.prepare(`SELECT ${columns4} FROM lt_project_room_messages WHERE tenant_id = ? AND room_id = ? AND (created_at < ? OR (created_at = ? AND id < ?)) ORDER BY created_at DESC, id DESC LIMIT ?`).all(input.tenantId, input.roomId, input.before.createdAt.toISOString(), input.before.createdAt.toISOString(), input.before.id, limit) : this.db.prepare(`SELECT ${columns4} FROM lt_project_room_messages WHERE tenant_id = ? AND room_id = ? ORDER BY created_at DESC, id DESC LIMIT ?`).all(input.tenantId, input.roomId, limit);
-    return rows2.map(mapRow4);
+    return mapRowsTolerant(rows2, { tenantId: input.tenantId, roomId: input.roomId });
   }
   async findById(tenantId, id) {
     const row = this.byId(tenantId, id);
     return row ? mapRow4(row) : null;
   }
+  async countAfter(input) {
+    if (!validDate(input.after)) throw new RangeError("Project room message count horizon date is invalid");
+    const rows2 = this.db.prepare(
+      `SELECT author FROM lt_project_room_messages
+       WHERE tenant_id = ? AND room_id = ? AND created_at > ?`
+    ).all(input.tenantId, input.roomId, input.after.toISOString());
+    return rows2.filter((row) => {
+      if (input.excludeAuthorUserId === void 0) return true;
+      const parsed = parseJson(row.author);
+      return !(record(parsed) && parsed.type === "human" && parsed.userId === input.excludeAuthorUserId);
+    }).length;
+  }
   insert(input, idempotent) {
     return transaction(this.db, () => {
       if (idempotent && input.idempotencyKey) {
@@ -1475,6 +1540,50 @@ var LocalProjectRoomMessageStore = class {
   }
 };
 
+// src/stores/LocalProjectRoomReadStateStore.ts
+var columns5 = "tenant_id, room_id, user_id, last_read_at, updated_at";
+function mapRow5(row) {
+  const lastReadAt = new Date(row.last_read_at);
+  const updatedAt = new Date(row.updated_at);
+  if (Number.isNaN(lastReadAt.getTime()) || Number.isNaN(updatedAt.getTime())) throw new Error("Invalid project room read state row");
+  return { tenantId: row.tenant_id, roomId: row.room_id, userId: row.user_id, lastReadAt, updatedAt };
+}
+var LocalProjectRoomReadStateStore = class {
+  /** Creates a store over a managed local database wrapper. */
+  constructor(db) {
+    this.db = db;
+    ensureProjectRoomSchema(db);
+  }
+  /** Returns the user's read marker for a room, or null when never reported. */
+  async get(tenantId, roomId, userId) {
+    const row = this.byKey(tenantId, roomId, userId);
+    return row ? mapRow5(row) : null;
+  }
+  /** Upserts the marker monotonically (an older report never regresses the horizon). */
+  async markRead(input) {
+    if (!validDate(input.lastReadAt)) throw new RangeError("Project room read state lastReadAt is invalid");
+    return transaction(this.db, () => {
+      const existing = this.byKey(input.tenantId, input.roomId, input.userId);
+      const lastReadAt = existing !== void 0 && new Date(existing.last_read_at).getTime() > input.lastReadAt.getTime() ? new Date(existing.last_read_at) : input.lastReadAt;
+      write(
+        this.db,
+        `INSERT INTO lt_project_room_read_states (${columns5})
+         VALUES (?, ?, ?, ?, ?)
+         ON CONFLICT (tenant_id, room_id, user_id) DO UPDATE
+           SET last_read_at = excluded.last_read_at, updated_at = excluded.updated_at`,
+        [input.tenantId, input.roomId, input.userId, lastReadAt.toISOString(), timestamp()]
+      );
+      const row = this.byKey(input.tenantId, input.roomId, input.userId);
+      return mapRow5(row);
+    });
+  }
+  byKey(tenantId, roomId, userId) {
+    return this.db.prepare(
+      `SELECT ${columns5} FROM lt_project_room_read_states WHERE tenant_id = ? AND room_id = ? AND user_id = ?`
+    ).get(tenantId, roomId, userId);
+  }
+};
+
 // src/stores/LocalUserStore.ts
 var DDL5 = `
 CREATE TABLE IF NOT EXISTS lt_users (
@@ -2302,6 +2411,18 @@ function mapRowToEntry3(row) {
       throw new Error("Failed to decrypt MCP server configuration");
     }
   }
+  if (config.headers && row.is_env_encrypted) {
+    try {
+      const decryptedHeaders = {};
+      for (const [key, value] of Object.entries(config.headers)) {
+        decryptedHeaders[key] = (0, import_core2.decrypt)(value);
+      }
+      config.headers = decryptedHeaders;
+    } catch (error) {
+      console.error("Failed to decrypt MCP server headers:", error);
+      throw new Error("Failed to decrypt MCP server configuration");
+    }
+  }
   return {
     id: row.id,
     tenantId: row.tenant_id,
@@ -2327,6 +2448,14 @@ function encryptEnvInConfig(config) {
     configCopy.env = encryptedEnv;
     isEnvEncrypted = true;
   }
+  if (configCopy.headers && Object.keys(configCopy.headers).length > 0) {
+    const encryptedHeaders = {};
+    for (const [key, value] of Object.entries(configCopy.headers)) {
+      encryptedHeaders[key] = (0, import_core2.encrypt)(value);
+    }
+    configCopy.headers = encryptedHeaders;
+    isEnvEncrypted = true;
+  }
   return { config: configCopy, isEnvEncrypted };
 }
 
@@ -3636,7 +3765,7 @@ var LocalChannelInstallationStore = class {
     const row = this.db.prepare(
       `SELECT * FROM lt_channel_installations WHERE id = ?`
     ).get(installationId);
-    return row ? mapRow5(row) : null;
+    return row ? mapRow6(row) : null;
   }
   async getInstallationsByTenant(tenantId, channel) {
     let rows2;
@@ -3649,7 +3778,7 @@ var LocalChannelInstallationStore = class {
         `SELECT * FROM lt_channel_installations WHERE tenant_id = ? ORDER BY created_at DESC`
       ).all(tenantId);
     }
-    return rows2.map(mapRow5);
+    return rows2.map(mapRow6);
   }
   async getAllInstallations(channel) {
     let rows2;
@@ -3662,7 +3791,7 @@ var LocalChannelInstallationStore = class {
         `SELECT * FROM lt_channel_installations ORDER BY created_at DESC`
       ).all();
     }
-    return rows2.map(mapRow5);
+    return rows2.map(mapRow6);
   }
   async createInstallation(tenantId, installationId, data) {
     const now = nowISO();
@@ -3738,7 +3867,7 @@ var LocalChannelInstallationStore = class {
     return result.changes > 0;
   }
 };
-function mapRow5(row) {
+function mapRow6(row) {
   return {
     id: row.id,
     tenantId: row.tenant_id,
@@ -3763,6 +3892,7 @@ CREATE TABLE IF NOT EXISTS lt_a2a_api_keys (
   tenant_id TEXT NOT NULL,
   project_id TEXT,
   assistant_ids TEXT,
+  grants TEXT,
   label TEXT,
   enabled INTEGER NOT NULL DEFAULT 1,
   created_at TEXT NOT NULL,
@@ -3772,6 +3902,15 @@ CREATE TABLE IF NOT EXISTS lt_a2a_api_keys (
 function generateApiKey() {
   return `a2a_${(0, import_crypto3.randomUUID)().replace(/-/g, "")}`;
 }
+function parseGrants(raw) {
+  if (!raw) return void 0;
+  try {
+    const parsed = JSON.parse(raw);
+    return Array.isArray(parsed) ? parsed : void 0;
+  } catch {
+    return void 0;
+  }
+}
 function parseAssistantIds(raw) {
   if (!raw) return void 0;
   try {
@@ -3786,6 +3925,7 @@ var LocalA2AApiKeyStore = class {
     this.db = db;
     ensureTable(db, DDL16);
     this.ensureColumn("lt_a2a_api_keys", "assistant_ids", "assistant_ids TEXT");
+    this.ensureColumn("lt_a2a_api_keys", "grants", "grants TEXT");
     this.repairManagementIds();
   }
   /** Add a column if it does not exist (SQLite version compatible). */
@@ -3846,9 +3986,9 @@ var LocalA2AApiKeyStore = class {
     const key = generateApiKey();
     const now = nowISO();
     this.db.prepare(
-      `INSERT INTO lt_a2a_api_keys (id, key_value, tenant_id, project_id, assistant_ids, label, created_at, updated_at)
-       VALUES (?, ?, ?, ?, ?, ?, ?, ?)`
-    ).run(id, (0, import_core3.encrypt)(key), input.tenantId, input.projectId, input.assistantIds ? JSON.stringify(input.assistantIds) : null, input.label || null, now, now);
+      `INSERT INTO lt_a2a_api_keys (id, key_value, tenant_id, project_id, assistant_ids, grants, label, created_at, updated_at)
+       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`
+    ).run(id, (0, import_core3.encrypt)(key), input.tenantId, input.projectId, input.assistantIds ? JSON.stringify(input.assistantIds) : null, input.grants ? JSON.stringify(input.grants) : null, input.label || null, now, now);
     const record2 = {
       id,
       key,
@@ -3880,6 +4020,38 @@ var LocalA2AApiKeyStore = class {
     if (!row) throw new Error(`A2A API key not found: ${id}`);
     return mapRowToRecord(row);
   }
+  async update(id, input) {
+    const sets = [];
+    const values = [];
+    if (input.label !== void 0) {
+      sets.push("label = ?");
+      values.push(input.label || null);
+    }
+    if (input.projectId !== void 0) {
+      sets.push("project_id = ?");
+      values.push(input.projectId);
+    }
+    if (input.assistantIds !== void 0) {
+      sets.push("assistant_ids = ?");
+      values.push(input.assistantIds ? JSON.stringify(input.assistantIds) : null);
+    }
+    if (input.grants !== void 0) {
+      sets.push("grants = ?");
+      values.push(input.grants ? JSON.stringify(input.grants) : null);
+    }
+    if (sets.length === 0) {
+      const row2 = this.db.prepare("SELECT * FROM lt_a2a_api_keys WHERE id = ?").get(id);
+      if (!row2) throw new Error(`A2A API key not found: ${id}`);
+      return mapRowToRecord(row2);
+    }
+    sets.push("updated_at = ?");
+    values.push(nowISO());
+    values.push(id);
+    this.db.prepare(`UPDATE lt_a2a_api_keys SET ${sets.join(", ")} WHERE id = ?`).run(...values);
+    const row = this.db.prepare("SELECT * FROM lt_a2a_api_keys WHERE id = ?").get(id);
+    if (!row) throw new Error(`A2A API key not found: ${id}`);
+    return mapRowToRecord(row);
+  }
   async rotate(id) {
     const key = generateApiKey();
     const now = nowISO();
@@ -3928,6 +4100,7 @@ function mapRowToRecord(row) {
     tenantId: row.tenant_id,
     projectId: row.project_id,
     assistantIds: parseAssistantIds(row.assistant_ids),
+    grants: parseGrants(row.grants),
     label: row.label || void 0,
     enabled: row.enabled === 1,
     createdAt: parseISO(row.created_at),
@@ -3935,10 +4108,100 @@ function mapRowToRecord(row) {
   };
 }
 
-// src/stores/LocalThreadMessageQueueStore.ts
-var import_protocols4 = require("@axiom-lattice/protocols");
+// src/stores/LocalOpenAuditStore.ts
 var import_crypto4 = require("crypto");
 var DDL17 = `
+CREATE TABLE IF NOT EXISTS lt_open_audit (
+  id TEXT PRIMARY KEY,
+  tenant_id TEXT NOT NULL,
+  credential_id TEXT NOT NULL,
+  credential_kind TEXT NOT NULL,
+  project_id TEXT NOT NULL,
+  domain TEXT NOT NULL,
+  action TEXT NOT NULL,
+  args TEXT,
+  status TEXT NOT NULL,
+  error_code TEXT,
+  duration_ms INTEGER NOT NULL,
+  created_at TEXT NOT NULL
+);
+`;
+var LocalOpenAuditStore = class {
+  constructor(db) {
+    this.db = db;
+    ensureTable(db, DDL17);
+  }
+  async query(params) {
+    const clauses = ["tenant_id = ?"];
+    const values = [params.tenantId];
+    if (params.credentialId) {
+      clauses.push("credential_id = ?");
+      values.push(params.credentialId);
+    }
+    if (params.domain) {
+      clauses.push("domain = ?");
+      values.push(params.domain);
+    }
+    if (params.status) {
+      clauses.push("status = ?");
+      values.push(params.status);
+    }
+    if (params.from) {
+      clauses.push("created_at >= ?");
+      values.push(params.from);
+    }
+    if (params.to) {
+      clauses.push("created_at < ?");
+      values.push(params.to);
+    }
+    const limit = params.limit ?? 100;
+    const offset = params.offset ?? 0;
+    values.push(limit, offset);
+    const rows2 = this.db.prepare(
+      `SELECT * FROM lt_open_audit WHERE ${clauses.join(" AND ")}
+         ORDER BY created_at DESC LIMIT ? OFFSET ?`
+    ).all(...values);
+    return rows2.map((row) => ({
+      id: row.id,
+      tenantId: row.tenant_id,
+      credentialId: row.credential_id,
+      credentialKind: row.credential_kind,
+      projectId: row.project_id,
+      domain: row.domain,
+      action: row.action,
+      args: row.args ? JSON.parse(row.args) : void 0,
+      status: row.status,
+      errorCode: row.error_code ?? void 0,
+      durationMs: row.duration_ms,
+      createdAt: parseISO(row.created_at)
+    }));
+  }
+  async append(record2) {
+    this.db.prepare(
+      `INSERT INTO lt_open_audit
+          (id, tenant_id, credential_id, credential_kind, project_id, domain, action, args, status, error_code, duration_ms, created_at)
+         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`
+    ).run(
+      (0, import_crypto4.randomUUID)(),
+      record2.tenantId,
+      record2.credentialId,
+      record2.credentialKind,
+      record2.projectId,
+      record2.domain,
+      record2.action,
+      record2.args === void 0 ? null : JSON.stringify(record2.args),
+      record2.status,
+      record2.errorCode ?? null,
+      Math.max(0, Math.round(record2.durationMs)),
+      nowISO()
+    );
+  }
+};
+
+// src/stores/LocalThreadMessageQueueStore.ts
+var import_protocols4 = require("@axiom-lattice/protocols");
+var import_crypto5 = require("crypto");
+var DDL18 = `
 CREATE TABLE IF NOT EXISTS lt_thread_message_queue (
   id TEXT PRIMARY KEY,
   thread_id TEXT NOT NULL,
@@ -3964,9 +4227,9 @@ var LocalThreadMessageQueueStore = class {
   constructor(db) {
     this.capacityTail = Promise.resolve();
     this.db = db;
-    ensureTable(db, DDL17);
-    const columns5 = db.prepare("PRAGMA table_info(lt_thread_message_queue)").all();
-    const names = new Set(columns5.map(({ name }) => name));
+    ensureTable(db, DDL18);
+    const columns6 = db.prepare("PRAGMA table_info(lt_thread_message_queue)").all();
+    const names = new Set(columns6.map(({ name }) => name));
     if (!names.has("trusted_run_context")) {
       db.run("ALTER TABLE lt_thread_message_queue ADD COLUMN trusted_run_context TEXT");
     }
@@ -3977,7 +4240,7 @@ var LocalThreadMessageQueueStore = class {
   async addMessage(params) {
     const trusted = validateQueueTrust(params);
     const now = nowISO();
-    const id = params.id || (0, import_crypto4.randomUUID)();
+    const id = params.id || (0, import_crypto5.randomUUID)();
     const seqRow = this.db.prepare(
       `SELECT COALESCE(MAX(sequence_order), 0) + 1 as next_seq FROM lt_thread_message_queue WHERE thread_id = ?`
     ).get(params.threadId);
@@ -4020,7 +4283,7 @@ var LocalThreadMessageQueueStore = class {
         projectId: params.projectId
       };
       const filter = scopeClause(scope);
-      const id = params.id || (0, import_crypto4.randomUUID)();
+      const id = params.id || (0, import_crypto5.randomUUID)();
       const limit = maxSize === Infinity ? -1 : maxSize;
       const result = this.db.prepare(
         `INSERT INTO lt_thread_message_queue (id, thread_id, tenant_id, assistant_id, workspace_id, project_id, message_content, message_type, sequence_order, priority, command, custom_run_config, trusted_run_context, execution_mode, created_at)
@@ -4058,7 +4321,7 @@ var LocalThreadMessageQueueStore = class {
   async addMessageAtHead(params) {
     const trusted = validateQueueTrust(params);
     const now = nowISO();
-    const id = params.id || (0, import_crypto4.randomUUID)();
+    const id = params.id || (0, import_crypto5.randomUUID)();
     const seqRow = this.db.prepare(
       `SELECT COALESCE(MAX(sequence_order), 0) + 1 as next_seq FROM lt_thread_message_queue WHERE thread_id = ?`
     ).get(params.threadId);
@@ -4177,7 +4440,7 @@ function rowToMessage(row) {
 }
 
 // src/stores/LocalSkillStore.ts
-var DDL18 = `
+var DDL19 = `
 CREATE TABLE IF NOT EXISTS lt_skills (
   id TEXT NOT NULL,
   tenant_id TEXT NOT NULL,
@@ -4196,7 +4459,7 @@ CREATE TABLE IF NOT EXISTS lt_skills (
 var LocalSkillStore = class {
   constructor(db) {
     this.db = db;
-    ensureTable(db, DDL18);
+    ensureTable(db, DDL19);
   }
   async getAllSkills(tenantId, _context) {
     const rows2 = this.db.prepare(
@@ -4346,7 +4609,7 @@ function mapRowToSkill(row) {
 }
 
 // src/stores/LocalScheduleStorage.ts
-var DDL19 = `
+var DDL20 = `
 CREATE TABLE IF NOT EXISTS lt_scheduled_tasks (
   task_id TEXT PRIMARY KEY,
   task_type TEXT NOT NULL,
@@ -4379,7 +4642,7 @@ CREATE INDEX IF NOT EXISTS idx_lt_st_tenant ON lt_scheduled_tasks(tenant_id);
 var LocalScheduleStorage = class {
   constructor(db) {
     this.db = db;
-    ensureTable(db, DDL19);
+    ensureTable(db, DDL20);
   }
   async save(task) {
     this.db.prepare(
@@ -4673,7 +4936,7 @@ function mapRowToTask(row) {
 }
 
 // src/stores/LocalTaskStore.ts
-var import_crypto5 = require("crypto");
+var import_crypto6 = require("crypto");
 var MAX_CANONICAL_TASK_TIME = "9999-12-31T23:59:59.999Z";
 var TASK_STATUSES = /* @__PURE__ */ new Set([
   "pending",
@@ -4689,7 +4952,7 @@ var NEXT_UPDATED_AT_SQL = `updated_at = CASE
     THEN strftime('%Y-%m-%dT%H:%M:%fZ', updated_at, '+0.001 seconds')
   ELSE ?
 END`;
-var DDL20 = `
+var DDL21 = `
 CREATE TABLE IF NOT EXISTS lt_tasks (
   id TEXT NOT NULL,
   tenant_id TEXT NOT NULL,
@@ -4762,7 +5025,7 @@ function assertPage(limit, offset = 0) {
 var LocalTaskStore = class {
   constructor(db) {
     this.db = db;
-    ensureTable(db, DDL20);
+    ensureTable(db, DDL21);
     this.ensureColumn("lt_tasks", "require_review", "require_review INTEGER DEFAULT 0");
     this.ensureColumn("lt_tasks", "dependencies", "dependencies TEXT");
     this.ensureColumn("lt_tasks", "result", "result TEXT");
@@ -4779,7 +5042,7 @@ var LocalTaskStore = class {
     }
   }
   async create(params) {
-    const id = params.id ?? (0, import_crypto5.randomUUID)();
+    const id = params.id ?? (0, import_crypto6.randomUUID)();
     const now = nowISO();
     this.db.prepare(
       `INSERT INTO lt_tasks (id, tenant_id, owner_type, owner_id, title, description, status, priority, due_date, metadata, parent_id, source_id, context, require_review, dependencies, result, failure_reason, workspace_id, project_id, files, created_at, updated_at)
@@ -5439,7 +5702,7 @@ var PROJECT_LIFECYCLE_ACTIONS = /* @__PURE__ */ new Set([
   "cancelled",
   "reassigned"
 ]);
-var DDL21 = `
+var DDL22 = `
 CREATE TABLE IF NOT EXISTS lt_task_work_items (
   id TEXT NOT NULL,
   tenant_id TEXT NOT NULL,
@@ -5513,7 +5776,7 @@ function assertLifecyclePage(query) {
 var LocalTaskWorkItemStore = class {
   constructor(db) {
     this.db = db;
-    ensureTable(db, DDL21);
+    ensureTable(db, DDL22);
     this.ensureColumn("lt_task_work_items", "workspace_id", "workspace_id TEXT");
     this.ensureColumn("lt_task_work_items", "project_id", "project_id TEXT");
     this.ensureColumn("lt_task_work_items", "event_key", "event_key TEXT");
@@ -5709,8 +5972,8 @@ var LocalTaskWorkItemStore = class {
 };
 
 // src/stores/LocalCapabilityBundleStore.ts
-var import_crypto6 = require("crypto");
-var DDL22 = `CREATE TABLE IF NOT EXISTS lt_capability_bundles (id TEXT NOT NULL, tenant_id TEXT NOT NULL, bundle_key TEXT NOT NULL, name TEXT NOT NULL, description TEXT, capabilities TEXT NOT NULL DEFAULT '[]', created_at TEXT NOT NULL, updated_at TEXT NOT NULL, PRIMARY KEY (tenant_id, id), UNIQUE (tenant_id, bundle_key)); CREATE INDEX IF NOT EXISTS idx_lt_capability_bundles_tenant ON lt_capability_bundles(tenant_id);`;
+var import_crypto7 = require("crypto");
+var DDL23 = `CREATE TABLE IF NOT EXISTS lt_capability_bundles (id TEXT NOT NULL, tenant_id TEXT NOT NULL, bundle_key TEXT NOT NULL, name TEXT NOT NULL, description TEXT, capabilities TEXT NOT NULL DEFAULT '[]', created_at TEXT NOT NULL, updated_at TEXT NOT NULL, PRIMARY KEY (tenant_id, id), UNIQUE (tenant_id, bundle_key)); CREATE INDEX IF NOT EXISTS idx_lt_capability_bundles_tenant ON lt_capability_bundles(tenant_id);`;
 var duplicateMessage = "Capability bundle key already exists for tenant";
 function map(row) {
   return { id: row.id, tenantId: row.tenant_id, key: row.bundle_key, name: row.name, description: row.description ?? void 0, capabilities: JSON.parse(row.capabilities), createdAt: parseISO(row.created_at).toISOString(), updatedAt: parseISO(row.updated_at).toISOString() };
@@ -5731,7 +5994,7 @@ var LocalCapabilityBundleStore = class {
    */
   constructor(db) {
     this.db = db;
-    ensureTable(db, DDL22);
+    ensureTable(db, DDL23);
   }
   async listByTenant(tenantId) {
     return this.db.prepare("SELECT * FROM lt_capability_bundles WHERE tenant_id = ? ORDER BY created_at").all(tenantId).map(map);
@@ -5748,7 +6011,7 @@ var LocalCapabilityBundleStore = class {
   }
   async create(tenantId, input) {
     const now = nextTimestamp();
-    const id = (0, import_crypto6.randomUUID)();
+    const id = (0, import_crypto7.randomUUID)();
     try {
       this.db.prepare("INSERT INTO lt_capability_bundles (id, tenant_id, bundle_key, name, description, capabilities, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?)").run(id, tenantId, input.key, input.name, input.description ?? null, JSON.stringify(input.capabilities), now, now);
     } catch (error) {
@@ -5817,6 +6080,7 @@ async function createLocalStoreConfig(options = {}) {
     projectMembership: new LocalProjectMembershipStore(db),
     projectBotMembership: new LocalProjectBotMembershipStore(db),
     projectRoomMessage: new LocalProjectRoomMessageStore(db),
+    projectRoomReadState: new LocalProjectRoomReadStateStore(db),
     user: new LocalUserStore(db),
     tenant: new LocalTenantStore(db),
     userTenantLink: new LocalUserTenantLinkStore(db),
@@ -5829,6 +6093,7 @@ async function createLocalStoreConfig(options = {}) {
     channelBinding: new LocalChannelBindingStore(db),
     channelInstallation: new LocalChannelInstallationStore(db),
     a2aApiKey: new LocalA2AApiKeyStore(db),
+    openAudit: new LocalOpenAuditStore(db),
     threadMessageQueue: new LocalThreadMessageQueueStore(db),
     skill: new LocalSkillStore(db),
     schedule: new LocalScheduleStorage(db),
@@ -5891,9 +6156,11 @@ var InMemoryConversationStore = class {
   LocalEvalStore,
   LocalMcpServerConfigStore,
   LocalMetricsServerConfigStore,
+  LocalOpenAuditStore,
   LocalProjectBotMembershipStore,
   LocalProjectMembershipStore,
   LocalProjectRoomMessageStore,
+  LocalProjectRoomReadStateStore,
   LocalProjectRoomStore,
   LocalProjectStore,
   LocalScheduleStorage,