@axiom-lattice/pg-stores 3.0.2 → 3.1.1

package/dist/index.js

@@ -35,10 +35,11 @@ __export(index_exports, {
   MenuStore: () => MenuStore,
   MigrationManager: () => MigrationManager,
   PGVectorStoreProvider: () => PGVectorStoreProvider,
-  Pool: () => import_pg27.Pool,
+  Pool: () => import_pg28.Pool,
   PostgreSQLA2AApiKeyStore: () => PostgreSQLA2AApiKeyStore,
   PostgreSQLAgentWebAppStore: () => PostgreSQLAgentWebAppStore,
   PostgreSQLAssistantStore: () => PostgreSQLAssistantStore,
+  PostgreSQLCapabilityBundleStore: () => PostgreSQLCapabilityBundleStore,
   PostgreSQLChannelInstallationStore: () => PostgreSQLChannelInstallationStore,
   PostgreSQLCollectionStore: () => PostgreSQLCollectionStore,
   PostgreSQLConnectionStore: () => PostgreSQLConnectionStore,
@@ -77,6 +78,7 @@ __export(index_exports, {
   createA2AApiKeysTable: () => createA2AApiKeysTable,
   createAgentWebAppsTable: () => createAgentWebAppsTable,
   createAssistantsTable: () => createAssistantsTable,
+  createCapabilityBundlesTable: () => createCapabilityBundlesTable,
   createChannelBindingsTable: () => createChannelBindingsTable,
   createChannelIdentityMappingTables: () => createChannelIdentityMappingTables,
   createChannelInstallationsTable: () => createChannelInstallationsTable,
@@ -109,10 +111,10 @@ __export(index_exports, {
   safeParse: () => safeParse
 });
 module.exports = __toCommonJS(index_exports);
-var import_pg27 = require("pg");
+var import_pg28 = require("pg");
 
 // src/createPgStoreConfig.ts
-var import_pg24 = require("pg");
+var import_pg25 = require("pg");
 
 // src/migrations/migration.ts
 var MigrationManager = class {
@@ -2382,6 +2384,7 @@ var PostgreSQLWorkspaceStore = class {
 
 // src/stores/PostgreSQLProjectStore.ts
 var import_pg7 = require("pg");
+var import_protocols = require("@axiom-lattice/protocols");
 
 // src/migrations/project_migrations.ts
 var createProjectsTable = {
@@ -2597,34 +2600,62 @@ var PostgreSQLProjectStore = class {
    * Create a new project
    */
   async createProject(tenantId, workspaceId, id, data) {
+    (0, import_protocols.assertGenericProjectConfig)(data.config);
     await this.ensureInitialized();
     const now = /* @__PURE__ */ new Date();
     const kind = data.kind || "business";
-    await this.pool.query(
-      `
-      INSERT INTO lattice_projects (id, tenant_id, workspace_id, name, description, config, kind, created_at, updated_at)
+    const client = await this.pool.connect();
+    try {
+      await client.query("BEGIN");
+      await client.query(
+        "SELECT pg_advisory_xact_lock(hashtextextended($1 || ':project-mutations', 0))",
+        [tenantId]
+      );
+      await client.query(
+        "SELECT pg_advisory_xact_lock(hashtextextended($2 || ':project:' || $1, 0))",
+        [id, tenantId]
+      );
+      const existing = await client.query(
+        "SELECT config FROM lattice_projects WHERE id = $1 AND tenant_id = $2 FOR UPDATE",
+        [id, tenantId]
+      );
+      const ids = existing.rows[0]?.config?.capabilityBundleIds;
+      const bundleIds = Array.isArray(ids) && ids.every((bundleId) => typeof bundleId === "string") ? [...ids].sort() : [];
+      if (bundleIds.length > 0) {
+        await client.query(
+          `SELECT pg_advisory_xact_lock(hashtextextended($1 || ':' || bundle_id, 0))
+           FROM unnest($2::text[]) AS bundle_id
+           ORDER BY bundle_id`,
+          [tenantId, bundleIds]
+        );
+      }
+      const result = await client.query(
+        `INSERT INTO lattice_projects (id, tenant_id, workspace_id, name, description, config, kind, created_at, updated_at)
       VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9)
       ON CONFLICT (id, tenant_id) DO UPDATE SET
         workspace_id = EXCLUDED.workspace_id,
         name = EXCLUDED.name,
         description = EXCLUDED.description,
-        config = EXCLUDED.config,
+        config = CASE
+          WHEN lattice_projects.config ? 'capabilityBundleIds'
+          THEN COALESCE(EXCLUDED.config, '{}'::jsonb)
+            || jsonb_build_object('capabilityBundleIds', lattice_projects.config->'capabilityBundleIds')
+          ELSE EXCLUDED.config
+        END,
         kind = EXCLUDED.kind,
         updated_at = EXCLUDED.updated_at
+      RETURNING id, tenant_id, workspace_id, name, description, config, kind, created_at, updated_at
     `,
-      [id, tenantId, workspaceId, data.name, data.description || null, data.config || null, kind, now, now]
-    );
-    return {
-      id,
-      tenantId,
-      workspaceId,
-      name: data.name,
-      description: data.description,
-      config: data.config,
-      kind,
-      createdAt: now,
-      updatedAt: now
-    };
+        [id, tenantId, workspaceId, data.name, data.description || null, data.config || null, kind, now, now]
+      );
+      await client.query("COMMIT");
+      return this.mapRowToProject(result.rows[0]);
+    } catch (error) {
+      await client.query("ROLLBACK");
+      throw error;
+    } finally {
+      client.release();
+    }
   }
   /**
    * Update an existing project
@@ -2634,11 +2665,8 @@ var PostgreSQLProjectStore = class {
    *   overwrites the existing config. To preserve the current config, omit this field.
    */
   async updateProject(tenantId, id, updates) {
+    (0, import_protocols.assertGenericProjectConfig)(updates.config);
     await this.ensureInitialized();
-    const existing = await this.getProjectById(tenantId, id);
-    if (!existing) {
-      return null;
-    }
     const updateFields = [];
     const updateValues = [];
     let paramIndex = 1;
@@ -2651,43 +2679,190 @@ var PostgreSQLProjectStore = class {
       updateValues.push(updates.description || null);
     }
     if (updates.config !== void 0) {
-      updateFields.push(`config = $${paramIndex++}`);
-      updateValues.push(updates.config || null);
+      const configParam = `$${paramIndex++}`;
+      updateFields.push(`config = CASE
+        WHEN config ? 'capabilityBundleIds'
+        THEN COALESCE(${configParam}::jsonb, '{}'::jsonb)
+          || jsonb_build_object('capabilityBundleIds', config->'capabilityBundleIds')
+        ELSE ${configParam}::jsonb
+      END`);
+      updateValues.push(updates.config);
     }
     if (updates.kind !== void 0) {
       updateFields.push(`kind = $${paramIndex++}`);
       updateValues.push(updates.kind);
     }
     if (updateFields.length === 0) {
-      return existing;
+      return await this.getProjectById(tenantId, id);
     }
     updateFields.push(`updated_at = $${paramIndex++}`);
     updateValues.push(/* @__PURE__ */ new Date());
-    updateValues.push(id);
-    updateValues.push(tenantId);
-    await this.pool.query(
-      `
-      UPDATE lattice_projects
-      SET ${updateFields.join(", ")}
-      WHERE id = $${paramIndex} AND tenant_id = $${paramIndex + 1}
-    `,
-      updateValues
-    );
-    return await this.getProjectById(tenantId, id);
+    updateValues.push(id, tenantId);
+    const client = await this.pool.connect();
+    try {
+      await client.query("BEGIN");
+      await client.query(
+        "SELECT pg_advisory_xact_lock(hashtextextended($1 || ':project-mutations', 0))",
+        [tenantId]
+      );
+      await client.query(
+        "SELECT pg_advisory_xact_lock(hashtextextended($2 || ':project:' || $1, 0))",
+        [id, tenantId]
+      );
+      const existing = await client.query(
+        "SELECT config FROM lattice_projects WHERE id = $1 AND tenant_id = $2 FOR UPDATE",
+        [id, tenantId]
+      );
+      if (!existing.rows[0]) {
+        await client.query("COMMIT");
+        return null;
+      }
+      const ids = existing.rows[0].config?.capabilityBundleIds;
+      const bundleIds = Array.isArray(ids) && ids.every((bundleId) => typeof bundleId === "string") ? [...ids].sort() : [];
+      if (bundleIds.length > 0) {
+        await client.query(
+          `SELECT pg_advisory_xact_lock(hashtextextended($1 || ':' || bundle_id, 0))
+           FROM unnest($2::text[]) AS bundle_id
+           ORDER BY bundle_id`,
+          [tenantId, bundleIds]
+        );
+      }
+      const result = await client.query(
+        `UPDATE lattice_projects SET ${updateFields.join(", ")}
+         WHERE id = $${paramIndex} AND tenant_id = $${paramIndex + 1}
+         RETURNING id, tenant_id, workspace_id, name, description, config, kind, created_at, updated_at`,
+        updateValues
+      );
+      await client.query("COMMIT");
+      return this.mapRowToProject(result.rows[0]);
+    } catch (error) {
+      await client.query("ROLLBACK");
+      throw error;
+    } finally {
+      client.release();
+    }
   }
   /**
    * Delete a project by ID
    */
   async deleteProject(tenantId, id) {
+    await this.ensureInitialized();
+    const client = await this.pool.connect();
+    try {
+      await client.query("BEGIN");
+      await client.query(
+        "SELECT pg_advisory_xact_lock(hashtextextended($1 || ':project-mutations', 0))",
+        [tenantId]
+      );
+      await client.query(
+        "SELECT pg_advisory_xact_lock(hashtextextended($2 || ':project:' || $1, 0))",
+        [id, tenantId]
+      );
+      const selected = await client.query(
+        "SELECT config FROM lattice_projects WHERE id = $1 AND tenant_id = $2 FOR UPDATE",
+        [id, tenantId]
+      );
+      if (!selected.rows[0]) {
+        await client.query("COMMIT");
+        return false;
+      }
+      const ids = selected.rows[0].config?.capabilityBundleIds;
+      const bundleIds = Array.isArray(ids) && ids.every((bundleId) => typeof bundleId === "string") ? [...ids].sort() : [];
+      if (bundleIds.length > 0) {
+        await client.query(
+          `SELECT pg_advisory_xact_lock(hashtextextended($1 || ':' || bundle_id, 0))
+           FROM unnest($2::text[]) AS bundle_id
+           ORDER BY bundle_id`,
+          [tenantId, bundleIds]
+        );
+      }
+      const result = await client.query(
+        "DELETE FROM lattice_projects WHERE id = $1 AND tenant_id = $2",
+        [id, tenantId]
+      );
+      await client.query("COMMIT");
+      return result.rowCount !== null && result.rowCount > 0;
+    } catch (error) {
+      await client.query("ROLLBACK");
+      throw error;
+    } finally {
+      client.release();
+    }
+  }
+  async updateCapabilityBundleIds(tenantId, projectId, bundleIds, expectedRevisions = {}) {
+    await this.ensureInitialized();
+    const client = await this.pool.connect();
+    try {
+      await client.query("BEGIN");
+      await client.query(
+        "SELECT pg_advisory_xact_lock(hashtextextended($1 || ':project-mutations', 0))",
+        [tenantId]
+      );
+      await client.query(
+        "SELECT pg_advisory_xact_lock(hashtextextended($2 || ':project:' || $1, 0))",
+        [projectId, tenantId]
+      );
+      await client.query(
+        "SELECT id FROM lattice_projects WHERE id = $1 AND tenant_id = $2 FOR UPDATE",
+        [projectId, tenantId]
+      );
+      if (bundleIds.length > 0) {
+        await client.query(
+          `SELECT pg_advisory_xact_lock(hashtextextended($1 || ':' || bundle_id, 0))
+           FROM unnest($2::text[]) AS bundle_id
+           ORDER BY bundle_id`,
+          [tenantId, [...bundleIds].sort()]
+        );
+        if (Object.keys(expectedRevisions).length > 0) {
+          const revisions = await client.query("SELECT id, updated_at::text AS updated_at FROM lattice_capability_bundles WHERE tenant_id = $1 AND id = ANY($2::uuid[]) FOR UPDATE", [tenantId, bundleIds]);
+          if (revisions.rows.some((bundle) => expectedRevisions[bundle.id] !== void 0 && expectedRevisions[bundle.id] !== bundle.updated_at)) {
+            await client.query("ROLLBACK");
+            return { status: "bundle_conflict" };
+          }
+        }
+      }
+      const result = await client.query(
+        `UPDATE lattice_projects
+         SET config = COALESCE(config, '{}'::jsonb) || jsonb_build_object('capabilityBundleIds', $3::jsonb), updated_at = NOW()
+         WHERE id = $1 AND tenant_id = $2
+         AND NOT EXISTS (
+           SELECT 1 FROM unnest($4::uuid[]) AS bundle_id
+           WHERE NOT EXISTS (
+             SELECT 1 FROM lattice_capability_bundles
+             WHERE tenant_id = $2 AND id = bundle_id
+           )
+         )
+         RETURNING id, tenant_id, workspace_id, name, description, config, kind, created_at, updated_at`,
+        [projectId, tenantId, JSON.stringify(bundleIds), bundleIds]
+      );
+      if (result.rows[0]) {
+        await client.query("COMMIT");
+        return { status: "updated", project: this.mapRowToProject(result.rows[0]) };
+      }
+      const project = await client.query(
+        "SELECT id FROM lattice_projects WHERE id = $1 AND tenant_id = $2",
+        [projectId, tenantId]
+      );
+      await client.query("COMMIT");
+      return project.rows.length > 0 ? { status: "bundle_not_found" } : { status: "project_not_found" };
+    } catch (error) {
+      await client.query("ROLLBACK");
+      throw error;
+    } finally {
+      client.release();
+    }
+  }
+  async isCapabilityBundleReferenced(tenantId, bundleId) {
     await this.ensureInitialized();
     const result = await this.pool.query(
-      `
-      DELETE FROM lattice_projects
-      WHERE id = $1 AND tenant_id = $2
-    `,
-      [id, tenantId]
+      `SELECT 1 AS exists FROM lattice_projects
+       WHERE tenant_id = $1
+       AND jsonb_typeof(config->'capabilityBundleIds') = 'array'
+       AND COALESCE(config->'capabilityBundleIds', '[]'::jsonb) ? $2
+       LIMIT 1`,
+      [tenantId, bundleId]
     );
-    return result.rowCount !== null && result.rowCount > 0;
+    return result.rows.length > 0;
   }
 };
 
@@ -5170,10 +5345,48 @@ var ThreadMessageQueueStore = class {
        (id, thread_id, tenant_id, assistant_id, workspace_id, project_id, message_content, message_type, sequence_order, priority, command, custom_run_config)
        VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12)
        RETURNING *`,
-      [id || import_crypto.default.randomUUID(), threadId, tenantId, assistantId, workspaceId || null, projectId || null, JSON.stringify(content), type, nextSeq, priority, command ? JSON.stringify(command) : null, custom_run_config ? JSON.stringify(custom_run_config) : null]
+      [id || import_crypto.default.randomUUID(), threadId, tenantId, assistantId, workspaceId ?? null, projectId ?? null, JSON.stringify(content), type, nextSeq, priority, command ? JSON.stringify(command) : null, custom_run_config ? JSON.stringify(custom_run_config) : null]
     );
     return this.rowToMessage(result.rows[0]);
   }
+  async addMessageIfCapacity(params, maxSize) {
+    if (maxSize === Infinity) {
+      await this.addMessage(params);
+      return true;
+    }
+    const client = await this.pool.connect();
+    try {
+      await client.query("BEGIN");
+      const scope = { tenantId: params.tenantId, assistantId: params.assistantId, workspaceId: params.workspaceId, projectId: params.projectId };
+      const lockKey = `${params.tenantId}:${params.assistantId}:${params.threadId}:${params.workspaceId ?? ""}:${params.projectId ?? ""}`;
+      await client.query("SELECT pg_advisory_xact_lock(hashtext($1))", [lockKey]);
+      const filter = scopeClause(scope, 2);
+      const count = await client.query(
+        `SELECT COUNT(*) as count FROM lattice_thread_message_queue WHERE thread_id = $1 AND status = 'pending'${filter.sql}`,
+        [params.threadId, ...filter.params]
+      );
+      if (parseInt(count.rows[0].count, 10) >= maxSize) {
+        await client.query("ROLLBACK");
+        return false;
+      }
+      const seq = await client.query(
+        `SELECT COALESCE(MAX(sequence_order), 0) + 1 as next_seq FROM lattice_thread_message_queue WHERE thread_id = $1`,
+        [params.threadId]
+      );
+      const result = await client.query(
+        `INSERT INTO lattice_thread_message_queue (id, thread_id, tenant_id, assistant_id, workspace_id, project_id, message_content, message_type, sequence_order, priority, command, custom_run_config)
+         VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12) RETURNING *`,
+        [params.id || import_crypto.default.randomUUID(), params.threadId, params.tenantId, params.assistantId, params.workspaceId ?? null, params.projectId ?? null, JSON.stringify(params.content), params.type || "human", seq.rows[0].next_seq, params.priority ?? 0, params.command ? JSON.stringify(params.command) : null, params.custom_run_config ? JSON.stringify(params.custom_run_config) : null]
+      );
+      await client.query("COMMIT");
+      return Boolean(result.rows[0]);
+    } catch (error) {
+      await client.query("ROLLBACK");
+      throw error;
+    } finally {
+      client.release();
+    }
+  }
   /**
    * Add message at head of queue (high priority, e.g., STEER/Command messages)
    * Uses priority=100 to ensure message is processed first
@@ -5194,42 +5407,45 @@ var ThreadMessageQueueStore = class {
        (id, thread_id, tenant_id, assistant_id, workspace_id, project_id, message_content, message_type, sequence_order, priority, command, custom_run_config)
        VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, 100, $10, $11)
        RETURNING *`,
-      [id || import_crypto.default.randomUUID(), threadId, resolvedTenantId, resolvedAssistantId, workspaceId || null, projectId || null, JSON.stringify(content), type, nextSeq, command ? JSON.stringify(command) : null, custom_run_config ? JSON.stringify(custom_run_config) : null]
+      [id || import_crypto.default.randomUUID(), threadId, resolvedTenantId, resolvedAssistantId, workspaceId ?? null, projectId ?? null, JSON.stringify(content), type, nextSeq, command ? JSON.stringify(command) : null, custom_run_config ? JSON.stringify(custom_run_config) : null]
     );
     return this.rowToMessage(result.rows[0]);
   }
   /**
    * Get pending messages for thread
    */
-  async getPendingMessages(threadId) {
+  async getPendingMessages(threadId, scope) {
+    const filter = scopeClause(scope, 2);
     const result = await this.pool.query(
-      `SELECT * FROM lattice_thread_message_queue 
-       WHERE thread_id = $1 AND status = 'pending'
+      `SELECT * FROM lattice_thread_message_queue
+        WHERE thread_id = $1 AND status = 'pending'${filter.sql}
        ORDER BY priority DESC, sequence_order ASC`,
-      [threadId]
+      [threadId, ...filter.params]
     );
     return result.rows.map((row) => this.rowToMessage(row));
   }
   /**
    * Get processing messages for a thread
    */
-  async getProcessingMessages(threadId) {
+  async getProcessingMessages(threadId, scope) {
+    const filter = scopeClause(scope, 2);
     const result = await this.pool.query(
       `SELECT * FROM lattice_thread_message_queue 
-       WHERE thread_id = $1 AND status = 'processing'
+        WHERE thread_id = $1 AND status = 'processing'${filter.sql}
        ORDER BY priority DESC, sequence_order ASC`,
-      [threadId]
+      [threadId, ...filter.params]
     );
     return result.rows.map((row) => this.rowToMessage(row));
   }
   /**
    * Get queue size
    */
-  async getQueueSize(threadId) {
+  async getQueueSize(threadId, scope) {
+    const filter = scopeClause(scope, 2);
     const result = await this.pool.query(
       `SELECT COUNT(*) as count FROM lattice_thread_message_queue 
-       WHERE thread_id = $1 AND status = 'pending'`,
-      [threadId]
+        WHERE thread_id = $1 AND status = 'pending'${filter.sql}`,
+      [threadId, ...filter.params]
     );
     return parseInt(result.rows[0].count, 10);
   }
@@ -5238,58 +5454,70 @@ var ThreadMessageQueueStore = class {
    */
   async getThreadsWithPendingMessages() {
     const result = await this.pool.query(
-      `SELECT DISTINCT ON (thread_id) tenant_id, assistant_id, thread_id, workspace_id, project_id
+      `SELECT DISTINCT ON (tenant_id, assistant_id, workspace_id, project_id, thread_id) tenant_id, assistant_id, thread_id, workspace_id, project_id
        FROM lattice_thread_message_queue 
        WHERE status IN ('pending', 'processing')
-       ORDER BY thread_id`
+        ORDER BY tenant_id, assistant_id, workspace_id, project_id, thread_id`
     );
     return result.rows.map((row) => ({
       tenantId: row.tenant_id,
       assistantId: row.assistant_id,
       threadId: row.thread_id,
-      workspaceId: row.workspace_id || void 0,
-      projectId: row.project_id || void 0
+      workspaceId: row.workspace_id,
+      projectId: row.project_id
     }));
   }
   /**
    * Remove message
    */
-  async removeMessage(messageId) {
+  async removeMessage(messageId, scope) {
+    const filter = scopeClause(scope, 2);
     const result = await this.pool.query(
-      `DELETE FROM lattice_thread_message_queue WHERE id = $1 RETURNING id`,
-      [messageId]
+      `DELETE FROM lattice_thread_message_queue WHERE id = $1${filter.sql} RETURNING id`,
+      [messageId, ...filter.params]
     );
     return (result.rowCount ?? 0) > 0;
   }
   /**
    * Clear all messages for thread
    */
-  async clearMessages(threadId) {
+  async clearMessages(threadId, scope) {
+    const filter = scopeClause(scope, 2);
     await this.pool.query(
-      `DELETE FROM lattice_thread_message_queue WHERE thread_id = $1`,
-      [threadId]
+      `DELETE FROM lattice_thread_message_queue WHERE thread_id = $1${filter.sql}`,
+      [threadId, ...filter.params]
     );
   }
   /**
    * Mark message as processing
    */
-  async markProcessing(messageId) {
+  async markProcessing(messageId, customRunConfig, scope) {
+    if (customRunConfig !== void 0) {
+      const filter2 = scopeClause(scope, 3);
+      await this.pool.query(
+        `UPDATE lattice_thread_message_queue SET status = 'processing', custom_run_config = $2 WHERE id = $1${filter2.sql}`,
+        [messageId, JSON.stringify(customRunConfig), ...filter2.params]
+      );
+      return;
+    }
+    const filter = scopeClause(scope, 2);
     await this.pool.query(
-      `UPDATE lattice_thread_message_queue SET status = 'processing' WHERE id = $1`,
-      [messageId]
+      `UPDATE lattice_thread_message_queue SET status = 'processing' WHERE id = $1${filter.sql}`,
+      [messageId, ...filter.params]
     );
   }
   /**
    * Reset all processing messages to pending state for a thread
    * Returns the number of messages reset
    */
-  async resetProcessingToPending(threadId) {
+  async resetProcessingToPending(threadId, scope) {
+    const filter = scopeClause(scope, 2);
     const result = await this.pool.query(
       `UPDATE lattice_thread_message_queue 
        SET status = 'pending'
-       WHERE thread_id = $1 AND status = 'processing'
+        WHERE thread_id = $1 AND status = 'processing'${filter.sql}
        RETURNING id`,
-      [threadId]
+      [threadId, ...filter.params]
     );
     return result.rowCount ?? 0;
   }
@@ -5306,6 +5534,18 @@ var ThreadMessageQueueStore = class {
     };
   }
 };
+function scopeClause(scope, start) {
+  if (!scope) return { sql: "", params: [] };
+  const params = [];
+  const entries = ["tenantId", "assistantId", "workspaceId", "projectId"].map((key) => [key, scope[key]]);
+  const sql = entries.map(([key, value]) => {
+    const column = key.replace(/[A-Z]/g, (letter) => `_${letter.toLowerCase()}`);
+    if (value == null) return ` AND ${column} IS NULL`;
+    params.push(value);
+    return ` AND ${column} = $${start + params.length - 1}`;
+  }).join("");
+  return { sql, params };
+}
 
 // src/stores/ChannelBindingStore.ts
 var import_pg14 = require("pg");
@@ -6056,17 +6296,17 @@ var PostgreSQLA2AApiKeyStore = class {
     const result = await this.pool.query(
       `SELECT * FROM lattice_a2a_api_keys WHERE enabled = true`
     );
-    const map = /* @__PURE__ */ new Map();
+    const map2 = /* @__PURE__ */ new Map();
     for (const row of result.rows) {
       const key = (0, import_core5.decrypt)(row.key_value);
-      map.set(key, {
+      map2.set(key, {
         key,
         tenantId: row.tenant_id,
         projectId: row.project_id,
         assistantIds: row.assistant_ids ?? void 0
       });
     }
-    return map;
+    return map2;
   }
 };
 
@@ -6296,7 +6536,7 @@ var PostgreSQLAgentWebAppStore = class {
 
 // src/stores/PostgreSQLScheduleStorage.ts
 var import_pg18 = require("pg");
-var import_protocols = require("@axiom-lattice/protocols");
+var import_protocols2 = require("@axiom-lattice/protocols");
 
 // src/migrations/schedule_migrations.ts
 var createScheduledTasksTable = {
@@ -6710,7 +6950,7 @@ var PostgreSQLScheduleStorage = class {
     await this.ensureInitialized();
     const result = await this.pool.query(
       `SELECT * FROM lattice_scheduled_tasks WHERE status IN ($1, $2) ORDER BY created_at ASC`,
-      [import_protocols.ScheduledTaskStatus.PENDING, import_protocols.ScheduledTaskStatus.PAUSED]
+      [import_protocols2.ScheduledTaskStatus.PENDING, import_protocols2.ScheduledTaskStatus.PAUSED]
     );
     return result.rows.map((row) => this.mapRowToTask(row));
   }
@@ -6869,9 +7109,9 @@ var PostgreSQLScheduleStorage = class {
       AND updated_at < $4
       `,
       [
-        import_protocols.ScheduledTaskStatus.COMPLETED,
-        import_protocols.ScheduledTaskStatus.CANCELLED,
-        import_protocols.ScheduledTaskStatus.FAILED,
+        import_protocols2.ScheduledTaskStatus.COMPLETED,
+        import_protocols2.ScheduledTaskStatus.CANCELLED,
+        import_protocols2.ScheduledTaskStatus.FAILED,
         cutoff
       ]
     );
@@ -7737,6 +7977,7 @@ var PostgreSQLTaskStore = class {
 };
 
 // src/stores/PostgreSQLTaskWorkItemStore.ts
+var import_protocols3 = require("@axiom-lattice/protocols");
 var import_uuid4 = require("uuid");
 var PostgreSQLTaskWorkItemStore = class {
   constructor(pool) {
@@ -7828,6 +8069,35 @@ var PostgreSQLTaskWorkItemStore = class {
     const result = await this.pool.query(query, params);
     return result.rows.map((row) => this.rowToItem(row));
   }
+  /** List pending execution results using one bounded PostgreSQL anti-join query. */
+  async listPendingExecutionResults(params) {
+    if (!Number.isSafeInteger(params.limit) || params.limit < 0 || params.limit > import_protocols3.MAX_PENDING_EXECUTION_RESULTS_LIMIT) {
+      const error = new RangeError(`limit must be a safe integer between 0 and ${import_protocols3.MAX_PENDING_EXECUTION_RESULTS_LIMIT}`);
+      error.code = "INVALID_LIMIT";
+      throw error;
+    }
+    if (params.limit === 0) return [];
+    const result = await this.pool.query(
+      `SELECT result.*
+       FROM lattice_task_work_items AS result
+       WHERE result.tenant_id = $1
+         AND result.task_id = $2
+         AND result.action = 'execution_result'
+         AND result.event_key COLLATE "C" ~ '^execution-result:[A-Za-z0-9._:-]+$'
+         AND NOT EXISTS (
+           SELECT 1
+           FROM lattice_task_work_items AS reconciled
+           WHERE reconciled.tenant_id = result.tenant_id
+             AND reconciled.task_id = result.task_id
+             AND reconciled.action = 'execution_reconciled'
+             AND reconciled.detail ->> 'executionResultId' = result.event_key
+         )
+       ORDER BY result.created_at DESC, result.id DESC
+       LIMIT $3`,
+      [params.tenantId, params.taskId, params.limit]
+    );
+    return result.rows.map((row) => this.rowToItem(row));
+  }
   rowToItem(row) {
     return {
       id: row.id,
@@ -8855,10 +9125,268 @@ var addTaskWorkItemEventKeyMigration = {
     `);
   }
 };
+var addTaskWorkItemPendingIndexesMigration = {
+  version: 171,
+  name: "add_task_work_item_pending_indexes",
+  up: async (client) => {
+    await client.query(`
+      CREATE INDEX IF NOT EXISTS idx_task_work_items_pending_order
+        ON lattice_task_work_items (tenant_id, task_id, action, created_at DESC, id DESC)
+    `);
+    await client.query(`
+      CREATE INDEX IF NOT EXISTS idx_task_work_items_reconciled_result
+        ON lattice_task_work_items (tenant_id, task_id, (detail ->> 'executionResultId'))
+        WHERE action = 'execution_reconciled'
+    `);
+  }
+};
+
+// src/migrations/capability_bundle_migration.ts
+var createCapabilityBundlesTable = {
+  version: 170,
+  name: "create_capability_bundles_table",
+  up: async (client) => {
+    await client.query(`CREATE TABLE IF NOT EXISTS lattice_capability_bundles (
+      id UUID PRIMARY KEY, tenant_id VARCHAR(255) NOT NULL, bundle_key VARCHAR(255) NOT NULL,
+      name VARCHAR(255) NOT NULL, description TEXT, capabilities JSONB NOT NULL DEFAULT '[]'::jsonb,
+      created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(), updated_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+      UNIQUE (tenant_id, bundle_key)
+    )`);
+    await client.query("CREATE INDEX IF NOT EXISTS idx_lattice_capability_bundles_tenant ON lattice_capability_bundles(tenant_id)");
+  },
+  down: async (client) => {
+    await client.query("DROP INDEX IF EXISTS idx_lattice_capability_bundles_tenant");
+    await client.query("DROP TABLE IF EXISTS lattice_capability_bundles");
+  }
+};
+
+// src/stores/PostgreSQLCapabilityBundleStore.ts
+var import_crypto4 = require("crypto");
+var import_pg24 = require("pg");
+var duplicateMessage = "Capability bundle key already exists for tenant";
+function map(row) {
+  return {
+    id: row.id,
+    tenantId: row.tenant_id,
+    key: row.bundle_key,
+    name: row.name,
+    description: row.description ?? void 0,
+    capabilities: row.capabilities,
+    createdAt: row.created_at.toISOString(),
+    updatedAt: typeof row.updated_at === "string" ? row.updated_at : row.updated_at.toISOString()
+  };
+}
+function isDuplicate(error) {
+  return typeof error === "object" && error !== null && "code" in error && error.code === "23505";
+}
+var PostgreSQLCapabilityBundleStore = class {
+  /**
+   * Creates a PostgreSQL capability bundle store.
+   *
+   * @param options - Pool ownership, connection, and migration options.
+   */
+  constructor(options) {
+    this.initialized = false;
+    this.ownsPool = true;
+    this.initPromise = null;
+    if (options.pool) {
+      this.pool = options.pool;
+      this.ownsPool = false;
+      this.initialized = true;
+      return;
+    }
+    this.pool = typeof options.poolConfig === "string" ? new import_pg24.Pool({ connectionString: options.poolConfig }) : options.poolConfig ? new import_pg24.Pool(options.poolConfig) : (() => {
+      throw new Error("Either pool or poolConfig must be provided");
+    })();
+    this.migrationManager = new MigrationManager(this.pool);
+    this.migrationManager.register(createCapabilityBundlesTable);
+    if (options.autoMigrate !== false) {
+      this.startInitialization();
+    }
+  }
+  /**
+   * Applies pending migrations for an internally managed pool.
+   *
+   * @returns A shared promise that resolves when initialization completes.
+   */
+  async initialize() {
+    if (this.initialized) return;
+    if (this.initPromise) return this.initPromise;
+    return this.startInitialization();
+  }
+  startInitialization() {
+    this.initPromise = this.migrationManager.migrate().then(() => {
+      this.initialized = true;
+    });
+    void this.initPromise.catch(() => void 0);
+    return this.initPromise;
+  }
+  /**
+   * Closes the pool when it was created by this store.
+   *
+   * @returns A promise that resolves after owned resources are released.
+   */
+  async dispose() {
+    if (this.ownsPool) await this.pool.end();
+  }
+  async ready() {
+    if (!this.initialized) await this.initialize();
+  }
+  async listByTenant(tenantId) {
+    await this.ready();
+    const result = await this.pool.query(
+      "SELECT id, tenant_id, bundle_key, name, description, capabilities, created_at, updated_at::text AS updated_at FROM lattice_capability_bundles WHERE tenant_id = $1 ORDER BY created_at",
+      [tenantId]
+    );
+    return result.rows.map(map);
+  }
+  async getById(tenantId, id) {
+    await this.ready();
+    const result = await this.pool.query(
+      "SELECT id, tenant_id, bundle_key, name, description, capabilities, created_at, updated_at::text AS updated_at FROM lattice_capability_bundles WHERE tenant_id = $1 AND id = $2",
+      [tenantId, id]
+    );
+    return result.rows[0] ? map(result.rows[0]) : null;
+  }
+  async getManyByIds(tenantId, ids) {
+    await this.ready();
+    if (ids.length === 0) return [];
+    const result = await this.pool.query(
+      "SELECT id, tenant_id, bundle_key, name, description, capabilities, created_at, updated_at::text AS updated_at FROM lattice_capability_bundles WHERE tenant_id = $1 AND id = ANY($2::uuid[])",
+      [tenantId, ids]
+    );
+    return result.rows.map(map);
+  }
+  async create(tenantId, input) {
+    await this.ready();
+    try {
+      const result = await this.pool.query(
+        `INSERT INTO lattice_capability_bundles
+         (id, tenant_id, bundle_key, name, description, capabilities)
+         VALUES ($1, $2, $3, $4, $5, $6::jsonb)
+          RETURNING id, tenant_id, bundle_key, name, description, capabilities, created_at, updated_at::text AS updated_at`,
+        [
+          (0, import_crypto4.randomUUID)(),
+          tenantId,
+          input.key,
+          input.name,
+          input.description ?? null,
+          JSON.stringify(input.capabilities)
+        ]
+      );
+      return map(result.rows[0]);
+    } catch (error) {
+      if (isDuplicate(error)) throw new Error(duplicateMessage);
+      throw error;
+    }
+  }
+  async update(tenantId, id, input) {
+    await this.ready();
+    const fields = [];
+    const values = [];
+    const add = (field, value) => {
+      values.push(value);
+      fields.push(`${field} = $${values.length}`);
+    };
+    if (input.name !== void 0) add("name", input.name);
+    if (Object.prototype.hasOwnProperty.call(input, "description")) {
+      add("description", input.description ?? null);
+    }
+    if (input.capabilities !== void 0) {
+      add("capabilities", JSON.stringify(input.capabilities));
+    }
+    if (fields.length === 0) {
+      const expectedUpdatedAt2 = input.expectedUpdatedAt;
+      const result = await this.pool.query(
+        `SELECT id, tenant_id, bundle_key, name, description, capabilities, created_at, updated_at::text AS updated_at
+         FROM lattice_capability_bundles
+         WHERE tenant_id = $1 AND id = $2${expectedUpdatedAt2 === void 0 ? "" : " AND updated_at::text = $3"}`,
+        expectedUpdatedAt2 === void 0 ? [tenantId, id] : [tenantId, id, expectedUpdatedAt2]
+      );
+      if (result.rows[0]) return map(result.rows[0]);
+      return expectedUpdatedAt2 === void 0 ? null : { status: "conflict" };
+    }
+    const expectedUpdatedAt = input.expectedUpdatedAt;
+    values.push(tenantId, id);
+    if (expectedUpdatedAt !== void 0) values.push(expectedUpdatedAt);
+    const tenantParam = values.length - (expectedUpdatedAt === void 0 ? 1 : 2);
+    const idParam = tenantParam + 1;
+    const revisionPredicate = expectedUpdatedAt === void 0 ? "" : ` AND updated_at::text = $${values.length}`;
+    try {
+      const result = await this.pool.query(
+        `UPDATE lattice_capability_bundles
+          SET ${fields.join(", ")}, updated_at = GREATEST(updated_at + interval '1 microsecond', clock_timestamp())
+          WHERE tenant_id = $${tenantParam} AND id = $${idParam}${revisionPredicate}
+         RETURNING id, tenant_id, bundle_key, name, description, capabilities, created_at, updated_at::text AS updated_at`,
+        values
+      );
+      if (result.rows[0]) return map(result.rows[0]);
+      return expectedUpdatedAt === void 0 ? null : { status: "conflict" };
+    } catch (error) {
+      if (isDuplicate(error)) throw new Error(duplicateMessage);
+      throw error;
+    }
+  }
+  async deleteIfUnreferenced(tenantId, id) {
+    await this.ready();
+    const client = await this.pool.connect();
+    try {
+      await client.query("BEGIN");
+      await client.query(
+        "SELECT pg_advisory_xact_lock(hashtextextended($1 || ':project-mutations', 0))",
+        [tenantId]
+      );
+      const projectIds = await client.query(
+        `SELECT id FROM lattice_projects
+         WHERE tenant_id = $1
+         ORDER BY id`,
+        [tenantId]
+      );
+      if (projectIds.rows.length > 0) {
+        await client.query(
+          `SELECT pg_advisory_xact_lock(hashtextextended($1 || ':project:' || project_id, 0))
+           FROM unnest($2::text[]) AS project_id
+           ORDER BY project_id`,
+          [tenantId, projectIds.rows.map((project) => project.id)]
+        );
+      }
+      await client.query(
+        `SELECT id FROM lattice_projects
+         WHERE tenant_id = $1
+         FOR UPDATE`,
+        [tenantId]
+      );
+      await client.query("SELECT pg_advisory_xact_lock(hashtextextended($1 || ':' || $2, 0))", [tenantId, id]);
+      const referenced = await client.query(
+        `SELECT 1 FROM lattice_projects
+         WHERE tenant_id = $1
+         AND jsonb_typeof(config->'capabilityBundleIds') = 'array'
+         AND COALESCE(config->'capabilityBundleIds', '[]'::jsonb) ? $2
+         LIMIT 1`,
+        [tenantId, id]
+      );
+      if (referenced.rows.length > 0) {
+        await client.query("COMMIT");
+        return "in_use";
+      }
+      const deleted = await client.query(
+        "DELETE FROM lattice_capability_bundles WHERE tenant_id = $1 AND id = $2 RETURNING id",
+        [tenantId, id]
+      );
+      await client.query("COMMIT");
+      return deleted.rows.length > 0 ? "deleted" : "not_found";
+    } catch (error) {
+      await client.query("ROLLBACK");
+      throw error;
+    } finally {
+      client.release();
+    }
+  }
+};
 
 // src/createPgStoreConfig.ts
 async function createPgStoreConfig(connectionString) {
-  const pool = new import_pg24.Pool({ connectionString });
+  const pool = new import_pg25.Pool({ connectionString });
   const mm = new MigrationManager(pool);
   mm.register(createThreadsTable);
   mm.register(createScheduledTasksTable);
@@ -8913,6 +9441,8 @@ async function createPgStoreConfig(connectionString) {
   mm.register(addA2AKeyAssistantIds);
   mm.register(addTaskWorkItemEventKeyMigration);
   mm.register(createAgentWebAppsTable);
+  mm.register(createCapabilityBundlesTable);
+  mm.register(addTaskWorkItemPendingIndexesMigration);
   await mm.migrate();
   const checkpoint = import_langgraph_checkpoint_postgres.PostgresSaver.fromConnString(connectionString);
   checkpoint.setup().catch((err) => {
@@ -8941,6 +9471,7 @@ async function createPgStoreConfig(connectionString) {
     taskWorkItem: taskWorkItemStore,
     a2aApiKey: new PostgreSQLA2AApiKeyStore(opts),
     agentWebApp: new PostgreSQLAgentWebAppStore(opts),
+    capabilityBundle: new PostgreSQLCapabilityBundleStore(opts),
     schedule: new PostgreSQLScheduleStorage(opts),
     menu: new MenuStore(opts),
     sharedResource: new PostgresSharedResourceStore(opts),
@@ -8951,7 +9482,7 @@ async function createPgStoreConfig(connectionString) {
 }
 
 // src/stores/PostgreSQLSkillStore.ts
-var import_pg25 = require("pg");
+var import_pg26 = require("pg");
 var PostgreSQLSkillStore = class {
   constructor(options) {
     this.initialized = false;
@@ -8964,9 +9495,9 @@ var PostgreSQLSkillStore = class {
       return;
     }
     if (typeof options.poolConfig === "string") {
-      this.pool = new import_pg25.Pool({ connectionString: options.poolConfig });
+      this.pool = new import_pg26.Pool({ connectionString: options.poolConfig });
     } else if (options.poolConfig) {
-      this.pool = new import_pg25.Pool(options.poolConfig);
+      this.pool = new import_pg26.Pool(options.poolConfig);
     } else {
       throw new Error("Either pool or poolConfig must be provided");
     }
@@ -9267,7 +9798,7 @@ var PostgreSQLSkillStore = class {
 };
 
 // src/stores/ChannelIdentityMappingStore.ts
-var import_pg26 = require("pg");
+var import_pg27 = require("pg");
 var ChannelIdentityMappingStore = class {
   constructor(options) {
     this.initialized = false;
@@ -9279,7 +9810,7 @@ var ChannelIdentityMappingStore = class {
       this.initialized = true;
       return;
     }
-    this.pool = typeof options.poolConfig === "string" ? new import_pg26.Pool({ connectionString: options.poolConfig }) : options.poolConfig ? new import_pg26.Pool(options.poolConfig) : (() => {
+    this.pool = typeof options.poolConfig === "string" ? new import_pg27.Pool({ connectionString: options.poolConfig }) : options.poolConfig ? new import_pg27.Pool(options.poolConfig) : (() => {
       throw new Error("Either pool or poolConfig must be provided");
     })();
     this.migrationManager = new MigrationManager(this.pool);
@@ -9508,6 +10039,7 @@ function mapRowToChannelIdentityMapping(row) {
   PostgreSQLA2AApiKeyStore,
   PostgreSQLAgentWebAppStore,
   PostgreSQLAssistantStore,
+  PostgreSQLCapabilityBundleStore,
   PostgreSQLChannelInstallationStore,
   PostgreSQLCollectionStore,
   PostgreSQLConnectionStore,
@@ -9546,6 +10078,7 @@ function mapRowToChannelIdentityMapping(row) {
   createA2AApiKeysTable,
   createAgentWebAppsTable,
   createAssistantsTable,
+  createCapabilityBundlesTable,
   createChannelBindingsTable,
   createChannelIdentityMappingTables,
   createChannelInstallationsTable,