@axiom-lattice/pg-stores 3.1.0 → 3.1.2

package/dist/index.mjs

@@ -1,8 +1,8 @@
 // src/index.ts
-import { Pool as Pool27 } from "pg";
+import { Pool as Pool29 } from "pg";
 
 // src/createPgStoreConfig.ts
-import { Pool as Pool24 } from "pg";
+import { Pool as Pool26 } from "pg";
 
 // src/migrations/migration.ts
 var MigrationManager = class {
@@ -33,7 +33,8 @@ var MigrationManager = class {
     const tableExists = await client.query(`
       SELECT EXISTS (
         SELECT FROM information_schema.tables
-        WHERE table_name = 'lattice_schema_migrations'
+        WHERE table_schema = current_schema()
+          AND table_name = 'lattice_schema_migrations'
       )
     `);
     if (!tableExists.rows[0].exists) {
@@ -2272,6 +2273,9 @@ var PostgreSQLWorkspaceStore = class {
 
 // src/stores/PostgreSQLProjectStore.ts
 import { Pool as Pool7 } from "pg";
+import {
+  assertGenericProjectConfig
+} from "@axiom-lattice/protocols";
 
 // src/migrations/project_migrations.ts
 var createProjectsTable = {
@@ -2487,34 +2491,62 @@ var PostgreSQLProjectStore = class {
    * Create a new project
    */
   async createProject(tenantId, workspaceId, id, data) {
+    assertGenericProjectConfig(data.config);
     await this.ensureInitialized();
     const now = /* @__PURE__ */ new Date();
     const kind = data.kind || "business";
-    await this.pool.query(
-      `
-      INSERT INTO lattice_projects (id, tenant_id, workspace_id, name, description, config, kind, created_at, updated_at)
+    const client = await this.pool.connect();
+    try {
+      await client.query("BEGIN");
+      await client.query(
+        "SELECT pg_advisory_xact_lock(hashtextextended($1 || ':project-mutations', 0))",
+        [tenantId]
+      );
+      await client.query(
+        "SELECT pg_advisory_xact_lock(hashtextextended($2 || ':project:' || $1, 0))",
+        [id, tenantId]
+      );
+      const existing = await client.query(
+        "SELECT config FROM lattice_projects WHERE id = $1 AND tenant_id = $2 FOR UPDATE",
+        [id, tenantId]
+      );
+      const ids = existing.rows[0]?.config?.capabilityBundleIds;
+      const bundleIds = Array.isArray(ids) && ids.every((bundleId) => typeof bundleId === "string") ? [...ids].sort() : [];
+      if (bundleIds.length > 0) {
+        await client.query(
+          `SELECT pg_advisory_xact_lock(hashtextextended($1 || ':' || bundle_id, 0))
+           FROM unnest($2::text[]) AS bundle_id
+           ORDER BY bundle_id`,
+          [tenantId, bundleIds]
+        );
+      }
+      const result = await client.query(
+        `INSERT INTO lattice_projects (id, tenant_id, workspace_id, name, description, config, kind, created_at, updated_at)
       VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9)
       ON CONFLICT (id, tenant_id) DO UPDATE SET
         workspace_id = EXCLUDED.workspace_id,
         name = EXCLUDED.name,
         description = EXCLUDED.description,
-        config = EXCLUDED.config,
+        config = CASE
+          WHEN lattice_projects.config ? 'capabilityBundleIds'
+          THEN COALESCE(EXCLUDED.config, '{}'::jsonb)
+            || jsonb_build_object('capabilityBundleIds', lattice_projects.config->'capabilityBundleIds')
+          ELSE EXCLUDED.config
+        END,
         kind = EXCLUDED.kind,
         updated_at = EXCLUDED.updated_at
+      RETURNING id, tenant_id, workspace_id, name, description, config, kind, created_at, updated_at
     `,
-      [id, tenantId, workspaceId, data.name, data.description || null, data.config || null, kind, now, now]
-    );
-    return {
-      id,
-      tenantId,
-      workspaceId,
-      name: data.name,
-      description: data.description,
-      config: data.config,
-      kind,
-      createdAt: now,
-      updatedAt: now
-    };
+        [id, tenantId, workspaceId, data.name, data.description || null, data.config || null, kind, now, now]
+      );
+      await client.query("COMMIT");
+      return this.mapRowToProject(result.rows[0]);
+    } catch (error) {
+      await client.query("ROLLBACK");
+      throw error;
+    } finally {
+      client.release();
+    }
   }
   /**
    * Update an existing project
@@ -2524,11 +2556,8 @@ var PostgreSQLProjectStore = class {
    *   overwrites the existing config. To preserve the current config, omit this field.
    */
   async updateProject(tenantId, id, updates) {
+    assertGenericProjectConfig(updates.config);
     await this.ensureInitialized();
-    const existing = await this.getProjectById(tenantId, id);
-    if (!existing) {
-      return null;
-    }
     const updateFields = [];
     const updateValues = [];
     let paramIndex = 1;
@@ -2541,43 +2570,190 @@ var PostgreSQLProjectStore = class {
       updateValues.push(updates.description || null);
     }
     if (updates.config !== void 0) {
-      updateFields.push(`config = $${paramIndex++}`);
-      updateValues.push(updates.config || null);
+      const configParam = `$${paramIndex++}`;
+      updateFields.push(`config = CASE
+        WHEN config ? 'capabilityBundleIds'
+        THEN COALESCE(${configParam}::jsonb, '{}'::jsonb)
+          || jsonb_build_object('capabilityBundleIds', config->'capabilityBundleIds')
+        ELSE ${configParam}::jsonb
+      END`);
+      updateValues.push(updates.config);
     }
     if (updates.kind !== void 0) {
       updateFields.push(`kind = $${paramIndex++}`);
       updateValues.push(updates.kind);
     }
     if (updateFields.length === 0) {
-      return existing;
+      return await this.getProjectById(tenantId, id);
     }
     updateFields.push(`updated_at = $${paramIndex++}`);
     updateValues.push(/* @__PURE__ */ new Date());
-    updateValues.push(id);
-    updateValues.push(tenantId);
-    await this.pool.query(
-      `
-      UPDATE lattice_projects
-      SET ${updateFields.join(", ")}
-      WHERE id = $${paramIndex} AND tenant_id = $${paramIndex + 1}
-    `,
-      updateValues
-    );
-    return await this.getProjectById(tenantId, id);
+    updateValues.push(id, tenantId);
+    const client = await this.pool.connect();
+    try {
+      await client.query("BEGIN");
+      await client.query(
+        "SELECT pg_advisory_xact_lock(hashtextextended($1 || ':project-mutations', 0))",
+        [tenantId]
+      );
+      await client.query(
+        "SELECT pg_advisory_xact_lock(hashtextextended($2 || ':project:' || $1, 0))",
+        [id, tenantId]
+      );
+      const existing = await client.query(
+        "SELECT config FROM lattice_projects WHERE id = $1 AND tenant_id = $2 FOR UPDATE",
+        [id, tenantId]
+      );
+      if (!existing.rows[0]) {
+        await client.query("COMMIT");
+        return null;
+      }
+      const ids = existing.rows[0].config?.capabilityBundleIds;
+      const bundleIds = Array.isArray(ids) && ids.every((bundleId) => typeof bundleId === "string") ? [...ids].sort() : [];
+      if (bundleIds.length > 0) {
+        await client.query(
+          `SELECT pg_advisory_xact_lock(hashtextextended($1 || ':' || bundle_id, 0))
+           FROM unnest($2::text[]) AS bundle_id
+           ORDER BY bundle_id`,
+          [tenantId, bundleIds]
+        );
+      }
+      const result = await client.query(
+        `UPDATE lattice_projects SET ${updateFields.join(", ")}
+         WHERE id = $${paramIndex} AND tenant_id = $${paramIndex + 1}
+         RETURNING id, tenant_id, workspace_id, name, description, config, kind, created_at, updated_at`,
+        updateValues
+      );
+      await client.query("COMMIT");
+      return this.mapRowToProject(result.rows[0]);
+    } catch (error) {
+      await client.query("ROLLBACK");
+      throw error;
+    } finally {
+      client.release();
+    }
   }
   /**
    * Delete a project by ID
    */
   async deleteProject(tenantId, id) {
+    await this.ensureInitialized();
+    const client = await this.pool.connect();
+    try {
+      await client.query("BEGIN");
+      await client.query(
+        "SELECT pg_advisory_xact_lock(hashtextextended($1 || ':project-mutations', 0))",
+        [tenantId]
+      );
+      await client.query(
+        "SELECT pg_advisory_xact_lock(hashtextextended($2 || ':project:' || $1, 0))",
+        [id, tenantId]
+      );
+      const selected = await client.query(
+        "SELECT config FROM lattice_projects WHERE id = $1 AND tenant_id = $2 FOR UPDATE",
+        [id, tenantId]
+      );
+      if (!selected.rows[0]) {
+        await client.query("COMMIT");
+        return false;
+      }
+      const ids = selected.rows[0].config?.capabilityBundleIds;
+      const bundleIds = Array.isArray(ids) && ids.every((bundleId) => typeof bundleId === "string") ? [...ids].sort() : [];
+      if (bundleIds.length > 0) {
+        await client.query(
+          `SELECT pg_advisory_xact_lock(hashtextextended($1 || ':' || bundle_id, 0))
+           FROM unnest($2::text[]) AS bundle_id
+           ORDER BY bundle_id`,
+          [tenantId, bundleIds]
+        );
+      }
+      const result = await client.query(
+        "DELETE FROM lattice_projects WHERE id = $1 AND tenant_id = $2",
+        [id, tenantId]
+      );
+      await client.query("COMMIT");
+      return result.rowCount !== null && result.rowCount > 0;
+    } catch (error) {
+      await client.query("ROLLBACK");
+      throw error;
+    } finally {
+      client.release();
+    }
+  }
+  async updateCapabilityBundleIds(tenantId, projectId, bundleIds, expectedRevisions = {}) {
+    await this.ensureInitialized();
+    const client = await this.pool.connect();
+    try {
+      await client.query("BEGIN");
+      await client.query(
+        "SELECT pg_advisory_xact_lock(hashtextextended($1 || ':project-mutations', 0))",
+        [tenantId]
+      );
+      await client.query(
+        "SELECT pg_advisory_xact_lock(hashtextextended($2 || ':project:' || $1, 0))",
+        [projectId, tenantId]
+      );
+      await client.query(
+        "SELECT id FROM lattice_projects WHERE id = $1 AND tenant_id = $2 FOR UPDATE",
+        [projectId, tenantId]
+      );
+      if (bundleIds.length > 0) {
+        await client.query(
+          `SELECT pg_advisory_xact_lock(hashtextextended($1 || ':' || bundle_id, 0))
+           FROM unnest($2::text[]) AS bundle_id
+           ORDER BY bundle_id`,
+          [tenantId, [...bundleIds].sort()]
+        );
+        if (Object.keys(expectedRevisions).length > 0) {
+          const revisions = await client.query("SELECT id, updated_at::text AS updated_at FROM lattice_capability_bundles WHERE tenant_id = $1 AND id = ANY($2::uuid[]) FOR UPDATE", [tenantId, bundleIds]);
+          if (revisions.rows.some((bundle) => expectedRevisions[bundle.id] !== void 0 && expectedRevisions[bundle.id] !== bundle.updated_at)) {
+            await client.query("ROLLBACK");
+            return { status: "bundle_conflict" };
+          }
+        }
+      }
+      const result = await client.query(
+        `UPDATE lattice_projects
+         SET config = COALESCE(config, '{}'::jsonb) || jsonb_build_object('capabilityBundleIds', $3::jsonb), updated_at = NOW()
+         WHERE id = $1 AND tenant_id = $2
+         AND NOT EXISTS (
+           SELECT 1 FROM unnest($4::uuid[]) AS bundle_id
+           WHERE NOT EXISTS (
+             SELECT 1 FROM lattice_capability_bundles
+             WHERE tenant_id = $2 AND id = bundle_id
+           )
+         )
+         RETURNING id, tenant_id, workspace_id, name, description, config, kind, created_at, updated_at`,
+        [projectId, tenantId, JSON.stringify(bundleIds), bundleIds]
+      );
+      if (result.rows[0]) {
+        await client.query("COMMIT");
+        return { status: "updated", project: this.mapRowToProject(result.rows[0]) };
+      }
+      const project = await client.query(
+        "SELECT id FROM lattice_projects WHERE id = $1 AND tenant_id = $2",
+        [projectId, tenantId]
+      );
+      await client.query("COMMIT");
+      return project.rows.length > 0 ? { status: "bundle_not_found" } : { status: "project_not_found" };
+    } catch (error) {
+      await client.query("ROLLBACK");
+      throw error;
+    } finally {
+      client.release();
+    }
+  }
+  async isCapabilityBundleReferenced(tenantId, bundleId) {
     await this.ensureInitialized();
     const result = await this.pool.query(
-      `
-      DELETE FROM lattice_projects
-      WHERE id = $1 AND tenant_id = $2
-    `,
-      [id, tenantId]
+      `SELECT 1 AS exists FROM lattice_projects
+       WHERE tenant_id = $1
+       AND jsonb_typeof(config->'capabilityBundleIds') = 'array'
+       AND COALESCE(config->'capabilityBundleIds', '[]'::jsonb) ? $2
+       LIMIT 1`,
+      [tenantId, bundleId]
     );
-    return result.rowCount !== null && result.rowCount > 0;
+    return result.rows.length > 0;
   }
 };
 
@@ -4857,6 +5033,10 @@ var PostgreSQLEvalStore = class {
 // src/stores/ThreadMessageQueueStore.ts
 import { Pool as Pool13 } from "pg";
 import crypto from "crypto";
+import {
+  parseQueuedExecutionMode,
+  parseTrustedRunContext
+} from "@axiom-lattice/protocols";
 
 // src/migrations/thread_message_queue_migrations.ts
 var createThreadMessageQueueTable = {
@@ -4993,6 +5173,23 @@ var addWorkspaceProjectToQueue = {
   }
 };
 
+// src/migrations/add_trusted_run_context_column.ts
+var addTrustedRunContextColumn = {
+  version: 173,
+  name: "add_thread_queue_trusted_run_context",
+  up: async (client) => {
+    await client.query(`ALTER TABLE lattice_thread_message_queue
+      ADD COLUMN IF NOT EXISTS trusted_run_context JSONB,
+      ADD COLUMN IF NOT EXISTS execution_mode VARCHAR(20)
+        CHECK (execution_mode IS NULL OR execution_mode = 'followup')`);
+  },
+  down: async (client) => {
+    await client.query(`ALTER TABLE lattice_thread_message_queue
+      DROP COLUMN IF EXISTS execution_mode,
+      DROP COLUMN IF EXISTS trusted_run_context`);
+  }
+};
+
 // src/stores/ThreadMessageQueueStore.ts
 var ThreadMessageQueueStore = class {
   constructor(options) {
@@ -5018,6 +5215,7 @@ var ThreadMessageQueueStore = class {
     this.migrationManager.register(addCustomRunConfigColumn);
     this.migrationManager.register(alterMessageQueueIdColumn);
     this.migrationManager.register(addWorkspaceProjectToQueue);
+    this.migrationManager.register(addTrustedRunContextColumn);
     if (options.autoMigrate !== false) {
       this.initialize().catch((error) => {
         console.error("Failed to initialize ThreadMessageQueueStore:", error);
@@ -5047,6 +5245,7 @@ var ThreadMessageQueueStore = class {
    * Add message to queue
    */
   async addMessage(params) {
+    const trusted = validateQueueTrust(params);
     const { threadId, tenantId, assistantId, workspaceId, projectId, content, type = "human", priority = 0, command, custom_run_config, id } = params;
     const seqResult = await this.pool.query(
       `SELECT COALESCE(MAX(sequence_order), 0) + 1 as next_seq
@@ -5057,18 +5256,58 @@ var ThreadMessageQueueStore = class {
     const nextSeq = seqResult.rows[0].next_seq;
     const result = await this.pool.query(
       `INSERT INTO lattice_thread_message_queue 
-       (id, thread_id, tenant_id, assistant_id, workspace_id, project_id, message_content, message_type, sequence_order, priority, command, custom_run_config)
-       VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12)
+       (id, thread_id, tenant_id, assistant_id, workspace_id, project_id, message_content, message_type, sequence_order, priority, command, custom_run_config, trusted_run_context, execution_mode)
+       VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14)
        RETURNING *`,
-      [id || crypto.randomUUID(), threadId, tenantId, assistantId, workspaceId || null, projectId || null, JSON.stringify(content), type, nextSeq, priority, command ? JSON.stringify(command) : null, custom_run_config ? JSON.stringify(custom_run_config) : null]
+      [id || crypto.randomUUID(), threadId, tenantId, assistantId, workspaceId ?? null, projectId ?? null, JSON.stringify(content), type, nextSeq, priority, command ? JSON.stringify(command) : null, custom_run_config ? JSON.stringify(custom_run_config) : null, trusted.trustedRunContext ? JSON.stringify(trusted.trustedRunContext) : null, trusted.executionMode ?? null]
     );
     return this.rowToMessage(result.rows[0]);
   }
+  async addMessageIfCapacity(params, maxSize) {
+    const trusted = validateQueueTrust(params);
+    if (maxSize === Infinity) {
+      await this.addMessage(params);
+      return true;
+    }
+    const client = await this.pool.connect();
+    try {
+      await client.query("BEGIN");
+      const scope = { tenantId: params.tenantId, assistantId: params.assistantId, workspaceId: params.workspaceId, projectId: params.projectId };
+      const lockKey = `${params.tenantId}:${params.assistantId}:${params.threadId}:${params.workspaceId ?? ""}:${params.projectId ?? ""}`;
+      await client.query("SELECT pg_advisory_xact_lock(hashtext($1))", [lockKey]);
+      const filter = scopeClause(scope, 2);
+      const count = await client.query(
+        `SELECT COUNT(*) as count FROM lattice_thread_message_queue WHERE thread_id = $1 AND status = 'pending'${filter.sql}`,
+        [params.threadId, ...filter.params]
+      );
+      if (parseInt(count.rows[0].count, 10) >= maxSize) {
+        await client.query("ROLLBACK");
+        return false;
+      }
+      const seq = await client.query(
+        `SELECT COALESCE(MAX(sequence_order), 0) + 1 as next_seq FROM lattice_thread_message_queue WHERE thread_id = $1`,
+        [params.threadId]
+      );
+      const result = await client.query(
+        `INSERT INTO lattice_thread_message_queue (id, thread_id, tenant_id, assistant_id, workspace_id, project_id, message_content, message_type, sequence_order, priority, command, custom_run_config, trusted_run_context, execution_mode)
+         VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14) RETURNING *`,
+        [params.id || crypto.randomUUID(), params.threadId, params.tenantId, params.assistantId, params.workspaceId ?? null, params.projectId ?? null, JSON.stringify(params.content), params.type || "human", seq.rows[0].next_seq, params.priority ?? 0, params.command ? JSON.stringify(params.command) : null, params.custom_run_config ? JSON.stringify(params.custom_run_config) : null, trusted.trustedRunContext ? JSON.stringify(trusted.trustedRunContext) : null, trusted.executionMode ?? null]
+      );
+      await client.query("COMMIT");
+      return Boolean(result.rows[0]);
+    } catch (error) {
+      await client.query("ROLLBACK");
+      throw error;
+    } finally {
+      client.release();
+    }
+  }
   /**
    * Add message at head of queue (high priority, e.g., STEER/Command messages)
    * Uses priority=100 to ensure message is processed first
    */
   async addMessageAtHead(params) {
+    const trusted = validateQueueTrust(params);
     const { threadId, tenantId, assistantId, workspaceId, projectId, content, type = "human", command, custom_run_config, id } = params;
     const resolvedTenantId = tenantId;
     const resolvedAssistantId = assistantId;
@@ -5081,45 +5320,48 @@ var ThreadMessageQueueStore = class {
     const nextSeq = seqResult.rows[0].next_seq;
     const result = await this.pool.query(
       `INSERT INTO lattice_thread_message_queue 
-       (id, thread_id, tenant_id, assistant_id, workspace_id, project_id, message_content, message_type, sequence_order, priority, command, custom_run_config)
-       VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, 100, $10, $11)
+       (id, thread_id, tenant_id, assistant_id, workspace_id, project_id, message_content, message_type, sequence_order, priority, command, custom_run_config, trusted_run_context, execution_mode)
+       VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, 100, $10, $11, $12, $13)
        RETURNING *`,
-      [id || crypto.randomUUID(), threadId, resolvedTenantId, resolvedAssistantId, workspaceId || null, projectId || null, JSON.stringify(content), type, nextSeq, command ? JSON.stringify(command) : null, custom_run_config ? JSON.stringify(custom_run_config) : null]
+      [id || crypto.randomUUID(), threadId, resolvedTenantId, resolvedAssistantId, workspaceId ?? null, projectId ?? null, JSON.stringify(content), type, nextSeq, command ? JSON.stringify(command) : null, custom_run_config ? JSON.stringify(custom_run_config) : null, trusted.trustedRunContext ? JSON.stringify(trusted.trustedRunContext) : null, trusted.executionMode ?? null]
     );
     return this.rowToMessage(result.rows[0]);
   }
   /**
    * Get pending messages for thread
    */
-  async getPendingMessages(threadId) {
+  async getPendingMessages(threadId, scope) {
+    const filter = scopeClause(scope, 2);
     const result = await this.pool.query(
-      `SELECT * FROM lattice_thread_message_queue 
-       WHERE thread_id = $1 AND status = 'pending'
+      `SELECT * FROM lattice_thread_message_queue
+        WHERE thread_id = $1 AND status = 'pending'${filter.sql}
        ORDER BY priority DESC, sequence_order ASC`,
-      [threadId]
+      [threadId, ...filter.params]
     );
     return result.rows.map((row) => this.rowToMessage(row));
   }
   /**
    * Get processing messages for a thread
    */
-  async getProcessingMessages(threadId) {
+  async getProcessingMessages(threadId, scope) {
+    const filter = scopeClause(scope, 2);
     const result = await this.pool.query(
       `SELECT * FROM lattice_thread_message_queue 
-       WHERE thread_id = $1 AND status = 'processing'
+        WHERE thread_id = $1 AND status = 'processing'${filter.sql}
        ORDER BY priority DESC, sequence_order ASC`,
-      [threadId]
+      [threadId, ...filter.params]
     );
     return result.rows.map((row) => this.rowToMessage(row));
   }
   /**
    * Get queue size
    */
-  async getQueueSize(threadId) {
+  async getQueueSize(threadId, scope) {
+    const filter = scopeClause(scope, 2);
     const result = await this.pool.query(
       `SELECT COUNT(*) as count FROM lattice_thread_message_queue 
-       WHERE thread_id = $1 AND status = 'pending'`,
-      [threadId]
+        WHERE thread_id = $1 AND status = 'pending'${filter.sql}`,
+      [threadId, ...filter.params]
     );
     return parseInt(result.rows[0].count, 10);
   }
@@ -5128,58 +5370,70 @@ var ThreadMessageQueueStore = class {
    */
   async getThreadsWithPendingMessages() {
     const result = await this.pool.query(
-      `SELECT DISTINCT ON (thread_id) tenant_id, assistant_id, thread_id, workspace_id, project_id
+      `SELECT DISTINCT ON (tenant_id, assistant_id, workspace_id, project_id, thread_id) tenant_id, assistant_id, thread_id, workspace_id, project_id
        FROM lattice_thread_message_queue 
        WHERE status IN ('pending', 'processing')
-       ORDER BY thread_id`
+        ORDER BY tenant_id, assistant_id, workspace_id, project_id, thread_id`
     );
     return result.rows.map((row) => ({
       tenantId: row.tenant_id,
       assistantId: row.assistant_id,
       threadId: row.thread_id,
-      workspaceId: row.workspace_id || void 0,
-      projectId: row.project_id || void 0
+      workspaceId: row.workspace_id,
+      projectId: row.project_id
     }));
   }
   /**
    * Remove message
    */
-  async removeMessage(messageId) {
+  async removeMessage(messageId, scope) {
+    const filter = scopeClause(scope, 2);
     const result = await this.pool.query(
-      `DELETE FROM lattice_thread_message_queue WHERE id = $1 RETURNING id`,
-      [messageId]
+      `DELETE FROM lattice_thread_message_queue WHERE id = $1${filter.sql} RETURNING id`,
+      [messageId, ...filter.params]
     );
     return (result.rowCount ?? 0) > 0;
   }
   /**
    * Clear all messages for thread
    */
-  async clearMessages(threadId) {
+  async clearMessages(threadId, scope) {
+    const filter = scopeClause(scope, 2);
     await this.pool.query(
-      `DELETE FROM lattice_thread_message_queue WHERE thread_id = $1`,
-      [threadId]
+      `DELETE FROM lattice_thread_message_queue WHERE thread_id = $1${filter.sql}`,
+      [threadId, ...filter.params]
     );
   }
   /**
    * Mark message as processing
    */
-  async markProcessing(messageId) {
+  async markProcessing(messageId, customRunConfig, scope) {
+    if (customRunConfig !== void 0) {
+      const filter2 = scopeClause(scope, 3);
+      await this.pool.query(
+        `UPDATE lattice_thread_message_queue SET status = 'processing', custom_run_config = $2 WHERE id = $1${filter2.sql}`,
+        [messageId, JSON.stringify(customRunConfig), ...filter2.params]
+      );
+      return;
+    }
+    const filter = scopeClause(scope, 2);
     await this.pool.query(
-      `UPDATE lattice_thread_message_queue SET status = 'processing' WHERE id = $1`,
-      [messageId]
+      `UPDATE lattice_thread_message_queue SET status = 'processing' WHERE id = $1${filter.sql}`,
+      [messageId, ...filter.params]
     );
   }
   /**
    * Reset all processing messages to pending state for a thread
    * Returns the number of messages reset
    */
-  async resetProcessingToPending(threadId) {
+  async resetProcessingToPending(threadId, scope) {
+    const filter = scopeClause(scope, 2);
     const result = await this.pool.query(
       `UPDATE lattice_thread_message_queue 
        SET status = 'pending'
-       WHERE thread_id = $1 AND status = 'processing'
+        WHERE thread_id = $1 AND status = 'processing'${filter.sql}
        RETURNING id`,
-      [threadId]
+      [threadId, ...filter.params]
     );
     return result.rowCount ?? 0;
   }
@@ -5192,13 +5446,36 @@ var ThreadMessageQueueStore = class {
       createdAt: new Date(row.created_at),
       priority: row.priority || 0,
       command: row.command ? typeof row.command === "string" ? JSON.parse(row.command) : row.command : void 0,
-      custom_run_config: row.custom_run_config ? typeof row.custom_run_config === "string" ? JSON.parse(row.custom_run_config) : row.custom_run_config : void 0
+      custom_run_config: row.custom_run_config ? typeof row.custom_run_config === "string" ? JSON.parse(row.custom_run_config) : row.custom_run_config : void 0,
+      trusted_run_context: row.trusted_run_context ? parseTrustedRunContext(typeof row.trusted_run_context === "string" ? JSON.parse(row.trusted_run_context) : row.trusted_run_context) : void 0,
+      execution_mode: row.execution_mode == null ? void 0 : parseQueuedExecutionMode(row.execution_mode)
     };
   }
 };
+function validateQueueTrust(params) {
+  return {
+    trustedRunContext: params.trusted_run_context === void 0 ? void 0 : parseTrustedRunContext(params.trusted_run_context),
+    executionMode: params.execution_mode === void 0 ? void 0 : parseQueuedExecutionMode(params.execution_mode)
+  };
+}
+function scopeClause(scope, start) {
+  if (!scope) return { sql: "", params: [] };
+  const params = [];
+  const entries = ["tenantId", "assistantId", "workspaceId", "projectId"].map((key) => [key, scope[key]]);
+  const sql = entries.map(([key, value]) => {
+    const column = key.replace(/[A-Z]/g, (letter) => `_${letter.toLowerCase()}`);
+    if (value == null) return ` AND ${column} IS NULL`;
+    params.push(value);
+    return ` AND ${column} = $${start + params.length - 1}`;
+  }).join("");
+  return { sql, params };
+}
 
 // src/stores/ChannelBindingStore.ts
 import { Pool as Pool14 } from "pg";
+import {
+  DuplicateChannelBindingSubjectError
+} from "@axiom-lattice/protocols";
 
 // src/migrations/channel_bindings_migration.ts
 var createChannelBindingsTable = {
@@ -5246,6 +5523,7 @@ var createChannelBindingsTable = {
 };
 
 // src/stores/ChannelBindingStore.ts
+var BINDING_SUBJECT_CONSTRAINT = "lattice_channel_bindings_channel_channel_installation_id_te_key";
 var ChannelBindingStore = class {
   constructor(options) {
     this.initialized = false;
@@ -5302,80 +5580,91 @@ var ChannelBindingStore = class {
     if (result.rows.length === 0) return null;
     return this.mapRowToBinding(result.rows[0]);
   }
-  async create(input) {
+  async findById(tenantId, id) {
     await this.ensureInitialized();
     const result = await this.pool.query(
-      `INSERT INTO lattice_channel_bindings
-         (channel, channel_installation_id, tenant_id, sender_id, agent_id,
-          thread_mode, sender_display_name, sender_metadata, workspace_id, project_id)
-       VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10)
-       RETURNING *`,
-      [
-        input.channel,
-        input.channelInstallationId,
-        input.tenantId,
-        input.senderId,
-        input.agentId,
-        input.threadMode || "fixed",
-        input.senderDisplayName || null,
-        input.senderMetadata ? JSON.stringify(input.senderMetadata) : null,
-        input.workspaceId || null,
-        input.projectId || null
-      ]
+      "SELECT * FROM lattice_channel_bindings WHERE id = $1 AND tenant_id = $2",
+      [id, tenantId]
     );
-    return this.mapRowToBinding(result.rows[0]);
+    return result.rows[0] ? this.mapRowToBinding(result.rows[0]) : null;
   }
-  async update(id, patch) {
+  async findBySubject(params) {
     await this.ensureInitialized();
-    const existing = await this.pool.query(
-      `SELECT * FROM lattice_channel_bindings WHERE id = $1`,
-      [id]
+    const result = await this.pool.query(
+      `SELECT * FROM lattice_channel_bindings
+      WHERE tenant_id = $1 AND channel = $2 AND channel_installation_id = $3 AND sender_id = $4 LIMIT 1`,
+      [params.tenantId, params.channel, params.channelInstallationId, params.senderId]
     );
-    if (existing.rows.length === 0) {
-      throw new Error(`Binding ${id} not found`);
+    return result.rows[0] ? this.mapRowToBinding(result.rows[0]) : null;
+  }
+  async create(input) {
+    await this.ensureInitialized();
+    try {
+      const result = await this.pool.query(
+        `INSERT INTO lattice_channel_bindings
+         (channel, channel_installation_id, tenant_id, sender_id, agent_id,
+            thread_id, thread_mode, sender_display_name, sender_metadata, workspace_id, project_id, enabled)
+         VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12)
+       RETURNING *`,
+        [
+          input.channel,
+          input.channelInstallationId,
+          input.tenantId,
+          input.senderId,
+          input.agentId,
+          input.threadId || null,
+          input.threadMode || "fixed",
+          input.senderDisplayName || null,
+          input.senderMetadata ? JSON.stringify(input.senderMetadata) : null,
+          input.workspaceId || null,
+          input.projectId || null,
+          input.enabled ?? true
+        ]
+      );
+      return this.mapRowToBinding(result.rows[0]);
+    } catch (error) {
+      if (isBindingSubjectConflict(error)) {
+        throw new DuplicateChannelBindingSubjectError();
+      }
+      throw error;
     }
-    const row = existing.rows[0];
-    const updated = {
-      channel: patch.channel ?? row.channel,
-      channel_installation_id: patch.channelInstallationId ?? row.channel_installation_id,
-      sender_id: patch.senderId ?? row.sender_id,
-      agent_id: patch.agentId ?? row.agent_id,
-      thread_id: patch.threadId !== void 0 ? patch.threadId : row.thread_id,
-      workspace_id: patch.workspaceId !== void 0 ? patch.workspaceId : row.workspace_id,
-      project_id: patch.projectId !== void 0 ? patch.projectId : row.project_id,
-      thread_mode: patch.threadMode ?? row.thread_mode,
-      sender_display_name: patch.senderDisplayName !== void 0 ? patch.senderDisplayName : row.sender_display_name,
-      sender_metadata: patch.senderMetadata !== void 0 ? patch.senderMetadata : row.sender_metadata,
-      enabled: patch.enabled ?? row.enabled
-    };
+  }
+  async update(tenantId, id, patch) {
+    await this.ensureInitialized();
     const result = await this.pool.query(
       `UPDATE lattice_channel_bindings SET
-         channel = $1, channel_installation_id = $2, sender_id = $3,
-         agent_id = $4, thread_id = $5, workspace_id = $6, project_id = $7,
-         thread_mode = $8, sender_display_name = $9, sender_metadata = $10,
-         enabled = $11, updated_at = NOW()
-       WHERE id = $12
+         agent_id = COALESCE($1, agent_id),
+         thread_id = COALESCE($2, thread_id),
+         workspace_id = COALESCE($3, workspace_id),
+         project_id = COALESCE($4, project_id),
+         thread_mode = COALESCE($5, thread_mode),
+         sender_display_name = COALESCE($6, sender_display_name),
+         sender_metadata = COALESCE($7, sender_metadata),
+         enabled = COALESCE($8, enabled), updated_at = NOW()
+       WHERE id = $9 AND tenant_id = $10
        RETURNING *`,
       [
-        updated.channel,
-        updated.channel_installation_id,
-        updated.sender_id,
-        updated.agent_id,
-        updated.thread_id,
-        updated.workspace_id,
-        updated.project_id,
-        updated.thread_mode,
-        updated.sender_display_name,
-        updated.sender_metadata ? JSON.stringify(updated.sender_metadata) : null,
-        updated.enabled,
-        id
+        patch.agentId ?? null,
+        patch.threadId ?? null,
+        patch.workspaceId ?? null,
+        patch.projectId ?? null,
+        patch.threadMode ?? null,
+        patch.senderDisplayName ?? null,
+        patch.senderMetadata ? JSON.stringify(patch.senderMetadata) : null,
+        patch.enabled ?? null,
+        id,
+        tenantId
       ]
     );
+    if (!result.rows[0]) throw new Error(`Binding ${id} not found`);
     return this.mapRowToBinding(result.rows[0]);
   }
-  async delete(id) {
+  async delete(tenantId, id) {
     await this.ensureInitialized();
-    await this.pool.query(`DELETE FROM lattice_channel_bindings WHERE id = $1`, [id]);
+    await this.pool.query(
+      `DELETE FROM lattice_channel_bindings WHERE id = $1 AND tenant_id = $2`,
+      [id, tenantId]
+    );
   }
   async list(params) {
     await this.ensureInitialized();
@@ -5394,6 +5683,14 @@ var ChannelBindingStore = class {
       conditions.push(`channel_installation_id = $${idx++}`);
       values.push(params.channelInstallationId);
     }
+    if (params.excludeChannels?.length) {
+      conditions.push(`channel <> ALL($${idx++}::text[])`);
+      values.push(params.excludeChannels);
+    }
+    for (const prefix of params.excludeInstallationIdPrefixes ?? []) {
+      conditions.push(`channel_installation_id NOT LIKE $${idx++} ESCAPE '\\'`);
+      values.push(`${escapeLikePattern(prefix)}%`);
+    }
     const limit = params.limit ?? 50;
     const offset = params.offset ?? 0;
     values.push(limit, offset);
@@ -5406,7 +5703,16 @@ var ChannelBindingStore = class {
     );
     return result.rows.map((r) => this.mapRowToBinding(r));
   }
-  async import(bindings) {
+  async import(tenantId, bindings) {
+    if (bindings.some((binding) => binding.channel === "room")) {
+      throw new Error("Room bindings cannot be imported through the public store API");
+    }
+    if (bindings.some((binding) => binding.channelInstallationId.startsWith("room-internal:"))) {
+      throw new Error("Internal bindings cannot be imported through the public store API");
+    }
+    if (bindings.some((binding) => binding.tenantId !== tenantId)) {
+      throw new Error("Binding import tenant mismatch");
+    }
     const result = [];
     for (const input of bindings) {
       result.push(await this.create(input));
@@ -5414,7 +5720,13 @@ var ChannelBindingStore = class {
     return result;
   }
   async export(params) {
-    return this.list({ tenantId: params.tenantId, limit: 1e4, offset: 0 });
+    return this.list({
+      tenantId: params.tenantId,
+      excludeChannels: ["room"],
+      excludeInstallationIdPrefixes: ["room-internal:"],
+      limit: 1e4,
+      offset: 0
+    });
   }
   async ensureInitialized() {
     if (!this.initialized) {
@@ -5441,6 +5753,14 @@ var ChannelBindingStore = class {
     };
   }
 };
+function isBindingSubjectConflict(error) {
+  if (typeof error !== "object" || error === null) return false;
+  const pgError = error;
+  return pgError.code === "23505" && pgError.constraint === BINDING_SUBJECT_CONSTRAINT;
+}
+function escapeLikePattern(value) {
+  return value.replace(/\\/g, "\\\\").replace(/%/g, "\\%").replace(/_/g, "\\_");
+}
 
 // src/stores/PostgreSQLChannelInstallationStore.ts
 import { Pool as Pool15 } from "pg";
@@ -5615,7 +5935,8 @@ var PostgreSQLChannelInstallationStore = class {
   async createInstallation(tenantId, installationId, data) {
     await this.ensureInitialized();
     const now = /* @__PURE__ */ new Date();
-    const encryptedConfig = this.encryptSecrets(data.config);
+    const config = { ...data.config };
+    const encryptedConfig = this.encryptSecrets(config);
     await this.pool.query(
       `
       INSERT INTO lattice_channel_installations (
@@ -5640,7 +5961,7 @@ var PostgreSQLChannelInstallationStore = class {
       tenantId,
       channel: data.channel,
       name: data.name,
-      config: data.config,
+      config,
       enabled: data.enabled ?? true,
       fallbackAgentId: data.fallbackAgentId,
       rejectWhenNoBinding: data.rejectWhenNoBinding ?? true,
@@ -5727,17 +6048,17 @@ var PostgreSQLChannelInstallationStore = class {
   encryptSecrets(config) {
     return {
       ...config,
-      appSecret: typeof config.appSecret === "string" ? encrypt4(config.appSecret) : config.appSecret,
-      verificationToken: typeof config.verificationToken === "string" ? encrypt4(config.verificationToken) : config.verificationToken,
-      encryptKey: typeof config.encryptKey === "string" ? encrypt4(config.encryptKey) : config.encryptKey
+      ...typeof config.appSecret === "string" ? { appSecret: encrypt4(config.appSecret) } : {},
+      ...typeof config.verificationToken === "string" ? { verificationToken: encrypt4(config.verificationToken) } : {},
+      ...typeof config.encryptKey === "string" ? { encryptKey: encrypt4(config.encryptKey) } : {}
     };
   }
   decryptSecrets(config) {
     return {
       ...config,
-      appSecret: typeof config.appSecret === "string" ? decrypt4(config.appSecret) : config.appSecret,
-      verificationToken: typeof config.verificationToken === "string" ? decrypt4(config.verificationToken) : config.verificationToken,
-      encryptKey: typeof config.encryptKey === "string" ? decrypt4(config.encryptKey) : config.encryptKey
+      ...typeof config.appSecret === "string" ? { appSecret: decrypt4(config.appSecret) } : {},
+      ...typeof config.verificationToken === "string" ? { verificationToken: decrypt4(config.verificationToken) } : {},
+      ...typeof config.encryptKey === "string" ? { encryptKey: decrypt4(config.encryptKey) } : {}
     };
   }
 };
@@ -5946,17 +6267,17 @@ var PostgreSQLA2AApiKeyStore = class {
     const result = await this.pool.query(
       `SELECT * FROM lattice_a2a_api_keys WHERE enabled = true`
     );
-    const map = /* @__PURE__ */ new Map();
+    const map2 = /* @__PURE__ */ new Map();
     for (const row of result.rows) {
       const key = decrypt5(row.key_value);
-      map.set(key, {
+      map2.set(key, {
         key,
         tenantId: row.tenant_id,
         projectId: row.project_id,
         assistantIds: row.assistant_ids ?? void 0
       });
     }
-    return map;
+    return map2;
   }
 };
 
@@ -6892,15 +7213,37 @@ var addFilesToTasks = {
     `);
   }
 };
+var addTaskDependenciesGinIndex = {
+  version: 174,
+  name: "add_task_dependencies_gin_index",
+  up: async (client) => {
+    await client.query(`CREATE INDEX IF NOT EXISTS idx_lattice_tasks_dependencies_gin
+      ON lattice_tasks USING GIN (dependencies jsonb_path_ops)
+      WHERE dependencies IS NOT NULL`);
+  },
+  down: async (client) => {
+    await client.query("DROP INDEX IF EXISTS idx_lattice_tasks_dependencies_gin");
+  }
+};
 var taskMigrations = [
   createTasksTable,
   addTaskFieldsMigration,
   addTaskProjectFieldsMigration,
-  addFilesToTasks
+  addFilesToTasks,
+  addTaskDependenciesGinIndex
 ];
 
 // src/stores/PostgreSQLTaskStore.ts
 import { v4 as uuidv42 } from "uuid";
+var TASK_STATUSES = /* @__PURE__ */ new Set([
+  "pending",
+  "in_progress",
+  "review",
+  "failed",
+  "interrupted",
+  "completed",
+  "cancelled"
+]);
 function nextUpdatedAtSql(column = "updated_at") {
   return `to_char(
     date_trunc('milliseconds', GREATEST(
@@ -6980,6 +7323,9 @@ function mapRowToTask(row) {
     updatedAt: new Date(row.updated_at)
   };
 }
+function assertPage(limit, offset = 0) {
+  if (!Number.isSafeInteger(limit) || limit < 1 || limit > 100 || !Number.isSafeInteger(offset) || offset < 0) throw new RangeError("Invalid task page");
+}
 var PostgreSQLTaskStore = class {
   constructor(options) {
     this.initialized = false;
@@ -7003,6 +7349,7 @@ var PostgreSQLTaskStore = class {
     this.migrationManager.register(addTaskFieldsMigration);
     this.migrationManager.register(addTaskProjectFieldsMigration);
     this.migrationManager.register(addFilesToTasks);
+    this.migrationManager.register(addTaskDependenciesGinIndex);
     if (options.autoMigrate !== false) {
       this.initialize().catch((error) => {
         console.error("Failed to initialize PostgreSQLTaskStore:", error);
@@ -7098,7 +7445,9 @@ var PostgreSQLTaskStore = class {
       conditions.push(`workspace_id = $${paramIndex++}`);
       params.push(filter.workspaceId);
     }
-    if (filter.projectId) {
+    if (filter.projectId === null) {
+      conditions.push("(project_id IS NULL OR project_id = '' OR project_id = 'default')");
+    } else if (filter.projectId !== void 0) {
       conditions.push(`project_id = $${paramIndex++}`);
       params.push(filter.projectId);
     }
@@ -7123,11 +7472,35 @@ var PostgreSQLTaskStore = class {
     const limit = filter.limit || 100;
     const offset = filter.offset || 0;
     const result = await this.pool.query(
-      `SELECT * FROM lattice_tasks WHERE ${where} ORDER BY created_at DESC LIMIT $${paramIndex++} OFFSET $${paramIndex++}`,
+      `SELECT * FROM lattice_tasks WHERE ${where} ORDER BY created_at DESC, id DESC LIMIT $${paramIndex++} OFFSET $${paramIndex++}`,
       [...params, limit, offset]
     );
     return result.rows.map((r) => mapRowToTask(r));
   }
+  /** Lists exact project tasks containing a JSON string dependency. */
+  async listDependents(query) {
+    assertPage(query.limit, query.offset);
+    if (query.statuses.length === 0 || query.statuses.some((status) => !TASK_STATUSES.has(status))) {
+      throw new RangeError("Invalid task statuses");
+    }
+    await this.ensureInitialized();
+    const result = await this.pool.query(
+      `SELECT * FROM lattice_tasks
+       WHERE tenant_id=$1 AND workspace_id=$2 AND project_id=$3
+         AND dependencies @> $4::jsonb AND status = ANY($5::text[])
+       ORDER BY created_at DESC, id DESC LIMIT $6 OFFSET $7`,
+      [
+        query.tenantId,
+        query.workspaceId,
+        query.projectId,
+        JSON.stringify([query.dependencyTaskId]),
+        query.statuses,
+        query.limit,
+        query.offset
+      ]
+    );
+    return result.rows.map(mapRowToTask);
+  }
   async update(tenantId, id, updates) {
     await this.ensureInitialized();
     const existing = await this.getById(tenantId, id);
@@ -7498,6 +7871,63 @@ var PostgreSQLTaskStore = class {
     );
     return result.rows[0] ? mapRowToTask(result.rows[0]) : null;
   }
+  /** Atomically update only while status, timestamp, owner, and Project scope match. */
+  async updateIfSnapshot(tenantId, id, updates, snapshot) {
+    await this.ensureInitialized();
+    const setClauses = [];
+    const params = [];
+    let index = 1;
+    const fields = [
+      ["title", "title"],
+      ["description", "description"],
+      ["status", "status"],
+      ["priority", "priority"],
+      ["dueDate", "due_date"],
+      ["metadata", "metadata", true],
+      ["files", "files", true],
+      ["parentId", "parent_id"],
+      ["sourceId", "source_id"],
+      ["context", "context", true],
+      ["ownerType", "owner_type"],
+      ["ownerId", "owner_id"],
+      ["requireReview", "require_review"],
+      ["dependencies", "dependencies", true],
+      ["result", "result"],
+      ["failureReason", "failure_reason"],
+      ["workspaceId", "workspace_id"],
+      ["projectId", "project_id"]
+    ];
+    for (const [field, column, json] of fields) {
+      const value = updates[field];
+      if (value === void 0) continue;
+      setClauses.push(`${column} = $${index++}`);
+      params.push(json && value !== null ? JSON.stringify(value) : value);
+    }
+    if (setClauses.length === 0) return this.getById(tenantId, id);
+    setClauses.push(`updated_at = ${nextUpdatedAtSql()}`);
+    const predicates = [
+      tenantId,
+      id,
+      snapshot.status,
+      new Date(snapshot.updatedAt).toISOString(),
+      snapshot.ownerType,
+      snapshot.ownerId,
+      snapshot.workspaceId,
+      snapshot.projectId
+    ];
+    const placeholders = predicates.map(() => `$${index++}`);
+    params.push(...predicates);
+    const result = await this.pool.query(
+      `UPDATE lattice_tasks SET ${setClauses.join(", ")}
+       WHERE tenant_id = ${placeholders[0]} AND id = ${placeholders[1]} AND status = ${placeholders[2]}
+         AND ${canonicalTimestampSnapshotSql("updated_at", placeholders[3])}
+          AND owner_type = ${placeholders[4]} AND owner_id = ${placeholders[5]}
+          AND workspace_id IS NOT DISTINCT FROM ${placeholders[6]}
+          AND project_id IS NOT DISTINCT FROM ${placeholders[7]} RETURNING *`,
+      params
+    );
+    return result.rows[0] ? mapRowToTask(result.rows[0]) : null;
+  }
   /** Atomically update a child only when both child and parent snapshots match. */
   async updateIfStatusUpdatedAtAndParentUpdatedAt(tenantId, id, updates, expectedStatuses, expectedUpdatedAt, parentId, expectedParentUpdatedAt) {
     await this.ensureInitialized();
@@ -7616,6 +8046,27 @@ var PostgreSQLTaskStore = class {
     );
     return (result.rowCount ?? 0) > 0;
   }
+  /** Atomically delete only while status, timestamp, owner, and Project scope match. */
+  async deleteIfSnapshot(tenantId, id, snapshot) {
+    await this.ensureInitialized();
+    const result = await this.pool.query(
+      `DELETE FROM lattice_tasks WHERE tenant_id = $1 AND id = $2 AND status = $3
+       AND ${canonicalTimestampSnapshotSql("updated_at", "$4")}
+        AND owner_type = $5 AND owner_id = $6
+        AND workspace_id IS NOT DISTINCT FROM $7 AND project_id IS NOT DISTINCT FROM $8`,
+      [
+        tenantId,
+        id,
+        snapshot.status,
+        new Date(snapshot.updatedAt).toISOString(),
+        snapshot.ownerType,
+        snapshot.ownerId,
+        snapshot.workspaceId,
+        snapshot.projectId
+      ]
+    );
+    return (result.rowCount ?? 0) > 0;
+  }
   async dispose() {
     if (this.ownsPool && this.pool) {
       await this.pool.end();
@@ -7629,17 +8080,175 @@ var PostgreSQLTaskStore = class {
 };
 
 // src/stores/PostgreSQLTaskWorkItemStore.ts
+import { Pool as Pool20 } from "pg";
+import { MAX_PENDING_EXECUTION_RESULTS_LIMIT } from "@axiom-lattice/protocols";
 import { v4 } from "uuid";
-var PostgreSQLTaskWorkItemStore = class {
-  constructor(pool) {
-    this.pool = pool;
+
+// src/migrations/task_work_items_migration.ts
+var createTaskWorkItemsMigration = {
+  version: 138,
+  name: "create_task_work_items_table",
+  up: async (client) => {
+    await client.query(`
+      CREATE TABLE IF NOT EXISTS lattice_task_work_items (
+        id TEXT NOT NULL,
+        tenant_id TEXT NOT NULL,
+        task_id TEXT NOT NULL,
+        action TEXT NOT NULL,
+        actor TEXT NOT NULL,
+        thread_id TEXT,
+        summary TEXT,
+        detail JSONB,
+        attempt INTEGER,
+        created_at TIMESTAMPTZ NOT NULL DEFAULT date_trunc('milliseconds', clock_timestamp()),
+        PRIMARY KEY (tenant_id, id)
+      )
+    `);
+    await client.query(`
+      CREATE INDEX IF NOT EXISTS idx_task_work_items_task_id
+        ON lattice_task_work_items (tenant_id, task_id)
+    `);
+    await client.query(`
+      CREATE INDEX IF NOT EXISTS idx_task_work_items_action
+        ON lattice_task_work_items (tenant_id, task_id, action)
+    `);
+  }
+};
+var addWorkItemProjectFieldsMigration = {
+  version: 140,
+  name: "add_task_work_item_project_fields",
+  up: async (client) => {
+    await client.query(`
+      ALTER TABLE lattice_task_work_items
+        ADD COLUMN IF NOT EXISTS workspace_id TEXT,
+        ADD COLUMN IF NOT EXISTS project_id TEXT
+    `);
+    await client.query(`
+      CREATE INDEX IF NOT EXISTS idx_task_work_items_project
+        ON lattice_task_work_items (tenant_id, project_id)
+    `);
+  }
+};
+var addTaskWorkItemEventKeyMigration = {
+  version: 168,
+  name: "add_task_work_item_event_key",
+  up: async (client) => {
+    await client.query(`
+      ALTER TABLE lattice_task_work_items
+        ADD COLUMN IF NOT EXISTS event_key TEXT
+    `);
+    await client.query(`
+      CREATE UNIQUE INDEX IF NOT EXISTS idx_task_work_items_event_key
+        ON lattice_task_work_items (tenant_id, task_id, event_key) WHERE event_key IS NOT NULL
+    `);
+  }
+};
+var addTaskWorkItemPendingIndexesMigration = {
+  version: 171,
+  name: "add_task_work_item_pending_indexes",
+  up: async (client) => {
+    await client.query(`
+      CREATE INDEX IF NOT EXISTS idx_task_work_items_pending_order
+        ON lattice_task_work_items (tenant_id, task_id, action, created_at DESC, id DESC)
+    `);
+    await client.query(`
+      CREATE INDEX IF NOT EXISTS idx_task_work_items_reconciled_result
+        ON lattice_task_work_items (tenant_id, task_id, (detail ->> 'executionResultId'))
+        WHERE action = 'execution_reconciled'
+    `);
+  }
+};
+var addProjectLifecycleEventIndex = {
+  version: 175,
+  name: "add_project_lifecycle_event_index",
+  up: async (client) => {
+    await client.query(`UPDATE lattice_task_work_items
+      SET created_at = date_trunc('milliseconds', created_at)
+      WHERE created_at <> date_trunc('milliseconds', created_at)`);
+    await client.query(`ALTER TABLE lattice_task_work_items
+      ALTER COLUMN created_at SET DEFAULT date_trunc('milliseconds', clock_timestamp())`);
+    await client.query(`CREATE INDEX IF NOT EXISTS idx_task_work_items_project_lifecycle
+      ON lattice_task_work_items (tenant_id, workspace_id, project_id, created_at DESC, id DESC)
+      WHERE event_key IS NOT NULL`);
+  },
+  down: async (client) => {
+    await client.query("DROP INDEX IF EXISTS idx_task_work_items_project_lifecycle");
+  }
+};
+var taskWorkItemMigrations = [
+  createTaskWorkItemsMigration,
+  addWorkItemProjectFieldsMigration,
+  addTaskWorkItemEventKeyMigration,
+  addTaskWorkItemPendingIndexesMigration,
+  addProjectLifecycleEventIndex
+];
+
+// src/stores/PostgreSQLTaskWorkItemStore.ts
+var PROJECT_LIFECYCLE_ACTIONS = /* @__PURE__ */ new Set([
+  "in_progress",
+  "interrupted",
+  "failed",
+  "completed",
+  "cancelled",
+  "reassigned"
+]);
+function isRecord2(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function isPool(value) {
+  return typeof value.query === "function";
+}
+var PostgreSQLTaskWorkItemStore = class {
+  constructor(poolOrOptions) {
+    this.initialized = false;
+    this.ownsPool = false;
+    this.initPromise = null;
+    if (isPool(poolOrOptions)) {
+      this.pool = poolOrOptions;
+      this.initialized = true;
+      return;
+    }
+    const options = poolOrOptions;
+    if (options.pool) {
+      this.pool = options.pool;
+      this.initialized = true;
+      return;
+    }
+    this.pool = typeof options.poolConfig === "string" ? new Pool20({ connectionString: options.poolConfig }) : options.poolConfig ? new Pool20(options.poolConfig) : (() => {
+      throw new Error("Either pool or poolConfig must be provided");
+    })();
+    this.ownsPool = true;
+    this.migrationManager = new MigrationManager(this.pool);
+    for (const migration of taskWorkItemMigrations) this.migrationManager.register(migration);
+    if (options.autoMigrate !== false) this.startInitialization();
+  }
+  /** Applies the complete standalone TaskWorkItem migration chain once. */
+  async initialize() {
+    if (this.initialized) return;
+    if (this.initPromise) return this.initPromise;
+    return this.startInitialization();
+  }
+  /** Closes the pool only when this store created it from connection configuration. */
+  async dispose() {
+    if (this.ownsPool) await this.pool.end();
+  }
+  startInitialization() {
+    this.initPromise = this.migrationManager.migrate().then(() => {
+      this.initialized = true;
+    });
+    void this.initPromise.catch(() => void 0);
+    return this.initPromise;
+  }
+  async ensureInitialized() {
+    if (!this.initialized) await this.initialize();
   }
   async create(params) {
+    await this.ensureInitialized();
     const id = v4();
     const result = await this.pool.query(
       `INSERT INTO lattice_task_work_items
-        (id, tenant_id, task_id, action, actor, thread_id, summary, detail, attempt, workspace_id, project_id)
-       VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11)
+        (id, tenant_id, task_id, action, actor, thread_id, summary, detail, attempt, workspace_id, project_id, created_at)
+       VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, date_trunc('milliseconds', clock_timestamp()))
        RETURNING *`,
       [
         id,
@@ -7657,8 +8266,46 @@ var PostgreSQLTaskWorkItemStore = class {
     );
     return this.rowToItem(result.rows[0]);
   }
+  /** Atomically inserts a work item by selecting one exact task snapshot. */
+  async createIfTaskSnapshot(params, snapshot) {
+    await this.ensureInitialized();
+    const result = await this.pool.query(
+      `INSERT INTO lattice_task_work_items
+        (id, tenant_id, task_id, action, actor, thread_id, summary, detail, attempt, workspace_id, project_id, created_at)
+       SELECT $1, task.tenant_id, task.id, $2, $3, $4, $5, $6, $7, task.workspace_id, task.project_id,
+         date_trunc('milliseconds', clock_timestamp())
+       FROM lattice_tasks AS task
+       WHERE task.tenant_id = $8 AND task.id = $9 AND task.status = $10
+         AND date_trunc('milliseconds', task.updated_at::timestamptz) = $11::timestamptz
+          AND task.owner_type = $12 AND task.owner_id = $13
+          AND task.workspace_id IS NOT DISTINCT FROM $14 AND task.project_id IS NOT DISTINCT FROM $15
+          AND $14 IS NOT DISTINCT FROM $16 AND $15 IS NOT DISTINCT FROM $17
+       RETURNING *`,
+      [
+        v4(),
+        params.action,
+        params.actor,
+        params.threadId || null,
+        params.summary || null,
+        params.detail ? JSON.stringify(params.detail) : null,
+        params.attempt ?? null,
+        params.tenantId,
+        params.taskId,
+        snapshot.status,
+        new Date(snapshot.updatedAt).toISOString(),
+        snapshot.ownerType,
+        snapshot.ownerId,
+        snapshot.workspaceId,
+        snapshot.projectId,
+        params.workspaceId,
+        params.projectId
+      ]
+    );
+    return result.rows[0] ? this.rowToItem(result.rows[0]) : null;
+  }
   /** Find an event by its tenant- and task-scoped key without pagination. */
   async findByEventKey(tenantId, taskId, eventKey) {
+    await this.ensureInitialized();
     const result = await this.pool.query(
       `SELECT * FROM lattice_task_work_items
        WHERE tenant_id = $1 AND task_id = $2 AND event_key = $3`,
@@ -7668,10 +8315,11 @@ var PostgreSQLTaskWorkItemStore = class {
   }
   /** Atomically return an existing event or create it once. */
   async createIfAbsentByEventKey(params) {
+    await this.ensureInitialized();
     const result = await this.pool.query(
       `INSERT INTO lattice_task_work_items
-        (id, tenant_id, task_id, action, actor, thread_id, summary, detail, attempt, workspace_id, project_id, event_key)
-       VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12)
+        (id, tenant_id, task_id, action, actor, thread_id, summary, detail, attempt, workspace_id, project_id, event_key, created_at)
+       VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, date_trunc('milliseconds', clock_timestamp()))
        ON CONFLICT (tenant_id, task_id, event_key) WHERE event_key IS NOT NULL
        DO UPDATE SET event_key = EXCLUDED.event_key
        RETURNING *`,
@@ -7693,6 +8341,7 @@ var PostgreSQLTaskWorkItemStore = class {
     return this.rowToItem(result.rows[0]);
   }
   async list(filter) {
+    await this.ensureInitialized();
     let query = `SELECT * FROM lattice_task_work_items WHERE tenant_id = $1 AND task_id = $2`;
     const params = [filter.tenantId, filter.taskId];
     if (filter.action) {
@@ -7720,6 +8369,84 @@ var PostgreSQLTaskWorkItemStore = class {
     const result = await this.pool.query(query, params);
     return result.rows.map((row) => this.rowToItem(row));
   }
+  /** List pending execution results using one bounded PostgreSQL anti-join query. */
+  async listPendingExecutionResults(params) {
+    if (!Number.isSafeInteger(params.limit) || params.limit < 0 || params.limit > MAX_PENDING_EXECUTION_RESULTS_LIMIT) {
+      const error = new RangeError(`limit must be a safe integer between 0 and ${MAX_PENDING_EXECUTION_RESULTS_LIMIT}`);
+      error.code = "INVALID_LIMIT";
+      throw error;
+    }
+    if (params.limit === 0) return [];
+    const result = await this.pool.query(
+      `SELECT result.*
+       FROM lattice_task_work_items AS result
+       WHERE result.tenant_id = $1
+         AND result.task_id = $2
+         AND result.action = 'execution_result'
+         AND result.event_key COLLATE "C" ~ '^execution-result:[A-Za-z0-9._:-]+$'
+         AND NOT EXISTS (
+           SELECT 1
+           FROM lattice_task_work_items AS reconciled
+           WHERE reconciled.tenant_id = result.tenant_id
+             AND reconciled.task_id = result.task_id
+             AND reconciled.action = 'execution_reconciled'
+             AND reconciled.detail ->> 'executionResultId' = result.event_key
+         )
+       ORDER BY result.created_at DESC, result.id DESC
+       LIMIT $3`,
+      [params.tenantId, params.taskId, params.limit]
+    );
+    return result.rows.map((row) => this.rowToItem(row));
+  }
+  /** Lists canonical project lifecycle events with an exclusive cursor. */
+  async listProjectLifecycleEvents(query) {
+    let cursorMilliseconds = null;
+    if (!Number.isSafeInteger(query.limit) || query.limit < 1 || query.limit > 100 || query.actions.length === 0 || query.actions.some((action) => !PROJECT_LIFECYCLE_ACTIONS.has(action))) {
+      throw new RangeError("Invalid project lifecycle event page");
+    }
+    if (query.before) {
+      try {
+        cursorMilliseconds = Date.prototype.getTime.call(query.before.createdAt);
+      } catch {
+        throw new RangeError("Invalid project lifecycle event cursor");
+      }
+      if (!Number.isFinite(cursorMilliseconds) || typeof query.before.id !== "string" || query.before.id.length === 0) {
+        throw new RangeError("Invalid project lifecycle event cursor");
+      }
+    }
+    const cursor = cursorMilliseconds === null ? null : new Date(cursorMilliseconds);
+    await this.ensureInitialized();
+    const result = await this.pool.query(
+      `SELECT * FROM lattice_task_work_items
+       WHERE tenant_id=$1 AND workspace_id=$2 AND project_id=$3
+         AND action = ANY($4::text[]) AND event_key IS NOT NULL AND event_key <> ''
+         AND ($5::timestamptz IS NULL OR created_at < $5::timestamptz
+           OR (created_at = $5::timestamptz AND id < $6))
+       ORDER BY created_at DESC, id DESC LIMIT $7`,
+      [
+        query.tenantId,
+        query.workspaceId,
+        query.projectId,
+        query.actions,
+        cursor,
+        query.before?.id ?? null,
+        query.limit
+      ]
+    );
+    return result.rows.map((row) => this.assertProjectLifecycleEvent(this.rowToItem(row)));
+  }
+  assertProjectLifecycleEvent(item) {
+    let milliseconds;
+    try {
+      milliseconds = Date.prototype.getTime.call(item.createdAt);
+    } catch {
+      throw new Error("Invalid project lifecycle event row");
+    }
+    if (!Number.isFinite(milliseconds) || typeof item.id !== "string" || item.id.length === 0 || typeof item.eventKey !== "string" || item.eventKey.length === 0) {
+      throw new Error("Invalid project lifecycle event row");
+    }
+    return { ...item, createdAt: new Date(milliseconds) };
+  }
   rowToItem(row) {
     return {
       id: row.id,
@@ -7729,7 +8456,7 @@ var PostgreSQLTaskWorkItemStore = class {
       actor: row.actor,
       threadId: row.thread_id,
       summary: row.summary,
-      detail: row.detail,
+      detail: isRecord2(row.detail) ? row.detail : void 0,
       attempt: row.attempt,
       workspaceId: row.workspace_id,
       projectId: row.project_id,
@@ -7740,7 +8467,7 @@ var PostgreSQLTaskWorkItemStore = class {
 };
 
 // src/stores/MenuStore.ts
-import { Pool as Pool20 } from "pg";
+import { Pool as Pool21 } from "pg";
 
 // src/migrations/menu_items_migration.ts
 var createMenuItemsTable = {
@@ -7817,7 +8544,7 @@ var MenuStore = class {
       this.initialized = true;
       return;
     }
-    this.pool = typeof options.poolConfig === "string" ? new Pool20({ connectionString: options.poolConfig }) : options.poolConfig ? new Pool20(options.poolConfig) : (() => {
+    this.pool = typeof options.poolConfig === "string" ? new Pool21({ connectionString: options.poolConfig }) : options.poolConfig ? new Pool21(options.poolConfig) : (() => {
       throw new Error("Either pool or poolConfig must be provided");
     })();
     this.migrationManager = new MigrationManager(this.pool);
@@ -7972,7 +8699,7 @@ var MenuStore = class {
 };
 
 // src/stores/PostgresSharedResourceStore.ts
-import { Pool as Pool21 } from "pg";
+import { Pool as Pool22 } from "pg";
 
 // src/migrations/shared_resources_migration.ts
 var createSharedResourcesTable = {
@@ -8026,7 +8753,7 @@ var PostgresSharedResourceStore = class {
       this.initialized = true;
       return;
     }
-    this.pool = typeof options.poolConfig === "string" ? new Pool21({ connectionString: options.poolConfig }) : options.poolConfig ? new Pool21(options.poolConfig) : (() => {
+    this.pool = typeof options.poolConfig === "string" ? new Pool22({ connectionString: options.poolConfig }) : options.poolConfig ? new Pool22(options.poolConfig) : (() => {
       throw new Error("Either pool or poolConfig must be provided");
     })();
     this.migrationManager = new MigrationManager(this.pool);
@@ -8195,7 +8922,7 @@ var PostgresSharedResourceStore = class {
 };
 
 // src/stores/PostgreSQLCollectionStore.ts
-import { Pool as Pool22 } from "pg";
+import { Pool as Pool23 } from "pg";
 var PostgreSQLCollectionStore = class {
   constructor(options) {
     this.initialized = false;
@@ -8208,9 +8935,9 @@ var PostgreSQLCollectionStore = class {
       return;
     }
     if (typeof options.poolConfig === "string") {
-      this.pool = new Pool22({ connectionString: options.poolConfig });
+      this.pool = new Pool23({ connectionString: options.poolConfig });
     } else if (options.poolConfig) {
-      this.pool = new Pool22(options.poolConfig);
+      this.pool = new Pool23(options.poolConfig);
     } else {
       throw new Error("Either pool or poolConfig must be provided");
     }
@@ -8325,7 +9052,7 @@ var PostgreSQLCollectionStore = class {
 import { PostgresSaver } from "@langchain/langgraph-checkpoint-postgres";
 
 // src/PGVectorStoreProvider.ts
-import { Pool as Pool23 } from "pg";
+import { Pool as Pool24 } from "pg";
 import { PGVectorStore } from "@langchain/community/vectorstores/pgvector";
 import { Document } from "@langchain/core/documents";
 import { embeddingsLatticeManager } from "@axiom-lattice/core";
@@ -8399,7 +9126,7 @@ var PGVectorStoreProvider = class {
   }
 };
 function createPGVectorStoreProvider(connectionString) {
-  const pool = new Pool23({ connectionString });
+  const pool = new Pool24({ connectionString });
   return {
     provider: new PGVectorStoreProvider(pool, connectionString),
     pool
@@ -8688,69 +9415,956 @@ var createCollectionsTable = {
   }
 };
 
-// src/migrations/task_work_items_migration.ts
-var createTaskWorkItemsMigration = {
-  version: 138,
-  name: "create_task_work_items_table",
+// src/migrations/capability_bundle_migration.ts
+var createCapabilityBundlesTable = {
+  version: 170,
+  name: "create_capability_bundles_table",
+  up: async (client) => {
+    await client.query(`CREATE TABLE IF NOT EXISTS lattice_capability_bundles (
+      id UUID PRIMARY KEY, tenant_id VARCHAR(255) NOT NULL, bundle_key VARCHAR(255) NOT NULL,
+      name VARCHAR(255) NOT NULL, description TEXT, capabilities JSONB NOT NULL DEFAULT '[]'::jsonb,
+      created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(), updated_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+      UNIQUE (tenant_id, bundle_key)
+    )`);
+    await client.query("CREATE INDEX IF NOT EXISTS idx_lattice_capability_bundles_tenant ON lattice_capability_bundles(tenant_id)");
+  },
+  down: async (client) => {
+    await client.query("DROP INDEX IF EXISTS idx_lattice_capability_bundles_tenant");
+    await client.query("DROP TABLE IF EXISTS lattice_capability_bundles");
+  }
+};
+
+// src/migrations/project_room_migration.ts
+var createProjectRoomTables = {
+  version: 172,
+  name: "create_project_room_tables",
   up: async (client) => {
     await client.query(`
-      CREATE TABLE IF NOT EXISTS lattice_task_work_items (
-        id TEXT NOT NULL,
-        tenant_id TEXT NOT NULL,
-        task_id TEXT NOT NULL,
-        action TEXT NOT NULL,
-        actor TEXT NOT NULL,
-        thread_id TEXT,
-        summary TEXT,
-        detail JSONB,
-        attempt INTEGER,
+      CREATE TABLE IF NOT EXISTS lattice_project_rooms (
+        id VARCHAR(255) NOT NULL,
+        tenant_id VARCHAR(255) NOT NULL,
+        workspace_id VARCHAR(255) NOT NULL,
+        project_id VARCHAR(255) NOT NULL,
+        name VARCHAR(255) NOT NULL,
+        type VARCHAR(32) NOT NULL CONSTRAINT chk_lattice_project_rooms_type
+          CHECK (type IN ('main')),
         created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
-        PRIMARY KEY (tenant_id, id)
+        updated_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+        PRIMARY KEY (tenant_id, id),
+        UNIQUE (tenant_id, project_id, type)
       )
     `);
     await client.query(`
-      CREATE INDEX IF NOT EXISTS idx_task_work_items_task_id
-        ON lattice_task_work_items (tenant_id, task_id)
+      CREATE TABLE IF NOT EXISTS lattice_project_memberships (
+        id VARCHAR(255) NOT NULL,
+        tenant_id VARCHAR(255) NOT NULL,
+        project_id VARCHAR(255) NOT NULL,
+        user_id VARCHAR(255) NOT NULL,
+        role VARCHAR(32) NOT NULL CONSTRAINT chk_lattice_project_memberships_role
+          CHECK (role IN ('owner', 'admin', 'member', 'viewer')),
+        status VARCHAR(32) NOT NULL CONSTRAINT chk_lattice_project_memberships_status
+          CHECK (status IN ('active', 'removed')),
+        joined_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+        updated_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+        PRIMARY KEY (tenant_id, id),
+        UNIQUE (tenant_id, project_id, user_id)
+      )
     `);
     await client.query(`
-      CREATE INDEX IF NOT EXISTS idx_task_work_items_action
-        ON lattice_task_work_items (tenant_id, task_id, action)
+      CREATE INDEX IF NOT EXISTS idx_lattice_project_memberships_project
+      ON lattice_project_memberships (tenant_id, project_id)
     `);
-  }
-};
-var addWorkItemProjectFieldsMigration = {
-  version: 140,
-  name: "add_task_work_item_project_fields",
-  up: async (client) => {
     await client.query(`
-      ALTER TABLE lattice_task_work_items
-        ADD COLUMN IF NOT EXISTS workspace_id TEXT,
-        ADD COLUMN IF NOT EXISTS project_id TEXT
+      CREATE TABLE IF NOT EXISTS lattice_project_bot_memberships (
+        id VARCHAR(255) NOT NULL,
+        tenant_id VARCHAR(255) NOT NULL,
+        workspace_id VARCHAR(255) NOT NULL,
+        project_id VARCHAR(255) NOT NULL,
+        room_id VARCHAR(255) NOT NULL,
+        assistant_id VARCHAR(255) NOT NULL,
+        role VARCHAR(32) NOT NULL CONSTRAINT chk_lattice_project_bot_memberships_role
+          CHECK (role IN ('coordinator', 'specialist')),
+        title VARCHAR(255) NOT NULL,
+        responsibility TEXT,
+        mention_name VARCHAR(255) NOT NULL,
+        status VARCHAR(32) NOT NULL CONSTRAINT chk_lattice_project_bot_memberships_status
+          CHECK (status IN ('active', 'paused', 'removed')),
+        room_thread_id VARCHAR(255) NOT NULL,
+        joined_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+        updated_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+        PRIMARY KEY (tenant_id, id),
+        UNIQUE (tenant_id, project_id, assistant_id)
+      )
     `);
     await client.query(`
-      CREATE INDEX IF NOT EXISTS idx_task_work_items_project
-        ON lattice_task_work_items (tenant_id, project_id)
+      CREATE UNIQUE INDEX IF NOT EXISTS uq_lattice_project_bot_memberships_coordinator
+      ON lattice_project_bot_memberships (tenant_id, project_id)
+      WHERE role = 'coordinator' AND status IN ('active', 'paused')
     `);
-  }
-};
-var addTaskWorkItemEventKeyMigration = {
-  version: 168,
-  name: "add_task_work_item_event_key",
-  up: async (client) => {
     await client.query(`
-      ALTER TABLE lattice_task_work_items
-        ADD COLUMN IF NOT EXISTS event_key TEXT
+      CREATE UNIQUE INDEX IF NOT EXISTS uq_lattice_project_bot_memberships_mention
+      ON lattice_project_bot_memberships (tenant_id, room_id, mention_name)
+      WHERE status IN ('active', 'paused')
     `);
     await client.query(`
-      CREATE UNIQUE INDEX IF NOT EXISTS idx_task_work_items_event_key
-        ON lattice_task_work_items (tenant_id, task_id, event_key) WHERE event_key IS NOT NULL
+      CREATE INDEX IF NOT EXISTS idx_lattice_project_bot_memberships_project
+      ON lattice_project_bot_memberships (tenant_id, project_id)
+    `);
+    await client.query(`
+      CREATE INDEX IF NOT EXISTS idx_lattice_project_bot_memberships_room
+      ON lattice_project_bot_memberships (tenant_id, room_id)
+    `);
+    await client.query(`
+      CREATE TABLE IF NOT EXISTS lattice_project_room_messages (
+        id VARCHAR(255) NOT NULL,
+        tenant_id VARCHAR(255) NOT NULL,
+        workspace_id VARCHAR(255) NOT NULL,
+        project_id VARCHAR(255) NOT NULL,
+        room_id VARCHAR(255) NOT NULL,
+        author JSONB NOT NULL,
+        content JSONB NOT NULL,
+        mentions JSONB NOT NULL DEFAULT '[]'::jsonb,
+        reply_to_message_id VARCHAR(255),
+        source VARCHAR(32) NOT NULL CONSTRAINT chk_lattice_project_room_messages_source
+          CHECK (source IN ('user', 'agent', 'task', 'routine', 'system')),
+        source_id VARCHAR(255),
+        idempotency_key VARCHAR(255),
+        created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+        PRIMARY KEY (tenant_id, id)
+      )
+    `);
+    await client.query(`
+      CREATE UNIQUE INDEX IF NOT EXISTS uq_lattice_project_room_messages_idempotency
+      ON lattice_project_room_messages (tenant_id, room_id, idempotency_key)
+      WHERE idempotency_key IS NOT NULL
+    `);
+    await client.query(`
+      CREATE INDEX IF NOT EXISTS idx_lattice_project_room_messages_room_created
+      ON lattice_project_room_messages (tenant_id, room_id, created_at DESC, id DESC)
     `);
+  },
+  down: async (client) => {
+    await client.query("DROP INDEX IF EXISTS idx_lattice_project_room_messages_room_created");
+    await client.query("DROP INDEX IF EXISTS uq_lattice_project_room_messages_idempotency");
+    await client.query("DROP TABLE IF EXISTS lattice_project_room_messages");
+    await client.query("DROP INDEX IF EXISTS idx_lattice_project_bot_memberships_room");
+    await client.query("DROP INDEX IF EXISTS idx_lattice_project_bot_memberships_project");
+    await client.query("DROP INDEX IF EXISTS uq_lattice_project_bot_memberships_mention");
+    await client.query("DROP INDEX IF EXISTS uq_lattice_project_bot_memberships_coordinator");
+    await client.query("DROP TABLE IF EXISTS lattice_project_bot_memberships");
+    await client.query("DROP INDEX IF EXISTS idx_lattice_project_memberships_project");
+    await client.query("DROP TABLE IF EXISTS lattice_project_memberships");
+    await client.query("DROP TABLE IF EXISTS lattice_project_rooms");
   }
 };
 
-// src/createPgStoreConfig.ts
-async function createPgStoreConfig(connectionString) {
-  const pool = new Pool24({ connectionString });
+// src/stores/PostgreSQLCapabilityBundleStore.ts
+import { randomUUID as randomUUID3 } from "crypto";
+import { Pool as Pool25 } from "pg";
+var duplicateMessage = "Capability bundle key already exists for tenant";
+function map(row) {
+  return {
+    id: row.id,
+    tenantId: row.tenant_id,
+    key: row.bundle_key,
+    name: row.name,
+    description: row.description ?? void 0,
+    capabilities: row.capabilities,
+    createdAt: row.created_at.toISOString(),
+    updatedAt: typeof row.updated_at === "string" ? row.updated_at : row.updated_at.toISOString()
+  };
+}
+function isDuplicate(error) {
+  return typeof error === "object" && error !== null && "code" in error && error.code === "23505";
+}
+var PostgreSQLCapabilityBundleStore = class {
+  /**
+   * Creates a PostgreSQL capability bundle store.
+   *
+   * @param options - Pool ownership, connection, and migration options.
+   */
+  constructor(options) {
+    this.initialized = false;
+    this.ownsPool = true;
+    this.initPromise = null;
+    if (options.pool) {
+      this.pool = options.pool;
+      this.ownsPool = false;
+      this.initialized = true;
+      return;
+    }
+    this.pool = typeof options.poolConfig === "string" ? new Pool25({ connectionString: options.poolConfig }) : options.poolConfig ? new Pool25(options.poolConfig) : (() => {
+      throw new Error("Either pool or poolConfig must be provided");
+    })();
+    this.migrationManager = new MigrationManager(this.pool);
+    this.migrationManager.register(createCapabilityBundlesTable);
+    if (options.autoMigrate !== false) {
+      this.startInitialization();
+    }
+  }
+  /**
+   * Applies pending migrations for an internally managed pool.
+   *
+   * @returns A shared promise that resolves when initialization completes.
+   */
+  async initialize() {
+    if (this.initialized) return;
+    if (this.initPromise) return this.initPromise;
+    return this.startInitialization();
+  }
+  startInitialization() {
+    this.initPromise = this.migrationManager.migrate().then(() => {
+      this.initialized = true;
+    });
+    void this.initPromise.catch(() => void 0);
+    return this.initPromise;
+  }
+  /**
+   * Closes the pool when it was created by this store.
+   *
+   * @returns A promise that resolves after owned resources are released.
+   */
+  async dispose() {
+    if (this.ownsPool) await this.pool.end();
+  }
+  async ready() {
+    if (!this.initialized) await this.initialize();
+  }
+  async listByTenant(tenantId) {
+    await this.ready();
+    const result = await this.pool.query(
+      "SELECT id, tenant_id, bundle_key, name, description, capabilities, created_at, updated_at::text AS updated_at FROM lattice_capability_bundles WHERE tenant_id = $1 ORDER BY created_at",
+      [tenantId]
+    );
+    return result.rows.map(map);
+  }
+  async getById(tenantId, id) {
+    await this.ready();
+    const result = await this.pool.query(
+      "SELECT id, tenant_id, bundle_key, name, description, capabilities, created_at, updated_at::text AS updated_at FROM lattice_capability_bundles WHERE tenant_id = $1 AND id = $2",
+      [tenantId, id]
+    );
+    return result.rows[0] ? map(result.rows[0]) : null;
+  }
+  async getManyByIds(tenantId, ids) {
+    await this.ready();
+    if (ids.length === 0) return [];
+    const result = await this.pool.query(
+      "SELECT id, tenant_id, bundle_key, name, description, capabilities, created_at, updated_at::text AS updated_at FROM lattice_capability_bundles WHERE tenant_id = $1 AND id = ANY($2::uuid[])",
+      [tenantId, ids]
+    );
+    return result.rows.map(map);
+  }
+  async create(tenantId, input) {
+    await this.ready();
+    try {
+      const result = await this.pool.query(
+        `INSERT INTO lattice_capability_bundles
+         (id, tenant_id, bundle_key, name, description, capabilities)
+         VALUES ($1, $2, $3, $4, $5, $6::jsonb)
+          RETURNING id, tenant_id, bundle_key, name, description, capabilities, created_at, updated_at::text AS updated_at`,
+        [
+          randomUUID3(),
+          tenantId,
+          input.key,
+          input.name,
+          input.description ?? null,
+          JSON.stringify(input.capabilities)
+        ]
+      );
+      return map(result.rows[0]);
+    } catch (error) {
+      if (isDuplicate(error)) throw new Error(duplicateMessage);
+      throw error;
+    }
+  }
+  async update(tenantId, id, input) {
+    await this.ready();
+    const fields = [];
+    const values = [];
+    const add = (field, value) => {
+      values.push(value);
+      fields.push(`${field} = $${values.length}`);
+    };
+    if (input.name !== void 0) add("name", input.name);
+    if (Object.prototype.hasOwnProperty.call(input, "description")) {
+      add("description", input.description ?? null);
+    }
+    if (input.capabilities !== void 0) {
+      add("capabilities", JSON.stringify(input.capabilities));
+    }
+    if (fields.length === 0) {
+      const expectedUpdatedAt2 = input.expectedUpdatedAt;
+      const result = await this.pool.query(
+        `SELECT id, tenant_id, bundle_key, name, description, capabilities, created_at, updated_at::text AS updated_at
+         FROM lattice_capability_bundles
+         WHERE tenant_id = $1 AND id = $2${expectedUpdatedAt2 === void 0 ? "" : " AND updated_at::text = $3"}`,
+        expectedUpdatedAt2 === void 0 ? [tenantId, id] : [tenantId, id, expectedUpdatedAt2]
+      );
+      if (result.rows[0]) return map(result.rows[0]);
+      return expectedUpdatedAt2 === void 0 ? null : { status: "conflict" };
+    }
+    const expectedUpdatedAt = input.expectedUpdatedAt;
+    values.push(tenantId, id);
+    if (expectedUpdatedAt !== void 0) values.push(expectedUpdatedAt);
+    const tenantParam = values.length - (expectedUpdatedAt === void 0 ? 1 : 2);
+    const idParam = tenantParam + 1;
+    const revisionPredicate = expectedUpdatedAt === void 0 ? "" : ` AND updated_at::text = $${values.length}`;
+    try {
+      const result = await this.pool.query(
+        `UPDATE lattice_capability_bundles
+          SET ${fields.join(", ")}, updated_at = GREATEST(updated_at + interval '1 microsecond', clock_timestamp())
+          WHERE tenant_id = $${tenantParam} AND id = $${idParam}${revisionPredicate}
+         RETURNING id, tenant_id, bundle_key, name, description, capabilities, created_at, updated_at::text AS updated_at`,
+        values
+      );
+      if (result.rows[0]) return map(result.rows[0]);
+      return expectedUpdatedAt === void 0 ? null : { status: "conflict" };
+    } catch (error) {
+      if (isDuplicate(error)) throw new Error(duplicateMessage);
+      throw error;
+    }
+  }
+  async deleteIfUnreferenced(tenantId, id) {
+    await this.ready();
+    const client = await this.pool.connect();
+    try {
+      await client.query("BEGIN");
+      await client.query(
+        "SELECT pg_advisory_xact_lock(hashtextextended($1 || ':project-mutations', 0))",
+        [tenantId]
+      );
+      const projectIds = await client.query(
+        `SELECT id FROM lattice_projects
+         WHERE tenant_id = $1
+         ORDER BY id`,
+        [tenantId]
+      );
+      if (projectIds.rows.length > 0) {
+        await client.query(
+          `SELECT pg_advisory_xact_lock(hashtextextended($1 || ':project:' || project_id, 0))
+           FROM unnest($2::text[]) AS project_id
+           ORDER BY project_id`,
+          [tenantId, projectIds.rows.map((project) => project.id)]
+        );
+      }
+      await client.query(
+        `SELECT id FROM lattice_projects
+         WHERE tenant_id = $1
+         FOR UPDATE`,
+        [tenantId]
+      );
+      await client.query("SELECT pg_advisory_xact_lock(hashtextextended($1 || ':' || $2, 0))", [tenantId, id]);
+      const referenced = await client.query(
+        `SELECT 1 FROM lattice_projects
+         WHERE tenant_id = $1
+         AND jsonb_typeof(config->'capabilityBundleIds') = 'array'
+         AND COALESCE(config->'capabilityBundleIds', '[]'::jsonb) ? $2
+         LIMIT 1`,
+        [tenantId, id]
+      );
+      if (referenced.rows.length > 0) {
+        await client.query("COMMIT");
+        return "in_use";
+      }
+      const deleted = await client.query(
+        "DELETE FROM lattice_capability_bundles WHERE tenant_id = $1 AND id = $2 RETURNING id",
+        [tenantId, id]
+      );
+      await client.query("COMMIT");
+      return deleted.rows.length > 0 ? "deleted" : "not_found";
+    } catch (error) {
+      await client.query("ROLLBACK");
+      throw error;
+    } finally {
+      client.release();
+    }
+  }
+};
+
+// src/stores/PostgreSQLProjectRoomStore.ts
+function isValidDate(value) {
+  return value instanceof Date && !Number.isNaN(value.getTime());
+}
+function mapRow2(row) {
+  if (typeof row.id !== "string" || typeof row.tenant_id !== "string" || typeof row.workspace_id !== "string" || typeof row.project_id !== "string" || row.type !== "main" || typeof row.name !== "string" || !isValidDate(row.created_at) || !isValidDate(row.updated_at)) {
+    throw new Error("Invalid project room row");
+  }
+  return {
+    id: row.id,
+    tenantId: row.tenant_id,
+    workspaceId: row.workspace_id,
+    projectId: row.project_id,
+    type: "main",
+    name: row.name,
+    createdAt: row.created_at,
+    updatedAt: row.updated_at
+  };
+}
+var PostgreSQLProjectRoomStore = class {
+  /** Creates a store using an externally managed pool; the pool is not migrated or closed. */
+  constructor(options) {
+    this.pool = options.pool;
+  }
+  /** Creates or returns the single persisted main room for a project. */
+  async ensureMainRoom(input) {
+    const result = await this.pool.query(
+      `INSERT INTO lattice_project_rooms
+       (id, tenant_id, workspace_id, project_id, type, name)
+       VALUES ($1, $2, $3, $4, $5, $6)
+       ON CONFLICT (tenant_id, project_id, type)
+       DO UPDATE SET updated_at = lattice_project_rooms.updated_at
+       RETURNING id, tenant_id, workspace_id, project_id, type, name, created_at, updated_at`,
+      [input.id, input.tenantId, input.workspaceId, input.projectId, "main", input.name]
+    );
+    return mapRow2(result.rows[0]);
+  }
+  /** Finds a tenant-scoped project's main room, or returns null. */
+  async getMainRoom(tenantId, projectId) {
+    const result = await this.pool.query(
+      "SELECT id, tenant_id, workspace_id, project_id, type, name, created_at, updated_at FROM lattice_project_rooms WHERE tenant_id = $1 AND project_id = $2 AND type = 'main'",
+      [tenantId, projectId]
+    );
+    return result.rows[0] ? mapRow2(result.rows[0]) : null;
+  }
+};
+
+// src/stores/PostgreSQLProjectMembershipStore.ts
+var DuplicateProjectMembershipError = class extends Error {
+  constructor() {
+    super("Project membership already exists for tenant, project, and user");
+    this.name = "DuplicateProjectMembershipError";
+  }
+};
+var ProjectMembershipIdConflictError = class extends Error {
+  constructor() {
+    super("Project membership ID already exists for tenant");
+    this.name = "ProjectMembershipIdConflictError";
+  }
+};
+function isDate(value) {
+  return value instanceof Date && !Number.isNaN(value.getTime());
+}
+function isRole(value) {
+  return value === "owner" || value === "admin" || value === "member" || value === "viewer";
+}
+function isStatus2(value) {
+  return value === "active" || value === "removed";
+}
+function mapRow3(row) {
+  if (typeof row.id !== "string" || typeof row.tenant_id !== "string" || typeof row.project_id !== "string" || typeof row.user_id !== "string" || !isRole(row.role) || !isStatus2(row.status) || !isDate(row.joined_at) || !isDate(row.updated_at)) throw new Error("Invalid project membership row");
+  return {
+    id: row.id,
+    tenantId: row.tenant_id,
+    projectId: row.project_id,
+    userId: row.user_id,
+    role: row.role,
+    status: row.status,
+    joinedAt: row.joined_at,
+    updatedAt: row.updated_at
+  };
+}
+function isDuplicate2(error) {
+  return typeof error === "object" && error !== null && "code" in error && error.code === "23505";
+}
+function mapDuplicate(error) {
+  if (isDuplicate2(error) && typeof error.constraint === "string" && error.constraint.includes("project_id_user_id")) throw new DuplicateProjectMembershipError();
+  if (isDuplicate2(error)) throw new ProjectMembershipIdConflictError();
+  throw error;
+}
+var columns = "id, tenant_id, project_id, user_id, role, status, joined_at, updated_at";
+var PostgreSQLProjectMembershipStore = class {
+  /** Creates a store using an externally managed pool; the pool is not migrated or closed. */
+  constructor(options) {
+    this.pool = options.pool;
+  }
+  /** Lists memberships in stable joined-time and ID order. */
+  async list(tenantId, projectId) {
+    const result = await this.pool.query(`SELECT ${columns} FROM lattice_project_memberships WHERE tenant_id = $1 AND project_id = $2 ORDER BY joined_at ASC, id ASC`, [tenantId, projectId]);
+    return result.rows.map(mapRow3);
+  }
+  /** Finds a membership by exact tenant, project, and user identity. */
+  async findByUser(tenantId, projectId, userId) {
+    const result = await this.pool.query(`SELECT ${columns} FROM lattice_project_memberships WHERE tenant_id = $1 AND project_id = $2 AND user_id = $3`, [tenantId, projectId, userId]);
+    return result.rows[0] ? mapRow3(result.rows[0]) : null;
+  }
+  /** Inserts a membership and maps database uniqueness errors to stable typed errors. */
+  async create(input) {
+    const client = await this.pool.connect();
+    try {
+      await client.query("BEGIN");
+      await client.query("SELECT pg_advisory_xact_lock(hashtextextended($1, 0))", [`${input.tenantId}:${input.projectId}`]);
+      const result = await client.query(`INSERT INTO lattice_project_memberships (id, tenant_id, project_id, user_id, role, status, joined_at, updated_at) VALUES ($1, $2, $3, $4, $5, $6, date_trunc('milliseconds', clock_timestamp()), date_trunc('milliseconds', clock_timestamp())) RETURNING ${columns}`, [input.id, input.tenantId, input.projectId, input.userId, input.role, input.status]);
+      const membership = mapRow3(result.rows[0]);
+      await client.query("COMMIT");
+      return membership;
+    } catch (error) {
+      try {
+        await client.query("ROLLBACK");
+      } catch {
+      }
+      return mapDuplicate(error);
+    } finally {
+      client.release();
+    }
+  }
+  /** Atomically creates the first active owner while serializing the project scope. */
+  async createInitialOwner(input) {
+    const client = await this.pool.connect();
+    try {
+      await client.query("BEGIN");
+      await client.query("SELECT pg_advisory_xact_lock(hashtextextended($1, 0))", [`${input.tenantId}:${input.projectId}`]);
+      const existingResult = await client.query(`SELECT ${columns} FROM lattice_project_memberships WHERE tenant_id = $1 AND project_id = $2 FOR UPDATE`, [input.tenantId, input.projectId]);
+      if (existingResult.rows.length > 0) {
+        const existing = existingResult.rows.map(mapRow3).find((item) => item.userId === input.userId && item.role === "owner" && item.status === "active");
+        await client.query("COMMIT");
+        return existing ? { kind: "existing", membership: existing } : { kind: "already_initialized" };
+      }
+      const idResult = await client.query("SELECT id FROM lattice_project_memberships WHERE tenant_id = $1 AND id = $2", [input.tenantId, input.id]);
+      if (idResult.rows.length > 0) throw new ProjectMembershipIdConflictError();
+      const inserted = await client.query(`INSERT INTO lattice_project_memberships (id, tenant_id, project_id, user_id, role, status, joined_at, updated_at) VALUES ($1, $2, $3, $4, 'owner', 'active', date_trunc('milliseconds', clock_timestamp()), date_trunc('milliseconds', clock_timestamp())) RETURNING ${columns}`, [input.id, input.tenantId, input.projectId, input.userId]);
+      const membership = mapRow3(inserted.rows[0]);
+      await client.query("COMMIT");
+      return { kind: "created", membership };
+    } catch (error) {
+      try {
+        await client.query("ROLLBACK");
+      } catch {
+      }
+      if (isDuplicate2(error)) return mapDuplicate(error);
+      throw error;
+    } finally {
+      client.release();
+    }
+  }
+  /** Updates a role under a project lock with exact timestamp and owner safeguards. */
+  async updateRole(input) {
+    return this.mutate(input.tenantId, input.id, input.expectedUpdatedAt, input.role, false);
+  }
+  /** Marks a membership removed under a project lock with exact timestamp and owner safeguards. */
+  async remove(input) {
+    return this.mutate(input.tenantId, input.id, input.expectedUpdatedAt, void 0, true);
+  }
+  async mutate(tenantId, id, expected, role, remove) {
+    const client = await this.pool.connect();
+    try {
+      await client.query("BEGIN");
+      const identity = await client.query("SELECT project_id FROM lattice_project_memberships WHERE tenant_id = $1 AND id = $2", [tenantId, id]);
+      if (!identity.rows[0] || typeof identity.rows[0].project_id !== "string") {
+        await client.query("COMMIT");
+        return { kind: "not_found" };
+      }
+      await client.query("SELECT pg_advisory_xact_lock(hashtextextended($1, 0))", [`${tenantId}:${identity.rows[0].project_id}`]);
+      const activeRows = await client.query(`SELECT ${columns} FROM lattice_project_memberships WHERE tenant_id = $1 AND project_id = $2 AND status = 'active' FOR UPDATE`, [tenantId, identity.rows[0].project_id]);
+      const lockedMemberships = activeRows.rows.map(mapRow3);
+      let current = lockedMemberships.find((membership) => membership.id === id);
+      if (!current) {
+        const target = await client.query(`SELECT ${columns} FROM lattice_project_memberships WHERE tenant_id = $1 AND id = $2 FOR UPDATE`, [tenantId, id]);
+        if (!target.rows[0]) {
+          await client.query("COMMIT");
+          return { kind: "not_found" };
+        }
+        current = mapRow3(target.rows[0]);
+      }
+      if (current.updatedAt.getTime() !== expected.getTime()) {
+        await client.query("COMMIT");
+        return { kind: "conflict" };
+      }
+      if (current.role === "owner" && current.status === "active" && (remove || role !== "owner")) {
+        const owners = lockedMemberships.filter((membership) => membership.id !== id && membership.role === "owner");
+        if (owners.length === 0) {
+          await client.query("COMMIT");
+          return { kind: "last_owner" };
+        }
+      }
+      const result = await client.query(remove ? `UPDATE lattice_project_memberships SET status = 'removed', updated_at = GREATEST(date_trunc('milliseconds', updated_at) + interval '1 millisecond', date_trunc('milliseconds', clock_timestamp())) WHERE tenant_id = $1 AND id = $2 AND date_trunc('milliseconds', updated_at) = $3 RETURNING ${columns}` : `UPDATE lattice_project_memberships SET role = $4, updated_at = GREATEST(date_trunc('milliseconds', updated_at) + interval '1 millisecond', date_trunc('milliseconds', clock_timestamp())) WHERE tenant_id = $1 AND id = $2 AND date_trunc('milliseconds', updated_at) = $3 RETURNING ${columns}`, remove ? [tenantId, id, expected] : [tenantId, id, expected, role]);
+      if (!result.rows[0]) {
+        await client.query("COMMIT");
+        return { kind: "conflict" };
+      }
+      await client.query("COMMIT");
+      return { kind: remove ? "removed" : "updated", membership: mapRow3(result.rows[0]) };
+    } catch (error) {
+      try {
+        await client.query("ROLLBACK");
+      } catch {
+      }
+      throw error;
+    } finally {
+      client.release();
+    }
+  }
+};
+
+// src/stores/PostgreSQLProjectBotMembershipStore.ts
+var columns2 = "id, tenant_id, workspace_id, project_id, room_id, assistant_id, role, title, responsibility, mention_name, status, room_thread_id, joined_at, updated_at";
+var ProjectBotMembershipIdConflictError = class extends Error {
+  /** Creates an accurate tenant-scoped membership ID collision error. */
+  constructor(tenantId, id) {
+    super(`Project bot membership ID '${id}' already exists in tenant '${tenantId}'`);
+    this.name = "ProjectBotMembershipIdConflictError";
+  }
+};
+function isDate2(value) {
+  return value instanceof Date && !Number.isNaN(value.getTime());
+}
+function isRole2(value) {
+  return value === "coordinator" || value === "specialist";
+}
+function isStatus3(value) {
+  return value === "active" || value === "paused" || value === "removed";
+}
+function mapRow4(row) {
+  if (typeof row.id !== "string" || typeof row.tenant_id !== "string" || typeof row.workspace_id !== "string" || typeof row.project_id !== "string" || typeof row.room_id !== "string" || typeof row.assistant_id !== "string" || !isRole2(row.role) || typeof row.title !== "string" || row.responsibility !== null && typeof row.responsibility !== "string" || typeof row.mention_name !== "string" || !isStatus3(row.status) || typeof row.room_thread_id !== "string" || !isDate2(row.joined_at) || !isDate2(row.updated_at)) {
+    throw new Error("Invalid project bot membership row");
+  }
+  return {
+    id: row.id,
+    tenantId: row.tenant_id,
+    workspaceId: row.workspace_id,
+    projectId: row.project_id,
+    roomId: row.room_id,
+    assistantId: row.assistant_id,
+    role: row.role,
+    title: row.title,
+    ...row.responsibility === null ? {} : { responsibility: row.responsibility },
+    mentionName: row.mention_name,
+    status: row.status,
+    roomThreadId: row.room_thread_id,
+    joinedAt: row.joined_at,
+    updatedAt: row.updated_at
+  };
+}
+function isUniqueViolation(error) {
+  return typeof error === "object" && error !== null && "code" in error && error.code === "23505";
+}
+function constraintConflict(error) {
+  if (!isUniqueViolation(error) || typeof error.constraint !== "string") return void 0;
+  if (error.constraint === "uq_lattice_project_bot_memberships_coordinator") return "coordinator_conflict";
+  if (error.constraint === "uq_lattice_project_bot_memberships_mention") return "mention_conflict";
+  return void 0;
+}
+async function rollback(client) {
+  try {
+    await client.query("ROLLBACK");
+  } catch {
+  }
+}
+var PostgreSQLProjectBotMembershipStore = class {
+  /** Creates a store using an externally managed shared pool. */
+  constructor(options) {
+    this.pool = options.pool;
+  }
+  /** Lists retained memberships in stable join order. */
+  async list(tenantId, projectId) {
+    const result = await this.pool.query(
+      `SELECT ${columns2} FROM lattice_project_bot_memberships WHERE tenant_id = $1 AND project_id = $2 ORDER BY joined_at ASC, id ASC`,
+      [tenantId, projectId]
+    );
+    return result.rows.map(mapRow4);
+  }
+  /** Finds a membership by tenant-scoped ID. */
+  async findById(tenantId, id) {
+    const result = await this.pool.query(
+      `SELECT ${columns2} FROM lattice_project_bot_memberships WHERE tenant_id = $1 AND id = $2`,
+      [tenantId, id]
+    );
+    return result.rows[0] ? mapRow4(result.rows[0]) : null;
+  }
+  /** Finds an assistant's durable membership in a tenant-scoped project. */
+  async findByAssistant(tenantId, projectId, assistantId) {
+    const result = await this.pool.query(
+      `SELECT ${columns2} FROM lattice_project_bot_memberships WHERE tenant_id = $1 AND project_id = $2 AND assistant_id = $3`,
+      [tenantId, projectId, assistantId]
+    );
+    return result.rows[0] ? mapRow4(result.rows[0]) : null;
+  }
+  /** Inserts a new membership or reactivates the assistant's durable membership atomically. */
+  async save(input) {
+    const client = await this.pool.connect();
+    try {
+      await client.query("BEGIN");
+      await client.query("SELECT pg_advisory_xact_lock(hashtextextended($1, 0))", [`${input.tenantId}:${input.projectId}`]);
+      const existingResult = await client.query(
+        `SELECT ${columns2} FROM lattice_project_bot_memberships WHERE tenant_id = $1 AND project_id = $2 AND assistant_id = $3 FOR UPDATE`,
+        [input.tenantId, input.projectId, input.assistantId]
+      );
+      const existing = existingResult.rows[0] ? mapRow4(existingResult.rows[0]) : void 0;
+      let result;
+      if (existing) {
+        result = await client.query(
+          `UPDATE lattice_project_bot_memberships
+           SET role = $3, title = $4, responsibility = $5, mention_name = $6, status = 'active',
+               updated_at = GREATEST(date_trunc('milliseconds', updated_at) + interval '1 millisecond', date_trunc('milliseconds', clock_timestamp()))
+           WHERE tenant_id = $1 AND id = $2 RETURNING ${columns2}`,
+          [input.tenantId, existing.id, input.role, input.title, input.responsibility ?? null, input.mentionName]
+        );
+      } else {
+        const idResult = await client.query(
+          "SELECT id FROM lattice_project_bot_memberships WHERE tenant_id = $1 AND id = $2",
+          [input.tenantId, input.id]
+        );
+        if (idResult.rows.length > 0) throw new ProjectBotMembershipIdConflictError(input.tenantId, input.id);
+        result = await client.query(
+          `INSERT INTO lattice_project_bot_memberships
+           (id, tenant_id, workspace_id, project_id, room_id, assistant_id, role, title, responsibility, mention_name, status, room_thread_id, joined_at, updated_at)
+           VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, 'active', $11, date_trunc('milliseconds', clock_timestamp()), date_trunc('milliseconds', clock_timestamp()))
+           RETURNING ${columns2}`,
+          [
+            input.id,
+            input.tenantId,
+            input.workspaceId,
+            input.projectId,
+            input.roomId,
+            input.assistantId,
+            input.role,
+            input.title,
+            input.responsibility ?? null,
+            input.mentionName,
+            input.roomThreadId
+          ]
+        );
+      }
+      const membership = mapRow4(result.rows[0]);
+      await client.query("COMMIT");
+      return { kind: existing === void 0 ? "created" : existing.status === "removed" ? "reactivated" : "updated", membership };
+    } catch (error) {
+      await rollback(client);
+      const conflict = constraintConflict(error);
+      if (conflict) return { kind: conflict };
+      if (isUniqueViolation(error) && error.constraint === "lattice_project_bot_memberships_pkey") {
+        throw new ProjectBotMembershipIdConflictError(input.tenantId, input.id);
+      }
+      throw error;
+    } finally {
+      client.release();
+    }
+  }
+  /** Applies a mutable-field patch with project serialization and millisecond-safe optimistic concurrency. */
+  async update(input) {
+    const client = await this.pool.connect();
+    try {
+      await client.query("BEGIN");
+      const identity = await client.query(
+        "SELECT project_id FROM lattice_project_bot_memberships WHERE tenant_id = $1 AND id = $2",
+        [input.tenantId, input.id]
+      );
+      if (!identity.rows[0]) {
+        await client.query("COMMIT");
+        return { kind: "not_found" };
+      }
+      if (typeof identity.rows[0].project_id !== "string") throw new Error("Invalid project bot membership row");
+      await client.query("SELECT pg_advisory_xact_lock(hashtextextended($1, 0))", [`${input.tenantId}:${identity.rows[0].project_id}`]);
+      const locked = await client.query(
+        `SELECT ${columns2} FROM lattice_project_bot_memberships WHERE tenant_id = $1 AND id = $2 FOR UPDATE`,
+        [input.tenantId, input.id]
+      );
+      if (!locked.rows[0]) {
+        await client.query("COMMIT");
+        return { kind: "not_found" };
+      }
+      const existing = mapRow4(locked.rows[0]);
+      if (existing.updatedAt.getTime() !== input.expectedUpdatedAt.getTime()) {
+        await client.query("COMMIT");
+        return { kind: "conflict" };
+      }
+      const candidate = { ...existing, ...input.patch };
+      const updated = await client.query(
+        `UPDATE lattice_project_bot_memberships
+         SET role = $4, title = $5, responsibility = $6, mention_name = $7, status = $8,
+             updated_at = GREATEST(date_trunc('milliseconds', updated_at) + interval '1 millisecond', date_trunc('milliseconds', clock_timestamp()))
+         WHERE tenant_id = $1 AND id = $2 AND date_trunc('milliseconds', updated_at) = $3
+         RETURNING ${columns2}`,
+        [
+          input.tenantId,
+          input.id,
+          input.expectedUpdatedAt,
+          candidate.role,
+          candidate.title,
+          candidate.responsibility ?? null,
+          candidate.mentionName,
+          candidate.status
+        ]
+      );
+      if (!updated.rows[0]) {
+        await client.query("COMMIT");
+        return { kind: "conflict" };
+      }
+      const membership = mapRow4(updated.rows[0]);
+      await client.query("COMMIT");
+      return { kind: "updated", membership };
+    } catch (error) {
+      await rollback(client);
+      const conflict = constraintConflict(error);
+      if (conflict) return { kind: conflict };
+      throw error;
+    } finally {
+      client.release();
+    }
+  }
+};
+
+// src/stores/PostgreSQLProjectRoomMessageStore.ts
+var columns3 = "id, tenant_id, workspace_id, project_id, room_id, author, content, mentions, reply_to_message_id, source, source_id, idempotency_key, created_at";
+var ProjectRoomMessageIdConflictError = class extends Error {
+  /** Creates an accurate tenant-scoped message ID collision error. */
+  constructor(tenantId, id) {
+    super(`Project room message ID '${id}' already exists in tenant '${tenantId}'`);
+    this.name = "ProjectRoomMessageIdConflictError";
+  }
+};
+var DuplicateProjectRoomMessageIdempotencyKeyError = class extends Error {
+  /** Creates an accurate tenant and room-scoped idempotency collision error. */
+  constructor(tenantId, roomId, idempotencyKey) {
+    super(`Project room message idempotency key '${idempotencyKey}' already exists in tenant '${tenantId}' room '${roomId}'`);
+    this.name = "DuplicateProjectRoomMessageIdempotencyKeyError";
+  }
+};
+function isRecord3(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function hasOnlyKeys(value, keys) {
+  return Object.keys(value).every((key) => keys.includes(key));
+}
+function mapAuthor(value) {
+  if (!isRecord3(value) || typeof value.type !== "string") return void 0;
+  if (value.type === "human" && hasOnlyKeys(value, ["type", "userId"]) && typeof value.userId === "string") return { type: "human", userId: value.userId };
+  if (value.type === "bot" && hasOnlyKeys(value, ["type", "membershipId", "assistantId"]) && typeof value.membershipId === "string" && typeof value.assistantId === "string") {
+    return { type: "bot", membershipId: value.membershipId, assistantId: value.assistantId };
+  }
+  if (value.type === "system" && hasOnlyKeys(value, ["type"])) return { type: "system" };
+  return void 0;
+}
+function mapMention(value) {
+  if (!isRecord3(value) || typeof value.type !== "string") return void 0;
+  if (value.type === "bot" && hasOnlyKeys(value, ["type", "membershipId"]) && typeof value.membershipId === "string") {
+    return { type: "bot", membershipId: value.membershipId };
+  }
+  if (value.type === "team" && hasOnlyKeys(value, ["type"])) return { type: "team" };
+  return void 0;
+}
+function isSource(value) {
+  return value === "user" || value === "agent" || value === "task" || value === "routine" || value === "system";
+}
+function mapRow5(row) {
+  const author = mapAuthor(row.author);
+  const content = isRecord3(row.content) && row.content.type === "text" && typeof row.content.text === "string" && hasOnlyKeys(row.content, ["type", "text"]) ? { type: "text", text: row.content.text } : void 0;
+  const mentions = Array.isArray(row.mentions) ? row.mentions.map(mapMention) : void 0;
+  if (typeof row.id !== "string" || typeof row.tenant_id !== "string" || typeof row.workspace_id !== "string" || typeof row.project_id !== "string" || typeof row.room_id !== "string" || !author || !content || !mentions || mentions.some((mention) => mention === void 0) || row.reply_to_message_id !== null && typeof row.reply_to_message_id !== "string" || !isSource(row.source) || row.source_id !== null && typeof row.source_id !== "string" || row.idempotency_key !== null && typeof row.idempotency_key !== "string" || !(row.created_at instanceof Date) || Number.isNaN(row.created_at.getTime())) {
+    throw new Error("Invalid project room message row");
+  }
+  return {
+    id: row.id,
+    tenantId: row.tenant_id,
+    workspaceId: row.workspace_id,
+    projectId: row.project_id,
+    roomId: row.room_id,
+    author,
+    content,
+    mentions,
+    ...row.reply_to_message_id === null ? {} : { replyToMessageId: row.reply_to_message_id },
+    source: row.source,
+    ...row.source_id === null ? {} : { sourceId: row.source_id },
+    ...row.idempotency_key === null ? {} : { idempotencyKey: row.idempotency_key },
+    createdAt: row.created_at
+  };
+}
+function isUniqueViolation2(error) {
+  return typeof error === "object" && error !== null && "code" in error && error.code === "23505";
+}
+var PostgreSQLProjectRoomMessageStore = class {
+  /** Creates a store using an externally managed shared pool. */
+  constructor(options) {
+    this.pool = options.pool;
+  }
+  /** Creates a room message and maps known uniqueness failures to typed errors. */
+  async create(input) {
+    try {
+      const result = await this.pool.query(
+        `INSERT INTO lattice_project_room_messages
+         (id, tenant_id, workspace_id, project_id, room_id, author, content, mentions, reply_to_message_id, source, source_id, idempotency_key, created_at)
+         VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, date_trunc('milliseconds', clock_timestamp()))
+         RETURNING ${columns3}`,
+        this.parameters(input)
+      );
+      return mapRow5(result.rows[0]);
+    } catch (error) {
+      if (isUniqueViolation2(error) && error.constraint === "lattice_project_room_messages_pkey") {
+        throw new ProjectRoomMessageIdConflictError(input.tenantId, input.id);
+      }
+      if (isUniqueViolation2(error) && error.constraint === "uq_lattice_project_room_messages_idempotency") {
+        throw new DuplicateProjectRoomMessageIdempotencyKeyError(input.tenantId, input.roomId, input.idempotencyKey ?? "");
+      }
+      throw error;
+    }
+  }
+  /** Atomically creates or returns the canonical message for a room-scoped idempotency key. */
+  async createIdempotent(input) {
+    try {
+      const result = await this.pool.query(
+        `INSERT INTO lattice_project_room_messages
+         (id, tenant_id, workspace_id, project_id, room_id, author, content, mentions, reply_to_message_id, source, source_id, idempotency_key, created_at)
+         VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, date_trunc('milliseconds', clock_timestamp()))
+         ON CONFLICT (tenant_id, room_id, idempotency_key) WHERE idempotency_key IS NOT NULL
+         DO UPDATE SET idempotency_key = lattice_project_room_messages.idempotency_key
+         RETURNING ${columns3}`,
+        this.parameters(input)
+      );
+      return mapRow5(result.rows[0]);
+    } catch (error) {
+      if (isUniqueViolation2(error) && error.constraint === "lattice_project_room_messages_pkey") {
+        throw new ProjectRoomMessageIdConflictError(input.tenantId, input.id);
+      }
+      throw error;
+    }
+  }
+  /** Lists messages newest first using an exclusive stable cursor and a clamped limit. */
+  async list(input) {
+    if (input.before && (!(input.before.createdAt instanceof Date) || Number.isNaN(input.before.createdAt.getTime()))) {
+      throw new RangeError("Project room message cursor date is invalid");
+    }
+    const limit = Math.min(100, Math.max(1, Math.trunc(Number.isFinite(input.limit) ? input.limit : 1)));
+    const result = input.before ? await this.pool.query(
+      `SELECT ${columns3} FROM lattice_project_room_messages
+         WHERE tenant_id = $1 AND room_id = $2 AND (created_at < $3 OR (created_at = $3 AND id < $4))
+         ORDER BY created_at DESC, id DESC LIMIT $5`,
+      [input.tenantId, input.roomId, input.before.createdAt, input.before.id, limit]
+    ) : await this.pool.query(
+      `SELECT ${columns3} FROM lattice_project_room_messages
+         WHERE tenant_id = $1 AND room_id = $2 ORDER BY created_at DESC, id DESC LIMIT $3`,
+      [input.tenantId, input.roomId, limit]
+    );
+    return result.rows.map(mapRow5);
+  }
+  /** Finds a message by tenant-scoped ID. */
+  async findById(tenantId, id) {
+    const result = await this.pool.query(
+      `SELECT ${columns3} FROM lattice_project_room_messages WHERE tenant_id = $1 AND id = $2`,
+      [tenantId, id]
+    );
+    return result.rows[0] ? mapRow5(result.rows[0]) : null;
+  }
+  parameters(input) {
+    return [
+      input.id,
+      input.tenantId,
+      input.workspaceId,
+      input.projectId,
+      input.roomId,
+      JSON.stringify(input.author),
+      JSON.stringify(input.content),
+      JSON.stringify(input.mentions),
+      input.replyToMessageId ?? null,
+      input.source,
+      input.sourceId ?? null,
+      input.idempotencyKey ?? null
+    ];
+  }
+};
+
+// src/createPgStoreConfig.ts
+async function createPgStoreConfig(connectionString) {
+  const pool = new Pool26({ connectionString });
   const mm = new MigrationManager(pool);
   mm.register(createThreadsTable);
   mm.register(createScheduledTasksTable);
@@ -8805,6 +10419,11 @@ async function createPgStoreConfig(connectionString) {
   mm.register(addA2AKeyAssistantIds);
   mm.register(addTaskWorkItemEventKeyMigration);
   mm.register(createAgentWebAppsTable);
+  mm.register(createCapabilityBundlesTable);
+  mm.register(addTaskWorkItemPendingIndexesMigration);
+  mm.register(createProjectRoomTables);
+  mm.register(addTrustedRunContextColumn);
+  mm.register(addProjectLifecycleEventIndex);
   await mm.migrate();
   const checkpoint = PostgresSaver.fromConnString(connectionString);
   checkpoint.setup().catch((err) => {
@@ -8833,17 +10452,22 @@ async function createPgStoreConfig(connectionString) {
     taskWorkItem: taskWorkItemStore,
     a2aApiKey: new PostgreSQLA2AApiKeyStore(opts),
     agentWebApp: new PostgreSQLAgentWebAppStore(opts),
+    capabilityBundle: new PostgreSQLCapabilityBundleStore(opts),
     schedule: new PostgreSQLScheduleStorage(opts),
     menu: new MenuStore(opts),
     sharedResource: new PostgresSharedResourceStore(opts),
     collection: new PostgreSQLCollectionStore(opts),
+    projectRoom: new PostgreSQLProjectRoomStore(opts),
+    projectMembership: new PostgreSQLProjectMembershipStore(opts),
+    projectBotMembership: new PostgreSQLProjectBotMembershipStore(opts),
+    projectRoomMessage: new PostgreSQLProjectRoomMessageStore(opts),
     vectorStoreProvider: new PGVectorStoreProvider(pool, connectionString),
     checkpoint
   };
 }
 
 // src/stores/PostgreSQLSkillStore.ts
-import { Pool as Pool25 } from "pg";
+import { Pool as Pool27 } from "pg";
 var PostgreSQLSkillStore = class {
   constructor(options) {
     this.initialized = false;
@@ -8856,9 +10480,9 @@ var PostgreSQLSkillStore = class {
       return;
     }
     if (typeof options.poolConfig === "string") {
-      this.pool = new Pool25({ connectionString: options.poolConfig });
+      this.pool = new Pool27({ connectionString: options.poolConfig });
     } else if (options.poolConfig) {
-      this.pool = new Pool25(options.poolConfig);
+      this.pool = new Pool27(options.poolConfig);
     } else {
       throw new Error("Either pool or poolConfig must be provided");
     }
@@ -9159,7 +10783,7 @@ var PostgreSQLSkillStore = class {
 };
 
 // src/stores/ChannelIdentityMappingStore.ts
-import { Pool as Pool26 } from "pg";
+import { Pool as Pool28 } from "pg";
 var ChannelIdentityMappingStore = class {
   constructor(options) {
     this.initialized = false;
@@ -9171,7 +10795,7 @@ var ChannelIdentityMappingStore = class {
       this.initialized = true;
       return;
     }
-    this.pool = typeof options.poolConfig === "string" ? new Pool26({ connectionString: options.poolConfig }) : options.poolConfig ? new Pool26(options.poolConfig) : (() => {
+    this.pool = typeof options.poolConfig === "string" ? new Pool28({ connectionString: options.poolConfig }) : options.poolConfig ? new Pool28(options.poolConfig) : (() => {
       throw new Error("Either pool or poolConfig must be provided");
     })();
     this.migrationManager = new MigrationManager(this.pool);
@@ -9392,13 +11016,16 @@ function mapRowToChannelIdentityMapping(row) {
 export {
   ChannelBindingStore,
   ChannelIdentityMappingStore,
+  DuplicateProjectMembershipError,
+  DuplicateProjectRoomMessageIdempotencyKeyError,
   MenuStore,
   MigrationManager,
   PGVectorStoreProvider,
-  Pool27 as Pool,
+  Pool29 as Pool,
   PostgreSQLA2AApiKeyStore,
   PostgreSQLAgentWebAppStore,
   PostgreSQLAssistantStore,
+  PostgreSQLCapabilityBundleStore,
   PostgreSQLChannelInstallationStore,
   PostgreSQLCollectionStore,
   PostgreSQLConnectionStore,
@@ -9406,9 +11033,14 @@ export {
   PostgreSQLEvalStore,
   PostgreSQLMcpServerConfigStore,
   PostgreSQLMetricsServerConfigStore,
+  PostgreSQLProjectBotMembershipStore,
+  PostgreSQLProjectMembershipStore,
+  PostgreSQLProjectRoomMessageStore,
+  PostgreSQLProjectRoomStore,
   PostgreSQLProjectStore,
   PostgreSQLScheduleStorage,
   PostgreSQLSkillStore,
+  PostgreSQLTaskWorkItemStore,
   PostgreSQLTenantStore,
   PostgreSQLThreadStore,
   PostgreSQLUserStore,
@@ -9416,6 +11048,9 @@ export {
   PostgreSQLWorkflowTrackingStore,
   PostgreSQLWorkspaceStore,
   PostgresSharedResourceStore,
+  ProjectBotMembershipIdConflictError,
+  ProjectMembershipIdConflictError,
+  ProjectRoomMessageIdConflictError,
   ThreadMessageQueueStore,
   addAssistantTenantId,
   addEnvToEvalRuns,
@@ -9437,6 +11072,7 @@ export {
   createA2AApiKeysTable,
   createAgentWebAppsTable,
   createAssistantsTable,
+  createCapabilityBundlesTable,
   createChannelBindingsTable,
   createChannelIdentityMappingTables,
   createChannelInstallationsTable,
@@ -9452,6 +11088,7 @@ export {
   createMetricsConfigsTable,
   createPGVectorStoreProvider,
   createPgStoreConfig,
+  createProjectRoomTables,
   createProjectsTable,
   createScheduledTasksTable,
   createSharedResourcesTable,