@axiom-lattice/pg-stores 3.1.6 → 3.1.9

package/dist/index.js

@@ -37,7 +37,7 @@ __export(index_exports, {
   MenuStore: () => MenuStore,
   MigrationManager: () => MigrationManager,
   PGVectorStoreProvider: () => PGVectorStoreProvider,
-  Pool: () => import_pg29.Pool,
+  Pool: () => import_pg30.Pool,
   PostgreSQLA2AApiKeyStore: () => PostgreSQLA2AApiKeyStore,
   PostgreSQLAgentWebAppStore: () => PostgreSQLAgentWebAppStore,
   PostgreSQLAssistantStore: () => PostgreSQLAssistantStore,
@@ -49,9 +49,11 @@ __export(index_exports, {
   PostgreSQLEvalStore: () => PostgreSQLEvalStore,
   PostgreSQLMcpServerConfigStore: () => PostgreSQLMcpServerConfigStore,
   PostgreSQLMetricsServerConfigStore: () => PostgreSQLMetricsServerConfigStore,
+  PostgreSQLOpenAuditStore: () => PostgreSQLOpenAuditStore,
   PostgreSQLProjectBotMembershipStore: () => PostgreSQLProjectBotMembershipStore,
   PostgreSQLProjectMembershipStore: () => PostgreSQLProjectMembershipStore,
   PostgreSQLProjectRoomMessageStore: () => PostgreSQLProjectRoomMessageStore,
+  PostgreSQLProjectRoomReadStateStore: () => PostgreSQLProjectRoomReadStateStore,
   PostgreSQLProjectRoomStore: () => PostgreSQLProjectRoomStore,
   PostgreSQLProjectStore: () => PostgreSQLProjectStore,
   PostgreSQLScheduleStorage: () => PostgreSQLScheduleStorage,
@@ -104,6 +106,7 @@ __export(index_exports, {
   createMetricsConfigsTable: () => createMetricsConfigsTable,
   createPGVectorStoreProvider: () => createPGVectorStoreProvider,
   createPgStoreConfig: () => createPgStoreConfig,
+  createProjectRoomReadStates: () => createProjectRoomReadStates,
   createProjectRoomTables: () => createProjectRoomTables,
   createProjectsTable: () => createProjectsTable,
   createScheduledTasksTable: () => createScheduledTasksTable,
@@ -122,10 +125,10 @@ __export(index_exports, {
   safeParse: () => safeParse
 });
 module.exports = __toCommonJS(index_exports);
-var import_pg29 = require("pg");
+var import_pg30 = require("pg");
 
 // src/createPgStoreConfig.ts
-var import_pg26 = require("pg");
+var import_pg27 = require("pg");
 
 // src/migrations/migration.ts
 var MigrationManager = class {
@@ -2139,6 +2142,18 @@ var PostgreSQLMcpServerConfigStore = class {
         throw new Error("Failed to decrypt MCP server configuration");
       }
     }
+    if (config.headers && row.is_env_encrypted) {
+      try {
+        const decryptedHeaders = {};
+        for (const [key, value] of Object.entries(config.headers)) {
+          decryptedHeaders[key] = (0, import_core3.decrypt)(value);
+        }
+        config.headers = decryptedHeaders;
+      } catch (error) {
+        console.error("Failed to decrypt MCP server headers:", error);
+        throw new Error("Failed to decrypt MCP server configuration");
+      }
+    }
     return {
       id: row.id,
       tenantId: row.tenant_id,
@@ -2167,6 +2182,14 @@ var PostgreSQLMcpServerConfigStore = class {
       configCopy.env = encryptedEnv;
       isEnvEncrypted = true;
     }
+    if (configCopy.headers && Object.keys(configCopy.headers).length > 0) {
+      const encryptedHeaders = {};
+      for (const [key, value] of Object.entries(configCopy.headers)) {
+        encryptedHeaders[key] = (0, import_core3.encrypt)(value);
+      }
+      configCopy.headers = encryptedHeaders;
+      isEnvEncrypted = true;
+    }
     return { config: configCopy, isEnvEncrypted };
   }
 };
@@ -6233,6 +6256,24 @@ var addA2AKeyAssistantIds = {
   }
 };
 
+// src/migrations/add_api_key_grants.ts
+var addApiKeyGrants = {
+  version: 178,
+  name: "add_api_key_grants",
+  up: async (client) => {
+    await client.query(`
+      ALTER TABLE lattice_a2a_api_keys
+        ADD COLUMN IF NOT EXISTS grants JSONB
+    `);
+  },
+  down: async (client) => {
+    await client.query(`
+      ALTER TABLE lattice_a2a_api_keys
+        DROP COLUMN IF EXISTS grants
+    `);
+  }
+};
+
 // src/stores/PostgreSQLA2AApiKeyStore.ts
 var import_core5 = require("@axiom-lattice/core");
 var import_crypto2 = require("crypto");
@@ -6246,6 +6287,7 @@ function mapRowToRecord(row) {
     tenantId: row.tenant_id,
     projectId: row.project_id,
     assistantIds: row.assistant_ids ?? void 0,
+    grants: row.grants ?? void 0,
     label: row.label || void 0,
     enabled: row.enabled,
     createdAt: row.created_at,
@@ -6269,6 +6311,7 @@ var PostgreSQLA2AApiKeyStore = class {
     this.migrationManager = new MigrationManager(this.pool);
     this.migrationManager.register(createA2AApiKeysTable);
     this.migrationManager.register(addA2AKeyAssistantIds);
+    this.migrationManager.register(addApiKeyGrants);
     if (options.autoMigrate !== false) {
       this.initialize().catch((error) => {
         console.error("Failed to initialize PostgreSQLA2AApiKeyStore:", error);
@@ -6297,13 +6340,28 @@ var PostgreSQLA2AApiKeyStore = class {
   async ensureInitialized() {
     if (!this.initialized) await this.initialize();
   }
+  /** Map rows that decrypt cleanly; skip rows under an unknown key. */
+  safeMap(rows) {
+    const out = [];
+    for (const row of rows) {
+      try {
+        out.push(mapRowToRecord(row));
+      } catch {
+      }
+    }
+    return out;
+  }
   async findByKey(key) {
     await this.ensureInitialized();
     const all = await this.pool.query(
       `SELECT * FROM lattice_a2a_api_keys WHERE enabled = true`
     );
     for (const row of all.rows) {
-      if ((0, import_core5.decrypt)(row.key_value) === key) return mapRowToRecord(row);
+      try {
+        if ((0, import_core5.decrypt)(row.key_value) === key) return mapRowToRecord(row);
+      } catch {
+        continue;
+      }
     }
     return null;
   }
@@ -6313,7 +6371,12 @@ var PostgreSQLA2AApiKeyStore = class {
       `SELECT * FROM lattice_a2a_api_keys WHERE id = $1`,
       [id]
     );
-    return result.rows[0] ? mapRowToRecord(result.rows[0]) : null;
+    if (!result.rows[0]) return null;
+    try {
+      return mapRowToRecord(result.rows[0]);
+    } catch {
+      return null;
+    }
   }
   async list(params) {
     await this.ensureInitialized();
@@ -6324,26 +6387,67 @@ var PostgreSQLA2AApiKeyStore = class {
         `SELECT * FROM lattice_a2a_api_keys WHERE tenant_id = $1 ORDER BY created_at DESC LIMIT $2 OFFSET $3`,
         [params.tenantId, limit, offset]
       );
-      return result2.rows.map(mapRowToRecord);
+      return this.safeMap(result2.rows);
     }
     const result = await this.pool.query(
       `SELECT * FROM lattice_a2a_api_keys ORDER BY created_at DESC LIMIT $1 OFFSET $2`,
       [limit, offset]
     );
-    return result.rows.map(mapRowToRecord);
+    return this.safeMap(result.rows);
   }
   async create(input) {
     await this.ensureInitialized();
     const key = generateApiKey();
     const result = await this.pool.query(
-      `INSERT INTO lattice_a2a_api_keys (key_value, tenant_id, project_id, assistant_ids, label)
-       VALUES ($1, $2, $3, $4, $5) RETURNING *`,
-      [(0, import_core5.encrypt)(key), input.tenantId, input.projectId, input.assistantIds ? JSON.stringify(input.assistantIds) : null, input.label || null]
+      `INSERT INTO lattice_a2a_api_keys (key_value, tenant_id, project_id, assistant_ids, grants, label)
+       VALUES ($1, $2, $3, $4, $5, $6) RETURNING *`,
+      [
+        (0, import_core5.encrypt)(key),
+        input.tenantId,
+        input.projectId,
+        input.assistantIds ? JSON.stringify(input.assistantIds) : null,
+        input.grants ? JSON.stringify(input.grants) : null,
+        input.label || null
+      ]
     );
     const record = mapRowToRecord(result.rows[0]);
     record.key = key;
     return record;
   }
+  async update(id, input) {
+    await this.ensureInitialized();
+    const sets = [];
+    const values = [];
+    if (input.label !== void 0) {
+      values.push(input.label || null);
+      sets.push(`label = $${values.length}`);
+    }
+    if (input.projectId !== void 0) {
+      values.push(input.projectId);
+      sets.push(`project_id = $${values.length}`);
+    }
+    if (input.assistantIds !== void 0) {
+      values.push(input.assistantIds ? JSON.stringify(input.assistantIds) : null);
+      sets.push(`assistant_ids = $${values.length}`);
+    }
+    if (input.grants !== void 0) {
+      values.push(input.grants ? JSON.stringify(input.grants) : null);
+      sets.push(`grants = $${values.length}`);
+    }
+    if (sets.length === 0) {
+      const existing = await this.findById(id);
+      if (!existing) throw new Error(`A2A API key not found: ${id}`);
+      return existing;
+    }
+    sets.push("updated_at = NOW()");
+    values.push(id);
+    const result = await this.pool.query(
+      `UPDATE lattice_a2a_api_keys SET ${sets.join(", ")} WHERE id = $${values.length} RETURNING *`,
+      values
+    );
+    if (result.rows.length === 0) throw new Error(`A2A API key not found: ${id}`);
+    return mapRowToRecord(result.rows[0]);
+  }
   async disable(id) {
     await this.ensureInitialized();
     const result = await this.pool.query(
@@ -6385,21 +6489,173 @@ var PostgreSQLA2AApiKeyStore = class {
     );
     const map2 = /* @__PURE__ */ new Map();
     for (const row of result.rows) {
-      const key = (0, import_core5.decrypt)(row.key_value);
-      map2.set(key, {
-        key,
-        tenantId: row.tenant_id,
-        projectId: row.project_id,
-        assistantIds: row.assistant_ids ?? void 0
-      });
+      try {
+        const key = (0, import_core5.decrypt)(row.key_value);
+        map2.set(key, {
+          key,
+          tenantId: row.tenant_id,
+          projectId: row.project_id,
+          assistantIds: row.assistant_ids ?? void 0,
+          grants: row.grants ?? void 0
+        });
+      } catch {
+      }
     }
     return map2;
   }
 };
 
+// src/stores/PostgreSQLOpenAuditStore.ts
+var import_pg17 = require("pg");
+
+// src/migrations/create_open_audit_table.ts
+var createOpenAuditTable = {
+  version: 179,
+  name: "create_open_audit_table",
+  up: async (client) => {
+    await client.query(`
+      CREATE TABLE IF NOT EXISTS lattice_open_audit (
+        id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+        tenant_id VARCHAR(255) NOT NULL,
+        credential_id VARCHAR(255) NOT NULL,
+        credential_kind VARCHAR(32) NOT NULL,
+        project_id VARCHAR(255) NOT NULL,
+        domain VARCHAR(255) NOT NULL,
+        action VARCHAR(255) NOT NULL,
+        args JSONB,
+        status VARCHAR(16) NOT NULL,
+        error_code VARCHAR(64),
+        duration_ms INTEGER NOT NULL,
+        created_at TIMESTAMP NOT NULL DEFAULT NOW()
+      )
+    `);
+    await client.query(`
+      CREATE INDEX IF NOT EXISTS idx_lattice_open_audit_tenant_created
+      ON lattice_open_audit(tenant_id, created_at DESC)
+    `);
+  },
+  down: async (client) => {
+    await client.query("DROP TABLE IF EXISTS lattice_open_audit");
+  }
+};
+
+// src/stores/PostgreSQLOpenAuditStore.ts
+var PostgreSQLOpenAuditStore = class {
+  constructor(options) {
+    this.initialized = false;
+    this.ownsPool = true;
+    this.initPromise = null;
+    if (options.pool) {
+      this.pool = options.pool;
+      this.ownsPool = false;
+      this.initialized = true;
+      return;
+    }
+    this.pool = typeof options.poolConfig === "string" ? new import_pg17.Pool({ connectionString: options.poolConfig }) : options.poolConfig ? new import_pg17.Pool(options.poolConfig) : (() => {
+      throw new Error("Either pool or poolConfig must be provided");
+    })();
+    this.migrationManager = new MigrationManager(this.pool);
+    this.migrationManager.register(createOpenAuditTable);
+    if (options.autoMigrate !== false) {
+      this.initialize().catch((error) => {
+        console.error("Failed to initialize PostgreSQLOpenAuditStore:", error);
+        throw error;
+      });
+    }
+  }
+  async initialize() {
+    if (this.initialized) return;
+    if (this.initPromise) return this.initPromise;
+    this.initPromise = (async () => {
+      try {
+        await this.migrationManager.migrate();
+        this.initialized = true;
+      } finally {
+        this.initPromise = null;
+      }
+    })();
+    return this.initPromise;
+  }
+  async dispose() {
+    if (this.ownsPool && this.pool) await this.pool.end();
+  }
+  async ensureInitialized() {
+    if (!this.initialized) await this.initialize();
+  }
+  async query(params) {
+    await this.ensureInitialized();
+    const clauses = ["tenant_id = $1"];
+    const values = [params.tenantId];
+    if (params.credentialId) {
+      values.push(params.credentialId);
+      clauses.push(`credential_id = $${values.length}`);
+    }
+    if (params.domain) {
+      values.push(params.domain);
+      clauses.push(`domain = $${values.length}`);
+    }
+    if (params.status) {
+      values.push(params.status);
+      clauses.push(`status = $${values.length}`);
+    }
+    if (params.from) {
+      values.push(params.from);
+      clauses.push(`created_at >= $${values.length}`);
+    }
+    if (params.to) {
+      values.push(params.to);
+      clauses.push(`created_at < $${values.length}`);
+    }
+    const limit = params.limit ?? 100;
+    const offset = params.offset ?? 0;
+    values.push(limit, offset);
+    const { rows } = await this.pool.query(
+      `SELECT * FROM lattice_open_audit
+       WHERE ${clauses.join(" AND ")}
+       ORDER BY created_at DESC
+       LIMIT $${values.length - 1} OFFSET $${values.length}`,
+      values
+    );
+    return rows.map((row) => ({
+      id: row.id,
+      tenantId: row.tenant_id,
+      credentialId: row.credential_id,
+      credentialKind: row.credential_kind,
+      projectId: row.project_id,
+      domain: row.domain,
+      action: row.action,
+      args: row.args,
+      status: row.status,
+      errorCode: row.error_code ?? void 0,
+      durationMs: row.duration_ms,
+      createdAt: row.created_at
+    }));
+  }
+  async append(record) {
+    await this.ensureInitialized();
+    await this.pool.query(
+      `INSERT INTO lattice_open_audit
+        (tenant_id, credential_id, credential_kind, project_id, domain, action, args, status, error_code, duration_ms)
+       VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10)`,
+      [
+        record.tenantId,
+        record.credentialId,
+        record.credentialKind,
+        record.projectId,
+        record.domain,
+        record.action,
+        record.args === void 0 ? null : JSON.stringify(record.args),
+        record.status,
+        record.errorCode ?? null,
+        Math.max(0, Math.round(record.durationMs))
+      ]
+    );
+  }
+};
+
 // src/stores/PostgreSQLAgentWebAppStore.ts
 var import_crypto3 = require("crypto");
-var import_pg17 = require("pg");
+var import_pg18 = require("pg");
 
 // src/migrations/agent_web_apps_migration.ts
 var createAgentWebAppsTable = {
@@ -6512,7 +6768,7 @@ var PostgreSQLAgentWebAppStore = class {
       this.initialized = true;
       return;
     }
-    this.pool = typeof options.poolConfig === "string" ? new import_pg17.Pool({ connectionString: options.poolConfig }) : options.poolConfig ? new import_pg17.Pool(options.poolConfig) : (() => {
+    this.pool = typeof options.poolConfig === "string" ? new import_pg18.Pool({ connectionString: options.poolConfig }) : options.poolConfig ? new import_pg18.Pool(options.poolConfig) : (() => {
       throw new Error("Either pool or poolConfig must be provided");
     })();
     this.migrationManager = new MigrationManager(this.pool);
@@ -6651,7 +6907,7 @@ var PostgreSQLAgentWebAppStore = class {
 };
 
 // src/stores/PostgreSQLScheduleStorage.ts
-var import_pg18 = require("pg");
+var import_pg19 = require("pg");
 var import_protocols4 = require("@axiom-lattice/protocols");
 
 // src/migrations/schedule_migrations.ts
@@ -6826,9 +7082,9 @@ var PostgreSQLScheduleStorage = class {
       return;
     }
     if (typeof options.poolConfig === "string") {
-      this.pool = new import_pg18.Pool({ connectionString: options.poolConfig });
+      this.pool = new import_pg19.Pool({ connectionString: options.poolConfig });
     } else if (options.poolConfig) {
-      this.pool = new import_pg18.Pool(options.poolConfig);
+      this.pool = new import_pg19.Pool(options.poolConfig);
     } else {
       throw new Error("Either pool or poolConfig must be provided");
     }
@@ -7266,7 +7522,7 @@ var PostgreSQLScheduleStorage = class {
 };
 
 // src/stores/PostgreSQLTaskStore.ts
-var import_pg19 = require("pg");
+var import_pg20 = require("pg");
 
 // src/migrations/task_migration.ts
 var createTasksTable = {
@@ -7481,9 +7737,9 @@ var PostgreSQLTaskStore = class {
       return;
     }
     if (typeof options.poolConfig === "string") {
-      this.pool = new import_pg19.Pool({ connectionString: options.poolConfig });
+      this.pool = new import_pg20.Pool({ connectionString: options.poolConfig });
     } else if (options.poolConfig) {
-      this.pool = new import_pg19.Pool(options.poolConfig);
+      this.pool = new import_pg20.Pool(options.poolConfig);
     } else {
       throw new Error("Either pool or poolConfig must be provided");
     }
@@ -8223,7 +8479,7 @@ var PostgreSQLTaskStore = class {
 };
 
 // src/stores/PostgreSQLTaskWorkItemStore.ts
-var import_pg20 = require("pg");
+var import_pg21 = require("pg");
 var import_protocols5 = require("@axiom-lattice/protocols");
 var import_uuid4 = require("uuid");
 
@@ -8357,7 +8613,7 @@ var PostgreSQLTaskWorkItemStore = class {
       this.initialized = true;
       return;
     }
-    this.pool = typeof options.poolConfig === "string" ? new import_pg20.Pool({ connectionString: options.poolConfig }) : options.poolConfig ? new import_pg20.Pool(options.poolConfig) : (() => {
+    this.pool = typeof options.poolConfig === "string" ? new import_pg21.Pool({ connectionString: options.poolConfig }) : options.poolConfig ? new import_pg21.Pool(options.poolConfig) : (() => {
       throw new Error("Either pool or poolConfig must be provided");
     })();
     this.ownsPool = true;
@@ -8610,7 +8866,7 @@ var PostgreSQLTaskWorkItemStore = class {
 };
 
 // src/stores/MenuStore.ts
-var import_pg21 = require("pg");
+var import_pg22 = require("pg");
 
 // src/migrations/menu_items_migration.ts
 var createMenuItemsTable = {
@@ -8687,7 +8943,7 @@ var MenuStore = class {
       this.initialized = true;
       return;
     }
-    this.pool = typeof options.poolConfig === "string" ? new import_pg21.Pool({ connectionString: options.poolConfig }) : options.poolConfig ? new import_pg21.Pool(options.poolConfig) : (() => {
+    this.pool = typeof options.poolConfig === "string" ? new import_pg22.Pool({ connectionString: options.poolConfig }) : options.poolConfig ? new import_pg22.Pool(options.poolConfig) : (() => {
       throw new Error("Either pool or poolConfig must be provided");
     })();
     this.migrationManager = new MigrationManager(this.pool);
@@ -8842,7 +9098,7 @@ var MenuStore = class {
 };
 
 // src/stores/PostgresSharedResourceStore.ts
-var import_pg22 = require("pg");
+var import_pg23 = require("pg");
 
 // src/migrations/shared_resources_migration.ts
 var createSharedResourcesTable = {
@@ -8896,7 +9152,7 @@ var PostgresSharedResourceStore = class {
       this.initialized = true;
       return;
     }
-    this.pool = typeof options.poolConfig === "string" ? new import_pg22.Pool({ connectionString: options.poolConfig }) : options.poolConfig ? new import_pg22.Pool(options.poolConfig) : (() => {
+    this.pool = typeof options.poolConfig === "string" ? new import_pg23.Pool({ connectionString: options.poolConfig }) : options.poolConfig ? new import_pg23.Pool(options.poolConfig) : (() => {
       throw new Error("Either pool or poolConfig must be provided");
     })();
     this.migrationManager = new MigrationManager(this.pool);
@@ -8944,8 +9200,8 @@ var PostgresSharedResourceStore = class {
       `INSERT INTO lattice_shared_resources
        (token, address, title, created_by, tenant_id, workspace_id, project_id,
         assistant_id, vm_isolation, visibility, password_hash,
-        expires_at, max_access, revoked)
-       VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12,$13,$14)
+        expires_at, max_access, open_grants, revoked)
+       VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12,$13,$14,$15)
        RETURNING *`,
       [
         record.token,
@@ -8961,6 +9217,7 @@ var PostgresSharedResourceStore = class {
         record.passwordHash,
         record.expiresAt ? record.expiresAt.toISOString() : null,
         record.maxAccess,
+        record.openGrants ? JSON.stringify(record.openGrants) : null,
         record.revoked
       ]
     );
@@ -9056,6 +9313,7 @@ var PostgresSharedResourceStore = class {
       passwordHash: row.password_hash,
       expiresAt: row.expires_at ? new Date(row.expires_at) : null,
       maxAccess: row.max_access,
+      openGrants: row.open_grants ?? void 0,
       accessCount: row.access_count ?? 0,
       revoked: row.revoked ?? false,
       createdAt: new Date(row.created_at),
@@ -9065,7 +9323,7 @@ var PostgresSharedResourceStore = class {
 };
 
 // src/stores/PostgreSQLCollectionStore.ts
-var import_pg23 = require("pg");
+var import_pg24 = require("pg");
 var PostgreSQLCollectionStore = class {
   constructor(options) {
     this.initialized = false;
@@ -9078,9 +9336,9 @@ var PostgreSQLCollectionStore = class {
       return;
     }
     if (typeof options.poolConfig === "string") {
-      this.pool = new import_pg23.Pool({ connectionString: options.poolConfig });
+      this.pool = new import_pg24.Pool({ connectionString: options.poolConfig });
     } else if (options.poolConfig) {
-      this.pool = new import_pg23.Pool(options.poolConfig);
+      this.pool = new import_pg24.Pool(options.poolConfig);
     } else {
       throw new Error("Either pool or poolConfig must be provided");
     }
@@ -9195,7 +9453,7 @@ var PostgreSQLCollectionStore = class {
 var import_langgraph_checkpoint_postgres = require("@langchain/langgraph-checkpoint-postgres");
 
 // src/PGVectorStoreProvider.ts
-var import_pg24 = require("pg");
+var import_pg25 = require("pg");
 var import_pgvector = require("@langchain/community/vectorstores/pgvector");
 var import_documents = require("@langchain/core/documents");
 var import_core6 = require("@axiom-lattice/core");
@@ -9269,7 +9527,7 @@ var PGVectorStoreProvider = class {
   }
 };
 function createPGVectorStoreProvider(connectionString) {
-  const pool = new import_pg24.Pool({ connectionString });
+  const pool = new import_pg25.Pool({ connectionString });
   return {
     provider: new PGVectorStoreProvider(pool, connectionString),
     pool
@@ -9524,6 +9782,24 @@ var createConnectionConfigsTable = {
   }
 };
 
+// src/migrations/add_share_open_grants.ts
+var addShareOpenGrants = {
+  version: 180,
+  name: "add_share_open_grants",
+  up: async (client) => {
+    await client.query(`
+      ALTER TABLE lattice_shared_resources
+        ADD COLUMN IF NOT EXISTS open_grants JSONB
+    `);
+  },
+  down: async (client) => {
+    await client.query(`
+      ALTER TABLE lattice_shared_resources
+        DROP COLUMN IF EXISTS open_grants
+    `);
+  }
+};
+
 // src/migrations/collection_migrations.ts
 var createCollectionsTable = {
   version: 137,
@@ -9700,10 +9976,34 @@ var createProjectRoomTables = {
     await client.query("DROP TABLE IF EXISTS lattice_project_rooms");
   }
 };
+var createProjectRoomReadStates = {
+  version: 177,
+  name: "create_project_room_read_states",
+  up: async (client) => {
+    await client.query(`
+      CREATE TABLE IF NOT EXISTS lattice_project_room_read_states (
+        tenant_id VARCHAR(255) NOT NULL,
+        room_id VARCHAR(255) NOT NULL,
+        user_id VARCHAR(255) NOT NULL,
+        last_read_at TIMESTAMPTZ NOT NULL,
+        updated_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+        PRIMARY KEY (tenant_id, room_id, user_id)
+      )
+    `);
+    await client.query(`
+      CREATE INDEX IF NOT EXISTS idx_lattice_project_room_read_states_user
+      ON lattice_project_room_read_states (tenant_id, user_id)
+    `);
+  },
+  down: async (client) => {
+    await client.query("DROP INDEX IF EXISTS idx_lattice_project_room_read_states_user");
+    await client.query("DROP TABLE IF EXISTS lattice_project_room_read_states");
+  }
+};
 
 // src/stores/PostgreSQLCapabilityBundleStore.ts
 var import_crypto4 = require("crypto");
-var import_pg25 = require("pg");
+var import_pg26 = require("pg");
 var duplicateMessage = "Capability bundle key already exists for tenant";
 function map(row) {
   return {
@@ -9736,7 +10036,7 @@ var PostgreSQLCapabilityBundleStore = class {
       this.initialized = true;
       return;
     }
-    this.pool = typeof options.poolConfig === "string" ? new import_pg25.Pool({ connectionString: options.poolConfig }) : options.poolConfig ? new import_pg25.Pool(options.poolConfig) : (() => {
+    this.pool = typeof options.poolConfig === "string" ? new import_pg26.Pool({ connectionString: options.poolConfig }) : options.poolConfig ? new import_pg26.Pool(options.poolConfig) : (() => {
       throw new Error("Either pool or poolConfig must be provided");
     })();
     this.migrationManager = new MigrationManager(this.pool);
@@ -10412,6 +10712,22 @@ function mapRow5(row) {
     createdAt: row.created_at
   };
 }
+function mapRowsTolerant(rows, scope) {
+  const messages = [];
+  for (const row of rows) {
+    try {
+      messages.push(mapRow5(row));
+    } catch (error) {
+      console.warn("[ProjectRoomMessageStore] Skipping invalid message row", {
+        tenantId: scope.tenantId,
+        roomId: scope.roomId,
+        rowId: typeof row.id === "string" ? row.id : void 0,
+        reason: error instanceof Error ? error.message : String(error)
+      });
+    }
+  }
+  return messages;
+}
 function isUniqueViolation2(error) {
   return typeof error === "object" && error !== null && "code" in error && error.code === "23505";
 }
@@ -10477,7 +10793,7 @@ var PostgreSQLProjectRoomMessageStore = class {
          WHERE tenant_id = $1 AND room_id = $2 ORDER BY created_at DESC, id DESC LIMIT $3`,
       [input.tenantId, input.roomId, limit]
     );
-    return result.rows.map(mapRow5);
+    return mapRowsTolerant(result.rows, { tenantId: input.tenantId, roomId: input.roomId });
   }
   /** Finds a message by tenant-scoped ID. */
   async findById(tenantId, id) {
@@ -10487,6 +10803,19 @@ var PostgreSQLProjectRoomMessageStore = class {
     );
     return result.rows[0] ? mapRow5(result.rows[0]) : null;
   }
+  /** Counts messages created strictly after a horizon, optionally excluding one human author. */
+  async countAfter(input) {
+    if (!(input.after instanceof Date) || Number.isNaN(input.after.getTime())) {
+      throw new RangeError("Project room message count horizon date is invalid");
+    }
+    const result = await this.pool.query(
+      `SELECT COUNT(*)::int AS count FROM lattice_project_room_messages
+       WHERE tenant_id = $1 AND room_id = $2 AND created_at > $3
+         AND ($4::text IS NULL OR author->>'type' <> 'human' OR author->>'userId' <> $4)`,
+      [input.tenantId, input.roomId, input.after, input.excludeAuthorUserId ?? null]
+    );
+    return result.rows[0]?.count ?? 0;
+  }
   parameters(input) {
     return [
       input.id,
@@ -10505,9 +10834,48 @@ var PostgreSQLProjectRoomMessageStore = class {
   }
 };
 
+// src/stores/PostgreSQLProjectRoomReadStateStore.ts
+function mapRow6(row) {
+  if (typeof row.tenant_id !== "string" || typeof row.room_id !== "string" || typeof row.user_id !== "string" || !(row.last_read_at instanceof Date) || Number.isNaN(row.last_read_at.getTime()) || !(row.updated_at instanceof Date) || Number.isNaN(row.updated_at.getTime())) {
+    throw new Error("Invalid project room read state row");
+  }
+  return { tenantId: row.tenant_id, roomId: row.room_id, userId: row.user_id, lastReadAt: row.last_read_at, updatedAt: row.updated_at };
+}
+var PostgreSQLProjectRoomReadStateStore = class {
+  /** Creates a store using an externally managed shared pool. */
+  constructor(options) {
+    this.pool = options.pool;
+  }
+  /** Returns the user's read marker for a room, or null when never reported. */
+  async get(tenantId, roomId, userId) {
+    const result = await this.pool.query(
+      `SELECT tenant_id, room_id, user_id, last_read_at, updated_at
+       FROM lattice_project_room_read_states WHERE tenant_id = $1 AND room_id = $2 AND user_id = $3`,
+      [tenantId, roomId, userId]
+    );
+    return result.rows[0] ? mapRow6(result.rows[0]) : null;
+  }
+  /** Upserts the marker monotonically using GREATEST so older reports never regress it. */
+  async markRead(input) {
+    if (!(input.lastReadAt instanceof Date) || Number.isNaN(input.lastReadAt.getTime())) {
+      throw new RangeError("Project room read state lastReadAt is invalid");
+    }
+    const result = await this.pool.query(
+      `INSERT INTO lattice_project_room_read_states (tenant_id, room_id, user_id, last_read_at, updated_at)
+       VALUES ($1, $2, $3, $4, NOW())
+       ON CONFLICT (tenant_id, room_id, user_id) DO UPDATE
+         SET last_read_at = GREATEST(lattice_project_room_read_states.last_read_at, EXCLUDED.last_read_at),
+             updated_at = NOW()
+       RETURNING tenant_id, room_id, user_id, last_read_at, updated_at`,
+      [input.tenantId, input.roomId, input.userId, input.lastReadAt]
+    );
+    return mapRow6(result.rows[0]);
+  }
+};
+
 // src/createPgStoreConfig.ts
 async function createPgStoreConfig(connectionString) {
-  const pool = new import_pg26.Pool({ connectionString });
+  const pool = new import_pg27.Pool({ connectionString });
   const mm = new MigrationManager(pool);
   mm.register(createThreadsTable);
   mm.register(createScheduledTasksTable);
@@ -10560,6 +10928,9 @@ async function createPgStoreConfig(connectionString) {
   mm.register(addWorkflowRunsTenantStatusUpdatedIndex);
   mm.register(addProjectKindColumn);
   mm.register(addA2AKeyAssistantIds);
+  mm.register(addApiKeyGrants);
+  mm.register(createOpenAuditTable);
+  mm.register(addShareOpenGrants);
   mm.register(addTaskWorkItemEventKeyMigration);
   mm.register(createAgentWebAppsTable);
   mm.register(createCapabilityBundlesTable);
@@ -10568,6 +10939,7 @@ async function createPgStoreConfig(connectionString) {
   mm.register(addTrustedRunContextColumn);
   mm.register(addProjectLifecycleEventIndex);
   mm.register(addAgentWebAppsIdentity);
+  mm.register(createProjectRoomReadStates);
   await mm.migrate();
   const checkpoint = import_langgraph_checkpoint_postgres.PostgresSaver.fromConnString(connectionString);
   checkpoint.setup().catch((err) => {
@@ -10595,6 +10967,7 @@ async function createPgStoreConfig(connectionString) {
     task: new PostgreSQLTaskStore(opts),
     taskWorkItem: taskWorkItemStore,
     a2aApiKey: new PostgreSQLA2AApiKeyStore(opts),
+    openAudit: new PostgreSQLOpenAuditStore(opts),
     agentWebApp: new PostgreSQLAgentWebAppStore(opts),
     capabilityBundle: new PostgreSQLCapabilityBundleStore(opts),
     schedule: new PostgreSQLScheduleStorage(opts),
@@ -10605,13 +10978,14 @@ async function createPgStoreConfig(connectionString) {
     projectMembership: new PostgreSQLProjectMembershipStore(opts),
     projectBotMembership: new PostgreSQLProjectBotMembershipStore(opts),
     projectRoomMessage: new PostgreSQLProjectRoomMessageStore(opts),
+    projectRoomReadState: new PostgreSQLProjectRoomReadStateStore(opts),
     vectorStoreProvider: new PGVectorStoreProvider(pool, connectionString),
     checkpoint
   };
 }
 
 // src/stores/PostgreSQLSkillStore.ts
-var import_pg27 = require("pg");
+var import_pg28 = require("pg");
 var PostgreSQLSkillStore = class {
   constructor(options) {
     this.initialized = false;
@@ -10624,9 +10998,9 @@ var PostgreSQLSkillStore = class {
       return;
     }
     if (typeof options.poolConfig === "string") {
-      this.pool = new import_pg27.Pool({ connectionString: options.poolConfig });
+      this.pool = new import_pg28.Pool({ connectionString: options.poolConfig });
     } else if (options.poolConfig) {
-      this.pool = new import_pg27.Pool(options.poolConfig);
+      this.pool = new import_pg28.Pool(options.poolConfig);
     } else {
       throw new Error("Either pool or poolConfig must be provided");
     }
@@ -10927,7 +11301,7 @@ var PostgreSQLSkillStore = class {
 };
 
 // src/stores/ChannelIdentityMappingStore.ts
-var import_pg28 = require("pg");
+var import_pg29 = require("pg");
 var ChannelIdentityMappingStore = class {
   constructor(options) {
     this.initialized = false;
@@ -10939,7 +11313,7 @@ var ChannelIdentityMappingStore = class {
       this.initialized = true;
       return;
     }
-    this.pool = typeof options.poolConfig === "string" ? new import_pg28.Pool({ connectionString: options.poolConfig }) : options.poolConfig ? new import_pg28.Pool(options.poolConfig) : (() => {
+    this.pool = typeof options.poolConfig === "string" ? new import_pg29.Pool({ connectionString: options.poolConfig }) : options.poolConfig ? new import_pg29.Pool(options.poolConfig) : (() => {
       throw new Error("Either pool or poolConfig must be provided");
     })();
     this.migrationManager = new MigrationManager(this.pool);
@@ -11178,9 +11552,11 @@ function mapRowToChannelIdentityMapping(row) {
   PostgreSQLEvalStore,
   PostgreSQLMcpServerConfigStore,
   PostgreSQLMetricsServerConfigStore,
+  PostgreSQLOpenAuditStore,
   PostgreSQLProjectBotMembershipStore,
   PostgreSQLProjectMembershipStore,
   PostgreSQLProjectRoomMessageStore,
+  PostgreSQLProjectRoomReadStateStore,
   PostgreSQLProjectRoomStore,
   PostgreSQLProjectStore,
   PostgreSQLScheduleStorage,
@@ -11233,6 +11609,7 @@ function mapRowToChannelIdentityMapping(row) {
   createMetricsConfigsTable,
   createPGVectorStoreProvider,
   createPgStoreConfig,
+  createProjectRoomReadStates,
   createProjectRoomTables,
   createProjectsTable,
   createScheduledTasksTable,