@axiom-lattice/pg-stores 3.1.6 → 3.1.9

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@axiom-lattice/pg-stores",
-  "version": "3.1.6",
+  "version": "3.1.9",
   "description": "PG stores implementation for Axiom Lattice framework",
   "main": "dist/index.js",
   "module": "dist/index.mjs",
@@ -25,8 +25,8 @@
     "@langchain/core": "1.1.30",
     "pg": "^8.16.3",
     "uuid": "^9.0.1",
-    "@axiom-lattice/core": "4.2.6",
-    "@axiom-lattice/protocols": "4.1.4"
+    "@axiom-lattice/core": "4.2.9",
+    "@axiom-lattice/protocols": "4.2.1"
   },
   "devDependencies": {
     "@types/jest": "^29.5.14",

package/src/__tests__/PostgreSQLA2AApiKeyStore.migrations.test.ts

@@ -55,7 +55,7 @@ describe("PostgreSQLA2AApiKeyStore standalone migrations", () => {
     mockClientSql.length = 0;
   });
 
-  it("registers and applies both the table and assistant_ids migrations", async () => {
+  it("registers and applies the table, assistant_ids, and grants migrations", async () => {
     const store = new PostgreSQLA2AApiKeyStore({
       poolConfig: "postgres://unused",
       autoMigrate: false,
@@ -66,6 +66,7 @@ describe("PostgreSQLA2AApiKeyStore standalone migrations", () => {
     expect(mockRecordedMigrationNames).toEqual([
       "create_a2a_api_keys_table",
       "add_a2a_key_assistant_ids",
+      "add_api_key_grants",
     ]);
     expect(
       mockClientSql.some((sql) => sql.includes("ADD COLUMN IF NOT EXISTS assistant_ids")),

package/src/__tests__/PostgreSQLA2AApiKeyStore.test.ts

@@ -131,3 +131,48 @@ describe("PostgreSQLA2AApiKeyStore", () => {
     expect("workspaceId" in (entry ?? {})).toBe(false);
   });
 });
+
+describe("PostgreSQLA2AApiKeyStore grants column", () => {
+  const pool2 = { query: mockQuery } as unknown as Pool;
+
+  beforeEach(() => {
+    jest.clearAllMocks();
+  });
+
+  it("create persists grants as JSON", async () => {
+    const store = new PostgreSQLA2AApiKeyStore({ pool: pool2 });
+    const grants = [{ domain: "kb", items: ["search"] }];
+    mockQuery.mockResolvedValueOnce({
+      rows: [{
+        id: "k1", key_value: "enc:a2a_x", tenant_id: "t1", project_id: "p1",
+        assistant_ids: null, grants, label: null, enabled: true,
+        created_at: new Date("2026-01-01T00:00:00.000Z"),
+        updated_at: new Date("2026-01-01T00:00:00.000Z"),
+      }],
+    });
+
+    const record = await store.create({
+      tenantId: "t1", projectId: "p1", grants,
+    });
+
+    const [sql, params] = mockQuery.mock.calls[0] as [string, unknown[]];
+    expect(sql).toContain("grants");
+    expect(params[4]).toBe(JSON.stringify(grants));
+    expect(record.grants).toEqual(grants);
+  });
+
+  it("mapRowToRecord projects grants back", async () => {
+    const store = new PostgreSQLA2AApiKeyStore({ pool: pool2 });
+    const grants = [{ domain: "kb" }];
+    mockQuery.mockResolvedValueOnce({
+      rows: [{
+        id: "k1", key_value: "enc:a2a_x", tenant_id: "t1", project_id: "p1",
+        assistant_ids: null, grants, label: null, enabled: true,
+        created_at: new Date("2026-01-01T00:00:00.000Z"),
+        updated_at: new Date("2026-01-01T00:00:00.000Z"),
+      }],
+    });
+    const record = await store.findById("k1");
+    expect(record?.grants).toEqual(grants);
+  });
+});

package/src/__tests__/PostgreSQLMcpServerConfigStore.test.ts

@@ -0,0 +1,79 @@
+import { describe, expect, it } from "@jest/globals";
+import type { Pool } from "pg";
+
+// The @axiom-lattice/core barrel cannot load under jest in this package (ESM-only
+// transitive deps), so mock it with the real encryption module — node:crypto only.
+jest.mock("@axiom-lattice/core", () => ({
+  ...jest.requireActual("../../../core/src/util/encryption"),
+}));
+
+import { PostgreSQLMcpServerConfigStore } from "../stores/PostgreSQLMcpServerConfigStore";
+
+const makeRow = (configJson: string, isEnvEncrypted: boolean) => ({
+  id: "cfg-1",
+  tenant_id: "tenant-1",
+  key: "remote",
+  name: null,
+  description: null,
+  config: configJson,
+  selected_tools: [],
+  is_env_encrypted: isEnvEncrypted,
+  status: "disconnected",
+  created_at: new Date(),
+  updated_at: new Date(),
+});
+
+describe("PostgreSQLMcpServerConfigStore header encryption", () => {
+  it("encrypts header values at rest and decrypts on read", async () => {
+    let storedConfig = "";
+    let storedFlag = false;
+    const query = jest.fn(async (sql: string, values: unknown[]) => {
+      if (sql.includes("INSERT INTO lattice_mcp_server_configs")) {
+        storedConfig = values[5] as string;
+        storedFlag = values[7] as boolean;
+        return { rowCount: 1 };
+      }
+      if (sql.includes("SELECT id, tenant_id, key")) {
+        return { rows: [makeRow(storedConfig, storedFlag)] };
+      }
+      return { rows: [] };
+    });
+    const store = new PostgreSQLMcpServerConfigStore({ pool: { query } as unknown as Pool });
+
+    await store.createConfig("tenant-1", "cfg-1", {
+      key: "remote",
+      config: {
+        name: "remote",
+        version: "1.0.0",
+        transport: "streamable_http",
+        url: "https://mcp.example.com/mcp",
+        headers: { Authorization: "Bearer sk-secret-token" },
+      },
+    });
+
+    expect(storedFlag).toBe(true);
+    const atRest = JSON.parse(storedConfig);
+    expect(atRest.headers.Authorization).not.toBe("Bearer sk-secret-token");
+
+    const read = await store.getConfigByKey("tenant-1", "remote");
+    expect(read?.config.headers?.Authorization).toBe("Bearer sk-secret-token");
+    expect(read?.config.headers?.Authorization).not.toBe(atRest.headers.Authorization);
+  });
+
+  it("leaves legacy rows without headers untouched", async () => {
+    const legacyConfig = JSON.stringify({
+      name: "legacy", version: "1.0.0", transport: "stdio", command: "npx",
+    });
+    const query = jest.fn(async (sql: string) => {
+      if (sql.includes("SELECT id, tenant_id, key")) {
+        return { rows: [makeRow(legacyConfig, false)] };
+      }
+      return { rows: [] };
+    });
+    const store = new PostgreSQLMcpServerConfigStore({ pool: { query } as unknown as Pool });
+
+    const read = await store.getConfigByKey("tenant-1", "remote");
+    expect(read?.config.headers).toBeUndefined();
+    expect(read?.config.command).toBe("npx");
+  });
+});

package/src/__tests__/PostgreSQLOpenAuditStore.test.ts

@@ -0,0 +1,100 @@
+import { describe, expect, it, jest, beforeEach } from "@jest/globals";
+import type { Pool } from "pg";
+
+const mockQuery = jest.fn();
+import { PostgreSQLOpenAuditStore } from "../stores/PostgreSQLOpenAuditStore";
+
+const pool = { query: mockQuery } as unknown as Pool;
+
+describe("PostgreSQLOpenAuditStore", () => {
+  beforeEach(() => jest.clearAllMocks());
+
+  it("append inserts a row with JSON args", async () => {
+    const store = new PostgreSQLOpenAuditStore({ pool });
+    mockQuery.mockResolvedValueOnce({ rows: [] });
+    await store.append({
+      tenantId: "t1",
+      credentialId: "k1",
+      credentialKind: "api_key",
+      projectId: "p1",
+      domain: "kb",
+      action: "search",
+      args: { query: "x" },
+      status: "ok",
+      durationMs: 12.7,
+    });
+    const [sql, params] = mockQuery.mock.calls[0] as [string, unknown[]];
+    expect(sql).toContain("INSERT INTO lattice_open_audit");
+    expect(params[6]).toBe(JSON.stringify({ query: "x" }));
+    expect(params[7]).toBe("ok");
+    expect(params[9]).toBe(13);
+  });
+
+  it("append persists null args safely", async () => {
+    const store = new PostgreSQLOpenAuditStore({ pool });
+    mockQuery.mockResolvedValueOnce({ rows: [] });
+    await store.append({
+      tenantId: "t1",
+      credentialId: "k1",
+      credentialKind: "browser_token",
+      projectId: "p1",
+      domain: "kb",
+      action: "search",
+      args: undefined,
+      status: "error",
+      errorCode: "GRANT_DENIED",
+      durationMs: 1,
+    });
+    const params = mockQuery.mock.calls[0][1] as unknown[];
+    expect(params[6]).toBeNull();
+    expect(params[8]).toBe("GRANT_DENIED");
+  });
+});
+
+describe("PostgreSQLOpenAuditStore.query", () => {
+  beforeEach(() => jest.clearAllMocks());
+
+  it("builds a tenant-scoped filtered query", async () => {
+    const store = new PostgreSQLOpenAuditStore({ pool });
+    mockQuery.mockResolvedValueOnce({ rows: [] });
+    await store.query({
+      tenantId: "t1",
+      domain: "kb",
+      status: "error",
+      from: "2026-01-01T00:00:00Z",
+      limit: 10,
+      offset: 5,
+    });
+    const [sql, values] = mockQuery.mock.calls[0] as [string, unknown[]];
+    expect(sql).toContain("tenant_id = $1");
+    expect(sql).toContain("domain = $2");
+    expect(sql).toContain("status = $3");
+    expect(sql).toContain("created_at >= $4");
+    expect(sql).toContain("ORDER BY created_at DESC");
+    expect(values).toEqual(["t1", "kb", "error", "2026-01-01T00:00:00Z", 10, 5]);
+  });
+
+  it("maps rows back to records", async () => {
+    const store = new PostgreSQLOpenAuditStore({ pool });
+    mockQuery.mockResolvedValueOnce({
+      rows: [
+        {
+          id: "a1",
+          tenant_id: "t1",
+          credential_id: "k1",
+          credential_kind: "api_key",
+          project_id: "p1",
+          domain: "kb",
+          action: "search",
+          args: { q: "x" },
+          status: "ok",
+          error_code: null,
+          duration_ms: 7,
+          created_at: new Date("2026-01-01T00:00:00Z"),
+        },
+      ],
+    });
+    const rows = await store.query({ tenantId: "t1" });
+    expect(rows[0]).toMatchObject({ id: "a1", status: "ok", errorCode: undefined });
+  });
+});

package/src/__tests__/PostgreSQLProjectRoomMessageStore.test.ts

@@ -100,4 +100,18 @@ describe("PostgreSQLProjectRoomMessageStore", () => {
     await expect(new PostgreSQLProjectRoomMessageStore({ pool }).findById("tenant-1", "message-1"))
       .rejects.toThrow("Invalid project room message row");
   });
+
+  it("skips individually invalid rows when listing while preserving valid rows", async () => {
+    const warn = jest.spyOn(console, "warn").mockImplementation(() => undefined);
+    const malformed = { ...row, id: "message-bad", content: { text: "missing type" } };
+    query.mockResolvedValueOnce({ rows: [row, malformed] });
+    const store = new PostgreSQLProjectRoomMessageStore({ pool });
+    await expect(store.list({ tenantId: "tenant-1", roomId: "room-1", limit: 10 }))
+      .resolves.toEqual([expect.objectContaining({ id: "message-1" })]);
+    expect(warn).toHaveBeenCalledWith(
+      "[ProjectRoomMessageStore] Skipping invalid message row",
+      expect.objectContaining({ tenantId: "tenant-1", roomId: "room-1", rowId: "message-bad" }),
+    );
+    warn.mockRestore();
+  });
 });

package/src/__tests__/PostgreSQLProjectRoomReadStateStore.test.ts

@@ -0,0 +1,136 @@
+import { randomUUID } from "node:crypto";
+import { afterAll, beforeAll, beforeEach, describe, expect, it, jest } from "@jest/globals";
+import { Pool } from "pg";
+import type { ProjectRoomMessage } from "@axiom-lattice/protocols";
+
+import { MigrationManager } from "../migrations/migration";
+import { createProjectRoomReadStates, createProjectRoomTables } from "../migrations/project_room_migration";
+import { PostgreSQLProjectRoomMessageStore } from "../stores/PostgreSQLProjectRoomMessageStore";
+import { PostgreSQLProjectRoomReadStateStore } from "../stores/PostgreSQLProjectRoomReadStateStore";
+
+const query = jest.fn();
+const mockPool = { query } as unknown as Pool;
+const readStateRow = {
+  tenant_id: "tenant-1", room_id: "room-1", user_id: "user-1",
+  last_read_at: new Date("2026-01-02T00:00:00.000Z"), updated_at: new Date("2026-01-02T00:00:01.000Z"),
+};
+
+describe("PostgreSQLProjectRoomReadStateStore SQL contract", () => {
+  beforeEach(() => query.mockReset());
+
+  it("returns null when no marker exists and selects by the full primary key", async () => {
+    query.mockResolvedValueOnce({ rows: [] });
+    const store = new PostgreSQLProjectRoomReadStateStore({ pool: mockPool });
+    await expect(store.get("tenant-1", "room-1", "user-1")).resolves.toBeNull();
+    expect(query.mock.calls[0][0]).toContain("FROM lattice_project_room_read_states");
+    expect(query.mock.calls[0][0]).toContain("WHERE tenant_id = $1 AND room_id = $2 AND user_id = $3");
+    expect(query.mock.calls[0][1]).toEqual(["tenant-1", "room-1", "user-1"]);
+  });
+
+  it("upserts monotonically with GREATEST and returns the stored row", async () => {
+    query.mockResolvedValueOnce({ rows: [readStateRow] });
+    const store = new PostgreSQLProjectRoomReadStateStore({ pool: mockPool });
+    const lastReadAt = new Date("2026-01-02T00:00:00.000Z");
+    await expect(store.markRead({ tenantId: "tenant-1", roomId: "room-1", userId: "user-1", lastReadAt }))
+      .resolves.toEqual({
+        tenantId: "tenant-1", roomId: "room-1", userId: "user-1",
+        lastReadAt, updatedAt: new Date("2026-01-02T00:00:01.000Z"),
+      });
+    const [sql, params] = query.mock.calls[0] as [string, unknown[]];
+    expect(sql).toContain("ON CONFLICT (tenant_id, room_id, user_id) DO UPDATE");
+    expect(sql).toContain("GREATEST(lattice_project_room_read_states.last_read_at, EXCLUDED.last_read_at)");
+    expect(params).toEqual(["tenant-1", "room-1", "user-1", lastReadAt]);
+  });
+
+  it("rejects an invalid markRead horizon before querying", async () => {
+    const store = new PostgreSQLProjectRoomReadStateStore({ pool: mockPool });
+    await expect(store.markRead({ tenantId: "tenant-1", roomId: "room-1", userId: "user-1", lastReadAt: new Date("bad") }))
+      .rejects.toThrow(RangeError);
+    expect(query).not.toHaveBeenCalled();
+  });
+
+  it("rejects malformed read state rows", async () => {
+    query.mockResolvedValueOnce({ rows: [{ ...readStateRow, last_read_at: "2026-01-02" }] });
+    const store = new PostgreSQLProjectRoomReadStateStore({ pool: mockPool });
+    await expect(store.get("tenant-1", "room-1", "user-1")).rejects.toThrow("Invalid project room read state row");
+  });
+});
+
+describe("PostgreSQLProjectRoomMessageStore countAfter SQL contract", () => {
+  beforeEach(() => query.mockReset());
+
+  it("counts strictly after the horizon and excludes one human author", async () => {
+    query.mockResolvedValueOnce({ rows: [{ count: 2 }] });
+    const store = new PostgreSQLProjectRoomMessageStore({ pool: mockPool });
+    const after = new Date("2026-01-01T00:00:00.000Z");
+    await expect(store.countAfter({ tenantId: "tenant-1", roomId: "room-1", after, excludeAuthorUserId: "user-1" }))
+      .resolves.toBe(2);
+    const [sql, params] = query.mock.calls[0] as [string, unknown[]];
+    expect(sql).toContain("created_at > $3");
+    expect(sql).toContain("($4::text IS NULL OR author->>'type' <> 'human' OR author->>'userId' <> $4)");
+    expect(params).toEqual(["tenant-1", "room-1", after, "user-1"]);
+  });
+
+  it("passes null when no author is excluded and rejects invalid horizons", async () => {
+    query.mockResolvedValueOnce({ rows: [{ count: 0 }] });
+    const store = new PostgreSQLProjectRoomMessageStore({ pool: mockPool });
+    const after = new Date("2026-01-01T00:00:00.000Z");
+    await expect(store.countAfter({ tenantId: "tenant-1", roomId: "room-1", after })).resolves.toBe(0);
+    expect(query.mock.calls[0][1]).toEqual(["tenant-1", "room-1", after, null]);
+    await expect(store.countAfter({ tenantId: "tenant-1", roomId: "room-1", after: new Date(Number.NaN) }))
+      .rejects.toThrow(RangeError);
+    expect(query).toHaveBeenCalledTimes(1);
+  });
+});
+
+const databaseUrl = process.env.TEST_DATABASE_URL;
+const describeIfDatabase = databaseUrl ? describe : describe.skip;
+
+describeIfDatabase("PostgreSQLProjectRoomReadStateStore", () => {
+  let pool: Pool;
+  let store: PostgreSQLProjectRoomReadStateStore;
+  let messages: PostgreSQLProjectRoomMessageStore;
+  const tenantId = `read-state-${randomUUID()}`;
+
+  beforeAll(async () => {
+    pool = new Pool({ connectionString: databaseUrl });
+    const mm = new MigrationManager(pool);
+    mm.register(createProjectRoomTables);
+    mm.register(createProjectRoomReadStates);
+    await mm.migrate();
+    store = new PostgreSQLProjectRoomReadStateStore({ pool });
+    messages = new PostgreSQLProjectRoomMessageStore({ pool });
+  });
+
+  afterAll(async () => {
+    await pool.query("DELETE FROM lattice_project_room_messages WHERE tenant_id = $1", [tenantId]);
+    await pool.query("DELETE FROM lattice_project_room_read_states WHERE tenant_id = $1", [tenantId]);
+    await pool.end();
+  });
+
+  it("returns null before any report and upserts monotonically", async () => {
+    await expect(store.get(tenantId, "room-1", "u1")).resolves.toBeNull();
+    await store.markRead({ tenantId, roomId: "room-1", userId: "u1", lastReadAt: new Date("2026-01-02T00:00:00Z") });
+    await store.markRead({ tenantId, roomId: "room-1", userId: "u1", lastReadAt: new Date("2026-01-01T00:00:00Z") });
+    const state = await store.get(tenantId, "room-1", "u1");
+    expect(state?.lastReadAt.toISOString()).toBe("2026-01-02T00:00:00.000Z");
+  });
+
+  it("counts messages after a horizon excluding one human author", async () => {
+    const roomId = `room-${randomUUID()}`;
+    const base = (id: string, author: ProjectRoomMessage["author"]): Omit<ProjectRoomMessage, "createdAt"> => ({
+      id, tenantId, workspaceId: "w1", projectId: "p1", roomId, author,
+      content: { type: "text", text: id }, mentions: [], source: "user",
+    });
+    await messages.create({ ...base(`m0-${roomId}`, { type: "human", userId: "u2" }) });
+    await new Promise((resolve) => setTimeout(resolve, 20));
+    await messages.create({ ...base(`m1-${roomId}`, { type: "human", userId: "u1" }) });
+    await messages.create({ ...base(`m2-${roomId}`, { type: "human", userId: "u2" }) });
+    await messages.create({ ...base(`m3-${roomId}`, { type: "bot", membershipId: "b1", assistantId: "a1" }) });
+    const first = await messages.findById(tenantId, `m0-${roomId}`);
+    const count = await messages.countAfter({
+      tenantId, roomId, after: first!.createdAt, excludeAuthorUserId: "u1",
+    });
+    expect(count).toBe(2);
+  });
+});

package/src/__tests__/PostgresSharedResourceStore.openGrants.test.ts

@@ -0,0 +1,62 @@
+import { describe, expect, it, jest, beforeEach } from "@jest/globals";
+import type { Pool } from "pg";
+import { PostgresSharedResourceStore } from "../stores/PostgresSharedResourceStore";
+
+const mockQuery = jest.fn();
+
+describe("PostgresSharedResourceStore openGrants", () => {
+  const pool = { query: mockQuery } as unknown as Pool;
+  beforeEach(() => jest.clearAllMocks());
+
+  it("persists open_grants as JSON on create", async () => {
+    const store = new PostgresSharedResourceStore({ pool } as never);
+    const openGrants = [{ domain: "kb", items: ["search"] }];
+    mockQuery.mockResolvedValueOnce({
+      rows: [
+        {
+          token: "tok",
+          address: JSON.stringify({ volume: "v", resourcePath: "index.html" }),
+          title: null,
+          created_by: "u1",
+          tenant_id: "t1",
+          workspace_id: "w1",
+          project_id: "p1",
+          assistant_id: null,
+          vm_isolation: "project",
+          visibility: "public",
+          password_hash: null,
+          expires_at: null,
+          max_access: null,
+          open_grants: openGrants,
+          access_count: 0,
+          revoked: false,
+          created_at: new Date().toISOString(),
+          version: 1,
+        },
+      ],
+    });
+
+    const record = await store.create({
+      token: "tok",
+      address: { volume: "v", resourcePath: "index.html" },
+      title: null,
+      createdBy: "u1",
+      tenantId: "t1",
+      workspaceId: "w1",
+      projectId: "p1",
+      assistantId: null,
+      vmIsolation: "project",
+      visibility: "public",
+      passwordHash: null,
+      expiresAt: null,
+      maxAccess: null,
+      openGrants,
+      revoked: false,
+    } as never);
+
+    const [sql, params] = mockQuery.mock.calls[0] as [string, unknown[]];
+    expect(sql).toContain("open_grants");
+    expect(params).toContain(JSON.stringify(openGrants));
+    expect(record.openGrants).toEqual(openGrants);
+  });
+});

package/src/__tests__/create_open_audit_table.test.ts

@@ -0,0 +1,40 @@
+/**
+ * create_open_audit_table migration tests
+ */
+
+import { describe, expect, it, jest } from "@jest/globals";
+import type { PoolClient } from "pg";
+import { createOpenAuditTable } from "../migrations/create_open_audit_table";
+
+describe("create_open_audit_table migration", () => {
+  it("has name create_open_audit_table", () => {
+    expect(createOpenAuditTable.name).toBe("create_open_audit_table");
+  });
+
+  it("has version 179", () => {
+    expect(createOpenAuditTable.version).toBe(179);
+  });
+
+  it("creates the audit table and tenant index in up()", async () => {
+    const queries: string[] = [];
+    const client = {
+      query: jest.fn(async (sql: string) => {
+        queries.push(sql);
+      }),
+    };
+    await createOpenAuditTable.up(client as unknown as PoolClient);
+    expect(queries.some((q) => q.includes("CREATE TABLE IF NOT EXISTS lattice_open_audit"))).toBe(true);
+    expect(queries.some((q) => q.includes("idx_lattice_open_audit_tenant_created"))).toBe(true);
+  });
+
+  it("drops the table in down()", async () => {
+    const queries: string[] = [];
+    const client = {
+      query: jest.fn(async (sql: string) => {
+        queries.push(sql);
+      }),
+    };
+    await createOpenAuditTable.down!(client as unknown as PoolClient);
+    expect(queries.some((q) => q.includes("DROP TABLE IF EXISTS lattice_open_audit"))).toBe(true);
+  });
+});

package/src/createPgStoreConfig.ts

@@ -17,6 +17,7 @@ import { ThreadMessageQueueStore } from "./stores/ThreadMessageQueueStore";
 import { ChannelBindingStore } from "./stores/ChannelBindingStore";
 import { PostgreSQLChannelInstallationStore } from "./stores/PostgreSQLChannelInstallationStore";
 import { PostgreSQLA2AApiKeyStore } from "./stores/PostgreSQLA2AApiKeyStore";
+import { PostgreSQLOpenAuditStore } from "./stores/PostgreSQLOpenAuditStore";
 import { PostgreSQLAgentWebAppStore } from "./stores/PostgreSQLAgentWebAppStore";
 import { PostgreSQLScheduleStorage } from "./stores/PostgreSQLScheduleStorage";
 import { PostgreSQLTaskStore } from "./stores/PostgreSQLTaskStore";
@@ -67,6 +68,9 @@ import { createWorkflowTrackingTables, addStepThreadId, addWorkflowRunsTenantSta
 import { evalMigrations } from "./migrations/eval_migrations";
 import { createA2AApiKeysTable } from "./migrations/a2a_api_key_migration";
 import { addA2AKeyAssistantIds } from "./migrations/add_a2a_key_assistant_ids";
+import { addApiKeyGrants } from "./migrations/add_api_key_grants";
+import { createOpenAuditTable } from "./migrations/create_open_audit_table";
+import { addShareOpenGrants } from "./migrations/add_share_open_grants";
 import { taskMigrations } from "./migrations/task_migration";
 import { createMenuItemsTable } from "./migrations/menu_items_migration";
 import { addFileContentType } from "./migrations/menu_items_add_file_type";
@@ -82,12 +86,13 @@ import {
 import { createAgentWebAppsTable } from "./migrations/agent_web_apps_migration";
 import { addAgentWebAppsIdentity } from "./migrations/add_agent_web_apps_identity_migration";
 import { createCapabilityBundlesTable } from "./migrations/capability_bundle_migration";
-import { createProjectRoomTables } from "./migrations/project_room_migration";
+import { createProjectRoomReadStates, createProjectRoomTables } from "./migrations/project_room_migration";
 import { PostgreSQLCapabilityBundleStore } from "./stores/PostgreSQLCapabilityBundleStore";
 import { PostgreSQLProjectRoomStore } from "./stores/PostgreSQLProjectRoomStore";
 import { PostgreSQLProjectMembershipStore } from "./stores/PostgreSQLProjectMembershipStore";
 import { PostgreSQLProjectBotMembershipStore } from "./stores/PostgreSQLProjectBotMembershipStore";
 import { PostgreSQLProjectRoomMessageStore } from "./stores/PostgreSQLProjectRoomMessageStore";
+import { PostgreSQLProjectRoomReadStateStore } from "./stores/PostgreSQLProjectRoomReadStateStore";
 
 export async function createPgStoreConfig(connectionString: string) {
   const pool = new Pool({ connectionString });
@@ -147,6 +152,9 @@ export async function createPgStoreConfig(connectionString: string) {
   mm.register(addWorkflowRunsTenantStatusUpdatedIndex); // v161
   mm.register(addProjectKindColumn);          // v165
   mm.register(addA2AKeyAssistantIds);         // v167
+  mm.register(addApiKeyGrants);               // v178
+  mm.register(createOpenAuditTable);          // v179
+  mm.register(addShareOpenGrants);            // v180
   mm.register(addTaskWorkItemEventKeyMigration); // v168
   mm.register(createAgentWebAppsTable);        // v169
   mm.register(createCapabilityBundlesTable);   // v170
@@ -155,6 +163,7 @@ export async function createPgStoreConfig(connectionString: string) {
   mm.register(addTrustedRunContextColumn);      // v173
   mm.register(addProjectLifecycleEventIndex);   // v175
   mm.register(addAgentWebAppsIdentity);         // v176
+  mm.register(createProjectRoomReadStates);     // v177
 
   await mm.migrate();
 
@@ -187,6 +196,7 @@ export async function createPgStoreConfig(connectionString: string) {
     task: new PostgreSQLTaskStore(opts),
     taskWorkItem: taskWorkItemStore,
     a2aApiKey: new PostgreSQLA2AApiKeyStore(opts),
+    openAudit: new PostgreSQLOpenAuditStore(opts),
     agentWebApp: new PostgreSQLAgentWebAppStore(opts),
     capabilityBundle: new PostgreSQLCapabilityBundleStore(opts),
     schedule: new PostgreSQLScheduleStorage(opts),
@@ -197,6 +207,7 @@ export async function createPgStoreConfig(connectionString: string) {
     projectMembership: new PostgreSQLProjectMembershipStore(opts),
     projectBotMembership: new PostgreSQLProjectBotMembershipStore(opts),
     projectRoomMessage: new PostgreSQLProjectRoomMessageStore(opts),
+    projectRoomReadState: new PostgreSQLProjectRoomReadStateStore(opts),
     vectorStoreProvider: new PGVectorStoreProvider(pool, connectionString),
     checkpoint,
   };

package/src/index.ts

@@ -57,6 +57,7 @@ export * from "./stores/ThreadMessageQueueStore";
 export * from "./stores/ChannelIdentityMappingStore";
 export * from "./stores/PostgreSQLChannelInstallationStore";
 export * from "./stores/PostgreSQLA2AApiKeyStore";
+export * from "./stores/PostgreSQLOpenAuditStore";
 export * from "./stores/PostgreSQLAgentWebAppStore";
 export * from "./stores/PostgreSQLTaskWorkItemStore";
 export * from "./stores/PostgreSQLCapabilityBundleStore";
@@ -75,6 +76,7 @@ export * from "./stores/PostgreSQLProjectRoomStore";
 export * from "./stores/PostgreSQLProjectMembershipStore";
 export * from "./stores/PostgreSQLProjectBotMembershipStore";
 export * from "./stores/PostgreSQLProjectRoomMessageStore";
+export * from "./stores/PostgreSQLProjectRoomReadStateStore";
 export * from "./migrations/project_room_migration";
 
 export * from "./PGVectorStoreProvider";

package/src/migrations/add_api_key_grants.ts

@@ -0,0 +1,25 @@
+import type { Migration } from "./migration";
+import type { PoolClient } from "pg";
+
+/**
+ * Adds the Open-door grants JSONB column to API keys.
+ *
+ * Absent/empty grants → legacy derivation via effectiveGrants()
+ * (assistantIds → agent-domain grant). The A2A door never reads this column.
+ */
+export const addApiKeyGrants: Migration = {
+  version: 178,
+  name: "add_api_key_grants",
+  up: async (client: PoolClient) => {
+    await client.query(`
+      ALTER TABLE lattice_a2a_api_keys
+        ADD COLUMN IF NOT EXISTS grants JSONB
+    `);
+  },
+  down: async (client: PoolClient) => {
+    await client.query(`
+      ALTER TABLE lattice_a2a_api_keys
+        DROP COLUMN IF EXISTS grants
+    `);
+  },
+};

package/src/migrations/add_share_open_grants.ts

@@ -0,0 +1,23 @@
+import type { Migration } from "./migration";
+import type { PoolClient } from "pg";
+
+/**
+ * Adds Open-door grants to resource shares. Sandbox tokens minted for a share
+ * append these (sanitized against the V1 whitelist) to their self grant.
+ */
+export const addShareOpenGrants: Migration = {
+  version: 180,
+  name: "add_share_open_grants",
+  up: async (client: PoolClient) => {
+    await client.query(`
+      ALTER TABLE lattice_shared_resources
+        ADD COLUMN IF NOT EXISTS open_grants JSONB
+    `);
+  },
+  down: async (client: PoolClient) => {
+    await client.query(`
+      ALTER TABLE lattice_shared_resources
+        DROP COLUMN IF EXISTS open_grants
+    `);
+  },
+};