@axiom-lattice/pg-stores 5.0.3 → 5.1.0

package/.turbo/turbo-build.log

@@ -1,5 +1,5 @@
 
-> @axiom-lattice/pg-stores@5.0.3 build /home/runner/work/agentic/agentic/packages/pg-stores
+> @axiom-lattice/pg-stores@5.1.0 build /home/runner/work/agentic/agentic/packages/pg-stores
 > tsup src/index.ts --format cjs,esm --dts --sourcemap
 
 CLI Building entry: src/index.ts
@@ -8,13 +8,13 @@
 CLI Target: es2020
 CJS Build start
 ESM Build start
-ESM dist/index.mjs     524.22 KB
-ESM dist/index.mjs.map 970.44 KB
-ESM ⚡️ Build success in 1100ms
-CJS dist/index.js     533.98 KB
-CJS dist/index.js.map 970.75 KB
-CJS ⚡️ Build success in 1191ms
 DTS Build start
-DTS ⚡️ Build success in 15036ms
-DTS dist/index.d.ts  112.00 KB
-DTS dist/index.d.mts 112.00 KB
+ESM dist/index.mjs     558.27 KB
+ESM dist/index.mjs.map 1.01 MB
+ESM ⚡️ Build success in 1906ms
+CJS dist/index.js     569.35 KB
+CJS dist/index.js.map 1.01 MB
+CJS ⚡️ Build success in 1911ms
+DTS ⚡️ Build success in 16426ms
+DTS dist/index.d.ts  120.00 KB
+DTS dist/index.d.mts 120.00 KB

package/CHANGELOG.md

@@ -1,5 +1,100 @@
 # @axiom-lattice/pg-stores
 
+## 5.1.0
+
+### Minor Changes
+
+- f29edad: Add the Admin Center platform-management surface, durable platform settings,
+  opaque invite links, enterprise SSO follow-ups, and domain branding.
+
+  - **Admin Center:** grouped navigation (Access/Tenancy/Identity/Settings),
+    full-width responsive shell, Overview attention cards + health + stats,
+    redesigned People, Platform Roles, Invite Links, Tenants, Tenant Members,
+    OIDC Providers, and Settings pages with shared Admin Center primitives.
+    Settings is split into three direct writable menu entries (Authentication,
+    Rate Limits & Quotas, Branding) instead of an in-page tab set; the read-only
+    environment view lives in Overview.
+  - **Platform settings:** PostgreSQL-backed auth/invite/rate-limit/quota/branding
+    settings with env fallback, version CAS, outbox invalidation, 30s refresh,
+    read-only Overview environment, and multi-replica readiness.
+  - **Invite links:** opaque, encrypted-at-rest links with expiry/max uses/revoke;
+    platform role links always require admin approval, tenant member auto-join
+    only with email-bound IdP-verified email; revoke cancels pending claims.
+  - **SSO follow-ups:** optional default tenant, private-host allowlists, email
+    completion claims, pending SSO review, and SSO avatar metadata.
+  - **Domain branding:** platform default + exact-host domain overrides, public
+    `GET /api/branding`, Admin Center Branding tab, login/register/invite brand
+    application, workspace domain theme inheritance, and tenant primary-color
+    override.
+  - **Security hardening:** platform guards fail closed; email-less completion and
+    public branding/invite routes are explicitly public; owner fallback/owner
+    target protections; last-owner checks; SSRF allowlist and metadata rejection;
+    rate-limit precedence; claim approval leases/rollback; avatar URL validation.
+
+- 0ad828b: Add generic OIDC console login with Azure Entra ID support, external identity
+  binding, JIT pending users, platform roles, a separate Platform Admin app, and
+  platform-scoped provider configuration.
+
+  - `@axiom-lattice/auth-oidc`: authorization-code + PKCE + nonce via
+    `openid-client` v6, Azure `oid`/`sub` claim mapping, signed state cookie,
+    endpoint SSRF validation, config parsing, and per-provider `providerId` state.
+  - `@axiom-lattice/protocols` / `@axiom-lattice/core`: auth provider and external
+    identity store contracts, provider registry, identity mapping (issuer-scoped
+    keys, verified-email-only auto-link, JIT pending), in-memory identity store,
+    the OIDC provider config store contract + encrypted in-memory store, and the
+    `PlatformMemberStore` contract + in-memory store with `owner`/`admin`/
+    `auditor` roles.
+  - `@axiom-lattice/local-stores` / `@axiom-lattice/pg-stores`: external identity,
+    OIDC provider config, and platform member stores; PostgreSQL migrations v209
+    (`lattice_user_identities`), v210 (`lower(email)` unique index), v211
+    (`lattice_oidc_provider_configs`, encrypted client secret), and v212
+    (`lattice_platform_members`).
+  - `@axiom-lattice/gateway`: multi-provider OIDC routes, one-time 60-second
+    handoff/exchange, platform-role CRUD/test APIs for store providers, runtime
+    registry with env `oidc` fallback, `PlatformBootstrapService` +
+    `PlatformAccessService` (owner/admin/auditor) replacing env-only checks on
+    approval/user/tenant/OIDC surfaces, `/api/platform/*` member and tenant
+    assignment APIs, OIDC rate limits, and fail-closed deployment checks.
+  - `@axiom-lattice/client-sdk`: `client.oidcProviders` list/create/update/
+    delete/test/testStored and `client.platform` me/members/tenant-assignment
+    methods with types.
+  - `@axiom-lattice/react-sdk`: provider discovery, SSO button labeled with the
+    provider display name, `/auth/callback` bootstrap, pending/error notices, the
+    write-only OIDC provider panel, and the separate `/platform-admin` app with
+    Overview, Platform Users, Tenants, Tenant Assignments, and OIDC Providers.
+    OIDC Providers is removed from the tenant workspace menu.
+
+- 0ad828b: SSO-only deployments and platform invitations.
+
+  - `@axiom-lattice/gateway`: `AUTH_LOCAL_ENABLED` / `AUTH_BREAK_GLASS_EMAILS`
+    disable password login, registration, and password changes while keeping an
+    audited, env-only break-glass escape hatch. `PlatformSsoBootstrapService`
+    claims the first platform owner from a verified SSO login (issuer + subject >
+    group > email) with no local password, serialized by the
+    `platform-bootstrap` lease. `PlatformInvitationService` invites normalized
+    emails: existing active users are granted immediately, everyone else gets a
+    pending invitation claimed on the first verified SSO login before identity
+    mapping (consume-before-grant, per-email lease, owner-only owner invitations,
+    `PLATFORM_INVITATION_TRUST_EMAIL` off by default).
+  - `@axiom-lattice/protocols` / `@axiom-lattice/core` /
+    `@axiom-lattice/local-stores` / `@axiom-lattice/pg-stores`: platform
+    invitation store contract + InMemory/Local/PostgreSQL implementations and PG
+    migration v213 (`lattice_platform_invitations`).
+  - `@axiom-lattice/client-sdk`: `client.platform.listInvitations()` /
+    `revokeInvitation(email)` and the `{ member?, invitation? }` grant result.
+  - `@axiom-lattice/react-sdk`: Platform Users loads and revokes pending
+    invitations, distinguishes "invited" from "granted", exposes SSO-only /
+    break-glass login states, and keeps owner invitations owner-only. Invited
+    users need no tenant membership to use `/platform-admin`.
+
+### Patch Changes
+
+- Updated dependencies [f29edad]
+- Updated dependencies [0ad828b]
+- Updated dependencies [0ad828b]
+  - @axiom-lattice/protocols@7.2.0
+  - @axiom-lattice/core@12.2.0
+
 ## 5.0.3
 
 ### Patch Changes

package/dist/index.d.mts

@@ -1,6 +1,6 @@
 import { Pool, PoolConfig, PoolClient } from 'pg';
 export { Pool, PoolConfig } from 'pg';
-import { ThreadStore, Thread, CreateThreadRequest, AssistantStore, Assistant, CreateAssistantRequest, DatabaseConfigStore, DatabaseConfigEntry, CreateDatabaseConfigRequest, UpdateDatabaseConfigRequest, ConnectionStore, ConnectionEntry, MetricsServerConfigStore, MetricsServerConfigEntry, CreateMetricsServerConfigRequest, UpdateMetricsServerConfigRequest, McpServerConfigStore, McpServerConfigEntry, CreateMcpServerConfigRequest, UpdateMcpServerConfigRequest, WorkspaceStore, Workspace, CreateWorkspaceRequest, UpdateWorkspaceRequest, ProjectStore, ProjectFilter, Project, CreateProjectRequest, UpdateProjectRequest, UpdateProjectCapabilityBundlesResult, UserStore, User, CreateUserRequest, UpdateUserRequest, TenantStore, Tenant, CreateTenantRequest, UpdateTenantRequest, UserTenantLinkStore, UserTenantLink, CreateUserTenantLinkRequest, UpdateUserTenantLinkRequest, WorkflowTrackingStore, CreateWorkflowRunRequest, WorkflowRun, UpdateWorkflowRunRequest, QueryWorkflowRunsOptions, QueryWorkflowRunsResult, CreateRunStepRequest, RunStep, UpdateRunStepRequest, StepType, EvalStore, EvalProject, CreateEvalProjectRequest, EvalSuite, CreateEvalSuiteRequest, EvalCase, CreateEvalCaseRequest, EvalRun, CreateEvalRunRequest, EvalRunResult, EvalProjectReport, BindingRegistry, Binding, CreateBindingInput, BindingMutablePatch, BindingListParams, ChannelInstallationStore, ChannelInstallation, ChannelInstallationType, CreateChannelInstallationInput, UpdateChannelInstallationRequest, A2AApiKeyStore, A2AApiKeyRecord, CreateA2AApiKeyInput, UpdateA2AApiKeyInput, A2AApiKeyEntry, OpenAuditStore, OpenAuditQuery, OpenAuditRecord, OpenAuditAppendInput, AgentWebAppStore, AgentWebApp, CreateAgentWebAppInput, AgentWebAppStorePatch, AgentWebAppUpdateOptions, ScheduleStorage, ScheduledTaskDefinition, ScheduledTaskStatus, ScheduleExecutionType, TaskStore, CreateTaskRequest, TaskItem, TaskListFilter, TaskDependentListQuery, UpdateTaskRequest, TaskMutationSnapshot, TaskWorkItemStore, CreateWorkItemRequest, TaskWorkItem, CreateWorkItemIfAbsentRequest, TaskWorkItemListFilter, ProjectLifecycleEventQuery, MenuRegistry, MenuItem, CreateMenuItemInput, UpdateMenuItemInput, SharedResourceStore, ShareRecord, CreateShareRecord, CollectionStore, Collection, CreateCollectionRequest, UpdateCollectionRequest, VectorStoreProvider, VectorStoreCreateParams, CapabilityBundleStore, CapabilityBundle, InternalCreateCapabilityBundleInput, InternalUpdateCapabilityBundleInput, CapabilityBundleDeleteResult, ProjectRoomStore, ProjectRoom, ProjectMembershipStore, ProjectMembership, ProjectHumanRole, ProjectMembershipMutationResult, ProjectBotMembershipStore, ProjectBotMembership, ProjectRoomMessageStore, ProjectRoomMessage, ProjectRoomReadStateStore, ProjectRoomReadState, UserPushSubscriptionStore, UserPushSubscription, ModelProviderStore, ModelProviderEntry, CreateModelProviderRequest, UpdateModelProviderRequest, ModelProviderStatus, ModelProviderModelEntry, ProviderModelInput, LeaseStore, LeaseRecord, OutboxStore, OutboxEvent, PluginDeploymentStore, PluginDeployment, ChannelReplyJobStore, CreateChannelReplyJobInput, ChannelReplyJob, CheckpointStorage, CheckpointMaintenance, ThreadCheckpointStorage, StoreProtocol, StorePutInput, StoreItem, StoreSearchInput, SkillStore, Skill, CreateSkillRequest } from '@axiom-lattice/protocols';
+import { ThreadStore, Thread, CreateThreadRequest, AssistantStore, Assistant, CreateAssistantRequest, DatabaseConfigStore, DatabaseConfigEntry, CreateDatabaseConfigRequest, UpdateDatabaseConfigRequest, ConnectionStore, ConnectionEntry, MetricsServerConfigStore, MetricsServerConfigEntry, CreateMetricsServerConfigRequest, UpdateMetricsServerConfigRequest, McpServerConfigStore, McpServerConfigEntry, CreateMcpServerConfigRequest, UpdateMcpServerConfigRequest, WorkspaceStore, Workspace, CreateWorkspaceRequest, UpdateWorkspaceRequest, ProjectStore, ProjectFilter, Project, CreateProjectRequest, UpdateProjectRequest, UpdateProjectCapabilityBundlesResult, UserStore, User, CreateUserRequest, UpdateUserRequest, TenantStore, Tenant, CreateTenantRequest, UpdateTenantRequest, UserTenantLinkStore, UserTenantLink, CreateUserTenantLinkRequest, UpdateUserTenantLinkRequest, UserExternalIdentityStore, UserExternalIdentity, OidcProviderConfigStore, OidcProviderConfig, CreateOidcProviderConfigInput, UpdateOidcProviderConfigInput, PlatformMemberStore, PlatformMember, PlatformInvitationStore, PlatformInvitation, OidcIdentityClaimStore, OidcIdentityClaimStatus, OidcIdentityClaim, CreateOidcIdentityClaimInput, UpdateOidcIdentityClaimInput, OidcIdentityClaimApproval, InviteLinkStore, InviteLink, CreateInviteLinkInput, WorkflowTrackingStore, CreateWorkflowRunRequest, WorkflowRun, UpdateWorkflowRunRequest, QueryWorkflowRunsOptions, QueryWorkflowRunsResult, CreateRunStepRequest, RunStep, UpdateRunStepRequest, StepType, EvalStore, EvalProject, CreateEvalProjectRequest, EvalSuite, CreateEvalSuiteRequest, EvalCase, CreateEvalCaseRequest, EvalRun, CreateEvalRunRequest, EvalRunResult, EvalProjectReport, BindingRegistry, Binding, CreateBindingInput, BindingMutablePatch, BindingListParams, ChannelInstallationStore, ChannelInstallation, ChannelInstallationType, CreateChannelInstallationInput, UpdateChannelInstallationRequest, A2AApiKeyStore, A2AApiKeyRecord, CreateA2AApiKeyInput, UpdateA2AApiKeyInput, A2AApiKeyEntry, OpenAuditStore, OpenAuditQuery, OpenAuditRecord, OpenAuditAppendInput, AgentWebAppStore, AgentWebApp, CreateAgentWebAppInput, AgentWebAppStorePatch, AgentWebAppUpdateOptions, ScheduleStorage, ScheduledTaskDefinition, ScheduledTaskStatus, ScheduleExecutionType, TaskStore, CreateTaskRequest, TaskItem, TaskListFilter, TaskDependentListQuery, UpdateTaskRequest, TaskMutationSnapshot, TaskWorkItemStore, CreateWorkItemRequest, TaskWorkItem, CreateWorkItemIfAbsentRequest, TaskWorkItemListFilter, ProjectLifecycleEventQuery, MenuRegistry, MenuItem, CreateMenuItemInput, UpdateMenuItemInput, SharedResourceStore, ShareRecord, CreateShareRecord, CollectionStore, Collection, CreateCollectionRequest, UpdateCollectionRequest, VectorStoreProvider, VectorStoreCreateParams, CapabilityBundleStore, CapabilityBundle, InternalCreateCapabilityBundleInput, InternalUpdateCapabilityBundleInput, CapabilityBundleDeleteResult, ProjectRoomStore, ProjectRoom, ProjectMembershipStore, ProjectMembership, ProjectHumanRole, ProjectMembershipMutationResult, ProjectBotMembershipStore, ProjectBotMembership, ProjectRoomMessageStore, ProjectRoomMessage, ProjectRoomReadStateStore, ProjectRoomReadState, UserPushSubscriptionStore, UserPushSubscription, ModelProviderStore, ModelProviderEntry, CreateModelProviderRequest, UpdateModelProviderRequest, ModelProviderStatus, ModelProviderModelEntry, ProviderModelInput, LeaseStore, LeaseRecord, OutboxStore, OutboxEvent, PluginDeploymentStore, PluginDeployment, PlatformSettingsStore, PlatformSettingsRecord, PlatformSettingsDocument, ChannelReplyJobStore, CreateChannelReplyJobInput, ChannelReplyJob, CheckpointStorage, CheckpointMaintenance, ThreadCheckpointStorage, StoreProtocol, StorePutInput, StoreItem, StoreSearchInput, SkillStore, Skill, CreateSkillRequest } from '@axiom-lattice/protocols';
 export { AgentWebApp, AgentWebAppAppearance, AgentWebAppFeatures, AgentWebAppScope, AgentWebAppStatus, AgentWebAppStore, Assistant, AssistantStore, Binding, BindingRegistry, CapabilityBundle, CapabilityBundleStore, ChannelInstallation, ChannelInstallationStore, ConnectionEntry, ConnectionStore, CreateAgentWebAppInput, CreateAssistantRequest, CreateBindingInput, CreateCapabilityBundleInput, CreateChannelInstallationInput, CreateChannelInstallationRequest, CreateDatabaseConfigRequest, CreateEvalCaseRequest, CreateEvalProjectRequest, CreateEvalRunRequest, CreateEvalSuiteRequest, CreateMcpServerConfigRequest, CreateMenuItemInput, CreateMetricsServerConfigRequest, CreateProjectRequest, CreateRunStepRequest, CreateShareRequest, CreateSkillRequest, CreateTenantRequest, CreateThreadRequest, CreateUserRequest, CreateUserTenantLinkRequest, CreateWorkflowRunRequest, CreateWorkspaceRequest, DatabaseConfig, DatabaseConfigEntry, DatabaseConfigStore, DatabaseType, EvalCase, EvalProject, EvalProjectReport, EvalRun, EvalRunResult, EvalStore, EvalSuite, LarkChannelInstallationConfig, McpServerConfigEntry, McpServerConfigStore, MenuItem, MenuRegistry, MetricsServerConfig, MetricsServerConfigEntry, MetricsServerConfigStore, Project, ProjectStore, ResourceAddress, RunStep, ScheduleExecutionType, ScheduleStorage, ScheduledTaskDefinition, ScheduledTaskStatus, ShareRecord, ShareResult, ShareVisibility, SharedResourceStore, Skill, SkillStore, StorageType, Tenant, TenantStatus, TenantStore, Thread, ThreadStore, UpdateAgentWebAppInput, UpdateCapabilityBundleInput, UpdateChannelInstallationRequest, UpdateDatabaseConfigRequest, UpdateMcpServerConfigRequest, UpdateMetricsServerConfigRequest, UpdateProjectRequest, UpdateRunStepRequest, UpdateTenantRequest, UpdateUserRequest, UpdateUserTenantLinkRequest, UpdateWorkflowRunRequest, UpdateWorkspaceRequest, User, UserStore, UserTenantLink, UserTenantLinkStore, UserTenantRole, WorkflowRun, WorkflowTrackingStore, Workspace, WorkspaceStore } from '@axiom-lattice/protocols';
 import { IMessageQueueStore, AddMessageParams, PendingMessage, QueueScope, ClaimMessagesOptions, ThreadInfo, IAgentRunLedger, BeginAgentRunInput, AgentRunRecord, CreatePendingAgentRunInput, ListPendingRunsOptions, ClaimAgentRunInput, DeleteAgentRunExpected, AgentRunStatus, RollbackFailureResult, AgentRunRollbackResult, AgentRunExpiredOutcome, SettleExpiredRunOptions, AgentRunCounts, AgentRunSource, ReapedAgentRun } from '@axiom-lattice/core';
 export { AddMessageParams, PendingMessage, ThreadInfo } from '@axiom-lattice/core';
@@ -748,6 +748,133 @@ declare class PostgreSQLUserTenantLinkStore implements UserTenantLinkStore {
     hasLink(userId: string, tenantId: string): Promise<boolean>;
 }
 
+/**
+ * Raised when a row read from `lattice_user_identities` does not match the
+ * expected column types.
+ */
+declare class InvalidUserExternalIdentityRowError extends Error {
+    readonly code = "INVALID_USER_EXTERNAL_IDENTITY_ROW";
+    constructor();
+}
+declare class PostgreSQLUserExternalIdentityStore implements UserExternalIdentityStore {
+    private readonly pool;
+    constructor(options: {
+        pool: Pool;
+    });
+    getByProviderSubject(providerId: string, issuer: string, subject: string): Promise<UserExternalIdentity | null>;
+    listByUser(userId: string): Promise<UserExternalIdentity[]>;
+    link(identity: UserExternalIdentity): Promise<void>;
+    unlink(providerId: string, issuer: string, subject: string): Promise<void>;
+}
+
+/**
+ * PostgreSQL implementation of {@link OidcProviderConfigStore}.
+ *
+ * Persists OIDC provider configurations in `lattice_oidc_provider_configs`,
+ * encrypting the client secret at rest and using the database clock for
+ * `updated_at` on writes.
+ */
+declare class PostgreSQLOidcProviderConfigStore implements OidcProviderConfigStore {
+    private readonly pool;
+    constructor(options: {
+        pool: Pool;
+    });
+    list(): Promise<OidcProviderConfig[]>;
+    get(id: string): Promise<OidcProviderConfig | null>;
+    create(id: string, input: CreateOidcProviderConfigInput): Promise<OidcProviderConfig>;
+    update(id: string, updates: UpdateOidcProviderConfigInput): Promise<OidcProviderConfig | null>;
+    delete(id: string): Promise<boolean>;
+}
+
+/**
+ * PostgreSQL implementation of {@link PlatformMemberStore}.
+ *
+ * Persists platform grants in `lattice_platform_members`, keyed by user id.
+ */
+declare class PostgreSQLPlatformMemberStore implements PlatformMemberStore {
+    private readonly pool;
+    constructor(options: {
+        pool: Pool;
+    });
+    /** Lists every platform member ordered by user id. */
+    list(): Promise<PlatformMember[]>;
+    /** Returns the platform member for a user, or null. */
+    get(userId: string): Promise<PlatformMember | null>;
+    /**
+     * Inserts or replaces a member keyed by user id.
+     *
+     * The supplied grant replaces any existing row in full (last write wins),
+     * including `grantedAt` and `updatedAt`.
+     */
+    upsert(member: PlatformMember): Promise<PlatformMember>;
+    /** Deletes a member. Returns whether a row was removed. */
+    delete(userId: string): Promise<boolean>;
+}
+
+/**
+ * PostgreSQL implementation of {@link PlatformInvitationStore}.
+ *
+ * Persists invitations in `lattice_platform_invitations`, keyed by normalized
+ * email.
+ */
+declare class PostgreSQLPlatformInvitationStore implements PlatformInvitationStore {
+    private readonly pool;
+    constructor(options: {
+        pool: Pool;
+    });
+    /** Lists every invitation ordered by normalized email. */
+    list(): Promise<PlatformInvitation[]>;
+    /** Returns the invitation for an email, or null. */
+    get(email: string): Promise<PlatformInvitation | null>;
+    /**
+     * Inserts or replaces an invitation keyed by normalized email.
+     *
+     * The supplied invitation replaces any existing row in full (last write wins),
+     * including `expiresAt` and `consumedAt`.
+     */
+    upsert(invitation: PlatformInvitation): Promise<PlatformInvitation>;
+    /** Deletes an invitation. Returns whether a row was removed. */
+    delete(email: string): Promise<boolean>;
+    /**
+     * Atomically consumes a pending, unexpired invitation.
+     *
+     * Returns the consumed invitation, or null when the row is missing, already
+     * consumed, or expired.
+     */
+    consume(email: string, at: Date): Promise<PlatformInvitation | null>;
+}
+
+/** PostgreSQL implementation of {@link OidcIdentityClaimStore}. */
+declare class PostgreSQLOidcIdentityClaimStore implements OidcIdentityClaimStore {
+    private readonly pool;
+    constructor(options: {
+        pool: Pool;
+    });
+    list(status?: OidcIdentityClaimStatus): Promise<OidcIdentityClaim[]>;
+    get(id: string): Promise<OidcIdentityClaim | null>;
+    getPendingBySubject(providerId: string, issuer: string, subject: string, now: Date): Promise<OidcIdentityClaim | null>;
+    create(input: CreateOidcIdentityClaimInput): Promise<OidcIdentityClaim>;
+    updatePending(id: string, updates: UpdateOidcIdentityClaimInput, now: Date): Promise<OidcIdentityClaim | null>;
+    approve(id: string, approval: OidcIdentityClaimApproval, now: Date): Promise<OidcIdentityClaim | null>;
+    reject(id: string, reviewedBy: string, now: Date): Promise<OidcIdentityClaim | null>;
+    delete(id: string): Promise<boolean>;
+}
+
+/** PostgreSQL implementation of {@link InviteLinkStore}. */
+declare class PostgreSQLInviteLinkStore implements InviteLinkStore {
+    private readonly options;
+    constructor(options: {
+        pool: Pool;
+    });
+    private get pool();
+    list(): Promise<InviteLink[]>;
+    get(id: string): Promise<InviteLink | null>;
+    getByTokenHash(tokenHash: string): Promise<InviteLink | null>;
+    create(input: CreateInviteLinkInput): Promise<InviteLink>;
+    consume(tokenHash: string, now: Date): Promise<InviteLink | null>;
+    revoke(id: string, now: Date): Promise<InviteLink | null>;
+}
+
 /**
  * PostgreSQL implementation of WorkflowTrackingStore
  */
@@ -2093,6 +2220,17 @@ declare class PostgreSQLAgentRunLedger implements IAgentRunLedger {
     reapLegacyExpired(): Promise<ReapedAgentRun[]>;
 }
 
+/** PostgreSQL implementation of {@link PlatformSettingsStore}. */
+declare class PostgreSQLPlatformSettingsStore implements PlatformSettingsStore {
+    private readonly options;
+    constructor(options: {
+        pool: Pool;
+    });
+    private get pool();
+    get(): Promise<PlatformSettingsRecord | null>;
+    save(document: PlatformSettingsDocument, expectedVersion: number, updatedBy?: string): Promise<PlatformSettingsRecord>;
+}
+
 /** Options accepted by {@link PostgreSQLChannelReplyJobStore}. */
 interface PostgreSQLChannelReplyJobStoreOptions {
     /** Externally managed pool. When supplied, migrations are not run here. */
@@ -2292,6 +2430,13 @@ declare function createPgStoreConfig(connectionString: string): Promise<{
     user: PostgreSQLUserStore;
     tenant: PostgreSQLTenantStore;
     userTenantLink: PostgreSQLUserTenantLinkStore;
+    userExternalIdentity: PostgreSQLUserExternalIdentityStore;
+    oidcProviderConfig: PostgreSQLOidcProviderConfigStore;
+    platformMember: PostgreSQLPlatformMemberStore;
+    platformInvitation: PostgreSQLPlatformInvitationStore;
+    oidcIdentityClaim: PostgreSQLOidcIdentityClaimStore;
+    inviteLink: PostgreSQLInviteLinkStore;
+    platformSettings: PostgreSQLPlatformSettingsStore;
     channelBinding: ChannelBindingStore;
     channelInstallation: PostgreSQLChannelInstallationStore;
     thread: PostgreSQLThreadStore;
@@ -2480,6 +2625,37 @@ declare class MigrationManager {
     getCurrentVersion(): Promise<number>;
 }
 
+declare const createUserExternalIdentityTable: Migration;
+
+/**
+ * Enforce case-insensitive email uniqueness.
+ *
+ * `lower(email)` is the lookup identity used by every UserStore, so the
+ * database must reject rows that differ only by case. This migration fails
+ * closed on an existing database that still has duplicate lower(email) rows.
+ */
+declare const createUserEmailLowerUniqueIndex: Migration;
+
+declare const createOidcProviderConfigsTable: Migration;
+
+/** Creates the platform member table keyed by user id. */
+declare const createPlatformMembersTable: Migration;
+
+/** Creates the platform invitation table keyed by normalized email. */
+declare const createPlatformInvitationsTable: Migration;
+
+/** Creates pending enterprise-SSO identity claims. */
+declare const createOidcIdentityClaimsTable: Migration;
+
+/** Creates durable bearer invitation links. */
+declare const createInviteLinksTable: Migration;
+
+/** Adds invite-link request context to pending identity claims. */
+declare const addOidcIdentityClaimInviteFields: Migration;
+
+/** Creates the single-row durable platform settings table. */
+declare const createPlatformSettingsTable: Migration;
+
 /**
  * Thread table migrations
  */
@@ -2873,4 +3049,4 @@ declare const createChannelReplyJobsTable: Migration;
  */
 declare const createStoreItemsTable: Migration;
 
-export { ChannelBindingStore, type ChannelBindingStoreOptions, type ChannelIdentityMapping, ChannelIdentityMappingStore, type ChannelIdentityMappingStoreOptions, CheckpointBaseNotFoundError, CheckpointTargetNotEmptyError, type CreateChannelIdentityMappingInput, DuplicateProjectMembershipError, DuplicateProjectRoomMessageIdempotencyKeyError, InvalidFileShareAddressError, InvalidMcpAppShareAddressError, InvalidMcpAppShareVisibilityError, MenuStore, type MenuStoreOptions, type Migration, MigrationManager, PGVectorStoreProvider, PostgreSQLA2AApiKeyStore, type PostgreSQLA2AApiKeyStoreOptions, PostgreSQLAgentRunLedger, type PostgreSQLAgentRunLedgerOptions, PostgreSQLAgentWebAppStore, type PostgreSQLAgentWebAppStoreOptions, PostgreSQLAssistantStore, type PostgreSQLAssistantStoreOptions, PostgreSQLCapabilityBundleStore, type PostgreSQLCapabilityBundleStoreOptions, PostgreSQLChannelInstallationStore, type PostgreSQLChannelInstallationStoreOptions, PostgreSQLChannelReplyJobStore, type PostgreSQLChannelReplyJobStoreOptions, PostgreSQLCheckpointStorage, PostgreSQLCollectionStore, type PostgreSQLCollectionStoreOptions, PostgreSQLConnectionStore, PostgreSQLDatabaseConfigStore, type PostgreSQLDatabaseConfigStoreOptions, PostgreSQLEvalStore, type PostgreSQLEvalStoreOptions, PostgreSQLMcpServerConfigStore, type PostgreSQLMcpServerConfigStoreOptions, PostgreSQLMetricsServerConfigStore, type PostgreSQLMetricsServerConfigStoreOptions, PostgreSQLModelProviderStore, type PostgreSQLModelProviderStoreOptions, PostgreSQLOpenAuditStore, type PostgreSQLOpenAuditStoreOptions, PostgreSQLPluginDeploymentStore, PostgreSQLProjectBotMembershipStore, PostgreSQLProjectMembershipStore, PostgreSQLProjectRoomMessageStore, PostgreSQLProjectRoomReadStateStore, PostgreSQLProjectRoomStore, PostgreSQLProjectStore, type PostgreSQLProjectStoreOptions, PostgreSQLScheduleStorage, type PostgreSQLScheduleStorageOptions, PostgreSQLSkillStore, type PostgreSQLSkillStoreOptions, PostgreSQLStore, PostgreSQLTaskWorkItemStore, type PostgreSQLTaskWorkItemStoreOptions, PostgreSQLTenantStore, type PostgreSQLTenantStoreOptions, type PostgreSQLThreadMessageQueueStoreOptions, PostgreSQLThreadStore, type PostgreSQLThreadStoreOptions, PostgreSQLUserStore, type PostgreSQLUserStoreOptions, PostgreSQLUserTenantLinkStore, type PostgreSQLUserTenantLinkStoreOptions, PostgreSQLWorkflowTrackingStore, type PostgreSQLWorkflowTrackingStoreOptions, PostgreSQLWorkspaceStore, type PostgreSQLWorkspaceStoreOptions, PostgresSharedResourceStore, type PostgresSharedResourceStoreOptions, ProjectBotMembershipIdConflictError, ProjectMembershipIdConflictError, ProjectRoomMessageIdConflictError, ThreadMessageQueueStore, addAssistantTenantId, addCancelRequestedToEvalRuns, addEnvToEvalRuns, addFileContentType, addHoldoutToEvalRuns, addInterruptColumnsToEval, addInterruptPolicyToEvalCases, addMcpAppContentType, addProjectConfigColumn, addScheduleTenantId, addShareKind, addSkillTenantId, addStepThreadId, addTaskIdToEvalRuns, addThreadExpiresAt, addThreadTenantId, addWorkflowRunsTenantStatusUpdatedIndex, alterChannelInstallationsTable, changeAssistantPrimaryKey, changeSkillPrimaryKey, changeThreadPrimaryKey, createA2AApiKeysTable, createAgentRunLedgerTable, createAgentWebAppsTable, createAssistantsTable, createCapabilityBundlesTable, createChannelBindingsTable, createChannelIdentityMappingTables, createChannelInstallationsTable, createChannelReplyJobsTable, createCollectionsTable, createDatabaseConfigsTable, createEvalCasesTable, createEvalProjectsTable, createEvalRunResultsTable, createEvalRunsTable, createEvalSuitesTable, createMcpServerConfigsTable, createMenuItemsTable, createMetricsConfigsTable, createPGVectorStoreProvider, createPgStoreConfig, createPluginDeployments, createProjectRoomReadStates, createProjectRoomTables, createProjectsTable, createScheduledTasksTable, createSharedResourcesTable, createSkillsTable, createStoreItemsTable, createTenantsTable, createThreadMessageQueueTable, createThreadsTable, createUsersTable, createWorkflowTrackingTables, createWorkspacesTable, dropPluginDeploymentAuthToken, enforceUniqueEvalProjectName, evalMigrations, mapRowToRunStep, mapRowToWorkflowRun, safeParse };
+export { ChannelBindingStore, type ChannelBindingStoreOptions, type ChannelIdentityMapping, ChannelIdentityMappingStore, type ChannelIdentityMappingStoreOptions, CheckpointBaseNotFoundError, CheckpointTargetNotEmptyError, type CreateChannelIdentityMappingInput, DuplicateProjectMembershipError, DuplicateProjectRoomMessageIdempotencyKeyError, InvalidFileShareAddressError, InvalidMcpAppShareAddressError, InvalidMcpAppShareVisibilityError, InvalidUserExternalIdentityRowError, MenuStore, type MenuStoreOptions, type Migration, MigrationManager, PGVectorStoreProvider, PostgreSQLA2AApiKeyStore, type PostgreSQLA2AApiKeyStoreOptions, PostgreSQLAgentRunLedger, type PostgreSQLAgentRunLedgerOptions, PostgreSQLAgentWebAppStore, type PostgreSQLAgentWebAppStoreOptions, PostgreSQLAssistantStore, type PostgreSQLAssistantStoreOptions, PostgreSQLCapabilityBundleStore, type PostgreSQLCapabilityBundleStoreOptions, PostgreSQLChannelInstallationStore, type PostgreSQLChannelInstallationStoreOptions, PostgreSQLChannelReplyJobStore, type PostgreSQLChannelReplyJobStoreOptions, PostgreSQLCheckpointStorage, PostgreSQLCollectionStore, type PostgreSQLCollectionStoreOptions, PostgreSQLConnectionStore, PostgreSQLDatabaseConfigStore, type PostgreSQLDatabaseConfigStoreOptions, PostgreSQLEvalStore, type PostgreSQLEvalStoreOptions, PostgreSQLInviteLinkStore, PostgreSQLMcpServerConfigStore, type PostgreSQLMcpServerConfigStoreOptions, PostgreSQLMetricsServerConfigStore, type PostgreSQLMetricsServerConfigStoreOptions, PostgreSQLModelProviderStore, type PostgreSQLModelProviderStoreOptions, PostgreSQLOidcIdentityClaimStore, PostgreSQLOidcProviderConfigStore, PostgreSQLOpenAuditStore, type PostgreSQLOpenAuditStoreOptions, PostgreSQLPlatformInvitationStore, PostgreSQLPlatformMemberStore, PostgreSQLPlatformSettingsStore, PostgreSQLPluginDeploymentStore, PostgreSQLProjectBotMembershipStore, PostgreSQLProjectMembershipStore, PostgreSQLProjectRoomMessageStore, PostgreSQLProjectRoomReadStateStore, PostgreSQLProjectRoomStore, PostgreSQLProjectStore, type PostgreSQLProjectStoreOptions, PostgreSQLScheduleStorage, type PostgreSQLScheduleStorageOptions, PostgreSQLSkillStore, type PostgreSQLSkillStoreOptions, PostgreSQLStore, PostgreSQLTaskWorkItemStore, type PostgreSQLTaskWorkItemStoreOptions, PostgreSQLTenantStore, type PostgreSQLTenantStoreOptions, type PostgreSQLThreadMessageQueueStoreOptions, PostgreSQLThreadStore, type PostgreSQLThreadStoreOptions, PostgreSQLUserExternalIdentityStore, PostgreSQLUserStore, type PostgreSQLUserStoreOptions, PostgreSQLUserTenantLinkStore, type PostgreSQLUserTenantLinkStoreOptions, PostgreSQLWorkflowTrackingStore, type PostgreSQLWorkflowTrackingStoreOptions, PostgreSQLWorkspaceStore, type PostgreSQLWorkspaceStoreOptions, PostgresSharedResourceStore, type PostgresSharedResourceStoreOptions, ProjectBotMembershipIdConflictError, ProjectMembershipIdConflictError, ProjectRoomMessageIdConflictError, ThreadMessageQueueStore, addAssistantTenantId, addCancelRequestedToEvalRuns, addEnvToEvalRuns, addFileContentType, addHoldoutToEvalRuns, addInterruptColumnsToEval, addInterruptPolicyToEvalCases, addMcpAppContentType, addOidcIdentityClaimInviteFields, addProjectConfigColumn, addScheduleTenantId, addShareKind, addSkillTenantId, addStepThreadId, addTaskIdToEvalRuns, addThreadExpiresAt, addThreadTenantId, addWorkflowRunsTenantStatusUpdatedIndex, alterChannelInstallationsTable, changeAssistantPrimaryKey, changeSkillPrimaryKey, changeThreadPrimaryKey, createA2AApiKeysTable, createAgentRunLedgerTable, createAgentWebAppsTable, createAssistantsTable, createCapabilityBundlesTable, createChannelBindingsTable, createChannelIdentityMappingTables, createChannelInstallationsTable, createChannelReplyJobsTable, createCollectionsTable, createDatabaseConfigsTable, createEvalCasesTable, createEvalProjectsTable, createEvalRunResultsTable, createEvalRunsTable, createEvalSuitesTable, createInviteLinksTable, createMcpServerConfigsTable, createMenuItemsTable, createMetricsConfigsTable, createOidcIdentityClaimsTable, createOidcProviderConfigsTable, createPGVectorStoreProvider, createPgStoreConfig, createPlatformInvitationsTable, createPlatformMembersTable, createPlatformSettingsTable, createPluginDeployments, createProjectRoomReadStates, createProjectRoomTables, createProjectsTable, createScheduledTasksTable, createSharedResourcesTable, createSkillsTable, createStoreItemsTable, createTenantsTable, createThreadMessageQueueTable, createThreadsTable, createUserEmailLowerUniqueIndex, createUserExternalIdentityTable, createUsersTable, createWorkflowTrackingTables, createWorkspacesTable, dropPluginDeploymentAuthToken, enforceUniqueEvalProjectName, evalMigrations, mapRowToRunStep, mapRowToWorkflowRun, safeParse };

package/dist/index.d.ts

@@ -1,6 +1,6 @@
 import { Pool, PoolConfig, PoolClient } from 'pg';
 export { Pool, PoolConfig } from 'pg';
-import { ThreadStore, Thread, CreateThreadRequest, AssistantStore, Assistant, CreateAssistantRequest, DatabaseConfigStore, DatabaseConfigEntry, CreateDatabaseConfigRequest, UpdateDatabaseConfigRequest, ConnectionStore, ConnectionEntry, MetricsServerConfigStore, MetricsServerConfigEntry, CreateMetricsServerConfigRequest, UpdateMetricsServerConfigRequest, McpServerConfigStore, McpServerConfigEntry, CreateMcpServerConfigRequest, UpdateMcpServerConfigRequest, WorkspaceStore, Workspace, CreateWorkspaceRequest, UpdateWorkspaceRequest, ProjectStore, ProjectFilter, Project, CreateProjectRequest, UpdateProjectRequest, UpdateProjectCapabilityBundlesResult, UserStore, User, CreateUserRequest, UpdateUserRequest, TenantStore, Tenant, CreateTenantRequest, UpdateTenantRequest, UserTenantLinkStore, UserTenantLink, CreateUserTenantLinkRequest, UpdateUserTenantLinkRequest, WorkflowTrackingStore, CreateWorkflowRunRequest, WorkflowRun, UpdateWorkflowRunRequest, QueryWorkflowRunsOptions, QueryWorkflowRunsResult, CreateRunStepRequest, RunStep, UpdateRunStepRequest, StepType, EvalStore, EvalProject, CreateEvalProjectRequest, EvalSuite, CreateEvalSuiteRequest, EvalCase, CreateEvalCaseRequest, EvalRun, CreateEvalRunRequest, EvalRunResult, EvalProjectReport, BindingRegistry, Binding, CreateBindingInput, BindingMutablePatch, BindingListParams, ChannelInstallationStore, ChannelInstallation, ChannelInstallationType, CreateChannelInstallationInput, UpdateChannelInstallationRequest, A2AApiKeyStore, A2AApiKeyRecord, CreateA2AApiKeyInput, UpdateA2AApiKeyInput, A2AApiKeyEntry, OpenAuditStore, OpenAuditQuery, OpenAuditRecord, OpenAuditAppendInput, AgentWebAppStore, AgentWebApp, CreateAgentWebAppInput, AgentWebAppStorePatch, AgentWebAppUpdateOptions, ScheduleStorage, ScheduledTaskDefinition, ScheduledTaskStatus, ScheduleExecutionType, TaskStore, CreateTaskRequest, TaskItem, TaskListFilter, TaskDependentListQuery, UpdateTaskRequest, TaskMutationSnapshot, TaskWorkItemStore, CreateWorkItemRequest, TaskWorkItem, CreateWorkItemIfAbsentRequest, TaskWorkItemListFilter, ProjectLifecycleEventQuery, MenuRegistry, MenuItem, CreateMenuItemInput, UpdateMenuItemInput, SharedResourceStore, ShareRecord, CreateShareRecord, CollectionStore, Collection, CreateCollectionRequest, UpdateCollectionRequest, VectorStoreProvider, VectorStoreCreateParams, CapabilityBundleStore, CapabilityBundle, InternalCreateCapabilityBundleInput, InternalUpdateCapabilityBundleInput, CapabilityBundleDeleteResult, ProjectRoomStore, ProjectRoom, ProjectMembershipStore, ProjectMembership, ProjectHumanRole, ProjectMembershipMutationResult, ProjectBotMembershipStore, ProjectBotMembership, ProjectRoomMessageStore, ProjectRoomMessage, ProjectRoomReadStateStore, ProjectRoomReadState, UserPushSubscriptionStore, UserPushSubscription, ModelProviderStore, ModelProviderEntry, CreateModelProviderRequest, UpdateModelProviderRequest, ModelProviderStatus, ModelProviderModelEntry, ProviderModelInput, LeaseStore, LeaseRecord, OutboxStore, OutboxEvent, PluginDeploymentStore, PluginDeployment, ChannelReplyJobStore, CreateChannelReplyJobInput, ChannelReplyJob, CheckpointStorage, CheckpointMaintenance, ThreadCheckpointStorage, StoreProtocol, StorePutInput, StoreItem, StoreSearchInput, SkillStore, Skill, CreateSkillRequest } from '@axiom-lattice/protocols';
+import { ThreadStore, Thread, CreateThreadRequest, AssistantStore, Assistant, CreateAssistantRequest, DatabaseConfigStore, DatabaseConfigEntry, CreateDatabaseConfigRequest, UpdateDatabaseConfigRequest, ConnectionStore, ConnectionEntry, MetricsServerConfigStore, MetricsServerConfigEntry, CreateMetricsServerConfigRequest, UpdateMetricsServerConfigRequest, McpServerConfigStore, McpServerConfigEntry, CreateMcpServerConfigRequest, UpdateMcpServerConfigRequest, WorkspaceStore, Workspace, CreateWorkspaceRequest, UpdateWorkspaceRequest, ProjectStore, ProjectFilter, Project, CreateProjectRequest, UpdateProjectRequest, UpdateProjectCapabilityBundlesResult, UserStore, User, CreateUserRequest, UpdateUserRequest, TenantStore, Tenant, CreateTenantRequest, UpdateTenantRequest, UserTenantLinkStore, UserTenantLink, CreateUserTenantLinkRequest, UpdateUserTenantLinkRequest, UserExternalIdentityStore, UserExternalIdentity, OidcProviderConfigStore, OidcProviderConfig, CreateOidcProviderConfigInput, UpdateOidcProviderConfigInput, PlatformMemberStore, PlatformMember, PlatformInvitationStore, PlatformInvitation, OidcIdentityClaimStore, OidcIdentityClaimStatus, OidcIdentityClaim, CreateOidcIdentityClaimInput, UpdateOidcIdentityClaimInput, OidcIdentityClaimApproval, InviteLinkStore, InviteLink, CreateInviteLinkInput, WorkflowTrackingStore, CreateWorkflowRunRequest, WorkflowRun, UpdateWorkflowRunRequest, QueryWorkflowRunsOptions, QueryWorkflowRunsResult, CreateRunStepRequest, RunStep, UpdateRunStepRequest, StepType, EvalStore, EvalProject, CreateEvalProjectRequest, EvalSuite, CreateEvalSuiteRequest, EvalCase, CreateEvalCaseRequest, EvalRun, CreateEvalRunRequest, EvalRunResult, EvalProjectReport, BindingRegistry, Binding, CreateBindingInput, BindingMutablePatch, BindingListParams, ChannelInstallationStore, ChannelInstallation, ChannelInstallationType, CreateChannelInstallationInput, UpdateChannelInstallationRequest, A2AApiKeyStore, A2AApiKeyRecord, CreateA2AApiKeyInput, UpdateA2AApiKeyInput, A2AApiKeyEntry, OpenAuditStore, OpenAuditQuery, OpenAuditRecord, OpenAuditAppendInput, AgentWebAppStore, AgentWebApp, CreateAgentWebAppInput, AgentWebAppStorePatch, AgentWebAppUpdateOptions, ScheduleStorage, ScheduledTaskDefinition, ScheduledTaskStatus, ScheduleExecutionType, TaskStore, CreateTaskRequest, TaskItem, TaskListFilter, TaskDependentListQuery, UpdateTaskRequest, TaskMutationSnapshot, TaskWorkItemStore, CreateWorkItemRequest, TaskWorkItem, CreateWorkItemIfAbsentRequest, TaskWorkItemListFilter, ProjectLifecycleEventQuery, MenuRegistry, MenuItem, CreateMenuItemInput, UpdateMenuItemInput, SharedResourceStore, ShareRecord, CreateShareRecord, CollectionStore, Collection, CreateCollectionRequest, UpdateCollectionRequest, VectorStoreProvider, VectorStoreCreateParams, CapabilityBundleStore, CapabilityBundle, InternalCreateCapabilityBundleInput, InternalUpdateCapabilityBundleInput, CapabilityBundleDeleteResult, ProjectRoomStore, ProjectRoom, ProjectMembershipStore, ProjectMembership, ProjectHumanRole, ProjectMembershipMutationResult, ProjectBotMembershipStore, ProjectBotMembership, ProjectRoomMessageStore, ProjectRoomMessage, ProjectRoomReadStateStore, ProjectRoomReadState, UserPushSubscriptionStore, UserPushSubscription, ModelProviderStore, ModelProviderEntry, CreateModelProviderRequest, UpdateModelProviderRequest, ModelProviderStatus, ModelProviderModelEntry, ProviderModelInput, LeaseStore, LeaseRecord, OutboxStore, OutboxEvent, PluginDeploymentStore, PluginDeployment, PlatformSettingsStore, PlatformSettingsRecord, PlatformSettingsDocument, ChannelReplyJobStore, CreateChannelReplyJobInput, ChannelReplyJob, CheckpointStorage, CheckpointMaintenance, ThreadCheckpointStorage, StoreProtocol, StorePutInput, StoreItem, StoreSearchInput, SkillStore, Skill, CreateSkillRequest } from '@axiom-lattice/protocols';
 export { AgentWebApp, AgentWebAppAppearance, AgentWebAppFeatures, AgentWebAppScope, AgentWebAppStatus, AgentWebAppStore, Assistant, AssistantStore, Binding, BindingRegistry, CapabilityBundle, CapabilityBundleStore, ChannelInstallation, ChannelInstallationStore, ConnectionEntry, ConnectionStore, CreateAgentWebAppInput, CreateAssistantRequest, CreateBindingInput, CreateCapabilityBundleInput, CreateChannelInstallationInput, CreateChannelInstallationRequest, CreateDatabaseConfigRequest, CreateEvalCaseRequest, CreateEvalProjectRequest, CreateEvalRunRequest, CreateEvalSuiteRequest, CreateMcpServerConfigRequest, CreateMenuItemInput, CreateMetricsServerConfigRequest, CreateProjectRequest, CreateRunStepRequest, CreateShareRequest, CreateSkillRequest, CreateTenantRequest, CreateThreadRequest, CreateUserRequest, CreateUserTenantLinkRequest, CreateWorkflowRunRequest, CreateWorkspaceRequest, DatabaseConfig, DatabaseConfigEntry, DatabaseConfigStore, DatabaseType, EvalCase, EvalProject, EvalProjectReport, EvalRun, EvalRunResult, EvalStore, EvalSuite, LarkChannelInstallationConfig, McpServerConfigEntry, McpServerConfigStore, MenuItem, MenuRegistry, MetricsServerConfig, MetricsServerConfigEntry, MetricsServerConfigStore, Project, ProjectStore, ResourceAddress, RunStep, ScheduleExecutionType, ScheduleStorage, ScheduledTaskDefinition, ScheduledTaskStatus, ShareRecord, ShareResult, ShareVisibility, SharedResourceStore, Skill, SkillStore, StorageType, Tenant, TenantStatus, TenantStore, Thread, ThreadStore, UpdateAgentWebAppInput, UpdateCapabilityBundleInput, UpdateChannelInstallationRequest, UpdateDatabaseConfigRequest, UpdateMcpServerConfigRequest, UpdateMetricsServerConfigRequest, UpdateProjectRequest, UpdateRunStepRequest, UpdateTenantRequest, UpdateUserRequest, UpdateUserTenantLinkRequest, UpdateWorkflowRunRequest, UpdateWorkspaceRequest, User, UserStore, UserTenantLink, UserTenantLinkStore, UserTenantRole, WorkflowRun, WorkflowTrackingStore, Workspace, WorkspaceStore } from '@axiom-lattice/protocols';
 import { IMessageQueueStore, AddMessageParams, PendingMessage, QueueScope, ClaimMessagesOptions, ThreadInfo, IAgentRunLedger, BeginAgentRunInput, AgentRunRecord, CreatePendingAgentRunInput, ListPendingRunsOptions, ClaimAgentRunInput, DeleteAgentRunExpected, AgentRunStatus, RollbackFailureResult, AgentRunRollbackResult, AgentRunExpiredOutcome, SettleExpiredRunOptions, AgentRunCounts, AgentRunSource, ReapedAgentRun } from '@axiom-lattice/core';
 export { AddMessageParams, PendingMessage, ThreadInfo } from '@axiom-lattice/core';
@@ -748,6 +748,133 @@ declare class PostgreSQLUserTenantLinkStore implements UserTenantLinkStore {
     hasLink(userId: string, tenantId: string): Promise<boolean>;
 }
 
+/**
+ * Raised when a row read from `lattice_user_identities` does not match the
+ * expected column types.
+ */
+declare class InvalidUserExternalIdentityRowError extends Error {
+    readonly code = "INVALID_USER_EXTERNAL_IDENTITY_ROW";
+    constructor();
+}
+declare class PostgreSQLUserExternalIdentityStore implements UserExternalIdentityStore {
+    private readonly pool;
+    constructor(options: {
+        pool: Pool;
+    });
+    getByProviderSubject(providerId: string, issuer: string, subject: string): Promise<UserExternalIdentity | null>;
+    listByUser(userId: string): Promise<UserExternalIdentity[]>;
+    link(identity: UserExternalIdentity): Promise<void>;
+    unlink(providerId: string, issuer: string, subject: string): Promise<void>;
+}
+
+/**
+ * PostgreSQL implementation of {@link OidcProviderConfigStore}.
+ *
+ * Persists OIDC provider configurations in `lattice_oidc_provider_configs`,
+ * encrypting the client secret at rest and using the database clock for
+ * `updated_at` on writes.
+ */
+declare class PostgreSQLOidcProviderConfigStore implements OidcProviderConfigStore {
+    private readonly pool;
+    constructor(options: {
+        pool: Pool;
+    });
+    list(): Promise<OidcProviderConfig[]>;
+    get(id: string): Promise<OidcProviderConfig | null>;
+    create(id: string, input: CreateOidcProviderConfigInput): Promise<OidcProviderConfig>;
+    update(id: string, updates: UpdateOidcProviderConfigInput): Promise<OidcProviderConfig | null>;
+    delete(id: string): Promise<boolean>;
+}
+
+/**
+ * PostgreSQL implementation of {@link PlatformMemberStore}.
+ *
+ * Persists platform grants in `lattice_platform_members`, keyed by user id.
+ */
+declare class PostgreSQLPlatformMemberStore implements PlatformMemberStore {
+    private readonly pool;
+    constructor(options: {
+        pool: Pool;
+    });
+    /** Lists every platform member ordered by user id. */
+    list(): Promise<PlatformMember[]>;
+    /** Returns the platform member for a user, or null. */
+    get(userId: string): Promise<PlatformMember | null>;
+    /**
+     * Inserts or replaces a member keyed by user id.
+     *
+     * The supplied grant replaces any existing row in full (last write wins),
+     * including `grantedAt` and `updatedAt`.
+     */
+    upsert(member: PlatformMember): Promise<PlatformMember>;
+    /** Deletes a member. Returns whether a row was removed. */
+    delete(userId: string): Promise<boolean>;
+}
+
+/**
+ * PostgreSQL implementation of {@link PlatformInvitationStore}.
+ *
+ * Persists invitations in `lattice_platform_invitations`, keyed by normalized
+ * email.
+ */
+declare class PostgreSQLPlatformInvitationStore implements PlatformInvitationStore {
+    private readonly pool;
+    constructor(options: {
+        pool: Pool;
+    });
+    /** Lists every invitation ordered by normalized email. */
+    list(): Promise<PlatformInvitation[]>;
+    /** Returns the invitation for an email, or null. */
+    get(email: string): Promise<PlatformInvitation | null>;
+    /**
+     * Inserts or replaces an invitation keyed by normalized email.
+     *
+     * The supplied invitation replaces any existing row in full (last write wins),
+     * including `expiresAt` and `consumedAt`.
+     */
+    upsert(invitation: PlatformInvitation): Promise<PlatformInvitation>;
+    /** Deletes an invitation. Returns whether a row was removed. */
+    delete(email: string): Promise<boolean>;
+    /**
+     * Atomically consumes a pending, unexpired invitation.
+     *
+     * Returns the consumed invitation, or null when the row is missing, already
+     * consumed, or expired.
+     */
+    consume(email: string, at: Date): Promise<PlatformInvitation | null>;
+}
+
+/** PostgreSQL implementation of {@link OidcIdentityClaimStore}. */
+declare class PostgreSQLOidcIdentityClaimStore implements OidcIdentityClaimStore {
+    private readonly pool;
+    constructor(options: {
+        pool: Pool;
+    });
+    list(status?: OidcIdentityClaimStatus): Promise<OidcIdentityClaim[]>;
+    get(id: string): Promise<OidcIdentityClaim | null>;
+    getPendingBySubject(providerId: string, issuer: string, subject: string, now: Date): Promise<OidcIdentityClaim | null>;
+    create(input: CreateOidcIdentityClaimInput): Promise<OidcIdentityClaim>;
+    updatePending(id: string, updates: UpdateOidcIdentityClaimInput, now: Date): Promise<OidcIdentityClaim | null>;
+    approve(id: string, approval: OidcIdentityClaimApproval, now: Date): Promise<OidcIdentityClaim | null>;
+    reject(id: string, reviewedBy: string, now: Date): Promise<OidcIdentityClaim | null>;
+    delete(id: string): Promise<boolean>;
+}
+
+/** PostgreSQL implementation of {@link InviteLinkStore}. */
+declare class PostgreSQLInviteLinkStore implements InviteLinkStore {
+    private readonly options;
+    constructor(options: {
+        pool: Pool;
+    });
+    private get pool();
+    list(): Promise<InviteLink[]>;
+    get(id: string): Promise<InviteLink | null>;
+    getByTokenHash(tokenHash: string): Promise<InviteLink | null>;
+    create(input: CreateInviteLinkInput): Promise<InviteLink>;
+    consume(tokenHash: string, now: Date): Promise<InviteLink | null>;
+    revoke(id: string, now: Date): Promise<InviteLink | null>;
+}
+
 /**
  * PostgreSQL implementation of WorkflowTrackingStore
  */
@@ -2093,6 +2220,17 @@ declare class PostgreSQLAgentRunLedger implements IAgentRunLedger {
     reapLegacyExpired(): Promise<ReapedAgentRun[]>;
 }
 
+/** PostgreSQL implementation of {@link PlatformSettingsStore}. */
+declare class PostgreSQLPlatformSettingsStore implements PlatformSettingsStore {
+    private readonly options;
+    constructor(options: {
+        pool: Pool;
+    });
+    private get pool();
+    get(): Promise<PlatformSettingsRecord | null>;
+    save(document: PlatformSettingsDocument, expectedVersion: number, updatedBy?: string): Promise<PlatformSettingsRecord>;
+}
+
 /** Options accepted by {@link PostgreSQLChannelReplyJobStore}. */
 interface PostgreSQLChannelReplyJobStoreOptions {
     /** Externally managed pool. When supplied, migrations are not run here. */
@@ -2292,6 +2430,13 @@ declare function createPgStoreConfig(connectionString: string): Promise<{
     user: PostgreSQLUserStore;
     tenant: PostgreSQLTenantStore;
     userTenantLink: PostgreSQLUserTenantLinkStore;
+    userExternalIdentity: PostgreSQLUserExternalIdentityStore;
+    oidcProviderConfig: PostgreSQLOidcProviderConfigStore;
+    platformMember: PostgreSQLPlatformMemberStore;
+    platformInvitation: PostgreSQLPlatformInvitationStore;
+    oidcIdentityClaim: PostgreSQLOidcIdentityClaimStore;
+    inviteLink: PostgreSQLInviteLinkStore;
+    platformSettings: PostgreSQLPlatformSettingsStore;
     channelBinding: ChannelBindingStore;
     channelInstallation: PostgreSQLChannelInstallationStore;
     thread: PostgreSQLThreadStore;
@@ -2480,6 +2625,37 @@ declare class MigrationManager {
     getCurrentVersion(): Promise<number>;
 }
 
+declare const createUserExternalIdentityTable: Migration;
+
+/**
+ * Enforce case-insensitive email uniqueness.
+ *
+ * `lower(email)` is the lookup identity used by every UserStore, so the
+ * database must reject rows that differ only by case. This migration fails
+ * closed on an existing database that still has duplicate lower(email) rows.
+ */
+declare const createUserEmailLowerUniqueIndex: Migration;
+
+declare const createOidcProviderConfigsTable: Migration;
+
+/** Creates the platform member table keyed by user id. */
+declare const createPlatformMembersTable: Migration;
+
+/** Creates the platform invitation table keyed by normalized email. */
+declare const createPlatformInvitationsTable: Migration;
+
+/** Creates pending enterprise-SSO identity claims. */
+declare const createOidcIdentityClaimsTable: Migration;
+
+/** Creates durable bearer invitation links. */
+declare const createInviteLinksTable: Migration;
+
+/** Adds invite-link request context to pending identity claims. */
+declare const addOidcIdentityClaimInviteFields: Migration;
+
+/** Creates the single-row durable platform settings table. */
+declare const createPlatformSettingsTable: Migration;
+
 /**
  * Thread table migrations
  */
@@ -2873,4 +3049,4 @@ declare const createChannelReplyJobsTable: Migration;
  */
 declare const createStoreItemsTable: Migration;
 
-export { ChannelBindingStore, type ChannelBindingStoreOptions, type ChannelIdentityMapping, ChannelIdentityMappingStore, type ChannelIdentityMappingStoreOptions, CheckpointBaseNotFoundError, CheckpointTargetNotEmptyError, type CreateChannelIdentityMappingInput, DuplicateProjectMembershipError, DuplicateProjectRoomMessageIdempotencyKeyError, InvalidFileShareAddressError, InvalidMcpAppShareAddressError, InvalidMcpAppShareVisibilityError, MenuStore, type MenuStoreOptions, type Migration, MigrationManager, PGVectorStoreProvider, PostgreSQLA2AApiKeyStore, type PostgreSQLA2AApiKeyStoreOptions, PostgreSQLAgentRunLedger, type PostgreSQLAgentRunLedgerOptions, PostgreSQLAgentWebAppStore, type PostgreSQLAgentWebAppStoreOptions, PostgreSQLAssistantStore, type PostgreSQLAssistantStoreOptions, PostgreSQLCapabilityBundleStore, type PostgreSQLCapabilityBundleStoreOptions, PostgreSQLChannelInstallationStore, type PostgreSQLChannelInstallationStoreOptions, PostgreSQLChannelReplyJobStore, type PostgreSQLChannelReplyJobStoreOptions, PostgreSQLCheckpointStorage, PostgreSQLCollectionStore, type PostgreSQLCollectionStoreOptions, PostgreSQLConnectionStore, PostgreSQLDatabaseConfigStore, type PostgreSQLDatabaseConfigStoreOptions, PostgreSQLEvalStore, type PostgreSQLEvalStoreOptions, PostgreSQLMcpServerConfigStore, type PostgreSQLMcpServerConfigStoreOptions, PostgreSQLMetricsServerConfigStore, type PostgreSQLMetricsServerConfigStoreOptions, PostgreSQLModelProviderStore, type PostgreSQLModelProviderStoreOptions, PostgreSQLOpenAuditStore, type PostgreSQLOpenAuditStoreOptions, PostgreSQLPluginDeploymentStore, PostgreSQLProjectBotMembershipStore, PostgreSQLProjectMembershipStore, PostgreSQLProjectRoomMessageStore, PostgreSQLProjectRoomReadStateStore, PostgreSQLProjectRoomStore, PostgreSQLProjectStore, type PostgreSQLProjectStoreOptions, PostgreSQLScheduleStorage, type PostgreSQLScheduleStorageOptions, PostgreSQLSkillStore, type PostgreSQLSkillStoreOptions, PostgreSQLStore, PostgreSQLTaskWorkItemStore, type PostgreSQLTaskWorkItemStoreOptions, PostgreSQLTenantStore, type PostgreSQLTenantStoreOptions, type PostgreSQLThreadMessageQueueStoreOptions, PostgreSQLThreadStore, type PostgreSQLThreadStoreOptions, PostgreSQLUserStore, type PostgreSQLUserStoreOptions, PostgreSQLUserTenantLinkStore, type PostgreSQLUserTenantLinkStoreOptions, PostgreSQLWorkflowTrackingStore, type PostgreSQLWorkflowTrackingStoreOptions, PostgreSQLWorkspaceStore, type PostgreSQLWorkspaceStoreOptions, PostgresSharedResourceStore, type PostgresSharedResourceStoreOptions, ProjectBotMembershipIdConflictError, ProjectMembershipIdConflictError, ProjectRoomMessageIdConflictError, ThreadMessageQueueStore, addAssistantTenantId, addCancelRequestedToEvalRuns, addEnvToEvalRuns, addFileContentType, addHoldoutToEvalRuns, addInterruptColumnsToEval, addInterruptPolicyToEvalCases, addMcpAppContentType, addProjectConfigColumn, addScheduleTenantId, addShareKind, addSkillTenantId, addStepThreadId, addTaskIdToEvalRuns, addThreadExpiresAt, addThreadTenantId, addWorkflowRunsTenantStatusUpdatedIndex, alterChannelInstallationsTable, changeAssistantPrimaryKey, changeSkillPrimaryKey, changeThreadPrimaryKey, createA2AApiKeysTable, createAgentRunLedgerTable, createAgentWebAppsTable, createAssistantsTable, createCapabilityBundlesTable, createChannelBindingsTable, createChannelIdentityMappingTables, createChannelInstallationsTable, createChannelReplyJobsTable, createCollectionsTable, createDatabaseConfigsTable, createEvalCasesTable, createEvalProjectsTable, createEvalRunResultsTable, createEvalRunsTable, createEvalSuitesTable, createMcpServerConfigsTable, createMenuItemsTable, createMetricsConfigsTable, createPGVectorStoreProvider, createPgStoreConfig, createPluginDeployments, createProjectRoomReadStates, createProjectRoomTables, createProjectsTable, createScheduledTasksTable, createSharedResourcesTable, createSkillsTable, createStoreItemsTable, createTenantsTable, createThreadMessageQueueTable, createThreadsTable, createUsersTable, createWorkflowTrackingTables, createWorkspacesTable, dropPluginDeploymentAuthToken, enforceUniqueEvalProjectName, evalMigrations, mapRowToRunStep, mapRowToWorkflowRun, safeParse };
+export { ChannelBindingStore, type ChannelBindingStoreOptions, type ChannelIdentityMapping, ChannelIdentityMappingStore, type ChannelIdentityMappingStoreOptions, CheckpointBaseNotFoundError, CheckpointTargetNotEmptyError, type CreateChannelIdentityMappingInput, DuplicateProjectMembershipError, DuplicateProjectRoomMessageIdempotencyKeyError, InvalidFileShareAddressError, InvalidMcpAppShareAddressError, InvalidMcpAppShareVisibilityError, InvalidUserExternalIdentityRowError, MenuStore, type MenuStoreOptions, type Migration, MigrationManager, PGVectorStoreProvider, PostgreSQLA2AApiKeyStore, type PostgreSQLA2AApiKeyStoreOptions, PostgreSQLAgentRunLedger, type PostgreSQLAgentRunLedgerOptions, PostgreSQLAgentWebAppStore, type PostgreSQLAgentWebAppStoreOptions, PostgreSQLAssistantStore, type PostgreSQLAssistantStoreOptions, PostgreSQLCapabilityBundleStore, type PostgreSQLCapabilityBundleStoreOptions, PostgreSQLChannelInstallationStore, type PostgreSQLChannelInstallationStoreOptions, PostgreSQLChannelReplyJobStore, type PostgreSQLChannelReplyJobStoreOptions, PostgreSQLCheckpointStorage, PostgreSQLCollectionStore, type PostgreSQLCollectionStoreOptions, PostgreSQLConnectionStore, PostgreSQLDatabaseConfigStore, type PostgreSQLDatabaseConfigStoreOptions, PostgreSQLEvalStore, type PostgreSQLEvalStoreOptions, PostgreSQLInviteLinkStore, PostgreSQLMcpServerConfigStore, type PostgreSQLMcpServerConfigStoreOptions, PostgreSQLMetricsServerConfigStore, type PostgreSQLMetricsServerConfigStoreOptions, PostgreSQLModelProviderStore, type PostgreSQLModelProviderStoreOptions, PostgreSQLOidcIdentityClaimStore, PostgreSQLOidcProviderConfigStore, PostgreSQLOpenAuditStore, type PostgreSQLOpenAuditStoreOptions, PostgreSQLPlatformInvitationStore, PostgreSQLPlatformMemberStore, PostgreSQLPlatformSettingsStore, PostgreSQLPluginDeploymentStore, PostgreSQLProjectBotMembershipStore, PostgreSQLProjectMembershipStore, PostgreSQLProjectRoomMessageStore, PostgreSQLProjectRoomReadStateStore, PostgreSQLProjectRoomStore, PostgreSQLProjectStore, type PostgreSQLProjectStoreOptions, PostgreSQLScheduleStorage, type PostgreSQLScheduleStorageOptions, PostgreSQLSkillStore, type PostgreSQLSkillStoreOptions, PostgreSQLStore, PostgreSQLTaskWorkItemStore, type PostgreSQLTaskWorkItemStoreOptions, PostgreSQLTenantStore, type PostgreSQLTenantStoreOptions, type PostgreSQLThreadMessageQueueStoreOptions, PostgreSQLThreadStore, type PostgreSQLThreadStoreOptions, PostgreSQLUserExternalIdentityStore, PostgreSQLUserStore, type PostgreSQLUserStoreOptions, PostgreSQLUserTenantLinkStore, type PostgreSQLUserTenantLinkStoreOptions, PostgreSQLWorkflowTrackingStore, type PostgreSQLWorkflowTrackingStoreOptions, PostgreSQLWorkspaceStore, type PostgreSQLWorkspaceStoreOptions, PostgresSharedResourceStore, type PostgresSharedResourceStoreOptions, ProjectBotMembershipIdConflictError, ProjectMembershipIdConflictError, ProjectRoomMessageIdConflictError, ThreadMessageQueueStore, addAssistantTenantId, addCancelRequestedToEvalRuns, addEnvToEvalRuns, addFileContentType, addHoldoutToEvalRuns, addInterruptColumnsToEval, addInterruptPolicyToEvalCases, addMcpAppContentType, addOidcIdentityClaimInviteFields, addProjectConfigColumn, addScheduleTenantId, addShareKind, addSkillTenantId, addStepThreadId, addTaskIdToEvalRuns, addThreadExpiresAt, addThreadTenantId, addWorkflowRunsTenantStatusUpdatedIndex, alterChannelInstallationsTable, changeAssistantPrimaryKey, changeSkillPrimaryKey, changeThreadPrimaryKey, createA2AApiKeysTable, createAgentRunLedgerTable, createAgentWebAppsTable, createAssistantsTable, createCapabilityBundlesTable, createChannelBindingsTable, createChannelIdentityMappingTables, createChannelInstallationsTable, createChannelReplyJobsTable, createCollectionsTable, createDatabaseConfigsTable, createEvalCasesTable, createEvalProjectsTable, createEvalRunResultsTable, createEvalRunsTable, createEvalSuitesTable, createInviteLinksTable, createMcpServerConfigsTable, createMenuItemsTable, createMetricsConfigsTable, createOidcIdentityClaimsTable, createOidcProviderConfigsTable, createPGVectorStoreProvider, createPgStoreConfig, createPlatformInvitationsTable, createPlatformMembersTable, createPlatformSettingsTable, createPluginDeployments, createProjectRoomReadStates, createProjectRoomTables, createProjectsTable, createScheduledTasksTable, createSharedResourcesTable, createSkillsTable, createStoreItemsTable, createTenantsTable, createThreadMessageQueueTable, createThreadsTable, createUserEmailLowerUniqueIndex, createUserExternalIdentityTable, createUsersTable, createWorkflowTrackingTables, createWorkspacesTable, dropPluginDeploymentAuthToken, enforceUniqueEvalProjectName, evalMigrations, mapRowToRunStep, mapRowToWorkflowRun, safeParse };