@axiom-lattice/pg-stores 5.0.3 → 5.1.0

package/dist/index.js

@@ -39,6 +39,7 @@ __export(index_exports, {
   InvalidFileShareAddressError: () => InvalidFileShareAddressError,
   InvalidMcpAppShareAddressError: () => InvalidMcpAppShareAddressError,
   InvalidMcpAppShareVisibilityError: () => InvalidMcpAppShareVisibilityError,
+  InvalidUserExternalIdentityRowError: () => InvalidUserExternalIdentityRowError,
   MenuStore: () => MenuStore,
   MigrationManager: () => MigrationManager,
   PGVectorStoreProvider: () => PGVectorStoreProvider,
@@ -55,10 +56,16 @@ __export(index_exports, {
   PostgreSQLConnectionStore: () => PostgreSQLConnectionStore,
   PostgreSQLDatabaseConfigStore: () => PostgreSQLDatabaseConfigStore,
   PostgreSQLEvalStore: () => PostgreSQLEvalStore,
+  PostgreSQLInviteLinkStore: () => PostgreSQLInviteLinkStore,
   PostgreSQLMcpServerConfigStore: () => PostgreSQLMcpServerConfigStore,
   PostgreSQLMetricsServerConfigStore: () => PostgreSQLMetricsServerConfigStore,
   PostgreSQLModelProviderStore: () => PostgreSQLModelProviderStore,
+  PostgreSQLOidcIdentityClaimStore: () => PostgreSQLOidcIdentityClaimStore,
+  PostgreSQLOidcProviderConfigStore: () => PostgreSQLOidcProviderConfigStore,
   PostgreSQLOpenAuditStore: () => PostgreSQLOpenAuditStore,
+  PostgreSQLPlatformInvitationStore: () => PostgreSQLPlatformInvitationStore,
+  PostgreSQLPlatformMemberStore: () => PostgreSQLPlatformMemberStore,
+  PostgreSQLPlatformSettingsStore: () => PostgreSQLPlatformSettingsStore,
   PostgreSQLPluginDeploymentStore: () => PostgreSQLPluginDeploymentStore,
   PostgreSQLProjectBotMembershipStore: () => PostgreSQLProjectBotMembershipStore,
   PostgreSQLProjectMembershipStore: () => PostgreSQLProjectMembershipStore,
@@ -72,6 +79,7 @@ __export(index_exports, {
   PostgreSQLTaskWorkItemStore: () => PostgreSQLTaskWorkItemStore,
   PostgreSQLTenantStore: () => PostgreSQLTenantStore,
   PostgreSQLThreadStore: () => PostgreSQLThreadStore,
+  PostgreSQLUserExternalIdentityStore: () => PostgreSQLUserExternalIdentityStore,
   PostgreSQLUserStore: () => PostgreSQLUserStore,
   PostgreSQLUserTenantLinkStore: () => PostgreSQLUserTenantLinkStore,
   PostgreSQLWorkflowTrackingStore: () => PostgreSQLWorkflowTrackingStore,
@@ -89,6 +97,7 @@ __export(index_exports, {
   addInterruptColumnsToEval: () => addInterruptColumnsToEval,
   addInterruptPolicyToEvalCases: () => addInterruptPolicyToEvalCases,
   addMcpAppContentType: () => addMcpAppContentType,
+  addOidcIdentityClaimInviteFields: () => addOidcIdentityClaimInviteFields,
   addProjectConfigColumn: () => addProjectConfigColumn,
   addScheduleTenantId: () => addScheduleTenantId,
   addShareKind: () => addShareKind,
@@ -118,11 +127,17 @@ __export(index_exports, {
   createEvalRunResultsTable: () => createEvalRunResultsTable,
   createEvalRunsTable: () => createEvalRunsTable,
   createEvalSuitesTable: () => createEvalSuitesTable,
+  createInviteLinksTable: () => createInviteLinksTable,
   createMcpServerConfigsTable: () => createMcpServerConfigsTable,
   createMenuItemsTable: () => createMenuItemsTable,
   createMetricsConfigsTable: () => createMetricsConfigsTable,
+  createOidcIdentityClaimsTable: () => createOidcIdentityClaimsTable,
+  createOidcProviderConfigsTable: () => createOidcProviderConfigsTable,
   createPGVectorStoreProvider: () => createPGVectorStoreProvider,
   createPgStoreConfig: () => createPgStoreConfig,
+  createPlatformInvitationsTable: () => createPlatformInvitationsTable,
+  createPlatformMembersTable: () => createPlatformMembersTable,
+  createPlatformSettingsTable: () => createPlatformSettingsTable,
   createPluginDeployments: () => createPluginDeployments,
   createProjectRoomReadStates: () => createProjectRoomReadStates,
   createProjectRoomTables: () => createProjectRoomTables,
@@ -134,6 +149,8 @@ __export(index_exports, {
   createTenantsTable: () => createTenantsTable,
   createThreadMessageQueueTable: () => createThreadMessageQueueTable,
   createThreadsTable: () => createThreadsTable,
+  createUserEmailLowerUniqueIndex: () => createUserEmailLowerUniqueIndex,
+  createUserExternalIdentityTable: () => createUserExternalIdentityTable,
   createUsersTable: () => createUsersTable,
   createWorkflowTrackingTables: () => createWorkflowTrackingTables,
   createWorkspacesTable: () => createWorkspacesTable,
@@ -3094,9 +3111,10 @@ var PostgreSQLUserStore = class {
       `
         SELECT id, email, name, status, metadata, created_at, updated_at
         FROM lattice_users
-        WHERE email = $1
+        WHERE lower(email) = lower($1)
+        LIMIT 1
       `,
-      [email]
+      [email.trim()]
     );
     if (result.rows.length === 0) return null;
     return this.mapRowToUser(result.rows[0]);
@@ -3610,30 +3628,705 @@ var PostgreSQLUserTenantLinkStore = class {
       `,
       updateValues
     );
-    return this.getLink(userId, tenantId);
+    return this.getLink(userId, tenantId);
+  }
+  async deleteLink(userId, tenantId) {
+    await this.ensureInitialized();
+    const result = await this.pool.query(
+      `
+        DELETE FROM lattice_user_tenant_links
+        WHERE user_id = $1 AND tenant_id = $2
+      `,
+      [userId, tenantId]
+    );
+    return result.rowCount !== null && result.rowCount > 0;
+  }
+  async hasLink(userId, tenantId) {
+    await this.ensureInitialized();
+    const result = await this.pool.query(
+      `
+        SELECT 1 FROM lattice_user_tenant_links
+        WHERE user_id = $1 AND tenant_id = $2
+        LIMIT 1
+      `,
+      [userId, tenantId]
+    );
+    return result.rows.length > 0;
+  }
+};
+
+// src/stores/PostgreSQLUserExternalIdentityStore.ts
+var import_protocols2 = require("@axiom-lattice/protocols");
+var InvalidUserExternalIdentityRowError = class extends Error {
+  constructor() {
+    super("Invalid user external identity row");
+    this.code = "INVALID_USER_EXTERNAL_IDENTITY_ROW";
+    this.name = "InvalidUserExternalIdentityRowError";
+  }
+};
+var columns = "user_id, provider_id, issuer, subject, email, linked_at";
+function mapRow(row) {
+  if (typeof row.user_id !== "string" || typeof row.provider_id !== "string" || typeof row.issuer !== "string" || typeof row.subject !== "string" || !(row.linked_at instanceof Date) || Number.isNaN(row.linked_at.getTime())) {
+    throw new InvalidUserExternalIdentityRowError();
+  }
+  return {
+    userId: row.user_id,
+    providerId: row.provider_id,
+    issuer: row.issuer,
+    subject: row.subject,
+    ...typeof row.email === "string" ? { email: row.email } : {},
+    linkedAt: row.linked_at
+  };
+}
+var PostgreSQLUserExternalIdentityStore = class {
+  constructor(options) {
+    this.pool = options.pool;
+  }
+  async getByProviderSubject(providerId, issuer, subject) {
+    const result = await this.pool.query(
+      `SELECT ${columns} FROM lattice_user_identities
+       WHERE provider_id = $1 AND issuer = $2 AND subject = $3`,
+      [providerId, issuer, subject]
+    );
+    return result.rows[0] ? mapRow(result.rows[0]) : null;
+  }
+  async listByUser(userId) {
+    const result = await this.pool.query(
+      `SELECT ${columns} FROM lattice_user_identities WHERE user_id = $1 ORDER BY linked_at ASC`,
+      [userId]
+    );
+    return result.rows.map(mapRow);
+  }
+  async link(identity) {
+    const inserted = await this.pool.query(
+      `INSERT INTO lattice_user_identities (${columns})
+       VALUES ($1, $2, $3, $4, $5, $6)
+       ON CONFLICT (provider_id, issuer, subject) DO NOTHING
+       RETURNING ${columns}`,
+      [
+        identity.userId,
+        identity.providerId,
+        identity.issuer,
+        identity.subject,
+        identity.email ?? null,
+        identity.linkedAt
+      ]
+    );
+    if (inserted.rows[0]) return;
+    const existing = await this.getByProviderSubject(
+      identity.providerId,
+      identity.issuer,
+      identity.subject
+    );
+    if (!existing) {
+      throw new import_protocols2.ExternalIdentityPersistError(
+        identity.providerId,
+        identity.issuer,
+        identity.subject
+      );
+    }
+    if (existing.userId !== identity.userId) {
+      throw new import_protocols2.ExternalIdentityConflictError(
+        identity.providerId,
+        identity.issuer,
+        identity.subject
+      );
+    }
+    if (identity.email !== void 0 && identity.email !== existing.email) {
+      await this.pool.query(
+        `UPDATE lattice_user_identities SET email = $1
+         WHERE provider_id = $2 AND issuer = $3 AND subject = $4`,
+        [identity.email, identity.providerId, identity.issuer, identity.subject]
+      );
+    }
+  }
+  async unlink(providerId, issuer, subject) {
+    await this.pool.query(
+      `DELETE FROM lattice_user_identities
+       WHERE provider_id = $1 AND issuer = $2 AND subject = $3`,
+      [providerId, issuer, subject]
+    );
+  }
+};
+
+// src/stores/PostgreSQLOidcProviderConfigStore.ts
+var import_core5 = require("@axiom-lattice/core");
+var import_protocols3 = require("@axiom-lattice/protocols");
+var TABLE2 = "lattice_oidc_provider_configs";
+function parseAllowedPrivateHosts(value) {
+  if (!Array.isArray(value)) return void 0;
+  return value.filter((entry) => typeof entry === "string");
+}
+function serializeAllowedPrivateHosts(value) {
+  return value === void 0 ? null : JSON.stringify(value);
+}
+function normalizeTenantId(value) {
+  if (typeof value !== "string") return void 0;
+  const trimmed = value.trim();
+  return trimmed.length > 0 ? trimmed : void 0;
+}
+function mapRow2(row) {
+  if (typeof row.id !== "string" || typeof row.display_name !== "string" || typeof row.issuer !== "string" || typeof row.client_id !== "string" || typeof row.client_secret !== "string" || typeof row.scopes !== "string" || typeof row.enabled !== "boolean" || typeof row.jit_provisioning !== "boolean" || typeof row.auto_link_email !== "boolean" || !(row.created_at instanceof Date) || !(row.updated_at instanceof Date)) {
+    throw new Error("Invalid OIDC provider config row");
+  }
+  const allowedPrivateHosts = parseAllowedPrivateHosts(
+    row.allowed_private_hosts
+  );
+  return {
+    id: row.id,
+    displayName: row.display_name,
+    issuer: row.issuer,
+    clientId: row.client_id,
+    clientSecret: (0, import_core5.safeDecrypt)(
+      row.client_secret,
+      `OIDC provider config "${row.id}" client secret`
+    ),
+    scopes: row.scopes,
+    enabled: row.enabled,
+    jitProvisioning: row.jit_provisioning,
+    autoLinkEmail: row.auto_link_email,
+    ...typeof row.default_tenant_id === "string" ? { defaultTenantId: row.default_tenant_id } : {},
+    ...allowedPrivateHosts !== void 0 ? { allowedPrivateHosts } : {},
+    createdAt: row.created_at,
+    updatedAt: row.updated_at
+  };
+}
+function isUniqueViolation(error) {
+  return typeof error === "object" && error !== null && "code" in error && error.code === "23505";
+}
+var PostgreSQLOidcProviderConfigStore = class {
+  constructor(options) {
+    this.pool = options.pool;
+  }
+  async list() {
+    const result = await this.pool.query(
+      `SELECT * FROM ${TABLE2} ORDER BY created_at ASC, id ASC`
+    );
+    return result.rows.map(mapRow2);
+  }
+  async get(id) {
+    const result = await this.pool.query(
+      `SELECT * FROM ${TABLE2} WHERE id = $1`,
+      [id]
+    );
+    return result.rows[0] ? mapRow2(result.rows[0]) : null;
+  }
+  async create(id, input) {
+    const tenantId = normalizeTenantId(input.defaultTenantId);
+    try {
+      await this.pool.query(
+        `INSERT INTO ${TABLE2}
+         (id, display_name, issuer, client_id, client_secret, scopes,
+          enabled, jit_provisioning, auto_link_email, default_tenant_id,
+          allowed_private_hosts)
+         VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11)`,
+        [
+          id,
+          input.displayName,
+          input.issuer,
+          input.clientId,
+          (0, import_core5.encrypt)(input.clientSecret),
+          input.scopes,
+          input.enabled,
+          input.jitProvisioning,
+          input.autoLinkEmail,
+          tenantId ?? null,
+          serializeAllowedPrivateHosts(input.allowedPrivateHosts)
+        ]
+      );
+    } catch (error) {
+      if (isUniqueViolation(error)) {
+        throw new import_protocols3.OidcProviderConfigConflictError(id);
+      }
+      throw error;
+    }
+    const created = await this.get(id);
+    if (!created) {
+      throw new Error(`OIDC provider config "${id}" was not persisted`);
+    }
+    return created;
+  }
+  async update(id, updates) {
+    const existing = await this.get(id);
+    if (!existing) return null;
+    const setClauses = [];
+    const values = [];
+    let paramIndex = 1;
+    const set = (column, value) => {
+      setClauses.push(`${column} = $${paramIndex++}`);
+      values.push(value);
+    };
+    if (updates.displayName !== void 0) set("display_name", updates.displayName);
+    if (updates.issuer !== void 0) set("issuer", updates.issuer);
+    if (updates.clientId !== void 0) set("client_id", updates.clientId);
+    if (updates.clientSecret !== void 0 && updates.clientSecret !== "") {
+      set("client_secret", (0, import_core5.encrypt)(updates.clientSecret));
+    }
+    if (updates.scopes !== void 0) set("scopes", updates.scopes);
+    if (updates.enabled !== void 0) set("enabled", updates.enabled);
+    if (updates.jitProvisioning !== void 0) {
+      set("jit_provisioning", updates.jitProvisioning);
+    }
+    if (updates.autoLinkEmail !== void 0) {
+      set("auto_link_email", updates.autoLinkEmail);
+    }
+    if (updates.defaultTenantId !== void 0) {
+      set("default_tenant_id", normalizeTenantId(updates.defaultTenantId) ?? null);
+    }
+    if (updates.allowedPrivateHosts !== void 0) {
+      set(
+        "allowed_private_hosts",
+        serializeAllowedPrivateHosts(updates.allowedPrivateHosts)
+      );
+    }
+    if (setClauses.length === 0) return existing;
+    setClauses.push("updated_at = NOW()");
+    values.push(id);
+    await this.pool.query(
+      `UPDATE ${TABLE2} SET ${setClauses.join(", ")} WHERE id = $${paramIndex}`,
+      values
+    );
+    return this.get(id);
+  }
+  async delete(id) {
+    const result = await this.pool.query(`DELETE FROM ${TABLE2} WHERE id = $1`, [id]);
+    return (result.rowCount ?? 0) > 0;
+  }
+};
+
+// src/stores/PostgreSQLPlatformMemberStore.ts
+var TABLE3 = "lattice_platform_members";
+var ROLES = ["owner", "admin", "auditor"];
+function isPlatformRole(value) {
+  return ROLES.includes(value);
+}
+function mapRow3(row) {
+  if (typeof row.user_id !== "string" || typeof row.role !== "string" || !isPlatformRole(row.role) || !(row.granted_at instanceof Date) || !(row.updated_at instanceof Date)) {
+    throw new Error("Invalid platform member row");
+  }
+  return {
+    userId: row.user_id,
+    role: row.role,
+    ...typeof row.granted_by === "string" ? { grantedBy: row.granted_by } : {},
+    grantedAt: row.granted_at,
+    updatedAt: row.updated_at
+  };
+}
+var PostgreSQLPlatformMemberStore = class {
+  constructor(options) {
+    this.pool = options.pool;
+  }
+  /** Lists every platform member ordered by user id. */
+  async list() {
+    const result = await this.pool.query(
+      `SELECT * FROM ${TABLE3} ORDER BY user_id ASC`
+    );
+    return result.rows.map(mapRow3);
+  }
+  /** Returns the platform member for a user, or null. */
+  async get(userId) {
+    const result = await this.pool.query(
+      `SELECT * FROM ${TABLE3} WHERE user_id = $1`,
+      [userId]
+    );
+    return result.rows[0] ? mapRow3(result.rows[0]) : null;
+  }
+  /**
+   * Inserts or replaces a member keyed by user id.
+   *
+   * The supplied grant replaces any existing row in full (last write wins),
+   * including `grantedAt` and `updatedAt`.
+   */
+  async upsert(member) {
+    const result = await this.pool.query(
+      `INSERT INTO ${TABLE3} (user_id, role, granted_by, granted_at, updated_at)
+       VALUES ($1, $2, $3, $4, $5)
+       ON CONFLICT (user_id) DO UPDATE SET
+         role = EXCLUDED.role,
+         granted_by = EXCLUDED.granted_by,
+         granted_at = EXCLUDED.granted_at,
+         updated_at = EXCLUDED.updated_at
+       RETURNING *`,
+      [
+        member.userId,
+        member.role,
+        member.grantedBy ?? null,
+        member.grantedAt,
+        member.updatedAt
+      ]
+    );
+    return mapRow3(result.rows[0]);
+  }
+  /** Deletes a member. Returns whether a row was removed. */
+  async delete(userId) {
+    const result = await this.pool.query(`DELETE FROM ${TABLE3} WHERE user_id = $1`, [
+      userId
+    ]);
+    return (result.rowCount ?? 0) > 0;
+  }
+};
+
+// src/stores/PostgreSQLPlatformInvitationStore.ts
+var import_protocols4 = require("@axiom-lattice/protocols");
+var TABLE4 = "lattice_platform_invitations";
+var ROLES2 = ["owner", "admin", "auditor"];
+function isPlatformRole2(value) {
+  return ROLES2.includes(value);
+}
+function mapRow4(row) {
+  if (typeof row.email !== "string" || typeof row.role !== "string" || !isPlatformRole2(row.role) || !(row.created_at instanceof Date)) {
+    throw new Error("Invalid platform invitation row");
+  }
+  return {
+    email: row.email,
+    role: row.role,
+    ...typeof row.invited_by === "string" ? { invitedBy: row.invited_by } : {},
+    createdAt: row.created_at,
+    ...row.expires_at instanceof Date ? { expiresAt: row.expires_at } : {},
+    ...row.consumed_at instanceof Date ? { consumedAt: row.consumed_at } : {}
+  };
+}
+var PostgreSQLPlatformInvitationStore = class {
+  constructor(options) {
+    this.pool = options.pool;
+  }
+  /** Lists every invitation ordered by normalized email. */
+  async list() {
+    const result = await this.pool.query(
+      `SELECT * FROM ${TABLE4} ORDER BY email ASC`
+    );
+    return result.rows.map(mapRow4);
+  }
+  /** Returns the invitation for an email, or null. */
+  async get(email) {
+    const result = await this.pool.query(
+      `SELECT * FROM ${TABLE4} WHERE email = $1`,
+      [(0, import_protocols4.normalizePlatformInvitationEmail)(email)]
+    );
+    return result.rows[0] ? mapRow4(result.rows[0]) : null;
+  }
+  /**
+   * Inserts or replaces an invitation keyed by normalized email.
+   *
+   * The supplied invitation replaces any existing row in full (last write wins),
+   * including `expiresAt` and `consumedAt`.
+   */
+  async upsert(invitation) {
+    const result = await this.pool.query(
+      `INSERT INTO ${TABLE4}
+         (email, role, invited_by, created_at, expires_at, consumed_at)
+       VALUES ($1, $2, $3, $4, $5, $6)
+       ON CONFLICT (email) DO UPDATE SET
+         role = EXCLUDED.role,
+         invited_by = EXCLUDED.invited_by,
+         created_at = EXCLUDED.created_at,
+         expires_at = EXCLUDED.expires_at,
+         consumed_at = EXCLUDED.consumed_at
+       RETURNING *`,
+      [
+        (0, import_protocols4.normalizePlatformInvitationEmail)(invitation.email),
+        invitation.role,
+        invitation.invitedBy ?? null,
+        invitation.createdAt,
+        invitation.expiresAt ?? null,
+        invitation.consumedAt ?? null
+      ]
+    );
+    return mapRow4(result.rows[0]);
+  }
+  /** Deletes an invitation. Returns whether a row was removed. */
+  async delete(email) {
+    const result = await this.pool.query(
+      `DELETE FROM ${TABLE4} WHERE email = $1`,
+      [(0, import_protocols4.normalizePlatformInvitationEmail)(email)]
+    );
+    return (result.rowCount ?? 0) > 0;
+  }
+  /**
+   * Atomically consumes a pending, unexpired invitation.
+   *
+   * Returns the consumed invitation, or null when the row is missing, already
+   * consumed, or expired.
+   */
+  async consume(email, at) {
+    const result = await this.pool.query(
+      `UPDATE ${TABLE4}
+       SET consumed_at = $1
+       WHERE email = $2
+         AND consumed_at IS NULL
+         AND (expires_at IS NULL OR expires_at > $1)
+       RETURNING *`,
+      [at, (0, import_protocols4.normalizePlatformInvitationEmail)(email)]
+    );
+    return result.rows[0] ? mapRow4(result.rows[0]) : null;
+  }
+};
+
+// src/stores/PostgreSQLOidcIdentityClaimStore.ts
+var import_protocols5 = require("@axiom-lattice/protocols");
+var TABLE5 = "lattice_oidc_identity_claims";
+function mapRow5(row) {
+  return {
+    id: row.id,
+    providerId: row.provider_id,
+    issuer: row.issuer,
+    subject: row.subject,
+    email: row.email,
+    ...row.name !== null ? { name: row.name } : {},
+    ...row.picture !== null ? { picture: row.picture } : {},
+    status: row.status,
+    createdAt: row.created_at,
+    updatedAt: row.updated_at,
+    expiresAt: row.expires_at,
+    ...row.reviewed_by !== null ? { reviewedBy: row.reviewed_by } : {},
+    ...row.reviewed_at !== null ? { reviewedAt: row.reviewed_at } : {},
+    ...row.linked_user_id !== null ? { linkedUserId: row.linked_user_id } : {},
+    ...row.source !== null ? { source: row.source } : {},
+    ...row.invite_link_id !== null ? { inviteLinkId: row.invite_link_id } : {},
+    ...row.requested_user_id !== null ? { requestedUserId: row.requested_user_id } : {},
+    ...row.requested_platform_role !== null ? { requestedPlatformRole: row.requested_platform_role } : {},
+    ...row.requested_tenant_id !== null ? { requestedTenantId: row.requested_tenant_id } : {},
+    ...row.requested_tenant_role !== null ? { requestedTenantRole: row.requested_tenant_role } : {}
+  };
+}
+function isUniqueViolation2(error) {
+  return typeof error === "object" && error !== null && error.code === "23505";
+}
+var PostgreSQLOidcIdentityClaimStore = class {
+  constructor(options) {
+    this.pool = options.pool;
+  }
+  async list(status) {
+    const result = status ? await this.pool.query(
+      `SELECT * FROM ${TABLE5} WHERE status = $1
+           ORDER BY created_at ASC, id ASC`,
+      [status]
+    ) : await this.pool.query(
+      `SELECT * FROM ${TABLE5} ORDER BY created_at ASC, id ASC`
+    );
+    return result.rows.map(mapRow5);
+  }
+  async get(id) {
+    const result = await this.pool.query(
+      `SELECT * FROM ${TABLE5} WHERE id = $1`,
+      [id]
+    );
+    return result.rows[0] ? mapRow5(result.rows[0]) : null;
+  }
+  async getPendingBySubject(providerId, issuer, subject, now) {
+    const result = await this.pool.query(
+      `SELECT * FROM ${TABLE5}
+       WHERE provider_id = $1 AND issuer = $2 AND subject = $3
+         AND status = 'pending' AND expires_at > $4`,
+      [providerId, issuer, subject, now]
+    );
+    return result.rows[0] ? mapRow5(result.rows[0]) : null;
+  }
+  async create(input) {
+    const now = /* @__PURE__ */ new Date();
+    await this.pool.query(
+      `UPDATE ${TABLE5}
+       SET status = 'expired', updated_at = $1
+       WHERE provider_id = $2 AND issuer = $3 AND subject = $4
+         AND status = 'pending' AND expires_at <= $1`,
+      [now, input.providerId, input.issuer, input.subject]
+    );
+    try {
+      const result = await this.pool.query(
+        `INSERT INTO ${TABLE5}
+         (id, provider_id, issuer, subject, email, name, picture, status,
+          created_at, updated_at, expires_at, source, invite_link_id,
+          requested_user_id, requested_platform_role, requested_tenant_id,
+          requested_tenant_role)
+         VALUES ($1, $2, $3, $4, $5, $6, $7, 'pending', $8, $8, $9,
+                 $10, $11, $12, $13, $14, $15)
+         RETURNING *`,
+        [
+          input.id,
+          input.providerId,
+          input.issuer,
+          input.subject,
+          (0, import_protocols5.normalizeOidcIdentityEmail)(input.email),
+          input.name ?? null,
+          input.picture ?? null,
+          now,
+          input.expiresAt,
+          input.source ?? null,
+          input.inviteLinkId ?? null,
+          input.requestedUserId ?? null,
+          input.requestedPlatformRole ?? null,
+          input.requestedTenantId ?? null,
+          input.requestedTenantRole ?? null
+        ]
+      );
+      return mapRow5(result.rows[0]);
+    } catch (error) {
+      if (isUniqueViolation2(error)) {
+        throw new import_protocols5.OidcIdentityClaimConflictError(
+          input.providerId,
+          input.issuer,
+          input.subject
+        );
+      }
+      throw error;
+    }
+  }
+  async updatePending(id, updates, now) {
+    const sets = [];
+    const params = [];
+    if (updates.email !== void 0) {
+      params.push((0, import_protocols5.normalizeOidcIdentityEmail)(updates.email));
+      sets.push(`email = $${params.length}`);
+    }
+    if (updates.name !== void 0) {
+      params.push(updates.name);
+      sets.push(`name = $${params.length}`);
+    }
+    if (updates.picture !== void 0) {
+      params.push(updates.picture);
+      sets.push(`picture = $${params.length}`);
+    }
+    if (sets.length === 0) return this.get(id);
+    params.push(now);
+    sets.push(`updated_at = $${params.length}`);
+    params.push(id);
+    const result = await this.pool.query(
+      `UPDATE ${TABLE5} SET ${sets.join(", ")}
+       WHERE id = $${params.length} AND status = 'pending'
+       RETURNING *`,
+      params
+    );
+    return result.rows[0] ? mapRow5(result.rows[0]) : null;
+  }
+  async approve(id, approval, now) {
+    const result = await this.pool.query(
+      `UPDATE ${TABLE5}
+       SET status = 'approved', reviewed_by = $1, reviewed_at = $2,
+           linked_user_id = $3, updated_at = $2
+       WHERE id = $4 AND status = 'pending'
+       RETURNING *`,
+      [approval.reviewedBy, now, approval.linkedUserId, id]
+    );
+    return result.rows[0] ? mapRow5(result.rows[0]) : null;
+  }
+  async reject(id, reviewedBy, now) {
+    const result = await this.pool.query(
+      `UPDATE ${TABLE5}
+       SET status = 'rejected', reviewed_by = $1, reviewed_at = $2,
+           updated_at = $2
+       WHERE id = $3 AND status = 'pending'
+       RETURNING *`,
+      [reviewedBy, now, id]
+    );
+    return result.rows[0] ? mapRow5(result.rows[0]) : null;
+  }
+  async delete(id) {
+    const result = await this.pool.query(
+      `DELETE FROM ${TABLE5} WHERE id = $1`,
+      [id]
+    );
+    return (result.rowCount ?? 0) > 0;
+  }
+};
+
+// src/stores/PostgreSQLInviteLinkStore.ts
+var import_core6 = require("@axiom-lattice/core");
+var import_protocols6 = require("@axiom-lattice/protocols");
+var TABLE6 = "lattice_invite_links";
+function mapRow6(row) {
+  return {
+    id: row.id,
+    scope: row.scope,
+    token: (0, import_core6.safeDecrypt)(row.token_encrypted, `Invite link "${row.id}" token`),
+    tokenHash: row.token_hash,
+    ...row.email !== null ? { email: row.email } : {},
+    ...row.platform_role !== null ? { platformRole: row.platform_role } : {},
+    ...row.tenant_id !== null ? { tenantId: row.tenant_id } : {},
+    ...row.tenant_role !== null ? { tenantRole: row.tenant_role } : {},
+    ...row.created_by !== null ? { createdBy: row.created_by } : {},
+    createdAt: row.created_at,
+    updatedAt: row.updated_at,
+    expiresAt: row.expires_at,
+    maxUses: Number(row.max_uses),
+    usedCount: Number(row.used_count),
+    ...row.revoked_at !== null ? { revokedAt: row.revoked_at } : {}
+  };
+}
+var PostgreSQLInviteLinkStore = class {
+  constructor(options) {
+    this.options = options;
+  }
+  get pool() {
+    return this.options.pool;
+  }
+  async list() {
+    const result = await this.pool.query(
+      `SELECT * FROM ${TABLE6} ORDER BY created_at DESC, id DESC`
+    );
+    return result.rows.map(mapRow6);
   }
-  async deleteLink(userId, tenantId) {
-    await this.ensureInitialized();
+  async get(id) {
     const result = await this.pool.query(
-      `
-        DELETE FROM lattice_user_tenant_links
-        WHERE user_id = $1 AND tenant_id = $2
-      `,
-      [userId, tenantId]
+      `SELECT * FROM ${TABLE6} WHERE id = $1`,
+      [id]
     );
-    return result.rowCount !== null && result.rowCount > 0;
+    return result.rows[0] ? mapRow6(result.rows[0]) : null;
   }
-  async hasLink(userId, tenantId) {
-    await this.ensureInitialized();
+  async getByTokenHash(tokenHash) {
     const result = await this.pool.query(
-      `
-        SELECT 1 FROM lattice_user_tenant_links
-        WHERE user_id = $1 AND tenant_id = $2
-        LIMIT 1
-      `,
-      [userId, tenantId]
+      `SELECT * FROM ${TABLE6} WHERE token_hash = $1`,
+      [tokenHash]
     );
-    return result.rows.length > 0;
+    return result.rows[0] ? mapRow6(result.rows[0]) : null;
+  }
+  async create(input) {
+    const now = /* @__PURE__ */ new Date();
+    const result = await this.pool.query(
+      `INSERT INTO ${TABLE6}
+       (id, scope, token_hash, token_encrypted, email, platform_role,
+        tenant_id, tenant_role, created_by, created_at, updated_at,
+        expires_at, max_uses, used_count)
+       VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $10, $11, $12, 0)
+       RETURNING *`,
+      [
+        input.id,
+        input.scope,
+        input.tokenHash,
+        (0, import_core6.encrypt)(input.token),
+        input.email ? (0, import_protocols6.normalizeInviteLinkEmail)(input.email) : null,
+        input.platformRole ?? null,
+        input.tenantId ?? null,
+        input.tenantRole ?? null,
+        input.createdBy ?? null,
+        now,
+        input.expiresAt,
+        input.maxUses
+      ]
+    );
+    return mapRow6(result.rows[0]);
+  }
+  async consume(tokenHash, now) {
+    const result = await this.pool.query(
+      `UPDATE ${TABLE6}
+       SET used_count = used_count + 1, updated_at = $1
+       WHERE token_hash = $2
+         AND revoked_at IS NULL
+         AND expires_at > $1
+         AND used_count < max_uses
+       RETURNING *`,
+      [now, tokenHash]
+    );
+    return result.rows[0] ? mapRow6(result.rows[0]) : null;
+  }
+  async revoke(id, now) {
+    const result = await this.pool.query(
+      `UPDATE ${TABLE6}
+       SET revoked_at = COALESCE(revoked_at, $1), updated_at = $1
+       WHERE id = $2
+       RETURNING *`,
+      [now, id]
+    );
+    return result.rows[0] ? mapRow6(result.rows[0]) : null;
   }
 };
 
@@ -5253,7 +5946,7 @@ var PostgreSQLEvalStore = class {
 // src/stores/ThreadMessageQueueStore.ts
 var import_pg13 = require("pg");
 var import_crypto = __toESM(require("crypto"));
-var import_protocols2 = require("@axiom-lattice/protocols");
+var import_protocols7 = require("@axiom-lattice/protocols");
 
 // src/migrations/thread_message_queue_migrations.ts
 var createThreadMessageQueueTable = {
@@ -5740,15 +6433,15 @@ var ThreadMessageQueueStore = class {
       priority: row.priority || 0,
       command: row.command ? typeof row.command === "string" ? JSON.parse(row.command) : row.command : void 0,
       custom_run_config: row.custom_run_config ? typeof row.custom_run_config === "string" ? JSON.parse(row.custom_run_config) : row.custom_run_config : void 0,
-      trusted_run_context: row.trusted_run_context ? (0, import_protocols2.parseTrustedRunContext)(typeof row.trusted_run_context === "string" ? JSON.parse(row.trusted_run_context) : row.trusted_run_context) : void 0,
-      execution_mode: row.execution_mode == null ? void 0 : (0, import_protocols2.parseQueuedExecutionMode)(row.execution_mode)
+      trusted_run_context: row.trusted_run_context ? (0, import_protocols7.parseTrustedRunContext)(typeof row.trusted_run_context === "string" ? JSON.parse(row.trusted_run_context) : row.trusted_run_context) : void 0,
+      execution_mode: row.execution_mode == null ? void 0 : (0, import_protocols7.parseQueuedExecutionMode)(row.execution_mode)
     };
   }
 };
 function validateQueueTrust(params) {
   return {
-    trustedRunContext: params.trusted_run_context === void 0 ? void 0 : (0, import_protocols2.parseTrustedRunContext)(params.trusted_run_context),
-    executionMode: params.execution_mode === void 0 ? void 0 : (0, import_protocols2.parseQueuedExecutionMode)(params.execution_mode)
+    trustedRunContext: params.trusted_run_context === void 0 ? void 0 : (0, import_protocols7.parseTrustedRunContext)(params.trusted_run_context),
+    executionMode: params.execution_mode === void 0 ? void 0 : (0, import_protocols7.parseQueuedExecutionMode)(params.execution_mode)
   };
 }
 function scopeClause(scope, start) {
@@ -5766,7 +6459,7 @@ function scopeClause(scope, start) {
 
 // src/stores/ChannelBindingStore.ts
 var import_pg14 = require("pg");
-var import_protocols3 = require("@axiom-lattice/protocols");
+var import_protocols8 = require("@axiom-lattice/protocols");
 
 // src/migrations/channel_bindings_migration.ts
 var createChannelBindingsTable = {
@@ -5915,7 +6608,7 @@ var ChannelBindingStore = class {
       return this.mapRowToBinding(result.rows[0]);
     } catch (error) {
       if (isBindingSubjectConflict(error)) {
-        throw new import_protocols3.DuplicateChannelBindingSubjectError();
+        throw new import_protocols8.DuplicateChannelBindingSubjectError();
       }
       throw error;
     }
@@ -6117,7 +6810,7 @@ var alterChannelInstallationsTable = {
 };
 
 // src/stores/PostgreSQLChannelInstallationStore.ts
-var import_core5 = require("@axiom-lattice/core");
+var import_core7 = require("@axiom-lattice/core");
 var PostgreSQLChannelInstallationStore = class {
   constructor(options) {
     this.initialized = false;
@@ -6339,17 +7032,17 @@ var PostgreSQLChannelInstallationStore = class {
   encryptSecrets(config) {
     return {
       ...config,
-      ...typeof config.appSecret === "string" ? { appSecret: (0, import_core5.encrypt)(config.appSecret) } : {},
-      ...typeof config.verificationToken === "string" ? { verificationToken: (0, import_core5.encrypt)(config.verificationToken) } : {},
-      ...typeof config.encryptKey === "string" ? { encryptKey: (0, import_core5.encrypt)(config.encryptKey) } : {}
+      ...typeof config.appSecret === "string" ? { appSecret: (0, import_core7.encrypt)(config.appSecret) } : {},
+      ...typeof config.verificationToken === "string" ? { verificationToken: (0, import_core7.encrypt)(config.verificationToken) } : {},
+      ...typeof config.encryptKey === "string" ? { encryptKey: (0, import_core7.encrypt)(config.encryptKey) } : {}
     };
   }
   decryptSecrets(config) {
     return {
       ...config,
-      ...typeof config.appSecret === "string" ? { appSecret: (0, import_core5.safeDecrypt)(config.appSecret) } : {},
-      ...typeof config.verificationToken === "string" ? { verificationToken: (0, import_core5.safeDecrypt)(config.verificationToken) } : {},
-      ...typeof config.encryptKey === "string" ? { encryptKey: (0, import_core5.safeDecrypt)(config.encryptKey) } : {}
+      ...typeof config.appSecret === "string" ? { appSecret: (0, import_core7.safeDecrypt)(config.appSecret) } : {},
+      ...typeof config.verificationToken === "string" ? { verificationToken: (0, import_core7.safeDecrypt)(config.verificationToken) } : {},
+      ...typeof config.encryptKey === "string" ? { encryptKey: (0, import_core7.safeDecrypt)(config.encryptKey) } : {}
     };
   }
 };
@@ -6427,7 +7120,7 @@ var addApiKeyGrants = {
 };
 
 // src/stores/PostgreSQLA2AApiKeyStore.ts
-var import_core6 = require("@axiom-lattice/core");
+var import_core8 = require("@axiom-lattice/core");
 var import_crypto2 = require("crypto");
 function generateApiKey() {
   return `a2a_${(0, import_crypto2.randomUUID)().replace(/-/g, "")}`;
@@ -6435,7 +7128,7 @@ function generateApiKey() {
 function mapRowToRecord(row) {
   return {
     id: row.id,
-    key: (0, import_core6.safeDecrypt)(row.key_value),
+    key: (0, import_core8.safeDecrypt)(row.key_value),
     tenantId: row.tenant_id,
     projectId: row.project_id,
     assistantIds: row.assistant_ids ?? void 0,
@@ -6499,7 +7192,7 @@ var PostgreSQLA2AApiKeyStore = class {
     );
     for (const row of all.rows) {
       try {
-        if ((0, import_core6.decrypt)(row.key_value) === key) return mapRowToRecord(row);
+        if ((0, import_core8.decrypt)(row.key_value) === key) return mapRowToRecord(row);
       } catch {
         continue;
       }
@@ -6543,7 +7236,7 @@ var PostgreSQLA2AApiKeyStore = class {
       `INSERT INTO lattice_a2a_api_keys (key_value, tenant_id, project_id, assistant_ids, grants, label)
        VALUES ($1, $2, $3, $4, $5, $6) RETURNING *`,
       [
-        (0, import_core6.encrypt)(key),
+        (0, import_core8.encrypt)(key),
         input.tenantId,
         input.projectId,
         input.assistantIds ? JSON.stringify(input.assistantIds) : null,
@@ -6612,7 +7305,7 @@ var PostgreSQLA2AApiKeyStore = class {
     const key = generateApiKey();
     const result = await this.pool.query(
       `UPDATE lattice_a2a_api_keys SET key_value = $1, updated_at = NOW() WHERE id = $2 RETURNING *`,
-      [(0, import_core6.encrypt)(key), id]
+      [(0, import_core8.encrypt)(key), id]
     );
     if (result.rows.length === 0) throw new Error(`A2A API key not found: ${id}`);
     const record = mapRowToRecord(result.rows[0]);
@@ -6631,7 +7324,7 @@ var PostgreSQLA2AApiKeyStore = class {
     const map2 = /* @__PURE__ */ new Map();
     for (const row of result.rows) {
       try {
-        const key = (0, import_core6.decrypt)(row.key_value);
+        const key = (0, import_core8.decrypt)(row.key_value);
         map2.set(key, {
           key,
           tenantId: row.tenant_id,
@@ -6881,7 +7574,7 @@ function isIdentity(value) {
 function isStatus(value) {
   return value === "draft" || value === "active" || value === "disabled";
 }
-function mapRow(row) {
+function mapRow7(row) {
   if (!isStatus(row.status) || !isIntegration(row.integration) || !isScope(row.scope) || !isFeatures(row.features) || !isAppearance(row.appearance) || !isIdentity(row.identity)) {
     throw new Error(`Invalid agent web app row: ${row.id}`);
   }
@@ -6953,7 +7646,7 @@ var PostgreSQLAgentWebAppStore = class {
          ORDER BY created_at DESC, id DESC`,
       [tenantId, assistantId]
     );
-    return result.rows.map(mapRow);
+    return result.rows.map(mapRow7);
   }
   async getById(tenantId, webAppId) {
     await this.ensureInitialized();
@@ -6962,7 +7655,7 @@ var PostgreSQLAgentWebAppStore = class {
        WHERE tenant_id = $1 AND id = $2`,
       [tenantId, webAppId]
     );
-    return result.rows[0] ? mapRow(result.rows[0]) : null;
+    return result.rows[0] ? mapRow7(result.rows[0]) : null;
   }
   async findById(webAppId) {
     await this.ensureInitialized();
@@ -6971,7 +7664,7 @@ var PostgreSQLAgentWebAppStore = class {
        WHERE id = $1`,
       [webAppId]
     );
-    return result.rows[0] ? mapRow(result.rows[0]) : null;
+    return result.rows[0] ? mapRow7(result.rows[0]) : null;
   }
   async create(tenantId, input) {
     await this.ensureInitialized();
@@ -6995,7 +7688,7 @@ var PostgreSQLAgentWebAppStore = class {
         input.identity ? JSON.stringify(input.identity) : null
       ]
     );
-    return mapRow(result.rows[0]);
+    return mapRow7(result.rows[0]);
   }
   async update(tenantId, webAppId, patch, options) {
     await this.ensureInitialized();
@@ -7037,7 +7730,7 @@ var PostgreSQLAgentWebAppStore = class {
        RETURNING *`,
       values
     );
-    return result.rows[0] ? mapRow(result.rows[0]) : null;
+    return result.rows[0] ? mapRow7(result.rows[0]) : null;
   }
   async delete(tenantId, webAppId) {
     await this.ensureInitialized();
@@ -7052,7 +7745,7 @@ var PostgreSQLAgentWebAppStore = class {
 
 // src/stores/PostgreSQLScheduleStorage.ts
 var import_pg19 = require("pg");
-var import_protocols4 = require("@axiom-lattice/protocols");
+var import_protocols9 = require("@axiom-lattice/protocols");
 
 // src/migrations/schedule_migrations.ts
 var createScheduledTasksTable = {
@@ -7467,10 +8160,10 @@ var PostgreSQLScheduleStorage = class {
        WHERE task_id = $3 AND status = $4
        RETURNING task_id`,
       [
-        import_protocols4.ScheduledTaskStatus.RUNNING,
+        import_protocols9.ScheduledTaskStatus.RUNNING,
         /* @__PURE__ */ new Date(),
         taskId,
-        import_protocols4.ScheduledTaskStatus.PENDING
+        import_protocols9.ScheduledTaskStatus.PENDING
       ]
     );
     return (result.rowCount ?? 0) > 0;
@@ -7490,8 +8183,8 @@ var PostgreSQLScheduleStorage = class {
        WHERE status = $2 AND updated_at < now() - ($3::bigint || ' milliseconds')::interval
        RETURNING task_id`,
       [
-        import_protocols4.ScheduledTaskStatus.PENDING,
-        import_protocols4.ScheduledTaskStatus.RUNNING,
+        import_protocols9.ScheduledTaskStatus.PENDING,
+        import_protocols9.ScheduledTaskStatus.RUNNING,
         olderThanMs
       ]
     );
@@ -7514,7 +8207,7 @@ var PostgreSQLScheduleStorage = class {
     await this.ensureInitialized();
     const result = await this.pool.query(
       `SELECT * FROM lattice_scheduled_tasks WHERE status IN ($1, $2) ORDER BY created_at ASC`,
-      [import_protocols4.ScheduledTaskStatus.PENDING, import_protocols4.ScheduledTaskStatus.PAUSED]
+      [import_protocols9.ScheduledTaskStatus.PENDING, import_protocols9.ScheduledTaskStatus.PAUSED]
     );
     return result.rows.map((row) => this.mapRowToTask(row));
   }
@@ -7673,9 +8366,9 @@ var PostgreSQLScheduleStorage = class {
       AND updated_at < $4
       `,
       [
-        import_protocols4.ScheduledTaskStatus.COMPLETED,
-        import_protocols4.ScheduledTaskStatus.CANCELLED,
-        import_protocols4.ScheduledTaskStatus.FAILED,
+        import_protocols9.ScheduledTaskStatus.COMPLETED,
+        import_protocols9.ScheduledTaskStatus.CANCELLED,
+        import_protocols9.ScheduledTaskStatus.FAILED,
         cutoff
       ]
     );
@@ -8691,7 +9384,7 @@ var PostgreSQLTaskStore = class {
 
 // src/stores/PostgreSQLTaskWorkItemStore.ts
 var import_pg21 = require("pg");
-var import_protocols5 = require("@axiom-lattice/protocols");
+var import_protocols10 = require("@axiom-lattice/protocols");
 var import_uuid4 = require("uuid");
 
 // src/migrations/task_work_items_migration.ts
@@ -8981,8 +9674,8 @@ var PostgreSQLTaskWorkItemStore = class {
   }
   /** List pending execution results using one bounded PostgreSQL anti-join query. */
   async listPendingExecutionResults(params) {
-    if (!Number.isSafeInteger(params.limit) || params.limit < 0 || params.limit > import_protocols5.MAX_PENDING_EXECUTION_RESULTS_LIMIT) {
-      const error = new RangeError(`limit must be a safe integer between 0 and ${import_protocols5.MAX_PENDING_EXECUTION_RESULTS_LIMIT}`);
+    if (!Number.isSafeInteger(params.limit) || params.limit < 0 || params.limit > import_protocols10.MAX_PENDING_EXECUTION_RESULTS_LIMIT) {
+      const error = new RangeError(`limit must be a safe integer between 0 and ${import_protocols10.MAX_PENDING_EXECUTION_RESULTS_LIMIT}`);
       error.code = "INVALID_LIMIT";
       throw error;
     }
@@ -9835,8 +10528,8 @@ var import_langgraph_checkpoint_postgres = require("@langchain/langgraph-checkpo
 var import_pg25 = require("pg");
 var import_pgvector = require("@langchain/community/vectorstores/pgvector");
 var import_documents = require("@langchain/core/documents");
-var import_core7 = require("@axiom-lattice/core");
-var import_protocols6 = require("@axiom-lattice/protocols");
+var import_core9 = require("@axiom-lattice/core");
+var import_protocols11 = require("@axiom-lattice/protocols");
 function safeTableName(name) {
   if (!/^[a-z][a-z0-9_-]*$/.test(name)) {
     throw new Error(`Invalid table name: ${name}`);
@@ -9851,14 +10544,14 @@ var PGVectorStoreProvider = class {
   async create(params) {
     const { tableName, embeddingKey } = params;
     const tenantId = params.tenantId ?? "default";
-    const requestedKey = embeddingKey || import_protocols6.EMBEDDING_DEFAULT_KEY;
-    const embeddings = await import_core7.embeddingsLatticeManager.getEmbeddingsClientWithTenant(
+    const requestedKey = embeddingKey || import_protocols11.EMBEDDING_DEFAULT_KEY;
+    const embeddings = await import_core9.embeddingsLatticeManager.getEmbeddingsClientWithTenant(
       tenantId,
       requestedKey
-    ) ?? (requestedKey === import_protocols6.EMBEDDING_DEFAULT_KEY ? void 0 : await import_core7.embeddingsLatticeManager.getEmbeddingsClientWithTenant(
+    ) ?? (requestedKey === import_protocols11.EMBEDDING_DEFAULT_KEY ? void 0 : await import_core9.embeddingsLatticeManager.getEmbeddingsClientWithTenant(
       tenantId,
-      import_protocols6.EMBEDDING_DEFAULT_KEY
-    )) ?? await import_core7.embeddingsLatticeManager.getEmbeddingsClientWithTenant(
+      import_protocols11.EMBEDDING_DEFAULT_KEY
+    )) ?? await import_core9.embeddingsLatticeManager.getEmbeddingsClientWithTenant(
       tenantId,
       "default"
     );
@@ -10126,7 +10819,7 @@ var createChannelIdentityMappingTables = {
 };
 
 // src/migrations/connection_config_migrations.ts
-var import_core8 = require("@axiom-lattice/core");
+var import_core10 = require("@axiom-lattice/core");
 var createConnectionConfigsTable = {
   version: 160,
   name: "create_connection_configs_table",
@@ -10197,8 +10890,8 @@ var reencryptLegacyConnectionSecrets = {
       let changed = false;
       for (const field of secretFields) {
         const value = config[field];
-        if (typeof value === "string" && value.length > 0 && !(0, import_core8.isEncryptedValue)(value)) {
-          config[field] = (0, import_core8.encrypt)(value);
+        if (typeof value === "string" && value.length > 0 && !(0, import_core10.isEncryptedValue)(value)) {
+          config[field] = (0, import_core10.encrypt)(value);
           changed = true;
         }
       }
@@ -10214,6 +10907,254 @@ var reencryptLegacyConnectionSecrets = {
   }
 };
 
+// src/migrations/user_external_identity_migration.ts
+var createUserExternalIdentityTable = {
+  version: 209,
+  name: "create_user_external_identity",
+  up: async (client) => {
+    await client.query(`
+      CREATE TABLE IF NOT EXISTS lattice_user_identities (
+        user_id VARCHAR(255) NOT NULL,
+        provider_id VARCHAR(255) NOT NULL,
+        issuer TEXT NOT NULL,
+        subject TEXT NOT NULL,
+        email TEXT,
+        linked_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+        PRIMARY KEY (provider_id, issuer, subject)
+      )
+    `);
+    await client.query(`
+      CREATE INDEX IF NOT EXISTS idx_lattice_user_identities_user
+      ON lattice_user_identities (user_id)
+    `);
+  },
+  down: async (client) => {
+    await client.query("DROP INDEX IF EXISTS idx_lattice_user_identities_user");
+    await client.query("DROP TABLE IF EXISTS lattice_user_identities");
+  }
+};
+
+// src/migrations/user_email_lower_unique_migration.ts
+var createUserEmailLowerUniqueIndex = {
+  version: 210,
+  name: "create_user_email_lower_unique_index",
+  up: async (client) => {
+    await client.query(`
+      CREATE UNIQUE INDEX IF NOT EXISTS idx_lattice_users_email_lower
+      ON lattice_users (lower(email))
+    `);
+  },
+  down: async (client) => {
+    await client.query("DROP INDEX IF EXISTS idx_lattice_users_email_lower");
+  }
+};
+
+// src/migrations/oidc_provider_config_migration.ts
+var createOidcProviderConfigsTable = {
+  version: 211,
+  name: "create_oidc_provider_configs",
+  up: async (client) => {
+    await client.query(`
+      CREATE TABLE IF NOT EXISTS lattice_oidc_provider_configs (
+        id VARCHAR(64) PRIMARY KEY,
+        display_name TEXT NOT NULL,
+        issuer TEXT NOT NULL,
+        client_id TEXT NOT NULL,
+        client_secret TEXT NOT NULL,
+        scopes TEXT NOT NULL,
+        enabled BOOLEAN NOT NULL DEFAULT TRUE,
+        jit_provisioning BOOLEAN NOT NULL DEFAULT FALSE,
+        auto_link_email BOOLEAN NOT NULL DEFAULT FALSE,
+        default_tenant_id TEXT,
+        created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+        updated_at TIMESTAMPTZ NOT NULL DEFAULT NOW()
+      )
+    `);
+  },
+  down: async (client) => {
+    await client.query("DROP TABLE IF EXISTS lattice_oidc_provider_configs");
+  }
+};
+
+// src/migrations/platform_member_migration.ts
+var createPlatformMembersTable = {
+  version: 212,
+  name: "create_platform_members",
+  up: async (client) => {
+    await client.query(`
+      CREATE TABLE IF NOT EXISTS lattice_platform_members (
+        user_id VARCHAR(255) PRIMARY KEY,
+        role VARCHAR(16) NOT NULL,
+        granted_by VARCHAR(255),
+        granted_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+        updated_at TIMESTAMPTZ NOT NULL DEFAULT NOW()
+      )
+    `);
+  },
+  down: async (client) => {
+    await client.query("DROP TABLE IF EXISTS lattice_platform_members");
+  }
+};
+
+// src/migrations/platform_invitation_migration.ts
+var createPlatformInvitationsTable = {
+  version: 213,
+  name: "create_platform_invitations",
+  up: async (client) => {
+    await client.query(`
+      CREATE TABLE IF NOT EXISTS lattice_platform_invitations (
+        email VARCHAR(320) PRIMARY KEY,
+        role VARCHAR(16) NOT NULL,
+        invited_by VARCHAR(255),
+        created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+        expires_at TIMESTAMPTZ,
+        consumed_at TIMESTAMPTZ
+      )
+    `);
+  },
+  down: async (client) => {
+    await client.query("DROP TABLE IF EXISTS lattice_platform_invitations");
+  }
+};
+
+// src/migrations/oidc_identity_claim_migration.ts
+var createOidcIdentityClaimsTable = {
+  version: 214,
+  name: "create_oidc_identity_claims",
+  up: async (client) => {
+    await client.query(`
+      CREATE TABLE IF NOT EXISTS lattice_oidc_identity_claims (
+        id UUID PRIMARY KEY,
+        provider_id VARCHAR(64) NOT NULL,
+        issuer TEXT NOT NULL,
+        subject TEXT NOT NULL,
+        email VARCHAR(320) NOT NULL,
+        name TEXT,
+        picture TEXT,
+        status VARCHAR(16) NOT NULL,
+        created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+        updated_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+        expires_at TIMESTAMPTZ NOT NULL,
+        reviewed_by VARCHAR(255),
+        reviewed_at TIMESTAMPTZ,
+        linked_user_id VARCHAR(255)
+      )
+    `);
+    await client.query(`
+      CREATE UNIQUE INDEX IF NOT EXISTS lattice_oidc_identity_claims_pending_subject
+        ON lattice_oidc_identity_claims (provider_id, issuer, subject)
+        WHERE status = 'pending'
+    `);
+    await client.query(`
+      CREATE INDEX IF NOT EXISTS lattice_oidc_identity_claims_status_created
+        ON lattice_oidc_identity_claims (status, created_at)
+    `);
+  },
+  down: async (client) => {
+    await client.query("DROP TABLE IF EXISTS lattice_oidc_identity_claims");
+  }
+};
+
+// src/migrations/invite_link_migration.ts
+var createInviteLinksTable = {
+  version: 215,
+  name: "create_invite_links",
+  up: async (client) => {
+    await client.query(`
+      CREATE TABLE IF NOT EXISTS lattice_invite_links (
+        id UUID PRIMARY KEY,
+        scope VARCHAR(16) NOT NULL,
+        token_hash VARCHAR(64) NOT NULL UNIQUE,
+        token_encrypted TEXT NOT NULL,
+        email VARCHAR(320),
+        platform_role VARCHAR(16),
+        tenant_id VARCHAR(255),
+        tenant_role VARCHAR(16),
+        created_by VARCHAR(255),
+        created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+        updated_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+        expires_at TIMESTAMPTZ NOT NULL,
+        max_uses INTEGER NOT NULL,
+        used_count INTEGER NOT NULL DEFAULT 0,
+        revoked_at TIMESTAMPTZ
+      )
+    `);
+    await client.query(`
+      CREATE INDEX IF NOT EXISTS lattice_invite_links_created
+        ON lattice_invite_links (created_at DESC)
+    `);
+  },
+  down: async (client) => {
+    await client.query("DROP TABLE IF EXISTS lattice_invite_links");
+  }
+};
+
+// src/migrations/oidc_identity_claim_invite_migration.ts
+var addOidcIdentityClaimInviteFields = {
+  version: 216,
+  name: "add_oidc_identity_claim_invite_fields",
+  up: async (client) => {
+    await client.query(`
+      ALTER TABLE lattice_oidc_identity_claims
+        ADD COLUMN IF NOT EXISTS source VARCHAR(32),
+        ADD COLUMN IF NOT EXISTS invite_link_id UUID,
+        ADD COLUMN IF NOT EXISTS requested_user_id VARCHAR(255),
+        ADD COLUMN IF NOT EXISTS requested_platform_role VARCHAR(16),
+        ADD COLUMN IF NOT EXISTS requested_tenant_id VARCHAR(255),
+        ADD COLUMN IF NOT EXISTS requested_tenant_role VARCHAR(16)
+    `);
+  },
+  down: async (client) => {
+    await client.query(`
+      ALTER TABLE lattice_oidc_identity_claims
+        DROP COLUMN IF EXISTS source,
+        DROP COLUMN IF EXISTS invite_link_id,
+        DROP COLUMN IF EXISTS requested_user_id,
+        DROP COLUMN IF EXISTS requested_platform_role,
+        DROP COLUMN IF EXISTS requested_tenant_id,
+        DROP COLUMN IF EXISTS requested_tenant_role
+    `);
+  }
+};
+
+// src/migrations/platform_settings_migration.ts
+var createPlatformSettingsTable = {
+  version: 217,
+  name: "create_platform_settings",
+  up: async (client) => {
+    await client.query(`
+      CREATE TABLE IF NOT EXISTS lattice_platform_settings (
+        id VARCHAR(32) PRIMARY KEY,
+        document JSONB NOT NULL,
+        version INTEGER NOT NULL,
+        updated_by VARCHAR(255),
+        updated_at TIMESTAMPTZ NOT NULL DEFAULT NOW()
+      )
+    `);
+  },
+  down: async (client) => {
+    await client.query("DROP TABLE IF EXISTS lattice_platform_settings");
+  }
+};
+
+// src/migrations/oidc_provider_allowed_hosts_migration.ts
+var addOidcProviderAllowedHosts = {
+  version: 218,
+  name: "add_oidc_provider_allowed_hosts",
+  up: async (client) => {
+    await client.query(`
+      ALTER TABLE lattice_oidc_provider_configs
+      ADD COLUMN IF NOT EXISTS allowed_private_hosts JSONB
+    `);
+  },
+  down: async (client) => {
+    await client.query(`
+      ALTER TABLE lattice_oidc_provider_configs
+      DROP COLUMN IF EXISTS allowed_private_hosts
+    `);
+  }
+};
+
 // src/migrations/collection_migrations.ts
 var createCollectionsTable = {
   version: 137,
@@ -11279,7 +12220,7 @@ var PostgreSQLCapabilityBundleStore = class {
 function isValidDate(value) {
   return value instanceof Date && !Number.isNaN(value.getTime());
 }
-function mapRow2(row) {
+function mapRow8(row) {
   if (typeof row.id !== "string" || typeof row.tenant_id !== "string" || typeof row.workspace_id !== "string" || typeof row.project_id !== "string" || row.type !== "main" || typeof row.name !== "string" || !isValidDate(row.created_at) || !isValidDate(row.updated_at)) {
     throw new Error("Invalid project room row");
   }
@@ -11310,7 +12251,7 @@ var PostgreSQLProjectRoomStore = class {
        RETURNING id, tenant_id, workspace_id, project_id, type, name, created_at, updated_at`,
       [input.id, input.tenantId, input.workspaceId, input.projectId, "main", input.name]
     );
-    return mapRow2(result.rows[0]);
+    return mapRow8(result.rows[0]);
   }
   /** Finds a tenant-scoped project's main room, or returns null. */
   async getMainRoom(tenantId, projectId) {
@@ -11318,7 +12259,7 @@ var PostgreSQLProjectRoomStore = class {
       "SELECT id, tenant_id, workspace_id, project_id, type, name, created_at, updated_at FROM lattice_project_rooms WHERE tenant_id = $1 AND project_id = $2 AND type = 'main'",
       [tenantId, projectId]
     );
-    return result.rows[0] ? mapRow2(result.rows[0]) : null;
+    return result.rows[0] ? mapRow8(result.rows[0]) : null;
   }
 };
 
@@ -11344,7 +12285,7 @@ function isRole(value) {
 function isStatus2(value) {
   return value === "active" || value === "removed";
 }
-function mapRow3(row) {
+function mapRow9(row) {
   if (typeof row.id !== "string" || typeof row.tenant_id !== "string" || typeof row.project_id !== "string" || typeof row.user_id !== "string" || !isRole(row.role) || !isStatus2(row.status) || !isDate(row.joined_at) || !isDate(row.updated_at)) throw new Error("Invalid project membership row");
   return {
     id: row.id,
@@ -11365,7 +12306,7 @@ function mapDuplicate(error) {
   if (isDuplicate2(error)) throw new ProjectMembershipIdConflictError();
   throw error;
 }
-var columns = "id, tenant_id, project_id, user_id, role, status, joined_at, updated_at";
+var columns2 = "id, tenant_id, project_id, user_id, role, status, joined_at, updated_at";
 var PostgreSQLProjectMembershipStore = class {
   /** Creates a store using an externally managed pool; the pool is not migrated or closed. */
   constructor(options) {
@@ -11373,13 +12314,13 @@ var PostgreSQLProjectMembershipStore = class {
   }
   /** Lists memberships in stable joined-time and ID order. */
   async list(tenantId, projectId) {
-    const result = await this.pool.query(`SELECT ${columns} FROM lattice_project_memberships WHERE tenant_id = $1 AND project_id = $2 ORDER BY joined_at ASC, id ASC`, [tenantId, projectId]);
-    return result.rows.map(mapRow3);
+    const result = await this.pool.query(`SELECT ${columns2} FROM lattice_project_memberships WHERE tenant_id = $1 AND project_id = $2 ORDER BY joined_at ASC, id ASC`, [tenantId, projectId]);
+    return result.rows.map(mapRow9);
   }
   /** Finds a membership by exact tenant, project, and user identity. */
   async findByUser(tenantId, projectId, userId) {
-    const result = await this.pool.query(`SELECT ${columns} FROM lattice_project_memberships WHERE tenant_id = $1 AND project_id = $2 AND user_id = $3`, [tenantId, projectId, userId]);
-    return result.rows[0] ? mapRow3(result.rows[0]) : null;
+    const result = await this.pool.query(`SELECT ${columns2} FROM lattice_project_memberships WHERE tenant_id = $1 AND project_id = $2 AND user_id = $3`, [tenantId, projectId, userId]);
+    return result.rows[0] ? mapRow9(result.rows[0]) : null;
   }
   /** Inserts a membership and maps database uniqueness errors to stable typed errors. */
   async create(input) {
@@ -11387,8 +12328,8 @@ var PostgreSQLProjectMembershipStore = class {
     try {
       await client.query("BEGIN");
       await client.query("SELECT pg_advisory_xact_lock(hashtextextended($1, 0))", [`${input.tenantId}:${input.projectId}`]);
-      const result = await client.query(`INSERT INTO lattice_project_memberships (id, tenant_id, project_id, user_id, role, status, joined_at, updated_at) VALUES ($1, $2, $3, $4, $5, $6, date_trunc('milliseconds', clock_timestamp()), date_trunc('milliseconds', clock_timestamp())) RETURNING ${columns}`, [input.id, input.tenantId, input.projectId, input.userId, input.role, input.status]);
-      const membership = mapRow3(result.rows[0]);
+      const result = await client.query(`INSERT INTO lattice_project_memberships (id, tenant_id, project_id, user_id, role, status, joined_at, updated_at) VALUES ($1, $2, $3, $4, $5, $6, date_trunc('milliseconds', clock_timestamp()), date_trunc('milliseconds', clock_timestamp())) RETURNING ${columns2}`, [input.id, input.tenantId, input.projectId, input.userId, input.role, input.status]);
+      const membership = mapRow9(result.rows[0]);
       await client.query("COMMIT");
       return membership;
     } catch (error) {
@@ -11407,16 +12348,16 @@ var PostgreSQLProjectMembershipStore = class {
     try {
       await client.query("BEGIN");
       await client.query("SELECT pg_advisory_xact_lock(hashtextextended($1, 0))", [`${input.tenantId}:${input.projectId}`]);
-      const existingResult = await client.query(`SELECT ${columns} FROM lattice_project_memberships WHERE tenant_id = $1 AND project_id = $2 FOR UPDATE`, [input.tenantId, input.projectId]);
+      const existingResult = await client.query(`SELECT ${columns2} FROM lattice_project_memberships WHERE tenant_id = $1 AND project_id = $2 FOR UPDATE`, [input.tenantId, input.projectId]);
       if (existingResult.rows.length > 0) {
-        const existing = existingResult.rows.map(mapRow3).find((item) => item.userId === input.userId && item.role === "owner" && item.status === "active");
+        const existing = existingResult.rows.map(mapRow9).find((item) => item.userId === input.userId && item.role === "owner" && item.status === "active");
         await client.query("COMMIT");
         return existing ? { kind: "existing", membership: existing } : { kind: "already_initialized" };
       }
       const idResult = await client.query("SELECT id FROM lattice_project_memberships WHERE tenant_id = $1 AND id = $2", [input.tenantId, input.id]);
       if (idResult.rows.length > 0) throw new ProjectMembershipIdConflictError();
-      const inserted = await client.query(`INSERT INTO lattice_project_memberships (id, tenant_id, project_id, user_id, role, status, joined_at, updated_at) VALUES ($1, $2, $3, $4, 'owner', 'active', date_trunc('milliseconds', clock_timestamp()), date_trunc('milliseconds', clock_timestamp())) RETURNING ${columns}`, [input.id, input.tenantId, input.projectId, input.userId]);
-      const membership = mapRow3(inserted.rows[0]);
+      const inserted = await client.query(`INSERT INTO lattice_project_memberships (id, tenant_id, project_id, user_id, role, status, joined_at, updated_at) VALUES ($1, $2, $3, $4, 'owner', 'active', date_trunc('milliseconds', clock_timestamp()), date_trunc('milliseconds', clock_timestamp())) RETURNING ${columns2}`, [input.id, input.tenantId, input.projectId, input.userId]);
+      const membership = mapRow9(inserted.rows[0]);
       await client.query("COMMIT");
       return { kind: "created", membership };
     } catch (error) {
@@ -11448,16 +12389,16 @@ var PostgreSQLProjectMembershipStore = class {
         return { kind: "not_found" };
       }
       await client.query("SELECT pg_advisory_xact_lock(hashtextextended($1, 0))", [`${tenantId}:${identity.rows[0].project_id}`]);
-      const activeRows = await client.query(`SELECT ${columns} FROM lattice_project_memberships WHERE tenant_id = $1 AND project_id = $2 AND status = 'active' FOR UPDATE`, [tenantId, identity.rows[0].project_id]);
-      const lockedMemberships = activeRows.rows.map(mapRow3);
+      const activeRows = await client.query(`SELECT ${columns2} FROM lattice_project_memberships WHERE tenant_id = $1 AND project_id = $2 AND status = 'active' FOR UPDATE`, [tenantId, identity.rows[0].project_id]);
+      const lockedMemberships = activeRows.rows.map(mapRow9);
       let current = lockedMemberships.find((membership) => membership.id === id);
       if (!current) {
-        const target = await client.query(`SELECT ${columns} FROM lattice_project_memberships WHERE tenant_id = $1 AND id = $2 FOR UPDATE`, [tenantId, id]);
+        const target = await client.query(`SELECT ${columns2} FROM lattice_project_memberships WHERE tenant_id = $1 AND id = $2 FOR UPDATE`, [tenantId, id]);
         if (!target.rows[0]) {
           await client.query("COMMIT");
           return { kind: "not_found" };
         }
-        current = mapRow3(target.rows[0]);
+        current = mapRow9(target.rows[0]);
       }
       if (current.updatedAt.getTime() !== expected.getTime()) {
         await client.query("COMMIT");
@@ -11470,13 +12411,13 @@ var PostgreSQLProjectMembershipStore = class {
           return { kind: "last_owner" };
         }
       }
-      const result = await client.query(remove ? `UPDATE lattice_project_memberships SET status = 'removed', updated_at = GREATEST(date_trunc('milliseconds', updated_at) + interval '1 millisecond', date_trunc('milliseconds', clock_timestamp())) WHERE tenant_id = $1 AND id = $2 AND date_trunc('milliseconds', updated_at) = $3 RETURNING ${columns}` : `UPDATE lattice_project_memberships SET role = $4, updated_at = GREATEST(date_trunc('milliseconds', updated_at) + interval '1 millisecond', date_trunc('milliseconds', clock_timestamp())) WHERE tenant_id = $1 AND id = $2 AND date_trunc('milliseconds', updated_at) = $3 RETURNING ${columns}`, remove ? [tenantId, id, expected] : [tenantId, id, expected, role]);
+      const result = await client.query(remove ? `UPDATE lattice_project_memberships SET status = 'removed', updated_at = GREATEST(date_trunc('milliseconds', updated_at) + interval '1 millisecond', date_trunc('milliseconds', clock_timestamp())) WHERE tenant_id = $1 AND id = $2 AND date_trunc('milliseconds', updated_at) = $3 RETURNING ${columns2}` : `UPDATE lattice_project_memberships SET role = $4, updated_at = GREATEST(date_trunc('milliseconds', updated_at) + interval '1 millisecond', date_trunc('milliseconds', clock_timestamp())) WHERE tenant_id = $1 AND id = $2 AND date_trunc('milliseconds', updated_at) = $3 RETURNING ${columns2}`, remove ? [tenantId, id, expected] : [tenantId, id, expected, role]);
       if (!result.rows[0]) {
         await client.query("COMMIT");
         return { kind: "conflict" };
       }
       await client.query("COMMIT");
-      return { kind: remove ? "removed" : "updated", membership: mapRow3(result.rows[0]) };
+      return { kind: remove ? "removed" : "updated", membership: mapRow9(result.rows[0]) };
     } catch (error) {
       try {
         await client.query("ROLLBACK");
@@ -11490,7 +12431,7 @@ var PostgreSQLProjectMembershipStore = class {
 };
 
 // src/stores/PostgreSQLProjectBotMembershipStore.ts
-var columns2 = "id, tenant_id, workspace_id, project_id, room_id, assistant_id, role, title, responsibility, mention_name, status, room_thread_id, joined_at, updated_at";
+var columns3 = "id, tenant_id, workspace_id, project_id, room_id, assistant_id, role, title, responsibility, mention_name, status, room_thread_id, joined_at, updated_at";
 var ProjectBotMembershipIdConflictError = class extends Error {
   /** Creates an accurate tenant-scoped membership ID collision error. */
   constructor(tenantId, id) {
@@ -11507,7 +12448,7 @@ function isRole2(value) {
 function isStatus3(value) {
   return value === "active" || value === "paused" || value === "removed";
 }
-function mapRow4(row) {
+function mapRow10(row) {
   if (typeof row.id !== "string" || typeof row.tenant_id !== "string" || typeof row.workspace_id !== "string" || typeof row.project_id !== "string" || typeof row.room_id !== "string" || typeof row.assistant_id !== "string" || !isRole2(row.role) || typeof row.title !== "string" || row.responsibility !== null && typeof row.responsibility !== "string" || typeof row.mention_name !== "string" || !isStatus3(row.status) || typeof row.room_thread_id !== "string" || !isDate2(row.joined_at) || !isDate2(row.updated_at)) {
     throw new Error("Invalid project bot membership row");
   }
@@ -11528,11 +12469,11 @@ function mapRow4(row) {
     updatedAt: row.updated_at
   };
 }
-function isUniqueViolation(error) {
+function isUniqueViolation3(error) {
   return typeof error === "object" && error !== null && "code" in error && error.code === "23505";
 }
 function constraintConflict(error) {
-  if (!isUniqueViolation(error) || typeof error.constraint !== "string") return void 0;
+  if (!isUniqueViolation3(error) || typeof error.constraint !== "string") return void 0;
   if (error.constraint === "uq_lattice_project_bot_memberships_coordinator") return "coordinator_conflict";
   if (error.constraint === "uq_lattice_project_bot_memberships_mention") return "mention_conflict";
   return void 0;
@@ -11551,26 +12492,26 @@ var PostgreSQLProjectBotMembershipStore = class {
   /** Lists retained memberships in stable join order. */
   async list(tenantId, projectId) {
     const result = await this.pool.query(
-      `SELECT ${columns2} FROM lattice_project_bot_memberships WHERE tenant_id = $1 AND project_id = $2 ORDER BY joined_at ASC, id ASC`,
+      `SELECT ${columns3} FROM lattice_project_bot_memberships WHERE tenant_id = $1 AND project_id = $2 ORDER BY joined_at ASC, id ASC`,
       [tenantId, projectId]
     );
-    return result.rows.map(mapRow4);
+    return result.rows.map(mapRow10);
   }
   /** Finds a membership by tenant-scoped ID. */
   async findById(tenantId, id) {
     const result = await this.pool.query(
-      `SELECT ${columns2} FROM lattice_project_bot_memberships WHERE tenant_id = $1 AND id = $2`,
+      `SELECT ${columns3} FROM lattice_project_bot_memberships WHERE tenant_id = $1 AND id = $2`,
       [tenantId, id]
     );
-    return result.rows[0] ? mapRow4(result.rows[0]) : null;
+    return result.rows[0] ? mapRow10(result.rows[0]) : null;
   }
   /** Finds an assistant's durable membership in a tenant-scoped project. */
   async findByAssistant(tenantId, projectId, assistantId) {
     const result = await this.pool.query(
-      `SELECT ${columns2} FROM lattice_project_bot_memberships WHERE tenant_id = $1 AND project_id = $2 AND assistant_id = $3`,
+      `SELECT ${columns3} FROM lattice_project_bot_memberships WHERE tenant_id = $1 AND project_id = $2 AND assistant_id = $3`,
       [tenantId, projectId, assistantId]
     );
-    return result.rows[0] ? mapRow4(result.rows[0]) : null;
+    return result.rows[0] ? mapRow10(result.rows[0]) : null;
   }
   /** Inserts a new membership or reactivates the assistant's durable membership atomically. */
   async save(input) {
@@ -11579,17 +12520,17 @@ var PostgreSQLProjectBotMembershipStore = class {
       await client.query("BEGIN");
       await client.query("SELECT pg_advisory_xact_lock(hashtextextended($1, 0))", [`${input.tenantId}:${input.projectId}`]);
       const existingResult = await client.query(
-        `SELECT ${columns2} FROM lattice_project_bot_memberships WHERE tenant_id = $1 AND project_id = $2 AND assistant_id = $3 FOR UPDATE`,
+        `SELECT ${columns3} FROM lattice_project_bot_memberships WHERE tenant_id = $1 AND project_id = $2 AND assistant_id = $3 FOR UPDATE`,
         [input.tenantId, input.projectId, input.assistantId]
       );
-      const existing = existingResult.rows[0] ? mapRow4(existingResult.rows[0]) : void 0;
+      const existing = existingResult.rows[0] ? mapRow10(existingResult.rows[0]) : void 0;
       let result;
       if (existing) {
         result = await client.query(
           `UPDATE lattice_project_bot_memberships
            SET role = $3, title = $4, responsibility = $5, mention_name = $6, status = 'active',
                updated_at = GREATEST(date_trunc('milliseconds', updated_at) + interval '1 millisecond', date_trunc('milliseconds', clock_timestamp()))
-           WHERE tenant_id = $1 AND id = $2 RETURNING ${columns2}`,
+           WHERE tenant_id = $1 AND id = $2 RETURNING ${columns3}`,
           [input.tenantId, existing.id, input.role, input.title, input.responsibility ?? null, input.mentionName]
         );
       } else {
@@ -11602,7 +12543,7 @@ var PostgreSQLProjectBotMembershipStore = class {
           `INSERT INTO lattice_project_bot_memberships
            (id, tenant_id, workspace_id, project_id, room_id, assistant_id, role, title, responsibility, mention_name, status, room_thread_id, joined_at, updated_at)
            VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, 'active', $11, date_trunc('milliseconds', clock_timestamp()), date_trunc('milliseconds', clock_timestamp()))
-           RETURNING ${columns2}`,
+           RETURNING ${columns3}`,
           [
             input.id,
             input.tenantId,
@@ -11618,14 +12559,14 @@ var PostgreSQLProjectBotMembershipStore = class {
           ]
         );
       }
-      const membership = mapRow4(result.rows[0]);
+      const membership = mapRow10(result.rows[0]);
       await client.query("COMMIT");
       return { kind: existing === void 0 ? "created" : existing.status === "removed" ? "reactivated" : "updated", membership };
     } catch (error) {
       await rollback(client);
       const conflict = constraintConflict(error);
       if (conflict) return { kind: conflict };
-      if (isUniqueViolation(error) && error.constraint === "lattice_project_bot_memberships_pkey") {
+      if (isUniqueViolation3(error) && error.constraint === "lattice_project_bot_memberships_pkey") {
         throw new ProjectBotMembershipIdConflictError(input.tenantId, input.id);
       }
       throw error;
@@ -11649,14 +12590,14 @@ var PostgreSQLProjectBotMembershipStore = class {
       if (typeof identity.rows[0].project_id !== "string") throw new Error("Invalid project bot membership row");
       await client.query("SELECT pg_advisory_xact_lock(hashtextextended($1, 0))", [`${input.tenantId}:${identity.rows[0].project_id}`]);
       const locked = await client.query(
-        `SELECT ${columns2} FROM lattice_project_bot_memberships WHERE tenant_id = $1 AND id = $2 FOR UPDATE`,
+        `SELECT ${columns3} FROM lattice_project_bot_memberships WHERE tenant_id = $1 AND id = $2 FOR UPDATE`,
         [input.tenantId, input.id]
       );
       if (!locked.rows[0]) {
         await client.query("COMMIT");
         return { kind: "not_found" };
       }
-      const existing = mapRow4(locked.rows[0]);
+      const existing = mapRow10(locked.rows[0]);
       if (existing.updatedAt.getTime() !== input.expectedUpdatedAt.getTime()) {
         await client.query("COMMIT");
         return { kind: "conflict" };
@@ -11667,7 +12608,7 @@ var PostgreSQLProjectBotMembershipStore = class {
          SET role = $4, title = $5, responsibility = $6, mention_name = $7, status = $8,
              updated_at = GREATEST(date_trunc('milliseconds', updated_at) + interval '1 millisecond', date_trunc('milliseconds', clock_timestamp()))
          WHERE tenant_id = $1 AND id = $2 AND date_trunc('milliseconds', updated_at) = $3
-         RETURNING ${columns2}`,
+         RETURNING ${columns3}`,
         [
           input.tenantId,
           input.id,
@@ -11683,7 +12624,7 @@ var PostgreSQLProjectBotMembershipStore = class {
         await client.query("COMMIT");
         return { kind: "conflict" };
       }
-      const membership = mapRow4(updated.rows[0]);
+      const membership = mapRow10(updated.rows[0]);
       await client.query("COMMIT");
       return { kind: "updated", membership };
     } catch (error) {
@@ -11698,7 +12639,7 @@ var PostgreSQLProjectBotMembershipStore = class {
 };
 
 // src/stores/PostgreSQLProjectRoomMessageStore.ts
-var columns3 = "id, tenant_id, workspace_id, project_id, room_id, author, content, mentions, reply_to_message_id, source, source_id, idempotency_key, created_at";
+var columns4 = "id, tenant_id, workspace_id, project_id, room_id, author, content, mentions, reply_to_message_id, source, source_id, idempotency_key, created_at";
 var ProjectRoomMessageIdConflictError = class extends Error {
   /** Creates an accurate tenant-scoped message ID collision error. */
   constructor(tenantId, id) {
@@ -11739,7 +12680,7 @@ function mapMention(value) {
 function isSource(value) {
   return value === "user" || value === "agent" || value === "task" || value === "routine" || value === "system";
 }
-function mapRow5(row) {
+function mapRow11(row) {
   const author = mapAuthor(row.author);
   const content = isRecord4(row.content) && row.content.type === "text" && typeof row.content.text === "string" && hasOnlyKeys(row.content, ["type", "text"]) ? { type: "text", text: row.content.text } : void 0;
   const mentions = Array.isArray(row.mentions) ? row.mentions.map(mapMention) : void 0;
@@ -11766,7 +12707,7 @@ function mapRowsTolerant(rows, scope) {
   const messages = [];
   for (const row of rows) {
     try {
-      messages.push(mapRow5(row));
+      messages.push(mapRow11(row));
     } catch (error) {
       console.warn("[ProjectRoomMessageStore] Skipping invalid message row", {
         tenantId: scope.tenantId,
@@ -11778,7 +12719,7 @@ function mapRowsTolerant(rows, scope) {
   }
   return messages;
 }
-function isUniqueViolation2(error) {
+function isUniqueViolation4(error) {
   return typeof error === "object" && error !== null && "code" in error && error.code === "23505";
 }
 var PostgreSQLProjectRoomMessageStore = class {
@@ -11793,15 +12734,15 @@ var PostgreSQLProjectRoomMessageStore = class {
         `INSERT INTO lattice_project_room_messages
          (id, tenant_id, workspace_id, project_id, room_id, author, content, mentions, reply_to_message_id, source, source_id, idempotency_key, created_at)
          VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, date_trunc('milliseconds', clock_timestamp()))
-         RETURNING ${columns3}`,
+         RETURNING ${columns4}`,
         this.parameters(input)
       );
-      return mapRow5(result.rows[0]);
+      return mapRow11(result.rows[0]);
     } catch (error) {
-      if (isUniqueViolation2(error) && error.constraint === "lattice_project_room_messages_pkey") {
+      if (isUniqueViolation4(error) && error.constraint === "lattice_project_room_messages_pkey") {
         throw new ProjectRoomMessageIdConflictError(input.tenantId, input.id);
       }
-      if (isUniqueViolation2(error) && error.constraint === "uq_lattice_project_room_messages_idempotency") {
+      if (isUniqueViolation4(error) && error.constraint === "uq_lattice_project_room_messages_idempotency") {
         throw new DuplicateProjectRoomMessageIdempotencyKeyError(input.tenantId, input.roomId, input.idempotencyKey ?? "");
       }
       throw error;
@@ -11816,12 +12757,12 @@ var PostgreSQLProjectRoomMessageStore = class {
          VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, date_trunc('milliseconds', clock_timestamp()))
          ON CONFLICT (tenant_id, room_id, idempotency_key) WHERE idempotency_key IS NOT NULL
          DO UPDATE SET idempotency_key = lattice_project_room_messages.idempotency_key
-         RETURNING ${columns3}`,
+         RETURNING ${columns4}`,
         this.parameters(input)
       );
-      return mapRow5(result.rows[0]);
+      return mapRow11(result.rows[0]);
     } catch (error) {
-      if (isUniqueViolation2(error) && error.constraint === "lattice_project_room_messages_pkey") {
+      if (isUniqueViolation4(error) && error.constraint === "lattice_project_room_messages_pkey") {
         throw new ProjectRoomMessageIdConflictError(input.tenantId, input.id);
       }
       throw error;
@@ -11834,12 +12775,12 @@ var PostgreSQLProjectRoomMessageStore = class {
     }
     const limit = Math.min(100, Math.max(1, Math.trunc(Number.isFinite(input.limit) ? input.limit : 1)));
     const result = input.before ? await this.pool.query(
-      `SELECT ${columns3} FROM lattice_project_room_messages
+      `SELECT ${columns4} FROM lattice_project_room_messages
          WHERE tenant_id = $1 AND room_id = $2 AND (created_at < $3 OR (created_at = $3 AND id < $4))
          ORDER BY created_at DESC, id DESC LIMIT $5`,
       [input.tenantId, input.roomId, input.before.createdAt, input.before.id, limit]
     ) : await this.pool.query(
-      `SELECT ${columns3} FROM lattice_project_room_messages
+      `SELECT ${columns4} FROM lattice_project_room_messages
          WHERE tenant_id = $1 AND room_id = $2 ORDER BY created_at DESC, id DESC LIMIT $3`,
       [input.tenantId, input.roomId, limit]
     );
@@ -11848,10 +12789,10 @@ var PostgreSQLProjectRoomMessageStore = class {
   /** Finds a message by tenant-scoped ID. */
   async findById(tenantId, id) {
     const result = await this.pool.query(
-      `SELECT ${columns3} FROM lattice_project_room_messages WHERE tenant_id = $1 AND id = $2`,
+      `SELECT ${columns4} FROM lattice_project_room_messages WHERE tenant_id = $1 AND id = $2`,
       [tenantId, id]
     );
-    return result.rows[0] ? mapRow5(result.rows[0]) : null;
+    return result.rows[0] ? mapRow11(result.rows[0]) : null;
   }
   /** Counts messages created strictly after a horizon, optionally excluding one human author. */
   async countAfter(input) {
@@ -11909,7 +12850,7 @@ var PostgreSQLProjectRoomMessageStore = class {
 };
 
 // src/stores/PostgreSQLProjectRoomReadStateStore.ts
-function mapRow6(row) {
+function mapRow12(row) {
   if (typeof row.tenant_id !== "string" || typeof row.room_id !== "string" || typeof row.user_id !== "string" || !(row.last_read_at instanceof Date) || Number.isNaN(row.last_read_at.getTime()) || !(row.updated_at instanceof Date) || Number.isNaN(row.updated_at.getTime())) {
     throw new Error("Invalid project room read state row");
   }
@@ -11927,7 +12868,7 @@ var PostgreSQLProjectRoomReadStateStore = class {
        FROM lattice_project_room_read_states WHERE tenant_id = $1 AND room_id = $2 AND user_id = $3`,
       [tenantId, roomId, userId]
     );
-    return result.rows[0] ? mapRow6(result.rows[0]) : null;
+    return result.rows[0] ? mapRow12(result.rows[0]) : null;
   }
   /** Upserts the marker monotonically using GREATEST so older reports never regress it. */
   async markRead(input) {
@@ -11943,14 +12884,14 @@ var PostgreSQLProjectRoomReadStateStore = class {
        RETURNING tenant_id, room_id, user_id, last_read_at, updated_at`,
       [input.tenantId, input.roomId, input.userId, input.lastReadAt]
     );
-    return mapRow6(result.rows[0]);
+    return mapRow12(result.rows[0]);
   }
 };
 
 // src/stores/PostgreSQLUserPushSubscriptionStore.ts
 var import_node_crypto2 = require("crypto");
-var columns4 = "id, tenant_id, user_id, endpoint, p256dh, auth, user_agent, created_at";
-function mapRow7(row) {
+var columns5 = "id, tenant_id, user_id, endpoint, p256dh, auth, user_agent, created_at";
+function mapRow13(row) {
   if (typeof row.id !== "string" || typeof row.tenant_id !== "string" || typeof row.user_id !== "string" || typeof row.endpoint !== "string" || typeof row.p256dh !== "string" || typeof row.auth !== "string" || !(row.created_at instanceof Date) || Number.isNaN(row.created_at.getTime())) {
     throw new Error("Invalid user push subscription row");
   }
@@ -11972,22 +12913,22 @@ var PostgreSQLUserPushSubscriptionStore = class {
   /** Lists every subscription for a user. */
   async list(tenantId, userId) {
     const result = await this.pool.query(
-      `SELECT ${columns4} FROM lattice_user_push_subscriptions WHERE tenant_id = $1 AND user_id = $2`,
+      `SELECT ${columns5} FROM lattice_user_push_subscriptions WHERE tenant_id = $1 AND user_id = $2`,
       [tenantId, userId]
     );
-    return result.rows.map(mapRow7);
+    return result.rows.map(mapRow13);
   }
   /** Upserts a subscription keyed by tenant + user + endpoint. */
   async save(input) {
     const result = await this.pool.query(
-      `INSERT INTO lattice_user_push_subscriptions (${columns4})
+      `INSERT INTO lattice_user_push_subscriptions (${columns5})
        VALUES ($1, $2, $3, $4, $5, $6, $7, NOW())
        ON CONFLICT (tenant_id, user_id, endpoint) DO UPDATE
          SET p256dh = EXCLUDED.p256dh, auth = EXCLUDED.auth, user_agent = EXCLUDED.user_agent
-       RETURNING ${columns4}`,
+       RETURNING ${columns5}`,
       [(0, import_node_crypto2.randomUUID)(), input.tenantId, input.userId, input.endpoint, input.keys.p256dh, input.keys.auth, input.userAgent ?? null]
     );
-    return mapRow7(result.rows[0]);
+    return mapRow13(result.rows[0]);
   }
   /** Deletes one subscription by endpoint. */
   async delete(tenantId, userId, endpoint) {
@@ -12001,7 +12942,7 @@ var PostgreSQLUserPushSubscriptionStore = class {
 
 // src/stores/PostgreSQLModelProviderStore.ts
 var import_pg27 = require("pg");
-var import_core9 = require("@axiom-lattice/core");
+var import_core11 = require("@axiom-lattice/core");
 function extraOrUndefined(value) {
   return value && Object.keys(value).length > 0 ? value : void 0;
 }
@@ -12125,7 +13066,7 @@ var PostgreSQLModelProviderStore = class {
     await this.ensureInitialized();
     const now = /* @__PURE__ */ new Date();
     const nowString = now.toISOString();
-    const apiKeyEnc = data.apiKey ? (0, import_core9.encrypt)(data.apiKey) : null;
+    const apiKeyEnc = data.apiKey ? (0, import_core11.encrypt)(data.apiKey) : null;
     const apiKeyHint = data.apiKey ? data.apiKey.slice(-4) : null;
     await this.pool.query(
       `
@@ -12201,7 +13142,7 @@ var PostgreSQLModelProviderStore = class {
       updateData.api_key_enc = null;
       updateData.api_key_hint = null;
     } else if (updates.apiKey) {
-      updateData.api_key_enc = (0, import_core9.encrypt)(updates.apiKey);
+      updateData.api_key_enc = (0, import_core11.encrypt)(updates.apiKey);
       updateData.api_key_hint = updates.apiKey.slice(-4);
     }
     if (updates.enabled !== void 0) {
@@ -12521,7 +13462,7 @@ var PostgreSQLModelProviderStore = class {
   mapRowToEntry(row) {
     let apiKey;
     if (row.api_key_enc) {
-      apiKey = (0, import_core9.safeDecrypt)(row.api_key_enc);
+      apiKey = (0, import_core11.safeDecrypt)(row.api_key_enc);
     }
     return {
       id: row.id,
@@ -12774,7 +13715,7 @@ var PostgreSQLOutboxStore = class {
 };
 
 // src/stores/PostgreSQLPluginDeploymentStore.ts
-var columns5 = "id, tenant_id, plugin_type, plugin_version, mode, status, provider, sandbox_name, port, endpoint, image_ref, idle_timeout_ms, last_health_at, last_error, created_at, updated_at";
+var columns6 = "id, tenant_id, plugin_type, plugin_version, mode, status, provider, sandbox_name, port, endpoint, image_ref, idle_timeout_ms, last_health_at, last_error, created_at, updated_at";
 var statuses = [
   "requested",
   "provisioning",
@@ -12787,7 +13728,7 @@ var statuses = [
 function isStatus4(value) {
   return typeof value === "string" && statuses.includes(value);
 }
-function mapRow8(row) {
+function mapRow14(row) {
   if (typeof row.id !== "string" || typeof row.tenant_id !== "string" || typeof row.plugin_type !== "string" || typeof row.plugin_version !== "string" || row.mode !== "onDemand" && row.mode !== "alwaysOn" || !isStatus4(row.status) || typeof row.provider !== "string" || typeof row.sandbox_name !== "string" || typeof row.port !== "number" || typeof row.idle_timeout_ms !== "number" || !(row.created_at instanceof Date) || Number.isNaN(row.created_at.getTime()) || !(row.updated_at instanceof Date) || Number.isNaN(row.updated_at.getTime())) {
     throw new Error("Invalid plugin deployment row");
   }
@@ -12818,23 +13759,23 @@ var PostgreSQLPluginDeploymentStore = class {
   /** Lists every deployment for a tenant, ordered by plugin type. */
   async listByTenant(tenantId) {
     const result = await this.pool.query(
-      `SELECT ${columns5} FROM lattice_plugin_deployments WHERE tenant_id = $1 ORDER BY plugin_type`,
+      `SELECT ${columns6} FROM lattice_plugin_deployments WHERE tenant_id = $1 ORDER BY plugin_type`,
       [tenantId]
     );
-    return result.rows.map(mapRow8);
+    return result.rows.map(mapRow14);
   }
   /** Returns the deployment for a tenant + plugin type, or undefined. */
   async get(tenantId, pluginType) {
     const result = await this.pool.query(
-      `SELECT ${columns5} FROM lattice_plugin_deployments WHERE tenant_id = $1 AND plugin_type = $2`,
+      `SELECT ${columns6} FROM lattice_plugin_deployments WHERE tenant_id = $1 AND plugin_type = $2`,
       [tenantId, pluginType]
     );
-    return result.rows[0] ? mapRow8(result.rows[0]) : void 0;
+    return result.rows[0] ? mapRow14(result.rows[0]) : void 0;
   }
   /** Upserts a deployment keyed by tenant + plugin type, preserving the original id and createdAt. */
   async upsert(deployment) {
     const result = await this.pool.query(
-      `INSERT INTO lattice_plugin_deployments (${columns5})
+      `INSERT INTO lattice_plugin_deployments (${columns6})
        VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14, $15, $16)
        ON CONFLICT (tenant_id, plugin_type) DO UPDATE SET
          plugin_version = EXCLUDED.plugin_version,
@@ -12849,7 +13790,7 @@ var PostgreSQLPluginDeploymentStore = class {
          last_health_at = EXCLUDED.last_health_at,
          last_error = EXCLUDED.last_error,
          updated_at = NOW()
-       RETURNING ${columns5}`,
+       RETURNING ${columns6}`,
       [
         deployment.id,
         deployment.tenantId,
@@ -12869,7 +13810,7 @@ var PostgreSQLPluginDeploymentStore = class {
         new Date(deployment.updatedAt)
       ]
     );
-    return mapRow8(result.rows[0]);
+    return mapRow14(result.rows[0]);
   }
   /** Applies a partial update to mutable columns; returns undefined when no row exists. */
   async updateStatus(tenantId, pluginType, patch) {
@@ -12897,10 +13838,10 @@ var PostgreSQLPluginDeploymentStore = class {
     const result = await this.pool.query(
       `UPDATE lattice_plugin_deployments SET ${assignments.join(", ")}
        WHERE tenant_id = $${tenantParam} AND plugin_type = $${pluginParam}
-       RETURNING ${columns5}`,
+       RETURNING ${columns6}`,
       params
     );
-    return result.rows[0] ? mapRow8(result.rows[0]) : void 0;
+    return result.rows[0] ? mapRow14(result.rows[0]) : void 0;
   }
   /** Deletes a deployment by tenant + plugin type; returns whether a row was removed. */
   async delete(tenantId, pluginType) {
@@ -12914,7 +13855,7 @@ var PostgreSQLPluginDeploymentStore = class {
 
 // src/stores/PostgreSQLAgentRunLedger.ts
 var import_pg30 = require("pg");
-var import_core10 = require("@axiom-lattice/core");
+var import_core12 = require("@axiom-lattice/core");
 var DEFAULT_LIST_LIMIT = 50;
 var MAX_LIST_LIMIT = 200;
 var CLAIM_RUN_SQL = `UPDATE lattice_agent_runs AS r
@@ -13048,7 +13989,7 @@ var PostgreSQLAgentRunLedger = class {
     } catch (error) {
       await client.query("ROLLBACK");
       if (isActiveRunViolation(error)) {
-        throw new import_core10.AgentRunAlreadyActiveError();
+        throw new import_core12.AgentRunAlreadyActiveError();
       }
       throw error;
     } finally {
@@ -13060,19 +14001,19 @@ var PostgreSQLAgentRunLedger = class {
     const source = input.source ?? "run_api";
     if (source === "project_task") {
       if (input.taskId === void 0 || input.taskId.trim().length === 0) {
-        throw new import_core10.AgentRunInvalidTaskIdError(
+        throw new import_core12.AgentRunInvalidTaskIdError(
           "A project_task run requires a non-empty taskId"
         );
       }
     } else if (input.taskId !== void 0) {
-      throw new import_core10.AgentRunInvalidTaskIdError(
+      throw new import_core12.AgentRunInvalidTaskIdError(
         `A ${source} run cannot carry a taskId`
       );
     }
     if (input.input != null && input.command != null) {
-      throw new import_core10.AgentRunInputCommandConflictError();
+      throw new import_core12.AgentRunInputCommandConflictError();
     }
-    const inputMessageIds = input.inputMessageIds ? (0, import_core10.normalizeAgentRunMessageIds)(input.inputMessageIds) : (0, import_core10.extractAgentRunInputMessageIds)(input.input);
+    const inputMessageIds = input.inputMessageIds ? (0, import_core12.normalizeAgentRunMessageIds)(input.inputMessageIds) : (0, import_core12.extractAgentRunInputMessageIds)(input.input);
     const availableAt = input.availableAt ?? null;
     const limit = input.maxActiveRunsForTenant;
     const client = await this.pool.connect();
@@ -13099,7 +14040,7 @@ var PostgreSQLAgentRunLedger = class {
         if ((duplicate.rowCount ?? 0) > 0) {
           const existing = duplicate.rows[0].input_message_ids;
           const messageId = existing.find((id) => inputMessageIds.includes(id)) ?? inputMessageIds[0];
-          throw new import_core10.AgentRunDuplicateMessageIdError(messageId);
+          throw new import_core12.AgentRunDuplicateMessageIdError(messageId);
         }
       }
       if (limit !== void 0 && limit > 0) {
@@ -13112,7 +14053,7 @@ var PostgreSQLAgentRunLedger = class {
           [input.tenantId]
         );
         if (Number(active.rows[0].count) >= limit) {
-          throw new import_core10.AgentRunTenantQuotaExceededError(input.tenantId, limit);
+          throw new import_core12.AgentRunTenantQuotaExceededError(input.tenantId, limit);
         }
       }
       const result = await client.query(
@@ -13169,7 +14110,7 @@ var PostgreSQLAgentRunLedger = class {
     }
     const maxRunning = positiveLimit(options?.maxRunningPerTenant);
     const sources = options?.sources === void 0 ? ["run_api"] : [...options.sources];
-    (0, import_core10.assertQueueSources)(sources);
+    (0, import_core12.assertQueueSources)(sources);
     const params = [limit];
     let cursorClause = "";
     if (after) {
@@ -13241,7 +14182,7 @@ var PostgreSQLAgentRunLedger = class {
   async claimRun(input) {
     const maxRunning = positiveLimit(input.maxRunningPerTenant);
     const sources = input.sources === void 0 ? ["run_api"] : [...input.sources];
-    (0, import_core10.assertQueueSources)(sources);
+    (0, import_core12.assertQueueSources)(sources);
     if (maxRunning !== void 0) {
       return this.claimRunWithTenantCap(input, maxRunning, sources);
     }
@@ -13710,7 +14651,7 @@ var PostgreSQLAgentRunLedger = class {
   }
   /** Reports expired run-queue rows for the requested sources. */
   async reapExpired(sources = ["run_api"]) {
-    (0, import_core10.assertQueueSources)(sources);
+    (0, import_core12.assertQueueSources)(sources);
     const result = await this.pool.query(
       `SELECT * FROM lattice_agent_runs
         WHERE source = ANY($1::text[]) AND status = 'running'
@@ -13856,11 +14797,82 @@ function isActiveRunViolation(error) {
   return code === "23505" && constraint === "uq_lattice_agent_runs_one_running";
 }
 
+// src/stores/PostgreSQLPlatformSettingsStore.ts
+var import_protocols12 = require("@axiom-lattice/protocols");
+var TABLE7 = "lattice_platform_settings";
+var SETTINGS_ID = "default";
+var COLUMNS = "id, document, version, updated_by, updated_at";
+function normalizeUpdatedBy(updatedBy) {
+  const trimmed = updatedBy?.trim();
+  return trimmed ? trimmed : null;
+}
+function mapRow15(row) {
+  return {
+    ...row.document,
+    version: Number(row.version),
+    ...row.updated_by !== null ? { updatedBy: row.updated_by } : {},
+    updatedAt: row.updated_at
+  };
+}
+var PostgreSQLPlatformSettingsStore = class {
+  constructor(options) {
+    this.options = options;
+  }
+  get pool() {
+    return this.options.pool;
+  }
+  async get() {
+    const result = await this.pool.query(
+      `SELECT ${COLUMNS} FROM ${TABLE7} WHERE id = $1`,
+      [SETTINGS_ID]
+    );
+    return result.rows[0] ? mapRow15(result.rows[0]) : null;
+  }
+  async save(document, expectedVersion, updatedBy) {
+    const version = expectedVersion + 1;
+    const result = expectedVersion === 0 ? await this.pool.query(
+      `INSERT INTO ${TABLE7} (id, document, version, updated_by, updated_at)
+             VALUES ($1, $2::jsonb, $3, $4, NOW())
+             ON CONFLICT (id) DO NOTHING
+             RETURNING ${COLUMNS}`,
+      [
+        SETTINGS_ID,
+        JSON.stringify(document),
+        version,
+        normalizeUpdatedBy(updatedBy)
+      ]
+    ) : await this.pool.query(
+      `UPDATE ${TABLE7}
+             SET document = $2::jsonb, version = $3, updated_by = $4, updated_at = NOW()
+             WHERE id = $1 AND version = $5
+             RETURNING ${COLUMNS}`,
+      [
+        SETTINGS_ID,
+        JSON.stringify(document),
+        version,
+        normalizeUpdatedBy(updatedBy),
+        expectedVersion
+      ]
+    );
+    if (result.rows[0]) {
+      return mapRow15(result.rows[0]);
+    }
+    const actual = await this.pool.query(
+      `SELECT version FROM ${TABLE7} WHERE id = $1`,
+      [SETTINGS_ID]
+    );
+    throw new import_protocols12.PlatformSettingsVersionConflictError(
+      expectedVersion,
+      actual.rows[0] ? Number(actual.rows[0].version) : 0
+    );
+  }
+};
+
 // src/stores/PostgreSQLChannelReplyJobStore.ts
 var import_pg31 = require("pg");
-var import_protocols7 = require("@axiom-lattice/protocols");
+var import_protocols13 = require("@axiom-lattice/protocols");
 var DB_CLOCK_MS2 = "FLOOR(EXTRACT(EPOCH FROM clock_timestamp()) * 1000)::bigint";
-var COLUMNS = `run_id, tenant_id, assistant_id, thread_id, adapter_channel,
+var COLUMNS2 = `run_id, tenant_id, assistant_id, thread_id, adapter_channel,
   channel_installation_id, reply_target, input_message_id, stream_cursor, status,
   attempts, available_at, lease_owner, lease_expires_at, last_error,
   output_message_id, created_at, updated_at, delivered_at`;
@@ -13878,7 +14890,7 @@ function toStatus(value) {
   }
   throw new Error(`Invalid channel reply job status: ${value}`);
 }
-function mapRow9(row) {
+function mapRow16(row) {
   return {
     runId: row.run_id,
     tenantId: row.tenant_id,
@@ -13949,7 +14961,7 @@ var PostgreSQLChannelReplyJobStore = class {
   }
   /** Creates a pending job with database-clock created/updated timestamps. */
   async create(input) {
-    (0, import_protocols7.assertValidCreateChannelReplyJobInput)(input);
+    (0, import_protocols13.assertValidCreateChannelReplyJobInput)(input);
     const result = await this.pool.query(
       `WITH clock AS (SELECT ${DB_CLOCK_MS2} AS now_ms)
        INSERT INTO lattice_channel_reply_jobs (
@@ -13964,7 +14976,7 @@ var PostgreSQLChannelReplyJobStore = class {
          'pending', 0, $10, NULL, NULL,
          NULL, NULL, clock.now_ms, clock.now_ms, NULL
        FROM clock
-       RETURNING ${COLUMNS}`,
+       RETURNING ${COLUMNS2}`,
       [
         input.runId,
         input.tenantId,
@@ -13978,31 +14990,31 @@ var PostgreSQLChannelReplyJobStore = class {
         input.availableAt
       ]
     );
-    return mapRow9(result.rows[0]);
+    return mapRow16(result.rows[0]);
   }
   /** Reads one job within a tenant scope. */
   async get(tenantId, runId) {
     const result = await this.pool.query(
-      `SELECT ${COLUMNS}
+      `SELECT ${COLUMNS2}
          FROM lattice_channel_reply_jobs
         WHERE tenant_id = $1 AND run_id = $2`,
       [tenantId, runId]
     );
-    return result.rowCount === 0 ? null : mapRow9(result.rows[0]);
+    return result.rowCount === 0 ? null : mapRow16(result.rows[0]);
   }
   /** Lists claimable pending jobs that are due at `now`, oldest first. */
   async listPending(now, limit) {
     const result = await this.pool.query(
-      `SELECT ${COLUMNS}
+      `SELECT ${COLUMNS2}
          FROM lattice_channel_reply_jobs
         WHERE status = 'pending'
           AND available_at <= $1
           AND (lease_owner IS NULL OR lease_expires_at IS NULL OR lease_expires_at <= $1)
         ORDER BY available_at ASC, created_at ASC, run_id ASC
         LIMIT $2`,
-      [now, (0, import_protocols7.normalizeChannelReplyJobListLimit)(limit)]
+      [now, (0, import_protocols13.normalizeChannelReplyJobListLimit)(limit)]
     );
-    return result.rows.map(mapRow9);
+    return result.rows.map(mapRow16);
   }
   /**
    * Atomically leases a claimable job.
@@ -14023,10 +15035,10 @@ var PostgreSQLChannelReplyJobStore = class {
           AND j.status = 'pending'
           AND j.available_at <= clock.now_ms
           AND (j.lease_owner IS NULL OR j.lease_expires_at IS NULL OR j.lease_expires_at <= clock.now_ms)
-        RETURNING ${COLUMNS}`,
+        RETURNING ${COLUMNS2}`,
       [tenantId, runId, owner, leaseMs]
     );
-    return result.rowCount === 0 ? null : mapRow9(result.rows[0]);
+    return result.rowCount === 0 ? null : mapRow16(result.rows[0]);
   }
   /**
    * Marks a job delivered when `owner` still holds the lease.
@@ -14049,10 +15061,10 @@ var PostgreSQLChannelReplyJobStore = class {
           AND j.run_id = $2
           AND j.lease_owner = $3
           AND j.status = 'pending'
-        RETURNING ${COLUMNS}`,
+        RETURNING ${COLUMNS2}`,
       [tenantId, runId, owner, outputMessageId]
     );
-    return result.rowCount === 0 ? null : mapRow9(result.rows[0]);
+    return result.rowCount === 0 ? null : mapRow16(result.rows[0]);
   }
   /**
    * Returns a job to pending with an incremented attempt count.
@@ -14076,10 +15088,10 @@ var PostgreSQLChannelReplyJobStore = class {
           AND j.run_id = $2
           AND j.lease_owner = $3
           AND j.status = 'pending'
-        RETURNING ${COLUMNS}`,
+        RETURNING ${COLUMNS2}`,
       [tenantId, runId, owner, error, availableAt]
     );
-    return result.rowCount === 0 ? null : mapRow9(result.rows[0]);
+    return result.rowCount === 0 ? null : mapRow16(result.rows[0]);
   }
   /**
    * Marks a job terminally failed when `owner` still holds the lease.
@@ -14101,10 +15113,10 @@ var PostgreSQLChannelReplyJobStore = class {
           AND j.run_id = $2
           AND j.lease_owner = $3
           AND j.status = 'pending'
-        RETURNING ${COLUMNS}`,
+        RETURNING ${COLUMNS2}`,
       [tenantId, runId, owner, error]
     );
-    return result.rowCount === 0 ? null : mapRow9(result.rows[0]);
+    return result.rowCount === 0 ? null : mapRow16(result.rows[0]);
   }
   /** Deletes one job. Returns whether a row was removed. */
   async delete(tenantId, runId) {
@@ -14126,7 +15138,7 @@ var PostgreSQLChannelReplyJobStore = class {
            ORDER BY updated_at ASC, run_id ASC
            LIMIT $2
         )`,
-      [before, (0, import_protocols7.normalizeChannelReplyJobListLimit)(limit)]
+      [before, (0, import_protocols13.normalizeChannelReplyJobListLimit)(limit)]
     );
     return result.rowCount ?? 0;
   }
@@ -14164,7 +15176,7 @@ async function rollbackQuietly(client) {
   } catch {
   }
 }
-function isUniqueViolation3(error) {
+function isUniqueViolation5(error) {
   return typeof error === "object" && error !== null && "code" in error && error.code === "23505";
 }
 function isRecord5(value) {
@@ -14292,7 +15304,7 @@ var PostgreSQLCheckpointStorage = class {
       await client.query("COMMIT");
     } catch (error) {
       await rollbackQuietly(client);
-      if (isUniqueViolation3(error)) {
+      if (isUniqueViolation5(error)) {
         throw new CheckpointTargetNotEmptyError(targetThreadId);
       }
       throw error;
@@ -14580,8 +15592,8 @@ var PostgreSQLCheckpointStorage = class {
 };
 
 // src/stores/PostgreSQLStore.ts
-var import_protocols8 = require("@axiom-lattice/protocols");
-function mapRow10(row) {
+var import_protocols14 = require("@axiom-lattice/protocols");
+function mapRow17(row) {
   return {
     namespace: row.namespace,
     key: row.key,
@@ -14599,9 +15611,9 @@ var PostgreSQLStore = class {
     this.pool = pool;
   }
   async put(tenantId, input) {
-    (0, import_protocols8.assertStoreIdentity)(input.namespace, input.key);
+    (0, import_protocols14.assertStoreIdentity)(input.namespace, input.key);
     const now = /* @__PURE__ */ new Date();
-    const expiresAt = (0, import_protocols8.storeExpiresAt)(input.ttlMinutes, now) ?? null;
+    const expiresAt = (0, import_protocols14.storeExpiresAt)(input.ttlMinutes, now) ?? null;
     const result = await this.pool.query(
       `INSERT INTO lattice_store_items
         (tenant_id, namespace, key, value, created_at, updated_at, expires_at)
@@ -14613,10 +15625,10 @@ var PostgreSQLStore = class {
        RETURNING tenant_id, namespace, key, value, created_at, updated_at, expires_at`,
       [tenantId, input.namespace, input.key, JSON.stringify(input.value), now, expiresAt]
     );
-    return mapRow10(result.rows[0]);
+    return mapRow17(result.rows[0]);
   }
   async get(tenantId, namespace, key) {
-    (0, import_protocols8.assertStoreIdentity)(namespace, key);
+    (0, import_protocols14.assertStoreIdentity)(namespace, key);
     const result = await this.pool.query(
       `SELECT tenant_id, namespace, key, value, created_at, updated_at, expires_at
        FROM lattice_store_items
@@ -14624,10 +15636,10 @@ var PostgreSQLStore = class {
          AND (expires_at IS NULL OR expires_at > $4)`,
       [tenantId, namespace, key, /* @__PURE__ */ new Date()]
     );
-    return result.rows[0] ? mapRow10(result.rows[0]) : null;
+    return result.rows[0] ? mapRow17(result.rows[0]) : null;
   }
   async delete(tenantId, namespace, key) {
-    (0, import_protocols8.assertStoreIdentity)(namespace, key);
+    (0, import_protocols14.assertStoreIdentity)(namespace, key);
     const result = await this.pool.query(
       `DELETE FROM lattice_store_items
        WHERE tenant_id = $1 AND namespace = $2 AND key = $3`,
@@ -14642,7 +15654,7 @@ var PostgreSQLStore = class {
     ];
     const params = [tenantId, /* @__PURE__ */ new Date()];
     if (input.namespacePrefix) {
-      (0, import_protocols8.assertStoreNamespacePrefix)(input.namespacePrefix);
+      (0, import_protocols14.assertStoreNamespacePrefix)(input.namespacePrefix);
     }
     if (input.namespacePrefix && input.namespacePrefix.length > 0) {
       params.push(input.namespacePrefix);
@@ -14656,9 +15668,9 @@ var PostgreSQLStore = class {
       params.push(input.query.replace(/[\\%_]/g, "\\$&"));
       conditions.push(`value::text ILIKE '%' || $${params.length} || '%' ESCAPE '\\'`);
     }
-    params.push((0, import_protocols8.storePaginationValue)(input.limit, 10));
+    params.push((0, import_protocols14.storePaginationValue)(input.limit, 10));
     const limitParam = params.length;
-    params.push((0, import_protocols8.storePaginationValue)(input.offset, 0));
+    params.push((0, import_protocols14.storePaginationValue)(input.offset, 0));
     const offsetParam = params.length;
     const result = await this.pool.query(
       `SELECT tenant_id, namespace, key, value, created_at, updated_at, expires_at
@@ -14668,10 +15680,10 @@ var PostgreSQLStore = class {
        LIMIT $${limitParam} OFFSET $${offsetParam}`,
       params
     );
-    return result.rows.map(mapRow10);
+    return result.rows.map(mapRow17);
   }
   async listNamespaces(tenantId, prefix = [], limit = 100) {
-    (0, import_protocols8.assertStoreNamespacePrefix)(prefix);
+    (0, import_protocols14.assertStoreNamespacePrefix)(prefix);
     const conditions = [
       "tenant_id = $1",
       "(expires_at IS NULL OR expires_at > $2)"
@@ -14681,7 +15693,7 @@ var PostgreSQLStore = class {
       params.push(prefix);
       conditions.push(`namespace[1:array_length($${params.length}::text[], 1)] = $${params.length}`);
     }
-    params.push((0, import_protocols8.storePaginationValue)(limit, 100));
+    params.push((0, import_protocols14.storePaginationValue)(limit, 100));
     const result = await this.pool.query(
       `SELECT DISTINCT namespace
        FROM lattice_store_items
@@ -14693,7 +15705,7 @@ var PostgreSQLStore = class {
     return result.rows.map((row) => row.namespace);
   }
   async deleteExpired(now, limit) {
-    const bounded = (0, import_protocols8.storePaginationValue)(limit, 0);
+    const bounded = (0, import_protocols14.storePaginationValue)(limit, 0);
     const result = await this.pool.query(
       `WITH expired AS (
          SELECT ctid FROM lattice_store_items
@@ -14839,6 +15851,16 @@ async function createPgStoreConfig(connectionString) {
   mm.register(agentRunProjectTaskRunningIndexMigration);
   mm.register(addModelProviderKindDefault);
   mm.register(addShareKind);
+  mm.register(createUserExternalIdentityTable);
+  mm.register(createUserEmailLowerUniqueIndex);
+  mm.register(createOidcProviderConfigsTable);
+  mm.register(createPlatformMembersTable);
+  mm.register(createPlatformInvitationsTable);
+  mm.register(createOidcIdentityClaimsTable);
+  mm.register(createInviteLinksTable);
+  mm.register(addOidcIdentityClaimInviteFields);
+  mm.register(createPlatformSettingsTable);
+  mm.register(addOidcProviderAllowedHosts);
   await mm.migrate();
   const checkpoint = import_langgraph_checkpoint_postgres.PostgresSaver.fromConnString(connectionString);
   try {
@@ -14855,6 +15877,13 @@ async function createPgStoreConfig(connectionString) {
     user: new PostgreSQLUserStore(opts),
     tenant: new PostgreSQLTenantStore(opts),
     userTenantLink: new PostgreSQLUserTenantLinkStore(opts),
+    userExternalIdentity: new PostgreSQLUserExternalIdentityStore(opts),
+    oidcProviderConfig: new PostgreSQLOidcProviderConfigStore(opts),
+    platformMember: new PostgreSQLPlatformMemberStore(opts),
+    platformInvitation: new PostgreSQLPlatformInvitationStore(opts),
+    oidcIdentityClaim: new PostgreSQLOidcIdentityClaimStore(opts),
+    inviteLink: new PostgreSQLInviteLinkStore(opts),
+    platformSettings: new PostgreSQLPlatformSettingsStore(opts),
     channelBinding: new ChannelBindingStore(opts),
     channelInstallation: new PostgreSQLChannelInstallationStore(opts),
     thread: new PostgreSQLThreadStore(opts),
@@ -15452,6 +16481,7 @@ function mapRowToChannelIdentityMapping(row) {
   InvalidFileShareAddressError,
   InvalidMcpAppShareAddressError,
   InvalidMcpAppShareVisibilityError,
+  InvalidUserExternalIdentityRowError,
   MenuStore,
   MigrationManager,
   PGVectorStoreProvider,
@@ -15468,10 +16498,16 @@ function mapRowToChannelIdentityMapping(row) {
   PostgreSQLConnectionStore,
   PostgreSQLDatabaseConfigStore,
   PostgreSQLEvalStore,
+  PostgreSQLInviteLinkStore,
   PostgreSQLMcpServerConfigStore,
   PostgreSQLMetricsServerConfigStore,
   PostgreSQLModelProviderStore,
+  PostgreSQLOidcIdentityClaimStore,
+  PostgreSQLOidcProviderConfigStore,
   PostgreSQLOpenAuditStore,
+  PostgreSQLPlatformInvitationStore,
+  PostgreSQLPlatformMemberStore,
+  PostgreSQLPlatformSettingsStore,
   PostgreSQLPluginDeploymentStore,
   PostgreSQLProjectBotMembershipStore,
   PostgreSQLProjectMembershipStore,
@@ -15485,6 +16521,7 @@ function mapRowToChannelIdentityMapping(row) {
   PostgreSQLTaskWorkItemStore,
   PostgreSQLTenantStore,
   PostgreSQLThreadStore,
+  PostgreSQLUserExternalIdentityStore,
   PostgreSQLUserStore,
   PostgreSQLUserTenantLinkStore,
   PostgreSQLWorkflowTrackingStore,
@@ -15502,6 +16539,7 @@ function mapRowToChannelIdentityMapping(row) {
   addInterruptColumnsToEval,
   addInterruptPolicyToEvalCases,
   addMcpAppContentType,
+  addOidcIdentityClaimInviteFields,
   addProjectConfigColumn,
   addScheduleTenantId,
   addShareKind,
@@ -15531,11 +16569,17 @@ function mapRowToChannelIdentityMapping(row) {
   createEvalRunResultsTable,
   createEvalRunsTable,
   createEvalSuitesTable,
+  createInviteLinksTable,
   createMcpServerConfigsTable,
   createMenuItemsTable,
   createMetricsConfigsTable,
+  createOidcIdentityClaimsTable,
+  createOidcProviderConfigsTable,
   createPGVectorStoreProvider,
   createPgStoreConfig,
+  createPlatformInvitationsTable,
+  createPlatformMembersTable,
+  createPlatformSettingsTable,
   createPluginDeployments,
   createProjectRoomReadStates,
   createProjectRoomTables,
@@ -15547,6 +16591,8 @@ function mapRowToChannelIdentityMapping(row) {
   createTenantsTable,
   createThreadMessageQueueTable,
   createThreadsTable,
+  createUserEmailLowerUniqueIndex,
+  createUserExternalIdentityTable,
   createUsersTable,
   createWorkflowTrackingTables,
   createWorkspacesTable,