@axiom-lattice/pg-stores 5.0.3 → 5.1.1

package/dist/index.mjs

@@ -2950,9 +2950,10 @@ var PostgreSQLUserStore = class {
       `
         SELECT id, email, name, status, metadata, created_at, updated_at
         FROM lattice_users
-        WHERE email = $1
+        WHERE lower(email) = lower($1)
+        LIMIT 1
       `,
-      [email]
+      [email.trim()]
     );
     if (result.rows.length === 0) return null;
     return this.mapRowToUser(result.rows[0]);
@@ -3493,6 +3494,693 @@ var PostgreSQLUserTenantLinkStore = class {
   }
 };
 
+// src/stores/PostgreSQLUserExternalIdentityStore.ts
+import {
+  ExternalIdentityConflictError,
+  ExternalIdentityPersistError
+} from "@axiom-lattice/protocols";
+var InvalidUserExternalIdentityRowError = class extends Error {
+  constructor() {
+    super("Invalid user external identity row");
+    this.code = "INVALID_USER_EXTERNAL_IDENTITY_ROW";
+    this.name = "InvalidUserExternalIdentityRowError";
+  }
+};
+var columns = "user_id, provider_id, issuer, subject, email, linked_at";
+function mapRow(row) {
+  if (typeof row.user_id !== "string" || typeof row.provider_id !== "string" || typeof row.issuer !== "string" || typeof row.subject !== "string" || !(row.linked_at instanceof Date) || Number.isNaN(row.linked_at.getTime())) {
+    throw new InvalidUserExternalIdentityRowError();
+  }
+  return {
+    userId: row.user_id,
+    providerId: row.provider_id,
+    issuer: row.issuer,
+    subject: row.subject,
+    ...typeof row.email === "string" ? { email: row.email } : {},
+    linkedAt: row.linked_at
+  };
+}
+var PostgreSQLUserExternalIdentityStore = class {
+  constructor(options) {
+    this.pool = options.pool;
+  }
+  async getByProviderSubject(providerId, issuer, subject) {
+    const result = await this.pool.query(
+      `SELECT ${columns} FROM lattice_user_identities
+       WHERE provider_id = $1 AND issuer = $2 AND subject = $3`,
+      [providerId, issuer, subject]
+    );
+    return result.rows[0] ? mapRow(result.rows[0]) : null;
+  }
+  async listByUser(userId) {
+    const result = await this.pool.query(
+      `SELECT ${columns} FROM lattice_user_identities WHERE user_id = $1 ORDER BY linked_at ASC`,
+      [userId]
+    );
+    return result.rows.map(mapRow);
+  }
+  async link(identity) {
+    const inserted = await this.pool.query(
+      `INSERT INTO lattice_user_identities (${columns})
+       VALUES ($1, $2, $3, $4, $5, $6)
+       ON CONFLICT (provider_id, issuer, subject) DO NOTHING
+       RETURNING ${columns}`,
+      [
+        identity.userId,
+        identity.providerId,
+        identity.issuer,
+        identity.subject,
+        identity.email ?? null,
+        identity.linkedAt
+      ]
+    );
+    if (inserted.rows[0]) return;
+    const existing = await this.getByProviderSubject(
+      identity.providerId,
+      identity.issuer,
+      identity.subject
+    );
+    if (!existing) {
+      throw new ExternalIdentityPersistError(
+        identity.providerId,
+        identity.issuer,
+        identity.subject
+      );
+    }
+    if (existing.userId !== identity.userId) {
+      throw new ExternalIdentityConflictError(
+        identity.providerId,
+        identity.issuer,
+        identity.subject
+      );
+    }
+    if (identity.email !== void 0 && identity.email !== existing.email) {
+      await this.pool.query(
+        `UPDATE lattice_user_identities SET email = $1
+         WHERE provider_id = $2 AND issuer = $3 AND subject = $4`,
+        [identity.email, identity.providerId, identity.issuer, identity.subject]
+      );
+    }
+  }
+  async unlink(providerId, issuer, subject) {
+    await this.pool.query(
+      `DELETE FROM lattice_user_identities
+       WHERE provider_id = $1 AND issuer = $2 AND subject = $3`,
+      [providerId, issuer, subject]
+    );
+  }
+};
+
+// src/stores/PostgreSQLOidcProviderConfigStore.ts
+import { safeDecrypt as safeDecrypt4, encrypt as encrypt4 } from "@axiom-lattice/core";
+import {
+  OidcProviderConfigConflictError
+} from "@axiom-lattice/protocols";
+var TABLE2 = "lattice_oidc_provider_configs";
+function parseAllowedPrivateHosts(value) {
+  if (!Array.isArray(value)) return void 0;
+  return value.filter((entry) => typeof entry === "string");
+}
+function serializeAllowedPrivateHosts(value) {
+  return value === void 0 ? null : JSON.stringify(value);
+}
+function normalizeTenantId(value) {
+  if (typeof value !== "string") return void 0;
+  const trimmed = value.trim();
+  return trimmed.length > 0 ? trimmed : void 0;
+}
+function mapRow2(row) {
+  if (typeof row.id !== "string" || typeof row.display_name !== "string" || typeof row.issuer !== "string" || typeof row.client_id !== "string" || typeof row.client_secret !== "string" || typeof row.scopes !== "string" || typeof row.enabled !== "boolean" || typeof row.jit_provisioning !== "boolean" || typeof row.auto_link_email !== "boolean" || !(row.created_at instanceof Date) || !(row.updated_at instanceof Date)) {
+    throw new Error("Invalid OIDC provider config row");
+  }
+  const allowedPrivateHosts = parseAllowedPrivateHosts(
+    row.allowed_private_hosts
+  );
+  return {
+    id: row.id,
+    displayName: row.display_name,
+    issuer: row.issuer,
+    clientId: row.client_id,
+    clientSecret: safeDecrypt4(
+      row.client_secret,
+      `OIDC provider config "${row.id}" client secret`
+    ),
+    scopes: row.scopes,
+    enabled: row.enabled,
+    jitProvisioning: row.jit_provisioning,
+    autoLinkEmail: row.auto_link_email,
+    ...typeof row.default_tenant_id === "string" ? { defaultTenantId: row.default_tenant_id } : {},
+    ...allowedPrivateHosts !== void 0 ? { allowedPrivateHosts } : {},
+    createdAt: row.created_at,
+    updatedAt: row.updated_at
+  };
+}
+function isUniqueViolation(error) {
+  return typeof error === "object" && error !== null && "code" in error && error.code === "23505";
+}
+var PostgreSQLOidcProviderConfigStore = class {
+  constructor(options) {
+    this.pool = options.pool;
+  }
+  async list() {
+    const result = await this.pool.query(
+      `SELECT * FROM ${TABLE2} ORDER BY created_at ASC, id ASC`
+    );
+    return result.rows.map(mapRow2);
+  }
+  async get(id) {
+    const result = await this.pool.query(
+      `SELECT * FROM ${TABLE2} WHERE id = $1`,
+      [id]
+    );
+    return result.rows[0] ? mapRow2(result.rows[0]) : null;
+  }
+  async create(id, input) {
+    const tenantId = normalizeTenantId(input.defaultTenantId);
+    try {
+      await this.pool.query(
+        `INSERT INTO ${TABLE2}
+         (id, display_name, issuer, client_id, client_secret, scopes,
+          enabled, jit_provisioning, auto_link_email, default_tenant_id,
+          allowed_private_hosts)
+         VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11)`,
+        [
+          id,
+          input.displayName,
+          input.issuer,
+          input.clientId,
+          encrypt4(input.clientSecret),
+          input.scopes,
+          input.enabled,
+          input.jitProvisioning,
+          input.autoLinkEmail,
+          tenantId ?? null,
+          serializeAllowedPrivateHosts(input.allowedPrivateHosts)
+        ]
+      );
+    } catch (error) {
+      if (isUniqueViolation(error)) {
+        throw new OidcProviderConfigConflictError(id);
+      }
+      throw error;
+    }
+    const created = await this.get(id);
+    if (!created) {
+      throw new Error(`OIDC provider config "${id}" was not persisted`);
+    }
+    return created;
+  }
+  async update(id, updates) {
+    const existing = await this.get(id);
+    if (!existing) return null;
+    const setClauses = [];
+    const values = [];
+    let paramIndex = 1;
+    const set = (column, value) => {
+      setClauses.push(`${column} = $${paramIndex++}`);
+      values.push(value);
+    };
+    if (updates.displayName !== void 0) set("display_name", updates.displayName);
+    if (updates.issuer !== void 0) set("issuer", updates.issuer);
+    if (updates.clientId !== void 0) set("client_id", updates.clientId);
+    if (updates.clientSecret !== void 0 && updates.clientSecret !== "") {
+      set("client_secret", encrypt4(updates.clientSecret));
+    }
+    if (updates.scopes !== void 0) set("scopes", updates.scopes);
+    if (updates.enabled !== void 0) set("enabled", updates.enabled);
+    if (updates.jitProvisioning !== void 0) {
+      set("jit_provisioning", updates.jitProvisioning);
+    }
+    if (updates.autoLinkEmail !== void 0) {
+      set("auto_link_email", updates.autoLinkEmail);
+    }
+    if (updates.defaultTenantId !== void 0) {
+      set("default_tenant_id", normalizeTenantId(updates.defaultTenantId) ?? null);
+    }
+    if (updates.allowedPrivateHosts !== void 0) {
+      set(
+        "allowed_private_hosts",
+        serializeAllowedPrivateHosts(updates.allowedPrivateHosts)
+      );
+    }
+    if (setClauses.length === 0) return existing;
+    setClauses.push("updated_at = NOW()");
+    values.push(id);
+    await this.pool.query(
+      `UPDATE ${TABLE2} SET ${setClauses.join(", ")} WHERE id = $${paramIndex}`,
+      values
+    );
+    return this.get(id);
+  }
+  async delete(id) {
+    const result = await this.pool.query(`DELETE FROM ${TABLE2} WHERE id = $1`, [id]);
+    return (result.rowCount ?? 0) > 0;
+  }
+};
+
+// src/stores/PostgreSQLPlatformMemberStore.ts
+var TABLE3 = "lattice_platform_members";
+var ROLES = ["owner", "admin", "auditor"];
+function isPlatformRole(value) {
+  return ROLES.includes(value);
+}
+function mapRow3(row) {
+  if (typeof row.user_id !== "string" || typeof row.role !== "string" || !isPlatformRole(row.role) || !(row.granted_at instanceof Date) || !(row.updated_at instanceof Date)) {
+    throw new Error("Invalid platform member row");
+  }
+  return {
+    userId: row.user_id,
+    role: row.role,
+    ...typeof row.granted_by === "string" ? { grantedBy: row.granted_by } : {},
+    grantedAt: row.granted_at,
+    updatedAt: row.updated_at
+  };
+}
+var PostgreSQLPlatformMemberStore = class {
+  constructor(options) {
+    this.pool = options.pool;
+  }
+  /** Lists every platform member ordered by user id. */
+  async list() {
+    const result = await this.pool.query(
+      `SELECT * FROM ${TABLE3} ORDER BY user_id ASC`
+    );
+    return result.rows.map(mapRow3);
+  }
+  /** Returns the platform member for a user, or null. */
+  async get(userId) {
+    const result = await this.pool.query(
+      `SELECT * FROM ${TABLE3} WHERE user_id = $1`,
+      [userId]
+    );
+    return result.rows[0] ? mapRow3(result.rows[0]) : null;
+  }
+  /**
+   * Inserts or replaces a member keyed by user id.
+   *
+   * The supplied grant replaces any existing row in full (last write wins),
+   * including `grantedAt` and `updatedAt`.
+   */
+  async upsert(member) {
+    const result = await this.pool.query(
+      `INSERT INTO ${TABLE3} (user_id, role, granted_by, granted_at, updated_at)
+       VALUES ($1, $2, $3, $4, $5)
+       ON CONFLICT (user_id) DO UPDATE SET
+         role = EXCLUDED.role,
+         granted_by = EXCLUDED.granted_by,
+         granted_at = EXCLUDED.granted_at,
+         updated_at = EXCLUDED.updated_at
+       RETURNING *`,
+      [
+        member.userId,
+        member.role,
+        member.grantedBy ?? null,
+        member.grantedAt,
+        member.updatedAt
+      ]
+    );
+    return mapRow3(result.rows[0]);
+  }
+  /** Deletes a member. Returns whether a row was removed. */
+  async delete(userId) {
+    const result = await this.pool.query(`DELETE FROM ${TABLE3} WHERE user_id = $1`, [
+      userId
+    ]);
+    return (result.rowCount ?? 0) > 0;
+  }
+};
+
+// src/stores/PostgreSQLPlatformInvitationStore.ts
+import {
+  normalizePlatformInvitationEmail
+} from "@axiom-lattice/protocols";
+var TABLE4 = "lattice_platform_invitations";
+var ROLES2 = ["owner", "admin", "auditor"];
+function isPlatformRole2(value) {
+  return ROLES2.includes(value);
+}
+function mapRow4(row) {
+  if (typeof row.email !== "string" || typeof row.role !== "string" || !isPlatformRole2(row.role) || !(row.created_at instanceof Date)) {
+    throw new Error("Invalid platform invitation row");
+  }
+  return {
+    email: row.email,
+    role: row.role,
+    ...typeof row.invited_by === "string" ? { invitedBy: row.invited_by } : {},
+    createdAt: row.created_at,
+    ...row.expires_at instanceof Date ? { expiresAt: row.expires_at } : {},
+    ...row.consumed_at instanceof Date ? { consumedAt: row.consumed_at } : {}
+  };
+}
+var PostgreSQLPlatformInvitationStore = class {
+  constructor(options) {
+    this.pool = options.pool;
+  }
+  /** Lists every invitation ordered by normalized email. */
+  async list() {
+    const result = await this.pool.query(
+      `SELECT * FROM ${TABLE4} ORDER BY email ASC`
+    );
+    return result.rows.map(mapRow4);
+  }
+  /** Returns the invitation for an email, or null. */
+  async get(email) {
+    const result = await this.pool.query(
+      `SELECT * FROM ${TABLE4} WHERE email = $1`,
+      [normalizePlatformInvitationEmail(email)]
+    );
+    return result.rows[0] ? mapRow4(result.rows[0]) : null;
+  }
+  /**
+   * Inserts or replaces an invitation keyed by normalized email.
+   *
+   * The supplied invitation replaces any existing row in full (last write wins),
+   * including `expiresAt` and `consumedAt`.
+   */
+  async upsert(invitation) {
+    const result = await this.pool.query(
+      `INSERT INTO ${TABLE4}
+         (email, role, invited_by, created_at, expires_at, consumed_at)
+       VALUES ($1, $2, $3, $4, $5, $6)
+       ON CONFLICT (email) DO UPDATE SET
+         role = EXCLUDED.role,
+         invited_by = EXCLUDED.invited_by,
+         created_at = EXCLUDED.created_at,
+         expires_at = EXCLUDED.expires_at,
+         consumed_at = EXCLUDED.consumed_at
+       RETURNING *`,
+      [
+        normalizePlatformInvitationEmail(invitation.email),
+        invitation.role,
+        invitation.invitedBy ?? null,
+        invitation.createdAt,
+        invitation.expiresAt ?? null,
+        invitation.consumedAt ?? null
+      ]
+    );
+    return mapRow4(result.rows[0]);
+  }
+  /** Deletes an invitation. Returns whether a row was removed. */
+  async delete(email) {
+    const result = await this.pool.query(
+      `DELETE FROM ${TABLE4} WHERE email = $1`,
+      [normalizePlatformInvitationEmail(email)]
+    );
+    return (result.rowCount ?? 0) > 0;
+  }
+  /**
+   * Atomically consumes a pending, unexpired invitation.
+   *
+   * Returns the consumed invitation, or null when the row is missing, already
+   * consumed, or expired.
+   */
+  async consume(email, at) {
+    const result = await this.pool.query(
+      `UPDATE ${TABLE4}
+       SET consumed_at = $1
+       WHERE email = $2
+         AND consumed_at IS NULL
+         AND (expires_at IS NULL OR expires_at > $1)
+       RETURNING *`,
+      [at, normalizePlatformInvitationEmail(email)]
+    );
+    return result.rows[0] ? mapRow4(result.rows[0]) : null;
+  }
+};
+
+// src/stores/PostgreSQLOidcIdentityClaimStore.ts
+import {
+  normalizeOidcIdentityEmail,
+  OidcIdentityClaimConflictError
+} from "@axiom-lattice/protocols";
+var TABLE5 = "lattice_oidc_identity_claims";
+function mapRow5(row) {
+  return {
+    id: row.id,
+    providerId: row.provider_id,
+    issuer: row.issuer,
+    subject: row.subject,
+    email: row.email,
+    ...row.name !== null ? { name: row.name } : {},
+    ...row.picture !== null ? { picture: row.picture } : {},
+    status: row.status,
+    createdAt: row.created_at,
+    updatedAt: row.updated_at,
+    expiresAt: row.expires_at,
+    ...row.reviewed_by !== null ? { reviewedBy: row.reviewed_by } : {},
+    ...row.reviewed_at !== null ? { reviewedAt: row.reviewed_at } : {},
+    ...row.linked_user_id !== null ? { linkedUserId: row.linked_user_id } : {},
+    ...row.source !== null ? { source: row.source } : {},
+    ...row.invite_link_id !== null ? { inviteLinkId: row.invite_link_id } : {},
+    ...row.requested_user_id !== null ? { requestedUserId: row.requested_user_id } : {},
+    ...row.requested_platform_role !== null ? { requestedPlatformRole: row.requested_platform_role } : {},
+    ...row.requested_tenant_id !== null ? { requestedTenantId: row.requested_tenant_id } : {},
+    ...row.requested_tenant_role !== null ? { requestedTenantRole: row.requested_tenant_role } : {}
+  };
+}
+function isUniqueViolation2(error) {
+  return typeof error === "object" && error !== null && error.code === "23505";
+}
+var PostgreSQLOidcIdentityClaimStore = class {
+  constructor(options) {
+    this.pool = options.pool;
+  }
+  async list(status) {
+    const result = status ? await this.pool.query(
+      `SELECT * FROM ${TABLE5} WHERE status = $1
+           ORDER BY created_at ASC, id ASC`,
+      [status]
+    ) : await this.pool.query(
+      `SELECT * FROM ${TABLE5} ORDER BY created_at ASC, id ASC`
+    );
+    return result.rows.map(mapRow5);
+  }
+  async get(id) {
+    const result = await this.pool.query(
+      `SELECT * FROM ${TABLE5} WHERE id = $1`,
+      [id]
+    );
+    return result.rows[0] ? mapRow5(result.rows[0]) : null;
+  }
+  async getPendingBySubject(providerId, issuer, subject, now) {
+    const result = await this.pool.query(
+      `SELECT * FROM ${TABLE5}
+       WHERE provider_id = $1 AND issuer = $2 AND subject = $3
+         AND status = 'pending' AND expires_at > $4`,
+      [providerId, issuer, subject, now]
+    );
+    return result.rows[0] ? mapRow5(result.rows[0]) : null;
+  }
+  async create(input) {
+    const now = /* @__PURE__ */ new Date();
+    await this.pool.query(
+      `UPDATE ${TABLE5}
+       SET status = 'expired', updated_at = $1
+       WHERE provider_id = $2 AND issuer = $3 AND subject = $4
+         AND status = 'pending' AND expires_at <= $1`,
+      [now, input.providerId, input.issuer, input.subject]
+    );
+    try {
+      const result = await this.pool.query(
+        `INSERT INTO ${TABLE5}
+         (id, provider_id, issuer, subject, email, name, picture, status,
+          created_at, updated_at, expires_at, source, invite_link_id,
+          requested_user_id, requested_platform_role, requested_tenant_id,
+          requested_tenant_role)
+         VALUES ($1, $2, $3, $4, $5, $6, $7, 'pending', $8, $8, $9,
+                 $10, $11, $12, $13, $14, $15)
+         RETURNING *`,
+        [
+          input.id,
+          input.providerId,
+          input.issuer,
+          input.subject,
+          normalizeOidcIdentityEmail(input.email),
+          input.name ?? null,
+          input.picture ?? null,
+          now,
+          input.expiresAt,
+          input.source ?? null,
+          input.inviteLinkId ?? null,
+          input.requestedUserId ?? null,
+          input.requestedPlatformRole ?? null,
+          input.requestedTenantId ?? null,
+          input.requestedTenantRole ?? null
+        ]
+      );
+      return mapRow5(result.rows[0]);
+    } catch (error) {
+      if (isUniqueViolation2(error)) {
+        throw new OidcIdentityClaimConflictError(
+          input.providerId,
+          input.issuer,
+          input.subject
+        );
+      }
+      throw error;
+    }
+  }
+  async updatePending(id, updates, now) {
+    const sets = [];
+    const params = [];
+    if (updates.email !== void 0) {
+      params.push(normalizeOidcIdentityEmail(updates.email));
+      sets.push(`email = $${params.length}`);
+    }
+    if (updates.name !== void 0) {
+      params.push(updates.name);
+      sets.push(`name = $${params.length}`);
+    }
+    if (updates.picture !== void 0) {
+      params.push(updates.picture);
+      sets.push(`picture = $${params.length}`);
+    }
+    if (sets.length === 0) return this.get(id);
+    params.push(now);
+    sets.push(`updated_at = $${params.length}`);
+    params.push(id);
+    const result = await this.pool.query(
+      `UPDATE ${TABLE5} SET ${sets.join(", ")}
+       WHERE id = $${params.length} AND status = 'pending'
+       RETURNING *`,
+      params
+    );
+    return result.rows[0] ? mapRow5(result.rows[0]) : null;
+  }
+  async approve(id, approval, now) {
+    const result = await this.pool.query(
+      `UPDATE ${TABLE5}
+       SET status = 'approved', reviewed_by = $1, reviewed_at = $2,
+           linked_user_id = $3, updated_at = $2
+       WHERE id = $4 AND status = 'pending'
+       RETURNING *`,
+      [approval.reviewedBy, now, approval.linkedUserId, id]
+    );
+    return result.rows[0] ? mapRow5(result.rows[0]) : null;
+  }
+  async reject(id, reviewedBy, now) {
+    const result = await this.pool.query(
+      `UPDATE ${TABLE5}
+       SET status = 'rejected', reviewed_by = $1, reviewed_at = $2,
+           updated_at = $2
+       WHERE id = $3 AND status = 'pending'
+       RETURNING *`,
+      [reviewedBy, now, id]
+    );
+    return result.rows[0] ? mapRow5(result.rows[0]) : null;
+  }
+  async delete(id) {
+    const result = await this.pool.query(
+      `DELETE FROM ${TABLE5} WHERE id = $1`,
+      [id]
+    );
+    return (result.rowCount ?? 0) > 0;
+  }
+};
+
+// src/stores/PostgreSQLInviteLinkStore.ts
+import { encrypt as encrypt5, safeDecrypt as safeDecrypt5 } from "@axiom-lattice/core";
+import {
+  normalizeInviteLinkEmail
+} from "@axiom-lattice/protocols";
+var TABLE6 = "lattice_invite_links";
+function mapRow6(row) {
+  return {
+    id: row.id,
+    scope: row.scope,
+    token: safeDecrypt5(row.token_encrypted, `Invite link "${row.id}" token`),
+    tokenHash: row.token_hash,
+    ...row.email !== null ? { email: row.email } : {},
+    ...row.platform_role !== null ? { platformRole: row.platform_role } : {},
+    ...row.tenant_id !== null ? { tenantId: row.tenant_id } : {},
+    ...row.tenant_role !== null ? { tenantRole: row.tenant_role } : {},
+    ...row.created_by !== null ? { createdBy: row.created_by } : {},
+    createdAt: row.created_at,
+    updatedAt: row.updated_at,
+    expiresAt: row.expires_at,
+    maxUses: Number(row.max_uses),
+    usedCount: Number(row.used_count),
+    ...row.revoked_at !== null ? { revokedAt: row.revoked_at } : {}
+  };
+}
+var PostgreSQLInviteLinkStore = class {
+  constructor(options) {
+    this.options = options;
+  }
+  get pool() {
+    return this.options.pool;
+  }
+  async list() {
+    const result = await this.pool.query(
+      `SELECT * FROM ${TABLE6} ORDER BY created_at DESC, id DESC`
+    );
+    return result.rows.map(mapRow6);
+  }
+  async get(id) {
+    const result = await this.pool.query(
+      `SELECT * FROM ${TABLE6} WHERE id = $1`,
+      [id]
+    );
+    return result.rows[0] ? mapRow6(result.rows[0]) : null;
+  }
+  async getByTokenHash(tokenHash) {
+    const result = await this.pool.query(
+      `SELECT * FROM ${TABLE6} WHERE token_hash = $1`,
+      [tokenHash]
+    );
+    return result.rows[0] ? mapRow6(result.rows[0]) : null;
+  }
+  async create(input) {
+    const now = /* @__PURE__ */ new Date();
+    const result = await this.pool.query(
+      `INSERT INTO ${TABLE6}
+       (id, scope, token_hash, token_encrypted, email, platform_role,
+        tenant_id, tenant_role, created_by, created_at, updated_at,
+        expires_at, max_uses, used_count)
+       VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $10, $11, $12, 0)
+       RETURNING *`,
+      [
+        input.id,
+        input.scope,
+        input.tokenHash,
+        encrypt5(input.token),
+        input.email ? normalizeInviteLinkEmail(input.email) : null,
+        input.platformRole ?? null,
+        input.tenantId ?? null,
+        input.tenantRole ?? null,
+        input.createdBy ?? null,
+        now,
+        input.expiresAt,
+        input.maxUses
+      ]
+    );
+    return mapRow6(result.rows[0]);
+  }
+  async consume(tokenHash, now) {
+    const result = await this.pool.query(
+      `UPDATE ${TABLE6}
+       SET used_count = used_count + 1, updated_at = $1
+       WHERE token_hash = $2
+         AND revoked_at IS NULL
+         AND expires_at > $1
+         AND used_count < max_uses
+       RETURNING *`,
+      [now, tokenHash]
+    );
+    return result.rows[0] ? mapRow6(result.rows[0]) : null;
+  }
+  async revoke(id, now) {
+    const result = await this.pool.query(
+      `UPDATE ${TABLE6}
+       SET revoked_at = COALESCE(revoked_at, $1), updated_at = $1
+       WHERE id = $2
+       RETURNING *`,
+      [now, id]
+    );
+    return result.rows[0] ? mapRow6(result.rows[0]) : null;
+  }
+};
+
 // src/stores/PostgreSQLWorkflowTrackingStore.ts
 import { randomUUID } from "crypto";
 import { Pool as Pool11 } from "pg";
@@ -5978,7 +6666,7 @@ var alterChannelInstallationsTable = {
 };
 
 // src/stores/PostgreSQLChannelInstallationStore.ts
-import { safeDecrypt as safeDecrypt4, encrypt as encrypt4 } from "@axiom-lattice/core";
+import { safeDecrypt as safeDecrypt6, encrypt as encrypt6 } from "@axiom-lattice/core";
 var PostgreSQLChannelInstallationStore = class {
   constructor(options) {
     this.initialized = false;
@@ -6200,17 +6888,17 @@ var PostgreSQLChannelInstallationStore = class {
   encryptSecrets(config) {
     return {
       ...config,
-      ...typeof config.appSecret === "string" ? { appSecret: encrypt4(config.appSecret) } : {},
-      ...typeof config.verificationToken === "string" ? { verificationToken: encrypt4(config.verificationToken) } : {},
-      ...typeof config.encryptKey === "string" ? { encryptKey: encrypt4(config.encryptKey) } : {}
+      ...typeof config.appSecret === "string" ? { appSecret: encrypt6(config.appSecret) } : {},
+      ...typeof config.verificationToken === "string" ? { verificationToken: encrypt6(config.verificationToken) } : {},
+      ...typeof config.encryptKey === "string" ? { encryptKey: encrypt6(config.encryptKey) } : {}
     };
   }
   decryptSecrets(config) {
     return {
       ...config,
-      ...typeof config.appSecret === "string" ? { appSecret: safeDecrypt4(config.appSecret) } : {},
-      ...typeof config.verificationToken === "string" ? { verificationToken: safeDecrypt4(config.verificationToken) } : {},
-      ...typeof config.encryptKey === "string" ? { encryptKey: safeDecrypt4(config.encryptKey) } : {}
+      ...typeof config.appSecret === "string" ? { appSecret: safeDecrypt6(config.appSecret) } : {},
+      ...typeof config.verificationToken === "string" ? { verificationToken: safeDecrypt6(config.verificationToken) } : {},
+      ...typeof config.encryptKey === "string" ? { encryptKey: safeDecrypt6(config.encryptKey) } : {}
     };
   }
 };
@@ -6288,7 +6976,7 @@ var addApiKeyGrants = {
 };
 
 // src/stores/PostgreSQLA2AApiKeyStore.ts
-import { encrypt as encrypt5, decrypt, safeDecrypt as safeDecrypt5 } from "@axiom-lattice/core";
+import { encrypt as encrypt7, decrypt, safeDecrypt as safeDecrypt7 } from "@axiom-lattice/core";
 import { randomUUID as randomUUID2 } from "crypto";
 function generateApiKey() {
   return `a2a_${randomUUID2().replace(/-/g, "")}`;
@@ -6296,7 +6984,7 @@ function generateApiKey() {
 function mapRowToRecord(row) {
   return {
     id: row.id,
-    key: safeDecrypt5(row.key_value),
+    key: safeDecrypt7(row.key_value),
     tenantId: row.tenant_id,
     projectId: row.project_id,
     assistantIds: row.assistant_ids ?? void 0,
@@ -6404,7 +7092,7 @@ var PostgreSQLA2AApiKeyStore = class {
       `INSERT INTO lattice_a2a_api_keys (key_value, tenant_id, project_id, assistant_ids, grants, label)
        VALUES ($1, $2, $3, $4, $5, $6) RETURNING *`,
       [
-        encrypt5(key),
+        encrypt7(key),
         input.tenantId,
         input.projectId,
         input.assistantIds ? JSON.stringify(input.assistantIds) : null,
@@ -6473,7 +7161,7 @@ var PostgreSQLA2AApiKeyStore = class {
     const key = generateApiKey();
     const result = await this.pool.query(
       `UPDATE lattice_a2a_api_keys SET key_value = $1, updated_at = NOW() WHERE id = $2 RETURNING *`,
-      [encrypt5(key), id]
+      [encrypt7(key), id]
     );
     if (result.rows.length === 0) throw new Error(`A2A API key not found: ${id}`);
     const record = mapRowToRecord(result.rows[0]);
@@ -6742,7 +7430,7 @@ function isIdentity(value) {
 function isStatus(value) {
   return value === "draft" || value === "active" || value === "disabled";
 }
-function mapRow(row) {
+function mapRow7(row) {
   if (!isStatus(row.status) || !isIntegration(row.integration) || !isScope(row.scope) || !isFeatures(row.features) || !isAppearance(row.appearance) || !isIdentity(row.identity)) {
     throw new Error(`Invalid agent web app row: ${row.id}`);
   }
@@ -6814,7 +7502,7 @@ var PostgreSQLAgentWebAppStore = class {
          ORDER BY created_at DESC, id DESC`,
       [tenantId, assistantId]
     );
-    return result.rows.map(mapRow);
+    return result.rows.map(mapRow7);
   }
   async getById(tenantId, webAppId) {
     await this.ensureInitialized();
@@ -6823,7 +7511,7 @@ var PostgreSQLAgentWebAppStore = class {
        WHERE tenant_id = $1 AND id = $2`,
       [tenantId, webAppId]
     );
-    return result.rows[0] ? mapRow(result.rows[0]) : null;
+    return result.rows[0] ? mapRow7(result.rows[0]) : null;
   }
   async findById(webAppId) {
     await this.ensureInitialized();
@@ -6832,7 +7520,7 @@ var PostgreSQLAgentWebAppStore = class {
        WHERE id = $1`,
       [webAppId]
     );
-    return result.rows[0] ? mapRow(result.rows[0]) : null;
+    return result.rows[0] ? mapRow7(result.rows[0]) : null;
   }
   async create(tenantId, input) {
     await this.ensureInitialized();
@@ -6856,7 +7544,7 @@ var PostgreSQLAgentWebAppStore = class {
         input.identity ? JSON.stringify(input.identity) : null
       ]
     );
-    return mapRow(result.rows[0]);
+    return mapRow7(result.rows[0]);
   }
   async update(tenantId, webAppId, patch, options) {
     await this.ensureInitialized();
@@ -6898,7 +7586,7 @@ var PostgreSQLAgentWebAppStore = class {
        RETURNING *`,
       values
     );
-    return result.rows[0] ? mapRow(result.rows[0]) : null;
+    return result.rows[0] ? mapRow7(result.rows[0]) : null;
   }
   async delete(tenantId, webAppId) {
     await this.ensureInitialized();
@@ -9991,7 +10679,7 @@ var createChannelIdentityMappingTables = {
 };
 
 // src/migrations/connection_config_migrations.ts
-import { encrypt as encrypt6, isEncryptedValue } from "@axiom-lattice/core";
+import { encrypt as encrypt8, isEncryptedValue } from "@axiom-lattice/core";
 var createConnectionConfigsTable = {
   version: 160,
   name: "create_connection_configs_table",
@@ -10063,7 +10751,7 @@ var reencryptLegacyConnectionSecrets = {
       for (const field of secretFields) {
         const value = config[field];
         if (typeof value === "string" && value.length > 0 && !isEncryptedValue(value)) {
-          config[field] = encrypt6(value);
+          config[field] = encrypt8(value);
           changed = true;
         }
       }
@@ -10079,6 +10767,254 @@ var reencryptLegacyConnectionSecrets = {
   }
 };
 
+// src/migrations/user_external_identity_migration.ts
+var createUserExternalIdentityTable = {
+  version: 209,
+  name: "create_user_external_identity",
+  up: async (client) => {
+    await client.query(`
+      CREATE TABLE IF NOT EXISTS lattice_user_identities (
+        user_id VARCHAR(255) NOT NULL,
+        provider_id VARCHAR(255) NOT NULL,
+        issuer TEXT NOT NULL,
+        subject TEXT NOT NULL,
+        email TEXT,
+        linked_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+        PRIMARY KEY (provider_id, issuer, subject)
+      )
+    `);
+    await client.query(`
+      CREATE INDEX IF NOT EXISTS idx_lattice_user_identities_user
+      ON lattice_user_identities (user_id)
+    `);
+  },
+  down: async (client) => {
+    await client.query("DROP INDEX IF EXISTS idx_lattice_user_identities_user");
+    await client.query("DROP TABLE IF EXISTS lattice_user_identities");
+  }
+};
+
+// src/migrations/user_email_lower_unique_migration.ts
+var createUserEmailLowerUniqueIndex = {
+  version: 210,
+  name: "create_user_email_lower_unique_index",
+  up: async (client) => {
+    await client.query(`
+      CREATE UNIQUE INDEX IF NOT EXISTS idx_lattice_users_email_lower
+      ON lattice_users (lower(email))
+    `);
+  },
+  down: async (client) => {
+    await client.query("DROP INDEX IF EXISTS idx_lattice_users_email_lower");
+  }
+};
+
+// src/migrations/oidc_provider_config_migration.ts
+var createOidcProviderConfigsTable = {
+  version: 211,
+  name: "create_oidc_provider_configs",
+  up: async (client) => {
+    await client.query(`
+      CREATE TABLE IF NOT EXISTS lattice_oidc_provider_configs (
+        id VARCHAR(64) PRIMARY KEY,
+        display_name TEXT NOT NULL,
+        issuer TEXT NOT NULL,
+        client_id TEXT NOT NULL,
+        client_secret TEXT NOT NULL,
+        scopes TEXT NOT NULL,
+        enabled BOOLEAN NOT NULL DEFAULT TRUE,
+        jit_provisioning BOOLEAN NOT NULL DEFAULT FALSE,
+        auto_link_email BOOLEAN NOT NULL DEFAULT FALSE,
+        default_tenant_id TEXT,
+        created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+        updated_at TIMESTAMPTZ NOT NULL DEFAULT NOW()
+      )
+    `);
+  },
+  down: async (client) => {
+    await client.query("DROP TABLE IF EXISTS lattice_oidc_provider_configs");
+  }
+};
+
+// src/migrations/platform_member_migration.ts
+var createPlatformMembersTable = {
+  version: 212,
+  name: "create_platform_members",
+  up: async (client) => {
+    await client.query(`
+      CREATE TABLE IF NOT EXISTS lattice_platform_members (
+        user_id VARCHAR(255) PRIMARY KEY,
+        role VARCHAR(16) NOT NULL,
+        granted_by VARCHAR(255),
+        granted_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+        updated_at TIMESTAMPTZ NOT NULL DEFAULT NOW()
+      )
+    `);
+  },
+  down: async (client) => {
+    await client.query("DROP TABLE IF EXISTS lattice_platform_members");
+  }
+};
+
+// src/migrations/platform_invitation_migration.ts
+var createPlatformInvitationsTable = {
+  version: 213,
+  name: "create_platform_invitations",
+  up: async (client) => {
+    await client.query(`
+      CREATE TABLE IF NOT EXISTS lattice_platform_invitations (
+        email VARCHAR(320) PRIMARY KEY,
+        role VARCHAR(16) NOT NULL,
+        invited_by VARCHAR(255),
+        created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+        expires_at TIMESTAMPTZ,
+        consumed_at TIMESTAMPTZ
+      )
+    `);
+  },
+  down: async (client) => {
+    await client.query("DROP TABLE IF EXISTS lattice_platform_invitations");
+  }
+};
+
+// src/migrations/oidc_identity_claim_migration.ts
+var createOidcIdentityClaimsTable = {
+  version: 214,
+  name: "create_oidc_identity_claims",
+  up: async (client) => {
+    await client.query(`
+      CREATE TABLE IF NOT EXISTS lattice_oidc_identity_claims (
+        id UUID PRIMARY KEY,
+        provider_id VARCHAR(64) NOT NULL,
+        issuer TEXT NOT NULL,
+        subject TEXT NOT NULL,
+        email VARCHAR(320) NOT NULL,
+        name TEXT,
+        picture TEXT,
+        status VARCHAR(16) NOT NULL,
+        created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+        updated_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+        expires_at TIMESTAMPTZ NOT NULL,
+        reviewed_by VARCHAR(255),
+        reviewed_at TIMESTAMPTZ,
+        linked_user_id VARCHAR(255)
+      )
+    `);
+    await client.query(`
+      CREATE UNIQUE INDEX IF NOT EXISTS lattice_oidc_identity_claims_pending_subject
+        ON lattice_oidc_identity_claims (provider_id, issuer, subject)
+        WHERE status = 'pending'
+    `);
+    await client.query(`
+      CREATE INDEX IF NOT EXISTS lattice_oidc_identity_claims_status_created
+        ON lattice_oidc_identity_claims (status, created_at)
+    `);
+  },
+  down: async (client) => {
+    await client.query("DROP TABLE IF EXISTS lattice_oidc_identity_claims");
+  }
+};
+
+// src/migrations/invite_link_migration.ts
+var createInviteLinksTable = {
+  version: 215,
+  name: "create_invite_links",
+  up: async (client) => {
+    await client.query(`
+      CREATE TABLE IF NOT EXISTS lattice_invite_links (
+        id UUID PRIMARY KEY,
+        scope VARCHAR(16) NOT NULL,
+        token_hash VARCHAR(64) NOT NULL UNIQUE,
+        token_encrypted TEXT NOT NULL,
+        email VARCHAR(320),
+        platform_role VARCHAR(16),
+        tenant_id VARCHAR(255),
+        tenant_role VARCHAR(16),
+        created_by VARCHAR(255),
+        created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+        updated_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+        expires_at TIMESTAMPTZ NOT NULL,
+        max_uses INTEGER NOT NULL,
+        used_count INTEGER NOT NULL DEFAULT 0,
+        revoked_at TIMESTAMPTZ
+      )
+    `);
+    await client.query(`
+      CREATE INDEX IF NOT EXISTS lattice_invite_links_created
+        ON lattice_invite_links (created_at DESC)
+    `);
+  },
+  down: async (client) => {
+    await client.query("DROP TABLE IF EXISTS lattice_invite_links");
+  }
+};
+
+// src/migrations/oidc_identity_claim_invite_migration.ts
+var addOidcIdentityClaimInviteFields = {
+  version: 216,
+  name: "add_oidc_identity_claim_invite_fields",
+  up: async (client) => {
+    await client.query(`
+      ALTER TABLE lattice_oidc_identity_claims
+        ADD COLUMN IF NOT EXISTS source VARCHAR(32),
+        ADD COLUMN IF NOT EXISTS invite_link_id UUID,
+        ADD COLUMN IF NOT EXISTS requested_user_id VARCHAR(255),
+        ADD COLUMN IF NOT EXISTS requested_platform_role VARCHAR(16),
+        ADD COLUMN IF NOT EXISTS requested_tenant_id VARCHAR(255),
+        ADD COLUMN IF NOT EXISTS requested_tenant_role VARCHAR(16)
+    `);
+  },
+  down: async (client) => {
+    await client.query(`
+      ALTER TABLE lattice_oidc_identity_claims
+        DROP COLUMN IF EXISTS source,
+        DROP COLUMN IF EXISTS invite_link_id,
+        DROP COLUMN IF EXISTS requested_user_id,
+        DROP COLUMN IF EXISTS requested_platform_role,
+        DROP COLUMN IF EXISTS requested_tenant_id,
+        DROP COLUMN IF EXISTS requested_tenant_role
+    `);
+  }
+};
+
+// src/migrations/platform_settings_migration.ts
+var createPlatformSettingsTable = {
+  version: 217,
+  name: "create_platform_settings",
+  up: async (client) => {
+    await client.query(`
+      CREATE TABLE IF NOT EXISTS lattice_platform_settings (
+        id VARCHAR(32) PRIMARY KEY,
+        document JSONB NOT NULL,
+        version INTEGER NOT NULL,
+        updated_by VARCHAR(255),
+        updated_at TIMESTAMPTZ NOT NULL DEFAULT NOW()
+      )
+    `);
+  },
+  down: async (client) => {
+    await client.query("DROP TABLE IF EXISTS lattice_platform_settings");
+  }
+};
+
+// src/migrations/oidc_provider_allowed_hosts_migration.ts
+var addOidcProviderAllowedHosts = {
+  version: 218,
+  name: "add_oidc_provider_allowed_hosts",
+  up: async (client) => {
+    await client.query(`
+      ALTER TABLE lattice_oidc_provider_configs
+      ADD COLUMN IF NOT EXISTS allowed_private_hosts JSONB
+    `);
+  },
+  down: async (client) => {
+    await client.query(`
+      ALTER TABLE lattice_oidc_provider_configs
+      DROP COLUMN IF EXISTS allowed_private_hosts
+    `);
+  }
+};
+
 // src/migrations/collection_migrations.ts
 var createCollectionsTable = {
   version: 137,
@@ -11144,7 +12080,7 @@ var PostgreSQLCapabilityBundleStore = class {
 function isValidDate(value) {
   return value instanceof Date && !Number.isNaN(value.getTime());
 }
-function mapRow2(row) {
+function mapRow8(row) {
   if (typeof row.id !== "string" || typeof row.tenant_id !== "string" || typeof row.workspace_id !== "string" || typeof row.project_id !== "string" || row.type !== "main" || typeof row.name !== "string" || !isValidDate(row.created_at) || !isValidDate(row.updated_at)) {
     throw new Error("Invalid project room row");
   }
@@ -11175,7 +12111,7 @@ var PostgreSQLProjectRoomStore = class {
        RETURNING id, tenant_id, workspace_id, project_id, type, name, created_at, updated_at`,
       [input.id, input.tenantId, input.workspaceId, input.projectId, "main", input.name]
     );
-    return mapRow2(result.rows[0]);
+    return mapRow8(result.rows[0]);
   }
   /** Finds a tenant-scoped project's main room, or returns null. */
   async getMainRoom(tenantId, projectId) {
@@ -11183,7 +12119,7 @@ var PostgreSQLProjectRoomStore = class {
       "SELECT id, tenant_id, workspace_id, project_id, type, name, created_at, updated_at FROM lattice_project_rooms WHERE tenant_id = $1 AND project_id = $2 AND type = 'main'",
       [tenantId, projectId]
     );
-    return result.rows[0] ? mapRow2(result.rows[0]) : null;
+    return result.rows[0] ? mapRow8(result.rows[0]) : null;
   }
 };
 
@@ -11209,7 +12145,7 @@ function isRole(value) {
 function isStatus2(value) {
   return value === "active" || value === "removed";
 }
-function mapRow3(row) {
+function mapRow9(row) {
   if (typeof row.id !== "string" || typeof row.tenant_id !== "string" || typeof row.project_id !== "string" || typeof row.user_id !== "string" || !isRole(row.role) || !isStatus2(row.status) || !isDate(row.joined_at) || !isDate(row.updated_at)) throw new Error("Invalid project membership row");
   return {
     id: row.id,
@@ -11230,7 +12166,7 @@ function mapDuplicate(error) {
   if (isDuplicate2(error)) throw new ProjectMembershipIdConflictError();
   throw error;
 }
-var columns = "id, tenant_id, project_id, user_id, role, status, joined_at, updated_at";
+var columns2 = "id, tenant_id, project_id, user_id, role, status, joined_at, updated_at";
 var PostgreSQLProjectMembershipStore = class {
   /** Creates a store using an externally managed pool; the pool is not migrated or closed. */
   constructor(options) {
@@ -11238,13 +12174,13 @@ var PostgreSQLProjectMembershipStore = class {
   }
   /** Lists memberships in stable joined-time and ID order. */
   async list(tenantId, projectId) {
-    const result = await this.pool.query(`SELECT ${columns} FROM lattice_project_memberships WHERE tenant_id = $1 AND project_id = $2 ORDER BY joined_at ASC, id ASC`, [tenantId, projectId]);
-    return result.rows.map(mapRow3);
+    const result = await this.pool.query(`SELECT ${columns2} FROM lattice_project_memberships WHERE tenant_id = $1 AND project_id = $2 ORDER BY joined_at ASC, id ASC`, [tenantId, projectId]);
+    return result.rows.map(mapRow9);
   }
   /** Finds a membership by exact tenant, project, and user identity. */
   async findByUser(tenantId, projectId, userId) {
-    const result = await this.pool.query(`SELECT ${columns} FROM lattice_project_memberships WHERE tenant_id = $1 AND project_id = $2 AND user_id = $3`, [tenantId, projectId, userId]);
-    return result.rows[0] ? mapRow3(result.rows[0]) : null;
+    const result = await this.pool.query(`SELECT ${columns2} FROM lattice_project_memberships WHERE tenant_id = $1 AND project_id = $2 AND user_id = $3`, [tenantId, projectId, userId]);
+    return result.rows[0] ? mapRow9(result.rows[0]) : null;
   }
   /** Inserts a membership and maps database uniqueness errors to stable typed errors. */
   async create(input) {
@@ -11252,8 +12188,8 @@ var PostgreSQLProjectMembershipStore = class {
     try {
       await client.query("BEGIN");
       await client.query("SELECT pg_advisory_xact_lock(hashtextextended($1, 0))", [`${input.tenantId}:${input.projectId}`]);
-      const result = await client.query(`INSERT INTO lattice_project_memberships (id, tenant_id, project_id, user_id, role, status, joined_at, updated_at) VALUES ($1, $2, $3, $4, $5, $6, date_trunc('milliseconds', clock_timestamp()), date_trunc('milliseconds', clock_timestamp())) RETURNING ${columns}`, [input.id, input.tenantId, input.projectId, input.userId, input.role, input.status]);
-      const membership = mapRow3(result.rows[0]);
+      const result = await client.query(`INSERT INTO lattice_project_memberships (id, tenant_id, project_id, user_id, role, status, joined_at, updated_at) VALUES ($1, $2, $3, $4, $5, $6, date_trunc('milliseconds', clock_timestamp()), date_trunc('milliseconds', clock_timestamp())) RETURNING ${columns2}`, [input.id, input.tenantId, input.projectId, input.userId, input.role, input.status]);
+      const membership = mapRow9(result.rows[0]);
       await client.query("COMMIT");
       return membership;
     } catch (error) {
@@ -11272,16 +12208,16 @@ var PostgreSQLProjectMembershipStore = class {
     try {
       await client.query("BEGIN");
       await client.query("SELECT pg_advisory_xact_lock(hashtextextended($1, 0))", [`${input.tenantId}:${input.projectId}`]);
-      const existingResult = await client.query(`SELECT ${columns} FROM lattice_project_memberships WHERE tenant_id = $1 AND project_id = $2 FOR UPDATE`, [input.tenantId, input.projectId]);
+      const existingResult = await client.query(`SELECT ${columns2} FROM lattice_project_memberships WHERE tenant_id = $1 AND project_id = $2 FOR UPDATE`, [input.tenantId, input.projectId]);
       if (existingResult.rows.length > 0) {
-        const existing = existingResult.rows.map(mapRow3).find((item) => item.userId === input.userId && item.role === "owner" && item.status === "active");
+        const existing = existingResult.rows.map(mapRow9).find((item) => item.userId === input.userId && item.role === "owner" && item.status === "active");
         await client.query("COMMIT");
         return existing ? { kind: "existing", membership: existing } : { kind: "already_initialized" };
       }
       const idResult = await client.query("SELECT id FROM lattice_project_memberships WHERE tenant_id = $1 AND id = $2", [input.tenantId, input.id]);
       if (idResult.rows.length > 0) throw new ProjectMembershipIdConflictError();
-      const inserted = await client.query(`INSERT INTO lattice_project_memberships (id, tenant_id, project_id, user_id, role, status, joined_at, updated_at) VALUES ($1, $2, $3, $4, 'owner', 'active', date_trunc('milliseconds', clock_timestamp()), date_trunc('milliseconds', clock_timestamp())) RETURNING ${columns}`, [input.id, input.tenantId, input.projectId, input.userId]);
-      const membership = mapRow3(inserted.rows[0]);
+      const inserted = await client.query(`INSERT INTO lattice_project_memberships (id, tenant_id, project_id, user_id, role, status, joined_at, updated_at) VALUES ($1, $2, $3, $4, 'owner', 'active', date_trunc('milliseconds', clock_timestamp()), date_trunc('milliseconds', clock_timestamp())) RETURNING ${columns2}`, [input.id, input.tenantId, input.projectId, input.userId]);
+      const membership = mapRow9(inserted.rows[0]);
       await client.query("COMMIT");
       return { kind: "created", membership };
     } catch (error) {
@@ -11313,16 +12249,16 @@ var PostgreSQLProjectMembershipStore = class {
         return { kind: "not_found" };
       }
       await client.query("SELECT pg_advisory_xact_lock(hashtextextended($1, 0))", [`${tenantId}:${identity.rows[0].project_id}`]);
-      const activeRows = await client.query(`SELECT ${columns} FROM lattice_project_memberships WHERE tenant_id = $1 AND project_id = $2 AND status = 'active' FOR UPDATE`, [tenantId, identity.rows[0].project_id]);
-      const lockedMemberships = activeRows.rows.map(mapRow3);
+      const activeRows = await client.query(`SELECT ${columns2} FROM lattice_project_memberships WHERE tenant_id = $1 AND project_id = $2 AND status = 'active' FOR UPDATE`, [tenantId, identity.rows[0].project_id]);
+      const lockedMemberships = activeRows.rows.map(mapRow9);
       let current = lockedMemberships.find((membership) => membership.id === id);
       if (!current) {
-        const target = await client.query(`SELECT ${columns} FROM lattice_project_memberships WHERE tenant_id = $1 AND id = $2 FOR UPDATE`, [tenantId, id]);
+        const target = await client.query(`SELECT ${columns2} FROM lattice_project_memberships WHERE tenant_id = $1 AND id = $2 FOR UPDATE`, [tenantId, id]);
         if (!target.rows[0]) {
           await client.query("COMMIT");
           return { kind: "not_found" };
         }
-        current = mapRow3(target.rows[0]);
+        current = mapRow9(target.rows[0]);
       }
       if (current.updatedAt.getTime() !== expected.getTime()) {
         await client.query("COMMIT");
@@ -11335,13 +12271,13 @@ var PostgreSQLProjectMembershipStore = class {
           return { kind: "last_owner" };
         }
       }
-      const result = await client.query(remove ? `UPDATE lattice_project_memberships SET status = 'removed', updated_at = GREATEST(date_trunc('milliseconds', updated_at) + interval '1 millisecond', date_trunc('milliseconds', clock_timestamp())) WHERE tenant_id = $1 AND id = $2 AND date_trunc('milliseconds', updated_at) = $3 RETURNING ${columns}` : `UPDATE lattice_project_memberships SET role = $4, updated_at = GREATEST(date_trunc('milliseconds', updated_at) + interval '1 millisecond', date_trunc('milliseconds', clock_timestamp())) WHERE tenant_id = $1 AND id = $2 AND date_trunc('milliseconds', updated_at) = $3 RETURNING ${columns}`, remove ? [tenantId, id, expected] : [tenantId, id, expected, role]);
+      const result = await client.query(remove ? `UPDATE lattice_project_memberships SET status = 'removed', updated_at = GREATEST(date_trunc('milliseconds', updated_at) + interval '1 millisecond', date_trunc('milliseconds', clock_timestamp())) WHERE tenant_id = $1 AND id = $2 AND date_trunc('milliseconds', updated_at) = $3 RETURNING ${columns2}` : `UPDATE lattice_project_memberships SET role = $4, updated_at = GREATEST(date_trunc('milliseconds', updated_at) + interval '1 millisecond', date_trunc('milliseconds', clock_timestamp())) WHERE tenant_id = $1 AND id = $2 AND date_trunc('milliseconds', updated_at) = $3 RETURNING ${columns2}`, remove ? [tenantId, id, expected] : [tenantId, id, expected, role]);
       if (!result.rows[0]) {
         await client.query("COMMIT");
         return { kind: "conflict" };
       }
       await client.query("COMMIT");
-      return { kind: remove ? "removed" : "updated", membership: mapRow3(result.rows[0]) };
+      return { kind: remove ? "removed" : "updated", membership: mapRow9(result.rows[0]) };
     } catch (error) {
       try {
         await client.query("ROLLBACK");
@@ -11355,7 +12291,7 @@ var PostgreSQLProjectMembershipStore = class {
 };
 
 // src/stores/PostgreSQLProjectBotMembershipStore.ts
-var columns2 = "id, tenant_id, workspace_id, project_id, room_id, assistant_id, role, title, responsibility, mention_name, status, room_thread_id, joined_at, updated_at";
+var columns3 = "id, tenant_id, workspace_id, project_id, room_id, assistant_id, role, title, responsibility, mention_name, status, room_thread_id, joined_at, updated_at";
 var ProjectBotMembershipIdConflictError = class extends Error {
   /** Creates an accurate tenant-scoped membership ID collision error. */
   constructor(tenantId, id) {
@@ -11372,7 +12308,7 @@ function isRole2(value) {
 function isStatus3(value) {
   return value === "active" || value === "paused" || value === "removed";
 }
-function mapRow4(row) {
+function mapRow10(row) {
   if (typeof row.id !== "string" || typeof row.tenant_id !== "string" || typeof row.workspace_id !== "string" || typeof row.project_id !== "string" || typeof row.room_id !== "string" || typeof row.assistant_id !== "string" || !isRole2(row.role) || typeof row.title !== "string" || row.responsibility !== null && typeof row.responsibility !== "string" || typeof row.mention_name !== "string" || !isStatus3(row.status) || typeof row.room_thread_id !== "string" || !isDate2(row.joined_at) || !isDate2(row.updated_at)) {
     throw new Error("Invalid project bot membership row");
   }
@@ -11393,11 +12329,11 @@ function mapRow4(row) {
     updatedAt: row.updated_at
   };
 }
-function isUniqueViolation(error) {
+function isUniqueViolation3(error) {
   return typeof error === "object" && error !== null && "code" in error && error.code === "23505";
 }
 function constraintConflict(error) {
-  if (!isUniqueViolation(error) || typeof error.constraint !== "string") return void 0;
+  if (!isUniqueViolation3(error) || typeof error.constraint !== "string") return void 0;
   if (error.constraint === "uq_lattice_project_bot_memberships_coordinator") return "coordinator_conflict";
   if (error.constraint === "uq_lattice_project_bot_memberships_mention") return "mention_conflict";
   return void 0;
@@ -11416,26 +12352,26 @@ var PostgreSQLProjectBotMembershipStore = class {
   /** Lists retained memberships in stable join order. */
   async list(tenantId, projectId) {
     const result = await this.pool.query(
-      `SELECT ${columns2} FROM lattice_project_bot_memberships WHERE tenant_id = $1 AND project_id = $2 ORDER BY joined_at ASC, id ASC`,
+      `SELECT ${columns3} FROM lattice_project_bot_memberships WHERE tenant_id = $1 AND project_id = $2 ORDER BY joined_at ASC, id ASC`,
       [tenantId, projectId]
     );
-    return result.rows.map(mapRow4);
+    return result.rows.map(mapRow10);
   }
   /** Finds a membership by tenant-scoped ID. */
   async findById(tenantId, id) {
     const result = await this.pool.query(
-      `SELECT ${columns2} FROM lattice_project_bot_memberships WHERE tenant_id = $1 AND id = $2`,
+      `SELECT ${columns3} FROM lattice_project_bot_memberships WHERE tenant_id = $1 AND id = $2`,
       [tenantId, id]
     );
-    return result.rows[0] ? mapRow4(result.rows[0]) : null;
+    return result.rows[0] ? mapRow10(result.rows[0]) : null;
   }
   /** Finds an assistant's durable membership in a tenant-scoped project. */
   async findByAssistant(tenantId, projectId, assistantId) {
     const result = await this.pool.query(
-      `SELECT ${columns2} FROM lattice_project_bot_memberships WHERE tenant_id = $1 AND project_id = $2 AND assistant_id = $3`,
+      `SELECT ${columns3} FROM lattice_project_bot_memberships WHERE tenant_id = $1 AND project_id = $2 AND assistant_id = $3`,
       [tenantId, projectId, assistantId]
     );
-    return result.rows[0] ? mapRow4(result.rows[0]) : null;
+    return result.rows[0] ? mapRow10(result.rows[0]) : null;
   }
   /** Inserts a new membership or reactivates the assistant's durable membership atomically. */
   async save(input) {
@@ -11444,17 +12380,17 @@ var PostgreSQLProjectBotMembershipStore = class {
       await client.query("BEGIN");
       await client.query("SELECT pg_advisory_xact_lock(hashtextextended($1, 0))", [`${input.tenantId}:${input.projectId}`]);
       const existingResult = await client.query(
-        `SELECT ${columns2} FROM lattice_project_bot_memberships WHERE tenant_id = $1 AND project_id = $2 AND assistant_id = $3 FOR UPDATE`,
+        `SELECT ${columns3} FROM lattice_project_bot_memberships WHERE tenant_id = $1 AND project_id = $2 AND assistant_id = $3 FOR UPDATE`,
         [input.tenantId, input.projectId, input.assistantId]
       );
-      const existing = existingResult.rows[0] ? mapRow4(existingResult.rows[0]) : void 0;
+      const existing = existingResult.rows[0] ? mapRow10(existingResult.rows[0]) : void 0;
       let result;
       if (existing) {
         result = await client.query(
           `UPDATE lattice_project_bot_memberships
            SET role = $3, title = $4, responsibility = $5, mention_name = $6, status = 'active',
                updated_at = GREATEST(date_trunc('milliseconds', updated_at) + interval '1 millisecond', date_trunc('milliseconds', clock_timestamp()))
-           WHERE tenant_id = $1 AND id = $2 RETURNING ${columns2}`,
+           WHERE tenant_id = $1 AND id = $2 RETURNING ${columns3}`,
           [input.tenantId, existing.id, input.role, input.title, input.responsibility ?? null, input.mentionName]
         );
       } else {
@@ -11467,7 +12403,7 @@ var PostgreSQLProjectBotMembershipStore = class {
           `INSERT INTO lattice_project_bot_memberships
            (id, tenant_id, workspace_id, project_id, room_id, assistant_id, role, title, responsibility, mention_name, status, room_thread_id, joined_at, updated_at)
            VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, 'active', $11, date_trunc('milliseconds', clock_timestamp()), date_trunc('milliseconds', clock_timestamp()))
-           RETURNING ${columns2}`,
+           RETURNING ${columns3}`,
           [
             input.id,
             input.tenantId,
@@ -11483,14 +12419,14 @@ var PostgreSQLProjectBotMembershipStore = class {
           ]
         );
       }
-      const membership = mapRow4(result.rows[0]);
+      const membership = mapRow10(result.rows[0]);
       await client.query("COMMIT");
       return { kind: existing === void 0 ? "created" : existing.status === "removed" ? "reactivated" : "updated", membership };
     } catch (error) {
       await rollback(client);
       const conflict = constraintConflict(error);
       if (conflict) return { kind: conflict };
-      if (isUniqueViolation(error) && error.constraint === "lattice_project_bot_memberships_pkey") {
+      if (isUniqueViolation3(error) && error.constraint === "lattice_project_bot_memberships_pkey") {
         throw new ProjectBotMembershipIdConflictError(input.tenantId, input.id);
       }
       throw error;
@@ -11514,14 +12450,14 @@ var PostgreSQLProjectBotMembershipStore = class {
       if (typeof identity.rows[0].project_id !== "string") throw new Error("Invalid project bot membership row");
       await client.query("SELECT pg_advisory_xact_lock(hashtextextended($1, 0))", [`${input.tenantId}:${identity.rows[0].project_id}`]);
       const locked = await client.query(
-        `SELECT ${columns2} FROM lattice_project_bot_memberships WHERE tenant_id = $1 AND id = $2 FOR UPDATE`,
+        `SELECT ${columns3} FROM lattice_project_bot_memberships WHERE tenant_id = $1 AND id = $2 FOR UPDATE`,
         [input.tenantId, input.id]
       );
       if (!locked.rows[0]) {
         await client.query("COMMIT");
         return { kind: "not_found" };
       }
-      const existing = mapRow4(locked.rows[0]);
+      const existing = mapRow10(locked.rows[0]);
       if (existing.updatedAt.getTime() !== input.expectedUpdatedAt.getTime()) {
         await client.query("COMMIT");
         return { kind: "conflict" };
@@ -11532,7 +12468,7 @@ var PostgreSQLProjectBotMembershipStore = class {
          SET role = $4, title = $5, responsibility = $6, mention_name = $7, status = $8,
              updated_at = GREATEST(date_trunc('milliseconds', updated_at) + interval '1 millisecond', date_trunc('milliseconds', clock_timestamp()))
          WHERE tenant_id = $1 AND id = $2 AND date_trunc('milliseconds', updated_at) = $3
-         RETURNING ${columns2}`,
+         RETURNING ${columns3}`,
         [
           input.tenantId,
           input.id,
@@ -11548,7 +12484,7 @@ var PostgreSQLProjectBotMembershipStore = class {
         await client.query("COMMIT");
         return { kind: "conflict" };
       }
-      const membership = mapRow4(updated.rows[0]);
+      const membership = mapRow10(updated.rows[0]);
       await client.query("COMMIT");
       return { kind: "updated", membership };
     } catch (error) {
@@ -11563,7 +12499,7 @@ var PostgreSQLProjectBotMembershipStore = class {
 };
 
 // src/stores/PostgreSQLProjectRoomMessageStore.ts
-var columns3 = "id, tenant_id, workspace_id, project_id, room_id, author, content, mentions, reply_to_message_id, source, source_id, idempotency_key, created_at";
+var columns4 = "id, tenant_id, workspace_id, project_id, room_id, author, content, mentions, reply_to_message_id, source, source_id, idempotency_key, created_at";
 var ProjectRoomMessageIdConflictError = class extends Error {
   /** Creates an accurate tenant-scoped message ID collision error. */
   constructor(tenantId, id) {
@@ -11604,7 +12540,7 @@ function mapMention(value) {
 function isSource(value) {
   return value === "user" || value === "agent" || value === "task" || value === "routine" || value === "system";
 }
-function mapRow5(row) {
+function mapRow11(row) {
   const author = mapAuthor(row.author);
   const content = isRecord4(row.content) && row.content.type === "text" && typeof row.content.text === "string" && hasOnlyKeys(row.content, ["type", "text"]) ? { type: "text", text: row.content.text } : void 0;
   const mentions = Array.isArray(row.mentions) ? row.mentions.map(mapMention) : void 0;
@@ -11631,7 +12567,7 @@ function mapRowsTolerant(rows, scope) {
   const messages = [];
   for (const row of rows) {
     try {
-      messages.push(mapRow5(row));
+      messages.push(mapRow11(row));
     } catch (error) {
       console.warn("[ProjectRoomMessageStore] Skipping invalid message row", {
         tenantId: scope.tenantId,
@@ -11643,7 +12579,7 @@ function mapRowsTolerant(rows, scope) {
   }
   return messages;
 }
-function isUniqueViolation2(error) {
+function isUniqueViolation4(error) {
   return typeof error === "object" && error !== null && "code" in error && error.code === "23505";
 }
 var PostgreSQLProjectRoomMessageStore = class {
@@ -11658,15 +12594,15 @@ var PostgreSQLProjectRoomMessageStore = class {
         `INSERT INTO lattice_project_room_messages
          (id, tenant_id, workspace_id, project_id, room_id, author, content, mentions, reply_to_message_id, source, source_id, idempotency_key, created_at)
          VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, date_trunc('milliseconds', clock_timestamp()))
-         RETURNING ${columns3}`,
+         RETURNING ${columns4}`,
         this.parameters(input)
       );
-      return mapRow5(result.rows[0]);
+      return mapRow11(result.rows[0]);
     } catch (error) {
-      if (isUniqueViolation2(error) && error.constraint === "lattice_project_room_messages_pkey") {
+      if (isUniqueViolation4(error) && error.constraint === "lattice_project_room_messages_pkey") {
         throw new ProjectRoomMessageIdConflictError(input.tenantId, input.id);
       }
-      if (isUniqueViolation2(error) && error.constraint === "uq_lattice_project_room_messages_idempotency") {
+      if (isUniqueViolation4(error) && error.constraint === "uq_lattice_project_room_messages_idempotency") {
         throw new DuplicateProjectRoomMessageIdempotencyKeyError(input.tenantId, input.roomId, input.idempotencyKey ?? "");
       }
       throw error;
@@ -11681,12 +12617,12 @@ var PostgreSQLProjectRoomMessageStore = class {
          VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, date_trunc('milliseconds', clock_timestamp()))
          ON CONFLICT (tenant_id, room_id, idempotency_key) WHERE idempotency_key IS NOT NULL
          DO UPDATE SET idempotency_key = lattice_project_room_messages.idempotency_key
-         RETURNING ${columns3}`,
+         RETURNING ${columns4}`,
         this.parameters(input)
       );
-      return mapRow5(result.rows[0]);
+      return mapRow11(result.rows[0]);
     } catch (error) {
-      if (isUniqueViolation2(error) && error.constraint === "lattice_project_room_messages_pkey") {
+      if (isUniqueViolation4(error) && error.constraint === "lattice_project_room_messages_pkey") {
         throw new ProjectRoomMessageIdConflictError(input.tenantId, input.id);
       }
       throw error;
@@ -11699,12 +12635,12 @@ var PostgreSQLProjectRoomMessageStore = class {
     }
     const limit = Math.min(100, Math.max(1, Math.trunc(Number.isFinite(input.limit) ? input.limit : 1)));
     const result = input.before ? await this.pool.query(
-      `SELECT ${columns3} FROM lattice_project_room_messages
+      `SELECT ${columns4} FROM lattice_project_room_messages
          WHERE tenant_id = $1 AND room_id = $2 AND (created_at < $3 OR (created_at = $3 AND id < $4))
          ORDER BY created_at DESC, id DESC LIMIT $5`,
       [input.tenantId, input.roomId, input.before.createdAt, input.before.id, limit]
     ) : await this.pool.query(
-      `SELECT ${columns3} FROM lattice_project_room_messages
+      `SELECT ${columns4} FROM lattice_project_room_messages
          WHERE tenant_id = $1 AND room_id = $2 ORDER BY created_at DESC, id DESC LIMIT $3`,
       [input.tenantId, input.roomId, limit]
     );
@@ -11713,10 +12649,10 @@ var PostgreSQLProjectRoomMessageStore = class {
   /** Finds a message by tenant-scoped ID. */
   async findById(tenantId, id) {
     const result = await this.pool.query(
-      `SELECT ${columns3} FROM lattice_project_room_messages WHERE tenant_id = $1 AND id = $2`,
+      `SELECT ${columns4} FROM lattice_project_room_messages WHERE tenant_id = $1 AND id = $2`,
       [tenantId, id]
     );
-    return result.rows[0] ? mapRow5(result.rows[0]) : null;
+    return result.rows[0] ? mapRow11(result.rows[0]) : null;
   }
   /** Counts messages created strictly after a horizon, optionally excluding one human author. */
   async countAfter(input) {
@@ -11774,7 +12710,7 @@ var PostgreSQLProjectRoomMessageStore = class {
 };
 
 // src/stores/PostgreSQLProjectRoomReadStateStore.ts
-function mapRow6(row) {
+function mapRow12(row) {
   if (typeof row.tenant_id !== "string" || typeof row.room_id !== "string" || typeof row.user_id !== "string" || !(row.last_read_at instanceof Date) || Number.isNaN(row.last_read_at.getTime()) || !(row.updated_at instanceof Date) || Number.isNaN(row.updated_at.getTime())) {
     throw new Error("Invalid project room read state row");
   }
@@ -11792,7 +12728,7 @@ var PostgreSQLProjectRoomReadStateStore = class {
        FROM lattice_project_room_read_states WHERE tenant_id = $1 AND room_id = $2 AND user_id = $3`,
       [tenantId, roomId, userId]
     );
-    return result.rows[0] ? mapRow6(result.rows[0]) : null;
+    return result.rows[0] ? mapRow12(result.rows[0]) : null;
   }
   /** Upserts the marker monotonically using GREATEST so older reports never regress it. */
   async markRead(input) {
@@ -11808,14 +12744,14 @@ var PostgreSQLProjectRoomReadStateStore = class {
        RETURNING tenant_id, room_id, user_id, last_read_at, updated_at`,
       [input.tenantId, input.roomId, input.userId, input.lastReadAt]
     );
-    return mapRow6(result.rows[0]);
+    return mapRow12(result.rows[0]);
   }
 };
 
 // src/stores/PostgreSQLUserPushSubscriptionStore.ts
 import { randomUUID as randomUUID5 } from "crypto";
-var columns4 = "id, tenant_id, user_id, endpoint, p256dh, auth, user_agent, created_at";
-function mapRow7(row) {
+var columns5 = "id, tenant_id, user_id, endpoint, p256dh, auth, user_agent, created_at";
+function mapRow13(row) {
   if (typeof row.id !== "string" || typeof row.tenant_id !== "string" || typeof row.user_id !== "string" || typeof row.endpoint !== "string" || typeof row.p256dh !== "string" || typeof row.auth !== "string" || !(row.created_at instanceof Date) || Number.isNaN(row.created_at.getTime())) {
     throw new Error("Invalid user push subscription row");
   }
@@ -11837,22 +12773,22 @@ var PostgreSQLUserPushSubscriptionStore = class {
   /** Lists every subscription for a user. */
   async list(tenantId, userId) {
     const result = await this.pool.query(
-      `SELECT ${columns4} FROM lattice_user_push_subscriptions WHERE tenant_id = $1 AND user_id = $2`,
+      `SELECT ${columns5} FROM lattice_user_push_subscriptions WHERE tenant_id = $1 AND user_id = $2`,
       [tenantId, userId]
     );
-    return result.rows.map(mapRow7);
+    return result.rows.map(mapRow13);
   }
   /** Upserts a subscription keyed by tenant + user + endpoint. */
   async save(input) {
     const result = await this.pool.query(
-      `INSERT INTO lattice_user_push_subscriptions (${columns4})
+      `INSERT INTO lattice_user_push_subscriptions (${columns5})
        VALUES ($1, $2, $3, $4, $5, $6, $7, NOW())
        ON CONFLICT (tenant_id, user_id, endpoint) DO UPDATE
          SET p256dh = EXCLUDED.p256dh, auth = EXCLUDED.auth, user_agent = EXCLUDED.user_agent
-       RETURNING ${columns4}`,
+       RETURNING ${columns5}`,
       [randomUUID5(), input.tenantId, input.userId, input.endpoint, input.keys.p256dh, input.keys.auth, input.userAgent ?? null]
     );
-    return mapRow7(result.rows[0]);
+    return mapRow13(result.rows[0]);
   }
   /** Deletes one subscription by endpoint. */
   async delete(tenantId, userId, endpoint) {
@@ -11866,7 +12802,7 @@ var PostgreSQLUserPushSubscriptionStore = class {
 
 // src/stores/PostgreSQLModelProviderStore.ts
 import { Pool as Pool27 } from "pg";
-import { encrypt as encrypt7, safeDecrypt as safeDecrypt6 } from "@axiom-lattice/core";
+import { encrypt as encrypt9, safeDecrypt as safeDecrypt8 } from "@axiom-lattice/core";
 function extraOrUndefined(value) {
   return value && Object.keys(value).length > 0 ? value : void 0;
 }
@@ -11990,7 +12926,7 @@ var PostgreSQLModelProviderStore = class {
     await this.ensureInitialized();
     const now = /* @__PURE__ */ new Date();
     const nowString = now.toISOString();
-    const apiKeyEnc = data.apiKey ? encrypt7(data.apiKey) : null;
+    const apiKeyEnc = data.apiKey ? encrypt9(data.apiKey) : null;
     const apiKeyHint = data.apiKey ? data.apiKey.slice(-4) : null;
     await this.pool.query(
       `
@@ -12066,7 +13002,7 @@ var PostgreSQLModelProviderStore = class {
       updateData.api_key_enc = null;
       updateData.api_key_hint = null;
     } else if (updates.apiKey) {
-      updateData.api_key_enc = encrypt7(updates.apiKey);
+      updateData.api_key_enc = encrypt9(updates.apiKey);
       updateData.api_key_hint = updates.apiKey.slice(-4);
     }
     if (updates.enabled !== void 0) {
@@ -12386,7 +13322,7 @@ var PostgreSQLModelProviderStore = class {
   mapRowToEntry(row) {
     let apiKey;
     if (row.api_key_enc) {
-      apiKey = safeDecrypt6(row.api_key_enc);
+      apiKey = safeDecrypt8(row.api_key_enc);
     }
     return {
       id: row.id,
@@ -12639,7 +13575,7 @@ var PostgreSQLOutboxStore = class {
 };
 
 // src/stores/PostgreSQLPluginDeploymentStore.ts
-var columns5 = "id, tenant_id, plugin_type, plugin_version, mode, status, provider, sandbox_name, port, endpoint, image_ref, idle_timeout_ms, last_health_at, last_error, created_at, updated_at";
+var columns6 = "id, tenant_id, plugin_type, plugin_version, mode, status, provider, sandbox_name, port, endpoint, image_ref, idle_timeout_ms, last_health_at, last_error, created_at, updated_at";
 var statuses = [
   "requested",
   "provisioning",
@@ -12652,7 +13588,7 @@ var statuses = [
 function isStatus4(value) {
   return typeof value === "string" && statuses.includes(value);
 }
-function mapRow8(row) {
+function mapRow14(row) {
   if (typeof row.id !== "string" || typeof row.tenant_id !== "string" || typeof row.plugin_type !== "string" || typeof row.plugin_version !== "string" || row.mode !== "onDemand" && row.mode !== "alwaysOn" || !isStatus4(row.status) || typeof row.provider !== "string" || typeof row.sandbox_name !== "string" || typeof row.port !== "number" || typeof row.idle_timeout_ms !== "number" || !(row.created_at instanceof Date) || Number.isNaN(row.created_at.getTime()) || !(row.updated_at instanceof Date) || Number.isNaN(row.updated_at.getTime())) {
     throw new Error("Invalid plugin deployment row");
   }
@@ -12683,23 +13619,23 @@ var PostgreSQLPluginDeploymentStore = class {
   /** Lists every deployment for a tenant, ordered by plugin type. */
   async listByTenant(tenantId) {
     const result = await this.pool.query(
-      `SELECT ${columns5} FROM lattice_plugin_deployments WHERE tenant_id = $1 ORDER BY plugin_type`,
+      `SELECT ${columns6} FROM lattice_plugin_deployments WHERE tenant_id = $1 ORDER BY plugin_type`,
       [tenantId]
     );
-    return result.rows.map(mapRow8);
+    return result.rows.map(mapRow14);
   }
   /** Returns the deployment for a tenant + plugin type, or undefined. */
   async get(tenantId, pluginType) {
     const result = await this.pool.query(
-      `SELECT ${columns5} FROM lattice_plugin_deployments WHERE tenant_id = $1 AND plugin_type = $2`,
+      `SELECT ${columns6} FROM lattice_plugin_deployments WHERE tenant_id = $1 AND plugin_type = $2`,
       [tenantId, pluginType]
     );
-    return result.rows[0] ? mapRow8(result.rows[0]) : void 0;
+    return result.rows[0] ? mapRow14(result.rows[0]) : void 0;
   }
   /** Upserts a deployment keyed by tenant + plugin type, preserving the original id and createdAt. */
   async upsert(deployment) {
     const result = await this.pool.query(
-      `INSERT INTO lattice_plugin_deployments (${columns5})
+      `INSERT INTO lattice_plugin_deployments (${columns6})
        VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14, $15, $16)
        ON CONFLICT (tenant_id, plugin_type) DO UPDATE SET
          plugin_version = EXCLUDED.plugin_version,
@@ -12714,7 +13650,7 @@ var PostgreSQLPluginDeploymentStore = class {
          last_health_at = EXCLUDED.last_health_at,
          last_error = EXCLUDED.last_error,
          updated_at = NOW()
-       RETURNING ${columns5}`,
+       RETURNING ${columns6}`,
       [
         deployment.id,
         deployment.tenantId,
@@ -12734,7 +13670,7 @@ var PostgreSQLPluginDeploymentStore = class {
         new Date(deployment.updatedAt)
       ]
     );
-    return mapRow8(result.rows[0]);
+    return mapRow14(result.rows[0]);
   }
   /** Applies a partial update to mutable columns; returns undefined when no row exists. */
   async updateStatus(tenantId, pluginType, patch) {
@@ -12762,10 +13698,10 @@ var PostgreSQLPluginDeploymentStore = class {
     const result = await this.pool.query(
       `UPDATE lattice_plugin_deployments SET ${assignments.join(", ")}
        WHERE tenant_id = $${tenantParam} AND plugin_type = $${pluginParam}
-       RETURNING ${columns5}`,
+       RETURNING ${columns6}`,
       params
     );
-    return result.rows[0] ? mapRow8(result.rows[0]) : void 0;
+    return result.rows[0] ? mapRow14(result.rows[0]) : void 0;
   }
   /** Deletes a deployment by tenant + plugin type; returns whether a row was removed. */
   async delete(tenantId, pluginType) {
@@ -13730,6 +14666,79 @@ function isActiveRunViolation(error) {
   return code === "23505" && constraint === "uq_lattice_agent_runs_one_running";
 }
 
+// src/stores/PostgreSQLPlatformSettingsStore.ts
+import {
+  PlatformSettingsVersionConflictError
+} from "@axiom-lattice/protocols";
+var TABLE7 = "lattice_platform_settings";
+var SETTINGS_ID = "default";
+var COLUMNS = "id, document, version, updated_by, updated_at";
+function normalizeUpdatedBy(updatedBy) {
+  const trimmed = updatedBy?.trim();
+  return trimmed ? trimmed : null;
+}
+function mapRow15(row) {
+  return {
+    ...row.document,
+    version: Number(row.version),
+    ...row.updated_by !== null ? { updatedBy: row.updated_by } : {},
+    updatedAt: row.updated_at
+  };
+}
+var PostgreSQLPlatformSettingsStore = class {
+  constructor(options) {
+    this.options = options;
+  }
+  get pool() {
+    return this.options.pool;
+  }
+  async get() {
+    const result = await this.pool.query(
+      `SELECT ${COLUMNS} FROM ${TABLE7} WHERE id = $1`,
+      [SETTINGS_ID]
+    );
+    return result.rows[0] ? mapRow15(result.rows[0]) : null;
+  }
+  async save(document, expectedVersion, updatedBy) {
+    const version = expectedVersion + 1;
+    const result = expectedVersion === 0 ? await this.pool.query(
+      `INSERT INTO ${TABLE7} (id, document, version, updated_by, updated_at)
+             VALUES ($1, $2::jsonb, $3, $4, NOW())
+             ON CONFLICT (id) DO NOTHING
+             RETURNING ${COLUMNS}`,
+      [
+        SETTINGS_ID,
+        JSON.stringify(document),
+        version,
+        normalizeUpdatedBy(updatedBy)
+      ]
+    ) : await this.pool.query(
+      `UPDATE ${TABLE7}
+             SET document = $2::jsonb, version = $3, updated_by = $4, updated_at = NOW()
+             WHERE id = $1 AND version = $5
+             RETURNING ${COLUMNS}`,
+      [
+        SETTINGS_ID,
+        JSON.stringify(document),
+        version,
+        normalizeUpdatedBy(updatedBy),
+        expectedVersion
+      ]
+    );
+    if (result.rows[0]) {
+      return mapRow15(result.rows[0]);
+    }
+    const actual = await this.pool.query(
+      `SELECT version FROM ${TABLE7} WHERE id = $1`,
+      [SETTINGS_ID]
+    );
+    throw new PlatformSettingsVersionConflictError(
+      expectedVersion,
+      actual.rows[0] ? Number(actual.rows[0].version) : 0
+    );
+  }
+};
+
 // src/stores/PostgreSQLChannelReplyJobStore.ts
 import { Pool as Pool31 } from "pg";
 import {
@@ -13737,7 +14746,7 @@ import {
   normalizeChannelReplyJobListLimit
 } from "@axiom-lattice/protocols";
 var DB_CLOCK_MS2 = "FLOOR(EXTRACT(EPOCH FROM clock_timestamp()) * 1000)::bigint";
-var COLUMNS = `run_id, tenant_id, assistant_id, thread_id, adapter_channel,
+var COLUMNS2 = `run_id, tenant_id, assistant_id, thread_id, adapter_channel,
   channel_installation_id, reply_target, input_message_id, stream_cursor, status,
   attempts, available_at, lease_owner, lease_expires_at, last_error,
   output_message_id, created_at, updated_at, delivered_at`;
@@ -13755,7 +14764,7 @@ function toStatus(value) {
   }
   throw new Error(`Invalid channel reply job status: ${value}`);
 }
-function mapRow9(row) {
+function mapRow16(row) {
   return {
     runId: row.run_id,
     tenantId: row.tenant_id,
@@ -13841,7 +14850,7 @@ var PostgreSQLChannelReplyJobStore = class {
          'pending', 0, $10, NULL, NULL,
          NULL, NULL, clock.now_ms, clock.now_ms, NULL
        FROM clock
-       RETURNING ${COLUMNS}`,
+       RETURNING ${COLUMNS2}`,
       [
         input.runId,
         input.tenantId,
@@ -13855,22 +14864,22 @@ var PostgreSQLChannelReplyJobStore = class {
         input.availableAt
       ]
     );
-    return mapRow9(result.rows[0]);
+    return mapRow16(result.rows[0]);
   }
   /** Reads one job within a tenant scope. */
   async get(tenantId, runId) {
     const result = await this.pool.query(
-      `SELECT ${COLUMNS}
+      `SELECT ${COLUMNS2}
          FROM lattice_channel_reply_jobs
         WHERE tenant_id = $1 AND run_id = $2`,
       [tenantId, runId]
     );
-    return result.rowCount === 0 ? null : mapRow9(result.rows[0]);
+    return result.rowCount === 0 ? null : mapRow16(result.rows[0]);
   }
   /** Lists claimable pending jobs that are due at `now`, oldest first. */
   async listPending(now, limit) {
     const result = await this.pool.query(
-      `SELECT ${COLUMNS}
+      `SELECT ${COLUMNS2}
          FROM lattice_channel_reply_jobs
         WHERE status = 'pending'
           AND available_at <= $1
@@ -13879,7 +14888,7 @@ var PostgreSQLChannelReplyJobStore = class {
         LIMIT $2`,
       [now, normalizeChannelReplyJobListLimit(limit)]
     );
-    return result.rows.map(mapRow9);
+    return result.rows.map(mapRow16);
   }
   /**
    * Atomically leases a claimable job.
@@ -13900,10 +14909,10 @@ var PostgreSQLChannelReplyJobStore = class {
           AND j.status = 'pending'
           AND j.available_at <= clock.now_ms
           AND (j.lease_owner IS NULL OR j.lease_expires_at IS NULL OR j.lease_expires_at <= clock.now_ms)
-        RETURNING ${COLUMNS}`,
+        RETURNING ${COLUMNS2}`,
       [tenantId, runId, owner, leaseMs]
     );
-    return result.rowCount === 0 ? null : mapRow9(result.rows[0]);
+    return result.rowCount === 0 ? null : mapRow16(result.rows[0]);
   }
   /**
    * Marks a job delivered when `owner` still holds the lease.
@@ -13926,10 +14935,10 @@ var PostgreSQLChannelReplyJobStore = class {
           AND j.run_id = $2
           AND j.lease_owner = $3
           AND j.status = 'pending'
-        RETURNING ${COLUMNS}`,
+        RETURNING ${COLUMNS2}`,
       [tenantId, runId, owner, outputMessageId]
     );
-    return result.rowCount === 0 ? null : mapRow9(result.rows[0]);
+    return result.rowCount === 0 ? null : mapRow16(result.rows[0]);
   }
   /**
    * Returns a job to pending with an incremented attempt count.
@@ -13953,10 +14962,10 @@ var PostgreSQLChannelReplyJobStore = class {
           AND j.run_id = $2
           AND j.lease_owner = $3
           AND j.status = 'pending'
-        RETURNING ${COLUMNS}`,
+        RETURNING ${COLUMNS2}`,
       [tenantId, runId, owner, error, availableAt]
     );
-    return result.rowCount === 0 ? null : mapRow9(result.rows[0]);
+    return result.rowCount === 0 ? null : mapRow16(result.rows[0]);
   }
   /**
    * Marks a job terminally failed when `owner` still holds the lease.
@@ -13978,10 +14987,10 @@ var PostgreSQLChannelReplyJobStore = class {
           AND j.run_id = $2
           AND j.lease_owner = $3
           AND j.status = 'pending'
-        RETURNING ${COLUMNS}`,
+        RETURNING ${COLUMNS2}`,
       [tenantId, runId, owner, error]
     );
-    return result.rowCount === 0 ? null : mapRow9(result.rows[0]);
+    return result.rowCount === 0 ? null : mapRow16(result.rows[0]);
   }
   /** Deletes one job. Returns whether a row was removed. */
   async delete(tenantId, runId) {
@@ -14041,7 +15050,7 @@ async function rollbackQuietly(client) {
   } catch {
   }
 }
-function isUniqueViolation3(error) {
+function isUniqueViolation5(error) {
   return typeof error === "object" && error !== null && "code" in error && error.code === "23505";
 }
 function isRecord5(value) {
@@ -14169,7 +15178,7 @@ var PostgreSQLCheckpointStorage = class {
       await client.query("COMMIT");
     } catch (error) {
       await rollbackQuietly(client);
-      if (isUniqueViolation3(error)) {
+      if (isUniqueViolation5(error)) {
         throw new CheckpointTargetNotEmptyError(targetThreadId);
       }
       throw error;
@@ -14463,7 +15472,7 @@ import {
   storeExpiresAt,
   storePaginationValue
 } from "@axiom-lattice/protocols";
-function mapRow10(row) {
+function mapRow17(row) {
   return {
     namespace: row.namespace,
     key: row.key,
@@ -14495,7 +15504,7 @@ var PostgreSQLStore = class {
        RETURNING tenant_id, namespace, key, value, created_at, updated_at, expires_at`,
       [tenantId, input.namespace, input.key, JSON.stringify(input.value), now, expiresAt]
     );
-    return mapRow10(result.rows[0]);
+    return mapRow17(result.rows[0]);
   }
   async get(tenantId, namespace, key) {
     assertStoreIdentity(namespace, key);
@@ -14506,7 +15515,7 @@ var PostgreSQLStore = class {
          AND (expires_at IS NULL OR expires_at > $4)`,
       [tenantId, namespace, key, /* @__PURE__ */ new Date()]
     );
-    return result.rows[0] ? mapRow10(result.rows[0]) : null;
+    return result.rows[0] ? mapRow17(result.rows[0]) : null;
   }
   async delete(tenantId, namespace, key) {
     assertStoreIdentity(namespace, key);
@@ -14550,7 +15559,7 @@ var PostgreSQLStore = class {
        LIMIT $${limitParam} OFFSET $${offsetParam}`,
       params
     );
-    return result.rows.map(mapRow10);
+    return result.rows.map(mapRow17);
   }
   async listNamespaces(tenantId, prefix = [], limit = 100) {
     assertStoreNamespacePrefix(prefix);
@@ -14721,6 +15730,16 @@ async function createPgStoreConfig(connectionString) {
   mm.register(agentRunProjectTaskRunningIndexMigration);
   mm.register(addModelProviderKindDefault);
   mm.register(addShareKind);
+  mm.register(createUserExternalIdentityTable);
+  mm.register(createUserEmailLowerUniqueIndex);
+  mm.register(createOidcProviderConfigsTable);
+  mm.register(createPlatformMembersTable);
+  mm.register(createPlatformInvitationsTable);
+  mm.register(createOidcIdentityClaimsTable);
+  mm.register(createInviteLinksTable);
+  mm.register(addOidcIdentityClaimInviteFields);
+  mm.register(createPlatformSettingsTable);
+  mm.register(addOidcProviderAllowedHosts);
   await mm.migrate();
   const checkpoint = PostgresSaver.fromConnString(connectionString);
   try {
@@ -14737,6 +15756,13 @@ async function createPgStoreConfig(connectionString) {
     user: new PostgreSQLUserStore(opts),
     tenant: new PostgreSQLTenantStore(opts),
     userTenantLink: new PostgreSQLUserTenantLinkStore(opts),
+    userExternalIdentity: new PostgreSQLUserExternalIdentityStore(opts),
+    oidcProviderConfig: new PostgreSQLOidcProviderConfigStore(opts),
+    platformMember: new PostgreSQLPlatformMemberStore(opts),
+    platformInvitation: new PostgreSQLPlatformInvitationStore(opts),
+    oidcIdentityClaim: new PostgreSQLOidcIdentityClaimStore(opts),
+    inviteLink: new PostgreSQLInviteLinkStore(opts),
+    platformSettings: new PostgreSQLPlatformSettingsStore(opts),
     channelBinding: new ChannelBindingStore(opts),
     channelInstallation: new PostgreSQLChannelInstallationStore(opts),
     thread: new PostgreSQLThreadStore(opts),
@@ -15333,6 +16359,7 @@ export {
   InvalidFileShareAddressError,
   InvalidMcpAppShareAddressError,
   InvalidMcpAppShareVisibilityError,
+  InvalidUserExternalIdentityRowError,
   MenuStore,
   MigrationManager,
   PGVectorStoreProvider,
@@ -15349,10 +16376,16 @@ export {
   PostgreSQLConnectionStore,
   PostgreSQLDatabaseConfigStore,
   PostgreSQLEvalStore,
+  PostgreSQLInviteLinkStore,
   PostgreSQLMcpServerConfigStore,
   PostgreSQLMetricsServerConfigStore,
   PostgreSQLModelProviderStore,
+  PostgreSQLOidcIdentityClaimStore,
+  PostgreSQLOidcProviderConfigStore,
   PostgreSQLOpenAuditStore,
+  PostgreSQLPlatformInvitationStore,
+  PostgreSQLPlatformMemberStore,
+  PostgreSQLPlatformSettingsStore,
   PostgreSQLPluginDeploymentStore,
   PostgreSQLProjectBotMembershipStore,
   PostgreSQLProjectMembershipStore,
@@ -15366,6 +16399,7 @@ export {
   PostgreSQLTaskWorkItemStore,
   PostgreSQLTenantStore,
   PostgreSQLThreadStore,
+  PostgreSQLUserExternalIdentityStore,
   PostgreSQLUserStore,
   PostgreSQLUserTenantLinkStore,
   PostgreSQLWorkflowTrackingStore,
@@ -15383,6 +16417,7 @@ export {
   addInterruptColumnsToEval,
   addInterruptPolicyToEvalCases,
   addMcpAppContentType,
+  addOidcIdentityClaimInviteFields,
   addProjectConfigColumn,
   addScheduleTenantId,
   addShareKind,
@@ -15412,11 +16447,17 @@ export {
   createEvalRunResultsTable,
   createEvalRunsTable,
   createEvalSuitesTable,
+  createInviteLinksTable,
   createMcpServerConfigsTable,
   createMenuItemsTable,
   createMetricsConfigsTable,
+  createOidcIdentityClaimsTable,
+  createOidcProviderConfigsTable,
   createPGVectorStoreProvider,
   createPgStoreConfig,
+  createPlatformInvitationsTable,
+  createPlatformMembersTable,
+  createPlatformSettingsTable,
   createPluginDeployments,
   createProjectRoomReadStates,
   createProjectRoomTables,
@@ -15428,6 +16469,8 @@ export {
   createTenantsTable,
   createThreadMessageQueueTable,
   createThreadsTable,
+  createUserEmailLowerUniqueIndex,
+  createUserExternalIdentityTable,
   createUsersTable,
   createWorkflowTrackingTables,
   createWorkspacesTable,