@axiom-lattice/pg-stores 5.1.1 → 5.2.0

package/dist/index.js

@@ -63,6 +63,7 @@ __export(index_exports, {
   PostgreSQLOidcIdentityClaimStore: () => PostgreSQLOidcIdentityClaimStore,
   PostgreSQLOidcProviderConfigStore: () => PostgreSQLOidcProviderConfigStore,
   PostgreSQLOpenAuditStore: () => PostgreSQLOpenAuditStore,
+  PostgreSQLPlatformAuditStore: () => PostgreSQLPlatformAuditStore,
   PostgreSQLPlatformInvitationStore: () => PostgreSQLPlatformInvitationStore,
   PostgreSQLPlatformMemberStore: () => PostgreSQLPlatformMemberStore,
   PostgreSQLPlatformSettingsStore: () => PostgreSQLPlatformSettingsStore,
@@ -134,7 +135,9 @@ __export(index_exports, {
   createOidcIdentityClaimsTable: () => createOidcIdentityClaimsTable,
   createOidcProviderConfigsTable: () => createOidcProviderConfigsTable,
   createPGVectorStoreProvider: () => createPGVectorStoreProvider,
+  createPersonalMcpServerConfigsTable: () => createPersonalMcpServerConfigsTable,
   createPgStoreConfig: () => createPgStoreConfig,
+  createPlatformAuditTable: () => createPlatformAuditTable,
   createPlatformInvitationsTable: () => createPlatformInvitationsTable,
   createPlatformMembersTable: () => createPlatformMembersTable,
   createPlatformSettingsTable: () => createPlatformSettingsTable,
@@ -1932,6 +1935,43 @@ var createMcpServerConfigsTable = {
     await client.query("DROP TABLE IF EXISTS lattice_mcp_server_configs");
   }
 };
+var createPersonalMcpServerConfigsTable = {
+  version: 220,
+  name: "create_personal_mcp_server_configs_table",
+  up: async (client) => {
+    await client.query(`
+      CREATE TABLE IF NOT EXISTS lattice_personal_mcp_server_configs (
+        id VARCHAR(255) NOT NULL,
+        tenant_id VARCHAR(255) NOT NULL,
+        owner_assistant_id VARCHAR(255) NOT NULL,
+        key VARCHAR(255) NOT NULL,
+        name VARCHAR(255),
+        description TEXT,
+        config JSONB NOT NULL,
+        selected_tools JSONB NOT NULL DEFAULT '[]',
+        is_env_encrypted BOOLEAN NOT NULL DEFAULT FALSE,
+        status VARCHAR(50) NOT NULL DEFAULT 'disconnected',
+        created_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP,
+        updated_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP,
+
+        PRIMARY KEY (tenant_id, owner_assistant_id, id)
+      )
+    `);
+    await client.query(`
+      CREATE UNIQUE INDEX IF NOT EXISTS idx_lattice_personal_mcp_assistant_key
+      ON lattice_personal_mcp_server_configs(tenant_id, owner_assistant_id, key)
+    `);
+    await client.query(`
+      CREATE INDEX IF NOT EXISTS idx_lattice_personal_mcp_assistant
+      ON lattice_personal_mcp_server_configs(tenant_id, owner_assistant_id)
+    `);
+  },
+  down: async (client) => {
+    await client.query("DROP INDEX IF EXISTS idx_lattice_personal_mcp_assistant_key");
+    await client.query("DROP INDEX IF EXISTS idx_lattice_personal_mcp_assistant");
+    await client.query("DROP TABLE IF EXISTS lattice_personal_mcp_server_configs");
+  }
+};
 
 // src/stores/PostgreSQLMcpServerConfigStore.ts
 var import_core4 = require("@axiom-lattice/core");
@@ -1955,6 +1995,7 @@ var PostgreSQLMcpServerConfigStore = class {
     }
     this.migrationManager = new MigrationManager(this.pool);
     this.migrationManager.register(createMcpServerConfigsTable);
+    this.migrationManager.register(createPersonalMcpServerConfigsTable);
     if (options.autoMigrate !== false) {
       this.initialize().catch((error) => {
         console.error("Failed to initialize PostgreSQLMcpServerConfigStore:", error);
@@ -2182,6 +2223,231 @@ var PostgreSQLMcpServerConfigStore = class {
     );
     return result.rows.length > 0;
   }
+  /**
+   * Get all personal MCP server configurations owned by one assistant.
+   */
+  async getAllConfigsForAssistant(tenantId, ownerAssistantId) {
+    await this.ensureInitialized();
+    const result = await this.pool.query(
+      `
+      SELECT id, tenant_id, owner_assistant_id, key, name, description, config, selected_tools, is_env_encrypted, status, created_at, updated_at
+      FROM lattice_personal_mcp_server_configs
+      WHERE tenant_id = $1 AND owner_assistant_id = $2
+      ORDER BY created_at DESC
+    `,
+      [tenantId, ownerAssistantId]
+    );
+    return result.rows.map((row) => this.mapPersonalRowToEntry(row));
+  }
+  /**
+   * Get every personal MCP server configuration across tenants.
+   *
+   * Operations/tests only; startup restoration must not call this.
+   */
+  async getAllPersonalConfigsWithoutTenant() {
+    await this.ensureInitialized();
+    const result = await this.pool.query(
+      `
+      SELECT id, tenant_id, owner_assistant_id, key, name, description, config, selected_tools, is_env_encrypted, status, created_at, updated_at
+      FROM lattice_personal_mcp_server_configs
+      ORDER BY created_at DESC
+    `
+    );
+    return result.rows.map((row) => this.mapPersonalRowToEntry(row));
+  }
+  /**
+   * Get one personal MCP server configuration by id.
+   */
+  async getConfigByIdForAssistant(tenantId, ownerAssistantId, id) {
+    await this.ensureInitialized();
+    const result = await this.pool.query(
+      `
+      SELECT id, tenant_id, owner_assistant_id, key, name, description, config, selected_tools, is_env_encrypted, status, created_at, updated_at
+      FROM lattice_personal_mcp_server_configs
+      WHERE tenant_id = $1 AND owner_assistant_id = $2 AND id = $3
+    `,
+      [tenantId, ownerAssistantId, id]
+    );
+    if (result.rows.length === 0) {
+      return null;
+    }
+    return this.mapPersonalRowToEntry(result.rows[0]);
+  }
+  /**
+   * Get one personal MCP server configuration by business key.
+   */
+  async getConfigByKeyForAssistant(tenantId, ownerAssistantId, key) {
+    await this.ensureInitialized();
+    const result = await this.pool.query(
+      `
+      SELECT id, tenant_id, owner_assistant_id, key, name, description, config, selected_tools, is_env_encrypted, status, created_at, updated_at
+      FROM lattice_personal_mcp_server_configs
+      WHERE tenant_id = $1 AND owner_assistant_id = $2 AND key = $3
+    `,
+      [tenantId, ownerAssistantId, key]
+    );
+    if (result.rows.length === 0) {
+      return null;
+    }
+    return this.mapPersonalRowToEntry(result.rows[0]);
+  }
+  /**
+   * Create a personal MCP server configuration.
+   */
+  async createConfigForAssistant(tenantId, ownerAssistantId, id, data) {
+    await this.ensureInitialized();
+    const now = /* @__PURE__ */ new Date();
+    const nowString = now.toISOString();
+    const { config: configWithEncryptedEnv, isEnvEncrypted } = this.encryptEnvInConfig(data.config);
+    await this.pool.query(
+      `
+      INSERT INTO lattice_personal_mcp_server_configs (id, tenant_id, owner_assistant_id, key, name, description, config, selected_tools, is_env_encrypted, status, created_at, updated_at)
+      VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11::timestamp, $12::timestamp)
+      ON CONFLICT (tenant_id, owner_assistant_id, id) DO UPDATE SET
+        key = EXCLUDED.key,
+        name = EXCLUDED.name,
+        description = EXCLUDED.description,
+        config = EXCLUDED.config,
+        selected_tools = EXCLUDED.selected_tools,
+        is_env_encrypted = EXCLUDED.is_env_encrypted,
+        status = EXCLUDED.status,
+        updated_at = EXCLUDED.updated_at
+    `,
+      [
+        id,
+        tenantId,
+        ownerAssistantId,
+        data.key,
+        data.name || null,
+        data.description || null,
+        JSON.stringify(configWithEncryptedEnv),
+        JSON.stringify(data.selectedTools || []),
+        isEnvEncrypted,
+        "disconnected",
+        nowString,
+        nowString
+      ]
+    );
+    return {
+      id,
+      tenantId,
+      ownerAssistantId,
+      key: data.key,
+      config: data.config,
+      selectedTools: data.selectedTools || [],
+      isEnvEncrypted,
+      status: "disconnected",
+      name: data.name,
+      description: data.description,
+      createdAt: now,
+      updatedAt: now
+    };
+  }
+  /**
+   * Update a personal MCP server configuration.
+   */
+  async updateConfigForAssistant(tenantId, ownerAssistantId, id, updates) {
+    await this.ensureInitialized();
+    const existing = await this.getConfigByIdForAssistant(
+      tenantId,
+      ownerAssistantId,
+      id
+    );
+    if (!existing) {
+      return null;
+    }
+    const updateData = {};
+    if (updates.key !== void 0) {
+      updateData.key = updates.key;
+    }
+    if (updates.name !== void 0) {
+      updateData.name = updates.name || null;
+    }
+    if (updates.description !== void 0) {
+      updateData.description = updates.description || null;
+    }
+    if (updates.config !== void 0) {
+      const { config: configWithEncryptedEnv, isEnvEncrypted } = this.encryptEnvInConfig(updates.config);
+      updateData.config = JSON.stringify(configWithEncryptedEnv);
+      updateData.is_env_encrypted = isEnvEncrypted;
+    }
+    if (updates.selectedTools !== void 0) {
+      updateData.selected_tools = JSON.stringify(updates.selectedTools);
+    }
+    if (updates.status !== void 0) {
+      updateData.status = updates.status;
+    }
+    if (Object.keys(updateData).length === 0) {
+      return existing;
+    }
+    updateData.updated_at = (/* @__PURE__ */ new Date()).toISOString();
+    const fields = Object.keys(updateData);
+    const values = Object.values(updateData);
+    values.push(tenantId);
+    values.push(ownerAssistantId);
+    values.push(id);
+    const setClauses = fields.map((field, index) => {
+      if (field === "updated_at") {
+        return `${field} = $${index + 1}::timestamp`;
+      }
+      return `${field} = $${index + 1}`;
+    });
+    const whereTenantIndex = fields.length + 1;
+    const whereOwnerIndex = fields.length + 2;
+    const whereIdIndex = fields.length + 3;
+    const sql = `
+      UPDATE lattice_personal_mcp_server_configs
+      SET ${setClauses.join(", ")}
+      WHERE tenant_id = $${whereTenantIndex}
+        AND owner_assistant_id = $${whereOwnerIndex}
+        AND id = $${whereIdIndex}
+    `;
+    await this.pool.query(sql, values);
+    return this.getConfigByIdForAssistant(tenantId, ownerAssistantId, id);
+  }
+  /**
+   * Delete one personal MCP server configuration by id.
+   */
+  async deleteConfigForAssistant(tenantId, ownerAssistantId, id) {
+    await this.ensureInitialized();
+    const result = await this.pool.query(
+      `
+      DELETE FROM lattice_personal_mcp_server_configs
+      WHERE tenant_id = $1 AND owner_assistant_id = $2 AND id = $3
+    `,
+      [tenantId, ownerAssistantId, id]
+    );
+    return result.rowCount !== null && result.rowCount > 0;
+  }
+  /**
+   * Delete every personal MCP server configuration owned by one assistant.
+   */
+  async deleteConfigsForAssistant(tenantId, ownerAssistantId) {
+    await this.ensureInitialized();
+    const result = await this.pool.query(
+      `
+      DELETE FROM lattice_personal_mcp_server_configs
+      WHERE tenant_id = $1 AND owner_assistant_id = $2
+    `,
+      [tenantId, ownerAssistantId]
+    );
+    return result.rowCount ?? 0;
+  }
+  /**
+   * Check whether a personal MCP server configuration exists.
+   */
+  async hasConfigForAssistant(tenantId, ownerAssistantId, id) {
+    await this.ensureInitialized();
+    const result = await this.pool.query(
+      `
+      SELECT 1 FROM lattice_personal_mcp_server_configs
+      WHERE tenant_id = $1 AND owner_assistant_id = $2 AND id = $3
+      LIMIT 1
+    `,
+      [tenantId, ownerAssistantId, id]
+    );
+    return result.rows.length > 0;
+  }
   /**
    * Dispose resources and close the connection pool
    */
@@ -2232,6 +2498,15 @@ var PostgreSQLMcpServerConfigStore = class {
       updatedAt: row.updated_at
     };
   }
+  /**
+   * Map a personal table row, tagging the owning assistant.
+   */
+  mapPersonalRowToEntry(row) {
+    return {
+      ...this.mapRowToEntry(row),
+      ownerAssistantId: row.owner_assistant_id
+    };
+  }
   /**
    * Encrypt env values in config before storing
    */
@@ -3423,6 +3698,7 @@ var PostgreSQLTenantStore = class {
 
 // src/stores/PostgreSQLUserTenantLinkStore.ts
 var import_pg10 = require("pg");
+var import_protocols2 = require("@axiom-lattice/protocols");
 
 // src/migrations/user_tenant_link_migrations.ts
 var createUserTenantLinkTable = {
@@ -3581,6 +3857,7 @@ var PostgreSQLUserTenantLinkStore = class {
     return this.mapRowToLink(result.rows[0]);
   }
   async createLink(data) {
+    (0, import_protocols2.assertNotPlatformTenant)(data.tenantId);
     await this.ensureInitialized();
     const now = /* @__PURE__ */ new Date();
     const role = data.role || "member";
@@ -3656,7 +3933,7 @@ var PostgreSQLUserTenantLinkStore = class {
 };
 
 // src/stores/PostgreSQLUserExternalIdentityStore.ts
-var import_protocols2 = require("@axiom-lattice/protocols");
+var import_protocols3 = require("@axiom-lattice/protocols");
 var InvalidUserExternalIdentityRowError = class extends Error {
   constructor() {
     super("Invalid user external identity row");
@@ -3719,14 +3996,14 @@ var PostgreSQLUserExternalIdentityStore = class {
       identity.subject
     );
     if (!existing) {
-      throw new import_protocols2.ExternalIdentityPersistError(
+      throw new import_protocols3.ExternalIdentityPersistError(
         identity.providerId,
         identity.issuer,
         identity.subject
       );
     }
     if (existing.userId !== identity.userId) {
-      throw new import_protocols2.ExternalIdentityConflictError(
+      throw new import_protocols3.ExternalIdentityConflictError(
         identity.providerId,
         identity.issuer,
         identity.subject
@@ -3751,7 +4028,7 @@ var PostgreSQLUserExternalIdentityStore = class {
 
 // src/stores/PostgreSQLOidcProviderConfigStore.ts
 var import_core5 = require("@axiom-lattice/core");
-var import_protocols3 = require("@axiom-lattice/protocols");
+var import_protocols4 = require("@axiom-lattice/protocols");
 var TABLE2 = "lattice_oidc_provider_configs";
 function parseAllowedPrivateHosts(value) {
   if (!Array.isArray(value)) return void 0;
@@ -3836,7 +4113,7 @@ var PostgreSQLOidcProviderConfigStore = class {
       );
     } catch (error) {
       if (isUniqueViolation(error)) {
-        throw new import_protocols3.OidcProviderConfigConflictError(id);
+        throw new import_protocols4.OidcProviderConfigConflictError(id);
       }
       throw error;
     }
@@ -3967,7 +4244,7 @@ var PostgreSQLPlatformMemberStore = class {
 };
 
 // src/stores/PostgreSQLPlatformInvitationStore.ts
-var import_protocols4 = require("@axiom-lattice/protocols");
+var import_protocols5 = require("@axiom-lattice/protocols");
 var TABLE4 = "lattice_platform_invitations";
 var ROLES2 = ["owner", "admin", "auditor"];
 function isPlatformRole2(value) {
@@ -4001,7 +4278,7 @@ var PostgreSQLPlatformInvitationStore = class {
   async get(email) {
     const result = await this.pool.query(
       `SELECT * FROM ${TABLE4} WHERE email = $1`,
-      [(0, import_protocols4.normalizePlatformInvitationEmail)(email)]
+      [(0, import_protocols5.normalizePlatformInvitationEmail)(email)]
     );
     return result.rows[0] ? mapRow4(result.rows[0]) : null;
   }
@@ -4024,7 +4301,7 @@ var PostgreSQLPlatformInvitationStore = class {
          consumed_at = EXCLUDED.consumed_at
        RETURNING *`,
       [
-        (0, import_protocols4.normalizePlatformInvitationEmail)(invitation.email),
+        (0, import_protocols5.normalizePlatformInvitationEmail)(invitation.email),
         invitation.role,
         invitation.invitedBy ?? null,
         invitation.createdAt,
@@ -4038,7 +4315,7 @@ var PostgreSQLPlatformInvitationStore = class {
   async delete(email) {
     const result = await this.pool.query(
       `DELETE FROM ${TABLE4} WHERE email = $1`,
-      [(0, import_protocols4.normalizePlatformInvitationEmail)(email)]
+      [(0, import_protocols5.normalizePlatformInvitationEmail)(email)]
     );
     return (result.rowCount ?? 0) > 0;
   }
@@ -4056,14 +4333,14 @@ var PostgreSQLPlatformInvitationStore = class {
          AND consumed_at IS NULL
          AND (expires_at IS NULL OR expires_at > $1)
        RETURNING *`,
-      [at, (0, import_protocols4.normalizePlatformInvitationEmail)(email)]
+      [at, (0, import_protocols5.normalizePlatformInvitationEmail)(email)]
     );
     return result.rows[0] ? mapRow4(result.rows[0]) : null;
   }
 };
 
 // src/stores/PostgreSQLOidcIdentityClaimStore.ts
-var import_protocols5 = require("@axiom-lattice/protocols");
+var import_protocols6 = require("@axiom-lattice/protocols");
 var TABLE5 = "lattice_oidc_identity_claims";
 function mapRow5(row) {
   return {
@@ -4146,7 +4423,7 @@ var PostgreSQLOidcIdentityClaimStore = class {
           input.providerId,
           input.issuer,
           input.subject,
-          (0, import_protocols5.normalizeOidcIdentityEmail)(input.email),
+          (0, import_protocols6.normalizeOidcIdentityEmail)(input.email),
           input.name ?? null,
           input.picture ?? null,
           now,
@@ -4162,7 +4439,7 @@ var PostgreSQLOidcIdentityClaimStore = class {
       return mapRow5(result.rows[0]);
     } catch (error) {
       if (isUniqueViolation2(error)) {
-        throw new import_protocols5.OidcIdentityClaimConflictError(
+        throw new import_protocols6.OidcIdentityClaimConflictError(
           input.providerId,
           input.issuer,
           input.subject
@@ -4175,7 +4452,7 @@ var PostgreSQLOidcIdentityClaimStore = class {
     const sets = [];
     const params = [];
     if (updates.email !== void 0) {
-      params.push((0, import_protocols5.normalizeOidcIdentityEmail)(updates.email));
+      params.push((0, import_protocols6.normalizeOidcIdentityEmail)(updates.email));
       sets.push(`email = $${params.length}`);
     }
     if (updates.name !== void 0) {
@@ -4231,7 +4508,7 @@ var PostgreSQLOidcIdentityClaimStore = class {
 
 // src/stores/PostgreSQLInviteLinkStore.ts
 var import_core6 = require("@axiom-lattice/core");
-var import_protocols6 = require("@axiom-lattice/protocols");
+var import_protocols7 = require("@axiom-lattice/protocols");
 var TABLE6 = "lattice_invite_links";
 function mapRow6(row) {
   return {
@@ -4293,7 +4570,7 @@ var PostgreSQLInviteLinkStore = class {
         input.scope,
         input.tokenHash,
         (0, import_core6.encrypt)(input.token),
-        input.email ? (0, import_protocols6.normalizeInviteLinkEmail)(input.email) : null,
+        input.email ? (0, import_protocols7.normalizeInviteLinkEmail)(input.email) : null,
         input.platformRole ?? null,
         input.tenantId ?? null,
         input.tenantRole ?? null,
@@ -5946,7 +6223,7 @@ var PostgreSQLEvalStore = class {
 // src/stores/ThreadMessageQueueStore.ts
 var import_pg13 = require("pg");
 var import_crypto = __toESM(require("crypto"));
-var import_protocols7 = require("@axiom-lattice/protocols");
+var import_protocols8 = require("@axiom-lattice/protocols");
 
 // src/migrations/thread_message_queue_migrations.ts
 var createThreadMessageQueueTable = {
@@ -6433,15 +6710,15 @@ var ThreadMessageQueueStore = class {
       priority: row.priority || 0,
       command: row.command ? typeof row.command === "string" ? JSON.parse(row.command) : row.command : void 0,
       custom_run_config: row.custom_run_config ? typeof row.custom_run_config === "string" ? JSON.parse(row.custom_run_config) : row.custom_run_config : void 0,
-      trusted_run_context: row.trusted_run_context ? (0, import_protocols7.parseTrustedRunContext)(typeof row.trusted_run_context === "string" ? JSON.parse(row.trusted_run_context) : row.trusted_run_context) : void 0,
-      execution_mode: row.execution_mode == null ? void 0 : (0, import_protocols7.parseQueuedExecutionMode)(row.execution_mode)
+      trusted_run_context: row.trusted_run_context ? (0, import_protocols8.parseTrustedRunContext)(typeof row.trusted_run_context === "string" ? JSON.parse(row.trusted_run_context) : row.trusted_run_context) : void 0,
+      execution_mode: row.execution_mode == null ? void 0 : (0, import_protocols8.parseQueuedExecutionMode)(row.execution_mode)
     };
   }
 };
 function validateQueueTrust(params) {
   return {
-    trustedRunContext: params.trusted_run_context === void 0 ? void 0 : (0, import_protocols7.parseTrustedRunContext)(params.trusted_run_context),
-    executionMode: params.execution_mode === void 0 ? void 0 : (0, import_protocols7.parseQueuedExecutionMode)(params.execution_mode)
+    trustedRunContext: params.trusted_run_context === void 0 ? void 0 : (0, import_protocols8.parseTrustedRunContext)(params.trusted_run_context),
+    executionMode: params.execution_mode === void 0 ? void 0 : (0, import_protocols8.parseQueuedExecutionMode)(params.execution_mode)
   };
 }
 function scopeClause(scope, start) {
@@ -6459,7 +6736,7 @@ function scopeClause(scope, start) {
 
 // src/stores/ChannelBindingStore.ts
 var import_pg14 = require("pg");
-var import_protocols8 = require("@axiom-lattice/protocols");
+var import_protocols9 = require("@axiom-lattice/protocols");
 
 // src/migrations/channel_bindings_migration.ts
 var createChannelBindingsTable = {
@@ -6608,7 +6885,7 @@ var ChannelBindingStore = class {
       return this.mapRowToBinding(result.rows[0]);
     } catch (error) {
       if (isBindingSubjectConflict(error)) {
-        throw new import_protocols8.DuplicateChannelBindingSubjectError();
+        throw new import_protocols9.DuplicateChannelBindingSubjectError();
       }
       throw error;
     }
@@ -7745,7 +8022,7 @@ var PostgreSQLAgentWebAppStore = class {
 
 // src/stores/PostgreSQLScheduleStorage.ts
 var import_pg19 = require("pg");
-var import_protocols9 = require("@axiom-lattice/protocols");
+var import_protocols10 = require("@axiom-lattice/protocols");
 
 // src/migrations/schedule_migrations.ts
 var createScheduledTasksTable = {
@@ -8160,10 +8437,10 @@ var PostgreSQLScheduleStorage = class {
        WHERE task_id = $3 AND status = $4
        RETURNING task_id`,
       [
-        import_protocols9.ScheduledTaskStatus.RUNNING,
+        import_protocols10.ScheduledTaskStatus.RUNNING,
         /* @__PURE__ */ new Date(),
         taskId,
-        import_protocols9.ScheduledTaskStatus.PENDING
+        import_protocols10.ScheduledTaskStatus.PENDING
       ]
     );
     return (result.rowCount ?? 0) > 0;
@@ -8183,8 +8460,8 @@ var PostgreSQLScheduleStorage = class {
        WHERE status = $2 AND updated_at < now() - ($3::bigint || ' milliseconds')::interval
        RETURNING task_id`,
       [
-        import_protocols9.ScheduledTaskStatus.PENDING,
-        import_protocols9.ScheduledTaskStatus.RUNNING,
+        import_protocols10.ScheduledTaskStatus.PENDING,
+        import_protocols10.ScheduledTaskStatus.RUNNING,
         olderThanMs
       ]
     );
@@ -8207,7 +8484,7 @@ var PostgreSQLScheduleStorage = class {
     await this.ensureInitialized();
     const result = await this.pool.query(
       `SELECT * FROM lattice_scheduled_tasks WHERE status IN ($1, $2) ORDER BY created_at ASC`,
-      [import_protocols9.ScheduledTaskStatus.PENDING, import_protocols9.ScheduledTaskStatus.PAUSED]
+      [import_protocols10.ScheduledTaskStatus.PENDING, import_protocols10.ScheduledTaskStatus.PAUSED]
     );
     return result.rows.map((row) => this.mapRowToTask(row));
   }
@@ -8366,9 +8643,9 @@ var PostgreSQLScheduleStorage = class {
       AND updated_at < $4
       `,
       [
-        import_protocols9.ScheduledTaskStatus.COMPLETED,
-        import_protocols9.ScheduledTaskStatus.CANCELLED,
-        import_protocols9.ScheduledTaskStatus.FAILED,
+        import_protocols10.ScheduledTaskStatus.COMPLETED,
+        import_protocols10.ScheduledTaskStatus.CANCELLED,
+        import_protocols10.ScheduledTaskStatus.FAILED,
         cutoff
       ]
     );
@@ -9384,7 +9661,7 @@ var PostgreSQLTaskStore = class {
 
 // src/stores/PostgreSQLTaskWorkItemStore.ts
 var import_pg21 = require("pg");
-var import_protocols10 = require("@axiom-lattice/protocols");
+var import_protocols11 = require("@axiom-lattice/protocols");
 var import_uuid4 = require("uuid");
 
 // src/migrations/task_work_items_migration.ts
@@ -9674,8 +9951,8 @@ var PostgreSQLTaskWorkItemStore = class {
   }
   /** List pending execution results using one bounded PostgreSQL anti-join query. */
   async listPendingExecutionResults(params) {
-    if (!Number.isSafeInteger(params.limit) || params.limit < 0 || params.limit > import_protocols10.MAX_PENDING_EXECUTION_RESULTS_LIMIT) {
-      const error = new RangeError(`limit must be a safe integer between 0 and ${import_protocols10.MAX_PENDING_EXECUTION_RESULTS_LIMIT}`);
+    if (!Number.isSafeInteger(params.limit) || params.limit < 0 || params.limit > import_protocols11.MAX_PENDING_EXECUTION_RESULTS_LIMIT) {
+      const error = new RangeError(`limit must be a safe integer between 0 and ${import_protocols11.MAX_PENDING_EXECUTION_RESULTS_LIMIT}`);
       error.code = "INVALID_LIMIT";
       throw error;
     }
@@ -10529,7 +10806,7 @@ var import_pg25 = require("pg");
 var import_pgvector = require("@langchain/community/vectorstores/pgvector");
 var import_documents = require("@langchain/core/documents");
 var import_core9 = require("@axiom-lattice/core");
-var import_protocols11 = require("@axiom-lattice/protocols");
+var import_protocols12 = require("@axiom-lattice/protocols");
 function safeTableName(name) {
   if (!/^[a-z][a-z0-9_-]*$/.test(name)) {
     throw new Error(`Invalid table name: ${name}`);
@@ -10544,13 +10821,13 @@ var PGVectorStoreProvider = class {
   async create(params) {
     const { tableName, embeddingKey } = params;
     const tenantId = params.tenantId ?? "default";
-    const requestedKey = embeddingKey || import_protocols11.EMBEDDING_DEFAULT_KEY;
+    const requestedKey = embeddingKey || import_protocols12.EMBEDDING_DEFAULT_KEY;
     const embeddings = await import_core9.embeddingsLatticeManager.getEmbeddingsClientWithTenant(
       tenantId,
       requestedKey
-    ) ?? (requestedKey === import_protocols11.EMBEDDING_DEFAULT_KEY ? void 0 : await import_core9.embeddingsLatticeManager.getEmbeddingsClientWithTenant(
+    ) ?? (requestedKey === import_protocols12.EMBEDDING_DEFAULT_KEY ? void 0 : await import_core9.embeddingsLatticeManager.getEmbeddingsClientWithTenant(
       tenantId,
-      import_protocols11.EMBEDDING_DEFAULT_KEY
+      import_protocols12.EMBEDDING_DEFAULT_KEY
     )) ?? await import_core9.embeddingsLatticeManager.getEmbeddingsClientWithTenant(
       tenantId,
       "default"
@@ -11155,6 +11432,49 @@ var addOidcProviderAllowedHosts = {
   }
 };
 
+// src/migrations/platform_audit_migration.ts
+var createPlatformAuditTable = {
+  version: 219,
+  name: "create_platform_audit_table",
+  up: async (client) => {
+    await client.query(`
+      CREATE TABLE IF NOT EXISTS lattice_platform_audit (
+        id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+        initiator_user_id VARCHAR(255),
+        initiator_role VARCHAR(16),
+        initiator JSONB NOT NULL,
+        source VARCHAR(32) NOT NULL,
+        executor JSONB NOT NULL,
+        tenant_id VARCHAR(255),
+        action VARCHAR(16) NOT NULL,
+        status VARCHAR(16) NOT NULL,
+        summary JSONB NOT NULL,
+        before JSONB,
+        after JSONB,
+        error_code VARCHAR(64),
+        duration_ms INTEGER NOT NULL,
+        created_at TIMESTAMPTZ NOT NULL DEFAULT NOW()
+      )
+    `);
+    await client.query(`
+      CREATE INDEX IF NOT EXISTS idx_lattice_platform_audit_created
+        ON lattice_platform_audit(created_at DESC, id DESC)
+    `);
+    await client.query(`
+      CREATE INDEX IF NOT EXISTS idx_lattice_platform_audit_initiator
+        ON lattice_platform_audit(initiator_user_id, created_at DESC)
+    `);
+    await client.query(`
+      CREATE INDEX IF NOT EXISTS idx_lattice_platform_audit_tenant
+        ON lattice_platform_audit(tenant_id, created_at DESC)
+        WHERE tenant_id IS NOT NULL
+    `);
+  },
+  down: async (client) => {
+    await client.query("DROP TABLE IF EXISTS lattice_platform_audit");
+  }
+};
+
 // src/migrations/collection_migrations.ts
 var createCollectionsTable = {
   version: 137,
@@ -14798,7 +15118,7 @@ function isActiveRunViolation(error) {
 }
 
 // src/stores/PostgreSQLPlatformSettingsStore.ts
-var import_protocols12 = require("@axiom-lattice/protocols");
+var import_protocols13 = require("@axiom-lattice/protocols");
 var TABLE7 = "lattice_platform_settings";
 var SETTINGS_ID = "default";
 var COLUMNS = "id, document, version, updated_by, updated_at";
@@ -14861,16 +15181,156 @@ var PostgreSQLPlatformSettingsStore = class {
       `SELECT version FROM ${TABLE7} WHERE id = $1`,
       [SETTINGS_ID]
     );
-    throw new import_protocols12.PlatformSettingsVersionConflictError(
+    throw new import_protocols13.PlatformSettingsVersionConflictError(
       expectedVersion,
       actual.rows[0] ? Number(actual.rows[0].version) : 0
     );
   }
 };
 
+// src/stores/PostgreSQLPlatformAuditStore.ts
+var TABLE8 = "lattice_platform_audit";
+function parseJson(value) {
+  return typeof value === "string" ? JSON.parse(value) : value;
+}
+function normalizeBoundary(value) {
+  if (value === void 0) return void 0;
+  const trimmed = value.trim();
+  if (trimmed === "") return void 0;
+  const parsed = new Date(trimmed);
+  if (Number.isNaN(parsed.getTime())) return void 0;
+  return parsed.toISOString();
+}
+function normalizePagination(value, fallback) {
+  if (value === void 0 || !Number.isFinite(value)) return fallback;
+  return Math.max(0, Math.trunc(value));
+}
+function mapRow16(row) {
+  return {
+    id: row.id,
+    initiator: parseJson(row.initiator),
+    source: row.source,
+    executor: parseJson(row.executor),
+    ...row.tenant_id !== null ? { tenantId: row.tenant_id } : {},
+    action: row.action,
+    status: row.status,
+    summary: parseJson(row.summary),
+    ...row.before !== null ? { before: parseJson(row.before) } : {},
+    ...row.after !== null ? { after: parseJson(row.after) } : {},
+    ...row.error_code !== null ? { errorCode: row.error_code } : {},
+    durationMs: Number(row.duration_ms),
+    createdAt: row.created_at
+  };
+}
+var PostgreSQLPlatformAuditStore = class {
+  constructor(options) {
+    this.options = options;
+  }
+  get pool() {
+    return this.options.pool;
+  }
+  /** Appends a record, assigning a fresh id and creation timestamp. */
+  async append(record) {
+    const initiator = record.initiator;
+    const initiatorUserId = initiator.type === "human" ? initiator.userId : null;
+    const initiatorRole = initiator.type === "human" ? initiator.role : null;
+    const durationMs = Number.isFinite(record.durationMs) ? Math.max(0, Math.round(record.durationMs)) : 0;
+    const result = await this.pool.query(
+      `INSERT INTO ${TABLE8}
+         (initiator_user_id, initiator_role, initiator, source, executor,
+          tenant_id, action, status, summary, before, after, error_code,
+          duration_ms)
+       VALUES ($1,$2,$3::jsonb,$4,$5::jsonb,$6,$7,$8,$9::jsonb,$10::jsonb,
+               $11::jsonb,$12,$13)
+       RETURNING *`,
+      [
+        initiatorUserId,
+        initiatorRole,
+        JSON.stringify(initiator),
+        record.source,
+        JSON.stringify(record.executor),
+        record.tenantId ?? null,
+        record.action,
+        record.status,
+        JSON.stringify(record.summary),
+        record.before === void 0 ? null : JSON.stringify(record.before),
+        record.after === void 0 ? null : JSON.stringify(record.after),
+        record.errorCode ?? null,
+        durationMs
+      ]
+    );
+    const row = result.rows[0];
+    if (!row) throw new Error("Platform audit record was not persisted");
+    return mapRow16(row);
+  }
+  /** Returns a record by id, or null when it does not exist. */
+  async get(id) {
+    const result = await this.pool.query(
+      `SELECT * FROM ${TABLE8} WHERE id = $1`,
+      [id]
+    );
+    return result.rows[0] ? mapRow16(result.rows[0]) : null;
+  }
+  /**
+   * Returns matching records newest-first.
+   *
+   * `initiatorUserId` only matches human initiators. `from` is inclusive and
+   * `to` is exclusive after both are normalized to instants; invalid or empty
+   * boundaries are ignored. Records are ordered by `createdAt` descending,
+   * then by `id` descending. Results are paginated with a default limit of 100;
+   * non-finite `offset`/`limit` fall back to defaults, finite values are
+   * truncated to integers, and negatives are clamped to 0.
+   */
+  async query(params) {
+    const clauses = [];
+    const values = [];
+    if (params.initiatorUserId !== void 0) {
+      values.push(params.initiatorUserId);
+      clauses.push(`initiator_user_id = $${values.length}`);
+    }
+    if (params.source !== void 0) {
+      values.push(params.source);
+      clauses.push(`source = $${values.length}`);
+    }
+    if (params.tenantId !== void 0) {
+      values.push(params.tenantId);
+      clauses.push(`tenant_id = $${values.length}`);
+    }
+    if (params.action !== void 0) {
+      values.push(params.action);
+      clauses.push(`action = $${values.length}`);
+    }
+    if (params.status !== void 0) {
+      values.push(params.status);
+      clauses.push(`status = $${values.length}`);
+    }
+    const from = normalizeBoundary(params.from);
+    if (from !== void 0) {
+      values.push(from);
+      clauses.push(`created_at >= $${values.length}`);
+    }
+    const to = normalizeBoundary(params.to);
+    if (to !== void 0) {
+      values.push(to);
+      clauses.push(`created_at < $${values.length}`);
+    }
+    const limit = normalizePagination(params.limit, 100);
+    const offset = normalizePagination(params.offset, 0);
+    values.push(limit, offset);
+    const where = clauses.length > 0 ? ` WHERE ${clauses.join(" AND ")}` : "";
+    const { rows } = await this.pool.query(
+      `SELECT * FROM ${TABLE8}${where}
+       ORDER BY created_at DESC, id DESC
+       LIMIT $${values.length - 1} OFFSET $${values.length}`,
+      values
+    );
+    return rows.map(mapRow16);
+  }
+};
+
 // src/stores/PostgreSQLChannelReplyJobStore.ts
 var import_pg31 = require("pg");
-var import_protocols13 = require("@axiom-lattice/protocols");
+var import_protocols14 = require("@axiom-lattice/protocols");
 var DB_CLOCK_MS2 = "FLOOR(EXTRACT(EPOCH FROM clock_timestamp()) * 1000)::bigint";
 var COLUMNS2 = `run_id, tenant_id, assistant_id, thread_id, adapter_channel,
   channel_installation_id, reply_target, input_message_id, stream_cursor, status,
@@ -14890,7 +15350,7 @@ function toStatus(value) {
   }
   throw new Error(`Invalid channel reply job status: ${value}`);
 }
-function mapRow16(row) {
+function mapRow17(row) {
   return {
     runId: row.run_id,
     tenantId: row.tenant_id,
@@ -14961,7 +15421,7 @@ var PostgreSQLChannelReplyJobStore = class {
   }
   /** Creates a pending job with database-clock created/updated timestamps. */
   async create(input) {
-    (0, import_protocols13.assertValidCreateChannelReplyJobInput)(input);
+    (0, import_protocols14.assertValidCreateChannelReplyJobInput)(input);
     const result = await this.pool.query(
       `WITH clock AS (SELECT ${DB_CLOCK_MS2} AS now_ms)
        INSERT INTO lattice_channel_reply_jobs (
@@ -14990,7 +15450,7 @@ var PostgreSQLChannelReplyJobStore = class {
         input.availableAt
       ]
     );
-    return mapRow16(result.rows[0]);
+    return mapRow17(result.rows[0]);
   }
   /** Reads one job within a tenant scope. */
   async get(tenantId, runId) {
@@ -15000,7 +15460,7 @@ var PostgreSQLChannelReplyJobStore = class {
         WHERE tenant_id = $1 AND run_id = $2`,
       [tenantId, runId]
     );
-    return result.rowCount === 0 ? null : mapRow16(result.rows[0]);
+    return result.rowCount === 0 ? null : mapRow17(result.rows[0]);
   }
   /** Lists claimable pending jobs that are due at `now`, oldest first. */
   async listPending(now, limit) {
@@ -15012,9 +15472,9 @@ var PostgreSQLChannelReplyJobStore = class {
           AND (lease_owner IS NULL OR lease_expires_at IS NULL OR lease_expires_at <= $1)
         ORDER BY available_at ASC, created_at ASC, run_id ASC
         LIMIT $2`,
-      [now, (0, import_protocols13.normalizeChannelReplyJobListLimit)(limit)]
+      [now, (0, import_protocols14.normalizeChannelReplyJobListLimit)(limit)]
     );
-    return result.rows.map(mapRow16);
+    return result.rows.map(mapRow17);
   }
   /**
    * Atomically leases a claimable job.
@@ -15038,7 +15498,7 @@ var PostgreSQLChannelReplyJobStore = class {
         RETURNING ${COLUMNS2}`,
       [tenantId, runId, owner, leaseMs]
     );
-    return result.rowCount === 0 ? null : mapRow16(result.rows[0]);
+    return result.rowCount === 0 ? null : mapRow17(result.rows[0]);
   }
   /**
    * Marks a job delivered when `owner` still holds the lease.
@@ -15064,7 +15524,7 @@ var PostgreSQLChannelReplyJobStore = class {
         RETURNING ${COLUMNS2}`,
       [tenantId, runId, owner, outputMessageId]
     );
-    return result.rowCount === 0 ? null : mapRow16(result.rows[0]);
+    return result.rowCount === 0 ? null : mapRow17(result.rows[0]);
   }
   /**
    * Returns a job to pending with an incremented attempt count.
@@ -15091,7 +15551,7 @@ var PostgreSQLChannelReplyJobStore = class {
         RETURNING ${COLUMNS2}`,
       [tenantId, runId, owner, error, availableAt]
     );
-    return result.rowCount === 0 ? null : mapRow16(result.rows[0]);
+    return result.rowCount === 0 ? null : mapRow17(result.rows[0]);
   }
   /**
    * Marks a job terminally failed when `owner` still holds the lease.
@@ -15116,7 +15576,7 @@ var PostgreSQLChannelReplyJobStore = class {
         RETURNING ${COLUMNS2}`,
       [tenantId, runId, owner, error]
     );
-    return result.rowCount === 0 ? null : mapRow16(result.rows[0]);
+    return result.rowCount === 0 ? null : mapRow17(result.rows[0]);
   }
   /** Deletes one job. Returns whether a row was removed. */
   async delete(tenantId, runId) {
@@ -15138,7 +15598,7 @@ var PostgreSQLChannelReplyJobStore = class {
            ORDER BY updated_at ASC, run_id ASC
            LIMIT $2
         )`,
-      [before, (0, import_protocols13.normalizeChannelReplyJobListLimit)(limit)]
+      [before, (0, import_protocols14.normalizeChannelReplyJobListLimit)(limit)]
     );
     return result.rowCount ?? 0;
   }
@@ -15592,8 +16052,8 @@ var PostgreSQLCheckpointStorage = class {
 };
 
 // src/stores/PostgreSQLStore.ts
-var import_protocols14 = require("@axiom-lattice/protocols");
-function mapRow17(row) {
+var import_protocols15 = require("@axiom-lattice/protocols");
+function mapRow18(row) {
   return {
     namespace: row.namespace,
     key: row.key,
@@ -15611,9 +16071,9 @@ var PostgreSQLStore = class {
     this.pool = pool;
   }
   async put(tenantId, input) {
-    (0, import_protocols14.assertStoreIdentity)(input.namespace, input.key);
+    (0, import_protocols15.assertStoreIdentity)(input.namespace, input.key);
     const now = /* @__PURE__ */ new Date();
-    const expiresAt = (0, import_protocols14.storeExpiresAt)(input.ttlMinutes, now) ?? null;
+    const expiresAt = (0, import_protocols15.storeExpiresAt)(input.ttlMinutes, now) ?? null;
     const result = await this.pool.query(
       `INSERT INTO lattice_store_items
         (tenant_id, namespace, key, value, created_at, updated_at, expires_at)
@@ -15625,10 +16085,10 @@ var PostgreSQLStore = class {
        RETURNING tenant_id, namespace, key, value, created_at, updated_at, expires_at`,
       [tenantId, input.namespace, input.key, JSON.stringify(input.value), now, expiresAt]
     );
-    return mapRow17(result.rows[0]);
+    return mapRow18(result.rows[0]);
   }
   async get(tenantId, namespace, key) {
-    (0, import_protocols14.assertStoreIdentity)(namespace, key);
+    (0, import_protocols15.assertStoreIdentity)(namespace, key);
     const result = await this.pool.query(
       `SELECT tenant_id, namespace, key, value, created_at, updated_at, expires_at
        FROM lattice_store_items
@@ -15636,10 +16096,10 @@ var PostgreSQLStore = class {
          AND (expires_at IS NULL OR expires_at > $4)`,
       [tenantId, namespace, key, /* @__PURE__ */ new Date()]
     );
-    return result.rows[0] ? mapRow17(result.rows[0]) : null;
+    return result.rows[0] ? mapRow18(result.rows[0]) : null;
   }
   async delete(tenantId, namespace, key) {
-    (0, import_protocols14.assertStoreIdentity)(namespace, key);
+    (0, import_protocols15.assertStoreIdentity)(namespace, key);
     const result = await this.pool.query(
       `DELETE FROM lattice_store_items
        WHERE tenant_id = $1 AND namespace = $2 AND key = $3`,
@@ -15654,7 +16114,7 @@ var PostgreSQLStore = class {
     ];
     const params = [tenantId, /* @__PURE__ */ new Date()];
     if (input.namespacePrefix) {
-      (0, import_protocols14.assertStoreNamespacePrefix)(input.namespacePrefix);
+      (0, import_protocols15.assertStoreNamespacePrefix)(input.namespacePrefix);
     }
     if (input.namespacePrefix && input.namespacePrefix.length > 0) {
       params.push(input.namespacePrefix);
@@ -15668,9 +16128,9 @@ var PostgreSQLStore = class {
       params.push(input.query.replace(/[\\%_]/g, "\\$&"));
       conditions.push(`value::text ILIKE '%' || $${params.length} || '%' ESCAPE '\\'`);
     }
-    params.push((0, import_protocols14.storePaginationValue)(input.limit, 10));
+    params.push((0, import_protocols15.storePaginationValue)(input.limit, 10));
     const limitParam = params.length;
-    params.push((0, import_protocols14.storePaginationValue)(input.offset, 0));
+    params.push((0, import_protocols15.storePaginationValue)(input.offset, 0));
     const offsetParam = params.length;
     const result = await this.pool.query(
       `SELECT tenant_id, namespace, key, value, created_at, updated_at, expires_at
@@ -15680,10 +16140,10 @@ var PostgreSQLStore = class {
        LIMIT $${limitParam} OFFSET $${offsetParam}`,
       params
     );
-    return result.rows.map(mapRow17);
+    return result.rows.map(mapRow18);
   }
   async listNamespaces(tenantId, prefix = [], limit = 100) {
-    (0, import_protocols14.assertStoreNamespacePrefix)(prefix);
+    (0, import_protocols15.assertStoreNamespacePrefix)(prefix);
     const conditions = [
       "tenant_id = $1",
       "(expires_at IS NULL OR expires_at > $2)"
@@ -15693,7 +16153,7 @@ var PostgreSQLStore = class {
       params.push(prefix);
       conditions.push(`namespace[1:array_length($${params.length}::text[], 1)] = $${params.length}`);
     }
-    params.push((0, import_protocols14.storePaginationValue)(limit, 100));
+    params.push((0, import_protocols15.storePaginationValue)(limit, 100));
     const result = await this.pool.query(
       `SELECT DISTINCT namespace
        FROM lattice_store_items
@@ -15705,7 +16165,7 @@ var PostgreSQLStore = class {
     return result.rows.map((row) => row.namespace);
   }
   async deleteExpired(now, limit) {
-    const bounded = (0, import_protocols14.storePaginationValue)(limit, 0);
+    const bounded = (0, import_protocols15.storePaginationValue)(limit, 0);
     const result = await this.pool.query(
       `WITH expired AS (
          SELECT ctid FROM lattice_store_items
@@ -15861,6 +16321,8 @@ async function createPgStoreConfig(connectionString) {
   mm.register(addOidcIdentityClaimInviteFields);
   mm.register(createPlatformSettingsTable);
   mm.register(addOidcProviderAllowedHosts);
+  mm.register(createPlatformAuditTable);
+  mm.register(createPersonalMcpServerConfigsTable);
   await mm.migrate();
   const checkpoint = import_langgraph_checkpoint_postgres.PostgresSaver.fromConnString(connectionString);
   try {
@@ -15884,6 +16346,7 @@ async function createPgStoreConfig(connectionString) {
     oidcIdentityClaim: new PostgreSQLOidcIdentityClaimStore(opts),
     inviteLink: new PostgreSQLInviteLinkStore(opts),
     platformSettings: new PostgreSQLPlatformSettingsStore(opts),
+    platformAudit: new PostgreSQLPlatformAuditStore(opts),
     channelBinding: new ChannelBindingStore(opts),
     channelInstallation: new PostgreSQLChannelInstallationStore(opts),
     thread: new PostgreSQLThreadStore(opts),
@@ -16505,6 +16968,7 @@ function mapRowToChannelIdentityMapping(row) {
   PostgreSQLOidcIdentityClaimStore,
   PostgreSQLOidcProviderConfigStore,
   PostgreSQLOpenAuditStore,
+  PostgreSQLPlatformAuditStore,
   PostgreSQLPlatformInvitationStore,
   PostgreSQLPlatformMemberStore,
   PostgreSQLPlatformSettingsStore,
@@ -16576,7 +17040,9 @@ function mapRowToChannelIdentityMapping(row) {
   createOidcIdentityClaimsTable,
   createOidcProviderConfigsTable,
   createPGVectorStoreProvider,
+  createPersonalMcpServerConfigsTable,
   createPgStoreConfig,
+  createPlatformAuditTable,
   createPlatformInvitationsTable,
   createPlatformMembersTable,
   createPlatformSettingsTable,