@axiom-lattice/local-stores 3.1.6 → 3.1.9

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@axiom-lattice/local-stores",
-  "version": "3.1.6",
+  "version": "3.1.9",
   "description": "Local SQLite-based stores for Axiom Lattice framework",
   "main": "dist/index.js",
   "module": "dist/index.mjs",
@@ -25,8 +25,8 @@
     "@types/sql.js": "^1.4.11",
     "sql.js": "^1.14.1",
     "uuid": "^14.0.1",
-    "@axiom-lattice/core": "4.2.6",
-    "@axiom-lattice/protocols": "4.1.4"
+    "@axiom-lattice/core": "4.2.9",
+    "@axiom-lattice/protocols": "4.2.1"
   },
   "devDependencies": {
     "@types/jest": "^29.5.14",

package/src/__tests__/LocalA2AApiKeyStore.test.ts

@@ -116,4 +116,13 @@ describe("LocalA2AApiKeyStore", () => {
     expect(entry.assistantIds).toEqual(["a1"]);
     expect("workspaceId" in entry).toBe(false);
   });
+
+  it("create persists grants and findById projects them back", async () => {
+    const grants = [{ domain: "kb", items: ["search"] }];
+    const created = await store.create({
+      tenantId: "t1", projectId: "p1", grants,
+    });
+    const record = await store.findById(created.id);
+    expect(record?.grants).toEqual(grants);
+  });
 });

package/src/__tests__/LocalMcpServerConfigStore.test.ts

@@ -0,0 +1,77 @@
+// The @axiom-lattice/core barrel cannot load under jest in this package (ESM-only
+// transitive deps), so mock it with the real encryption module — node:crypto only.
+jest.mock("@axiom-lattice/core", () => ({
+  ...jest.requireActual("../../../core/src/util/encryption"),
+}));
+
+import { afterEach, beforeEach, describe, expect, it } from "@jest/globals";
+import { tmpdir } from "os";
+import path from "path";
+
+import { closeDatabase, initDatabase } from "../database";
+import { LocalMcpServerConfigStore } from "../stores/LocalMcpServerConfigStore";
+
+const nextDbPath = (): string => path.join(
+  tmpdir(), `lt-mcp-config-${Date.now()}-${Math.random().toString(36).slice(2)}.db`,
+);
+
+const httpConfig = {
+  name: "remote",
+  version: "1.0.0",
+  transport: "streamable_http" as const,
+  url: "https://mcp.example.com/mcp",
+  headers: { Authorization: "Bearer sk-secret-token" },
+};
+
+describe("LocalMcpServerConfigStore secret handling", () => {
+  let store: LocalMcpServerConfigStore;
+  let db: Awaited<ReturnType<typeof initDatabase>>;
+
+  beforeEach(async () => {
+    db = await initDatabase({ dbPath: nextDbPath() });
+    store = new LocalMcpServerConfigStore(db);
+  });
+  afterEach(() => closeDatabase());
+
+  it("encrypts env and headers at rest and decrypts on read", async () => {
+    await store.createConfig("tenant-1", "cfg-1", {
+      key: "remote",
+      config: { ...httpConfig, env: { MCP_TOKEN: "env-secret" } },
+    });
+
+    const row = db.prepare(
+      "SELECT config, is_env_encrypted FROM lt_mcp_configs WHERE id = ?",
+    ).get("cfg-1") as unknown as { config: string; is_env_encrypted: number };
+    expect(row.is_env_encrypted).toBe(1);
+    const atRest = JSON.parse(row.config);
+    expect(atRest.env.MCP_TOKEN).not.toBe("env-secret");
+    expect(atRest.headers.Authorization).not.toBe("Bearer sk-secret-token");
+
+    const read = await store.getConfigByKey("tenant-1", "remote");
+    expect(read?.config.env?.MCP_TOKEN).toBe("env-secret");
+    expect(read?.config.headers?.Authorization).toBe("Bearer sk-secret-token");
+  });
+
+  it("round-trips configs without secrets and leaves no headers key", async () => {
+    await store.createConfig("tenant-1", "cfg-2", {
+      key: "plain",
+      config: {
+        name: "plain", version: "1.0.0", transport: "stdio",
+        command: "npx", args: ["-y", "@modelcontextprotocol/server-everything"],
+      },
+    });
+    const read = await store.getConfigByKey("tenant-1", "plain");
+    expect(read?.config.headers).toBeUndefined();
+    expect(read?.config.command).toBe("npx");
+    expect(read?.isEnvEncrypted).toBe(false);
+  });
+
+  it("re-encrypts rotated header secrets on update", async () => {
+    await store.createConfig("tenant-1", "cfg-3", { key: "remote", config: httpConfig });
+    await store.updateConfig("tenant-1", "cfg-3", {
+      config: { ...httpConfig, headers: { Authorization: "Bearer rotated-token" } },
+    });
+    const read = await store.getConfigByKey("tenant-1", "remote");
+    expect(read?.config.headers?.Authorization).toBe("Bearer rotated-token");
+  });
+});

package/src/__tests__/LocalOpenAuditStore.test.ts

@@ -0,0 +1,116 @@
+import { describe, expect, it, beforeEach, afterEach } from "@jest/globals";
+import { tmpdir } from "os";
+import path from "path";
+import { initDatabase, closeDatabase, type DatabaseWrapper } from "../database";
+import { LocalOpenAuditStore } from "../stores/LocalOpenAuditStore";
+
+const nextDbPath = () =>
+  path.join(tmpdir(), `lt-open-audit-test-${Date.now()}-${Math.random().toString(36).slice(2)}.db`);
+
+describe("LocalOpenAuditStore", () => {
+  let store: LocalOpenAuditStore;
+  let db: DatabaseWrapper;
+
+  beforeEach(async () => {
+    db = await initDatabase({ dbPath: nextDbPath() });
+    store = new LocalOpenAuditStore(db);
+  });
+
+  afterEach(async () => {
+    closeDatabase();
+  });
+
+  it("appends rows with redactable args and rounded duration", async () => {
+    await store.append({
+      tenantId: "t1",
+      credentialId: "k1",
+      credentialKind: "api_key",
+      projectId: "p1",
+      domain: "kb",
+      action: "search",
+      args: { query: "退款" },
+      status: "ok",
+      durationMs: 4.6,
+    });
+
+    const row = db
+      .prepare(`SELECT * FROM lt_open_audit`)
+      .get() as Record<string, unknown>;
+    expect(row.tenant_id).toBe("t1");
+    expect(row.domain).toBe("kb");
+    expect(row.status).toBe("ok");
+    expect(row.duration_ms).toBe(5);
+    expect(JSON.parse(row.args as string)).toEqual({ query: "退款" });
+  });
+
+  it("stores null args and an error code", async () => {
+    await store.append({
+      tenantId: "t1",
+      credentialId: "c",
+      credentialKind: "browser_token",
+      projectId: "p1",
+      domain: "sandbox",
+      action: "shell_exec",
+      args: undefined,
+      status: "error",
+      errorCode: "GRANT_DENIED",
+      durationMs: 2,
+    });
+    const row = db
+      .prepare(`SELECT * FROM lt_open_audit`)
+      .get() as Record<string, unknown>;
+    expect(row.args).toBeNull();
+    expect(row.error_code).toBe("GRANT_DENIED");
+  });
+});
+
+describe("LocalOpenAuditStore.query", () => {
+  let store: LocalOpenAuditStore;
+  let db: DatabaseWrapper;
+
+  beforeEach(async () => {
+    db = await initDatabase({ dbPath: nextDbPath() });
+    store = new LocalOpenAuditStore(db);
+    for (const [domain, status] of [["kb", "ok"], ["sandbox", "error"], ["kb", "ok"]] as const) {
+      await store.append({
+        tenantId: "t1",
+        credentialId: "k1",
+        credentialKind: "api_key",
+        projectId: "p1",
+        domain,
+        action: "x",
+        args: {},
+        status,
+        durationMs: 1,
+      });
+    }
+    // A different tenant must not leak.
+    await store.append({
+      tenantId: "t2",
+      credentialId: "k2",
+      credentialKind: "api_key",
+      projectId: "p9",
+      domain: "kb",
+      action: "x",
+      args: {},
+      status: "ok",
+      durationMs: 1,
+    });
+  });
+
+  afterEach(() => closeDatabase());
+
+  it("filters by tenant and domain", async () => {
+    const rows = await store.query({ tenantId: "t1", domain: "kb" });
+    expect(rows).toHaveLength(2);
+    expect(rows.every((r) => r.domain === "kb")).toBe(true);
+  });
+
+  it("filters by status and paginates newest-first", async () => {
+    const errors = await store.query({ tenantId: "t1", status: "error" });
+    expect(errors).toHaveLength(1);
+    expect(errors[0].domain).toBe("sandbox");
+    const limited = await store.query({ tenantId: "t1", limit: 1, offset: 0 });
+    expect(limited).toHaveLength(1);
+  });
+});

package/src/__tests__/LocalProjectRoomReadStateStore.test.ts

@@ -0,0 +1,101 @@
+import { afterEach, beforeEach, describe, expect, it } from "@jest/globals";
+import { existsSync, unlinkSync } from "fs";
+import { tmpdir } from "os";
+import path from "path";
+import { closeDatabase, initDatabase } from "../database";
+import { LocalProjectRoomReadStateStore } from "../stores/LocalProjectRoomReadStateStore";
+
+const nextDbPath = (): string => path.join(tmpdir(), `lt-read-state-${Date.now()}-${Math.random().toString(36).slice(2)}.db`);
+
+describe("LocalProjectRoomReadStateStore", () => {
+  let dbPath: string;
+
+  beforeEach(() => { dbPath = nextDbPath(); });
+  afterEach(() => {
+    closeDatabase();
+    if (existsSync(dbPath)) unlinkSync(dbPath);
+  });
+
+  it("upserts monotonically and isolates scope", async () => {
+    const store = new LocalProjectRoomReadStateStore(await initDatabase({ dbPath }));
+    await expect(store.get("t1", "room-1", "u1")).resolves.toBeNull();
+    await store.markRead({ tenantId: "t1", roomId: "room-1", userId: "u1", lastReadAt: new Date(1000) });
+    await store.markRead({ tenantId: "t1", roomId: "room-1", userId: "u1", lastReadAt: new Date(2000) });
+    await store.markRead({ tenantId: "t1", roomId: "room-1", userId: "u1", lastReadAt: new Date(500) });
+    expect((await store.get("t1", "room-1", "u1"))?.lastReadAt.getTime()).toBe(2000);
+    await expect(store.get("t1", "room-2", "u1")).resolves.toBeNull();
+    await expect(store.get("t2", "room-1", "u1")).resolves.toBeNull();
+    await expect(store.get("t1", "room-1", "u2")).resolves.toBeNull();
+  });
+
+  it("rejects an invalid lastReadAt without writing", async () => {
+    const store = new LocalProjectRoomReadStateStore(await initDatabase({ dbPath }));
+    await expect(store.markRead({ tenantId: "t1", roomId: "room-1", userId: "u1", lastReadAt: new Date(Number.NaN) })).rejects.toBeInstanceOf(RangeError);
+    await expect(store.get("t1", "room-1", "u1")).resolves.toBeNull();
+  });
+
+  it("persists markers across reopen with hydrated dates", async () => {
+    const initial = new LocalProjectRoomReadStateStore(await initDatabase({ dbPath }));
+    const saved = await initial.markRead({ tenantId: "t1", roomId: "room-1", userId: "u1", lastReadAt: new Date(1500) });
+    expect(saved.lastReadAt.getTime()).toBe(1500);
+    expect(saved.updatedAt).toBeInstanceOf(Date);
+    closeDatabase();
+
+    const reopened = new LocalProjectRoomReadStateStore(await initDatabase({ dbPath }));
+    const persisted = await reopened.get("t1", "room-1", "u1");
+    expect(persisted).toEqual(saved);
+    expect(persisted?.lastReadAt).toBeInstanceOf(Date);
+    expect(persisted?.updatedAt).toBeInstanceOf(Date);
+  });
+
+  it("upgrades a version-1 project room database by adding the read-state table", async () => {
+    const db = await initDatabase({ dbPath });
+    db.exec(`CREATE TABLE lt_project_rooms (
+      id TEXT NOT NULL, tenant_id TEXT NOT NULL, workspace_id TEXT NOT NULL, project_id TEXT NOT NULL,
+      type TEXT NOT NULL CHECK (type = 'main'), name TEXT NOT NULL, created_at TEXT NOT NULL, updated_at TEXT NOT NULL,
+      PRIMARY KEY (tenant_id, id), UNIQUE (tenant_id, project_id, type)
+    );
+    CREATE TABLE lt_project_memberships (
+      id TEXT NOT NULL, tenant_id TEXT NOT NULL, project_id TEXT NOT NULL, user_id TEXT NOT NULL,
+      role TEXT NOT NULL CHECK (role IN ('owner','admin','member','viewer')),
+      status TEXT NOT NULL CHECK (status IN ('active','removed')), joined_at TEXT NOT NULL, updated_at TEXT NOT NULL,
+      PRIMARY KEY (tenant_id, id), UNIQUE (tenant_id, project_id, user_id)
+    );
+    CREATE INDEX idx_lt_project_memberships_project ON lt_project_memberships (tenant_id, project_id);
+    CREATE TABLE lt_project_bot_memberships (
+      id TEXT NOT NULL, tenant_id TEXT NOT NULL, workspace_id TEXT NOT NULL, project_id TEXT NOT NULL,
+      room_id TEXT NOT NULL, assistant_id TEXT NOT NULL, role TEXT NOT NULL CHECK (role IN ('coordinator','specialist')),
+      title TEXT NOT NULL, responsibility TEXT, mention_name TEXT NOT NULL,
+      status TEXT NOT NULL CHECK (status IN ('active','paused','removed')), room_thread_id TEXT NOT NULL,
+      joined_at TEXT NOT NULL, updated_at TEXT NOT NULL, PRIMARY KEY (tenant_id, id),
+      UNIQUE (tenant_id, project_id, assistant_id)
+    );
+    CREATE UNIQUE INDEX uq_lt_project_bot_memberships_coordinator
+      ON lt_project_bot_memberships (tenant_id, project_id) WHERE role = 'coordinator' AND status IN ('active','paused');
+    CREATE UNIQUE INDEX uq_lt_project_bot_memberships_mention
+      ON lt_project_bot_memberships (tenant_id, room_id, mention_name) WHERE status IN ('active','paused');
+    CREATE INDEX idx_lt_project_bot_memberships_project ON lt_project_bot_memberships (tenant_id, project_id);
+    CREATE INDEX idx_lt_project_bot_memberships_room ON lt_project_bot_memberships (tenant_id, room_id);
+    CREATE TABLE lt_project_room_messages (
+      id TEXT NOT NULL, tenant_id TEXT NOT NULL, workspace_id TEXT NOT NULL, project_id TEXT NOT NULL, room_id TEXT NOT NULL,
+      author TEXT NOT NULL, content TEXT NOT NULL, mentions TEXT NOT NULL DEFAULT '[]', reply_to_message_id TEXT,
+      source TEXT NOT NULL CHECK (source IN ('user','agent','task','routine','system')), source_id TEXT,
+      idempotency_key TEXT, created_at TEXT NOT NULL, PRIMARY KEY (tenant_id, id)
+    );
+    CREATE UNIQUE INDEX uq_lt_project_room_messages_idempotency
+      ON lt_project_room_messages (tenant_id, room_id, idempotency_key) WHERE idempotency_key IS NOT NULL;
+    CREATE INDEX idx_lt_project_room_messages_room_created
+      ON lt_project_room_messages (tenant_id, room_id, created_at DESC, id DESC);
+    CREATE TABLE lattice_schema_migrations (
+      store_name TEXT NOT NULL, name TEXT NOT NULL, version INTEGER NOT NULL, applied_at TEXT NOT NULL,
+      PRIMARY KEY (store_name, name)
+    );`);
+    db.getRawDb().run("INSERT INTO lattice_schema_migrations (store_name, name, version, applied_at) VALUES (?, ?, ?, ?)", ["project_room", "create_project_room_tables", 1, new Date().toISOString()]);
+
+    const store = new LocalProjectRoomReadStateStore(db);
+    await expect(store.get("t1", "room-1", "u1")).resolves.toBeNull();
+    await store.markRead({ tenantId: "t1", roomId: "room-1", userId: "u1", lastReadAt: new Date(1000) });
+    expect((await store.get("t1", "room-1", "u1"))?.lastReadAt.getTime()).toBe(1000);
+    expect(db.prepare("SELECT name, version FROM lattice_schema_migrations WHERE store_name = ? AND name = ?").get("project_room", "create_project_room_read_states")).toMatchObject({ name: "create_project_room_read_states", version: 2 });
+  });
+});

package/src/__tests__/LocalProjectRoomStores.test.ts

@@ -337,6 +337,45 @@ describe("local project room stores", () => {
     await expect(store.list({ tenantId: "t1", roomId: "r1", before: { createdAt: new Date("invalid"), id: "x" }, limit: 1 })).rejects.toBeInstanceOf(RangeError);
   });
 
+  it("counts messages strictly after the horizon with optional human-author exclusion", async () => {
+    const db = await initDatabase({ dbPath });
+    const store = new LocalProjectRoomMessageStore(db);
+    const insert = (id: string, author: string, createdAt: string) => transaction(db, () => {
+      write(db, "INSERT INTO lt_project_room_messages (id, tenant_id, workspace_id, project_id, room_id, author, content, mentions, reply_to_message_id, source, source_id, idempotency_key, created_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)",
+        [id, "t1", "w1", "p1", "r1", author, '{"type":"text","text":"text"}', "[]", null, "user", null, null, createdAt]);
+    });
+    insert("m1", '{"type":"human","userId":"u1"}', "2026-01-01T00:00:01.000Z");
+    insert("m2", '{"type":"human","userId":"u1"}', "2026-01-01T00:00:02.000Z");
+    insert("m3", '{"type":"human","userId":"u2"}', "2026-01-01T00:00:03.000Z");
+    insert("m4", '{"type":"bot","membershipId":"b1","assistantId":"a1"}', "2026-01-01T00:00:04.000Z");
+    const horizon = new Date("2026-01-01T00:00:01.000Z");
+
+    expect(await store.countAfter({ tenantId: "t1", roomId: "r1", after: horizon })).toBe(3);
+    expect(await store.countAfter({ tenantId: "t1", roomId: "r1", after: new Date("2026-01-01T00:00:04.000Z") })).toBe(0);
+    expect(await store.countAfter({ tenantId: "t1", roomId: "r1", after: new Date(0) })).toBe(4);
+    expect(await store.countAfter({ tenantId: "t1", roomId: "r1", after: horizon, excludeAuthorUserId: "u1" })).toBe(2);
+    expect(await store.countAfter({ tenantId: "t1", roomId: "r1", after: horizon, excludeAuthorUserId: "u2" })).toBe(2);
+    expect(await store.countAfter({ tenantId: "t1", roomId: "r1", after: new Date("2026-01-01T00:00:03.000Z"), excludeAuthorUserId: "u2" })).toBe(1);
+  });
+
+  it("scopes countAfter by tenant and room and rejects invalid horizons", async () => {
+    const db = await initDatabase({ dbPath });
+    const store = new LocalProjectRoomMessageStore(db);
+    const insert = (id: string, tenantId: string, roomId: string, createdAt: string) => transaction(db, () => {
+      write(db, "INSERT INTO lt_project_room_messages (id, tenant_id, workspace_id, project_id, room_id, author, content, mentions, reply_to_message_id, source, source_id, idempotency_key, created_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)",
+        [id, tenantId, "w1", "p1", roomId, '{"type":"system"}', '{"type":"text","text":"text"}', "[]", null, "system", null, null, createdAt]);
+    });
+    insert("m1", "t1", "r1", "2026-01-01T00:00:01.000Z");
+    insert("m2", "t1", "r2", "2026-01-01T00:00:02.000Z");
+    insert("m3", "t2", "r1", "2026-01-01T00:00:03.000Z");
+
+    expect(await store.countAfter({ tenantId: "t1", roomId: "r1", after: new Date(0) })).toBe(1);
+    expect(await store.countAfter({ tenantId: "t1", roomId: "r2", after: new Date(0) })).toBe(1);
+    expect(await store.countAfter({ tenantId: "t2", roomId: "r1", after: new Date(0) })).toBe(1);
+    expect(await store.countAfter({ tenantId: "t1", roomId: "r1", after: new Date("2026-01-01T00:00:01.000Z") })).toBe(0);
+    await expect(store.countAfter({ tenantId: "t1", roomId: "r1", after: new Date(Number.NaN) })).rejects.toBeInstanceOf(RangeError);
+  });
+
   it("classifies a room message ID collision that occurs after preflight", async () => {
     const db = await initDatabase({ dbPath });
     const store = new LocalProjectRoomMessageStore(db);
@@ -353,4 +392,26 @@ describe("local project room stores", () => {
 
     await expect(store.create({ id: "race-id", tenantId: "t1", workspaceId: "w1", projectId: "p1", roomId: "r1", author: { type: "system" }, content: { type: "text", text: "message" }, mentions: [], source: "system" })).rejects.toBeInstanceOf(ProjectRoomMessageIdConflictError);
   });
+
+  it("skips individually invalid rows when listing while preserving valid rows", async () => {
+    const db = await initDatabase({ dbPath });
+    const store = new LocalProjectRoomMessageStore(db);
+    await store.create({
+      id: "m1", tenantId: "t1", workspaceId: "w1", projectId: "p1", roomId: "r1",
+      author: { type: "human", userId: "u1" }, content: { type: "text", text: "hello" },
+      mentions: [], source: "user",
+    });
+    transaction(db, () => {
+      write(db, "INSERT INTO lt_project_room_messages (id, tenant_id, workspace_id, project_id, room_id, author, content, mentions, reply_to_message_id, source, source_id, idempotency_key, created_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)",
+        ["bad", "t1", "w1", "p1", "r1", '{"type":"human","userId":"u1"}', '{"text":"missing type"}', "[]", null, "user", null, null, "2026-01-01T00:00:00.000Z"]);
+    });
+    const warn = jest.spyOn(console, "warn").mockImplementation(() => undefined);
+    const page = await store.list({ tenantId: "t1", roomId: "r1", limit: 10 });
+    expect(page.map((message) => message.id)).toEqual(["m1"]);
+    expect(warn).toHaveBeenCalledWith(
+      "[ProjectRoomMessageStore] Skipping invalid message row",
+      expect.objectContaining({ tenantId: "t1", roomId: "r1", rowId: "bad" }),
+    );
+    warn.mockRestore();
+  });
 });

package/src/createLocalStoreConfig.ts

@@ -24,6 +24,7 @@ import { LocalProjectRoomStore } from "./stores/LocalProjectRoomStore";
 import { LocalProjectMembershipStore } from "./stores/LocalProjectMembershipStore";
 import { LocalProjectBotMembershipStore } from "./stores/LocalProjectBotMembershipStore";
 import { LocalProjectRoomMessageStore } from "./stores/LocalProjectRoomMessageStore";
+import { LocalProjectRoomReadStateStore } from "./stores/LocalProjectRoomReadStateStore";
 import { LocalUserStore } from "./stores/LocalUserStore";
 import { LocalTenantStore } from "./stores/LocalTenantStore";
 import { LocalUserTenantLinkStore } from "./stores/LocalUserTenantLinkStore";
@@ -36,6 +37,7 @@ import { LocalEvalStore } from "./stores/LocalEvalStore";
 import { LocalChannelBindingStore } from "./stores/LocalChannelBindingStore";
 import { LocalChannelInstallationStore } from "./stores/LocalChannelInstallationStore";
 import { LocalA2AApiKeyStore } from "./stores/LocalA2AApiKeyStore";
+import { LocalOpenAuditStore } from "./stores/LocalOpenAuditStore";
 import { LocalThreadMessageQueueStore } from "./stores/LocalThreadMessageQueueStore";
 import { LocalSkillStore } from "./stores/LocalSkillStore";
 import { LocalScheduleStorage } from "./stores/LocalScheduleStorage";
@@ -74,6 +76,7 @@ export async function createLocalStoreConfig(options: LocalStoreConfigOptions =
     projectMembership: new LocalProjectMembershipStore(db),
     projectBotMembership: new LocalProjectBotMembershipStore(db),
     projectRoomMessage: new LocalProjectRoomMessageStore(db),
+    projectRoomReadState: new LocalProjectRoomReadStateStore(db),
     user: new LocalUserStore(db),
     tenant: new LocalTenantStore(db),
     userTenantLink: new LocalUserTenantLinkStore(db),
@@ -86,6 +89,7 @@ export async function createLocalStoreConfig(options: LocalStoreConfigOptions =
     channelBinding: new LocalChannelBindingStore(db),
     channelInstallation: new LocalChannelInstallationStore(db),
     a2aApiKey: new LocalA2AApiKeyStore(db),
+    openAudit: new LocalOpenAuditStore(db),
     threadMessageQueue: new LocalThreadMessageQueueStore(db),
     skill: new LocalSkillStore(db),
     schedule: new LocalScheduleStorage(db),

package/src/index.ts

@@ -35,6 +35,7 @@ export { LocalProjectRoomStore } from "./stores/LocalProjectRoomStore";
 export { LocalProjectMembershipStore, DuplicateProjectMembershipError, ProjectMembershipIdConflictError } from "./stores/LocalProjectMembershipStore";
 export { LocalProjectBotMembershipStore, ProjectBotMembershipIdConflictError } from "./stores/LocalProjectBotMembershipStore";
 export { LocalProjectRoomMessageStore, ProjectRoomMessageIdConflictError, DuplicateProjectRoomMessageIdempotencyKeyError } from "./stores/LocalProjectRoomMessageStore";
+export { LocalProjectRoomReadStateStore } from "./stores/LocalProjectRoomReadStateStore";
 export { LocalUserStore } from "./stores/LocalUserStore";
 export { LocalTenantStore } from "./stores/LocalTenantStore";
 export { LocalUserTenantLinkStore } from "./stores/LocalUserTenantLinkStore";
@@ -54,3 +55,5 @@ export { LocalTaskStore } from "./stores/LocalTaskStore";
 export { LocalTaskWorkItemStore } from "./stores/LocalTaskWorkItemStore";
 export { LocalCapabilityBundleStore } from "./stores/LocalCapabilityBundleStore";
 export { InMemoryConversationStore } from "./stores/InMemoryConversationStore";
+
+export * from "./stores/LocalOpenAuditStore";

package/src/stores/LocalA2AApiKeyStore.ts

@@ -4,10 +4,12 @@
 
 import { DatabaseWrapper } from "../database";
 import type {
+  UpdateA2AApiKeyInput,
   A2AApiKeyStore,
   A2AApiKeyRecord,
   CreateA2AApiKeyInput,
   A2AApiKeyEntry,
+  OpenGrant,
 } from "@axiom-lattice/protocols";
 import { ensureTable, nowISO, parseISO } from "../database";
 import { encrypt, decrypt } from "@axiom-lattice/core";
@@ -20,6 +22,7 @@ CREATE TABLE IF NOT EXISTS lt_a2a_api_keys (
   tenant_id TEXT NOT NULL,
   project_id TEXT,
   assistant_ids TEXT,
+  grants TEXT,
   label TEXT,
   enabled INTEGER NOT NULL DEFAULT 1,
   created_at TEXT NOT NULL,
@@ -33,6 +36,7 @@ interface KeyRow {
   tenant_id: string;
   project_id: string;
   assistant_ids: string | null;
+  grants: string | null;
   label: string | null;
   enabled: number;
   created_at: string;
@@ -43,6 +47,16 @@ function generateApiKey(): string {
   return `a2a_${randomUUID().replace(/-/g, "")}`;
 }
 
+function parseGrants(raw: string | null): OpenGrant[] | undefined {
+  if (!raw) return undefined;
+  try {
+    const parsed = JSON.parse(raw);
+    return Array.isArray(parsed) ? (parsed as OpenGrant[]) : undefined;
+  } catch {
+    return undefined;
+  }
+}
+
 function parseAssistantIds(raw: string | null): string[] | undefined {
   if (!raw) return undefined;
   try {
@@ -62,6 +76,7 @@ export class LocalA2AApiKeyStore implements A2AApiKeyStore {
     ensureTable(db, DDL);
     // Existing installs: add columns shipped after the original schema.
     this.ensureColumn("lt_a2a_api_keys", "assistant_ids", "assistant_ids TEXT");
+    this.ensureColumn("lt_a2a_api_keys", "grants", "grants TEXT");
     this.repairManagementIds();
   }
 
@@ -128,9 +143,9 @@ export class LocalA2AApiKeyStore implements A2AApiKeyStore {
     const key = generateApiKey();
     const now = nowISO();
     this.db.prepare(
-      `INSERT INTO lt_a2a_api_keys (id, key_value, tenant_id, project_id, assistant_ids, label, created_at, updated_at)
-       VALUES (?, ?, ?, ?, ?, ?, ?, ?)`,
-    ).run(id, encrypt(key), input.tenantId, input.projectId, input.assistantIds ? JSON.stringify(input.assistantIds) : null, input.label || null, now, now);
+      `INSERT INTO lt_a2a_api_keys (id, key_value, tenant_id, project_id, assistant_ids, grants, label, created_at, updated_at)
+       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+    ).run(id, encrypt(key), input.tenantId, input.projectId, input.assistantIds ? JSON.stringify(input.assistantIds) : null, input.grants ? JSON.stringify(input.grants) : null, input.label || null, now, now);
 
     const record: A2AApiKeyRecord = {
       id,
@@ -166,6 +181,28 @@ export class LocalA2AApiKeyStore implements A2AApiKeyStore {
     return mapRowToRecord(row);
   }
 
+
+  async update(id: string, input: UpdateA2AApiKeyInput): Promise<A2AApiKeyRecord> {
+    const sets: string[] = [];
+    const values: unknown[] = [];
+    if (input.label !== undefined) { sets.push("label = ?"); values.push(input.label || null); }
+    if (input.projectId !== undefined) { sets.push("project_id = ?"); values.push(input.projectId); }
+    if (input.assistantIds !== undefined) { sets.push("assistant_ids = ?"); values.push(input.assistantIds ? JSON.stringify(input.assistantIds) : null); }
+    if (input.grants !== undefined) { sets.push("grants = ?"); values.push(input.grants ? JSON.stringify(input.grants) : null); }
+    if (sets.length === 0) {
+      const row = this.db.prepare("SELECT * FROM lt_a2a_api_keys WHERE id = ?").get(id) as unknown as KeyRow | undefined;
+      if (!row) throw new Error(`A2A API key not found: ${id}`);
+      return mapRowToRecord(row);
+    }
+    sets.push("updated_at = ?");
+    values.push(nowISO());
+    values.push(id);
+    this.db.prepare(`UPDATE lt_a2a_api_keys SET ${sets.join(", ")} WHERE id = ?`).run(...values);
+    const row = this.db.prepare("SELECT * FROM lt_a2a_api_keys WHERE id = ?").get(id) as unknown as KeyRow | undefined;
+    if (!row) throw new Error(`A2A API key not found: ${id}`);
+    return mapRowToRecord(row);
+  }
+
   async rotate(id: string): Promise<A2AApiKeyRecord> {
     const key = generateApiKey();
     const now = nowISO();
@@ -212,6 +249,7 @@ function mapRowToRecord(row: KeyRow): A2AApiKeyRecord {
     tenantId: row.tenant_id,
     projectId: row.project_id,
     assistantIds: parseAssistantIds(row.assistant_ids),
+    grants: parseGrants(row.grants),
     label: row.label || undefined,
     enabled: row.enabled === 1,
     createdAt: parseISO(row.created_at),

package/src/stores/LocalMcpServerConfigStore.ts

@@ -191,6 +191,19 @@ function mapRowToEntry(row: ConfigRow): McpServerConfigEntry {
     }
   }
 
+  if (config.headers && row.is_env_encrypted) {
+    try {
+      const decryptedHeaders: Record<string, string> = {};
+      for (const [key, value] of Object.entries(config.headers)) {
+        decryptedHeaders[key] = decrypt(value);
+      }
+      config.headers = decryptedHeaders;
+    } catch (error) {
+      console.error("Failed to decrypt MCP server headers:", error);
+      throw new Error("Failed to decrypt MCP server configuration");
+    }
+  }
+
   return {
     id: row.id,
     tenantId: row.tenant_id,
@@ -219,5 +232,14 @@ function encryptEnvInConfig(config: McpServerConfig): { config: McpServerConfig;
     isEnvEncrypted = true;
   }
 
+  if (configCopy.headers && Object.keys(configCopy.headers).length > 0) {
+    const encryptedHeaders: Record<string, string> = {};
+    for (const [key, value] of Object.entries(configCopy.headers)) {
+      encryptedHeaders[key] = encrypt(value);
+    }
+    configCopy.headers = encryptedHeaders;
+    isEnvEncrypted = true;
+  }
+
   return { config: configCopy, isEnvEncrypted };
 }