@axiom-lattice/local-stores 3.1.8 → 3.1.9

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@axiom-lattice/local-stores",
-  "version": "3.1.8",
+  "version": "3.1.9",
   "description": "Local SQLite-based stores for Axiom Lattice framework",
   "main": "dist/index.js",
   "module": "dist/index.mjs",
@@ -25,8 +25,8 @@
     "@types/sql.js": "^1.4.11",
     "sql.js": "^1.14.1",
     "uuid": "^14.0.1",
-    "@axiom-lattice/core": "4.2.8",
-    "@axiom-lattice/protocols": "4.2.0"
+    "@axiom-lattice/core": "4.2.9",
+    "@axiom-lattice/protocols": "4.2.1"
   },
   "devDependencies": {
     "@types/jest": "^29.5.14",

package/src/__tests__/LocalA2AApiKeyStore.test.ts

@@ -116,4 +116,13 @@ describe("LocalA2AApiKeyStore", () => {
     expect(entry.assistantIds).toEqual(["a1"]);
     expect("workspaceId" in entry).toBe(false);
   });
+
+  it("create persists grants and findById projects them back", async () => {
+    const grants = [{ domain: "kb", items: ["search"] }];
+    const created = await store.create({
+      tenantId: "t1", projectId: "p1", grants,
+    });
+    const record = await store.findById(created.id);
+    expect(record?.grants).toEqual(grants);
+  });
 });

package/src/__tests__/LocalOpenAuditStore.test.ts

@@ -0,0 +1,116 @@
+import { describe, expect, it, beforeEach, afterEach } from "@jest/globals";
+import { tmpdir } from "os";
+import path from "path";
+import { initDatabase, closeDatabase, type DatabaseWrapper } from "../database";
+import { LocalOpenAuditStore } from "../stores/LocalOpenAuditStore";
+
+const nextDbPath = () =>
+  path.join(tmpdir(), `lt-open-audit-test-${Date.now()}-${Math.random().toString(36).slice(2)}.db`);
+
+describe("LocalOpenAuditStore", () => {
+  let store: LocalOpenAuditStore;
+  let db: DatabaseWrapper;
+
+  beforeEach(async () => {
+    db = await initDatabase({ dbPath: nextDbPath() });
+    store = new LocalOpenAuditStore(db);
+  });
+
+  afterEach(async () => {
+    closeDatabase();
+  });
+
+  it("appends rows with redactable args and rounded duration", async () => {
+    await store.append({
+      tenantId: "t1",
+      credentialId: "k1",
+      credentialKind: "api_key",
+      projectId: "p1",
+      domain: "kb",
+      action: "search",
+      args: { query: "退款" },
+      status: "ok",
+      durationMs: 4.6,
+    });
+
+    const row = db
+      .prepare(`SELECT * FROM lt_open_audit`)
+      .get() as Record<string, unknown>;
+    expect(row.tenant_id).toBe("t1");
+    expect(row.domain).toBe("kb");
+    expect(row.status).toBe("ok");
+    expect(row.duration_ms).toBe(5);
+    expect(JSON.parse(row.args as string)).toEqual({ query: "退款" });
+  });
+
+  it("stores null args and an error code", async () => {
+    await store.append({
+      tenantId: "t1",
+      credentialId: "c",
+      credentialKind: "browser_token",
+      projectId: "p1",
+      domain: "sandbox",
+      action: "shell_exec",
+      args: undefined,
+      status: "error",
+      errorCode: "GRANT_DENIED",
+      durationMs: 2,
+    });
+    const row = db
+      .prepare(`SELECT * FROM lt_open_audit`)
+      .get() as Record<string, unknown>;
+    expect(row.args).toBeNull();
+    expect(row.error_code).toBe("GRANT_DENIED");
+  });
+});
+
+describe("LocalOpenAuditStore.query", () => {
+  let store: LocalOpenAuditStore;
+  let db: DatabaseWrapper;
+
+  beforeEach(async () => {
+    db = await initDatabase({ dbPath: nextDbPath() });
+    store = new LocalOpenAuditStore(db);
+    for (const [domain, status] of [["kb", "ok"], ["sandbox", "error"], ["kb", "ok"]] as const) {
+      await store.append({
+        tenantId: "t1",
+        credentialId: "k1",
+        credentialKind: "api_key",
+        projectId: "p1",
+        domain,
+        action: "x",
+        args: {},
+        status,
+        durationMs: 1,
+      });
+    }
+    // A different tenant must not leak.
+    await store.append({
+      tenantId: "t2",
+      credentialId: "k2",
+      credentialKind: "api_key",
+      projectId: "p9",
+      domain: "kb",
+      action: "x",
+      args: {},
+      status: "ok",
+      durationMs: 1,
+    });
+  });
+
+  afterEach(() => closeDatabase());
+
+  it("filters by tenant and domain", async () => {
+    const rows = await store.query({ tenantId: "t1", domain: "kb" });
+    expect(rows).toHaveLength(2);
+    expect(rows.every((r) => r.domain === "kb")).toBe(true);
+  });
+
+  it("filters by status and paginates newest-first", async () => {
+    const errors = await store.query({ tenantId: "t1", status: "error" });
+    expect(errors).toHaveLength(1);
+    expect(errors[0].domain).toBe("sandbox");
+    const limited = await store.query({ tenantId: "t1", limit: 1, offset: 0 });
+    expect(limited).toHaveLength(1);
+  });
+});

package/src/__tests__/LocalProjectRoomStores.test.ts

@@ -392,4 +392,26 @@ describe("local project room stores", () => {
 
     await expect(store.create({ id: "race-id", tenantId: "t1", workspaceId: "w1", projectId: "p1", roomId: "r1", author: { type: "system" }, content: { type: "text", text: "message" }, mentions: [], source: "system" })).rejects.toBeInstanceOf(ProjectRoomMessageIdConflictError);
   });
+
+  it("skips individually invalid rows when listing while preserving valid rows", async () => {
+    const db = await initDatabase({ dbPath });
+    const store = new LocalProjectRoomMessageStore(db);
+    await store.create({
+      id: "m1", tenantId: "t1", workspaceId: "w1", projectId: "p1", roomId: "r1",
+      author: { type: "human", userId: "u1" }, content: { type: "text", text: "hello" },
+      mentions: [], source: "user",
+    });
+    transaction(db, () => {
+      write(db, "INSERT INTO lt_project_room_messages (id, tenant_id, workspace_id, project_id, room_id, author, content, mentions, reply_to_message_id, source, source_id, idempotency_key, created_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)",
+        ["bad", "t1", "w1", "p1", "r1", '{"type":"human","userId":"u1"}', '{"text":"missing type"}', "[]", null, "user", null, null, "2026-01-01T00:00:00.000Z"]);
+    });
+    const warn = jest.spyOn(console, "warn").mockImplementation(() => undefined);
+    const page = await store.list({ tenantId: "t1", roomId: "r1", limit: 10 });
+    expect(page.map((message) => message.id)).toEqual(["m1"]);
+    expect(warn).toHaveBeenCalledWith(
+      "[ProjectRoomMessageStore] Skipping invalid message row",
+      expect.objectContaining({ tenantId: "t1", roomId: "r1", rowId: "bad" }),
+    );
+    warn.mockRestore();
+  });
 });

package/src/createLocalStoreConfig.ts

@@ -37,6 +37,7 @@ import { LocalEvalStore } from "./stores/LocalEvalStore";
 import { LocalChannelBindingStore } from "./stores/LocalChannelBindingStore";
 import { LocalChannelInstallationStore } from "./stores/LocalChannelInstallationStore";
 import { LocalA2AApiKeyStore } from "./stores/LocalA2AApiKeyStore";
+import { LocalOpenAuditStore } from "./stores/LocalOpenAuditStore";
 import { LocalThreadMessageQueueStore } from "./stores/LocalThreadMessageQueueStore";
 import { LocalSkillStore } from "./stores/LocalSkillStore";
 import { LocalScheduleStorage } from "./stores/LocalScheduleStorage";
@@ -88,6 +89,7 @@ export async function createLocalStoreConfig(options: LocalStoreConfigOptions =
     channelBinding: new LocalChannelBindingStore(db),
     channelInstallation: new LocalChannelInstallationStore(db),
     a2aApiKey: new LocalA2AApiKeyStore(db),
+    openAudit: new LocalOpenAuditStore(db),
     threadMessageQueue: new LocalThreadMessageQueueStore(db),
     skill: new LocalSkillStore(db),
     schedule: new LocalScheduleStorage(db),

package/src/index.ts

@@ -55,3 +55,5 @@ export { LocalTaskStore } from "./stores/LocalTaskStore";
 export { LocalTaskWorkItemStore } from "./stores/LocalTaskWorkItemStore";
 export { LocalCapabilityBundleStore } from "./stores/LocalCapabilityBundleStore";
 export { InMemoryConversationStore } from "./stores/InMemoryConversationStore";
+
+export * from "./stores/LocalOpenAuditStore";

package/src/stores/LocalA2AApiKeyStore.ts

@@ -4,10 +4,12 @@
 
 import { DatabaseWrapper } from "../database";
 import type {
+  UpdateA2AApiKeyInput,
   A2AApiKeyStore,
   A2AApiKeyRecord,
   CreateA2AApiKeyInput,
   A2AApiKeyEntry,
+  OpenGrant,
 } from "@axiom-lattice/protocols";
 import { ensureTable, nowISO, parseISO } from "../database";
 import { encrypt, decrypt } from "@axiom-lattice/core";
@@ -20,6 +22,7 @@ CREATE TABLE IF NOT EXISTS lt_a2a_api_keys (
   tenant_id TEXT NOT NULL,
   project_id TEXT,
   assistant_ids TEXT,
+  grants TEXT,
   label TEXT,
   enabled INTEGER NOT NULL DEFAULT 1,
   created_at TEXT NOT NULL,
@@ -33,6 +36,7 @@ interface KeyRow {
   tenant_id: string;
   project_id: string;
   assistant_ids: string | null;
+  grants: string | null;
   label: string | null;
   enabled: number;
   created_at: string;
@@ -43,6 +47,16 @@ function generateApiKey(): string {
   return `a2a_${randomUUID().replace(/-/g, "")}`;
 }
 
+function parseGrants(raw: string | null): OpenGrant[] | undefined {
+  if (!raw) return undefined;
+  try {
+    const parsed = JSON.parse(raw);
+    return Array.isArray(parsed) ? (parsed as OpenGrant[]) : undefined;
+  } catch {
+    return undefined;
+  }
+}
+
 function parseAssistantIds(raw: string | null): string[] | undefined {
   if (!raw) return undefined;
   try {
@@ -62,6 +76,7 @@ export class LocalA2AApiKeyStore implements A2AApiKeyStore {
     ensureTable(db, DDL);
     // Existing installs: add columns shipped after the original schema.
     this.ensureColumn("lt_a2a_api_keys", "assistant_ids", "assistant_ids TEXT");
+    this.ensureColumn("lt_a2a_api_keys", "grants", "grants TEXT");
     this.repairManagementIds();
   }
 
@@ -128,9 +143,9 @@ export class LocalA2AApiKeyStore implements A2AApiKeyStore {
     const key = generateApiKey();
     const now = nowISO();
     this.db.prepare(
-      `INSERT INTO lt_a2a_api_keys (id, key_value, tenant_id, project_id, assistant_ids, label, created_at, updated_at)
-       VALUES (?, ?, ?, ?, ?, ?, ?, ?)`,
-    ).run(id, encrypt(key), input.tenantId, input.projectId, input.assistantIds ? JSON.stringify(input.assistantIds) : null, input.label || null, now, now);
+      `INSERT INTO lt_a2a_api_keys (id, key_value, tenant_id, project_id, assistant_ids, grants, label, created_at, updated_at)
+       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+    ).run(id, encrypt(key), input.tenantId, input.projectId, input.assistantIds ? JSON.stringify(input.assistantIds) : null, input.grants ? JSON.stringify(input.grants) : null, input.label || null, now, now);
 
     const record: A2AApiKeyRecord = {
       id,
@@ -166,6 +181,28 @@ export class LocalA2AApiKeyStore implements A2AApiKeyStore {
     return mapRowToRecord(row);
   }
 
+
+  async update(id: string, input: UpdateA2AApiKeyInput): Promise<A2AApiKeyRecord> {
+    const sets: string[] = [];
+    const values: unknown[] = [];
+    if (input.label !== undefined) { sets.push("label = ?"); values.push(input.label || null); }
+    if (input.projectId !== undefined) { sets.push("project_id = ?"); values.push(input.projectId); }
+    if (input.assistantIds !== undefined) { sets.push("assistant_ids = ?"); values.push(input.assistantIds ? JSON.stringify(input.assistantIds) : null); }
+    if (input.grants !== undefined) { sets.push("grants = ?"); values.push(input.grants ? JSON.stringify(input.grants) : null); }
+    if (sets.length === 0) {
+      const row = this.db.prepare("SELECT * FROM lt_a2a_api_keys WHERE id = ?").get(id) as unknown as KeyRow | undefined;
+      if (!row) throw new Error(`A2A API key not found: ${id}`);
+      return mapRowToRecord(row);
+    }
+    sets.push("updated_at = ?");
+    values.push(nowISO());
+    values.push(id);
+    this.db.prepare(`UPDATE lt_a2a_api_keys SET ${sets.join(", ")} WHERE id = ?`).run(...values);
+    const row = this.db.prepare("SELECT * FROM lt_a2a_api_keys WHERE id = ?").get(id) as unknown as KeyRow | undefined;
+    if (!row) throw new Error(`A2A API key not found: ${id}`);
+    return mapRowToRecord(row);
+  }
+
   async rotate(id: string): Promise<A2AApiKeyRecord> {
     const key = generateApiKey();
     const now = nowISO();
@@ -212,6 +249,7 @@ function mapRowToRecord(row: KeyRow): A2AApiKeyRecord {
     tenantId: row.tenant_id,
     projectId: row.project_id,
     assistantIds: parseAssistantIds(row.assistant_ids),
+    grants: parseGrants(row.grants),
     label: row.label || undefined,
     enabled: row.enabled === 1,
     createdAt: parseISO(row.created_at),

package/src/stores/LocalOpenAuditStore.ts

@@ -0,0 +1,110 @@
+/**
+ * Local SQLite implementation of the Open audit store (append-only).
+ */
+
+import { DatabaseWrapper, ensureTable, nowISO, parseISO } from "../database";
+import type {
+  OpenAuditStore,
+  OpenAuditAppendInput,
+  OpenAuditQuery,
+  OpenAuditRecord,
+} from "@axiom-lattice/protocols";
+import { randomUUID } from "crypto";
+
+const DDL = `
+CREATE TABLE IF NOT EXISTS lt_open_audit (
+  id TEXT PRIMARY KEY,
+  tenant_id TEXT NOT NULL,
+  credential_id TEXT NOT NULL,
+  credential_kind TEXT NOT NULL,
+  project_id TEXT NOT NULL,
+  domain TEXT NOT NULL,
+  action TEXT NOT NULL,
+  args TEXT,
+  status TEXT NOT NULL,
+  error_code TEXT,
+  duration_ms INTEGER NOT NULL,
+  created_at TEXT NOT NULL
+);
+`;
+
+/** SQLite-backed append-only audit store for the Open API surface. */
+export class LocalOpenAuditStore implements OpenAuditStore {
+  private db: DatabaseWrapper;
+
+  constructor(db: DatabaseWrapper) {
+    this.db = db;
+    ensureTable(db, DDL);
+  }
+
+  async query(params: OpenAuditQuery): Promise<OpenAuditRecord[]> {
+    const clauses = ["tenant_id = ?"];
+    const values: unknown[] = [params.tenantId];
+    if (params.credentialId) {
+      clauses.push("credential_id = ?");
+      values.push(params.credentialId);
+    }
+    if (params.domain) {
+      clauses.push("domain = ?");
+      values.push(params.domain);
+    }
+    if (params.status) {
+      clauses.push("status = ?");
+      values.push(params.status);
+    }
+    if (params.from) {
+      clauses.push("created_at >= ?");
+      values.push(params.from);
+    }
+    if (params.to) {
+      clauses.push("created_at < ?");
+      values.push(params.to);
+    }
+    const limit = params.limit ?? 100;
+    const offset = params.offset ?? 0;
+    values.push(limit, offset);
+    const rows = this.db
+      .prepare(
+        `SELECT * FROM lt_open_audit WHERE ${clauses.join(" AND ")}
+         ORDER BY created_at DESC LIMIT ? OFFSET ?`,
+      )
+      .all(...values) as unknown as Array<Record<string, unknown>>;
+    return rows.map((row) => ({
+      id: row.id as string,
+      tenantId: row.tenant_id as string,
+      credentialId: row.credential_id as string,
+      credentialKind: row.credential_kind as OpenAuditRecord["credentialKind"],
+      projectId: row.project_id as string,
+      domain: row.domain as string,
+      action: row.action as string,
+      args: row.args ? JSON.parse(row.args as string) : undefined,
+      status: row.status as "ok" | "error",
+      errorCode: (row.error_code as string) ?? undefined,
+      durationMs: row.duration_ms as number,
+      createdAt: parseISO(row.created_at as string),
+    }));
+  }
+
+  async append(record: OpenAuditAppendInput): Promise<void> {
+    this.db
+      .prepare(
+        `INSERT INTO lt_open_audit
+          (id, tenant_id, credential_id, credential_kind, project_id, domain, action, args, status, error_code, duration_ms, created_at)
+         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+      )
+      .run(
+        randomUUID(),
+        record.tenantId,
+        record.credentialId,
+        record.credentialKind,
+        record.projectId,
+        record.domain,
+        record.action,
+        record.args === undefined ? null : JSON.stringify(record.args),
+        record.status,
+        record.errorCode ?? null,
+        Math.max(0, Math.round(record.durationMs)),
+        nowISO(),
+      );
+  }
+}

package/src/stores/LocalProjectRoomMessageStore.ts

@@ -26,6 +26,26 @@ function mapRow(row: Row): ProjectRoomMessage {
     ...(row.source_id === null ? {} : { sourceId: row.source_id }), ...(row.idempotency_key === null ? {} : { idempotencyKey: row.idempotency_key }), createdAt };
 }
 
+function mapRowsTolerant(
+  rows: Row[],
+  scope: { tenantId: string; roomId: string },
+): ProjectRoomMessage[] {
+  const messages: ProjectRoomMessage[] = [];
+  for (const row of rows) {
+    try {
+      messages.push(mapRow(row));
+    } catch (error) {
+      console.warn("[ProjectRoomMessageStore] Skipping invalid message row", {
+        tenantId: scope.tenantId,
+        roomId: scope.roomId,
+        rowId: typeof row.id === "string" ? row.id : undefined,
+        reason: error instanceof Error ? error.message : String(error),
+      });
+    }
+  }
+  return messages;
+}
+
 /** Persists validated project room messages in local SQLite. */
 export class LocalProjectRoomMessageStore implements ProjectRoomMessageStore {
   constructor(private readonly db: DatabaseWrapper) { ensureProjectRoomSchema(db); }
@@ -37,7 +57,7 @@ export class LocalProjectRoomMessageStore implements ProjectRoomMessageStore {
     const rows = input.before
       ? this.db.prepare(`SELECT ${columns} FROM lt_project_room_messages WHERE tenant_id = ? AND room_id = ? AND (created_at < ? OR (created_at = ? AND id < ?)) ORDER BY created_at DESC, id DESC LIMIT ?`).all(input.tenantId, input.roomId, input.before.createdAt.toISOString(), input.before.createdAt.toISOString(), input.before.id, limit)
       : this.db.prepare(`SELECT ${columns} FROM lt_project_room_messages WHERE tenant_id = ? AND room_id = ? ORDER BY created_at DESC, id DESC LIMIT ?`).all(input.tenantId, input.roomId, limit);
-    return (rows as Row[]).map(mapRow);
+    return mapRowsTolerant(rows as Row[], { tenantId: input.tenantId, roomId: input.roomId });
   }
   async findById(tenantId: string, id: string): Promise<ProjectRoomMessage | null> { const row = this.byId(tenantId, id); return row ? mapRow(row) : null; }
   async countAfter(input: {