@axiom-lattice/local-stores 3.2.5 → 3.2.6

package/.turbo/turbo-build.log

@@ -1,5 +1,5 @@
 
-> @axiom-lattice/local-stores@3.2.5 build /home/runner/work/agentic/agentic/packages/local-stores
+> @axiom-lattice/local-stores@3.2.6 build /home/runner/work/agentic/agentic/packages/local-stores
 > tsup src/index.ts --format cjs,esm --dts --sourcemap
 
 CLI Building entry: src/index.ts
@@ -8,13 +8,13 @@
 CLI Target: es2020
 CJS Build start
 ESM Build start
-CJS dist/index.js     243.72 KB
-CJS dist/index.js.map 442.40 KB
-CJS ⚡️ Build success in 522ms
-ESM dist/index.mjs     239.07 KB
-ESM dist/index.mjs.map 438.65 KB
-ESM ⚡️ Build success in 528ms
+CJS dist/index.js     244.66 KB
+CJS dist/index.js.map 443.82 KB
+CJS ⚡️ Build success in 637ms
+ESM dist/index.mjs     240.04 KB
+ESM dist/index.mjs.map 440.11 KB
+ESM ⚡️ Build success in 646ms
 DTS Build start
-DTS ⚡️ Build success in 9966ms
-DTS dist/index.d.ts  44.69 KB
-DTS dist/index.d.mts 44.69 KB
+DTS ⚡️ Build success in 10963ms
+DTS dist/index.d.ts  45.28 KB
+DTS dist/index.d.mts 45.28 KB

package/CHANGELOG.md

@@ -1,5 +1,12 @@
 # @axiom-lattice/local-stores
 
+## 3.2.6
+
+### Patch Changes
+
+- Updated dependencies [726c98a]
+  - @axiom-lattice/core@7.0.0
+
 ## 3.2.5
 
 ### Patch Changes

package/dist/index.d.mts

@@ -468,6 +468,17 @@ declare class LocalConnectionStore implements ConnectionStore {
     private db;
     constructor(db: DatabaseWrapper);
     private ensureColumn;
+    /**
+     * Re-encrypt declared secret fields that are still stored as plaintext.
+     *
+     * A plugin can mark a field as a secret after connections already exist (e.g.
+     * a field renamed from a plaintext key to a password), leaving legacy rows
+     * with plaintext where ciphertext is now expected. This one-time, idempotent
+     * pass encrypts any declared secret field that does not look like our
+     * ciphertext; values that do look encrypted are left untouched, so genuine
+     * ciphertext written under another key is never destroyed.
+     */
+    private reencryptLegacySecrets;
     listByTenant(tenantId: string): Promise<ConnectionEntry[]>;
     listByType(tenantId: string, type: string): Promise<ConnectionEntry[]>;
     getByKey(tenantId: string, type: string, key: string): Promise<ConnectionEntry | null>;

package/dist/index.d.ts

@@ -468,6 +468,17 @@ declare class LocalConnectionStore implements ConnectionStore {
     private db;
     constructor(db: DatabaseWrapper);
     private ensureColumn;
+    /**
+     * Re-encrypt declared secret fields that are still stored as plaintext.
+     *
+     * A plugin can mark a field as a secret after connections already exist (e.g.
+     * a field renamed from a plaintext key to a password), leaving legacy rows
+     * with plaintext where ciphertext is now expected. This one-time, idempotent
+     * pass encrypts any declared secret field that does not look like our
+     * ciphertext; values that do look encrypted are left untouched, so genuine
+     * ciphertext written under another key is never destroyed.
+     */
+    private reencryptLegacySecrets;
     listByTenant(tenantId: string): Promise<ConnectionEntry[]>;
     listByType(tenantId: string, type: string): Promise<ConnectionEntry[]>;
     getByKey(tenantId: string, type: string, key: string): Promise<ConnectionEntry | null>;

package/dist/index.js

@@ -2108,6 +2108,7 @@ var LocalConnectionStore = class {
     this.db = db;
     ensureTable(db, DDL9);
     this.ensureColumn("connection_configs", "secret_fields", "secret_fields TEXT");
+    this.reencryptLegacySecrets();
   }
   ensureColumn(table, column, ddl2) {
     const cols = this.db.prepare(`PRAGMA table_info(${table})`).all();
@@ -2115,6 +2116,44 @@ var LocalConnectionStore = class {
       this.db.exec(`ALTER TABLE ${table} ADD COLUMN ${ddl2}`);
     }
   }
+  /**
+   * Re-encrypt declared secret fields that are still stored as plaintext.
+   *
+   * A plugin can mark a field as a secret after connections already exist (e.g.
+   * a field renamed from a plaintext key to a password), leaving legacy rows
+   * with plaintext where ciphertext is now expected. This one-time, idempotent
+   * pass encrypts any declared secret field that does not look like our
+   * ciphertext; values that do look encrypted are left untouched, so genuine
+   * ciphertext written under another key is never destroyed.
+   */
+  reencryptLegacySecrets() {
+    const rows2 = this.db.prepare(
+      `SELECT id, tenant_id, config, secret_fields FROM connection_configs WHERE secret_fields IS NOT NULL`
+    ).all();
+    for (const row of rows2) {
+      const secretFields = parseSecretFields(row.secret_fields);
+      if (!secretFields?.length) continue;
+      let config;
+      try {
+        config = JSON.parse(row.config);
+      } catch {
+        continue;
+      }
+      let changed = false;
+      for (const field of secretFields) {
+        const value = config[field];
+        if (typeof value === "string" && value.length > 0 && !(0, import_core2.isEncryptedValue)(value)) {
+          config[field] = (0, import_core2.encrypt)(value);
+          changed = true;
+        }
+      }
+      if (changed) {
+        this.db.prepare(
+          `UPDATE connection_configs SET config = ?, updated_at = ? WHERE tenant_id = ? AND id = ?`
+        ).run(JSON.stringify(config), nowISO(), row.tenant_id, row.id);
+      }
+    }
+  }
   async listByTenant(tenantId) {
     const rows2 = this.db.prepare(
       `SELECT * FROM connection_configs WHERE tenant_id = ? ORDER BY created_at`
@@ -2480,28 +2519,18 @@ var LocalMcpServerConfigStore = class {
 function mapRowToEntry3(row) {
   const config = JSON.parse(row.config);
   if (config.env && row.is_env_encrypted) {
-    try {
-      const decryptedEnv = {};
-      for (const [key, value] of Object.entries(config.env)) {
-        decryptedEnv[key] = (0, import_core3.decrypt)(value);
-      }
-      config.env = decryptedEnv;
-    } catch (error) {
-      console.error("Failed to decrypt MCP server env:", error);
-      throw new Error("Failed to decrypt MCP server configuration");
+    const decryptedEnv = {};
+    for (const [key, value] of Object.entries(config.env)) {
+      decryptedEnv[key] = (0, import_core3.safeDecrypt)(value);
     }
+    config.env = decryptedEnv;
   }
   if (config.headers && row.is_env_encrypted) {
-    try {
-      const decryptedHeaders = {};
-      for (const [key, value] of Object.entries(config.headers)) {
-        decryptedHeaders[key] = (0, import_core3.decrypt)(value);
-      }
-      config.headers = decryptedHeaders;
-    } catch (error) {
-      console.error("Failed to decrypt MCP server headers:", error);
-      throw new Error("Failed to decrypt MCP server configuration");
+    const decryptedHeaders = {};
+    for (const [key, value] of Object.entries(config.headers)) {
+      decryptedHeaders[key] = (0, import_core3.safeDecrypt)(value);
     }
+    config.headers = decryptedHeaders;
   }
   return {
     id: row.id,
@@ -2817,12 +2846,7 @@ var LocalModelProviderStore = class {
 function mapRowToEntry4(row) {
   let apiKey;
   if (row.api_key_enc) {
-    try {
-      apiKey = (0, import_core4.decrypt)(row.api_key_enc);
-    } catch (error) {
-      console.error("Failed to decrypt model provider API key:", error);
-      throw new Error("Failed to decrypt model provider API key");
-    }
+    apiKey = (0, import_core4.safeDecrypt)(row.api_key_enc);
   }
   return {
     id: row.id,
@@ -4488,15 +4512,9 @@ var LocalA2AApiKeyStore = class {
   }
 };
 function mapRowToRecord(row) {
-  let key = "";
-  try {
-    key = (0, import_core5.decrypt)(row.key_value);
-  } catch {
-    key = row.key_value;
-  }
   return {
     id: row.id,
-    key,
+    key: (0, import_core5.safeDecrypt)(row.key_value),
     tenantId: row.tenant_id,
     projectId: row.project_id,
     assistantIds: parseAssistantIds(row.assistant_ids),