@axiom-lattice/local-stores 3.2.5 → 3.2.6

package/dist/index.mjs

@@ -1993,7 +1993,7 @@ function encryptPasswordInConfig(config) {
 
 // src/stores/LocalConnectionStore.ts
 import { v4 as uuid } from "uuid";
-import { encryptConfigFields, decryptConfigFields } from "@axiom-lattice/core";
+import { encryptConfigFields, decryptConfigFields, encrypt as encrypt2, isEncryptedValue } from "@axiom-lattice/core";
 var DDL9 = `
 CREATE TABLE IF NOT EXISTS connection_configs (
   id TEXT NOT NULL,
@@ -2027,6 +2027,7 @@ var LocalConnectionStore = class {
     this.db = db;
     ensureTable(db, DDL9);
     this.ensureColumn("connection_configs", "secret_fields", "secret_fields TEXT");
+    this.reencryptLegacySecrets();
   }
   ensureColumn(table, column, ddl2) {
     const cols = this.db.prepare(`PRAGMA table_info(${table})`).all();
@@ -2034,6 +2035,44 @@ var LocalConnectionStore = class {
       this.db.exec(`ALTER TABLE ${table} ADD COLUMN ${ddl2}`);
     }
   }
+  /**
+   * Re-encrypt declared secret fields that are still stored as plaintext.
+   *
+   * A plugin can mark a field as a secret after connections already exist (e.g.
+   * a field renamed from a plaintext key to a password), leaving legacy rows
+   * with plaintext where ciphertext is now expected. This one-time, idempotent
+   * pass encrypts any declared secret field that does not look like our
+   * ciphertext; values that do look encrypted are left untouched, so genuine
+   * ciphertext written under another key is never destroyed.
+   */
+  reencryptLegacySecrets() {
+    const rows2 = this.db.prepare(
+      `SELECT id, tenant_id, config, secret_fields FROM connection_configs WHERE secret_fields IS NOT NULL`
+    ).all();
+    for (const row of rows2) {
+      const secretFields = parseSecretFields(row.secret_fields);
+      if (!secretFields?.length) continue;
+      let config;
+      try {
+        config = JSON.parse(row.config);
+      } catch {
+        continue;
+      }
+      let changed = false;
+      for (const field of secretFields) {
+        const value = config[field];
+        if (typeof value === "string" && value.length > 0 && !isEncryptedValue(value)) {
+          config[field] = encrypt2(value);
+          changed = true;
+        }
+      }
+      if (changed) {
+        this.db.prepare(
+          `UPDATE connection_configs SET config = ?, updated_at = ? WHERE tenant_id = ? AND id = ?`
+        ).run(JSON.stringify(config), nowISO(), row.tenant_id, row.id);
+      }
+    }
+  }
   async listByTenant(tenantId) {
     const rows2 = this.db.prepare(
       `SELECT * FROM connection_configs WHERE tenant_id = ? ORDER BY created_at`
@@ -2252,7 +2291,7 @@ function mapRowToEntry2(row) {
 }
 
 // src/stores/LocalMcpServerConfigStore.ts
-import { encrypt as encrypt2, decrypt as decrypt2 } from "@axiom-lattice/core";
+import { encrypt as encrypt3, safeDecrypt } from "@axiom-lattice/core";
 var DDL11 = `
 CREATE TABLE IF NOT EXISTS lt_mcp_configs (
   id TEXT NOT NULL,
@@ -2399,28 +2438,18 @@ var LocalMcpServerConfigStore = class {
 function mapRowToEntry3(row) {
   const config = JSON.parse(row.config);
   if (config.env && row.is_env_encrypted) {
-    try {
-      const decryptedEnv = {};
-      for (const [key, value] of Object.entries(config.env)) {
-        decryptedEnv[key] = decrypt2(value);
-      }
-      config.env = decryptedEnv;
-    } catch (error) {
-      console.error("Failed to decrypt MCP server env:", error);
-      throw new Error("Failed to decrypt MCP server configuration");
+    const decryptedEnv = {};
+    for (const [key, value] of Object.entries(config.env)) {
+      decryptedEnv[key] = safeDecrypt(value);
     }
+    config.env = decryptedEnv;
   }
   if (config.headers && row.is_env_encrypted) {
-    try {
-      const decryptedHeaders = {};
-      for (const [key, value] of Object.entries(config.headers)) {
-        decryptedHeaders[key] = decrypt2(value);
-      }
-      config.headers = decryptedHeaders;
-    } catch (error) {
-      console.error("Failed to decrypt MCP server headers:", error);
-      throw new Error("Failed to decrypt MCP server configuration");
+    const decryptedHeaders = {};
+    for (const [key, value] of Object.entries(config.headers)) {
+      decryptedHeaders[key] = safeDecrypt(value);
     }
+    config.headers = decryptedHeaders;
   }
   return {
     id: row.id,
@@ -2442,7 +2471,7 @@ function encryptEnvInConfig(config) {
   if (configCopy.env && Object.keys(configCopy.env).length > 0) {
     const encryptedEnv = {};
     for (const [key, value] of Object.entries(configCopy.env)) {
-      encryptedEnv[key] = encrypt2(value);
+      encryptedEnv[key] = encrypt3(value);
     }
     configCopy.env = encryptedEnv;
     isEnvEncrypted = true;
@@ -2450,7 +2479,7 @@ function encryptEnvInConfig(config) {
   if (configCopy.headers && Object.keys(configCopy.headers).length > 0) {
     const encryptedHeaders = {};
     for (const [key, value] of Object.entries(configCopy.headers)) {
-      encryptedHeaders[key] = encrypt2(value);
+      encryptedHeaders[key] = encrypt3(value);
     }
     configCopy.headers = encryptedHeaders;
     isEnvEncrypted = true;
@@ -2459,7 +2488,7 @@ function encryptEnvInConfig(config) {
 }
 
 // src/stores/LocalModelProviderStore.ts
-import { encrypt as encrypt3, decrypt as decrypt3 } from "@axiom-lattice/core";
+import { encrypt as encrypt4, safeDecrypt as safeDecrypt2 } from "@axiom-lattice/core";
 var DDL12 = `
 CREATE TABLE IF NOT EXISTS lt_model_providers (
   id TEXT NOT NULL,
@@ -2569,7 +2598,7 @@ var LocalModelProviderStore = class {
       // Phase 1 pins the LLM provider (ADR-138 decision 7b)
       "openai",
       data.baseURL,
-      data.apiKey ? encrypt3(data.apiKey) : null,
+      data.apiKey ? encrypt4(data.apiKey) : null,
       data.apiKey ? data.apiKey.slice(-4) : null,
       data.enabled === false ? 0 : 1,
       now,
@@ -2604,7 +2633,7 @@ var LocalModelProviderStore = class {
       set("api_key_enc", null);
       set("api_key_hint", null);
     } else if (updates.apiKey) {
-      set("api_key_enc", encrypt3(updates.apiKey));
+      set("api_key_enc", encrypt4(updates.apiKey));
       set("api_key_hint", updates.apiKey.slice(-4));
     }
     if (fields.length === 0) {
@@ -2736,12 +2765,7 @@ var LocalModelProviderStore = class {
 function mapRowToEntry4(row) {
   let apiKey;
   if (row.api_key_enc) {
-    try {
-      apiKey = decrypt3(row.api_key_enc);
-    } catch (error) {
-      console.error("Failed to decrypt model provider API key:", error);
-      throw new Error("Failed to decrypt model provider API key");
-    }
+    apiKey = safeDecrypt2(row.api_key_enc);
   }
   return {
     id: row.id,
@@ -4206,7 +4230,7 @@ function mapRow6(row) {
 }
 
 // src/stores/LocalA2AApiKeyStore.ts
-import { encrypt as encrypt4, decrypt as decrypt4 } from "@axiom-lattice/core";
+import { encrypt as encrypt5, decrypt as decrypt2, safeDecrypt as safeDecrypt3 } from "@axiom-lattice/core";
 import { randomUUID as randomUUID3 } from "crypto";
 var DDL17 = `
 CREATE TABLE IF NOT EXISTS lt_a2a_api_keys (
@@ -4277,7 +4301,7 @@ var LocalA2AApiKeyStore = class {
     ).all();
     for (const row of rows2) {
       try {
-        if (decrypt4(row.key_value) === key) return mapRowToRecord(row);
+        if (decrypt2(row.key_value) === key) return mapRowToRecord(row);
       } catch {
       }
     }
@@ -4311,7 +4335,7 @@ var LocalA2AApiKeyStore = class {
     this.db.prepare(
       `INSERT INTO lt_a2a_api_keys (id, key_value, tenant_id, project_id, assistant_ids, grants, label, created_at, updated_at)
        VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`
-    ).run(id, encrypt4(key), input.tenantId, input.projectId, input.assistantIds ? JSON.stringify(input.assistantIds) : null, input.grants ? JSON.stringify(input.grants) : null, input.label || null, now, now);
+    ).run(id, encrypt5(key), input.tenantId, input.projectId, input.assistantIds ? JSON.stringify(input.assistantIds) : null, input.grants ? JSON.stringify(input.grants) : null, input.label || null, now, now);
     const record2 = {
       id,
       key,
@@ -4380,7 +4404,7 @@ var LocalA2AApiKeyStore = class {
     const now = nowISO();
     this.db.prepare(
       `UPDATE lt_a2a_api_keys SET key_value = ?, updated_at = ? WHERE id = ?`
-    ).run(encrypt4(key), now, id);
+    ).run(encrypt5(key), now, id);
     const row = this.db.prepare(`SELECT * FROM lt_a2a_api_keys WHERE id = ?`).get(id);
     if (!row) throw new Error(`A2A API key not found: ${id}`);
     const record2 = mapRowToRecord(row);
@@ -4397,7 +4421,7 @@ var LocalA2AApiKeyStore = class {
     const map2 = /* @__PURE__ */ new Map();
     for (const row of rows2) {
       try {
-        const key = decrypt4(row.key_value);
+        const key = decrypt2(row.key_value);
         map2.set(key, {
           key,
           tenantId: row.tenant_id,
@@ -4411,15 +4435,9 @@ var LocalA2AApiKeyStore = class {
   }
 };
 function mapRowToRecord(row) {
-  let key = "";
-  try {
-    key = decrypt4(row.key_value);
-  } catch {
-    key = row.key_value;
-  }
   return {
     id: row.id,
-    key,
+    key: safeDecrypt3(row.key_value),
     tenantId: row.tenant_id,
     projectId: row.project_id,
     assistantIds: parseAssistantIds(row.assistant_ids),