@axiom-lattice/pg-stores 2.0.10 → 3.0.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@axiom-lattice/pg-stores",
-  "version": "2.0.10",
+  "version": "3.0.1",
   "description": "PG stores implementation for Axiom Lattice framework",
   "main": "dist/index.js",
   "module": "dist/index.mjs",
@@ -25,8 +25,8 @@
     "@langchain/core": "1.1.30",
     "pg": "^8.16.3",
     "uuid": "^9.0.1",
-    "@axiom-lattice/core": "3.1.2",
-    "@axiom-lattice/protocols": "3.0.4"
+    "@axiom-lattice/core": "4.0.1",
+    "@axiom-lattice/protocols": "4.0.1"
   },
   "devDependencies": {
     "@types/jest": "^29.5.14",

package/src/__tests__/PostgreSQLA2AApiKeyStore.migrations.test.ts

@@ -0,0 +1,76 @@
+/**
+ * Standalone-migration tests for PostgreSQLA2AApiKeyStore.
+ *
+ * When the store is constructed with its own `poolConfig` (no shared pool from
+ * `createPgStoreConfig`), its private MigrationManager must register every
+ * migration the store's queries depend on — including the `assistant_ids`
+ * column added after the original table creation.
+ */
+
+import { describe, expect, it, beforeEach } from "@jest/globals";
+
+const mockRecordedMigrationNames: string[] = [];
+const mockClientSql: string[] = [];
+
+jest.mock("@axiom-lattice/core", () => ({
+  encrypt: (value: string) => `enc:${value}`,
+  decrypt: (value: string) => value.replace(/^enc:/, ""),
+}));
+
+jest.mock("pg", () => {
+  const client = {
+    query: async (sql: string, params?: unknown[]) => {
+      mockClientSql.push(sql);
+      if (sql.includes("information_schema.tables")) {
+        return { rows: [{ exists: true }] };
+      }
+      if (sql.includes("pg_index")) {
+        // PK already on `name` — no legacy schema migration needed.
+        return { rows: [] };
+      }
+      if (sql.includes("INSERT INTO lattice_schema_migrations")) {
+        mockRecordedMigrationNames.push(params?.[0] as string);
+        return { rows: [] };
+      }
+      if (sql.includes("FROM lattice_schema_migrations")) {
+        return { rows: [] };
+      }
+      return { rows: [] };
+    },
+    release: () => undefined,
+  };
+  const pool = {
+    connect: async () => client,
+    query: async () => ({ rows: [] }),
+    end: async () => undefined,
+  };
+  return { Pool: function Pool() { return pool; } };
+});
+
+import { PostgreSQLA2AApiKeyStore } from "../stores/PostgreSQLA2AApiKeyStore";
+
+describe("PostgreSQLA2AApiKeyStore standalone migrations", () => {
+  beforeEach(() => {
+    mockRecordedMigrationNames.length = 0;
+    mockClientSql.length = 0;
+  });
+
+  it("registers and applies both the table and assistant_ids migrations", async () => {
+    const store = new PostgreSQLA2AApiKeyStore({
+      poolConfig: "postgres://unused",
+      autoMigrate: false,
+    });
+
+    await store.initialize();
+
+    expect(mockRecordedMigrationNames).toEqual([
+      "create_a2a_api_keys_table",
+      "add_a2a_key_assistant_ids",
+    ]);
+    expect(
+      mockClientSql.some((sql) => sql.includes("ADD COLUMN IF NOT EXISTS assistant_ids")),
+    ).toBe(true);
+
+    await store.dispose();
+  });
+});

package/src/__tests__/PostgreSQLA2AApiKeyStore.test.ts

@@ -0,0 +1,133 @@
+/**
+ * PostgreSQLA2AApiKeyStore behavior tests
+ *
+ * Verifies the store aligns with the new A2A key scope model:
+ * - projectId is required (written directly, no null fallback)
+ * - assistantIds is persisted as JSONB and projected back
+ * - workspaceId is no longer read or written
+ */
+
+import { describe, expect, it, jest, beforeEach } from "@jest/globals";
+import type { Pool } from "pg";
+
+const mockQuery = jest.fn();
+
+jest.mock("@axiom-lattice/core", () => ({
+  encrypt: (value: string) => `enc:${value}`,
+  decrypt: (value: string) => value.replace(/^enc:/, ""),
+}));
+
+import { PostgreSQLA2AApiKeyStore } from "../stores/PostgreSQLA2AApiKeyStore";
+
+describe("PostgreSQLA2AApiKeyStore", () => {
+  const pool = { query: mockQuery } as unknown as Pool;
+
+  beforeEach(() => {
+    jest.clearAllMocks();
+  });
+
+  it("create writes assistant_ids and project_id, omits workspace_id", async () => {
+    const store = new PostgreSQLA2AApiKeyStore({ pool });
+    mockQuery.mockResolvedValueOnce({
+      rows: [{
+        id: "k1",
+        key_value: "enc:a2a_x",
+        tenant_id: "t1",
+        project_id: "p1",
+        assistant_ids: ["a1", "a2"],
+        label: "lbl",
+        enabled: true,
+        created_at: new Date("2026-01-01T00:00:00.000Z"),
+        updated_at: new Date("2026-01-01T00:00:00.000Z"),
+      }],
+    });
+
+    const record = await store.create({
+      tenantId: "t1",
+      projectId: "p1",
+      assistantIds: ["a1", "a2"],
+      label: "lbl",
+    });
+
+    const [sql, params] = mockQuery.mock.calls[0] as [string, unknown[]];
+    expect(sql).toContain("assistant_ids");
+    expect(sql).not.toContain("workspace_id");
+    expect(params[2]).toBe("p1");
+    expect(params[3]).toBe(JSON.stringify(["a1", "a2"]));
+    expect(record.projectId).toBe("p1");
+    expect(record.assistantIds).toEqual(["a1", "a2"]);
+    expect("workspaceId" in record).toBe(false);
+  });
+
+  it("create stores null assistant_ids when not provided", async () => {
+    const store = new PostgreSQLA2AApiKeyStore({ pool });
+    mockQuery.mockResolvedValueOnce({
+      rows: [{
+        id: "k2",
+        key_value: "enc:a2a_y",
+        tenant_id: "t1",
+        project_id: "p1",
+        assistant_ids: null,
+        label: null,
+        enabled: true,
+        created_at: new Date("2026-01-01T00:00:00.000Z"),
+        updated_at: new Date("2026-01-01T00:00:00.000Z"),
+      }],
+    });
+
+    const record = await store.create({ tenantId: "t1", projectId: "p1" });
+
+    const [, params] = mockQuery.mock.calls[0] as [string, unknown[]];
+    expect(params[3]).toBe(null);
+    expect(record.assistantIds).toBeUndefined();
+  });
+
+  it("findById returns the matching key record", async () => {
+    const store = new PostgreSQLA2AApiKeyStore({ pool });
+    mockQuery.mockResolvedValueOnce({
+      rows: [{
+        id: "k1",
+        key_value: "enc:a2a_x",
+        tenant_id: "t1",
+        project_id: "p1",
+        assistant_ids: null,
+        label: null,
+        enabled: true,
+        created_at: new Date("2026-01-01T00:00:00.000Z"),
+        updated_at: new Date("2026-01-01T00:00:00.000Z"),
+      }],
+    });
+
+    const record = await store.findById("k1");
+
+    expect(mockQuery).toHaveBeenCalledWith(
+      expect.stringContaining("WHERE id = $1"),
+      ["k1"],
+    );
+    expect(record?.tenantId).toBe("t1");
+  });
+
+  it("loadIntoMap projects assistantIds and omits workspaceId", async () => {
+    const store = new PostgreSQLA2AApiKeyStore({ pool });
+    mockQuery.mockResolvedValueOnce({
+      rows: [{
+        id: "k1",
+        key_value: "enc:a2a_x",
+        tenant_id: "t1",
+        project_id: "p1",
+        assistant_ids: ["a1"],
+        label: null,
+        enabled: true,
+        created_at: new Date("2026-01-01T00:00:00.000Z"),
+        updated_at: new Date("2026-01-01T00:00:00.000Z"),
+      }],
+    });
+
+    const map = await store.loadIntoMap();
+    const entry = map.get("a2a_x");
+    expect(entry).toBeDefined();
+    expect(entry?.projectId).toBe("p1");
+    expect(entry?.assistantIds).toEqual(["a1"]);
+    expect("workspaceId" in (entry ?? {})).toBe(false);
+  });
+});

package/src/__tests__/PostgreSQLAgentWebAppStore.migrations.test.ts

@@ -0,0 +1,77 @@
+import { beforeEach, describe, expect, it } from "@jest/globals";
+
+const recordedMigrationNames: string[] = [];
+const clientSql: string[] = [];
+let migrationError: Error | null = null;
+
+jest.mock("pg", () => {
+  const client = {
+    query: async (sql: string, params?: unknown[]) => {
+      clientSql.push(sql);
+      if (migrationError && sql.includes("CREATE TABLE IF NOT EXISTS lattice_agent_web_apps")) {
+        throw migrationError;
+      }
+      if (sql.includes("information_schema.tables")) return { rows: [{ exists: true }] };
+      if (sql.includes("pg_index")) return { rows: [] };
+      if (sql.includes("INSERT INTO lattice_schema_migrations")) {
+        recordedMigrationNames.push(params?.[0] as string);
+      }
+      return { rows: [] };
+    },
+    release: () => undefined,
+  };
+  const pool = {
+    connect: async () => client,
+    query: async () => ({ rows: [] }),
+    end: async () => undefined,
+  };
+  return { Pool: function Pool() { return pool; } };
+});
+
+import { PostgreSQLAgentWebAppStore } from "../stores/PostgreSQLAgentWebAppStore";
+
+describe("PostgreSQLAgentWebAppStore standalone migrations", () => {
+  beforeEach(() => {
+    recordedMigrationNames.length = 0;
+    clientSql.length = 0;
+    migrationError = null;
+  });
+
+  it("registers and applies the agent web apps table migration", async () => {
+    const store = new PostgreSQLAgentWebAppStore({
+      poolConfig: "postgres://unused",
+      autoMigrate: false,
+    });
+
+    await store.initialize();
+
+    expect(recordedMigrationNames).toEqual(["create_agent_web_apps_table"]);
+    expect(clientSql.some((sql) => sql.includes("CREATE TABLE IF NOT EXISTS lattice_agent_web_apps"))).toBe(true);
+    expect(clientSql.some((sql) => sql.includes("status VARCHAR(32) NOT NULL DEFAULT 'draft'"))).toBe(true);
+    expect(clientSql.some((sql) => sql.includes(
+      "CONSTRAINT chk_lattice_agent_web_apps_status CHECK (status IN ('draft', 'active', 'disabled'))",
+    ))).toBe(true);
+    expect(clientSql.some((sql) => sql.includes(
+      "created_at TIMESTAMPTZ NOT NULL DEFAULT date_trunc('milliseconds', NOW())",
+    ))).toBe(true);
+    expect(clientSql.some((sql) => sql.includes(
+      "updated_at TIMESTAMPTZ NOT NULL DEFAULT date_trunc('milliseconds', NOW())",
+    ))).toBe(true);
+    expect(clientSql.some((sql) => sql.includes("idx_lattice_agent_web_apps_tenant_assistant"))).toBe(true);
+
+    await store.dispose();
+  });
+
+  it("surfaces an eager auto-migration rejection through initialize without retrying", async () => {
+    migrationError = new Error("migration failed");
+    const store = new PostgreSQLAgentWebAppStore({ poolConfig: "postgres://unused" });
+
+    await expect(store.initialize()).rejects.toThrow("migration failed");
+    await expect(store.list("tenant-1")).rejects.toThrow("migration failed");
+
+    expect(clientSql.filter((sql) =>
+      sql.includes("CREATE TABLE IF NOT EXISTS lattice_agent_web_apps")
+    )).toHaveLength(1);
+    await store.dispose();
+  });
+});

package/src/__tests__/PostgreSQLAgentWebAppStore.test.ts

@@ -0,0 +1,290 @@
+import { beforeEach, describe, expect, it, jest } from "@jest/globals";
+import type {
+  AgentWebAppStorePatch,
+  CreateAgentWebAppInput,
+  UpdateAgentWebAppInput,
+} from "@axiom-lattice/protocols";
+import type { Pool } from "pg";
+
+import { PostgreSQLAgentWebAppStore } from "../stores/PostgreSQLAgentWebAppStore";
+
+const mockQuery = jest.fn();
+const now = new Date("2026-08-24T12:00:00.000Z");
+
+const input: CreateAgentWebAppInput = {
+  assistantId: "assistant-1",
+  name: "Support",
+  description: "Customer support",
+  integration: { type: "react_sdk" },
+  scope: {
+    defaultProjectId: "project-1",
+    allowedProjectIds: ["project-1", "project-2"],
+    defaultModelKey: "model-1",
+    allowedModelKeys: ["model-1"],
+  },
+  features: {
+    projectSelector: true,
+    modelSelector: true,
+    threadManagement: true,
+    attachments: false,
+    hitl: true,
+    genUI: false,
+  },
+  appearance: { title: "Help", primaryColor: "#123456" },
+};
+
+const row = {
+  id: "webapp_123",
+  tenant_id: "tenant-1",
+  assistant_id: "assistant-1",
+  name: "Support",
+  description: "Customer support",
+  status: "draft",
+  integration: input.integration,
+  scope: input.scope,
+  features: input.features,
+  appearance: input.appearance,
+  created_at: now,
+  updated_at: now,
+};
+
+describe("PostgreSQLAgentWebAppStore", () => {
+  const pool = { query: mockQuery } as unknown as Pool;
+
+  beforeEach(() => {
+    jest.clearAllMocks();
+  });
+
+  it("creates a draft web app with a generated webapp id and JSONB values", async () => {
+    mockQuery.mockResolvedValueOnce({ rows: [row] });
+    const store = new PostgreSQLAgentWebAppStore({ pool });
+
+    const result = await store.create("tenant-1", input);
+
+    const [sql, params] = mockQuery.mock.calls[0] as [string, unknown[]];
+    expect(sql).toContain("INSERT INTO lattice_agent_web_apps");
+    expect(sql).toContain("status");
+    expect(params[0]).toEqual(expect.stringMatching(/^webapp_[0-9a-f]{32}$/));
+    expect(params).toEqual([
+      expect.stringMatching(/^webapp_[0-9a-f]{32}$/),
+      "tenant-1",
+      "assistant-1",
+      "Support",
+      "Customer support",
+      "draft",
+      JSON.stringify(input.integration),
+      JSON.stringify(input.scope),
+      JSON.stringify(input.features),
+      JSON.stringify(input.appearance),
+    ]);
+    expect(result).toEqual({
+      id: "webapp_123",
+      tenantId: "tenant-1",
+      assistantId: "assistant-1",
+      name: "Support",
+      description: "Customer support",
+      status: "draft",
+      integration: input.integration,
+      scope: input.scope,
+      features: input.features,
+      appearance: input.appearance,
+      createdAt: now,
+      updatedAt: now,
+    });
+  });
+
+  it("lists tenant web apps in deterministic newest-first order", async () => {
+    mockQuery.mockResolvedValueOnce({ rows: [row] });
+    const store = new PostgreSQLAgentWebAppStore({ pool });
+
+    await store.list("tenant-1");
+
+    expect(mockQuery).toHaveBeenCalledWith(
+      expect.stringMatching(/WHERE tenant_id = \$1\s+ORDER BY created_at DESC, id DESC/),
+      ["tenant-1"],
+    );
+  });
+
+  it("optionally filters list by assistant", async () => {
+    mockQuery.mockResolvedValueOnce({ rows: [row] });
+    const store = new PostgreSQLAgentWebAppStore({ pool });
+
+    await store.list("tenant-1", "assistant-1");
+
+    expect(mockQuery).toHaveBeenCalledWith(
+      expect.stringMatching(/WHERE tenant_id = \$1 AND assistant_id = \$2/),
+      ["tenant-1", "assistant-1"],
+    );
+  });
+
+  it("gets by tenant and id and returns null when absent", async () => {
+    mockQuery.mockResolvedValueOnce({ rows: [] });
+    const store = new PostgreSQLAgentWebAppStore({ pool });
+
+    await expect(store.getById("tenant-1", "webapp_missing")).resolves.toBeNull();
+    expect(mockQuery).toHaveBeenCalledWith(
+      expect.stringMatching(/WHERE tenant_id = \$1 AND id = \$2/),
+      ["tenant-1", "webapp_missing"],
+    );
+  });
+
+  it("finds a globally identifiable publication by primary key", async () => {
+    mockQuery.mockResolvedValueOnce({ rows: [row] });
+    const store = new PostgreSQLAgentWebAppStore({ pool });
+
+    await expect(store.findById("webapp_123")).resolves.toMatchObject({
+      id: "webapp_123",
+      tenantId: "tenant-1",
+    });
+    expect(mockQuery).toHaveBeenCalledWith(
+      expect.stringMatching(/WHERE id = \$1/),
+      ["webapp_123"],
+    );
+  });
+
+  it("updates only known mutable fields and scopes by tenant and id", async () => {
+    mockQuery.mockResolvedValueOnce({ rows: [{ ...row, name: "Renamed", description: null }] });
+    const store = new PostgreSQLAgentWebAppStore({ pool });
+    const patch = {
+      name: "Renamed",
+      description: undefined,
+      assistantId: "assistant-evil",
+    } as unknown as UpdateAgentWebAppInput;
+
+    const result = await store.update("tenant-1", "webapp_123", patch);
+
+    const [sql, params] = mockQuery.mock.calls[0] as [string, unknown[]];
+    expect(sql).toContain("name = $1");
+    expect(sql).toContain("description = $2");
+    expect(sql).toContain("updated_at = GREATEST(");
+    expect(sql).toContain("WHERE tenant_id = $3 AND id = $4");
+    expect(sql).not.toContain("assistant_id =");
+    expect(params).toEqual(["Renamed", null, "tenant-1", "webapp_123"]);
+    expect(result?.description).toBeUndefined();
+  });
+
+  it("updates a defined status and returns the persisted row", async () => {
+    mockQuery.mockResolvedValueOnce({ rows: [{ ...row, status: "active" }] });
+    const store = new PostgreSQLAgentWebAppStore({ pool });
+    const patch: AgentWebAppStorePatch = { status: "active" };
+
+    const result = await store.update("tenant-1", "webapp_123", patch);
+
+    expect(mockQuery).toHaveBeenCalledWith(
+      expect.stringMatching(
+        /SET status = \$1, updated_at = GREATEST\(\s*date_trunc\('milliseconds', clock_timestamp\(\)\),\s*updated_at \+ interval '1 millisecond'\s*\)\s+WHERE tenant_id = \$2 AND id = \$3/,
+      ),
+      ["active", "tenant-1", "webapp_123"],
+    );
+    expect(result?.status).toBe("active");
+  });
+
+  it("monotonically advances a same-millisecond version so a stale writer conflicts", async () => {
+    const advanced = new Date(now.getTime() + 1);
+    mockQuery
+      .mockResolvedValueOnce({ rowCount: 1, rows: [{ ...row, status: "active", updated_at: advanced }] })
+      .mockResolvedValueOnce({ rowCount: 0, rows: [] });
+    const store = new PostgreSQLAgentWebAppStore({ pool });
+
+    await expect(store.update(
+      "tenant-1",
+      "webapp_123",
+      { status: "active" },
+      { expectedUpdatedAt: now },
+    )).resolves.toMatchObject({ status: "active", updatedAt: advanced });
+    await expect(store.update(
+      "tenant-1",
+      "webapp_123",
+      { status: "disabled" },
+      { expectedUpdatedAt: now },
+    )).resolves.toBeNull();
+
+    const monotonicCasSql = expect.stringMatching(
+      /SET status = \$1, updated_at = GREATEST\(\s*date_trunc\('milliseconds', clock_timestamp\(\)\),\s*updated_at \+ interval '1 millisecond'\s*\)\s+WHERE tenant_id = \$2 AND id = \$3 AND date_trunc\('milliseconds', updated_at\) = \$4/,
+    );
+    expect(mockQuery).toHaveBeenNthCalledWith(
+      1,
+      monotonicCasSql,
+      ["active", "tenant-1", "webapp_123", now],
+    );
+    expect(mockQuery).toHaveBeenNthCalledWith(
+      2,
+      monotonicCasSql,
+      ["disabled", "tenant-1", "webapp_123", now],
+    );
+  });
+
+  it("serializes JSONB update fields", async () => {
+    mockQuery.mockResolvedValueOnce({ rows: [row] });
+    const store = new PostgreSQLAgentWebAppStore({ pool });
+    const patch: UpdateAgentWebAppInput = {
+      scope: input.scope,
+      features: input.features,
+      appearance: input.appearance,
+    };
+
+    await store.update("tenant-1", "webapp_123", patch);
+
+    const [, params] = mockQuery.mock.calls[0] as [string, unknown[]];
+    expect(params).toEqual([
+      JSON.stringify(input.scope),
+      JSON.stringify(input.features),
+      JSON.stringify(input.appearance),
+      "tenant-1",
+      "webapp_123",
+    ]);
+  });
+
+  it("ignores undefined non-description fields as a read-only no-op", async () => {
+    mockQuery.mockResolvedValueOnce({ rows: [row] });
+    const store = new PostgreSQLAgentWebAppStore({ pool });
+    const patch: AgentWebAppStorePatch = {
+      name: undefined,
+      scope: undefined,
+      features: undefined,
+      appearance: undefined,
+      status: undefined,
+    };
+
+    const result = await store.update("tenant-1", "webapp_123", patch);
+
+    expect(mockQuery).toHaveBeenCalledTimes(1);
+    expect(mockQuery).toHaveBeenCalledWith(
+      expect.stringMatching(/^SELECT[\s\S]+WHERE tenant_id = \$1 AND id = \$2$/),
+      ["tenant-1", "webapp_123"],
+    );
+    expect(result?.updatedAt).toBe(now);
+  });
+
+  it("clears description when it is explicitly present as undefined", async () => {
+    mockQuery.mockResolvedValueOnce({ rows: [{ ...row, description: null }] });
+    const store = new PostgreSQLAgentWebAppStore({ pool });
+
+    await store.update("tenant-1", "webapp_123", { description: undefined });
+
+    expect(mockQuery).toHaveBeenCalledWith(
+      expect.stringContaining("SET description = $1, updated_at = GREATEST("),
+      [null, "tenant-1", "webapp_123"],
+    );
+  });
+
+  it("deletes by tenant and id and reports whether a row was removed", async () => {
+    mockQuery.mockResolvedValueOnce({ rowCount: 1, rows: [] });
+    const store = new PostgreSQLAgentWebAppStore({ pool });
+
+    await expect(store.delete("tenant-1", "webapp_123")).resolves.toBe(true);
+    expect(mockQuery).toHaveBeenCalledWith(
+      expect.stringMatching(/DELETE FROM lattice_agent_web_apps\s+WHERE tenant_id = \$1 AND id = \$2/),
+      ["tenant-1", "webapp_123"],
+    );
+  });
+
+  it("rejects rows that violate the stored JSON contract", async () => {
+    mockQuery.mockResolvedValueOnce({ rows: [{ ...row, integration: { type: "iframe" } }] });
+    const store = new PostgreSQLAgentWebAppStore({ pool });
+
+    await expect(store.getById("tenant-1", "webapp_123")).rejects.toThrow(
+      "Invalid agent web app row",
+    );
+  });
+});

package/src/__tests__/PostgreSQLChannelInstallationStore.test.ts

@@ -1,4 +1,5 @@
 import { PostgreSQLChannelInstallationStore } from "../stores/PostgreSQLChannelInstallationStore";
+import type { Pool } from "pg";
 
 const mockQuery = jest.fn();
 
@@ -20,8 +21,7 @@ describe("PostgreSQLChannelInstallationStore", () => {
 
   it("retrieves and decrypts an installation by id", async () => {
     const store = new PostgreSQLChannelInstallationStore({
-      poolConfig: "postgres://test:test@localhost:5432/test",
-      autoMigrate: false,
+      pool: { query: mockQuery } as unknown as Pool,
     });
 
     mockQuery.mockResolvedValueOnce({
@@ -51,4 +51,39 @@ describe("PostgreSQLChannelInstallationStore", () => {
     expect(installation?.config.appSecret).toBe("secret");
     expect(installation?.config.verificationToken).toBe("token-1");
   });
+
+  it("rejects a duplicate id without changing the original installation", async () => {
+    const store = new PostgreSQLChannelInstallationStore({
+      pool: { query: mockQuery } as unknown as Pool,
+    });
+    const originalRow = {
+      id: "install-1",
+      tenant_id: "tenant-a",
+      channel: "lark",
+      name: "Original",
+      config: { appId: "app-1", appSecret: "enc:secret-1" },
+      enabled: true,
+      fallback_agent_id: null,
+      reject_when_no_binding: true,
+      created_at: new Date("2026-04-10T00:00:00.000Z"),
+      updated_at: new Date("2026-04-10T00:00:00.000Z"),
+    };
+    const duplicateError = Object.assign(new Error("duplicate key value violates unique constraint"), {
+      code: "23505",
+    });
+    mockQuery.mockRejectedValueOnce(duplicateError).mockResolvedValueOnce({ rows: [originalRow] });
+
+    await expect(
+      store.createInstallation("tenant-a", "install-1", {
+        channel: "lark",
+        name: "Replacement",
+        config: { appId: "app-2", appSecret: "secret-2" },
+      }),
+    ).rejects.toMatchObject({ code: "23505" });
+    await expect(store.getInstallationById("install-1")).resolves.toMatchObject({
+      id: "install-1",
+      name: "Original",
+      config: { appId: "app-1", appSecret: "secret-1" },
+    });
+  });
 });