@axiom-lattice/pg-stores 3.1.8 → 3.1.10

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@axiom-lattice/pg-stores",
-  "version": "3.1.8",
+  "version": "3.1.10",
   "description": "PG stores implementation for Axiom Lattice framework",
   "main": "dist/index.js",
   "module": "dist/index.mjs",
@@ -25,8 +25,8 @@
     "@langchain/core": "1.1.30",
     "pg": "^8.16.3",
     "uuid": "^9.0.1",
-    "@axiom-lattice/core": "4.2.8",
-    "@axiom-lattice/protocols": "4.2.0"
+    "@axiom-lattice/core": "4.2.10",
+    "@axiom-lattice/protocols": "4.2.1"
   },
   "devDependencies": {
     "@types/jest": "^29.5.14",

package/src/__tests__/PostgreSQLA2AApiKeyStore.migrations.test.ts

@@ -55,7 +55,7 @@ describe("PostgreSQLA2AApiKeyStore standalone migrations", () => {
     mockClientSql.length = 0;
   });
 
-  it("registers and applies both the table and assistant_ids migrations", async () => {
+  it("registers and applies the table, assistant_ids, and grants migrations", async () => {
     const store = new PostgreSQLA2AApiKeyStore({
       poolConfig: "postgres://unused",
       autoMigrate: false,
@@ -66,6 +66,7 @@ describe("PostgreSQLA2AApiKeyStore standalone migrations", () => {
     expect(mockRecordedMigrationNames).toEqual([
       "create_a2a_api_keys_table",
       "add_a2a_key_assistant_ids",
+      "add_api_key_grants",
     ]);
     expect(
       mockClientSql.some((sql) => sql.includes("ADD COLUMN IF NOT EXISTS assistant_ids")),

package/src/__tests__/PostgreSQLA2AApiKeyStore.test.ts

@@ -131,3 +131,48 @@ describe("PostgreSQLA2AApiKeyStore", () => {
     expect("workspaceId" in (entry ?? {})).toBe(false);
   });
 });
+
+describe("PostgreSQLA2AApiKeyStore grants column", () => {
+  const pool2 = { query: mockQuery } as unknown as Pool;
+
+  beforeEach(() => {
+    jest.clearAllMocks();
+  });
+
+  it("create persists grants as JSON", async () => {
+    const store = new PostgreSQLA2AApiKeyStore({ pool: pool2 });
+    const grants = [{ domain: "kb", items: ["search"] }];
+    mockQuery.mockResolvedValueOnce({
+      rows: [{
+        id: "k1", key_value: "enc:a2a_x", tenant_id: "t1", project_id: "p1",
+        assistant_ids: null, grants, label: null, enabled: true,
+        created_at: new Date("2026-01-01T00:00:00.000Z"),
+        updated_at: new Date("2026-01-01T00:00:00.000Z"),
+      }],
+    });
+
+    const record = await store.create({
+      tenantId: "t1", projectId: "p1", grants,
+    });
+
+    const [sql, params] = mockQuery.mock.calls[0] as [string, unknown[]];
+    expect(sql).toContain("grants");
+    expect(params[4]).toBe(JSON.stringify(grants));
+    expect(record.grants).toEqual(grants);
+  });
+
+  it("mapRowToRecord projects grants back", async () => {
+    const store = new PostgreSQLA2AApiKeyStore({ pool: pool2 });
+    const grants = [{ domain: "kb" }];
+    mockQuery.mockResolvedValueOnce({
+      rows: [{
+        id: "k1", key_value: "enc:a2a_x", tenant_id: "t1", project_id: "p1",
+        assistant_ids: null, grants, label: null, enabled: true,
+        created_at: new Date("2026-01-01T00:00:00.000Z"),
+        updated_at: new Date("2026-01-01T00:00:00.000Z"),
+      }],
+    });
+    const record = await store.findById("k1");
+    expect(record?.grants).toEqual(grants);
+  });
+});

package/src/__tests__/PostgreSQLOpenAuditStore.test.ts

@@ -0,0 +1,100 @@
+import { describe, expect, it, jest, beforeEach } from "@jest/globals";
+import type { Pool } from "pg";
+
+const mockQuery = jest.fn();
+import { PostgreSQLOpenAuditStore } from "../stores/PostgreSQLOpenAuditStore";
+
+const pool = { query: mockQuery } as unknown as Pool;
+
+describe("PostgreSQLOpenAuditStore", () => {
+  beforeEach(() => jest.clearAllMocks());
+
+  it("append inserts a row with JSON args", async () => {
+    const store = new PostgreSQLOpenAuditStore({ pool });
+    mockQuery.mockResolvedValueOnce({ rows: [] });
+    await store.append({
+      tenantId: "t1",
+      credentialId: "k1",
+      credentialKind: "api_key",
+      projectId: "p1",
+      domain: "kb",
+      action: "search",
+      args: { query: "x" },
+      status: "ok",
+      durationMs: 12.7,
+    });
+    const [sql, params] = mockQuery.mock.calls[0] as [string, unknown[]];
+    expect(sql).toContain("INSERT INTO lattice_open_audit");
+    expect(params[6]).toBe(JSON.stringify({ query: "x" }));
+    expect(params[7]).toBe("ok");
+    expect(params[9]).toBe(13);
+  });
+
+  it("append persists null args safely", async () => {
+    const store = new PostgreSQLOpenAuditStore({ pool });
+    mockQuery.mockResolvedValueOnce({ rows: [] });
+    await store.append({
+      tenantId: "t1",
+      credentialId: "k1",
+      credentialKind: "browser_token",
+      projectId: "p1",
+      domain: "kb",
+      action: "search",
+      args: undefined,
+      status: "error",
+      errorCode: "GRANT_DENIED",
+      durationMs: 1,
+    });
+    const params = mockQuery.mock.calls[0][1] as unknown[];
+    expect(params[6]).toBeNull();
+    expect(params[8]).toBe("GRANT_DENIED");
+  });
+});
+
+describe("PostgreSQLOpenAuditStore.query", () => {
+  beforeEach(() => jest.clearAllMocks());
+
+  it("builds a tenant-scoped filtered query", async () => {
+    const store = new PostgreSQLOpenAuditStore({ pool });
+    mockQuery.mockResolvedValueOnce({ rows: [] });
+    await store.query({
+      tenantId: "t1",
+      domain: "kb",
+      status: "error",
+      from: "2026-01-01T00:00:00Z",
+      limit: 10,
+      offset: 5,
+    });
+    const [sql, values] = mockQuery.mock.calls[0] as [string, unknown[]];
+    expect(sql).toContain("tenant_id = $1");
+    expect(sql).toContain("domain = $2");
+    expect(sql).toContain("status = $3");
+    expect(sql).toContain("created_at >= $4");
+    expect(sql).toContain("ORDER BY created_at DESC");
+    expect(values).toEqual(["t1", "kb", "error", "2026-01-01T00:00:00Z", 10, 5]);
+  });
+
+  it("maps rows back to records", async () => {
+    const store = new PostgreSQLOpenAuditStore({ pool });
+    mockQuery.mockResolvedValueOnce({
+      rows: [
+        {
+          id: "a1",
+          tenant_id: "t1",
+          credential_id: "k1",
+          credential_kind: "api_key",
+          project_id: "p1",
+          domain: "kb",
+          action: "search",
+          args: { q: "x" },
+          status: "ok",
+          error_code: null,
+          duration_ms: 7,
+          created_at: new Date("2026-01-01T00:00:00Z"),
+        },
+      ],
+    });
+    const rows = await store.query({ tenantId: "t1" });
+    expect(rows[0]).toMatchObject({ id: "a1", status: "ok", errorCode: undefined });
+  });
+});

package/src/__tests__/PostgreSQLProjectRoomMessageStore.test.ts

@@ -100,4 +100,18 @@ describe("PostgreSQLProjectRoomMessageStore", () => {
     await expect(new PostgreSQLProjectRoomMessageStore({ pool }).findById("tenant-1", "message-1"))
       .rejects.toThrow("Invalid project room message row");
   });
+
+  it("skips individually invalid rows when listing while preserving valid rows", async () => {
+    const warn = jest.spyOn(console, "warn").mockImplementation(() => undefined);
+    const malformed = { ...row, id: "message-bad", content: { text: "missing type" } };
+    query.mockResolvedValueOnce({ rows: [row, malformed] });
+    const store = new PostgreSQLProjectRoomMessageStore({ pool });
+    await expect(store.list({ tenantId: "tenant-1", roomId: "room-1", limit: 10 }))
+      .resolves.toEqual([expect.objectContaining({ id: "message-1" })]);
+    expect(warn).toHaveBeenCalledWith(
+      "[ProjectRoomMessageStore] Skipping invalid message row",
+      expect.objectContaining({ tenantId: "tenant-1", roomId: "room-1", rowId: "message-bad" }),
+    );
+    warn.mockRestore();
+  });
 });

package/src/__tests__/PostgresSharedResourceStore.openGrants.test.ts

@@ -0,0 +1,62 @@
+import { describe, expect, it, jest, beforeEach } from "@jest/globals";
+import type { Pool } from "pg";
+import { PostgresSharedResourceStore } from "../stores/PostgresSharedResourceStore";
+
+const mockQuery = jest.fn();
+
+describe("PostgresSharedResourceStore openGrants", () => {
+  const pool = { query: mockQuery } as unknown as Pool;
+  beforeEach(() => jest.clearAllMocks());
+
+  it("persists open_grants as JSON on create", async () => {
+    const store = new PostgresSharedResourceStore({ pool } as never);
+    const openGrants = [{ domain: "kb", items: ["search"] }];
+    mockQuery.mockResolvedValueOnce({
+      rows: [
+        {
+          token: "tok",
+          address: JSON.stringify({ volume: "v", resourcePath: "index.html" }),
+          title: null,
+          created_by: "u1",
+          tenant_id: "t1",
+          workspace_id: "w1",
+          project_id: "p1",
+          assistant_id: null,
+          vm_isolation: "project",
+          visibility: "public",
+          password_hash: null,
+          expires_at: null,
+          max_access: null,
+          open_grants: openGrants,
+          access_count: 0,
+          revoked: false,
+          created_at: new Date().toISOString(),
+          version: 1,
+        },
+      ],
+    });
+
+    const record = await store.create({
+      token: "tok",
+      address: { volume: "v", resourcePath: "index.html" },
+      title: null,
+      createdBy: "u1",
+      tenantId: "t1",
+      workspaceId: "w1",
+      projectId: "p1",
+      assistantId: null,
+      vmIsolation: "project",
+      visibility: "public",
+      passwordHash: null,
+      expiresAt: null,
+      maxAccess: null,
+      openGrants,
+      revoked: false,
+    } as never);
+
+    const [sql, params] = mockQuery.mock.calls[0] as [string, unknown[]];
+    expect(sql).toContain("open_grants");
+    expect(params).toContain(JSON.stringify(openGrants));
+    expect(record.openGrants).toEqual(openGrants);
+  });
+});

package/src/__tests__/create_open_audit_table.test.ts

@@ -0,0 +1,40 @@
+/**
+ * create_open_audit_table migration tests
+ */
+
+import { describe, expect, it, jest } from "@jest/globals";
+import type { PoolClient } from "pg";
+import { createOpenAuditTable } from "../migrations/create_open_audit_table";
+
+describe("create_open_audit_table migration", () => {
+  it("has name create_open_audit_table", () => {
+    expect(createOpenAuditTable.name).toBe("create_open_audit_table");
+  });
+
+  it("has version 179", () => {
+    expect(createOpenAuditTable.version).toBe(179);
+  });
+
+  it("creates the audit table and tenant index in up()", async () => {
+    const queries: string[] = [];
+    const client = {
+      query: jest.fn(async (sql: string) => {
+        queries.push(sql);
+      }),
+    };
+    await createOpenAuditTable.up(client as unknown as PoolClient);
+    expect(queries.some((q) => q.includes("CREATE TABLE IF NOT EXISTS lattice_open_audit"))).toBe(true);
+    expect(queries.some((q) => q.includes("idx_lattice_open_audit_tenant_created"))).toBe(true);
+  });
+
+  it("drops the table in down()", async () => {
+    const queries: string[] = [];
+    const client = {
+      query: jest.fn(async (sql: string) => {
+        queries.push(sql);
+      }),
+    };
+    await createOpenAuditTable.down!(client as unknown as PoolClient);
+    expect(queries.some((q) => q.includes("DROP TABLE IF EXISTS lattice_open_audit"))).toBe(true);
+  });
+});

package/src/createPgStoreConfig.ts

@@ -17,6 +17,7 @@ import { ThreadMessageQueueStore } from "./stores/ThreadMessageQueueStore";
 import { ChannelBindingStore } from "./stores/ChannelBindingStore";
 import { PostgreSQLChannelInstallationStore } from "./stores/PostgreSQLChannelInstallationStore";
 import { PostgreSQLA2AApiKeyStore } from "./stores/PostgreSQLA2AApiKeyStore";
+import { PostgreSQLOpenAuditStore } from "./stores/PostgreSQLOpenAuditStore";
 import { PostgreSQLAgentWebAppStore } from "./stores/PostgreSQLAgentWebAppStore";
 import { PostgreSQLScheduleStorage } from "./stores/PostgreSQLScheduleStorage";
 import { PostgreSQLTaskStore } from "./stores/PostgreSQLTaskStore";
@@ -67,6 +68,9 @@ import { createWorkflowTrackingTables, addStepThreadId, addWorkflowRunsTenantSta
 import { evalMigrations } from "./migrations/eval_migrations";
 import { createA2AApiKeysTable } from "./migrations/a2a_api_key_migration";
 import { addA2AKeyAssistantIds } from "./migrations/add_a2a_key_assistant_ids";
+import { addApiKeyGrants } from "./migrations/add_api_key_grants";
+import { createOpenAuditTable } from "./migrations/create_open_audit_table";
+import { addShareOpenGrants } from "./migrations/add_share_open_grants";
 import { taskMigrations } from "./migrations/task_migration";
 import { createMenuItemsTable } from "./migrations/menu_items_migration";
 import { addFileContentType } from "./migrations/menu_items_add_file_type";
@@ -148,6 +152,9 @@ export async function createPgStoreConfig(connectionString: string) {
   mm.register(addWorkflowRunsTenantStatusUpdatedIndex); // v161
   mm.register(addProjectKindColumn);          // v165
   mm.register(addA2AKeyAssistantIds);         // v167
+  mm.register(addApiKeyGrants);               // v178
+  mm.register(createOpenAuditTable);          // v179
+  mm.register(addShareOpenGrants);            // v180
   mm.register(addTaskWorkItemEventKeyMigration); // v168
   mm.register(createAgentWebAppsTable);        // v169
   mm.register(createCapabilityBundlesTable);   // v170
@@ -189,6 +196,7 @@ export async function createPgStoreConfig(connectionString: string) {
     task: new PostgreSQLTaskStore(opts),
     taskWorkItem: taskWorkItemStore,
     a2aApiKey: new PostgreSQLA2AApiKeyStore(opts),
+    openAudit: new PostgreSQLOpenAuditStore(opts),
     agentWebApp: new PostgreSQLAgentWebAppStore(opts),
     capabilityBundle: new PostgreSQLCapabilityBundleStore(opts),
     schedule: new PostgreSQLScheduleStorage(opts),

package/src/index.ts

@@ -57,6 +57,7 @@ export * from "./stores/ThreadMessageQueueStore";
 export * from "./stores/ChannelIdentityMappingStore";
 export * from "./stores/PostgreSQLChannelInstallationStore";
 export * from "./stores/PostgreSQLA2AApiKeyStore";
+export * from "./stores/PostgreSQLOpenAuditStore";
 export * from "./stores/PostgreSQLAgentWebAppStore";
 export * from "./stores/PostgreSQLTaskWorkItemStore";
 export * from "./stores/PostgreSQLCapabilityBundleStore";

package/src/migrations/add_api_key_grants.ts

@@ -0,0 +1,25 @@
+import type { Migration } from "./migration";
+import type { PoolClient } from "pg";
+
+/**
+ * Adds the Open-door grants JSONB column to API keys.
+ *
+ * Absent/empty grants → legacy derivation via effectiveGrants()
+ * (assistantIds → agent-domain grant). The A2A door never reads this column.
+ */
+export const addApiKeyGrants: Migration = {
+  version: 178,
+  name: "add_api_key_grants",
+  up: async (client: PoolClient) => {
+    await client.query(`
+      ALTER TABLE lattice_a2a_api_keys
+        ADD COLUMN IF NOT EXISTS grants JSONB
+    `);
+  },
+  down: async (client: PoolClient) => {
+    await client.query(`
+      ALTER TABLE lattice_a2a_api_keys
+        DROP COLUMN IF EXISTS grants
+    `);
+  },
+};

package/src/migrations/add_share_open_grants.ts

@@ -0,0 +1,23 @@
+import type { Migration } from "./migration";
+import type { PoolClient } from "pg";
+
+/**
+ * Adds Open-door grants to resource shares. Sandbox tokens minted for a share
+ * append these (sanitized against the V1 whitelist) to their self grant.
+ */
+export const addShareOpenGrants: Migration = {
+  version: 180,
+  name: "add_share_open_grants",
+  up: async (client: PoolClient) => {
+    await client.query(`
+      ALTER TABLE lattice_shared_resources
+        ADD COLUMN IF NOT EXISTS open_grants JSONB
+    `);
+  },
+  down: async (client: PoolClient) => {
+    await client.query(`
+      ALTER TABLE lattice_shared_resources
+        DROP COLUMN IF EXISTS open_grants
+    `);
+  },
+};

package/src/migrations/create_open_audit_table.ts

@@ -0,0 +1,36 @@
+import type { Migration } from "./migration";
+import type { PoolClient } from "pg";
+
+/**
+ * Append-only audit log for the Open API surface (one row per invoke).
+ */
+export const createOpenAuditTable: Migration = {
+  version: 179,
+  name: "create_open_audit_table",
+  up: async (client: PoolClient) => {
+    await client.query(`
+      CREATE TABLE IF NOT EXISTS lattice_open_audit (
+        id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+        tenant_id VARCHAR(255) NOT NULL,
+        credential_id VARCHAR(255) NOT NULL,
+        credential_kind VARCHAR(32) NOT NULL,
+        project_id VARCHAR(255) NOT NULL,
+        domain VARCHAR(255) NOT NULL,
+        action VARCHAR(255) NOT NULL,
+        args JSONB,
+        status VARCHAR(16) NOT NULL,
+        error_code VARCHAR(64),
+        duration_ms INTEGER NOT NULL,
+        created_at TIMESTAMP NOT NULL DEFAULT NOW()
+      )
+    `);
+
+    await client.query(`
+      CREATE INDEX IF NOT EXISTS idx_lattice_open_audit_tenant_created
+      ON lattice_open_audit(tenant_id, created_at DESC)
+    `);
+  },
+  down: async (client: PoolClient) => {
+    await client.query("DROP TABLE IF EXISTS lattice_open_audit");
+  },
+};

package/src/stores/PostgreSQLA2AApiKeyStore.ts

@@ -1,6 +1,7 @@
 import { Pool } from "pg";
 import type { PoolConfig } from "pg";
 import type {
+  UpdateA2AApiKeyInput,
   A2AApiKeyStore,
   A2AApiKeyRecord,
   CreateA2AApiKeyInput,
@@ -9,6 +10,7 @@ import type {
 import { MigrationManager } from "../migrations/migration";
 import { createA2AApiKeysTable } from "../migrations/a2a_api_key_migration";
 import { addA2AKeyAssistantIds } from "../migrations/add_a2a_key_assistant_ids";
+import { addApiKeyGrants } from "../migrations/add_api_key_grants";
 import { encrypt, decrypt } from "@axiom-lattice/core";
 import { randomUUID } from "crypto";
 
@@ -24,6 +26,7 @@ type KeyRow = {
   tenant_id: string;
   project_id: string;
   assistant_ids: string[] | null;
+  grants: unknown[] | null;
   label: string | null;
   enabled: boolean;
   created_at: Date;
@@ -41,6 +44,7 @@ function mapRowToRecord(row: KeyRow): A2AApiKeyRecord {
     tenantId: row.tenant_id,
     projectId: row.project_id,
     assistantIds: row.assistant_ids ?? undefined,
+    grants: (row.grants as A2AApiKeyRecord["grants"]) ?? undefined,
     label: row.label || undefined,
     enabled: row.enabled,
     createdAt: row.created_at,
@@ -78,6 +82,7 @@ export class PostgreSQLA2AApiKeyStore implements A2AApiKeyStore {
     // overlap is safe.
     this.migrationManager.register(createA2AApiKeysTable);
     this.migrationManager.register(addA2AKeyAssistantIds);
+    this.migrationManager.register(addApiKeyGrants);
 
     if (options.autoMigrate !== false) {
       this.initialize().catch((error) => {
@@ -111,13 +116,31 @@ export class PostgreSQLA2AApiKeyStore implements A2AApiKeyStore {
     if (!this.initialized) await this.initialize();
   }
 
+  /** Map rows that decrypt cleanly; skip rows under an unknown key. */
+  private safeMap(rows: KeyRow[]): A2AApiKeyRecord[] {
+    const out: A2AApiKeyRecord[] = [];
+    for (const row of rows) {
+      try {
+        out.push(mapRowToRecord(row));
+      } catch {
+        // Skip undecryptable rows.
+      }
+    }
+    return out;
+  }
+
   async findByKey(key: string): Promise<A2AApiKeyRecord | null> {
     await this.ensureInitialized();
     const all = await this.pool.query<KeyRow>(
       `SELECT * FROM lattice_a2a_api_keys WHERE enabled = true`,
     );
     for (const row of all.rows) {
-      if (decrypt(row.key_value) === key) return mapRowToRecord(row);
+      // A row encrypted under a different key must not break every lookup.
+      try {
+        if (decrypt(row.key_value) === key) return mapRowToRecord(row);
+      } catch {
+        continue;
+      }
     }
     return null;
   }
@@ -128,7 +151,12 @@ export class PostgreSQLA2AApiKeyStore implements A2AApiKeyStore {
       `SELECT * FROM lattice_a2a_api_keys WHERE id = $1`,
       [id],
     );
-    return result.rows[0] ? mapRowToRecord(result.rows[0]) : null;
+    if (!result.rows[0]) return null;
+    try {
+      return mapRowToRecord(result.rows[0]);
+    } catch {
+      return null;
+    }
   }
 
   async list(params: { tenantId?: string; limit?: number; offset?: number }): Promise<A2AApiKeyRecord[]> {
@@ -140,28 +168,71 @@ export class PostgreSQLA2AApiKeyStore implements A2AApiKeyStore {
         `SELECT * FROM lattice_a2a_api_keys WHERE tenant_id = $1 ORDER BY created_at DESC LIMIT $2 OFFSET $3`,
         [params.tenantId, limit, offset],
       );
-      return result.rows.map(mapRowToRecord);
+      return this.safeMap(result.rows);
     }
     const result = await this.pool.query<KeyRow>(
       `SELECT * FROM lattice_a2a_api_keys ORDER BY created_at DESC LIMIT $1 OFFSET $2`,
       [limit, offset],
     );
-    return result.rows.map(mapRowToRecord);
+    return this.safeMap(result.rows);
   }
 
   async create(input: CreateA2AApiKeyInput): Promise<A2AApiKeyRecord> {
     await this.ensureInitialized();
     const key = generateApiKey();
     const result = await this.pool.query<KeyRow>(
-      `INSERT INTO lattice_a2a_api_keys (key_value, tenant_id, project_id, assistant_ids, label)
-       VALUES ($1, $2, $3, $4, $5) RETURNING *`,
-      [encrypt(key), input.tenantId, input.projectId, input.assistantIds ? JSON.stringify(input.assistantIds) : null, input.label || null],
+      `INSERT INTO lattice_a2a_api_keys (key_value, tenant_id, project_id, assistant_ids, grants, label)
+       VALUES ($1, $2, $3, $4, $5, $6) RETURNING *`,
+      [
+        encrypt(key),
+        input.tenantId,
+        input.projectId,
+        input.assistantIds ? JSON.stringify(input.assistantIds) : null,
+        input.grants ? JSON.stringify(input.grants) : null,
+        input.label || null,
+      ],
     );
     const record = mapRowToRecord(result.rows[0]);
     record.key = key;
     return record;
   }
 
+
+  async update(id: string, input: UpdateA2AApiKeyInput): Promise<A2AApiKeyRecord> {
+    await this.ensureInitialized();
+    const sets: string[] = [];
+    const values: unknown[] = [];
+    if (input.label !== undefined) {
+      values.push(input.label || null);
+      sets.push(`label = $${values.length}`);
+    }
+    if (input.projectId !== undefined) {
+      values.push(input.projectId);
+      sets.push(`project_id = $${values.length}`);
+    }
+    if (input.assistantIds !== undefined) {
+      values.push(input.assistantIds ? JSON.stringify(input.assistantIds) : null);
+      sets.push(`assistant_ids = $${values.length}`);
+    }
+    if (input.grants !== undefined) {
+      values.push(input.grants ? JSON.stringify(input.grants) : null);
+      sets.push(`grants = $${values.length}`);
+    }
+    if (sets.length === 0) {
+      const existing = await this.findById(id);
+      if (!existing) throw new Error(`A2A API key not found: ${id}`);
+      return existing;
+    }
+    sets.push("updated_at = NOW()");
+    values.push(id);
+    const result = await this.pool.query<KeyRow>(
+      `UPDATE lattice_a2a_api_keys SET ${sets.join(", ")} WHERE id = $${values.length} RETURNING *`,
+      values,
+    );
+    if (result.rows.length === 0) throw new Error(`A2A API key not found: ${id}`);
+    return mapRowToRecord(result.rows[0]);
+  }
+
   async disable(id: string): Promise<A2AApiKeyRecord> {
     await this.ensureInitialized();
     const result = await this.pool.query<KeyRow>(
@@ -207,13 +278,18 @@ export class PostgreSQLA2AApiKeyStore implements A2AApiKeyStore {
     );
     const map = new Map<string, A2AApiKeyEntry>();
     for (const row of result.rows) {
-      const key = decrypt(row.key_value);
-      map.set(key, {
-        key,
-        tenantId: row.tenant_id,
-        projectId: row.project_id,
-        assistantIds: row.assistant_ids ?? undefined,
-      });
+      try {
+        const key = decrypt(row.key_value);
+        map.set(key, {
+          key,
+          tenantId: row.tenant_id,
+          projectId: row.project_id,
+          assistantIds: row.assistant_ids ?? undefined,
+          grants: (row.grants as A2AApiKeyEntry["grants"]) ?? undefined,
+        });
+      } catch {
+        // Skip rows encrypted under an unknown key.
+      }
     }
     return map;
   }