@axiom-lattice/pg-stores 3.3.1 → 3.3.3

package/.turbo/turbo-build.log

@@ -1,5 +1,5 @@
 
-> @axiom-lattice/pg-stores@3.3.1 build /home/runner/work/agentic/agentic/packages/pg-stores
+> @axiom-lattice/pg-stores@3.3.3 build /home/runner/work/agentic/agentic/packages/pg-stores
 > tsup src/index.ts --format cjs,esm --dts --sourcemap
 
 CLI Building entry: src/index.ts
@@ -8,13 +8,13 @@
 CLI Target: es2020
 CJS Build start
 ESM Build start
-ESM dist/index.mjs     425.03 KB
-ESM dist/index.mjs.map 790.15 KB
-ESM ⚡️ Build success in 910ms
-CJS dist/index.js     433.50 KB
-CJS dist/index.js.map 790.48 KB
-CJS ⚡️ Build success in 981ms
+CJS dist/index.js     434.94 KB
+CJS dist/index.js.map 793.26 KB
+CJS ⚡️ Build success in 1005ms
+ESM dist/index.mjs     426.45 KB
+ESM dist/index.mjs.map 792.92 KB
+ESM ⚡️ Build success in 1062ms
 DTS Build start
-DTS ⚡️ Build success in 15242ms
+DTS ⚡️ Build success in 13655ms
 DTS dist/index.d.ts  91.36 KB
 DTS dist/index.d.mts 91.36 KB

package/CHANGELOG.md

@@ -1,5 +1,29 @@
 # @axiom-lattice/pg-stores
 
+## 3.3.3
+
+### Patch Changes
+
+- Updated dependencies
+  - @axiom-lattice/core@6.3.3
+
+## 3.3.2
+
+### Patch Changes
+
+- bb2614f: Chating composer height, plugin connection-secret encryption, and manage_task compact cards.
+
+  - react-sdk: keep the Chating composer input from collapsing after a run. In slot mode (Chating always passes an array `slotConfig`) the Sender input is a `contentEditable` whose height comes from `autoSize`; without a `minRows` the empty editor lost its placeholder-driven line box once streaming ended and collapsed to zero height on some platforms (e.g. Windows Chrome), leaving the input unreachable while the footer stayed visible. Pass `autoSize={{ minRows: 1, maxRows: 8 }}` like `ProjectRoomComposer`.
+  - protocols/core: add `ConnectionEntry.secretFields`, plus `connectionSecretFields` / `encryptConfigFields` / `decryptConfigFields`.
+  - local-stores/pg-stores: encrypt the declared secret fields on save and decrypt on read, so the API and runtime consumers always receive real values. Existing plaintext rows read unchanged and convert on their next save (PG migration v188).
+  - gateway: plugin builder self-test discovery + secret redaction.
+  - core: `manage_task` `add_activity` now returns the target task alongside the activity (`{ success, data, task }`), so UIs can show which task an activity was written to.
+  - react-sdk: every `manage_task` action renders a compact chip in the chat stream and reveals its full card on hover. Fixes `get` and `add_activity`, which previously rendered no UI at all.
+
+- Updated dependencies [bb2614f]
+  - @axiom-lattice/protocols@4.7.1
+  - @axiom-lattice/core@6.3.2
+
 ## 3.3.1
 
 ### Patch Changes

package/dist/index.js

@@ -1378,6 +1378,7 @@ var PostgreSQLDatabaseConfigStore = class {
 
 // src/stores/PostgreSQLConnectionStore.ts
 var import_uuid = require("uuid");
+var import_core2 = require("@axiom-lattice/core");
 var TABLE = "lattice_connection_configs";
 var PostgreSQLConnectionStore = class {
   constructor(db) {
@@ -1408,9 +1409,10 @@ var PostgreSQLConnectionStore = class {
   async create(entry) {
     const id = (0, import_uuid.v4)();
     const now = (/* @__PURE__ */ new Date()).toISOString();
+    const secretFields = entry.secretFields?.length ? entry.secretFields : void 0;
     await this.db.query(
-      `INSERT INTO ${TABLE} (id, tenant_id, type, key, name, description, config, status, created_at, updated_at)
-       VALUES ($1, $2, $3, $4, $5, $6, $7, 'active', $8::timestamp, $9::timestamp)`,
+      `INSERT INTO ${TABLE} (id, tenant_id, type, key, name, description, config, secret_fields, status, created_at, updated_at)
+       VALUES ($1, $2, $3, $4, $5, $6, $7, $8::jsonb, 'active', $9::timestamp, $10::timestamp)`,
       [
         id,
         entry.tenantId,
@@ -1418,12 +1420,13 @@ var PostgreSQLConnectionStore = class {
         entry.key,
         entry.name,
         entry.description || null,
-        JSON.stringify(entry.config),
+        JSON.stringify((0, import_core2.encryptConfigFields)(entry.config, secretFields)),
+        secretFields ? JSON.stringify(secretFields) : null,
         now,
         now
       ]
     );
-    return { id, ...entry, createdAt: now, updatedAt: now };
+    return { id, ...entry, secretFields, createdAt: now, updatedAt: now };
   }
   async update(tenantId, type, key, updates) {
     const existing = await this.getByKey(tenantId, type, key);
@@ -1440,8 +1443,11 @@ var PostgreSQLConnectionStore = class {
       values.push(updates.description || null);
     }
     if (updates.config !== void 0) {
+      const secretFields = updates.secretFields?.length ? updates.secretFields : existing.secretFields?.length ? existing.secretFields : void 0;
       setClauses.push(`config = $${paramIndex++}`);
-      values.push(JSON.stringify(updates.config));
+      values.push(JSON.stringify((0, import_core2.encryptConfigFields)(updates.config, secretFields)));
+      setClauses.push(`secret_fields = $${paramIndex++}::jsonb`);
+      values.push(secretFields ? JSON.stringify(secretFields) : null);
     }
     if (setClauses.length === 0) return existing;
     setClauses.push(`updated_at = $${paramIndex++}::timestamp`);
@@ -1464,6 +1470,9 @@ var PostgreSQLConnectionStore = class {
     return (result.rowCount ?? 0) > 0;
   }
   mapRow(row) {
+    const parsedSecretFields = typeof row.secret_fields === "string" ? JSON.parse(row.secret_fields) : row.secret_fields;
+    const secretFields = Array.isArray(parsedSecretFields) && parsedSecretFields.length > 0 ? parsedSecretFields.filter((field) => typeof field === "string") : void 0;
+    const storedConfig = typeof row.config === "string" ? JSON.parse(row.config) : row.config;
     return {
       id: row.id,
       tenantId: row.tenant_id,
@@ -1471,7 +1480,8 @@ var PostgreSQLConnectionStore = class {
       key: row.key,
       name: row.name,
       description: row.description || void 0,
-      config: typeof row.config === "string" ? JSON.parse(row.config) : row.config,
+      config: (0, import_core2.decryptConfigFields)(storedConfig, secretFields),
+      secretFields,
       createdAt: row.created_at instanceof Date ? row.created_at.toISOString() : String(row.created_at),
       updatedAt: row.updated_at instanceof Date ? row.updated_at.toISOString() : String(row.updated_at)
     };
@@ -1518,7 +1528,7 @@ var createMetricsConfigsTable = {
 };
 
 // src/stores/PostgreSQLMetricsServerConfigStore.ts
-var import_core2 = require("@axiom-lattice/core");
+var import_core3 = require("@axiom-lattice/core");
 var PostgreSQLMetricsServerConfigStore = class {
   constructor(options) {
     this.initialized = false;
@@ -1774,7 +1784,7 @@ var PostgreSQLMetricsServerConfigStore = class {
     const config = typeof row.config === "string" ? JSON.parse(row.config) : row.config;
     if (config.apiKey) {
       try {
-        config.apiKey = (0, import_core2.decrypt)(config.apiKey);
+        config.apiKey = (0, import_core3.decrypt)(config.apiKey);
       } catch (error) {
         console.error("Failed to decrypt apiKey:", error);
         throw new Error("Failed to decrypt metrics server configuration");
@@ -1782,7 +1792,7 @@ var PostgreSQLMetricsServerConfigStore = class {
     }
     if (config.password) {
       try {
-        config.password = (0, import_core2.decrypt)(config.password);
+        config.password = (0, import_core3.decrypt)(config.password);
       } catch (error) {
         console.error("Failed to decrypt password:", error);
         throw new Error("Failed to decrypt metrics server configuration");
@@ -1805,10 +1815,10 @@ var PostgreSQLMetricsServerConfigStore = class {
   encryptSecretsInConfig(config) {
     const configCopy = { ...config };
     if (configCopy.apiKey) {
-      configCopy.apiKey = (0, import_core2.encrypt)(configCopy.apiKey);
+      configCopy.apiKey = (0, import_core3.encrypt)(configCopy.apiKey);
     }
     if (configCopy.password) {
-      configCopy.password = (0, import_core2.encrypt)(configCopy.password);
+      configCopy.password = (0, import_core3.encrypt)(configCopy.password);
     }
     return configCopy;
   }
@@ -1862,7 +1872,7 @@ var createMcpServerConfigsTable = {
 };
 
 // src/stores/PostgreSQLMcpServerConfigStore.ts
-var import_core3 = require("@axiom-lattice/core");
+var import_core4 = require("@axiom-lattice/core");
 var PostgreSQLMcpServerConfigStore = class {
   constructor(options) {
     this.initialized = false;
@@ -2136,7 +2146,7 @@ var PostgreSQLMcpServerConfigStore = class {
       try {
         const decryptedEnv = {};
         for (const [key, value] of Object.entries(config.env)) {
-          decryptedEnv[key] = (0, import_core3.decrypt)(value);
+          decryptedEnv[key] = (0, import_core4.decrypt)(value);
         }
         config.env = decryptedEnv;
       } catch (error) {
@@ -2148,7 +2158,7 @@ var PostgreSQLMcpServerConfigStore = class {
       try {
         const decryptedHeaders = {};
         for (const [key, value] of Object.entries(config.headers)) {
-          decryptedHeaders[key] = (0, import_core3.decrypt)(value);
+          decryptedHeaders[key] = (0, import_core4.decrypt)(value);
         }
         config.headers = decryptedHeaders;
       } catch (error) {
@@ -2179,7 +2189,7 @@ var PostgreSQLMcpServerConfigStore = class {
     if (configCopy.env && Object.keys(configCopy.env).length > 0) {
       const encryptedEnv = {};
       for (const [key, value] of Object.entries(configCopy.env)) {
-        encryptedEnv[key] = (0, import_core3.encrypt)(value);
+        encryptedEnv[key] = (0, import_core4.encrypt)(value);
       }
       configCopy.env = encryptedEnv;
       isEnvEncrypted = true;
@@ -2187,7 +2197,7 @@ var PostgreSQLMcpServerConfigStore = class {
     if (configCopy.headers && Object.keys(configCopy.headers).length > 0) {
       const encryptedHeaders = {};
       for (const [key, value] of Object.entries(configCopy.headers)) {
-        encryptedHeaders[key] = (0, import_core3.encrypt)(value);
+        encryptedHeaders[key] = (0, import_core4.encrypt)(value);
       }
       configCopy.headers = encryptedHeaders;
       isEnvEncrypted = true;
@@ -6038,7 +6048,7 @@ var alterChannelInstallationsTable = {
 };
 
 // src/stores/PostgreSQLChannelInstallationStore.ts
-var import_core4 = require("@axiom-lattice/core");
+var import_core5 = require("@axiom-lattice/core");
 var PostgreSQLChannelInstallationStore = class {
   constructor(options) {
     this.initialized = false;
@@ -6260,17 +6270,17 @@ var PostgreSQLChannelInstallationStore = class {
   encryptSecrets(config) {
     return {
       ...config,
-      ...typeof config.appSecret === "string" ? { appSecret: (0, import_core4.encrypt)(config.appSecret) } : {},
-      ...typeof config.verificationToken === "string" ? { verificationToken: (0, import_core4.encrypt)(config.verificationToken) } : {},
-      ...typeof config.encryptKey === "string" ? { encryptKey: (0, import_core4.encrypt)(config.encryptKey) } : {}
+      ...typeof config.appSecret === "string" ? { appSecret: (0, import_core5.encrypt)(config.appSecret) } : {},
+      ...typeof config.verificationToken === "string" ? { verificationToken: (0, import_core5.encrypt)(config.verificationToken) } : {},
+      ...typeof config.encryptKey === "string" ? { encryptKey: (0, import_core5.encrypt)(config.encryptKey) } : {}
     };
   }
   decryptSecrets(config) {
     return {
       ...config,
-      ...typeof config.appSecret === "string" ? { appSecret: (0, import_core4.decrypt)(config.appSecret) } : {},
-      ...typeof config.verificationToken === "string" ? { verificationToken: (0, import_core4.decrypt)(config.verificationToken) } : {},
-      ...typeof config.encryptKey === "string" ? { encryptKey: (0, import_core4.decrypt)(config.encryptKey) } : {}
+      ...typeof config.appSecret === "string" ? { appSecret: (0, import_core5.decrypt)(config.appSecret) } : {},
+      ...typeof config.verificationToken === "string" ? { verificationToken: (0, import_core5.decrypt)(config.verificationToken) } : {},
+      ...typeof config.encryptKey === "string" ? { encryptKey: (0, import_core5.decrypt)(config.encryptKey) } : {}
     };
   }
 };
@@ -6348,7 +6358,7 @@ var addApiKeyGrants = {
 };
 
 // src/stores/PostgreSQLA2AApiKeyStore.ts
-var import_core5 = require("@axiom-lattice/core");
+var import_core6 = require("@axiom-lattice/core");
 var import_crypto2 = require("crypto");
 function generateApiKey() {
   return `a2a_${(0, import_crypto2.randomUUID)().replace(/-/g, "")}`;
@@ -6356,7 +6366,7 @@ function generateApiKey() {
 function mapRowToRecord(row) {
   return {
     id: row.id,
-    key: (0, import_core5.decrypt)(row.key_value),
+    key: (0, import_core6.decrypt)(row.key_value),
     tenantId: row.tenant_id,
     projectId: row.project_id,
     assistantIds: row.assistant_ids ?? void 0,
@@ -6431,7 +6441,7 @@ var PostgreSQLA2AApiKeyStore = class {
     );
     for (const row of all.rows) {
       try {
-        if ((0, import_core5.decrypt)(row.key_value) === key) return mapRowToRecord(row);
+        if ((0, import_core6.decrypt)(row.key_value) === key) return mapRowToRecord(row);
       } catch {
         continue;
       }
@@ -6475,7 +6485,7 @@ var PostgreSQLA2AApiKeyStore = class {
       `INSERT INTO lattice_a2a_api_keys (key_value, tenant_id, project_id, assistant_ids, grants, label)
        VALUES ($1, $2, $3, $4, $5, $6) RETURNING *`,
       [
-        (0, import_core5.encrypt)(key),
+        (0, import_core6.encrypt)(key),
         input.tenantId,
         input.projectId,
         input.assistantIds ? JSON.stringify(input.assistantIds) : null,
@@ -6544,7 +6554,7 @@ var PostgreSQLA2AApiKeyStore = class {
     const key = generateApiKey();
     const result = await this.pool.query(
       `UPDATE lattice_a2a_api_keys SET key_value = $1, updated_at = NOW() WHERE id = $2 RETURNING *`,
-      [(0, import_core5.encrypt)(key), id]
+      [(0, import_core6.encrypt)(key), id]
     );
     if (result.rows.length === 0) throw new Error(`A2A API key not found: ${id}`);
     const record = mapRowToRecord(result.rows[0]);
@@ -6563,7 +6573,7 @@ var PostgreSQLA2AApiKeyStore = class {
     const map2 = /* @__PURE__ */ new Map();
     for (const row of result.rows) {
       try {
-        const key = (0, import_core5.decrypt)(row.key_value);
+        const key = (0, import_core6.decrypt)(row.key_value);
         map2.set(key, {
           key,
           tenantId: row.tenant_id,
@@ -9609,7 +9619,7 @@ var import_langgraph_checkpoint_postgres = require("@langchain/langgraph-checkpo
 var import_pg25 = require("pg");
 var import_pgvector = require("@langchain/community/vectorstores/pgvector");
 var import_documents = require("@langchain/core/documents");
-var import_core6 = require("@axiom-lattice/core");
+var import_core7 = require("@axiom-lattice/core");
 function safeTableName(name) {
   if (!/^[a-z][a-z0-9_-]*$/.test(name)) {
     throw new Error(`Invalid table name: ${name}`);
@@ -9625,10 +9635,10 @@ var PGVectorStoreProvider = class {
     const { tableName, embeddingKey } = params;
     let embeddings;
     try {
-      embeddings = import_core6.embeddingsLatticeManager.getEmbeddingsClient(embeddingKey);
+      embeddings = import_core7.embeddingsLatticeManager.getEmbeddingsClient(embeddingKey);
     } catch {
       try {
-        embeddings = import_core6.embeddingsLatticeManager.getEmbeddingsClient("default");
+        embeddings = import_core7.embeddingsLatticeManager.getEmbeddingsClient("default");
       } catch {
         throw new Error(
           `No embedding model registered. Register one first:
@@ -9934,6 +9944,22 @@ var createConnectionConfigsTable = {
     await client.query("DROP TABLE IF EXISTS lattice_connection_configs");
   }
 };
+var addConnectionSecretFields = {
+  version: 188,
+  name: "add_connection_secret_fields",
+  up: async (client) => {
+    await client.query(`
+      ALTER TABLE lattice_connection_configs
+        ADD COLUMN IF NOT EXISTS secret_fields JSONB
+    `);
+  },
+  down: async (client) => {
+    await client.query(`
+      ALTER TABLE lattice_connection_configs
+        DROP COLUMN IF EXISTS secret_fields
+    `);
+  }
+};
 
 // src/migrations/add_share_open_grants.ts
 var addShareOpenGrants = {
@@ -11318,7 +11344,7 @@ var PostgreSQLUserPushSubscriptionStore = class {
 
 // src/stores/PostgreSQLModelProviderStore.ts
 var import_pg27 = require("pg");
-var import_core7 = require("@axiom-lattice/core");
+var import_core8 = require("@axiom-lattice/core");
 var PostgreSQLModelProviderStore = class {
   constructor(options) {
     this.initialized = false;
@@ -11433,7 +11459,7 @@ var PostgreSQLModelProviderStore = class {
     await this.ensureInitialized();
     const now = /* @__PURE__ */ new Date();
     const nowString = now.toISOString();
-    const apiKeyEnc = data.apiKey ? (0, import_core7.encrypt)(data.apiKey) : null;
+    const apiKeyEnc = data.apiKey ? (0, import_core8.encrypt)(data.apiKey) : null;
     const apiKeyHint = data.apiKey ? data.apiKey.slice(-4) : null;
     await this.pool.query(
       `
@@ -11509,7 +11535,7 @@ var PostgreSQLModelProviderStore = class {
       updateData.api_key_enc = null;
       updateData.api_key_hint = null;
     } else if (updates.apiKey) {
-      updateData.api_key_enc = (0, import_core7.encrypt)(updates.apiKey);
+      updateData.api_key_enc = (0, import_core8.encrypt)(updates.apiKey);
       updateData.api_key_hint = updates.apiKey.slice(-4);
     }
     if (updates.enabled !== void 0) {
@@ -11775,7 +11801,7 @@ var PostgreSQLModelProviderStore = class {
     let apiKey;
     if (row.api_key_enc) {
       try {
-        apiKey = (0, import_core7.decrypt)(row.api_key_enc);
+        apiKey = (0, import_core8.decrypt)(row.api_key_enc);
       } catch (error) {
         console.error("Failed to decrypt model provider API key:", error);
         throw new Error("Failed to decrypt model provider API key");
@@ -12099,6 +12125,7 @@ async function createPgStoreConfig(connectionString) {
   mm.register(addModelProviderModelStale);
   mm.register(createDistributedLeases);
   mm.register(createOutboxTable);
+  mm.register(addConnectionSecretFields);
   await mm.migrate();
   const checkpoint = import_langgraph_checkpoint_postgres.PostgresSaver.fromConnString(connectionString);
   checkpoint.setup().catch((err) => {