@axiom-lattice/pg-stores 3.3.4 → 3.3.6

package/.turbo/turbo-build.log

@@ -1,5 +1,5 @@
 
-> @axiom-lattice/pg-stores@3.3.4 build /home/runner/work/agentic/agentic/packages/pg-stores
+> @axiom-lattice/pg-stores@3.3.6 build /home/runner/work/agentic/agentic/packages/pg-stores
 > tsup src/index.ts --format cjs,esm --dts --sourcemap
 
 CLI Building entry: src/index.ts
@@ -8,13 +8,13 @@
 CLI Target: es2020
 CJS Build start
 ESM Build start
-CJS dist/index.js     443.09 KB
-CJS dist/index.js.map 807.74 KB
-CJS ⚡️ Build success in 1017ms
-ESM dist/index.mjs     434.40 KB
-ESM dist/index.mjs.map 807.39 KB
-ESM ⚡️ Build success in 1084ms
+CJS dist/index.js     446.36 KB
+CJS dist/index.js.map 818.00 KB
+CJS ⚡️ Build success in 929ms
+ESM dist/index.mjs     437.71 KB
+ESM dist/index.mjs.map 817.68 KB
+ESM ⚡️ Build success in 931ms
 DTS Build start
-DTS ⚡️ Build success in 14116ms
-DTS dist/index.d.ts  93.36 KB
-DTS dist/index.d.mts 93.36 KB
+DTS ⚡️ Build success in 12265ms
+DTS dist/index.d.ts  93.45 KB
+DTS dist/index.d.mts 93.45 KB

package/CHANGELOG.md

@@ -1,5 +1,25 @@
 # @axiom-lattice/pg-stores
 
+## 3.3.6
+
+### Patch Changes
+
+- Updated dependencies [726c98a]
+  - @axiom-lattice/core@7.0.0
+
+## 3.3.5
+
+### Patch Changes
+
+- Updated dependencies [cb75780]
+- Updated dependencies [c0f75e2]
+- Updated dependencies [48e3ce3]
+- Updated dependencies [3e923d0]
+- Updated dependencies [99bf609]
+- Updated dependencies [92bffbb]
+- Updated dependencies [a19e0aa]
+  - @axiom-lattice/core@6.4.1
+
 ## 3.3.4
 
 ### Patch Changes

package/dist/index.d.mts

@@ -1045,8 +1045,6 @@ declare class PostgreSQLA2AApiKeyStore implements A2AApiKeyStore {
     initialize(): Promise<void>;
     dispose(): Promise<void>;
     private ensureInitialized;
-    /** Map rows that decrypt cleanly; skip rows under an unknown key. */
-    private safeMap;
     findByKey(key: string): Promise<A2AApiKeyRecord | null>;
     findById(id: string): Promise<A2AApiKeyRecord | null>;
     list(params: {
@@ -1807,8 +1805,12 @@ declare class PostgreSQLModelProviderStore implements ModelProviderStore {
      * is an independent model.
      *
      * Models the upstream no longer offers are deleted; models that survive are
-     * upserted *without* touching `enabled`, so the tenant's enable/disable
-     * choice survives a re-discovery. New rows take the column default (enabled).
+     * upserted *without* touching `enabled` or `extra`, so the tenant's choices
+     * survive a re-discovery. New rows take the column defaults.
+     *
+     * The default model is the exception to the delete: it is kept and flagged
+     * `stale` instead, because deleting it would take the tenant's default away
+     * with no confirmation.
      */
     replaceProviderModels(tenantId: string, providerId: string, models: ProviderModelInput[]): Promise<string[]>;
     /**

package/dist/index.d.ts

@@ -1045,8 +1045,6 @@ declare class PostgreSQLA2AApiKeyStore implements A2AApiKeyStore {
     initialize(): Promise<void>;
     dispose(): Promise<void>;
     private ensureInitialized;
-    /** Map rows that decrypt cleanly; skip rows under an unknown key. */
-    private safeMap;
     findByKey(key: string): Promise<A2AApiKeyRecord | null>;
     findById(id: string): Promise<A2AApiKeyRecord | null>;
     list(params: {
@@ -1807,8 +1805,12 @@ declare class PostgreSQLModelProviderStore implements ModelProviderStore {
      * is an independent model.
      *
      * Models the upstream no longer offers are deleted; models that survive are
-     * upserted *without* touching `enabled`, so the tenant's enable/disable
-     * choice survives a re-discovery. New rows take the column default (enabled).
+     * upserted *without* touching `enabled` or `extra`, so the tenant's choices
+     * survive a re-discovery. New rows take the column defaults.
+     *
+     * The default model is the exception to the delete: it is kept and flagged
+     * `stale` instead, because deleting it would take the tenant's default away
+     * with no confirmation.
      */
     replaceProviderModels(tenantId: string, providerId: string, models: ProviderModelInput[]): Promise<string[]>;
     /**

package/dist/index.js

@@ -1349,12 +1349,7 @@ var PostgreSQLDatabaseConfigStore = class {
   mapRowToEntry(row) {
     const config = typeof row.config === "string" ? JSON.parse(row.config) : row.config;
     if (config.password) {
-      try {
-        config.password = (0, import_core.decrypt)(config.password);
-      } catch (error) {
-        console.error("Failed to decrypt database password:", error);
-        throw new Error("Failed to decrypt database configuration");
-      }
+      config.password = (0, import_core.safeDecrypt)(config.password);
     }
     return {
       id: row.id,
@@ -1786,20 +1781,10 @@ var PostgreSQLMetricsServerConfigStore = class {
   mapRowToEntry(row) {
     const config = typeof row.config === "string" ? JSON.parse(row.config) : row.config;
     if (config.apiKey) {
-      try {
-        config.apiKey = (0, import_core3.decrypt)(config.apiKey);
-      } catch (error) {
-        console.error("Failed to decrypt apiKey:", error);
-        throw new Error("Failed to decrypt metrics server configuration");
-      }
+      config.apiKey = (0, import_core3.safeDecrypt)(config.apiKey);
     }
     if (config.password) {
-      try {
-        config.password = (0, import_core3.decrypt)(config.password);
-      } catch (error) {
-        console.error("Failed to decrypt password:", error);
-        throw new Error("Failed to decrypt metrics server configuration");
-      }
+      config.password = (0, import_core3.safeDecrypt)(config.password);
     }
     return {
       id: row.id,
@@ -2146,28 +2131,18 @@ var PostgreSQLMcpServerConfigStore = class {
   mapRowToEntry(row) {
     const config = typeof row.config === "string" ? JSON.parse(row.config) : row.config;
     if (config.env && row.is_env_encrypted) {
-      try {
-        const decryptedEnv = {};
-        for (const [key, value] of Object.entries(config.env)) {
-          decryptedEnv[key] = (0, import_core4.decrypt)(value);
-        }
-        config.env = decryptedEnv;
-      } catch (error) {
-        console.error("Failed to decrypt MCP server env:", error);
-        throw new Error("Failed to decrypt MCP server configuration");
+      const decryptedEnv = {};
+      for (const [key, value] of Object.entries(config.env)) {
+        decryptedEnv[key] = (0, import_core4.safeDecrypt)(value);
       }
+      config.env = decryptedEnv;
     }
     if (config.headers && row.is_env_encrypted) {
-      try {
-        const decryptedHeaders = {};
-        for (const [key, value] of Object.entries(config.headers)) {
-          decryptedHeaders[key] = (0, import_core4.decrypt)(value);
-        }
-        config.headers = decryptedHeaders;
-      } catch (error) {
-        console.error("Failed to decrypt MCP server headers:", error);
-        throw new Error("Failed to decrypt MCP server configuration");
+      const decryptedHeaders = {};
+      for (const [key, value] of Object.entries(config.headers)) {
+        decryptedHeaders[key] = (0, import_core4.safeDecrypt)(value);
       }
+      config.headers = decryptedHeaders;
     }
     return {
       id: row.id,
@@ -6281,9 +6256,9 @@ var PostgreSQLChannelInstallationStore = class {
   decryptSecrets(config) {
     return {
       ...config,
-      ...typeof config.appSecret === "string" ? { appSecret: (0, import_core5.decrypt)(config.appSecret) } : {},
-      ...typeof config.verificationToken === "string" ? { verificationToken: (0, import_core5.decrypt)(config.verificationToken) } : {},
-      ...typeof config.encryptKey === "string" ? { encryptKey: (0, import_core5.decrypt)(config.encryptKey) } : {}
+      ...typeof config.appSecret === "string" ? { appSecret: (0, import_core5.safeDecrypt)(config.appSecret) } : {},
+      ...typeof config.verificationToken === "string" ? { verificationToken: (0, import_core5.safeDecrypt)(config.verificationToken) } : {},
+      ...typeof config.encryptKey === "string" ? { encryptKey: (0, import_core5.safeDecrypt)(config.encryptKey) } : {}
     };
   }
 };
@@ -6369,7 +6344,7 @@ function generateApiKey() {
 function mapRowToRecord(row) {
   return {
     id: row.id,
-    key: (0, import_core6.decrypt)(row.key_value),
+    key: (0, import_core6.safeDecrypt)(row.key_value),
     tenantId: row.tenant_id,
     projectId: row.project_id,
     assistantIds: row.assistant_ids ?? void 0,
@@ -6426,17 +6401,6 @@ var PostgreSQLA2AApiKeyStore = class {
   async ensureInitialized() {
     if (!this.initialized) await this.initialize();
   }
-  /** Map rows that decrypt cleanly; skip rows under an unknown key. */
-  safeMap(rows) {
-    const out = [];
-    for (const row of rows) {
-      try {
-        out.push(mapRowToRecord(row));
-      } catch {
-      }
-    }
-    return out;
-  }
   async findByKey(key) {
     await this.ensureInitialized();
     const all = await this.pool.query(
@@ -6473,13 +6437,13 @@ var PostgreSQLA2AApiKeyStore = class {
         `SELECT * FROM lattice_a2a_api_keys WHERE tenant_id = $1 ORDER BY created_at DESC LIMIT $2 OFFSET $3`,
         [params.tenantId, limit, offset]
       );
-      return this.safeMap(result2.rows);
+      return result2.rows.map((row) => mapRowToRecord(row));
     }
     const result = await this.pool.query(
       `SELECT * FROM lattice_a2a_api_keys ORDER BY created_at DESC LIMIT $1 OFFSET $2`,
       [limit, offset]
     );
-    return this.safeMap(result.rows);
+    return result.rows.map((row) => mapRowToRecord(row));
   }
   async create(input) {
     await this.ensureInitialized();
@@ -9909,6 +9873,7 @@ var createChannelIdentityMappingTables = {
 };
 
 // src/migrations/connection_config_migrations.ts
+var import_core8 = require("@axiom-lattice/core");
 var createConnectionConfigsTable = {
   version: 160,
   name: "create_connection_configs_table",
@@ -9963,6 +9928,38 @@ var addConnectionSecretFields = {
     `);
   }
 };
+var reencryptLegacyConnectionSecrets = {
+  version: 191,
+  name: "reencrypt_legacy_connection_secrets",
+  up: async (client) => {
+    const result = await client.query(
+      `SELECT id, tenant_id, config, secret_fields
+       FROM lattice_connection_configs
+       WHERE secret_fields IS NOT NULL`
+    );
+    for (const row of result.rows) {
+      const secretFields = Array.isArray(row.secret_fields) ? row.secret_fields.filter((field) => typeof field === "string") : [];
+      if (secretFields.length === 0) continue;
+      const config = row.config && typeof row.config === "object" ? { ...row.config } : {};
+      let changed = false;
+      for (const field of secretFields) {
+        const value = config[field];
+        if (typeof value === "string" && value.length > 0 && !(0, import_core8.isEncryptedValue)(value)) {
+          config[field] = (0, import_core8.encrypt)(value);
+          changed = true;
+        }
+      }
+      if (changed) {
+        await client.query(
+          `UPDATE lattice_connection_configs
+           SET config = $1::jsonb, updated_at = CURRENT_TIMESTAMP
+           WHERE tenant_id = $2 AND id = $3`,
+          [JSON.stringify(config), row.tenant_id, row.id]
+        );
+      }
+    }
+  }
+};
 
 // src/migrations/add_share_open_grants.ts
 var addShareOpenGrants = {
@@ -10437,6 +10434,44 @@ var addModelProviderModelStale = {
     `);
   }
 };
+var addModelProviderModelExtra = {
+  version: 191,
+  name: "add_model_provider_model_extra",
+  up: async (client) => {
+    await client.query(`
+      ALTER TABLE lattice_model_provider_models
+      ADD COLUMN IF NOT EXISTS extra JSONB NOT NULL DEFAULT '{}'::jsonb
+    `);
+  },
+  down: async (client) => {
+    await client.query(`
+      ALTER TABLE lattice_model_provider_models DROP COLUMN IF EXISTS extra
+    `);
+  }
+};
+var addModelProviderModelDefault = {
+  version: 192,
+  name: "add_model_provider_model_default",
+  up: async (client) => {
+    await client.query(`
+      ALTER TABLE lattice_model_provider_models
+      ADD COLUMN IF NOT EXISTS is_default BOOLEAN NOT NULL DEFAULT FALSE
+    `);
+    await client.query(`
+      CREATE UNIQUE INDEX IF NOT EXISTS uk_lattice_model_provider_models_tenant_default
+      ON lattice_model_provider_models (tenant_id)
+      WHERE is_default
+    `);
+  },
+  down: async (client) => {
+    await client.query(`
+      DROP INDEX IF EXISTS uk_lattice_model_provider_models_tenant_default
+    `);
+    await client.query(`
+      ALTER TABLE lattice_model_provider_models DROP COLUMN IF EXISTS is_default
+    `);
+  }
+};
 
 // src/stores/PostgreSQLCapabilityBundleStore.ts
 var import_crypto4 = require("crypto");
@@ -11401,7 +11436,10 @@ var PostgreSQLUserPushSubscriptionStore = class {
 
 // src/stores/PostgreSQLModelProviderStore.ts
 var import_pg27 = require("pg");
-var import_core8 = require("@axiom-lattice/core");
+var import_core9 = require("@axiom-lattice/core");
+function extraOrUndefined(value) {
+  return value && Object.keys(value).length > 0 ? value : void 0;
+}
 var PostgreSQLModelProviderStore = class {
   constructor(options) {
     this.initialized = false;
@@ -11423,6 +11461,10 @@ var PostgreSQLModelProviderStore = class {
     this.migrationManager = new MigrationManager(this.pool);
     this.migrationManager.register(createModelProvidersTable);
     this.migrationManager.register(createModelProviderModelsTable);
+    this.migrationManager.register(addModelProviderApiStyle);
+    this.migrationManager.register(addModelProviderModelStale);
+    this.migrationManager.register(addModelProviderModelExtra);
+    this.migrationManager.register(addModelProviderModelDefault);
     if (options.autoMigrate !== false) {
       this.initialize().catch((error) => {
         console.error("Failed to initialize PostgreSQLModelProviderStore:", error);
@@ -11516,7 +11558,7 @@ var PostgreSQLModelProviderStore = class {
     await this.ensureInitialized();
     const now = /* @__PURE__ */ new Date();
     const nowString = now.toISOString();
-    const apiKeyEnc = data.apiKey ? (0, import_core8.encrypt)(data.apiKey) : null;
+    const apiKeyEnc = data.apiKey ? (0, import_core9.encrypt)(data.apiKey) : null;
     const apiKeyHint = data.apiKey ? data.apiKey.slice(-4) : null;
     await this.pool.query(
       `
@@ -11592,7 +11634,7 @@ var PostgreSQLModelProviderStore = class {
       updateData.api_key_enc = null;
       updateData.api_key_hint = null;
     } else if (updates.apiKey) {
-      updateData.api_key_enc = (0, import_core8.encrypt)(updates.apiKey);
+      updateData.api_key_enc = (0, import_core9.encrypt)(updates.apiKey);
       updateData.api_key_hint = updates.apiKey.slice(-4);
     }
     if (updates.enabled !== void 0) {
@@ -11669,7 +11711,7 @@ var PostgreSQLModelProviderStore = class {
     const result = providerId ? await this.pool.query(
       `
           SELECT id, tenant_id, provider_id, model_id, display_name, owned_by,
-                 upstream_created, enabled, stale, discovered_at
+                 upstream_created, enabled, stale, extra, is_default, discovered_at
           FROM lattice_model_provider_models
           WHERE tenant_id = $1 AND provider_id = $2
           ORDER BY model_id ASC
@@ -11678,7 +11720,7 @@ var PostgreSQLModelProviderStore = class {
     ) : await this.pool.query(
       `
           SELECT id, tenant_id, provider_id, model_id, display_name, owned_by,
-                 upstream_created, enabled, discovered_at
+                 upstream_created, enabled, stale, extra, is_default, discovered_at
           FROM lattice_model_provider_models
           WHERE tenant_id = $1
           ORDER BY model_id ASC
@@ -11697,7 +11739,7 @@ var PostgreSQLModelProviderStore = class {
     const result = await this.pool.query(
       `
       SELECT id, tenant_id, provider_id, model_id, display_name, owned_by,
-             upstream_created, enabled, discovered_at
+             upstream_created, enabled, stale, extra, is_default, discovered_at
       FROM lattice_model_provider_models
       WHERE tenant_id = $1 AND provider_id = $2 AND model_id = $3
     `,
@@ -11716,8 +11758,12 @@ var PostgreSQLModelProviderStore = class {
    * is an independent model.
    *
    * Models the upstream no longer offers are deleted; models that survive are
-   * upserted *without* touching `enabled`, so the tenant's enable/disable
-   * choice survives a re-discovery. New rows take the column default (enabled).
+   * upserted *without* touching `enabled` or `extra`, so the tenant's choices
+   * survive a re-discovery. New rows take the column defaults.
+   *
+   * The default model is the exception to the delete: it is kept and flagged
+   * `stale` instead, because deleting it would take the tenant's default away
+   * with no confirmation.
    */
   async replaceProviderModels(tenantId, providerId, models) {
     await this.ensureInitialized();
@@ -11726,7 +11772,7 @@ var PostgreSQLModelProviderStore = class {
       await client.query("BEGIN");
       const current = await client.query(
         `
-        SELECT model_id, enabled FROM lattice_model_provider_models
+        SELECT model_id, enabled, extra, is_default FROM lattice_model_provider_models
         WHERE tenant_id = $1 AND provider_id = $2
       `,
         [tenantId, providerId]
@@ -11734,6 +11780,12 @@ var PostgreSQLModelProviderStore = class {
       const currentEnabled = new Map(
         current.rows.map((row) => [row.model_id, row.enabled])
       );
+      const currentExtra = new Map(
+        current.rows.map((row) => [row.model_id, row.extra])
+      );
+      const currentIsDefault = new Map(
+        current.rows.map((row) => [row.model_id, row.is_default])
+      );
       const deduped = /* @__PURE__ */ new Map();
       for (const model of models) {
         deduped.set(model.id, model);
@@ -11742,12 +11794,37 @@ var PostgreSQLModelProviderStore = class {
       const effectiveEnabled = rows.map(
         (model) => model.enabled ?? currentEnabled.get(model.id) ?? true
       );
+      const effectiveExtra = rows.map(
+        (model) => model.extra ?? currentExtra.get(model.id) ?? {}
+      );
+      const namesDefault = rows.some((model) => model.isDefault === true);
+      if (namesDefault) {
+        await client.query(
+          `UPDATE lattice_model_provider_models SET is_default = FALSE WHERE tenant_id = $1`,
+          [tenantId]
+        );
+      }
+      const effectiveIsDefault = rows.map(
+        (model) => model.isDefault ?? (namesDefault ? false : currentIsDefault.get(model.id)) ?? false
+      );
+      await client.query(
+        `
+        UPDATE lattice_model_provider_models
+           SET stale = TRUE
+         WHERE tenant_id = $1
+           AND provider_id = $2
+           AND model_id <> ALL($3::text[])
+           AND is_default
+      `,
+        [tenantId, providerId, rows.map((model) => model.id)]
+      );
       await client.query(
         `
         DELETE FROM lattice_model_provider_models
         WHERE tenant_id = $1
           AND provider_id = $2
           AND model_id <> ALL($3::text[])
+          AND NOT is_default
       `,
         [tenantId, providerId, rows.map((model) => model.id)]
       );
@@ -11756,14 +11833,15 @@ var PostgreSQLModelProviderStore = class {
           `
           INSERT INTO lattice_model_provider_models (
             id, tenant_id, provider_id, model_id, display_name, owned_by,
-            upstream_created, raw, enabled, stale, discovered_at
+            upstream_created, raw, enabled, stale, extra, is_default, discovered_at
           )
           SELECT * FROM unnest(
             $1::text[], $2::text[], $3::text[], $4::text[], $5::text[],
-            $6::text[], $7::timestamp[], $8::jsonb[], $9::boolean[], $10::boolean[], $11::timestamp[]
+            $6::text[], $7::timestamp[], $8::jsonb[], $9::boolean[], $10::boolean[],
+            $11::jsonb[], $12::boolean[], $13::timestamp[]
           ) AS t(
             id, tenant_id, provider_id, model_id, display_name, owned_by,
-            upstream_created, raw, enabled, stale, discovered_at
+            upstream_created, raw, enabled, stale, extra, is_default, discovered_at
           )
           ON CONFLICT (tenant_id, provider_id, model_id) DO UPDATE SET
             display_name = EXCLUDED.display_name,
@@ -11772,6 +11850,8 @@ var PostgreSQLModelProviderStore = class {
             raw = EXCLUDED.raw,
             enabled = EXCLUDED.enabled,
             stale = EXCLUDED.stale,
+            extra = EXCLUDED.extra,
+            is_default = EXCLUDED.is_default,
             discovered_at = EXCLUDED.discovered_at
         `,
           [
@@ -11789,6 +11869,8 @@ var PostgreSQLModelProviderStore = class {
             ),
             effectiveEnabled,
             rows.map((model) => model.stale ?? false),
+            effectiveExtra.map((extra) => JSON.stringify(extra)),
+            effectiveIsDefault,
             rows.map(() => (/* @__PURE__ */ new Date()).toISOString())
           ]
         );
@@ -11857,12 +11939,7 @@ var PostgreSQLModelProviderStore = class {
   mapRowToEntry(row) {
     let apiKey;
     if (row.api_key_enc) {
-      try {
-        apiKey = (0, import_core8.decrypt)(row.api_key_enc);
-      } catch (error) {
-        console.error("Failed to decrypt model provider API key:", error);
-        throw new Error("Failed to decrypt model provider API key");
-      }
+      apiKey = (0, import_core9.safeDecrypt)(row.api_key_enc);
     }
     return {
       id: row.id,
@@ -11898,6 +11975,8 @@ var PostgreSQLModelProviderStore = class {
       upstreamCreatedAt: row.upstream_created || void 0,
       enabled: row.enabled,
       stale: row.stale,
+      extra: extraOrUndefined(row.extra),
+      isDefault: row.is_default,
       discoveredAt: row.discovered_at
     };
   }
@@ -12322,8 +12401,11 @@ async function createPgStoreConfig(connectionString) {
   mm.register(createDistributedLeases);
   mm.register(createOutboxTable);
   mm.register(addConnectionSecretFields);
+  mm.register(reencryptLegacyConnectionSecrets);
   mm.register(createPluginDeployments);
   mm.register(dropPluginDeploymentAuthToken);
+  mm.register(addModelProviderModelExtra);
+  mm.register(addModelProviderModelDefault);
   await mm.migrate();
   const checkpoint = import_langgraph_checkpoint_postgres.PostgresSaver.fromConnString(connectionString);
   checkpoint.setup().catch((err) => {