@axiom-lattice/pg-stores 3.3.5 → 3.3.6

package/dist/index.mjs

@@ -963,7 +963,7 @@ var createDatabaseConfigsTable = {
 };
 
 // src/stores/PostgreSQLDatabaseConfigStore.ts
-import { encrypt, decrypt } from "@axiom-lattice/core";
+import { encrypt, safeDecrypt } from "@axiom-lattice/core";
 var PostgreSQLDatabaseConfigStore = class {
   constructor(options) {
     this.initialized = false;
@@ -1218,12 +1218,7 @@ var PostgreSQLDatabaseConfigStore = class {
   mapRowToEntry(row) {
     const config = typeof row.config === "string" ? JSON.parse(row.config) : row.config;
     if (config.password) {
-      try {
-        config.password = decrypt(config.password);
-      } catch (error) {
-        console.error("Failed to decrypt database password:", error);
-        throw new Error("Failed to decrypt database configuration");
-      }
+      config.password = safeDecrypt(config.password);
     }
     return {
       id: row.id,
@@ -1400,7 +1395,7 @@ var createMetricsConfigsTable = {
 };
 
 // src/stores/PostgreSQLMetricsServerConfigStore.ts
-import { encrypt as encrypt2, decrypt as decrypt2 } from "@axiom-lattice/core";
+import { encrypt as encrypt2, safeDecrypt as safeDecrypt2 } from "@axiom-lattice/core";
 var PostgreSQLMetricsServerConfigStore = class {
   constructor(options) {
     this.initialized = false;
@@ -1655,20 +1650,10 @@ var PostgreSQLMetricsServerConfigStore = class {
   mapRowToEntry(row) {
     const config = typeof row.config === "string" ? JSON.parse(row.config) : row.config;
     if (config.apiKey) {
-      try {
-        config.apiKey = decrypt2(config.apiKey);
-      } catch (error) {
-        console.error("Failed to decrypt apiKey:", error);
-        throw new Error("Failed to decrypt metrics server configuration");
-      }
+      config.apiKey = safeDecrypt2(config.apiKey);
     }
     if (config.password) {
-      try {
-        config.password = decrypt2(config.password);
-      } catch (error) {
-        console.error("Failed to decrypt password:", error);
-        throw new Error("Failed to decrypt metrics server configuration");
-      }
+      config.password = safeDecrypt2(config.password);
     }
     return {
       id: row.id,
@@ -1744,7 +1729,7 @@ var createMcpServerConfigsTable = {
 };
 
 // src/stores/PostgreSQLMcpServerConfigStore.ts
-import { encrypt as encrypt3, decrypt as decrypt3 } from "@axiom-lattice/core";
+import { encrypt as encrypt3, safeDecrypt as safeDecrypt3 } from "@axiom-lattice/core";
 var PostgreSQLMcpServerConfigStore = class {
   constructor(options) {
     this.initialized = false;
@@ -2015,28 +2000,18 @@ var PostgreSQLMcpServerConfigStore = class {
   mapRowToEntry(row) {
     const config = typeof row.config === "string" ? JSON.parse(row.config) : row.config;
     if (config.env && row.is_env_encrypted) {
-      try {
-        const decryptedEnv = {};
-        for (const [key, value] of Object.entries(config.env)) {
-          decryptedEnv[key] = decrypt3(value);
-        }
-        config.env = decryptedEnv;
-      } catch (error) {
-        console.error("Failed to decrypt MCP server env:", error);
-        throw new Error("Failed to decrypt MCP server configuration");
+      const decryptedEnv = {};
+      for (const [key, value] of Object.entries(config.env)) {
+        decryptedEnv[key] = safeDecrypt3(value);
       }
+      config.env = decryptedEnv;
     }
     if (config.headers && row.is_env_encrypted) {
-      try {
-        const decryptedHeaders = {};
-        for (const [key, value] of Object.entries(config.headers)) {
-          decryptedHeaders[key] = decrypt3(value);
-        }
-        config.headers = decryptedHeaders;
-      } catch (error) {
-        console.error("Failed to decrypt MCP server headers:", error);
-        throw new Error("Failed to decrypt MCP server configuration");
+      const decryptedHeaders = {};
+      for (const [key, value] of Object.entries(config.headers)) {
+        decryptedHeaders[key] = safeDecrypt3(value);
       }
+      config.headers = decryptedHeaders;
     }
     return {
       id: row.id,
@@ -5927,7 +5902,7 @@ var alterChannelInstallationsTable = {
 };
 
 // src/stores/PostgreSQLChannelInstallationStore.ts
-import { decrypt as decrypt4, encrypt as encrypt4 } from "@axiom-lattice/core";
+import { safeDecrypt as safeDecrypt4, encrypt as encrypt4 } from "@axiom-lattice/core";
 var PostgreSQLChannelInstallationStore = class {
   constructor(options) {
     this.initialized = false;
@@ -6157,9 +6132,9 @@ var PostgreSQLChannelInstallationStore = class {
   decryptSecrets(config) {
     return {
       ...config,
-      ...typeof config.appSecret === "string" ? { appSecret: decrypt4(config.appSecret) } : {},
-      ...typeof config.verificationToken === "string" ? { verificationToken: decrypt4(config.verificationToken) } : {},
-      ...typeof config.encryptKey === "string" ? { encryptKey: decrypt4(config.encryptKey) } : {}
+      ...typeof config.appSecret === "string" ? { appSecret: safeDecrypt4(config.appSecret) } : {},
+      ...typeof config.verificationToken === "string" ? { verificationToken: safeDecrypt4(config.verificationToken) } : {},
+      ...typeof config.encryptKey === "string" ? { encryptKey: safeDecrypt4(config.encryptKey) } : {}
     };
   }
 };
@@ -6237,7 +6212,7 @@ var addApiKeyGrants = {
 };
 
 // src/stores/PostgreSQLA2AApiKeyStore.ts
-import { encrypt as encrypt5, decrypt as decrypt5 } from "@axiom-lattice/core";
+import { encrypt as encrypt5, decrypt, safeDecrypt as safeDecrypt5 } from "@axiom-lattice/core";
 import { randomUUID } from "crypto";
 function generateApiKey() {
   return `a2a_${randomUUID().replace(/-/g, "")}`;
@@ -6245,7 +6220,7 @@ function generateApiKey() {
 function mapRowToRecord(row) {
   return {
     id: row.id,
-    key: decrypt5(row.key_value),
+    key: safeDecrypt5(row.key_value),
     tenantId: row.tenant_id,
     projectId: row.project_id,
     assistantIds: row.assistant_ids ?? void 0,
@@ -6302,17 +6277,6 @@ var PostgreSQLA2AApiKeyStore = class {
   async ensureInitialized() {
     if (!this.initialized) await this.initialize();
   }
-  /** Map rows that decrypt cleanly; skip rows under an unknown key. */
-  safeMap(rows) {
-    const out = [];
-    for (const row of rows) {
-      try {
-        out.push(mapRowToRecord(row));
-      } catch {
-      }
-    }
-    return out;
-  }
   async findByKey(key) {
     await this.ensureInitialized();
     const all = await this.pool.query(
@@ -6320,7 +6284,7 @@ var PostgreSQLA2AApiKeyStore = class {
     );
     for (const row of all.rows) {
       try {
-        if (decrypt5(row.key_value) === key) return mapRowToRecord(row);
+        if (decrypt(row.key_value) === key) return mapRowToRecord(row);
       } catch {
         continue;
       }
@@ -6349,13 +6313,13 @@ var PostgreSQLA2AApiKeyStore = class {
         `SELECT * FROM lattice_a2a_api_keys WHERE tenant_id = $1 ORDER BY created_at DESC LIMIT $2 OFFSET $3`,
         [params.tenantId, limit, offset]
       );
-      return this.safeMap(result2.rows);
+      return result2.rows.map((row) => mapRowToRecord(row));
     }
     const result = await this.pool.query(
       `SELECT * FROM lattice_a2a_api_keys ORDER BY created_at DESC LIMIT $1 OFFSET $2`,
       [limit, offset]
     );
-    return this.safeMap(result.rows);
+    return result.rows.map((row) => mapRowToRecord(row));
   }
   async create(input) {
     await this.ensureInitialized();
@@ -6452,7 +6416,7 @@ var PostgreSQLA2AApiKeyStore = class {
     const map2 = /* @__PURE__ */ new Map();
     for (const row of result.rows) {
       try {
-        const key = decrypt5(row.key_value);
+        const key = decrypt(row.key_value);
         map2.set(key, {
           key,
           tenantId: row.tenant_id,
@@ -9787,6 +9751,7 @@ var createChannelIdentityMappingTables = {
 };
 
 // src/migrations/connection_config_migrations.ts
+import { encrypt as encrypt6, isEncryptedValue } from "@axiom-lattice/core";
 var createConnectionConfigsTable = {
   version: 160,
   name: "create_connection_configs_table",
@@ -9841,6 +9806,38 @@ var addConnectionSecretFields = {
     `);
   }
 };
+var reencryptLegacyConnectionSecrets = {
+  version: 191,
+  name: "reencrypt_legacy_connection_secrets",
+  up: async (client) => {
+    const result = await client.query(
+      `SELECT id, tenant_id, config, secret_fields
+       FROM lattice_connection_configs
+       WHERE secret_fields IS NOT NULL`
+    );
+    for (const row of result.rows) {
+      const secretFields = Array.isArray(row.secret_fields) ? row.secret_fields.filter((field) => typeof field === "string") : [];
+      if (secretFields.length === 0) continue;
+      const config = row.config && typeof row.config === "object" ? { ...row.config } : {};
+      let changed = false;
+      for (const field of secretFields) {
+        const value = config[field];
+        if (typeof value === "string" && value.length > 0 && !isEncryptedValue(value)) {
+          config[field] = encrypt6(value);
+          changed = true;
+        }
+      }
+      if (changed) {
+        await client.query(
+          `UPDATE lattice_connection_configs
+           SET config = $1::jsonb, updated_at = CURRENT_TIMESTAMP
+           WHERE tenant_id = $2 AND id = $3`,
+          [JSON.stringify(config), row.tenant_id, row.id]
+        );
+      }
+    }
+  }
+};
 
 // src/migrations/add_share_open_grants.ts
 var addShareOpenGrants = {
@@ -10315,6 +10312,44 @@ var addModelProviderModelStale = {
     `);
   }
 };
+var addModelProviderModelExtra = {
+  version: 191,
+  name: "add_model_provider_model_extra",
+  up: async (client) => {
+    await client.query(`
+      ALTER TABLE lattice_model_provider_models
+      ADD COLUMN IF NOT EXISTS extra JSONB NOT NULL DEFAULT '{}'::jsonb
+    `);
+  },
+  down: async (client) => {
+    await client.query(`
+      ALTER TABLE lattice_model_provider_models DROP COLUMN IF EXISTS extra
+    `);
+  }
+};
+var addModelProviderModelDefault = {
+  version: 192,
+  name: "add_model_provider_model_default",
+  up: async (client) => {
+    await client.query(`
+      ALTER TABLE lattice_model_provider_models
+      ADD COLUMN IF NOT EXISTS is_default BOOLEAN NOT NULL DEFAULT FALSE
+    `);
+    await client.query(`
+      CREATE UNIQUE INDEX IF NOT EXISTS uk_lattice_model_provider_models_tenant_default
+      ON lattice_model_provider_models (tenant_id)
+      WHERE is_default
+    `);
+  },
+  down: async (client) => {
+    await client.query(`
+      DROP INDEX IF EXISTS uk_lattice_model_provider_models_tenant_default
+    `);
+    await client.query(`
+      ALTER TABLE lattice_model_provider_models DROP COLUMN IF EXISTS is_default
+    `);
+  }
+};
 
 // src/stores/PostgreSQLCapabilityBundleStore.ts
 import { randomUUID as randomUUID3 } from "crypto";
@@ -11279,7 +11314,10 @@ var PostgreSQLUserPushSubscriptionStore = class {
 
 // src/stores/PostgreSQLModelProviderStore.ts
 import { Pool as Pool27 } from "pg";
-import { encrypt as encrypt6, decrypt as decrypt6 } from "@axiom-lattice/core";
+import { encrypt as encrypt7, safeDecrypt as safeDecrypt6 } from "@axiom-lattice/core";
+function extraOrUndefined(value) {
+  return value && Object.keys(value).length > 0 ? value : void 0;
+}
 var PostgreSQLModelProviderStore = class {
   constructor(options) {
     this.initialized = false;
@@ -11301,6 +11339,10 @@ var PostgreSQLModelProviderStore = class {
     this.migrationManager = new MigrationManager(this.pool);
     this.migrationManager.register(createModelProvidersTable);
     this.migrationManager.register(createModelProviderModelsTable);
+    this.migrationManager.register(addModelProviderApiStyle);
+    this.migrationManager.register(addModelProviderModelStale);
+    this.migrationManager.register(addModelProviderModelExtra);
+    this.migrationManager.register(addModelProviderModelDefault);
     if (options.autoMigrate !== false) {
       this.initialize().catch((error) => {
         console.error("Failed to initialize PostgreSQLModelProviderStore:", error);
@@ -11394,7 +11436,7 @@ var PostgreSQLModelProviderStore = class {
     await this.ensureInitialized();
     const now = /* @__PURE__ */ new Date();
     const nowString = now.toISOString();
-    const apiKeyEnc = data.apiKey ? encrypt6(data.apiKey) : null;
+    const apiKeyEnc = data.apiKey ? encrypt7(data.apiKey) : null;
     const apiKeyHint = data.apiKey ? data.apiKey.slice(-4) : null;
     await this.pool.query(
       `
@@ -11470,7 +11512,7 @@ var PostgreSQLModelProviderStore = class {
       updateData.api_key_enc = null;
       updateData.api_key_hint = null;
     } else if (updates.apiKey) {
-      updateData.api_key_enc = encrypt6(updates.apiKey);
+      updateData.api_key_enc = encrypt7(updates.apiKey);
       updateData.api_key_hint = updates.apiKey.slice(-4);
     }
     if (updates.enabled !== void 0) {
@@ -11547,7 +11589,7 @@ var PostgreSQLModelProviderStore = class {
     const result = providerId ? await this.pool.query(
       `
           SELECT id, tenant_id, provider_id, model_id, display_name, owned_by,
-                 upstream_created, enabled, stale, discovered_at
+                 upstream_created, enabled, stale, extra, is_default, discovered_at
           FROM lattice_model_provider_models
           WHERE tenant_id = $1 AND provider_id = $2
           ORDER BY model_id ASC
@@ -11556,7 +11598,7 @@ var PostgreSQLModelProviderStore = class {
     ) : await this.pool.query(
       `
           SELECT id, tenant_id, provider_id, model_id, display_name, owned_by,
-                 upstream_created, enabled, discovered_at
+                 upstream_created, enabled, stale, extra, is_default, discovered_at
           FROM lattice_model_provider_models
           WHERE tenant_id = $1
           ORDER BY model_id ASC
@@ -11575,7 +11617,7 @@ var PostgreSQLModelProviderStore = class {
     const result = await this.pool.query(
       `
       SELECT id, tenant_id, provider_id, model_id, display_name, owned_by,
-             upstream_created, enabled, discovered_at
+             upstream_created, enabled, stale, extra, is_default, discovered_at
       FROM lattice_model_provider_models
       WHERE tenant_id = $1 AND provider_id = $2 AND model_id = $3
     `,
@@ -11594,8 +11636,12 @@ var PostgreSQLModelProviderStore = class {
    * is an independent model.
    *
    * Models the upstream no longer offers are deleted; models that survive are
-   * upserted *without* touching `enabled`, so the tenant's enable/disable
-   * choice survives a re-discovery. New rows take the column default (enabled).
+   * upserted *without* touching `enabled` or `extra`, so the tenant's choices
+   * survive a re-discovery. New rows take the column defaults.
+   *
+   * The default model is the exception to the delete: it is kept and flagged
+   * `stale` instead, because deleting it would take the tenant's default away
+   * with no confirmation.
    */
   async replaceProviderModels(tenantId, providerId, models) {
     await this.ensureInitialized();
@@ -11604,7 +11650,7 @@ var PostgreSQLModelProviderStore = class {
       await client.query("BEGIN");
       const current = await client.query(
         `
-        SELECT model_id, enabled FROM lattice_model_provider_models
+        SELECT model_id, enabled, extra, is_default FROM lattice_model_provider_models
         WHERE tenant_id = $1 AND provider_id = $2
       `,
         [tenantId, providerId]
@@ -11612,6 +11658,12 @@ var PostgreSQLModelProviderStore = class {
       const currentEnabled = new Map(
         current.rows.map((row) => [row.model_id, row.enabled])
       );
+      const currentExtra = new Map(
+        current.rows.map((row) => [row.model_id, row.extra])
+      );
+      const currentIsDefault = new Map(
+        current.rows.map((row) => [row.model_id, row.is_default])
+      );
       const deduped = /* @__PURE__ */ new Map();
       for (const model of models) {
         deduped.set(model.id, model);
@@ -11620,12 +11672,37 @@ var PostgreSQLModelProviderStore = class {
       const effectiveEnabled = rows.map(
         (model) => model.enabled ?? currentEnabled.get(model.id) ?? true
       );
+      const effectiveExtra = rows.map(
+        (model) => model.extra ?? currentExtra.get(model.id) ?? {}
+      );
+      const namesDefault = rows.some((model) => model.isDefault === true);
+      if (namesDefault) {
+        await client.query(
+          `UPDATE lattice_model_provider_models SET is_default = FALSE WHERE tenant_id = $1`,
+          [tenantId]
+        );
+      }
+      const effectiveIsDefault = rows.map(
+        (model) => model.isDefault ?? (namesDefault ? false : currentIsDefault.get(model.id)) ?? false
+      );
+      await client.query(
+        `
+        UPDATE lattice_model_provider_models
+           SET stale = TRUE
+         WHERE tenant_id = $1
+           AND provider_id = $2
+           AND model_id <> ALL($3::text[])
+           AND is_default
+      `,
+        [tenantId, providerId, rows.map((model) => model.id)]
+      );
       await client.query(
         `
         DELETE FROM lattice_model_provider_models
         WHERE tenant_id = $1
           AND provider_id = $2
           AND model_id <> ALL($3::text[])
+          AND NOT is_default
       `,
         [tenantId, providerId, rows.map((model) => model.id)]
       );
@@ -11634,14 +11711,15 @@ var PostgreSQLModelProviderStore = class {
           `
           INSERT INTO lattice_model_provider_models (
             id, tenant_id, provider_id, model_id, display_name, owned_by,
-            upstream_created, raw, enabled, stale, discovered_at
+            upstream_created, raw, enabled, stale, extra, is_default, discovered_at
           )
           SELECT * FROM unnest(
             $1::text[], $2::text[], $3::text[], $4::text[], $5::text[],
-            $6::text[], $7::timestamp[], $8::jsonb[], $9::boolean[], $10::boolean[], $11::timestamp[]
+            $6::text[], $7::timestamp[], $8::jsonb[], $9::boolean[], $10::boolean[],
+            $11::jsonb[], $12::boolean[], $13::timestamp[]
           ) AS t(
             id, tenant_id, provider_id, model_id, display_name, owned_by,
-            upstream_created, raw, enabled, stale, discovered_at
+            upstream_created, raw, enabled, stale, extra, is_default, discovered_at
           )
           ON CONFLICT (tenant_id, provider_id, model_id) DO UPDATE SET
             display_name = EXCLUDED.display_name,
@@ -11650,6 +11728,8 @@ var PostgreSQLModelProviderStore = class {
             raw = EXCLUDED.raw,
             enabled = EXCLUDED.enabled,
             stale = EXCLUDED.stale,
+            extra = EXCLUDED.extra,
+            is_default = EXCLUDED.is_default,
             discovered_at = EXCLUDED.discovered_at
         `,
           [
@@ -11667,6 +11747,8 @@ var PostgreSQLModelProviderStore = class {
             ),
             effectiveEnabled,
             rows.map((model) => model.stale ?? false),
+            effectiveExtra.map((extra) => JSON.stringify(extra)),
+            effectiveIsDefault,
             rows.map(() => (/* @__PURE__ */ new Date()).toISOString())
           ]
         );
@@ -11735,12 +11817,7 @@ var PostgreSQLModelProviderStore = class {
   mapRowToEntry(row) {
     let apiKey;
     if (row.api_key_enc) {
-      try {
-        apiKey = decrypt6(row.api_key_enc);
-      } catch (error) {
-        console.error("Failed to decrypt model provider API key:", error);
-        throw new Error("Failed to decrypt model provider API key");
-      }
+      apiKey = safeDecrypt6(row.api_key_enc);
     }
     return {
       id: row.id,
@@ -11776,6 +11853,8 @@ var PostgreSQLModelProviderStore = class {
       upstreamCreatedAt: row.upstream_created || void 0,
       enabled: row.enabled,
       stale: row.stale,
+      extra: extraOrUndefined(row.extra),
+      isDefault: row.is_default,
       discoveredAt: row.discovered_at
     };
   }
@@ -12200,8 +12279,11 @@ async function createPgStoreConfig(connectionString) {
   mm.register(createDistributedLeases);
   mm.register(createOutboxTable);
   mm.register(addConnectionSecretFields);
+  mm.register(reencryptLegacyConnectionSecrets);
   mm.register(createPluginDeployments);
   mm.register(dropPluginDeploymentAuthToken);
+  mm.register(addModelProviderModelExtra);
+  mm.register(addModelProviderModelDefault);
   await mm.migrate();
   const checkpoint = PostgresSaver.fromConnString(connectionString);
   checkpoint.setup().catch((err) => {