@axiom-lattice/pg-stores 3.3.5 → 3.3.6

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@axiom-lattice/pg-stores",
-  "version": "3.3.5",
+  "version": "3.3.6",
   "description": "PG stores implementation for Axiom Lattice framework",
   "main": "dist/index.js",
   "module": "dist/index.mjs",
@@ -25,7 +25,7 @@
     "@langchain/core": "1.1.30",
     "pg": "^8.16.3",
     "uuid": "^9.0.1",
-    "@axiom-lattice/core": "6.4.1",
+    "@axiom-lattice/core": "7.0.0",
     "@axiom-lattice/protocols": "4.8.0"
   },
   "devDependencies": {

package/scripts/verify-model-provider-migrations.ts

@@ -0,0 +1,214 @@
+/**
+ * Verification for the model-provider migrations against a real PostgreSQL.
+ *
+ * Not a jest test: the repo's PG store suites are skipped without a database,
+ * and a migration's whole risk is what its SQL does to a real server — a
+ * column's nullability, its default, and whether an ALTER leaves a populated
+ * table intact.
+ *
+ * Deliberately named for the feature rather than a version number: the `extra`
+ * column was renumbered once already (v185 → v189) when a rebase collided with
+ * the distributed-lease migration. The script itself is version-agnostic — it
+ * drives the imported migration objects, never a hardcoded number.
+ *
+ * Usage:
+ *   VERIFY_PG_URL=postgresql://postgres@localhost:5433/postgres \
+ *     node_modules/.bin/tsx scripts/verify-model-provider-migrations.ts
+ */
+
+import { Pool } from "pg";
+import { MigrationManager } from "../src/migrations/migration";
+import {
+  createModelProvidersTable,
+  createModelProviderModelsTable,
+  addModelProviderApiStyle,
+  addModelProviderModelStale,
+  addModelProviderModelExtra,
+  addModelProviderModelDefault,
+} from "../src/migrations/model_provider_migrations";
+
+const CONNECTION = process.env.VERIFY_PG_URL;
+if (!CONNECTION) {
+  throw new Error("Set VERIFY_PG_URL to a throwaway PostgreSQL.");
+}
+
+/** Every model-provider migration, in order. */
+const ALL = [
+  createModelProvidersTable,
+  createModelProviderModelsTable,
+  addModelProviderApiStyle,
+  addModelProviderModelStale,
+  addModelProviderModelExtra,
+  addModelProviderModelDefault,
+];
+
+let failures = 0;
+
+function check(label: string, actual: unknown, expected: unknown): void {
+  const ok = JSON.stringify(actual) === JSON.stringify(expected);
+  if (!ok) {
+    failures += 1;
+  }
+  console.log(
+    `${ok ? "  ok  " : "  FAIL"} ${label}${
+      ok
+        ? ""
+        : `  (got ${JSON.stringify(actual)}, want ${JSON.stringify(expected)})`
+    }`
+  );
+}
+
+/** A clean database, connected as a pool. */
+async function freshDatabase(name: string): Promise<Pool> {
+  const admin = new Pool({ connectionString: CONNECTION });
+  await admin.query(`DROP DATABASE IF EXISTS ${name}`);
+  await admin.query(`CREATE DATABASE ${name}`);
+  await admin.end();
+
+  const url = new URL(CONNECTION!);
+  url.pathname = `/${name}`;
+  return new Pool({ connectionString: url.toString() });
+}
+
+/** The columns the model table actually has on this database. */
+async function modelColumns(pool: Pool): Promise<string[]> {
+  const result = await pool.query<{ column_name: string }>(
+    `SELECT column_name FROM information_schema.columns
+     WHERE table_name = 'lattice_model_provider_models'
+     ORDER BY column_name`
+  );
+  return result.rows.map((row) => row.column_name);
+}
+
+async function main(): Promise<void> {
+  // -------------------------------------------------------------------
+  // A. The store's old registration list really did leave columns out.
+  // -------------------------------------------------------------------
+  console.log("\nA. store list as it was (v181+v182 only)");
+  const oldPool = await freshDatabase("v185_old");
+  const oldManager = new MigrationManager(oldPool);
+  oldManager.register(createModelProvidersTable);
+  oldManager.register(createModelProviderModelsTable);
+  await oldManager.migrate();
+
+  const oldColumns = await modelColumns(oldPool);
+  check("`stale` absent — the R3 bug was real", oldColumns.includes("stale"), false);
+  check("`extra` absent", oldColumns.includes("extra"), false);
+  await oldPool.end();
+
+  // -------------------------------------------------------------------
+  // B. The fixed registration list produces a fully-formed table.
+  // -------------------------------------------------------------------
+  console.log("\nB. store list as it is now (v181..v185)");
+  const newPool = await freshDatabase("v185_new");
+  const newManager = new MigrationManager(newPool);
+  for (const migration of ALL) {
+    newManager.register(migration);
+  }
+  await newManager.migrate();
+
+  const newColumns = await modelColumns(newPool);
+  check("`stale` present", newColumns.includes("stale"), true);
+  check("`extra` present", newColumns.includes("extra"), true);
+  await newPool.end();
+
+  // -------------------------------------------------------------------
+  // C. Upgrading an already-populated table needs no backfill.
+  // -------------------------------------------------------------------
+  console.log("\nC. upgrade path over existing rows (creates, then every ALTER)");
+  const upgradePool = await freshDatabase("v185_upgrade");
+  const before = new MigrationManager(upgradePool);
+  for (const migration of ALL.slice(0, 4)) {
+    before.register(migration);
+  }
+  await before.migrate();
+
+  await upgradePool.query(
+    `INSERT INTO lattice_model_provider_models
+       (id, tenant_id, provider_id, model_id, enabled, stale)
+     VALUES ('p:gpt-4o', 't1', 'p', 'gpt-4o', TRUE, FALSE)`
+  );
+
+  const after = new MigrationManager(upgradePool);
+  for (const migration of ALL) {
+    after.register(migration);
+  }
+  await after.migrate();
+
+  const row = await upgradePool.query<{
+    extra: unknown;
+    enabled: boolean;
+    is_default: boolean;
+  }>(
+    `SELECT extra, enabled, is_default FROM lattice_model_provider_models
+     WHERE tenant_id = 't1' AND provider_id = 'p' AND model_id = 'gpt-4o'`
+  );
+  check("the pre-existing row survived", row.rows.length, 1);
+  check("it defaulted to an empty object", row.rows[0]?.extra, {});
+  // The default column arrives FALSE for existing rows, which is what keeps
+  // every legacy tenant on the deployment's default with no backfill.
+  check("it is not a default", row.rows[0]?.is_default, false);
+  // The ALTER must not have disturbed anything else on the table.
+  check("its other columns are untouched", row.rows[0]?.enabled, true);
+
+  // The partial unique index only came into existence with this migration, so
+  // assert it here rather than assuming.
+  const index = await upgradePool.query<{ indexdef: string }>(
+    `SELECT indexdef FROM pg_indexes
+      WHERE tablename = 'lattice_model_provider_models'
+        AND indexname = 'uk_lattice_model_provider_models_tenant_default'`
+  );
+  check("the one-default-per-tenant index exists", index.rows.length, 1);
+  check(
+    "…and is partial",
+    index.rows[0]?.indexdef.includes("WHERE is_default"),
+    true
+  );
+
+  // -------------------------------------------------------------------
+  // D. Re-running is a no-op, and jsonb round-trips.
+  // -------------------------------------------------------------------
+  console.log("\nD. idempotency and round-trip");
+  const rerun = new MigrationManager(upgradePool);
+  for (const migration of ALL) {
+    rerun.register(migration);
+  }
+  await rerun.migrate();
+
+  await upgradePool.query(
+    `INSERT INTO lattice_model_provider_models
+       (id, tenant_id, provider_id, model_id, enabled, extra)
+     VALUES ('p:o3', 't1', 'p', 'o3', TRUE, '{"temperature":0.2}'::jsonb)`
+  );
+  const roundTrip = await upgradePool.query<{ extra: unknown }>(
+    `SELECT extra FROM lattice_model_provider_models WHERE model_id = 'o3'`
+  );
+  check("jsonb round-trips as an object", roundTrip.rows[0]?.extra, {
+    temperature: 0.2,
+  });
+
+  // The NOT NULL constraint is what lets the store's reads skip a null check.
+  let rejected = false;
+  try {
+    await upgradePool.query(
+      `INSERT INTO lattice_model_provider_models
+         (id, tenant_id, provider_id, model_id, enabled, extra)
+       VALUES ('p:null', 't1', 'p', 'null-extra', TRUE, NULL)`
+    );
+  } catch {
+    rejected = true;
+  }
+  check("extra rejects NULL", rejected, true);
+
+  await upgradePool.end();
+
+  console.log(
+    failures === 0 ? "\nALL CHECKS PASSED" : `\n${failures} CHECK(S) FAILED`
+  );
+  process.exit(failures === 0 ? 0 : 1);
+}
+
+main().catch((error) => {
+  console.error(error);
+  process.exit(1);
+});

package/scripts/verify-store.ts

@@ -0,0 +1,232 @@
+/**
+ * Throwaway end-to-end check for PostgreSQLModelProviderStore on a real server.
+ *
+ * Exercises what a jest run cannot: the store migrating itself (the R3 fix),
+ * then writing and reading a model's `extra` through the unnest-based bulk
+ * upsert.
+ *
+ * Usage:
+ *   VERIFY_PG_URL=postgresql://postgres@localhost:5433/postgres \
+ *     node_modules/.bin/tsx scripts/verify-store.ts
+ */
+
+import { Pool } from "pg";
+import { PostgreSQLModelProviderStore } from "../src/stores/PostgreSQLModelProviderStore";
+
+const CONNECTION = process.env.VERIFY_PG_URL;
+if (!CONNECTION) {
+  throw new Error("Set VERIFY_PG_URL to a throwaway PostgreSQL.");
+}
+
+const DB = "v185_store";
+
+let failures = 0;
+
+/**
+ * Compare structurally rather than by key order: jsonb reorders keys, so a
+ * JSON string comparison reports spurious differences.
+ */
+function stable(value: unknown): string {
+  if (value === null || typeof value !== "object") {
+    return JSON.stringify(value);
+  }
+  if (Array.isArray(value)) {
+    return `[${value.map(stable).join(",")}]`;
+  }
+  const entries = Object.entries(value as Record<string, unknown>)
+    .sort(([a], [b]) => a.localeCompare(b))
+    .map(([key, entry]) => `${JSON.stringify(key)}:${stable(entry)}`);
+  return `{${entries.join(",")}}`;
+}
+
+function check(label: string, actual: unknown, expected: unknown): void {
+  const ok = stable(actual) === stable(expected);
+  if (!ok) {
+    failures += 1;
+  }
+  console.log(
+    `${ok ? "  ok  " : "  FAIL"} ${label}${
+      ok
+        ? ""
+        : `  (got ${stable(actual)}, want ${stable(expected)})`
+    }`
+  );
+}
+
+async function main(): Promise<void> {
+  const admin = new Pool({ connectionString: CONNECTION });
+  await admin.query(`DROP DATABASE IF EXISTS ${DB}`);
+  await admin.query(`CREATE DATABASE ${DB}`);
+  await admin.end();
+
+  const url = new URL(CONNECTION!);
+  url.pathname = `/${DB}`;
+
+  // Standalone construction: this is the path whose registration list was
+  // short by v183/v184, and it migrates itself here.
+  const store = new PostgreSQLModelProviderStore({
+    poolConfig: url.toString(),
+    autoMigrate: true,
+  });
+
+  const provider = await store.createProvider("t1", "prov-1", {
+    name: "ollama",
+    protocol: "openai-compatible",
+    baseURL: "http://localhost:11434/v1",
+    // Keyless: the whole point of phase 1.5.
+  });
+  check("a provider with no key is stored", provider.apiKey, undefined);
+
+  await store.replaceProviderModels("t1", "prov-1", [
+    { id: "llama3", enabled: true, extra: { supportsVision: false, temperature: 0.2 } },
+    { id: "Qwen/Qwen2.5-7B-Instruct", enabled: true },
+  ]);
+
+  const models = await store.listModels("t1", "prov-1");
+  const byId = new Map(models.map((model) => [model.modelId, model]));
+
+  check("the row with an upstream slash survives", byId.has("Qwen/Qwen2.5-7B-Instruct"), true);
+  check("extra round-trips", byId.get("llama3")?.extra, {
+    supportsVision: false,
+    temperature: 0.2,
+  });
+  check("a row with no config reads back empty", byId.get("Qwen/Qwen2.5-7B-Instruct")?.extra, undefined);
+
+  // A sync omits `extra`; the stored config must survive it.
+  await store.replaceProviderModels("t1", "prov-1", [
+    { id: "llama3", enabled: true },
+    { id: "Qwen/Qwen2.5-7B-Instruct", enabled: true },
+  ]);
+  const afterSync = await store.listModels("t1", "prov-1");
+  check(
+    "an omitted extra keeps its stored value",
+    afterSync.find((model) => model.modelId === "llama3")?.extra,
+    { supportsVision: false, temperature: 0.2 }
+  );
+
+  // An explicit empty object is how the UI clears a config. It reads back as
+  // absent, which is what the store's `extra?:` contract means by "no config".
+  await store.replaceProviderModels("t1", "prov-1", [
+    { id: "llama3", enabled: true, extra: {} },
+    { id: "Qwen/Qwen2.5-7B-Instruct", enabled: true },
+  ]);
+  const afterClear = await store.listModels("t1", "prov-1");
+  check(
+    "an explicit {} clears the config",
+    afterClear.find((model) => model.modelId === "llama3")?.extra,
+    undefined
+  );
+
+  // The stale flag must still work — it was the column the old list omitted.
+  await store.replaceProviderModels("t1", "prov-1", [
+    { id: "llama3", enabled: false, extra: {} },
+  ]);
+  const afterDrop = await store.listModels("t1", "prov-1");
+  check("dropping a model removes its row", afterDrop.length, 1);
+
+  // ── The tenant's default model ─────────────────────────────────────────
+  //
+  // The flag is per tenant and enforced by a partial unique index. Three
+  // failures a unit test cannot show: the index rejects a legitimate swap
+  // depending on row order, does not reject a second default at all, or the
+  // wholesale replace takes the default with it.
+  console.log("\nE. the tenant's default model");
+
+  await store.createProvider("t1", "prov-2", {
+    name: "openai",
+    protocol: "openai-compatible",
+    baseURL: "https://93.184.216.34/v1",
+    apiKey: "sk-default",
+  });
+  await store.replaceProviderModels("t1", "prov-2", [
+    { id: "a", enabled: true, isDefault: true },
+    { id: "b", enabled: true },
+  ]);
+
+  // The swap, with the incoming default listed *second* — the order the index
+  // would trip on without the store's clear-first step.
+  await store.replaceProviderModels("t1", "prov-2", [
+    { id: "a", enabled: true },
+    { id: "b", enabled: true, isDefault: true },
+  ]);
+  const swapped = await store.listModels("t1", "prov-2");
+  check(
+    "a swap moves the flag",
+    swapped.find((model) => model.modelId === "b")?.isDefault,
+    true
+  );
+  check(
+    "…and clears the previous holder",
+    swapped.find((model) => model.modelId === "a")?.isDefault,
+    false
+  );
+
+  // Bypass the store: two defaults for one tenant must be refused by the
+  // database, not merely by convention.
+  const raw = new Pool({ connectionString: url.toString() });
+  let rejectedSecond = false;
+  try {
+    await raw.query(
+      `INSERT INTO lattice_model_provider_models
+         (id, tenant_id, provider_id, model_id, enabled, is_default, discovered_at)
+       VALUES ('prov-1:second', 't1', 'prov-1', 'second', TRUE, TRUE, NOW())`
+    );
+  } catch (error) {
+    rejectedSecond = (error as { code?: string }).code === "23505";
+  }
+  check("the unique index refuses a second default", rejectedSecond, true);
+
+  // Naming one in a *different* provider clears the first: the index spans the
+  // tenant, while the store writes one provider at a time.
+  await store.replaceProviderModels("t1", "prov-1", [
+    { id: "only", enabled: true, isDefault: true },
+  ]);
+  const otherProvider = await store.listModels("t1", "prov-2");
+  check(
+    "naming a default in another provider clears the first",
+    otherProvider.find((model) => model.modelId === "b")?.isDefault,
+    false
+  );
+
+  // A replace that no longer offers the default — exactly what a discovery
+  // pass sends — must not take it away.
+  await store.replaceProviderModels("t1", "prov-1", [
+    { id: "something-else", enabled: true },
+  ]);
+  const afterDroppedDefault = await store.listModels("t1", "prov-1");
+  const keptDefault = afterDroppedDefault.find(
+    (model) => model.modelId === "only"
+  );
+  check("a replace that drops the default keeps the row", Boolean(keptDefault), true);
+  check("…flagged as dropped upstream", keptDefault?.stale, true);
+  check("…and still the default", keptDefault?.isDefault, true);
+
+  // Different tenant, same shape: the index must not couple them.
+  await store.createProvider("t2", "prov-1", {
+    name: "openai-t2",
+    protocol: "openai-compatible",
+    baseURL: "https://93.184.216.34/v1",
+    apiKey: "sk-t2",
+  });
+  await store.replaceProviderModels("t2", "prov-1", [
+    { id: "only", enabled: true, isDefault: true },
+  ]);
+  check(
+    "another tenant has its own default",
+    (await store.listModels("t2", "prov-1"))[0]?.isDefault,
+    true
+  );
+
+  await raw.end();
+  await store.dispose();
+
+  console.log(
+    failures === 0 ? "\nALL CHECKS PASSED" : `\n${failures} CHECK(S) FAILED`
+  );
+  process.exit(failures === 0 ? 0 : 1);
+}
+
+main().catch((error) => {
+  console.error(error);
+  process.exit(1);
+});

package/src/__tests__/PostgreSQLA2AApiKeyStore.test.ts

@@ -12,10 +12,23 @@ import type { Pool } from "pg";
 
 const mockQuery = jest.fn();
 
-jest.mock("@axiom-lattice/core", () => ({
-  encrypt: (value: string) => `enc:${value}`,
-  decrypt: (value: string) => value.replace(/^enc:/, ""),
-}));
+jest.mock("@axiom-lattice/core", () => {
+  const decrypt = (value: string): string => {
+    if (!value.startsWith("enc:")) throw new Error("Failed to decrypt");
+    return value.replace(/^enc:/, "");
+  };
+  return {
+    encrypt: (value: string) => `enc:${value}`,
+    decrypt,
+    safeDecrypt: (value: string) => {
+      try {
+        return decrypt(value);
+      } catch {
+        return "";
+      }
+    },
+  };
+});
 
 import { PostgreSQLA2AApiKeyStore } from "../stores/PostgreSQLA2AApiKeyStore";
 
@@ -107,6 +120,30 @@ describe("PostgreSQLA2AApiKeyStore", () => {
     expect(record?.tenantId).toBe("t1");
   });
 
+  it("list returns an undecryptable key with an empty value instead of throwing", async () => {
+    const store = new PostgreSQLA2AApiKeyStore({ pool });
+    mockQuery.mockResolvedValueOnce({
+      rows: [{
+        id: "k1",
+        key_value: "plaintext-legacy-key",
+        tenant_id: "t1",
+        project_id: "p1",
+        assistant_ids: null,
+        grants: null,
+        label: null,
+        enabled: true,
+        created_at: new Date("2026-01-01T00:00:00.000Z"),
+        updated_at: new Date("2026-01-01T00:00:00.000Z"),
+      }],
+    });
+
+    const records = await store.list({ tenantId: "t1" });
+
+    expect(records).toHaveLength(1);
+    expect(records[0].key).toBe("");
+    expect(records[0].projectId).toBe("p1");
+  });
+
   it("loadIntoMap projects assistantIds and omits workspaceId", async () => {
     const store = new PostgreSQLA2AApiKeyStore({ pool });
     mockQuery.mockResolvedValueOnce({

package/src/__tests__/PostgreSQLChannelInstallationStore.test.ts

@@ -9,10 +9,23 @@ jest.mock("pg", () => ({
   })),
 }));
 
-jest.mock("@axiom-lattice/core", () => ({
-  encrypt: (value: string) => `enc:${value}`,
-  decrypt: (value: string) => value.replace(/^enc:/, ""),
-}));
+jest.mock("@axiom-lattice/core", () => {
+  const decrypt = (value: string): string => {
+    if (!value.startsWith("enc:")) throw new Error("Failed to decrypt");
+    return value.replace(/^enc:/, "");
+  };
+  return {
+    encrypt: (value: string) => `enc:${value}`,
+    decrypt,
+    safeDecrypt: (value: string) => {
+      try {
+        return decrypt(value);
+      } catch {
+        return "";
+      }
+    },
+  };
+});
 
 describe("PostgreSQLChannelInstallationStore", () => {
   beforeEach(() => {
@@ -68,6 +81,37 @@ describe("PostgreSQLChannelInstallationStore", () => {
     expect(installation?.config.verificationToken).toBe("token-1");
   });
 
+  it("empties an undecryptable secret but still returns the installation", async () => {
+    const store = new PostgreSQLChannelInstallationStore({
+      pool: { query: mockQuery } as unknown as Pool,
+    });
+
+    mockQuery.mockResolvedValueOnce({
+      rows: [
+        {
+          id: "install-2",
+          tenant_id: "tenant-a",
+          channel: "lark",
+          name: "Tenant A Lark",
+          config: {
+            appId: "cli_app_1",
+            appSecret: "plaintext-legacy-secret",
+            verificationToken: "enc:token-1",
+            assistantId: "assistant-a",
+          },
+          created_at: new Date("2026-04-10T00:00:00.000Z"),
+          updated_at: new Date("2026-04-10T00:00:00.000Z"),
+        },
+      ],
+    });
+
+    const installation = await store.getInstallationById("install-2");
+
+    expect(installation?.config.appSecret).toBe("");
+    expect(installation?.config.verificationToken).toBe("token-1");
+    expect(installation?.config.appId).toBe("cli_app_1");
+  });
+
   it("rejects a duplicate id without changing the original installation", async () => {
     const store = new PostgreSQLChannelInstallationStore({
       pool: { query: mockQuery } as unknown as Pool,

package/src/__tests__/PostgreSQLConnectionStore.integration.test.ts

@@ -11,8 +11,9 @@ import { PostgreSQLConnectionStore } from "../stores/PostgreSQLConnectionStore";
 import {
   createConnectionConfigsTable,
   addConnectionSecretFields,
+  reencryptLegacyConnectionSecrets,
 } from "../migrations/connection_config_migrations";
-import { decrypt } from "@axiom-lattice/core";
+import { clearEncryptionKeyCache, decrypt } from "@axiom-lattice/core";
 
 const databaseUrl = process.env.TEST_DATABASE_URL;
 const describeIfDatabase = databaseUrl ? describe : describe.skip;
@@ -103,4 +104,62 @@ describeIfDatabase("PostgreSQLConnectionStore secret field encryption", () => {
     expect(read?.config.apiKey).toBe("sk-legacy");
     expect(read?.secretFields).toBeUndefined();
   });
+
+  it("empties an undecryptable secret field but still lists the connection", async () => {
+    const previousKey = process.env.LATTICE_ENCRYPTION_KEY;
+    try {
+      process.env.LATTICE_ENCRYPTION_KEY = "conn-key-one";
+      clearEncryptionKeyCache();
+      await store.create({
+        tenantId,
+        type,
+        key: "rotated",
+        name: "Rotated",
+        config: { baseUrl: "https://metrics.example/api/v1", apiKey: "sk-one" },
+        secretFields: ["apiKey"],
+      });
+
+      process.env.LATTICE_ENCRYPTION_KEY = "conn-key-two";
+      clearEncryptionKeyCache();
+
+      const read = await store.getByKey(tenantId, type, "rotated");
+      expect(read?.config.apiKey).toBe("");
+      expect(read?.config.baseUrl).toBe("https://metrics.example/api/v1");
+
+      const listed = await store.listByType(tenantId, type);
+      expect(listed.map((c) => c.key)).toContain("rotated");
+    } finally {
+      if (previousKey === undefined) delete process.env.LATTICE_ENCRYPTION_KEY;
+      else process.env.LATTICE_ENCRYPTION_KEY = previousKey;
+      clearEncryptionKeyCache();
+    }
+  });
+
+  it("re-encrypts a legacy plaintext declared secret field", async () => {
+    const id = randomUUID();
+    await pool.query(
+      `INSERT INTO lattice_connection_configs (id, tenant_id, type, key, name, config, secret_fields, created_at, updated_at)
+       VALUES ($1, $2, $3, $4, $5, $6::jsonb, $7::jsonb, CURRENT_TIMESTAMP, CURRENT_TIMESTAMP)`,
+      [
+        id, tenantId, type, "legacy-secret", "Legacy",
+        JSON.stringify({ boStoreKey: "plain-store-key", baseUrl: "https://bo.example" }),
+        JSON.stringify(["boStoreKey"]),
+      ],
+    );
+
+    const client = await pool.connect();
+    try {
+      await reencryptLegacyConnectionSecrets.up(client);
+    } finally {
+      client.release();
+    }
+
+    const raw = await pool.query<{ config: Record<string, unknown> }>(
+      "SELECT config FROM lattice_connection_configs WHERE tenant_id = $1 AND id = $2",
+      [tenantId, id],
+    );
+    expect(raw.rows[0].config.boStoreKey).not.toBe("plain-store-key");
+    expect(decrypt(raw.rows[0].config.boStoreKey as string)).toBe("plain-store-key");
+    expect(raw.rows[0].config.baseUrl).toBe("https://bo.example");
+  });
 });