@axiom-lattice/pg-stores 3.3.5 → 3.3.6

package/src/__tests__/PostgreSQLDatabaseConfigStore.test.ts

@@ -0,0 +1,53 @@
+import { afterEach, describe, expect, it } from "@jest/globals";
+import type { Pool } from "pg";
+
+// The @axiom-lattice/core barrel cannot load under jest in this package (ESM-only
+// transitive deps), so mock it with the real encryption module — node:crypto only.
+jest.mock("@axiom-lattice/core", () => ({
+  ...jest.requireActual("../../../core/src/util/encryption"),
+}));
+
+import { clearEncryptionKeyCache, encrypt } from "@axiom-lattice/core";
+import { PostgreSQLDatabaseConfigStore } from "../stores/PostgreSQLDatabaseConfigStore";
+
+describe("PostgreSQLDatabaseConfigStore secret handling", () => {
+  const originalKey = process.env.LATTICE_ENCRYPTION_KEY;
+
+  afterEach(() => {
+    if (originalKey === undefined) delete process.env.LATTICE_ENCRYPTION_KEY;
+    else process.env.LATTICE_ENCRYPTION_KEY = originalKey;
+    clearEncryptionKeyCache();
+  });
+
+  it("empties an undecryptable password but still lists the config", async () => {
+    process.env.LATTICE_ENCRYPTION_KEY = "key-one";
+    clearEncryptionKeyCache();
+    const encrypted = encrypt("db-password");
+
+    process.env.LATTICE_ENCRYPTION_KEY = "key-two";
+    clearEncryptionKeyCache();
+
+    const query = jest.fn(async () => ({
+      rows: [{
+        id: "cfg-1",
+        tenant_id: "tenant-1",
+        key: "warehouse",
+        name: "Warehouse",
+        description: null,
+        config: JSON.stringify({
+          host: "db.example.com",
+          database: "analytics",
+          password: encrypted,
+        }),
+        created_at: new Date(),
+        updated_at: new Date(),
+      }],
+    }));
+    const store = new PostgreSQLDatabaseConfigStore({ pool: { query } as unknown as Pool });
+
+    const listed = await store.getAllConfigs("tenant-1");
+    expect(listed).toHaveLength(1);
+    expect(listed[0].config.password).toBe("");
+    expect(listed[0].config.host).toBe("db.example.com");
+  });
+});

package/src/__tests__/PostgreSQLMcpServerConfigStore.test.ts

@@ -7,6 +7,7 @@ jest.mock("@axiom-lattice/core", () => ({
   ...jest.requireActual("../../../core/src/util/encryption"),
 }));
 
+import { clearEncryptionKeyCache } from "@axiom-lattice/core";
 import { PostgreSQLMcpServerConfigStore } from "../stores/PostgreSQLMcpServerConfigStore";
 
 const makeRow = (configJson: string, isEnvEncrypted: boolean) => ({
@@ -60,6 +61,48 @@ describe("PostgreSQLMcpServerConfigStore header encryption", () => {
     expect(read?.config.headers?.Authorization).not.toBe(atRest.headers.Authorization);
   });
 
+  it("empties undecryptable secrets but still returns the config", async () => {
+    const previous = process.env.LATTICE_ENCRYPTION_KEY;
+    try {
+      let storedConfig = "";
+      let storedFlag = false;
+      const query = jest.fn(async (sql: string, values: unknown[]) => {
+        if (sql.includes("INSERT INTO lattice_mcp_server_configs")) {
+          storedConfig = values[5] as string;
+          storedFlag = values[7] as boolean;
+          return { rowCount: 1 };
+        }
+        if (sql.includes("SELECT id, tenant_id, key")) {
+          return { rows: [makeRow(storedConfig, storedFlag)] };
+        }
+        return { rows: [] };
+      });
+      const store = new PostgreSQLMcpServerConfigStore({ pool: { query } as unknown as Pool });
+
+      process.env.LATTICE_ENCRYPTION_KEY = "test-key-one";
+      clearEncryptionKeyCache();
+      await store.createConfig("tenant-1", "cfg-1", {
+        key: "remote",
+        config: {
+          name: "remote", version: "1.0.0", transport: "streamable_http",
+          url: "https://mcp.example.com/mcp",
+          headers: { Authorization: "Bearer sk-secret-token" },
+        },
+      });
+
+      process.env.LATTICE_ENCRYPTION_KEY = "test-key-two";
+      clearEncryptionKeyCache();
+
+      const read = await store.getConfigByKey("tenant-1", "remote");
+      expect(read?.config.headers?.Authorization).toBe("");
+      expect(read?.config.url).toBe("https://mcp.example.com/mcp");
+    } finally {
+      if (previous === undefined) delete process.env.LATTICE_ENCRYPTION_KEY;
+      else process.env.LATTICE_ENCRYPTION_KEY = previous;
+      clearEncryptionKeyCache();
+    }
+  });
+
   it("leaves legacy rows without headers untouched", async () => {
     const legacyConfig = JSON.stringify({
       name: "legacy", version: "1.0.0", transport: "stdio", command: "npx",

package/src/__tests__/PostgreSQLMetricsServerConfigStore.test.ts

@@ -0,0 +1,59 @@
+import { afterEach, describe, expect, it } from "@jest/globals";
+import type { Pool } from "pg";
+
+// The @axiom-lattice/core barrel cannot load under jest in this package (ESM-only
+// transitive deps), so mock it with the real encryption module — node:crypto only.
+jest.mock("@axiom-lattice/core", () => ({
+  ...jest.requireActual("../../../core/src/util/encryption"),
+}));
+
+import { clearEncryptionKeyCache, encrypt } from "@axiom-lattice/core";
+import { PostgreSQLMetricsServerConfigStore } from "../stores/PostgreSQLMetricsServerConfigStore";
+
+const row = {
+  id: "cfg-1",
+  tenant_id: "tenant-1",
+  key: "metrics",
+  name: "Metrics",
+  description: null,
+  config: "",
+  created_at: new Date(),
+  updated_at: new Date(),
+};
+
+describe("PostgreSQLMetricsServerConfigStore secret handling", () => {
+  const originalKey = process.env.LATTICE_ENCRYPTION_KEY;
+
+  afterEach(() => {
+    if (originalKey === undefined) delete process.env.LATTICE_ENCRYPTION_KEY;
+    else process.env.LATTICE_ENCRYPTION_KEY = originalKey;
+    clearEncryptionKeyCache();
+  });
+
+  it("empties an undecryptable secret but still lists the config", async () => {
+    process.env.LATTICE_ENCRYPTION_KEY = "key-one";
+    clearEncryptionKeyCache();
+    const encrypted = encrypt("sk-secret");
+
+    process.env.LATTICE_ENCRYPTION_KEY = "key-two";
+    clearEncryptionKeyCache();
+
+    const query = jest.fn(async () => ({
+      rows: [{
+        ...row,
+        config: JSON.stringify({
+          baseUrl: "https://metrics.example/api/v1",
+          apiKey: encrypted,
+          password: "plaintext-legacy",
+        }),
+      }],
+    }));
+    const store = new PostgreSQLMetricsServerConfigStore({ pool: { query } as unknown as Pool });
+
+    const listed = await store.getAllConfigs("tenant-1");
+    expect(listed).toHaveLength(1);
+    expect(listed[0].config.apiKey).toBe("");
+    expect(listed[0].config.password).toBe("");
+    expect(listed[0].config.baseUrl).toBe("https://metrics.example/api/v1");
+  });
+});

package/src/__tests__/PostgreSQLModelProviderStore.test.ts

@@ -0,0 +1,58 @@
+import { afterEach, describe, expect, it } from "@jest/globals";
+import type { Pool } from "pg";
+
+// The @axiom-lattice/core barrel cannot load under jest in this package (ESM-only
+// transitive deps), so mock it with the real encryption module — node:crypto only.
+jest.mock("@axiom-lattice/core", () => ({
+  ...jest.requireActual("../../../core/src/util/encryption"),
+}));
+
+import { clearEncryptionKeyCache, encrypt } from "@axiom-lattice/core";
+import { PostgreSQLModelProviderStore } from "../stores/PostgreSQLModelProviderStore";
+
+describe("PostgreSQLModelProviderStore secret handling", () => {
+  const originalKey = process.env.LATTICE_ENCRYPTION_KEY;
+
+  afterEach(() => {
+    if (originalKey === undefined) delete process.env.LATTICE_ENCRYPTION_KEY;
+    else process.env.LATTICE_ENCRYPTION_KEY = originalKey;
+    clearEncryptionKeyCache();
+  });
+
+  it("empties an undecryptable API key but still lists the provider", async () => {
+    process.env.LATTICE_ENCRYPTION_KEY = "key-one";
+    clearEncryptionKeyCache();
+    const encrypted = encrypt("sk-secret");
+
+    process.env.LATTICE_ENCRYPTION_KEY = "key-two";
+    clearEncryptionKeyCache();
+
+    const query = jest.fn(async () => ({
+      rows: [{
+        id: "prov-1",
+        tenant_id: "tenant-1",
+        name: "openai",
+        display_name: "OpenAI",
+        protocol: "openai-compatible",
+        api_style: "chat-completions",
+        llm_provider: "openai",
+        base_url: "https://api.openai.com/v1",
+        api_key_enc: encrypted,
+        api_key_hint: "cret",
+        enabled: 1,
+        status: "ready",
+        last_error: null,
+        last_discovered_at: null,
+        created_by: null,
+        created_at: new Date(),
+        updated_at: new Date(),
+      }],
+    }));
+    const store = new PostgreSQLModelProviderStore({ pool: { query } as unknown as Pool });
+
+    const listed = await store.listProviders("tenant-1");
+    expect(listed).toHaveLength(1);
+    expect(listed[0].apiKey).toBe("");
+    expect(listed[0].baseURL).toBe("https://api.openai.com/v1");
+  });
+});

package/src/createPgStoreConfig.ts

@@ -55,7 +55,7 @@ import { createChannelInstallationsTable } from "./migrations/channel_installati
 import { alterChannelInstallationsTable } from "./migrations/channel_installations_alter_migration";
 import { createChannelBindingsTable } from "./migrations/channel_bindings_migration";
 import { createDatabaseConfigsTable } from "./migrations/database_config_migrations";
-import { createConnectionConfigsTable, addConnectionSecretFields } from "./migrations/connection_config_migrations";
+import { createConnectionConfigsTable, addConnectionSecretFields, reencryptLegacyConnectionSecrets } from "./migrations/connection_config_migrations";
 import { createMetricsConfigsTable } from "./migrations/metrics_config_migrations";
 import { createMcpServerConfigsTable } from "./migrations/mcp_server_config_migrations";
 import { registerThreadMessageQueueMigrations } from "./migrations/queue_migrations";
@@ -96,6 +96,8 @@ import {
   createModelProviderModelsTable,
   addModelProviderApiStyle,
   addModelProviderModelStale,
+  addModelProviderModelExtra,
+  addModelProviderModelDefault,
 } from "./migrations/model_provider_migrations";
 import { PostgreSQLCapabilityBundleStore } from "./stores/PostgreSQLCapabilityBundleStore";
 import { PostgreSQLProjectRoomStore } from "./stores/PostgreSQLProjectRoomStore";
@@ -184,8 +186,11 @@ export async function createPgStoreConfig(connectionString: string) {
   mm.register(createDistributedLeases);        // v185
   mm.register(createOutboxTable);              // v187
   mm.register(addConnectionSecretFields);      // v188
+  mm.register(reencryptLegacyConnectionSecrets); // v191
   mm.register(createPluginDeployments);        // v189
   mm.register(dropPluginDeploymentAuthToken);  // v190
+  mm.register(addModelProviderModelExtra);      // v191
+  mm.register(addModelProviderModelDefault);    // v192
 
   await mm.migrate();
 

package/src/migrations/connection_config_migrations.ts

@@ -7,6 +7,7 @@
  */
 import { PoolClient } from "pg";
 import { Migration } from "./migration";
+import { encrypt, isEncryptedValue } from "@axiom-lattice/core";
 
 export const createConnectionConfigsTable: Migration = {
   version: 160,
@@ -73,3 +74,58 @@ export const addConnectionSecretFields: Migration = {
     `);
   },
 };
+
+/**
+ * Re-encrypt declared secret fields that are still stored as plaintext.
+ *
+ * A plugin can mark a field as a secret after connections already exist (for
+ * example a field renamed from a plaintext key to a password), leaving legacy
+ * rows with plaintext where the store now expects ciphertext — which makes
+ * `decryptConfigFields` fail authentication for that field. This one-time,
+ * idempotent migration encrypts any declared secret field that does not look
+ * like our ciphertext; values that do look encrypted (including genuine
+ * ciphertext written under a different key) are left untouched, so no real
+ * ciphertext is ever destroyed.
+ */
+export const reencryptLegacyConnectionSecrets: Migration = {
+  version: 191,
+  name: "reencrypt_legacy_connection_secrets",
+  up: async (client: PoolClient) => {
+    const result = await client.query<{
+      id: string;
+      tenant_id: string;
+      config: Record<string, unknown> | null;
+      secret_fields: unknown;
+    }>(
+      `SELECT id, tenant_id, config, secret_fields
+       FROM lattice_connection_configs
+       WHERE secret_fields IS NOT NULL`,
+    );
+
+    for (const row of result.rows) {
+      const secretFields = Array.isArray(row.secret_fields)
+        ? row.secret_fields.filter((field): field is string => typeof field === "string")
+        : [];
+      if (secretFields.length === 0) continue;
+
+      const config = row.config && typeof row.config === "object" ? { ...row.config } : {};
+      let changed = false;
+      for (const field of secretFields) {
+        const value = config[field];
+        if (typeof value === "string" && value.length > 0 && !isEncryptedValue(value)) {
+          config[field] = encrypt(value);
+          changed = true;
+        }
+      }
+
+      if (changed) {
+        await client.query(
+          `UPDATE lattice_connection_configs
+           SET config = $1::jsonb, updated_at = CURRENT_TIMESTAMP
+           WHERE tenant_id = $2 AND id = $3`,
+          [JSON.stringify(config), row.tenant_id, row.id],
+        );
+      }
+    }
+  },
+};

package/src/migrations/model_provider_migrations.ts

@@ -155,3 +155,77 @@ export const addModelProviderModelStale: Migration = {
     `);
   },
 };
+
+/**
+ * Per-model LLM config.
+ *
+ * An upstream advertises an id, an owner and a creation time — nothing about
+ * how the model wants to be called. Temperature, token limits, whether it reads
+ * images and provider-specific request fields are things only the tenant knows,
+ * so they are stored against the model rather than guessed.
+ *
+ * JSON rather than a column per setting: the set of knobs is the upstream
+ * SDK's, not ours, and growing it should not cost a migration. The values are
+ * merged *under* the provider's own address and credential at registration, so
+ * a config here can tune behaviour but cannot redirect the request.
+ *
+ * `NOT NULL DEFAULT '{}'` lets existing rows mean "no per-model config" without
+ * a backfill. `IF NOT EXISTS` matches v183/v184 and keeps a re-run a no-op.
+ */
+export const addModelProviderModelExtra: Migration = {
+  version: 191,
+  name: 'add_model_provider_model_extra',
+  up: async (client: PoolClient) => {
+    await client.query(`
+      ALTER TABLE lattice_model_provider_models
+      ADD COLUMN IF NOT EXISTS extra JSONB NOT NULL DEFAULT '{}'::jsonb
+    `);
+  },
+  down: async (client: PoolClient) => {
+    await client.query(`
+      ALTER TABLE lattice_model_provider_models DROP COLUMN IF EXISTS extra
+    `);
+  },
+};
+
+/**
+ * The tenant's default model.
+ *
+ * A model key of `"default"` is what every execution path falls back to — an
+ * agent with no model configured, the assistant, the eval judge, reading an
+ * image. It used to name a model the *deployment* registered at boot; this
+ * column lets a tenant name their own instead, and the deployment's remains the
+ * fallback for tenants that have not chosen one.
+ *
+ * The partial unique index is the point: **at most one default per tenant, per
+ * database**, rather than by application convention. `WHERE is_default` indexes
+ * only the true rows, so the many non-default rows are unconstrained.
+ *
+ * Note the index spans *providers* within a tenant, while the store writes one
+ * provider at a time — which is why `replaceProviderModels` clears the flag
+ * tenant-wide before setting a new one.
+ */
+export const addModelProviderModelDefault: Migration = {
+  version: 192,
+  name: 'add_model_provider_model_default',
+  up: async (client: PoolClient) => {
+    await client.query(`
+      ALTER TABLE lattice_model_provider_models
+      ADD COLUMN IF NOT EXISTS is_default BOOLEAN NOT NULL DEFAULT FALSE
+    `);
+
+    await client.query(`
+      CREATE UNIQUE INDEX IF NOT EXISTS uk_lattice_model_provider_models_tenant_default
+      ON lattice_model_provider_models (tenant_id)
+      WHERE is_default
+    `);
+  },
+  down: async (client: PoolClient) => {
+    await client.query(`
+      DROP INDEX IF EXISTS uk_lattice_model_provider_models_tenant_default
+    `);
+    await client.query(`
+      ALTER TABLE lattice_model_provider_models DROP COLUMN IF EXISTS is_default
+    `);
+  },
+};

package/src/stores/PostgreSQLA2AApiKeyStore.ts

@@ -11,7 +11,7 @@ import { MigrationManager } from "../migrations/migration";
 import { createA2AApiKeysTable } from "../migrations/a2a_api_key_migration";
 import { addA2AKeyAssistantIds } from "../migrations/add_a2a_key_assistant_ids";
 import { addApiKeyGrants } from "../migrations/add_api_key_grants";
-import { encrypt, decrypt } from "@axiom-lattice/core";
+import { encrypt, decrypt, safeDecrypt } from "@axiom-lattice/core";
 import { randomUUID } from "crypto";
 
 export interface PostgreSQLA2AApiKeyStoreOptions {
@@ -40,7 +40,7 @@ function generateApiKey(): string {
 function mapRowToRecord(row: KeyRow): A2AApiKeyRecord {
   return {
     id: row.id,
-    key: decrypt(row.key_value),
+    key: safeDecrypt(row.key_value),
     tenantId: row.tenant_id,
     projectId: row.project_id,
     assistantIds: row.assistant_ids ?? undefined,
@@ -116,19 +116,6 @@ export class PostgreSQLA2AApiKeyStore implements A2AApiKeyStore {
     if (!this.initialized) await this.initialize();
   }
 
-  /** Map rows that decrypt cleanly; skip rows under an unknown key. */
-  private safeMap(rows: KeyRow[]): A2AApiKeyRecord[] {
-    const out: A2AApiKeyRecord[] = [];
-    for (const row of rows) {
-      try {
-        out.push(mapRowToRecord(row));
-      } catch {
-        // Skip undecryptable rows.
-      }
-    }
-    return out;
-  }
-
   async findByKey(key: string): Promise<A2AApiKeyRecord | null> {
     await this.ensureInitialized();
     const all = await this.pool.query<KeyRow>(
@@ -168,13 +155,13 @@ export class PostgreSQLA2AApiKeyStore implements A2AApiKeyStore {
         `SELECT * FROM lattice_a2a_api_keys WHERE tenant_id = $1 ORDER BY created_at DESC LIMIT $2 OFFSET $3`,
         [params.tenantId, limit, offset],
       );
-      return this.safeMap(result.rows);
+      return result.rows.map((row) => mapRowToRecord(row));
     }
     const result = await this.pool.query<KeyRow>(
       `SELECT * FROM lattice_a2a_api_keys ORDER BY created_at DESC LIMIT $1 OFFSET $2`,
       [limit, offset],
     );
-    return this.safeMap(result.rows);
+    return result.rows.map((row) => mapRowToRecord(row));
   }
 
   async create(input: CreateA2AApiKeyInput): Promise<A2AApiKeyRecord> {

package/src/stores/PostgreSQLChannelInstallationStore.ts

@@ -10,7 +10,7 @@ import {
 import { MigrationManager } from "../migrations/migration";
 import { createChannelInstallationsTable } from "../migrations/channel_installation_migrations";
 import { alterChannelInstallationsTable } from "../migrations/channel_installations_alter_migration";
-import { decrypt, encrypt } from "@axiom-lattice/core";
+import { safeDecrypt, encrypt } from "@axiom-lattice/core";
 
 export interface PostgreSQLChannelInstallationStoreOptions {
   pool?: Pool;
@@ -333,9 +333,9 @@ export class PostgreSQLChannelInstallationStore
   ): Record<string, unknown> {
     return {
       ...config,
-      ...(typeof config.appSecret === "string" ? { appSecret: decrypt(config.appSecret) } : {}),
-      ...(typeof config.verificationToken === "string" ? { verificationToken: decrypt(config.verificationToken) } : {}),
-      ...(typeof config.encryptKey === "string" ? { encryptKey: decrypt(config.encryptKey) } : {}),
+      ...(typeof config.appSecret === "string" ? { appSecret: safeDecrypt(config.appSecret) } : {}),
+      ...(typeof config.verificationToken === "string" ? { verificationToken: safeDecrypt(config.verificationToken) } : {}),
+      ...(typeof config.encryptKey === "string" ? { encryptKey: safeDecrypt(config.encryptKey) } : {}),
     };
   }
 }

package/src/stores/PostgreSQLDatabaseConfigStore.ts

@@ -13,7 +13,7 @@ import {
 } from '@axiom-lattice/protocols';
 import { MigrationManager } from '../migrations/migration';
 import { createDatabaseConfigsTable } from '../migrations/database_config_migrations';
-import { encrypt, decrypt } from '@axiom-lattice/core';
+import { encrypt, safeDecrypt } from '@axiom-lattice/core';
 
 /**
  * PostgreSQL DatabaseConfigStore options
@@ -419,12 +419,7 @@ export class PostgreSQLDatabaseConfigStore implements DatabaseConfigStore {
 
     // Decrypt password if present
     if (config.password) {
-      try {
-        config.password = decrypt(config.password);
-      } catch (error) {
-        console.error('Failed to decrypt database password:', error);
-        throw new Error('Failed to decrypt database configuration');
-      }
+      config.password = safeDecrypt(config.password);
     }
 
     return {

package/src/stores/PostgreSQLMcpServerConfigStore.ts

@@ -13,7 +13,7 @@ import {
 } from '@axiom-lattice/protocols';
 import { MigrationManager } from '../migrations/migration';
 import { createMcpServerConfigsTable } from '../migrations/mcp_server_config_migrations';
-import { encrypt, decrypt } from '@axiom-lattice/core';
+import { encrypt, safeDecrypt } from '@axiom-lattice/core';
 
 /**
  * PostgreSQL McpServerConfigStore options
@@ -452,30 +452,20 @@ export class PostgreSQLMcpServerConfigStore implements McpServerConfigStore {
 
     // Decrypt env values if present and encrypted
     if (config.env && row.is_env_encrypted) {
-      try {
-        const decryptedEnv: Record<string, string> = {};
-        for (const [key, value] of Object.entries(config.env)) {
-          decryptedEnv[key] = decrypt(value);
-        }
-        config.env = decryptedEnv;
-      } catch (error) {
-        console.error('Failed to decrypt MCP server env:', error);
-        throw new Error('Failed to decrypt MCP server configuration');
+      const decryptedEnv: Record<string, string> = {};
+      for (const [key, value] of Object.entries(config.env)) {
+        decryptedEnv[key] = safeDecrypt(value);
       }
+      config.env = decryptedEnv;
     }
 
     // Decrypt header values if present and encrypted
     if (config.headers && row.is_env_encrypted) {
-      try {
-        const decryptedHeaders: Record<string, string> = {};
-        for (const [key, value] of Object.entries(config.headers)) {
-          decryptedHeaders[key] = decrypt(value);
-        }
-        config.headers = decryptedHeaders;
-      } catch (error) {
-        console.error('Failed to decrypt MCP server headers:', error);
-        throw new Error('Failed to decrypt MCP server configuration');
+      const decryptedHeaders: Record<string, string> = {};
+      for (const [key, value] of Object.entries(config.headers)) {
+        decryptedHeaders[key] = safeDecrypt(value);
       }
+      config.headers = decryptedHeaders;
     }
 
     return {

package/src/stores/PostgreSQLMetricsServerConfigStore.ts

@@ -13,7 +13,7 @@ import {
 } from '@axiom-lattice/protocols';
 import { MigrationManager } from '../migrations/migration';
 import { createMetricsConfigsTable } from '../migrations/metrics_config_migrations';
-import { encrypt, decrypt } from '@axiom-lattice/core';
+import { encrypt, safeDecrypt } from '@axiom-lattice/core';
 
 /**
  * PostgreSQL MetricsServerConfigStore options
@@ -419,22 +419,12 @@ export class PostgreSQLMetricsServerConfigStore implements MetricsServerConfigSt
 
     // Decrypt apiKey if present
     if (config.apiKey) {
-      try {
-        config.apiKey = decrypt(config.apiKey);
-      } catch (error) {
-        console.error('Failed to decrypt apiKey:', error);
-        throw new Error('Failed to decrypt metrics server configuration');
-      }
+      config.apiKey = safeDecrypt(config.apiKey);
     }
 
     // Decrypt password if present
     if (config.password) {
-      try {
-        config.password = decrypt(config.password);
-      } catch (error) {
-        console.error('Failed to decrypt password:', error);
-        throw new Error('Failed to decrypt metrics server configuration');
-      }
+      config.password = safeDecrypt(config.password);
     }
 
     return {