@axiom-lattice/pg-stores 5.0.0 → 5.0.2

package/.turbo/turbo-build.log

@@ -1,5 +1,5 @@
 
-> @axiom-lattice/pg-stores@5.0.0 build /home/runner/work/agentic/agentic/packages/pg-stores
+> @axiom-lattice/pg-stores@5.0.2 build /home/runner/work/agentic/agentic/packages/pg-stores
 > tsup src/index.ts --format cjs,esm --dts --sourcemap
 
 CLI Building entry: src/index.ts
@@ -8,13 +8,13 @@
 CLI Target: es2020
 CJS Build start
 ESM Build start
-ESM dist/index.mjs     524.15 KB
-ESM dist/index.mjs.map 970.33 KB
-ESM ⚡️ Build success in 1448ms
-CJS dist/index.js     533.89 KB
-CJS dist/index.js.map 970.64 KB
-CJS ⚡️ Build success in 1451ms
+CJS dist/index.js     533.98 KB
+CJS dist/index.js.map 970.75 KB
+CJS ⚡️ Build success in 1274ms
+ESM dist/index.mjs     524.22 KB
+ESM dist/index.mjs.map 970.44 KB
+ESM ⚡️ Build success in 1353ms
 DTS Build start
-DTS ⚡️ Build success in 15489ms
+DTS ⚡️ Build success in 15828ms
 DTS dist/index.d.ts  112.00 KB
 DTS dist/index.d.mts 112.00 KB

package/CHANGELOG.md

@@ -1,5 +1,207 @@
 # @axiom-lattice/pg-stores
 
+## 5.0.2
+
+### Patch Changes
+
+- a756acb: feat(model-providers): a tenant's own providers become its entire model supply
+
+  - A tenant that has at least one provider row no longer falls back to the
+    deployment (`default`) namespace. `resolveModelLatticeForTenant`,
+    `hasModelLatticeForTenant` (+ sync variant), `listModelLatticesForTenant`,
+    the embeddings client and both STT clients return a miss instead, and
+    `list_models` reports only the tenant's own models.
+  - `tenantHasOwnModelSupply` / `tenantHasOwnModelSupplySync` (new in core) read
+    the provider store; the sync variant uses a 30 s observation cache, and a
+    store failure fails closed (treats the tenant as owning its supply).
+  - `ModelProviderService.catalog` lists deployment models only while the tenant
+    has no provider, so a provider with no synced models shows an empty catalog
+    rather than rows that cannot run.
+  - The last remaining provider cannot be deleted: the service returns
+    `LAST_PROVIDER_NOT_DELETABLE` (409), and the panel disables the action.
+    Removing a provider now requires a second one to exist first.
+  - eval runs no longer take the first listed model as a judge fallback when the
+    tenant owns its supply; they fail with a message pointing at Model Providers.
+  - The panel derives the platform/own switch from `providers.length > 0`, shows
+    a read-only deployment description when nothing is configured, and keeps a
+    `X/3` default-model summary with per-kind status once providers exist.
+
+- Updated dependencies [a756acb]
+  - @axiom-lattice/core@12.1.0
+  - @axiom-lattice/protocols@7.1.0
+
+## 5.0.1
+
+### Patch Changes
+
+- 3c95be1: This changeset consolidates all pending release notes into a single release entry. All packages are released as patch versions for this consolidated release.
+
+  ## Pending changes
+
+  ### chat-cursor-expired-auto-recovery
+
+  Console chat now silently recovers from chunk-stream `CURSOR_EXPIRED`: it reloads durable messages, reconnects without the expired cursor, and only shows a localized retry prompt when recovery fails or exceeds the bounded recovery budget.
+
+  ### chat-quick-prompts-generic
+
+  Make `Chating` empty-state content generic by default: the question is now "How can I help you today?", the built-in data-analysis dataset is opt-in via `showQuickAnalysis`, and all quick prompts use one `QuickPromptCategory[]` shape rendered below the composer in both empty and non-empty states. Adds `quickPromptsData` / `quickPromptsTitle` props, keeps the shell `quickPromptsData` as a fallback, and exports `BusinessAnalysisPrompts`, `QuickPrompts`, `buildDataAnalysisPrompts`, and the `BusinessAnalysisPromptsProps` type. Also removes the empty→active send transition animation.
+
+  ### chat-quick-prompts-hardening
+
+  Fix chat quick prompts:
+
+  - Sender labels and descriptions are no longer duplicated, including description-only prompts and whitespace-only labels.
+  - Effective sender prompt text is trimmed; fully blank or whitespace-only prompts are dropped and whitespace-only descriptions are suppressed.
+  - The renderer honors `disabled` for generated items and guards the click and More handlers.
+  - Simple-mode item keys are collision-safe across categories.
+  - An explicit `title` takes precedence over the category title.
+  - Single-category items inherit the category icon when they have none.
+
+  ### fix-abort-notice-task-detail-overflow
+
+  Preserve the neutral "Response stopped." notice after a user aborts a run: terminal stream events from that same run no longer clear it immediately, while a new run's output still clears it.
+
+  Also fix task-detail horizontal overflow on narrow layouts by wrapping activity metadata and removing the mobile subtask row negative margin.
+
+  ### fix-client-sdk-delete-content-type
+
+  Fix bodyless `DELETE` requests sending `Content-Type: application/json`. `makeRequest` strips the header for bodyless deletes, but `fetchWithTimeout` merged `this.headers` back in and silently restored it, so delete requests could be rejected by servers that treat a declared JSON content type as requiring a body. `fetchWithTimeout` now trusts the already-merged request headers from `makeRequest`.
+
+  `WorkspaceClient.request` had the same problem: it always merged `this.headers` (including `Content-Type: application/json`) into every request. Bodyless `deleteWorkspace` / `deleteProject` calls now strip the `content-type` header case-insensitively from the merged map, including a lowercase `content-type` supplied through `ClientConfig.headers`.
+
+  ### fix-filesystem-write-edit-symlink-parent
+
+  Fix `FilesystemBackend` virtual-mode confinement for writes and edits: both operations now validate the resolved parent directory against the virtual root (mirroring reads and deletes), so a symlinked parent that points outside the root can no longer be used to create or modify files outside the sandbox.
+
+  Writes additionally validate the nearest existing ancestor before recursive directory creation. A nested path such as `/outside-link/created-dir/escaped.txt` is rejected before `fs.mkdir(..., { recursive: true })` runs, so no directories are created outside the virtual root either.
+
+  Directory listing and search are hardened too: in virtual mode the requested `lsInfo` directory, `globInfo` search base, and `grepRaw` base must resolve inside the root; symlink entries are hidden from scans; `globInfo`/grep fallback stop following symlinks; and ripgrep runs with `--no-follow`.
+
+  Symlink behavior is intentionally split between root scans and direct access. A symlink whose target stays inside the root is hidden from directory listings and recursive scans, but a direct `lsInfo`, `globInfo`, or `grepRaw` call whose resolved base stays inside the root is allowed, and direct file reads through an inside-root symlink remain allowed. A symlink whose target leaves the root is rejected for direct listing/search/read and is neither listed nor searched.
+
+  Residual limitations:
+
+  - Plain Node file APIs cannot make "validate ancestor, then create directory/file" atomic. The checks close the symlinked-parent escape and nested-directory side effect, but a concurrent attacker who can swap path components between the ancestor check and the create/open calls could still win a TOCTOU race. Directory-level isolation (or an OS primitive with `openat`/`O_NOFOLLOW`-style semantics for every component) would be required to eliminate that race completely.
+  - Hard-link escapes remain possible: hard links share inode data and cannot be distinguished from ordinary files by path checks, so a hard link inside the root can still expose content outside it.
+
+  ### fix-inmemory-workflow-run-id-collision
+
+  Fix `InMemoryWorkflowTrackingStore.createWorkflowRun` ID collisions: the generated ID is now `${threadId}_${Date.now()}_${randomUUID()}` (matching the PostgreSQL and Local stores) instead of `${threadId}_${Date.now()}`, so two runs started on the same thread within the same millisecond no longer overwrite each other in the backing `Map` (which also silently reset the earlier run's steps). Added a unit test that pins `Date.now()` and asserts both runs exist with distinct IDs and isolated steps.
+
+  ### fix-local-store-workflow-and-schedule
+
+  Fix four local-store defects found while adding coverage:
+
+  - `LocalWorkflowTrackingStore` could not be constructed: its DDL used `ALTER TABLE ... ADD COLUMN IF NOT EXISTS`, which SQLite does not support, so every constructor call threw. The `thread_id` backfill now uses the same `PRAGMA table_info` guard as the other local stores.
+  - `LocalWorkflowTrackingStore.createWorkflowRun` generated `${threadId}_${Date.now()}`, so two runs on the same thread within the same millisecond collided on the primary key. IDs are now `${threadId}_${Date.now()}_${randomUUID()}`, matching the PostgreSQL store.
+  - `LocalScheduleStorage.getAllTasks` emitted `OFFSET` without `LIMIT` when only an offset was supplied, which SQLite rejects. It now emits `LIMIT -1` first, matching `LocalWorkflowTrackingStore.queryWorkflowRuns`.
+  - **Security parity:** `LocalMetricsServerConfigStore` stored `apiKey`/`password` in plaintext while the PostgreSQL store encrypted them. Both fields are now encrypted on create/update (partial updates still preserve the stored ciphertext) and decrypted on read. Legacy plaintext rows are preserved unchanged on read and encrypted on the next config write; a value that looks encrypted but cannot be decrypted with the current key degrades to `""` via `safeDecrypt`, matching PostgreSQL.
+
+    **Upgrade note:** the legacy-row heuristic is shape-based. A plaintext secret that itself happens to look like canonical ciphertext (valid base64 of at least the salt+IV+tag length) cannot be distinguished from encrypted data, so it is treated as ciphertext and may read back as an empty string. There is no safe way to tell the two apart after the fact; re-enter any such metric-server secret once after upgrading. Other plaintext secrets are read unchanged and encrypted on the next write.
+
+  ### fix-opensandbox-concurrent-ensure-dedup
+
+  Fix `ensureSandbox` concurrency and `listSandboxes` status filtering.
+
+  `ensureSandbox` now keeps the early in-flight fast path, then re-checks both the cache and the in-flight create map after the asynchronous metadata lookup. A caller that was suspended during metadata recovery can no longer create a duplicate sandbox when another caller finishes first, and waiters on a failed create reject and leave `pendingCreates` cleared so a later call retries instead of hanging.
+
+  `listSandboxes` now translates the lowercase API status filter to the SDK's capitalized lifecycle states: `running` → `Running`, `stopped` → `Paused`, `crashed` → `Failed`, and `unknown` omits the states filter instead of sending an invalid state. Returned items are mapped back to the same API vocabulary instead of leaking raw SDK states: `Running` → `running`, `Paused`/`Stopping`/`Stopped`/`Terminated` → `stopped`, `Failed`/`Error` → `crashed`, and everything else → `unknown` (previously `Paused` and `Failed` came back as `paused`/`failed`, outside the response schema's allowed values).
+
+  `mapVolumes` now validates named volume definitions with the same conservative name validator used by the volume-fs routes, so a traversal name such as `../../escape` is rejected with `HttpError(400, INVALID_VOLUME_NAME)` before it can resolve outside `VOLUME_BASE_PATH` or become a PVC `subPath`. Bind volumes are unchanged and still accept arbitrary host source paths.
+
+  ### fix-pg-eval-result-and-project-defaults
+
+  Fix two `PostgreSQLEvalStore` contract gaps. `updateRunResult` now includes `interrupted` in its `RETURNING` list, so updating that field returns the new value instead of a stale `false` (follow-up reads already agreed with the database). `createProject` now defaults an omitted `judgeModelConfig` (and defensively an undefined `targetServerConfig`) to `{}` instead of writing SQL `NULL` into a `NOT NULL` JSONB column, matching the protocol's optional `judgeModelConfig`. Added DB-backed integration tests for both cases.
+
+  ### fix-pg-skill-get-sub-skills
+
+  Fix `PostgreSQLSkillStore.getSubSkills` so it returns the skills whose `subSkills` list contains the requested parent. The query bound `JSON.stringify([parentName])`, which made the JSONB containment compare against the JSON string `"[\"parent\"]"` instead of the array element `"parent"`, so it never matched. It now binds the bare parent name while keeping the lookup tenant-scoped. Added DB-backed integration coverage for the skill store, including cross-tenant isolation.
+
+  ### fix-pg-workflow-run-id-collision
+
+  Fix `PostgreSQLWorkflowTrackingStore.createWorkflowRun` ID collisions: the generated ID is now `${threadId}_${Date.now()}_${randomUUID()}` instead of `${threadId}_${Date.now()}`, so two runs started on the same thread within the same millisecond no longer collide on the primary key. The thread prefix is kept for readability. Added a DB-backed integration test that pins `Date.now()` to a fixed value and asserts both runs exist with distinct IDs.
+
+  ### fix-publish-target-json-schema
+
+  Fix `publish_target` for OpenAI-compatible function calling. The Zod schema now has an object root (instead of a root `oneOf` from `discriminatedUnion`), so providers no longer reject it with `schema must be a JSON Schema of 'type: "object"', got 'type: null'`.
+
+  ### fix-review-regressions
+
+  Fix review regressions across skills, SQL and filesystem backends:
+
+  - `FileSystemSkillStore.listSkillResources` falls back to the dirent `path` when `parentPath` is unavailable on older Node versions.
+  - `list_tables_sql` quotes mixed-case / non-simple identifiers only on PostgreSQL so its output round-trips through `info_sql`/`getTableInfo`; MySQL keeps raw names because its lookup is exact (unquoted input is still lowercased).
+  - `FilesystemBackend.write` creates a missing virtual root before validating ancestors.
+  - `query_checker_sql` flags data-modifying CTE `UPDATE`/`DELETE` without a `WHERE`, without misreading `FOR NO KEY UPDATE`.
+
+  Note: a cancelled workflow thread remains terminal by design — every later input on that thread (including a would-be new turn) is intentionally blocked; this wave does not change workflow abort semantics.
+
+  ### fix-sql-query-checker-schema-qualified
+
+  Harden `query_checker_sql` and fix schema-qualified PostgreSQL table lookups.
+
+  - `ISqlDatabase` gains an optional `explainQuery(query)` method. `PostgresDatabase` implements it with both guards required for safe validation: parenthesized options (`{ text: "EXPLAIN (FORMAT JSON) " + query, queryMode: "extended" }`). The parenthesized option list prevents a user query from starting with `ANALYZE` (or another EXPLAIN option) and turning validation into execution; extended query mode rejects multi-statement input server-side before any tail statement runs. Either guard alone is insufficient. `query_checker_sql` calls `explainQuery` for Postgres validation and never calls `executeQuery` for EXPLAIN; when `explainQuery` is unavailable it skips database validation instead of falling back to simple-mode execution. A server-side validation rejection now makes the overall verdict unsafe.
+  - `query_checker_sql` uses a SQL lexer that blanks single-quoted strings (including doubled quotes and E-string backslash escapes), double-quoted identifiers, dollar-quoted strings (`$$...$$`, `$tag$...$tag$`, only at token boundaries), line comments, and nested block comments. The normalized text drives both multi-statement detection and the unqualified-DML check. DML detection looks only at the statement's top-level `UPDATE`/`DELETE` and requires a depth-zero `WHERE` after it, so subquery/CTE `WHERE` clauses, `SELECT ... FOR UPDATE`, `INSERT ... ON CONFLICT DO UPDATE`, and `CREATE TABLE ... ON DELETE/ON UPDATE` do not mask or create a full-table-DML finding.
+  - The lexer is advisory/diagnostic rather than a full SQL parser: it does not implement every PostgreSQL literal/identifier form and can misclassify unusual or malformed input. The execution-safety boundary is the server-side parenthesized-options EXPLAIN in extended mode whenever Postgres validation runs; if the adapter lacks `explainQuery`, no server-side validation is performed.
+  - `PostgresDatabase.getTableInfo` now lowercases unquoted schema/table parts, preserves quoted identifier case, safely quotes schema-qualified names such as `sales.orders`, filters column and PK/FK metadata by schema (including constraint joins), and reads sample rows from the qualified table.
+
+  ### fix-wechat-client-request-contract
+
+  Fix `WeChatClient` request and stream handling:
+
+  - `makeRequest` dropped per-request headers. It built the merged header map (Content-Type, Authorization, config headers, caller headers, tenant) but passed only the workspace headers to `wechatRequest`, so headers supplied through `request()` / `chat.abort()` (including `x-axiom-affinity`) never reached `wx.request`. It now forwards the fully merged header map with precedence defaults < config < workspace < per-request, so workspace context overrides config headers.
+  - `resumeStream` omitted the required `assistant_id` body field, so the gateway rejected resumes with 400. It now includes `assistant_id`, matching the main `Client.resumeStream`.
+  - `resumeStream` and `streamRun` omitted workspace/project context. Both now merge `getWorkspaceHeaders()` into their request headers and send `Accept: text/event-stream`.
+  - `resumeStream` ignored `ResumeStreamOptions.lastEventId`. A trimmed, non-empty value is now sent as `Last-Event-ID`, matching `Client.resumeStream`.
+  - Streaming chunks are now decoded with a per-request `TextDecoder` (`{ stream: true }`) and a pending-line buffer, so JSON frames and multibyte UTF-8 characters split across chunks are no longer dropped or corrupted. Both `data: {...}` and `data:{...}` frames are accepted. On completion the pending final line is flushed, so a last `data:` line without a trailing newline is emitted.
+  - `resumeStream` and `streamRun` now inspect the stream response status: 401 surfaces `AuthenticationError` and other non-2xx statuses surface `ApiError` via `onError`, and chunks/completion are suppressed. The error body is parsed from objects, JSON strings, or plain text (`error` / `message`), falling back to `HTTP error! Status: <code>`. A transport `fail` is terminal, so the subsequent `complete` no longer calls `onComplete` or fetches agent state.
+  - Aborting through the returned stop function no longer surfaces the WeChat `fail` callback as `onError`, matching the web `Client`; aborts also suppress completion and agent-state fetching. A late completion reported through `success` after abort/terminal is ignored as well.
+  - `wechatRequest` now uses the same error-body extractor for 401 and other non-2xx responses, so gateway envelopes like `{ success: false, error: "..." }` surface their `error` (not only `message`).
+  - Bodyless `DELETE` requests no longer send `Content-Type: application/json`, matching the web `Client`.
+  - Missing `wx` / `wx.request` now raises a descriptive error instead of a raw `TypeError`.
+
+  ### fix-workspace-client-errors
+
+  Fix two `WorkspaceClient` error-handling gaps:
+
+  - `request()` now reads the gateway wire contract's `error` field (`{ success: false, error: "..." }`) before falling back to `message` and the HTTP status, matching `uploadFile`, `downloadFolder`, and `Client`. Previously only `message` was read, so gateway errors surfaced as `HTTP error! Status: 404`.
+  - `createWorkspace`, `getWorkspace`, `updateWorkspace`, `createProject`, `getProject`, and `updateProject` now throw a clear `Error` when a successful envelope omits `data`, instead of returning `undefined` through a non-null assertion. `readFile` and `browseFilesystem` get the same treatment (`Failed to read file` / `Failed to browse filesystem`). List methods keep their empty-array fallback.
+
+  ### harden-menu-item-update-patch
+
+  Security hardening for menu item updates: PUT `/api/menu-items/:id` now strips server-owned `id` and `tenantId` fields from the patch before calling the registry, so a caller cannot move an item to another tenant or rewrite its id. Normal clients that send a full persisted item back are unaffected; only the mutable fields are applied.
+
+  ### harden-microsandbox-volume-fs-confinement
+
+  Harden volume filesystem route confinement. Volume names are now validated against a conservative pattern before host path resolution, guest paths reject lexical traversal, backslashes and NUL bytes, reads/downloads/listings verify the real path stays inside the volume root, and writes/uploads/mkdir verify the nearest existing ancestor before recursive directory creation so symlinked parents cannot create or modify files outside the volume. Uploads also reject malformed base64 instead of silently decoding it.
+  This is a deterministic symlink/path hardening, not an atomic guarantee: a concurrent writer with volume access can still race validation and I/O (TOCTOU), and hard links to outside inodes are not detectable by path checks. Guest paths containing any `..` segment (even `a/../b`) are now rejected, and uploads accept only standard base64 (no base64url/whitespace-wrapped input).
+
+  ### harden-opensandbox-volume-fs-confinement
+
+  Harden volume filesystem route confinement. Volume names are now validated against a conservative pattern before host path resolution, guest paths reject lexical traversal and backslashes, reads/downloads/listings verify the real path stays inside the volume root, and writes/uploads verify the nearest existing ancestor before recursive directory creation so symlinked parents cannot create or modify files outside the volume. Uploads also reject malformed base64 instead of silently decoding it.
+  This is a deterministic symlink/path hardening, not an atomic guarantee: a concurrent writer with volume access can still race validation and I/O (TOCTOU), and hard links to outside inodes are not detectable by path checks. Guest paths containing any `..` segment (even `a/../b`) are now rejected, and uploads accept only standard base64 (no base64url/whitespace-wrapped input).
+
+  ### remove-processing-agents
+
+  Remove the deprecated PROCESSING agent type and topology middleware. WORKFLOW agents are the only orchestration type.
+
+  - Removed `AgentType.PROCESSING`, `ProcessingAgentConfig`, `isProcessingAgentConfig`, the PROCESSING builder/agent, and the disabled `create_processing_agent` / `update_processing_agent` tools.
+  - Removed `topologyMiddleware`, the topology middleware editor/default config, the Topology Automation view, and related i18n.
+  - Removed `/api/workflows/definitions` and `/api/assistants/:assistantId/workflows/definitions`; workflow run/inbox tracking remains.
+  - `CreateWorkflowModal` now creates WORKFLOW agents only.
+
+  ### tenant-plugin-schema-root
+
+  Reject tenant sandbox plugin tools whose JSON Schema root is not `type: "object"`. OpenAI-compatible function calling requires an object root; allowing `string`/`array` roots produced runtime `type: null` failures.
+
+  ### workflow-skill-store-fixes
+
+  Fix workflow abort detection and filesystem skill resource listing. The input node now lets the "workflow was cancelled before restart" error escape instead of swallowing it in the tracking-store catch, and `FileSystemSkillStore.listSkillResources` reads Node's recursive `Dirent.parentPath` instead of the removed `.path` property. Added workflow, skill-manager, and skill-store lifecycle coverage.
+
+- Updated dependencies [3c95be1]
+  - @axiom-lattice/core@12.0.1
+  - @axiom-lattice/protocols@7.0.1
+
 ## 5.0.0
 
 ### Major Changes

package/dist/index.js

@@ -3638,6 +3638,7 @@ var PostgreSQLUserTenantLinkStore = class {
 };
 
 // src/stores/PostgreSQLWorkflowTrackingStore.ts
+var import_node_crypto = require("crypto");
 var import_pg11 = require("pg");
 
 // src/migrations/workflow_tracking_migrations.ts
@@ -3798,7 +3799,7 @@ var PostgreSQLWorkflowTrackingStore = class {
   async createWorkflowRun(request) {
     await this.ensureInitialized();
     const now = /* @__PURE__ */ new Date();
-    const id = `${request.threadId}_${Date.now()}`;
+    const id = `${request.threadId}_${Date.now()}_${(0, import_node_crypto.randomUUID)()}`;
     await this.pool.query(
       `INSERT INTO lattice_workflow_runs (id, tenant_id, assistant_id, thread_id, status, topology_edges, total_edges, completed_edges, metadata, started_at, created_at, updated_at)
        VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12)`,
@@ -4684,8 +4685,8 @@ var PostgreSQLEvalStore = class {
         data.name,
         data.description || null,
         data.version || null,
-        JSON.stringify(data.judgeModelConfig),
-        JSON.stringify(data.targetServerConfig),
+        JSON.stringify(data.judgeModelConfig ?? {}),
+        JSON.stringify(data.targetServerConfig ?? {}),
         data.concurrency ?? 3,
         data.reportConfig === void 0 ? null : JSON.stringify(data.reportConfig)
       ]
@@ -5188,7 +5189,7 @@ var PostgreSQLEvalStore = class {
          AND run_id IN (SELECT id FROM lattice_eval_runs WHERE tenant_id = $${i + 1})
        RETURNING id, run_id, suite_name, case_id,
                  pass, score, summary, dimension_results,
-                 duration_ms, messages, logs, error, created_at`,
+                 duration_ms, messages, logs, error, interrupted, created_at`,
       vals
     );
     return rows.length ? this.mapRowToRunResult(rows[0]) : null;
@@ -9863,7 +9864,7 @@ var PGVectorStoreProvider = class {
     );
     if (!embeddings) {
       throw new Error(
-        `No embedding model "${embeddingKey}" registered for tenant "${tenantId}", and no tenant or deployment default. Configure one in the model service panel.`
+        `No embedding model "${embeddingKey}" registered for tenant "${tenantId}", and no default model available. Configure one in the model service panel.`
       );
     }
     return import_pgvector.PGVectorStore.initialize(embeddings, {
@@ -11947,7 +11948,7 @@ var PostgreSQLProjectRoomReadStateStore = class {
 };
 
 // src/stores/PostgreSQLUserPushSubscriptionStore.ts
-var import_node_crypto = require("crypto");
+var import_node_crypto2 = require("crypto");
 var columns4 = "id, tenant_id, user_id, endpoint, p256dh, auth, user_agent, created_at";
 function mapRow7(row) {
   if (typeof row.id !== "string" || typeof row.tenant_id !== "string" || typeof row.user_id !== "string" || typeof row.endpoint !== "string" || typeof row.p256dh !== "string" || typeof row.auth !== "string" || !(row.created_at instanceof Date) || Number.isNaN(row.created_at.getTime())) {
@@ -11984,7 +11985,7 @@ var PostgreSQLUserPushSubscriptionStore = class {
        ON CONFLICT (tenant_id, user_id, endpoint) DO UPDATE
          SET p256dh = EXCLUDED.p256dh, auth = EXCLUDED.auth, user_agent = EXCLUDED.user_agent
        RETURNING ${columns4}`,
-      [(0, import_node_crypto.randomUUID)(), input.tenantId, input.userId, input.endpoint, input.keys.p256dh, input.keys.auth, input.userAgent ?? null]
+      [(0, import_node_crypto2.randomUUID)(), input.tenantId, input.userId, input.endpoint, input.keys.p256dh, input.keys.auth, input.userAgent ?? null]
     );
     return mapRow7(result.rows[0]);
   }
@@ -15203,7 +15204,7 @@ var PostgreSQLSkillStore = class {
       WHERE tenant_id = $1 AND sub_skills @> to_jsonb($2::text)
       ORDER BY created_at DESC
     `,
-      [tenantId, JSON.stringify([parentSkillName])]
+      [tenantId, parentSkillName]
     );
     return result.rows.map(this.mapRowToSkill);
   }