@axiom-lattice/protocols 4.7.0 → 4.7.1

package/.turbo/turbo-build.log

@@ -1,5 +1,5 @@
 
-> @axiom-lattice/protocols@4.7.0 build /home/runner/work/agentic/agentic/packages/protocols
+> @axiom-lattice/protocols@4.7.1 build /home/runner/work/agentic/agentic/packages/protocols
 > tsup src/index.ts --format cjs,esm --dts --sourcemap
 
 CLI Building entry: src/index.ts
@@ -8,13 +8,13 @@
 CLI Target: es2020
 CJS Build start
 ESM Build start
-ESM dist/index.mjs     42.99 KB
-ESM dist/index.mjs.map 189.15 KB
-ESM ⚡️ Build success in 817ms
 CJS dist/index.js     48.09 KB
 CJS dist/index.js.map 193.07 KB
-CJS ⚡️ Build success in 819ms
+CJS ⚡️ Build success in 508ms
+ESM dist/index.mjs     42.99 KB
+ESM dist/index.mjs.map 189.15 KB
+ESM ⚡️ Build success in 504ms
 DTS Build start
-DTS ⚡️ Build success in 15444ms
-DTS dist/index.d.ts  249.89 KB
-DTS dist/index.d.mts 249.89 KB
+DTS ⚡️ Build success in 14202ms
+DTS dist/index.d.ts  251.25 KB
+DTS dist/index.d.mts 251.25 KB

package/CHANGELOG.md

@@ -1,5 +1,18 @@
 # @axiom-lattice/protocols
 
+## 4.7.1
+
+### Patch Changes
+
+- bb2614f: Chating composer height, plugin connection-secret encryption, and manage_task compact cards.
+
+  - react-sdk: keep the Chating composer input from collapsing after a run. In slot mode (Chating always passes an array `slotConfig`) the Sender input is a `contentEditable` whose height comes from `autoSize`; without a `minRows` the empty editor lost its placeholder-driven line box once streaming ended and collapsed to zero height on some platforms (e.g. Windows Chrome), leaving the input unreachable while the footer stayed visible. Pass `autoSize={{ minRows: 1, maxRows: 8 }}` like `ProjectRoomComposer`.
+  - protocols/core: add `ConnectionEntry.secretFields`, plus `connectionSecretFields` / `encryptConfigFields` / `decryptConfigFields`.
+  - local-stores/pg-stores: encrypt the declared secret fields on save and decrypt on read, so the API and runtime consumers always receive real values. Existing plaintext rows read unchanged and convert on their next save (PG migration v188).
+  - gateway: plugin builder self-test discovery + secret redaction.
+  - core: `manage_task` `add_activity` now returns the target task alongside the activity (`{ success, data, task }`), so UIs can show which task an activity was written to.
+  - react-sdk: every `manage_task` action renders a compact chip in the chat stream and reveals its full card on hover. Fixes `get` and `add_activity`, which previously rendered no UI at all.
+
 ## 4.7.0
 
 ### Minor Changes

package/dist/index.d.mts

@@ -2409,14 +2409,50 @@ interface ConnectionEntry {
     name: string;
     description?: string;
     config: Record<string, unknown>;
+    /**
+     * Names of config fields that hold secrets (API keys, passwords, tokens).
+     *
+     * Stores persist this list alongside the entry and use it to encrypt those
+     * config values at rest on write and transparently decrypt them on read.
+     * `config` in a returned entry is always the decrypted, real value — callers
+     * (gateway API, runtime plugin resolution) never see ciphertext.
+     *
+     * Absent/empty means the entry has no encrypted fields (e.g. legacy rows or
+     * connection types whose schema defines no password fields).
+     */
+    secretFields?: string[];
     createdAt: string;
     updatedAt: string;
 }
 interface ConnectionStore {
     listByTenant(tenantId: string): Promise<ConnectionEntry[]>;
+    /**
+     * List a tenant's connections of one plugin type.
+     *
+     * `config` in the returned entries is decrypted — implementations decrypt the
+     * fields named by each entry's `secretFields` before returning.
+     */
     listByType(tenantId: string, type: string): Promise<ConnectionEntry[]>;
+    /**
+     * Read one connection by key.
+     *
+     * `config` in the returned entry is decrypted (see `listByType`).
+     */
     getByKey(tenantId: string, type: string, key: string): Promise<ConnectionEntry | null>;
+    /**
+     * Create a connection.
+     *
+     * Implementations encrypt the `secretFields` of `config` at rest; the
+     * returned entry carries the plaintext `config` the caller supplied.
+     */
     create(entry: Omit<ConnectionEntry, "id" | "createdAt" | "updatedAt">): Promise<ConnectionEntry>;
+    /**
+     * Update a connection.
+     *
+     * When `updates.config` is present, the effective secret fields are
+     * `updates.secretFields ?? existing.secretFields`; those fields are
+     * re-encrypted before persistence.
+     */
     update(tenantId: string, type: string, key: string, updates: Partial<ConnectionEntry>): Promise<ConnectionEntry | null>;
     delete(tenantId: string, type: string, key: string): Promise<boolean>;
 }

package/dist/index.d.ts

@@ -2409,14 +2409,50 @@ interface ConnectionEntry {
     name: string;
     description?: string;
     config: Record<string, unknown>;
+    /**
+     * Names of config fields that hold secrets (API keys, passwords, tokens).
+     *
+     * Stores persist this list alongside the entry and use it to encrypt those
+     * config values at rest on write and transparently decrypt them on read.
+     * `config` in a returned entry is always the decrypted, real value — callers
+     * (gateway API, runtime plugin resolution) never see ciphertext.
+     *
+     * Absent/empty means the entry has no encrypted fields (e.g. legacy rows or
+     * connection types whose schema defines no password fields).
+     */
+    secretFields?: string[];
     createdAt: string;
     updatedAt: string;
 }
 interface ConnectionStore {
     listByTenant(tenantId: string): Promise<ConnectionEntry[]>;
+    /**
+     * List a tenant's connections of one plugin type.
+     *
+     * `config` in the returned entries is decrypted — implementations decrypt the
+     * fields named by each entry's `secretFields` before returning.
+     */
     listByType(tenantId: string, type: string): Promise<ConnectionEntry[]>;
+    /**
+     * Read one connection by key.
+     *
+     * `config` in the returned entry is decrypted (see `listByType`).
+     */
     getByKey(tenantId: string, type: string, key: string): Promise<ConnectionEntry | null>;
+    /**
+     * Create a connection.
+     *
+     * Implementations encrypt the `secretFields` of `config` at rest; the
+     * returned entry carries the plaintext `config` the caller supplied.
+     */
     create(entry: Omit<ConnectionEntry, "id" | "createdAt" | "updatedAt">): Promise<ConnectionEntry>;
+    /**
+     * Update a connection.
+     *
+     * When `updates.config` is present, the effective secret fields are
+     * `updates.secretFields ?? existing.secretFields`; those fields are
+     * re-encrypted before persistence.
+     */
     update(tenantId: string, type: string, key: string, updates: Partial<ConnectionEntry>): Promise<ConnectionEntry | null>;
     delete(tenantId: string, type: string, key: string): Promise<boolean>;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@axiom-lattice/protocols",
-  "version": "4.7.0",
+  "version": "4.7.1",
   "description": "Unified protocol type definitions for Axiom Lattice framework",
   "main": "dist/index.js",
   "module": "dist/index.mjs",

package/src/ConnectionStoreProtocol.ts

@@ -15,15 +15,51 @@ export interface ConnectionEntry {
   name: string;
   description?: string;
   config: Record<string, unknown>;
+  /**
+   * Names of config fields that hold secrets (API keys, passwords, tokens).
+   *
+   * Stores persist this list alongside the entry and use it to encrypt those
+   * config values at rest on write and transparently decrypt them on read.
+   * `config` in a returned entry is always the decrypted, real value — callers
+   * (gateway API, runtime plugin resolution) never see ciphertext.
+   *
+   * Absent/empty means the entry has no encrypted fields (e.g. legacy rows or
+   * connection types whose schema defines no password fields).
+   */
+  secretFields?: string[];
   createdAt: string;
   updatedAt: string;
 }
 
 export interface ConnectionStore {
   listByTenant(tenantId: string): Promise<ConnectionEntry[]>;
+  /**
+   * List a tenant's connections of one plugin type.
+   *
+   * `config` in the returned entries is decrypted — implementations decrypt the
+   * fields named by each entry's `secretFields` before returning.
+   */
   listByType(tenantId: string, type: string): Promise<ConnectionEntry[]>;
+  /**
+   * Read one connection by key.
+   *
+   * `config` in the returned entry is decrypted (see `listByType`).
+   */
   getByKey(tenantId: string, type: string, key: string): Promise<ConnectionEntry | null>;
+  /**
+   * Create a connection.
+   *
+   * Implementations encrypt the `secretFields` of `config` at rest; the
+   * returned entry carries the plaintext `config` the caller supplied.
+   */
   create(entry: Omit<ConnectionEntry, "id" | "createdAt" | "updatedAt">): Promise<ConnectionEntry>;
+  /**
+   * Update a connection.
+   *
+   * When `updates.config` is present, the effective secret fields are
+   * `updates.secretFields ?? existing.secretFields`; those fields are
+   * re-encrypted before persistence.
+   */
   update(tenantId: string, type: string, key: string, updates: Partial<ConnectionEntry>): Promise<ConnectionEntry | null>;
   delete(tenantId: string, type: string, key: string): Promise<boolean>;
 }