@flowdular/sdk 0.2.3 → 0.3.0

package/modules/automations/src/services/schedule-runner.ts

@@ -0,0 +1,84 @@
+import {
+	createJobRunner,
+	createJobTraceSink,
+	jobBackoff,
+	serverLogger,
+	type JobEvent,
+	type JobRunner,
+	type Tracer,
+} from '@flowdular/sdk/server';
+import type { AutomationScheduleService } from './schedule-service.ts';
+import type {
+	AutomationScheduleRouting,
+	AutomationsRepository,
+} from './repository.ts';
+
+/** Schedules one pass fires, and the page the cross-tenant poll answers. */
+export const SCHEDULE_POLL_PAGE = 20;
+
+export interface AutomationScheduleRunnerOptions {
+	readonly repository: () => Promise<AutomationsRepository>;
+	readonly service: () => Promise<AutomationScheduleService>;
+	/** The platform setting, read once when the loop starts. */
+	readonly intervalMs: number;
+	readonly now?: (() => number) | undefined;
+	/** Absent turns every pass into spans; a sink of its own replaces that. */
+	readonly onEvent?: ((event: JobEvent) => void) | undefined;
+	/** Defaults to the process tracer, which is the one `context.tracer` carries. */
+	readonly tracer?: Tracer | undefined;
+}
+
+/**
+ * The scheduler pass as the platform runner sees it: a claim over routing
+ * columns and one due schedule fired per claim. The loop, its bound, the guard
+ * against overlapping passes, the isolation of one schedule from the next and
+ * the drain are the runner's (`@flowdular/sdk/server`); the cross-tenant poll, the
+ * re-read under the workspace it named and the slot advance stay here.
+ */
+export function createAutomationScheduleRunner(
+	options: AutomationScheduleRunnerOptions,
+): JobRunner {
+	/* The poll crosses workspaces on the background role and answers routing
+	   columns alone. It refills only once the page it filled is drained, and a
+	   page shorter than the bound means nothing further was due, so a pass reads
+	   it at most twice however many schedules it fires. */
+	let queue: AutomationScheduleRouting[] = [];
+	let refillable = true;
+
+	return createJobRunner<AutomationScheduleRouting>({
+		name: 'automations.core',
+		intervalMs: options.intervalMs,
+		/* A schedule claims nothing: the next run time the advance compares and
+		   swaps, and the slot key the run carries, are its fence, so no lease is
+		   held and no renewal runs. */
+		staleAfterMs: options.intervalMs,
+		backoff: jobBackoff(options.intervalMs),
+		batchLimit: SCHEDULE_POLL_PAGE,
+		logger: serverLogger,
+		now: options.now,
+		onEvent:
+			options.onEvent ??
+			createJobTraceSink(options.tracer ? { tracer: options.tracer } : {}),
+		claim: async (at) => {
+			if (queue.length === 0) {
+				if (!refillable) {
+					refillable = true;
+					return null;
+				}
+				const repository = await options.repository();
+				const page = await repository.listDueSchedules(at, SCHEDULE_POLL_PAGE);
+				refillable = page.length === SCHEDULE_POLL_PAGE;
+				queue = [...page];
+			}
+			const routing = queue.shift();
+			if (!routing) {
+				refillable = true;
+				return null;
+			}
+			return routing;
+		},
+		perform: async (routing) => {
+			await (await options.service()).fireDue(routing);
+		},
+	});
+}

package/modules/automations/src/services/schedule-service.ts

@@ -22,10 +22,13 @@ import {
 } from '../domain/variables.ts';
 import {
 	InvalidCadenceError,
-	cadenceMinutes,
-	nextSlotAfter,
+	firstCadenceSlot,
+	nextCadenceSlot,
 	normalizeCadence,
+	parseCadence,
+	type Cadence,
 } from '../domain/cadence.ts';
+import { DEFAULT_TIME_ZONE } from '../domain/time-zone.ts';
 import {
 	createAutomationTargetRegistry,
 	type AutomationTargetJsonValue,
@@ -33,6 +36,9 @@ import {
 } from '../server/targets.ts';
 import { AutomationsServiceError } from './automations-service.ts';
 import type {
+	AutomationListPage,
+	AutomationListQuery,
+	AutomationScheduleRouting,
 	AutomationsRepository,
 	StoredAutomationSchedule,
 } from './repository.ts';
@@ -72,6 +78,17 @@ function cadence(value: string): string {
 	}
 }
 
+function cadenceSlot(compute: () => number): number {
+	try {
+		return compute();
+	} catch (error) {
+		if (error instanceof InvalidCadenceError) {
+			throw new AutomationsServiceError('INVALID_CADENCE', error.message);
+		}
+		throw error;
+	}
+}
+
 function trustedUser(input: string | UserActor): UserActor {
 	if (typeof input === 'string') {
 		const id = bounded(input, 'actorId', 1, 128);
@@ -203,17 +220,42 @@ export class AutomationScheduleService {
 		private readonly signal: AbortSignal = new AbortController().signal,
 		variables?: PlatformVariableRegistry,
 		targets?: AutomationTargetRegistry,
+		/* The workspace zone a cron slot is computed in, read live so a change
+		   applies to the next slot rather than to the next deployment. */
+		private readonly timeZoneOf: (tenantId: string) => string = () =>
+			DEFAULT_TIME_ZONE,
+		/* Loads the workspace settings the zone is read from; the scheduler
+		   fires outside any request, so nothing else has primed them. */
+		private readonly primeTenant: (tenantId: string) => Promise<void> = () =>
+			Promise.resolve(),
 	) {
 		this.variables = variables ?? createScheduleVariableRegistry(this.runs);
 		this.targets = targets ?? createAutomationTargetRegistry();
 	}
 
-	async list(tenantId: string): Promise<readonly AutomationSchedule[]> {
-		return Promise.all(
-			(await this.repository.listSchedules(tenantId)).map((record) =>
-				this.present(record),
+	/** The zone this workspace's wall clock slots and screens use. */
+	timeZone(tenantId: string): string {
+		return this.timeZoneOf(bounded(tenantId, 'tenantId', 1, 128));
+	}
+
+	/* An interval cadence carries no zone, so it never pays for the read. */
+	private zoneFor(cadence: Cadence, tenantId: string): string {
+		return cadence.kind === 'cron'
+			? this.timeZoneOf(tenantId)
+			: DEFAULT_TIME_ZONE;
+	}
+
+	async list(
+		tenantId: string,
+		query: AutomationListQuery,
+	): Promise<AutomationListPage<AutomationSchedule>> {
+		const page = await this.repository.listSchedulesPage(tenantId, query);
+		return {
+			items: await Promise.all(
+				page.items.map((record) => this.present(record)),
 			),
-		);
+			next: page.next,
+		};
 	}
 
 	async agents(tenantId: string) {
@@ -307,7 +349,7 @@ export class AutomationScheduleService {
 			cadence: normalized,
 			enabled: input.enabled === true,
 			disabledReason: null,
-			nextRunAt: now + cadenceMinutes(normalized) * 60_000,
+			nextRunAt: this.firstSlot(normalized, trustedTenantId, now),
 			lastRunAt: null,
 			lastRunId: null,
 			lastError: null,
@@ -361,7 +403,7 @@ export class AutomationScheduleService {
 		const nextRunAt =
 			nextCadence === existing.cadence && existing.enabled === input.enabled
 				? existing.nextRunAt
-				: now + cadenceMinutes(nextCadence) * 60_000;
+				: this.firstSlot(nextCadence, trustedTenantId, now);
 		const inputTemplate = bounded(input.inputTemplate, 'input', 1, 10_000);
 		validateScheduleTemplate(inputTemplate, scopes);
 		if (
@@ -541,22 +583,19 @@ export class AutomationScheduleService {
 		return { id, created, targetKind: stored.targetKind };
 	}
 
-	async tick(limit = 20): Promise<number> {
-		const now = this.now();
-		const due = await this.repository.listDueSchedules(now, limit);
-		let fired = 0;
-		for (const routing of due) {
-			/* The poll crosses tenants and returns routing data only. The schedule
-			   itself is read under the tenant that row named, and a slot that moved
-			   in between is skipped rather than fired twice. */
-			const schedule = await this.repository.getSchedule(
-				routing.tenantId,
-				routing.id,
-			);
-			if (!schedule || schedule.nextRunAt !== routing.nextRunAt) continue;
-			if (await this.fire(schedule, now)) fired += 1;
-		}
-		return fired;
+	/**
+	 * One due schedule the cross-tenant poll routed here. The poll returns
+	 * routing data only, so the schedule itself is read under the tenant that row
+	 * named, and a slot that moved in between is skipped rather than fired twice.
+	 * Answers whether the slot dispatched a run.
+	 */
+	async fireDue(routing: AutomationScheduleRouting): Promise<boolean> {
+		const schedule = await this.repository.getSchedule(
+			routing.tenantId,
+			routing.id,
+		);
+		if (!schedule || schedule.nextRunAt !== routing.nextRunAt) return false;
+		return await this.fire(schedule, this.now());
 	}
 
 	private async fire(
@@ -564,6 +603,43 @@ export class AutomationScheduleService {
 		now: number,
 	): Promise<boolean> {
 		const slot = schedule.nextRunAt;
+		await this.primeTenant(schedule.tenantId);
+		/* Resolved before anything is dispatched: a cadence whose next slot cannot
+		   be computed disables the schedule instead of firing a slot it could
+		   never advance past. */
+		let nextRunAt: number;
+		try {
+			const cadence = parseCadence(schedule.cadence);
+			nextRunAt = nextCadenceSlot(
+				cadence,
+				slot,
+				now,
+				this.zoneFor(cadence, schedule.tenantId),
+			);
+		} catch (error) {
+			if (!(error instanceof InvalidCadenceError)) throw error;
+			const reason = `INVALID_CADENCE: ${error.message}`.slice(
+				0,
+				MAX_ERROR_LENGTH,
+			);
+			if (
+				await this.repository.disableSchedule(
+					schedule.tenantId,
+					schedule.id,
+					reason,
+					now,
+				)
+			) {
+				await this.audit(
+					schedule,
+					'system',
+					'automation-schedule.disabled',
+					now,
+					{ reason: 'INVALID_CADENCE', targetKind: schedule.targetKind },
+				);
+			}
+			return false;
+		}
 		let runId: string | null = null;
 		let failure: string | null = null;
 		try {
@@ -647,7 +723,7 @@ export class AutomationScheduleService {
 			tenantId: schedule.tenantId,
 			scheduleId: schedule.id,
 			firedSlot: slot,
-			nextRunAt: nextSlotAfter(slot, cadenceMinutes(schedule.cadence), now),
+			nextRunAt,
 			lastRunAt: now,
 			lastRunId: runId ?? schedule.lastRunId,
 			lastError: failure,
@@ -669,6 +745,56 @@ export class AutomationScheduleService {
 		return runId !== null;
 	}
 
+	private firstSlot(normalized: string, tenantId: string, now: number): number {
+		const cadence = parseCadence(normalized);
+		return cadenceSlot(() =>
+			firstCadenceSlot(cadence, now, this.zoneFor(cadence, tenantId)),
+		);
+	}
+
+	/**
+	 * Moves every pending cron slot of one workspace into the zone it now uses.
+	 * A slot already due is left alone so the fire it owes is not lost, and each
+	 * write is conditional on the slot this read saw, so a concurrent fire wins.
+	 */
+	async retime(tenantId: string): Promise<number> {
+		const trustedTenantId = bounded(tenantId, 'tenantId', 1, 128);
+		const now = this.now();
+		const timeZone = this.timeZoneOf(trustedTenantId);
+		let moved = 0;
+		for (const schedule of await this.repository.listSchedules(
+			trustedTenantId,
+		)) {
+			if (!schedule.enabled || schedule.nextRunAt <= now) continue;
+			let nextRunAt: number;
+			try {
+				const cadence = parseCadence(schedule.cadence);
+				if (cadence.kind !== 'cron') continue;
+				nextRunAt = firstCadenceSlot(cadence, now, timeZone);
+			} catch (error) {
+				/* A cadence that no longer parses is left for the fire path, which
+				   disables it with the reason on the schedule. */
+				if (error instanceof InvalidCadenceError) continue;
+				throw error;
+			}
+			if (nextRunAt === schedule.nextRunAt) continue;
+			const applied = await this.repository.retimeSchedule({
+				tenantId: trustedTenantId,
+				scheduleId: schedule.id,
+				expectedNextRunAt: schedule.nextRunAt,
+				nextRunAt,
+				updatedAt: now,
+			});
+			if (!applied) continue;
+			moved += 1;
+			await this.audit(schedule, 'system', 'automation-schedule.retimed', now, {
+				timeZone,
+				nextRunAt,
+			});
+		}
+		return moved;
+	}
+
 	private async validateTarget(
 		tenantId: string,
 		target: { readonly kind: string; readonly key: string },

package/modules/automations/src/services/secret-rotation.ts

@@ -0,0 +1,176 @@
+import type { DatabaseHandle } from '@flowdular/sdk/database';
+import { secretContext, type SecretVault } from './secret-vault.ts';
+
+/** Rows re-sealed inside one tenant-scoped transaction. */
+export const SECRET_ROTATION_BATCH = 200;
+
+export const SECRET_ROTATION_TABLE = 'automations_triggers';
+
+export interface SecretKeyCount {
+	readonly keyId: string;
+	readonly rows: number;
+}
+
+export interface SecretRotationReport {
+	readonly table: string;
+	/** Key id every row should end on: the current key of the vault. */
+	readonly currentKeyId: string;
+	readonly counts: readonly SecretKeyCount[];
+	/** Rows on a retired key when the run started. */
+	readonly stale: number;
+	readonly tenants: number;
+	readonly rotated: number;
+	/** Rows a concurrent write changed between the read and the update. */
+	readonly skipped: number;
+}
+
+export interface SecretRotationOptions {
+	/** Tenant-scoped handle. Every read and write of a row runs on it. */
+	readonly runtime: DatabaseHandle;
+	/** Cross-tenant handle. It is granted the key ids and nothing else. */
+	readonly background: DatabaseHandle;
+	readonly vault: SecretVault;
+	readonly apply?: boolean;
+	readonly batchSize?: number;
+}
+
+interface StaleRow {
+	id: string;
+	secret_key_id: string;
+	secret_iv: string;
+	secret_tag: string;
+	secret_ciphertext: string;
+}
+
+const SQL = {
+	counts: `SELECT secret_key_id AS key_id, count(*) AS row_count
+	         FROM automations_triggers
+	         GROUP BY secret_key_id
+	         ORDER BY secret_key_id`,
+	staleTenants: `SELECT tenant_id, count(*) AS row_count
+	               FROM automations_triggers
+	               WHERE secret_key_id <> $1
+	               GROUP BY tenant_id
+	               ORDER BY tenant_id`,
+	/* Paged by primary key: a row the optimistic update skipped stays stale, so
+	   a query that only asked for stale rows would return it forever. */
+	staleBatch: `SELECT id, secret_key_id, secret_iv, secret_tag, secret_ciphertext
+	             FROM automations_triggers
+	             WHERE tenant_id = $1 AND secret_key_id <> $2 AND id > $3
+	             ORDER BY id
+	             LIMIT $4`,
+	/* The envelope the row still holds is the optimistic check: a secret rotated
+	   by the application in between keeps its own value. secret_revision counts
+	   secret changes a caller can see, and a re-seal is not one. */
+	reseal: `UPDATE automations_triggers
+	         SET secret_key_id = $1, secret_iv = $2, secret_tag = $3,
+	             secret_ciphertext = $4
+	         WHERE tenant_id = $5 AND id = $6 AND secret_ciphertext = $7`,
+};
+
+function count(value: number | bigint | string): number {
+	const normalized = Number(value);
+	if (!Number.isSafeInteger(normalized)) {
+		throw new Error('The automations database returned an invalid count.');
+	}
+	return normalized;
+}
+
+/**
+ * Re-seals every stored trigger secret that is not on the current key. The
+ * inventory is read once across tenants, and each batch of rows is read,
+ * decrypted, re-sealed and written inside one transaction scoped to the tenant
+ * that owns them. It is idempotent: a second run finds nothing to do.
+ */
+export async function rotateTriggerSecrets(
+	options: SecretRotationOptions,
+): Promise<SecretRotationReport> {
+	const currentKeyId = options.vault.keyId;
+	const batchSize = options.batchSize ?? SECRET_ROTATION_BATCH;
+	const inventory = await options.background.transaction(
+		async (transaction) => ({
+			counts: (
+				await transaction.query<{
+					key_id: string;
+					row_count: number | bigint | string;
+				}>({ text: SQL.counts })
+			).rows,
+			stale: (
+				await transaction.query<{
+					tenant_id: string;
+					row_count: number | bigint | string;
+				}>({ text: SQL.staleTenants, parameters: [currentKeyId] })
+			).rows,
+		}),
+		{ access: 'read' },
+	);
+	const report = {
+		table: SECRET_ROTATION_TABLE,
+		currentKeyId,
+		counts: inventory.counts.map((row) => ({
+			keyId: row.key_id,
+			rows: count(row.row_count),
+		})),
+		stale: inventory.stale.reduce(
+			(total, row) => total + count(row.row_count),
+			0,
+		),
+		tenants: inventory.stale.length,
+	};
+	if (options.apply !== true) {
+		return { ...report, rotated: 0, skipped: 0 };
+	}
+	let rotated = 0;
+	let skipped = 0;
+	for (const { tenant_id: tenantId } of inventory.stale) {
+		let cursor = '';
+		for (;;) {
+			const batch = await options.runtime.transaction(
+				async (transaction) => {
+					const rows = (
+						await transaction.query<StaleRow>({
+							text: SQL.staleBatch,
+							parameters: [tenantId, currentKeyId, cursor, batchSize],
+						})
+					).rows;
+					let written = 0;
+					for (const row of rows) {
+						const context = secretContext(tenantId, row.id);
+						const sealed = options.vault.encrypt(
+							options.vault.decrypt(
+								{
+									keyId: row.secret_key_id,
+									iv: row.secret_iv,
+									tag: row.secret_tag,
+									ciphertext: row.secret_ciphertext,
+								},
+								context,
+							),
+							context,
+						);
+						const result = await transaction.execute({
+							text: SQL.reseal,
+							parameters: [
+								sealed.keyId,
+								sealed.iv,
+								sealed.tag,
+								sealed.ciphertext,
+								tenantId,
+								row.id,
+								row.secret_ciphertext,
+							],
+						});
+						written += result.affectedRows;
+					}
+					return { read: rows.length, written, last: rows.at(-1)?.id };
+				},
+				{ access: 'write', tenantId },
+			);
+			rotated += batch.written;
+			skipped += batch.read - batch.written;
+			if (batch.read < batchSize || batch.last === undefined) break;
+			cursor = batch.last;
+		}
+	}
+	return { ...report, rotated, skipped };
+}

package/modules/automations/src/services/secret-vault.ts

@@ -1,9 +1,4 @@
-import {
-	createCipheriv,
-	createDecipheriv,
-	createHash,
-	randomBytes,
-} from 'node:crypto';
+import { randomBytes } from 'node:crypto';
 import {
 	closeSync,
 	mkdirSync,
@@ -12,6 +7,12 @@ import {
 	writeFileSync,
 } from 'node:fs';
 import { dirname } from 'node:path';
+import {
+	createKeyring,
+	KeyringError,
+	parsePreviousKeys,
+	type Keyring,
+} from '@flowdular/sdk/kernel';
 import { flowdularLocalDataPath } from '@flowdular/sdk/kernel/legacy-local-state';
 
 export interface EncryptedSecret {
@@ -21,32 +22,48 @@ export interface EncryptedSecret {
 	readonly ciphertext: string;
 }
 
+/**
+ * The additional data every trigger secret envelope is bound to. It is part of
+ * the stored envelope: re-sealing a row under a new key must rebuild exactly
+ * this string, so it lives with the envelope format and not with a service.
+ */
+export function secretContext(tenantId: string, triggerId: string): string {
+	return `${tenantId}:${triggerId}:automation-trigger`;
+}
+
 export interface SecretVault {
+	/** Key id every new envelope is written with; stored rows may carry older ones. */
+	readonly keyId: string;
 	encrypt(secret: string, context: string): EncryptedSecret;
 	decrypt(envelope: EncryptedSecret, context: string): string;
 }
 
-function encryptionKey(value: string): Buffer {
+function encryptionKey(
+	value: string,
+	variable = 'FD_AUTOMATIONS_CREDENTIAL_KEY',
+): Buffer {
 	const key = Buffer.from(value.trim(), 'base64');
 	if (key.byteLength !== 32) {
 		key.fill(0);
-		throw new Error(
-			'FD_AUTOMATIONS_CREDENTIAL_KEY must be a base64-encoded 32-byte key.',
-		);
+		throw new Error(`${variable} must be a base64-encoded 32-byte key.`);
 	}
 	return key;
 }
 
 export class AesGcmSecretVault implements SecretVault {
-	readonly #key: Buffer;
-	readonly #keyId: string;
+	readonly #keyring: Keyring;
 
-	constructor(key: Buffer) {
+	/* `previous` holds the keys a rotation has not finished retiring: they open
+	   stored rows, and nothing is ever written with them. */
+	constructor(key: Buffer, previous: readonly Buffer[] = []) {
 		if (key.byteLength !== 32) {
 			throw new Error('Automation secret encryption requires a 32-byte key.');
 		}
-		this.#key = Buffer.from(key);
-		this.#keyId = createHash('sha256').update(key).digest('hex').slice(0, 16);
+		this.#keyring = createKeyring({ current: key, previous });
+	}
+
+	get keyId(): string {
+		return this.#keyring.keyId;
 	}
 
 	encrypt(secret: string, context: string): EncryptedSecret {
@@ -54,36 +71,39 @@ export class AesGcmSecretVault implements SecretVault {
 		if (normalized.length < 8 || normalized.length > 16_384) {
 			throw new Error('Automation secrets must contain 8 to 16384 characters.');
 		}
-		const iv = randomBytes(12);
-		const cipher = createCipheriv('aes-256-gcm', this.#key, iv);
-		cipher.setAAD(Buffer.from(context, 'utf8'));
-		const ciphertext = Buffer.concat([
-			cipher.update(normalized, 'utf8'),
-			cipher.final(),
-		]);
+		const sealed = this.#keyring.seal(normalized, context);
 		return {
-			keyId: this.#keyId,
-			iv: iv.toString('base64'),
-			tag: cipher.getAuthTag().toString('base64'),
-			ciphertext: ciphertext.toString('base64'),
+			keyId: sealed.keyId,
+			iv: sealed.iv.toString('base64'),
+			tag: sealed.tag.toString('base64'),
+			ciphertext: sealed.ciphertext.toString('base64'),
 		};
 	}
 
 	decrypt(envelope: EncryptedSecret, context: string): string {
-		if (envelope.keyId !== this.#keyId) {
-			throw new Error('The automation secret encryption key is unavailable.');
+		try {
+			return this.#keyring
+				.open(
+					{
+						keyId: envelope.keyId,
+						iv: Buffer.from(envelope.iv, 'base64'),
+						tag: Buffer.from(envelope.tag, 'base64'),
+						ciphertext: Buffer.from(envelope.ciphertext, 'base64'),
+					},
+					context,
+				)
+				.toString('utf8');
+		} catch (error) {
+			if (error instanceof KeyringError && error.code === 'KEY_UNKNOWN') {
+				throw new Error(
+					'The automation secret encryption key is unavailable.',
+					{
+						cause: error,
+					},
+				);
+			}
+			throw error;
 		}
-		const decipher = createDecipheriv(
-			'aes-256-gcm',
-			this.#key,
-			Buffer.from(envelope.iv, 'base64'),
-		);
-		decipher.setAAD(Buffer.from(context, 'utf8'));
-		decipher.setAuthTag(Buffer.from(envelope.tag, 'base64'));
-		return Buffer.concat([
-			decipher.update(Buffer.from(envelope.ciphertext, 'base64')),
-			decipher.final(),
-		]).toString('utf8');
 	}
 }
 
@@ -108,17 +128,24 @@ export function secretVaultFromEnvironment(
 	environment: NodeJS.ProcessEnv = process.env,
 	workspaceRoot = process.cwd(),
 ): SecretVault {
+	const previous = parsePreviousKeys(
+		environment.FD_AUTOMATIONS_CREDENTIAL_KEY_PREVIOUS,
+		(entry) => encryptionKey(entry, 'FD_AUTOMATIONS_CREDENTIAL_KEY_PREVIOUS'),
+	);
 	const configured = environment.FD_AUTOMATIONS_CREDENTIAL_KEY;
-	if (configured) return new AesGcmSecretVault(encryptionKey(configured));
+	if (configured) {
+		return new AesGcmSecretVault(encryptionKey(configured), previous);
+	}
 	if (environment.NODE_ENV === 'production') {
 		throw new Error('FD_AUTOMATIONS_CREDENTIAL_KEY is required in production.');
 	}
 	if (environment.NODE_ENV === 'test') {
-		return new AesGcmSecretVault(Buffer.alloc(32, 0x41));
+		return new AesGcmSecretVault(Buffer.alloc(32, 0x41), previous);
 	}
 	return new AesGcmSecretVault(
 		developmentKey(
 			flowdularLocalDataPath(workspaceRoot, 'automations-credential.key'),
 		),
+		previous,
 	);
 }