@sanoma-ai/workflows 0.10.1 → 0.10.2

package/src/cloud-identity.ts

@@ -0,0 +1,266 @@
+import { createHash, randomBytes } from "node:crypto";
+import { Compute, OAuth2Client } from "google-auth-library";
+import type { Db } from "./db.ts";
+
+const LIFETIME = 600_000;
+const SCOPE = "https://www.googleapis.com/auth/cloud-platform";
+const CREDENTIAL = /^[A-Za-z0-9_-]{43}$/;
+const ACCOUNT = /^[a-z][a-z0-9-]+@[a-z][a-z0-9-]+\.iam\.gserviceaccount\.com$/;
+
+/** A safe error boundary: no HTTP response, credentials, SDK cause or request options. */
+export class CloudIdentityError extends Error {
+  constructor() {
+    super("Cloud identity unavailable");
+    this.name = "CloudIdentityError";
+  }
+}
+
+/** Provisioning only. Deliver the value once through deployment secrets; persist only its hash. */
+export function createDeploymentCredential(): { credential: string; hash: string } {
+  const credential = randomBytes(32).toString("base64url");
+  return { credential, hash: credentialHash(credential) };
+}
+const credentialHash = (credential: string) => createHash("sha256").update(credential).digest("hex");
+
+export interface IdentityEnrollment {
+  deployment: string;
+  company: string;
+  environment: string;
+  serviceAccount: string;
+  generation: number;
+}
+export interface IdentityEnrollments {
+  /** Return an enrollment only while this hash/generation and deployment are active. Never cache. */
+  active(hash: string): Promise<IdentityEnrollment | undefined>;
+}
+
+/** Install in the broker's own database using provisioning authority, never a company database. */
+export const CLOUD_IDENTITY_SQL = `
+CREATE SCHEMA IF NOT EXISTS sanoma_identity;
+REVOKE ALL ON SCHEMA sanoma_identity FROM PUBLIC;
+CREATE TABLE IF NOT EXISTS sanoma_identity.deployments (
+  id text PRIMARY KEY, company text NOT NULL, environment text NOT NULL,
+  service_account text NOT NULL, enabled boolean NOT NULL DEFAULT true
+);
+CREATE TABLE IF NOT EXISTS sanoma_identity.credentials (
+  hash text PRIMARY KEY CHECK (hash ~ '^[0-9a-f]{64}$'),
+  deployment text NOT NULL REFERENCES sanoma_identity.deployments(id),
+  generation bigint NOT NULL CHECK (generation > 0),
+  valid_from timestamptz NOT NULL DEFAULT now(), valid_until timestamptz NOT NULL,
+  revoked boolean NOT NULL DEFAULT false,
+  UNIQUE (deployment, generation), CHECK (valid_until > valid_from),
+  CHECK (isfinite(valid_from) AND isfinite(valid_until))
+);
+REVOKE ALL ON ALL TABLES IN SCHEMA sanoma_identity FROM PUBLIC;
+`;
+
+/** Give the broker SELECT only; enrollment, rotation and revocation use a separate database role. */
+export function postgresIdentityEnrollments(database: () => Promise<Db>): IdentityEnrollments {
+  return {
+    async active(hash) {
+      const { rows } = await (
+        await database()
+      ).query<{
+        deployment: string;
+        company: string;
+        environment: string;
+        service_account: string;
+        generation: string;
+      }>(
+        `SELECT d.id AS deployment, d.company, d.environment, d.service_account, c.generation
+          FROM sanoma_identity.credentials c JOIN sanoma_identity.deployments d ON d.id = c.deployment
+          WHERE c.hash = $1 AND NOT c.revoked AND d.enabled
+            AND c.valid_from <= clock_timestamp() AND c.valid_until > clock_timestamp()`,
+        [hash],
+      );
+      const row = rows[0];
+      return (
+        row && {
+          deployment: row.deployment,
+          company: row.company,
+          environment: row.environment,
+          serviceAccount: row.service_account,
+          generation: Number(row.generation),
+        }
+      );
+    },
+  };
+}
+
+export interface CloudAccessToken {
+  accessToken: string;
+  expiresAt: number;
+}
+export interface IdentityAudit {
+  result: "issued" | "denied" | "unavailable";
+  enrollment?: IdentityEnrollment;
+  expiresAt?: number;
+}
+export interface IdentityBrokerOptions {
+  enrollments: IdentityEnrollments;
+  /** Trusted issuer with attached platform authority; target comes exclusively from enrollment. */
+  issue(serviceAccount: string): Promise<CloudAccessToken>;
+  /** Must durably record the decision without token values. A failure prevents delivery. */
+  audit(event: IdentityAudit): Promise<void>;
+}
+const validEnrollment = (e: IdentityEnrollment | undefined): e is IdentityEnrollment =>
+  !!e &&
+  [e.deployment, e.company, e.environment].every((v) => typeof v === "string" && v.length > 0 && v.length <= 256) &&
+  ACCOUNT.test(e.serviceAccount) &&
+  Number.isSafeInteger(e.generation) &&
+  e.generation > 0;
+const validToken = (token: CloudAccessToken, now: number) =>
+  typeof token?.accessToken === "string" &&
+  token.accessToken.length > 0 &&
+  token.accessToken.length <= 8192 &&
+  !/[\s\r\n]/.test(token.accessToken) &&
+  Number.isFinite(token.expiresAt) &&
+  token.expiresAt > now &&
+  token.expiresAt <= now + LIFETIME + 30_000;
+const reply = (status: number, body: unknown) =>
+  Response.json(body, {
+    status,
+    headers: { "Cache-Control": "no-store", Pragma: "no-cache" },
+  });
+
+// Node/edge adapters can represent an empty POST as a stream. Reject actual bytes,
+// without buffering attacker-controlled input or waiting indefinitely for its end.
+async function hasBody(request: Request): Promise<boolean> {
+  if (!request.body) return false;
+  const reader = request.body.getReader();
+  let timeout: ReturnType<typeof setTimeout> | undefined;
+  try {
+    const first = await Promise.race([
+      reader.read(),
+      new Promise<never>((_, reject) => {
+        timeout = setTimeout(() => reject(new CloudIdentityError()), 5_000);
+      }),
+    ]);
+    return !first.done;
+  } finally {
+    clearTimeout(timeout);
+    void reader.cancel().catch(() => {});
+  }
+}
+
+/** POST /token with a deployment bearer credential and no query or body. No enrollment endpoint. */
+export function identityBroker(options: IdentityBrokerOptions): (request: Request) => Promise<Response> {
+  return async (request) => {
+    let enrollment: IdentityEnrollment | undefined;
+    try {
+      const url = new URL(request.url);
+      if (url.pathname !== "/token" || request.method !== "POST") return reply(404, { error: "not_found" });
+      if (url.search || (await hasBody(request))) return reply(400, { error: "invalid_request" });
+      const authorization = request.headers.get("authorization") ?? "";
+      const credential = authorization.startsWith("Bearer ") ? authorization.slice(7) : "";
+      const hash = CREDENTIAL.test(credential) ? credentialHash(credential) : undefined;
+      enrollment = hash ? await options.enrollments.active(hash) : undefined;
+      if (!validEnrollment(enrollment)) {
+        await options.audit({ result: "denied" });
+        return reply(401, { error: "unauthorized" });
+      }
+      // Copy authoritative values before any awaits; caller fields never select a target or lifetime.
+      enrollment = {
+        deployment: enrollment.deployment,
+        company: enrollment.company,
+        environment: enrollment.environment,
+        serviceAccount: enrollment.serviceAccount,
+        generation: enrollment.generation,
+      };
+      const token = await options.issue(enrollment.serviceAccount);
+      if (!validToken(token, Date.now())) throw new CloudIdentityError();
+      const current = await options.enrollments.active(hash!);
+      if (
+        !current ||
+        (Object.keys(enrollment) as (keyof IdentityEnrollment)[]).some((key) => current[key] !== enrollment![key])
+      ) {
+        await options.audit({ result: "denied", enrollment });
+        return reply(401, { error: "unauthorized" });
+      }
+      await options.audit({ result: "issued", enrollment, expiresAt: token.expiresAt });
+      return reply(200, { accessToken: token.accessToken, expiresAt: token.expiresAt });
+    } catch {
+      try {
+        await options.audit({ result: "unavailable", ...(enrollment && { enrollment }) });
+      } catch {
+        /* fail closed */
+      }
+      return reply(503, { error: "unavailable" });
+    }
+  };
+}
+
+/** Cloud Run attached identity only: no ADC environment file or service-account private key fallback. */
+export function attachedGoogleTokenIssuer(): IdentityBrokerOptions["issue"] {
+  const auth = new Compute({ scopes: [SCOPE] });
+  return async (serviceAccount) => {
+    if (!ACCOUNT.test(serviceAccount)) throw new CloudIdentityError();
+    try {
+      const response = await auth.request<{ accessToken: string; expireTime: string }>({
+        url: `https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/${serviceAccount}:generateAccessToken`,
+        method: "POST",
+        data: { scope: [SCOPE], lifetime: "600s" },
+        timeout: 10_000,
+      });
+      const token = { accessToken: response.data.accessToken, expiresAt: Date.parse(response.data.expireTime) };
+      if (!validToken(token, Date.now())) throw new CloudIdentityError();
+      return token;
+    } catch {
+      throw new CloudIdentityError();
+    }
+  };
+}
+
+/** A per-runtime Google SDK auth client. Short-lived access tokens are kept only in this instance's memory. */
+export function cloudIdentityAuth(options: {
+  endpoint: string;
+  /** Read the current deployment credential from protected bootstrap; called again on renewal. */
+  credential(): Promise<string>;
+}): OAuth2Client {
+  let endpoint: URL;
+  try {
+    endpoint = new URL(options.endpoint);
+  } catch {
+    throw new CloudIdentityError();
+  }
+  if (
+    endpoint.protocol !== "https:" ||
+    endpoint.username ||
+    endpoint.password ||
+    endpoint.search ||
+    endpoint.hash ||
+    endpoint.pathname !== "/token"
+  )
+    throw new CloudIdentityError();
+  const client = new OAuth2Client({ eagerRefreshThresholdMillis: 60_000 });
+  let pending: Promise<{ access_token: string; expiry_date: number }> | undefined;
+  client.refreshHandler = () => {
+    if (pending) return pending;
+    pending = (async () => {
+      try {
+        const credential = await options.credential();
+        if (!CREDENTIAL.test(credential)) throw new CloudIdentityError();
+        const response = await fetch(endpoint, {
+          method: "POST",
+          headers: { Authorization: `Bearer ${credential}` },
+          cache: "no-store",
+          redirect: "error",
+          signal: AbortSignal.timeout(10_000),
+        });
+        if (!response.ok) throw new CloudIdentityError();
+        const raw = await response.text();
+        if (raw.length > 16_384) throw new CloudIdentityError();
+        const token = JSON.parse(raw) as CloudAccessToken;
+        const now = Date.now();
+        if (!validToken(token, now) || token.expiresAt <= now + 60_000) throw new CloudIdentityError();
+        return { access_token: token.accessToken, expiry_date: token.expiresAt };
+      } catch {
+        throw new CloudIdentityError();
+      } finally {
+        pending = undefined;
+      }
+    })();
+    return pending;
+  };
+  return client;
+}

package/src/connection.ts

@@ -565,7 +565,10 @@ export class ConnectionRegistry {
     const method = this.catalog.methods.get(row.vendor)![row.method]!;
     const bundle = row.credential ? await this.secrets?.read(row.credential) : undefined;
     if (row.credential && !bundle) throw new SecretStoreError("unavailable");
-    const identity = await verifyAuthentication(method, bundle && decodeCredentials(method, bundle.value));
+    const identity = await verifyAuthentication(method, bundle && decodeCredentials(method, bundle.value), {
+      connectionId: row.id,
+      vendor: row.vendor,
+    });
     if (identity.account !== row.account) throw new AuthenticationError("wrong_account");
     if (JSON.stringify(identity.scopes) !== JSON.stringify([...new Set(row.scopes)].toSorted()))
       throw new AuthenticationError("scope_changed");
@@ -670,7 +673,10 @@ export class ConnectionRegistry {
       material.credentials = decodeCredentials(method, bundle.value);
       material.credentialVersion = bundle.version;
     }
-    const identity = await verifyAuthentication(method, material.credentials);
+    const identity = await verifyAuthentication(method, material.credentials, {
+      connectionId: selected.id,
+      vendor: selected.vendor,
+    });
     if (identity.account !== selected.account) throw new AuthenticationError("wrong_account");
     if (JSON.stringify(identity.scopes) !== JSON.stringify([...new Set(selected.scopes)].toSorted()))
       throw new AuthenticationError("scope_changed");

package/src/index.ts

@@ -292,6 +292,7 @@ export {
   type AuthenticationProblem,
   type Authentication,
   type AuthenticationIdentity,
+  type AuthenticationContext,
   type CallAuthentication,
 } from "./authentication.ts";
 export { checkSecretStore, type SecretStoreCheck } from "./secret-store-check.ts";

package/src/kms-secrets.ts

@@ -0,0 +1,271 @@
+import { createCipheriv, createDecipheriv, randomBytes, randomUUID } from "node:crypto";
+import type { protos } from "@google-cloud/kms";
+import crc32c from "crc-32/crc32c.js";
+import type { Db } from "./db.ts";
+import { SecretStoreError, type SecretAddress, type SecretStore, type SecretValue } from "./secret-store.ts";
+
+/** Install with a privileged connection; runtime needs only SELECT/INSERT/UPDATE/DELETE on its company database. */
+export const KMS_SECRETS_SQL = `
+CREATE SCHEMA IF NOT EXISTS sanoma_kms;
+REVOKE ALL ON SCHEMA sanoma_kms FROM PUBLIC;
+CREATE TABLE IF NOT EXISTS sanoma_kms.secrets (
+  company text NOT NULL, namespace text NOT NULL, path text NOT NULL,
+  version uuid NOT NULL, envelope jsonb NOT NULL,
+  updated_by text NOT NULL, updated_at timestamptz NOT NULL DEFAULT now(),
+  PRIMARY KEY (company, namespace, path)
+);
+REVOKE ALL ON sanoma_kms.secrets FROM PUBLIC;
+DO $revoke$
+DECLARE api_role text;
+BEGIN
+  FOREACH api_role IN ARRAY ARRAY['anon', 'authenticated', 'service_role'] LOOP
+    IF EXISTS (SELECT 1 FROM pg_catalog.pg_roles WHERE rolname = api_role) THEN
+      EXECUTE format('REVOKE ALL ON SCHEMA sanoma_kms FROM %I', api_role);
+      EXECUTE format('REVOKE ALL ON sanoma_kms.secrets FROM %I', api_role);
+    END IF;
+  END LOOP;
+END;
+$revoke$;
+`;
+
+/** Promise interface implemented by Google's KeyManagementServiceClient. */
+export interface GcpKmsClient {
+  encrypt(
+    request: protos.google.cloud.kms.v1.IEncryptRequest,
+  ): Promise<[protos.google.cloud.kms.v1.IEncryptResponse, ...unknown[]]>;
+  decrypt(
+    request: protos.google.cloud.kms.v1.IDecryptRequest,
+  ): Promise<[protos.google.cloud.kms.v1.IDecryptResponse, ...unknown[]]>;
+}
+
+export interface KmsPostgresOptions {
+  /** Fixed by trusted deployment bootstrap. IAM must independently restrict the runtime to this company’s CryptoKeys. */
+  company: string;
+  /** Full GCP CryptoKey resource name for new writes, using its primary version. */
+  keyName: string;
+  /** Retained CryptoKey names allowed for reads during key replacement/backup recovery. */
+  decryptKeyNames?: readonly string[];
+  /** Explicit client under a company-scoped IAM identity, never fleet credentials. Caller owns its lifecycle. */
+  kms: GcpKmsClient;
+  /** Company-scoped database access. Caller owns connection lifecycle; never shared admin authority. */
+  database: () => Promise<Db>;
+}
+
+interface Envelope {
+  format: "sanoma-gcp-kms-v1";
+  key: string;
+  keyVersion: string;
+  wrapped: string;
+  nonce: string;
+  ciphertext: string;
+  tag: string;
+}
+interface Row {
+  version: string;
+  envelope: Envelope;
+  updated_by: string;
+  updated_at: Date;
+}
+const FORMAT = "sanoma-gcp-kms-v1";
+const MAX_BYTES = 65_536;
+const keyName =
+  /^projects\/[a-zA-Z0-9-]+\/locations\/[a-z0-9-]+\/keyRings\/[a-zA-Z0-9_-]+\/cryptoKeys\/[a-zA-Z0-9_-]+$/;
+const nonempty = (v: string) =>
+  typeof v === "string" && v.length > 0 && Buffer.byteLength(v, "utf8") <= 1024 && !v.includes("\0");
+const failed = (error: unknown): never => {
+  if (error instanceof SecretStoreError) throw error;
+  const code = (error as { code?: string | number } | null)?.code;
+  throw new SecretStoreError(
+    code === 7 || code === 16 || code === "42501"
+      ? "denied"
+      : code === 3
+        ? "invalid_value"
+        : code === 5 || code === 9 || code === "42P01"
+          ? "invalid_configuration"
+          : "unavailable",
+  );
+};
+const safe = async <T>(run: () => Promise<T>): Promise<T> => {
+  try {
+    return await run();
+  } catch (e) {
+    return failed(e);
+  }
+};
+const bytes = (v: string, length?: number, max = MAX_BYTES): Buffer => {
+  if (
+    typeof v !== "string" ||
+    v.length > Math.ceil((length ?? max) / 3) * 4 ||
+    !/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/.test(v)
+  )
+    throw new SecretStoreError("invalid_value");
+  const b = Buffer.from(v, "base64");
+  if (length !== undefined && b.length !== length) throw new SecretStoreError("invalid_value");
+  return b;
+};
+
+const versionOf = (name: unknown, key: string): name is string =>
+  typeof name === "string" &&
+  name.startsWith(`${key}/cryptoKeyVersions/`) &&
+  /^[1-9][0-9]{0,19}$/.test(name.slice(`${key}/cryptoKeyVersions/`.length));
+const checksum = (value: Uint8Array) => crc32c.buf(value) >>> 0;
+
+/** Versioned envelope encryption; no plaintext/data-key cache, no SANOMA_SECRETS_KEY and no Secrets Manager. */
+export function kmsPostgresStore(options: KmsPostgresOptions): SecretStore {
+  const { company, keyName: writeKey, kms, database } = options;
+  const keys = new Set([writeKey, ...(options.decryptKeyNames ?? [])]);
+  if (!nonempty(company) || [...keys].some((k) => !nonempty(k) || !keyName.test(k)))
+    throw new SecretStoreError("invalid_configuration");
+  const context = (address: SecretAddress, version: string) => {
+    if (!nonempty(address.namespace) || !nonempty(address.path)) throw new SecretStoreError("invalid_configuration");
+    return { company, namespace: address.namespace, path: address.path, version, format: FORMAT };
+  };
+  const seal = async (address: SecretAddress, value: string, version: string): Promise<Envelope> => {
+    const bound = context(address, version);
+    const aad = Buffer.from(JSON.stringify(bound));
+    const dataKey = randomBytes(32);
+    try {
+      const [encrypted] = await kms.encrypt({
+        name: writeKey,
+        plaintext: dataKey,
+        plaintextCrc32c: { value: checksum(dataKey) },
+        additionalAuthenticatedData: aad,
+        additionalAuthenticatedDataCrc32c: { value: checksum(aad) },
+      });
+      const wrapped =
+        typeof encrypted.ciphertext === "string" ? bytes(encrypted.ciphertext, undefined, 6144) : encrypted.ciphertext;
+      if (
+        !versionOf(encrypted.name, writeKey) ||
+        !wrapped?.length ||
+        wrapped.length > 6144 ||
+        !encrypted.verifiedPlaintextCrc32c ||
+        !encrypted.verifiedAdditionalAuthenticatedDataCrc32c ||
+        Number(encrypted.ciphertextCrc32c?.value ?? NaN) !== checksum(wrapped)
+      )
+        throw new SecretStoreError("invalid_value");
+      const nonce = randomBytes(12);
+      const cipher = createCipheriv("aes-256-gcm", dataKey, nonce).setAAD(
+        Buffer.from(JSON.stringify({ ...bound, keyVersion: encrypted.name })),
+      );
+      const ciphertext = Buffer.concat([cipher.update(value, "utf8"), cipher.final()]);
+      return {
+        format: FORMAT,
+        key: writeKey,
+        keyVersion: encrypted.name,
+        wrapped: Buffer.from(wrapped).toString("base64"),
+        nonce: nonce.toString("base64"),
+        ciphertext: ciphertext.toString("base64"),
+        tag: cipher.getAuthTag().toString("base64"),
+      };
+    } finally {
+      dataKey.fill(0);
+    }
+  };
+  const open = async (address: SecretAddress, row: Row): Promise<SecretValue> => {
+    const e = row.envelope;
+    if (!e || e.format !== FORMAT || !keys.has(e.key) || !versionOf(e.keyVersion, e.key))
+      throw new SecretStoreError("invalid_value");
+    const nonce = bytes(e.nonce, 12),
+      tag = bytes(e.tag, 16),
+      ciphertext = bytes(e.ciphertext),
+      wrapped = bytes(e.wrapped, undefined, 6144);
+    if (ciphertext.length > MAX_BYTES || !wrapped.length || wrapped.length > 6144)
+      throw new SecretStoreError("invalid_value");
+    const bound = context(address, row.version);
+    const aad = Buffer.from(JSON.stringify(bound));
+    const [decrypted] = await kms.decrypt({
+      name: e.key,
+      ciphertext: wrapped,
+      ciphertextCrc32c: { value: checksum(wrapped) },
+      additionalAuthenticatedData: aad,
+      additionalAuthenticatedDataCrc32c: { value: checksum(aad) },
+    });
+    const dataKey = typeof decrypted.plaintext === "string" ? bytes(decrypted.plaintext, 32) : decrypted.plaintext;
+    try {
+      if (dataKey?.length !== 32 || Number(decrypted.plaintextCrc32c?.value ?? NaN) !== checksum(dataKey))
+        throw new SecretStoreError("invalid_value");
+      const decipher = createDecipheriv("aes-256-gcm", dataKey, nonce)
+        .setAAD(Buffer.from(JSON.stringify({ ...bound, keyVersion: e.keyVersion })))
+        .setAuthTag(tag);
+      let plaintext: Buffer;
+      try {
+        plaintext = Buffer.concat([decipher.update(ciphertext), decipher.final()]);
+      } catch {
+        throw new SecretStoreError("invalid_value");
+      }
+      try {
+        return {
+          value: plaintext.toString("utf8"),
+          version: row.version,
+          updatedBy: row.updated_by,
+          updatedAt: row.updated_at.toISOString(),
+        };
+      } finally {
+        plaintext.fill(0);
+      }
+    } finally {
+      dataKey?.fill(0);
+    }
+  };
+  return {
+    id: "kms-postgres",
+    capabilities: Object.freeze({
+      writable: true,
+      maxBytes: MAX_BYTES,
+      conditionalWrites: "atomic",
+      deletion: "destroy",
+      changeDetection: "read",
+    }),
+    validate: (namespace) =>
+      safe(async () => {
+        const address = { namespace, path: "__validation__" },
+          version = randomUUID();
+        const envelope = await seal(address, "validation", version);
+        await open(address, { envelope, version, updated_by: "validation", updated_at: new Date() });
+        await (await database()).query("SELECT version FROM sanoma_kms.secrets WHERE company=$1 LIMIT 0", [company]);
+        // Own-key usability only. Cross-company authorization requires live IAM proof with another existing key.
+      }),
+    read: (address) =>
+      safe(async () => {
+        context(address, "read");
+        const { rows } = await (
+          await database()
+        ).query<Row>(
+          "SELECT version,envelope,updated_by,updated_at FROM sanoma_kms.secrets WHERE company=$1 AND namespace=$2 AND path=$3",
+          [company, address.namespace, address.path],
+        );
+        return rows[0] && open(address, rows[0]);
+      }),
+    write: (address, value, { expectedVersion, by }) =>
+      safe(async () => {
+        if (Buffer.byteLength(value, "utf8") > MAX_BYTES) throw new SecretStoreError("too_large");
+        if (!nonempty(by)) throw new SecretStoreError("invalid_value");
+        const version = randomUUID(),
+          envelope = await seal(address, value, version);
+        const args = [company, address.namespace, address.path, version, JSON.stringify(envelope), by];
+        const sql =
+          expectedVersion === null
+            ? "INSERT INTO sanoma_kms.secrets(company,namespace,path,version,envelope,updated_by) VALUES($1,$2,$3,$4,$5,$6) ON CONFLICT(company,namespace,path) DO NOTHING RETURNING version,envelope,updated_by,updated_at"
+            : "UPDATE sanoma_kms.secrets SET version=$4,envelope=$5,updated_by=$6,updated_at=now() WHERE company=$1 AND namespace=$2 AND path=$3 AND version::text=$7 RETURNING version,envelope,updated_by,updated_at";
+        const { rows } = await (
+          await database()
+        ).query<Row>(sql, expectedVersion === null ? args : [...args, expectedVersion]);
+        if (!rows[0]) throw new SecretStoreError("conflict");
+        // Return the caller's value, never make a second decrypt after a successful commit.
+        return { value, version, updatedBy: by, updatedAt: rows[0].updated_at.toISOString() };
+      }),
+    delete: (address, { expectedVersion }) =>
+      safe(async () => {
+        context(address, expectedVersion);
+        const { rowCount } = await (
+          await database()
+        ).query("DELETE FROM sanoma_kms.secrets WHERE company=$1 AND namespace=$2 AND path=$3 AND version::text=$4", [
+          company,
+          address.namespace,
+          address.path,
+          expectedVersion,
+        ]);
+        if (!rowCount) throw new SecretStoreError("conflict");
+      }),
+  };
+}