@k2b/cloud 0.46.0 → 0.48.0

package/src/services/identity/workload-runtime.ts

@@ -0,0 +1,253 @@
+/** Core-only workload issuer. This module never reads identity signing keys, OAuth secrets, or sessions. */
+import type { NatsConnection } from "@nats-io/transport-node";
+import { sql } from "bun";
+import { getProcessNats } from "../../_internal/process-sync";
+import { APP_REGISTRY_TTL_MS, appInstancePrefix, appInstanceRegistry } from "../../_internal/registry";
+import {
+  WORKLOAD_CHECK_INTERVAL_MS,
+  WORKLOAD_LIFETIME_MS,
+  WORKLOAD_ROTATE_BEFORE_MS,
+  type WorkloadRequest,
+  WorkloadRequestSchema,
+  type WorkloadResponse,
+  workloadSubject,
+} from "../../_internal/workload-protocol";
+import { connections } from "../../runtime/connections";
+import { audit } from "../audit";
+import { logger } from "../logging";
+import { serviceAccountCredentials } from "../service-account-credentials";
+import { serviceAccounts } from "../service-accounts";
+
+const isRegistered = async (appId: string, instanceId: string): Promise<boolean> => {
+  const key = `${appInstancePrefix(appId)}${instanceId}`;
+  const snapshot = await appInstanceRegistry().snapshot({ prefix: key });
+  return snapshot.entries.some((entry) => entry.key === key && entry.value.appId === appId && entry.value.instanceId === instanceId);
+};
+
+export const issueAppWorkloadCredential = async (
+  request: WorkloadRequest,
+  registered: (appId: string, instanceId: string) => Promise<boolean> = isRegistered,
+): Promise<WorkloadResponse> => {
+  if (!(await registered(request.appId, request.instanceId))) return { status: "unregistered" };
+  const account = await serviceAccounts.getOrCreateResourceBound({
+    name: `${request.appId} workload`,
+    appId: request.appId,
+    resourceType: "cloud.app",
+    resourceId: request.appId,
+  });
+  if (!account.ok) return { status: "unavailable" };
+  return sql.begin(async (db) => {
+    // One account lock serializes issuance/rotation/removal across Core replicas. Admin revocation
+    // locks the credential row too, so it cannot be overwritten by an in-flight refresh.
+    const [owner] = await db<{ status: string }[]>`SELECT status FROM auth.service_accounts WHERE id = ${account.data.id}::uuid FOR UPDATE`;
+    if (owner?.status !== "active") return { status: "revoked" };
+    const [current] = await db<{ id: string; status: string; expires_at: Date; previous_credential_id: string | null }[]>`
+      SELECT c.id, c.status, c.expires_at, i.previous_credential_id FROM auth.app_workload_instances i
+      JOIN auth.service_account_credentials c ON c.id = i.credential_id
+      WHERE i.app_id = ${request.appId} AND i.instance_id = ${request.instanceId}
+      FOR UPDATE OF c
+    `;
+    if (request.operation === "release") {
+      if (current?.status === "active") {
+        for (const credentialId of [current.id, current.previous_credential_id]) {
+          if (!credentialId) continue;
+          const revoked = await serviceAccountCredentials.revoke(
+            { credentialId, system: { service: "app-workload", reason: "instance stopped" } },
+            { db },
+          );
+          if (!revoked.ok) throw new Error("Stopped workload credential could not be revoked");
+        }
+        await db`DELETE FROM auth.app_workload_instances WHERE app_id = ${request.appId} AND instance_id = ${request.instanceId}`;
+        await db`DELETE FROM auth.service_account_credentials WHERE id = ${current.id}::uuid OR id = ${current.previous_credential_id}::uuid`;
+      }
+      return { status: "revoked" };
+    }
+    if (!(await registered(request.appId, request.instanceId))) return { status: "unregistered" };
+    await db`UPDATE auth.app_workload_instances SET last_refreshed_at = now()
+      WHERE app_id = ${request.appId} AND instance_id = ${request.instanceId}`;
+    if (
+      current?.status === "active" &&
+      current.id === request.credentialId &&
+      current.expires_at.getTime() - Date.now() > WORKLOAD_ROTATE_BEFORE_MS
+    ) {
+      return { status: "current", credentialId: current.id };
+    }
+    const expiresAt = new Date(Date.now() + WORKLOAD_LIFETIME_MS).toISOString();
+    const issued = await serviceAccountCredentials.createApiToken(
+      {
+        serviceAccountId: account.data.id,
+        name: `Runtime ${request.instanceId}`,
+        scopes: ["identity:invoke"],
+        expiresAt,
+      },
+      { db },
+    );
+    if (!issued.ok) return { status: "unavailable" };
+    // An acknowledged current token overlaps its successor until expiry. When a reply was
+    // lost, replace only the undelivered generation and keep the token the caller still knows.
+    const retainedId = current
+      ? request.credentialId === current.id
+        ? current.id
+        : current.previous_credential_id === request.credentialId
+          ? current.previous_credential_id
+          : null
+      : null;
+    for (const retiredId of [current?.id, current?.previous_credential_id]) {
+      if (!retiredId || retiredId === retainedId) continue;
+      const revoked = await serviceAccountCredentials.revoke(
+        { credentialId: retiredId, system: { service: "app-workload", reason: "rotation" } },
+        { db },
+      );
+      if (!revoked.ok) throw new Error("Workload rotation could not retire previous credential");
+    }
+    await db`
+      INSERT INTO auth.app_workload_instances (app_id, instance_id, credential_id, previous_credential_id)
+      VALUES (${request.appId}, ${request.instanceId}, ${issued.data.credential.id}::uuid, ${retainedId}::uuid)
+      ON CONFLICT (app_id, instance_id) DO UPDATE
+      SET credential_id = EXCLUDED.credential_id, previous_credential_id = EXCLUDED.previous_credential_id, last_refreshed_at = now()
+    `;
+    for (const retiredId of [current?.id, current?.previous_credential_id]) {
+      if (retiredId && retiredId !== retainedId) await db`DELETE FROM auth.service_account_credentials WHERE id = ${retiredId}::uuid`;
+    }
+    await audit.record(
+      {
+        action: "service_account_credential.create",
+        outcome: "allowed",
+        target: { type: "service_account_credential", id: issued.data.credential.id, label: issued.data.credential.name },
+        metadata: {
+          provenance: "system",
+          service: "app-workload",
+          appId: request.appId,
+          instanceId: request.instanceId,
+          serviceAccountId: account.data.id,
+        },
+      },
+      db,
+    );
+    // Deliberately construct the response: only a newly minted app-bound token and its coordinates.
+    return {
+      status: "issued",
+      appId: request.appId,
+      instanceId: request.instanceId,
+      credentialId: issued.data.credential.id,
+      token: issued.data.token,
+      expiresAt,
+    };
+  });
+};
+
+/** Revoke disappeared instances, including TTL expiry after an ungraceful stop. Pages bound memory. */
+export const revokeRemovedAppWorkloads = async (
+  registered: (appId: string, instanceId: string) => Promise<boolean> = isRegistered,
+): Promise<void> => {
+  let afterApp = "";
+  let afterInstance = "";
+  for (;;) {
+    // Same page size as the credential administration API; never materialize credential history.
+    const rows = await sql<{ app_id: string; instance_id: string; credential_id: string; service_account_id: string }[]>`
+      SELECT i.app_id, i.instance_id, i.credential_id, c.service_account_id
+      FROM auth.app_workload_instances i JOIN auth.service_account_credentials c ON c.id = i.credential_id
+      WHERE c.status = 'active' AND i.last_refreshed_at < ${new Date(Date.now() - APP_REGISTRY_TTL_MS)} AND (i.app_id, i.instance_id) > (${afterApp}, ${afterInstance})
+      ORDER BY i.app_id, i.instance_id LIMIT 100
+    `;
+    if (!rows.length) return;
+    for (const row of rows) {
+      afterApp = row.app_id;
+      afterInstance = row.instance_id;
+      if (await registered(row.app_id, row.instance_id)) continue;
+      await sql.begin(async (db) => {
+        await db`SELECT id FROM auth.service_accounts WHERE id = ${row.service_account_id}::uuid FOR UPDATE`;
+        if (await registered(row.app_id, row.instance_id)) return;
+        // Read again under the account lock, in case another Core replica rotated it meanwhile.
+        const [current] = await db<
+          { credential_id: string; previous_credential_id: string | null; status: string; last_refreshed_at: Date }[]
+        >`
+          SELECT i.credential_id, i.previous_credential_id, c.status, i.last_refreshed_at FROM auth.app_workload_instances i
+          JOIN auth.service_account_credentials c ON c.id = i.credential_id
+          WHERE i.app_id = ${row.app_id} AND i.instance_id = ${row.instance_id}
+          FOR UPDATE OF c
+        `;
+        if (current?.status === "active" && current.last_refreshed_at.getTime() < Date.now() - APP_REGISTRY_TTL_MS) {
+          for (const credentialId of [current.credential_id, current.previous_credential_id]) {
+            if (!credentialId) continue;
+            const revoked = await serviceAccountCredentials.revoke(
+              { credentialId, system: { service: "app-workload", reason: "instance removed" } },
+              { db },
+            );
+            if (!revoked.ok) throw new Error("Removed workload credential could not be revoked");
+          }
+          // An automatically retired instance may register again after a registry reset. An
+          // admin-revoked credential keeps its mapping and disabled account until explicit recovery.
+          await db`DELETE FROM auth.app_workload_instances WHERE app_id = ${row.app_id} AND instance_id = ${row.instance_id}`;
+          await db`DELETE FROM auth.service_account_credentials WHERE id = ${current.credential_id}::uuid OR id = ${current.previous_credential_id}::uuid`;
+        }
+      });
+    }
+  }
+};
+
+export const startAppWorkloadBroker = async (
+  options: {
+    connection?: NatsConnection;
+    namespace?: string;
+    issue?: (request: WorkloadRequest) => Promise<WorkloadResponse>;
+    reconcile?: () => Promise<void>;
+  } = {},
+): Promise<() => Promise<void>> => {
+  const connection = options.connection ?? getProcessNats();
+  const issue = options.issue ?? issueAppWorkloadCredential;
+  const reconcile = options.reconcile ?? revokeRemovedAppWorkloads;
+  const log = logger("app-workload");
+  // Issuance gets four concurrent DB transactions per Core replica, reserving the rest of
+  // Bun SQL's default ten-connection pool for identity requests. Overload retries at the caller.
+  const inFlight = new Set<Promise<void>>();
+  let stopped = false;
+  let maintenance: Promise<void> | undefined;
+  let timer: Timer | undefined;
+  const subscription = connection.subscribe(workloadSubject(options.namespace ?? connections().nats.namespace), {
+    queue: "core-workload-v1",
+    callback: (error, message) => {
+      if (error || !message.reply) return;
+      // App id, instance id and UUID fit in 1 KiB including JSON escaping. Reject larger input before parsing.
+      if (stopped || inFlight.size >= 4 || message.data.length > 1024) {
+        message.respond(JSON.stringify({ status: "unavailable" }));
+        return;
+      }
+      const operation = (async () => {
+        let response: WorkloadResponse = { status: "unavailable" };
+        try {
+          const parsed = WorkloadRequestSchema.safeParse(message.json<unknown>());
+          if (parsed.success) response = await issue(parsed.data);
+        } catch {
+          log.error("Workload credential issuance failed; caller will retry");
+        }
+        if (!stopped) message.respond(JSON.stringify(response));
+      })();
+      inFlight.add(operation);
+      void operation.finally(() => inFlight.delete(operation));
+    },
+  });
+  const maintain = () => {
+    maintenance = reconcile()
+      .catch(() => {
+        log.error("Workload removal reconciliation failed; retrying");
+      })
+      .finally(() => {
+        if (!stopped) timer = setTimeout(maintain, WORKLOAD_CHECK_INTERVAL_MS);
+      });
+  };
+  const stop = async () => {
+    stopped = true;
+    clearTimeout(timer);
+    subscription.unsubscribe();
+    await Promise.allSettled([...inFlight, ...(maintenance ? [maintenance] : [])]);
+  };
+  maintain();
+  try {
+    await connection.flush();
+  } catch (error) {
+    await stop();
+    throw error;
+  }
+  return stop;
+};

package/src/services/index.ts

@@ -8,6 +8,7 @@ export type { PosixCandidate } from "./accounts/posix";
 export { accountIdentities, AccountIdentityError } from "./accounts/identities";
 export type { AccountIdentityUser, AccountIdentityGroup, AccountIdentityPage, AccountIdentityAvailability } from "./accounts/identities";
 export type { AccountIdentityReconciliation } from "./accounts/identity-reconciliation";
+export { getAppWorkloadCredential } from "../_internal/workload-credential";
 export { providers } from "./providers";
 export { createAllowedNetworkFetch } from "./allowed-network-fetch";
 export { requestPublicHttps, type PublicHttpInput } from "./public-http";
@@ -252,6 +253,7 @@ export type { NetworkLookup, PublicNetworkAddress } from "./network-security";
 
 export { geoip } from "./geoip";
 export { appDetails } from "./app-details";
+export { appAdminFacts, type AppAdminFacts } from "./app-admin-facts";
 export {
   knownBrowsers,
   KNOWN_BROWSER_LIMITS,
@@ -281,7 +283,9 @@ export {
   type AppAccessSnapshot,
 } from "./app-access-management";
 
-export { storage } from "./object-store";
+import { storage as platformStorage } from "./object-store";
+/** @deprecated Import storage from @k2b/cloud. */
+export const storage = platformStorage;
 export type {
   ObjectStoreFile,
   ObjectVisibility,
@@ -291,3 +295,6 @@ export type {
   ObjectListOptions,
   ObjectListResult,
 } from "./object-store";
+
+export { links } from "./links";
+export type { CreateLinkInput, CreatedLink, RedeemedLink, LinkOptions, PeekedLink, PeekLinkResult, RedeemLinkResult } from "./links";

package/src/services/links/index.ts

@@ -0,0 +1,16 @@
+import { getProcessApplicationPackage } from "../../_internal/process-identity";
+import { sql } from "../../runtime/clients";
+import { type CreateLinkInput, createLinksStore, type LinkOptions } from "./store";
+
+const store = () => {
+  const packageName = getProcessApplicationPackage();
+  if (!packageName) throw new Error("Start the application before using one-time links");
+  return createLinksStore(sql, packageName);
+};
+
+export const links = {
+  create: (input: CreateLinkInput, options?: LinkOptions) => store().create(input, options),
+  peek: (token: string, input: { purpose: string }, options?: LinkOptions) => store().peek(token, input, options),
+  redeem: (token: string, input: { purpose: string }, options?: LinkOptions) => store().redeem(token, input, options),
+};
+export type { CreatedLink, CreateLinkInput, LinkOptions, PeekedLink, PeekLinkResult, RedeemedLink, RedeemLinkResult } from "./store";

package/src/services/links/runtime.ts

@@ -0,0 +1,44 @@
+import { lazySync } from "../../_internal/process-sync";
+import { sql } from "../../runtime/clients";
+import { logger } from "../logging";
+import { cleanupLinksBatch, LINK_CLEANUP_BATCH, setupLinks } from "./store";
+
+// All apps compete for one platform schedule, including replicas and apps sharing a package.
+const scheduler = lazySync((sync) =>
+  sync.scheduler({
+    id: "cloud-links-retention",
+    owner: "platform",
+    delivery: { maxAttempts: 2, backoffMs: [30_000], ackWaitMs: 60_000 },
+  }),
+);
+
+/** Provision before app setup and readiness, then drain this worker before NATS during shutdown. */
+export const startLinksRuntime = async (): Promise<() => Promise<void>> => {
+  await setupLinks(sql);
+  const stopping = new AbortController();
+  await scheduler().create({
+    id: "retention",
+    cron: "0 * * * *",
+    timezone: "UTC",
+    misfire: "latest",
+    meta: { family: "links", label: "One-time link cleanup" },
+    process: async ({ signal, heartbeat }) => {
+      const runSignal = AbortSignal.any([signal, stopping.signal]);
+      const deadline = performance.now() + 5 * 60_000;
+      let deleted = 0;
+      while (!runSignal.aborted && performance.now() < deadline) {
+        const count = await cleanupLinksBatch(sql);
+        deleted += count;
+        if (count < LINK_CLEANUP_BATCH) break;
+        await heartbeat();
+      }
+      if (deleted > 0) logger("links:cleanup").info("Removed old one-time links", { deleted });
+    },
+  });
+  const worker = await scheduler().process({ concurrency: 1 });
+  return async () => {
+    stopping.abort();
+    worker.stop();
+    await worker.drain({ timeoutMs: 30_000 });
+  };
+};

package/src/services/links/store.ts

@@ -0,0 +1,105 @@
+import { createHash, randomBytes } from "node:crypto";
+import type { SQL, TransactionSQL } from "bun";
+import { isPurposeName, validatePurposeName } from "../../_internal/purpose-name";
+import { ensureSchema } from "../postgres";
+
+export type CreateLinkInput = { purpose: string; subject: string; ttl: number };
+export type CreatedLink = { token: string; expiresAt: Date };
+export type RedeemedLink = { subject: string; createdAt: Date };
+export type PeekedLink = RedeemedLink & { expiresAt: Date };
+export type LinkOptions = { tx?: TransactionSQL };
+type LinkResult<T> = { ok: true; data: T } | { ok: false; error: { code: "LINK_INVALID" } };
+export type RedeemLinkResult = LinkResult<RedeemedLink>;
+export type PeekLinkResult = LinkResult<PeekedLink>;
+
+const TOKEN = /^cl_[A-Za-z0-9_-]{42}[AEIMQUYcgkosw048]$/;
+// Match the existing outgoing-mail retention batch budget.
+export const LINK_CLEANUP_BATCH = 1000;
+const hashToken = (token: string): string => createHash("sha256").update(token).digest("hex");
+
+const linkCandidate = (token: string, purpose: string) => {
+  const value = typeof token === "string" ? token : "";
+  const digest = hashToken(value);
+  const validPurpose = isPurposeName(purpose);
+  return { digest, purpose: validPurpose ? purpose : "", valid: TOKEN.test(value) && validPurpose };
+};
+
+export const validateCreateLink = (input: CreateLinkInput): void => {
+  validatePurposeName(input.purpose);
+  if (typeof input.subject !== "string" || Buffer.byteLength(input.subject, "utf8") > 1024) {
+    throw new TypeError("Link subject must be a string of at most 1024 UTF-8 bytes");
+  }
+  if (!Number.isFinite(input.ttl) || input.ttl < 60 || input.ttl > 30 * 24 * 60 * 60) {
+    throw new RangeError("Link ttl must be seconds from 60 to 2592000 (30 days)");
+  }
+};
+
+/** One reserved platform table in the same database as the application's domain transactions. */
+export const setupLinks = async (db: SQL): Promise<void> => {
+  await db.begin(async (tx) => {
+    await tx`SELECT pg_advisory_xact_lock(hashtext('cloud.links'))`;
+    await ensureSchema(tx, "platform");
+    const [existing] = await tx<{ table_exists: boolean; index_exists: boolean }[]>`
+      SELECT to_regclass('platform._cloud_links') IS NOT NULL AS table_exists,
+        to_regclass('platform._cloud_links_retention') IS NOT NULL AS index_exists`;
+    if (!existing?.table_exists)
+      await tx`CREATE TABLE IF NOT EXISTS platform._cloud_links (
+      package text NOT NULL, token_hash text NOT NULL, purpose text NOT NULL, subject bytea NOT NULL,
+      created_at timestamptz NOT NULL, expires_at timestamptz NOT NULL, used_at timestamptz,
+      PRIMARY KEY (package, token_hash)
+    )`.simple();
+    // Even IF NOT EXISTS takes a ShareLock; skip index DDL on ordinary app restarts.
+    if (!existing?.index_exists)
+      await tx`CREATE INDEX IF NOT EXISTS _cloud_links_retention ON platform._cloud_links (LEAST(expires_at, used_at))`.simple();
+  });
+};
+
+export const createLinksStore = (db: SQL, packageName: string) => ({
+  create: async (input: CreateLinkInput, options: LinkOptions = {}): Promise<CreatedLink> => {
+    validateCreateLink(input);
+    const token = `cl_${randomBytes(32).toString("base64url")}`;
+    const [row] = await (options.tx ?? db)<{ expires_at: Date }[]>`
+      INSERT INTO platform._cloud_links (package, token_hash, purpose, subject, created_at, expires_at)
+      VALUES (${packageName}, ${hashToken(token)}, ${input.purpose}, ${Buffer.from(input.subject, "utf8")},
+        statement_timestamp(), statement_timestamp() + ${input.ttl} * interval '1 second')
+      RETURNING expires_at`;
+    if (!row) throw new Error("One-time link insert returned no expiry");
+    return { token, expiresAt: row.expires_at };
+  },
+  peek: async (token: string, input: { purpose: string }, options: LinkOptions = {}): Promise<PeekLinkResult> => {
+    const candidate = linkCandidate(token, input.purpose);
+    const [row] = await (options.tx ?? db)<{ subject: Uint8Array; created_at: Date; expires_at: Date }[]>`
+      SELECT subject, created_at, expires_at FROM platform._cloud_links
+      WHERE package = ${packageName} AND token_hash = ${candidate.digest} AND purpose = ${candidate.purpose}
+        AND ${candidate.valid}::boolean AND used_at IS NULL AND expires_at > clock_timestamp()`;
+    return row
+      ? { ok: true, data: { subject: Buffer.from(row.subject).toString("utf8"), createdAt: row.created_at, expiresAt: row.expires_at } }
+      : { ok: false, error: { code: "LINK_INVALID" } };
+  },
+  redeem: async (token: string, input: { purpose: string }, options: LinkOptions = {}): Promise<RedeemLinkResult> => {
+    // Every candidate is hashed and reaches one indexed UPDATE, including malformed credentials.
+    const candidate = linkCandidate(token, input.purpose);
+    const [row] = await (options.tx ?? db)<{ subject: Uint8Array; created_at: Date }[]>`
+      UPDATE platform._cloud_links SET used_at = clock_timestamp()
+      WHERE package = ${packageName} AND token_hash = ${candidate.digest} AND purpose = ${candidate.purpose}
+        AND ${candidate.valid}::boolean AND used_at IS NULL AND expires_at > clock_timestamp()
+      RETURNING subject, created_at`;
+    return row
+      ? { ok: true, data: { subject: Buffer.from(row.subject).toString("utf8"), createdAt: row.created_at } }
+      : { ok: false, error: { code: "LINK_INVALID" } };
+  },
+});
+
+/** Platform maintenance spans packages; the application facade never exposes this operation. */
+export const cleanupLinksBatch = async (db: SQL): Promise<number> =>
+  db.begin(async (tx) => {
+    await tx`SET LOCAL statement_timeout = '10s'`;
+    const rows = await tx<{ token_hash: string }[]>`
+      WITH expired AS (
+        SELECT package, token_hash FROM platform._cloud_links
+        WHERE LEAST(expires_at, used_at) < statement_timestamp() - interval '24 hours'
+        ORDER BY LEAST(expires_at, used_at) LIMIT ${LINK_CLEANUP_BATCH} FOR UPDATE SKIP LOCKED
+      ) DELETE FROM platform._cloud_links link USING expired
+        WHERE link.package = expired.package AND link.token_hash = expired.token_hash RETURNING link.token_hash`;
+    return rows.length;
+  });

package/src/services/logging/index.ts

@@ -2,7 +2,7 @@ import { sql } from "bun";
 import type { PaginationParams } from "../../contracts/shared";
 import { escapeLikePattern, parsePgJsonRecord, toPgTextArray } from "../postgres";
 import { registerSettings } from "../settings/defaults";
-import { redactMetadata } from "./redaction";
+import { redactLinkTokens, redactMetadata } from "./redaction";
 import { observeSyncEvent, TRACE_STUCK_AFTER_MS, trace } from "./trace";
 import { readWebVitals } from "./web-vitals";
 
@@ -120,16 +120,18 @@ const mapRow = (row: DbLogRow): LogEntry => ({
 /** Fire-and-forget write — mirrors to console, then inserts to DB async. */
 function write(params: WriteParams): void {
   const safeMetadata = params.metadata ? (redactMetadata(params.metadata) as Record<string, unknown>) : undefined;
-  const prefix = `[${params.source}]`;
+  const source = redactLinkTokens(params.source);
+  const message = redactLinkTokens(params.message);
+  const prefix = `[${source}]`;
   const consoleFn = params.level === "error" ? console.error : params.level === "warn" ? console.warn : console.log;
-  consoleFn(prefix, params.message, ...(safeMetadata ? [safeMetadata] : []));
+  consoleFn(prefix, message, ...(safeMetadata ? [safeMetadata] : []));
 
   sql`
     INSERT INTO logging.entries (level, source, message, metadata)
     VALUES (
       ${params.level},
-      ${params.source},
-      ${params.message},
+      ${source},
+      ${message},
       (${safeMetadata ? JSON.stringify(safeMetadata) : null}::text)::jsonb
     )
   `.catch((err: Error) => console.error("[logging] DB write failed:", err.message));

package/src/services/logging/redaction.ts

@@ -7,14 +7,18 @@ const SENSITIVE_KEY_PATTERN = /(password|secret|token|cookie|authorization|api[_
 
 export const REDACTED = "[REDACTED]";
 
+/** Recognizable one-time credentials are scrubbed even under ordinary metadata keys. */
+export const redactLinkTokens = (value: string): string => value.replace(/cl_[A-Za-z0-9_-]{43}/g, REDACTED);
+
 export const isSensitiveMetadataKey = (key: string): boolean => SENSITIVE_KEY_PATTERN.test(key);
 
 export const redactMetadata = (input: unknown): unknown => {
+  if (typeof input === "string") return redactLinkTokens(input);
   if (input === null || typeof input !== "object") return input;
   if (Array.isArray(input)) return input.map(redactMetadata);
   const out: Record<string, unknown> = {};
   for (const [key, value] of Object.entries(input)) {
-    out[key] = isSensitiveMetadataKey(key) ? REDACTED : redactMetadata(value);
+    out[redactLinkTokens(key)] = isSensitiveMetadataKey(key) ? REDACTED : redactMetadata(value);
   }
   return out;
 };
@@ -60,6 +64,7 @@ export const redactSensitivePath = (pathname: string): string => {
     .split("/")
     .map((segment) => {
       const value = decodeSegment(segment);
+      if (redactLinkTokens(value) !== value) return ":token";
       if (UUID.test(value)) return ":id";
       // Dot-separated parts cover signed tokens and credential filenames such as .ics.
       // Lowercase word slugs preserve readable routes like getting-started-with-grids.

package/src/services/logging/trace.ts

@@ -4,7 +4,7 @@ import { sql } from "bun";
 import { getProcessApplicationId } from "../../_internal/process-identity";
 import type { PaginationParams } from "../../contracts/shared";
 import { escapeLikePattern, parsePgJsonRecord, toPgTextArray } from "../postgres";
-import { isSensitiveMetadataKey, REDACTED, redactMetadata } from "./redaction";
+import { isSensitiveMetadataKey, REDACTED, redactLinkTokens, redactMetadata } from "./redaction";
 
 export type TraceAttributeValue = string | number | boolean | null | undefined;
 export type TraceAttributes = Record<string, TraceAttributeValue>;
@@ -499,10 +499,10 @@ const start = async (params: TraceStartParams, preservePresentation = false): Pr
     VALUES (
       ${context.traceId},
       ${context.spanId},
-      ${params.spanKey ?? null},
+      ${params.spanKey ? redactLinkTokens(params.spanKey) : null},
       ${params.parent?.spanId ?? null},
-      ${params.name},
-      ${params.source},
+      ${redactLinkTokens(params.name)},
+      ${redactLinkTokens(params.source)},
       ${params.appId ?? null},
       ${params.category ?? "custom"},
       ${params.kind ?? "internal"},
@@ -567,10 +567,10 @@ const complete = async (params: TraceCompleteParams, preservePresentation = fals
     VALUES (
       ${context.traceId},
       ${context.spanId},
-      ${params.spanKey ?? null},
+      ${params.spanKey ? redactLinkTokens(params.spanKey) : null},
       ${params.parent?.spanId ?? null},
-      ${params.name},
-      ${params.source},
+      ${redactLinkTokens(params.name)},
+      ${redactLinkTokens(params.source)},
       ${params.appId ?? null},
       ${params.category ?? "custom"},
       ${params.kind ?? "internal"},
@@ -636,7 +636,7 @@ const record = async (params: TraceRecordParams, preservePresentation = false):
     VALUES (
       ${context.traceId},
       ${context.spanId},
-      ${params.event},
+      ${redactLinkTokens(params.event)},
       ${params.severity ?? "info"},
       (${attributesJson}::text)::jsonb,
       ${body},

package/src/services/outgoing-mail/resolve-host.ts

@@ -1,8 +1,9 @@
-import { env } from "../../config/env";
 import { networkAddressFamily, normalizeNetworkHostname, parseNetworkAllowlistEnv } from "../../shared/network-address";
 import { NetworkTargetBlockedError, resolveAllowedNetworkAddresses } from "../network-security";
+import { coreSettings } from "../settings/api";
 
-export const outgoingMailAllowlist = () => parseNetworkAllowlistEnv("OUTGOING_MAIL_ALLOWED_TARGETS", env.OUTGOING_MAIL_ALLOWED_TARGETS);
+export const outgoingMailAllowlist = async () =>
+  parseNetworkAllowlistEnv("outgoing_mail.allowed_targets", await coreSettings.get<string[]>("outgoing_mail.allowed_targets"));
 
 /** One bounded lookup shared by SMTP and bounce IMAP; clients use only the checked addresses. */
 export const resolveMailHost = async (host: string, signal?: AbortSignal, resolve = resolveAllowedNetworkAddresses, port?: number) => {
@@ -14,7 +15,7 @@ export const resolveMailHost = async (host: string, signal?: AbortSignal, resolv
   try {
     cancellation.throwIfAborted();
     const addresses = await Promise.race([
-      resolve(hostname, outgoingMailAllowlist(), undefined, port),
+      outgoingMailAllowlist().then((allowlist) => resolve(hostname, allowlist, undefined, port)),
       new Promise<never>((_, reject) => {
         abort = () => reject(cancellation.reason);
         cancellation.addEventListener("abort", abort, { once: true });
@@ -29,7 +30,7 @@ export const resolveMailHost = async (host: string, signal?: AbortSignal, resolv
   } catch (error) {
     if (error instanceof NetworkTargetBlockedError)
       throw new NetworkTargetBlockedError(
-        "Outgoing mail target is on an internal network. An operator can allow it with OUTGOING_MAIL_ALLOWED_TARGETS.",
+        "Outgoing mail target is on an internal network. An operator can allow it with outgoing_mail.allowed_targets.",
       );
     throw error;
   } finally {

package/src/services/request-cache-redis.ts

@@ -1,5 +1,5 @@
 import { RedisClient } from "bun";
-import { env } from "../config/env";
+import { connections } from "../runtime/connections";
 
 // Cache commands must not queue across a disconnect: delayed fills/invalidations
 // are not useful, and reads must be able to fall back to Postgres. Keep this
@@ -10,7 +10,7 @@ let reconnecting: Promise<void> | undefined;
 
 export const requestCacheRedis = async (): Promise<RedisClient> => {
   if (!client) {
-    client = new RedisClient(env.REDIS_URL, { enableOfflineQueue: false });
+    client = new RedisClient(connections().valkey.url, { enableOfflineQueue: false });
     // The first operation waits for normal connection establishment (Bun's
     // connection timeout applies). Later disconnected operations fail promptly.
     initialConnection = client.connect().catch(() => {});