@k2b/cloud 0.47.0 → 0.48.0

package/src/services/identity/workload-runtime.ts

@@ -12,7 +12,7 @@ import {
   type WorkloadResponse,
   workloadSubject,
 } from "../../_internal/workload-protocol";
-import { env } from "../../config/env";
+import { connections } from "../../runtime/connections";
 import { audit } from "../audit";
 import { logger } from "../logging";
 import { serviceAccountCredentials } from "../service-account-credentials";
@@ -204,7 +204,7 @@ export const startAppWorkloadBroker = async (
   let stopped = false;
   let maintenance: Promise<void> | undefined;
   let timer: Timer | undefined;
-  const subscription = connection.subscribe(workloadSubject(options.namespace ?? env.SYNC_NAMESPACE), {
+  const subscription = connection.subscribe(workloadSubject(options.namespace ?? connections().nats.namespace), {
     queue: "core-workload-v1",
     callback: (error, message) => {
       if (error || !message.reply) return;

package/src/services/index.ts

@@ -253,6 +253,7 @@ export type { NetworkLookup, PublicNetworkAddress } from "./network-security";
 
 export { geoip } from "./geoip";
 export { appDetails } from "./app-details";
+export { appAdminFacts, type AppAdminFacts } from "./app-admin-facts";
 export {
   knownBrowsers,
   KNOWN_BROWSER_LIMITS,
@@ -294,3 +295,6 @@ export type {
   ObjectListOptions,
   ObjectListResult,
 } from "./object-store";
+
+export { links } from "./links";
+export type { CreateLinkInput, CreatedLink, RedeemedLink, LinkOptions, PeekedLink, PeekLinkResult, RedeemLinkResult } from "./links";

package/src/services/links/index.ts

@@ -0,0 +1,16 @@
+import { getProcessApplicationPackage } from "../../_internal/process-identity";
+import { sql } from "../../runtime/clients";
+import { type CreateLinkInput, createLinksStore, type LinkOptions } from "./store";
+
+const store = () => {
+  const packageName = getProcessApplicationPackage();
+  if (!packageName) throw new Error("Start the application before using one-time links");
+  return createLinksStore(sql, packageName);
+};
+
+export const links = {
+  create: (input: CreateLinkInput, options?: LinkOptions) => store().create(input, options),
+  peek: (token: string, input: { purpose: string }, options?: LinkOptions) => store().peek(token, input, options),
+  redeem: (token: string, input: { purpose: string }, options?: LinkOptions) => store().redeem(token, input, options),
+};
+export type { CreatedLink, CreateLinkInput, LinkOptions, PeekedLink, PeekLinkResult, RedeemedLink, RedeemLinkResult } from "./store";

package/src/services/links/runtime.ts

@@ -0,0 +1,44 @@
+import { lazySync } from "../../_internal/process-sync";
+import { sql } from "../../runtime/clients";
+import { logger } from "../logging";
+import { cleanupLinksBatch, LINK_CLEANUP_BATCH, setupLinks } from "./store";
+
+// All apps compete for one platform schedule, including replicas and apps sharing a package.
+const scheduler = lazySync((sync) =>
+  sync.scheduler({
+    id: "cloud-links-retention",
+    owner: "platform",
+    delivery: { maxAttempts: 2, backoffMs: [30_000], ackWaitMs: 60_000 },
+  }),
+);
+
+/** Provision before app setup and readiness, then drain this worker before NATS during shutdown. */
+export const startLinksRuntime = async (): Promise<() => Promise<void>> => {
+  await setupLinks(sql);
+  const stopping = new AbortController();
+  await scheduler().create({
+    id: "retention",
+    cron: "0 * * * *",
+    timezone: "UTC",
+    misfire: "latest",
+    meta: { family: "links", label: "One-time link cleanup" },
+    process: async ({ signal, heartbeat }) => {
+      const runSignal = AbortSignal.any([signal, stopping.signal]);
+      const deadline = performance.now() + 5 * 60_000;
+      let deleted = 0;
+      while (!runSignal.aborted && performance.now() < deadline) {
+        const count = await cleanupLinksBatch(sql);
+        deleted += count;
+        if (count < LINK_CLEANUP_BATCH) break;
+        await heartbeat();
+      }
+      if (deleted > 0) logger("links:cleanup").info("Removed old one-time links", { deleted });
+    },
+  });
+  const worker = await scheduler().process({ concurrency: 1 });
+  return async () => {
+    stopping.abort();
+    worker.stop();
+    await worker.drain({ timeoutMs: 30_000 });
+  };
+};

package/src/services/links/store.ts

@@ -0,0 +1,105 @@
+import { createHash, randomBytes } from "node:crypto";
+import type { SQL, TransactionSQL } from "bun";
+import { isPurposeName, validatePurposeName } from "../../_internal/purpose-name";
+import { ensureSchema } from "../postgres";
+
+export type CreateLinkInput = { purpose: string; subject: string; ttl: number };
+export type CreatedLink = { token: string; expiresAt: Date };
+export type RedeemedLink = { subject: string; createdAt: Date };
+export type PeekedLink = RedeemedLink & { expiresAt: Date };
+export type LinkOptions = { tx?: TransactionSQL };
+type LinkResult<T> = { ok: true; data: T } | { ok: false; error: { code: "LINK_INVALID" } };
+export type RedeemLinkResult = LinkResult<RedeemedLink>;
+export type PeekLinkResult = LinkResult<PeekedLink>;
+
+const TOKEN = /^cl_[A-Za-z0-9_-]{42}[AEIMQUYcgkosw048]$/;
+// Match the existing outgoing-mail retention batch budget.
+export const LINK_CLEANUP_BATCH = 1000;
+const hashToken = (token: string): string => createHash("sha256").update(token).digest("hex");
+
+const linkCandidate = (token: string, purpose: string) => {
+  const value = typeof token === "string" ? token : "";
+  const digest = hashToken(value);
+  const validPurpose = isPurposeName(purpose);
+  return { digest, purpose: validPurpose ? purpose : "", valid: TOKEN.test(value) && validPurpose };
+};
+
+export const validateCreateLink = (input: CreateLinkInput): void => {
+  validatePurposeName(input.purpose);
+  if (typeof input.subject !== "string" || Buffer.byteLength(input.subject, "utf8") > 1024) {
+    throw new TypeError("Link subject must be a string of at most 1024 UTF-8 bytes");
+  }
+  if (!Number.isFinite(input.ttl) || input.ttl < 60 || input.ttl > 30 * 24 * 60 * 60) {
+    throw new RangeError("Link ttl must be seconds from 60 to 2592000 (30 days)");
+  }
+};
+
+/** One reserved platform table in the same database as the application's domain transactions. */
+export const setupLinks = async (db: SQL): Promise<void> => {
+  await db.begin(async (tx) => {
+    await tx`SELECT pg_advisory_xact_lock(hashtext('cloud.links'))`;
+    await ensureSchema(tx, "platform");
+    const [existing] = await tx<{ table_exists: boolean; index_exists: boolean }[]>`
+      SELECT to_regclass('platform._cloud_links') IS NOT NULL AS table_exists,
+        to_regclass('platform._cloud_links_retention') IS NOT NULL AS index_exists`;
+    if (!existing?.table_exists)
+      await tx`CREATE TABLE IF NOT EXISTS platform._cloud_links (
+      package text NOT NULL, token_hash text NOT NULL, purpose text NOT NULL, subject bytea NOT NULL,
+      created_at timestamptz NOT NULL, expires_at timestamptz NOT NULL, used_at timestamptz,
+      PRIMARY KEY (package, token_hash)
+    )`.simple();
+    // Even IF NOT EXISTS takes a ShareLock; skip index DDL on ordinary app restarts.
+    if (!existing?.index_exists)
+      await tx`CREATE INDEX IF NOT EXISTS _cloud_links_retention ON platform._cloud_links (LEAST(expires_at, used_at))`.simple();
+  });
+};
+
+export const createLinksStore = (db: SQL, packageName: string) => ({
+  create: async (input: CreateLinkInput, options: LinkOptions = {}): Promise<CreatedLink> => {
+    validateCreateLink(input);
+    const token = `cl_${randomBytes(32).toString("base64url")}`;
+    const [row] = await (options.tx ?? db)<{ expires_at: Date }[]>`
+      INSERT INTO platform._cloud_links (package, token_hash, purpose, subject, created_at, expires_at)
+      VALUES (${packageName}, ${hashToken(token)}, ${input.purpose}, ${Buffer.from(input.subject, "utf8")},
+        statement_timestamp(), statement_timestamp() + ${input.ttl} * interval '1 second')
+      RETURNING expires_at`;
+    if (!row) throw new Error("One-time link insert returned no expiry");
+    return { token, expiresAt: row.expires_at };
+  },
+  peek: async (token: string, input: { purpose: string }, options: LinkOptions = {}): Promise<PeekLinkResult> => {
+    const candidate = linkCandidate(token, input.purpose);
+    const [row] = await (options.tx ?? db)<{ subject: Uint8Array; created_at: Date; expires_at: Date }[]>`
+      SELECT subject, created_at, expires_at FROM platform._cloud_links
+      WHERE package = ${packageName} AND token_hash = ${candidate.digest} AND purpose = ${candidate.purpose}
+        AND ${candidate.valid}::boolean AND used_at IS NULL AND expires_at > clock_timestamp()`;
+    return row
+      ? { ok: true, data: { subject: Buffer.from(row.subject).toString("utf8"), createdAt: row.created_at, expiresAt: row.expires_at } }
+      : { ok: false, error: { code: "LINK_INVALID" } };
+  },
+  redeem: async (token: string, input: { purpose: string }, options: LinkOptions = {}): Promise<RedeemLinkResult> => {
+    // Every candidate is hashed and reaches one indexed UPDATE, including malformed credentials.
+    const candidate = linkCandidate(token, input.purpose);
+    const [row] = await (options.tx ?? db)<{ subject: Uint8Array; created_at: Date }[]>`
+      UPDATE platform._cloud_links SET used_at = clock_timestamp()
+      WHERE package = ${packageName} AND token_hash = ${candidate.digest} AND purpose = ${candidate.purpose}
+        AND ${candidate.valid}::boolean AND used_at IS NULL AND expires_at > clock_timestamp()
+      RETURNING subject, created_at`;
+    return row
+      ? { ok: true, data: { subject: Buffer.from(row.subject).toString("utf8"), createdAt: row.created_at } }
+      : { ok: false, error: { code: "LINK_INVALID" } };
+  },
+});
+
+/** Platform maintenance spans packages; the application facade never exposes this operation. */
+export const cleanupLinksBatch = async (db: SQL): Promise<number> =>
+  db.begin(async (tx) => {
+    await tx`SET LOCAL statement_timeout = '10s'`;
+    const rows = await tx<{ token_hash: string }[]>`
+      WITH expired AS (
+        SELECT package, token_hash FROM platform._cloud_links
+        WHERE LEAST(expires_at, used_at) < statement_timestamp() - interval '24 hours'
+        ORDER BY LEAST(expires_at, used_at) LIMIT ${LINK_CLEANUP_BATCH} FOR UPDATE SKIP LOCKED
+      ) DELETE FROM platform._cloud_links link USING expired
+        WHERE link.package = expired.package AND link.token_hash = expired.token_hash RETURNING link.token_hash`;
+    return rows.length;
+  });

package/src/services/logging/index.ts

@@ -2,7 +2,7 @@ import { sql } from "bun";
 import type { PaginationParams } from "../../contracts/shared";
 import { escapeLikePattern, parsePgJsonRecord, toPgTextArray } from "../postgres";
 import { registerSettings } from "../settings/defaults";
-import { redactMetadata } from "./redaction";
+import { redactLinkTokens, redactMetadata } from "./redaction";
 import { observeSyncEvent, TRACE_STUCK_AFTER_MS, trace } from "./trace";
 import { readWebVitals } from "./web-vitals";
 
@@ -120,16 +120,18 @@ const mapRow = (row: DbLogRow): LogEntry => ({
 /** Fire-and-forget write — mirrors to console, then inserts to DB async. */
 function write(params: WriteParams): void {
   const safeMetadata = params.metadata ? (redactMetadata(params.metadata) as Record<string, unknown>) : undefined;
-  const prefix = `[${params.source}]`;
+  const source = redactLinkTokens(params.source);
+  const message = redactLinkTokens(params.message);
+  const prefix = `[${source}]`;
   const consoleFn = params.level === "error" ? console.error : params.level === "warn" ? console.warn : console.log;
-  consoleFn(prefix, params.message, ...(safeMetadata ? [safeMetadata] : []));
+  consoleFn(prefix, message, ...(safeMetadata ? [safeMetadata] : []));
 
   sql`
     INSERT INTO logging.entries (level, source, message, metadata)
     VALUES (
       ${params.level},
-      ${params.source},
-      ${params.message},
+      ${source},
+      ${message},
       (${safeMetadata ? JSON.stringify(safeMetadata) : null}::text)::jsonb
     )
   `.catch((err: Error) => console.error("[logging] DB write failed:", err.message));

package/src/services/logging/redaction.ts

@@ -7,14 +7,18 @@ const SENSITIVE_KEY_PATTERN = /(password|secret|token|cookie|authorization|api[_
 
 export const REDACTED = "[REDACTED]";
 
+/** Recognizable one-time credentials are scrubbed even under ordinary metadata keys. */
+export const redactLinkTokens = (value: string): string => value.replace(/cl_[A-Za-z0-9_-]{43}/g, REDACTED);
+
 export const isSensitiveMetadataKey = (key: string): boolean => SENSITIVE_KEY_PATTERN.test(key);
 
 export const redactMetadata = (input: unknown): unknown => {
+  if (typeof input === "string") return redactLinkTokens(input);
   if (input === null || typeof input !== "object") return input;
   if (Array.isArray(input)) return input.map(redactMetadata);
   const out: Record<string, unknown> = {};
   for (const [key, value] of Object.entries(input)) {
-    out[key] = isSensitiveMetadataKey(key) ? REDACTED : redactMetadata(value);
+    out[redactLinkTokens(key)] = isSensitiveMetadataKey(key) ? REDACTED : redactMetadata(value);
   }
   return out;
 };
@@ -60,6 +64,7 @@ export const redactSensitivePath = (pathname: string): string => {
     .split("/")
     .map((segment) => {
       const value = decodeSegment(segment);
+      if (redactLinkTokens(value) !== value) return ":token";
       if (UUID.test(value)) return ":id";
       // Dot-separated parts cover signed tokens and credential filenames such as .ics.
       // Lowercase word slugs preserve readable routes like getting-started-with-grids.

package/src/services/logging/trace.ts

@@ -4,7 +4,7 @@ import { sql } from "bun";
 import { getProcessApplicationId } from "../../_internal/process-identity";
 import type { PaginationParams } from "../../contracts/shared";
 import { escapeLikePattern, parsePgJsonRecord, toPgTextArray } from "../postgres";
-import { isSensitiveMetadataKey, REDACTED, redactMetadata } from "./redaction";
+import { isSensitiveMetadataKey, REDACTED, redactLinkTokens, redactMetadata } from "./redaction";
 
 export type TraceAttributeValue = string | number | boolean | null | undefined;
 export type TraceAttributes = Record<string, TraceAttributeValue>;
@@ -499,10 +499,10 @@ const start = async (params: TraceStartParams, preservePresentation = false): Pr
     VALUES (
       ${context.traceId},
       ${context.spanId},
-      ${params.spanKey ?? null},
+      ${params.spanKey ? redactLinkTokens(params.spanKey) : null},
       ${params.parent?.spanId ?? null},
-      ${params.name},
-      ${params.source},
+      ${redactLinkTokens(params.name)},
+      ${redactLinkTokens(params.source)},
       ${params.appId ?? null},
       ${params.category ?? "custom"},
       ${params.kind ?? "internal"},
@@ -567,10 +567,10 @@ const complete = async (params: TraceCompleteParams, preservePresentation = fals
     VALUES (
       ${context.traceId},
       ${context.spanId},
-      ${params.spanKey ?? null},
+      ${params.spanKey ? redactLinkTokens(params.spanKey) : null},
       ${params.parent?.spanId ?? null},
-      ${params.name},
-      ${params.source},
+      ${redactLinkTokens(params.name)},
+      ${redactLinkTokens(params.source)},
       ${params.appId ?? null},
       ${params.category ?? "custom"},
       ${params.kind ?? "internal"},
@@ -636,7 +636,7 @@ const record = async (params: TraceRecordParams, preservePresentation = false):
     VALUES (
       ${context.traceId},
       ${context.spanId},
-      ${params.event},
+      ${redactLinkTokens(params.event)},
       ${params.severity ?? "info"},
       (${attributesJson}::text)::jsonb,
       ${body},

package/src/services/request-cache-redis.ts

@@ -1,5 +1,5 @@
 import { RedisClient } from "bun";
-import { env } from "../config/env";
+import { connections } from "../runtime/connections";
 
 // Cache commands must not queue across a disconnect: delayed fills/invalidations
 // are not useful, and reads must be able to fall back to Postgres. Keep this
@@ -10,7 +10,7 @@ let reconnecting: Promise<void> | undefined;
 
 export const requestCacheRedis = async (): Promise<RedisClient> => {
   if (!client) {
-    client = new RedisClient(env.REDIS_URL, { enableOfflineQueue: false });
+    client = new RedisClient(connections().valkey.url, { enableOfflineQueue: false });
     // The first operation waits for normal connection establishment (Bun's
     // connection timeout applies). Later disconnected operations fail promptly.
     initialConnection = client.connect().catch(() => {});

package/src/services/settings/core-settings.ts

@@ -49,6 +49,26 @@ export const CORE_SETTINGS = {
       },
     },
   },
+  "gateway.ingress_cert_resolver": {
+    kind: "string",
+    default: "le",
+    label: "App domain certificate resolver",
+    description:
+      "Traefik certificate resolver used by app domain routers. Must name a configured ACME resolver; changes apply within five seconds.",
+    validate: (value: unknown) =>
+      typeof value === "string" && /^[a-zA-Z0-9_-]+$/.test(value)
+        ? undefined
+        : "Use a Traefik certificate resolver name (letters, digits, underscores or hyphens).",
+    presentation: {
+      translations: {
+        de: {
+          label: "Zertifikatsresolver für App-Domains",
+          description:
+            "Traefik-Zertifikatsresolver der App-Domains. Muss einen konfigurierten ACME-Resolver benennen; Änderungen wirken innerhalb von fünf Sekunden.",
+        },
+      },
+    },
+  },
   "gateway.trusted_proxies": {
     kind: "string_list",
     default: DEFAULT_TRUSTED_PROXIES,

package/src/services/settings/crypto.ts

@@ -1,3 +1,4 @@
+import { connections } from "../../runtime/connections";
 /**
  * Encryption helpers for settings at-rest.
  *
@@ -7,7 +8,6 @@
  */
 
 import { createHash } from "node:crypto";
-import { env } from "../../config/env";
 import { crypto } from "../../server/services";
 
 /**
@@ -34,7 +34,7 @@ import { crypto } from "../../server/services";
  * with deployments that have always used hex-format APP_SECRET.
  */
 export const getAppSecret = (): string => {
-  const raw = env.APP_SECRET.trim();
+  const raw = connections().appSecret.current.trim();
   if (!raw) {
     throw new Error("APP_SECRET is required to read or write encrypted settings");
   }

package/src/services/settings/store.ts

@@ -16,6 +16,7 @@
 import { sql } from "bun";
 import { HTTPException } from "hono/http-exception";
 import { hasRole, type User } from "../../contracts/shared";
+import { connections } from "../../runtime/connections";
 import { claimCacheFill, completeCacheFill, MISSING_SETTING } from "../cache-fill";
 import { stripImageDataUrlMetadata } from "../image-metadata";
 import { toPgTextArray } from "../postgres";
@@ -89,6 +90,8 @@ export const readKeyState = async (key: string, db: SqlClient = sql): Promise<Se
 export const bulkRead = async (keys: readonly string[]): Promise<Map<string, unknown>> => {
   const result = new Map<string, unknown>();
   if (keys.length === 0) return result;
+  // Missing startup is a programming error, never a cache outage or unreadable row.
+  connections();
   // Bound access is read with its endpoint in one database snapshot. Never
   // resolve it from an independently cached secret.
   const boundKeys = keys.filter((key) => settingOwners(key).length > 0);
@@ -163,6 +166,7 @@ export const bulkRead = async (keys: readonly string[]): Promise<Map<string, unk
 export const readStates = async (keys: readonly string[], db: SqlClient = sql): Promise<Map<string, SettingRead>> => {
   const result = new Map<string, SettingRead>();
   if (keys.length === 0) return result;
+  connections();
   const snapshotKeys = [...new Set(keys.flatMap((key) => [key, ...settingOwners(key).map((owner) => owner.key)]))];
   const rows = await db<StoredRow[]>`SELECT key, value FROM settings.entries WHERE key = ANY(${toPgTextArray(snapshotKeys)}::text[])`;
   const byKey = new Map(rows.map((row) => [row.key, row]));
@@ -206,6 +210,7 @@ const knownKeysWith = (extraKnownKeys: readonly string[]) =>
   Array.from(new Set([...allKnownKeys(), ...retainedLegacyKeys, ...extraKnownKeys]));
 
 export const listLegacyKeys = async (extraKnownKeys: readonly string[] = []): Promise<LegacySettingRow[]> => {
+  connections();
   const knownKeys = knownKeysWith(extraKnownKeys);
   const rows = await sql<LegacyStoredRow[]>`
     SELECT key, value, updated_at

package/src/ssr/admin-navigation.ts

@@ -70,7 +70,6 @@ export const buildAdminGroups = (apps: readonly RuntimeContext["apps"][number][]
       links: [
         { href: "/admin", icon: "ti-dashboard", label: t.overview },
         { href: "/admin/apps", icon: "ti-apps", label: t.apps },
-        { href: "/admin/app-credentials", icon: "ti-key", label: t.appCredentials },
         { href: "/admin/rail", icon: "ti-layout-sidebar", label: t.rail },
         { href: "/admin/announcements", icon: "ti-speakerphone", label: t.announcements },
       ],

package/src/ssr/platform-messages.ts

@@ -40,7 +40,6 @@ export const platformMessages = i18n.define({
       general: "General",
       rail: "App bar",
       announcements: "Announcements",
-      appCredentials: "App credentials",
       ai: "AI",
       observability: "Observability",
       baseSettings: "Base settings",
@@ -147,7 +146,6 @@ export const platformMessages = i18n.define({
       general: "Allgemein",
       rail: "App-Leiste",
       announcements: "Ankündigungen",
-      appCredentials: "App-Schlüssel",
       ai: "KI",
       observability: "Observability",
       baseSettings: "Grundeinstellungen",

package/src/start.ts

@@ -1,4 +1,8 @@
 // Keep this entry independent of the platform barrel and application modules.
+import { parseAppKey } from "./app-key";
+import { env } from "./config/env";
+import { bootstrapConnections } from "./runtime/bootstrap-client";
+import type { BootstrapResponse } from "./runtime/bootstrap-protocol";
 import { initializeClients } from "./runtime/clients";
 import { bindConnections, hasConnections } from "./runtime/connections";
 import { resolveConnections } from "./runtime/resolve-connections";
@@ -9,24 +13,41 @@ export type PlatformStartOptions = {
   source?: "env";
 };
 
+let initializing = false;
+
 /** Initialize before importing any application module, also in dev and data workers. */
 export const initializePlatform = async ({ appId, source }: PlatformStartOptions): Promise<void> => {
   if (!/^[a-z][a-z0-9-]{0,79}$/.test(appId)) throw new Error("Platform start requires a valid appId");
-  if (hasConnections()) throw new Error("Platform has already started");
-  if (appId === "core" || appId === "gateway") source = "env";
-  // Slice 6b seam: validate the app key and fetch missing values from Core here,
-  // then pass the typed response to resolveConnections({ appId, core }).
-  // A present key must never silently fall back to the legacy env mode.
-  if (source !== "env" && (process.env.CLOUD_APP_KEY?.trim() || process.env.CLOUD_APP_KEY_FILE?.trim())) {
-    throw new Error("Core connection bootstrap is not available yet");
-  }
-  const resolved = resolveConnections({ appId });
-  bindConnections(resolved);
+  if (initializing || hasConnections()) throw new Error("Platform has already started");
+  initializing = true;
   try {
-    await initializeClients();
-  } catch (error) {
-    bindConnections(undefined);
-    throw error;
+    const keyValue = env.CLOUD_APP_KEY;
+    const envOnly = source === "env" || appId === "core" || appId === "gateway";
+    if (keyValue && envOnly) throw new Error("App keys are forbidden in forced env mode (including Core and Gateway)");
+    let bootstrap: BootstrapResponse | undefined;
+    if (keyValue) {
+      // Parsing never prints the private value. A present invalid key cannot fall back to env.
+      const key = parseAppKey(keyValue);
+      if (key.appId !== appId) throw new Error("App-key appId does not match the declared application");
+      bootstrap = await bootstrapConnections(key, env.CLOUD_CORE_INTERNAL_ORIGIN);
+    }
+    const resolved = resolveConnections({ appId, core: bootstrap?.connections });
+    resolved.bootstrap = {
+      mode: bootstrap ? "core" : "env",
+      ...(bootstrap ? { keyId: bootstrap.identity.keyId } : {}),
+      sources: resolved.sources,
+      keyFormat: "cloud-app-key-v1",
+      protocol: 1,
+    };
+    bindConnections(resolved);
+    try {
+      await initializeClients();
+    } catch (error) {
+      bindConnections(undefined);
+      throw error;
+    }
+  } finally {
+    initializing = false;
   }
 };