@k2b/cloud 0.47.0 → 0.49.0

package/src/services/notifications/batches.ts

@@ -1,9 +1,9 @@
 import { createHash } from "node:crypto";
 import { err, fail, ok, type Result } from "@k2b/stdlib";
 import type { Worker } from "@k2b/sync";
-import { sql } from "bun";
 import { lazySync } from "../../_internal/process-sync";
 import { type MailMessage, MailMessageSchema, type MailStatus, MailStatusSchema } from "../../contracts/outgoing-mail";
+import { sql } from "../../runtime/clients";
 import { markdown } from "../../shared/markdown";
 import { type AuditActor, audit } from "../audit";
 import { logger, trace } from "../logging";

package/src/services/notifications/browser.ts

@@ -1,10 +1,10 @@
 import { createHash } from "node:crypto";
-import { sql } from "bun";
 import webpush from "web-push";
 import { z } from "zod";
 import { notificationGroupTag } from "../../contracts/notification-group";
 import { isSafeNotificationTargetHref } from "../../contracts/notification-types";
 import { type BrowserPushSubscription, BrowserPushSubscriptionSchema } from "../../contracts/user-notifications";
+import { sql } from "../../runtime/clients";
 import { decryptSecret, encryptSecret } from "../secrets";
 import { coreSettings } from "../settings/api";
 import { SettingUnreadableError } from "../settings/store";

package/src/services/notifications/catalog.ts

@@ -1,5 +1,5 @@
-import { sql } from "bun";
 import type { AnyBoundNotificationDefinition } from "../../contracts/notification-types";
+import { sql } from "../../runtime/clients";
 import { logger } from "../logging";
 import { toPgTextArray } from "../postgres";
 

package/src/services/notifications/dispatcher.ts

@@ -1,5 +1,5 @@
-import { sql } from "bun";
 import { z } from "zod";
+import { sql } from "../../runtime/clients";
 import { decryptSecret } from "../secrets";
 import { getNotificationChannel } from "./channels";
 import { quietStateForEvent } from "./quiet";

package/src/services/notifications/index.ts

@@ -1,7 +1,7 @@
-import { sql } from "bun";
 import type { ZodType } from "zod";
 import type { BoundNotificationDefinition, NotificationRecipientKind, NotificationSendInput } from "../../contracts/notification-types";
 import type { PaginationParams } from "../../contracts/shared";
+import { sql } from "../../runtime/clients";
 import { logger } from "../logging";
 import { escapeLikePattern } from "../postgres";
 import { notificationMailOutcome, sendNotificationMail } from "./email-mail";

package/src/services/notifications/observability.ts

@@ -1,6 +1,7 @@
-import { type SQL, sql } from "bun";
+import type { SQL } from "bun";
 import type { MailStatus } from "../../contracts/outgoing-mail";
 import type { NotificationDeliveryStatus } from "../../contracts/user-notifications";
+import { sql } from "../../runtime/clients";
 import { escapeLikePattern, toPgTextArray } from "../postgres";
 
 const DELIVERY_STATUSES = new Set<NotificationDeliveryStatus>(["deferred", "pending", "sending", "delivered", "suppressed", "failed"]);

package/src/services/notifications/platform.ts

@@ -1,4 +1,3 @@
-import { sql } from "bun";
 import type { output, ZodType } from "zod";
 import { isNotificationGroup, notificationGroupTag } from "../../contracts/notification-group";
 import type {
@@ -10,6 +9,7 @@ import type {
   NotificationSendInput,
 } from "../../contracts/notification-types";
 import { validateNotificationTargetHref } from "../../contracts/notification-types";
+import { sql } from "../../runtime/clients";
 import { normalizeLocale } from "../../shared/locale";
 import { logger } from "../logging";
 import { encryptSecret } from "../secrets";

package/src/services/notifications/quiet.ts

@@ -1,5 +1,4 @@
 import { dates } from "@k2b/stdlib";
-import { sql } from "bun";
 import type { MutationResult } from "../../contracts/shared";
 import {
   NOTIFICATION_DO_NOT_DISTURB_MAX_DAYS,
@@ -9,6 +8,7 @@ import {
   type NotificationQuietState,
   type UpdateNotificationQuietSettings,
 } from "../../contracts/user-notifications";
+import { sql } from "../../runtime/clients";
 import { normalizeTimeZone } from "../../shared/time";
 
 const DAY_MS = 24 * 60 * 60_000;

package/src/services/notifications/user.ts

@@ -1,4 +1,3 @@
-import { sql } from "bun";
 import {
   isSafeNotificationTargetHref,
   type NotificationDefinitionPresentationCatalog,
@@ -11,6 +10,7 @@ import type {
   UserNotificationPreference,
   UserNotificationPreferencesResponse,
 } from "../../contracts/user-notifications";
+import { sql } from "../../runtime/clients";
 import { normalizeLocale } from "../../shared/locale";
 import { toPgTextArray } from "../postgres";
 import { listNotificationChannels } from "./channels";

package/src/services/oauth-tokens.ts

@@ -1,6 +1,6 @@
-import { sql } from "bun";
 import { createRemoteJWKSet, decodeProtectedHeader, errors, type JWTPayload, type JWTVerifyGetKey, jwtVerify } from "jose";
 import type { User } from "../contracts/shared";
+import { sql } from "../runtime/clients";
 import { isAccountCategoryAllowed } from "./account-category-policy";
 import { isAccountExpired } from "./account-model";
 import { IDENTITY_JWKS_MAX_AGE_SECONDS } from "./identity/constants";

package/src/services/outbox.ts

@@ -1,4 +1,5 @@
-import { sql } from "bun";
+import { sql } from "../runtime/clients";
+
 import { logger } from "./logging";
 
 /**
@@ -66,9 +67,9 @@ export type PgOutbox<Row extends OutboxRow> = {
   stop(): Promise<void>;
 };
 
-const identifier = (name: string, label: string): ReturnType<typeof sql.unsafe> => {
+const identifier = (name: string, label: string) => {
   if (!name.split(".").every((part) => IDENTIFIER.test(part))) throw new Error(`Invalid outbox ${label}: ${name}`);
-  return sql.unsafe(name);
+  return name;
 };
 
 export const createPgOutbox = <Row extends OutboxRow>(config: PgOutboxConfig<Row>): PgOutbox<Row> => {
@@ -81,7 +82,7 @@ export const createPgOutbox = <Row extends OutboxRow>(config: PgOutboxConfig<Row
   const log = logger(config.name);
   const filters = Object.entries(config.where ?? {}).map(([column, value]) => ({ column: identifier(column, "filter column"), value }));
   const matches = (alias: "current" | "busy") =>
-    filters.reduce((fragment, { column, value }) => sql`${fragment} AND ${sql.unsafe(alias)}.${column} = ${value}`, sql``);
+    filters.reduce((fragment, { column, value }) => sql`${fragment} AND ${sql.unsafe(alias)}.${sql.unsafe(column)} = ${value}`, sql``);
   // Sorted, so the order of the `where` entries cannot give one outbox two locks. Descending keeps the
   // lock that live outboxes (`kind`, `app_id`) always took, so replicas of two releases share it.
   const where = Object.entries(config.where ?? {}).sort(([left], [right]) => (left < right ? 1 : -1));
@@ -115,28 +116,28 @@ export const createPgOutbox = <Row extends OutboxRow>(config: PgOutboxConfig<Row
       return tx<Row[]>`
         WITH candidates AS MATERIALIZED (
           SELECT current.id
-          FROM ${table} current
+          FROM ${sql.unsafe(table)} current
           WHERE (current.attempts = 0 OR current.next_attempt_at <= now())
             AND (current.claimed_until IS NULL OR current.claimed_until <= now())
             ${matches("current")}
             AND NOT EXISTS (
               SELECT
-              FROM ${table} busy
-              WHERE busy.${runColumn} = current.${runColumn}
+              FROM ${sql.unsafe(table)} busy
+              WHERE busy.${sql.unsafe(runColumn)} = current.${sql.unsafe(runColumn)}
                 AND (busy.claimed_until > now() OR (busy.attempts > 0 AND busy.next_attempt_at > now()))
                 ${matches("busy")}
               OFFSET 0
             )
-          ORDER BY current.${sequence}
+          ORDER BY current.${sql.unsafe(sequence)}
           LIMIT ${cap}
           FOR UPDATE SKIP LOCKED
         ), claimed AS (
-          UPDATE ${table} outbox
+          UPDATE ${sql.unsafe(table)} outbox
           SET claimed_until = now() + (${claimMs} * interval '1 millisecond')
           WHERE outbox.id = ANY(ARRAY(SELECT id FROM candidates))
           RETURNING outbox.*
         )
-        SELECT * FROM claimed ORDER BY ${sequence}
+        SELECT * FROM claimed ORDER BY ${sql.unsafe(sequence)}
       `;
     });
 
@@ -145,7 +146,7 @@ export const createPgOutbox = <Row extends OutboxRow>(config: PgOutboxConfig<Row
     const message = error instanceof Error ? error.message : String(error);
     const delaySeconds = Math.min(300, 2 ** Math.min(attempts, 8));
     await sql`
-      UPDATE ${table}
+      UPDATE ${sql.unsafe(table)}
       SET attempts = ${attempts},
           next_attempt_at = now() + (${delaySeconds} * interval '1 second'),
           claimed_until = NULL,
@@ -158,7 +159,7 @@ export const createPgOutbox = <Row extends OutboxRow>(config: PgOutboxConfig<Row
   const dispatch: PgOutbox<Row>["dispatch"] = async (row, publish = config.publish) => {
     try {
       await publish(row);
-      await sql`DELETE FROM ${table} WHERE id = ${row.id}::uuid AND attempts = ${row.attempts}`;
+      await sql`DELETE FROM ${sql.unsafe(table)} WHERE id = ${row.id}::uuid AND attempts = ${row.attempts}`;
     } catch (error) {
       await retryLater(row, error);
     }
@@ -182,7 +183,7 @@ export const createPgOutbox = <Row extends OutboxRow>(config: PgOutboxConfig<Row
             const rest = run.slice(index + 1).map((later) => later.id);
             // Past the claim, the rest is free already, and releasing it could end another replica's claim.
             if (rest.length > 0 && performance.now() < claimEnds) {
-              await sql`UPDATE ${table} SET claimed_until = NULL WHERE id = ANY(${sql.array(rest, "uuid")})`;
+              await sql`UPDATE ${sql.unsafe(table)} SET claimed_until = NULL WHERE id = ANY(${sql.array(rest, "uuid")})`;
             }
             return;
           }
@@ -190,7 +191,7 @@ export const createPgOutbox = <Row extends OutboxRow>(config: PgOutboxConfig<Row
         }
       }),
     );
-    if (delivered.length > 0) await sql`DELETE FROM ${table} WHERE id = ANY(${sql.array(delivered, "uuid")})`;
+    if (delivered.length > 0) await sql`DELETE FROM ${sql.unsafe(table)} WHERE id = ANY(${sql.array(delivered, "uuid")})`;
     for (const result of results) if (result.status === "rejected") throw result.reason;
   };
 

package/src/services/outgoing-mail/admin.ts

@@ -1,4 +1,3 @@
-import { sql } from "bun";
 import {
   type AdminMailFilter,
   type AdminMailRecord,
@@ -6,6 +5,7 @@ import {
   type MailPage,
   type MailPageParams,
 } from "../../contracts/outgoing-mail";
+import { sql } from "../../runtime/clients";
 import { audit } from "../audit";
 import { cleanupMailAttachments, publishMailSettled } from "./dispatcher";
 import { adminMessageRecord, type MessageRow, outgoingMailMessages } from "./messages";

package/src/services/outgoing-mail/dispatcher.ts

@@ -1,9 +1,9 @@
 import { createHash } from "node:crypto";
 import { Socket } from "node:net";
 import { Readable } from "node:stream";
-import { sql } from "bun";
 import { z } from "zod";
 import { listApps } from "../../_internal/registry";
+import { sql } from "../../runtime/clients";
 import { DownstreamBusyError, downstreamBudget } from "../downstream-budget";
 import { parsePgJsonValue } from "../postgres";
 import { get } from "../settings";

package/src/services/outgoing-mail/drain.ts

@@ -1,4 +1,5 @@
-import { sql } from "bun";
+import { sql } from "../../runtime/clients";
+
 import { mailNextDrainDelay } from "./bulk";
 import { attemptOutgoingMail } from "./dispatcher";
 import type { MessageRow } from "./messages";

package/src/services/outgoing-mail/enqueue.ts

@@ -1,5 +1,6 @@
-import { type SQL, sql } from "bun";
+import type { SQL } from "bun";
 import type { MailMessage } from "../../contracts/outgoing-mail";
+import { sql } from "../../runtime/clients";
 import {
   cancelMailStreams,
   deleteMailObjects,

package/src/services/outgoing-mail/messages.ts

@@ -1,5 +1,5 @@
 import type { ObjectRef } from "@k2b/sync";
-import { type SQL, sql } from "bun";
+import type { SQL } from "bun";
 import { z } from "zod";
 import {
   type AdminMailFilter,
@@ -14,6 +14,7 @@ import {
   MailRecordSchema,
   type MailStatus,
 } from "../../contracts/outgoing-mail";
+import { sql } from "../../runtime/clients";
 import { sanitizeEmailHtml } from "../../shared/email-html";
 import { audit } from "../audit";
 import { escapeLikePattern, parsePgJsonValue, toPgTextArray, toPgUuidArray } from "../postgres";

package/src/services/outgoing-mail/retention.ts

@@ -1,5 +1,5 @@
-import { sql } from "bun";
 import type { MailRetention } from "../../contracts/outgoing-mail";
+import { sql } from "../../runtime/clients";
 import { toPgUuidArray } from "../postgres";
 import { get, read } from "../settings";
 import { deleteMailObjects } from "./attachments";

package/src/services/outgoing-mail/send.ts

@@ -1,5 +1,5 @@
-import { sql } from "bun";
 import type { MailMessage, MailRecord } from "../../contracts/outgoing-mail";
+import { sql } from "../../runtime/clients";
 import { cancelMailStreams, deleteMailObjects, uploadMailAttachments } from "./attachments";
 import {
   allowedMailProfile,

package/src/services/outgoing-mail/store.ts

@@ -1,5 +1,5 @@
 import { createHash } from "node:crypto";
-import { type SQL, sql } from "bun";
+import type { SQL } from "bun";
 import { listApps } from "../../_internal/registry";
 import {
   type AdminMailApp,
@@ -18,6 +18,7 @@ import {
   MailProfileKeySchema,
 } from "../../contracts/outgoing-mail";
 import type { AppRegistryEntry } from "../../contracts/registry";
+import { sql } from "../../runtime/clients";
 import { type AuditActor, audit } from "../audit";
 import { toPgTextArray } from "../postgres";
 import { decryptValue, encryptValue } from "../settings/crypto";

package/src/services/panel-context-consent.ts

@@ -1,5 +1,6 @@
-import { type SQL, sql } from "bun";
+import type { SQL } from "bun";
 import { CapabilityAppIdSchema } from "../contracts/capabilities";
+import { sql } from "../runtime/clients";
 
 type ConsentAnswer = { allowed: boolean; revision: number };
 export class PanelConsentCancelled extends Error {
@@ -12,34 +13,36 @@ export class PanelConsentCancelled extends Error {
  * Core owns the table; platform requests read without a process-wide cache. Missing is distinct from denied. Reads
  * take a share lock, so a page rendered while a save is in flight sees that save's outcome, not the answer before it.
  */
-export const createPanelContextConsentService = (db: SQL = sql) => ({
-  async get(userId: string, provider: string): Promise<ConsentAnswer | null> {
-    CapabilityAppIdSchema.parse(provider);
-    const [row] = await db<ConsentAnswer[]>`
+export const createPanelContextConsentService = (injectedDb?: SQL) => {
+  const db = () => injectedDb ?? sql;
+  return {
+    async get(userId: string, provider: string): Promise<ConsentAnswer | null> {
+      CapabilityAppIdSchema.parse(provider);
+      const [row] = await db()<ConsentAnswer[]>`
       SELECT allowed, revision FROM auth.panel_context_consent WHERE user_id = ${userId}::uuid AND provider = ${provider}
       FOR SHARE
     `;
-    return row ?? null;
-  },
-  async list(userId: string, providers: string[]): Promise<Record<string, ConsentAnswer>> {
-    if (!providers.length) return {};
-    for (const provider of providers) CapabilityAppIdSchema.parse(provider);
-    const rows = await db<({ provider: string } & ConsentAnswer)[]>`
+      return row ?? null;
+    },
+    async list(userId: string, providers: string[]): Promise<Record<string, ConsentAnswer>> {
+      if (!providers.length) return {};
+      for (const provider of providers) CapabilityAppIdSchema.parse(provider);
+      const rows = await db()<({ provider: string } & ConsentAnswer)[]>`
       SELECT provider, allowed, revision FROM auth.panel_context_consent
-      WHERE user_id = ${userId}::uuid AND provider IN ${db(providers)}
+      WHERE user_id = ${userId}::uuid AND provider IN ${db()(providers)}
       FOR SHARE
     `;
-    return Object.fromEntries(rows.map(({ provider, allowed, revision }) => [provider, { allowed, revision }]));
-  },
-  /**
-   * Compare-and-set on the revision the client read. A save whose request was cancelled (the browser gave up or
-   * left) is rolled back before commit, so no answer lands after its page stopped waiting.
-   */
-  async set(userId: string, provider: string, allowed: boolean, revision: number, signal?: AbortSignal): Promise<ConsentAnswer | null> {
-    CapabilityAppIdSchema.parse(provider);
-    return db.begin(async (tx) => {
-      await tx`SET LOCAL statement_timeout = '5s'`;
-      const [row] = await tx<ConsentAnswer[]>`
+      return Object.fromEntries(rows.map(({ provider, allowed, revision }) => [provider, { allowed, revision }]));
+    },
+    /**
+     * Compare-and-set on the revision the client read. A save whose request was cancelled (the browser gave up or
+     * left) is rolled back before commit, so no answer lands after its page stopped waiting.
+     */
+    async set(userId: string, provider: string, allowed: boolean, revision: number, signal?: AbortSignal): Promise<ConsentAnswer | null> {
+      CapabilityAppIdSchema.parse(provider);
+      return db().begin(async (tx) => {
+        await tx`SET LOCAL statement_timeout = '5s'`;
+        const [row] = await tx<ConsentAnswer[]>`
       INSERT INTO auth.panel_context_consent (user_id, provider, allowed, revision)
       SELECT ${userId}::uuid, ${provider}, ${allowed}, 1
       WHERE ${revision} = 0 OR EXISTS (
@@ -50,9 +53,10 @@ export const createPanelContextConsentService = (db: SQL = sql) => ({
       WHERE auth.panel_context_consent.revision = ${revision}
       RETURNING allowed, revision
     `;
-      if (signal?.aborted) throw new PanelConsentCancelled();
-      return row ?? null;
-    });
-  },
-});
+        if (signal?.aborted) throw new PanelConsentCancelled();
+        return row ?? null;
+      });
+    },
+  };
+};
 export const panelContextConsent = createPanelContextConsentService();

package/src/services/providers/local/auth.ts

@@ -1,4 +1,4 @@
-import { redis } from "bun";
+import { redis } from "../../../runtime/clients";
 
 /** Requested by email or username on the login page; resolves the account through its email at use. */
 export type EmailLoginTokenPayload = { email: string; category?: "guest" | "login" };

package/src/services/providers/local/users.ts

@@ -1,6 +1,6 @@
-import { sql } from "bun";
 import type { MutationResult, UserProfile } from "../../../contracts/shared";
 import { coreUserEventPublisher } from "../../../events/core-user-created";
+import { sql } from "../../../runtime/clients";
 import { isAccountCategoryAllowed } from "../../account-category-policy";
 import { writeDeletedAccountAudit } from "../../account-lifecycle/audit";
 import { emailAlreadyUsed, findAccountsByEmail, lockAccountEmail, normalizeAccountEmail } from "../../accounts/email-write";

package/src/services/pwa-devices.ts

@@ -1,8 +1,9 @@
 import { timingSafeEqual } from "node:crypto";
-import { type SQL, sql } from "bun";
+import type { SQL } from "bun";
 import type { Context } from "hono";
 import { lazySync } from "../_internal/process-sync";
 import { PWA_LIMITS as limits, type PwaDeviceView, type PwaErrorCode, type PwaPairingState, type PwaPlatform } from "../contracts/pwa";
+import { sql } from "../runtime/clients";
 import { isAccountCategoryAllowed } from "./account-category-policy";
 import { audit } from "./audit";
 import { logger } from "./logging";

package/src/services/rail-preferences.ts

@@ -1,17 +1,20 @@
-import { type SQL, sql } from "bun";
+import type { SQL } from "bun";
 import { defaultRailPreferences, type RailPreferences, RailPreferencesSchema } from "../contracts/rail-preferences";
+import { sql } from "../runtime/clients";
 
 /** Core-owned data, read by the platform SSR seam without a process-wide cache. */
-export const createRailPreferencesService = (db: SQL = sql) => ({
-  async get(userId: string): Promise<RailPreferences> {
-    const [row] = await db<{ revision: number; visibility: unknown; shortcuts: unknown }[]>`
+export const createRailPreferencesService = (injectedDb?: SQL) => {
+  const db = () => injectedDb ?? sql;
+  return {
+    async get(userId: string): Promise<RailPreferences> {
+      const [row] = await db()<{ revision: number; visibility: unknown; shortcuts: unknown }[]>`
       SELECT revision, visibility, shortcuts FROM auth.rail_preferences WHERE user_id = ${userId}::uuid
     `;
-    return row ? RailPreferencesSchema.parse(row) : defaultRailPreferences();
-  },
-  async save(userId: string, input: RailPreferences): Promise<RailPreferences | null> {
-    const value = RailPreferencesSchema.parse(input);
-    const [row] = await db<{ revision: number; visibility: unknown; shortcuts: unknown }[]>`
+      return row ? RailPreferencesSchema.parse(row) : defaultRailPreferences();
+    },
+    async save(userId: string, input: RailPreferences): Promise<RailPreferences | null> {
+      const value = RailPreferencesSchema.parse(input);
+      const [row] = await db()<{ revision: number; visibility: unknown; shortcuts: unknown }[]>`
       INSERT INTO auth.rail_preferences (user_id, revision, visibility, shortcuts)
       SELECT ${userId}::uuid, 1, (${JSON.stringify(value.visibility)}::text)::jsonb, (${JSON.stringify(value.shortcuts)}::text)::jsonb
       WHERE ${value.revision} = 0 OR EXISTS (SELECT 1 FROM auth.rail_preferences WHERE user_id = ${userId}::uuid)
@@ -21,7 +24,8 @@ export const createRailPreferencesService = (db: SQL = sql) => ({
       WHERE auth.rail_preferences.revision = ${value.revision}
       RETURNING revision, visibility, shortcuts
     `;
-    return row ? RailPreferencesSchema.parse(row) : null;
-  },
-});
+      return row ? RailPreferencesSchema.parse(row) : null;
+    },
+  };
+};
 export const railPreferences = createRailPreferencesService();

package/src/services/rail-shortcuts.ts

@@ -1,7 +1,8 @@
-import { type SQL, sql } from "bun";
+import type { SQL } from "bun";
 import { type RailAdminInput, RailAdminInputSchema, RailAdminSchema, type RailAdminState } from "../contracts/rail-admin";
 import { RailShortcutSchema } from "../contracts/rail-preferences";
 import { hasRole, type User } from "../contracts/shared";
+import { sql } from "../runtime/clients";
 import { buildAccessPrincipalCondition, createAccess } from "../server/services/access";
 
 export class RailAdminError extends Error {
@@ -16,8 +17,9 @@ const requireAdmin = (actor: User | undefined) => {
   if (!actor || !hasRole(actor, "admin")) throw new RailAdminError(403, "Administrator access required");
 };
 
-export const createRailShortcutsService = (db: SQL = sql) => {
-  const list = async (query: SQL = db): Promise<RailAdminState> => {
+export const createRailShortcutsService = (injectedDb?: SQL) => {
+  const db = () => injectedDb ?? sql;
+  const list = async (query: SQL = db()): Promise<RailAdminState> => {
     const [state] = await query<{ revision: number }[]>`SELECT revision FROM auth.rail_state WHERE singleton`;
     const rows = await query<{ shortcut: unknown; access: unknown }[]>`
       SELECT r.shortcut, COALESCE((
@@ -41,7 +43,7 @@ export const createRailShortcutsService = (db: SQL = sql) => {
       requireAdmin(actor);
       // One generation switch invalidates every user, including concurrent old refills.
       // Keep the configuration revision unchanged so open editors remain valid.
-      await db`UPDATE auth.rail_state SET cache_version = gen_random_uuid() WHERE singleton`;
+      await db()`UPDATE auth.rail_state SET cache_version = gen_random_uuid() WHERE singleton`;
     },
     async list(actor: User | undefined) {
       requireAdmin(actor);
@@ -50,7 +52,7 @@ export const createRailShortcutsService = (db: SQL = sql) => {
     async save(actor: User | undefined, input: RailAdminInput) {
       requireAdmin(actor);
       const value = RailAdminInputSchema.parse(input);
-      return db.begin(async (tx) => {
+      return db().begin(async (tx) => {
         const [state] = await tx<{ revision: number }[]>`SELECT revision FROM auth.rail_state WHERE singleton FOR UPDATE`;
         if (state?.revision !== value.revision) throw new RailAdminError(409, "App bar configuration changed. Reload before saving.");
         await tx`DELETE FROM auth.access WHERE id IN (SELECT access_id FROM auth.rail_shortcut_access)`;
@@ -76,13 +78,13 @@ export const createRailShortcutsService = (db: SQL = sql) => {
       const match = buildAccessPrincipalCondition({
         subject: { type: "user", userId },
         columns: {
-          userId: db`a.user_id`,
-          groupId: db`a.group_id`,
-          serviceAccountId: db`a.service_account_id`,
-          authenticatedOnly: db`a.authenticated_only`,
+          userId: db()`a.user_id`,
+          groupId: db()`a.group_id`,
+          serviceAccountId: db()`a.service_account_id`,
+          authenticatedOnly: db()`a.authenticated_only`,
         },
       });
-      const rows = await db<{ shortcut: unknown }[]>`
+      const rows = await db()<{ shortcut: unknown }[]>`
         SELECT r.shortcut FROM auth.rail_shortcuts r WHERE EXISTS (
           SELECT 1 FROM auth.rail_shortcut_access ra JOIN auth.access a ON a.id = ra.access_id
           WHERE ra.shortcut_id = r.id AND a.permission = 'read' AND ${match}

package/src/services/request-cache-redis.ts

@@ -1,5 +1,5 @@
-import { RedisClient } from "bun";
-import { env } from "../config/env";
+import type { RedisClient } from "bun";
+import { createRedis } from "../runtime/clients";
 
 // Cache commands must not queue across a disconnect: delayed fills/invalidations
 // are not useful, and reads must be able to fall back to Postgres. Keep this
@@ -10,7 +10,7 @@ let reconnecting: Promise<void> | undefined;
 
 export const requestCacheRedis = async (): Promise<RedisClient> => {
   if (!client) {
-    client = new RedisClient(env.REDIS_URL, { enableOfflineQueue: false });
+    client = createRedis({ enableOfflineQueue: false });
     // The first operation waits for normal connection establishment (Bun's
     // connection timeout applies). Later disconnected operations fail promptly.
     initialConnection = client.connect().catch(() => {});

package/src/services/service-account-credentials.ts

@@ -1,7 +1,8 @@
 import { createHash, timingSafeEqual } from "node:crypto";
 import { crypto, err, fail, ok, type PageParams, type Paginated, type Result } from "@k2b/stdlib";
-import { type SQL, sql } from "bun";
+import type { SQL } from "bun";
 import { AI_INFERENCE_SCOPE, type User } from "../contracts/shared";
+import { sql } from "../runtime/clients";
 import { accounts } from "./accounts";
 import { audit } from "./audit";
 import { isUniqueViolation, toPgTextArray } from "./postgres";

package/src/services/service-accounts.ts

@@ -1,5 +1,6 @@
 import { err, fail, ok, type Result } from "@k2b/stdlib";
-import { sql } from "bun";
+import { sql } from "../runtime/clients";
+
 import { isUniqueViolation } from "./postgres";
 
 export type ServiceAccountKind = "user_delegated" | "resource_bound" | "standalone" | "agent";

package/src/services/session/index.ts

@@ -1,10 +1,11 @@
-import { type SQL, sql } from "bun";
+import type { SQL } from "bun";
 import type { Context } from "hono";
 import { deleteCookie, getCookie, setCookie } from "hono/cookie";
 import { HTTPException } from "hono/http-exception";
 import { env } from "../../config/env";
 import { PWA_AUTH_PATH, PWA_COOKIES } from "../../contracts/pwa";
 import type { User } from "../../contracts/shared";
+import { sql } from "../../runtime/clients";
 import { getLocale } from "../../server/locale";
 import { describeRequest } from "../../server/request-context";
 import { isAccountCategoryAllowed } from "../account-category-policy";

package/src/services/session/user.ts

@@ -1,5 +1,6 @@
-import { type SQLQuery, sql } from "bun";
+import type { SQLQuery } from "bun";
 import type { User } from "../../contracts/shared";
+import { sql } from "../../runtime/clients";
 import { decodeAccountCategoryEnabled } from "../account-category-policy";
 import { buildRoles } from "../accounts/authz";
 import { resolveProviderProfile } from "../accounts/base-user";

package/src/services/settings/core-settings.ts

@@ -49,6 +49,26 @@ export const CORE_SETTINGS = {
       },
     },
   },
+  "gateway.ingress_cert_resolver": {
+    kind: "string",
+    default: "le",
+    label: "App domain certificate resolver",
+    description:
+      "Traefik certificate resolver used by app domain routers. Must name a configured ACME resolver; changes apply within five seconds.",
+    validate: (value: unknown) =>
+      typeof value === "string" && /^[a-zA-Z0-9_-]+$/.test(value)
+        ? undefined
+        : "Use a Traefik certificate resolver name (letters, digits, underscores or hyphens).",
+    presentation: {
+      translations: {
+        de: {
+          label: "Zertifikatsresolver für App-Domains",
+          description:
+            "Traefik-Zertifikatsresolver der App-Domains. Muss einen konfigurierten ACME-Resolver benennen; Änderungen wirken innerhalb von fünf Sekunden.",
+        },
+      },
+    },
+  },
   "gateway.trusted_proxies": {
     kind: "string_list",
     default: DEFAULT_TRUSTED_PROXIES,

package/src/services/settings/crypto.ts

@@ -1,3 +1,4 @@
+import { connections } from "../../runtime/connections";
 /**
  * Encryption helpers for settings at-rest.
  *
@@ -7,7 +8,6 @@
  */
 
 import { createHash } from "node:crypto";
-import { env } from "../../config/env";
 import { crypto } from "../../server/services";
 
 /**
@@ -34,7 +34,7 @@ import { crypto } from "../../server/services";
  * with deployments that have always used hex-format APP_SECRET.
  */
 export const getAppSecret = (): string => {
-  const raw = env.APP_SECRET.trim();
+  const raw = connections().appSecret.current.trim();
   if (!raw) {
     throw new Error("APP_SECRET is required to read or write encrypted settings");
   }