@k2b/cloud 0.47.0 → 0.49.0

package/src/runtime/bootstrap-client.ts

@@ -0,0 +1,195 @@
+import type { AppKey } from "../app-key";
+import {
+  BOOTSTRAP_ATTEMPT_MS,
+  BOOTSTRAP_BODY,
+  BOOTSTRAP_BUDGET_MS,
+  BOOTSTRAP_PATH,
+  BOOTSTRAP_RESPONSE_BYTES,
+  type BootstrapResponse,
+  BootstrapResponseSchema,
+  signBootstrapProof,
+} from "./bootstrap-protocol";
+
+export class BootstrapError extends Error {
+  constructor(
+    readonly kind: "transient" | "permanent",
+    readonly reason: string,
+    readonly retryAfterMs = 0,
+  ) {
+    super(`Core bootstrap ${kind}: ${reason}`);
+    this.name = "BootstrapError";
+  }
+}
+
+const originUrl = (origin: string | undefined): URL => {
+  try {
+    if (!origin) throw new Error();
+    const url = new URL(origin);
+    if (!["http:", "https:"].includes(url.protocol) || url.username || url.password || url.pathname !== "/" || url.search || url.hash)
+      throw new Error();
+    return new URL(BOOTSTRAP_PATH, url);
+  } catch {
+    throw new BootstrapError("permanent", "CLOUD_CORE_INTERNAL_ORIGIN must be a direct http(s) Core origin");
+  }
+};
+const httpReason = (status: number): string => {
+  if (status === 401) return "HTTP 401: unknown, revoked, expired or invalid app key/proof";
+  if (status === 403) return "HTTP 403: connections_not_permitted, app/installation mismatch or replayed proof";
+  if (status === 404) return "HTTP 404: bootstrap route unavailable; check the direct Core origin and version";
+  return `HTTP ${status}`;
+};
+const retryAfter = (header: string | null, now: number): number => {
+  if (!header) return 0;
+  if (/^\d+$/.test(header)) return Number(header) * 1000;
+  const date = Date.parse(header);
+  return Number.isFinite(date) ? Math.max(0, date - now) : 0;
+};
+// Keep transport read failures separate from invalid JSON: only transport failures retry.
+const readResponse = async (response: Response, signal: AbortSignal): Promise<unknown> => {
+  const tooLarge = () => new BootstrapError("permanent", "response too_large");
+  if (Number(response.headers.get("Content-Length")) > BOOTSTRAP_RESPONSE_BYTES) {
+    void response.body?.cancel().catch(() => undefined);
+    throw tooLarge();
+  }
+  const reader = response.body?.getReader();
+  if (!reader) throw new BootstrapError("permanent", "response invalid_json");
+  const abort = () => {
+    void reader.cancel().catch(() => undefined);
+  };
+  signal.addEventListener("abort", abort, { once: true });
+  if (signal.aborted) abort();
+  const bytes = new Uint8Array(BOOTSTRAP_RESPONSE_BYTES);
+  let length = 0;
+  try {
+    while (true) {
+      const chunk = await reader.read();
+      if (chunk.done) break;
+      if (length + chunk.value.byteLength > bytes.byteLength) {
+        void reader.cancel().catch(() => undefined);
+        throw tooLarge();
+      }
+      bytes.set(chunk.value, length);
+      length += chunk.value.byteLength;
+    }
+  } finally {
+    signal.removeEventListener("abort", abort);
+    reader.releaseLock();
+  }
+  signal.throwIfAborted();
+  try {
+    return JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes.subarray(0, length)));
+  } catch {
+    throw new BootstrapError("permanent", "response invalid_json");
+  }
+};
+// Dependency injection keeps retry-budget tests fast and deterministic; not a public startup option.
+type Dependencies = {
+  fetch: (url: URL, init: RequestInit) => Promise<Response>;
+  now: () => number;
+  wallNow: () => number;
+  sleep: (ms: number) => Promise<unknown>;
+  random: () => number;
+  log: (entry: { appId: string; attempt: number; errorClass: "transient" | "permanent" }) => void;
+};
+const defaults: Dependencies = {
+  fetch: (url, init) => fetch(url, init),
+  now: () => performance.now(),
+  wallNow: () => Date.now(),
+  sleep: (ms) => Bun.sleep(ms),
+  random: Math.random,
+  log: (entry) => console.warn("Core bootstrap attempt failed", entry),
+};
+
+/** No application imports or listeners exist while this bounded startup request waits. */
+export const bootstrapConnections = async (
+  key: AppKey,
+  origin: string | undefined,
+  dependencies: Partial<Dependencies> = {},
+): Promise<BootstrapResponse> => {
+  const url = originUrl(origin);
+  const deps = { ...defaults, ...dependencies };
+  const deadline = deps.now() + BOOTSTRAP_BUDGET_MS;
+  let attempt = 0;
+  while (deps.now() < deadline) {
+    attempt++;
+    const controller = new AbortController();
+    let timer: ReturnType<typeof setTimeout> | undefined;
+    let failure: BootstrapError;
+    let httpFailure: BootstrapError | undefined;
+    try {
+      const transmission = async (): Promise<BootstrapResponse> => {
+        const proof = await signBootstrapProof(key, deps.wallNow()).catch(() => {
+          throw new BootstrapError("permanent", "could not create Ed25519 startup proof");
+        });
+        controller.signal.throwIfAborted();
+        const response = await deps.fetch(url, {
+          method: "POST",
+          headers: { Authorization: `Bearer ${proof}`, "Content-Type": "application/json", Accept: "application/json" },
+          body: BOOTSTRAP_BODY,
+          redirect: "error",
+          signal: controller.signal,
+        });
+        if (response.status !== 200) {
+          // A failed transmission may already have consumed its jti.
+          httpFailure = new BootstrapError(
+            response.status === 429 || response.status === 503 ? "transient" : "permanent",
+            httpReason(response.status),
+            retryAfter(response.headers.get("retry-after"), deps.wallNow()),
+          );
+          if (response.status === 403) {
+            try {
+              // Recognize only the stable permission code; never retain or log raw error payloads.
+              const body = await readResponse(response, controller.signal);
+              if (typeof body === "object" && body !== null && "code" in body && body.code === "connections_not_permitted")
+                httpFailure = new BootstrapError("permanent", "HTTP 403: connections_not_permitted; this key cannot receive connections");
+            } catch {
+              // A broken or stalled error body cannot turn a permanent HTTP status into a retry.
+            }
+          } else void response.body?.cancel().catch(() => undefined);
+          throw httpFailure;
+        }
+        const parsed = await readResponse(response, controller.signal);
+        const checked = BootstrapResponseSchema.safeParse(parsed);
+        if (!checked.success) throw new BootstrapError("permanent", "invalid response schema");
+        const { identity } = checked.data;
+        if (identity.installationId !== key.installationId) throw new BootstrapError("permanent", "wrong installation");
+        if (identity.appId !== key.appId) throw new BootstrapError("permanent", "wrong app");
+        if (identity.keyId !== key.keyId) throw new BootstrapError("permanent", "wrong key");
+        return checked.data;
+      };
+      return await Promise.race([
+        transmission(),
+        new Promise<never>((_, reject) => {
+          timer = setTimeout(
+            () => {
+              controller.abort();
+              reject(new BootstrapError("transient", "attempt deadline exceeded"));
+            },
+            Math.min(BOOTSTRAP_ATTEMPT_MS, Math.max(0, deadline - deps.now())),
+          );
+        }),
+      ]);
+    } catch (error) {
+      // Network/TLS/CA errors may embed credentials or destinations; never retain their text or cause.
+      const redirect = error instanceof TypeError && "code" in error && error.code === "UnexpectedRedirect";
+      failure =
+        httpFailure ??
+        (error instanceof BootstrapError
+          ? error
+          : redirect
+            ? new BootstrapError("permanent", "redirect refused; check the direct Core origin")
+            : new BootstrapError("transient", "network or TLS failure"));
+      deps.log({ appId: key.appId, attempt, errorClass: failure.kind });
+      if (failure.kind === "permanent") throw failure;
+    } finally {
+      clearTimeout(timer);
+      controller.abort();
+    }
+    // Full jitter, capped at the per-attempt deadline. Retry-After remains a minimum wait.
+    const delay = Math.max(failure.retryAfterMs, deps.random() * Math.min(BOOTSTRAP_ATTEMPT_MS, 250 * 2 ** Math.min(attempt - 1, 6)));
+    const remaining = deadline - deps.now();
+    if (delay >= remaining) break;
+    await deps.sleep(delay);
+  }
+  throw new BootstrapError("transient", "five-minute startup budget exhausted");
+};

package/src/runtime/bootstrap-protocol.ts

@@ -0,0 +1,67 @@
+/** Bootstrap v1 has no platform barrel or application dependencies. */
+import { SignJWT } from "jose";
+import { z } from "zod";
+import { type AppKey, importAppKeySeed } from "../app-key";
+import type { PlatformConnectionValues } from "./connections";
+
+export const BOOTSTRAP_PATH = "/_internal/apps/bootstrap";
+export const BOOTSTRAP_TYPE = "cloud-app+jwt";
+export const BOOTSTRAP_BODY = "{}";
+export const BOOTSTRAP_RESPONSE_BYTES = 64 * 1024;
+// Same compact-token budget as Cloud's identity protocols.
+export const BOOTSTRAP_PROOF_BYTES = 4 * 1024;
+export const BOOTSTRAP_BUDGET_MS = 5 * 60_000;
+export const BOOTSTRAP_ATTEMPT_MS = 10_000;
+export const BOOTSTRAP_PROOF_SECONDS = 30;
+export const BOOTSTRAP_REPLAY_RETENTION_SECONDS = 5 * 60;
+
+const nonempty = z.string().refine((value) => value.trim().length > 0);
+export const BootstrapIdentitySchema = z.object({ installationId: z.uuid(), appId: z.string(), keyId: z.uuid() }).strict();
+export type BootstrapIdentity = z.infer<typeof BootstrapIdentitySchema>;
+export const BootstrapConnectionsSchema = z
+  .object({
+    database: z.object({ url: nonempty }).strict(),
+    valkey: z.object({ url: nonempty }).strict(),
+    nats: z
+      .object({
+        servers: z.array(nonempty).nonempty(),
+        namespace: nonempty,
+        replicas: z.union([z.literal(1), z.literal(3), z.literal(5)]),
+        ignoreClusterUpdates: z.boolean(),
+        creds: nonempty.optional(),
+        ca: nonempty.optional(),
+      })
+      .strict(),
+    appSecret: z.object({ current: nonempty, previous: nonempty.optional(), next: nonempty.optional() }).strict(),
+  })
+  .strict() satisfies z.ZodType<PlatformConnectionValues>;
+export const BootstrapResponseSchema = z.object({ identity: BootstrapIdentitySchema, connections: BootstrapConnectionsSchema }).strict();
+export type BootstrapResponse = z.infer<typeof BootstrapResponseSchema>;
+
+export const bootstrapBodyDigest = async (body: Uint8Array<ArrayBuffer>): Promise<string> =>
+  Buffer.from(await crypto.subtle.digest("SHA-256", body)).toString("base64url");
+
+/** Call at the HTTP transmission seam, including every retry. */
+export const signAppProof = async (
+  key: AppKey,
+  request: { method: string; path: string; body: Uint8Array<ArrayBuffer> },
+  now = Date.now(),
+): Promise<string> => {
+  const iat = Math.floor(now / 1000);
+  return new SignJWT({
+    htm: request.method,
+    htu: request.path,
+    bdh: await bootstrapBodyDigest(request.body),
+  })
+    .setProtectedHeader({ alg: "EdDSA", typ: BOOTSTRAP_TYPE, kid: key.keyId })
+    .setIssuer(key.appId)
+    .setSubject(key.appId)
+    .setAudience(`cloud-core:${key.installationId}`)
+    .setIssuedAt(iat)
+    .setExpirationTime(iat + BOOTSTRAP_PROOF_SECONDS)
+    .setJti(crypto.randomUUID())
+    .sign(await importAppKeySeed(key.seed));
+};
+
+export const signBootstrapProof = (key: AppKey, now = Date.now()): Promise<string> =>
+  signAppProof(key, { method: "POST", path: BOOTSTRAP_PATH, body: new TextEncoder().encode(BOOTSTRAP_BODY) }, now);

package/src/runtime/clients.ts

@@ -1,6 +1,6 @@
 import { RedisClient, type RedisOptions, SQL } from "bun";
 import { postgresApplicationOptions } from "../_internal/postgres-application-name";
-import { connections, hasConnections } from "./connections";
+import { connections } from "./connections";
 
 export type SqlPoolOptions = SQL.PostgresOrMySQLOptions;
 
@@ -28,6 +28,8 @@ const notStarted = <T>(name: string): T => {
 
 export let sql: SQL = notStarted("sql");
 export let redis: RedisClient = notStarted("redis");
+// Whether `sql` and `redis` hold native clients; teardown must not touch the placeholders.
+let live = false;
 
 /** Own pool and lifecycle; defaults to the installation URL and application name. */
 export const createSql = (options: SqlPoolOptions = {}): SQL => {
@@ -55,6 +57,7 @@ export const initializeClients = async (): Promise<void> => {
     const valkey = createRedis();
     sql = database;
     redis = valkey;
+    live = true;
   } catch {
     await database.close();
     throw new Error("Valkey client configuration is invalid; check REDIS_URL and native Redis options");
@@ -63,7 +66,8 @@ export const initializeClients = async (): Promise<void> => {
 
 /** Internal test-target teardown, before a fixture selects a different database. */
 export const closePlatformClients = async (): Promise<void> => {
-  if (hasConnections()) {
+  if (live) {
+    live = false;
     await sql.close();
     redis.close();
   }

package/src/runtime/connections.ts

@@ -17,9 +17,18 @@ export type PlatformConnectionValues = {
 export type PlatformConnectionSources = {
   [Group in keyof PlatformConnectionValues]: { [Key in keyof PlatformConnectionValues[Group]]: ConnectionSource };
 };
+/** Credential-free capability metadata; absent on older processes means unknown. */
+export type PlatformBootstrapMetadata = {
+  keyId?: string;
+  mode: "core" | "env";
+  sources: PlatformConnectionSources;
+  keyFormat: "cloud-app-key-v1";
+  protocol: 1;
+};
 export type PlatformConnections = PlatformConnectionValues & {
   appId: string;
   sources: PlatformConnectionSources;
+  bootstrap?: PlatformBootstrapMetadata;
 };
 
 let current: PlatformConnections | undefined;

package/src/server/app-key.ts

@@ -0,0 +1,14 @@
+import { hkdfSync } from "node:crypto";
+import { getProcessApplicationId } from "../_internal/process-identity";
+import { validatePurposeName } from "../_internal/purpose-name";
+import { connections } from "../runtime/connections";
+
+/** Derive a purpose-specific signing key from this installation's current secret. */
+export const appKey = (name: string): string => {
+  validatePurposeName(name);
+  const appId = getProcessApplicationId();
+  if (!appId) throw new Error("Start the application before using appKey()");
+  const secret = connections().appSecret.current;
+  if (!secret.trim()) throw new Error("APP_SECRET is required to derive application signing keys");
+  return Buffer.from(hkdfSync("sha256", secret, appId, name, 32)).toString("base64url");
+};

package/src/server/index.ts

@@ -1,6 +1,7 @@
 export { buildMetadata } from "../_internal/build-metadata";
 export { loadPendingApprovals } from "../api/approvals-loader";
 export { geoClient } from "../capabilities/geo-client";
+export { appCaller } from "../capabilities/server-invoke";
 export { expectUserBackedActor, getUserBackedActor, isAppSessionActor, userFromActor } from "./actor";
 export type { ApiErrorBody, ApiErrorResponse, ApiErrorStatus } from "./api";
 export { api, respond, respondMessage } from "./api";
@@ -8,6 +9,7 @@ export type { CreateApiClientConfig } from "./api-client";
 export { api as apiClient } from "./api-client";
 export { appAssetPath } from "./app-assets";
 export type { AppContext } from "./app-context";
+export { appKey } from "./app-key";
 export { clientIp, clientIpBucket } from "./client-ip";
 export { defineHelp, defineHelpCollection, type HelpCollection, type HelpDefinition, type HelpDefinitionDocument } from "./help";
 export { DEFAULT_LOCALE, getLocale, LOCALE_COOKIE, LOCALE_HEADER, locale, preferredLocale, resolveLocale } from "./locale";

package/src/server/ratelimit.ts

@@ -1,5 +1,5 @@
 import { createHash } from "node:crypto";
-import { redis } from "bun";
+import { redis } from "../runtime/clients";
 
 /**
  * Sliding-window rate limiter on the Cloud Redis.

package/src/server/services/access.ts

@@ -1,7 +1,8 @@
 import { err, fail, ok, type Result } from "@k2b/stdlib";
-import { type SQLQuery, sql } from "bun";
+import type { SQLQuery } from "bun";
 import { type ManagerCandidate, removesLastManager } from "../../access/managers";
 import { accessMessages } from "../../access/messages";
+import { sql } from "../../runtime/clients";
 import { recursiveGroupIdsSubquery, recursiveServiceAccountGroupIdsSubquery } from "../../services/accounts/group-sql";
 import { toPgUuidArray } from "../../services/postgres";
 import type { ServiceAccountKind } from "../../services/service-accounts";

package/src/services/account-category-policy.ts

@@ -1,10 +1,10 @@
-import { sql } from "bun";
 import {
   type AccountCategory,
   type AccountCategoryPolicy,
   accountCategory,
   DEFAULT_ACCOUNT_CATEGORY_POLICY,
 } from "../contracts/account-categories";
+import { sql } from "../runtime/clients";
 import { decryptValue } from "./settings/crypto";
 
 const prefix = "user.category.";

package/src/services/account-lifecycle/audit.ts

@@ -1,5 +1,5 @@
-import { sql } from "bun";
 import type { UserProfile, UserProvider } from "../../contracts/shared";
+import { sql } from "../../runtime/clients";
 
 export type DeletedAccountReason =
   | "ipa_expired_demoted"

package/src/services/account-lifecycle/index.ts

@@ -1,5 +1,5 @@
-import { sql } from "bun";
 import type { User } from "../../contracts/shared";
+import { sql } from "../../runtime/clients";
 import { err, fail, freeipa, ok, type Result } from "../../server/services";
 import { dates } from "../../shared";
 import { getConfiguredExpiryDays, parseIpaAccountTransitionPolicy } from "../account-model";

package/src/services/account-lifecycle/ipa-backfill.ts

@@ -1,5 +1,6 @@
 import type { JobContext, PumpConfig, Sync } from "@k2b/sync";
-import { sql } from "bun";
+import { sql } from "../../runtime/clients";
+
 import { freeipa } from "../../server/services/freeipa";
 import { getConfiguredExpiryDays } from "../account-model";
 import { getFreeIpaConfig } from "../freeipa-config";

package/src/services/accounts/app.ts

@@ -1,4 +1,3 @@
-import { sql } from "bun";
 import { accountCategory } from "../../contracts/account-categories";
 import type { PersonAvatar } from "../../contracts/avatar";
 import type {
@@ -14,6 +13,7 @@ import type {
   UserProfile,
   UserProvider,
 } from "../../contracts/shared";
+import { sql } from "../../runtime/clients";
 import type { ServiceAccountRequestActor } from "../../server/middleware/auth";
 import {
   err,

package/src/services/accounts/avatar.ts

@@ -1,5 +1,4 @@
 import { createHash } from "node:crypto";
-import { sql } from "bun";
 import {
   type AvatarConfig,
   type AvatarKind,
@@ -12,6 +11,7 @@ import {
 } from "../../contracts/avatar";
 import { MAX_AVATAR_BYTES, MAX_AVATAR_DATA_URL_LENGTH } from "../../contracts/profile";
 import type { MutationResult } from "../../contracts/shared";
+import { sql } from "../../runtime/clients";
 import { AVATAR_RENDERER_REVISION, renderAvatarSvg } from "../../shared/avatar-art";
 import { stripImageMetadata } from "../image-metadata";
 

package/src/services/accounts/base-group.ts

@@ -1,5 +1,5 @@
-import { sql } from "bun";
 import type { BaseGroup, UserProvider } from "../../contracts/shared";
+import { sql } from "../../runtime/clients";
 
 type DbRow = Record<string, unknown>;
 

package/src/services/accounts/directory-shares.ts

@@ -1,7 +1,7 @@
 import { err, fail, ok, type Result } from "@k2b/stdlib";
-import { sql } from "bun";
 import { z } from "zod";
 import type { User } from "../../contracts/shared";
+import { sql } from "../../runtime/clients";
 import type { RequestActor } from "../../server/middleware/auth";
 import { audit } from "../audit";
 

package/src/services/accounts/duplicate-emails.ts

@@ -1,6 +1,6 @@
 import { err, fail, ok, type PageParams, type Paginated, paginate, type Result } from "@k2b/stdlib";
-import { sql } from "bun";
 import type { User } from "../../contracts/shared";
+import { sql } from "../../runtime/clients";
 import { type AccountsActor, isAdminActor } from "./authz";
 
 export type DuplicateEmailUser = Pick<

package/src/services/accounts/entities.ts

@@ -1,5 +1,6 @@
-import { type SQLQuery, sql } from "bun";
+import type { SQLQuery } from "bun";
 import type { EntityKind, EntityListItem, UserProfile, UserProvider } from "../../contracts/shared";
+import { sql } from "../../runtime/clients";
 import { getFreeIpaConfig } from "../freeipa-config";
 import { escapeLikePattern, toPgTextArray, toPgUuidArray } from "../postgres";
 import type { ServiceAccountKind, ServiceAccountStatus } from "../service-accounts";

package/src/services/accounts/group-sql.ts

@@ -1,4 +1,5 @@
-import { type SQLQuery, sql } from "bun";
+import type { SQLQuery } from "bun";
+import { sql } from "../../runtime/clients";
 
 type SqlFragment = SQLQuery;
 type SqlValue = SQLQuery | string;

package/src/services/accounts/groups.ts

@@ -1,5 +1,5 @@
-import { sql } from "bun";
 import type { BaseGroup, GroupMember, MutationResult, UserProvider } from "../../contracts/shared";
+import { sql } from "../../runtime/clients";
 import { freeipa } from "../../server/services";
 import { getServiceIpaSession } from "../ipa/service-account";
 import { toPgUuidArray } from "../postgres";

package/src/services/accounts/identities.ts

@@ -1,7 +1,8 @@
-import { type SQLQuery, sql } from "bun";
+import type { SQLQuery } from "bun";
 import { z } from "zod";
 import { DEFAULT_LINUX_IDENTITY_CONFIGURATION, LinuxIdentityConfigurationSchema } from "../../contracts/posix";
 import type { RequestActor, UserProfile, UserProvider } from "../../contracts/shared";
+import { sql } from "../../runtime/clients";
 import { userFromActor } from "../../server/actor";
 import { isAccountCategoryAllowed } from "../account-category-policy";
 import { toPgTextArray } from "../postgres";
@@ -66,9 +67,10 @@ const cursor = (after?: string): string | null => {
 };
 
 /** Server-side identity reads. Authentication and application resource authorization remain caller-owned. */
-export const createAccountIdentityService = (db: typeof sql = sql, upstreamIdentity = readUpstreamIdentity) => {
+export const createAccountIdentityService = (injectedDb?: typeof sql, upstreamIdentity = readUpstreamIdentity) => {
+  const db = () => injectedDb ?? sql;
   const setting = async (key: string, fallback: unknown): Promise<unknown> => {
-    const [row] = await db<{ value: string }[]>`SELECT value FROM settings.entries WHERE key = ${key}`;
+    const [row] = await db()<{ value: string }[]>`SELECT value FROM settings.entries WHERE key = ${key}`;
     return row ? decryptValue(row.value) : fallback;
   };
   const availability = async (): Promise<AccountIdentityAvailability> => {
@@ -84,7 +86,7 @@ export const createAccountIdentityService = (db: typeof sql = sql, upstreamIdent
       throw new AccountIdentityError("invalid_identity_configuration");
     }
   };
-  const userRows = (filter: SQLQuery) => db<UserRow[]>`
+  const userRows = (filter: SQLQuery) => db()<UserRow[]>`
     SELECT u.id, u.provider, u.uid, u.profile, u.admin,
       (u.account_expires IS NOT NULL AND u.account_expires <= now()) AS expired,
       p.managed_by, p.uid_number, p.primary_gid_number
@@ -98,7 +100,7 @@ export const createAccountIdentityService = (db: typeof sql = sql, upstreamIdent
     const [row] = await userRows(sql`u.id = ${supplied.id}::uuid`);
     if (!row || row.expired || row.provider !== supplied.provider || row.uid !== supplied.uid || row.profile !== supplied.profile)
       throw new AccountIdentityError("identity_unavailable");
-    if (!(await isAccountCategoryAllowed(row, db))) throw new AccountIdentityError("identity_unavailable");
+    if (!(await isAccountCategoryAllowed(row, db()))) throw new AccountIdentityError("identity_unavailable");
     const state = await availability();
     if (row.provider === "ipa" && !state.freeipaEnabled) throw new AccountIdentityError("identity_unavailable");
     return { row, state, supplied };
@@ -113,14 +115,14 @@ export const createAccountIdentityService = (db: typeof sql = sql, upstreamIdent
       if (!Array.isArray(configured) || !configured.every((value): value is string => typeof value === "string"))
         throw new AccountIdentityError("invalid_identity_configuration");
       const names = configured.length > 0 ? configured : ["admins"];
-      const [membership] = await db`SELECT 1 FROM auth.ipa_user_effective_groups
+      const [membership] = await db()`SELECT 1 FROM auth.ipa_user_effective_groups
         WHERE user_id = ${current.row.id}::uuid AND group_name = ANY(${toPgTextArray(names)}::text[]) LIMIT 1`;
       if (!membership) throw new AccountIdentityError("admin_required");
     }
     return current;
   };
   const groupRows = async (filter: SQLQuery) => {
-    const rows = await db<{ id: string; provider: UserProvider; name: string; gid_number: number | null; personal: boolean }[]>`
+    const rows = await db()<{ id: string; provider: UserProvider; name: string; gid_number: number | null; personal: boolean }[]>`
       SELECT g.id, g.provider, g.name, g.gid_number,
         EXISTS(SELECT 1 FROM auth.personal_groups p WHERE p.group_id = g.id) AS personal
       FROM auth.groups g
@@ -189,7 +191,7 @@ export const createAccountIdentityService = (db: typeof sql = sql, upstreamIdent
         eligible: current.profile === "user",
       };
     }
-    const [ownership] = await db<{ personal: boolean }[]>`SELECT EXISTS (
+    const [ownership] = await db()<{ personal: boolean }[]>`SELECT EXISTS (
       SELECT 1 FROM auth.personal_groups p
       WHERE (${input.identityId ?? null}::uuid IS NOT NULL AND p.group_id = ${input.identityId ?? null}::uuid)
          OR (${input.identityId ?? null}::uuid IS NULL AND p.group_name = ${input.name})
@@ -238,10 +240,10 @@ export const createAccountIdentityService = (db: typeof sql = sql, upstreamIdent
       const after = cursor(input.after);
       const state = await availability();
       const [localAllowed, ipaAllowed] = await Promise.all([
-        isAccountCategoryAllowed({ provider: "local", profile: "user" }, db),
-        isAccountCategoryAllowed({ provider: "ipa", profile: "user" }, db),
+        isAccountCategoryAllowed({ provider: "local", profile: "user" }, db()),
+        isAccountCategoryAllowed({ provider: "ipa", profile: "user" }, db()),
       ]);
-      const rows = await db<
+      const rows = await db()<
         {
           id: string;
           provider: UserProvider;

package/src/services/accounts/ipa-data.ts

@@ -1,5 +1,5 @@
-import { sql } from "bun";
 import type { IpaUserData } from "../../contracts/shared";
+import { sql } from "../../runtime/clients";
 
 type DbRow = Record<string, unknown>;
 

package/src/services/accounts/local-groups.ts

@@ -1,5 +1,6 @@
-import { sql, type TransactionSQL } from "bun";
+import type { TransactionSQL } from "bun";
 import type { BaseGroup, GroupMember, MutationResult, UserProvider } from "../../contracts/shared";
+import { sql } from "../../runtime/clients";
 import { escapeLikePattern, isUniqueViolation } from "../postgres";
 import { buildBaseGroup, personalOwnerJoin } from "./base-group";
 import { recursiveServiceAccountGroupIdsSubquery } from "./group-sql";

package/src/services/accounts/machine-group-management.ts

@@ -1,4 +1,5 @@
-import { sql } from "bun";
+import { sql } from "../../runtime/clients";
+
 import type { ServiceAccountRequestActor } from "../../server/middleware/auth";
 import { err, fail, ok, type Result } from "../../server/services";
 import { audit } from "../audit";