@k2b/cloud 0.47.0 → 0.49.0

package/src/services/accounts/posix.ts

@@ -1,4 +1,3 @@
-import { sql } from "bun";
 import {
   DEFAULT_LINUX_IDENTITY_CONFIGURATION,
   isPosixName,
@@ -8,6 +7,7 @@ import {
   PosixOverridesSchema,
 } from "../../contracts/posix";
 import type { MutationResult } from "../../contracts/shared";
+import { sql } from "../../runtime/clients";
 import { freeipa } from "../../server/services";
 import { type AuditActor, audit } from "../audit";
 import { getFreeIpaConfig } from "../freeipa-config";
@@ -128,8 +128,9 @@ const candidate = (row: IdentityRow): PosixCandidate => {
 };
 
 // Database injection is used by isolated integration tests; production uses the shared pool.
-export const createPosixRuntime = (db: typeof sql = sql, readRanges = readIpaIdRanges) => {
-  const readConfig = async (connection = db): Promise<LinuxIdentityConfiguration> => {
+export const createPosixRuntime = (injectedDb?: typeof sql, readRanges = readIpaIdRanges) => {
+  const db = () => injectedDb ?? sql;
+  const readConfig = async (connection = db()): Promise<LinuxIdentityConfiguration> => {
     // Provisioning must not use a stale cache after an operator disables or changes the range.
     const [row] = await connection<{ value: string }[]>`SELECT value FROM settings.entries WHERE key = ${CONFIG_KEY}`;
     try {
@@ -256,7 +257,7 @@ export const createPosixRuntime = (db: typeof sql = sql, readRanges = readIpaIdR
     actor?: AuditActor,
   ): Promise<MutationResult<{ id: string }>> => {
     try {
-      return await db.begin(async (tx) => {
+      return await db().begin(async (tx) => {
         await lock(tx);
         const result = await write(tx);
         if (!result.ok) return result;
@@ -316,13 +317,13 @@ export const createPosixRuntime = (db: typeof sql = sql, readRanges = readIpaIdR
     },
     async overview(actor: Actor, after: string | null = null, filters: { search?: string; scope?: "ready" | "all" } = {}) {
       requireAdmin(actor);
-      const result = await rows(db, null, after, filters);
+      const result = await rows(db(), null, after, filters);
       const items = result.slice(0, POSIX_PAGE_SIZE).map(candidate);
       return { config: await service.configuration(actor), items, nextCursor: result.length > POSIX_PAGE_SIZE ? items.at(-1)!.id : null };
     },
     async get(actor: Actor, id: string) {
       requireAdmin(actor);
-      const [row] = await rows(db, id, null);
+      const [row] = await rows(db(), id, null);
       if (!row) throw new PosixError("user_not_found", 404);
       return { config: await readConfig(), user: candidate(row) };
     },
@@ -331,7 +332,7 @@ export const createPosixRuntime = (db: typeof sql = sql, readRanges = readIpaIdR
       const parsed = LinuxIdentityConfigurationSchema.safeParse(input);
       if (!parsed.success) throw new PosixError("invalid_configuration", 400);
       const ranges = parsed.data.enabled ? await readRanges() : [];
-      await db.begin(async (tx) => {
+      await db().begin(async (tx) => {
         // Same order as provisioning; settings write upgrades this lock in the same transaction.
         await lock(tx);
         if (options?.replaceUnreadable !== true) {
@@ -360,7 +361,7 @@ export const createPosixRuntime = (db: typeof sql = sql, readRanges = readIpaIdR
     },
     async provision(actor: Actor, id: string) {
       requireAdmin(actor);
-      return db.begin(async (tx) => {
+      return db().begin(async (tx) => {
         await lock(tx);
         const config = await readConfig(tx);
         if (!config.enabled) throw new PosixError("setup_disabled");
@@ -371,7 +372,7 @@ export const createPosixRuntime = (db: typeof sql = sql, readRanges = readIpaIdR
       requireAdmin(actor);
       const parsed = PosixOverridesSchema.safeParse(input);
       if (!parsed.success) throw new PosixError("invalid_paths", 400);
-      return db.begin(async (tx) => {
+      return db().begin(async (tx) => {
         await lock(tx);
         const [row] = await rows(tx, id, null);
         if (!row) throw new PosixError("user_not_found", 404);
@@ -394,7 +395,7 @@ export const createPosixRuntime = (db: typeof sql = sql, readRanges = readIpaIdR
     async createGroup(actor: Actor, input: { name: string; description?: string }) {
       requireAdmin(actor);
       const ranges = await readRanges();
-      return db.begin(async (tx) => {
+      return db().begin(async (tx) => {
         await lock(tx);
         const created = await createLocalGroup(input, tx);
         if (!created.ok) throw new PosixError("group_conflict");
@@ -405,7 +406,7 @@ export const createPosixRuntime = (db: typeof sql = sql, readRanges = readIpaIdR
     async provisionGroup(actor: Actor, id: string) {
       requireAdmin(actor);
       const ranges = await readRanges();
-      return db.begin(async (tx) => {
+      return db().begin(async (tx) => {
         await lock(tx);
         return assignGroup(tx, actor, id, ranges);
       });
@@ -413,5 +414,5 @@ export const createPosixRuntime = (db: typeof sql = sql, readRanges = readIpaIdR
   };
   return { service, writeLocalAccount };
 };
-export const createPosixService = (db: typeof sql = sql, readRanges = readIpaIdRanges) => createPosixRuntime(db, readRanges).service;
+export const createPosixService = (db?: typeof sql, readRanges = readIpaIdRanges) => createPosixRuntime(db, readRanges).service;
 export const { service: posix, writeLocalAccount } = createPosixRuntime();

package/src/services/accounts/request-policy.ts

@@ -1,4 +1,5 @@
-import { sql } from "bun";
+import { sql } from "../../runtime/clients";
+
 import { decryptValue } from "../settings/crypto";
 
 /** Read durable policy so disabling new requests is not delayed by the settings cache. */

package/src/services/accounts/switching.ts

@@ -1,5 +1,5 @@
-import { sql } from "bun";
 import type { UserProfile, UserProvider } from "../../contracts/shared";
+import { sql } from "../../runtime/clients";
 import * as settings from "../settings";
 import type { IpaAccountTransitionPolicy } from "./model";
 

package/src/services/accounts/users.ts

@@ -1,4 +1,4 @@
-import { type SQL, sql } from "bun";
+import type { SQL } from "bun";
 import type {
   BaseUser,
   MutationResult,
@@ -9,6 +9,7 @@ import type {
   UserProfile,
   UserProvider,
 } from "../../contracts/shared";
+import { sql } from "../../runtime/clients";
 import { freeipa } from "../../server/services";
 import { createAuthLoginUrl } from "../../shared/redirect";
 import { isAccountCategoryAllowed } from "../account-category-policy";

package/src/services/announcements/index.ts

@@ -1,5 +1,4 @@
 import { err, fail, ok, type Result } from "@k2b/stdlib";
-import { sql } from "bun";
 import { HTTPException } from "hono/http-exception";
 import { z } from "zod";
 import type {
@@ -11,6 +10,7 @@ import type {
 } from "../../contracts/announcements";
 import { AnnouncementDisplayEntrySchema } from "../../contracts/announcements";
 import { hasRole, type User } from "../../contracts/shared";
+import { sql } from "../../runtime/clients";
 import { markdown } from "../../shared/markdown";
 import { claimCacheFill, completeCacheFill } from "../cache-fill";
 import { logger } from "../logging";

package/src/services/app-access-management.ts

@@ -1,7 +1,9 @@
-import { type SQL, sql } from "bun";
+import type { SQL } from "bun";
+import { managerEligibility } from "../_internal/app-access-manager-sql";
 import type { AppMeta } from "../contracts/app";
 import type { AppAccessDeclaration, AppAccessSnapshot } from "../contracts/app-access";
 import { publishAppAccessChanged, wakeAppAccessChanged } from "../events/app-access";
+import { sql } from "../runtime/clients";
 import { isAppSessionActor, userFromActor } from "../server/actor";
 import type { RequestAuthority } from "../server/middleware/auth";
 import {
@@ -107,14 +109,6 @@ const listEntries = async (appId: string, db: SQL = sql): Promise<AccessEntry[]>
             : { type: "public" },
   }));
 };
-/** Shared eligibility predicate for the last-manager guard and its presentation. */
-const managerEligibility = (db: SQL) => db`
-  EXISTS (SELECT 1 FROM auth.users u WHERE (u.account_expires IS NULL OR u.account_expires > now()) AND
-    (u.id = a.user_id OR (a.group_id IS NOT NULL AND a.group_id IN (${recursiveGroupIdsSubquery(db`u.id`)}))))
-  OR EXISTS (SELECT 1 FROM auth.service_accounts sa WHERE sa.id = a.service_account_id
-    AND sa.status = 'active' AND sa.kind IN ('standalone', 'agent'))
-`;
-
 const entryPresentation = async (appId: string): Promise<Map<string, { groupMemberCount?: number; effectiveManager: boolean }>> => {
   const rows = await sql<{ id: string; group_member_count: number | null; effective_manager: boolean }[]>`
     SELECT a.id,

package/src/services/app-access.ts

@@ -1,8 +1,9 @@
-import { type SQL, sql } from "bun";
+import type { SQL } from "bun";
 import type { Context } from "hono";
 import { RESOURCE_ACCESS_TIMEOUT_MS, resourceAppAccess } from "../_internal/app-access-resources";
 import type { AppMeta } from "../contracts/app";
 import { AppAccessRuleSchema, type FixedAppAccessRule } from "../contracts/app-access";
+import { sql } from "../runtime/clients";
 import { userFromActor } from "../server/actor";
 import { type AuthContext, auth, type RequestAuthority } from "../server/middleware/auth";
 import { buildAccessPrincipalCondition } from "../server/services/access";

package/src/services/app-admin-facts.ts

@@ -0,0 +1,160 @@
+import { managerEligibility } from "../_internal/app-access-manager-sql";
+import { sql } from "../runtime/clients";
+import type { RequestAuthority } from "../server/middleware/auth";
+import { AppAccessManagementError, canRepairAppAccess } from "./app-access-management";
+
+export type AppAdminFacts = {
+  access: { people: number; groups: number; serviceAccounts: number; managers: number; configured: boolean } | null;
+  keys: {
+    active: number;
+    expired: number;
+    revoked: number;
+    lastUsedAt: string | null;
+    firstCreatedAt: string | null;
+    accountStatus: "active" | "disabled" | null;
+  };
+  tokens: { active: number; total: number };
+  events: { hears: number; sends: number | null; failedDeliveries: number; waitingDeliveries: number };
+  notifications: number | null;
+  firstKnownAt: string | null;
+};
+
+/** Core-owned administration summary: at most 500 input IDs and four batched SQL reads. */
+export const appAdminFacts = async (authority: RequestAuthority, appIds: readonly string[]): Promise<Map<string, AppAdminFacts>> => {
+  if (!canRepairAppAccess(authority)) throw new AppAccessManagementError("FORBIDDEN", "Cloud administration authority is required.");
+  if (appIds.length > 500) throw new AppAccessManagementError("TOO_MANY_APPS", "At most 500 application IDs may be read at once.", 400);
+  const ids = [...new Set(appIds)];
+  const facts = new Map<string, AppAdminFacts>(
+    ids.map((id) => [
+      id,
+      {
+        access: null,
+        keys: { active: 0, expired: 0, revoked: 0, lastUsedAt: null, firstCreatedAt: null, accountStatus: null },
+        tokens: { active: 0, total: 0 },
+        events: { hears: 0, sends: 0, failedDeliveries: 0, waitingDeliveries: 0 },
+        notifications: 0,
+        firstKnownAt: null,
+      },
+    ]),
+  );
+  if (!ids.length) return facts;
+
+  const [access, credentials, events, notifications] = await Promise.all([
+    sql<
+      {
+        app_id: string;
+        people: number;
+        groups: number;
+        service_accounts: number;
+        managers: number;
+        configured: boolean;
+        first_known_at: Date | null;
+      }[]
+    >`
+      SELECT COALESCE(aa.app_id, s.app_id) AS app_id,
+        count(a.user_id)::int AS people, count(a.group_id)::int AS groups,
+        count(a.service_account_id)::int AS service_accounts,
+        count(*) FILTER (WHERE a.permission = 'admin' AND (${managerEligibility(sql)}))::int AS managers,
+        s.configured_at IS NOT NULL AS configured,
+        LEAST(min(a.created_at), s.configured_at) AS first_known_at
+      FROM auth.app_access aa
+      FULL JOIN auth.app_access_state s ON s.app_id = aa.app_id
+      LEFT JOIN auth.access a ON a.id = aa.access_id
+      WHERE COALESCE(aa.app_id, s.app_id) IN ${sql(ids)}
+      GROUP BY aa.app_id, s.app_id, s.configured_at
+    `,
+    sql<
+      {
+        app_id: string;
+        active: number;
+        expired: number;
+        revoked: number;
+        last_used_at: Date | null;
+        first_created_at: Date | null;
+        account_status: "active" | "disabled";
+        active_tokens: number;
+        total_tokens: number;
+        first_known_at: Date;
+      }[]
+    >`
+      WITH accounts AS (
+        SELECT id, app_id, status, created_at FROM auth.service_accounts
+        WHERE kind = 'resource_bound' AND resource_type = 'cloud.app' AND resource_id = app_id
+          AND app_id IN ${sql(ids)}
+      ), canonical_accounts AS (
+        SELECT DISTINCT ON (app_id) app_id, status FROM accounts ORDER BY app_id, created_at, id
+      )
+      SELECT sa.app_id,
+        count(*) FILTER (WHERE c.kind = 'app_key' AND c.status = 'active'
+          AND (c.expires_at IS NULL OR c.expires_at > now()))::int AS active,
+        count(*) FILTER (WHERE c.kind = 'app_key' AND c.status <> 'revoked' AND c.expires_at <= now())::int AS expired,
+        count(*) FILTER (WHERE c.kind = 'app_key' AND c.status = 'revoked')::int AS revoked,
+        max(c.last_used_at) FILTER (WHERE c.kind = 'app_key') AS last_used_at,
+        min(c.created_at) FILTER (WHERE c.kind = 'app_key') AS first_created_at,
+        canonical.status AS account_status,
+        count(*) FILTER (WHERE c.kind <> 'app_key' AND c.status = 'active'
+          AND (c.expires_at IS NULL OR c.expires_at > now()))::int AS active_tokens,
+        count(*) FILTER (WHERE c.kind <> 'app_key')::int AS total_tokens,
+        LEAST(min(sa.created_at), min(c.created_at)) AS first_known_at
+      FROM accounts sa
+      JOIN canonical_accounts canonical ON canonical.app_id = sa.app_id
+      LEFT JOIN auth.service_account_credentials c ON c.service_account_id = sa.id
+      GROUP BY sa.app_id, canonical.status
+    `,
+    sql<{ app_id: string; hears: number; sends: number; failed: number; waiting: number }[]>`
+      WITH subscriptions AS (
+        SELECT app_id, count(*) FILTER (WHERE state = 'active')::int AS hears
+        FROM events.app_subscriptions WHERE app_id IN ${sql(ids)} GROUP BY app_id
+      ), declarations AS (
+        SELECT app_id, count(*)::int AS sends
+        FROM events.app_declarations WHERE app_id IN ${sql(ids)} AND retired_at IS NULL GROUP BY app_id
+      ), deliveries AS (
+        SELECT subscription.app_id, count(*) FILTER (WHERE delivery.state = 'failed')::int AS failed,
+          count(*) FILTER (WHERE delivery.state IN ('pending', 'retrying'))::int AS waiting
+        FROM events.app_subscriptions subscription
+        JOIN events.app_deliveries delivery ON delivery.subscription_id = subscription.id
+        WHERE subscription.app_id IN ${sql(ids)} AND delivery.state IN ('failed', 'pending', 'retrying')
+        GROUP BY subscription.app_id
+      )
+      SELECT COALESCE(s.app_id, d.app_id, f.app_id) AS app_id, COALESCE(s.hears, 0) AS hears,
+        COALESCE(d.sends, 0) AS sends, COALESCE(f.failed, 0) AS failed, COALESCE(f.waiting, 0) AS waiting
+      FROM subscriptions s FULL JOIN declarations d ON d.app_id = s.app_id
+      FULL JOIN deliveries f ON f.app_id = COALESCE(s.app_id, d.app_id)
+    `,
+    sql<{ app_id: string; count: number }[]>`
+      SELECT app_id, count(*)::int AS count FROM notifications.definitions
+      WHERE app_id IN ${sql(ids)} AND active = true GROUP BY app_id
+    `,
+  ]);
+
+  for (const row of access) {
+    const fact = facts.get(row.app_id)!;
+    fact.access = {
+      people: row.people,
+      groups: row.groups,
+      serviceAccounts: row.service_accounts,
+      managers: row.managers,
+      configured: row.configured,
+    };
+    fact.firstKnownAt = row.first_known_at?.toISOString() ?? null;
+  }
+  for (const row of credentials) {
+    const fact = facts.get(row.app_id)!;
+    fact.keys = {
+      active: row.active,
+      expired: row.expired,
+      revoked: row.revoked,
+      lastUsedAt: row.last_used_at?.toISOString() ?? null,
+      firstCreatedAt: row.first_created_at?.toISOString() ?? null,
+      accountStatus: row.account_status,
+    };
+    fact.tokens = { active: row.active_tokens, total: row.total_tokens };
+    const firstKnownAt = row.first_known_at.toISOString();
+    if (fact.firstKnownAt === null || firstKnownAt < fact.firstKnownAt) fact.firstKnownAt = firstKnownAt;
+  }
+  for (const row of events) {
+    facts.get(row.app_id)!.events = { hears: row.hears, sends: row.sends, failedDeliveries: row.failed, waitingDeliveries: row.waiting };
+  }
+  for (const row of notifications) facts.get(row.app_id)!.notifications = row.count;
+  return facts;
+};

package/src/services/app-approval.ts

@@ -1,4 +1,4 @@
-import { type SQL, sql } from "bun";
+import type { SQL } from "bun";
 import type { z } from "zod";
 import { lazySync } from "../_internal/process-sync";
 import { env } from "../config/env";
@@ -25,6 +25,7 @@ import {
   appPairingProofMessage,
   APP_APPROVAL_LIMITS as limits,
 } from "../contracts/app-approval";
+import { sql } from "../runtime/clients";
 import { addressPrefix } from "../server/request-context/address";
 import { publicCloudOrigin } from "../shared/app-url";
 import { isAccountCategoryAllowed } from "./account-category-policy";
@@ -296,12 +297,13 @@ const verify = async (key: AppDevicePublicKey, message: string, signature: strin
 /** One owner for production API and isolated HTTP consumers. Config is re-read
  * per operation; SQL transactions serialize device decisions and revocation. */
 export const createAppApprovalService = (
-  db: SQL = sql,
-  configuration = (requireEnabled = true) => readAppApprovalConfig(db, requireEnabled),
+  injectedDb?: SQL,
+  configuration = (requireEnabled = true) => readAppApprovalConfig(injectedDb ?? sql, requireEnabled),
   hints: AppLoginDecisionHints = syncLoginDecisionHints,
   push: AppLoginPushSender = fetchPushSender,
   addresses: AppLoginAddressStore = valkeyAppLoginAddressStore,
 ) => {
+  const db = () => injectedDb ?? sql;
   // Error messages may contain their inputs; log only the error class, never addresses or proofs.
   const addressFailure = (error: unknown) =>
     log.warn("App login address hint unavailable", { error: error instanceof Error ? error.name : "UnknownError" });
@@ -332,12 +334,12 @@ export const createAppApprovalService = (
   const cleanup = async () => {
     // Bounded opportunistic maintenance: each accepted write retires up to 100
     // expired rows per table, so bursts cannot trigger an unbounded sweep.
-    await db`DELETE FROM auth.app_device_changes WHERE id IN (SELECT id FROM auth.app_device_changes WHERE expires_at < now() - interval '1 minute' ORDER BY expires_at LIMIT 100 FOR UPDATE SKIP LOCKED)`;
-    await db`DELETE FROM auth.app_pairings WHERE id IN (SELECT p.id FROM auth.app_pairings p
+    await db()`DELETE FROM auth.app_device_changes WHERE id IN (SELECT id FROM auth.app_device_changes WHERE expires_at < now() - interval '1 minute' ORDER BY expires_at LIMIT 100 FOR UPDATE SKIP LOCKED)`;
+    await db()`DELETE FROM auth.app_pairings WHERE id IN (SELECT p.id FROM auth.app_pairings p
       WHERE p.expires_at < now() - interval '1 minute' AND NOT EXISTS (SELECT 1 FROM auth.app_device_changes c WHERE c.pairing_id=p.id)
       ORDER BY p.expires_at LIMIT 100 FOR UPDATE SKIP LOCKED)`;
-    await db`DELETE FROM auth.app_logins WHERE id IN (SELECT id FROM auth.app_logins WHERE expires_at < now() AND NOT (kind='terminal' AND state='approved') ORDER BY expires_at LIMIT 100 FOR UPDATE SKIP LOCKED)`;
-    await db`DELETE FROM auth.app_device_proofs WHERE (device_id,jti) IN (SELECT device_id,jti FROM auth.app_device_proofs WHERE expires_at < now() ORDER BY expires_at LIMIT 100 FOR UPDATE SKIP LOCKED)`;
+    await db()`DELETE FROM auth.app_logins WHERE id IN (SELECT id FROM auth.app_logins WHERE expires_at < now() AND NOT (kind='terminal' AND state='approved') ORDER BY expires_at LIMIT 100 FOR UPDATE SKIP LOCKED)`;
+    await db()`DELETE FROM auth.app_device_proofs WHERE (device_id,jti) IN (SELECT device_id,jti FROM auth.app_device_proofs WHERE expires_at < now() ORDER BY expires_at LIMIT 100 FOR UPDATE SKIP LOCKED)`;
   };
   const pairingOwner = async (tx: SQL, actor: AppApprovalActor, pairing: PairingRow, cfg: AppApprovalConfig) => {
     if (
@@ -409,7 +411,7 @@ export const createAppApprovalService = (
     if (!cfg.enabled || !cfg.appOrigin) return;
     try {
       // A withdrawn device change keeps its window, so withdrawing and asking again cannot push without bound.
-      const rows = await db<{ push_token: string }[]>`
+      const rows = await db()<{ push_token: string }[]>`
         UPDATE auth.app_devices d SET login_wake_at=now(), login_wake_ref=${requestId}::uuid
         WHERE issuer=${cfg.issuer} AND user_id=${userId}::uuid AND revoked_at IS NULL AND push_token IS NOT NULL
           AND (${options?.accept ?? null}::text IS NULL OR ${options?.accept ?? null}::text=ANY(d.accepts))
@@ -423,7 +425,7 @@ export const createAppApprovalService = (
         Array.from(new Set(rows.map((row) => row.push_token)), async (token) => {
           const status = await push(cfg.appOrigin, { token, cloudOrigin: cfg.issuer, requestRef: requestId });
           if (status === 410)
-            await db`UPDATE auth.app_devices SET push_token=NULL WHERE issuer=${cfg.issuer} AND user_id=${userId}::uuid AND push_token=${token}`;
+            await db()`UPDATE auth.app_devices SET push_token=NULL WHERE issuer=${cfg.issuer} AND user_id=${userId}::uuid AND push_token=${token}`;
         }),
       );
     } catch (error) {
@@ -463,7 +465,7 @@ export const createAppApprovalService = (
       try {
         const cfg = await config(false);
         if (!cfg.enabled || !cfg.appOrigin) return;
-        const rows = await db<{ push_token: string; user_id: string }[]>`
+        const rows = await db()<{ push_token: string; user_id: string }[]>`
           UPDATE auth.app_devices d SET action_wake_at=now(), action_wake_ref=${approvalId}::uuid
           WHERE d.id IN (
             SELECT device.id FROM auth.app_devices device JOIN approvals.requests r ON r.approver_user_id=device.user_id
@@ -483,7 +485,7 @@ export const createAppApprovalService = (
           Array.from(tokens, async ([token, userId]) => {
             const status = await push(cfg.appOrigin, { token, cloudOrigin: cfg.issuer, requestRef: approvalId, kind: "action" });
             if (status === 410)
-              await db`UPDATE auth.app_devices SET push_token=NULL WHERE issuer=${cfg.issuer} AND user_id=${userId}::uuid AND push_token=${token}`;
+              await db()`UPDATE auth.app_devices SET push_token=NULL WHERE issuer=${cfg.issuer} AND user_id=${userId}::uuid AND push_token=${token}`;
           }),
         );
       } catch (error) {
@@ -492,7 +494,7 @@ export const createAppApprovalService = (
     },
     maintain: async (notify: (notice: AppDeviceEnrollmentNotice) => Promise<unknown>, signal?: AbortSignal) => {
       await cleanup();
-      const rows = await db<(DeviceRow & { has_email: boolean })[]>`
+      const rows = await db()<(DeviceRow & { has_email: boolean })[]>`
         SELECT d.*, COALESCE(btrim(u.mail), '') <> '' AS has_email
         FROM auth.app_devices d JOIN auth.users u ON u.id = d.user_id
         WHERE d.notified_at IS NULL ORDER BY d.created_at LIMIT ${limits.pageSize}`;
@@ -503,7 +505,7 @@ export const createAppApprovalService = (
         // The notice is email-only, so an account without email relies on the
         // enrollment audit entry instead of a delivery that can only fail.
         if (row.has_email) await notify({ deviceId: row.id, userId: row.user_id, name: row.name, assisted: row.assisted });
-        await db`UPDATE auth.app_devices SET notified_at=now() WHERE id=${row.id}::uuid AND notified_at IS NULL`;
+        await db()`UPDATE auth.app_devices SET notified_at=now() WHERE id=${row.id}::uuid AND notified_at IS NULL`;
       }
     },
     info: async () => {
@@ -524,7 +526,7 @@ export const createAppApprovalService = (
       const id = crypto.randomUUID(),
         token = secret(),
         expiresAt = future(limits.pairingSeconds);
-      return db.begin(async (tx) => {
+      return db().begin(async (tx) => {
         await fresh(tx, actor);
         if (targetId !== actor.userId && (!actor.admin || !cfg.adminPairing)) return reject("FORBIDDEN", 403);
         await tx`SELECT id FROM auth.users WHERE id = ${targetId}::uuid FOR UPDATE`;
@@ -549,7 +551,7 @@ export const createAppApprovalService = (
     claimPairing: async (claim: { pairingId: string; secret: string; publicKey: AppDevicePublicKey; name: string; signature: string }) => {
       const cfg = await config();
       if (!(await verify(claim.publicKey, appPairingProofMessage(cfg.issuer, claim), claim.signature))) return reject("FORBIDDEN", 403);
-      return db.begin(async (tx) => {
+      return db().begin(async (tx) => {
         const [p] = await tx<
           PairingRow[]
         >`SELECT * FROM auth.app_pairings WHERE id = ${claim.pairingId}::uuid AND issuer = ${cfg.issuer} FOR UPDATE`;
@@ -564,7 +566,7 @@ export const createAppApprovalService = (
     },
     pairingResult: async (id: string, token: string, key: AppDevicePublicKey) => {
       const cfg = await config();
-      const [p] = await db<PairingRow[]>`SELECT * FROM auth.app_pairings WHERE id = ${id}::uuid AND issuer = ${cfg.issuer}`;
+      const [p] = await db()<PairingRow[]>`SELECT * FROM auth.app_pairings WHERE id = ${id}::uuid AND issuer = ${cfg.issuer}`;
       if (!p || !matches(token, p.secret_hash)) return reject("FORBIDDEN", 403);
       const age = Date.now() - new Date(p.expires_at).getTime();
       if (age >= 0 && !(age < 60_000 && (p.state === "confirmed" || p.state === "cancelled"))) return reject("FORBIDDEN", 403);
@@ -576,7 +578,7 @@ export const createAppApprovalService = (
     },
     inspectPairing: async (actor: AppApprovalActor, id: string) => {
       const cfg = await config();
-      return db.begin(async (tx) => {
+      return db().begin(async (tx) => {
         const [p] = await tx<PairingRow[]>`SELECT * FROM auth.app_pairings WHERE id = ${id}::uuid AND issuer = ${cfg.issuer}`;
         if (!p) return reject("UNAVAILABLE", 404);
         const [change] = await tx<ChangeRow[]>`SELECT * FROM auth.app_device_changes WHERE pairing_id=${p.id}::uuid`;
@@ -598,7 +600,7 @@ export const createAppApprovalService = (
     confirmPairing: async (actor: AppApprovalActor, id: string, code: string): Promise<z.infer<typeof AppPairingConfirmResultSchema>> => {
       const cfg = await config();
       let wakeId: string | undefined;
-      const result = await db.begin(async (tx) => {
+      const result = await db().begin(async (tx) => {
         const [snapshot] = await tx<PairingRow[]>`SELECT * FROM auth.app_pairings WHERE id=${id}::uuid AND issuer=${cfg.issuer}`;
         if (!snapshot) return reject("CONFLICT", 409);
         await tx`SELECT id FROM auth.users WHERE id=${snapshot.user_id}::uuid FOR NO KEY UPDATE`;
@@ -636,7 +638,7 @@ export const createAppApprovalService = (
     },
     cancelPairing: async (actor: AppApprovalActor, id: string) => {
       const cfg = await config();
-      return db.begin(async (tx) => {
+      return db().begin(async (tx) => {
         const [snapshot] = await tx<PairingRow[]>`SELECT * FROM auth.app_pairings WHERE id=${id}::uuid AND issuer=${cfg.issuer}`;
         if (!snapshot) return reject("UNAVAILABLE", 404);
         await tx`SELECT id FROM auth.users WHERE id=${snapshot.user_id}::uuid FOR NO KEY UPDATE`;
@@ -656,7 +658,7 @@ export const createAppApprovalService = (
       const cfg = await config(false);
       const changeId = "changeId" in lookup ? lookup.changeId : null,
         deviceId = "deviceId" in lookup ? lookup.deviceId : null;
-      const [row] = await db<ChangeRow[]>`SELECT * FROM auth.app_device_changes
+      const [row] = await db()<ChangeRow[]>`SELECT * FROM auth.app_device_changes
         WHERE issuer=${cfg.issuer} AND user_id=${actor.userId}::uuid AND requested_by_sid=${actor.sid}::uuid AND kind='revoke'
           AND (${changeId}::uuid IS NULL OR id=${changeId}::uuid) AND (${deviceId}::uuid IS NULL OR device_id=${deviceId}::uuid)
         ORDER BY created_at DESC, id DESC LIMIT 1`;
@@ -665,7 +667,7 @@ export const createAppApprovalService = (
     },
     cancelChange: async (actor: AppApprovalActor, id: string) => {
       const cfg = await config(false);
-      return db.begin(async (tx) => {
+      return db().begin(async (tx) => {
         await tx`SELECT id FROM auth.users WHERE id=${actor.userId}::uuid FOR NO KEY UPDATE`;
         const change = await ownedChange(tx, cfg, actor, id);
         if (changeStatus(change).state !== "pending") return reject("CONFLICT", 409);
@@ -676,7 +678,7 @@ export const createAppApprovalService = (
     },
     listDevices: async (actor: AppApprovalActor, after?: string) => {
       const cfg = await config(false);
-      const rows = await db<
+      const rows = await db()<
         DeviceRow[]
       >`SELECT * FROM auth.app_devices WHERE issuer=${cfg.issuer} AND user_id=${actor.userId}::uuid AND (${after ?? null}::uuid IS NULL OR id > ${after ?? null}::uuid) ORDER BY id LIMIT ${limits.pageSize + 1}`;
       return {
@@ -692,7 +694,7 @@ export const createAppApprovalService = (
     ): Promise<z.infer<typeof AppDeviceRevokeResultSchema> | undefined> => {
       const cfg = await config(false);
       let wakeId: string | undefined;
-      const result = await db.begin(async (tx) => {
+      const result = await db().begin(async (tx) => {
         await tx`SELECT id FROM auth.users WHERE id=${actor.userId}::uuid FOR NO KEY UPDATE`;
         const user = await fresh(tx, actor);
         const [device] = await tx<DeviceRow[]>`SELECT * FROM auth.app_devices
@@ -723,7 +725,7 @@ export const createAppApprovalService = (
     listUserDevices: async (actor: AppDeviceAdministrator, userId: string): Promise<AppDeviceView[]> => {
       if (!actor.admin) return reject("FORBIDDEN", 403);
       const cfg = await config(false);
-      const rows = await db<
+      const rows = await db()<
         DeviceRow[]
       >`SELECT * FROM auth.app_devices WHERE issuer=${cfg.issuer} AND user_id=${userId}::uuid AND revoked_at IS NULL ORDER BY created_at, id LIMIT ${limits.devicesPerAccount}`;
       return rows.map(view);
@@ -733,7 +735,7 @@ export const createAppApprovalService = (
     revokeUserDevice: async (actor: AppDeviceAdministrator, userId: string, id: string) => {
       if (!actor.admin) return reject("FORBIDDEN", 403);
       const cfg = await config(false);
-      return db.begin(async (tx) => {
+      return db().begin(async (tx) => {
         const [device] = await tx<
           DeviceRow[]
         >`SELECT * FROM auth.app_devices WHERE id=${id}::uuid AND issuer=${cfg.issuer} AND user_id=${userId}::uuid FOR UPDATE`;
@@ -753,7 +755,7 @@ export const createAppApprovalService = (
         code = comparison(),
         expiresAt = future(limits.loginSeconds);
       let owner: string | undefined;
-      await db.begin(async (tx) => {
+      await db().begin(async (tx) => {
         let candidate = await loginCandidate(tx, identifier, category);
         if (candidate && !(await loginBudget(tx, cfg.issuer, candidate.id))) candidate = undefined;
         const now = new Date();
@@ -789,7 +791,7 @@ export const createAppApprovalService = (
         code = comparison(),
         expiresAt = future(limits.loginSeconds);
       let owner: string | undefined;
-      await db.begin(async (tx) => {
+      await db().begin(async (tx) => {
         let candidate = await loginCandidate(tx, input.identifier);
         const subject = candidate ?? { id: crypto.randomUUID(), profile: "user" as const };
         // Even a decoy performs the client-access, device and shared-budget queries.
@@ -830,7 +832,7 @@ export const createAppApprovalService = (
         return reject("FORBIDDEN", 403);
       await cleanup();
       let decidedBrowserId: string | undefined;
-      const outcome = await db.begin(async (tx) => {
+      const outcome = await db().begin(async (tx) => {
         let changeUserId: string | undefined;
         if (proof.command.operation === "change") {
           const [snapshot] = await tx<
@@ -1105,7 +1107,9 @@ export const createAppApprovalService = (
     browserStatus: async (id: string, token: string, hold?: { ms: number; signal?: AbortSignal }) => {
       const cfg = await config();
       const read = async () => {
-        const [row] = await db<LoginRow[]>`SELECT * FROM auth.app_logins WHERE kind='browser' AND id=${id}::uuid AND issuer=${cfg.issuer}`;
+        const [row] = await db()<
+          LoginRow[]
+        >`SELECT * FROM auth.app_logins WHERE kind='browser' AND id=${id}::uuid AND issuer=${cfg.issuer}`;
         if (!row || !matches(token, row.browser_hash)) return reject("UNAVAILABLE", 404);
         const expiresIn = new Date(row.expires_at).getTime() - Date.now();
         return { state: expiresIn <= 0 ? "expired" : row.state, expiresIn };
@@ -1134,7 +1138,7 @@ export const createAppApprovalService = (
     },
     consumeLogin: async (id: string, token: string) => {
       const cfg = await config();
-      return db.begin(async (tx) => {
+      return db().begin(async (tx) => {
         // Lock order is device -> request for both approval and completion.
         const [snapshot] = await tx<
           LoginRow[]