@k2b/cloud 0.48.0 → 0.50.0

package/src/api/admin-ai.ts

@@ -1,4 +1,3 @@
-import { sql } from "bun";
 import { Hono, type MiddlewareHandler } from "hono";
 import { z } from "zod";
 import { setAiCredential } from "../ai/credentials";
@@ -15,6 +14,7 @@ import {
   testAiProvider,
 } from "../ai/provider-connections";
 import { getAiRequestHeaders, setAiRequestHeaders } from "../ai/request-headers";
+import { sql } from "../runtime/clients";
 import { type AuthContext, auth, v } from "../server";
 import { ConfigConflict } from "../services/config-conflict";
 import { ImageMetadataError } from "../services/image-metadata";

package/src/api/admin-app-keys.ts

@@ -3,7 +3,7 @@ import { Hono } from "hono";
 import { describeRoute } from "hono-openapi";
 import { z } from "zod";
 import { validateAppKeyAppId } from "../app-key";
-import { type AuthContext, auth, respond, v } from "../server";
+import { type AuthContext, auth, jsonResponse, respond, v } from "../server";
 import { noTransform } from "../server/middleware/no-transform";
 import { appKeys } from "../services/app-keys";
 
@@ -21,9 +21,49 @@ const pagination = z.object({
   perPage: z.coerce.number().int().min(1).max(500).default(100),
 });
 const input = z
-  .object({ publicKey: z.string().length(43), name: z.string().trim().min(1).max(120).optional(), expiresAt: z.iso.datetime().optional() })
+  .object({
+    publicKey: z.string().length(43),
+    name: z.string().trim().min(1).max(120).optional(),
+    expiresAt: z.iso.datetime().optional(),
+    grants: z.array(z.literal("oauth:issue")).max(1).optional(),
+  })
   .strict();
 
+const keyListResponse = z.object({
+  installationId: z.uuid(),
+  items: z.array(
+    z.object({
+      keyId: z.uuid(),
+      appId: z.string(),
+      serviceAccountId: z.uuid(),
+      kind: z.literal("app_key"),
+      name: z.string(),
+      publicKey: z.string(),
+      grants: z.array(z.literal("oauth:issue")),
+      fingerprint: z.string(),
+      status: z.enum(["active", "expired", "revoked"]),
+      accountStatus: z.enum(["active", "disabled"]),
+      createdAt: z.iso.datetime(),
+      createdBy: z.uuid().nullable(),
+      expiresAt: z.iso.datetime().nullable(),
+      revokedAt: z.iso.datetime().nullable(),
+      revokedBy: z.uuid().nullable(),
+      lastUsedAt: z.iso.datetime().nullable(),
+    }),
+  ),
+  lastRejectedStart: z
+    .object({
+      at: z.iso.datetime(),
+      reason: z.enum(["revoked", "expired", "disabled", "connections_not_permitted"]),
+      keyId: z.uuid().nullable(),
+    })
+    .nullable(),
+  page: z.number().int(),
+  perPage: z.number().int(),
+  total: z.number().int(),
+  hasNext: z.boolean(),
+});
+
 export const createAdminAppKeyRoutes = (
   authenticate: MiddlewareHandler<AuthContext> = auth.requireRole("admin"),
   service: typeof appKeys = appKeys,
@@ -44,7 +84,11 @@ export const createAdminAppKeyRoutes = (
     )
     .get(
       "/:appId/keys",
-      describeRoute({ tags: ["App keys"], summary: "List app public keys and lifecycle metadata" }),
+      describeRoute({
+        tags: ["App keys"],
+        summary: "List app public keys, lifecycle metadata and last rejected start",
+        responses: { 200: jsonResponse(keyListResponse, "App keys and last rejected start") },
+      }),
       v("param", params),
       v("query", pagination),
       (c) => respond(c, () => service.list({ actor: c.get("user"), ...c.req.valid("param"), ...c.req.valid("query") })),

package/src/api/admin-core-settings.ts

@@ -6,13 +6,13 @@
  * core app mounts it under `/api/admin/core/settings`.
  */
 
-import { sql } from "bun";
 import { Hono } from "hono";
 import { describeRoute } from "hono-openapi";
 import { z } from "zod";
 import { ObjectStoreConfigurationError, ObjectStoreConnectionError, testObjectStoreConnection } from "../_internal/object-store-config";
 import { listApps } from "../_internal/registry";
 import { enrichDirtyAiConversations } from "../ai/enrich";
+import { sql } from "../runtime/clients";
 import { type AuthContext, auth, getLocale, jsonResponse, requiresAdmin, v } from "../server";
 import { settingsDeleteLegacyKeys, settingsListLegacyKeys, settingsService } from "../services";
 import { readAccountCategoryPolicy } from "../services/account-category-policy";

package/src/api/admin-outgoing-mail.ts

@@ -1,4 +1,3 @@
-import { sql } from "bun";
 import { type Context, Hono, type MiddlewareHandler } from "hono";
 import { describeRoute, validator } from "hono-openapi";
 import { z } from "zod";
@@ -13,6 +12,7 @@ import {
   MailRetentionSchema,
   MailStatusSchema,
 } from "../contracts/outgoing-mail";
+import { sql } from "../runtime/clients";
 import { type AuthContext, auth, jsonResponse, requiresAdmin } from "../server";
 import { noTransform } from "../server/middleware/no-transform";
 import { audit } from "../services/audit";

package/src/api/app-bootstrap.ts

@@ -11,8 +11,17 @@ import {
 import { connections } from "../runtime/connections";
 import { clientIpBucket } from "../server/client-ip";
 import { type RateLimitResult, ratelimit } from "../server/ratelimit";
-import { authenticateBootstrap, BootstrapProofError, bootstrapRateLimit, consumeBootstrapProof } from "../services/app-bootstrap";
+import {
+  authenticateBootstrap,
+  BootstrapProofError,
+  bootstrapRateLimit,
+  clearRejectedBootstrapStart,
+  consumeBootstrapProof,
+  RejectedBootstrapStart,
+  recordRejectedBootstrapStart,
+} from "../services/app-bootstrap";
 import { touchAppKey } from "../services/app-keys";
+import { logger } from "../services/logging";
 
 type BootstrapContext = { Variables: { bootstrapBody: Uint8Array<ArrayBuffer> } };
 
@@ -110,6 +119,14 @@ export const createAppBootstrapRoutes = (dependencies: Dependencies = {}) => {
         try {
           verified = await authenticateBootstrap(header.slice(7), { method: c.req.method, path: url.pathname, body }, dependencies.db);
         } catch (error) {
+          if (error instanceof RejectedBootstrapStart) {
+            try {
+              const rate = dependencies.admit ? await dependencies.admit(error.identity.keyId) : await admit("key", error.identity.keyId);
+              if (!rate.limited) await recordRejectedBootstrapStart(error, dependencies.db);
+            } catch {
+              logger("app-bootstrap").warn("Could not record rejected app start", { appId: error.identity.appId });
+            }
+          }
           if (error instanceof BootstrapProofError) return c.json({ code: error.code }, error.code === "invalid_proof" ? 401 : 403);
           throw error;
         }
@@ -124,6 +141,11 @@ export const createAppBootstrapRoutes = (dependencies: Dependencies = {}) => {
         await touchAppKey(identity, dependencies.db);
         const response = JSON.stringify(BootstrapResponseSchema.parse({ identity, connections: snapshot }));
         if (Buffer.byteLength(response) > BOOTSTRAP_RESPONSE_BYTES) throw new Error("Bootstrap response exceeds protocol budget");
+        try {
+          await clearRejectedBootstrapStart(identity.appId, dependencies.db);
+        } catch {
+          logger("app-bootstrap").warn("Could not clear rejected app start", { appId: identity.appId });
+        }
         c.header("Content-Type", "application/json");
         return c.body(response);
       },

package/src/api/app-events.ts

@@ -1,10 +1,10 @@
-import { sql } from "bun";
 import { Hono, type MiddlewareHandler } from "hono";
 import { describeRoute } from "hono-openapi";
 import { z } from "zod";
 import { AppDetailsSchema } from "../contracts/app-details";
 import { AppEventEnvelopeSchema } from "../contracts/app-events";
 import { CapabilityQualifiedIdSchema } from "../contracts/capabilities";
+import { sql } from "../runtime/clients";
 import { type AuthContext, auth, expectUserBackedActor, getLocale, v } from "../server";
 import { AppAccessManagementError } from "../services/app-access-management";
 import { appDetails } from "../services/app-details";

package/src/api/auth.ts

@@ -1,10 +1,10 @@
-import { sql } from "bun";
 import { type Context, Hono } from "hono";
 import { describeRoute } from "hono-openapi";
 import { z } from "zod";
 import { env } from "../config";
 import { ChangeExpiredPasswordSchema } from "../contracts";
 import { coreUserEventPublisher } from "../events/core-user-created";
+import { sql } from "../runtime/clients";
 import { type AuthContext, auth, getLocale, jsonResponse, rateLimit, respond, v } from "../server";
 import { accounts, audit, authFlows, getFreeIpaConfig, logger, webauthn } from "../services";
 import { isAccountCategoryAllowed } from "../services/account-category-policy";

package/src/api/authenticate-app-request.ts

@@ -0,0 +1,129 @@
+import type { SQL } from "bun";
+import type { Context } from "hono";
+import { getConnInfo } from "hono/bun";
+import { CAPABILITY_MAX_REQUEST_BYTES } from "../contracts/capabilities";
+import { clientIpBucket } from "../server/client-ip";
+import { type RateLimitResult, ratelimit } from "../server/ratelimit";
+import { REQUEST_IDLE_TIMEOUT_SECONDS } from "../server/request-timeout";
+import {
+  authenticateAppProof,
+  BootstrapProofError,
+  bootstrapRateLimit,
+  consumeBootstrapProof,
+  inspectAppProof,
+} from "../services/app-bootstrap";
+import { touchAppKey } from "../services/app-keys";
+import type { AuthenticatedWorkload } from "../services/identity/workload-auth";
+
+type Dependencies = {
+  db?: SQL;
+  ingress?: (peer: string) => Promise<RateLimitResult>;
+  admit?: (keyId: string) => Promise<RateLimitResult>;
+};
+const admission = async (kind: "ingress" | "key", id: string) =>
+  ratelimit({ id: `app-bootstrap-${kind}`, limit: await bootstrapRateLimit() }).check(id);
+
+/** Core-only request authentication; the body remains available to the domain handler. */
+export const authenticateSignedAppRequest = async (
+  c: Context,
+  scope: "identity:invoke" | "oauth:issue",
+  dependencies: Dependencies = {},
+): Promise<AuthenticatedWorkload | Response> => {
+  c.header("Cache-Control", "no-store");
+  const deadline = AbortSignal.timeout(REQUEST_IDLE_TIMEOUT_SECONDS * 1000);
+  const signal = AbortSignal.any([c.req.raw.signal, deadline]);
+  const reject = (status: 401 | 403 | 413 | 429 | 503 | 504, code: string, message: string) => c.json({ code, message }, status);
+  const limited = (rate: RateLimitResult) => {
+    c.header("Retry-After", String(Math.max(1, Math.ceil(rate.resetIn / 1000))));
+    return reject(429, "RATE_LIMITED", "App request admission limit reached");
+  };
+  try {
+    let peer = "unknown";
+    try {
+      peer = getConnInfo(c).remote.address ?? peer;
+    } catch {
+      /* In-process requests have no socket. */
+    }
+    const ingress = await (dependencies.ingress ?? ((id) => admission("ingress", id)))(clientIpBucket(peer));
+    if (ingress.limited) return limited(ingress);
+    const header = c.req.header("Authorization") ?? "";
+    if (!header.startsWith("Bearer ")) return reject(401, "invalid_proof", "A valid app proof is required");
+    inspectAppProof(header.slice(7));
+    const tooLarge = () => reject(413, "body_too_large", "App request exceeds the byte limit");
+    if (Number(c.req.header("Content-Length")) > CAPABILITY_MAX_REQUEST_BYTES) {
+      void c.req.raw.body?.cancel().catch(() => undefined);
+      return tooLarge();
+    }
+    signal.throwIfAborted();
+    const copy = c.req.raw.clone();
+    const reader = copy.body?.getReader();
+    const bytes = new Uint8Array(CAPABILITY_MAX_REQUEST_BYTES);
+    let total = 0;
+    if (reader) {
+      const cancel = () => {
+        // A tee cancels its source only after both branches cancel. Never await a stalled source.
+        void reader.cancel(signal.reason).catch(() => undefined);
+        void c.req.raw.body?.cancel(signal.reason).catch(() => undefined);
+      };
+      signal.addEventListener("abort", cancel, { once: true });
+      try {
+        signal.throwIfAborted();
+        while (true) {
+          const chunk = await reader.read();
+          if (chunk.done) break;
+          if (total + chunk.value.byteLength > bytes.byteLength) {
+            cancel();
+            return tooLarge();
+          }
+          bytes.set(chunk.value, total);
+          total += chunk.value.byteLength;
+        }
+        signal.throwIfAborted();
+      } catch (error) {
+        cancel();
+        if (signal.aborted) throw signal.reason;
+        throw error;
+      } finally {
+        signal.removeEventListener("abort", cancel);
+        reader.releaseLock();
+      }
+    }
+    const url = new URL(c.req.url);
+    const verified = await authenticateAppProof(
+      header.slice(7),
+      { method: c.req.method, path: url.pathname + url.search, body: bytes.slice(0, total) },
+      dependencies.db,
+    );
+    // Recheck the operator-owned key grant on every transmission.
+    if (scope === "oauth:issue" && !verified.key.oauthIssueAllowed)
+      return reject(403, "scope_not_permitted", "App is not permitted to issue OAuth credentials");
+    const declaredApp = c.req.header("X-Cloud-App-Id");
+    if (declaredApp && declaredApp !== verified.identity.appId) return reject(403, "wrong_app", "App identity does not match the proof");
+    const rate = await (dependencies.admit ?? ((id) => admission("key", id)))(verified.identity.keyId);
+    if (rate.limited) return limited(rate);
+    if (!(await consumeBootstrapProof(verified.identity.keyId, verified.jti, verified.exp, dependencies.db)))
+      return reject(403, "replayed_proof", "App proof has already been used");
+    await touchAppKey(verified.identity, dependencies.db);
+    return {
+      appId: verified.identity.appId,
+      keyId: verified.identity.keyId,
+      serviceAccountId: verified.key.serviceAccountId,
+      credentialId: verified.identity.keyId,
+      scope: "identity:invoke",
+    };
+  } catch (error) {
+    if (signal.aborted && error === signal.reason) {
+      void c.req.raw.body?.cancel(signal.reason).catch(() => undefined);
+      return c.req.raw.signal.aborted
+        ? Response.json(
+            { code: "REQUEST_CANCELLED", message: "App request was cancelled" },
+            { status: 499, headers: { "Cache-Control": "no-store" } },
+          )
+        : reject(504, "DEADLINE_EXCEEDED", "App request body deadline exceeded");
+    }
+    if (error instanceof BootstrapProofError)
+      return reject(error.code === "invalid_proof" ? 401 : 403, error.code, "App proof was rejected");
+    c.header("Retry-After", "1");
+    return reject(503, "app_proof_unavailable", "App request authentication is temporarily unavailable");
+  }
+};

package/src/api/capabilities.ts

@@ -61,11 +61,12 @@ import { noTransform } from "../server/middleware/no-transform";
 import { hasOAuthScope } from "../server/oauth-scope";
 import { ratelimit } from "../server/ratelimit";
 import { appAccessAuthority, canUseApp } from "../services/app-access";
+import { bootstrapRateLimit } from "../services/app-bootstrap";
 import { discoverableApps } from "../services/app-discovery";
 import { authorityFromParentInvocation, invocationAuthorityFromRequest } from "../services/identity/invocation-authority";
 import { capabilityInvocationOperation } from "../services/identity/invocation-operations";
 import type { CloudInvocationClaims, InvocationAuthority } from "../services/identity/invocation-token";
-import { normalizeInvocationRequestId, signAppQueryInvocation } from "../services/identity/invocation-token";
+import { normalizeInvocationRequestId, signAppCapabilityInvocation, signAppQueryInvocation } from "../services/identity/invocation-token";
 import { issueInvocationToken as signInvocationToken } from "../services/identity/issue-invocation";
 import { withActiveIdentitySigner } from "../services/identity/key-ring";
 import {
@@ -128,6 +129,7 @@ export type CapabilityRouteDependencies = {
   withMandateIssueAuthority?: typeof withMandateIssueAuthority;
   queryTimeoutMs?: number;
   actionTimeoutMs?: number;
+  checkAppCapabilityRate?: (appId: string) => Promise<{ limited: boolean; resetIn: number }>;
   checkAppQueryRate?: (appId: string) => Promise<{ limited: boolean }>;
   reviewTimeoutMs?: number;
   appUrl?: () => Promise<string>;
@@ -135,6 +137,7 @@ export type CapabilityRouteDependencies = {
 
 export type CapabilityDispatchDependencies = Pick<
   CapabilityRouteDependencies,
+  | "checkAppCapabilityRate"
   | "checkAppQueryRate"
   | "getApp"
   | "getCapability"
@@ -293,6 +296,8 @@ export type CapabilityDispatchParams = {
   deadline?: number;
   /** Core-only authenticated workload. Never populated from request JSON. */
   workload?: AuthenticatedWorkload;
+  /** Verified Ed25519 app identity, separate from person and legacy workload authority. */
+  appCaller?: { appId: string; keyId: string };
   mandate?: MandatedCapabilityAuthority;
   callingAppId?: string;
   /** Internal observation only: called immediately before attempting the app request. */
@@ -363,6 +368,39 @@ const runCapabilityDispatch = async (
   }
   if ("appOnly" in operation && operation.appOnly !== undefined && !params.workload)
     return errorResponse("FORBIDDEN", "App authority required for this query", 403);
+  if (params.appCaller) {
+    if (
+      params.authority ||
+      params.workload ||
+      params.mandate ||
+      params.parentInvocation ||
+      params.review ||
+      !operation.appPermission ||
+      operation.stream
+    )
+      return errorResponse("FORBIDDEN", "This capability does not accept app authority", 403);
+    try {
+      const app = params.appCaller;
+      const caller = await deadline.wait(() => (params.dependencies?.getApp ?? getApp)(app.appId));
+      if (!caller) return errorResponse("APP_UNAVAILABLE", "Calling app registry entry unavailable", 503);
+      if (!caller.platformPermissions?.includes(operation.appPermission))
+        return errorResponse("APP_CAPABILITY_NOT_ADMITTED", `App caller does not declare ${operation.appPermission}`, 403);
+      // Same operator-owned per-second budget as signed app ingress; shared by all keys of the app.
+      const rate = await deadline.wait(() =>
+        (
+          params.dependencies?.checkAppCapabilityRate ??
+          (async (appId) => ratelimit({ id: "app-capabilities", limit: await bootstrapRateLimit() }).check(appId))
+        )(app.appId),
+      );
+      if (rate.limited)
+        return errorResponse("RATE_LIMITED", "App capability rate limit reached", 429, {
+          retryAfter: Math.max(1, Math.ceil(rate.resetIn / 1000)),
+        });
+    } catch {
+      deadline.check();
+      return errorResponse("APP_UNAVAILABLE", "App capability admission unavailable", 503);
+    }
+  }
   if (params.workload) {
     if (
       params.authority ||
@@ -544,6 +582,36 @@ const runCapabilityDispatch = async (
           });
         })()
       : await (async () => {
+          if (params.appCaller && operation.appPermission) {
+            const app = params.appCaller;
+            const permission = operation.appPermission;
+            return deadline.wait(() =>
+              (params.dependencies?.withActiveSigner ?? withActiveIdentitySigner)(
+                "invocation",
+                async (signer) => {
+                  deadline.check();
+                  const signed = await signAppCapabilityInvocation({
+                    app,
+                    permission,
+                    kind: params.kind === "queries" ? "query" : "action",
+                    targetAppId: params.appId,
+                    capabilityId: params.capabilityId,
+                    schemaHash: operation.schemaHash,
+                    input: input.data,
+                    requestId,
+                    signer,
+                  });
+                  observed.invocationId = signed.claims.jti;
+                  return new Headers({
+                    "content-type": "application/json",
+                    accept: "application/json",
+                    authorization: `Bearer ${signed.token}`,
+                  });
+                },
+                { signal, timeoutMs: deadline.remainingMs() },
+              ),
+            );
+          }
           if (params.workload) {
             const workload = params.workload;
             return deadline.wait(() =>
@@ -675,7 +743,11 @@ const runCapabilityDispatch = async (
       ? {
           appId: params.appId,
           capability: `${params.appId}.${params.capabilityId}`,
-          principal: claimPrincipal ? `${claimPrincipal.type}:${claimPrincipal.id}` : "anonymous",
+          principal: params.appCaller
+            ? `app:${params.appCaller.appId}`
+            : claimPrincipal
+              ? `${claimPrincipal.type}:${claimPrincipal.id}`
+              : "anonymous",
           keyHash: capabilityIdempotencyKeyHash(idempotencyKey.data),
         }
       : null;
@@ -749,7 +821,7 @@ const runCapabilityDispatch = async (
     params.onUpstreamAttempt?.();
     const fetchResponse = () =>
       fetchUpstream(
-        `${entry.endpoint}/${params.workload ? "app-queries" : params.kind}/${encodeURIComponent(params.capabilityId)}${params.review ? "/review" : ""}`,
+        `${entry.endpoint}/${params.appCaller ? `app-capabilities/${params.kind}` : params.workload ? "app-queries" : params.kind}/${encodeURIComponent(params.capabilityId)}${params.review ? "/review" : ""}`,
         {
           method: "POST",
           headers,
@@ -986,13 +1058,15 @@ export const dispatchCapability = async (params: CapabilityDispatchParams): Prom
         origin: params.origin,
         invocationId: observed.invocationId,
         parentInvocationId: params.parentInvocation?.jti,
-        viaAppId: params.workload?.appId ?? (params.parentInvocation ? params.callingAppId : undefined),
+        viaAppId: params.appCaller?.appId ?? params.workload?.appId ?? (params.parentInvocation ? params.callingAppId : undefined),
         appId: params.appId,
         capability: `${params.appId}.${params.capabilityId}`,
         kind: params.kind === "queries" ? "query" : "action",
         destructive: observed.destructive,
-        actorKind: params.workload ? "app" : (principal?.type ?? null),
+        actorKind: params.appCaller || params.workload ? "app" : (principal?.type ?? null),
         actorId: principal?.id ?? null,
+        actorAppId: params.appCaller?.appId ?? params.workload?.appId,
+        actorKeyId: params.appCaller?.keyId,
         userId: actor?.kind === "user" ? actor.user.id : (actor?.delegatedUser?.id ?? (principal?.type === "user" ? principal.id : null)),
         accessSubject: subject && subject.id !== principal?.id ? subject : null,
         status: executionStatus(outcome.status, errorCode),

package/src/api/index.ts

@@ -142,6 +142,8 @@ export { createAdminAppKeyRoutes } from "./admin-app-keys";
 export { createAppAccessRoutes } from "./app-access";
 /** Core-owned internal startup protocol; applications use @k2b/cloud/start. */
 export { createAppBootstrapRoutes } from "./app-bootstrap";
+/** Core-owned app-key request authentication. */
+export { authenticateSignedAppRequest } from "./authenticate-app-request";
 export {
   CLOUD_MCP_PATH,
   CLOUD_MCP_PROTECTED_RESOURCE_PATH,

package/src/api/me.ts

@@ -5,7 +5,6 @@
  */
 
 import { err, fail, ok, type Result } from "@k2b/stdlib";
-import { sql } from "bun";
 import { type Context, Hono, type MiddlewareHandler } from "hono";
 import { deleteCookie } from "hono/cookie";
 import { createMiddleware } from "hono/factory";
@@ -42,6 +41,7 @@ import {
   WebAuthnPasskeySchema,
 } from "../contracts";
 import { CapabilityAppIdSchema } from "../contracts/capabilities";
+import { sql } from "../runtime/clients";
 import { type AuthContext, auth, getLocale, getTimeZone, jsonResponse, rateLimit, requiresAuth, respond, v } from "../server";
 import { APP_SESSION_FORBIDDEN } from "../server/middleware/auth";
 import { noTransform } from "../server/middleware/no-transform";

package/src/api/search.bench.ts

@@ -1,10 +1,10 @@
 import { ok } from "@k2b/stdlib";
-import { sql } from "bun";
 import type { MiddlewareHandler } from "hono";
 import { generateKeyPair, jwtVerify, SignJWT } from "jose";
 import { compileCapabilities } from "../_internal/capabilities";
 import { defineCapabilities, UniversalSearchDataSchema, UniversalSearchInputSchema } from "../contracts/capabilities";
 import type { CapabilityRegistryEntry } from "../contracts/registry";
+import { sql } from "../runtime/clients";
 import type { AuthContext } from "../server";
 import type { signInvocationToken } from "../services/identity/invocation-token";
 import type { withActiveIdentitySigner } from "../services/identity/key-ring";

package/src/app-pwa/service.ts

@@ -1,8 +1,9 @@
-import { sql, type TransactionSQL } from "bun";
+import type { TransactionSQL } from "bun";
 import { z } from "zod";
 import { GeoAutocompleteInputSchema } from "../contracts/geo";
 import { isInstallablePath } from "../contracts/installable";
 import { PWA_LIMITS } from "../contracts/pwa";
+import { sql } from "../runtime/clients";
 import { ratelimit } from "../server/ratelimit";
 import { REQUEST_IDLE_TIMEOUT_SECONDS } from "../server/request-timeout";
 import { getEffectivePermission, hasPermission } from "../server/services/access";

package/src/app-pwa/transaction.ts

@@ -1,6 +1,6 @@
 import { isPromise } from "node:util/types";
 import type { ReservedSQL, SQL, TransactionSQL } from "bun";
-import * as bun from "bun";
+import { createSql } from "../runtime/clients";
 import { REQUEST_IDLE_TIMEOUT_SECONDS } from "../server/request-timeout";
 import { boundTransaction } from "./authority";
 import { AppPwaError } from "./contracts";
@@ -22,8 +22,9 @@ const cancellationPool = (db: SQL) => {
   const connection: Record<string, string | number> = {};
   for (let index = 0; index + 1 < parts.length; index += 2) connection[parts[index]!] = parts[index + 1]!;
   connection.statement_timeout = requestBudget;
-  return new bun.SQL(`postgres://localhost?sslmode=${modes[sslMode]}`, {
+  return createSql({
     ...options,
+    adapter: "postgres",
     // Bun adds SNI to normalized prefer options. Passing that generated object
     // back as explicit TLS upgrades prefer to require. Recreate its default SNI
     // from hostname instead; explicit verification options remain unchanged.
@@ -35,6 +36,7 @@ const cancellationPool = (db: SQL) => {
     maxLifetime: REQUEST_IDLE_TIMEOUT_SECONDS,
     onconnect: undefined,
     onclose: undefined,
+    url: `postgres://localhost?sslmode=${modes[sslMode]}`,
   });
 };
 

package/src/capabilities/claims.ts

@@ -1,4 +1,5 @@
-import { sql } from "bun";
+import { sql } from "../runtime/clients";
+
 import { logger } from "../services/logging";
 
 const log = logger("capabilities:claims");

package/src/capabilities/executions.ts

@@ -1,6 +1,6 @@
-import { sql } from "bun";
 import { createCapabilityDeadline } from "../_internal/capability-timeout";
 import type { CapabilityOrigin } from "../contracts/capabilities";
+import { sql } from "../runtime/clients";
 import { REQUEST_IDLE_TIMEOUT_SECONDS } from "../server/request-timeout";
 import { pruneApprovalRequests } from "../services/approvals";
 import { logger } from "../services/logging";
@@ -65,6 +65,8 @@ export type CapabilityExecutionInput = {
   destructive: boolean;
   actorKind?: "user" | "service_account" | "app" | null;
   actorId?: string | null;
+  actorAppId?: string | null;
+  actorKeyId?: string | null;
   userId?: string | null;
   /** Recorded only when the access subject differs from the acting principal. */
   accessSubject?: { type: "user" | "service_account"; id: string } | null;
@@ -92,6 +94,8 @@ export type CapabilityExecution = {
   destructive: boolean;
   actorKind: "user" | "service_account" | "app" | null;
   actorId: string | null;
+  actorAppId?: string | null;
+  actorKeyId?: string | null;
   userId: string | null;
   accessSubjectType: "user" | "service_account" | null;
   accessSubjectId: string | null;
@@ -122,12 +126,12 @@ export const recordCapabilityExecution = async (input: CapabilityExecutionInput)
         const [row] = await db<{ id: string }[]>`
     INSERT INTO capabilities.executions (
       request_id, invocation_id, parent_invocation_id, via_app_id, origin, app_id, capability, kind, destructive,
-      actor_kind, actor_id, user_id, access_subject_type, access_subject_id,
+      actor_kind, actor_id, actor_app_id, actor_key_id, user_id, access_subject_type, access_subject_id,
       status, error_code, input_meta, output_meta, idempotency_key, replayed,
       started_at, completed_at, duration_ms
     ) VALUES (
       ${input.requestId}, ${input.invocationId ?? null}, ${input.parentInvocationId ?? null}, ${input.viaAppId ?? null}, ${input.origin}, ${input.appId}, ${input.capability}, ${input.kind}, ${input.destructive},
-      ${input.actorKind ?? null}, ${input.actorId ?? null}, ${input.userId ?? null},
+      ${input.actorKind ?? null}, ${input.actorId ?? null}, ${input.actorAppId ?? null}, ${input.actorKeyId ?? null}::uuid, ${input.userId ?? null},
       ${input.accessSubject?.type ?? null}, ${input.accessSubject?.id ?? null},
       ${input.status}, ${input.errorCode ?? null},
       ${input.inputMeta ? JSON.stringify(input.inputMeta) : null}::text::jsonb,
@@ -177,7 +181,7 @@ const columns = () => sql`
   execution.id::text AS id, execution.request_id AS "requestId",
   execution.invocation_id::text AS "invocationId", execution.parent_invocation_id::text AS "parentInvocationId", execution.via_app_id AS "viaAppId", execution.origin, execution.app_id AS "appId",
   execution.capability, execution.kind, execution.destructive,
-  execution.actor_kind AS "actorKind", execution.actor_id::text AS "actorId", execution.user_id::text AS "userId",
+  execution.actor_app_id AS "actorAppId", execution.actor_key_id::text AS "actorKeyId", execution.actor_kind AS "actorKind", execution.actor_id::text AS "actorId", execution.user_id::text AS "userId",
   execution.access_subject_type AS "accessSubjectType", execution.access_subject_id::text AS "accessSubjectId",
   execution.status, execution.error_code AS "errorCode", execution.input_meta AS "inputMeta",
   execution.output_meta AS "outputMeta", execution.idempotency_key AS "idempotencyKey", execution.replayed,

package/src/capabilities/geo-client.ts

@@ -4,7 +4,7 @@ import { geoMapContract } from "../contracts/geo-map";
 import { geoRouteContract } from "../contracts/geo-route";
 import { type CapabilityCaller, invokeCapabilityWithDataSchema } from "./server";
 
-/** Calls Core using the caller's interactive identity, invocation transport, or durable mandate. */
+/** Calls Core using the caller's interactive identity, invocation transport, app authority, or durable mandate. */
 export const geoClient = {
   mapStyle: (input: z.input<typeof geoMapContract.style.input>, caller: CapabilityCaller) =>
     invokeCapabilityWithDataSchema(

package/src/capabilities/migrate.ts

@@ -1,4 +1,4 @@
-import { sql } from "bun";
+import { sql } from "../runtime/clients";
 
 /**
  * Platform-owned capability execution history.
@@ -58,6 +58,8 @@ export const migrateCloudCapabilities = async (): Promise<void> => {
   await sql`ALTER TABLE capabilities.executions ADD COLUMN IF NOT EXISTS invocation_id UUID`.simple();
   await sql`ALTER TABLE capabilities.executions ADD COLUMN IF NOT EXISTS parent_invocation_id UUID`.simple();
   await sql`ALTER TABLE capabilities.executions ADD COLUMN IF NOT EXISTS via_app_id TEXT`.simple();
+  await sql`ALTER TABLE capabilities.executions ADD COLUMN IF NOT EXISTS actor_app_id TEXT`.simple();
+  await sql`ALTER TABLE capabilities.executions ADD COLUMN IF NOT EXISTS actor_key_id UUID`.simple();
 
   await sql`DO $$ BEGIN
     IF EXISTS (SELECT 1 FROM pg_constraint WHERE conrelid = 'capabilities.executions'::regclass

package/src/capabilities/resource-readers.ts

@@ -33,7 +33,7 @@ export const readResourcePrincipals = async (options: {
   const ref = CloudResourceRefSchema.parse(options.ref);
   // Core issues the credential automatically; an explicit CLOUD_APP_CREDENTIAL override wins.
   const credential = getAppWorkloadCredential();
-  if (!credential) return { state: "not_configured", reason: "no_credential" };
+  if (!env.CLOUD_APP_KEY && !credential) return { state: "not_configured", reason: "no_credential" };
   if (!env.CLOUD_CORE_INTERNAL_ORIGIN) return { state: "not_configured", reason: "no_internal_origin" };
   const callerAppId = getProcessApplicationId();
   if (!callerAppId) return { state: "not_configured", reason: "no_app_identity" };
@@ -54,7 +54,7 @@ export const readResourcePrincipals = async (options: {
     ResourceReadableDataSchema,
     {
       workload: { appId: callerAppId },
-      authorization: `Bearer ${credential}`,
+      ...(credential ? { authorization: `Bearer ${credential}` } : {}),
       signal: options.signal,
       locale: options.locale,
       requestId: options.requestId,