@k2b/cloud 0.48.0 → 0.50.0

package/src/capabilities/server-invoke.ts

@@ -1,6 +1,8 @@
 import { z } from "zod";
+import { getProcessApplicationId } from "../_internal/process-identity";
 import { refreshAppWorkloadCredential } from "../_internal/workload-credential";
 import { dispatchCapability, loadCapabilityCatalogPage } from "../api/capabilities";
+import { env } from "../config/env";
 import {
   CAPABILITY_FRAMEWORK_ERROR_CODES,
   CAPABILITY_MAX_CATALOG_BYTES,
@@ -10,6 +12,7 @@ import {
   capabilityResultSchema,
 } from "../contracts/capabilities";
 import type { RequestAuthority } from "../server";
+import { sendAppRequest } from "../services/identity/app-request";
 import { coreOrigin } from "../services/identity/core-origin";
 import { capabilityMessages } from "../shared/capability-messages";
 import { LOCALE_HEADER } from "../shared/locale";
@@ -39,12 +42,22 @@ export type CapabilityCaller = {
   signal?: AbortSignal;
   /** Request-local aggregate response budget; called before result validation for every received chunk. */
   consumeResponseBytes?: (bytes: number) => void;
-  /** App-only query authority. The workload credential goes only to Core. */
+  /** App-only query authority. The platform authenticates each transmission to Core. */
   workload?: { appId: string };
-  /** Durable background authority. `authorization` must be the owning app's workload credential. */
+  /** App authority authenticated only by the configured Ed25519 app key. */
+  app?: { appId: string };
+  /** Durable background authority. The platform authenticates each transmission to Core. */
   mandate?: { id: string; revision: number; callingAppId: string };
 };
 
+/** Call as the started application, without a person, service account token, or mandate. */
+export const appCaller = (options: Pick<CapabilityCaller, "locale" | "requestId" | "signal"> = {}): CapabilityCaller => {
+  const appId = getProcessApplicationId();
+  if (!appId) throw new Error("Start the application before creating its capability caller");
+  if (!env.CLOUD_APP_KEY) throw new Error("App capability calls require CLOUD_APP_KEY");
+  return { ...options, app: { appId }, origin: "app" };
+};
+
 export { coreOrigin } from "../services/identity/core-origin";
 
 export const callerRequest = async (
@@ -55,7 +68,7 @@ export const callerRequest = async (
 ): Promise<Request> => {
   const headers = new Headers();
   if (caller.authorization) headers.set("authorization", caller.authorization);
-  if (!caller.mandate && !caller.workload) {
+  if (!caller.mandate && !caller.workload && !caller.app) {
     if (caller.cookie) headers.set("cookie", caller.cookie);
     if (caller.requestId) headers.set("x-request-id", caller.requestId);
     if (caller.traceparent) headers.set("traceparent", caller.traceparent);
@@ -63,14 +76,17 @@ export const callerRequest = async (
     if (caller.locale) headers.set(LOCALE_HEADER, caller.locale);
     if (idempotencyKey) headers.set("idempotency-key", idempotencyKey);
   } else {
-    headers.set("x-cloud-app-id", caller.mandate?.callingAppId ?? caller.workload!.appId);
+    headers.set("x-cloud-app-id", caller.app?.appId ?? caller.mandate?.callingAppId ?? caller.workload!.appId);
   }
   const signal = combineCapabilitySignals(caller.signal, invocationSignal);
-  return new Request(new URL(path, await coreOrigin(caller.mandate !== undefined || caller.workload !== undefined)), {
-    method: "POST",
-    headers,
-    signal,
-  });
+  return new Request(
+    new URL(path, await coreOrigin(caller.app !== undefined || caller.mandate !== undefined || caller.workload !== undefined)),
+    {
+      method: "POST",
+      headers,
+      signal,
+    },
+  );
 };
 
 export const unavailable = (
@@ -106,15 +122,20 @@ const invokeCapabilityWithResultSchema = async <TDataSchema extends z.ZodType, T
   caller: CapabilityCaller,
 ): Promise<CapabilityClientResult<z.output<TDataSchema>>> => {
   try {
+    if (
+      caller.app &&
+      (!env.CLOUD_APP_KEY || caller.authority || caller.authorization || caller.cookie || caller.workload || caller.mandate)
+    )
+      throw new Error("App calls require one app-key authority source");
     if (caller.workload && (caller.mandate || caller.cookie || invocation.kind !== "query"))
       throw new Error("Workload authority permits only queries without a mandate or cookie");
     const path =
-      caller.mandate || caller.workload
+      caller.app || caller.mandate || caller.workload
         ? "/api/_internal/identity/v1/invoke"
         : `/api/capabilities/v1/${invocation.kind === "query" ? "queries" : "actions"}/${encodeURIComponent(invocation.appId)}/${encodeURIComponent(invocation.capabilityId)}`;
     const request = await callerRequest(caller, path, invocation.idempotencyKey, invocation.signal);
     if (caller.authority) {
-      if (caller.authorization || caller.cookie || caller.mandate || caller.workload || caller.transport)
+      if (caller.authorization || caller.cookie || caller.app || caller.mandate || caller.workload || caller.transport)
         throw new Error("Use exactly one capability authority source");
       let charged = false;
       const charge = caller.consumeResponseBytes;
@@ -147,8 +168,9 @@ const invokeCapabilityWithResultSchema = async <TDataSchema extends z.ZodType, T
     }
     const brokerRequest = new Request(request, {
       body: JSON.stringify(
-        caller.mandate || caller.workload
+        caller.app || caller.mandate || caller.workload
           ? {
+              ...(caller.app ? { appCaller: true } : {}),
               kind: invocation.kind,
               targetApp: invocation.appId,
               capabilityId: invocation.capabilityId,
@@ -169,13 +191,15 @@ const invokeCapabilityWithResultSchema = async <TDataSchema extends z.ZodType, T
           : { input: invocation.input },
       ),
     });
-    const send = caller.transport ?? ((request: Request) => fetch(request, caller.workload ? { redirect: "error" } : undefined));
-    // Only Core's pre-dispatch workload rejection is safe to retry, including a non-idempotent action.
-    const workloadAppId = caller.mandate?.callingAppId ?? caller.workload?.appId;
+    const workloadAppId = caller.app?.appId ?? caller.mandate?.callingAppId ?? caller.workload?.appId;
+    const send = (request: Request) =>
+      workloadAppId ? sendAppRequest(request, { appId: workloadAppId, transport: caller.transport }) : (caller.transport ?? fetch)(request);
+    // Only Core's pre-dispatch legacy rejection is safe to refresh and retry.
+    // A configured app key is never downgraded to a reusable credential.
     const retryRequest = workloadAppId ? brokerRequest.clone() : undefined;
     let response = await send(brokerRequest);
     const credentialRejected = (reply: Response) => reply.status === 401 && reply.headers.get("x-cloud-workload-auth") === "required";
-    if (workloadAppId && retryRequest && credentialRejected(response)) {
+    if (!caller.app && workloadAppId && retryRequest && !env.CLOUD_APP_KEY && credentialRejected(response)) {
       await response.body?.cancel();
       let token: string | undefined;
       try {
@@ -228,14 +252,17 @@ export const listCapabilityCatalog = async (
     if (options.caller) {
       const caller = options.caller;
       if (options.authority) throw new Error("Use one catalog authority source");
-      if (caller.authority && (caller.authorization || caller.cookie || caller.mandate || caller.workload || caller.transport))
+      if (
+        caller.authority &&
+        (caller.authorization || caller.cookie || caller.app || caller.mandate || caller.workload || caller.transport)
+      )
         throw new Error("Use exactly one capability authority source");
       if (caller.authority)
         return {
           ok: true,
           data: await loadCapabilityCatalogPage({ cursor: options.cursor, limit }, {}, caller.locale ?? options.locale, caller.authority),
         };
-      if (caller.mandate || caller.workload) throw new Error("Calendar discovery requires request credentials");
+      if (caller.app || caller.mandate || caller.workload) throw new Error("Calendar discovery requires request credentials");
       const query = new URLSearchParams({ limit: String(limit) });
       if (options.cursor) query.set("cursor", options.cursor);
       const request = new Request(await callerRequest(caller, `/api/capabilities/v1/catalog?${query}`), { method: "GET" });

package/src/capabilities/server.ts

@@ -19,6 +19,7 @@ import type { CapabilityCatalogAppClientResult, CapabilityInvocation, Capability
 
 export type { CapabilityActionWording } from "../_internal/capability-sentences";
 export {
+  appCaller,
   type CapabilityCaller,
   invokeCapability,
   invokeCapabilityWithDataSchema,
@@ -89,7 +90,7 @@ export const reviewCapabilityAction = async <TInput = unknown>(
   caller: CapabilityCaller,
 ): Promise<CapabilityReviewClientResult> => {
   try {
-    if (caller.workload) throw new Error("App query authority cannot review Actions");
+    if (caller.app || caller.workload) throw new Error("App query authority cannot review Actions");
     if (caller.authority) {
       if (caller.authorization || caller.cookie || caller.mandate || caller.transport)
         throw new Error("Use exactly one capability authority source");

package/src/cli/admin/app-keys.ts

@@ -78,7 +78,8 @@ export const enrollAppKey = async (input: {
   format: AppKeyArtifactFormat;
   uid?: number;
   name?: string;
-  register: (body: { publicKey: string; name?: string }) => Promise<unknown>;
+  grants?: "oauth:issue"[];
+  register: (body: { publicKey: string; name?: string; grants?: "oauth:issue"[] }) => Promise<unknown>;
 }) => {
   validateAppKeyAppId(input.appId);
   if (input.uid !== undefined && process.getuid?.() !== 0 && process.getuid?.() !== input.uid)
@@ -113,7 +114,11 @@ export const enrollAppKey = async (input: {
   if ((await deriveAppPublicKey(state.seed)) !== state.publicKey) throw new Error("Enrollment public key does not match its seed");
   await owner(provisional, input.uid);
   const registered = registrationSchema.parse(
-    await input.register({ publicKey: state.publicKey, ...(input.name ? { name: input.name } : {}) }),
+    await input.register({
+      publicKey: state.publicKey,
+      ...(input.name ? { name: input.name } : {}),
+      ...(input.grants ? { grants: input.grants } : {}),
+    }),
   );
   if (registered.fingerprint !== (await appKeyFingerprint(state.publicKey)))
     throw new Error("Core returned a different app-key fingerprint");
@@ -161,8 +166,11 @@ export const appKeyCommands = [
       format: flag.enum(["file", "env", "compose", "k8s-secret"] as const, { default: "file" }),
       uid: flag.int({ min: 0, description: "File owner UID; requires root or the current UID" }),
       name: flag.string({ description: "Human-readable key name" }),
+      grant: flag.enum(["oauth:issue"] as const, { description: "Grant OAuth issuance to each new key; repeat on rotation" }),
+      noGrant: flag.boolean({ name: "no-grant", description: "Enroll new keys without grants (the default)" }),
     },
     async run({ ctx, args, flags }) {
+      if (flags.grant && flags.noGrant) throw new Error("Choose either --grant or --no-grant");
       const apps = await resolveAppKeyApps(args.apps, flags.all, flags.apps);
       const results = [];
       for (const appId of apps)
@@ -174,6 +182,7 @@ export const appKeyCommands = [
             format: flags.format ?? "file",
             uid: flags.uid,
             name: flags.name,
+            grants: flags.grant ? [flags.grant] : flags.noGrant ? [] : undefined,
             register: (body) => apiJson(ctx, "POST", keyPath(appId), body),
           }),
         );
@@ -194,6 +203,14 @@ export const appKeyCommands = [
       const result = z
         .object({
           installationId: z.uuid(),
+          lastRejectedStart: z
+            .object({
+              at: z.iso.datetime(),
+              reason: z.enum(["revoked", "expired", "disabled", "connections_not_permitted"]),
+              keyId: z.uuid().nullable(),
+            })
+            .nullable()
+            .optional(),
           items: z.array(
             z
               .object({ keyId: z.string(), name: z.string(), fingerprint: z.string(), status: z.string(), accountStatus: z.string() })
@@ -202,7 +219,11 @@ export const appKeyCommands = [
         })
         .passthrough()
         .parse(await apiGet(ctx, `${keyPath(args.app)}?page=${flags.page}&perPage=${flags.perPage}`));
-      if (!printStructured(ctx, result))
+      if (!printStructured(ctx, result)) {
+        if (result.lastRejectedStart) {
+          const rejection = result.lastRejectedStart;
+          ctx.print(`Last rejected start: ${rejection.at} · ${rejection.reason} · key ${rejection.keyId ?? "unknown"}`);
+        }
         ctx.table(result.items, [
           { key: "keyId", label: "Key ID" },
           { key: "name", label: "Name" },
@@ -210,6 +231,7 @@ export const appKeyCommands = [
           { key: "status", label: "Status" },
           { key: "accountStatus", label: "Account" },
         ]);
+      }
     },
   }),
   command("apps keys revoke", {

package/src/config/env.ts

@@ -164,13 +164,13 @@ const registry = defineEnv({
     schema: z.string(),
     scope: "secret",
     secretFile: true,
-    doc: "Core and OAuth only: 64-hex secret that lets the OAuth app request token signatures from Core; generate independently with `openssl rand -hex 32`.",
+    doc: "Deprecated: Core and OAuth legacy 64-hex broker secret, used only when OAuth has no app key. Configure an OAuth app key instead; retained for this release.",
   },
   CLOUD_APP_KEY: {
     schema: z.string(),
     scope: "secret",
     secretFile: true,
-    doc: "App Ed25519 private key for startup connection bootstrap; alternatively mount CLOUD_APP_KEY_FILE. Requires the direct Core origin. Core and Gateway refuse app keys. Keep infrastructure env until the platform-client import migration is complete.",
+    doc: "App Ed25519 private key for startup bootstrap, background calls and OAuth issuance; alternatively mount CLOUD_APP_KEY_FILE. Requires the direct Core origin. Core and Gateway refuse app keys. Keep infrastructure env until the platform-client import migration is complete.",
   },
   CLOUD_CORE_INTERNAL_ORIGIN: {
     schema: z.string(),
@@ -180,7 +180,7 @@ const registry = defineEnv({
     schema: z.string(),
     scope: "secret",
     secretFile: true,
-    doc: "Optional host-run app override for the automatically delivered app workload credential; provision through Core's admin workload API with `identity:invoke`.",
+    doc: "Deprecated: host-run override for the automatically delivered workload credential when no app key is configured; use CLOUD_APP_KEY or CLOUD_APP_KEY_FILE instead. Retained for this release.",
   },
   CLOUD_IDENTITY_JWKS_ORIGIN: {
     schema: z.string(),
@@ -188,7 +188,7 @@ const registry = defineEnv({
   },
   CLOUD_OAUTH_JWKS_ORIGIN: {
     schema: z.string(),
-    doc: "Optional private origin of the OAuth listener for OAuth JWKS; unset fetches keys from the public issuer origin.",
+    doc: "Deprecated: explicit legacy OAuth JWKS origin, honored for this release. Unset uses Core internal OAuth JWKS through CLOUD_CORE_INTERNAL_ORIGIN, then the public issuer origin.",
   },
 
   // Build and standalone development

package/src/contracts/capabilities.ts

@@ -12,6 +12,7 @@ import { z } from "zod";
 import type { RequestAuthority } from "../server/middleware/auth";
 import type { AppEventDefinition, AppEventSubscriptionDefinition } from "./app-events";
 import { CommandPathSchema } from "./commands";
+import { type PlatformPermission, PlatformPermissionSchema } from "./outgoing-mail";
 import type { AccessSubject, RequestActor, User } from "./shared";
 import { AuthenticatedPrincipalSchema } from "./shared";
 
@@ -955,12 +956,12 @@ export type CapabilityPresentationCatalog = {
 
 /** App authority has no grant-bearing subject, user, nested exchange, or interactive credential. */
 export type CapabilityAppExecutionContext = {
-  actor: { kind: "app"; appId: string };
+  actor: { kind: "app"; appId: string; keyId?: string };
   accessSubject: { type: "none" };
   user: null;
   authority?: never;
   query?: never;
-  idempotencyKey?: never;
+  idempotencyKey?: string;
   locale: string;
   requestId: string;
   origin: CapabilityOrigin;
@@ -968,8 +969,18 @@ export type CapabilityAppExecutionContext = {
   signal: AbortSignal;
 };
 
+/** Explicit provider entry for calls paid for and authorized as the calling application. */
+export type CapabilityAppHandler<Input extends z.ZodType, Data extends z.ZodType> = {
+  permission: PlatformPermission;
+  run: (
+    input: z.output<Input>,
+    context: CapabilityAppExecutionContext,
+  ) => CapabilityInvocationResult<z.output<Data>> | Promise<CapabilityInvocationResult<z.output<Data>>>;
+};
+
 export type CapabilityQueryDefinition<Input extends z.ZodType = z.ZodType<any>, Data extends z.ZodType = z.ZodType<any>> = {
   appOnly?: never;
+  app?: CapabilityAppHandler<Input, Data>;
   title: string;
   description: string;
   input: Input;
@@ -988,6 +999,7 @@ export type CapabilityActionApprovalPolicy = "rememberable" | "none";
 
 export type CapabilityActionDefinition<Input extends z.ZodType = z.ZodType<any>, Data extends z.ZodType = z.ZodType<any>> = {
   appOnly?: never;
+  app?: CapabilityAppHandler<Input, Data>;
   title: string;
   description: string;
   input: Input;
@@ -1104,6 +1116,7 @@ const CapabilityOperationManifestBaseSchema = z
     inputSchema: z.record(z.string(), z.unknown()),
     dataSchema: z.record(z.string(), z.unknown()),
     stream: CapabilityStreamPolicySchema.optional(),
+    appPermission: PlatformPermissionSchema.optional(),
     schemaHash: z.string().regex(/^[a-f0-9]{64}$/),
   })
   .strict();

package/src/contracts/outgoing-mail.ts

@@ -2,7 +2,7 @@ import type { PageParams, Paginated, ServiceError } from "@k2b/stdlib";
 import { z } from "zod";
 import { type RequestActor, ServiceAccountSchema, UserSchema } from "./shared";
 
-export const PlatformPermissionSchema = z.enum(["mail:send", "mail:read", "resources:readers"]);
+export const PlatformPermissionSchema = z.enum(["mail:send", "mail:read", "resources:readers", "geo:query"]);
 export type PlatformPermission = z.infer<typeof PlatformPermissionSchema>;
 export const MailRetentionSchema = z.object({ contentDays: z.int().min(1).max(36500), recordDays: z.int().min(1).max(36500) }).strict();
 export type MailRetention = z.infer<typeof MailRetentionSchema> & {

package/src/events/app-event-delivery.ts

@@ -1,8 +1,8 @@
 import type { Topic, TopicConfig } from "@k2b/sync";
-import { sql } from "bun";
 import { assertAppEventSize } from "../_internal/app-event-schemas";
 import { lazySync } from "../_internal/process-sync";
 import { type AppEventEnvelope, AppEventEnvelopeSchema } from "../contracts/app-events";
+import { sql } from "../runtime/clients";
 import { logger } from "../services/logging";
 import { createPgOutbox } from "../services/outbox";
 

package/src/events/live-delivery.ts

@@ -1,7 +1,8 @@
 import type { Topic, TopicConfig } from "@k2b/sync";
-import { type SQL, sql } from "bun";
+import type { SQL } from "bun";
 import type { z } from "zod";
 import { lazySync } from "../_internal/process-sync";
+import { sql } from "../runtime/clients";
 import { logger } from "../services/logging";
 import { createPgOutbox } from "../services/outbox";
 import type { LiveEnvelope } from "./live-engine";

package/src/runtime/bootstrap-protocol.ts

@@ -42,12 +42,16 @@ export const bootstrapBodyDigest = async (body: Uint8Array<ArrayBuffer>): Promis
   Buffer.from(await crypto.subtle.digest("SHA-256", body)).toString("base64url");
 
 /** Call at the HTTP transmission seam, including every retry. */
-export const signBootstrapProof = async (key: AppKey, now = Date.now()): Promise<string> => {
+export const signAppProof = async (
+  key: AppKey,
+  request: { method: string; path: string; body: Uint8Array<ArrayBuffer> },
+  now = Date.now(),
+): Promise<string> => {
   const iat = Math.floor(now / 1000);
   return new SignJWT({
-    htm: "POST",
-    htu: BOOTSTRAP_PATH,
-    bdh: await bootstrapBodyDigest(new TextEncoder().encode(BOOTSTRAP_BODY)),
+    htm: request.method,
+    htu: request.path,
+    bdh: await bootstrapBodyDigest(request.body),
   })
     .setProtectedHeader({ alg: "EdDSA", typ: BOOTSTRAP_TYPE, kid: key.keyId })
     .setIssuer(key.appId)
@@ -58,3 +62,6 @@ export const signBootstrapProof = async (key: AppKey, now = Date.now()): Promise
     .setJti(crypto.randomUUID())
     .sign(await importAppKeySeed(key.seed));
 };
+
+export const signBootstrapProof = (key: AppKey, now = Date.now()): Promise<string> =>
+  signAppProof(key, { method: "POST", path: BOOTSTRAP_PATH, body: new TextEncoder().encode(BOOTSTRAP_BODY) }, now);

package/src/runtime/clients.ts

@@ -1,6 +1,6 @@
 import { RedisClient, type RedisOptions, SQL } from "bun";
 import { postgresApplicationOptions } from "../_internal/postgres-application-name";
-import { connections, hasConnections } from "./connections";
+import { connections } from "./connections";
 
 export type SqlPoolOptions = SQL.PostgresOrMySQLOptions;
 
@@ -28,6 +28,8 @@ const notStarted = <T>(name: string): T => {
 
 export let sql: SQL = notStarted("sql");
 export let redis: RedisClient = notStarted("redis");
+// Whether `sql` and `redis` hold native clients; teardown must not touch the placeholders.
+let live = false;
 
 /** Own pool and lifecycle; defaults to the installation URL and application name. */
 export const createSql = (options: SqlPoolOptions = {}): SQL => {
@@ -55,6 +57,7 @@ export const initializeClients = async (): Promise<void> => {
     const valkey = createRedis();
     sql = database;
     redis = valkey;
+    live = true;
   } catch {
     await database.close();
     throw new Error("Valkey client configuration is invalid; check REDIS_URL and native Redis options");
@@ -63,7 +66,8 @@ export const initializeClients = async (): Promise<void> => {
 
 /** Internal test-target teardown, before a fixture selects a different database. */
 export const closePlatformClients = async (): Promise<void> => {
-  if (hasConnections()) {
+  if (live) {
+    live = false;
     await sql.close();
     redis.close();
   }

package/src/server/index.ts

@@ -1,6 +1,7 @@
 export { buildMetadata } from "../_internal/build-metadata";
 export { loadPendingApprovals } from "../api/approvals-loader";
 export { geoClient } from "../capabilities/geo-client";
+export { appCaller } from "../capabilities/server-invoke";
 export { expectUserBackedActor, getUserBackedActor, isAppSessionActor, userFromActor } from "./actor";
 export type { ApiErrorBody, ApiErrorResponse, ApiErrorStatus } from "./api";
 export { api, respond, respondMessage } from "./api";

package/src/server/ratelimit.ts

@@ -1,5 +1,5 @@
 import { createHash } from "node:crypto";
-import { redis } from "bun";
+import { redis } from "../runtime/clients";
 
 /**
  * Sliding-window rate limiter on the Cloud Redis.

package/src/server/services/access.ts

@@ -1,7 +1,8 @@
 import { err, fail, ok, type Result } from "@k2b/stdlib";
-import { type SQLQuery, sql } from "bun";
+import type { SQLQuery } from "bun";
 import { type ManagerCandidate, removesLastManager } from "../../access/managers";
 import { accessMessages } from "../../access/messages";
+import { sql } from "../../runtime/clients";
 import { recursiveGroupIdsSubquery, recursiveServiceAccountGroupIdsSubquery } from "../../services/accounts/group-sql";
 import { toPgUuidArray } from "../../services/postgres";
 import type { ServiceAccountKind } from "../../services/service-accounts";

package/src/services/account-category-policy.ts

@@ -1,10 +1,10 @@
-import { sql } from "bun";
 import {
   type AccountCategory,
   type AccountCategoryPolicy,
   accountCategory,
   DEFAULT_ACCOUNT_CATEGORY_POLICY,
 } from "../contracts/account-categories";
+import { sql } from "../runtime/clients";
 import { decryptValue } from "./settings/crypto";
 
 const prefix = "user.category.";

package/src/services/account-lifecycle/audit.ts

@@ -1,5 +1,5 @@
-import { sql } from "bun";
 import type { UserProfile, UserProvider } from "../../contracts/shared";
+import { sql } from "../../runtime/clients";
 
 export type DeletedAccountReason =
   | "ipa_expired_demoted"

package/src/services/account-lifecycle/index.ts

@@ -1,5 +1,5 @@
-import { sql } from "bun";
 import type { User } from "../../contracts/shared";
+import { sql } from "../../runtime/clients";
 import { err, fail, freeipa, ok, type Result } from "../../server/services";
 import { dates } from "../../shared";
 import { getConfiguredExpiryDays, parseIpaAccountTransitionPolicy } from "../account-model";

package/src/services/account-lifecycle/ipa-backfill.ts

@@ -1,5 +1,6 @@
 import type { JobContext, PumpConfig, Sync } from "@k2b/sync";
-import { sql } from "bun";
+import { sql } from "../../runtime/clients";
+
 import { freeipa } from "../../server/services/freeipa";
 import { getConfiguredExpiryDays } from "../account-model";
 import { getFreeIpaConfig } from "../freeipa-config";

package/src/services/accounts/app.ts

@@ -1,4 +1,3 @@
-import { sql } from "bun";
 import { accountCategory } from "../../contracts/account-categories";
 import type { PersonAvatar } from "../../contracts/avatar";
 import type {
@@ -14,6 +13,7 @@ import type {
   UserProfile,
   UserProvider,
 } from "../../contracts/shared";
+import { sql } from "../../runtime/clients";
 import type { ServiceAccountRequestActor } from "../../server/middleware/auth";
 import {
   err,

package/src/services/accounts/avatar.ts

@@ -1,5 +1,4 @@
 import { createHash } from "node:crypto";
-import { sql } from "bun";
 import {
   type AvatarConfig,
   type AvatarKind,
@@ -12,6 +11,7 @@ import {
 } from "../../contracts/avatar";
 import { MAX_AVATAR_BYTES, MAX_AVATAR_DATA_URL_LENGTH } from "../../contracts/profile";
 import type { MutationResult } from "../../contracts/shared";
+import { sql } from "../../runtime/clients";
 import { AVATAR_RENDERER_REVISION, renderAvatarSvg } from "../../shared/avatar-art";
 import { stripImageMetadata } from "../image-metadata";
 

package/src/services/accounts/base-group.ts

@@ -1,5 +1,5 @@
-import { sql } from "bun";
 import type { BaseGroup, UserProvider } from "../../contracts/shared";
+import { sql } from "../../runtime/clients";
 
 type DbRow = Record<string, unknown>;
 

package/src/services/accounts/directory-shares.ts

@@ -1,7 +1,7 @@
 import { err, fail, ok, type Result } from "@k2b/stdlib";
-import { sql } from "bun";
 import { z } from "zod";
 import type { User } from "../../contracts/shared";
+import { sql } from "../../runtime/clients";
 import type { RequestActor } from "../../server/middleware/auth";
 import { audit } from "../audit";
 

package/src/services/accounts/duplicate-emails.ts

@@ -1,6 +1,6 @@
 import { err, fail, ok, type PageParams, type Paginated, paginate, type Result } from "@k2b/stdlib";
-import { sql } from "bun";
 import type { User } from "../../contracts/shared";
+import { sql } from "../../runtime/clients";
 import { type AccountsActor, isAdminActor } from "./authz";
 
 export type DuplicateEmailUser = Pick<

package/src/services/accounts/entities.ts

@@ -1,5 +1,6 @@
-import { type SQLQuery, sql } from "bun";
+import type { SQLQuery } from "bun";
 import type { EntityKind, EntityListItem, UserProfile, UserProvider } from "../../contracts/shared";
+import { sql } from "../../runtime/clients";
 import { getFreeIpaConfig } from "../freeipa-config";
 import { escapeLikePattern, toPgTextArray, toPgUuidArray } from "../postgres";
 import type { ServiceAccountKind, ServiceAccountStatus } from "../service-accounts";

package/src/services/accounts/group-sql.ts

@@ -1,4 +1,5 @@
-import { type SQLQuery, sql } from "bun";
+import type { SQLQuery } from "bun";
+import { sql } from "../../runtime/clients";
 
 type SqlFragment = SQLQuery;
 type SqlValue = SQLQuery | string;

package/src/services/accounts/groups.ts

@@ -1,5 +1,5 @@
-import { sql } from "bun";
 import type { BaseGroup, GroupMember, MutationResult, UserProvider } from "../../contracts/shared";
+import { sql } from "../../runtime/clients";
 import { freeipa } from "../../server/services";
 import { getServiceIpaSession } from "../ipa/service-account";
 import { toPgUuidArray } from "../postgres";