@k2b/cloud 0.48.0 → 0.50.0

package/src/services/accounts/identities.ts

@@ -1,7 +1,8 @@
-import { type SQLQuery, sql } from "bun";
+import type { SQLQuery } from "bun";
 import { z } from "zod";
 import { DEFAULT_LINUX_IDENTITY_CONFIGURATION, LinuxIdentityConfigurationSchema } from "../../contracts/posix";
 import type { RequestActor, UserProfile, UserProvider } from "../../contracts/shared";
+import { sql } from "../../runtime/clients";
 import { userFromActor } from "../../server/actor";
 import { isAccountCategoryAllowed } from "../account-category-policy";
 import { toPgTextArray } from "../postgres";
@@ -66,9 +67,10 @@ const cursor = (after?: string): string | null => {
 };
 
 /** Server-side identity reads. Authentication and application resource authorization remain caller-owned. */
-export const createAccountIdentityService = (db: typeof sql = sql, upstreamIdentity = readUpstreamIdentity) => {
+export const createAccountIdentityService = (injectedDb?: typeof sql, upstreamIdentity = readUpstreamIdentity) => {
+  const db = () => injectedDb ?? sql;
   const setting = async (key: string, fallback: unknown): Promise<unknown> => {
-    const [row] = await db<{ value: string }[]>`SELECT value FROM settings.entries WHERE key = ${key}`;
+    const [row] = await db()<{ value: string }[]>`SELECT value FROM settings.entries WHERE key = ${key}`;
     return row ? decryptValue(row.value) : fallback;
   };
   const availability = async (): Promise<AccountIdentityAvailability> => {
@@ -84,7 +86,7 @@ export const createAccountIdentityService = (db: typeof sql = sql, upstreamIdent
       throw new AccountIdentityError("invalid_identity_configuration");
     }
   };
-  const userRows = (filter: SQLQuery) => db<UserRow[]>`
+  const userRows = (filter: SQLQuery) => db()<UserRow[]>`
     SELECT u.id, u.provider, u.uid, u.profile, u.admin,
       (u.account_expires IS NOT NULL AND u.account_expires <= now()) AS expired,
       p.managed_by, p.uid_number, p.primary_gid_number
@@ -98,7 +100,7 @@ export const createAccountIdentityService = (db: typeof sql = sql, upstreamIdent
     const [row] = await userRows(sql`u.id = ${supplied.id}::uuid`);
     if (!row || row.expired || row.provider !== supplied.provider || row.uid !== supplied.uid || row.profile !== supplied.profile)
       throw new AccountIdentityError("identity_unavailable");
-    if (!(await isAccountCategoryAllowed(row, db))) throw new AccountIdentityError("identity_unavailable");
+    if (!(await isAccountCategoryAllowed(row, db()))) throw new AccountIdentityError("identity_unavailable");
     const state = await availability();
     if (row.provider === "ipa" && !state.freeipaEnabled) throw new AccountIdentityError("identity_unavailable");
     return { row, state, supplied };
@@ -113,14 +115,14 @@ export const createAccountIdentityService = (db: typeof sql = sql, upstreamIdent
       if (!Array.isArray(configured) || !configured.every((value): value is string => typeof value === "string"))
         throw new AccountIdentityError("invalid_identity_configuration");
       const names = configured.length > 0 ? configured : ["admins"];
-      const [membership] = await db`SELECT 1 FROM auth.ipa_user_effective_groups
+      const [membership] = await db()`SELECT 1 FROM auth.ipa_user_effective_groups
         WHERE user_id = ${current.row.id}::uuid AND group_name = ANY(${toPgTextArray(names)}::text[]) LIMIT 1`;
       if (!membership) throw new AccountIdentityError("admin_required");
     }
     return current;
   };
   const groupRows = async (filter: SQLQuery) => {
-    const rows = await db<{ id: string; provider: UserProvider; name: string; gid_number: number | null; personal: boolean }[]>`
+    const rows = await db()<{ id: string; provider: UserProvider; name: string; gid_number: number | null; personal: boolean }[]>`
       SELECT g.id, g.provider, g.name, g.gid_number,
         EXISTS(SELECT 1 FROM auth.personal_groups p WHERE p.group_id = g.id) AS personal
       FROM auth.groups g
@@ -189,7 +191,7 @@ export const createAccountIdentityService = (db: typeof sql = sql, upstreamIdent
         eligible: current.profile === "user",
       };
     }
-    const [ownership] = await db<{ personal: boolean }[]>`SELECT EXISTS (
+    const [ownership] = await db()<{ personal: boolean }[]>`SELECT EXISTS (
       SELECT 1 FROM auth.personal_groups p
       WHERE (${input.identityId ?? null}::uuid IS NOT NULL AND p.group_id = ${input.identityId ?? null}::uuid)
          OR (${input.identityId ?? null}::uuid IS NULL AND p.group_name = ${input.name})
@@ -238,10 +240,10 @@ export const createAccountIdentityService = (db: typeof sql = sql, upstreamIdent
       const after = cursor(input.after);
       const state = await availability();
       const [localAllowed, ipaAllowed] = await Promise.all([
-        isAccountCategoryAllowed({ provider: "local", profile: "user" }, db),
-        isAccountCategoryAllowed({ provider: "ipa", profile: "user" }, db),
+        isAccountCategoryAllowed({ provider: "local", profile: "user" }, db()),
+        isAccountCategoryAllowed({ provider: "ipa", profile: "user" }, db()),
       ]);
-      const rows = await db<
+      const rows = await db()<
         {
           id: string;
           provider: UserProvider;

package/src/services/accounts/ipa-data.ts

@@ -1,5 +1,5 @@
-import { sql } from "bun";
 import type { IpaUserData } from "../../contracts/shared";
+import { sql } from "../../runtime/clients";
 
 type DbRow = Record<string, unknown>;
 

package/src/services/accounts/local-groups.ts

@@ -1,5 +1,6 @@
-import { sql, type TransactionSQL } from "bun";
+import type { TransactionSQL } from "bun";
 import type { BaseGroup, GroupMember, MutationResult, UserProvider } from "../../contracts/shared";
+import { sql } from "../../runtime/clients";
 import { escapeLikePattern, isUniqueViolation } from "../postgres";
 import { buildBaseGroup, personalOwnerJoin } from "./base-group";
 import { recursiveServiceAccountGroupIdsSubquery } from "./group-sql";

package/src/services/accounts/machine-group-management.ts

@@ -1,4 +1,5 @@
-import { sql } from "bun";
+import { sql } from "../../runtime/clients";
+
 import type { ServiceAccountRequestActor } from "../../server/middleware/auth";
 import { err, fail, ok, type Result } from "../../server/services";
 import { audit } from "../audit";

package/src/services/accounts/posix.ts

@@ -1,4 +1,3 @@
-import { sql } from "bun";
 import {
   DEFAULT_LINUX_IDENTITY_CONFIGURATION,
   isPosixName,
@@ -8,6 +7,7 @@ import {
   PosixOverridesSchema,
 } from "../../contracts/posix";
 import type { MutationResult } from "../../contracts/shared";
+import { sql } from "../../runtime/clients";
 import { freeipa } from "../../server/services";
 import { type AuditActor, audit } from "../audit";
 import { getFreeIpaConfig } from "../freeipa-config";
@@ -128,8 +128,9 @@ const candidate = (row: IdentityRow): PosixCandidate => {
 };
 
 // Database injection is used by isolated integration tests; production uses the shared pool.
-export const createPosixRuntime = (db: typeof sql = sql, readRanges = readIpaIdRanges) => {
-  const readConfig = async (connection = db): Promise<LinuxIdentityConfiguration> => {
+export const createPosixRuntime = (injectedDb?: typeof sql, readRanges = readIpaIdRanges) => {
+  const db = () => injectedDb ?? sql;
+  const readConfig = async (connection = db()): Promise<LinuxIdentityConfiguration> => {
     // Provisioning must not use a stale cache after an operator disables or changes the range.
     const [row] = await connection<{ value: string }[]>`SELECT value FROM settings.entries WHERE key = ${CONFIG_KEY}`;
     try {
@@ -256,7 +257,7 @@ export const createPosixRuntime = (db: typeof sql = sql, readRanges = readIpaIdR
     actor?: AuditActor,
   ): Promise<MutationResult<{ id: string }>> => {
     try {
-      return await db.begin(async (tx) => {
+      return await db().begin(async (tx) => {
         await lock(tx);
         const result = await write(tx);
         if (!result.ok) return result;
@@ -316,13 +317,13 @@ export const createPosixRuntime = (db: typeof sql = sql, readRanges = readIpaIdR
     },
     async overview(actor: Actor, after: string | null = null, filters: { search?: string; scope?: "ready" | "all" } = {}) {
       requireAdmin(actor);
-      const result = await rows(db, null, after, filters);
+      const result = await rows(db(), null, after, filters);
       const items = result.slice(0, POSIX_PAGE_SIZE).map(candidate);
       return { config: await service.configuration(actor), items, nextCursor: result.length > POSIX_PAGE_SIZE ? items.at(-1)!.id : null };
     },
     async get(actor: Actor, id: string) {
       requireAdmin(actor);
-      const [row] = await rows(db, id, null);
+      const [row] = await rows(db(), id, null);
       if (!row) throw new PosixError("user_not_found", 404);
       return { config: await readConfig(), user: candidate(row) };
     },
@@ -331,7 +332,7 @@ export const createPosixRuntime = (db: typeof sql = sql, readRanges = readIpaIdR
       const parsed = LinuxIdentityConfigurationSchema.safeParse(input);
       if (!parsed.success) throw new PosixError("invalid_configuration", 400);
       const ranges = parsed.data.enabled ? await readRanges() : [];
-      await db.begin(async (tx) => {
+      await db().begin(async (tx) => {
         // Same order as provisioning; settings write upgrades this lock in the same transaction.
         await lock(tx);
         if (options?.replaceUnreadable !== true) {
@@ -360,7 +361,7 @@ export const createPosixRuntime = (db: typeof sql = sql, readRanges = readIpaIdR
     },
     async provision(actor: Actor, id: string) {
       requireAdmin(actor);
-      return db.begin(async (tx) => {
+      return db().begin(async (tx) => {
         await lock(tx);
         const config = await readConfig(tx);
         if (!config.enabled) throw new PosixError("setup_disabled");
@@ -371,7 +372,7 @@ export const createPosixRuntime = (db: typeof sql = sql, readRanges = readIpaIdR
       requireAdmin(actor);
       const parsed = PosixOverridesSchema.safeParse(input);
       if (!parsed.success) throw new PosixError("invalid_paths", 400);
-      return db.begin(async (tx) => {
+      return db().begin(async (tx) => {
         await lock(tx);
         const [row] = await rows(tx, id, null);
         if (!row) throw new PosixError("user_not_found", 404);
@@ -394,7 +395,7 @@ export const createPosixRuntime = (db: typeof sql = sql, readRanges = readIpaIdR
     async createGroup(actor: Actor, input: { name: string; description?: string }) {
       requireAdmin(actor);
       const ranges = await readRanges();
-      return db.begin(async (tx) => {
+      return db().begin(async (tx) => {
         await lock(tx);
         const created = await createLocalGroup(input, tx);
         if (!created.ok) throw new PosixError("group_conflict");
@@ -405,7 +406,7 @@ export const createPosixRuntime = (db: typeof sql = sql, readRanges = readIpaIdR
     async provisionGroup(actor: Actor, id: string) {
       requireAdmin(actor);
       const ranges = await readRanges();
-      return db.begin(async (tx) => {
+      return db().begin(async (tx) => {
         await lock(tx);
         return assignGroup(tx, actor, id, ranges);
       });
@@ -413,5 +414,5 @@ export const createPosixRuntime = (db: typeof sql = sql, readRanges = readIpaIdR
   };
   return { service, writeLocalAccount };
 };
-export const createPosixService = (db: typeof sql = sql, readRanges = readIpaIdRanges) => createPosixRuntime(db, readRanges).service;
+export const createPosixService = (db?: typeof sql, readRanges = readIpaIdRanges) => createPosixRuntime(db, readRanges).service;
 export const { service: posix, writeLocalAccount } = createPosixRuntime();

package/src/services/accounts/request-policy.ts

@@ -1,4 +1,5 @@
-import { sql } from "bun";
+import { sql } from "../../runtime/clients";
+
 import { decryptValue } from "../settings/crypto";
 
 /** Read durable policy so disabling new requests is not delayed by the settings cache. */

package/src/services/accounts/switching.ts

@@ -1,5 +1,5 @@
-import { sql } from "bun";
 import type { UserProfile, UserProvider } from "../../contracts/shared";
+import { sql } from "../../runtime/clients";
 import * as settings from "../settings";
 import type { IpaAccountTransitionPolicy } from "./model";
 

package/src/services/accounts/users.ts

@@ -1,4 +1,4 @@
-import { type SQL, sql } from "bun";
+import type { SQL } from "bun";
 import type {
   BaseUser,
   MutationResult,
@@ -9,6 +9,7 @@ import type {
   UserProfile,
   UserProvider,
 } from "../../contracts/shared";
+import { sql } from "../../runtime/clients";
 import { freeipa } from "../../server/services";
 import { createAuthLoginUrl } from "../../shared/redirect";
 import { isAccountCategoryAllowed } from "../account-category-policy";

package/src/services/announcements/index.ts

@@ -1,5 +1,4 @@
 import { err, fail, ok, type Result } from "@k2b/stdlib";
-import { sql } from "bun";
 import { HTTPException } from "hono/http-exception";
 import { z } from "zod";
 import type {
@@ -11,6 +10,7 @@ import type {
 } from "../../contracts/announcements";
 import { AnnouncementDisplayEntrySchema } from "../../contracts/announcements";
 import { hasRole, type User } from "../../contracts/shared";
+import { sql } from "../../runtime/clients";
 import { markdown } from "../../shared/markdown";
 import { claimCacheFill, completeCacheFill } from "../cache-fill";
 import { logger } from "../logging";

package/src/services/app-access-management.ts

@@ -1,8 +1,9 @@
-import { type SQL, sql } from "bun";
+import type { SQL } from "bun";
 import { managerEligibility } from "../_internal/app-access-manager-sql";
 import type { AppMeta } from "../contracts/app";
 import type { AppAccessDeclaration, AppAccessSnapshot } from "../contracts/app-access";
 import { publishAppAccessChanged, wakeAppAccessChanged } from "../events/app-access";
+import { sql } from "../runtime/clients";
 import { isAppSessionActor, userFromActor } from "../server/actor";
 import type { RequestAuthority } from "../server/middleware/auth";
 import {

package/src/services/app-access.ts

@@ -1,8 +1,9 @@
-import { type SQL, sql } from "bun";
+import type { SQL } from "bun";
 import type { Context } from "hono";
 import { RESOURCE_ACCESS_TIMEOUT_MS, resourceAppAccess } from "../_internal/app-access-resources";
 import type { AppMeta } from "../contracts/app";
 import { AppAccessRuleSchema, type FixedAppAccessRule } from "../contracts/app-access";
+import { sql } from "../runtime/clients";
 import { userFromActor } from "../server/actor";
 import { type AuthContext, auth, type RequestAuthority } from "../server/middleware/auth";
 import { buildAccessPrincipalCondition } from "../server/services/access";

package/src/services/app-admin-facts.ts

@@ -1,7 +1,8 @@
-import { sql } from "bun";
 import { managerEligibility } from "../_internal/app-access-manager-sql";
+import { sql } from "../runtime/clients";
 import type { RequestAuthority } from "../server/middleware/auth";
 import { AppAccessManagementError, canRepairAppAccess } from "./app-access-management";
+import type { LastRejectedStart } from "./app-keys";
 
 export type AppAdminFacts = {
   access: { people: number; groups: number; serviceAccounts: number; managers: number; configured: boolean } | null;
@@ -14,12 +15,14 @@ export type AppAdminFacts = {
     accountStatus: "active" | "disabled" | null;
   };
   tokens: { active: number; total: number };
+  /** Core's last refusal of a start with a verified proof; cleared by the next successful start. */
+  lastRejectedStart: Omit<LastRejectedStart, "keyId"> | null;
   events: { hears: number; sends: number | null; failedDeliveries: number; waitingDeliveries: number };
   notifications: number | null;
   firstKnownAt: string | null;
 };
 
-/** Core-owned administration summary: at most 500 input IDs and four batched SQL reads. */
+/** Core-owned administration summary: at most 500 input IDs and five batched SQL reads. */
 export const appAdminFacts = async (authority: RequestAuthority, appIds: readonly string[]): Promise<Map<string, AppAdminFacts>> => {
   if (!canRepairAppAccess(authority)) throw new AppAccessManagementError("FORBIDDEN", "Cloud administration authority is required.");
   if (appIds.length > 500) throw new AppAccessManagementError("TOO_MANY_APPS", "At most 500 application IDs may be read at once.", 400);
@@ -31,6 +34,7 @@ export const appAdminFacts = async (authority: RequestAuthority, appIds: readonl
         access: null,
         keys: { active: 0, expired: 0, revoked: 0, lastUsedAt: null, firstCreatedAt: null, accountStatus: null },
         tokens: { active: 0, total: 0 },
+        lastRejectedStart: null,
         events: { hears: 0, sends: 0, failedDeliveries: 0, waitingDeliveries: 0 },
         notifications: 0,
         firstKnownAt: null,
@@ -39,7 +43,7 @@ export const appAdminFacts = async (authority: RequestAuthority, appIds: readonl
   );
   if (!ids.length) return facts;
 
-  const [access, credentials, events, notifications] = await Promise.all([
+  const [access, credentials, events, notifications, rejections] = await Promise.all([
     sql<
       {
         app_id: string;
@@ -125,6 +129,9 @@ export const appAdminFacts = async (authority: RequestAuthority, appIds: readonl
       SELECT app_id, count(*)::int AS count FROM notifications.definitions
       WHERE app_id IN ${sql(ids)} AND active = true GROUP BY app_id
     `,
+    sql<{ app_id: string; rejected_at: Date; reason: LastRejectedStart["reason"] }[]>`
+      SELECT app_id, rejected_at, reason FROM auth.app_start_rejections WHERE app_id IN ${sql(ids)}
+    `,
   ]);
 
   for (const row of access) {
@@ -156,5 +163,6 @@ export const appAdminFacts = async (authority: RequestAuthority, appIds: readonl
     facts.get(row.app_id)!.events = { hears: row.hears, sends: row.sends, failedDeliveries: row.failed, waitingDeliveries: row.waiting };
   }
   for (const row of notifications) facts.get(row.app_id)!.notifications = row.count;
+  for (const row of rejections) facts.get(row.app_id)!.lastRejectedStart = { at: row.rejected_at.toISOString(), reason: row.reason };
   return facts;
 };

package/src/services/app-approval.ts

@@ -1,4 +1,4 @@
-import { type SQL, sql } from "bun";
+import type { SQL } from "bun";
 import type { z } from "zod";
 import { lazySync } from "../_internal/process-sync";
 import { env } from "../config/env";
@@ -25,6 +25,7 @@ import {
   appPairingProofMessage,
   APP_APPROVAL_LIMITS as limits,
 } from "../contracts/app-approval";
+import { sql } from "../runtime/clients";
 import { addressPrefix } from "../server/request-context/address";
 import { publicCloudOrigin } from "../shared/app-url";
 import { isAccountCategoryAllowed } from "./account-category-policy";
@@ -296,12 +297,13 @@ const verify = async (key: AppDevicePublicKey, message: string, signature: strin
 /** One owner for production API and isolated HTTP consumers. Config is re-read
  * per operation; SQL transactions serialize device decisions and revocation. */
 export const createAppApprovalService = (
-  db: SQL = sql,
-  configuration = (requireEnabled = true) => readAppApprovalConfig(db, requireEnabled),
+  injectedDb?: SQL,
+  configuration = (requireEnabled = true) => readAppApprovalConfig(injectedDb ?? sql, requireEnabled),
   hints: AppLoginDecisionHints = syncLoginDecisionHints,
   push: AppLoginPushSender = fetchPushSender,
   addresses: AppLoginAddressStore = valkeyAppLoginAddressStore,
 ) => {
+  const db = () => injectedDb ?? sql;
   // Error messages may contain their inputs; log only the error class, never addresses or proofs.
   const addressFailure = (error: unknown) =>
     log.warn("App login address hint unavailable", { error: error instanceof Error ? error.name : "UnknownError" });
@@ -332,12 +334,12 @@ export const createAppApprovalService = (
   const cleanup = async () => {
     // Bounded opportunistic maintenance: each accepted write retires up to 100
     // expired rows per table, so bursts cannot trigger an unbounded sweep.
-    await db`DELETE FROM auth.app_device_changes WHERE id IN (SELECT id FROM auth.app_device_changes WHERE expires_at < now() - interval '1 minute' ORDER BY expires_at LIMIT 100 FOR UPDATE SKIP LOCKED)`;
-    await db`DELETE FROM auth.app_pairings WHERE id IN (SELECT p.id FROM auth.app_pairings p
+    await db()`DELETE FROM auth.app_device_changes WHERE id IN (SELECT id FROM auth.app_device_changes WHERE expires_at < now() - interval '1 minute' ORDER BY expires_at LIMIT 100 FOR UPDATE SKIP LOCKED)`;
+    await db()`DELETE FROM auth.app_pairings WHERE id IN (SELECT p.id FROM auth.app_pairings p
       WHERE p.expires_at < now() - interval '1 minute' AND NOT EXISTS (SELECT 1 FROM auth.app_device_changes c WHERE c.pairing_id=p.id)
       ORDER BY p.expires_at LIMIT 100 FOR UPDATE SKIP LOCKED)`;
-    await db`DELETE FROM auth.app_logins WHERE id IN (SELECT id FROM auth.app_logins WHERE expires_at < now() AND NOT (kind='terminal' AND state='approved') ORDER BY expires_at LIMIT 100 FOR UPDATE SKIP LOCKED)`;
-    await db`DELETE FROM auth.app_device_proofs WHERE (device_id,jti) IN (SELECT device_id,jti FROM auth.app_device_proofs WHERE expires_at < now() ORDER BY expires_at LIMIT 100 FOR UPDATE SKIP LOCKED)`;
+    await db()`DELETE FROM auth.app_logins WHERE id IN (SELECT id FROM auth.app_logins WHERE expires_at < now() AND NOT (kind='terminal' AND state='approved') ORDER BY expires_at LIMIT 100 FOR UPDATE SKIP LOCKED)`;
+    await db()`DELETE FROM auth.app_device_proofs WHERE (device_id,jti) IN (SELECT device_id,jti FROM auth.app_device_proofs WHERE expires_at < now() ORDER BY expires_at LIMIT 100 FOR UPDATE SKIP LOCKED)`;
   };
   const pairingOwner = async (tx: SQL, actor: AppApprovalActor, pairing: PairingRow, cfg: AppApprovalConfig) => {
     if (
@@ -409,7 +411,7 @@ export const createAppApprovalService = (
     if (!cfg.enabled || !cfg.appOrigin) return;
     try {
       // A withdrawn device change keeps its window, so withdrawing and asking again cannot push without bound.
-      const rows = await db<{ push_token: string }[]>`
+      const rows = await db()<{ push_token: string }[]>`
         UPDATE auth.app_devices d SET login_wake_at=now(), login_wake_ref=${requestId}::uuid
         WHERE issuer=${cfg.issuer} AND user_id=${userId}::uuid AND revoked_at IS NULL AND push_token IS NOT NULL
           AND (${options?.accept ?? null}::text IS NULL OR ${options?.accept ?? null}::text=ANY(d.accepts))
@@ -423,7 +425,7 @@ export const createAppApprovalService = (
         Array.from(new Set(rows.map((row) => row.push_token)), async (token) => {
           const status = await push(cfg.appOrigin, { token, cloudOrigin: cfg.issuer, requestRef: requestId });
           if (status === 410)
-            await db`UPDATE auth.app_devices SET push_token=NULL WHERE issuer=${cfg.issuer} AND user_id=${userId}::uuid AND push_token=${token}`;
+            await db()`UPDATE auth.app_devices SET push_token=NULL WHERE issuer=${cfg.issuer} AND user_id=${userId}::uuid AND push_token=${token}`;
         }),
       );
     } catch (error) {
@@ -463,7 +465,7 @@ export const createAppApprovalService = (
       try {
         const cfg = await config(false);
         if (!cfg.enabled || !cfg.appOrigin) return;
-        const rows = await db<{ push_token: string; user_id: string }[]>`
+        const rows = await db()<{ push_token: string; user_id: string }[]>`
           UPDATE auth.app_devices d SET action_wake_at=now(), action_wake_ref=${approvalId}::uuid
           WHERE d.id IN (
             SELECT device.id FROM auth.app_devices device JOIN approvals.requests r ON r.approver_user_id=device.user_id
@@ -483,7 +485,7 @@ export const createAppApprovalService = (
           Array.from(tokens, async ([token, userId]) => {
             const status = await push(cfg.appOrigin, { token, cloudOrigin: cfg.issuer, requestRef: approvalId, kind: "action" });
             if (status === 410)
-              await db`UPDATE auth.app_devices SET push_token=NULL WHERE issuer=${cfg.issuer} AND user_id=${userId}::uuid AND push_token=${token}`;
+              await db()`UPDATE auth.app_devices SET push_token=NULL WHERE issuer=${cfg.issuer} AND user_id=${userId}::uuid AND push_token=${token}`;
           }),
         );
       } catch (error) {
@@ -492,7 +494,7 @@ export const createAppApprovalService = (
     },
     maintain: async (notify: (notice: AppDeviceEnrollmentNotice) => Promise<unknown>, signal?: AbortSignal) => {
       await cleanup();
-      const rows = await db<(DeviceRow & { has_email: boolean })[]>`
+      const rows = await db()<(DeviceRow & { has_email: boolean })[]>`
         SELECT d.*, COALESCE(btrim(u.mail), '') <> '' AS has_email
         FROM auth.app_devices d JOIN auth.users u ON u.id = d.user_id
         WHERE d.notified_at IS NULL ORDER BY d.created_at LIMIT ${limits.pageSize}`;
@@ -503,7 +505,7 @@ export const createAppApprovalService = (
         // The notice is email-only, so an account without email relies on the
         // enrollment audit entry instead of a delivery that can only fail.
         if (row.has_email) await notify({ deviceId: row.id, userId: row.user_id, name: row.name, assisted: row.assisted });
-        await db`UPDATE auth.app_devices SET notified_at=now() WHERE id=${row.id}::uuid AND notified_at IS NULL`;
+        await db()`UPDATE auth.app_devices SET notified_at=now() WHERE id=${row.id}::uuid AND notified_at IS NULL`;
       }
     },
     info: async () => {
@@ -524,7 +526,7 @@ export const createAppApprovalService = (
       const id = crypto.randomUUID(),
         token = secret(),
         expiresAt = future(limits.pairingSeconds);
-      return db.begin(async (tx) => {
+      return db().begin(async (tx) => {
         await fresh(tx, actor);
         if (targetId !== actor.userId && (!actor.admin || !cfg.adminPairing)) return reject("FORBIDDEN", 403);
         await tx`SELECT id FROM auth.users WHERE id = ${targetId}::uuid FOR UPDATE`;
@@ -549,7 +551,7 @@ export const createAppApprovalService = (
     claimPairing: async (claim: { pairingId: string; secret: string; publicKey: AppDevicePublicKey; name: string; signature: string }) => {
       const cfg = await config();
       if (!(await verify(claim.publicKey, appPairingProofMessage(cfg.issuer, claim), claim.signature))) return reject("FORBIDDEN", 403);
-      return db.begin(async (tx) => {
+      return db().begin(async (tx) => {
         const [p] = await tx<
           PairingRow[]
         >`SELECT * FROM auth.app_pairings WHERE id = ${claim.pairingId}::uuid AND issuer = ${cfg.issuer} FOR UPDATE`;
@@ -564,7 +566,7 @@ export const createAppApprovalService = (
     },
     pairingResult: async (id: string, token: string, key: AppDevicePublicKey) => {
       const cfg = await config();
-      const [p] = await db<PairingRow[]>`SELECT * FROM auth.app_pairings WHERE id = ${id}::uuid AND issuer = ${cfg.issuer}`;
+      const [p] = await db()<PairingRow[]>`SELECT * FROM auth.app_pairings WHERE id = ${id}::uuid AND issuer = ${cfg.issuer}`;
       if (!p || !matches(token, p.secret_hash)) return reject("FORBIDDEN", 403);
       const age = Date.now() - new Date(p.expires_at).getTime();
       if (age >= 0 && !(age < 60_000 && (p.state === "confirmed" || p.state === "cancelled"))) return reject("FORBIDDEN", 403);
@@ -576,7 +578,7 @@ export const createAppApprovalService = (
     },
     inspectPairing: async (actor: AppApprovalActor, id: string) => {
       const cfg = await config();
-      return db.begin(async (tx) => {
+      return db().begin(async (tx) => {
         const [p] = await tx<PairingRow[]>`SELECT * FROM auth.app_pairings WHERE id = ${id}::uuid AND issuer = ${cfg.issuer}`;
         if (!p) return reject("UNAVAILABLE", 404);
         const [change] = await tx<ChangeRow[]>`SELECT * FROM auth.app_device_changes WHERE pairing_id=${p.id}::uuid`;
@@ -598,7 +600,7 @@ export const createAppApprovalService = (
     confirmPairing: async (actor: AppApprovalActor, id: string, code: string): Promise<z.infer<typeof AppPairingConfirmResultSchema>> => {
       const cfg = await config();
       let wakeId: string | undefined;
-      const result = await db.begin(async (tx) => {
+      const result = await db().begin(async (tx) => {
         const [snapshot] = await tx<PairingRow[]>`SELECT * FROM auth.app_pairings WHERE id=${id}::uuid AND issuer=${cfg.issuer}`;
         if (!snapshot) return reject("CONFLICT", 409);
         await tx`SELECT id FROM auth.users WHERE id=${snapshot.user_id}::uuid FOR NO KEY UPDATE`;
@@ -636,7 +638,7 @@ export const createAppApprovalService = (
     },
     cancelPairing: async (actor: AppApprovalActor, id: string) => {
       const cfg = await config();
-      return db.begin(async (tx) => {
+      return db().begin(async (tx) => {
         const [snapshot] = await tx<PairingRow[]>`SELECT * FROM auth.app_pairings WHERE id=${id}::uuid AND issuer=${cfg.issuer}`;
         if (!snapshot) return reject("UNAVAILABLE", 404);
         await tx`SELECT id FROM auth.users WHERE id=${snapshot.user_id}::uuid FOR NO KEY UPDATE`;
@@ -656,7 +658,7 @@ export const createAppApprovalService = (
       const cfg = await config(false);
       const changeId = "changeId" in lookup ? lookup.changeId : null,
         deviceId = "deviceId" in lookup ? lookup.deviceId : null;
-      const [row] = await db<ChangeRow[]>`SELECT * FROM auth.app_device_changes
+      const [row] = await db()<ChangeRow[]>`SELECT * FROM auth.app_device_changes
         WHERE issuer=${cfg.issuer} AND user_id=${actor.userId}::uuid AND requested_by_sid=${actor.sid}::uuid AND kind='revoke'
           AND (${changeId}::uuid IS NULL OR id=${changeId}::uuid) AND (${deviceId}::uuid IS NULL OR device_id=${deviceId}::uuid)
         ORDER BY created_at DESC, id DESC LIMIT 1`;
@@ -665,7 +667,7 @@ export const createAppApprovalService = (
     },
     cancelChange: async (actor: AppApprovalActor, id: string) => {
       const cfg = await config(false);
-      return db.begin(async (tx) => {
+      return db().begin(async (tx) => {
         await tx`SELECT id FROM auth.users WHERE id=${actor.userId}::uuid FOR NO KEY UPDATE`;
         const change = await ownedChange(tx, cfg, actor, id);
         if (changeStatus(change).state !== "pending") return reject("CONFLICT", 409);
@@ -676,7 +678,7 @@ export const createAppApprovalService = (
     },
     listDevices: async (actor: AppApprovalActor, after?: string) => {
       const cfg = await config(false);
-      const rows = await db<
+      const rows = await db()<
         DeviceRow[]
       >`SELECT * FROM auth.app_devices WHERE issuer=${cfg.issuer} AND user_id=${actor.userId}::uuid AND (${after ?? null}::uuid IS NULL OR id > ${after ?? null}::uuid) ORDER BY id LIMIT ${limits.pageSize + 1}`;
       return {
@@ -692,7 +694,7 @@ export const createAppApprovalService = (
     ): Promise<z.infer<typeof AppDeviceRevokeResultSchema> | undefined> => {
       const cfg = await config(false);
       let wakeId: string | undefined;
-      const result = await db.begin(async (tx) => {
+      const result = await db().begin(async (tx) => {
         await tx`SELECT id FROM auth.users WHERE id=${actor.userId}::uuid FOR NO KEY UPDATE`;
         const user = await fresh(tx, actor);
         const [device] = await tx<DeviceRow[]>`SELECT * FROM auth.app_devices
@@ -723,7 +725,7 @@ export const createAppApprovalService = (
     listUserDevices: async (actor: AppDeviceAdministrator, userId: string): Promise<AppDeviceView[]> => {
       if (!actor.admin) return reject("FORBIDDEN", 403);
       const cfg = await config(false);
-      const rows = await db<
+      const rows = await db()<
         DeviceRow[]
       >`SELECT * FROM auth.app_devices WHERE issuer=${cfg.issuer} AND user_id=${userId}::uuid AND revoked_at IS NULL ORDER BY created_at, id LIMIT ${limits.devicesPerAccount}`;
       return rows.map(view);
@@ -733,7 +735,7 @@ export const createAppApprovalService = (
     revokeUserDevice: async (actor: AppDeviceAdministrator, userId: string, id: string) => {
       if (!actor.admin) return reject("FORBIDDEN", 403);
       const cfg = await config(false);
-      return db.begin(async (tx) => {
+      return db().begin(async (tx) => {
         const [device] = await tx<
           DeviceRow[]
         >`SELECT * FROM auth.app_devices WHERE id=${id}::uuid AND issuer=${cfg.issuer} AND user_id=${userId}::uuid FOR UPDATE`;
@@ -753,7 +755,7 @@ export const createAppApprovalService = (
         code = comparison(),
         expiresAt = future(limits.loginSeconds);
       let owner: string | undefined;
-      await db.begin(async (tx) => {
+      await db().begin(async (tx) => {
         let candidate = await loginCandidate(tx, identifier, category);
         if (candidate && !(await loginBudget(tx, cfg.issuer, candidate.id))) candidate = undefined;
         const now = new Date();
@@ -789,7 +791,7 @@ export const createAppApprovalService = (
         code = comparison(),
         expiresAt = future(limits.loginSeconds);
       let owner: string | undefined;
-      await db.begin(async (tx) => {
+      await db().begin(async (tx) => {
         let candidate = await loginCandidate(tx, input.identifier);
         const subject = candidate ?? { id: crypto.randomUUID(), profile: "user" as const };
         // Even a decoy performs the client-access, device and shared-budget queries.
@@ -830,7 +832,7 @@ export const createAppApprovalService = (
         return reject("FORBIDDEN", 403);
       await cleanup();
       let decidedBrowserId: string | undefined;
-      const outcome = await db.begin(async (tx) => {
+      const outcome = await db().begin(async (tx) => {
         let changeUserId: string | undefined;
         if (proof.command.operation === "change") {
           const [snapshot] = await tx<
@@ -1105,7 +1107,9 @@ export const createAppApprovalService = (
     browserStatus: async (id: string, token: string, hold?: { ms: number; signal?: AbortSignal }) => {
       const cfg = await config();
       const read = async () => {
-        const [row] = await db<LoginRow[]>`SELECT * FROM auth.app_logins WHERE kind='browser' AND id=${id}::uuid AND issuer=${cfg.issuer}`;
+        const [row] = await db()<
+          LoginRow[]
+        >`SELECT * FROM auth.app_logins WHERE kind='browser' AND id=${id}::uuid AND issuer=${cfg.issuer}`;
         if (!row || !matches(token, row.browser_hash)) return reject("UNAVAILABLE", 404);
         const expiresIn = new Date(row.expires_at).getTime() - Date.now();
         return { state: expiresIn <= 0 ? "expired" : row.state, expiresIn };
@@ -1134,7 +1138,7 @@ export const createAppApprovalService = (
     },
     consumeLogin: async (id: string, token: string) => {
       const cfg = await config();
-      return db.begin(async (tx) => {
+      return db().begin(async (tx) => {
         // Lock order is device -> request for both approval and completion.
         const [snapshot] = await tx<
           LoginRow[]