@k2b/cloud 0.48.0 → 0.50.0

package/src/services/identity/app-request.ts

@@ -0,0 +1,44 @@
+import { getAppWorkloadCredential } from "../../_internal/workload-credential";
+import { parseAppKey } from "../../app-key";
+import { env } from "../../config/env";
+import { CapabilityAppIdSchema } from "../../contracts/capabilities";
+import { signAppProof } from "../../runtime/bootstrap-protocol";
+
+/** Send only to Core. Call for every transmission, including safe caller-owned retries. */
+export const sendAppRequest = async (
+  request: Request,
+  options: {
+    appId: string;
+    transport?: (request: Request) => Promise<Response>;
+    /** Release N legacy authority; evaluated only when no app key is configured. */
+    bearer?: () => string | undefined;
+  },
+): Promise<Response> => {
+  const appId = CapabilityAppIdSchema.parse(options.appId);
+  const headers = new Headers(request.headers);
+  const declaredApp = headers.get("X-Cloud-App-Id");
+  if (declaredApp !== null && declaredApp !== appId) throw new Error("App identity header does not match the calling application");
+  headers.set("X-Cloud-App-Id", appId);
+  const keyValue = env.CLOUD_APP_KEY;
+  if (keyValue) {
+    const key = parseAppKey(keyValue);
+    if (key.appId !== options.appId) throw new Error("App-key appId does not match the calling application");
+    const url = new URL(request.url);
+    const proof = await signAppProof(key, {
+      method: request.method,
+      path: url.pathname + url.search,
+      body: new Uint8Array(await request.clone().arrayBuffer()),
+    });
+    headers.set("authorization", `Bearer ${proof}`);
+  } else if (!headers.has("authorization")) {
+    const token = (options.bearer ?? getAppWorkloadCredential)();
+    if (!token) throw new Error("App workload authorization is unavailable");
+    headers.set("authorization", `Bearer ${token}`);
+  }
+  // A proof is bound to this target; redirects must never carry it elsewhere.
+  return (options.transport ?? fetch)(new Request(request, { headers, redirect: "error" }));
+};
+
+/** Legacy workload tokens and the OAuth secret never contain JWT separators. */
+export const isAppRequestProof = (authorization: string | undefined): boolean =>
+  authorization?.startsWith("Bearer ") === true && authorization.slice(7).includes(".");

package/src/services/identity/constants.ts

@@ -1,6 +1,7 @@
 export const CLOUD_SESSION_JWKS_PATH = "/.well-known/cloud-session-jwks.json";
 export const CLOUD_INVOCATION_JWKS_PATH = "/.well-known/cloud-invocation-jwks.json";
 export const CLOUD_OAUTH_JWKS_PATH = "/.well-known/jwks.json";
+export const CLOUD_INTERNAL_OAUTH_JWKS_PATH = "/api/_internal/identity/v1/oauth/jwks";
 export const CLOUD_SESSION_TOKEN_TYPE = "cloud-session+jwt";
 export const CLOUD_SESSION_AUDIENCE = "cloud";
 export const CLOUD_INVOCATION_TOKEN_TYPE = "cloud-invocation+jwt";

package/src/services/identity/index.ts

@@ -1,4 +1,5 @@
 export { getAppWorkloadCredential } from "../../_internal/workload-credential";
+export { isAppRequestProof, sendAppRequest } from "./app-request";
 export {
   CLOUD_INVOCATION_JWKS_PATH,
   CLOUD_INVOCATION_PROTOCOL_VERSION,

package/src/services/identity/invocation-actor.ts

@@ -1,4 +1,5 @@
-import { sql } from "bun";
+import { sql } from "../../runtime/clients";
+
 import type { RequestActor } from "../../server/middleware/auth";
 import type { AccessSubject } from "../../server/services/access";
 import { isAccountCategoryAllowed } from "../account-category-policy";

package/src/services/identity/invocation-token.ts

@@ -507,6 +507,26 @@ const AppQueryClaimsSchema = z
   .strict()
   .refine((claims) => claims.nbf === claims.iat && claims.exp - claims.iat === CLOUD_INVOCATION_TOKEN_TTL_SECONDS);
 
+const AppCapabilityClaimsSchema = z
+  .object({
+    iss: z.string().url(),
+    aud: z.string().regex(/^app:[a-z][a-z0-9-]{0,79}$/),
+    token_use: z.literal("app_capability"),
+    sub: AppIdSchema,
+    key_id: z.uuid(),
+    permission: z.string().min(1).max(100),
+    op: OperationSchema.refine((value) => value.startsWith("capability.query:") || value.startsWith("capability.action:")),
+    schema_hash: z.string().regex(/^[a-f0-9]{64}$/),
+    input_hash: z.string().regex(/^[a-f0-9]{64}$/),
+    request_id: BoundedIdentifierSchema,
+    jti: z.uuid(),
+    iat: z.number().int(),
+    nbf: z.number().int(),
+    exp: z.number().int(),
+  })
+  .strict()
+  .refine((claims) => claims.nbf === claims.iat && claims.exp - claims.iat === CLOUD_INVOCATION_TOKEN_TTL_SECONDS);
+
 export const signAppQueryInvocation = async (input: {
   workload: import("./workload-auth").AuthenticatedWorkload;
   targetAppId: string;
@@ -595,3 +615,95 @@ export const verifyAppQueryInvocation = async (
     throw error;
   }
 };
+
+export const signAppCapabilityInvocation = async (input: {
+  app: { appId: string; keyId: string };
+  kind: "query" | "action";
+  permission: string;
+  targetAppId: string;
+  capabilityId: string;
+  schemaHash: string;
+  input: unknown;
+  requestId: string;
+  signer: PreparedIdentitySigner & { issuer: string };
+}) => {
+  const now = Math.floor(Date.now() / 1000);
+  if (input.signer.signUntil.getTime() < (now + CLOUD_INVOCATION_TOKEN_TTL_SECONDS) * 1000)
+    throw new Error("Signing key expires before the app capability invocation");
+  const claims = AppCapabilityClaimsSchema.parse({
+    iss: input.signer.issuer,
+    aud: `app:${input.targetAppId}`,
+    token_use: "app_capability",
+    sub: input.app.appId,
+    key_id: input.app.keyId,
+    permission: input.permission,
+    op: `capability.${input.kind}:${input.capabilityId}`,
+    schema_hash: input.schemaHash,
+    input_hash: appEventPayloadHash(input.input),
+    request_id: input.requestId,
+    jti: crypto.randomUUID(),
+    iat: now,
+    nbf: now,
+    exp: now + CLOUD_INVOCATION_TOKEN_TTL_SECONDS,
+  });
+  const token = await new SignJWT(claims)
+    .setProtectedHeader({ alg: CLOUD_IDENTITY_ALGORITHM, typ: CLOUD_INVOCATION_TOKEN_TYPE, kid: input.signer.kid })
+    .sign(input.signer.key);
+  if (Buffer.byteLength(token) > IDENTITY_MAX_COMPACT_TOKEN_BYTES) throw new Error("App capability token exceeds its byte budget");
+  return { token, claims };
+};
+
+export const verifyAppCapabilityInvocation = async (
+  token: string,
+  expected: { appId: string; kind: "query" | "action"; capabilityId: string; schemaHash: string; input: unknown; permission: string },
+  options: { issuer?: string; key?: JWTVerifyGetKey; now?: Date } = {},
+) => {
+  if (Buffer.byteLength(token) > IDENTITY_MAX_COMPACT_TOKEN_BYTES) return null;
+  try {
+    assertProtectedHeader(decodeProtectedHeader(token));
+  } catch {
+    return null;
+  }
+  // Configuration and key-fetch failures must remain retryable, rather than look like invalid tokens.
+  const runtime = options.issuer && options.key ? null : await getIdentityRuntimeConfig();
+  try {
+    const issuer = options.issuer ?? runtime!.issuer;
+    const state = options.key ? null : remoteSet(runtime!.invocationJwksUrl);
+    const key = options.key ?? state!.key;
+    const verified = await verifyWithKeyRefresh(
+      (candidate) =>
+        jwtVerify(token, candidate, {
+          algorithms: [CLOUD_IDENTITY_ALGORITHM],
+          issuer,
+          audience: `app:${expected.appId}`,
+          typ: CLOUD_INVOCATION_TOKEN_TYPE,
+          clockTolerance: INVOCATION_CLOCK_TOLERANCE_SECONDS,
+          currentDate: options.now,
+        }),
+      key,
+      state ? { url: runtime!.invocationJwksUrl, state } : null,
+    );
+    const claims = AppCapabilityClaimsSchema.parse(verified.payload);
+    if (
+      claims.permission !== expected.permission ||
+      claims.op !== `capability.${expected.kind}:${expected.capabilityId}` ||
+      claims.schema_hash !== expected.schemaHash ||
+      claims.input_hash !== appEventPayloadHash(expected.input)
+    )
+      return null;
+    return claims;
+  } catch (error) {
+    if (
+      error instanceof z.ZodError ||
+      error instanceof errors.JWTExpired ||
+      error instanceof errors.JWTClaimValidationFailed ||
+      error instanceof errors.JWTInvalid ||
+      error instanceof errors.JWSInvalid ||
+      error instanceof errors.JWSSignatureVerificationFailed ||
+      error instanceof errors.JWKSNoMatchingKey ||
+      error instanceof errors.JOSENotSupported
+    )
+      return null;
+    throw error;
+  }
+};

package/src/services/identity/key-ring.ts

@@ -1,6 +1,6 @@
 import { crypto } from "@k2b/stdlib";
-import { sql } from "bun";
 import { CompactSign, compactVerify, exportJWK, generateKeyPair, importJWK, type JWK } from "jose";
+import { sql } from "../../runtime/clients";
 import { logger } from "../logging";
 import {
   CLOUD_IDENTITY_ALGORITHM,
@@ -449,7 +449,7 @@ export const initializeIdentityAuthority = async (): Promise<void> => {
   if (keys.previous) await rewrapIdentitySigningKeys();
 };
 
-export const listIdentityJwks = async (purpose: "session" | "invocation"): Promise<{ keys: JWK[]; etag: string }> => {
+export const listIdentityJwks = async (purpose: SigningKeyPurpose): Promise<{ keys: JWK[]; etag: string }> => {
   const rows = await sql<Array<{ public_jwk: JWK | string }>>`
         SELECT public_jwk
         FROM auth.signing_keys

package/src/services/identity/resource-readers.ts

@@ -1,7 +1,7 @@
-import { sql } from "bun";
 import { z } from "zod";
 import { type ResourcePrincipal, ResourcePrincipalSchema } from "../../contracts/capabilities";
 import type { AccessSubject } from "../../contracts/shared";
+import { sql } from "../../runtime/clients";
 import { decodeAccountCategoryEnabled } from "../account-category-policy";
 import { toPgUuidArray } from "../postgres";
 import type { ServiceAccount } from "../service-accounts";

package/src/services/identity/routes.ts

@@ -1,12 +1,17 @@
 import { type Context, Hono } from "hono";
-import { CLOUD_INVOCATION_JWKS_PATH, CLOUD_SESSION_JWKS_PATH, IDENTITY_JWKS_MAX_AGE_SECONDS } from "./constants";
+import {
+  CLOUD_INTERNAL_OAUTH_JWKS_PATH,
+  CLOUD_INVOCATION_JWKS_PATH,
+  CLOUD_SESSION_JWKS_PATH,
+  IDENTITY_JWKS_MAX_AGE_SECONDS,
+} from "./constants";
 import { listIdentityJwks } from "./key-ring";
 
 // If-None-Match uses weak comparison, including lists and the wildcard.
 const matchesEtag = (header: string | undefined, etag: string): boolean =>
   header?.trim() === "*" || (header?.match(/(?:W\/)?"[^"]*"/g) ?? []).some((tag) => tag.replace(/^W\//, "") === etag.replace(/^W\//, ""));
 
-const serveJwks = (purpose: "session" | "invocation") => async (c: Context) => {
+const serveJwks = (purpose: "session" | "invocation" | "oauth") => async (c: Context) => {
   const jwks = await listIdentityJwks(purpose);
   if (matchesEtag(c.req.header("if-none-match"), jwks.etag)) {
     c.header("ETag", jwks.etag);
@@ -19,4 +24,7 @@ const serveJwks = (purpose: "session" | "invocation") => async (c: Context) => {
 };
 
 export const createIdentityPublicRoutes = (): Hono =>
-  new Hono().get(CLOUD_SESSION_JWKS_PATH, serveJwks("session")).get(CLOUD_INVOCATION_JWKS_PATH, serveJwks("invocation"));
+  new Hono()
+    .get(CLOUD_SESSION_JWKS_PATH, serveJwks("session"))
+    .get(CLOUD_INVOCATION_JWKS_PATH, serveJwks("invocation"))
+    .get(CLOUD_INTERNAL_OAUTH_JWKS_PATH, serveJwks("oauth"));

package/src/services/identity/runtime-config.ts

@@ -4,7 +4,13 @@ import { publicCloudOrigin } from "../../shared/app-url";
 import { get as getSetting } from "../settings";
 import { decryptValue } from "../settings/crypto";
 import { SETTINGS_MAP, validateSettingValue } from "../settings/defaults";
-import { CLOUD_INVOCATION_JWKS_PATH, CLOUD_OAUTH_JWKS_PATH, CLOUD_SESSION_JWKS_PATH, IDENTITY_REFRESH_TIMEOUT_MS } from "./constants";
+import {
+  CLOUD_INTERNAL_OAUTH_JWKS_PATH,
+  CLOUD_INVOCATION_JWKS_PATH,
+  CLOUD_OAUTH_JWKS_PATH,
+  CLOUD_SESSION_JWKS_PATH,
+  IDENTITY_REFRESH_TIMEOUT_MS,
+} from "./constants";
 
 const RUNTIME_CONFIG_TTL_MS = 60_000;
 
@@ -75,8 +81,13 @@ export const resolveInvocationJwksUrl = (
   transportOrigin = env.CLOUD_IDENTITY_JWKS_ORIGIN ?? env.CLOUD_CORE_INTERNAL_ORIGIN,
 ): URL => resolveCoreJwksUrl(issuer, CLOUD_INVOCATION_JWKS_PATH, transportOrigin);
 
-export const resolveOAuthJwksUrl = (issuer: string, transportOrigin = env.CLOUD_OAUTH_JWKS_ORIGIN): URL => {
-  if (!transportOrigin) return new URL(CLOUD_OAUTH_JWKS_PATH, issuer);
+export const resolveOAuthJwksUrl = (
+  issuer: string,
+  transportOrigin = env.CLOUD_OAUTH_JWKS_ORIGIN,
+  coreOrigin = env.CLOUD_CORE_INTERNAL_ORIGIN,
+): URL => {
+  if (!transportOrigin)
+    return coreOrigin ? resolveCoreJwksUrl(issuer, CLOUD_INTERNAL_OAUTH_JWKS_PATH, coreOrigin) : new URL(CLOUD_OAUTH_JWKS_PATH, issuer);
 
   const url = new URL(CLOUD_OAUTH_JWKS_PATH, transportOrigin);
   if (url.protocol !== "http:" && url.protocol !== "https:") {

package/src/services/identity/workload-auth.ts

@@ -9,6 +9,8 @@ export type AuthenticatedWorkload = {
   serviceAccountId: string;
   credentialId: string;
   scope: WorkloadScope;
+  /** Present only for a verified signed app request, never a legacy token. */
+  keyId?: string;
 };
 
 type WorkloadCredentialAuthenticator = Pick<typeof serviceAccountCredentials, "isApiToken" | "authenticateApiToken">;

package/src/services/identity/workload-runtime.ts

@@ -1,6 +1,5 @@
 /** Core-only workload issuer. This module never reads identity signing keys, OAuth secrets, or sessions. */
 import type { NatsConnection } from "@nats-io/transport-node";
-import { sql } from "bun";
 import { getProcessNats } from "../../_internal/process-sync";
 import { APP_REGISTRY_TTL_MS, appInstancePrefix, appInstanceRegistry } from "../../_internal/registry";
 import {
@@ -12,6 +11,7 @@ import {
   type WorkloadResponse,
   workloadSubject,
 } from "../../_internal/workload-protocol";
+import { sql } from "../../runtime/clients";
 import { connections } from "../../runtime/connections";
 import { audit } from "../audit";
 import { logger } from "../logging";

package/src/services/ipa/groups.ts

@@ -1,5 +1,5 @@
-import { sql } from "bun";
 import type { BaseGroup, GroupMember, MutationResult } from "../../contracts/shared";
+import { sql } from "../../runtime/clients";
 import { freeipa } from "../../server/services";
 import { toPgUuidArray } from "../postgres";
 import { ensureFreeIpaMutationAvailable, getIpaUrl } from "./guard";

package/src/services/ipa/profile.ts

@@ -5,8 +5,8 @@
  * Local group mutations keep that projection as source of truth; the local
  * display mirror is only a bootstrap fallback before the first full sync.
  */
+import { sql } from "../../runtime/clients";
 
-import { sql } from "bun";
 import { calculateIpaProfileFromGroupNames } from "../account-model";
 import { getFreeIpaConfig } from "../freeipa-config";
 

package/src/services/ipa/search.ts

@@ -1,5 +1,5 @@
-import { sql } from "bun";
 import type { BaseGroup, BaseUser, UserProfile, UserProvider } from "../../contracts/shared";
+import { sql } from "../../runtime/clients";
 import { freeipa } from "../../server/services";
 import { buildRoles } from "../account-model";
 import { getFreeIpaConfig } from "../freeipa-config";

package/src/services/ipa/sync.ts

@@ -1,5 +1,5 @@
-import { sql } from "bun";
 import { coreUserEventPublisher } from "../../events/core-user-created";
+import { sql } from "../../runtime/clients";
 import { freeipa } from "../../server/services";
 import { writeDeletedAccountAudit } from "../account-lifecycle/audit";
 import { calculateIpaProfileFromGroupNames, parseIpaAccountTransitionPolicy, parseIpaMatchMode } from "../account-model";

package/src/services/ipa/users.ts

@@ -1,7 +1,7 @@
 import { password } from "@k2b/stdlib";
-import { sql } from "bun";
 import type { MutationResult, UserProfile } from "../../contracts/shared";
 import { coreUserEventPublisher } from "../../events/core-user-created";
+import { sql } from "../../runtime/clients";
 import { freeipa } from "../../server/services";
 import { writeDeletedAccountAudit } from "../account-lifecycle/audit";
 import { resolveProviderProfile } from "../accounts/base-user";

package/src/services/known-browsers.ts

@@ -1,9 +1,10 @@
-import { type SQL, sql } from "bun";
+import type { SQL } from "bun";
 import type { Context } from "hono";
 import { getCookie, setCookie } from "hono/cookie";
 import { z } from "zod";
 import { env } from "../config/env";
 import { APP_LOGIN_CONTEXT_BROWSERS, APP_LOGIN_CONTEXT_OSES } from "../contracts/app-approval";
+import { sql } from "../runtime/clients";
 import { type BrowserCode, type OsCode, truncateUtf8 } from "../server/request-context";
 import { logger } from "./logging";
 

package/src/services/legal-consent.ts

@@ -1,7 +1,7 @@
 import { createHash } from "node:crypto";
-import { sql } from "bun";
 import type { Context } from "hono";
 import { HTTPException } from "hono/http-exception";
+import { sql } from "../runtime/clients";
 import { isAccountCategoryAllowed } from "./account-category-policy";
 import { isAccountExpired } from "./account-model";
 import { verifySessionToken } from "./identity";

package/src/services/logging/index.ts

@@ -1,5 +1,5 @@
-import { sql } from "bun";
 import type { PaginationParams } from "../../contracts/shared";
+import { sql } from "../../runtime/clients";
 import { escapeLikePattern, parsePgJsonRecord, toPgTextArray } from "../postgres";
 import { registerSettings } from "../settings/defaults";
 import { redactLinkTokens, redactMetadata } from "./redaction";
@@ -126,7 +126,8 @@ function write(params: WriteParams): void {
   const consoleFn = params.level === "error" ? console.error : params.level === "warn" ? console.warn : console.log;
   consoleFn(prefix, message, ...(safeMetadata ? [safeMetadata] : []));
 
-  sql`
+  const persist = async () => {
+    await sql`
     INSERT INTO logging.entries (level, source, message, metadata)
     VALUES (
       ${params.level},
@@ -134,7 +135,9 @@ function write(params: WriteParams): void {
       ${message},
       (${safeMetadata ? JSON.stringify(safeMetadata) : null}::text)::jsonb
     )
-  `.catch((err: Error) => console.error("[logging] DB write failed:", err.message));
+    `;
+  };
+  void persist().catch((err: Error) => console.error("[logging] DB write failed:", err.message));
 }
 
 /**

package/src/services/logging/trace.ts

@@ -1,8 +1,8 @@
 import { createHash, randomBytes } from "node:crypto";
 import type { SyncEvent } from "@k2b/sync";
-import { sql } from "bun";
 import { getProcessApplicationId } from "../../_internal/process-identity";
 import type { PaginationParams } from "../../contracts/shared";
+import { sql } from "../../runtime/clients";
 import { escapeLikePattern, parsePgJsonRecord, toPgTextArray } from "../postgres";
 import { isSensitiveMetadataKey, REDACTED, redactLinkTokens, redactMetadata } from "./redaction";
 

package/src/services/logging/web-vitals.ts

@@ -1,5 +1,5 @@
-import { sql } from "bun";
 import { z } from "zod";
+import { sql } from "../../runtime/clients";
 
 const ranges = {
   "1h": { hours: 1, bucket: 60 },

package/src/services/mandates/index.ts

@@ -1,8 +1,9 @@
 import { err, fail, ok, type PageParams, type Paginated, paginate, type Result } from "@k2b/stdlib";
-import { type SQL, sql } from "bun";
+import type { SQL } from "bun";
 import { z } from "zod";
 import type { CapabilityActionPolicy } from "../../contracts/capabilities";
 import { CapabilityAppIdSchema } from "../../contracts/capabilities";
+import { sql } from "../../runtime/clients";
 import { isAccountCategoryAllowed } from "../account-category-policy";
 import { audit } from "../audit";
 import { requireRegisteredAppAccess, resolveIssuanceAuthority } from "../identity/issue-invocation";

package/src/services/notifications/batches.ts

@@ -1,9 +1,9 @@
 import { createHash } from "node:crypto";
 import { err, fail, ok, type Result } from "@k2b/stdlib";
 import type { Worker } from "@k2b/sync";
-import { sql } from "bun";
 import { lazySync } from "../../_internal/process-sync";
 import { type MailMessage, MailMessageSchema, type MailStatus, MailStatusSchema } from "../../contracts/outgoing-mail";
+import { sql } from "../../runtime/clients";
 import { markdown } from "../../shared/markdown";
 import { type AuditActor, audit } from "../audit";
 import { logger, trace } from "../logging";

package/src/services/notifications/browser.ts

@@ -1,10 +1,10 @@
 import { createHash } from "node:crypto";
-import { sql } from "bun";
 import webpush from "web-push";
 import { z } from "zod";
 import { notificationGroupTag } from "../../contracts/notification-group";
 import { isSafeNotificationTargetHref } from "../../contracts/notification-types";
 import { type BrowserPushSubscription, BrowserPushSubscriptionSchema } from "../../contracts/user-notifications";
+import { sql } from "../../runtime/clients";
 import { decryptSecret, encryptSecret } from "../secrets";
 import { coreSettings } from "../settings/api";
 import { SettingUnreadableError } from "../settings/store";

package/src/services/notifications/catalog.ts

@@ -1,5 +1,5 @@
-import { sql } from "bun";
 import type { AnyBoundNotificationDefinition } from "../../contracts/notification-types";
+import { sql } from "../../runtime/clients";
 import { logger } from "../logging";
 import { toPgTextArray } from "../postgres";
 

package/src/services/notifications/dispatcher.ts

@@ -1,5 +1,5 @@
-import { sql } from "bun";
 import { z } from "zod";
+import { sql } from "../../runtime/clients";
 import { decryptSecret } from "../secrets";
 import { getNotificationChannel } from "./channels";
 import { quietStateForEvent } from "./quiet";

package/src/services/notifications/index.ts

@@ -1,7 +1,7 @@
-import { sql } from "bun";
 import type { ZodType } from "zod";
 import type { BoundNotificationDefinition, NotificationRecipientKind, NotificationSendInput } from "../../contracts/notification-types";
 import type { PaginationParams } from "../../contracts/shared";
+import { sql } from "../../runtime/clients";
 import { logger } from "../logging";
 import { escapeLikePattern } from "../postgres";
 import { notificationMailOutcome, sendNotificationMail } from "./email-mail";

package/src/services/notifications/observability.ts

@@ -1,6 +1,7 @@
-import { type SQL, sql } from "bun";
+import type { SQL } from "bun";
 import type { MailStatus } from "../../contracts/outgoing-mail";
 import type { NotificationDeliveryStatus } from "../../contracts/user-notifications";
+import { sql } from "../../runtime/clients";
 import { escapeLikePattern, toPgTextArray } from "../postgres";
 
 const DELIVERY_STATUSES = new Set<NotificationDeliveryStatus>(["deferred", "pending", "sending", "delivered", "suppressed", "failed"]);

package/src/services/notifications/platform.ts

@@ -1,4 +1,3 @@
-import { sql } from "bun";
 import type { output, ZodType } from "zod";
 import { isNotificationGroup, notificationGroupTag } from "../../contracts/notification-group";
 import type {
@@ -10,6 +9,7 @@ import type {
   NotificationSendInput,
 } from "../../contracts/notification-types";
 import { validateNotificationTargetHref } from "../../contracts/notification-types";
+import { sql } from "../../runtime/clients";
 import { normalizeLocale } from "../../shared/locale";
 import { logger } from "../logging";
 import { encryptSecret } from "../secrets";

package/src/services/notifications/quiet.ts

@@ -1,5 +1,4 @@
 import { dates } from "@k2b/stdlib";
-import { sql } from "bun";
 import type { MutationResult } from "../../contracts/shared";
 import {
   NOTIFICATION_DO_NOT_DISTURB_MAX_DAYS,
@@ -9,6 +8,7 @@ import {
   type NotificationQuietState,
   type UpdateNotificationQuietSettings,
 } from "../../contracts/user-notifications";
+import { sql } from "../../runtime/clients";
 import { normalizeTimeZone } from "../../shared/time";
 
 const DAY_MS = 24 * 60 * 60_000;

package/src/services/notifications/user.ts

@@ -1,4 +1,3 @@
-import { sql } from "bun";
 import {
   isSafeNotificationTargetHref,
   type NotificationDefinitionPresentationCatalog,
@@ -11,6 +10,7 @@ import type {
   UserNotificationPreference,
   UserNotificationPreferencesResponse,
 } from "../../contracts/user-notifications";
+import { sql } from "../../runtime/clients";
 import { normalizeLocale } from "../../shared/locale";
 import { toPgTextArray } from "../postgres";
 import { listNotificationChannels } from "./channels";

package/src/services/oauth-tokens.ts

@@ -1,6 +1,6 @@
-import { sql } from "bun";
 import { createRemoteJWKSet, decodeProtectedHeader, errors, type JWTPayload, type JWTVerifyGetKey, jwtVerify } from "jose";
 import type { User } from "../contracts/shared";
+import { sql } from "../runtime/clients";
 import { isAccountCategoryAllowed } from "./account-category-policy";
 import { isAccountExpired } from "./account-model";
 import { IDENTITY_JWKS_MAX_AGE_SECONDS } from "./identity/constants";