@remit/backend 0.0.50 → 0.0.52

package/dev-server/content-auth.test.ts

@@ -8,7 +8,7 @@ const PATH = "accounts/cfg-alice/acc-alice/messages/msg-1/parts/1.2";
 const now = () => Math.floor(Date.now() / 1000);
 
 describe("authorizeContentRequest", () => {
-	it("is a no-op outside Postgres mode (AWS serves unsigned URLs)", () => {
+	it("is a no-op on the AWS path (unsigned URLs)", () => {
 		const result = authorizeContentRequest({
 			dataBackend: undefined,
 			secret: undefined,
@@ -20,10 +20,10 @@ describe("authorizeContentRequest", () => {
 		assert.deepEqual(result, { authorized: true });
 	});
 
-	it("authorizes a validly signed request in Postgres mode", () => {
+	it("authorizes a validly signed request on the self-host stack", () => {
 		const { exp, sig } = createContentSigner(SECRET)(PATH);
 		const result = authorizeContentRequest({
-			dataBackend: "postgres",
+			dataBackend: "sqlite",
 			secret: SECRET,
 			relativePath: PATH,
 			exp: String(exp),
@@ -35,7 +35,7 @@ describe("authorizeContentRequest", () => {
 
 	it("returns 401 when the signature is absent", () => {
 		const result = authorizeContentRequest({
-			dataBackend: "postgres",
+			dataBackend: "sqlite",
 			secret: SECRET,
 			relativePath: PATH,
 			exp: undefined,
@@ -49,7 +49,7 @@ describe("authorizeContentRequest", () => {
 	it("returns 403 for a signature minted for another account's path", () => {
 		const { exp, sig } = createContentSigner(SECRET)(PATH);
 		const result = authorizeContentRequest({
-			dataBackend: "postgres",
+			dataBackend: "sqlite",
 			secret: SECRET,
 			relativePath: "accounts/cfg-bob/acc-bob/messages/msg-9/parts/1.2",
 			exp: String(exp),
@@ -63,7 +63,7 @@ describe("authorizeContentRequest", () => {
 	it("returns 403 for an expired signature", () => {
 		const { exp, sig } = createContentSigner(SECRET, -20)(PATH);
 		const result = authorizeContentRequest({
-			dataBackend: "postgres",
+			dataBackend: "sqlite",
 			secret: SECRET,
 			relativePath: PATH,
 			exp: String(exp),
@@ -74,9 +74,9 @@ describe("authorizeContentRequest", () => {
 		assert.equal(result.authorized === false && result.status, 403);
 	});
 
-	it("fails closed with 500 in Postgres mode when no signing secret is configured", () => {
+	it("fails closed with 500 when no signing secret is configured", () => {
 		const result = authorizeContentRequest({
-			dataBackend: "postgres",
+			dataBackend: "sqlite",
 			secret: undefined,
 			relativePath: PATH,
 			exp: "123",
@@ -87,7 +87,7 @@ describe("authorizeContentRequest", () => {
 		assert.equal(result.authorized === false && result.status, 500);
 	});
 
-	it("enforces signatures in SQLite mode the same as Postgres", () => {
+	it("enforces signatures on every self-host request", () => {
 		const { exp, sig } = createContentSigner(SECRET)(PATH);
 		const valid = authorizeContentRequest({
 			dataBackend: "sqlite",

package/dev-server/content-auth.ts

@@ -2,7 +2,7 @@ import { verifyContentSignature } from "../src/derive/contentSignature.js";
 
 /**
  * Decide whether a `/content` request is authorized. Enforcement applies on the
- * self-host SQL backends (postgres and sqlite), where this server is the
+ * self-host SQL backend (sqlite), where this server is the
  * deployed backend container and content URLs are signed. On AWS-local dev
  * (`DATA_BACKEND` unset) `/content` is served straight from the filesystem
  * stand-in for CloudFront and URLs are unsigned, so the check is a no-op.
@@ -25,7 +25,7 @@ export const authorizeContentRequest = (
 ):
 	| { authorized: true }
 	| { authorized: false; status: number; reason: string } => {
-	if (input.dataBackend !== "postgres" && input.dataBackend !== "sqlite") {
+	if (input.dataBackend !== "sqlite") {
 		return { authorized: true };
 	}
 

package/dev-server/relational-health.test.ts

@@ -80,12 +80,4 @@ describe("checkRelationalStore", () => {
 		chmodSync(dbPath, 0o400);
 		assert.equal(await checkRelationalStore(), false);
 	});
-
-	it("is false when Postgres connection fails", async () => {
-		process.env.DATA_BACKEND = "postgres";
-		process.env.PG_CONNECTION_URL =
-			"postgresql://remit:remit@127.0.0.1:1/nonexistent";
-
-		assert.equal(await checkRelationalStore(), false);
-	});
 });

package/dev-server/relational-health.ts

@@ -21,23 +21,9 @@ const pingSqlite = async (): Promise<void> => {
 	}
 };
 
-const pingPostgres = async (): Promise<void> => {
-	const { Client } = await import("pg");
-	const client = new Client({
-		connectionString: process.env.PG_CONNECTION_URL,
-		connectionTimeoutMillis: 3000,
-	});
-	await client.connect();
-	try {
-		await client.query("SELECT 1");
-	} finally {
-		await client.end();
-	}
-};
-
 /**
- * A trivial read against whichever relational store DATA_BACKEND selects — the
- * dependency `/health` must actually exercise (RFC 037 D5, R9) so a backend that
+ * A trivial read against the relational store — the dependency `/health` must
+ * actually exercise (RFC 037 D5, R9) so a backend that
  * booted with an unusable database reports unhealthy instead of a bare 200. The
  * AWS/DynamoDB path has no relational store and is never checked.
  */
@@ -45,11 +31,7 @@ export const checkRelationalStore = async (): Promise<boolean> => {
 	if (!isSelfHostSqlBackend()) return true;
 
 	try {
-		if (process.env.DATA_BACKEND === "sqlite") {
-			await pingSqlite();
-		} else {
-			await pingPostgres();
-		}
+		await pingSqlite();
 		return true;
 	} catch {
 		return false;

package/dev-server/server.ts

@@ -17,7 +17,7 @@ import express, {
 } from "express";
 import { handler, OpenAPISpec } from "../src/index.js";
 import { safeJsonParse } from "../src/json.js";
-import { getClient } from "../src/service/dynamodb.js";
+import { getClient } from "../src/service/data-client.js";
 import { authorizeContentRequest } from "./content-auth.js";
 import { serveContent } from "./content-handler.js";
 import { resolveContentPath } from "./content-path.js";
@@ -28,15 +28,13 @@ import { collectAccountSyncAges } from "./sync-age.js";
 
 const app = express();
 
-// The self-host relational backends — Postgres and, from RFC 036, SQLite — both
-// run better-auth and the APISIX edge; the AWS-local (DynamoDB) dev path runs
-// neither. Everything gated on "not the AWS-local path" keys off this.
-const isSelfHostBackend =
-	process.env.DATA_BACKEND === "postgres" ||
-	process.env.DATA_BACKEND === "sqlite";
+// The self-host relational backend runs better-auth and the APISIX edge; the
+// AWS-local (DynamoDB) dev path runs neither. Everything gated on "not the
+// AWS-local path" keys off this.
+const isSelfHostBackend = process.env.DATA_BACKEND === "sqlite";
 
 // CORS is driven by CORS_ALLOWED_ORIGINS (comma-separated, or `*`). On the
-// self-host backends it is required config — refuse to start if unset, so the
+// self-host backend it is required config — refuse to start if unset, so the
 // deployed edge is never accidentally wide open by omission. On the AWS-local
 // dev path it defaults to `*` to keep the existing local flow working.
 const configuredCorsOrigins = parseAllowedOrigins(
@@ -218,7 +216,7 @@ const STORAGE_BASE = resolve(
 app.get(/^\/content\/.+$/, async (req: Request, res: Response) => {
 	const storageKey = req.path.replace(/^\/content\//, "");
 
-	// On the Postgres stack this route is the deployed content-delivery surface;
+	// On the self-host stack this route is the deployed content-delivery surface;
 	// require a valid signed URL (HMAC + expiry, scoped to the owning account)
 	// before touching storage. Bearer auth can't ride on an `<img src>` content
 	// load, so the signature carried in the query string is the authorization.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@remit/backend",
-  "version": "0.0.50",
+  "version": "0.0.52",
   "description": "Remit Mail Inspector API backend",
   "license": "MIT",
   "author": "",
@@ -12,8 +12,8 @@
       "default": "./src/index.ts"
     },
     "./client": {
-      "types": "./src/service/dynamodb.ts",
-      "default": "./src/service/dynamodb.ts"
+      "types": "./src/service/data-client.ts",
+      "default": "./src/service/data-client.ts"
     },
     "./create-remit-client": {
       "types": "./src/service/create-remit-client.ts",
@@ -73,14 +73,11 @@
     "@aws-sdk/client-secrets-manager": "*",
     "@aws-sdk/client-sqs": "*",
     "better-sqlite3": "^12.11.1",
-    "drizzle-orm": "^0.45.2",
     "expect-env": "*",
     "openapi-backend": "*",
     "p-map": "*",
-    "pg": "^8.0.0",
     "@types/aws-lambda": "*",
-    "@types/better-sqlite3": "^7.6.13",
-    "@types/pg": "^8.0.0"
+    "@types/better-sqlite3": "^7.6.13"
   },
   "publishConfig": {
     "access": "public"

package/scripts/backfill-list-id.ts

@@ -7,7 +7,7 @@ import {
 	type ListIdBackfillCheckpoint,
 	type ListIdBackfillCheckpointStore,
 } from "@remit/mailbox-service";
-import { getClient } from "../src/service/dynamodb.js";
+import { getClient } from "../src/service/data-client.js";
 
 /**
  * One-time, full-corpus `ThreadMessage.listId` backfill (issue #263). Ships as

package/src/data-backend.test.ts

@@ -9,9 +9,7 @@ describe("usesBetterAuthJwt", () => {
 		else process.env.DATA_BACKEND = ORIGINAL;
 	});
 
-	it("is true for the self-host SQL backends", () => {
-		process.env.DATA_BACKEND = "postgres";
-		assert.equal(usesBetterAuthJwt(), true);
+	it("is true for the self-host SQL backend", () => {
 		process.env.DATA_BACKEND = "sqlite";
 		assert.equal(usesBetterAuthJwt(), true);
 	});

package/src/data-backend.ts

@@ -1,20 +1,14 @@
 /**
- * The two self-host SQL backends (RFC 034/035/036), as opposed to the AWS
- * DynamoDB path.
+ * The self-host SQL backend (RFC 034/035/036), as opposed to the AWS DynamoDB
+ * path.
  */
-export const isSelfHostSqlBackend = (): boolean => {
-	const backend = process.env.DATA_BACKEND;
-	return backend === "postgres" || backend === "sqlite";
-};
+export const isSelfHostSqlBackend = (): boolean =>
+	process.env.DATA_BACKEND === "sqlite";
 
 /**
- * The self-host SQL backends authenticate requests and sign content URLs the
- * same way: a better-auth RS256 JWT verified at the edge and re-verified
- * in-process, no Cognito authorizer. DynamoDB is the AWS path (Cognito claims,
- * Lambda@Edge content guard) and is deliberately excluded.
- *
- * Guarding these paths on `=== "postgres"` alone left the sqlite deployment
- * with no claim injection (every identity-bound request 500s) and unsigned
- * `/content/*` URLs; both branch on this predicate instead.
+ * The self-host SQL backend authenticates requests and signs content URLs with
+ * a better-auth RS256 JWT verified at the edge and re-verified in-process, no
+ * Cognito authorizer. DynamoDB is the AWS path (Cognito claims, Lambda@Edge
+ * content guard) and is deliberately excluded.
  */
 export const usesBetterAuthJwt = (): boolean => isSelfHostSqlBackend();

package/src/derive/contentSignature.test.ts

@@ -110,29 +110,11 @@ describe("getContentSigner", () => {
 		else process.env.BETTER_AUTH_SECRET = ORIGINAL_SECRET;
 	});
 
-	it("returns undefined outside Postgres mode (AWS keeps unsigned URLs)", () => {
+	it("returns undefined on the AWS path (unsigned URLs)", () => {
 		delete process.env.DATA_BACKEND;
 		assert.equal(getContentSigner(), undefined);
 	});
 
-	it("returns a working signer in Postgres mode", () => {
-		process.env.DATA_BACKEND = "postgres";
-		process.env.BETTER_AUTH_SECRET = SECRET;
-		const signer = getContentSigner();
-		assert.ok(signer);
-		const { exp, sig } = signer(PATH_A);
-		assert.deepEqual(
-			verifyContentSignature(PATH_A, String(exp), sig, SECRET, nowSeconds()),
-			{ valid: true },
-		);
-	});
-
-	it("throws in Postgres mode when the master secret is missing (fail loud)", () => {
-		process.env.DATA_BACKEND = "postgres";
-		delete process.env.BETTER_AUTH_SECRET;
-		assert.throws(() => getContentSigner(), /BETTER_AUTH_SECRET/);
-	});
-
 	it("returns a working signer in SQLite mode", () => {
 		process.env.DATA_BACKEND = "sqlite";
 		process.env.BETTER_AUTH_SECRET = SECRET;

package/src/derive/contentSignature.ts

@@ -2,10 +2,10 @@ import { createHmac, timingSafeEqual } from "node:crypto";
 import { usesBetterAuthJwt } from "../data-backend.js";
 
 /**
- * Signed-URL scheme for `/content/*` on the Postgres stack.
+ * Signed-URL scheme for `/content/*` on the self-host stack.
  *
  * On AWS the same bytes are guarded by CloudFront + a Lambda@Edge JWT verifier.
- * The Postgres stack serves `/content/*` straight from the backend container,
+ * The self-host stack serves `/content/*` straight from the backend container,
  * and a bearer token cannot ride along on an `<img src>` / `<a href>` content
  * load rendered inside email HTML. So the backend signs each content URL when
  * it hands the SPA a `BodyPartResponse.contentUrl`, and the `/content` route
@@ -37,7 +37,7 @@ export const CONTENT_URL_TTL_SECONDS = 3600;
  * separation via a fixed label keeps the content-signing key distinct from the
  * raw better-auth secret, so a compromise of one signing space does not reveal
  * the other. Reusing `BETTER_AUTH_SECRET` as the master means no new secret has
- * to be provisioned on the Postgres stack — it is already required there.
+ * to be provisioned on the self-host stack — it is already required there.
  */
 const deriveSigningKey = (masterSecret: string): Buffer =>
 	createHmac("sha256", masterSecret).update(KEY_DERIVATION_LABEL).digest();
@@ -78,19 +78,19 @@ export const createContentSigner = (
 
 /**
  * Build the content-URL signer for the current environment, or `undefined` when
- * signing does not apply. Signing is enforced on the self-host SQL backends
- * (postgres and sqlite), which serve `/content/*` straight from the backend
- * container; on AWS the Lambda@Edge JWT verifier guards `/content/*` and the URL
- * stays unsigned so CloudFront/S3 behaviour is unchanged. Throws on those
- * backends when the master secret is missing, so a misconfigured deploy fails
- * loud rather than shipping unsigned (unauthenticated) content URLs.
+ * signing does not apply. Signing is enforced on the self-host SQL backend,
+ * which serves `/content/*` straight from the backend container; on AWS the
+ * Lambda@Edge JWT verifier guards `/content/*` and the URL stays unsigned so
+ * CloudFront/S3 behaviour is unchanged. Throws on the self-host backend when the
+ * master secret is missing, so a misconfigured deploy fails loud rather than
+ * shipping unsigned (unauthenticated) content URLs.
  */
 export const getContentSigner = (): ContentSigner | undefined => {
 	if (!usesBetterAuthJwt()) return undefined;
 	const secret = process.env.BETTER_AUTH_SECRET;
 	if (!secret || secret.length === 0) {
 		throw new Error(
-			"a self-host SQL backend (postgres/sqlite) requires BETTER_AUTH_SECRET to sign content URLs",
+			"the self-host SQL backend requires BETTER_AUTH_SECRET to sign content URLs",
 		);
 	}
 	return createContentSigner(secret);

package/src/derive/contentUrl.ts

@@ -19,7 +19,7 @@ export interface BuildContentUrlInput {
 	messageId: string;
 	partPath: string;
 	/**
-	 * When present (Postgres stack), append an `exp`/`sig` signature scoped to
+	 * When present (self-host stack), append an `exp`/`sig` signature scoped to
 	 * this account's storage path. Absent on AWS, where Lambda@Edge guards the
 	 * URL and the path stays unsigned. See `contentSignature.ts`.
 	 */

package/src/handlers/account-oauth.ts

@@ -16,7 +16,7 @@ import type { Context } from "openapi-backend";
 import { getAccountConfigIdFromEvent } from "../auth.js";
 import { getMsOAuthConfig } from "../config/msoauth.js";
 import { safeJsonParse } from "../json.js";
-import { getClient } from "../service/dynamodb.js";
+import { getClient } from "../service/data-client.js";
 import type { MicrosoftOAuthOperationIds, OperationHandler } from "../types.js";
 import { triggerAccountSyncSafe } from "./account.js";
 import { findActiveDuplicateMailbox } from "./account-guards.js";

package/src/handlers/account.ts

@@ -29,7 +29,7 @@ import type { APIGatewayProxyEvent } from "aws-lambda";
 import { env } from "expect-env";
 import type { Context } from "openapi-backend";
 import { getAccountConfigIdFromEvent } from "../auth.js";
-import { getClient } from "../service/dynamodb.js";
+import { getClient } from "../service/data-client.js";
 import { fireAndForget } from "../service/fire-and-forget.js";
 import { sqsClient } from "../service/sqs.js";
 import { triggerAccountSync } from "../service/trigger-sync.js";

package/src/handlers/address.ts

@@ -7,7 +7,7 @@ import { ForbiddenError } from "@remit/data-ports/errors";
 import type { APIGatewayProxyEvent } from "aws-lambda";
 import type { Context } from "openapi-backend";
 import { getAccountConfigIdFromEvent } from "../auth.js";
-import { getClient } from "../service/dynamodb.js";
+import { getClient } from "../service/data-client.js";
 import type {
 	AddressDetailOperationIds,
 	AddressOperationIds,

package/src/handlers/config.ts

@@ -10,7 +10,7 @@ import type { APIGatewayProxyEvent } from "aws-lambda";
 import { env } from "expect-env";
 import type { Context } from "openapi-backend";
 import { getAccountConfigIdFromEvent, getSubFromEvent } from "../auth.js";
-import { getClient } from "../service/dynamodb.js";
+import { getClient } from "../service/data-client.js";
 import { fireAndForget } from "../service/fire-and-forget.js";
 import { sqsClient } from "../service/sqs.js";
 import { triggerAccountSync } from "../service/trigger-sync.js";

package/src/handlers/filter.ts

@@ -13,7 +13,7 @@ import { FilterScope, FilterState } from "@remit/domain-enums";
 import type { AnchorPayload } from "@remit/search-service";
 import type { APIGatewayProxyEvent } from "aws-lambda";
 import { getAccountConfigIdFromEvent } from "../auth.js";
-import { getClient } from "../service/dynamodb.js";
+import { getClient } from "../service/data-client.js";
 import { buildFilterAnchor } from "../service/filter.js";
 import type {
 	FilterDetailOperationIds,

package/src/handlers/folder-role.ts

@@ -4,7 +4,7 @@ import type {
 } from "@remit/api-openapi-types";
 import type { APIGatewayProxyEvent } from "aws-lambda";
 import { getAccountConfigIdFromEvent } from "../auth.js";
-import { getClient } from "../service/dynamodb.js";
+import { getClient } from "../service/data-client.js";
 import type { FolderRoleOperationIds, OperationHandler } from "../types.js";
 import { toAccountResponse } from "./account-guards.js";
 import { loadAccountOverrides } from "./account-overrides.js";

package/src/handlers/label.ts

@@ -11,7 +11,7 @@ import type {
 } from "@remit/data-ports";
 import type { APIGatewayProxyEvent } from "aws-lambda";
 import { getAccountConfigIdFromEvent } from "../auth.js";
-import { getClient } from "../service/dynamodb.js";
+import { getClient } from "../service/data-client.js";
 import type {
 	LabelDetailOperationIds,
 	LabelOperationIds,

package/src/handlers/mailbox.ts

@@ -11,7 +11,7 @@ import {
 	applyPendingMoveCountPrediction,
 	type PendingUnseenFlagPush,
 } from "../derive/pendingMoveCounts.js";
-import { getClient } from "../service/dynamodb.js";
+import { getClient } from "../service/data-client.js";
 import type {
 	MailboxDetailOperationIds,
 	MailboxOperationIds,
@@ -139,7 +139,7 @@ export const assertMailboxInAccount = (
  * `applyPendingMoveCountPrediction`'s read-time adjustment only, never mutates
  * stored counts (epic #1281 invariant 4). Markers are written by the
  * imap-worker bulk sync path through `RemitClient.placementMove` on every
- * backend, so this is a real signal on Postgres too.
+ * backend, so this is a real signal on the self-host stack too.
  */
 const loadPendingMoves = (
 	client: Awaited<ReturnType<typeof getClient>>,
@@ -150,7 +150,7 @@ const loadPendingMoves = (
  * Every pending `\Seen` flag-push marker (issue #1273) for an account —
  * `\Flagged` (star) markers are excluded, since only read/unread state feeds
  * `unseenCount`'s prediction. `RemitClient.flagPush` is present and WRITTEN
- * on both backends, so this is a real signal on Postgres too.
+ * on both backends, so this is a real signal on the self-host stack too.
  */
 const loadPendingUnseenFlagPushes = async (
 	client: Awaited<ReturnType<typeof getClient>>,

package/src/handlers/me.test.ts

@@ -8,7 +8,7 @@ import {
 	_resetForTest,
 	type RemitClient,
 	setClient,
-} from "../service/dynamodb.js";
+} from "../service/data-client.js";
 import { MeOperations } from "./me.js";
 
 const listQuarantine = MeOperations.MeOperations_listQuarantine as unknown as (

package/src/handlers/me.ts

@@ -13,7 +13,7 @@ import type { APIGatewayProxyEvent } from "aws-lambda";
 import { env } from "expect-env";
 import type { Context } from "openapi-backend";
 import { getAccountConfigIdFromEvent, getSubFromEvent } from "../auth.js";
-import { getClient } from "../service/dynamodb.js";
+import { getClient } from "../service/data-client.js";
 import { sqsClient } from "../service/sqs.js";
 import type { MeOperationIds, OperationHandler } from "../types.js";
 import { toVipSuggestionEntry } from "./vip-suggestions.js";

package/src/handlers/message.ts

@@ -41,7 +41,7 @@ import {
 	getContentDeliveryDomain,
 } from "../derive/contentUrl.js";
 import { deriveSenderTrust } from "../derive/senderTrust.js";
-import { getClient } from "../service/dynamodb.js";
+import { getClient } from "../service/data-client.js";
 import type {
 	MessageBulkOperationIds,
 	MessageOperationIds,

package/src/handlers/organize.test.ts

@@ -1,7 +1,9 @@
 import assert from "node:assert/strict";
 import { describe, it } from "node:test";
 import type { OrganizeInput } from "@remit/api-openapi-types";
+import { BadRequestError } from "@remit/data-ports/errors";
 import { FilterMatchOperator } from "@remit/domain-enums";
+import { handleError } from "../error.js";
 import { predicateFromInput } from "./organize.js";
 
 const input = (over: Partial<OrganizeInput> = {}): OrganizeInput => ({
@@ -41,3 +43,21 @@ describe("predicateFromInput (move back-apply accepted)", () => {
 		assert.equal(predicate.actionLabelId, "None");
 	});
 });
+
+// previewOrganize rejects a body-content (HasWords) clause by throwing
+// BadRequestError (see service/organize.test.ts for the throw site). Proving
+// the 4xx actually reaches the wire — not just that the right class is
+// thrown — means proving the shared error handler maps it, since a plain
+// Error would otherwise fall through to a 500 (reader #457).
+describe("previewOrganize rejected-rule response (reader #457)", () => {
+	it("maps a rejected HasWords clause to a 400 naming the reason, not a 500", async () => {
+		const error = new BadRequestError(
+			"Organize literal matching cannot evaluate a body-content (HasWords) clause without the vector pipeline — it requires the semantic widen path",
+		);
+
+		const response = await handleError(error);
+
+		assert.equal(response.statusCode, 400);
+		assert.match(JSON.parse(response.body).message, /HasWords/);
+	});
+});

package/src/handlers/organize.ts

@@ -11,7 +11,7 @@ import type { APIGatewayProxyEvent } from "aws-lambda";
 import { env } from "expect-env";
 import type { Context } from "openapi-backend";
 import { getAccountConfigIdFromEvent, getSubFromEvent } from "../auth.js";
-import { getClient, type RemitClient } from "../service/dynamodb.js";
+import { getClient, type RemitClient } from "../service/data-client.js";
 import {
 	buildOrganizeMatchDeps,
 	matchOrganize,

package/src/handlers/outbox.ts

@@ -8,7 +8,7 @@ import { ForbiddenError } from "@remit/data-ports/errors";
 import type { APIGatewayProxyEvent } from "aws-lambda";
 import type { Context } from "openapi-backend";
 import { getAccountConfigIdFromEvent } from "../auth.js";
-import { getClient } from "../service/dynamodb.js";
+import { getClient } from "../service/data-client.js";
 import type {
 	OperationHandler,
 	OutboxDetailOperationIds,

package/src/handlers/search.ts

@@ -6,7 +6,7 @@ import type { SearchResult } from "@remit/search-service";
 import type { APIGatewayProxyEvent } from "aws-lambda";
 import type { Context } from "openapi-backend";
 import { getAccountConfigIdFromEvent } from "../auth.js";
-import { getClient } from "../service/dynamodb.js";
+import { getClient } from "../service/data-client.js";
 import {
 	isSemanticSearchUnavailable,
 	noteSemanticCapabilityAbsence,

package/src/handlers/sync.ts

@@ -3,7 +3,7 @@ import { logger } from "@remit/logger-lambda";
 import type { APIGatewayProxyEvent } from "aws-lambda";
 import { env } from "expect-env";
 import { getAccountConfigIdFromEvent } from "../auth.js";
-import { getClient } from "../service/dynamodb.js";
+import { getClient } from "../service/data-client.js";
 import {
 	type FireAndForgetLogger,
 	fireAndForget,

package/src/handlers/thread.ts

@@ -17,7 +17,7 @@ import {
 	filterByOffRowCriteria,
 	hasOffRowCriteria,
 } from "../derive/filterThreadCriteria.js";
-import { getClient } from "../service/dynamodb.js";
+import { getClient } from "../service/data-client.js";
 import type {
 	OperationHandler,
 	ThreadDetailOperationIds,

package/src/handlers/unified-threads.ts

@@ -9,7 +9,7 @@ import type { Context } from "openapi-backend";
 import pMap from "p-map";
 import { getAccountConfigIdFromEvent } from "../auth.js";
 import { enrichThreadRows } from "../derive/enrichThreadRows.js";
-import { getClient } from "../service/dynamodb.js";
+import { getClient } from "../service/data-client.js";
 import type { OperationHandler, UnifiedThreadOperationIds } from "../types.js";
 import {
 	groupAccountOverrides,

package/src/index.ts

@@ -14,7 +14,7 @@ import { assertLocalBypassNotInDeployedEnv } from "./auth.js";
 import { usesBetterAuthJwt } from "./data-backend.js";
 import { handleError } from "./error.js";
 import { handlers } from "./handlers/index.js";
-import { authenticatePostgresRequest } from "./jwt-auth.js";
+import { authenticateSelfHostRequest } from "./jwt-auth.js";
 import { normalizeRequest } from "./request.js";
 import { runWithRequestContext } from "./request-context.js";
 import { formatResponse, postResponseHandler } from "./response.js";
@@ -161,7 +161,7 @@ const rawHandler = async (event: APIGatewayProxyEvent, context: Context) =>
 			const origin = readOriginHeader(event.headers);
 
 			if (usesBetterAuthJwt()) {
-				const denied = await authenticatePostgresRequest(event);
+				const denied = await authenticateSelfHostRequest(event);
 				if (denied) return denied;
 			}