@remit/backend 0.0.51 → 0.0.53

package/dev-server/content-auth.test.ts

@@ -8,7 +8,7 @@ const PATH = "accounts/cfg-alice/acc-alice/messages/msg-1/parts/1.2";
 const now = () => Math.floor(Date.now() / 1000);
 
 describe("authorizeContentRequest", () => {
-	it("is a no-op outside Postgres mode (AWS serves unsigned URLs)", () => {
+	it("is a no-op on the AWS path (unsigned URLs)", () => {
 		const result = authorizeContentRequest({
 			dataBackend: undefined,
 			secret: undefined,
@@ -20,10 +20,10 @@ describe("authorizeContentRequest", () => {
 		assert.deepEqual(result, { authorized: true });
 	});
 
-	it("authorizes a validly signed request in Postgres mode", () => {
+	it("authorizes a validly signed request on the self-host stack", () => {
 		const { exp, sig } = createContentSigner(SECRET)(PATH);
 		const result = authorizeContentRequest({
-			dataBackend: "postgres",
+			dataBackend: "sqlite",
 			secret: SECRET,
 			relativePath: PATH,
 			exp: String(exp),
@@ -35,7 +35,7 @@ describe("authorizeContentRequest", () => {
 
 	it("returns 401 when the signature is absent", () => {
 		const result = authorizeContentRequest({
-			dataBackend: "postgres",
+			dataBackend: "sqlite",
 			secret: SECRET,
 			relativePath: PATH,
 			exp: undefined,
@@ -49,7 +49,7 @@ describe("authorizeContentRequest", () => {
 	it("returns 403 for a signature minted for another account's path", () => {
 		const { exp, sig } = createContentSigner(SECRET)(PATH);
 		const result = authorizeContentRequest({
-			dataBackend: "postgres",
+			dataBackend: "sqlite",
 			secret: SECRET,
 			relativePath: "accounts/cfg-bob/acc-bob/messages/msg-9/parts/1.2",
 			exp: String(exp),
@@ -63,7 +63,7 @@ describe("authorizeContentRequest", () => {
 	it("returns 403 for an expired signature", () => {
 		const { exp, sig } = createContentSigner(SECRET, -20)(PATH);
 		const result = authorizeContentRequest({
-			dataBackend: "postgres",
+			dataBackend: "sqlite",
 			secret: SECRET,
 			relativePath: PATH,
 			exp: String(exp),
@@ -74,9 +74,9 @@ describe("authorizeContentRequest", () => {
 		assert.equal(result.authorized === false && result.status, 403);
 	});
 
-	it("fails closed with 500 in Postgres mode when no signing secret is configured", () => {
+	it("fails closed with 500 when no signing secret is configured", () => {
 		const result = authorizeContentRequest({
-			dataBackend: "postgres",
+			dataBackend: "sqlite",
 			secret: undefined,
 			relativePath: PATH,
 			exp: "123",
@@ -87,7 +87,7 @@ describe("authorizeContentRequest", () => {
 		assert.equal(result.authorized === false && result.status, 500);
 	});
 
-	it("enforces signatures in SQLite mode the same as Postgres", () => {
+	it("enforces signatures on every self-host request", () => {
 		const { exp, sig } = createContentSigner(SECRET)(PATH);
 		const valid = authorizeContentRequest({
 			dataBackend: "sqlite",

package/dev-server/content-auth.ts

@@ -2,7 +2,7 @@ import { verifyContentSignature } from "../src/derive/contentSignature.js";
 
 /**
  * Decide whether a `/content` request is authorized. Enforcement applies on the
- * self-host SQL backends (postgres and sqlite), where this server is the
+ * self-host SQL backend (sqlite), where this server is the
  * deployed backend container and content URLs are signed. On AWS-local dev
  * (`DATA_BACKEND` unset) `/content` is served straight from the filesystem
  * stand-in for CloudFront and URLs are unsigned, so the check is a no-op.
@@ -25,7 +25,7 @@ export const authorizeContentRequest = (
 ):
 	| { authorized: true }
 	| { authorized: false; status: number; reason: string } => {
-	if (input.dataBackend !== "postgres" && input.dataBackend !== "sqlite") {
+	if (input.dataBackend !== "sqlite") {
 		return { authorized: true };
 	}
 

package/dev-server/relational-health.test.ts

@@ -80,12 +80,4 @@ describe("checkRelationalStore", () => {
 		chmodSync(dbPath, 0o400);
 		assert.equal(await checkRelationalStore(), false);
 	});
-
-	it("is false when Postgres connection fails", async () => {
-		process.env.DATA_BACKEND = "postgres";
-		process.env.PG_CONNECTION_URL =
-			"postgresql://remit:remit@127.0.0.1:1/nonexistent";
-
-		assert.equal(await checkRelationalStore(), false);
-	});
 });

package/dev-server/relational-health.ts

@@ -21,23 +21,9 @@ const pingSqlite = async (): Promise<void> => {
 	}
 };
 
-const pingPostgres = async (): Promise<void> => {
-	const { Client } = await import("pg");
-	const client = new Client({
-		connectionString: process.env.PG_CONNECTION_URL,
-		connectionTimeoutMillis: 3000,
-	});
-	await client.connect();
-	try {
-		await client.query("SELECT 1");
-	} finally {
-		await client.end();
-	}
-};
-
 /**
- * A trivial read against whichever relational store DATA_BACKEND selects — the
- * dependency `/health` must actually exercise (RFC 037 D5, R9) so a backend that
+ * A trivial read against the relational store — the dependency `/health` must
+ * actually exercise (RFC 037 D5, R9) so a backend that
  * booted with an unusable database reports unhealthy instead of a bare 200. The
  * AWS/DynamoDB path has no relational store and is never checked.
  */
@@ -45,11 +31,7 @@ export const checkRelationalStore = async (): Promise<boolean> => {
 	if (!isSelfHostSqlBackend()) return true;
 
 	try {
-		if (process.env.DATA_BACKEND === "sqlite") {
-			await pingSqlite();
-		} else {
-			await pingPostgres();
-		}
+		await pingSqlite();
 		return true;
 	} catch {
 		return false;

package/dev-server/server.ts

@@ -17,7 +17,7 @@ import express, {
 } from "express";
 import { handler, OpenAPISpec } from "../src/index.js";
 import { safeJsonParse } from "../src/json.js";
-import { getClient } from "../src/service/dynamodb.js";
+import { getClient } from "../src/service/data-client.js";
 import { authorizeContentRequest } from "./content-auth.js";
 import { serveContent } from "./content-handler.js";
 import { resolveContentPath } from "./content-path.js";
@@ -28,15 +28,13 @@ import { collectAccountSyncAges } from "./sync-age.js";
 
 const app = express();
 
-// The self-host relational backends — Postgres and, from RFC 036, SQLite — both
-// run better-auth and the APISIX edge; the AWS-local (DynamoDB) dev path runs
-// neither. Everything gated on "not the AWS-local path" keys off this.
-const isSelfHostBackend =
-	process.env.DATA_BACKEND === "postgres" ||
-	process.env.DATA_BACKEND === "sqlite";
+// The self-host relational backend runs better-auth and the APISIX edge; the
+// AWS-local (DynamoDB) dev path runs neither. Everything gated on "not the
+// AWS-local path" keys off this.
+const isSelfHostBackend = process.env.DATA_BACKEND === "sqlite";
 
 // CORS is driven by CORS_ALLOWED_ORIGINS (comma-separated, or `*`). On the
-// self-host backends it is required config — refuse to start if unset, so the
+// self-host backend it is required config — refuse to start if unset, so the
 // deployed edge is never accidentally wide open by omission. On the AWS-local
 // dev path it defaults to `*` to keep the existing local flow working.
 const configuredCorsOrigins = parseAllowedOrigins(
@@ -218,7 +216,7 @@ const STORAGE_BASE = resolve(
 app.get(/^\/content\/.+$/, async (req: Request, res: Response) => {
 	const storageKey = req.path.replace(/^\/content\//, "");
 
-	// On the Postgres stack this route is the deployed content-delivery surface;
+	// On the self-host stack this route is the deployed content-delivery surface;
 	// require a valid signed URL (HMAC + expiry, scoped to the owning account)
 	// before touching storage. Bearer auth can't ride on an `<img src>` content
 	// load, so the signature carried in the query string is the authorization.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@remit/backend",
-  "version": "0.0.51",
+  "version": "0.0.53",
   "description": "Remit Mail Inspector API backend",
   "license": "MIT",
   "author": "",
@@ -12,8 +12,8 @@
       "default": "./src/index.ts"
     },
     "./client": {
-      "types": "./src/service/dynamodb.ts",
-      "default": "./src/service/dynamodb.ts"
+      "types": "./src/service/data-client.ts",
+      "default": "./src/service/data-client.ts"
     },
     "./create-remit-client": {
       "types": "./src/service/create-remit-client.ts",
@@ -73,14 +73,11 @@
     "@aws-sdk/client-secrets-manager": "*",
     "@aws-sdk/client-sqs": "*",
     "better-sqlite3": "^12.11.1",
-    "drizzle-orm": "^0.45.2",
     "expect-env": "*",
     "openapi-backend": "*",
     "p-map": "*",
-    "pg": "^8.0.0",
     "@types/aws-lambda": "*",
-    "@types/better-sqlite3": "^7.6.13",
-    "@types/pg": "^8.0.0"
+    "@types/better-sqlite3": "^7.6.13"
   },
   "publishConfig": {
     "access": "public"

package/scripts/backfill-list-id.ts

@@ -1,5 +1,5 @@
 import { existsSync } from "node:fs";
-import { mkdir, readFile, rm, writeFile } from "node:fs/promises";
+import { mkdir, readFile, rename, rm, writeFile } from "node:fs/promises";
 import { dirname } from "node:path";
 import { logger } from "@remit/logger-lambda";
 import {
@@ -7,7 +7,7 @@ import {
 	type ListIdBackfillCheckpoint,
 	type ListIdBackfillCheckpointStore,
 } from "@remit/mailbox-service";
-import { getClient } from "../src/service/dynamodb.js";
+import { getClient } from "../src/service/data-client.js";
 
 /**
  * One-time, full-corpus `ThreadMessage.listId` backfill (issue #263). Ships as
@@ -29,15 +29,29 @@ const CHECKPOINT_PATH =
 	process.env.LIST_ID_BACKFILL_CHECKPOINT_PATH ??
 	"/data/sqlite/list-id-backfill-checkpoint.json";
 
+const isCheckpoint = (value: unknown): value is ListIdBackfillCheckpoint => {
+	if (typeof value !== "object" || value === null) return false;
+	if (!("accountConfigId" in value)) return false;
+	const candidate = value as Record<string, unknown>;
+	return (
+		typeof candidate.accountConfigId === "string" &&
+		(candidate.continuationToken === undefined ||
+			typeof candidate.continuationToken === "string")
+	);
+};
+
 const fileCheckpointStore: ListIdBackfillCheckpointStore = {
 	load: async () => {
 		if (!existsSync(CHECKPOINT_PATH)) return undefined;
 		const raw = await readFile(CHECKPOINT_PATH, "utf8");
-		return JSON.parse(raw) as ListIdBackfillCheckpoint;
+		const parsed: unknown = JSON.parse(raw);
+		return isCheckpoint(parsed) ? parsed : undefined;
 	},
 	save: async (checkpoint) => {
 		await mkdir(dirname(CHECKPOINT_PATH), { recursive: true });
-		await writeFile(CHECKPOINT_PATH, JSON.stringify(checkpoint));
+		const staging = `${CHECKPOINT_PATH}.writing`;
+		await writeFile(staging, JSON.stringify(checkpoint));
+		await rename(staging, CHECKPOINT_PATH);
 	},
 	clear: async () => {
 		await rm(CHECKPOINT_PATH, { force: true });

package/src/data-backend.test.ts

@@ -9,9 +9,7 @@ describe("usesBetterAuthJwt", () => {
 		else process.env.DATA_BACKEND = ORIGINAL;
 	});
 
-	it("is true for the self-host SQL backends", () => {
-		process.env.DATA_BACKEND = "postgres";
-		assert.equal(usesBetterAuthJwt(), true);
+	it("is true for the self-host SQL backend", () => {
 		process.env.DATA_BACKEND = "sqlite";
 		assert.equal(usesBetterAuthJwt(), true);
 	});

package/src/data-backend.ts

@@ -1,20 +1,14 @@
 /**
- * The two self-host SQL backends (RFC 034/035/036), as opposed to the AWS
- * DynamoDB path.
+ * The self-host SQL backend (RFC 034/035/036), as opposed to the AWS DynamoDB
+ * path.
  */
-export const isSelfHostSqlBackend = (): boolean => {
-	const backend = process.env.DATA_BACKEND;
-	return backend === "postgres" || backend === "sqlite";
-};
+export const isSelfHostSqlBackend = (): boolean =>
+	process.env.DATA_BACKEND === "sqlite";
 
 /**
- * The self-host SQL backends authenticate requests and sign content URLs the
- * same way: a better-auth RS256 JWT verified at the edge and re-verified
- * in-process, no Cognito authorizer. DynamoDB is the AWS path (Cognito claims,
- * Lambda@Edge content guard) and is deliberately excluded.
- *
- * Guarding these paths on `=== "postgres"` alone left the sqlite deployment
- * with no claim injection (every identity-bound request 500s) and unsigned
- * `/content/*` URLs; both branch on this predicate instead.
+ * The self-host SQL backend authenticates requests and signs content URLs with
+ * a better-auth RS256 JWT verified at the edge and re-verified in-process, no
+ * Cognito authorizer. DynamoDB is the AWS path (Cognito claims, Lambda@Edge
+ * content guard) and is deliberately excluded.
  */
 export const usesBetterAuthJwt = (): boolean => isSelfHostSqlBackend();

package/src/derive/contentSignature.test.ts

@@ -110,29 +110,11 @@ describe("getContentSigner", () => {
 		else process.env.BETTER_AUTH_SECRET = ORIGINAL_SECRET;
 	});
 
-	it("returns undefined outside Postgres mode (AWS keeps unsigned URLs)", () => {
+	it("returns undefined on the AWS path (unsigned URLs)", () => {
 		delete process.env.DATA_BACKEND;
 		assert.equal(getContentSigner(), undefined);
 	});
 
-	it("returns a working signer in Postgres mode", () => {
-		process.env.DATA_BACKEND = "postgres";
-		process.env.BETTER_AUTH_SECRET = SECRET;
-		const signer = getContentSigner();
-		assert.ok(signer);
-		const { exp, sig } = signer(PATH_A);
-		assert.deepEqual(
-			verifyContentSignature(PATH_A, String(exp), sig, SECRET, nowSeconds()),
-			{ valid: true },
-		);
-	});
-
-	it("throws in Postgres mode when the master secret is missing (fail loud)", () => {
-		process.env.DATA_BACKEND = "postgres";
-		delete process.env.BETTER_AUTH_SECRET;
-		assert.throws(() => getContentSigner(), /BETTER_AUTH_SECRET/);
-	});
-
 	it("returns a working signer in SQLite mode", () => {
 		process.env.DATA_BACKEND = "sqlite";
 		process.env.BETTER_AUTH_SECRET = SECRET;

package/src/derive/contentSignature.ts

@@ -2,10 +2,10 @@ import { createHmac, timingSafeEqual } from "node:crypto";
 import { usesBetterAuthJwt } from "../data-backend.js";
 
 /**
- * Signed-URL scheme for `/content/*` on the Postgres stack.
+ * Signed-URL scheme for `/content/*` on the self-host stack.
  *
  * On AWS the same bytes are guarded by CloudFront + a Lambda@Edge JWT verifier.
- * The Postgres stack serves `/content/*` straight from the backend container,
+ * The self-host stack serves `/content/*` straight from the backend container,
  * and a bearer token cannot ride along on an `<img src>` / `<a href>` content
  * load rendered inside email HTML. So the backend signs each content URL when
  * it hands the SPA a `BodyPartResponse.contentUrl`, and the `/content` route
@@ -37,7 +37,7 @@ export const CONTENT_URL_TTL_SECONDS = 3600;
  * separation via a fixed label keeps the content-signing key distinct from the
  * raw better-auth secret, so a compromise of one signing space does not reveal
  * the other. Reusing `BETTER_AUTH_SECRET` as the master means no new secret has
- * to be provisioned on the Postgres stack — it is already required there.
+ * to be provisioned on the self-host stack — it is already required there.
  */
 const deriveSigningKey = (masterSecret: string): Buffer =>
 	createHmac("sha256", masterSecret).update(KEY_DERIVATION_LABEL).digest();
@@ -78,19 +78,19 @@ export const createContentSigner = (
 
 /**
  * Build the content-URL signer for the current environment, or `undefined` when
- * signing does not apply. Signing is enforced on the self-host SQL backends
- * (postgres and sqlite), which serve `/content/*` straight from the backend
- * container; on AWS the Lambda@Edge JWT verifier guards `/content/*` and the URL
- * stays unsigned so CloudFront/S3 behaviour is unchanged. Throws on those
- * backends when the master secret is missing, so a misconfigured deploy fails
- * loud rather than shipping unsigned (unauthenticated) content URLs.
+ * signing does not apply. Signing is enforced on the self-host SQL backend,
+ * which serves `/content/*` straight from the backend container; on AWS the
+ * Lambda@Edge JWT verifier guards `/content/*` and the URL stays unsigned so
+ * CloudFront/S3 behaviour is unchanged. Throws on the self-host backend when the
+ * master secret is missing, so a misconfigured deploy fails loud rather than
+ * shipping unsigned (unauthenticated) content URLs.
  */
 export const getContentSigner = (): ContentSigner | undefined => {
 	if (!usesBetterAuthJwt()) return undefined;
 	const secret = process.env.BETTER_AUTH_SECRET;
 	if (!secret || secret.length === 0) {
 		throw new Error(
-			"a self-host SQL backend (postgres/sqlite) requires BETTER_AUTH_SECRET to sign content URLs",
+			"the self-host SQL backend requires BETTER_AUTH_SECRET to sign content URLs",
 		);
 	}
 	return createContentSigner(secret);

package/src/derive/contentUrl.ts

@@ -19,7 +19,7 @@ export interface BuildContentUrlInput {
 	messageId: string;
 	partPath: string;
 	/**
-	 * When present (Postgres stack), append an `exp`/`sig` signature scoped to
+	 * When present (self-host stack), append an `exp`/`sig` signature scoped to
 	 * this account's storage path. Absent on AWS, where Lambda@Edge guards the
 	 * URL and the path stays unsigned. See `contentSignature.ts`.
 	 */

package/src/handlers/account-oauth.ts

@@ -16,7 +16,7 @@ import type { Context } from "openapi-backend";
 import { getAccountConfigIdFromEvent } from "../auth.js";
 import { getMsOAuthConfig } from "../config/msoauth.js";
 import { safeJsonParse } from "../json.js";
-import { getClient } from "../service/dynamodb.js";
+import { getClient } from "../service/data-client.js";
 import type { MicrosoftOAuthOperationIds, OperationHandler } from "../types.js";
 import { triggerAccountSyncSafe } from "./account.js";
 import { findActiveDuplicateMailbox } from "./account-guards.js";

package/src/handlers/account.ts

@@ -29,7 +29,7 @@ import type { APIGatewayProxyEvent } from "aws-lambda";
 import { env } from "expect-env";
 import type { Context } from "openapi-backend";
 import { getAccountConfigIdFromEvent } from "../auth.js";
-import { getClient } from "../service/dynamodb.js";
+import { getClient } from "../service/data-client.js";
 import { fireAndForget } from "../service/fire-and-forget.js";
 import { sqsClient } from "../service/sqs.js";
 import { triggerAccountSync } from "../service/trigger-sync.js";

package/src/handlers/address.ts

@@ -7,7 +7,7 @@ import { ForbiddenError } from "@remit/data-ports/errors";
 import type { APIGatewayProxyEvent } from "aws-lambda";
 import type { Context } from "openapi-backend";
 import { getAccountConfigIdFromEvent } from "../auth.js";
-import { getClient } from "../service/dynamodb.js";
+import { getClient } from "../service/data-client.js";
 import type {
 	AddressDetailOperationIds,
 	AddressOperationIds,

package/src/handlers/config.ts

@@ -10,7 +10,7 @@ import type { APIGatewayProxyEvent } from "aws-lambda";
 import { env } from "expect-env";
 import type { Context } from "openapi-backend";
 import { getAccountConfigIdFromEvent, getSubFromEvent } from "../auth.js";
-import { getClient } from "../service/dynamodb.js";
+import { getClient } from "../service/data-client.js";
 import { fireAndForget } from "../service/fire-and-forget.js";
 import { sqsClient } from "../service/sqs.js";
 import { triggerAccountSync } from "../service/trigger-sync.js";

package/src/handlers/filter.ts

@@ -13,7 +13,7 @@ import { FilterScope, FilterState } from "@remit/domain-enums";
 import type { AnchorPayload } from "@remit/search-service";
 import type { APIGatewayProxyEvent } from "aws-lambda";
 import { getAccountConfigIdFromEvent } from "../auth.js";
-import { getClient } from "../service/dynamodb.js";
+import { getClient } from "../service/data-client.js";
 import { buildFilterAnchor } from "../service/filter.js";
 import type {
 	FilterDetailOperationIds,

package/src/handlers/folder-role.ts

@@ -4,7 +4,7 @@ import type {
 } from "@remit/api-openapi-types";
 import type { APIGatewayProxyEvent } from "aws-lambda";
 import { getAccountConfigIdFromEvent } from "../auth.js";
-import { getClient } from "../service/dynamodb.js";
+import { getClient } from "../service/data-client.js";
 import type { FolderRoleOperationIds, OperationHandler } from "../types.js";
 import { toAccountResponse } from "./account-guards.js";
 import { loadAccountOverrides } from "./account-overrides.js";

package/src/handlers/label.ts

@@ -11,7 +11,7 @@ import type {
 } from "@remit/data-ports";
 import type { APIGatewayProxyEvent } from "aws-lambda";
 import { getAccountConfigIdFromEvent } from "../auth.js";
-import { getClient } from "../service/dynamodb.js";
+import { getClient } from "../service/data-client.js";
 import type {
 	LabelDetailOperationIds,
 	LabelOperationIds,

package/src/handlers/mailbox.ts

@@ -11,7 +11,7 @@ import {
 	applyPendingMoveCountPrediction,
 	type PendingUnseenFlagPush,
 } from "../derive/pendingMoveCounts.js";
-import { getClient } from "../service/dynamodb.js";
+import { getClient } from "../service/data-client.js";
 import type {
 	MailboxDetailOperationIds,
 	MailboxOperationIds,
@@ -139,7 +139,7 @@ export const assertMailboxInAccount = (
  * `applyPendingMoveCountPrediction`'s read-time adjustment only, never mutates
  * stored counts (epic #1281 invariant 4). Markers are written by the
  * imap-worker bulk sync path through `RemitClient.placementMove` on every
- * backend, so this is a real signal on Postgres too.
+ * backend, so this is a real signal on the self-host stack too.
  */
 const loadPendingMoves = (
 	client: Awaited<ReturnType<typeof getClient>>,
@@ -150,7 +150,7 @@ const loadPendingMoves = (
  * Every pending `\Seen` flag-push marker (issue #1273) for an account —
  * `\Flagged` (star) markers are excluded, since only read/unread state feeds
  * `unseenCount`'s prediction. `RemitClient.flagPush` is present and WRITTEN
- * on both backends, so this is a real signal on Postgres too.
+ * on both backends, so this is a real signal on the self-host stack too.
  */
 const loadPendingUnseenFlagPushes = async (
 	client: Awaited<ReturnType<typeof getClient>>,

package/src/handlers/me.test.ts

@@ -8,7 +8,7 @@ import {
 	_resetForTest,
 	type RemitClient,
 	setClient,
-} from "../service/dynamodb.js";
+} from "../service/data-client.js";
 import { MeOperations } from "./me.js";
 
 const listQuarantine = MeOperations.MeOperations_listQuarantine as unknown as (

package/src/handlers/me.ts

@@ -13,7 +13,7 @@ import type { APIGatewayProxyEvent } from "aws-lambda";
 import { env } from "expect-env";
 import type { Context } from "openapi-backend";
 import { getAccountConfigIdFromEvent, getSubFromEvent } from "../auth.js";
-import { getClient } from "../service/dynamodb.js";
+import { getClient } from "../service/data-client.js";
 import { sqsClient } from "../service/sqs.js";
 import type { MeOperationIds, OperationHandler } from "../types.js";
 import { toVipSuggestionEntry } from "./vip-suggestions.js";

package/src/handlers/message.ts

@@ -41,7 +41,7 @@ import {
 	getContentDeliveryDomain,
 } from "../derive/contentUrl.js";
 import { deriveSenderTrust } from "../derive/senderTrust.js";
-import { getClient } from "../service/dynamodb.js";
+import { getClient } from "../service/data-client.js";
 import type {
 	MessageBulkOperationIds,
 	MessageOperationIds,

package/src/handlers/organize.ts

@@ -11,7 +11,7 @@ import type { APIGatewayProxyEvent } from "aws-lambda";
 import { env } from "expect-env";
 import type { Context } from "openapi-backend";
 import { getAccountConfigIdFromEvent, getSubFromEvent } from "../auth.js";
-import { getClient, type RemitClient } from "../service/dynamodb.js";
+import { getClient, type RemitClient } from "../service/data-client.js";
 import {
 	buildOrganizeMatchDeps,
 	matchOrganize,

package/src/handlers/outbox.ts

@@ -8,7 +8,7 @@ import { ForbiddenError } from "@remit/data-ports/errors";
 import type { APIGatewayProxyEvent } from "aws-lambda";
 import type { Context } from "openapi-backend";
 import { getAccountConfigIdFromEvent } from "../auth.js";
-import { getClient } from "../service/dynamodb.js";
+import { getClient } from "../service/data-client.js";
 import type {
 	OperationHandler,
 	OutboxDetailOperationIds,

package/src/handlers/search.ts

@@ -6,7 +6,7 @@ import type { SearchResult } from "@remit/search-service";
 import type { APIGatewayProxyEvent } from "aws-lambda";
 import type { Context } from "openapi-backend";
 import { getAccountConfigIdFromEvent } from "../auth.js";
-import { getClient } from "../service/dynamodb.js";
+import { getClient } from "../service/data-client.js";
 import {
 	isSemanticSearchUnavailable,
 	noteSemanticCapabilityAbsence,

package/src/handlers/sync.ts

@@ -3,7 +3,7 @@ import { logger } from "@remit/logger-lambda";
 import type { APIGatewayProxyEvent } from "aws-lambda";
 import { env } from "expect-env";
 import { getAccountConfigIdFromEvent } from "../auth.js";
-import { getClient } from "../service/dynamodb.js";
+import { getClient } from "../service/data-client.js";
 import {
 	type FireAndForgetLogger,
 	fireAndForget,

package/src/handlers/thread.ts

@@ -17,7 +17,7 @@ import {
 	filterByOffRowCriteria,
 	hasOffRowCriteria,
 } from "../derive/filterThreadCriteria.js";
-import { getClient } from "../service/dynamodb.js";
+import { getClient } from "../service/data-client.js";
 import type {
 	OperationHandler,
 	ThreadDetailOperationIds,

package/src/handlers/unified-threads.ts

@@ -9,7 +9,7 @@ import type { Context } from "openapi-backend";
 import pMap from "p-map";
 import { getAccountConfigIdFromEvent } from "../auth.js";
 import { enrichThreadRows } from "../derive/enrichThreadRows.js";
-import { getClient } from "../service/dynamodb.js";
+import { getClient } from "../service/data-client.js";
 import type { OperationHandler, UnifiedThreadOperationIds } from "../types.js";
 import {
 	groupAccountOverrides,

package/src/index.ts

@@ -14,7 +14,7 @@ import { assertLocalBypassNotInDeployedEnv } from "./auth.js";
 import { usesBetterAuthJwt } from "./data-backend.js";
 import { handleError } from "./error.js";
 import { handlers } from "./handlers/index.js";
-import { authenticatePostgresRequest } from "./jwt-auth.js";
+import { authenticateSelfHostRequest } from "./jwt-auth.js";
 import { normalizeRequest } from "./request.js";
 import { runWithRequestContext } from "./request-context.js";
 import { formatResponse, postResponseHandler } from "./response.js";
@@ -161,7 +161,7 @@ const rawHandler = async (event: APIGatewayProxyEvent, context: Context) =>
 			const origin = readOriginHeader(event.headers);
 
 			if (usesBetterAuthJwt()) {
-				const denied = await authenticatePostgresRequest(event);
+				const denied = await authenticateSelfHostRequest(event);
 				if (denied) return denied;
 			}
 

package/src/jwt-auth.test.ts

@@ -3,7 +3,7 @@ import { afterEach, beforeEach, test } from "node:test";
 import type { APIGatewayProxyEvent } from "aws-lambda";
 import {
 	_setVerifierForTest,
-	authenticatePostgresRequest,
+	authenticateSelfHostRequest,
 } from "./jwt-auth.js";
 
 const buildEvent = (
@@ -34,7 +34,7 @@ test("valid token injects verified sub into authorizer claims", async () => {
 		headers: { Authorization: "Bearer good.token.here" },
 	});
 
-	const result = await authenticatePostgresRequest(event);
+	const result = await authenticateSelfHostRequest(event);
 
 	assert.equal(result, null);
 	assert.equal(event.requestContext.authorizer?.claims?.sub, "user-abc");
@@ -49,7 +49,7 @@ test("invalid token returns 401 and does not inject claims", async () => {
 		headers: { authorization: "Bearer bad.token" },
 	});
 
-	const result = await authenticatePostgresRequest(event);
+	const result = await authenticateSelfHostRequest(event);
 
 	assert.equal(result?.statusCode, 401);
 	assert.equal(event.requestContext.authorizer, undefined);
@@ -59,7 +59,7 @@ test("no token with a local bypass configured is allowed", async () => {
 	process.env.LOCAL_ACCOUNT_CONFIG_ID = "some-config-id";
 	const event = buildEvent();
 
-	const result = await authenticatePostgresRequest(event);
+	const result = await authenticateSelfHostRequest(event);
 
 	assert.equal(result, null);
 });
@@ -67,7 +67,7 @@ test("no token with a local bypass configured is allowed", async () => {
 test("no token and no bypass returns 401", async () => {
 	const event = buildEvent();
 
-	const result = await authenticatePostgresRequest(event);
+	const result = await authenticateSelfHostRequest(event);
 
 	assert.equal(result?.statusCode, 401);
 });
@@ -82,7 +82,7 @@ test("pre-injected claims (edge tier) short-circuit verification", async () => {
 		} as unknown as APIGatewayProxyEvent["requestContext"],
 	});
 
-	const result = await authenticatePostgresRequest(event);
+	const result = await authenticateSelfHostRequest(event);
 
 	assert.equal(result, null);
 	assert.equal(event.requestContext.authorizer?.claims?.sub, "edge-user");

package/src/jwt-auth.ts

@@ -56,7 +56,7 @@ const hasLocalBypass = (): boolean =>
 	Boolean(process.env.LOCAL_ACCOUNT_CONFIG_ID);
 
 /**
- * Authenticate a Postgres-mode request from a better-auth RS256 JWT.
+ * Authenticate a self-host request from a better-auth RS256 JWT.
  *
  * On a valid token the verified `sub` is injected into the event's authorizer
  * claims, exactly where the Cognito authorizer puts it, so every downstream
@@ -68,7 +68,7 @@ const hasLocalBypass = (): boolean =>
  * When the edge tier (APISIX) has already verified and injected claims, this is
  * a no-op — the backend trusts pre-populated claims and re-verifies otherwise.
  */
-export const authenticatePostgresRequest = async (
+export const authenticateSelfHostRequest = async (
 	event: APIGatewayProxyEvent,
 ): Promise<APIGatewayProxyResult | null> => {
 	const existingSub = event.requestContext?.authorizer?.claims?.sub;

package/src/service/compose-sqlite.ts

@@ -25,7 +25,6 @@ import {
 	OutboxMessageRepo,
 	QuarantineRepo,
 } from "@remit/drizzle-service";
-import type { NodePgDatabase } from "drizzle-orm/node-postgres";
 import { env } from "expect-env";
 import {
 	buildSharedDeps,
@@ -34,25 +33,20 @@ import {
 	type RemitClientRepositories,
 } from "./create-remit-client.js";
 
-// The SQLite backend (RFC 036). Mirrors the Postgres composition — the same
-// dialect-neutral Drizzle repos, wired to one shared SQLite file instead of a
-// Postgres server — with two differences the file topology forces (D3): every
-// repo runs on the single serialized connection `createSqliteDatabase` opens
-// (writes cannot bypass serialization, so a plain repo write never joins an
-// open transaction's savepoint), and `threadMessage` takes that shared handle
-// rather than its own connection string, so its writes enlist in the same
-// unit-of-work transaction and the same write queue as everything else.
+// The SQLite adapter composition (RFC 036). Every repo runs on the single
+// serialized connection `createSqliteDatabase` opens (D3), so a plain repo
+// write cannot bypass serialization and join an open transaction's savepoint,
+// and `threadMessage` takes that same shared handle, so its writes enlist in
+// the same unit-of-work transaction and the same write queue as everything
+// else.
 export const buildSqliteClient = async (): Promise<RemitClient> => {
 	const sqliteDbPath = env.SQLITE_DB_PATH;
 
 	const { db } = await createSqliteDatabase(messageDataSchema, {
 		filename: sqliteDbPath,
 	});
-	const genericDb = db as unknown as NodePgDatabase<Record<string, unknown>>;
-
-	const messageDataDb = db as unknown as NodePgDatabase<
-		typeof messageDataSchema
-	>;
+	const genericDb = db;
+	const messageDataDb = db;
 
 	const repositories: RemitClientRepositories = {
 		accountConfig: new AccountConfigRepo(genericDb),

package/src/service/create-remit-client.ts

@@ -85,8 +85,8 @@ export interface RemitClient {
 
 	// Smart Organize (RFC 034, epic #1280). Present on both backends
 	// (`FilterService`/`LabelService`/… on DynamoDB, `FilterRepo`/`LabelRepo`/…
-	// on Postgres) so the matching pipeline and filter CRUD run unchanged on
-	// either. The Postgres side has no TTL reaper for expired Temporary filters;
+	// relationally) so the matching pipeline and filter CRUD run unchanged on
+	// either. The relational side has no TTL reaper for expired Temporary filters;
 	// match-time correctness gates on `expiresAt` (RFC 034 Decision 1.1), never
 	// on the row still existing, so the missing reaper is housekeeping only.
 	filter: IFilterRepository;
@@ -99,7 +99,7 @@ export interface RemitClient {
 	label: ILabelRepository;
 	messageLabel: IMessageLabelRepository;
 
-	// Atomic write set for a message save. Present on Postgres (real
+	// Atomic write set for a message save. Present on the relational backend (real
 	// transaction); absent on DynamoDB, where callers fall back to per-repo
 	// writes with that backend's own (non-transactional) guarantees.
 	unitOfWork?: IUnitOfWork;
@@ -123,16 +123,16 @@ export interface RemitClient {
 
 	// Pending placement-move markers (issue #1271). Present on both backends
 	// (`MessagePlacementMoveService` on DynamoDB, `MessagePlacementMoveRepo` on
-	// Postgres) so a caller never needs to guess which backend is active. Used
+	// relationally) so a caller never needs to guess which backend is active. Used
 	// for read-time count prediction (epic #1281 invariant 4) and by the
 	// account-worker cascade delete. Written by the imap-worker's bulk
 	// body-sync path through this `placementMove`, so the placement producer
-	// runs on whatever backend is active — DynamoDB, Postgres, or SQLite.
+	// runs on whatever backend is active — DynamoDB or SQLite.
 	placementMove: IMessagePlacementMoveRepository;
 
 	// Pending flag-push markers (issue #1273). Present on both backends
 	// (`MessageFlagPushService` on DynamoDB, `MessageFlagPushRepo` on
-	// Postgres). Used for read-time unseenCount prediction (epic #1281
+	// relationally). Used for read-time unseenCount prediction (epic #1281
 	// invariant 4), by the account-worker cascade delete, and by the periodic
 	// per-mailbox sync tick to re-arm a marker stuck `pending`. Unlike
 	// `placementMove`, this one IS written on both backends — `flagQueue`

package/src/service/data-client.test.ts

@@ -0,0 +1,96 @@
+import assert from "node:assert/strict";
+import { mkdtempSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { afterEach, test } from "node:test";
+import {
+	_resetForTest,
+	getClient,
+	type RemitClient,
+	setClient,
+} from "./data-client.js";
+
+const REQUIRED_KEYS: ReadonlyArray<keyof RemitClient> = [
+	"accountConfig",
+	"account",
+	"accountSetting",
+	"address",
+	"mailbox",
+	"mailboxSpecialUse",
+	"message",
+	"messageFlag",
+	"outboxMessage",
+	"threadMessage",
+	"envelope",
+	"accountExportRequest",
+	"quarantine",
+	"storage",
+	"search",
+	"secrets",
+	"bodySync",
+	"flagQueue",
+	"mailboxQueue",
+	"messageMove",
+	"outboxQueue",
+	"createConnectionScope",
+] as const;
+
+afterEach(() => {
+	_resetForTest();
+});
+
+const withSqliteDbPath = async (run: () => Promise<void>): Promise<void> => {
+	const saved = process.env.SQLITE_DB_PATH;
+	const dir = mkdtempSync(join(tmpdir(), "remit-data-client-"));
+	process.env.SQLITE_DB_PATH = join(dir, "remit.db");
+	try {
+		await run();
+	} finally {
+		_resetForTest();
+		if (saved === undefined) delete process.env.SQLITE_DB_PATH;
+		else process.env.SQLITE_DB_PATH = saved;
+		rmSync(dir, { recursive: true, force: true });
+	}
+};
+
+test("getClient() falls back to the in-package composition and constructs every service", async () => {
+	await withSqliteDbPath(async () => {
+		const client = await getClient();
+
+		for (const key of REQUIRED_KEYS) {
+			assert.ok(
+				client[key] !== undefined && client[key] !== null,
+				`RemitClient.${String(key)} must be defined on the fallback path`,
+			);
+		}
+
+		assert.equal(typeof client.createConnectionScope, "function");
+	});
+});
+
+test("getClient() names setClient when nothing is registered and there is no database to open", async () => {
+	const saved = process.env.SQLITE_DB_PATH;
+	delete process.env.SQLITE_DB_PATH;
+
+	try {
+		await assert.rejects(getClient(), /register one with setClient\(\)/);
+	} finally {
+		if (saved !== undefined) process.env.SQLITE_DB_PATH = saved;
+	}
+});
+
+test("getClient() returns the injected client without reading the environment", async () => {
+	const saved = process.env.SQLITE_DB_PATH;
+	delete process.env.SQLITE_DB_PATH;
+
+	const injected = { account: {} } as unknown as RemitClient;
+	setClient(injected);
+
+	try {
+		const client = await getClient();
+		assert.equal(client, injected);
+	} finally {
+		_resetForTest();
+		if (saved !== undefined) process.env.SQLITE_DB_PATH = saved;
+	}
+});

package/src/service/data-client.ts

@@ -0,0 +1,58 @@
+import type { RemitClient } from "./create-remit-client.js";
+
+export type {
+	ConnectionScope,
+	RemitClient,
+} from "./create-remit-client.js";
+
+let clientPromise: Promise<RemitClient> | null = null;
+let injected: RemitClient | null = null;
+
+/**
+ * Register the client from the composition root. An adapter that lives outside
+ * this shared, open-core module — DynamoDB, or a Postgres adapter in the
+ * repository that deploys it — is never imported here; its composition root
+ * calls this before handling a request.
+ */
+export const setClient = (client: RemitClient): void => {
+	injected = client;
+	clientPromise = null;
+};
+
+/**
+ * The SQLite composition this build contains, reached only by a process that
+ * registered no client of its own. The `import()` is dynamic so a bundler
+ * following the entry graph of a process that injects its client never reaches
+ * `@remit/drizzle-service` or drizzle-orm (both `external` for the Lambda
+ * esbuild build).
+ *
+ * `SQLITE_DB_PATH` is the precondition the composition needs, checked ahead of
+ * the import so its absence names `setClient` instead of failing on module
+ * resolution inside a bundle, or — worse — opening an empty database and
+ * serving an empty mailbox. It is a precondition, not a backend selection.
+ */
+const buildRelationalClient = async (): Promise<RemitClient> => {
+	if (!process.env.SQLITE_DB_PATH) {
+		throw new Error(
+			"no client registered — register one with setClient() from your composition root",
+		);
+	}
+	const composition = await import("./compose-sqlite.js");
+	return composition.buildSqliteClient();
+};
+
+export const getClient = (): Promise<RemitClient> => {
+	if (!clientPromise) {
+		clientPromise = injected
+			? Promise.resolve(injected)
+			: buildRelationalClient();
+	}
+
+	return clientPromise;
+};
+
+/** Reset the singleton and any injected client — test use only. */
+export const _resetForTest = (): void => {
+	clientPromise = null;
+	injected = null;
+};

package/src/service/organize.test.ts

@@ -9,7 +9,7 @@ import type {
 	VectorRecord,
 } from "@remit/search-service";
 import { createMemoryVectorStore } from "@remit/search-service";
-import type { RemitClient } from "./dynamodb.js";
+import type { RemitClient } from "./data-client.js";
 import {
 	applyOrganize,
 	matchOrganize,

package/src/service/organize.ts

@@ -25,7 +25,7 @@ import {
 	buildEmbeddingServiceFromEnv,
 	buildVectorStoreFromEnv,
 } from "@remit/search-service/from-env";
-import type { RemitClient } from "./dynamodb.js";
+import type { RemitClient } from "./data-client.js";
 import { noteSemanticCapabilityAbsence } from "./semantic-capability.js";
 
 /**

package/src/service/semantic-capability.test.ts

@@ -33,14 +33,11 @@ describe("noteSemanticCapabilityAbsence", () => {
 		_resetSemanticCapabilityForTest();
 	});
 
-	it("absorbs a missing-module failure on the self-host SQL backends and remembers it", () => {
-		for (const backend of ["sqlite", "postgres"]) {
-			_resetSemanticCapabilityForTest();
-			process.env.DATA_BACKEND = backend;
-			assert.equal(isSemanticSearchUnavailable(), false);
-			assert.equal(noteSemanticCapabilityAbsence(moduleNotFound()), true);
-			assert.equal(isSemanticSearchUnavailable(), true);
-		}
+	it("absorbs a missing-module failure on the self-host SQL backend and remembers it", () => {
+		process.env.DATA_BACKEND = "sqlite";
+		assert.equal(isSemanticSearchUnavailable(), false);
+		assert.equal(noteSemanticCapabilityAbsence(moduleNotFound()), true);
+		assert.equal(isSemanticSearchUnavailable(), true);
 	});
 
 	it("absorbs a dlopen failure (musl loading a glibc extension)", () => {
@@ -53,16 +50,13 @@ describe("noteSemanticCapabilityAbsence", () => {
 	});
 
 	it("absorbs an embedding-model load failure (e2e-dev from source, HuggingFace fetch failed) and remembers it", () => {
-		for (const backend of ["sqlite", "postgres"]) {
-			_resetSemanticCapabilityForTest();
-			process.env.DATA_BACKEND = backend;
-			assert.equal(isSemanticSearchUnavailable(), false);
-			assert.equal(noteSemanticCapabilityAbsence(modelUnavailable()), true);
-			assert.equal(isSemanticSearchUnavailable(), true);
-		}
+		process.env.DATA_BACKEND = "sqlite";
+		assert.equal(isSemanticSearchUnavailable(), false);
+		assert.equal(noteSemanticCapabilityAbsence(modelUnavailable()), true);
+		assert.equal(isSemanticSearchUnavailable(), true);
 	});
 
-	it("rethrows genuine query errors on the self-host SQL backends", () => {
+	it("rethrows genuine query errors on the self-host SQL backend", () => {
 		process.env.DATA_BACKEND = "sqlite";
 		assert.equal(
 			noteSemanticCapabilityAbsence(new Error("SQLITE_BUSY")),

package/src/service/semantic-capability.ts

@@ -35,7 +35,7 @@ import { isSelfHostSqlBackend } from "../data-backend.js";
  * the FTS/literal engine is the primary search surface on these profiles and is
  * unaffected. The absence is remembered so subsequent requests short-circuit.
  *
- * Scoped to the self-host SQL backends: on AWS the pipeline (Bedrock +
+ * Scoped to the self-host SQL backend: on AWS the pipeline (Bedrock +
  * S3 Vectors) is bundled, so a module-resolution failure there is a broken
  * deploy and must keep failing loud. Falling back to the FTS engine here
  * instead was considered and rejected — it would fabricate relevance scores and

package/src/service/compose-postgres.ts

@@ -1,76 +0,0 @@
-import {
-	AccountConfigRepo,
-	AccountExportRequestRepo,
-	AccountRepo,
-	AccountSettingRepo,
-	AddressRepo,
-	DrizzleEnvelopeRepository,
-	DrizzleFilterAnchorTransaction,
-	DrizzleMessageFlagRepository,
-	DrizzleMessageRepository,
-	DrizzleThreadMessageRepository,
-	DrizzleUnitOfWork,
-	FilterAnchorRepo,
-	FilterRepo,
-	LabelRepo,
-	MailboxLockRepo,
-	MailboxRepo,
-	MailboxSpecialUseRepo,
-	MessageFlagPushRepo,
-	MessageLabelRepo,
-	MessagePlacementMoveRepo,
-	messageDataSchema,
-	OrganizeJobRequestRepo,
-	OutboxMessageRepo,
-	QuarantineRepo,
-} from "@remit/drizzle-service";
-import { drizzle, type NodePgDatabase } from "drizzle-orm/node-postgres";
-import { env } from "expect-env";
-import {
-	buildSharedDeps,
-	createRemitClient,
-	type RemitClient,
-	type RemitClientRepositories,
-} from "./create-remit-client.js";
-
-export const buildPostgresClient = (): RemitClient => {
-	const pgConnectionUrl = env.PG_CONNECTION_URL;
-
-	// One drizzle db instance shared across repos.
-	// The schema is registered for message-data tables; i4 repos use the same
-	// underlying connection and only need the builder API (no relational queries).
-	const db = drizzle(pgConnectionUrl, { schema: messageDataSchema });
-	const genericDb = db as unknown as NodePgDatabase<Record<string, unknown>>;
-
-	const messageDataDb = db as unknown as NodePgDatabase<
-		typeof messageDataSchema
-	>;
-
-	const repositories: RemitClientRepositories = {
-		accountConfig: new AccountConfigRepo(genericDb),
-		account: new AccountRepo(genericDb),
-		accountSetting: new AccountSettingRepo(genericDb),
-		address: new AddressRepo(genericDb),
-		mailbox: new MailboxRepo(genericDb),
-		mailboxSpecialUse: new MailboxSpecialUseRepo(genericDb),
-		mailboxLock: new MailboxLockRepo(genericDb),
-		message: new DrizzleMessageRepository(messageDataDb),
-		messageFlag: new DrizzleMessageFlagRepository(messageDataDb),
-		outboxMessage: new OutboxMessageRepo(genericDb),
-		threadMessage: new DrizzleThreadMessageRepository(pgConnectionUrl),
-		envelope: new DrizzleEnvelopeRepository(messageDataDb),
-		accountExportRequest: new AccountExportRequestRepo(genericDb),
-		quarantine: new QuarantineRepo(genericDb),
-		organizeJobRequest: new OrganizeJobRequestRepo(genericDb),
-		placementMove: new MessagePlacementMoveRepo(genericDb),
-		flagPush: new MessageFlagPushRepo(genericDb),
-		filter: new FilterRepo(genericDb),
-		filterAnchor: new FilterAnchorRepo(genericDb),
-		filterAnchorTransaction: new DrizzleFilterAnchorTransaction(genericDb),
-		label: new LabelRepo(genericDb),
-		messageLabel: new MessageLabelRepo(genericDb),
-		unitOfWork: new DrizzleUnitOfWork(messageDataDb),
-	};
-
-	return createRemitClient({ repositories, ...buildSharedDeps() });
-};

package/src/service/dynamodb.test.ts

@@ -1,98 +0,0 @@
-import assert from "node:assert/strict";
-import { afterEach, test } from "node:test";
-import {
-	_resetForTest,
-	getClient,
-	type RemitClient,
-	setClient,
-} from "./dynamodb.js";
-
-const REQUIRED_KEYS: ReadonlyArray<keyof RemitClient> = [
-	"accountConfig",
-	"account",
-	"accountSetting",
-	"address",
-	"mailbox",
-	"mailboxSpecialUse",
-	"message",
-	"messageFlag",
-	"outboxMessage",
-	"threadMessage",
-	"envelope",
-	"accountExportRequest",
-	"quarantine",
-	"storage",
-	"search",
-	"secrets",
-	"bodySync",
-	"flagQueue",
-	"mailboxQueue",
-	"messageMove",
-	"outboxQueue",
-	"createConnectionScope",
-] as const;
-
-afterEach(() => {
-	_resetForTest();
-});
-
-test("getClient() with DATA_BACKEND=postgres constructs all services without throwing", async () => {
-	const savedBackend = process.env.DATA_BACKEND;
-	const savedPgUrl = process.env.PG_CONNECTION_URL;
-
-	process.env.DATA_BACKEND = "postgres";
-	process.env.PG_CONNECTION_URL =
-		"postgresql://remit:remit@localhost:5432/remit_test";
-
-	try {
-		const client = await getClient();
-
-		for (const key of REQUIRED_KEYS) {
-			assert.ok(
-				client[key] !== undefined && client[key] !== null,
-				`RemitClient.${key} must be defined on the postgres path`,
-			);
-		}
-
-		assert.equal(typeof client.createConnectionScope, "function");
-	} finally {
-		_resetForTest();
-		if (savedBackend === undefined) {
-			delete process.env.DATA_BACKEND;
-		} else {
-			process.env.DATA_BACKEND = savedBackend;
-		}
-		if (savedPgUrl === undefined) {
-			delete process.env.PG_CONNECTION_URL;
-		} else {
-			process.env.PG_CONNECTION_URL = savedPgUrl;
-		}
-	}
-});
-
-test("getClient() without DATA_BACKEND throws until a client is registered", () => {
-	const savedBackend = process.env.DATA_BACKEND;
-	delete process.env.DATA_BACKEND;
-
-	try {
-		assert.throws(() => getClient(), /no DynamoDB client registered/);
-	} finally {
-		if (savedBackend !== undefined) process.env.DATA_BACKEND = savedBackend;
-	}
-});
-
-test("getClient() without DATA_BACKEND returns the injected client", async () => {
-	const savedBackend = process.env.DATA_BACKEND;
-	delete process.env.DATA_BACKEND;
-
-	const injected = { account: {} } as unknown as RemitClient;
-	setClient(injected);
-
-	try {
-		const client = await getClient();
-		assert.equal(client, injected);
-	} finally {
-		_resetForTest();
-		if (savedBackend !== undefined) process.env.DATA_BACKEND = savedBackend;
-	}
-});

package/src/service/dynamodb.ts

@@ -1,57 +0,0 @@
-import type { RemitClient } from "./create-remit-client.js";
-
-export type {
-	ConnectionScope,
-	RemitClient,
-} from "./create-remit-client.js";
-
-let clientPromise: Promise<RemitClient> | null = null;
-let injected: RemitClient | null = null;
-
-/**
- * Register the DynamoDB-backed client from the composition root. The DynamoDB
- * composition lives outside this shared, open-core module and is never imported
- * here. Every DynamoDB entry point calls this before handling a request. The
- * relational backends compose in-package below and never touch this seam.
- */
-export const setClient = (client: RemitClient): void => {
-	injected = client;
-	clientPromise = null;
-};
-
-// The API process and the imap-worker share this composition root. The
-// relational backends are loaded through a lazy `import()` of their own
-// in-package composition module, so the module a given deploy never runs never
-// enters its graph: `@remit/drizzle-service`/`drizzle-orm` stay out of a
-// Lambda bundle (both `external` for the Lambda esbuild build;
-// `remit-lambda-bundles.test.ts` enforces this). The DynamoDB backend is
-// injected by the composition root through `setClient`, so this module carries
-// no import of the DynamoDB composition.
-export const getClient = (): Promise<RemitClient> => {
-	if (!clientPromise) {
-		if (process.env.DATA_BACKEND === "postgres") {
-			clientPromise = import("./compose-postgres.js").then((m) =>
-				m.buildPostgresClient(),
-			);
-		} else if (process.env.DATA_BACKEND === "sqlite") {
-			clientPromise = import("./compose-sqlite.js").then((m) =>
-				m.buildSqliteClient(),
-			);
-		} else {
-			if (!injected) {
-				throw new Error(
-					"no DynamoDB client registered — register one with setClient() from your composition root",
-				);
-			}
-			clientPromise = Promise.resolve(injected);
-		}
-	}
-
-	return clientPromise;
-};
-
-/** Reset the singleton and any injected client — test use only. */
-export const _resetForTest = (): void => {
-	clientPromise = null;
-	injected = null;
-};