CORS was too strict

server/index.ts

···
       req.method === 'OPTIONS'
     ) {
       res.setHeader('Access-Control-Allow-Origin', '*');
+    } else if (req.path.startsWith('/xrpc/')) {
+      // XRPC endpoints use Authorization header auth, not cookies, so CSRF isn't a concern
+      // Allow cross-origin requests for ATProto clients
+      res.setHeader('Access-Control-Allow-Origin', '*');
     } else {
       // For state-changing operations without origin, reject to prevent CSRF
       return res.status(403).json({

server/storage.ts

···
       conditions.push(sql`${notifications.indexedAt} <= ${seenAt}`);
     }
 
-    return await db
+    return await this.db
       .select()
       .from(notifications)
       .where(and(...conditions))
···
   }
 
   async getUnreadNotificationCount(recipientDid: string): Promise<number> {
-    const result = await db
+    const result = await this.db
       .select({ count: sql<number>`count(*)` })
       .from(notifications)
       .where(
···
   }
 
   async createList(list: InsertList): Promise<List> {
-    const [newList] = await db.insert(lists).values(list).returning();
+    const [newList] = await this.db.insert(lists).values(list).returning();
     return newList;
   }
 
···
 
   // Video job operations
   async createVideoJob(job: InsertVideoJob): Promise<VideoJob> {
-    const [videoJob] = await db.insert(videoJobs).values(job).returning();
+    const [videoJob] = await this.db.insert(videoJobs).values(job).returning();
     return videoJob;
   }
 
   async getVideoJob(jobId: string): Promise<VideoJob | undefined> {
-    const [job] = await db
+    const [job] = await this.db
       .select()
       .from(videoJobs)
       .where(eq(videoJobs.jobId, jobId))