@12-apps/notifications 4.11.0 → 4.13.0

package/dist/{wire-BG1kuoXX.d.ts → wire-CJka1AvM.d.ts}

@@ -1,4 +1,4 @@
-import { b as NotificationCategory, c as NotificationChannel } from './types-BlqZkCWZ.js';
+import { b as NotificationCategory, c as NotificationChannel } from './types-DPiePHJD.js';
 
 /**
  * Every sentence this package can say to a USER, stated by the HOST.
@@ -163,6 +163,69 @@ declare function defaultChannelMatrix(categories: readonly NotificationCategory[
  * a data migration for every existing row on every channel that ever ships.
  */
 declare function mergeStoredRow(stored: unknown, base: ChannelRow): ChannelRow;
+/**
+ * What ONE notification type says about its own channels, independent of the
+ * user's category preferences: {@link NotificationGenerator.channels} (the hard
+ * availability cap) and {@link NotificationGenerator.channelDefaults} (a
+ * starting point the user can still move).
+ *
+ * Structurally what a generator already is, rather than the generator itself,
+ * so the policy here stays free of the registry and the router.
+ */
+interface TypeChannelRules {
+    channels?: readonly NotificationChannel[];
+    channelDefaults?: Partial<ChannelRow>;
+}
+/**
+ * The channels a type may EVER use, coerced onto the closed channel set.
+ *
+ * `undefined` — a generator that never declared a list — means every channel,
+ * which is what keeps every generator written before the field working. An
+ * EMPTY list means no transport channel at all and is legal: the inbox record
+ * is written by the router regardless, and the inbox is not a channel a user
+ * opts out of.
+ *
+ * Filtering through {@link NOTIFICATION_CHANNELS} rather than returning the
+ * declaration is deliberate: it drops a value that is not a channel (a typo, a
+ * channel removed from the set since) instead of carrying it into an
+ * intersection where it would silently match nothing anyway, and it fixes the
+ * order so two declarations of the same set compare equal.
+ */
+declare function availableChannelsOf(declared: readonly NotificationChannel[] | undefined): NotificationChannel[];
+/**
+ * Drop the channels a type does not offer. Applied by the router AFTER every
+ * other gate, so no later stage can hand back a channel the type never offered
+ * — including the plan gate's own error fallback, which degrades to the free
+ * channels and would otherwise restore an e-mail this type had just refused.
+ */
+declare function capToAvailable(channels: readonly NotificationChannel[], declared: readonly NotificationChannel[] | undefined): NotificationChannel[];
+/**
+ * The channels one (user, category, TYPE) actually enables — the whole policy
+ * in one pure function, so the router's gate can be argued about without a
+ * database.
+ *
+ * The order is the meaning:
+ *   1. the category's defaults, with the TYPE's defaults over them — a type
+ *      moves the starting point;
+ *   2. the user's stored row over that — an explicit choice beats any default,
+ *      which is what makes step 1 a default rather than a rule;
+ *   3. the type's AVAILABILITY over everything — a channel this type does not
+ *      offer is gone even when the user's stored row explicitly asked for it,
+ *      because it was never on offer for this message.
+ *
+ * Step 3 overriding a stored `true` is the one place a user's saved choice is
+ * discarded, and it is the point of the field: the answer they gave was about
+ * the CATEGORY, and a category can hold messages this channel was never right
+ * for. Step 2 beating step 1 is what keeps the other field a default.
+ */
+declare function resolveTypeChannels(input: {
+    /** The stored `channels` JSON for this (user, category), if any. */
+    stored?: unknown;
+    /** The category's effective default row (host defaults already merged). */
+    categoryDefaults: ChannelRow;
+    /** The type's own declarations. */
+    rules?: TypeChannelRules;
+}): NotificationChannel[];
 /** The channels enabled by one effective row — the router's gate. */
 declare function enabledChannelsOf(row: ChannelRow): NotificationChannel[];
 /**
@@ -220,4 +283,4 @@ interface NotificationRow {
 /** Row → wire. Dates become ISO strings; a null `data` becomes `{}`. */
 declare function inboxWire(row: NotificationRow): InboxNotification;
 
-export { type ChannelMatrix as C, DEFAULT_CHANNEL_ROW as D, type InboxNotification as I, type ListNotificationsResult as L, type NotificationMessages as N, type ChannelRow as a, type NotificationRow as b, type NotificationWireMessages as c, defaultChannelMatrix as d, enabledChannelsOf as e, mergeStoredRow as f, messagesOf as g, type NotificationsCopySource as h, inboxWire as i, mergeChoices as m };
+export { type ChannelMatrix as C, DEFAULT_CHANNEL_ROW as D, type InboxNotification as I, type ListNotificationsResult as L, type NotificationMessages as N, type TypeChannelRules as T, type ChannelRow as a, type NotificationRow as b, type NotificationWireMessages as c, availableChannelsOf as d, capToAvailable as e, defaultChannelMatrix as f, enabledChannelsOf as g, mergeStoredRow as h, inboxWire as i, messagesOf as j, type NotificationsCopySource as k, mergeChoices as m, resolveTypeChannels as r };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@12-apps/notifications",
-  "version": "4.11.0",
+  "version": "4.13.0",
   "type": "module",
   "sideEffects": false,
   "description": "Plug-and-play notification system (12-15): an always-on in-app inbox, per-user × per-category channel preferences, and email / SMS / WhatsApp / web-push transports behind vendor DRIVERS so a second provider is a config entry. Framework-free core (.), host-mounted backend surface (./server: inbox / preferences / push-subscription endpoints, the channel router with delivery records + retry sweep, the permission fan-out, duck-typed Prisma seam), Hono adapter (./hono), React surface (./react: bell + badge, inbox drawer, preferences screen), VAPID sender (./web-push) and the package-owned Prisma partial + migrations. Standardized adoption contract in ADOPTING.md.",
@@ -71,7 +71,7 @@
     "prisma:sync:check": "node scripts/sync-notifications-schema.mjs --check"
   },
   "dependencies": {
-    "@12-apps/ui": "^6.22.0"
+    "@12-apps/ui": "^6.27.1"
   },
   "peerDependencies": {
     "@12-apps/wiring": ">=1.3.0",

package/prisma/migrations/20260914210000_scope_push_subscriptions_per_store/migration.sql

@@ -0,0 +1,31 @@
+-- @12-apps/notifications: which ORIGIN a browser subscription was
+-- registered on.
+--
+-- A multi-tenant host installs one storefront per store as its own PWA, and a
+-- PWA's identity is its ORIGIN — so two stores are two apps. Without this
+-- column the Web Push transport fans every notification out to every row a user
+-- holds, and store B's push lands inside store A's installed app wearing store
+-- A's icon.
+--
+-- NULL means the PLATFORM origin: the marketplace host itself, or any adopter
+-- that serves one origin and has no per-store apps at all. That is why the
+-- column is nullable and why every EXISTING row reads correctly with no
+-- backfill — an adopter who never had custom domains keeps today's behaviour
+-- exactly, which is what makes this a MINOR release rather than a breaking one.
+--
+-- A by-value scalar with NO foreign key, exactly as `user_id` and
+-- `notifications.client_id` already are here (the payments-backend doctrine at
+-- the top of `notifications.prisma`): this package must not constrain a host's
+-- tenant table, whose name it does not know.
+--
+-- Additive DDL, so no expand/contract ceremony: the previous release reads a
+-- table that has gained a nullable column it never mentions, which is safe.
+ALTER TABLE "push_subscriptions" ADD COLUMN IF NOT EXISTS "client_id" TEXT;
+
+-- Serves the ONE query the send path makes per notification:
+--   user_id = $1 AND ($2 IS NULL OR client_id IS NULL OR client_id = $2)
+-- `user_id` leads because it is the selective half and is on every read; the
+-- existing `push_subscriptions_user_id_idx` stays for the unscoped counts the
+-- settings screen still makes.
+CREATE INDEX IF NOT EXISTS "push_subscriptions_user_id_client_id_idx"
+  ON "push_subscriptions" ("user_id", "client_id");

package/prisma/notifications.prisma

@@ -131,11 +131,23 @@ model PushSubscription {
   endpoint  String   @unique
   p256dh    String
   auth      String
+  /// Which ORIGIN this browser registered on.
+  ///
+  /// NULL is the PLATFORM origin — the host itself, or any adopter serving one
+  /// origin. A subscription stamped with a store receives that store's
+  /// notifications plus platform-wide ones (`clientId IS NULL`) and NEVER
+  /// another store's; a platform-origin subscription receives everything, which
+  /// is what keeps a marketplace host's behaviour identical to before.
+  ///
+  /// Nullable so every pre-existing row reads as "platform" with no backfill.
+  clientId  String?  @map("client_id")
   // Free-form browser/device hint ("Chrome · Linux") for a device list.
   userAgent String?  @map("user_agent")
   createdAt DateTime @default(now()) @map("created_at")
   updatedAt DateTime @updatedAt @map("updated_at")
 
   @@index([userId])
+  // The send path's one query: owner, then the origin rule above.
+  @@index([userId, clientId])
   @@map("push_subscriptions")
 }

package/src/index.ts

@@ -48,13 +48,17 @@ export {
 } from './generators';
 
 export {
+  availableChannelsOf,
+  capToAvailable,
   DEFAULT_CHANNEL_ROW,
   defaultChannelMatrix,
   enabledChannelsOf,
   mergeChoices,
   mergeStoredRow,
+  resolveTypeChannels,
   type ChannelMatrix,
   type ChannelRow,
+  type TypeChannelRules,
 } from './preferences-core';
 
 export { normalizePhoneE164, type PhoneNormalizeOptions } from './phone';

package/src/preferences-core.ts

@@ -70,11 +70,118 @@ export function mergeStoredRow(stored: unknown, base: ChannelRow): ChannelRow {
   return row;
 }
 
+/**
+ * What ONE notification type says about its own channels, independent of the
+ * user's category preferences: {@link NotificationGenerator.channels} (the hard
+ * availability cap) and {@link NotificationGenerator.channelDefaults} (a
+ * starting point the user can still move).
+ *
+ * Structurally what a generator already is, rather than the generator itself,
+ * so the policy here stays free of the registry and the router.
+ */
+export interface TypeChannelRules {
+  channels?: readonly NotificationChannel[];
+  channelDefaults?: Partial<ChannelRow>;
+}
+
+/**
+ * The channels a type may EVER use, coerced onto the closed channel set.
+ *
+ * `undefined` — a generator that never declared a list — means every channel,
+ * which is what keeps every generator written before the field working. An
+ * EMPTY list means no transport channel at all and is legal: the inbox record
+ * is written by the router regardless, and the inbox is not a channel a user
+ * opts out of.
+ *
+ * Filtering through {@link NOTIFICATION_CHANNELS} rather than returning the
+ * declaration is deliberate: it drops a value that is not a channel (a typo, a
+ * channel removed from the set since) instead of carrying it into an
+ * intersection where it would silently match nothing anyway, and it fixes the
+ * order so two declarations of the same set compare equal.
+ */
+export function availableChannelsOf(
+  declared: readonly NotificationChannel[] | undefined,
+): NotificationChannel[] {
+  if (!declared) return [...NOTIFICATION_CHANNELS];
+  const offered = new Set<string>(declared);
+  return NOTIFICATION_CHANNELS.filter((channel) => offered.has(channel));
+}
+
+/**
+ * Drop the channels a type does not offer. Applied by the router AFTER every
+ * other gate, so no later stage can hand back a channel the type never offered
+ * — including the plan gate's own error fallback, which degrades to the free
+ * channels and would otherwise restore an e-mail this type had just refused.
+ */
+export function capToAvailable(
+  channels: readonly NotificationChannel[],
+  declared: readonly NotificationChannel[] | undefined,
+): NotificationChannel[] {
+  if (!declared) return [...channels];
+  const offered = new Set(availableChannelsOf(declared));
+  return channels.filter((channel) => offered.has(channel));
+}
+
+/**
+ * The channels one (user, category, TYPE) actually enables — the whole policy
+ * in one pure function, so the router's gate can be argued about without a
+ * database.
+ *
+ * The order is the meaning:
+ *   1. the category's defaults, with the TYPE's defaults over them — a type
+ *      moves the starting point;
+ *   2. the user's stored row over that — an explicit choice beats any default,
+ *      which is what makes step 1 a default rather than a rule;
+ *   3. the type's AVAILABILITY over everything — a channel this type does not
+ *      offer is gone even when the user's stored row explicitly asked for it,
+ *      because it was never on offer for this message.
+ *
+ * Step 3 overriding a stored `true` is the one place a user's saved choice is
+ * discarded, and it is the point of the field: the answer they gave was about
+ * the CATEGORY, and a category can hold messages this channel was never right
+ * for. Step 2 beating step 1 is what keeps the other field a default.
+ */
+export function resolveTypeChannels(input: {
+  /** The stored `channels` JSON for this (user, category), if any. */
+  stored?: unknown;
+  /** The category's effective default row (host defaults already merged). */
+  categoryDefaults: ChannelRow;
+  /** The type's own declarations. */
+  rules?: TypeChannelRules;
+}): NotificationChannel[] {
+  const { stored, categoryDefaults, rules } = input;
+  const base: ChannelRow = { ...categoryDefaults, ...rules?.channelDefaults };
+  const row = stored === undefined || stored === null ? base : mergeStoredRow(stored, base);
+  return capToAvailable(enabledChannelsOf(row), rules?.channels);
+}
+
 /** The channels enabled by one effective row — the router's gate. */
 export function enabledChannelsOf(row: ChannelRow): NotificationChannel[] {
   return NOTIFICATION_CHANNELS.filter((channel) => row[channel]);
 }
 
+/**
+ * The channels a stored row states an EXPLICIT choice for, dropping everything
+ * else — the inverse of {@link mergeStoredRow}, which fills the gaps in.
+ *
+ * The package's storage model is "only explicit choices are stored; a missing
+ * key falls back to the default", and this is what lets a writer keep that
+ * promise. Merging a save onto the user's EFFECTIVE row instead turns every
+ * defaulted channel into an explicit one the moment they touch any switch, and
+ * the row can never say "no opinion" about a channel again.
+ */
+export function explicitChoicesOf(stored: unknown): Partial<ChannelRow> {
+  const choices: Partial<ChannelRow> = {};
+  if (stored && typeof stored === 'object') {
+    const record = stored as Record<string, unknown>;
+    for (const channel of NOTIFICATION_CHANNELS) {
+      const value = record[channel];
+      if (typeof value === 'boolean') choices[channel] = value;
+    }
+  }
+  return choices;
+}
+
 /**
  * What a PUT writes for one category: the caller's toggles merged over the
  * user's CURRENT effective row. A single-toggle save (how the settings UI

package/src/server/context.ts

@@ -22,6 +22,21 @@ import { NOTIFICATION_CHANNELS, type NotificationChannel } from '../types';
  */
 export interface NotificationsActor {
   userId: string;
+  /**
+   * The store whose ORIGIN this request arrived on, resolved by the
+   * HOST from the hostname — never read from the body or the query.
+   *
+   * The paragraph above still holds: this is not a tenant the surface
+   * authorizes against, it is a NARROWING of a read that is already the
+   * caller's own, and it can never widen one. A host with a single origin never
+   * sets it and every endpoint answers exactly what it answered before.
+   *
+   * It exists because a multi-tenant host installs one storefront per store as
+   * its own PWA, and a PWA's identity is its ORIGIN — so an inbox answering a
+   * store's own app with a neighbour's notifications is one store reporting on
+   * another.
+   */
+  scopeClientId?: string;
 }
 
 /** One request, already authenticated and routed by the host. */

package/src/server/db.ts

@@ -54,14 +54,40 @@ export interface NotificationPageAfter {
   id: string;
 }
 
-/** The inbox read filter. `deletedAt: null` is on every read, always. */
-export interface NotificationWhere {
+/**
+ * One BRANCH of an inbox filter — a member of `AND`/`OR`, never a whole read.
+ *
+ * Split out when the store scope arrived, and the split is what keeps `deletedAt: null`
+ * REQUIRED on the read itself (see {@link NotificationWhere}). Widening `OR`
+ * from the old fixed keyset tuple to a general array needed its members to be
+ * valid filters, and the tempting move — relaxing `deletedAt` on the one type —
+ * would have removed the only thing that makes a Prisma-backed host exclude
+ * soft-deleted rows. Both in-package doubles hard-code that filter regardless,
+ * so Prisma is precisely the implementation the requirement was protecting.
+ *
+ * `createdAt` and `id: { lt }` are here because the keyset boundary is built
+ * from them (`../inbox.ts`'s `pageWhere`); without them the branch type cannot
+ * express the very thing the widening exists to preserve.
+ */
+export interface NotificationWhereBranch {
   userId?: string;
-  id?: string | { in: string[] };
-  deletedAt: null;
+  id?: string | { in: string[] } | { lt: string };
+  createdAt?: Date | { lt: Date };
+  deletedAt?: null;
   readAt?: null;
-  /** The keyset half of `(createdAt, id) < (anchor.createdAt, anchor.id)`. */
-  OR?: [{ createdAt: { lt: Date } }, { createdAt: Date; id: { lt: string } }];
+  /** `null` matches the platform-wide rows that travel with every store scope. */
+  clientId?: string | null;
+  OR?: NotificationWhereBranch[];
+  AND?: NotificationWhereBranch[];
+}
+
+/**
+ * The inbox read filter. `deletedAt: null` is on every read, always — and it
+ * stays REQUIRED here, which is the whole reason {@link NotificationWhereBranch}
+ * is a separate type.
+ */
+export interface NotificationWhere extends NotificationWhereBranch {
+  deletedAt: null;
 }
 
 export interface NotificationDelegate {
@@ -180,11 +206,25 @@ export interface PushSubscriptionRow {
   endpoint: string;
   p256dh: string;
   auth: string;
+  /** The origin this browser registered on; `null` = the platform origin. */
+  clientId: string | null;
   userAgent: string | null;
 }
 
+/**
+ * Which of a user's subscriptions one send may reach.
+ *
+ * The disjunction is load-bearing and `clientId: { in: [x, null] }` is NOT a
+ * shortcut for it: SQL `IN` never matches NULL, so the platform-wide rows that
+ * must travel with every store scope would silently vanish.
+ */
+export interface PushSubscriptionWhere {
+  userId: string;
+  OR?: [{ clientId: null }, { clientId: string }];
+}
+
 export interface PushSubscriptionDelegate {
-  count(args: { where: { userId: string } }): Promise<number>;
+  count(args: { where: PushSubscriptionWhere }): Promise<number>;
   /**
    * The row holding one endpoint, whoever owns it. Read BEFORE an upsert so a
    * re-own (the same browser profile, a different signed-in user) is a logged
@@ -192,7 +232,7 @@ export interface PushSubscriptionDelegate {
    * whether THIS browser's subscription is still the caller's.
    */
   findUnique(args: { where: { endpoint: string } }): Promise<PushSubscriptionRow | null>;
-  findMany(args: { where: { userId: string } }): Promise<PushSubscriptionRow[]>;
+  findMany(args: { where: PushSubscriptionWhere }): Promise<PushSubscriptionRow[]>;
   upsert(args: {
     where: { endpoint: string };
     create: {
@@ -200,12 +240,14 @@ export interface PushSubscriptionDelegate {
       endpoint: string;
       p256dh: string;
       auth: string;
+      clientId: string | null;
       userAgent: string | null;
     };
     update: {
       userId: string;
       p256dh: string;
       auth: string;
+      clientId: string | null;
       userAgent: string | null;
     };
   }): Promise<PushSubscriptionRow>;

package/src/server/dispatch.ts

@@ -92,6 +92,7 @@ export interface NotificationDispatchDeps {
 export async function loadRecipient(
   deps: NotificationDispatchDeps,
   userId: string,
+  clientId: string | null,
 ): Promise<TransportRecipient | null> {
   const contact = await deps.contacts.getContact(userId);
   if (!contact) return null;
@@ -103,7 +104,11 @@ export async function loadRecipient(
     // absent case has to stay distinguishable from a stated language, because
     // that is what lets a generator apply its own default in one place.
     ...(contact.locale === undefined ? {} : { locale: contact.locale }),
-    pushSubscriptionCount: await deps.pushSubscriptions.count(userId),
+    clientId,
+    // SCOPED, and this is what keeps `supports()` honest: it gates on this
+    // number, so an unscoped count would enqueue a WEB_PUSH delivery for a
+    // notification no reachable subscription exists for.
+    pushSubscriptionCount: await deps.pushSubscriptions.count(userId, clientId),
   };
 }
 
@@ -223,7 +228,9 @@ export async function dispatchOne(
   });
   if (queued.length === 0) return 0;
 
-  const recipient = await loadRecipient(deps, notification.userId);
+  // The STORED column, so the retry sweep scopes identically to the first
+  // attempt — anything less would let a retry leak what the first send withheld.
+  const recipient = await loadRecipient(deps, notification.userId, notification.clientId);
   if (!recipient) {
     await abandonUnreachable(deps, client, queued, notification.userId);
     return 0;

package/src/server/inbox.ts

@@ -5,6 +5,7 @@ import type {
   NotificationPageAfter,
   NotificationsDbProvider,
   NotificationWhere,
+  NotificationWhereBranch,
 } from './db';
 
 /**
@@ -15,6 +16,29 @@ import type {
  * never be resurrected by mark-read.
  */
 
+/**
+ * The store whose ORIGIN the caller is reading from, or absent for the platform
+ * origin.
+ *
+ * A host that installs one storefront per store as its own PWA reads this from
+ * the request's hostname; a host with one origin never sets it and every read
+ * below is exactly what it was. Set, it narrows to that store's rows PLUS the
+ * platform-wide ones (`clientId IS NULL`) — a password reset or a security
+ * notice is about the person and not about a store, so hiding it inside the
+ * only app a customer opens would be a worse failure than the leak this fixes.
+ */
+export type NotificationScope = string | undefined;
+
+/**
+ * `clientId IN (<scope>, NULL)`, as a filter branch — or nothing at all.
+ *
+ * A disjunction rather than an `in`, because SQL `IN` never matches NULL and
+ * the NULL rows are precisely the ones that must survive every scope.
+ */
+function scopeBranch(scope: NotificationScope): NotificationWhereBranch[] {
+  return scope === undefined ? [] : [{ OR: [{ clientId: scope }, { clientId: null }] }];
+}
+
 export interface ListNotificationsInput {
   /** `unread` narrows to unread rows; default lists all non-deleted. */
   filter?: 'all' | 'unread';
@@ -34,10 +58,27 @@ const DEFAULT_PAGE = 20;
 const MAX_PAGE = 100;
 
 export interface NotificationInboxStore {
-  list(userId: string, input?: ListNotificationsInput): Promise<ListNotificationsResult>;
-  unreadCount(userId: string): Promise<number>;
+  list(
+    userId: string,
+    input?: ListNotificationsInput,
+    scope?: NotificationScope,
+  ): Promise<ListNotificationsResult>;
+  /** Scoped with `list`, or the badge and the list it sits over disagree. */
+  unreadCount(userId: string, scope?: NotificationScope): Promise<number>;
   markRead(userId: string, ids: readonly string[]): Promise<number>;
-  markAllRead(userId: string): Promise<number>;
+  /**
+   * Scoped too, and this one is a WRITE.
+   *
+   * Unscoped, "mark all as read" pressed inside store A's app clears store B's
+   * unread rows everywhere — a cross-store write from the app that exists to be
+   * isolated, and strictly worse than the read leak. `markRead(ids)` and
+   * `softDelete(ids)` need nothing: their ids come from the already-scoped list.
+   *
+   * The platform-wide rows ARE cleared from any origin, and that follows from
+   * the scope rule rather than contradicting it — those rows are one person's,
+   * not one store's.
+   */
+  markAllRead(userId: string, scope?: NotificationScope): Promise<number>;
   softDelete(userId: string, ids: readonly string[]): Promise<number>;
 }
 
@@ -66,27 +107,55 @@ function pageWhere(
   userId: string,
   filter: ListNotificationsInput['filter'],
   anchor: NotificationPageAfter | undefined,
+  scope: NotificationScope,
 ): NotificationWhere {
+  // Two DISJUNCTIONS have to hold at once — the page boundary and the store
+  // scope — so they are AND-ed rather than merged. A second `OR` key on this
+  // object literal would overwrite the first, dropping either the scope or the
+  // anchor; the anchor only from page TWO onward, which is the case a cursor
+  // exists for and the case a single-page test never reaches.
+  const clauses: NotificationWhereBranch[] = [
+    // `(createdAt, id) < (anchor.createdAt, anchor.id)`, as a portable `where`.
+    ...(anchor
+      ? [
+          {
+            OR: [
+              { createdAt: { lt: anchor.createdAt } },
+              { createdAt: anchor.createdAt, id: { lt: anchor.id } },
+            ],
+          },
+        ]
+      : []),
+    ...scopeBranch(scope),
+  ];
   return {
     userId,
     deletedAt: null,
     ...(filter === 'unread' ? { readAt: null } : {}),
-    // `(createdAt, id) < (anchor.createdAt, anchor.id)`, as a portable `where`.
-    ...(anchor
-      ? {
-          OR: [
-            { createdAt: { lt: anchor.createdAt } },
-            { createdAt: anchor.createdAt, id: { lt: anchor.id } },
-          ] as NonNullable<NotificationWhere['OR']>,
-        }
-      : {}),
+    ...(clauses.length > 0 ? { AND: clauses } : {}),
+  };
+}
+
+/**
+ * The unread rows this scope can see — READ by the badge and WRITTEN by "mark
+ * all". One filter for both on purpose: the count and the write have to agree
+ * about which rows are in scope, and two copies of the same object literal is
+ * how a badge ends up saying 3 over a list of 2.
+ */
+function unreadWhere(userId: string, scope: NotificationScope): NotificationWhere {
+  const scoped = scopeBranch(scope);
+  return {
+    userId,
+    deletedAt: null,
+    readAt: null,
+    ...(scoped.length > 0 ? { AND: scoped } : {}),
   };
 }
 
 export function createInboxStore(db: NotificationsDbProvider): NotificationInboxStore {
   return {
     /** The owner's inbox, newest first, keyset-paginated, deleted excluded. */
-    async list(userId, input = {}) {
+    async list(userId, input = {}, scope) {
       const client = await db();
       const limit = Math.min(Math.max(input.limit ?? DEFAULT_PAGE, 1), MAX_PAGE);
       const anchor = input.cursor
@@ -94,7 +163,7 @@ export function createInboxStore(db: NotificationsDbProvider): NotificationInbox
         : undefined;
       if (input.cursor && !anchor) return { items: [], nextCursor: null };
       const rows = await client.notification.findMany({
-        where: pageWhere(userId, input.filter, anchor),
+        where: pageWhere(userId, input.filter, anchor, scope),
         // `id` tie-breaks equal timestamps so pages never skip/repeat.
         orderBy: [{ createdAt: 'desc' }, { id: 'desc' }],
         take: limit + 1,
@@ -107,9 +176,9 @@ export function createInboxStore(db: NotificationsDbProvider): NotificationInbox
     },
 
     /** Unread badge count (non-deleted, unread). */
-    async unreadCount(userId) {
+    async unreadCount(userId, scope) {
       const client = await db();
-      return client.notification.count({ where: { userId, deletedAt: null, readAt: null } });
+      return client.notification.count({ where: unreadWhere(userId, scope) });
     },
 
     /**
@@ -128,10 +197,10 @@ export function createInboxStore(db: NotificationsDbProvider): NotificationInbox
     },
 
     /** Mark every unread notification of the owner read ("mark all"). */
-    async markAllRead(userId) {
+    async markAllRead(userId, scope) {
       const client = await db();
       const result = await client.notification.updateMany({
-        where: { userId, deletedAt: null, readAt: null },
+        where: unreadWhere(userId, scope),
         data: { readAt: new Date() },
       });
       return result.count;

package/src/server/index.ts

@@ -34,11 +34,13 @@ export type {
   NotificationPreferenceDelegate,
   NotificationPreferenceRow,
   NotificationWhere,
+  NotificationWhereBranch,
   NotificationsDb,
   NotificationsDbClient,
   NotificationsDbProvider,
   PushSubscriptionDelegate,
   PushSubscriptionRow,
+  PushSubscriptionWhere,
 } from './db';
 
 export type { ListNotificationsInput, NotificationInboxStore } from './inbox';