@12-apps/notifications 4.12.0 → 4.14.0

package/dist/{preferences-screen-S3ZHX5LB.js → preferences-screen-YRPNUZS5.js}

@@ -4,7 +4,7 @@ import {
 } from "./chunk-CQZMTFPY.js";
 import {
   NOTIFICATION_CHANNELS
-} from "./chunk-CPQKKLPS.js";
+} from "./chunk-CSMFJJXY.js";
 import {
   __name
 } from "./chunk-7QVYU63E.js";
@@ -291,4 +291,4 @@ __name(PreferencesScreen, "PreferencesScreen");
 export {
   PreferencesScreen
 };
-//# sourceMappingURL=preferences-screen-S3ZHX5LB.js.map
+//# sourceMappingURL=preferences-screen-YRPNUZS5.js.map

package/dist/react/index.d.ts

@@ -1,10 +1,10 @@
-import { L as LiveActivitiesConfig, N as NotificationsApiClient } from '../create-web-notifications-2xxbKnrW.js';
-export { B as BADGE_POLL_MS, a as BADGE_RECONCILE_MS, b as BadgeSyncOptions, d as BellBadge, e as BellButtonProps, I as InboxListStatus, f as InboxState, g as InboxStore, h as LiveActivitiesHook, i as LiveActivityMessages, j as NotificationsHttpError, k as NotificationsPanelProps, l as NotificationsResult, m as NotificationsSignalHook, n as NotificationsSubscribe, o as NotificationsTransport, p as NotificationsWebConfig, P as PAGE_SIZE, q as PreferencesPayload, r as PreferencesScreenProps, s as PushRegistrationPayload, W as WebNotifications, t as WebPushPlatformHint, u as WebPushSetupConfig, v as createInboxStore, w as createNotificationsApiClient, c as createWebNotifications, x as httpNotificationsTransport, y as useInboxList, z as useInboxState, A as useUnreadCount } from '../create-web-notifications-2xxbKnrW.js';
+import { L as LiveActivitiesConfig, N as NotificationsApiClient } from '../create-web-notifications-32Myo-ww.js';
+export { B as BADGE_POLL_MS, a as BADGE_RECONCILE_MS, b as BadgeHookOptions, d as BadgeSyncOptions, e as BellBadge, f as BellButtonProps, I as InboxListStatus, g as InboxState, h as InboxStore, i as LiveActivitiesHook, j as LiveActivityMessages, k as NotificationsHttpError, l as NotificationsPanelProps, m as NotificationsResult, n as NotificationsSignalHook, o as NotificationsSubscribe, p as NotificationsTransport, q as NotificationsWebConfig, P as PAGE_SIZE, r as PreferencesPayload, s as PreferencesScreenProps, t as PushRegistrationPayload, W as WebNotifications, u as WebPushPlatformHint, v as WebPushSetupConfig, w as createInboxStore, x as createNotificationsApiClient, c as createWebNotifications, y as httpNotificationsTransport, z as useInboxList, A as useInboxState, C as useUnreadCount } from '../create-web-notifications-32Myo-ww.js';
 import { JSX, ReactNode } from 'react';
 import { b as LiveActivity } from '../live-DYxEFO49.js';
 export { c as LiveActivityLane, d as LiveActivityStep, l as liveActivityLane } from '../live-DYxEFO49.js';
-import { N as NotificationMessages } from '../wire-Bn6aA2nL.js';
-import '../types-H_aFzLA0.js';
+import { N as NotificationMessages } from '../wire-CJka1AvM.js';
+import '../types-DPiePHJD.js';
 
 /**
  * What the reader has already been shown, so the bell can say NEW rather than

package/dist/react/index.js

@@ -3,7 +3,7 @@ import {
   createNotificationsApiClient,
   createWebNotifications,
   httpNotificationsTransport
-} from "../chunk-PNY6S6WH.js";
+} from "../chunk-643HNPQJ.js";
 import {
   LiveSection,
   relativeTime
@@ -17,7 +17,7 @@ import {
   useInboxList,
   useInboxState,
   useUnreadCount
-} from "../chunk-2IAHFIXS.js";
+} from "../chunk-AN6IX4AE.js";
 import {
   disableWebPush,
   enableWebPush,

package/dist/server/index.d.ts

@@ -1,11 +1,11 @@
-import { A as ApiNotifications } from '../create-api-notifications-BTudlaSC.js';
-export { C as CommittedNotification, E as EMAIL_DRIVERS, c as EmailDriver, d as EmailDriverDeclaration, e as EmailMessage, f as ExtraDrivers, L as ListNotificationsInput, g as NotificationAudienceDirectory, h as NotificationChannelPolicy, i as NotificationCommittedListener, j as NotificationContactDirectory, k as NotificationCreateData, l as NotificationDelegate, m as NotificationDeliveryDelegate, n as NotificationDeliveryRow, o as NotificationDeliveryWhere, p as NotificationDispatchScheduler, q as NotificationInboxStore, r as NotificationPageAfter, s as NotificationPreferenceDelegate, t as NotificationPreferenceRow, u as NotificationPreferenceStore, v as NotificationRouter, w as NotificationWhere, a as NotificationsActor, x as NotificationsApiError, y as NotificationsDb, z as NotificationsDbClient, B as NotificationsDbProvider, D as NotificationsRequest, F as NotificationsResponse, b as NotificationsRoute, N as NotificationsServerConfig, G as NotifyByPermission, H as NotifyOptions, I as NotifyResult, P as PermissionNotificationResult, J as PermissionNotificationSkip, K as PushSubscriptionDelegate, M as PushSubscriptionInput, O as PushSubscriptionRow, Q as PushSubscriptionStore, S as SMS_DRIVERS, R as SmsDriver, T as SmsDriverDeclaration, U as SmsMessage, V as TransportDeclaration, W as TransportRegistry, X as WHATSAPP_DRIVERS, Y as WhatsAppDriver, Z as WhatsAppDriverDeclaration, _ as WhatsAppMessage, $ as createApiNotifications, a0 as createTransportRegistry, a1 as emailTransport, a2 as foldApiError, a3 as formatEmail, a4 as formatSms, a5 as formatWhatsApp, a6 as ok, a7 as smsTransport, a8 as whatsAppTransport } from '../create-api-notifications-BTudlaSC.js';
-export { D as DriverDeclarationBase, F as FetchImpl, N as NotificationProviderError, W as WEB_PUSH_DRIVERS, a as WebPushDriverDeclaration, b as WebPushMessage, c as WebPushSender, d as WebPushSubscription, e as WebPushSubscriptionSource, f as absoluteLink, g as formatWebPush, w as webPushTransport } from '../web-push-C6U-5JCV.js';
+import { A as ApiNotifications } from '../create-api-notifications-cIEbFqoZ.js';
+export { C as CommittedNotification, E as EMAIL_DRIVERS, c as EmailDriver, d as EmailDriverDeclaration, e as EmailMessage, f as ExtraDrivers, L as ListNotificationsInput, g as NotificationAudienceDirectory, h as NotificationChannelPolicy, i as NotificationCommittedListener, j as NotificationContactDirectory, k as NotificationCreateData, l as NotificationDelegate, m as NotificationDeliveryDelegate, n as NotificationDeliveryRow, o as NotificationDeliveryWhere, p as NotificationDispatchScheduler, q as NotificationInboxStore, r as NotificationPageAfter, s as NotificationPreferenceDelegate, t as NotificationPreferenceRow, u as NotificationPreferenceStore, v as NotificationRouter, w as NotificationWhere, x as NotificationWhereBranch, a as NotificationsActor, y as NotificationsApiError, z as NotificationsDb, B as NotificationsDbClient, D as NotificationsDbProvider, F as NotificationsRequest, G as NotificationsResponse, b as NotificationsRoute, N as NotificationsServerConfig, H as NotifyByPermission, I as NotifyOptions, J as NotifyResult, P as PermissionNotificationResult, K as PermissionNotificationSkip, M as PushSubscriptionDelegate, O as PushSubscriptionInput, Q as PushSubscriptionRow, R as PushSubscriptionStore, S as PushSubscriptionWhere, T as SMS_DRIVERS, U as SmsDriver, V as SmsDriverDeclaration, W as SmsMessage, X as TransportDeclaration, Y as TransportRegistry, Z as WHATSAPP_DRIVERS, _ as WhatsAppDriver, $ as WhatsAppDriverDeclaration, a0 as WhatsAppMessage, a1 as createApiNotifications, a2 as createTransportRegistry, a3 as emailTransport, a4 as foldApiError, a5 as formatEmail, a6 as formatSms, a7 as formatWhatsApp, a8 as ok, a9 as smsTransport, aa as whatsAppTransport } from '../create-api-notifications-cIEbFqoZ.js';
+export { D as DriverDeclarationBase, F as FetchImpl, N as NotificationProviderError, W as WEB_PUSH_DRIVERS, a as WebPushDriverDeclaration, b as WebPushMessage, c as WebPushSender, d as WebPushSubscription, e as WebPushSubscriptionSource, f as absoluteLink, g as formatWebPush, w as webPushTransport } from '../web-push-DUn_d_gj.js';
 import { NotifyPort } from '@12-apps/wiring/ports';
-export { a as NOTIFICATIONS_DRAIN_CRON, b as NOTIFICATIONS_DRAIN_LEASE_MS, c as NOTIFICATIONS_JOBS, d as NOTIFICATIONS_SWEEP_QUEUE, N as NotificationsJobDeps } from '../jobs-CaovU4GM.js';
-import '../generators-CQYdJfB5.js';
-import '../types-H_aFzLA0.js';
-import '../wire-Bn6aA2nL.js';
+export { a as NOTIFICATIONS_DRAIN_CRON, b as NOTIFICATIONS_DRAIN_LEASE_MS, c as NOTIFICATIONS_JOBS, d as NOTIFICATIONS_SWEEP_QUEUE, N as NotificationsJobDeps } from '../jobs-wKoOz91Q.js';
+import '../generators-GUF-Kml-.js';
+import '../types-DPiePHJD.js';
+import '../wire-CJka1AvM.js';
 import '../template-Dlt5S54z.js';
 import '@12-apps/wiring';
 

package/dist/server/index.js

@@ -4,7 +4,7 @@ import {
   NOTIFICATIONS_JOBS,
   NOTIFICATIONS_SWEEP_QUEUE,
   wireNotifyPort
-} from "../chunk-FBBPS2LT.js";
+} from "../chunk-QPO6NSRR.js";
 import {
   EMAIL_DRIVERS,
   NotificationProviderError,
@@ -25,11 +25,11 @@ import {
   smsTransport,
   webPushTransport,
   whatsAppTransport
-} from "../chunk-WZBX7YCE.js";
-import "../chunk-GK6GSC2J.js";
+} from "../chunk-53SH5ABN.js";
+import "../chunk-XFODKRRB.js";
 import "../chunk-M2TVBVH2.js";
 import "../chunk-RTURLH5U.js";
-import "../chunk-CPQKKLPS.js";
+import "../chunk-CSMFJJXY.js";
 import "../chunk-EKUSNUBT.js";
 import "../chunk-7QVYU63E.js";
 export {

package/dist/{types-H_aFzLA0.d.ts → types-DPiePHJD.d.ts}

@@ -181,8 +181,26 @@ interface TransportRecipient {
     locale?: string | null;
     /** Phone as the host stores it (transports normalize per provider rules). */
     phone: string | null;
-    /** How many active browser push subscriptions the user holds. */
+    /**
+     * How many push subscriptions this NOTIFICATION can actually reach — not how
+     * many the user holds. Scoped by {@link TransportRecipient.clientId}.
+     */
     pushSubscriptionCount: number;
+    /**
+     * The store this notification belongs to, or `null` for a platform-wide one
+     *.
+     *
+     * REQUIRED, and deliberately so where optional is the tempting answer. An
+     * optional field fails OPEN: a construction site that forgets it yields
+     * `undefined`, which the push scope reads as "platform notification -> every
+     * subscription" — precisely the cross-store fan-out this exists to stop.
+     * Three construction sites is the argument FOR requiring it, not against; the
+     * compiler then names them.
+     *
+     * Not a breaking change for adopters: every external use CONSUMES a recipient
+     * through `supports`/`send` below, and the only constructors are in-package.
+     */
+    clientId: string | null;
 }
 /**
  * One pluggable channel adapter: a FORMATTER (agnostic content → channel

package/dist/web-push/index.d.ts

@@ -1,5 +1,5 @@
-import { c as WebPushSender } from '../web-push-C6U-5JCV.js';
-import '../types-H_aFzLA0.js';
+import { c as WebPushSender } from '../web-push-DUn_d_gj.js';
+import '../types-DPiePHJD.js';
 
 /**
  * `@12-apps/notifications/web-push` — the VAPID sender, behind its own subpath.

package/dist/{web-push-C6U-5JCV.d.ts → web-push-DUn_d_gj.d.ts}

@@ -1,4 +1,4 @@
-import { g as NotificationLogger, d as NotificationContent, j as NotificationTransport } from './types-H_aFzLA0.js';
+import { g as NotificationLogger, d as NotificationContent, j as NotificationTransport } from './types-DPiePHJD.js';
 
 /**
  * The DRIVER port — the reason a host adds a vendor with a config entry and no
@@ -133,7 +133,17 @@ interface WebPushDriverDeclaration extends DriverDeclarationBase {
 }
 /** The subscriptions the transport reads and prunes (db-backed by the mount). */
 interface WebPushSubscriptionSource {
-    list(userId: string): Promise<{
+    /**
+     * The subscriptions one notification may reach.
+     *
+     * `notificationClientId` is the notification's tenant — `null` for a
+     * platform-wide one, which every subscription receives. An ADOPTER with a
+     * hand-written source must honour it: a function declared with fewer
+     * parameters still type-checks, so an un-updated implementation silently
+     * ignores the scope and keeps fanning out to every origin, with nothing
+     * failing to compile to say so.
+     */
+    list(userId: string, notificationClientId?: string | null): Promise<{
         id: string;
         endpoint: string;
         p256dh: string;

package/dist/{wire-Bn6aA2nL.d.ts → wire-CJka1AvM.d.ts}

@@ -1,4 +1,4 @@
-import { b as NotificationCategory, c as NotificationChannel } from './types-H_aFzLA0.js';
+import { b as NotificationCategory, c as NotificationChannel } from './types-DPiePHJD.js';
 
 /**
  * Every sentence this package can say to a USER, stated by the HOST.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@12-apps/notifications",
-  "version": "4.12.0",
+  "version": "4.14.0",
   "type": "module",
   "sideEffects": false,
   "description": "Plug-and-play notification system (12-15): an always-on in-app inbox, per-user × per-category channel preferences, and email / SMS / WhatsApp / web-push transports behind vendor DRIVERS so a second provider is a config entry. Framework-free core (.), host-mounted backend surface (./server: inbox / preferences / push-subscription endpoints, the channel router with delivery records + retry sweep, the permission fan-out, duck-typed Prisma seam), Hono adapter (./hono), React surface (./react: bell + badge, inbox drawer, preferences screen), VAPID sender (./web-push) and the package-owned Prisma partial + migrations. Standardized adoption contract in ADOPTING.md.",
@@ -71,7 +71,7 @@
     "prisma:sync:check": "node scripts/sync-notifications-schema.mjs --check"
   },
   "dependencies": {
-    "@12-apps/ui": "^6.25.0"
+    "@12-apps/ui": "^6.28.0"
   },
   "peerDependencies": {
     "@12-apps/wiring": ">=1.3.0",

package/prisma/migrations/20260914210000_scope_push_subscriptions_per_store/migration.sql

@@ -0,0 +1,31 @@
+-- @12-apps/notifications: which ORIGIN a browser subscription was
+-- registered on.
+--
+-- A multi-tenant host installs one storefront per store as its own PWA, and a
+-- PWA's identity is its ORIGIN — so two stores are two apps. Without this
+-- column the Web Push transport fans every notification out to every row a user
+-- holds, and store B's push lands inside store A's installed app wearing store
+-- A's icon.
+--
+-- NULL means the PLATFORM origin: the marketplace host itself, or any adopter
+-- that serves one origin and has no per-store apps at all. That is why the
+-- column is nullable and why every EXISTING row reads correctly with no
+-- backfill — an adopter who never had custom domains keeps today's behaviour
+-- exactly, which is what makes this a MINOR release rather than a breaking one.
+--
+-- A by-value scalar with NO foreign key, exactly as `user_id` and
+-- `notifications.client_id` already are here (the payments-backend doctrine at
+-- the top of `notifications.prisma`): this package must not constrain a host's
+-- tenant table, whose name it does not know.
+--
+-- Additive DDL, so no expand/contract ceremony: the previous release reads a
+-- table that has gained a nullable column it never mentions, which is safe.
+ALTER TABLE "push_subscriptions" ADD COLUMN IF NOT EXISTS "client_id" TEXT;
+
+-- Serves the ONE query the send path makes per notification:
+--   user_id = $1 AND ($2 IS NULL OR client_id IS NULL OR client_id = $2)
+-- `user_id` leads because it is the selective half and is on every read; the
+-- existing `push_subscriptions_user_id_idx` stays for the unscoped counts the
+-- settings screen still makes.
+CREATE INDEX IF NOT EXISTS "push_subscriptions_user_id_client_id_idx"
+  ON "push_subscriptions" ("user_id", "client_id");

package/prisma/notifications.prisma

@@ -131,11 +131,23 @@ model PushSubscription {
   endpoint  String   @unique
   p256dh    String
   auth      String
+  /// Which ORIGIN this browser registered on.
+  ///
+  /// NULL is the PLATFORM origin — the host itself, or any adopter serving one
+  /// origin. A subscription stamped with a store receives that store's
+  /// notifications plus platform-wide ones (`clientId IS NULL`) and NEVER
+  /// another store's; a platform-origin subscription receives everything, which
+  /// is what keeps a marketplace host's behaviour identical to before.
+  ///
+  /// Nullable so every pre-existing row reads as "platform" with no backfill.
+  clientId  String?  @map("client_id")
   // Free-form browser/device hint ("Chrome · Linux") for a device list.
   userAgent String?  @map("user_agent")
   createdAt DateTime @default(now()) @map("created_at")
   updatedAt DateTime @updatedAt @map("updated_at")
 
   @@index([userId])
+  // The send path's one query: owner, then the origin rule above.
+  @@index([userId, clientId])
   @@map("push_subscriptions")
 }

package/src/react/create-web-notifications.tsx

@@ -103,7 +103,7 @@ export interface WebNotifications {
    * right now, and `useBellBadge` below is the door. Still the right hook for
    * anything that genuinely wants "how many unread rows".
    */
-  useUnreadCount: (options?: { enabled?: boolean }) => number;
+  useUnreadCount: (options?: BadgeHookOptions) => number;
   /**
    * The badge's NUMBER AND TONE, for a host with its own trigger chrome.
    *
@@ -119,7 +119,7 @@ export interface WebNotifications {
    * hook that bell uses. Without live activities configured it is
    * `useUnreadCount` plus `hasNew: count > 0`.
    */
-  useBellBadge: (options?: { enabled?: boolean }) => BellBadge;
+  useBellBadge: (options?: BadgeHookOptions) => BellBadge;
   /** The shared client state, for host glue. */
   store: InboxStore;
   /** The bound wire client. */
@@ -128,6 +128,16 @@ export interface WebNotifications {
   messages: NotificationMessages;
 }
 
+/**
+ * What a host passes either badge hook: whether to run at all, and — for a host
+ * that holds its own realtime connection — whether that connection is up
+ * (`BadgeSyncOptions.live`).
+ */
+export interface BadgeHookOptions {
+  enabled?: boolean;
+  live?: boolean;
+}
+
 /** What the factory passes both badge hooks: whatever realtime wiring it has. */
 type SubscribeOption = {
   subscribe?: NotificationsSubscribe;

package/src/react/hooks.ts

@@ -53,6 +53,23 @@ export interface BadgeSyncOptions {
   enabled?: boolean;
   subscribe?: NotificationsSubscribe;
   useSignal?: NotificationsSignalHook;
+  /**
+   * The host's own word that its realtime channel is up RIGHT NOW.
+   *
+   * `subscribe` relaxes the poll because a live subscription is implied by its
+   * presence. `useSignal` cannot say the same — a hook handed a callback knows
+   * nothing about whether its connection opened — and neither can a host that
+   * wires the invalidate itself, outside this package, because its connection
+   * is session-scoped and must stay behind `enabled` (which `useSignal` is
+   * called in front of). Such a host had no way to relax the badge at all, and
+   * every signed-in reader polled once a minute on top of a working stream.
+   *
+   * `true` relaxes the poll to {@link BADGE_RECONCILE_MS}, exactly as a
+   * `subscribe` does; anything else keeps {@link BADGE_POLL_MS}. It is a STATUS,
+   * so pass it live — a stream that drops takes the badge straight back to the
+   * fast poll on the next render.
+   */
+  live?: boolean;
 }
 
 /**
@@ -100,6 +117,9 @@ const NOTHING_TO_SHOW: InboxState = {
 export function useBadgeState(store: InboxStore, options: BadgeSyncOptions = {}): InboxState {
   const enabled = options.enabled ?? true;
   const subscribe = options.subscribe;
+  // Pushed to by a subscription this package holds, or by one the host holds
+  // and says is up — see `BadgeSyncOptions.live`.
+  const relaxed = subscribe !== undefined || options.live === true;
   const live = useInboxState(store);
   const state = enabled ? live : NOTHING_TO_SHOW;
 
@@ -113,11 +133,11 @@ export function useBadgeState(store: InboxStore, options: BadgeSyncOptions = {})
     if (!enabled) return;
     store.refreshBadge();
     const unsubscribe = subscribe?.(() => store.invalidate());
-    // A live subscription relaxes the poll to the reconcile interval; without
-    // one it stays the 60 s poll.
+    // A live channel relaxes the poll to the reconcile interval; without one it
+    // stays the 60 s poll.
     const interval = setInterval(
       () => store.refreshBadge(),
-      subscribe ? BADGE_RECONCILE_MS : BADGE_POLL_MS,
+      relaxed ? BADGE_RECONCILE_MS : BADGE_POLL_MS,
     );
     const onFocus = (): void => store.refreshBadge();
     globalThis.addEventListener?.('focus', onFocus);
@@ -126,7 +146,7 @@ export function useBadgeState(store: InboxStore, options: BadgeSyncOptions = {})
       globalThis.removeEventListener?.('focus', onFocus);
       unsubscribe?.();
     };
-  }, [store, enabled, subscribe]);
+  }, [store, enabled, subscribe, relaxed]);
 
   return state;
 }

package/src/react/index.ts

@@ -9,6 +9,7 @@
 
 export {
   createWebNotifications,
+  type BadgeHookOptions,
   type NotificationsWebConfig,
   type WebNotifications,
 } from './create-web-notifications';

package/src/server/context.ts

@@ -22,6 +22,21 @@ import { NOTIFICATION_CHANNELS, type NotificationChannel } from '../types';
  */
 export interface NotificationsActor {
   userId: string;
+  /**
+   * The store whose ORIGIN this request arrived on, resolved by the
+   * HOST from the hostname — never read from the body or the query.
+   *
+   * The paragraph above still holds: this is not a tenant the surface
+   * authorizes against, it is a NARROWING of a read that is already the
+   * caller's own, and it can never widen one. A host with a single origin never
+   * sets it and every endpoint answers exactly what it answered before.
+   *
+   * It exists because a multi-tenant host installs one storefront per store as
+   * its own PWA, and a PWA's identity is its ORIGIN — so an inbox answering a
+   * store's own app with a neighbour's notifications is one store reporting on
+   * another.
+   */
+  scopeClientId?: string;
 }
 
 /** One request, already authenticated and routed by the host. */

package/src/server/db.ts

@@ -54,14 +54,40 @@ export interface NotificationPageAfter {
   id: string;
 }
 
-/** The inbox read filter. `deletedAt: null` is on every read, always. */
-export interface NotificationWhere {
+/**
+ * One BRANCH of an inbox filter — a member of `AND`/`OR`, never a whole read.
+ *
+ * Split out when the store scope arrived, and the split is what keeps `deletedAt: null`
+ * REQUIRED on the read itself (see {@link NotificationWhere}). Widening `OR`
+ * from the old fixed keyset tuple to a general array needed its members to be
+ * valid filters, and the tempting move — relaxing `deletedAt` on the one type —
+ * would have removed the only thing that makes a Prisma-backed host exclude
+ * soft-deleted rows. Both in-package doubles hard-code that filter regardless,
+ * so Prisma is precisely the implementation the requirement was protecting.
+ *
+ * `createdAt` and `id: { lt }` are here because the keyset boundary is built
+ * from them (`../inbox.ts`'s `pageWhere`); without them the branch type cannot
+ * express the very thing the widening exists to preserve.
+ */
+export interface NotificationWhereBranch {
   userId?: string;
-  id?: string | { in: string[] };
-  deletedAt: null;
+  id?: string | { in: string[] } | { lt: string };
+  createdAt?: Date | { lt: Date };
+  deletedAt?: null;
   readAt?: null;
-  /** The keyset half of `(createdAt, id) < (anchor.createdAt, anchor.id)`. */
-  OR?: [{ createdAt: { lt: Date } }, { createdAt: Date; id: { lt: string } }];
+  /** `null` matches the platform-wide rows that travel with every store scope. */
+  clientId?: string | null;
+  OR?: NotificationWhereBranch[];
+  AND?: NotificationWhereBranch[];
+}
+
+/**
+ * The inbox read filter. `deletedAt: null` is on every read, always — and it
+ * stays REQUIRED here, which is the whole reason {@link NotificationWhereBranch}
+ * is a separate type.
+ */
+export interface NotificationWhere extends NotificationWhereBranch {
+  deletedAt: null;
 }
 
 export interface NotificationDelegate {
@@ -180,11 +206,25 @@ export interface PushSubscriptionRow {
   endpoint: string;
   p256dh: string;
   auth: string;
+  /** The origin this browser registered on; `null` = the platform origin. */
+  clientId: string | null;
   userAgent: string | null;
 }
 
+/**
+ * Which of a user's subscriptions one send may reach.
+ *
+ * The disjunction is load-bearing and `clientId: { in: [x, null] }` is NOT a
+ * shortcut for it: SQL `IN` never matches NULL, so the platform-wide rows that
+ * must travel with every store scope would silently vanish.
+ */
+export interface PushSubscriptionWhere {
+  userId: string;
+  OR?: [{ clientId: null }, { clientId: string }];
+}
+
 export interface PushSubscriptionDelegate {
-  count(args: { where: { userId: string } }): Promise<number>;
+  count(args: { where: PushSubscriptionWhere }): Promise<number>;
   /**
    * The row holding one endpoint, whoever owns it. Read BEFORE an upsert so a
    * re-own (the same browser profile, a different signed-in user) is a logged
@@ -192,7 +232,7 @@ export interface PushSubscriptionDelegate {
    * whether THIS browser's subscription is still the caller's.
    */
   findUnique(args: { where: { endpoint: string } }): Promise<PushSubscriptionRow | null>;
-  findMany(args: { where: { userId: string } }): Promise<PushSubscriptionRow[]>;
+  findMany(args: { where: PushSubscriptionWhere }): Promise<PushSubscriptionRow[]>;
   upsert(args: {
     where: { endpoint: string };
     create: {
@@ -200,12 +240,14 @@ export interface PushSubscriptionDelegate {
       endpoint: string;
       p256dh: string;
       auth: string;
+      clientId: string | null;
       userAgent: string | null;
     };
     update: {
       userId: string;
       p256dh: string;
       auth: string;
+      clientId: string | null;
       userAgent: string | null;
     };
   }): Promise<PushSubscriptionRow>;

package/src/server/dispatch.ts

@@ -92,6 +92,7 @@ export interface NotificationDispatchDeps {
 export async function loadRecipient(
   deps: NotificationDispatchDeps,
   userId: string,
+  clientId: string | null,
 ): Promise<TransportRecipient | null> {
   const contact = await deps.contacts.getContact(userId);
   if (!contact) return null;
@@ -103,7 +104,11 @@ export async function loadRecipient(
     // absent case has to stay distinguishable from a stated language, because
     // that is what lets a generator apply its own default in one place.
     ...(contact.locale === undefined ? {} : { locale: contact.locale }),
-    pushSubscriptionCount: await deps.pushSubscriptions.count(userId),
+    clientId,
+    // SCOPED, and this is what keeps `supports()` honest: it gates on this
+    // number, so an unscoped count would enqueue a WEB_PUSH delivery for a
+    // notification no reachable subscription exists for.
+    pushSubscriptionCount: await deps.pushSubscriptions.count(userId, clientId),
   };
 }
 
@@ -223,7 +228,9 @@ export async function dispatchOne(
   });
   if (queued.length === 0) return 0;
 
-  const recipient = await loadRecipient(deps, notification.userId);
+  // The STORED column, so the retry sweep scopes identically to the first
+  // attempt — anything less would let a retry leak what the first send withheld.
+  const recipient = await loadRecipient(deps, notification.userId, notification.clientId);
   if (!recipient) {
     await abandonUnreachable(deps, client, queued, notification.userId);
     return 0;