@pramen/server 0.0.51 → 0.0.53

package/dist/index.d.ts

@@ -12,6 +12,7 @@ export { Kv, denySession, allowSession, isSessionDenied } from "./runtime/kv";
 export type { FileRef, Files, SignUploadOpts, SignDownloadOpts, HeadResult } from "./sdk/files";
 export { R2Adapter, MemoryAdapter, createFiles, handleFileRequest } from "./runtime/storage";
 export { signToken, verifyToken, isUsableSecret, resolveSecret, MIN_TOKEN_SECRET_LEN } from "./runtime/token";
+export { HmacStrategy, JwksStrategy, type VerifyStrategy, type VerifyOptions } from "./auth";
 export type { ExpiringToken } from "./runtime/token";
 export type { StorageAdapter, PutResult, GetResult } from "./runtime/storage";
 export { Mail, CloudflareEmailAdapter, KvMailAdapter, MemoryMailAdapter, UnconfiguredMailAdapter, createMail } from "./runtime/mail";

package/dist/index.js

@@ -21,6 +21,10 @@ export { R2Adapter, MemoryAdapter, createFiles, handleFileRequest } from "./runt
 // page-preview links. Exported so an app (or @pramen/cms) can mint its own capability url
 // without a second signing implementation.
 export { signToken, verifyToken, isUsableSecret, resolveSecret, MIN_TOKEN_SECRET_LEN } from "./runtime/token";
+// Verify strategies live on the AUTHORING entry, not `/worker`: they carry no
+// `cloudflare:workers` import, and @pramen/auth's OIDC flow verifies a provider's RS256 ID
+// token with the same JWKS cache (and its key-rotation handling) the Worker uses.
+export { HmacStrategy, JwksStrategy } from "./auth";
 // --- mail (ctx.mail) ---
 export { Mail, CloudflareEmailAdapter, KvMailAdapter, MemoryMailAdapter, UnconfiguredMailAdapter, createMail } from "./runtime/mail";
 // --- queue (ctx.queue — Cloudflare Queues) ---

package/dist/runtime/driver.d.ts

@@ -83,6 +83,15 @@ export declare class D1Driver implements Driver {
         start?: D1SessionStart;
     });
     exec(sql: string, params: CellValue[]): Promise<DriverRow[]>;
+    /** How many write statements this session has auto-committed.
+     *
+     * There is no rollback here (see the ATOMICITY LIMIT above), so a mutation that throws
+     * midway leaves whatever it had already written. Counting the writes lets the caller say
+     * so out loud instead of surfacing a half-applied mutation as an ordinary 500 — the
+     * difference between "the request failed" and "the request failed and your data is now
+     * in a state no code path intended". */
+    writtenCount(): number;
+    private writes;
     /** The session's latest bookmark (null before any query). Threaded back to the client
      * via the `x-pramen-d1-bookmark` response header so a subsequent request can anchor a
      * fresh session at it and read its own writes. */

package/dist/runtime/driver.js

@@ -59,6 +59,9 @@ export class DoSqliteDriver {
         return this.storage.transaction(fn);
     }
 }
+/** Does this statement mutate? Used only to notice a partial write after a failed
+ * mutation — deliberately coarse: over-reporting a warning is harmless, missing one is not. */
+const WRITE_SQL = /^\s*(insert|update|delete|replace|create|drop|alter)\b/i;
 /** D1 — SQLite over RPC. Async by nature.
  *
  * Read replicas (Sessions API): every D1Driver opens ONE `db.withSession(start)` and
@@ -80,10 +83,23 @@ export class D1Driver {
         this.session = db.withSession(opts?.start ?? "first-unconstrained");
     }
     async exec(sql, params) {
+        if (WRITE_SQL.test(sql))
+            this.writes++;
         const stmt = params.length ? this.session.prepare(sql).bind(...params) : this.session.prepare(sql);
         const { results } = await stmt.all();
         return results ?? [];
     }
+    /** How many write statements this session has auto-committed.
+     *
+     * There is no rollback here (see the ATOMICITY LIMIT above), so a mutation that throws
+     * midway leaves whatever it had already written. Counting the writes lets the caller say
+     * so out loud instead of surfacing a half-applied mutation as an ordinary 500 — the
+     * difference between "the request failed" and "the request failed and your data is now
+     * in a state no code path intended". */
+    writtenCount() {
+        return this.writes;
+    }
+    writes = 0;
     /** The session's latest bookmark (null before any query). Threaded back to the client
      * via the `x-pramen-d1-bookmark` response header so a subsequent request can anchor a
      * fresh session at it and read its own writes. */

package/dist/worker-entry.d.ts

@@ -1,3 +1,3 @@
-export { createPramen, type PramenApp, type PublicRoute, type Env, type DoEnv } from "./pramen";
+export { createPramen, type PramenApp, type PublicRoute, type RouteContext, type Env, type DoEnv } from "./pramen";
 export { makeWorker, callPrivileged } from "./worker";
 export { pramenDO, PramenDOBase } from "./durable-object";

package/dist/worker-entry.js

@@ -3,6 +3,8 @@
 // the main authoring entry: tools that merely load an app.ts to read its schema
 // (the CLI, tests, codegen) import from "@pramen/server" and never drag in the DO
 // runtime. A Worker's entry imports createPramen from here.
+// `RouteContext` stays exported (it predates nothing — @pramen/auth's OIDC routes are
+// typed against it); `WorkerOpts` goes with the reverted basePath.
 export { createPramen } from "./pramen";
 export { makeWorker, callPrivileged } from "./worker";
 export { pramenDO, PramenDOBase } from "./durable-object";

package/dist/worker.d.ts

@@ -60,6 +60,22 @@ export declare function useD1Store(opts: {
     isLive: boolean;
     defaultStore: string | undefined;
 }): boolean;
+/** Should we warn that no Cron trigger seems to be wired?
+ *
+ * The DO store self-drains via an alarm; the D1 store has none, so a DELAYED task — a
+ * scheduled publish, a retry backoff — runs only when a Cron trigger calls
+ * `createPramen().scheduled`. Forgetting that is silent: the row simply never goes live,
+ * and nothing anywhere says why.
+ *
+ * A request-tail drain that leaves something due in the FUTURE is exactly the situation
+ * that depends on the cron, so it is the moment to say so. Once a cron actually fires, the
+ * question is settled and we never warn again. Exported for tests — the decision is pure. */
+export declare function shouldWarnMissingCron(opts: {
+    cronSeen: boolean;
+    warned: boolean;
+    nextRunAt: number | null;
+    now: number;
+}): boolean;
 /** Forward a privileged mutation into a tenant's DO from a public route. The
  * synthetic identity (default `["admin"]`) is trusted because the call originates
  * in the Worker — the same internal mechanism the admin endpoints use. Returns the

package/dist/worker.js

@@ -13,7 +13,7 @@ import { migrate } from "./runtime/migrate";
 import { compileAcl } from "./runtime/acl";
 import { Db } from "./runtime/db";
 import { D1Driver } from "./runtime/driver";
-import { toResponse } from "./runtime/errors";
+import { BadRequest, Forbidden, toResponse } from "./runtime/errors";
 import { Kv, isSessionDenied } from "./runtime/kv";
 import { listDOs, partitionDoName } from "./runtime/registry";
 import { createFiles, handleFileRequest, handleMediaRequest, R2Adapter } from "./runtime/storage";
@@ -43,6 +43,21 @@ export function useD1Store(opts) {
         return false;
     return opts.defaultStore === "d1";
 }
+/** Should we warn that no Cron trigger seems to be wired?
+ *
+ * The DO store self-drains via an alarm; the D1 store has none, so a DELAYED task — a
+ * scheduled publish, a retry backoff — runs only when a Cron trigger calls
+ * `createPramen().scheduled`. Forgetting that is silent: the row simply never goes live,
+ * and nothing anywhere says why.
+ *
+ * A request-tail drain that leaves something due in the FUTURE is exactly the situation
+ * that depends on the cron, so it is the moment to say so. Once a cron actually fires, the
+ * question is settled and we never warn again. Exported for tests — the decision is pure. */
+export function shouldWarnMissingCron(opts) {
+    if (opts.cronSeen || opts.warned)
+        return false;
+    return opts.nextRunAt != null && opts.nextRunAt > opts.now;
+}
 const json = (body, status = 200) => Response.json(body, { status });
 const forbidden = (what) => json({ ok: false, error: `access denied: ${what}`, code: "forbidden" }, 403);
 const badRequest = (msg) => json({ ok: false, error: msg, code: "bad_request" }, 400);
@@ -155,6 +170,47 @@ export function makeWorker(app) {
         }
     };
     let d1Ready;
+    /** Run one handler against the D1 store, in the Worker. The request path and the
+     * PRIVILEGED path (routes, which have no ctx.db) both come through here, so the two
+     * cannot drift on migration, bootstrap, the multi-tenant guard or the outbox drain.
+     *
+     * Returns the `{ ok, result }` envelope rather than a Response so each caller can add
+     * what only it needs — CORS and the session bookmark for a request, nothing for an
+     * internal call. */
+    const dispatchD1 = async (env, ctx, opts) => {
+        if (!env.DB)
+            throw new BadRequest("D1 store is not configured");
+        // Same COMMINGLING GUARD as the request path: shared D1 has no tenant column, so a
+        // non-`main` tenant would mix rows unless the operator opted in explicitly.
+        if (opts.tenant !== "main" && env.PRAMEN_D1_ALLOW_MULTITENANT !== "true") {
+            throw new Forbidden(`D1 store for tenant '${opts.tenant}' (shared D1 has no tenant isolation — set PRAMEN_D1_ALLOW_MULTITENANT=true to allow)`);
+        }
+        const driver = new D1Driver(env.DB, { start: opts.start });
+        const files = createFiles({ tenant: opts.tenant, secret: filesSecret(env), adapter: new R2Adapter(env.FILES) });
+        await ensureD1Migrated(driver, env.PRAMEN_ALLOW_DESTRUCTIVE === "true");
+        let dispatched;
+        try {
+            dispatched = await dispatch(app.handlers, app.schema, driver, new Kv(env.KV), files, envBag(env), { acl: d1Acl, identity: opts.identity, tenant: opts.tenant, store: "d1" }, opts.name, opts.input);
+        }
+        catch (err) {
+            // D1 has no interactive transactions, so `transaction(fn)` runs `fn` as-is and a
+            // mutation that throws midway keeps whatever it already wrote. Say so: a partially
+            // applied mutation looks exactly like an ordinary 500 in the logs, and the difference
+            // — data left in a state no code path intended — is the whole point.
+            const written = driver.writtenCount();
+            if (written > 0) {
+                console.error(`pramen: '${opts.name}' failed on the D1 store AFTER ${written} write statement(s) had committed. ` +
+                    `D1 has no interactive transactions, so this mutation is PARTIALLY APPLIED and will not roll back. ` +
+                    `Use the Durable Object store if this mutation must be atomic.`);
+            }
+            throw err;
+        }
+        const { result, enqueued } = dispatched;
+        // Drain in the request tail so an enqueued task does not wait for the next Cron tick.
+        if (enqueued > 0 && ctx)
+            ctx.waitUntil(drainD1(env));
+        return { driver, result: result };
+    };
     const ensureD1Migrated = (driver, allowDestructive) => {
         if (!d1Ready) {
             d1Ready = migrate(driver, app.schema, { allowDestructive })
@@ -183,14 +239,29 @@ export function makeWorker(app) {
     };
     /** Drain the D1 outbox in the Worker (no DO/alarm on this path) — called by the
      * /admin/tasks/drain route with `x-pramen-store: d1`, and by `scheduled()` (Cron). */
-    const drainD1 = async (env) => {
+    // Whether a Cron trigger has ever driven a drain in this isolate, and whether we have
+    // already said it looks missing. See `shouldWarnMissingCron`.
+    let cronSeen = false;
+    let warnedNoCron = false;
+    const drainD1 = async (env, source = "request") => {
         if (!env.DB)
             throw new Error("D1 store is not configured");
+        if (source === "cron")
+            cronSeen = true;
         // The drain reads due tasks then writes their status — pin the primary so it sees
         // and updates current outbox state (not a lagging replica).
         const driver = new D1Driver(env.DB, { start: "first-primary" });
         await ensureD1Migrated(driver, env.PRAMEN_ALLOW_DESTRUCTIVE === "true");
-        return drainOutbox(driver, bindTasks(app.tasks, d1TaskCtx(driver, env)), Date.now());
+        const result = await drainOutbox(driver, bindTasks(app.tasks, d1TaskCtx(driver, env)), Date.now());
+        if (source === "request" && shouldWarnMissingCron({ cronSeen, warned: warnedNoCron, nextRunAt: result.nextRunAt, now: Date.now() })) {
+            warnedNoCron = true;
+            const inSeconds = Math.round(((result.nextRunAt ?? 0) - Date.now()) / 1000);
+            console.warn(`pramen: a task is queued on the D1 store to run in ~${inSeconds}s, but no Cron trigger has drained this Worker. ` +
+                `The D1 store has no Durable Object alarm, so a DELAYED task (a scheduled publish, a retry) runs ONLY when a Cron ` +
+                `trigger calls createPramen().scheduled. Add \`triggers: { crons: ["* * * * *"] }\` to your Worker config, or drain ` +
+                `manually via POST /admin/tasks/drain. This warning appears once per isolate and stops once a Cron drain is seen.`);
+        }
+        return result;
     };
     const listD1Tasks = async (env, status, limit) => {
         if (!env.DB)
@@ -222,7 +293,35 @@ export function makeWorker(app) {
             // signature-authed webhook can live outside the JWT-gated /rpc surface.
             for (const r of app.routes ?? []) {
                 if (request.method === r.method && url.pathname === r.path) {
-                    const routeCtx = { callPrivileged: (opts) => callPrivileged(env, opts) };
+                    // A public route has no ctx.db, so it reaches a handler through here. On the D1
+                    // store there is no Durable Object to forward to — the engine runs in THIS Worker
+                    // — so dispatch locally instead. Without this, everything built on a pre-auth
+                    // route (a signed preview link, the sitemap) was DO-only, and the CMS had to
+                    // refuse to mint preview links on D1 rather than hand out a dead one.
+                    const routeCtx = {
+                        callPrivileged: async (opts) => {
+                            const store = useD1Store({ storeHeader: request.headers.get("x-pramen-store"), isLive: false, defaultStore: env.PRAMEN_STORE });
+                            if (!store)
+                                return callPrivileged(env, opts);
+                            try {
+                                const { result } = await dispatchD1(env, ctx, {
+                                    name: opts.name,
+                                    input: opts.input ?? null,
+                                    tenant: opts.tenant ?? "main",
+                                    // The same synthetic identity the DO path sends in `x-pramen-identity`.
+                                    identity: { roles: opts.roles ?? ["admin"] },
+                                    // A privileged call may write (a redeemed one-time token), so pin the
+                                    // primary rather than risk a read-modify-write off a lagging replica.
+                                    start: "first-primary",
+                                });
+                                return json({ ok: true, result });
+                            }
+                            catch (err) {
+                                const { status, body } = toResponse(err);
+                                return json(body, status);
+                            }
+                        },
+                    };
                     return r.handler(request, envBag(env), routeCtx);
                 }
             }
@@ -323,7 +422,7 @@ export function makeWorker(app) {
                     return forbidden("tasks");
                 if (request.headers.get("x-pramen-store") === "d1") {
                     try {
-                        return withCors(json({ ok: true, result: await drainD1(env) }), cors);
+                        return withCors(json({ ok: true, result: await drainD1(env, "admin") }), cors);
                     }
                     catch (err) {
                         const { status, body } = toResponse(err);
@@ -420,21 +519,10 @@ export function makeWorker(app) {
                     start = inboundBookmark;
                 else
                     start = "first-unconstrained";
-                const driver = new D1Driver(env.DB, { start });
-                const files = createFiles({ tenant, secret: filesSecret(env), adapter: new R2Adapter(env.FILES) });
-                const bag = envBag(env);
                 try {
-                    await ensureD1Migrated(driver, env.PRAMEN_ALLOW_DESTRUCTIVE === "true");
                     // `tenant` matters here: a handler minting a tenant-scoped capability (a signed
                     // preview link) would otherwise stamp it "main" while reading acme's rows.
-                    const { result, enqueued } = await dispatch(app.handlers, app.schema, driver, new Kv(env.KV), files, bag, { acl: d1Acl, identity, tenant, store: "d1" }, name, input);
-                    // Kick an immediate drain in the request tail when this handler enqueued tasks
-                    // (e.g. sendMagicLinkEmail). Without this, tasks wait for the next Cron trigger
-                    // — up to a full minute. `waitUntil` lets the response return now while the
-                    // drain runs; the Cron trigger remains the safety net for delayed / retried
-                    // tasks that no request happens to coincide with.
-                    if (enqueued > 0)
-                        ctx.waitUntil(drainD1(env));
+                    const { driver, result } = await dispatchD1(env, ctx, { name, input, tenant, identity, start });
                     const res = json({ ok: true, result });
                     // Thread the session's latest bookmark back so the client can read its own writes.
                     const bookmark = driver.getBookmark();
@@ -492,7 +580,7 @@ export function makeWorker(app) {
         // so it needs no cron). Wire a `[triggers] crons` in wrangler/oblaka to call this.
         async scheduled(_event, env) {
             if (env.DB)
-                await drainD1(env);
+                await drainD1(env, "cron");
         },
         // Cloudflare Queues consumer entry: routes a batch to the matching `app.queues`
         // handler (ACK on success / RETRY on throw, per message). A consumer is Worker-level

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pramen/server",
-  "version": "0.0.51",
+  "version": "0.0.53",
   "description": "pramen server runtime \u2014 schema, ACL, ORM, live queries, files, and the createPramen(app) factory for Cloudflare Workers + Durable Objects.",
   "license": "MIT",
   "repository": {

package/src/index.ts

@@ -87,6 +87,10 @@ export { R2Adapter, MemoryAdapter, createFiles, handleFileRequest } from "./runt
 // page-preview links. Exported so an app (or @pramen/cms) can mint its own capability url
 // without a second signing implementation.
 export { signToken, verifyToken, isUsableSecret, resolveSecret, MIN_TOKEN_SECRET_LEN } from "./runtime/token";
+// Verify strategies live on the AUTHORING entry, not `/worker`: they carry no
+// `cloudflare:workers` import, and @pramen/auth's OIDC flow verifies a provider's RS256 ID
+// token with the same JWKS cache (and its key-rotation handling) the Worker uses.
+export { HmacStrategy, JwksStrategy, type VerifyStrategy, type VerifyOptions } from "./auth";
 export type { ExpiringToken } from "./runtime/token";
 export type { StorageAdapter, PutResult, GetResult } from "./runtime/storage";
 

package/src/runtime/driver.ts

@@ -107,6 +107,10 @@ export class DoSqliteDriver implements Driver {
  * A bookmark always wins over a constraint when one is supplied. */
 export type D1SessionStart = "first-primary" | "first-unconstrained" | (string & {});
 
+/** Does this statement mutate? Used only to notice a partial write after a failed
+ * mutation — deliberately coarse: over-reporting a warning is harmless, missing one is not. */
+const WRITE_SQL = /^\s*(insert|update|delete|replace|create|drop|alter)\b/i;
+
 /** D1 — SQLite over RPC. Async by nature.
  *
  * Read replicas (Sessions API): every D1Driver opens ONE `db.withSession(start)` and
@@ -129,11 +133,24 @@ export class D1Driver implements Driver {
   }
 
   async exec(sql: string, params: CellValue[]): Promise<DriverRow[]> {
+    if (WRITE_SQL.test(sql)) this.writes++;
     const stmt = params.length ? this.session.prepare(sql).bind(...params) : this.session.prepare(sql);
     const { results } = await stmt.all<DriverRow>();
     return results ?? [];
   }
 
+  /** How many write statements this session has auto-committed.
+   *
+   * There is no rollback here (see the ATOMICITY LIMIT above), so a mutation that throws
+   * midway leaves whatever it had already written. Counting the writes lets the caller say
+   * so out loud instead of surfacing a half-applied mutation as an ordinary 500 — the
+   * difference between "the request failed" and "the request failed and your data is now
+   * in a state no code path intended". */
+  writtenCount(): number {
+    return this.writes;
+  }
+  private writes = 0;
+
   /** The session's latest bookmark (null before any query). Threaded back to the client
    * via the `x-pramen-d1-bookmark` response header so a subsequent request can anchor a
    * fresh session at it and read its own writes. */

package/src/worker-entry.ts

@@ -4,6 +4,8 @@
 // (the CLI, tests, codegen) import from "@pramen/server" and never drag in the DO
 // runtime. A Worker's entry imports createPramen from here.
 
-export { createPramen, type PramenApp, type PublicRoute, type Env, type DoEnv } from "./pramen";
+// `RouteContext` stays exported (it predates nothing — @pramen/auth's OIDC routes are
+// typed against it); `WorkerOpts` goes with the reverted basePath.
+export { createPramen, type PramenApp, type PublicRoute, type RouteContext, type Env, type DoEnv } from "./pramen";
 export { makeWorker, callPrivileged } from "./worker";
 export { pramenDO, PramenDOBase } from "./durable-object";

package/src/worker.ts

@@ -16,7 +16,7 @@ import { migrate } from "./runtime/migrate";
 import { compileAcl } from "./runtime/acl";
 import { Db } from "./runtime/db";
 import { D1Driver, type D1SessionStart, type Driver } from "./runtime/driver";
-import { toResponse } from "./runtime/errors";
+import { BadRequest, Forbidden, toResponse } from "./runtime/errors";
 import { Kv, isSessionDenied } from "./runtime/kv";
 import { listDOs, partitionDoName } from "./runtime/registry";
 import { createFiles, handleFileRequest, handleMediaRequest, R2Adapter } from "./runtime/storage";
@@ -100,6 +100,21 @@ export function useD1Store(opts: { storeHeader: string | null; isLive: boolean;
   return opts.defaultStore === "d1";
 }
 
+/** Should we warn that no Cron trigger seems to be wired?
+ *
+ * The DO store self-drains via an alarm; the D1 store has none, so a DELAYED task — a
+ * scheduled publish, a retry backoff — runs only when a Cron trigger calls
+ * `createPramen().scheduled`. Forgetting that is silent: the row simply never goes live,
+ * and nothing anywhere says why.
+ *
+ * A request-tail drain that leaves something due in the FUTURE is exactly the situation
+ * that depends on the cron, so it is the moment to say so. Once a cron actually fires, the
+ * question is settled and we never warn again. Exported for tests — the decision is pure. */
+export function shouldWarnMissingCron(opts: { cronSeen: boolean; warned: boolean; nextRunAt: number | null; now: number }): boolean {
+  if (opts.cronSeen || opts.warned) return false;
+  return opts.nextRunAt != null && opts.nextRunAt > opts.now;
+}
+
 const json = (body: unknown, status = 200) => Response.json(body, { status });
 const forbidden = (what: string) => json({ ok: false, error: `access denied: ${what}`, code: "forbidden" }, 403);
 const badRequest = (msg: string) => json({ ok: false, error: msg, code: "bad_request" }, 400);
@@ -220,6 +235,61 @@ export function makeWorker(app: PramenApp) {
   };
 
   let d1Ready: Promise<void> | undefined;
+  /** Run one handler against the D1 store, in the Worker. The request path and the
+   * PRIVILEGED path (routes, which have no ctx.db) both come through here, so the two
+   * cannot drift on migration, bootstrap, the multi-tenant guard or the outbox drain.
+   *
+   * Returns the `{ ok, result }` envelope rather than a Response so each caller can add
+   * what only it needs — CORS and the session bookmark for a request, nothing for an
+   * internal call. */
+  const dispatchD1 = async (
+    env: Env,
+    ctx: ExecutionContext | undefined,
+    opts: { name: string; input: JsonValue; tenant: string; identity: Identity | null; start: D1SessionStart },
+  ): Promise<{ driver: D1Driver; result: JsonValue }> => {
+    if (!env.DB) throw new BadRequest("D1 store is not configured");
+    // Same COMMINGLING GUARD as the request path: shared D1 has no tenant column, so a
+    // non-`main` tenant would mix rows unless the operator opted in explicitly.
+    if (opts.tenant !== "main" && env.PRAMEN_D1_ALLOW_MULTITENANT !== "true") {
+      throw new Forbidden(`D1 store for tenant '${opts.tenant}' (shared D1 has no tenant isolation — set PRAMEN_D1_ALLOW_MULTITENANT=true to allow)`);
+    }
+    const driver = new D1Driver(env.DB, { start: opts.start });
+    const files = createFiles({ tenant: opts.tenant, secret: filesSecret(env), adapter: new R2Adapter(env.FILES) });
+    await ensureD1Migrated(driver, env.PRAMEN_ALLOW_DESTRUCTIVE === "true");
+    let dispatched;
+    try {
+      dispatched = await dispatch(
+        app.handlers,
+        app.schema,
+        driver,
+        new Kv(env.KV),
+        files,
+        envBag(env),
+        { acl: d1Acl, identity: opts.identity, tenant: opts.tenant, store: "d1" },
+        opts.name,
+        opts.input,
+      );
+    } catch (err) {
+      // D1 has no interactive transactions, so `transaction(fn)` runs `fn` as-is and a
+      // mutation that throws midway keeps whatever it already wrote. Say so: a partially
+      // applied mutation looks exactly like an ordinary 500 in the logs, and the difference
+      // — data left in a state no code path intended — is the whole point.
+      const written = driver.writtenCount();
+      if (written > 0) {
+        console.error(
+          `pramen: '${opts.name}' failed on the D1 store AFTER ${written} write statement(s) had committed. ` +
+            `D1 has no interactive transactions, so this mutation is PARTIALLY APPLIED and will not roll back. ` +
+            `Use the Durable Object store if this mutation must be atomic.`,
+        );
+      }
+      throw err;
+    }
+    const { result, enqueued } = dispatched;
+    // Drain in the request tail so an enqueued task does not wait for the next Cron tick.
+    if (enqueued > 0 && ctx) ctx.waitUntil(drainD1(env));
+    return { driver, result: result as JsonValue };
+  };
+
   const ensureD1Migrated = (driver: Driver, allowDestructive: boolean): Promise<void> => {
     if (!d1Ready) {
       d1Ready = migrate(driver, app.schema, { allowDestructive })
@@ -250,13 +320,30 @@ export function makeWorker(app: PramenApp) {
 
   /** Drain the D1 outbox in the Worker (no DO/alarm on this path) — called by the
    * /admin/tasks/drain route with `x-pramen-store: d1`, and by `scheduled()` (Cron). */
-  const drainD1 = async (env: Env): Promise<unknown> => {
+  // Whether a Cron trigger has ever driven a drain in this isolate, and whether we have
+  // already said it looks missing. See `shouldWarnMissingCron`.
+  let cronSeen = false;
+  let warnedNoCron = false;
+
+  const drainD1 = async (env: Env, source: "request" | "cron" | "admin" = "request"): Promise<unknown> => {
     if (!env.DB) throw new Error("D1 store is not configured");
+    if (source === "cron") cronSeen = true;
     // The drain reads due tasks then writes their status — pin the primary so it sees
     // and updates current outbox state (not a lagging replica).
     const driver = new D1Driver(env.DB, { start: "first-primary" });
     await ensureD1Migrated(driver, env.PRAMEN_ALLOW_DESTRUCTIVE === "true");
-    return drainOutbox(driver, bindTasks(app.tasks, d1TaskCtx(driver, env)), Date.now());
+    const result = await drainOutbox(driver, bindTasks(app.tasks, d1TaskCtx(driver, env)), Date.now());
+    if (source === "request" && shouldWarnMissingCron({ cronSeen, warned: warnedNoCron, nextRunAt: result.nextRunAt, now: Date.now() })) {
+      warnedNoCron = true;
+      const inSeconds = Math.round(((result.nextRunAt ?? 0) - Date.now()) / 1000);
+      console.warn(
+        `pramen: a task is queued on the D1 store to run in ~${inSeconds}s, but no Cron trigger has drained this Worker. ` +
+          `The D1 store has no Durable Object alarm, so a DELAYED task (a scheduled publish, a retry) runs ONLY when a Cron ` +
+          `trigger calls createPramen().scheduled. Add \`triggers: { crons: ["* * * * *"] }\` to your Worker config, or drain ` +
+          `manually via POST /admin/tasks/drain. This warning appears once per isolate and stops once a Cron drain is seen.`,
+      );
+    }
+    return result;
   };
 
   const listD1Tasks = async (env: Env, status?: string, limit?: number): Promise<unknown> => {
@@ -290,7 +377,33 @@ export function makeWorker(app: PramenApp) {
     // signature-authed webhook can live outside the JWT-gated /rpc surface.
     for (const r of app.routes ?? []) {
       if (request.method === r.method && url.pathname === r.path) {
-        const routeCtx = { callPrivileged: (opts: Parameters<typeof callPrivileged>[1]) => callPrivileged(env, opts) };
+        // A public route has no ctx.db, so it reaches a handler through here. On the D1
+        // store there is no Durable Object to forward to — the engine runs in THIS Worker
+        // — so dispatch locally instead. Without this, everything built on a pre-auth
+        // route (a signed preview link, the sitemap) was DO-only, and the CMS had to
+        // refuse to mint preview links on D1 rather than hand out a dead one.
+        const routeCtx = {
+          callPrivileged: async (opts: Parameters<typeof callPrivileged>[1]): Promise<Response> => {
+            const store = useD1Store({ storeHeader: request.headers.get("x-pramen-store"), isLive: false, defaultStore: env.PRAMEN_STORE });
+            if (!store) return callPrivileged(env, opts);
+            try {
+              const { result } = await dispatchD1(env, ctx, {
+                name: opts.name,
+                input: opts.input ?? null,
+                tenant: opts.tenant ?? "main",
+                // The same synthetic identity the DO path sends in `x-pramen-identity`.
+                identity: { roles: opts.roles ?? ["admin"] },
+                // A privileged call may write (a redeemed one-time token), so pin the
+                // primary rather than risk a read-modify-write off a lagging replica.
+                start: "first-primary",
+              });
+              return json({ ok: true, result });
+            } catch (err) {
+              const { status, body } = toResponse(err);
+              return json(body, status);
+            }
+          },
+        };
         return r.handler(request, envBag(env), routeCtx);
       }
     }
@@ -395,7 +508,7 @@ export function makeWorker(app: PramenApp) {
       if (!isAdmin(identity)) return forbidden("tasks");
       if (request.headers.get("x-pramen-store") === "d1") {
         try {
-          return withCors(json({ ok: true, result: await drainD1(env) }), cors);
+          return withCors(json({ ok: true, result: await drainD1(env, "admin") }), cors);
         } catch (err) {
           const { status, body } = toResponse(err);
           return withCors(json(body, status), cors);
@@ -498,20 +611,10 @@ export function makeWorker(app: PramenApp) {
       else if (inboundBookmark) start = inboundBookmark;
       else start = "first-unconstrained";
 
-      const driver = new D1Driver(env.DB, { start });
-      const files = createFiles({ tenant, secret: filesSecret(env), adapter: new R2Adapter(env.FILES) });
-      const bag = envBag(env);
       try {
-        await ensureD1Migrated(driver, env.PRAMEN_ALLOW_DESTRUCTIVE === "true");
         // `tenant` matters here: a handler minting a tenant-scoped capability (a signed
         // preview link) would otherwise stamp it "main" while reading acme's rows.
-        const { result, enqueued } = await dispatch(app.handlers, app.schema, driver, new Kv(env.KV), files, bag, { acl: d1Acl, identity, tenant, store: "d1" }, name, input);
-        // Kick an immediate drain in the request tail when this handler enqueued tasks
-        // (e.g. sendMagicLinkEmail). Without this, tasks wait for the next Cron trigger
-        // — up to a full minute. `waitUntil` lets the response return now while the
-        // drain runs; the Cron trigger remains the safety net for delayed / retried
-        // tasks that no request happens to coincide with.
-        if (enqueued > 0) ctx.waitUntil(drainD1(env));
+        const { driver, result } = await dispatchD1(env, ctx, { name, input, tenant, identity, start });
         const res = json({ ok: true, result });
         // Thread the session's latest bookmark back so the client can read its own writes.
         const bookmark = driver.getBookmark();
@@ -573,7 +676,7 @@ export function makeWorker(app: PramenApp) {
     // Cron Trigger entry: drains the D1 outbox (the DO path self-drains via an alarm,
     // so it needs no cron). Wire a `[triggers] crons` in wrangler/oblaka to call this.
     async scheduled(_event: unknown, env: Env): Promise<void> {
-      if (env.DB) await drainD1(env);
+      if (env.DB) await drainD1(env, "cron");
     },
 
     // Cloudflare Queues consumer entry: routes a batch to the matching `app.queues`