@protobase/server 0.45.16 → 0.45.18

package/dist/notifications/history.d.ts

@@ -0,0 +1,34 @@
+import { JsonObject } from "./json-value.js";
+//#region src/notifications/history.d.ts
+/**
+ * A notification as the history keeps it for its user's inbox: what a panel shows of it. `title` and `body` are plain
+ * text; `url` is where it leads; `data` is the app's own JSON.
+ */
+export type NewNotification = {
+  title: string;
+  body: string | null;
+  url: string | null;
+  data: JsonObject | null;
+};
+/** A kept notification: whose it is, its id, when it was recorded and when its user read it, `null` while unread. */
+export type StoredNotification = NewNotification & {
+  id: string;
+  userId: string;
+  createdAt: Date;
+  readAt: Date | null;
+};
+/** Where a page of the history ends: the last entry's creation time and id. The next page starts after it. */
+export type HistoryPosition = {
+  createdAt: Date;
+  id: string;
+};
+/** What an entry id looks like in every history store: it goes into a path, so no `/`, `.`, `?`, `#` or `%`. */
+export declare const historyIdPattern: RegExp;
+/** The longest title, body and url, as a push message takes them, and the most bytes of `data` as JSON. */
+export declare const historyLimits: {
+  readonly title: 256;
+  readonly body: 2048;
+  readonly url: 2048;
+  readonly dataBytes: 4096;
+};
+//#endregion

package/dist/notifications/history.js

@@ -0,0 +1,41 @@
+import { isJsonObject, jsonProblem } from "./json-value.js";
+//#region src/notifications/history.ts
+/** What an entry id looks like in every history store: it goes into a path, so no `/`, `.`, `?`, `#` or `%`. */
+const historyIdPattern = /^[A-Za-z0-9_-]{1,64}$/;
+/** The longest title, body and url, as a push message takes them, and the most bytes of `data` as JSON. */
+const historyLimits = {
+	title: 256,
+	body: 2048,
+	url: 2048,
+	dataBytes: 4096
+};
+const noControls = /^[^\u0000-\u001f\u007f]*$/;
+const noControlsButLines = /^[^\u0000-\u0008\u000b-\u001f\u007f]*$/;
+const text = (value, max, pattern) => typeof value === "string" && value.length <= max && pattern.test(value);
+const notificationProblem = (notification) => {
+	if (typeof notification !== "object" || notification === null) return "notification";
+	if (!text(notification.title, historyLimits.title, noControls) || notification.title === "") return "title";
+	if (notification.body !== null && !text(notification.body, historyLimits.body, noControlsButLines)) return "body";
+	if (notification.url !== null && !text(notification.url, historyLimits.url, noControls)) return "url";
+	if (notification.data === null) return void 0;
+	if (!isJsonObject(notification.data) || jsonProblem(notification.data, "") !== void 0) return "data";
+	if (Buffer.byteLength(JSON.stringify(notification.data)) > historyLimits.dataBytes) return "data";
+};
+/**
+* The notification as a new object with its four fields alone, or an error naming the first field at fault, never its
+* value: a title of 1 to 256 characters, a body and a url of at most 2048, without control characters, and `data`
+* plain JSON of at most 4096 bytes. Every history store records only what this accepts.
+*/
+const checkedNotification = (notification) => {
+	const problem = notificationProblem(notification);
+	if (problem !== void 0) throw new Error(`The history cannot keep this notification: its ${problem} is invalid`);
+	const { title, body, url, data } = notification;
+	return {
+		title,
+		body,
+		url,
+		data: data === null ? null : structuredClone(data)
+	};
+};
+//#endregion
+export { checkedNotification, historyIdPattern, historyLimits };

package/dist/notifications/json-value.d.ts

@@ -0,0 +1,8 @@
+//#region src/notifications/json-value.d.ts
+export type JsonValue = string | number | boolean | null | JsonValue[] | {
+  [key: string]: JsonValue;
+};
+export type JsonObject = {
+  [key: string]: JsonValue;
+};
+//#endregion

package/dist/notifications/json-value.js

@@ -0,0 +1,54 @@
+//#region src/notifications/json-value.ts
+const forbiddenKeys = /* @__PURE__ */ new Set([
+	"__proto__",
+	"constructor",
+	"prototype"
+]);
+const maxDepth = 16;
+const isPlainObject = (value) => {
+	const prototype = Object.getPrototypeOf(value);
+	return prototype === Object.prototype || prototype === null;
+};
+/**
+* The path of the first part of `value` that is not plain JSON, or `undefined` when all of it is: plain objects,
+* arrays, strings, finite numbers, booleans and null, at most 16 levels deep, without a `__proto__`, `constructor` or
+* `prototype` key at any depth.
+*/
+const jsonProblem = (value, path, depth = 0) => {
+	if (depth > maxDepth) return path;
+	if (value === null || typeof value === "string" || typeof value === "boolean") return void 0;
+	if (typeof value === "number") return Number.isFinite(value) ? void 0 : path;
+	if (typeof value !== "object") return path;
+	if (Array.isArray(value)) {
+		for (const [index, item] of value.entries()) {
+			const problem = jsonProblem(item, `${path}.${index}`, depth + 1);
+			if (problem !== void 0) return problem;
+		}
+		return;
+	}
+	if (!isPlainObject(value)) return path;
+	for (const key of Reflect.ownKeys(value)) {
+		if (typeof key !== "string" || forbiddenKeys.has(key)) return `${path}.${String(key)}`;
+		const descriptor = Object.getOwnPropertyDescriptor(value, key);
+		if (!("value" in descriptor)) return `${path}.${key}`;
+		const problem = jsonProblem(descriptor.value, `${path}.${key}`, depth + 1);
+		if (problem !== void 0) return problem;
+	}
+};
+/** Whether `value` is a plain JSON object, as `jsonProblem` checks it. */
+const isJsonObject = (value) => typeof value === "object" && value !== null && !Array.isArray(value) && isPlainObject(value);
+/**
+* `over` merged into `base`, objects key by key and anything else replaced, as new objects: neither is changed and no
+* key is assigned onto an object with a prototype. Both are plain JSON, as `jsonProblem` checks.
+*/
+const mergeJson = (base, over) => {
+	const merged = Object.create(null);
+	for (const [key, value] of Object.entries(base)) merged[key] = value;
+	for (const [key, value] of Object.entries(over)) {
+		const under = merged[key];
+		merged[key] = isJsonObject(under) && isJsonObject(value) ? mergeJson(under, value) : value;
+	}
+	return structuredClone({ ...merged });
+};
+//#endregion
+export { isJsonObject, jsonProblem, mergeJson };

package/dist/notifications/message.d.ts

@@ -0,0 +1,52 @@
+import { JsonObject } from "./json-value.js";
+//#region src/notifications/message.d.ts
+/** How soon a push service delivers a message, as Web Push names it (RFC 8030); the other senders map it to theirs. */
+export declare const urgencies: readonly ["very-low", "low", "normal", "high"];
+export type Urgency = (typeof urgencies)[number];
+/** The longest a push service keeps an undelivered message: 28 days, the most any of them keeps one. */
+export declare const maxTtlSeconds = 2419200;
+/**
+ * What `platform.web` may set beside the common message: the Web Push headers (RFC 8030's TTL, Urgency and Topic) and
+ * fields merged into the JSON payload the browser's service worker reads. Nothing else, such as the endpoint or a
+ * header of the sender's own.
+ */
+export type WebPushFields = {
+  ttl?: number;
+  urgency?: Urgency;
+  topic?: string;
+  payload?: JsonObject;
+};
+/**
+ * A notification as every sender takes it, plain data: `url` is opened on tap (an absolute `http` or `https` URL),
+ * `tag` replaces an earlier notification with the same tag, `ttl` is how long in seconds a push service keeps it for a
+ * device that is offline, and `platform` holds each protocol's own fields, merged into its request.
+ */
+export type PushMessage = {
+  title: string;
+  body?: string;
+  url?: string;
+  data?: JsonObject;
+  badge?: number;
+  sound?: string;
+  tag?: string;
+  ttl?: number;
+  urgency?: Urgency;
+  platform?: {
+    web?: WebPushFields;
+    apns?: JsonObject;
+    fcm?: JsonObject;
+  };
+};
+/** A message that is not one `pushMessage` accepts: `field` names the part at fault, never its value. */
+export declare class PushMessageError extends Error {
+  readonly field: string;
+  constructor(field: string);
+}
+/**
+ * The message, checked and as a new object, or a `PushMessageError` naming the first field at fault: every field
+ * within its format, only plain JSON in the free-form ones, and a `url` that is an absolute `http` or `https` URL,
+ * written as the WHATWG parser writes it. Senders check what they are given the same way, since a message is plain
+ * data and need not come from here.
+ */
+export declare const pushMessage: (input: PushMessage) => PushMessage;
+//#endregion

package/dist/notifications/message.js

@@ -0,0 +1,74 @@
+import { jsonProblem } from "./json-value.js";
+import { tapUrl } from "./tap-url.js";
+import { z } from "zod";
+//#region src/notifications/message.ts
+/** How soon a push service delivers a message, as Web Push names it (RFC 8030); the other senders map it to theirs. */
+const urgencies = [
+	"very-low",
+	"low",
+	"normal",
+	"high"
+];
+/** The longest a push service keeps an undelivered message: 28 days, the most any of them keeps one. */
+const maxTtlSeconds = 2419200;
+/** A message that is not one `pushMessage` accepts: `field` names the part at fault, never its value. */
+var PushMessageError = class extends Error {
+	field;
+	constructor(field) {
+		super(`The notification is invalid: ${field}`);
+		this.field = field;
+	}
+};
+const noControls = /^[^\u0000-\u001f\u007f]*$/;
+const noControlsButLines = /^[^\u0000-\u0008\u000b-\u001f\u007f]*$/;
+const topic = z.string().regex(/^[A-Za-z0-9_-]{1,32}$/);
+const ttl = z.number().int().min(0).max(maxTtlSeconds);
+const urgency = z.enum(urgencies);
+const json = z.custom((value) => typeof value === "object" && value !== null && !Array.isArray(value));
+const web = z.strictObject({
+	ttl: ttl.optional(),
+	urgency: urgency.optional(),
+	topic: topic.optional(),
+	payload: json.optional()
+});
+const message = z.strictObject({
+	title: z.string().min(1).max(256).regex(noControls),
+	body: z.string().max(2048).regex(noControlsButLines).optional(),
+	url: z.string().optional(),
+	data: json.optional(),
+	badge: z.number().int().min(0).max(1e6).optional(),
+	sound: z.string().min(1).max(256).regex(noControls).optional(),
+	tag: topic.optional(),
+	ttl: ttl.optional(),
+	urgency: urgency.optional(),
+	platform: z.strictObject({
+		web: web.optional(),
+		apns: json.optional(),
+		fcm: json.optional()
+	}).optional()
+});
+const issueField = (issue) => {
+	return (issue.code === "unrecognized_keys" ? [...issue.path, issue.keys[0]] : issue.path).join(".") || "message";
+};
+/**
+* The message, checked and as a new object, or a `PushMessageError` naming the first field at fault: every field
+* within its format, only plain JSON in the free-form ones, and a `url` that is an absolute `http` or `https` URL,
+* written as the WHATWG parser writes it. Senders check what they are given the same way, since a message is plain
+* data and need not come from here.
+*/
+const pushMessage = (input) => {
+	const problem = jsonProblem(input, "");
+	if (problem !== void 0) throw new PushMessageError(problem.slice(1) || "message");
+	const parsed = message.safeParse(input);
+	if (!parsed.success) throw new PushMessageError(issueField(parsed.error.issues[0]));
+	const checked = structuredClone(parsed.data);
+	if (checked.url === void 0) return checked;
+	const url = tapUrl(checked.url);
+	if (url === void 0) throw new PushMessageError("url");
+	return {
+		...checked,
+		url
+	};
+};
+//#endregion
+export { PushMessageError, maxTtlSeconds, pushMessage, urgencies };

package/dist/notifications/options.d.ts

@@ -1,8 +1,13 @@
 import { DeviceStore } from "./device-store.js";
+import { HistoryStore } from "./history-store.js";
+import { PushSender } from "./sender.js";
 //#region src/notifications/options.d.ts
 /** The columns of the devices table, by the name Protobase gives them. */
 export declare const deviceColumns: readonly ["id", "user_id", "kind", "token", "p256dh", "auth", "environment", "app_id", "user_agent", "created_at", "last_seen_at"];
 export type DeviceColumn = (typeof deviceColumns)[number];
+/** The columns of the history table, by the name Protobase gives them. */
+export declare const historyColumns: readonly ["id", "user_id", "title", "body", "url", "data", "created_at", "read_at"];
+export type HistoryColumn = (typeof historyColumns)[number];
 /** Notifications, turned on with `extends: [notifications()]`. */
 export type NotificationsOptions = {
   /** The bell in the top bar; default true. `false` keeps only the backend. */
@@ -16,5 +21,17 @@ export type NotificationsOptions = {
   };
   /** Keeps the devices somewhere else than the devices table, which is then not needed. */
   store?: DeviceStore;
+  /** The history table: its name, default `history`, and its columns named otherwise than Protobase names them. */
+  history?: {
+    table?: string;
+    columns?: Partial<Record<HistoryColumn, string>>;
+  };
+  /** Keeps each user's notification history somewhere else than the history table, which is then not needed. */
+  historyStore?: HistoryStore;
+  /**
+   * Deliver notifications in place of the built-in senders, such as senders from a package; at most one for each kind
+   * of device. By default the built-in ones whose environment is set: Web Push with the `PROTOBASE_VAPID_*` variables.
+   */
+  senders?: PushSender[];
 };
 //#endregion

package/dist/notifications/options.js

@@ -1,4 +1,6 @@
 import { checkDeviceStore } from "./device-store.js";
+import { checkHistoryStore } from "./history-store.js";
+import { checkSenders } from "./sender.js";
 //#region src/notifications/options.ts
 /** The columns of the devices table, by the name Protobase gives them. */
 const deviceColumns = [
@@ -14,30 +16,49 @@ const deviceColumns = [
 	"created_at",
 	"last_seen_at"
 ];
+/** The columns of the history table, by the name Protobase gives them. */
+const historyColumns = [
+	"id",
+	"user_id",
+	"title",
+	"body",
+	"url",
+	"data",
+	"created_at",
+	"read_at"
+];
 const namePattern = /^[a-z_][a-z0-9_]*$/;
 const maxNameBytes = 63;
 const checkedName = (option, name) => {
 	if (typeof name !== "string" || !namePattern.test(name) || Buffer.byteLength(name) > maxNameBytes) throw new Error(`notifications ${option} is not a valid name: use lowercase letters, digits and "_", at most ${maxNameBytes} characters`);
 	return name;
 };
-/** The built-in tables' names, checked: a bad or unknown name is an error naming its option. */
-const notificationsNames = (options = {}) => {
-	const given = options.devices?.columns ?? {};
-	const unknown = Object.keys(given).find((name) => !deviceColumns.includes(name));
-	if (unknown !== void 0) throw new Error(`notifications devices.columns names "${unknown}", which is not a column of the devices table: ${deviceColumns.join(", ")}`);
-	const columns = Object.fromEntries(deviceColumns.map((column) => [column, checkedName(`devices.columns.${column}`, given[column] ?? column)]));
-	return {
-		schema: checkedName("schema", options.schema ?? "notifications"),
-		table: checkedName("devices.table", options.devices?.table ?? "devices"),
-		columns
-	};
+const columnNames = (table, all, given = {}) => {
+	const unknown = Object.keys(given).find((name) => !all.includes(name));
+	if (unknown !== void 0) throw new Error(`notifications ${table}.columns names "${unknown}", which is not a column of the ${table} table: ${all.join(", ")}`);
+	return Object.fromEntries(all.map((column) => [column, checkedName(`${table}.columns.${column}`, given[column] ?? column)]));
 };
-/** The options, checked as `notifications()` takes them: the names, and a given store's methods. */
+/** The devices table's names, checked: a bad or unknown name is an error naming its option. */
+const notificationsNames = (options = {}) => ({
+	schema: checkedName("schema", options.schema ?? "notifications"),
+	table: checkedName("devices.table", options.devices?.table ?? "devices"),
+	columns: columnNames("devices", deviceColumns, options.devices?.columns)
+});
+/** The history table's names, checked as the devices table's are. */
+const historyNames = (options = {}) => ({
+	schema: checkedName("schema", options.schema ?? "notifications"),
+	table: checkedName("history.table", options.history?.table ?? "history"),
+	columns: columnNames("history", historyColumns, options.history?.columns)
+});
+/** The options, checked as `notifications()` takes them: the names, given stores' methods and the senders given. */
 const checkNotificationsOptions = (options) => {
 	if (options.ui !== void 0 && typeof options.ui !== "boolean") throw new Error("notifications ui is true or false");
 	notificationsNames(options);
+	historyNames(options);
 	if (options.store !== void 0) checkDeviceStore(options.store);
+	if (options.historyStore !== void 0) checkHistoryStore(options.historyStore);
+	if (options.senders !== void 0) checkSenders(options.senders);
 	return options;
 };
 //#endregion
-export { checkNotificationsOptions, deviceColumns, notificationsNames };
+export { checkNotificationsOptions, deviceColumns, historyColumns, historyNames, notificationsNames };

package/dist/notifications/paths.d.ts

@@ -3,4 +3,14 @@
 export declare const deviceIdParam = "id";
 /** The path of the caller's devices under the API's system path (`/api`), or of one of them by its id. */
 export declare const devicesPath: (systemPath: string, id?: string) => string;
+/** The name of the entry id in the path that marks one entry of the history read. */
+export declare const historyIdParam = "id";
+/**
+ * The path of the caller's notification history under the API's system path (`/api`): the list itself, `unread` its
+ * unread count, `read` marking all read, or `{ read: id }` marking one entry read. An id that could leave the history's
+ * path, any but letters, digits, `_` and `-`, is refused.
+ */
+export declare const historyPath: (systemPath: string, part?: "unread" | "read" | {
+  read: string;
+}) => string;
 //#endregion

package/dist/notifications/paths.js

@@ -1,7 +1,22 @@
+import { historyIdPattern } from "./history.js";
 //#region src/notifications/paths.ts
 /** The name of the device id in a device's path. */
 const deviceIdParam = "id";
 /** The path of the caller's devices under the API's system path (`/api`), or of one of them by its id. */
 const devicesPath = (systemPath, id) => `${systemPath}/notifications/devices${id === void 0 ? "" : `/${encodeURIComponent(id)}`}`;
+/** The name of the entry id in the path that marks one entry of the history read. */
+const historyIdParam = "id";
+/**
+* The path of the caller's notification history under the API's system path (`/api`): the list itself, `unread` its
+* unread count, `read` marking all read, or `{ read: id }` marking one entry read. An id that could leave the history's
+* path, any but letters, digits, `_` and `-`, is refused.
+*/
+const historyPath = (systemPath, part) => {
+	const base = `${systemPath}/notifications/history`;
+	if (part === void 0) return base;
+	if (typeof part === "string") return `${base}/${part}`;
+	if (!historyIdPattern.test(part.read)) throw new Error("A history entry id is letters, digits, \"_\" and \"-\" only");
+	return `${base}/${part.read}/read`;
+};
 //#endregion
-export { deviceIdParam, devicesPath };
+export { deviceIdParam, devicesPath, historyIdParam, historyPath };

package/dist/notifications/plugin.d.ts

@@ -4,7 +4,10 @@ import { ProjectConfig } from "../project-config.js";
 /**
  * Notifications: `extends: [notifications()]` in `protobase.config.ts`. It keeps each user's devices, in the
  * `notifications.devices` table that `protobase migration` writes or in the `store` given, and serves the endpoints
- * through which a signed-in user registers and removes their own (`devicesPath`).
+ * through which a signed-in user registers and removes their own (`devicesPath`). It keeps each user's inbox
+ * notifications in the `notifications.history` table or the `historyStore` given, and serves the endpoints through which
+ * a signed-in user lists theirs and marks them read (`historyPath`). It delivers through `senders`, by default the
+ * built-in ones whose environment is set (see `notificationSenders`).
  */
 export declare const notifications: (options?: NotificationsOptions) => ProjectConfig;
 //#endregion

package/dist/notifications/plugin.js

@@ -3,7 +3,10 @@ import { checkNotificationsOptions } from "./options.js";
 /**
 * Notifications: `extends: [notifications()]` in `protobase.config.ts`. It keeps each user's devices, in the
 * `notifications.devices` table that `protobase migration` writes or in the `store` given, and serves the endpoints
-* through which a signed-in user registers and removes their own (`devicesPath`).
+* through which a signed-in user registers and removes their own (`devicesPath`). It keeps each user's inbox
+* notifications in the `notifications.history` table or the `historyStore` given, and serves the endpoints through which
+* a signed-in user lists theirs and marks them read (`historyPath`). It delivers through `senders`, by default the
+* built-in ones whose environment is set (see `notificationSenders`).
 */
 const notifications = (options = {}) => ({
 	name: "protobase-notifications",

package/dist/notifications/postgres-history-store.d.ts

@@ -0,0 +1,15 @@
+import { HistoryStore } from "./history-store.js";
+import { NotificationsOptions } from "./options.js";
+import { Db } from "@protobase/query";
+//#region src/notifications/postgres-history-store.d.ts
+/**
+ * A database error of the history store, holding its SQLSTATE alone: the driver's own carries the failing row in its
+ * detail, which must never reach a log.
+ */
+export declare class HistoryStoreError extends Error {
+  readonly sqlState: string;
+  constructor(sqlState: string);
+}
+/** The default history store: the history table `protobase migration` writes, under the names the options give. */
+export declare const postgresHistoryStore: (db: Db, options?: NotificationsOptions) => HistoryStore;
+//#endregion

package/dist/notifications/postgres-history-store.js

@@ -0,0 +1,91 @@
+import { isDatabaseError } from "../error-handler.js";
+import { requiredPage, requiredText, requiredTime } from "./history-store.js";
+import { historyColumns, historyNames } from "./options.js";
+import { checkedNotification } from "./history.js";
+import { sql } from "kysely";
+//#region src/notifications/postgres-history-store.ts
+/**
+* A database error of the history store, holding its SQLSTATE alone: the driver's own carries the failing row in its
+* detail, which must never reach a log.
+*/
+var HistoryStoreError = class extends Error {
+	sqlState;
+	constructor(sqlState) {
+		super(`The history store's query failed (SQLSTATE ${sqlState})`);
+		this.sqlState = sqlState;
+	}
+};
+const uuidPattern = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+const entryOf = (row) => ({
+	id: String(row.id),
+	userId: String(row.user_id),
+	title: row.title,
+	body: row.body,
+	url: row.url,
+	data: row.data,
+	createdAt: new Date(row.created_at),
+	readAt: row.read_at === null ? null : new Date(row.read_at)
+});
+/** The default history store: the history table `protobase migration` writes, under the names the options give. */
+const postgresHistoryStore = (db, options = {}) => {
+	const { schema, table, columns } = historyNames(options);
+	const history = sql.id(schema, table);
+	const column = (name) => sql.id(columns[name]);
+	const selected = sql.join(historyColumns.map((name) => sql`${column(name)} as ${sql.id(name)}`));
+	const execute = (query) => query.execute(db).catch((error) => {
+		if (isDatabaseError(error)) throw new HistoryStoreError(error.code);
+		throw error;
+	});
+	const rows = async (query) => (await execute(query)).rows.map(entryOf);
+	const unread = (userId) => sql`${column("user_id")} = ${userId} and ${column("read_at")} is null`;
+	return {
+		record: async (userId, notification) => {
+			requiredText("user id", userId);
+			const { title, body, url, data } = checkedNotification(notification);
+			const values = {
+				id: crypto.randomUUID(),
+				user_id: userId,
+				title,
+				body,
+				url,
+				data: data === null ? null : JSON.stringify(data),
+				created_at: /* @__PURE__ */ new Date(),
+				read_at: null
+			};
+			const names = sql.join(historyColumns.map(column));
+			const given = sql.join(historyColumns.map((name) => name === "data" ? sql`${values.data}::jsonb` : sql`${values[name]}`));
+			const [stored] = await rows(sql`insert into ${history} (${names}) values (${given}) returning ${selected}`);
+			return stored;
+		},
+		list: async (userId, page) => {
+			requiredText("user id", userId);
+			const { before, limit } = requiredPage(page);
+			const after = before && uuidPattern.test(before.id) ? sql`and (${column("created_at")}, ${column("id")}) < (${before.createdAt}, ${before.id}::uuid)` : before ? sql`and ${column("created_at")} < ${before.createdAt}` : sql``;
+			return rows(sql`select ${selected} from ${history} where ${column("user_id")} = ${userId} ${after}
+        order by ${column("created_at")} desc, ${column("id")} desc limit ${limit}`);
+		},
+		countUnread: async (userId) => {
+			requiredText("user id", userId);
+			return (await execute(sql`select count(*)::int as count from (select from ${history} where ${unread(userId)} limit ${100}) as unread`)).rows[0].count;
+		},
+		markRead: async (userId, id) => {
+			requiredText("user id", userId);
+			requiredText("id", id);
+			if (!uuidPattern.test(id)) return false;
+			return (await execute(sql`with found as (select ${column("id")} from ${history} where ${column("user_id")} = ${userId} and ${column("id")} = ${id}::uuid),
+        marked as (update ${history} set ${column("read_at")} = ${/* @__PURE__ */ new Date()} where ${column("id")} in (select ${column("id")} from found) and ${column("read_at")} is null)
+        select exists (select from found) as found`)).rows[0].found;
+		},
+		markAllRead: async (userId, upTo) => {
+			requiredText("user id", userId);
+			requiredTime("time", upTo);
+			await execute(sql`update ${history} set ${column("read_at")} = ${/* @__PURE__ */ new Date()} where ${unread(userId)} and ${column("created_at")} <= ${upTo}`);
+		},
+		removeAllForUser: async (userId) => {
+			requiredText("user id", userId);
+			await execute(sql`delete from ${history} where ${column("user_id")} = ${userId}`);
+		}
+	};
+};
+//#endregion
+export { HistoryStoreError, postgresHistoryStore };

package/dist/notifications/routes.js

@@ -1,6 +1,6 @@
 import { HttpProblem } from "../problem.js";
+import { ownSignInUser } from "./caller.js";
 import "./paths.js";
-import { ownDeviceUser } from "./caller.js";
 import { deviceInput, maxDeviceBodyBytes } from "./device-input.js";
 import { Hono } from "hono";
 import { bodyLimit } from "hono/body-limit";
@@ -8,7 +8,7 @@ import { bodyLimit } from "hono/body-limit";
 /** The most devices one user keeps: registering one more drops their least recently seen. */
 const maxDevicesPerUser = 20;
 const ownSignIn = async (c, next) => {
-	c.set("deviceUser", ownDeviceUser(c.get("session")));
+	c.set("deviceUser", ownSignInUser(c.get("session")));
 	await next();
 };
 const jsonOnly = async (c, next) => {

package/dist/notifications/schema.d.ts

@@ -3,15 +3,11 @@ import { NotificationsOptions } from "./options.js";
 import { Db } from "@protobase/query";
 //#region src/notifications/schema.d.ts
 /**
- * The SQL that adds the devices table `notifications()` keeps devices in, under the names its options give; with
- * `auth`, its user column points at auth's users table. `undefined` when the table exists, and with a store of the
- * app's own, which needs none.
+ * The SQL that adds the tables `notifications()` keeps devices and each user's history in, under the names its options
+ * give; with `auth`, their user columns point at auth's users table. Each table is left out when it exists or a store
+ * of the app's own replaces it; `undefined` when none is left.
  */
 export declare const notificationsMigration: (db: Db, options?: NotificationsOptions, auth?: AdminAuth) => Promise<string | undefined>;
-/**
- * Refuses to start while the devices table lacks what `notifications()` needs, naming it: the table, each column under
- * its configured name, a unique index on the token alone, which moving a device relies on, and with `auth` a foreign key
- * from the user column that deletes a user's devices with the user. Nothing to check with a store of the app's own.
- */
+/** Refuses to start while the devices or the history table lacks what `notifications()` needs, naming it. */
 export declare const checkNotificationsSchema: (db: Db, options?: NotificationsOptions, auth?: AdminAuth) => Promise<void>;
 //#endregion