cursedbelt-server 4.1.0 → 4.3.0

package/src/server/bench/budget.ts

@@ -26,6 +26,10 @@
  * which is the owner's estimate and not a measurement. {@link deriveCpuBudgetMs} is the
  * function to re-run against real traffic — the re-derivation is a call, not a paragraph
  * somebody has to remember to do.
+ *
+ * 🔴 **It has already been run once** — see {@link MEASURED_FLEET_REQUESTS_PER_DAY}, which
+ * carries both the number and the reason the default was left stricter than it. Do not
+ * spend that measurement again; what is still missing is Worker traffic, not Mac traffic.
  */
 
 /** CPU-milliseconds included in the Workers Paid plan each month. */
@@ -49,6 +53,35 @@ export const OWNER_PROJECTED_REQUESTS_PER_DAY = 100_000;
 /** 365.25 / 12 — the average calendar month, since billing is monthly. */
 export const DAYS_PER_MONTH = 30.4375;
 
+/**
+ * 🔴 The re-derivation has been DONE — 2026-09-16 — and the answer was not 9.9. This
+ * constant exists so the next reader does not spend the measurement again.
+ *
+ * Summed from the six apps still holding a populated `request_metrics` table in
+ * `$FORGE_STATE/apps/<app>/metrics.sqlite` (rows ÷ retained window, since five of the
+ * six sit at a ~100,4xx retention cap and only `patterns` is a true count):
+ *
+ * ```
+ * family 15,489/d · roms 10,580/d · music 7,034/d · vault 5,690/d
+ * collections 3,737/d · patterns 442/d                →  42,971/day
+ * ```
+ *
+ * That is **43 % of {@link OWNER_PROJECTED_REQUESTS_PER_DAY}**, so the real per-request
+ * allowance is ~22.9 CPU-ms rather than 9.9 — 2.3× looser than the shipped default.
+ *
+ * 🔴 **The default was deliberately NOT raised to it**, and the reason is the corpus:
+ * every one of those tables stops within hours of its app's graduation (`roms` ends
+ * `2026-09-15 12:00:03`), because `requestLogger` has no callers in this generation
+ * yet. It is the RETIRED generation's traffic, and no app is on a Worker at all — so
+ * nothing here has been measured against the quantity Cloudflare actually bills.
+ * Loosening every budget in the fleet on evidence that cannot support it is the one
+ * direction a wrong guess costs money in; being 2.3× conservative costs nothing.
+ *
+ * `budget.spec.ts` holds that ordering as an assertion rather than as this paragraph:
+ * the default may never drift ABOVE the measured allowance without a red build.
+ */
+export const MEASURED_FLEET_REQUESTS_PER_DAY = 42_971;
+
 /**
  * Derive the average CPU-ms a single request may spend before the fleet exceeds its
  * included CPU allowance.
@@ -100,7 +133,9 @@ export function monthlyOverageUsd(opts: {
  * 9.9 CPU-ms — `30,000,000 ÷ (100,000 × 30.4375)` = 9.856, to one decimal.
  *
  * Generous for a JSON route, tight for anything that renders, parses or derives a key.
- * 🔴 Re-derive with {@link deriveCpuBudgetMs} once an app has real traffic.
+ *
+ * 🔴 Deliberately kept BELOW the ~22.9 ms that {@link MEASURED_FLEET_REQUESTS_PER_DAY}
+ * derives; that constant says why, and `budget.spec.ts` reddens if the two ever swap.
  */
 export const DEFAULT_ROUTE_CPU_BUDGET_MS = Math.round(deriveCpuBudgetMs() * 10) / 10;
 

package/src/server/bench/cpuBudget.spec.ts

@@ -3,7 +3,12 @@ import { Hono } from 'hono';
 import { assertCpuBudgets, checkCpuBudgets, formatCpuBudgetReport } from './assert';
 import { type CpuBudgetConfig, DEFAULT_ROUTE_CPU_BUDGET_MS } from './budget';
 import { cpuBudget } from './cpuBudget';
-import { fixedCpuClock, processCpuClock, unavailableCpuClock } from './cpuClock';
+import {
+  fixedCpuClock,
+  processCpuClock,
+  unavailableCpuClock,
+  workerCpuClock,
+} from './cpuClock';
 import { createCpuRecorder } from './recorder';
 import { runCpuBench } from './runBench';
 
@@ -300,3 +305,98 @@ describe('the bench runner', () => {
     await expect(runCpuBench({ app, recorder, cases: [] })).rejects.toThrow(/no cases/);
   });
 });
+
+/**
+ * 🔴 **The third direction: a gate that CANNOT go red.**
+ *
+ * The two directions above prove the assertion fires on a real over-budget route and stays
+ * quiet on a real under-budget one. Both assume the report describes something that was
+ * measured. Measured 2026-09-17, before the guards these cases cover: an empty report, a
+ * constant-zero `workerCpuClock`, and a reader returning `undefined` ALL asserted green —
+ * and the middle one did it carrying `proxy: false`, the exact flag that says "quote this
+ * as a Cloudflare billing fact".
+ *
+ * `cpuClock.ts`'s own header predicted it — *"a clock that reads zero for ever and a gate
+ * that can never go red"* — so this block is that paragraph turned into checks.
+ */
+describe('direction 3 — a gate that measured nothing must FAIL, not pass', () => {
+  it('fails an available clock that recorded no route at all', () => {
+    const recorder = createCpuRecorder({ clock: processCpuClock() });
+    const report = recorder.report();
+    expect(report.available).toBe(true);
+    expect(report.routes).toHaveLength(0);
+
+    expect(() => assertCpuBudgets(report)).toThrow(/not one route was recorded/);
+    // requireDeclared must not be what saves it — it has no routes to require anything of.
+    expect(() => assertCpuBudgets(report, { requireDeclared: true })).toThrow(/no-samples|not one route/);
+    // The one deliberate escape hatch.
+    expect(assertCpuBudgets(report, { allowUnmeasurable: true })).toEqual([]);
+  });
+
+  it('fails a bench whose app never mounted cpuBudget() — the real wiring mistake', async () => {
+    const recorder = createCpuRecorder({ clock: processCpuClock() });
+    const app = new Hono(); // 🔴 no app.use('*', cpuBudget({ recorder }))
+    app.get('/api/cheap', (c) => c.json({ ok: true }));
+
+    // The bench itself is happy: every case returns 200.
+    const report = await runCpuBench({ app, recorder, cases: [{ path: '/api/cheap' }] });
+    expect(report.routes).toHaveLength(0);
+    expect(() => assertCpuBudgets(report)).toThrow(/cpuBudget\(\) is mounted/);
+  });
+
+  it('fails a constant-zero worker reader, and says it was reported as NON-proxy', () => {
+    const clock = workerCpuClock(() => 0);
+    const recorder = createCpuRecorder({ clock });
+    for (let i = 0; i < 40; i += 1) recorder.record('GET', '/api/thing', clock.start()());
+
+    const report = recorder.report();
+    // This is the shape that makes it dangerous: it claims to be billable truth.
+    expect(report.proxy).toBe(false);
+    expect(report.routes[0].samples).toBe(40);
+    expect(report.routes[0].p99).toBe(0);
+
+    expect(() => assertCpuBudgets(report)).toThrow(/never moves cannot ever redden/);
+    expect(() => assertCpuBudgets(report)).toThrow(/NON-proxy/);
+    expect(assertCpuBudgets(report, { allowZeroCpu: true })).toEqual([]);
+  });
+
+  it('does NOT fire when any route read a real number — one non-zero clears it', () => {
+    const recorder = createCpuRecorder({ clock: fixedCpuClock([0]) });
+    for (let i = 0; i < 40; i += 1) recorder.record('GET', '/api/flat', 0);
+    recorder.record('GET', '/api/real', 0.25);
+
+    const violations = checkCpuBudgets(recorder.report(), { minSamples: 1 });
+    expect(violations.map((v) => v.kind)).not.toContain('degenerate');
+  });
+
+  it('refuses a reader that is not callable, at wiring time', () => {
+    expect(() => workerCpuClock(undefined as unknown as () => number)).toThrow(
+      /needs a function returning CPU-ms/,
+    );
+  });
+
+  it('treats a non-numeric reading as unmeasurable, never as zero', () => {
+    const clock = workerCpuClock(() => undefined as unknown as number);
+    expect(Number.isNaN(clock.start()())).toBe(true);
+
+    // NaN is dropped by the recorder, so the run lands on the no-samples guard rather
+    // than reporting a confident 0.00 for every route.
+    const recorder = createCpuRecorder({ clock });
+    for (let i = 0; i < 40; i += 1) recorder.record('GET', '/api/thing', clock.start()());
+    expect(() => assertCpuBudgets(recorder.report())).toThrow(/finite number/);
+  });
+
+  it('passes a worker clock that actually moves — the guards do not block a real one', () => {
+    let cpu = 0;
+    const clock = workerCpuClock(() => (cpu += 1.5), 'tail-worker cpuTime');
+    const recorder = createCpuRecorder({ clock, config: { routes: { 'GET /api/thing': 5 } } });
+    for (let i = 0; i < 40; i += 1) recorder.record('GET', '/api/thing', clock.start()());
+
+    const report = recorder.report();
+    expect(report.proxy).toBe(false);
+    expect(report.source).toBe('tail-worker cpuTime');
+    expect(report.routes[0].p99).toBeGreaterThan(0);
+    expect(assertCpuBudgets(report, { requireDeclared: true })).toEqual([]);
+    expect(formatCpuBudgetReport(report)).toContain('runtime-reported Worker CPU-ms');
+  });
+});

package/src/server/bench/cpuClock.ts

@@ -68,13 +68,34 @@ export function processCpuClock(): CpuClock {
  * @param readCpuMs Returns monotonically non-decreasing CPU-ms for the current invocation.
  */
 export function workerCpuClock(readCpuMs: () => number, source = 'worker-runtime'): CpuClock {
+  // This function is the only place `proxy: false` is stamped — the claim that a number may
+  // be quoted as a Cloudflare billing fact is made HERE, so it is checked here. A reader
+  // that is not callable can never be one, and finding that out at wiring time costs one
+  // cold start; finding it out later costs a gate that reads zero for ever.
+  if (typeof readCpuMs !== 'function') {
+    throw new TypeError(
+      'workerCpuClock: needs a function returning CPU-ms for the current invocation. ' +
+        'There is no built-in Cloudflare reader — the isolate does not hand a handler its ' +
+        'own CPU time, so this comes from a tail worker feeding cpuTime back.',
+    );
+  }
+  // 🔴 The reader is NOT called here. Cloudflare's CPU readings are request-scoped, so a
+  // correct reader may legitimately throw or read nothing at construction; validating
+  // eagerly would reject the very readers this exists to accept.
   return {
     source,
     proxy: false,
     available: true,
     start(): CpuSpan {
       const before = readCpuMs();
-      return () => Math.max(0, readCpuMs() - before);
+      return () => {
+        const after = readCpuMs();
+        // A non-numeric reading is unmeasurable, never zero. NaN is what
+        // `createCpuRecorder` drops as "not a sample"; a 0 would be recorded as a
+        // confident measurement of no work, which is the lie this module exists to avoid.
+        if (!Number.isFinite(before) || !Number.isFinite(after)) return Number.NaN;
+        return Math.max(0, after - before);
+      };
     },
   };
 }

package/src/server/bench/index.ts

@@ -49,6 +49,7 @@ export {
   DEFAULT_ROUTE_CPU_BUDGET_MS,
   deriveCpuBudgetMs,
   isExemption,
+  MEASURED_FLEET_REQUESTS_PER_DAY,
   monthlyOverageUsd,
   OWNER_PROJECTED_REQUESTS_PER_DAY,
   type ResolvedBudget,

package/src/server/d1/fakeD1.ts

@@ -19,6 +19,11 @@
  *      precision above 2^53 without a word.
  *   4. **Results are wrapped** in `{ results, success, meta }` rather than returned bare.
  *   5. **`BEGIN`/`COMMIT` is refused** — D1 has no interactive transaction.
+ *   6. **`batch()` reports each member's own `changes` / `last_row_id`**, because real D1
+ *      does. 🔴 Until 2026-09-17 this file hardcoded `changes: 0` there and so did the
+ *      local driver, so `sameShape.spec.ts` was green on a bug BOTH sides shared — the one
+ *      failure mode a two-implementation test cannot see. A real port of
+ *      `apps/patterns/src/server/tokens.ts` found it on its first atomic write.
  *
  * SQL semantics are real: it runs against an actual in-memory SQLite. Only the edges are
  * emulated, which are exactly the edges under test.
@@ -31,6 +36,7 @@
 
 import type { Database } from 'bun:sqlite';
 import type { D1BindingLike, D1BindingResult, D1BindingStatement } from './remote';
+import { isPureReadSql } from './values';
 
 /** The bind types a real D1 binding accepts. Everything else throws. */
 function assertD1Bindable(value: unknown, index: number): void {
@@ -135,8 +141,55 @@ class FakeD1Statement implements D1BindingStatement {
 		const rows = this.db.query(this.sql).values(...(this.params as never[])) as unknown[][];
 		return rows.map((r) => r.map(toWireValue));
 	}
+
+	/**
+	 * Execute synchronously and report the wire result, for `batch()`.
+	 *
+	 * 🔴 Synchronous on purpose: a `bun:sqlite` transaction callback may not await — a
+	 * promise resolved inside it settles a microtask after the transaction has already
+	 * committed. The local driver keeps a `SyncExecutable` for exactly this reason.
+	 *
+	 * The counters are read the same way real D1 populates `meta`, and deliberately NOT by
+	 * copying `local.ts`: this file is a divergence simulator, so it reaches its answer
+	 * independently and the shared-bug case stays detectable.
+	 */
+	runSync(): D1BindingResult {
+		assertRunnableOnD1(this.sql);
+		const started = performance.now();
+		const stmt = this.db.query(this.sql);
+		const bound = this.params as never[];
+
+		// No result columns → cannot return rows, and `.run()` is the only call that reports
+		// `changes`. This is the ordinary batch member: an INSERT, UPDATE or DELETE.
+		if (stmt.columnNames.length === 0) {
+			const res = stmt.run(...bound);
+			return { results: [], success: true, meta: this.meta(started, res.changes, Number(res.lastInsertRowid)) };
+		}
+
+		// A pure read wrote nothing. Its `changes()` would be the PREVIOUS statement's.
+		if (isPureReadSql(this.sql)) {
+			const rows = stmt.all(...bound) as Record<string, unknown>[];
+			return { results: rows.map(toWireRow), success: true, meta: this.meta(started, 0, 0) };
+		}
+
+		// Returns rows AND writes — `INSERT … RETURNING` and friends.
+		const before = totalChanges(this.db);
+		const rows = this.db.query(this.sql).all(...bound) as Record<string, unknown>[];
+		const changes = totalChanges(this.db) - before;
+		return {
+			results: rows.map(toWireRow),
+			success: true,
+			meta: this.meta(started, changes, changes > 0 ? lastInsertRowid(this.db) : 0),
+		};
+	}
 }
 
+/** Cumulative rows changed on this connection — a difference is one statement's count. */
+const totalChanges = (db: Database): number => (db.query('SELECT total_changes() AS n').get() as { n: number }).n;
+
+/** The connection's last inserted rowid, which is what D1 puts in `meta.last_row_id`. */
+const lastInsertRowid = (db: Database): number => (db.query('SELECT last_insert_rowid() AS r').get() as { r: number }).r;
+
 /**
  * Wrap a real `bun:sqlite` database in D1's API and D1's restrictions.
  *
@@ -154,26 +207,11 @@ export function createFakeD1Binding(db: Database): D1BindingLike {
 		async batch(statements: D1BindingStatement[]): Promise<D1BindingResult[]> {
 			// D1's batch is atomic — it is the only atomicity D1 offers. A real `bun:sqlite`
 			// transaction is the faithful local equivalent.
+			// 🔴 Each member reports its OWN `changes` / `last_row_id`, because real D1 does.
+			// This used to hardcode zero — see note 6 in the header for what that cost.
 			const results: D1BindingResult[] = [];
 			const run = db.transaction((stmts: D1BindingStatement[]) => {
-				for (const s of stmts) {
-					const started = performance.now();
-					const inner = s as FakeD1Statement;
-					assertRunnableOnD1(inner.sql);
-					const rows = db.query(inner.sql).all(...(inner.params as never[])) as Record<string, unknown>[];
-					results.push({
-						results: rows.map(toWireRow),
-						success: true,
-						meta: {
-							duration: performance.now() - started,
-							changes: 0,
-							last_row_id: 0,
-							rows_read: rows.length,
-							rows_written: 0,
-							served_by: 'fake-d1',
-						},
-					});
-				}
+				for (const s of stmts) results.push((s as FakeD1Statement).runSync());
 			});
 			run(statements);
 			return results;

package/src/server/d1/index.ts

@@ -26,6 +26,7 @@ export {
 	type TimeTravelOpts,
 } from './backup';
 export { createD1Kysely, D1LikeDialect, type D1PlumbingDb } from './kysely';
+export { type InvocationD1, perInvocation } from './invocation';
 export { assertBatchSize, assertWithinLimits, chunkForBind, LIMITS } from './limits';
 export { createLocalD1, refuseInteractiveTransaction } from './local';
 export {

package/src/server/d1/invocation.spec.ts

@@ -0,0 +1,174 @@
+import { Database } from 'bun:sqlite';
+import { beforeEach, describe, expect, test } from 'bun:test';
+import { createFakeD1Binding } from './fakeD1';
+import { perInvocation } from './invocation';
+import { LIMITS } from './limits';
+import { createLocalD1 } from './local';
+import { createRemoteD1 } from './remote';
+import { D1LimitError, type D1LikeDatabase } from './types';
+
+/**
+ * 🔴 Every test here would have passed against the seam as published in 4.2.0, because
+ * nothing counted. `assertBatchSize` guards the length of one `batch()`; the N+1 loop
+ * below never builds a batch at all.
+ */
+
+const seeded = () => {
+	const db = new Database(':memory:');
+	db.run('CREATE TABLE people (id INTEGER PRIMARY KEY, name TEXT)');
+	for (let i = 1; i <= 5; i++) db.run('INSERT INTO people (id, name) VALUES (?, ?)', [i, `p${i}`]);
+	return db;
+};
+
+describe('the per-invocation query budget', () => {
+	let base: D1LikeDatabase;
+
+	beforeEach(() => {
+		base = createLocalD1(seeded());
+	});
+
+	test('🔴 the N+1 loop the limits header names is refused — and it is the case nothing caught before', async () => {
+		const db = perInvocation(base, { max: 10 });
+		// The laziest mechanical port of a synchronous loop: await inside `for`.
+		const run = async () => {
+			for (let i = 0; i < 50; i++) {
+				await db.prepare('SELECT name FROM people WHERE id = ?').bind(1).first();
+			}
+		};
+		await expect(run()).rejects.toThrow(D1LimitError);
+		// It stopped AT the cap, not after it — the query over budget was never issued.
+		expect(db.used).toBe(10);
+		expect(db.remaining).toBe(0);
+	});
+
+	test('the refusal names the remedy rather than the number', async () => {
+		const db = perInvocation(base, { max: 1 });
+		await db.prepare('SELECT 1 AS n').all();
+		try {
+			await db.prepare('SELECT 2 AS n').all();
+			throw new Error('expected a refusal');
+		} catch (e) {
+			expect(e).toBeInstanceOf(D1LimitError);
+			const msg = (e as Error).message;
+			expect(msg).toContain('N+1');
+			expect(msg).toContain('JOIN');
+			expect(msg).toContain('batch()');
+		}
+	});
+
+	test('the JOIN that replaces the loop costs one query', async () => {
+		const db = perInvocation(base, { max: 1 });
+		const res = await db.prepare('SELECT id, name FROM people ORDER BY id').all();
+		expect(res.results).toHaveLength(5);
+		expect(db.used).toBe(1);
+	});
+
+	test('every terminal call is charged, and building a statement is not', async () => {
+		const db = perInvocation(base);
+		// prepare + bind reach nothing, so they cost nothing — otherwise a re-bound
+		// statement kept in a helper would bill for merely existing.
+		const stmt = db.prepare('SELECT name FROM people WHERE id = ?').bind(1);
+		expect(db.used).toBe(0);
+
+		await stmt.first();
+		await stmt.all();
+		await stmt.raw();
+		await db.prepare('INSERT INTO people (id, name) VALUES (?, ?)').bind(99, 'x').run();
+		expect(db.used).toBe(4);
+	});
+
+	test('a batch is charged per MEMBER, because D1 bills it that way', async () => {
+		const db = perInvocation(base);
+		const stmts = [1, 2, 3].map((i) => db.prepare('SELECT name FROM people WHERE id = ?').bind(i));
+		const out = await db.batch(stmts);
+		expect(out).toHaveLength(3);
+		expect(db.used).toBe(3);
+	});
+
+	test('🔴 batch() still works through the wrapper — the statements are unwrapped for the driver', async () => {
+		// The regression this guards: both drivers identify their own statements
+		// structurally (`allSync` local, `binding` remote) and reject anything else. A
+		// wrapper that forwarded itself would break batch() on both sides.
+		const db = perInvocation(base);
+		const stmts = [
+			db.prepare('INSERT INTO people (id, name) VALUES (?, ?)').bind(20, 'a'),
+			db.prepare('INSERT INTO people (id, name) VALUES (?, ?)').bind(21, 'b'),
+		];
+		await db.batch(stmts);
+		const check = await db.prepare('SELECT COUNT(*) AS n FROM people').first<{ n: number }>();
+		expect(check?.n).toBe(7);
+	});
+
+	test('a batch that would exceed the remaining budget is refused before it is sent', async () => {
+		const db = perInvocation(base, { max: 2 });
+		const stmts = [1, 2, 3].map((i) => db.prepare('SELECT name FROM people WHERE id = ?').bind(i));
+		await expect(db.batch(stmts)).rejects.toThrow(D1LimitError);
+		// Nothing was charged, because nothing was sent.
+		expect(db.used).toBe(0);
+	});
+
+	test('exec settles its true cost afterwards, and the NEXT query is what refuses', async () => {
+		const db = perInvocation(base, { max: 3 });
+		// Three statements through a budget of three: exec reserves one, then settles two.
+		const res = await db.exec('CREATE TABLE a (x); CREATE TABLE b (x); CREATE TABLE c (x)');
+		expect(res.count).toBe(3);
+		expect(db.used).toBe(3);
+		await expect(db.prepare('SELECT 1 AS n').all()).rejects.toThrow(D1LimitError);
+	});
+
+	test('the cap is not off by one — exactly `max` queries are allowed', async () => {
+		const db = perInvocation(base, { max: 3 });
+		for (let i = 0; i < 3; i++) await db.prepare('SELECT 1 AS n').all();
+		expect(db.used).toBe(3);
+		await expect(db.prepare('SELECT 1 AS n').all()).rejects.toThrow(D1LimitError);
+	});
+
+	test('the default budget is D1\'s own, and `remaining` starts there', () => {
+		const db = perInvocation(base);
+		expect(db.remaining).toBe(LIMITS.queriesPerInvocation);
+		expect(db.used).toBe(0);
+	});
+
+	test('a budget above D1\'s real cap is refused rather than honoured', () => {
+		expect(() => perInvocation(base, { max: LIMITS.queriesPerInvocation + 1 })).toThrow(D1LimitError);
+		expect(() => perInvocation(base, { max: 0 })).toThrow(RangeError);
+		expect(() => perInvocation(base, { max: 1.5 })).toThrow(RangeError);
+	});
+
+	test('the flavor of the wrapped driver shows through', () => {
+		expect(perInvocation(base).flavor).toBe('local');
+	});
+
+	test('🔴 each invocation gets its own budget — the count is the request\'s, not the handle\'s', async () => {
+		// The false positive this design avoids: `createLocalD1` lives for the whole
+		// process, so a counter on the HANDLE would refuse the 1,001st query of the day.
+		for (let request = 0; request < 3; request++) {
+			const db = perInvocation(base, { max: 2 });
+			await db.prepare('SELECT 1 AS n').all();
+			await db.prepare('SELECT 1 AS n').all();
+			expect(db.used).toBe(2);
+		}
+	});
+});
+
+describe('the budget counts the REMOTE driver identically', () => {
+	// Same assertions, other side of the seam — a budget that only worked locally would be
+	// the sync-locally defect over again.
+	test('the loop is refused on D1 too, at the same point', async () => {
+		const db = perInvocation(createRemoteD1(createFakeD1Binding(seeded())), { max: 4 });
+		expect(db.flavor).toBe('d1');
+		const run = async () => {
+			for (let i = 0; i < 20; i++) await db.prepare('SELECT name FROM people WHERE id = ?').bind(1).first();
+		};
+		await expect(run()).rejects.toThrow(D1LimitError);
+		expect(db.used).toBe(4);
+	});
+
+	test('batch() unwraps for the remote driver as well', async () => {
+		const db = perInvocation(createRemoteD1(createFakeD1Binding(seeded())));
+		const stmts = [1, 2].map((i) => db.prepare('SELECT name FROM people WHERE id = ?').bind(i));
+		const out = await db.batch(stmts);
+		expect(out).toHaveLength(2);
+		expect(db.used).toBe(2);
+	});
+});