cursedbelt-server 4.26.1 → 4.28.0

package/src/server/engagement/d1.spec.ts

@@ -0,0 +1,102 @@
+/**
+ * The Worker's engagement recorder is the kit's, over D1 — the SAME tables and the SAME rows for
+ * the same views, because station reads both with one query set (tasks 2081, 2096).
+ */
+import { Database } from 'bun:sqlite';
+import { afterEach, describe, expect, test } from 'bun:test';
+import { mkdtempSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { Hono } from 'hono';
+import { createLocalD1 } from '../d1/local.js';
+import { createD1EngagementRecorder, ENGAGEMENT_DDL, placesFromManifest, recordViewD1 } from './d1.js';
+import { engagementPlacesFor } from './places.js';
+import { EngagementStore } from './store.js';
+
+const dirs: string[] = [];
+afterEach(() => {
+	for (const dir of dirs.splice(0)) rmSync(dir, { recursive: true });
+});
+const tempDir = (): string => {
+	const dir = mkdtempSync(join(tmpdir(), 'engagement-d1-'));
+	dirs.push(dir);
+	return dir;
+};
+const kitStore = (): EngagementStore => new EngagementStore({ dbPath: join(tempDir(), 'engagement.sqlite') });
+const d1 = () => {
+	const sqlite = new Database(':memory:');
+	for (const ddl of ENGAGEMENT_DDL) sqlite.run(ddl);
+	return { sqlite, db: createLocalD1(sqlite) };
+};
+const shape = (db: Database) =>
+	(
+		db
+			.query("SELECT type, name, sql FROM sqlite_master WHERE name LIKE '%engagement%' AND sql IS NOT NULL ORDER BY name")
+			.all() as { type: string; name: string; sql: string }[]
+	).map((r) => ({ type: r.type, name: r.name, sql: r.sql.replace(/\s+/g, ' ').replace('IF NOT EXISTS ', '').trim() }));
+const dump = (db: Database) => ({
+	days: db.query('SELECT * FROM engagement_days ORDER BY user_key, place, day').all(),
+	places: db.query('SELECT * FROM engagement_places ORDER BY user_key, place').all(),
+	users: db.query('SELECT * FROM engagement_users ORDER BY user_key').all(),
+});
+
+describe('cursedbelt-server/engagement/d1', () => {
+	test("🔴 creates exactly the kit store's tables and indexes — station reads both with one query set", () => {
+		const kit = kitStore();
+		const { sqlite } = d1();
+		expect(shape(sqlite)).toEqual(shape(kit.handle));
+	});
+
+	test("🔴 the same views produce the same rows as the kit's store — sessions, dwell, days", async () => {
+		const kit = kitStore();
+		const { sqlite, db } = d1();
+		const t0 = Date.UTC(2026, 8, 23, 10, 0, 0);
+		const views = [
+			{ userKey: 'u1', place: 'library', ts: t0 },
+			{ userKey: 'u1', place: 'downloads', ts: t0 + 40_000 },
+			{ userKey: 'u2', place: 'library', ts: t0 + 50_000 },
+			{ userKey: 'u1', place: 'library', ts: t0 + 90_000 },
+			// A new session (a long gap) on the next day.
+			{ userKey: 'u1', place: 'library', ts: t0 + 26 * 3_600_000 },
+		];
+		for (const v of views) expect(await recordViewD1(db, v)).toEqual(kit.recordView(v));
+		expect(dump(sqlite)).toEqual(dump(kit.handle));
+	});
+
+	test('records only a signed-in account, and buckets an off-manifest place as `other`', async () => {
+		const { sqlite, db } = d1();
+		const places = placesFromManifest({ routes: [{ id: 'library', path: '/library' }, { id: 'library' }, { path: '/x' }] });
+		expect(places).toEqual([{ id: 'library', path: '/library' }]);
+		let user: string | null = null;
+		const app = new Hono().route('/api/engagement', createD1EngagementRecorder({ db, places, resolveUser: () => user }));
+		const post = (place: unknown) =>
+			app.request('http://x/api/engagement/view', {
+				method: 'POST',
+				headers: { 'content-type': 'application/json' },
+				body: JSON.stringify({ place }),
+			});
+		expect((await post('library')).status).toBe(401);
+		user = 'u1';
+		expect(await (await post('library')).json()).toMatchObject({ ok: true, place: 'library', bucketed: false });
+		// An id, an album name, a search string — never a row of its own.
+		expect(await (await post('album:Some Private Name')).json()).toMatchObject({ place: 'other', bucketed: true });
+		expect((await post(42)).status).toBe(400);
+		expect(sqlite.query('SELECT place FROM engagement_places ORDER BY place').all()).toEqual([
+			{ place: 'library' },
+			{ place: 'other' },
+		]);
+	});
+
+	test('🔴 ONE manifest rule: a Worker handed the JSON and a Bun server reading the file agree', async () => {
+		const doc = { routes: [{ id: 'queue', path: '/#/queue' }, { id: 'home', path: '/' }, { id: 'queue' }, { id: '' }, null] };
+		const dir = tempDir();
+		await Bun.write(join(dir, 'routes.manifest.json'), JSON.stringify(doc));
+		expect(placesFromManifest(doc)).toEqual([
+			{ id: 'home', path: '/' },
+			{ id: 'queue', path: '/#/queue' },
+		]);
+		expect(engagementPlacesFor(dir)).toEqual(placesFromManifest(doc));
+		expect(placesFromManifest('not a manifest')).toEqual([]);
+		expect(placesFromManifest(null)).toEqual([]);
+	});
+});

package/src/server/engagement/d1.ts

@@ -0,0 +1,141 @@
+/**
+ * `cursedbelt-server/engagement/d1` — the engagement recorder over D1, for an app a Worker serves.
+ *
+ * ── Why it exists ───────────────────────────────────────────────────────────
+ * `./engagement` is Bun-only: its store is a synchronous `bun:sqlite` file (`engagement.sqlite`)
+ * that station's Metrics page reads off disk. A Worker has neither, so an app that moved to one
+ * stopped being heard with no error anywhere — `collections` from its 2026-09-22 cutover until
+ * this subpath (task 2096). The SAME three tables live in the app's own D1 instead (its
+ * `db/schema.sql`, from {@link ENGAGEMENT_DDL}), written with the SAME fold (`./policy.ts` →
+ * `foldView`, `dayKey`, `resolvePlace`), and station reads them from D1 for any Worker-served app.
+ *
+ * It was `apps/music/src/server/engagementD1.ts` plus a copied `kit/engagement/policy.ts` held
+ * byte-identical by a parity test (task 2081). collections was the second consumer, so it was
+ * lifted here rather than copied again — and the policy copy went with it: this module imports
+ * the library's own `policy.ts`, so there is one privacy rule, not one per Worker.
+ *
+ * 🔴 Worker-safe: nothing reachable from here at runtime imports `bun:*`
+ * (`telemetryIsWorkerSafe.spec.ts` walks it). Do not import `./store.js` or `./api.js` here.
+ *
+ * 🔴 The kit's privacy story holds unchanged: the place is resolved against the app's own route
+ * manifest AT THE DOOR, so an id, an album name or a search string never reaches a row; the
+ * account is the session's subject, never anything in the body. Mount it INSIDE the session gate.
+ *
+ * 🔴 {@link ENGAGEMENT_DDL} must stay byte-identical in effect to `EngagementStore`'s `migrate()` —
+ * station reads both shapes with one query set. `d1.spec.ts` builds both and compares their
+ * `sqlite_master` rows, so a column added to one and not the other is a red.
+ *
+ * ```ts
+ * import { createD1EngagementRecorder, placesFromManifest } from "cursedbelt-server/engagement/d1";
+ * import routesManifest from "../routes.manifest.json";
+ *
+ * gated.route("/api/engagement", createD1EngagementRecorder({
+ *   db, places: placesFromManifest(routesManifest), resolveUser: (c) => sso.userOf(c)?.id ?? null,
+ * }));
+ * ```
+ */
+import type { D1LikeDatabase } from "../d1/types.js";
+import type { Context } from "hono";
+import { Hono } from "hono";
+import { dayKey, foldView, OTHER_PLACE, type PlaceRef, resolvePlace } from "./policy.js";
+
+/** The kit store's own tables and indexes, as one-line DDL — see the header. */
+export const ENGAGEMENT_DDL: readonly string[] = [
+	"CREATE TABLE IF NOT EXISTS engagement_days ( user_key TEXT NOT NULL, place TEXT NOT NULL, day TEXT NOT NULL, views INTEGER NOT NULL DEFAULT 0, active_ms INTEGER NOT NULL DEFAULT 0, sessions INTEGER NOT NULL DEFAULT 0, first_ts INTEGER NOT NULL, last_ts INTEGER NOT NULL, PRIMARY KEY (user_key, place, day) )",
+	"CREATE INDEX IF NOT EXISTS idx_engagement_days_day ON engagement_days (day)",
+	"CREATE TABLE IF NOT EXISTS engagement_places ( user_key TEXT NOT NULL, place TEXT NOT NULL, views INTEGER NOT NULL DEFAULT 0, sessions INTEGER NOT NULL DEFAULT 0, active_ms INTEGER NOT NULL DEFAULT 0, first_ts INTEGER NOT NULL, last_ts INTEGER NOT NULL, PRIMARY KEY (user_key, place) )",
+	"CREATE INDEX IF NOT EXISTS idx_engagement_places_last ON engagement_places (last_ts)",
+	"CREATE TABLE IF NOT EXISTS engagement_users ( user_key TEXT PRIMARY KEY, views INTEGER NOT NULL DEFAULT 0, sessions INTEGER NOT NULL DEFAULT 0, active_ms INTEGER NOT NULL DEFAULT 0, first_ts INTEGER NOT NULL, last_ts INTEGER NOT NULL, last_place TEXT NOT NULL DEFAULT '' )",
+];
+
+/**
+ * Record one view — the kit's `EngagementStore.recordView`, asynchronously: one read (the
+ * account's previous view) and ONE batch of up to five statements, so a view is atomic and
+ * costs two D1 round trips however much it credits.
+ */
+export async function recordViewD1(
+	db: D1LikeDatabase,
+	input: { userKey: string; place: string; ts: number },
+): Promise<{ newSession: boolean; activeMs: number }> {
+	const { userKey, place, ts } = input;
+	const prior = await db
+		.prepare("SELECT last_ts, last_place FROM engagement_users WHERE user_key = ?")
+		.bind(userKey)
+		.first<{ last_ts: number; last_place: string }>();
+	const fold = foldView(prior ? prior.last_ts : null, ts);
+	const sessionDelta = fold.newSession ? 1 : 0;
+	const statements = [];
+	if (fold.activeMs > 0 && prior?.last_place) {
+		// The time since the last view is credited to the place the account was LOOKING AT.
+		statements.push(
+			db
+				.prepare("UPDATE engagement_days SET active_ms = active_ms + ? WHERE user_key = ? AND place = ? AND day = ?")
+				.bind(fold.activeMs, userKey, prior.last_place, dayKey(prior.last_ts)),
+			db
+				.prepare("UPDATE engagement_places SET active_ms = active_ms + ? WHERE user_key = ? AND place = ?")
+				.bind(fold.activeMs, userKey, prior.last_place),
+		);
+	}
+	statements.push(
+		db
+			.prepare(
+				`INSERT INTO engagement_days (user_key, place, day, views, active_ms, sessions, first_ts, last_ts)
+				 VALUES (?, ?, ?, 1, 0, ?, ?, ?)
+				 ON CONFLICT(user_key, place, day) DO UPDATE SET
+				   views = views + 1, sessions = sessions + excluded.sessions, last_ts = excluded.last_ts`,
+			)
+			.bind(userKey, place, dayKey(ts), sessionDelta, ts, ts),
+		db
+			.prepare(
+				`INSERT INTO engagement_places (user_key, place, views, sessions, active_ms, first_ts, last_ts)
+				 VALUES (?, ?, 1, ?, 0, ?, ?)
+				 ON CONFLICT(user_key, place) DO UPDATE SET
+				   views = views + 1, sessions = sessions + excluded.sessions, last_ts = excluded.last_ts`,
+			)
+			.bind(userKey, place, sessionDelta, ts, ts),
+		db
+			.prepare(
+				`INSERT INTO engagement_users (user_key, views, sessions, active_ms, first_ts, last_ts, last_place)
+				 VALUES (?, 1, ?, 0, ?, ?, ?)
+				 ON CONFLICT(user_key) DO UPDATE SET
+				   views = views + 1, sessions = sessions + excluded.sessions, active_ms = active_ms + ?,
+				   last_ts = excluded.last_ts, last_place = excluded.last_place`,
+			)
+			.bind(userKey, sessionDelta, ts, ts, place, fold.activeMs),
+	);
+	await db.batch(statements);
+	return fold;
+}
+
+/**
+ * The recorder as the kit's `createEngagementRecorder` mounts it — `POST /view` under
+ * `ENGAGEMENT_BASE_PATH` — over D1. Recording only: there is no read surface here, as there is
+ * none on the Mac; station reads the tables directly.
+ */
+export function createD1EngagementRecorder(options: {
+	db: D1LikeDatabase;
+	places: readonly PlaceRef[];
+	resolveUser: (c: Context) => string | null;
+	now?: () => number;
+}): Hono {
+	const app = new Hono();
+	const now = options.now ?? (() => Date.now());
+	app.post("/view", async (c) => {
+		const userKey = options.resolveUser(c);
+		if (!userKey) return c.json({ error: "unauthenticated" }, 401);
+		let body: unknown;
+		try {
+			body = await c.req.json();
+		} catch {
+			return c.json({ error: "expected a json body" }, 400);
+		}
+		const claimed = (body as { place?: unknown } | null)?.place;
+		if (typeof claimed !== "string") return c.json({ error: "place must be a string" }, 400);
+		const place = resolvePlace(claimed, options.places);
+		const fold = await recordViewD1(options.db, { userKey, place, ts: now() });
+		return c.json({ ok: true, place, bucketed: place === OTHER_PLACE, ...fold });
+	});
+	return app;
+}
+
+export { placesFromManifest } from "./manifestPlaces.js";

package/src/server/engagement/manifestPlaces.ts

@@ -0,0 +1,24 @@
+/**
+ * A parsed `routes.manifest.json` → the place allowlist. Pure, and Worker-safe: `places.ts`
+ * reads the file off disk for a Bun server, and a Worker hands over the JSON it bundles
+ * (`./d1.ts`). ONE rule for both — until task 2096 music's Worker carried its own copy of it.
+ *
+ * Anything it cannot read is `[]`, never a throw: see `places.ts`, "Missing is EMPTY".
+ */
+import type { PlaceRef } from "./policy.js";
+
+export function placesFromManifest(doc: unknown): PlaceRef[] {
+	const routes = Array.isArray(doc) ? doc : ((doc as { routes?: unknown } | null)?.routes as unknown[] | undefined);
+	if (!Array.isArray(routes)) return [];
+	const seen = new Set<string>();
+	const places: PlaceRef[] = [];
+	for (const raw of routes) {
+		const r = raw as { id?: unknown; path?: unknown } | null;
+		if (!r || typeof r.id !== "string" || !r.id || seen.has(r.id)) continue;
+		seen.add(r.id);
+		places.push({ id: r.id, path: typeof r.path === "string" ? r.path : "" });
+	}
+	// Sorted so the allowlist a board renders is stable between deployments.
+	places.sort((a, b) => a.id.localeCompare(b.id));
+	return places;
+}

package/src/server/engagement/places.ts

@@ -24,6 +24,7 @@
  */
 import { existsSync, readFileSync } from "node:fs";
 import { join } from "node:path";
+import { placesFromManifest } from "./manifestPlaces.js";
 
 /** Where the manifest sits, in a source tree and in a built artifact alike. */
 const MANIFEST = "routes.manifest.json";
@@ -54,22 +55,7 @@ export function engagementPlacesFor(dir: string): EngagementPlace[] {
 	const path = join(dir, MANIFEST);
 	if (!existsSync(path)) return [];
 	try {
-		const doc = JSON.parse(readFileSync(path, "utf8")) as unknown;
-		const routes = Array.isArray(doc)
-			? doc
-			: ((doc as { routes?: unknown }).routes as unknown[] | undefined);
-		if (!Array.isArray(routes)) return [];
-		const seen = new Set<string>();
-		const places: EngagementPlace[] = [];
-		for (const raw of routes) {
-			const r = raw as { id?: unknown; path?: unknown };
-			if (typeof r.id !== "string" || !r.id || seen.has(r.id)) continue;
-			seen.add(r.id);
-			places.push({ id: r.id, path: typeof r.path === "string" ? r.path : "" });
-		}
-		// Sorted so the allowlist a board renders is stable between deployments.
-		places.sort((a, b) => a.id.localeCompare(b.id));
-		return places;
+		return placesFromManifest(JSON.parse(readFileSync(path, "utf8")) as unknown);
 	} catch {
 		return [];
 	}

package/src/server/notifications/d1.spec.ts

@@ -0,0 +1,179 @@
+/**
+ * The D1 notification service is the sync one over D1 — the same table, the same rows for the
+ * same notifications, the same routes minus the live stream (task 393, `apps/family`).
+ *
+ * Parity is proven at the STORE seam, which is the only thing that changed: cwip's own center
+ * drives cwip's sqlite store and the D1 store through one scenario, with one clock and one id
+ * sequence, and every result and every row is compared. It runs over the local driver and over
+ * the fake D1 binding, which refuses `undefined` binds exactly as D1 does.
+ */
+import { Database } from "bun:sqlite";
+import { describe, expect, test } from "bun:test";
+import {
+	createNotificationCenter,
+	createSqliteNotificationStore,
+	type NotificationCenter,
+	type NotificationDb,
+} from "cwip/notifications";
+import { Hono } from "hono";
+import { createFakeD1Binding } from "../d1/fakeD1.js";
+import { createLocalD1 } from "../d1/local.js";
+import { createRemoteD1 } from "../d1/remote.js";
+import type { D1LikeDatabase } from "../d1/types.js";
+import {
+	createD1NotificationService,
+	createD1NotificationStore,
+	NOTIFICATIONS_DDL,
+	notificationsDdl,
+} from "./d1.js";
+import { NOTIFICATION_MIGRATIONS } from "./migrations.js";
+
+const DRIVERS: Record<string, (sqlite: Database) => D1LikeDatabase> = {
+	local: (sqlite) => createLocalD1(sqlite),
+	"remote (fake D1 binding)": (sqlite) => createRemoteD1(createFakeD1Binding(sqlite)),
+};
+const local = DRIVERS.local as (sqlite: Database) => D1LikeDatabase;
+
+const withDdl = (ddl: readonly string[] = NOTIFICATIONS_DDL): Database => {
+	const sqlite = new Database(":memory:");
+	for (const statement of ddl) sqlite.run(statement);
+	return sqlite;
+};
+
+/** A clock that ticks 1 ms per call and a sequential id — identical for both centers. */
+const seams = () => {
+	let t = 1_000;
+	let n = 0;
+	return { now: () => t++, newId: () => `n${++n}`, onError: (error: unknown) => { throw error; } };
+};
+
+const SCENARIO: ReadonlyArray<(c: NotificationCenter) => Promise<unknown>> = [
+	(c) => c.notify("u1", { type: "share.grant", title: "Shared with you", body: "Grandma", link: "/people/p1" }),
+	(c) => c.notify("u1", { type: "share.grant", title: "Two things", groupKey: "g1", severity: "warning" }),
+	(c) => c.notify("u1", { type: "share.grant", title: "Three things", groupKey: "g1" }),
+	(c) => c.notify("u2", { type: "auth.login", title: "New sign-in", source: "auth", actorId: "a1", actorName: "Ann", resourceType: "session", resourceId: "s1" }),
+	(c) => c.notify("u1", { type: "plain", title: "A later row" }),
+	(c) => c.list({ userId: "u1" }),
+	(c) => c.list({ userId: "u1", limit: 1 }),
+	(c) => c.list({ userId: "u1", limit: 1, offset: 1 }),
+	(c) => c.unreadCount("u1"),
+	(c) => c.get("u1", "n1"),
+	(c) => c.get("u2", "n1"),
+	(c) => c.markRead("u1", "n1", true),
+	(c) => c.markRead("u1", "n1", true),
+	(c) => c.list({ userId: "u1", filter: "unread" }),
+	(c) => c.markAllRead("u1"),
+	(c) => c.markRead("u1", "n1", false),
+	(c) => c.setDone("u1", "n2", true),
+	(c) => c.list({ userId: "u1", filter: "done" }),
+	(c) => c.notify("u1", { type: "share.grant", title: "g1 again, after done", groupKey: "g1" }),
+	(c) => c.doneAll("u2"),
+	(c) => c.remove("u1", "n4"),
+	(c) => c.remove("u1", "nothing"),
+	(c) => c.pruneDone(0),
+	(c) => c.list({ userId: "u2", filter: "all" }),
+	(c) => c.unreadCount("nobody"),
+];
+
+describe("cursedbelt-server/notifications/d1", () => {
+	for (const [name, driver] of Object.entries(DRIVERS)) {
+		test(`🔴 parity over the ${name} driver: every result and every row match cwip's sqlite store`, async () => {
+			const syncDb = new Database(":memory:");
+			const sync = createNotificationCenter({
+				store: createSqliteNotificationStore(syncDb as unknown as NotificationDb),
+				...seams(),
+			});
+			const d1Sqlite = withDdl();
+			const d1 = createNotificationCenter({ store: createD1NotificationStore(driver(d1Sqlite)), ...seams() });
+			const results: unknown[] = [];
+			for (const [index, step] of SCENARIO.entries()) {
+				const expected = await step(sync);
+				const actual = await step(d1);
+				expect({ step: index, result: actual }).toEqual({ step: index, result: expected });
+				results.push(actual);
+			}
+			const table = (db: Database) => db.query("SELECT * FROM notifications ORDER BY rowid").all();
+			expect(table(d1Sqlite)).toEqual(table(syncDb));
+			// Not vacuous: a group coalesced to a count of 2, the prune removed a done row, and
+			// rows survived it.
+			expect(JSON.stringify(results)).toContain('"count":2');
+			expect(results[SCENARIO.length - 3]).toBeGreaterThan(0);
+			expect(table(d1Sqlite).length).toBeGreaterThan(1);
+		});
+	}
+
+	test("the DDL builds exactly the table cwip's store and NOTIFICATION_MIGRATIONS build", () => {
+		const shape = (db: Database) =>
+			(
+				db
+					.query("SELECT type, name, sql FROM sqlite_master WHERE tbl_name = 'notifications' AND sql IS NOT NULL ORDER BY name")
+					.all() as { type: string; name: string; sql: string }[]
+			).map((r) => ({ ...r, sql: r.sql.replace(/\s+/g, " ").replace("IF NOT EXISTS ", "").trim() }));
+		const viaStore = new Database(":memory:");
+		createSqliteNotificationStore(viaStore as unknown as NotificationDb);
+		const viaMigration = new Database(":memory:");
+		for (const migration of NOTIFICATION_MIGRATIONS) migration.up(viaMigration);
+		expect(shape(withDdl())).toEqual(shape(viaStore));
+		expect(shape(withDdl())).toEqual(shape(viaMigration));
+		expect(shape(viaStore).length).toBe(3);
+		// A renamed table carries its name into both indexes.
+		expect(notificationsDdl("inbox").join("\n")).toContain("idx_inbox_group ON inbox(");
+	});
+
+	test("🔴 a table name is an identifier or it is refused — it is interpolated into SQL", () => {
+		expect(() => notificationsDdl("notifications; DROP TABLE x")).toThrow(/invalid table identifier/);
+		expect(() => createD1NotificationStore(local(withDdl()), { table: "a b" })).toThrow(/invalid table identifier/);
+	});
+
+	test("🔴 coalescing is enforced by the index on D1 too — a second open row in a group is refused", async () => {
+		const store = createD1NotificationStore(local(withDdl()));
+		const row = (id: string) => ({
+			id,
+			userId: "u1",
+			createdAt: 0,
+			updatedAt: 0,
+			type: "t",
+			severity: "info" as const,
+			title: "x",
+			groupKey: "g",
+			count: 1,
+			read: false,
+			done: false,
+		});
+		await store.insert(row("a"));
+		await expect(store.insert(row("b"))).rejects.toThrow(/UNIQUE constraint/);
+		expect(await store.unreadCount("u1")).toBe(1);
+	});
+
+	test("🔴 runs no DDL: on a database without the table it creates nothing and fails loudly", async () => {
+		const sqlite = new Database(":memory:");
+		const service = createD1NotificationService({ db: local(sqlite) });
+		expect(sqlite.query("SELECT COUNT(*) AS n FROM sqlite_master").get()).toEqual({ n: 0 });
+		await expect(service.store.unreadCount("u1")).rejects.toThrow(/no such table/);
+	});
+
+	test("the service mounts the inbox routes, user-scoped, with no hub and no stream route", async () => {
+		let who: string | null = "u1";
+		const service = createD1NotificationService({ db: local(withDdl()), onError: () => {} });
+		expect(service.hub).toBeNull();
+		const app = new Hono();
+		service.mount(app, { authorize: () => who });
+		await service.center.notify("u1", { type: "share.grant", title: "Shared with you", link: "/people/p1" });
+		await service.center.notify("u2", { type: "share.grant", title: "Not yours" });
+
+		const list = (await (await app.request("/api/notifications")).json()) as { items: { id: string; title: string }[] };
+		expect(list.items.map((n) => n.title)).toEqual(["Shared with you"]);
+		expect(await (await app.request("/api/notifications/unread-count")).json()).toEqual({ count: 1 });
+		const id = list.items[0]?.id as string;
+		expect(await (await app.request(`/api/notifications/${id}/read`, { method: "POST" })).json()).toEqual({ changed: true });
+		expect(await (await app.request("/api/notifications/unread-count")).json()).toEqual({ count: 0 });
+		// u2's row cannot be reached by u1's session, even by id.
+		const u2 = (await service.center.list({ userId: "u2" })).items[0]?.id as string;
+		expect((await app.request(`/api/notifications/${u2}`)).status).toBe(404);
+		// No hub, so no stream: the client's poll transport falls back from the 404.
+		expect((await app.request("/api/notifications/stream")).status).not.toBe(200);
+		who = null;
+		expect((await app.request("/api/notifications")).status).toBe(401);
+		service.close();
+	});
+});