cursedbelt-server 4.27.0 → 4.28.0

package/dist/server/sharing/store.js

@@ -1,31 +1,11 @@
 import { levelsMeeting, normalizeSubjectId, strongerAccess, } from "cursedbelt-core/sharing/model";
 import { runMigrations } from "../migration/runner.js";
-import { SHARE_EVENTS_TABLE, SHARE_GRANTS_TABLE, SHARE_GROUPS_TABLE, SHARE_GROUP_MEMBERS_TABLE, SHARE_MIGRATIONS, } from "./migrations.js";
+import { SHARE_MIGRATIONS } from "./migrations.js";
 import { sharedResourceSql } from "./sql.js";
-/** Shorthand for the common subject. `group(id)` is its sibling. */
-export const user = (id) => ({ type: "user", id });
-export const group = (id) => ({ type: "group", id });
-const toGrant = (row) => ({
-    resource: { app: row.app, kind: row.kind, id: row.resource_id },
-    subject: { type: row.subject_type, id: row.subject_id },
-    level: row.level,
-    grantedBy: row.granted_by,
-    grantedAt: row.granted_at,
-    note: row.note,
-});
-const toEvent = (row) => ({
-    id: row.event_id,
-    at: row.at,
-    action: row.action,
-    resource: row.app === null || row.kind === null || row.resource_id === null
-        ? null
-        : { app: row.app, kind: row.kind, id: row.resource_id },
-    subject: { type: row.subject_type, id: row.subject_id },
-    level: row.level,
-    previousLevel: row.previous_level,
-    actor: row.actor,
-    note: row.note,
-});
+import { eventLimit, eventsWhere, SHARE_SQL, toEvent, toGrant, } from "./statements.js";
+// The contract has no driver in it, so `./d1.ts` (which runs on `workerd`) shares it without
+// reaching this file. Re-exported so `cursedbelt-server/sharing` is unchanged.
+export { group, user } from "./contract.js";
 /**
  * Open (and migrate) the sharing tables in this database, returning the store.
  *
@@ -54,9 +34,7 @@ export function createShareStore(options) {
         }
     };
     const recordEvent = (input) => {
-        db.query(`INSERT INTO ${SHARE_EVENTS_TABLE}
-			   (at, action, app, kind, resource_id, subject_type, subject_id, level, previous_level, actor, note)
-			 VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`).run(input.at, input.action, input.resource?.app ?? null, input.resource?.kind ?? null, input.resource?.id ?? null, input.subject.type, input.subject.id, input.level, input.previousLevel ?? null, input.actor, input.note ?? "");
+        db.query(SHARE_SQL.insertEvent).run(input.at, input.action, input.resource?.app ?? null, input.resource?.kind ?? null, input.resource?.id ?? null, input.subject.type, input.subject.id, input.level, input.previousLevel ?? null, input.actor, input.note ?? "");
         const id = db.query("SELECT last_insert_rowid() AS id").get().id;
         return {
             id,
@@ -76,8 +54,7 @@ export function createShareStore(options) {
     });
     const readGrant = (target, subject) => {
         const row = db
-            .query(`SELECT * FROM ${SHARE_GRANTS_TABLE}
-				 WHERE app = ? AND kind = ? AND resource_id = ? AND subject_type = ? AND subject_id = ?`)
+            .query(SHARE_SQL.selectGrant)
             .get(app, target.kind, target.id, subject.type, subject.id);
         return row ? toGrant(row) : null;
     };
@@ -102,12 +79,7 @@ export function createShareStore(options) {
             const events = [];
             const grant = db.transaction(() => {
                 const existing = readGrant(input, subject);
-                db.query(`INSERT INTO ${SHARE_GRANTS_TABLE}
-					   (app, kind, resource_id, subject_type, subject_id, level, granted_by, granted_at, note)
-					 VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)
-					 ON CONFLICT (app, kind, resource_id, subject_type, subject_id)
-					 DO UPDATE SET level = excluded.level, granted_by = excluded.granted_by,
-					               granted_at = excluded.granted_at, note = excluded.note`).run(app, input.kind, input.id, subject.type, subject.id, input.level, input.grantedBy, at, input.note ?? "");
+                db.query(SHARE_SQL.upsertGrant).run(app, input.kind, input.id, subject.type, subject.id, input.level, input.grantedBy, at, input.note ?? "");
                 const resource = { app, kind: input.kind, id: input.id };
                 events.push(recordEvent({
                     action: existing && existing.level !== input.level ? "regrade" : "grant",
@@ -142,8 +114,7 @@ export function createShareStore(options) {
                 const existing = readGrant(input, subject);
                 if (!existing)
                     return null;
-                db.query(`DELETE FROM ${SHARE_GRANTS_TABLE}
-					 WHERE app = ? AND kind = ? AND resource_id = ? AND subject_type = ? AND subject_id = ?`).run(app, input.kind, input.id, subject.type, subject.id);
+                db.query(SHARE_SQL.deleteGrant).run(app, input.kind, input.id, subject.type, subject.id);
                 events.push(recordEvent({
                     action: "revoke",
                     resource: { app, kind: input.kind, id: input.id },
@@ -172,11 +143,11 @@ export function createShareStore(options) {
             const events = [];
             const count = db.transaction(() => {
                 const rows = db
-                    .query(`SELECT * FROM ${SHARE_GRANTS_TABLE} WHERE app = ? AND kind = ? AND resource_id = ?`)
+                    .query(SHARE_SQL.selectResourceGrants)
                     .all(app, target.kind, target.id);
                 if (rows.length === 0)
                     return 0;
-                db.query(`DELETE FROM ${SHARE_GRANTS_TABLE} WHERE app = ? AND kind = ? AND resource_id = ?`).run(app, target.kind, target.id);
+                db.query(SHARE_SQL.deleteResourceGrants).run(app, target.kind, target.id);
                 for (const row of rows) {
                     events.push(recordEvent({
                         action: "revoke",
@@ -201,11 +172,11 @@ export function createShareStore(options) {
             const events = [];
             const count = db.transaction(() => {
                 const rows = db
-                    .query(`SELECT * FROM ${SHARE_GRANTS_TABLE} WHERE app = ? AND subject_type = ? AND subject_id = ?`)
+                    .query(SHARE_SQL.selectSubjectGrants)
                     .all(app, normal.type, normal.id);
                 if (rows.length === 0)
                     return 0;
-                db.query(`DELETE FROM ${SHARE_GRANTS_TABLE} WHERE app = ? AND subject_type = ? AND subject_id = ?`).run(app, normal.type, normal.id);
+                db.query(SHARE_SQL.deleteSubjectGrants).run(app, normal.type, normal.id);
                 for (const row of rows) {
                     events.push(recordEvent({
                         action: "revoke",
@@ -224,25 +195,14 @@ export function createShareStore(options) {
         },
         /** Who can see this record, strongest first then oldest — the panel's read. */
         listForResource(target) {
-            const rows = db
-                .query(`SELECT * FROM ${SHARE_GRANTS_TABLE}
-					 WHERE app = ? AND kind = ? AND resource_id = ?
-					 -- Strongest first, then oldest. Spelled as a CASE rather than an
-					 -- ORDER BY on level, which happens to work only because 'write'
-					 -- sorts after 'read' and would silently mis-order a third level.
-					 ORDER BY CASE level WHEN 'write' THEN 0 ELSE 1 END, granted_at ASC`)
-                .all(app, target.kind, target.id);
+            const rows = db.query(SHARE_SQL.listForResource).all(app, target.kind, target.id);
             return rows.map(toGrant);
         },
         /** Everything shared with one subject — "shared with you". Group grants are
          *  NOT expanded here; use {@link resourceIdsFor} for the resolved answer. */
         listForSubject(subject) {
             const normal = normalized(subject);
-            const rows = db
-                .query(`SELECT * FROM ${SHARE_GRANTS_TABLE}
-					 WHERE app = ? AND subject_type = ? AND subject_id = ?
-					 ORDER BY granted_at DESC`)
-                .all(app, normal.type, normal.id);
+            const rows = db.query(SHARE_SQL.listForSubject).all(app, normal.type, normal.id);
             return rows.map(toGrant);
         },
         /**
@@ -257,11 +217,7 @@ export function createShareStore(options) {
             if (!subjectId)
                 return "none";
             const rows = db
-                .query(`SELECT level FROM ${SHARE_GRANTS_TABLE}
-					 WHERE app = ? AND kind = ? AND resource_id = ?
-					   AND ( (subject_type = 'user' AND subject_id = ?)
-					      OR (subject_type = 'group' AND subject_id IN
-					          (SELECT group_id FROM ${SHARE_GROUP_MEMBERS_TABLE} WHERE subject_id = ?)) )`)
+                .query(SHARE_SQL.accessFor)
                 .all(app, target.kind, target.id, subjectId, subjectId);
             let access = "none";
             for (const row of rows)
@@ -276,12 +232,7 @@ export function createShareStore(options) {
                 return [];
             const levels = levelsMeeting(atLeast);
             const rows = db
-                .query(`SELECT DISTINCT resource_id FROM ${SHARE_GRANTS_TABLE}
-					 WHERE app = ? AND kind = ? AND level IN (${levels.map(() => "?").join(", ")})
-					   AND ( (subject_type = 'user' AND subject_id = ?)
-					      OR (subject_type = 'group' AND subject_id IN
-					          (SELECT group_id FROM ${SHARE_GROUP_MEMBERS_TABLE} WHERE subject_id = ?)) )
-					 ORDER BY resource_id`)
+                .query(SHARE_SQL.resourceIdsFor(levels.length))
                 .all(app, kind, ...levels, subjectId, subjectId);
             return rows.map((row) => row.resource_id);
         },
@@ -298,9 +249,7 @@ export function createShareStore(options) {
             const at = clock();
             const events = [];
             const created = db.transaction(() => {
-                db.query(`INSERT INTO ${SHARE_GROUPS_TABLE} (group_id, name, created_by, created_at, note)
-					 VALUES (?, ?, ?, ?, ?)
-					 ON CONFLICT (group_id) DO UPDATE SET name = excluded.name, note = excluded.note`).run(id, input.name, input.createdBy, at, input.note ?? "");
+                db.query(SHARE_SQL.upsertGroup).run(id, input.name, input.createdBy, at, input.note ?? "");
                 events.push(recordEvent({
                     action: "group.create",
                     resource: null,
@@ -326,7 +275,7 @@ export function createShareStore(options) {
             const at = clock();
             const events = [];
             db.transaction(() => {
-                db.query(`UPDATE ${SHARE_GROUPS_TABLE} SET name = ? WHERE group_id = ?`).run(name, groupId);
+                db.query(SHARE_SQL.renameGroup).run(name, groupId);
                 events.push(recordEvent({
                     action: "group.rename",
                     resource: null,
@@ -353,10 +302,8 @@ export function createShareStore(options) {
             const at = clock();
             const events = [];
             db.transaction(() => {
-                const grants = db
-                    .query(`SELECT * FROM ${SHARE_GRANTS_TABLE} WHERE app = ? AND subject_type = 'group' AND subject_id = ?`)
-                    .all(app, groupId);
-                db.query(`DELETE FROM ${SHARE_GRANTS_TABLE} WHERE app = ? AND subject_type = 'group' AND subject_id = ?`).run(app, groupId);
+                const grants = db.query(SHARE_SQL.selectGroupGrants).all(app, groupId);
+                db.query(SHARE_SQL.deleteGroupGrants).run(app, groupId);
                 for (const row of grants) {
                     events.push(recordEvent({
                         action: "revoke",
@@ -368,7 +315,7 @@ export function createShareStore(options) {
                         at,
                     }));
                 }
-                db.query(`DELETE FROM ${SHARE_GROUPS_TABLE} WHERE group_id = ?`).run(groupId);
+                db.query(SHARE_SQL.deleteGroup).run(groupId);
                 events.push(recordEvent({
                     action: "group.delete",
                     resource: null,
@@ -382,9 +329,7 @@ export function createShareStore(options) {
             emit(events);
         },
         listGroups() {
-            const rows = db
-                .query(`SELECT * FROM ${SHARE_GROUPS_TABLE} ORDER BY name`)
-                .all();
+            const rows = db.query(SHARE_SQL.listGroups).all();
             return rows.map((row) => ({
                 id: row.group_id,
                 name: row.name,
@@ -401,8 +346,7 @@ export function createShareStore(options) {
             const at = clock();
             const events = [];
             db.transaction(() => {
-                db.query(`INSERT INTO ${SHARE_GROUP_MEMBERS_TABLE} (group_id, subject_id, added_by, added_at)
-					 VALUES (?, ?, ?, ?) ON CONFLICT (group_id, subject_id) DO NOTHING`).run(id, member, actor, at);
+                db.query(SHARE_SQL.insertMember).run(id, member, actor, at);
                 events.push(recordEvent({
                     action: "group.join",
                     resource: null,
@@ -421,7 +365,7 @@ export function createShareStore(options) {
             const at = clock();
             const events = [];
             db.transaction(() => {
-                db.query(`DELETE FROM ${SHARE_GROUP_MEMBERS_TABLE} WHERE group_id = ? AND subject_id = ?`).run(id, member);
+                db.query(SHARE_SQL.deleteMember).run(id, member);
                 events.push(recordEvent({
                     action: "group.leave",
                     resource: null,
@@ -436,7 +380,7 @@ export function createShareStore(options) {
         },
         listGroupMembers(groupId) {
             const rows = db
-                .query(`SELECT * FROM ${SHARE_GROUP_MEMBERS_TABLE} WHERE group_id = ? ORDER BY subject_id`)
+                .query(SHARE_SQL.listMembers)
                 .all(normalizeSubjectId("group", groupId));
             return rows.map((row) => ({
                 groupId: row.group_id,
@@ -450,34 +394,17 @@ export function createShareStore(options) {
             const member = normalizeSubjectId("user", subjectId);
             if (!member)
                 return [];
-            const rows = db
-                .query(`SELECT group_id FROM ${SHARE_GROUP_MEMBERS_TABLE} WHERE subject_id = ? ORDER BY group_id`)
-                .all(member);
+            const rows = db.query(SHARE_SQL.groupIdsFor).all(member);
             return rows.map((row) => row.group_id);
         },
         // ── The audit trail ──────────────────────────────────────────────────────
         /** The trail, newest first. Filter by resource, by subject, or neither. */
         events(query = {}) {
-            const clauses = ["app IS NULL OR app = ?"];
-            const params = [app];
-            if (query.kind !== undefined) {
-                clauses.push("kind = ?");
-                params.push(query.kind);
-            }
-            if (query.id !== undefined) {
-                clauses.push("resource_id = ?");
-                params.push(query.id);
-            }
-            if (query.subject) {
-                const normal = normalized(query.subject);
-                clauses.push("subject_type = ? AND subject_id = ?");
-                params.push(normal.type, normal.id);
-            }
-            const where = clauses.map((clause) => `(${clause})`).join(" AND ");
-            const limit = Math.max(1, Math.min(query.limit ?? 200, 1000));
-            const rows = db
-                .query(`SELECT * FROM ${SHARE_EVENTS_TABLE} WHERE ${where} ORDER BY event_id DESC LIMIT ?`)
-                .all(...params, limit);
+            const { where, params } = eventsWhere(app, {
+                ...query,
+                subject: query.subject ? normalized(query.subject) : undefined,
+            });
+            const rows = db.query(SHARE_SQL.events(where)).all(...params, eventLimit(query.limit));
             return rows.map(toEvent);
         },
     };

package/docs/activity.md

@@ -40,4 +40,11 @@ a merge across apps stays labelled.
 `describeActivityEvent` / `describeActivityResource` produce the sentence a reader sees. An app
 that writes its own sentence for the same event creates a second wording that drifts.
 
+## 5. On a Worker, the same stream lives in D1
+
+`cursedbelt-server/activity/d1` (since 4.28.0, task 393) is `createD1ActivityLog` — the same
+`record`, `query`, `count`, `facets` and `sources`, each async, over the same `activity_events`
+table and the same filter semantics (one shared `query.ts`). `shareEventsSource` is re-exported
+there. It runs no DDL: `ACTIVITY_DDL` goes into the app's `db/schema.sql`. It is Worker-safe.
+
 Cite this page from an app as `cursedbelt-server/docs/activity.md`.

package/docs/notifications.md

@@ -40,4 +40,13 @@ It is not filtered by the reader's scope at read time and cannot be. Put what is
 recipient in the title and body, and let the LINK carry them to the thing, where every normal
 read filter applies (`family`'s share notification does not name the relative for this reason).
 
+## 5. On a Worker, the inbox lives in D1 and there is no live stream
+
+`cursedbelt-server/notifications/d1` (since 4.28.0, task 393) is `createD1NotificationService` —
+the same `{ center, store, mount, close }`, with cwip's center over a D1 implementation of its
+`NotificationStore` and the same table (`NOTIFICATIONS_DDL` / `notificationsDdl(table)` for the
+app's `db/schema.sql`; nothing runs DDL at request time). `hub` is always `null` and
+`{base}/stream` is not mounted: an isolate cannot share open streams, so polling (rule 1's
+backstop) is the delivery. It is Worker-safe.
+
 Cite this page from an app as `cursedbelt-server/docs/notifications.md`.

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "cursedbelt-server",
-	"version": "4.27.0",
+	"version": "4.28.0",
 	"license": "ISC",
 	"type": "module",
 	"description": "The app-facing Bun/Hono server tier of the cursedbelt split — storage, sharing, activity, guard, sync. React-free; cursedbelt-core below it.",
@@ -47,6 +47,12 @@
 			"source": "./src/server/activity/index.ts",
 			"import": "./dist/server/activity/index.js"
 		},
+		"./activity/d1": {
+			"types": "./dist/server/activity/d1.d.ts",
+			"bun": "./src/server/activity/d1.ts",
+			"source": "./src/server/activity/d1.ts",
+			"import": "./dist/server/activity/d1.js"
+		},
 		"./context": {
 			"types": "./dist/server/context.d.ts",
 			"bun": "./src/server/context.ts",
@@ -246,6 +252,12 @@
 			"source": "./src/server/notifications/index.ts",
 			"import": "./dist/server/notifications/index.js"
 		},
+		"./notifications/d1": {
+			"types": "./dist/server/notifications/d1.d.ts",
+			"bun": "./src/server/notifications/d1.ts",
+			"source": "./src/server/notifications/d1.ts",
+			"import": "./dist/server/notifications/d1.js"
+		},
 		"./resume": {
 			"types": "./dist/server/resume/index.d.ts",
 			"bun": "./src/server/resume/index.ts",
@@ -282,6 +294,12 @@
 			"source": "./src/server/sharing/index.ts",
 			"import": "./dist/server/sharing/index.js"
 		},
+		"./sharing/d1": {
+			"types": "./dist/server/sharing/d1.d.ts",
+			"bun": "./src/server/sharing/d1.ts",
+			"source": "./src/server/sharing/d1.ts",
+			"import": "./dist/server/sharing/d1.js"
+		},
 		"./sqlite": {
 			"types": "./dist/server/sqlite/index.d.ts",
 			"bun": "./src/server/sqlite/index.ts",

package/src/server/activity/d1.spec.ts

@@ -0,0 +1,169 @@
+/**
+ * The D1 activity log is the sync log, asynchronously — the same events, pages, counts, facets
+ * and sources for the same calls, over the same table (task 393, `apps/family`).
+ *
+ * The parity scenario drives both logs — each with a share store writing `share_events` into
+ * the same database, merged in through `shareEventsSource` — with one script and one clock, and
+ * compares every result and then the table. It runs over the local driver and over the fake D1
+ * binding, which refuses the binds real D1 refuses.
+ */
+import { Database } from "bun:sqlite";
+import { describe, expect, test } from "bun:test";
+import { createFakeD1Binding } from "../d1/fakeD1.js";
+import { createLocalD1 } from "../d1/local.js";
+import { createRemoteD1 } from "../d1/remote.js";
+import type { D1LikeDatabase } from "../d1/types.js";
+import { runMigrations } from "../migration/runner.js";
+import { createD1ShareStore, SHARE_DDL, user } from "../sharing/d1.js";
+import { createShareStore } from "../sharing/store.js";
+import { ACTIVITY_DDL, type AsyncActivityLog, createD1ActivityLog, shareEventsSource } from "./d1.js";
+import { ACTIVITY_MIGRATIONS } from "./migrations.js";
+import { type ActivityLog, createActivityLog } from "./store.js";
+
+const APP = "family";
+
+/** One minute per call, from a fixed start, identical for both logs. */
+const clock = () => {
+	let at = Date.parse("2026-08-11T00:00:00.000Z");
+	return () => {
+		const value = new Date(at).toISOString();
+		at += 60_000;
+		return value;
+	};
+};
+
+const DRIVERS: Record<string, (sqlite: Database) => D1LikeDatabase> = {
+	local: (sqlite) => createLocalD1(sqlite),
+	"remote (fake D1 binding)": (sqlite) => createRemoteD1(createFakeD1Binding(sqlite)),
+};
+const local = DRIVERS.local as (sqlite: Database) => D1LikeDatabase;
+
+const withDdl = (...ddl: (readonly string[])[]): Database => {
+	const sqlite = new Database(":memory:");
+	for (const statements of ddl) for (const statement of statements) sqlite.run(statement);
+	return sqlite;
+};
+
+type Grant = (email: string) => unknown;
+
+const SCENARIO: ReadonlyArray<(log: ActivityLog | AsyncActivityLog, grant: Grant) => unknown> = [
+	(log) => log.sources(),
+	(log) =>
+		log.record({
+			actor: " Curt@Example.com ",
+			action: "person.create",
+			resource: { kind: "person", id: "a" },
+			note: "100% done",
+			data: { bytes: 4096 },
+		}),
+	(_log, grant) => grant("aunt@example.com"),
+	(log) => log.record({ actor: "other@example.com", action: "person.delete", resource: { kind: "person", id: "b" } }),
+	(log) => log.record({ actor: "curt@example.com", action: "backup.create", outcome: "error", note: "nothing like it" }),
+	(log) => log.record({ actor: "curt@example.com", action: "backup.create", at: "2026-08-10T23:59:00.000Z" }),
+	(_log, grant) => grant("cousin@example.com"),
+	(log) => log.query(),
+	(log) => log.query({ limit: 2 }),
+	(log) => log.query({ limit: 10_000 }),
+	(log) => log.query({ actor: "CURT@example.com" }),
+	(log) => log.query({ action: "person." }),
+	(log) => log.query({ action: "share." }),
+	(log) => log.query({ action: "person.create" }),
+	(log) => log.query({ kind: "person", resourceId: "b" }),
+	(log) => log.query({ outcome: "error" }),
+	(log) => log.query({ since: "2026-08-11T00:02:00.000Z" }),
+	(log) => log.query({ until: "2026-08-11T00:00:30.000Z" }),
+	(log) => log.query({ q: "100%" }),
+	(log) => log.query({ q: "%d" }),
+	(log) => log.query({ source: "share" }),
+	(log) => log.query({ source: "log", limit: 1 }),
+	(log) => log.query({ source: "nothing" }),
+	(log) => log.count(),
+	(log) => log.count({ source: "share" }),
+	(log) => log.facets(),
+	(log) => log.facets({ actor: "other@example.com" }, 1),
+	(log) => log.sources(),
+];
+
+describe("cursedbelt-server/activity/d1", () => {
+	for (const [name, driver] of Object.entries(DRIVERS)) {
+		test(`🔴 parity over the ${name} driver: every page, count, facet and row match the sync log`, async () => {
+			const syncDb = new Database(":memory:");
+			const syncClock = clock();
+			const syncLog = createActivityLog({
+				db: syncDb,
+				app: APP,
+				now: syncClock,
+				sources: [shareEventsSource({ app: APP })],
+			});
+			const syncShares = createShareStore({ db: syncDb, app: APP, now: syncClock });
+
+			const d1Sqlite = withDdl(SHARE_DDL, ACTIVITY_DDL);
+			const d1 = driver(d1Sqlite);
+			const d1Clock = clock();
+			const d1Log = createD1ActivityLog({ db: d1, app: APP, now: d1Clock, sources: [shareEventsSource({ app: APP })] });
+			const d1Shares = createD1ShareStore({ db: d1, app: APP, now: d1Clock });
+
+			const grantVia =
+				(shares: { grant: (input: Parameters<typeof syncShares.grant>[0]) => unknown }): Grant =>
+				(email) =>
+					shares.grant({ kind: "person", id: "a", subject: user(email), level: "read", grantedBy: "curt@example.com" });
+
+			for (const [index, step] of SCENARIO.entries()) {
+				const expected = step(syncLog, grantVia(syncShares));
+				const actual = await step(d1Log, grantVia(d1Shares));
+				expect({ step: index, result: actual }).toEqual({ step: index, result: expected });
+			}
+			const table = (db: Database) => db.query("SELECT * FROM activity_events ORDER BY event_id").all();
+			expect(table(d1Sqlite)).toEqual(table(syncDb));
+			// Not vacuous: the merged stream really carried both contributors.
+			const merged = (await d1Log.query()).events.map((e) => e.source);
+			expect(new Set(merged)).toEqual(new Set(["log", "share"]));
+		});
+	}
+
+	test("ACTIVITY_DDL builds exactly the table and indexes the sync migration does", () => {
+		const shape = (db: Database) =>
+			db
+				.query("SELECT type, name, sql FROM sqlite_master WHERE name LIKE '%activity%' AND sql IS NOT NULL ORDER BY name")
+				.all();
+		const migrated = new Database(":memory:");
+		runMigrations(migrated, ACTIVITY_MIGRATIONS);
+		expect(shape(withDdl(ACTIVITY_DDL))).toEqual(shape(migrated));
+		expect(shape(migrated).length).toBe(5);
+	});
+
+	test("🔴 refuses an event that cannot be filtered or attributed, and writes nothing", async () => {
+		const sqlite = withDdl(ACTIVITY_DDL);
+		const log = createD1ActivityLog({ db: local(sqlite), app: "admin" });
+		await expect(log.record({ actor: "curt@example.com", action: "Backup Deleted" })).rejects.toThrow(/not an action/);
+		await expect(log.record({ actor: "curt@example.com", action: "backup" })).rejects.toThrow(/not an action/);
+		await expect(log.record({ actor: "   ", action: "backup.delete" })).rejects.toThrow(/no actor/);
+		expect(await log.count()).toBe(0);
+	});
+
+	test("is append only — no verb here can remove an event", () => {
+		const log = createD1ActivityLog({ db: local(withDdl(ACTIVITY_DDL)), app: "admin" });
+		expect(Object.keys(log).some((verb) => /delete|remove|purge|clear|prune|truncate/i.test(verb))).toBe(false);
+		expect(Object.keys(log).sort()).toEqual(
+			Object.keys(createActivityLog({ db: new Database(":memory:"), app: "admin" })).sort(),
+		);
+	});
+
+	test("a source whose table does not exist is empty, not a crash — and joins once it does", async () => {
+		const sqlite = withDdl(ACTIVITY_DDL);
+		const log = createD1ActivityLog({ db: local(sqlite), app: "notes", sources: [shareEventsSource({ app: "notes" })] });
+		await log.record({ actor: "curt@example.com", action: "note.create" });
+		expect(await log.sources()).toEqual(["log"]);
+		expect((await log.query()).events).toHaveLength(1);
+		expect((await log.facets()).actions).toHaveLength(1);
+		for (const statement of SHARE_DDL) sqlite.run(statement);
+		expect(await log.sources()).toEqual(["log", "share"]);
+	});
+
+	test("🔴 runs no DDL: on a database without the table it creates nothing and fails loudly", async () => {
+		const sqlite = new Database(":memory:");
+		const log = createD1ActivityLog({ db: local(sqlite), app: "notes" });
+		expect(sqlite.query("SELECT COUNT(*) AS n FROM sqlite_master").get()).toEqual({ n: 0 });
+		await expect(log.record({ actor: "curt@example.com", action: "note.create" })).rejects.toThrow(/no such table/);
+	});
+});