cursedbelt-server 4.27.0 → 4.29.0

package/dist/server/activity/store.js

@@ -1,170 +1,39 @@
-import { isActivityAction, isActivityOutcome, } from "cursedbelt-core/activity/model";
 import { runMigrations } from "../migration/runner.js";
-import { ACTIVITY_EVENTS_TABLE, ACTIVITY_MIGRATIONS } from "./migrations.js";
-const DEFAULT_LIMIT = 100;
-const MAX_LIMIT = 1000;
-const MAX_FACET = 25;
-/** `%` and `_` are wildcards and `\` is the escape — a note containing any of
- *  them must still search literally. */
-const likeContains = (value) => `%${value.replace(/[\\%_]/g, (ch) => `\\${ch}`)}%`;
-const toEvent = (row) => ({
-    id: `${row.source}:${row.seq}`,
-    source: row.source,
-    at: row.at,
-    app: row.app,
-    actor: row.actor,
-    action: row.action,
-    resource: row.kind === null || row.resource_id === null
-        ? null
-        : { app: row.app, kind: row.kind, id: row.resource_id },
-    outcome: isActivityOutcome(row.outcome) ? row.outcome : "ok",
-    note: row.note ?? "",
-    data: parseData(row.data),
-});
-/** A row whose `data` is unreadable must not take the page down with it — the
- *  event still says who did what, which is the part that matters. */
-function parseData(raw) {
-    if (!raw)
-        return null;
-    try {
-        const parsed = JSON.parse(raw);
-        return parsed && typeof parsed === "object" && !Array.isArray(parsed)
-            ? parsed
-            : { value: parsed };
-    }
-    catch {
-        return { unparsed: raw };
-    }
-}
+import { ACTIVITY_MIGRATIONS } from "./migrations.js";
+import { ACTIVITY_SQL, buildStream, facetLimit, MAX_FACET, pageLimit, prepareRecord, toStreamEvent, } from "./query.js";
 export function createActivityLog(options) {
     const { db, app } = options;
     const now = options.now ?? (() => new Date().toISOString());
     const registered = options.sources ?? [];
     runMigrations(db, ACTIVITY_MIGRATIONS);
-    const insert = db.query(`INSERT INTO ${ACTIVITY_EVENTS_TABLE}
-		   (at, app, actor, action, kind, resource_id, outcome, note, data)
-		 VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`);
-    const tableExists = (name) => !!db
-        .query("SELECT 1 AS ok FROM sqlite_master WHERE type = 'table' AND name = ?")
-        .get(name);
+    const insert = db.query(ACTIVITY_SQL.insert);
+    const tableExists = (name) => !!db.query(ACTIVITY_SQL.tableExists).get(name);
     /** The contributors that can actually answer right now. */
     const liveSources = () => registered.filter((source) => !source.requiresTable || tableExists(source.requiresTable));
-    const OWN_SELECT = `SELECT 'log' AS source, event_id AS seq, at, app, actor, action,
-	                           kind, resource_id, outcome, note, data
-	                      FROM ${ACTIVITY_EVENTS_TABLE}`;
-    /** The union, plus the WHERE the caller asked for, plus their parameters in
-     *  bind order (sources first — they are inside the FROM). */
-    const stream = (query) => {
-        const params = [];
-        const selects = [OWN_SELECT];
-        for (const source of liveSources()) {
-            if (query.source && query.source !== source.name)
-                continue;
-            selects.push(source.sql);
-            params.push(...(source.params ?? []));
-        }
-        const where = [];
-        if (query.source) {
-            where.push("source = ?");
-            params.push(query.source);
-        }
-        if (query.since) {
-            where.push("at >= ?");
-            params.push(query.since);
-        }
-        if (query.until) {
-            where.push("at <= ?");
-            params.push(query.until);
-        }
-        if (query.actor) {
-            where.push("LOWER(actor) = LOWER(?)");
-            params.push(query.actor);
-        }
-        if (query.action) {
-            if (query.action.endsWith(".")) {
-                where.push("action LIKE ? ESCAPE '\\'");
-                params.push(`${query.action.replace(/[\\%_]/g, (ch) => `\\${ch}`)}%`);
-            }
-            else {
-                where.push("action = ?");
-                params.push(query.action);
-            }
-        }
-        if (query.kind) {
-            where.push("kind = ?");
-            params.push(query.kind);
-        }
-        if (query.resourceId) {
-            where.push("resource_id = ?");
-            params.push(query.resourceId);
-        }
-        if (query.outcome) {
-            where.push("outcome = ?");
-            params.push(query.outcome);
-        }
-        if (query.q) {
-            where.push("(actor LIKE ? ESCAPE '\\' OR action LIKE ? ESCAPE '\\' OR note LIKE ? ESCAPE '\\' OR IFNULL(resource_id, '') LIKE ? ESCAPE '\\')");
-            const like = likeContains(query.q);
-            params.push(like, like, like, like);
-        }
-        // `query.source` naming a contributor that is not live leaves only the own
-        // select, filtered to a source it cannot be — an empty result, which is the
-        // honest answer rather than every row.
-        const sql = `SELECT * FROM (${selects.join("\n UNION ALL\n")}) AS stream${where.length ? ` WHERE ${where.join(" AND ")}` : ""}`;
-        return { sql, params };
-    };
+    const stream = (query) => buildStream(query, liveSources());
     return {
         app,
         record(input) {
-            if (!isActivityAction(input.action)) {
-                throw new Error(`activity: "${input.action}" is not an action — use lowercase subject.verb, e.g. "backup.delete"`);
-            }
-            const actor = input.actor?.trim();
-            if (!actor) {
-                // An event that cannot say who is a log line, not an audit trail.
-                throw new Error(`activity: ${input.action} has no actor`);
-            }
-            const at = input.at ?? now();
-            const outcome = input.outcome ?? "ok";
-            const data = input.data ? JSON.stringify(input.data) : null;
-            const info = insert.run(at, app, actor, input.action, input.resource?.kind ?? null, input.resource?.id ?? null, outcome, input.note ?? "", data);
-            return {
-                id: `log:${Number(info.lastInsertRowid)}`,
-                source: "log",
-                at,
-                app,
-                actor,
-                action: input.action,
-                resource: input.resource ? { app, ...input.resource } : null,
-                outcome,
-                note: input.note ?? "",
-                data: input.data ?? null,
-            };
+            const { binds, event } = prepareRecord(app, input, now);
+            const info = insert.run(...binds);
+            return { id: `log:${Number(info.lastInsertRowid)}`, ...event };
         },
         query(query = {}) {
-            const limit = Math.min(MAX_LIMIT, Math.max(1, Math.floor(query.limit ?? DEFAULT_LIMIT)));
+            const limit = pageLimit(query.limit);
             const { sql, params } = stream(query);
-            // One row past the limit, so "there is more" is a fact rather than a
-            // guess made from `rows.length === limit`.
-            const rows = db
-                .query(`${sql} ORDER BY at DESC, seq DESC LIMIT ?`)
-                .all(...params, limit + 1);
+            const rows = db.query(ACTIVITY_SQL.page(sql)).all(...params, limit + 1);
             const truncated = rows.length > limit;
-            return { events: rows.slice(0, limit).map(toEvent), limit, truncated };
+            return { events: rows.slice(0, limit).map(toStreamEvent), limit, truncated };
         },
         count(query = {}) {
             const { sql, params } = stream(query);
-            const row = db.query(`SELECT COUNT(*) AS n FROM (${sql})`).get(...params);
+            const row = db.query(ACTIVITY_SQL.count(sql)).get(...params);
             return row?.n ?? 0;
         },
         facets(query = {}, limit = MAX_FACET) {
             const { sql, params } = stream(query);
-            const capped = Math.min(MAX_FACET, Math.max(1, Math.floor(limit)));
-            const dimension = (column) => db
-                .query(`SELECT ${column} AS value, COUNT(*) AS count FROM (${sql})
-							  WHERE ${column} IS NOT NULL AND ${column} <> ''
-							  GROUP BY ${column} ORDER BY count DESC, value ASC LIMIT ?`)
-                .all(...params, capped).map((row) => ({ value: row.value, count: row.count }));
+            const capped = facetLimit(limit);
+            const dimension = (column) => db.query(ACTIVITY_SQL.facet(sql, column)).all(...params, capped).map((row) => ({ value: row.value, count: row.count }));
             return {
                 actions: dimension("action"),
                 actors: dimension("actor"),

package/dist/server/metrics/metricsBuffer.d.ts

@@ -27,8 +27,6 @@ export interface MetricRow {
     region?: string | null;
     city?: string | null;
 }
-/** The optional place columns, in insert order. Each is written only when the table HAS it. */
-export declare const PLACE_COLUMNS: readonly ["country", "region", "city"];
 export interface MetricsBufferOptions {
     db: Database;
     /** Flush cadence in ms. Default: 1500. */

package/dist/server/metrics/metricsBuffer.js

@@ -1,5 +1,8 @@
-/** The optional place columns, in insert order. Each is written only when the table HAS it. */
-export const PLACE_COLUMNS = ['country', 'region', 'city'];
+import { PLACE_COLUMNS } from './requestPlace.js';
+// Every place column is a `MetricRow` field — a column declared in `requestPlace.ts` that this
+// row cannot carry fails to compile here rather than inserting `undefined` for ever.
+const _placeColumnsAreRowFields = PLACE_COLUMNS;
+void _placeColumnsAreRowFields;
 export function createMetricsBuffer(opts) {
     const { db, flushIntervalMs = 1500, maxSize = 5000 } = opts;
     let buffer = [];

package/dist/server/metrics/requestPlace.d.ts

@@ -30,6 +30,14 @@ export interface RequestPlace {
 }
 /** Place one request, or `null` when it cannot. Must not throw — but a throw is caught and read as `null`. */
 export type RequestLocator = (request: Request) => RequestPlace | null;
+/**
+ * The place columns, in insert order — the ONE declaration every reader and migration uses
+ * (`metricsBuffer` writes them, an app's reader allows them, an app's migration adds them).
+ * Exported through `cursedbelt-server/telemetry` since 4.29.0 (task 2141): until then it was
+ * private to `metricsBuffer.ts`, so flix, station and desk each declared their own copy, and a
+ * fourth column added here would have been written by the buffer and dropped by all three.
+ */
+export declare const PLACE_COLUMNS: readonly ["country", "region", "city"];
 /** Each place field is capped so three of them can never crowd the 5120-byte Analytics Engine blob budget. */
 export declare const PLACE_FIELD_MAX_CHARS = 96;
 /**

package/dist/server/metrics/requestPlace.js

@@ -22,6 +22,14 @@
  *
  * Worker-safe: no `bun:` import (`telemetryIsWorkerSafe.spec.ts` walks this graph).
  */
+/**
+ * The place columns, in insert order — the ONE declaration every reader and migration uses
+ * (`metricsBuffer` writes them, an app's reader allows them, an app's migration adds them).
+ * Exported through `cursedbelt-server/telemetry` since 4.29.0 (task 2141): until then it was
+ * private to `metricsBuffer.ts`, so flix, station and desk each declared their own copy, and a
+ * fourth column added here would have been written by the buffer and dropped by all three.
+ */
+export const PLACE_COLUMNS = ['country', 'region', 'city'];
 /** Each place field is capped so three of them can never crowd the 5120-byte Analytics Engine blob budget. */
 export const PLACE_FIELD_MAX_CHARS = 96;
 /** Cloudflare's "no country could be determined" code — an unknown, not a place. */

package/dist/server/notifications/d1.d.ts

@@ -0,0 +1,80 @@
+/**
+ * `cursedbelt-server/notifications/d1` — the notification service over D1, for an app a Worker
+ * serves.
+ *
+ * ── Why it exists ───────────────────────────────────────────────────────────
+ * `createNotificationService` builds cwip's `createSqliteNotificationStore` over a synchronous
+ * `bun:sqlite` handle; a Worker has neither. `apps/family`'s port to a Worker + D1 (task 393)
+ * needs the SAME inbox — the same table, the same coalescing, the same routes — so this is
+ * cwip's `NotificationStore` contract implemented over D1, handed to cwip's own
+ * `createNotificationCenter`, and mounted by the same `mountNotificationRoutes`. The engine
+ * stays cwip's; only the storage changes.
+ *
+ * ── What is the same, and what is not ─────────────────────────────────────
+ *   · The table is `createSqliteNotificationStore`'s, column for column and index for index
+ *     ({@link notificationsDdl}; `./d1.spec.ts` compares the two schemas), so coalescing is
+ *     still the partial unique index and never only a read.
+ *   · Every store method runs cwip's statement, bound identically; `./d1.spec.ts` drives both
+ *     stores through one scenario and compares every result and every row.
+ *   · 🔴 `hub` is always `null` and `{base}/stream` is never mounted. Live delivery is an
+ *     in-memory set of open streams, and a Worker isolate cannot share one with the isolate
+ *     that produced the notification — a stream route that answered 200 and never emitted
+ *     would be worse than the 404 the client already falls back from. The poll transport is
+ *     the delivery story here, exactly as it is for `live: false` on the Mac.
+ *   · 🔴 No DDL runs here, ever. The sync store migrates on construction; on D1 the table is
+ *     the app's `db/schema.sql`, built from {@link notificationsDdl} (or from an in-memory run
+ *     of `NOTIFICATION_MIGRATIONS` — the two converge, and the spec proves it).
+ *
+ * 🔴 Worker-safe: nothing reachable from here at runtime imports `bun:*`
+ * (`../telemetryIsWorkerSafe.spec.ts` walks it). Do not import `./service.js`,
+ * `./migrations.js` or `./index.js` here.
+ *
+ * ```ts
+ * import { createD1NotificationService } from "cursedbelt-server/notifications/d1";
+ *
+ * const notifications = createD1NotificationService({ db: createRemoteD1(env.DB) });
+ * notifications.mount(app, { authorize: (c) => sso.userOf(c)?.id ?? null });
+ * await notifications.center.notify(userId, { type: "share.grant", title: "Shared with you" });
+ * ```
+ */
+import { type NotificationStore } from "cwip/notifications";
+import type { D1LikeDatabase } from "../d1/types.js";
+import type { NotificationService } from "./types.js";
+export type { NotificationService, NotificationServiceMountOptions } from "./types.js";
+/** The default table — the name `createSqliteNotificationStore` and `NOTIFICATION_MIGRATIONS` use. */
+export declare const D1_NOTIFICATIONS_TABLE = "notifications";
+/**
+ * The DDL a D1 schema needs for the notification table — the FINAL shape
+ * `createSqliteNotificationStore` migrates any database to (its later `source`/`severity`
+ * columns are in the CREATE, as they are in cwip's), with both indexes. Idempotent.
+ */
+export declare function notificationsDdl(table?: string): string[];
+/** {@link notificationsDdl} for the default table. */
+export declare const NOTIFICATIONS_DDL: readonly string[];
+export interface D1NotificationStoreOptions {
+    /** Table name override (identifier-validated). Default `notifications`. */
+    table?: string;
+}
+/**
+ * cwip's `NotificationStore` over D1 — the same statements as `createSqliteNotificationStore`,
+ * awaited. Every method is user-scoped, as the contract requires. Runs no DDL.
+ */
+export declare function createD1NotificationStore(db: D1LikeDatabase, options?: D1NotificationStoreOptions): NotificationStore;
+export interface CreateD1NotificationServiceOptions {
+    /** The app's D1 handle — `createRemoteD1(env.DB)` on a Worker, `createLocalD1(sqlite)` in a test. */
+    db: D1LikeDatabase;
+    /** Table name override (identifier-validated). */
+    table?: string;
+    /** Resolve a role audience (`notifyAudience({ role })`) to user ids. */
+    resolveRole?: (role: string) => Promise<string[]>;
+    /** Producer-path failures land here. Defaults to stderr. */
+    onError?: (error: unknown, context: string) => void;
+    /** Test seams, forwarded to the center. */
+    now?: () => number;
+    newId?: () => string;
+}
+/**
+ * The whole server half over D1 — `createNotificationService`'s shape, with `hub: null`.
+ * `mount` hangs the same routes on the app, minus `{base}/stream` (see the header).
+ */
+export declare function createD1NotificationService(options: CreateD1NotificationServiceOptions): NotificationService;

package/dist/server/notifications/d1.js

@@ -0,0 +1,226 @@
+/**
+ * `cursedbelt-server/notifications/d1` — the notification service over D1, for an app a Worker
+ * serves.
+ *
+ * ── Why it exists ───────────────────────────────────────────────────────────
+ * `createNotificationService` builds cwip's `createSqliteNotificationStore` over a synchronous
+ * `bun:sqlite` handle; a Worker has neither. `apps/family`'s port to a Worker + D1 (task 393)
+ * needs the SAME inbox — the same table, the same coalescing, the same routes — so this is
+ * cwip's `NotificationStore` contract implemented over D1, handed to cwip's own
+ * `createNotificationCenter`, and mounted by the same `mountNotificationRoutes`. The engine
+ * stays cwip's; only the storage changes.
+ *
+ * ── What is the same, and what is not ─────────────────────────────────────
+ *   · The table is `createSqliteNotificationStore`'s, column for column and index for index
+ *     ({@link notificationsDdl}; `./d1.spec.ts` compares the two schemas), so coalescing is
+ *     still the partial unique index and never only a read.
+ *   · Every store method runs cwip's statement, bound identically; `./d1.spec.ts` drives both
+ *     stores through one scenario and compares every result and every row.
+ *   · 🔴 `hub` is always `null` and `{base}/stream` is never mounted. Live delivery is an
+ *     in-memory set of open streams, and a Worker isolate cannot share one with the isolate
+ *     that produced the notification — a stream route that answered 200 and never emitted
+ *     would be worse than the 404 the client already falls back from. The poll transport is
+ *     the delivery story here, exactly as it is for `live: false` on the Mac.
+ *   · 🔴 No DDL runs here, ever. The sync store migrates on construction; on D1 the table is
+ *     the app's `db/schema.sql`, built from {@link notificationsDdl} (or from an in-memory run
+ *     of `NOTIFICATION_MIGRATIONS` — the two converge, and the spec proves it).
+ *
+ * 🔴 Worker-safe: nothing reachable from here at runtime imports `bun:*`
+ * (`../telemetryIsWorkerSafe.spec.ts` walks it). Do not import `./service.js`,
+ * `./migrations.js` or `./index.js` here.
+ *
+ * ```ts
+ * import { createD1NotificationService } from "cursedbelt-server/notifications/d1";
+ *
+ * const notifications = createD1NotificationService({ db: createRemoteD1(env.DB) });
+ * notifications.mount(app, { authorize: (c) => sso.userOf(c)?.id ?? null });
+ * await notifications.center.notify(userId, { type: "share.grant", title: "Shared with you" });
+ * ```
+ */
+import { createNotificationCenter, } from "cwip/notifications";
+import { mountNotificationRoutes } from "./routes.js";
+/** The default table — the name `createSqliteNotificationStore` and `NOTIFICATION_MIGRATIONS` use. */
+export const D1_NOTIFICATIONS_TABLE = "notifications";
+const DEFAULT_LIMIT = 50;
+const assertIdentifier = (name) => {
+    if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(name)) {
+        throw new Error(`notifications: invalid table identifier: ${name}`);
+    }
+};
+/**
+ * The DDL a D1 schema needs for the notification table — the FINAL shape
+ * `createSqliteNotificationStore` migrates any database to (its later `source`/`severity`
+ * columns are in the CREATE, as they are in cwip's), with both indexes. Idempotent.
+ */
+export function notificationsDdl(table = D1_NOTIFICATIONS_TABLE) {
+    assertIdentifier(table);
+    return [
+        `CREATE TABLE IF NOT EXISTS ${table} (
+      id TEXT PRIMARY KEY,
+      user_id TEXT NOT NULL,
+      created_at INTEGER NOT NULL,
+      updated_at INTEGER NOT NULL,
+      type TEXT NOT NULL,
+      source TEXT,
+      severity TEXT NOT NULL DEFAULT 'info',
+      title TEXT NOT NULL,
+      body TEXT,
+      link TEXT,
+      resource_type TEXT,
+      resource_id TEXT,
+      actor_id TEXT,
+      actor_name TEXT,
+      group_key TEXT,
+      count INTEGER NOT NULL DEFAULT 1,
+      read INTEGER NOT NULL DEFAULT 0,
+      done INTEGER NOT NULL DEFAULT 0
+    )`,
+        `CREATE INDEX IF NOT EXISTS idx_${table}_user ON ${table}(user_id, done, read, created_at)`,
+        `CREATE UNIQUE INDEX IF NOT EXISTS idx_${table}_group ON ${table}(user_id, group_key)
+     WHERE group_key IS NOT NULL AND done = 0`,
+    ];
+}
+/** {@link notificationsDdl} for the default table. */
+export const NOTIFICATIONS_DDL = notificationsDdl();
+/** cwip's `rowToNotification`, verbatim in effect — an absent column is `undefined`, never `null`. */
+const rowToNotification = (row) => ({
+    id: row.id,
+    userId: row.user_id,
+    createdAt: row.created_at,
+    updatedAt: row.updated_at,
+    type: row.type,
+    source: row.source ?? undefined,
+    severity: row.severity ?? "info",
+    title: row.title,
+    body: row.body ?? undefined,
+    link: row.link ?? undefined,
+    resourceType: row.resource_type ?? undefined,
+    resourceId: row.resource_id ?? undefined,
+    actorId: row.actor_id ?? undefined,
+    actorName: row.actor_name ?? undefined,
+    groupKey: row.group_key ?? undefined,
+    count: row.count,
+    read: !!row.read,
+    done: !!row.done,
+});
+/**
+ * cwip's `NotificationStore` over D1 — the same statements as `createSqliteNotificationStore`,
+ * awaited. Every method is user-scoped, as the contract requires. Runs no DDL.
+ */
+export function createD1NotificationStore(db, options = {}) {
+    const table = options.table ?? D1_NOTIFICATIONS_TABLE;
+    assertIdentifier(table);
+    const insertSql = `
+    INSERT INTO ${table} (id, user_id, created_at, updated_at, type, source, severity, title,
+      body, link, resource_type, resource_id, actor_id, actor_name, group_key, count, read, done)
+    VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+  `;
+    const updateSql = `
+    UPDATE ${table} SET updated_at = ?, type = ?, source = ?, severity = ?, title = ?, body = ?,
+      link = ?, resource_type = ?, resource_id = ?, actor_id = ?, actor_name = ?, group_key = ?,
+      count = ?, read = ?, done = ?
+    WHERE id = ? AND user_id = ?
+  `;
+    /** 🔴 Every optional becomes `null` and every boolean `0/1` HERE — D1 refuses an
+     *  `undefined` bind outright, where `bun:sqlite` would have bound NULL without a word. */
+    const bindDraftColumns = (n) => [
+        n.type,
+        n.source ?? null,
+        n.severity,
+        n.title,
+        n.body ?? null,
+        n.link ?? null,
+        n.resourceType ?? null,
+        n.resourceId ?? null,
+        n.actorId ?? null,
+        n.actorName ?? null,
+        n.groupKey ?? null,
+        n.count,
+        n.read ? 1 : 0,
+        n.done ? 1 : 0,
+    ];
+    const one = async (sql, ...values) => {
+        const row = await db
+            .prepare(sql)
+            .bind(...values)
+            .first();
+        return row ? rowToNotification(row) : null;
+    };
+    const changes = async (sql, ...values) => (await db
+        .prepare(sql)
+        .bind(...values)
+        .run()).meta.changes;
+    return {
+        insert: async (n) => {
+            await db
+                .prepare(insertSql)
+                .bind(n.id, n.userId, n.createdAt, n.updatedAt, ...bindDraftColumns(n))
+                .run();
+        },
+        update: async (n) => {
+            await db
+                .prepare(updateSql)
+                .bind(n.updatedAt, ...bindDraftColumns(n), n.id, n.userId)
+                .run();
+        },
+        findOpenByGroup: (userId, groupKey) => one(`SELECT * FROM ${table} WHERE user_id = ? AND group_key = ? AND done = 0 LIMIT 1`, userId, groupKey),
+        get: (userId, id) => one(`SELECT * FROM ${table} WHERE id = ? AND user_id = ?`, id, userId),
+        list: async ({ userId, filter = "all", limit = DEFAULT_LIMIT, offset = 0, }) => {
+            const where = filter === "unread"
+                ? "user_id = ? AND done = 0 AND read = 0"
+                : filter === "done"
+                    ? "user_id = ? AND done = 1"
+                    : "user_id = ? AND done = 0";
+            // `rowid DESC` breaks a same-millisecond tie by insertion order, as cwip's store does —
+            // its comment has the measurement. D1 tables are rowid tables, so it means the same there.
+            const { results } = await db
+                .prepare(`SELECT * FROM ${table} WHERE ${where} ORDER BY created_at DESC, rowid DESC LIMIT ? OFFSET ?`)
+                .bind(userId, limit + 1, offset)
+                .all();
+            return { items: results.slice(0, limit).map(rowToNotification), hasMore: results.length > limit };
+        },
+        unreadCount: async (userId) => (await db
+            .prepare(`SELECT COUNT(*) AS n FROM ${table} WHERE user_id = ? AND done = 0 AND read = 0`)
+            .bind(userId)
+            .first("n")) ?? 0,
+        markRead: (userId, id, read) => changes(`UPDATE ${table} SET read = ? WHERE id = ? AND user_id = ? AND read != ?`, read ? 1 : 0, id, userId, read ? 1 : 0),
+        markAllRead: (userId) => changes(`UPDATE ${table} SET read = 1 WHERE user_id = ? AND done = 0 AND read = 0`, userId),
+        setDone: (userId, id, done) => changes(`UPDATE ${table} SET done = ?, read = CASE WHEN ? = 1 THEN 1 ELSE read END
+           WHERE id = ? AND user_id = ? AND done != ?`, done ? 1 : 0, done ? 1 : 0, id, userId, done ? 1 : 0),
+        doneAll: (userId) => changes(`UPDATE ${table} SET done = 1, read = 1 WHERE user_id = ? AND done = 0`, userId),
+        remove: (userId, id) => changes(`DELETE FROM ${table} WHERE id = ? AND user_id = ?`, id, userId),
+        pruneDone: (olderThanMs) => changes(`DELETE FROM ${table} WHERE done = 1 AND updated_at < ?`, olderThanMs),
+    };
+}
+/**
+ * The whole server half over D1 — `createNotificationService`'s shape, with `hub: null`.
+ * `mount` hangs the same routes on the app, minus `{base}/stream` (see the header).
+ */
+export function createD1NotificationService(options) {
+    const onError = options.onError ??
+        ((error, context) => console.error(`[notifications] ${context}:`, error instanceof Error ? error.message : error));
+    const store = createD1NotificationStore(options.db, { table: options.table });
+    const center = createNotificationCenter({
+        store,
+        resolveRole: options.resolveRole,
+        now: options.now,
+        newId: options.newId,
+        onError,
+    });
+    return {
+        center,
+        store,
+        hub: null,
+        mount(app, mountOptions) {
+            mountNotificationRoutes(app, {
+                center,
+                authorize: mountOptions.authorize,
+                basePath: mountOptions.basePath,
+                maxLimit: mountOptions.maxLimit,
+            });
+        },
+        close() {
+            // Nothing to close: there are no live streams on D1.
+        },
+    };
+}

package/dist/server/notifications/service.d.ts

@@ -13,9 +13,8 @@
  * import and no wiring to get wrong.
  */
 import type { Database } from "bun:sqlite";
-import { type NotificationCenter, type NotificationStore } from "cwip/notifications";
-import type { Context, Hono } from "hono";
-import { type NotificationHub } from "./hub.js";
+import type { NotificationService } from "./types.js";
+export type { NotificationService, NotificationServiceMountOptions } from "./types.js";
 export interface CreateNotificationServiceOptions {
     /** The app's own database — the table lands beside its rows. */
     db: Database;
@@ -38,21 +37,4 @@ export interface CreateNotificationServiceOptions {
     now?: () => number;
     newId?: () => string;
 }
-export interface NotificationServiceMountOptions {
-    /** Resolve the caller to a user id, or null to refuse. */
-    authorize: (c: Context) => string | null | Promise<string | null>;
-    /** Path prefix. Default `/api/notifications`. */
-    basePath?: string;
-    /** Largest page a caller may ask for. Default 200. */
-    maxLimit?: number;
-}
-export interface NotificationService {
-    readonly center: NotificationCenter;
-    readonly store: NotificationStore;
-    /** Null when `live: false` — there is then nothing to stream. */
-    readonly hub: NotificationHub | null;
-    mount(app: Hono, options: NotificationServiceMountOptions): void;
-    /** Drop live subscribers (shutdown, tests). Safe to call with no hub. */
-    close(): void;
-}
 export declare function createNotificationService(options: CreateNotificationServiceOptions): NotificationService;

package/dist/server/notifications/types.d.ts

@@ -0,0 +1,27 @@
+/**
+ * The notification service's shape with no driver attached — what `createNotificationService`
+ * (`bun:sqlite`) and `createD1NotificationService` (D1, `./d1.ts`) both return. It lives apart
+ * from `./service.ts` so the D1 half, which runs on `workerd`, never reaches a module that
+ * names `bun:sqlite`, not even as a type.
+ */
+import type { NotificationCenter, NotificationStore } from "cwip/notifications";
+import type { Context, Hono } from "hono";
+import type { NotificationHub } from "./hub.js";
+export interface NotificationServiceMountOptions {
+    /** Resolve the caller to a user id, or null to refuse. */
+    authorize: (c: Context) => string | null | Promise<string | null>;
+    /** Path prefix. Default `/api/notifications`. */
+    basePath?: string;
+    /** Largest page a caller may ask for. Default 200. */
+    maxLimit?: number;
+}
+export interface NotificationService {
+    readonly center: NotificationCenter;
+    readonly store: NotificationStore;
+    /** Null when `live: false`, and always on D1 (`./d1.ts`) — there is then nothing to stream,
+     *  and the client's poll transport is the whole delivery story. */
+    readonly hub: NotificationHub | null;
+    mount(app: Hono, options: NotificationServiceMountOptions): void;
+    /** Drop live subscribers (shutdown, tests). Safe to call with no hub. */
+    close(): void;
+}

package/dist/server/notifications/types.js

@@ -0,0 +1 @@
+export {};

package/dist/server/requestLog/requestMetrics.js

@@ -62,7 +62,7 @@ import { Database } from "bun:sqlite";
 import { closeSync, existsSync, mkdirSync, openSync, readSync, renameSync, statSync } from "node:fs";
 import { join } from "node:path";
 import { applyCcPragmas } from "cwip/sqlite";
-import { PLACE_COLUMNS } from "../metrics/metricsBuffer.js";
+import { PLACE_COLUMNS } from "../metrics/requestPlace.js";
 import { createTelemetrySink } from "../metrics/telemetrySink.js";
 import { requestLogger } from "../middleware/requestLogger.js";
 import { runMigrations } from "../migration/runner.js";