cursedbelt-server 4.38.0 → 4.40.0

package/dist/server/activity/migrations.js

@@ -27,4 +27,14 @@ export const ACTIVITY_MIGRATIONS = [
                 db.run(statement);
         },
     },
+    {
+        // A store that ran 0001 before the case-insensitive actor index existed never gets it from
+        // 0001 again. Idempotent, so on a fresh store (where 0001 already built it) it is a no-op.
+        name: "0002_activity_actor_ci",
+        up(db) {
+            for (const statement of ACTIVITY_DDL)
+                if (statement.includes("idx_activity_events_actor_ci"))
+                    db.run(statement);
+        },
+    },
 ];

package/dist/server/activity/schema.js

@@ -33,6 +33,14 @@ export const ACTIVITY_DDL = [
     // question, and the one a fleet-wide search runs first.
     `CREATE INDEX IF NOT EXISTS idx_activity_events_actor
 				 ON ${ACTIVITY_EVENTS_TABLE} (actor, event_id DESC)`,
+    // 🔴 The index the actor filter can actually USE. `buildStream` matches an actor
+    // case-insensitively — `LOWER(actor) = LOWER(?)` — and SQLite cannot use the plain
+    // `actor` index above for that, so every actor query scanned the stream: measured
+    // 2026-09-28 (task 2254) on auth-stage, auth's sign-in familiarity read (actor + action +
+    // outcome, on every sign-in and app-open) cost 760 rows a call and 2.2M rows in four
+    // days, growing with the log for ever. With this index: 41 rows, flat.
+    `CREATE INDEX IF NOT EXISTS idx_activity_events_actor_ci
+				 ON ${ACTIVITY_EVENTS_TABLE} (LOWER(actor), action, at DESC)`,
     // "Everything that ever happened to this record."
     `CREATE INDEX IF NOT EXISTS idx_activity_events_resource
 				 ON ${ACTIVITY_EVENTS_TABLE} (kind, resource_id, event_id DESC)`,

package/dist/server/d1/limits.d.ts

@@ -10,6 +10,13 @@
  *   · **100 bound parameters per query.** Any seed, import or bulk insert hits this. Use
  *     {@link chunkForBind}, which does the arithmetic rather than leaving it to a guess.
  *   · **2 MB per string / BLOB / row.** Nothing may store a media byte in D1.
+ *   · **5 terms per compound SELECT** — `UNION`, `UNION ALL`, `INTERSECT`, `EXCEPT`, and
+ *     every term of a recursive CTE counts. SQLite's own default is 500, so a sixth term is
+ *     green here and `too many terms in compound SELECT` on D1. Measured against production
+ *     D1 on 2026-09-26: five terms answer, six are refused, inside a CTE exactly as outside
+ *     one. `family`'s "Both families" viewport was a six-term recursive CTE, and every read
+ *     it scoped failed in production from the D1 cutover until then. Wrap extra seed terms in
+ *     a subquery — `SELECT id FROM (… UNION …)` is ONE term of the outer compound.
  *
  * The limits are asserted by the LOCAL driver as well as the remote one, which is the
  * whole point: a bulk insert that would fail in production fails on the laptop, at the
@@ -31,12 +38,29 @@ export declare const LIMITS: {
     readonly columnsPerTable: 100;
     /** Wall-clock milliseconds one query may take. */
     readonly queryDurationMs: 30000;
+    /** Terms in one compound SELECT, recursive CTEs included. SQLite's default is 500. */
+    readonly compoundSelectTerms: 5;
 };
 /**
  * Refuse a statement that D1 would refuse — checked on BOTH drivers, at `bind()` time, so
  * the failure lands on the call site that built the query rather than in production.
  */
 export declare function assertWithinLimits(sql: string, params: readonly D1LikeBindable[]): void;
+/**
+ * The most terms any ONE compound SELECT in `sql` has — `1` for a plain SELECT.
+ *
+ * Lexical, because `bun:sqlite` exposes no `sqlite3_limit`: string literals, quoted
+ * identifiers and comments are skipped, and every parenthesis opens its own count, since a
+ * parenthesised subquery or CTE body is a compound of its own. A `;` ends a statement.
+ * Multi-row `VALUES` is not counted — SQLite stopped counting it against this limit in 3.8.8.
+ */
+export declare function maxCompoundSelectTerms(sql: string): number;
+/**
+ * Refuse a statement whose compound SELECT has more terms than D1 allows — see
+ * `LIMITS.compoundSelectTerms`. Called at `prepare()`, because a statement with nothing to
+ * bind never reaches {@link assertWithinLimits}.
+ */
+export declare function assertCompoundSelectTerms(sql: string): void;
 /** Refuse a `batch()` bigger than one Worker invocation may issue. */
 export declare function assertBatchSize(count: number): void;
 /**

package/dist/server/d1/limits.js

@@ -10,6 +10,13 @@
  *   · **100 bound parameters per query.** Any seed, import or bulk insert hits this. Use
  *     {@link chunkForBind}, which does the arithmetic rather than leaving it to a guess.
  *   · **2 MB per string / BLOB / row.** Nothing may store a media byte in D1.
+ *   · **5 terms per compound SELECT** — `UNION`, `UNION ALL`, `INTERSECT`, `EXCEPT`, and
+ *     every term of a recursive CTE counts. SQLite's own default is 500, so a sixth term is
+ *     green here and `too many terms in compound SELECT` on D1. Measured against production
+ *     D1 on 2026-09-26: five terms answer, six are refused, inside a CTE exactly as outside
+ *     one. `family`'s "Both families" viewport was a six-term recursive CTE, and every read
+ *     it scoped failed in production from the D1 cutover until then. Wrap extra seed terms in
+ *     a subquery — `SELECT id FROM (… UNION …)` is ONE term of the outer compound.
  *
  * The limits are asserted by the LOCAL driver as well as the remote one, which is the
  * whole point: a bulk insert that would fail in production fails on the laptop, at the
@@ -31,6 +38,8 @@ export const LIMITS = {
     columnsPerTable: 100,
     /** Wall-clock milliseconds one query may take. */
     queryDurationMs: 30_000,
+    /** Terms in one compound SELECT, recursive CTEs included. SQLite's default is 500. */
+    compoundSelectTerms: 5,
 };
 const byteLength = (v) => {
     if (typeof v === 'string')
@@ -61,6 +70,91 @@ export function assertWithinLimits(sql, params) {
         }
     }
 }
+/**
+ * The most terms any ONE compound SELECT in `sql` has — `1` for a plain SELECT.
+ *
+ * Lexical, because `bun:sqlite` exposes no `sqlite3_limit`: string literals, quoted
+ * identifiers and comments are skipped, and every parenthesis opens its own count, since a
+ * parenthesised subquery or CTE body is a compound of its own. A `;` ends a statement.
+ * Multi-row `VALUES` is not counted — SQLite stopped counting it against this limit in 3.8.8.
+ */
+export function maxCompoundSelectTerms(sql) {
+    const stack = [0];
+    let max = 0;
+    let i = 0;
+    const n = sql.length;
+    const skipQuoted = (close) => {
+        i++;
+        while (i < n) {
+            if (sql[i] === close) {
+                // A doubled quote is an escaped one, inside the same literal.
+                if (sql[i + 1] === close && close !== ']') {
+                    i += 2;
+                    continue;
+                }
+                break;
+            }
+            i++;
+        }
+        i++;
+    };
+    while (i < n) {
+        const c = sql[i];
+        if (c === "'" || c === '"' || c === '`')
+            skipQuoted(c);
+        else if (c === '[')
+            skipQuoted(']');
+        else if (c === '-' && sql[i + 1] === '-') {
+            while (i < n && sql[i] !== '\n')
+                i++;
+        }
+        else if (c === '/' && sql[i + 1] === '*') {
+            const end = sql.indexOf('*/', i + 2);
+            i = end === -1 ? n : end + 2;
+        }
+        else if (c === '(') {
+            stack.push(0);
+            i++;
+        }
+        else if (c === ')') {
+            if (stack.length > 1)
+                stack.pop();
+            i++;
+        }
+        else if (c === ';') {
+            stack.length = 1;
+            stack[0] = 0;
+            i++;
+        }
+        else if (/[A-Za-z_]/.test(c)) {
+            let j = i + 1;
+            while (j < n && /[A-Za-z0-9_$]/.test(sql[j]))
+                j++;
+            const word = sql.slice(i, j).toUpperCase();
+            if (word === 'UNION' || word === 'INTERSECT' || word === 'EXCEPT') {
+                const top = stack.length - 1;
+                stack[top] = stack[top] + 1;
+                max = Math.max(max, stack[top]);
+            }
+            i = j;
+        }
+        else
+            i++;
+    }
+    return max + 1;
+}
+/**
+ * Refuse a statement whose compound SELECT has more terms than D1 allows — see
+ * `LIMITS.compoundSelectTerms`. Called at `prepare()`, because a statement with nothing to
+ * bind never reaches {@link assertWithinLimits}.
+ */
+export function assertCompoundSelectTerms(sql) {
+    const terms = maxCompoundSelectTerms(sql);
+    if (terms > LIMITS.compoundSelectTerms) {
+        throw new D1LimitError('terms in one compound SELECT', terms, LIMITS.compoundSelectTerms, 'D1 answers `too many terms in compound SELECT`. Fold extra terms into a subquery — ' +
+            '`SELECT id FROM (a UNION b UNION c)` is one term of the outer compound.');
+    }
+}
 /** Refuse a `batch()` bigger than one Worker invocation may issue. */
 export function assertBatchSize(count) {
     if (count > LIMITS.queriesPerInvocation) {

package/dist/server/d1/local.js

@@ -13,7 +13,7 @@
  * refused here exactly as it is refused remotely. The point of a local driver is to fail
  * the same way, early and on a laptop.
  */
-import { assertBatchSize, assertWithinLimits } from './limits.js';
+import { assertBatchSize, assertCompoundSelectTerms, assertWithinLimits } from './limits.js';
 import { D1UnsupportedError, } from './types.js';
 import { isPureReadSql, makeMeta, normalizeBinds, normalizeRows, normalizeValue } from './values.js';
 /** Shared clock, so `meta.duration` means the same thing on both sides of the seam. */
@@ -133,6 +133,7 @@ export function createLocalD1(db) {
     return {
         flavor: 'local',
         prepare(sql) {
+            assertCompoundSelectTerms(sql);
             return new LocalStatement(db, sql);
         },
         /**

package/dist/server/d1/remote.js

@@ -14,7 +14,7 @@
  * a real binding satisfies it without a cast, and the test suite can satisfy it with a
  * fake that has no `workerd` in sight.
  */
-import { assertBatchSize, assertWithinLimits } from './limits.js';
+import { assertBatchSize, assertCompoundSelectTerms, assertWithinLimits } from './limits.js';
 import { D1UnsupportedError, } from './types.js';
 import { makeMeta, normalizeBinds, normalizeRows, normalizeValue } from './values.js';
 /**
@@ -91,6 +91,7 @@ export function createRemoteD1(binding) {
     return {
         flavor: 'd1',
         prepare(sql) {
+            assertCompoundSelectTerms(sql);
             return new RemoteStatement(binding.prepare(sql), sql);
         },
         async batch(statements) {

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "cursedbelt-server",
-	"version": "4.38.0",
+	"version": "4.40.0",
 	"license": "ISC",
 	"type": "module",
 	"description": "The app-facing Bun/Hono server tier of the cursedbelt split — storage, sharing, activity, guard, sync. React-free; cursedbelt-core below it.",

package/src/barrelsReachNoOptionalPeer.spec.ts

@@ -132,19 +132,23 @@ const packageOf = (specifier: string): string | undefined => {
  * non-zero exit or an empty bundle THROWS rather than returning an empty set. That is the
  * one way a check like this dies quietly.
  */
-const scan = (entry: string, subpath: string): { packages: Set<string>; bun: Set<string> } => {
+const scan = async (entry: string, subpath: string): Promise<{ packages: Set<string>; bun: Set<string> }> => {
 	const outdir = `${process.env.TMPDIR ?? '/tmp'}/cursedbelt-server-barrel-scan/${subpath.replace(/[^a-z0-9]+/gi, '-')}`;
-	const build = Bun.spawnSync(['bun', 'build', entry, '--target=bun', '--packages=external', '--outdir', outdir], {
+	const child = Bun.spawn(['bun', 'build', entry, '--target=bun', '--packages=external', '--outdir', outdir], {
 		cwd: REPO,
+		stdin: 'ignore',
 		stdout: 'pipe',
 		stderr: 'pipe',
 	});
+	const [, stderr, exitCode] = await Promise.all([
+		new Response(child.stdout).text(),
+		new Response(child.stderr).text(),
+		child.exited,
+	]);
 	const emitted = [...new Bun.Glob('**/*.js').scanSync({ cwd: outdir, onlyFiles: true })];
 	const bundle = emitted.map((f) => readFileSync(`${outdir}/${f}`, 'utf8')).join('\n');
-	if (build.exitCode !== 0 || bundle.trim() === '') {
-		throw new Error(
-			`could not bundle ${subpath} (${entry}, exit ${build.exitCode}) — a check that cannot measure is not a passing check:\n${build.stderr.toString()}`,
-		);
+	if (exitCode !== 0 || bundle.trim() === '') {
+		throw new Error(`could not bundle ${subpath} (${entry}, exit ${exitCode}) — a check that cannot measure is not a passing check:\n${stderr}`);
 	}
 	const packages = new Set<string>();
 	const bun = new Set<string>();
@@ -168,8 +172,8 @@ const scan = (entry: string, subpath: string): { packages: Set<string>; bun: Set
  * One bundle per subpath, shared by both assertions. Bundling is the expensive part of this
  * file and the answer cannot change between two `it`s in the same run.
  */
-const scans = new Map<string, { packages: Set<string>; bun: Set<string> }>();
-const scanOnce = (entry: string, subpath: string): { packages: Set<string>; bun: Set<string> } => {
+const scans = new Map<string, Promise<{ packages: Set<string>; bun: Set<string> }>>();
+const scanOnce = (entry: string, subpath: string): Promise<{ packages: Set<string>; bun: Set<string> }> => {
 	const cached = scans.get(subpath);
 	if (cached !== undefined) return cached;
 	const fresh = scan(entry, subpath);
@@ -190,8 +194,8 @@ describe('no public subpath statically reaches what its consumers may not have',
 
 	for (const { subpath, entry } of SUBPATHS) {
 		const allowed = MAY_DRAG[subpath] ?? [];
-		it(`${subpath} drags ${allowed.length === 0 ? 'no optional peer' : allowed.join(' + ') + ' and nothing more'}`, () => {
-			const dragged = [...scanOnce(entry, subpath).packages].filter((n) => OPTIONAL_PEERS.has(n)).sort();
+		it(`${subpath} drags ${allowed.length === 0 ? 'no optional peer' : allowed.join(' + ') + ' and nothing more'}`, async () => {
+			const dragged = [...(await scanOnce(entry, subpath)).packages].filter((n) => OPTIONAL_PEERS.has(n)).sort();
 			const unexpected = dragged.filter((n) => !allowed.includes(n));
 			expect(
 				unexpected,
@@ -213,8 +217,8 @@ describe('no public subpath statically reaches what its consumers may not have',
 
 	for (const { subpath, entry } of SUBPATHS) {
 		const allowed = MAY_NEED_BUN[subpath] ?? [];
-		it(`${subpath} ${allowed.length === 0 ? 'loads on a Worker — no bun builtin' : `needs ${allowed.join(' + ')} and nothing more`}`, () => {
-			const reached = [...scanOnce(entry, subpath).bun].sort();
+		it(`${subpath} ${allowed.length === 0 ? 'loads on a Worker — no bun builtin' : `needs ${allowed.join(' + ')} and nothing more`}`, async () => {
+			const reached = [...(await scanOnce(entry, subpath)).bun].sort();
 			const unexpected = reached.filter((n) => !allowed.includes(n));
 			expect(
 				unexpected,

package/src/leafSubpathsImportNothing.spec.ts

@@ -361,16 +361,20 @@ console.log(JSON.stringify(out));
 `,
   );
 
-  const child = Bun.spawnSync(['bun', 'run', 'entry.ts'], {
+  const child = Bun.spawn(['bun', 'run', 'entry.ts'], {
     cwd: root,
+    stdin: 'ignore',
     stdout: 'pipe',
     stderr: 'pipe',
   });
-  const stdout = child.stdout.toString().trim();
-  if (child.exitCode !== 0 || stdout === '') {
-    throw new Error(
-      `the fixture could not run at all (exit ${child.exitCode}) — that is a broken check, not a passing one:\n${child.stderr.toString()}`,
-    );
+  const [stdoutRaw, stderr, exitCode] = await Promise.all([
+    new Response(child.stdout).text(),
+    new Response(child.stderr).text(),
+    child.exited,
+  ]);
+  const stdout = stdoutRaw.trim();
+  if (exitCode !== 0 || stdout === '') {
+    throw new Error(`the fixture could not run at all (exit ${exitCode}) — that is a broken check, not a passing one:\n${stderr}`);
   }
   return JSON.parse(stdout) as Record<string, Outcome>;
 };
@@ -412,16 +416,18 @@ const OPTIONAL_PEERS = new Set(
 /** `import x from "pkg"`, `import "pkg"`, `export … from "pkg"` — one line each, as bun emits. */
 const STATIC_SPECIFIER = /^(?:import|export)\s[^\n]*?["']([^"'\n]+)["'];?$|^import\s*["']([^"'\n]+)["'];?$/gm;
 
-const staticOptionalPeersOf = (entry: string): string[] => {
-  const build = Bun.spawnSync(
+const staticOptionalPeersOf = async (entry: string): Promise<string[]> => {
+  const child = Bun.spawn(
     ['bun', 'build', entry, '--target=bun', '--packages=external'],
-    { cwd: REPO, stdout: 'pipe', stderr: 'pipe' },
+    { cwd: REPO, stdin: 'ignore', stdout: 'pipe', stderr: 'pipe' },
   );
-  const bundle = build.stdout.toString();
-  if (build.exitCode !== 0 || bundle.trim() === '') {
-    throw new Error(
-      `could not bundle ${entry} (exit ${build.exitCode}) — a check that cannot measure is not a passing check:\n${build.stderr.toString()}`,
-    );
+  const [bundle, stderr, exitCode] = await Promise.all([
+    new Response(child.stdout).text(),
+    new Response(child.stderr).text(),
+    child.exited,
+  ]);
+  if (exitCode !== 0 || bundle.trim() === '') {
+    throw new Error(`could not bundle ${entry} (exit ${exitCode}) — a check that cannot measure is not a passing check:\n${stderr}`);
   }
   const found = new Set<string>();
   for (const match of bundle.matchAll(STATIC_SPECIFIER)) {
@@ -478,9 +484,9 @@ describe('barrels reach no optional peer statically', () => {
   });
 
   for (const target of NO_STATIC_OPTIONAL_PEERS) {
-    it(`${pkg.name}/${target.subpath.slice(2)} costs a consumer no optional peer to import`, () => {
+    it(`${pkg.name}/${target.subpath.slice(2)} costs a consumer no optional peer to import`, async () => {
       expect(
-        staticOptionalPeersOf(target.entry),
+        await staticOptionalPeersOf(target.entry),
         `importing ${pkg.name}/${target.subpath.slice(2)} statically pulls these OPTIONAL peers, so every consumer must install them for code it may never call. Either import the leaf module that has what you need instead of a sibling INDEX (that is how 'otplib' got in here twice), or make the dependency lazy: \`const { x } = await import('pkg')\` inside the function that needs it.`,
       ).toEqual([]);
     });

package/src/lockfileIsTracked.spec.ts

@@ -23,7 +23,6 @@
  * to skip it. Ignored-vs-not is the property that actually regresses.
  */
 import { describe, expect, test } from 'bun:test'
-import { spawnSync } from 'node:child_process'
 import { existsSync } from 'node:fs'
 import { fileURLToPath } from 'node:url'
 
@@ -37,13 +36,18 @@ describe('bun.lock is part of the checkout', () => {
     ).toBe(true)
   })
 
-  test('git is not told to ignore it', () => {
-    const git = spawnSync('git', ['check-ignore', '-q', 'bun.lock'], { cwd: repoRoot })
-    if (git.error) return // no git on this host: nothing to assert about ignore rules
+  test('git is not told to ignore it', async () => {
+    let status: number
+    try {
+      const child = Bun.spawn(['git', 'check-ignore', '-q', 'bun.lock'], { cwd: repoRoot, stdin: 'ignore', stdout: 'pipe', stderr: 'pipe' })
+      status = await child.exited
+    } catch {
+      return // no git on this host: nothing to assert about ignore rules
+    }
 
     // exit 0 = the path IS ignored; 1 = it is not; anything else = git could not tell us.
     expect(
-      git.status,
+      status,
       'bun.lock is gitignored, so a fresh clone has no lockfile and `bun install --frozen-lockfile` cannot pass there. Delete the stanza from .gitignore rather than the assertion.',
     ).not.toBe(0)
   })

package/src/server/activity/actorIndex.spec.ts

@@ -0,0 +1,25 @@
+/**
+ * 🔴 The actor filter must reach an index (task 2254).
+ *
+ * `buildStream` matches an actor with `LOWER(actor) = LOWER(?)`, which the plain `actor` index
+ * cannot serve — so until `idx_activity_events_actor_ci` every actor query scanned the stream.
+ * Measured on auth-stage, 2026-09-28: 760 rows a call on auth's sign-in familiarity read, growing
+ * with the log; 41 with the index. This pins the PLAN, so dropping the index or changing the
+ * filter's shape fails here rather than on the next bill.
+ */
+import { Database } from "bun:sqlite";
+import { expect, test } from "bun:test";
+import { buildStream } from "./query.js";
+import { ACTIVITY_DDL } from "./schema.js";
+
+test("a case-insensitive actor + action filter searches idx_activity_events_actor_ci, never a scan", () => {
+	const db = new Database(":memory:");
+	for (const ddl of ACTIVITY_DDL) db.run(ddl);
+	const insert = db.prepare("INSERT INTO activity_events (at, app, actor, action, outcome) VALUES (?, 'auth', ?, ?, 'ok')");
+	for (let i = 0; i < 500; i++) insert.run(new Date(1_790_000_000_000 + i).toISOString(), `user${i % 50}@example.com`, i % 2 ? "auth.sign-in" : "auth.app-open");
+	db.run("ANALYZE");
+	const { sql, params } = buildStream({ actor: "User7@Example.com", action: "auth.sign-in", outcome: "ok", limit: 20 }, []);
+	const plan = (db.query(`EXPLAIN QUERY PLAN ${sql}`).all(...(params as never[])) as { detail: string }[]).map((r) => r.detail).join(" | ");
+	expect(plan).toContain("idx_activity_events_actor_ci");
+	expect(plan).not.toMatch(/SCAN activity_events/);
+});

package/src/server/activity/d1.spec.ts

@@ -129,7 +129,7 @@ describe("cursedbelt-server/activity/d1", () => {
 		const migrated = new Database(":memory:");
 		runMigrations(migrated, ACTIVITY_MIGRATIONS);
 		expect(shape(withDdl(ACTIVITY_DDL))).toEqual(shape(migrated));
-		expect(shape(migrated).length).toBe(5);
+		expect(shape(migrated).length).toBe(6);
 	});
 
 	test("🔴 refuses an event that cannot be filtered or attributed, and writes nothing", async () => {

package/src/server/activity/migrations.ts

@@ -30,4 +30,12 @@ export const ACTIVITY_MIGRATIONS: readonly Migration[] = [
 			for (const statement of ACTIVITY_DDL) db.run(statement);
 		},
 	},
+	{
+		// A store that ran 0001 before the case-insensitive actor index existed never gets it from
+		// 0001 again. Idempotent, so on a fresh store (where 0001 already built it) it is a no-op.
+		name: "0002_activity_actor_ci",
+		up(db: Database): void {
+			for (const statement of ACTIVITY_DDL) if (statement.includes("idx_activity_events_actor_ci")) db.run(statement);
+		},
+	},
 ];

package/src/server/activity/schema.ts

@@ -35,6 +35,14 @@ export const ACTIVITY_DDL: readonly string[] = [
 	// question, and the one a fleet-wide search runs first.
 	`CREATE INDEX IF NOT EXISTS idx_activity_events_actor
 				 ON ${ACTIVITY_EVENTS_TABLE} (actor, event_id DESC)`,
+	// 🔴 The index the actor filter can actually USE. `buildStream` matches an actor
+	// case-insensitively — `LOWER(actor) = LOWER(?)` — and SQLite cannot use the plain
+	// `actor` index above for that, so every actor query scanned the stream: measured
+	// 2026-09-28 (task 2254) on auth-stage, auth's sign-in familiarity read (actor + action +
+	// outcome, on every sign-in and app-open) cost 760 rows a call and 2.2M rows in four
+	// days, growing with the log for ever. With this index: 41 rows, flat.
+	`CREATE INDEX IF NOT EXISTS idx_activity_events_actor_ci
+				 ON ${ACTIVITY_EVENTS_TABLE} (LOWER(actor), action, at DESC)`,
 	// "Everything that ever happened to this record."
 	`CREATE INDEX IF NOT EXISTS idx_activity_events_resource
 				 ON ${ACTIVITY_EVENTS_TABLE} (kind, resource_id, event_id DESC)`,

package/src/server/d1/limits.spec.ts

@@ -1,7 +1,15 @@
 import { Database } from 'bun:sqlite';
 import { describe, expect, test } from 'bun:test';
-import { assertBatchSize, assertWithinLimits, chunkForBind, inArray, LIMITS } from './limits.js';
+import {
+	assertBatchSize,
+	assertWithinLimits,
+	chunkForBind,
+	inArray,
+	LIMITS,
+	maxCompoundSelectTerms,
+} from './limits.js';
 import { createLocalD1 } from './local.js';
+import { createRemoteD1 } from './remote.js';
 import { D1LimitError } from './types.js';
 
 describe('D1 limits are enforced on the LOCAL driver too', () => {
@@ -52,6 +60,57 @@ describe('D1 limits are enforced on the LOCAL driver too', () => {
 		expect(() => assertWithinLimits(sql, [])).toThrow(/SQL statement length/);
 	});
 
+	describe('five terms per compound SELECT — measured against production D1, 2026-09-26', () => {
+		const union = (terms: number): string =>
+			Array.from({ length: terms }, (_, k) => `SELECT ${k + 1}`).join(' UNION ');
+
+		test('six terms are refused at prepare(), before anything is bound', () => {
+			const db = createLocalD1(new Database(':memory:'));
+			expect(() => db.prepare(union(6))).toThrow(D1LimitError);
+			expect(() => db.prepare(union(6))).toThrow(/compound SELECT/);
+		});
+
+		test('five terms run — the cap is not off by one', async () => {
+			const db = createLocalD1(new Database(':memory:'));
+			const out = await db.prepare(union(5)).all();
+			expect(out.results).toHaveLength(5);
+		});
+
+		test('a recursive CTE counts its seed AND recursive terms — the shape that broke `family`', () => {
+			const db = createLocalD1(new Database(':memory:'));
+			const six = `WITH RECURSIVE r(x) AS (SELECT 1 UNION SELECT 2 UNION SELECT 3 UNION SELECT 4
+				UNION SELECT x + 1 FROM r WHERE x < 3 UNION SELECT x + 2 FROM r WHERE x < 3) SELECT x FROM r`;
+			expect(() => db.prepare(six)).toThrow(D1LimitError);
+		});
+
+		test('a subquery is ONE term of the outer compound — the documented remedy passes', async () => {
+			const db = createLocalD1(new Database(':memory:'));
+			const folded = `WITH RECURSIVE r(x) AS (SELECT x FROM (SELECT 1 AS x UNION SELECT 2 UNION SELECT 3 UNION SELECT 4)
+				UNION SELECT x + 10 FROM r WHERE x < 3 UNION SELECT x + 20 FROM r WHERE x < 3) SELECT x FROM r`;
+			expect(maxCompoundSelectTerms(folded)).toBe(4);
+			const out = await db.prepare(folded).all();
+			expect(out.results.length).toBeGreaterThan(4);
+		});
+
+		test('UNION inside a string, a quoted name or a comment is not a term', () => {
+			const sql = `SELECT 'a UNION b UNION c UNION d UNION e UNION f' AS "UNION UNION UNION UNION UNION"
+				-- UNION UNION UNION UNION UNION
+				/* UNION UNION UNION UNION UNION */ FROM [UNION UNION UNION UNION UNION]`;
+			expect(maxCompoundSelectTerms(sql)).toBe(1);
+		});
+
+		test('separate statements and sibling subqueries are counted apart', () => {
+			expect(maxCompoundSelectTerms(`${union(3)}; ${union(3)}`)).toBe(3);
+			expect(maxCompoundSelectTerms(`SELECT * FROM (${union(3)}) JOIN (${union(3)})`)).toBe(3);
+			expect(maxCompoundSelectTerms(`SELECT 1 UNION ALL SELECT 2 INTERSECT SELECT 3 EXCEPT SELECT 4`)).toBe(4);
+		});
+
+		test('the remote driver refuses too, so a Worker fails with the remedy rather than D1\'s bare error', () => {
+			const binding = { prepare: () => ({}) } as unknown as Parameters<typeof createRemoteD1>[0];
+			expect(() => createRemoteD1(binding).prepare(union(6))).toThrow(D1LimitError);
+		});
+	});
+
 	test('a batch over 1,000 statements is refused', () => {
 		expect(() => assertBatchSize(1_001)).toThrow(D1LimitError);
 		expect(() => assertBatchSize(1_000)).not.toThrow();

package/src/server/d1/limits.ts

@@ -10,6 +10,13 @@
  *   · **100 bound parameters per query.** Any seed, import or bulk insert hits this. Use
  *     {@link chunkForBind}, which does the arithmetic rather than leaving it to a guess.
  *   · **2 MB per string / BLOB / row.** Nothing may store a media byte in D1.
+ *   · **5 terms per compound SELECT** — `UNION`, `UNION ALL`, `INTERSECT`, `EXCEPT`, and
+ *     every term of a recursive CTE counts. SQLite's own default is 500, so a sixth term is
+ *     green here and `too many terms in compound SELECT` on D1. Measured against production
+ *     D1 on 2026-09-26: five terms answer, six are refused, inside a CTE exactly as outside
+ *     one. `family`'s "Both families" viewport was a six-term recursive CTE, and every read
+ *     it scoped failed in production from the D1 cutover until then. Wrap extra seed terms in
+ *     a subquery — `SELECT id FROM (… UNION …)` is ONE term of the outer compound.
  *
  * The limits are asserted by the LOCAL driver as well as the remote one, which is the
  * whole point: a bulk insert that would fail in production fails on the laptop, at the
@@ -33,6 +40,8 @@ export const LIMITS = {
 	columnsPerTable: 100,
 	/** Wall-clock milliseconds one query may take. */
 	queryDurationMs: 30_000,
+	/** Terms in one compound SELECT, recursive CTEs included. SQLite's default is 500. */
+	compoundSelectTerms: 5,
 } as const;
 
 const byteLength = (v: D1LikeBindable): number => {
@@ -78,6 +87,86 @@ export function assertWithinLimits(sql: string, params: readonly D1LikeBindable[
 	}
 }
 
+/**
+ * The most terms any ONE compound SELECT in `sql` has — `1` for a plain SELECT.
+ *
+ * Lexical, because `bun:sqlite` exposes no `sqlite3_limit`: string literals, quoted
+ * identifiers and comments are skipped, and every parenthesis opens its own count, since a
+ * parenthesised subquery or CTE body is a compound of its own. A `;` ends a statement.
+ * Multi-row `VALUES` is not counted — SQLite stopped counting it against this limit in 3.8.8.
+ */
+export function maxCompoundSelectTerms(sql: string): number {
+	const stack: number[] = [0];
+	let max = 0;
+	let i = 0;
+	const n = sql.length;
+	const skipQuoted = (close: string): void => {
+		i++;
+		while (i < n) {
+			if (sql[i] === close) {
+				// A doubled quote is an escaped one, inside the same literal.
+				if (sql[i + 1] === close && close !== ']') {
+					i += 2;
+					continue;
+				}
+				break;
+			}
+			i++;
+		}
+		i++;
+	};
+	while (i < n) {
+		const c = sql[i] as string;
+		if (c === "'" || c === '"' || c === '`') skipQuoted(c);
+		else if (c === '[') skipQuoted(']');
+		else if (c === '-' && sql[i + 1] === '-') {
+			while (i < n && sql[i] !== '\n') i++;
+		} else if (c === '/' && sql[i + 1] === '*') {
+			const end = sql.indexOf('*/', i + 2);
+			i = end === -1 ? n : end + 2;
+		} else if (c === '(') {
+			stack.push(0);
+			i++;
+		} else if (c === ')') {
+			if (stack.length > 1) stack.pop();
+			i++;
+		} else if (c === ';') {
+			stack.length = 1;
+			stack[0] = 0;
+			i++;
+		} else if (/[A-Za-z_]/.test(c)) {
+			let j = i + 1;
+			while (j < n && /[A-Za-z0-9_$]/.test(sql[j] as string)) j++;
+			const word = sql.slice(i, j).toUpperCase();
+			if (word === 'UNION' || word === 'INTERSECT' || word === 'EXCEPT') {
+				const top = stack.length - 1;
+				stack[top] = (stack[top] as number) + 1;
+				max = Math.max(max, stack[top] as number);
+			}
+			i = j;
+		} else i++;
+	}
+	return max + 1;
+}
+
+/**
+ * Refuse a statement whose compound SELECT has more terms than D1 allows — see
+ * `LIMITS.compoundSelectTerms`. Called at `prepare()`, because a statement with nothing to
+ * bind never reaches {@link assertWithinLimits}.
+ */
+export function assertCompoundSelectTerms(sql: string): void {
+	const terms = maxCompoundSelectTerms(sql);
+	if (terms > LIMITS.compoundSelectTerms) {
+		throw new D1LimitError(
+			'terms in one compound SELECT',
+			terms,
+			LIMITS.compoundSelectTerms,
+			'D1 answers `too many terms in compound SELECT`. Fold extra terms into a subquery — ' +
+				'`SELECT id FROM (a UNION b UNION c)` is one term of the outer compound.',
+		);
+	}
+}
+
 /** Refuse a `batch()` bigger than one Worker invocation may issue. */
 export function assertBatchSize(count: number): void {
 	if (count > LIMITS.queriesPerInvocation) {

package/src/server/d1/local.ts

@@ -15,7 +15,7 @@
  */
 
 import type { Database } from 'bun:sqlite';
-import { assertBatchSize, assertWithinLimits } from './limits.js';
+import { assertBatchSize, assertCompoundSelectTerms, assertWithinLimits } from './limits.js';
 import {
 	type D1LikeBindable,
 	type D1LikeDatabase,
@@ -171,6 +171,7 @@ export function createLocalD1(db: Database): D1LikeDatabase {
 		flavor: 'local',
 
 		prepare(sql: string): D1LikeStatement {
+			assertCompoundSelectTerms(sql);
 			return new LocalStatement(db, sql);
 		},
 

package/src/server/d1/remote.ts

@@ -15,7 +15,7 @@
  * fake that has no `workerd` in sight.
  */
 
-import { assertBatchSize, assertWithinLimits } from './limits.js';
+import { assertBatchSize, assertCompoundSelectTerms, assertWithinLimits } from './limits.js';
 import {
 	type D1LikeBindable,
 	type D1LikeDatabase,
@@ -141,6 +141,7 @@ export function createRemoteD1(binding: D1BindingLike): D1LikeDatabase {
 		flavor: 'd1',
 
 		prepare(sql: string): D1LikeStatement {
+			assertCompoundSelectTerms(sql);
 			return new RemoteStatement(binding.prepare(sql), sql);
 		},
 

package/src/server/serveBunOverload.spec.ts

@@ -20,26 +20,31 @@ import { fileURLToPath } from 'node:url';
 const DIR = fileURLToPath(new URL('./typetests/', import.meta.url));
 const TSC = fileURLToPath(new URL('../../node_modules/typescript/bin/tsc', import.meta.url));
 
-const tsc = (project: string) => {
-  const run = Bun.spawnSync(['bun', TSC, '-p', project], { stdout: 'pipe', stderr: 'pipe' });
-  return { code: run.exitCode, out: `${run.stdout.toString()}${run.stderr.toString()}` };
+const tsc = async (project: string) => {
+  const child = Bun.spawn(['bun', TSC, '-p', project], { stdin: 'ignore', stdout: 'pipe', stderr: 'pipe' });
+  const [stdout, stderr, code] = await Promise.all([
+    new Response(child.stdout).text(),
+    new Response(child.stderr).text(),
+    child.exited,
+  ]);
+  return { code, out: `${stdout}${stderr}` };
 };
 
 describe("Bun.serve's websocket overload", () => {
-  it('the trap is still live in bun’s types, and serveBun is the seam that never meets it', () => {
-    const run = tsc(`${DIR}tsconfig.json`);
+  it('the trap is still live in bun’s types, and serveBun is the seam that never meets it', async () => {
+    const run = await tsc(`${DIR}tsconfig.json`);
     expect(run.out).toBe('');
     expect(run.code).toBe(0);
   }, 60_000);
 
-  it('🔴 without the directives the SAME lines fail — so the check above can go red', () => {
+  it('🔴 without the directives the SAME lines fail — so the check above can go red', async () => {
     const source = readFileSync(`${DIR}serveBunOverload.ts`, 'utf8').replace(/^\s*\/\/ @ts-expect-error.*$/gm, '');
     const file = `${DIR}serveBunOverload.stripped.ts`;
     const project = `${DIR}tsconfig.stripped.json`;
     writeFileSync(file, source);
     writeFileSync(project, JSON.stringify({ extends: './tsconfig.json', include: ['serveBunOverload.stripped.ts'] }));
     try {
-      const run = tsc(project);
+      const run = await tsc(project);
       expect(run.code).not.toBe(0);
       const errors = run.out.split('\n').filter((line) => line.includes('error TS'));
       expect(errors).toHaveLength(2);

package/src/shippedFilesAreTracked.spec.ts

@@ -25,7 +25,6 @@
  * when `git` cannot answer — a check that silently degrades to green is worse than none.
  */
 import { describe, expect, test } from 'bun:test';
-import { spawnSync } from 'node:child_process';
 import { existsSync } from 'node:fs';
 import { fileURLToPath } from 'node:url';
 import pkg from '../package.json';
@@ -36,14 +35,15 @@ const repoRoot = fileURLToPath(new URL('..', import.meta.url));
 const shippedDirs = (): string[] =>
 	((pkg as { files?: string[] }).files ?? []).filter((f) => f !== 'dist' && existsSync(`${repoRoot}/${f}`));
 
-const git = (...args: string[]): { ok: boolean; out: string } => {
-	const r = spawnSync('git', ['-C', repoRoot, ...args], { encoding: 'utf8' });
-	return { ok: r.status === 0, out: (r.stdout ?? '').trim() };
+const git = async (...args: string[]): Promise<{ ok: boolean; out: string }> => {
+	const child = Bun.spawn(['git', '-C', repoRoot, ...args], { stdin: 'ignore', stdout: 'pipe', stderr: 'pipe' });
+	const [out, , code] = await Promise.all([new Response(child.stdout).text(), new Response(child.stderr).text(), child.exited]);
+	return { ok: code === 0, out: out.trim() };
 };
 
 describe('every file inside the published surface is tracked', () => {
-	test('git can answer at all — a degraded check must refuse, not pass', () => {
-		expect(git('rev-parse', '--is-inside-work-tree').ok, 'not a git checkout, so this check proves nothing').toBe(true);
+	test('git can answer at all — a degraded check must refuse, not pass', async () => {
+		expect((await git('rev-parse', '--is-inside-work-tree')).ok, 'not a git checkout, so this check proves nothing').toBe(true);
 	});
 
 	test('package.json names a shippable directory to scan', () => {
@@ -52,10 +52,10 @@ describe('every file inside the published surface is tracked', () => {
 		expect(shippedDirs().length, '`files` names no committed directory — nothing would be scanned').toBeGreaterThan(0);
 	});
 
-	test('no untracked file sits inside a directory `files` ships', () => {
+	test('no untracked file sits inside a directory `files` ships', async () => {
 		// --others = untracked; --exclude-standard honours .gitignore, so deliberately
 		// ignored paths (.agent.noindex, node_modules) are not offences.
-		const { ok, out } = git('ls-files', '--others', '--exclude-standard', '--', ...shippedDirs());
+		const { ok, out } = await git('ls-files', '--others', '--exclude-standard', '--', ...shippedDirs());
 		expect(ok, 'git ls-files failed').toBe(true);
 		const untracked = out === '' ? [] : out.split('\n');
 		expect(