sessions in a db

it.... works?

server/.gitignore

···
+db.sqlite3*

server/db.js

···
+import { readFileSync } from 'node:fs';
+import Database from 'better-sqlite3';
+
+const SUBS_PER_ACCOUNT_LIMIT = 5;
+const SCHEMA_FNAME = './schema.sql';
+
+export class DB {
+  #stmt_insert_account;
+  #stmt_get_account;
+  #stmt_delete_account;
+  #stmt_insert_push_sub;
+  #stmt_get_all_sub_dids;
+  #stmt_get_push_subs;
+  #stmt_update_push_sub;
+  #stmt_delete_push_sub;
+  #stmt_get_push_info;
+  #transactionally;
+  #db;
+
+  constructor(filename, init = false, handleExit = true) {
+    const db = new Database(filename);
+
+    db.pragma('journal_mode = WAL');
+    db.pragma('foreign_keys = ON');
+
+    if (init) {
+      const createSchema = readFileSync(SCHEMA_FNAME, 'utf8');
+      db.exec(createSchema);
+    }
+
+    if (handleExit) { // probably a better way to do this 🤷‍♀️
+      process.on('exit', () => db.close());
+      process.on('SIGHUP', () => process.exit(128 + 1));
+      process.on('SIGINT', () => process.exit(128 + 2));
+      process.on('SIGTERM', () => process.exit(128 + 15));
+    }
+
+    this.#stmt_insert_account = db.prepare(
+      `insert into accounts (did)
+       values (?)`);
+
+    this.#stmt_get_account = db.prepare(
+      `select a.first_seen,
+              count(*) as total_subs
+         from accounts a
+         left outer join push_subs p on (p.account_did = a.did)
+        where a.did = ?
+        group by a.did`);
+
+    this.#stmt_delete_account = db.prepare(
+      `delete from accounts
+        where did = ?`);
+
+    this.#stmt_insert_push_sub = db.prepare(
+      `insert into push_subs (account_did, session, subscription)
+       values (?, ?, ?)`);
+
+    this.#stmt_get_all_sub_dids = db.prepare(
+      `select distinct account_did
+         from push_subs`);
+
+    this.#stmt_get_push_subs = db.prepare(
+      `select session,
+              subscription,
+              (julianday(CURRENT_TIMESTAMP) - julianday(last_push)) * 24 * 60 * 60
+                as 'since_last_push'
+         from push_subs
+        where account_did = ?`);
+
+    this.#stmt_update_push_sub = db.prepare(
+      `update push_subs
+          set last_push = CURRENT_TIMESTAMP,
+              total_pushes = total_pushes + 1
+        where session = ?`);
+
+    this.#stmt_delete_push_sub = db.prepare(
+      `delete from push_subs
+        where session = ?`);
+
+    this.#stmt_get_push_info = db.prepare(
+      `select created,
+              last_push,
+              total_pushes
+         from push_subs
+        where account_did = ?`);
+
+    this.#transactionally = t => db.transaction(t).immediate();
+  }
+
+  addAccount(did) {
+    this.#stmt_insert_account.run(did);
+  }
+
+  addPushSub(did, session, sub) {
+    this.#transactionally(() => {
+      const res = this.#stmt_get_account.get(did);
+      if (!res) {
+        throw new Error(`Could not find account for ${did}`);
+      }
+      if (res.total_subs >= SUBS_PER_ACCOUNT_LIMIT) {
+        throw new Error(`Too many subscriptions for ${did}`);
+      }
+      this.#stmt_insert_push_sub.run(did, session, sub);
+    });
+  }
+
+  getSubscribedDids() {
+    return this.#stmt_get_all_sub_dids.all().map(r => r.account_did);
+  }
+
+  getSubsByDid(did) {
+    return this.#stmt_get_push_subs.all(did);
+  }
+
+  updateLastPush(session) {
+    this.#stmt_update_push_sub.run(session);
+  }
+
+  deleteSub(session) {
+    this.#stmt_delete_push_sub.run(session);
+  }
+}

server/index.js

···
 const cookie = require('cookie');
 const cookieSig = require('cookie-signature');
 const webpush = require('web-push');
+const { v4: uuidv4 } = require('uuid');
+const { DB } = require('./db');
 
 // kind of silly but right now there's no way to tell spacedust that we want an alive connection
 // but don't want the notification firehose (everything filtered out)
···
 
 let spacedust;
 let spacedustEverStarted = false;
-const subs = new Map();
 
-const addSub = (did, sub) => {
-  if (!subs.has(did)) {
-    subs.set(did, []);
-  }
-  sub.t = new Date();
-  subs.get(did).push(sub);
-  updateSubs();
-};
 
-const updateSubs = () => {
+const updateSubs = db => {
   if (!spacedust) {
     console.warn('not updating subscription, no spacedust (reconnecting?)');
     return;
   }
-  const wantedSubjectDids = Array.from(subs.keys());
+  const wantedSubjectDids = db.getSubscribedDids();
   if (wantedSubjectDids.length === 0) {
     wantedSubjectDids.push(DUMMY_DID);
   }
···
   }));
 };
 
-const handleDust = async event => {
+async function push(db, pushSubscription, payload) {
+  const { session, subscription, since_last_push } = pushSubscription;
+  if (since_last_push !== null && since_last_push < 1.618) {
+    console.warn(`rate limiter: dropping too-soon push (${since_last_push})`);
+    return;
+  }
+
+  let sub;
+  try {
+    sub = JSON.parse(subscription);
+  } catch (e) {
+    console.error('failed to parse subscription json, dropping session', e);
+    db.deleteSub(session);
+    return;
+  }
+
+  try {
+    await webpush.sendNotification(sub, payload);
+  } catch (err) {
+    if (400 <= err.statusCode && err.statusCode < 500) {
+      console.info(`removing sub for ${err.statusCode}`);
+      db.deleteSub(session);
+      return;
+    } else {
+      console.warn('something went wrong for another reason', err);
+    }
+  }
+
+  db.updateLastPush(session);
+}
+
+const handleDust = db => async event => {
   console.log('got', event.data);
   let data;
   try {
···
     return;
   }
 
-  const expiredSubs = [];
-  const now = new Date();
+  const subs = db.getSubsByDid(did);
   const payload = JSON.stringify({ subject, source, source_record, timestamp });
-  console.log('pl', payload);
-  for (const sub of subs.get(did) ?? []) {
-    try {
-      if (now - sub.t < 1500) {
-        console.warn('skipping for rate limit');
-        continue;
-      }
-      sub.t = now;
-      await webpush.sendNotification(sub, payload);
-    } catch (err) {
-      if (400 <= err.statusCode && err.statusCode < 500) {
-        expiredSubs.push(sub);
-        console.info(`removing sub for ${err.statusCode}`);
-      }
-    }
-  }
-  if (expiredSubs.length > 0) {
-    const activeSubs = subs.get(did)?.filter(s => !expiredSubs.includes(s));
-    if (!activeSubs) { // concurrently removed already
-      return;
-    }
-    if (activeSubs.length === 0) {
-      console.info('removed last subscriber for', did);
-      subs.delete(did);
-      updateSubs();
-    } else {
-      subs.set(did, activeSubs);
-    }
-  }
+  await Promise.all(subs.map(pushSubscription => push(db, pushSubscription, payload)));
 };
 
-const connectSpacedust = host => {
+const connectSpacedust = (db, host) => {
   spacedust = new WebSocket(`${host}/subscribe?instant=true&wantedSubjectDids=${DUMMY_DID}`);
   let restarting = false;
 
···
     restarting = true;
     let wait = Math.round(500 + (Math.random() * 1000));
     console.info(`restarting spacedust connection in ${wait}ms...`);
-    setTimeout(() => connectSpacedust(host), wait);
+    setTimeout(() => connectSpacedust(db, host), wait);
     spacedust = null;
   }
 
-  spacedust.onopen = updateSubs
-  spacedust.onmessage = handleDust;
+  spacedust.onopen = () => updateSubs(db);
+  spacedust.onmessage = handleDust(db);
 
   spacedust.onerror = e => {
     console.error('spacedust errored:', e);
···
 });
 
 const COOKIE_BASE = { httpOnly: true, secure: true, partitioned: true, sameSite: 'None' };
-const setDidCookie = (res, did, appSecret) => res.setHeader('Set-Cookie', cookie.serialize(
-  'verified-did',
-  cookieSig.sign(did, appSecret),
+const setAccountCookie = (res, did, session, appSecret) => res.setHeader('Set-Cookie', cookie.serialize(
+  'verified-account',
+  cookieSig.sign(JSON.stringify([did, session]), appSecret),
   { ...COOKIE_BASE, maxAge: 90 * 86_400 },
 ));
-const clearDidCookie = res => res.setHeader('Set-Cookie', cookie.serialize(
-  'verified-did',
+const clearAccountCookie = res => res.setHeader('Set-Cookie', cookie.serialize(
+  'verified-account',
   '',
   { ...COOKIE_BASE, expires: new Date(0) },
 ));
-const getDidCookie = (req, res, appSecret) => {
+const getAccountCookie = (req, res, appSecret) => {
   const cookies = cookie.parse(req.headers.cookie ?? '');
-  const untrusted = cookies['verified-did'] ?? '';
-  const did = cookieSig.unsign(untrusted, appSecret);
-  if (!did) clearDidCookie(res);
-  return did;
+  const untrusted = cookies['verified-account'] ?? '';
+  const json = cookieSig.unsign(untrusted, appSecret);
+  if (!json) {
+    clearAccountCookie(res);
+    return null;
+  }
+  try {
+    const [did, session] = JSON.parse(json);
+    return [did, session];
+  } catch (e) {
+    console.warn('validated account cookie but failed to parse json', e);
+    clearAccountCookie(res);
+    return null;
+  }
 };
 
 const handleFile = (fname, ftype) => async (req, res, replace = {}) => {
···
 const handleIndex = handleFile('index.html', 'text/html');
 const handleServiceWorker = handleFile('service-worker.js', 'application/javascript');
 
-const handleVerify = async (req, res, jwks, appSecret) => {
+const handleVerify = async (db, req, res, jwks, appSecret) => {
   const body = await getRequesBody(req);
   const { token } = JSON.parse(body);
   let did;
···
     const verified = await jose.jwtVerify(token, jwks);
     did = verified.payload.sub;
   } catch (e) {
-    return clearDidCookie(res).writeHead(400).end(JSON.stringify({ reason: 'verification failed' }));
+    return clearAccountCookie(res).writeHead(400).end(JSON.stringify({ reason: 'verification failed' }));
   }
-  setDidCookie(res, did, appSecret);
+  db.addAccount(did);
+  const session = uuidv4();
+  setAccountCookie(res, did, session, appSecret);
   return res.writeHead(200).end('okayyyy');
 };
 
-const handleSubscribe = async (req, res, appSecret) => {
-  let did = getDidCookie(req, res, appSecret);
-  if (!did) return res.writeHead(400).end(JSON.stringify({ reason: 'failed to verify cookie signature' }));
+const handleSubscribe = async (db, req, res, appSecret) => {
+  let info = getAccountCookie(req, res, appSecret);
+  if (!info) return res.writeHead(400).end(JSON.stringify({ reason: 'failed to verify cookie signature' }));
+  const [did, session] = info;
 
   const body = await getRequesBody(req);
   const { sub } = JSON.parse(body);
-  addSub('did:plc:z72i7hdynmk6r22z27h6tvur', sub); // DELETEME @bsky.app (DEBUG)
-  addSub(did, sub);
+  // addSub('did:plc:z72i7hdynmk6r22z27h6tvur', sub); // DELETEME @bsky.app (DEBUG)
+  db.addPushSub(did, session, JSON.stringify(sub));
+  updateSubs(db);
   res.setHeader('Content-Type', 'application/json');
   res.writeHead(201);
   res.end('{"oh": "hi"}');
 };
 
-const requestListener = (pubkey, jwks, appSecret) => (req, res) => {
+const requestListener = (pubkey, jwks, appSecret, db) => (req, res) => {
   if (req.method === 'GET' && req.url === '/') {
     return handleIndex(req, res, { PUBKEY: pubkey });
   }
···
   }
   if (req.method === 'POST' && req.url === '/verify') {
     res.setHeaders(new Headers(CORS_PERMISSIVE(req)));
-    return handleVerify(req, res, jwks, appSecret);
+    return handleVerify(db, req, res, jwks, appSecret);
   }
 
   if (req.method === 'OPTIONS' && req.url === '/subscribe') {
···
   }
   if (req.method === 'POST' && req.url === '/subscribe') {
     res.setHeaders(new Headers(CORS_PERMISSIVE(req)));
-    return handleSubscribe(req, res, appSecret);
+    return handleSubscribe(db, req, res, appSecret);
   }
 
   res.writeHead(200);
···
   const whoamiHost = env.WHOAMI_HOST ?? 'https://who-am-i.microcosm.blue';
   const jwks = jose.createRemoteJWKSet(new URL(`${whoamiHost}/.well-known/jwks.json`));
 
+  const dbFilename = env.DB_FILE ?? './db.sqlite3';
+  const initDb = process.argv.includes('--init-db');
+  console.log(`connecting sqlite db file: ${dbFilename} (initializing: ${initDb})`);
+  const db = new DB(dbFilename, initDb);
+
   const spacedustHost = env.SPACEDUST_HOST ?? 'wss://spacedust.microcosm.blue';
-  connectSpacedust(spacedustHost);
+  connectSpacedust(db, spacedustHost);
 
   const host = env.HOST ?? 'localhost';
   const port = parseInt(env.PORT ?? 8000, 10);
 
   http
-    .createServer(requestListener(keys.publicKey, jwks, appSecret))
+    .createServer(requestListener(keys.publicKey, jwks, appSecret, db))
     .listen(port, host, () => console.log(`listening at http://${host}:${port}`));
 };
 

server/package-lock.json

···
   "packages": {
     "": {
       "dependencies": {
+        "better-sqlite3": "^12.2.0",
         "cookie": "^1.0.2",
         "cookie-signature": "^1.2.2",
         "jose": "^6.0.11",
+        "uuid": "^11.1.0",
         "web-push": "^3.6.7"
       }
     },
···
         "safer-buffer": "^2.1.0"
       }
     },
+    "node_modules/base64-js": {
+      "version": "1.5.1",
+      "resolved": "https://registry.npmjs.org/base64-js/-/base64-js-1.5.1.tgz",
+      "integrity": "sha512-AKpaYlHn8t4SVbOHCy+b5+KKgvR4vrsD8vbvrbiQJps7fKDTkjkDry6ji0rUJjC0kzbNePLwzxq8iypo41qeWA==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/feross"
+        },
+        {
+          "type": "patreon",
+          "url": "https://www.patreon.com/feross"
+        },
+        {
+          "type": "consulting",
+          "url": "https://feross.org/support"
+        }
+      ],
+      "license": "MIT"
+    },
+    "node_modules/better-sqlite3": {
+      "version": "12.2.0",
+      "resolved": "https://registry.npmjs.org/better-sqlite3/-/better-sqlite3-12.2.0.tgz",
+      "integrity": "sha512-eGbYq2CT+tos1fBwLQ/tkBt9J5M3JEHjku4hbvQUePCckkvVf14xWj+1m7dGoK81M/fOjFT7yM9UMeKT/+vFLQ==",
+      "hasInstallScript": true,
+      "license": "MIT",
+      "dependencies": {
+        "bindings": "^1.5.0",
+        "prebuild-install": "^7.1.1"
+      },
+      "engines": {
+        "node": "20.x || 22.x || 23.x || 24.x"
+      }
+    },
+    "node_modules/bindings": {
+      "version": "1.5.0",
+      "resolved": "https://registry.npmjs.org/bindings/-/bindings-1.5.0.tgz",
+      "integrity": "sha512-p2q/t/mhvuOj/UeLlV6566GD/guowlr0hHxClI0W9m7MWYkL1F0hLo+0Aexs9HSPCtR1SXQ0TD3MMKrXZajbiQ==",
+      "license": "MIT",
+      "dependencies": {
+        "file-uri-to-path": "1.0.0"
+      }
+    },
+    "node_modules/bl": {
+      "version": "4.1.0",
+      "resolved": "https://registry.npmjs.org/bl/-/bl-4.1.0.tgz",
+      "integrity": "sha512-1W07cM9gS6DcLperZfFSj+bWLtaPGSOHWhPiGzXmvVJbRLdG82sH/Kn8EtW1VqWVA54AKf2h5k5BbnIbwF3h6w==",
+      "license": "MIT",
+      "dependencies": {
+        "buffer": "^5.5.0",
+        "inherits": "^2.0.4",
+        "readable-stream": "^3.4.0"
+      }
+    },
     "node_modules/bn.js": {
       "version": "4.12.2",
       "resolved": "https://registry.npmjs.org/bn.js/-/bn.js-4.12.2.tgz",
       "integrity": "sha512-n4DSx829VRTRByMRGdjQ9iqsN0Bh4OolPsFnaZBLcbi8iXcB+kJ9s7EnRt4wILZNV3kPLHkRVfOc/HvhC3ovDw==",
       "license": "MIT"
     },
+    "node_modules/buffer": {
+      "version": "5.7.1",
+      "resolved": "https://registry.npmjs.org/buffer/-/buffer-5.7.1.tgz",
+      "integrity": "sha512-EHcyIPBQ4BSGlvjB16k5KgAJ27CIsHY/2JBmCRReo48y9rQ3MaUzWX3KVlBa4U7MyX02HdVj0K7C3WaB3ju7FQ==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/feross"
+        },
+        {
+          "type": "patreon",
+          "url": "https://www.patreon.com/feross"
+        },
+        {
+          "type": "consulting",
+          "url": "https://feross.org/support"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "base64-js": "^1.3.1",
+        "ieee754": "^1.1.13"
+      }
+    },
     "node_modules/buffer-equal-constant-time": {
       "version": "1.0.1",
       "resolved": "https://registry.npmjs.org/buffer-equal-constant-time/-/buffer-equal-constant-time-1.0.1.tgz",
       "integrity": "sha512-zRpUiDwd/xk6ADqPMATG8vc9VPrkck7T07OIx0gnjmJAnHnTVXNQG3vfvWNuiZIkwu9KrKdA1iJKfsfTVxE6NA==",
       "license": "BSD-3-Clause"
     },
+    "node_modules/chownr": {
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/chownr/-/chownr-1.1.4.tgz",
+      "integrity": "sha512-jJ0bqzaylmJtVnNgzTeSOs8DPavpbYgEr/b0YL8/2GO3xJEhInFmhKMUnEJQjZumK7KXGFhUy89PrsJWlakBVg==",
+      "license": "ISC"
+    },
     "node_modules/cookie": {
       "version": "1.0.2",
       "resolved": "https://registry.npmjs.org/cookie/-/cookie-1.0.2.tgz",
···
         }
       }
     },
+    "node_modules/decompress-response": {
+      "version": "6.0.0",
+      "resolved": "https://registry.npmjs.org/decompress-response/-/decompress-response-6.0.0.tgz",
+      "integrity": "sha512-aW35yZM6Bb/4oJlZncMH2LCoZtJXTRxES17vE3hoRiowU2kWHaJKFkSBDnDR+cm9J+9QhXmREyIfv0pji9ejCQ==",
+      "license": "MIT",
+      "dependencies": {
+        "mimic-response": "^3.1.0"
+      },
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/deep-extend": {
+      "version": "0.6.0",
+      "resolved": "https://registry.npmjs.org/deep-extend/-/deep-extend-0.6.0.tgz",
+      "integrity": "sha512-LOHxIOaPYdHlJRtCQfDIVZtfw/ufM8+rVj649RIHzcm/vGwQRXFt6OPqIFWsm2XEMrNIEtWR64sY1LEKD2vAOA==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=4.0.0"
+      }
+    },
+    "node_modules/detect-libc": {
+      "version": "2.0.4",
+      "resolved": "https://registry.npmjs.org/detect-libc/-/detect-libc-2.0.4.tgz",
+      "integrity": "sha512-3UDv+G9CsCKO1WKMGw9fwq/SWJYbI0c5Y7LU1AXYoDdbhE2AHQ6N6Nb34sG8Fj7T5APy8qXDCKuuIHd1BR0tVA==",
+      "license": "Apache-2.0",
+      "engines": {
+        "node": ">=8"
+      }
+    },
     "node_modules/ecdsa-sig-formatter": {
       "version": "1.0.11",
       "resolved": "https://registry.npmjs.org/ecdsa-sig-formatter/-/ecdsa-sig-formatter-1.0.11.tgz",
···
         "safe-buffer": "^5.0.1"
       }
     },
+    "node_modules/end-of-stream": {
+      "version": "1.4.5",
+      "resolved": "https://registry.npmjs.org/end-of-stream/-/end-of-stream-1.4.5.tgz",
+      "integrity": "sha512-ooEGc6HP26xXq/N+GCGOT0JKCLDGrq2bQUZrQ7gyrJiZANJ/8YDTxTpQBXGMn+WbIQXNVpyWymm7KYVICQnyOg==",
+      "license": "MIT",
+      "dependencies": {
+        "once": "^1.4.0"
+      }
+    },
+    "node_modules/expand-template": {
+      "version": "2.0.3",
+      "resolved": "https://registry.npmjs.org/expand-template/-/expand-template-2.0.3.tgz",
+      "integrity": "sha512-XYfuKMvj4O35f/pOXLObndIRvyQ+/+6AhODh+OKWj9S9498pHHn/IMszH+gt0fBCRWMNfk1ZSp5x3AifmnI2vg==",
+      "license": "(MIT OR WTFPL)",
+      "engines": {
+        "node": ">=6"
+      }
+    },
+    "node_modules/file-uri-to-path": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/file-uri-to-path/-/file-uri-to-path-1.0.0.tgz",
+      "integrity": "sha512-0Zt+s3L7Vf1biwWZ29aARiVYLx7iMGnEUl9x33fbB/j3jR81u/O2LbqK+Bm1CDSNDKVtJ/YjwY7TUd5SkeLQLw==",
+      "license": "MIT"
+    },
+    "node_modules/fs-constants": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/fs-constants/-/fs-constants-1.0.0.tgz",
+      "integrity": "sha512-y6OAwoSIf7FyjMIv94u+b5rdheZEjzR63GTyZJm5qh4Bi+2YgwLCcI/fPFZkL5PSixOt6ZNKm+w+Hfp/Bciwow==",
+      "license": "MIT"
+    },
+    "node_modules/github-from-package": {
+      "version": "0.0.0",
+      "resolved": "https://registry.npmjs.org/github-from-package/-/github-from-package-0.0.0.tgz",
+      "integrity": "sha512-SyHy3T1v2NUXn29OsWdxmK6RwHD+vkj3v8en8AOBZ1wBQ/hCAQ5bAQTD02kW4W9tUp/3Qh6J8r9EvntiyCmOOw==",
+      "license": "MIT"
+    },
     "node_modules/http_ece": {
       "version": "1.2.0",
       "resolved": "https://registry.npmjs.org/http_ece/-/http_ece-1.2.0.tgz",
···
         "node": ">= 14"
       }
     },
+    "node_modules/ieee754": {
+      "version": "1.2.1",
+      "resolved": "https://registry.npmjs.org/ieee754/-/ieee754-1.2.1.tgz",
+      "integrity": "sha512-dcyqhDvX1C46lXZcVqCpK+FtMRQVdIMN6/Df5js2zouUsqG7I6sFxitIC+7KYK29KdXOLHdu9zL4sFnoVQnqaA==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/feross"
+        },
+        {
+          "type": "patreon",
+          "url": "https://www.patreon.com/feross"
+        },
+        {
+          "type": "consulting",
+          "url": "https://feross.org/support"
+        }
+      ],
+      "license": "BSD-3-Clause"
+    },
     "node_modules/inherits": {
       "version": "2.0.4",
       "resolved": "https://registry.npmjs.org/inherits/-/inherits-2.0.4.tgz",
       "integrity": "sha512-k/vGaX4/Yla3WzyMCvTQOXYeIHvqOKtnqBduzTHpzpQZzAskKMhZ2K+EnBiSM9zGSoIFeMpXKxa4dYeZIQqewQ==",
+      "license": "ISC"
+    },
+    "node_modules/ini": {
+      "version": "1.3.8",
+      "resolved": "https://registry.npmjs.org/ini/-/ini-1.3.8.tgz",
+      "integrity": "sha512-JV/yugV2uzW5iMRSiZAyDtQd+nxtUnjeLt0acNdw98kKLrvuRVyB80tsREOE7yvGVgalhZ6RNXCmEHkUKBKxew==",
       "license": "ISC"
     },
     "node_modules/jose": {
···
         "safe-buffer": "^5.0.1"
       }
     },
+    "node_modules/mimic-response": {
+      "version": "3.1.0",
+      "resolved": "https://registry.npmjs.org/mimic-response/-/mimic-response-3.1.0.tgz",
+      "integrity": "sha512-z0yWI+4FDrrweS8Zmt4Ej5HdJmky15+L2e6Wgn3+iK5fWzb6T3fhNFq2+MeTRb064c6Wr4N/wv0DzQTjNzHNGQ==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
     "node_modules/minimalistic-assert": {
       "version": "1.0.1",
       "resolved": "https://registry.npmjs.org/minimalistic-assert/-/minimalistic-assert-1.0.1.tgz",
···
         "url": "https://github.com/sponsors/ljharb"
       }
     },
+    "node_modules/mkdirp-classic": {
+      "version": "0.5.3",
+      "resolved": "https://registry.npmjs.org/mkdirp-classic/-/mkdirp-classic-0.5.3.tgz",
+      "integrity": "sha512-gKLcREMhtuZRwRAfqP3RFW+TK4JqApVBtOIftVgjuABpAtpxhPGaDcfvbhNvD0B8iD1oUr/txX35NjcaY6Ns/A==",
+      "license": "MIT"
+    },
     "node_modules/ms": {
       "version": "2.1.3",
       "resolved": "https://registry.npmjs.org/ms/-/ms-2.1.3.tgz",
       "integrity": "sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA==",
       "license": "MIT"
     },
+    "node_modules/napi-build-utils": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/napi-build-utils/-/napi-build-utils-2.0.0.tgz",
+      "integrity": "sha512-GEbrYkbfF7MoNaoh2iGG84Mnf/WZfB0GdGEsM8wz7Expx/LlWf5U8t9nvJKXSp3qr5IsEbK04cBGhol/KwOsWA==",
+      "license": "MIT"
+    },
+    "node_modules/node-abi": {
+      "version": "3.75.0",
+      "resolved": "https://registry.npmjs.org/node-abi/-/node-abi-3.75.0.tgz",
+      "integrity": "sha512-OhYaY5sDsIka7H7AtijtI9jwGYLyl29eQn/W623DiN/MIv5sUqc4g7BIDThX+gb7di9f6xK02nkp8sdfFWZLTg==",
+      "license": "MIT",
+      "dependencies": {
+        "semver": "^7.3.5"
+      },
+      "engines": {
+        "node": ">=10"
+      }
+    },
+    "node_modules/once": {
+      "version": "1.4.0",
+      "resolved": "https://registry.npmjs.org/once/-/once-1.4.0.tgz",
+      "integrity": "sha512-lNaJgI+2Q5URQBkccEKHTQOPaXdUxnZZElQTZY0MFUAuaEqe1E+Nyvgdz/aIyNi6Z9MzO5dv1H8n58/GELp3+w==",
+      "license": "ISC",
+      "dependencies": {
+        "wrappy": "1"
+      }
+    },
+    "node_modules/prebuild-install": {
+      "version": "7.1.3",
+      "resolved": "https://registry.npmjs.org/prebuild-install/-/prebuild-install-7.1.3.tgz",
+      "integrity": "sha512-8Mf2cbV7x1cXPUILADGI3wuhfqWvtiLA1iclTDbFRZkgRQS0NqsPZphna9V+HyTEadheuPmjaJMsbzKQFOzLug==",
+      "license": "MIT",
+      "dependencies": {
+        "detect-libc": "^2.0.0",
+        "expand-template": "^2.0.3",
+        "github-from-package": "0.0.0",
+        "minimist": "^1.2.3",
+        "mkdirp-classic": "^0.5.3",
+        "napi-build-utils": "^2.0.0",
+        "node-abi": "^3.3.0",
+        "pump": "^3.0.0",
+        "rc": "^1.2.7",
+        "simple-get": "^4.0.0",
+        "tar-fs": "^2.0.0",
+        "tunnel-agent": "^0.6.0"
+      },
+      "bin": {
+        "prebuild-install": "bin.js"
+      },
+      "engines": {
+        "node": ">=10"
+      }
+    },
+    "node_modules/pump": {
+      "version": "3.0.3",
+      "resolved": "https://registry.npmjs.org/pump/-/pump-3.0.3.tgz",
+      "integrity": "sha512-todwxLMY7/heScKmntwQG8CXVkWUOdYxIvY2s0VWAAMh/nd8SoYiRaKjlr7+iCs984f2P8zvrfWcDDYVb73NfA==",
+      "license": "MIT",
+      "dependencies": {
+        "end-of-stream": "^1.1.0",
+        "once": "^1.3.1"
+      }
+    },
+    "node_modules/rc": {
+      "version": "1.2.8",
+      "resolved": "https://registry.npmjs.org/rc/-/rc-1.2.8.tgz",
+      "integrity": "sha512-y3bGgqKj3QBdxLbLkomlohkvsA8gdAiUQlSBJnBhfn+BPxg4bc62d8TcBW15wavDfgexCgccckhcZvywyQYPOw==",
+      "license": "(BSD-2-Clause OR MIT OR Apache-2.0)",
+      "dependencies": {
+        "deep-extend": "^0.6.0",
+        "ini": "~1.3.0",
+        "minimist": "^1.2.0",
+        "strip-json-comments": "~2.0.1"
+      },
+      "bin": {
+        "rc": "cli.js"
+      }
+    },
+    "node_modules/readable-stream": {
+      "version": "3.6.2",
+      "resolved": "https://registry.npmjs.org/readable-stream/-/readable-stream-3.6.2.tgz",
+      "integrity": "sha512-9u/sniCrY3D5WdsERHzHE4G2YCXqoG5FTHUiCC4SIbr6XcLZBY05ya9EKjYek9O5xOAwjGq+1JdGBAS7Q9ScoA==",
+      "license": "MIT",
+      "dependencies": {
+        "inherits": "^2.0.3",
+        "string_decoder": "^1.1.1",
+        "util-deprecate": "^1.0.1"
+      },
+      "engines": {
+        "node": ">= 6"
+      }
+    },
     "node_modules/safe-buffer": {
       "version": "5.2.1",
       "resolved": "https://registry.npmjs.org/safe-buffer/-/safe-buffer-5.2.1.tgz",
···
       "integrity": "sha512-YZo3K82SD7Riyi0E1EQPojLz7kpepnSQI9IyPbHHg1XXXevb5dJI7tpyN2ADxGcQbHG7vcyRHk0cbwqcQriUtg==",
       "license": "MIT"
     },
+    "node_modules/semver": {
+      "version": "7.7.2",
+      "resolved": "https://registry.npmjs.org/semver/-/semver-7.7.2.tgz",
+      "integrity": "sha512-RF0Fw+rO5AMf9MAyaRXI4AV0Ulj5lMHqVxxdSgiVbixSCXoEmmX/jk0CuJw4+3SqroYO9VoUh+HcuJivvtJemA==",
+      "license": "ISC",
+      "bin": {
+        "semver": "bin/semver.js"
+      },
+      "engines": {
+        "node": ">=10"
+      }
+    },
+    "node_modules/simple-concat": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/simple-concat/-/simple-concat-1.0.1.tgz",
+      "integrity": "sha512-cSFtAPtRhljv69IK0hTVZQ+OfE9nePi/rtJmw5UjHeVyVroEqJXP1sFztKUy1qU+xvz3u/sfYJLa947b7nAN2Q==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/feross"
+        },
+        {
+          "type": "patreon",
+          "url": "https://www.patreon.com/feross"
+        },
+        {
+          "type": "consulting",
+          "url": "https://feross.org/support"
+        }
+      ],
+      "license": "MIT"
+    },
+    "node_modules/simple-get": {
+      "version": "4.0.1",
+      "resolved": "https://registry.npmjs.org/simple-get/-/simple-get-4.0.1.tgz",
+      "integrity": "sha512-brv7p5WgH0jmQJr1ZDDfKDOSeWWg+OVypG99A/5vYGPqJ6pxiaHLy8nxtFjBA7oMa01ebA9gfh1uMCFqOuXxvA==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/feross"
+        },
+        {
+          "type": "patreon",
+          "url": "https://www.patreon.com/feross"
+        },
+        {
+          "type": "consulting",
+          "url": "https://feross.org/support"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "decompress-response": "^6.0.0",
+        "once": "^1.3.1",
+        "simple-concat": "^1.0.0"
+      }
+    },
+    "node_modules/string_decoder": {
+      "version": "1.3.0",
+      "resolved": "https://registry.npmjs.org/string_decoder/-/string_decoder-1.3.0.tgz",
+      "integrity": "sha512-hkRX8U1WjJFd8LsDJ2yQ/wWWxaopEsABU1XfkM8A+j0+85JAGppt16cr1Whg6KIbb4okU6Mql6BOj+uup/wKeA==",
+      "license": "MIT",
+      "dependencies": {
+        "safe-buffer": "~5.2.0"
+      }
+    },
+    "node_modules/strip-json-comments": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/strip-json-comments/-/strip-json-comments-2.0.1.tgz",
+      "integrity": "sha512-4gB8na07fecVVkOI6Rs4e7T6NOTki5EmL7TUduTs6bu3EdnSycntVJ4re8kgZA+wx9IueI2Y11bfbgwtzuE0KQ==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/tar-fs": {
+      "version": "2.1.3",
+      "resolved": "https://registry.npmjs.org/tar-fs/-/tar-fs-2.1.3.tgz",
+      "integrity": "sha512-090nwYJDmlhwFwEW3QQl+vaNnxsO2yVsd45eTKRBzSzu+hlb1w2K9inVq5b0ngXuLVqQ4ApvsUHHnu/zQNkWAg==",
+      "license": "MIT",
+      "dependencies": {
+        "chownr": "^1.1.1",
+        "mkdirp-classic": "^0.5.2",
+        "pump": "^3.0.0",
+        "tar-stream": "^2.1.4"
+      }
+    },
+    "node_modules/tar-stream": {
+      "version": "2.2.0",
+      "resolved": "https://registry.npmjs.org/tar-stream/-/tar-stream-2.2.0.tgz",
+      "integrity": "sha512-ujeqbceABgwMZxEJnk2HDY2DlnUZ+9oEcb1KzTVfYHio0UE6dG71n60d8D2I4qNvleWrrXpmjpt7vZeF1LnMZQ==",
+      "license": "MIT",
+      "dependencies": {
+        "bl": "^4.0.3",
+        "end-of-stream": "^1.4.1",
+        "fs-constants": "^1.0.0",
+        "inherits": "^2.0.3",
+        "readable-stream": "^3.1.1"
+      },
+      "engines": {
+        "node": ">=6"
+      }
+    },
+    "node_modules/tunnel-agent": {
+      "version": "0.6.0",
+      "resolved": "https://registry.npmjs.org/tunnel-agent/-/tunnel-agent-0.6.0.tgz",
+      "integrity": "sha512-McnNiV1l8RYeY8tBgEpuodCC1mLUdbSN+CYBL7kJsJNInOP8UjDDEwdk6Mw60vdLLrr5NHKZhMAOSrR2NZuQ+w==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "safe-buffer": "^5.0.1"
+      },
+      "engines": {
+        "node": "*"
+      }
+    },
+    "node_modules/util-deprecate": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/util-deprecate/-/util-deprecate-1.0.2.tgz",
+      "integrity": "sha512-EPD5q1uXyFxJpCrLnCc1nHnq3gOa6DZBocAIiI2TaSCA7VCJ1UJDMagCzIkXNsUYfD1daK//LTEQ8xiIbrHtcw==",
+      "license": "MIT"
+    },
+    "node_modules/uuid": {
+      "version": "11.1.0",
+      "resolved": "https://registry.npmjs.org/uuid/-/uuid-11.1.0.tgz",
+      "integrity": "sha512-0/A9rDy9P7cJ+8w1c9WD9V//9Wj15Ce2MPz8Ri6032usz+NfePxx5AcN3bN+r6ZL6jEo066/yNYB3tn4pQEx+A==",
+      "funding": [
+        "https://github.com/sponsors/broofa",
+        "https://github.com/sponsors/ctavan"
+      ],
+      "license": "MIT",
+      "bin": {
+        "uuid": "dist/esm/bin/uuid"
+      }
+    },
     "node_modules/web-push": {
       "version": "3.6.7",
       "resolved": "https://registry.npmjs.org/web-push/-/web-push-3.6.7.tgz",
···
       "engines": {
         "node": ">= 16"
       }
+    },
+    "node_modules/wrappy": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/wrappy/-/wrappy-1.0.2.tgz",
+      "integrity": "sha512-l4Sp/DRseor9wL6EvV2+TuQn63dMkPjZ/sp9XkghTEbV9KlPS1xUsZ3u7/IQO4wxtcFB4bgpQPRcR3QCvezPcQ==",
+      "license": "ISC"
     }
   }
 }

server/package.json

···
 {
   "dependencies": {
+    "better-sqlite3": "^12.2.0",
     "cookie": "^1.0.2",
     "cookie-signature": "^1.2.2",
     "jose": "^6.0.11",
+    "uuid": "^11.1.0",
     "web-push": "^3.6.7"
   }
 }

server/schema.sql

···
+create table accounts (
+  did        text primary key,
+  first_seen text not null default CURRENT_TIMESTAMP,
+
+  check(did like 'did:%')
+) strict;
+
+create table push_subs (
+  session      text primary key, -- uuidv4, bound to signed browser cookie
+  account_did  text not null,
+  subscription text not null, -- from browser, treat as opaque blob
+
+  created      text not null default CURRENT_TIMESTAMP,
+
+  last_push    text,
+  total_pushes integer not null default 0,
+
+  foreign key(account_did) references accounts(did)
+    on delete cascade on update cascade
+) strict;