@12-apps/notifications 4.12.0 → 4.13.0

package/dist/{create-api-notifications-BTudlaSC.d.ts → create-api-notifications-cIEbFqoZ.d.ts}

@@ -1,7 +1,7 @@
-import { N as NotificationGeneratorRegistry } from './generators-CQYdJfB5.js';
-import { b as NotificationRow, C as ChannelMatrix, a as ChannelRow, T as TypeChannelRules, L as ListNotificationsResult, k as NotificationsCopySource, c as NotificationWireMessages } from './wire-Bn6aA2nL.js';
-import { c as NotificationChannel, D as DeliveryStatus, g as NotificationLogger, j as NotificationTransport, d as NotificationContent, b as NotificationCategory, e as NotificationEvent, N as NotificationGenerator } from './types-H_aFzLA0.js';
-import { e as WebPushSubscriptionSource, D as DriverDeclarationBase, a as WebPushDriverDeclaration, c as WebPushSender } from './web-push-C6U-5JCV.js';
+import { N as NotificationGeneratorRegistry } from './generators-GUF-Kml-.js';
+import { b as NotificationRow, C as ChannelMatrix, a as ChannelRow, T as TypeChannelRules, L as ListNotificationsResult, k as NotificationsCopySource, c as NotificationWireMessages } from './wire-CJka1AvM.js';
+import { c as NotificationChannel, D as DeliveryStatus, g as NotificationLogger, j as NotificationTransport, d as NotificationContent, b as NotificationCategory, e as NotificationEvent, N as NotificationGenerator } from './types-DPiePHJD.js';
+import { e as WebPushSubscriptionSource, D as DriverDeclarationBase, a as WebPushDriverDeclaration, c as WebPushSender } from './web-push-DUn_d_gj.js';
 import { d as EmailChromeCopy, f as EmailTheme } from './template-Dlt5S54z.js';
 
 /**
@@ -51,25 +51,45 @@ interface NotificationPageAfter {
     createdAt: Date;
     id: string;
 }
-/** The inbox read filter. `deletedAt: null` is on every read, always. */
-interface NotificationWhere {
+/**
+ * One BRANCH of an inbox filter — a member of `AND`/`OR`, never a whole read.
+ *
+ * Split out when the store scope arrived, and the split is what keeps `deletedAt: null`
+ * REQUIRED on the read itself (see {@link NotificationWhere}). Widening `OR`
+ * from the old fixed keyset tuple to a general array needed its members to be
+ * valid filters, and the tempting move — relaxing `deletedAt` on the one type —
+ * would have removed the only thing that makes a Prisma-backed host exclude
+ * soft-deleted rows. Both in-package doubles hard-code that filter regardless,
+ * so Prisma is precisely the implementation the requirement was protecting.
+ *
+ * `createdAt` and `id: { lt }` are here because the keyset boundary is built
+ * from them (`../inbox.ts`'s `pageWhere`); without them the branch type cannot
+ * express the very thing the widening exists to preserve.
+ */
+interface NotificationWhereBranch {
     userId?: string;
     id?: string | {
         in: string[];
+    } | {
+        lt: string;
     };
-    deletedAt: null;
+    createdAt?: Date | {
+        lt: Date;
+    };
+    deletedAt?: null;
     readAt?: null;
-    /** The keyset half of `(createdAt, id) < (anchor.createdAt, anchor.id)`. */
-    OR?: [{
-        createdAt: {
-            lt: Date;
-        };
-    }, {
-        createdAt: Date;
-        id: {
-            lt: string;
-        };
-    }];
+    /** `null` matches the platform-wide rows that travel with every store scope. */
+    clientId?: string | null;
+    OR?: NotificationWhereBranch[];
+    AND?: NotificationWhereBranch[];
+}
+/**
+ * The inbox read filter. `deletedAt: null` is on every read, always — and it
+ * stays REQUIRED here, which is the whole reason {@link NotificationWhereBranch}
+ * is a separate type.
+ */
+interface NotificationWhere extends NotificationWhereBranch {
+    deletedAt: null;
 }
 interface NotificationDelegate {
     create(args: {
@@ -227,13 +247,28 @@ interface PushSubscriptionRow {
     endpoint: string;
     p256dh: string;
     auth: string;
+    /** The origin this browser registered on; `null` = the platform origin. */
+    clientId: string | null;
     userAgent: string | null;
 }
+/**
+ * Which of a user's subscriptions one send may reach.
+ *
+ * The disjunction is load-bearing and `clientId: { in: [x, null] }` is NOT a
+ * shortcut for it: SQL `IN` never matches NULL, so the platform-wide rows that
+ * must travel with every store scope would silently vanish.
+ */
+interface PushSubscriptionWhere {
+    userId: string;
+    OR?: [{
+        clientId: null;
+    }, {
+        clientId: string;
+    }];
+}
 interface PushSubscriptionDelegate {
     count(args: {
-        where: {
-            userId: string;
-        };
+        where: PushSubscriptionWhere;
     }): Promise<number>;
     /**
      * The row holding one endpoint, whoever owns it. Read BEFORE an upsert so a
@@ -247,9 +282,7 @@ interface PushSubscriptionDelegate {
         };
     }): Promise<PushSubscriptionRow | null>;
     findMany(args: {
-        where: {
-            userId: string;
-        };
+        where: PushSubscriptionWhere;
     }): Promise<PushSubscriptionRow[]>;
     upsert(args: {
         where: {
@@ -260,12 +293,14 @@ interface PushSubscriptionDelegate {
             endpoint: string;
             p256dh: string;
             auth: string;
+            clientId: string | null;
             userAgent: string | null;
         };
         update: {
             userId: string;
             p256dh: string;
             auth: string;
+            clientId: string | null;
             userAgent: string | null;
         };
     }): Promise<PushSubscriptionRow>;
@@ -338,6 +373,11 @@ interface PushSubscriptionInput {
     };
     /** Optional browser/device hint for a device list. */
     userAgent?: string;
+    /**
+     * Which ORIGIN this browser subscribed on — the HOST's resolved
+     * value, never anything the caller sent. Absent/null = the platform origin.
+     */
+    clientId?: string | null;
 }
 interface PushSubscriptionStore extends WebPushSubscriptionSource {
     /**
@@ -355,8 +395,19 @@ interface PushSubscriptionStore extends WebPushSubscriptionSource {
     save(userId: string, input: PushSubscriptionInput): Promise<void>;
     /** Remove one browser's subscription (owner-scoped; unknown = no-op). */
     remove(userId: string, endpoint: string): Promise<void>;
-    /** How many devices the user has registered (settings UI hint). */
-    count(userId: string): Promise<number>;
+    /**
+     * How many devices the user has registered.
+     *
+     * TWO callers with different questions. The settings screen asks unscoped —
+     * "you have 2 devices" is a fact about the PERSON — and passes nothing. The
+     * dispatch path passes the notification's tenant, because this is what
+     * `supports()` gates on: left unscoped there, the router would enqueue a
+     * WEB_PUSH delivery for a notification no reachable subscription exists for,
+     * `send` would find an empty list and throw, and the sweep would burn every
+     * attempt before writing DEAD — a FAILED row for something that was never
+     * undeliverable, only out of scope.
+     */
+    count(userId: string, notificationClientId?: string | null): Promise<number>;
     /**
      * Whether THIS endpoint is currently registered to THIS user.
      *
@@ -792,6 +843,21 @@ type NotifyByPermission = <TPayload>(clientId: string, permissions: readonly str
  */
 interface NotificationsActor {
     userId: string;
+    /**
+     * The store whose ORIGIN this request arrived on, resolved by the
+     * HOST from the hostname — never read from the body or the query.
+     *
+     * The paragraph above still holds: this is not a tenant the surface
+     * authorizes against, it is a NARROWING of a read that is already the
+     * caller's own, and it can never widen one. A host with a single origin never
+     * sets it and every endpoint answers exactly what it answered before.
+     *
+     * It exists because a multi-tenant host installs one storefront per store as
+     * its own PWA, and a PWA's identity is its ORIGIN — so an inbox answering a
+     * store's own app with a neighbour's notifications is one store reporting on
+     * another.
+     */
+    scopeClientId?: string;
 }
 /** One request, already authenticated and routed by the host. */
 interface NotificationsRequest {
@@ -844,6 +910,18 @@ declare function foldApiError(error: unknown): NotificationsResponse;
  * Soft-deleted rows (`deletedAt` set) are excluded from every read and can
  * never be resurrected by mark-read.
  */
+/**
+ * The store whose ORIGIN the caller is reading from, or absent for the platform
+ * origin.
+ *
+ * A host that installs one storefront per store as its own PWA reads this from
+ * the request's hostname; a host with one origin never sets it and every read
+ * below is exactly what it was. Set, it narrows to that store's rows PLUS the
+ * platform-wide ones (`clientId IS NULL`) — a password reset or a security
+ * notice is about the person and not about a store, so hiding it inside the
+ * only app a customer opens would be a worse failure than the leak this fixes.
+ */
+type NotificationScope = string | undefined;
 interface ListNotificationsInput {
     /** `unread` narrows to unread rows; default lists all non-deleted. */
     filter?: 'all' | 'unread';
@@ -859,10 +937,23 @@ interface ListNotificationsInput {
     limit?: number;
 }
 interface NotificationInboxStore {
-    list(userId: string, input?: ListNotificationsInput): Promise<ListNotificationsResult>;
-    unreadCount(userId: string): Promise<number>;
+    list(userId: string, input?: ListNotificationsInput, scope?: NotificationScope): Promise<ListNotificationsResult>;
+    /** Scoped with `list`, or the badge and the list it sits over disagree. */
+    unreadCount(userId: string, scope?: NotificationScope): Promise<number>;
     markRead(userId: string, ids: readonly string[]): Promise<number>;
-    markAllRead(userId: string): Promise<number>;
+    /**
+     * Scoped too, and this one is a WRITE.
+     *
+     * Unscoped, "mark all as read" pressed inside store A's app clears store B's
+     * unread rows everywhere — a cross-store write from the app that exists to be
+     * isolated, and strictly worse than the read leak. `markRead(ids)` and
+     * `softDelete(ids)` need nothing: their ids come from the already-scoped list.
+     *
+     * The platform-wide rows ARE cleared from any origin, and that follows from
+     * the scope rule rather than contradicting it — those rows are one person's,
+     * not one store's.
+     */
+    markAllRead(userId: string, scope?: NotificationScope): Promise<number>;
     softDelete(userId: string, ids: readonly string[]): Promise<number>;
 }
 
@@ -977,4 +1068,4 @@ interface ApiNotifications {
 }
 declare function createApiNotifications(config: NotificationsServerConfig): ApiNotifications;
 
-export { createApiNotifications as $, type ApiNotifications as A, type NotificationsDbProvider as B, type CommittedNotification as C, type NotificationsRequest as D, EMAIL_DRIVERS as E, type NotificationsResponse as F, type NotifyByPermission as G, type NotifyOptions as H, type NotifyResult as I, type PermissionNotificationSkip as J, type PushSubscriptionDelegate as K, type ListNotificationsInput as L, type PushSubscriptionInput as M, type NotificationsServerConfig as N, type PushSubscriptionRow as O, type PermissionNotificationResult as P, type PushSubscriptionStore as Q, type SmsDriver as R, SMS_DRIVERS as S, type SmsDriverDeclaration as T, type SmsMessage as U, type TransportDeclaration as V, type TransportRegistry as W, WHATSAPP_DRIVERS as X, type WhatsAppDriver as Y, type WhatsAppDriverDeclaration as Z, type WhatsAppMessage as _, type NotificationsActor as a, createTransportRegistry as a0, emailTransport as a1, foldApiError as a2, formatEmail as a3, formatSms as a4, formatWhatsApp as a5, ok as a6, smsTransport as a7, whatsAppTransport as a8, type NotificationsRoute as b, type EmailDriver as c, type EmailDriverDeclaration as d, type EmailMessage as e, type ExtraDrivers as f, type NotificationAudienceDirectory as g, type NotificationChannelPolicy as h, type NotificationCommittedListener as i, type NotificationContactDirectory as j, type NotificationCreateData as k, type NotificationDelegate as l, type NotificationDeliveryDelegate as m, type NotificationDeliveryRow as n, type NotificationDeliveryWhere as o, type NotificationDispatchScheduler as p, type NotificationInboxStore as q, type NotificationPageAfter as r, type NotificationPreferenceDelegate as s, type NotificationPreferenceRow as t, type NotificationPreferenceStore as u, type NotificationRouter as v, type NotificationWhere as w, NotificationsApiError as x, type NotificationsDb as y, type NotificationsDbClient as z };
+export { type WhatsAppDriverDeclaration as $, type ApiNotifications as A, type NotificationsDbClient as B, type CommittedNotification as C, type NotificationsDbProvider as D, EMAIL_DRIVERS as E, type NotificationsRequest as F, type NotificationsResponse as G, type NotifyByPermission as H, type NotifyOptions as I, type NotifyResult as J, type PermissionNotificationSkip as K, type ListNotificationsInput as L, type PushSubscriptionDelegate as M, type NotificationsServerConfig as N, type PushSubscriptionInput as O, type PermissionNotificationResult as P, type PushSubscriptionRow as Q, type PushSubscriptionStore as R, type PushSubscriptionWhere as S, SMS_DRIVERS as T, type SmsDriver as U, type SmsDriverDeclaration as V, type SmsMessage as W, type TransportDeclaration as X, type TransportRegistry as Y, WHATSAPP_DRIVERS as Z, type WhatsAppDriver as _, type NotificationsActor as a, type WhatsAppMessage as a0, createApiNotifications as a1, createTransportRegistry as a2, emailTransport as a3, foldApiError as a4, formatEmail as a5, formatSms as a6, formatWhatsApp as a7, ok as a8, smsTransport as a9, whatsAppTransport as aa, type NotificationsRoute as b, type EmailDriver as c, type EmailDriverDeclaration as d, type EmailMessage as e, type ExtraDrivers as f, type NotificationAudienceDirectory as g, type NotificationChannelPolicy as h, type NotificationCommittedListener as i, type NotificationContactDirectory as j, type NotificationCreateData as k, type NotificationDelegate as l, type NotificationDeliveryDelegate as m, type NotificationDeliveryRow as n, type NotificationDeliveryWhere as o, type NotificationDispatchScheduler as p, type NotificationInboxStore as q, type NotificationPageAfter as r, type NotificationPreferenceDelegate as s, type NotificationPreferenceRow as t, type NotificationPreferenceStore as u, type NotificationRouter as v, type NotificationWhere as w, type NotificationWhereBranch as x, NotificationsApiError as y, type NotificationsDb as z };

package/dist/{create-web-notifications-2xxbKnrW.d.ts → create-web-notifications-BODiQRK-.d.ts}

@@ -1,6 +1,6 @@
 import { ReactNode, JSX, ComponentType } from 'react';
-import { L as ListNotificationsResult, a as ChannelRow, I as InboxNotification, N as NotificationMessages } from './wire-Bn6aA2nL.js';
-import { c as NotificationChannel } from './types-H_aFzLA0.js';
+import { L as ListNotificationsResult, a as ChannelRow, I as InboxNotification, N as NotificationMessages } from './wire-CJka1AvM.js';
+import { c as NotificationChannel } from './types-DPiePHJD.js';
 import { b as LiveActivity } from './live-DYxEFO49.js';
 
 /**

package/dist/{generators-CQYdJfB5.d.ts → generators-GUF-Kml-.d.ts}

@@ -1,4 +1,4 @@
-import { N as NotificationGenerator } from './types-H_aFzLA0.js';
+import { N as NotificationGenerator } from './types-DPiePHJD.js';
 
 /**
  * Generator registry: one {@link NotificationGenerator} per event `type`.

package/dist/hono/index.d.ts

@@ -1,9 +1,9 @@
 import { Hono, Context } from 'hono';
-import { A as ApiNotifications, N as NotificationsServerConfig, a as NotificationsActor } from '../create-api-notifications-BTudlaSC.js';
-import '../generators-CQYdJfB5.js';
-import '../types-H_aFzLA0.js';
-import '../wire-Bn6aA2nL.js';
-import '../web-push-C6U-5JCV.js';
+import { A as ApiNotifications, N as NotificationsServerConfig, a as NotificationsActor } from '../create-api-notifications-cIEbFqoZ.js';
+import '../generators-GUF-Kml-.js';
+import '../types-DPiePHJD.js';
+import '../wire-CJka1AvM.js';
+import '../web-push-DUn_d_gj.js';
 import '../template-Dlt5S54z.js';
 
 /**

package/dist/hono/index.js

@@ -1,12 +1,12 @@
 import {
   createApiNotifications
-} from "../chunk-WZBX7YCE.js";
-import "../chunk-GK6GSC2J.js";
+} from "../chunk-53SH5ABN.js";
+import "../chunk-XFODKRRB.js";
 import {
   messagesOf
 } from "../chunk-M2TVBVH2.js";
 import "../chunk-RTURLH5U.js";
-import "../chunk-CPQKKLPS.js";
+import "../chunk-CSMFJJXY.js";
 import "../chunk-EKUSNUBT.js";
 import {
   __name

package/dist/index.d.ts

@@ -1,6 +1,6 @@
-export { D as DeliveryStatus, a as NOTIFICATION_CHANNELS, b as NotificationCategory, c as NotificationChannel, d as NotificationContent, e as NotificationEvent, f as NotificationGenerateContext, N as NotificationGenerator, g as NotificationLogger, h as NotificationRecipient, i as NotificationTaxonomy, j as NotificationTransport, T as TransportRecipient, t as taxonomyOf } from './types-H_aFzLA0.js';
-export { N as NotificationGeneratorRegistry, c as createGeneratorRegistry } from './generators-CQYdJfB5.js';
-export { C as ChannelMatrix, a as ChannelRow, D as DEFAULT_CHANNEL_ROW, I as InboxNotification, L as ListNotificationsResult, N as NotificationMessages, b as NotificationRow, c as NotificationWireMessages, T as TypeChannelRules, d as availableChannelsOf, e as capToAvailable, f as defaultChannelMatrix, g as enabledChannelsOf, i as inboxWire, m as mergeChoices, h as mergeStoredRow, j as messagesOf, r as resolveTypeChannels } from './wire-Bn6aA2nL.js';
+export { D as DeliveryStatus, a as NOTIFICATION_CHANNELS, b as NotificationCategory, c as NotificationChannel, d as NotificationContent, e as NotificationEvent, f as NotificationGenerateContext, N as NotificationGenerator, g as NotificationLogger, h as NotificationRecipient, i as NotificationTaxonomy, j as NotificationTransport, T as TransportRecipient, t as taxonomyOf } from './types-DPiePHJD.js';
+export { N as NotificationGeneratorRegistry, c as createGeneratorRegistry } from './generators-GUF-Kml-.js';
+export { C as ChannelMatrix, a as ChannelRow, D as DEFAULT_CHANNEL_ROW, I as InboxNotification, L as ListNotificationsResult, N as NotificationMessages, b as NotificationRow, c as NotificationWireMessages, T as TypeChannelRules, d as availableChannelsOf, e as capToAvailable, f as defaultChannelMatrix, g as enabledChannelsOf, i as inboxWire, m as mergeChoices, h as mergeStoredRow, j as messagesOf, r as resolveTypeChannels } from './wire-CJka1AvM.js';
 export { L as LIVE_PUSH_TAG_PREFIX, a as LIVE_SUBJECT_KEY, b as LiveActivity, c as LiveActivityLane, d as LiveActivityStep, l as liveActivityLane, e as livePushTag } from './live-DYxEFO49.js';
 
 /** Thrown by `notify` when no generator is registered for the event type. */

package/dist/index.js

@@ -12,7 +12,7 @@ import {
   mergeStoredRow,
   normalizePhoneE164,
   resolveTypeChannels
-} from "./chunk-GK6GSC2J.js";
+} from "./chunk-XFODKRRB.js";
 import {
   messagesOf
 } from "./chunk-M2TVBVH2.js";
@@ -25,7 +25,7 @@ import {
 import {
   NOTIFICATION_CHANNELS,
   taxonomyOf
-} from "./chunk-CPQKKLPS.js";
+} from "./chunk-CSMFJJXY.js";
 import "./chunk-7QVYU63E.js";
 export {
   DEFAULT_CHANNEL_ROW,

package/dist/{jobs-CaovU4GM.d.ts → jobs-wKoOz91Q.d.ts}

@@ -1,5 +1,5 @@
 import { WireJobBlueprint } from '@12-apps/wiring';
-import { A as ApiNotifications } from './create-api-notifications-BTudlaSC.js';
+import { A as ApiNotifications } from './create-api-notifications-cIEbFqoZ.js';
 
 /**
  * The two background jobs getting a message out actually needs.

package/dist/manifest/server.d.ts

@@ -1,13 +1,13 @@
 import { EmailPreviewRoute } from '../email/previews/index.js';
 import * as _12_apps_wiring from '@12-apps/wiring';
 import { WireRequest } from '@12-apps/wiring';
-import { N as NotificationsServerConfig, A as ApiNotifications, b as NotificationsRoute } from '../create-api-notifications-BTudlaSC.js';
-import { N as NotificationsJobDeps } from '../jobs-CaovU4GM.js';
+import { N as NotificationsServerConfig, A as ApiNotifications, b as NotificationsRoute } from '../create-api-notifications-cIEbFqoZ.js';
+import { N as NotificationsJobDeps } from '../jobs-wKoOz91Q.js';
 import { E as EmailPreviewsConfig } from '../catalog-BOVZ2b-b.js';
-import '../generators-CQYdJfB5.js';
-import '../types-H_aFzLA0.js';
-import '../wire-Bn6aA2nL.js';
-import '../web-push-C6U-5JCV.js';
+import '../generators-GUF-Kml-.js';
+import '../types-DPiePHJD.js';
+import '../wire-CJka1AvM.js';
+import '../web-push-DUn_d_gj.js';
 import '../template-Dlt5S54z.js';
 
 /** One `NotificationsRoute` as the wiring contract reads it. */

package/dist/manifest/server.js

@@ -3,14 +3,14 @@ import {
 } from "../chunk-FTFLU6KH.js";
 import {
   NOTIFICATIONS_JOBS
-} from "../chunk-FBBPS2LT.js";
+} from "../chunk-QPO6NSRR.js";
 import {
   createApiNotifications
-} from "../chunk-WZBX7YCE.js";
-import "../chunk-GK6GSC2J.js";
+} from "../chunk-53SH5ABN.js";
+import "../chunk-XFODKRRB.js";
 import "../chunk-M2TVBVH2.js";
 import "../chunk-RTURLH5U.js";
-import "../chunk-CPQKKLPS.js";
+import "../chunk-CSMFJJXY.js";
 import "../chunk-EKUSNUBT.js";
 import {
   __name

package/dist/manifest/web.d.ts

@@ -1,8 +1,8 @@
 import { c as createEmailPreviewScreen } from '../preview-screen-DYJRAnAY.js';
-import { c as createWebNotifications } from '../create-web-notifications-2xxbKnrW.js';
+import { c as createWebNotifications } from '../create-web-notifications-BODiQRK-.js';
 import 'react';
-import '../wire-Bn6aA2nL.js';
-import '../types-H_aFzLA0.js';
+import '../wire-CJka1AvM.js';
+import '../types-DPiePHJD.js';
 import '../live-DYxEFO49.js';
 
 /**

package/dist/manifest/web.js

@@ -1,6 +1,6 @@
 import {
   createWebNotifications
-} from "../chunk-PNY6S6WH.js";
+} from "../chunk-4DTUD74E.js";
 import "../chunk-2IAHFIXS.js";
 import {
   createEmailPreviewScreen

package/dist/{preferences-screen-S3ZHX5LB.js → preferences-screen-YRPNUZS5.js}

@@ -4,7 +4,7 @@ import {
 } from "./chunk-CQZMTFPY.js";
 import {
   NOTIFICATION_CHANNELS
-} from "./chunk-CPQKKLPS.js";
+} from "./chunk-CSMFJJXY.js";
 import {
   __name
 } from "./chunk-7QVYU63E.js";
@@ -291,4 +291,4 @@ __name(PreferencesScreen, "PreferencesScreen");
 export {
   PreferencesScreen
 };
-//# sourceMappingURL=preferences-screen-S3ZHX5LB.js.map
+//# sourceMappingURL=preferences-screen-YRPNUZS5.js.map

package/dist/react/index.d.ts

@@ -1,10 +1,10 @@
-import { L as LiveActivitiesConfig, N as NotificationsApiClient } from '../create-web-notifications-2xxbKnrW.js';
-export { B as BADGE_POLL_MS, a as BADGE_RECONCILE_MS, b as BadgeSyncOptions, d as BellBadge, e as BellButtonProps, I as InboxListStatus, f as InboxState, g as InboxStore, h as LiveActivitiesHook, i as LiveActivityMessages, j as NotificationsHttpError, k as NotificationsPanelProps, l as NotificationsResult, m as NotificationsSignalHook, n as NotificationsSubscribe, o as NotificationsTransport, p as NotificationsWebConfig, P as PAGE_SIZE, q as PreferencesPayload, r as PreferencesScreenProps, s as PushRegistrationPayload, W as WebNotifications, t as WebPushPlatformHint, u as WebPushSetupConfig, v as createInboxStore, w as createNotificationsApiClient, c as createWebNotifications, x as httpNotificationsTransport, y as useInboxList, z as useInboxState, A as useUnreadCount } from '../create-web-notifications-2xxbKnrW.js';
+import { L as LiveActivitiesConfig, N as NotificationsApiClient } from '../create-web-notifications-BODiQRK-.js';
+export { B as BADGE_POLL_MS, a as BADGE_RECONCILE_MS, b as BadgeSyncOptions, d as BellBadge, e as BellButtonProps, I as InboxListStatus, f as InboxState, g as InboxStore, h as LiveActivitiesHook, i as LiveActivityMessages, j as NotificationsHttpError, k as NotificationsPanelProps, l as NotificationsResult, m as NotificationsSignalHook, n as NotificationsSubscribe, o as NotificationsTransport, p as NotificationsWebConfig, P as PAGE_SIZE, q as PreferencesPayload, r as PreferencesScreenProps, s as PushRegistrationPayload, W as WebNotifications, t as WebPushPlatformHint, u as WebPushSetupConfig, v as createInboxStore, w as createNotificationsApiClient, c as createWebNotifications, x as httpNotificationsTransport, y as useInboxList, z as useInboxState, A as useUnreadCount } from '../create-web-notifications-BODiQRK-.js';
 import { JSX, ReactNode } from 'react';
 import { b as LiveActivity } from '../live-DYxEFO49.js';
 export { c as LiveActivityLane, d as LiveActivityStep, l as liveActivityLane } from '../live-DYxEFO49.js';
-import { N as NotificationMessages } from '../wire-Bn6aA2nL.js';
-import '../types-H_aFzLA0.js';
+import { N as NotificationMessages } from '../wire-CJka1AvM.js';
+import '../types-DPiePHJD.js';
 
 /**
  * What the reader has already been shown, so the bell can say NEW rather than

package/dist/react/index.js

@@ -3,7 +3,7 @@ import {
   createNotificationsApiClient,
   createWebNotifications,
   httpNotificationsTransport
-} from "../chunk-PNY6S6WH.js";
+} from "../chunk-4DTUD74E.js";
 import {
   LiveSection,
   relativeTime

package/dist/server/index.d.ts

@@ -1,11 +1,11 @@
-import { A as ApiNotifications } from '../create-api-notifications-BTudlaSC.js';
-export { C as CommittedNotification, E as EMAIL_DRIVERS, c as EmailDriver, d as EmailDriverDeclaration, e as EmailMessage, f as ExtraDrivers, L as ListNotificationsInput, g as NotificationAudienceDirectory, h as NotificationChannelPolicy, i as NotificationCommittedListener, j as NotificationContactDirectory, k as NotificationCreateData, l as NotificationDelegate, m as NotificationDeliveryDelegate, n as NotificationDeliveryRow, o as NotificationDeliveryWhere, p as NotificationDispatchScheduler, q as NotificationInboxStore, r as NotificationPageAfter, s as NotificationPreferenceDelegate, t as NotificationPreferenceRow, u as NotificationPreferenceStore, v as NotificationRouter, w as NotificationWhere, a as NotificationsActor, x as NotificationsApiError, y as NotificationsDb, z as NotificationsDbClient, B as NotificationsDbProvider, D as NotificationsRequest, F as NotificationsResponse, b as NotificationsRoute, N as NotificationsServerConfig, G as NotifyByPermission, H as NotifyOptions, I as NotifyResult, P as PermissionNotificationResult, J as PermissionNotificationSkip, K as PushSubscriptionDelegate, M as PushSubscriptionInput, O as PushSubscriptionRow, Q as PushSubscriptionStore, S as SMS_DRIVERS, R as SmsDriver, T as SmsDriverDeclaration, U as SmsMessage, V as TransportDeclaration, W as TransportRegistry, X as WHATSAPP_DRIVERS, Y as WhatsAppDriver, Z as WhatsAppDriverDeclaration, _ as WhatsAppMessage, $ as createApiNotifications, a0 as createTransportRegistry, a1 as emailTransport, a2 as foldApiError, a3 as formatEmail, a4 as formatSms, a5 as formatWhatsApp, a6 as ok, a7 as smsTransport, a8 as whatsAppTransport } from '../create-api-notifications-BTudlaSC.js';
-export { D as DriverDeclarationBase, F as FetchImpl, N as NotificationProviderError, W as WEB_PUSH_DRIVERS, a as WebPushDriverDeclaration, b as WebPushMessage, c as WebPushSender, d as WebPushSubscription, e as WebPushSubscriptionSource, f as absoluteLink, g as formatWebPush, w as webPushTransport } from '../web-push-C6U-5JCV.js';
+import { A as ApiNotifications } from '../create-api-notifications-cIEbFqoZ.js';
+export { C as CommittedNotification, E as EMAIL_DRIVERS, c as EmailDriver, d as EmailDriverDeclaration, e as EmailMessage, f as ExtraDrivers, L as ListNotificationsInput, g as NotificationAudienceDirectory, h as NotificationChannelPolicy, i as NotificationCommittedListener, j as NotificationContactDirectory, k as NotificationCreateData, l as NotificationDelegate, m as NotificationDeliveryDelegate, n as NotificationDeliveryRow, o as NotificationDeliveryWhere, p as NotificationDispatchScheduler, q as NotificationInboxStore, r as NotificationPageAfter, s as NotificationPreferenceDelegate, t as NotificationPreferenceRow, u as NotificationPreferenceStore, v as NotificationRouter, w as NotificationWhere, x as NotificationWhereBranch, a as NotificationsActor, y as NotificationsApiError, z as NotificationsDb, B as NotificationsDbClient, D as NotificationsDbProvider, F as NotificationsRequest, G as NotificationsResponse, b as NotificationsRoute, N as NotificationsServerConfig, H as NotifyByPermission, I as NotifyOptions, J as NotifyResult, P as PermissionNotificationResult, K as PermissionNotificationSkip, M as PushSubscriptionDelegate, O as PushSubscriptionInput, Q as PushSubscriptionRow, R as PushSubscriptionStore, S as PushSubscriptionWhere, T as SMS_DRIVERS, U as SmsDriver, V as SmsDriverDeclaration, W as SmsMessage, X as TransportDeclaration, Y as TransportRegistry, Z as WHATSAPP_DRIVERS, _ as WhatsAppDriver, $ as WhatsAppDriverDeclaration, a0 as WhatsAppMessage, a1 as createApiNotifications, a2 as createTransportRegistry, a3 as emailTransport, a4 as foldApiError, a5 as formatEmail, a6 as formatSms, a7 as formatWhatsApp, a8 as ok, a9 as smsTransport, aa as whatsAppTransport } from '../create-api-notifications-cIEbFqoZ.js';
+export { D as DriverDeclarationBase, F as FetchImpl, N as NotificationProviderError, W as WEB_PUSH_DRIVERS, a as WebPushDriverDeclaration, b as WebPushMessage, c as WebPushSender, d as WebPushSubscription, e as WebPushSubscriptionSource, f as absoluteLink, g as formatWebPush, w as webPushTransport } from '../web-push-DUn_d_gj.js';
 import { NotifyPort } from '@12-apps/wiring/ports';
-export { a as NOTIFICATIONS_DRAIN_CRON, b as NOTIFICATIONS_DRAIN_LEASE_MS, c as NOTIFICATIONS_JOBS, d as NOTIFICATIONS_SWEEP_QUEUE, N as NotificationsJobDeps } from '../jobs-CaovU4GM.js';
-import '../generators-CQYdJfB5.js';
-import '../types-H_aFzLA0.js';
-import '../wire-Bn6aA2nL.js';
+export { a as NOTIFICATIONS_DRAIN_CRON, b as NOTIFICATIONS_DRAIN_LEASE_MS, c as NOTIFICATIONS_JOBS, d as NOTIFICATIONS_SWEEP_QUEUE, N as NotificationsJobDeps } from '../jobs-wKoOz91Q.js';
+import '../generators-GUF-Kml-.js';
+import '../types-DPiePHJD.js';
+import '../wire-CJka1AvM.js';
 import '../template-Dlt5S54z.js';
 import '@12-apps/wiring';
 

package/dist/server/index.js

@@ -4,7 +4,7 @@ import {
   NOTIFICATIONS_JOBS,
   NOTIFICATIONS_SWEEP_QUEUE,
   wireNotifyPort
-} from "../chunk-FBBPS2LT.js";
+} from "../chunk-QPO6NSRR.js";
 import {
   EMAIL_DRIVERS,
   NotificationProviderError,
@@ -25,11 +25,11 @@ import {
   smsTransport,
   webPushTransport,
   whatsAppTransport
-} from "../chunk-WZBX7YCE.js";
-import "../chunk-GK6GSC2J.js";
+} from "../chunk-53SH5ABN.js";
+import "../chunk-XFODKRRB.js";
 import "../chunk-M2TVBVH2.js";
 import "../chunk-RTURLH5U.js";
-import "../chunk-CPQKKLPS.js";
+import "../chunk-CSMFJJXY.js";
 import "../chunk-EKUSNUBT.js";
 import "../chunk-7QVYU63E.js";
 export {

package/dist/{types-H_aFzLA0.d.ts → types-DPiePHJD.d.ts}

@@ -181,8 +181,26 @@ interface TransportRecipient {
     locale?: string | null;
     /** Phone as the host stores it (transports normalize per provider rules). */
     phone: string | null;
-    /** How many active browser push subscriptions the user holds. */
+    /**
+     * How many push subscriptions this NOTIFICATION can actually reach — not how
+     * many the user holds. Scoped by {@link TransportRecipient.clientId}.
+     */
     pushSubscriptionCount: number;
+    /**
+     * The store this notification belongs to, or `null` for a platform-wide one
+     *.
+     *
+     * REQUIRED, and deliberately so where optional is the tempting answer. An
+     * optional field fails OPEN: a construction site that forgets it yields
+     * `undefined`, which the push scope reads as "platform notification -> every
+     * subscription" — precisely the cross-store fan-out this exists to stop.
+     * Three construction sites is the argument FOR requiring it, not against; the
+     * compiler then names them.
+     *
+     * Not a breaking change for adopters: every external use CONSUMES a recipient
+     * through `supports`/`send` below, and the only constructors are in-package.
+     */
+    clientId: string | null;
 }
 /**
  * One pluggable channel adapter: a FORMATTER (agnostic content → channel

package/dist/web-push/index.d.ts

@@ -1,5 +1,5 @@
-import { c as WebPushSender } from '../web-push-C6U-5JCV.js';
-import '../types-H_aFzLA0.js';
+import { c as WebPushSender } from '../web-push-DUn_d_gj.js';
+import '../types-DPiePHJD.js';
 
 /**
  * `@12-apps/notifications/web-push` — the VAPID sender, behind its own subpath.

package/dist/{web-push-C6U-5JCV.d.ts → web-push-DUn_d_gj.d.ts}

@@ -1,4 +1,4 @@
-import { g as NotificationLogger, d as NotificationContent, j as NotificationTransport } from './types-H_aFzLA0.js';
+import { g as NotificationLogger, d as NotificationContent, j as NotificationTransport } from './types-DPiePHJD.js';
 
 /**
  * The DRIVER port — the reason a host adds a vendor with a config entry and no
@@ -133,7 +133,17 @@ interface WebPushDriverDeclaration extends DriverDeclarationBase {
 }
 /** The subscriptions the transport reads and prunes (db-backed by the mount). */
 interface WebPushSubscriptionSource {
-    list(userId: string): Promise<{
+    /**
+     * The subscriptions one notification may reach.
+     *
+     * `notificationClientId` is the notification's tenant — `null` for a
+     * platform-wide one, which every subscription receives. An ADOPTER with a
+     * hand-written source must honour it: a function declared with fewer
+     * parameters still type-checks, so an un-updated implementation silently
+     * ignores the scope and keeps fanning out to every origin, with nothing
+     * failing to compile to say so.
+     */
+    list(userId: string, notificationClientId?: string | null): Promise<{
         id: string;
         endpoint: string;
         p256dh: string;

package/dist/{wire-Bn6aA2nL.d.ts → wire-CJka1AvM.d.ts}

@@ -1,4 +1,4 @@
-import { b as NotificationCategory, c as NotificationChannel } from './types-H_aFzLA0.js';
+import { b as NotificationCategory, c as NotificationChannel } from './types-DPiePHJD.js';
 
 /**
  * Every sentence this package can say to a USER, stated by the HOST.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@12-apps/notifications",
-  "version": "4.12.0",
+  "version": "4.13.0",
   "type": "module",
   "sideEffects": false,
   "description": "Plug-and-play notification system (12-15): an always-on in-app inbox, per-user × per-category channel preferences, and email / SMS / WhatsApp / web-push transports behind vendor DRIVERS so a second provider is a config entry. Framework-free core (.), host-mounted backend surface (./server: inbox / preferences / push-subscription endpoints, the channel router with delivery records + retry sweep, the permission fan-out, duck-typed Prisma seam), Hono adapter (./hono), React surface (./react: bell + badge, inbox drawer, preferences screen), VAPID sender (./web-push) and the package-owned Prisma partial + migrations. Standardized adoption contract in ADOPTING.md.",
@@ -71,7 +71,7 @@
     "prisma:sync:check": "node scripts/sync-notifications-schema.mjs --check"
   },
   "dependencies": {
-    "@12-apps/ui": "^6.25.0"
+    "@12-apps/ui": "^6.27.1"
   },
   "peerDependencies": {
     "@12-apps/wiring": ">=1.3.0",

package/prisma/migrations/20260914210000_scope_push_subscriptions_per_store/migration.sql

@@ -0,0 +1,31 @@
+-- @12-apps/notifications: which ORIGIN a browser subscription was
+-- registered on.
+--
+-- A multi-tenant host installs one storefront per store as its own PWA, and a
+-- PWA's identity is its ORIGIN — so two stores are two apps. Without this
+-- column the Web Push transport fans every notification out to every row a user
+-- holds, and store B's push lands inside store A's installed app wearing store
+-- A's icon.
+--
+-- NULL means the PLATFORM origin: the marketplace host itself, or any adopter
+-- that serves one origin and has no per-store apps at all. That is why the
+-- column is nullable and why every EXISTING row reads correctly with no
+-- backfill — an adopter who never had custom domains keeps today's behaviour
+-- exactly, which is what makes this a MINOR release rather than a breaking one.
+--
+-- A by-value scalar with NO foreign key, exactly as `user_id` and
+-- `notifications.client_id` already are here (the payments-backend doctrine at
+-- the top of `notifications.prisma`): this package must not constrain a host's
+-- tenant table, whose name it does not know.
+--
+-- Additive DDL, so no expand/contract ceremony: the previous release reads a
+-- table that has gained a nullable column it never mentions, which is safe.
+ALTER TABLE "push_subscriptions" ADD COLUMN IF NOT EXISTS "client_id" TEXT;
+
+-- Serves the ONE query the send path makes per notification:
+--   user_id = $1 AND ($2 IS NULL OR client_id IS NULL OR client_id = $2)
+-- `user_id` leads because it is the selective half and is on every read; the
+-- existing `push_subscriptions_user_id_idx` stays for the unscoped counts the
+-- settings screen still makes.
+CREATE INDEX IF NOT EXISTS "push_subscriptions_user_id_client_id_idx"
+  ON "push_subscriptions" ("user_id", "client_id");