@7365admin1/core 3.75.1 → 3.77.0

package/dist/index.mjs

@@ -8925,6 +8925,20 @@ var NOTIFICATION_CATEGORIES = [
     vendorDefault: true,
     rendered: true
   },
+  // Inventory (2026-09-17). Sent from `iservice365-API-core`'s inventory
+  // module: a stock request waiting for approval and stock falling to its alert
+  // level go to that store's staff; a decided request goes to the person who
+  // asked. The caller checks `rendered` before it sends, so the sender and this
+  // switch cannot land out of order.
+  {
+    key: "inventory",
+    label: "Inventory",
+    description: "When a stock request needs your approval or has been decided, or stock you look after runs low.",
+    channels: { inApp: true, push: true, email: false },
+    channelNote: { email: NO_EMAIL_RECIPIENT },
+    permissionResources: ["inventory"],
+    rendered: true
+  },
   {
     key: "serviceProviderInvite",
     label: "Service Provider Invitations",
@@ -21240,6 +21254,37 @@ function signPlaybackLink(params) {
     expiresAt: new Date(exp * 1e3).toISOString()
   };
 }
+function signLiveLink(host, {
+  relays = playbackRelays(),
+  now = /* @__PURE__ */ new Date()
+} = {}) {
+  const parsed = host ? parseCameraHost(host) : null;
+  if (!parsed || parsed.channel === null)
+    return null;
+  const key = relays[parsed.authority];
+  if (!key)
+    return null;
+  const exp = Math.floor(now.getTime() / 1e3) + PLAYBACK_LINK_SECONDS;
+  const channel = String(parsed.channel);
+  const sig = createHmac("sha256", key).update(`${channel}|${exp}`).digest("hex");
+  const liveAuth = `exp=${exp}&sig=${sig}`;
+  return {
+    /** The player page, ready for an iframe or a WebView. */
+    liveUrl: `https://${parsed.authority}/${channel}?${liveAuth}`,
+    /**
+     * The same signature, on its own, to append to any of the relay's live
+     * routes — the socket, the still, the clip. One signature serves all four
+     * because it covers the CHANNEL and not the path, which is what lets
+     * `insertScreenshot` keep splicing `screenshot` into the path.
+     */
+    liveAuth,
+    liveExpiresAt: new Date(exp * 1e3).toISOString()
+  };
+}
+function withLiveLink(fields, options) {
+  const live = signLiveLink(fields.host, options);
+  return live ? { ...fields, ...live } : fields;
+}
 
 // src/utils/camera-capability.util.ts
 var CAMERA_CAPABILITIES = [
@@ -22595,7 +22640,9 @@ function useCameraViewService() {
         // player-page URL, which is the one picture path proven to work, and the
         // plain `GET /site-cameras` already returns it to every authenticated
         // caller. The credential fields are still never included.
-        ...publicCameraFields({ ...camera, siteName: site?.name }),
+        ...withLiveLink(
+          publicCameraFields({ ...camera, siteName: site?.name })
+        ),
         // Answered before anything is requested, so a camera with no address or
         // an inactive one renders with a reason and costs zero device requests.
         // (An ANPR unit never reaches here — it is filtered out above.)
@@ -22638,7 +22685,7 @@ function useCameraViewService() {
   async function probeCamera(camera, cacheSeconds) {
     const id = camera?._id?.toString?.() ?? "";
     const identity = {
-      ...publicCameraFields(camera),
+      ...withLiveLink(publicCameraFields(camera)),
       unavailableReason: snapshotRefusalReason(camera)
     };
     const lastFrameAt = await getCache(`lastframe:${id}`) || null;
@@ -22772,7 +22819,7 @@ function useCameraViewService() {
     );
     const { capabilities } = capabilitiesOf(camera, probe);
     const base = {
-      camera: publicCameraFields(camera),
+      camera: withLiveLink(publicCameraFields(camera)),
       snapshotSupported: refusal === null,
       capabilities,
       // Filled in from the probe when the device answers. Today it does not, so
@@ -37981,6 +38028,87 @@ function useVehicleController() {
       next(error);
     }
   }
+  const MAX_BULK_VEHICLE_ROWS = 100;
+  async function addBulk(req, res, next) {
+    const rowSchema = Joi57.object({
+      // The sheet's own row id. Opaque to the server, handed straight back.
+      id: Joi57.string().trim().max(64).required(),
+      block: Joi57.string().hex().length(24).required(),
+      level: Joi57.string().hex().length(24).required(),
+      unit: Joi57.string().hex().length(24).required(),
+      name: Joi57.string().trim().min(1).required(),
+      plateNumber: Joi57.string().trim().min(1).required(),
+      nric: Joi57.string().trim().optional().allow("", null),
+      phoneNumber: Joi57.string().trim().optional().allow("", null)
+    });
+    const schema2 = Joi57.object({
+      site: Joi57.string().hex().length(24).required(),
+      org: Joi57.string().hex().length(24).required(),
+      category: Joi57.string().optional().valid(...Object.values(VehicleCategory)).default("resident" /* RESIDENT */),
+      rows: Joi57.array().items(rowSchema).min(1).max(MAX_BULK_VEHICLE_ROWS).required()
+    });
+    const { error, value } = schema2.validate(req.body, { abortEarly: false });
+    if (error) {
+      const messages = error.details.map((d) => d.message).join(", ");
+      logger79.log({ level: "error", message: messages });
+      next(new BadRequestError102(messages));
+      return;
+    }
+    try {
+      await requireSiteReach(req, value.site);
+      const user = req.user?.user || req.user?._id;
+      const results = [];
+      for (const row of value.rows) {
+        try {
+          const message = await _add(
+            {
+              site: value.site,
+              org: value.org,
+              type: "whitelist" /* WHITELIST */,
+              category: value.category,
+              name: row.name,
+              nric: row.nric || "",
+              phoneNumber: row.phoneNumber || "",
+              block: row.block,
+              level: row.level,
+              unit: row.unit,
+              plateNumber: [row.plateNumber]
+            },
+            void 0,
+            user
+          );
+          results.push({
+            id: row.id,
+            ok: true,
+            message: String(message ?? "Vehicle added successfully.")
+          });
+        } catch (rowError) {
+          logger79.log({
+            level: "error",
+            message: `bulk vehicle row ${row.id}: ${rowError?.message ?? rowError}`
+          });
+          results.push({
+            id: row.id,
+            ok: false,
+            message: String(
+              rowError?.message ?? "The vehicle could not be added."
+            )
+          });
+        }
+      }
+      const added = results.filter((result) => result.ok).length;
+      const failed = results.length - added;
+      res.status(200).json({
+        message: failed === 0 ? `${added} vehicle${added === 1 ? "" : "s"} added.` : `${added} of ${results.length} vehicles added; ${failed} could not be added.`,
+        added,
+        failed,
+        results
+      });
+    } catch (error2) {
+      logger79.log({ level: "error", message: error2.message });
+      next(error2);
+    }
+  }
   async function add(req, res, next) {
     const { error, value } = vehicleSchema.validate(req.body, {
       abortEarly: false
@@ -38456,6 +38584,7 @@ function useVehicleController() {
   }
   return {
     add,
+    addBulk,
     getVehicles,
     getSeasonPassTypes,
     getVehicleById,
@@ -76363,6 +76492,7 @@ function highSeverityIncidentCount(severities) {
   ).length;
 }
 var SUPPLY_BASIS_LOWEST_QUANTITY = "lowest-quantity";
+var SUPPLY_BASIS_BELOW_ALERT_LEVEL = "below-alert-level";
 var SUPPLY_THRESHOLD_NOT_IN_MODEL = "Supplies do not record a stock threshold, so these are the lowest-quantity items rather than items below a level.";
 
 // src/repositories/new-dashboard.repo.ts
@@ -77221,6 +77351,32 @@ function useNewDashboardRepo() {
       { $unwind: { path: "$scheduleDoc", preserveNullAndEmptyArrays: false } }
     ];
   }
+  async function lowStockItems(site, serviceType) {
+    const stores = await db2.collection("inventory.stores").find({ sites: site, status: "active" }, { projection: { _id: 1 } }).toArray();
+    if (stores.length) {
+      const items2 = await db2.collection("inventory.items").aggregate([
+        {
+          $match: {
+            store: { $in: stores.map((store) => store._id) },
+            status: "active",
+            reorderLevel: { $gt: 0 },
+            $expr: { $lte: ["$onHand", "$reorderLevel"] }
+          }
+        },
+        { $sort: { onHand: 1 } },
+        { $limit: 5 },
+        { $project: { _id: 1, name: 1, qty: "$onHand" } }
+      ]).toArray();
+      return { items: items2, basis: SUPPLY_BASIS_BELOW_ALERT_LEVEL };
+    }
+    const items = await supplyCollection.aggregate([
+      { $match: { site, serviceType, status: "active" } },
+      { $sort: { qty: 1 } },
+      { $limit: 3 },
+      { $project: { _id: 1, name: 1, qty: 1 } }
+    ]).toArray();
+    return { items, basis: SUPPLY_BASIS_LOWEST_QUANTITY };
+  }
   async function getServiceDashboard({
     site,
     serviceType,
@@ -77278,12 +77434,7 @@ function useNewDashboardRepo() {
             }
           }
         ]).toArray(),
-        supplyCollection.aggregate([
-          { $match: { site, serviceType, status: "active" } },
-          { $sort: { qty: 1 } },
-          { $limit: 3 },
-          { $project: { _id: 1, name: 1, qty: 1 } }
-        ]).toArray(),
+        lowStockItems(site, serviceType),
         areaChecklistCollection.aggregate([
           ...areaChecklistScheduleLookup(site, serviceType, periodRange),
           {
@@ -77345,7 +77496,7 @@ function useNewDashboardRepo() {
           )
         },
         supplyAlert: {
-          items: supplyAlertReport.map((item) => ({
+          items: supplyAlertReport.items.map((item) => ({
             name: item.name,
             qty: item.qty
           })),
@@ -77353,8 +77504,8 @@ function useNewDashboardRepo() {
           // with no threshold, because `site.supplies` records no stock level to
           // compare against. Naming the ordering stops 900 gloves being drawn as
           // a warning. No threshold is invented here.
-          basis: SUPPLY_BASIS_LOWEST_QUANTITY,
-          thresholdUnavailableReason: SUPPLY_THRESHOLD_NOT_IN_MODEL
+          basis: supplyAlertReport.basis,
+          ...supplyAlertReport.basis === SUPPLY_BASIS_LOWEST_QUANTITY ? { thresholdUnavailableReason: SUPPLY_THRESHOLD_NOT_IN_MODEL } : {}
         },
         taskCompleted: {
           completed: tFacet.completed[0]?.count ?? 0,
@@ -91783,6 +91934,7 @@ export {
   sessionSchema,
   setIO,
   shiftSchema,
+  signLiveLink,
   signPlaybackLink,
   siteDayBounds,
   siteModulesHandlers,
@@ -92033,6 +92185,7 @@ export {
   vehicles_namespace_collection,
   visitors_namespace_collection,
   wallConfig,
+  withLiveLink,
   workOrderSchema,
   work_orders2_namespace_collection,
   work_orders_namespace_collection