@assembly-js/app-foundation 0.2.1 → 0.2.3

package/CHANGELOG.md

@@ -17,6 +17,12 @@ bullets ship. Write `[fix]`, `[behavior]` and `[action]` bullets for the app's o
 A patch release never changes what an app's build requires; a minor release may add or change a
 `bin/check-*.mjs` script. CI fails a PR that changes a check script without a minor bump over main.
 
+## 0.2.3
+- [new] The client-call scan now treats a client's own notification reads (list, mark read, mark unread) as safe, matching the routes the platform opens to clients. Nothing in the app changes.
+
+## 0.2.2
+- [fix] `@assembly-js/app-foundation/scripts` now loads when a script runs under plain `node`, not only under `bun`.
+
 ## 0.2.1
 - [new] Add `@assembly-js/app-foundation/scripts`, which exports `getOfflineAssembly` without `server-only`, for seed and backfill scripts that run outside Next.
 

package/bin/client-safe-sdk-methods.mjs

@@ -1,11 +1,28 @@
-// PROVISIONAL until the final client-safe public route list lands.
-//
 // The routes a client bearer may keep calling once clients stop acting as admin,
-// as SDK method names (the SDK is flat: `retrieveClient`, not `clients.retrieve`):
-//   GET /v1/me                -> retrieveMe
-//   GET /v1/clients/{id}      -> retrieveClient (the client's own record only)
-//   GET /v1/session/flags     -> no SDK method yet, so nothing to list; add it
-//                                here when the SDK gains one.
-// retrieveClient is allowlisted by name: whether the id is the viewer's own is a
-// runtime fact a static scan cannot see.
-export const CLIENT_SAFE_SDK_METHODS = Object.freeze(['retrieveClient', 'retrieveMe']);
+// as SDK method names (the SDK is flat: `retrieveClient`, not `clients.retrieve`).
+// Mirrors every route the platform marks with ClientAccessOpen, ClientAccessSelf or
+// ClientAccessGuarded under backend/platform-api; scan-client-calls.test.mjs fails when
+// the marker count drifts from this list.
+//
+//   GET  /v1/me                         -> retrieveMe
+//   GET  /v1/clients/{id}               -> retrieveClient (the client's own record only)
+//   GET  /v1/notifications              -> listNotifications
+//   POST /v1/notifications/{id}/read    -> markNotificationRead
+//   POST /v1/notifications/{id}/unread  -> markNotificationUnread
+//   GET  /v1/session/flags              -> no SDK method yet, so nothing to list; add it
+//                                          here when the SDK gains one.
+//
+// retrieveClient is allowlisted by name: whether the id is the viewer's own is a runtime
+// fact a static scan cannot see. The notification routes are open to clients, and the
+// platform pins a client caller to their own notifications. Creating, retrieving and
+// deleting a notification stay off the list: those routes are not open to clients.
+export const CLIENT_SAFE_SDK_METHODS = Object.freeze([
+  'retrieveClient',
+  'retrieveMe',
+  'listNotifications',
+  'markNotificationRead',
+  'markNotificationUnread',
+]);
+
+// Marked client-safe routes that no SDK method reaches yet (the list above says which).
+export const CLIENT_SAFE_ROUTES_WITHOUT_SDK_METHOD = 1;