@codixus/server 0.1.4 → 0.1.6

package/dist/index.cjs

@@ -37,6 +37,7 @@ __export(index_exports, {
   Query: () => Query,
   RestErrorCode: () => RestErrorCode,
   SubCollection: () => SubCollection,
+  createExpoTransport: () => createExpoTransport,
   model: () => model,
   validate: () => validate
 });
@@ -49,6 +50,8 @@ var ConnectionManager = class {
     this.uri = uri;
     this.dbName = dbName;
   }
+  uri;
+  dbName;
   client = null;
   db = null;
   async connect() {
@@ -873,6 +876,7 @@ var RestError = class extends Error {
     super(message);
     this.code = code;
   }
+  code;
 };
 function param(req, name) {
   const val = req.params[name];
@@ -1304,6 +1308,724 @@ function createRestRouter(model2, options = {}) {
   return router;
 }
 
+// src/push/router.ts
+var import_express3 = require("express");
+var import_node_crypto5 = require("crypto");
+function checkAuth(req, res) {
+  const deviceId = req.user?.deviceId;
+  if (!deviceId) {
+    res.status(401).json({ success: false, error: "Missing authorization header" });
+    return null;
+  }
+  return deviceId;
+}
+function isNonEmptyString(value) {
+  return typeof value === "string" && value.length > 0;
+}
+function createPushRouter(db) {
+  const router = (0, import_express3.Router)();
+  const devicesCol = db.collection("push_devices");
+  const deliveriesCol = db.collection("push_deliveries");
+  router.post("/register", async (req, res) => {
+    const deviceId = checkAuth(req, res);
+    if (!deviceId) return;
+    const { token, provider, platform, locale, timezone, appVersion, permissionStatus } = req.body ?? {};
+    if (!isNonEmptyString(token) || !isNonEmptyString(provider) || platform !== "ios" && platform !== "android") {
+      res.status(400).json({ success: false, error: "Invalid request body" });
+      return;
+    }
+    const now = /* @__PURE__ */ new Date();
+    const existing = await devicesCol.findOne({ token });
+    if (existing) {
+      const update = {
+        deviceId,
+        enabled: true,
+        lastSeenAt: now,
+        updatedAt: now,
+        provider,
+        platform
+      };
+      if (locale !== void 0) update.locale = locale;
+      if (timezone !== void 0) update.timezone = timezone;
+      if (appVersion !== void 0) update.appVersion = appVersion;
+      if (permissionStatus !== void 0)
+        update.permissionStatus = permissionStatus;
+      await devicesCol.updateOne({ token }, { $set: update });
+      res.json({ success: true });
+      return;
+    }
+    const doc = {
+      _id: (0, import_node_crypto5.randomUUID)(),
+      deviceId,
+      token,
+      provider,
+      platform,
+      enabled: true,
+      lastSeenAt: now,
+      createdAt: now,
+      updatedAt: now
+    };
+    if (locale !== void 0) doc.locale = locale;
+    if (timezone !== void 0) doc.timezone = timezone;
+    if (appVersion !== void 0) doc.appVersion = appVersion;
+    if (permissionStatus !== void 0) doc.permissionStatus = permissionStatus;
+    try {
+      await devicesCol.insertOne(doc);
+    } catch (err) {
+      if (!isDuplicateKeyError(err)) throw err;
+      const update = {
+        deviceId,
+        enabled: true,
+        lastSeenAt: now,
+        updatedAt: now,
+        provider,
+        platform
+      };
+      if (locale !== void 0) update.locale = locale;
+      if (timezone !== void 0) update.timezone = timezone;
+      if (appVersion !== void 0) update.appVersion = appVersion;
+      if (permissionStatus !== void 0)
+        update.permissionStatus = permissionStatus;
+      await devicesCol.updateOne({ token }, { $set: update });
+    }
+    res.json({ success: true });
+  });
+  router.post("/unregister", async (req, res) => {
+    const deviceId = checkAuth(req, res);
+    if (!deviceId) return;
+    await devicesCol.updateMany(
+      { deviceId },
+      { $set: { enabled: false, updatedAt: /* @__PURE__ */ new Date() } }
+    );
+    res.json({ success: true });
+  });
+  router.post("/open", async (req, res) => {
+    const deviceId = checkAuth(req, res);
+    if (!deviceId) return;
+    const { deliveryId } = req.body ?? {};
+    if (!isNonEmptyString(deliveryId)) {
+      res.status(400).json({ success: false, error: "Invalid request body" });
+      return;
+    }
+    const delivery = await deliveriesCol.findOne({ _id: deliveryId });
+    if (!delivery || delivery.deviceId !== deviceId) {
+      res.status(404).json({ success: false, error: "NOT_FOUND" });
+      return;
+    }
+    const update = { status: "opened" };
+    if (!delivery.openedAt) {
+      update.openedAt = /* @__PURE__ */ new Date();
+    }
+    await deliveriesCol.updateOne({ _id: deliveryId }, { $set: update });
+    res.json({ success: true });
+  });
+  return router;
+}
+function isDuplicateKeyError(err) {
+  return typeof err === "object" && err !== null && "code" in err && err.code === 11e3;
+}
+
+// src/admin/router.ts
+var import_express4 = require("express");
+var import_node_crypto7 = require("crypto");
+var import_zod = require("zod");
+
+// src/admin/guard.ts
+var import_node_crypto6 = require("crypto");
+var ADMIN_HEADER = "x-codixus-admin";
+function digestToken(token) {
+  return (0, import_node_crypto6.createHash)("sha256").update(token, "utf8").digest();
+}
+function tokensMatch(provided, expected) {
+  return (0, import_node_crypto6.timingSafeEqual)(digestToken(provided), digestToken(expected));
+}
+function readHeader(req) {
+  const value = req.headers[ADMIN_HEADER];
+  if (typeof value === "string") return value;
+  if (Array.isArray(value)) return value[0];
+  return void 0;
+}
+function createAdminGuard(expectedToken) {
+  return (req, res, next) => {
+    const token = readHeader(req);
+    if (!token || !tokensMatch(token, expectedToken)) {
+      res.status(401).json({ success: false, error: "UNAUTHORIZED" });
+      return;
+    }
+    next();
+  };
+}
+
+// src/admin/router.ts
+var USERS_FIELDS = ["_id", "deviceId", "locale", "createdAt"];
+var PUSH_DEVICE_FIELDS = [
+  "_id",
+  "deviceId",
+  "token",
+  "provider",
+  "platform",
+  "locale",
+  "timezone",
+  "appVersion",
+  "permissionStatus",
+  "enabled",
+  "lastSeenAt",
+  "properties",
+  "createdAt",
+  "updatedAt"
+];
+var PUSH_DELIVERY_FIELDS = [
+  "_id",
+  "deviceId",
+  "token",
+  "provider",
+  "title",
+  "body",
+  "data",
+  "status",
+  "ticketId",
+  "errorCode",
+  "idempotencyKey",
+  "createdAt",
+  "openedAt",
+  "receiptedAt"
+];
+function param2(req, name) {
+  const val = req.params[name];
+  return Array.isArray(val) ? val[0] : val ?? "";
+}
+function isNonEmptyString2(value) {
+  return typeof value === "string" && value.length > 0;
+}
+function getModelSchema(model2) {
+  return model2.definition.schema;
+}
+function getModelFields(model2) {
+  const schema = getModelSchema(model2);
+  const fields = schema instanceof import_zod.z.ZodObject ? Object.keys(schema.shape) : [];
+  if (!fields.includes("_id")) {
+    return ["_id", ...fields];
+  }
+  return fields;
+}
+function escapeRegex(value) {
+  return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function parseJsonObject(value, res) {
+  if (value === void 0 || value === "") {
+    return {};
+  }
+  if (typeof value !== "string") {
+    res.status(400).json({ success: false, error: "Invalid request body" });
+    return null;
+  }
+  try {
+    const parsed = JSON.parse(value);
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+      res.status(400).json({ success: false, error: "Invalid request body" });
+      return null;
+    }
+    return parsed;
+  } catch {
+    res.status(400).json({ success: false, error: "Invalid request body" });
+    return null;
+  }
+}
+function parseSort(value, res) {
+  if (value === void 0 || value === "") {
+    return {};
+  }
+  const parsed = parseJsonObject(value, res);
+  if (parsed === null) return null;
+  const sort = {};
+  for (const [field, direction] of Object.entries(parsed)) {
+    if (direction !== 1 && direction !== -1) {
+      res.status(400).json({ success: false, error: "Invalid request body" });
+      return null;
+    }
+    sort[field] = direction;
+  }
+  return sort;
+}
+function parseLimit(value) {
+  const parsed = Number.parseInt(String(value ?? ""), 10);
+  if (Number.isNaN(parsed) || parsed < 1) return 50;
+  return Math.min(parsed, 100);
+}
+function parseSkip(value) {
+  const parsed = Number.parseInt(String(value ?? ""), 10);
+  if (Number.isNaN(parsed) || parsed < 0) return 0;
+  return parsed;
+}
+var NATIVE_DATE_FIELDS = /* @__PURE__ */ new Set([
+  "createdAt",
+  "updatedAt",
+  "lastSeenAt",
+  "openedAt",
+  "receiptedAt"
+]);
+function prepareSetValues(setValues) {
+  const next = { ...setValues };
+  delete next._id;
+  for (const [key, value] of Object.entries(next)) {
+    if (!NATIVE_DATE_FIELDS.has(key) || typeof value !== "string") {
+      continue;
+    }
+    const parsed = new Date(value);
+    if (!Number.isNaN(parsed.getTime())) {
+      next[key] = parsed;
+    }
+  }
+  return next;
+}
+function extractSetValues(body) {
+  if (!body || typeof body !== "object" || Array.isArray(body)) {
+    return {};
+  }
+  const obj = body;
+  const update = obj.update;
+  if (update !== void 0) {
+    if (!update || typeof update !== "object" || Array.isArray(update)) {
+      return null;
+    }
+    const setValues = update.$set;
+    if (setValues === void 0 || typeof setValues !== "object" || setValues === null || Array.isArray(setValues)) {
+      return null;
+    }
+    return setValues;
+  }
+  return obj;
+}
+function buildCollectionsList(hasPush) {
+  const byName = /* @__PURE__ */ new Map();
+  for (const model2 of getModelRegistry()) {
+    byName.set(model2.collectionName, {
+      name: model2.collectionName,
+      fields: getModelFields(model2),
+      kind: "model"
+    });
+  }
+  if (!byName.has("users")) {
+    byName.set("users", {
+      name: "users",
+      fields: [...USERS_FIELDS],
+      kind: "users"
+    });
+  }
+  if (hasPush) {
+    if (!byName.has("push_devices")) {
+      byName.set("push_devices", {
+        name: "push_devices",
+        fields: [...PUSH_DEVICE_FIELDS],
+        kind: "push_devices"
+      });
+    }
+    if (!byName.has("push_deliveries")) {
+      byName.set("push_deliveries", {
+        name: "push_deliveries",
+        fields: [...PUSH_DELIVERY_FIELDS],
+        kind: "push_deliveries"
+      });
+    }
+  }
+  return Array.from(byName.values()).sort(
+    (a, b) => a.name.localeCompare(b.name)
+  );
+}
+function resolveCollection(name, hasPush) {
+  if (name === "refresh_tokens") return null;
+  const model2 = getModelRegistry().find((m) => m.collectionName === name);
+  if (model2) {
+    return { kind: "model", name, model: model2 };
+  }
+  if (name === "users") {
+    return { kind: "users", name: "users" };
+  }
+  if (hasPush && name === "push_devices") {
+    return { kind: "push_devices", name: "push_devices" };
+  }
+  if (hasPush && name === "push_deliveries") {
+    return { kind: "push_deliveries", name: "push_deliveries" };
+  }
+  return null;
+}
+function notFound(res) {
+  res.status(404).json({ success: false, error: "NOT_FOUND" });
+}
+function invalidBody(res) {
+  res.status(400).json({ success: false, error: "Invalid request body" });
+}
+function createAdminRouter(deps) {
+  const router = (0, import_express4.Router)();
+  router.use(createAdminGuard(deps.token));
+  router.get("/session", (_req, res) => {
+    res.status(204).send();
+  });
+  router.get("/collections", (_req, res) => {
+    res.json({
+      success: true,
+      data: buildCollectionsList(deps.hasPush)
+    });
+  });
+  router.get("/collections/:name", async (req, res) => {
+    const name = param2(req, "name");
+    const resolved = resolveCollection(name, deps.hasPush);
+    if (!resolved) {
+      notFound(res);
+      return;
+    }
+    const filter = parseJsonObject(req.query.filter, res);
+    if (filter === null) return;
+    const sort = parseSort(req.query.sort, res);
+    if (sort === null) return;
+    const limit = parseLimit(req.query.limit);
+    const skip = parseSkip(req.query.skip);
+    const docs = await deps.db.collection(name).find(filter).sort(sort).skip(skip).limit(limit).toArray();
+    const payload = {
+      success: true,
+      data: docs
+    };
+    if (docs.length === limit) {
+      payload.nextSkip = skip + limit;
+    }
+    res.json(payload);
+  });
+  router.post("/collections/:name", async (req, res) => {
+    const name = param2(req, "name");
+    const resolved = resolveCollection(name, deps.hasPush);
+    if (!resolved) {
+      notFound(res);
+      return;
+    }
+    const body = req.body ?? {};
+    if (resolved.kind === "model") {
+      try {
+        const created = await resolved.model.create(body);
+        res.status(200).json({ success: true, data: created });
+      } catch {
+        invalidBody(res);
+      }
+      return;
+    }
+    if (!body || typeof body !== "object" || Array.isArray(body)) {
+      invalidBody(res);
+      return;
+    }
+    const doc = { ...body };
+    if (!doc._id) {
+      doc._id = (0, import_node_crypto7.randomUUID)();
+    }
+    await deps.db.collection(name).insertOne(doc);
+    res.status(200).json({ success: true, data: doc });
+  });
+  router.get("/collections/:name/:id", async (req, res) => {
+    const name = param2(req, "name");
+    const id = param2(req, "id");
+    const resolved = resolveCollection(name, deps.hasPush);
+    if (!resolved) {
+      notFound(res);
+      return;
+    }
+    const doc = await deps.db.collection(name).findOne({ _id: id });
+    if (!doc) {
+      notFound(res);
+      return;
+    }
+    res.json({ success: true, data: doc });
+  });
+  router.patch(
+    "/collections/:name/:id",
+    async (req, res) => {
+      const name = param2(req, "name");
+      const id = param2(req, "id");
+      const resolved = resolveCollection(name, deps.hasPush);
+      if (!resolved) {
+        notFound(res);
+        return;
+      }
+      const setValues = extractSetValues(req.body);
+      if (setValues === null) {
+        invalidBody(res);
+        return;
+      }
+      const col = deps.db.collection(name);
+      const existing = await col.findOne({ _id: id });
+      if (!existing) {
+        notFound(res);
+        return;
+      }
+      if (resolved.kind === "model") {
+        const schema = getModelSchema(resolved.model);
+        try {
+          schema.parse({ ...existing, ...setValues });
+        } catch {
+          invalidBody(res);
+          return;
+        }
+      }
+      const prepared = prepareSetValues(setValues);
+      if (Object.keys(prepared).length > 0) {
+        await col.updateOne({ _id: id }, { $set: prepared });
+      }
+      const updated = await col.findOne({ _id: id });
+      res.json({ success: true, data: updated });
+    }
+  );
+  router.delete(
+    "/collections/:name/:id",
+    async (req, res) => {
+      const name = param2(req, "name");
+      const id = param2(req, "id");
+      const resolved = resolveCollection(name, deps.hasPush);
+      if (!resolved) {
+        notFound(res);
+        return;
+      }
+      const result = await deps.db.collection(name).deleteOne({ _id: id });
+      if (result.deletedCount === 0) {
+        notFound(res);
+        return;
+      }
+      res.status(204).send();
+    }
+  );
+  router.get("/push/devices", async (req, res) => {
+    if (!deps.hasPush) {
+      notFound(res);
+      return;
+    }
+    const q = req.query.q;
+    if (!isNonEmptyString2(q)) {
+      invalidBody(res);
+      return;
+    }
+    const devicesCol = deps.db.collection("push_devices");
+    const pattern = escapeRegex(q);
+    const docs = await devicesCol.find({
+      $or: [
+        { deviceId: { $regex: pattern } },
+        { token: { $regex: pattern } }
+      ]
+    }).sort({ enabled: -1, lastSeenAt: -1 }).limit(50).toArray();
+    res.json({ success: true, data: docs });
+  });
+  router.post("/push/send", async (req, res) => {
+    if (!deps.hasPush || !deps.pushSend) {
+      notFound(res);
+      return;
+    }
+    const { deviceId, title, body, data } = req.body ?? {};
+    if (!isNonEmptyString2(deviceId) || !isNonEmptyString2(title) || !isNonEmptyString2(body)) {
+      invalidBody(res);
+      return;
+    }
+    const devicesCol = deps.db.collection("push_devices");
+    const device = await devicesCol.findOne({ deviceId, enabled: true });
+    if (!device) {
+      res.status(404).json({ success: false, error: "NO_DEVICE" });
+      return;
+    }
+    const input = { deviceId, title, body };
+    if (data !== void 0) {
+      input.data = data;
+    }
+    await deps.pushSend(input);
+    res.status(200).json({ success: true });
+  });
+  router.get("/push/deliveries", async (req, res) => {
+    if (!deps.hasPush) {
+      notFound(res);
+      return;
+    }
+    const deviceId = req.query.deviceId;
+    if (!isNonEmptyString2(deviceId)) {
+      invalidBody(res);
+      return;
+    }
+    const deliveriesCol = deps.db.collection("push_deliveries");
+    const docs = await deliveriesCol.find({ deviceId }).sort({ createdAt: -1 }).limit(50).toArray();
+    res.json({ success: true, data: docs });
+  });
+  return router;
+}
+
+// src/push/service.ts
+var import_node_crypto8 = require("crypto");
+var PERMANENT_DISABLE_CODES = /* @__PURE__ */ new Set([
+  "DeviceNotRegistered",
+  "InvalidCredentials"
+]);
+var RECEIPT_BATCH_SIZE = 100;
+var PushService = class {
+  constructor(db, transport) {
+    this.transport = transport;
+    this.devicesCol = db.collection("push_devices");
+    this.deliveriesCol = db.collection("push_deliveries");
+  }
+  transport;
+  devicesCol;
+  deliveriesCol;
+  async send(input) {
+    const deviceIds = Array.isArray(input.deviceId) ? [...new Set(input.deviceId)] : [input.deviceId];
+    if (deviceIds.length === 0) return;
+    const digest = computeDigest(
+      input.title,
+      input.body,
+      input.idempotencyKey
+    );
+    const pending = [];
+    for (const deviceId of deviceIds) {
+      const devices = await this.devicesCol.find({ deviceId, enabled: true }).toArray();
+      for (const device of devices) {
+        const idempotencyKey = `${deviceId}:${device.token}:${digest}`;
+        const existing = await this.deliveriesCol.findOne({ idempotencyKey });
+        if (existing) continue;
+        const deliveryId = (0, import_node_crypto8.randomUUID)();
+        const data = input.data ? { ...input.data } : {};
+        if (!("deliveryId" in data)) {
+          data.deliveryId = deliveryId;
+        }
+        pending.push({
+          token: device.token,
+          deviceId,
+          provider: device.provider,
+          deliveryId,
+          idempotencyKey,
+          message: {
+            token: device.token,
+            title: input.title,
+            body: input.body,
+            data
+          }
+        });
+      }
+    }
+    if (pending.length === 0) return;
+    const messages = pending.map((p) => p.message);
+    const tickets = await this.transport.send(messages);
+    for (let i = 0; i < pending.length; i++) {
+      const item = pending[i];
+      const ticket = tickets[i];
+      if (ticket && ticket.status === "error" && ticket.errorCode && PERMANENT_DISABLE_CODES.has(ticket.errorCode)) {
+        await this.devicesCol.updateOne(
+          { token: item.token },
+          { $set: { enabled: false, updatedAt: /* @__PURE__ */ new Date() } }
+        );
+      }
+      const doc = {
+        _id: item.deliveryId,
+        deviceId: item.deviceId,
+        token: item.token,
+        provider: item.provider,
+        title: input.title,
+        body: input.body,
+        data: item.message.data,
+        status: "failed",
+        idempotencyKey: item.idempotencyKey,
+        createdAt: /* @__PURE__ */ new Date()
+      };
+      if (ticket && ticket.status === "ok") {
+        doc.status = "submitted";
+        if (ticket.ticketId) doc.ticketId = ticket.ticketId;
+      } else {
+        doc.errorCode = ticket?.errorCode ?? "TRANSIENT";
+        if (ticket?.ticketId) doc.ticketId = ticket.ticketId;
+      }
+      try {
+        await this.deliveriesCol.insertOne(doc);
+      } catch (err) {
+        if (!isDuplicateKeyError2(err)) throw err;
+      }
+    }
+  }
+  async sendTo(input) {
+    const devices = await this.devicesCol.find({ $and: [input.filter, { enabled: true }] }).toArray();
+    const seen = /* @__PURE__ */ new Set();
+    const deviceIds = [];
+    for (const device of devices) {
+      if (!seen.has(device.deviceId)) {
+        seen.add(device.deviceId);
+        deviceIds.push(device.deviceId);
+      }
+    }
+    if (deviceIds.length === 0) return;
+    await this.send({
+      deviceId: deviceIds,
+      title: input.title,
+      body: input.body,
+      data: input.data,
+      idempotencyKey: input.idempotencyKey
+    });
+  }
+  async pollReceipts() {
+    if (!this.transport.getReceipts) return;
+    const deliveries = await this.deliveriesCol.find({
+      status: "submitted",
+      ticketId: { $exists: true, $ne: "" },
+      receiptedAt: { $exists: false }
+    }).toArray();
+    if (deliveries.length === 0) return;
+    const ticketIds = [
+      ...new Set(
+        deliveries.map((d) => d.ticketId).filter((id) => !!id)
+      )
+    ];
+    const receipts = [];
+    try {
+      for (let i = 0; i < ticketIds.length; i += RECEIPT_BATCH_SIZE) {
+        const chunk = ticketIds.slice(i, i + RECEIPT_BATCH_SIZE);
+        const batch = await this.transport.getReceipts(chunk);
+        receipts.push(...batch);
+      }
+    } catch {
+      return;
+    }
+    const receiptMap = new Map(receipts.map((r) => [r.ticketId, r]));
+    for (const delivery of deliveries) {
+      if (!delivery.ticketId) continue;
+      const receipt = receiptMap.get(delivery.ticketId);
+      if (!receipt) continue;
+      const now = /* @__PURE__ */ new Date();
+      if (receipt.status === "ok") {
+        await this.deliveriesCol.updateOne(
+          { _id: delivery._id },
+          { $set: { receiptedAt: now } }
+        );
+      } else {
+        const errorCode = receipt.errorCode ?? "UNKNOWN";
+        await this.deliveriesCol.updateOne(
+          { _id: delivery._id },
+          {
+            $set: {
+              status: "failed",
+              errorCode,
+              receiptedAt: now
+            }
+          }
+        );
+        if (PERMANENT_DISABLE_CODES.has(errorCode)) {
+          await this.devicesCol.updateOne(
+            { token: delivery.token },
+            { $set: { enabled: false, updatedAt: now } }
+          );
+        }
+      }
+    }
+  }
+  async find(filter) {
+    return this.devicesCol.find(filter).toArray();
+  }
+};
+function computeDigest(title, body, idempotencyKey) {
+  if (idempotencyKey) return idempotencyKey;
+  const utcDay = (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
+  const input = title + "\0" + body + "\0" + utcDay;
+  return (0, import_node_crypto8.createHash)("sha256").update(input, "utf8").digest("hex");
+}
+function isDuplicateKeyError2(err) {
+  return typeof err === "object" && err !== null && "code" in err && err.code === 11e3;
+}
+
 // src/codixus-server.ts
 var CodixusServer = class {
   constructor(config) {
@@ -1317,6 +2039,7 @@ var CodixusServer = class {
       refreshTokenTtl: config.refreshTokenTtl ?? "30d"
     });
   }
+  config;
   connection;
   jwt;
   banService;
@@ -1326,6 +2049,8 @@ var CodixusServer = class {
   _appSecret;
   auth;
   db;
+  push;
+  admin;
   async connect() {
     this._db = await this.connection.connect();
     this.banService = new BanService(this._db);
@@ -1341,6 +2066,27 @@ var CodixusServer = class {
       { expiresAt: 1 },
       { expireAfterSeconds: 0 }
     );
+    if (this.config.push) {
+      const pushDevicesCol = this._db.collection("push_devices");
+      await pushDevicesCol.createIndex({ token: 1 }, { unique: true });
+      await pushDevicesCol.createIndex({ deviceId: 1 });
+      await pushDevicesCol.createIndex({ enabled: 1, lastSeenAt: -1 });
+      const pushDeliveriesCol = this._db.collection("push_deliveries");
+      await pushDeliveriesCol.createIndex(
+        { idempotencyKey: 1 },
+        { unique: true }
+      );
+      await pushDeliveriesCol.createIndex({ ticketId: 1 });
+      await pushDeliveriesCol.createIndex({ deviceId: 1 });
+      const pushService = new PushService(this._db, this.config.push.transport);
+      this.push = {
+        router: () => createPushRouter(this._db),
+        send: (input) => pushService.send(input),
+        sendTo: (input) => pushService.sendTo(input),
+        pollReceipts: () => pushService.pollReceipts(),
+        find: (filter) => pushService.find(filter)
+      };
+    }
     this.auth = {
       sign: (subject, claims) => this.jwt.sign(subject, claims),
       verify: (token) => this.jwt.verify(token),
@@ -1360,6 +2106,16 @@ var CodixusServer = class {
       transaction: (fn) => runTransaction(this.connection.getClient(), fn),
       getDb: () => this._db
     };
+    if (this.config.admin) {
+      this.admin = {
+        router: () => createAdminRouter({
+          db: this._db,
+          token: this.config.admin.token,
+          hasPush: !!this.config.push,
+          pushSend: this.push?.send
+        })
+      };
+    }
   }
   /**
    * HMAC request signing middleware.
@@ -1412,6 +2168,149 @@ function validate(schema) {
   };
 }
 
+// src/push/expo-transport.ts
+var SEND_URL = "https://exp.host/--/api/v2/push/send";
+var RECEIPTS_URL = "https://exp.host/--/api/v2/push/getReceipts";
+var BATCH_SIZE = 100;
+function transientTickets(messages) {
+  return messages.map((m) => ({
+    token: m.token,
+    status: "error",
+    errorCode: "TRANSIENT"
+  }));
+}
+function invalidPayloadTickets(messages) {
+  return messages.map((m) => ({
+    token: m.token,
+    status: "error",
+    errorCode: "INVALID_PAYLOAD"
+  }));
+}
+function mapExpoTickets(messages, data) {
+  const tickets = [];
+  for (let i = 0; i < messages.length; i++) {
+    const msg = messages[i];
+    const ticket = data[i];
+    if (!ticket) {
+      tickets.push({
+        token: msg.token,
+        status: "error",
+        errorCode: "TRANSIENT"
+      });
+      continue;
+    }
+    if (ticket.status === "ok") {
+      tickets.push({
+        token: msg.token,
+        status: "ok",
+        ticketId: ticket.id
+      });
+    } else {
+      tickets.push({
+        token: msg.token,
+        status: "error",
+        errorCode: ticket.details?.error ?? "UNKNOWN",
+        errorMessage: ticket.message
+      });
+    }
+  }
+  return tickets;
+}
+function createExpoTransport(opts) {
+  const fetchImpl = opts?.fetchImpl ?? globalThis.fetch;
+  const accessToken = opts?.accessToken;
+  function headers() {
+    const h = {
+      "Content-Type": "application/json"
+    };
+    if (accessToken) {
+      h["Authorization"] = `Bearer ${accessToken}`;
+    }
+    return h;
+  }
+  return {
+    name: "expo",
+    async send(messages) {
+      const allTickets = [];
+      for (let i = 0; i < messages.length; i += BATCH_SIZE) {
+        const batch = messages.slice(i, i + BATCH_SIZE);
+        const body = batch.map((m) => {
+          const item = {
+            to: m.token,
+            title: m.title,
+            body: m.body
+          };
+          if (m.data !== void 0) item.data = m.data;
+          if (m.ttl !== void 0) item.ttl = m.ttl;
+          if (m.badge !== void 0) item.badge = m.badge;
+          if (m.sound !== void 0) item.sound = m.sound;
+          if (m.channelId !== void 0) item.channelId = m.channelId;
+          return item;
+        });
+        try {
+          const res = await fetchImpl(SEND_URL, {
+            method: "POST",
+            headers: headers(),
+            body: JSON.stringify(body)
+          });
+          if (res.status === 429 || res.status >= 500) {
+            allTickets.push(...transientTickets(batch));
+            continue;
+          }
+          if (res.status >= 400 && res.status < 500) {
+            allTickets.push(...invalidPayloadTickets(batch));
+            continue;
+          }
+          const json = await res.json();
+          if (!Array.isArray(json.data)) {
+            allTickets.push(...transientTickets(batch));
+            continue;
+          }
+          allTickets.push(
+            ...mapExpoTickets(batch, json.data)
+          );
+        } catch {
+          allTickets.push(...transientTickets(batch));
+        }
+      }
+      return allTickets;
+    },
+    async getReceipts(ticketIds) {
+      const allReceipts = [];
+      for (let i = 0; i < ticketIds.length; i += BATCH_SIZE) {
+        const batch = ticketIds.slice(i, i + BATCH_SIZE);
+        const res = await fetchImpl(RECEIPTS_URL, {
+          method: "POST",
+          headers: headers(),
+          body: JSON.stringify({ ids: batch })
+        });
+        if (!res.ok) {
+          throw new Error(`Expo getReceipts HTTP ${res.status}`);
+        }
+        const json = await res.json();
+        if (typeof json.data !== "object" || json.data === null || Array.isArray(json.data)) {
+          throw new Error("Expo getReceipts invalid response");
+        }
+        const data = json.data;
+        for (const id of batch) {
+          const receipt = data[id];
+          if (!receipt) continue;
+          if (receipt.status === "ok") {
+            allReceipts.push({ ticketId: id, status: "ok" });
+          } else {
+            allReceipts.push({
+              ticketId: id,
+              status: "error",
+              errorCode: receipt.status === "error" ? receipt.details?.error ?? "UNKNOWN" : "UNKNOWN"
+            });
+          }
+        }
+      }
+      return allReceipts;
+    }
+  };
+}
+
 // src/index.ts
 var import_shared4 = require("@codixus/shared");
 // Annotate the CommonJS export names for ESM import in node:
@@ -1423,6 +2322,7 @@ var import_shared4 = require("@codixus/shared");
   Query,
   RestErrorCode,
   SubCollection,
+  createExpoTransport,
   model,
   validate
 });