@open-mercato/core 0.4.2-canary-7c76659938 → 0.4.2-canary-70c8402224

package/dist/modules/notifications/lib/notificationRecipients.js

@@ -0,0 +1,35 @@
+import { hasFeature } from "@open-mercato/shared/security/features";
+function normalizeFeatures(features) {
+  if (!Array.isArray(features)) return void 0;
+  const normalized = features.filter((feature) => typeof feature === "string");
+  return normalized.length ? normalized : void 0;
+}
+function collectUsersWithFeature(userIdsSet, rows, requiredFeature) {
+  for (const row of rows) {
+    if (row.is_super_admin) {
+      userIdsSet.add(row.user_id);
+      continue;
+    }
+    const features = normalizeFeatures(row.features_json);
+    if (features && hasFeature(features, requiredFeature)) {
+      userIdsSet.add(row.user_id);
+    }
+  }
+}
+async function getRecipientUserIdsForRole(knex, tenantId, roleId) {
+  const userRoles = await knex("user_roles").join("users", "user_roles.user_id", "users.id").where("user_roles.role_id", roleId).whereNull("user_roles.deleted_at").whereNull("users.deleted_at").where("users.tenant_id", tenantId).select("users.id as user_id");
+  return userRoles.map((row) => row.user_id);
+}
+async function getRecipientUserIdsForFeature(knex, tenantId, requiredFeature) {
+  const userIdsSet = /* @__PURE__ */ new Set();
+  const userAcls = await knex("user_acls").join("users", "user_acls.user_id", "users.id").where("user_acls.tenant_id", tenantId).whereNull("user_acls.deleted_at").whereNull("users.deleted_at").where("users.tenant_id", tenantId).select("users.id as user_id", "user_acls.features_json", "user_acls.is_super_admin");
+  collectUsersWithFeature(userIdsSet, userAcls, requiredFeature);
+  const roleAcls = await knex("role_acls").join("user_roles", "role_acls.role_id", "user_roles.role_id").join("users", "user_roles.user_id", "users.id").where("role_acls.tenant_id", tenantId).whereNull("role_acls.deleted_at").whereNull("user_roles.deleted_at").whereNull("users.deleted_at").where("users.tenant_id", tenantId).select("users.id as user_id", "role_acls.features_json", "role_acls.is_super_admin");
+  collectUsersWithFeature(userIdsSet, roleAcls, requiredFeature);
+  return Array.from(userIdsSet);
+}
+export {
+  getRecipientUserIdsForFeature,
+  getRecipientUserIdsForRole
+};
+//# sourceMappingURL=notificationRecipients.js.map

package/dist/modules/notifications/lib/notificationRecipients.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/notifications/lib/notificationRecipients.ts"],
+  "sourcesContent": ["import type { Knex } from 'knex'\nimport { hasFeature } from '@open-mercato/shared/security/features'\n\ninterface AclRow {\n  user_id: string\n  features_json: unknown\n  is_super_admin: boolean\n}\n\nfunction normalizeFeatures(features: unknown): string[] | undefined {\n  if (!Array.isArray(features)) return undefined\n  const normalized = features.filter((feature): feature is string => typeof feature === 'string')\n  return normalized.length ? normalized : undefined\n}\n\n/**\n * Extract user IDs from ACL rows that have the required feature or are super admins.\n */\nfunction collectUsersWithFeature(\n  userIdsSet: Set<string>,\n  rows: AclRow[],\n  requiredFeature: string\n): void {\n  for (const row of rows) {\n    if (row.is_super_admin) {\n      userIdsSet.add(row.user_id)\n      continue\n    }\n\n    const features = normalizeFeatures(row.features_json)\n    if (features && hasFeature(features, requiredFeature)) {\n      userIdsSet.add(row.user_id)\n    }\n  }\n}\n\nexport async function getRecipientUserIdsForRole(\n  knex: Knex,\n  tenantId: string,\n  roleId: string\n): Promise<string[]> {\n  const userRoles = await knex('user_roles')\n    .join('users', 'user_roles.user_id', 'users.id')\n    .where('user_roles.role_id', roleId)\n    .whereNull('user_roles.deleted_at')\n    .whereNull('users.deleted_at')\n    .where('users.tenant_id', tenantId)\n    .select('users.id as user_id')\n\n  return userRoles.map((row: { user_id: string }) => row.user_id)\n}\n\nexport async function getRecipientUserIdsForFeature(\n  knex: Knex,\n  tenantId: string,\n  requiredFeature: string\n): Promise<string[]> {\n  const userIdsSet = new Set<string>()\n\n  const userAcls = await knex('user_acls')\n    .join('users', 'user_acls.user_id', 'users.id')\n    .where('user_acls.tenant_id', tenantId)\n    .whereNull('user_acls.deleted_at')\n    .whereNull('users.deleted_at')\n    .where('users.tenant_id', tenantId)\n    .select('users.id as user_id', 'user_acls.features_json', 'user_acls.is_super_admin')\n\n  collectUsersWithFeature(userIdsSet, userAcls, requiredFeature)\n\n  const roleAcls = await knex('role_acls')\n    .join('user_roles', 'role_acls.role_id', 'user_roles.role_id')\n    .join('users', 'user_roles.user_id', 'users.id')\n    .where('role_acls.tenant_id', tenantId)\n    .whereNull('role_acls.deleted_at')\n    .whereNull('user_roles.deleted_at')\n    .whereNull('users.deleted_at')\n    .where('users.tenant_id', tenantId)\n    .select('users.id as user_id', 'role_acls.features_json', 'role_acls.is_super_admin')\n\n  collectUsersWithFeature(userIdsSet, roleAcls, requiredFeature)\n\n  return Array.from(userIdsSet)\n}\n"],
+  "mappings": "AACA,SAAS,kBAAkB;AAQ3B,SAAS,kBAAkB,UAAyC;AAClE,MAAI,CAAC,MAAM,QAAQ,QAAQ,EAAG,QAAO;AACrC,QAAM,aAAa,SAAS,OAAO,CAAC,YAA+B,OAAO,YAAY,QAAQ;AAC9F,SAAO,WAAW,SAAS,aAAa;AAC1C;AAKA,SAAS,wBACP,YACA,MACA,iBACM;AACN,aAAW,OAAO,MAAM;AACtB,QAAI,IAAI,gBAAgB;AACtB,iBAAW,IAAI,IAAI,OAAO;AAC1B;AAAA,IACF;AAEA,UAAM,WAAW,kBAAkB,IAAI,aAAa;AACpD,QAAI,YAAY,WAAW,UAAU,eAAe,GAAG;AACrD,iBAAW,IAAI,IAAI,OAAO;AAAA,IAC5B;AAAA,EACF;AACF;AAEA,eAAsB,2BACpB,MACA,UACA,QACmB;AACnB,QAAM,YAAY,MAAM,KAAK,YAAY,EACtC,KAAK,SAAS,sBAAsB,UAAU,EAC9C,MAAM,sBAAsB,MAAM,EAClC,UAAU,uBAAuB,EACjC,UAAU,kBAAkB,EAC5B,MAAM,mBAAmB,QAAQ,EACjC,OAAO,qBAAqB;AAE/B,SAAO,UAAU,IAAI,CAAC,QAA6B,IAAI,OAAO;AAChE;AAEA,eAAsB,8BACpB,MACA,UACA,iBACmB;AACnB,QAAM,aAAa,oBAAI,IAAY;AAEnC,QAAM,WAAW,MAAM,KAAK,WAAW,EACpC,KAAK,SAAS,qBAAqB,UAAU,EAC7C,MAAM,uBAAuB,QAAQ,EACrC,UAAU,sBAAsB,EAChC,UAAU,kBAAkB,EAC5B,MAAM,mBAAmB,QAAQ,EACjC,OAAO,uBAAuB,2BAA2B,0BAA0B;AAEtF,0BAAwB,YAAY,UAAU,eAAe;AAE7D,QAAM,WAAW,MAAM,KAAK,WAAW,EACpC,KAAK,cAAc,qBAAqB,oBAAoB,EAC5D,KAAK,SAAS,sBAAsB,UAAU,EAC9C,MAAM,uBAAuB,QAAQ,EACrC,UAAU,sBAAsB,EAChC,UAAU,uBAAuB,EACjC,UAAU,kBAAkB,EAC5B,MAAM,mBAAmB,QAAQ,EACjC,OAAO,uBAAuB,2BAA2B,0BAA0B;AAEtF,0BAAwB,YAAY,UAAU,eAAe;AAE7D,SAAO,MAAM,KAAK,UAAU;AAC9B;",
+  "names": []
+}

package/dist/modules/notifications/lib/notificationService.js

@@ -0,0 +1,279 @@
+import { Notification } from "../data/entities.js";
+import { NOTIFICATION_EVENTS } from "./events.js";
+import { buildNotificationEntity, emitNotificationCreated, emitNotificationCreatedBatch } from "./notificationFactory.js";
+import { toNotificationDto } from "./notificationMapper.js";
+import { getRecipientUserIdsForFeature, getRecipientUserIdsForRole } from "./notificationRecipients.js";
+const DEBUG = process.env.NOTIFICATIONS_DEBUG === "true";
+function debug(...args) {
+  if (DEBUG) {
+    console.log("[notifications]", ...args);
+  }
+}
+function getKnex(em) {
+  return em.getConnection().getKnex();
+}
+function createNotificationService(deps) {
+  const { em: rootEm, eventBus, commandBus, container } = deps;
+  return {
+    async create(input, ctx) {
+      const em = rootEm.fork();
+      const { recipientUserId, ...content } = input;
+      const notification = buildNotificationEntity(em, content, recipientUserId, ctx);
+      await em.persistAndFlush(notification);
+      await emitNotificationCreated(eventBus, notification, ctx);
+      return notification;
+    },
+    async createBatch(input, ctx) {
+      const em = rootEm.fork();
+      const { recipientUserIds, ...content } = input;
+      const notifications = [];
+      for (const recipientUserId of recipientUserIds) {
+        const notification = buildNotificationEntity(em, content, recipientUserId, ctx);
+        notifications.push(notification);
+      }
+      await em.persistAndFlush(notifications);
+      await emitNotificationCreatedBatch(eventBus, notifications, ctx);
+      return notifications;
+    },
+    async createForRole(input, ctx) {
+      const em = rootEm.fork();
+      const knex = getKnex(em);
+      const recipientUserIds = await getRecipientUserIdsForRole(knex, ctx.tenantId, input.roleId);
+      if (recipientUserIds.length === 0) {
+        return [];
+      }
+      const { roleId: _roleId, ...content } = input;
+      const notifications = [];
+      for (const recipientUserId of recipientUserIds) {
+        const notification = buildNotificationEntity(em, content, recipientUserId, ctx);
+        notifications.push(notification);
+      }
+      await em.persistAndFlush(notifications);
+      await emitNotificationCreatedBatch(eventBus, notifications, ctx);
+      return notifications;
+    },
+    async createForFeature(input, ctx) {
+      const em = rootEm.fork();
+      const knex = getKnex(em);
+      const recipientUserIds = await getRecipientUserIdsForFeature(knex, ctx.tenantId, input.requiredFeature);
+      if (recipientUserIds.length === 0) {
+        debug("No users found with feature:", input.requiredFeature, "in tenant:", ctx.tenantId);
+        return [];
+      }
+      debug("Creating notifications for", recipientUserIds.length, "user(s) with feature:", input.requiredFeature);
+      const { requiredFeature: _requiredFeature, ...content } = input;
+      const notifications = [];
+      for (const recipientUserId of recipientUserIds) {
+        const notification = buildNotificationEntity(em, content, recipientUserId, ctx);
+        notifications.push(notification);
+      }
+      await em.persistAndFlush(notifications);
+      await emitNotificationCreatedBatch(eventBus, notifications, ctx);
+      return notifications;
+    },
+    async markAsRead(notificationId, ctx) {
+      const em = rootEm.fork();
+      const notification = await em.findOneOrFail(Notification, {
+        id: notificationId,
+        recipientUserId: ctx.userId,
+        tenantId: ctx.tenantId
+      });
+      if (notification.status === "unread") {
+        notification.status = "read";
+        notification.readAt = /* @__PURE__ */ new Date();
+        await em.flush();
+        await eventBus.emit(NOTIFICATION_EVENTS.READ, {
+          notificationId: notification.id,
+          userId: ctx.userId,
+          tenantId: ctx.tenantId
+        });
+      }
+      return notification;
+    },
+    async markAllAsRead(ctx) {
+      const em = rootEm.fork();
+      const knex = getKnex(em);
+      const result = await knex("notifications").where({
+        recipient_user_id: ctx.userId,
+        tenant_id: ctx.tenantId,
+        status: "unread"
+      }).update({
+        status: "read",
+        read_at: knex.fn.now()
+      });
+      return result;
+    },
+    async dismiss(notificationId, ctx) {
+      const em = rootEm.fork();
+      const notification = await em.findOneOrFail(Notification, {
+        id: notificationId,
+        recipientUserId: ctx.userId,
+        tenantId: ctx.tenantId
+      });
+      notification.status = "dismissed";
+      notification.dismissedAt = /* @__PURE__ */ new Date();
+      await em.flush();
+      await eventBus.emit(NOTIFICATION_EVENTS.DISMISSED, {
+        notificationId: notification.id,
+        userId: ctx.userId,
+        tenantId: ctx.tenantId
+      });
+      return notification;
+    },
+    async restoreDismissed(notificationId, status, ctx) {
+      const em = rootEm.fork();
+      const notification = await em.findOneOrFail(Notification, {
+        id: notificationId,
+        recipientUserId: ctx.userId,
+        tenantId: ctx.tenantId
+      });
+      if (notification.status !== "dismissed") {
+        return notification;
+      }
+      const targetStatus = status ?? "read";
+      notification.status = targetStatus;
+      notification.dismissedAt = null;
+      if (targetStatus === "unread") {
+        notification.readAt = null;
+      } else if (!notification.readAt) {
+        notification.readAt = /* @__PURE__ */ new Date();
+      }
+      await em.flush();
+      await eventBus.emit(NOTIFICATION_EVENTS.RESTORED, {
+        notificationId: notification.id,
+        userId: ctx.userId,
+        tenantId: ctx.tenantId,
+        status: targetStatus
+      });
+      return notification;
+    },
+    async executeAction(notificationId, input, ctx) {
+      const em = rootEm.fork();
+      const notification = await em.findOneOrFail(Notification, {
+        id: notificationId,
+        recipientUserId: ctx.userId,
+        tenantId: ctx.tenantId
+      });
+      const actionData = notification.actionData;
+      const action = actionData?.actions?.find((a) => a.id === input.actionId);
+      if (!action) {
+        throw new Error("Action not found");
+      }
+      let result = null;
+      if (action.commandId && commandBus && container) {
+        const commandInput = {
+          id: notification.sourceEntityId,
+          ...input.payload
+        };
+        const commandCtx = {
+          container,
+          auth: {
+            sub: ctx.userId,
+            tenantId: ctx.tenantId,
+            orgId: ctx.organizationId
+          },
+          organizationScope: null,
+          selectedOrganizationId: ctx.organizationId ?? null,
+          organizationIds: ctx.organizationId ? [ctx.organizationId] : null
+        };
+        const commandResult = await commandBus.execute(action.commandId, {
+          input: commandInput,
+          ctx: commandCtx,
+          metadata: {
+            tenantId: ctx.tenantId,
+            organizationId: ctx.organizationId,
+            resourceKind: "notifications"
+          }
+        });
+        result = commandResult.result;
+      }
+      notification.status = "actioned";
+      notification.actionedAt = /* @__PURE__ */ new Date();
+      notification.actionTaken = input.actionId;
+      notification.actionResult = result;
+      if (!notification.readAt) {
+        notification.readAt = /* @__PURE__ */ new Date();
+      }
+      await em.flush();
+      await eventBus.emit(NOTIFICATION_EVENTS.ACTIONED, {
+        notificationId: notification.id,
+        actionId: input.actionId,
+        userId: ctx.userId,
+        tenantId: ctx.tenantId
+      });
+      return { notification, result };
+    },
+    async getUnreadCount(ctx) {
+      const em = rootEm.fork();
+      return em.count(Notification, {
+        recipientUserId: ctx.userId,
+        tenantId: ctx.tenantId,
+        status: "unread"
+      });
+    },
+    async getPollData(ctx, since) {
+      const em = rootEm.fork();
+      const filters = {
+        recipientUserId: ctx.userId,
+        tenantId: ctx.tenantId
+      };
+      if (since) {
+        filters.createdAt = { $gt: new Date(since) };
+      }
+      const [notifications, unreadCount] = await Promise.all([
+        em.find(Notification, filters, {
+          orderBy: { createdAt: "desc" },
+          limit: 50
+        }),
+        em.count(Notification, {
+          recipientUserId: ctx.userId,
+          tenantId: ctx.tenantId,
+          status: "unread"
+        })
+      ]);
+      const recent = notifications.map(toNotificationDto);
+      const hasNew = since ? recent.length > 0 : false;
+      return {
+        unreadCount,
+        recent,
+        hasNew,
+        lastId: recent[0]?.id
+      };
+    },
+    async cleanupExpired() {
+      const em = rootEm.fork();
+      const knex = getKnex(em);
+      const result = await knex("notifications").where("expires_at", "<", knex.fn.now()).whereNotIn("status", ["actioned", "dismissed"]).update({
+        status: "dismissed",
+        dismissed_at: knex.fn.now()
+      });
+      return result;
+    },
+    async deleteBySource(sourceEntityType, sourceEntityId, ctx) {
+      const em = rootEm.fork();
+      const knex = getKnex(em);
+      const result = await knex("notifications").where({
+        source_entity_type: sourceEntityType,
+        source_entity_id: sourceEntityId,
+        tenant_id: ctx.tenantId
+      }).delete();
+      return result;
+    }
+  };
+}
+function resolveNotificationService(container) {
+  const em = container.resolve("em");
+  const eventBus = container.resolve("eventBus");
+  let commandBus;
+  try {
+    commandBus = container.resolve("commandBus");
+  } catch {
+    commandBus = void 0;
+  }
+  return createNotificationService({ em, eventBus, commandBus, container });
+}
+export {
+  createNotificationService,
+  resolveNotificationService
+};
+//# sourceMappingURL=notificationService.js.map

package/dist/modules/notifications/lib/notificationService.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/notifications/lib/notificationService.ts"],
+  "sourcesContent": ["import type { EntityManager } from '@mikro-orm/core'\nimport type { Knex } from 'knex'\nimport { Notification } from '../data/entities'\nimport type { CreateNotificationInput, CreateBatchNotificationInput, CreateRoleNotificationInput, CreateFeatureNotificationInput, ExecuteActionInput } from '../data/validators'\nimport type { NotificationPollData } from '@open-mercato/shared/modules/notifications/types'\nimport { NOTIFICATION_EVENTS } from './events'\nimport { buildNotificationEntity, emitNotificationCreated, emitNotificationCreatedBatch } from './notificationFactory'\nimport { toNotificationDto } from './notificationMapper'\nimport { getRecipientUserIdsForFeature, getRecipientUserIdsForRole } from './notificationRecipients'\n\nconst DEBUG = process.env.NOTIFICATIONS_DEBUG === 'true'\n\nfunction debug(...args: unknown[]): void {\n  if (DEBUG) {\n    console.log('[notifications]', ...args)\n  }\n}\n\nfunction getKnex(em: EntityManager): Knex {\n  return (em.getConnection() as unknown as { getKnex: () => Knex }).getKnex()\n}\n\nexport interface NotificationServiceContext {\n  tenantId: string\n  organizationId?: string | null\n  userId?: string | null\n}\n\nexport interface NotificationService {\n  create(input: CreateNotificationInput, ctx: NotificationServiceContext): Promise<Notification>\n  createBatch(input: CreateBatchNotificationInput, ctx: NotificationServiceContext): Promise<Notification[]>\n  createForRole(input: CreateRoleNotificationInput, ctx: NotificationServiceContext): Promise<Notification[]>\n  createForFeature(input: CreateFeatureNotificationInput, ctx: NotificationServiceContext): Promise<Notification[]>\n  markAsRead(notificationId: string, ctx: NotificationServiceContext): Promise<Notification>\n  markAllAsRead(ctx: NotificationServiceContext): Promise<number>\n  dismiss(notificationId: string, ctx: NotificationServiceContext): Promise<Notification>\n  restoreDismissed(\n    notificationId: string,\n    status: 'read' | 'unread' | undefined,\n    ctx: NotificationServiceContext\n  ): Promise<Notification>\n  executeAction(\n    notificationId: string,\n    input: ExecuteActionInput,\n    ctx: NotificationServiceContext\n  ): Promise<{ notification: Notification; result: unknown }>\n  getUnreadCount(ctx: NotificationServiceContext): Promise<number>\n  getPollData(ctx: NotificationServiceContext, since?: string): Promise<NotificationPollData>\n  cleanupExpired(): Promise<number>\n  deleteBySource(\n    sourceEntityType: string,\n    sourceEntityId: string,\n    ctx: NotificationServiceContext\n  ): Promise<number>\n}\n\nexport interface NotificationServiceDeps {\n  em: EntityManager\n  eventBus: { emit: (event: string, payload: unknown) => Promise<void> }\n  commandBus?: {\n    execute: (\n      commandId: string,\n      options: { input: unknown; ctx: unknown; metadata?: unknown }\n    ) => Promise<{ result: unknown }>\n  }\n  container?: { resolve: (name: string) => unknown }\n}\n\nexport function createNotificationService(deps: NotificationServiceDeps): NotificationService {\n  const { em: rootEm, eventBus, commandBus, container } = deps\n\n  return {\n    async create(input, ctx) {\n      const em = rootEm.fork()\n      const { recipientUserId, ...content } = input\n      const notification = buildNotificationEntity(em, content, recipientUserId, ctx)\n\n      await em.persistAndFlush(notification)\n\n      await emitNotificationCreated(eventBus, notification, ctx)\n\n      return notification\n    },\n\n    async createBatch(input, ctx) {\n      const em = rootEm.fork()\n      const { recipientUserIds, ...content } = input\n      const notifications: Notification[] = []\n\n      for (const recipientUserId of recipientUserIds) {\n        const notification = buildNotificationEntity(em, content, recipientUserId, ctx)\n        notifications.push(notification)\n      }\n\n      await em.persistAndFlush(notifications)\n\n      await emitNotificationCreatedBatch(eventBus, notifications, ctx)\n\n      return notifications\n    },\n\n    async createForRole(input, ctx) {\n      const em = rootEm.fork()\n\n      const knex = getKnex(em)\n      const recipientUserIds = await getRecipientUserIdsForRole(knex, ctx.tenantId, input.roleId)\n      if (recipientUserIds.length === 0) {\n        return []\n      }\n\n      const { roleId: _roleId, ...content } = input\n      const notifications: Notification[] = []\n\n      for (const recipientUserId of recipientUserIds) {\n        const notification = buildNotificationEntity(em, content, recipientUserId, ctx)\n        notifications.push(notification)\n      }\n\n      await em.persistAndFlush(notifications)\n\n      await emitNotificationCreatedBatch(eventBus, notifications, ctx)\n\n      return notifications\n    },\n\n    async createForFeature(input, ctx) {\n      const em = rootEm.fork()\n      const knex = getKnex(em)\n      const recipientUserIds = await getRecipientUserIdsForFeature(knex, ctx.tenantId, input.requiredFeature)\n\n      if (recipientUserIds.length === 0) {\n        debug('No users found with feature:', input.requiredFeature, 'in tenant:', ctx.tenantId)\n        return []\n      }\n\n      debug('Creating notifications for', recipientUserIds.length, 'user(s) with feature:', input.requiredFeature)\n\n      const { requiredFeature: _requiredFeature, ...content } = input\n      const notifications: Notification[] = []\n\n      for (const recipientUserId of recipientUserIds) {\n        const notification = buildNotificationEntity(em, content, recipientUserId, ctx)\n        notifications.push(notification)\n      }\n\n      await em.persistAndFlush(notifications)\n\n      await emitNotificationCreatedBatch(eventBus, notifications, ctx)\n\n      return notifications\n    },\n\n    async markAsRead(notificationId, ctx) {\n      const em = rootEm.fork()\n      const notification = await em.findOneOrFail(Notification, {\n        id: notificationId,\n        recipientUserId: ctx.userId,\n        tenantId: ctx.tenantId,\n      })\n\n      if (notification.status === 'unread') {\n        notification.status = 'read'\n        notification.readAt = new Date()\n        await em.flush()\n\n        await eventBus.emit(NOTIFICATION_EVENTS.READ, {\n          notificationId: notification.id,\n          userId: ctx.userId,\n          tenantId: ctx.tenantId,\n        })\n      }\n\n      return notification\n    },\n\n    async markAllAsRead(ctx) {\n      const em = rootEm.fork()\n      const knex = getKnex(em)\n\n      const result = await knex('notifications')\n        .where({\n          recipient_user_id: ctx.userId,\n          tenant_id: ctx.tenantId,\n          status: 'unread',\n        })\n        .update({\n          status: 'read',\n          read_at: knex.fn.now(),\n        })\n\n      return result\n    },\n\n    async dismiss(notificationId, ctx) {\n      const em = rootEm.fork()\n      const notification = await em.findOneOrFail(Notification, {\n        id: notificationId,\n        recipientUserId: ctx.userId,\n        tenantId: ctx.tenantId,\n      })\n\n      notification.status = 'dismissed'\n      notification.dismissedAt = new Date()\n      await em.flush()\n\n      await eventBus.emit(NOTIFICATION_EVENTS.DISMISSED, {\n        notificationId: notification.id,\n        userId: ctx.userId,\n        tenantId: ctx.tenantId,\n      })\n\n      return notification\n    },\n\n    async restoreDismissed(notificationId, status, ctx) {\n      const em = rootEm.fork()\n      const notification = await em.findOneOrFail(Notification, {\n        id: notificationId,\n        recipientUserId: ctx.userId,\n        tenantId: ctx.tenantId,\n      })\n\n      if (notification.status !== 'dismissed') {\n        return notification\n      }\n\n      const targetStatus = status ?? 'read'\n      notification.status = targetStatus\n      notification.dismissedAt = null\n\n      if (targetStatus === 'unread') {\n        notification.readAt = null\n      } else if (!notification.readAt) {\n        notification.readAt = new Date()\n      }\n\n      await em.flush()\n\n      await eventBus.emit(NOTIFICATION_EVENTS.RESTORED, {\n        notificationId: notification.id,\n        userId: ctx.userId,\n        tenantId: ctx.tenantId,\n        status: targetStatus,\n      })\n\n      return notification\n    },\n\n    async executeAction(notificationId, input, ctx) {\n      const em = rootEm.fork()\n      const notification = await em.findOneOrFail(Notification, {\n        id: notificationId,\n        recipientUserId: ctx.userId,\n        tenantId: ctx.tenantId,\n      })\n\n      const actionData = notification.actionData\n      const action = actionData?.actions?.find((a) => a.id === input.actionId)\n\n      if (!action) {\n        throw new Error('Action not found')\n      }\n\n      let result: unknown = null\n\n      if (action.commandId && commandBus && container) {\n        const commandInput = {\n          id: notification.sourceEntityId,\n          ...input.payload,\n        }\n\n        // Build a CommandRuntimeContext from the notification service context\n        const commandCtx = {\n          container,\n          auth: {\n            sub: ctx.userId,\n            tenantId: ctx.tenantId,\n            orgId: ctx.organizationId,\n          },\n          organizationScope: null,\n          selectedOrganizationId: ctx.organizationId ?? null,\n          organizationIds: ctx.organizationId ? [ctx.organizationId] : null,\n        }\n\n        const commandResult = await commandBus.execute(action.commandId, {\n          input: commandInput,\n          ctx: commandCtx,\n          metadata: {\n            tenantId: ctx.tenantId,\n            organizationId: ctx.organizationId,\n            resourceKind: 'notifications',\n          },\n        })\n\n        result = commandResult.result\n      }\n\n      notification.status = 'actioned'\n      notification.actionedAt = new Date()\n      notification.actionTaken = input.actionId\n      notification.actionResult = result as Record<string, unknown>\n\n      if (!notification.readAt) {\n        notification.readAt = new Date()\n      }\n\n      await em.flush()\n\n      await eventBus.emit(NOTIFICATION_EVENTS.ACTIONED, {\n        notificationId: notification.id,\n        actionId: input.actionId,\n        userId: ctx.userId,\n        tenantId: ctx.tenantId,\n      })\n\n      return { notification, result }\n    },\n\n    async getUnreadCount(ctx) {\n      const em = rootEm.fork()\n      return em.count(Notification, {\n        recipientUserId: ctx.userId,\n        tenantId: ctx.tenantId,\n        status: 'unread',\n      })\n    },\n\n    async getPollData(ctx, since) {\n      const em = rootEm.fork()\n      const filters: Record<string, unknown> = {\n        recipientUserId: ctx.userId,\n        tenantId: ctx.tenantId,\n      }\n\n      if (since) {\n        filters.createdAt = { $gt: new Date(since) }\n      }\n\n      const [notifications, unreadCount] = await Promise.all([\n        em.find(Notification, filters, {\n          orderBy: { createdAt: 'desc' },\n          limit: 50,\n        }),\n        em.count(Notification, {\n          recipientUserId: ctx.userId,\n          tenantId: ctx.tenantId,\n          status: 'unread',\n        }),\n      ])\n\n      const recent = notifications.map(toNotificationDto)\n      const hasNew = since ? recent.length > 0 : false\n\n      return {\n        unreadCount,\n        recent,\n        hasNew,\n        lastId: recent[0]?.id,\n      }\n    },\n\n    async cleanupExpired() {\n      const em = rootEm.fork()\n      const knex = getKnex(em)\n\n      const result = await knex('notifications')\n        .where('expires_at', '<', knex.fn.now())\n        .whereNotIn('status', ['actioned', 'dismissed'])\n        .update({\n          status: 'dismissed',\n          dismissed_at: knex.fn.now(),\n        })\n\n      return result\n    },\n\n    async deleteBySource(sourceEntityType, sourceEntityId, ctx) {\n      const em = rootEm.fork()\n      const knex = getKnex(em)\n\n      const result = await knex('notifications')\n        .where({\n          source_entity_type: sourceEntityType,\n          source_entity_id: sourceEntityId,\n          tenant_id: ctx.tenantId,\n        })\n        .delete()\n\n      return result\n    },\n  }\n}\n\n/**\n * Helper to create notification service from a DI container.\n * Use this in API routes and commands to avoid DI resolution issues.\n */\nexport function resolveNotificationService(container: {\n  resolve: (name: string) => unknown\n}): NotificationService {\n  const em = container.resolve('em') as EntityManager\n  const eventBus = container.resolve('eventBus') as { emit: (event: string, payload: unknown) => Promise<void> }\n\n  // commandBus may not be registered in all contexts, so resolve it safely\n  let commandBus: NotificationServiceDeps['commandBus']\n  try {\n    commandBus = container.resolve('commandBus') as typeof commandBus\n  } catch {\n    // commandBus not available - actions with commandId won't work\n    commandBus = undefined\n  }\n\n  return createNotificationService({ em, eventBus, commandBus, container })\n}\n"],
+  "mappings": "AAEA,SAAS,oBAAoB;AAG7B,SAAS,2BAA2B;AACpC,SAAS,yBAAyB,yBAAyB,oCAAoC;AAC/F,SAAS,yBAAyB;AAClC,SAAS,+BAA+B,kCAAkC;AAE1E,MAAM,QAAQ,QAAQ,IAAI,wBAAwB;AAElD,SAAS,SAAS,MAAuB;AACvC,MAAI,OAAO;AACT,YAAQ,IAAI,mBAAmB,GAAG,IAAI;AAAA,EACxC;AACF;AAEA,SAAS,QAAQ,IAAyB;AACxC,SAAQ,GAAG,cAAc,EAAyC,QAAQ;AAC5E;AAgDO,SAAS,0BAA0B,MAAoD;AAC5F,QAAM,EAAE,IAAI,QAAQ,UAAU,YAAY,UAAU,IAAI;AAExD,SAAO;AAAA,IACL,MAAM,OAAO,OAAO,KAAK;AACvB,YAAM,KAAK,OAAO,KAAK;AACvB,YAAM,EAAE,iBAAiB,GAAG,QAAQ,IAAI;AACxC,YAAM,eAAe,wBAAwB,IAAI,SAAS,iBAAiB,GAAG;AAE9E,YAAM,GAAG,gBAAgB,YAAY;AAErC,YAAM,wBAAwB,UAAU,cAAc,GAAG;AAEzD,aAAO;AAAA,IACT;AAAA,IAEA,MAAM,YAAY,OAAO,KAAK;AAC5B,YAAM,KAAK,OAAO,KAAK;AACvB,YAAM,EAAE,kBAAkB,GAAG,QAAQ,IAAI;AACzC,YAAM,gBAAgC,CAAC;AAEvC,iBAAW,mBAAmB,kBAAkB;AAC9C,cAAM,eAAe,wBAAwB,IAAI,SAAS,iBAAiB,GAAG;AAC9E,sBAAc,KAAK,YAAY;AAAA,MACjC;AAEA,YAAM,GAAG,gBAAgB,aAAa;AAEtC,YAAM,6BAA6B,UAAU,eAAe,GAAG;AAE/D,aAAO;AAAA,IACT;AAAA,IAEA,MAAM,cAAc,OAAO,KAAK;AAC9B,YAAM,KAAK,OAAO,KAAK;AAEvB,YAAM,OAAO,QAAQ,EAAE;AACvB,YAAM,mBAAmB,MAAM,2BAA2B,MAAM,IAAI,UAAU,MAAM,MAAM;AAC1F,UAAI,iBAAiB,WAAW,GAAG;AACjC,eAAO,CAAC;AAAA,MACV;AAEA,YAAM,EAAE,QAAQ,SAAS,GAAG,QAAQ,IAAI;AACxC,YAAM,gBAAgC,CAAC;AAEvC,iBAAW,mBAAmB,kBAAkB;AAC9C,cAAM,eAAe,wBAAwB,IAAI,SAAS,iBAAiB,GAAG;AAC9E,sBAAc,KAAK,YAAY;AAAA,MACjC;AAEA,YAAM,GAAG,gBAAgB,aAAa;AAEtC,YAAM,6BAA6B,UAAU,eAAe,GAAG;AAE/D,aAAO;AAAA,IACT;AAAA,IAEA,MAAM,iBAAiB,OAAO,KAAK;AACjC,YAAM,KAAK,OAAO,KAAK;AACvB,YAAM,OAAO,QAAQ,EAAE;AACvB,YAAM,mBAAmB,MAAM,8BAA8B,MAAM,IAAI,UAAU,MAAM,eAAe;AAEtG,UAAI,iBAAiB,WAAW,GAAG;AACjC,cAAM,gCAAgC,MAAM,iBAAiB,cAAc,IAAI,QAAQ;AACvF,eAAO,CAAC;AAAA,MACV;AAEA,YAAM,8BAA8B,iBAAiB,QAAQ,yBAAyB,MAAM,eAAe;AAE3G,YAAM,EAAE,iBAAiB,kBAAkB,GAAG,QAAQ,IAAI;AAC1D,YAAM,gBAAgC,CAAC;AAEvC,iBAAW,mBAAmB,kBAAkB;AAC9C,cAAM,eAAe,wBAAwB,IAAI,SAAS,iBAAiB,GAAG;AAC9E,sBAAc,KAAK,YAAY;AAAA,MACjC;AAEA,YAAM,GAAG,gBAAgB,aAAa;AAEtC,YAAM,6BAA6B,UAAU,eAAe,GAAG;AAE/D,aAAO;AAAA,IACT;AAAA,IAEA,MAAM,WAAW,gBAAgB,KAAK;AACpC,YAAM,KAAK,OAAO,KAAK;AACvB,YAAM,eAAe,MAAM,GAAG,cAAc,cAAc;AAAA,QACxD,IAAI;AAAA,QACJ,iBAAiB,IAAI;AAAA,QACrB,UAAU,IAAI;AAAA,MAChB,CAAC;AAED,UAAI,aAAa,WAAW,UAAU;AACpC,qBAAa,SAAS;AACtB,qBAAa,SAAS,oBAAI,KAAK;AAC/B,cAAM,GAAG,MAAM;AAEf,cAAM,SAAS,KAAK,oBAAoB,MAAM;AAAA,UAC5C,gBAAgB,aAAa;AAAA,UAC7B,QAAQ,IAAI;AAAA,UACZ,UAAU,IAAI;AAAA,QAChB,CAAC;AAAA,MACH;AAEA,aAAO;AAAA,IACT;AAAA,IAEA,MAAM,cAAc,KAAK;AACvB,YAAM,KAAK,OAAO,KAAK;AACvB,YAAM,OAAO,QAAQ,EAAE;AAEvB,YAAM,SAAS,MAAM,KAAK,eAAe,EACtC,MAAM;AAAA,QACL,mBAAmB,IAAI;AAAA,QACvB,WAAW,IAAI;AAAA,QACf,QAAQ;AAAA,MACV,CAAC,EACA,OAAO;AAAA,QACN,QAAQ;AAAA,QACR,SAAS,KAAK,GAAG,IAAI;AAAA,MACvB,CAAC;AAEH,aAAO;AAAA,IACT;AAAA,IAEA,MAAM,QAAQ,gBAAgB,KAAK;AACjC,YAAM,KAAK,OAAO,KAAK;AACvB,YAAM,eAAe,MAAM,GAAG,cAAc,cAAc;AAAA,QACxD,IAAI;AAAA,QACJ,iBAAiB,IAAI;AAAA,QACrB,UAAU,IAAI;AAAA,MAChB,CAAC;AAED,mBAAa,SAAS;AACtB,mBAAa,cAAc,oBAAI,KAAK;AACpC,YAAM,GAAG,MAAM;AAEf,YAAM,SAAS,KAAK,oBAAoB,WAAW;AAAA,QACjD,gBAAgB,aAAa;AAAA,QAC7B,QAAQ,IAAI;AAAA,QACZ,UAAU,IAAI;AAAA,MAChB,CAAC;AAED,aAAO;AAAA,IACT;AAAA,IAEA,MAAM,iBAAiB,gBAAgB,QAAQ,KAAK;AAClD,YAAM,KAAK,OAAO,KAAK;AACvB,YAAM,eAAe,MAAM,GAAG,cAAc,cAAc;AAAA,QACxD,IAAI;AAAA,QACJ,iBAAiB,IAAI;AAAA,QACrB,UAAU,IAAI;AAAA,MAChB,CAAC;AAED,UAAI,aAAa,WAAW,aAAa;AACvC,eAAO;AAAA,MACT;AAEA,YAAM,eAAe,UAAU;AAC/B,mBAAa,SAAS;AACtB,mBAAa,cAAc;AAE3B,UAAI,iBAAiB,UAAU;AAC7B,qBAAa,SAAS;AAAA,MACxB,WAAW,CAAC,aAAa,QAAQ;AAC/B,qBAAa,SAAS,oBAAI,KAAK;AAAA,MACjC;AAEA,YAAM,GAAG,MAAM;AAEf,YAAM,SAAS,KAAK,oBAAoB,UAAU;AAAA,QAChD,gBAAgB,aAAa;AAAA,QAC7B,QAAQ,IAAI;AAAA,QACZ,UAAU,IAAI;AAAA,QACd,QAAQ;AAAA,MACV,CAAC;AAED,aAAO;AAAA,IACT;AAAA,IAEA,MAAM,cAAc,gBAAgB,OAAO,KAAK;AAC9C,YAAM,KAAK,OAAO,KAAK;AACvB,YAAM,eAAe,MAAM,GAAG,cAAc,cAAc;AAAA,QACxD,IAAI;AAAA,QACJ,iBAAiB,IAAI;AAAA,QACrB,UAAU,IAAI;AAAA,MAChB,CAAC;AAED,YAAM,aAAa,aAAa;AAChC,YAAM,SAAS,YAAY,SAAS,KAAK,CAAC,MAAM,EAAE,OAAO,MAAM,QAAQ;AAEvE,UAAI,CAAC,QAAQ;AACX,cAAM,IAAI,MAAM,kBAAkB;AAAA,MACpC;AAEA,UAAI,SAAkB;AAEtB,UAAI,OAAO,aAAa,cAAc,WAAW;AAC/C,cAAM,eAAe;AAAA,UACnB,IAAI,aAAa;AAAA,UACjB,GAAG,MAAM;AAAA,QACX;AAGA,cAAM,aAAa;AAAA,UACjB;AAAA,UACA,MAAM;AAAA,YACJ,KAAK,IAAI;AAAA,YACT,UAAU,IAAI;AAAA,YACd,OAAO,IAAI;AAAA,UACb;AAAA,UACA,mBAAmB;AAAA,UACnB,wBAAwB,IAAI,kBAAkB;AAAA,UAC9C,iBAAiB,IAAI,iBAAiB,CAAC,IAAI,cAAc,IAAI;AAAA,QAC/D;AAEA,cAAM,gBAAgB,MAAM,WAAW,QAAQ,OAAO,WAAW;AAAA,UAC/D,OAAO;AAAA,UACP,KAAK;AAAA,UACL,UAAU;AAAA,YACR,UAAU,IAAI;AAAA,YACd,gBAAgB,IAAI;AAAA,YACpB,cAAc;AAAA,UAChB;AAAA,QACF,CAAC;AAED,iBAAS,cAAc;AAAA,MACzB;AAEA,mBAAa,SAAS;AACtB,mBAAa,aAAa,oBAAI,KAAK;AACnC,mBAAa,cAAc,MAAM;AACjC,mBAAa,eAAe;AAE5B,UAAI,CAAC,aAAa,QAAQ;AACxB,qBAAa,SAAS,oBAAI,KAAK;AAAA,MACjC;AAEA,YAAM,GAAG,MAAM;AAEf,YAAM,SAAS,KAAK,oBAAoB,UAAU;AAAA,QAChD,gBAAgB,aAAa;AAAA,QAC7B,UAAU,MAAM;AAAA,QAChB,QAAQ,IAAI;AAAA,QACZ,UAAU,IAAI;AAAA,MAChB,CAAC;AAED,aAAO,EAAE,cAAc,OAAO;AAAA,IAChC;AAAA,IAEA,MAAM,eAAe,KAAK;AACxB,YAAM,KAAK,OAAO,KAAK;AACvB,aAAO,GAAG,MAAM,cAAc;AAAA,QAC5B,iBAAiB,IAAI;AAAA,QACrB,UAAU,IAAI;AAAA,QACd,QAAQ;AAAA,MACV,CAAC;AAAA,IACH;AAAA,IAEA,MAAM,YAAY,KAAK,OAAO;AAC5B,YAAM,KAAK,OAAO,KAAK;AACvB,YAAM,UAAmC;AAAA,QACvC,iBAAiB,IAAI;AAAA,QACrB,UAAU,IAAI;AAAA,MAChB;AAEA,UAAI,OAAO;AACT,gBAAQ,YAAY,EAAE,KAAK,IAAI,KAAK,KAAK,EAAE;AAAA,MAC7C;AAEA,YAAM,CAAC,eAAe,WAAW,IAAI,MAAM,QAAQ,IAAI;AAAA,QACrD,GAAG,KAAK,cAAc,SAAS;AAAA,UAC7B,SAAS,EAAE,WAAW,OAAO;AAAA,UAC7B,OAAO;AAAA,QACT,CAAC;AAAA,QACD,GAAG,MAAM,cAAc;AAAA,UACrB,iBAAiB,IAAI;AAAA,UACrB,UAAU,IAAI;AAAA,UACd,QAAQ;AAAA,QACV,CAAC;AAAA,MACH,CAAC;AAED,YAAM,SAAS,cAAc,IAAI,iBAAiB;AAClD,YAAM,SAAS,QAAQ,OAAO,SAAS,IAAI;AAE3C,aAAO;AAAA,QACL;AAAA,QACA;AAAA,QACA;AAAA,QACA,QAAQ,OAAO,CAAC,GAAG;AAAA,MACrB;AAAA,IACF;AAAA,IAEA,MAAM,iBAAiB;AACrB,YAAM,KAAK,OAAO,KAAK;AACvB,YAAM,OAAO,QAAQ,EAAE;AAEvB,YAAM,SAAS,MAAM,KAAK,eAAe,EACtC,MAAM,cAAc,KAAK,KAAK,GAAG,IAAI,CAAC,EACtC,WAAW,UAAU,CAAC,YAAY,WAAW,CAAC,EAC9C,OAAO;AAAA,QACN,QAAQ;AAAA,QACR,cAAc,KAAK,GAAG,IAAI;AAAA,MAC5B,CAAC;AAEH,aAAO;AAAA,IACT;AAAA,IAEA,MAAM,eAAe,kBAAkB,gBAAgB,KAAK;AAC1D,YAAM,KAAK,OAAO,KAAK;AACvB,YAAM,OAAO,QAAQ,EAAE;AAEvB,YAAM,SAAS,MAAM,KAAK,eAAe,EACtC,MAAM;AAAA,QACL,oBAAoB;AAAA,QACpB,kBAAkB;AAAA,QAClB,WAAW,IAAI;AAAA,MACjB,CAAC,EACA,OAAO;AAEV,aAAO;AAAA,IACT;AAAA,EACF;AACF;AAMO,SAAS,2BAA2B,WAEnB;AACtB,QAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,QAAM,WAAW,UAAU,QAAQ,UAAU;AAG7C,MAAI;AACJ,MAAI;AACF,iBAAa,UAAU,QAAQ,YAAY;AAAA,EAC7C,QAAQ;AAEN,iBAAa;AAAA,EACf;AAEA,SAAO,0BAA0B,EAAE,IAAI,UAAU,YAAY,UAAU,CAAC;AAC1E;",
+  "names": []
+}

package/dist/modules/notifications/lib/routeHelpers.js

@@ -0,0 +1,101 @@
+import { z } from "zod";
+import { resolveRequestContext } from "@open-mercato/shared/lib/api/context";
+import { resolveNotificationService } from "./notificationService.js";
+async function resolveNotificationContext(req) {
+  const { ctx } = await resolveRequestContext(req);
+  return {
+    service: resolveNotificationService(ctx.container),
+    scope: {
+      tenantId: ctx.auth?.tenantId ?? "",
+      organizationId: ctx.selectedOrganizationId ?? null,
+      userId: ctx.auth?.sub ?? null
+    },
+    ctx
+  };
+}
+function createBulkNotificationRoute(schema, serviceMethod) {
+  return async function POST(req) {
+    const { service, scope } = await resolveNotificationContext(req);
+    const body = await req.json().catch(() => ({}));
+    const input = schema.parse(body);
+    const notifications = await service[serviceMethod](input, scope);
+    return Response.json({
+      ok: true,
+      count: notifications.length,
+      ids: notifications.map((n) => n.id)
+    }, { status: 201 });
+  };
+}
+function createBulkNotificationOpenApi(schema, summary, description) {
+  return {
+    POST: {
+      summary,
+      description,
+      tags: ["Notifications"],
+      requestBody: {
+        required: true,
+        content: {
+          "application/json": {
+            schema
+          }
+        }
+      },
+      responses: {
+        201: {
+          description: "Notifications created",
+          content: {
+            "application/json": {
+              schema: z.object({
+                ok: z.boolean(),
+                count: z.number(),
+                ids: z.array(z.string().uuid())
+              })
+            }
+          }
+        }
+      }
+    }
+  };
+}
+function createSingleNotificationActionRoute(serviceMethod) {
+  return async function PUT(req, { params }) {
+    const { id } = await params;
+    const { service, scope } = await resolveNotificationContext(req);
+    await service[serviceMethod](id, scope);
+    return Response.json({ ok: true });
+  };
+}
+function createSingleNotificationActionOpenApi(summary, description) {
+  return {
+    PUT: {
+      summary,
+      tags: ["Notifications"],
+      parameters: [
+        {
+          name: "id",
+          in: "path",
+          required: true,
+          schema: { type: "string", format: "uuid" }
+        }
+      ],
+      responses: {
+        200: {
+          description,
+          content: {
+            "application/json": {
+              schema: z.object({ ok: z.boolean() })
+            }
+          }
+        }
+      }
+    }
+  };
+}
+export {
+  createBulkNotificationOpenApi,
+  createBulkNotificationRoute,
+  createSingleNotificationActionOpenApi,
+  createSingleNotificationActionRoute,
+  resolveNotificationContext
+};
+//# sourceMappingURL=routeHelpers.js.map

package/dist/modules/notifications/lib/routeHelpers.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/notifications/lib/routeHelpers.ts"],
+  "sourcesContent": ["import { z } from 'zod'\nimport { resolveRequestContext } from '@open-mercato/shared/lib/api/context'\nimport { resolveNotificationService, type NotificationService } from './notificationService'\n\n/**\n * Notification scope context for service calls\n */\nexport interface NotificationScope {\n  tenantId: string\n  organizationId: string | null\n  userId: string | null\n}\n\n/**\n * Resolved notification context from a request\n */\nexport interface NotificationRequestContext {\n  service: NotificationService\n  scope: NotificationScope\n  ctx: Awaited<ReturnType<typeof resolveRequestContext>>['ctx']\n}\n\n/**\n * Resolve notification service and scope from a request.\n * Centralizes the common pattern used across all notification API routes.\n */\nexport async function resolveNotificationContext(req: Request): Promise<NotificationRequestContext> {\n  const { ctx } = await resolveRequestContext(req)\n  return {\n    service: resolveNotificationService(ctx.container),\n    scope: {\n      tenantId: ctx.auth?.tenantId ?? '',\n      organizationId: ctx.selectedOrganizationId ?? null,\n      userId: ctx.auth?.sub ?? null,\n    },\n    ctx,\n  }\n}\n\n/**\n * Create a POST handler for bulk notification creation routes.\n * Used by batch, role, and feature notification endpoints.\n */\nexport function createBulkNotificationRoute<TSchema extends z.ZodTypeAny>(\n  schema: TSchema,\n  serviceMethod: 'createBatch' | 'createForRole' | 'createForFeature'\n) {\n  return async function POST(req: Request) {\n    const { service, scope } = await resolveNotificationContext(req)\n\n    const body = await req.json().catch(() => ({}))\n    const input = schema.parse(body)\n\n    const notifications = await service[serviceMethod](input as never, scope)\n\n    return Response.json({\n      ok: true,\n      count: notifications.length,\n      ids: notifications.map((n) => n.id),\n    }, { status: 201 })\n  }\n}\n\n/**\n * Create OpenAPI spec for bulk notification creation routes.\n */\nexport function createBulkNotificationOpenApi<TSchema extends z.ZodTypeAny>(\n  schema: TSchema,\n  summary: string,\n  description?: string\n) {\n  return {\n    POST: {\n      summary,\n      description,\n      tags: ['Notifications'],\n      requestBody: {\n        required: true,\n        content: {\n          'application/json': {\n            schema,\n          },\n        },\n      },\n      responses: {\n        201: {\n          description: 'Notifications created',\n          content: {\n            'application/json': {\n              schema: z.object({\n                ok: z.boolean(),\n                count: z.number(),\n                ids: z.array(z.string().uuid()),\n              }),\n            },\n          },\n        },\n      },\n    },\n  }\n}\n\n/**\n * Create a PUT handler for single notification action routes.\n * Used by read and dismiss endpoints.\n */\nexport function createSingleNotificationActionRoute(\n  serviceMethod: 'markAsRead' | 'dismiss'\n) {\n  return async function PUT(req: Request, { params }: { params: Promise<{ id: string }> }) {\n    const { id } = await params\n    const { service, scope } = await resolveNotificationContext(req)\n\n    await service[serviceMethod](id, scope)\n\n    return Response.json({ ok: true })\n  }\n}\n\n/**\n * Create OpenAPI spec for single notification action routes.\n */\nexport function createSingleNotificationActionOpenApi(\n  summary: string,\n  description: string\n) {\n  return {\n    PUT: {\n      summary,\n      tags: ['Notifications'],\n      parameters: [\n        {\n          name: 'id',\n          in: 'path',\n          required: true,\n          schema: { type: 'string', format: 'uuid' },\n        },\n      ],\n      responses: {\n        200: {\n          description,\n          content: {\n            'application/json': {\n              schema: z.object({ ok: z.boolean() }),\n            },\n          },\n        },\n      },\n    },\n  }\n}\n"],
+  "mappings": "AAAA,SAAS,SAAS;AAClB,SAAS,6BAA6B;AACtC,SAAS,kCAA4D;AAwBrE,eAAsB,2BAA2B,KAAmD;AAClG,QAAM,EAAE,IAAI,IAAI,MAAM,sBAAsB,GAAG;AAC/C,SAAO;AAAA,IACL,SAAS,2BAA2B,IAAI,SAAS;AAAA,IACjD,OAAO;AAAA,MACL,UAAU,IAAI,MAAM,YAAY;AAAA,MAChC,gBAAgB,IAAI,0BAA0B;AAAA,MAC9C,QAAQ,IAAI,MAAM,OAAO;AAAA,IAC3B;AAAA,IACA;AAAA,EACF;AACF;AAMO,SAAS,4BACd,QACA,eACA;AACA,SAAO,eAAe,KAAK,KAAc;AACvC,UAAM,EAAE,SAAS,MAAM,IAAI,MAAM,2BAA2B,GAAG;AAE/D,UAAM,OAAO,MAAM,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAC9C,UAAM,QAAQ,OAAO,MAAM,IAAI;AAE/B,UAAM,gBAAgB,MAAM,QAAQ,aAAa,EAAE,OAAgB,KAAK;AAExE,WAAO,SAAS,KAAK;AAAA,MACnB,IAAI;AAAA,MACJ,OAAO,cAAc;AAAA,MACrB,KAAK,cAAc,IAAI,CAAC,MAAM,EAAE,EAAE;AAAA,IACpC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACpB;AACF;AAKO,SAAS,8BACd,QACA,SACA,aACA;AACA,SAAO;AAAA,IACL,MAAM;AAAA,MACJ;AAAA,MACA;AAAA,MACA,MAAM,CAAC,eAAe;AAAA,MACtB,aAAa;AAAA,QACX,UAAU;AAAA,QACV,SAAS;AAAA,UACP,oBAAoB;AAAA,YAClB;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,MACA,WAAW;AAAA,QACT,KAAK;AAAA,UACH,aAAa;AAAA,UACb,SAAS;AAAA,YACP,oBAAoB;AAAA,cAClB,QAAQ,EAAE,OAAO;AAAA,gBACf,IAAI,EAAE,QAAQ;AAAA,gBACd,OAAO,EAAE,OAAO;AAAA,gBAChB,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC;AAAA,cAChC,CAAC;AAAA,YACH;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;AAMO,SAAS,oCACd,eACA;AACA,SAAO,eAAe,IAAI,KAAc,EAAE,OAAO,GAAwC;AACvF,UAAM,EAAE,GAAG,IAAI,MAAM;AACrB,UAAM,EAAE,SAAS,MAAM,IAAI,MAAM,2BAA2B,GAAG;AAE/D,UAAM,QAAQ,aAAa,EAAE,IAAI,KAAK;AAEtC,WAAO,SAAS,KAAK,EAAE,IAAI,KAAK,CAAC;AAAA,EACnC;AACF;AAKO,SAAS,sCACd,SACA,aACA;AACA,SAAO;AAAA,IACL,KAAK;AAAA,MACH;AAAA,MACA,MAAM,CAAC,eAAe;AAAA,MACtB,YAAY;AAAA,QACV;AAAA,UACE,MAAM;AAAA,UACN,IAAI;AAAA,UACJ,UAAU;AAAA,UACV,QAAQ,EAAE,MAAM,UAAU,QAAQ,OAAO;AAAA,QAC3C;AAAA,MACF;AAAA,MACA,WAAW;AAAA,QACT,KAAK;AAAA,UACH;AAAA,UACA,SAAS;AAAA,YACP,oBAAoB;AAAA,cAClB,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;AAAA,YACtC;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;",
+  "names": []
+}

package/dist/modules/notifications/lib/safeHref.js

@@ -0,0 +1,24 @@
+function isSafeNotificationHref(href) {
+  return href.startsWith("/") && !href.startsWith("//");
+}
+function assertSafeNotificationHref(href) {
+  if (href == null) {
+    return void 0;
+  }
+  if (!isSafeNotificationHref(href)) {
+    throw new Error("Notification href must be a same-origin relative path starting with /");
+  }
+  return href;
+}
+function sanitizeNotificationActions(actions) {
+  if (!actions) {
+    return void 0;
+  }
+  return actions.map((action) => action.href ? { ...action, href: assertSafeNotificationHref(action.href) } : action);
+}
+export {
+  assertSafeNotificationHref,
+  isSafeNotificationHref,
+  sanitizeNotificationActions
+};
+//# sourceMappingURL=safeHref.js.map

package/dist/modules/notifications/lib/safeHref.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/notifications/lib/safeHref.ts"],
+  "sourcesContent": ["import type { NotificationAction } from '@open-mercato/shared/modules/notifications/types'\n\nexport function isSafeNotificationHref(href: string): boolean {\n  return href.startsWith('/') && !href.startsWith('//')\n}\n\nexport function assertSafeNotificationHref(href: string | undefined | null): string | undefined {\n  if (href == null) {\n    return undefined\n  }\n\n  if (!isSafeNotificationHref(href)) {\n    throw new Error('Notification href must be a same-origin relative path starting with /')\n  }\n\n  return href\n}\n\nexport function sanitizeNotificationActions(\n  actions: NotificationAction[] | undefined\n): NotificationAction[] | undefined {\n  if (!actions) {\n    return undefined\n  }\n\n  return actions.map((action) => (\n    action.href ? { ...action, href: assertSafeNotificationHref(action.href) } : action\n  ))\n}\n"],
+  "mappings": "AAEO,SAAS,uBAAuB,MAAuB;AAC5D,SAAO,KAAK,WAAW,GAAG,KAAK,CAAC,KAAK,WAAW,IAAI;AACtD;AAEO,SAAS,2BAA2B,MAAqD;AAC9F,MAAI,QAAQ,MAAM;AAChB,WAAO;AAAA,EACT;AAEA,MAAI,CAAC,uBAAuB,IAAI,GAAG;AACjC,UAAM,IAAI,MAAM,uEAAuE;AAAA,EACzF;AAEA,SAAO;AACT;AAEO,SAAS,4BACd,SACkC;AAClC,MAAI,CAAC,SAAS;AACZ,WAAO;AAAA,EACT;AAEA,SAAO,QAAQ,IAAI,CAAC,WAClB,OAAO,OAAO,EAAE,GAAG,QAAQ,MAAM,2BAA2B,OAAO,IAAI,EAAE,IAAI,MAC9E;AACH;",
+  "names": []
+}

package/dist/modules/notifications/migrations/Migration20260123000001.js

@@ -0,0 +1,70 @@
+import { Migration } from "@mikro-orm/migrations";
+class Migration20260123000001 extends Migration {
+  async up() {
+    this.addSql(`
+      CREATE TABLE notifications (
+        id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+        
+        recipient_user_id UUID NOT NULL,
+        
+        type TEXT NOT NULL,
+        title TEXT NOT NULL,
+        body TEXT,
+        icon TEXT,
+        severity TEXT NOT NULL DEFAULT 'info',
+        
+        status TEXT NOT NULL DEFAULT 'unread',
+        
+        action_data JSONB,
+        action_result JSONB,
+        action_taken TEXT,
+        
+        source_module TEXT,
+        source_entity_type TEXT,
+        source_entity_id UUID,
+        link_href TEXT,
+        
+        group_key TEXT,
+        
+        created_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+        read_at TIMESTAMPTZ,
+        actioned_at TIMESTAMPTZ,
+        dismissed_at TIMESTAMPTZ,
+        expires_at TIMESTAMPTZ,
+        
+        tenant_id UUID NOT NULL,
+        organization_id UUID
+      );
+    `);
+    this.addSql(`
+      CREATE INDEX notifications_recipient_status_idx 
+        ON notifications(recipient_user_id, status, created_at DESC);
+    `);
+    this.addSql(`
+      CREATE INDEX notifications_source_idx 
+        ON notifications(source_entity_type, source_entity_id) 
+        WHERE source_entity_id IS NOT NULL;
+    `);
+    this.addSql(`
+      CREATE INDEX notifications_tenant_idx 
+        ON notifications(tenant_id, organization_id);
+    `);
+    this.addSql(`
+      CREATE INDEX notifications_expires_idx 
+        ON notifications(expires_at) 
+        WHERE expires_at IS NOT NULL AND status NOT IN ('actioned', 'dismissed');
+    `);
+    this.addSql(`
+      CREATE INDEX notifications_group_idx 
+        ON notifications(group_key, recipient_user_id) 
+        WHERE group_key IS NOT NULL;
+    `);
+  }
+  async down() {
+    this.addSql("DROP TABLE IF EXISTS notifications CASCADE;");
+  }
+}
+export {
+  Migration20260123000001
+};
+//# sourceMappingURL=Migration20260123000001.js.map

package/dist/modules/notifications/migrations/Migration20260123000001.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/notifications/migrations/Migration20260123000001.ts"],
+  "sourcesContent": ["import { Migration } from '@mikro-orm/migrations'\n\nexport class Migration20260123000001 extends Migration {\n  async up(): Promise<void> {\n    this.addSql(`\n      CREATE TABLE notifications (\n        id UUID PRIMARY KEY DEFAULT gen_random_uuid(),\n        \n        recipient_user_id UUID NOT NULL,\n        \n        type TEXT NOT NULL,\n        title TEXT NOT NULL,\n        body TEXT,\n        icon TEXT,\n        severity TEXT NOT NULL DEFAULT 'info',\n        \n        status TEXT NOT NULL DEFAULT 'unread',\n        \n        action_data JSONB,\n        action_result JSONB,\n        action_taken TEXT,\n        \n        source_module TEXT,\n        source_entity_type TEXT,\n        source_entity_id UUID,\n        link_href TEXT,\n        \n        group_key TEXT,\n        \n        created_at TIMESTAMPTZ NOT NULL DEFAULT now(),\n        read_at TIMESTAMPTZ,\n        actioned_at TIMESTAMPTZ,\n        dismissed_at TIMESTAMPTZ,\n        expires_at TIMESTAMPTZ,\n        \n        tenant_id UUID NOT NULL,\n        organization_id UUID\n      );\n    `)\n\n    this.addSql(`\n      CREATE INDEX notifications_recipient_status_idx \n        ON notifications(recipient_user_id, status, created_at DESC);\n    `)\n\n    this.addSql(`\n      CREATE INDEX notifications_source_idx \n        ON notifications(source_entity_type, source_entity_id) \n        WHERE source_entity_id IS NOT NULL;\n    `)\n\n    this.addSql(`\n      CREATE INDEX notifications_tenant_idx \n        ON notifications(tenant_id, organization_id);\n    `)\n\n    this.addSql(`\n      CREATE INDEX notifications_expires_idx \n        ON notifications(expires_at) \n        WHERE expires_at IS NOT NULL AND status NOT IN ('actioned', 'dismissed');\n    `)\n\n    this.addSql(`\n      CREATE INDEX notifications_group_idx \n        ON notifications(group_key, recipient_user_id) \n        WHERE group_key IS NOT NULL;\n    `)\n  }\n\n  async down(): Promise<void> {\n    this.addSql('DROP TABLE IF EXISTS notifications CASCADE;')\n  }\n}\n"],
+  "mappings": "AAAA,SAAS,iBAAiB;AAEnB,MAAM,gCAAgC,UAAU;AAAA,EACrD,MAAM,KAAoB;AACxB,SAAK,OAAO;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,KAkCX;AAED,SAAK,OAAO;AAAA;AAAA;AAAA,KAGX;AAED,SAAK,OAAO;AAAA;AAAA;AAAA;AAAA,KAIX;AAED,SAAK,OAAO;AAAA;AAAA;AAAA,KAGX;AAED,SAAK,OAAO;AAAA;AAAA;AAAA;AAAA,KAIX;AAED,SAAK,OAAO;AAAA;AAAA;AAAA;AAAA,KAIX;AAAA,EACH;AAAA,EAEA,MAAM,OAAsB;AAC1B,SAAK,OAAO,6CAA6C;AAAA,EAC3D;AACF;",
+  "names": []
+}

package/dist/modules/notifications/migrations/Migration20260126150000.js

@@ -0,0 +1,37 @@
+import { Migration } from "@mikro-orm/migrations";
+class Migration20260126150000 extends Migration {
+  async up() {
+    this.addSql(`
+      alter table "notifications"
+      add column if not exists "title_key" text,
+      add column if not exists "body_key" text,
+      add column if not exists "title_variables" jsonb,
+      add column if not exists "body_variables" jsonb;
+    `);
+    this.addSql(`
+      comment on column "notifications"."title_key" is 'i18n key for notification title';
+    `);
+    this.addSql(`
+      comment on column "notifications"."body_key" is 'i18n key for notification body';
+    `);
+    this.addSql(`
+      comment on column "notifications"."title_variables" is 'Variables for i18n interpolation in title';
+    `);
+    this.addSql(`
+      comment on column "notifications"."body_variables" is 'Variables for i18n interpolation in body';
+    `);
+  }
+  async down() {
+    this.addSql(`
+      alter table "notifications"
+      drop column if exists "title_key",
+      drop column if exists "body_key",
+      drop column if exists "title_variables",
+      drop column if exists "body_variables";
+    `);
+  }
+}
+export {
+  Migration20260126150000
+};
+//# sourceMappingURL=Migration20260126150000.js.map