@open-mercato/core 0.6.7 → 0.6.8-develop.6875.1.871a4afc94

package/dist/modules/messages/search.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../src/modules/messages/search.ts"],
-  "sourcesContent": ["import type {\n  SearchModuleConfig,\n  SearchBuildContext,\n  SearchIndexSource,\n  SearchResultPresenter,\n} from '@open-mercato/shared/modules/search'\n\nfunction appendLine(lines: string[], label: string, value: unknown) {\n  if (value === null || value === undefined) return\n  const text = Array.isArray(value)\n    ? value.map((item) => (item === null || item === undefined ? '' : String(item))).filter(Boolean).join(', ')\n    : (typeof value === 'object' ? JSON.stringify(value) : String(value))\n  if (!text.trim()) return\n  lines.push(`${label}: ${text}`)\n}\n\nfunction pickString(...candidates: Array<unknown>): string | null {\n  for (const candidate of candidates) {\n    if (typeof candidate !== 'string') continue\n    const trimmed = candidate.trim()\n    if (trimmed.length > 0) return trimmed\n  }\n  return null\n}\n\nfunction snippet(value: unknown, max = 140): string | undefined {\n  if (typeof value !== 'string') return undefined\n  const trimmed = value.trim()\n  if (!trimmed.length) return undefined\n  if (trimmed.length <= max) return trimmed\n  return `${trimmed.slice(0, max - 3)}...`\n}\n\nfunction buildMessagePresenter(record: Record<string, unknown>): SearchResultPresenter {\n  const title = pickString(record.subject) ?? 'Message'\n  const body = snippet(record.body)\n  const externalName = pickString(record.external_name, record.externalName)\n  const subtitle = [externalName, body].filter(Boolean).join(' \u00B7 ') || undefined\n  return {\n    title: String(title),\n    subtitle,\n    icon: 'mail',\n    badge: 'Message',\n  }\n}\n\nexport const searchConfig: SearchModuleConfig = {\n  entities: [\n    {\n      entityId: 'messages:message',\n      enabled: true,\n      priority: 5,\n      buildSource: async (ctx: SearchBuildContext): Promise<SearchIndexSource | null> => {\n        const record = ctx.record\n        const lines: string[] = []\n        appendLine(lines, 'Subject', record.subject)\n        appendLine(lines, 'Body', record.body)\n        appendLine(lines, 'From name', record.external_name ?? record.externalName)\n        if (!lines.length) return null\n        return {\n          text: lines,\n          presenter: buildMessagePresenter(record),\n          checksumSource: {\n            record: {\n              subject: record.subject,\n              body: record.body,\n              external_name: record.external_name ?? record.externalName,\n              external_email_hash: record.external_email_hash ?? record.externalEmailHash,\n            },\n          },\n        }\n      },\n      formatResult: async (ctx) => buildMessagePresenter(ctx.record),\n      resolveUrl: async (ctx) => {\n        const id = pickString(ctx.record.id)\n        return id ? `/backend/messages/${encodeURIComponent(id)}` : null\n      },\n      fieldPolicy: {\n        searchable: ['subject', 'body', 'external_name'],\n        hashOnly: ['external_email'],\n        excluded: ['action_data', 'action_result'],\n      },\n    },\n  ],\n}\n\nexport default searchConfig\nexport const config = searchConfig\n"],
-  "mappings": "AAOA,SAAS,WAAW,OAAiB,OAAe,OAAgB;AAClE,MAAI,UAAU,QAAQ,UAAU,OAAW;AAC3C,QAAM,OAAO,MAAM,QAAQ,KAAK,IAC5B,MAAM,IAAI,CAAC,SAAU,SAAS,QAAQ,SAAS,SAAY,KAAK,OAAO,IAAI,CAAE,EAAE,OAAO,OAAO,EAAE,KAAK,IAAI,IACvG,OAAO,UAAU,WAAW,KAAK,UAAU,KAAK,IAAI,OAAO,KAAK;AACrE,MAAI,CAAC,KAAK,KAAK,EAAG;AAClB,QAAM,KAAK,GAAG,KAAK,KAAK,IAAI,EAAE;AAChC;AAEA,SAAS,cAAc,YAA2C;AAChE,aAAW,aAAa,YAAY;AAClC,QAAI,OAAO,cAAc,SAAU;AACnC,UAAM,UAAU,UAAU,KAAK;AAC/B,QAAI,QAAQ,SAAS,EAAG,QAAO;AAAA,EACjC;AACA,SAAO;AACT;AAEA,SAAS,QAAQ,OAAgB,MAAM,KAAyB;AAC9D,MAAI,OAAO,UAAU,SAAU,QAAO;AACtC,QAAM,UAAU,MAAM,KAAK;AAC3B,MAAI,CAAC,QAAQ,OAAQ,QAAO;AAC5B,MAAI,QAAQ,UAAU,IAAK,QAAO;AAClC,SAAO,GAAG,QAAQ,MAAM,GAAG,MAAM,CAAC,CAAC;AACrC;AAEA,SAAS,sBAAsB,QAAwD;AACrF,QAAM,QAAQ,WAAW,OAAO,OAAO,KAAK;AAC5C,QAAM,OAAO,QAAQ,OAAO,IAAI;AAChC,QAAM,eAAe,WAAW,OAAO,eAAe,OAAO,YAAY;AACzE,QAAM,WAAW,CAAC,cAAc,IAAI,EAAE,OAAO,OAAO,EAAE,KAAK,QAAK,KAAK;AACrE,SAAO;AAAA,IACL,OAAO,OAAO,KAAK;AAAA,IACnB;AAAA,IACA,MAAM;AAAA,IACN,OAAO;AAAA,EACT;AACF;AAEO,MAAM,eAAmC;AAAA,EAC9C,UAAU;AAAA,IACR;AAAA,MACE,UAAU;AAAA,MACV,SAAS;AAAA,MACT,UAAU;AAAA,MACV,aAAa,OAAO,QAA+D;AACjF,cAAM,SAAS,IAAI;AACnB,cAAM,QAAkB,CAAC;AACzB,mBAAW,OAAO,WAAW,OAAO,OAAO;AAC3C,mBAAW,OAAO,QAAQ,OAAO,IAAI;AACrC,mBAAW,OAAO,aAAa,OAAO,iBAAiB,OAAO,YAAY;AAC1E,YAAI,CAAC,MAAM,OAAQ,QAAO;AAC1B,eAAO;AAAA,UACL,MAAM;AAAA,UACN,WAAW,sBAAsB,MAAM;AAAA,UACvC,gBAAgB;AAAA,YACd,QAAQ;AAAA,cACN,SAAS,OAAO;AAAA,cAChB,MAAM,OAAO;AAAA,cACb,eAAe,OAAO,iBAAiB,OAAO;AAAA,cAC9C,qBAAqB,OAAO,uBAAuB,OAAO;AAAA,YAC5D;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,MACA,cAAc,OAAO,QAAQ,sBAAsB,IAAI,MAAM;AAAA,MAC7D,YAAY,OAAO,QAAQ;AACzB,cAAM,KAAK,WAAW,IAAI,OAAO,EAAE;AACnC,eAAO,KAAK,qBAAqB,mBAAmB,EAAE,CAAC,KAAK;AAAA,MAC9D;AAAA,MACA,aAAa;AAAA,QACX,YAAY,CAAC,WAAW,QAAQ,eAAe;AAAA,QAC/C,UAAU,CAAC,gBAAgB;AAAA,QAC3B,UAAU,CAAC,eAAe,eAAe;AAAA,MAC3C;AAAA,IACF;AAAA,EACF;AACF;AAEA,IAAO,iBAAQ;AACR,MAAM,SAAS;",
+  "sourcesContent": ["import type {\n  SearchModuleConfig,\n  SearchBuildContext,\n  SearchIndexSource,\n  SearchResultPresenter,\n} from '@open-mercato/shared/modules/search'\nimport type { TranslateFn } from '@open-mercato/shared/lib/i18n/context'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\n\nfunction appendLine(lines: string[], label: string, value: unknown) {\n  if (value === null || value === undefined) return\n  const text = Array.isArray(value)\n    ? value.map((item) => (item === null || item === undefined ? '' : String(item))).filter(Boolean).join(', ')\n    : (typeof value === 'object' ? JSON.stringify(value) : String(value))\n  if (!text.trim()) return\n  lines.push(`${label}: ${text}`)\n}\n\nfunction pickString(...candidates: Array<unknown>): string | null {\n  for (const candidate of candidates) {\n    if (typeof candidate !== 'string') continue\n    const trimmed = candidate.trim()\n    if (trimmed.length > 0) return trimmed\n  }\n  return null\n}\n\nfunction snippet(value: unknown, max = 140): string | undefined {\n  if (typeof value !== 'string') return undefined\n  const trimmed = value.trim()\n  if (!trimmed.length) return undefined\n  if (trimmed.length <= max) return trimmed\n  return `${trimmed.slice(0, max - 3)}...`\n}\n\nfunction buildMessagePresenter(translate: TranslateFn, record: Record<string, unknown>): SearchResultPresenter {\n  const title = pickString(record.subject) ?? translate('messages.search.fallback.title', 'Message')\n  const body = snippet(record.body)\n  const externalName = pickString(record.external_name, record.externalName)\n  const subtitle = [externalName, body].filter(Boolean).join(' \u00B7 ') || undefined\n  return {\n    title: String(title),\n    subtitle,\n    icon: 'mail',\n    badge: translate('messages.search.badge.message', 'Message'),\n  }\n}\n\nexport const searchConfig: SearchModuleConfig = {\n  entities: [\n    {\n      entityId: 'messages:message',\n      enabled: true,\n      priority: 5,\n      buildSource: async (ctx: SearchBuildContext): Promise<SearchIndexSource | null> => {\n        const { t } = await resolveTranslations()\n        const record = ctx.record\n        const lines: string[] = []\n        appendLine(lines, 'Subject', record.subject)\n        appendLine(lines, 'Body', record.body)\n        appendLine(lines, 'From name', record.external_name ?? record.externalName)\n        if (!lines.length) return null\n        return {\n          text: lines,\n          presenter: buildMessagePresenter(t, record),\n          checksumSource: {\n            record: {\n              subject: record.subject,\n              body: record.body,\n              external_name: record.external_name ?? record.externalName,\n              external_email_hash: record.external_email_hash ?? record.externalEmailHash,\n            },\n          },\n        }\n      },\n      formatResult: async (ctx) => {\n        const { t } = await resolveTranslations()\n        return buildMessagePresenter(t, ctx.record)\n      },\n      resolveUrl: async (ctx) => {\n        const id = pickString(ctx.record.id)\n        return id ? `/backend/messages/${encodeURIComponent(id)}` : null\n      },\n      fieldPolicy: {\n        searchable: ['subject', 'body', 'external_name'],\n        hashOnly: ['external_email'],\n        excluded: ['action_data', 'action_result'],\n      },\n    },\n  ],\n}\n\nexport default searchConfig\nexport const config = searchConfig\n"],
+  "mappings": "AAOA,SAAS,2BAA2B;AAEpC,SAAS,WAAW,OAAiB,OAAe,OAAgB;AAClE,MAAI,UAAU,QAAQ,UAAU,OAAW;AAC3C,QAAM,OAAO,MAAM,QAAQ,KAAK,IAC5B,MAAM,IAAI,CAAC,SAAU,SAAS,QAAQ,SAAS,SAAY,KAAK,OAAO,IAAI,CAAE,EAAE,OAAO,OAAO,EAAE,KAAK,IAAI,IACvG,OAAO,UAAU,WAAW,KAAK,UAAU,KAAK,IAAI,OAAO,KAAK;AACrE,MAAI,CAAC,KAAK,KAAK,EAAG;AAClB,QAAM,KAAK,GAAG,KAAK,KAAK,IAAI,EAAE;AAChC;AAEA,SAAS,cAAc,YAA2C;AAChE,aAAW,aAAa,YAAY;AAClC,QAAI,OAAO,cAAc,SAAU;AACnC,UAAM,UAAU,UAAU,KAAK;AAC/B,QAAI,QAAQ,SAAS,EAAG,QAAO;AAAA,EACjC;AACA,SAAO;AACT;AAEA,SAAS,QAAQ,OAAgB,MAAM,KAAyB;AAC9D,MAAI,OAAO,UAAU,SAAU,QAAO;AACtC,QAAM,UAAU,MAAM,KAAK;AAC3B,MAAI,CAAC,QAAQ,OAAQ,QAAO;AAC5B,MAAI,QAAQ,UAAU,IAAK,QAAO;AAClC,SAAO,GAAG,QAAQ,MAAM,GAAG,MAAM,CAAC,CAAC;AACrC;AAEA,SAAS,sBAAsB,WAAwB,QAAwD;AAC7G,QAAM,QAAQ,WAAW,OAAO,OAAO,KAAK,UAAU,kCAAkC,SAAS;AACjG,QAAM,OAAO,QAAQ,OAAO,IAAI;AAChC,QAAM,eAAe,WAAW,OAAO,eAAe,OAAO,YAAY;AACzE,QAAM,WAAW,CAAC,cAAc,IAAI,EAAE,OAAO,OAAO,EAAE,KAAK,QAAK,KAAK;AACrE,SAAO;AAAA,IACL,OAAO,OAAO,KAAK;AAAA,IACnB;AAAA,IACA,MAAM;AAAA,IACN,OAAO,UAAU,iCAAiC,SAAS;AAAA,EAC7D;AACF;AAEO,MAAM,eAAmC;AAAA,EAC9C,UAAU;AAAA,IACR;AAAA,MACE,UAAU;AAAA,MACV,SAAS;AAAA,MACT,UAAU;AAAA,MACV,aAAa,OAAO,QAA+D;AACjF,cAAM,EAAE,EAAE,IAAI,MAAM,oBAAoB;AACxC,cAAM,SAAS,IAAI;AACnB,cAAM,QAAkB,CAAC;AACzB,mBAAW,OAAO,WAAW,OAAO,OAAO;AAC3C,mBAAW,OAAO,QAAQ,OAAO,IAAI;AACrC,mBAAW,OAAO,aAAa,OAAO,iBAAiB,OAAO,YAAY;AAC1E,YAAI,CAAC,MAAM,OAAQ,QAAO;AAC1B,eAAO;AAAA,UACL,MAAM;AAAA,UACN,WAAW,sBAAsB,GAAG,MAAM;AAAA,UAC1C,gBAAgB;AAAA,YACd,QAAQ;AAAA,cACN,SAAS,OAAO;AAAA,cAChB,MAAM,OAAO;AAAA,cACb,eAAe,OAAO,iBAAiB,OAAO;AAAA,cAC9C,qBAAqB,OAAO,uBAAuB,OAAO;AAAA,YAC5D;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,MACA,cAAc,OAAO,QAAQ;AAC3B,cAAM,EAAE,EAAE,IAAI,MAAM,oBAAoB;AACxC,eAAO,sBAAsB,GAAG,IAAI,MAAM;AAAA,MAC5C;AAAA,MACA,YAAY,OAAO,QAAQ;AACzB,cAAM,KAAK,WAAW,IAAI,OAAO,EAAE;AACnC,eAAO,KAAK,qBAAqB,mBAAmB,EAAE,CAAC,KAAK;AAAA,MAC9D;AAAA,MACA,aAAa;AAAA,QACX,YAAY,CAAC,WAAW,QAAQ,eAAe;AAAA,QAC/C,UAAU,CAAC,gBAAgB;AAAA,QAC3B,UAAU,CAAC,eAAe,eAAe;AAAA,MAC3C;AAAA,IACF;AAAA,EACF;AACF;AAEA,IAAO,iBAAQ;AACR,MAAM,SAAS;",
   "names": []
 }

package/dist/modules/notifications/api/route.js

@@ -1,7 +1,19 @@
+import { createHash } from "node:crypto";
 import { z } from "zod";
+import { runWithCacheTenant } from "@open-mercato/cache";
+import {
+  buildCollectionTags,
+  debugCrudCache,
+  isCrudCacheEnabled,
+  resolveCrudCache
+} from "@open-mercato/shared/lib/crud/cache";
 import { Notification } from "../data/entities.js";
 import { listNotificationsSchema, createNotificationSchema } from "../data/validators.js";
 import { toNotificationDto } from "../lib/notificationMapper.js";
+import {
+  buildNotificationReadScopeWhere,
+  getNotificationReadScopeTagOrganizationIds
+} from "../lib/notificationScope.js";
 import {
   NOTIFICATION_RESOURCE_KIND,
   notificationCrudErrorResponse,
@@ -18,15 +30,61 @@ const metadata = {
   GET: { requireAuth: true },
   POST: { requireAuth: true, requireFeatures: ["notifications.create"] }
 };
+const NOTIFICATIONS_LIST_TTL_MS = 1e4;
+const NOTIFICATIONS_LIST_CACHE_VERSION = 2;
+const NOTIFICATIONS_LIST_RESOURCE = "notifications.notification";
+function buildNotificationsListCacheKey(userId, organizationScope, input) {
+  const normalizedIds = Array.from(new Set(
+    organizationScope.organizationIds.filter((value) => value.trim().length > 0)
+  )).sort((left, right) => left.localeCompare(right));
+  const scopeKey = normalizedIds.length === 0 ? "no-access" : `${organizationScope.organizationId ?? "none"}:scope=${createHash("sha256").update(normalizedIds.join("\0")).digest("hex").slice(0, 16)}`;
+  const filterSignature = JSON.stringify({
+    status: Array.isArray(input.status) ? [...input.status].sort((left, right) => left.localeCompare(right)) : input.status ?? null,
+    type: input.type ?? null,
+    severity: input.severity ?? null,
+    sourceEntityType: input.sourceEntityType ?? null,
+    sourceEntityId: input.sourceEntityId ?? null,
+    since: input.since ?? null,
+    page: input.page,
+    pageSize: input.pageSize
+  });
+  return `notifications:list:v${NOTIFICATIONS_LIST_CACHE_VERSION}:u=${userId}:org=${scopeKey}:filters=${filterSignature}`;
+}
+function isNotificationsListPayload(value) {
+  if (!value || typeof value !== "object") return false;
+  const payload = value;
+  return Array.isArray(payload.items) && typeof payload.total === "number" && typeof payload.page === "number" && typeof payload.pageSize === "number" && typeof payload.totalPages === "number";
+}
 async function GET(req) {
   const { ctx, scope } = await resolveNotificationContext(req);
   const em = ctx.container.resolve("em");
   const url = new URL(req.url);
   const queryParams = Object.fromEntries(url.searchParams.entries());
   const input = listNotificationsSchema.parse(queryParams);
+  const userId = scope.userId;
+  const cacheableOrganizationIds = Array.isArray(scope.organizationIds) ? scope.organizationIds : null;
+  const cache = userId && cacheableOrganizationIds && isCrudCacheEnabled() ? resolveCrudCache(ctx.container) : null;
+  const cacheKey = cache && userId && cacheableOrganizationIds ? buildNotificationsListCacheKey(
+    userId,
+    { organizationId: scope.organizationId, organizationIds: cacheableOrganizationIds },
+    input
+  ) : null;
+  if (cache && cacheKey) {
+    try {
+      const cached = await runWithCacheTenant(scope.tenantId, () => cache.get(cacheKey));
+      if (isNotificationsListPayload(cached)) {
+        return Response.json(cached);
+      }
+    } catch (error) {
+      debugCrudCache("notifications-list-cache-read-failed", {
+        error: error instanceof Error ? error.message : String(error)
+      });
+    }
+  }
   const filters = {
-    recipientUserId: scope.userId,
-    tenantId: scope.tenantId
+    recipientUserId: userId,
+    tenantId: scope.tenantId,
+    ...buildNotificationReadScopeWhere(scope)
   };
   if (input.status) {
     filters.status = Array.isArray(input.status) ? { $in: input.status } : input.status;
@@ -57,13 +115,33 @@ async function GET(req) {
     em.count(Notification, filters)
   ]);
   const items = notifications.map(toNotificationDto);
-  return Response.json({
+  const payload = {
     items,
     total,
     page: input.page,
     pageSize: input.pageSize,
     totalPages: Math.ceil(total / input.pageSize)
-  });
+  };
+  if (cache && cacheKey) {
+    try {
+      await runWithCacheTenant(
+        scope.tenantId,
+        () => cache.set(cacheKey, payload, {
+          ttl: NOTIFICATIONS_LIST_TTL_MS,
+          tags: buildCollectionTags(
+            NOTIFICATIONS_LIST_RESOURCE,
+            scope.tenantId,
+            getNotificationReadScopeTagOrganizationIds(scope)
+          )
+        })
+      );
+    } catch (error) {
+      debugCrudCache("notifications-list-cache-write-failed", {
+        error: error instanceof Error ? error.message : String(error)
+      });
+    }
+  }
+  return Response.json(payload);
 }
 async function POST(req) {
   const { service, scope, ctx } = await resolveNotificationContext(req);
@@ -105,6 +183,7 @@ const openApi = buildNotificationsCrudOpenApi({
 export {
   GET,
   POST,
+  buildNotificationsListCacheKey,
   metadata,
   openApi
 };

package/dist/modules/notifications/api/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/notifications/api/route.ts"],
-  "sourcesContent": ["import { z } from 'zod'\nimport type { EntityManager } from '@mikro-orm/core'\nimport { Notification } from '../data/entities'\nimport { listNotificationsSchema, createNotificationSchema } from '../data/validators'\nimport { toNotificationDto } from '../lib/notificationMapper'\nimport {\n  NOTIFICATION_RESOURCE_KIND,\n  notificationCrudErrorResponse,\n  notificationValidationErrorResponse,\n  resolveNotificationContext,\n  runGuardedNotificationWrite,\n} from '../lib/routeHelpers'\nimport {\n  buildNotificationsCrudOpenApi,\n  createPagedListResponseSchema,\n  notificationItemSchema,\n} from './openapi'\n\nexport const metadata = {\n  GET: { requireAuth: true },\n  POST: { requireAuth: true, requireFeatures: ['notifications.create'] },\n}\n\nexport async function GET(req: Request) {\n  const { ctx, scope } = await resolveNotificationContext(req)\n  const em = ctx.container.resolve('em') as EntityManager\n\n  const url = new URL(req.url)\n  const queryParams = Object.fromEntries(url.searchParams.entries())\n  const input = listNotificationsSchema.parse(queryParams)\n\n  const filters: Record<string, unknown> = {\n    recipientUserId: scope.userId,\n    tenantId: scope.tenantId,\n  }\n\n  if (input.status) {\n    filters.status = Array.isArray(input.status) ? { $in: input.status } : input.status\n  } else {\n    filters.status = { $ne: 'dismissed' }\n  }\n  if (input.type) {\n    filters.type = input.type\n  }\n  if (input.severity) {\n    filters.severity = input.severity\n  }\n  if (input.sourceEntityType) {\n    filters.sourceEntityType = input.sourceEntityType\n  }\n  if (input.sourceEntityId) {\n    filters.sourceEntityId = input.sourceEntityId\n  }\n  if (input.since) {\n    filters.createdAt = { $gt: new Date(input.since) }\n  }\n\n  const [notifications, total] = await Promise.all([\n    em.find(Notification, filters, {\n      orderBy: { createdAt: 'desc' },\n      limit: input.pageSize,\n      offset: (input.page - 1) * input.pageSize,\n    }),\n    em.count(Notification, filters),\n  ])\n\n  const items = notifications.map(toNotificationDto)\n\n  return Response.json({\n    items,\n    total,\n    page: input.page,\n    pageSize: input.pageSize,\n    totalPages: Math.ceil(total / input.pageSize),\n  })\n}\n\nexport async function POST(req: Request) {\n  const { service, scope, ctx } = await resolveNotificationContext(req)\n\n  const body = await req.json().catch(() => ({}))\n  const parsed = createNotificationSchema.safeParse(body)\n  if (!parsed.success) {\n    return notificationValidationErrorResponse(parsed.error)\n  }\n\n  try {\n    const guarded = await runGuardedNotificationWrite(\n      ctx.container,\n      scope,\n      req,\n      {\n        resourceKind: NOTIFICATION_RESOURCE_KIND,\n        operation: 'create',\n        payload: parsed.data as Record<string, unknown>,\n      },\n      () => service.create(parsed.data, scope),\n    )\n    if (!guarded.ok) return guarded.response\n\n    return Response.json({ id: guarded.result.id }, { status: 201 })\n  } catch (error) {\n    const errorResponse = notificationCrudErrorResponse(error)\n    if (errorResponse) return errorResponse\n    throw error\n  }\n}\n\nexport const openApi = buildNotificationsCrudOpenApi({\n  resourceName: 'Notification',\n  querySchema: listNotificationsSchema,\n  listResponseSchema: createPagedListResponseSchema(notificationItemSchema),\n  create: {\n    schema: createNotificationSchema,\n    responseSchema: z.object({ id: z.string().uuid() }),\n    description: 'Creates a notification for a user.',\n  },\n})\n"],
-  "mappings": "AAAA,SAAS,SAAS;AAElB,SAAS,oBAAoB;AAC7B,SAAS,yBAAyB,gCAAgC;AAClE,SAAS,yBAAyB;AAClC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAEA,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,KAAK;AAAA,EACzB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,sBAAsB,EAAE;AACvE;AAEA,eAAsB,IAAI,KAAc;AACtC,QAAM,EAAE,KAAK,MAAM,IAAI,MAAM,2BAA2B,GAAG;AAC3D,QAAM,KAAK,IAAI,UAAU,QAAQ,IAAI;AAErC,QAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,QAAM,cAAc,OAAO,YAAY,IAAI,aAAa,QAAQ,CAAC;AACjE,QAAM,QAAQ,wBAAwB,MAAM,WAAW;AAEvD,QAAM,UAAmC;AAAA,IACvC,iBAAiB,MAAM;AAAA,IACvB,UAAU,MAAM;AAAA,EAClB;AAEA,MAAI,MAAM,QAAQ;AAChB,YAAQ,SAAS,MAAM,QAAQ,MAAM,MAAM,IAAI,EAAE,KAAK,MAAM,OAAO,IAAI,MAAM;AAAA,EAC/E,OAAO;AACL,YAAQ,SAAS,EAAE,KAAK,YAAY;AAAA,EACtC;AACA,MAAI,MAAM,MAAM;AACd,YAAQ,OAAO,MAAM;AAAA,EACvB;AACA,MAAI,MAAM,UAAU;AAClB,YAAQ,WAAW,MAAM;AAAA,EAC3B;AACA,MAAI,MAAM,kBAAkB;AAC1B,YAAQ,mBAAmB,MAAM;AAAA,EACnC;AACA,MAAI,MAAM,gBAAgB;AACxB,YAAQ,iBAAiB,MAAM;AAAA,EACjC;AACA,MAAI,MAAM,OAAO;AACf,YAAQ,YAAY,EAAE,KAAK,IAAI,KAAK,MAAM,KAAK,EAAE;AAAA,EACnD;AAEA,QAAM,CAAC,eAAe,KAAK,IAAI,MAAM,QAAQ,IAAI;AAAA,IAC/C,GAAG,KAAK,cAAc,SAAS;AAAA,MAC7B,SAAS,EAAE,WAAW,OAAO;AAAA,MAC7B,OAAO,MAAM;AAAA,MACb,SAAS,MAAM,OAAO,KAAK,MAAM;AAAA,IACnC,CAAC;AAAA,IACD,GAAG,MAAM,cAAc,OAAO;AAAA,EAChC,CAAC;AAED,QAAM,QAAQ,cAAc,IAAI,iBAAiB;AAEjD,SAAO,SAAS,KAAK;AAAA,IACnB;AAAA,IACA;AAAA,IACA,MAAM,MAAM;AAAA,IACZ,UAAU,MAAM;AAAA,IAChB,YAAY,KAAK,KAAK,QAAQ,MAAM,QAAQ;AAAA,EAC9C,CAAC;AACH;AAEA,eAAsB,KAAK,KAAc;AACvC,QAAM,EAAE,SAAS,OAAO,IAAI,IAAI,MAAM,2BAA2B,GAAG;AAEpE,QAAM,OAAO,MAAM,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAC9C,QAAM,SAAS,yBAAyB,UAAU,IAAI;AACtD,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO,oCAAoC,OAAO,KAAK;AAAA,EACzD;AAEA,MAAI;AACF,UAAM,UAAU,MAAM;AAAA,MACpB,IAAI;AAAA,MACJ;AAAA,MACA;AAAA,MACA;AAAA,QACE,cAAc;AAAA,QACd,WAAW;AAAA,QACX,SAAS,OAAO;AAAA,MAClB;AAAA,MACA,MAAM,QAAQ,OAAO,OAAO,MAAM,KAAK;AAAA,IACzC;AACA,QAAI,CAAC,QAAQ,GAAI,QAAO,QAAQ;AAEhC,WAAO,SAAS,KAAK,EAAE,IAAI,QAAQ,OAAO,GAAG,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACjE,SAAS,OAAO;AACd,UAAM,gBAAgB,8BAA8B,KAAK;AACzD,QAAI,cAAe,QAAO;AAC1B,UAAM;AAAA,EACR;AACF;AAEO,MAAM,UAAU,8BAA8B;AAAA,EACnD,cAAc;AAAA,EACd,aAAa;AAAA,EACb,oBAAoB,8BAA8B,sBAAsB;AAAA,EACxE,QAAQ;AAAA,IACN,QAAQ;AAAA,IACR,gBAAgB,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAAA,IAClD,aAAa;AAAA,EACf;AACF,CAAC;",
+  "sourcesContent": ["import { createHash } from 'node:crypto'\nimport { z } from 'zod'\nimport type { EntityManager } from '@mikro-orm/core'\nimport { runWithCacheTenant } from '@open-mercato/cache'\nimport {\n  buildCollectionTags,\n  debugCrudCache,\n  isCrudCacheEnabled,\n  resolveCrudCache,\n} from '@open-mercato/shared/lib/crud/cache'\nimport { Notification } from '../data/entities'\nimport { listNotificationsSchema, createNotificationSchema } from '../data/validators'\nimport { toNotificationDto } from '../lib/notificationMapper'\nimport {\n  buildNotificationReadScopeWhere,\n  getNotificationReadScopeTagOrganizationIds,\n} from '../lib/notificationScope'\nimport {\n  NOTIFICATION_RESOURCE_KIND,\n  notificationCrudErrorResponse,\n  notificationValidationErrorResponse,\n  resolveNotificationContext,\n  runGuardedNotificationWrite,\n} from '../lib/routeHelpers'\nimport {\n  buildNotificationsCrudOpenApi,\n  createPagedListResponseSchema,\n  notificationItemSchema,\n} from './openapi'\n\nexport const metadata = {\n  GET: { requireAuth: true },\n  POST: { requireAuth: true, requireFeatures: ['notifications.create'] },\n}\n\nconst NOTIFICATIONS_LIST_TTL_MS = 10_000\n// v2: the key gained the selected-organization scope (#4840). Bumping the version\n// retires v1 entries, which were shared across organizations for the same user.\nconst NOTIFICATIONS_LIST_CACHE_VERSION = 2\nconst NOTIFICATIONS_LIST_RESOURCE = 'notifications.notification'\n\ntype NotificationsListPayload = {\n  items: ReturnType<typeof toNotificationDto>[]\n  total: number\n  page: number\n  pageSize: number\n  totalPages: number\n}\n\nexport function buildNotificationsListCacheKey(\n  userId: string,\n  organizationScope: { organizationId: string | null; organizationIds: string[] },\n  input: z.infer<typeof listNotificationsSchema>,\n): string {\n  const normalizedIds = Array.from(new Set(\n    organizationScope.organizationIds.filter((value) => value.trim().length > 0),\n  )).sort((left, right) => left.localeCompare(right))\n  const scopeKey = normalizedIds.length === 0\n    ? 'no-access'\n    : `${organizationScope.organizationId ?? 'none'}:scope=${createHash('sha256')\n        .update(normalizedIds.join('\\0'))\n        .digest('hex')\n        .slice(0, 16)}`\n  const filterSignature = JSON.stringify({\n    status: Array.isArray(input.status)\n      ? [...input.status].sort((left, right) => left.localeCompare(right))\n      : input.status ?? null,\n    type: input.type ?? null,\n    severity: input.severity ?? null,\n    sourceEntityType: input.sourceEntityType ?? null,\n    sourceEntityId: input.sourceEntityId ?? null,\n    since: input.since ?? null,\n    page: input.page,\n    pageSize: input.pageSize,\n  })\n  return `notifications:list:v${NOTIFICATIONS_LIST_CACHE_VERSION}:u=${userId}:org=${scopeKey}:filters=${filterSignature}`\n}\n\nfunction isNotificationsListPayload(value: unknown): value is NotificationsListPayload {\n  if (!value || typeof value !== 'object') return false\n  const payload = value as Partial<NotificationsListPayload>\n  return (\n    Array.isArray(payload.items)\n    && typeof payload.total === 'number'\n    && typeof payload.page === 'number'\n    && typeof payload.pageSize === 'number'\n    && typeof payload.totalPages === 'number'\n  )\n}\n\nexport async function GET(req: Request) {\n  const { ctx, scope } = await resolveNotificationContext(req)\n  const em = ctx.container.resolve('em') as EntityManager\n\n  const url = new URL(req.url)\n  const queryParams = Object.fromEntries(url.searchParams.entries())\n  const input = listNotificationsSchema.parse(queryParams)\n  const userId = scope.userId\n  // Mirrors api/unread-count/route.ts: unrestricted and omitted legacy organization\n  // scopes cannot be safely tagged for invalidation, because organization-specific\n  // writes only invalidate their own collection tag. Leave those scopes uncached\n  // rather than serving a stale tenant-wide list until the TTL expires.\n  const cacheableOrganizationIds = Array.isArray(scope.organizationIds)\n    ? scope.organizationIds\n    : null\n  const cache = userId && cacheableOrganizationIds && isCrudCacheEnabled()\n    ? resolveCrudCache(ctx.container)\n    : null\n  const cacheKey = cache && userId && cacheableOrganizationIds\n    ? buildNotificationsListCacheKey(\n        userId,\n        { organizationId: scope.organizationId, organizationIds: cacheableOrganizationIds },\n        input,\n      )\n    : null\n\n  if (cache && cacheKey) {\n    try {\n      const cached = await runWithCacheTenant(scope.tenantId, () => cache.get(cacheKey))\n      if (isNotificationsListPayload(cached)) {\n        return Response.json(cached)\n      }\n    } catch (error) {\n      debugCrudCache('notifications-list-cache-read-failed', {\n        error: error instanceof Error ? error.message : String(error),\n      })\n    }\n  }\n\n  const filters: Record<string, unknown> = {\n    recipientUserId: userId,\n    tenantId: scope.tenantId,\n    ...buildNotificationReadScopeWhere(scope),\n  }\n\n  if (input.status) {\n    filters.status = Array.isArray(input.status) ? { $in: input.status } : input.status\n  } else {\n    filters.status = { $ne: 'dismissed' }\n  }\n  if (input.type) {\n    filters.type = input.type\n  }\n  if (input.severity) {\n    filters.severity = input.severity\n  }\n  if (input.sourceEntityType) {\n    filters.sourceEntityType = input.sourceEntityType\n  }\n  if (input.sourceEntityId) {\n    filters.sourceEntityId = input.sourceEntityId\n  }\n  if (input.since) {\n    filters.createdAt = { $gt: new Date(input.since) }\n  }\n\n  const [notifications, total] = await Promise.all([\n    em.find(Notification, filters, {\n      orderBy: { createdAt: 'desc' },\n      limit: input.pageSize,\n      offset: (input.page - 1) * input.pageSize,\n    }),\n    em.count(Notification, filters),\n  ])\n\n  const items = notifications.map(toNotificationDto)\n\n  const payload: NotificationsListPayload = {\n    items,\n    total,\n    page: input.page,\n    pageSize: input.pageSize,\n    totalPages: Math.ceil(total / input.pageSize),\n  }\n\n  if (cache && cacheKey) {\n    try {\n      await runWithCacheTenant(scope.tenantId, () =>\n        cache.set(cacheKey, payload, {\n          ttl: NOTIFICATIONS_LIST_TTL_MS,\n          tags: buildCollectionTags(\n            NOTIFICATIONS_LIST_RESOURCE,\n            scope.tenantId,\n            getNotificationReadScopeTagOrganizationIds(scope),\n          ),\n        }),\n      )\n    } catch (error) {\n      debugCrudCache('notifications-list-cache-write-failed', {\n        error: error instanceof Error ? error.message : String(error),\n      })\n    }\n  }\n\n  return Response.json(payload)\n}\n\nexport async function POST(req: Request) {\n  const { service, scope, ctx } = await resolveNotificationContext(req)\n\n  const body = await req.json().catch(() => ({}))\n  const parsed = createNotificationSchema.safeParse(body)\n  if (!parsed.success) {\n    return notificationValidationErrorResponse(parsed.error)\n  }\n\n  try {\n    const guarded = await runGuardedNotificationWrite(\n      ctx.container,\n      scope,\n      req,\n      {\n        resourceKind: NOTIFICATION_RESOURCE_KIND,\n        operation: 'create',\n        payload: parsed.data as Record<string, unknown>,\n      },\n      () => service.create(parsed.data, scope),\n    )\n    if (!guarded.ok) return guarded.response\n\n    return Response.json({ id: guarded.result.id }, { status: 201 })\n  } catch (error) {\n    const errorResponse = notificationCrudErrorResponse(error)\n    if (errorResponse) return errorResponse\n    throw error\n  }\n}\n\nexport const openApi = buildNotificationsCrudOpenApi({\n  resourceName: 'Notification',\n  querySchema: listNotificationsSchema,\n  listResponseSchema: createPagedListResponseSchema(notificationItemSchema),\n  create: {\n    schema: createNotificationSchema,\n    responseSchema: z.object({ id: z.string().uuid() }),\n    description: 'Creates a notification for a user.',\n  },\n})\n"],
+  "mappings": "AAAA,SAAS,kBAAkB;AAC3B,SAAS,SAAS;AAElB,SAAS,0BAA0B;AACnC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,oBAAoB;AAC7B,SAAS,yBAAyB,gCAAgC;AAClE,SAAS,yBAAyB;AAClC;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAEA,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,KAAK;AAAA,EACzB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,sBAAsB,EAAE;AACvE;AAEA,MAAM,4BAA4B;AAGlC,MAAM,mCAAmC;AACzC,MAAM,8BAA8B;AAU7B,SAAS,+BACd,QACA,mBACA,OACQ;AACR,QAAM,gBAAgB,MAAM,KAAK,IAAI;AAAA,IACnC,kBAAkB,gBAAgB,OAAO,CAAC,UAAU,MAAM,KAAK,EAAE,SAAS,CAAC;AAAA,EAC7E,CAAC,EAAE,KAAK,CAAC,MAAM,UAAU,KAAK,cAAc,KAAK,CAAC;AAClD,QAAM,WAAW,cAAc,WAAW,IACtC,cACA,GAAG,kBAAkB,kBAAkB,MAAM,UAAU,WAAW,QAAQ,EACvE,OAAO,cAAc,KAAK,IAAI,CAAC,EAC/B,OAAO,KAAK,EACZ,MAAM,GAAG,EAAE,CAAC;AACnB,QAAM,kBAAkB,KAAK,UAAU;AAAA,IACrC,QAAQ,MAAM,QAAQ,MAAM,MAAM,IAC9B,CAAC,GAAG,MAAM,MAAM,EAAE,KAAK,CAAC,MAAM,UAAU,KAAK,cAAc,KAAK,CAAC,IACjE,MAAM,UAAU;AAAA,IACpB,MAAM,MAAM,QAAQ;AAAA,IACpB,UAAU,MAAM,YAAY;AAAA,IAC5B,kBAAkB,MAAM,oBAAoB;AAAA,IAC5C,gBAAgB,MAAM,kBAAkB;AAAA,IACxC,OAAO,MAAM,SAAS;AAAA,IACtB,MAAM,MAAM;AAAA,IACZ,UAAU,MAAM;AAAA,EAClB,CAAC;AACD,SAAO,uBAAuB,gCAAgC,MAAM,MAAM,QAAQ,QAAQ,YAAY,eAAe;AACvH;AAEA,SAAS,2BAA2B,OAAmD;AACrF,MAAI,CAAC,SAAS,OAAO,UAAU,SAAU,QAAO;AAChD,QAAM,UAAU;AAChB,SACE,MAAM,QAAQ,QAAQ,KAAK,KACxB,OAAO,QAAQ,UAAU,YACzB,OAAO,QAAQ,SAAS,YACxB,OAAO,QAAQ,aAAa,YAC5B,OAAO,QAAQ,eAAe;AAErC;AAEA,eAAsB,IAAI,KAAc;AACtC,QAAM,EAAE,KAAK,MAAM,IAAI,MAAM,2BAA2B,GAAG;AAC3D,QAAM,KAAK,IAAI,UAAU,QAAQ,IAAI;AAErC,QAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,QAAM,cAAc,OAAO,YAAY,IAAI,aAAa,QAAQ,CAAC;AACjE,QAAM,QAAQ,wBAAwB,MAAM,WAAW;AACvD,QAAM,SAAS,MAAM;AAKrB,QAAM,2BAA2B,MAAM,QAAQ,MAAM,eAAe,IAChE,MAAM,kBACN;AACJ,QAAM,QAAQ,UAAU,4BAA4B,mBAAmB,IACnE,iBAAiB,IAAI,SAAS,IAC9B;AACJ,QAAM,WAAW,SAAS,UAAU,2BAChC;AAAA,IACE;AAAA,IACA,EAAE,gBAAgB,MAAM,gBAAgB,iBAAiB,yBAAyB;AAAA,IAClF;AAAA,EACF,IACA;AAEJ,MAAI,SAAS,UAAU;AACrB,QAAI;AACF,YAAM,SAAS,MAAM,mBAAmB,MAAM,UAAU,MAAM,MAAM,IAAI,QAAQ,CAAC;AACjF,UAAI,2BAA2B,MAAM,GAAG;AACtC,eAAO,SAAS,KAAK,MAAM;AAAA,MAC7B;AAAA,IACF,SAAS,OAAO;AACd,qBAAe,wCAAwC;AAAA,QACrD,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,MAC9D,CAAC;AAAA,IACH;AAAA,EACF;AAEA,QAAM,UAAmC;AAAA,IACvC,iBAAiB;AAAA,IACjB,UAAU,MAAM;AAAA,IAChB,GAAG,gCAAgC,KAAK;AAAA,EAC1C;AAEA,MAAI,MAAM,QAAQ;AAChB,YAAQ,SAAS,MAAM,QAAQ,MAAM,MAAM,IAAI,EAAE,KAAK,MAAM,OAAO,IAAI,MAAM;AAAA,EAC/E,OAAO;AACL,YAAQ,SAAS,EAAE,KAAK,YAAY;AAAA,EACtC;AACA,MAAI,MAAM,MAAM;AACd,YAAQ,OAAO,MAAM;AAAA,EACvB;AACA,MAAI,MAAM,UAAU;AAClB,YAAQ,WAAW,MAAM;AAAA,EAC3B;AACA,MAAI,MAAM,kBAAkB;AAC1B,YAAQ,mBAAmB,MAAM;AAAA,EACnC;AACA,MAAI,MAAM,gBAAgB;AACxB,YAAQ,iBAAiB,MAAM;AAAA,EACjC;AACA,MAAI,MAAM,OAAO;AACf,YAAQ,YAAY,EAAE,KAAK,IAAI,KAAK,MAAM,KAAK,EAAE;AAAA,EACnD;AAEA,QAAM,CAAC,eAAe,KAAK,IAAI,MAAM,QAAQ,IAAI;AAAA,IAC/C,GAAG,KAAK,cAAc,SAAS;AAAA,MAC7B,SAAS,EAAE,WAAW,OAAO;AAAA,MAC7B,OAAO,MAAM;AAAA,MACb,SAAS,MAAM,OAAO,KAAK,MAAM;AAAA,IACnC,CAAC;AAAA,IACD,GAAG,MAAM,cAAc,OAAO;AAAA,EAChC,CAAC;AAED,QAAM,QAAQ,cAAc,IAAI,iBAAiB;AAEjD,QAAM,UAAoC;AAAA,IACxC;AAAA,IACA;AAAA,IACA,MAAM,MAAM;AAAA,IACZ,UAAU,MAAM;AAAA,IAChB,YAAY,KAAK,KAAK,QAAQ,MAAM,QAAQ;AAAA,EAC9C;AAEA,MAAI,SAAS,UAAU;AACrB,QAAI;AACF,YAAM;AAAA,QAAmB,MAAM;AAAA,QAAU,MACvC,MAAM,IAAI,UAAU,SAAS;AAAA,UAC3B,KAAK;AAAA,UACL,MAAM;AAAA,YACJ;AAAA,YACA,MAAM;AAAA,YACN,2CAA2C,KAAK;AAAA,UAClD;AAAA,QACF,CAAC;AAAA,MACH;AAAA,IACF,SAAS,OAAO;AACd,qBAAe,yCAAyC;AAAA,QACtD,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,MAC9D,CAAC;AAAA,IACH;AAAA,EACF;AAEA,SAAO,SAAS,KAAK,OAAO;AAC9B;AAEA,eAAsB,KAAK,KAAc;AACvC,QAAM,EAAE,SAAS,OAAO,IAAI,IAAI,MAAM,2BAA2B,GAAG;AAEpE,QAAM,OAAO,MAAM,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAC9C,QAAM,SAAS,yBAAyB,UAAU,IAAI;AACtD,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO,oCAAoC,OAAO,KAAK;AAAA,EACzD;AAEA,MAAI;AACF,UAAM,UAAU,MAAM;AAAA,MACpB,IAAI;AAAA,MACJ;AAAA,MACA;AAAA,MACA;AAAA,QACE,cAAc;AAAA,QACd,WAAW;AAAA,QACX,SAAS,OAAO;AAAA,MAClB;AAAA,MACA,MAAM,QAAQ,OAAO,OAAO,MAAM,KAAK;AAAA,IACzC;AACA,QAAI,CAAC,QAAQ,GAAI,QAAO,QAAQ;AAEhC,WAAO,SAAS,KAAK,EAAE,IAAI,QAAQ,OAAO,GAAG,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACjE,SAAS,OAAO;AACd,UAAM,gBAAgB,8BAA8B,KAAK;AACzD,QAAI,cAAe,QAAO;AAC1B,UAAM;AAAA,EACR;AACF;AAEO,MAAM,UAAU,8BAA8B;AAAA,EACnD,cAAc;AAAA,EACd,aAAa;AAAA,EACb,oBAAoB,8BAA8B,sBAAsB;AAAA,EACxE,QAAQ;AAAA,IACN,QAAQ;AAAA,IACR,gBAAgB,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAAA,IAClD,aAAa;AAAA,EACf;AACF,CAAC;",
   "names": []
 }

package/dist/modules/notifications/api/unread-count/route.js

@@ -1,3 +1,4 @@
+import { createHash } from "node:crypto";
 import { runWithCacheTenant } from "@open-mercato/cache";
 import {
   buildCollectionTags,
@@ -7,20 +8,33 @@ import {
 import { Notification } from "../../data/entities.js";
 import { unreadCountResponseSchema } from "../openapi.js";
 import { resolveNotificationContext } from "../../lib/routeHelpers.js";
+import {
+  buildNotificationReadScopeWhere,
+  getNotificationReadScopeTagOrganizationIds
+} from "../../lib/notificationScope.js";
 const metadata = {
   GET: { requireAuth: true }
 };
 const UNREAD_COUNT_RESOURCE = "notifications.notification";
 const UNREAD_COUNT_TTL_MS = 1e4;
-function buildUnreadCountCacheKey(userId) {
-  return `notifications:unread-count:u=${userId}`;
+function buildUnreadCountCacheKey(params) {
+  const normalizedIds = Array.from(new Set(
+    params.organizationIds.filter((value) => value.trim().length > 0)
+  )).sort((left, right) => left.localeCompare(right));
+  const scopeKey = normalizedIds.length === 0 ? "no-access" : `${params.organizationId ?? "none"}:scope=${createHash("sha256").update(normalizedIds.join("\0")).digest("hex").slice(0, 16)}`;
+  return `notifications:unread-count:u=${params.userId}:org=${scopeKey}`;
 }
 async function GET(req) {
   const { scope, ctx } = await resolveNotificationContext(req);
   const em = ctx.container.resolve("em");
   const userId = scope.userId;
-  const cache = userId && isCrudCacheEnabled() ? resolveCrudCache(ctx.container) : null;
-  const cacheKey = cache && userId ? buildUnreadCountCacheKey(userId) : null;
+  const cacheableOrganizationIds = Array.isArray(scope.organizationIds) ? scope.organizationIds : null;
+  const cache = userId && cacheableOrganizationIds && isCrudCacheEnabled() ? resolveCrudCache(ctx.container) : null;
+  const cacheKey = cache && userId && cacheableOrganizationIds ? buildUnreadCountCacheKey({
+    userId,
+    organizationId: scope.organizationId,
+    organizationIds: cacheableOrganizationIds
+  }) : null;
   if (cache && cacheKey) {
     try {
       const cached = await runWithCacheTenant(scope.tenantId, () => cache.get(cacheKey));
@@ -33,7 +47,8 @@ async function GET(req) {
   const count = await em.count(Notification, {
     recipientUserId: userId,
     tenantId: scope.tenantId,
-    status: "unread"
+    status: "unread",
+    ...buildNotificationReadScopeWhere(scope)
   });
   if (cache && cacheKey) {
     try {
@@ -41,7 +56,11 @@ async function GET(req) {
         scope.tenantId,
         () => cache.set(cacheKey, count, {
           ttl: UNREAD_COUNT_TTL_MS,
-          tags: buildCollectionTags(UNREAD_COUNT_RESOURCE, scope.tenantId, [null])
+          tags: buildCollectionTags(
+            UNREAD_COUNT_RESOURCE,
+            scope.tenantId,
+            getNotificationReadScopeTagOrganizationIds(scope)
+          )
         })
       );
     } catch {

package/dist/modules/notifications/api/unread-count/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../src/modules/notifications/api/unread-count/route.ts"],
-  "sourcesContent": ["import type { EntityManager } from '@mikro-orm/core'\nimport { runWithCacheTenant } from '@open-mercato/cache'\nimport {\n  buildCollectionTags,\n  isCrudCacheEnabled,\n  resolveCrudCache,\n} from '@open-mercato/shared/lib/crud/cache'\nimport { Notification } from '../../data/entities'\nimport { unreadCountResponseSchema } from '../openapi'\nimport { resolveNotificationContext } from '../../lib/routeHelpers'\n\nexport const metadata = {\n  GET: { requireAuth: true },\n}\n\nconst UNREAD_COUNT_RESOURCE = 'notifications.notification'\nconst UNREAD_COUNT_TTL_MS = 10_000\n\nfunction buildUnreadCountCacheKey(userId: string): string {\n  return `notifications:unread-count:u=${userId}`\n}\n\nexport async function GET(req: Request) {\n  const { scope, ctx } = await resolveNotificationContext(req)\n  const em = ctx.container.resolve('em') as EntityManager\n\n  const userId = scope.userId\n  const cache = userId && isCrudCacheEnabled() ? resolveCrudCache(ctx.container) : null\n  const cacheKey = cache && userId ? buildUnreadCountCacheKey(userId) : null\n\n  if (cache && cacheKey) {\n    try {\n      const cached = await runWithCacheTenant(scope.tenantId, () => cache.get(cacheKey))\n      if (typeof cached === 'number') {\n        return Response.json({ unreadCount: cached })\n      }\n    } catch {}\n  }\n\n  const count = await em.count(Notification, {\n    recipientUserId: userId,\n    tenantId: scope.tenantId,\n    status: 'unread',\n  })\n\n  if (cache && cacheKey) {\n    try {\n      await runWithCacheTenant(scope.tenantId, () =>\n        cache.set(cacheKey, count, {\n          ttl: UNREAD_COUNT_TTL_MS,\n          tags: buildCollectionTags(UNREAD_COUNT_RESOURCE, scope.tenantId, [null]),\n        }),\n      )\n    } catch {}\n  }\n\n  return Response.json({ unreadCount: count })\n}\n\nexport const openApi = {\n  GET: {\n    summary: 'Get unread notification count',\n    tags: ['Notifications'],\n    responses: {\n      200: {\n        description: 'Unread count',\n        content: {\n          'application/json': {\n            schema: unreadCountResponseSchema,\n          },\n        },\n      },\n    },\n  },\n}\n"],
-  "mappings": "AACA,SAAS,0BAA0B;AACnC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,oBAAoB;AAC7B,SAAS,iCAAiC;AAC1C,SAAS,kCAAkC;AAEpC,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,KAAK;AAC3B;AAEA,MAAM,wBAAwB;AAC9B,MAAM,sBAAsB;AAE5B,SAAS,yBAAyB,QAAwB;AACxD,SAAO,gCAAgC,MAAM;AAC/C;AAEA,eAAsB,IAAI,KAAc;AACtC,QAAM,EAAE,OAAO,IAAI,IAAI,MAAM,2BAA2B,GAAG;AAC3D,QAAM,KAAK,IAAI,UAAU,QAAQ,IAAI;AAErC,QAAM,SAAS,MAAM;AACrB,QAAM,QAAQ,UAAU,mBAAmB,IAAI,iBAAiB,IAAI,SAAS,IAAI;AACjF,QAAM,WAAW,SAAS,SAAS,yBAAyB,MAAM,IAAI;AAEtE,MAAI,SAAS,UAAU;AACrB,QAAI;AACF,YAAM,SAAS,MAAM,mBAAmB,MAAM,UAAU,MAAM,MAAM,IAAI,QAAQ,CAAC;AACjF,UAAI,OAAO,WAAW,UAAU;AAC9B,eAAO,SAAS,KAAK,EAAE,aAAa,OAAO,CAAC;AAAA,MAC9C;AAAA,IACF,QAAQ;AAAA,IAAC;AAAA,EACX;AAEA,QAAM,QAAQ,MAAM,GAAG,MAAM,cAAc;AAAA,IACzC,iBAAiB;AAAA,IACjB,UAAU,MAAM;AAAA,IAChB,QAAQ;AAAA,EACV,CAAC;AAED,MAAI,SAAS,UAAU;AACrB,QAAI;AACF,YAAM;AAAA,QAAmB,MAAM;AAAA,QAAU,MACvC,MAAM,IAAI,UAAU,OAAO;AAAA,UACzB,KAAK;AAAA,UACL,MAAM,oBAAoB,uBAAuB,MAAM,UAAU,CAAC,IAAI,CAAC;AAAA,QACzE,CAAC;AAAA,MACH;AAAA,IACF,QAAQ;AAAA,IAAC;AAAA,EACX;AAEA,SAAO,SAAS,KAAK,EAAE,aAAa,MAAM,CAAC;AAC7C;AAEO,MAAM,UAAU;AAAA,EACrB,KAAK;AAAA,IACH,SAAS;AAAA,IACT,MAAM,CAAC,eAAe;AAAA,IACtB,WAAW;AAAA,MACT,KAAK;AAAA,QACH,aAAa;AAAA,QACb,SAAS;AAAA,UACP,oBAAoB;AAAA,YAClB,QAAQ;AAAA,UACV;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["import { createHash } from 'node:crypto'\nimport type { EntityManager } from '@mikro-orm/core'\nimport { runWithCacheTenant } from '@open-mercato/cache'\nimport {\n  buildCollectionTags,\n  isCrudCacheEnabled,\n  resolveCrudCache,\n} from '@open-mercato/shared/lib/crud/cache'\nimport { Notification } from '../../data/entities'\nimport { unreadCountResponseSchema } from '../openapi'\nimport { resolveNotificationContext } from '../../lib/routeHelpers'\nimport {\n  buildNotificationReadScopeWhere,\n  getNotificationReadScopeTagOrganizationIds,\n} from '../../lib/notificationScope'\n\nexport const metadata = {\n  GET: { requireAuth: true },\n}\n\nconst UNREAD_COUNT_RESOURCE = 'notifications.notification'\nconst UNREAD_COUNT_TTL_MS = 10_000\n\nfunction buildUnreadCountCacheKey(params: {\n  userId: string\n  organizationId: string | null\n  organizationIds: string[]\n}): string {\n  const normalizedIds = Array.from(new Set(\n    params.organizationIds.filter((value) => value.trim().length > 0),\n  )).sort((left, right) => left.localeCompare(right))\n  const scopeKey = normalizedIds.length === 0\n    ? 'no-access'\n    : `${params.organizationId ?? 'none'}:scope=${createHash('sha256')\n        .update(normalizedIds.join('\\0'))\n        .digest('hex')\n        .slice(0, 16)}`\n  return `notifications:unread-count:u=${params.userId}:org=${scopeKey}`\n}\n\nexport async function GET(req: Request) {\n  const { scope, ctx } = await resolveNotificationContext(req)\n  const em = ctx.container.resolve('em') as EntityManager\n\n  const userId = scope.userId\n  const cacheableOrganizationIds = Array.isArray(scope.organizationIds)\n    ? scope.organizationIds\n    : null\n  // Unrestricted and omitted legacy scopes cannot be safely tagged for invalidation:\n  // org-specific writes only invalidate their own collection tag. Keep those scopes\n  // uncached rather than serving a stale tenant-wide total until the TTL expires.\n  const cache = userId && cacheableOrganizationIds && isCrudCacheEnabled()\n    ? resolveCrudCache(ctx.container)\n    : null\n  const cacheKey = cache && userId && cacheableOrganizationIds\n    ? buildUnreadCountCacheKey({\n        userId,\n        organizationId: scope.organizationId,\n        organizationIds: cacheableOrganizationIds,\n      })\n    : null\n\n  if (cache && cacheKey) {\n    try {\n      const cached = await runWithCacheTenant(scope.tenantId, () => cache.get(cacheKey))\n      if (typeof cached === 'number') {\n        return Response.json({ unreadCount: cached })\n      }\n    } catch {}\n  }\n\n  const count = await em.count(Notification, {\n    recipientUserId: userId,\n    tenantId: scope.tenantId,\n    status: 'unread',\n    ...buildNotificationReadScopeWhere(scope),\n  })\n\n  if (cache && cacheKey) {\n    try {\n      await runWithCacheTenant(scope.tenantId, () =>\n        cache.set(cacheKey, count, {\n          ttl: UNREAD_COUNT_TTL_MS,\n          tags: buildCollectionTags(\n            UNREAD_COUNT_RESOURCE,\n            scope.tenantId,\n            getNotificationReadScopeTagOrganizationIds(scope),\n          ),\n        }),\n      )\n    } catch {}\n  }\n\n  return Response.json({ unreadCount: count })\n}\n\nexport const openApi = {\n  GET: {\n    summary: 'Get unread notification count',\n    tags: ['Notifications'],\n    responses: {\n      200: {\n        description: 'Unread count',\n        content: {\n          'application/json': {\n            schema: unreadCountResponseSchema,\n          },\n        },\n      },\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,kBAAkB;AAE3B,SAAS,0BAA0B;AACnC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,oBAAoB;AAC7B,SAAS,iCAAiC;AAC1C,SAAS,kCAAkC;AAC3C;AAAA,EACE;AAAA,EACA;AAAA,OACK;AAEA,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,KAAK;AAC3B;AAEA,MAAM,wBAAwB;AAC9B,MAAM,sBAAsB;AAE5B,SAAS,yBAAyB,QAIvB;AACT,QAAM,gBAAgB,MAAM,KAAK,IAAI;AAAA,IACnC,OAAO,gBAAgB,OAAO,CAAC,UAAU,MAAM,KAAK,EAAE,SAAS,CAAC;AAAA,EAClE,CAAC,EAAE,KAAK,CAAC,MAAM,UAAU,KAAK,cAAc,KAAK,CAAC;AAClD,QAAM,WAAW,cAAc,WAAW,IACtC,cACA,GAAG,OAAO,kBAAkB,MAAM,UAAU,WAAW,QAAQ,EAC5D,OAAO,cAAc,KAAK,IAAI,CAAC,EAC/B,OAAO,KAAK,EACZ,MAAM,GAAG,EAAE,CAAC;AACnB,SAAO,gCAAgC,OAAO,MAAM,QAAQ,QAAQ;AACtE;AAEA,eAAsB,IAAI,KAAc;AACtC,QAAM,EAAE,OAAO,IAAI,IAAI,MAAM,2BAA2B,GAAG;AAC3D,QAAM,KAAK,IAAI,UAAU,QAAQ,IAAI;AAErC,QAAM,SAAS,MAAM;AACrB,QAAM,2BAA2B,MAAM,QAAQ,MAAM,eAAe,IAChE,MAAM,kBACN;AAIJ,QAAM,QAAQ,UAAU,4BAA4B,mBAAmB,IACnE,iBAAiB,IAAI,SAAS,IAC9B;AACJ,QAAM,WAAW,SAAS,UAAU,2BAChC,yBAAyB;AAAA,IACvB;AAAA,IACA,gBAAgB,MAAM;AAAA,IACtB,iBAAiB;AAAA,EACnB,CAAC,IACD;AAEJ,MAAI,SAAS,UAAU;AACrB,QAAI;AACF,YAAM,SAAS,MAAM,mBAAmB,MAAM,UAAU,MAAM,MAAM,IAAI,QAAQ,CAAC;AACjF,UAAI,OAAO,WAAW,UAAU;AAC9B,eAAO,SAAS,KAAK,EAAE,aAAa,OAAO,CAAC;AAAA,MAC9C;AAAA,IACF,QAAQ;AAAA,IAAC;AAAA,EACX;AAEA,QAAM,QAAQ,MAAM,GAAG,MAAM,cAAc;AAAA,IACzC,iBAAiB;AAAA,IACjB,UAAU,MAAM;AAAA,IAChB,QAAQ;AAAA,IACR,GAAG,gCAAgC,KAAK;AAAA,EAC1C,CAAC;AAED,MAAI,SAAS,UAAU;AACrB,QAAI;AACF,YAAM;AAAA,QAAmB,MAAM;AAAA,QAAU,MACvC,MAAM,IAAI,UAAU,OAAO;AAAA,UACzB,KAAK;AAAA,UACL,MAAM;AAAA,YACJ;AAAA,YACA,MAAM;AAAA,YACN,2CAA2C,KAAK;AAAA,UAClD;AAAA,QACF,CAAC;AAAA,MACH;AAAA,IACF,QAAQ;AAAA,IAAC;AAAA,EACX;AAEA,SAAO,SAAS,KAAK,EAAE,aAAa,MAAM,CAAC;AAC7C;AAEO,MAAM,UAAU;AAAA,EACrB,KAAK;AAAA,IACH,SAAS;AAAA,IACT,MAAM,CAAC,eAAe;AAAA,IACtB,WAAW;AAAA,MACT,KAAK;AAAA,QACH,aAAa;AAAA,QACb,SAAS;AAAA,UACP,oBAAoB;AAAA,YAClB,QAAQ;AAAA,UACV;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/notifications/di.js

@@ -3,7 +3,7 @@ import { createNotificationService } from "./lib/notificationService.js";
 function register(container) {
   container.register({
     notificationService: asFunction(
-      ({ em, eventBus, commandBus }) => createNotificationService({ em, eventBus, commandBus })
+      ({ em, eventBus, commandBus }) => createNotificationService({ em, eventBus, commandBus, container })
     ).scoped().proxy()
   });
 }

package/dist/modules/notifications/di.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../src/modules/notifications/di.ts"],
-  "sourcesContent": ["import type { AppContainer } from '@open-mercato/shared/lib/di/container'\nimport { asFunction } from 'awilix'\nimport { createNotificationService } from './lib/notificationService'\n\nexport function register(container: AppContainer): void {\n  container.register({\n    notificationService: asFunction(({ em, eventBus, commandBus }) =>\n      createNotificationService({ em, eventBus, commandBus })\n    ).scoped().proxy(),\n  })\n}\n"],
-  "mappings": "AACA,SAAS,kBAAkB;AAC3B,SAAS,iCAAiC;AAEnC,SAAS,SAAS,WAA+B;AACtD,YAAU,SAAS;AAAA,IACjB,qBAAqB;AAAA,MAAW,CAAC,EAAE,IAAI,UAAU,WAAW,MAC1D,0BAA0B,EAAE,IAAI,UAAU,WAAW,CAAC;AAAA,IACxD,EAAE,OAAO,EAAE,MAAM;AAAA,EACnB,CAAC;AACH;",
+  "sourcesContent": ["import type { AppContainer } from '@open-mercato/shared/lib/di/container'\nimport { asFunction } from 'awilix'\nimport { createNotificationService } from './lib/notificationService'\n\nexport function register(container: AppContainer): void {\n  container.register({\n    notificationService: asFunction(({ em, eventBus, commandBus }) =>\n      createNotificationService({ em, eventBus, commandBus, container })\n    ).scoped().proxy(),\n  })\n}\n"],
+  "mappings": "AACA,SAAS,kBAAkB;AAC3B,SAAS,iCAAiC;AAEnC,SAAS,SAAS,WAA+B;AACtD,YAAU,SAAS;AAAA,IACjB,qBAAqB;AAAA,MAAW,CAAC,EAAE,IAAI,UAAU,WAAW,MAC1D,0BAA0B,EAAE,IAAI,UAAU,YAAY,UAAU,CAAC;AAAA,IACnE,EAAE,OAAO,EAAE,MAAM;AAAA,EACnB,CAAC;AACH;",
   "names": []
 }

package/dist/modules/notifications/events.js

@@ -6,14 +6,16 @@ const events = [
     label: "Notification Created",
     entity: "notification",
     category: "system",
-    clientBroadcast: true
+    clientBroadcast: true,
+    portalBroadcast: true
   },
   {
     id: NOTIFICATION_SSE_EVENTS.BATCH_CREATED,
     label: "Notification Batch Created",
     entity: "notification",
     category: "system",
-    clientBroadcast: true
+    clientBroadcast: true,
+    portalBroadcast: true
   }
 ];
 const eventsConfig = createModuleEvents({

package/dist/modules/notifications/events.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../src/modules/notifications/events.ts"],
-  "sourcesContent": ["import { createModuleEvents } from '@open-mercato/shared/modules/events'\nimport { NOTIFICATION_SSE_EVENTS } from './lib/events'\n\nconst events = [\n  {\n    id: NOTIFICATION_SSE_EVENTS.CREATED,\n    label: 'Notification Created',\n    entity: 'notification',\n    category: 'system',\n    clientBroadcast: true,\n  },\n  {\n    id: NOTIFICATION_SSE_EVENTS.BATCH_CREATED,\n    label: 'Notification Batch Created',\n    entity: 'notification',\n    category: 'system',\n    clientBroadcast: true,\n  },\n] as const\n\nexport const eventsConfig = createModuleEvents({\n  moduleId: 'notifications',\n  events,\n})\n\nexport const emitNotificationEvent = eventsConfig.emit\n\nexport default eventsConfig\n"],
-  "mappings": "AAAA,SAAS,0BAA0B;AACnC,SAAS,+BAA+B;AAExC,MAAM,SAAS;AAAA,EACb;AAAA,IACE,IAAI,wBAAwB;AAAA,IAC5B,OAAO;AAAA,IACP,QAAQ;AAAA,IACR,UAAU;AAAA,IACV,iBAAiB;AAAA,EACnB;AAAA,EACA;AAAA,IACE,IAAI,wBAAwB;AAAA,IAC5B,OAAO;AAAA,IACP,QAAQ;AAAA,IACR,UAAU;AAAA,IACV,iBAAiB;AAAA,EACnB;AACF;AAEO,MAAM,eAAe,mBAAmB;AAAA,EAC7C,UAAU;AAAA,EACV;AACF,CAAC;AAEM,MAAM,wBAAwB,aAAa;AAElD,IAAO,iBAAQ;",
+  "sourcesContent": ["import { createModuleEvents } from '@open-mercato/shared/modules/events'\nimport { NOTIFICATION_SSE_EVENTS } from './lib/events'\n\nconst events = [\n  {\n    id: NOTIFICATION_SSE_EVENTS.CREATED,\n    label: 'Notification Created',\n    entity: 'notification',\n    category: 'system',\n    clientBroadcast: true,\n    portalBroadcast: true,\n  },\n  {\n    id: NOTIFICATION_SSE_EVENTS.BATCH_CREATED,\n    label: 'Notification Batch Created',\n    entity: 'notification',\n    category: 'system',\n    clientBroadcast: true,\n    portalBroadcast: true,\n  },\n] as const\n\nexport const eventsConfig = createModuleEvents({\n  moduleId: 'notifications',\n  events,\n})\n\nexport const emitNotificationEvent = eventsConfig.emit\n\nexport default eventsConfig\n"],
+  "mappings": "AAAA,SAAS,0BAA0B;AACnC,SAAS,+BAA+B;AAExC,MAAM,SAAS;AAAA,EACb;AAAA,IACE,IAAI,wBAAwB;AAAA,IAC5B,OAAO;AAAA,IACP,QAAQ;AAAA,IACR,UAAU;AAAA,IACV,iBAAiB;AAAA,IACjB,iBAAiB;AAAA,EACnB;AAAA,EACA;AAAA,IACE,IAAI,wBAAwB;AAAA,IAC5B,OAAO;AAAA,IACP,QAAQ;AAAA,IACR,UAAU;AAAA,IACV,iBAAiB;AAAA,IACjB,iBAAiB;AAAA,EACnB;AACF;AAEO,MAAM,eAAe,mBAAmB;AAAA,EAC7C,UAAU;AAAA,EACV;AACF,CAAC;AAEM,MAAM,wBAAwB,aAAa;AAElD,IAAO,iBAAQ;",
   "names": []
 }

package/dist/modules/notifications/lib/notificationRecipients.js

@@ -1,4 +1,4 @@
-import { hasFeature } from "@open-mercato/shared/security/features";
+import { authorizeFeatures } from "@open-mercato/shared/security/featurePolicy";
 function normalizeFeatures(features) {
   if (!Array.isArray(features)) return void 0;
   const normalized = features.filter((feature) => typeof feature === "string");
@@ -6,12 +6,11 @@ function normalizeFeatures(features) {
 }
 function collectUsersWithFeature(userIdsSet, rows, requiredFeature) {
   for (const row of rows) {
-    if (row.is_super_admin) {
-      userIdsSet.add(row.user_id);
-      continue;
-    }
-    const features = normalizeFeatures(row.features_json);
-    if (features && hasFeature(features, requiredFeature)) {
+    const features = normalizeFeatures(row.features_json) ?? [];
+    if (authorizeFeatures([requiredFeature], {
+      grantedFeatures: features,
+      unrestricted: row.is_super_admin
+    })) {
       userIdsSet.add(row.user_id);
     }
   }

package/dist/modules/notifications/lib/notificationRecipients.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/notifications/lib/notificationRecipients.ts"],
-  "sourcesContent": ["import type { Kysely } from 'kysely'\nimport { hasFeature } from '@open-mercato/shared/security/features'\n\ninterface AclRow {\n  user_id: string\n  features_json: unknown\n  is_super_admin: boolean\n}\n\nfunction normalizeFeatures(features: unknown): string[] | undefined {\n  if (!Array.isArray(features)) return undefined\n  const normalized = features.filter((feature): feature is string => typeof feature === 'string')\n  return normalized.length ? normalized : undefined\n}\n\n/**\n * Extract user IDs from ACL rows that have the required feature or are super admins.\n */\nfunction collectUsersWithFeature(\n  userIdsSet: Set<string>,\n  rows: AclRow[],\n  requiredFeature: string\n): void {\n  for (const row of rows) {\n    if (row.is_super_admin) {\n      userIdsSet.add(row.user_id)\n      continue\n    }\n\n    const features = normalizeFeatures(row.features_json)\n    if (features && hasFeature(features, requiredFeature)) {\n      userIdsSet.add(row.user_id)\n    }\n  }\n}\n\nexport async function getScopedNotificationRecipientUserIds(\n  db: Kysely<any>,\n  tenantId: string,\n  organizationId: string | null,\n  recipientUserIds: string[],\n): Promise<string[]> {\n  const builder: any = db\n  let query = builder\n    .selectFrom('users')\n    .where('users.id', 'in', recipientUserIds)\n    .where('users.deleted_at', 'is', null)\n    .where('users.tenant_id', '=', tenantId)\n\n  if (organizationId) {\n    query = query.where('users.organization_id', '=', organizationId)\n  }\n\n  const users = await query\n    .select('users.id as user_id')\n    .execute() as Array<{ user_id: string }>\n\n  return users.map((user) => user.user_id)\n}\n\nexport async function getRecipientUserIdsForRole(\n  db: Kysely<any>,\n  tenantId: string,\n  roleId: string\n): Promise<string[]> {\n  const builder: any = db\n  const userRoles = await builder\n    .selectFrom('user_roles')\n    .innerJoin('users', 'user_roles.user_id', 'users.id')\n    .where('user_roles.role_id', '=', roleId)\n    .where('user_roles.deleted_at', 'is', null)\n    .where('users.deleted_at', 'is', null)\n    .where('users.tenant_id', '=', tenantId)\n    .select('users.id as user_id')\n    .execute() as Array<{ user_id: string }>\n\n  return userRoles.map((row) => row.user_id)\n}\n\nexport async function getRecipientUserIdsForFeature(\n  db: Kysely<any>,\n  tenantId: string,\n  requiredFeature: string\n): Promise<string[]> {\n  const userIdsSet = new Set<string>()\n  const builder: any = db\n\n  const userAcls = await builder\n    .selectFrom('user_acls')\n    .innerJoin('users', 'user_acls.user_id', 'users.id')\n    .where('user_acls.tenant_id', '=', tenantId)\n    .where('user_acls.deleted_at', 'is', null)\n    .where('users.deleted_at', 'is', null)\n    .where('users.tenant_id', '=', tenantId)\n    .select([\n      'users.id as user_id',\n      'user_acls.features_json',\n      'user_acls.is_super_admin',\n    ])\n    .execute() as AclRow[]\n\n  collectUsersWithFeature(userIdsSet, userAcls, requiredFeature)\n\n  const roleAcls = await builder\n    .selectFrom('role_acls')\n    .innerJoin('user_roles', 'role_acls.role_id', 'user_roles.role_id')\n    .innerJoin('users', 'user_roles.user_id', 'users.id')\n    .where('role_acls.tenant_id', '=', tenantId)\n    .where('role_acls.deleted_at', 'is', null)\n    .where('user_roles.deleted_at', 'is', null)\n    .where('users.deleted_at', 'is', null)\n    .where('users.tenant_id', '=', tenantId)\n    .select([\n      'users.id as user_id',\n      'role_acls.features_json',\n      'role_acls.is_super_admin',\n    ])\n    .execute() as AclRow[]\n\n  collectUsersWithFeature(userIdsSet, roleAcls, requiredFeature)\n\n  return Array.from(userIdsSet)\n}\n"],
-  "mappings": "AACA,SAAS,kBAAkB;AAQ3B,SAAS,kBAAkB,UAAyC;AAClE,MAAI,CAAC,MAAM,QAAQ,QAAQ,EAAG,QAAO;AACrC,QAAM,aAAa,SAAS,OAAO,CAAC,YAA+B,OAAO,YAAY,QAAQ;AAC9F,SAAO,WAAW,SAAS,aAAa;AAC1C;AAKA,SAAS,wBACP,YACA,MACA,iBACM;AACN,aAAW,OAAO,MAAM;AACtB,QAAI,IAAI,gBAAgB;AACtB,iBAAW,IAAI,IAAI,OAAO;AAC1B;AAAA,IACF;AAEA,UAAM,WAAW,kBAAkB,IAAI,aAAa;AACpD,QAAI,YAAY,WAAW,UAAU,eAAe,GAAG;AACrD,iBAAW,IAAI,IAAI,OAAO;AAAA,IAC5B;AAAA,EACF;AACF;AAEA,eAAsB,sCACpB,IACA,UACA,gBACA,kBACmB;AACnB,QAAM,UAAe;AACrB,MAAI,QAAQ,QACT,WAAW,OAAO,EAClB,MAAM,YAAY,MAAM,gBAAgB,EACxC,MAAM,oBAAoB,MAAM,IAAI,EACpC,MAAM,mBAAmB,KAAK,QAAQ;AAEzC,MAAI,gBAAgB;AAClB,YAAQ,MAAM,MAAM,yBAAyB,KAAK,cAAc;AAAA,EAClE;AAEA,QAAM,QAAQ,MAAM,MACjB,OAAO,qBAAqB,EAC5B,QAAQ;AAEX,SAAO,MAAM,IAAI,CAAC,SAAS,KAAK,OAAO;AACzC;AAEA,eAAsB,2BACpB,IACA,UACA,QACmB;AACnB,QAAM,UAAe;AACrB,QAAM,YAAY,MAAM,QACrB,WAAW,YAAY,EACvB,UAAU,SAAS,sBAAsB,UAAU,EACnD,MAAM,sBAAsB,KAAK,MAAM,EACvC,MAAM,yBAAyB,MAAM,IAAI,EACzC,MAAM,oBAAoB,MAAM,IAAI,EACpC,MAAM,mBAAmB,KAAK,QAAQ,EACtC,OAAO,qBAAqB,EAC5B,QAAQ;AAEX,SAAO,UAAU,IAAI,CAAC,QAAQ,IAAI,OAAO;AAC3C;AAEA,eAAsB,8BACpB,IACA,UACA,iBACmB;AACnB,QAAM,aAAa,oBAAI,IAAY;AACnC,QAAM,UAAe;AAErB,QAAM,WAAW,MAAM,QACpB,WAAW,WAAW,EACtB,UAAU,SAAS,qBAAqB,UAAU,EAClD,MAAM,uBAAuB,KAAK,QAAQ,EAC1C,MAAM,wBAAwB,MAAM,IAAI,EACxC,MAAM,oBAAoB,MAAM,IAAI,EACpC,MAAM,mBAAmB,KAAK,QAAQ,EACtC,OAAO;AAAA,IACN;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC,EACA,QAAQ;AAEX,0BAAwB,YAAY,UAAU,eAAe;AAE7D,QAAM,WAAW,MAAM,QACpB,WAAW,WAAW,EACtB,UAAU,cAAc,qBAAqB,oBAAoB,EACjE,UAAU,SAAS,sBAAsB,UAAU,EACnD,MAAM,uBAAuB,KAAK,QAAQ,EAC1C,MAAM,wBAAwB,MAAM,IAAI,EACxC,MAAM,yBAAyB,MAAM,IAAI,EACzC,MAAM,oBAAoB,MAAM,IAAI,EACpC,MAAM,mBAAmB,KAAK,QAAQ,EACtC,OAAO;AAAA,IACN;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC,EACA,QAAQ;AAEX,0BAAwB,YAAY,UAAU,eAAe;AAE7D,SAAO,MAAM,KAAK,UAAU;AAC9B;",
+  "sourcesContent": ["import type { Kysely } from 'kysely'\nimport { authorizeFeatures } from '@open-mercato/shared/security/featurePolicy'\n\ninterface AclRow {\n  user_id: string\n  features_json: unknown\n  is_super_admin: boolean\n}\n\nfunction normalizeFeatures(features: unknown): string[] | undefined {\n  if (!Array.isArray(features)) return undefined\n  const normalized = features.filter((feature): feature is string => typeof feature === 'string')\n  return normalized.length ? normalized : undefined\n}\n\n/**\n * Extract user IDs from ACL rows that have the required feature or are super admins.\n */\nfunction collectUsersWithFeature(\n  userIdsSet: Set<string>,\n  rows: AclRow[],\n  requiredFeature: string\n): void {\n  for (const row of rows) {\n    const features = normalizeFeatures(row.features_json) ?? []\n    if (authorizeFeatures([requiredFeature], {\n      grantedFeatures: features,\n      unrestricted: row.is_super_admin,\n    })) {\n      userIdsSet.add(row.user_id)\n    }\n  }\n}\n\nexport async function getScopedNotificationRecipientUserIds(\n  db: Kysely<any>,\n  tenantId: string,\n  organizationId: string | null,\n  recipientUserIds: string[],\n): Promise<string[]> {\n  const builder: any = db\n  let query = builder\n    .selectFrom('users')\n    .where('users.id', 'in', recipientUserIds)\n    .where('users.deleted_at', 'is', null)\n    .where('users.tenant_id', '=', tenantId)\n\n  if (organizationId) {\n    query = query.where('users.organization_id', '=', organizationId)\n  }\n\n  const users = await query\n    .select('users.id as user_id')\n    .execute() as Array<{ user_id: string }>\n\n  return users.map((user) => user.user_id)\n}\n\nexport async function getRecipientUserIdsForRole(\n  db: Kysely<any>,\n  tenantId: string,\n  roleId: string\n): Promise<string[]> {\n  const builder: any = db\n  const userRoles = await builder\n    .selectFrom('user_roles')\n    .innerJoin('users', 'user_roles.user_id', 'users.id')\n    .where('user_roles.role_id', '=', roleId)\n    .where('user_roles.deleted_at', 'is', null)\n    .where('users.deleted_at', 'is', null)\n    .where('users.tenant_id', '=', tenantId)\n    .select('users.id as user_id')\n    .execute() as Array<{ user_id: string }>\n\n  return userRoles.map((row) => row.user_id)\n}\n\nexport async function getRecipientUserIdsForFeature(\n  db: Kysely<any>,\n  tenantId: string,\n  requiredFeature: string\n): Promise<string[]> {\n  const userIdsSet = new Set<string>()\n  const builder: any = db\n\n  const userAcls = await builder\n    .selectFrom('user_acls')\n    .innerJoin('users', 'user_acls.user_id', 'users.id')\n    .where('user_acls.tenant_id', '=', tenantId)\n    .where('user_acls.deleted_at', 'is', null)\n    .where('users.deleted_at', 'is', null)\n    .where('users.tenant_id', '=', tenantId)\n    .select([\n      'users.id as user_id',\n      'user_acls.features_json',\n      'user_acls.is_super_admin',\n    ])\n    .execute() as AclRow[]\n\n  collectUsersWithFeature(userIdsSet, userAcls, requiredFeature)\n\n  const roleAcls = await builder\n    .selectFrom('role_acls')\n    .innerJoin('user_roles', 'role_acls.role_id', 'user_roles.role_id')\n    .innerJoin('users', 'user_roles.user_id', 'users.id')\n    .where('role_acls.tenant_id', '=', tenantId)\n    .where('role_acls.deleted_at', 'is', null)\n    .where('user_roles.deleted_at', 'is', null)\n    .where('users.deleted_at', 'is', null)\n    .where('users.tenant_id', '=', tenantId)\n    .select([\n      'users.id as user_id',\n      'role_acls.features_json',\n      'role_acls.is_super_admin',\n    ])\n    .execute() as AclRow[]\n\n  collectUsersWithFeature(userIdsSet, roleAcls, requiredFeature)\n\n  return Array.from(userIdsSet)\n}\n"],
+  "mappings": "AACA,SAAS,yBAAyB;AAQlC,SAAS,kBAAkB,UAAyC;AAClE,MAAI,CAAC,MAAM,QAAQ,QAAQ,EAAG,QAAO;AACrC,QAAM,aAAa,SAAS,OAAO,CAAC,YAA+B,OAAO,YAAY,QAAQ;AAC9F,SAAO,WAAW,SAAS,aAAa;AAC1C;AAKA,SAAS,wBACP,YACA,MACA,iBACM;AACN,aAAW,OAAO,MAAM;AACtB,UAAM,WAAW,kBAAkB,IAAI,aAAa,KAAK,CAAC;AAC1D,QAAI,kBAAkB,CAAC,eAAe,GAAG;AAAA,MACvC,iBAAiB;AAAA,MACjB,cAAc,IAAI;AAAA,IACpB,CAAC,GAAG;AACF,iBAAW,IAAI,IAAI,OAAO;AAAA,IAC5B;AAAA,EACF;AACF;AAEA,eAAsB,sCACpB,IACA,UACA,gBACA,kBACmB;AACnB,QAAM,UAAe;AACrB,MAAI,QAAQ,QACT,WAAW,OAAO,EAClB,MAAM,YAAY,MAAM,gBAAgB,EACxC,MAAM,oBAAoB,MAAM,IAAI,EACpC,MAAM,mBAAmB,KAAK,QAAQ;AAEzC,MAAI,gBAAgB;AAClB,YAAQ,MAAM,MAAM,yBAAyB,KAAK,cAAc;AAAA,EAClE;AAEA,QAAM,QAAQ,MAAM,MACjB,OAAO,qBAAqB,EAC5B,QAAQ;AAEX,SAAO,MAAM,IAAI,CAAC,SAAS,KAAK,OAAO;AACzC;AAEA,eAAsB,2BACpB,IACA,UACA,QACmB;AACnB,QAAM,UAAe;AACrB,QAAM,YAAY,MAAM,QACrB,WAAW,YAAY,EACvB,UAAU,SAAS,sBAAsB,UAAU,EACnD,MAAM,sBAAsB,KAAK,MAAM,EACvC,MAAM,yBAAyB,MAAM,IAAI,EACzC,MAAM,oBAAoB,MAAM,IAAI,EACpC,MAAM,mBAAmB,KAAK,QAAQ,EACtC,OAAO,qBAAqB,EAC5B,QAAQ;AAEX,SAAO,UAAU,IAAI,CAAC,QAAQ,IAAI,OAAO;AAC3C;AAEA,eAAsB,8BACpB,IACA,UACA,iBACmB;AACnB,QAAM,aAAa,oBAAI,IAAY;AACnC,QAAM,UAAe;AAErB,QAAM,WAAW,MAAM,QACpB,WAAW,WAAW,EACtB,UAAU,SAAS,qBAAqB,UAAU,EAClD,MAAM,uBAAuB,KAAK,QAAQ,EAC1C,MAAM,wBAAwB,MAAM,IAAI,EACxC,MAAM,oBAAoB,MAAM,IAAI,EACpC,MAAM,mBAAmB,KAAK,QAAQ,EACtC,OAAO;AAAA,IACN;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC,EACA,QAAQ;AAEX,0BAAwB,YAAY,UAAU,eAAe;AAE7D,QAAM,WAAW,MAAM,QACpB,WAAW,WAAW,EACtB,UAAU,cAAc,qBAAqB,oBAAoB,EACjE,UAAU,SAAS,sBAAsB,UAAU,EACnD,MAAM,uBAAuB,KAAK,QAAQ,EAC1C,MAAM,wBAAwB,MAAM,IAAI,EACxC,MAAM,yBAAyB,MAAM,IAAI,EACzC,MAAM,oBAAoB,MAAM,IAAI,EACpC,MAAM,mBAAmB,KAAK,QAAQ,EACtC,OAAO;AAAA,IACN;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC,EACA,QAAQ;AAEX,0BAAwB,YAAY,UAAU,eAAe;AAE7D,SAAO,MAAM,KAAK,UAAU;AAC9B;",
   "names": []
 }

package/dist/modules/notifications/lib/notificationScope.js

@@ -0,0 +1,26 @@
+function resolveOrganizationIds(scope) {
+  if (scope.organizationIds === null) return null;
+  if (scope.organizationIds === void 0) return null;
+  const candidates = scope.organizationIds;
+  return Array.from(new Set(candidates.filter((value) => value.trim().length > 0)));
+}
+function buildNotificationReadScopeWhere(scope) {
+  const organizationIds = resolveOrganizationIds(scope);
+  if (organizationIds === null) return {};
+  if (organizationIds.length === 0) return { organizationId: null };
+  return {
+    $or: [
+      { organizationId: { $in: organizationIds } },
+      { organizationId: null }
+    ]
+  };
+}
+function getNotificationReadScopeTagOrganizationIds(scope) {
+  const organizationIds = resolveOrganizationIds(scope);
+  return organizationIds === null ? [null] : [...organizationIds, null];
+}
+export {
+  buildNotificationReadScopeWhere,
+  getNotificationReadScopeTagOrganizationIds
+};
+//# sourceMappingURL=notificationScope.js.map

package/dist/modules/notifications/lib/notificationScope.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/notifications/lib/notificationScope.ts"],
+  "sourcesContent": ["export type NotificationReadOrganizationScope = {\n  organizationId?: string | null\n  organizationIds?: string[] | null\n}\n\ntype NotificationReadScopeWhere = {\n  organizationId?: null\n  $or?: Array<\n    | { organizationId: { $in: string[] } }\n    | { organizationId: null }\n  >\n}\n\nfunction resolveOrganizationIds(scope: NotificationReadOrganizationScope): string[] | null {\n  if (scope.organizationIds === null) return null\n  if (scope.organizationIds === undefined) return null\n  const candidates = scope.organizationIds\n  return Array.from(new Set(candidates.filter((value) => value.trim().length > 0)))\n}\n\nexport function buildNotificationReadScopeWhere(\n  scope: NotificationReadOrganizationScope,\n): NotificationReadScopeWhere {\n  const organizationIds = resolveOrganizationIds(scope)\n  if (organizationIds === null) return {}\n  if (organizationIds.length === 0) return { organizationId: null }\n  return {\n    $or: [\n      { organizationId: { $in: organizationIds } },\n      { organizationId: null },\n    ],\n  }\n}\n\nexport function getNotificationReadScopeTagOrganizationIds(\n  scope: NotificationReadOrganizationScope,\n): Array<string | null> {\n  const organizationIds = resolveOrganizationIds(scope)\n  return organizationIds === null ? [null] : [...organizationIds, null]\n}\n"],
+  "mappings": "AAaA,SAAS,uBAAuB,OAA2D;AACzF,MAAI,MAAM,oBAAoB,KAAM,QAAO;AAC3C,MAAI,MAAM,oBAAoB,OAAW,QAAO;AAChD,QAAM,aAAa,MAAM;AACzB,SAAO,MAAM,KAAK,IAAI,IAAI,WAAW,OAAO,CAAC,UAAU,MAAM,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC;AAClF;AAEO,SAAS,gCACd,OAC4B;AAC5B,QAAM,kBAAkB,uBAAuB,KAAK;AACpD,MAAI,oBAAoB,KAAM,QAAO,CAAC;AACtC,MAAI,gBAAgB,WAAW,EAAG,QAAO,EAAE,gBAAgB,KAAK;AAChE,SAAO;AAAA,IACL,KAAK;AAAA,MACH,EAAE,gBAAgB,EAAE,KAAK,gBAAgB,EAAE;AAAA,MAC3C,EAAE,gBAAgB,KAAK;AAAA,IACzB;AAAA,EACF;AACF;AAEO,SAAS,2CACd,OACsB;AACtB,QAAM,kBAAkB,uBAAuB,KAAK;AACpD,SAAO,oBAAoB,OAAO,CAAC,IAAI,IAAI,CAAC,GAAG,iBAAiB,IAAI;AACtE;",
+  "names": []
+}