@open-mercato/core 0.6.8-develop.6983.1.e4f794099e → 0.6.8-develop.6985.1.fb93574faa

package/dist/modules/push_notifications/lib/push-fanout.js

@@ -0,0 +1,138 @@
+import { sql } from "kysely";
+import { findWithDecryption } from "@open-mercato/shared/lib/encryption/find";
+import { defaultLocale } from "@open-mercato/shared/lib/i18n/config";
+import { resolveSupportedLocale } from "@open-mercato/shared/lib/i18n/locale";
+import { createLogger } from "@open-mercato/shared/lib/logger";
+import {
+  resolveNotificationCopy
+} from "@open-mercato/core/modules/notifications/lib/notificationCopy";
+import { enqueuePushDelivery } from "./queue.js";
+const logger = createLogger("push_notifications");
+const PUSH_CHANNEL = "push";
+function tokenSnapshot(token) {
+  return token.slice(-8);
+}
+async function fanOutPushDeliveries(args) {
+  const { em, resolve, scope, userId, userDeviceId, notificationId, notificationTypeId, payload, copy } = args;
+  const { tenantId, organizationId } = scope;
+  const silent = payload.silent === true;
+  const ChannelRef = resolve("CommunicationChannel");
+  const channels = await em.find(
+    ChannelRef,
+    {
+      tenantId,
+      channelType: PUSH_CHANNEL,
+      isActive: true,
+      deletedAt: null
+    },
+    { orderBy: { createdAt: "asc" } }
+  );
+  if (channels.length === 0) return { enqueued: 0 };
+  const channelsByProvider = /* @__PURE__ */ new Map();
+  for (const channel of channels) {
+    if (!channelsByProvider.has(channel.providerKey)) channelsByProvider.set(channel.providerKey, channel);
+  }
+  const DeviceRef = resolve("UserDevice");
+  const devices = await findWithDecryption(
+    em,
+    DeviceRef,
+    {
+      tenantId,
+      organizationId,
+      userId,
+      // Optionally restrict to a single device; still scoped to this user so a foreign id matches none.
+      ...userDeviceId ? { id: userDeviceId } : {},
+      deletedAt: null,
+      pushToken: { $ne: null }
+    },
+    void 0,
+    { tenantId, organizationId }
+  );
+  if (devices.length === 0) return { enqueued: 0 };
+  const localizedByLocale = /* @__PURE__ */ new Map();
+  function resolveLocalizedPayload(deviceLocale) {
+    if (!copy) return Promise.resolve(payload);
+    const locale = resolveSupportedLocale(deviceLocale) ?? defaultLocale;
+    let cached = localizedByLocale.get(locale);
+    if (!cached) {
+      cached = (async () => {
+        if (locale === defaultLocale) {
+          return { ...payload, title: copy.title, body: copy.body ?? null };
+        }
+        const { title, body } = await resolveNotificationCopy(copy, locale);
+        return { ...payload, title, body };
+      })();
+      localizedByLocale.set(locale, cached);
+    }
+    return cached;
+  }
+  const builtRows = await Promise.all(
+    devices.map(async (device) => {
+      const providerKey = device.pushProvider;
+      if (!providerKey) return null;
+      const channel = channelsByProvider.get(providerKey);
+      if (!channel) return null;
+      const rowPayload = await resolveLocalizedPayload(device.locale);
+      return {
+        tenant_id: tenantId,
+        organization_id: organizationId,
+        notification_id: notificationId,
+        notification_type_id: notificationTypeId,
+        user_device_id: device.id,
+        user_id: userId,
+        provider: channel.providerKey,
+        token_snapshot: tokenSnapshot(device.pushToken),
+        silent,
+        status: "pending",
+        attempts: 0,
+        payload: sql`${JSON.stringify(rowPayload)}::jsonb`,
+        created_at: sql`now()`,
+        updated_at: sql`now()`
+      };
+    })
+  );
+  const rows = builtRows.filter((row) => row !== null);
+  const skippedNoChannel = devices.length - rows.length;
+  if (skippedNoChannel > 0) {
+    logger.warn("Skipped devices with no matching push channel", {
+      tenantId,
+      userId,
+      notificationId,
+      skipped: skippedNoChannel
+    });
+  }
+  if (rows.length === 0) return { enqueued: 0 };
+  const db = em.getKysely();
+  const inserted = await db.insertInto("push_notification_deliveries").values(rows).onConflict(
+    (oc) => oc.columns(["notification_id", "user_device_id"]).where("notification_id", "is not", null).doNothing()
+  ).returning(["id"]).execute();
+  const outcomes = await Promise.allSettled(
+    inserted.map((row) => enqueuePushDelivery({ deliveryId: row.id, tenantId, organizationId }))
+  );
+  const failedIdsByReason = /* @__PURE__ */ new Map();
+  let enqueued = 0;
+  outcomes.forEach((outcome, index) => {
+    if (outcome.status === "fulfilled") {
+      enqueued += 1;
+      return;
+    }
+    const error = outcome.reason;
+    const reason = error instanceof Error ? `enqueue_failed: ${error.message}` : "enqueue_failed";
+    const ids = failedIdsByReason.get(reason) ?? [];
+    ids.push(inserted[index].id);
+    failedIdsByReason.set(reason, ids);
+  });
+  if (failedIdsByReason.size > 0) {
+    await Promise.allSettled(
+      Array.from(failedIdsByReason.entries()).map(
+        ([reason, ids]) => db.updateTable("push_notification_deliveries").set({ status: "failed", last_error: reason, updated_at: sql`now()` }).where("id", "in", ids).where("status", "=", "pending").execute()
+      )
+    );
+  }
+  return { enqueued };
+}
+export {
+  PUSH_CHANNEL,
+  fanOutPushDeliveries
+};
+//# sourceMappingURL=push-fanout.js.map

package/dist/modules/push_notifications/lib/push-fanout.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/push_notifications/lib/push-fanout.ts"],
+  "sourcesContent": ["import type { EntityManager } from '@mikro-orm/postgresql'\nimport type { EntityName } from '@mikro-orm/core'\nimport { sql } from 'kysely'\nimport { findWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport type { PushOptions } from '@open-mercato/core/modules/communication_channels/lib/push-envelope'\nimport type { UserDevice } from '@open-mercato/core/modules/devices/data/entities'\nimport type { CommunicationChannel } from '@open-mercato/core/modules/communication_channels/data/entities'\nimport { defaultLocale } from '@open-mercato/shared/lib/i18n/config'\nimport { resolveSupportedLocale } from '@open-mercato/shared/lib/i18n/locale'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport {\n  resolveNotificationCopy,\n  type NotificationCopySource,\n} from '@open-mercato/core/modules/notifications/lib/notificationCopy'\nimport { enqueuePushDelivery } from './queue'\n\nconst logger = createLogger('push_notifications')\n\nexport const PUSH_CHANNEL = 'push'\n\ntype Resolve = <T = unknown>(name: string) => T\n\n/** The push payload persisted on each delivery row and unpacked by the worker into the send envelope. */\nexport interface PushFanoutPayload {\n  title?: string\n  body?: string | null\n  data: Record<string, string>\n  options?: PushOptions\n  silent?: boolean\n}\n\nexport interface FanOutPushDeliveriesArgs {\n  em: EntityManager\n  resolve: Resolve\n  scope: { tenantId: string; organizationId: string | null }\n  userId: string\n  /**\n   * Restrict the fan-out to a single one of the user's devices (`UserDevice.id`). Still scoped to the\n   * same (tenant, org, user), so an id that isn't the user's own matches nothing. Omit to fan out to\n   * all of the user's push-capable devices (the default).\n   */\n  userDeviceId?: string\n  /** Source in-app notification id, or `null` for a silent push (no Notification row). */\n  notificationId: string | null\n  notificationTypeId: string\n  payload: PushFanoutPayload\n  /**\n   * Per-device localizable copy for visible notifications. When present, `title`/`body` are\n   * resolved per device using its `locale`. Omit for silent pushes (no user-facing copy).\n   */\n  copy?: NotificationCopySource\n}\n\nfunction tokenSnapshot(token: string): string {\n  // Persist at most the last 8 chars of the (long) provider token \u2014 never the full secret.\n  return token.slice(-8)\n}\n\n/**\n * Resolve a recipient's push-capable devices, route each to its provider's tenant push\n * `CommunicationChannel`, persist one `pending` push delivery row per device, and enqueue a send\n * job per row. Shared by the `push` delivery strategy (visible + silent notifications) and\n * `sendCustomPush` (admin one-off pushes); it is preference-agnostic \u2014 the caller decides whether\n * to consult per-channel preferences before fanning out.\n *\n * Cross-module entities are resolved via DI tokens (registered `asValue` by their owning modules)\n * so this stays decoupled from those modules' internals. Returns the number of jobs enqueued.\n */\nexport async function fanOutPushDeliveries(args: FanOutPushDeliveriesArgs): Promise<{ enqueued: number }> {\n  const { em, resolve, scope, userId, userDeviceId, notificationId, notificationTypeId, payload, copy } = args\n  const { tenantId, organizationId } = scope\n  const silent = payload.silent === true\n\n  // Require at least one active push CommunicationChannel for the tenant (push not configured \u21D2 skip).\n  // This is the cheapest, most selective short-circuit (most tenants have no push channel), so it runs\n  // before the per-recipient device lookup. Channels are indexed by providerKey so each device can be\n  // routed to its matching provider below (ios\u2192apns, android\u2192fcm, expo\u2192expo). Oldest-first so that when\n  // a tenant has more than one active channel for the same provider, the pick is deterministic.\n  const ChannelRef = resolve('CommunicationChannel') as EntityName<CommunicationChannel>\n  const channels = await em.find(\n    ChannelRef,\n    {\n      tenantId,\n      channelType: PUSH_CHANNEL,\n      isActive: true,\n      deletedAt: null,\n    },\n    { orderBy: { createdAt: 'asc' } },\n  )\n  if (channels.length === 0) return { enqueued: 0 }\n  const channelsByProvider = new Map<string, CommunicationChannel>()\n  for (const channel of channels) {\n    if (!channelsByProvider.has(channel.providerKey)) channelsByProvider.set(channel.providerKey, channel)\n  }\n\n  // Load the recipient's devices that can receive push (active + has a token). Scoped to the\n  // notification's organization so an org-scoped notification never fans out to a device the user\n  // registered under a different org \u2014 device identity is per (tenant, org, user, device) (see devices\n  // module). A tenant-level (null-org) notification targets the user's tenant-level (null-org) devices.\n  // `push_token` is encrypted at rest; decrypt on read (no-op when encryption is disabled).\n  const DeviceRef = resolve('UserDevice') as EntityName<UserDevice>\n  const devices = await findWithDecryption(\n    em,\n    DeviceRef,\n    {\n      tenantId,\n      organizationId,\n      userId,\n      // Optionally restrict to a single device; still scoped to this user so a foreign id matches none.\n      ...(userDeviceId ? { id: userDeviceId } : {}),\n      deletedAt: null,\n      pushToken: { $ne: null },\n    },\n    undefined,\n    { tenantId, organizationId },\n  )\n  if (devices.length === 0) return { enqueued: 0 }\n\n  // Resolve the per-device localized copy. The default-locale case (the common one: device has no\n  // locale, an unsupported one, or already speaks the default) reuses the copy already resolved\n  // upstream \u2014 no dictionary load. Other locales translate via the shared notification-copy helper\n  // (dictionaries are memoized by loadDictionary). Silent pushes carry no copy and skip this.\n  // Memoized by resolved locale so a user with many same-locale devices derives copy once\n  // (O(distinct locales) instead of O(devices)).\n  const localizedByLocale = new Map<string, Promise<PushFanoutPayload>>()\n  function resolveLocalizedPayload(deviceLocale?: string | null): Promise<PushFanoutPayload> {\n    if (!copy) return Promise.resolve(payload)\n    const locale = resolveSupportedLocale(deviceLocale) ?? defaultLocale\n    let cached = localizedByLocale.get(locale)\n    if (!cached) {\n      cached = (async () => {\n        if (locale === defaultLocale) {\n          return { ...payload, title: copy.title, body: copy.body ?? null }\n        }\n        const { title, body } = await resolveNotificationCopy(copy, locale)\n        return { ...payload, title, body }\n      })()\n      localizedByLocale.set(locale, cached)\n    }\n    return cached\n  }\n\n  // Insert one pending delivery row per device, routing each device to the push channel whose\n  // providerKey matches the device's pushProvider. Devices with no provider, or no matching configured\n  // channel, are skipped. Insert via INSERT ... ON CONFLICT DO NOTHING on the (notification_id,\n  // user_device_id) partial unique index: the `push` strategy runs inside the at-least-once persistent\n  // `notifications:deliver` subscriber, so a redelivered event re-runs it \u2014 the conflict clause makes\n  // the re-fan-out a no-op instead of inserting a duplicate set of rows (and duplicate pushes). Silent\n  // pushes carry a null notification_id and are excluded from the partial index (they are triggered\n  // explicitly, not via at-least-once redelivery). Only the rows actually inserted are enqueued.\n  const builtRows = await Promise.all(\n    devices.map(async (device) => {\n      const providerKey = device.pushProvider\n      if (!providerKey) return null\n      const channel = channelsByProvider.get(providerKey)\n      if (!channel) return null\n      const rowPayload = await resolveLocalizedPayload(device.locale)\n      return {\n        tenant_id: tenantId,\n        organization_id: organizationId,\n        notification_id: notificationId,\n        notification_type_id: notificationTypeId,\n        user_device_id: device.id,\n        user_id: userId,\n        provider: channel.providerKey,\n        token_snapshot: tokenSnapshot(device.pushToken as string),\n        silent,\n        status: 'pending',\n        attempts: 0,\n        payload: sql`${JSON.stringify(rowPayload)}::jsonb`,\n        created_at: sql`now()`,\n        updated_at: sql`now()`,\n      }\n    }),\n  )\n  const rows = builtRows.filter((row): row is NonNullable<typeof row> => row !== null)\n  // A registered device whose pushProvider has no matching active channel (e.g. an Expo device on an\n  // FCM-only tenant) is correctly skipped above \u2014 but it produces no delivery row and would otherwise\n  // be an invisible no-op. Surface a count so a provider-config gap is diagnosable.\n  const skippedNoChannel = devices.length - rows.length\n  if (skippedNoChannel > 0) {\n    logger.warn('Skipped devices with no matching push channel', {\n      tenantId,\n      userId,\n      notificationId,\n      skipped: skippedNoChannel,\n    })\n  }\n  if (rows.length === 0) return { enqueued: 0 }\n\n  const db = em.getKysely<any>()\n  const inserted = (await db\n    .insertInto('push_notification_deliveries')\n    .values(rows)\n    .onConflict((oc: any) =>\n      oc.columns(['notification_id', 'user_device_id']).where('notification_id', 'is not', null).doNothing(),\n    )\n    .returning(['id'])\n    .execute()) as Array<{ id: string }>\n\n  // Enqueue one send job per inserted row (per-device retry isolation, idempotent on delivery id).\n  // Enqueue all rows concurrently \u2014 the jobs are independent, so there is no reason to serialize the\n  // queue round-trips. If an enqueue fails, mark that row failed instead of leaving it orphaned in\n  // `pending` forever (the worker only ever processes rows it receives a job for). Failed rows are\n  // grouped by reason and marked in one UPDATE per reason to keep DB round-trips minimal.\n  const outcomes = await Promise.allSettled(\n    inserted.map((row) => enqueuePushDelivery({ deliveryId: row.id, tenantId, organizationId })),\n  )\n  const failedIdsByReason = new Map<string, string[]>()\n  let enqueued = 0\n  outcomes.forEach((outcome, index) => {\n    if (outcome.status === 'fulfilled') {\n      enqueued += 1\n      return\n    }\n    const error = outcome.reason\n    const reason = error instanceof Error ? `enqueue_failed: ${error.message}` : 'enqueue_failed'\n    const ids = failedIdsByReason.get(reason) ?? []\n    ids.push(inserted[index].id)\n    failedIdsByReason.set(reason, ids)\n  })\n  if (failedIdsByReason.size > 0) {\n    await Promise.allSettled(\n      Array.from(failedIdsByReason.entries()).map(([reason, ids]) =>\n        db\n          .updateTable('push_notification_deliveries')\n          .set({ status: 'failed', last_error: reason, updated_at: sql`now()` })\n          .where('id', 'in', ids)\n          // Guard on `pending`: if the enqueue reported failure yet the job actually landed and a\n          // worker already claimed/finished the row, don't clobber its later status back to `failed`.\n          .where('status', '=', 'pending')\n          .execute(),\n      ),\n    )\n  }\n  return { enqueued }\n}\n"],
+  "mappings": "AAEA,SAAS,WAAW;AACpB,SAAS,0BAA0B;AAInC,SAAS,qBAAqB;AAC9B,SAAS,8BAA8B;AACvC,SAAS,oBAAoB;AAC7B;AAAA,EACE;AAAA,OAEK;AACP,SAAS,2BAA2B;AAEpC,MAAM,SAAS,aAAa,oBAAoB;AAEzC,MAAM,eAAe;AAmC5B,SAAS,cAAc,OAAuB;AAE5C,SAAO,MAAM,MAAM,EAAE;AACvB;AAYA,eAAsB,qBAAqB,MAA+D;AACxG,QAAM,EAAE,IAAI,SAAS,OAAO,QAAQ,cAAc,gBAAgB,oBAAoB,SAAS,KAAK,IAAI;AACxG,QAAM,EAAE,UAAU,eAAe,IAAI;AACrC,QAAM,SAAS,QAAQ,WAAW;AAOlC,QAAM,aAAa,QAAQ,sBAAsB;AACjD,QAAM,WAAW,MAAM,GAAG;AAAA,IACxB;AAAA,IACA;AAAA,MACE;AAAA,MACA,aAAa;AAAA,MACb,UAAU;AAAA,MACV,WAAW;AAAA,IACb;AAAA,IACA,EAAE,SAAS,EAAE,WAAW,MAAM,EAAE;AAAA,EAClC;AACA,MAAI,SAAS,WAAW,EAAG,QAAO,EAAE,UAAU,EAAE;AAChD,QAAM,qBAAqB,oBAAI,IAAkC;AACjE,aAAW,WAAW,UAAU;AAC9B,QAAI,CAAC,mBAAmB,IAAI,QAAQ,WAAW,EAAG,oBAAmB,IAAI,QAAQ,aAAa,OAAO;AAAA,EACvG;AAOA,QAAM,YAAY,QAAQ,YAAY;AACtC,QAAM,UAAU,MAAM;AAAA,IACpB;AAAA,IACA;AAAA,IACA;AAAA,MACE;AAAA,MACA;AAAA,MACA;AAAA;AAAA,MAEA,GAAI,eAAe,EAAE,IAAI,aAAa,IAAI,CAAC;AAAA,MAC3C,WAAW;AAAA,MACX,WAAW,EAAE,KAAK,KAAK;AAAA,IACzB;AAAA,IACA;AAAA,IACA,EAAE,UAAU,eAAe;AAAA,EAC7B;AACA,MAAI,QAAQ,WAAW,EAAG,QAAO,EAAE,UAAU,EAAE;AAQ/C,QAAM,oBAAoB,oBAAI,IAAwC;AACtE,WAAS,wBAAwB,cAA0D;AACzF,QAAI,CAAC,KAAM,QAAO,QAAQ,QAAQ,OAAO;AACzC,UAAM,SAAS,uBAAuB,YAAY,KAAK;AACvD,QAAI,SAAS,kBAAkB,IAAI,MAAM;AACzC,QAAI,CAAC,QAAQ;AACX,gBAAU,YAAY;AACpB,YAAI,WAAW,eAAe;AAC5B,iBAAO,EAAE,GAAG,SAAS,OAAO,KAAK,OAAO,MAAM,KAAK,QAAQ,KAAK;AAAA,QAClE;AACA,cAAM,EAAE,OAAO,KAAK,IAAI,MAAM,wBAAwB,MAAM,MAAM;AAClE,eAAO,EAAE,GAAG,SAAS,OAAO,KAAK;AAAA,MACnC,GAAG;AACH,wBAAkB,IAAI,QAAQ,MAAM;AAAA,IACtC;AACA,WAAO;AAAA,EACT;AAUA,QAAM,YAAY,MAAM,QAAQ;AAAA,IAC9B,QAAQ,IAAI,OAAO,WAAW;AAC5B,YAAM,cAAc,OAAO;AAC3B,UAAI,CAAC,YAAa,QAAO;AACzB,YAAM,UAAU,mBAAmB,IAAI,WAAW;AAClD,UAAI,CAAC,QAAS,QAAO;AACrB,YAAM,aAAa,MAAM,wBAAwB,OAAO,MAAM;AAC9D,aAAO;AAAA,QACL,WAAW;AAAA,QACX,iBAAiB;AAAA,QACjB,iBAAiB;AAAA,QACjB,sBAAsB;AAAA,QACtB,gBAAgB,OAAO;AAAA,QACvB,SAAS;AAAA,QACT,UAAU,QAAQ;AAAA,QAClB,gBAAgB,cAAc,OAAO,SAAmB;AAAA,QACxD;AAAA,QACA,QAAQ;AAAA,QACR,UAAU;AAAA,QACV,SAAS,MAAM,KAAK,UAAU,UAAU,CAAC;AAAA,QACzC,YAAY;AAAA,QACZ,YAAY;AAAA,MACd;AAAA,IACF,CAAC;AAAA,EACH;AACA,QAAM,OAAO,UAAU,OAAO,CAAC,QAAwC,QAAQ,IAAI;AAInF,QAAM,mBAAmB,QAAQ,SAAS,KAAK;AAC/C,MAAI,mBAAmB,GAAG;AACxB,WAAO,KAAK,iDAAiD;AAAA,MAC3D;AAAA,MACA;AAAA,MACA;AAAA,MACA,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MAAI,KAAK,WAAW,EAAG,QAAO,EAAE,UAAU,EAAE;AAE5C,QAAM,KAAK,GAAG,UAAe;AAC7B,QAAM,WAAY,MAAM,GACrB,WAAW,8BAA8B,EACzC,OAAO,IAAI,EACX;AAAA,IAAW,CAAC,OACX,GAAG,QAAQ,CAAC,mBAAmB,gBAAgB,CAAC,EAAE,MAAM,mBAAmB,UAAU,IAAI,EAAE,UAAU;AAAA,EACvG,EACC,UAAU,CAAC,IAAI,CAAC,EAChB,QAAQ;AAOX,QAAM,WAAW,MAAM,QAAQ;AAAA,IAC7B,SAAS,IAAI,CAAC,QAAQ,oBAAoB,EAAE,YAAY,IAAI,IAAI,UAAU,eAAe,CAAC,CAAC;AAAA,EAC7F;AACA,QAAM,oBAAoB,oBAAI,IAAsB;AACpD,MAAI,WAAW;AACf,WAAS,QAAQ,CAAC,SAAS,UAAU;AACnC,QAAI,QAAQ,WAAW,aAAa;AAClC,kBAAY;AACZ;AAAA,IACF;AACA,UAAM,QAAQ,QAAQ;AACtB,UAAM,SAAS,iBAAiB,QAAQ,mBAAmB,MAAM,OAAO,KAAK;AAC7E,UAAM,MAAM,kBAAkB,IAAI,MAAM,KAAK,CAAC;AAC9C,QAAI,KAAK,SAAS,KAAK,EAAE,EAAE;AAC3B,sBAAkB,IAAI,QAAQ,GAAG;AAAA,EACnC,CAAC;AACD,MAAI,kBAAkB,OAAO,GAAG;AAC9B,UAAM,QAAQ;AAAA,MACZ,MAAM,KAAK,kBAAkB,QAAQ,CAAC,EAAE;AAAA,QAAI,CAAC,CAAC,QAAQ,GAAG,MACvD,GACG,YAAY,8BAA8B,EAC1C,IAAI,EAAE,QAAQ,UAAU,YAAY,QAAQ,YAAY,WAAW,CAAC,EACpE,MAAM,MAAM,MAAM,GAAG,EAGrB,MAAM,UAAU,KAAK,SAAS,EAC9B,QAAQ;AAAA,MACb;AAAA,IACF;AAAA,EACF;AACA,SAAO,EAAE,SAAS;AACpB;",
+  "names": []
+}

package/dist/modules/push_notifications/lib/push-health.js

@@ -0,0 +1,32 @@
+import { isPushFakeProvidersEnabled, PUSH_FAKE_PROVIDERS_ENV } from "./fake-provider-recorder.js";
+function makePushClientConfigHealthCheck(options) {
+  return {
+    async check(credentials) {
+      if (isPushFakeProvidersEnabled()) {
+        return {
+          status: "degraded",
+          message: `${options.providerLabel} is running in FAKE mode (${PUSH_FAKE_PROVIDERS_ENV} is set): pushes are recorded, not delivered. Unset this flag in production.`,
+          details: { fakeProviders: true, env: PUSH_FAKE_PROVIDERS_ENV }
+        };
+      }
+      const parsed = options.schema.safeParse(credentials ?? {});
+      if (!parsed.success) {
+        const first = parsed.error.issues[0];
+        return {
+          status: "unhealthy",
+          message: `${options.providerLabel} credentials invalid: ${first?.message ?? "unknown validation error"}`,
+          details: { reason: "invalid_credentials" }
+        };
+      }
+      return {
+        status: "healthy",
+        message: `${options.providerLabel} credentials configured`,
+        details: { credentialsConfigured: true, ...options.healthyDetails?.(parsed.data) ?? {} }
+      };
+    }
+  };
+}
+export {
+  makePushClientConfigHealthCheck
+};
+//# sourceMappingURL=push-health.js.map

package/dist/modules/push_notifications/lib/push-health.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/push_notifications/lib/push-health.ts"],
+  "sourcesContent": ["import type { ZodType } from 'zod'\nimport type { EmailHealthCheck } from '@open-mercato/core/modules/communication_channels/lib/provider-health'\nimport { isPushFakeProvidersEnabled, PUSH_FAKE_PROVIDERS_ENV } from './fake-provider-recorder'\n\n/**\n * Liveness probe for a push provider (FCM/APNs/Expo).\n *\n * A push provider has NO OAuth client \u2014 its credentials are a service-account JSON, a `.p8` signing\n * key, or an Expo access token. So this probe validates the tenant-scoped credentials against the\n * provider schema and reports push-appropriate copy, rather than the OAuth-client wording the shared\n * `makeClientConfigHealthCheck` emits (which is correct for the Gmail-style channels but misleading\n * here). It additionally surfaces fake-provider mode: when `OM_PUSH_FAKE_PROVIDERS` is set every send is\n * short-circuited to a recorded no-op, so a plain \"credentials valid \u2192 healthy\" probe would report green\n * while nothing is delivered \u2014 this reports `degraded` instead. Pairs with `warnPushFakeProvidersActive`\n * (a one-time log at registration).\n */\nexport function makePushClientConfigHealthCheck<T>(options: {\n  schema: ZodType<T>\n  providerLabel: string\n  healthyDetails?: (parsed: T) => Record<string, unknown>\n}): EmailHealthCheck {\n  return {\n    async check(credentials) {\n      if (isPushFakeProvidersEnabled()) {\n        return {\n          status: 'degraded',\n          message: `${options.providerLabel} is running in FAKE mode (${PUSH_FAKE_PROVIDERS_ENV} is set): pushes are recorded, not delivered. Unset this flag in production.`,\n          details: { fakeProviders: true, env: PUSH_FAKE_PROVIDERS_ENV },\n        }\n      }\n      const parsed = options.schema.safeParse(credentials ?? {})\n      if (!parsed.success) {\n        const first = parsed.error.issues[0]\n        return {\n          status: 'unhealthy',\n          message: `${options.providerLabel} credentials invalid: ${first?.message ?? 'unknown validation error'}`,\n          details: { reason: 'invalid_credentials' },\n        }\n      }\n      return {\n        status: 'healthy',\n        message: `${options.providerLabel} credentials configured`,\n        details: { credentialsConfigured: true, ...(options.healthyDetails?.(parsed.data) ?? {}) },\n      }\n    },\n  }\n}\n"],
+  "mappings": "AAEA,SAAS,4BAA4B,+BAA+B;AAc7D,SAAS,gCAAmC,SAI9B;AACnB,SAAO;AAAA,IACL,MAAM,MAAM,aAAa;AACvB,UAAI,2BAA2B,GAAG;AAChC,eAAO;AAAA,UACL,QAAQ;AAAA,UACR,SAAS,GAAG,QAAQ,aAAa,6BAA6B,uBAAuB;AAAA,UACrF,SAAS,EAAE,eAAe,MAAM,KAAK,wBAAwB;AAAA,QAC/D;AAAA,MACF;AACA,YAAM,SAAS,QAAQ,OAAO,UAAU,eAAe,CAAC,CAAC;AACzD,UAAI,CAAC,OAAO,SAAS;AACnB,cAAM,QAAQ,OAAO,MAAM,OAAO,CAAC;AACnC,eAAO;AAAA,UACL,QAAQ;AAAA,UACR,SAAS,GAAG,QAAQ,aAAa,yBAAyB,OAAO,WAAW,0BAA0B;AAAA,UACtG,SAAS,EAAE,QAAQ,sBAAsB;AAAA,QAC3C;AAAA,MACF;AACA,aAAO;AAAA,QACL,QAAQ;AAAA,QACR,SAAS,GAAG,QAAQ,aAAa;AAAA,QACjC,SAAS,EAAE,uBAAuB,MAAM,GAAI,QAAQ,iBAAiB,OAAO,IAAI,KAAK,CAAC,EAAG;AAAA,MAC3F;AAAA,IACF;AAAA,EACF;AACF;",
+  "names": []
+}

package/dist/modules/push_notifications/lib/push-reaper.js

@@ -0,0 +1,87 @@
+import { PushNotificationDelivery } from "../data/entities.js";
+import { emitPushNotificationsEvent } from "../events.js";
+import { MAX_ATTEMPTS } from "./push-delivery.js";
+import { resolveStuckThresholdMs } from "./reclaim-window.js";
+import { enqueuePushDelivery } from "./queue.js";
+const DEFAULT_RECLAIM_BATCH_LIMIT = 500;
+const MIN_RECLAIM_BATCH_LIMIT = 1;
+function resolveReclaimBatchLimit() {
+  const raw = Number.parseInt(process.env.OM_PUSH_STUCK_RECLAIM_BATCH_LIMIT ?? "", 10);
+  return Number.isFinite(raw) && raw >= MIN_RECLAIM_BATCH_LIMIT ? raw : DEFAULT_RECLAIM_BATCH_LIMIT;
+}
+async function emitFailed(delivery, willRetry) {
+  await emitPushNotificationsEvent(
+    "push_notifications.delivery.failed",
+    {
+      deliveryId: delivery.id,
+      tenantId: delivery.tenantId,
+      organizationId: delivery.organizationId ?? null,
+      userId: delivery.userId,
+      provider: delivery.provider,
+      status: delivery.status,
+      ...willRetry ? { willRetry: true } : {}
+    },
+    { persistent: true }
+  );
+}
+async function reclaimStuckPushDeliveries(em, scope, now = /* @__PURE__ */ new Date()) {
+  const cutoff = new Date(now.getTime() - resolveStuckThresholdMs());
+  const stuck = await em.find(
+    PushNotificationDelivery,
+    {
+      tenantId: scope.tenantId,
+      status: { $in: ["sending", "pending"] },
+      updatedAt: { $lt: cutoff }
+    },
+    { limit: resolveReclaimBatchLimit(), orderBy: { updatedAt: "asc" } }
+  );
+  let reEnqueued = 0;
+  let expired = 0;
+  for (const delivery of stuck) {
+    const claimGuard = { id: delivery.id, tenantId: scope.tenantId, status: delivery.status, updatedAt: { $lt: cutoff } };
+    if (delivery.attempts >= MAX_ATTEMPTS) {
+      const claimed2 = await em.nativeUpdate(PushNotificationDelivery, claimGuard, {
+        status: "expired",
+        lastError: "stuck_reclaimed",
+        nextRetryAt: null,
+        updatedAt: /* @__PURE__ */ new Date()
+      });
+      if (claimed2 === 0) continue;
+      delivery.status = "expired";
+      delivery.lastError = "stuck_reclaimed";
+      await emitFailed(delivery, false);
+      expired += 1;
+      continue;
+    }
+    const claimed = await em.nativeUpdate(PushNotificationDelivery, claimGuard, {
+      status: "pending",
+      nextRetryAt: null,
+      updatedAt: /* @__PURE__ */ new Date()
+    });
+    if (claimed === 0) continue;
+    delivery.status = "pending";
+    try {
+      await enqueuePushDelivery({
+        deliveryId: delivery.id,
+        tenantId: scope.tenantId,
+        organizationId: delivery.organizationId ?? null
+      });
+      reEnqueued += 1;
+    } catch (error) {
+      const reason = error instanceof Error ? `reclaim_enqueue_failed: ${error.message}` : "reclaim_enqueue_failed";
+      await em.nativeUpdate(
+        PushNotificationDelivery,
+        { id: delivery.id, tenantId: scope.tenantId, status: "pending" },
+        { status: "failed", lastError: reason, nextRetryAt: null, updatedAt: /* @__PURE__ */ new Date() }
+      );
+      delivery.status = "failed";
+      delivery.lastError = reason;
+      await emitFailed(delivery, false);
+    }
+  }
+  return { reEnqueued, expired };
+}
+export {
+  reclaimStuckPushDeliveries
+};
+//# sourceMappingURL=push-reaper.js.map

package/dist/modules/push_notifications/lib/push-reaper.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/push_notifications/lib/push-reaper.ts"],
+  "sourcesContent": ["import type { EntityManager } from '@mikro-orm/postgresql'\nimport { PushNotificationDelivery } from '../data/entities'\nimport { emitPushNotificationsEvent } from '../events'\nimport { MAX_ATTEMPTS } from './push-delivery'\nimport { resolveStuckThresholdMs } from './reclaim-window'\nimport { enqueuePushDelivery } from './queue'\n\n// The stuck-reclaim window (minutes a row may sit in `sending`/`pending` before a dead-worker reclaim)\n// lives in ./reclaim-window so the send-path timeout shares the same source of truth.\n//\n// INVARIANT: this window MUST exceed the worst-case single provider send time. `updated_at` is stamped\n// once when the row is claimed (`pending` \u2192 `sending`) and is NOT refreshed mid-send (no heartbeat), so\n// a legitimate send that runs longer than the window would be reclaimed and re-enqueued \u2192 a duplicate\n// push. The send path caps each provider send below this window (see push-delivery.ts\n// `resolvePushSendTimeoutMs`), and duplicates are otherwise bounded by MAX_ATTEMPTS (incremented at\n// claim time) and inherent to at-least-once delivery.\n\n// Bound the per-tick scan so a stranded backlog (provider/queue outage) cannot load an unbounded row\n// set into memory and re-enqueue it serially in one tick. Oldest-stuck rows are drained first; the\n// remainder is picked up by subsequent ticks. Tunable via OM_PUSH_STUCK_RECLAIM_BATCH_LIMIT (values\n// below MIN_RECLAIM_BATCH_LIMIT, negative, or non-numeric \u2192 default). Mirrors the receipt reaper's\n// OM_PUSH_RECEIPT_BATCH_LIMIT.\nconst DEFAULT_RECLAIM_BATCH_LIMIT = 500\nconst MIN_RECLAIM_BATCH_LIMIT = 1\n\nexport type ReclaimStuckResult = { reEnqueued: number; expired: number }\n\nfunction resolveReclaimBatchLimit(): number {\n  const raw = Number.parseInt(process.env.OM_PUSH_STUCK_RECLAIM_BATCH_LIMIT ?? '', 10)\n  return Number.isFinite(raw) && raw >= MIN_RECLAIM_BATCH_LIMIT ? raw : DEFAULT_RECLAIM_BATCH_LIMIT\n}\n\nasync function emitFailed(delivery: PushNotificationDelivery, willRetry: boolean): Promise<void> {\n  await emitPushNotificationsEvent(\n    'push_notifications.delivery.failed',\n    {\n      deliveryId: delivery.id,\n      tenantId: delivery.tenantId,\n      organizationId: delivery.organizationId ?? null,\n      userId: delivery.userId,\n      provider: delivery.provider,\n      status: delivery.status,\n      ...(willRetry ? { willRetry: true } : {}),\n    },\n    { persistent: true },\n  )\n}\n\n/**\n * Recover push delivery rows stranded by a worker (or an enqueue) that never finished:\n *\n *  - `sending` rows \u2014 a worker crashed between claiming the row (`pending` \u2192 `sending`) and finalizing\n *    it. Such a row has no outstanding job the claim can re-match.\n *  - `pending` rows \u2014 the fan-out committed the delivery row (a plain INSERT, auto-committed) but the\n *    subsequent enqueue never landed (process died, or the queue dropped the job). The row then sits\n *    `pending` forever: the send-path claim only runs when a job fires, so no job \u21D2 no claim \u21D2 the row\n *    is never retried, expired, nor surfaced as failed. Only a *synchronous* enqueue throw is handled\n *    inline by the fan-out; a lost job after the INSERT committed is invisible without this sweep.\n *\n * Both are recovered identically: re-enqueue if retry budget remains, else finalize `expired`. Driven\n * by the `push_notifications:reclaim-stuck` scheduler tick (one per tenant), so the query is scoped to\n * the tenant only (covers org-bound and tenant-level rows alike); there is no cross-tenant read.\n *\n * The stale-`updated_at < cutoff` guard is what makes sweeping `pending` safe: a freshly fan-outed row\n * (with a live job in flight) is younger than the cutoff and is left alone; only a row that has sat\n * past the reclaim window \u2014 long after any real job would have claimed it \u2014 is re-enqueued. A rare\n * duplicate job is a no-op because the send-path claim is atomic (`pending` \u2192 `sending`, exactly one\n * winner), and provider-send duplicates are bounded by MAX_ATTEMPTS.\n *\n * Each transition is an atomic `nativeUpdate` guarded on the row's observed `status` AND still-stale\n * `updated_at < cutoff`, so overlapping ticks (or a worker that re-claimed the row in the meantime)\n * can never re-open an actively-processing delivery \u2014 exactly one actor wins each row.\n */\nexport async function reclaimStuckPushDeliveries(\n  em: EntityManager,\n  scope: { tenantId: string },\n  now: Date = new Date(),\n): Promise<ReclaimStuckResult> {\n  const cutoff = new Date(now.getTime() - resolveStuckThresholdMs())\n  const stuck = await em.find(\n    PushNotificationDelivery,\n    {\n      tenantId: scope.tenantId,\n      status: { $in: ['sending', 'pending'] },\n      updatedAt: { $lt: cutoff },\n    },\n    { limit: resolveReclaimBatchLimit(), orderBy: { updatedAt: 'asc' } },\n  )\n\n  let reEnqueued = 0\n  let expired = 0\n  for (const delivery of stuck) {\n    const claimGuard = { id: delivery.id, tenantId: scope.tenantId, status: delivery.status, updatedAt: { $lt: cutoff } }\n\n    if (delivery.attempts >= MAX_ATTEMPTS) {\n      const claimed = await em.nativeUpdate(PushNotificationDelivery, claimGuard, {\n        status: 'expired',\n        lastError: 'stuck_reclaimed',\n        nextRetryAt: null,\n        updatedAt: new Date(),\n      })\n      if (claimed === 0) continue\n      delivery.status = 'expired'\n      delivery.lastError = 'stuck_reclaimed'\n      await emitFailed(delivery, false)\n      expired += 1\n      continue\n    }\n\n    const claimed = await em.nativeUpdate(PushNotificationDelivery, claimGuard, {\n      status: 'pending',\n      nextRetryAt: null,\n      updatedAt: new Date(),\n    })\n    if (claimed === 0) continue\n    delivery.status = 'pending'\n\n    try {\n      await enqueuePushDelivery({\n        deliveryId: delivery.id,\n        tenantId: scope.tenantId,\n        organizationId: delivery.organizationId ?? null,\n      })\n      reEnqueued += 1\n    } catch (error) {\n      // Re-enqueue failed: don't leave the row pending with no job. Fail it terminally instead.\n      const reason = error instanceof Error ? `reclaim_enqueue_failed: ${error.message}` : 'reclaim_enqueue_failed'\n      await em.nativeUpdate(\n        PushNotificationDelivery,\n        { id: delivery.id, tenantId: scope.tenantId, status: 'pending' },\n        { status: 'failed', lastError: reason, nextRetryAt: null, updatedAt: new Date() },\n      )\n      delivery.status = 'failed'\n      delivery.lastError = reason\n      await emitFailed(delivery, false)\n    }\n  }\n\n  return { reEnqueued, expired }\n}\n"],
+  "mappings": "AACA,SAAS,gCAAgC;AACzC,SAAS,kCAAkC;AAC3C,SAAS,oBAAoB;AAC7B,SAAS,+BAA+B;AACxC,SAAS,2BAA2B;AAiBpC,MAAM,8BAA8B;AACpC,MAAM,0BAA0B;AAIhC,SAAS,2BAAmC;AAC1C,QAAM,MAAM,OAAO,SAAS,QAAQ,IAAI,qCAAqC,IAAI,EAAE;AACnF,SAAO,OAAO,SAAS,GAAG,KAAK,OAAO,0BAA0B,MAAM;AACxE;AAEA,eAAe,WAAW,UAAoC,WAAmC;AAC/F,QAAM;AAAA,IACJ;AAAA,IACA;AAAA,MACE,YAAY,SAAS;AAAA,MACrB,UAAU,SAAS;AAAA,MACnB,gBAAgB,SAAS,kBAAkB;AAAA,MAC3C,QAAQ,SAAS;AAAA,MACjB,UAAU,SAAS;AAAA,MACnB,QAAQ,SAAS;AAAA,MACjB,GAAI,YAAY,EAAE,WAAW,KAAK,IAAI,CAAC;AAAA,IACzC;AAAA,IACA,EAAE,YAAY,KAAK;AAAA,EACrB;AACF;AA2BA,eAAsB,2BACpB,IACA,OACA,MAAY,oBAAI,KAAK,GACQ;AAC7B,QAAM,SAAS,IAAI,KAAK,IAAI,QAAQ,IAAI,wBAAwB,CAAC;AACjE,QAAM,QAAQ,MAAM,GAAG;AAAA,IACrB;AAAA,IACA;AAAA,MACE,UAAU,MAAM;AAAA,MAChB,QAAQ,EAAE,KAAK,CAAC,WAAW,SAAS,EAAE;AAAA,MACtC,WAAW,EAAE,KAAK,OAAO;AAAA,IAC3B;AAAA,IACA,EAAE,OAAO,yBAAyB,GAAG,SAAS,EAAE,WAAW,MAAM,EAAE;AAAA,EACrE;AAEA,MAAI,aAAa;AACjB,MAAI,UAAU;AACd,aAAW,YAAY,OAAO;AAC5B,UAAM,aAAa,EAAE,IAAI,SAAS,IAAI,UAAU,MAAM,UAAU,QAAQ,SAAS,QAAQ,WAAW,EAAE,KAAK,OAAO,EAAE;AAEpH,QAAI,SAAS,YAAY,cAAc;AACrC,YAAMA,WAAU,MAAM,GAAG,aAAa,0BAA0B,YAAY;AAAA,QAC1E,QAAQ;AAAA,QACR,WAAW;AAAA,QACX,aAAa;AAAA,QACb,WAAW,oBAAI,KAAK;AAAA,MACtB,CAAC;AACD,UAAIA,aAAY,EAAG;AACnB,eAAS,SAAS;AAClB,eAAS,YAAY;AACrB,YAAM,WAAW,UAAU,KAAK;AAChC,iBAAW;AACX;AAAA,IACF;AAEA,UAAM,UAAU,MAAM,GAAG,aAAa,0BAA0B,YAAY;AAAA,MAC1E,QAAQ;AAAA,MACR,aAAa;AAAA,MACb,WAAW,oBAAI,KAAK;AAAA,IACtB,CAAC;AACD,QAAI,YAAY,EAAG;AACnB,aAAS,SAAS;AAElB,QAAI;AACF,YAAM,oBAAoB;AAAA,QACxB,YAAY,SAAS;AAAA,QACrB,UAAU,MAAM;AAAA,QAChB,gBAAgB,SAAS,kBAAkB;AAAA,MAC7C,CAAC;AACD,oBAAc;AAAA,IAChB,SAAS,OAAO;AAEd,YAAM,SAAS,iBAAiB,QAAQ,2BAA2B,MAAM,OAAO,KAAK;AACrF,YAAM,GAAG;AAAA,QACP;AAAA,QACA,EAAE,IAAI,SAAS,IAAI,UAAU,MAAM,UAAU,QAAQ,UAAU;AAAA,QAC/D,EAAE,QAAQ,UAAU,WAAW,QAAQ,aAAa,MAAM,WAAW,oBAAI,KAAK,EAAE;AAAA,MAClF;AACA,eAAS,SAAS;AAClB,eAAS,YAAY;AACrB,YAAM,WAAW,UAAU,KAAK;AAAA,IAClC;AAAA,EACF;AAEA,SAAO,EAAE,YAAY,QAAQ;AAC/B;",
+  "names": ["claimed"]
+}

package/dist/modules/push_notifications/lib/push-receipt-reaper.js

@@ -0,0 +1,136 @@
+import { raw } from "@mikro-orm/core";
+import {
+  DEVICE_UNREGISTERED,
+  supportsReceiptChecking
+} from "@open-mercato/core/modules/communication_channels/lib/push-adapter";
+import { createLogger } from "@open-mercato/shared/lib/logger";
+import { PushNotificationDelivery } from "../data/entities.js";
+import { softDeleteUnregisteredDevice } from "./push-delivery.js";
+const logger = createLogger("push_notifications");
+function envInt(name, fallback) {
+  const parsed = Number.parseInt(process.env[name] ?? "", 10);
+  return Number.isFinite(parsed) ? parsed : fallback;
+}
+const RECEIPT_MIN_AGE_MINUTES_RAW = envInt("OM_PUSH_RECEIPT_MIN_AGE_MINUTES", 15);
+const RECEIPT_MIN_AGE_MS = (RECEIPT_MIN_AGE_MINUTES_RAW >= 0 ? RECEIPT_MIN_AGE_MINUTES_RAW : 15) * 60 * 1e3;
+const RECEIPT_MAX_AGE_MS = Math.max(
+  RECEIPT_MIN_AGE_MS + 60 * 1e3,
+  envInt("OM_PUSH_RECEIPT_MAX_AGE_MINUTES", 60) * 60 * 1e3
+);
+const RECEIPT_BATCH_LIMIT = Math.max(1, envInt("OM_PUSH_RECEIPT_BATCH_LIMIT", 500));
+function ticketIdOf(delivery) {
+  const id = delivery.providerResponse?.externalMessageId;
+  return typeof id === "string" && id.length > 0 ? id : null;
+}
+function isReceiptChecked(delivery) {
+  return delivery.providerResponse?.receiptChecked === true;
+}
+function markReceiptChecked(delivery, unregistered) {
+  delivery.providerResponse = {
+    ...delivery.providerResponse ?? {},
+    receiptChecked: true,
+    ...unregistered ? { unregistered: true } : {}
+  };
+}
+async function checkPushReceipts(em, scope, resolve, now = /* @__PURE__ */ new Date()) {
+  const registry = resolve("channelAdapterRegistry");
+  if (!registry) return { checked: 0, unregistered: 0 };
+  const workableRow = raw(
+    `(nullif(provider_response->>'externalMessageId', '') is not null and coalesce((provider_response->>'receiptChecked')::boolean, false) = false)`
+  );
+  const candidates = await em.find(
+    PushNotificationDelivery,
+    {
+      tenantId: scope.tenantId,
+      status: "sent",
+      sentAt: { $gte: new Date(now.getTime() - RECEIPT_MAX_AGE_MS), $lte: new Date(now.getTime() - RECEIPT_MIN_AGE_MS) },
+      [workableRow]: true
+    },
+    { limit: RECEIPT_BATCH_LIMIT, orderBy: { sentAt: "asc" } }
+  );
+  const byProvider = /* @__PURE__ */ new Map();
+  for (const delivery of candidates) {
+    if (isReceiptChecked(delivery)) continue;
+    const ticketId = ticketIdOf(delivery);
+    if (!ticketId) continue;
+    const list = byProvider.get(delivery.provider) ?? [];
+    list.push({ ticketId, delivery });
+    byProvider.set(delivery.provider, list);
+  }
+  if (byProvider.size === 0) return { checked: 0, unregistered: 0 };
+  let credentialsService;
+  try {
+    credentialsService = resolve("integrationCredentialsService");
+  } catch {
+    credentialsService = void 0;
+  }
+  const ChannelRef = resolve("CommunicationChannel");
+  let checked = 0;
+  let unregistered = 0;
+  for (const [provider, entries] of byProvider) {
+    const adapter = registry.get(provider);
+    if (!adapter || !supportsReceiptChecking(adapter)) continue;
+    const channel = await em.findOne(ChannelRef, {
+      tenantId: scope.tenantId,
+      providerKey: provider,
+      channelType: "push",
+      isActive: true,
+      deletedAt: null
+    });
+    if (!channel) continue;
+    const credentialScope = {
+      tenantId: scope.tenantId,
+      organizationId: channel.organizationId ?? scope.tenantId,
+      userId: channel.userId ?? null
+    };
+    let credentials = {};
+    if (channel.credentialsRef && credentialsService) {
+      credentials = await credentialsService.resolve(`channel_${provider}`, credentialScope).catch(() => null) ?? {};
+    }
+    const byTicket = /* @__PURE__ */ new Map();
+    for (const entry of entries) {
+      const list = byTicket.get(entry.ticketId) ?? [];
+      list.push(entry.delivery);
+      byTicket.set(entry.ticketId, list);
+    }
+    let outcomes;
+    try {
+      outcomes = await adapter.checkReceipts([...byTicket.keys()], credentials);
+    } catch (error) {
+      logger.error("Push receipt check failed", {
+        tenantId: scope.tenantId,
+        provider,
+        error: error instanceof Error ? error.message : String(error)
+      });
+      continue;
+    }
+    const toDeactivate = [];
+    for (const outcome of outcomes) {
+      const deliveries = byTicket.get(outcome.ticketId);
+      if (!deliveries) continue;
+      for (const delivery of deliveries) {
+        markReceiptChecked(delivery, outcome.unregistered);
+        checked += 1;
+        if (outcome.unregistered) {
+          delivery.lastError = DEVICE_UNREGISTERED;
+          toDeactivate.push({
+            id: delivery.userDeviceId,
+            tenantId: delivery.tenantId,
+            userId: delivery.userId,
+            organizationId: delivery.organizationId ?? null
+          });
+          unregistered += 1;
+        }
+      }
+    }
+    await em.flush();
+    for (const input of toDeactivate) {
+      await softDeleteUnregisteredDevice(resolve, input);
+    }
+  }
+  return { checked, unregistered };
+}
+export {
+  checkPushReceipts
+};
+//# sourceMappingURL=push-receipt-reaper.js.map

package/dist/modules/push_notifications/lib/push-receipt-reaper.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/push_notifications/lib/push-receipt-reaper.ts"],
+  "sourcesContent": ["import type { EntityManager } from '@mikro-orm/postgresql'\nimport { raw, type EntityName } from '@mikro-orm/core'\nimport type { ChannelAdapter } from '@open-mercato/core/modules/communication_channels/lib/adapter'\nimport {\n  DEVICE_UNREGISTERED,\n  supportsReceiptChecking,\n} from '@open-mercato/core/modules/communication_channels/lib/push-adapter'\nimport type { CommunicationChannel } from '@open-mercato/core/modules/communication_channels/data/entities'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport { PushNotificationDelivery } from '../data/entities'\nimport { softDeleteUnregisteredDevice } from './push-delivery'\n\nconst logger = createLogger('push_notifications')\n\ntype Resolve = <T = unknown>(name: string) => T\n\ninterface ChannelAdapterRegistryLike {\n  get(providerKey: string): ChannelAdapter | undefined\n}\n\ninterface CredentialsServiceLike {\n  resolve(\n    integrationId: string,\n    scope: { tenantId: string; organizationId: string; userId?: string | null },\n  ): Promise<Record<string, unknown> | null>\n}\n\nexport type ReceiptReaperResult = { checked: number; unregistered: number }\n\n// A receipt only exists after the provider has attempted handoff to FCM/APNs, so a just-`sent` row has\n// nothing to poll yet. Wait MIN_AGE before the first check (Expo recommends ~15m) and stop looking after\n// MAX_AGE \u2014 a row not resolved within the window is left as `sent` (best-effort hygiene, not a\n// correctness guarantee). Both tunable; MAX is clamped above MIN so the window is always non-empty.\n// Parse an int env var, falling back to `fallback` only when it is unset/non-numeric \u2014 a legitimately\n// configured `0` is preserved (`|| fallback` would coerce it, since `0` is falsy).\nfunction envInt(name: string, fallback: number): number {\n  const parsed = Number.parseInt(process.env[name] ?? '', 10)\n  return Number.isFinite(parsed) ? parsed : fallback\n}\n// A negative value must NOT collapse to 0 (that would poll before any receipt exists and mark the\n// delivery `receiptChecked` forever). Preserve a legitimately-configured 0 but floor a negative back to\n// the default \u2014 mirroring the reaper's `raw >= MIN ? raw : DEFAULT` guard (resolveReclaimBatchLimit).\nconst RECEIPT_MIN_AGE_MINUTES_RAW = envInt('OM_PUSH_RECEIPT_MIN_AGE_MINUTES', 15)\nconst RECEIPT_MIN_AGE_MS = (RECEIPT_MIN_AGE_MINUTES_RAW >= 0 ? RECEIPT_MIN_AGE_MINUTES_RAW : 15) * 60 * 1000\nconst RECEIPT_MAX_AGE_MS = Math.max(\n  RECEIPT_MIN_AGE_MS + 60 * 1000,\n  envInt('OM_PUSH_RECEIPT_MAX_AGE_MINUTES', 60) * 60 * 1000,\n)\n// Bound the per-tick scan so a busy tenant's `sent` backlog cannot fetch an unbounded row set.\nconst RECEIPT_BATCH_LIMIT = Math.max(1, envInt('OM_PUSH_RECEIPT_BATCH_LIMIT', 500))\n\n/** The provider ticket id persisted by the send path, or null when there is nothing to poll. */\nfunction ticketIdOf(delivery: PushNotificationDelivery): string | null {\n  const id = (delivery.providerResponse as { externalMessageId?: unknown } | null | undefined)?.externalMessageId\n  return typeof id === 'string' && id.length > 0 ? id : null\n}\n\n/** A row whose receipt was already resolved on a prior sweep \u2014 skip it (marker is JSON, no migration). */\nfunction isReceiptChecked(delivery: PushNotificationDelivery): boolean {\n  return (delivery.providerResponse as { receiptChecked?: unknown } | null | undefined)?.receiptChecked === true\n}\n\nfunction markReceiptChecked(delivery: PushNotificationDelivery, unregistered: boolean): void {\n  delivery.providerResponse = {\n    ...(delivery.providerResponse ?? {}),\n    receiptChecked: true,\n    ...(unregistered ? { unregistered: true } : {}),\n  }\n}\n\n/**\n * Second-pass hygiene for push providers whose \"device unregistered\" signal arrives in an ASYNCHRONOUS\n * receipt phase rather than the synchronous send ticket (Expo). Runs on the per-tenant reclaim tick.\n *\n * For each `sent` delivery old enough to have a receipt, group ticket ids by provider, and for every\n * provider whose adapter implements the optional `PushReceiptChecker` capability, poll receipts using\n * the same channel credentials as the send path. A `DeviceNotRegistered` receipt is routed through the\n * SAME `softDeleteUnregisteredDevice` contract the synchronous path uses \u2014 no separate deletion path.\n * `MessageRateExceeded` and other transient receipt errors resolve the receipt but never kill the token.\n *\n * Idempotent: each resolved row is marked (`providerResponse.receiptChecked`) so it is never re-polled,\n * and `devices.deactivate` is itself idempotent, so an overlapping tick cannot double-delete.\n */\nexport async function checkPushReceipts(\n  em: EntityManager,\n  scope: { tenantId: string },\n  resolve: Resolve,\n  now: Date = new Date(),\n): Promise<ReceiptReaperResult> {\n  const registry = resolve('channelAdapterRegistry') as ChannelAdapterRegistryLike | undefined\n  if (!registry) return { checked: 0, unregistered: 0 }\n\n  // Exclude non-workable rows in SQL, not in memory. A resolved row keeps `status: 'sent'` (the\n  // `receiptChecked` marker lives in the `provider_response` JSON, not the status column), and rows\n  // with no pollable ticket id (fcm/apns report unregistered synchronously and persist an empty\n  // `externalMessageId`) can never be receipt-checked. Filtering those in memory after a\n  // `LIMIT \u2026 ORDER BY sent_at ASC` fetch lets an oldest-first backlog of them fill the bounded batch\n  // and starve every still-unchecked Expo row in the tenant \u2014 the batch does zero work forever until\n  // the backlog ages past MAX_AGE. Push both predicates into the query so the budget only ever loads\n  // rows that can actually make progress. (`provider_response` is `json`; `->>` reads it as text.)\n  const workableRow = raw(\n    `(nullif(provider_response->>'externalMessageId', '') is not null and coalesce((provider_response->>'receiptChecked')::boolean, false) = false)`,\n  )\n  const candidates = await em.find(\n    PushNotificationDelivery,\n    {\n      tenantId: scope.tenantId,\n      status: 'sent',\n      sentAt: { $gte: new Date(now.getTime() - RECEIPT_MAX_AGE_MS), $lte: new Date(now.getTime() - RECEIPT_MIN_AGE_MS) },\n      [workableRow as unknown as string]: true,\n    },\n    { limit: RECEIPT_BATCH_LIMIT, orderBy: { sentAt: 'asc' } },\n  )\n\n  // Group unchecked rows that have a real ticket id by provider. Providers whose adapter doesn't\n  // implement receipt checking (fcm/apns) never issue a network call \u2014 they are dropped below.\n  const byProvider = new Map<string, { ticketId: string; delivery: PushNotificationDelivery }[]>()\n  for (const delivery of candidates) {\n    if (isReceiptChecked(delivery)) continue\n    const ticketId = ticketIdOf(delivery)\n    if (!ticketId) continue\n    const list = byProvider.get(delivery.provider) ?? []\n    list.push({ ticketId, delivery })\n    byProvider.set(delivery.provider, list)\n  }\n  if (byProvider.size === 0) return { checked: 0, unregistered: 0 }\n\n  let credentialsService: CredentialsServiceLike | undefined\n  try {\n    credentialsService = resolve('integrationCredentialsService') as CredentialsServiceLike | undefined\n  } catch {\n    credentialsService = undefined\n  }\n  const ChannelRef = resolve('CommunicationChannel') as EntityName<CommunicationChannel>\n\n  let checked = 0\n  let unregistered = 0\n\n  for (const [provider, entries] of byProvider) {\n    const adapter = registry.get(provider)\n    if (!adapter || !supportsReceiptChecking(adapter)) continue\n\n    const channel = await em.findOne(ChannelRef, {\n      tenantId: scope.tenantId,\n      providerKey: provider,\n      channelType: 'push',\n      isActive: true,\n      deletedAt: null,\n    })\n    if (!channel) continue\n\n    // Credentials are keyed by the CHANNEL's org context, mirroring the send path (see push-delivery).\n    const credentialScope = {\n      tenantId: scope.tenantId,\n      organizationId: channel.organizationId ?? scope.tenantId,\n      userId: channel.userId ?? null,\n    }\n    let credentials: Record<string, unknown> = {}\n    if (channel.credentialsRef && credentialsService) {\n      credentials = (await credentialsService.resolve(`channel_${provider}`, credentialScope).catch(() => null)) ?? {}\n    }\n\n    const byTicket = new Map<string, PushNotificationDelivery[]>()\n    for (const entry of entries) {\n      const list = byTicket.get(entry.ticketId) ?? []\n      list.push(entry.delivery)\n      byTicket.set(entry.ticketId, list)\n    }\n\n    let outcomes\n    try {\n      outcomes = await adapter.checkReceipts([...byTicket.keys()], credentials)\n    } catch (error) {\n      logger.error('Push receipt check failed', {\n        tenantId: scope.tenantId,\n        provider,\n        error: error instanceof Error ? error.message : String(error),\n      })\n      continue\n    }\n\n    // Persist the receipt-checked marks first, then run the device deactivations AFTER the flush so a\n    // command that reads on the same EntityManager can never discard the pending scalar marks.\n    const toDeactivate: Array<{ id: string; tenantId: string; userId: string; organizationId: string | null }> = []\n    for (const outcome of outcomes) {\n      const deliveries = byTicket.get(outcome.ticketId)\n      if (!deliveries) continue\n      for (const delivery of deliveries) {\n        markReceiptChecked(delivery, outcome.unregistered)\n        checked += 1\n        if (outcome.unregistered) {\n          delivery.lastError = DEVICE_UNREGISTERED\n          toDeactivate.push({\n            id: delivery.userDeviceId,\n            tenantId: delivery.tenantId,\n            userId: delivery.userId,\n            organizationId: delivery.organizationId ?? null,\n          })\n          unregistered += 1\n        }\n      }\n    }\n    await em.flush()\n    for (const input of toDeactivate) {\n      await softDeleteUnregisteredDevice(resolve, input)\n    }\n  }\n\n  return { checked, unregistered }\n}\n"],
+  "mappings": "AACA,SAAS,WAA4B;AAErC;AAAA,EACE;AAAA,EACA;AAAA,OACK;AAEP,SAAS,oBAAoB;AAC7B,SAAS,gCAAgC;AACzC,SAAS,oCAAoC;AAE7C,MAAM,SAAS,aAAa,oBAAoB;AAuBhD,SAAS,OAAO,MAAc,UAA0B;AACtD,QAAM,SAAS,OAAO,SAAS,QAAQ,IAAI,IAAI,KAAK,IAAI,EAAE;AAC1D,SAAO,OAAO,SAAS,MAAM,IAAI,SAAS;AAC5C;AAIA,MAAM,8BAA8B,OAAO,mCAAmC,EAAE;AAChF,MAAM,sBAAsB,+BAA+B,IAAI,8BAA8B,MAAM,KAAK;AACxG,MAAM,qBAAqB,KAAK;AAAA,EAC9B,qBAAqB,KAAK;AAAA,EAC1B,OAAO,mCAAmC,EAAE,IAAI,KAAK;AACvD;AAEA,MAAM,sBAAsB,KAAK,IAAI,GAAG,OAAO,+BAA+B,GAAG,CAAC;AAGlF,SAAS,WAAW,UAAmD;AACrE,QAAM,KAAM,SAAS,kBAAyE;AAC9F,SAAO,OAAO,OAAO,YAAY,GAAG,SAAS,IAAI,KAAK;AACxD;AAGA,SAAS,iBAAiB,UAA6C;AACrE,SAAQ,SAAS,kBAAsE,mBAAmB;AAC5G;AAEA,SAAS,mBAAmB,UAAoC,cAA6B;AAC3F,WAAS,mBAAmB;AAAA,IAC1B,GAAI,SAAS,oBAAoB,CAAC;AAAA,IAClC,gBAAgB;AAAA,IAChB,GAAI,eAAe,EAAE,cAAc,KAAK,IAAI,CAAC;AAAA,EAC/C;AACF;AAeA,eAAsB,kBACpB,IACA,OACA,SACA,MAAY,oBAAI,KAAK,GACS;AAC9B,QAAM,WAAW,QAAQ,wBAAwB;AACjD,MAAI,CAAC,SAAU,QAAO,EAAE,SAAS,GAAG,cAAc,EAAE;AAUpD,QAAM,cAAc;AAAA,IAClB;AAAA,EACF;AACA,QAAM,aAAa,MAAM,GAAG;AAAA,IAC1B;AAAA,IACA;AAAA,MACE,UAAU,MAAM;AAAA,MAChB,QAAQ;AAAA,MACR,QAAQ,EAAE,MAAM,IAAI,KAAK,IAAI,QAAQ,IAAI,kBAAkB,GAAG,MAAM,IAAI,KAAK,IAAI,QAAQ,IAAI,kBAAkB,EAAE;AAAA,MACjH,CAAC,WAAgC,GAAG;AAAA,IACtC;AAAA,IACA,EAAE,OAAO,qBAAqB,SAAS,EAAE,QAAQ,MAAM,EAAE;AAAA,EAC3D;AAIA,QAAM,aAAa,oBAAI,IAAwE;AAC/F,aAAW,YAAY,YAAY;AACjC,QAAI,iBAAiB,QAAQ,EAAG;AAChC,UAAM,WAAW,WAAW,QAAQ;AACpC,QAAI,CAAC,SAAU;AACf,UAAM,OAAO,WAAW,IAAI,SAAS,QAAQ,KAAK,CAAC;AACnD,SAAK,KAAK,EAAE,UAAU,SAAS,CAAC;AAChC,eAAW,IAAI,SAAS,UAAU,IAAI;AAAA,EACxC;AACA,MAAI,WAAW,SAAS,EAAG,QAAO,EAAE,SAAS,GAAG,cAAc,EAAE;AAEhE,MAAI;AACJ,MAAI;AACF,yBAAqB,QAAQ,+BAA+B;AAAA,EAC9D,QAAQ;AACN,yBAAqB;AAAA,EACvB;AACA,QAAM,aAAa,QAAQ,sBAAsB;AAEjD,MAAI,UAAU;AACd,MAAI,eAAe;AAEnB,aAAW,CAAC,UAAU,OAAO,KAAK,YAAY;AAC5C,UAAM,UAAU,SAAS,IAAI,QAAQ;AACrC,QAAI,CAAC,WAAW,CAAC,wBAAwB,OAAO,EAAG;AAEnD,UAAM,UAAU,MAAM,GAAG,QAAQ,YAAY;AAAA,MAC3C,UAAU,MAAM;AAAA,MAChB,aAAa;AAAA,MACb,aAAa;AAAA,MACb,UAAU;AAAA,MACV,WAAW;AAAA,IACb,CAAC;AACD,QAAI,CAAC,QAAS;AAGd,UAAM,kBAAkB;AAAA,MACtB,UAAU,MAAM;AAAA,MAChB,gBAAgB,QAAQ,kBAAkB,MAAM;AAAA,MAChD,QAAQ,QAAQ,UAAU;AAAA,IAC5B;AACA,QAAI,cAAuC,CAAC;AAC5C,QAAI,QAAQ,kBAAkB,oBAAoB;AAChD,oBAAe,MAAM,mBAAmB,QAAQ,WAAW,QAAQ,IAAI,eAAe,EAAE,MAAM,MAAM,IAAI,KAAM,CAAC;AAAA,IACjH;AAEA,UAAM,WAAW,oBAAI,IAAwC;AAC7D,eAAW,SAAS,SAAS;AAC3B,YAAM,OAAO,SAAS,IAAI,MAAM,QAAQ,KAAK,CAAC;AAC9C,WAAK,KAAK,MAAM,QAAQ;AACxB,eAAS,IAAI,MAAM,UAAU,IAAI;AAAA,IACnC;AAEA,QAAI;AACJ,QAAI;AACF,iBAAW,MAAM,QAAQ,cAAc,CAAC,GAAG,SAAS,KAAK,CAAC,GAAG,WAAW;AAAA,IAC1E,SAAS,OAAO;AACd,aAAO,MAAM,6BAA6B;AAAA,QACxC,UAAU,MAAM;AAAA,QAChB;AAAA,QACA,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,MAC9D,CAAC;AACD;AAAA,IACF;AAIA,UAAM,eAAuG,CAAC;AAC9G,eAAW,WAAW,UAAU;AAC9B,YAAM,aAAa,SAAS,IAAI,QAAQ,QAAQ;AAChD,UAAI,CAAC,WAAY;AACjB,iBAAW,YAAY,YAAY;AACjC,2BAAmB,UAAU,QAAQ,YAAY;AACjD,mBAAW;AACX,YAAI,QAAQ,cAAc;AACxB,mBAAS,YAAY;AACrB,uBAAa,KAAK;AAAA,YAChB,IAAI,SAAS;AAAA,YACb,UAAU,SAAS;AAAA,YACnB,QAAQ,SAAS;AAAA,YACjB,gBAAgB,SAAS,kBAAkB;AAAA,UAC7C,CAAC;AACD,0BAAgB;AAAA,QAClB;AAAA,MACF;AAAA,IACF;AACA,UAAM,GAAG,MAAM;AACf,eAAW,SAAS,cAAc;AAChC,YAAM,6BAA6B,SAAS,KAAK;AAAA,IACnD;AAAA,EACF;AAEA,SAAO,EAAE,SAAS,aAAa;AACjC;",
+  "names": []
+}

package/dist/modules/push_notifications/lib/push-stub-adapter.js

@@ -0,0 +1,63 @@
+import { z } from "zod";
+import {
+  BasePushChannelAdapter,
+  deviceUnregisteredResult,
+  readPushToken
+} from "@open-mercato/core/modules/communication_channels/lib/push-adapter";
+import { readPushEnvelope } from "@open-mercato/core/modules/communication_channels/lib/push-envelope";
+import {
+  hasChannelAdapter,
+  registerChannelAdapter
+} from "@open-mercato/core/modules/communication_channels/lib/adapter-registry-singleton";
+const PUSH_STUB_PROVIDER_KEY = "push_stub";
+const PUSH_STUB_ENV = "OM_ENABLE_PUSH_STUB_ADAPTER";
+function isPushStubEnabled() {
+  const raw = process.env[PUSH_STUB_ENV];
+  if (typeof raw !== "string") return false;
+  return ["1", "true", "yes", "on"].includes(raw.trim().toLowerCase());
+}
+class PushStubChannelAdapter extends BasePushChannelAdapter {
+  constructor() {
+    super(...arguments);
+    this.providerKey = PUSH_STUB_PROVIDER_KEY;
+    this.credentialsSchema = z.object({}).passthrough();
+  }
+  async sendMessage(input) {
+    const token = readPushToken(input) ?? "";
+    if (token.includes("unregistered")) {
+      return deviceUnregisteredResult({ stub: true });
+    }
+    if (token.includes("fail")) {
+      return { externalMessageId: "", status: "failed", error: "push_stub_forced_failure", metadata: { stub: true } };
+    }
+    const envelope = readPushEnvelope(input.content);
+    return {
+      externalMessageId: `push-stub-${token.slice(-8) || "token"}`,
+      status: "sent",
+      metadata: {
+        stub: true,
+        silent: envelope.silent,
+        data: envelope.data,
+        options: envelope.options
+      }
+    };
+  }
+}
+let cachedPushStubAdapter = null;
+function getPushStubAdapter() {
+  if (!cachedPushStubAdapter) cachedPushStubAdapter = new PushStubChannelAdapter();
+  return cachedPushStubAdapter;
+}
+function ensurePushStubAdapterRegistered() {
+  if (!isPushStubEnabled()) return;
+  if (hasChannelAdapter(PUSH_STUB_PROVIDER_KEY)) return;
+  registerChannelAdapter(getPushStubAdapter());
+}
+export {
+  PUSH_STUB_ENV,
+  PUSH_STUB_PROVIDER_KEY,
+  ensurePushStubAdapterRegistered,
+  getPushStubAdapter,
+  isPushStubEnabled
+};
+//# sourceMappingURL=push-stub-adapter.js.map

package/dist/modules/push_notifications/lib/push-stub-adapter.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/push_notifications/lib/push-stub-adapter.ts"],
+  "sourcesContent": ["import { z } from 'zod'\nimport type {\n  SendMessageInput,\n  SendMessageResult,\n} from '@open-mercato/core/modules/communication_channels/lib/adapter'\nimport {\n  BasePushChannelAdapter,\n  deviceUnregisteredResult,\n  readPushToken,\n} from '@open-mercato/core/modules/communication_channels/lib/push-adapter'\nimport { readPushEnvelope } from '@open-mercato/core/modules/communication_channels/lib/push-envelope'\nimport {\n  hasChannelAdapter,\n  registerChannelAdapter,\n} from '@open-mercato/core/modules/communication_channels/lib/adapter-registry-singleton'\n\n/**\n * In-process, network-free `push` channel adapter used ONLY by tests.\n *\n * Real provider adapters (FCM/APNs/Expo) land in Phase 4 as separate channel packages. Phase 3 ships\n * this stub so the strategy \u2192 delivery-row \u2192 worker \u2192 `sendMessage` chain is exercisable end-to-end.\n *\n * Token sentinels let a test drive each worker branch deterministically:\n *   - a token containing `unregistered` \u2192 the uniform `unregistered` shape (worker soft-deletes the device)\n *   - a token containing `fail`         \u2192 a retryable failure (worker retries then marks `failed`)\n *   - otherwise                          \u2192 `sent`\n *\n * Production safety: never registered at module import. The integration harness calls\n * {@link ensurePushStubAdapterRegistered}, gated by `OM_ENABLE_PUSH_STUB_ADAPTER`.\n */\nexport const PUSH_STUB_PROVIDER_KEY = 'push_stub'\nexport const PUSH_STUB_ENV = 'OM_ENABLE_PUSH_STUB_ADAPTER'\n\nexport function isPushStubEnabled(): boolean {\n  const raw = process.env[PUSH_STUB_ENV]\n  if (typeof raw !== 'string') return false\n  return ['1', 'true', 'yes', 'on'].includes(raw.trim().toLowerCase())\n}\n\nclass PushStubChannelAdapter extends BasePushChannelAdapter {\n  readonly providerKey = PUSH_STUB_PROVIDER_KEY\n  protected readonly credentialsSchema = z.object({}).passthrough()\n\n  async sendMessage(input: SendMessageInput): Promise<SendMessageResult> {\n    const token = readPushToken(input) ?? ''\n    if (token.includes('unregistered')) {\n      return deviceUnregisteredResult({ stub: true })\n    }\n    if (token.includes('fail')) {\n      return { externalMessageId: '', status: 'failed', error: 'push_stub_forced_failure', metadata: { stub: true } }\n    }\n    // Surface the resolved envelope (silent flag, custom data, mapped options) so\n    // integration tests can assert what the worker handed the adapter per delivery.\n    const envelope = readPushEnvelope(input.content)\n    return {\n      externalMessageId: `push-stub-${token.slice(-8) || 'token'}`,\n      status: 'sent',\n      metadata: {\n        stub: true,\n        silent: envelope.silent,\n        data: envelope.data,\n        options: envelope.options,\n      },\n    }\n  }\n}\n\nlet cachedPushStubAdapter: PushStubChannelAdapter | null = null\n\nexport function getPushStubAdapter(): PushStubChannelAdapter {\n  if (!cachedPushStubAdapter) cachedPushStubAdapter = new PushStubChannelAdapter()\n  return cachedPushStubAdapter\n}\n\n/** Register the push stub adapter once, ONLY when the test env flag is set. No-op otherwise. */\nexport function ensurePushStubAdapterRegistered(): void {\n  if (!isPushStubEnabled()) return\n  if (hasChannelAdapter(PUSH_STUB_PROVIDER_KEY)) return\n  registerChannelAdapter(getPushStubAdapter())\n}\n"],
+  "mappings": "AAAA,SAAS,SAAS;AAKlB;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,wBAAwB;AACjC;AAAA,EACE;AAAA,EACA;AAAA,OACK;AAgBA,MAAM,yBAAyB;AAC/B,MAAM,gBAAgB;AAEtB,SAAS,oBAA6B;AAC3C,QAAM,MAAM,QAAQ,IAAI,aAAa;AACrC,MAAI,OAAO,QAAQ,SAAU,QAAO;AACpC,SAAO,CAAC,KAAK,QAAQ,OAAO,IAAI,EAAE,SAAS,IAAI,KAAK,EAAE,YAAY,CAAC;AACrE;AAEA,MAAM,+BAA+B,uBAAuB;AAAA,EAA5D;AAAA;AACE,SAAS,cAAc;AACvB,SAAmB,oBAAoB,EAAE,OAAO,CAAC,CAAC,EAAE,YAAY;AAAA;AAAA,EAEhE,MAAM,YAAY,OAAqD;AACrE,UAAM,QAAQ,cAAc,KAAK,KAAK;AACtC,QAAI,MAAM,SAAS,cAAc,GAAG;AAClC,aAAO,yBAAyB,EAAE,MAAM,KAAK,CAAC;AAAA,IAChD;AACA,QAAI,MAAM,SAAS,MAAM,GAAG;AAC1B,aAAO,EAAE,mBAAmB,IAAI,QAAQ,UAAU,OAAO,4BAA4B,UAAU,EAAE,MAAM,KAAK,EAAE;AAAA,IAChH;AAGA,UAAM,WAAW,iBAAiB,MAAM,OAAO;AAC/C,WAAO;AAAA,MACL,mBAAmB,aAAa,MAAM,MAAM,EAAE,KAAK,OAAO;AAAA,MAC1D,QAAQ;AAAA,MACR,UAAU;AAAA,QACR,MAAM;AAAA,QACN,QAAQ,SAAS;AAAA,QACjB,MAAM,SAAS;AAAA,QACf,SAAS,SAAS;AAAA,MACpB;AAAA,IACF;AAAA,EACF;AACF;AAEA,IAAI,wBAAuD;AAEpD,SAAS,qBAA6C;AAC3D,MAAI,CAAC,sBAAuB,yBAAwB,IAAI,uBAAuB;AAC/E,SAAO;AACT;AAGO,SAAS,kCAAwC;AACtD,MAAI,CAAC,kBAAkB,EAAG;AAC1B,MAAI,kBAAkB,sBAAsB,EAAG;AAC/C,yBAAuB,mBAAmB,CAAC;AAC7C;",
+  "names": []
+}

package/dist/modules/push_notifications/lib/queue.js

@@ -0,0 +1,53 @@
+import { createModuleQueue } from "@open-mercato/queue";
+import { createLogger } from "@open-mercato/shared/lib/logger";
+const logger = createLogger("push_notifications");
+const PUSH_DELIVERIES_QUEUE = "push-deliveries";
+const PUSH_STUCK_RECLAIM_QUEUE = "push-stuck-reclaim";
+const queues = /* @__PURE__ */ new Map();
+const LOCAL_WORKER_PROMISE_KEY = "__openMercatoPushLocalWorkerPromise__";
+function getPushQueue(queueName = PUSH_DELIVERIES_QUEUE) {
+  const existing = queues.get(queueName);
+  if (existing) return existing;
+  const concurrency = Math.max(1, Number.parseInt(process.env.PUSH_QUEUE_CONCURRENCY ?? "8", 10) || 8);
+  const created = createModuleQueue(queueName, { concurrency });
+  queues.set(queueName, created);
+  return created;
+}
+async function ensureLocalPushQueueWorkerStarted() {
+  if (process.env.QUEUE_STRATEGY === "async") return;
+  const globalStore = globalThis;
+  if (globalStore[LOCAL_WORKER_PROMISE_KEY]) {
+    await globalStore[LOCAL_WORKER_PROMISE_KEY];
+    return;
+  }
+  globalStore[LOCAL_WORKER_PROMISE_KEY] = (async () => {
+    const queue = getPushQueue();
+    await queue.process(async (job) => {
+      const [{ createRequestContainer }, { processPushDeliveryJob }] = await Promise.all([
+        import("@open-mercato/shared/lib/di/container"),
+        import("./push-delivery.js")
+      ]);
+      const container = await createRequestContainer();
+      const em = container.resolve("em").fork();
+      await processPushDeliveryJob(em, job.payload, (name) => container.resolve(name));
+    });
+  })().catch((error) => {
+    delete globalStore[LOCAL_WORKER_PROMISE_KEY];
+    logger.error("Failed to start local delivery worker", { error });
+    throw error;
+  });
+  await globalStore[LOCAL_WORKER_PROMISE_KEY];
+}
+async function enqueuePushDelivery(job, delayMs) {
+  const queue = getPushQueue();
+  const jobId = await queue.enqueue(job, delayMs && delayMs > 0 ? { delayMs } : void 0);
+  await ensureLocalPushQueueWorkerStarted();
+  return jobId;
+}
+export {
+  PUSH_DELIVERIES_QUEUE,
+  PUSH_STUCK_RECLAIM_QUEUE,
+  enqueuePushDelivery,
+  getPushQueue
+};
+//# sourceMappingURL=queue.js.map