@open-mercato/core 0.6.8-develop.6984.1.f0cf23f0f6 → 0.6.8-develop.6985.1.fb93574faa

package/generated/entities/push_notification_delivery/index.ts

@@ -0,0 +1,19 @@
+export const id = "id";
+export const tenant_id = "tenant_id";
+export const organization_id = "organization_id";
+export const notification_id = "notification_id";
+export const notification_type_id = "notification_type_id";
+export const user_device_id = "user_device_id";
+export const user_id = "user_id";
+export const provider = "provider";
+export const token_snapshot = "token_snapshot";
+export const silent = "silent";
+export const status = "status";
+export const attempts = "attempts";
+export const last_error = "last_error";
+export const payload = "payload";
+export const provider_response = "provider_response";
+export const created_at = "created_at";
+export const sent_at = "sent_at";
+export const next_retry_at = "next_retry_at";
+export const updated_at = "updated_at";

package/generated/entities/user_device/index.ts

@@ -0,0 +1,16 @@
+export const id = "id";
+export const tenant_id = "tenant_id";
+export const organization_id = "organization_id";
+export const user_id = "user_id";
+export const device_id = "device_id";
+export const platform = "platform";
+export const client_app_version = "client_app_version";
+export const os_version = "os_version";
+export const locale = "locale";
+export const push_token = "push_token";
+export const push_provider = "push_provider";
+export const push_token_updated_at = "push_token_updated_at";
+export const last_seen_at = "last_seen_at";
+export const created_at = "created_at";
+export const updated_at = "updated_at";
+export const deleted_at = "deleted_at";

package/generated/entities.ids.generated.ts

@@ -14,6 +14,7 @@ export const M = {
     "sales": "sales",
     "wms": "wms",
     "api_keys": "api_keys",
+    "devices": "devices",
     "dictionaries": "dictionaries",
     "api_docs": "api_docs",
     "design_system": "design_system",
@@ -31,6 +32,7 @@ export const M = {
     "sync_excel": "sync_excel",
     "messages": "messages",
     "communication_channels": "communication_channels",
+    "push_notifications": "push_notifications",
     "translations": "translations",
     "inbox_ops": "inbox_ops",
     "payment_gateways": "payment_gateways",
@@ -178,6 +180,9 @@ export const M = {
     "api_keys": {
       "api_key": "api_keys:api_key"
     },
+    "devices": {
+      "user_device": "devices:user_device"
+    },
     "dictionaries": {
       "dictionary": "dictionaries:dictionary",
       "dictionary_entry": "dictionaries:dictionary_entry"
@@ -233,7 +238,10 @@ export const M = {
       "staff_time_project_member": "staff:staff_time_project_member"
     },
     "notifications": {
-      "notification": "notifications:notification"
+      "notification": "notifications:notification",
+      "notification_type": "notifications:notification_type",
+      "notification_type_override": "notifications:notification_type_override",
+      "notification_preference": "notifications:notification_preference"
     },
     "progress": {
       "progress_job": "progress:progress_job"
@@ -270,6 +278,9 @@ export const M = {
       "channel_thread_token": "communication_channels:channel_thread_token",
       "channel_ingest_dead_letter": "communication_channels:channel_ingest_dead_letter"
     },
+    "push_notifications": {
+      "push_notification_delivery": "push_notifications:push_notification_delivery"
+    },
     "translations": {
       "entity_translation": "translations:entity_translation"
     },

package/generated/entity-fields-registry.ts

@@ -1790,6 +1790,9 @@ export const entityFieldsRegistry: Record<string, Record<string, string>> = {
       "source_entity_id": "source_entity_id",
       "link_href": "link_href",
       "group_key": "group_key",
+      "data": "data",
+      "push_options": "push_options",
+      "channels": "channels",
       "created_at": "created_at",
       "read_at": "read_at",
       "actioned_at": "actioned_at",
@@ -1798,6 +1801,36 @@ export const entityFieldsRegistry: Record<string, Record<string, string>> = {
       "tenant_id": "tenant_id",
       "organization_id": "organization_id"
     },
+    "notification_preference": {
+      "id": "id",
+      "tenant_id": "tenant_id",
+      "user_id": "user_id",
+      "notification_type_id": "notification_type_id",
+      "channel": "channel",
+      "enabled": "enabled",
+      "created_at": "created_at",
+      "updated_at": "updated_at"
+    },
+    "notification_type": {
+      "id": "id",
+      "tenant_id": "tenant_id",
+      "label_key": "label_key",
+      "description_key": "description_key",
+      "category": "category",
+      "silent": "silent",
+      "non_opt_out": "non_opt_out",
+      "created_at": "created_at",
+      "updated_at": "updated_at"
+    },
+    "notification_type_override": {
+      "id": "id",
+      "tenant_id": "tenant_id",
+      "notification_type_id": "notification_type_id",
+      "channels": "channels",
+      "non_opt_out": "non_opt_out",
+      "created_at": "created_at",
+      "updated_at": "updated_at"
+    },
     "organization": {
       "id": "id",
       "tenant": "tenant",
@@ -1907,6 +1940,27 @@ export const entityFieldsRegistry: Record<string, Record<string, string>> = {
       "created_at": "created_at",
       "updated_at": "updated_at"
     },
+    "push_notification_delivery": {
+      "id": "id",
+      "tenant_id": "tenant_id",
+      "organization_id": "organization_id",
+      "notification_id": "notification_id",
+      "notification_type_id": "notification_type_id",
+      "user_device_id": "user_device_id",
+      "user_id": "user_id",
+      "provider": "provider",
+      "token_snapshot": "token_snapshot",
+      "silent": "silent",
+      "status": "status",
+      "attempts": "attempts",
+      "last_error": "last_error",
+      "payload": "payload",
+      "provider_response": "provider_response",
+      "created_at": "created_at",
+      "sent_at": "sent_at",
+      "next_retry_at": "next_retry_at",
+      "updated_at": "updated_at"
+    },
     "resources_resource": {
       "id": "id",
       "tenant_id": "tenant_id",
@@ -3125,6 +3179,24 @@ export const entityFieldsRegistry: Record<string, Record<string, string>> = {
       "updated_at": "updated_at",
       "deleted_at": "deleted_at"
     },
+    "user_device": {
+      "id": "id",
+      "tenant_id": "tenant_id",
+      "organization_id": "organization_id",
+      "user_id": "user_id",
+      "device_id": "device_id",
+      "platform": "platform",
+      "client_app_version": "client_app_version",
+      "os_version": "os_version",
+      "locale": "locale",
+      "push_token": "push_token",
+      "push_provider": "push_provider",
+      "push_token_updated_at": "push_token_updated_at",
+      "last_seen_at": "last_seen_at",
+      "created_at": "created_at",
+      "updated_at": "updated_at",
+      "deleted_at": "deleted_at"
+    },
     "user_role": {
       "id": "id",
       "user": "user",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@open-mercato/core",
-  "version": "0.6.8-develop.6984.1.f0cf23f0f6",
+  "version": "0.6.8-develop.6985.1.fb93574faa",
   "license": "MIT",
   "type": "module",
   "main": "./dist/index.js",
@@ -254,16 +254,16 @@
     "zod": "^4.4.3"
   },
   "peerDependencies": {
-    "@open-mercato/ai-assistant": "0.6.8-develop.6984.1.f0cf23f0f6",
-    "@open-mercato/shared": "0.6.8-develop.6984.1.f0cf23f0f6",
-    "@open-mercato/ui": "0.6.8-develop.6984.1.f0cf23f0f6",
+    "@open-mercato/ai-assistant": "0.6.8-develop.6985.1.fb93574faa",
+    "@open-mercato/shared": "0.6.8-develop.6985.1.fb93574faa",
+    "@open-mercato/ui": "0.6.8-develop.6985.1.fb93574faa",
     "react": "^19.0.0",
     "react-dom": "^19.0.0"
   },
   "devDependencies": {
-    "@open-mercato/ai-assistant": "0.6.8-develop.6984.1.f0cf23f0f6",
-    "@open-mercato/shared": "0.6.8-develop.6984.1.f0cf23f0f6",
-    "@open-mercato/ui": "0.6.8-develop.6984.1.f0cf23f0f6",
+    "@open-mercato/ai-assistant": "0.6.8-develop.6985.1.fb93574faa",
+    "@open-mercato/shared": "0.6.8-develop.6985.1.fb93574faa",
+    "@open-mercato/ui": "0.6.8-develop.6985.1.fb93574faa",
     "@testing-library/dom": "^10.4.1",
     "@testing-library/jest-dom": "^7.0.0",
     "@testing-library/react": "^16.3.1",

package/src/helpers/integration/api.ts

@@ -95,11 +95,12 @@ export async function apiRequest(
   request: APIRequestContext,
   method: string,
   path: string,
-  options: { token: string; data?: unknown; timeout?: number },
+  options: { token: string; data?: unknown; timeout?: number; headers?: Record<string, string> },
 ) {
   const headers = {
     Authorization: `Bearer ${options.token}`,
     'Content-Type': 'application/json',
+    ...(options.headers ?? {}),
   };
   const timeout = options.timeout ?? 30_000;
   let lastError: unknown = null;

package/src/helpers/integration/appRoot.ts

@@ -0,0 +1,13 @@
+import path from 'node:path'
+
+/**
+ * The app root an integration test targets: `OM_TEST_APP_ROOT` when a standalone app is under test,
+ * else the monorepo's `apps/mercato` (the Playwright process runs from the repo root, so its `cwd` is
+ * not the app root).
+ *
+ * Single source for what was previously re-derived in `queue.ts`, `dbFixtures.ts`, and `pushFake.ts`.
+ */
+export function resolveAppRoot(input?: string): string {
+  const explicit = input?.trim() || process.env.OM_TEST_APP_ROOT?.trim()
+  return explicit ? path.resolve(explicit) : path.resolve(process.cwd(), 'apps/mercato')
+}

package/src/helpers/integration/dbFixtures.ts

@@ -1,6 +1,7 @@
 import { readFileSync } from 'node:fs';
 import path from 'node:path';
 import { Client } from 'pg';
+import { resolveAppRoot } from './appRoot';
 
 /**
  * Database fixtures for the org-scope fail-open hardening tests.
@@ -14,11 +15,6 @@ import { Client } from 'pg';
  * `dist/` output for an in-process MikroORM bootstrap.
  */
 
-function resolveAppRoot(): string {
-  const fromEnv = process.env.OM_TEST_APP_ROOT?.trim();
-  return fromEnv ? path.resolve(fromEnv) : path.resolve(process.cwd(), 'apps/mercato');
-}
-
 function readEnvValue(key: string): string | undefined {
   if (process.env[key]) return process.env[key];
   const candidatePaths = [

package/src/helpers/integration/pushFake.ts

@@ -0,0 +1,219 @@
+import { generateKeyPairSync } from 'node:crypto'
+import path from 'node:path'
+import { expect, type APIRequestContext } from '@playwright/test'
+import {
+  findFakePush,
+  resolveQueueBaseDir,
+  uniquePushTokenTail,
+  type FakePushEntry,
+  type FakePushProvider,
+} from '../../modules/push_notifications/lib/fake-provider-recorder'
+import { apiRequest } from './api'
+import { resolveAppRoot } from './appRoot'
+import { deleteEntityByPathIfExists, expectId, readJsonSafe } from './generalFixtures'
+import { withClient } from './dbFixtures'
+
+/**
+ * Harness for the `OM_PUSH_FAKE_PROVIDERS` integration specs (TC-PUSH-004+, TC-CHANNEL-PUSH-005+).
+ *
+ * The fake replaces each provider's SDK client, so the REAL adapter runs and records the
+ * provider-native message it built. The worker does that in a different process than the spec, so the
+ * message travels through a JSONL sink under the queue's own base dir rather than the delivery row —
+ * no adapter returns `metadata` on success, and APNs deliberately reports an empty `externalMessageId`.
+ */
+/**
+ * The Playwright process runs from the repo root, so its `cwd` is not the app root. Pin `QUEUE_BASE_DIR`
+ * once, before anything resolves it, so the spec, the worker, and the drain child all agree on the queue
+ * dir and the sink inside it. Never overrides a dir the harness already chose (the ephemeral runner
+ * sets its own).
+ */
+if (!process.env.QUEUE_BASE_DIR?.trim()) {
+  process.env.QUEUE_BASE_DIR = path.resolve(resolveAppRoot(), '.mercato/queue')
+}
+
+/** Re-exported so specs never hand-roll a second, divergent fallback (see TC-PUSH-008). */
+export { resolveQueueBaseDir, uniquePushTokenTail }
+
+/** The canonical channel teardown — API-based, not raw SQL. Re-exported so specs import one module. */
+export { deleteChannelIfExists } from './communicationChannelsFixtures'
+
+export const TENANT_CONNECT_PATH = '/api/communication_channels/channels/connect/tenant-credentials'
+export const DEVICES_PATH = '/api/devices'
+export const NOTIFICATIONS_PATH = '/api/notifications'
+
+/** A push token whose last 8 chars are unique to this run — the sink and delivery row are keyed on them. */
+export function makeFakePushToken(provider: FakePushProvider): { pushToken: string; tokenTail: string } {
+  const tokenTail = uniquePushTokenTail()
+  return { pushToken: `qa-${provider}-token-${tokenTail}`, tokenTail }
+}
+
+/** A push token that drives the given branch, keeping the run-unique tail. */
+export function makeFakePushTokenFor(
+  provider: FakePushProvider,
+  sentinel: 'unregistered' | 'fail',
+): { pushToken: string; tokenTail: string } {
+  const tokenTail = uniquePushTokenTail()
+  return { pushToken: `qa-${provider}-${sentinel}-token-${tokenTail}`, tokenTail }
+}
+
+export type PushDeliveryRow = {
+  status: string
+  token_snapshot: string
+  organization_id: string | null
+  provider: string
+  attempts: number
+  silent: boolean
+  sent_at: string | null
+  last_error: string | null
+  provider_response: Record<string, unknown> | null
+}
+
+/**
+ * A throwaway ES256 (P-256) key in PKCS#8 PEM — the curve Apple's `.p8` signing
+ * keys use. `apnsCredentialsSchema` structurally parses `p8Key`, so the fixture
+ * must be a genuinely parseable key; generating it per process keeps a private
+ * key out of the repository.
+ */
+const FAKE_APNS_P8_KEY = generateKeyPairSync('ec', {
+  namedCurve: 'P-256',
+  privateKeyEncoding: { type: 'pkcs8', format: 'pem' },
+  publicKeyEncoding: { type: 'spki', format: 'pem' },
+}).privateKey
+
+/**
+ * Valid-*shaped* fake credentials. `validateCredentials` is schema-only — it checks
+ * structure (APNs additionally parses the `.p8` and pins Apple's identifier formats),
+ * never that the provider accepts them; real parsing lives in the faked SDK client.
+ */
+export const FAKE_PUSH_CREDENTIALS: Record<FakePushProvider, Record<string, unknown>> = {
+  fcm: {
+    serviceAccountJson: JSON.stringify({
+      project_id: 'om-fake-project',
+      client_email: 'fake@om-fake-project.iam.gserviceaccount.com',
+      private_key: '-----BEGIN PRIVATE KEY-----\nom-fake-key\n-----END PRIVATE KEY-----\n',
+    }),
+  },
+  apns: {
+    p8Key: FAKE_APNS_P8_KEY,
+    keyId: 'FAKEKEYID1',
+    teamId: 'FAKETEAMID',
+    bundleId: 'com.openmercato.fake',
+    production: false,
+  },
+  expo: {
+    accessToken: 'om-fake-expo-token',
+  },
+}
+
+/**
+ * Connect a tenant-wide push channel through the real credential-connect route.
+ *
+ * Not `seedConnectedChannel` from `communicationChannelsFixtures`: that seeds the `__test_seed__`
+ * provider, whereas these specs must drive the real `fcm`/`apns`/`expo` connect path so the adapter's own
+ * `validateCredentials` runs. Tear down with `deleteChannelIfExists` from that same module.
+ */
+export async function connectFakePushChannel(
+  request: APIRequestContext,
+  token: string,
+  provider: FakePushProvider,
+  displayName: string,
+): Promise<string> {
+  const response = await apiRequest(request, 'POST', TENANT_CONNECT_PATH, {
+    token,
+    data: { providerKey: provider, displayName, credentials: FAKE_PUSH_CREDENTIALS[provider] },
+  })
+  expect(response.status(), `connect ${provider} channel`).toBe(201)
+  const body = await readJsonSafe<{ channelId?: string }>(response)
+  return expectId(body?.channelId, `connect ${provider} response should include channelId`)
+}
+
+/**
+ * Register a device routed to `provider`. The token tail keys both the delivery row's
+ * `token_snapshot` and the recorded native message, isolating concurrent specs.
+ */
+export async function registerFakePushDevice(
+  request: APIRequestContext,
+  token: string,
+  provider: FakePushProvider,
+  pushToken: string,
+  deviceId: string,
+): Promise<string> {
+  const response = await apiRequest(request, 'POST', DEVICES_PATH, {
+    token,
+    data: { deviceId, platform: provider === 'apns' ? 'ios' : 'android', pushToken, pushProvider: provider },
+  })
+  expect(response.status(), `register ${provider} device`).toBe(201)
+  const body = await readJsonSafe<{ id?: string }>(response)
+  return expectId(body?.id, `register ${provider} device response should include id`)
+}
+
+/** Teardown counterpart to {@link registerFakePushDevice}. */
+export async function deleteFakePushDevice(
+  request: APIRequestContext,
+  token: string | null,
+  userDeviceId: string | null,
+): Promise<void> {
+  if (!userDeviceId) return
+  await deleteEntityByPathIfExists(request, token, `${DEVICES_PATH}/${userDeviceId}`)
+}
+
+export async function deleteDeliveriesForDevice(userDeviceId: string | null): Promise<void> {
+  if (!userDeviceId) return
+  await withClient(async (client) => {
+    await client.query('delete from push_notification_deliveries where user_device_id = $1', [userDeviceId])
+  }).catch(() => undefined)
+}
+
+export async function readLatestDelivery(tenantId: string, userDeviceId: string): Promise<PushDeliveryRow | null> {
+  return withClient(async (client) => {
+    const res = await client.query(
+      `select status, token_snapshot, organization_id, provider, attempts, silent, sent_at, last_error, provider_response
+         from push_notification_deliveries
+        where tenant_id = $1 and user_device_id = $2
+        order by created_at desc
+        limit 1`,
+      [tenantId, userDeviceId],
+    )
+    return (res.rows[0] as PushDeliveryRow | undefined) ?? null
+  })
+}
+
+/**
+ * True once the device has been soft-deleted (the `device_unregistered` contract).
+ *
+ * A MISSING row returns `false`, not `true`: soft-delete keeps the row, so an absent one means the
+ * device was never created or a neighbouring teardown hard-deleted it. Returning `true` there would let
+ * the central assertion of TC-PUSH-004/008 pass vacuously.
+ */
+export async function isDeviceSoftDeleted(userDeviceId: string): Promise<boolean> {
+  return withClient(async (client) => {
+    const res = await client.query('select deleted_at from user_devices where id = $1', [userDeviceId])
+    if (res.rows.length === 0) return false
+    return res.rows[0].deleted_at != null
+  })
+}
+
+/** The provider-native message the REAL adapter handed the faked SDK client. */
+export function readNativeMessage(
+  provider: FakePushProvider,
+  tokenTail: string,
+  sinceIso?: string,
+): FakePushEntry | undefined {
+  return findFakePush(provider, tokenTail, sinceIso)
+}
+
+/**
+ * Wait for the message this run's worker recorded. Pass `sinceIso` to reject entries from an earlier
+ * run — the sink is append-only and the reused-environment path never truncates it. The default
+ * (epoch) accepts every recorded entry.
+ */
+export async function expectNativeMessage(
+  provider: FakePushProvider,
+  tokenTail: string,
+  sinceIso: string = new Date(0).toISOString(),
+): Promise<Record<string, unknown>> {
+  await expect
+    .poll(() => readNativeMessage(provider, tokenTail, sinceIso)?.native ?? null, { timeout: 30_000 })
+    .not.toBeNull()
+  return readNativeMessage(provider, tokenTail, sinceIso)!.native
+}

package/src/modules/auth/i18n/de.json

@@ -227,6 +227,7 @@
   "backend.nav.externalSystems": "Externe Systeme",
   "backend.nav.settings": "Einstellungen",
   "backend.nav.settingsAdmin": "Administration",
+  "notifications.categories.auth": "Sicherheit",
   "profile.page.description": "Verwalte deine Kontoeinstellungen",
   "profile.page.selectItem": "Wähle ein Element aus dem Menü, um dein Konto zu verwalten.",
   "profile.page.title": "Profil",

package/src/modules/auth/i18n/en.json

@@ -227,6 +227,7 @@
   "backend.nav.externalSystems": "External systems",
   "backend.nav.settings": "Settings",
   "backend.nav.settingsAdmin": "Administration",
+  "notifications.categories.auth": "Security",
   "profile.page.description": "Manage your account settings",
   "profile.page.selectItem": "Select an item from the menu to manage your account.",
   "profile.page.title": "Profile",

package/src/modules/auth/i18n/es.json

@@ -227,6 +227,7 @@
   "backend.nav.externalSystems": "Sistemas externos",
   "backend.nav.settings": "Configuración",
   "backend.nav.settingsAdmin": "Administración",
+  "notifications.categories.auth": "Seguridad",
   "profile.page.description": "Administra la configuración de tu cuenta",
   "profile.page.selectItem": "Selecciona un elemento del menú para administrar tu cuenta.",
   "profile.page.title": "Perfil",

package/src/modules/auth/i18n/ko.json

@@ -227,6 +227,7 @@
   "backend.nav.externalSystems": "외부 시스템",
   "backend.nav.settings": "설정",
   "backend.nav.settingsAdmin": "관리",
+  "notifications.categories.auth": "보안",
   "profile.page.description": "계정 설정을 관리합니다",
   "profile.page.selectItem": "메뉴에서 항목을 선택하여 계정을 관리하세요.",
   "profile.page.title": "프로필",

package/src/modules/auth/i18n/pl.json

@@ -227,6 +227,7 @@
   "backend.nav.externalSystems": "Systemy zewnetrzne",
   "backend.nav.settings": "Ustawienia",
   "backend.nav.settingsAdmin": "Administracja",
+  "notifications.categories.auth": "Bezpiecze\u0144stwo",
   "profile.page.description": "Zarządzaj ustawieniami konta",
   "profile.page.selectItem": "Wybierz element z menu, aby zarządzać swoim kontem.",
   "profile.page.title": "Profil",

package/src/modules/auth/notifications.ts

@@ -3,6 +3,8 @@ import type { NotificationTypeDefinition } from '@open-mercato/shared/modules/no
 export const notificationTypes: NotificationTypeDefinition[] = [
   {
     type: 'auth.password_reset.requested',
+    // Ships without push — operators re-enable it per type from the Notification Delivery settings.
+    channels: ['in_app', 'email'],
     module: 'auth',
     titleKey: 'auth.notifications.passwordReset.requested.title',
     bodyKey: 'auth.notifications.passwordReset.requested.body',
@@ -22,6 +24,8 @@ export const notificationTypes: NotificationTypeDefinition[] = [
   },
   {
     type: 'auth.password_reset.completed',
+    // Ships without push — operators re-enable it per type from the Notification Delivery settings.
+    channels: ['in_app', 'email'],
     module: 'auth',
     titleKey: 'auth.notifications.passwordReset.completed.title',
     bodyKey: 'auth.notifications.passwordReset.completed.body',
@@ -32,11 +36,15 @@ export const notificationTypes: NotificationTypeDefinition[] = [
   },
   {
     type: 'auth.account.locked',
+    // Ships without push — operators re-enable it per type from the Notification Delivery settings.
+    channels: ['in_app', 'email'],
     module: 'auth',
     titleKey: 'auth.notifications.account.locked.title',
     bodyKey: 'auth.notifications.account.locked.body',
     icon: 'lock',
     severity: 'warning',
+    // Security alert — the user must not be able to silence it.
+    nonOptOut: true,
     actions: [
       {
         id: 'contact_support',
@@ -50,11 +58,15 @@ export const notificationTypes: NotificationTypeDefinition[] = [
   },
   {
     type: 'auth.login.new_device',
+    // Ships without push — operators re-enable it per type from the Notification Delivery settings.
+    channels: ['in_app', 'email'],
     module: 'auth',
     titleKey: 'auth.notifications.login.newDevice.title',
     bodyKey: 'auth.notifications.login.newDevice.body',
     icon: 'smartphone',
     severity: 'info',
+    // Security alert — the user must not be able to silence it.
+    nonOptOut: true,
     actions: [
       {
         id: 'view_sessions',
@@ -69,6 +81,8 @@ export const notificationTypes: NotificationTypeDefinition[] = [
   },
   {
     type: 'auth.role.assigned',
+    // Ships without push — operators re-enable it per type from the Notification Delivery settings.
+    channels: ['in_app', 'email'],
     module: 'auth',
     titleKey: 'auth.notifications.role.assigned.title',
     bodyKey: 'auth.notifications.role.assigned.body',
@@ -88,6 +102,8 @@ export const notificationTypes: NotificationTypeDefinition[] = [
   },
   {
     type: 'auth.role.revoked',
+    // Ships without push — operators re-enable it per type from the Notification Delivery settings.
+    channels: ['in_app', 'email'],
     module: 'auth',
     titleKey: 'auth.notifications.role.revoked.title',
     bodyKey: 'auth.notifications.role.revoked.body',

package/src/modules/business_rules/i18n/de.json

@@ -392,5 +392,6 @@
   "common.remove": "Entfernen",
   "common.retry": "Wiederholen",
   "common.unknown": "Unbekannt",
-  "common.yes": "Ja"
+  "common.yes": "Ja",
+  "notifications.categories.business_rules": "Geschäftsregeln"
 }

package/src/modules/business_rules/i18n/en.json

@@ -392,5 +392,6 @@
   "common.remove": "Remove",
   "common.retry": "Retry",
   "common.unknown": "Unknown",
-  "common.yes": "Yes"
+  "common.yes": "Yes",
+  "notifications.categories.business_rules": "Business rules"
 }

package/src/modules/business_rules/i18n/es.json

@@ -392,5 +392,6 @@
   "common.remove": "Eliminar",
   "common.retry": "Reintentar",
   "common.unknown": "Desconocido",
-  "common.yes": "Sí"
+  "common.yes": "Sí",
+  "notifications.categories.business_rules": "Reglas de negocio"
 }

package/src/modules/business_rules/i18n/ko.json

@@ -392,5 +392,6 @@
   "common.remove": "제거",
   "common.retry": "재시도",
   "common.unknown": "알 수 없음",
-  "common.yes": "예"
+  "common.yes": "예",
+  "notifications.categories.business_rules": "비즈니스 규칙"
 }

package/src/modules/business_rules/i18n/pl.json

@@ -392,5 +392,6 @@
   "common.remove": "Usuń",
   "common.retry": "Ponów",
   "common.unknown": "Nieznany",
-  "common.yes": "Tak"
+  "common.yes": "Tak",
+  "notifications.categories.business_rules": "Regu\u0142y biznesowe"
 }

package/src/modules/business_rules/notifications.ts

@@ -3,6 +3,8 @@ import type { NotificationTypeDefinition } from '@open-mercato/shared/modules/no
 export const notificationTypes: NotificationTypeDefinition[] = [
   {
     type: 'business_rules.rule.execution_failed',
+    // Ships without push — operators re-enable it per type from the Notification Delivery settings.
+    channels: ['in_app', 'email'],
     module: 'business_rules',
     titleKey: 'businessRules.notifications.rule.executionFailed.title',
     bodyKey: 'businessRules.notifications.rule.executionFailed.body',