@peanut-admin/admin 0.1.0-alpha.11

package/integration-security/src/runtime.ts

@@ -0,0 +1,180 @@
+import { defineAdminModule } from '@peanut-admin/admin/core'
+import { inject, reactive } from 'vue'
+import type { AdminModuleContribution } from '@peanut-admin/admin/core'
+import type { InjectionKey } from 'vue'
+import { parseAttempt, parseDelivery, parseItem, parseList, parseMachine, parsePage, parseProvisionedMachine, parseProvisionedWebhook, parseSession, parseWebhook } from './contracts'
+import type { IntegrationSecurityTransport, MachineIdentity, Page, ProvisionedMachineIdentity, ProvisionedWebhookEndpoint, SessionDevice, TransportResult, WebhookAttemptRecord, WebhookDeliveryRecord, WebhookEndpoint } from './contracts'
+
+export const INTEGRATION_SECURITY_MODULE_KEY = 'peanut.integration-security' as const
+export const INTEGRATION_SECURITY_ROUTE_PATH = '/app/integration-security' as const
+export const INTEGRATION_SECURITY_ROUTE_PERMISSION = 'peanut.integration-security.access' as const
+export const INTEGRATION_SECURITY_READ_PERMISSIONS = [
+  'peanut.integration-security.machine.read', 'peanut.integration-security.webhook.read',
+  'peanut.integration-security.delivery.read', 'peanut.integration-security.session.read',
+] as const
+
+export type RuntimeErrorCode =
+  | 'INTEGRATION_PERMISSION_DENIED' | 'INTEGRATION_INPUT_INVALID' | 'INTEGRATION_REVISION_CONFLICT'
+  | 'INTEGRATION_REQUEST_FAILED' | 'INTEGRATION_NETWORK_FAILED' | 'INTEGRATION_RESPONSE_INVALID' | 'INTEGRATION_MUTATION_FAILED'
+  | 'MACHINE_IDENTITY_NOT_FOUND' | 'MACHINE_TOKEN_INVALID' | 'MACHINE_TOKEN_EXPIRED' | 'MACHINE_SCOPE_DENIED'
+  | 'WEBHOOK_ENDPOINT_NOT_FOUND' | 'WEBHOOK_DESTINATION_DENIED' | 'WEBHOOK_SECRET_INVALID' | 'SESSION_DEVICE_NOT_FOUND'
+export interface RuntimeError { readonly code: RuntimeErrorCode; readonly message: string; readonly requestId: string | null; readonly status: number | null }
+export interface SurfaceState<T> { items: T[]; loading: boolean; error: RuntimeError | null }
+export interface IntegrationSecurityState {
+  machines: SurfaceState<MachineIdentity>; webhooks: SurfaceState<WebhookEndpoint>
+  deliveries: SurfaceState<WebhookDeliveryRecord> & { page: number; pageSize: number; total: number }
+  attempts: SurfaceState<WebhookAttemptRecord> & { deliveryKey: string | null }
+  sessions: SurfaceState<SessionDevice>; mutating: boolean
+  disclosure: { kind: 'machine-token' | 'webhook-secret'; value: string } | null
+}
+export interface IntegrationSecurityRuntime {
+  readonly state: IntegrationSecurityState
+  load: () => Promise<void>; loadMachines: () => Promise<void>; loadWebhooks: () => Promise<void>; loadDeliveries: (page?: number) => Promise<void>; loadAttempts: (deliveryKey: string) => Promise<void>; loadSessions: () => Promise<void>
+  createMachine: (input: { name: string; scopes: string[]; expires_at: string | null }) => Promise<void>
+  rotateMachine: (identity: MachineIdentity) => Promise<void>; revokeMachine: (identity: MachineIdentity) => Promise<void>
+  createWebhook: (input: { name: string; url: string; events: string[] }) => Promise<void>
+  rotateWebhook: (endpoint: WebhookEndpoint) => Promise<void>; disableWebhook: (endpoint: WebhookEndpoint) => Promise<void>
+  revokeSession: (session: SessionDevice) => Promise<void>; clearDisclosure: () => void; dispose: () => void
+  readonly can: IntegrationSecurityPermissions
+}
+export interface IntegrationSecurityPermissions {
+  readonly canReadMachines: () => boolean; readonly canManageMachines: () => boolean
+  readonly canReadWebhooks: () => boolean; readonly canManageWebhooks: () => boolean
+  readonly canReadDeliveries: () => boolean; readonly canReadSessions: () => boolean; readonly canRevokeSession: () => boolean
+}
+
+const requestIdPattern = /^[A-Za-z0-9][A-Za-z0-9._:-]{7,127}$/
+const messages: Readonly<Record<RuntimeErrorCode, string>> = {
+  INTEGRATION_PERMISSION_DENIED: 'You do not have permission to perform this action.',
+  INTEGRATION_INPUT_INVALID: 'The submitted integration settings are invalid.',
+  INTEGRATION_REQUEST_FAILED: 'The integration security request failed.',
+  INTEGRATION_NETWORK_FAILED: 'The integration security service could not be reached.',
+  INTEGRATION_RESPONSE_INVALID: 'The integration security service returned an invalid response.',
+  INTEGRATION_MUTATION_FAILED: 'The requested integration security change could not be completed.',
+  MACHINE_IDENTITY_NOT_FOUND: 'The machine identity is unavailable.',
+  MACHINE_TOKEN_INVALID: 'The machine credential is invalid.',
+  MACHINE_TOKEN_EXPIRED: 'The machine credential has expired.',
+  MACHINE_SCOPE_DENIED: 'One or more machine scopes cannot be granted.',
+  INTEGRATION_REVISION_CONFLICT: 'This record changed. Refresh and try again.',
+  WEBHOOK_ENDPOINT_NOT_FOUND: 'The webhook endpoint is unavailable.',
+  WEBHOOK_DESTINATION_DENIED: 'The webhook destination is not allowed.',
+  WEBHOOK_SECRET_INVALID: 'The webhook credential is invalid.',
+  SESSION_DEVICE_NOT_FOUND: 'The session is unavailable.',
+}
+const runtimeErrorCodes = new Set<RuntimeErrorCode>(Object.keys(messages) as RuntimeErrorCode[])
+const failure = (result: TransportResult): RuntimeError => {
+  const body = typeof result.body === 'object' && result.body !== null && !Array.isArray(result.body) ? result.body as Record<string, unknown> : {}
+  const code: RuntimeErrorCode = typeof body.code === 'string' && runtimeErrorCodes.has(body.code as RuntimeErrorCode) ? body.code as RuntimeErrorCode : 'INTEGRATION_REQUEST_FAILED'
+  const candidate = body.request_id ?? result.headers.get('X-Request-Id')
+  return { code, message: messages[code], requestId: typeof candidate === 'string' && requestIdPattern.test(candidate) ? candidate : null, status: result.status }
+}
+const localFailure = (code: RuntimeErrorCode): RuntimeError => ({ code, message: messages[code], requestId: null, status: null })
+
+type SurfaceKey = 'machines' | 'webhooks' | 'deliveries' | 'attempts' | 'sessions'
+type RequestKey = SurfaceKey | 'machine-mutation' | 'webhook-mutation' | 'session-mutation'
+
+export const createIntegrationSecurityRuntime = (options: { readonly transport: IntegrationSecurityTransport; readonly permissions: IntegrationSecurityPermissions }): IntegrationSecurityRuntime => {
+  const state = reactive<IntegrationSecurityState>({
+    machines: { items: [], loading: false, error: null }, webhooks: { items: [], loading: false, error: null },
+    deliveries: { items: [], loading: false, error: null, page: 1, pageSize: 20, total: 0 },
+    attempts: { items: [], loading: false, error: null, deliveryKey: null },
+    sessions: { items: [], loading: false, error: null }, mutating: false, disclosure: null,
+  })
+  const controllers = new Map<RequestKey, AbortController>()
+  const epochs: Record<SurfaceKey, number> = { machines: 0, webhooks: 0, deliveries: 0, attempts: 0, sessions: 0 }
+  let generation = 0
+  const cancel = (key: RequestKey): void => { controllers.get(key)?.abort(); controllers.delete(key) }
+  const run = async <T>(key: RequestKey, operation: (signal: AbortSignal) => Promise<T>): Promise<T> => {
+    cancel(key)
+    const controller = new AbortController(); controllers.set(key, controller)
+    try { return await operation(controller.signal) } finally { if (controllers.get(key) === controller) controllers.delete(key) }
+  }
+  const loadSurface = async <T>(key: SurfaceKey, surface: SurfaceState<T>, allowed: () => boolean, request: (signal: AbortSignal) => Promise<TransportResult>, parser: (body: unknown) => T[]): Promise<void> => {
+    const currentGeneration = generation; const currentEpoch = ++epochs[key]
+    cancel(key); surface.loading = true; surface.error = null
+    if (!allowed()) { surface.items = []; surface.loading = false; surface.error = localFailure('INTEGRATION_PERMISSION_DENIED'); return }
+    let result: TransportResult
+    try {
+      result = await run(key, request)
+    } catch {
+      if (currentGeneration === generation && currentEpoch === epochs[key]) { surface.error = localFailure('INTEGRATION_NETWORK_FAILED'); surface.loading = false }
+      return
+    }
+    if (currentGeneration !== generation || currentEpoch !== epochs[key]) return
+    if (result.status !== 200) { surface.error = failure(result); surface.loading = false; return }
+    try { surface.items = parser(result.body) } catch { surface.error = localFailure('INTEGRATION_RESPONSE_INVALID') }
+    finally { if (currentGeneration === generation && currentEpoch === epochs[key]) surface.loading = false }
+  }
+  const loadMachines = () => loadSurface('machines', state.machines, options.permissions.canReadMachines, options.transport.machines, body => parseList(body, parseMachine))
+  const loadWebhooks = () => loadSurface('webhooks', state.webhooks, options.permissions.canReadWebhooks, options.transport.webhooks, body => parseList(body, parseWebhook))
+  const loadSessions = () => loadSurface('sessions', state.sessions, options.permissions.canReadSessions, options.transport.sessions, body => parseList(body, parseSession))
+  const loadDeliveries = async (page = state.deliveries.page): Promise<void> => {
+    const key: SurfaceKey = 'deliveries'; const currentGeneration = generation; const currentEpoch = ++epochs[key]
+    const surface = state.deliveries; cancel(key); surface.loading = true; surface.error = null
+    if (!options.permissions.canReadDeliveries()) { surface.items = []; surface.total = 0; surface.loading = false; surface.error = localFailure('INTEGRATION_PERMISSION_DENIED'); return }
+    let result: TransportResult
+    try {
+      result = await run(key, signal => options.transport.deliveries(page, surface.pageSize, signal))
+    } catch {
+      if (currentGeneration === generation && currentEpoch === epochs[key]) { surface.error = localFailure('INTEGRATION_NETWORK_FAILED'); surface.loading = false }
+      return
+    }
+    if (currentGeneration !== generation || currentEpoch !== epochs[key]) return
+    if (result.status !== 200) { surface.error = failure(result); surface.loading = false; return }
+    try {
+      const parsed: Page<WebhookDeliveryRecord> = parsePage(result.body, parseDelivery)
+      surface.items = parsed.items; surface.page = parsed.page; surface.pageSize = parsed.pageSize; surface.total = parsed.total
+    } catch { surface.error = localFailure('INTEGRATION_RESPONSE_INVALID') }
+    finally { if (currentGeneration === generation && currentEpoch === epochs[key]) surface.loading = false }
+  }
+  const loadAttempts = async (deliveryKey: string): Promise<void> => {
+    const surface = state.attempts; surface.deliveryKey = deliveryKey
+    await loadSurface('attempts', surface, options.permissions.canReadDeliveries, signal => options.transport.deliveryAttempts(deliveryKey, 1, 100, signal), body => parsePage(body, parseAttempt).items)
+  }
+  const mutate = async <T>(key: RequestKey, allowed: () => boolean, request: (signal: AbortSignal) => Promise<TransportResult>, parser: (body: unknown) => T, after: (value: T) => Promise<void>, surface: SurfaceState<unknown>): Promise<void> => {
+    if (!allowed()) { surface.error = localFailure('INTEGRATION_PERMISSION_DENIED'); return }
+    if (state.mutating) return
+    const current = generation; state.mutating = true; surface.error = null; state.disclosure = null
+    let result: TransportResult
+    try {
+      result = await run(key, request)
+    } catch {
+      if (current === generation) { surface.error = localFailure('INTEGRATION_NETWORK_FAILED'); state.mutating = false }
+      return
+    }
+    if (current !== generation) return
+    if (result.status < 200 || result.status >= 300) { surface.error = failure(result); state.mutating = false; return }
+    let value: T
+    try { value = parser(result.body) } catch { surface.error = localFailure('INTEGRATION_RESPONSE_INVALID'); state.mutating = false; return }
+    try { await after(value) } catch { if (current === generation) surface.error = localFailure('INTEGRATION_MUTATION_FAILED') }
+    finally { if (current === generation) state.mutating = false }
+  }
+  return {
+    state, can: options.permissions, load: async () => { await Promise.allSettled([loadMachines(), loadWebhooks(), loadDeliveries(), loadSessions()]) },
+    loadMachines, loadWebhooks, loadDeliveries, loadAttempts, loadSessions,
+    createMachine: input => mutate('machine-mutation', options.permissions.canManageMachines, signal => options.transport.createMachine(input, signal), body => parseItem(body, value => { try { return parseProvisionedMachine(value) } catch { return parseMachine(value) } }), async (value: ProvisionedMachineIdentity | MachineIdentity) => { if ('token' in value) state.disclosure = { kind: 'machine-token', value: value.token }; await loadMachines() }, state.machines),
+    rotateMachine: identity => mutate('machine-mutation', options.permissions.canManageMachines, signal => options.transport.rotateMachine(identity.identityKey, identity.revision, signal), body => parseItem(body, value => { try { return parseProvisionedMachine(value) } catch { return parseMachine(value) } }), async (value: ProvisionedMachineIdentity | MachineIdentity) => { if ('token' in value) state.disclosure = { kind: 'machine-token', value: value.token }; await loadMachines() }, state.machines),
+    revokeMachine: identity => mutate('machine-mutation', options.permissions.canManageMachines, signal => options.transport.revokeMachine(identity.identityKey, identity.revision, signal), body => parseItem(body, parseMachine), async () => loadMachines(), state.machines),
+    createWebhook: input => mutate('webhook-mutation', options.permissions.canManageWebhooks, signal => options.transport.createWebhook(input, signal), body => parseItem(body, value => { try { return parseProvisionedWebhook(value) } catch { return parseWebhook(value) } }), async (value: ProvisionedWebhookEndpoint | WebhookEndpoint) => { if ('signingSecret' in value) state.disclosure = { kind: 'webhook-secret', value: value.signingSecret }; await loadWebhooks() }, state.webhooks),
+    rotateWebhook: endpoint => mutate('webhook-mutation', options.permissions.canManageWebhooks, signal => options.transport.rotateWebhook(endpoint.endpointKey, endpoint.revision, signal), body => parseItem(body, value => { try { return parseProvisionedWebhook(value) } catch { return parseWebhook(value) } }), async (value: ProvisionedWebhookEndpoint | WebhookEndpoint) => { if ('signingSecret' in value) state.disclosure = { kind: 'webhook-secret', value: value.signingSecret }; await loadWebhooks() }, state.webhooks),
+    disableWebhook: endpoint => mutate('webhook-mutation', options.permissions.canManageWebhooks, signal => options.transport.disableWebhook(endpoint.endpointKey, endpoint.revision, signal), body => parseItem(body, parseWebhook), async () => loadWebhooks(), state.webhooks),
+    revokeSession: session => mutate('session-mutation', options.permissions.canRevokeSession, signal => options.transport.revokeSession(session.sessionKey, signal), body => parseItem(body, parseSession), async () => loadSessions(), state.sessions),
+    clearDisclosure: () => { state.disclosure = null },
+    dispose() {
+      generation += 1; for (const key of Object.keys(epochs) as SurfaceKey[]) epochs[key] += 1
+      for (const controller of controllers.values()) controller.abort(); controllers.clear()
+      state.machines.items = []; state.webhooks.items = []; state.deliveries.items = []; state.attempts.items = []; state.sessions.items = []
+      state.machines.loading = state.webhooks.loading = state.deliveries.loading = state.attempts.loading = state.sessions.loading = false
+      state.machines.error = state.webhooks.error = state.deliveries.error = state.attempts.error = state.sessions.error = null
+      state.attempts.deliveryKey = null
+      state.deliveries.total = 0; state.deliveries.page = 1; state.mutating = false; state.disclosure = null
+    },
+  }
+}
+export const integrationSecurityRuntimeKey: InjectionKey<IntegrationSecurityRuntime> = Symbol('peanut.integration-security.runtime')
+export const useIntegrationSecurityRuntime = (): IntegrationSecurityRuntime => { const runtime = inject(integrationSecurityRuntimeKey); if (runtime === undefined) throw new Error('INTEGRATION_SECURITY_RUNTIME_MISSING'); return runtime }
+export const createIntegrationSecurityModuleContribution = (runtime: IntegrationSecurityRuntime): AdminModuleContribution => defineAdminModule({
+  key: INTEGRATION_SECURITY_MODULE_KEY,
+  routes: [{ name: 'peanut.integration-security.index', path: INTEGRATION_SECURITY_ROUTE_PATH, component: async () => ({ default: (await import('./IntegrationSecurityPage.vue')).default }), access: { moduleKey: INTEGRATION_SECURITY_MODULE_KEY, permissionKeys: [INTEGRATION_SECURITY_ROUTE_PERMISSION] } }],
+  disposeOnTenantChange: true, stores: [{ key: 'peanut.integration-security.runtime', dispose: runtime.dispose }],
+})

package/notification-sms/src/NotificationInboxPage.vue

@@ -0,0 +1,266 @@
+<script setup lang="ts">
+import {
+  EmptyState,
+  ForbiddenState,
+  ModuleUnavailableState,
+  PageContent,
+  PageHeader,
+  PageToolbar,
+  SessionExpiredState,
+} from '@peanut-admin/admin/shell'
+import { ElButton, ElCheckbox, ElTag } from 'element-plus'
+import { onMounted } from 'vue'
+
+import type { NotificationFilter, NotificationMessage } from './contracts'
+import { useNotificationRuntime } from './runtime'
+
+const runtime = useNotificationRuntime()
+const state = runtime.state
+const filters: readonly { label: string; value: NotificationFilter }[] = [
+  { label: 'All', value: 'all' },
+  { label: 'Unread', value: 'unread' },
+  { label: 'Read', value: 'read' },
+  { label: 'Archived', value: 'archived' },
+]
+
+const run = async (operation: () => Promise<void>): Promise<void> => {
+  try { await operation() } catch { return }
+}
+const statusType = (message: NotificationMessage): 'primary' | 'success' | 'info' => (
+  message.status === 'unread' ? 'primary' : message.status === 'read' ? 'success' : 'info'
+)
+
+onMounted(() => run(runtime.load))
+</script>
+
+<template>
+  <PageContent class="notification-inbox-page">
+    <PageHeader>
+      Notifications
+      <template #actions>
+        <ElButton
+          aria-label="Reload notifications"
+          :disabled="state.mutating"
+          :loading="state.loading"
+          @click="run(runtime.load)"
+        >
+          Reload
+        </ElButton>
+      </template>
+    </PageHeader>
+
+    <PageToolbar
+      v-if="!state.error"
+      label="Notification controls"
+    >
+      <div class="notification-toolbar">
+        <div
+          class="notification-filters"
+          role="group"
+          aria-label="Inbox status"
+        >
+          <ElButton
+            v-for="filter in filters"
+            :key="filter.value"
+            :aria-pressed="state.status === filter.value"
+            :disabled="state.loading || state.mutating"
+            :type="state.status === filter.value ? 'primary' : 'default'"
+            @click="run(() => runtime.setStatus(filter.value))"
+          >
+            {{ filter.label }}
+          </ElButton>
+        </div>
+        <div class="notification-actions">
+          <span>{{ state.selected.size }} selected</span>
+          <ElButton
+            :disabled="state.selected.size === 0 || state.mutating"
+            @click="run(() => runtime.bulk('read'))"
+          >
+            Mark read
+          </ElButton>
+          <ElButton
+            :disabled="state.selected.size === 0 || state.mutating"
+            @click="run(() => runtime.bulk('archive'))"
+          >
+            Archive
+          </ElButton>
+        </div>
+      </div>
+    </PageToolbar>
+
+    <SessionExpiredState
+      v-if="state.error?.status === 401"
+      :message="state.error.message"
+      v-bind="state.error.requestId === null ? {} : { requestId: state.error.requestId }"
+    />
+    <ForbiddenState
+      v-else-if="state.error?.status === 403"
+      :message="state.error.message"
+      v-bind="state.error.requestId === null ? {} : { requestId: state.error.requestId }"
+    />
+    <ModuleUnavailableState
+      v-else-if="state.error?.status === 503"
+      :message="state.error.message"
+      v-bind="state.error.requestId === null ? {} : { requestId: state.error.requestId }"
+      @action="run(runtime.load)"
+    />
+    <section
+      v-else-if="state.error"
+      class="notification-state"
+      role="alert"
+    >
+      <h2>Unable to load notifications</h2>
+      <p>{{ state.error.message }}</p>
+      <ElButton @click="run(runtime.load)">
+        Retry
+      </ElButton>
+    </section>
+    <div
+      v-else-if="state.loading"
+      class="notification-state"
+      role="status"
+      aria-live="polite"
+    >
+      Loading notifications...
+    </div>
+    <EmptyState
+      v-else-if="state.items.length === 0"
+      title="No notifications"
+      message="No messages match the selected inbox status."
+    />
+    <section
+      v-else
+      class="notification-list"
+      aria-label="Notification inbox"
+    >
+      <article
+        v-for="message in state.items"
+        :key="message.messageKey"
+        class="notification-item"
+        :class="{ 'notification-item--unread': message.status === 'unread' }"
+      >
+        <ElCheckbox
+          :aria-label="`Select ${message.subject}`"
+          :disabled="state.mutating"
+          :model-value="state.selected.has(message.messageKey)"
+          @update:model-value="runtime.toggle(message.messageKey)"
+        />
+        <div class="notification-item__content">
+          <div class="notification-item__heading">
+            <h2>{{ message.subject }}</h2>
+            <ElTag :type="statusType(message)">
+              {{ message.status }}
+            </ElTag>
+          </div>
+          <p>{{ message.body }}</p>
+          <ul
+            v-if="message.attachments.length > 0"
+            class="notification-attachments"
+            aria-label="Attachments"
+          >
+            <li
+              v-for="attachment in message.attachments"
+              :key="attachment.fileKey"
+            >
+              {{ attachment.originalName }} - {{ attachment.mediaType }}
+            </li>
+          </ul>
+          <div class="notification-item__footer">
+            <time :datetime="message.createdAt">{{ message.createdAt }}</time>
+            <ElButton
+              v-if="message.status === 'unread'"
+              text
+              :disabled="state.mutating"
+              @click="run(() => runtime.markRead(message))"
+            >
+              Mark read
+            </ElButton>
+          </div>
+        </div>
+      </article>
+    </section>
+  </PageContent>
+</template>
+
+<style scoped>
+.notification-toolbar,
+.notification-filters,
+.notification-actions,
+.notification-item__heading,
+.notification-item__footer {
+  display: flex;
+  align-items: center;
+  gap: 8px;
+}
+
+.notification-toolbar,
+.notification-item__heading,
+.notification-item__footer {
+  justify-content: space-between;
+}
+
+.notification-toolbar {
+  flex-wrap: wrap;
+  width: 100%;
+}
+
+.notification-list {
+  border-top: 1px solid var(--el-border-color);
+}
+
+.notification-item {
+  display: grid;
+  grid-template-columns: 32px minmax(0, 1fr);
+  gap: 12px;
+  padding: 16px 0;
+  border-bottom: 1px solid var(--el-border-color);
+}
+
+.notification-item--unread {
+  border-left: 3px solid var(--el-color-primary);
+  padding-left: 12px;
+}
+
+.notification-item__content,
+.notification-item__heading h2 {
+  min-width: 0;
+}
+
+.notification-item__heading h2 {
+  margin: 0;
+  overflow-wrap: anywhere;
+  font-size: 16px;
+  letter-spacing: 0;
+}
+
+.notification-item__content > p {
+  white-space: pre-wrap;
+  overflow-wrap: anywhere;
+}
+
+.notification-attachments {
+  margin: 8px 0;
+  padding-left: 20px;
+}
+
+.notification-item__footer {
+  color: var(--el-text-color-secondary);
+  font-size: 13px;
+}
+
+.notification-state {
+  padding: 24px 0;
+}
+
+@media (max-width: 720px) {
+  .notification-toolbar,
+  .notification-actions {
+    align-items: flex-start;
+    flex-direction: column;
+  }
+
+  .notification-filters {
+    flex-wrap: wrap;
+  }
+}
+</style>

package/notification-sms/src/contracts.ts

@@ -0,0 +1,195 @@
+export type NotificationStatus = 'unread' | 'read' | 'archived'
+export type NotificationFilter = NotificationStatus | 'all'
+export type NotificationBulkAction = 'read' | 'archive'
+
+export interface NotificationAttachment {
+  readonly fileKey: string
+  readonly originalName: string
+  readonly mediaType: string
+  readonly sizeBytes: number
+  readonly sha256: string
+}
+
+export interface NotificationMessage {
+  readonly messageKey: string
+  readonly templateKey: string
+  readonly templateRevision: number
+  readonly subject: string
+  readonly body: string
+  readonly status: NotificationStatus
+  readonly revision: number
+  readonly createdAt: string
+  readonly readAt: string | null
+  readonly archivedAt: string | null
+  readonly attachments: readonly NotificationAttachment[]
+}
+
+export interface NotificationList {
+  readonly items: readonly NotificationMessage[]
+  readonly page: number
+  readonly pageSize: number
+  readonly total: number
+}
+
+export interface NotificationTransportResult {
+  readonly body: unknown
+  readonly headers: Headers
+  readonly status: number
+}
+
+export interface NotificationTransport {
+  list: (status: NotificationFilter, page: number, pageSize: number, signal: AbortSignal) => Promise<NotificationTransportResult>
+  markRead: (messageKey: string, revision: number, signal: AbortSignal) => Promise<NotificationTransportResult>
+  bulk: (messageKeys: readonly string[], action: NotificationBulkAction, signal: AbortSignal) => Promise<NotificationTransportResult>
+}
+
+const record = (value: unknown): Record<string, unknown> => {
+  if (typeof value !== 'object' || value === null || Array.isArray(value)) throw new Error('NOTIFICATION_RESPONSE_INVALID')
+  return value as Record<string, unknown>
+}
+
+const exactKeys = (value: Record<string, unknown>, keys: readonly string[]): void => {
+  const actual = Object.keys(value).sort()
+  const expected = [...keys].sort()
+  if (actual.length !== expected.length || actual.some((key, index) => key !== expected[index])) {
+    throw new Error('NOTIFICATION_RESPONSE_INVALID')
+  }
+}
+
+const instant = (value: unknown): value is string => typeof value === 'string'
+  && /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z$/.test(value)
+  && Number.isFinite(Date.parse(value))
+
+const fileKeyPattern = /^file_[0-9a-f]{32}$/
+const messageKeyPattern = /^notice_[0-9a-f]{32}$/
+const qualifiedKeyPattern = /^[a-z][a-z0-9]*(?:[.-][a-z0-9]+)*$/
+
+const parseAttachment = (value: unknown): NotificationAttachment => {
+  const item = record(value)
+  exactKeys(item, ['file_key', 'original_name', 'media_type', 'size_bytes', 'sha256'])
+  if (typeof item.file_key !== 'string' || !fileKeyPattern.test(item.file_key)
+    || typeof item.original_name !== 'string' || item.original_name === '' || [...item.original_name].length > 255
+    || typeof item.media_type !== 'string' || !/^[a-z0-9][a-z0-9.+-]*\/[a-z0-9][a-z0-9.+-]*$/.test(item.media_type)
+    || typeof item.size_bytes !== 'number' || !Number.isSafeInteger(item.size_bytes) || item.size_bytes < 0
+    || typeof item.sha256 !== 'string' || !/^[0-9a-f]{64}$/.test(item.sha256)
+  ) throw new Error('NOTIFICATION_RESPONSE_INVALID')
+  return {
+    fileKey: item.file_key,
+    originalName: item.original_name,
+    mediaType: item.media_type,
+    sizeBytes: item.size_bytes,
+    sha256: item.sha256,
+  }
+}
+
+export const parseNotification = (value: unknown): NotificationMessage => {
+  const item = record(value)
+  exactKeys(item, [
+    'message_key', 'template_key', 'template_revision', 'subject', 'body', 'status', 'revision',
+    'created_at', 'read_at', 'archived_at', 'attachments',
+  ])
+  if (typeof item.message_key !== 'string' || !messageKeyPattern.test(item.message_key)
+    || typeof item.template_key !== 'string' || item.template_key.length > 64 || !qualifiedKeyPattern.test(item.template_key)
+    || typeof item.template_revision !== 'number' || !Number.isSafeInteger(item.template_revision) || item.template_revision < 1
+    || typeof item.subject !== 'string' || item.subject === '' || [...item.subject].length > 255
+    || typeof item.body !== 'string' || item.body === '' || [...item.body].length > 10000
+    || !['unread', 'read', 'archived'].includes(String(item.status))
+    || typeof item.revision !== 'number' || !Number.isSafeInteger(item.revision) || item.revision < 1
+    || !instant(item.created_at)
+    || (item.read_at !== null && !instant(item.read_at))
+    || (item.archived_at !== null && !instant(item.archived_at))
+    || ((item.status === 'unread') !== (item.read_at === null))
+    || ((item.status === 'archived') !== (item.archived_at !== null))
+    || !Array.isArray(item.attachments) || item.attachments.length > 10
+  ) throw new Error('NOTIFICATION_RESPONSE_INVALID')
+  return {
+    messageKey: item.message_key,
+    templateKey: item.template_key,
+    templateRevision: item.template_revision,
+    subject: item.subject,
+    body: item.body,
+    status: item.status as NotificationStatus,
+    revision: item.revision,
+    createdAt: item.created_at,
+    readAt: item.read_at as string | null,
+    archivedAt: item.archived_at as string | null,
+    attachments: item.attachments.map(parseAttachment),
+  }
+}
+
+export const parseNotificationResponse = (value: unknown): NotificationMessage => {
+  const body = record(value)
+  exactKeys(body, ['data', 'meta'])
+  const meta = record(body.meta)
+  exactKeys(meta, ['request_id'])
+  if (typeof meta.request_id !== 'string' || meta.request_id === '') throw new Error('NOTIFICATION_RESPONSE_INVALID')
+  return parseNotification(body.data)
+}
+
+export const parseNotificationList = (value: unknown): NotificationList => {
+  const body = record(value)
+  exactKeys(body, ['data', 'meta'])
+  const data = record(body.data)
+  const meta = record(body.meta)
+  exactKeys(data, ['items'])
+  exactKeys(meta, ['request_id', 'page', 'page_size', 'total'])
+  if (!Array.isArray(data.items) || typeof meta.request_id !== 'string' || meta.request_id === '') {
+    throw new Error('NOTIFICATION_RESPONSE_INVALID')
+  }
+  for (const key of ['page', 'page_size', 'total'] as const) {
+    if (typeof meta[key] !== 'number' || !Number.isSafeInteger(meta[key]) || meta[key] < (key === 'total' ? 0 : 1)) {
+      throw new Error('NOTIFICATION_RESPONSE_INVALID')
+    }
+  }
+  return {
+    items: data.items.map(parseNotification),
+    page: meta.page as number,
+    pageSize: meta.page_size as number,
+    total: meta.total as number,
+  }
+}
+
+export const parseBulkResult = (value: unknown): number => {
+  const body = record(value)
+  exactKeys(body, ['data', 'meta'])
+  const data = record(body.data)
+  const meta = record(body.meta)
+  exactKeys(data, ['changed'])
+  exactKeys(meta, ['request_id'])
+  if (typeof data.changed !== 'number' || !Number.isSafeInteger(data.changed) || data.changed < 0
+    || typeof meta.request_id !== 'string' || meta.request_id === ''
+  ) throw new Error('NOTIFICATION_RESPONSE_INVALID')
+  return data.changed
+}
+
+export const createNotificationFetchTransport = (options: {
+  readonly baseUrl: string
+  readonly fetch?: (request: Request) => Promise<Response>
+}): NotificationTransport => {
+  const fetcher = options.fetch ?? fetch
+  const request = async (path: string, init: RequestInit): Promise<NotificationTransportResult> => {
+    const headers = new Headers(init.headers)
+    if (!headers.has('Accept')) headers.set('Accept', 'application/json')
+    if (init.body !== undefined && !headers.has('Content-Type')) headers.set('Content-Type', 'application/json')
+    const response = await fetcher(new Request(new URL(path, options.baseUrl), {
+      credentials: 'include', ...init, headers,
+    }))
+    return { body: response.status === 204 ? null : await response.json(), headers: response.headers, status: response.status }
+  }
+  return {
+    list(status, page, pageSize, signal) {
+      const query = new URLSearchParams({ status, page: String(page), page_size: String(pageSize) })
+      return request(`/api/v1/notifications?${query}`, { method: 'GET', signal })
+    },
+    markRead(messageKey, revision, signal) {
+      return request(`/api/v1/notifications/${encodeURIComponent(messageKey)}/read`, {
+        method: 'POST', headers: { 'If-Match': `"rev-${revision}"` }, body: '{}', signal,
+      })
+    },
+    bulk(messageKeys, action, signal) {
+      return request('/api/v1/notifications/bulk', {
+        method: 'POST', body: JSON.stringify({ message_keys: messageKeys, action }), signal,
+      })
+    },
+  }
+}

package/notification-sms/src/index.ts

@@ -0,0 +1,4 @@
+export const NOTIFICATION_SMS_PACKAGE = '@peanut-admin/admin/notification-sms' as const
+export const NOTIFICATION_SMS_VERSION = '0.1.0' as const
+export * from './contracts'
+export * from './runtime'