@protobase/server 0.45.16 → 0.45.18

package/dist/create-admin.js

@@ -52,8 +52,11 @@ import { createWebhooks } from "./webhooks/webhooks.js";
 import { webhookTable } from "./webhooks/table/webhook-table.js";
 import { subscriptionUrlCheck, subscriptionWriteCheck } from "./webhooks/table/validate-hook.js";
 import { deviceStore, removeDevicesWithUsers } from "./notifications/device-store-of.js";
-import { devicesPath } from "./notifications/paths.js";
+import { historyStore, removeHistoryWithUsers } from "./notifications/history-store-of.js";
+import { devicesPath, historyPath } from "./notifications/paths.js";
+import { historyRoutes } from "./notifications/history-routes.js";
 import { deviceRoutes } from "./notifications/routes.js";
+import { notificationSenders, webPushKey } from "./notifications/senders-of.js";
 import { visitorsBrowse, withAnonymous } from "./anonymous.js";
 import { checkBottomBars, checkShell } from "./check-shell.js";
 import { checkOwnerFields } from "./check-owners.js";
@@ -152,6 +155,8 @@ const createAdmin = ({ resources: appResources, views: appViews = [], pages = []
 	const runtime = runtimeUrl(options.runtime, globalThis.process?.env ?? {});
 	const errorReporting = errorReportingSettings(options.errorReporting, globalThis.process?.env ?? {});
 	const maps = mapSettings(options.maps, globalThis.process?.env ?? {});
+	const senders = notifications ? notificationSenders(notifications) : [];
+	const pushKey = webPushKey(senders);
 	const locale = localeSetting(options.locale);
 	const plugins = pluginOptions(options.plugins, globalThis.process?.env ?? {}, bundlePlugins);
 	const sources = sourceOptions(options.sources, globalThis.process?.env ?? {});
@@ -204,6 +209,7 @@ const createAdmin = ({ resources: appResources, views: appViews = [], pages = []
 		...runtime && { runtime },
 		...errorReporting && { errorReporting },
 		...maps && { maps },
+		...pushKey && { webPushKey: pushKey },
 		...locale && { locale },
 		plugins,
 		sources,
@@ -368,6 +374,9 @@ const createAdmin = ({ resources: appResources, views: appViews = [], pages = []
 		const devices = deviceStore(db, notifications);
 		if (auth) removeDevicesWithUsers(auth, devices);
 		app.route(devicesPath(systemPath), guarded((routes) => void routes.route("/", deviceRoutes(devices))));
+		const history = historyStore(db, notifications);
+		if (auth) removeHistoryWithUsers(auth, history);
+		app.route(historyPath(systemPath), guarded((routes) => void routes.route("/", historyRoutes(history, auth?.origins ?? []))));
 	}
 	if (forms) app.route(`${systemPath}/forms`, formRoutes(deps, forms));
 	const feed = tableFeed({

package/dist/deps.d.ts

@@ -47,6 +47,8 @@ export type Deps = {
   errorReporting?: ErrorReportingSettings;
   /** The map style the admin app draws maps with and the layers they may switch to, which `/meta` names to everyone. */
   maps?: MapSettings;
+  /** The VAPID public key browsers subscribe for Web Push with, when notifications have a web sender, which `/meta` names to everyone. */
+  webPushKey?: string;
   /** The language the admin app's screens are in for everyone, which `/meta` names to everyone. */
   locale?: Locale;
   /** The plugins `/meta` names to the callers they are for. */

package/dist/index.d.ts

@@ -20,7 +20,12 @@ import { HistoryOptions } from "./history/options.js";
 import { WebhooksOptions } from "./webhooks/table/options.js";
 import { ApnsEnvironment, Device, DeviceKind, NewDevice } from "./notifications/device.js";
 import { DeviceStore } from "./notifications/device-store.js";
-import { DeviceColumn, NotificationsOptions } from "./notifications/options.js";
+import { JsonObject, JsonValue } from "./notifications/json-value.js";
+import { HistoryPosition, NewNotification, StoredNotification, historyIdPattern, historyLimits } from "./notifications/history.js";
+import { HistoryStore, maxHistoryPage, maxUnreadCount } from "./notifications/history-store.js";
+import { PushMessage, PushMessageError, Urgency, WebPushFields, maxTtlSeconds, pushMessage, urgencies } from "./notifications/message.js";
+import { PushAnswer, PushSender } from "./notifications/sender.js";
+import { DeviceColumn, HistoryColumn, NotificationsOptions } from "./notifications/options.js";
 import { EventData, RunContext, SubscriptionDefinition, SubscriptionEvent, SubscriptionOptions, subscription } from "./webhooks/subscription.js";
 import { Sharp, renderVariant, thumbHash } from "./files/images.js";
 import { FileProvider, FileStore, StoredObject } from "./files/store.js";
@@ -93,8 +98,15 @@ import { notifications } from "./notifications/plugin.js";
 import { checkNotificationsSchema, notificationsMigration } from "./notifications/schema.js";
 import { deviceStore, removeDevicesWithUsers } from "./notifications/device-store-of.js";
 import { DeviceStoreError, postgresDeviceStore } from "./notifications/postgres-store.js";
-import { deviceIdParam, devicesPath } from "./notifications/paths.js";
+import { deviceIdParam, devicesPath, historyIdParam, historyPath } from "./notifications/paths.js";
 import { maxDevicesPerUser } from "./notifications/routes.js";
+import { historyStore, removeHistoryWithUsers } from "./notifications/history-store-of.js";
+import { HistoryStoreError, postgresHistoryStore } from "./notifications/postgres-history-store.js";
+import { defaultHistoryPage } from "./notifications/history-routes.js";
+import { notificationSenders } from "./notifications/senders-of.js";
+import { VapidSettings, readVapidSettings, vapidPrivateKeyVariable, vapidPublicKeyVariable, vapidSubjectVariable } from "./notifications/web-push/vapid-settings.js";
+import { WebPushOptions, webPushSender } from "./notifications/web-push/web-push-sender.js";
+import { generateVapidKeys } from "./notifications/web-push/keys.js";
 import { MemberInput, NewOrganization, addAppRoleToOwners, addMember, createOrganization, listOrganizations, removeMember, setMemberRoles } from "./better-auth/organizations/host.js";
 import { AssistantBackend, assistantProtocolRoutes } from "./assistant/protocol-routes.js";
 import { fileConversationStore } from "./assistant/file-conversation-store.js";
@@ -146,4 +158,4 @@ import { checkJobsSchema, jobsSchema, jobsSchemaMigration } from "./jobs/schema.
 import { MobileRelease, ReleaseFile, ServedReleaseFile, composeRelease, releaseManifest } from "./mobile-release/release.js";
 import { MobileReleaseAppInput, OfferedRelease, mobileReleaseApp } from "./mobile-release/release-app.js";
 import { mobileSigningKeyVariable, readSigningKey } from "./mobile-release/signing-key.js";
-export { type Admin, type AdminAuth, type AdminOptions, type ApiFunction, type ApiKeys, type ApiKeysOptions, type ApnsEnvironment, type AppIcons, type AppIdentity, type AppPoolConfig, type ApplyOptions, type ApplyResult, type ApprovalAnswer, type ApprovalRequest, type AssistantBackend, type AssistantOptions, type AssistantSettings, type AssistantTool, type AuditEvent, type AuditQueue, type Authenticator, type BatchOperation, type BatchResult, type BetterAuthAuthenticator, type BetterAuthAuthenticatorOptions, type Caller, type CallerOptions, type CapturedRow, type CascadingKey, type ChatMessage, type ChatTextPart, type CheckAiInput, type CleanupEntry, type CleanupReport, type CleanupSchedule, type CoalescedChange, type CommentItem, type CommentUsers, type Completion, type CompletionOptions, ConnectionsBusy, type Conversation, type ConversationRecord, type ConversationStore, type ConversationsOptions, type CorsOptions, type CorsOrigins, type CreateAdminInput, type CreateAuthOptions, type Device, type DeviceColumn, type DeviceKind, type DeviceStore, DeviceStoreError, type DrainResult, type EmailComponent, type EmailOptions, type EmailTemplate, type EncryptionStatus, type EncryptionTools, type EncryptionToolsInput, type EnqueueOptions, type ErrorReporter, type ErrorReportingOptions, type ErrorReportingSettings, type EventData, type EventsOptions, FatalJobError, type FieldApplied, type FieldStatus, type FileCleanupInput, type FileLimits, type FileObject, type FileProvider, type FileRef, type FileStore, type FileVariantObject, type FilesOptions, type FunctionApp, type FunctionCaller, type FunctionContext, type FunctionEnv, type FunctionHandler, type FunctionOptions, type FunctionRecords, type FunctionSocket, type FunctionSource, type HistoryOptions, HttpProblem, type IssueTokenOptions, type JobContext, type JobDefinition, type JobOptions, type JobsRuntime, type JwtOptions, type JwtVerifyOptions, type KeyFunctionContext, type LinkedAccount, type ListParams, type LocalFilesOptions, type MailMessage, type Mailer, type MapLayer, type MapOptions, type MapSettings, type McpGateInput, type McpHandlerInput, type McpRoutesInput, type McpServerInput, type McpToolsInput, type McpWrites, type MemberInput, MissingCredentials, type MobileConfig, type MobileRelease, type MobileReleaseAppInput, ModelError, type ModelSettings, type NewDevice, type NewOrganization, type NewUser, type NotificationsOptions, type OfferedRelease, type OperatorProvider, type OrganizationRole, type OrganizationsOptions, type PgModule, type PipelineHook, type PlatformSignIn, type PluginOption, type PluginRef, type PngIcon, type ProjectConfig, type ProtectedFunctionOptions, type PublicFunctionContext, type PublicFunctionEnv, type PublicFunctionHandler, type PublicFunctionOptions, type QueryOptions, type QueryResult, type ReadableResources, type ReasoningDetail, type ReasoningEffort, type RebindOption, type RecordKeyInput, type RecordPage, type ReleaseFile, type RenderedEmail, type ResourceChange, type ResourceSource, type RoleDefinition, type RolesInput, type RunContext, type RuntimeOptions, type S3Bucket, type S3FilesOptions, type S3ListPage, type S3Object, type ScanGuardMode, type ScheduledDelete, type ServedReleaseFile, type Session, type SessionOrganization, type Sharp, type SignInPolicy, type SignInRule, type SignatureOptions, type SocketEvents, type SourceOption, type SourceRef, type StaffAccessRule, type StaffSignIn, type StandardSchema, type StandardWebhookOptions, type StartJobsOptions, type StoreFileInput, type StoredMember, type StoredObject, type StoredOrganization, type StoredUser, type StrayValues, type SubscriptionDefinition, type SubscriptionEvent, type SubscriptionOptions, type TenantValue, type ToolAnnotations, type ToolCall, type ToolContext, type ToolRecord, type ToolRecords, type ToolSpec, type TrustedApp, type TurnOptions, type UnreadableEntry, type User, type UserCreatedHook, type ViewSource, type WebhooksOptions, type WidgetOptions, type WriteEvent, type WriteOperation, type WriteRecordToolsInput, addAppRoleToOwners, addMember, apiKeyCaller, apiKeySettings, apiKeyVariables, appPool, aspectRatio, assistantProtocolRoutes, assistantRoles, assistantSettings, assistantVariables, authSchemaMigration, authStoreTables, backgroundSettled, badRequest, batchWriteTool, beforeSignInPluginsVariable, betterAuthAuthenticator, betterAuthTokens, capSocketMessages, changesMigration, checkAi, checkAuthSchema, checkChanges, checkComments, checkComputed, checkJobsSchema, checkNotificationsSchema, checkQueryRunner, checkSourceNames, checkViewQueries, checkWebhooksSchema, coalesce, commentsMigration, composeRelease, computedMigration, configExports, consoleAuditQueue, conversationKey, createAdmin, createAuth, createConversations, createEncryptionTools, createFileCleanup, createOrganization, createRecordTool, createUser, defaultAppName, defaultSignInPolicy, defineConfig, defineEmail, defineFunction, defineJob, defineTool, deleteRecordTool, deleteUser, deviceIdParam, deviceStore, devicesPath, errorReportingSettings, errorReportingVariable, eventMatcher, fileConversationStore, fileSize, fileType, forbidden, formatUri, functionApp, getRecordTool, goTruePath, handleDroppedConnections, hasUsers, honorSocketMessageCaps, imageSize, isBackgroundWork, isCaptured, isJobDefinition, isOAuthWellKnownPath, isSchedule, issueToken, jobDefinitions, jobsDrainApp, jobsSchema, jobsSchemaMigration, jwtAuthenticator, jwtVerifier, limitedFileStore, listOrganizations, listRecordsTool, listResourcesTool, listUsers, localFileStore, localFiles, longQueryPool, longQueryTimeoutMs, mapSettings, mapStyleUrl, mapStyleVariable, maxDevicesPerUser, maxTokenTtlSeconds, maxWidgetPropsBytes, mcpGate, mcpHandler, mcpRoutes, mcpServer, mcpToolContext, mcpTools, mergeConfig, migrationCommand, mobileReleaseApp, mobileSigningKeyVariable, newWebhookSecret, normalizeRoles, notFound, notifications, notificationsMigration, oauthWellKnownPaths, objectKey, parseColumns, parseRoles, passwordLength, pluginOptions, pluginsBeforeSignIn, pluginsFor, pluginsVariable, pngIcons, poolWaitMs, postgresDeviceStore, processor, queryRunnerMigration, readDbConnections, readJson, readOnlyQueryTool, readOperatorSettings, readOutbox, readPlatformSignIn, readRecordTools, readSigningKey, readWriteQueryTool, readableResources, realtimeLimits, recordOf, releaseManifest, removeDevicesWithUsers, removeMember, renderVariant, requestApproval, requireEnv, resourceChange, roleChoices, runInBackground, runReadOnlyQuery, runReadWriteQuery, runTurn, runtimeUrl, runtimeVariable, s3FileStore, s3Files, seesAssistant, seesRuntime, sessionOf, setMemberRoles, setUserBanned, setUserRole, shownAppName, signInPolicyMethods, socketMessageCapOf, sourceOptions, sourcesFor, sourcesVariable, startErrorReporting, startJobs, storageCleanupSchedule, storageProvider, storeFile, storeUsage, streamChatCompletion, subscription, supabasePath, thumbHash, unauthorized, updateRecordTool, variantPath, verifySignature, verifyStandardWebhook, waitUntil, wantsLongQueries, webManifestPath, webauthnPath, webhooks, webhooksMigration, widget, withCacheBreakpoints, withTrustedApps, writeRecordTools };
+export { type Admin, type AdminAuth, type AdminOptions, type ApiFunction, type ApiKeys, type ApiKeysOptions, type ApnsEnvironment, type AppIcons, type AppIdentity, type AppPoolConfig, type ApplyOptions, type ApplyResult, type ApprovalAnswer, type ApprovalRequest, type AssistantBackend, type AssistantOptions, type AssistantSettings, type AssistantTool, type AuditEvent, type AuditQueue, type Authenticator, type BatchOperation, type BatchResult, type BetterAuthAuthenticator, type BetterAuthAuthenticatorOptions, type Caller, type CallerOptions, type CapturedRow, type CascadingKey, type ChatMessage, type ChatTextPart, type CheckAiInput, type CleanupEntry, type CleanupReport, type CleanupSchedule, type CoalescedChange, type CommentItem, type CommentUsers, type Completion, type CompletionOptions, ConnectionsBusy, type Conversation, type ConversationRecord, type ConversationStore, type ConversationsOptions, type CorsOptions, type CorsOrigins, type CreateAdminInput, type CreateAuthOptions, type Device, type DeviceColumn, type DeviceKind, type DeviceStore, DeviceStoreError, type DrainResult, type EmailComponent, type EmailOptions, type EmailTemplate, type EncryptionStatus, type EncryptionTools, type EncryptionToolsInput, type EnqueueOptions, type ErrorReporter, type ErrorReportingOptions, type ErrorReportingSettings, type EventData, type EventsOptions, FatalJobError, type FieldApplied, type FieldStatus, type FileCleanupInput, type FileLimits, type FileObject, type FileProvider, type FileRef, type FileStore, type FileVariantObject, type FilesOptions, type FunctionApp, type FunctionCaller, type FunctionContext, type FunctionEnv, type FunctionHandler, type FunctionOptions, type FunctionRecords, type FunctionSocket, type FunctionSource, type HistoryColumn, type HistoryOptions, type HistoryPosition, type HistoryStore, HistoryStoreError, HttpProblem, type IssueTokenOptions, type JobContext, type JobDefinition, type JobOptions, type JobsRuntime, type JsonObject, type JsonValue, type JwtOptions, type JwtVerifyOptions, type KeyFunctionContext, type LinkedAccount, type ListParams, type LocalFilesOptions, type MailMessage, type Mailer, type MapLayer, type MapOptions, type MapSettings, type McpGateInput, type McpHandlerInput, type McpRoutesInput, type McpServerInput, type McpToolsInput, type McpWrites, type MemberInput, MissingCredentials, type MobileConfig, type MobileRelease, type MobileReleaseAppInput, ModelError, type ModelSettings, type NewDevice, type NewNotification, type NewOrganization, type NewUser, type NotificationsOptions, type OfferedRelease, type OperatorProvider, type OrganizationRole, type OrganizationsOptions, type PgModule, type PipelineHook, type PlatformSignIn, type PluginOption, type PluginRef, type PngIcon, type ProjectConfig, type ProtectedFunctionOptions, type PublicFunctionContext, type PublicFunctionEnv, type PublicFunctionHandler, type PublicFunctionOptions, type PushAnswer, type PushMessage, PushMessageError, type PushSender, type QueryOptions, type QueryResult, type ReadableResources, type ReasoningDetail, type ReasoningEffort, type RebindOption, type RecordKeyInput, type RecordPage, type ReleaseFile, type RenderedEmail, type ResourceChange, type ResourceSource, type RoleDefinition, type RolesInput, type RunContext, type RuntimeOptions, type S3Bucket, type S3FilesOptions, type S3ListPage, type S3Object, type ScanGuardMode, type ScheduledDelete, type ServedReleaseFile, type Session, type SessionOrganization, type Sharp, type SignInPolicy, type SignInRule, type SignatureOptions, type SocketEvents, type SourceOption, type SourceRef, type StaffAccessRule, type StaffSignIn, type StandardSchema, type StandardWebhookOptions, type StartJobsOptions, type StoreFileInput, type StoredMember, type StoredNotification, type StoredObject, type StoredOrganization, type StoredUser, type StrayValues, type SubscriptionDefinition, type SubscriptionEvent, type SubscriptionOptions, type TenantValue, type ToolAnnotations, type ToolCall, type ToolContext, type ToolRecord, type ToolRecords, type ToolSpec, type TrustedApp, type TurnOptions, type UnreadableEntry, type Urgency, type User, type UserCreatedHook, type VapidSettings, type ViewSource, type WebPushFields, type WebPushOptions, type WebhooksOptions, type WidgetOptions, type WriteEvent, type WriteOperation, type WriteRecordToolsInput, addAppRoleToOwners, addMember, apiKeyCaller, apiKeySettings, apiKeyVariables, appPool, aspectRatio, assistantProtocolRoutes, assistantRoles, assistantSettings, assistantVariables, authSchemaMigration, authStoreTables, backgroundSettled, badRequest, batchWriteTool, beforeSignInPluginsVariable, betterAuthAuthenticator, betterAuthTokens, capSocketMessages, changesMigration, checkAi, checkAuthSchema, checkChanges, checkComments, checkComputed, checkJobsSchema, checkNotificationsSchema, checkQueryRunner, checkSourceNames, checkViewQueries, checkWebhooksSchema, coalesce, commentsMigration, composeRelease, computedMigration, configExports, consoleAuditQueue, conversationKey, createAdmin, createAuth, createConversations, createEncryptionTools, createFileCleanup, createOrganization, createRecordTool, createUser, defaultAppName, defaultHistoryPage, defaultSignInPolicy, defineConfig, defineEmail, defineFunction, defineJob, defineTool, deleteRecordTool, deleteUser, deviceIdParam, deviceStore, devicesPath, errorReportingSettings, errorReportingVariable, eventMatcher, fileConversationStore, fileSize, fileType, forbidden, formatUri, functionApp, generateVapidKeys, getRecordTool, goTruePath, handleDroppedConnections, hasUsers, historyIdParam, historyIdPattern, historyLimits, historyPath, historyStore, honorSocketMessageCaps, imageSize, isBackgroundWork, isCaptured, isJobDefinition, isOAuthWellKnownPath, isSchedule, issueToken, jobDefinitions, jobsDrainApp, jobsSchema, jobsSchemaMigration, jwtAuthenticator, jwtVerifier, limitedFileStore, listOrganizations, listRecordsTool, listResourcesTool, listUsers, localFileStore, localFiles, longQueryPool, longQueryTimeoutMs, mapSettings, mapStyleUrl, mapStyleVariable, maxDevicesPerUser, maxHistoryPage, maxTokenTtlSeconds, maxTtlSeconds, maxUnreadCount, maxWidgetPropsBytes, mcpGate, mcpHandler, mcpRoutes, mcpServer, mcpToolContext, mcpTools, mergeConfig, migrationCommand, mobileReleaseApp, mobileSigningKeyVariable, newWebhookSecret, normalizeRoles, notFound, notificationSenders, notifications, notificationsMigration, oauthWellKnownPaths, objectKey, parseColumns, parseRoles, passwordLength, pluginOptions, pluginsBeforeSignIn, pluginsFor, pluginsVariable, pngIcons, poolWaitMs, postgresDeviceStore, postgresHistoryStore, processor, pushMessage, queryRunnerMigration, readDbConnections, readJson, readOnlyQueryTool, readOperatorSettings, readOutbox, readPlatformSignIn, readRecordTools, readSigningKey, readVapidSettings, readWriteQueryTool, readableResources, realtimeLimits, recordOf, releaseManifest, removeDevicesWithUsers, removeHistoryWithUsers, removeMember, renderVariant, requestApproval, requireEnv, resourceChange, roleChoices, runInBackground, runReadOnlyQuery, runReadWriteQuery, runTurn, runtimeUrl, runtimeVariable, s3FileStore, s3Files, seesAssistant, seesRuntime, sessionOf, setMemberRoles, setUserBanned, setUserRole, shownAppName, signInPolicyMethods, socketMessageCapOf, sourceOptions, sourcesFor, sourcesVariable, startErrorReporting, startJobs, storageCleanupSchedule, storageProvider, storeFile, storeUsage, streamChatCompletion, subscription, supabasePath, thumbHash, unauthorized, updateRecordTool, urgencies, vapidPrivateKeyVariable, vapidPublicKeyVariable, vapidSubjectVariable, variantPath, verifySignature, verifyStandardWebhook, waitUntil, wantsLongQueries, webManifestPath, webPushSender, webauthnPath, webhooks, webhooksMigration, widget, withCacheBreakpoints, withTrustedApps, writeRecordTools };

package/dist/index.js

@@ -56,10 +56,20 @@ import { recordOf, resourceChange } from "./changes/resource-change.js";
 import { defineFunction } from "./functions/define-function.js";
 import { newWebhookSecret } from "./webhooks/standard-webhooks.js";
 import { subscription } from "./webhooks/subscription.js";
+import { maxHistoryPage, maxUnreadCount } from "./notifications/history-store.js";
+import { generateVapidKeys } from "./notifications/web-push/keys.js";
 import { DeviceStoreError, postgresDeviceStore } from "./notifications/postgres-store.js";
 import { deviceStore, removeDevicesWithUsers } from "./notifications/device-store-of.js";
-import { deviceIdParam, devicesPath } from "./notifications/paths.js";
+import { historyIdPattern, historyLimits } from "./notifications/history.js";
+import { HistoryStoreError, postgresHistoryStore } from "./notifications/postgres-history-store.js";
+import { historyStore, removeHistoryWithUsers } from "./notifications/history-store-of.js";
+import { deviceIdParam, devicesPath, historyIdParam, historyPath } from "./notifications/paths.js";
+import { defaultHistoryPage } from "./notifications/history-routes.js";
 import { maxDevicesPerUser } from "./notifications/routes.js";
+import { PushMessageError, maxTtlSeconds, pushMessage, urgencies } from "./notifications/message.js";
+import { readVapidSettings, vapidPrivateKeyVariable, vapidPublicKeyVariable, vapidSubjectVariable } from "./notifications/web-push/vapid-settings.js";
+import { webPushSender } from "./notifications/web-push/web-push-sender.js";
+import { notificationSenders } from "./notifications/senders-of.js";
 import { errorReportingSettings, errorReportingVariable } from "./error-reporting/error-reporting-settings.js";
 import { storageCleanupSchedule } from "./files/cleanup-schedule.js";
 import { limitedFileStore, storeUsage } from "./files/limits.js";
@@ -110,4 +120,4 @@ import { jobsDrainApp } from "./jobs/drain-route.js";
 import { composeRelease, releaseManifest } from "./mobile-release/release.js";
 import { mobileReleaseApp } from "./mobile-release/release-app.js";
 import { mobileSigningKeyVariable, readSigningKey } from "./mobile-release/signing-key.js";
-export { ConnectionsBusy, DeviceStoreError, FatalJobError, HttpProblem, MissingCredentials, ModelError, addAppRoleToOwners, addMember, apiKeyCaller, apiKeySettings, apiKeyVariables, appPool, aspectRatio, assistantProtocolRoutes, assistantRoles, assistantSettings, assistantVariables, authSchemaMigration, authStoreTables, backgroundSettled, badRequest, batchWriteTool, beforeSignInPluginsVariable, betterAuthAuthenticator, betterAuthTokens, capSocketMessages, changesMigration, checkAi, checkAuthSchema, checkChanges, checkComments, checkComputed, checkJobsSchema, checkNotificationsSchema, checkQueryRunner, checkSourceNames, checkViewQueries, checkWebhooksSchema, coalesce, commentsMigration, composeRelease, computedMigration, configExports, consoleAuditQueue, conversationKey, createAdmin, createAuth, createConversations, createEncryptionTools, createFileCleanup, createOrganization, createRecordTool, createUser, defaultAppName, defaultSignInPolicy, defineConfig, defineEmail, defineFunction, defineJob, defineTool, deleteRecordTool, deleteUser, deviceIdParam, deviceStore, devicesPath, errorReportingSettings, errorReportingVariable, eventMatcher, fileConversationStore, fileSize, fileType, forbidden, formatUri, functionApp, getRecordTool, goTruePath, handleDroppedConnections, hasUsers, honorSocketMessageCaps, imageSize, isBackgroundWork, isCaptured, isJobDefinition, isOAuthWellKnownPath, isSchedule, issueToken, jobDefinitions, jobsDrainApp, jobsSchema, jobsSchemaMigration, jwtAuthenticator, jwtVerifier, limitedFileStore, listOrganizations, listRecordsTool, listResourcesTool, listUsers, localFileStore, localFiles, longQueryPool, longQueryTimeoutMs, mapSettings, mapStyleUrl, mapStyleVariable, maxDevicesPerUser, maxTokenTtlSeconds, maxWidgetPropsBytes, mcpGate, mcpHandler, mcpRoutes, mcpServer, mcpToolContext, mcpTools, mergeConfig, migrationCommand, mobileReleaseApp, mobileSigningKeyVariable, newWebhookSecret, normalizeRoles, notFound, notifications, notificationsMigration, oauthWellKnownPaths, objectKey, parseColumns, parseRoles, passwordLength, pluginOptions, pluginsBeforeSignIn, pluginsFor, pluginsVariable, pngIcons, poolWaitMs, postgresDeviceStore, processor, queryRunnerMigration, readDbConnections, readJson, readOnlyQueryTool, readOperatorSettings, readOutbox, readPlatformSignIn, readRecordTools, readSigningKey, readWriteQueryTool, readableResources, realtimeLimits, recordOf, releaseManifest, removeDevicesWithUsers, removeMember, renderVariant, requestApproval, requireEnv, resourceChange, roleChoices, runInBackground, runReadOnlyQuery, runReadWriteQuery, runTurn, runtimeUrl, runtimeVariable, s3FileStore, s3Files, seesAssistant, seesRuntime, sessionOf, setMemberRoles, setUserBanned, setUserRole, shownAppName, signInPolicyMethods, socketMessageCapOf, sourceOptions, sourcesFor, sourcesVariable, startErrorReporting, startJobs, storageCleanupSchedule, storageProvider, storeFile, storeUsage, streamChatCompletion, subscription, supabasePath, thumbHash, unauthorized, updateRecordTool, variantPath, verifySignature, verifyStandardWebhook, waitUntil, wantsLongQueries, webManifestPath, webauthnPath, webhooks, webhooksMigration, widget, withCacheBreakpoints, withTrustedApps, writeRecordTools };
+export { ConnectionsBusy, DeviceStoreError, FatalJobError, HistoryStoreError, HttpProblem, MissingCredentials, ModelError, PushMessageError, addAppRoleToOwners, addMember, apiKeyCaller, apiKeySettings, apiKeyVariables, appPool, aspectRatio, assistantProtocolRoutes, assistantRoles, assistantSettings, assistantVariables, authSchemaMigration, authStoreTables, backgroundSettled, badRequest, batchWriteTool, beforeSignInPluginsVariable, betterAuthAuthenticator, betterAuthTokens, capSocketMessages, changesMigration, checkAi, checkAuthSchema, checkChanges, checkComments, checkComputed, checkJobsSchema, checkNotificationsSchema, checkQueryRunner, checkSourceNames, checkViewQueries, checkWebhooksSchema, coalesce, commentsMigration, composeRelease, computedMigration, configExports, consoleAuditQueue, conversationKey, createAdmin, createAuth, createConversations, createEncryptionTools, createFileCleanup, createOrganization, createRecordTool, createUser, defaultAppName, defaultHistoryPage, defaultSignInPolicy, defineConfig, defineEmail, defineFunction, defineJob, defineTool, deleteRecordTool, deleteUser, deviceIdParam, deviceStore, devicesPath, errorReportingSettings, errorReportingVariable, eventMatcher, fileConversationStore, fileSize, fileType, forbidden, formatUri, functionApp, generateVapidKeys, getRecordTool, goTruePath, handleDroppedConnections, hasUsers, historyIdParam, historyIdPattern, historyLimits, historyPath, historyStore, honorSocketMessageCaps, imageSize, isBackgroundWork, isCaptured, isJobDefinition, isOAuthWellKnownPath, isSchedule, issueToken, jobDefinitions, jobsDrainApp, jobsSchema, jobsSchemaMigration, jwtAuthenticator, jwtVerifier, limitedFileStore, listOrganizations, listRecordsTool, listResourcesTool, listUsers, localFileStore, localFiles, longQueryPool, longQueryTimeoutMs, mapSettings, mapStyleUrl, mapStyleVariable, maxDevicesPerUser, maxHistoryPage, maxTokenTtlSeconds, maxTtlSeconds, maxUnreadCount, maxWidgetPropsBytes, mcpGate, mcpHandler, mcpRoutes, mcpServer, mcpToolContext, mcpTools, mergeConfig, migrationCommand, mobileReleaseApp, mobileSigningKeyVariable, newWebhookSecret, normalizeRoles, notFound, notificationSenders, notifications, notificationsMigration, oauthWellKnownPaths, objectKey, parseColumns, parseRoles, passwordLength, pluginOptions, pluginsBeforeSignIn, pluginsFor, pluginsVariable, pngIcons, poolWaitMs, postgresDeviceStore, postgresHistoryStore, processor, pushMessage, queryRunnerMigration, readDbConnections, readJson, readOnlyQueryTool, readOperatorSettings, readOutbox, readPlatformSignIn, readRecordTools, readSigningKey, readVapidSettings, readWriteQueryTool, readableResources, realtimeLimits, recordOf, releaseManifest, removeDevicesWithUsers, removeHistoryWithUsers, removeMember, renderVariant, requestApproval, requireEnv, resourceChange, roleChoices, runInBackground, runReadOnlyQuery, runReadWriteQuery, runTurn, runtimeUrl, runtimeVariable, s3FileStore, s3Files, seesAssistant, seesRuntime, sessionOf, setMemberRoles, setUserBanned, setUserRole, shownAppName, signInPolicyMethods, socketMessageCapOf, sourceOptions, sourcesFor, sourcesVariable, startErrorReporting, startJobs, storageCleanupSchedule, storageProvider, storeFile, storeUsage, streamChatCompletion, subscription, supabasePath, thumbHash, unauthorized, updateRecordTool, urgencies, vapidPrivateKeyVariable, vapidPublicKeyVariable, vapidSubjectVariable, variantPath, verifySignature, verifyStandardWebhook, waitUntil, wantsLongQueries, webManifestPath, webPushSender, webauthnPath, webhooks, webhooksMigration, widget, withCacheBreakpoints, withTrustedApps, writeRecordTools };

package/dist/meta.d.ts

@@ -49,6 +49,10 @@ export type CallerMeta = {
   errorReporting?: ErrorReportingSettings;
   /** The map style the admin app draws its maps with, and the layers they may switch to, when the app has one: public, as the tiles are. */
   maps?: MapSettings;
+  /** The VAPID public key browsers subscribe for Web Push with, when the app's notifications deliver to browsers: public, as any VAPID key is. */
+  notifications?: {
+    webPushKey: string;
+  };
   /** The language the admin app's screens are in, when the app sets one for everyone. */
   locale?: Locale;
   /** The hosts besides the app's own whose images the admin app draws with the page's referrer, when there are any. */

package/dist/meta.js

@@ -90,6 +90,7 @@ const createMeta = (deps, appName, appIcon) => {
 			...deps.runtime && seesRuntime(session.user.roles) && { runtime: { url: deps.runtime } },
 			...deps.errorReporting && { errorReporting: deps.errorReporting },
 			...deps.maps && { maps: deps.maps },
+			...deps.webPushKey && { notifications: { webPushKey: deps.webPushKey } },
 			...deps.locale && { locale: deps.locale },
 			...deps.files && deps.files.trustedHosts.length > 0 && { files: { trustedHosts: deps.files.trustedHosts } },
 			...plugins.length > 0 && { plugins },

package/dist/notifications/caller.js

@@ -1,16 +1,16 @@
 import { forbidden } from "../problem.js";
 //#region src/notifications/caller.ts
 /**
-* The id of the user whose devices a request may register and remove: only someone signed in as themselves. Refused:
-* visitors, outside apps acting for the user (an MCP client), and every session whose authenticator does not mark it as
-* the user's own sign-in (`Session.signIn`), staff signed in as the user included.
+* The id of the user whose devices and notification history a request may reach: only someone signed in as themselves.
+* Refused: visitors, outside apps acting for the user (an MCP client), and every session whose authenticator does not
+* mark it as the user's own sign-in (`Session.signIn`), staff signed in as the user included.
 */
-const ownDeviceUser = (session) => {
-	const refuse = () => forbidden("own-sign-in-only", "Only someone signed in as themselves can change their devices");
+const ownSignInUser = (session) => {
+	const refuse = () => forbidden("own-sign-in-only", "Only someone signed in as themselves can reach their devices and notifications");
 	if (session.anonymous || session.client || session.signIn?.staff !== false) throw refuse();
 	const userId = String(session.user.id);
 	if (userId === "" || session.user.id === void 0 || session.user.id === null) throw refuse();
 	return userId;
 };
 //#endregion
-export { ownDeviceUser };
+export { ownSignInUser };

package/dist/notifications/device.js

@@ -1,5 +1,11 @@
 //#region src/notifications/device.ts
+/** How a device receives push: a browser's Web Push subscription, an iOS app's APNs token or an Android app's FCM token. */
+const deviceKinds = [
+	"web",
+	"apns",
+	"fcm"
+];
 /** The APNs environment an iOS build's token belongs to. */
 const apnsEnvironments = ["sandbox", "production"];
 //#endregion
-export { apnsEnvironments };
+export { apnsEnvironments, deviceKinds };

package/dist/notifications/guarded-sender.js

@@ -0,0 +1,61 @@
+import { PushMessageError, pushMessage } from "./message.js";
+//#region src/notifications/guarded-sender.ts
+const results = /* @__PURE__ */ new Set([
+	"ok",
+	"gone",
+	"retry"
+]);
+const deepFrozen = (value) => {
+	if (typeof value !== "object" || value === null) return value;
+	for (const item of Object.values(value)) deepFrozen(item);
+	return Object.freeze(value);
+};
+const validAnswer = (answer) => {
+	if (typeof answer !== "object" || answer === null) return false;
+	const { id, result, retryAfterSeconds } = answer;
+	if (typeof id !== "string" || typeof result !== "string" || !results.has(result)) return false;
+	return retryAfterSeconds === void 0 || Number.isInteger(retryAfterSeconds) && retryAfterSeconds >= 0;
+};
+const answersFor = (batch, given) => {
+	const byId = /* @__PURE__ */ new Map();
+	for (const answer of Array.isArray(given) ? given : []) {
+		if (!validAnswer(answer) || byId.has(answer.id)) continue;
+		byId.set(answer.id, {
+			id: answer.id,
+			result: answer.result,
+			...answer.retryAfterSeconds !== void 0 && { retryAfterSeconds: answer.retryAfterSeconds }
+		});
+	}
+	return batch.map((device) => byId.get(device.id) ?? {
+		id: device.id,
+		result: "retry"
+	});
+};
+/**
+* `sender` as the code that sends calls it, whether built in or the app's own: the message is checked as `pushMessage`
+* checks it, and refused before the sender sees it; the sender gets a frozen copy of it and of the devices of its kinds
+* only, and answers each of those once, as above. A sender that throws throws an error of its own naming its index,
+* never the sender's, which may carry an endpoint or a key, but for a `PushMessageError`, which names a field only.
+*/
+const guardedSender = (sender, index) => {
+	const send = async (given, devices) => {
+		const message = deepFrozen(pushMessage(given));
+		const batch = deepFrozen(devices.filter((device) => sender.kinds.includes(device.kind)).map((device) => structuredClone(device)));
+		if (batch.length === 0) return [];
+		let answers;
+		try {
+			answers = await sender.send(message, batch);
+		} catch (error) {
+			if (error instanceof PushMessageError) throw error;
+			throw new Error(`notifications sender ${index} failed`);
+		}
+		return answersFor(batch, answers);
+	};
+	return {
+		kinds: [...sender.kinds],
+		...sender.publicKey !== void 0 && { publicKey: sender.publicKey },
+		send
+	};
+};
+//#endregion
+export { guardedSender };

package/dist/notifications/history-cursor.js

@@ -0,0 +1,40 @@
+import { badRequest } from "../problem.js";
+import { historyIdPattern } from "./history.js";
+//#region src/notifications/history-cursor.ts
+const base64url = /^[A-Za-z0-9_-]{1,200}$/;
+/** The cursor of the page after `position`: its time and id as base64url JSON, nothing of the user or the page size. */
+const historyCursor = (position) => Buffer.from(JSON.stringify({
+	t: position.createdAt.getTime(),
+	i: position.id
+})).toString("base64url");
+const refused = () => badRequest("invalid-cursor", "The cursor is not one a history page gave");
+const decoded = (cursor) => {
+	if (!base64url.test(cursor)) return void 0;
+	const bytes = Buffer.from(cursor, "base64url");
+	if (bytes.toString("base64url") !== cursor) return void 0;
+	const text = bytes.toString("utf8");
+	if (!text.startsWith("{")) return void 0;
+	return JSON.parse(text);
+};
+/** The position a cursor holds, or a 400 that says nothing of what was wrong with it: exactly a time and an entry id. */
+const historyPosition = (cursor) => {
+	let value;
+	try {
+		value = decoded(cursor);
+	} catch (error) {
+		if (error instanceof SyntaxError) throw refused();
+		throw error;
+	}
+	if (typeof value !== "object" || value === null || Array.isArray(value)) throw refused();
+	const keys = Object.keys(value).sort();
+	const { t, i } = value;
+	if (keys.join() !== "i,t" || !Number.isSafeInteger(t) || t < 0 || typeof i !== "string" || !historyIdPattern.test(i)) throw refused();
+	const createdAt = new Date(t);
+	if (Number.isNaN(createdAt.getTime())) throw refused();
+	return {
+		createdAt,
+		id: i
+	};
+};
+//#endregion
+export { historyCursor, historyPosition };

package/dist/notifications/history-request.js

@@ -0,0 +1,40 @@
+import { HttpProblem, badRequest } from "../problem.js";
+import { bodyLimit } from "hono/body-limit";
+//#region src/notifications/history-request.ts
+/** The largest body a history request takes, in bytes. */
+const maxHistoryBodyBytes = 1024;
+/** Refuses a body that is not `application/json`, so no plain form posted from another site reaches a mark. */
+const jsonOnly = async (c, next) => {
+	if (c.req.header("content-type")?.split(";")[0]?.trim().toLowerCase() !== "application/json") throw new HttpProblem(415, "json-only", "Unsupported Media Type", "Send application/json");
+	await next();
+};
+const limitedBody = bodyLimit({
+	maxSize: maxHistoryBodyBytes,
+	onError: () => {
+		throw new HttpProblem(413, "too-large", "Payload Too Large", `The body is larger than ${maxHistoryBodyBytes} bytes`);
+	}
+});
+/** The request's JSON body, `undefined` when it is empty, or a 400 when it is no JSON. */
+const jsonBody = async (c) => {
+	const text = await c.req.text();
+	if (text.trim() === "") return void 0;
+	try {
+		return JSON.parse(text);
+	} catch (error) {
+		if (error instanceof SyntaxError) throw badRequest("invalid-json", "The body is not JSON");
+		throw error;
+	}
+};
+/** The query's parameters, each at most once, or a 400 naming the first that is none of `allowed`. */
+const queryOf = (c, allowed) => {
+	const given = c.req.queries();
+	const query = {};
+	for (const [key, values] of Object.entries(given)) {
+		if (!allowed.includes(key)) throw badRequest("unknown-parameter", `This endpoint takes no parameter "${key.slice(0, 64)}"`);
+		if (values.length !== 1) throw badRequest("repeated-parameter", `The parameter "${key}" is given more than once`);
+		query[key] = values[0];
+	}
+	return query;
+};
+//#endregion
+export { jsonBody, jsonOnly, limitedBody, maxHistoryBodyBytes, queryOf };

package/dist/notifications/history-routes.d.ts

@@ -0,0 +1,6 @@
+import "../types.js";
+import { Hono } from "hono";
+//#region src/notifications/history-routes.d.ts
+/** How many entries a page of the history holds when the request names no `limit`. */
+export declare const defaultHistoryPage = 20;
+//#endregion

package/dist/notifications/history-routes.js

@@ -0,0 +1,84 @@
+import { badRequest } from "../problem.js";
+import "./history-store.js";
+import { historyIdPattern } from "./history.js";
+import { ownSignInUser } from "./caller.js";
+import { historyCursor, historyPosition } from "./history-cursor.js";
+import { jsonBody, jsonOnly, limitedBody, queryOf } from "./history-request.js";
+import { historyUrl } from "./history-url.js";
+import "./paths.js";
+import { Hono } from "hono";
+import { z } from "zod";
+//#region src/notifications/history-routes.ts
+/** How many entries a page of the history holds when the request names no `limit`. */
+const defaultHistoryPage = 20;
+const ownSignIn = async (c, next) => {
+	c.set("historyUser", ownSignInUser(c.get("session")));
+	await next();
+};
+const noStore = { "Cache-Control": "no-store" };
+const pageLimit = (limit) => {
+	if (limit === void 0) return 20;
+	const value = /^[1-9][0-9]{0,2}$/.test(limit) ? Number(limit) : 0;
+	if (value < 1 || value > 50) throw badRequest("invalid-limit", `The limit is a whole number from 1 to 50`);
+	return value;
+};
+const markAll = z.strictObject({ upTo: z.iso.datetime({ offset: true }) });
+/**
+* The caller's own notification history, mounted at `historyPath` behind the API's authenticator: `GET /` a page of
+* it, newest first, `GET /unread` how many are unread, `POST /read` marks all read up to the newest the caller was
+* shown, `POST /<id>/read` one. No request names a user: each reaches the signed-in user's own entries alone. `origins`
+* are the app's own, which an absolute url may lead to.
+*/
+const historyRoutes = (store, origins) => {
+	const app = new Hono();
+	const answer = (entry) => ({
+		id: entry.id,
+		title: entry.title,
+		body: entry.body,
+		url: historyUrl(entry.url, origins),
+		data: entry.data,
+		createdAt: entry.createdAt.toISOString(),
+		readAt: entry.readAt === null ? null : entry.readAt.toISOString()
+	});
+	app.get("/", ownSignIn, async (c) => {
+		const userId = c.get("historyUser");
+		const query = queryOf(c, ["cursor", "limit"]);
+		const limit = pageLimit(query.limit);
+		const before = query.cursor === void 0 ? void 0 : historyPosition(query.cursor);
+		const entries = await store.list(userId, {
+			...before && { before },
+			limit
+		});
+		if (entries.length > limit || entries.some((entry) => entry.userId !== userId || !historyIdPattern.test(entry.id))) throw new Error("The history store answered list with entries that are not the caller's");
+		const last = entries.at(-1);
+		const next = last && entries.length === limit ? historyCursor(last) : null;
+		return c.json({
+			items: entries.map(answer),
+			next
+		}, 200, noStore);
+	});
+	app.get("/unread", ownSignIn, async (c) => {
+		queryOf(c, []);
+		const count = await store.countUnread(c.get("historyUser"));
+		if (!Number.isSafeInteger(count) || count < 0 || count > 100) throw new Error("The history store answered countUnread with no count");
+		return c.json({ count }, 200, noStore);
+	});
+	app.post("/read", ownSignIn, jsonOnly, limitedBody, async (c) => {
+		queryOf(c, []);
+		const parsed = markAll.safeParse(await jsonBody(c));
+		if (!parsed.success) throw badRequest("invalid-mark", "Send { \"upTo\": <createdAt of the newest notification shown> }");
+		await store.markAllRead(c.get("historyUser"), new Date(parsed.data.upTo));
+		return c.body(null, 204);
+	});
+	app.post(`/:id/read`, ownSignIn, jsonOnly, limitedBody, async (c) => {
+		queryOf(c, []);
+		const body = await jsonBody(c);
+		if (body !== void 0 && (typeof body !== "object" || body === null || Array.isArray(body) || Object.keys(body).length > 0)) throw badRequest("invalid-mark", "Marking one read takes no body");
+		const id = c.req.param("id");
+		if (historyIdPattern.test(id)) await store.markRead(c.get("historyUser"), id);
+		return c.body(null, 204);
+	});
+	return app;
+};
+//#endregion
+export { defaultHistoryPage, historyRoutes };

package/dist/notifications/history-sql.js

@@ -0,0 +1,31 @@
+import { quoteIdent } from "../changes/capture-sql.js";
+import { qualified } from "./schema-sql.js";
+//#region src/notifications/history-sql.ts
+/**
+* The history table: with auth, its user column points at auth's users table and goes with the user. `read_at` is NULL
+* while unread and nothing has a default. One index serves a user's newest-first pages, another their unread ones.
+*/
+const historyTableSql = ({ schema, table, columns }, user) => {
+	const c = Object.fromEntries(Object.entries(columns).map(([name, value]) => [name, quoteIdent(value)]));
+	const history = qualified({
+		schema,
+		table
+	});
+	return [
+		`create schema if not exists ${quoteIdent(schema)}`,
+		`create table ${history} (
+  ${c.id} uuid primary key,
+  ${c.user_id} ${user.type} not null${user.references ? ` references ${user.references} on delete cascade` : ""},
+  ${c.title} text not null,
+  ${c.body} text,
+  ${c.url} text,
+  ${c.data} jsonb,
+  ${c.created_at} timestamptz not null,
+  ${c.read_at} timestamptz
+)`,
+		`create index on ${history} (${c.user_id}, ${c.created_at} desc, ${c.id} desc)`,
+		`create index on ${history} (${c.user_id}, ${c.created_at}) where ${c.read_at} is null`
+	];
+};
+//#endregion
+export { historyTableSql };

package/dist/notifications/history-store-of.d.ts

@@ -0,0 +1,13 @@
+import { AdminAuth } from "../better-auth/create-auth.js";
+import { HistoryStore } from "./history-store.js";
+import { NotificationsOptions } from "./options.js";
+import { Db } from "@protobase/query";
+//#region src/notifications/history-store-of.d.ts
+/**
+ * The history's store `notifications()` configures: the app's own `historyStore`, or the history table in `db`. An app
+ * that deletes users without Protobase's auth calls its `removeAllForUser` as it deletes one.
+ */
+export declare const historyStore: (db: Db, options?: NotificationsOptions) => HistoryStore;
+/** Has `auth` remove a user's history from `store` when it deletes the user, before and once more after. */
+export declare const removeHistoryWithUsers: (auth: AdminAuth, store: HistoryStore) => void;
+//#endregion

package/dist/notifications/history-store-of.js

@@ -0,0 +1,13 @@
+import { postgresHistoryStore } from "./postgres-history-store.js";
+//#region src/notifications/history-store-of.ts
+/**
+* The history's store `notifications()` configures: the app's own `historyStore`, or the history table in `db`. An app
+* that deletes users without Protobase's auth calls its `removeAllForUser` as it deletes one.
+*/
+const historyStore = (db, options = {}) => options.historyStore ?? postgresHistoryStore(db, options);
+/** Has `auth` remove a user's history from `store` when it deletes the user, before and once more after. */
+const removeHistoryWithUsers = (auth, store) => {
+	auth.userDeletion.set("notifications-history", (userId) => store.removeAllForUser(userId));
+};
+//#endregion
+export { historyStore, removeHistoryWithUsers };

package/dist/notifications/history-store.d.ts

@@ -0,0 +1,29 @@
+import { HistoryPosition, NewNotification, StoredNotification } from "./history.js";
+//#region src/notifications/history-store.d.ts
+/** The most unread notifications `countUnread` counts: a bell shows "99+" past it. */
+export declare const maxUnreadCount = 100;
+/**
+ * Where each user's inbox notifications are kept: the Postgres default (`postgresHistoryStore`), or a store of the
+ * app's own passed as `notifications({ historyStore })`. Plain data in and out, so any store can implement it. Every
+ * method takes the user and touches that user's entries alone; each throws on an empty user id or id.
+ */
+export type HistoryStore = {
+  /** Keeps the notification for `userId`, unread, created now, under a new id matching `historyIdPattern`. */
+  record: (userId: string, notification: NewNotification) => Promise<StoredNotification>;
+  /** At most `limit` of the user's entries, newest first by creation time then id, starting after `before`. */
+  list: (userId: string, page: {
+    before?: HistoryPosition;
+    limit: number;
+  }) => Promise<StoredNotification[]>;
+  /** How many of the user's entries are unread, counting up to `maxUnreadCount` at most. */
+  countUnread: (userId: string) => Promise<number>;
+  /** Marks the user's entry with this id read now, unless it was read already; false when the user has none such. */
+  markRead: (userId: string, id: string) => Promise<boolean>;
+  /** Marks the user's unread entries created at or before `upTo` read now; entries read already keep their time. */
+  markAllRead: (userId: string, upTo: Date) => Promise<void>;
+  /** Removes every entry of the user, as when the user is deleted. */
+  removeAllForUser: (userId: string) => Promise<void>;
+};
+/** The most entries `list` gives at once. */
+export declare const maxHistoryPage = 50;
+//#endregion

package/dist/notifications/history-store.js

@@ -0,0 +1,39 @@
+//#region src/notifications/history-store.ts
+/** The most unread notifications `countUnread` counts: a bell shows "99+" past it. */
+const maxUnreadCount = 100;
+const methods = [
+	"record",
+	"list",
+	"countUnread",
+	"markRead",
+	"markAllRead",
+	"removeAllForUser"
+];
+/** The store, checked to have every method; a missing one is an error naming it. */
+const checkHistoryStore = (store) => {
+	const missing = methods.find((method) => typeof store[method] !== "function");
+	if (missing !== void 0) throw new Error(`notifications({ historyStore }): the history store has no ${missing} method`);
+	return store;
+};
+/** The most entries `list` gives at once. */
+const maxHistoryPage = 50;
+/** The value, refused when empty: no store call may be read as "every user". */
+const requiredText = (name, value) => {
+	if (typeof value !== "string" || value === "") throw new Error(`The history store needs a ${name}`);
+	return value;
+};
+/** The time, refused when it is no valid `Date`. */
+const requiredTime = (name, value) => {
+	if (!(value instanceof Date) || Number.isNaN(value.getTime())) throw new Error(`The history store needs a ${name}`);
+	return value;
+};
+/** The page asked for, refused unless its limit is a whole number from 1 to `maxHistoryPage` and its position whole. */
+const requiredPage = (page) => {
+	if (typeof page !== "object" || page === null || !Number.isInteger(page.limit) || page.limit < 1 || page.limit > 50) throw new Error(`The history store needs a page limit from 1 to 50`);
+	if (page.before === void 0) return page;
+	requiredTime("position time", page.before.createdAt);
+	requiredText("position id", page.before.id);
+	return page;
+};
+//#endregion
+export { checkHistoryStore, maxHistoryPage, maxUnreadCount, requiredPage, requiredText, requiredTime };

package/dist/notifications/history-url.js

@@ -0,0 +1,18 @@
+//#region src/notifications/history-url.ts
+const ownPath = /^\/(?![/\\])[^\s\u0000-\u001f\u007f-\u009f]*$/;
+const absolute = /^https?:\/\//i;
+/**
+* The url an entry of the history may lead to, as an answer shows it, or `null`: a path on the app, or an absolute
+* `http` or `https` URL without user info whose origin is exactly one of `origins`, the app's own, written as the URL
+* parser writes it. Anything else, another site, `javascript:`, `data:` or a scheme-relative URL, is `null`.
+*/
+const historyUrl = (url, origins) => {
+	if (url === null || url.length > 2048) return null;
+	if (ownPath.test(url)) return url;
+	if (!absolute.test(url) || !URL.canParse(url) || /[\s\u0000-\u001f\u007f-\u009f]/.test(url)) return null;
+	const parsed = new URL(url);
+	if (parsed.username !== "" || parsed.password !== "") return null;
+	return origins.some((origin) => URL.canParse(origin) && new URL(origin).origin === parsed.origin) ? parsed.href : null;
+};
+//#endregion
+export { historyUrl };