@rpcbase/server 0.475.0 → 0.477.0

package/dist/notifications/api/notifications/handler.d.ts

@@ -0,0 +1,4 @@
+import { Api } from '../../../../../api/src';
+declare const _default: (api: Api) => void;
+export default _default;
+//# sourceMappingURL=handler.d.ts.map

package/dist/notifications/api/notifications/handler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"handler.d.ts","sourceRoot":"","sources":["../../../../src/notifications/api/notifications/handler.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAmB,MAAM,cAAc,CAAA;yBAubnC,KAAK,GAAG;AAAxB,wBASC"}

package/dist/notifications/api/notifications/index.d.ts

@@ -0,0 +1,168 @@
+import { z } from '../../../../../vite/node_modules/zod';
+export declare const ListRoute = "/api/rb/notifications";
+export declare const CreateRoute = "/api/rb/notifications/create";
+export declare const MarkReadRoute = "/api/rb/notifications/:notificationId/read";
+export declare const ArchiveRoute = "/api/rb/notifications/:notificationId/archive";
+export declare const MarkAllReadRoute = "/api/rb/notifications/mark-all-read";
+export declare const SettingsRoute = "/api/rb/notifications/settings";
+export declare const DigestRunRoute = "/api/rb/notifications/digest/run";
+export declare const listRequestSchema: z.ZodObject<{
+    includeArchived: z.ZodOptional<z.ZodBoolean>;
+    unreadOnly: z.ZodOptional<z.ZodBoolean>;
+    limit: z.ZodOptional<z.ZodNumber>;
+    markSeen: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strip>;
+export type ListRequestPayload = z.infer<typeof listRequestSchema>;
+export declare const createRequestSchema: z.ZodObject<{
+    topic: z.ZodOptional<z.ZodString>;
+    title: z.ZodString;
+    body: z.ZodOptional<z.ZodString>;
+    url: z.ZodOptional<z.ZodString>;
+    metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+}, z.core.$strip>;
+export type CreateRequestPayload = z.infer<typeof createRequestSchema>;
+export declare const notificationSchema: z.ZodObject<{
+    id: z.ZodString;
+    topic: z.ZodOptional<z.ZodString>;
+    title: z.ZodString;
+    body: z.ZodOptional<z.ZodString>;
+    url: z.ZodOptional<z.ZodString>;
+    createdAt: z.ZodString;
+    seenAt: z.ZodOptional<z.ZodString>;
+    readAt: z.ZodOptional<z.ZodString>;
+    archivedAt: z.ZodOptional<z.ZodString>;
+    metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+}, z.core.$strip>;
+export type NotificationPayload = z.infer<typeof notificationSchema>;
+export declare const listResponseSchema: z.ZodObject<{
+    ok: z.ZodBoolean;
+    error: z.ZodOptional<z.ZodString>;
+    notifications: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        topic: z.ZodOptional<z.ZodString>;
+        title: z.ZodString;
+        body: z.ZodOptional<z.ZodString>;
+        url: z.ZodOptional<z.ZodString>;
+        createdAt: z.ZodString;
+        seenAt: z.ZodOptional<z.ZodString>;
+        readAt: z.ZodOptional<z.ZodString>;
+        archivedAt: z.ZodOptional<z.ZodString>;
+        metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    }, z.core.$strip>>>;
+    unreadCount: z.ZodOptional<z.ZodNumber>;
+    unseenCount: z.ZodOptional<z.ZodNumber>;
+}, z.core.$strip>;
+export type ListResponsePayload = z.infer<typeof listResponseSchema>;
+export declare const createResponseSchema: z.ZodObject<{
+    ok: z.ZodBoolean;
+    error: z.ZodOptional<z.ZodString>;
+    id: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export type CreateResponsePayload = z.infer<typeof createResponseSchema>;
+export declare const markReadResponseSchema: z.ZodObject<{
+    ok: z.ZodBoolean;
+    error: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export type MarkReadResponsePayload = z.infer<typeof markReadResponseSchema>;
+export declare const archiveResponseSchema: z.ZodObject<{
+    ok: z.ZodBoolean;
+    error: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export type ArchiveResponsePayload = z.infer<typeof archiveResponseSchema>;
+export declare const markAllReadResponseSchema: z.ZodObject<{
+    ok: z.ZodBoolean;
+    error: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export type MarkAllReadResponsePayload = z.infer<typeof markAllReadResponseSchema>;
+export declare const digestFrequencySchema: z.ZodEnum<{
+    off: "off";
+    daily: "daily";
+    weekly: "weekly";
+}>;
+export type DigestFrequency = z.infer<typeof digestFrequencySchema>;
+export declare const topicPreferenceSchema: z.ZodObject<{
+    topic: z.ZodString;
+    inApp: z.ZodBoolean;
+    emailDigest: z.ZodBoolean;
+    push: z.ZodBoolean;
+}, z.core.$strip>;
+export type TopicPreferencePayload = z.infer<typeof topicPreferenceSchema>;
+export declare const settingsSchema: z.ZodObject<{
+    digestFrequency: z.ZodEnum<{
+        off: "off";
+        daily: "daily";
+        weekly: "weekly";
+    }>;
+    topicPreferences: z.ZodArray<z.ZodObject<{
+        topic: z.ZodString;
+        inApp: z.ZodBoolean;
+        emailDigest: z.ZodBoolean;
+        push: z.ZodBoolean;
+    }, z.core.$strip>>;
+    lastDigestSentAt: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export type SettingsPayload = z.infer<typeof settingsSchema>;
+export declare const settingsResponseSchema: z.ZodObject<{
+    ok: z.ZodBoolean;
+    error: z.ZodOptional<z.ZodString>;
+    settings: z.ZodOptional<z.ZodObject<{
+        digestFrequency: z.ZodEnum<{
+            off: "off";
+            daily: "daily";
+            weekly: "weekly";
+        }>;
+        topicPreferences: z.ZodArray<z.ZodObject<{
+            topic: z.ZodString;
+            inApp: z.ZodBoolean;
+            emailDigest: z.ZodBoolean;
+            push: z.ZodBoolean;
+        }, z.core.$strip>>;
+        lastDigestSentAt: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export type SettingsResponsePayload = z.infer<typeof settingsResponseSchema>;
+export declare const updateSettingsRequestSchema: z.ZodObject<{
+    digestFrequency: z.ZodOptional<z.ZodEnum<{
+        off: "off";
+        daily: "daily";
+        weekly: "weekly";
+    }>>;
+    topicPreferences: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        topic: z.ZodString;
+        inApp: z.ZodBoolean;
+        emailDigest: z.ZodBoolean;
+        push: z.ZodBoolean;
+    }, z.core.$strip>>>;
+}, z.core.$strip>;
+export type UpdateSettingsRequestPayload = z.infer<typeof updateSettingsRequestSchema>;
+export declare const updateSettingsResponseSchema: z.ZodObject<{
+    ok: z.ZodBoolean;
+    error: z.ZodOptional<z.ZodString>;
+    settings: z.ZodOptional<z.ZodObject<{
+        digestFrequency: z.ZodEnum<{
+            off: "off";
+            daily: "daily";
+            weekly: "weekly";
+        }>;
+        topicPreferences: z.ZodArray<z.ZodObject<{
+            topic: z.ZodString;
+            inApp: z.ZodBoolean;
+            emailDigest: z.ZodBoolean;
+            push: z.ZodBoolean;
+        }, z.core.$strip>>;
+        lastDigestSentAt: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export type UpdateSettingsResponsePayload = z.infer<typeof updateSettingsResponseSchema>;
+export declare const digestRunRequestSchema: z.ZodObject<{
+    force: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strip>;
+export type DigestRunRequestPayload = z.infer<typeof digestRunRequestSchema>;
+export declare const digestRunResponseSchema: z.ZodObject<{
+    ok: z.ZodBoolean;
+    error: z.ZodOptional<z.ZodString>;
+    sent: z.ZodOptional<z.ZodBoolean>;
+    skippedReason: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export type DigestRunResponsePayload = z.infer<typeof digestRunResponseSchema>;
+//# sourceMappingURL=index.d.ts.map

package/dist/notifications/api/notifications/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/notifications/api/notifications/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAGvB,eAAO,MAAM,SAAS,0BAA0B,CAAA;AAChD,eAAO,MAAM,WAAW,iCAAiC,CAAA;AACzD,eAAO,MAAM,aAAa,+CAA+C,CAAA;AACzE,eAAO,MAAM,YAAY,kDAAkD,CAAA;AAC3E,eAAO,MAAM,gBAAgB,wCAAwC,CAAA;AACrE,eAAO,MAAM,aAAa,mCAAmC,CAAA;AAC7D,eAAO,MAAM,cAAc,qCAAqC,CAAA;AAEhE,eAAO,MAAM,iBAAiB;;;;;iBAK5B,CAAA;AAEF,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAA;AAElE,eAAO,MAAM,mBAAmB;;;;;;iBAM9B,CAAA;AAEF,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAA;AAEtE,eAAO,MAAM,kBAAkB;;;;;;;;;;;iBAW7B,CAAA;AAEF,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAA;AAEpE,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;iBAM7B,CAAA;AAEF,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAA;AAEpE,eAAO,MAAM,oBAAoB;;;;iBAI/B,CAAA;AAEF,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAA;AAExE,eAAO,MAAM,sBAAsB;;;iBAGjC,CAAA;AAEF,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAA;AAE5E,eAAO,MAAM,qBAAqB;;;iBAGhC,CAAA;AAEF,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAA;AAE1E,eAAO,MAAM,yBAAyB;;;iBAGpC,CAAA;AAEF,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAA;AAElF,eAAO,MAAM,qBAAqB;;;;EAAqC,CAAA;AAEvE,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAA;AAEnE,eAAO,MAAM,qBAAqB;;;;;iBAKhC,CAAA;AAEF,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAA;AAE1E,eAAO,MAAM,cAAc;;;;;;;;;;;;;iBAIzB,CAAA;AAEF,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAA;AAE5D,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;iBAIjC,CAAA;AAEF,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAA;AAE5E,eAAO,MAAM,2BAA2B;;;;;;;;;;;;iBAGtC,CAAA;AAEF,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAA;AAEtF,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;iBAIvC,CAAA;AAEF,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAA;AAExF,eAAO,MAAM,sBAAsB;;iBAEjC,CAAA;AAEF,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAA;AAE5E,eAAO,MAAM,uBAAuB;;;;;iBAKlC,CAAA;AAEF,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAA"}

package/dist/notifications/api/notifications/shared.d.ts

@@ -0,0 +1,6 @@
+import { Ctx } from '../../../../../api/src';
+export declare const getSessionUser: (ctx: Ctx) => {
+    userId: string;
+    tenantId: string;
+} | null;
+//# sourceMappingURL=shared.d.ts.map

package/dist/notifications/api/notifications/shared.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"shared.d.ts","sourceRoot":"","sources":["../../../../src/notifications/api/notifications/shared.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,cAAc,CAAA;AAQvC,eAAO,MAAM,cAAc,GAAI,KAAK,GAAG;;;QAgBtC,CAAA"}

package/dist/notifications/createNotification.d.ts

@@ -0,0 +1,13 @@
+import { Ctx } from '../../../api/src';
+export type CreateNotificationInput = {
+    userId: string;
+    topic?: string;
+    title: string;
+    body?: string;
+    url?: string;
+    metadata?: Record<string, unknown>;
+};
+export declare const createNotification: (ctx: Ctx, input: CreateNotificationInput) => Promise<{
+    id: string;
+}>;
+//# sourceMappingURL=createNotification.d.ts.map

package/dist/notifications/createNotification.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"createNotification.d.ts","sourceRoot":"","sources":["../../src/notifications/createNotification.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,cAAc,CAAA;AAIvC,MAAM,MAAM,uBAAuB,GAAG;IACpC,MAAM,EAAE,MAAM,CAAA;IACd,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CACnC,CAAA;AAED,eAAO,MAAM,kBAAkB,GAC7B,KAAK,GAAG,EACR,OAAO,uBAAuB,KAC7B,OAAO,CAAC;IAAE,EAAE,EAAE,MAAM,CAAA;CAAE,CAyBxB,CAAA"}

package/dist/notifications/digest.d.ts

@@ -0,0 +1,13 @@
+import { Ctx } from '../../../api/src';
+export declare const sendNotificationsDigestForUser: (ctx: Ctx, { userId, force, }: {
+    userId: string;
+    force?: boolean;
+}) => Promise<{
+    ok: true;
+    sent: boolean;
+    skippedReason?: string;
+} | {
+    ok: false;
+    error: string;
+}>;
+//# sourceMappingURL=digest.d.ts.map

package/dist/notifications/digest.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"digest.d.ts","sourceRoot":"","sources":["../../src/notifications/digest.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,cAAc,CAAA;AAuCvC,eAAO,MAAM,8BAA8B,GACzC,KAAK,GAAG,EACR,oBAGG;IACD,MAAM,EAAE,MAAM,CAAA;IACd,KAAK,CAAC,EAAE,OAAO,CAAA;CAChB,KACA,OAAO,CAAC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,OAAO,CAAC;IAAC,aAAa,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CA0F5F,CAAA"}

package/dist/notifications/routes.d.ts

@@ -0,0 +1,2 @@
+export declare const routes: Record<string, unknown>;
+//# sourceMappingURL=routes.d.ts.map

package/dist/notifications/routes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"routes.d.ts","sourceRoot":"","sources":["../../src/notifications/routes.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,MAAM,yBAKb,CAAA"}

package/dist/notifications.d.ts

@@ -0,0 +1,4 @@
+export * from './notifications/routes';
+export * from './notifications/createNotification';
+export * from './notifications/digest';
+//# sourceMappingURL=notifications.d.ts.map

package/dist/notifications.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"notifications.d.ts","sourceRoot":"","sources":["../src/notifications.ts"],"names":[],"mappings":"AAAA,cAAc,wBAAwB,CAAA;AACtC,cAAc,oCAAoC,CAAA;AAClD,cAAc,wBAAwB,CAAA"}

package/dist/notifications.js

@@ -0,0 +1,126 @@
+import { loadModel, loadRbModel } from "@rpcbase/db";
+import { s as sendEmail } from "./email-DEw8keax.js";
+const routes = Object.entries({
+  .../* @__PURE__ */ Object.assign({ "./api/notifications/handler.ts": () => import("./handler-B_mMDLBO.js") })
+}).reduce((acc, [path, mod]) => {
+  acc[path.replace("./api/", "@rpcbase/server/notifications/api/")] = mod;
+  return acc;
+}, {});
+const createNotification = async (ctx, input) => {
+  const userId = input.userId.trim();
+  const title = input.title.trim();
+  if (!userId) {
+    throw new Error("createNotification: userId is required");
+  }
+  if (!title) {
+    throw new Error("createNotification: title is required");
+  }
+  const topic = typeof input.topic === "string" ? input.topic.trim() : "";
+  const body = typeof input.body === "string" ? input.body.trim() : "";
+  const url = typeof input.url === "string" ? input.url.trim() : "";
+  const NotificationModel = await loadModel("RBNotification", ctx);
+  const doc = await NotificationModel.create({
+    userId,
+    ...topic ? { topic } : {},
+    title,
+    ...body ? { body } : {},
+    ...url ? { url } : {},
+    ...input.metadata ? { metadata: input.metadata } : {}
+  });
+  return { id: doc._id.toString() };
+};
+const DAY_MS = 24 * 60 * 60 * 1e3;
+const WEEK_MS = 7 * DAY_MS;
+const getDigestWindowMs = (frequency) => {
+  if (frequency === "daily") return DAY_MS;
+  if (frequency === "weekly") return WEEK_MS;
+  return 0;
+};
+const formatIso = (value) => {
+  if (!(value instanceof Date)) return void 0;
+  return value.toISOString();
+};
+const buildPreferencesByTopic = (settings) => {
+  const record = {};
+  const raw = settings?.topicPreferences;
+  if (!Array.isArray(raw)) return record;
+  for (const pref of raw) {
+    if (!pref || typeof pref !== "object") continue;
+    const topic = typeof pref.topic === "string" ? pref.topic.trim() : "";
+    if (!topic) continue;
+    const emailDigest = pref.emailDigest;
+    record[topic] = { emailDigest: emailDigest === true };
+  }
+  return record;
+};
+const sendNotificationsDigestForUser = async (ctx, {
+  userId,
+  force = false
+}) => {
+  const SettingsModel = await loadModel("RBNotificationSettings", ctx);
+  const NotificationModel = await loadModel("RBNotification", ctx);
+  const settings = await SettingsModel.findOne({ userId }).lean();
+  const digestFrequencyRaw = typeof settings?.digestFrequency === "string" ? settings.digestFrequency : "weekly";
+  const digestFrequency = digestFrequencyRaw === "daily" || digestFrequencyRaw === "weekly" || digestFrequencyRaw === "off" ? digestFrequencyRaw : "weekly";
+  if (digestFrequency === "off") {
+    return { ok: true, sent: false, skippedReason: "digest_off" };
+  }
+  const now = /* @__PURE__ */ new Date();
+  const windowMs = getDigestWindowMs(digestFrequency);
+  const lastSentAt = settings?.lastDigestSentAt instanceof Date ? settings.lastDigestSentAt : null;
+  const since = lastSentAt ?? new Date(now.getTime() - windowMs);
+  if (!force && lastSentAt && now.getTime() - lastSentAt.getTime() < windowMs) {
+    return { ok: true, sent: false, skippedReason: "not_due" };
+  }
+  const preferencesByTopic = buildPreferencesByTopic(settings);
+  const disabledTopics = Object.entries(preferencesByTopic).filter(([, pref]) => pref.emailDigest === false).map(([topic]) => topic);
+  const query = {
+    userId,
+    archivedAt: { $exists: false },
+    readAt: { $exists: false },
+    createdAt: { $gt: since }
+  };
+  if (disabledTopics.length > 0) {
+    query.topic = { $nin: disabledTopics };
+  }
+  const notifications = await NotificationModel.find(query).sort({ createdAt: -1 }).limit(50).lean();
+  if (!notifications.length) {
+    await SettingsModel.updateOne(
+      { userId },
+      { $set: { lastDigestSentAt: now }, $setOnInsert: { userId, digestFrequency: "weekly" } },
+      { upsert: true }
+    );
+    return { ok: true, sent: false, skippedReason: "empty" };
+  }
+  const UserModel = await loadRbModel("RBUser", ctx);
+  const user = await UserModel.findById(userId, { email: 1 }).lean();
+  const email = typeof user?.email === "string" ? user.email.trim() : "";
+  if (!email) {
+    return { ok: true, sent: false, skippedReason: "missing_email" };
+  }
+  const subject = "Notifications digest";
+  const rows = notifications.map((n) => {
+    const title = typeof n.title === "string" ? n.title : "";
+    const body = typeof n.body === "string" ? n.body : "";
+    const url = typeof n.url === "string" ? n.url : "";
+    const createdAt = formatIso(n.createdAt) ?? "";
+    const line = url ? `<li><strong>${title}</strong><br>${body}<br><a href="${url}">${url}</a><br><small>${createdAt}</small></li>` : `<li><strong>${title}</strong><br>${body}<br><small>${createdAt}</small></li>`;
+    return line;
+  }).join("");
+  const html = `<div><p>Here is your notifications digest:</p><ul>${rows}</ul></div>`;
+  const emailResult = await sendEmail({ to: email, subject, html });
+  if (emailResult.error) {
+    return { ok: false, error: emailResult.error };
+  }
+  await SettingsModel.updateOne(
+    { userId },
+    { $set: { lastDigestSentAt: now }, $setOnInsert: { userId, digestFrequency: "weekly" } },
+    { upsert: true }
+  );
+  return { ok: true, sent: emailResult.skipped !== true, ...emailResult.skipped ? { skippedReason: "email_skipped" } : {} };
+};
+export {
+  createNotification,
+  routes,
+  sendNotificationsDigestForUser
+};

package/dist/rts/api/changes/handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"handler.d.ts","sourceRoot":"","sources":["../../../../src/rts/api/changes/handler.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAmB,MAAM,cAAc,CAAA;AAOnD,KAAK,WAAW,GAAG;IACjB,EAAE,CAAC,EAAE,MAAM,CAAA;IACX,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,eAAe,CAAC,EAAE,MAAM,EAAE,CAAA;CAC3B,CAAA;yBA0He,KAAK,GAAG,CAAC,WAAW,CAAC;AAArC,wBAEC"}
+{"version":3,"file":"handler.d.ts","sourceRoot":"","sources":["../../../../src/rts/api/changes/handler.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAmB,MAAM,cAAc,CAAA;AAQnD,KAAK,WAAW,GAAG;IACjB,EAAE,CAAC,EAAE,MAAM,CAAA;IACX,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,eAAe,CAAC,EAAE,MAAM,EAAE,CAAA;CAC3B,CAAA;yBAuIe,KAAK,GAAG,CAAC,WAAW,CAAC;AAArC,wBAEC"}

package/dist/rts/index.d.ts

@@ -1,9 +1,11 @@
 import { Server as HttpServer } from 'node:http';
 import { RequestHandler } from 'express';
+import { AppAbility } from '../../../db/acl/src';
 import { WebSocket } from 'ws';
 type SocketMeta = {
     tenantId: string;
     userId: string;
+    ability: AppAbility;
 };
 type HandlerFn = (socket: RtsSocket) => void | (() => void);
 declare class RtsSocket {
@@ -34,5 +36,5 @@ export declare const initRts: ({ server, path, sessionMiddleware, maxPayloadByte
 }) => void;
 export declare const registerRtsHandler: (handler: HandlerFn) => void;
 export declare const notifyRtsModelChanged: (tenantId: string, modelName: string) => void;
-export {};
+export * from './routes';
 //# sourceMappingURL=index.d.ts.map

package/dist/rts/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/rts/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAmB,MAAM,IAAI,UAAU,EAAE,MAAM,WAAW,CAAA;AAGtE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,SAAS,CAAA;AAI7C,OAAO,EAAiC,KAAK,SAAS,EAAE,MAAM,IAAI,CAAA;AAqBlE,KAAK,UAAU,GAAG;IAChB,QAAQ,EAAE,MAAM,CAAA;IAChB,MAAM,EAAE,MAAM,CAAA;CACf,CAAA;AAoBD,KAAK,SAAS,GAAG,CAAC,MAAM,EAAE,SAAS,KAAK,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,CAAA;AAiC3D,cAAM,SAAS;IACb,SAAgB,EAAE,EAAE,MAAM,CAAA;IAC1B,SAAgB,QAAQ,EAAE,MAAM,CAAA;IAChC,SAAgB,MAAM,EAAE,MAAM,CAAA;IAE9B,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAW;IAC9B,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAqD;gBAE3D,EACjB,EAAE,EACF,EAAE,EACF,IAAI,GACL,EAAE;QACD,EAAE,EAAE,MAAM,CAAA;QACV,EAAE,EAAE,SAAS,CAAA;QACb,IAAI,EAAE,UAAU,CAAA;KACjB;IAOM,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,IAAI,GAAG,MAAM,IAAI;IAOlE,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,IAAI,GAAG,IAAI;IAO7D,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,OAAO,GAAG,IAAI;IAI5C,KAAK,IAAI,IAAI;IAQb,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,IAAI;CAOvD;AAseD,eAAO,MAAM,OAAO,GAAI,4NAQrB;IACD,MAAM,EAAE,UAAU,CAAA;IAClB,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,iBAAiB,CAAC,EAAE,cAAc,CAAA;IAClC,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,yBAAyB,CAAC,EAAE,MAAM,CAAA;IAClC,kBAAkB,CAAC,EAAE,MAAM,CAAA;IAC3B,mBAAmB,CAAC,EAAE,OAAO,CAAA;CAC9B,KAAG,IA8GH,CAAA;AAED,eAAO,MAAM,kBAAkB,GAAI,SAAS,SAAS,KAAG,IAEvD,CAAA;AAED,eAAO,MAAM,qBAAqB,GAAI,UAAU,MAAM,EAAE,WAAW,MAAM,KAAG,IAE3E,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/rts/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAmB,MAAM,IAAI,UAAU,EAAE,MAAM,WAAW,CAAA;AAGtE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,SAAS,CAAA;AAE7C,OAAO,EAAmH,KAAK,UAAU,EAAE,MAAM,iBAAiB,CAAA;AAGlK,OAAO,EAAiC,KAAK,SAAS,EAAE,MAAM,IAAI,CAAA;AAqBlE,KAAK,UAAU,GAAG;IAChB,QAAQ,EAAE,MAAM,CAAA;IAChB,MAAM,EAAE,MAAM,CAAA;IACd,OAAO,EAAE,UAAU,CAAA;CACpB,CAAA;AAoBD,KAAK,SAAS,GAAG,CAAC,MAAM,EAAE,SAAS,KAAK,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,CAAA;AAiC3D,cAAM,SAAS;IACb,SAAgB,EAAE,EAAE,MAAM,CAAA;IAC1B,SAAgB,QAAQ,EAAE,MAAM,CAAA;IAChC,SAAgB,MAAM,EAAE,MAAM,CAAA;IAE9B,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAW;IAC9B,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAqD;gBAE3D,EACjB,EAAE,EACF,EAAE,EACF,IAAI,GACL,EAAE;QACD,EAAE,EAAE,MAAM,CAAA;QACV,EAAE,EAAE,SAAS,CAAA;QACb,IAAI,EAAE,UAAU,CAAA;KACjB;IAOM,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,IAAI,GAAG,MAAM,IAAI;IAOlE,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,IAAI,GAAG,IAAI;IAO7D,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,OAAO,GAAG,IAAI;IAI5C,KAAK,IAAI,IAAI;IAQb,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,IAAI;CAOvD;AA+iBD,eAAO,MAAM,OAAO,GAAI,4NAQrB;IACD,MAAM,EAAE,UAAU,CAAA;IAClB,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,iBAAiB,CAAC,EAAE,cAAc,CAAA;IAClC,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,yBAAyB,CAAC,EAAE,MAAM,CAAA;IAClC,kBAAkB,CAAC,EAAE,MAAM,CAAA;IAC3B,mBAAmB,CAAC,EAAE,OAAO,CAAA;CAC9B,KAAG,IA8GH,CAAA;AAED,eAAO,MAAM,kBAAkB,GAAI,SAAS,SAAS,KAAG,IAEvD,CAAA;AAED,eAAO,MAAM,qBAAqB,GAAI,UAAU,MAAM,EAAE,WAAW,MAAM,KAAG,IAE3E,CAAA;AAED,cAAc,UAAU,CAAA"}

package/dist/{index-Ckx0UHs6.js → rts/index.js}

@@ -1,6 +1,13 @@
 import { randomUUID } from "node:crypto";
-import { loadModel } from "@rpcbase/db";
+import { loadRbModel, loadModel } from "@rpcbase/db";
+import { buildAbilityFromSession, getTenantRolesFromSessionUser, buildAbility, getAccessibleByQuery } from "@rpcbase/db/acl";
 import { WebSocketServer } from "ws";
+const routes = Object.entries({
+  .../* @__PURE__ */ Object.assign({ "./api/changes/handler.ts": () => import("../handler-Dd20DHyz.js") })
+}).reduce((acc, [path, mod]) => {
+  acc[path.replace("./api/", "@rpcbase/server/rts/api/")] = mod;
+  return acc;
+}, {});
 const TENANT_ID_QUERY_PARAM = "rb-tenant-id";
 const USER_ID_HEADER = "rb-user-id";
 const QUERY_KEY_MAX_LEN = 4096;
@@ -150,14 +157,25 @@ const parseUpgradeMeta = async ({
     } else {
       throw new Error("Tenant not authorized for this session");
     }
-    return { tenantId, userId: sessionUserId };
+    const ability2 = buildAbilityFromSession({ tenantId, session: upgradeReq.session });
+    return { tenantId, userId: sessionUserId, ability: ability2 };
   }
   const raw = req.headers[USER_ID_HEADER];
   const headerUserId = Array.isArray(raw) ? raw[0] : raw;
   if (!headerUserId) {
     throw new Error("Missing rb-user-id header (reverse-proxy) and no session middleware configured");
   }
-  return { tenantId, userId: headerUserId };
+  const rbCtx = { req: { session: null } };
+  const User = await loadRbModel("RBUser", rbCtx);
+  const user = await User.findById(headerUserId, { tenants: 1, tenantRoles: 1 }).lean();
+  const tenantsRaw = user?.tenants;
+  const tenants = Array.isArray(tenantsRaw) ? tenantsRaw.map((t) => String(t)) : [];
+  if (!tenants.includes(tenantId)) {
+    throw new Error("Tenant not authorized for this session");
+  }
+  const roles = getTenantRolesFromSessionUser(user, tenantId);
+  const ability = buildAbility({ tenantId, userId: headerUserId, roles: roles.length ? roles : ["owner"] });
+  return { tenantId, userId: headerUserId, ability };
 };
 const getTenantModel = async (tenantId, modelName) => {
   const ctx = {
@@ -208,16 +226,28 @@ const scheduleDispatchSubscriptionsForModel = (tenantId, modelName) => {
 const runAndSendQuery = async ({
   tenantId,
   targetSocketIds,
+  ability,
   modelName,
   queryKey,
   query,
   options
 }) => {
+  if (!ability.can("read", modelName)) {
+    const payload2 = { type: "query_payload", modelName, queryKey, error: "forbidden" };
+    for (const socketId of targetSocketIds) {
+      const ws = sockets.get(socketId);
+      if (!ws) continue;
+      sendWs(ws, payload2);
+    }
+    return;
+  }
   const model = await getTenantModel(tenantId, modelName);
   const projection = options.projection ?? void 0;
   const sort = options.sort;
   const limit = normalizeLimit(options.limit);
-  const queryPromise = model.find(query, projection);
+  const accessQuery = getAccessibleByQuery(ability, "read", modelName);
+  const finalQuery = { $and: [query, accessQuery] };
+  const queryPromise = model.find(finalQuery, projection);
   if (sort && Object.keys(sort).length) {
     queryPromise.sort(sort);
   }
@@ -232,27 +262,35 @@ const runAndSendQuery = async ({
 };
 const dispatchSubscriptionsForModel = async (tenantId, modelName) => {
   const tenantSubs = subscriptions.get(tenantId);
-  const modelSubs = tenantSubs?.get(modelName);
-  if (!modelSubs || !modelSubs.size) return;
-  for (const [queryKey, sub] of modelSubs.entries()) {
-    const targetSocketIds = Array.from(sub.socketIds);
-    if (!targetSocketIds.length) continue;
-    try {
-      await runAndSendQuery({
-        tenantId,
-        targetSocketIds,
-        modelName,
-        queryKey,
-        query: sub.query,
-        options: sub.options
-      });
-    } catch (err) {
-      const error = redactErrorMessage(err);
-      const payload = { type: "query_payload", modelName, queryKey, error };
-      for (const socketId of targetSocketIds) {
-        const ws = sockets.get(socketId);
-        if (!ws) continue;
-        sendWs(ws, payload);
+  if (!tenantSubs || !tenantSubs.size) return;
+  for (const userSubs of tenantSubs.values()) {
+    const modelSubs = userSubs.get(modelName);
+    if (!modelSubs || !modelSubs.size) continue;
+    for (const [queryKey, sub] of modelSubs.entries()) {
+      const targetSocketIds = Array.from(sub.socketIds);
+      if (!targetSocketIds.length) continue;
+      const socketId = targetSocketIds[0];
+      const meta = socketMeta.get(socketId);
+      const ability = meta?.ability;
+      if (!ability) continue;
+      try {
+        await runAndSendQuery({
+          tenantId,
+          targetSocketIds,
+          ability,
+          modelName,
+          queryKey,
+          query: sub.query,
+          options: sub.options
+        });
+      } catch (err) {
+        const error = redactErrorMessage(err);
+        const payload = { type: "query_payload", modelName, queryKey, error };
+        for (const socketId2 of targetSocketIds) {
+          const ws = sockets.get(socketId2);
+          if (!ws) continue;
+          sendWs(ws, payload);
+        }
       }
     }
   }
@@ -286,6 +324,7 @@ const ensureChangeStream = async (tenantId, modelName) => {
 const addSocketSubscription = ({
   socketId,
   tenantId,
+  userId,
   modelName,
   queryKey,
   query,
@@ -293,8 +332,10 @@ const addSocketSubscription = ({
 }) => {
   const tenantSubs = subscriptions.get(tenantId) ?? /* @__PURE__ */ new Map();
   subscriptions.set(tenantId, tenantSubs);
-  const modelSubs = tenantSubs.get(modelName) ?? /* @__PURE__ */ new Map();
-  tenantSubs.set(modelName, modelSubs);
+  const userSubs = tenantSubs.get(userId) ?? /* @__PURE__ */ new Map();
+  tenantSubs.set(userId, userSubs);
+  const modelSubs = userSubs.get(modelName) ?? /* @__PURE__ */ new Map();
+  userSubs.set(modelName, modelSubs);
   const existing = modelSubs.get(queryKey);
   if (existing) {
     existing.socketIds.add(socketId);
@@ -314,11 +355,13 @@ const addSocketSubscription = ({
 const removeSocketSubscription = ({
   socketId,
   tenantId,
+  userId,
   modelName,
   queryKey
 }) => {
   const tenantSubs = subscriptions.get(tenantId);
-  const modelSubs = tenantSubs?.get(modelName);
+  const userSubs = tenantSubs?.get(userId);
+  const modelSubs = userSubs?.get(modelName);
   const sub = modelSubs?.get(queryKey);
   if (sub) {
     sub.socketIds.delete(socketId);
@@ -335,7 +378,21 @@ const removeSocketSubscription = ({
     }
   }
   if (modelSubs && modelSubs.size === 0) {
-    tenantSubs?.delete(modelName);
+    userSubs?.delete(modelName);
+  }
+  if (userSubs && userSubs.size === 0) {
+    tenantSubs?.delete(userId);
+  }
+  const hasAnyModelSubs = (() => {
+    const byUser = subscriptions.get(tenantId);
+    if (!byUser) return false;
+    for (const subs of byUser.values()) {
+      const modelSubs2 = subs.get(modelName);
+      if (modelSubs2 && modelSubs2.size > 0) return true;
+    }
+    return false;
+  })();
+  if (!hasAnyModelSubs) {
     const tenantStreams = changeStreams.get(tenantId);
     const stream = tenantStreams?.get(modelName);
     if (stream) {
@@ -361,6 +418,7 @@ const cleanupSocket = (socketId) => {
           removeSocketSubscription({
             socketId,
             tenantId: meta.tenantId,
+            userId: meta.userId,
             modelName,
             queryKey
           });
@@ -404,6 +462,7 @@ const handleClientMessage = async ({
     removeSocketSubscription({
       socketId,
       tenantId: meta.tenantId,
+      userId: meta.userId,
       modelName: message.modelName,
       queryKey: message.queryKey
     });
@@ -411,6 +470,11 @@ const handleClientMessage = async ({
   }
   if (!message.query || typeof message.query !== "object") return;
   const options = normalizeOptions(message.options);
+  const ability = meta.ability;
+  if (!ability.can("read", message.modelName)) {
+    sendWs(ws, { type: "query_payload", modelName: message.modelName, queryKey: message.queryKey, error: "forbidden" });
+    return;
+  }
   if (message.type === "registerQuery") {
     const existing = socketSubscriptions.get(socketId)?.get(message.modelName)?.has(message.queryKey) ?? false;
     if (!existing) {
@@ -427,6 +491,7 @@ const handleClientMessage = async ({
     addSocketSubscription({
       socketId,
       tenantId: meta.tenantId,
+      userId: meta.userId,
       modelName: message.modelName,
       queryKey: message.queryKey,
       query: message.query,
@@ -444,6 +509,7 @@ const handleClientMessage = async ({
     await runAndSendQuery({
       tenantId: meta.tenantId,
       targetSocketIds: [socketId],
+      ability,
       modelName: message.modelName,
       queryKey: message.queryKey,
       query: message.query,
@@ -556,7 +622,8 @@ const notifyRtsModelChanged = (tenantId, modelName) => {
   scheduleDispatchSubscriptionsForModel(tenantId, modelName);
 };
 export {
-  initRts as i,
-  notifyRtsModelChanged as n,
-  registerRtsHandler as r
+  initRts,
+  notifyRtsModelChanged,
+  registerRtsHandler,
+  routes
 };