create-nexwire 4.3.0 → 4.4.0

package/fastify/src/framework/maker-cli/stubs/deploy/server/env/redis.stub

@@ -0,0 +1,25 @@
+# Server infra env template (base values)
+# Remote: copy to deploy/server/.env and use as-is
+# Local: copy to deploy/server/.env then override in deploy/server/.env.local
+LETSENCRYPT_EMAIL=ops@example.com
+PROXY_HTTP_PORT=80
+PROXY_HTTPS_PORT=443
+
+MYSQL_ROOT_PASSWORD=change-me-root
+MYSQL_DATABASE=nexwire
+MYSQL_PORT=4000
+
+POSTGRES_USER=postgres
+POSTGRES_PASSWORD=change-me-postgres
+POSTGRES_DB=postgres
+POSTGRES_PORT=4001
+
+REDIS=true
+
+PHPMYADMIN_DOMAIN=pma.example.com
+PGADMIN_DOMAIN=pga.example.com
+PGADMIN_DEFAULT_EMAIL=admin@example.com
+PGADMIN_DEFAULT_PASSWORD=admin123
+PHPMYADMIN_LOCAL_PORT=127.0.0.1:8082
+PGADMIN_LOCAL_PORT=127.0.0.1:8083
+

package/fastify/src/framework/maker-cli/stubs/deploy/server/nginx-vhost/README.stub

@@ -0,0 +1,16 @@
+# nginx-vhost overrides
+
+This folder holds per-domain nginx overrides for `jwilder/nginx-proxy`.
+
+## Usage
+
+1. Copy `app.example.com` to your real app domain file name.
+2. Edit rules as needed (timeouts, upload limits, auth for `/board`, etc).
+3. Recreate or reload proxy container if needed.
+
+Example:
+
+```bash
+cp deploy/server/nginx-vhost/app.example.com deploy/server/nginx-vhost/api.yourdomain.com
+```
+

package/fastify/src/framework/maker-cli/stubs/deploy/server/nginx-vhost/app.example.com.stub

@@ -0,0 +1,13 @@
+# Custom nginx vhost overrides for app.example.com
+# File name should match your APP_DOMAIN exactly.
+
+client_max_body_size 50m;
+proxy_read_timeout 300;
+proxy_send_timeout 300;
+
+# Protect Queue Dashboard in production
+location /board {
+    auth_basic "Restricted";
+    auth_basic_user_file /etc/nginx/vhost.d/.htpasswd;
+}
+

package/fastify/src/framework/maker-cli/stubs/deploy/server/pgadmin/servers.stub

@@ -0,0 +1,14 @@
+{
+  "Servers": {
+    "1": {
+      "Name": "postgres-global",
+      "Group": "Servers",
+      "Host": "postgres-global",
+      "Port": 5432,
+      "MaintenanceDB": "postgres",
+      "Username": "postgres",
+      "SSLMode": "prefer"
+    }
+  }
+}
+

package/fastify/src/framework/maker-cli/stubs/deploy/server/redis/redis.conf.stub

@@ -0,0 +1,7 @@
+appendonly yes
+maxmemory 512mb
+maxmemory-policy noeviction
+save 900 1
+save 300 10
+save 60 10000
+

package/fastify/src/framework/maker-cli/stubs/deploy/supervisor/noredis.stub

@@ -0,0 +1,54 @@
+[supervisord]
+nodaemon=true
+user=root
+logfile=/dev/null
+logfile_maxbytes=0
+pidfile=/var/run/supervisord.pid
+loglevel=info
+
+[program:migrate]
+command=/bin/sh -lc "/bin/sh /app/deploy/scripts/auto-migrate.sh {{RUNTIME_EXEC}}"
+directory=/app
+autostart=true
+autorestart=false
+priority=5
+startsecs=0
+startretries=1
+exitcodes=0
+stdout_logfile=/dev/stdout
+stderr_logfile=/dev/stderr
+stdout_logfile_maxbytes=0
+stderr_logfile_maxbytes=0
+
+[program:api]
+command=/bin/sh -lc "{{RUNTIME_EXEC}} src/framework/maker-cli/index.mjs serve --prod --runtime={{RUNTIME_NAME}}"
+directory=/app
+autostart=true
+autorestart=true
+priority=20
+startsecs=3
+startretries=5
+stopsignal=TERM
+stopwaitsecs=20
+redirect_stderr=true
+stdout_logfile=/dev/stdout
+stdout_logfile_maxbytes=0
+stopasgroup=true
+killasgroup=true
+
+[program:scheduler]
+command=/bin/sh -lc "{{RUNTIME_EXEC}} src/framework/maker-cli/index.mjs schedule:work --prod --runtime={{RUNTIME_NAME}}"
+directory=/app
+autostart=true
+autorestart=true
+priority=40
+startsecs=3
+startretries=5
+stopsignal=TERM
+stopwaitsecs=20
+redirect_stderr=true
+stdout_logfile=/dev/stdout
+stdout_logfile_maxbytes=0
+stopasgroup=true
+killasgroup=true
+

package/fastify/src/framework/maker-cli/stubs/deploy/supervisor/redis.stub

@@ -0,0 +1,70 @@
+[supervisord]
+nodaemon=true
+user=root
+logfile=/dev/null
+logfile_maxbytes=0
+pidfile=/var/run/supervisord.pid
+loglevel=info
+
+[program:migrate]
+command=/bin/sh -lc "/bin/sh /app/deploy/scripts/auto-migrate.sh {{RUNTIME_EXEC}}"
+directory=/app
+autostart=true
+autorestart=false
+priority=5
+startsecs=0
+startretries=1
+exitcodes=0
+stdout_logfile=/dev/stdout
+stderr_logfile=/dev/stderr
+stdout_logfile_maxbytes=0
+stderr_logfile_maxbytes=0
+
+[program:api]
+command=/bin/sh -lc "{{RUNTIME_EXEC}} src/framework/maker-cli/index.mjs serve --prod --runtime={{RUNTIME_NAME}}"
+directory=/app
+autostart=true
+autorestart=true
+priority=20
+startsecs=3
+startretries=5
+stopsignal=TERM
+stopwaitsecs=20
+redirect_stderr=true
+stdout_logfile=/dev/stdout
+stdout_logfile_maxbytes=0
+stopasgroup=true
+killasgroup=true
+
+[program:queue]
+command=/bin/sh -lc "{{RUNTIME_EXEC}} src/framework/maker-cli/index.mjs queue:work --queue=default,mail,maintenance --prod --runtime={{RUNTIME_NAME}}"
+directory=/app
+autostart=true
+autorestart=true
+priority=30
+startsecs=3
+startretries=5
+stopsignal=TERM
+stopwaitsecs=20
+redirect_stderr=true
+stdout_logfile=/dev/stdout
+stdout_logfile_maxbytes=0
+stopasgroup=true
+killasgroup=true
+
+[program:scheduler]
+command=/bin/sh -lc "{{RUNTIME_EXEC}} src/framework/maker-cli/index.mjs schedule:work --prod --runtime={{RUNTIME_NAME}}"
+directory=/app
+autostart=true
+autorestart=true
+priority=40
+startsecs=3
+startretries=5
+stopsignal=TERM
+stopwaitsecs=20
+redirect_stderr=true
+stdout_logfile=/dev/stdout
+stdout_logfile_maxbytes=0
+stopasgroup=true
+killasgroup=true
+

package/fastify/src/framework/maker-cli/stubs/deploy/workflow/local.json.stub

@@ -0,0 +1,25 @@
+{
+  "steps": [
+    {
+      "name": "Generate deploy files",
+      "run": "deploy:init --force",
+      "enabled": false
+    },
+    {
+      "name": "Start shared infra",
+      "run": "deploy:workflow --server-only",
+      "enabled": true
+    },
+    {
+      "name": "Import database dump (optional)",
+      "run": "deploy:db:import --file=deploy/nexwire.sql --database=nexwire",
+      "enabled": false
+    },
+    {
+      "name": "Start app stack",
+      "run": "deploy:workflow --app-only",
+      "enabled": true
+    }
+  ]
+}
+

package/fastify/src/framework/maker-cli/stubs/deploy/workflow/remote.json.stub

@@ -0,0 +1,24 @@
+{
+  "remote": {
+    "host": "127.0.0.1",
+    "user": "deploy",
+    "port": 22,
+    "keyPath": "~/.ssh/id_rsa",
+    "targetPath": "/home/deploy/nexwire"
+  },
+  "upload": {
+    "source": ".",
+    "targetSubPath": "."
+  },
+  "databaseImport": {
+    "enabled": false,
+    "file": "deploy/nexwire.sql",
+    "database": "nexwire",
+    "container": "mysql-global",
+    "user": "root"
+  },
+  "preDeployCommands": [
+    "docker rm -f old-app 2>/dev/null || true"
+  ]
+}
+

package/fastify/src/framework/maker-cli/stubs/facade/name.ts.stub

@@ -0,0 +1,12 @@
+/**
+ * Public API for the {{module}} module.
+ *
+ * Other modules import from this file, never from controllers/ or services/ directly.
+ * Re-export the pieces they are allowed to depend on:
+ *
+ * export { list, findOne } from "./services/{{controller}}.js";
+ *
+ * Rule: a facade must never import another module's facade.
+ */
+
+export {};

package/fastify/src/framework/maker-cli/stubs/helper/name.ts.stub

@@ -0,0 +1,14 @@
+/**
+ * Why: Reusable {{name}} logic that does not belong to a controller or service.
+ * When: Called by controllers, services, jobs, or other helpers.
+ * Where: src/modules/{{module}}/helpers/{{name}}.ts
+ */
+
+/**
+ * Why: Placeholder shared helper.
+ * When: Replace this with real logic and rename it.
+ * Where: Anywhere inside the {{module}} module.
+ */
+export function {{Name}}Helper<T>(value: T): T {
+  return value;
+}

package/fastify/src/framework/maker-cli/stubs/job/name.ts.stub

@@ -0,0 +1,25 @@
+import { DateTime } from "luxon";
+import { dispatchEvent, shouldQueue } from "@/framework/facade.js";
+
+/**
+ * event: Event name this worker listens to.
+ * queue: Queue name where jobs are consumed from.
+ * handler: Async processor that receives `job.data`.
+ */
+shouldQueue("{{module}}.{{name}}", "default", async job => {
+  console.log("{{module}}.{{name}}", job.data);
+
+  /**
+   * dispatchEvent name: Event id to publish to listeners.
+   * payload: Data sent to queue/broadcast consumers.
+   * queue: Optional queue target for async event consumers.
+   * broadcast: Optional realtime fanout (all/users/roles/rooms).
+   */
+  // await dispatchEvent("{{module}}.{{name}}.finished", {
+  //   ...job.data,
+  //   processedAt: DateTime.now(),
+  // });
+
+  return { ok: true, processedAt: DateTime.now().toISO() };
+});
+

package/fastify/src/framework/maker-cli/stubs/middleware/name.local.ts.stub

@@ -0,0 +1,15 @@
+import type { FastifyReply, FastifyRequest } from "fastify";
+
+/**
+ * Why: Route-scoped middleware for the {{module}} module.
+ * When: Attach to a route or route scope inside routes/*.ts.
+ * Where: src/modules/{{module}}/middlewares/{{name}}.ts
+ *
+ * Register it in a route file:
+ *   import { {{camel}}Middleware } from "@/modules/{{module}}/middlewares/{{name}}.js";
+ *   scope.addHook("preHandler", {{camel}}Middleware);
+ *   // or: app.route({ ..., preHandler: {{camel}}Middleware, handler })
+ */
+export async function {{camel}}Middleware(_request: FastifyRequest, _reply: FastifyReply) {
+  // Guard the route here; send a reply to stop, or return to continue the chain.
+}

package/fastify/src/framework/maker-cli/stubs/middleware/name.ts.stub

@@ -0,0 +1,15 @@
+import type { FastifyReply, FastifyRequest } from "fastify";
+import { db } from "@/framework/facade.js";
+
+/**
+ * Why: Runs before route handlers to enforce cross-cutting rules for {{name}}.
+ * When: Attach to a route scope or a specific route.
+ * Where: Add it globally: app.addHook("preHandler", {{camel}}Middleware), or per route:
+ *        app.route({ ..., preHandler: {{camel}}Middleware, handler })
+ * How: request.auth is populated when authMiddleware ran first; db gives
+ *      typed access to your module models. Return nothing to continue, or
+ *      return a reply to stop the request.
+ */
+export async function {{camel}}Middleware(_request: FastifyRequest, _reply: FastifyReply) {
+  // Guard the request here; send a reply to stop, or return to continue.
+}

package/fastify/src/framework/maker-cli/stubs/model/name.mysql.ts.stub

@@ -0,0 +1,10 @@
+import { relations } from "drizzle-orm";
+import { int, mysqlTable, timestamp, varchar } from "drizzle-orm/mysql-core";
+
+export const {{tableVariable}} = mysqlTable("{{tableName}}", {
+  id: int("id").autoincrement().primaryKey(),
+  name: varchar("name", { length: 255 }).notNull(),
+  createdAt: timestamp("created_at").defaultNow().notNull(),
+  updatedAt: timestamp("updated_at").defaultNow().notNull()
+});
+

package/fastify/src/framework/maker-cli/stubs/model/name.postgresql.ts.stub

@@ -0,0 +1,10 @@
+import { relations } from "drizzle-orm";
+import { pgTable, serial, text, timestamp } from "drizzle-orm/pg-core";
+
+export const {{tableVariable}} = pgTable("{{tableName}}", {
+  id: serial("id").primaryKey(),
+  name: text("name").notNull(),
+  createdAt: timestamp("created_at", { withTimezone: true }).defaultNow().notNull(),
+  updatedAt: timestamp("updated_at", { withTimezone: true }).defaultNow().notNull()
+});
+

package/fastify/src/framework/maker-cli/stubs/model/name.sqlite.ts.stub

@@ -0,0 +1,10 @@
+import { relations } from "drizzle-orm";
+import { integer, sqliteTable, text } from "drizzle-orm/sqlite-core";
+
+export const {{tableVariable}} = sqliteTable("{{tableName}}", {
+  id: integer("id").primaryKey({ autoIncrement: true }),
+  name: text("name").notNull(),
+  createdAt: integer("created_at", { mode: "timestamp" }).$defaultFn(() => new Date()).notNull(),
+  updatedAt: integer("updated_at", { mode: "timestamp" }).$defaultFn(() => new Date()).notNull()
+});
+

package/fastify/src/framework/maker-cli/stubs/notification/controller.ts.stub

@@ -0,0 +1,79 @@
+import type { FastifyReply, FastifyRequest } from "fastify";
+import { HttpStatusCodes, resolveNotificationProvider } from "@/framework/facade.js";
+import type { NotifiableTarget } from "@/framework/providers/contracts.js";
+
+type IdRequest = FastifyRequest<{ Params: { id: string } }>;
+type ListRequest = FastifyRequest<{ Querystring: { page?: string; perPage?: string } }>;
+
+/** Read the authenticated owner. A missing auth context means the request is anonymous. */
+function targetFrom(request: FastifyRequest): NotifiableTarget | null {
+  const auth = request.auth;
+  if (!auth || auth.id === undefined || auth.id === null) return null;
+  return { type: "{{notifiable}}", id: auth.id };
+}
+
+function unavailable(reply: FastifyReply) {
+  return reply.code(HttpStatusCodes.SERVICE_UNAVAILABLE).send({
+    message: "Notification provider not available. Restore src/modules/notification or register one in src/providers/."
+  });
+}
+
+function unauthorized(reply: FastifyReply) {
+  return reply.code(HttpStatusCodes.UNAUTHORIZED).send({ message: "Unauthorized" });
+}
+
+export const list = async (request: ListRequest, reply: FastifyReply) => {
+  const provider = await resolveNotificationProvider();
+  if (!provider) return unavailable(reply);
+
+  const target = targetFrom(request);
+  if (!target) return unauthorized(reply);
+
+  const page = Math.max(1, Number(request.query.page) || 1);
+  const perPage = Math.min(50, Math.max(1, Number(request.query.perPage) || 20));
+
+  return reply.code(HttpStatusCodes.OK).send(await provider.list(target, { page, perPage }));
+};
+
+export const unreadCount = async (request: FastifyRequest, reply: FastifyReply) => {
+  const provider = await resolveNotificationProvider();
+  if (!provider) return unavailable(reply);
+
+  const target = targetFrom(request);
+  if (!target) return unauthorized(reply);
+
+  return reply.code(HttpStatusCodes.OK).send({ count: await provider.unreadCount(target) });
+};
+
+export const markRead = async (request: IdRequest, reply: FastifyReply) => {
+  const provider = await resolveNotificationProvider();
+  if (!provider) return unavailable(reply);
+
+  const target = targetFrom(request);
+  if (!target) return unauthorized(reply);
+
+  await provider.markRead(target, String(request.params.id));
+  return reply.code(HttpStatusCodes.OK).send({ ok: true });
+};
+
+export const markAllRead = async (request: FastifyRequest, reply: FastifyReply) => {
+  const provider = await resolveNotificationProvider();
+  if (!provider) return unavailable(reply);
+
+  const target = targetFrom(request);
+  if (!target) return unauthorized(reply);
+
+  await provider.markAllRead(target);
+  return reply.code(HttpStatusCodes.OK).send({ ok: true });
+};
+
+export const remove = async (request: IdRequest, reply: FastifyReply) => {
+  const provider = await resolveNotificationProvider();
+  if (!provider) return unavailable(reply);
+
+  const target = targetFrom(request);
+  if (!target) return unauthorized(reply);
+
+  await provider.remove(target, String(request.params.id));
+  return reply.code(HttpStatusCodes.OK).send({ ok: true });
+};

package/fastify/src/framework/maker-cli/stubs/notification/job.ts.stub

@@ -0,0 +1,11 @@
+import { mail, shouldQueue } from "@/framework/facade.js";
+import { logger } from "@/framework/support/logger.js";
+
+shouldQueue("notification:mail", "mail", async (job) => {
+  const { to, subject, html } = job.data;
+
+  await mail.sendMail({ to, subject, html });
+  logger.info("Notification mail sent", { to, subject });
+
+  return { ok: true };
+});

package/fastify/src/framework/maker-cli/stubs/notification/model.ts.stub

@@ -0,0 +1,29 @@
+import { index, integer, sqliteTable, text } from "drizzle-orm/sqlite-core";
+
+/**
+ * Why: Notifications are stored by a standalone module, not by auth.
+ * When: `notify()` writes a row and `/api/notification/*` reads it back.
+ * Where: `src/modules/notification/database/models/notification.ts`.
+ * How: A polymorphic owner (`notifiable_type` + `notifiable_id`) with no
+ *      foreign key, so deleting or replacing auth cannot cascade-delete
+ *      notifications and a UUID or numeric owner id stores the same way.
+ */
+export const notifications = sqliteTable(
+  "notifications",
+  {
+    id: text("id").primaryKey(),
+    notifiableType: text("notifiable_type").notNull().default("user"),
+    notifiableId: text("notifiable_id").notNull(),
+    type: text("type").notNull(),
+    title: text("title").notNull(),
+    body: text("body"),
+    data: text("data"),
+    link: text("link"),
+    readAt: integer("read_at", { mode: "timestamp" }),
+    createdAt: integer("created_at", { mode: "timestamp" }).defaultNow().notNull()
+  },
+  (table) => [
+    index("notifications_notifiable_read_idx").on(table.notifiableType, table.notifiableId, table.readAt),
+    index("notifications_notifiable_created_idx").on(table.notifiableType, table.notifiableId, table.createdAt)
+  ]
+);

package/fastify/src/framework/maker-cli/stubs/notification/provider.ts.stub

@@ -0,0 +1,174 @@
+import { randomUUID } from "node:crypto";
+import { and, count, desc, eq, isNull } from "drizzle-orm";
+import { db } from "@/framework/database/connection.js";
+import type {
+  NotifiableTarget,
+  NotificationCreateInput,
+  NotificationListOptions,
+  NotificationPage,
+  NotificationProvider,
+  NotificationRecord
+} from "@/framework/providers/contracts.js";
+import { registerNotificationProvider } from "@/framework/providers/registry.js";
+import { notifications } from "@/modules/{{module}}/database/models/notification.js";
+
+/** Normalize a target into the polymorphic pair stored in the table. */
+function normalizeTarget(target: NotifiableTarget) {
+  const type = String(target?.type || "user").trim() || "user";
+  if (target?.id === undefined || target?.id === null || target?.id === "") {
+    throw new Error("A notification target needs an id.");
+  }
+  return { type, id: String(target.id) };
+}
+
+/** Build the owner scope shared by every read and write. */
+function scope(target: NotifiableTarget) {
+  const normalized = normalizeTarget(target);
+  return {
+    target: normalized,
+    where: and(eq(notifications.notifiableType, normalized.type), eq(notifications.notifiableId, normalized.id))
+  };
+}
+
+function toIso(value: Date | string | number | null | undefined): string | null {
+  if (value === null || value === undefined) return null;
+  const date = value instanceof Date ? value : new Date(value);
+  return Number.isNaN(date.getTime()) ? null : date.toISOString();
+}
+
+function parseData(value: unknown): Record<string, unknown> | null {
+  if (!value) return null;
+  if (typeof value === "object") return value as Record<string, unknown>;
+  try {
+    const parsed = JSON.parse(String(value));
+    return parsed && typeof parsed === "object" ? (parsed as Record<string, unknown>) : null;
+  } catch {
+    return null;
+  }
+}
+
+/** Convert a DB row into the stable shape every consumer receives. */
+function normalizeRow(row: typeof notifications.$inferSelect): NotificationRecord {
+  return {
+    id: String(row.id),
+    notifiableType: row.notifiableType,
+    notifiableId: row.notifiableId,
+    type: row.type,
+    title: row.title,
+    body: row.body ?? null,
+    data: parseData(row.data),
+    link: row.link ?? null,
+    readAt: toIso(row.readAt),
+    createdAt: toIso(row.createdAt) ?? new Date(0).toISOString()
+  };
+}
+
+/**
+ * Why: Ships a working notification store so `notify()` needs no setup.
+ * When: Imported at boot by the provider loader (and lazily by the resolver).
+ * Where: `src/modules/notification/providers/notification.ts`.
+ * How: Drizzle-backed implementation of `NotificationProvider`. The primary
+ *      key is a UUID string, so ids never depend on the auth table; numeric
+ *      targets are accepted and stored as text by the contract.
+ */
+export const notificationProvider: NotificationProvider = {
+  async create(target: NotifiableTarget, input: NotificationCreateInput): Promise<NotificationRecord> {
+    const { target: normalized } = scope(target);
+    const id = randomUUID();
+
+    await db.insert(notifications).values({
+      id,
+      notifiableType: normalized.type,
+      notifiableId: normalized.id,
+      type: input.type || "info",
+      title: input.title,
+      body: input.body ?? null,
+      link: input.link ?? null,
+      data: input.data ? JSON.stringify(input.data) : null
+    });
+
+    const [row] = await db.select().from(notifications).where(eq(notifications.id, id));
+    if (!row) throw new Error("Failed to create notification");
+    return normalizeRow(row);
+  },
+
+  async list(target: NotifiableTarget, options: NotificationListOptions = {}): Promise<NotificationPage> {
+    const { where } = scope(target);
+    const page = Math.max(1, Math.floor(Number(options.page) || 1));
+    const perPage = Math.min(100, Math.max(1, Math.floor(Number(options.perPage) || 20)));
+
+    const [totalRows, unreadRows, rows] = await Promise.all([
+      db.select({ count: count() }).from(notifications).where(where),
+      db.select({ count: count() }).from(notifications).where(and(where, isNull(notifications.readAt))),
+      db
+        .select()
+        .from(notifications)
+        .where(where)
+        .orderBy(desc(notifications.createdAt))
+        .limit(perPage)
+        .offset((page - 1) * perPage)
+    ]);
+
+    return {
+      data: rows.map(normalizeRow),
+      total: Number(totalRows[0]?.count ?? 0),
+      unread: Number(unreadRows[0]?.count ?? 0),
+      page,
+      perPage
+    };
+  },
+
+  async unreadCount(target: NotifiableTarget): Promise<number> {
+    const { where } = scope(target);
+    const rows = await db
+      .select({ count: count() })
+      .from(notifications)
+      .where(and(where, isNull(notifications.readAt)));
+    return Number(rows[0]?.count ?? 0);
+  },
+
+  async markRead(target: NotifiableTarget, id: number | string): Promise<boolean> {
+    const { where } = scope(target);
+    const notificationWhere = and(where, eq(notifications.id, String(id)));
+    const [existing] = await db.select({ id: notifications.id }).from(notifications).where(notificationWhere);
+    if (!existing) return false;
+
+    await db.update(notifications).set({ readAt: new Date() }).where(notificationWhere);
+    return true;
+  },
+
+  async markAllRead(target: NotifiableTarget): Promise<number> {
+    const { where } = scope(target);
+    const unreadWhere = and(where, isNull(notifications.readAt));
+    const rows = await db.select({ count: count() }).from(notifications).where(unreadWhere);
+    const unread = Number(rows[0]?.count ?? 0);
+    if (unread === 0) return 0;
+
+    await db.update(notifications).set({ readAt: new Date() }).where(unreadWhere);
+    return unread;
+  },
+
+  async remove(target: NotifiableTarget, id: number | string): Promise<boolean> {
+    const { where } = scope(target);
+    const notificationWhere = and(where, eq(notifications.id, String(id)));
+    const [existing] = await db.select({ id: notifications.id }).from(notifications).where(notificationWhere);
+    if (!existing) return false;
+
+    await db.delete(notifications).where(notificationWhere);
+    return true;
+  },
+
+  async deleteForTarget(target: NotifiableTarget): Promise<number> {
+    const { where } = scope(target);
+    const rows = await db.select({ count: count() }).from(notifications).where(where);
+    const total = Number(rows[0]?.count ?? 0);
+    if (total === 0) return 0;
+
+    await db.delete(notifications).where(where);
+    return total;
+  }
+};
+
+registerNotificationProvider(notificationProvider);
+
+export default notificationProvider;