[fredericklamar342-prog]

Summary

• Add the owner-linked Notification model, typed payload validation, provider-agnostic channel adapter registry, and authenticated inbox endpoints with unread filtering, count, read-all, and keyset pagination.
• Ensure every notification query is scoped to the authenticated user; payload schemas accept opaque record IDs only and exclude clinical detail.
• Persist in-app notifications before external adapters run and isolate adapter failures from the write.
• Add the Prisma migration and update architecture, API, and Phase 6 roadmap documentation. Provider integrations remain deferred to issue [Phase 6] ADR: pick notification provider (email/SMS) #17.

Tests

• npm run audit:prod — passed (policy-tolerated existing Axios advisories only).
• npm run typecheck — passed.
• npm test — passed (93 tests).
• npm run test:integration — passed (161 tests, including 4 new notification inbox cases).
• npm run build — passed.
• npm run test:all — 254 tests passed and 3 skipped, but the optional live-testnet payments suite fails in its setup before skips are applied because its Prisma client uses the default test database URL. CI runs the separate unit/integration commands above and excludes tests/testnet-integration/.

No new provider configuration is required. The notification migration must be applied with the normal Prisma migration deployment.

Closes #93

[drips-wave]

@fredericklamar342-prog Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

[afeezorobsco-cyber]

@fredericklamar342-prog Thanks for the PR. It can't be merged yet. To unblock it:

Merge conflicts: this branch conflicts with main. Please rebase onto the latest main (git fetch upstream && git rebase upstream/main), resolve the conflicts (often ROADMAP.md, ARCHITECTURE*.md or prisma/schema.prisma), and force-push.

Push to this same branch and CI will re-run. Once it's green and conflict-free, it'll be reviewed for merge.

[github-actions]

@fredericklamar342-prog This PR now has merge conflicts with main, most likely because #156 (feat(patients): account deletion with clinical-record retention: anonymise identity, keep the audit trail) was just merged, so it can't be merged until it's rebased:

git fetch upstream            # upstream = https://github.com/DocForum/docforum-core.git
git rebase upstream/main
# resolve the conflicts, re-run the tests, then:
git push --force-with-lease

The usual culprits are shared docs like ROADMAP.md and ARCHITECTURE*.md. If the conflict is in the ROADMAP.md changelog, move your entry into a new file under changelog.d/ (see changelog.d/README.md) rather than resolving it in place, so it can't conflict again. CI re-runs when you push, and the needs-rebase label is removed automatically once the conflicts are resolved.

_{Automated message. It won't repeat unless the PR conflicts again after your next push.}

[github-actions]

@fredericklamar342-prog This PR now has merge conflicts with main, most likely because #157 (feat(patients): guardian and dependent accounts: booking on behalf of a minor) was just merged, so it can't be merged until it's rebased:

git fetch upstream            # upstream = https://github.com/DocForum/docforum-core.git
git rebase upstream/main
# resolve the conflicts, re-run the tests, then:
git push --force-with-lease

The usual culprits are shared docs like ROADMAP.md and ARCHITECTURE*.md. If the conflict is in the ROADMAP.md changelog, move your entry into a new file under changelog.d/ (see changelog.d/README.md) rather than resolving it in place, so it can't conflict again. CI re-runs when you push, and the needs-rebase label is removed automatically once the conflicts are resolved.

_{Automated message. It won't repeat unless the PR conflicts again after your next push.}

[github-actions]

@fredericklamar342-prog This PR now has merge conflicts with main, most likely because #239 (feat(api): publish a typed API client package for docforum-web from the OpenAPI spec) was just merged, so it can't be merged until it's rebased:

git fetch upstream            # upstream = https://github.com/DocForum/docforum-core.git
git rebase upstream/main
# resolve the conflicts, re-run the tests, then:
git push --force-with-lease

The usual culprits are shared docs like ROADMAP.md and ARCHITECTURE*.md. If the conflict is in the ROADMAP.md changelog, move your entry into a new file under changelog.d/ (see changelog.d/README.md) rather than resolving it in place, so it can't conflict again. CI re-runs when you push, and the needs-rebase label is removed automatically once the conflicts are resolved.

_{Automated message. It won't repeat unless the PR conflicts again after your next push.}

[afeezorobsco-cyber]

@fredericklamar342-prog CI is failing at npm run typecheck with a syntax error:

src/modules/notifications/controllers/index.ts(90,1): error TS1005: '}' expected.

The notifications controller is missing a closing brace (it looks like a merge leftover). Please fix it, run npm run typecheck in backend/, and push.

[afeezorobsco-cyber]

@fredericklamar342-prog Same syntax error as on #171: src/modules/notifications/controllers/index.ts(90,1): error TS1005: '}' expected. The controller is missing a closing brace. Please fix it on both PRs and run npm run typecheck in backend/ before pushing.

[github-actions]

@fredericklamar342-prog This PR now has merge conflicts with main, most likely because #257 (feat(pharmacy-orders, facilities): clean recovery of Phase 5 partial fulfillment + facility distance sorting) was just merged, so it can't be merged until it's rebased:

git fetch upstream            # upstream = https://github.com/DocForum/docforum-core.git
git rebase upstream/main
# resolve the conflicts, re-run the tests, then:
git push --force-with-lease

The usual culprits are shared docs like ROADMAP.md and ARCHITECTURE*.md. If the conflict is in the ROADMAP.md changelog, move your entry into a new file under changelog.d/ (see changelog.d/README.md) rather than resolving it in place, so it can't conflict again. CI re-runs when you push, and the needs-rebase label is removed automatically once the conflicts are resolved.

_{Automated message. It won't repeat unless the PR conflicts again after your next push.}