@m5kdev/backend 0.7.0 → 0.8.2

package/dist/src/modules/auth/auth.utils.mjs

@@ -0,0 +1,77 @@
+import { auth_db_exports } from "./auth.db.mjs";
+import { desc, eq } from "drizzle-orm";
+import { v4 } from "uuid";
+//#region src/modules/auth/auth.utils.ts
+({ ...auth_db_exports });
+async function getActiveOrganizationAndTeam(orm, schema, userId) {
+	let organizationId;
+	let teamId;
+	let organizationRole;
+	let teamRole;
+	const [lastSession] = await orm.select({
+		activeOrganizationId: schema.sessions.activeOrganizationId,
+		activeTeamId: schema.sessions.activeTeamId,
+		activeOrganizationRole: schema.sessions.activeOrganizationRole,
+		activeTeamRole: schema.sessions.activeTeamRole
+	}).from(schema.sessions).where(eq(schema.sessions.userId, userId)).orderBy(desc(schema.sessions.createdAt)).limit(1);
+	if (lastSession) {
+		organizationId = lastSession.activeOrganizationId ?? void 0;
+		teamId = lastSession.activeTeamId ?? void 0;
+		organizationRole = lastSession.activeOrganizationRole ?? void 0;
+		teamRole = lastSession.activeTeamRole ?? void 0;
+	}
+	if (!organizationId || !organizationRole) {
+		const [member] = await orm.select({
+			organizationId: schema.members.organizationId,
+			role: schema.members.role
+		}).from(schema.members).orderBy(desc(schema.members.createdAt)).where(eq(schema.members.userId, userId)).limit(1);
+		organizationId = member?.organizationId;
+		organizationRole = member?.role;
+	}
+	if (!teamId || !teamRole) {
+		const [teamMember] = await orm.select({
+			teamId: schema.teamMembers.teamId,
+			role: schema.teamMembers.role
+		}).from(schema.teamMembers).orderBy(desc(schema.teamMembers.createdAt)).where(eq(schema.teamMembers.userId, userId)).limit(1);
+		teamId = teamMember?.teamId;
+		teamRole = teamMember?.role;
+	}
+	return {
+		organizationId,
+		teamId,
+		organizationRole,
+		teamRole
+	};
+}
+async function createOrganizationAndTeam(orm, schema, user) {
+	const organizationId = v4();
+	await orm.transaction(async (tx) => {
+		const [organization] = await tx.insert(schema.organizations).values({
+			id: organizationId,
+			name: organizationId,
+			slug: organizationId
+		}).returning();
+		if (!organization) throw new Error("createOrganizationAndTeam: Failed to create organization");
+		const [member] = await tx.insert(schema.members).values({
+			userId: user.id,
+			organizationId: organization.id,
+			role: "owner"
+		}).returning();
+		if (!member) throw new Error("createOrganizationAndTeam: Failed to create member");
+		const [team] = await tx.insert(schema.teams).values({
+			name: organization.id,
+			organizationId: organization.id
+		}).returning();
+		if (!team) throw new Error("createOrganizationAndTeam: Failed to create team");
+		const [teamMember] = await tx.insert(schema.teamMembers).values({
+			userId: user.id,
+			teamId: team.id,
+			role: "owner"
+		}).returning();
+		if (!teamMember) throw new Error("createOrganizationAndTeam: Failed to create team member");
+	});
+}
+//#endregion
+export { createOrganizationAndTeam, getActiveOrganizationAndTeam };
+
+//# sourceMappingURL=auth.utils.mjs.map

package/dist/src/modules/auth/auth.utils.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.utils.mjs","names":["auth","uuidv4"],"sources":["../../../../src/modules/auth/auth.utils.ts"],"sourcesContent":["import { desc, eq } from \"drizzle-orm\";\r\nimport type { LibSQLDatabase } from \"drizzle-orm/libsql\";\r\nimport { v4 as uuidv4 } from \"uuid\";\r\nimport * as auth from \"./auth.db\";\r\n\r\nconst schema = { ...auth };\r\ntype Schema = typeof schema;\r\nexport type Orm = LibSQLDatabase<Schema>;\r\n\r\nexport async function getActiveOrganizationAndTeam<O extends Orm, S extends Schema>(\r\n  orm: O,\r\n  schema: S,\r\n  userId: string\r\n): Promise<{\r\n  organizationId: string | undefined;\r\n  teamId: string | undefined;\r\n  organizationRole: string | undefined;\r\n  teamRole: string | undefined;\r\n}> {\r\n  let organizationId: string | undefined;\r\n  let teamId: string | undefined;\r\n  let organizationRole: string | undefined;\r\n  let teamRole: string | undefined;\r\n  const [lastSession] = await orm\r\n    .select({\r\n      activeOrganizationId: schema.sessions.activeOrganizationId,\r\n      activeTeamId: schema.sessions.activeTeamId,\r\n      activeOrganizationRole: schema.sessions.activeOrganizationRole,\r\n      activeTeamRole: schema.sessions.activeTeamRole,\r\n    })\r\n    .from(schema.sessions)\r\n    .where(eq(schema.sessions.userId, userId))\r\n    .orderBy(desc(schema.sessions.createdAt))\r\n    .limit(1);\r\n  if (lastSession) {\r\n    organizationId = lastSession.activeOrganizationId ?? undefined;\r\n    teamId = lastSession.activeTeamId ?? undefined;\r\n    organizationRole = lastSession.activeOrganizationRole ?? undefined;\r\n    teamRole = lastSession.activeTeamRole ?? undefined;\r\n  }\r\n\r\n  if (!organizationId || !organizationRole) {\r\n    const [member] = await orm\r\n      .select({ organizationId: schema.members.organizationId, role: schema.members.role })\r\n      .from(schema.members)\r\n      .orderBy(desc(schema.members.createdAt))\r\n      .where(eq(schema.members.userId, userId))\r\n      .limit(1);\r\n    organizationId = member?.organizationId;\r\n    organizationRole = member?.role;\r\n  }\r\n\r\n  if (!teamId || !teamRole) {\r\n    const [teamMember] = await orm\r\n      .select({ teamId: schema.teamMembers.teamId, role: schema.teamMembers.role })\r\n      .from(schema.teamMembers)\r\n      .orderBy(desc(schema.teamMembers.createdAt))\r\n      .where(eq(schema.teamMembers.userId, userId))\r\n      .limit(1);\r\n    teamId = teamMember?.teamId;\r\n    teamRole = teamMember?.role;\r\n  }\r\n\r\n  return { organizationId, teamId, organizationRole, teamRole };\r\n}\r\n\r\nexport async function createOrganizationAndTeam<O extends Orm, S extends Schema>(\r\n  orm: O,\r\n  schema: S,\r\n  user: { id: string; email: string }\r\n): Promise<void> {\r\n  const organizationId = uuidv4();\r\n  await orm.transaction(async (tx) => {\r\n    const [organization] = await tx\r\n      .insert(schema.organizations)\r\n      .values({\r\n        id: organizationId,\r\n        name: organizationId,\r\n        slug: organizationId,\r\n      })\r\n      .returning();\r\n\r\n    if (!organization) throw new Error(\"createOrganizationAndTeam: Failed to create organization\");\r\n\r\n    const [member] = await tx\r\n      .insert(schema.members)\r\n      .values({\r\n        userId: user.id,\r\n        organizationId: organization.id,\r\n        role: \"owner\",\r\n      })\r\n      .returning();\r\n\r\n    if (!member) throw new Error(\"createOrganizationAndTeam: Failed to create member\");\r\n\r\n    const [team] = await tx\r\n      .insert(schema.teams)\r\n      .values({\r\n        name: organization.id,\r\n        organizationId: organization.id,\r\n      })\r\n      .returning();\r\n\r\n    if (!team) throw new Error(\"createOrganizationAndTeam: Failed to create team\");\r\n\r\n    const [teamMember] = await tx\r\n      .insert(schema.teamMembers)\r\n      .values({\r\n        userId: user.id,\r\n        teamId: team.id,\r\n        role: \"owner\",\r\n      })\r\n      .returning();\r\n\r\n    if (!teamMember) throw new Error(\"createOrganizationAndTeam: Failed to create team member\");\r\n  });\r\n}\r\n"],"mappings":";;;;CAKe,EAAE,GAAGA,iBAAM;AAI1B,eAAsB,6BACpB,KACA,QACA,QAMC;CACD,IAAI;CACJ,IAAI;CACJ,IAAI;CACJ,IAAI;CACJ,MAAM,CAAC,eAAe,MAAM,IACzB,OAAO;EACN,sBAAsB,OAAO,SAAS;EACtC,cAAc,OAAO,SAAS;EAC9B,wBAAwB,OAAO,SAAS;EACxC,gBAAgB,OAAO,SAAS;EACjC,CAAC,CACD,KAAK,OAAO,SAAS,CACrB,MAAM,GAAG,OAAO,SAAS,QAAQ,OAAO,CAAC,CACzC,QAAQ,KAAK,OAAO,SAAS,UAAU,CAAC,CACxC,MAAM,EAAE;AACX,KAAI,aAAa;AACf,mBAAiB,YAAY,wBAAwB,KAAA;AACrD,WAAS,YAAY,gBAAgB,KAAA;AACrC,qBAAmB,YAAY,0BAA0B,KAAA;AACzD,aAAW,YAAY,kBAAkB,KAAA;;AAG3C,KAAI,CAAC,kBAAkB,CAAC,kBAAkB;EACxC,MAAM,CAAC,UAAU,MAAM,IACpB,OAAO;GAAE,gBAAgB,OAAO,QAAQ;GAAgB,MAAM,OAAO,QAAQ;GAAM,CAAC,CACpF,KAAK,OAAO,QAAQ,CACpB,QAAQ,KAAK,OAAO,QAAQ,UAAU,CAAC,CACvC,MAAM,GAAG,OAAO,QAAQ,QAAQ,OAAO,CAAC,CACxC,MAAM,EAAE;AACX,mBAAiB,QAAQ;AACzB,qBAAmB,QAAQ;;AAG7B,KAAI,CAAC,UAAU,CAAC,UAAU;EACxB,MAAM,CAAC,cAAc,MAAM,IACxB,OAAO;GAAE,QAAQ,OAAO,YAAY;GAAQ,MAAM,OAAO,YAAY;GAAM,CAAC,CAC5E,KAAK,OAAO,YAAY,CACxB,QAAQ,KAAK,OAAO,YAAY,UAAU,CAAC,CAC3C,MAAM,GAAG,OAAO,YAAY,QAAQ,OAAO,CAAC,CAC5C,MAAM,EAAE;AACX,WAAS,YAAY;AACrB,aAAW,YAAY;;AAGzB,QAAO;EAAE;EAAgB;EAAQ;EAAkB;EAAU;;AAG/D,eAAsB,0BACpB,KACA,QACA,MACe;CACf,MAAM,iBAAiBC,IAAQ;AAC/B,OAAM,IAAI,YAAY,OAAO,OAAO;EAClC,MAAM,CAAC,gBAAgB,MAAM,GAC1B,OAAO,OAAO,cAAc,CAC5B,OAAO;GACN,IAAI;GACJ,MAAM;GACN,MAAM;GACP,CAAC,CACD,WAAW;AAEd,MAAI,CAAC,aAAc,OAAM,IAAI,MAAM,2DAA2D;EAE9F,MAAM,CAAC,UAAU,MAAM,GACpB,OAAO,OAAO,QAAQ,CACtB,OAAO;GACN,QAAQ,KAAK;GACb,gBAAgB,aAAa;GAC7B,MAAM;GACP,CAAC,CACD,WAAW;AAEd,MAAI,CAAC,OAAQ,OAAM,IAAI,MAAM,qDAAqD;EAElF,MAAM,CAAC,QAAQ,MAAM,GAClB,OAAO,OAAO,MAAM,CACpB,OAAO;GACN,MAAM,aAAa;GACnB,gBAAgB,aAAa;GAC9B,CAAC,CACD,WAAW;AAEd,MAAI,CAAC,KAAM,OAAM,IAAI,MAAM,mDAAmD;EAE9E,MAAM,CAAC,cAAc,MAAM,GACxB,OAAO,OAAO,YAAY,CAC1B,OAAO;GACN,QAAQ,KAAK;GACb,QAAQ,KAAK;GACb,MAAM;GACP,CAAC,CACD,WAAW;AAEd,MAAI,CAAC,WAAY,OAAM,IAAI,MAAM,0DAA0D;GAC3F"}

package/dist/src/modules/base/base.abstract.d.mts

@@ -0,0 +1,29 @@
+import { ServerErrorLayer } from "./base.types.mjs";
+import { ServerError } from "../../utils/errors.mjs";
+import { ServerResult, ServerResultAsync } from "./base.dto.mjs";
+import { logger } from "../../utils/logger.mjs";
+import { TRPC_ERROR_CODE_KEY } from "@trpc/server";
+import * as _$neverthrow from "neverthrow";
+
+//#region src/modules/base/base.abstract.d.ts
+declare abstract class Base {
+  layer: ServerErrorLayer;
+  logger: ReturnType<typeof logger.child>;
+  constructor(layer: ServerErrorLayer);
+  error(code: TRPC_ERROR_CODE_KEY, message?: string, {
+    cause,
+    clientMessage,
+    log
+  }?: {
+    cause?: unknown;
+    clientMessage?: string;
+    log?: boolean;
+  }): _$neverthrow.Err<never, ServerError>;
+  handleUnknownError(error: unknown): ServerError;
+  throwable<T>(fn: () => ServerResult<T>): ServerResult<T>;
+  throwableAsync<T>(fn: () => ServerResultAsync<T>): ServerResultAsync<T>;
+  throwablePromise<T>(fn: () => Promise<T>, errorHandler?: (error: unknown) => ServerError): ServerResultAsync<T>;
+}
+//#endregion
+export { Base };
+//# sourceMappingURL=base.abstract.d.mts.map

package/dist/src/modules/base/base.abstract.mjs

@@ -0,0 +1,60 @@
+import { logger } from "../../utils/logger.mjs";
+import { ServerError, reportError } from "../../utils/errors.mjs";
+import { err, ok } from "neverthrow";
+//#region src/modules/base/base.abstract.ts
+var Base = class {
+	layer;
+	logger;
+	constructor(layer) {
+		this.layer = layer;
+		this.logger = logger.child({
+			layer: this.layer,
+			layerName: this.constructor.name
+		});
+	}
+	error(code, message, { cause, clientMessage, log = process.env.NODE_ENV === "development" } = {}) {
+		const serverError = new ServerError({
+			code,
+			layer: this.layer,
+			layerName: this.constructor.name,
+			message,
+			clientMessage,
+			cause,
+			captureBoundary: true
+		});
+		if (serverError.is5xxError()) reportError(serverError);
+		if (log) logger.error(serverError);
+		return err(serverError);
+	}
+	handleUnknownError(error) {
+		return ServerError.fromUnknown("INTERNAL_SERVER_ERROR", error, {
+			layer: this.layer,
+			layerName: this.constructor.name
+		});
+	}
+	throwable(fn) {
+		try {
+			return fn();
+		} catch (error) {
+			return err(this.handleUnknownError(error));
+		}
+	}
+	async throwableAsync(fn) {
+		try {
+			return await fn();
+		} catch (error) {
+			return err(this.handleUnknownError(error));
+		}
+	}
+	async throwablePromise(fn, errorHandler) {
+		try {
+			return ok(await fn());
+		} catch (error) {
+			return err(errorHandler ? errorHandler(error) : this.handleUnknownError(error));
+		}
+	}
+};
+//#endregion
+export { Base };
+
+//# sourceMappingURL=base.abstract.mjs.map

package/dist/src/modules/base/base.abstract.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"base.abstract.mjs","names":[],"sources":["../../../../src/modules/base/base.abstract.ts"],"sourcesContent":["import type { TRPC_ERROR_CODE_KEY } from \"@trpc/server\";\r\nimport { err, ok } from \"neverthrow\";\r\nimport { reportError, ServerError } from \"../../utils/errors\";\r\nimport { logger } from \"../../utils/logger\";\r\nimport type { ServerResult, ServerResultAsync } from \"./base.dto\";\r\nimport type { ServerErrorLayer } from \"./base.types\";\r\n\r\nexport abstract class Base {\r\n  public layer: ServerErrorLayer;\r\n  public logger: ReturnType<typeof logger.child>;\r\n\r\n  constructor(layer: ServerErrorLayer) {\r\n    this.layer = layer;\r\n    this.logger = logger.child({ layer: this.layer, layerName: this.constructor.name });\r\n  }\r\n\r\n  error(\r\n    code: TRPC_ERROR_CODE_KEY,\r\n    message?: string,\r\n    {\r\n      cause,\r\n      clientMessage,\r\n      log = process.env.NODE_ENV === \"development\",\r\n    }: { cause?: unknown; clientMessage?: string; log?: boolean } = {}\r\n  ) {\r\n    const serverError = new ServerError({\r\n      code,\r\n      layer: this.layer,\r\n      layerName: this.constructor.name,\r\n      message,\r\n      clientMessage,\r\n      cause,\r\n      captureBoundary: true,\r\n    });\r\n    if (serverError.is5xxError()) reportError(serverError);\r\n    if (log) logger.error(serverError);\r\n    return err(serverError);\r\n  }\r\n\r\n  handleUnknownError(error: unknown) {\r\n    return ServerError.fromUnknown(\"INTERNAL_SERVER_ERROR\", error, {\r\n      layer: this.layer,\r\n      layerName: this.constructor.name,\r\n    });\r\n  }\r\n\r\n  throwable<T>(fn: () => ServerResult<T>): ServerResult<T> {\r\n    try {\r\n      return fn();\r\n    } catch (error) {\r\n      return err(this.handleUnknownError(error));\r\n    }\r\n  }\r\n\r\n  async throwableAsync<T>(fn: () => ServerResultAsync<T>): ServerResultAsync<T> {\r\n    try {\r\n      return await fn();\r\n    } catch (error) {\r\n      return err(this.handleUnknownError(error));\r\n    }\r\n  }\r\n\r\n  async throwablePromise<T>(\r\n    fn: () => Promise<T>,\r\n    errorHandler?: (error: unknown) => ServerError\r\n  ): ServerResultAsync<T> {\r\n    try {\r\n      const result = await fn();\r\n      return ok(result);\r\n    } catch (error) {\r\n      return err(errorHandler ? errorHandler(error) : this.handleUnknownError(error));\r\n    }\r\n  }\r\n}\r\n"],"mappings":";;;;AAOA,IAAsB,OAAtB,MAA2B;CACzB;CACA;CAEA,YAAY,OAAyB;AACnC,OAAK,QAAQ;AACb,OAAK,SAAS,OAAO,MAAM;GAAE,OAAO,KAAK;GAAO,WAAW,KAAK,YAAY;GAAM,CAAC;;CAGrF,MACE,MACA,SACA,EACE,OACA,eACA,MAAM,QAAQ,IAAI,aAAa,kBAC+B,EAAE,EAClE;EACA,MAAM,cAAc,IAAI,YAAY;GAClC;GACA,OAAO,KAAK;GACZ,WAAW,KAAK,YAAY;GAC5B;GACA;GACA;GACA,iBAAiB;GAClB,CAAC;AACF,MAAI,YAAY,YAAY,CAAE,aAAY,YAAY;AACtD,MAAI,IAAK,QAAO,MAAM,YAAY;AAClC,SAAO,IAAI,YAAY;;CAGzB,mBAAmB,OAAgB;AACjC,SAAO,YAAY,YAAY,yBAAyB,OAAO;GAC7D,OAAO,KAAK;GACZ,WAAW,KAAK,YAAY;GAC7B,CAAC;;CAGJ,UAAa,IAA4C;AACvD,MAAI;AACF,UAAO,IAAI;WACJ,OAAO;AACd,UAAO,IAAI,KAAK,mBAAmB,MAAM,CAAC;;;CAI9C,MAAM,eAAkB,IAAsD;AAC5E,MAAI;AACF,UAAO,MAAM,IAAI;WACV,OAAO;AACd,UAAO,IAAI,KAAK,mBAAmB,MAAM,CAAC;;;CAI9C,MAAM,iBACJ,IACA,cACsB;AACtB,MAAI;AAEF,UAAO,GADQ,MAAM,IAAI,CACR;WACV,OAAO;AACd,UAAO,IAAI,eAAe,aAAa,MAAM,GAAG,KAAK,mBAAmB,MAAM,CAAC"}

package/dist/src/modules/base/base.actor.d.mts

@@ -0,0 +1,73 @@
+import { Session, User } from "../auth/auth.lib.mjs";
+
+//#region src/modules/base/base.actor.d.ts
+type UserActor = {
+  userId: string;
+  userRole: string;
+  organizationId: string | null;
+  organizationRole: string | null;
+  teamId: string | null;
+  teamRole: string | null;
+};
+type OrganizationActor = {
+  userId: string;
+  userRole: string;
+  organizationId: string;
+  organizationRole: string;
+  teamId: string | null;
+  teamRole: string | null;
+};
+type TeamActor = {
+  userId: string;
+  userRole: string;
+  organizationId: string;
+  organizationRole: string;
+  teamId: string;
+  teamRole: string;
+};
+type AuthenticatedActor = UserActor | OrganizationActor | TeamActor;
+/** @deprecated Prefer `AuthenticatedActor` — kept for grants and legacy call sites */
+type ServiceActor = AuthenticatedActor;
+type Actor = {
+  user: UserActor;
+  organization: OrganizationActor;
+  team: TeamActor;
+  authenticated: AuthenticatedActor;
+};
+type ActorScope = "user" | "organization" | "team";
+type RequiredServiceActor<Scope extends ActorScope> = Actor[Scope];
+/** Claims shape used by tests and factories */
+type ServiceActorClaims = {
+  userId: string;
+  userRole: string;
+  organizationId?: string | null;
+  organizationRole?: string | null;
+  teamId?: string | null;
+  teamRole?: string | null;
+};
+/** @deprecated Prefer `OrganizationActor` */
+type ServiceOrganizationActor = OrganizationActor;
+/** @deprecated Prefer `TeamActor` */
+type ServiceTeamActor = TeamActor;
+declare function createActorFromContext(context: {
+  user: User;
+  session: Session;
+}, scope: "team"): TeamActor;
+declare function createActorFromContext(context: {
+  user: User;
+  session: Session;
+}, scope: "organization"): OrganizationActor;
+declare function createActorFromContext(context: {
+  user: User;
+  session: Session;
+}, scope: "user"): UserActor;
+declare function validateActor(actor: AuthenticatedActor, scope: ActorScope): boolean;
+/**
+ * Builds a flat actor for tests / grants without session. Validates that team scope implies organization.
+ */
+declare function createServiceActor(claims: ServiceActorClaims): AuthenticatedActor;
+declare function getServiceActorScope(actor: AuthenticatedActor): ActorScope;
+declare function hasServiceActorScope(actor: AuthenticatedActor, scope: ActorScope): boolean;
+//#endregion
+export { Actor, ActorScope, AuthenticatedActor, OrganizationActor, RequiredServiceActor, ServiceActor, ServiceActorClaims, ServiceOrganizationActor, ServiceTeamActor, TeamActor, UserActor, createActorFromContext, createServiceActor, getServiceActorScope, hasServiceActorScope, validateActor };
+//# sourceMappingURL=base.actor.d.mts.map

package/dist/src/modules/base/base.actor.mjs

@@ -0,0 +1,78 @@
+import { ServerError } from "../../utils/errors.mjs";
+//#region src/modules/base/base.actor.ts
+function createActorFromContext(context, scope) {
+	if (!context.user.role) throw new ServerError({
+		code: "BAD_REQUEST",
+		message: "User role not found in context",
+		layer: "controller",
+		layerName: "ActorValidation"
+	});
+	if (scope === "organization") {
+		if (!context.session.activeOrganizationId || !context.session.activeOrganizationRole) throw new ServerError({
+			code: "FORBIDDEN",
+			message: "Active organization context required",
+			layer: "controller",
+			layerName: "ActorValidation"
+		});
+	}
+	if (scope === "team") {
+		if (!context.session.activeOrganizationId || !context.session.activeOrganizationRole) throw new ServerError({
+			code: "FORBIDDEN",
+			message: "Active organization context required for team scope",
+			layer: "controller",
+			layerName: "ActorValidation"
+		});
+		if (!context.session.activeTeamId || !context.session.activeTeamRole) throw new ServerError({
+			code: "FORBIDDEN",
+			message: "Active team context required",
+			layer: "controller",
+			layerName: "ActorValidation"
+		});
+	}
+	return {
+		userId: context.user.id,
+		userRole: context.user.role,
+		organizationId: context.session.activeOrganizationId,
+		organizationRole: context.session.activeOrganizationRole,
+		teamId: context.session.activeTeamId,
+		teamRole: context.session.activeTeamRole
+	};
+}
+function validateActor(actor, scope) {
+	if (!actor.userId || !actor.userRole) return false;
+	if (scope === "user") return true;
+	if (scope === "organization") return Boolean(actor.organizationId && actor.organizationRole);
+	return Boolean(actor.organizationId && actor.organizationRole && actor.teamId && actor.teamRole);
+}
+/**
+* Builds a flat actor for tests / grants without session. Validates that team scope implies organization.
+*/
+function createServiceActor(claims) {
+	const organizationId = claims.organizationId ?? null;
+	const organizationRole = claims.organizationRole ?? null;
+	const teamId = claims.teamId ?? null;
+	const teamRole = claims.teamRole ?? null;
+	if ((teamId || teamRole) && (!organizationId || !organizationRole)) throw new Error("organization access before team access");
+	return {
+		userId: claims.userId,
+		userRole: claims.userRole,
+		organizationId,
+		organizationRole,
+		teamId,
+		teamRole
+	};
+}
+function getServiceActorScope(actor) {
+	if (validateActor(actor, "team")) return "team";
+	if (validateActor(actor, "organization")) return "organization";
+	return "user";
+}
+function hasServiceActorScope(actor, scope) {
+	if (scope === "team") return validateActor(actor, "team");
+	if (scope === "organization") return validateActor(actor, "organization") || validateActor(actor, "team");
+	return validateActor(actor, "user");
+}
+//#endregion
+export { createActorFromContext, createServiceActor, getServiceActorScope, hasServiceActorScope, validateActor };
+
+//# sourceMappingURL=base.actor.mjs.map

package/dist/src/modules/base/base.actor.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"base.actor.mjs","names":[],"sources":["../../../../src/modules/base/base.actor.ts"],"sourcesContent":["import { ServerError } from \"../../utils/errors\";\r\nimport type { Session, User } from \"../auth/auth.lib\";\r\n\r\nexport type UserActor = {\r\n  userId: string;\r\n  userRole: string;\r\n  organizationId: string | null;\r\n  organizationRole: string | null;\r\n  teamId: string | null;\r\n  teamRole: string | null;\r\n};\r\n\r\nexport type OrganizationActor = {\r\n  userId: string;\r\n  userRole: string;\r\n  organizationId: string;\r\n  organizationRole: string;\r\n  teamId: string | null;\r\n  teamRole: string | null;\r\n};\r\n\r\nexport type TeamActor = {\r\n  userId: string;\r\n  userRole: string;\r\n  organizationId: string;\r\n  organizationRole: string;\r\n  teamId: string;\r\n  teamRole: string;\r\n};\r\n\r\nexport type AuthenticatedActor = UserActor | OrganizationActor | TeamActor;\r\n\r\n/** @deprecated Prefer `AuthenticatedActor` — kept for grants and legacy call sites */\r\nexport type ServiceActor = AuthenticatedActor;\r\n\r\nexport type Actor = {\r\n  user: UserActor;\r\n  organization: OrganizationActor;\r\n  team: TeamActor;\r\n  authenticated: AuthenticatedActor;\r\n};\r\n\r\nexport type ActorScope = \"user\" | \"organization\" | \"team\";\r\n\r\nexport type RequiredServiceActor<Scope extends ActorScope> = Actor[Scope];\r\n\r\n/** Claims shape used by tests and factories */\r\nexport type ServiceActorClaims = {\r\n  userId: string;\r\n  userRole: string;\r\n  organizationId?: string | null;\r\n  organizationRole?: string | null;\r\n  teamId?: string | null;\r\n  teamRole?: string | null;\r\n};\r\n\r\n/** @deprecated Prefer `OrganizationActor` */\r\nexport type ServiceOrganizationActor = OrganizationActor;\r\n/** @deprecated Prefer `TeamActor` */\r\nexport type ServiceTeamActor = TeamActor;\r\n\r\nexport function createActorFromContext(\r\n  context: { user: User; session: Session },\r\n  scope: \"team\"\r\n): TeamActor;\r\nexport function createActorFromContext(\r\n  context: { user: User; session: Session },\r\n  scope: \"organization\"\r\n): OrganizationActor;\r\nexport function createActorFromContext(\r\n  context: { user: User; session: Session },\r\n  scope: \"user\"\r\n): UserActor;\r\nexport function createActorFromContext(\r\n  context: { user: User; session: Session },\r\n  scope: ActorScope\r\n): AuthenticatedActor {\r\n  if (!context.user.role) {\r\n    throw new ServerError({\r\n      code: \"BAD_REQUEST\",\r\n      message: \"User role not found in context\",\r\n      layer: \"controller\",\r\n      layerName: \"ActorValidation\",\r\n    });\r\n  }\r\n\r\n  if (scope === \"organization\") {\r\n    if (!context.session.activeOrganizationId || !context.session.activeOrganizationRole) {\r\n      throw new ServerError({\r\n        code: \"FORBIDDEN\",\r\n        message: \"Active organization context required\",\r\n        layer: \"controller\",\r\n        layerName: \"ActorValidation\",\r\n      });\r\n    }\r\n  }\r\n\r\n  if (scope === \"team\") {\r\n    if (!context.session.activeOrganizationId || !context.session.activeOrganizationRole) {\r\n      throw new ServerError({\r\n        code: \"FORBIDDEN\",\r\n        message: \"Active organization context required for team scope\",\r\n        layer: \"controller\",\r\n        layerName: \"ActorValidation\",\r\n      });\r\n    }\r\n    if (!context.session.activeTeamId || !context.session.activeTeamRole) {\r\n      throw new ServerError({\r\n        code: \"FORBIDDEN\",\r\n        message: \"Active team context required\",\r\n        layer: \"controller\",\r\n        layerName: \"ActorValidation\",\r\n      });\r\n    }\r\n  }\r\n\r\n  return {\r\n    userId: context.user.id,\r\n    userRole: context.user.role,\r\n    organizationId: context.session.activeOrganizationId,\r\n    organizationRole: context.session.activeOrganizationRole,\r\n    teamId: context.session.activeTeamId,\r\n    teamRole: context.session.activeTeamRole,\r\n  };\r\n}\r\n\r\nexport function validateActor(actor: AuthenticatedActor, scope: ActorScope): boolean {\r\n  if (!actor.userId || !actor.userRole) return false;\r\n  if (scope === \"user\") return true;\r\n  if (scope === \"organization\") {\r\n    return Boolean(actor.organizationId && actor.organizationRole);\r\n  }\r\n  return Boolean(\r\n    actor.organizationId && actor.organizationRole && actor.teamId && actor.teamRole\r\n  );\r\n}\r\n\r\n/**\r\n * Builds a flat actor for tests / grants without session. Validates that team scope implies organization.\r\n */\r\nexport function createServiceActor(claims: ServiceActorClaims): AuthenticatedActor {\r\n  const organizationId = claims.organizationId ?? null;\r\n  const organizationRole = claims.organizationRole ?? null;\r\n  const teamId = claims.teamId ?? null;\r\n  const teamRole = claims.teamRole ?? null;\r\n\r\n  if ((teamId || teamRole) && (!organizationId || !organizationRole)) {\r\n    throw new Error(\"organization access before team access\");\r\n  }\r\n\r\n  return {\r\n    userId: claims.userId,\r\n    userRole: claims.userRole,\r\n    organizationId,\r\n    organizationRole,\r\n    teamId,\r\n    teamRole,\r\n  };\r\n}\r\n\r\nexport function getServiceActorScope(actor: AuthenticatedActor): ActorScope {\r\n  if (validateActor(actor, \"team\")) return \"team\";\r\n  if (validateActor(actor, \"organization\")) return \"organization\";\r\n  return \"user\";\r\n}\r\n\r\nexport function hasServiceActorScope(actor: AuthenticatedActor, scope: ActorScope): boolean {\r\n  if (scope === \"team\") return validateActor(actor, \"team\");\r\n  if (scope === \"organization\") {\r\n    return validateActor(actor, \"organization\") || validateActor(actor, \"team\");\r\n  }\r\n  return validateActor(actor, \"user\");\r\n}\r\n"],"mappings":";;AAyEA,SAAgB,uBACd,SACA,OACoB;AACpB,KAAI,CAAC,QAAQ,KAAK,KAChB,OAAM,IAAI,YAAY;EACpB,MAAM;EACN,SAAS;EACT,OAAO;EACP,WAAW;EACZ,CAAC;AAGJ,KAAI,UAAU;MACR,CAAC,QAAQ,QAAQ,wBAAwB,CAAC,QAAQ,QAAQ,uBAC5D,OAAM,IAAI,YAAY;GACpB,MAAM;GACN,SAAS;GACT,OAAO;GACP,WAAW;GACZ,CAAC;;AAIN,KAAI,UAAU,QAAQ;AACpB,MAAI,CAAC,QAAQ,QAAQ,wBAAwB,CAAC,QAAQ,QAAQ,uBAC5D,OAAM,IAAI,YAAY;GACpB,MAAM;GACN,SAAS;GACT,OAAO;GACP,WAAW;GACZ,CAAC;AAEJ,MAAI,CAAC,QAAQ,QAAQ,gBAAgB,CAAC,QAAQ,QAAQ,eACpD,OAAM,IAAI,YAAY;GACpB,MAAM;GACN,SAAS;GACT,OAAO;GACP,WAAW;GACZ,CAAC;;AAIN,QAAO;EACL,QAAQ,QAAQ,KAAK;EACrB,UAAU,QAAQ,KAAK;EACvB,gBAAgB,QAAQ,QAAQ;EAChC,kBAAkB,QAAQ,QAAQ;EAClC,QAAQ,QAAQ,QAAQ;EACxB,UAAU,QAAQ,QAAQ;EAC3B;;AAGH,SAAgB,cAAc,OAA2B,OAA4B;AACnF,KAAI,CAAC,MAAM,UAAU,CAAC,MAAM,SAAU,QAAO;AAC7C,KAAI,UAAU,OAAQ,QAAO;AAC7B,KAAI,UAAU,eACZ,QAAO,QAAQ,MAAM,kBAAkB,MAAM,iBAAiB;AAEhE,QAAO,QACL,MAAM,kBAAkB,MAAM,oBAAoB,MAAM,UAAU,MAAM,SACzE;;;;;AAMH,SAAgB,mBAAmB,QAAgD;CACjF,MAAM,iBAAiB,OAAO,kBAAkB;CAChD,MAAM,mBAAmB,OAAO,oBAAoB;CACpD,MAAM,SAAS,OAAO,UAAU;CAChC,MAAM,WAAW,OAAO,YAAY;AAEpC,MAAK,UAAU,cAAc,CAAC,kBAAkB,CAAC,kBAC/C,OAAM,IAAI,MAAM,yCAAyC;AAG3D,QAAO;EACL,QAAQ,OAAO;EACf,UAAU,OAAO;EACjB;EACA;EACA;EACA;EACD;;AAGH,SAAgB,qBAAqB,OAAuC;AAC1E,KAAI,cAAc,OAAO,OAAO,CAAE,QAAO;AACzC,KAAI,cAAc,OAAO,eAAe,CAAE,QAAO;AACjD,QAAO;;AAGT,SAAgB,qBAAqB,OAA2B,OAA4B;AAC1F,KAAI,UAAU,OAAQ,QAAO,cAAc,OAAO,OAAO;AACzD,KAAI,UAAU,eACZ,QAAO,cAAc,OAAO,eAAe,IAAI,cAAc,OAAO,OAAO;AAE7E,QAAO,cAAc,OAAO,OAAO"}

package/dist/src/modules/base/base.dto.d.mts

@@ -0,0 +1,67 @@
+import { ServerError } from "../../utils/errors.mjs";
+import { z } from "zod";
+import * as _$drizzle_orm0 from "drizzle-orm";
+import { InferSelectModel, Table, getTableColumns } from "drizzle-orm";
+import { Result } from "neverthrow";
+import * as _$drizzle_zod0 from "drizzle-zod";
+
+//#region src/modules/base/base.dto.d.ts
+type Simplify<T> = { [K in keyof T]: T[K] } & {};
+type StringKeys<T> = Extract<keyof T, string>;
+type ServerResult<T> = Result<T, ServerError>;
+type ServerResultAsync<T> = Promise<ServerResult<T>>;
+declare const createTableSelectSchema: <T extends Table>(table: T) => _$drizzle_zod0.BuildSchema<"select", T["_"]["columns"], undefined, undefined>;
+type ExtractColumnTypes<T extends Table, C extends Record<string, unknown>> = Simplify<Pick<InferSelectModel<T>, Extract<keyof C, keyof InferSelectModel<T>>>>;
+declare function toZodFilter<const T extends readonly string[]>(array: T): Record<T[number], true>;
+declare function pickSchema<Shape extends z.ZodRawShape, const Keys extends readonly StringKeys<Shape>[]>(schema: z.ZodObject<Shape>, keys: Keys): z.ZodObject<Pick<Shape, Keys[number]>>;
+declare function pickTableSchema<T extends Table, K extends keyof InferSelectModel<T>>(table: T, columns: readonly K[]): z.ZodObject<Pick<(T["_"]["columns"] extends infer T_2 extends Record<string, any> ? { [K_2 in keyof T_2 as _$drizzle_zod0.ColumnIsGeneratedAlwaysAs<T["_"]["columns"][K_2]> extends true ? K_2 : K_2]: T_2[K_2] extends infer TColumn extends _$drizzle_orm0.Column<_$drizzle_orm0.ColumnBaseConfig<_$drizzle_orm0.ColumnDataType, string>, object, object> ? (TRefinements extends object ? TRefinements[K_2] extends z.ZodType<unknown, unknown, z.core.$ZodTypeInternals<unknown, unknown>> | ((schema: any) => any) ? true : false : false) extends true ? _$drizzle_orm0.Assume<TRefinements[K_2 & keyof TRefinements] extends infer T_3 ? T_3 extends TRefinements[K_2 & keyof TRefinements] ? T_3 extends ((schema: any) => z.ZodType) ? (TColumn["_"]["notNull"] extends true ? ReturnType<T_3> : z.ZodNullable<ReturnType<T_3>>) extends infer TSchema extends z.ZodType<unknown, unknown, z.core.$ZodTypeInternals<unknown, unknown>> ? TType extends "update" ? z.ZodOptional<TSchema> : TSchema : z.ZodType<unknown, unknown, z.core.$ZodTypeInternals<unknown, unknown>> : T_3 : never : never, z.ZodType<unknown, unknown, z.core.$ZodTypeInternals<unknown, unknown>>> : _$drizzle_zod0.HandleColumn<TType, TColumn, TCoerce> : T_2[K_2] extends infer TObject extends Table<_$drizzle_orm0.TableConfig<_$drizzle_orm0.Column<any, object, object>>> | _$drizzle_orm0.SelectedFieldsFlat<_$drizzle_orm0.Column<_$drizzle_orm0.ColumnBaseConfig<_$drizzle_orm0.ColumnDataType, string>, object, object>> | _$drizzle_orm0.View<string, boolean, _$drizzle_orm0.ColumnsSelection> ? _$drizzle_zod0.BuildSchema<TType, _$drizzle_zod0.GetSelection<TObject>, TRefinements extends object ? TRefinements[K_2 & keyof TRefinements] : undefined, TCoerce> : z.ZodAny } : never) extends infer T_1 ? { [K_1 in keyof T_1]: T_1[K_1] } : never, K>, z.core.$strip>;
+declare function omitSchema<Shape extends z.ZodRawShape, const Keys extends readonly StringKeys<Shape>[]>(schema: z.ZodObject<Shape>, keys: Keys): z.ZodObject<Omit<Shape, Keys[number]>>;
+declare function omitTableSchema<T extends Table, K extends keyof InferSelectModel<T>>(table: T, columns: readonly K[]): z.ZodObject<Omit<(T["_"]["columns"] extends infer T_2 extends Record<string, any> ? { [K_2 in keyof T_2 as _$drizzle_zod0.ColumnIsGeneratedAlwaysAs<T["_"]["columns"][K_2]> extends true ? K_2 : K_2]: T_2[K_2] extends infer TColumn extends _$drizzle_orm0.Column<_$drizzle_orm0.ColumnBaseConfig<_$drizzle_orm0.ColumnDataType, string>, object, object> ? (TRefinements extends object ? TRefinements[K_2] extends z.ZodType<unknown, unknown, z.core.$ZodTypeInternals<unknown, unknown>> | ((schema: any) => any) ? true : false : false) extends true ? _$drizzle_orm0.Assume<TRefinements[K_2 & keyof TRefinements] extends infer T_3 ? T_3 extends TRefinements[K_2 & keyof TRefinements] ? T_3 extends ((schema: any) => z.ZodType) ? (TColumn["_"]["notNull"] extends true ? ReturnType<T_3> : z.ZodNullable<ReturnType<T_3>>) extends infer TSchema extends z.ZodType<unknown, unknown, z.core.$ZodTypeInternals<unknown, unknown>> ? TType extends "update" ? z.ZodOptional<TSchema> : TSchema : z.ZodType<unknown, unknown, z.core.$ZodTypeInternals<unknown, unknown>> : T_3 : never : never, z.ZodType<unknown, unknown, z.core.$ZodTypeInternals<unknown, unknown>>> : _$drizzle_zod0.HandleColumn<TType, TColumn, TCoerce> : T_2[K_2] extends infer TObject extends Table<_$drizzle_orm0.TableConfig<_$drizzle_orm0.Column<any, object, object>>> | _$drizzle_orm0.SelectedFieldsFlat<_$drizzle_orm0.Column<_$drizzle_orm0.ColumnBaseConfig<_$drizzle_orm0.ColumnDataType, string>, object, object>> | _$drizzle_orm0.View<string, boolean, _$drizzle_orm0.ColumnsSelection> ? _$drizzle_zod0.BuildSchema<TType, _$drizzle_zod0.GetSelection<TObject>, TRefinements extends object ? TRefinements[K_2 & keyof TRefinements] : undefined, TCoerce> : z.ZodAny } : never) extends infer T_1 ? { [K_1 in keyof T_1]: T_1[K_1] } : never, K>, z.core.$strip>;
+declare function pickColumns<T extends Table, Shape extends z.ZodRawShape>(table: T, schema: z.ZodObject<Shape>): Pick<ReturnType<typeof getTableColumns<T>>, Extract<keyof Shape, string>>;
+declare function pickTableColumns<T extends Table, K extends keyof InferSelectModel<T>>(table: T, columns: readonly K[]): Pick<ReturnType<typeof getTableColumns<T>>, K>;
+declare function omitTableColumns<T extends Table, K extends keyof InferSelectModel<T>>(table: T, columns: readonly K[]): Omit<ReturnType<typeof getTableColumns<T>>, K>;
+declare function createSelectDTO<T extends Table>(table: T): {
+  columns: ReturnType<typeof getTableColumns<T>>;
+  schema: ReturnType<typeof createTableSelectSchema<T>>;
+};
+declare function createSelectDTO<T extends Table, K extends Extract<keyof InferSelectModel<T>, string>>(table: T, partial: {
+  omit: readonly K[];
+}): {
+  columns: ReturnType<typeof omitTableColumns<T, K>>;
+  schema: ReturnType<typeof omitTableSchema<T, K>>;
+};
+declare function createSelectDTO<T extends Table, K extends Extract<keyof InferSelectModel<T>, string>>(table: T, partial: {
+  pick: readonly K[];
+}): {
+  columns: ReturnType<typeof pickTableColumns<T, K>>;
+  schema: ReturnType<typeof pickTableSchema<T, K>>;
+};
+declare function createSelectUtils<T extends Record<string, {
+  columns: unknown;
+  schema: z.ZodTypeAny;
+}>, S extends z.ZodTypeAny>(dtos: T, output: S, transformer: (rows: Array<{ [K in keyof T]: z.infer<T[K]["schema"]> }>) => z.infer<S>): {
+  select: { [K in keyof T]: T[K]["columns"] };
+  output: S;
+  transformer: (rows: Array<{ [K in keyof T]: z.infer<T[K]["schema"]> }>) => z.infer<S>;
+};
+declare const uuidOutput: z.ZodObject<{
+  id: z.ZodUUID;
+}, z.core.$strip>;
+declare const uuidManyOutput: z.ZodObject<{
+  ids: z.ZodArray<z.ZodUUID>;
+}, z.core.$strip>;
+declare const scheduleOutput: z.ZodObject<{
+  jobId: z.ZodString;
+}, z.core.$strip>;
+declare const scheduleManyOutput: z.ZodObject<{
+  jobIds: z.ZodArray<z.ZodString>;
+}, z.core.$strip>;
+declare const deleteOutput: z.ZodObject<{
+  id: z.ZodUUID;
+}, z.core.$strip>;
+declare const deleteManyOutput: z.ZodObject<{
+  ids: z.ZodArray<z.ZodUUID>;
+}, z.core.$strip>;
+//#endregion
+export { ExtractColumnTypes, ServerResult, ServerResultAsync, createSelectDTO, createSelectUtils, createTableSelectSchema, deleteManyOutput, deleteOutput, getTableColumns, omitSchema, omitTableColumns, omitTableSchema, pickColumns, pickSchema, pickTableColumns, pickTableSchema, scheduleManyOutput, scheduleOutput, toZodFilter, uuidManyOutput, uuidOutput };
+//# sourceMappingURL=base.dto.d.mts.map

package/dist/src/modules/base/base.dto.mjs

@@ -0,0 +1,79 @@
+import { z } from "zod";
+import { getTableColumns } from "drizzle-orm";
+import { createSelectSchema } from "drizzle-zod";
+//#region src/modules/base/base.dto.ts
+const createTableSelectSchema = (table) => createSelectSchema(table);
+function toZodFilter(array) {
+	return array.reduce((acc, column) => {
+		acc[column] = true;
+		return acc;
+	}, {});
+}
+function pickSchema(schema, keys) {
+	const mask = {};
+	for (const k of keys) mask[k] = true;
+	return schema.pick(mask);
+}
+function pickTableSchema(table, columns) {
+	return pickSchema(createSelectSchema(table), columns);
+}
+function omitSchema(schema, keys) {
+	const mask = {};
+	for (const k of keys) mask[k] = true;
+	return schema.omit(mask);
+}
+function omitTableSchema(table, columns) {
+	return omitSchema(createSelectSchema(table), columns);
+}
+function pickColumns(table, schema) {
+	const allColumns = getTableColumns(table);
+	const schemaKeys = Object.keys(schema.shape);
+	const result = {};
+	for (const key of schemaKeys) if (key in allColumns) result[key] = allColumns[key];
+	return result;
+}
+function pickTableColumns(table, columns) {
+	const allColumns = getTableColumns(table);
+	const result = {};
+	for (const key of columns) if (key in allColumns) result[key] = allColumns[key];
+	return result;
+}
+function omitTableColumns(table, columns) {
+	const allColumns = getTableColumns(table);
+	const columnsToOmit = new Set(columns);
+	const filteredEntries = Object.entries(allColumns).filter(([key]) => !columnsToOmit.has(key));
+	return Object.fromEntries(filteredEntries);
+}
+function createSelectDTO(table, partial) {
+	if (partial) {
+		if ("omit" in partial && partial.omit) return {
+			columns: omitTableColumns(table, partial.omit),
+			schema: omitTableSchema(table, partial.omit)
+		};
+		if ("pick" in partial && partial.pick) return {
+			columns: pickTableColumns(table, partial.pick),
+			schema: pickTableSchema(table, partial.pick)
+		};
+	}
+	return {
+		columns: getTableColumns(table),
+		schema: createTableSelectSchema(table)
+	};
+}
+function createSelectUtils(dtos, output, transformer) {
+	return {
+		select: Object.fromEntries(Object.entries(dtos).map(([key, dto]) => [key, dto.columns])),
+		output,
+		transformer
+	};
+}
+const uuidOutput = z.object({ id: z.uuid() });
+const uuidManyOutput = z.object({ ids: z.array(z.uuid()) });
+const scheduleOutput = z.object({ jobId: z.string() });
+const scheduleManyOutput = z.object({ jobIds: z.array(z.string()) });
+const deleteOutput = uuidOutput;
+const deleteManyOutput = uuidManyOutput;
+//#endregion
+export { createSelectDTO, createSelectUtils, createTableSelectSchema, deleteManyOutput, deleteOutput, getTableColumns, omitSchema, omitTableColumns, omitTableSchema, pickColumns, pickSchema, pickTableColumns, pickTableSchema, scheduleManyOutput, scheduleOutput, toZodFilter, uuidManyOutput, uuidOutput };
+
+//# sourceMappingURL=base.dto.mjs.map

package/dist/src/modules/base/base.dto.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"base.dto.mjs","names":[],"sources":["../../../../src/modules/base/base.dto.ts"],"sourcesContent":["import { getTableColumns, type InferSelectModel, type Table } from \"drizzle-orm\";\r\nimport { createSelectSchema } from \"drizzle-zod\";\r\nimport type { Result } from \"neverthrow\";\r\nimport { z } from \"zod\";\r\nimport type { ServerError } from \"../../utils/errors\";\r\n\r\ntype Simplify<T> = { [K in keyof T]: T[K] } & {};\r\ntype StringKeys<T> = Extract<keyof T, string>;\r\n\r\nexport type ServerResult<T> = Result<T, ServerError>;\r\nexport type ServerResultAsync<T> = Promise<ServerResult<T>>;\r\n\r\n// Wrapper to force the drizzle-zod overload to the Table version\r\nexport const createTableSelectSchema = <T extends Table>(table: T) => createSelectSchema(table);\r\n\r\nexport type ExtractColumnTypes<T extends Table, C extends Record<string, unknown>> = Simplify<\r\n  Pick<InferSelectModel<T>, Extract<keyof C, keyof InferSelectModel<T>>>\r\n>;\r\n\r\nexport function toZodFilter<const T extends readonly string[]>(array: T): Record<T[number], true> {\r\n  return array.reduce(\r\n    (acc, column) => {\r\n      acc[column as T[number]] = true;\r\n      return acc;\r\n    },\r\n    {} as Record<T[number], true>\r\n  );\r\n}\r\n\r\nexport function pickSchema<\r\n  Shape extends z.ZodRawShape,\r\n  const Keys extends readonly StringKeys<Shape>[],\r\n>(schema: z.ZodObject<Shape>, keys: Keys): z.ZodObject<Pick<Shape, Keys[number]>> {\r\n  const mask: Record<keyof Shape, true> = {} as Record<keyof Shape, true>;\r\n  for (const k of keys) {\r\n    mask[k] = true;\r\n  }\r\n  return schema.pick(mask) as z.ZodObject<Pick<Shape, Keys[number]>>;\r\n}\r\n\r\nexport function pickTableSchema<T extends Table, K extends keyof InferSelectModel<T>>(\r\n  table: T,\r\n  columns: readonly K[]\r\n) {\r\n  return pickSchema(createSelectSchema(table), columns);\r\n}\r\n\r\nexport function omitSchema<\r\n  Shape extends z.ZodRawShape,\r\n  const Keys extends readonly StringKeys<Shape>[],\r\n>(schema: z.ZodObject<Shape>, keys: Keys): z.ZodObject<Omit<Shape, Keys[number]>> {\r\n  const mask: Record<keyof Shape, true> = {} as Record<keyof Shape, true>;\r\n  for (const k of keys) {\r\n    mask[k] = true;\r\n  }\r\n  return schema.omit(mask) as z.ZodObject<Omit<Shape, Keys[number]>>;\r\n}\r\n\r\nexport function omitTableSchema<T extends Table, K extends keyof InferSelectModel<T>>(\r\n  table: T,\r\n  columns: readonly K[]\r\n) {\r\n  return omitSchema(createSelectSchema(table), columns);\r\n}\r\n\r\nexport { getTableColumns };\r\n\r\nexport function pickColumns<T extends Table, Shape extends z.ZodRawShape>(\r\n  table: T,\r\n  schema: z.ZodObject<Shape>\r\n): Pick<ReturnType<typeof getTableColumns<T>>, Extract<keyof Shape, string>> {\r\n  const allColumns = getTableColumns(table);\r\n  const schemaKeys = Object.keys(schema.shape) as Array<Extract<keyof Shape, string>>;\r\n\r\n  const result = {} as Pick<typeof allColumns, Extract<keyof Shape, string>>;\r\n  for (const key of schemaKeys) {\r\n    if (key in allColumns) {\r\n      (result as any)[key] = allColumns[key as keyof typeof allColumns];\r\n    }\r\n  }\r\n\r\n  return result;\r\n}\r\n\r\nexport function pickTableColumns<T extends Table, K extends keyof InferSelectModel<T>>(\r\n  table: T,\r\n  columns: readonly K[]\r\n): Pick<ReturnType<typeof getTableColumns<T>>, K> {\r\n  const allColumns = getTableColumns(table);\r\n  const result = {} as Pick<typeof allColumns, K>;\r\n  for (const key of columns) {\r\n    if (key in allColumns) {\r\n      result[key] = allColumns[key];\r\n    }\r\n  }\r\n  return result;\r\n}\r\n\r\nexport function omitTableColumns<T extends Table, K extends keyof InferSelectModel<T>>(\r\n  table: T,\r\n  columns: readonly K[]\r\n): Omit<ReturnType<typeof getTableColumns<T>>, K> {\r\n  const allColumns = getTableColumns(table);\r\n  const columnsToOmit = new Set(columns as readonly string[]);\r\n  const filteredEntries = Object.entries(allColumns).filter(([key]) => !columnsToOmit.has(key));\r\n  return Object.fromEntries(filteredEntries) as Omit<typeof allColumns, K>;\r\n}\r\n\r\n// Overloads to narrow return type based on provided partial\r\nexport function createSelectDTO<T extends Table>(\r\n  table: T\r\n): {\r\n  columns: ReturnType<typeof getTableColumns<T>>;\r\n  schema: ReturnType<typeof createTableSelectSchema<T>>;\r\n};\r\nexport function createSelectDTO<\r\n  T extends Table,\r\n  K extends Extract<keyof InferSelectModel<T>, string>,\r\n>(\r\n  table: T,\r\n  partial: { omit: readonly K[] }\r\n): {\r\n  columns: ReturnType<typeof omitTableColumns<T, K>>;\r\n  schema: ReturnType<typeof omitTableSchema<T, K>>;\r\n};\r\nexport function createSelectDTO<\r\n  T extends Table,\r\n  K extends Extract<keyof InferSelectModel<T>, string>,\r\n>(\r\n  table: T,\r\n  partial: { pick: readonly K[] }\r\n): {\r\n  columns: ReturnType<typeof pickTableColumns<T, K>>;\r\n  schema: ReturnType<typeof pickTableSchema<T, K>>;\r\n};\r\n\r\n// Implementation\r\nexport function createSelectDTO<T extends Table>(\r\n  table: T,\r\n  partial?:\r\n    | { omit: readonly (keyof InferSelectModel<T>)[] }\r\n    | { pick: readonly (keyof InferSelectModel<T>)[] }\r\n): { columns: unknown; schema: unknown } {\r\n  if (partial) {\r\n    if (\"omit\" in partial && partial.omit) {\r\n      return {\r\n        columns: omitTableColumns(table, partial.omit),\r\n        schema: omitTableSchema(table, partial.omit),\r\n      };\r\n    }\r\n    if (\"pick\" in partial && partial.pick) {\r\n      return {\r\n        columns: pickTableColumns(table, partial.pick),\r\n        schema: pickTableSchema(table, partial.pick),\r\n      };\r\n    }\r\n  }\r\n  return { columns: getTableColumns(table), schema: createTableSelectSchema(table) };\r\n}\r\n\r\nexport function createSelectUtils<\r\n  T extends Record<\r\n    string,\r\n    {\r\n      columns: unknown;\r\n      schema: z.ZodTypeAny;\r\n    }\r\n  >,\r\n  S extends z.ZodTypeAny,\r\n>(\r\n  dtos: T,\r\n  output: S,\r\n  transformer: (rows: Array<{ [K in keyof T]: z.infer<T[K][\"schema\"]> }>) => z.infer<S>\r\n): {\r\n  select: { [K in keyof T]: T[K][\"columns\"] };\r\n  output: S;\r\n  transformer: (rows: Array<{ [K in keyof T]: z.infer<T[K][\"schema\"]> }>) => z.infer<S>;\r\n} {\r\n  return {\r\n    select: Object.fromEntries(Object.entries(dtos).map(([key, dto]) => [key, dto.columns])) as {\r\n      [K in keyof T]: T[K][\"columns\"];\r\n    },\r\n    output,\r\n    transformer,\r\n  };\r\n}\r\n\r\nexport const uuidOutput = z.object({\r\n  id: z.uuid(),\r\n});\r\n\r\nexport const uuidManyOutput = z.object({\r\n  ids: z.array(z.uuid()),\r\n});\r\n\r\nexport const scheduleOutput = z.object({\r\n  jobId: z.string(),\r\n});\r\n\r\nexport const scheduleManyOutput = z.object({\r\n  jobIds: z.array(z.string()),\r\n});\r\n\r\nexport const deleteOutput = uuidOutput;\r\n\r\nexport const deleteManyOutput = uuidManyOutput;\r\n"],"mappings":";;;;AAaA,MAAa,2BAA4C,UAAa,mBAAmB,MAAM;AAM/F,SAAgB,YAA+C,OAAmC;AAChG,QAAO,MAAM,QACV,KAAK,WAAW;AACf,MAAI,UAAuB;AAC3B,SAAO;IAET,EAAE,CACH;;AAGH,SAAgB,WAGd,QAA4B,MAAoD;CAChF,MAAM,OAAkC,EAAE;AAC1C,MAAK,MAAM,KAAK,KACd,MAAK,KAAK;AAEZ,QAAO,OAAO,KAAK,KAAK;;AAG1B,SAAgB,gBACd,OACA,SACA;AACA,QAAO,WAAW,mBAAmB,MAAM,EAAE,QAAQ;;AAGvD,SAAgB,WAGd,QAA4B,MAAoD;CAChF,MAAM,OAAkC,EAAE;AAC1C,MAAK,MAAM,KAAK,KACd,MAAK,KAAK;AAEZ,QAAO,OAAO,KAAK,KAAK;;AAG1B,SAAgB,gBACd,OACA,SACA;AACA,QAAO,WAAW,mBAAmB,MAAM,EAAE,QAAQ;;AAKvD,SAAgB,YACd,OACA,QAC2E;CAC3E,MAAM,aAAa,gBAAgB,MAAM;CACzC,MAAM,aAAa,OAAO,KAAK,OAAO,MAAM;CAE5C,MAAM,SAAS,EAAE;AACjB,MAAK,MAAM,OAAO,WAChB,KAAI,OAAO,WACR,QAAe,OAAO,WAAW;AAItC,QAAO;;AAGT,SAAgB,iBACd,OACA,SACgD;CAChD,MAAM,aAAa,gBAAgB,MAAM;CACzC,MAAM,SAAS,EAAE;AACjB,MAAK,MAAM,OAAO,QAChB,KAAI,OAAO,WACT,QAAO,OAAO,WAAW;AAG7B,QAAO;;AAGT,SAAgB,iBACd,OACA,SACgD;CAChD,MAAM,aAAa,gBAAgB,MAAM;CACzC,MAAM,gBAAgB,IAAI,IAAI,QAA6B;CAC3D,MAAM,kBAAkB,OAAO,QAAQ,WAAW,CAAC,QAAQ,CAAC,SAAS,CAAC,cAAc,IAAI,IAAI,CAAC;AAC7F,QAAO,OAAO,YAAY,gBAAgB;;AAgC5C,SAAgB,gBACd,OACA,SAGuC;AACvC,KAAI,SAAS;AACX,MAAI,UAAU,WAAW,QAAQ,KAC/B,QAAO;GACL,SAAS,iBAAiB,OAAO,QAAQ,KAAK;GAC9C,QAAQ,gBAAgB,OAAO,QAAQ,KAAK;GAC7C;AAEH,MAAI,UAAU,WAAW,QAAQ,KAC/B,QAAO;GACL,SAAS,iBAAiB,OAAO,QAAQ,KAAK;GAC9C,QAAQ,gBAAgB,OAAO,QAAQ,KAAK;GAC7C;;AAGL,QAAO;EAAE,SAAS,gBAAgB,MAAM;EAAE,QAAQ,wBAAwB,MAAM;EAAE;;AAGpF,SAAgB,kBAUd,MACA,QACA,aAKA;AACA,QAAO;EACL,QAAQ,OAAO,YAAY,OAAO,QAAQ,KAAK,CAAC,KAAK,CAAC,KAAK,SAAS,CAAC,KAAK,IAAI,QAAQ,CAAC,CAAC;EAGxF;EACA;EACD;;AAGH,MAAa,aAAa,EAAE,OAAO,EACjC,IAAI,EAAE,MAAM,EACb,CAAC;AAEF,MAAa,iBAAiB,EAAE,OAAO,EACrC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,EACvB,CAAC;AAEF,MAAa,iBAAiB,EAAE,OAAO,EACrC,OAAO,EAAE,QAAQ,EAClB,CAAC;AAEF,MAAa,qBAAqB,EAAE,OAAO,EACzC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,EAC5B,CAAC;AAEF,MAAa,eAAe;AAE5B,MAAa,mBAAmB"}

package/dist/src/modules/base/base.grants.d.mts

@@ -0,0 +1,28 @@
+import { ServerResultAsync } from "./base.dto.mjs";
+import { ServiceActor } from "./base.actor.mjs";
+
+//#region src/modules/base/base.grants.d.ts
+type Level = "user" | "team" | "organization";
+type Access = "all" | "own";
+type Entity = Partial<{
+  userId: string | null;
+  teamId: string | null;
+  organizationId: string | null;
+}>;
+type Grant = {
+  level: Level;
+  role: string;
+  action: string;
+  resource: string;
+  access: Access;
+  attributes?: string[];
+};
+type NestedGrants = Record<string, Partial<Record<Level, Record<string, Record<string, Access>>>>>;
+type ResourceGrant = Omit<Grant, "resource">;
+type ResourceActionGrant = Omit<ResourceGrant, "action">;
+declare function flattenNestedGrants(nestedGrants: NestedGrants): Grant[];
+declare function checkPermissionSync<T extends Entity>(actor: ServiceActor, grants: ResourceActionGrant[], entities?: T | T[]): boolean;
+declare function checkPermissionAsync<T extends Entity>(actor: ServiceActor, grants: ResourceActionGrant[], getEntities: () => ServerResultAsync<T | T[] | undefined>): ServerResultAsync<boolean>;
+//#endregion
+export { Entity, Grant, NestedGrants, ResourceActionGrant, ResourceGrant, checkPermissionAsync, checkPermissionSync, flattenNestedGrants };
+//# sourceMappingURL=base.grants.d.mts.map