@m5kdev/backend 0.8.7 → 0.8.8

package/dist/src/modules/base/base.procedure.cjs

@@ -0,0 +1,255 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+require("../../../_virtual/_rolldown/runtime.cjs");
+const require_src_modules_base_base_actor = require("./base.actor.cjs");
+let neverthrow = require("neverthrow");
+//#region src/modules/base/base.procedure.ts
+const DEFAULT_CONTEXT_FILTER_INCLUDE = ["user"];
+function isServerResult(value) {
+	return typeof value === "object" && value !== null && "isErr" in value && typeof value.isErr === "function" && "isOk" in value && typeof value.isOk === "function";
+}
+async function normalizeProcedureResult(result) {
+	const resolved = await result;
+	return isServerResult(resolved) ? resolved : (0, neverthrow.ok)(resolved);
+}
+function assertUniqueStepName(steps, stepName) {
+	if (steps.some((step) => step.stepName === stepName)) throw new Error(`Duplicate service procedure step name: ${stepName}`);
+}
+function hasStepName(steps, stepName) {
+	return steps.some((step) => step.stepName === stepName);
+}
+function getContextFilterInclude(include = DEFAULT_CONTEXT_FILTER_INCLUDE) {
+	return {
+		user: include.includes("user"),
+		organization: include.includes("organization"),
+		team: include.includes("team")
+	};
+}
+function getFailureStage(code) {
+	return code === "FORBIDDEN" || code === "UNAUTHORIZED" ? "forbidden" : "error";
+}
+function logProcedureStage(host, procedureName, ctx, stage, { stepName, durationMs, errorCode } = {}) {
+	host.logger.debug({
+		procedureName,
+		stage,
+		stepName,
+		durationMs,
+		errorCode,
+		hasActor: Boolean(ctx.actor)
+	});
+}
+function requireProcedureActor(host, ctx, scope) {
+	if (!ctx.actor) return host.error("UNAUTHORIZED", "Unauthorized");
+	if (!require_src_modules_base_base_actor.validateActor(ctx.actor, scope)) return host.error("FORBIDDEN", "Forbidden");
+	return (0, neverthrow.ok)(ctx.actor);
+}
+function createRequireAuthStep(host, scope = "user") {
+	return {
+		stage: "auth",
+		stepName: "auth",
+		run: async ({ ctx }) => {
+			return requireProcedureActor(host, ctx, scope);
+		}
+	};
+}
+function createUseStep(stepName, step) {
+	return {
+		stage: "use",
+		stepName,
+		run: async (args) => normalizeProcedureResult(step(args))
+	};
+}
+function createInputStep(stepName, step) {
+	return {
+		stage: "input",
+		stepName,
+		run: async (args) => normalizeProcedureResult(step(args))
+	};
+}
+function createContextFilterStep(host, include) {
+	const contextInclude = getContextFilterInclude(include);
+	const requiredScope = contextInclude.team ? "team" : contextInclude.organization ? "organization" : "user";
+	return {
+		stage: "input",
+		stepName: "contextFilter",
+		run: async ({ input, ctx }) => {
+			const actor = requireProcedureActor(host, ctx, requiredScope);
+			if (actor.isErr()) return actor;
+			return (0, neverthrow.ok)(host.addContextFilter(actor.value, contextInclude, input));
+		}
+	};
+}
+function createAccessStep(host, config) {
+	return {
+		stage: "access",
+		stepName: "access",
+		run: async (args) => {
+			const typedArgs = args;
+			const actor = requireProcedureActor(host, typedArgs.ctx, "user");
+			if (actor.isErr()) return actor;
+			if ("entityStep" in config && typeof config.entityStep === "string") {
+				const entities = typedArgs.state[config.entityStep];
+				if (!host.checkPermission(actor.value, config.action, entities, config.grants)) return host.error("FORBIDDEN");
+				return (0, neverthrow.ok)(entities);
+			}
+			if (typeof config.entities === "function") {
+				const resolveEntities = config.entities;
+				let loadedEntities;
+				const permission = await host.checkPermissionAsync(actor.value, config.action, async () => {
+					const entityResult = await normalizeProcedureResult(resolveEntities(typedArgs));
+					if (entityResult.isOk()) loadedEntities = entityResult.value;
+					return entityResult;
+				}, config.grants);
+				if (permission.isErr()) return permission;
+				if (!permission.value) return host.error("FORBIDDEN");
+				return (0, neverthrow.ok)(loadedEntities);
+			}
+			const entities = config.entities;
+			if (!host.checkPermission(actor.value, config.action, entities, config.grants)) return host.error("FORBIDDEN");
+			return (0, neverthrow.ok)(entities);
+		}
+	};
+}
+function createProcedureHandler(host, config, handler) {
+	return async (input, ctx) => host.throwableAsync(async () => {
+		const state = {};
+		const startTime = Date.now();
+		const typedCtx = ctx;
+		let currentInput = input;
+		logProcedureStage(host, config.name, typedCtx, "start");
+		try {
+			for (const step of config.steps) {
+				const stepResult = await step.run({
+					input: currentInput,
+					ctx: typedCtx,
+					state,
+					repository: host.repository,
+					service: host.service,
+					logger: host.logger
+				});
+				if (stepResult.isErr()) {
+					logProcedureStage(host, config.name, typedCtx, getFailureStage(stepResult.error.code), {
+						stepName: step.stepName,
+						durationMs: Date.now() - startTime,
+						errorCode: stepResult.error.code
+					});
+					return stepResult;
+				}
+				state[step.stepName] = stepResult.value;
+				if (step.stage === "input") currentInput = stepResult.value;
+				if (step.stage === "auth") logProcedureStage(host, config.name, typedCtx, "auth_passed", { stepName: step.stepName });
+				if (step.stage === "access") logProcedureStage(host, config.name, typedCtx, "access_passed", { stepName: step.stepName });
+			}
+			const handlerResult = await normalizeProcedureResult(handler({
+				input: currentInput,
+				ctx,
+				state,
+				repository: host.repository,
+				service: host.service,
+				logger: host.logger
+			}));
+			if (handlerResult.isErr()) {
+				logProcedureStage(host, config.name, typedCtx, getFailureStage(handlerResult.error.code), {
+					durationMs: Date.now() - startTime,
+					errorCode: handlerResult.error.code
+				});
+				return handlerResult;
+			}
+			logProcedureStage(host, config.name, typedCtx, "success", { durationMs: Date.now() - startTime });
+			return handlerResult;
+		} catch (error) {
+			const serverError = host.handleUnknownError(error);
+			logProcedureStage(host, config.name, typedCtx, getFailureStage(serverError.code), {
+				durationMs: Date.now() - startTime,
+				errorCode: serverError.code
+			});
+			throw error;
+		}
+	});
+}
+function createServiceProcedureBuilder(host, config) {
+	function addContextFilter(include) {
+		const steps = hasStepName(config.steps, "auth") ? config.steps : [...config.steps, createRequireAuthStep(host, "user")];
+		assertUniqueStepName(steps, "contextFilter");
+		return createServiceProcedureBuilder(host, {
+			...config,
+			steps: [...steps, createContextFilterStep(host, include)]
+		});
+	}
+	return {
+		use(stepName, step) {
+			assertUniqueStepName(config.steps, stepName);
+			return createServiceProcedureBuilder(host, {
+				...config,
+				steps: [...config.steps, createUseStep(stepName, step)]
+			});
+		},
+		mapInput(stepName, step) {
+			assertUniqueStepName(config.steps, stepName);
+			return createServiceProcedureBuilder(host, {
+				...config,
+				steps: [...config.steps, createInputStep(stepName, step)]
+			});
+		},
+		addContextFilter,
+		requireAuth(scope) {
+			assertUniqueStepName(config.steps, "auth");
+			return createServiceProcedureBuilder(host, {
+				...config,
+				steps: [...config.steps, createRequireAuthStep(host, scope ?? "user")]
+			});
+		},
+		handle(handler) {
+			return createProcedureHandler(host, config, handler);
+		}
+	};
+}
+function createPermissionServiceProcedureBuilder(host, config) {
+	function addContextFilter(include) {
+		const steps = hasStepName(config.steps, "auth") ? config.steps : [...config.steps, createRequireAuthStep(host, "user")];
+		assertUniqueStepName(steps, "contextFilter");
+		return createPermissionServiceProcedureBuilder(host, {
+			...config,
+			steps: [...steps, createContextFilterStep(host, include)]
+		});
+	}
+	function access(accessConfig) {
+		assertUniqueStepName(config.steps, "access");
+		return createPermissionServiceProcedureBuilder(host, {
+			...config,
+			steps: [...config.steps, createAccessStep(host, accessConfig)]
+		});
+	}
+	return {
+		use(stepName, step) {
+			assertUniqueStepName(config.steps, stepName);
+			return createPermissionServiceProcedureBuilder(host, {
+				...config,
+				steps: [...config.steps, createUseStep(stepName, step)]
+			});
+		},
+		mapInput(stepName, step) {
+			assertUniqueStepName(config.steps, stepName);
+			return createPermissionServiceProcedureBuilder(host, {
+				...config,
+				steps: [...config.steps, createInputStep(stepName, step)]
+			});
+		},
+		addContextFilter,
+		requireAuth(scope) {
+			assertUniqueStepName(config.steps, "auth");
+			return createPermissionServiceProcedureBuilder(host, {
+				...config,
+				steps: [...config.steps, createRequireAuthStep(host, scope ?? "user")]
+			});
+		},
+		access,
+		handle(handler) {
+			return createProcedureHandler(host, config, handler);
+		}
+	};
+}
+//#endregion
+exports.createPermissionServiceProcedureBuilder = createPermissionServiceProcedureBuilder;
+exports.createServiceProcedureBuilder = createServiceProcedureBuilder;
+
+//# sourceMappingURL=base.procedure.cjs.map

package/dist/src/modules/base/base.procedure.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"base.procedure.cjs","names":["validateActor"],"sources":["../../../../src/modules/base/base.procedure.ts"],"sourcesContent":["import type { QueryInput } from \"@m5kdev/commons/modules/schemas/query.schema\";\r\nimport type { TRPC_ERROR_CODE_KEY } from \"@trpc/server\";\r\nimport { ok } from \"neverthrow\";\r\nimport type { ServerError } from \"../../utils/errors\";\r\nimport type { logger } from \"../../utils/logger\";\r\nimport type { Base } from \"./base.abstract\";\r\nimport { type Actor, type ActorScope, type AuthenticatedActor, validateActor } from \"./base.actor\";\r\nimport type { ServerResult, ServerResultAsync } from \"./base.dto\";\r\nimport type { Entity, ResourceActionGrant } from \"./base.grants\";\r\n\r\ntype ServiceLogger = ReturnType<typeof logger.child>;\r\ntype RepositoryMap = Record<string, Base>;\r\ntype ServiceMap = Record<string, Base>;\r\n\r\nexport type ServiceProcedureContext = {\r\n  actor?: AuthenticatedActor | null;\r\n} & Record<string, unknown>;\r\n\r\nexport type ServiceProcedureState = Record<string, unknown>;\r\nexport type ServiceProcedureStoredValue<T> = [T] extends [undefined] ? undefined : Awaited<T>;\r\nexport type ServiceProcedureResultLike<T> = T | ServerResult<T> | Promise<T | ServerResult<T>>;\r\nexport type ServiceProcedureContextFilterScope = ActorScope;\r\nexport type ServiceProcedureContextFilteredInput<TInput> = Extract<NonNullable<TInput>, QueryInput>;\r\ntype ServiceProcedureAuthContext<Scope extends ActorScope> = {\r\n  actor: Actor[Scope];\r\n};\r\ntype ServiceProcedureRequiredScopeFromFilter<\r\n  TInclude extends readonly ServiceProcedureContextFilterScope[] | undefined,\r\n> = TInclude extends readonly ServiceProcedureContextFilterScope[]\r\n  ? \"team\" extends TInclude[number]\r\n    ? \"team\"\r\n    : \"organization\" extends TInclude[number]\r\n      ? \"organization\"\r\n      : \"user\"\r\n  : \"user\";\r\n\r\nexport type ServiceProcedure<TInput, TCtx extends ServiceProcedureContext, TOutput> = (\r\n  input: TInput,\r\n  ctx: TCtx\r\n) => ServerResultAsync<TOutput>;\r\n\r\nexport type ServiceProcedureArgs<\r\n  TInput,\r\n  TCtx extends ServiceProcedureContext,\r\n  Repositories extends RepositoryMap,\r\n  Services extends ServiceMap,\r\n  State extends ServiceProcedureState,\r\n> = {\r\n  input: TInput;\r\n  ctx: TCtx;\r\n  state: State;\r\n  repository: Repositories;\r\n  service: Services;\r\n  logger: ServiceLogger;\r\n};\r\n\r\nexport type ServiceProcedureStep<\r\n  TInput,\r\n  TCtx extends ServiceProcedureContext,\r\n  Repositories extends RepositoryMap,\r\n  Services extends ServiceMap,\r\n  State extends ServiceProcedureState,\r\n  TOutput = undefined,\r\n> = (\r\n  args: ServiceProcedureArgs<TInput, TCtx, Repositories, Services, State>\r\n) => ServiceProcedureResultLike<ServiceProcedureStoredValue<TOutput>>;\r\n\r\nexport type ServiceProcedureInputMapper<\r\n  TInput,\r\n  TCtx extends ServiceProcedureContext,\r\n  Repositories extends RepositoryMap,\r\n  Services extends ServiceMap,\r\n  State extends ServiceProcedureState,\r\n  TNextInput,\r\n> = (\r\n  args: ServiceProcedureArgs<TInput, TCtx, Repositories, Services, State>\r\n) => ServiceProcedureResultLike<ServiceProcedureStoredValue<TNextInput>>;\r\n\r\nexport type ServiceProcedureHandler<\r\n  TInput,\r\n  TCtx extends ServiceProcedureContext,\r\n  Repositories extends RepositoryMap,\r\n  Services extends ServiceMap,\r\n  State extends ServiceProcedureState,\r\n  TOutput,\r\n> = (\r\n  args: ServiceProcedureArgs<TInput, TCtx, Repositories, Services, State>\r\n) => ServiceProcedureResultLike<TOutput>;\r\n\r\nexport type ServiceProcedureEntityResolver<\r\n  TInput,\r\n  TCtx extends ServiceProcedureContext,\r\n  Repositories extends RepositoryMap,\r\n  Services extends ServiceMap,\r\n  State extends ServiceProcedureState,\r\n  TEntities extends Entity | Entity[] | undefined,\r\n> =\r\n  | TEntities\r\n  | ((\r\n      args: ServiceProcedureArgs<TInput, TCtx, Repositories, Services, State>\r\n    ) => ServiceProcedureResultLike<TEntities>);\r\n\r\ntype ServiceProcedureAccessBaseConfig = {\r\n  action: string;\r\n  grants?: ResourceActionGrant[];\r\n};\r\n\r\nexport type ServiceProcedureEntityStepName<State extends ServiceProcedureState> = Extract<\r\n  {\r\n    [Key in keyof State]: State[Key] extends Entity | Entity[] | undefined ? Key : never;\r\n  }[keyof State],\r\n  string\r\n>;\r\n\r\nexport type ServiceProcedureAccessEntitiesConfig<\r\n  TInput,\r\n  TCtx extends ServiceProcedureContext,\r\n  Repositories extends RepositoryMap,\r\n  Services extends ServiceMap,\r\n  State extends ServiceProcedureState,\r\n  TEntities extends Entity | Entity[] | undefined = undefined,\r\n> = ServiceProcedureAccessBaseConfig & {\r\n  entities?: ServiceProcedureEntityResolver<TInput, TCtx, Repositories, Services, State, TEntities>;\r\n  entityStep?: never;\r\n};\r\n\r\nexport type ServiceProcedureAccessStateConfig<\r\n  State extends ServiceProcedureState,\r\n  StepName extends ServiceProcedureEntityStepName<State>,\r\n> = ServiceProcedureAccessBaseConfig & {\r\n  entityStep: StepName;\r\n  entities?: never;\r\n};\r\n\r\nexport type ServiceProcedureAccessConfig<\r\n  TInput,\r\n  TCtx extends ServiceProcedureContext,\r\n  Repositories extends RepositoryMap,\r\n  Services extends ServiceMap,\r\n  State extends ServiceProcedureState,\r\n  TEntities extends Entity | Entity[] | undefined = undefined,\r\n> =\r\n  | ServiceProcedureAccessEntitiesConfig<TInput, TCtx, Repositories, Services, State, TEntities>\r\n  | ServiceProcedureAccessStateConfig<State, ServiceProcedureEntityStepName<State>>;\r\n\r\nexport interface ServiceProcedureBuilder<\r\n  TInput,\r\n  TCtx extends ServiceProcedureContext,\r\n  Repositories extends RepositoryMap,\r\n  Services extends ServiceMap,\r\n  State extends ServiceProcedureState = Record<string, never>,\r\n> {\r\n  use<StepName extends string, TOutput = void>(\r\n    stepName: StepName,\r\n    step: ServiceProcedureStep<TInput, TCtx, Repositories, Services, State, TOutput>\r\n  ): ServiceProcedureBuilder<\r\n    TInput,\r\n    TCtx,\r\n    Repositories,\r\n    Services,\r\n    State & Record<StepName, ServiceProcedureStoredValue<TOutput>>\r\n  >;\r\n  mapInput<StepName extends string, TNextInput>(\r\n    stepName: StepName,\r\n    step: ServiceProcedureInputMapper<TInput, TCtx, Repositories, Services, State, TNextInput>\r\n  ): ServiceProcedureBuilder<\r\n    ServiceProcedureStoredValue<TNextInput>,\r\n    TCtx,\r\n    Repositories,\r\n    Services,\r\n    State & Record<StepName, ServiceProcedureStoredValue<TNextInput>>\r\n  >;\r\n  addContextFilter<\r\n    TInclude extends readonly ServiceProcedureContextFilterScope[] | undefined = undefined,\r\n  >(\r\n    include?: TInclude\r\n  ): ServiceProcedureBuilder<\r\n    ServiceProcedureContextFilteredInput<TInput>,\r\n    TCtx & ServiceProcedureAuthContext<ServiceProcedureRequiredScopeFromFilter<TInclude>>,\r\n    Repositories,\r\n    Services,\r\n    State & { contextFilter: ServiceProcedureContextFilteredInput<TInput> }\r\n  >;\r\n  requireAuth<Scope extends ActorScope = \"user\">(\r\n    scope?: Scope\r\n  ): ServiceProcedureBuilder<\r\n    TInput,\r\n    TCtx & ServiceProcedureAuthContext<Scope>,\r\n    Repositories,\r\n    Services,\r\n    State\r\n  >;\r\n  handle<TOutput>(\r\n    handler: ServiceProcedureHandler<TInput, TCtx, Repositories, Services, State, TOutput>\r\n  ): ServiceProcedure<TInput, TCtx, TOutput>;\r\n}\r\n\r\nexport interface PermissionServiceProcedureBuilder<\r\n  TInput,\r\n  TCtx extends ServiceProcedureContext,\r\n  Repositories extends RepositoryMap,\r\n  Services extends ServiceMap,\r\n  State extends ServiceProcedureState = Record<string, never>,\r\n> extends ServiceProcedureBuilder<TInput, TCtx, Repositories, Services, State> {\r\n  use<StepName extends string, TOutput = void>(\r\n    stepName: StepName,\r\n    step: ServiceProcedureStep<TInput, TCtx, Repositories, Services, State, TOutput>\r\n  ): PermissionServiceProcedureBuilder<\r\n    TInput,\r\n    TCtx,\r\n    Repositories,\r\n    Services,\r\n    State & Record<StepName, ServiceProcedureStoredValue<TOutput>>\r\n  >;\r\n  mapInput<StepName extends string, TNextInput>(\r\n    stepName: StepName,\r\n    step: ServiceProcedureInputMapper<TInput, TCtx, Repositories, Services, State, TNextInput>\r\n  ): PermissionServiceProcedureBuilder<\r\n    ServiceProcedureStoredValue<TNextInput>,\r\n    TCtx,\r\n    Repositories,\r\n    Services,\r\n    State & Record<StepName, ServiceProcedureStoredValue<TNextInput>>\r\n  >;\r\n  addContextFilter<\r\n    TInclude extends readonly ServiceProcedureContextFilterScope[] | undefined = undefined,\r\n  >(\r\n    include?: TInclude\r\n  ): PermissionServiceProcedureBuilder<\r\n    ServiceProcedureContextFilteredInput<TInput>,\r\n    TCtx & ServiceProcedureAuthContext<ServiceProcedureRequiredScopeFromFilter<TInclude>>,\r\n    Repositories,\r\n    Services,\r\n    State & { contextFilter: ServiceProcedureContextFilteredInput<TInput> }\r\n  >;\r\n  requireAuth<Scope extends ActorScope = \"user\">(\r\n    scope?: Scope\r\n  ): PermissionServiceProcedureBuilder<\r\n    TInput,\r\n    TCtx & ServiceProcedureAuthContext<Scope>,\r\n    Repositories,\r\n    Services,\r\n    State\r\n  >;\r\n  access(\r\n    config: ServiceProcedureAccessEntitiesConfig<TInput, TCtx, Repositories, Services, State>\r\n  ): PermissionServiceProcedureBuilder<\r\n    TInput,\r\n    TCtx & ServiceProcedureAuthContext<\"user\">,\r\n    Repositories,\r\n    Services,\r\n    State\r\n  >;\r\n  access<TEntities extends Entity | Entity[] | undefined>(\r\n    config: ServiceProcedureAccessEntitiesConfig<\r\n      TInput,\r\n      TCtx,\r\n      Repositories,\r\n      Services,\r\n      State,\r\n      TEntities\r\n    >\r\n  ): PermissionServiceProcedureBuilder<\r\n    TInput,\r\n    TCtx & ServiceProcedureAuthContext<\"user\">,\r\n    Repositories,\r\n    Services,\r\n    State & { access: TEntities }\r\n  >;\r\n  access<StepName extends ServiceProcedureEntityStepName<State>>(\r\n    config: ServiceProcedureAccessStateConfig<State, StepName>\r\n  ): PermissionServiceProcedureBuilder<\r\n    TInput,\r\n    TCtx & ServiceProcedureAuthContext<\"user\">,\r\n    Repositories,\r\n    Services,\r\n    State & { access: State[StepName] }\r\n  >;\r\n}\r\n\r\ntype BaseServiceProcedureHost<Repositories extends RepositoryMap, Services extends ServiceMap> = {\r\n  repository: Repositories;\r\n  service: Services;\r\n  logger: ServiceLogger;\r\n  addContextFilter(\r\n    actor: AuthenticatedActor,\r\n    include?: { user?: boolean; organization?: boolean; team?: boolean },\r\n    query?: QueryInput\r\n  ): QueryInput;\r\n  error(\r\n    code: TRPC_ERROR_CODE_KEY,\r\n    message?: string,\r\n    options?: { cause?: unknown; clientMessage?: string; log?: boolean }\r\n  ): ServerResult<never>;\r\n  throwableAsync<T>(fn: () => ServerResultAsync<T>): ServerResultAsync<T>;\r\n  handleUnknownError(error: unknown): ServerError;\r\n};\r\n\r\ntype PermissionServiceProcedureHost<\r\n  Repositories extends RepositoryMap,\r\n  Services extends ServiceMap,\r\n> = BaseServiceProcedureHost<Repositories, Services> & {\r\n  checkPermission<T extends Entity>(\r\n    actor: AuthenticatedActor,\r\n    action: string,\r\n    entities?: T | T[],\r\n    grants?: ResourceActionGrant[]\r\n  ): boolean;\r\n  checkPermissionAsync<T extends Entity>(\r\n    actor: AuthenticatedActor,\r\n    action: string,\r\n    getEntities: () => ServerResultAsync<T | T[] | undefined>,\r\n    grants?: ResourceActionGrant[]\r\n  ): ServerResultAsync<boolean>;\r\n};\r\n\r\ntype ProcedureStage = \"start\" | \"auth_passed\" | \"access_passed\" | \"forbidden\" | \"success\" | \"error\";\r\n\r\ntype ProcedureRuntimeStep<Repositories extends RepositoryMap, Services extends ServiceMap> = {\r\n  stage: \"use\" | \"input\" | \"auth\" | \"access\";\r\n  stepName: string;\r\n  run: (\r\n    args: ServiceProcedureArgs<\r\n      unknown,\r\n      ServiceProcedureContext,\r\n      Repositories,\r\n      Services,\r\n      ServiceProcedureState\r\n    >\r\n  ) => Promise<ServerResult<unknown>>;\r\n};\r\n\r\ntype ProcedureBuilderConfig<Repositories extends RepositoryMap, Services extends ServiceMap> = {\r\n  name: string;\r\n  steps: ProcedureRuntimeStep<Repositories, Services>[];\r\n};\r\n\r\nconst DEFAULT_CONTEXT_FILTER_INCLUDE = [\r\n  \"user\",\r\n] as const satisfies readonly ServiceProcedureContextFilterScope[];\r\n\r\nfunction isServerResult<T>(value: unknown): value is ServerResult<T> {\r\n  return (\r\n    typeof value === \"object\" &&\r\n    value !== null &&\r\n    \"isErr\" in value &&\r\n    typeof (value as { isErr: unknown }).isErr === \"function\" &&\r\n    \"isOk\" in value &&\r\n    typeof (value as { isOk: unknown }).isOk === \"function\"\r\n  );\r\n}\r\n\r\nasync function normalizeProcedureResult<T>(\r\n  result: ServiceProcedureResultLike<T>\r\n): Promise<ServerResult<T>> {\r\n  const resolved = await result;\r\n  return isServerResult<T>(resolved) ? resolved : ok(resolved);\r\n}\r\n\r\nfunction assertUniqueStepName<Repositories extends RepositoryMap, Services extends ServiceMap>(\r\n  steps: ProcedureRuntimeStep<Repositories, Services>[],\r\n  stepName: string\r\n) {\r\n  if (steps.some((step) => step.stepName === stepName)) {\r\n    throw new Error(`Duplicate service procedure step name: ${stepName}`);\r\n  }\r\n}\r\n\r\nfunction hasStepName<Repositories extends RepositoryMap, Services extends ServiceMap>(\r\n  steps: ProcedureRuntimeStep<Repositories, Services>[],\r\n  stepName: string\r\n) {\r\n  return steps.some((step) => step.stepName === stepName);\r\n}\r\n\r\nfunction getContextFilterInclude(\r\n  include: readonly ServiceProcedureContextFilterScope[] = DEFAULT_CONTEXT_FILTER_INCLUDE\r\n) {\r\n  return {\r\n    user: include.includes(\"user\"),\r\n    organization: include.includes(\"organization\"),\r\n    team: include.includes(\"team\"),\r\n  };\r\n}\r\n\r\nfunction getFailureStage(code: TRPC_ERROR_CODE_KEY | undefined): ProcedureStage {\r\n  return code === \"FORBIDDEN\" || code === \"UNAUTHORIZED\" ? \"forbidden\" : \"error\";\r\n}\r\n\r\nfunction logProcedureStage<Repositories extends RepositoryMap, Services extends ServiceMap>(\r\n  host: BaseServiceProcedureHost<Repositories, Services>,\r\n  procedureName: string,\r\n  ctx: ServiceProcedureContext,\r\n  stage: ProcedureStage,\r\n  {\r\n    stepName,\r\n    durationMs,\r\n    errorCode,\r\n  }: {\r\n    stepName?: string;\r\n    durationMs?: number;\r\n    errorCode?: TRPC_ERROR_CODE_KEY;\r\n  } = {}\r\n) {\r\n  host.logger.debug({\r\n    procedureName,\r\n    stage,\r\n    stepName,\r\n    durationMs,\r\n    errorCode,\r\n    hasActor: Boolean(ctx.actor),\r\n  });\r\n}\r\n\r\nfunction requireProcedureActor<\r\n  Scope extends ActorScope,\r\n  Repositories extends RepositoryMap,\r\n  Services extends ServiceMap,\r\n>(\r\n  host: BaseServiceProcedureHost<Repositories, Services>,\r\n  ctx: ServiceProcedureContext,\r\n  scope: Scope\r\n): ServerResult<Actor[Scope]> {\r\n  if (!ctx.actor) {\r\n    return host.error(\"UNAUTHORIZED\", \"Unauthorized\");\r\n  }\r\n\r\n  if (!validateActor(ctx.actor, scope)) {\r\n    return host.error(\"FORBIDDEN\", \"Forbidden\");\r\n  }\r\n\r\n  return ok(ctx.actor as Actor[Scope]);\r\n}\r\n\r\nfunction createRequireAuthStep<Repositories extends RepositoryMap, Services extends ServiceMap>(\r\n  host: BaseServiceProcedureHost<Repositories, Services>,\r\n  scope: ActorScope = \"user\"\r\n): ProcedureRuntimeStep<Repositories, Services> {\r\n  return {\r\n    stage: \"auth\",\r\n    stepName: \"auth\",\r\n    run: async ({ ctx }) => {\r\n      return requireProcedureActor(host, ctx, scope);\r\n    },\r\n  };\r\n}\r\n\r\nfunction createUseStep<\r\n  TInput,\r\n  TCtx extends ServiceProcedureContext,\r\n  Repositories extends RepositoryMap,\r\n  Services extends ServiceMap,\r\n  State extends ServiceProcedureState,\r\n  TOutput,\r\n>(\r\n  stepName: string,\r\n  step: ServiceProcedureStep<TInput, TCtx, Repositories, Services, State, TOutput>\r\n): ProcedureRuntimeStep<Repositories, Services> {\r\n  return {\r\n    stage: \"use\",\r\n    stepName,\r\n    run: async (args) =>\r\n      normalizeProcedureResult(\r\n        step(args as ServiceProcedureArgs<TInput, TCtx, Repositories, Services, State>)\r\n      ),\r\n  };\r\n}\r\n\r\nfunction createInputStep<\r\n  TInput,\r\n  TCtx extends ServiceProcedureContext,\r\n  Repositories extends RepositoryMap,\r\n  Services extends ServiceMap,\r\n  State extends ServiceProcedureState,\r\n  TNextInput,\r\n>(\r\n  stepName: string,\r\n  step: ServiceProcedureInputMapper<TInput, TCtx, Repositories, Services, State, TNextInput>\r\n): ProcedureRuntimeStep<Repositories, Services> {\r\n  return {\r\n    stage: \"input\",\r\n    stepName,\r\n    run: async (args) =>\r\n      normalizeProcedureResult(\r\n        step(args as ServiceProcedureArgs<TInput, TCtx, Repositories, Services, State>)\r\n      ),\r\n  };\r\n}\r\n\r\nfunction createContextFilterStep<Repositories extends RepositoryMap, Services extends ServiceMap>(\r\n  host: BaseServiceProcedureHost<Repositories, Services>,\r\n  include?: readonly ServiceProcedureContextFilterScope[]\r\n): ProcedureRuntimeStep<Repositories, Services> {\r\n  const contextInclude = getContextFilterInclude(include);\r\n  const requiredScope: ActorScope = contextInclude.team\r\n    ? \"team\"\r\n    : contextInclude.organization\r\n      ? \"organization\"\r\n      : \"user\";\r\n\r\n  return {\r\n    stage: \"input\",\r\n    stepName: \"contextFilter\",\r\n    run: async ({ input, ctx }) => {\r\n      const actor = requireProcedureActor(host, ctx, requiredScope);\r\n      if (actor.isErr()) return actor;\r\n      return ok(host.addContextFilter(actor.value, contextInclude, input as QueryInput));\r\n    },\r\n  };\r\n}\r\n\r\nfunction createAccessStep<\r\n  TInput,\r\n  TCtx extends ServiceProcedureContext,\r\n  Repositories extends RepositoryMap,\r\n  Services extends ServiceMap,\r\n  State extends ServiceProcedureState,\r\n  TEntities extends Entity | Entity[] | undefined,\r\n>(\r\n  host: PermissionServiceProcedureHost<Repositories, Services>,\r\n  config: ServiceProcedureAccessConfig<TInput, TCtx, Repositories, Services, State, TEntities>\r\n): ProcedureRuntimeStep<Repositories, Services> {\r\n  return {\r\n    stage: \"access\",\r\n    stepName: \"access\",\r\n    run: async (args) => {\r\n      const typedArgs = args as ServiceProcedureArgs<TInput, TCtx, Repositories, Services, State>;\r\n      const actor = requireProcedureActor(host, typedArgs.ctx, \"user\");\r\n      if (actor.isErr()) return actor;\r\n\r\n      if (\"entityStep\" in config && typeof config.entityStep === \"string\") {\r\n        const entities = typedArgs.state[config.entityStep] as TEntities;\r\n        const hasPermission = host.checkPermission(\r\n          actor.value,\r\n          config.action,\r\n          entities as Entity | Entity[] | undefined,\r\n          config.grants\r\n        );\r\n\r\n        if (!hasPermission) {\r\n          return host.error(\"FORBIDDEN\");\r\n        }\r\n\r\n        return ok(entities);\r\n      }\r\n\r\n      if (typeof config.entities === \"function\") {\r\n        const resolveEntities = config.entities as (\r\n          args: ServiceProcedureArgs<TInput, TCtx, Repositories, Services, State>\r\n        ) => ServiceProcedureResultLike<TEntities>;\r\n\r\n        let loadedEntities: TEntities | undefined;\r\n        const permission = await host.checkPermissionAsync(\r\n          actor.value,\r\n          config.action,\r\n          async () => {\r\n            const entityResult = await normalizeProcedureResult(resolveEntities(typedArgs));\r\n            if (entityResult.isOk()) {\r\n              loadedEntities = entityResult.value;\r\n            }\r\n            return entityResult;\r\n          },\r\n          config.grants\r\n        );\r\n\r\n        if (permission.isErr()) {\r\n          return permission;\r\n        }\r\n\r\n        if (!permission.value) {\r\n          return host.error(\"FORBIDDEN\");\r\n        }\r\n\r\n        return ok(loadedEntities);\r\n      }\r\n\r\n      const entities = config.entities;\r\n      const hasPermission = host.checkPermission(\r\n        actor.value,\r\n        config.action,\r\n        entities,\r\n        config.grants\r\n      );\r\n\r\n      if (!hasPermission) {\r\n        return host.error(\"FORBIDDEN\");\r\n      }\r\n\r\n      return ok(entities);\r\n    },\r\n  };\r\n}\r\n\r\nfunction createProcedureHandler<\r\n  TInput,\r\n  TCtx extends ServiceProcedureContext,\r\n  Repositories extends RepositoryMap,\r\n  Services extends ServiceMap,\r\n  State extends ServiceProcedureState,\r\n  TOutput,\r\n>(\r\n  host: BaseServiceProcedureHost<Repositories, Services>,\r\n  config: ProcedureBuilderConfig<Repositories, Services>,\r\n  handler: ServiceProcedureHandler<TInput, TCtx, Repositories, Services, State, TOutput>\r\n): ServiceProcedure<TInput, TCtx, TOutput> {\r\n  return async (input, ctx) =>\r\n    host.throwableAsync(async () => {\r\n      const state: ServiceProcedureState = {};\r\n      const startTime = Date.now();\r\n      const typedCtx = ctx as ServiceProcedureContext;\r\n      let currentInput: unknown = input;\r\n\r\n      logProcedureStage(host, config.name, typedCtx, \"start\");\r\n\r\n      try {\r\n        for (const step of config.steps) {\r\n          const stepResult = await step.run({\r\n            input: currentInput,\r\n            ctx: typedCtx,\r\n            state,\r\n            repository: host.repository,\r\n            service: host.service,\r\n            logger: host.logger,\r\n          });\r\n\r\n          if (stepResult.isErr()) {\r\n            logProcedureStage(host, config.name, typedCtx, getFailureStage(stepResult.error.code), {\r\n              stepName: step.stepName,\r\n              durationMs: Date.now() - startTime,\r\n              errorCode: stepResult.error.code,\r\n            });\r\n            return stepResult as ServerResult<TOutput>;\r\n          }\r\n\r\n          state[step.stepName] = stepResult.value;\r\n\r\n          if (step.stage === \"input\") {\r\n            currentInput = stepResult.value;\r\n          }\r\n\r\n          if (step.stage === \"auth\") {\r\n            logProcedureStage(host, config.name, typedCtx, \"auth_passed\", {\r\n              stepName: step.stepName,\r\n            });\r\n          }\r\n\r\n          if (step.stage === \"access\") {\r\n            logProcedureStage(host, config.name, typedCtx, \"access_passed\", {\r\n              stepName: step.stepName,\r\n            });\r\n          }\r\n        }\r\n\r\n        const handlerResult = await normalizeProcedureResult(\r\n          handler({\r\n            input: currentInput as TInput,\r\n            ctx: ctx as TCtx,\r\n            state: state as State,\r\n            repository: host.repository,\r\n            service: host.service,\r\n            logger: host.logger,\r\n          })\r\n        );\r\n\r\n        if (handlerResult.isErr()) {\r\n          logProcedureStage(\r\n            host,\r\n            config.name,\r\n            typedCtx,\r\n            getFailureStage(handlerResult.error.code),\r\n            {\r\n              durationMs: Date.now() - startTime,\r\n              errorCode: handlerResult.error.code,\r\n            }\r\n          );\r\n          return handlerResult;\r\n        }\r\n\r\n        logProcedureStage(host, config.name, typedCtx, \"success\", {\r\n          durationMs: Date.now() - startTime,\r\n        });\r\n        return handlerResult;\r\n      } catch (error) {\r\n        const serverError = host.handleUnknownError(error);\r\n        logProcedureStage(host, config.name, typedCtx, getFailureStage(serverError.code), {\r\n          durationMs: Date.now() - startTime,\r\n          errorCode: serverError.code,\r\n        });\r\n        throw error;\r\n      }\r\n    });\r\n}\r\n\r\nexport function createServiceProcedureBuilder<\r\n  TInput,\r\n  TCtx extends ServiceProcedureContext,\r\n  Repositories extends RepositoryMap,\r\n  Services extends ServiceMap,\r\n  State extends ServiceProcedureState = Record<string, never>,\r\n>(\r\n  host: BaseServiceProcedureHost<Repositories, Services>,\r\n  config: ProcedureBuilderConfig<Repositories, Services>\r\n): ServiceProcedureBuilder<TInput, TCtx, Repositories, Services, State> {\r\n  function addContextFilter<\r\n    TInclude extends readonly ServiceProcedureContextFilterScope[] | undefined = undefined,\r\n  >(include?: TInclude) {\r\n    const steps = hasStepName(config.steps, \"auth\")\r\n      ? config.steps\r\n      : [...config.steps, createRequireAuthStep(host, \"user\")];\r\n\r\n    assertUniqueStepName(steps, \"contextFilter\");\r\n\r\n    return createServiceProcedureBuilder<\r\n      ServiceProcedureContextFilteredInput<TInput>,\r\n      TCtx & ServiceProcedureAuthContext<ServiceProcedureRequiredScopeFromFilter<TInclude>>,\r\n      Repositories,\r\n      Services,\r\n      State & { contextFilter: ServiceProcedureContextFilteredInput<TInput> }\r\n    >(host, {\r\n      ...config,\r\n      steps: [...steps, createContextFilterStep(host, include)],\r\n    });\r\n  }\r\n\r\n  const builder: ServiceProcedureBuilder<TInput, TCtx, Repositories, Services, State> = {\r\n    use<StepName extends string, TOutput = void>(\r\n      stepName: StepName,\r\n      step: ServiceProcedureStep<TInput, TCtx, Repositories, Services, State, TOutput>\r\n    ) {\r\n      assertUniqueStepName(config.steps, stepName);\r\n      return createServiceProcedureBuilder<\r\n        TInput,\r\n        TCtx,\r\n        Repositories,\r\n        Services,\r\n        State & Record<StepName, ServiceProcedureStoredValue<TOutput>>\r\n      >(host, {\r\n        ...config,\r\n        steps: [...config.steps, createUseStep(stepName, step)],\r\n      });\r\n    },\r\n    mapInput<StepName extends string, TNextInput>(\r\n      stepName: StepName,\r\n      step: ServiceProcedureInputMapper<TInput, TCtx, Repositories, Services, State, TNextInput>\r\n    ) {\r\n      assertUniqueStepName(config.steps, stepName);\r\n      return createServiceProcedureBuilder<\r\n        ServiceProcedureStoredValue<TNextInput>,\r\n        TCtx,\r\n        Repositories,\r\n        Services,\r\n        State & Record<StepName, ServiceProcedureStoredValue<TNextInput>>\r\n      >(host, {\r\n        ...config,\r\n        steps: [...config.steps, createInputStep(stepName, step)],\r\n      });\r\n    },\r\n    addContextFilter,\r\n    requireAuth<Scope extends ActorScope = \"user\">(scope?: Scope) {\r\n      assertUniqueStepName(config.steps, \"auth\");\r\n      return createServiceProcedureBuilder<\r\n        TInput,\r\n        TCtx & ServiceProcedureAuthContext<Scope>,\r\n        Repositories,\r\n        Services,\r\n        State\r\n      >(host, {\r\n        ...config,\r\n        steps: [...config.steps, createRequireAuthStep(host, scope ?? \"user\")],\r\n      });\r\n    },\r\n    handle<TOutput>(\r\n      handler: ServiceProcedureHandler<TInput, TCtx, Repositories, Services, State, TOutput>\r\n    ) {\r\n      return createProcedureHandler(host, config, handler);\r\n    },\r\n  };\r\n\r\n  return builder;\r\n}\r\n\r\nexport function createPermissionServiceProcedureBuilder<\r\n  TInput,\r\n  TCtx extends ServiceProcedureContext,\r\n  Repositories extends RepositoryMap,\r\n  Services extends ServiceMap,\r\n  State extends ServiceProcedureState = Record<string, never>,\r\n>(\r\n  host: PermissionServiceProcedureHost<Repositories, Services>,\r\n  config: ProcedureBuilderConfig<Repositories, Services>\r\n): PermissionServiceProcedureBuilder<TInput, TCtx, Repositories, Services, State> {\r\n  function addContextFilter<\r\n    TInclude extends readonly ServiceProcedureContextFilterScope[] | undefined = undefined,\r\n  >(include?: TInclude) {\r\n    const steps = hasStepName(config.steps, \"auth\")\r\n      ? config.steps\r\n      : [...config.steps, createRequireAuthStep(host, \"user\")];\r\n\r\n    assertUniqueStepName(steps, \"contextFilter\");\r\n\r\n    return createPermissionServiceProcedureBuilder<\r\n      ServiceProcedureContextFilteredInput<TInput>,\r\n      TCtx & ServiceProcedureAuthContext<ServiceProcedureRequiredScopeFromFilter<TInclude>>,\r\n      Repositories,\r\n      Services,\r\n      State & { contextFilter: ServiceProcedureContextFilteredInput<TInput> }\r\n    >(host, {\r\n      ...config,\r\n      steps: [...steps, createContextFilterStep(host, include)],\r\n    });\r\n  }\r\n\r\n  function access(\r\n    accessConfig: ServiceProcedureAccessEntitiesConfig<TInput, TCtx, Repositories, Services, State>\r\n  ): PermissionServiceProcedureBuilder<\r\n    TInput,\r\n    TCtx & ServiceProcedureAuthContext<\"user\">,\r\n    Repositories,\r\n    Services,\r\n    State\r\n  >;\r\n  function access<TEntities extends Entity | Entity[] | undefined>(\r\n    accessConfig: ServiceProcedureAccessEntitiesConfig<\r\n      TInput,\r\n      TCtx,\r\n      Repositories,\r\n      Services,\r\n      State,\r\n      TEntities\r\n    >\r\n  ): PermissionServiceProcedureBuilder<\r\n    TInput,\r\n    TCtx & ServiceProcedureAuthContext<\"user\">,\r\n    Repositories,\r\n    Services,\r\n    State & { access: TEntities }\r\n  >;\r\n  function access<StepName extends ServiceProcedureEntityStepName<State>>(\r\n    accessConfig: ServiceProcedureAccessStateConfig<State, StepName>\r\n  ): PermissionServiceProcedureBuilder<\r\n    TInput,\r\n    TCtx & ServiceProcedureAuthContext<\"user\">,\r\n    Repositories,\r\n    Services,\r\n    State & { access: State[StepName] }\r\n  >;\r\n  function access(\r\n    accessConfig:\r\n      | ServiceProcedureAccessEntitiesConfig<\r\n          TInput,\r\n          TCtx,\r\n          Repositories,\r\n          Services,\r\n          State,\r\n          Entity | Entity[] | undefined\r\n        >\r\n      | ServiceProcedureAccessStateConfig<State, ServiceProcedureEntityStepName<State>>\r\n  ) {\r\n    assertUniqueStepName(config.steps, \"access\");\r\n    return createPermissionServiceProcedureBuilder<\r\n      TInput,\r\n      TCtx & ServiceProcedureAuthContext<\"user\">,\r\n      Repositories,\r\n      Services,\r\n      State\r\n    >(host, {\r\n      ...config,\r\n      steps: [...config.steps, createAccessStep(host, accessConfig)],\r\n    });\r\n  }\r\n\r\n  const builder: PermissionServiceProcedureBuilder<TInput, TCtx, Repositories, Services, State> = {\r\n    use<StepName extends string, TOutput = void>(\r\n      stepName: StepName,\r\n      step: ServiceProcedureStep<TInput, TCtx, Repositories, Services, State, TOutput>\r\n    ) {\r\n      assertUniqueStepName(config.steps, stepName);\r\n      return createPermissionServiceProcedureBuilder<\r\n        TInput,\r\n        TCtx,\r\n        Repositories,\r\n        Services,\r\n        State & Record<StepName, ServiceProcedureStoredValue<TOutput>>\r\n      >(host, {\r\n        ...config,\r\n        steps: [...config.steps, createUseStep(stepName, step)],\r\n      });\r\n    },\r\n    mapInput<StepName extends string, TNextInput>(\r\n      stepName: StepName,\r\n      step: ServiceProcedureInputMapper<TInput, TCtx, Repositories, Services, State, TNextInput>\r\n    ) {\r\n      assertUniqueStepName(config.steps, stepName);\r\n      return createPermissionServiceProcedureBuilder<\r\n        ServiceProcedureStoredValue<TNextInput>,\r\n        TCtx,\r\n        Repositories,\r\n        Services,\r\n        State & Record<StepName, ServiceProcedureStoredValue<TNextInput>>\r\n      >(host, {\r\n        ...config,\r\n        steps: [...config.steps, createInputStep(stepName, step)],\r\n      });\r\n    },\r\n    addContextFilter,\r\n    requireAuth<Scope extends ActorScope = \"user\">(scope?: Scope) {\r\n      assertUniqueStepName(config.steps, \"auth\");\r\n      return createPermissionServiceProcedureBuilder<\r\n        TInput,\r\n        TCtx & ServiceProcedureAuthContext<Scope>,\r\n        Repositories,\r\n        Services,\r\n        State\r\n      >(host, {\r\n        ...config,\r\n        steps: [...config.steps, createRequireAuthStep(host, scope ?? \"user\")],\r\n      });\r\n    },\r\n    access,\r\n    handle<TOutput>(\r\n      handler: ServiceProcedureHandler<TInput, TCtx, Repositories, Services, State, TOutput>\r\n    ) {\r\n      return createProcedureHandler(host, config, handler);\r\n    },\r\n  };\r\n\r\n  return builder;\r\n}\r\n"],"mappings":";;;;;AAiVA,MAAM,iCAAiC,CACrC,OACD;AAED,SAAS,eAAkB,OAA0C;AACnE,QACE,OAAO,UAAU,YACjB,UAAU,QACV,WAAW,SACX,OAAQ,MAA6B,UAAU,cAC/C,UAAU,SACV,OAAQ,MAA4B,SAAS;;AAIjD,eAAe,yBACb,QAC0B;CAC1B,MAAM,WAAW,MAAM;AACvB,QAAO,eAAkB,SAAS,GAAG,YAAA,GAAA,WAAA,IAAc,SAAS;;AAG9D,SAAS,qBACP,OACA,UACA;AACA,KAAI,MAAM,MAAM,SAAS,KAAK,aAAa,SAAS,CAClD,OAAM,IAAI,MAAM,0CAA0C,WAAW;;AAIzE,SAAS,YACP,OACA,UACA;AACA,QAAO,MAAM,MAAM,SAAS,KAAK,aAAa,SAAS;;AAGzD,SAAS,wBACP,UAAyD,gCACzD;AACA,QAAO;EACL,MAAM,QAAQ,SAAS,OAAO;EAC9B,cAAc,QAAQ,SAAS,eAAe;EAC9C,MAAM,QAAQ,SAAS,OAAO;EAC/B;;AAGH,SAAS,gBAAgB,MAAuD;AAC9E,QAAO,SAAS,eAAe,SAAS,iBAAiB,cAAc;;AAGzE,SAAS,kBACP,MACA,eACA,KACA,OACA,EACE,UACA,YACA,cAKE,EAAE,EACN;AACA,MAAK,OAAO,MAAM;EAChB;EACA;EACA;EACA;EACA;EACA,UAAU,QAAQ,IAAI,MAAM;EAC7B,CAAC;;AAGJ,SAAS,sBAKP,MACA,KACA,OAC4B;AAC5B,KAAI,CAAC,IAAI,MACP,QAAO,KAAK,MAAM,gBAAgB,eAAe;AAGnD,KAAI,CAACA,oCAAAA,cAAc,IAAI,OAAO,MAAM,CAClC,QAAO,KAAK,MAAM,aAAa,YAAY;AAG7C,SAAA,GAAA,WAAA,IAAU,IAAI,MAAsB;;AAGtC,SAAS,sBACP,MACA,QAAoB,QAC0B;AAC9C,QAAO;EACL,OAAO;EACP,UAAU;EACV,KAAK,OAAO,EAAE,UAAU;AACtB,UAAO,sBAAsB,MAAM,KAAK,MAAM;;EAEjD;;AAGH,SAAS,cAQP,UACA,MAC8C;AAC9C,QAAO;EACL,OAAO;EACP;EACA,KAAK,OAAO,SACV,yBACE,KAAK,KAA0E,CAChF;EACJ;;AAGH,SAAS,gBAQP,UACA,MAC8C;AAC9C,QAAO;EACL,OAAO;EACP;EACA,KAAK,OAAO,SACV,yBACE,KAAK,KAA0E,CAChF;EACJ;;AAGH,SAAS,wBACP,MACA,SAC8C;CAC9C,MAAM,iBAAiB,wBAAwB,QAAQ;CACvD,MAAM,gBAA4B,eAAe,OAC7C,SACA,eAAe,eACb,iBACA;AAEN,QAAO;EACL,OAAO;EACP,UAAU;EACV,KAAK,OAAO,EAAE,OAAO,UAAU;GAC7B,MAAM,QAAQ,sBAAsB,MAAM,KAAK,cAAc;AAC7D,OAAI,MAAM,OAAO,CAAE,QAAO;AAC1B,WAAA,GAAA,WAAA,IAAU,KAAK,iBAAiB,MAAM,OAAO,gBAAgB,MAAoB,CAAC;;EAErF;;AAGH,SAAS,iBAQP,MACA,QAC8C;AAC9C,QAAO;EACL,OAAO;EACP,UAAU;EACV,KAAK,OAAO,SAAS;GACnB,MAAM,YAAY;GAClB,MAAM,QAAQ,sBAAsB,MAAM,UAAU,KAAK,OAAO;AAChE,OAAI,MAAM,OAAO,CAAE,QAAO;AAE1B,OAAI,gBAAgB,UAAU,OAAO,OAAO,eAAe,UAAU;IACnE,MAAM,WAAW,UAAU,MAAM,OAAO;AAQxC,QAAI,CAPkB,KAAK,gBACzB,MAAM,OACN,OAAO,QACP,UACA,OAAO,OACR,CAGC,QAAO,KAAK,MAAM,YAAY;AAGhC,YAAA,GAAA,WAAA,IAAU,SAAS;;AAGrB,OAAI,OAAO,OAAO,aAAa,YAAY;IACzC,MAAM,kBAAkB,OAAO;IAI/B,IAAI;IACJ,MAAM,aAAa,MAAM,KAAK,qBAC5B,MAAM,OACN,OAAO,QACP,YAAY;KACV,MAAM,eAAe,MAAM,yBAAyB,gBAAgB,UAAU,CAAC;AAC/E,SAAI,aAAa,MAAM,CACrB,kBAAiB,aAAa;AAEhC,YAAO;OAET,OAAO,OACR;AAED,QAAI,WAAW,OAAO,CACpB,QAAO;AAGT,QAAI,CAAC,WAAW,MACd,QAAO,KAAK,MAAM,YAAY;AAGhC,YAAA,GAAA,WAAA,IAAU,eAAe;;GAG3B,MAAM,WAAW,OAAO;AAQxB,OAAI,CAPkB,KAAK,gBACzB,MAAM,OACN,OAAO,QACP,UACA,OAAO,OACR,CAGC,QAAO,KAAK,MAAM,YAAY;AAGhC,WAAA,GAAA,WAAA,IAAU,SAAS;;EAEtB;;AAGH,SAAS,uBAQP,MACA,QACA,SACyC;AACzC,QAAO,OAAO,OAAO,QACnB,KAAK,eAAe,YAAY;EAC9B,MAAM,QAA+B,EAAE;EACvC,MAAM,YAAY,KAAK,KAAK;EAC5B,MAAM,WAAW;EACjB,IAAI,eAAwB;AAE5B,oBAAkB,MAAM,OAAO,MAAM,UAAU,QAAQ;AAEvD,MAAI;AACF,QAAK,MAAM,QAAQ,OAAO,OAAO;IAC/B,MAAM,aAAa,MAAM,KAAK,IAAI;KAChC,OAAO;KACP,KAAK;KACL;KACA,YAAY,KAAK;KACjB,SAAS,KAAK;KACd,QAAQ,KAAK;KACd,CAAC;AAEF,QAAI,WAAW,OAAO,EAAE;AACtB,uBAAkB,MAAM,OAAO,MAAM,UAAU,gBAAgB,WAAW,MAAM,KAAK,EAAE;MACrF,UAAU,KAAK;MACf,YAAY,KAAK,KAAK,GAAG;MACzB,WAAW,WAAW,MAAM;MAC7B,CAAC;AACF,YAAO;;AAGT,UAAM,KAAK,YAAY,WAAW;AAElC,QAAI,KAAK,UAAU,QACjB,gBAAe,WAAW;AAG5B,QAAI,KAAK,UAAU,OACjB,mBAAkB,MAAM,OAAO,MAAM,UAAU,eAAe,EAC5D,UAAU,KAAK,UAChB,CAAC;AAGJ,QAAI,KAAK,UAAU,SACjB,mBAAkB,MAAM,OAAO,MAAM,UAAU,iBAAiB,EAC9D,UAAU,KAAK,UAChB,CAAC;;GAIN,MAAM,gBAAgB,MAAM,yBAC1B,QAAQ;IACN,OAAO;IACF;IACE;IACP,YAAY,KAAK;IACjB,SAAS,KAAK;IACd,QAAQ,KAAK;IACd,CAAC,CACH;AAED,OAAI,cAAc,OAAO,EAAE;AACzB,sBACE,MACA,OAAO,MACP,UACA,gBAAgB,cAAc,MAAM,KAAK,EACzC;KACE,YAAY,KAAK,KAAK,GAAG;KACzB,WAAW,cAAc,MAAM;KAChC,CACF;AACD,WAAO;;AAGT,qBAAkB,MAAM,OAAO,MAAM,UAAU,WAAW,EACxD,YAAY,KAAK,KAAK,GAAG,WAC1B,CAAC;AACF,UAAO;WACA,OAAO;GACd,MAAM,cAAc,KAAK,mBAAmB,MAAM;AAClD,qBAAkB,MAAM,OAAO,MAAM,UAAU,gBAAgB,YAAY,KAAK,EAAE;IAChF,YAAY,KAAK,KAAK,GAAG;IACzB,WAAW,YAAY;IACxB,CAAC;AACF,SAAM;;GAER;;AAGN,SAAgB,8BAOd,MACA,QACsE;CACtE,SAAS,iBAEP,SAAoB;EACpB,MAAM,QAAQ,YAAY,OAAO,OAAO,OAAO,GAC3C,OAAO,QACP,CAAC,GAAG,OAAO,OAAO,sBAAsB,MAAM,OAAO,CAAC;AAE1D,uBAAqB,OAAO,gBAAgB;AAE5C,SAAO,8BAML,MAAM;GACN,GAAG;GACH,OAAO,CAAC,GAAG,OAAO,wBAAwB,MAAM,QAAQ,CAAC;GAC1D,CAAC;;AAyDJ,QAtDsF;EACpF,IACE,UACA,MACA;AACA,wBAAqB,OAAO,OAAO,SAAS;AAC5C,UAAO,8BAML,MAAM;IACN,GAAG;IACH,OAAO,CAAC,GAAG,OAAO,OAAO,cAAc,UAAU,KAAK,CAAC;IACxD,CAAC;;EAEJ,SACE,UACA,MACA;AACA,wBAAqB,OAAO,OAAO,SAAS;AAC5C,UAAO,8BAML,MAAM;IACN,GAAG;IACH,OAAO,CAAC,GAAG,OAAO,OAAO,gBAAgB,UAAU,KAAK,CAAC;IAC1D,CAAC;;EAEJ;EACA,YAA+C,OAAe;AAC5D,wBAAqB,OAAO,OAAO,OAAO;AAC1C,UAAO,8BAML,MAAM;IACN,GAAG;IACH,OAAO,CAAC,GAAG,OAAO,OAAO,sBAAsB,MAAM,SAAS,OAAO,CAAC;IACvE,CAAC;;EAEJ,OACE,SACA;AACA,UAAO,uBAAuB,MAAM,QAAQ,QAAQ;;EAEvD;;AAKH,SAAgB,wCAOd,MACA,QACgF;CAChF,SAAS,iBAEP,SAAoB;EACpB,MAAM,QAAQ,YAAY,OAAO,OAAO,OAAO,GAC3C,OAAO,QACP,CAAC,GAAG,OAAO,OAAO,sBAAsB,MAAM,OAAO,CAAC;AAE1D,uBAAqB,OAAO,gBAAgB;AAE5C,SAAO,wCAML,MAAM;GACN,GAAG;GACH,OAAO,CAAC,GAAG,OAAO,wBAAwB,MAAM,QAAQ,CAAC;GAC1D,CAAC;;CAqCJ,SAAS,OACP,cAUA;AACA,uBAAqB,OAAO,OAAO,SAAS;AAC5C,SAAO,wCAML,MAAM;GACN,GAAG;GACH,OAAO,CAAC,GAAG,OAAO,OAAO,iBAAiB,MAAM,aAAa,CAAC;GAC/D,CAAC;;AA0DJ,QAvDgG;EAC9F,IACE,UACA,MACA;AACA,wBAAqB,OAAO,OAAO,SAAS;AAC5C,UAAO,wCAML,MAAM;IACN,GAAG;IACH,OAAO,CAAC,GAAG,OAAO,OAAO,cAAc,UAAU,KAAK,CAAC;IACxD,CAAC;;EAEJ,SACE,UACA,MACA;AACA,wBAAqB,OAAO,OAAO,SAAS;AAC5C,UAAO,wCAML,MAAM;IACN,GAAG;IACH,OAAO,CAAC,GAAG,OAAO,OAAO,gBAAgB,UAAU,KAAK,CAAC;IAC1D,CAAC;;EAEJ;EACA,YAA+C,OAAe;AAC5D,wBAAqB,OAAO,OAAO,OAAO;AAC1C,UAAO,wCAML,MAAM;IACN,GAAG;IACH,OAAO,CAAC,GAAG,OAAO,OAAO,sBAAsB,MAAM,SAAS,OAAO,CAAC;IACvE,CAAC;;EAEJ;EACA,OACE,SACA;AACA,UAAO,uBAAuB,MAAM,QAAQ,QAAQ;;EAEvD"}

package/dist/src/modules/base/base.procedure.d.cts

@@ -0,0 +1,111 @@
+import { ServerError } from "../../utils/errors.cjs";
+import { ServerResult, ServerResultAsync } from "./base.dto.cjs";
+import { logger } from "../../utils/logger.cjs";
+import { Base } from "./base.abstract.cjs";
+import { Actor, ActorScope, AuthenticatedActor } from "./base.actor.cjs";
+import { Entity, ResourceActionGrant } from "./base.grants.cjs";
+import { TRPC_ERROR_CODE_KEY } from "@trpc/server";
+import { QueryInput } from "@m5kdev/commons/modules/schemas/query.schema";
+
+//#region src/modules/base/base.procedure.d.ts
+type ServiceLogger = ReturnType<typeof logger.child>;
+type RepositoryMap = Record<string, Base>;
+type ServiceMap = Record<string, Base>;
+type ServiceProcedureContext = {
+  actor?: AuthenticatedActor | null;
+} & Record<string, unknown>;
+type ServiceProcedureState = Record<string, unknown>;
+type ServiceProcedureStoredValue<T> = [T] extends [undefined] ? undefined : Awaited<T>;
+type ServiceProcedureResultLike<T> = T | ServerResult<T> | Promise<T | ServerResult<T>>;
+type ServiceProcedureContextFilterScope = ActorScope;
+type ServiceProcedureContextFilteredInput<TInput> = Extract<NonNullable<TInput>, QueryInput>;
+type ServiceProcedureAuthContext<Scope extends ActorScope> = {
+  actor: Actor[Scope];
+};
+type ServiceProcedureRequiredScopeFromFilter<TInclude extends readonly ServiceProcedureContextFilterScope[] | undefined> = TInclude extends readonly ServiceProcedureContextFilterScope[] ? "team" extends TInclude[number] ? "team" : "organization" extends TInclude[number] ? "organization" : "user" : "user";
+type ServiceProcedure<TInput, TCtx extends ServiceProcedureContext, TOutput> = (input: TInput, ctx: TCtx) => ServerResultAsync<TOutput>;
+type ServiceProcedureArgs<TInput, TCtx extends ServiceProcedureContext, Repositories extends RepositoryMap, Services extends ServiceMap, State extends ServiceProcedureState> = {
+  input: TInput;
+  ctx: TCtx;
+  state: State;
+  repository: Repositories;
+  service: Services;
+  logger: ServiceLogger;
+};
+type ServiceProcedureStep<TInput, TCtx extends ServiceProcedureContext, Repositories extends RepositoryMap, Services extends ServiceMap, State extends ServiceProcedureState, TOutput = undefined> = (args: ServiceProcedureArgs<TInput, TCtx, Repositories, Services, State>) => ServiceProcedureResultLike<ServiceProcedureStoredValue<TOutput>>;
+type ServiceProcedureInputMapper<TInput, TCtx extends ServiceProcedureContext, Repositories extends RepositoryMap, Services extends ServiceMap, State extends ServiceProcedureState, TNextInput> = (args: ServiceProcedureArgs<TInput, TCtx, Repositories, Services, State>) => ServiceProcedureResultLike<ServiceProcedureStoredValue<TNextInput>>;
+type ServiceProcedureHandler<TInput, TCtx extends ServiceProcedureContext, Repositories extends RepositoryMap, Services extends ServiceMap, State extends ServiceProcedureState, TOutput> = (args: ServiceProcedureArgs<TInput, TCtx, Repositories, Services, State>) => ServiceProcedureResultLike<TOutput>;
+type ServiceProcedureEntityResolver<TInput, TCtx extends ServiceProcedureContext, Repositories extends RepositoryMap, Services extends ServiceMap, State extends ServiceProcedureState, TEntities extends Entity | Entity[] | undefined> = TEntities | ((args: ServiceProcedureArgs<TInput, TCtx, Repositories, Services, State>) => ServiceProcedureResultLike<TEntities>);
+type ServiceProcedureAccessBaseConfig = {
+  action: string;
+  grants?: ResourceActionGrant[];
+};
+type ServiceProcedureEntityStepName<State extends ServiceProcedureState> = Extract<{ [Key in keyof State]: State[Key] extends Entity | Entity[] | undefined ? Key : never }[keyof State], string>;
+type ServiceProcedureAccessEntitiesConfig<TInput, TCtx extends ServiceProcedureContext, Repositories extends RepositoryMap, Services extends ServiceMap, State extends ServiceProcedureState, TEntities extends Entity | Entity[] | undefined = undefined> = ServiceProcedureAccessBaseConfig & {
+  entities?: ServiceProcedureEntityResolver<TInput, TCtx, Repositories, Services, State, TEntities>;
+  entityStep?: never;
+};
+type ServiceProcedureAccessStateConfig<State extends ServiceProcedureState, StepName extends ServiceProcedureEntityStepName<State>> = ServiceProcedureAccessBaseConfig & {
+  entityStep: StepName;
+  entities?: never;
+};
+type ServiceProcedureAccessConfig<TInput, TCtx extends ServiceProcedureContext, Repositories extends RepositoryMap, Services extends ServiceMap, State extends ServiceProcedureState, TEntities extends Entity | Entity[] | undefined = undefined> = ServiceProcedureAccessEntitiesConfig<TInput, TCtx, Repositories, Services, State, TEntities> | ServiceProcedureAccessStateConfig<State, ServiceProcedureEntityStepName<State>>;
+interface ServiceProcedureBuilder<TInput, TCtx extends ServiceProcedureContext, Repositories extends RepositoryMap, Services extends ServiceMap, State extends ServiceProcedureState = Record<string, never>> {
+  use<StepName extends string, TOutput = void>(stepName: StepName, step: ServiceProcedureStep<TInput, TCtx, Repositories, Services, State, TOutput>): ServiceProcedureBuilder<TInput, TCtx, Repositories, Services, State & Record<StepName, ServiceProcedureStoredValue<TOutput>>>;
+  mapInput<StepName extends string, TNextInput>(stepName: StepName, step: ServiceProcedureInputMapper<TInput, TCtx, Repositories, Services, State, TNextInput>): ServiceProcedureBuilder<ServiceProcedureStoredValue<TNextInput>, TCtx, Repositories, Services, State & Record<StepName, ServiceProcedureStoredValue<TNextInput>>>;
+  addContextFilter<TInclude extends readonly ServiceProcedureContextFilterScope[] | undefined = undefined>(include?: TInclude): ServiceProcedureBuilder<ServiceProcedureContextFilteredInput<TInput>, TCtx & ServiceProcedureAuthContext<ServiceProcedureRequiredScopeFromFilter<TInclude>>, Repositories, Services, State & {
+    contextFilter: ServiceProcedureContextFilteredInput<TInput>;
+  }>;
+  requireAuth<Scope extends ActorScope = "user">(scope?: Scope): ServiceProcedureBuilder<TInput, TCtx & ServiceProcedureAuthContext<Scope>, Repositories, Services, State>;
+  handle<TOutput>(handler: ServiceProcedureHandler<TInput, TCtx, Repositories, Services, State, TOutput>): ServiceProcedure<TInput, TCtx, TOutput>;
+}
+interface PermissionServiceProcedureBuilder<TInput, TCtx extends ServiceProcedureContext, Repositories extends RepositoryMap, Services extends ServiceMap, State extends ServiceProcedureState = Record<string, never>> extends ServiceProcedureBuilder<TInput, TCtx, Repositories, Services, State> {
+  use<StepName extends string, TOutput = void>(stepName: StepName, step: ServiceProcedureStep<TInput, TCtx, Repositories, Services, State, TOutput>): PermissionServiceProcedureBuilder<TInput, TCtx, Repositories, Services, State & Record<StepName, ServiceProcedureStoredValue<TOutput>>>;
+  mapInput<StepName extends string, TNextInput>(stepName: StepName, step: ServiceProcedureInputMapper<TInput, TCtx, Repositories, Services, State, TNextInput>): PermissionServiceProcedureBuilder<ServiceProcedureStoredValue<TNextInput>, TCtx, Repositories, Services, State & Record<StepName, ServiceProcedureStoredValue<TNextInput>>>;
+  addContextFilter<TInclude extends readonly ServiceProcedureContextFilterScope[] | undefined = undefined>(include?: TInclude): PermissionServiceProcedureBuilder<ServiceProcedureContextFilteredInput<TInput>, TCtx & ServiceProcedureAuthContext<ServiceProcedureRequiredScopeFromFilter<TInclude>>, Repositories, Services, State & {
+    contextFilter: ServiceProcedureContextFilteredInput<TInput>;
+  }>;
+  requireAuth<Scope extends ActorScope = "user">(scope?: Scope): PermissionServiceProcedureBuilder<TInput, TCtx & ServiceProcedureAuthContext<Scope>, Repositories, Services, State>;
+  access(config: ServiceProcedureAccessEntitiesConfig<TInput, TCtx, Repositories, Services, State>): PermissionServiceProcedureBuilder<TInput, TCtx & ServiceProcedureAuthContext<"user">, Repositories, Services, State>;
+  access<TEntities extends Entity | Entity[] | undefined>(config: ServiceProcedureAccessEntitiesConfig<TInput, TCtx, Repositories, Services, State, TEntities>): PermissionServiceProcedureBuilder<TInput, TCtx & ServiceProcedureAuthContext<"user">, Repositories, Services, State & {
+    access: TEntities;
+  }>;
+  access<StepName extends ServiceProcedureEntityStepName<State>>(config: ServiceProcedureAccessStateConfig<State, StepName>): PermissionServiceProcedureBuilder<TInput, TCtx & ServiceProcedureAuthContext<"user">, Repositories, Services, State & {
+    access: State[StepName];
+  }>;
+}
+type BaseServiceProcedureHost<Repositories extends RepositoryMap, Services extends ServiceMap> = {
+  repository: Repositories;
+  service: Services;
+  logger: ServiceLogger;
+  addContextFilter(actor: AuthenticatedActor, include?: {
+    user?: boolean;
+    organization?: boolean;
+    team?: boolean;
+  }, query?: QueryInput): QueryInput;
+  error(code: TRPC_ERROR_CODE_KEY, message?: string, options?: {
+    cause?: unknown;
+    clientMessage?: string;
+    log?: boolean;
+  }): ServerResult<never>;
+  throwableAsync<T>(fn: () => ServerResultAsync<T>): ServerResultAsync<T>;
+  handleUnknownError(error: unknown): ServerError;
+};
+type PermissionServiceProcedureHost<Repositories extends RepositoryMap, Services extends ServiceMap> = BaseServiceProcedureHost<Repositories, Services> & {
+  checkPermission<T extends Entity>(actor: AuthenticatedActor, action: string, entities?: T | T[], grants?: ResourceActionGrant[]): boolean;
+  checkPermissionAsync<T extends Entity>(actor: AuthenticatedActor, action: string, getEntities: () => ServerResultAsync<T | T[] | undefined>, grants?: ResourceActionGrant[]): ServerResultAsync<boolean>;
+};
+type ProcedureRuntimeStep<Repositories extends RepositoryMap, Services extends ServiceMap> = {
+  stage: "use" | "input" | "auth" | "access";
+  stepName: string;
+  run: (args: ServiceProcedureArgs<unknown, ServiceProcedureContext, Repositories, Services, ServiceProcedureState>) => Promise<ServerResult<unknown>>;
+};
+type ProcedureBuilderConfig<Repositories extends RepositoryMap, Services extends ServiceMap> = {
+  name: string;
+  steps: ProcedureRuntimeStep<Repositories, Services>[];
+};
+declare function createServiceProcedureBuilder<TInput, TCtx extends ServiceProcedureContext, Repositories extends RepositoryMap, Services extends ServiceMap, State extends ServiceProcedureState = Record<string, never>>(host: BaseServiceProcedureHost<Repositories, Services>, config: ProcedureBuilderConfig<Repositories, Services>): ServiceProcedureBuilder<TInput, TCtx, Repositories, Services, State>;
+declare function createPermissionServiceProcedureBuilder<TInput, TCtx extends ServiceProcedureContext, Repositories extends RepositoryMap, Services extends ServiceMap, State extends ServiceProcedureState = Record<string, never>>(host: PermissionServiceProcedureHost<Repositories, Services>, config: ProcedureBuilderConfig<Repositories, Services>): PermissionServiceProcedureBuilder<TInput, TCtx, Repositories, Services, State>;
+//#endregion
+export { PermissionServiceProcedureBuilder, ServiceProcedure, ServiceProcedureAccessConfig, ServiceProcedureAccessEntitiesConfig, ServiceProcedureAccessStateConfig, ServiceProcedureArgs, ServiceProcedureBuilder, ServiceProcedureContext, ServiceProcedureContextFilterScope, ServiceProcedureContextFilteredInput, ServiceProcedureEntityResolver, ServiceProcedureEntityStepName, ServiceProcedureHandler, ServiceProcedureInputMapper, ServiceProcedureResultLike, ServiceProcedureState, ServiceProcedureStep, ServiceProcedureStoredValue, createPermissionServiceProcedureBuilder, createServiceProcedureBuilder };
+//# sourceMappingURL=base.procedure.d.cts.map