pipework 0.252.0 → 0.253.0

package/src/lint/include.ts

@@ -0,0 +1,97 @@
+import { existsSync, readdirSync } from 'node:fs'
+import { join, relative, resolve, sep } from 'node:path'
+import { discoverWorkspacePackages } from '../workspace/discover.js'
+
+/**
+ * The file globs a module lints, relative to the module directory.
+ *
+ * `configured` — `lint.modules.<path>.include`, else `lint.include` — replaces the
+ * default outright: a module whose sources are not under `src` says so once. The
+ * default covers `src` plus the `src` of each workspace package under `dir`, so a
+ * nested workspace is not left matching nothing (#393).
+ */
+export function lintIncludeGlobs(dir: string, configured?: readonly string[]): string[] {
+  if (configured !== undefined && configured.length > 0) return [...configured]
+
+  const globs = ['src/**/*.ts', 'src/**/*.tsx']
+  for (const pkg of discoverWorkspacePackages(dir)) {
+    globs.push(pkg + '/src/**/*.ts', pkg + '/src/**/*.tsx')
+  }
+  return globs
+}
+
+/**
+ * The longest directory prefix of `glob` that contains no wildcard.
+ *
+ * `app/src/**\/*.ts` → `app/src`; `**\/*.ts` → `''` (the module root). That is the
+ * directory eslint is pointed at and the directory walked to find files the run
+ * should have covered.
+ */
+export function globRoot(glob: string): string {
+  const parts = glob.split('/')
+  const wildcard = parts.findIndex(p => p.includes('*') || p.includes('?'))
+  return (wildcard === -1 ? parts.slice(0, -1) : parts.slice(0, wildcard)).join('/')
+}
+
+/**
+ * Match a path (relative, `/`-separated) against one glob.
+ *
+ * `**` crosses directory separators, `*` and `?` do not. Enough for the `files`
+ * patterns eslint itself accepts; anything richer belongs in eslint's config, not here.
+ */
+export function matchesGlob(path: string, glob: string): boolean {
+  return globToRegExp(glob).test(path)
+}
+
+function globToRegExp(glob: string): RegExp {
+  let out = '^'
+  for (let i = 0; i < glob.length; i++) {
+    const ch = glob[i]!
+    if (ch === '*') {
+      if (glob[i + 1] === '*') {
+        // `**/` may match zero segments, so the separator is part of the optional group.
+        i++
+        if (glob[i + 1] === '/') i++
+        out += '(?:[^/]*(?:/|$))*'
+      } else {
+        out += '[^/]*'
+      }
+    } else if (ch === '?') {
+      out += '[^/]'
+    } else {
+      out += ch.replace(/[.+^${}()|[\]\\]/g, '\\$&')
+    }
+  }
+  return new RegExp(out + '$')
+}
+
+/**
+ * Every file under `dir` that the module's globs say should be linted.
+ *
+ * Walked from each glob's static root so the cost tracks the configured scope, not the
+ * whole module. `node_modules` and `dist` are never descended — eslint ignores both.
+ */
+export function filesMatchingGlobs(dir: string, globs: readonly string[]): string[] {
+  const found = new Set<string>()
+  for (const glob of globs) {
+    const root = globRoot(glob)
+    const rootDir = root === '' ? dir : join(dir, root)
+    if (!existsSync(rootDir)) continue
+    for (const file of walk(rootDir, dir)) {
+      if (matchesGlob(file, glob)) found.add(file)
+    }
+  }
+  return [...found].sort()
+}
+
+function walk(dir: string, base: string, out: string[] = []): string[] {
+  for (const entry of readdirSync(dir, { withFileTypes: true })) {
+    if (entry.isDirectory()) {
+      if (entry.name === 'node_modules' || entry.name === 'dist') continue
+      walk(join(dir, entry.name), base, out)
+    } else {
+      out.push(relative(resolve(base), resolve(dir, entry.name)).split(sep).join('/'))
+    }
+  }
+  return out
+}

package/src/lint/index.ts

@@ -0,0 +1,3 @@
+export { createLintConfig, rules } from './config.js'
+export type { LintOptions } from './config.js'
+export { resolveLintConfig } from './resolver.js'

package/src/lint/preset.ts

@@ -0,0 +1,10 @@
+import { resolveLintConfig } from './resolver.js'
+
+// `pipework check` lints each module directory with `--config <this file>` (see
+// lintDirectory in src/cli/commands/check.ts). Resolving here — rather than a
+// static createLintConfig() — makes that per-module pass honour pipework.config.ts:
+// `lint.extra` applies everywhere, and `lint.modules` applies to the module being
+// linted (resolveLintConfig keys off the eslint process cwd, i.e. the module dir).
+// With `--config`, eslint's base path IS the cwd, so cwd is also the right root for
+// the file globs here — unlike the generated eslint.config.js, which passes its own dir.
+export default await resolveLintConfig()

package/src/lint/resolver.ts

@@ -0,0 +1,218 @@
+import { dirname, join, relative, sep } from 'node:path'
+import type { Manifold } from '../core/pipework.js'
+import type { LintModuleConfig } from '../core/config/schema.js'
+import { findConfig, registerTsResolveHooks } from '../core/config/discover.js'
+import { importConfig } from '../core/config/import-config.js'
+import { loadEnvFiles } from '../core/config/env.js'
+import { expandGlob } from '../workspace/discover.js'
+import { lintIncludeGlobs } from './include.js'
+import { createLintConfig, type LintOptions } from './config.js'
+
+/**
+ * Build the full eslint flat-config array from pipework.config.ts.
+ *
+ * The generated `eslint.config.js` delegates here, passing its own directory as `cwd` —
+ * eslint resolves flat-config globs against that directory, not the process cwd.
+ * Everything that would normally live in `eslint.config.js` — extra plugins, rules, additional
+ * flat-config blocks — flows through `pipework.config.ts` so pipework remains the single source
+ * of truth and the generated file stays byte-stable for `pipework check`.
+ *
+ * Shape:
+ *   - `lint.extra.plugins` → registered in pipework's main lint block; rules under
+ *     `lint.extra.rules` (or `pipework`'s built-in rules) can reference them as `name/rule`.
+ *   - `lint.extra.rules` → merged into pipework's main block (can override defaults).
+ *   - `lint.extra.configs` → appended as additional flat-config entries after pipework's block.
+ *   - `lint.include` (or a module's own `include`) → the block's `files`. Unset, the globs
+ *     are derived from the workspace rooted at `base`: a glob for `src` plus one per
+ *     workspace package under it, nested workspaces included. Without either, a package
+ *     whose sources are not under `base/src` matches no block, eslint reports "no matching
+ *     configuration", and `pipework check` still prints Lint ✓ (#392, #393).
+ *   - `lint.modules` → per-module overrides, applied per file whatever the directory eslint
+ *     runs from. When `cwd` resolves inside a declared module (the per-module `pipework check`
+ *     pass, `pipework lint`), that module's `rules` and `configs` are layered on top of
+ *     `lint.extra`. For a module below `cwd` (the generated root `eslint.config.js`), its
+ *     `rules` and `configs` become config entries whose `files` and `ignores` are prefixed
+ *     with the module's path, so plain `eslint <file>` agrees with `pipework check`.
+ */
+export async function resolveLintConfig(cwd?: string): Promise<unknown[]> {
+  const start = cwd ?? process.cwd()
+  const configPath = findConfig(start)
+
+  if (configPath === null) {
+    return createLintConfig({ include: lintIncludeGlobs(start) })
+  }
+
+  const configDir = dirname(configPath)
+  loadEnvFiles(configDir)
+  registerTsResolveHooks()
+
+  let manifold: Manifold
+  try {
+    manifold = await importConfig(configPath)
+  } catch (err: unknown) {
+    const message = err instanceof Error ? err.message : String(err)
+    throw new Error(
+      `[pipework] Failed to load pipework.config.ts for eslint config resolution.\n\n` +
+      `  ${message}\n\n` +
+      '  The eslint config resolver imports your config to read `lint.extra`.\n' +
+      '  It does not connect to any database.\n',
+    )
+  }
+
+  const lint = manifold.config.raw.lint
+  if (lint === undefined) {
+    return createLintConfig({ include: lintIncludeGlobs(start) })
+  }
+
+  const extra = lint.extra
+  const moduleOverride = resolveModuleOverride(lint.modules, configDir, start)
+
+  const extraRules = { ...extra?.rules, ...moduleOverride.rules }
+  const extraConfigs = [...(extra?.configs ?? []), ...moduleOverride.configs]
+
+  const below = resolveBelowOverrides(lint, configDir, start)
+
+  const options: LintOptions = {
+    include: unique([...lintIncludeGlobs(start, moduleOverride.include ?? lint.include), ...below.include]),
+    ...(extra?.plugins !== undefined ? { extraPlugins: extra.plugins } : {}),
+    ...(Object.keys(extraRules).length > 0 ? { extraRules } : {}),
+    ...(extraConfigs.length > 0 || below.configs.length > 0 ? { extraConfigs: [...extraConfigs, ...below.configs] } : {}),
+  }
+
+  return createLintConfig(options)
+}
+
+function unique(globs: readonly string[]): string[] {
+  return [...new Set(globs)]
+}
+
+/**
+ * Every `lint.modules` entry as `{ path, config }`, glob keys expanded the same way as the
+ * top-level `modules` map. Glob keys come first so that when a glob expands to the same
+ * path as an explicit key, the explicit entry lands later; the callers' sort by path length
+ * is stable, so the explicit entry stays last and wins — an explicit module entry refines a
+ * glob match regardless of declaration order.
+ */
+function moduleEntries(
+  modules: Record<string, LintModuleConfig> | undefined,
+  configDir: string,
+): Array<{ path: string; config: LintModuleConfig }> {
+  const entries: Array<{ path: string; config: LintModuleConfig }> = []
+  if (modules === undefined) return entries
+  for (const [key, config] of Object.entries(modules)) {
+    if (key.includes('*')) {
+      for (const path of expandGlob(key, configDir)) entries.push({ path, config })
+    }
+  }
+  for (const [key, config] of Object.entries(modules)) {
+    if (!key.includes('*')) entries.push({ path: key, config })
+  }
+  return entries
+}
+
+function prefixGlob(prefix: string, glob: string): string {
+  const negated = glob.startsWith('!')
+  const bare = (negated ? glob.slice(1) : glob).replace(/^\.\//, '')
+  return (negated ? '!' : '') + prefix + '/' + bare
+}
+
+// A flat-config `files` item is a glob or an array of globs that must all match.
+function prefixFiles(prefix: string, files: unknown): unknown {
+  if (typeof files === 'string') return prefixGlob(prefix, files)
+  if (Array.isArray(files)) return files.map(f => prefixFiles(prefix, f))
+  return files
+}
+
+/**
+ * Re-root one module-relative flat-config entry at `prefix`. An entry with no `files`
+ * applied to the whole module, so it takes the module's include globs; an entry with only
+ * `ignores` is a global ignore and just has its patterns prefixed.
+ */
+function prefixConfig(prefix: string, config: unknown, moduleFiles: readonly string[]): unknown {
+  if (typeof config !== 'object' || config === null || Array.isArray(config)) return config
+  const entry = { ...(config as Record<string, unknown>) }
+  const ignoresOnly = entry['files'] === undefined && entry['ignores'] !== undefined &&
+    Object.keys(entry).every(k => k === 'ignores' || k === 'name')
+  if (entry['files'] !== undefined) {
+    entry['files'] = prefixFiles(prefix, entry['files'])
+  } else if (!ignoresOnly) {
+    entry['files'] = moduleFiles.map(g => prefixGlob(prefix, g))
+  }
+  if (Array.isArray(entry['ignores'])) {
+    entry['ignores'] = entry['ignores'].map((g: unknown) => typeof g === 'string' ? prefixGlob(prefix, g) : g)
+  }
+  return entry
+}
+
+/**
+ * Overrides of modules strictly below `start`, as config entries scoped to each module's
+ * files, plus the module's include globs re-rooted at `start` so the main block reaches them.
+ */
+function resolveBelowOverrides(
+  lint: { include?: readonly string[] | undefined; modules?: Record<string, LintModuleConfig> | undefined },
+  configDir: string,
+  start: string,
+): { configs: unknown[]; include: string[] } {
+  const configs: unknown[] = []
+  const include: string[] = []
+  const below = moduleEntries(lint.modules, configDir)
+    .map(e => ({ ...e, prefix: relative(start, join(configDir, e.path)).split(sep).join('/') }))
+    .filter(e => e.prefix !== '' && e.prefix !== '..' && !e.prefix.startsWith('../') && !e.prefix.startsWith('/'))
+    .sort((a, b) => a.prefix.length - b.prefix.length)
+
+  for (const { path, config, prefix } of below) {
+    const moduleFiles = lintIncludeGlobs(join(configDir, path), config.include ?? lint.include)
+    include.push(...moduleFiles.map(g => prefixGlob(prefix, g)))
+    if (config.rules !== undefined && Object.keys(config.rules).length > 0) {
+      configs.push({ files: moduleFiles.map(g => prefixGlob(prefix, g)), rules: config.rules })
+    }
+    for (const c of config.configs ?? []) configs.push(prefixConfig(prefix, c, moduleFiles))
+  }
+  return { configs, include }
+}
+
+/**
+ * Collect the `lint.modules` rules and configs that apply to `start`.
+ *
+ * `start` is the directory eslint runs in — a module directory for a per-module
+ * `pipework check` pass, or the repo root for the generated root `eslint.config.js`
+ * (where modules below it are handled by `resolveBelowOverrides`).
+ * An override applies when its module path (glob keys expanded the same way as the
+ * top-level `modules` map) contains `start`. Least-specific module first, so a deeper
+ * module's rules win, and a glob match is refined by an explicit module entry.
+ */
+function resolveModuleOverride(
+  modules: Record<string, LintModuleConfig> | undefined,
+  configDir: string,
+  start: string,
+): { rules: Record<string, unknown>; configs: readonly unknown[]; include?: readonly string[] } {
+  if (modules === undefined) {
+    return { rules: {}, configs: [] }
+  }
+
+  // `findConfig` only walks upward, so `configDir` is always an ancestor of
+  // `start`; an empty `rel` means `start` *is* the repo root (the generated
+  // root eslint.config.js) — no module override applies there.
+  const rel = relative(configDir, start)
+  if (rel === '') {
+    return { rules: {}, configs: [] }
+  }
+
+  const entries = moduleEntries(modules, configDir)
+
+  const matching = entries
+    .filter(e => rel === e.path || rel.startsWith(e.path + '/'))
+    .sort((a, b) => a.path.length - b.path.length)
+
+  let rules: Record<string, unknown> = {}
+  let configs: readonly unknown[] = []
+  let include: readonly string[] | undefined
+  for (const { config } of matching) {
+    rules = { ...rules, ...config.rules }
+    configs = [...configs, ...(config.configs ?? [])]
+    // Replaced, not merged: `include` names the module's sources outright, so the
+    // deepest module that declares it wins rather than accumulating a union.
+    if (config.include !== undefined) include = config.include
+  }
+  return { rules, configs, ...(include !== undefined ? { include } : {}) }
+}

package/src/lint/rules/no-reexports.ts

@@ -0,0 +1,46 @@
+import type { Rule } from 'eslint'
+
+function isTypeOnly(node: Record<string, unknown>): boolean {
+  return (node as Record<string, unknown>)['exportKind'] === 'type'
+}
+
+export const noReexports: Rule.RuleModule = {
+  meta: {
+    type: 'problem',
+    docs: {
+      description: 'Disallow re-exporting from other modules. Each module should export its own declarations.',
+    },
+    messages: {
+      noReexport:
+        'Do not re-export from "{{source}}". Import into the consuming module directly.\n' +
+        'Re-exports create hidden coupling and make it harder to trace where a symbol is defined.',
+      noBarrelExport:
+        'Do not use `export * from "{{source}}"`. Barrel files obscure the dependency graph.\n' +
+        'Import from the source module directly.',
+    },
+    schema: [],
+  },
+
+  create(context) {
+    return {
+      ExportAllDeclaration(node) {
+        if (isTypeOnly(node as unknown as Record<string, unknown>)) return
+        context.report({
+          node,
+          messageId: 'noBarrelExport',
+          data: { source: String(node.source.value) },
+        })
+      },
+
+      ExportNamedDeclaration(node) {
+        if (node.source === null || node.source === undefined) return
+        if (isTypeOnly(node as unknown as Record<string, unknown>)) return
+        context.report({
+          node,
+          messageId: 'noReexport',
+          data: { source: String(node.source.value) },
+        })
+      },
+    }
+  },
+}

package/src/request/behavior/audited.ts

@@ -0,0 +1,85 @@
+import type { DB } from '../../data/db/index.js'
+import type { ResourceOperations, ResourceId } from '../fixture/types.js'
+import type { AuditedBehaviorConfig } from './types.js'
+import type { Audit, AuditEmitOptions } from '../../infra/audit/types.js'
+import { singularize } from '../internal/text.js'
+
+export function applyAudited<TAuth>(
+  ops: ResourceOperations<TAuth>,
+  config: AuditedBehaviorConfig | Audit,
+  resourceName: string,
+): ResourceOperations<TAuth> {
+  const audit: Audit = 'emit' in config ? config : config.audit
+  const isConfig = !('emit' in config)
+  const entityType = isConfig && (config as AuditedBehaviorConfig).entityType !== undefined
+    ? (config as AuditedBehaviorConfig).entityType!
+    : singularize(resourceName)
+  const prefix = isConfig && (config as AuditedBehaviorConfig).actionPrefix !== undefined
+    ? (config as AuditedBehaviorConfig).actionPrefix!
+    : entityType
+
+  const result: Record<string, unknown> = { ...ops }
+
+  if (ops.create !== undefined) {
+    const original = ops.create
+    result['create'] = {
+      input: original.input,
+      handler: async (db: DB, auth: TAuth, tenant: string, input: unknown) => {
+        const created = await original.handler(db, auth, tenant, input)
+        const opts: AuditEmitOptions = {
+          actionType: `${prefix}.created`,
+          entityType,
+          entityId: extractEntityId(created),
+          after: created,
+        }
+        await audit.emit(opts)
+        return created
+      },
+    }
+  }
+
+  if (ops.update !== undefined) {
+    const original = ops.update
+    result['update'] = {
+      input: original.input,
+      handler: async (db: DB, auth: TAuth, tenant: string, id: ResourceId, input: unknown) => {
+        const before = ops.get !== undefined ? await ops.get(db, auth, tenant, id) : null
+        const updated = await original.handler(db, auth, tenant, id, input)
+        const opts: AuditEmitOptions = {
+          actionType: `${prefix}.updated`,
+          entityType,
+          entityId: id,
+          before: before ?? undefined,
+          after: updated,
+        }
+        await audit.emit(opts)
+        return updated
+      },
+    }
+  }
+
+  if (ops.delete !== undefined) {
+    const original = ops.delete
+    result['delete'] = async (db: DB, auth: TAuth, tenant: string, id: ResourceId) => {
+      const before = ops.get !== undefined ? await ops.get(db, auth, tenant, id) : null
+      await original(db, auth, tenant, id)
+      const opts: AuditEmitOptions = {
+        actionType: `${prefix}.deleted`,
+        entityType,
+        entityId: id,
+        before: before ?? undefined,
+      }
+      await audit.emit(opts)
+    }
+  }
+
+  return result as ResourceOperations<TAuth>
+}
+
+function extractEntityId(result: unknown): string {
+  if (result !== null && typeof result === 'object' && 'id' in result) {
+    return String((result as { id: unknown }).id)
+  }
+  return 'unknown'
+}
+

package/src/request/behavior/cached.ts

@@ -0,0 +1,62 @@
+import type { DB } from '../../data/db/index.js'
+import type { ResourceOperations, ResourceId } from '../fixture/types.js'
+import type { InvalidationBehaviorConfig } from './types.js'
+import { createCache } from '../../infra/cache/create.js'
+import type { Cache } from '../../infra/cache/types.js'
+
+export function withInvalidation<TAuth>(
+  ops: ResourceOperations<TAuth>,
+  config: InvalidationBehaviorConfig,
+  resourceName: string,
+): ResourceOperations<TAuth> & { readonly cache: Cache<unknown[]> } {
+  const listCache = createCache<unknown[]>({
+    name: `resource:${resourceName}:list`,
+    database: config.database,
+    ttlMs: config.ttlMs,
+    load: () => Promise.resolve([]),
+  })
+
+  const result: Record<string, unknown> = { ...ops, cache: listCache }
+
+  if (ops.list !== undefined) {
+    const original = ops.list
+    result['list'] = async (db: DB, auth: TAuth, tenant: string) => {
+      const data = await original(db, auth, tenant)
+      return data
+    }
+  }
+
+  if (ops.create !== undefined) {
+    const original = ops.create
+    result['create'] = {
+      input: original.input,
+      handler: async (db: DB, auth: TAuth, tenant: string, input: unknown) => {
+        const created = await original.handler(db, auth, tenant, input)
+        listCache.invalidate()
+        return created
+      },
+    }
+  }
+
+  if (ops.update !== undefined) {
+    const original = ops.update
+    result['update'] = {
+      input: original.input,
+      handler: async (db: DB, auth: TAuth, tenant: string, id: ResourceId, input: unknown) => {
+        const updated = await original.handler(db, auth, tenant, id, input)
+        listCache.invalidate()
+        return updated
+      },
+    }
+  }
+
+  if (ops.delete !== undefined) {
+    const original = ops.delete
+    result['delete'] = async (db: DB, _auth: TAuth, _tenant: string, id: ResourceId) => {
+      await original(db, _auth, _tenant, id)
+      listCache.invalidate()
+    }
+  }
+
+  return result as unknown as ResourceOperations<TAuth> & { readonly cache: Cache<unknown[]> }
+}

package/src/request/behavior/compose.ts

@@ -0,0 +1,28 @@
+import type { ResourceOperations } from '../fixture/types.js'
+import type { BehaviorConfig } from './types.js'
+import { applyVersioned } from './versioned.js'
+import { applyAudited } from './audited.js'
+import { withInvalidation } from './cached.js'
+
+export function withBehaviors<TAuth>(
+  ops: ResourceOperations<TAuth>,
+  config: BehaviorConfig,
+  resourceName?: string,
+): ResourceOperations<TAuth> {
+  const name = resourceName ?? 'resource'
+  let decorated = ops
+
+  if (config.versioned !== undefined) {
+    decorated = applyVersioned(decorated, config.versioned, name)
+  }
+
+  if (config.audited !== undefined) {
+    decorated = applyAudited(decorated, config.audited, name)
+  }
+
+  if (config.cached !== undefined) {
+    decorated = withInvalidation(decorated, config.cached, name)
+  }
+
+  return decorated
+}

package/src/request/behavior/index.ts

@@ -0,0 +1,5 @@
+export { withBehaviors } from './compose.js'
+export { applyVersioned } from './versioned.js'
+export { applyAudited } from './audited.js'
+export { withInvalidation } from './cached.js'
+export type { BehaviorConfig, VersionedBehaviorConfig, AuditedBehaviorConfig, InvalidationBehaviorConfig } from './types.js'

package/src/request/behavior/namespace.ts

@@ -0,0 +1,16 @@
+import { withBehaviors } from './compose.js'
+import { applyVersioned } from './versioned.js'
+import { applyAudited } from './audited.js'
+import { withInvalidation } from './cached.js'
+
+/** Resource behavior decorators — compose versioning, audit trails, and cache invalidation onto CRUD operations. */
+export const behavior = {
+  /** Applies multiple behaviors to a ResourceOperations set in order. */
+  compose: withBehaviors,
+  /** Adds optimistic concurrency control via a version column — rejects stale updates. */
+  versioned: applyVersioned,
+  /** Wraps operations to emit audit records on create/update/delete. */
+  audited: applyAudited,
+  /** Wraps operations to invalidate a cache on mutations. Returns ops with an attached .cache handle. */
+  invalidate: withInvalidation,
+}

package/src/request/behavior/types.ts

@@ -0,0 +1,26 @@
+import type { Audit } from '../../infra/audit/types.js'
+import type { SQL, DB } from '../../data/db/types.js'
+
+export interface VersionedBehaviorConfig {
+  readonly table: string
+  readonly whereFromId?: (id: string) => SQL
+  readonly softDelete?: boolean
+  readonly beforeRevise?: (db: DB, auth: unknown, tenant: string, id: string, input: unknown) => Promise<void>
+}
+
+export interface AuditedBehaviorConfig {
+  readonly audit: Audit
+  readonly entityType?: string
+  readonly actionPrefix?: string
+}
+
+export interface InvalidationBehaviorConfig {
+  readonly ttlMs: number
+  readonly database: string
+}
+
+export interface BehaviorConfig {
+  readonly versioned?: VersionedBehaviorConfig
+  readonly audited?: AuditedBehaviorConfig | Audit
+  readonly cached?: InvalidationBehaviorConfig
+}

package/src/request/behavior/versioned.ts

@@ -0,0 +1,54 @@
+import type { DB } from '../../data/db/index.js'
+import type { ResourceOperations, ResourceId } from '../fixture/types.js'
+import type { VersionedBehaviorConfig } from './types.js'
+import type { ReviseOptions } from '../../data/temporal/types.js'
+import { sql } from '../../data/db/sql.js'
+import { revise } from '../../data/temporal/revise.js'
+
+export function applyVersioned<TAuth>(
+  ops: ResourceOperations<TAuth>,
+  config: VersionedBehaviorConfig,
+  _resourceName: string,
+): ResourceOperations<TAuth> {
+  const softDelete = config.softDelete !== false
+
+  const buildWhere = config.whereFromId
+    ?? ((id: string) => sql`id = ${id}::uuid`)
+
+  const result: Record<string, unknown> = { ...ops }
+
+  if (ops.update !== undefined) {
+    const originalUpdate = ops.update
+    result['update'] = {
+      input: originalUpdate.input,
+      handler: async (db: DB, auth: TAuth, _tenant: string, id: ResourceId, input: unknown) => {
+        return (db as DB).transaction(async (tx) => {
+          await config.beforeRevise?.(db, auth, _tenant, id, input)
+          const userId = extractUserId(auth)
+          const opts: ReviseOptions = userId !== undefined
+            ? { tx, table: config.table, where: sql`${buildWhere(id)} AND effective_to IS NULL`, data: input as Record<string, unknown>, userId }
+            : { tx, table: config.table, where: sql`${buildWhere(id)} AND effective_to IS NULL`, data: input as Record<string, unknown> }
+          return revise(opts)
+        })
+      },
+    }
+  }
+
+  if (ops.delete !== undefined && softDelete) {
+    result['delete'] = async (db: DB, _auth: TAuth, _tenant: string, id: ResourceId) => {
+      await db.execute(
+        sql`UPDATE ${sql.identifier(config.table)} SET effective_to = now() WHERE ${buildWhere(id)} AND effective_to IS NULL`,
+      )
+    }
+  }
+
+  return result as ResourceOperations<TAuth>
+}
+
+function extractUserId(auth: unknown): string | undefined {
+  if (auth !== null && typeof auth === 'object' && 'userId' in auth) {
+    const userId = (auth as { userId: unknown }).userId
+    if (typeof userId === 'string') return userId
+  }
+  return undefined
+}