Client request
    │
    ├── /api/health (unauthenticated health check)
    │
    └── /api/{trpc,v1,mcp}/*
            │
            ├── CORS middleware (origin-based)
            ├── Logger middleware (emulators only)
            ├── authenticate() → AuthContext
            ├── rateLimiter()
            ├── tenantIsolation() → OrgContext
            │
            └── Route handler

interface AuthContext {
  userId: string;
  organizationId: string;
  role: SystemRole;
  permissions: Permission[];
  tier: SubscriptionTier;
  authMethod: 'firebase' | 'apiKey' | 'portal';
}

// Anyone can call (used for health checks)
publicProcedure

// Requires valid authentication (any auth method)
protectedProcedure

// Requires specific RBAC permission(s)
permissionProcedure([Permission.VIEW_PROJECTS, Permission.EDIT_PROJECTS])

// src/lib/trpc.ts
const trpc = createTRPCReact<AppRouter>();

// In components:
const { data } = trpc.projects.list.useQuery({ status: 'active' });
const mutation = trpc.expenses.submit.useMutation();

// packages/domain-client/src/expenses.ts
export function useExpenses(projectId?: string) {
  return trpc.expenses.list.useQuery({ page: 1, pageSize: 50, projectId });
}

export function useExpenseMutations() {
  const utils = trpc.useUtils();
  const create = trpc.expenses.create.useMutation({
    onSuccess: () => utils.expenses.list.invalidate(),
  });
  return { create };
}

grantmaster_{domain}_{action}

function requirePermissions(ctx: AuthContext, perms: Permission[]): void {
  for (const p of perms) {
    if (!ctx.permissions.includes(p)) {
      throw new McpError(ErrorCode.InvalidRequest, `Missing permission: ${p}`);
    }
  }
}

export const api = onRequest({
  region: 'europe-west1',
  memory: '512MiB',
  timeoutSeconds: 60,
}, app.fetch);