@govcore/federation 0.2.0 → 0.2.2

package/dist/index.d.ts

@@ -1,4 +1,139 @@
-export * from './connections';
-export * from './visibility';
-export * from './links';
-//# sourceMappingURL=index.d.ts.map
+import { orgConnections, GovcoreDb, crossOrgLinks } from '@govcore/schema';
+import { SQL } from 'drizzle-orm';
+import { AnyPgColumn } from 'drizzle-orm/pg-core';
+
+type OrgConnection = typeof orgConnections.$inferSelect;
+/** All connections touching `orgId`, in either direction. */
+declare function getConnections(db: GovcoreDb, orgId: string): Promise<OrgConnection[]>;
+/** An existing connection between two orgs in either direction, or null. */
+declare function findConnectionBetween(db: GovcoreDb, orgId: string, targetOrgId: string): Promise<OrgConnection | null>;
+interface RequestConnectionParams {
+    /** The org opening the connection. */
+    orgId: string;
+    /** The org being invited. */
+    targetOrgId: string;
+    /** The acting user (recorded as `created_by` and on the audit row). */
+    actorUserId: string;
+}
+/**
+ * Open a pending connection from `orgId` to `targetOrgId`. Throws if a
+ * connection already exists in either direction. Audited.
+ */
+declare function requestConnection(db: GovcoreDb, params: RequestConnectionParams): Promise<OrgConnection>;
+interface ConnectionDecisionParams {
+    connectionId: string;
+    /** The org acting — must be the connection's target org. */
+    orgId: string;
+    actorUserId: string;
+}
+/** Accept a pending connection. Only the target org may accept. Audited. */
+declare function acceptConnection(db: GovcoreDb, params: ConnectionDecisionParams): Promise<OrgConnection>;
+/** Reject a pending connection. Only the target org may reject. Audited. */
+declare function rejectConnection(db: GovcoreDb, params: ConnectionDecisionParams): Promise<OrgConnection>;
+
+/** A content row's visibility vocabulary (mirrors the `visibility` schema enum). */
+type FederationVisibility = 'org' | 'connections' | 'instance';
+/**
+ * List-view scope. `org` (default) restricts to the caller's own org;
+ * `federated` is an explicit, user-requested broadening so list queries never
+ * silently fan out across every visible org.
+ */
+type ListScope = 'org' | 'federated';
+/** Coerce a raw query-string value into a ListScope, defaulting to `org`. */
+declare function parseListScope(value: string | string[] | undefined): ListScope;
+/**
+ * Build the visibility WHERE condition for an org-scoped list query.
+ *
+ * - `org` scope → only rows owned by `orgId`.
+ * - `federated` scope → owned rows, plus instance-wide rows, plus
+ *   connections/instance rows owned by a connected org.
+ *
+ * Pass `connectedOrgIds` empty under `org` scope (callers should skip the
+ * connected-org lookup there). Compose with any status filter via `and(...)`.
+ */
+declare function listScopeFilter(cols: {
+    organizationId: AnyPgColumn;
+    visibility: AnyPgColumn;
+}, opts: {
+    orgId: string;
+    scope: ListScope;
+    connectedOrgIds?: string[];
+}): SQL;
+/**
+ * Throw if an entity's owning org doesn't match the caller's. Use before any
+ * write to content fetched without an org filter.
+ */
+declare function assertOwnership(entityOrgId: string | null | undefined, callerOrgId: string): void;
+/** Org IDs with an *active* bilateral connection to `organizationId` (either direction). */
+declare function getConnectedOrgIds(db: GovcoreDb, organizationId: string): Promise<string[]>;
+/**
+ * Whether `callerOrgId` may read a single entity given its owning org and
+ * visibility. Own-org always; `instance` always; `connections` only when an
+ * active connection exists. A null org/visibility is unreadable.
+ */
+declare function canReadFederatedEntity(db: GovcoreDb, entityOrgId: string | null | undefined, visibility: FederationVisibility | null | undefined, callerOrgId: string): Promise<boolean>;
+
+type CrossOrgLink = typeof crossOrgLinks.$inferSelect;
+/** What to do with a link request given any existing link for the same pair. */
+type LinkRequestAction = 'block' | 'reactivate' | 'create';
+/**
+ * Pure: a pending/active link blocks a new request; a previously rejected one is
+ * reactivated; otherwise a fresh link is created.
+ */
+declare function resolveLinkRequest(existing: Pick<CrossOrgLink, 'status'> | null | undefined): LinkRequestAction;
+/** All links where `orgId` is either the source or target org. */
+declare function getCrossOrgLinks(db: GovcoreDb, orgId: string): Promise<CrossOrgLink[]>;
+/** All links touching a given entity (on either side). */
+declare function getLinksForEntity(db: GovcoreDb, entityType: string, entityId: string): Promise<CrossOrgLink[]>;
+interface LinkEndpoints {
+    sourceEntityType: string;
+    sourceEntityId: string;
+    targetEntityType: string;
+    targetEntityId: string;
+}
+/** The existing link for an exact source→target entity pair, or null. */
+declare function findCrossOrgLink(db: GovcoreDb, ends: LinkEndpoints): Promise<CrossOrgLink | null>;
+interface RequestCrossOrgLinkParams extends LinkEndpoints {
+    sourceOrgId: string;
+    targetOrgId: string;
+    linkType: string;
+    actorUserId: string;
+}
+/**
+ * Propose a cross-org link. Blocks if a pending/active link for the pair already
+ * exists; reactivates a previously rejected one; otherwise creates a pending
+ * link. Audited. Entity ownership/visibility must be validated by the caller.
+ */
+declare function requestCrossOrgLink(db: GovcoreDb, params: RequestCrossOrgLinkParams): Promise<CrossOrgLink>;
+interface LinkDecisionParams {
+    linkId: string;
+    /** The acting org — must be the link's target org. */
+    orgId: string;
+    actorUserId: string;
+}
+/** Approve a pending link. Target org only. Audited. */
+declare function approveCrossOrgLink(db: GovcoreDb, params: LinkDecisionParams): Promise<CrossOrgLink>;
+/** Reject a pending link with an optional reason. Target org only. Audited. */
+declare function rejectCrossOrgLink(db: GovcoreDb, params: LinkDecisionParams & {
+    reason?: string;
+}): Promise<CrossOrgLink>;
+/** Withdraw a link the *source* org proposed (any status). Audited. */
+declare function withdrawCrossOrgLink(db: GovcoreDb, params: LinkDecisionParams): Promise<CrossOrgLink>;
+/** Revoke an active link from the *target* org. Audited. */
+declare function revokeCrossOrgLink(db: GovcoreDb, params: LinkDecisionParams): Promise<CrossOrgLink>;
+/**
+ * Flag every pending/active link touching an entity for review — used when the
+ * entity's visibility drops so both orgs are alerted the link may no longer be
+ * accessible. Caller must have verified the entity belongs to its org.
+ */
+declare function flagLinksForVisibilityDrop(db: GovcoreDb, entityType: string, entityId: string, reason: string): Promise<void>;
+/** Clear review flags on an entity's links — used when visibility is raised back. */
+declare function clearLinksFlag(db: GovcoreDb, entityType: string, entityId: string): Promise<void>;
+/**
+ * Delete every cross-org link between two orgs — called when their connection is
+ * removed. Audits a snapshot of the removed links (when any) under the actor.
+ * Returns the removed rows.
+ */
+declare function removeLinksForConnection(db: GovcoreDb, orgAId: string, orgBId: string, actorUserId: string, actorOrgId: string): Promise<CrossOrgLink[]>;
+
+export { type ConnectionDecisionParams, type CrossOrgLink, type FederationVisibility, type LinkDecisionParams, type LinkEndpoints, type LinkRequestAction, type ListScope, type OrgConnection, type RequestConnectionParams, type RequestCrossOrgLinkParams, acceptConnection, approveCrossOrgLink, assertOwnership, canReadFederatedEntity, clearLinksFlag, findConnectionBetween, findCrossOrgLink, flagLinksForVisibilityDrop, getConnectedOrgIds, getConnections, getCrossOrgLinks, getLinksForEntity, listScopeFilter, parseListScope, rejectConnection, rejectCrossOrgLink, removeLinksForConnection, requestConnection, requestCrossOrgLink, resolveLinkRequest, revokeCrossOrgLink, withdrawCrossOrgLink };

package/dist/index.js

@@ -1,14 +1,290 @@
-// @govcore/federation — cross-organization connections + federated visibility.
-//
-// connections: the bilateral org-to-org connection lifecycle (request / accept /
-// reject), audited; an active connection is what federated reads key off.
-// visibility: the org | connections | instance scoping helpers for list queries
-// and single-row read checks over app-owned content.
-//
-// links: the cross-org content-link lifecycle (request / approve / reject /
-// withdraw / revoke) plus review-flag and connection-cleanup helpers. Entity
-// types and link_type are app-defined strings; the app validates entity
-// ownership/visibility, this owns the link record.
-export * from './connections';
-export * from './visibility';
-export * from './links';
+// src/connections.ts
+import { and, eq, or } from "drizzle-orm";
+import { orgConnections } from "@govcore/schema";
+import { writeAuditLog } from "@govcore/audit";
+async function getConnections(db, orgId) {
+  return db.select().from(orgConnections).where(or(eq(orgConnections.fromOrgId, orgId), eq(orgConnections.toOrgId, orgId)));
+}
+async function findConnectionBetween(db, orgId, targetOrgId) {
+  const [existing] = await db.select().from(orgConnections).where(
+    or(
+      and(eq(orgConnections.fromOrgId, orgId), eq(orgConnections.toOrgId, targetOrgId)),
+      and(eq(orgConnections.fromOrgId, targetOrgId), eq(orgConnections.toOrgId, orgId))
+    )
+  ).limit(1);
+  return existing ?? null;
+}
+async function requestConnection(db, params) {
+  if (params.orgId === params.targetOrgId) {
+    throw new Error("Cannot connect an organization to itself");
+  }
+  const existing = await findConnectionBetween(db, params.orgId, params.targetOrgId);
+  if (existing) throw new Error("Connection already exists or is pending");
+  const [connection] = await db.insert(orgConnections).values({
+    fromOrgId: params.orgId,
+    toOrgId: params.targetOrgId,
+    status: "pending",
+    createdBy: params.actorUserId
+  }).returning();
+  await writeAuditLog(db, {
+    action: "federation.connection.request",
+    entityType: "org_connection",
+    entityId: connection.id,
+    userId: params.actorUserId,
+    organizationId: params.orgId,
+    after: { targetOrgId: params.targetOrgId }
+  });
+  return connection;
+}
+async function transitionByTarget(db, params, status, action) {
+  const [row] = await db.update(orgConnections).set({ status, updatedAt: /* @__PURE__ */ new Date() }).where(
+    and(
+      eq(orgConnections.id, params.connectionId),
+      eq(orgConnections.toOrgId, params.orgId)
+    )
+  ).returning();
+  if (!row) throw new Error("Connection not found or not authorized");
+  await writeAuditLog(db, {
+    action,
+    entityType: "org_connection",
+    entityId: params.connectionId,
+    userId: params.actorUserId,
+    organizationId: params.orgId
+  });
+  return row;
+}
+async function acceptConnection(db, params) {
+  return transitionByTarget(db, params, "active", "federation.connection.accept");
+}
+async function rejectConnection(db, params) {
+  return transitionByTarget(db, params, "rejected", "federation.connection.reject");
+}
+
+// src/visibility.ts
+import { and as and2, eq as eq2, inArray, or as or2 } from "drizzle-orm";
+import { orgConnections as orgConnections2 } from "@govcore/schema";
+function parseListScope(value) {
+  return value === "federated" ? "federated" : "org";
+}
+function listScopeFilter(cols, opts) {
+  const base = eq2(cols.organizationId, opts.orgId);
+  if (opts.scope === "org") return base;
+  const instanceWide = eq2(cols.visibility, "instance");
+  const connectedOrgIds = opts.connectedOrgIds ?? [];
+  if (connectedOrgIds.length === 0) return or2(base, instanceWide);
+  return or2(
+    base,
+    instanceWide,
+    and2(
+      inArray(cols.organizationId, connectedOrgIds),
+      inArray(cols.visibility, ["connections", "instance"])
+    )
+  );
+}
+function assertOwnership(entityOrgId, callerOrgId) {
+  if (!entityOrgId || entityOrgId !== callerOrgId) {
+    throw new Error("Forbidden: content owned by another organization");
+  }
+}
+async function getConnectedOrgIds(db, organizationId) {
+  const rows = await db.select({ fromOrgId: orgConnections2.fromOrgId, toOrgId: orgConnections2.toOrgId }).from(orgConnections2).where(
+    and2(
+      or2(
+        eq2(orgConnections2.fromOrgId, organizationId),
+        eq2(orgConnections2.toOrgId, organizationId)
+      ),
+      eq2(orgConnections2.status, "active")
+    )
+  );
+  return rows.map((r) => r.fromOrgId === organizationId ? r.toOrgId : r.fromOrgId);
+}
+async function canReadFederatedEntity(db, entityOrgId, visibility, callerOrgId) {
+  if (!entityOrgId || !visibility) return false;
+  if (entityOrgId === callerOrgId) return true;
+  if (visibility === "instance") return true;
+  if (visibility !== "connections") return false;
+  const connectedOrgIds = await getConnectedOrgIds(db, callerOrgId);
+  return connectedOrgIds.includes(entityOrgId);
+}
+
+// src/links.ts
+import { and as and3, eq as eq3, inArray as inArray2, or as or3 } from "drizzle-orm";
+import { crossOrgLinks } from "@govcore/schema";
+import { writeAuditLog as writeAuditLog2 } from "@govcore/audit";
+function resolveLinkRequest(existing) {
+  if (!existing) return "create";
+  if (existing.status === "pending" || existing.status === "active") return "block";
+  return "reactivate";
+}
+var touchesEntity = (entityType, entityId) => or3(
+  and3(eq3(crossOrgLinks.sourceEntityType, entityType), eq3(crossOrgLinks.sourceEntityId, entityId)),
+  and3(eq3(crossOrgLinks.targetEntityType, entityType), eq3(crossOrgLinks.targetEntityId, entityId))
+);
+var betweenOrgs = (orgAId, orgBId) => or3(
+  and3(eq3(crossOrgLinks.sourceOrgId, orgAId), eq3(crossOrgLinks.targetOrgId, orgBId)),
+  and3(eq3(crossOrgLinks.sourceOrgId, orgBId), eq3(crossOrgLinks.targetOrgId, orgAId))
+);
+async function getCrossOrgLinks(db, orgId) {
+  return db.select().from(crossOrgLinks).where(or3(eq3(crossOrgLinks.sourceOrgId, orgId), eq3(crossOrgLinks.targetOrgId, orgId)));
+}
+async function getLinksForEntity(db, entityType, entityId) {
+  return db.select().from(crossOrgLinks).where(touchesEntity(entityType, entityId));
+}
+async function findCrossOrgLink(db, ends) {
+  const [row] = await db.select().from(crossOrgLinks).where(
+    and3(
+      eq3(crossOrgLinks.sourceEntityType, ends.sourceEntityType),
+      eq3(crossOrgLinks.sourceEntityId, ends.sourceEntityId),
+      eq3(crossOrgLinks.targetEntityType, ends.targetEntityType),
+      eq3(crossOrgLinks.targetEntityId, ends.targetEntityId)
+    )
+  ).limit(1);
+  return row ?? null;
+}
+async function requestCrossOrgLink(db, params) {
+  if (params.sourceOrgId === params.targetOrgId) {
+    throw new Error("Use same-org relationships for links within one organization");
+  }
+  const existing = await findCrossOrgLink(db, params);
+  const action = resolveLinkRequest(existing);
+  if (action === "block") {
+    throw new Error("A cross-org link already exists or is awaiting approval");
+  }
+  let link;
+  if (action === "reactivate" && existing) {
+    const [row] = await db.update(crossOrgLinks).set({ linkType: params.linkType, status: "pending", rejectionReason: null, updatedAt: /* @__PURE__ */ new Date() }).where(eq3(crossOrgLinks.id, existing.id)).returning();
+    link = row;
+  } else {
+    const [row] = await db.insert(crossOrgLinks).values({
+      sourceOrgId: params.sourceOrgId,
+      sourceEntityType: params.sourceEntityType,
+      sourceEntityId: params.sourceEntityId,
+      targetOrgId: params.targetOrgId,
+      targetEntityType: params.targetEntityType,
+      targetEntityId: params.targetEntityId,
+      linkType: params.linkType,
+      status: "pending",
+      createdBy: params.actorUserId
+    }).returning();
+    link = row;
+  }
+  await writeAuditLog2(db, {
+    action: "federation.cross_org_link.request",
+    entityType: "cross_org_link",
+    entityId: link.id,
+    userId: params.actorUserId,
+    organizationId: params.sourceOrgId,
+    after: {
+      sourceEntityId: params.sourceEntityId,
+      targetEntityId: params.targetEntityId,
+      linkType: params.linkType,
+      targetOrgId: params.targetOrgId
+    }
+  });
+  return link;
+}
+async function transitionByTarget2(db, params, status, action) {
+  const [link] = await db.select().from(crossOrgLinks).where(and3(eq3(crossOrgLinks.id, params.linkId), eq3(crossOrgLinks.targetOrgId, params.orgId))).limit(1);
+  if (!link) throw new Error("Cross-org link not found or not authorized");
+  if (link.status !== "pending") throw new Error("Only pending links can be approved or rejected");
+  const [row] = await db.update(crossOrgLinks).set({
+    status,
+    rejectionReason: status === "rejected" && params.reason?.trim() ? params.reason.trim() : null,
+    updatedAt: /* @__PURE__ */ new Date()
+  }).where(eq3(crossOrgLinks.id, params.linkId)).returning();
+  await writeAuditLog2(db, {
+    action,
+    entityType: "cross_org_link",
+    entityId: params.linkId,
+    userId: params.actorUserId,
+    organizationId: params.orgId,
+    after: { sourceEntityId: link.sourceEntityId, targetEntityId: link.targetEntityId }
+  });
+  return row;
+}
+async function approveCrossOrgLink(db, params) {
+  return transitionByTarget2(db, params, "active", "federation.cross_org_link.approve");
+}
+async function rejectCrossOrgLink(db, params) {
+  return transitionByTarget2(db, params, "rejected", "federation.cross_org_link.reject");
+}
+async function deleteOwnedLink(db, params, ownerColumn, action) {
+  const [link] = await db.select().from(crossOrgLinks).where(and3(eq3(crossOrgLinks.id, params.linkId), eq3(ownerColumn, params.orgId))).limit(1);
+  if (!link) throw new Error("Cross-org link not found or not authorized");
+  if (params.requireActive && link.status !== "active") {
+    throw new Error("Only active links can be revoked");
+  }
+  await db.delete(crossOrgLinks).where(eq3(crossOrgLinks.id, params.linkId));
+  await writeAuditLog2(db, {
+    action,
+    entityType: "cross_org_link",
+    entityId: params.linkId,
+    userId: params.actorUserId,
+    organizationId: params.orgId,
+    before: {
+      sourceEntityId: link.sourceEntityId,
+      targetEntityId: link.targetEntityId,
+      status: link.status
+    }
+  });
+  return link;
+}
+async function withdrawCrossOrgLink(db, params) {
+  return deleteOwnedLink(db, params, crossOrgLinks.sourceOrgId, "federation.cross_org_link.withdraw");
+}
+async function revokeCrossOrgLink(db, params) {
+  return deleteOwnedLink(
+    db,
+    { ...params, requireActive: true },
+    crossOrgLinks.targetOrgId,
+    "federation.cross_org_link.revoke"
+  );
+}
+async function flagLinksForVisibilityDrop(db, entityType, entityId, reason) {
+  await db.update(crossOrgLinks).set({ flaggedForReview: true, flagReason: reason, updatedAt: /* @__PURE__ */ new Date() }).where(and3(touchesEntity(entityType, entityId), inArray2(crossOrgLinks.status, ["pending", "active"])));
+}
+async function clearLinksFlag(db, entityType, entityId) {
+  await db.update(crossOrgLinks).set({ flaggedForReview: false, flagReason: null, updatedAt: /* @__PURE__ */ new Date() }).where(and3(touchesEntity(entityType, entityId), eq3(crossOrgLinks.flaggedForReview, true)));
+}
+async function removeLinksForConnection(db, orgAId, orgBId, actorUserId, actorOrgId) {
+  const affected = await db.select().from(crossOrgLinks).where(betweenOrgs(orgAId, orgBId));
+  if (affected.length === 0) return [];
+  await db.delete(crossOrgLinks).where(betweenOrgs(orgAId, orgBId));
+  await writeAuditLog2(db, {
+    action: "federation.cross_org_link.remove_for_connection",
+    entityType: "org_connection",
+    userId: actorUserId,
+    organizationId: actorOrgId,
+    before: {
+      orgAId,
+      orgBId,
+      removedLinkIds: affected.map((l) => l.id)
+    }
+  });
+  return affected;
+}
+export {
+  acceptConnection,
+  approveCrossOrgLink,
+  assertOwnership,
+  canReadFederatedEntity,
+  clearLinksFlag,
+  findConnectionBetween,
+  findCrossOrgLink,
+  flagLinksForVisibilityDrop,
+  getConnectedOrgIds,
+  getConnections,
+  getCrossOrgLinks,
+  getLinksForEntity,
+  listScopeFilter,
+  parseListScope,
+  rejectConnection,
+  rejectCrossOrgLink,
+  removeLinksForConnection,
+  requestConnection,
+  requestCrossOrgLink,
+  resolveLinkRequest,
+  revokeCrossOrgLink,
+  withdrawCrossOrgLink
+};
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/connections.ts","../src/visibility.ts","../src/links.ts"],"sourcesContent":["// @govcore/federation/connections — the org-to-org connection lifecycle.\n//\n// A connection is a bilateral, explicit link between two orgs. The requester's\n// org opens it (`pending`); only the *target* org may accept (`active`) or\n// reject (`rejected`). An active connection is what `getConnectedOrgIds` and the\n// federated read checks key off. Each transition is audited. App-layer auth\n// (who is an admin, whose org is acting) stays in the caller.\n\nimport { and, eq, or } from 'drizzle-orm'\nimport { orgConnections, type GovcoreDb } from '@govcore/schema'\nimport { writeAuditLog } from '@govcore/audit'\n\nexport type OrgConnection = typeof orgConnections.$inferSelect\n\n/** All connections touching `orgId`, in either direction. */\nexport async function getConnections(db: GovcoreDb, orgId: string): Promise<OrgConnection[]> {\n  return db\n    .select()\n    .from(orgConnections)\n    .where(or(eq(orgConnections.fromOrgId, orgId), eq(orgConnections.toOrgId, orgId)))\n}\n\n/** An existing connection between two orgs in either direction, or null. */\nexport async function findConnectionBetween(\n  db: GovcoreDb,\n  orgId: string,\n  targetOrgId: string,\n): Promise<OrgConnection | null> {\n  const [existing] = await db\n    .select()\n    .from(orgConnections)\n    .where(\n      or(\n        and(eq(orgConnections.fromOrgId, orgId), eq(orgConnections.toOrgId, targetOrgId)),\n        and(eq(orgConnections.fromOrgId, targetOrgId), eq(orgConnections.toOrgId, orgId)),\n      ),\n    )\n    .limit(1)\n  return existing ?? null\n}\n\nexport interface RequestConnectionParams {\n  /** The org opening the connection. */\n  orgId: string\n  /** The org being invited. */\n  targetOrgId: string\n  /** The acting user (recorded as `created_by` and on the audit row). */\n  actorUserId: string\n}\n\n/**\n * Open a pending connection from `orgId` to `targetOrgId`. Throws if a\n * connection already exists in either direction. Audited.\n */\nexport async function requestConnection(\n  db: GovcoreDb,\n  params: RequestConnectionParams,\n): Promise<OrgConnection> {\n  if (params.orgId === params.targetOrgId) {\n    throw new Error('Cannot connect an organization to itself')\n  }\n  const existing = await findConnectionBetween(db, params.orgId, params.targetOrgId)\n  if (existing) throw new Error('Connection already exists or is pending')\n\n  const [connection] = await db\n    .insert(orgConnections)\n    .values({\n      fromOrgId: params.orgId,\n      toOrgId: params.targetOrgId,\n      status: 'pending',\n      createdBy: params.actorUserId,\n    })\n    .returning()\n\n  await writeAuditLog(db, {\n    action: 'federation.connection.request',\n    entityType: 'org_connection',\n    entityId: connection.id,\n    userId: params.actorUserId,\n    organizationId: params.orgId,\n    after: { targetOrgId: params.targetOrgId },\n  })\n  return connection\n}\n\n/** Internal: a target-only status transition with an audit row. */\nasync function transitionByTarget(\n  db: GovcoreDb,\n  params: { connectionId: string; orgId: string; actorUserId: string },\n  status: 'active' | 'rejected',\n  action: string,\n): Promise<OrgConnection> {\n  // Only the target org (toOrgId) may accept or reject.\n  const [row] = await db\n    .update(orgConnections)\n    .set({ status, updatedAt: new Date() })\n    .where(\n      and(\n        eq(orgConnections.id, params.connectionId),\n        eq(orgConnections.toOrgId, params.orgId),\n      ),\n    )\n    .returning()\n  if (!row) throw new Error('Connection not found or not authorized')\n\n  await writeAuditLog(db, {\n    action,\n    entityType: 'org_connection',\n    entityId: params.connectionId,\n    userId: params.actorUserId,\n    organizationId: params.orgId,\n  })\n  return row\n}\n\nexport interface ConnectionDecisionParams {\n  connectionId: string\n  /** The org acting — must be the connection's target org. */\n  orgId: string\n  actorUserId: string\n}\n\n/** Accept a pending connection. Only the target org may accept. Audited. */\nexport async function acceptConnection(\n  db: GovcoreDb,\n  params: ConnectionDecisionParams,\n): Promise<OrgConnection> {\n  return transitionByTarget(db, params, 'active', 'federation.connection.accept')\n}\n\n/** Reject a pending connection. Only the target org may reject. Audited. */\nexport async function rejectConnection(\n  db: GovcoreDb,\n  params: ConnectionDecisionParams,\n): Promise<OrgConnection> {\n  return transitionByTarget(db, params, 'rejected', 'federation.connection.reject')\n}\n","// @govcore/federation/visibility — federated read scoping.\n//\n// Content rows carry a `visibility` (org | connections | instance). A list query\n// is scoped to the caller's org by default; broadening to `federated` also pulls\n// in instance-wide rows and rows owned by a *connected* org whose visibility\n// permits it. These helpers build the query condition and answer single-row\n// read checks; the content tables themselves are app-owned (content is a later\n// milestone), so callers pass the columns.\n\nimport { and, eq, inArray, or, type SQL } from 'drizzle-orm'\nimport type { AnyPgColumn } from 'drizzle-orm/pg-core'\nimport { orgConnections, type GovcoreDb } from '@govcore/schema'\n\n/** A content row's visibility vocabulary (mirrors the `visibility` schema enum). */\nexport type FederationVisibility = 'org' | 'connections' | 'instance'\n\n/**\n * List-view scope. `org` (default) restricts to the caller's own org;\n * `federated` is an explicit, user-requested broadening so list queries never\n * silently fan out across every visible org.\n */\nexport type ListScope = 'org' | 'federated'\n\n/** Coerce a raw query-string value into a ListScope, defaulting to `org`. */\nexport function parseListScope(value: string | string[] | undefined): ListScope {\n  return value === 'federated' ? 'federated' : 'org'\n}\n\n/**\n * Build the visibility WHERE condition for an org-scoped list query.\n *\n * - `org` scope → only rows owned by `orgId`.\n * - `federated` scope → owned rows, plus instance-wide rows, plus\n *   connections/instance rows owned by a connected org.\n *\n * Pass `connectedOrgIds` empty under `org` scope (callers should skip the\n * connected-org lookup there). Compose with any status filter via `and(...)`.\n */\nexport function listScopeFilter(\n  cols: { organizationId: AnyPgColumn; visibility: AnyPgColumn },\n  opts: { orgId: string; scope: ListScope; connectedOrgIds?: string[] },\n): SQL {\n  const base = eq(cols.organizationId, opts.orgId)\n  if (opts.scope === 'org') return base\n\n  const instanceWide = eq(cols.visibility, 'instance')\n  const connectedOrgIds = opts.connectedOrgIds ?? []\n  if (connectedOrgIds.length === 0) return or(base, instanceWide)!\n  return or(\n    base,\n    instanceWide,\n    and(\n      inArray(cols.organizationId, connectedOrgIds),\n      inArray(cols.visibility, ['connections', 'instance']),\n    ),\n  )!\n}\n\n/**\n * Throw if an entity's owning org doesn't match the caller's. Use before any\n * write to content fetched without an org filter.\n */\nexport function assertOwnership(\n  entityOrgId: string | null | undefined,\n  callerOrgId: string,\n): void {\n  if (!entityOrgId || entityOrgId !== callerOrgId) {\n    throw new Error('Forbidden: content owned by another organization')\n  }\n}\n\n/** Org IDs with an *active* bilateral connection to `organizationId` (either direction). */\nexport async function getConnectedOrgIds(\n  db: GovcoreDb,\n  organizationId: string,\n): Promise<string[]> {\n  const rows = await db\n    .select({ fromOrgId: orgConnections.fromOrgId, toOrgId: orgConnections.toOrgId })\n    .from(orgConnections)\n    .where(\n      and(\n        or(\n          eq(orgConnections.fromOrgId, organizationId),\n          eq(orgConnections.toOrgId, organizationId),\n        ),\n        eq(orgConnections.status, 'active'),\n      ),\n    )\n  return rows.map((r) => (r.fromOrgId === organizationId ? r.toOrgId : r.fromOrgId))\n}\n\n/**\n * Whether `callerOrgId` may read a single entity given its owning org and\n * visibility. Own-org always; `instance` always; `connections` only when an\n * active connection exists. A null org/visibility is unreadable.\n */\nexport async function canReadFederatedEntity(\n  db: GovcoreDb,\n  entityOrgId: string | null | undefined,\n  visibility: FederationVisibility | null | undefined,\n  callerOrgId: string,\n): Promise<boolean> {\n  if (!entityOrgId || !visibility) return false\n  if (entityOrgId === callerOrgId) return true\n  if (visibility === 'instance') return true\n  if (visibility !== 'connections') return false\n\n  const connectedOrgIds = await getConnectedOrgIds(db, callerOrgId)\n  return connectedOrgIds.includes(entityOrgId)\n}\n","// @govcore/federation/links — the cross-org content-link lifecycle.\n//\n// A cross-org link is an approved relationship between a content item in one org\n// and one in another. Entity ids carry no FK (they cross org boundaries) and the\n// link semantics are app-defined: `linkType`, `sourceEntityType`/`targetEntityType`\n// are plain strings here. The *source* org proposes a link; only the *target* org\n// approves or rejects it. Entity ownership and federated-visibility preconditions\n// are the caller's responsibility (they live over app-owned content) — this module\n// owns the link record and its transitions. Each transition is audited.\n\nimport { and, eq, inArray, or } from 'drizzle-orm'\nimport { crossOrgLinks, type GovcoreDb } from '@govcore/schema'\nimport { writeAuditLog } from '@govcore/audit'\n\nexport type CrossOrgLink = typeof crossOrgLinks.$inferSelect\n\n/** What to do with a link request given any existing link for the same pair. */\nexport type LinkRequestAction = 'block' | 'reactivate' | 'create'\n\n/**\n * Pure: a pending/active link blocks a new request; a previously rejected one is\n * reactivated; otherwise a fresh link is created.\n */\nexport function resolveLinkRequest(\n  existing: Pick<CrossOrgLink, 'status'> | null | undefined,\n): LinkRequestAction {\n  if (!existing) return 'create'\n  if (existing.status === 'pending' || existing.status === 'active') return 'block'\n  return 'reactivate'\n}\n\nconst touchesEntity = (entityType: string, entityId: string) =>\n  or(\n    and(eq(crossOrgLinks.sourceEntityType, entityType), eq(crossOrgLinks.sourceEntityId, entityId)),\n    and(eq(crossOrgLinks.targetEntityType, entityType), eq(crossOrgLinks.targetEntityId, entityId)),\n  )\n\nconst betweenOrgs = (orgAId: string, orgBId: string) =>\n  or(\n    and(eq(crossOrgLinks.sourceOrgId, orgAId), eq(crossOrgLinks.targetOrgId, orgBId)),\n    and(eq(crossOrgLinks.sourceOrgId, orgBId), eq(crossOrgLinks.targetOrgId, orgAId)),\n  )\n\n/** All links where `orgId` is either the source or target org. */\nexport async function getCrossOrgLinks(db: GovcoreDb, orgId: string): Promise<CrossOrgLink[]> {\n  return db\n    .select()\n    .from(crossOrgLinks)\n    .where(or(eq(crossOrgLinks.sourceOrgId, orgId), eq(crossOrgLinks.targetOrgId, orgId)))\n}\n\n/** All links touching a given entity (on either side). */\nexport async function getLinksForEntity(\n  db: GovcoreDb,\n  entityType: string,\n  entityId: string,\n): Promise<CrossOrgLink[]> {\n  return db.select().from(crossOrgLinks).where(touchesEntity(entityType, entityId))\n}\n\nexport interface LinkEndpoints {\n  sourceEntityType: string\n  sourceEntityId: string\n  targetEntityType: string\n  targetEntityId: string\n}\n\n/** The existing link for an exact source→target entity pair, or null. */\nexport async function findCrossOrgLink(\n  db: GovcoreDb,\n  ends: LinkEndpoints,\n): Promise<CrossOrgLink | null> {\n  const [row] = await db\n    .select()\n    .from(crossOrgLinks)\n    .where(\n      and(\n        eq(crossOrgLinks.sourceEntityType, ends.sourceEntityType),\n        eq(crossOrgLinks.sourceEntityId, ends.sourceEntityId),\n        eq(crossOrgLinks.targetEntityType, ends.targetEntityType),\n        eq(crossOrgLinks.targetEntityId, ends.targetEntityId),\n      ),\n    )\n    .limit(1)\n  return row ?? null\n}\n\nexport interface RequestCrossOrgLinkParams extends LinkEndpoints {\n  sourceOrgId: string\n  targetOrgId: string\n  linkType: string\n  actorUserId: string\n}\n\n/**\n * Propose a cross-org link. Blocks if a pending/active link for the pair already\n * exists; reactivates a previously rejected one; otherwise creates a pending\n * link. Audited. Entity ownership/visibility must be validated by the caller.\n */\nexport async function requestCrossOrgLink(\n  db: GovcoreDb,\n  params: RequestCrossOrgLinkParams,\n): Promise<CrossOrgLink> {\n  if (params.sourceOrgId === params.targetOrgId) {\n    throw new Error('Use same-org relationships for links within one organization')\n  }\n\n  const existing = await findCrossOrgLink(db, params)\n  const action = resolveLinkRequest(existing)\n  if (action === 'block') {\n    throw new Error('A cross-org link already exists or is awaiting approval')\n  }\n\n  let link: CrossOrgLink\n  if (action === 'reactivate' && existing) {\n    const [row] = await db\n      .update(crossOrgLinks)\n      .set({ linkType: params.linkType, status: 'pending', rejectionReason: null, updatedAt: new Date() })\n      .where(eq(crossOrgLinks.id, existing.id))\n      .returning()\n    link = row\n  } else {\n    const [row] = await db\n      .insert(crossOrgLinks)\n      .values({\n        sourceOrgId: params.sourceOrgId,\n        sourceEntityType: params.sourceEntityType,\n        sourceEntityId: params.sourceEntityId,\n        targetOrgId: params.targetOrgId,\n        targetEntityType: params.targetEntityType,\n        targetEntityId: params.targetEntityId,\n        linkType: params.linkType,\n        status: 'pending',\n        createdBy: params.actorUserId,\n      })\n      .returning()\n    link = row\n  }\n\n  await writeAuditLog(db, {\n    action: 'federation.cross_org_link.request',\n    entityType: 'cross_org_link',\n    entityId: link.id,\n    userId: params.actorUserId,\n    organizationId: params.sourceOrgId,\n    after: {\n      sourceEntityId: params.sourceEntityId,\n      targetEntityId: params.targetEntityId,\n      linkType: params.linkType,\n      targetOrgId: params.targetOrgId,\n    },\n  })\n  return link\n}\n\n/** Internal: a target-org-only status transition with an audit row. */\nasync function transitionByTarget(\n  db: GovcoreDb,\n  params: { linkId: string; orgId: string; actorUserId: string; reason?: string },\n  status: 'active' | 'rejected',\n  action: string,\n): Promise<CrossOrgLink> {\n  const [link] = await db\n    .select()\n    .from(crossOrgLinks)\n    .where(and(eq(crossOrgLinks.id, params.linkId), eq(crossOrgLinks.targetOrgId, params.orgId)))\n    .limit(1)\n  if (!link) throw new Error('Cross-org link not found or not authorized')\n  if (link.status !== 'pending') throw new Error('Only pending links can be approved or rejected')\n\n  const [row] = await db\n    .update(crossOrgLinks)\n    .set({\n      status,\n      rejectionReason: status === 'rejected' && params.reason?.trim() ? params.reason.trim() : null,\n      updatedAt: new Date(),\n    })\n    .where(eq(crossOrgLinks.id, params.linkId))\n    .returning()\n\n  await writeAuditLog(db, {\n    action,\n    entityType: 'cross_org_link',\n    entityId: params.linkId,\n    userId: params.actorUserId,\n    organizationId: params.orgId,\n    after: { sourceEntityId: link.sourceEntityId, targetEntityId: link.targetEntityId },\n  })\n  return row\n}\n\nexport interface LinkDecisionParams {\n  linkId: string\n  /** The acting org — must be the link's target org. */\n  orgId: string\n  actorUserId: string\n}\n\n/** Approve a pending link. Target org only. Audited. */\nexport async function approveCrossOrgLink(\n  db: GovcoreDb,\n  params: LinkDecisionParams,\n): Promise<CrossOrgLink> {\n  return transitionByTarget(db, params, 'active', 'federation.cross_org_link.approve')\n}\n\n/** Reject a pending link with an optional reason. Target org only. Audited. */\nexport async function rejectCrossOrgLink(\n  db: GovcoreDb,\n  params: LinkDecisionParams & { reason?: string },\n): Promise<CrossOrgLink> {\n  return transitionByTarget(db, params, 'rejected', 'federation.cross_org_link.reject')\n}\n\n/** Internal: delete a link the acting org owns on the given side, audited. */\nasync function deleteOwnedLink(\n  db: GovcoreDb,\n  params: { linkId: string; orgId: string; actorUserId: string; requireActive?: boolean },\n  ownerColumn: typeof crossOrgLinks.sourceOrgId | typeof crossOrgLinks.targetOrgId,\n  action: string,\n): Promise<CrossOrgLink> {\n  const [link] = await db\n    .select()\n    .from(crossOrgLinks)\n    .where(and(eq(crossOrgLinks.id, params.linkId), eq(ownerColumn, params.orgId)))\n    .limit(1)\n  if (!link) throw new Error('Cross-org link not found or not authorized')\n  if (params.requireActive && link.status !== 'active') {\n    throw new Error('Only active links can be revoked')\n  }\n\n  await db.delete(crossOrgLinks).where(eq(crossOrgLinks.id, params.linkId))\n\n  await writeAuditLog(db, {\n    action,\n    entityType: 'cross_org_link',\n    entityId: params.linkId,\n    userId: params.actorUserId,\n    organizationId: params.orgId,\n    before: {\n      sourceEntityId: link.sourceEntityId,\n      targetEntityId: link.targetEntityId,\n      status: link.status,\n    },\n  })\n  return link\n}\n\n/** Withdraw a link the *source* org proposed (any status). Audited. */\nexport async function withdrawCrossOrgLink(\n  db: GovcoreDb,\n  params: LinkDecisionParams,\n): Promise<CrossOrgLink> {\n  return deleteOwnedLink(db, params, crossOrgLinks.sourceOrgId, 'federation.cross_org_link.withdraw')\n}\n\n/** Revoke an active link from the *target* org. Audited. */\nexport async function revokeCrossOrgLink(\n  db: GovcoreDb,\n  params: LinkDecisionParams,\n): Promise<CrossOrgLink> {\n  return deleteOwnedLink(\n    db,\n    { ...params, requireActive: true },\n    crossOrgLinks.targetOrgId,\n    'federation.cross_org_link.revoke',\n  )\n}\n\n/**\n * Flag every pending/active link touching an entity for review — used when the\n * entity's visibility drops so both orgs are alerted the link may no longer be\n * accessible. Caller must have verified the entity belongs to its org.\n */\nexport async function flagLinksForVisibilityDrop(\n  db: GovcoreDb,\n  entityType: string,\n  entityId: string,\n  reason: string,\n): Promise<void> {\n  await db\n    .update(crossOrgLinks)\n    .set({ flaggedForReview: true, flagReason: reason, updatedAt: new Date() })\n    .where(and(touchesEntity(entityType, entityId), inArray(crossOrgLinks.status, ['pending', 'active'])))\n}\n\n/** Clear review flags on an entity's links — used when visibility is raised back. */\nexport async function clearLinksFlag(\n  db: GovcoreDb,\n  entityType: string,\n  entityId: string,\n): Promise<void> {\n  await db\n    .update(crossOrgLinks)\n    .set({ flaggedForReview: false, flagReason: null, updatedAt: new Date() })\n    .where(and(touchesEntity(entityType, entityId), eq(crossOrgLinks.flaggedForReview, true)))\n}\n\n/**\n * Delete every cross-org link between two orgs — called when their connection is\n * removed. Audits a snapshot of the removed links (when any) under the actor.\n * Returns the removed rows.\n */\nexport async function removeLinksForConnection(\n  db: GovcoreDb,\n  orgAId: string,\n  orgBId: string,\n  actorUserId: string,\n  actorOrgId: string,\n): Promise<CrossOrgLink[]> {\n  const affected = await db.select().from(crossOrgLinks).where(betweenOrgs(orgAId, orgBId))\n  if (affected.length === 0) return []\n\n  await db.delete(crossOrgLinks).where(betweenOrgs(orgAId, orgBId))\n\n  await writeAuditLog(db, {\n    action: 'federation.cross_org_link.remove_for_connection',\n    entityType: 'org_connection',\n    userId: actorUserId,\n    organizationId: actorOrgId,\n    before: {\n      orgAId,\n      orgBId,\n      removedLinkIds: affected.map((l) => l.id),\n    },\n  })\n  return affected\n}\n"],"mappings":";AAQA,SAAS,KAAK,IAAI,UAAU;AAC5B,SAAS,sBAAsC;AAC/C,SAAS,qBAAqB;AAK9B,eAAsB,eAAe,IAAe,OAAyC;AAC3F,SAAO,GACJ,OAAO,EACP,KAAK,cAAc,EACnB,MAAM,GAAG,GAAG,eAAe,WAAW,KAAK,GAAG,GAAG,eAAe,SAAS,KAAK,CAAC,CAAC;AACrF;AAGA,eAAsB,sBACpB,IACA,OACA,aAC+B;AAC/B,QAAM,CAAC,QAAQ,IAAI,MAAM,GACtB,OAAO,EACP,KAAK,cAAc,EACnB;AAAA,IACC;AAAA,MACE,IAAI,GAAG,eAAe,WAAW,KAAK,GAAG,GAAG,eAAe,SAAS,WAAW,CAAC;AAAA,MAChF,IAAI,GAAG,eAAe,WAAW,WAAW,GAAG,GAAG,eAAe,SAAS,KAAK,CAAC;AAAA,IAClF;AAAA,EACF,EACC,MAAM,CAAC;AACV,SAAO,YAAY;AACrB;AAeA,eAAsB,kBACpB,IACA,QACwB;AACxB,MAAI,OAAO,UAAU,OAAO,aAAa;AACvC,UAAM,IAAI,MAAM,0CAA0C;AAAA,EAC5D;AACA,QAAM,WAAW,MAAM,sBAAsB,IAAI,OAAO,OAAO,OAAO,WAAW;AACjF,MAAI,SAAU,OAAM,IAAI,MAAM,yCAAyC;AAEvE,QAAM,CAAC,UAAU,IAAI,MAAM,GACxB,OAAO,cAAc,EACrB,OAAO;AAAA,IACN,WAAW,OAAO;AAAA,IAClB,SAAS,OAAO;AAAA,IAChB,QAAQ;AAAA,IACR,WAAW,OAAO;AAAA,EACpB,CAAC,EACA,UAAU;AAEb,QAAM,cAAc,IAAI;AAAA,IACtB,QAAQ;AAAA,IACR,YAAY;AAAA,IACZ,UAAU,WAAW;AAAA,IACrB,QAAQ,OAAO;AAAA,IACf,gBAAgB,OAAO;AAAA,IACvB,OAAO,EAAE,aAAa,OAAO,YAAY;AAAA,EAC3C,CAAC;AACD,SAAO;AACT;AAGA,eAAe,mBACb,IACA,QACA,QACA,QACwB;AAExB,QAAM,CAAC,GAAG,IAAI,MAAM,GACjB,OAAO,cAAc,EACrB,IAAI,EAAE,QAAQ,WAAW,oBAAI,KAAK,EAAE,CAAC,EACrC;AAAA,IACC;AAAA,MACE,GAAG,eAAe,IAAI,OAAO,YAAY;AAAA,MACzC,GAAG,eAAe,SAAS,OAAO,KAAK;AAAA,IACzC;AAAA,EACF,EACC,UAAU;AACb,MAAI,CAAC,IAAK,OAAM,IAAI,MAAM,wCAAwC;AAElE,QAAM,cAAc,IAAI;AAAA,IACtB;AAAA,IACA,YAAY;AAAA,IACZ,UAAU,OAAO;AAAA,IACjB,QAAQ,OAAO;AAAA,IACf,gBAAgB,OAAO;AAAA,EACzB,CAAC;AACD,SAAO;AACT;AAUA,eAAsB,iBACpB,IACA,QACwB;AACxB,SAAO,mBAAmB,IAAI,QAAQ,UAAU,8BAA8B;AAChF;AAGA,eAAsB,iBACpB,IACA,QACwB;AACxB,SAAO,mBAAmB,IAAI,QAAQ,YAAY,8BAA8B;AAClF;;;AC/HA,SAAS,OAAAA,MAAK,MAAAC,KAAI,SAAS,MAAAC,WAAoB;AAE/C,SAAS,kBAAAC,uBAAsC;AAaxC,SAAS,eAAe,OAAiD;AAC9E,SAAO,UAAU,cAAc,cAAc;AAC/C;AAYO,SAAS,gBACd,MACA,MACK;AACL,QAAM,OAAOF,IAAG,KAAK,gBAAgB,KAAK,KAAK;AAC/C,MAAI,KAAK,UAAU,MAAO,QAAO;AAEjC,QAAM,eAAeA,IAAG,KAAK,YAAY,UAAU;AACnD,QAAM,kBAAkB,KAAK,mBAAmB,CAAC;AACjD,MAAI,gBAAgB,WAAW,EAAG,QAAOC,IAAG,MAAM,YAAY;AAC9D,SAAOA;AAAA,IACL;AAAA,IACA;AAAA,IACAF;AAAA,MACE,QAAQ,KAAK,gBAAgB,eAAe;AAAA,MAC5C,QAAQ,KAAK,YAAY,CAAC,eAAe,UAAU,CAAC;AAAA,IACtD;AAAA,EACF;AACF;AAMO,SAAS,gBACd,aACA,aACM;AACN,MAAI,CAAC,eAAe,gBAAgB,aAAa;AAC/C,UAAM,IAAI,MAAM,kDAAkD;AAAA,EACpE;AACF;AAGA,eAAsB,mBACpB,IACA,gBACmB;AACnB,QAAM,OAAO,MAAM,GAChB,OAAO,EAAE,WAAWG,gBAAe,WAAW,SAASA,gBAAe,QAAQ,CAAC,EAC/E,KAAKA,eAAc,EACnB;AAAA,IACCH;AAAA,MACEE;AAAA,QACED,IAAGE,gBAAe,WAAW,cAAc;AAAA,QAC3CF,IAAGE,gBAAe,SAAS,cAAc;AAAA,MAC3C;AAAA,MACAF,IAAGE,gBAAe,QAAQ,QAAQ;AAAA,IACpC;AAAA,EACF;AACF,SAAO,KAAK,IAAI,CAAC,MAAO,EAAE,cAAc,iBAAiB,EAAE,UAAU,EAAE,SAAU;AACnF;AAOA,eAAsB,uBACpB,IACA,aACA,YACA,aACkB;AAClB,MAAI,CAAC,eAAe,CAAC,WAAY,QAAO;AACxC,MAAI,gBAAgB,YAAa,QAAO;AACxC,MAAI,eAAe,WAAY,QAAO;AACtC,MAAI,eAAe,cAAe,QAAO;AAEzC,QAAM,kBAAkB,MAAM,mBAAmB,IAAI,WAAW;AAChE,SAAO,gBAAgB,SAAS,WAAW;AAC7C;;;ACnGA,SAAS,OAAAC,MAAK,MAAAC,KAAI,WAAAC,UAAS,MAAAC,WAAU;AACrC,SAAS,qBAAqC;AAC9C,SAAS,iBAAAC,sBAAqB;AAWvB,SAAS,mBACd,UACmB;AACnB,MAAI,CAAC,SAAU,QAAO;AACtB,MAAI,SAAS,WAAW,aAAa,SAAS,WAAW,SAAU,QAAO;AAC1E,SAAO;AACT;AAEA,IAAM,gBAAgB,CAAC,YAAoB,aACzCD;AAAA,EACEH,KAAIC,IAAG,cAAc,kBAAkB,UAAU,GAAGA,IAAG,cAAc,gBAAgB,QAAQ,CAAC;AAAA,EAC9FD,KAAIC,IAAG,cAAc,kBAAkB,UAAU,GAAGA,IAAG,cAAc,gBAAgB,QAAQ,CAAC;AAChG;AAEF,IAAM,cAAc,CAAC,QAAgB,WACnCE;AAAA,EACEH,KAAIC,IAAG,cAAc,aAAa,MAAM,GAAGA,IAAG,cAAc,aAAa,MAAM,CAAC;AAAA,EAChFD,KAAIC,IAAG,cAAc,aAAa,MAAM,GAAGA,IAAG,cAAc,aAAa,MAAM,CAAC;AAClF;AAGF,eAAsB,iBAAiB,IAAe,OAAwC;AAC5F,SAAO,GACJ,OAAO,EACP,KAAK,aAAa,EAClB,MAAME,IAAGF,IAAG,cAAc,aAAa,KAAK,GAAGA,IAAG,cAAc,aAAa,KAAK,CAAC,CAAC;AACzF;AAGA,eAAsB,kBACpB,IACA,YACA,UACyB;AACzB,SAAO,GAAG,OAAO,EAAE,KAAK,aAAa,EAAE,MAAM,cAAc,YAAY,QAAQ,CAAC;AAClF;AAUA,eAAsB,iBACpB,IACA,MAC8B;AAC9B,QAAM,CAAC,GAAG,IAAI,MAAM,GACjB,OAAO,EACP,KAAK,aAAa,EAClB;AAAA,IACCD;AAAA,MACEC,IAAG,cAAc,kBAAkB,KAAK,gBAAgB;AAAA,MACxDA,IAAG,cAAc,gBAAgB,KAAK,cAAc;AAAA,MACpDA,IAAG,cAAc,kBAAkB,KAAK,gBAAgB;AAAA,MACxDA,IAAG,cAAc,gBAAgB,KAAK,cAAc;AAAA,IACtD;AAAA,EACF,EACC,MAAM,CAAC;AACV,SAAO,OAAO;AAChB;AAcA,eAAsB,oBACpB,IACA,QACuB;AACvB,MAAI,OAAO,gBAAgB,OAAO,aAAa;AAC7C,UAAM,IAAI,MAAM,8DAA8D;AAAA,EAChF;AAEA,QAAM,WAAW,MAAM,iBAAiB,IAAI,MAAM;AAClD,QAAM,SAAS,mBAAmB,QAAQ;AAC1C,MAAI,WAAW,SAAS;AACtB,UAAM,IAAI,MAAM,yDAAyD;AAAA,EAC3E;AAEA,MAAI;AACJ,MAAI,WAAW,gBAAgB,UAAU;AACvC,UAAM,CAAC,GAAG,IAAI,MAAM,GACjB,OAAO,aAAa,EACpB,IAAI,EAAE,UAAU,OAAO,UAAU,QAAQ,WAAW,iBAAiB,MAAM,WAAW,oBAAI,KAAK,EAAE,CAAC,EAClG,MAAMA,IAAG,cAAc,IAAI,SAAS,EAAE,CAAC,EACvC,UAAU;AACb,WAAO;AAAA,EACT,OAAO;AACL,UAAM,CAAC,GAAG,IAAI,MAAM,GACjB,OAAO,aAAa,EACpB,OAAO;AAAA,MACN,aAAa,OAAO;AAAA,MACpB,kBAAkB,OAAO;AAAA,MACzB,gBAAgB,OAAO;AAAA,MACvB,aAAa,OAAO;AAAA,MACpB,kBAAkB,OAAO;AAAA,MACzB,gBAAgB,OAAO;AAAA,MACvB,UAAU,OAAO;AAAA,MACjB,QAAQ;AAAA,MACR,WAAW,OAAO;AAAA,IACpB,CAAC,EACA,UAAU;AACb,WAAO;AAAA,EACT;AAEA,QAAMG,eAAc,IAAI;AAAA,IACtB,QAAQ;AAAA,IACR,YAAY;AAAA,IACZ,UAAU,KAAK;AAAA,IACf,QAAQ,OAAO;AAAA,IACf,gBAAgB,OAAO;AAAA,IACvB,OAAO;AAAA,MACL,gBAAgB,OAAO;AAAA,MACvB,gBAAgB,OAAO;AAAA,MACvB,UAAU,OAAO;AAAA,MACjB,aAAa,OAAO;AAAA,IACtB;AAAA,EACF,CAAC;AACD,SAAO;AACT;AAGA,eAAeC,oBACb,IACA,QACA,QACA,QACuB;AACvB,QAAM,CAAC,IAAI,IAAI,MAAM,GAClB,OAAO,EACP,KAAK,aAAa,EAClB,MAAML,KAAIC,IAAG,cAAc,IAAI,OAAO,MAAM,GAAGA,IAAG,cAAc,aAAa,OAAO,KAAK,CAAC,CAAC,EAC3F,MAAM,CAAC;AACV,MAAI,CAAC,KAAM,OAAM,IAAI,MAAM,4CAA4C;AACvE,MAAI,KAAK,WAAW,UAAW,OAAM,IAAI,MAAM,gDAAgD;AAE/F,QAAM,CAAC,GAAG,IAAI,MAAM,GACjB,OAAO,aAAa,EACpB,IAAI;AAAA,IACH;AAAA,IACA,iBAAiB,WAAW,cAAc,OAAO,QAAQ,KAAK,IAAI,OAAO,OAAO,KAAK,IAAI;AAAA,IACzF,WAAW,oBAAI,KAAK;AAAA,EACtB,CAAC,EACA,MAAMA,IAAG,cAAc,IAAI,OAAO,MAAM,CAAC,EACzC,UAAU;AAEb,QAAMG,eAAc,IAAI;AAAA,IACtB;AAAA,IACA,YAAY;AAAA,IACZ,UAAU,OAAO;AAAA,IACjB,QAAQ,OAAO;AAAA,IACf,gBAAgB,OAAO;AAAA,IACvB,OAAO,EAAE,gBAAgB,KAAK,gBAAgB,gBAAgB,KAAK,eAAe;AAAA,EACpF,CAAC;AACD,SAAO;AACT;AAUA,eAAsB,oBACpB,IACA,QACuB;AACvB,SAAOC,oBAAmB,IAAI,QAAQ,UAAU,mCAAmC;AACrF;AAGA,eAAsB,mBACpB,IACA,QACuB;AACvB,SAAOA,oBAAmB,IAAI,QAAQ,YAAY,kCAAkC;AACtF;AAGA,eAAe,gBACb,IACA,QACA,aACA,QACuB;AACvB,QAAM,CAAC,IAAI,IAAI,MAAM,GAClB,OAAO,EACP,KAAK,aAAa,EAClB,MAAML,KAAIC,IAAG,cAAc,IAAI,OAAO,MAAM,GAAGA,IAAG,aAAa,OAAO,KAAK,CAAC,CAAC,EAC7E,MAAM,CAAC;AACV,MAAI,CAAC,KAAM,OAAM,IAAI,MAAM,4CAA4C;AACvE,MAAI,OAAO,iBAAiB,KAAK,WAAW,UAAU;AACpD,UAAM,IAAI,MAAM,kCAAkC;AAAA,EACpD;AAEA,QAAM,GAAG,OAAO,aAAa,EAAE,MAAMA,IAAG,cAAc,IAAI,OAAO,MAAM,CAAC;AAExE,QAAMG,eAAc,IAAI;AAAA,IACtB;AAAA,IACA,YAAY;AAAA,IACZ,UAAU,OAAO;AAAA,IACjB,QAAQ,OAAO;AAAA,IACf,gBAAgB,OAAO;AAAA,IACvB,QAAQ;AAAA,MACN,gBAAgB,KAAK;AAAA,MACrB,gBAAgB,KAAK;AAAA,MACrB,QAAQ,KAAK;AAAA,IACf;AAAA,EACF,CAAC;AACD,SAAO;AACT;AAGA,eAAsB,qBACpB,IACA,QACuB;AACvB,SAAO,gBAAgB,IAAI,QAAQ,cAAc,aAAa,oCAAoC;AACpG;AAGA,eAAsB,mBACpB,IACA,QACuB;AACvB,SAAO;AAAA,IACL;AAAA,IACA,EAAE,GAAG,QAAQ,eAAe,KAAK;AAAA,IACjC,cAAc;AAAA,IACd;AAAA,EACF;AACF;AAOA,eAAsB,2BACpB,IACA,YACA,UACA,QACe;AACf,QAAM,GACH,OAAO,aAAa,EACpB,IAAI,EAAE,kBAAkB,MAAM,YAAY,QAAQ,WAAW,oBAAI,KAAK,EAAE,CAAC,EACzE,MAAMJ,KAAI,cAAc,YAAY,QAAQ,GAAGE,SAAQ,cAAc,QAAQ,CAAC,WAAW,QAAQ,CAAC,CAAC,CAAC;AACzG;AAGA,eAAsB,eACpB,IACA,YACA,UACe;AACf,QAAM,GACH,OAAO,aAAa,EACpB,IAAI,EAAE,kBAAkB,OAAO,YAAY,MAAM,WAAW,oBAAI,KAAK,EAAE,CAAC,EACxE,MAAMF,KAAI,cAAc,YAAY,QAAQ,GAAGC,IAAG,cAAc,kBAAkB,IAAI,CAAC,CAAC;AAC7F;AAOA,eAAsB,yBACpB,IACA,QACA,QACA,aACA,YACyB;AACzB,QAAM,WAAW,MAAM,GAAG,OAAO,EAAE,KAAK,aAAa,EAAE,MAAM,YAAY,QAAQ,MAAM,CAAC;AACxF,MAAI,SAAS,WAAW,EAAG,QAAO,CAAC;AAEnC,QAAM,GAAG,OAAO,aAAa,EAAE,MAAM,YAAY,QAAQ,MAAM,CAAC;AAEhE,QAAMG,eAAc,IAAI;AAAA,IACtB,QAAQ;AAAA,IACR,YAAY;AAAA,IACZ,QAAQ;AAAA,IACR,gBAAgB;AAAA,IAChB,QAAQ;AAAA,MACN;AAAA,MACA;AAAA,MACA,gBAAgB,SAAS,IAAI,CAAC,MAAM,EAAE,EAAE;AAAA,IAC1C;AAAA,EACF,CAAC;AACD,SAAO;AACT;","names":["and","eq","or","orgConnections","and","eq","inArray","or","writeAuditLog","transitionByTarget"]}

package/package.json

@@ -1,14 +1,14 @@
 {
   "name": "@govcore/federation",
-  "version": "0.2.0",
+  "version": "0.2.2",
   "description": "Cross-organization connections and federated-visibility query helpers",
   "type": "module",
-  "main": "./src/index.ts",
-  "types": "./src/index.ts",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
   "exports": {
     ".": {
-      "types": "./src/index.ts",
-      "default": "./src/index.ts"
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
     }
   },
   "publishConfig": {
@@ -16,14 +16,30 @@
   },
   "dependencies": {
     "drizzle-orm": "^0.45.2",
-    "@govcore/audit": "0.1.0",
-    "@govcore/schema": "0.1.0"
+    "@govcore/audit": "0.1.2",
+    "@govcore/schema": "0.2.1"
   },
   "devDependencies": {
-    "typescript": "^5.5.0"
+    "typescript": "^5.5.0",
+    "tsup": "^8.3.0"
+  },
+  "module": "./dist/index.js",
+  "files": [
+    "dist"
+  ],
+  "tsup": {
+    "entry": [
+      "src/index.ts"
+    ],
+    "format": [
+      "esm"
+    ],
+    "dts": true,
+    "clean": true,
+    "sourcemap": true
   },
   "scripts": {
-    "build": "tsc -p tsconfig.json",
-    "dev": "tsc -p tsconfig.json --watch"
+    "build": "tsup",
+    "dev": "tsup --watch"
   }
 }

package/CHANGELOG.md

@@ -1,39 +0,0 @@
-# @govcore/federation
-
-## 0.2.0
-
-### Minor Changes
-
-- 1d1794f: Add the cross-org content-link lifecycle to `@govcore/federation`. Entity types
-  and `linkType` are app-defined strings; the app validates entity
-  ownership/visibility, this owns the link record:
-
-  - reads — `getCrossOrgLinks`, `getLinksForEntity`, `findCrossOrgLink`;
-  - lifecycle (audited) — `requestCrossOrgLink` (blocks an existing pending/active
-    pair, reactivates a rejected one), `approveCrossOrgLink` / `rejectCrossOrgLink`
-    (target org only), `withdrawCrossOrgLink` (source org), `revokeCrossOrgLink`
-    (target org, active only);
-  - review flags + connection cleanup — `flagLinksForVisibilityDrop`,
-    `clearLinksFlag`, `removeLinksForConnection`;
-  - pure helper `resolveLinkRequest`.
-
-## 0.1.0
-
-### Minor Changes
-
-- Phase 4 — `@govcore/federation`: cross-organization connections and federated
-  visibility.
-
-  connections: the bilateral request / accept / reject lifecycle (audited; only
-  the target org may accept or reject), with `getConnections` /
-  `findConnectionBetween`. visibility: `FederationVisibility` / `ListScope`,
-  `parseListScope`, the generic `listScopeFilter`, `assertOwnership`,
-  `getConnectedOrgIds`, and `canReadFederatedEntity`. Cross-org content links are
-  not part of this release.
-
-### Patch Changes
-
-- Updated dependencies
-- Updated dependencies [f2f3743]
-  - @govcore/audit@0.1.0
-  - @govcore/schema@0.1.0

package/dist/connections.d.ts

@@ -1,30 +0,0 @@
-import { orgConnections, type GovcoreDb } from '@govcore/schema';
-export type OrgConnection = typeof orgConnections.$inferSelect;
-/** All connections touching `orgId`, in either direction. */
-export declare function getConnections(db: GovcoreDb, orgId: string): Promise<OrgConnection[]>;
-/** An existing connection between two orgs in either direction, or null. */
-export declare function findConnectionBetween(db: GovcoreDb, orgId: string, targetOrgId: string): Promise<OrgConnection | null>;
-export interface RequestConnectionParams {
-    /** The org opening the connection. */
-    orgId: string;
-    /** The org being invited. */
-    targetOrgId: string;
-    /** The acting user (recorded as `created_by` and on the audit row). */
-    actorUserId: string;
-}
-/**
- * Open a pending connection from `orgId` to `targetOrgId`. Throws if a
- * connection already exists in either direction. Audited.
- */
-export declare function requestConnection(db: GovcoreDb, params: RequestConnectionParams): Promise<OrgConnection>;
-export interface ConnectionDecisionParams {
-    connectionId: string;
-    /** The org acting — must be the connection's target org. */
-    orgId: string;
-    actorUserId: string;
-}
-/** Accept a pending connection. Only the target org may accept. Audited. */
-export declare function acceptConnection(db: GovcoreDb, params: ConnectionDecisionParams): Promise<OrgConnection>;
-/** Reject a pending connection. Only the target org may reject. Audited. */
-export declare function rejectConnection(db: GovcoreDb, params: ConnectionDecisionParams): Promise<OrgConnection>;
-//# sourceMappingURL=connections.d.ts.map

package/dist/connections.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"connections.d.ts","sourceRoot":"","sources":["../src/connections.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,cAAc,EAAE,KAAK,SAAS,EAAE,MAAM,iBAAiB,CAAA;AAGhE,MAAM,MAAM,aAAa,GAAG,OAAO,cAAc,CAAC,YAAY,CAAA;AAE9D,6DAA6D;AAC7D,wBAAsB,cAAc,CAAC,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC,CAK3F;AAED,4EAA4E;AAC5E,wBAAsB,qBAAqB,CACzC,EAAE,EAAE,SAAS,EACb,KAAK,EAAE,MAAM,EACb,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAY/B;AAED,MAAM,WAAW,uBAAuB;IACtC,sCAAsC;IACtC,KAAK,EAAE,MAAM,CAAA;IACb,6BAA6B;IAC7B,WAAW,EAAE,MAAM,CAAA;IACnB,uEAAuE;IACvE,WAAW,EAAE,MAAM,CAAA;CACpB;AAED;;;GAGG;AACH,wBAAsB,iBAAiB,CACrC,EAAE,EAAE,SAAS,EACb,MAAM,EAAE,uBAAuB,GAC9B,OAAO,CAAC,aAAa,CAAC,CA0BxB;AAgCD,MAAM,WAAW,wBAAwB;IACvC,YAAY,EAAE,MAAM,CAAA;IACpB,4DAA4D;IAC5D,KAAK,EAAE,MAAM,CAAA;IACb,WAAW,EAAE,MAAM,CAAA;CACpB;AAED,4EAA4E;AAC5E,wBAAsB,gBAAgB,CACpC,EAAE,EAAE,SAAS,EACb,MAAM,EAAE,wBAAwB,GAC/B,OAAO,CAAC,aAAa,CAAC,CAExB;AAED,4EAA4E;AAC5E,wBAAsB,gBAAgB,CACpC,EAAE,EAAE,SAAS,EACb,MAAM,EAAE,wBAAwB,GAC/B,OAAO,CAAC,aAAa,CAAC,CAExB"}