@govcore/federation 0.2.0 → 0.2.2

package/dist/connections.js

@@ -1,83 +0,0 @@
-// @govcore/federation/connections — the org-to-org connection lifecycle.
-//
-// A connection is a bilateral, explicit link between two orgs. The requester's
-// org opens it (`pending`); only the *target* org may accept (`active`) or
-// reject (`rejected`). An active connection is what `getConnectedOrgIds` and the
-// federated read checks key off. Each transition is audited. App-layer auth
-// (who is an admin, whose org is acting) stays in the caller.
-import { and, eq, or } from 'drizzle-orm';
-import { orgConnections } from '@govcore/schema';
-import { writeAuditLog } from '@govcore/audit';
-/** All connections touching `orgId`, in either direction. */
-export async function getConnections(db, orgId) {
-    return db
-        .select()
-        .from(orgConnections)
-        .where(or(eq(orgConnections.fromOrgId, orgId), eq(orgConnections.toOrgId, orgId)));
-}
-/** An existing connection between two orgs in either direction, or null. */
-export async function findConnectionBetween(db, orgId, targetOrgId) {
-    const [existing] = await db
-        .select()
-        .from(orgConnections)
-        .where(or(and(eq(orgConnections.fromOrgId, orgId), eq(orgConnections.toOrgId, targetOrgId)), and(eq(orgConnections.fromOrgId, targetOrgId), eq(orgConnections.toOrgId, orgId))))
-        .limit(1);
-    return existing ?? null;
-}
-/**
- * Open a pending connection from `orgId` to `targetOrgId`. Throws if a
- * connection already exists in either direction. Audited.
- */
-export async function requestConnection(db, params) {
-    if (params.orgId === params.targetOrgId) {
-        throw new Error('Cannot connect an organization to itself');
-    }
-    const existing = await findConnectionBetween(db, params.orgId, params.targetOrgId);
-    if (existing)
-        throw new Error('Connection already exists or is pending');
-    const [connection] = await db
-        .insert(orgConnections)
-        .values({
-        fromOrgId: params.orgId,
-        toOrgId: params.targetOrgId,
-        status: 'pending',
-        createdBy: params.actorUserId,
-    })
-        .returning();
-    await writeAuditLog(db, {
-        action: 'federation.connection.request',
-        entityType: 'org_connection',
-        entityId: connection.id,
-        userId: params.actorUserId,
-        organizationId: params.orgId,
-        after: { targetOrgId: params.targetOrgId },
-    });
-    return connection;
-}
-/** Internal: a target-only status transition with an audit row. */
-async function transitionByTarget(db, params, status, action) {
-    // Only the target org (toOrgId) may accept or reject.
-    const [row] = await db
-        .update(orgConnections)
-        .set({ status, updatedAt: new Date() })
-        .where(and(eq(orgConnections.id, params.connectionId), eq(orgConnections.toOrgId, params.orgId)))
-        .returning();
-    if (!row)
-        throw new Error('Connection not found or not authorized');
-    await writeAuditLog(db, {
-        action,
-        entityType: 'org_connection',
-        entityId: params.connectionId,
-        userId: params.actorUserId,
-        organizationId: params.orgId,
-    });
-    return row;
-}
-/** Accept a pending connection. Only the target org may accept. Audited. */
-export async function acceptConnection(db, params) {
-    return transitionByTarget(db, params, 'active', 'federation.connection.accept');
-}
-/** Reject a pending connection. Only the target org may reject. Audited. */
-export async function rejectConnection(db, params) {
-    return transitionByTarget(db, params, 'rejected', 'federation.connection.reject');
-}

package/dist/index.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAYA,cAAc,eAAe,CAAA;AAC7B,cAAc,cAAc,CAAA;AAC5B,cAAc,SAAS,CAAA"}

package/dist/links.d.ts

@@ -1,64 +0,0 @@
-import { crossOrgLinks, type GovcoreDb } from '@govcore/schema';
-export type CrossOrgLink = typeof crossOrgLinks.$inferSelect;
-/** What to do with a link request given any existing link for the same pair. */
-export type LinkRequestAction = 'block' | 'reactivate' | 'create';
-/**
- * Pure: a pending/active link blocks a new request; a previously rejected one is
- * reactivated; otherwise a fresh link is created.
- */
-export declare function resolveLinkRequest(existing: Pick<CrossOrgLink, 'status'> | null | undefined): LinkRequestAction;
-/** All links where `orgId` is either the source or target org. */
-export declare function getCrossOrgLinks(db: GovcoreDb, orgId: string): Promise<CrossOrgLink[]>;
-/** All links touching a given entity (on either side). */
-export declare function getLinksForEntity(db: GovcoreDb, entityType: string, entityId: string): Promise<CrossOrgLink[]>;
-export interface LinkEndpoints {
-    sourceEntityType: string;
-    sourceEntityId: string;
-    targetEntityType: string;
-    targetEntityId: string;
-}
-/** The existing link for an exact source→target entity pair, or null. */
-export declare function findCrossOrgLink(db: GovcoreDb, ends: LinkEndpoints): Promise<CrossOrgLink | null>;
-export interface RequestCrossOrgLinkParams extends LinkEndpoints {
-    sourceOrgId: string;
-    targetOrgId: string;
-    linkType: string;
-    actorUserId: string;
-}
-/**
- * Propose a cross-org link. Blocks if a pending/active link for the pair already
- * exists; reactivates a previously rejected one; otherwise creates a pending
- * link. Audited. Entity ownership/visibility must be validated by the caller.
- */
-export declare function requestCrossOrgLink(db: GovcoreDb, params: RequestCrossOrgLinkParams): Promise<CrossOrgLink>;
-export interface LinkDecisionParams {
-    linkId: string;
-    /** The acting org — must be the link's target org. */
-    orgId: string;
-    actorUserId: string;
-}
-/** Approve a pending link. Target org only. Audited. */
-export declare function approveCrossOrgLink(db: GovcoreDb, params: LinkDecisionParams): Promise<CrossOrgLink>;
-/** Reject a pending link with an optional reason. Target org only. Audited. */
-export declare function rejectCrossOrgLink(db: GovcoreDb, params: LinkDecisionParams & {
-    reason?: string;
-}): Promise<CrossOrgLink>;
-/** Withdraw a link the *source* org proposed (any status). Audited. */
-export declare function withdrawCrossOrgLink(db: GovcoreDb, params: LinkDecisionParams): Promise<CrossOrgLink>;
-/** Revoke an active link from the *target* org. Audited. */
-export declare function revokeCrossOrgLink(db: GovcoreDb, params: LinkDecisionParams): Promise<CrossOrgLink>;
-/**
- * Flag every pending/active link touching an entity for review — used when the
- * entity's visibility drops so both orgs are alerted the link may no longer be
- * accessible. Caller must have verified the entity belongs to its org.
- */
-export declare function flagLinksForVisibilityDrop(db: GovcoreDb, entityType: string, entityId: string, reason: string): Promise<void>;
-/** Clear review flags on an entity's links — used when visibility is raised back. */
-export declare function clearLinksFlag(db: GovcoreDb, entityType: string, entityId: string): Promise<void>;
-/**
- * Delete every cross-org link between two orgs — called when their connection is
- * removed. Audits a snapshot of the removed links (when any) under the actor.
- * Returns the removed rows.
- */
-export declare function removeLinksForConnection(db: GovcoreDb, orgAId: string, orgBId: string, actorUserId: string, actorOrgId: string): Promise<CrossOrgLink[]>;
-//# sourceMappingURL=links.d.ts.map

package/dist/links.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"links.d.ts","sourceRoot":"","sources":["../src/links.ts"],"names":[],"mappings":"AAWA,OAAO,EAAE,aAAa,EAAE,KAAK,SAAS,EAAE,MAAM,iBAAiB,CAAA;AAG/D,MAAM,MAAM,YAAY,GAAG,OAAO,aAAa,CAAC,YAAY,CAAA;AAE5D,gFAAgF;AAChF,MAAM,MAAM,iBAAiB,GAAG,OAAO,GAAG,YAAY,GAAG,QAAQ,CAAA;AAEjE;;;GAGG;AACH,wBAAgB,kBAAkB,CAChC,QAAQ,EAAE,IAAI,CAAC,YAAY,EAAE,QAAQ,CAAC,GAAG,IAAI,GAAG,SAAS,GACxD,iBAAiB,CAInB;AAcD,kEAAkE;AAClE,wBAAsB,gBAAgB,CAAC,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,CAK5F;AAED,0DAA0D;AAC1D,wBAAsB,iBAAiB,CACrC,EAAE,EAAE,SAAS,EACb,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,YAAY,EAAE,CAAC,CAEzB;AAED,MAAM,WAAW,aAAa;IAC5B,gBAAgB,EAAE,MAAM,CAAA;IACxB,cAAc,EAAE,MAAM,CAAA;IACtB,gBAAgB,EAAE,MAAM,CAAA;IACxB,cAAc,EAAE,MAAM,CAAA;CACvB;AAED,yEAAyE;AACzE,wBAAsB,gBAAgB,CACpC,EAAE,EAAE,SAAS,EACb,IAAI,EAAE,aAAa,GAClB,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAc9B;AAED,MAAM,WAAW,yBAA0B,SAAQ,aAAa;IAC9D,WAAW,EAAE,MAAM,CAAA;IACnB,WAAW,EAAE,MAAM,CAAA;IACnB,QAAQ,EAAE,MAAM,CAAA;IAChB,WAAW,EAAE,MAAM,CAAA;CACpB;AAED;;;;GAIG;AACH,wBAAsB,mBAAmB,CACvC,EAAE,EAAE,SAAS,EACb,MAAM,EAAE,yBAAyB,GAChC,OAAO,CAAC,YAAY,CAAC,CAmDvB;AAsCD,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,MAAM,CAAA;IACd,sDAAsD;IACtD,KAAK,EAAE,MAAM,CAAA;IACb,WAAW,EAAE,MAAM,CAAA;CACpB;AAED,wDAAwD;AACxD,wBAAsB,mBAAmB,CACvC,EAAE,EAAE,SAAS,EACb,MAAM,EAAE,kBAAkB,GACzB,OAAO,CAAC,YAAY,CAAC,CAEvB;AAED,+EAA+E;AAC/E,wBAAsB,kBAAkB,CACtC,EAAE,EAAE,SAAS,EACb,MAAM,EAAE,kBAAkB,GAAG;IAAE,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GAC/C,OAAO,CAAC,YAAY,CAAC,CAEvB;AAoCD,uEAAuE;AACvE,wBAAsB,oBAAoB,CACxC,EAAE,EAAE,SAAS,EACb,MAAM,EAAE,kBAAkB,GACzB,OAAO,CAAC,YAAY,CAAC,CAEvB;AAED,4DAA4D;AAC5D,wBAAsB,kBAAkB,CACtC,EAAE,EAAE,SAAS,EACb,MAAM,EAAE,kBAAkB,GACzB,OAAO,CAAC,YAAY,CAAC,CAOvB;AAED;;;;GAIG;AACH,wBAAsB,0BAA0B,CAC9C,EAAE,EAAE,SAAS,EACb,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,IAAI,CAAC,CAKf;AAED,qFAAqF;AACrF,wBAAsB,cAAc,CAClC,EAAE,EAAE,SAAS,EACb,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC,CAKf;AAED;;;;GAIG;AACH,wBAAsB,wBAAwB,CAC5C,EAAE,EAAE,SAAS,EACb,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,MAAM,EACnB,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,YAAY,EAAE,CAAC,CAkBzB"}

package/dist/links.js

@@ -1,214 +0,0 @@
-// @govcore/federation/links — the cross-org content-link lifecycle.
-//
-// A cross-org link is an approved relationship between a content item in one org
-// and one in another. Entity ids carry no FK (they cross org boundaries) and the
-// link semantics are app-defined: `linkType`, `sourceEntityType`/`targetEntityType`
-// are plain strings here. The *source* org proposes a link; only the *target* org
-// approves or rejects it. Entity ownership and federated-visibility preconditions
-// are the caller's responsibility (they live over app-owned content) — this module
-// owns the link record and its transitions. Each transition is audited.
-import { and, eq, inArray, or } from 'drizzle-orm';
-import { crossOrgLinks } from '@govcore/schema';
-import { writeAuditLog } from '@govcore/audit';
-/**
- * Pure: a pending/active link blocks a new request; a previously rejected one is
- * reactivated; otherwise a fresh link is created.
- */
-export function resolveLinkRequest(existing) {
-    if (!existing)
-        return 'create';
-    if (existing.status === 'pending' || existing.status === 'active')
-        return 'block';
-    return 'reactivate';
-}
-const touchesEntity = (entityType, entityId) => or(and(eq(crossOrgLinks.sourceEntityType, entityType), eq(crossOrgLinks.sourceEntityId, entityId)), and(eq(crossOrgLinks.targetEntityType, entityType), eq(crossOrgLinks.targetEntityId, entityId)));
-const betweenOrgs = (orgAId, orgBId) => or(and(eq(crossOrgLinks.sourceOrgId, orgAId), eq(crossOrgLinks.targetOrgId, orgBId)), and(eq(crossOrgLinks.sourceOrgId, orgBId), eq(crossOrgLinks.targetOrgId, orgAId)));
-/** All links where `orgId` is either the source or target org. */
-export async function getCrossOrgLinks(db, orgId) {
-    return db
-        .select()
-        .from(crossOrgLinks)
-        .where(or(eq(crossOrgLinks.sourceOrgId, orgId), eq(crossOrgLinks.targetOrgId, orgId)));
-}
-/** All links touching a given entity (on either side). */
-export async function getLinksForEntity(db, entityType, entityId) {
-    return db.select().from(crossOrgLinks).where(touchesEntity(entityType, entityId));
-}
-/** The existing link for an exact source→target entity pair, or null. */
-export async function findCrossOrgLink(db, ends) {
-    const [row] = await db
-        .select()
-        .from(crossOrgLinks)
-        .where(and(eq(crossOrgLinks.sourceEntityType, ends.sourceEntityType), eq(crossOrgLinks.sourceEntityId, ends.sourceEntityId), eq(crossOrgLinks.targetEntityType, ends.targetEntityType), eq(crossOrgLinks.targetEntityId, ends.targetEntityId)))
-        .limit(1);
-    return row ?? null;
-}
-/**
- * Propose a cross-org link. Blocks if a pending/active link for the pair already
- * exists; reactivates a previously rejected one; otherwise creates a pending
- * link. Audited. Entity ownership/visibility must be validated by the caller.
- */
-export async function requestCrossOrgLink(db, params) {
-    if (params.sourceOrgId === params.targetOrgId) {
-        throw new Error('Use same-org relationships for links within one organization');
-    }
-    const existing = await findCrossOrgLink(db, params);
-    const action = resolveLinkRequest(existing);
-    if (action === 'block') {
-        throw new Error('A cross-org link already exists or is awaiting approval');
-    }
-    let link;
-    if (action === 'reactivate' && existing) {
-        const [row] = await db
-            .update(crossOrgLinks)
-            .set({ linkType: params.linkType, status: 'pending', rejectionReason: null, updatedAt: new Date() })
-            .where(eq(crossOrgLinks.id, existing.id))
-            .returning();
-        link = row;
-    }
-    else {
-        const [row] = await db
-            .insert(crossOrgLinks)
-            .values({
-            sourceOrgId: params.sourceOrgId,
-            sourceEntityType: params.sourceEntityType,
-            sourceEntityId: params.sourceEntityId,
-            targetOrgId: params.targetOrgId,
-            targetEntityType: params.targetEntityType,
-            targetEntityId: params.targetEntityId,
-            linkType: params.linkType,
-            status: 'pending',
-            createdBy: params.actorUserId,
-        })
-            .returning();
-        link = row;
-    }
-    await writeAuditLog(db, {
-        action: 'federation.cross_org_link.request',
-        entityType: 'cross_org_link',
-        entityId: link.id,
-        userId: params.actorUserId,
-        organizationId: params.sourceOrgId,
-        after: {
-            sourceEntityId: params.sourceEntityId,
-            targetEntityId: params.targetEntityId,
-            linkType: params.linkType,
-            targetOrgId: params.targetOrgId,
-        },
-    });
-    return link;
-}
-/** Internal: a target-org-only status transition with an audit row. */
-async function transitionByTarget(db, params, status, action) {
-    const [link] = await db
-        .select()
-        .from(crossOrgLinks)
-        .where(and(eq(crossOrgLinks.id, params.linkId), eq(crossOrgLinks.targetOrgId, params.orgId)))
-        .limit(1);
-    if (!link)
-        throw new Error('Cross-org link not found or not authorized');
-    if (link.status !== 'pending')
-        throw new Error('Only pending links can be approved or rejected');
-    const [row] = await db
-        .update(crossOrgLinks)
-        .set({
-        status,
-        rejectionReason: status === 'rejected' && params.reason?.trim() ? params.reason.trim() : null,
-        updatedAt: new Date(),
-    })
-        .where(eq(crossOrgLinks.id, params.linkId))
-        .returning();
-    await writeAuditLog(db, {
-        action,
-        entityType: 'cross_org_link',
-        entityId: params.linkId,
-        userId: params.actorUserId,
-        organizationId: params.orgId,
-        after: { sourceEntityId: link.sourceEntityId, targetEntityId: link.targetEntityId },
-    });
-    return row;
-}
-/** Approve a pending link. Target org only. Audited. */
-export async function approveCrossOrgLink(db, params) {
-    return transitionByTarget(db, params, 'active', 'federation.cross_org_link.approve');
-}
-/** Reject a pending link with an optional reason. Target org only. Audited. */
-export async function rejectCrossOrgLink(db, params) {
-    return transitionByTarget(db, params, 'rejected', 'federation.cross_org_link.reject');
-}
-/** Internal: delete a link the acting org owns on the given side, audited. */
-async function deleteOwnedLink(db, params, ownerColumn, action) {
-    const [link] = await db
-        .select()
-        .from(crossOrgLinks)
-        .where(and(eq(crossOrgLinks.id, params.linkId), eq(ownerColumn, params.orgId)))
-        .limit(1);
-    if (!link)
-        throw new Error('Cross-org link not found or not authorized');
-    if (params.requireActive && link.status !== 'active') {
-        throw new Error('Only active links can be revoked');
-    }
-    await db.delete(crossOrgLinks).where(eq(crossOrgLinks.id, params.linkId));
-    await writeAuditLog(db, {
-        action,
-        entityType: 'cross_org_link',
-        entityId: params.linkId,
-        userId: params.actorUserId,
-        organizationId: params.orgId,
-        before: {
-            sourceEntityId: link.sourceEntityId,
-            targetEntityId: link.targetEntityId,
-            status: link.status,
-        },
-    });
-    return link;
-}
-/** Withdraw a link the *source* org proposed (any status). Audited. */
-export async function withdrawCrossOrgLink(db, params) {
-    return deleteOwnedLink(db, params, crossOrgLinks.sourceOrgId, 'federation.cross_org_link.withdraw');
-}
-/** Revoke an active link from the *target* org. Audited. */
-export async function revokeCrossOrgLink(db, params) {
-    return deleteOwnedLink(db, { ...params, requireActive: true }, crossOrgLinks.targetOrgId, 'federation.cross_org_link.revoke');
-}
-/**
- * Flag every pending/active link touching an entity for review — used when the
- * entity's visibility drops so both orgs are alerted the link may no longer be
- * accessible. Caller must have verified the entity belongs to its org.
- */
-export async function flagLinksForVisibilityDrop(db, entityType, entityId, reason) {
-    await db
-        .update(crossOrgLinks)
-        .set({ flaggedForReview: true, flagReason: reason, updatedAt: new Date() })
-        .where(and(touchesEntity(entityType, entityId), inArray(crossOrgLinks.status, ['pending', 'active'])));
-}
-/** Clear review flags on an entity's links — used when visibility is raised back. */
-export async function clearLinksFlag(db, entityType, entityId) {
-    await db
-        .update(crossOrgLinks)
-        .set({ flaggedForReview: false, flagReason: null, updatedAt: new Date() })
-        .where(and(touchesEntity(entityType, entityId), eq(crossOrgLinks.flaggedForReview, true)));
-}
-/**
- * Delete every cross-org link between two orgs — called when their connection is
- * removed. Audits a snapshot of the removed links (when any) under the actor.
- * Returns the removed rows.
- */
-export async function removeLinksForConnection(db, orgAId, orgBId, actorUserId, actorOrgId) {
-    const affected = await db.select().from(crossOrgLinks).where(betweenOrgs(orgAId, orgBId));
-    if (affected.length === 0)
-        return [];
-    await db.delete(crossOrgLinks).where(betweenOrgs(orgAId, orgBId));
-    await writeAuditLog(db, {
-        action: 'federation.cross_org_link.remove_for_connection',
-        entityType: 'org_connection',
-        userId: actorUserId,
-        organizationId: actorOrgId,
-        before: {
-            orgAId,
-            orgBId,
-            removedLinkIds: affected.map((l) => l.id),
-        },
-    });
-    return affected;
-}

package/dist/visibility.d.ts

@@ -1,45 +0,0 @@
-import { type SQL } from 'drizzle-orm';
-import type { AnyPgColumn } from 'drizzle-orm/pg-core';
-import { type GovcoreDb } from '@govcore/schema';
-/** A content row's visibility vocabulary (mirrors the `visibility` schema enum). */
-export type FederationVisibility = 'org' | 'connections' | 'instance';
-/**
- * List-view scope. `org` (default) restricts to the caller's own org;
- * `federated` is an explicit, user-requested broadening so list queries never
- * silently fan out across every visible org.
- */
-export type ListScope = 'org' | 'federated';
-/** Coerce a raw query-string value into a ListScope, defaulting to `org`. */
-export declare function parseListScope(value: string | string[] | undefined): ListScope;
-/**
- * Build the visibility WHERE condition for an org-scoped list query.
- *
- * - `org` scope → only rows owned by `orgId`.
- * - `federated` scope → owned rows, plus instance-wide rows, plus
- *   connections/instance rows owned by a connected org.
- *
- * Pass `connectedOrgIds` empty under `org` scope (callers should skip the
- * connected-org lookup there). Compose with any status filter via `and(...)`.
- */
-export declare function listScopeFilter(cols: {
-    organizationId: AnyPgColumn;
-    visibility: AnyPgColumn;
-}, opts: {
-    orgId: string;
-    scope: ListScope;
-    connectedOrgIds?: string[];
-}): SQL;
-/**
- * Throw if an entity's owning org doesn't match the caller's. Use before any
- * write to content fetched without an org filter.
- */
-export declare function assertOwnership(entityOrgId: string | null | undefined, callerOrgId: string): void;
-/** Org IDs with an *active* bilateral connection to `organizationId` (either direction). */
-export declare function getConnectedOrgIds(db: GovcoreDb, organizationId: string): Promise<string[]>;
-/**
- * Whether `callerOrgId` may read a single entity given its owning org and
- * visibility. Own-org always; `instance` always; `connections` only when an
- * active connection exists. A null org/visibility is unreadable.
- */
-export declare function canReadFederatedEntity(db: GovcoreDb, entityOrgId: string | null | undefined, visibility: FederationVisibility | null | undefined, callerOrgId: string): Promise<boolean>;
-//# sourceMappingURL=visibility.d.ts.map

package/dist/visibility.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"visibility.d.ts","sourceRoot":"","sources":["../src/visibility.ts"],"names":[],"mappings":"AASA,OAAO,EAAwB,KAAK,GAAG,EAAE,MAAM,aAAa,CAAA;AAC5D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAA;AACtD,OAAO,EAAkB,KAAK,SAAS,EAAE,MAAM,iBAAiB,CAAA;AAEhE,oFAAoF;AACpF,MAAM,MAAM,oBAAoB,GAAG,KAAK,GAAG,aAAa,GAAG,UAAU,CAAA;AAErE;;;;GAIG;AACH,MAAM,MAAM,SAAS,GAAG,KAAK,GAAG,WAAW,CAAA;AAE3C,6EAA6E;AAC7E,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,GAAG,SAAS,CAE9E;AAED;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAC7B,IAAI,EAAE;IAAE,cAAc,EAAE,WAAW,CAAC;IAAC,UAAU,EAAE,WAAW,CAAA;CAAE,EAC9D,IAAI,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,SAAS,CAAC;IAAC,eAAe,CAAC,EAAE,MAAM,EAAE,CAAA;CAAE,GACpE,GAAG,CAeL;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAC7B,WAAW,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EACtC,WAAW,EAAE,MAAM,GAClB,IAAI,CAIN;AAED,4FAA4F;AAC5F,wBAAsB,kBAAkB,CACtC,EAAE,EAAE,SAAS,EACb,cAAc,EAAE,MAAM,GACrB,OAAO,CAAC,MAAM,EAAE,CAAC,CAcnB;AAED;;;;GAIG;AACH,wBAAsB,sBAAsB,CAC1C,EAAE,EAAE,SAAS,EACb,WAAW,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EACtC,UAAU,EAAE,oBAAoB,GAAG,IAAI,GAAG,SAAS,EACnD,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,OAAO,CAAC,CAQlB"}

package/dist/visibility.js

@@ -1,68 +0,0 @@
-// @govcore/federation/visibility — federated read scoping.
-//
-// Content rows carry a `visibility` (org | connections | instance). A list query
-// is scoped to the caller's org by default; broadening to `federated` also pulls
-// in instance-wide rows and rows owned by a *connected* org whose visibility
-// permits it. These helpers build the query condition and answer single-row
-// read checks; the content tables themselves are app-owned (content is a later
-// milestone), so callers pass the columns.
-import { and, eq, inArray, or } from 'drizzle-orm';
-import { orgConnections } from '@govcore/schema';
-/** Coerce a raw query-string value into a ListScope, defaulting to `org`. */
-export function parseListScope(value) {
-    return value === 'federated' ? 'federated' : 'org';
-}
-/**
- * Build the visibility WHERE condition for an org-scoped list query.
- *
- * - `org` scope → only rows owned by `orgId`.
- * - `federated` scope → owned rows, plus instance-wide rows, plus
- *   connections/instance rows owned by a connected org.
- *
- * Pass `connectedOrgIds` empty under `org` scope (callers should skip the
- * connected-org lookup there). Compose with any status filter via `and(...)`.
- */
-export function listScopeFilter(cols, opts) {
-    const base = eq(cols.organizationId, opts.orgId);
-    if (opts.scope === 'org')
-        return base;
-    const instanceWide = eq(cols.visibility, 'instance');
-    const connectedOrgIds = opts.connectedOrgIds ?? [];
-    if (connectedOrgIds.length === 0)
-        return or(base, instanceWide);
-    return or(base, instanceWide, and(inArray(cols.organizationId, connectedOrgIds), inArray(cols.visibility, ['connections', 'instance'])));
-}
-/**
- * Throw if an entity's owning org doesn't match the caller's. Use before any
- * write to content fetched without an org filter.
- */
-export function assertOwnership(entityOrgId, callerOrgId) {
-    if (!entityOrgId || entityOrgId !== callerOrgId) {
-        throw new Error('Forbidden: content owned by another organization');
-    }
-}
-/** Org IDs with an *active* bilateral connection to `organizationId` (either direction). */
-export async function getConnectedOrgIds(db, organizationId) {
-    const rows = await db
-        .select({ fromOrgId: orgConnections.fromOrgId, toOrgId: orgConnections.toOrgId })
-        .from(orgConnections)
-        .where(and(or(eq(orgConnections.fromOrgId, organizationId), eq(orgConnections.toOrgId, organizationId)), eq(orgConnections.status, 'active')));
-    return rows.map((r) => (r.fromOrgId === organizationId ? r.toOrgId : r.fromOrgId));
-}
-/**
- * Whether `callerOrgId` may read a single entity given its owning org and
- * visibility. Own-org always; `instance` always; `connections` only when an
- * active connection exists. A null org/visibility is unreadable.
- */
-export async function canReadFederatedEntity(db, entityOrgId, visibility, callerOrgId) {
-    if (!entityOrgId || !visibility)
-        return false;
-    if (entityOrgId === callerOrgId)
-        return true;
-    if (visibility === 'instance')
-        return true;
-    if (visibility !== 'connections')
-        return false;
-    const connectedOrgIds = await getConnectedOrgIds(db, callerOrgId);
-    return connectedOrgIds.includes(entityOrgId);
-}

package/src/connections.ts

@@ -1,137 +0,0 @@
-// @govcore/federation/connections — the org-to-org connection lifecycle.
-//
-// A connection is a bilateral, explicit link between two orgs. The requester's
-// org opens it (`pending`); only the *target* org may accept (`active`) or
-// reject (`rejected`). An active connection is what `getConnectedOrgIds` and the
-// federated read checks key off. Each transition is audited. App-layer auth
-// (who is an admin, whose org is acting) stays in the caller.
-
-import { and, eq, or } from 'drizzle-orm'
-import { orgConnections, type GovcoreDb } from '@govcore/schema'
-import { writeAuditLog } from '@govcore/audit'
-
-export type OrgConnection = typeof orgConnections.$inferSelect
-
-/** All connections touching `orgId`, in either direction. */
-export async function getConnections(db: GovcoreDb, orgId: string): Promise<OrgConnection[]> {
-  return db
-    .select()
-    .from(orgConnections)
-    .where(or(eq(orgConnections.fromOrgId, orgId), eq(orgConnections.toOrgId, orgId)))
-}
-
-/** An existing connection between two orgs in either direction, or null. */
-export async function findConnectionBetween(
-  db: GovcoreDb,
-  orgId: string,
-  targetOrgId: string,
-): Promise<OrgConnection | null> {
-  const [existing] = await db
-    .select()
-    .from(orgConnections)
-    .where(
-      or(
-        and(eq(orgConnections.fromOrgId, orgId), eq(orgConnections.toOrgId, targetOrgId)),
-        and(eq(orgConnections.fromOrgId, targetOrgId), eq(orgConnections.toOrgId, orgId)),
-      ),
-    )
-    .limit(1)
-  return existing ?? null
-}
-
-export interface RequestConnectionParams {
-  /** The org opening the connection. */
-  orgId: string
-  /** The org being invited. */
-  targetOrgId: string
-  /** The acting user (recorded as `created_by` and on the audit row). */
-  actorUserId: string
-}
-
-/**
- * Open a pending connection from `orgId` to `targetOrgId`. Throws if a
- * connection already exists in either direction. Audited.
- */
-export async function requestConnection(
-  db: GovcoreDb,
-  params: RequestConnectionParams,
-): Promise<OrgConnection> {
-  if (params.orgId === params.targetOrgId) {
-    throw new Error('Cannot connect an organization to itself')
-  }
-  const existing = await findConnectionBetween(db, params.orgId, params.targetOrgId)
-  if (existing) throw new Error('Connection already exists or is pending')
-
-  const [connection] = await db
-    .insert(orgConnections)
-    .values({
-      fromOrgId: params.orgId,
-      toOrgId: params.targetOrgId,
-      status: 'pending',
-      createdBy: params.actorUserId,
-    })
-    .returning()
-
-  await writeAuditLog(db, {
-    action: 'federation.connection.request',
-    entityType: 'org_connection',
-    entityId: connection.id,
-    userId: params.actorUserId,
-    organizationId: params.orgId,
-    after: { targetOrgId: params.targetOrgId },
-  })
-  return connection
-}
-
-/** Internal: a target-only status transition with an audit row. */
-async function transitionByTarget(
-  db: GovcoreDb,
-  params: { connectionId: string; orgId: string; actorUserId: string },
-  status: 'active' | 'rejected',
-  action: string,
-): Promise<OrgConnection> {
-  // Only the target org (toOrgId) may accept or reject.
-  const [row] = await db
-    .update(orgConnections)
-    .set({ status, updatedAt: new Date() })
-    .where(
-      and(
-        eq(orgConnections.id, params.connectionId),
-        eq(orgConnections.toOrgId, params.orgId),
-      ),
-    )
-    .returning()
-  if (!row) throw new Error('Connection not found or not authorized')
-
-  await writeAuditLog(db, {
-    action,
-    entityType: 'org_connection',
-    entityId: params.connectionId,
-    userId: params.actorUserId,
-    organizationId: params.orgId,
-  })
-  return row
-}
-
-export interface ConnectionDecisionParams {
-  connectionId: string
-  /** The org acting — must be the connection's target org. */
-  orgId: string
-  actorUserId: string
-}
-
-/** Accept a pending connection. Only the target org may accept. Audited. */
-export async function acceptConnection(
-  db: GovcoreDb,
-  params: ConnectionDecisionParams,
-): Promise<OrgConnection> {
-  return transitionByTarget(db, params, 'active', 'federation.connection.accept')
-}
-
-/** Reject a pending connection. Only the target org may reject. Audited. */
-export async function rejectConnection(
-  db: GovcoreDb,
-  params: ConnectionDecisionParams,
-): Promise<OrgConnection> {
-  return transitionByTarget(db, params, 'rejected', 'federation.connection.reject')
-}

package/src/index.ts

@@ -1,15 +0,0 @@
-// @govcore/federation — cross-organization connections + federated visibility.
-//
-// connections: the bilateral org-to-org connection lifecycle (request / accept /
-// reject), audited; an active connection is what federated reads key off.
-// visibility: the org | connections | instance scoping helpers for list queries
-// and single-row read checks over app-owned content.
-//
-// links: the cross-org content-link lifecycle (request / approve / reject /
-// withdraw / revoke) plus review-flag and connection-cleanup helpers. Entity
-// types and link_type are app-defined strings; the app validates entity
-// ownership/visibility, this owns the link record.
-
-export * from './connections'
-export * from './visibility'
-export * from './links'