@govcore/schema 0.1.0

package/dist/schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../src/schema.ts"],"names":[],"mappings":"AAuBA,mEAAmE;AACnE,eAAO,MAAM,OAAO,mDAAsB,CAAA;AAE1C,mFAAmF;AACnF,eAAO,MAAM,UAAU,0EAAiE,CAAA;AAExF,0EAA0E;AAC1E,eAAO,MAAM,gBAAgB,yEAAuE,CAAA;AAIpG,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAYzB,CAAA;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,SAAS,GAAI,MAAM,OAAO,aAAa;;CAIlD,CAAA;AAIF,eAAO,MAAM,KAAK;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAoCjB,CAAA;AAKD,eAAO,MAAM,QAAQ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAenB,CAAA;AAEF,eAAO,MAAM,QAAQ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAOnB,CAAA;AAEF,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAI7B,CAAA;AAIF,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAmBvC,CAAA;AAID,eAAO,MAAM,QAAQ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAWnB,CAAA;AAIF,+DAA+D;AAC/D,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAgB1B,CAAA;AAED;sFACsF;AACtF,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAoBxB,CAAA;AAOF,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAgB7B,CAAA;AAEF,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAexB,CAAA;AAEF,eAAO,MAAM,0BAA0B,KAAK,CAAA;AAC5C,eAAO,MAAM,kBAAkB,yEAKrB,CAAA;AACV,MAAM,MAAM,cAAc,GAAG,CAAC,OAAO,kBAAkB,CAAC,CAAC,MAAM,CAAC,CAAA;AAIhE,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAK3B,CAAA;AAEF,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EASzB,CAAA;AAIF,MAAM,MAAM,YAAY,GAAG,OAAO,aAAa,CAAC,YAAY,CAAA;AAC5D,MAAM,MAAM,eAAe,GAAG,OAAO,aAAa,CAAC,YAAY,CAAA;AAC/D,MAAM,MAAM,IAAI,GAAG,OAAO,KAAK,CAAC,YAAY,CAAA;AAC5C,MAAM,MAAM,OAAO,GAAG,OAAO,KAAK,CAAC,YAAY,CAAA;AAC/C,MAAM,MAAM,0BAA0B,GAAG,OAAO,2BAA2B,CAAC,YAAY,CAAA;AACxF,MAAM,MAAM,6BAA6B,GAAG,OAAO,2BAA2B,CAAC,YAAY,CAAA;AAC3F,MAAM,MAAM,UAAU,GAAG,OAAO,QAAQ,CAAC,YAAY,CAAA;AACrD,MAAM,MAAM,aAAa,GAAG,OAAO,QAAQ,CAAC,YAAY,CAAA;AACxD,MAAM,MAAM,aAAa,GAAG,OAAO,cAAc,CAAC,YAAY,CAAA;AAC9D,MAAM,MAAM,gBAAgB,GAAG,OAAO,cAAc,CAAC,YAAY,CAAA;AACjE,MAAM,MAAM,YAAY,GAAG,OAAO,aAAa,CAAC,YAAY,CAAA;AAC5D,MAAM,MAAM,eAAe,GAAG,OAAO,aAAa,CAAC,YAAY,CAAA;AAC/D,MAAM,MAAM,iBAAiB,GAAG,OAAO,kBAAkB,CAAC,YAAY,CAAA;AACtE,MAAM,MAAM,oBAAoB,GAAG,OAAO,kBAAkB,CAAC,YAAY,CAAA;AACzE,MAAM,MAAM,YAAY,GAAG,OAAO,aAAa,CAAC,YAAY,CAAA;AAC5D,MAAM,MAAM,eAAe,GAAG,OAAO,aAAa,CAAC,YAAY,CAAA;AAC/D,MAAM,MAAM,gBAAgB,GAAG,OAAO,gBAAgB,CAAC,YAAY,CAAA;AACnE,MAAM,MAAM,mBAAmB,GAAG,OAAO,gBAAgB,CAAC,YAAY,CAAA;AACtE,MAAM,MAAM,cAAc,GAAG,OAAO,cAAc,CAAC,YAAY,CAAA;AAC/D,MAAM,MAAM,iBAAiB,GAAG,OAAO,cAAc,CAAC,YAAY,CAAA"}

package/dist/schema.js

@@ -0,0 +1,231 @@
+// @govcore/schema — platform table definitions (identity, tenancy, auth, audit).
+//
+// Edge-safe: imports only `drizzle-orm/pg-core`, no DB client. The app imports
+// these for type-safe queries and to declare foreign keys *to* platform tables.
+// The govcore-migrate runner (./migrate) is a separate, non-edge entrypoint.
+//
+// All platform tables live in a dedicated `govcore` Postgres schema (design
+// §13.4) so they never collide with an app's `public` tables and ownership is
+// obvious. The authored DDL lives in ../migrations and must stay in sync.
+import { boolean, integer, jsonb, pgSchema, text, timestamp, unique, uniqueIndex, uuid, } from 'drizzle-orm/pg-core';
+/** The Postgres schema every GovCore platform table belongs to. */
+export const govcore = pgSchema('govcore');
+/** Content/federation visibility. Used by the federation package (later phase). */
+export const visibility = govcore.enum('visibility', ['org', 'connections', 'instance']);
+/** Generic workflow status shared by federation connections and links. */
+export const federationStatus = govcore.enum('federation_status', ['pending', 'active', 'rejected']);
+// ── Tenancy root ────────────────────────────────────────────────────────────
+export const organizations = govcore.table('organizations', {
+    id: uuid('id').primaryKey().defaultRandom(),
+    name: text('name').notNull(),
+    slug: text('slug').notNull(),
+    /** App-extensible bag for org settings GovCore itself doesn't model. */
+    metadata: jsonb('metadata').notNull().default({}),
+    createdAt: timestamp('created_at').notNull().defaultNow(),
+    updatedAt: timestamp('updated_at').notNull().defaultNow(),
+}, (t) => [uniqueIndex('organizations_slug_unique').on(t.slug)]);
+/**
+ * The tenancy column contract (design §5): every tenant-scoped table — core's
+ * and the app's own domain tables — carries `organization_id` referencing
+ * `organizations`. RLS policies (see ../migrations/0001) key off this column.
+ *
+ * @example
+ * export const permits = pgTable('permits', { ...orgScoped(organizations), title: text('title') })
+ */
+export const orgScoped = (orgs) => ({
+    organizationId: uuid('organization_id')
+        .notNull()
+        .references(() => orgs.id, { onDelete: 'cascade' }),
+});
+// ── Identity ────────────────────────────────────────────────────────────────
+export const users = govcore.table('users', {
+    id: uuid('id').primaryKey().defaultRandom(),
+    organizationId: uuid('organization_id')
+        .notNull()
+        .references(() => organizations.id, { onDelete: 'cascade' }),
+    /** Last-selected active org, honored first by active-membership resolution. */
+    lastActiveOrganizationId: uuid('last_active_organization_id').references(() => organizations.id, { onDelete: 'set null' }),
+    name: text('name'),
+    email: text('email').notNull(),
+    emailVerified: timestamp('email_verified'),
+    image: text('image'),
+    passwordHash: text('password_hash'),
+    /**
+     * App-defined role (see @govcore/rbac `createRbac`) — stored as `text`, not
+     * a fixed enum, so GovCore ships no role vocabulary of its own. Denormalized
+     * cache of the active membership's role; nullable so the Auth.js adapter can
+     * create a user before a membership is assigned.
+     */
+    role: text('role'),
+    /** Platform-level role (e.g. instance/platform admin), separate from per-org role. */
+    instanceRole: text('instance_role'),
+    isActive: boolean('is_active').notNull().default(true),
+    // Account-lockout + password-expiry state; the policy itself lives app-side.
+    failedLoginAttempts: integer('failed_login_attempts').notNull().default(0),
+    lockoutUntil: timestamp('lockout_until'),
+    lastPasswordChangedAt: timestamp('last_password_changed_at').notNull().defaultNow(),
+    createdAt: timestamp('created_at').notNull().defaultNow(),
+    updatedAt: timestamp('updated_at').notNull().defaultNow(),
+}, 
+// One identity per email across all orgs — unambiguous auth/SSO lookups.
+(t) => [uniqueIndex('users_email_unique').on(t.email)]);
+// Auth.js (drizzle-adapter) tables. Not org-scoped; read during auth flows
+// before a tenant context exists, so they are intentionally outside RLS.
+export const accounts = govcore.table('accounts', {
+    id: uuid('id').primaryKey().defaultRandom(),
+    userId: uuid('user_id')
+        .notNull()
+        .references(() => users.id, { onDelete: 'cascade' }),
+    type: text('type').notNull(),
+    provider: text('provider').notNull(),
+    providerAccountId: text('provider_account_id').notNull(),
+    refreshToken: text('refresh_token'),
+    accessToken: text('access_token'),
+    expiresAt: timestamp('expires_at'),
+    tokenType: text('token_type'),
+    scope: text('scope'),
+    idToken: text('id_token'),
+    sessionState: text('session_state'),
+});
+export const sessions = govcore.table('sessions', {
+    id: uuid('id').primaryKey().defaultRandom(),
+    sessionToken: text('session_token').notNull().unique(),
+    userId: uuid('user_id')
+        .notNull()
+        .references(() => users.id, { onDelete: 'cascade' }),
+    expires: timestamp('expires').notNull(),
+});
+export const verificationTokens = govcore.table('verification_tokens', {
+    identifier: text('identifier').notNull(),
+    token: text('token').notNull(),
+    expires: timestamp('expires').notNull(),
+});
+// ── Membership model (the heart of tenancy) ─────────────────────────────────
+export const userOrganizationMemberships = govcore.table('user_organization_memberships', {
+    id: uuid('id').primaryKey().defaultRandom(),
+    userId: uuid('user_id')
+        .notNull()
+        .references(() => users.id, { onDelete: 'cascade' }),
+    organizationId: uuid('organization_id')
+        .notNull()
+        .references(() => organizations.id, { onDelete: 'cascade' }),
+    /** App-defined role for this membership (text, not an enum — see `users.role`). */
+    role: text('role').notNull(),
+    /** Revocation soft-deactivates so the historical row survives for audit. */
+    isActive: boolean('is_active').notNull().default(true),
+    isPrimary: boolean('is_primary').notNull().default(false),
+    createdAt: timestamp('created_at').notNull().defaultNow(),
+    updatedAt: timestamp('updated_at').notNull().defaultNow(),
+}, (t) => [uniqueIndex('user_org_membership_unique').on(t.userId, t.organizationId)]);
+// ── Audit (append-only; immutability + RLS in ../migrations/0001) ───────────
+export const auditLog = govcore.table('audit_log', {
+    id: uuid('id').primaryKey().defaultRandom(),
+    organizationId: uuid('organization_id'), // historical UUID — no FK on purpose
+    userId: uuid('user_id'), // historical UUID — no FK on purpose
+    action: text('action').notNull(),
+    entityType: text('entity_type').notNull(),
+    entityId: uuid('entity_id'),
+    before: jsonb('before'),
+    after: jsonb('after'),
+    metadata: jsonb('metadata'),
+    createdAt: timestamp('created_at').notNull().defaultNow(),
+});
+// ── Federation (cross-organization connections and content links) ──────────
+/** Explicit bilateral connection between two organizations. */
+export const orgConnections = govcore.table('org_connections', {
+    id: uuid('id').primaryKey().defaultRandom(),
+    fromOrgId: uuid('from_org_id')
+        .notNull()
+        .references(() => organizations.id, { onDelete: 'cascade' }),
+    toOrgId: uuid('to_org_id')
+        .notNull()
+        .references(() => organizations.id, { onDelete: 'cascade' }),
+    status: federationStatus('status').notNull().default('pending'),
+    createdBy: uuid('created_by').references(() => users.id),
+    createdAt: timestamp('created_at').notNull().defaultNow(),
+    updatedAt: timestamp('updated_at').notNull().defaultNow(),
+}, (t) => [unique('unique_org_connection').on(t.fromOrgId, t.toOrgId)]);
+/** Approved relationship between content items across orgs. No FK on entity ids
+ *  (they cross org boundaries); link semantics are app-defined (`link_type` text). */
+export const crossOrgLinks = govcore.table('cross_org_links', {
+    id: uuid('id').primaryKey().defaultRandom(),
+    sourceOrgId: uuid('source_org_id')
+        .notNull()
+        .references(() => organizations.id, { onDelete: 'cascade' }),
+    sourceEntityType: text('source_entity_type').notNull(),
+    sourceEntityId: uuid('source_entity_id').notNull(),
+    targetOrgId: uuid('target_org_id')
+        .notNull()
+        .references(() => organizations.id, { onDelete: 'cascade' }),
+    targetEntityType: text('target_entity_type').notNull(),
+    targetEntityId: uuid('target_entity_id').notNull(),
+    linkType: text('link_type').notNull(),
+    status: federationStatus('status').notNull().default('pending'),
+    rejectionReason: text('rejection_reason'),
+    flaggedForReview: boolean('flagged_for_review').notNull().default(false),
+    flagReason: text('flag_reason'),
+    createdBy: uuid('created_by').references(() => users.id),
+    createdAt: timestamp('created_at').notNull().defaultNow(),
+    updatedAt: timestamp('updated_at').notNull().defaultNow(),
+});
+// ── Support access (break-glass + act-as) ──────────────────────────────────
+// Instance-operator constructs that deliberately cross the tenant boundary, so
+// they are NOT under the org-GUC RLS (the actor is an instance admin operating
+// across orgs). Authorization is enforced in @govcore/support (design §6.6).
+export const breakGlassSessions = govcore.table('break_glass_sessions', {
+    id: uuid('id').primaryKey().defaultRandom(),
+    instanceAdminId: uuid('instance_admin_id')
+        .notNull()
+        .references(() => users.id),
+    targetOrgId: uuid('target_org_id')
+        .notNull()
+        .references(() => organizations.id),
+    reason: text('reason').notNull(),
+    grantedAt: timestamp('granted_at').notNull().defaultNow(),
+    expiresAt: timestamp('expires_at').notNull(),
+    requiresApproval: boolean('requires_approval').notNull().default(false),
+    approvedAt: timestamp('approved_at'),
+    approvedBy: uuid('approved_by').references(() => users.id),
+    revokedAt: timestamp('revoked_at'),
+    revokedBy: uuid('revoked_by').references(() => users.id),
+});
+export const actAsSessions = govcore.table('act_as_sessions', {
+    id: uuid('id').primaryKey().defaultRandom(),
+    breakGlassSessionId: uuid('break_glass_session_id')
+        .notNull()
+        .references(() => breakGlassSessions.id),
+    instanceAdminId: uuid('instance_admin_id')
+        .notNull()
+        .references(() => users.id),
+    targetOrgId: uuid('target_org_id')
+        .notNull()
+        .references(() => organizations.id),
+    startedAt: timestamp('started_at').notNull().defaultNow(),
+    expiresAt: timestamp('expires_at').notNull(),
+    endedAt: timestamp('ended_at'),
+    endReason: text('end_reason'),
+});
+export const ACT_AS_DEFAULT_TTL_MINUTES = 30;
+export const ACT_AS_END_REASONS = [
+    'admin_ended',
+    'expired',
+    'parent_revoked',
+    'parent_expired',
+];
+// ── Instance / platform configuration (singletons; not org-scoped) ─────────
+export const instanceSettings = govcore.table('instance_settings', {
+    id: uuid('id').primaryKey().defaultRandom(),
+    disabledModules: jsonb('disabled_modules').$type().notNull().default({}),
+    createdAt: timestamp('created_at').notNull().defaultNow(),
+    updatedAt: timestamp('updated_at').notNull().defaultNow(),
+});
+export const platformConfig = govcore.table('platform_config', {
+    id: text('id').primaryKey().default('singleton'),
+    instanceName: text('instance_name').notNull().default('GovCore'),
+    defaultTheme: text('default_theme').notNull().default('base'),
+    allowLocalAuth: boolean('allow_local_auth').notNull().default(true),
+    /** Stamped onto new orgs at provisioning time. Null means no tier. */
+    defaultSupportTier: text('default_support_tier'),
+    updatedAt: timestamp('updated_at').notNull().defaultNow(),
+    updatedBy: uuid('updated_by').references(() => users.id, { onDelete: 'set null' }),
+});

package/migrations/0000_platform_init.sql

@@ -0,0 +1,97 @@
+-- 0000_platform_init — GovCore platform schema (identity, tenancy, auth, audit).
+--
+-- Authored DDL: core owns the platform migrations (design §5). Keep in sync
+-- with packages/schema/src/schema.ts. Applied by govcore-migrate, in one
+-- transaction, as the owner/DDL role.
+
+CREATE SCHEMA IF NOT EXISTS govcore;
+
+DO $$ BEGIN
+  CREATE TYPE govcore.visibility AS ENUM ('org', 'connections', 'instance');
+EXCEPTION WHEN duplicate_object THEN NULL;
+END $$;
+
+CREATE TABLE IF NOT EXISTS govcore.organizations (
+  id          uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  name        text NOT NULL,
+  slug        text NOT NULL,
+  metadata    jsonb NOT NULL DEFAULT '{}'::jsonb,
+  created_at  timestamp NOT NULL DEFAULT now(),
+  updated_at  timestamp NOT NULL DEFAULT now()
+);
+CREATE UNIQUE INDEX IF NOT EXISTS organizations_slug_unique ON govcore.organizations (slug);
+
+CREATE TABLE IF NOT EXISTS govcore.users (
+  id                          uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  organization_id             uuid NOT NULL REFERENCES govcore.organizations (id) ON DELETE CASCADE,
+  last_active_organization_id uuid REFERENCES govcore.organizations (id) ON DELETE SET NULL,
+  name                        text,
+  email                       text NOT NULL,
+  email_verified              timestamp,
+  image                       text,
+  password_hash               text,
+  role                        text,
+  instance_role               text,
+  is_active                   boolean NOT NULL DEFAULT true,
+  failed_login_attempts       integer NOT NULL DEFAULT 0,
+  lockout_until               timestamp,
+  last_password_changed_at    timestamp NOT NULL DEFAULT now(),
+  created_at                  timestamp NOT NULL DEFAULT now(),
+  updated_at                  timestamp NOT NULL DEFAULT now()
+);
+CREATE UNIQUE INDEX IF NOT EXISTS users_email_unique ON govcore.users (email);
+
+CREATE TABLE IF NOT EXISTS govcore.accounts (
+  id                  uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  user_id             uuid NOT NULL REFERENCES govcore.users (id) ON DELETE CASCADE,
+  type                text NOT NULL,
+  provider            text NOT NULL,
+  provider_account_id text NOT NULL,
+  refresh_token       text,
+  access_token        text,
+  expires_at          timestamp,
+  token_type          text,
+  scope               text,
+  id_token            text,
+  session_state       text
+);
+
+CREATE TABLE IF NOT EXISTS govcore.sessions (
+  id            uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  session_token text NOT NULL UNIQUE,
+  user_id       uuid NOT NULL REFERENCES govcore.users (id) ON DELETE CASCADE,
+  expires       timestamp NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS govcore.verification_tokens (
+  identifier text NOT NULL,
+  token      text NOT NULL,
+  expires    timestamp NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS govcore.user_organization_memberships (
+  id              uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  user_id         uuid NOT NULL REFERENCES govcore.users (id) ON DELETE CASCADE,
+  organization_id uuid NOT NULL REFERENCES govcore.organizations (id) ON DELETE CASCADE,
+  role            text NOT NULL,
+  is_active       boolean NOT NULL DEFAULT true,
+  is_primary      boolean NOT NULL DEFAULT false,
+  created_at      timestamp NOT NULL DEFAULT now(),
+  updated_at      timestamp NOT NULL DEFAULT now()
+);
+CREATE UNIQUE INDEX IF NOT EXISTS user_org_membership_unique
+  ON govcore.user_organization_memberships (user_id, organization_id);
+
+CREATE TABLE IF NOT EXISTS govcore.audit_log (
+  id              uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  organization_id uuid,
+  user_id         uuid,
+  action          text NOT NULL,
+  entity_type     text NOT NULL,
+  entity_id       uuid,
+  before          jsonb,
+  after           jsonb,
+  metadata        jsonb,
+  created_at      timestamp NOT NULL DEFAULT now()
+);
+CREATE INDEX IF NOT EXISTS audit_log_org_idx ON govcore.audit_log (organization_id);

package/migrations/0001_platform_security.sql

@@ -0,0 +1,59 @@
+-- 0001_platform_security — append-only audit + Row-Level Security.
+--
+-- Hand-authored: Drizzle manages neither triggers nor RLS. These are core's
+-- security properties (design §13.1–§13.2), applied by govcore-migrate.
+
+-- ── Append-only audit log (carried from GovEA #417) ─────────────────────────
+CREATE OR REPLACE FUNCTION govcore.audit_log_immutable()
+RETURNS trigger LANGUAGE plpgsql AS $$
+BEGIN
+  RAISE EXCEPTION 'audit_log is append-only — UPDATE and DELETE are not permitted';
+END;
+$$;
+
+DROP TRIGGER IF EXISTS audit_log_no_update ON govcore.audit_log;
+CREATE TRIGGER audit_log_no_update
+  BEFORE UPDATE ON govcore.audit_log
+  FOR EACH ROW EXECUTE FUNCTION govcore.audit_log_immutable();
+
+DROP TRIGGER IF EXISTS audit_log_no_delete ON govcore.audit_log;
+CREATE TRIGGER audit_log_no_delete
+  BEFORE DELETE ON govcore.audit_log
+  FOR EACH ROW EXECUTE FUNCTION govcore.audit_log_immutable();
+
+-- ── Row-Level Security: tenant isolation by the active-org GUC ──────────────
+--
+-- The runtime sets `app.current_org` per request, transaction-locally, inside
+-- the tenant transaction (design §13.1): `select set_config('app.current_org',
+-- $org, true)`. When the GUC is unset, current_setting(..., true) returns NULL,
+-- the comparison is NULL (not true), and every row is hidden — deny by default.
+--
+-- FORCE so the policy binds even for the table owner; the app connects as a
+-- NON-OWNER runtime role (design §13.2). One sanctioned bypass (break-glass /
+-- act-as) is a later phase; nothing bypasses RLS today.
+--
+-- Scope (this slice): users, memberships, audit_log. NOT applied to
+-- `organizations` (the tenant root — visibility is membership-based, a later
+-- policy) or the Auth.js tables (read before a tenant context exists).
+
+ALTER TABLE govcore.users ENABLE ROW LEVEL SECURITY;
+ALTER TABLE govcore.users FORCE ROW LEVEL SECURITY;
+DROP POLICY IF EXISTS users_org_isolation ON govcore.users;
+CREATE POLICY users_org_isolation ON govcore.users
+  USING (organization_id = nullif(current_setting('app.current_org', true), '')::uuid);
+
+ALTER TABLE govcore.user_organization_memberships ENABLE ROW LEVEL SECURITY;
+ALTER TABLE govcore.user_organization_memberships FORCE ROW LEVEL SECURITY;
+DROP POLICY IF EXISTS memberships_org_isolation ON govcore.user_organization_memberships;
+CREATE POLICY memberships_org_isolation ON govcore.user_organization_memberships
+  USING (organization_id = nullif(current_setting('app.current_org', true), '')::uuid);
+
+ALTER TABLE govcore.audit_log ENABLE ROW LEVEL SECURITY;
+ALTER TABLE govcore.audit_log FORCE ROW LEVEL SECURITY;
+DROP POLICY IF EXISTS audit_org_isolation ON govcore.audit_log;
+-- Reads scoped to the active org (or org-less platform events); inserts allowed
+-- (e.g. cross-org support actions record an audit row). Immutability is the
+-- trigger above; UPDATE/DELETE never reach the policy.
+CREATE POLICY audit_org_isolation ON govcore.audit_log
+  USING (organization_id IS NULL OR organization_id = nullif(current_setting('app.current_org', true), '')::uuid)
+  WITH CHECK (true);

package/migrations/0002_platform_federation_support.sql

@@ -0,0 +1,103 @@
+-- 0002_platform_federation_support — federation, support access, instance config.
+-- Authored DDL (design §5). Keep in sync with packages/schema/src/schema.ts.
+
+DO $$ BEGIN
+  CREATE TYPE govcore.federation_status AS ENUM ('pending', 'active', 'rejected');
+EXCEPTION WHEN duplicate_object THEN NULL;
+END $$;
+
+-- ── Federation ─────────────────────────────────────────────────────────────
+CREATE TABLE IF NOT EXISTS govcore.org_connections (
+  id          uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  from_org_id uuid NOT NULL REFERENCES govcore.organizations (id) ON DELETE CASCADE,
+  to_org_id   uuid NOT NULL REFERENCES govcore.organizations (id) ON DELETE CASCADE,
+  status      govcore.federation_status NOT NULL DEFAULT 'pending',
+  created_by  uuid REFERENCES govcore.users (id),
+  created_at  timestamp NOT NULL DEFAULT now(),
+  updated_at  timestamp NOT NULL DEFAULT now(),
+  CONSTRAINT unique_org_connection UNIQUE (from_org_id, to_org_id)
+);
+
+CREATE TABLE IF NOT EXISTS govcore.cross_org_links (
+  id                 uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  source_org_id      uuid NOT NULL REFERENCES govcore.organizations (id) ON DELETE CASCADE,
+  source_entity_type text NOT NULL,
+  source_entity_id   uuid NOT NULL,
+  target_org_id      uuid NOT NULL REFERENCES govcore.organizations (id) ON DELETE CASCADE,
+  target_entity_type text NOT NULL,
+  target_entity_id   uuid NOT NULL,
+  link_type          text NOT NULL,
+  status             govcore.federation_status NOT NULL DEFAULT 'pending',
+  rejection_reason   text,
+  flagged_for_review boolean NOT NULL DEFAULT false,
+  flag_reason        text,
+  created_by         uuid REFERENCES govcore.users (id),
+  created_at         timestamp NOT NULL DEFAULT now(),
+  updated_at         timestamp NOT NULL DEFAULT now()
+);
+
+-- ── Support access (break-glass + act-as) ──────────────────────────────────
+CREATE TABLE IF NOT EXISTS govcore.break_glass_sessions (
+  id                uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  instance_admin_id uuid NOT NULL REFERENCES govcore.users (id),
+  target_org_id     uuid NOT NULL REFERENCES govcore.organizations (id),
+  reason            text NOT NULL,
+  granted_at        timestamp NOT NULL DEFAULT now(),
+  expires_at        timestamp NOT NULL,
+  requires_approval boolean NOT NULL DEFAULT false,
+  approved_at       timestamp,
+  approved_by       uuid REFERENCES govcore.users (id),
+  revoked_at        timestamp,
+  revoked_by        uuid REFERENCES govcore.users (id)
+);
+
+CREATE TABLE IF NOT EXISTS govcore.act_as_sessions (
+  id                     uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  break_glass_session_id uuid NOT NULL REFERENCES govcore.break_glass_sessions (id),
+  instance_admin_id      uuid NOT NULL REFERENCES govcore.users (id),
+  target_org_id          uuid NOT NULL REFERENCES govcore.organizations (id),
+  started_at             timestamp NOT NULL DEFAULT now(),
+  expires_at             timestamp NOT NULL,
+  ended_at               timestamp,
+  end_reason             text
+);
+
+-- ── Instance / platform configuration (singletons) ─────────────────────────
+CREATE TABLE IF NOT EXISTS govcore.instance_settings (
+  id               uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  disabled_modules jsonb NOT NULL DEFAULT '{}'::jsonb,
+  created_at       timestamp NOT NULL DEFAULT now(),
+  updated_at       timestamp NOT NULL DEFAULT now()
+);
+
+CREATE TABLE IF NOT EXISTS govcore.platform_config (
+  id                   text PRIMARY KEY DEFAULT 'singleton',
+  instance_name        text NOT NULL DEFAULT 'GovCore',
+  default_theme        text NOT NULL DEFAULT 'base',
+  allow_local_auth     boolean NOT NULL DEFAULT true,
+  default_support_tier text,
+  updated_at           timestamp NOT NULL DEFAULT now(),
+  updated_by           uuid REFERENCES govcore.users (id) ON DELETE SET NULL
+);
+
+-- ── RLS: federation tables are visible to BOTH participating orgs ───────────
+-- The active-org GUC must be one of the two orgs on the row. Unset GUC ⇒ no
+-- match ⇒ denied (deny by default). This is also the WITH CHECK on writes, so
+-- an org can only create a connection/link it participates in.
+ALTER TABLE govcore.org_connections ENABLE ROW LEVEL SECURITY;
+ALTER TABLE govcore.org_connections FORCE ROW LEVEL SECURITY;
+DROP POLICY IF EXISTS org_connections_participant ON govcore.org_connections;
+CREATE POLICY org_connections_participant ON govcore.org_connections
+  USING (nullif(current_setting('app.current_org', true), '')::uuid IN (from_org_id, to_org_id));
+
+ALTER TABLE govcore.cross_org_links ENABLE ROW LEVEL SECURITY;
+ALTER TABLE govcore.cross_org_links FORCE ROW LEVEL SECURITY;
+DROP POLICY IF EXISTS cross_org_links_participant ON govcore.cross_org_links;
+CREATE POLICY cross_org_links_participant ON govcore.cross_org_links
+  USING (nullif(current_setting('app.current_org', true), '')::uuid IN (source_org_id, target_org_id));
+
+-- break_glass_sessions, act_as_sessions, instance_settings, platform_config are
+-- intentionally NOT under org-GUC RLS: they are instance-operator / singleton
+-- tables. Authorization is enforced in app/@govcore/support code; a refined
+-- instance-admin RLS bypass is future work (design §6.6, the single sanctioned
+-- cross-org bypass).

package/package.json

@@ -0,0 +1,35 @@
+{
+  "name": "@govcore/schema",
+  "version": "0.1.0",
+  "description": "Platform tables, enums, migrations, and the govcore-migrate runner",
+  "type": "module",
+  "main": "./src/index.ts",
+  "types": "./src/index.ts",
+  "exports": {
+    ".": {
+      "types": "./src/index.ts",
+      "default": "./src/index.ts"
+    },
+    "./migrate": {
+      "types": "./src/migrate.ts",
+      "default": "./src/migrate.ts"
+    }
+  },
+  "bin": {
+    "govcore-migrate": "./dist/migrate.js"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "dependencies": {
+    "drizzle-orm": "^0.45.2",
+    "postgres": "^3.4.0"
+  },
+  "devDependencies": {
+    "typescript": "^5.5.0"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "dev": "tsc -p tsconfig.json --watch"
+  }
+}

package/src/index.ts

@@ -0,0 +1,21 @@
+// @govcore/schema — platform table definitions + schema version.
+// Edge-safe entrypoint (no DB client). The migrate runner is ./migrate.
+
+import type { PgDatabase, PgQueryResultHKT } from 'drizzle-orm/pg-core'
+
+export * from './schema'
+
+/**
+ * A Drizzle Postgres database **or** transaction handle. Functions in the
+ * tenancy/audit packages accept this so callers inject their own client (the
+ * app's `postgres-js` db, or a `tx` inside a transaction — which extends it).
+ */
+export type GovcoreDb = PgDatabase<PgQueryResultHKT, any, any>
+
+/**
+ * Bumped whenever the platform schema changes. Written to instance settings on
+ * boot for observability ("this instance runs platform schema vN", design §5),
+ * and stamped into backup archives (design §13.5). Not load-bearing for
+ * correctness — the migrations are — but useful for diagnostics.
+ */
+export const CORE_SCHEMA_VERSION = '0.0.0'

package/src/migrate.ts

@@ -0,0 +1,85 @@
+// @govcore/schema/migrate — the govcore-migrate runner.
+//
+// NOT edge-safe (uses node:fs + a postgres client). Applies the authored
+// platform migrations in ../migrations in lexical order, each in its own
+// transaction, tracked in `govcore.__govcore_migrations` — kept separate from
+// the app's own Drizzle journal so the two migration streams never overlap
+// (design §5).
+//
+// Runs as the OWNER / DDL role (design §13.2): set GOVCORE_MIGRATE_DATABASE_URL
+// to the owning role's connection string; falls back to DATABASE_URL. The app
+// runtime connects as a separate NON-OWNER role, which RLS binds.
+
+import { readdirSync, readFileSync } from 'node:fs'
+import { dirname, join } from 'node:path'
+import { fileURLToPath } from 'node:url'
+import postgres from 'postgres'
+
+const MIGRATIONS_DIR = join(dirname(fileURLToPath(import.meta.url)), '..', 'migrations')
+
+export interface MigrateOptions {
+  /** Connection string for the owner/DDL role. Defaults to env. */
+  connectionString?: string
+  /** Optional logger; defaults to console.log. */
+  log?: (message: string) => void
+}
+
+/** Apply all pending platform migrations. Idempotent — already-applied files are skipped. */
+export async function migrate(options: MigrateOptions = {}): Promise<{ applied: string[] }> {
+  const connectionString =
+    options.connectionString ??
+    process.env.GOVCORE_MIGRATE_DATABASE_URL ??
+    process.env.DATABASE_URL
+  if (!connectionString) {
+    throw new Error(
+      'govcore-migrate: set GOVCORE_MIGRATE_DATABASE_URL (owner role) or DATABASE_URL',
+    )
+  }
+  const log = options.log ?? ((m: string) => console.log(m))
+  const sql = postgres(connectionString, { max: 1 })
+  const applied: string[] = []
+  try {
+    await sql.unsafe('CREATE SCHEMA IF NOT EXISTS govcore')
+    await sql.unsafe(
+      `CREATE TABLE IF NOT EXISTS govcore.__govcore_migrations (
+         name text PRIMARY KEY,
+         applied_at timestamptz NOT NULL DEFAULT now()
+       )`,
+    )
+
+    const done = new Set(
+      (await sql`SELECT name FROM govcore.__govcore_migrations`).map((r) => r.name as string),
+    )
+    const files = readdirSync(MIGRATIONS_DIR)
+      .filter((f) => f.endsWith('.sql'))
+      .sort()
+
+    for (const file of files) {
+      if (done.has(file)) continue
+      const ddl = readFileSync(join(MIGRATIONS_DIR, file), 'utf8')
+      await sql.begin(async (tx) => {
+        await tx.unsafe(ddl)
+        await tx`INSERT INTO govcore.__govcore_migrations (name) VALUES (${file})`
+      })
+      applied.push(file)
+      log(`govcore-migrate: applied ${file}`)
+    }
+
+    log(
+      applied.length
+        ? `govcore-migrate: applied ${applied.length} migration(s)`
+        : 'govcore-migrate: already up to date',
+    )
+    return { applied }
+  } finally {
+    await sql.end()
+  }
+}
+
+// Run when invoked as the `govcore-migrate` bin.
+if (process.argv[1] && import.meta.url === `file://${process.argv[1]}`) {
+  migrate().catch((err) => {
+    console.error(err)
+    process.exit(1)
+  })
+}