@govcore/server 0.1.2 → 0.2.1

package/dist/index.d.ts

@@ -1,18 +1,59 @@
-import { type GovcoreDb } from '@govcore/schema';
-import { type AuditEvent } from '@govcore/audit';
+import { GovcoreDb } from '@govcore/schema';
+import { AuditEvent } from '@govcore/audit';
+
+/** The default `instanceRole` value that grants operator-plane access. */
+declare const INSTANCE_ADMIN_ROLE = "instance_admin";
+/** What an operator handler receives: the actor plus a pre-bound audit writer. */
+interface OperatorContext {
+    userId: string;
+    instanceRole: string;
+    /** Write a platform audit row, pre-filled with the operator as actor. */
+    audit: (event: AuditEvent) => Promise<void>;
+}
+interface CreateOperatorActionsConfig {
+    /**
+     * The privileged, RLS-bypassing pool (the same one createAuth takes as
+     * `authDb`). Operator queries run here because they are cross-org and must
+     * not be filtered by the tenant GUC.
+     */
+    operatorDb: GovcoreDb;
+    /** Resolve the current actor's active context — typically from the auth() session. */
+    getActiveContext: () => Promise<ActiveContext | null>;
+    /** The `instanceRole` that grants operator access. Default `instance_admin`. */
+    operatorRole?: string;
+    /** Called when there is no active context. Default: throws Error('Unauthorized'). */
+    onUnauthorized?: () => never;
+    /** Called when the actor is not an operator. Default: throws Error('Forbidden'). */
+    onForbidden?: () => never;
+}
+type OperatorActionHandler<I, O> = (args: {
+    ctx: OperatorContext;
+    db: GovcoreDb;
+}, input: I) => Promise<O>;
+/**
+ * Build the app's typed `operatorAction`. Call once at app startup with the
+ * privileged pool and the session→context resolver.
+ *
+ * The handler receives the raw `operatorDb` (not a pre-opened transaction):
+ * cross-org operator mutations — e.g. `@govcore/tenancy`'s `createOrganization`
+ * / `updateUserAdministration` — open and audit their own transactions, so a
+ * forced outer transaction would only nest. Deliberately sets no org GUC.
+ */
+declare function createOperatorActions(config: CreateOperatorActionsConfig): <I = void, O = unknown>(handler: OperatorActionHandler<I, O>) => (input: I) => Promise<O>;
+
 /** The trusted, server-resolved identity of the current actor. */
-export interface ActiveContext {
+interface ActiveContext {
     userId: string;
     organizationId: string;
     role: string;
     instanceRole?: string | null;
 }
 /** What a handler receives: the active context plus a pre-bound audit writer. */
-export interface TenantActionContext extends ActiveContext {
+interface TenantActionContext extends ActiveContext {
     /** Write an audit row in the *same* transaction, pre-filled with actor + org. */
     audit: (event: AuditEvent) => Promise<void>;
 }
-export interface CreateTenantActionsConfig {
+interface CreateTenantActionsConfig {
     db: GovcoreDb;
     /** Resolve the current actor's active context — typically from the auth() session. */
     getActiveContext: () => Promise<ActiveContext | null>;
@@ -30,11 +71,11 @@ export interface CreateTenantActionsConfig {
     /** Called when the permission check fails. Default: throws Error('Forbidden'). */
     onForbidden?: () => never;
 }
-export type TenantActionHandler<I, O> = (args: {
+type TenantActionHandler<I, O> = (args: {
     ctx: TenantActionContext;
     db: GovcoreDb;
 }, input: I) => Promise<O>;
-export interface TenantActionOptions {
+interface TenantActionOptions {
     /** Permission required to run this action (checked against the active role). */
     permission?: string;
 }
@@ -42,5 +83,6 @@ export interface TenantActionOptions {
  * Build the app's typed `tenantAction`. Call once at app startup with the app's
  * db, session→context resolver, and rbac instance.
  */
-export declare function createTenantActions(config: CreateTenantActionsConfig): <I = void, O = unknown>(options: TenantActionOptions, handler: TenantActionHandler<I, O>) => (input: I) => Promise<O>;
-//# sourceMappingURL=index.d.ts.map
+declare function createTenantActions(config: CreateTenantActionsConfig): <I = void, O = unknown>(options: TenantActionOptions, handler: TenantActionHandler<I, O>) => (input: I) => Promise<O>;
+
+export { type ActiveContext, type CreateOperatorActionsConfig, type CreateTenantActionsConfig, INSTANCE_ADMIN_ROLE, type OperatorActionHandler, type OperatorContext, type TenantActionContext, type TenantActionHandler, type TenantActionOptions, createOperatorActions, createTenantActions };

package/dist/index.js

@@ -1,52 +1,70 @@
-// @govcore/server — tenantAction, the enforced server-action seam.
-//
-// Every tenant-scoped mutation runs through here. tenantAction:
-//   1. resolves the actor's active context (never trusts caller input),
-//   2. applies a permission gate (if configured),
-//   3. opens a transaction and sets the transaction-local org GUC, so the RLS
-//      policies in @govcore/schema apply to every query in the handler, and
-//   4. hands the handler an audit fn pre-bound to the actor + org.
-//
-// The app builds its own typed `tenantAction` once via createTenantActions,
-// injecting its db, its session→context resolver, and its rbac instance.
-import { sql } from 'drizzle-orm';
-import { writeAuditLog } from '@govcore/audit';
-/**
- * Build the app's typed `tenantAction`. Call once at app startup with the app's
- * db, session→context resolver, and rbac instance.
- */
-export function createTenantActions(config) {
-    const { db, getActiveContext, rbac } = config;
-    return function tenantAction(options, handler) {
-        return async (input) => {
-            const active = await getActiveContext();
-            if (!active) {
-                if (config.onUnauthorized)
-                    return config.onUnauthorized();
-                throw new Error('Unauthorized');
-            }
-            if (options.permission) {
-                const allowed = rbac?.hasPermission(active.role, options.permission) ?? false;
-                if (!allowed) {
-                    if (config.onForbidden)
-                        return config.onForbidden();
-                    throw new Error('Forbidden');
-                }
-            }
-            return db.transaction(async (tx) => {
-                // Transaction-local org GUC → RLS policies bind to every query below.
-                await tx.execute(sql `select set_config('app.current_org', ${active.organizationId}, true)`);
-                const txDb = tx;
-                const ctx = {
-                    ...active,
-                    audit: (event) => writeAuditLog(txDb, {
-                        ...event,
-                        userId: event.userId ?? active.userId,
-                        organizationId: event.organizationId ?? active.organizationId,
-                    }),
-                };
-                return handler({ ctx, db: txDb }, input);
-            });
+// src/index.ts
+import { sql } from "drizzle-orm";
+import { writeAuditLog as writeAuditLog2 } from "@govcore/audit";
+
+// src/operator.ts
+import { writeAuditLog } from "@govcore/audit";
+var INSTANCE_ADMIN_ROLE = "instance_admin";
+function createOperatorActions(config) {
+  const { operatorDb, getActiveContext } = config;
+  const operatorRole = config.operatorRole ?? INSTANCE_ADMIN_ROLE;
+  return function operatorAction(handler) {
+    return async (input) => {
+      const active = await getActiveContext();
+      if (!active) {
+        if (config.onUnauthorized) return config.onUnauthorized();
+        throw new Error("Unauthorized");
+      }
+      if (active.instanceRole !== operatorRole) {
+        if (config.onForbidden) return config.onForbidden();
+        throw new Error("Forbidden");
+      }
+      const ctx = {
+        userId: active.userId,
+        instanceRole: active.instanceRole,
+        audit: (event) => writeAuditLog(operatorDb, { ...event, userId: event.userId ?? active.userId })
+      };
+      return handler({ ctx, db: operatorDb }, input);
+    };
+  };
+}
+
+// src/index.ts
+function createTenantActions(config) {
+  const { db, getActiveContext, rbac } = config;
+  return function tenantAction(options, handler) {
+    return async (input) => {
+      const active = await getActiveContext();
+      if (!active) {
+        if (config.onUnauthorized) return config.onUnauthorized();
+        throw new Error("Unauthorized");
+      }
+      if (options.permission) {
+        const allowed = rbac?.hasPermission(active.role, options.permission) ?? false;
+        if (!allowed) {
+          if (config.onForbidden) return config.onForbidden();
+          throw new Error("Forbidden");
+        }
+      }
+      return db.transaction(async (tx) => {
+        await tx.execute(sql`select set_config('app.current_org', ${active.organizationId}, true)`);
+        const txDb = tx;
+        const ctx = {
+          ...active,
+          audit: (event) => writeAuditLog2(txDb, {
+            ...event,
+            userId: event.userId ?? active.userId,
+            organizationId: event.organizationId ?? active.organizationId
+          })
         };
+        return handler({ ctx, db: txDb }, input);
+      });
     };
+  };
 }
+export {
+  INSTANCE_ADMIN_ROLE,
+  createOperatorActions,
+  createTenantActions
+};
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/index.ts","../src/operator.ts"],"sourcesContent":["// @govcore/server — tenantAction, the enforced server-action seam.\n//\n// Every tenant-scoped mutation runs through here. tenantAction:\n//   1. resolves the actor's active context (never trusts caller input),\n//   2. applies a permission gate (if configured),\n//   3. opens a transaction and sets the transaction-local org GUC, so the RLS\n//      policies in @govcore/schema apply to every query in the handler, and\n//   4. hands the handler an audit fn pre-bound to the actor + org.\n//\n// The app builds its own typed `tenantAction` once via createTenantActions,\n// injecting its db, its session→context resolver, and its rbac instance.\n\nimport { sql } from 'drizzle-orm'\nimport { type GovcoreDb } from '@govcore/schema'\nimport { writeAuditLog, type AuditEvent } from '@govcore/audit'\n\n/** The trusted, server-resolved identity of the current actor. */\nexport interface ActiveContext {\n  userId: string\n  organizationId: string\n  role: string\n  instanceRole?: string | null\n}\n\n/** What a handler receives: the active context plus a pre-bound audit writer. */\nexport interface TenantActionContext extends ActiveContext {\n  /** Write an audit row in the *same* transaction, pre-filled with actor + org. */\n  audit: (event: AuditEvent) => Promise<void>\n}\n\nexport interface CreateTenantActionsConfig {\n  db: GovcoreDb\n  /** Resolve the current actor's active context — typically from the auth() session. */\n  getActiveContext: () => Promise<ActiveContext | null>\n  /**\n   * Optional permission gate — pass an `@govcore/rbac` instance directly. Method\n   * syntax (not an arrow property) so its bivariant parameters accept a\n   * `createRbac<Role, Permission>()` whose `hasPermission` is typed with the\n   * app's role/permission *literals*, while the active role here is a `string`.\n   */\n  rbac?: { hasPermission(role: string, permission: string): boolean }\n  /** Called when there is no active context. Default: throws Error('Unauthorized'). */\n  onUnauthorized?: () => never\n  /** Called when the permission check fails. Default: throws Error('Forbidden'). */\n  onForbidden?: () => never\n}\n\nexport type TenantActionHandler<I, O> = (\n  args: { ctx: TenantActionContext; db: GovcoreDb },\n  input: I,\n) => Promise<O>\n\nexport interface TenantActionOptions {\n  /** Permission required to run this action (checked against the active role). */\n  permission?: string\n}\n\n/**\n * Build the app's typed `tenantAction`. Call once at app startup with the app's\n * db, session→context resolver, and rbac instance.\n */\nexport function createTenantActions(config: CreateTenantActionsConfig) {\n  const { db, getActiveContext, rbac } = config\n\n  return function tenantAction<I = void, O = unknown>(\n    options: TenantActionOptions,\n    handler: TenantActionHandler<I, O>,\n  ): (input: I) => Promise<O> {\n    return async (input: I): Promise<O> => {\n      const active = await getActiveContext()\n      if (!active) {\n        if (config.onUnauthorized) return config.onUnauthorized()\n        throw new Error('Unauthorized')\n      }\n\n      if (options.permission) {\n        const allowed = rbac?.hasPermission(active.role, options.permission) ?? false\n        if (!allowed) {\n          if (config.onForbidden) return config.onForbidden()\n          throw new Error('Forbidden')\n        }\n      }\n\n      return db.transaction(async (tx) => {\n        // Transaction-local org GUC → RLS policies bind to every query below.\n        await tx.execute(sql`select set_config('app.current_org', ${active.organizationId}, true)`)\n        const txDb = tx as unknown as GovcoreDb\n        const ctx: TenantActionContext = {\n          ...active,\n          audit: (event) =>\n            writeAuditLog(txDb, {\n              ...event,\n              userId: event.userId ?? active.userId,\n              organizationId: event.organizationId ?? active.organizationId,\n            }),\n        }\n        return handler({ ctx, db: txDb }, input)\n      })\n    }\n  }\n}\n\nexport {\n  createOperatorActions,\n  INSTANCE_ADMIN_ROLE,\n  type OperatorContext,\n  type CreateOperatorActionsConfig,\n  type OperatorActionHandler,\n} from './operator'\n","// @govcore/server — operatorAction, the operator-plane counterpart to tenantAction.\n//\n// The instance console legitimately crosses org boundaries: list every org,\n// provision a user in any org, read the platform audit. Those queries must NOT\n// run through the tenant seam — there is no single active org, and the runtime\n// pool's FORCE-RLS (keyed on the `app.current_org` GUC) would filter them to\n// nothing. So the operator plane is the mirror image of tenantAction:\n//\n//   tenantAction   — runtime pool · sets the org GUC · gated by an RBAC permission\n//   operatorAction — privileged pool · NO org GUC (cross-org) · gated by instanceRole\n//\n// The privileged `operatorDb` is the same RLS-bypassing pool createAuth takes as\n// `authDb`. Wrapping every cross-org mutation in operatorAction is what turns a\n// consumer's ad-hoc `platformDb.select(...)` into a named, instance-admin-gated\n// seam — so the gate can't be forgotten and the plane has one definition.\n\nimport { type GovcoreDb } from '@govcore/schema'\nimport { writeAuditLog, type AuditEvent } from '@govcore/audit'\nimport type { ActiveContext } from './index'\n\n/** The default `instanceRole` value that grants operator-plane access. */\nexport const INSTANCE_ADMIN_ROLE = 'instance_admin'\n\n/** What an operator handler receives: the actor plus a pre-bound audit writer. */\nexport interface OperatorContext {\n  userId: string\n  instanceRole: string\n  /** Write a platform audit row, pre-filled with the operator as actor. */\n  audit: (event: AuditEvent) => Promise<void>\n}\n\nexport interface CreateOperatorActionsConfig {\n  /**\n   * The privileged, RLS-bypassing pool (the same one createAuth takes as\n   * `authDb`). Operator queries run here because they are cross-org and must\n   * not be filtered by the tenant GUC.\n   */\n  operatorDb: GovcoreDb\n  /** Resolve the current actor's active context — typically from the auth() session. */\n  getActiveContext: () => Promise<ActiveContext | null>\n  /** The `instanceRole` that grants operator access. Default `instance_admin`. */\n  operatorRole?: string\n  /** Called when there is no active context. Default: throws Error('Unauthorized'). */\n  onUnauthorized?: () => never\n  /** Called when the actor is not an operator. Default: throws Error('Forbidden'). */\n  onForbidden?: () => never\n}\n\nexport type OperatorActionHandler<I, O> = (\n  args: { ctx: OperatorContext; db: GovcoreDb },\n  input: I,\n) => Promise<O>\n\n/**\n * Build the app's typed `operatorAction`. Call once at app startup with the\n * privileged pool and the session→context resolver.\n *\n * The handler receives the raw `operatorDb` (not a pre-opened transaction):\n * cross-org operator mutations — e.g. `@govcore/tenancy`'s `createOrganization`\n * / `updateUserAdministration` — open and audit their own transactions, so a\n * forced outer transaction would only nest. Deliberately sets no org GUC.\n */\nexport function createOperatorActions(config: CreateOperatorActionsConfig) {\n  const { operatorDb, getActiveContext } = config\n  const operatorRole = config.operatorRole ?? INSTANCE_ADMIN_ROLE\n\n  return function operatorAction<I = void, O = unknown>(\n    handler: OperatorActionHandler<I, O>,\n  ): (input: I) => Promise<O> {\n    return async (input: I): Promise<O> => {\n      const active = await getActiveContext()\n      if (!active) {\n        if (config.onUnauthorized) return config.onUnauthorized()\n        throw new Error('Unauthorized')\n      }\n      if (active.instanceRole !== operatorRole) {\n        if (config.onForbidden) return config.onForbidden()\n        throw new Error('Forbidden')\n      }\n\n      const ctx: OperatorContext = {\n        userId: active.userId,\n        instanceRole: active.instanceRole,\n        audit: (event) =>\n          writeAuditLog(operatorDb, { ...event, userId: event.userId ?? active.userId }),\n      }\n      return handler({ ctx, db: operatorDb }, input)\n    }\n  }\n}\n"],"mappings":";AAYA,SAAS,WAAW;AAEpB,SAAS,iBAAAA,sBAAsC;;;ACG/C,SAAS,qBAAsC;AAIxC,IAAM,sBAAsB;AAyC5B,SAAS,sBAAsB,QAAqC;AACzE,QAAM,EAAE,YAAY,iBAAiB,IAAI;AACzC,QAAM,eAAe,OAAO,gBAAgB;AAE5C,SAAO,SAAS,eACd,SAC0B;AAC1B,WAAO,OAAO,UAAyB;AACrC,YAAM,SAAS,MAAM,iBAAiB;AACtC,UAAI,CAAC,QAAQ;AACX,YAAI,OAAO,eAAgB,QAAO,OAAO,eAAe;AACxD,cAAM,IAAI,MAAM,cAAc;AAAA,MAChC;AACA,UAAI,OAAO,iBAAiB,cAAc;AACxC,YAAI,OAAO,YAAa,QAAO,OAAO,YAAY;AAClD,cAAM,IAAI,MAAM,WAAW;AAAA,MAC7B;AAEA,YAAM,MAAuB;AAAA,QAC3B,QAAQ,OAAO;AAAA,QACf,cAAc,OAAO;AAAA,QACrB,OAAO,CAAC,UACN,cAAc,YAAY,EAAE,GAAG,OAAO,QAAQ,MAAM,UAAU,OAAO,OAAO,CAAC;AAAA,MACjF;AACA,aAAO,QAAQ,EAAE,KAAK,IAAI,WAAW,GAAG,KAAK;AAAA,IAC/C;AAAA,EACF;AACF;;;AD5BO,SAAS,oBAAoB,QAAmC;AACrE,QAAM,EAAE,IAAI,kBAAkB,KAAK,IAAI;AAEvC,SAAO,SAAS,aACd,SACA,SAC0B;AAC1B,WAAO,OAAO,UAAyB;AACrC,YAAM,SAAS,MAAM,iBAAiB;AACtC,UAAI,CAAC,QAAQ;AACX,YAAI,OAAO,eAAgB,QAAO,OAAO,eAAe;AACxD,cAAM,IAAI,MAAM,cAAc;AAAA,MAChC;AAEA,UAAI,QAAQ,YAAY;AACtB,cAAM,UAAU,MAAM,cAAc,OAAO,MAAM,QAAQ,UAAU,KAAK;AACxE,YAAI,CAAC,SAAS;AACZ,cAAI,OAAO,YAAa,QAAO,OAAO,YAAY;AAClD,gBAAM,IAAI,MAAM,WAAW;AAAA,QAC7B;AAAA,MACF;AAEA,aAAO,GAAG,YAAY,OAAO,OAAO;AAElC,cAAM,GAAG,QAAQ,2CAA2C,OAAO,cAAc,SAAS;AAC1F,cAAM,OAAO;AACb,cAAM,MAA2B;AAAA,UAC/B,GAAG;AAAA,UACH,OAAO,CAAC,UACNC,eAAc,MAAM;AAAA,YAClB,GAAG;AAAA,YACH,QAAQ,MAAM,UAAU,OAAO;AAAA,YAC/B,gBAAgB,MAAM,kBAAkB,OAAO;AAAA,UACjD,CAAC;AAAA,QACL;AACA,eAAO,QAAQ,EAAE,KAAK,IAAI,KAAK,GAAG,KAAK;AAAA,MACzC,CAAC;AAAA,IACH;AAAA,EACF;AACF;","names":["writeAuditLog","writeAuditLog"]}

package/package.json

@@ -1,14 +1,14 @@
 {
   "name": "@govcore/server",
-  "version": "0.1.2",
+  "version": "0.2.1",
   "description": "tenantAction — the server-action wrapper that opens the tenant transaction, sets the RLS org GUC, gates on permission, and binds audit",
   "type": "module",
-  "main": "./src/index.ts",
-  "types": "./src/index.ts",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
   "exports": {
     ".": {
-      "types": "./src/index.ts",
-      "default": "./src/index.ts"
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
     }
   },
   "publishConfig": {
@@ -16,14 +16,30 @@
   },
   "dependencies": {
     "drizzle-orm": "^0.45.2",
-    "@govcore/audit": "0.1.1",
-    "@govcore/schema": "0.2.0"
+    "@govcore/schema": "0.2.1",
+    "@govcore/audit": "0.1.2"
   },
   "devDependencies": {
-    "typescript": "^5.5.0"
+    "typescript": "^5.5.0",
+    "tsup": "^8.3.0"
+  },
+  "module": "./dist/index.js",
+  "files": [
+    "dist"
+  ],
+  "tsup": {
+    "entry": [
+      "src/index.ts"
+    ],
+    "format": [
+      "esm"
+    ],
+    "dts": true,
+    "clean": true,
+    "sourcemap": true
   },
   "scripts": {
-    "build": "tsc -p tsconfig.json",
-    "dev": "tsc -p tsconfig.json --watch"
+    "build": "tsup",
+    "dev": "tsup --watch"
   }
 }

package/CHANGELOG.md

@@ -1,39 +0,0 @@
-# @govcore/server
-
-## 0.1.2
-
-### Patch Changes
-
-- Updated dependencies [d255afc]
-  - @govcore/schema@0.2.0
-  - @govcore/audit@0.1.1
-
-## 0.1.1
-
-### Patch Changes
-
-- f3bce48: `createTenantActions` now accepts a `createRbac()` instance for its `rbac` gate without a cast. `CreateTenantActionsConfig.rbac.hasPermission` is declared with method syntax so its bivariant parameters accept a gate typed with the app's role/permission _literals_ (what `@govcore/rbac` returns), while the active role is checked as a `string`. Removes a consumer footgun (#45).
-
-## 0.1.0
-
-### Minor Changes
-
-- 8db62da: Phase 4 (part 1) — the action seam and the accessibility floor.
-
-  `@govcore/server`: `createTenantActions` → a typed `tenantAction` wrapper. It
-  resolves the actor's active context (never trusting caller input), applies an
-  optional permission gate, opens a transaction and sets the transaction-local
-  `app.current_org` GUC so the schema's RLS policies bind to every query, and hands
-  the handler an `audit` fn pre-bound to the actor + org.
-
-  `@govcore/theme`: a WCAG-AA base token set (`base.css`, light/dark, visible focus
-  ring), a Tailwind `baseTheme` preset, and `defineTheme` — which only allows
-  overriding allowlisted brand vars and sanitizes values to prevent inline-`<style>`
-  breakout (#769).
-
-### Patch Changes
-
-- Updated dependencies
-- Updated dependencies [f2f3743]
-  - @govcore/audit@0.1.0
-  - @govcore/schema@0.1.0

package/dist/index.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAaA,OAAO,EAAE,KAAK,SAAS,EAAE,MAAM,iBAAiB,CAAA;AAChD,OAAO,EAAiB,KAAK,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAE/D,kEAAkE;AAClE,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,MAAM,CAAA;IACd,cAAc,EAAE,MAAM,CAAA;IACtB,IAAI,EAAE,MAAM,CAAA;IACZ,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAC7B;AAED,iFAAiF;AACjF,MAAM,WAAW,mBAAoB,SAAQ,aAAa;IACxD,iFAAiF;IACjF,KAAK,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;CAC5C;AAED,MAAM,WAAW,yBAAyB;IACxC,EAAE,EAAE,SAAS,CAAA;IACb,sFAAsF;IACtF,gBAAgB,EAAE,MAAM,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAAA;IACrD;;;;;OAKG;IACH,IAAI,CAAC,EAAE;QAAE,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE,CAAA;IACnE,qFAAqF;IACrF,cAAc,CAAC,EAAE,MAAM,KAAK,CAAA;IAC5B,kFAAkF;IAClF,WAAW,CAAC,EAAE,MAAM,KAAK,CAAA;CAC1B;AAED,MAAM,MAAM,mBAAmB,CAAC,CAAC,EAAE,CAAC,IAAI,CACtC,IAAI,EAAE;IAAE,GAAG,EAAE,mBAAmB,CAAC;IAAC,EAAE,EAAE,SAAS,CAAA;CAAE,EACjD,KAAK,EAAE,CAAC,KACL,OAAO,CAAC,CAAC,CAAC,CAAA;AAEf,MAAM,WAAW,mBAAmB;IAClC,gFAAgF;IAChF,UAAU,CAAC,EAAE,MAAM,CAAA;CACpB;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,yBAAyB,IAGtC,CAAC,GAAG,IAAI,EAAE,CAAC,GAAG,OAAO,EAChD,SAAS,mBAAmB,EAC5B,SAAS,mBAAmB,CAAC,CAAC,EAAE,CAAC,CAAC,KACjC,CAAC,KAAK,EAAE,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,CAiC5B"}

package/src/index.ts

@@ -1,101 +0,0 @@
-// @govcore/server — tenantAction, the enforced server-action seam.
-//
-// Every tenant-scoped mutation runs through here. tenantAction:
-//   1. resolves the actor's active context (never trusts caller input),
-//   2. applies a permission gate (if configured),
-//   3. opens a transaction and sets the transaction-local org GUC, so the RLS
-//      policies in @govcore/schema apply to every query in the handler, and
-//   4. hands the handler an audit fn pre-bound to the actor + org.
-//
-// The app builds its own typed `tenantAction` once via createTenantActions,
-// injecting its db, its session→context resolver, and its rbac instance.
-
-import { sql } from 'drizzle-orm'
-import { type GovcoreDb } from '@govcore/schema'
-import { writeAuditLog, type AuditEvent } from '@govcore/audit'
-
-/** The trusted, server-resolved identity of the current actor. */
-export interface ActiveContext {
-  userId: string
-  organizationId: string
-  role: string
-  instanceRole?: string | null
-}
-
-/** What a handler receives: the active context plus a pre-bound audit writer. */
-export interface TenantActionContext extends ActiveContext {
-  /** Write an audit row in the *same* transaction, pre-filled with actor + org. */
-  audit: (event: AuditEvent) => Promise<void>
-}
-
-export interface CreateTenantActionsConfig {
-  db: GovcoreDb
-  /** Resolve the current actor's active context — typically from the auth() session. */
-  getActiveContext: () => Promise<ActiveContext | null>
-  /**
-   * Optional permission gate — pass an `@govcore/rbac` instance directly. Method
-   * syntax (not an arrow property) so its bivariant parameters accept a
-   * `createRbac<Role, Permission>()` whose `hasPermission` is typed with the
-   * app's role/permission *literals*, while the active role here is a `string`.
-   */
-  rbac?: { hasPermission(role: string, permission: string): boolean }
-  /** Called when there is no active context. Default: throws Error('Unauthorized'). */
-  onUnauthorized?: () => never
-  /** Called when the permission check fails. Default: throws Error('Forbidden'). */
-  onForbidden?: () => never
-}
-
-export type TenantActionHandler<I, O> = (
-  args: { ctx: TenantActionContext; db: GovcoreDb },
-  input: I,
-) => Promise<O>
-
-export interface TenantActionOptions {
-  /** Permission required to run this action (checked against the active role). */
-  permission?: string
-}
-
-/**
- * Build the app's typed `tenantAction`. Call once at app startup with the app's
- * db, session→context resolver, and rbac instance.
- */
-export function createTenantActions(config: CreateTenantActionsConfig) {
-  const { db, getActiveContext, rbac } = config
-
-  return function tenantAction<I = void, O = unknown>(
-    options: TenantActionOptions,
-    handler: TenantActionHandler<I, O>,
-  ): (input: I) => Promise<O> {
-    return async (input: I): Promise<O> => {
-      const active = await getActiveContext()
-      if (!active) {
-        if (config.onUnauthorized) return config.onUnauthorized()
-        throw new Error('Unauthorized')
-      }
-
-      if (options.permission) {
-        const allowed = rbac?.hasPermission(active.role, options.permission) ?? false
-        if (!allowed) {
-          if (config.onForbidden) return config.onForbidden()
-          throw new Error('Forbidden')
-        }
-      }
-
-      return db.transaction(async (tx) => {
-        // Transaction-local org GUC → RLS policies bind to every query below.
-        await tx.execute(sql`select set_config('app.current_org', ${active.organizationId}, true)`)
-        const txDb = tx as unknown as GovcoreDb
-        const ctx: TenantActionContext = {
-          ...active,
-          audit: (event) =>
-            writeAuditLog(txDb, {
-              ...event,
-              userId: event.userId ?? active.userId,
-              organizationId: event.organizationId ?? active.organizationId,
-            }),
-        }
-        return handler({ ctx, db: txDb }, input)
-      })
-    }
-  }
-}