/**
 * Actor context. Fixed by #11 decision 4.
 *
 * Every data path runs inside a transaction that has issued
 *   SET LOCAL app.actor_id / app.org_id / app.capability
 * and policies read them through current_setting().
 *
 * SET LOCAL is transaction-scoped, so it cannot leak across a pooled
 * connection to the next request — the specific failure that would be
 * catastrophic here. It also keeps PgBouncer in transaction pooling viable.
 */
export type Capability = 'issuer' | 'vendor'

export interface ActorContext {
  actorId: string
  orgId: string
  /** Permissions never resolve against an org alone (#11 decision 2). */
  capability: Capability
}

/**
 * A job runs with no request behind it. The scheduler still establishes an
 * actor context — it is simply a system one (#13 decision 4).
 */
export interface SystemContext {
  kind: 'system'
  job: string
}

export type Context = ActorContext | SystemContext

export const isSystem = (c: Context): c is SystemContext => 'kind' in c
