@govnav/core

Domain services, Prisma schema/client, migrations, and seed data for GovNav. Server-only — imported exclusively by govnav-api; the Next.js apps never import this package or touch the database directly (§8.3 of the comprehensive plan).

What lives here

• prisma/schema.prisma — the full data model (§10): users, OTP codes, sessions, jurisdictions, services, checklists, applications, verification results, the append-only audit log.
• src/services/ — domain logic: AuthService (email-OTP + sessions, ADR 0003), JurisdictionService, CatalogService (services + checklists), ApplicationService (delegated applications, upload/verify state machine), AuditService.
• src/docintel/ — the DocIntel provider interface (§7.7, §15) plus a Gemini free-tier driver for dev.
• src/jobs/enqueue.ts — the job-dispatch abstraction; ships an inline driver for MVP (ADR 0004), a qstash driver is additive later.
• prisma/seed.ts — one real jurisdiction path (Addis Ababa → Bole → Woreda 03), one service, one hand-curated checklist, matching the Phase 1 entry criterion.

Setup

pnpm install
cp .env.example .env   # fill in DATABASE_URL (pooled) and DIRECT_URL (direct) from Neon
pnpm prisma:migrate     # creates tables locally / against your Neon dev branch
pnpm seed                # loads the Phase 1 pilot data
pnpm build

Security notes

• OTP codes are hashed with a slow, salted scrypt (low-entropy secret — must resist brute force). Session tokens are 256-bit random values digested with fast SHA-256 for an indexed O(1) lookup — see the doc comment in src/crypto.ts for why these use different hashing strategies.
• The audit log (AuditEvent) has no update/delete path anywhere in this package.