@oimlsmart/platform-server 0.1.3 → 0.1.5

package/migrations/0019_org_member_category.sql

@@ -0,0 +1,34 @@
+-- Migration 0019 — the OIML Member category (TODO.identity-features/10,
+-- the taxonomy correction): the org_registry gains the two designation
+-- LINK columns and the CS status facet.
+--
+-- The corrected model: the Utilizer/Associate are DESIGNATED BODIES
+-- (their own organization rows, signing the Declaration per PD-08),
+-- never statuses on a member; "OIML Member" is the category with the
+-- member-state / corresponding-member kinds. The links:
+--
+--   designated_by  the designating body: a Utilizer's is its MEMBER
+--                  STATE, an Associate's its CORRESPONDING MEMBER, a
+--                  Test Laboratory's its associated ISSUING AUTHORITY
+--                  (the participants model's designated_by:
+--                  issuing_authority);
+--   proposed_by    an Issuing Authority's proposing MEMBER STATE (a
+--                  member state participates in the OIML-CS by
+--                  PROPOSING an IA and DESIGNATING a Utilizer);
+--   cs_status      the designated bodies' Declaration standing
+--                  (signed-active / suspended / withdrawn — the CS
+--                  layer's fact projected onto the identity plane).
+--
+-- Expand-only, and deliberately NULL-defaulted: the kind enforcement of
+-- the links (which kind may point at which) is the PROGRAM's write path
+-- (the store keeps the kind column opaque by doctrine), and a legacy
+-- row — a utilizer/associate curated before this migration — keeps its
+-- home untouched: the links read NULL ("not recorded"), never a
+-- destructive move. The journals' discipline holds.
+-- schema.sql carries the same end state for fresh databases —
+-- test/migrations.test.ts pins the UNION of every migration to
+-- schema.sql's CREATE set.
+
+ALTER TABLE org_registry ADD COLUMN designated_by TEXT;
+ALTER TABLE org_registry ADD COLUMN proposed_by TEXT;
+ALTER TABLE org_registry ADD COLUMN cs_status TEXT;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oimlsmart/platform-server",
-  "version": "0.1.3",
+  "version": "0.1.5",
   "description": "The OIML SMART platform server kernel: the store seam (ServerStore + the D1 and SQLite implementations), the canonical D1 migration set both deployments apply, the instance profile, the mailer, the RBAC map, the OIDC/OAuth client cones, and the shared role/permission vocabulary. Consumed by the smart monorepo (browser/) and the identity service.",
   "type": "module",
   "repository": {

package/src/store/d1.ts

@@ -323,6 +323,16 @@ export class D1ServerStore implements ServerStore {
            )`,
         ).run()
         await this.db.prepare('CREATE INDEX IF NOT EXISTS idx_org_registry_state ON org_registry (state)').run()
+        // TODO.identity-features/10 (the OIML Member category): the
+        // designation links + the CS status facet arrive with migration
+        // 0019 — a dev D1 predating it grows the columns here (the
+        // PRAGMA probe + ALTER posture of ensureUserColumns). NULL = not
+        // recorded: existing rows keep their posture silently.
+        const cols = await this.db.prepare('PRAGMA table_info(org_registry)').all<{ name: string }>()
+        const names = new Set(cols.results.map(c => c.name))
+        if (!names.has('designated_by')) await this.db.prepare('ALTER TABLE org_registry ADD COLUMN designated_by TEXT').run()
+        if (!names.has('proposed_by')) await this.db.prepare('ALTER TABLE org_registry ADD COLUMN proposed_by TEXT').run()
+        if (!names.has('cs_status')) await this.db.prepare('ALTER TABLE org_registry ADD COLUMN cs_status TEXT').run()
       })()
     }
     return this.orgRegistrySupportEnsured
@@ -2188,6 +2198,9 @@ export class D1ServerStore implements ServerStore {
       country: (row.country as string | null) ?? null,
       contacts,
       participantRef: (row.participant_ref as string | null) ?? null,
+      designatedBy: (row.designated_by as string | null) ?? null,
+      proposedBy: (row.proposed_by as string | null) ?? null,
+      csStatus: (row.cs_status as string | null) ?? null,
       state: row.state as OrgRegistryState,
       createdAt: row.created_at as string,
       createdBy: (row.created_by as string | null) ?? null,
@@ -2219,14 +2232,18 @@ export class D1ServerStore implements ServerStore {
     country?: string | null
     contacts?: OrgRegistryContact[]
     participantRef?: string | null
+    designatedBy?: string | null
+    proposedBy?: string | null
+    csStatus?: string | null
     createdBy?: string | null
   }): Promise<OrgRegistryOrg | null> {
     await this.ensureOrgRegistrySupport()
     const res = await this.stmt(
-      `INSERT OR IGNORE INTO org_registry (id, name, short_name, kind, country, contacts, participant_ref, created_by)
-       VALUES (?, ?, ?, ?, ?, ?, ?, ?)`,
+      `INSERT OR IGNORE INTO org_registry (id, name, short_name, kind, country, contacts, participant_ref, designated_by, proposed_by, cs_status, created_by)
+       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
       input.id, input.name, input.shortName ?? null, input.kind ?? null, input.country ?? null,
-      JSON.stringify(input.contacts ?? []), input.participantRef ?? null, input.createdBy ?? null,
+      JSON.stringify(input.contacts ?? []), input.participantRef ?? null,
+      input.designatedBy ?? null, input.proposedBy ?? null, input.csStatus ?? null, input.createdBy ?? null,
     ).run()
     if ((res.meta.changes ?? 0) === 0) return null
     return this.getOrgRegistryOrg(input.id)
@@ -2242,6 +2259,9 @@ export class D1ServerStore implements ServerStore {
       country?: string | null
       contacts?: OrgRegistryContact[]
       participantRef?: string | null
+      designatedBy?: string | null
+      proposedBy?: string | null
+      csStatus?: string | null
     },
     actor?: string | null,
   ): Promise<OrgRegistryOrg | null> {
@@ -2254,6 +2274,9 @@ export class D1ServerStore implements ServerStore {
     if (patch.country !== undefined) { sets.push('country = ?'); params.push(patch.country) }
     if (patch.contacts !== undefined) { sets.push('contacts = ?'); params.push(JSON.stringify(patch.contacts)) }
     if (patch.participantRef !== undefined) { sets.push('participant_ref = ?'); params.push(patch.participantRef) }
+    if (patch.designatedBy !== undefined) { sets.push('designated_by = ?'); params.push(patch.designatedBy) }
+    if (patch.proposedBy !== undefined) { sets.push('proposed_by = ?'); params.push(patch.proposedBy) }
+    if (patch.csStatus !== undefined) { sets.push('cs_status = ?'); params.push(patch.csStatus) }
     sets.push("updated_at = datetime('now')", 'updated_by = ?')
     params.push(actor ?? null)
     const res = await this.stmt(`UPDATE org_registry SET ${sets.join(', ')} WHERE id = ?`, ...params, id).run()

package/src/store/sqlite/schema.sql

@@ -668,7 +668,7 @@ CREATE INDEX IF NOT EXISTS idx_mfa_pending_user ON mfa_pending (user_id);
 -- registry never merge (the spec's §4), and a membership row's honesty
 -- (its lifecycle state) never depends on a join.
 -- The D1 migration set carries the identical end state
--- (0013_org_registry.sql).
+-- (0013_org_registry.sql + 0019_org_member_category.sql).
 -- ═══════════════════════════════════════════════════════════════════
 CREATE TABLE IF NOT EXISTS org_registry (
   id TEXT PRIMARY KEY,
@@ -684,6 +684,17 @@ CREATE TABLE IF NOT EXISTS org_registry (
   -- The participant-link annotation (which participant record the org
   -- mirrors); documentation only.
   participant_ref TEXT,
+  -- The designation links + the CS status facet (0019_org_member_category.sql,
+  -- TODO.identity-features/10): a Utilizer's designated_by is its MEMBER
+  -- STATE, an Associate's its CORRESPONDING MEMBER, a Test Laboratory's
+  -- its associated ISSUING AUTHORITY; an Issuing Authority's proposed_by
+  -- is its proposing MEMBER STATE; cs_status is the designated bodies'
+  -- Declaration standing (signed-active / suspended / withdrawn). All
+  -- NULL = not recorded; the kind enforcement is the program's write
+  -- path, the store keeps the columns opaque.
+  designated_by TEXT,
+  proposed_by TEXT,
+  cs_status TEXT,
   state TEXT NOT NULL DEFAULT 'active',
   created_at TEXT NOT NULL DEFAULT (datetime('now')),
   created_by TEXT,

package/src/store/sqlite/store.ts

@@ -115,6 +115,22 @@ function migrateAuthTables(db: Database.Database): void {
   if (membershipCols.length && !membershipCols.some(c => c.name === 'cone')) {
     db.exec('ALTER TABLE org_memberships ADD COLUMN cone TEXT')
   }
+  // TODO.identity-features/10 (the OIML Member category): the
+  // designation links + the CS status facet arrive with migration 0019 —
+  // a dev file predating it grows the columns here. NULL = not recorded:
+  // existing rows keep their posture silently.
+  const registryCols = db.prepare('PRAGMA table_info(org_registry)').all() as Array<{ name: string }>
+  if (registryCols.length) {
+    if (!registryCols.some(c => c.name === 'designated_by')) {
+      db.exec('ALTER TABLE org_registry ADD COLUMN designated_by TEXT')
+    }
+    if (!registryCols.some(c => c.name === 'proposed_by')) {
+      db.exec('ALTER TABLE org_registry ADD COLUMN proposed_by TEXT')
+    }
+    if (!registryCols.some(c => c.name === 'cs_status')) {
+      db.exec('ALTER TABLE org_registry ADD COLUMN cs_status TEXT')
+    }
+  }
   // TODO.identity-sso/02+03 (the strong-authentication wave): the amr
   // provenance columns on sessions → codes → access tokens.
   if (!sessionCols.some(c => c.name === 'amr')) {
@@ -1008,6 +1024,9 @@ interface OrgRegistryRow {
   country: string | null
   contacts: string
   participant_ref: string | null
+  designated_by: string | null
+  proposed_by: string | null
+  cs_status: string | null
   state: OrgRegistryState
   created_at: string
   created_by: string | null
@@ -1042,6 +1061,9 @@ function orgRegistryPayload(row: OrgRegistryRow): OrgRegistryOrg {
     country: row.country,
     contacts: parseOrgContacts(row.contacts),
     participantRef: row.participant_ref,
+    designatedBy: row.designated_by ?? null,
+    proposedBy: row.proposed_by ?? null,
+    csStatus: row.cs_status ?? null,
     state: row.state,
     createdAt: row.created_at,
     createdBy: row.created_by,
@@ -1071,14 +1093,18 @@ export function createOrgRegistryOrg(input: {
   country?: string | null
   contacts?: OrgRegistryContact[]
   participantRef?: string | null
+  designatedBy?: string | null
+  proposedBy?: string | null
+  csStatus?: string | null
   createdBy?: string | null
 }): OrgRegistryOrg | null {
   const res = getDb().prepare(
-    `INSERT OR IGNORE INTO org_registry (id, name, short_name, kind, country, contacts, participant_ref, created_by)
-     VALUES (?, ?, ?, ?, ?, ?, ?, ?)`,
+    `INSERT OR IGNORE INTO org_registry (id, name, short_name, kind, country, contacts, participant_ref, designated_by, proposed_by, cs_status, created_by)
+     VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
   ).run(
     input.id, input.name, input.shortName ?? null, input.kind ?? null, input.country ?? null,
-    JSON.stringify(input.contacts ?? []), input.participantRef ?? null, input.createdBy ?? null,
+    JSON.stringify(input.contacts ?? []), input.participantRef ?? null,
+    input.designatedBy ?? null, input.proposedBy ?? null, input.csStatus ?? null, input.createdBy ?? null,
   )
   if (res.changes === 0) return null
   return getOrgRegistryOrg(input.id)
@@ -1095,6 +1121,9 @@ export function updateOrgRegistryOrg(
     country?: string | null
     contacts?: OrgRegistryContact[]
     participantRef?: string | null
+    designatedBy?: string | null
+    proposedBy?: string | null
+    csStatus?: string | null
   },
   actor?: string | null,
 ): OrgRegistryOrg | null {
@@ -1106,6 +1135,9 @@ export function updateOrgRegistryOrg(
   if (patch.country !== undefined) { sets.push('country = ?'); params.push(patch.country) }
   if (patch.contacts !== undefined) { sets.push('contacts = ?'); params.push(JSON.stringify(patch.contacts)) }
   if (patch.participantRef !== undefined) { sets.push('participant_ref = ?'); params.push(patch.participantRef) }
+  if (patch.designatedBy !== undefined) { sets.push('designated_by = ?'); params.push(patch.designatedBy) }
+  if (patch.proposedBy !== undefined) { sets.push('proposed_by = ?'); params.push(patch.proposedBy) }
+  if (patch.csStatus !== undefined) { sets.push('cs_status = ?'); params.push(patch.csStatus) }
   sets.push("updated_at = datetime('now')", 'updated_by = ?')
   params.push(actor ?? null)
   const res = getDb().prepare(`UPDATE org_registry SET ${sets.join(', ')} WHERE id = ?`).run(...params, id)

package/src/store.ts

@@ -898,19 +898,40 @@ export interface OrgRegistryContact {
  *  scheme consumer); the program side bounds the assignable per-org
  *  roles by it. `participantRef` is the OPTIONAL annotation documenting
  *  which participant record the org mirrors (the link's documentation,
- *  never a key the store resolves). */
+ *  never a key the store resolves).
+ *
+ *  TODO.identity-features/10 (the OIML Member category, the taxonomy
+ *  correction): the designation links + the CS status facet (migration
+ *  0019). `designatedBy` is the designating body (a Utilizer's member
+ *  state, an Associate's corresponding member, a Test Laboratory's
+ *  associated issuing authority); `proposedBy` is an Issuing
+ *  Authority's proposing member state; `csStatus` is the designated
+ *  bodies' Declaration standing ('signed-active' | 'suspended' |
+ *  'withdrawn'). All three are opaque strings to the store — the
+ *  per-kind link enforcement (which kind may point at which) is the
+ *  program's write path; NULL reads "not recorded", honestly. */
 export interface OrgRegistryOrg {
   id: string
   /** The display name. */
   name: string
   shortName: string | null
   /** The participant kind ('issuing-authority' | 'test-laboratory' |
-   *  'utilizer' | 'associate' on the OIML-CS program), NULL for a
+   *  'utilizer' | 'associate' on the OIML-CS program, 'member-state' |
+   *  'corresponding-member' on the OIML Member category), NULL for a
    *  non-participant org. Opaque to the store. */
   kind: string | null
   country: string | null
   contacts: OrgRegistryContact[]
   participantRef: string | null
+  /** The designating body's org id (TODO.identity-features/10) — the
+   *  designated-body kinds carry it; NULL = not recorded. */
+  designatedBy: string | null
+  /** The proposing member state's org id (the issuing-authority kind). */
+  proposedBy: string | null
+  /** The Declaration's standing on the designated bodies
+   *  ('signed-active' | 'suspended' | 'withdrawn'); NULL = not
+   *  recorded. */
+  csStatus: string | null
   state: OrgRegistryState
   createdAt: string
   createdBy: string | null
@@ -1702,6 +1723,9 @@ export interface ServerStore {
     country?: string | null
     contacts?: OrgRegistryContact[]
     participantRef?: string | null
+    designatedBy?: string | null
+    proposedBy?: string | null
+    csStatus?: string | null
     createdBy?: string | null
   }): Promise<OrgRegistryOrg | null>
   /** Edit the display data (the id is the stable slug — never editable);
@@ -1716,6 +1740,9 @@ export interface ServerStore {
       country?: string | null
       contacts?: OrgRegistryContact[]
       participantRef?: string | null
+      designatedBy?: string | null
+      proposedBy?: string | null
+      csStatus?: string | null
     },
     actor?: string | null,
   ): Promise<OrgRegistryOrg | null>

package/src/vocab/permissions.ts

@@ -145,6 +145,12 @@ export const TRANSITION_PERMISSIONS: Record<string, readonly ActionPermission[]>
   // records mode (TODO.adoption/02): the registered-offline entry — the
   // application's honest hop into ACCEPTED without a fake walked history.
   'application:register_offline->ACCEPTED': ['records.register'],
+  // DEMO_FLOWS wave 1: the lifecycle closure — the IA marks the Evaluation
+  // Project COMPLETED once the completion gate's settling conditions all
+  // hold (the model's completion_settled guard refuses otherwise); the act
+  // is the IA's decision desk on the application, the same family as the
+  // accept/reject decisions.
+  'application:ia_marks_completed->COMPLETED': ['application.accept'],
 
   // test_request (the dispatch; TODO.adoption/07's quote leg: the
   // laboratory's quotation response and the IA's commercial decision on it)
@@ -161,6 +167,9 @@ export const TRANSITION_PERMISSIONS: Record<string, readonly ActionPermission[]>
   // test_report
   'test_report:lab_submits->SUBMITTED': ['tr.submit'],
   'test_report:ia_starts_review->UNDER_REVIEW': ['tr.review'],
+  // DEMO_FLOWS wave 1: the review period's opening on the test report —
+  // the IA's TR-review desk (the consultation rides the review class).
+  'test_report:ia_opens_consultation->CONSULTATION': ['tr.review'],
   'test_report:ia_accepts->ACCEPTED': ['tr.review'],
   'test_report:ia_rejects->REJECTED': ['tr.review'],
   'test_report:lab_withdraws_for_edit->DRAFT': ['tr.submit'],
@@ -184,6 +193,9 @@ export const TRANSITION_PERMISSIONS: Record<string, readonly ActionPermission[]>
   // Fired by the TR-review service when the last report is determined —
   // the reviewing officer holds tr.review, the evaluation worker er.review.
   'evaluation_report:last_tr_determined->ALL_TR_REVIEWED': ['tr.review', 'er.review'],
+  // DEMO_FLOWS wave 1: the review period's opening — the IA officer's
+  // evaluation-work act (the consultation is the ER's review surface).
+  'evaluation_report:ia_opens_consultation->CONSULTATION': ['er.review'],
   'evaluation_report:ia_approves->APPROVED': ['er.finalize'],
   'evaluation_report:ia_rejects->REJECTED': ['er.finalize'],
   'evaluation_report:ia_approves_with_conditions->CONDITIONALLY_APPROVED': ['er.finalize'],
@@ -217,6 +229,22 @@ export const TRANSITION_PERMISSIONS: Record<string, readonly ActionPermission[]>
   'certificate:revise->ACTIVE': ['certificate.issue'],
   'certificate:transfer_ownership->ACTIVE': ['certificate.issue'],
 
+  // certificate_registration (DEMO_FLOWS wave 1 — the register's
+  // auto-publish doctrine, the program owner's 2026-08-28 decision): the
+  // hub-side registration submission lifecycle — the registrant
+  // announcement's shell, the signed package's intake verification, the
+  // publication, the recorded refusal. All three edges are SYSTEM acts:
+  // the intake automation walks them on the verified signed submission
+  // (no human gate between verify and publish — the register's trust is
+  // in the signature + the receipt machinery; the human review surfaces
+  // stay read postures). The map names the desk authority the automation
+  // exercises — the same shape the other engine-fired edges ride (the
+  // sample_verification projection's transitions name
+  // verification.perform).
+  'certificate_registration:intake_verifies->SUBMITTED': ['certificate.register'],
+  'certificate_registration:auto_publishes->PUBLISHED': ['certificate.register'],
+  'certificate_registration:intake_refuses->REFUSED': ['certificate.register'],
+
   // test_assignment (the laboratory's work items; `omit` rides the IA's
   // dispatch withdrawal cascade)
   'test_assignment:lab_accepts->ACCEPTED': ['run.perform'],
@@ -354,6 +382,10 @@ export const STORE_MACHINES: Record<string, string> = {
   formInstances: 'form_instance',
   evaluationReports: 'evaluation_report',
   certificates: 'certificate',
+  // DEMO_FLOWS wave 1: the register's registration submissions are
+  // machinated too (the intake-verify → auto-publish chain); the generic
+  // write path gates status writes on the machine's declared edges.
+  certificateRegistrations: 'certificate_registration',
   testAssignments: 'test_assignment',
   testRuns: 'test_run',
   measuringInstrumentSamples: 'measuring_instrument_sample',