@oimlsmart/platform-server 0.2.13 → 0.2.15

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oimlsmart/platform-server",
-  "version": "0.2.13",
+  "version": "0.2.15",
   "description": "The OIML SMART platform server kernel: the store seam (ServerStore + the D1 and SQLite implementations), the canonical D1 migration set both deployments apply, the instance profile, the mailer, the RBAC map, the OIDC/OAuth client cones, and the shared role/permission vocabulary. Consumed by the smart monorepo (browser/) and the identity service.",
   "type": "module",
   "repository": {

package/src/store/d1.ts

@@ -47,6 +47,7 @@ import {
   type EmailChangeToken,
   type EnrollmentToken,
   type EntityChange,
+  type EntityListOptions,
   type EntityRow,
   type EntityWriteInput,
   type EventEntityKey,
@@ -3542,7 +3543,7 @@ export class D1ServerStore implements ServerStore {
 
   // ── the workflow entity store + change journal ───────────────────
 
-  async listEntities(store: string): Promise<EntityRow[]> {
+  async listEntities(store: string, options?: EntityListOptions): Promise<EntityRow[]> {
     // The ORDER BY is the seam's contract (the 0.2.3 pin): the answer
     // arrives in (org_id, rowid) order — the read's observable order
     // since migration 0001, when the planner walked
@@ -3551,6 +3552,19 @@ export class D1ServerStore implements ServerStore {
     // insertion (the smart app's render-baseline red, oimlsmart/smart
     // PR #264) — a list read's order is a consumer-visible contract,
     // never the planner's pick.
+    // options.orgId narrows the candidate set (the seam's EntityListOptions
+    // — the portal-load audit's R3-fix3): the kept groups (NULL stamps,
+    // then the named org) are the two lowest org_id buckets, so the
+    // filtered ORDER BY is the unfiltered order's restriction to the
+    // candidates — a gate-driven projection of either answer is
+    // byte-identical.
+    if (options?.orgId) {
+      const res = await this.stmt(
+        'SELECT store, id, org_id, data, updated_at FROM entities WHERE store = ? AND (org_id = ? OR org_id IS NULL) ORDER BY org_id, rowid',
+        store, options.orgId,
+      ).all<EntityRow>()
+      return res.results
+    }
     const res = await this.stmt(
       'SELECT store, id, org_id, data, updated_at FROM entities WHERE store = ? ORDER BY org_id, rowid', store,
     ).all<EntityRow>()

package/src/store/sqlite/entities.ts

@@ -18,7 +18,7 @@ import { PUT_ENTITIES_CHUNK, orgIdOf } from '../../store'
 export type { EntityRow, EntityChange } from '../../store'
 export { ORG_FIELDS, CATALOG_STORES, orgIdOf } from '../../store'
 
-import type { EntityRow, EntityChange, EntityWriteInput, JournalAppend } from '../../store'
+import type { EntityRow, EntityChange, EntityListOptions, EntityWriteInput, JournalAppend } from '../../store'
 
 /** The journal fan-out's ISOLATE-scope registry (the seam's
  *  onJournalAppend, the D1 half's twin): one module-scope set — a
@@ -69,12 +69,23 @@ const CERTIFICATE_NUMBER_SQL = `SELECT store, id, org_id, data, updated_at
          AND json_extract(CASE WHEN json_valid(data) THEN data ELSE '{}' END, '$.certificate_number') COLLATE NOCASE = ?
        ORDER BY org_id, rowid`
 
-export function listEntities(store: string): EntityRow[] {
+export function listEntities(store: string, options?: EntityListOptions): EntityRow[] {
   // The ORDER BY is the seam's contract (the 0.2.3 pin, the D1 half's
   // twin): (org_id, rowid) — the read's observable order since
   // migration 0001's idx_entities_store_org walk, made planner-proof
   // when migration 0023's expression index offered a second
   // store-prefixed plan.
+  // options.orgId narrows the candidate set (the seam's EntityListOptions
+  // — the portal-load audit's R3-fix3): the kept groups (NULL stamps,
+  // then the named org) are the two lowest org_id buckets, so the
+  // filtered ORDER BY is the unfiltered order's restriction to the
+  // candidates — a gate-driven projection of either answer is
+  // byte-identical.
+  if (options?.orgId) {
+    return getDb()
+      .prepare('SELECT store, id, org_id, data, updated_at FROM entities WHERE store = ? AND (org_id = ? OR org_id IS NULL) ORDER BY org_id, rowid')
+      .all(store, options.orgId) as EntityRow[]
+  }
   return getDb()
     .prepare('SELECT store, id, org_id, data, updated_at FROM entities WHERE store = ? ORDER BY org_id, rowid')
     .all(store) as EntityRow[]

package/src/store/sqlite.ts

@@ -194,7 +194,7 @@ import {
   updateOpAccount,
   updateUserName,
 } from './sqlite/op-accounts-store'
-import { installStore, type AccountEmail, type AddAccountEmailResult, type AuthUserPayload, type CertificateHolderClaim, type CertificateHolderOrg, type CompleteEmailChangeResult, type CompleteEnrollmentResult, type ConsumeOidcRefreshTokenResult, type EmailChangeToken, type EnrollmentToken, type EntityChange, type EntityRow, type EntityWriteInput, type EventEntityKey, type EventKeyFilter, type EventWriteInput, type FederationPeer, type IdentityApproval, type IdentityLink, type IdentityProvider, type InstrumentRegistration, type InstrumentRegistrationLifecycle, type InstrumentRegistrationScopeStatus, type InstrumentRegistrationWriteInput, type JournalAppend, type NotifyDelivery, type NotifyDeliveryStatus, type NotifyEntityMute, type NotifyInboxState, type NotifyPreferences, type NotifyRule, type OAuthInitialAssignment, type OidcAccessToken, type OidcAuthorization, type OidcClient, type OidcClientLaunch, type OidcCode, type OidcConsentGrant, type OidcKeyRow, type OidcRefreshToken, type OpAccountErasure, type OpClientRoleAssignment, type OpLiveSession, type OrgJoinRequest, type OrgMembership, type OrgMembershipState, type OrgRegistryContact, type OrgRegistryOrg, type OrgRegistryState, type PersonalAccessToken, type PlatformEvent, type ServerStore, type SessionView, type SsoSignInState, type UserAdminRow, type AdvanceCounterResult, type MfaPending, type RecoveryCodeState, type TotpSecret, type WebauthnChallenge, type WebauthnCredential } from '../store'
+import { installStore, type AccountEmail, type AddAccountEmailResult, type AuthUserPayload, type CertificateHolderClaim, type CertificateHolderOrg, type CompleteEmailChangeResult, type CompleteEnrollmentResult, type ConsumeOidcRefreshTokenResult, type EmailChangeToken, type EnrollmentToken, type EntityChange, type EntityListOptions, type EntityRow, type EntityWriteInput, type EventEntityKey, type EventKeyFilter, type EventWriteInput, type FederationPeer, type IdentityApproval, type IdentityLink, type IdentityProvider, type InstrumentRegistration, type InstrumentRegistrationLifecycle, type InstrumentRegistrationScopeStatus, type InstrumentRegistrationWriteInput, type JournalAppend, type NotifyDelivery, type NotifyDeliveryStatus, type NotifyEntityMute, type NotifyInboxState, type NotifyPreferences, type NotifyRule, type OAuthInitialAssignment, type OidcAccessToken, type OidcAuthorization, type OidcClient, type OidcClientLaunch, type OidcCode, type OidcConsentGrant, type OidcKeyRow, type OidcRefreshToken, type OpAccountErasure, type OpClientRoleAssignment, type OpLiveSession, type OrgJoinRequest, type OrgMembership, type OrgMembershipState, type OrgRegistryContact, type OrgRegistryOrg, type OrgRegistryState, type PersonalAccessToken, type PlatformEvent, type ServerStore, type SessionView, type SsoSignInState, type UserAdminRow, type AdvanceCounterResult, type MfaPending, type RecoveryCodeState, type TotpSecret, type WebauthnChallenge, type WebauthnCredential } from '../store'
 import {
   advanceWebauthnCounter,
   consumeMfaPending,
@@ -1015,8 +1015,8 @@ export function createSqliteServerStore(): ServerStore {
     },
 
     // ── the workflow entity store + change journal ──
-    async listEntities(store: string): Promise<EntityRow[]> {
-      return listEntities(store)
+    async listEntities(store: string, options?: EntityListOptions): Promise<EntityRow[]> {
+      return listEntities(store, options)
     },
     async getEntity(store: string, id: string): Promise<EntityRow | undefined> {
       return getEntity(store, id)

package/src/store.ts

@@ -138,6 +138,29 @@ export interface EntityRow {
   updated_at: string
 }
 
+/** listEntities' candidate narrowing (the 2026-09-01 portal-load audit,
+ *  R3-fix3): the entities table carries an indexed org_id column
+ *  (idx_entities_store_org, migration 0001) that reads never used —
+ *  every list scanned the whole store and left the org cone to the
+ *  consumer's per-row gate. */
+export interface EntityListOptions {
+  /** Narrow the CANDIDATE set to the rows stamped under this org (org_id
+   *  = the value — orgIdOf's first-org-field stamp, or the writer's own
+   *  org on the stamping write paths) PLUS the unstamped rows (org_id IS
+   *  NULL — a stamp-less row is never excluded: the stamp's absence says
+   *  nothing about the row's cone). A candidate filter, NEVER a
+   *  visibility decision: which rows of the narrowed set answer is the
+   *  consumer's in-memory gate, authoritative as before. The consumer
+   *  enables the filter only where its gate provably denies every row
+   *  the filter drops (the per-store verification rides the consumer's
+   *  change — org_id stamps the FIRST org field, so multi-org-field
+   *  stores are never narrowed). The answer keeps the seam's declared
+   *  order: (org_id, rowid) over the kept rows — the unfiltered order's
+   *  restriction to the candidate set, so a gate-driven projection of
+   *  either answer is byte-identical. */
+  orgId?: string
+}
+
 // ── federation peers (TODO.federation/04) ────────────────────────────
 
 /** A pinned federation peer: the counterparty instance's descriptor,
@@ -2485,8 +2508,11 @@ export interface ServerStore {
    *  first, then by org id, then by insertion). Both backends spell the
    *  ORDER BY explicitly — a list read's order is a consumer-visible
    *  contract, never the planner's pick (the 0.2.3 pin, after
-   *  migration 0023's expression index flipped the unnamed walk). */
-  listEntities(store: string): Promise<EntityRow[]>
+   *  migration 0023's expression index flipped the unnamed walk).
+   *  `options.orgId` narrows the candidate set in SQL (EntityListOptions
+   *  — the portal-load audit's R3-fix3); the narrowed answer is the same
+   *  order's restriction to the candidates. */
+  listEntities(store: string, options?: EntityListOptions): Promise<EntityRow[]>
   getEntity(store: string, id: string): Promise<EntityRow | undefined>
   /** The public register's certificate-number lookup (the verify
    *  surfaces' keyed read — the 2026-09-07 performance audit's

package/src/vocab/permissions.ts

@@ -420,6 +420,12 @@ export const CREATION_PERMISSIONS: Record<string, readonly ActionPermission[]> =
   // document list is maintained by the certificate's issuers.
   operatedSchemes: ['instance.settings'],
   certificateDocumentLists: ['certificate.issue'],
+  // Registering a participant is the scheme operator's named act (the
+  // 2026-09-15 direct-registration posture: participation cases are
+  // CREATED active by the Secretariat — the B 18:2025 §11 RC/MC ballot
+  // pipeline is modelled, not operated). The organ split holds: the MC
+  // decides (suspension/reinstatement), the Secretariat administers.
+  participantApplications: ['participants.manage'],
 }
 
 /** FIELD guards: a field going unset → set is the act (the test