@oimlsmart/platform-server 0.2.14 → 0.2.16

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oimlsmart/platform-server",
-  "version": "0.2.14",
+  "version": "0.2.16",
   "description": "The OIML SMART platform server kernel: the store seam (ServerStore + the D1 and SQLite implementations), the canonical D1 migration set both deployments apply, the instance profile, the mailer, the RBAC map, the OIDC/OAuth client cones, and the shared role/permission vocabulary. Consumed by the smart monorepo (browser/) and the identity service.",
   "type": "module",
   "repository": {

package/src/store/d1.ts

@@ -28,7 +28,7 @@
 // key on the RAW binding (a rejected chain still evicts itself).
 // ═══════════════════════════════════════════════════════════════════
 
-import type { D1Database, D1PreparedStatement } from '@cloudflare/workers-types'
+import type { D1Database, D1PreparedStatement, D1Result } from '@cloudflare/workers-types'
 import {
   APPEND_EVENTS_CHUNK,
   DEMO_PASSWORD,
@@ -1831,6 +1831,24 @@ export class D1ServerStore implements ServerStore {
     return res.results.map(D1ServerStore.toIdentityLink)
   }
 
+  /** The bulk list-endpoint variant (identity's TODO.restructure/06):
+   *  ONE read for the whole set (the per-row loop's O(rows) D1 round
+   *  trips collapsed); every requested id answers, an unknown id as the
+   *  empty array; each account's links keep the per-id read's own
+   *  (linked_at, provider) order. */
+  async listIdentityLinksBulk(userIds: string[]): Promise<Map<string, IdentityLink[]>> {
+    const answer = new Map<string, IdentityLink[]>(userIds.map(id => [id, []]))
+    if (userIds.length === 0) return answer
+    const placeholders = userIds.map(() => '?').join(',')
+    const res = await this.stmt(`SELECT * FROM identity_links WHERE user_id IN (${placeholders}) ORDER BY linked_at, provider`, ...userIds)
+      .all<Record<string, unknown>>()
+    for (const row of res.results) {
+      const link = D1ServerStore.toIdentityLink(row)
+      answer.get(link.userId)?.push(link)
+    }
+    return answer
+  }
+
   async findIdentityLink(provider: string, providerAccountId: string): Promise<IdentityLink | null> {
     const row = await this.stmt('SELECT * FROM identity_links WHERE provider = ? AND provider_account_id = ?', provider, providerAccountId)
       .first<Record<string, unknown>>()
@@ -1941,6 +1959,41 @@ export class D1ServerStore implements ServerStore {
     return { password: (pw?.n ?? 0) > 0, links: links?.n ?? 0, passkeys: passkeys?.n ?? 0 }
   }
 
+  /** The bulk list-endpoint variant (identity's TODO.restructure/06): the
+   *  three grouped counts ride ONE batch — a single D1 round trip for
+   *  the whole set, never three per account. Every requested id answers;
+   *  an absent row reads as zero (the per-id read's posture). */
+  async countSignInMethodsBulk(userIds: string[]): Promise<Map<string, { password: boolean; links: number; passkeys: number }>> {
+    const answer = new Map<string, { password: boolean; links: number; passkeys: number }>(
+      userIds.map(id => [id, { password: false, links: 0, passkeys: 0 }]),
+    )
+    if (userIds.length === 0) return answer
+    const placeholders = userIds.map(() => '?').join(',')
+    const grouped = (table: string) =>
+      `SELECT user_id, COUNT(*) AS n FROM ${table} WHERE user_id IN (${placeholders}) GROUP BY user_id`
+    const [pw, links, passkeys] = await this.db.batch<Record<string, unknown>>([
+      this.stmt(grouped('passwords'), ...userIds),
+      this.stmt(grouped('identity_links'), ...userIds),
+      this.stmt(grouped('webauthn_credentials'), ...userIds),
+    ])
+    const tally = (res: D1Result<Record<string, unknown>>): Map<string, number> => {
+      const m = new Map<string, number>()
+      for (const row of res.results) m.set(String(row.user_id), Number(row.n))
+      return m
+    }
+    const pwBy = tally(pw)
+    const linksBy = tally(links)
+    const passkeysBy = tally(passkeys)
+    for (const id of userIds) {
+      answer.set(id, {
+        password: (pwBy.get(id) ?? 0) > 0,
+        links: linksBy.get(id) ?? 0,
+        passkeys: passkeysBy.get(id) ?? 0,
+      })
+    }
+    return answer
+  }
+
   async createEnrollmentToken(input: {
     token: string
     userId: string

package/src/store/sqlite/op-accounts-store.ts

@@ -139,6 +139,38 @@ export function countSignInMethods(userId: string): { password: boolean; links:
   return { password: pw.n > 0, links: links.n, passkeys: passkeys.n }
 }
 
+/** The bulk list-endpoint variant (identity's TODO.restructure/06): one
+ *  grouped read per underlying table — three statements for the whole
+ *  set, never three per account. Every requested id answers; an absent
+ *  row reads as zero (the per-id read's posture). */
+export function countSignInMethodsBulk(userIds: string[]): Map<string, { password: boolean; links: number; passkeys: number }> {
+  const answer = new Map<string, { password: boolean; links: number; passkeys: number }>(
+    userIds.map(id => [id, { password: false, links: 0, passkeys: 0 }]),
+  )
+  if (userIds.length === 0) return answer
+  const db = getDb()
+  const placeholders = userIds.map(() => '?').join(',')
+  const counts = (table: string): Map<string, number> => {
+    const m = new Map<string, number>()
+    const rows = db
+      .prepare(`SELECT user_id, COUNT(*) AS n FROM ${table} WHERE user_id IN (${placeholders}) GROUP BY user_id`)
+      .all(...userIds) as Array<{ user_id: string; n: number }>
+    for (const row of rows) m.set(row.user_id, row.n)
+    return m
+  }
+  const pw = counts('passwords')
+  const links = counts('identity_links')
+  const passkeys = counts('webauthn_credentials')
+  for (const id of userIds) {
+    answer.set(id, {
+      password: (pw.get(id) ?? 0) > 0,
+      links: links.get(id) ?? 0,
+      passkeys: passkeys.get(id) ?? 0,
+    })
+  }
+  return answer
+}
+
 export function createEnrollmentToken(input: {
   token: string
   userId: string

package/src/store/sqlite/upstream-store.ts

@@ -120,6 +120,24 @@ export function listIdentityLinks(userId: string): IdentityLink[] {
   return rows.map(toIdentityLink)
 }
 
+/** The bulk list-endpoint variant (identity's TODO.restructure/06): the
+ *  same rows for every id, ONE read for the whole set, grouped in
+ *  memory. The single ORDER BY keeps each account's links in the
+ *  per-id read's own (linked_at, provider) order. */
+export function listIdentityLinksBulk(userIds: string[]): Map<string, IdentityLink[]> {
+  const answer = new Map<string, IdentityLink[]>(userIds.map(id => [id, []]))
+  if (userIds.length === 0) return answer
+  const placeholders = userIds.map(() => '?').join(',')
+  const rows = getDb()
+    .prepare(`SELECT * FROM identity_links WHERE user_id IN (${placeholders}) ORDER BY linked_at, provider`)
+    .all(...userIds) as Array<Record<string, unknown>>
+  for (const row of rows) {
+    const link = toIdentityLink(row)
+    answer.get(link.userId)?.push(link)
+  }
+  return answer
+}
+
 export function findIdentityLink(provider: string, providerAccountId: string): IdentityLink | null {
   const row = getDb().prepare('SELECT * FROM identity_links WHERE provider = ? AND provider_account_id = ?')
     .get(provider, providerAccountId) as Record<string, unknown> | undefined

package/src/store/sqlite.ts

@@ -154,6 +154,7 @@ import {
   findIdentityLink,
   getIdentityProvider,
   listIdentityLinks,
+  listIdentityLinksBulk,
   listIdentityProviders,
   setIdentityProviderEnabled,
   upsertIdentityProvider,
@@ -163,6 +164,7 @@ import {
   completeEmailChange,
   completeEnrollment,
   countSignInMethods,
+  countSignInMethodsBulk,
   createEmailChangeToken,
   createEnrollmentToken,
   createOpAccount,
@@ -759,6 +761,9 @@ export function createSqliteServerStore(): ServerStore {
     async listIdentityLinks(userId: string): Promise<IdentityLink[]> {
       return listIdentityLinks(userId)
     },
+    async listIdentityLinksBulk(userIds: string[]): Promise<Map<string, IdentityLink[]>> {
+      return listIdentityLinksBulk(userIds)
+    },
     async findIdentityLink(provider: string, providerAccountId: string): Promise<IdentityLink | null> {
       return findIdentityLink(provider, providerAccountId)
     },
@@ -792,6 +797,9 @@ export function createSqliteServerStore(): ServerStore {
     async countSignInMethods(userId: string): Promise<{ password: boolean; links: number; passkeys: number }> {
       return countSignInMethods(userId)
     },
+    async countSignInMethodsBulk(userIds: string[]): Promise<Map<string, { password: boolean; links: number; passkeys: number }>> {
+      return countSignInMethodsBulk(userIds)
+    },
     async createEnrollmentToken(input: {
       token: string
       userId: string

package/src/store.ts

@@ -843,7 +843,7 @@ export type AddAccountEmailResult =
   | 'present'
   /** Another account holds the address (as its primary or an
    *  additional), or it IS this account's primary — an address names at
-   *  most one account across the estate. */
+   *  most one account across the platform. */
   | 'conflict'
 
 // ── strong authentication: the factor registry (TODO.identity-sso/02 + /03)
@@ -933,7 +933,7 @@ export interface MfaPending {
 // ── the personal access tokens (TODO.identity-features/08) ───────────
 // The developer surface: an ACCOUNT-minted credential for programmatic
 // access (the lab CLI, scripts, the agent pipelines). The GitHub
-// fine-grained pattern mapped to the estate:
+// fine-grained pattern mapped to the platform:
 //
 //   - the PAT NEVER rides a request directly — it exchanges at the OP's
 //     token endpoint (the RFC 8693 grant, subject_token_type
@@ -961,7 +961,7 @@ export const PAT_ACTION_CLASSES = ['read', 'write', 'admin'] as const
 export type PatActionClass = (typeof PAT_ACTION_CLASSES)[number]
 
 /** One parsed scope: the service (a registered application-class OIDC
- *  client id — the estate's service registry IS the OP's client
+ *  client id — the platform's service registry IS the OP's client
  *  registry) × the action class. */
 export interface PatScope {
   service: string
@@ -1263,7 +1263,7 @@ export interface OrgRegistryContact {
  *  the org claim's value against its own participant registry directly:
  *  the same string on both sides, so the mapping is identity, never a
  *  lookup table). `kind` names the participant kind for a participant
- *  org (NULL = a non-participant org — the estate operator's own org, a
+ *  org (NULL = a non-participant org — the platform operator's own org, a
  *  scheme consumer); the program side bounds the assignable per-org
  *  roles by it. `participantRef` is the OPTIONAL annotation documenting
  *  which participant record the org mirrors (the link's documentation,
@@ -1316,7 +1316,7 @@ export interface OrgRegistryOrg {
  *  organization — the OP-minted org id, never an instance-minted one.
  *  The hub's OWN row (the certificate_holder_orgs table): the registrar's
  *  act extracts the descriptor the federation registration package carried
- *  (source 'registration'), or the estate admin's claim confirmation writes
+ *  (source 'registration'), or the register operator's claim confirmation writes
  *  it for a legacy row (source 'claim'). ONE row per certificate — the
  *  first attribution wins, a later writer never overwrites silently.
  *
@@ -1330,7 +1330,7 @@ export interface CertificateHolderOrg {
   orgName: string
   source: 'registration' | 'claim'
   attributedAt: string
-  /** The registrar / the confirming estate admin (the actor's name). */
+  /** The registrar / the confirming register operator (the actor's name). */
   attributedBy: string | null
   /** The confirming claim (source 'claim' only). */
   claimId: string | null
@@ -1338,7 +1338,7 @@ export interface CertificateHolderOrg {
 
 /** The legacy-row claim act's lifecycle: PENDING (the manufacturer org's
  *  administrator claimed the row by holder-name match — a claim is a
- *  claim until confirmed) → CONFIRMED (the estate admin's act; the
+ *  claim until confirmed) → CONFIRMED (the register operator's act; the
  *  attribution row lands) / REFUSED (terminal for THAT claim, with the
  *  written reason; a fresh claim may follow). */
 export type CertificateHolderClaimState = 'pending' | 'confirmed' | 'refused'
@@ -1893,6 +1893,13 @@ export interface ServerStore {
   // ── the linked identities (TODO.identity/02's shape, 08's flows) ──
   /** The account's linked upstream identities (the account surface). */
   listIdentityLinks(userId: string): Promise<IdentityLink[]>
+  /** The bulk list-endpoint variant (identity's TODO.restructure/06):
+   *  the same rows as listIdentityLinks for every id, ONE read for the
+   *  whole set — the per-row loop's O(rows) store-call disease's
+   *  kernel-side answer. Every requested id answers (an unknown id
+   *  honestly as the empty array, the per-id read's own posture); an
+   *  empty array answers an empty map. */
+  listIdentityLinksBulk(userIds: string[]): Promise<Map<string, IdentityLink[]>>
   /** THE match rule's read: resolve (provider, providerAccountId) → the
    *  link (and thereby the account). NEVER match by email alone. */
   findIdentityLink(provider: string, providerAccountId: string): Promise<IdentityLink | null>
@@ -1938,6 +1945,13 @@ export interface ServerStore {
    *  sign-in method (passwordless), so the at-least-one-way-in guard
    *  reads it alongside the password and the links. */
   countSignInMethods(userId: string): Promise<{ password: boolean; links: number; passkeys: number }>
+  /** The bulk list-endpoint variant (identity's TODO.restructure/06):
+   *  the same counts for every id, one grouped read per underlying
+   *  table (the D1 leg rides them in ONE batch) instead of three reads
+   *  per account. Every requested id answers; an absent row reads as
+   *  zero (the per-id read's posture); an empty array answers an empty
+   *  map. */
+  countSignInMethodsBulk(userIds: string[]): Promise<Map<string, { password: boolean; links: number; passkeys: number }>>
   /** The enrollment links (invite-only). The token arrives from the
    *  caller (auth/op/accounts.ts's mint); expires_at = now + ttlMs. */
   createEnrollmentToken(input: {
@@ -2411,7 +2425,7 @@ export interface ServerStore {
   }): Promise<CertificateHolderOrg | null>
   getCertificateHolderOrg(certificateId: string): Promise<CertificateHolderOrg | null>
   /** The surface's reads: one org's attributions (the manufacturer cone),
-   *  or every row (the estate cone — no filter). */
+   *  or every row (the register-operator cone — no filter). */
   listCertificateHolderOrgs(filter?: { orgId?: string }): Promise<CertificateHolderOrg[]>
   /** File the legacy-row claim (the manufacturer org admin's act). */
   createCertificateHolderClaim(input: {
@@ -2422,7 +2436,7 @@ export interface ServerStore {
     claimedBy: string
   }): Promise<CertificateHolderClaim>
   getCertificateHolderClaim(id: string): Promise<CertificateHolderClaim | null>
-  /** The queues: the estate admin's pending list (state filter), the
+  /** The queues: the register operator's pending list (state filter), the
    *  claiming org's own claims (claimantOrgId filter), one certificate's
    *  claim history (certificateId filter). */
   listCertificateHolderClaims(filter?: {
@@ -2430,7 +2444,7 @@ export interface ServerStore {
     claimantOrgId?: string
     certificateId?: string
   }): Promise<CertificateHolderClaim[]>
-  /** The estate admin's decision — ATOMIC on 'pending': an
+  /** The register operator's decision — ATOMIC on 'pending': an
    *  already-decided claim answers null (a double confirm/refuse loses
    *  the race honestly). */
   decideCertificateHolderClaim(

package/src/vocab/permissions.ts

@@ -420,6 +420,12 @@ export const CREATION_PERMISSIONS: Record<string, readonly ActionPermission[]> =
   // document list is maintained by the certificate's issuers.
   operatedSchemes: ['instance.settings'],
   certificateDocumentLists: ['certificate.issue'],
+  // Registering a participant is the scheme operator's named act (the
+  // 2026-09-15 direct-registration posture: participation cases are
+  // CREATED active by the Secretariat — the B 18:2025 §11 RC/MC ballot
+  // pipeline is modelled, not operated). The organ split holds: the MC
+  // decides (suspension/reinstatement), the Secretariat administers.
+  participantApplications: ['participants.manage'],
 }
 
 /** FIELD guards: a field going unset → set is the act (the test

package/src/vocab/roles.ts

@@ -26,9 +26,9 @@ export const APP_ROLES = [
   // own org's people on the identity service (/op/admin/users).
   'org_admin',
   // TODO.adoption/11 — Utilizer/Associate staff: declare Additional
-  // National Requirements for their country on the ANR registry console
-  // (the declaration carries the participant it acts for; the CS
-  // registry's approval is the moderation gate).
+  // National Requirements for their country on the Member portal (the
+  // declaration carries the participant it acts for; the CS registry's
+  // approval is the moderation gate).
   'scheme_participant',
   // TODO.adoption/05 — the market-surveillance authority account: the
   // register's authority audience for the schemes that reserve their
@@ -51,14 +51,20 @@ export function roleHome(role: string | null | undefined): string {
     case 'applicant': return '/app/portal'
     case 'ia_officer': return '/app/ia'
     case 'tl_operator': return '/app/lab'
-    case 'biml_officer': return '/app/biml'
+    // The registration officer's desk: the former /app/biml portal, now a
+    // carve-out of the CS console (the six-portal taxonomy).
+    case 'biml_officer': return '/app/cs/registration'
     case 'cs_admin': return '/app/cs'
+    // The scheme-desk roles land on the /app/cs hub; their working desks
+    // (the approval pipeline, the participant registry, the ANR review
+    // queue) sit one prefix below it.
     case 'mc_member':
-    case 'rc_member': return '/app/cs/approvals'
-    case 'executive_secretary': return '/app/cs/participants'
-    // TODO.adoption/11 — the Utilizer/Associate staffer lands on the ANR
-    // registry console (the only /app/cs surface the role may enter).
-    case 'scheme_participant': return '/app/cs/anr'
+    case 'rc_member': return '/app/cs'
+    case 'executive_secretary': return '/app/cs'
+    // TODO.adoption/11 — the Utilizer/Associate staffer lands on the
+    // Member portal (the ANR declaration desk moved there from the scheme
+    // console).
+    case 'scheme_participant': return '/app/member'
     // TODO.adoption/05 — the market-surveillance authority's surface is
     // the register (its read-only authority view).
     case 'market_surveillance': return '/app/register'
@@ -94,7 +100,11 @@ export interface RoleSectionRule {
  * Secretary's surface. Both stay open to cs_admin (scheme operations).
  * TODO.roadmap/45: the scheme-operations console (/app/cs/operations —
  * appeals, complaints, misuse, deregistration) is the Executive
- * Secretary's post-issuance surface.
+ * Secretary's post-issuance surface. The registration desk
+ * (/app/cs/registration — the former /app/biml portal) is the
+ * registration officer's surface. The Member portal (/app/member) is the
+ * Utilizer/Associate staffer's surface; the ANR declaration desk moved
+ * there from /app/cs/anr (the review queue stays scheme-side).
  */
 export const ROLE_SECTION_RULES: RoleSectionRule[] = [
   // TODO.federation/02 — the engagement conversion hands off to the
@@ -117,8 +127,13 @@ export const ROLE_SECTION_RULES: RoleSectionRule[] = [
   // TODO.cs-e2e/05a — /app/lab/projects/<id> (the laboratory's scoped TEP
   // context view) rides the /app/lab prefix: the laboratory's own section.
   { prefix: '/app/lab', roles: ['tl_operator'] },
+  // The Member portal: the Utilizer/Associate staffer's surface (the ANR
+  // declaration desk moved here from the CS console — the six-portal
+  // taxonomy).
+  { prefix: '/app/member', roles: ['scheme_participant'] },
   // TODO.register/02 — the register's owner view: the manufacturer org's
-  // own rows, the IA desk's issued cone, the estate's all-seeing cone +
+  // own rows, the IA desk's issued cone, the register operator's all-seeing
+  // cone +
   // the holder-claim queue. The module path rule (auth/modules.ts) rides
   // the register module.
   { prefix: '/app/my-certificates', roles: ['applicant', 'ia_officer', 'case_officer', 'certification_officer', 'signatory', 'biml_officer', 'cs_admin'] },
@@ -129,10 +144,15 @@ export const ROLE_SECTION_RULES: RoleSectionRule[] = [
   { prefix: '/app/cs/approvals', roles: ['mc_member', 'rc_member', 'executive_secretary', 'cs_admin'] },
   { prefix: '/app/cs/participants', roles: ['executive_secretary', 'cs_admin'] },
   { prefix: '/app/cs/operations', roles: ['executive_secretary', 'cs_admin'] },
-  // TODO.adoption/11 — the ANR registry console: the Utilizer/Associate
-  // staffer (scheme_participant) declares here; the CS registry moderates.
+  // TODO.adoption/11 — the ANR review queue: the scheme side (the
+  // Executive Secretary, open to cs_admin) moderates the member-declared
+  // declarations; the declaration desk itself moved to the Member portal.
   // More specific than /app/cs, so it must come first (first match wins).
-  { prefix: '/app/cs/anr', roles: ['scheme_participant', 'executive_secretary', 'cs_admin'] },
+  { prefix: '/app/cs/anr', roles: ['executive_secretary', 'cs_admin'] },
+  // The registration desk: the registration officer's surface (the
+  // former /app/biml portal), open to cs_admin for scheme operations.
+  // More specific than /app/cs, so it must come first (first match wins).
+  { prefix: '/app/cs/registration', roles: ['biml_officer', 'cs_admin'] },
   // TODO.cs-e2e/13.15 — Data management is the workspace's own export/
   // import surface, and the profile indicator's degradation banner names
   // it as the way out for EVERY role; it must stay reachable by every