@oimlsmart/platform-server 0.2.2 → 0.2.4

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oimlsmart/platform-server",
-  "version": "0.2.2",
+  "version": "0.2.4",
   "description": "The OIML SMART platform server kernel: the store seam (ServerStore + the D1 and SQLite implementations), the canonical D1 migration set both deployments apply, the instance profile, the mailer, the RBAC map, the OIDC/OAuth client cones, and the shared role/permission vocabulary. Consumed by the smart monorepo (browser/) and the identity service.",
   "type": "module",
   "repository": {

package/src/store/d1.ts

@@ -1996,8 +1996,9 @@ export class D1ServerStore implements ServerStore {
       newEmail: row.new_email as string,
       deliveredBy: row.delivered_by === 'mailer' ? 'mailer' : 'shown',
       // TODO.identity-features/01: rows predating the kind column (or a
-      // store over a pre-0022 database) read as the legacy ceremony.
-      kind: row.kind === 'add' ? 'add' : 'change',
+      // store over a pre-0022 database) read as the legacy ceremony; the
+      // 0.2.4 'verify' kind reads by its name.
+      kind: row.kind === 'add' ? 'add' : row.kind === 'verify' ? 'verify' : 'change',
       createdAt: row.created_at as string,
       expiresAt: row.expires_at as string,
       consumedAt: (row.consumed_at as string | null) ?? null,
@@ -2009,13 +2010,15 @@ export class D1ServerStore implements ServerStore {
    *  pending 'change' rows (only the newest change link works — the
    *  pre-01 doctrine); an 'add' request voids the account's earlier
    *  pending 'add' rows FOR THE SAME address (other addresses' links
-   *  stand). */
+   *  stand); a 'verify' request voids the account's earlier pending
+   *  'verify' rows (the target is the current primary — one per
+   *  account, the change doctrine's scoping). */
   async createEmailChangeToken(input: {
     token: string
     userId: string
     newEmail: string
     deliveredBy: 'mailer' | 'shown'
-    kind?: 'change' | 'add'
+    kind?: 'change' | 'add' | 'verify'
     ttlMs: number
   }): Promise<EmailChangeToken> {
     await this.ensureAccountEmailSupport()
@@ -2025,6 +2028,11 @@ export class D1ServerStore implements ServerStore {
         "UPDATE email_change_tokens SET consumed_at = datetime('now') WHERE user_id = ? AND kind = 'change' AND consumed_at IS NULL",
         input.userId,
       ).run()
+    } else if (kind === 'verify') {
+      await this.stmt(
+        "UPDATE email_change_tokens SET consumed_at = datetime('now') WHERE user_id = ? AND kind = 'verify' AND consumed_at IS NULL",
+        input.userId,
+      ).run()
     } else {
       await this.stmt(
         "UPDATE email_change_tokens SET consumed_at = datetime('now') WHERE user_id = ? AND kind = 'add' AND new_email = ? AND consumed_at IS NULL",
@@ -2067,8 +2075,13 @@ export class D1ServerStore implements ServerStore {
    *  too, this account's included), then move users.email. 'add' (the
    *  per-address verification): the account_emails row landed unverified
    *  at the request; the completion stamps it (a row removed meanwhile
-   *  burns the link as 'unknown'). A 'mailer'-delivered token verifies
-   *  the address; a shown one never does. */
+   *  burns the link as 'unknown'). 'verify' (the 0.2.4 kind): the
+   *  re-verification of the address the account ALREADY holds as its
+   *  primary — the completion stamps users.email_verified_at when the
+   *  token's new_email IS STILL the primary (a primary moved meanwhile
+   *  burns the link as 'unknown', the vanished-target doctrine).
+   *  A 'mailer'-delivered token verifies the address; a shown one never
+   *  does. */
   async completeEmailChange(token: string): Promise<CompleteEmailChangeResult> {
     await this.ensureAccountEmailSupport()
     const res = await this.stmt(
@@ -2084,6 +2097,15 @@ export class D1ServerStore implements ServerStore {
       if (verified) await this.markAccountEmailVerified(row.userId, row.newEmail)
       return { kind: 'ok', userId: row.userId, newEmail: row.newEmail, verified }
     }
+    if (row.kind === 'verify') {
+      // The address never changes hands in this ceremony — 'conflict'
+      // does not exist here; the honest burns are the moved primary and
+      // the gone account, both read from the users row.
+      const current = await this.stmt('SELECT email FROM users WHERE id = ?', row.userId).first<{ email: string }>()
+      if (!current || current.email !== row.newEmail) return { kind: 'unknown' }
+      if (verified) await this.stmt("UPDATE users SET email_verified_at = datetime('now') WHERE id = ?", row.userId).run()
+      return { kind: 'ok', userId: row.userId, newEmail: row.newEmail, verified }
+    }
     const taken = await this.stmt('SELECT id FROM users WHERE email = ?', row.newEmail).first<{ id: string }>()
     if (taken) return { kind: 'conflict' }
     const takenAdditional = await this.stmt('SELECT user_id FROM account_emails WHERE email = ?', row.newEmail).first<{ user_id: string }>()
@@ -3235,8 +3257,16 @@ export class D1ServerStore implements ServerStore {
   // ── the workflow entity store + change journal ───────────────────
 
   async listEntities(store: string): Promise<EntityRow[]> {
+    // The ORDER BY is the seam's contract (the 0.2.3 pin): the answer
+    // arrives in (org_id, rowid) order — the read's observable order
+    // since migration 0001, when the planner walked
+    // idx_entities_store_org. Migration 0023's expression index offered
+    // a second store-prefixed walk and the unnamed order flipped to
+    // insertion (the smart app's render-baseline red, oimlsmart/smart
+    // PR #264) — a list read's order is a consumer-visible contract,
+    // never the planner's pick.
     const res = await this.stmt(
-      'SELECT store, id, org_id, data, updated_at FROM entities WHERE store = ?', store,
+      'SELECT store, id, org_id, data, updated_at FROM entities WHERE store = ? ORDER BY org_id, rowid', store,
     ).all<EntityRow>()
     return res.results
   }

package/src/store/sqlite/entities.ts

@@ -21,8 +21,13 @@ export { ORG_FIELDS, CATALOG_STORES, orgIdOf } from '../../store'
 import type { EntityRow, EntityChange } from '../../store'
 
 export function listEntities(store: string): EntityRow[] {
+  // The ORDER BY is the seam's contract (the 0.2.3 pin, the D1 half's
+  // twin): (org_id, rowid) — the read's observable order since
+  // migration 0001's idx_entities_store_org walk, made planner-proof
+  // when migration 0023's expression index offered a second
+  // store-prefixed plan.
   return getDb()
-    .prepare('SELECT store, id, org_id, data, updated_at FROM entities WHERE store = ?')
+    .prepare('SELECT store, id, org_id, data, updated_at FROM entities WHERE store = ? ORDER BY org_id, rowid')
     .all(store) as EntityRow[]
 }
 

package/src/store/sqlite/op-accounts-store.ts

@@ -469,8 +469,8 @@ function toEmailChangeToken(row: Record<string, unknown>): EmailChangeToken {
     newEmail: row.new_email as string,
     deliveredBy: row.delivered_by === 'mailer' ? 'mailer' : 'shown',
     // TODO.identity-features/01: rows predating the kind column read as
-    // the legacy ceremony.
-    kind: row.kind === 'add' ? 'add' : 'change',
+    // the legacy ceremony; the 0.2.4 'verify' kind reads by its name.
+    kind: row.kind === 'add' ? 'add' : row.kind === 'verify' ? 'verify' : 'change',
     createdAt: row.created_at as string,
     expiresAt: row.expires_at as string,
     consumedAt: (row.consumed_at as string | null) ?? null,
@@ -482,13 +482,15 @@ function toEmailChangeToken(row: Record<string, unknown>): EmailChangeToken {
  *  pending 'change' rows (only the newest change link works — the
  *  pre-01 doctrine); an 'add' request voids the account's earlier
  *  pending 'add' rows FOR THE SAME address (other addresses' links
- *  stand). */
+ *  stand); a 'verify' request voids the account's earlier pending
+ *  'verify' rows (the target is the current primary — one per account,
+ *  the change doctrine's scoping). */
 export function createEmailChangeToken(input: {
   token: string
   userId: string
   newEmail: string
   deliveredBy: 'mailer' | 'shown'
-  kind?: 'change' | 'add'
+  kind?: 'change' | 'add' | 'verify'
   ttlMs: number
 }): EmailChangeToken {
   const db = getDb()
@@ -497,6 +499,10 @@ export function createEmailChangeToken(input: {
     db.prepare(
       "UPDATE email_change_tokens SET consumed_at = datetime('now') WHERE user_id = ? AND kind = 'change' AND consumed_at IS NULL",
     ).run(input.userId)
+  } else if (kind === 'verify') {
+    db.prepare(
+      "UPDATE email_change_tokens SET consumed_at = datetime('now') WHERE user_id = ? AND kind = 'verify' AND consumed_at IS NULL",
+    ).run(input.userId)
   } else {
     db.prepare(
       "UPDATE email_change_tokens SET consumed_at = datetime('now') WHERE user_id = ? AND kind = 'add' AND new_email = ? AND consumed_at IS NULL",
@@ -535,8 +541,14 @@ export function getPendingEmailChange(userId: string): EmailChangeToken | null {
  *  this account's included), then move users.email. 'add' (the
  *  per-address verification): the account_emails row landed unverified
  *  at the request; the completion stamps it (a row removed meanwhile
- *  burns the link as 'unknown'). A 'mailer'-delivered token verifies the
- *  address; a shown one never does. */
+ *  burns the link as 'unknown'). 'verify' (the 0.2.4 kind): the
+ *  re-verification of the address the account ALREADY holds as its
+ *  primary — the completion stamps users.email_verified_at when the
+ *  token's new_email IS STILL the primary (a primary moved meanwhile —
+ *  a completed 'change', an admin re-address — burns the link as
+ *  'unknown', the vanished-target doctrine; the erasure's token sweep
+ *  burns it earlier). A 'mailer'-delivered token verifies the address;
+ *  a shown one never does. */
 export function completeEmailChange(token: string): CompleteEmailChangeResult {
   const db = getDb()
   const res = db.prepare(
@@ -552,6 +564,15 @@ export function completeEmailChange(token: string): CompleteEmailChangeResult {
     if (verified) markAccountEmailVerified(row.userId, row.newEmail)
     return { kind: 'ok', userId: row.userId, newEmail: row.newEmail, verified }
   }
+  if (row.kind === 'verify') {
+    // The address NEVER changes hands in this ceremony — 'conflict' does
+    // not exist here; the honest burns are the moved primary and the
+    // gone account, both read from the users row.
+    const current = db.prepare('SELECT email FROM users WHERE id = ?').get(row.userId) as { email: string } | undefined
+    if (!current || current.email !== row.newEmail) return { kind: 'unknown' }
+    if (verified) db.prepare("UPDATE users SET email_verified_at = datetime('now') WHERE id = ?").run(row.userId)
+    return { kind: 'ok', userId: row.userId, newEmail: row.newEmail, verified }
+  }
   const taken = db.prepare('SELECT id FROM users WHERE email = ?').get(row.newEmail) as { id: string } | undefined
   if (taken) return { kind: 'conflict' }
   const takenAdditional = db.prepare('SELECT user_id FROM account_emails WHERE email = ?').get(row.newEmail) as { user_id: string } | undefined

package/src/store/sqlite/schema.sql

@@ -459,6 +459,11 @@ CREATE INDEX IF NOT EXISTS idx_enrollment_tokens_user ON enrollment_tokens (user
 -- TODO.identity-features/01: kind names the ceremony — 'change' (the
 -- primary replacement above) or 'add' (the per-address verification of an
 -- account_emails row; completion stamps the row's verified_at).
+-- The 0.2.4 kind: 'verify' — the re-verification of the account's CURRENT
+-- primary (new_email carries it as requested; a mailer-delivered
+-- completion stamps users.email_verified_at while the address still IS
+-- the primary). A value, never a column: the kind TEXT carries it, so no
+-- migration rides the 0.2.4 seam change.
 CREATE TABLE IF NOT EXISTS email_change_tokens (
   token TEXT PRIMARY KEY,
   user_id TEXT NOT NULL REFERENCES users(id),

package/src/store/sqlite.ts

@@ -791,7 +791,7 @@ export function createSqliteServerStore(): ServerStore {
       userId: string
       newEmail: string
       deliveredBy: 'mailer' | 'shown'
-      kind?: 'change' | 'add'
+      kind?: 'change' | 'add' | 'verify'
       ttlMs: number
     }): Promise<EmailChangeToken> {
       return createEmailChangeToken(input)

package/src/store.ts

@@ -637,13 +637,19 @@ export interface OpAccountErasure {
  *  primary-address replacement; completion moves users.email) or 'add'
  *  (the per-address verification of an account_emails row; completion
  *  stamps the row's verified_at). Rows predating the kind column read
- *  'change' (the migration's default). */
+ *  'change' (the migration's default).
+ *  The 0.2.4 kind: 'verify' — the re-verification of the address the
+ *  account ALREADY holds as its primary (the invited-not-yet-set-up and
+ *  the admin-re-addressed postures, whose primary never went through a
+ *  mailbox proof). new_email carries the primary AS REQUESTED;
+ *  completion stamps users.email_verified_at when the address is STILL
+ *  the account's primary and the link traveled by mailer. */
 export interface EmailChangeToken {
   token: string
   userId: string
   newEmail: string
   deliveredBy: 'mailer' | 'shown'
-  kind: 'change' | 'add'
+  kind: 'change' | 'add' | 'verify'
   createdAt: string
   expiresAt: string
   consumedAt: string | null
@@ -653,7 +659,9 @@ export interface EmailChangeToken {
 export type CompleteEmailChangeResult =
   | { kind: 'ok'; userId: string; newEmail: string; verified: boolean }
   /** Never existed or already consumed (indistinguishable, the
-   *  enrollment rule). */
+   *  enrollment rule) — or the ceremony's target vanished between
+   *  request and completion: the 'add' row removed, the 'verify'
+   *  primary moved (the link burns the same, honestly). */
   | { kind: 'unknown' }
   /** Past the TTL: burned on presentation, never redeemable later. */
   | { kind: 'expired' }
@@ -1787,7 +1795,10 @@ export interface ServerStore {
    *  account's earlier pending 'change' rows (only the newest change
    *  link works — the pre-01 doctrine); an 'add' request voids the
    *  account's earlier pending 'add' rows FOR THE SAME address (other
-   *  addresses' links stand). deliveredBy is stamped at request time and
+   *  addresses' links stand); a 'verify' request voids the account's
+   *  earlier pending 'verify' rows (the target is the CURRENT primary —
+   *  one per account, the change doctrine's scoping; cross-kind links
+   *  never touch each other). deliveredBy is stamped at request time and
    *  decides whether completion may verify the address. kind defaults
    *  'change'. */
   createEmailChangeToken(input: {
@@ -1795,12 +1806,14 @@ export interface ServerStore {
     userId: string
     newEmail: string
     deliveredBy: 'mailer' | 'shown'
-    kind?: 'change' | 'add'
+    kind?: 'change' | 'add' | 'verify'
     ttlMs: number
   }): Promise<EmailChangeToken>
   getEmailChangeToken(token: string): Promise<EmailChangeToken | null>
   /** The account's pending change (the newest unconsumed, unexpired row),
-   *  so the console can show it. */
+   *  so the console can show it. 'verify' rows have NO pending read: the
+   *  waiting state IS users.email_verified_at NULL (the 'add' doctrine —
+   *  the account_emails rows carry their own). */
   getPendingEmailChange(userId: string): Promise<EmailChangeToken | null>
   /** Complete the ceremony: consume the token ATOMICALLY (a presented
    *  link works exactly once, expired or not), judge the expiry, then
@@ -1808,8 +1821,16 @@ export interface ServerStore {
    *  BOTH address tables (a conflict burns the token honestly) and moves
    *  the account's primary (users.email); 'add' stamps the
    *  account_emails row's verified_at (a row removed between request and
-   *  completion answers 'unknown'). verified = the token traveled by
-   *  mailer (mailbox proven); a shown link never verifies. */
+   *  completion answers 'unknown'); 'verify' (the 0.2.4 kind, the
+   *  resend-verification act for the CURRENT primary) stamps
+   *  users.email_verified_at when the token's new_email IS STILL the
+   *  account's primary — a primary moved meanwhile (a completed 'change',
+   *  an admin re-address, the erasure) burns the link as 'unknown', and
+   *  'conflict' never applies (no address changes hands). verified = the
+   *  token traveled by mailer (mailbox proven); a shown link never
+   *  verifies. The answer carries { userId, newEmail, verified } for
+   *  every kind, so the consumer's completion route audits a proven
+   *  'verify' exactly as it audits an 'add' (its account.email_verified). */
   completeEmailChange(token: string): Promise<CompleteEmailChangeResult>
 
   // ── multiple emails per account (TODO.identity-features/01) ──
@@ -2221,6 +2242,12 @@ export interface ServerStore {
   ): Promise<InstrumentRegistration | null>
 
   // ── the workflow entity store + change journal ──
+  /** The store's rows, in the seam's declared order: (org_id, rowid) —
+   *  the read's observable order since migration 0001 (NULL org ids
+   *  first, then by org id, then by insertion). Both backends spell the
+   *  ORDER BY explicitly — a list read's order is a consumer-visible
+   *  contract, never the planner's pick (the 0.2.3 pin, after
+   *  migration 0023's expression index flipped the unnamed walk). */
   listEntities(store: string): Promise<EntityRow[]>
   getEntity(store: string, id: string): Promise<EntityRow | undefined>
   putEntity(store: string, id: string, orgId: string | null, data: string): Promise<void>