@oimlsmart/platform-server 0.2.9 → 0.2.10

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oimlsmart/platform-server",
-  "version": "0.2.9",
+  "version": "0.2.10",
   "description": "The OIML SMART platform server kernel: the store seam (ServerStore + the D1 and SQLite implementations), the canonical D1 migration set both deployments apply, the instance profile, the mailer, the RBAC map, the OIDC/OAuth client cones, and the shared role/permission vocabulary. Consumed by the smart monorepo (browser/) and the identity service.",
   "type": "module",
   "repository": {

package/src/store/d1.ts

@@ -1456,6 +1456,16 @@ export class D1ServerStore implements ServerStore {
     return (res.meta.changes ?? 0) > 0
   }
 
+  /** The governance view's population read: the client's LIVE access-token
+   *  count (unexpired — the row's absence IS the revocation). */
+  async countOidcAccessTokensForClient(clientId: string): Promise<number> {
+    await this.ensureMembershipSupport()
+    const row = await this.stmt(
+      "SELECT COUNT(*) AS n FROM oidc_access_tokens WHERE client_id = ? AND datetime(expires_at) > datetime('now')", clientId,
+    ).first<{ n: number }>()
+    return row?.n ?? 0
+  }
+
   private static toRefreshToken(row: Record<string, unknown>): OidcRefreshToken {
     return {
       token: row.token as string,
@@ -1546,6 +1556,18 @@ export class D1ServerStore implements ServerStore {
     return res.meta.changes ?? 0
   }
 
+  /** The governance view's population read: the client's LIVE refresh-token
+   *  count (unconsumed AND unexpired — a revoked family is deleted
+   *  wholesale, so a live row's presence is the offline grant's standing). */
+  async countOidcRefreshTokensForClient(clientId: string): Promise<number> {
+    await this.ensureMembershipSupport()
+    await this.ensureOidcRefreshTokenSupport()
+    const row = await this.stmt(
+      "SELECT COUNT(*) AS n FROM oidc_refresh_tokens WHERE client_id = ? AND consumed_at IS NULL AND datetime(expires_at) > datetime('now')", clientId,
+    ).first<{ n: number }>()
+    return row?.n ?? 0
+  }
+
   async listOidcKeys(): Promise<OidcKeyRow[]> {
     const res = await this.stmt('SELECT * FROM oidc_keys ORDER BY created_at, kid').all<Record<string, unknown>>()
     return res.results.map(row => ({
@@ -1639,6 +1661,17 @@ export class D1ServerStore implements ServerStore {
     return (res.meta.changes ?? 0) > 0
   }
 
+  /** The client-registry governance view's per-client read: EVERY grant row
+   *  the client holds — live AND revoked, newest first. */
+  async listOidcConsentGrantsForClient(clientId: string): Promise<OidcConsentGrant[]> {
+    await this.ensureConsentGrantSupport()
+    const res = await this.stmt(
+      'SELECT * FROM oidc_consent_grants WHERE client_id = ? ORDER BY created_at DESC, rowid DESC',
+      clientId,
+    ).all<Record<string, unknown>>()
+    return res.results.map(D1ServerStore.toConsentGrant)
+  }
+
   // ── the upstream providers (TODO.identity/08) ─────────────────────
   // The provider + link rows port directly (D1 is SQLite).
 

package/src/store/sqlite/consent-grants-store.ts

@@ -77,6 +77,15 @@ export function listConsentGrants(userId: string): OidcConsentGrant[] {
   return rows.map(toConsentGrant)
 }
 
+/** The client-registry governance view's per-client read: EVERY grant row
+ *  the client holds — live AND revoked, newest first. */
+export function listOidcConsentGrantsForClient(clientId: string): OidcConsentGrant[] {
+  const rows = getDb().prepare(
+    'SELECT * FROM oidc_consent_grants WHERE client_id = ? ORDER BY created_at DESC, rowid DESC',
+  ).all(clientId) as Array<Record<string, unknown>>
+  return rows.map(toConsentGrant)
+}
+
 /** The guarded revoke: the owner's LIVE row flips, once. */
 export function revokeConsentGrant(id: string, userId: string): boolean {
   return getDb().prepare(

package/src/store/sqlite/op-store.ts

@@ -275,6 +275,15 @@ export function deleteOidcAccessToken(token: string, clientId: string): boolean
   return res.changes > 0
 }
 
+/** The governance view's population read: the client's LIVE access-token
+ *  count (unexpired — the row's absence IS the revocation). */
+export function countOidcAccessTokensForClient(clientId: string): number {
+  const row = getDb().prepare(
+    "SELECT COUNT(*) AS n FROM oidc_access_tokens WHERE client_id = ? AND datetime(expires_at) > datetime('now')",
+  ).get(clientId) as { n: number }
+  return row.n
+}
+
 function toOidcRefreshToken(row: Record<string, unknown>): OidcRefreshToken {
   return {
     token: row.token as string,
@@ -354,6 +363,16 @@ export function deleteOidcRefreshTokensForUserClient(userId: string, clientId: s
   return getDb().prepare('DELETE FROM oidc_refresh_tokens WHERE user_id = ? AND client_id = ?').run(userId, clientId).changes
 }
 
+/** The governance view's population read: the client's LIVE refresh-token
+ *  count (unconsumed AND unexpired — a revoked family is deleted wholesale,
+ *  so a live row's presence is the offline grant's standing). */
+export function countOidcRefreshTokensForClient(clientId: string): number {
+  const row = getDb().prepare(
+    "SELECT COUNT(*) AS n FROM oidc_refresh_tokens WHERE client_id = ? AND consumed_at IS NULL AND datetime(expires_at) > datetime('now')",
+  ).get(clientId) as { n: number }
+  return row.n
+}
+
 /** The amr column's honest parse (a JSON array of strings, else null —
  *  the provenance is absent on rows that predate the wave). */
 function parseJsonStringList(raw: unknown): string[] | null {

package/src/store/sqlite.ts

@@ -120,6 +120,8 @@ import {
 import {
   consumeOidcCode,
   consumeOidcRefreshToken,
+  countOidcAccessTokensForClient,
+  countOidcRefreshTokensForClient,
   createOidcAccessToken,
   createOidcAuthorization,
   createOidcCode,
@@ -223,6 +225,7 @@ import {
 import {
   getConsentGrant,
   listConsentGrants,
+  listOidcConsentGrantsForClient,
   recordConsentGrant,
   revokeConsentGrant,
 } from './sqlite/consent-grants-store'
@@ -672,6 +675,9 @@ export function createSqliteServerStore(): ServerStore {
     async deleteOidcAccessToken(token: string, clientId: string): Promise<boolean> {
       return deleteOidcAccessToken(token, clientId)
     },
+    async countOidcAccessTokensForClient(clientId: string): Promise<number> {
+      return countOidcAccessTokensForClient(clientId)
+    },
     async createOidcRefreshToken(input: {
       token: string
       userId: string
@@ -694,6 +700,9 @@ export function createSqliteServerStore(): ServerStore {
     async deleteOidcRefreshTokensForUserClient(userId: string, clientId: string): Promise<number> {
       return deleteOidcRefreshTokensForUserClient(userId, clientId)
     },
+    async countOidcRefreshTokensForClient(clientId: string): Promise<number> {
+      return countOidcRefreshTokensForClient(clientId)
+    },
     async listOidcKeys(): Promise<OidcKeyRow[]> {
       return listOidcKeys()
     },
@@ -717,6 +726,9 @@ export function createSqliteServerStore(): ServerStore {
     async revokeConsentGrant(id: string, userId: string): Promise<boolean> {
       return revokeConsentGrant(id, userId)
     },
+    async listOidcConsentGrantsForClient(clientId: string): Promise<OidcConsentGrant[]> {
+      return listOidcConsentGrantsForClient(clientId)
+    },
 
     // ── the upstream providers (TODO.identity/08) ──
     async listIdentityProviders(): Promise<IdentityProvider[]> {

package/src/store.ts

@@ -1684,6 +1684,12 @@ export interface ServerStore {
    *  client answers false). An absent row answers false too (the endpoint
    *  masks both behind its 200). */
   deleteOidcAccessToken(token: string, clientId: string): Promise<boolean>
+  /** The client-registry governance view's population read: the count of
+   *  the client's LIVE access tokens (unexpired — the row's absence IS the
+   *  revocation, so presence + liveness is standing). A count, never the
+   *  rows: the governance console answers "how many sessions stand behind
+   *  this client", never a token value. */
+  countOidcAccessTokensForClient(clientId: string): Promise<number>
   /** The refresh tokens (migration 0025 — the SSO wave-C token surface).
    *  The mint: token is the opaque value the route generated, familyId the
    *  rotation lineage (a fresh id at the code exchange's first mint, the
@@ -1717,6 +1723,12 @@ export interface ServerStore {
    *  (account, client) pair goes — the "Revoke access" act ends the
    *  offline half with the remembered consent. Answers the count. */
   deleteOidcRefreshTokensForUserClient(userId: string, clientId: string): Promise<number>
+  /** The client-registry governance view's population read: the count of
+   *  the client's LIVE refresh tokens (unconsumed AND unexpired — a
+   *  revoked family is DELETED wholesale, so a live row's presence is the
+   *  grant's standing). A count, never the rows: the console answers "how
+   *  many offline grants stand", never a token value. */
+  countOidcRefreshTokensForClient(clientId: string): Promise<number>
   /** The key rotation history (public halves). */
   listOidcKeys(): Promise<OidcKeyRow[]>
   upsertOidcKey(input: { kid: string; publicJwk: string }): Promise<void>
@@ -1743,6 +1755,13 @@ export interface ServerStore {
    *  live row — a second revoke or another account's row answers false
    *  (the PAT guard's posture). The row STAYS. */
   revokeConsentGrant(id: string, userId: string): Promise<boolean>
+  /** The client-registry governance view's per-client read: EVERY grant
+   *  row the client holds — live AND revoked (the account console's
+   *  listConsentGrants hides the revoked half; the governance view shows
+   *  the history the audit chain would otherwise carry alone), newest
+   *  first. Read-only: the acts stay on the account console and the
+   *  dashboard's revoke routes. */
+  listOidcConsentGrantsForClient(clientId: string): Promise<OidcConsentGrant[]>
 
   // ── the upstream providers (TODO.identity/08) ──
   /** The upstream registry (admin-managed; OP_UPSTREAM_SEED bootstraps).