@oimlsmart/platform-server 0.2.9 → 0.2.11

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oimlsmart/platform-server",
-  "version": "0.2.9",
+  "version": "0.2.11",
   "description": "The OIML SMART platform server kernel: the store seam (ServerStore + the D1 and SQLite implementations), the canonical D1 migration set both deployments apply, the instance profile, the mailer, the RBAC map, the OIDC/OAuth client cones, and the shared role/permission vocabulary. Consumed by the smart monorepo (browser/) and the identity service.",
   "type": "module",
   "repository": {

package/src/store/d1.ts

@@ -30,8 +30,10 @@
 
 import type { D1Database, D1PreparedStatement } from '@cloudflare/workers-types'
 import {
+  APPEND_EVENTS_CHUNK,
   DEMO_PASSWORD,
   EVENTS_BULK_KEY_CHUNK,
+  INSTRUMENT_REGISTRATIONS_CHUNK,
   PUT_ENTITIES_CHUNK,
   StoreUnavailable,
   type AccountEmail,
@@ -48,6 +50,7 @@ import {
   type EntityWriteInput,
   type EventEntityKey,
   type EventKeyFilter,
+  type EventWriteInput,
   type FederationPeer,
   type IdentityApproval,
   type IdentityLink,
@@ -84,6 +87,7 @@ import {
   type InstrumentRegistration,
   type InstrumentRegistrationLifecycle,
   type InstrumentRegistrationScopeStatus,
+  type InstrumentRegistrationWriteInput,
   type PersonalAccessToken,
   type PlatformEvent,
   resolveOrgContext,
@@ -423,6 +427,20 @@ const ENTITY_UPSERT_SQL = `INSERT INTO entities (store, id, org_id, data, update
          ON CONFLICT (store, id) DO UPDATE SET org_id = excluded.org_id, data = excluded.data, updated_at = datetime('now')`
 const ENTITY_CHANGE_SQL = 'INSERT INTO entity_changes (store, type, id) VALUES (?, ?, ?)'
 
+/** The register write's INSERT — ONE textual source for
+ *  createInstrumentRegistration and createInstrumentRegistrations alike
+ *  (the batch verb appends RETURNING * so the stored row answers off
+ *  the write itself; the single verb keeps its .run() + by-id
+ *  read-back pair). */
+const INSTRUMENT_REGISTRATION_INSERT_SQL = `INSERT OR IGNORE INTO instrument_registrations
+       (id, certificate_id, holder_org_id, standard_id, serial_number, manufacture_date, designations, scope_status, scope_detail, registered_by)
+     VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`
+
+/** The event append's INSERT … RETURNING * — ONE textual source for
+ *  appendEvent and appendEvents alike (the stored row — seq + the
+ *  default at — answers off the write itself). */
+const EVENT_INSERT_SQL = 'INSERT INTO events (id, domain, entity_id, action, payload) VALUES (?, ?, ?, ?, ?) RETURNING *'
+
 export class D1ServerStore implements ServerStore {
   /** The RAW binding — the ensure memos (and d1StoreFor's map) key on
    *  it: the facade below is per-instance and would never hit. */
@@ -1456,6 +1474,16 @@ export class D1ServerStore implements ServerStore {
     return (res.meta.changes ?? 0) > 0
   }
 
+  /** The governance view's population read: the client's LIVE access-token
+   *  count (unexpired — the row's absence IS the revocation). */
+  async countOidcAccessTokensForClient(clientId: string): Promise<number> {
+    await this.ensureMembershipSupport()
+    const row = await this.stmt(
+      "SELECT COUNT(*) AS n FROM oidc_access_tokens WHERE client_id = ? AND datetime(expires_at) > datetime('now')", clientId,
+    ).first<{ n: number }>()
+    return row?.n ?? 0
+  }
+
   private static toRefreshToken(row: Record<string, unknown>): OidcRefreshToken {
     return {
       token: row.token as string,
@@ -1546,6 +1574,18 @@ export class D1ServerStore implements ServerStore {
     return res.meta.changes ?? 0
   }
 
+  /** The governance view's population read: the client's LIVE refresh-token
+   *  count (unconsumed AND unexpired — a revoked family is deleted
+   *  wholesale, so a live row's presence is the offline grant's standing). */
+  async countOidcRefreshTokensForClient(clientId: string): Promise<number> {
+    await this.ensureMembershipSupport()
+    await this.ensureOidcRefreshTokenSupport()
+    const row = await this.stmt(
+      "SELECT COUNT(*) AS n FROM oidc_refresh_tokens WHERE client_id = ? AND consumed_at IS NULL AND datetime(expires_at) > datetime('now')", clientId,
+    ).first<{ n: number }>()
+    return row?.n ?? 0
+  }
+
   async listOidcKeys(): Promise<OidcKeyRow[]> {
     const res = await this.stmt('SELECT * FROM oidc_keys ORDER BY created_at, kid').all<Record<string, unknown>>()
     return res.results.map(row => ({
@@ -1639,6 +1679,17 @@ export class D1ServerStore implements ServerStore {
     return (res.meta.changes ?? 0) > 0
   }
 
+  /** The client-registry governance view's per-client read: EVERY grant row
+   *  the client holds — live AND revoked, newest first. */
+  async listOidcConsentGrantsForClient(clientId: string): Promise<OidcConsentGrant[]> {
+    await this.ensureConsentGrantSupport()
+    const res = await this.stmt(
+      'SELECT * FROM oidc_consent_grants WHERE client_id = ? ORDER BY created_at DESC, rowid DESC',
+      clientId,
+    ).all<Record<string, unknown>>()
+    return res.results.map(D1ServerStore.toConsentGrant)
+  }
+
   // ── the upstream providers (TODO.identity/08) ─────────────────────
   // The provider + link rows port directly (D1 is SQLite).
 
@@ -3390,23 +3441,10 @@ export class D1ServerStore implements ServerStore {
 
   /** Register the instrument; NULL on the (certificate, serial)
    *  conflict (the route's honest 409). */
-  async createInstrumentRegistration(input: {
-    id: string
-    certificateId: string
-    holderOrgId: string
-    standardId: string
-    serialNumber: string
-    manufactureDate?: string | null
-    designations?: Record<string, unknown>
-    scopeStatus: InstrumentRegistrationScopeStatus
-    scopeDetail?: string | null
-    registeredBy?: string | null
-  }): Promise<InstrumentRegistration | null> {
+  async createInstrumentRegistration(input: InstrumentRegistrationWriteInput): Promise<InstrumentRegistration | null> {
     await this.ensureInstrumentRegistrationSupport()
     const res = await this.stmt(
-      `INSERT OR IGNORE INTO instrument_registrations
-         (id, certificate_id, holder_org_id, standard_id, serial_number, manufacture_date, designations, scope_status, scope_detail, registered_by)
-       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+      INSTRUMENT_REGISTRATION_INSERT_SQL,
       input.id, input.certificateId, input.holderOrgId, input.standardId, input.serialNumber,
       input.manufactureDate ?? null, JSON.stringify(input.designations ?? {}),
       input.scopeStatus, input.scopeDetail ?? null, input.registeredBy ?? null,
@@ -3415,6 +3453,37 @@ export class D1ServerStore implements ServerStore {
     return this.getInstrumentRegistration(input.id)
   }
 
+  /** The batch register write (the seam's contract, mechanically):
+   *  each row's INSERT OR IGNORE … RETURNING * rides ONE db.batch per
+   *  INSTRUMENT_REGISTRATIONS_CHUNK rows, the statements in INPUT order,
+   *  the chunks SERIALLY — the register's insertion order IS the CSV's
+   *  row order. The per-row answer comes off the batch's own results:
+   *  the stored row, or NULL when the RETURNING came back empty (the
+   *  (certificate, serial) conflict — the single verb's honest null).
+   *  The chunk is the atomic unit: a D1 batch lands all-or-nothing; a
+   *  failed chunk throws with its rows unlanded, earlier chunks
+   *  standing, later chunks never issued. */
+  async createInstrumentRegistrations(rows: readonly InstrumentRegistrationWriteInput[]): Promise<(InstrumentRegistration | null)[]> {
+    await this.ensureInstrumentRegistrationSupport()
+    if (rows.length === 0) return []
+    const out: (InstrumentRegistration | null)[] = []
+    for (let i = 0; i < rows.length; i += INSTRUMENT_REGISTRATIONS_CHUNK) {
+      const chunk = rows.slice(i, i + INSTRUMENT_REGISTRATIONS_CHUNK)
+      const statements = chunk.map(row => this.stmt(
+        `${INSTRUMENT_REGISTRATION_INSERT_SQL} RETURNING *`,
+        row.id, row.certificateId, row.holderOrgId, row.standardId, row.serialNumber,
+        row.manufactureDate ?? null, JSON.stringify(row.designations ?? {}),
+        row.scopeStatus, row.scopeDetail ?? null, row.registeredBy ?? null,
+      ))
+      const results = await this.db.batch(statements)
+      for (const res of results) {
+        const stored = res.results[0] as Record<string, unknown> | undefined
+        out.push(stored ? D1ServerStore.toInstrumentRegistration(stored) : null)
+      }
+    }
+    return out
+  }
+
   /** The lifecycle act (the transition rule is the route's); stamps
    *  updated_at/by. NULL when the register does not carry the id. */
   async setInstrumentRegistrationLifecycle(
@@ -3535,24 +3604,42 @@ export class D1ServerStore implements ServerStore {
     }
   }
 
-  async appendEvent(input: {
-    id: string
-    domain: string
-    entityId: string
-    action: string
-    payload: string
-  }): Promise<PlatformEvent> {
+  async appendEvent(input: EventWriteInput): Promise<PlatformEvent> {
     // ONE round trip: the RETURNING clause (SQLite ≥ 3.35, D1 included)
     // answers the stored row — seq + the default at — off the INSERT
     // itself; the SELECT-by-id read-back retired (the 2026-09-06 audit:
     // two round trips per event, halved).
     const row = await this.stmt(
-      'INSERT INTO events (id, domain, entity_id, action, payload) VALUES (?, ?, ?, ?, ?) RETURNING *',
+      EVENT_INSERT_SQL,
       input.id, input.domain, input.entityId, input.action, input.payload,
     ).first<Record<string, unknown>>()
     return D1ServerStore.toPlatformEvent(row!)
   }
 
+  /** The bulk append (the seam's contract, mechanically): each event's
+   *  INSERT … RETURNING * rides ONE db.batch per APPEND_EVENTS_CHUNK
+   *  rows, the statements in INPUT order, the chunks SERIALLY — the
+   *  events' seq order IS the input order. The answer is the stored
+   *  rows, input-aligned. The chunk is the atomic unit: a D1 batch
+   *  lands all-or-nothing; a failed chunk throws with its events
+   *  unlanded, earlier chunks standing, later chunks never issued. */
+  async appendEvents(events: readonly EventWriteInput[]): Promise<PlatformEvent[]> {
+    if (events.length === 0) return []
+    const out: PlatformEvent[] = []
+    for (let i = 0; i < events.length; i += APPEND_EVENTS_CHUNK) {
+      const chunk = events.slice(i, i + APPEND_EVENTS_CHUNK)
+      const statements = chunk.map(e => this.stmt(
+        EVENT_INSERT_SQL,
+        e.id, e.domain, e.entityId, e.action, e.payload,
+      ))
+      const results = await this.db.batch(statements)
+      for (const res of results) {
+        out.push(D1ServerStore.toPlatformEvent(res.results[0] as Record<string, unknown>))
+      }
+    }
+    return out
+  }
+
   async eventsAfter(seq: number, limit = 500): Promise<PlatformEvent[]> {
     const res = await this.stmt(
       'SELECT * FROM events WHERE seq > ? ORDER BY seq LIMIT ?', seq, limit,

package/src/store/sqlite/consent-grants-store.ts

@@ -77,6 +77,15 @@ export function listConsentGrants(userId: string): OidcConsentGrant[] {
   return rows.map(toConsentGrant)
 }
 
+/** The client-registry governance view's per-client read: EVERY grant row
+ *  the client holds — live AND revoked, newest first. */
+export function listOidcConsentGrantsForClient(clientId: string): OidcConsentGrant[] {
+  const rows = getDb().prepare(
+    'SELECT * FROM oidc_consent_grants WHERE client_id = ? ORDER BY created_at DESC, rowid DESC',
+  ).all(clientId) as Array<Record<string, unknown>>
+  return rows.map(toConsentGrant)
+}
+
 /** The guarded revoke: the owner's LIVE row flips, once. */
 export function revokeConsentGrant(id: string, userId: string): boolean {
   return getDb().prepare(

package/src/store/sqlite/events.ts

@@ -9,7 +9,7 @@
 // ═══════════════════════════════════════════════════════════════════
 
 import { getDb } from './store'
-import { EVENTS_BULK_KEY_CHUNK, type EventEntityKey, type EventKeyFilter, type PlatformEvent } from '../../store'
+import { APPEND_EVENTS_CHUNK, EVENTS_BULK_KEY_CHUNK, type EventEntityKey, type EventKeyFilter, type EventWriteInput, type PlatformEvent } from '../../store'
 
 interface EventRow {
   seq: number
@@ -33,13 +33,7 @@ function toPlatformEvent(row: EventRow): PlatformEvent {
   }
 }
 
-export function appendEvent(input: {
-  id: string
-  domain: string
-  entityId: string
-  action: string
-  payload: string
-}): PlatformEvent {
+export function appendEvent(input: EventWriteInput): PlatformEvent {
   // ONE statement: RETURNING answers the stored row (seq + the default
   // at) off the INSERT itself — the same halving as the D1 half.
   return toPlatformEvent(
@@ -49,6 +43,33 @@ export function appendEvent(input: {
   )
 }
 
+/** The bulk append (the seam's appendEvents, the 2026-09-07 audit's
+ *  chain half): each event lands exactly as appendEvent would land it —
+ *  the INSERT … RETURNING * answers the stored row off the write itself —
+ *  the answer rows in INPUT order (their seqs strictly increase in it),
+ *  one transaction per APPEND_EVENTS_CHUNK rows. The chunk is the atomic
+ *  unit, matching the D1 batch's all-or-nothing; a failed chunk throws
+ *  with its events unlanded, earlier chunks standing, later chunks never
+ *  issued. The chunks run serially, so the events' seq order IS the
+ *  input order. */
+export function appendEvents(events: readonly EventWriteInput[]): PlatformEvent[] {
+  if (events.length === 0) return []
+  const db = getDb()
+  const insert = db.prepare(
+    `INSERT INTO events (id, domain, entity_id, action, payload) VALUES (?, ?, ?, ?, ?) RETURNING *`,
+  )
+  const out: PlatformEvent[] = []
+  for (let i = 0; i < events.length; i += APPEND_EVENTS_CHUNK) {
+    const chunk = events.slice(i, i + APPEND_EVENTS_CHUNK)
+    db.transaction(() => {
+      for (const e of chunk) {
+        out.push(toPlatformEvent(insert.get(e.id, e.domain, e.entityId, e.action, e.payload) as EventRow))
+      }
+    })()
+  }
+  return out
+}
+
 /** The feed's raw leg: events past the cursor, seq-ordered. */
 export function eventsAfter(seq: number, limit = 500): PlatformEvent[] {
   const rows = getDb()

package/src/store/sqlite/op-store.ts

@@ -275,6 +275,15 @@ export function deleteOidcAccessToken(token: string, clientId: string): boolean
   return res.changes > 0
 }
 
+/** The governance view's population read: the client's LIVE access-token
+ *  count (unexpired — the row's absence IS the revocation). */
+export function countOidcAccessTokensForClient(clientId: string): number {
+  const row = getDb().prepare(
+    "SELECT COUNT(*) AS n FROM oidc_access_tokens WHERE client_id = ? AND datetime(expires_at) > datetime('now')",
+  ).get(clientId) as { n: number }
+  return row.n
+}
+
 function toOidcRefreshToken(row: Record<string, unknown>): OidcRefreshToken {
   return {
     token: row.token as string,
@@ -354,6 +363,16 @@ export function deleteOidcRefreshTokensForUserClient(userId: string, clientId: s
   return getDb().prepare('DELETE FROM oidc_refresh_tokens WHERE user_id = ? AND client_id = ?').run(userId, clientId).changes
 }
 
+/** The governance view's population read: the client's LIVE refresh-token
+ *  count (unconsumed AND unexpired — a revoked family is deleted wholesale,
+ *  so a live row's presence is the offline grant's standing). */
+export function countOidcRefreshTokensForClient(clientId: string): number {
+  const row = getDb().prepare(
+    "SELECT COUNT(*) AS n FROM oidc_refresh_tokens WHERE client_id = ? AND consumed_at IS NULL AND datetime(expires_at) > datetime('now')",
+  ).get(clientId) as { n: number }
+  return row.n
+}
+
 /** The amr column's honest parse (a JSON array of strings, else null —
  *  the provenance is absent on rows that predate the wave). */
 function parseJsonStringList(raw: unknown): string[] | null {

package/src/store/sqlite/store.ts

@@ -1355,7 +1355,9 @@ import type {
   InstrumentRegistration,
   InstrumentRegistrationLifecycle,
   InstrumentRegistrationScopeStatus,
+  InstrumentRegistrationWriteInput,
 } from '../../store'
+import { INSTRUMENT_REGISTRATIONS_CHUNK } from '../../store'
 
 interface InstrumentRegistrationRow {
   id: string
@@ -1430,18 +1432,7 @@ export function getInstrumentRegistration(id: string): InstrumentRegistration |
 /** Register the instrument; NULL on the (certificate, serial) conflict
  *  (the same physical unit never registers twice under one certificate —
  *  the route's honest 409). */
-export function createInstrumentRegistration(input: {
-  id: string
-  certificateId: string
-  holderOrgId: string
-  standardId: string
-  serialNumber: string
-  manufactureDate?: string | null
-  designations?: Record<string, unknown>
-  scopeStatus: InstrumentRegistrationScopeStatus
-  scopeDetail?: string | null
-  registeredBy?: string | null
-}): InstrumentRegistration | null {
+export function createInstrumentRegistration(input: InstrumentRegistrationWriteInput): InstrumentRegistration | null {
   const res = getDb().prepare(
     `INSERT OR IGNORE INTO instrument_registrations
        (id, certificate_id, holder_org_id, standard_id, serial_number, manufacture_date, designations, scope_status, scope_detail, registered_by)
@@ -1455,6 +1446,42 @@ export function createInstrumentRegistration(input: {
   return getInstrumentRegistration(input.id)
 }
 
+/** The batch register write (the seam's createInstrumentRegistrations,
+ *  the 2026-09-07 audit's REAL J1): each row lands exactly as
+ *  createInstrumentRegistration would land it — the INSERT OR IGNORE …
+ *  RETURNING * answers the stored row off the write itself (NULL when it
+ *  comes back empty: the (certificate, serial) conflict), the per-row
+ *  answers aligned with the INPUT order — one transaction per
+ *  INSTRUMENT_REGISTRATIONS_CHUNK rows. The chunk is the atomic unit,
+ *  matching the D1 batch's all-or-nothing; a failed chunk throws with
+ *  its rows unlanded, earlier chunks standing, later chunks never
+ *  issued. The chunks run serially, so the register's insertion order
+ *  IS the input's row order. */
+export function createInstrumentRegistrations(rows: readonly InstrumentRegistrationWriteInput[]): (InstrumentRegistration | null)[] {
+  if (rows.length === 0) return []
+  const db = getDb()
+  const insert = db.prepare(
+    `INSERT OR IGNORE INTO instrument_registrations
+       (id, certificate_id, holder_org_id, standard_id, serial_number, manufacture_date, designations, scope_status, scope_detail, registered_by)
+     VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?) RETURNING *`,
+  )
+  const out: (InstrumentRegistration | null)[] = []
+  for (let i = 0; i < rows.length; i += INSTRUMENT_REGISTRATIONS_CHUNK) {
+    const chunk = rows.slice(i, i + INSTRUMENT_REGISTRATIONS_CHUNK)
+    db.transaction(() => {
+      for (const row of chunk) {
+        const stored = insert.get(
+          row.id, row.certificateId, row.holderOrgId, row.standardId, row.serialNumber,
+          row.manufactureDate ?? null, JSON.stringify(row.designations ?? {}),
+          row.scopeStatus, row.scopeDetail ?? null, row.registeredBy ?? null,
+        ) as InstrumentRegistrationRow | undefined
+        out.push(stored ? instrumentRegistrationPayload(stored) : null)
+      }
+    })()
+  }
+  return out
+}
+
 /** The lifecycle act (the transition rule is the route's); stamps
  *  updated_at/by. NULL when the register does not carry the id. */
 export function setInstrumentRegistrationLifecycle(

package/src/store/sqlite.ts

@@ -22,6 +22,7 @@ import {
   createOrgMembership,
   createOrgRegistryOrg,
   createInstrumentRegistration,
+  createInstrumentRegistrations,
   createSession,
   decideCertificateHolderClaim,
   decideIdentityApproval,
@@ -91,6 +92,7 @@ import {
 } from './sqlite/entities'
 import {
   appendEvent,
+  appendEvents,
   eventsAfter,
   eventsMatching,
   getEvent,
@@ -120,6 +122,8 @@ import {
 import {
   consumeOidcCode,
   consumeOidcRefreshToken,
+  countOidcAccessTokensForClient,
+  countOidcRefreshTokensForClient,
   createOidcAccessToken,
   createOidcAuthorization,
   createOidcCode,
@@ -187,7 +191,7 @@ import {
   updateOpAccount,
   updateUserName,
 } from './sqlite/op-accounts-store'
-import { installStore, type AccountEmail, type AddAccountEmailResult, type AuthUserPayload, type CertificateHolderClaim, type CertificateHolderOrg, type CompleteEmailChangeResult, type CompleteEnrollmentResult, type ConsumeOidcRefreshTokenResult, type EmailChangeToken, type EnrollmentToken, type EntityChange, type EntityRow, type EntityWriteInput, type EventEntityKey, type EventKeyFilter, type FederationPeer, type IdentityApproval, type IdentityLink, type IdentityProvider, type InstrumentRegistration, type InstrumentRegistrationLifecycle, type InstrumentRegistrationScopeStatus, type NotifyDelivery, type NotifyDeliveryStatus, type NotifyEntityMute, type NotifyInboxState, type NotifyPreferences, type NotifyRule, type OAuthInitialAssignment, type OidcAccessToken, type OidcAuthorization, type OidcClient, type OidcClientLaunch, type OidcCode, type OidcConsentGrant, type OidcKeyRow, type OidcRefreshToken, type OpAccountErasure, type OpClientRoleAssignment, type OpLiveSession, type OrgJoinRequest, type OrgMembership, type OrgMembershipState, type OrgRegistryContact, type OrgRegistryOrg, type OrgRegistryState, type PersonalAccessToken, type PlatformEvent, type ServerStore, type SessionView, type SsoSignInState, type UserAdminRow, type AdvanceCounterResult, type MfaPending, type RecoveryCodeState, type TotpSecret, type WebauthnChallenge, type WebauthnCredential } from '../store'
+import { installStore, type AccountEmail, type AddAccountEmailResult, type AuthUserPayload, type CertificateHolderClaim, type CertificateHolderOrg, type CompleteEmailChangeResult, type CompleteEnrollmentResult, type ConsumeOidcRefreshTokenResult, type EmailChangeToken, type EnrollmentToken, type EntityChange, type EntityRow, type EntityWriteInput, type EventEntityKey, type EventKeyFilter, type EventWriteInput, type FederationPeer, type IdentityApproval, type IdentityLink, type IdentityProvider, type InstrumentRegistration, type InstrumentRegistrationLifecycle, type InstrumentRegistrationScopeStatus, type InstrumentRegistrationWriteInput, type NotifyDelivery, type NotifyDeliveryStatus, type NotifyEntityMute, type NotifyInboxState, type NotifyPreferences, type NotifyRule, type OAuthInitialAssignment, type OidcAccessToken, type OidcAuthorization, type OidcClient, type OidcClientLaunch, type OidcCode, type OidcConsentGrant, type OidcKeyRow, type OidcRefreshToken, type OpAccountErasure, type OpClientRoleAssignment, type OpLiveSession, type OrgJoinRequest, type OrgMembership, type OrgMembershipState, type OrgRegistryContact, type OrgRegistryOrg, type OrgRegistryState, type PersonalAccessToken, type PlatformEvent, type ServerStore, type SessionView, type SsoSignInState, type UserAdminRow, type AdvanceCounterResult, type MfaPending, type RecoveryCodeState, type TotpSecret, type WebauthnChallenge, type WebauthnCredential } from '../store'
 import {
   advanceWebauthnCounter,
   consumeMfaPending,
@@ -223,6 +227,7 @@ import {
 import {
   getConsentGrant,
   listConsentGrants,
+  listOidcConsentGrantsForClient,
   recordConsentGrant,
   revokeConsentGrant,
 } from './sqlite/consent-grants-store'
@@ -568,20 +573,12 @@ export function createSqliteServerStore(): ServerStore {
     async getInstrumentRegistration(id: string): Promise<InstrumentRegistration | null> {
       return getInstrumentRegistration(id)
     },
-    async createInstrumentRegistration(input: {
-      id: string
-      certificateId: string
-      holderOrgId: string
-      standardId: string
-      serialNumber: string
-      manufactureDate?: string | null
-      designations?: Record<string, unknown>
-      scopeStatus: InstrumentRegistrationScopeStatus
-      scopeDetail?: string | null
-      registeredBy?: string | null
-    }): Promise<InstrumentRegistration | null> {
+    async createInstrumentRegistration(input: InstrumentRegistrationWriteInput): Promise<InstrumentRegistration | null> {
       return createInstrumentRegistration(input)
     },
+    async createInstrumentRegistrations(rows: readonly InstrumentRegistrationWriteInput[]): Promise<(InstrumentRegistration | null)[]> {
+      return createInstrumentRegistrations(rows)
+    },
     async setInstrumentRegistrationLifecycle(
       id: string,
       lifecycle: InstrumentRegistrationLifecycle,
@@ -672,6 +669,9 @@ export function createSqliteServerStore(): ServerStore {
     async deleteOidcAccessToken(token: string, clientId: string): Promise<boolean> {
       return deleteOidcAccessToken(token, clientId)
     },
+    async countOidcAccessTokensForClient(clientId: string): Promise<number> {
+      return countOidcAccessTokensForClient(clientId)
+    },
     async createOidcRefreshToken(input: {
       token: string
       userId: string
@@ -694,6 +694,9 @@ export function createSqliteServerStore(): ServerStore {
     async deleteOidcRefreshTokensForUserClient(userId: string, clientId: string): Promise<number> {
       return deleteOidcRefreshTokensForUserClient(userId, clientId)
     },
+    async countOidcRefreshTokensForClient(clientId: string): Promise<number> {
+      return countOidcRefreshTokensForClient(clientId)
+    },
     async listOidcKeys(): Promise<OidcKeyRow[]> {
       return listOidcKeys()
     },
@@ -717,6 +720,9 @@ export function createSqliteServerStore(): ServerStore {
     async revokeConsentGrant(id: string, userId: string): Promise<boolean> {
       return revokeConsentGrant(id, userId)
     },
+    async listOidcConsentGrantsForClient(clientId: string): Promise<OidcConsentGrant[]> {
+      return listOidcConsentGrantsForClient(clientId)
+    },
 
     // ── the upstream providers (TODO.identity/08) ──
     async listIdentityProviders(): Promise<IdentityProvider[]> {
@@ -1032,15 +1038,12 @@ export function createSqliteServerStore(): ServerStore {
     },
 
     // ── the platform event store (TODO.notify/01) ──
-    async appendEvent(input: {
-      id: string
-      domain: string
-      entityId: string
-      action: string
-      payload: string
-    }): Promise<PlatformEvent> {
+    async appendEvent(input: EventWriteInput): Promise<PlatformEvent> {
       return appendEvent(input)
     },
+    async appendEvents(events: readonly EventWriteInput[]): Promise<PlatformEvent[]> {
+      return appendEvents(events)
+    },
     async eventsAfter(seq: number, limit = 500): Promise<PlatformEvent[]> {
       return eventsAfter(seq, limit)
     },

package/src/store.ts

@@ -217,6 +217,17 @@ export interface PlatformEvent {
   at: string
 }
 
+/** One row of the bulk append (appendEvents): appendEvent's legs — the
+ *  same fields, so each event lands exactly as the single-row verb
+ *  would land it (the EntityWriteInput pattern). */
+export interface EventWriteInput {
+  id: string
+  domain: string
+  entityId: string
+  action: string
+  payload: string
+}
+
 /** The key pattern's SQL legs: a subscription pattern (`application/**`,
  *  `certificate` + `issued` across the domain, one entity's
  *  `test-run/asg-…-001/**`) compiles to the columns it pins; absent legs
@@ -243,6 +254,17 @@ export interface EventEntityKey {
  *  backends stay answer-identical. */
 export const EVENTS_BULK_KEY_CHUNK = 49
 
+/** The bulk append's chunk, in ROWS (appendEvents): each event
+ *  contributes ONE statement (the INSERT … RETURNING * answers the
+ *  stored row off the write itself, the appendEvent halving), so a
+ *  chunk is one db.batch of APPEND_EVENTS_CHUNK statements — the
+ *  INSTRUMENT_REGISTRATIONS_CHUNK order. The chunk bounds the ATOMIC
+ *  unit (a D1 batch is all-or-nothing; the SQLite half's per-chunk
+ *  transaction matches it). Chunks issue SERIALLY, in input order —
+ *  the events' seq order IS the input order, and parallel chunks would
+ *  forfeit it. */
+export const APPEND_EVENTS_CHUNK = 50
+
 // ── the notification subscriptions store (TODO.notify/02) ────────────
 
 /** The rule row's mode: 'subscribe' adds the user to the candidates of
@@ -1339,6 +1361,35 @@ export interface InstrumentRegistration {
   updatedBy: string | null
 }
 
+/** One row of the batch register write (createInstrumentRegistrations):
+ *  createInstrumentRegistration's legs — the same fields, so each row
+ *  lands exactly as the single-row verb would land it (the
+ *  EntityWriteInput pattern). */
+export interface InstrumentRegistrationWriteInput {
+  id: string
+  certificateId: string
+  holderOrgId: string
+  standardId: string
+  serialNumber: string
+  manufactureDate?: string | null
+  designations?: Record<string, unknown>
+  scopeStatus: InstrumentRegistrationScopeStatus
+  scopeDetail?: string | null
+  registeredBy?: string | null
+}
+
+/** The batch register write's chunk, in ROWS (createInstrumentRegistrations):
+ *  each row contributes ONE statement (the INSERT OR IGNORE … RETURNING *
+ *  answers the stored row off the write itself), so a chunk is one
+ *  db.batch of INSTRUMENT_REGISTRATIONS_CHUNK statements — half the
+ *  PUT_ENTITIES_CHUNK statement load, the same conservative order. The
+ *  chunk bounds the ATOMIC unit (a D1 batch is all-or-nothing; the
+ *  SQLite half's per-chunk transaction matches it). Chunks issue
+ *  SERIALLY, in input order — the register's insertion order IS the
+ *  input's row order (the CSV commit's chain events sequence after it,
+ *  same order), and parallel chunks would forfeit it. */
+export const INSTRUMENT_REGISTRATIONS_CHUNK = 50
+
 /** Per-store org fields for the READ visibility (the multi-party
  *  model: a row is visible when ANY named field equals the user's
  *  org). The field names are the entities' REAL ones (verified against
@@ -1684,6 +1735,12 @@ export interface ServerStore {
    *  client answers false). An absent row answers false too (the endpoint
    *  masks both behind its 200). */
   deleteOidcAccessToken(token: string, clientId: string): Promise<boolean>
+  /** The client-registry governance view's population read: the count of
+   *  the client's LIVE access tokens (unexpired — the row's absence IS the
+   *  revocation, so presence + liveness is standing). A count, never the
+   *  rows: the governance console answers "how many sessions stand behind
+   *  this client", never a token value. */
+  countOidcAccessTokensForClient(clientId: string): Promise<number>
   /** The refresh tokens (migration 0025 — the SSO wave-C token surface).
    *  The mint: token is the opaque value the route generated, familyId the
    *  rotation lineage (a fresh id at the code exchange's first mint, the
@@ -1717,6 +1774,12 @@ export interface ServerStore {
    *  (account, client) pair goes — the "Revoke access" act ends the
    *  offline half with the remembered consent. Answers the count. */
   deleteOidcRefreshTokensForUserClient(userId: string, clientId: string): Promise<number>
+  /** The client-registry governance view's population read: the count of
+   *  the client's LIVE refresh tokens (unconsumed AND unexpired — a
+   *  revoked family is DELETED wholesale, so a live row's presence is the
+   *  grant's standing). A count, never the rows: the console answers "how
+   *  many offline grants stand", never a token value. */
+  countOidcRefreshTokensForClient(clientId: string): Promise<number>
   /** The key rotation history (public halves). */
   listOidcKeys(): Promise<OidcKeyRow[]>
   upsertOidcKey(input: { kid: string; publicJwk: string }): Promise<void>
@@ -1743,6 +1806,13 @@ export interface ServerStore {
    *  live row — a second revoke or another account's row answers false
    *  (the PAT guard's posture). The row STAYS. */
   revokeConsentGrant(id: string, userId: string): Promise<boolean>
+  /** The client-registry governance view's per-client read: EVERY grant
+   *  row the client holds — live AND revoked (the account console's
+   *  listConsentGrants hides the revoked half; the governance view shows
+   *  the history the audit chain would otherwise carry alone), newest
+   *  first. Read-only: the acts stay on the account console and the
+   *  dashboard's revoke routes. */
+  listOidcConsentGrantsForClient(clientId: string): Promise<OidcConsentGrant[]>
 
   // ── the upstream providers (TODO.identity/08) ──
   /** The upstream registry (admin-managed; OP_UPSTREAM_SEED bootstraps).
@@ -2338,18 +2408,35 @@ export interface ServerStore {
   /** Register the instrument. NULL on the (certificate_id,
    *  serial_number) conflict — the same physical unit never registers
    *  twice under one certificate (the route's honest 409). */
-  createInstrumentRegistration(input: {
-    id: string
-    certificateId: string
-    holderOrgId: string
-    standardId: string
-    serialNumber: string
-    manufactureDate?: string | null
-    designations?: Record<string, unknown>
-    scopeStatus: InstrumentRegistrationScopeStatus
-    scopeDetail?: string | null
-    registeredBy?: string | null
-  }): Promise<InstrumentRegistration | null>
+  createInstrumentRegistration(input: InstrumentRegistrationWriteInput): Promise<InstrumentRegistration | null>
+  /** The BATCH register write (the 2026-09-07 performance audit's REAL
+   *  J1 — the CSV commit awaited createInstrumentRegistration per
+   *  imported row: ~10⁴ rows = minutes of serial D1 writes at demo
+   *  latency, two round trips each): every row lands exactly as the
+   *  single-row verb would land it, but the rows ride ONE db.batch per
+   *  INSTRUMENT_REGISTRATIONS_CHUNK rows, the INSERT OR IGNORE …
+   *  RETURNING * answering the stored row off the write itself (the
+   *  appendEvent halving — never the INSERT + SELECT-by-id pair).
+   *
+   *  The per-row answer, aligned with the INPUT order: the stored row,
+   *  or NULL on the (certificate_id, serial_number) conflict — the
+   *  single verb's honest null, so the route's per-row refusal leg (the
+   *  serial registered between the evaluation and the commit) rides
+   *  unchanged.
+   *
+   *  The ordering contract: the statements ride each batch in input
+   *  order and the chunks issue SERIALLY, so the register's insertion
+   *  order IS the input's row order (the CSV row order; the commit's
+   *  chain events sequence after it, same order). A caller
+   *  parallelizing the call itself forfeits the contract.
+   *
+   *  The failure contract mirrors putEntities: the chunk is the ATOMIC
+   *  unit (a D1 batch is all-or-nothing; the SQLite half wraps each
+   *  chunk in a transaction). A failed chunk lands NOTHING of its rows
+   *  and the call throws — earlier chunks' writes STAND, later chunks
+   *  never issue. An empty rows list resolves to [] without issuing a
+   *  statement. */
+  createInstrumentRegistrations(rows: readonly InstrumentRegistrationWriteInput[]): Promise<(InstrumentRegistration | null)[]>
   /** The lifecycle act (registered ⇄ out_of_service → withdrawn; the
    *  transition RULE is the route's — withdrawn is terminal): stamps
    *  updated_at/by. NULL when the register does not carry the id. */
@@ -2420,13 +2507,21 @@ export interface ServerStore {
    *  acting request's envelope). Answers the stored row (seq + at read
    *  back) off the INSERT's own RETURNING — ONE round trip, never the
    *  INSERT + SELECT-by-id pair. */
-  appendEvent(input: {
-    id: string
-    domain: string
-    entityId: string
-    action: string
-    payload: string
-  }): Promise<PlatformEvent>
+  appendEvent(input: EventWriteInput): Promise<PlatformEvent>
+  /** The BULK append (the 2026-09-07 performance audit's chain half —
+   *  the CSV registration commit's one chain event per imported serial,
+   *  a second serial loop after the register writes): every event lands
+   *  exactly as appendEvent would land it, the rows riding ONE
+   *  db.batch per APPEND_EVENTS_CHUNK rows. Answers the stored rows in
+   *  INPUT order — the seqs strictly increase in it (the statements
+   *  ride each batch in input order, the chunks SERIALLY; the same
+   *  semantic contract as putEntities').
+   *
+   *  The failure contract mirrors putEntities: the chunk is the ATOMIC
+   *  unit; a failed chunk lands NOTHING of its events and the call
+   *  throws — earlier chunks stand, later chunks never issue. An empty
+   *  list resolves to [] without issuing a statement. */
+  appendEvents(events: readonly EventWriteInput[]): Promise<PlatformEvent[]>
   /** The feed's raw leg: events past the cursor, seq-ordered. The
    *  visibility gate is the READER's layer (server/notify-feed.ts) —
    *  never waived here, never duplicated into the SQL. */