@oimlsmart/platform-server

The OIML SMART platform server kernel: the modules the certification platform (github.com/oimlsmart/smart) and the identity service (github.com/oimlsmart/identity) both consume, published once to npm so the two repositories never fork them. The boundary is measured, not aspirational: PROGRESS/41-identity-extraction-map.md §2 in the smart repository. Both consumers pin the published semver line; the version pin IS the contract (TODO.repos/01).

What it is

• store, the ServerStore seam: the interface, every row type, the demo-account plan, installStore/getStore, and StoreUnavailable (the bounded writes' honest timeout error). Worker-safe.
• store/d1, the Cloudflare D1 implementation: every write/batch/DDL statement races a confirmation budget (DEFAULT_STORE_WRITE_BUDGET_MS = 5 s; the consumer's STORE_WRITE_BUDGET_MS env binding retunes it through resolveStoreWriteBudgetMs + the d1StoreFor/D1ServerStore options) — a timeout throws the seam's StoreUnavailable. Reads stay unbounded. Worker-safe.
• store/sqlite, the node implementation (better-sqlite3): the server store composed from the sync modules, the entity-store verbs, the raw driver handle, the schema (SQLITE_SCHEMA_PATH), and the migration set's location (MIGRATIONS_DIR). Node-only.
• migrations/, the canonical D1 migration set. Both deployments point wrangler's migrations_dir at this directory in the consumer's node_modules; the live databases' journals key on the filenames.
• profile, the deployment profile model (hub / IA / TL / identity): parse, resolve, install, the account seed plan. Worker-safe.
• profile/node, the file/env profile loader. Node-only (fs).
• mailer, the transactional mail seam (provider dispatch + the D1 outbox). Worker-safe.
• rbac, the instance's effective role to permission map (installRbacMap / effectiveRbacMap). Worker-safe.
• rbac/node, the map's node carriers (INSTANCE_RBAC_JSON, the profile file's rbac: section). Node-only (fs).
• oidc, the OIDC relying-party client (discovery, PKCE, the code exchange, ID-token validation). Worker-safe.
• github, the GitHub OAuth cone (state sign/verify, the authorized users declaration, the org-membership check). Worker-safe.
• session, the oiml-session cookie seam: SESSION_COOKIE, sessionUser(c), sessionCookieOpts(c). Worker-safe.
• client-info, the request's client context (user agent, IP). Worker-safe.
• vocab, the shared identity vocabulary: the role model, the role to permission map, the action-permission catalog. Isomorphic.

The worker-safe rule, at package granularity: every subpath except store/sqlite, profile/node and rbac/node carries no node built-ins; a Worker bundle never imports the three node subpaths.

The migration contract

migrations/ is the ONE schema-migration set both deployments apply (the smart platform's D1 databases and the identity service's account registry alike):

• Expand-only, filename-keyed. A new schema act appends NNNN_name.sql; existing files never change and never renumber. wrangler records applied filenames in each database's d1_migrations journal, so a rename or an edit would split the live history.
• Duplicate sequence numbers are legal siblings (the wave that landed two stores the same week); apply order is the filename sort.
• test/migrations.test.ts pins the set's end state to src/store/sqlite/schema.sql (table and column sets), so the SQLite DDL and the D1 journal path can never drift apart inside the package.
• Consumers read the set's location from MIGRATIONS_DIR (@oimlsmart/platform-server/store/sqlite); deploy configs point at node_modules/@oimlsmart/platform-server/migrations.

Source-form exports

The package ships its TypeScript sources directly (the @oimlsmart/site-shell pattern, no build step): the consumers' toolchains (vite/astro, tsx, vitest, vue-tsc) compile them in place.

Development

npm ci
npm run typecheck
npm test

Releasing

Trusted publishing rides v* tags on this repository (the .github/workflows/release.yml machinery, npm OIDC, no stored token): bump version in package.json on main (the package-lock.json root fields bump with it), tag v<x.y.z> at the merge commit, push the tag. The workflow runs the gates, refuses a tag that does not equal the package version, and publishes with --provenance. The one-time bootstrap (the manual first publish + the npmjs.com trusted publisher enrollment) is done; the runbook is docs/deployment/npm-releases.md in the smart repository.