@bongos/core 1.17.0

package/scripts/gds/backfill-task-rewards.js

@@ -0,0 +1,408 @@
+#!/usr/bin/env node
+'use strict';
+
+// scripts/gds/backfill-task-rewards.js — retroactive drachmae backfill for
+// shipped tasks that paid 0 reward (task 1672, ADR 0097).
+//
+// THE GAP. A task's `credits_reward` defaults to 0; many early/dev-box/CI ships
+// never had an author-estimated reward set, so the kind-multiplied task-confirm
+// credit (modules/economy/credits.js insertMultipliedConfirmCredit) computed
+// `0 × multiplier = 0` and minted nothing. The cost-plus *session* reward
+// (reason='session.token_reward', ADR 0054) was supposed to backstop those, but
+// it pays ~0 for dev-box/CI agent ships (no priced model usage uploaded), so
+// those builders earned nothing for real shipped work. This script lets an
+// Archon retroactively pay a *fair, reviewed* per-task amount — once, safely.
+//
+// SAFETY MODEL (read before running):
+//   * DRY-RUN BY DEFAULT. With no flags it prints the full plan + grand total
+//     and writes NOTHING. A live mint requires ALL of:
+//       --apply               explicit opt-in to write
+//       Archon rank           verified server-side via GET /api/gds/me; the
+//                             script refuses for any other rank
+//       interactive y/N       a typed confirmation at the terminal (skip only
+//                             with --yes, which an Archon must pass deliberately)
+//   * IDEMPOTENT. Every minted row is keyed on (task_id, reason='reward.backfill').
+//     A re-run SELECTs the existing rows first and skips any task already paid —
+//     so re-running can never double-mint. (A partial-unique DB index would be a
+//     harder backstop; this script's SELECT-then-skip is the application guard,
+//     mirroring maybeAwardIdeaPromotionBonus / awardNetNegativeBonus.)
+//   * COST-PLUS NETTING. For each builder we subtract what the cost-plus stream
+//     (reason='session.token_reward') ALREADY paid for the sessions that shipped
+//     these tasks, so we never double-pay. The dry-run report shows, per builder:
+//     tasks, would-be per-task total (kind-multiplied), cost-plus already paid,
+//     and the net to mint.
+//   * NEVER ACTS ON import/require. All work is inside main(), which only runs
+//     when invoked as a CLI (require.main === module). Importing this file for
+//     its pure helpers (the test does) touches no DB and mints nothing.
+//
+// NOT A MIGRATION. This is a one-time OTB-specific remediation, NOT a
+// migrations/ file — migrations run on every instance (incl. cloudbongos.com),
+// and a fresh instance has no 0-reward backlog to fix. See ADR 0097.
+//
+// USAGE:
+//   node scripts/gds/backfill-task-rewards.js --help
+//   node scripts/gds/backfill-task-rewards.js                 # dry-run (default)
+//   node scripts/gds/backfill-task-rewards.js --rewards rewards.json   # dry-run w/ reviewed mapping
+//   node scripts/gds/backfill-task-rewards.js --rewards rewards.json --apply   # Archon-only live mint
+//
+// REVIEWED MAPPING (--rewards <file.json>): a JSON object { "<taskId>": <rawDrachmae>, ... }
+//   giving the FAIR per-task raw reward an Archon reviewed for each 0-reward task.
+//   This is deliberately a reviewed input, NOT an auto-formula from `estimate`
+//   (that would re-derive the same un-reviewed numbers that caused the gap). A
+//   task absent from the mapping is reported as "unrewarded (no mapping)" and
+//   never minted. A flat default for un-mapped tasks can be supplied with
+//   --default-raw <n> (still requires the task to be in the enumerated set).
+
+const path = require('node:path');
+const fs = require('node:fs');
+const readline = require('node:readline');
+
+// Reuse the REAL reward math (kind multipliers) from the economy module — the
+// same code that pays task.confirmed at ship time. A CLI may require a module
+// directly (the backfill-cost.js / grade-smoke.js precedent).
+const credits = require('../../modules/economy/credits');
+const { arg, hasFlag, cliClient } = require('./cli-lib');
+
+const BACKFILL_REASON = 'reward.backfill';
+const TOKEN_REWARD_REASON = 'session.token_reward';
+
+// =========================================================================
+// PURE LOGIC (exported for tests — no I/O, no DB).
+// =========================================================================
+
+// The idempotency key for a backfill credit_log row. Keying on task_id +
+// reason='reward.backfill' is what makes a re-run a no-op: the apply path
+// SELECTs existing keys first and skips any already present.
+function backfillKey(taskId) {
+  return `${BACKFILL_REASON}:${taskId}`;
+}
+
+// Compute the per-task would-be amount using the REAL kind multiplier. Returns
+// the same shape applyKindMultiplier does plus the task id and the backfill key.
+function computeTaskReward(taskId, rawCredits, kind) {
+  const m = credits.applyKindMultiplier(rawCredits, kind);
+  return {
+    taskId: Number(taskId),
+    kind: m.kind,
+    raw: m.raw,
+    multiplier: m.multiplier,
+    effective: m.effective, // kind-multiplied integer drachmae it WOULD pay
+    description: `backfill: ${m.description} [reward.backfill task #${taskId}]`,
+    key: backfillKey(taskId),
+  };
+}
+
+// Net a builder's would-be task total against the cost-plus stream already paid.
+// `wouldBeTotal` = sum of effective per-task amounts; `costPlusAlreadyPaid` =
+// sum of this builder's session.token_reward deltas for the relevant sessions.
+// Net is floored at 0 — the cost-plus stream having OVER-paid for some sessions
+// never claws back; backfill only ever tops UP toward the fair task total.
+function netForBuilder(wouldBeTotal, costPlusAlreadyPaid) {
+  const want = Math.max(0, Math.round(Number(wouldBeTotal) || 0));
+  const paid = Math.max(0, Math.round(Number(costPlusAlreadyPaid) || 0));
+  return Math.max(0, want - paid);
+}
+
+// Assemble a per-builder plan row from already-computed per-task rewards +
+// the cost-plus already paid + the set of task ids already backfilled. Tasks
+// in `alreadyBackfilled` are excluded from BOTH the mint list and the would-be
+// total (idempotency: an already-paid task contributes nothing to a re-run).
+function planForBuilder(builderId, taskRewards, costPlusAlreadyPaid, alreadyBackfilled = new Set()) {
+  const toMint = [];
+  let wouldBeTotal = 0;
+  let skipped = 0;
+  for (const r of taskRewards) {
+    if (alreadyBackfilled.has(r.taskId)) { skipped++; continue; }
+    if (r.effective <= 0) { continue; } // a 0-mapping pays nothing
+    wouldBeTotal += r.effective;
+    toMint.push(r);
+  }
+  const net = netForBuilder(wouldBeTotal, costPlusAlreadyPaid);
+  return {
+    builderId: Number(builderId),
+    tasks: toMint,
+    skippedAlreadyBackfilled: skipped,
+    wouldBeTotal,
+    costPlusAlreadyPaid: Math.max(0, Math.round(Number(costPlusAlreadyPaid) || 0)),
+    netToMint: net,
+  };
+}
+
+// =========================================================================
+// CLI / DB plumbing (only runs from main()).
+// =========================================================================
+
+function loadPool() {
+  // Lazy + guarded: a builder box has no DATABASE_URL / no peer-auth Postgres,
+  // so --help and --dry-run must not crash here. We only reach for the pool when
+  // we actually need to read/write the DB, and we report a clean message if the
+  // connection is unavailable rather than throwing a raw stack.
+  const REPO_ROOT = path.resolve(__dirname, '..', '..');
+  // eslint-disable-next-line global-require
+  const { pool } = require(path.join(REPO_ROOT, 'src/bongos/pool'));
+  return pool;
+}
+
+function loadRewardMapping() {
+  const file = arg('--rewards');
+  if (!file) return {};
+  const abs = path.resolve(process.cwd(), file);
+  if (!fs.existsSync(abs)) {
+    throw new Error(`--rewards file not found: ${abs}`);
+  }
+  const raw = JSON.parse(fs.readFileSync(abs, 'utf8'));
+  const out = {};
+  for (const [k, v] of Object.entries(raw)) {
+    out[Number(k)] = Number(v);
+  }
+  return out;
+}
+
+function printHelp() {
+  const text = fs.readFileSync(__filename, 'utf8');
+  // Print the leading comment block as the help text.
+  const lines = text.split('\n');
+  const help = [];
+  for (const line of lines) {
+    if (line.startsWith('#!') || line === "'use strict';" || line.trim() === '') {
+      if (help.length) break; else continue;
+    }
+    if (!line.startsWith('//')) break;
+    help.push(line.replace(/^\/\/ ?/, ''));
+  }
+  console.log(help.join('\n'));
+}
+
+async function confirmInteractive(question) {
+  if (hasFlag('--yes')) return true;
+  if (!process.stdin.isTTY) {
+    console.error('Refusing to --apply without a TTY confirmation. Pass --yes only if you are an Archon running this deliberately.');
+    return false;
+  }
+  const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+  const answer = await new Promise((resolve) => rl.question(`${question} [y/N] `, resolve));
+  rl.close();
+  return /^y(es)?$/i.test(answer.trim());
+}
+
+function fmt(rows) {
+  let total = 0;
+  const out = [];
+  out.push('builder   tasks  would-be   cost-plus paid   net to mint   (skipped already-backfilled)');
+  out.push('-------   -----  --------   --------------   -----------   ---------------------------');
+  for (const p of rows) {
+    total += p.netToMint;
+    out.push(
+      `#${String(p.builderId).padEnd(6)} ${String(p.tasks.length).padStart(5)}  ${String(p.wouldBeTotal).padStart(8)}   ${String(p.costPlusAlreadyPaid).padStart(14)}   ${String(p.netToMint).padStart(11)}   ${p.skippedAlreadyBackfilled}`
+    );
+  }
+  out.push('-------   -----  --------   --------------   -----------   ---------------------------');
+  out.push(`GRAND TOTAL net to mint: ${total} drachmae`);
+  return { text: out.join('\n'), total };
+}
+
+// Enumerate shipped 0-reward tasks → per-builder plan. Reads the DB.
+async function buildPlan(pool, mapping, defaultRaw) {
+  // 1. shipped tasks with credits_reward IS NULL OR = 0, with shipper + kind.
+  //    The shipper is the builder who held the claim that shipped it.
+  const { rows: tasks } = await pool.query(
+    `SELECT t.id, t.kind, c.builder_id AS shipper
+       FROM tasks t
+       JOIN LATERAL (
+         SELECT builder_id FROM claims
+          WHERE task_id = t.id AND status = 'shipped'
+          ORDER BY shipped_at DESC NULLS LAST, id DESC
+          LIMIT 1
+       ) c ON true
+      WHERE t.status = 'shipped'
+        AND (t.credits_reward IS NULL OR t.credits_reward = 0)
+      ORDER BY c.builder_id, t.id`
+  );
+
+  // 2. which tasks were ALREADY backfilled (idempotency).
+  const { rows: doneRows } = await pool.query(
+    `SELECT DISTINCT task_id FROM credit_log WHERE reason = $1 AND task_id IS NOT NULL`,
+    [BACKFILL_REASON]
+  );
+  const alreadyBackfilled = new Set(doneRows.map((r) => Number(r.task_id)));
+
+  // 3. cost-plus already paid, per builder. NOTE: session.token_reward rows are
+  //    session-level (task_id NULL), so we net at the BUILDER level — the audit
+  //    question is "did the cost-plus stream already compensate this builder for
+  //    the work these tasks represent". The dry-run surfaces this number so the
+  //    Archon can see whether it actually fired (it pays ~0 for dev-box/CI ships).
+  const { rows: costPlusRows } = await pool.query(
+    `SELECT builder_id, COALESCE(SUM(delta), 0)::int AS paid
+       FROM credit_log
+      WHERE reason = $1
+      GROUP BY builder_id`,
+    [TOKEN_REWARD_REASON]
+  );
+  const costPlusByBuilder = new Map(costPlusRows.map((r) => [Number(r.builder_id), Number(r.paid)]));
+
+  // 4. group tasks by shipper, compute per-task rewards from the REVIEWED mapping.
+  const byBuilder = new Map();
+  const unmapped = [];
+  for (const t of tasks) {
+    const builderId = Number(t.shipper);
+    let raw = mapping[Number(t.id)];
+    if (raw == null) raw = defaultRaw; // may be undefined → unmapped
+    if (raw == null) { unmapped.push(Number(t.id)); continue; }
+    const reward = computeTaskReward(t.id, raw, t.kind);
+    if (!byBuilder.has(builderId)) byBuilder.set(builderId, []);
+    byBuilder.get(builderId).push(reward);
+  }
+
+  const plans = [];
+  for (const [builderId, taskRewards] of byBuilder) {
+    plans.push(planForBuilder(
+      builderId, taskRewards, costPlusByBuilder.get(builderId) || 0, alreadyBackfilled
+    ));
+  }
+  plans.sort((a, b) => a.builderId - b.builderId);
+  return { plans, unmapped, totalCandidates: tasks.length, alreadyBackfilledCount: alreadyBackfilled.size };
+}
+
+async function applyPlan(pool, plans) {
+  const client = await pool.connect();
+  let mintedRows = 0;
+  let mintedDrachmae = 0;
+  try {
+    await client.query('BEGIN');
+    for (const p of plans) {
+      if (p.netToMint <= 0 || p.tasks.length === 0) continue;
+      // Mint per-task rows (so the audit trail attributes each task), but the
+      // SUM across a builder's tasks is capped at netToMint (we don't mint the
+      // cost-plus-already-paid slice). We allocate the net proportionally to the
+      // would-be amounts, with the kind-multiplied per-task description inline.
+      // To keep it simple AND idempotent per task, we mint each task's effective
+      // amount but stop once the running builder total reaches netToMint.
+      let remaining = p.netToMint;
+      for (const r of p.tasks) {
+        if (remaining <= 0) break;
+        // Re-check idempotency at write time inside the tx (a concurrent run
+        // could have inserted between plan-build and now).
+        const { rows: existing } = await client.query(
+          `SELECT 1 FROM credit_log WHERE task_id = $1 AND reason = $2 LIMIT 1`,
+          [r.taskId, BACKFILL_REASON]
+        );
+        if (existing.length > 0) continue;
+        const delta = Math.min(r.effective, remaining);
+        if (delta <= 0) continue;
+        await client.query(
+          `INSERT INTO credit_log (builder_id, task_id, delta, reason, description)
+           VALUES ($1, $2, $3, $4, $5)`,
+          [p.builderId, r.taskId, delta, BACKFILL_REASON,
+            `${r.description} (net-capped ${delta} of ${r.effective}; builder cost-plus already paid ${p.costPlusAlreadyPaid})`]
+        );
+        await client.query(
+          `UPDATE builders SET total_credits = total_credits + $1 WHERE id = $2`,
+          [delta, p.builderId]
+        );
+        remaining -= delta;
+        mintedRows++;
+        mintedDrachmae += delta;
+      }
+    }
+    await client.query('COMMIT');
+  } catch (err) {
+    await client.query('ROLLBACK').catch(() => {});
+    throw err;
+  } finally {
+    client.release();
+  }
+  return { mintedRows, mintedDrachmae };
+}
+
+async function main() {
+  if (hasFlag('--help') || hasFlag('-h')) {
+    printHelp();
+    return;
+  }
+
+  const apply = hasFlag('--apply');
+  const mapping = loadRewardMapping();
+  const defaultRawArg = arg('--default-raw');
+  const defaultRaw = defaultRawArg != null ? Number(defaultRawArg) : undefined;
+
+  let pool;
+  try {
+    pool = loadPool();
+  } catch (err) {
+    console.error('No DB connection available (expected on a builder box with no prod credentials).');
+    console.error('This script is inert here — run --help for usage. Detail:', err.message);
+    process.exit(2);
+  }
+
+  let plan;
+  try {
+    plan = await buildPlan(pool, mapping, defaultRaw);
+  } catch (err) {
+    console.error('Could not read the DB to build the plan (no prod credentials?):', err.message);
+    await pool.end().catch(() => {});
+    process.exit(2);
+  }
+
+  const { plans, unmapped, totalCandidates, alreadyBackfilledCount } = plan;
+
+  console.log(`Shipped 0-reward candidate tasks: ${totalCandidates}`);
+  console.log(`Already backfilled (skipped, idempotent): ${alreadyBackfilledCount}`);
+  if (unmapped.length) {
+    console.log(`Unrewarded (no mapping, never minted): ${unmapped.length} tasks — ${unmapped.slice(0, 20).join(', ')}${unmapped.length > 20 ? ' …' : ''}`);
+  }
+  console.log('');
+  const { text, total } = fmt(plans);
+  console.log(text);
+  console.log('');
+
+  if (!apply) {
+    console.log('DRY-RUN (default). Nothing written. Re-run with --apply (Archon-only) to mint.');
+    await pool.end().catch(() => {});
+    return;
+  }
+
+  // --apply path: verify Archon rank server-side, then confirm interactively.
+  let me;
+  try {
+    const api = await cliClient();
+    me = await api.me.getMe();
+  } catch (err) {
+    console.error('--apply requires a verified Archon session; could not reach /api/gds/me:', err.message);
+    await pool.end().catch(() => {});
+    process.exit(3);
+  }
+  const rank = me && me.data && (me.data.rank || (me.data.builder && me.data.builder.rank));
+  if (rank !== 'archon') {
+    console.error(`--apply is Archon-only. Your rank is '${rank || 'unknown'}'. Refusing to mint.`);
+    await pool.end().catch(() => {});
+    process.exit(3);
+  }
+
+  const ok = await confirmInteractive(`Mint ${total} drachmae across ${plans.length} builder(s)?`);
+  if (!ok) {
+    console.log('Aborted. Nothing written.');
+    await pool.end().catch(() => {});
+    return;
+  }
+
+  const { mintedRows, mintedDrachmae } = await applyPlan(pool, plans);
+  console.log(`Minted ${mintedDrachmae} drachmae across ${mintedRows} credit_log row(s).`);
+  await pool.end().catch(() => {});
+}
+
+// Only run when invoked as a CLI — NEVER on import/require.
+if (require.main === module) {
+  main().catch((err) => {
+    console.error('backfill-task-rewards.js failed:', err);
+    process.exit(1);
+  });
+}
+
+module.exports = {
+  BACKFILL_REASON,
+  TOKEN_REWARD_REASON,
+  backfillKey,
+  computeTaskReward,
+  netForBuilder,
+  planForBuilder,
+};

package/scripts/gds/backup.js

@@ -0,0 +1,94 @@
+#!/usr/bin/env node
+// Check backup status or trigger a fresh local dump.
+//
+// Usage:
+//   node scripts/gds/backup.js             — show latest dump info
+//   node scripts/gds/backup.js --trigger   — fire a fresh dump, then poll until it lands
+//
+// Rank gate: metic+archon.
+
+const { cliClient, requireSession } = require('./cli-lib');
+
+function fmtBytes(n) {
+  if (n == null) return '(unknown size)';
+  if (n < 1024) return `${n} B`;
+  if (n < 1024 * 1024) return `${(n / 1024).toFixed(1)} KB`;
+  return `${(n / (1024 * 1024)).toFixed(1)} MB`;
+}
+
+async function fetchStatus() {
+  const api = await cliClient();
+  const r = await api.backup.getBackupStatus();
+  if (!r.ok) {
+    console.error(`backup status failed (${r.status}):`, r.data);
+    process.exit(1);
+  }
+  return r.data;
+}
+
+function printStatus(data) {
+  const d = data.latest_dump;
+  if (!d) {
+    console.log(`Backup dir: ${data.backup_dir}`);
+    console.log('No dumps found yet.');
+    return;
+  }
+  console.log(`Backup dir:  ${data.backup_dir}`);
+  console.log(`Latest dump: ${d.filename}`);
+  console.log(`  Timestamp: ${d.timestamp}`);
+  console.log(`  Size:      ${fmtBytes(d.size_bytes)}`);
+  console.log(`  Retained:  ${d.count} dump(s)`);
+  if (data.trigger_running) console.log('  ⏳ A backup is currently running.');
+}
+
+async function trigger() {
+  console.log('Requesting fresh backup…');
+  const api = await cliClient();
+  const r = await api.backup.postBackupTrigger();
+  if (r.status === 409) {
+    console.log('A backup is already in progress — polling for it to land…');
+  } else if (!r.ok) {
+    console.error(`trigger failed (${r.status}):`, r.data);
+    process.exit(1);
+  } else {
+    console.log(r.data.message);
+  }
+
+  // Capture the filename of the current latest dump (before the new one lands).
+  const before = await fetchStatus();
+  const beforeFile = before.latest_dump && before.latest_dump.filename;
+
+  // Poll until a newer dump appears (up to ~60 s).
+  const deadline = Date.now() + 60_000;
+  let landed = false;
+  while (Date.now() < deadline) {
+    await new Promise(resolve => setTimeout(resolve, 3_000));
+    const status = await fetchStatus();
+    const nowFile = status.latest_dump && status.latest_dump.filename;
+    if (nowFile && nowFile !== beforeFile) {
+      console.log('\n✅ New dump landed:');
+      printStatus(status);
+      landed = true;
+      break;
+    }
+    process.stdout.write('.');
+  }
+  if (!landed) {
+    console.log('\nTimed out waiting for dump. Check server logs or run again to see status.');
+    process.exit(1);
+  }
+}
+
+(async () => {
+  await requireSession();
+  const args = process.argv.slice(2);
+  if (args.includes('--trigger')) {
+    await trigger();
+  } else {
+    const status = await fetchStatus();
+    printStatus(status);
+  }
+})().catch((err) => {
+  console.error('fatal:', err);
+  process.exit(1);
+});

package/scripts/gds/bfg-principal-token.js

@@ -0,0 +1,65 @@
+#!/usr/bin/env node
+// Mint (or rotate) a session token for the BFG service principal so the 6C.2
+// routine can authenticate AS the principal to call the cross-builder write
+// endpoint (ADR 0026 §6C). Archon-run, on a box with DATABASE_URL (the droplet).
+//
+// Why a dedicated token (not the operator's Archon session): the write endpoint
+// gates on the EXACT principal identity (system_role='bfg'), and an Archon token
+// is deliberately rejected there. So the routine needs the principal's OWN
+// token. This is the one privileged bootstrap; it lives outside any self-serve
+// route (you must have DB access to run it), which is what keeps "an Archon
+// can't act as the BFG" true.
+//
+// The token is written to ~/.config/otb/bfg-principal.json (0600). The routine
+// reads it and sends `Authorization: Bearer <token>`. Re-running mints a fresh
+// token (the old one keeps working until revoked via /auth/revoke); rotate by
+// re-running then revoking the prior session id.
+//
+//   node scripts/gds/bfg-principal-token.js          # mint + write the file
+//   node scripts/gds/bfg-principal-token.js --print  # also echo the token to stdout
+//
+// NOTE: the write path stays DISABLED until BFG_WRITE_ENABLED=true in the
+// server env (the kill-switch, 6C.1) — minting a token does NOT enable writes.
+
+const crypto = require('node:crypto');
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+const { pool } = require('../../src/bongos/pool');
+const { createSession } = require('../../src/bongos/db');
+
+async function main() {
+  const printToken = process.argv.includes('--print');
+  const { rows } = await pool.query(`SELECT id, github_login FROM builders WHERE system_role = 'bfg'`);
+  if (!rows[0]) {
+    console.error("No BFG principal found (system_role='bfg'). Apply migration 065 first, then re-run.");
+    process.exitCode = 1;
+    return;
+  }
+  const principal = rows[0];
+  const token = crypto.randomBytes(32).toString('hex'); // matches the extractToken [a-zA-Z0-9] shape
+  // No-expiry CLI-shaped session (like the operator's CLI token); revocable.
+  await createSession({ builderId: principal.id, token, source: 'cli', userAgent: 'bfg-principal-provision', expiresAt: null });
+
+  const dir = require('../../src/instance-config').configHome();
+  fs.mkdirSync(dir, { recursive: true });
+  const file = path.join(dir, 'bfg-principal.json');
+  fs.writeFileSync(
+    file,
+    JSON.stringify({ token, builder_id: principal.id, github_login: principal.github_login, minted_at: new Date().toISOString() }, null, 2),
+    { mode: 0o600 }
+  );
+  fs.chmodSync(file, 0o600); // ensure 0600 even if the file pre-existed
+
+  console.log(`Minted BFG principal session for builder #${principal.id} (${principal.github_login}).`);
+  console.log(`Wrote ${file} (0600). The 6C.2 routine reads its token from there.`);
+  console.log('Reminder: writes stay OFF until BFG_WRITE_ENABLED=true in the server env (the 6C.1 kill-switch).');
+  if (printToken) console.log(`token: ${token}`);
+}
+
+main()
+  .catch((err) => {
+    console.error('bfg-principal-token failed:', err && err.message ? err.message : err);
+    process.exitCode = 1;
+  })
+  .finally(() => pool.end().catch(() => {}));