@genesislcap/mock-server 15.51.0 → 15.52.0

package/src/db/store.ts

@@ -1,7 +1,8 @@
 // In-memory tables + views + sequence generation. No persistence, no external deps.
 // This is the "database" — disposable and rebuilt from seed data on every server start.
 
-import type { Row, TableDef, ViewDef } from '../types.ts';
+import type { Row, SequenceFormat, TableDef, ViewDef } from '../types.ts';
+import { RECORD_ID, RecordClock, recordKey, TIMESTAMP, withoutRecordFields } from './identity.ts';
 
 type Pk = string;
 
@@ -9,6 +10,7 @@ interface TableConfig {
   pkFields: string[];
   sequencePrefix?: string;
   sequenceWidth: number;
+  sequenceFormat: SequenceFormat;
 }
 
 // Composite keys join the pk fields' values with '|' (so values must not
@@ -16,6 +18,15 @@ interface TableConfig {
 // getRow('TABLE', 'TR001')-style lookups.
 const COMPOSITE_KEY_SEPARATOR = '|';
 
+const MAX_REMOVED_PER_KEY = 16;
+const MAX_REMOVED_KEYS = 10_000;
+
+// IdStrategy.java: a 15-digit counter, the sequence id, the location
+// (DbConfig's default 'LO') and the system id (always 1).
+const GENESIS_SEQUENCE_DIGITS = 15;
+const GENESIS_LOCATION = 'LO';
+const GENESIS_SYSTEM = '1';
+
 function normalizePkFields(pkField: string | string[]): string[] {
   return Array.isArray(pkField) ? pkField : [pkField];
 }
@@ -25,27 +36,75 @@ function keyFor(pkFields: string[], row: Row): Pk {
   return pkFields.map((field) => String(row[field])).join(COMPOSITE_KEY_SEPARATOR);
 }
 
+function escapeRegExp(text: string): string {
+  return text.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
+
+// The counter inside a generated value, or undefined when the value isn't
+// one this table's sequence could have produced.
+function sequenceNumber(config: TableConfig, value: unknown): number | undefined {
+  const prefix = config.sequencePrefix;
+  if (!prefix || typeof value !== 'string') return undefined;
+  const digits =
+    config.sequenceFormat === 'genesis'
+      ? new RegExp(`^(\\d+)${escapeRegExp(prefix)}${GENESIS_LOCATION}${GENESIS_SYSTEM}$`).exec(
+          value,
+        )?.[1]
+      : value.startsWith(prefix)
+        ? value.slice(prefix.length)
+        : undefined;
+  if (digits === undefined) return undefined;
+  const n = parseInt(digits, 10);
+  return Number.isFinite(n) ? n : undefined;
+}
+
+// Counters are shared by tables using the same prefix in the same format.
+function counterKey(config: TableConfig): string {
+  return config.sequenceFormat === 'genesis'
+    ? `${config.sequencePrefix}\u0000genesis`
+    : config.sequencePrefix!;
+}
+
 export class Store {
   private tables = new Map<string, Map<Pk, Row>>();
   private tableConfig = new Map<string, TableConfig>();
   private sequenceCounters = new Map<string, number>();
+  private clock = new RecordClock();
   // Immutable snapshot of each table's rows as registered, used only for field
   // metadata derivation (see getMetadataRows) so deleting every live row can't
   // collapse a resource's schema to zero fields.
   private seedRows = new Map<string, Row[]>();
+  // Per table and key, every record the key lost (deleted, or displaced by
+  // an insert or a key change landing on it) and no broadcast has announced
+  // yet, oldest first — see takeRemovedRows. Bounded: a key keeps its last
+  // MAX_REMOVED_PER_KEY records and a table its last MAX_REMOVED_KEYS keys,
+  // for handlers that delete without ever broadcasting.
+  private removedRows = new Map<string, Map<Pk, Row[]>>();
   readonly views = new Map<string, ViewDef>();
 
   registerTable(
     tableName: string,
-    { pkField, sequencePrefix, sequenceWidth = 3, rows = [] }: TableDef,
+    { pkField, sequencePrefix, sequenceWidth = 3, sequenceFormat = 'prefix', rows = [] }: TableDef,
   ): this {
     const pkFields = normalizePkFields(pkField);
+    const config: TableConfig = { pkFields, sequencePrefix, sequenceWidth, sequenceFormat };
     const table = new Map<Pk, Row>();
+    const seenIds = new Set<string>();
+    let restamped = 0;
     for (const row of rows) {
-      table.set(keyFor(pkFields, row), { ...row });
+      const stamped = this.stampSeedRow({ ...row }, seenIds);
+      if (stamped.restamped) restamped += 1;
+      table.set(keyFor(pkFields, row), stamped.row);
+    }
+    if (restamped > 0) {
+      console.warn(
+        `[mock-server] ${tableName}: re-stamped ${restamped} seed row(s) whose RECORD_ID was ` +
+          'not a safe integer or a string, or repeated another row, so every ROW_REF stays unique',
+      );
     }
     this.tables.set(tableName, table);
-    this.tableConfig.set(tableName, { pkFields, sequencePrefix, sequenceWidth });
+    this.tableConfig.set(tableName, config);
+    this.removedRows.delete(tableName);
     this.seedRows.set(
       tableName,
       rows.map((row) => ({ ...row })),
@@ -55,13 +114,10 @@ export class Store {
     if (sequencePrefix && pkFields.length === 1) {
       let maxN = 0;
       for (const row of rows) {
-        const pk = String(row[pkFields[0]] ?? '');
-        if (pk.startsWith(sequencePrefix)) {
-          const n = parseInt(pk.slice(sequencePrefix.length), 10);
-          if (Number.isFinite(n)) maxN = Math.max(maxN, n);
-        }
+        const n = sequenceNumber(config, row[pkFields[0]]);
+        if (n !== undefined) maxN = Math.max(maxN, n);
       }
-      this.sequenceCounters.set(sequencePrefix, maxN + 1);
+      this.sequenceCounters.set(counterKey(config), maxN + 1);
     }
     return this;
   }
@@ -71,6 +127,54 @@ export class Store {
     return this;
   }
 
+  // Seed rows keep a RECORD_ID they bring (e.g. rows copied from a real
+  // server) when it is usable: a safe integer, or a string, not used by an
+  // earlier seed row. Anything else — a missing id, a number above 2^53 that
+  // JSON.parse already rounded onto its neighbour's, a repeat — gets a fresh
+  // stamp, in seed order, so no two rows share a ROW_REF. A missing or
+  // unusable TIMESTAMP becomes the RECORD_ID.
+  private stampSeedRow(row: Row, seenIds: Set<string>): { row: Row; restamped: boolean } {
+    const given = row[RECORD_ID];
+    const usable = (value: unknown) =>
+      (typeof value === 'number' && Number.isSafeInteger(value)) ||
+      (typeof value === 'string' && value !== '');
+    const missing = given === undefined || given === null;
+    const keep = !missing && usable(given) && !seenIds.has(String(given));
+    if (keep) {
+      this.clock.observe(given);
+    } else {
+      row[RECORD_ID] = this.clock.next();
+    }
+    seenIds.add(String(row[RECORD_ID]));
+    if (!usable(row[TIMESTAMP])) row[TIMESTAMP] = row[RECORD_ID];
+    this.clock.observe(row[TIMESTAMP]);
+    return { row, restamped: !missing && !keep };
+  }
+
+  // A newly inserted row gets RECORD_ID = TIMESTAMP = a fresh stamp, whatever
+  // it was given — as on the real server — appended after its own fields.
+  private stampNewRow(row: Row): Row {
+    delete row[RECORD_ID];
+    delete row[TIMESTAMP];
+    const stamp = this.clock.next();
+    row[RECORD_ID] = stamp;
+    row[TIMESTAMP] = stamp;
+    return row;
+  }
+
+  private noteRemoved(tableName: string, key: Pk, row: Row): void {
+    let removed = this.removedRows.get(tableName);
+    if (!removed) {
+      removed = new Map();
+      this.removedRows.set(tableName, removed);
+    }
+    const records = removed.get(key) ?? [];
+    // Re-set so the key moves to the end: the oldest keys are dropped first.
+    removed.delete(key);
+    removed.set(key, [...records, row].slice(-MAX_REMOVED_PER_KEY));
+    if (removed.size > MAX_REMOVED_KEYS) removed.delete(removed.keys().next().value!);
+  }
+
   // An explicitly-supplied pk inside the sequence's own range must advance the
   // counter too. Without this, inserting e.g. 'TR002' by hand leaves the
   // counter at 2, and the next auto-generated insert mints 'TR002' again and
@@ -78,12 +182,11 @@ export class Store {
   // acks success).
   private observeSequenceValue(config: TableConfig, row: Row): void {
     if (!config.sequencePrefix || config.pkFields.length !== 1) return;
-    const pk = String(row[config.pkFields[0]] ?? '');
-    if (!pk.startsWith(config.sequencePrefix)) return;
-    const n = parseInt(pk.slice(config.sequencePrefix.length), 10);
-    if (!Number.isFinite(n)) return;
-    const next = this.sequenceCounters.get(config.sequencePrefix) ?? 1;
-    if (n + 1 > next) this.sequenceCounters.set(config.sequencePrefix, n + 1);
+    const n = sequenceNumber(config, row[config.pkFields[0]]);
+    if (n === undefined) return;
+    const key = counterKey(config);
+    const next = this.sequenceCounters.get(key) ?? 1;
+    if (n + 1 > next) this.sequenceCounters.set(key, n + 1);
   }
 
   nextSequenceValue(sequencePrefix: string, width: number): string {
@@ -92,6 +195,16 @@ export class Store {
     return `${sequencePrefix}${String(n).padStart(width, '0')}`;
   }
 
+  private generateSequenceValue(config: TableConfig): string {
+    if (config.sequenceFormat !== 'genesis') {
+      return this.nextSequenceValue(config.sequencePrefix!, config.sequenceWidth);
+    }
+    const key = counterKey(config);
+    const n = this.sequenceCounters.get(key) ?? 1;
+    this.sequenceCounters.set(key, n + 1);
+    return `${String(n).padStart(GENESIS_SEQUENCE_DIGITS, '0')}${config.sequencePrefix}${GENESIS_LOCATION}${GENESIS_SYSTEM}`;
+  }
+
   getAllRows(tableName: string): Row[] {
     const table = this.tables.get(tableName);
     if (!table) return [];
@@ -135,6 +248,10 @@ export class Store {
     return rows.find(matchesAllCriteria);
   }
 
+  // Generates a missing (undefined or null) sequence pk and keeps a supplied
+  // one, as GSF does; stamps RECORD_ID/TIMESTAMP. A row already stored under
+  // the same key is replaced (the real database would reject the insert with
+  // DUPLICATE_KEY — check first and throw NackError.duplicateKey for that).
   insertRow(tableName: string, record: Row): Row {
     const table = this.tables.get(tableName);
     const config = this.tableConfig.get(tableName);
@@ -143,10 +260,10 @@ export class Store {
     const row = { ...record };
     if (
       config.pkFields.length === 1 &&
-      row[config.pkFields[0]] === undefined &&
+      (row[config.pkFields[0]] === undefined || row[config.pkFields[0]] === null) &&
       config.sequencePrefix
     ) {
-      row[config.pkFields[0]] = this.nextSequenceValue(config.sequencePrefix, config.sequenceWidth);
+      row[config.pkFields[0]] = this.generateSequenceValue(config);
     }
     const missing = config.pkFields.filter((field) => row[field] === undefined);
     if (missing.length > 0) {
@@ -155,39 +272,78 @@ export class Store {
       );
     }
     this.observeSequenceValue(config, row);
-    table.set(keyFor(config.pkFields, row), row);
+    this.stampNewRow(row);
+    const key = keyFor(config.pkFields, row);
+    const displaced = table.get(key);
+    if (displaced) this.noteRemoved(tableName, key, displaced);
+    table.set(key, row);
     return row;
   }
 
+  // Merges the patch, moves TIMESTAMP on and keeps RECORD_ID (a patch can't
+  // change a row's identity).
   updateRow(tableName: string, pk: Pk, patch: Row): Row | undefined {
     const table = this.tables.get(tableName);
     const config = this.tableConfig.get(tableName);
     if (!table || !config || !table.has(pk)) return undefined;
-    const updated = { ...table.get(pk), ...patch };
+    const existing = table.get(pk)!;
+    const updated = { ...existing, ...patch };
+    updated[RECORD_ID] = existing[RECORD_ID];
+    updated[TIMESTAMP] = this.clock.next();
     // A patch that changes a pk field (e.g. an entity-management form posting
     // its full DETAILS after the user edited the key column) must move the row
     // to its new key. Leaving it under the old one makes the index disagree
     // with the row itself: getRow(newKey) misses, while rowKey()/getRowRef()
     // report the new key, so the matching broadcast finds nothing to push.
     const nextKey = keyFor(config.pkFields, updated);
-    if (nextKey !== pk) table.delete(pk);
+    if (nextKey !== pk) {
+      table.delete(pk);
+      const displaced = table.get(nextKey);
+      if (displaced) this.noteRemoved(tableName, nextKey, displaced);
+    }
     table.set(nextKey, updated);
     return updated;
   }
 
   deleteRow(tableName: string, pk: Pk): boolean {
     const table = this.tables.get(tableName);
-    if (!table) return false;
-    return table.delete(pk);
+    const existing = table?.get(pk);
+    if (!table || !existing) return false;
+    table.delete(pk);
+    this.noteRemoved(tableName, pk, existing);
+    return true;
+  }
+
+  // Reads and clears every record a key lost that no broadcast announced
+  // yet, oldest first: what a DELETE broadcast names (their RECORD_IDs are
+  // the ROW_REFs a client may hold — held-rows tracking drops the ones it
+  // doesn't), including the old record when a key's row was replaced before
+  // one broadcast.
+  takeRemovedRows(tableName: string, key: Pk): Row[] {
+    const removed = this.removedRows.get(tableName);
+    const records = removed?.get(key) ?? [];
+    removed?.delete(key);
+    return records;
+  }
+
+  // The same, for a row of a table or view given by its (base) pk fields —
+  // what a public broadcast(resource, 'DELETE', pkStub) names.
+  takeRemovedRecordsFor(resourceName: string, row: Row): Row[] {
+    const located = this.locateRecord(resourceName, row);
+    return located ? this.takeRemovedRows(located.tableName, located.key) : [];
   }
 
   // Materializes a view: base table left-joined to related tables (optionally
   // narrowed by per-join `where` predicates), minus anti-joined rows, plus
-  // derived fields.
-  getViewRows(viewName: string): Row[] {
+  // derived fields. `tables` substitutes the rows of any table the view reads
+  // (its base or a joined one) — e.g. one base row, to build that row's view
+  // row, or a table's earlier state, to rebuild the view as it was.
+  getViewRows(viewName: string, tables: Record<string, Row[]> = {}): Row[] {
     const view = this.views.get(viewName);
     if (!view) throw new Error(`Unknown view: ${viewName}`);
-    return this.materializeView(view, (tableName) => this.getAllRows(tableName));
+    return this.materializeView(view, (tableName) =>
+      Object.hasOwn(tables, tableName) ? tables[tableName] : this.getAllRows(tableName),
+    );
   }
 
   private materializeView(view: ViewDef, getRows: (tableName: string) => Row[]): Row[] {
@@ -254,12 +410,16 @@ export class Store {
   // deleting a table's last row would make the next metadata reply say the
   // resource has zero fields — which entity-management renders as a form with
   // no inputs and a delete button that can't build a payload, silently.
+  // RECORD_ID and TIMESTAMP are left out: they are not fields a dataserver
+  // row or an event's DETAILS carry.
   getMetadataRows(resourceName: string): Row[] {
     const live = this.getResourceRows(resourceName);
-    if (live.length > 0) return live;
+    if (live.length > 0) return live.map(withoutRecordFields);
     const view = this.views.get(resourceName);
-    if (view) return this.materializeView(view, (tableName) => this.seedRows.get(tableName) ?? []);
-    return this.seedRows.get(resourceName) ?? [];
+    const seed = view
+      ? this.materializeView(view, (tableName) => this.seedRows.get(tableName) ?? [])
+      : (this.seedRows.get(resourceName) ?? []);
+    return seed.map(withoutRecordFields);
   }
 
   // Row-identity fields for a table or view; empty when unknown.
@@ -272,17 +432,50 @@ export class Store {
     return this.tableConfig.get(resourceName)?.pkFields ?? [];
   }
 
-  // The DETAILS.ROW_REF value stamped on QUERY_UPDATE rows (see
-  // protocol/rowUpdate.ts): the pk field's value, or the composite key. The
-  // client's dataServerResultFilter keys inserts/amends/deletes off this.
+  // The pk-based row reference: the pk field's value, or the composite key.
+  // This was DETAILS.ROW_REF up to 15.47 and still is under
+  // fidelity: 'legacy'; by default ROW_REF is getRecordRef's.
   getRowRef(resourceName: string, row: Row): unknown {
     const pkFields = this.getPkFields(resourceName);
     if (pkFields.length === 0) return undefined;
     return keyFor(pkFields, row);
   }
 
+  // The DETAILS.ROW_REF GSF stamps on dataserver rows: the row's RECORD_ID as
+  // a string (GenesisSetMaskingJsonSerializer: value.toString()). A view row
+  // carries its base row's RECORD_ID. A row passed without one (a hand-built
+  // row, or a pk-only stub) is matched to the stored record by its pk — a
+  // just-deleted record included — and only when that fails too does this
+  // fall back to the pk-based reference.
+  getRecordRef(resourceName: string, row: Row): unknown {
+    const id = recordKey(row) ?? recordKey(this.findStoredRecord(resourceName, row));
+    return id ?? this.getRowRef(resourceName, row);
+  }
+
+  private locateRecord(resourceName: string, row: Row): { tableName: string; key: Pk } | undefined {
+    const view = this.views.get(resourceName);
+    const tableName = view ? view.base : resourceName;
+    const pkFields = this.tableConfig.get(tableName)?.pkFields ?? [];
+    if (pkFields.length === 0 || pkFields.some((field) => row[field] === undefined)) {
+      return undefined;
+    }
+    return { tableName, key: keyFor(pkFields, row) };
+  }
+
+  // The stored record a pk-only row names: the live one, else the newest
+  // record removed from that key and not yet broadcast.
+  private findStoredRecord(resourceName: string, row: Row): Row | undefined {
+    const located = this.locateRecord(resourceName, row);
+    if (!located) return undefined;
+    const { tableName, key } = located;
+    return (
+      this.tables.get(tableName)?.get(key) ?? this.removedRows.get(tableName)?.get(key)?.at(-1)
+    );
+  }
+
   // Rebuilds a DELETE stub row carrying the pk field(s) from a stored key, so
   // subscribers can be told which row to drop after it's already gone.
+  // (The DELETE body under fidelity: 'legacy'; GSF sends DETAILS only.)
   rowStubFromKey(resourceName: string, key: Pk): Row {
     const pkFields = this.getPkFields(resourceName);
     if (pkFields.length <= 1) return pkFields.length ? { [pkFields[0]]: key } : {};

package/src/handlers/commitEvent.ts

@@ -1,6 +1,6 @@
 import type { Store } from '../db/store.ts';
 import type { Connection } from '../protocol/connection.ts';
-import { NackError } from '../protocol/errors.ts';
+import { nackPayload, warningPayload } from '../protocol/errors.ts';
 import { isLegacyFidelity } from '../protocol/fidelity.ts';
 import { ERROR_CODE, MESSAGE_TYPE } from '../protocol/messageTypes.ts';
 import { resourceNotMappedNack } from '../protocol/msgNack.ts';
@@ -19,7 +19,8 @@ export interface CommitEventCtx {
 // Commit events (EVENT_<ENTITY>_INSERT/_AMEND/_DELETE, or whatever suffix
 // convention your project uses) are looked up by exact MESSAGE_TYPE against
 // config.eventHandlers. A handler receives (details, ctx) and either returns
-// { generated?: [...] } on success, or throws NackError(errors) on failure.
+// { generated?: [...] } on success, { warnings: [...] } to NACK with warnings
+// only, or throws NackError(errors) on failure.
 export function handleCommitEvent(
   message: GenesisMessage,
   connection: Connection,
@@ -58,17 +59,29 @@ export function handleCommitEvent(
     return;
   }
 
+  // A handler's failure is an EVENT_NACK with GSF's error items (see
+  // protocol/errors.ts): a thrown NackError gives its own, anything else is
+  // StandardError INTERNAL_ERROR. Returned warnings NACK too, with an empty
+  // ERROR — the IGNORE_WARNINGS/VALIDATE flow that would let them through is
+  // not modelled yet.
+  const legacy = isLegacyFidelity(config);
   try {
     const result = handler(message.DETAILS ?? {}, { connection, store, message, ...ctx }) ?? {};
+    if (result.warnings?.length) {
+      connection.reply(message, {
+        MESSAGE_TYPE: MESSAGE_TYPE.EVENT_NACK,
+        ...warningPayload(result.warnings, legacy),
+      });
+      return;
+    }
     connection.reply(message, {
       MESSAGE_TYPE: MESSAGE_TYPE.EVENT_ACK,
       GENERATED: result.generated ?? [],
     });
   } catch (error) {
-    const errors =
-      error instanceof NackError
-        ? error.errors
-        : [{ CODE: ERROR_CODE.VALIDATION_ERROR, TEXT: (error as Error).message }];
-    connection.reply(message, { MESSAGE_TYPE: MESSAGE_TYPE.EVENT_NACK, ERROR: errors });
+    connection.reply(message, {
+      MESSAGE_TYPE: MESSAGE_TYPE.EVENT_NACK,
+      ...nackPayload(error, legacy),
+    });
   }
 }

package/src/handlers/dataLogon.ts

@@ -1,4 +1,7 @@
-import { compileCriteria, filterByCriteria } from '../db/criteria.ts';
+import { compileCriteria, criteriaFields, filterByCriteria } from '../db/criteria.ts';
+import { RECORD_ID } from '../db/identity.ts';
+
+import { queryFieldNames, querySchema } from '../db/schema.ts';
 import type { Store } from '../db/store.ts';
 import type { Connection, Subscription } from '../protocol/connection.ts';
 import { isLegacyFidelity } from '../protocol/fidelity.ts';
@@ -8,9 +11,10 @@ import {
   resourceNotMappedNack,
   subscriptionAlreadyExistsNack,
 } from '../protocol/msgNack.ts';
-import { stampRow } from '../protocol/rowUpdate.ts';
-import type { GenesisMessage, MockServerConfig, Row } from '../types.ts';
-import { applyResourceAuth, requestingUser } from './resourceAuth.ts';
+import { dataserverRow, rowRefFor, stampRow } from '../protocol/rowUpdate.ts';
+
+import type { GenesisMessage, IndexDef, MockServerConfig, QueryDef, Row } from '../types.ts';
+import { permittedQueryRow, requestingUser } from './resourceAuth.ts';
 
 // The real dataserver's defaults (genesis-pal-dataserver ClientOptions,
 // GSF 8.15.x) — also what foundation-comms' DatasourceDefaults send.
@@ -75,6 +79,59 @@ function takePage(subscription: Subscription): Row[] {
   return page;
 }
 
+// The dataserver's own refusal of a logon (genesis-pal-dataserver): a
+// LOGON_NACK with a StandardError, sent instead of LOGON_ACK. No subscription
+// is opened, so a later DATA_LOGOFF on it gets the router's 404.
+function logonNack(code: 'INVALID_CRITERIA' | 'INVALID_INDEX', text: string): Row {
+  return {
+    MESSAGE_TYPE: MESSAGE_TYPE.LOGON_NACK,
+    ERROR: [{ '@type': 'StandardError', CODE: code, TEXT: text, STATUS_CODE: '400 Bad Request' }],
+    WARNING: [],
+  };
+}
+
+// DETAILS.FIELDS: a space-separated projection of the query's columns, in the
+// query's order. Names it doesn't expose are dropped, as the real dataserver
+// drops them.
+function requestedFieldNames(
+  details: Row,
+  query: QueryDef,
+  exposed: string[] | undefined,
+  config: MockServerConfig,
+  store: Store,
+): string[] | undefined {
+  const requested =
+    typeof details.FIELDS === 'string' && details.FIELDS.trim() !== ''
+      ? details.FIELDS.trim().split(/\s+/)
+      : undefined;
+  if (!requested) return exposed;
+  const available = exposed ?? querySchema(query, config, store).fields.map((field) => field.name);
+  return available.filter((name) => requested.includes(name));
+}
+
+// Ascending by the index's fields, nulls first. Ties are broken by RECORD_ID,
+// as the real index breaks them, so REVERSE, which flips the whole order,
+// puts the newest of equal rows first.
+
+function indexComparator(index: IndexDef): (a: Row, b: Row) => number {
+  const compareValues = (a: unknown, b: unknown): number => {
+    if (a === b) return 0;
+    if (a === undefined || a === null) return -1;
+    if (b === undefined || b === null) return 1;
+    if (typeof a === 'number' && typeof b === 'number') return a - b;
+    if (typeof a === 'boolean' && typeof b === 'boolean') return a ? 1 : -1;
+    const [left, right] = [String(a), String(b)];
+    return left < right ? -1 : left > right ? 1 : 0;
+  };
+  return (a, b) => {
+    for (const field of index.fields) {
+      const result = compareValues(a[field], b[field]);
+      if (result !== 0) return result;
+    }
+    return compareValues(a[RECORD_ID], b[RECORD_ID]);
+  };
+}
+
 // DATA_LOGON opens a persistent subscription keyed by SOURCE_REF: reply with
 // LOGON_ACK and the first page of the snapshot, then keep the SOURCE_REF
 // registered so MORE_ROWS can page the rest and later inserts/amends/deletes
@@ -116,6 +173,44 @@ export function handleDataLogon(
 
   const criteria = details.CRITERIA_MATCH;
   const user = requestingUser(connection);
+  // The query's fields block (or the source's declared columns) is all a
+  // criteria may name and all a row carries; DETAILS.FIELDS narrows the rows.
+  // Legacy subscriptions ignore all of it, and ORDER_BY, as 15.47 did.
+  const exposed = queryFieldNames(query, config, store);
+  let compare: ((a: Row, b: Row) => number) | undefined;
+  let reverse = false;
+  if (!legacy) {
+    // The real dataserver lets a criteria read only the query's own fields
+    // (QueryClientFactory.kt). Unknown columns are only checked when the
+    // query's fields are known; an inferred query fails open as before.
+    const outside = exposed && criteriaFields(criteria)?.find((field) => !exposed.includes(field));
+    if (outside) {
+      connection.reply(
+        message,
+        logonNack(
+          'INVALID_CRITERIA',
+          `GenericCriteriaValidationException : Criteria validation failed: Variable ${outside} is not allowed in criteria expression`,
+        ),
+      );
+      return;
+    }
+    // ORDER_BY names one of the query's own indexes (QueryDef.indexes).
+    if (details.ORDER_BY) {
+      const index = query.indexes?.find((candidate) => candidate.name === details.ORDER_BY);
+      if (!index) {
+        connection.reply(
+          message,
+          logonNack(
+            'INVALID_INDEX',
+            `No such index ${details.ORDER_BY} for dataserver query ${resourceName}`,
+          ),
+        );
+        return;
+      }
+      compare = indexComparator(index);
+      reverse = details.REVERSE === true;
+    }
+  }
   // Order matters: the query's own filter (the where-clause equivalent) and
   // the user's row permissioning narrow the set BEFORE the client's
   // CRITERIA_MATCH; hidden fields are stripped last, off the final rows.
@@ -129,20 +224,39 @@ export function handleDataLogon(
   // the count is taken after it — an assumption, as no recording covers it.
   const rowsCount = rows.length;
   rows = filterByCriteria(rows, criteria);
+  if (compare) {
+    rows = [...rows].sort(compare);
+    if (reverse) rows.reverse();
+  }
   // Permissioning is applied per row so the ROW_REF can still be computed from
   // the UNSTRIPPED row — pk fields may themselves be hidden from this user,
   // and a snapshot row with no ROW_REF can never be matched to the later
   // INSERT/MODIFY/DELETE pushes (which stamp the real ref, see server.ts).
+  // RECORD_ID (or, in legacy mode, the pk fields) is never sent unless the
+  // query's fields block names it.
+  const getRowRef = (row: Row) => rowRefFor(config, store, query.source, row);
+
+  const fieldNames = legacy
+    ? undefined
+    : requestedFieldNames(details, query, exposed, config, store);
   const stampedRows: Row[] = [];
+  // Each sent-or-waiting row as stored, by pending key, for ORDER_BY's live
+  // INSERT placement below.
+  const rawRows = new Map<string, Row>();
   for (const row of rows) {
-    const [permitted] = applyResourceAuth([row], query.auth, user);
+    const permitted = permittedQueryRow(row, query.auth, user, fieldNames);
     if (!permitted) continue;
-    stampedRows.push(stampRow(permitted, store.getRowRef(query.source, row), 'INSERT'));
+    const rowRef = getRowRef(row);
+    const key = pendingKey(rowRef);
+    if (key !== undefined) rawRows.set(key, row);
+    stampedRows.push(
+      stampRow(dataserverRow(permitted, row, query.fields), rowRef, 'INSERT', legacy),
+    );
   }
 
   const subscription: Subscription = {
     resourceName,
-    getRowRef: (row) => store.getRowRef(query.source, row),
+    getRowRef,
     predicate: compileCriteria(criteria),
     sequenceId: 1,
   };
@@ -170,7 +284,30 @@ export function handleDataLogon(
     held: new Set<string>(),
     maxRows,
     maxView,
+    fieldNames,
   };
+  // Under ORDER_BY a live INSERT that sorts among the rows still waiting for
+  // MORE_ROWS joins them in order rather than being pushed out of order; one
+  // that sorts before them lands in what the client has, and is pushed. (A
+  // MODIFY of a waiting row keeps its place.)
+  if (compare) {
+    const ascending = compare;
+    const sortCompare = reverse ? (a: Row, b: Row) => ascending(b, a) : ascending;
+    tracked.queueInsert = (key, stamped, row) => {
+      const waiting = [...tracked.pending!];
+      const first = waiting[0] && rawRows.get(waiting[0][0]);
+      if (!first || sortCompare(row, first) < 0) return false;
+      const at = waiting.findIndex(([waitingKey]) => {
+        const other = rawRows.get(waitingKey);
+        return other !== undefined && sortCompare(row, other) < 0;
+      });
+      waiting.splice(at < 0 ? waiting.length : at, 0, [key, stamped]);
+      tracked.pending!.clear();
+      for (const [waitingKey, waitingRow] of waiting) tracked.pending!.set(waitingKey, waitingRow);
+      rawRows.set(key, row);
+      return true;
+    };
+  }
   const firstPage = takePage(tracked);
   const pending = tracked.pending!;
   connection.subscribe(sourceRef, tracked);