@genesislcap/mock-server 15.51.1 → 15.52.0

package/dist/db/store.js

@@ -1,9 +1,17 @@
 // In-memory tables + views + sequence generation. No persistence, no external deps.
 // This is the "database" — disposable and rebuilt from seed data on every server start.
+import { RECORD_ID, RecordClock, recordKey, TIMESTAMP, withoutRecordFields } from "./identity.js";
 // Composite keys join the pk fields' values with '|' (so values must not
 // contain '|'). Single-field keys stay the raw value, preserving
 // getRow('TABLE', 'TR001')-style lookups.
 const COMPOSITE_KEY_SEPARATOR = '|';
+const MAX_REMOVED_PER_KEY = 16;
+const MAX_REMOVED_KEYS = 10_000;
+// IdStrategy.java: a 15-digit counter, the sequence id, the location
+// (DbConfig's default 'LO') and the system id (always 1).
+const GENESIS_SEQUENCE_DIGITS = 15;
+const GENESIS_LOCATION = 'LO';
+const GENESIS_SYSTEM = '1';
 function normalizePkFields(pkField) {
     return Array.isArray(pkField) ? pkField : [pkField];
 }
@@ -12,36 +20,76 @@ function keyFor(pkFields, row) {
         return row[pkFields[0]];
     return pkFields.map((field) => String(row[field])).join(COMPOSITE_KEY_SEPARATOR);
 }
+function escapeRegExp(text) {
+    return text.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
+// The counter inside a generated value, or undefined when the value isn't
+// one this table's sequence could have produced.
+function sequenceNumber(config, value) {
+    const prefix = config.sequencePrefix;
+    if (!prefix || typeof value !== 'string')
+        return undefined;
+    const digits = config.sequenceFormat === 'genesis'
+        ? new RegExp(`^(\\d+)${escapeRegExp(prefix)}${GENESIS_LOCATION}${GENESIS_SYSTEM}$`).exec(value)?.[1]
+        : value.startsWith(prefix)
+            ? value.slice(prefix.length)
+            : undefined;
+    if (digits === undefined)
+        return undefined;
+    const n = parseInt(digits, 10);
+    return Number.isFinite(n) ? n : undefined;
+}
+// Counters are shared by tables using the same prefix in the same format.
+function counterKey(config) {
+    return config.sequenceFormat === 'genesis'
+        ? `${config.sequencePrefix}\u0000genesis`
+        : config.sequencePrefix;
+}
 export class Store {
     tables = new Map();
     tableConfig = new Map();
     sequenceCounters = new Map();
+    clock = new RecordClock();
     // Immutable snapshot of each table's rows as registered, used only for field
     // metadata derivation (see getMetadataRows) so deleting every live row can't
     // collapse a resource's schema to zero fields.
     seedRows = new Map();
+    // Per table and key, every record the key lost (deleted, or displaced by
+    // an insert or a key change landing on it) and no broadcast has announced
+    // yet, oldest first — see takeRemovedRows. Bounded: a key keeps its last
+    // MAX_REMOVED_PER_KEY records and a table its last MAX_REMOVED_KEYS keys,
+    // for handlers that delete without ever broadcasting.
+    removedRows = new Map();
     views = new Map();
-    registerTable(tableName, { pkField, sequencePrefix, sequenceWidth = 3, rows = [] }) {
+    registerTable(tableName, { pkField, sequencePrefix, sequenceWidth = 3, sequenceFormat = 'prefix', rows = [] }) {
         const pkFields = normalizePkFields(pkField);
+        const config = { pkFields, sequencePrefix, sequenceWidth, sequenceFormat };
         const table = new Map();
+        const seenIds = new Set();
+        let restamped = 0;
         for (const row of rows) {
-            table.set(keyFor(pkFields, row), { ...row });
+            const stamped = this.stampSeedRow({ ...row }, seenIds);
+            if (stamped.restamped)
+                restamped += 1;
+            table.set(keyFor(pkFields, row), stamped.row);
+        }
+        if (restamped > 0) {
+            console.warn(`[mock-server] ${tableName}: re-stamped ${restamped} seed row(s) whose RECORD_ID was ` +
+                'not a safe integer or a string, or repeated another row, so every ROW_REF stays unique');
         }
         this.tables.set(tableName, table);
-        this.tableConfig.set(tableName, { pkFields, sequencePrefix, sequenceWidth });
+        this.tableConfig.set(tableName, config);
+        this.removedRows.delete(tableName);
         this.seedRows.set(tableName, rows.map((row) => ({ ...row })));
         // Sequence generation only makes sense for a single-field pk.
         if (sequencePrefix && pkFields.length === 1) {
             let maxN = 0;
             for (const row of rows) {
-                const pk = String(row[pkFields[0]] ?? '');
-                if (pk.startsWith(sequencePrefix)) {
-                    const n = parseInt(pk.slice(sequencePrefix.length), 10);
-                    if (Number.isFinite(n))
-                        maxN = Math.max(maxN, n);
-                }
+                const n = sequenceNumber(config, row[pkFields[0]]);
+                if (n !== undefined)
+                    maxN = Math.max(maxN, n);
             }
-            this.sequenceCounters.set(sequencePrefix, maxN + 1);
+            this.sequenceCounters.set(counterKey(config), maxN + 1);
         }
         return this;
     }
@@ -49,6 +97,53 @@ export class Store {
         this.views.set(viewName, definition);
         return this;
     }
+    // Seed rows keep a RECORD_ID they bring (e.g. rows copied from a real
+    // server) when it is usable: a safe integer, or a string, not used by an
+    // earlier seed row. Anything else — a missing id, a number above 2^53 that
+    // JSON.parse already rounded onto its neighbour's, a repeat — gets a fresh
+    // stamp, in seed order, so no two rows share a ROW_REF. A missing or
+    // unusable TIMESTAMP becomes the RECORD_ID.
+    stampSeedRow(row, seenIds) {
+        const given = row[RECORD_ID];
+        const usable = (value) => (typeof value === 'number' && Number.isSafeInteger(value)) ||
+            (typeof value === 'string' && value !== '');
+        const missing = given === undefined || given === null;
+        const keep = !missing && usable(given) && !seenIds.has(String(given));
+        if (keep) {
+            this.clock.observe(given);
+        }
+        else {
+            row[RECORD_ID] = this.clock.next();
+        }
+        seenIds.add(String(row[RECORD_ID]));
+        if (!usable(row[TIMESTAMP]))
+            row[TIMESTAMP] = row[RECORD_ID];
+        this.clock.observe(row[TIMESTAMP]);
+        return { row, restamped: !missing && !keep };
+    }
+    // A newly inserted row gets RECORD_ID = TIMESTAMP = a fresh stamp, whatever
+    // it was given — as on the real server — appended after its own fields.
+    stampNewRow(row) {
+        delete row[RECORD_ID];
+        delete row[TIMESTAMP];
+        const stamp = this.clock.next();
+        row[RECORD_ID] = stamp;
+        row[TIMESTAMP] = stamp;
+        return row;
+    }
+    noteRemoved(tableName, key, row) {
+        let removed = this.removedRows.get(tableName);
+        if (!removed) {
+            removed = new Map();
+            this.removedRows.set(tableName, removed);
+        }
+        const records = removed.get(key) ?? [];
+        // Re-set so the key moves to the end: the oldest keys are dropped first.
+        removed.delete(key);
+        removed.set(key, [...records, row].slice(-MAX_REMOVED_PER_KEY));
+        if (removed.size > MAX_REMOVED_KEYS)
+            removed.delete(removed.keys().next().value);
+    }
     // An explicitly-supplied pk inside the sequence's own range must advance the
     // counter too. Without this, inserting e.g. 'TR002' by hand leaves the
     // counter at 2, and the next auto-generated insert mints 'TR002' again and
@@ -57,21 +152,28 @@ export class Store {
     observeSequenceValue(config, row) {
         if (!config.sequencePrefix || config.pkFields.length !== 1)
             return;
-        const pk = String(row[config.pkFields[0]] ?? '');
-        if (!pk.startsWith(config.sequencePrefix))
-            return;
-        const n = parseInt(pk.slice(config.sequencePrefix.length), 10);
-        if (!Number.isFinite(n))
+        const n = sequenceNumber(config, row[config.pkFields[0]]);
+        if (n === undefined)
             return;
-        const next = this.sequenceCounters.get(config.sequencePrefix) ?? 1;
+        const key = counterKey(config);
+        const next = this.sequenceCounters.get(key) ?? 1;
         if (n + 1 > next)
-            this.sequenceCounters.set(config.sequencePrefix, n + 1);
+            this.sequenceCounters.set(key, n + 1);
     }
     nextSequenceValue(sequencePrefix, width) {
         const n = this.sequenceCounters.get(sequencePrefix) ?? 1;
         this.sequenceCounters.set(sequencePrefix, n + 1);
         return `${sequencePrefix}${String(n).padStart(width, '0')}`;
     }
+    generateSequenceValue(config) {
+        if (config.sequenceFormat !== 'genesis') {
+            return this.nextSequenceValue(config.sequencePrefix, config.sequenceWidth);
+        }
+        const key = counterKey(config);
+        const n = this.sequenceCounters.get(key) ?? 1;
+        this.sequenceCounters.set(key, n + 1);
+        return `${String(n).padStart(GENESIS_SEQUENCE_DIGITS, '0')}${config.sequencePrefix}${GENESIS_LOCATION}${GENESIS_SYSTEM}`;
+    }
     getAllRows(tableName) {
         const table = this.tables.get(tableName);
         if (!table)
@@ -112,6 +214,10 @@ export class Store {
         }
         return rows.find(matchesAllCriteria);
     }
+    // Generates a missing (undefined or null) sequence pk and keeps a supplied
+    // one, as GSF does; stamps RECORD_ID/TIMESTAMP. A row already stored under
+    // the same key is replaced (the real database would reject the insert with
+    // DUPLICATE_KEY — check first and throw NackError.duplicateKey for that).
     insertRow(tableName, record) {
         const table = this.tables.get(tableName);
         const config = this.tableConfig.get(tableName);
@@ -119,49 +225,85 @@ export class Store {
             throw new Error(`Unknown table: ${tableName}`);
         const row = { ...record };
         if (config.pkFields.length === 1 &&
-            row[config.pkFields[0]] === undefined &&
+            (row[config.pkFields[0]] === undefined || row[config.pkFields[0]] === null) &&
             config.sequencePrefix) {
-            row[config.pkFields[0]] = this.nextSequenceValue(config.sequencePrefix, config.sequenceWidth);
+            row[config.pkFields[0]] = this.generateSequenceValue(config);
         }
         const missing = config.pkFields.filter((field) => row[field] === undefined);
         if (missing.length > 0) {
             throw new Error(`Primary key field(s) '${missing.join("', '")}' are required for inserting into table '${tableName}'`);
         }
         this.observeSequenceValue(config, row);
-        table.set(keyFor(config.pkFields, row), row);
+        this.stampNewRow(row);
+        const key = keyFor(config.pkFields, row);
+        const displaced = table.get(key);
+        if (displaced)
+            this.noteRemoved(tableName, key, displaced);
+        table.set(key, row);
         return row;
     }
+    // Merges the patch, moves TIMESTAMP on and keeps RECORD_ID (a patch can't
+    // change a row's identity).
     updateRow(tableName, pk, patch) {
         const table = this.tables.get(tableName);
         const config = this.tableConfig.get(tableName);
         if (!table || !config || !table.has(pk))
             return undefined;
-        const updated = { ...table.get(pk), ...patch };
+        const existing = table.get(pk);
+        const updated = { ...existing, ...patch };
+        updated[RECORD_ID] = existing[RECORD_ID];
+        updated[TIMESTAMP] = this.clock.next();
         // A patch that changes a pk field (e.g. an entity-management form posting
         // its full DETAILS after the user edited the key column) must move the row
         // to its new key. Leaving it under the old one makes the index disagree
         // with the row itself: getRow(newKey) misses, while rowKey()/getRowRef()
         // report the new key, so the matching broadcast finds nothing to push.
         const nextKey = keyFor(config.pkFields, updated);
-        if (nextKey !== pk)
+        if (nextKey !== pk) {
             table.delete(pk);
+            const displaced = table.get(nextKey);
+            if (displaced)
+                this.noteRemoved(tableName, nextKey, displaced);
+        }
         table.set(nextKey, updated);
         return updated;
     }
     deleteRow(tableName, pk) {
         const table = this.tables.get(tableName);
-        if (!table)
+        const existing = table?.get(pk);
+        if (!table || !existing)
             return false;
-        return table.delete(pk);
+        table.delete(pk);
+        this.noteRemoved(tableName, pk, existing);
+        return true;
+    }
+    // Reads and clears every record a key lost that no broadcast announced
+    // yet, oldest first: what a DELETE broadcast names (their RECORD_IDs are
+    // the ROW_REFs a client may hold — held-rows tracking drops the ones it
+    // doesn't), including the old record when a key's row was replaced before
+    // one broadcast.
+    takeRemovedRows(tableName, key) {
+        const removed = this.removedRows.get(tableName);
+        const records = removed?.get(key) ?? [];
+        removed?.delete(key);
+        return records;
+    }
+    // The same, for a row of a table or view given by its (base) pk fields —
+    // what a public broadcast(resource, 'DELETE', pkStub) names.
+    takeRemovedRecordsFor(resourceName, row) {
+        const located = this.locateRecord(resourceName, row);
+        return located ? this.takeRemovedRows(located.tableName, located.key) : [];
     }
     // Materializes a view: base table left-joined to related tables (optionally
     // narrowed by per-join `where` predicates), minus anti-joined rows, plus
-    // derived fields.
-    getViewRows(viewName) {
+    // derived fields. `tables` substitutes the rows of any table the view reads
+    // (its base or a joined one) — e.g. one base row, to build that row's view
+    // row, or a table's earlier state, to rebuild the view as it was.
+    getViewRows(viewName, tables = {}) {
         const view = this.views.get(viewName);
         if (!view)
             throw new Error(`Unknown view: ${viewName}`);
-        return this.materializeView(view, (tableName) => this.getAllRows(tableName));
+        return this.materializeView(view, (tableName) => Object.hasOwn(tables, tableName) ? tables[tableName] : this.getAllRows(tableName));
     }
     materializeView(view, getRows) {
         let rows = getRows(view.base).map((row) => ({ ...row }));
@@ -214,14 +356,17 @@ export class Store {
     // deleting a table's last row would make the next metadata reply say the
     // resource has zero fields — which entity-management renders as a form with
     // no inputs and a delete button that can't build a payload, silently.
+    // RECORD_ID and TIMESTAMP are left out: they are not fields a dataserver
+    // row or an event's DETAILS carry.
     getMetadataRows(resourceName) {
         const live = this.getResourceRows(resourceName);
         if (live.length > 0)
-            return live;
+            return live.map(withoutRecordFields);
         const view = this.views.get(resourceName);
-        if (view)
-            return this.materializeView(view, (tableName) => this.seedRows.get(tableName) ?? []);
-        return this.seedRows.get(resourceName) ?? [];
+        const seed = view
+            ? this.materializeView(view, (tableName) => this.seedRows.get(tableName) ?? [])
+            : (this.seedRows.get(resourceName) ?? []);
+        return seed.map(withoutRecordFields);
     }
     // Row-identity fields for a table or view; empty when unknown.
     getPkFields(resourceName) {
@@ -233,17 +378,46 @@ export class Store {
         }
         return this.tableConfig.get(resourceName)?.pkFields ?? [];
     }
-    // The DETAILS.ROW_REF value stamped on QUERY_UPDATE rows (see
-    // protocol/rowUpdate.ts): the pk field's value, or the composite key. The
-    // client's dataServerResultFilter keys inserts/amends/deletes off this.
+    // The pk-based row reference: the pk field's value, or the composite key.
+    // This was DETAILS.ROW_REF up to 15.47 and still is under
+    // fidelity: 'legacy'; by default ROW_REF is getRecordRef's.
     getRowRef(resourceName, row) {
         const pkFields = this.getPkFields(resourceName);
         if (pkFields.length === 0)
             return undefined;
         return keyFor(pkFields, row);
     }
+    // The DETAILS.ROW_REF GSF stamps on dataserver rows: the row's RECORD_ID as
+    // a string (GenesisSetMaskingJsonSerializer: value.toString()). A view row
+    // carries its base row's RECORD_ID. A row passed without one (a hand-built
+    // row, or a pk-only stub) is matched to the stored record by its pk — a
+    // just-deleted record included — and only when that fails too does this
+    // fall back to the pk-based reference.
+    getRecordRef(resourceName, row) {
+        const id = recordKey(row) ?? recordKey(this.findStoredRecord(resourceName, row));
+        return id ?? this.getRowRef(resourceName, row);
+    }
+    locateRecord(resourceName, row) {
+        const view = this.views.get(resourceName);
+        const tableName = view ? view.base : resourceName;
+        const pkFields = this.tableConfig.get(tableName)?.pkFields ?? [];
+        if (pkFields.length === 0 || pkFields.some((field) => row[field] === undefined)) {
+            return undefined;
+        }
+        return { tableName, key: keyFor(pkFields, row) };
+    }
+    // The stored record a pk-only row names: the live one, else the newest
+    // record removed from that key and not yet broadcast.
+    findStoredRecord(resourceName, row) {
+        const located = this.locateRecord(resourceName, row);
+        if (!located)
+            return undefined;
+        const { tableName, key } = located;
+        return (this.tables.get(tableName)?.get(key) ?? this.removedRows.get(tableName)?.get(key)?.at(-1));
+    }
     // Rebuilds a DELETE stub row carrying the pk field(s) from a stored key, so
     // subscribers can be told which row to drop after it's already gone.
+    // (The DELETE body under fidelity: 'legacy'; GSF sends DETAILS only.)
     rowStubFromKey(resourceName, key) {
         const pkFields = this.getPkFields(resourceName);
         if (pkFields.length <= 1)

package/dist/handlers/commitEvent.js

@@ -1,11 +1,12 @@
-import { NackError } from "../protocol/errors.js";
+import { nackPayload, warningPayload } from "../protocol/errors.js";
 import { isLegacyFidelity } from "../protocol/fidelity.js";
 import { ERROR_CODE, MESSAGE_TYPE } from "../protocol/messageTypes.js";
 import { resourceNotMappedNack } from "../protocol/msgNack.js";
 // Commit events (EVENT_<ENTITY>_INSERT/_AMEND/_DELETE, or whatever suffix
 // convention your project uses) are looked up by exact MESSAGE_TYPE against
 // config.eventHandlers. A handler receives (details, ctx) and either returns
-// { generated?: [...] } on success, or throws NackError(errors) on failure.
+// { generated?: [...] } on success, { warnings: [...] } to NACK with warnings
+// only, or throws NackError(errors) on failure.
 export function handleCommitEvent(message, connection, config, store, ctx) {
     const eventName = message.MESSAGE_TYPE;
     // defaultEventHandler catches anything unregistered — lets projects with
@@ -33,17 +34,30 @@ export function handleCommitEvent(message, connection, config, store, ctx) {
             : resourceNotMappedNack(eventName));
         return;
     }
+    // A handler's failure is an EVENT_NACK with GSF's error items (see
+    // protocol/errors.ts): a thrown NackError gives its own, anything else is
+    // StandardError INTERNAL_ERROR. Returned warnings NACK too, with an empty
+    // ERROR — the IGNORE_WARNINGS/VALIDATE flow that would let them through is
+    // not modelled yet.
+    const legacy = isLegacyFidelity(config);
     try {
         const result = handler(message.DETAILS ?? {}, { connection, store, message, ...ctx }) ?? {};
+        if (result.warnings?.length) {
+            connection.reply(message, {
+                MESSAGE_TYPE: MESSAGE_TYPE.EVENT_NACK,
+                ...warningPayload(result.warnings, legacy),
+            });
+            return;
+        }
         connection.reply(message, {
             MESSAGE_TYPE: MESSAGE_TYPE.EVENT_ACK,
             GENERATED: result.generated ?? [],
         });
     }
     catch (error) {
-        const errors = error instanceof NackError
-            ? error.errors
-            : [{ CODE: ERROR_CODE.VALIDATION_ERROR, TEXT: error.message }];
-        connection.reply(message, { MESSAGE_TYPE: MESSAGE_TYPE.EVENT_NACK, ERROR: errors });
+        connection.reply(message, {
+            MESSAGE_TYPE: MESSAGE_TYPE.EVENT_NACK,
+            ...nackPayload(error, legacy),
+        });
     }
 }

package/dist/handlers/dataLogon.js

@@ -1,9 +1,11 @@
-import { compileCriteria, filterByCriteria } from "../db/criteria.js";
+import { compileCriteria, criteriaFields, filterByCriteria } from "../db/criteria.js";
+import { RECORD_ID } from "../db/identity.js";
+import { queryFieldNames, querySchema } from "../db/schema.js";
 import { isLegacyFidelity } from "../protocol/fidelity.js";
 import { MESSAGE_TYPE, ERROR_CODE } from "../protocol/messageTypes.js";
 import { nonExistentSubscriptionNack, resourceNotMappedNack, subscriptionAlreadyExistsNack, } from "../protocol/msgNack.js";
-import { stampRow } from "../protocol/rowUpdate.js";
-import { applyResourceAuth, requestingUser } from "./resourceAuth.js";
+import { dataserverRow, rowRefFor, stampRow } from "../protocol/rowUpdate.js";
+import { permittedQueryRow, requestingUser } from "./resourceAuth.js";
 // The real dataserver's defaults (genesis-pal-dataserver ClientOptions,
 // GSF 8.15.x) — also what foundation-comms' DatasourceDefaults send.
 const DEFAULT_MAX_ROWS = 250;
@@ -57,6 +59,55 @@ function takePage(subscription) {
     }
     return page;
 }
+// The dataserver's own refusal of a logon (genesis-pal-dataserver): a
+// LOGON_NACK with a StandardError, sent instead of LOGON_ACK. No subscription
+// is opened, so a later DATA_LOGOFF on it gets the router's 404.
+function logonNack(code, text) {
+    return {
+        MESSAGE_TYPE: MESSAGE_TYPE.LOGON_NACK,
+        ERROR: [{ '@type': 'StandardError', CODE: code, TEXT: text, STATUS_CODE: '400 Bad Request' }],
+        WARNING: [],
+    };
+}
+// DETAILS.FIELDS: a space-separated projection of the query's columns, in the
+// query's order. Names it doesn't expose are dropped, as the real dataserver
+// drops them.
+function requestedFieldNames(details, query, exposed, config, store) {
+    const requested = typeof details.FIELDS === 'string' && details.FIELDS.trim() !== ''
+        ? details.FIELDS.trim().split(/\s+/)
+        : undefined;
+    if (!requested)
+        return exposed;
+    const available = exposed ?? querySchema(query, config, store).fields.map((field) => field.name);
+    return available.filter((name) => requested.includes(name));
+}
+// Ascending by the index's fields, nulls first. Ties are broken by RECORD_ID,
+// as the real index breaks them, so REVERSE, which flips the whole order,
+// puts the newest of equal rows first.
+function indexComparator(index) {
+    const compareValues = (a, b) => {
+        if (a === b)
+            return 0;
+        if (a === undefined || a === null)
+            return -1;
+        if (b === undefined || b === null)
+            return 1;
+        if (typeof a === 'number' && typeof b === 'number')
+            return a - b;
+        if (typeof a === 'boolean' && typeof b === 'boolean')
+            return a ? 1 : -1;
+        const [left, right] = [String(a), String(b)];
+        return left < right ? -1 : left > right ? 1 : 0;
+    };
+    return (a, b) => {
+        for (const field of index.fields) {
+            const result = compareValues(a[field], b[field]);
+            if (result !== 0)
+                return result;
+        }
+        return compareValues(a[RECORD_ID], b[RECORD_ID]);
+    };
+}
 // DATA_LOGON opens a persistent subscription keyed by SOURCE_REF: reply with
 // LOGON_ACK and the first page of the snapshot, then keep the SOURCE_REF
 // registered so MORE_ROWS can page the rest and later inserts/amends/deletes
@@ -87,6 +138,32 @@ export function handleDataLogon(message, connection, config, store) {
     }
     const criteria = details.CRITERIA_MATCH;
     const user = requestingUser(connection);
+    // The query's fields block (or the source's declared columns) is all a
+    // criteria may name and all a row carries; DETAILS.FIELDS narrows the rows.
+    // Legacy subscriptions ignore all of it, and ORDER_BY, as 15.47 did.
+    const exposed = queryFieldNames(query, config, store);
+    let compare;
+    let reverse = false;
+    if (!legacy) {
+        // The real dataserver lets a criteria read only the query's own fields
+        // (QueryClientFactory.kt). Unknown columns are only checked when the
+        // query's fields are known; an inferred query fails open as before.
+        const outside = exposed && criteriaFields(criteria)?.find((field) => !exposed.includes(field));
+        if (outside) {
+            connection.reply(message, logonNack('INVALID_CRITERIA', `GenericCriteriaValidationException : Criteria validation failed: Variable ${outside} is not allowed in criteria expression`));
+            return;
+        }
+        // ORDER_BY names one of the query's own indexes (QueryDef.indexes).
+        if (details.ORDER_BY) {
+            const index = query.indexes?.find((candidate) => candidate.name === details.ORDER_BY);
+            if (!index) {
+                connection.reply(message, logonNack('INVALID_INDEX', `No such index ${details.ORDER_BY} for dataserver query ${resourceName}`));
+                return;
+            }
+            compare = indexComparator(index);
+            reverse = details.REVERSE === true;
+        }
+    }
     // Order matters: the query's own filter (the where-clause equivalent) and
     // the user's row permissioning narrow the set BEFORE the client's
     // CRITERIA_MATCH; hidden fields are stripped last, off the final rows.
@@ -101,20 +178,38 @@ export function handleDataLogon(message, connection, config, store) {
     // the count is taken after it — an assumption, as no recording covers it.
     const rowsCount = rows.length;
     rows = filterByCriteria(rows, criteria);
+    if (compare) {
+        rows = [...rows].sort(compare);
+        if (reverse)
+            rows.reverse();
+    }
     // Permissioning is applied per row so the ROW_REF can still be computed from
     // the UNSTRIPPED row — pk fields may themselves be hidden from this user,
     // and a snapshot row with no ROW_REF can never be matched to the later
     // INSERT/MODIFY/DELETE pushes (which stamp the real ref, see server.ts).
+    // RECORD_ID (or, in legacy mode, the pk fields) is never sent unless the
+    // query's fields block names it.
+    const getRowRef = (row) => rowRefFor(config, store, query.source, row);
+    const fieldNames = legacy
+        ? undefined
+        : requestedFieldNames(details, query, exposed, config, store);
     const stampedRows = [];
+    // Each sent-or-waiting row as stored, by pending key, for ORDER_BY's live
+    // INSERT placement below.
+    const rawRows = new Map();
     for (const row of rows) {
-        const [permitted] = applyResourceAuth([row], query.auth, user);
+        const permitted = permittedQueryRow(row, query.auth, user, fieldNames);
         if (!permitted)
             continue;
-        stampedRows.push(stampRow(permitted, store.getRowRef(query.source, row), 'INSERT'));
+        const rowRef = getRowRef(row);
+        const key = pendingKey(rowRef);
+        if (key !== undefined)
+            rawRows.set(key, row);
+        stampedRows.push(stampRow(dataserverRow(permitted, row, query.fields), rowRef, 'INSERT', legacy));
     }
     const subscription = {
         resourceName,
-        getRowRef: (row) => store.getRowRef(query.source, row),
+        getRowRef,
         predicate: compileCriteria(criteria),
         sequenceId: 1,
     };
@@ -140,7 +235,32 @@ export function handleDataLogon(message, connection, config, store) {
         held: new Set(),
         maxRows,
         maxView,
+        fieldNames,
     };
+    // Under ORDER_BY a live INSERT that sorts among the rows still waiting for
+    // MORE_ROWS joins them in order rather than being pushed out of order; one
+    // that sorts before them lands in what the client has, and is pushed. (A
+    // MODIFY of a waiting row keeps its place.)
+    if (compare) {
+        const ascending = compare;
+        const sortCompare = reverse ? (a, b) => ascending(b, a) : ascending;
+        tracked.queueInsert = (key, stamped, row) => {
+            const waiting = [...tracked.pending];
+            const first = waiting[0] && rawRows.get(waiting[0][0]);
+            if (!first || sortCompare(row, first) < 0)
+                return false;
+            const at = waiting.findIndex(([waitingKey]) => {
+                const other = rawRows.get(waitingKey);
+                return other !== undefined && sortCompare(row, other) < 0;
+            });
+            waiting.splice(at < 0 ? waiting.length : at, 0, [key, stamped]);
+            tracked.pending.clear();
+            for (const [waitingKey, waitingRow] of waiting)
+                tracked.pending.set(waitingKey, waitingRow);
+            rawRows.set(key, row);
+            return true;
+        };
+    }
     const firstPage = takePage(tracked);
     const pending = tracked.pending;
     connection.subscribe(sourceRef, tracked);

package/dist/handlers/jsonSchema.d.ts

@@ -1,5 +1,6 @@
+import { inferEventTable } from '../db/schema.ts';
 import type { Store } from '../db/store.ts';
 import type { Connection } from '../protocol/connection.ts';
 import type { GenesisMessage, MockServerConfig } from '../types.ts';
-export declare function inferEventTable(eventName: string | undefined, tableNames: string[]): string | undefined;
+export { inferEventTable };
 export declare function handleJsonSchemaRequest(message: GenesisMessage, connection: Connection, config: MockServerConfig, store: Store): void;