biz-a-cli 2.3.80-15326 → 2.3.80-15333

package/bin/app.js

@@ -36,8 +36,11 @@ import {
 import {
 	isPostgresIndex,
 	execPostgres,
+	execPostgresStatements,
 	primeRegistry,
 } from "../engine/domain/dialect.js";
+
+import { translateExecuteBlock } from "../engine/orm/executeBlock.js";
 import { addUser } from "../engine/orm/userAdmin.js";
 import {
 	preservePublishedAdditions,

package/bin/directHubEvent.js

@@ -125,10 +125,11 @@ export function createSocketServer(httpServer, cliIpAddress = "127.0.0.1") {
 				TEST_URL,
 				ADMIN_URL,
 				TEST_ADMIN_URL,
-				// Retired biz-a.id origins. Kept here, commented, in case the domain is used
-				// again — uncomment these, but NOT the wildcard (see above).
-				// "https://biz-a.id",
-				// "https://test.biz-a.id",
+				// biz-a.id is still served alongside biz-a.app, so its browser origins stay allowed.
+				"https://biz-a.id",
+				"https://test.biz-a.id",
+				"https://admin.biz-a.id",
+				// NOT the wildcard (see above):
 				// /\.biz-a\.id$/,
 				"vscode-file://vscode-app",
 				/\.vscode-cdn\.net$/,

package/engine/domain/appConfig.js

@@ -2781,6 +2781,11 @@ const loadDdlHashes = async (domainName, domainVersion, config) => {
 	}
 };
 
+/* Exported so a publish can store a config row it has just rewritten -- currently the navigation a
+   domain contributed (Dok. 5 section 3.3). Same dialect-aware path every other config write uses. */
+export const saveConfigRow = (name, version, content, config) =>
+	upsertConfigRow(name, version, content, config);
+
 const writeDdlHashes = async (domainName, domainVersion, tables, config) => {
 	const { name, version } = buildDdlHashConfigKey(domainName, domainVersion);
 	const payload = JSON.stringify({ tables });

package/engine/domain/applicationConfig.js

@@ -5,7 +5,12 @@ import {
 	resolveConfigFromPayload,
 	buildPublishStatusConfigKey,
 	writePublishStatus,
+	saveConfigRow,
 } from "./appConfig.js";
+import { execPostgres } from "./dialect.js";
+/* Dok. 5 section 3.3 -- a Layer 3 domain contributing its own menus, gated by its own activation
+   setting. Read generically: no domain name and no domain code appear in this file. */
+import { mergeDomainNavigation, selectActiveDomainMenus, readActiveModules } from "./domainNavigation.js";
 
 export const parseConfigData = (rawConfig) => {
 	if (rawConfig == null) {
@@ -628,7 +633,7 @@ export const publishApplicationConfig = async (payload = {}, argv = {}) => {
 	if (!appRow?.data) {
 		throw new Error(`SYS$CONFIG record ${applicationConfigName}@${applicationConfigVersion} was not found.`);
 	}
-	const parsedApplicationConfig = parseConfigData(appRow.data) ?? {};
+	let parsedApplicationConfig = parseConfigData(appRow.data) ?? {};
 
 	/* An app bundle publish is a full replace (addApp() rebuilds the whole bundle from scratch every call), so
 	   template.js scaffolding must be generated for EVERY domain registered in application.js's `domains` map, not
@@ -653,6 +658,10 @@ export const publishApplicationConfig = async (payload = {}, argv = {}) => {
 	}
 
 	const mergedFileList = [];
+	/* domainKey -> the menu entries that domain contributes this publish (§3.3). */
+	const domainNavigation = new Map();
+	/* Parsed once in the collect pass, reused in the build pass. */
+	const scannedDomains = [];
 	const seenFileNames = new Set();
 	const addFilesToMergedList = (fileList) => {
 		for (const file of fileList) {
@@ -667,10 +676,61 @@ export const publishApplicationConfig = async (payload = {}, argv = {}) => {
 	if (domainsToScan.size === 0) {
 		addFilesToMergedList(buildPublishBodyFromConfigs(parsedApplicationConfig, {}, "").fileList);
 	} else {
+		/*
+		 * ⚠️ TWO PASSES, AND THE ORDER IS THE WHOLE POINT. The menu the CLIENT reads is generated
+		 * INTO THE BUNDLE by buildPublishBodyFromConfigs, so any domain menu folded in after that is a
+		 * publish behind — the row is right and the screen still has no way to be reached. Found live:
+		 * `hr: 2` in the log, `HR_ROSTER` in APPLICATION_CONFIG, and no such item in the menu.
+		 *
+		 * So: collect first, merge, then build the files from the MERGED navigation. The template a
+		 * leaf points at is generated in this same bundle, so a link can never outrun its screen.
+		 */
 		for (const [domainKey, { domainConfigName, domainConfigVersion }] of domainsToScan) {
 			const domainRows = await readConfigRows(domainConfigName, domainConfigVersion, config);
 			const domainRow = domainRows?.[0];
 			const parsedDomainConfig = domainRow?.data ? (parseConfigData(domainRow.data) ?? {}) : {};
+			scannedDomains.push([domainKey, parsedDomainConfig]);
+
+			/*
+			 * Dok. 5 §3.3 / §4.2 — a Layer 3 domain contributing its OWN menus, gated by its own
+			 * activation setting. Without this a domain could declare screens and still have no way to
+			 * be reached, and the activation setting drove nothing.
+			 *
+			 * ⚠️ READ, NEVER EXECUTED. The activating set lives in the domain's table, which this file
+			 * must not know about — so the domain NAMES the table and column and the read is generic.
+			 * No domain name and no domain code appear here, which is what keeps the golden rule.
+			 *
+			 * ⚠️ Fails SOFT: a domain that declares nothing, or whose setting cannot be read, simply
+			 * contributes nothing. A publish must not fail because one domain's settings row is bad.
+			 */
+			const declaredMenus = parsedDomainConfig?.navigation?.menus;
+			if (Array.isArray(declaredMenus) && declaredMenus.length > 0) {
+				try {
+					const activeModules = await readActiveModules({
+						activation: parsedDomainConfig?.navigation?.activation,
+						exec: execPostgres,
+						dbIndex: Number(config?.dbindex ?? config?.dbIndex),
+					});
+					domainNavigation.set(domainKey, selectActiveDomainMenus({ menus: declaredMenus, activeModules }));
+				} catch (error) {
+					logger.warn(
+						`[navigation] ${domainKey}: could not resolve its menus, so it contributes none: ` +
+							`${error?.message ?? error}`,
+					);
+				}
+			}
+		}
+
+		/* Fold the domains' menus in BEFORE the bundle is built from this config. */
+		if (domainNavigation.size > 0) {
+			let navigation = parsedApplicationConfig?.navigation ?? {};
+			for (const [domainKey, menus] of domainNavigation) {
+				navigation = mergeDomainNavigation({ applicationConfig: { navigation }, domainKey, menus });
+			}
+			parsedApplicationConfig = { ...parsedApplicationConfig, navigation };
+		}
+
+		for (const [domainKey, parsedDomainConfig] of scannedDomains) {
 			addFilesToMergedList(buildPublishBodyFromConfigs(parsedApplicationConfig, parsedDomainConfig, domainKey).fileList);
 		}
 	}
@@ -687,6 +747,35 @@ export const publishApplicationConfig = async (payload = {}, argv = {}) => {
 	if (!response || response.success !== true) {
 		throw new Error(response?.error ? String(response.error) : "Application Config publish failed without an error message from the server.");
 	}
+
+	/*
+	 * ⚠️ AFTER the bundle publish, not before: a domain's leaf must not appear in the menu until the
+	 * screen it opens is actually in the bundle. The other order produces a dead link for exactly as
+	 * long as a publish takes, and permanently if the publish then fails.
+	 *
+	 * ⚠️ And the merge is additive + self-healing per domain (see domainNavigation.js), because
+	 * APPLICATION_CONFIG has more than one writer and a wholesale replace has wiped the other one's
+	 * work before.
+	 */
+	if (domainNavigation.size > 0) {
+		try {
+			/* Already merged above, so the stored row and the bundle's menu are the same thing — which
+			   is the only arrangement in which the two cannot drift. */
+			await saveConfigRow(
+				applicationConfigName,
+				applicationConfigVersion,
+				`get = function () { return ${JSON.stringify(parsedApplicationConfig)}; }`,
+				config,
+			);
+			const counts = [...domainNavigation].map(([key, menus]) => `${key}: ${menus.length}`).join(", ");
+			logger.info(`[navigation] domain menus published (${counts})`);
+		} catch (error) {
+			/* The bundle is already published and correct; a menu that did not update is a re-publish
+			   away, so this must not turn a successful publish into a failure. */
+			logger.warn(`[navigation] domain menus could not be merged: ${error?.message ?? error}`);
+		}
+	}
+
 	return response;
 };
 

package/engine/domain/domainNavigation.js

@@ -0,0 +1,131 @@
+/*
+ * A Layer 3 domain contributing its own navigation.
+ *
+ * ⚠️ WHY THIS EXISTS. `buildMenuStructureFromApplicationConfig` reads `APPLICATION_CONFIG.navigation`
+ * and nothing else, so a domain could declare entities, screens, settings and server code and still
+ * have no way to be REACHED — the host had to hand-declare every leaf. That also made Doc 5 §4.2's
+ * "runtime publish emits the menu tree from the activated set" impossible: the activation setting
+ * drove nothing at all.
+ *
+ * §3.3 names the mechanism: "Navigation entries carry `domain: 'hr'` and are emitted at runtime
+ * publish according to which submodules are active."
+ *
+ * ⚠️ THE ACTIVATION IS READ FROM DATA, NOT EXECUTED. The activating set lives in the DOMAIN's own
+ * table, which this file must not know about — so the domain NAMES the table and column in its config
+ * and the publish reads it generically. No domain name, no domain code, nothing app-specific here.
+ */
+
+/* The route shape the client's menu component renders, identical to a hand-declared leaf. */
+const linkFor = (entry) => ["./form", String(entry?.entryPoint ?? "").trim(), null];
+
+/*
+ * Which of a domain's declared entries are live right now.
+ *
+ * ⚠️ AN ENTRY WITH NO `module` IS ALWAYS EMITTED — §4.2's design-time menu, which exists whatever is
+ * activated. An entry WITH one appears only while that module is active.
+ *
+ * ⚠️ AND AN UNREADABLE ACTIVATION LIST ACTIVATES NOTHING. Failing open would hand a client every
+ * screen the moment a settings row went bad, which is the opposite of what a gate is for.
+ */
+export const selectActiveDomainMenus = ({ menus, activeModules } = {}) => {
+	const declared = Array.isArray(menus) ? menus : [];
+	const active = new Set(Array.isArray(activeModules) ? activeModules.map((m) => String(m)) : []);
+	return declared.filter((entry) => {
+		const gate = entry?.module;
+		if (gate === null || gate === undefined || String(gate).trim() === "") return true;
+		return active.has(String(gate));
+	});
+};
+
+/*
+ * Fold a domain's live entries into the host's navigation.
+ *
+ * ⚠️ ADDITIVE AND SELF-HEALING, which is the lesson APPLICATION_CONFIG's two writers already taught
+ * once: a publish that replaces the whole navigation wipes whatever the other writer added. So the
+ * host's own leaves are never touched, and neither are another domain's.
+ *
+ * ⚠️ AND IT STRIPS THIS DOMAIN'S PREVIOUS LEAVES FIRST. That is what the `domain` stamp is for, and
+ * it is what makes deactivation real: §4.2's stated failure is that "switching one off would leave
+ * its tile behind", which would make activation advisory — the setting would look like it did
+ * something while the tile still opened. Injecting without stripping would also accumulate duplicates
+ * that nothing could clear.
+ */
+export const mergeDomainNavigation = ({ applicationConfig, domainKey, menus } = {}) => {
+	const key = String(domainKey ?? "").trim();
+	const navigation = applicationConfig?.navigation ?? {};
+	const sourceMenus = Array.isArray(navigation.menus) ? navigation.menus : [];
+	const entries = Array.isArray(menus) ? menus : [];
+
+	/* Everything that is NOT this domain's, group structure preserved. */
+	const kept = sourceMenus.map((group) => ({
+		...group,
+		subMenu: (Array.isArray(group?.subMenu) ? group.subMenu : []).filter(
+			(leaf) => String(leaf?.domain ?? "") !== key,
+		),
+	}));
+
+	for (const entry of entries) {
+		const groupCaption = String(entry?.group ?? "").trim();
+		if (!groupCaption || !entry?.entryPoint) continue;
+
+		let group = kept.find((g) => String(g?.caption ?? "") === groupCaption);
+		if (!group) {
+			group = { caption: groupCaption, link: [], subMenu: [] };
+			kept.push(group);
+		}
+		if (!Array.isArray(group.subMenu)) group.subMenu = [];
+
+		group.subMenu.push({
+			caption: String(entry.caption ?? entry.entryPoint),
+			menuKey: String(entry.menuKey ?? entry.entryPoint),
+			link: linkFor(entry),
+			/* §3.3's stamp: what the next publish uses to find exactly its own leaves. */
+			domain: key,
+		});
+	}
+
+	/* A group that existed only to hold this domain's leaves, and now holds none, goes with them —
+	   an empty group renders as a dead parent nobody can open. The host's own empty groups are left
+	   alone, because they were not this publish's to remove. */
+	const hadDomainLeafOnly = (group) =>
+		(group?.subMenu ?? []).length === 0 &&
+		!sourceMenus.some(
+			(original) =>
+				String(original?.caption ?? "") === String(group?.caption ?? "") &&
+				(original?.subMenu ?? []).some((leaf) => String(leaf?.domain ?? "") !== key),
+		);
+
+	return { ...navigation, menus: kept.filter((group) => !hadDomainLeafOnly(group)) };
+};
+
+/*
+ * Read a domain's activation setting through the coordinates IT declares.
+ *
+ * ⚠️ Returns an empty list for anything it cannot read — a missing declaration, a missing row, a value
+ * that is not a JSON array. See `selectActiveDomainMenus`: the gate fails closed.
+ */
+export const readActiveModules = async ({ activation, exec, dbIndex } = {}) => {
+	const entity = String(activation?.entity ?? "").trim();
+	const keyColumn = String(activation?.keyColumn ?? "").trim();
+	const valueColumn = String(activation?.valueColumn ?? "").trim();
+	const setting = String(activation?.setting ?? "").trim();
+	if (!entity || !keyColumn || !valueColumn || !setting) return [];
+
+	/* Identifiers come from a published domain config, but they are still interpolated — so anything
+	   that is not a plain identifier is refused rather than quoted into the statement. */
+	const identifier = /^[A-Za-z_][A-Za-z0-9_$]*$/;
+	if (![entity, keyColumn, valueColumn].every((name) => identifier.test(name))) return [];
+
+	try {
+		const rows = await exec(
+			`SELECT ${valueColumn} AS value FROM ${entity} WHERE ${keyColumn} = '${setting.replace(/'/g, "''")}'`,
+			dbIndex,
+		);
+		const raw = rows?.[0]?.value;
+		if (raw === null || raw === undefined) return [];
+		const parsed = JSON.parse(String(raw));
+		return Array.isArray(parsed) ? parsed : [];
+	} catch {
+		return [];
+	}
+};

package/engine/orm/tenantResolution.js

@@ -50,6 +50,29 @@ export const assertInterval = (value, what = "grace") => {
 
 /* An instant, as a literal. Refused unless it actually parses — same reasoning as the interval. */
 export const assertInstant = (value, what = "at") => {
+	/*
+	 * ⚠⚠ A DATE OBJECT IS WHAT THE DRIVER HANDS BACK, and it used to pass this guard and then
+	 * break the statement. `Date.parse` accepts a JS Date's own toString() — "Tue Sep 15 2026
+	 * 08:00:00 GMT+0700 (Western Indonesia Time)" — which was then interpolated verbatim, and
+	 * PostgreSQL refused it with `time zone "gmt+0700" not recognized`.
+	 *
+	 * So the value was CERTIFIED and still unusable, which is the worst thing a validator can do.
+	 * Found the first time the §10 bridge ran against real rows: every timestamp it carries comes
+	 * straight out of a `timestamp` column, so every assignment it issued would have failed.
+	 *
+	 * ⚠️ Only a Date is converted. A naive STRING keeps its passthrough, because parsing it here
+	 * would move its interpretation from the SERVER's timezone to this process's — a silent shift in
+	 * meaning for every existing caller.
+	 */
+	if (value instanceof Date) {
+		if (Number.isNaN(value.getTime())) {
+			throw new Error(
+				`${what} must be a timestamp — refused an Invalid Date rather than interpolating it ` +
+					"into a statement (Doc 4 §7.1).",
+			);
+		}
+		return value.toISOString();
+	}
 	const text = String(value ?? "").trim();
 	if (text === "" || Number.isNaN(Date.parse(text))) {
 		throw new Error(

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "biz-a-cli",
-	"version": "2.3.80-15326",
+	"version": "2.3.80-15333",
 	"description": "",
 	"main": "bin/index.js",
 	"type": "module",