biz-a-cli 2.3.80-15365 → 2.3.80-15372

package/bin/app.js

@@ -1,5 +1,6 @@
 #!/usr/bin/env node
 
+import "../envs/defaultEnv.js";
 import yargs from "yargs";
 import axios from "axios";
 import fs from "fs";

package/bin/deleteApp.js

@@ -1,5 +1,6 @@
 #!/usr/bin/env node
 
+import "../envs/defaultEnv.js";
 import yargs from "yargs";
 import axios from "axios";
 import { logger } from "../logger.js";

package/bin/hub.js

@@ -1,9 +1,6 @@
 #!/usr/bin/env node
 
-if (!process.env.NODE_ENV) {
-	process.env.NODE_ENV = "production";
-}
-
+import "../envs/defaultEnv.js";
 import yargs from "yargs";
 import { io as ioClient } from "socket.io-client";
 import {

package/bin/index.js

@@ -1,5 +1,6 @@
 #!/usr/bin/env node
 
+import "../envs/defaultEnv.js";
 import yargs from "yargs";
 import axios from "axios";
 import { promises as fs } from "fs";

package/bin/proxy.js

@@ -1,5 +1,6 @@
 #!/usr/bin/env node
 
+import "../envs/defaultEnv.js";
 import express from 'express';
 import cors from 'cors';
 const app = express();

package/bin/uploadApp.js

@@ -1,5 +1,6 @@
 #!/usr/bin/env node
 
+import "../envs/defaultEnv.js";
 import yargs from "yargs";
 import axios from "axios";
 import { promises as fs } from "fs";

package/bin/watcher.js

@@ -1,5 +1,6 @@
 #!/usr/bin/env node
 
+import "../envs/defaultEnv.js";
 import express from 'express';
 import cors from 'cors';
 const app = express();

package/engine/domain/appConfig.js

@@ -9,6 +9,11 @@ import {
 	findRawColorsInStyles,
 	describeRawColorFindings,
 } from "./styleColors.js";
+import {
+	findImplicitNumericScale,
+	describeImplicitScaleFindings,
+	selectScaleRisks,
+} from "./numericScale.js";
 import { json2List } from "../orm/index.js";
 import { toDbName } from "./naming.js";
 import { logger } from "../../logger.js";
@@ -3242,6 +3247,49 @@ export const publishConfigs = async (payload = {}, argv = {}) => {
 			);
 		}
 
+		/*
+		 * ⚠️⚠️ WHICH `number` COLUMNS LET A DISPLAY HINT CHOOSE THEIR STORAGE PRECISION.
+		 *
+		 * `resolveColumnType` takes a column's scale from `uiIntent` when none is declared: 'currency'
+		 * gives 2, anything else gives 0. In Supertail that made `st_order`'s header BIGINT while the
+		 * order LINES it sums stayed NUMERIC(18,2), and made `tax_rate` unable to hold 11.5%.
+		 *
+		 * ⚠️ REPORT-ONLY, and scanned here beside the Style colours for the same reason: 204 `number`
+		 * attributes across biz-a-template declare no scale at all, so refusing a publish would make
+		 * the platform un-upgradable for every application that has the problem. The countable list is
+		 * the deliverable.
+		 *
+		 * ⚠️ Its own try/catch: a warning must never be the thing that fails a publish.
+		 */
+		try {
+			const implicitScale = findImplicitNumericScale(parseDomainConfig(domainConfigContent));
+			const scaleRisks = selectScaleRisks(implicitScale);
+			/*
+			 * ⚠️ ONLY THE RISKS ARE LISTED. The raw scan finds 158 columns in one real config and most
+			 * are legitimately whole (sequence_no, timeout_minutes, foreign keys) — printing them all
+			 * is how a check gets switched off. The rest is a count, so the number is never lost.
+			 */
+			if (scaleRisks.length > 0) {
+				logger.warn(
+					`[AppConfig Publish] ${scaleRisks.length} money/rate column(s) in ` +
+					`${domainName}@${domainVersion} resolve to a WHOLE-NUMBER type because no \`scale\` ` +
+					"is declared and uiIntent decides it (REPORT ONLY). These cannot hold cents or a " +
+					"fractional rate:",
+				);
+				describeImplicitScaleFindings(scaleRisks).forEach((line) => logger.warn(line));
+			}
+			if (implicitScale.length > 0) {
+				logger.warn(
+					`[AppConfig Publish] (${implicitScale.length} numeric column(s) in total take their ` +
+					"scale from uiIntent rather than declaring it.)",
+				);
+			}
+		} catch (error) {
+			logger.warn(
+				`[AppConfig Publish] could not scan numeric scales: ${error?.message ?? error}`,
+			);
+		}
+
 		/*
 		 * Doc 3 §11 — resolve the tenancy declaration across EVERY published domain, not just this one.
 		 *

package/engine/domain/domainNavigation.js

@@ -71,7 +71,25 @@ export const mergeDomainNavigation = ({ applicationConfig, domainKey, menus } =
 		let group = kept.find((g) => String(g?.caption ?? "") === groupCaption);
 		if (!group) {
 			group = { caption: groupCaption, link: [], subMenu: [] };
-			kept.push(group);
+			/*
+			 * ⚠️ WHERE a group the host does not have is placed. Appending is fine for one stray leaf
+			 * and wrong for a domain that owns a whole group: "HR, beside Setup" appended after every
+			 * group the host emits is a group at the BOTTOM of the menu, which is not what was asked
+			 * for and not where anyone looks.
+			 *
+			 * ⚠️ ON CREATION ONLY. Once the group exists, `kept.find` above keeps its position, and so
+			 * does the host's own injector, which concats into a group it finds rather than
+			 * re-appending. Every entry of a multi-screen domain therefore carries the same hint and
+			 * only the first one acts on it.
+			 *
+			 * ⚠️ AN ANCHOR THE HOST DOES NOT HAVE APPENDS. Declining to place the group would hide
+			 * every screen the domain owns — far worse than placing it last, and a domain cannot know
+			 * what groups its host happens to emit.
+			 */
+			const anchor = String(entry?.groupAfter ?? "").trim();
+			const at = anchor ? kept.findIndex((g) => String(g?.caption ?? "") === anchor) : -1;
+			if (at >= 0) kept.splice(at + 1, 0, group);
+			else kept.push(group);
 		}
 		if (!Array.isArray(group.subMenu)) group.subMenu = [];
 

package/engine/domain/numericScale.js

@@ -0,0 +1,113 @@
+/*
+ * ⚠️⚠️ WHICH `number` COLUMNS LET A PRESENTATION HINT CHOOSE THEIR STORAGE.
+ *
+ * `appConfig.js resolveColumnType` infers a column's scale from `uiIntent`: 'currency' gives 2, ANY
+ * other value gives 0 — so a money column labelled for DISPLAY silently becomes an integer, and the
+ * rounding is invisible until something produces a fraction.
+ *
+ * Found in Supertail, 2026-09-24: `st_order`'s header (`subtotal_amount`, `tax_amount`,
+ * `service_charge_amount`, `final_amount`) carried `uiIntent: 'label'` and became BIGINT, while the
+ * order LINES they sum kept NUMERIC(18,2) — one order, money at two precisions. And
+ * `st_finalisasi_profile.tax_rate` was BIGINT: 11% expressible, 11.5% silently truncated.
+ *
+ * ⚠️ WHY A REPORT AND NOT A RULE CHANGE. Measured across `biz-a-template`: 204 `type: 'number'`
+ * attributes, and NOT ONE declares an explicit `scale`. Flipping the inference today would drop the
+ * decimals on the 66 that currently rely on `uiIntent: 'currency'`. So the gap is made countable
+ * first, the configs state their storage over time, and only then can the default move. The same
+ * staging the raw-colour warning used (§10 point 3).
+ *
+ * ⚠️ REPORT-ONLY, ALWAYS. Refusing a publish would make the platform un-upgradable for exactly the
+ * applications that most need the fix — the argument styleColors.js already makes, and this file
+ * deliberately mirrors its shape so the two read as one idea.
+ */
+
+/* Everything here fails SOFT and returns a list: a warning must never fail a publish. */
+const entitiesOf = (config) => {
+	const entities = config?.model?.entities;
+	if (!entities || typeof entities !== "object" || Array.isArray(entities)) return [];
+	return Object.entries(entities);
+};
+
+/**
+ * Every `type: 'number'` attribute whose scale is INFERRED rather than declared.
+ *
+ * ⚠️ `uiIntent: 'currency'` is included too, deliberately. Those columns get the right storage for
+ * the wrong reason — a display hint — which is the coupling being retired. `resolved` says what each
+ * one becomes, so the two groups stay countable apart.
+ *
+ * Returns `[{ table, column, uiIntent, resolved }]`, or `[]` for anything it cannot read.
+ */
+export const findImplicitNumericScale = (config) => {
+	const findings = [];
+	for (const [entityName, entity] of entitiesOf(config)) {
+		const attributes = entity?.attributes;
+		if (!attributes || typeof attributes !== "object" || Array.isArray(attributes)) continue;
+		/* An entity may name no table; the entity key is what a reader would search for. */
+		const table = String(entity?.table ?? entityName);
+
+		for (const [column, attribute] of Object.entries(attributes)) {
+			if (!attribute || typeof attribute !== "object") continue;
+			if (String(attribute.type ?? "").toLowerCase() !== "number") continue;
+			/* Declared scale is the answer this check exists to encourage — including scale 0, which
+			   is a perfectly good statement that a column holds whole units. */
+			if (typeof attribute.scale === "number" && Number.isFinite(attribute.scale)) continue;
+
+			const uiIntent = String(attribute.uiIntent ?? "");
+			findings.push({
+				table,
+				column,
+				uiIntent: uiIntent || "(none)",
+				resolved:
+					uiIntent.toLowerCase() === "currency"
+						? `NUMERIC(${attribute.precision ?? attribute.size ?? 18},2)`
+						: "INTEGER/BIGINT",
+			});
+		}
+	}
+	return findings;
+};
+
+/*
+ * ⚠️⚠️ WHAT IS WORTH PRINTING AT EVERY PUBLISH — a much smaller set than what the scan finds.
+ *
+ * The raw scan reports 158 columns in Supertail alone, and most are legitimately whole: `sequence_no`,
+ * `timeout_minutes`, foreign-key `_id`s, `user_id`. A report that long is noise, and styleColors.js
+ * already records where noise leads: "false positives will make people switch the check off, along
+ * with the findings that were real". Named colours are excluded there for exactly this reason.
+ *
+ * So the publish prints the defect SHAPE that was actually found: a column whose NAME says money or
+ * rate, which nonetheless resolved to an integer. Everything else stays available from the scan and
+ * is summarised as a count.
+ *
+ * ⚠️ A column ending `_id` is a key however it is named — `payment_amount_id` is not money.
+ */
+const MONEY_OR_RATE = /(amount|price|total|subtotal|cost|fee|discount|paid|change|balance|tax|charge|rate|percent|pct)/i;
+const LOOKS_LIKE_KEY = /(^id$|_id$)/i;
+
+export const selectScaleRisks = (findings) =>
+	(Array.isArray(findings) ? findings : []).filter(
+		(f) =>
+			f?.resolved === "INTEGER/BIGINT" &&
+			MONEY_OR_RATE.test(String(f.column)) &&
+			!LOOKS_LIKE_KEY.test(String(f.column)),
+	);
+
+/* ⚠️ CAPPED. A report that dumps 204 lines is one nobody reads, and the point is that somebody
+   reads it. The tail says how many were hidden so the number is never lost. */
+const MAX_LINES = 20;
+
+export const describeImplicitScaleFindings = (findings) => {
+	const list = Array.isArray(findings) ? findings : [];
+	if (list.length === 0) return [];
+
+	const lines = list
+		.slice(0, MAX_LINES)
+		.map(
+			(f) =>
+				`  ${f.table}.${f.column}  uiIntent=${f.uiIntent}  ->  ${f.resolved}`,
+		);
+	if (list.length > MAX_LINES) {
+		lines.push(`  ... and ${list.length - MAX_LINES} more`);
+	}
+	return lines;
+};

package/engine/ext/live.js

@@ -29,12 +29,32 @@ import {
 } from "./publicTheme.js";
 import { createAllTenantScope } from "../orm/tenantScope.js";
 import { execPostgres, isPostgresIndex } from "../domain/dialect.js";
+import { nextGeneratorValue } from "../orm/dialect.js";
 
 const DEFAULT_FINA_URL = "http://127.0.0.1:212";
 
 // Next value from a Firebird generator (for SYS$EXT_USER ids). Mirrors datalib.genId's
 // endpoint without importing datalib (which pulls the worker pool + watcher).
+//
+// ⚠️ ON POSTGRESQL THERE IS NO GENERATOR AND NO FINA TO ASK. The migrations translate
+// `<TABLE>_GEN` + BI trigger into an IDENTITY column, so this call could only ever fail — the same
+// defect the admin client's `genId` hit live ("add user group" -> ECONNREFUSED 127.0.0.1:212), in a
+// second hand-rolled copy. Shared with apiRoute.js through `nextGeneratorValue` so the two cannot
+// drift; the Firebird branch below is untouched.
 async function genId(cfg, genName) {
+	if (isPostgresIndex(cfg.dbindex)) {
+		const { sequence, value } = await nextGeneratorValue({
+			exec: execPostgres,
+			dbIndex: cfg.dbindex,
+			generator: genName,
+		});
+		if (sequence === null) {
+			throw new Error(
+				`no sequence backs generator ${genName} on database ${cfg.dbindex}`,
+			);
+		}
+		return value;
+	}
 	const url = `${cfg.url}/fina/rest/TOrmMethod/genId/${genName}/${cfg.dbindex}`;
 	const res = await axios.get(url, {
 		headers: { "content-type": "text/plain" },

package/engine/orm/apiRoute.js

@@ -20,6 +20,7 @@
  *   failure           -> {"error":"..."} , which db/ds.js's dsReq already looks for.
  */
 import { json2List, addTableNameToArray, lookupToSql, lookupTotalToSql, resolveDbIndex, buildWriteSql } from "./index.js";
+import { nextGeneratorValue } from "./dialect.js";
 import { createReaders } from "./changeInference.js";
 import { CONFLICT_CODE, ROW_VERSION_KEY, refreshRowVersion } from "./concurrency.js";
 import {
@@ -135,6 +136,27 @@ export const parseExecuteSqlRequest = (path, body) => {
 	}
 };
 
+/*
+ * `genId` carries EVERYTHING IN THE PATH and posts a null body:
+ * `/fina/rest/TOrmMethod/%22genId%22/SYS$USERGROUP_GEN/3` (data.service.ts genId).
+ *
+ * ⚠️ Which is why `parseDataSnapRequest` never recognised it — that one needs `_parameters[0]` and
+ * quietly declines a body it cannot read. The call fell through to FINA, and on a tenant with no
+ * FINA the admin screen answered `502 ECONNREFUSED 127.0.0.1:212`.
+ *
+ * Returns { generator, dbIndex } or null.
+ */
+const GENID_PATH = /\/fina\/rest\/\w+\/(?:%22|")genId(?:%22|")\/([^/?#]+)\/(\d+)/i;
+
+export const parseGenIdRequest = (path) => {
+	const match = GENID_PATH.exec(String(path ?? ""));
+	if (!match) return null;
+	const generator = decodeURIComponent(match[1]).trim();
+	if (!generator) return null;
+	const dbIndex = Number(match[2]);
+	return { generator, dbIndex: Number.isFinite(dbIndex) ? dbIndex : null };
+};
+
 export const parseDataSnapRequest = (path, body) => {
 	const match = DATASNAP_PATH.exec(String(path ?? ""));
 	if (!match) return null;
@@ -580,6 +602,53 @@ export const routeApiRequest = async (
 		}
 	}
 
+	/*
+	 * ⚠️⚠️ `genId` — a Firebird GENERATOR, answered from PostgreSQL's own counter.
+	 *
+	 * This used to fall through to FINA with the rest of the non-ORM surface, which was honest while
+	 * the generator was merely SOMEWHERE ELSE. It is not: the PostgreSQL migrations translate
+	 * `<TABLE>_GEN` + BI trigger into `GENERATED BY DEFAULT AS IDENTITY`, so on a PostgreSQL tenant
+	 * the generator does not exist at all and the forward could only ever reach a Firebird counter
+	 * for a different database — or, on a tenant with no FINA, `ECONNREFUSED`.
+	 *
+	 * ⚠️ Answering it from FINA was the WORSE outcome of the two. `buildUpsert` honours a supplied
+	 * key, so a value drawn from one database and inserted into another collides with the identity
+	 * column's own sequence as soon as the two counters cross. Resolving to the table's OWN sequence
+	 * is what makes the pre-allocated key and the column default one counter again.
+	 *
+	 * ⚠️ A Firebird index still has a real generator, so it still forwards — the mixed tenant
+	 * `finaEndpoint.js` protects keeps working untouched.
+	 */
+	const genIdRequest = parseGenIdRequest(path);
+	if (genIdRequest) {
+		if (!isPostgresIndex(genIdRequest.dbIndex)) return null;
+		try {
+			const { sequence, value } = await nextGeneratorValue({
+				exec,
+				dbIndex: genIdRequest.dbIndex,
+				generator: genIdRequest.generator,
+			});
+			/* ⚠️ A caller can act on "no sequence backs SYS$NOPE_GEN". It cannot act on a connection
+			   error, and telling the two apart is most of what made this bug hard to place. */
+			if (sequence === null) {
+				return {
+					status: 400,
+					body: {
+						error:
+							`no sequence backs generator ${genIdRequest.generator} on database ` +
+							`${genIdRequest.dbIndex} — no sequence of that name, and no identity column on ` +
+							`${genIdRequest.generator.replace(/_GEN$/i, "")}`,
+					},
+				};
+			}
+			/* ⚠️ A BARE NUMBER, captured from the live FINA rather than guessed: it answers `2`, not
+			   `{data:…}` and not a string. data.service.ts hands the body straight to the caller. */
+			return { status: 200, body: value };
+		} catch (error) {
+			return { status: 500, body: { error: error?.message ?? String(error) } };
+		}
+	}
+
 	const parsed = parseDataSnapRequest(path, body);
 	if (!parsed) return null;
 

package/engine/orm/connection.js

@@ -21,6 +21,7 @@
 import fs from "node:fs";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
+import { logger } from "../../logger.js";
 
 /* ABSOLUTE, resolved from this module — NOT process.cwd(). The hub is routinely launched from
    another directory (a global `hub` binary, a service wrapper, `node cli/bin/hub.js` from the repo
@@ -257,11 +258,61 @@ export const PG_DATE_OID = 1082;
  */
 export const PG_BOOL_OID = 16;
 
+/*
+ * ⚠️⚠️ NUMERIC AND BIGINT MUST ARRIVE AS NUMBERS — the same argument as DATE and BOOL above, and the
+ * one that cost a real mis-priced screen.
+ *
+ * node-postgres hands arbitrary-precision types back as STRINGS so precision is never silently lost
+ * to IEEE-754. That is the right default for a general driver and the wrong one for an application
+ * written against what FINA sent, which was numbers. Left as strings, `a + b` CONCATENATES and
+ * `row.qty > 5` compares text.
+ *
+ * ⚠️ Live, 2026-09-23 (company bkd): `NUMERIC(18,2)` arrived as `"18000.00"` and the client read it
+ * as LOCALE text — Indonesian groups with `.` — so an 18,000 item rendered as Rp 1.800.000 on the
+ * screen used to cancel, void and refund. The display edge was fixed then; this fixes the shape.
+ */
+export const PG_NUMERIC_OID = 1700;
+export const PG_INT8_OID = 20;
+
+/*
+ * ⚠️⚠️ THE PRECISION RISK IS REAL, SO IT IS MADE LOUD RATHER THAN ASSUMED AWAY.
+ *
+ * A double represents every integer exactly only up to 2^53-1; `NUMERIC(18,2)` can hold more, which
+ * is exactly why node-pg returns strings. Measured on db 3 the largest real amount is 900,000 —
+ * roughly ten million times of headroom — but "today's data fits" is not a guarantee, and a value
+ * that does not fit must NOT be rounded in silence. That would be the same class of defect this
+ * change exists to remove, one layer down.
+ *
+ * ⚠️ IT WARNS, IT DOES NOT THROW. A type parser runs inside every row of every read; throwing would
+ * turn one oversized value into a failed query with no obvious cause.
+ *
+ * ⚠️ AND AN UNPARSEABLE VALUE IS HANDED BACK UNTOUCHED, never NaN. PostgreSQL's `numeric` accepts
+ * 'NaN' and the infinities; coercing those would spread a JS NaN through every sum that touched them
+ * with nothing to trace it to.
+ */
+const parseNumeric = (value) => {
+	if (value === null || value === undefined) return value;
+	const text = String(value);
+	const parsed = Number(text);
+	if (!Number.isFinite(parsed)) return value;
+
+	if (Math.abs(parsed) > Number.MAX_SAFE_INTEGER) {
+		logger.warn(
+			`[pg] ${text} exceeds the range a JavaScript number represents exactly ` +
+				`(±${Number.MAX_SAFE_INTEGER}); it has been read as ${parsed} and is no longer exact. ` +
+				"Handle this column as a string at the call site.",
+		);
+	}
+	return parsed;
+};
+
 export const registerPgTypeParsers = (pg) => {
 	pg.types.setTypeParser(PG_DATE_OID, (value) => value);
 	pg.types.setTypeParser(PG_BOOL_OID, (value) =>
 		value === null || value === undefined ? value : value === "t" ? 1 : 0,
 	);
+	pg.types.setTypeParser(PG_NUMERIC_OID, parseNumeric);
+	pg.types.setTypeParser(PG_INT8_OID, parseNumeric);
 };
 
 /* Registered once per process, at the same lazy point `pg` itself is first loaded — the parser is

package/engine/orm/dialect.js

@@ -25,6 +25,71 @@ export const buildPagingClause = (start, length) => {
 export const buildSequenceNextValue = (sequenceName) =>
 	`SELECT nextval('${String(sequenceName).replace(/'/g, "''")}')`;
 
+/*
+ * Doc 3 §5 item 11 — which PostgreSQL sequence stands in for a Firebird GENERATOR.
+ *
+ * ⚠️⚠️ THE SECOND BRANCH IS THE WHOLE POINT. On Firebird a table's key comes from `<TABLE>_GEN`
+ * plus a BEFORE INSERT trigger; the PostgreSQL migrations translate that pair into
+ * `GENERATED BY DEFAULT AS IDENTITY`, so the generator does not exist here and cannot. Measured on
+ * both live PostgreSQL databases: not one `%_GEN` sequence.
+ *
+ * So `SYS$USERGROUP_GEN` resolves to the sequence `SYS$USERGROUP`'s identity column ALREADY OWNS.
+ * That is not a convenience — it is the correctness condition. A caller that pre-allocates a key
+ * and then inserts it explicitly (`admin/userGroup.component.ts`, because SYS$UGPRIV is written as
+ * an independent row carrying `usergroup_id`) must draw from the SAME counter the column's DEFAULT
+ * would use, or the two drift apart and collide on the primary key. That is exactly what was
+ * happening while `genId` was forwarded to a FINA whose own generator was a different number in a
+ * different database.
+ *
+ * ⚠️ The exact-name branch comes FIRST so an application that genuinely created `FOO_GEN` keeps
+ * working, and so a Firebird-shaped schema restored onto PostgreSQL is still answered correctly.
+ *
+ * ⚠️ The column is not assumed to be `id`: the lookup asks which of the table's columns owns a
+ * sequence. A table whose key is named otherwise resolves just the same.
+ *
+ * ⚠️ `pg_table_is_visible` keeps both branches inside the caller's search path — without it a
+ * same-named sequence in another schema could answer for a table this connection cannot even see.
+ *
+ * ⚠️ Both names are rendered as LITERALS, compared with `lower(...)`, never as identifiers. Nothing
+ * from the request reaches an identifier position: the `nextval` that follows uses the name the
+ * DATABASE returned, not the one the caller sent.
+ */
+export const buildGeneratorSequenceSql = (generator) => {
+	const name = String(generator ?? "");
+	const table = name.replace(/_GEN$/i, "");
+	return (
+		"SELECT COALESCE(" +
+		"(SELECT c.oid::regclass::text FROM pg_class c " +
+		`WHERE c.relkind = 'S' AND pg_table_is_visible(c.oid) AND lower(c.relname) = lower(${quoteLiteral(name)}) ` +
+		"LIMIT 1), " +
+		"(SELECT pg_get_serial_sequence(t.oid::regclass::text, a.attname) FROM pg_class t " +
+		"JOIN pg_attribute a ON a.attrelid = t.oid AND a.attnum > 0 AND NOT a.attisdropped " +
+		`WHERE t.relkind = 'r' AND pg_table_is_visible(t.oid) AND lower(t.relname) = lower(${quoteLiteral(table)}) ` +
+		"AND pg_get_serial_sequence(t.oid::regclass::text, a.attname) IS NOT NULL " +
+		"LIMIT 1)" +
+		") AS sequence_name"
+	);
+};
+
+/*
+ * The next value of a Firebird-named generator, from PostgreSQL.
+ *
+ * ⚠️ ONE COPY, because there are two callers and they must not drift: `apiRoute.js` answers the
+ * admin client's `genId`, and `engine/ext/live.js` pre-generates SYS$EXT_USER ids. The second was
+ * a hand-rolled axios call to FINA and carried the identical latent failure — a PostgreSQL tenant
+ * has no FINA to ask and no generator to ask for.
+ *
+ * Resolves to `{ sequence, value }`, or `{ sequence: null, value: null }` when nothing backs the
+ * name. The caller decides what an unresolvable generator means; here it is simply a fact.
+ */
+export const nextGeneratorValue = async ({ exec, dbIndex, generator }) => {
+	const resolved = (await exec(buildGeneratorSequenceSql(generator), dbIndex)) ?? [];
+	const sequence = resolved[0]?.sequence_name ?? resolved[0]?.SEQUENCE_NAME ?? null;
+	if (!sequence) return { sequence: null, value: null };
+	const next = (await exec(buildSequenceNextValue(sequence), dbIndex)) ?? [];
+	return { sequence, value: Number(next[0]?.nextval ?? next[0]?.NEXTVAL) };
+};
+
 export const quoteLiteral = (value) => `'${String(value).replace(/'/g, "''")}'`;
 
 /* A JS Date as a SQL literal. `String(date)` gives

package/engine/orm/executeBlock.js

@@ -602,8 +602,91 @@ const coerceInsertSelect = (statement, dbIndex) => {
 	);
 };
 
-/* `UPDATE t SET a = x, b = y [WHERE …]` — ASSIGNMENTS ONLY. The WHERE clause is a filter, handled
-   where filters are built; rewriting it here too risks corrupting a comparison meant literally. */
+/*
+ * ⚠️⚠️ THE FILTER HALF — `WHERE ACTIVE = 1` AGAINST A NATIVE BOOLEAN.
+ *
+ * This used to read "ASSIGNMENTS ONLY. The WHERE clause is a filter, handled where filters are
+ * built", and that premise is true of the ORM and FALSE of this module. A filter reaching
+ * listQuery.js was BUILT by the ORM from a declared column and a value, so the type is known there.
+ * A WHERE inside a raw EXECUTE BLOCK is a string the application concatenated — no filter builder
+ * ever sees it. This module is the only place that knows both the table and the declaration.
+ *
+ * The cost of believing otherwise, reported by QA 2026-09-25 from Manage Order > Batalkan Paksa:
+ *
+ *   UPDATE ST_ORDER_RESOURCE SET ACTIVE='0', RELEASED_AT=CURRENT_TIMESTAMP
+ *   WHERE ST_ORDER_ID='{…}' AND ACTIVE=1
+ *   -> operator does not exist: boolean = integer
+ *
+ * ⚠️ Half-rewritten: the platform coerced its own SET and handed PostgreSQL the raw WHERE. A rule
+ * that fires on one side of a statement and not the other is worse than one that never fires, because
+ * the statement in the error message no longer looks like the statement in the source.
+ *
+ * ⚠️⚠️ A SUBQUERY IS THE LINE THIS MUST NOT CROSS. Inside `IN (SELECT … FROM other …)` the column
+ * names belong to ANOTHER table, whose declarations this function does not have — coercing there
+ * would quote a value by the wrong table's type, silently, inside a transactional statement. So a
+ * WHERE containing a SELECT is passed through whole. Same trade as `coerceInsertSelect`: a statement
+ * left alone may fail loudly; a statement MISALIGNED corrupts a row quietly.
+ */
+
+/* Split into alternating unquoted / quoted runs so a rewrite never reaches inside a string literal:
+   `WHERE NOTE = 'ACTIVE = 1'` is prose, not a comparison. */
+const splitQuotedRuns = (text) => {
+	const runs = [];
+	let current = "";
+	let quoted = false;
+	for (let i = 0; i < text.length; i += 1) {
+		const ch = text[i];
+		if (quoted) {
+			current += ch;
+			if (ch === "'") {
+				if (text[i + 1] === "'") { current += text[++i]; continue; }
+				runs.push({ quoted: true, text: current });
+				current = "";
+				quoted = false;
+			}
+			continue;
+		}
+		if (ch === "'") {
+			runs.push({ quoted: false, text: current });
+			current = "'";
+			quoted = true;
+			continue;
+		}
+		current += ch;
+	}
+	runs.push({ quoted, text: current });
+	return runs;
+};
+
+/*
+ * `<column> = 0` / `<> 0` / `!= 0`, bare on both sides.
+ *
+ * ⚠️ `[^\w.]` before the name rejects a QUALIFIED column (`x.active`): the qualifier may be an alias
+ * for a different table, and this function only holds one table's declarations. `(?![\w.])` after the
+ * digit rejects `10` and `1.5`, which were never booleans. `>=` and `<=` do not match — the operator
+ * alternation has no bare `<` or `>` — and they are nonsense on a boolean anyway.
+ */
+const BOOLEAN_COMPARISON = /(^|[^\w.])([A-Za-z_]\w*)(\s*(?:<>|!=|=)\s*)([01])(?![\w.])/g;
+
+const coerceBooleanFilter = (table, whereText, dbIndex) => {
+	if (dbIndex === null || dbIndex === undefined) return whereText;
+	/* ⚠️ Any depth, not just the top level — the subquery that matters is inside parentheses. */
+	if (/(^|[^A-Za-z_])SELECT([^A-Za-z_]|$)/i.test(stripLiterals(whereText))) return whereText;
+
+	return splitQuotedRuns(whereText)
+		.map((run) =>
+			run.quoted
+				? run.text
+				: run.text.replace(BOOLEAN_COMPARISON, (whole, before, column, operator, digit) =>
+						isBooleanColumn(table, column.replace(/^"|"$/g, ""), dbIndex)
+							? before + column + operator + "'" + digit + "'"
+							: whole,
+					),
+		)
+		.join("");
+};
+
+/* `UPDATE t SET a = x, b = y [WHERE …]` — assignments, then the filter. */
 const UPDATE_SET = /^(UPDATE\s+([\w$."]+)\s+SET\s+)([\s\S]*?)(\s+WHERE[\s\S]*)?$/i;
 const coerceUpdate = (statement, dbIndex) => {
 	const match = UPDATE_SET.exec(statement.trim());
@@ -618,7 +701,16 @@ const coerceUpdate = (statement, dbIndex) => {
 		const column = pair.slice(0, eq).trim().replace(/^"|"$/g, "");
 		return pair.slice(0, eq) + "=" + coerceOne(table, column, pair.slice(eq + 1), dbIndex);
 	});
-	return head + assignments.join(",") + whereText;
+	return head + assignments.join(",") + coerceBooleanFilter(table, whereText, dbIndex);
+};
+
+/* `DELETE FROM t WHERE …` — the same defect with a different verb. There is no SET to align, so the
+   filter is the whole of the work. */
+const DELETE_FROM = /^(DELETE\s+FROM\s+([\w$."]+))(\s+WHERE[\s\S]*)?$/i;
+const coerceDelete = (statement, dbIndex) => {
+	const match = DELETE_FROM.exec(statement.trim());
+	if (!match) return statement;
+	return match[1] + coerceBooleanFilter(match[2], match[3] ?? "", dbIndex);
 };
 
 /*
@@ -763,6 +855,7 @@ const coerceBooleanLiterals = (statement, dbIndex) => {
 		);
 	}
 	if (/^\s*UPDATE\s/i.test(statement)) return coerceUpdate(statement, dbIndex);
+	if (/^\s*DELETE\s/i.test(statement)) return coerceDelete(statement, dbIndex);
 	return statement;
 };
 

package/engine/orm/executor.js

@@ -251,7 +251,12 @@ export const createExecutor = ({ exec, execStatements, execTransaction }) => ({
 	   still refuses the procedural nine by name. The whole body runs as one transaction, because
 	   EXECUTE BLOCK is one statement in Firebird. */
 	async executeBlock(sqlString, dbIndex) {
-		const { statements } = translateExecuteBlock(sqlString);
+		/* ⚠️ dbIndex IS NOT OPTIONAL HERE. executeBlock.js can only coerce a boolean literal or stamp
+		   authorship if it knows which database DECLARED the column; without it every rewrite is
+		   silently skipped. It was omitted until 2026-09-25, so the same raw block behaved one way from
+		   a browser (apiRoute.js passed it) and another from a CLI script. Fenced in
+		   tests/block-executor-dbindex.test.js. */
+		const { statements } = translateExecuteBlock(sqlString, dbIndex);
 		const rows = await execTransaction(statements, dbIndex);
 		// Firebird's shape: db/db.js claimRow reads res?.data || res, and the admin client reads
 		// data[0].RESULT — upper-cased, as unquoted Firebird identifiers come back.

package/engine/orm/tenantApi.js

@@ -32,10 +32,10 @@ const literal = (value) => `'${String(value ?? "").replace(/'/g, "''")}'`;
 
 /* ⚠️ `Number()`, never `parseInt`: "7; DROP TABLE x" must become NaN and be refused, not have its
    leading digits salvaged into a valid-looking id. */
-const assertUserId = (value) => {
+const assertUserId = (value, what = "userId") => {
 	const id = Number(value);
 	if (!Number.isInteger(id)) {
-		throw new Error(`userId must be an integer — refused '${value}' (Doc 4 §6).`);
+		throw new Error(`${what} must be an integer — refused '${value}' (Doc 4 §6).`);
 	}
 	return id;
 };
@@ -246,6 +246,18 @@ export const createTenantApi = ({
 		sourceRef = null,
 		includeDescendants = false,
 		grace = null,
+		/*
+		 * §6 declares `created_by integer` and the migration creates the column, but nothing ever
+		 * wrote it — so the table could not answer "who granted this", which is precisely what §10
+		 * exists to keep answerable.
+		 *
+		 * ⚠️ It only starts mattering once a HUMAN can grant from a screen. A roster-driven row is
+		 * explained by its `source_ref`; a hand-made one is explained by nobody.
+		 *
+		 * ⚠️ The CALLER must take this from a VERIFIED principal, never from its own request body —
+		 * a field naming the granter is worth nothing if the granter can choose it.
+		 */
+		createdBy = null,
 	}) => {
 		const user = assertUserId(userId);
 		const tenant = assertText(tenantId, "tenantId");
@@ -270,6 +282,12 @@ export const createTenantApi = ({
 			["SOURCE_REF", sourceRef === null ? "NULL" : `${literal(assertUuid(sourceRef, "sourceRef"))}::uuid`],
 			["GRACE_BEFORE", `INTERVAL ${literal(before)}`],
 			["GRACE_AFTER", `INTERVAL ${literal(after)}`],
+			/* ⚠️ Through `assertUserId`, the same guard the subject of the assignment gets:
+			   "3; DROP TABLE …" must become NaN and be refused, not have its leading digits
+			   salvaged into a valid-looking id. */
+			["CREATED_BY", createdBy === null || createdBy === undefined
+				? "NULL"
+				: String(assertUserId(createdBy, "createdBy"))],
 		];
 
 		const rows =

package/engine/orm/userGroups.js

@@ -11,6 +11,7 @@
  * id would let anyone enumerate somebody else's rights.
  */
 import { logger } from "../../logger.js";
+import { buildFindAdminForUserSql } from "./userAdmin.js";
 
 const MEMBERSHIP_TABLE = "sys$ugmember";
 const GROUP_TABLE = "sys$usergroup";
@@ -60,3 +61,41 @@ export const resolveUserGroups = async ({ exec, dbIndex, userId }) => {
 		return [];
 	}
 };
+
+/*
+ * Is this VERIFIED caller a company administrator?
+ *
+ * ⚠️ PLATFORM CODE FOR THE SAME REASON `resolveUserGroups` IS. SYS$ADMINISTRATOR is a `sys$` table
+ * and Dok. 5 §1–2 forbids a Layer 3 domain from touching one, so the domain states the right it
+ * needs and the platform answers. HR's Akses Outlet gates its writes on this: granting a person
+ * access to an outlet is an administrative act, and hiding a menu entry stops nobody — anyone can
+ * open a socket and send `runCLIScript`.
+ *
+ * ⚠️ SYS$ADMINISTRATOR is the same table the client already reads to decide whether to show the
+ * admin menu at all (`data.service.ts validateAdminTable`), and the same one the platform's own
+ * branding guard uses (`principalGuards.requireAdministrator`). Reusing it rather than inventing a
+ * second notion of "administrator" is the point — two would drift, and the forgotten one is the hole.
+ *
+ * ⚠️ IT TAKES NO USER ID FROM A CALLER. The id comes from inside a signature; handing this a
+ * caller-supplied id would let anyone claim somebody else's rights.
+ *
+ * ⚠️ FAIL-CLOSED: an unreadable table, a bad id, no exec — all `false`. A gate that failed open on a
+ * database hiccup would hand out the administrator right.
+ */
+export const resolveIsAdministrator = async ({ exec, dbIndex, userId }) => {
+	if (userId === null || userId === undefined || userId === "") return false;
+	if (typeof userId === "object" || typeof userId === "boolean") return false;
+	const id = Number(userId);
+	if (!Number.isInteger(id) || typeof exec !== "function") return false;
+
+	try {
+		const rows = await exec(buildFindAdminForUserSql(id), dbIndex);
+		return Array.isArray(rows) && rows.length > 0;
+	} catch (error) {
+		logger.warn(
+			`[principal] could not read SYS$ADMINISTRATOR for user ${id}: ${error?.message ?? error}. ` +
+				"Treating the caller as NOT an administrator, so any administrative action is refused.",
+		);
+		return false;
+	}
+};

package/envs/defaultEnv.js

@@ -0,0 +1,3 @@
+if (!process.env.NODE_ENV) {
+	process.env.NODE_ENV = "production";
+}

package/logger.js

@@ -30,7 +30,18 @@ const __dirname = path.dirname(fileURLToPath(import.meta.url));
    same trap cliWorkerPool.js documents for the secrets store. */
 export const LOG_DIR = path.join(__dirname, "log");
 
-const isProduction = process.env.NODE_ENV === "production";
+let isProductionCache = null;
+
+export const _resetLoggerCache = () => {
+	isProductionCache = null;
+};
+
+const isProduction = () => {
+	if (isProductionCache === null) {
+		isProductionCache = process.env.NODE_ENV === "production";
+	}
+	return isProductionCache;
+};
 
 /* Under test, log to the console only. A winston File transport opens a write stream on first
    use and holds it, which keeps the event loop alive and makes jest hang after a suite finishes —
@@ -60,7 +71,7 @@ const base = createLogger({
 
 /* debug is the only level that goes quiet in production — error and info still print, exactly as
    the console.* calls they replaced always did. */
-const isEnabled = (level) => !(isProduction && level === "debug");
+const isEnabled = (level) => !(isProduction() && level === "debug");
 
 const emit = (level, args, prefix = null) => {
 	if (!isEnabled(level)) return;

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "biz-a-cli",
-	"version": "2.3.80-15365",
+	"version": "2.3.80-15372",
 	"description": "",
 	"main": "bin/index.js",
 	"type": "module",

package/scheduler/datalib.js

@@ -190,6 +190,15 @@ const normalisePrincipal = (principal) => {
 		   may not read sys$ tables). Frozen for the same reason: a script that could push onto it
 		   would grant itself the very right it is about to check. */
 		groups: Object.freeze(Array.isArray(principal.groups) ? [...principal.groups] : []),
+		/*
+		 * Doc 6 §8.3 — whether the platform found this caller in SYS$ADMINISTRATOR.
+		 *
+		 * ⚠️ `=== true`, NOT a coercion. A script gates a write on this, so "the platform did not say"
+		 * and "not an administrator" must be the same value. A truthy string or a stray 1 arriving
+		 * here would open the gate the field exists to shut — and the object is frozen, so a script
+		 * cannot set it either.
+		 */
+		isAdministrator: principal.isAdministrator === true,
 	});
 };
 

package/worker/cliScriptWorker.js

@@ -2,7 +2,7 @@ import workerpool from "workerpool";
 import { loadCliScript, extractFunctionScript } from "../scheduler/datalib.js";
 import * as db from "../db/db.js";
 import { ensureEntityConfig } from "../engine/domain/entityConfigPrimer.js";
-import { resolveUserGroups } from "../engine/orm/userGroups.js";
+import { resolveUserGroups, resolveIsAdministrator } from "../engine/orm/userGroups.js";
 import { execPostgres } from "../engine/domain/dialect.js";
 import { logger } from "../logger.js";
 
@@ -224,6 +224,14 @@ export const run = async (apiConfig, scriptIdentifier, scriptData, principal = n
 						dbIndex: db.resolveDbIndex(apiConfig),
 						userId: principal.userId,
 					}),
+					/* ⚠️ Whether this caller is a company administrator — SYS$ADMINISTRATOR is a `sys$`
+					   table, so the domain may not ask it directly (Dok. 5 §1–2). Same seam, same
+					   fail-closed shape: unreadable means NOT an administrator. */
+					isAdministrator: await resolveIsAdministrator({
+						exec: execPostgres,
+						dbIndex: db.resolveDbIndex(apiConfig),
+						userId: principal.userId,
+					}),
 				}
 			: null;