biz-a-cli 2.3.80-15375 → 2.3.80-15385

package/bin/app.js

@@ -33,7 +33,6 @@ import {
 	buildPostgresSetAppSql,
 	extractConfigVersion,
 	getChunkedUpsertBlocks,
-	getUpsertBlock,
 	isSemanticVersion,
 	parseConfigForVersion,
 	readConfigRows,
@@ -52,9 +51,11 @@ import {
 	renderApplicationConfig,
 	uploadSourceConfigName,
 } from "../engine/domain/publishedAdditions.js";
+import { guardCcOwnedDomains } from "../engine/cc/ownershipGuard.js";
 import { validateTenancyDeclaration } from "../engine/orm/tenancyDeclaration.js";
 import { logger } from "../logger.js";
 import { findRawColorsInSource } from "../engine/domain/styleColors.js";
+import { resolveMenuLayout } from "../engine/domain/domainNavigation.js";
 
 const getKeyFolderPath = () => {
 	const scriptPath =
@@ -154,6 +155,13 @@ const addCommandOptions = {
 		demandOption: false,
 		default: false,
 	},
+	releaseCc: {
+		describe:
+			"Config mode: upload a domain that Control Center owns, handing it back to SVN. Without it such a domain is refused, so CC edits are never silently overwritten",
+		type: "boolean",
+		demandOption: false,
+		default: false,
+	},
 };
 
 const removeCommandOptions = {
@@ -376,9 +384,6 @@ const APPLICATION_CONFIG_FILE = "application.js";
 /* Doc 6 §8.1 — the application theme source. JSON, because it is DATA that reaches the browser
    via sys$config and must never be evaluated (AC 26). */
 const THEME_CONFIG_FILE = "theme.json";
-/* Parity with the admin editor (appConfig.component.ts executeBlockBodyLimit): the DataSnap
-   `block` call body must stay under 64KB, so an oversized config is upserted in chunks. */
-const EXECUTE_BLOCK_BODY_LIMIT = 2 ** 16;
 
 const findApplicationConfigFile = (fileNames = []) =>
 	fileNames.find(
@@ -404,7 +409,7 @@ const isConfigModeDir = (workingDir, files = null) => {
    flattenSql(), whose `--` comment stripping mangles a config upsert — the whole config is embedded
    as a single-line quoted literal, so the first `--` ANYWHERE in the config text (a JS comment, a
    CSS custom property, an HTML template) silently truncates the rest of the statement and Firebird
-   reports "Unexpected end of command". getUpsertBlock already emits single-line SQL, so there is
+   reports "Unexpected end of command". getChunkedUpsertBlocks already emits single-line SQL, so there is
    nothing to flatten. This mirrors what the admin editor sends (dataService.executeBlock). */
 const executeConfigBlock = async (blockSql, { server, apiPort, dbIndex }) => {
 	const url = `${server}:${apiPort}/fina/rest/TOrmMethod/%22block%22`;
@@ -424,43 +429,9 @@ const executeConfigBlock = async (blockSql, { server, apiPort, dbIndex }) => {
 	return parsed;
 };
 
-const estimateExecuteBlockBodyLength = (blockSql, dbIndex) =>
-	JSON.stringify({
-		_parameters: [
-			JSON.stringify({ dbIndex, method: "block", object: blockSql }),
-		],
-	}).length;
-
-/* One upsert block when it fits, else halve the chunk size until every block fits. Mirrors
-   appConfig.component.ts resolveUpsertBlocksByBodyLimit. */
-const resolveUpsertBlocks = (name, version, content, dbIndex) => {
-	const singleBlock = getUpsertBlock(name, version, content);
-	if (
-		estimateExecuteBlockBodyLength(singleBlock, dbIndex) <=
-		EXECUTE_BLOCK_BODY_LIMIT
-	) {
-		return [singleBlock];
-	}
-
-	let chunkSize = EXECUTE_BLOCK_BODY_LIMIT;
-	while (chunkSize > 0) {
-		const blocks = getChunkedUpsertBlocks(name, version, content, chunkSize);
-		if (
-			blocks.every(
-				(block) =>
-					estimateExecuteBlockBodyLength(block, dbIndex) <=
-					EXECUTE_BLOCK_BODY_LIMIT,
-			)
-		) {
-			return blocks;
-		}
-		chunkSize = Math.floor(chunkSize / 2);
-	}
-
-	throw new Error(
-		`Failed to split "${name}" into executeBlock-sized chunks.`,
-	);
-};
+/* The upsert blocks for one config. getChunkedUpsertBlocks sizes them by the finished SQL in bytes,
+   under Firebird's 65,535-byte statement limit (engine/domain/finaBlocks.js) — one block when it fits. */
+const resolveUpsertBlocks = (name, version, content) => getChunkedUpsertBlocks(name, version, content);
 
 /* PURE-ish (reads files, no network): resolve every config in the directory and validate the
    WHOLE set before anything is uploaded, so a stray lib or a typo'd metadata can never leave a
@@ -727,6 +698,7 @@ async function uploadConfigs({
 	sub,
 	publish = false,
 	forceFull = false,
+	releaseCc = false,
 	serverMode = "prod",
 }) {
 	/* Phase B2: ask biz-a for this tenant's database coordinates before anything reads the
@@ -749,6 +721,19 @@ async function uploadConfigs({
 		timeout: 60000,
 	};
 
+	/*
+	 * Doc 1 step 0a.2 — ⚠️ one owner at a time. A domain Control Center owns is refused BEFORE anything
+	 * is saved (the application config included), so a refused upload writes nothing at all.
+	 */
+	if (isPostgresIndex(dbIndex)) {
+		const { released } = await guardCcOwnedDomains({
+			exec: (sql) => execPostgres(sql, dbIndex),
+			domainNames: domains.map(({ name }) => name),
+			releaseCc,
+		});
+		if (released.length > 0) logger.info(`handed back to SVN (no longer owned by Control Center): ${released.join(", ")}`);
+	}
+
 	const saveOne = async ({ name, version, content }) => {
 		/* A PostgreSQL index writes straight to its pool. No chunking: the block splitting below
 		   exists only because the FINA HTTP body has a size limit, which a direct connection does
@@ -922,13 +907,39 @@ const parseApplicationConfigData = (rawConfig) => {
 	}
 };
 
-const resolveAppDisplayNameFromApplicationConfig = async ({
+/*
+ * What the stored APPLICATION_CONFIG contributes to the SYS$APPS metadata: the display name (which
+ * also keys the row) and the menu layout the client shell draws.
+ */
+const resolveAppMetadataFromApplicationConfig = async ({
 	server,
 	apiPort,
 	dbIndex,
 	sub,
 }) => {
-	/* A PostgreSQL tenant reads SYS$CONFIG directly. This must not silently return "": the
+	const applicationConfig = await readStoredApplicationConfig({
+		server,
+		apiPort,
+		dbIndex,
+		sub,
+	});
+	const displayName = applicationConfig?.metadata?.name;
+	const declaredLayout = applicationConfig?.navigation?.layout;
+	const menuLayout = resolveMenuLayout(applicationConfig);
+	if (declaredLayout != null && menuLayout == null) {
+		logger.warn(
+			`[Add] navigation.layout ${JSON.stringify(declaredLayout)} is not one of ` +
+				`"horizontal" or "vertical"; the client keeps its default menu.`,
+		);
+	}
+	return {
+		displayName: typeof displayName === "string" ? displayName.trim() : "",
+		menuLayout,
+	};
+};
+
+const readStoredApplicationConfig = async ({ server, apiPort, dbIndex, sub }) => {
+	/* A PostgreSQL tenant reads SYS$CONFIG directly. This must not silently come back empty: the
 	   display name keys the SYS$APPS row, so falling back to the random bundle name would insert
 	   a fresh app row on every publish instead of updating the existing one. */
 	if (isPostgresIndex(dbIndex)) {
@@ -937,15 +948,14 @@ const resolveAppDisplayNameFromApplicationConfig = async ({
 				buildPostgresApplicationConfigLookupSql(),
 				dbIndex,
 			);
-			const displayName = parseApplicationConfigData(rows?.[0]?.data)?.metadata?.name;
-			return typeof displayName === "string" ? displayName.trim() : "";
+			return parseApplicationConfigData(rows?.[0]?.data);
 		} catch {
-			return "";
+			return null;
 		}
 	}
 
 	if (typeof axios.request !== "function") {
-		return "";
+		return null;
 	}
 
 	const baseUrl = "fina/rest/TOrmMethod/%22list%22";
@@ -989,18 +999,16 @@ const resolveAppDisplayNameFromApplicationConfig = async ({
 			return name === "APPLICATION_CONFIG";
 		});
 		if (!applicationConfigRow) {
-			return "";
+			return null;
 		}
 
-		const applicationConfig = parseApplicationConfigData(
+		return parseApplicationConfigData(
 			applicationConfigRow?.["SYS$CONFIG.DATA"] ??
 				applicationConfigRow?.DATA ??
 				applicationConfigRow?.data,
 		);
-		const displayName = applicationConfig?.metadata?.name;
-		return typeof displayName === "string" ? displayName.trim() : "";
 	} catch {
-		return "";
+		return null;
 	}
 };
 
@@ -1015,6 +1023,7 @@ async function addApp({
 	body = null,
 	publish = false,
 	forceFull = false,
+	releaseCc = false,
 	serverMode = "prod",
 	/* Extra directories whose DOMAIN configs upload alongside this one's (see --include). */
 	include = [],
@@ -1071,6 +1080,7 @@ async function addApp({
 				sub,
 				publish,
 				forceFull,
+				releaseCc,
 				serverMode,
 			});
 		}
@@ -1161,8 +1171,8 @@ async function addApp({
 				: `${server}:${apiPort}/${baseUrl}`;
 
 			const headers = { "Content-Type": "text/plain" };
-			const appDisplayName =
-				await resolveAppDisplayNameFromApplicationConfig({
+			const { displayName: appDisplayName, menuLayout } =
+				await resolveAppMetadataFromApplicationConfig({
 					server,
 					apiPort,
 					dbIndex,
@@ -1172,6 +1182,11 @@ async function addApp({
 			if (useApplicationConfigName && appDisplayName.length > 0) {
 				keys.metadata["name"] = appDisplayName;
 			}
+			/* navigation.layout -> how the client shell draws this app's menu. Only a value it
+			   understands is copied; without one the metadata stays exactly as before. */
+			if (useApplicationConfigName && menuLayout) {
+				keys.metadata["menuLayout"] = menuLayout;
+			}
 			const uploadAppName = normalizeAppName(
 				(useApplicationConfigName ? appDisplayName : "") || bundleName,
 			);
@@ -1274,6 +1289,7 @@ async function runUnitTests(options) {
 					files: options.files,
 					publish: options.publish,
 					forceFull: options.forceFull,
+					releaseCc: options.releaseCc,
 					serverMode: options.serverMode,
 				});
 			} else {
@@ -1307,6 +1323,7 @@ const buildCli = () =>
 						files: commandOptions.files,
 						publish: commandOptions.publish,
 						forceFull: commandOptions.forceFull,
+						releaseCc: commandOptions.releaseCc,
 						serverMode: commandOptions.serverMode,
 						include: commandOptions.include,
 					});

package/bin/directHubEvent.js

@@ -6,36 +6,109 @@ import { CLIENT_ROOM } from "../message-broker/clientEmitter.js";
 import { ClientEmitter } from "../message-broker/clientEmitter.js";
 import { joinExtRooms } from "../engine/ext/esb.js";
 import { extClientListener } from "../engine/ext/socketListener.js";
+import { io as ioClient } from "socket.io-client";
+
 import { prefixedLogger } from "../logger.js";
-import { APP_URL, TEST_URL, ADMIN_URL, TEST_ADMIN_URL } from "../envs/hosts.js";
+import { APP_URL, TEST_URL, ADMIN_URL, TEST_ADMIN_URL, CC_URL } from "../envs/hosts.js";
 
 const logger = prefixedLogger("[DirectHub]");
 
 export async function localhostTunnel(port, notifier) {
 	let tunnelUrl = "";
 	let qt = QuickTunnel.quick("127.0.0.1:" + port);
+	let isReconnecting = false;
+	let loopbackSocket = null;
+
+	function destroyLoopback() {
+		if (loopbackSocket) {
+			loopbackSocket.disconnect();
+			loopbackSocket.close();
+			loopbackSocket = null;
+		}
+	}
+
+	const gracefulProcessShutdown = () => {
+		destroyLoopback();
+		if (qt && typeof qt.stop === "function") {
+			try {
+				qt.stop();
+			} catch (e) {}
+		}
+	};
+	process.once("SIGINT", gracefulProcessShutdown);
+	process.once("SIGTERM", gracefulProcessShutdown);
+
 	function reconnectTunnel() {
+		process.off("SIGINT", gracefulProcessShutdown);
+		process.off("SIGTERM", gracefulProcessShutdown);
+		destroyLoopback();
+
+		if (isReconnecting) return;
+		isReconnecting = true;
+
+		if (qt && typeof qt.stop === "function") {
+			try {
+				qt.stop();
+			} catch (e) {}
+		}
+
 		setTimeout(() => {
 			qt = localhostTunnel(port, notifier);
 		}, RECONNECT_SOCKET_DELAY);
 	}
+
+	function startDirectHubHeartbeat() {
+		if (loopbackSocket && loopbackSocket.connected) return;
+
+		if (!tunnelUrl || !tunnelUrl.includes("trycloudflare.com")) {
+			logger.warn(`Invalid remote URL detected. Heartbeat aborted.`);
+			return;
+		}
+
+		destroyLoopback();
+
+		loopbackSocket = ioClient(tunnelUrl, {
+			query: { isLoopback: true },
+			transports: ["websocket"],
+			reconnectionDelay: 5000,
+			reconnectionAttempts: 3,
+		});
+
+		loopbackSocket.on("connect", () => {
+			logger.debug(
+				`Heartbeat established via public internet. Cloudflare idle-drop prevented.`,
+			);
+		});
+
+		loopbackSocket.io.on("reconnect_failed", () => {
+			logger.warn(
+				`Heartbeat failed to reach Edge. Ghost tunnel confirmed. Terminating...`,
+			);
+			notifier("");
+			destroyLoopback();
+			if (qt && typeof qt.stop === "function")
+				try {
+					qt.stop();
+				} catch (e) {}
+		});
+	}
+
 	qt.on("url", (qtUrl) => {
 		tunnelUrl = qtUrl;
 	})
 		.on("connected", (conn) => {
 			notifier(tunnelUrl);
 			logger.info(`Connected to Direct Hub at public URL ${tunnelUrl}`);
+			startDirectHubHeartbeat();
 		})
 		.on("disconnected", (conn) => {
 			notifier("");
-			qt.stop();
 			logger.info(
 				`Disconnected from edge node. Awaiting native reconnect...`,
 			);
 		})
 		.on("error", (err) => {
 			notifier("");
-			qt.stop();
 			logger.error(
 				`Tunnel error: ${err.message || err}. Awaiting native reconnect...`,
 			);
@@ -91,7 +164,10 @@ export function directHubEvent(serverSocket, argv) {
 				if (clientInstanceId) {
 					clientSocket.join(clientInstanceId);
 					clientSocket.on("ESB_ACK", (msgId) => {
-						ClientEmitter.acknowledgeMessage(msgId, clientInstanceId);
+						ClientEmitter.acknowledgeMessage(
+							msgId,
+							clientInstanceId,
+						);
 					});
 				}
 
@@ -108,6 +184,8 @@ export function directHubEvent(serverSocket, argv) {
 		} else if (clientSocket.handshake.query.isDeploy) {
 			setConnectListeners(clientSocket);
 			deploymentListenerForVSCode(clientSocket, argv);
+		} else if (clientSocket.handshake.query.isLoopback) {
+			setConnectListeners(clientSocket);
 		} else {
 			clientSocket.disconnect();
 		}
@@ -125,10 +203,12 @@ export function createSocketServer(httpServer, cliIpAddress = "127.0.0.1") {
 				TEST_URL,
 				ADMIN_URL,
 				TEST_ADMIN_URL,
+				CC_URL,
 				// biz-a.id is still served alongside biz-a.app, so its browser origins stay allowed.
 				"https://biz-a.id",
 				"https://test.biz-a.id",
 				"https://admin.biz-a.id",
+				"https://cc.biz-a.id",
 				// NOT the wildcard (see above):
 				// /\.biz-a\.id$/,
 				"vscode-file://vscode-app",
@@ -139,8 +219,10 @@ export function createSocketServer(httpServer, cliIpAddress = "127.0.0.1") {
 							`http://${cliIpAddress}:4200`,
 							"http://localhost:4200",
 							"http://localhost",
+							// Control Center (bcc) dev server, beside the client on 4200.
+							"http://localhost:4300",
 						]
-					: [`http://${cliIpAddress}:4200`, "http://localhost:4200"],
+					: [`http://${cliIpAddress}:4200`, "http://localhost:4200", "http://localhost:4300"],
 			),
 		},
 		maxHttpBufferSize: 1e8, // 100 MB

package/bin/hub.js

@@ -121,6 +121,15 @@ const argv = yargs(process.argv.slice(2))
 		   rebuilt to send a principal. A tenant opts in explicitly. */
 		default: "observe",
 	})
+	.options("ruleMode", {
+		describe:
+			"Doc 1 0b.2: DOMAIN_RULE guards run their rule script. 'observe' logs what a rule would block and lets it pass; 'enforce' blocks.",
+		type: "string",
+		choices: ["observe", "enforce"],
+		/* ⚠️ The DEFAULT STAYS `observe`, as for principalMode: a tenant switches to enforce once its logs
+		   show its rules behave. */
+		default: "observe",
+	})
 	.options("services", {
 		describe:
 			"Comma-separated list of engine jobs this agent handles (e.g., 'BPM,EMAIL')",

package/bin/hubEvent.js

@@ -16,7 +16,8 @@ import { extDeriveRoomsHandler } from "../engine/ext/esb.js";
 import { makeExtReqHandler } from "../engine/ext/hubProxy.js";
 
 import { logger } from "../logger.js";
-import { routeApiRequest } from "../engine/orm/apiRoute.js";
+import { routeApiRequest, parseAuthRequest, withFinaLoginPrincipal } from "../engine/orm/apiRoute.js";
+import { tenantSqlFor } from "../engine/orm/tenantSql.js";
 import { ensureEntityConfig } from "../engine/domain/entityConfigPrimer.js";
 import { runAsPrincipal, runTrusted, ACTIVE_TENANT_NOT_HELD } from "../engine/orm/tenantContext.js";
 import { resolveRequestScope, SESSION_NOT_USABLE } from "../engine/orm/requestScope.js";
@@ -24,6 +25,9 @@ import { createSessionStore } from "../engine/orm/sessionStore.js";
 import { resolveUserTenancy } from "../engine/orm/tenantResolution.js";
 import { buildUserTenantSql } from "../engine/orm/finaAuth.js";
 import { authorizeRequest, principalForCliScript } from "../security/internalPrincipal.js";
+import { whoami } from "../security/whoami.js";
+import { runDraftAction } from "../engine/cc/draftStore.js";
+import { createPgDraftRepo } from "../engine/cc/pgRepo.js";
 import {
 	readUserPreferences,
 	writeUserPreferences,
@@ -483,6 +487,14 @@ const handleCliCommand = async (data, cb, argv) => {
 			case "status":
 				cb(null, status(argv));
 				break;
+			/*
+			 * Doc 1 step 0a.1 — who THIS CLI verified is asking. Control Center checks it before
+			 * offering any editing: a successful login at biz-a does not prove the principal
+			 * verifies here. Headers only; see security/whoami.js.
+			 */
+			case "whoami":
+				cb(null, whoami(data.headers, { mode: argv["principalMode"] || "observe" }));
+				break;
 			case "runcliscript":
 				const liveTriggerPayload = {
 					arguments: argv,
@@ -542,16 +554,19 @@ const handleCliCommand = async (data, cb, argv) => {
 				const prefPrincipal = principalForCliScript(data.headers, {
 					mode: argv["principalMode"] || "observe",
 				});
-				const prefExec = (sql) => execPostgres(sql, argv["dbindex"]);
+				/* Doc 6 on Firebird (2026-10-01) — the tenant seam runs this on either engine. */
+				const prefDb = tenantSqlFor(argv["dbindex"]);
 				const prefs =
 					data.action === "write"
 						? await writeUserPreferences({
-								exec: prefExec,
+								exec: prefDb.exec,
+								execStatements: prefDb.atomic,
+								sql: prefDb,
 								principal: prefPrincipal,
 								patch: data.patch,
 							})
 						: await readUserPreferences({
-								exec: prefExec,
+								exec: prefDb.exec,
 								principal: prefPrincipal,
 							});
 				cb(null, { success: true, data: prefs });
@@ -573,12 +588,15 @@ const handleCliCommand = async (data, cb, argv) => {
 				const themePrincipal = principalForCliScript(data.headers, {
 					mode: argv["principalMode"] || "observe",
 				});
-				const themeExec = (sql) => execPostgres(sql, argv["dbindex"]);
+				/* Doc 6 on Firebird (2026-10-01) — one transaction on either engine: a PostgreSQL
+				   transaction, or ONE Firebird EXECUTE BLOCK (engine/orm/tenantSql.js). */
+				const themeDb = tenantSqlFor(argv["dbindex"]);
+				const themeExec = themeDb.exec;
 				if (data.action === "write") {
 					const saved = await writeCompanyTheme({
 						exec: themeExec,
-						execStatements: (statements) =>
-							execPostgresStatements(statements, argv["dbindex"]),
+						execStatements: themeDb.atomic,
+						sql: themeDb,
 						principal: themePrincipal,
 						theme: data.theme,
 					});
@@ -612,14 +630,17 @@ const handleCliCommand = async (data, cb, argv) => {
 				const logoPrincipal = principalForCliScript(data.headers, {
 					mode: argv["principalMode"] || "observe",
 				});
-				const logoExec = (sql) => execPostgres(sql, argv["dbindex"]);
-				const logoStatements = (statements) =>
-					execPostgresStatements(statements, argv["dbindex"]);
+				/* Doc 6 on Firebird (2026-10-01) — the tenant seam; on Firebird a logo is staged in
+				   blocks (runBlocks) and swapped in atomically (companyLogo.js). */
+				const logoDb = tenantSqlFor(argv["dbindex"]);
+				const logoExec = logoDb.exec;
 
 				if (data.action === "write") {
 					const saved = await writeCompanyLogo({
 						exec: logoExec,
-						execStatements: logoStatements,
+						execStatements: logoDb.atomic,
+						sql: logoDb,
+						runBlocks: logoDb.runBlocks,
 						principal: logoPrincipal,
 						dataUrl: data.dataUrl,
 					});
@@ -633,7 +654,8 @@ const handleCliCommand = async (data, cb, argv) => {
 				} else if (data.action === "clear") {
 					const cleared = await clearCompanyLogo({
 						exec: logoExec,
-						execStatements: logoStatements,
+						execStatements: logoDb.atomic,
+						sql: logoDb,
 						principal: logoPrincipal,
 					});
 					cb(null, { success: cleared.ok, problems: cleared.problems, data: null });
@@ -645,6 +667,34 @@ const handleCliCommand = async (data, cb, argv) => {
 				}
 				break;
 			}
+			/*
+			 * Doc 1 step 0a.2 — Control Center drafts (engine/cc/draftStore.js). Administrators only,
+			 * from the principal in the HEADERS; a draft never reaches SYS$CONFIG or SYS$BPM_* (only
+			 * publish may). A refusal the user can act on is returned as `problems`, as companytheme
+			 * does; `code` carries CC_DRAFT_STALE for a save made from an old revision.
+			 */
+			case "ccdraft": {
+				const ccResult = await runDraftAction({
+					repo: createPgDraftRepo({
+						exec: (sql) => execPostgres(sql, argv["dbindex"]),
+						execStatements: (statements) => execPostgresStatements(statements, argv["dbindex"]),
+					}),
+					principal: principalForCliScript(data.headers, { mode: argv["principalMode"] || "observe" }),
+					isPostgres: isPostgresIndex(argv["dbindex"]),
+					action: data.action,
+					args: data.args,
+					/* 0b.3: publish writes SYS$CONFIG, SYS$APPS and SYS$BPM_* through the existing pipelines —
+					   loaded only for a publish (appConfig.js imports this file, and must not pull the BPM engine in). */
+					pipelines: data.action === "publish" ? ((m) => (userId) => m.createLivePipelines({ argv, userId }))(await import("../engine/cc/livePipelines.js")) : undefined,
+				});
+				cb(null, {
+					success: ccResult.ok,
+					...(ccResult.code ? { code: ccResult.code } : {}),
+					problems: ccResult.problems ?? [],
+					data: ccResult.data ?? null,
+				});
+				break;
+			}
 			case "runextcliscript": {
 				// External-access op invoker — enforces the capability boundary (dispatch.js),
 				// unlike raw `runcliscript`. Safe to expose: no valid token -> UNAUTHENTICATED.
@@ -836,6 +886,11 @@ export const clientListener = (socket, argv, via = "?") => {
 							maxContentLength: Infinity,
 						})
 						.then((response) => {
+							/* Doc 6 on Firebird — a login FINA answered gets its principal, on this
+							   transport as on the HTTP one (finaEndpoint.js); see apiRoute.js. */
+							if (parseAuthRequest(reqData.path, reqBody)) {
+								response.data = withFinaLoginPrincipal(response.data, Number(argv["dbindex"]));
+							}
 							resCB(null, socketResponse(response));
 						})
 						.catch((error) => {

package/config/secrets.json

@@ -1,21 +1,27 @@
 {
-	"supertail.ledger": {
-		"currentKeyId": "st_ledger_v1",
-		"keys": {
-			"st_ledger_v1": "CdgBjUShgx7t9Wo/dfSOOJAHjHOD5KwAlRi6xwDMEfs="
-		}
-	},
-	"supertail.session": "3jepiFkSV6HxlbCSWiGqYWpmfapYxLHeHY/YgxyFQ8Q=",
-	"ext.capability": {
-		"currentKeyId": "ext_v1",
-		"keys": {
-			"ext_v1": "f4PLkG2QLn6OFyv0IlqWhq3tlSGs2VAyaYDM4kDKLZ8="
-		}
-	},
-	"internal.principal": {
-		"currentKeyId": "ip_v1",
-		"keys": {
-			"ip_v1": "GsoRIpPG0D7c0q+AtmMNrtKpZ104Uv4/tfmLHtAtbIM="
-		}
-	}
+  "supertail.ledger": {
+    "currentKeyId": "st_ledger_v1",
+    "keys": {
+      "st_ledger_v1": "CdgBjUShgx7t9Wo/dfSOOJAHjHOD5KwAlRi6xwDMEfs="
+    }
+  },
+  "supertail.session": "3jepiFkSV6HxlbCSWiGqYWpmfapYxLHeHY/YgxyFQ8Q=",
+  "ext.capability": {
+    "currentKeyId": "ext_v1",
+    "keys": {
+      "ext_v1": "f4PLkG2QLn6OFyv0IlqWhq3tlSGs2VAyaYDM4kDKLZ8="
+    }
+  },
+  "internal.principal": {
+    "currentKeyId": "ip_v1",
+    "keys": {
+      "ip_v1": "GsoRIpPG0D7c0q+AtmMNrtKpZ104Uv4/tfmLHtAtbIM="
+    }
+  },
+  "biza.ai.studiob": {
+    "currentKeyId": "ai_v1",
+    "keys": {
+      "ai_v1": "QxE6YiZdcjVRK1UbWGRMLuEgBKM3zFUte9euFldduZc="
+    }
+  }
 }

package/db/db.js

@@ -115,11 +115,11 @@ export const list = async (payload, config = {}) => {
 };
 
 /* Refused on PostgreSQL — the bodies are Firebird PSQL. See executor.js for the reasoning. */
-export const executeBlock = async (sqlString, config = {}) => {
+export const executeBlock = async (sqlString, config = {}, options = {}) => {
 	if (onPostgres(config)) {
 		return await executor.executeBlock(sqlString, resolveDbIndex(config));
 	}
-	return await adapter.executeBlock(sqlString, config);
+	return await adapter.executeBlock(sqlString, config, options);
 };
 
 /* An optimistic claim: flip one row's status if it is still in an expected state, and report