@memberjunction/server 5.38.0 → 5.39.0

package/src/generic/__tests__/FireAndForgetHeartbeat.test.ts

@@ -0,0 +1,99 @@
+import 'reflect-metadata';
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
+import { PubSubEngine } from 'type-graphql';
+import {
+    startLivenessPulse,
+    DEFAULT_PULSE_INTERVAL_MS,
+    HEARTBEAT_MESSAGE_TYPE,
+} from '../FireAndForgetHeartbeat';
+import { PUSH_STATUS_UPDATES_TOPIC } from '../PushStatusResolver';
+
+/** Minimal PubSubEngine stub capturing publish calls. */
+function makePubSub() {
+    const publish = vi.fn().mockResolvedValue(undefined);
+    return { publish } as unknown as PubSubEngine & { publish: ReturnType<typeof vi.fn> };
+}
+
+function parseLastMessage(pubSub: { publish: ReturnType<typeof vi.fn> }) {
+    const [topic, payload] = pubSub.publish.mock.calls[pubSub.publish.mock.calls.length - 1];
+    return { topic, payload, parsed: JSON.parse(payload.message) };
+}
+
+describe('startLivenessPulse', () => {
+    beforeEach(() => {
+        vi.useFakeTimers();
+    });
+
+    afterEach(() => {
+        vi.useRealTimers();
+        vi.restoreAllMocks();
+    });
+
+    it('does not publish before the first interval elapses', () => {
+        const pubSub = makePubSub();
+        startLivenessPulse({ pubSub, sessionId: 's1', resolver: 'TestResolver' });
+        vi.advanceTimersByTime(DEFAULT_PULSE_INTERVAL_MS - 1);
+        expect(pubSub.publish).not.toHaveBeenCalled();
+    });
+
+    it('publishes a heartbeat on the push-status topic each interval', () => {
+        const pubSub = makePubSub();
+        startLivenessPulse({ pubSub, sessionId: 's1', resolver: 'TestResolver', intervalMs: 1000 });
+
+        vi.advanceTimersByTime(3000);
+
+        expect(pubSub.publish).toHaveBeenCalledTimes(3);
+        const { topic, payload, parsed } = parseLastMessage(pubSub);
+        expect(topic).toBe(PUSH_STATUS_UPDATES_TOPIC);
+        expect(payload.sessionId).toBe('s1');
+        expect(parsed.resolver).toBe('TestResolver');
+        expect(parsed.type).toBe(HEARTBEAT_MESSAGE_TYPE);
+    });
+
+    it('includes the enriched status snapshot from readStatus', () => {
+        const pubSub = makePubSub();
+        startLivenessPulse({
+            pubSub,
+            sessionId: 's1',
+            resolver: 'RunAIAgentResolver',
+            intervalMs: 1000,
+            readStatus: () => ({ runId: 'run-123', status: 'Running', currentStep: 'Prompt' }),
+        });
+
+        vi.advanceTimersByTime(1000);
+
+        const { parsed } = parseLastMessage(pubSub);
+        expect(parsed.data).toEqual({ runId: 'run-123', status: 'Running', currentStep: 'Prompt' });
+    });
+
+    it('publishes an empty data object when readStatus throws (loop survives)', () => {
+        const pubSub = makePubSub();
+        startLivenessPulse({
+            pubSub,
+            sessionId: 's1',
+            resolver: 'RunAIAgentResolver',
+            intervalMs: 1000,
+            readStatus: () => {
+                throw new Error('transient read failure');
+            },
+        });
+
+        vi.advanceTimersByTime(2000);
+
+        expect(pubSub.publish).toHaveBeenCalledTimes(2);
+        const { parsed } = parseLastMessage(pubSub);
+        expect(parsed.data).toEqual({});
+    });
+
+    it('stops publishing after stop() is called', () => {
+        const pubSub = makePubSub();
+        const handle = startLivenessPulse({ pubSub, sessionId: 's1', resolver: 'TestResolver', intervalMs: 1000 });
+
+        vi.advanceTimersByTime(2000);
+        expect(pubSub.publish).toHaveBeenCalledTimes(2);
+
+        handle.stop();
+        vi.advanceTimersByTime(5000);
+        expect(pubSub.publish).toHaveBeenCalledTimes(2);
+    });
+});

package/src/index.ts

@@ -4,7 +4,7 @@ dotenv.config({ quiet: true });
 
 import { expressMiddleware } from '@as-integrations/express5';
 import { mergeSchemas } from '@graphql-tools/schema';
-import { Metadata, DatabasePlatform, SetProvider, StartupManager as StartupManagerImport, BaseEntity, BaseEntityEvent, RunView } from '@memberjunction/core';
+import { Metadata, DatabasePlatform, SetProvider, StartupManager as StartupManagerImport, BaseEntity, BaseEntityEvent, RunView, DatabaseProviderBase } from '@memberjunction/core';
 import { resolveDbPlatformFromEnv } from '@memberjunction/generic-database-provider';
 import { MJGlobal, MJEventType, UUIDsEqual, ShutdownRegistry } from '@memberjunction/global';
 import { setupSQLServerClient, SQLServerDataProvider, SQLServerProviderConfigData, UserCache } from '@memberjunction/sqlserver-dataprovider';
@@ -30,6 +30,8 @@ import { default as jwt } from 'jsonwebtoken';
 import { contextFunction, createUnifiedAuthMiddleware, getUserPayload } from './context.js';
 import { UserPayload } from './types.js';
 import { requireSystemUserDirective, publicDirective } from './directives/index.js';
+import { variablesLoggingMiddleware } from './logging/variablesLoggingMiddleware.js';
+import { auditResolversForUndecoratedArgs } from './logging/bootAudit.js';
 import createMSSQLConfig from './orm.js';
 import { setupRESTEndpoints } from './rest/setupRESTEndpoints.js';
 import { createOAuthCallbackHandler } from './rest/OAuthCallbackHandler.js';
@@ -45,7 +47,9 @@ import { GetAPIKeyEngine } from '@memberjunction/api-keys';
 import { RedisLocalStorageProvider } from '@memberjunction/redis-provider';
 import { GenericDatabaseProvider } from '@memberjunction/generic-database-provider';
 import { PubSubManager } from './generic/PubSubManager.js';
-import { ClientToolRequestManager } from '@memberjunction/ai-agents';
+import { IntegrationProgressEmitter } from '@memberjunction/integration-progress-artifacts';
+import { PublishIntegrationProgress } from './resolvers/IntegrationProgressResolver.js';
+import { ClientToolRequestManager, AgentRunWatchdog } from '@memberjunction/ai-agents';
 import { CACHE_INVALIDATION_TOPIC } from './generic/CacheInvalidationResolver.js';
 import { ConnectorFactory, IntegrationEngine, IntegrationSyncOptions } from '@memberjunction/integration-engine';
 import { CronExpressionHelper } from '@memberjunction/scheduling-engine';
@@ -83,6 +87,7 @@ export { configInfo, DEFAULT_SERVER_CONFIG } from './config.js';
 export { ServerExtensionLoader, BaseServerExtension } from '@memberjunction/server-extensions-core';
 export type { ServerExtensionConfig, ExtensionInitResult, ExtensionHealthResult } from '@memberjunction/server-extensions-core';
 export * from './directives/index.js';
+export { NoLog, hasNoLogParameter, getNoLogFields } from './logging/NoLog.js';
 export * from './entitySubclasses/MJEntityPermissionEntityServer.server.js';
 export * from './types.js';
 export {
@@ -107,6 +112,7 @@ export * from './resolvers/SearchKnowledgeStreamResolver.js';
 export * from './resolvers/AvailableSearchProvidersResolver.js';
 export * from './resolvers/FetchEntityVectorsResolver.js';
 export * from './resolvers/PipelineProgressResolver.js';
+export * from './resolvers/IntegrationProgressResolver.js';
 export * from './resolvers/ClientToolRequestResolver.js';
 export * from './resolvers/AutotagPipelineResolver.js';
 export * from './resolvers/TagGovernanceResolver.js';
@@ -150,6 +156,7 @@ export * from './resolvers/FileResolver.js';
 export * from './resolvers/InfoResolver.js';
 export * from './resolvers/PotentialDuplicateRecordResolver.js';
 export * from './resolvers/RunTestResolver.js';
+export * from './resolvers/SearchEntitiesResolver.js';
 export * from './resolvers/UserFavoriteResolver.js';
 export * from './resolvers/UserResolver.js';
 export * from './resolvers/UserViewResolver.js';
@@ -294,6 +301,86 @@ export const serve = async (resolverPaths: Array<string>, app: Application = cre
       return origExecuteSQLWithPool.call(this, pool, query, parameters, contextUser);
     };
 
+    // Set up CodeGen-credentialed provider + in-process CodeGen runner for RSU (PostgreSQL).
+    // Without this, RuntimeSchemaManager has no injected runner and falls back to spawning a
+    // child-process CodeGen. On Postgres that child path is slow, its output is buffered (so
+    // progress is unobservable), and a non-responding advancedGen AI pass hangs it indefinitely
+    // — which leaves association/junction CRUD functions un-regenerated and blocks the sync.
+    // Running in-process keeps CodeGen inside the MJAPI event loop where it is observable and
+    // bounded by advanced_generation's per-call timeout + circuit breaker. Mirrors the SQL
+    // Server path below (the runner is required for BOTH platforms).
+    const pgCodegenUser = process.env.CODEGEN_DB_USERNAME;
+    const pgCodegenPass = process.env.CODEGEN_DB_PASSWORD;
+    if (pgCodegenUser && pgCodegenPass) {
+      try {
+        const codegenPgPool = new pg.default.Pool({
+          host: pgHost,
+          port: pgPort,
+          user: pgCodegenUser,
+          password: pgCodegenPass,
+          database: pgDatabase,
+          max: 10,
+        });
+        const codegenTestClient = await codegenPgPool.connect();
+        await codegenTestClient.query('SELECT 1');
+        codegenTestClient.release();
+
+        const { RuntimeSchemaManager } = await import('@memberjunction/schema-engine');
+        const codegenPgConfigData = new PostgreSQLProviderConfigData(
+          { Host: pgHost, Port: pgPort, Database: pgDatabase, User: pgCodegenUser, Password: pgCodegenPass },
+          mj_core_schema,
+          cacheRefreshInterval / 1000, // ms → seconds
+        );
+        const codegenPgProvider = new PostgreSQLDataProvider();
+        await codegenPgProvider.Config(codegenPgConfigData); // separate pool (per-instance manager); does NOT touch the global API provider
+        RuntimeSchemaManager.Instance.SetDDLProvider(codegenPgProvider);
+        console.log('RSU DDL provider initialized with CodeGen credentials (PostgreSQL).');
+
+        // Set up in-process CodeGen runner for RSU
+        try {
+          const { RunCodeGenBase } = await import('@memberjunction/codegen-lib');
+          const { PostgreSQLCodeGenConnection } = await import('@memberjunction/codegen-lib/dist/Database/providers/postgresql/PostgreSQLCodeGenConnection.js');
+
+          const codegenConnection = new PostgreSQLCodeGenConnection(codegenPgPool);
+          const codegenCurrentUser = UserCache.Instance.Users.find(u => u.Type?.trim().toLowerCase() === 'owner') ?? UserCache.Instance.Users[0];
+
+          const codegenDataSource = {
+            provider: codegenPgProvider,
+            connection: codegenConnection,
+            currentUser: codegenCurrentUser,
+            connectionInfo: `${pgHost}:${pgPort}/${pgDatabase} (CodeGen)`,
+          };
+
+          const runObject = MJGlobal.Instance.ClassFactory.CreateInstance(RunCodeGenBase) as InstanceType<typeof RunCodeGenBase>;
+
+          const rsuWorkDir = process.env.RSU_WORK_DIR || process.cwd();
+          RuntimeSchemaManager.Instance.SetCodeGenRunner({
+            RunInProcess: (skipDB) => runObject.RunInProcess(codegenDataSource, skipDB, rsuWorkDir),
+          });
+          console.log('RSU in-process CodeGen runner initialized (PostgreSQL).');
+
+          // Inject CodeGen output paths for targeted git staging
+          const { initializeConfig } = await import('@memberjunction/codegen-lib');
+          const cgConfig = initializeConfig(rsuWorkDir);
+          const outputPaths = (cgConfig.output ?? []).map((o: { directory: string }) => o.directory);
+          RuntimeSchemaManager.Instance.SetCodeGenOutputPaths(outputPaths);
+          console.log(`RSU CodeGen output paths: ${outputPaths.length} directories configured.`);
+
+          // Point RSU's soft PK/FK writer at the SAME file CodeGen reads (mj.config.cjs
+          // `additionalSchemaInfo`), or RSU writes soft PKs to its own default path while
+          // CodeGen reads a different one and skips integration tables with "No primary key found".
+          if (cgConfig.additionalSchemaInfo) {
+            RuntimeSchemaManager.Instance.SetAdditionalSchemaInfoPath(cgConfig.additionalSchemaInfo);
+            console.log(`RSU additionalSchemaInfo path: ${cgConfig.additionalSchemaInfo}`);
+          }
+        } catch (codegenErr) {
+          console.warn(`RSU in-process CodeGen runner setup failed (will fall back to child process): ${(codegenErr as Error).message}`);
+        }
+      } catch (err) {
+        console.warn(`RSU DDL provider setup failed (PostgreSQL; RSU will fall back to default provider): ${(err as Error).message}`);
+      }
+    }
+
     const md = new Metadata(); // global-provider-ok: bootstrap
     console.log(`Data Source has been initialized. ${md?.Entities ? md.Entities.length : 0} entities loaded.`);
   } else {
@@ -348,6 +435,13 @@ export const serve = async (resolverPaths: Array<string>, app: Application = cre
           ...createMSSQLConfig(),
           user: codegenUser,
           password: codegenPass,
+          // CodeGen's metadata management ("manage entity fields", schema refresh) runs
+          // long-running queries across ALL entities. The default API requestTimeout (30s)
+          // is far too short at scale — e.g. a large integration Create-Tables pushing the
+          // schema to 400+ entities times out mid-refresh and leaves entity-field metadata
+          // only partially applied. This pool is used ONLY for CodeGen/DDL (never to serve
+          // API requests), so a generous timeout is safe. Mirrors MJCLI's baseline connection.
+          requestTimeout: 600000,
         });
         codegenPool.on('error', (err) => {
           console.error('[ConnectionPool] CodeGen pool connection error:', err.message);
@@ -390,6 +484,15 @@ export const serve = async (resolverPaths: Array<string>, app: Application = cre
           const outputPaths = (codegenConfig.output ?? []).map((o: { directory: string }) => o.directory);
           RuntimeSchemaManager.Instance.SetCodeGenOutputPaths(outputPaths);
           console.log(`RSU CodeGen output paths: ${outputPaths.length} directories configured.`);
+
+          // Point RSU's soft PK/FK writer at the SAME file CodeGen reads (mj.config.cjs
+          // `additionalSchemaInfo`). Without this, RSU writes soft PKs to its own default
+          // path while CodeGen reads a different one and skips every integration table
+          // with "No primary key found".
+          if (codegenConfig.additionalSchemaInfo) {
+            RuntimeSchemaManager.Instance.SetAdditionalSchemaInfoPath(codegenConfig.additionalSchemaInfo);
+            console.log(`RSU additionalSchemaInfo path: ${codegenConfig.additionalSchemaInfo}`);
+          }
         } catch (codegenErr) {
           console.warn(`RSU in-process CodeGen runner setup failed (will fall back to child process): ${(codegenErr as Error).message}`);
         }
@@ -620,6 +723,24 @@ export const serve = async (resolverPaths: Array<string>, app: Application = cre
     (topic: string, payload: Record<string, unknown>) => PubSubManager.Instance.Publish(topic, payload)
   );
 
+  // §11: fan every integration progress event onto the live GraphQL subscription topic. The emitter
+  // (in @memberjunction/integration-progress-artifacts) stays server-agnostic; we inject the publish
+  // here so integration runs/refreshes/syncs are subscribable in addition to the durable JSONL
+  // artifact + the pollable IntegrationTailRunEvents query.
+  IntegrationProgressEmitter.SetPublishHook((manifest, event) =>
+    PublishIntegrationProgress({
+      RunID: manifest.runID,
+      Kind: manifest.runKind,
+      CompanyIntegrationID: manifest.companyIntegrationID,
+      EventType: event.eventType,
+      Seq: event.seq,
+      Message: event.message,
+      Stage: event.stage,
+      Level: event.level,
+      Data: event.data,
+    })
+  );
+
   // Global listener: broadcast CACHE_INVALIDATION to all browser clients whenever
   // ANY BaseEntity save/delete occurs on this server — regardless of whether it
   // originated from a GraphQL mutation or internal server-side code (agents, actions,
@@ -652,10 +773,15 @@ export const serve = async (resolverPaths: Array<string>, app: Application = cre
         scalarsMap: [{ type: Date, scalar: GraphQLTimestamp }],
         emitSchemaFile: websiteRunFromPackage !== 1,
         pubSub,
+        globalMiddlewares: [variablesLoggingMiddleware],
       }),
     ],
     typeDefs: [requireSystemUserDirective.typeDefs, publicDirective.typeDefs],
   });
+
+  // Verbose-mode-only diagnostic: name custom-resolver args that aren't metadata-bound
+  // and aren't @NoLog-marked. No-op in default config (logVariables=false).
+  auditResolversForUndecoratedArgs();
   schema = requireSystemUserDirective.transformer(schema);
   schema = publicDirective.transformer(schema);
 
@@ -929,6 +1055,15 @@ export const serve = async (resolverPaths: Array<string>, app: Application = cre
       .catch(err => console.warn(`[IntegrationEngine] Orphaned sync resume failed: ${err}`));
   }
 
+  // Force-fail any agent runs left 'Running' by a process that died (restart/crash/OOM) or whose
+  // terminal-state write never landed. Staleness-based, so it never touches runs another healthy
+  // instance is still heart-beating. The watchdog also self-registers for graceful-shutdown
+  // cancellation (via ShutdownRegistry) once it begins tracking this process's first live run.
+  if (resumeUser && Metadata.Provider instanceof DatabaseProviderBase) { // global-provider-ok: server startup recovery — one-shot orphaned-run sweep at boot
+    AgentRunWatchdog.SweepOrphanedRuns(Metadata.Provider, resumeUser) // global-provider-ok: server startup recovery — one-shot orphaned-run sweep at boot
+      .catch(err => console.warn(`[AgentRunWatchdog] Startup sweep failed: ${err}`));
+  }
+
   // Set up graceful shutdown handlers
   const gracefulShutdown = async (signal: string) => {
     console.log(`\n${signal} received, shutting down gracefully...`);

package/src/logging/NoLog.ts

@@ -0,0 +1,88 @@
+import 'reflect-metadata';
+
+/**
+ * Reflect-metadata key for `@NoLog` marks. A single symbol covers both parameter-level
+ * marks (stored against `(target, propertyKey)` pairs) and field-level marks (stored
+ * against the input class prototype).
+ */
+const NO_LOG_PARAM_KEY = Symbol('mj:NoLog:param');
+const NO_LOG_FIELD_KEY = Symbol('mj:NoLog:field');
+
+/**
+ * `@NoLog` — marks a resolver argument or input-type field as never-loggable.
+ *
+ * Two modes, distinguished by decorator arity at runtime:
+ *
+ *   **Parameter** — applied to an `@Arg(...)` parameter on a resolver method:
+ *   ```ts
+ *   @Mutation(() => Boolean)
+ *   async VoiceTestHubSpotCredential(
+ *     @Arg('accessToken') @NoLog accessToken: string,
+ *     @Ctx() ctx: AppContext,
+ *   ): Promise<boolean> { ... }
+ *   ```
+ *
+ *   **Property** — applied to a `@Field()` on an `@InputType` class:
+ *   ```ts
+ *   @InputType()
+ *   export class GetDataInputType {
+ *     @Field(() => String) @NoLog Token: string;
+ *     @Field(() => [String]) Queries: string[];
+ *   }
+ *   ```
+ *
+ * The variables-logging middleware reads these marks at runtime via
+ * `hasNoLogParameter` / `getNoLogFields` and replaces the marked value (or whole arg)
+ * with `"<redacted>"` before emitting the variables block. Metadata-covered fields
+ * (entity columns with `EntityFieldInfo.Encrypt=true`) do not need `@NoLog` — applying
+ * it is harmless but redundant. Use `@NoLog` for arguments that the redactor cannot
+ * identify via metadata: custom-resolver parameters, MCP tool args, fields on input
+ * types that don't map to a known entity.
+ */
+export function NoLog(target: object, propertyKey?: string | symbol, parameterIndex?: number): void {
+  // Parameter-decorator path: (target, propertyKey, parameterIndex)
+  if (typeof parameterIndex === 'number' && propertyKey !== undefined) {
+    const existing = (Reflect.getOwnMetadata(NO_LOG_PARAM_KEY, target, propertyKey) as Set<number> | undefined) ?? new Set<number>();
+    existing.add(parameterIndex);
+    Reflect.defineMetadata(NO_LOG_PARAM_KEY, existing, target, propertyKey);
+    return;
+  }
+
+  // Property-decorator path: (target, propertyKey)
+  if (propertyKey !== undefined) {
+    const existing = (Reflect.getOwnMetadata(NO_LOG_FIELD_KEY, target) as Set<string> | undefined) ?? new Set<string>();
+    existing.add(String(propertyKey));
+    Reflect.defineMetadata(NO_LOG_FIELD_KEY, existing, target);
+    return;
+  }
+}
+
+/**
+ * Returns true if `@NoLog` was applied to `methodName`'s argument at `parameterIndex`
+ * on the given resolver class prototype. False otherwise.
+ *
+ * Pass the resolver class itself (e.g. `MyResolver`) — the function reads from the
+ * prototype internally to match how type-graphql stores resolver metadata.
+ */
+export function hasNoLogParameter(
+  resolverClass: Function,
+  methodName: string,
+  parameterIndex: number,
+): boolean {
+  const target = resolverClass.prototype as object;
+  const marks = Reflect.getMetadata(NO_LOG_PARAM_KEY, target, methodName) as Set<number> | undefined;
+  return marks !== undefined && marks.has(parameterIndex);
+}
+
+/**
+ * Returns the set of field names decorated `@NoLog` on the given input class. Empty set
+ * if none were marked.
+ *
+ * Pass the input class itself (e.g. `GetDataInputType`) — the function reads from the
+ * prototype internally.
+ */
+export function getNoLogFields(inputTypeClass: Function): ReadonlySet<string> {
+  const target = inputTypeClass.prototype as object;
+  const marks = Reflect.getMetadata(NO_LOG_FIELD_KEY, target) as Set<string> | undefined;
+  return marks ?? new Set<string>();
+}

package/src/logging/bootAudit.ts

@@ -0,0 +1,117 @@
+import { getMetadataStorage } from 'type-graphql';
+import { configInfo } from '../config.js';
+import { hasNoLogParameter } from './NoLog.js';
+
+// Delete is included alongside Create/Update so codegen DeleteMJ*Input resolvers count as
+// metadata-bound and don't flood the audit with false positives (their args are PK + Options
+// only — no encrypted values by construction). Must stay in sync with the redactor's
+// INPUT_TYPE_REGEX in secretRedactor.ts. See docs/adr/0001-graphql-variables-logging-tiered-by-verbose.md.
+const INPUT_TYPE_REGEX = /^(Create|Update|Delete).+Input$/;
+
+/**
+ * Structural shape of an `@Arg` parameter as seen from outside type-graphql's internals.
+ * Used by the audit walker. Mirrors the subset of `ArgParamMetadata` we need.
+ */
+export type AuditArgParam = {
+  kind: 'arg';
+  index: number;
+  name: string;
+  target: Function;
+  methodName: string;
+  getType: () => unknown;
+};
+
+/**
+ * Structural shape of a resolver metadata entry from outside type-graphql's internals.
+ * Includes `@Query`, `@Mutation`, `@Subscription` entries.
+ */
+export type AuditResolver = {
+  target: Function;
+  methodName: string;
+  params?: ReadonlyArray<{ kind: string; index: number } & Partial<AuditArgParam>>;
+};
+
+/**
+ * Scans every `@Query` / `@Mutation` / `@Subscription` for `@Arg`s that are neither
+ * metadata-bound (input type matching `Create<X>Input` / `Update<X>Input`) nor `@NoLog`-marked.
+ * Emits one warning per such arg.
+ *
+ * Gated on `loggingSettings.graphql.logVariables=true` — runs zero work in default config.
+ * In verbose mode, the audit is a diagnostic for the operator who chose to turn on
+ * variables logging, naming gaps that will leak plaintext while the flag is active.
+ *
+ * Never throws. Boot does not fail on a missed `@NoLog`.
+ */
+export function auditResolversForUndecoratedArgs(): void {
+  if (!configInfo.loggingSettings.graphql.logVariables) {
+    return;
+  }
+
+  const storage = getMetadataStorage() as unknown as {
+    queries: AuditResolver[];
+    mutations: AuditResolver[];
+    subscriptions: AuditResolver[];
+  };
+  auditResolverList([
+    ...storage.queries,
+    ...storage.mutations,
+    ...storage.subscriptions,
+  ]);
+}
+
+/**
+ * Internal helper exported for test injection. Takes a list of resolver metadata directly,
+ * skipping the global `getMetadataStorage()` lookup. The boot-time scan uses this after
+ * pulling from the global storage; tests pass in a synthetic fixture.
+ */
+export function auditResolverList(resolvers: ReadonlyArray<AuditResolver>): void {
+  for (const resolver of resolvers) {
+    auditResolver(resolver);
+  }
+}
+
+function auditResolver(resolver: AuditResolver): void {
+  for (const param of resolver.params ?? []) {
+    if (param.kind !== 'arg') {
+      continue;
+    }
+    auditArg(resolver, param as AuditArgParam);
+  }
+}
+
+function auditArg(resolver: AuditResolver, argParam: AuditArgParam): void {
+  const typeName = readArgTypeName(argParam);
+  if (typeName && INPUT_TYPE_REGEX.test(typeName)) {
+    return;
+  }
+  if (hasNoLogParameter(resolver.target, resolver.methodName, argParam.index)) {
+    return;
+  }
+  const resolverName = `${resolver.target.name}.${resolver.methodName}`;
+  console.warn(
+    `[mj:NoLog audit] Custom resolver ${resolverName} takes argument '${argParam.name}' ` +
+    `(type ${typeName ?? 'unknown'}) which is not marked @NoLog. Verify this argument does ` +
+    `not carry sensitive material; if it does, apply @NoLog. Variables for this resolver will ` +
+    `be logged in plaintext while logVariables=true is active.`,
+  );
+}
+
+/**
+ * Reads the declared input type name from an `@Arg` parameter's `getType()` thunk.
+ * Returns the class/scalar name when the thunk resolves to a class or named scalar; otherwise
+ * returns `undefined` (e.g. for array literals or complex generics we don't unwrap).
+ */
+function readArgTypeName(argParam: AuditArgParam): string | undefined {
+  try {
+    const type = argParam.getType();
+    if (typeof type === 'function') {
+      return (type as { name?: string }).name;
+    }
+    if (type && typeof type === 'object' && 'name' in type && typeof (type as { name: unknown }).name === 'string') {
+      return (type as { name: string }).name;
+    }
+  } catch {
+    return undefined;
+  }
+  return undefined;
+}

package/src/logging/boundaryLogPayload.ts

@@ -0,0 +1,19 @@
+/**
+ * Builds the always-on GraphQL boundary log payload: operation name ONLY.
+ *
+ * Variable VALUES are never emitted here, in any configuration — this is the load-bearing
+ * fix for the #2638 secret leak. Verbose variables logging (MJ_LOG_GRAPHQL_VARIABLES=true)
+ * is the job of `variablesLoggingMiddleware`, which emits per-root-resolver, fully-emitted
+ * values with `Encrypt=true` fields masked.
+ *
+ * Pure function, no MJ-server import surface, so the "no `variables` key in the boundary
+ * line" property is testable in isolation without booting the request-context dependency
+ * chain.
+ *
+ * See docs/adr/0001-graphql-variables-logging-tiered-by-verbose.md.
+ */
+export function buildBoundaryLogPayload(
+  operationName: string | undefined,
+): { operationName: string | undefined } {
+  return { operationName };
+}

package/src/logging/secretRedactor.ts

@@ -0,0 +1,82 @@
+import type { IMetadataProvider } from '@memberjunction/core';
+import { shortenForLog } from './shortenForLog.js';
+
+/**
+ * Input to the redactor. Built per `@Arg` per resolver call by the variables-logging middleware.
+ *
+ * - `inputTypeName` is the GraphQL input type name from the schema (e.g. `"CreateMJCredentialInput"`),
+ *   derived from `info.parentType.getFields()[info.fieldName].args[i].type` — NOT from any
+ *   `args[i].constructor.name`, because type-graphql v2.0.0-beta.3 passes raw plain-object args
+ *   to middleware (conversion to typed instances happens after the middleware chain unwinds).
+ * - `provider` is the per-request metadata provider (`context.providers[0].provider`).
+ * - `noLogParameter` indicates the `@Arg` itself was decorated `@NoLog` at the parameter level.
+ * - `noLogFields` lists field names that were decorated `@NoLog` at the `@Field()` level on the
+ *   input class. The redactor honors both `EntityFieldInfo.Encrypt=true` (metadata-driven) and
+ *   this set (decorator-driven) when walking top-level keys.
+ */
+export type RedactionContext = {
+  inputTypeName: string;
+  rawValue: unknown;
+  provider: IMetadataProvider;
+  noLogParameter: boolean;
+  noLogFields: ReadonlySet<string>;
+};
+
+// Delete is included so DeleteMJ*Input resolvers resolve to their entity (yielding an empty
+// or value-free encrypted-field walk) instead of falling to the fail-open shortenForLog path —
+// keeps the boot audit quiet on them. Security is identical either way: Delete inputs carry
+// PK + Options only, no encrypted values. Must stay in sync with bootAudit.ts's INPUT_TYPE_REGEX.
+const INPUT_TYPE_REGEX = /^(Create|Update|Delete)(?<name>.+)Input$/;
+
+// Assumes EntityFieldInfo.Name === GraphQLFieldName for input-type fields.
+// True today for all codegen output (323 Create*Input + 323 Update*Input).
+// type-graphql allows @Field({ name: 'overrideName' }) to rename fields at the
+// GraphQL layer; MJ codegen does not use this. A future maintainer renaming an
+// encrypted field at the GraphQL layer would silently miss redaction.
+export function redactArg(ctx: RedactionContext): unknown {
+  if (ctx.noLogParameter) {
+    return '<redacted>';
+  }
+
+  if (ctx.provider.Entities.length === 0) {
+    return '<metadata-not-ready>';
+  }
+
+  // Determine the encrypted-field set from entity metadata IF this input maps to a known entity.
+  // Custom / non-CRUD inputs (e.g. GetDataInput) have no entity binding — that's fine; field-level
+  // @NoLog still applies below. The entity path only adds metadata-driven encrypted-field names.
+  let encryptedFieldNames: ReadonlySet<string> = EMPTY_SET;
+  const match = INPUT_TYPE_REGEX.exec(ctx.inputTypeName);
+  if (match?.groups?.name) {
+    const entity = ctx.provider.Entities.find((e) => e.ClassName === match.groups!.name);
+    if (entity) {
+      encryptedFieldNames = new Set(entity.EncryptedFields.map((f) => f.Name));
+    }
+  }
+
+  // Walk top-level keys whenever we have BOTH a redaction source (encrypted fields or @NoLog fields)
+  // AND a plain-object value. This honors field-level @NoLog even on non-entity-bound inputs — the
+  // exact case @NoLog exists for (custom resolvers, e.g. GetDataInputType.Token). Without a redaction
+  // source, or for non-object values, fall through to shortenForLog as before.
+  const canWalk =
+    (encryptedFieldNames.size > 0 || ctx.noLogFields.size > 0) &&
+    ctx.rawValue !== null &&
+    typeof ctx.rawValue === 'object' &&
+    !Array.isArray(ctx.rawValue);
+
+  if (!canWalk) {
+    return shortenForLog(ctx.rawValue);
+  }
+
+  const result: Record<string, unknown> = {};
+  for (const [key, value] of Object.entries(ctx.rawValue as Record<string, unknown>)) {
+    if (encryptedFieldNames.has(key) || ctx.noLogFields.has(key)) {
+      result[key] = '<redacted>';
+    } else {
+      result[key] = shortenForLog(value);
+    }
+  }
+  return result;
+}
+
+const EMPTY_SET: ReadonlySet<string> = new Set<string>();

package/src/logging/shortenForLog.ts

@@ -0,0 +1,17 @@
+/**
+ * Renders a value for one-line console logging without Node's `[Object]` truncation.
+ * Arrays keep their structure; non-array objects collapse to JSON, truncated at `maxLen`.
+ * Objects whose JSON exceeds `maxLen` and contain nested structure are recursed into so
+ * outer keys remain visible.
+ */
+export function shortenForLog(value: unknown, maxLen = 300): unknown {
+  if (value === null || typeof value !== 'object') return value;
+  if (Array.isArray(value)) return value.map((v) => shortenForLog(v, maxLen));
+  const json = JSON.stringify(value);
+  if (json.length <= maxLen) return json;
+  const result: Record<string, unknown> = {};
+  for (const [k, v] of Object.entries(value as Record<string, unknown>)) {
+    result[k] = shortenForLog(v, maxLen);
+  }
+  return result;
+}