@memberjunction/server 5.38.0 → 5.39.0

package/dist/logging/NoLog.js

@@ -0,0 +1,80 @@
+import 'reflect-metadata';
+/**
+ * Reflect-metadata key for `@NoLog` marks. A single symbol covers both parameter-level
+ * marks (stored against `(target, propertyKey)` pairs) and field-level marks (stored
+ * against the input class prototype).
+ */
+const NO_LOG_PARAM_KEY = Symbol('mj:NoLog:param');
+const NO_LOG_FIELD_KEY = Symbol('mj:NoLog:field');
+/**
+ * `@NoLog` — marks a resolver argument or input-type field as never-loggable.
+ *
+ * Two modes, distinguished by decorator arity at runtime:
+ *
+ *   **Parameter** — applied to an `@Arg(...)` parameter on a resolver method:
+ *   ```ts
+ *   @Mutation(() => Boolean)
+ *   async VoiceTestHubSpotCredential(
+ *     @Arg('accessToken') @NoLog accessToken: string,
+ *     @Ctx() ctx: AppContext,
+ *   ): Promise<boolean> { ... }
+ *   ```
+ *
+ *   **Property** — applied to a `@Field()` on an `@InputType` class:
+ *   ```ts
+ *   @InputType()
+ *   export class GetDataInputType {
+ *     @Field(() => String) @NoLog Token: string;
+ *     @Field(() => [String]) Queries: string[];
+ *   }
+ *   ```
+ *
+ * The variables-logging middleware reads these marks at runtime via
+ * `hasNoLogParameter` / `getNoLogFields` and replaces the marked value (or whole arg)
+ * with `"<redacted>"` before emitting the variables block. Metadata-covered fields
+ * (entity columns with `EntityFieldInfo.Encrypt=true`) do not need `@NoLog` — applying
+ * it is harmless but redundant. Use `@NoLog` for arguments that the redactor cannot
+ * identify via metadata: custom-resolver parameters, MCP tool args, fields on input
+ * types that don't map to a known entity.
+ */
+export function NoLog(target, propertyKey, parameterIndex) {
+    // Parameter-decorator path: (target, propertyKey, parameterIndex)
+    if (typeof parameterIndex === 'number' && propertyKey !== undefined) {
+        const existing = Reflect.getOwnMetadata(NO_LOG_PARAM_KEY, target, propertyKey) ?? new Set();
+        existing.add(parameterIndex);
+        Reflect.defineMetadata(NO_LOG_PARAM_KEY, existing, target, propertyKey);
+        return;
+    }
+    // Property-decorator path: (target, propertyKey)
+    if (propertyKey !== undefined) {
+        const existing = Reflect.getOwnMetadata(NO_LOG_FIELD_KEY, target) ?? new Set();
+        existing.add(String(propertyKey));
+        Reflect.defineMetadata(NO_LOG_FIELD_KEY, existing, target);
+        return;
+    }
+}
+/**
+ * Returns true if `@NoLog` was applied to `methodName`'s argument at `parameterIndex`
+ * on the given resolver class prototype. False otherwise.
+ *
+ * Pass the resolver class itself (e.g. `MyResolver`) — the function reads from the
+ * prototype internally to match how type-graphql stores resolver metadata.
+ */
+export function hasNoLogParameter(resolverClass, methodName, parameterIndex) {
+    const target = resolverClass.prototype;
+    const marks = Reflect.getMetadata(NO_LOG_PARAM_KEY, target, methodName);
+    return marks !== undefined && marks.has(parameterIndex);
+}
+/**
+ * Returns the set of field names decorated `@NoLog` on the given input class. Empty set
+ * if none were marked.
+ *
+ * Pass the input class itself (e.g. `GetDataInputType`) — the function reads from the
+ * prototype internally.
+ */
+export function getNoLogFields(inputTypeClass) {
+    const target = inputTypeClass.prototype;
+    const marks = Reflect.getMetadata(NO_LOG_FIELD_KEY, target);
+    return marks ?? new Set();
+}
+//# sourceMappingURL=NoLog.js.map

package/dist/logging/NoLog.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"NoLog.js","sourceRoot":"","sources":["../../src/logging/NoLog.ts"],"names":[],"mappings":"AAAA,OAAO,kBAAkB,CAAC;AAE1B;;;;GAIG;AACH,MAAM,gBAAgB,GAAG,MAAM,CAAC,gBAAgB,CAAC,CAAC;AAClD,MAAM,gBAAgB,GAAG,MAAM,CAAC,gBAAgB,CAAC,CAAC;AAElD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,MAAM,UAAU,KAAK,CAAC,MAAc,EAAE,WAA6B,EAAE,cAAuB;IAC1F,kEAAkE;IAClE,IAAI,OAAO,cAAc,KAAK,QAAQ,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;QACpE,MAAM,QAAQ,GAAI,OAAO,CAAC,cAAc,CAAC,gBAAgB,EAAE,MAAM,EAAE,WAAW,CAA6B,IAAI,IAAI,GAAG,EAAU,CAAC;QACjI,QAAQ,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QAC7B,OAAO,CAAC,cAAc,CAAC,gBAAgB,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC;QACxE,OAAO;IACT,CAAC;IAED,iDAAiD;IACjD,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;QAC9B,MAAM,QAAQ,GAAI,OAAO,CAAC,cAAc,CAAC,gBAAgB,EAAE,MAAM,CAA6B,IAAI,IAAI,GAAG,EAAU,CAAC;QACpH,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC;QAClC,OAAO,CAAC,cAAc,CAAC,gBAAgB,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;QAC3D,OAAO;IACT,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAC/B,aAAuB,EACvB,UAAkB,EAClB,cAAsB;IAEtB,MAAM,MAAM,GAAG,aAAa,CAAC,SAAmB,CAAC;IACjD,MAAM,KAAK,GAAG,OAAO,CAAC,WAAW,CAAC,gBAAgB,EAAE,MAAM,EAAE,UAAU,CAA4B,CAAC;IACnG,OAAO,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;AAC1D,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAAC,cAAwB;IACrD,MAAM,MAAM,GAAG,cAAc,CAAC,SAAmB,CAAC;IAClD,MAAM,KAAK,GAAG,OAAO,CAAC,WAAW,CAAC,gBAAgB,EAAE,MAAM,CAA4B,CAAC;IACvF,OAAO,KAAK,IAAI,IAAI,GAAG,EAAU,CAAC;AACpC,CAAC"}

package/dist/logging/bootAudit.d.ts

@@ -0,0 +1,43 @@
+/**
+ * Structural shape of an `@Arg` parameter as seen from outside type-graphql's internals.
+ * Used by the audit walker. Mirrors the subset of `ArgParamMetadata` we need.
+ */
+export type AuditArgParam = {
+    kind: 'arg';
+    index: number;
+    name: string;
+    target: Function;
+    methodName: string;
+    getType: () => unknown;
+};
+/**
+ * Structural shape of a resolver metadata entry from outside type-graphql's internals.
+ * Includes `@Query`, `@Mutation`, `@Subscription` entries.
+ */
+export type AuditResolver = {
+    target: Function;
+    methodName: string;
+    params?: ReadonlyArray<{
+        kind: string;
+        index: number;
+    } & Partial<AuditArgParam>>;
+};
+/**
+ * Scans every `@Query` / `@Mutation` / `@Subscription` for `@Arg`s that are neither
+ * metadata-bound (input type matching `Create<X>Input` / `Update<X>Input`) nor `@NoLog`-marked.
+ * Emits one warning per such arg.
+ *
+ * Gated on `loggingSettings.graphql.logVariables=true` — runs zero work in default config.
+ * In verbose mode, the audit is a diagnostic for the operator who chose to turn on
+ * variables logging, naming gaps that will leak plaintext while the flag is active.
+ *
+ * Never throws. Boot does not fail on a missed `@NoLog`.
+ */
+export declare function auditResolversForUndecoratedArgs(): void;
+/**
+ * Internal helper exported for test injection. Takes a list of resolver metadata directly,
+ * skipping the global `getMetadataStorage()` lookup. The boot-time scan uses this after
+ * pulling from the global storage; tests pass in a synthetic fixture.
+ */
+export declare function auditResolverList(resolvers: ReadonlyArray<AuditResolver>): void;
+//# sourceMappingURL=bootAudit.d.ts.map

package/dist/logging/bootAudit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bootAudit.d.ts","sourceRoot":"","sources":["../../src/logging/bootAudit.ts"],"names":[],"mappings":"AAUA;;;GAGG;AACH,MAAM,MAAM,aAAa,GAAG;IAC1B,IAAI,EAAE,KAAK,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,QAAQ,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,OAAO,CAAC;CACxB,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,aAAa,GAAG;IAC1B,MAAM,EAAE,QAAQ,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,aAAa,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC;CAClF,CAAC;AAEF;;;;;;;;;;GAUG;AACH,wBAAgB,gCAAgC,IAAI,IAAI,CAevD;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,aAAa,CAAC,aAAa,CAAC,GAAG,IAAI,CAI/E"}

package/dist/logging/bootAudit.js

@@ -0,0 +1,83 @@
+import { getMetadataStorage } from 'type-graphql';
+import { configInfo } from '../config.js';
+import { hasNoLogParameter } from './NoLog.js';
+// Delete is included alongside Create/Update so codegen DeleteMJ*Input resolvers count as
+// metadata-bound and don't flood the audit with false positives (their args are PK + Options
+// only — no encrypted values by construction). Must stay in sync with the redactor's
+// INPUT_TYPE_REGEX in secretRedactor.ts. See docs/adr/0001-graphql-variables-logging-tiered-by-verbose.md.
+const INPUT_TYPE_REGEX = /^(Create|Update|Delete).+Input$/;
+/**
+ * Scans every `@Query` / `@Mutation` / `@Subscription` for `@Arg`s that are neither
+ * metadata-bound (input type matching `Create<X>Input` / `Update<X>Input`) nor `@NoLog`-marked.
+ * Emits one warning per such arg.
+ *
+ * Gated on `loggingSettings.graphql.logVariables=true` — runs zero work in default config.
+ * In verbose mode, the audit is a diagnostic for the operator who chose to turn on
+ * variables logging, naming gaps that will leak plaintext while the flag is active.
+ *
+ * Never throws. Boot does not fail on a missed `@NoLog`.
+ */
+export function auditResolversForUndecoratedArgs() {
+    if (!configInfo.loggingSettings.graphql.logVariables) {
+        return;
+    }
+    const storage = getMetadataStorage();
+    auditResolverList([
+        ...storage.queries,
+        ...storage.mutations,
+        ...storage.subscriptions,
+    ]);
+}
+/**
+ * Internal helper exported for test injection. Takes a list of resolver metadata directly,
+ * skipping the global `getMetadataStorage()` lookup. The boot-time scan uses this after
+ * pulling from the global storage; tests pass in a synthetic fixture.
+ */
+export function auditResolverList(resolvers) {
+    for (const resolver of resolvers) {
+        auditResolver(resolver);
+    }
+}
+function auditResolver(resolver) {
+    for (const param of resolver.params ?? []) {
+        if (param.kind !== 'arg') {
+            continue;
+        }
+        auditArg(resolver, param);
+    }
+}
+function auditArg(resolver, argParam) {
+    const typeName = readArgTypeName(argParam);
+    if (typeName && INPUT_TYPE_REGEX.test(typeName)) {
+        return;
+    }
+    if (hasNoLogParameter(resolver.target, resolver.methodName, argParam.index)) {
+        return;
+    }
+    const resolverName = `${resolver.target.name}.${resolver.methodName}`;
+    console.warn(`[mj:NoLog audit] Custom resolver ${resolverName} takes argument '${argParam.name}' ` +
+        `(type ${typeName ?? 'unknown'}) which is not marked @NoLog. Verify this argument does ` +
+        `not carry sensitive material; if it does, apply @NoLog. Variables for this resolver will ` +
+        `be logged in plaintext while logVariables=true is active.`);
+}
+/**
+ * Reads the declared input type name from an `@Arg` parameter's `getType()` thunk.
+ * Returns the class/scalar name when the thunk resolves to a class or named scalar; otherwise
+ * returns `undefined` (e.g. for array literals or complex generics we don't unwrap).
+ */
+function readArgTypeName(argParam) {
+    try {
+        const type = argParam.getType();
+        if (typeof type === 'function') {
+            return type.name;
+        }
+        if (type && typeof type === 'object' && 'name' in type && typeof type.name === 'string') {
+            return type.name;
+        }
+    }
+    catch {
+        return undefined;
+    }
+    return undefined;
+}
+//# sourceMappingURL=bootAudit.js.map

package/dist/logging/bootAudit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bootAudit.js","sourceRoot":"","sources":["../../src/logging/bootAudit.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAE/C,0FAA0F;AAC1F,6FAA6F;AAC7F,qFAAqF;AACrF,2GAA2G;AAC3G,MAAM,gBAAgB,GAAG,iCAAiC,CAAC;AAyB3D;;;;;;;;;;GAUG;AACH,MAAM,UAAU,gCAAgC;IAC9C,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC;QACrD,OAAO;IACT,CAAC;IAED,MAAM,OAAO,GAAG,kBAAkB,EAIjC,CAAC;IACF,iBAAiB,CAAC;QAChB,GAAG,OAAO,CAAC,OAAO;QAClB,GAAG,OAAO,CAAC,SAAS;QACpB,GAAG,OAAO,CAAC,aAAa;KACzB,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,SAAuC;IACvE,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QACjC,aAAa,CAAC,QAAQ,CAAC,CAAC;IAC1B,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,QAAuB;IAC5C,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;QAC1C,IAAI,KAAK,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;YACzB,SAAS;QACX,CAAC;QACD,QAAQ,CAAC,QAAQ,EAAE,KAAsB,CAAC,CAAC;IAC7C,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,QAAuB,EAAE,QAAuB;IAChE,MAAM,QAAQ,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;IAC3C,IAAI,QAAQ,IAAI,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QAChD,OAAO;IACT,CAAC;IACD,IAAI,iBAAiB,CAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5E,OAAO;IACT,CAAC;IACD,MAAM,YAAY,GAAG,GAAG,QAAQ,CAAC,MAAM,CAAC,IAAI,IAAI,QAAQ,CAAC,UAAU,EAAE,CAAC;IACtE,OAAO,CAAC,IAAI,CACV,oCAAoC,YAAY,oBAAoB,QAAQ,CAAC,IAAI,IAAI;QACrF,SAAS,QAAQ,IAAI,SAAS,0DAA0D;QACxF,2FAA2F;QAC3F,2DAA2D,CAC5D,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,eAAe,CAAC,QAAuB;IAC9C,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,EAAE,CAAC;QAChC,IAAI,OAAO,IAAI,KAAK,UAAU,EAAE,CAAC;YAC/B,OAAQ,IAA0B,CAAC,IAAI,CAAC;QAC1C,CAAC;QACD,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,MAAM,IAAI,IAAI,IAAI,OAAQ,IAA0B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC/G,OAAQ,IAAyB,CAAC,IAAI,CAAC;QACzC,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/logging/boundaryLogPayload.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Builds the always-on GraphQL boundary log payload: operation name ONLY.
+ *
+ * Variable VALUES are never emitted here, in any configuration — this is the load-bearing
+ * fix for the #2638 secret leak. Verbose variables logging (MJ_LOG_GRAPHQL_VARIABLES=true)
+ * is the job of `variablesLoggingMiddleware`, which emits per-root-resolver, fully-emitted
+ * values with `Encrypt=true` fields masked.
+ *
+ * Pure function, no MJ-server import surface, so the "no `variables` key in the boundary
+ * line" property is testable in isolation without booting the request-context dependency
+ * chain.
+ *
+ * See docs/adr/0001-graphql-variables-logging-tiered-by-verbose.md.
+ */
+export declare function buildBoundaryLogPayload(operationName: string | undefined): {
+    operationName: string | undefined;
+};
+//# sourceMappingURL=boundaryLogPayload.d.ts.map

package/dist/logging/boundaryLogPayload.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"boundaryLogPayload.d.ts","sourceRoot":"","sources":["../../src/logging/boundaryLogPayload.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,wBAAgB,uBAAuB,CACrC,aAAa,EAAE,MAAM,GAAG,SAAS,GAChC;IAAE,aAAa,EAAE,MAAM,GAAG,SAAS,CAAA;CAAE,CAEvC"}

package/dist/logging/boundaryLogPayload.js

@@ -0,0 +1,18 @@
+/**
+ * Builds the always-on GraphQL boundary log payload: operation name ONLY.
+ *
+ * Variable VALUES are never emitted here, in any configuration — this is the load-bearing
+ * fix for the #2638 secret leak. Verbose variables logging (MJ_LOG_GRAPHQL_VARIABLES=true)
+ * is the job of `variablesLoggingMiddleware`, which emits per-root-resolver, fully-emitted
+ * values with `Encrypt=true` fields masked.
+ *
+ * Pure function, no MJ-server import surface, so the "no `variables` key in the boundary
+ * line" property is testable in isolation without booting the request-context dependency
+ * chain.
+ *
+ * See docs/adr/0001-graphql-variables-logging-tiered-by-verbose.md.
+ */
+export function buildBoundaryLogPayload(operationName) {
+    return { operationName };
+}
+//# sourceMappingURL=boundaryLogPayload.js.map

package/dist/logging/boundaryLogPayload.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"boundaryLogPayload.js","sourceRoot":"","sources":["../../src/logging/boundaryLogPayload.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,uBAAuB,CACrC,aAAiC;IAEjC,OAAO,EAAE,aAAa,EAAE,CAAC;AAC3B,CAAC"}

package/dist/logging/secretRedactor.d.ts

@@ -0,0 +1,23 @@
+import type { IMetadataProvider } from '@memberjunction/core';
+/**
+ * Input to the redactor. Built per `@Arg` per resolver call by the variables-logging middleware.
+ *
+ * - `inputTypeName` is the GraphQL input type name from the schema (e.g. `"CreateMJCredentialInput"`),
+ *   derived from `info.parentType.getFields()[info.fieldName].args[i].type` — NOT from any
+ *   `args[i].constructor.name`, because type-graphql v2.0.0-beta.3 passes raw plain-object args
+ *   to middleware (conversion to typed instances happens after the middleware chain unwinds).
+ * - `provider` is the per-request metadata provider (`context.providers[0].provider`).
+ * - `noLogParameter` indicates the `@Arg` itself was decorated `@NoLog` at the parameter level.
+ * - `noLogFields` lists field names that were decorated `@NoLog` at the `@Field()` level on the
+ *   input class. The redactor honors both `EntityFieldInfo.Encrypt=true` (metadata-driven) and
+ *   this set (decorator-driven) when walking top-level keys.
+ */
+export type RedactionContext = {
+    inputTypeName: string;
+    rawValue: unknown;
+    provider: IMetadataProvider;
+    noLogParameter: boolean;
+    noLogFields: ReadonlySet<string>;
+};
+export declare function redactArg(ctx: RedactionContext): unknown;
+//# sourceMappingURL=secretRedactor.d.ts.map

package/dist/logging/secretRedactor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secretRedactor.d.ts","sourceRoot":"","sources":["../../src/logging/secretRedactor.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAG9D;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,gBAAgB,GAAG;IAC7B,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,OAAO,CAAC;IAClB,QAAQ,EAAE,iBAAiB,CAAC;IAC5B,cAAc,EAAE,OAAO,CAAC;IACxB,WAAW,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;CAClC,CAAC;AAaF,wBAAgB,SAAS,CAAC,GAAG,EAAE,gBAAgB,GAAG,OAAO,CA4CxD"}

package/dist/logging/secretRedactor.js

@@ -0,0 +1,53 @@
+import { shortenForLog } from './shortenForLog.js';
+// Delete is included so DeleteMJ*Input resolvers resolve to their entity (yielding an empty
+// or value-free encrypted-field walk) instead of falling to the fail-open shortenForLog path —
+// keeps the boot audit quiet on them. Security is identical either way: Delete inputs carry
+// PK + Options only, no encrypted values. Must stay in sync with bootAudit.ts's INPUT_TYPE_REGEX.
+const INPUT_TYPE_REGEX = /^(Create|Update|Delete)(?<name>.+)Input$/;
+// Assumes EntityFieldInfo.Name === GraphQLFieldName for input-type fields.
+// True today for all codegen output (323 Create*Input + 323 Update*Input).
+// type-graphql allows @Field({ name: 'overrideName' }) to rename fields at the
+// GraphQL layer; MJ codegen does not use this. A future maintainer renaming an
+// encrypted field at the GraphQL layer would silently miss redaction.
+export function redactArg(ctx) {
+    if (ctx.noLogParameter) {
+        return '<redacted>';
+    }
+    if (ctx.provider.Entities.length === 0) {
+        return '<metadata-not-ready>';
+    }
+    // Determine the encrypted-field set from entity metadata IF this input maps to a known entity.
+    // Custom / non-CRUD inputs (e.g. GetDataInput) have no entity binding — that's fine; field-level
+    // @NoLog still applies below. The entity path only adds metadata-driven encrypted-field names.
+    let encryptedFieldNames = EMPTY_SET;
+    const match = INPUT_TYPE_REGEX.exec(ctx.inputTypeName);
+    if (match?.groups?.name) {
+        const entity = ctx.provider.Entities.find((e) => e.ClassName === match.groups.name);
+        if (entity) {
+            encryptedFieldNames = new Set(entity.EncryptedFields.map((f) => f.Name));
+        }
+    }
+    // Walk top-level keys whenever we have BOTH a redaction source (encrypted fields or @NoLog fields)
+    // AND a plain-object value. This honors field-level @NoLog even on non-entity-bound inputs — the
+    // exact case @NoLog exists for (custom resolvers, e.g. GetDataInputType.Token). Without a redaction
+    // source, or for non-object values, fall through to shortenForLog as before.
+    const canWalk = (encryptedFieldNames.size > 0 || ctx.noLogFields.size > 0) &&
+        ctx.rawValue !== null &&
+        typeof ctx.rawValue === 'object' &&
+        !Array.isArray(ctx.rawValue);
+    if (!canWalk) {
+        return shortenForLog(ctx.rawValue);
+    }
+    const result = {};
+    for (const [key, value] of Object.entries(ctx.rawValue)) {
+        if (encryptedFieldNames.has(key) || ctx.noLogFields.has(key)) {
+            result[key] = '<redacted>';
+        }
+        else {
+            result[key] = shortenForLog(value);
+        }
+    }
+    return result;
+}
+const EMPTY_SET = new Set();
+//# sourceMappingURL=secretRedactor.js.map

package/dist/logging/secretRedactor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secretRedactor.js","sourceRoot":"","sources":["../../src/logging/secretRedactor.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAuBnD,4FAA4F;AAC5F,+FAA+F;AAC/F,4FAA4F;AAC5F,kGAAkG;AAClG,MAAM,gBAAgB,GAAG,0CAA0C,CAAC;AAEpE,2EAA2E;AAC3E,2EAA2E;AAC3E,+EAA+E;AAC/E,+EAA+E;AAC/E,sEAAsE;AACtE,MAAM,UAAU,SAAS,CAAC,GAAqB;IAC7C,IAAI,GAAG,CAAC,cAAc,EAAE,CAAC;QACvB,OAAO,YAAY,CAAC;IACtB,CAAC;IAED,IAAI,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvC,OAAO,sBAAsB,CAAC;IAChC,CAAC;IAED,+FAA+F;IAC/F,iGAAiG;IACjG,+FAA+F;IAC/F,IAAI,mBAAmB,GAAwB,SAAS,CAAC;IACzD,MAAM,KAAK,GAAG,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IACvD,IAAI,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;QACxB,MAAM,MAAM,GAAG,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,KAAK,CAAC,MAAO,CAAC,IAAI,CAAC,CAAC;QACrF,IAAI,MAAM,EAAE,CAAC;YACX,mBAAmB,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QAC3E,CAAC;IACH,CAAC;IAED,mGAAmG;IACnG,iGAAiG;IACjG,oGAAoG;IACpG,6EAA6E;IAC7E,MAAM,OAAO,GACX,CAAC,mBAAmB,CAAC,IAAI,GAAG,CAAC,IAAI,GAAG,CAAC,WAAW,CAAC,IAAI,GAAG,CAAC,CAAC;QAC1D,GAAG,CAAC,QAAQ,KAAK,IAAI;QACrB,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ;QAChC,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAE/B,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACrC,CAAC;IAED,MAAM,MAAM,GAA4B,EAAE,CAAC;IAC3C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,QAAmC,CAAC,EAAE,CAAC;QACnF,IAAI,mBAAmB,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAC7D,MAAM,CAAC,GAAG,CAAC,GAAG,YAAY,CAAC;QAC7B,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,GAAG,CAAC,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;QACrC,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,SAAS,GAAwB,IAAI,GAAG,EAAU,CAAC"}

package/dist/logging/shortenForLog.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Renders a value for one-line console logging without Node's `[Object]` truncation.
+ * Arrays keep their structure; non-array objects collapse to JSON, truncated at `maxLen`.
+ * Objects whose JSON exceeds `maxLen` and contain nested structure are recursed into so
+ * outer keys remain visible.
+ */
+export declare function shortenForLog(value: unknown, maxLen?: number): unknown;
+//# sourceMappingURL=shortenForLog.d.ts.map

package/dist/logging/shortenForLog.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"shortenForLog.d.ts","sourceRoot":"","sources":["../../src/logging/shortenForLog.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,SAAM,GAAG,OAAO,CAUnE"}

package/dist/logging/shortenForLog.js

@@ -0,0 +1,21 @@
+/**
+ * Renders a value for one-line console logging without Node's `[Object]` truncation.
+ * Arrays keep their structure; non-array objects collapse to JSON, truncated at `maxLen`.
+ * Objects whose JSON exceeds `maxLen` and contain nested structure are recursed into so
+ * outer keys remain visible.
+ */
+export function shortenForLog(value, maxLen = 300) {
+    if (value === null || typeof value !== 'object')
+        return value;
+    if (Array.isArray(value))
+        return value.map((v) => shortenForLog(v, maxLen));
+    const json = JSON.stringify(value);
+    if (json.length <= maxLen)
+        return json;
+    const result = {};
+    for (const [k, v] of Object.entries(value)) {
+        result[k] = shortenForLog(v, maxLen);
+    }
+    return result;
+}
+//# sourceMappingURL=shortenForLog.js.map

package/dist/logging/shortenForLog.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"shortenForLog.js","sourceRoot":"","sources":["../../src/logging/shortenForLog.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAAC,KAAc,EAAE,MAAM,GAAG,GAAG;IACxD,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC9D,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;IAC5E,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACnC,IAAI,IAAI,CAAC,MAAM,IAAI,MAAM;QAAE,OAAO,IAAI,CAAC;IACvC,MAAM,MAAM,GAA4B,EAAE,CAAC;IAC3C,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC,EAAE,CAAC;QACtE,MAAM,CAAC,CAAC,CAAC,GAAG,aAAa,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IACvC,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/logging/variablesLoggingMiddleware.d.ts

@@ -0,0 +1,22 @@
+import type { MiddlewareFn } from 'type-graphql';
+import type { AppContext } from '../types.js';
+/**
+ * Variables-logging middleware. Default-off; gated on `loggingSettings.graphql.logVariables`.
+ *
+ * NOTE: this middleware is NOT the primary leak defense. The primary defense is the removal
+ * of the `variables` field from the always-on log line in `context.ts`. This middleware
+ * provides an opt-in, redacted verbose-echo path for developers debugging locally.
+ *
+ * When enabled, fires once per root resolver call (skips field resolvers via
+ * `info.path.prev === undefined`). For each `@Arg`:
+ *   - Derives the GraphQL input type name from the schema (NOT from `args[i].constructor.name`,
+ *     because type-graphql v2.0.0-beta.3 passes raw plain-object args to middleware).
+ *   - Looks up `@NoLog` marks (parameter-level on the resolver, field-level on the input class).
+ *   - Delegates redaction to `redactArg`.
+ *
+ * Emits a single `console.dir` line with shape `{ operation, args }`. Note: the key names
+ * differ from the always-on log line (`operationName` vs `operation`, `variables` vs `args`)
+ * — operators with log-grep automation should update their patterns.
+ */
+export declare const variablesLoggingMiddleware: MiddlewareFn<AppContext>;
+//# sourceMappingURL=variablesLoggingMiddleware.d.ts.map

package/dist/logging/variablesLoggingMiddleware.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"variablesLoggingMiddleware.d.ts","sourceRoot":"","sources":["../../src/logging/variablesLoggingMiddleware.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAKjD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AA2E9C;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,0BAA0B,EAAE,YAAY,CAAC,UAAU,CAsE/D,CAAC"}

package/dist/logging/variablesLoggingMiddleware.js

@@ -0,0 +1,127 @@
+import { getMetadataStorage } from 'type-graphql';
+import { getNamedType } from 'graphql';
+import { configInfo } from '../config.js';
+import { redactArg } from './secretRedactor.js';
+import { hasNoLogParameter, getNoLogFields } from './NoLog.js';
+let resolverLookup;
+function getResolverLookup() {
+    if (resolverLookup !== undefined) {
+        return resolverLookup;
+    }
+    const storage = getMetadataStorage();
+    const lookup = new Map();
+    const collect = (entries) => {
+        for (const entry of entries) {
+            lookup.set(entry.schemaName, {
+                target: entry.target,
+                methodName: entry.methodName,
+                params: entry.params ?? [],
+            });
+        }
+    };
+    collect(storage.queries);
+    collect(storage.mutations);
+    collect(storage.subscriptions);
+    resolverLookup = lookup;
+    return lookup;
+}
+function findInputClass(typeName) {
+    const storage = getMetadataStorage();
+    const found = storage.inputTypes.find((t) => t.name === typeName);
+    return found?.target;
+}
+/** Type guard for `MinimalArgParamMeta`. */
+function isArgParam(p) {
+    return p.kind === 'arg';
+}
+const warnedResolverSignatures = new Set();
+/**
+ * Variables-logging middleware. Default-off; gated on `loggingSettings.graphql.logVariables`.
+ *
+ * NOTE: this middleware is NOT the primary leak defense. The primary defense is the removal
+ * of the `variables` field from the always-on log line in `context.ts`. This middleware
+ * provides an opt-in, redacted verbose-echo path for developers debugging locally.
+ *
+ * When enabled, fires once per root resolver call (skips field resolvers via
+ * `info.path.prev === undefined`). For each `@Arg`:
+ *   - Derives the GraphQL input type name from the schema (NOT from `args[i].constructor.name`,
+ *     because type-graphql v2.0.0-beta.3 passes raw plain-object args to middleware).
+ *   - Looks up `@NoLog` marks (parameter-level on the resolver, field-level on the input class).
+ *   - Delegates redaction to `redactArg`.
+ *
+ * Emits a single `console.dir` line with shape `{ operation, args }`. Note: the key names
+ * differ from the always-on log line (`operationName` vs `operation`, `variables` vs `args`)
+ * — operators with log-grep automation should update their patterns.
+ */
+export const variablesLoggingMiddleware = async (action, next) => {
+    // Field resolvers (info.path.prev !== undefined) are skipped — only root @Query/@Mutation/@Subscription.
+    if (action.info.path.prev !== undefined) {
+        return next();
+    }
+    // Hot-path zero-cost short-circuit when the flag is off.
+    if (!configInfo.loggingSettings.graphql.logVariables) {
+        return next();
+    }
+    const provider = action.context.providers?.[0]?.provider;
+    if (!provider) {
+        return next();
+    }
+    const fieldDef = action.info.parentType.getFields()[action.info.fieldName];
+    if (!fieldDef) {
+        return next();
+    }
+    const resolverEntry = getResolverLookup().get(action.info.fieldName);
+    const argParams = (resolverEntry?.params ?? []).filter(isArgParam);
+    const redactedArgs = {};
+    let hasUndecoratedCustomArg = false;
+    for (const argDef of fieldDef.args) {
+        const inputTypeName = getNamedType(argDef.type).name;
+        const rawValue = action.args[argDef.name];
+        const paramMeta = argParams.find((p) => p.name === argDef.name);
+        const noLogParameter = paramMeta && resolverEntry
+            ? hasNoLogParameter(resolverEntry.target, resolverEntry.methodName, paramMeta.index)
+            : false;
+        const inputClass = findInputClass(inputTypeName);
+        const noLogFields = inputClass ? getNoLogFields(inputClass) : new Set();
+        redactedArgs[argDef.name] = redactArg({
+            inputTypeName,
+            rawValue,
+            provider,
+            noLogParameter,
+            noLogFields,
+        });
+        if (!noLogParameter && isCustomArg(inputTypeName, noLogFields, provider)) {
+            hasUndecoratedCustomArg = true;
+        }
+    }
+    // eslint-disable-next-line no-console
+    console.dir({ operation: action.info.fieldName, args: redactedArgs }, { depth: null, breakLength: 200 });
+    if (hasUndecoratedCustomArg && resolverEntry) {
+        const signature = `${resolverEntry.target.name}.${resolverEntry.methodName}`;
+        if (!warnedResolverSignatures.has(signature)) {
+            warnedResolverSignatures.add(signature);
+            console.warn(`[mj:NoLog] Resolver ${signature} has un-decorated, non-metadata-bound argument(s). ` +
+                `Variables for this resolver were logged in plaintext while logVariables=true is active. ` +
+                `Apply @NoLog to sensitive arguments to suppress this.`);
+        }
+    }
+    return next();
+};
+/**
+ * Heuristic: an arg is "custom" (i.e. needs `@NoLog` discipline because metadata can't redact it)
+ * when its GraphQL input type is not a known `Create<X>Input` / `Update<X>Input` for an entity
+ * in the provider, AND no field-level `@NoLog` marks are present on the input class.
+ */
+function isCustomArg(inputTypeName, noLogFields, provider) {
+    if (noLogFields.size > 0) {
+        return false;
+    }
+    const match = /^(Create|Update)(?<name>.+)Input$/.exec(inputTypeName);
+    if (!match || !match.groups?.name) {
+        return true;
+    }
+    const className = match.groups.name;
+    const found = provider.Entities.find((e) => e.ClassName === className);
+    return !found;
+}
+//# sourceMappingURL=variablesLoggingMiddleware.js.map

package/dist/logging/variablesLoggingMiddleware.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"variablesLoggingMiddleware.js","sourceRoot":"","sources":["../../src/logging/variablesLoggingMiddleware.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAEvC,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAE1C,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAChD,OAAO,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AA+B/D,IAAI,cAAsD,CAAC;AAE3D,SAAS,iBAAiB;IACxB,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;QACjC,OAAO,cAAc,CAAC;IACxB,CAAC;IACD,MAAM,OAAO,GAAG,kBAAkB,EAKjC,CAAC;IACF,MAAM,MAAM,GAAG,IAAI,GAAG,EAAyB,CAAC;IAChD,MAAM,OAAO,GAAG,CAAC,OAA2C,EAAQ,EAAE;QACpE,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,EAAE;gBAC3B,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,EAAE;aAC3B,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC;IACF,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACzB,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAC3B,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IAC/B,cAAc,GAAG,MAAM,CAAC;IACxB,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,cAAc,CAAC,QAAgB;IACtC,MAAM,OAAO,GAAG,kBAAkB,EAA0E,CAAC;IAC7G,MAAM,KAAK,GAAG,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC;IAClE,OAAO,KAAK,EAAE,MAAM,CAAC;AACvB,CAAC;AAED,4CAA4C;AAC5C,SAAS,UAAU,CAAC,CAAmB;IACrC,OAAO,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC;AAC1B,CAAC;AAED,MAAM,wBAAwB,GAAG,IAAI,GAAG,EAAU,CAAC;AAEnD;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAA6B,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE;IACzF,yGAAyG;IACzG,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QACxC,OAAO,IAAI,EAAE,CAAC;IAChB,CAAC;IAED,yDAAyD;IACzD,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC;QACrD,OAAO,IAAI,EAAE,CAAC;IAChB,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC;IACzD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,IAAI,EAAE,CAAC;IAChB,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC3E,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,IAAI,EAAE,CAAC;IAChB,CAAC;IAED,MAAM,aAAa,GAAG,iBAAiB,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACrE,MAAM,SAAS,GAAuC,CAAC,aAAa,EAAE,MAAM,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IAEvG,MAAM,YAAY,GAA4B,EAAE,CAAC;IACjD,IAAI,uBAAuB,GAAG,KAAK,CAAC;IACpC,KAAK,MAAM,MAAM,IAAI,QAAQ,CAAC,IAAsC,EAAE,CAAC;QACrE,MAAM,aAAa,GAAG,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC;QACrD,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAE1C,MAAM,SAAS,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC;QAChE,MAAM,cAAc,GAAG,SAAS,IAAI,aAAa;YAC/C,CAAC,CAAC,iBAAiB,CAAC,aAAa,CAAC,MAAM,EAAE,aAAa,CAAC,UAAU,EAAE,SAAS,CAAC,KAAK,CAAC;YACpF,CAAC,CAAC,KAAK,CAAC;QAEV,MAAM,UAAU,GAAG,cAAc,CAAC,aAAa,CAAC,CAAC;QACjD,MAAM,WAAW,GAAG,UAAU,CAAC,CAAC,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,EAAU,CAAC;QAEhF,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC;YACpC,aAAa;YACb,QAAQ;YACR,QAAQ;YACR,cAAc;YACd,WAAW;SACZ,CAAC,CAAC;QAEH,IAAI,CAAC,cAAc,IAAI,WAAW,CAAC,aAAa,EAAE,WAAW,EAAE,QAAQ,CAAC,EAAE,CAAC;YACzE,uBAAuB,GAAG,IAAI,CAAC;QACjC,CAAC;IACH,CAAC;IAED,sCAAsC;IACtC,OAAO,CAAC,GAAG,CACT,EAAE,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,YAAY,EAAE,EACxD,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE,CAClC,CAAC;IAEF,IAAI,uBAAuB,IAAI,aAAa,EAAE,CAAC;QAC7C,MAAM,SAAS,GAAG,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,IAAI,aAAa,CAAC,UAAU,EAAE,CAAC;QAC7E,IAAI,CAAC,wBAAwB,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;YAC7C,wBAAwB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YACxC,OAAO,CAAC,IAAI,CACV,uBAAuB,SAAS,qDAAqD;gBACrF,0FAA0F;gBAC1F,uDAAuD,CACxD,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,IAAI,EAAE,CAAC;AAChB,CAAC,CAAC;AAEF;;;;GAIG;AACH,SAAS,WAAW,CAClB,aAAqB,EACrB,WAAgC,EAChC,QAA4D;IAE5D,IAAI,WAAW,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,KAAK,GAAG,mCAAmC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IACtE,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC;QAClC,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,SAAS,GAAG,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC;IACpC,MAAM,KAAK,GAAG,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC;IACvE,OAAO,CAAC,KAAK,CAAC;AAChB,CAAC"}

package/dist/resolvers/GetDataResolver.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"GetDataResolver.d.ts","sourceRoot":"","sources":["../../src/resolvers/GetDataResolver.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAUzC,qBACa,gBAAgB;IAEzB,KAAK,EAAE,MAAM,CAAC;IAGd,OAAO,EAAE,MAAM,EAAE,CAAC;CACrB;AAGD,qBACa,iBAAiB;IAE1B,OAAO,EAAE,OAAO,CAAC;IAGjB,OAAO,EAAE,MAAM,EAAE,CAAC;IAGlB,aAAa,EAAE,CAAC,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC;IAEjC;;OAEG;IAEH,OAAO,EAAE,CAAC,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC;CAC9B;AAED,qBACa,sBAAsB;IAE/B,OAAO,EAAE,OAAO,CAAC;IAGjB,YAAY,CAAC,EAAE,MAAM,CAAC;IAGtB,OAAO,EAAE,sBAAsB,EAAE,CAAC;CACrC;AAED,qBACa,sBAAsB;IAE/B,EAAE,EAAE,MAAM,CAAC;IAGX,IAAI,EAAE,MAAM,CAAC;IAGb,WAAW,CAAC,EAAE,MAAM,CAAC;IAGrB,UAAU,EAAE,MAAM,CAAC;IAGnB,QAAQ,EAAE,MAAM,CAAC;IAGjB,SAAS,EAAE,MAAM,CAAC;IAGlB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAGlB,SAAS,CAAC,EAAE,MAAM,CAAC;IAGnB,MAAM,EAAE,2BAA2B,EAAE,CAAC;CACzC;AAED,qBACa,2BAA2B;IAEpC,EAAE,EAAE,MAAM,CAAC;IAGX,IAAI,EAAE,MAAM,CAAC;IAGb,WAAW,CAAC,EAAE,MAAM,CAAC;IAGrB,IAAI,EAAE,MAAM,CAAC;IAGb,UAAU,EAAE,OAAO,CAAC;IAGpB,SAAS,EAAE,MAAM,CAAC;CACrB;AAED;;GAEG;AACH,qBAAa,eAAe;IACxB;;;;OAIG;IAGG,OAAO,CACyB,KAAK,EAAE,gBAAgB,EACtD,OAAO,EAAE,UAAU,GACvB,OAAO,CAAC,iBAAiB,CAAC;IAmGvB,cAAc,CACb,OAAO,EAAE,UAAU,GACvB,OAAO,CAAC,sBAAsB,CAAC;CAsCrC;AAGD,qBAAa,WAAW;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,IAAI,CAAC;IACb,UAAU,EAAE,GAAG,CAAC;CACnB;AACD;;;;GAIG;AACH,qBAAa,kBAAkB;IAC3B,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,IAAI,CAAC;IAChB,UAAU,EAAE,IAAI,CAAC;IACjB;;OAEG;IACH,gBAAgB,EAAE,GAAG,CAAC;IACtB,SAAS,EAAE,WAAW,EAAE,CAAC;CAC5B;AAGD,wBAAgB,mBAAmB,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,QAAQ,GAAE,MAA+B,EAAE,gBAAgB,CAAC,EAAE,GAAG,GAAG,kBAAkB,CAezI;AACD,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,QAQ9C;AACD,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,WAExC;AACD,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,WAMzC;AACD,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,QAW5D"}
+{"version":3,"file":"GetDataResolver.d.ts","sourceRoot":"","sources":["../../src/resolvers/GetDataResolver.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAWzC,qBACa,gBAAgB;IAGzB,KAAK,EAAE,MAAM,CAAC;IAGd,OAAO,EAAE,MAAM,EAAE,CAAC;CACrB;AAGD,qBACa,iBAAiB;IAE1B,OAAO,EAAE,OAAO,CAAC;IAGjB,OAAO,EAAE,MAAM,EAAE,CAAC;IAGlB,aAAa,EAAE,CAAC,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC;IAEjC;;OAEG;IAEH,OAAO,EAAE,CAAC,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC;CAC9B;AAED,qBACa,sBAAsB;IAE/B,OAAO,EAAE,OAAO,CAAC;IAGjB,YAAY,CAAC,EAAE,MAAM,CAAC;IAGtB,OAAO,EAAE,sBAAsB,EAAE,CAAC;CACrC;AAED,qBACa,sBAAsB;IAE/B,EAAE,EAAE,MAAM,CAAC;IAGX,IAAI,EAAE,MAAM,CAAC;IAGb,WAAW,CAAC,EAAE,MAAM,CAAC;IAGrB,UAAU,EAAE,MAAM,CAAC;IAGnB,QAAQ,EAAE,MAAM,CAAC;IAGjB,SAAS,EAAE,MAAM,CAAC;IAGlB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAGlB,SAAS,CAAC,EAAE,MAAM,CAAC;IAGnB,MAAM,EAAE,2BAA2B,EAAE,CAAC;CACzC;AAED,qBACa,2BAA2B;IAEpC,EAAE,EAAE,MAAM,CAAC;IAGX,IAAI,EAAE,MAAM,CAAC;IAGb,WAAW,CAAC,EAAE,MAAM,CAAC;IAGrB,IAAI,EAAE,MAAM,CAAC;IAGb,UAAU,EAAE,OAAO,CAAC;IAGpB,SAAS,EAAE,MAAM,CAAC;CACrB;AAED;;GAEG;AACH,qBAAa,eAAe;IACxB;;;;OAIG;IAGG,OAAO,CACyB,KAAK,EAAE,gBAAgB,EACtD,OAAO,EAAE,UAAU,GACvB,OAAO,CAAC,iBAAiB,CAAC;IAqGvB,cAAc,CACb,OAAO,EAAE,UAAU,GACvB,OAAO,CAAC,sBAAsB,CAAC;CAsCrC;AAGD,qBAAa,WAAW;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,IAAI,CAAC;IACb,UAAU,EAAE,GAAG,CAAC;CACnB;AACD;;;;GAIG;AACH,qBAAa,kBAAkB;IAC3B,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,IAAI,CAAC;IAChB,UAAU,EAAE,IAAI,CAAC;IACjB;;OAEG;IACH,gBAAgB,EAAE,GAAG,CAAC;IACtB,SAAS,EAAE,WAAW,EAAE,CAAC;CAC5B;AAGD,wBAAgB,mBAAmB,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,QAAQ,GAAE,MAA+B,EAAE,gBAAgB,CAAC,EAAE,GAAG,GAAG,kBAAkB,CAezI;AACD,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,QAQ9C;AACD,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,WAExC;AACD,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,WAMzC;AACD,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,QAW5D"}

package/dist/resolvers/GetDataResolver.js

@@ -11,9 +11,10 @@ var __param = (this && this.__param) || function (paramIndex, decorator) {
     return function (target, key) { decorator(target, key, paramIndex); }
 };
 import { Arg, Ctx, Field, InputType, ObjectType, Query } from 'type-graphql';
-import { LogError, LogStatus } from '@memberjunction/core';
+import { LogError, LogStatus, LogStatusEx } from '@memberjunction/core';
 import { QueryCompositionEngine } from '@memberjunction/generic-database-provider';
 import { RequireSystemUser } from '../directives/RequireSystemUser.js';
+import { NoLog } from '../logging/NoLog.js';
 import { v4 as uuidv4 } from 'uuid';
 import { GetReadOnlyDataSource, GetReadOnlyProvider } from '../util.js';
 import { getDbType } from '../index.js';
@@ -23,6 +24,7 @@ let GetDataInputType = class GetDataInputType {
 };
 __decorate([
     Field(() => String),
+    NoLog,
     __metadata("design:type", String)
 ], GetDataInputType.prototype, "Token", void 0);
 __decorate([
@@ -158,9 +160,11 @@ export class GetDataResolver {
      */
     async GetData(input, context) {
         try {
-            LogStatus(`GetDataResolver.GetData() ---- IMPORTANT - temporarily using the same connection as rest of the server, we need to separately create a READ ONLY CONNECTION and pass that in 
-                       the AppContext so we can use that special connection here to ensure we are using a lower privileged connection for this operation to prevent mutation from being possible.`);
-            LogStatus(`${JSON.stringify(input)}`);
+            LogStatusEx({
+                message: `GetDataResolver.GetData() ---- IMPORTANT - temporarily using the same connection as rest of the server, we need to separately create a READ ONLY CONNECTION and pass that in the AppContext so we can use that special connection here to ensure we are using a lower privileged connection for this operation to prevent mutation from being possible.`,
+                verboseOnly: true,
+            });
+            LogStatus(`GetData invoked: ${input.Queries.length} queries`);
             // validate the token
             if (!isTokenValid(input.Token)) {
                 throw new Error(`Token ${input.Token} is not valid or has expired`);