@memberjunction/server 5.38.0 → 5.40.0

package/src/generic/FireAndForgetHeartbeat.ts

@@ -0,0 +1,85 @@
+import { PubSubEngine } from 'type-graphql';
+import { LogError } from '@memberjunction/core';
+import { PUSH_STATUS_UPDATES_TOPIC } from './PushStatusResolver.js';
+
+/** Default cadence for fire-and-forget liveness pulses (5 minutes). */
+export const DEFAULT_PULSE_INTERVAL_MS = 5 * 60 * 1000;
+
+/** The `type` discriminator carried by liveness pulse messages. */
+export const HEARTBEAT_MESSAGE_TYPE = 'Heartbeat';
+
+/**
+ * Lightweight status snapshot included in an enriched pulse so the client can
+ * correlate the pulse with a run record and surface a coarse "still running"
+ * signal. Read from the in-memory run entity — never a DB query.
+ */
+export interface PulseStatus {
+    /** Primary key of the persisted run record (AIAgentRun, TestRun, TestSuiteRun). */
+    runId?: string;
+    /** Current run status, e.g. 'Running'. */
+    status?: string;
+    /** Optional human-readable current step for UI display. */
+    currentStep?: string;
+}
+
+/** Handle returned by {@link startLivenessPulse}; call `stop()` when the work settles. */
+export interface LivenessPulseHandle {
+    stop(): void;
+}
+
+export interface LivenessPulseOptions {
+    /** PubSub engine used to publish on the shared push-status topic. */
+    pubSub: PubSubEngine;
+    /** Session the client is subscribed on (used by the subscription filter). */
+    sessionId: string;
+    /** Resolver label echoed in the message envelope (e.g. 'RunAIAgentResolver'). */
+    resolver: string;
+    /** Pulse cadence in ms. Defaults to {@link DEFAULT_PULSE_INTERVAL_MS}. */
+    intervalMs?: number;
+    /**
+     * Optional cheap status reader invoked on each tick. Should read from an
+     * in-memory ref, not the database. Errors are swallowed so a transient read
+     * never kills the pulse loop.
+     */
+    readStatus?: () => PulseStatus | undefined;
+}
+
+/**
+ * Publishes a periodic liveness pulse on {@link PUSH_STATUS_UPDATES_TOPIC} while a
+ * fire-and-forget background operation runs. Each pulse resets the client's idle
+ * timer, so a long-but-active operation never spuriously times out. The pulse
+ * stops when the caller invokes `stop()` (typically in the background promise's
+ * `finally` block).
+ *
+ * The envelope matches the resolvers' existing push-status messages
+ * (`{ message: JSON.stringify({ resolver, type, status, data }), sessionId }`),
+ * so the client receives it through the same subscription with no special parsing.
+ */
+export function startLivenessPulse(options: LivenessPulseOptions): LivenessPulseHandle {
+    const { pubSub, sessionId, resolver, readStatus } = options;
+    const intervalMs = options.intervalMs ?? DEFAULT_PULSE_INTERVAL_MS;
+
+    const timer = setInterval(() => {
+        let data: PulseStatus | undefined;
+        try {
+            data = readStatus?.();
+        } catch (e) {
+            // A status read failure must not break the liveness loop.
+            LogError(`[LivenessPulse:${resolver}] readStatus failed: ${(e as Error).message}`);
+        }
+
+        pubSub.publish(PUSH_STATUS_UPDATES_TOPIC, {
+            message: JSON.stringify({
+                resolver,
+                type: HEARTBEAT_MESSAGE_TYPE,
+                status: 'ok',
+                data: data ?? {},
+            }),
+            sessionId,
+        });
+    }, intervalMs);
+
+    return {
+        stop: () => clearInterval(timer),
+    };
+}

package/src/generic/ResolverBase.ts

@@ -587,7 +587,16 @@ export class ResolverBase {
 
     // first check permissions, the logged in user must have read permissions on the entity to run the view
     if (entityInfo) {
-      const userInfo = UserCache.Users.find((u) => u.Email.toLowerCase().trim() === userPayload.email.toLowerCase().trim()); // get the user record from MD so we have ROLES attached, don't use the one from payload directly
+      // Prefer the authenticated session's payload user WHEN it carries roles — that is the
+      // authoritative per-session identity (and, for magic-link sessions, carries claims-based
+      // synthesized roles that are deliberately NOT persisted to the shared UserCache). For
+      // normal users the payload user IS the UserCache user, so this is a no-op; we only diverge
+      // for per-session synthesized identities. Fall back to the cache lookup when the payload
+      // user has no roles attached (older/edge auth paths).
+      const payloadUser = this.GetUserFromPayload(userPayload);
+      const userInfo = (payloadUser && payloadUser.UserRoles && payloadUser.UserRoles.length > 0)
+        ? payloadUser
+        : UserCache.Users.find((u) => u.Email.toLowerCase().trim() === userPayload.email.toLowerCase().trim());
       if (!userInfo) {
         throw new Error(`User ${userPayload.email} not found in metadata`);
       }
@@ -709,7 +718,12 @@ export class ResolverBase {
       await this.CheckAPIKeyScopeAuthorization('view:run', viewInfo.Entity, userPayload);
 
       const md = provider
-      const user = UserCache.Users.find((u) => u.Email.toLowerCase().trim() === userPayload?.email.toLowerCase().trim());
+      // Prefer the authenticated session's payload user — it is the authoritative per-request
+      // identity and (for magic-link sessions) carries the per-session resource scope / synthesized
+      // roles that drive RLS. The cached lookup is a fallback for paths where the payload user
+      // isn't populated. For normal users the two are the same instance, so this is a no-op.
+      const user = this.GetUserFromPayload(userPayload)
+        ?? UserCache.Users.find((u) => u.Email.toLowerCase().trim() === userPayload?.email.toLowerCase().trim());
       if (!user) throw new Error(`User ${userPayload?.email} not found in metadata`);
 
       const entityInfo = md.Entities.find((e) => e.Name === viewInfo.Entity);
@@ -823,8 +837,14 @@ export class ResolverBase {
       // Fix #1: Get user info only once for all queries
       let contextUser: UserInfo | null = null;
       if (params[0]?.userPayload?.email) {
-        const userEmail = params[0].userPayload.email.toLowerCase().trim();
-        const user = UserCache.Users.find(u => u.Email.toLowerCase().trim() === userEmail);
+        const userPayload = params[0].userPayload;
+        const userEmail = userPayload.email.toLowerCase().trim();
+        // Prefer the authenticated session's payload user — it is the authoritative per-request
+        // identity and (for magic-link sessions) carries the per-session resource scope / synthesized
+        // roles that drive RLS. The cached lookup is a fallback for paths where the payload user
+        // isn't populated. For normal users the two are the same instance, so this is a no-op.
+        const user = this.GetUserFromPayload(userPayload)
+          ?? UserCache.Users.find(u => u.Email.toLowerCase().trim() === userEmail);
         if (!user) {
           throw new Error(`User ${userEmail} not found in metadata`);
         }
@@ -921,7 +941,9 @@ export class ResolverBase {
       if (!entityInfo) throw new Error(`Entity ${entityName} not found in metadata`);
 
       if (entityInfo.AuditRecordAccess) {
-        const userInfo = UserCache.Users.find((u) => u.Email.toLowerCase().trim() === userPayload?.email.toLowerCase().trim());
+        // Prefer the per-session payload user (the actual actor for this request) over the cache lookup.
+        const userInfo = this.GetUserFromPayload(userPayload)
+          ?? UserCache.Users.find((u) => u.Email.toLowerCase().trim() === userPayload?.email.toLowerCase().trim());
         const auditLogTypeName = 'Record Accessed';
         const auditLogType = md.AuditLogTypes.find((a) => a.Name.trim().toLowerCase() === auditLogTypeName.trim().toLowerCase());
 
@@ -939,7 +961,11 @@ export class ResolverBase {
     const md = provider;
     const entityInfo = md.Entities.find((e) => e.Name.trim().toLowerCase() === entityName.trim().toLowerCase());
     if (!entityInfo) throw new Error(`Entity ${entityName} not found in metadata`);
-    const user = UserCache.Users.find((u) => u.Email.toLowerCase().trim() === userPayload?.email.toLowerCase().trim());
+    // Prefer the authenticated session's payload user — it is the authoritative per-request identity
+    // and (for magic-link sessions) carries the per-session resource scope / synthesized roles that
+    // the RLS WHERE clause (e.g. {{ScopeResourceID}}) depends on. Cache lookup is the fallback.
+    const user = this.GetUserFromPayload(userPayload)
+      ?? UserCache.Users.find((u) => u.Email.toLowerCase().trim() === userPayload?.email.toLowerCase().trim());
     if (!user) throw new Error(`User ${userPayload?.email} not found in metadata`);
 
     return entityInfo.GetUserRowLevelSecurityWhereClause(user, type, returnPrefix);
@@ -957,7 +983,9 @@ export class ResolverBase {
   ): Promise<any> {
     try {
       const md = provider;
-      const userInfo = UserCache.Users.find((u) => u.Email.toLowerCase().trim() === userPayload?.email.toLowerCase().trim());
+      // Prefer the per-session payload user (the actual actor for this request) over the cache lookup.
+      const userInfo = this.GetUserFromPayload(userPayload)
+        ?? UserCache.Users.find((u) => u.Email.toLowerCase().trim() === userPayload?.email.toLowerCase().trim());
       const authorization = authorizationName
         ? md.Authorizations.find((a) => a.Name.trim().toLowerCase() === authorizationName.trim().toLowerCase())
         : null;

package/src/generic/__tests__/FireAndForgetHeartbeat.test.ts

@@ -0,0 +1,99 @@
+import 'reflect-metadata';
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
+import { PubSubEngine } from 'type-graphql';
+import {
+    startLivenessPulse,
+    DEFAULT_PULSE_INTERVAL_MS,
+    HEARTBEAT_MESSAGE_TYPE,
+} from '../FireAndForgetHeartbeat';
+import { PUSH_STATUS_UPDATES_TOPIC } from '../PushStatusResolver';
+
+/** Minimal PubSubEngine stub capturing publish calls. */
+function makePubSub() {
+    const publish = vi.fn().mockResolvedValue(undefined);
+    return { publish } as unknown as PubSubEngine & { publish: ReturnType<typeof vi.fn> };
+}
+
+function parseLastMessage(pubSub: { publish: ReturnType<typeof vi.fn> }) {
+    const [topic, payload] = pubSub.publish.mock.calls[pubSub.publish.mock.calls.length - 1];
+    return { topic, payload, parsed: JSON.parse(payload.message) };
+}
+
+describe('startLivenessPulse', () => {
+    beforeEach(() => {
+        vi.useFakeTimers();
+    });
+
+    afterEach(() => {
+        vi.useRealTimers();
+        vi.restoreAllMocks();
+    });
+
+    it('does not publish before the first interval elapses', () => {
+        const pubSub = makePubSub();
+        startLivenessPulse({ pubSub, sessionId: 's1', resolver: 'TestResolver' });
+        vi.advanceTimersByTime(DEFAULT_PULSE_INTERVAL_MS - 1);
+        expect(pubSub.publish).not.toHaveBeenCalled();
+    });
+
+    it('publishes a heartbeat on the push-status topic each interval', () => {
+        const pubSub = makePubSub();
+        startLivenessPulse({ pubSub, sessionId: 's1', resolver: 'TestResolver', intervalMs: 1000 });
+
+        vi.advanceTimersByTime(3000);
+
+        expect(pubSub.publish).toHaveBeenCalledTimes(3);
+        const { topic, payload, parsed } = parseLastMessage(pubSub);
+        expect(topic).toBe(PUSH_STATUS_UPDATES_TOPIC);
+        expect(payload.sessionId).toBe('s1');
+        expect(parsed.resolver).toBe('TestResolver');
+        expect(parsed.type).toBe(HEARTBEAT_MESSAGE_TYPE);
+    });
+
+    it('includes the enriched status snapshot from readStatus', () => {
+        const pubSub = makePubSub();
+        startLivenessPulse({
+            pubSub,
+            sessionId: 's1',
+            resolver: 'RunAIAgentResolver',
+            intervalMs: 1000,
+            readStatus: () => ({ runId: 'run-123', status: 'Running', currentStep: 'Prompt' }),
+        });
+
+        vi.advanceTimersByTime(1000);
+
+        const { parsed } = parseLastMessage(pubSub);
+        expect(parsed.data).toEqual({ runId: 'run-123', status: 'Running', currentStep: 'Prompt' });
+    });
+
+    it('publishes an empty data object when readStatus throws (loop survives)', () => {
+        const pubSub = makePubSub();
+        startLivenessPulse({
+            pubSub,
+            sessionId: 's1',
+            resolver: 'RunAIAgentResolver',
+            intervalMs: 1000,
+            readStatus: () => {
+                throw new Error('transient read failure');
+            },
+        });
+
+        vi.advanceTimersByTime(2000);
+
+        expect(pubSub.publish).toHaveBeenCalledTimes(2);
+        const { parsed } = parseLastMessage(pubSub);
+        expect(parsed.data).toEqual({});
+    });
+
+    it('stops publishing after stop() is called', () => {
+        const pubSub = makePubSub();
+        const handle = startLivenessPulse({ pubSub, sessionId: 's1', resolver: 'TestResolver', intervalMs: 1000 });
+
+        vi.advanceTimersByTime(2000);
+        expect(pubSub.publish).toHaveBeenCalledTimes(2);
+
+        handle.stop();
+        vi.advanceTimersByTime(5000);
+        expect(pubSub.publish).toHaveBeenCalledTimes(2);
+    });
+});

package/src/index.ts

@@ -4,7 +4,7 @@ dotenv.config({ quiet: true });
 
 import { expressMiddleware } from '@as-integrations/express5';
 import { mergeSchemas } from '@graphql-tools/schema';
-import { Metadata, DatabasePlatform, SetProvider, StartupManager as StartupManagerImport, BaseEntity, BaseEntityEvent, RunView } from '@memberjunction/core';
+import { Metadata, DatabasePlatform, SetProvider, StartupManager as StartupManagerImport, BaseEntity, BaseEntityEvent, RunView, DatabaseProviderBase } from '@memberjunction/core';
 import { resolveDbPlatformFromEnv } from '@memberjunction/generic-database-provider';
 import { MJGlobal, MJEventType, UUIDsEqual, ShutdownRegistry } from '@memberjunction/global';
 import { setupSQLServerClient, SQLServerDataProvider, SQLServerProviderConfigData, UserCache } from '@memberjunction/sqlserver-dataprovider';
@@ -30,9 +30,13 @@ import { default as jwt } from 'jsonwebtoken';
 import { contextFunction, createUnifiedAuthMiddleware, getUserPayload } from './context.js';
 import { UserPayload } from './types.js';
 import { requireSystemUserDirective, publicDirective } from './directives/index.js';
+import { variablesLoggingMiddleware } from './logging/variablesLoggingMiddleware.js';
+import { auditResolversForUndecoratedArgs } from './logging/bootAudit.js';
 import createMSSQLConfig from './orm.js';
 import { setupRESTEndpoints } from './rest/setupRESTEndpoints.js';
 import { createOAuthCallbackHandler } from './rest/OAuthCallbackHandler.js';
+import { createSignatureWebhookHandler } from './rest/SignatureWebhookHandler.js';
+import { createMagicLinkHandler, registerMagicLinkAuthProvider, MAGIC_LINK_MOUNT_PATH } from './auth/magicLink/index.js';
 
 import { resolve } from 'node:path';
 import { DataSourceInfo, raiseEvent } from './types.js';
@@ -45,7 +49,9 @@ import { GetAPIKeyEngine } from '@memberjunction/api-keys';
 import { RedisLocalStorageProvider } from '@memberjunction/redis-provider';
 import { GenericDatabaseProvider } from '@memberjunction/generic-database-provider';
 import { PubSubManager } from './generic/PubSubManager.js';
-import { ClientToolRequestManager } from '@memberjunction/ai-agents';
+import { IntegrationProgressEmitter } from '@memberjunction/integration-progress-artifacts';
+import { PublishIntegrationProgress } from './resolvers/IntegrationProgressResolver.js';
+import { ClientToolRequestManager, AgentRunWatchdog } from '@memberjunction/ai-agents';
 import { CACHE_INVALIDATION_TOPIC } from './generic/CacheInvalidationResolver.js';
 import { ConnectorFactory, IntegrationEngine, IntegrationSyncOptions } from '@memberjunction/integration-engine';
 import { CronExpressionHelper } from '@memberjunction/scheduling-engine';
@@ -83,6 +89,7 @@ export { configInfo, DEFAULT_SERVER_CONFIG } from './config.js';
 export { ServerExtensionLoader, BaseServerExtension } from '@memberjunction/server-extensions-core';
 export type { ServerExtensionConfig, ExtensionInitResult, ExtensionHealthResult } from '@memberjunction/server-extensions-core';
 export * from './directives/index.js';
+export { NoLog, hasNoLogParameter, getNoLogFields } from './logging/NoLog.js';
 export * from './entitySubclasses/MJEntityPermissionEntityServer.server.js';
 export * from './types.js';
 export {
@@ -106,7 +113,10 @@ export * from './resolvers/SearchKnowledgeResolver.js';
 export * from './resolvers/SearchKnowledgeStreamResolver.js';
 export * from './resolvers/AvailableSearchProvidersResolver.js';
 export * from './resolvers/FetchEntityVectorsResolver.js';
+export * from './resolvers/RunClusterAnalysisResolver.js';
+export * from './resolvers/GenerateSeedTaxonomyResolver.js';
 export * from './resolvers/PipelineProgressResolver.js';
+export * from './resolvers/IntegrationProgressResolver.js';
 export * from './resolvers/ClientToolRequestResolver.js';
 export * from './resolvers/AutotagPipelineResolver.js';
 export * from './resolvers/TagGovernanceResolver.js';
@@ -150,6 +160,7 @@ export * from './resolvers/FileResolver.js';
 export * from './resolvers/InfoResolver.js';
 export * from './resolvers/PotentialDuplicateRecordResolver.js';
 export * from './resolvers/RunTestResolver.js';
+export * from './resolvers/SearchEntitiesResolver.js';
 export * from './resolvers/UserFavoriteResolver.js';
 export * from './resolvers/UserResolver.js';
 export * from './resolvers/UserViewResolver.js';
@@ -294,6 +305,86 @@ export const serve = async (resolverPaths: Array<string>, app: Application = cre
       return origExecuteSQLWithPool.call(this, pool, query, parameters, contextUser);
     };
 
+    // Set up CodeGen-credentialed provider + in-process CodeGen runner for RSU (PostgreSQL).
+    // Without this, RuntimeSchemaManager has no injected runner and falls back to spawning a
+    // child-process CodeGen. On Postgres that child path is slow, its output is buffered (so
+    // progress is unobservable), and a non-responding advancedGen AI pass hangs it indefinitely
+    // — which leaves association/junction CRUD functions un-regenerated and blocks the sync.
+    // Running in-process keeps CodeGen inside the MJAPI event loop where it is observable and
+    // bounded by advanced_generation's per-call timeout + circuit breaker. Mirrors the SQL
+    // Server path below (the runner is required for BOTH platforms).
+    const pgCodegenUser = process.env.CODEGEN_DB_USERNAME;
+    const pgCodegenPass = process.env.CODEGEN_DB_PASSWORD;
+    if (pgCodegenUser && pgCodegenPass) {
+      try {
+        const codegenPgPool = new pg.default.Pool({
+          host: pgHost,
+          port: pgPort,
+          user: pgCodegenUser,
+          password: pgCodegenPass,
+          database: pgDatabase,
+          max: 10,
+        });
+        const codegenTestClient = await codegenPgPool.connect();
+        await codegenTestClient.query('SELECT 1');
+        codegenTestClient.release();
+
+        const { RuntimeSchemaManager } = await import('@memberjunction/schema-engine');
+        const codegenPgConfigData = new PostgreSQLProviderConfigData(
+          { Host: pgHost, Port: pgPort, Database: pgDatabase, User: pgCodegenUser, Password: pgCodegenPass },
+          mj_core_schema,
+          cacheRefreshInterval / 1000, // ms → seconds
+        );
+        const codegenPgProvider = new PostgreSQLDataProvider();
+        await codegenPgProvider.Config(codegenPgConfigData); // separate pool (per-instance manager); does NOT touch the global API provider
+        RuntimeSchemaManager.Instance.SetDDLProvider(codegenPgProvider);
+        console.log('RSU DDL provider initialized with CodeGen credentials (PostgreSQL).');
+
+        // Set up in-process CodeGen runner for RSU
+        try {
+          const { RunCodeGenBase } = await import('@memberjunction/codegen-lib');
+          const { PostgreSQLCodeGenConnection } = await import('@memberjunction/codegen-lib/dist/Database/providers/postgresql/PostgreSQLCodeGenConnection.js');
+
+          const codegenConnection = new PostgreSQLCodeGenConnection(codegenPgPool);
+          const codegenCurrentUser = UserCache.Instance.Users.find(u => u.Type?.trim().toLowerCase() === 'owner') ?? UserCache.Instance.Users[0];
+
+          const codegenDataSource = {
+            provider: codegenPgProvider,
+            connection: codegenConnection,
+            currentUser: codegenCurrentUser,
+            connectionInfo: `${pgHost}:${pgPort}/${pgDatabase} (CodeGen)`,
+          };
+
+          const runObject = MJGlobal.Instance.ClassFactory.CreateInstance(RunCodeGenBase) as InstanceType<typeof RunCodeGenBase>;
+
+          const rsuWorkDir = process.env.RSU_WORK_DIR || process.cwd();
+          RuntimeSchemaManager.Instance.SetCodeGenRunner({
+            RunInProcess: (skipDB) => runObject.RunInProcess(codegenDataSource, skipDB, rsuWorkDir),
+          });
+          console.log('RSU in-process CodeGen runner initialized (PostgreSQL).');
+
+          // Inject CodeGen output paths for targeted git staging
+          const { initializeConfig } = await import('@memberjunction/codegen-lib');
+          const cgConfig = initializeConfig(rsuWorkDir);
+          const outputPaths = (cgConfig.output ?? []).map((o: { directory: string }) => o.directory);
+          RuntimeSchemaManager.Instance.SetCodeGenOutputPaths(outputPaths);
+          console.log(`RSU CodeGen output paths: ${outputPaths.length} directories configured.`);
+
+          // Point RSU's soft PK/FK writer at the SAME file CodeGen reads (mj.config.cjs
+          // `additionalSchemaInfo`), or RSU writes soft PKs to its own default path while
+          // CodeGen reads a different one and skips integration tables with "No primary key found".
+          if (cgConfig.additionalSchemaInfo) {
+            RuntimeSchemaManager.Instance.SetAdditionalSchemaInfoPath(cgConfig.additionalSchemaInfo);
+            console.log(`RSU additionalSchemaInfo path: ${cgConfig.additionalSchemaInfo}`);
+          }
+        } catch (codegenErr) {
+          console.warn(`RSU in-process CodeGen runner setup failed (will fall back to child process): ${(codegenErr as Error).message}`);
+        }
+      } catch (err) {
+        console.warn(`RSU DDL provider setup failed (PostgreSQL; RSU will fall back to default provider): ${(err as Error).message}`);
+      }
+    }
+
     const md = new Metadata(); // global-provider-ok: bootstrap
     console.log(`Data Source has been initialized. ${md?.Entities ? md.Entities.length : 0} entities loaded.`);
   } else {
@@ -348,6 +439,13 @@ export const serve = async (resolverPaths: Array<string>, app: Application = cre
           ...createMSSQLConfig(),
           user: codegenUser,
           password: codegenPass,
+          // CodeGen's metadata management ("manage entity fields", schema refresh) runs
+          // long-running queries across ALL entities. The default API requestTimeout (30s)
+          // is far too short at scale — e.g. a large integration Create-Tables pushing the
+          // schema to 400+ entities times out mid-refresh and leaves entity-field metadata
+          // only partially applied. This pool is used ONLY for CodeGen/DDL (never to serve
+          // API requests), so a generous timeout is safe. Mirrors MJCLI's baseline connection.
+          requestTimeout: 600000,
         });
         codegenPool.on('error', (err) => {
           console.error('[ConnectionPool] CodeGen pool connection error:', err.message);
@@ -390,6 +488,15 @@ export const serve = async (resolverPaths: Array<string>, app: Application = cre
           const outputPaths = (codegenConfig.output ?? []).map((o: { directory: string }) => o.directory);
           RuntimeSchemaManager.Instance.SetCodeGenOutputPaths(outputPaths);
           console.log(`RSU CodeGen output paths: ${outputPaths.length} directories configured.`);
+
+          // Point RSU's soft PK/FK writer at the SAME file CodeGen reads (mj.config.cjs
+          // `additionalSchemaInfo`). Without this, RSU writes soft PKs to its own default
+          // path while CodeGen reads a different one and skips every integration table
+          // with "No primary key found".
+          if (codegenConfig.additionalSchemaInfo) {
+            RuntimeSchemaManager.Instance.SetAdditionalSchemaInfoPath(codegenConfig.additionalSchemaInfo);
+            console.log(`RSU additionalSchemaInfo path: ${codegenConfig.additionalSchemaInfo}`);
+          }
         } catch (codegenErr) {
           console.warn(`RSU in-process CodeGen runner setup failed (will fall back to child process): ${(codegenErr as Error).message}`);
         }
@@ -620,6 +727,24 @@ export const serve = async (resolverPaths: Array<string>, app: Application = cre
     (topic: string, payload: Record<string, unknown>) => PubSubManager.Instance.Publish(topic, payload)
   );
 
+  // §11: fan every integration progress event onto the live GraphQL subscription topic. The emitter
+  // (in @memberjunction/integration-progress-artifacts) stays server-agnostic; we inject the publish
+  // here so integration runs/refreshes/syncs are subscribable in addition to the durable JSONL
+  // artifact + the pollable IntegrationTailRunEvents query.
+  IntegrationProgressEmitter.SetPublishHook((manifest, event) =>
+    PublishIntegrationProgress({
+      RunID: manifest.runID,
+      Kind: manifest.runKind,
+      CompanyIntegrationID: manifest.companyIntegrationID,
+      EventType: event.eventType,
+      Seq: event.seq,
+      Message: event.message,
+      Stage: event.stage,
+      Level: event.level,
+      Data: event.data,
+    })
+  );
+
   // Global listener: broadcast CACHE_INVALIDATION to all browser clients whenever
   // ANY BaseEntity save/delete occurs on this server — regardless of whether it
   // originated from a GraphQL mutation or internal server-side code (agents, actions,
@@ -652,10 +777,15 @@ export const serve = async (resolverPaths: Array<string>, app: Application = cre
         scalarsMap: [{ type: Date, scalar: GraphQLTimestamp }],
         emitSchemaFile: websiteRunFromPackage !== 1,
         pubSub,
+        globalMiddlewares: [variablesLoggingMiddleware],
       }),
     ],
     typeDefs: [requireSystemUserDirective.typeDefs, publicDirective.typeDefs],
   });
+
+  // Verbose-mode-only diagnostic: name custom-resolver args that aren't metadata-bound
+  // and aren't @NoLog-marked. No-op in default config (logVariables=false).
+  auditResolversForUndecoratedArgs();
   schema = requireSystemUserDirective.transformer(schema);
   schema = publicDirective.transformer(schema);
 
@@ -799,6 +929,24 @@ export const serve = async (resolverPaths: Array<string>, app: Application = cre
     console.log('[OAuth] Callback route registered at /oauth/callback');
   }
 
+  // ─── eSignature webhook (unauthenticated, registered BEFORE auth) ─────
+  // Called by external signature providers (DocuSign Connect, etc.) without an MJ bearer token.
+  // The provider DRIVER verifies the payload signature/HMAC; MJ auth does not apply here.
+  app.use('/esignature', cors<cors.CorsRequest>(), createSignatureWebhookHandler());
+  console.log('[eSignature] Webhook route registered at /esignature/webhook/:driverKey');
+
+  // ─── Magic-link routes (MJ-issued, app-scoped external access) ───────────
+  // Public router (JWKS + redeem) mounts BEFORE the auth middleware; the
+  // authenticated invite-creation router mounts AFTER it (see below).
+  let magicLinkAuthenticatedRouter: ReturnType<typeof createMagicLinkHandler>['authenticatedRouter'] | undefined;
+  if (configInfo.magicLink?.enabled) {
+    const { publicRouter, authenticatedRouter } = createMagicLinkHandler(oauthPublicUrl, configInfo.magicLink);
+    magicLinkAuthenticatedRouter = authenticatedRouter;
+    registerMagicLinkAuthProvider(oauthPublicUrl, configInfo.magicLink);
+    app.use(MAGIC_LINK_MOUNT_PATH, cors<cors.CorsRequest>(), publicRouter);
+    console.log(`[MagicLink] Public routes registered at ${MAGIC_LINK_MOUNT_PATH}/redeem and ${MAGIC_LINK_MOUNT_PATH}/jwks.json`);
+  }
+
   // ─── Global CORS (before auth so 401 responses include CORS headers) ─────
   // Without this, the browser blocks 401 responses from the auth middleware
   // because they lack Access-Control-Allow-Origin headers, preventing the
@@ -840,6 +988,12 @@ export const serve = async (resolverPaths: Array<string>, app: Application = cre
     console.log('[OAuth] Authenticated routes registered at /oauth/status, /oauth/initiate, and /oauth/exchange');
   }
 
+  // ─── Magic-link authenticated route (invite creation) ─────────────────────
+  if (magicLinkAuthenticatedRouter) {
+    app.use(MAGIC_LINK_MOUNT_PATH, cors<cors.CorsRequest>(), magicLinkAuthenticatedRouter);
+    console.log(`[MagicLink] Authenticated route registered at ${MAGIC_LINK_MOUNT_PATH}/create`);
+  }
+
   // ─── REST API endpoints (auth already handled by unified middleware) ─────
   const restApiConfig = {
     enabled: configInfo.restApiOptions?.enabled ?? false,
@@ -929,6 +1083,15 @@ export const serve = async (resolverPaths: Array<string>, app: Application = cre
       .catch(err => console.warn(`[IntegrationEngine] Orphaned sync resume failed: ${err}`));
   }
 
+  // Force-fail any agent runs left 'Running' by a process that died (restart/crash/OOM) or whose
+  // terminal-state write never landed. Staleness-based, so it never touches runs another healthy
+  // instance is still heart-beating. The watchdog also self-registers for graceful-shutdown
+  // cancellation (via ShutdownRegistry) once it begins tracking this process's first live run.
+  if (resumeUser && Metadata.Provider instanceof DatabaseProviderBase) { // global-provider-ok: server startup recovery — one-shot orphaned-run sweep at boot
+    AgentRunWatchdog.SweepOrphanedRuns(Metadata.Provider, resumeUser) // global-provider-ok: server startup recovery — one-shot orphaned-run sweep at boot
+      .catch(err => console.warn(`[AgentRunWatchdog] Startup sweep failed: ${err}`));
+  }
+
   // Set up graceful shutdown handlers
   const gracefulShutdown = async (signal: string) => {
     console.log(`\n${signal} received, shutting down gracefully...`);

package/src/logging/NoLog.ts

@@ -0,0 +1,88 @@
+import 'reflect-metadata';
+
+/**
+ * Reflect-metadata key for `@NoLog` marks. A single symbol covers both parameter-level
+ * marks (stored against `(target, propertyKey)` pairs) and field-level marks (stored
+ * against the input class prototype).
+ */
+const NO_LOG_PARAM_KEY = Symbol('mj:NoLog:param');
+const NO_LOG_FIELD_KEY = Symbol('mj:NoLog:field');
+
+/**
+ * `@NoLog` — marks a resolver argument or input-type field as never-loggable.
+ *
+ * Two modes, distinguished by decorator arity at runtime:
+ *
+ *   **Parameter** — applied to an `@Arg(...)` parameter on a resolver method:
+ *   ```ts
+ *   @Mutation(() => Boolean)
+ *   async VoiceTestHubSpotCredential(
+ *     @Arg('accessToken') @NoLog accessToken: string,
+ *     @Ctx() ctx: AppContext,
+ *   ): Promise<boolean> { ... }
+ *   ```
+ *
+ *   **Property** — applied to a `@Field()` on an `@InputType` class:
+ *   ```ts
+ *   @InputType()
+ *   export class GetDataInputType {
+ *     @Field(() => String) @NoLog Token: string;
+ *     @Field(() => [String]) Queries: string[];
+ *   }
+ *   ```
+ *
+ * The variables-logging middleware reads these marks at runtime via
+ * `hasNoLogParameter` / `getNoLogFields` and replaces the marked value (or whole arg)
+ * with `"<redacted>"` before emitting the variables block. Metadata-covered fields
+ * (entity columns with `EntityFieldInfo.Encrypt=true`) do not need `@NoLog` — applying
+ * it is harmless but redundant. Use `@NoLog` for arguments that the redactor cannot
+ * identify via metadata: custom-resolver parameters, MCP tool args, fields on input
+ * types that don't map to a known entity.
+ */
+export function NoLog(target: object, propertyKey?: string | symbol, parameterIndex?: number): void {
+  // Parameter-decorator path: (target, propertyKey, parameterIndex)
+  if (typeof parameterIndex === 'number' && propertyKey !== undefined) {
+    const existing = (Reflect.getOwnMetadata(NO_LOG_PARAM_KEY, target, propertyKey) as Set<number> | undefined) ?? new Set<number>();
+    existing.add(parameterIndex);
+    Reflect.defineMetadata(NO_LOG_PARAM_KEY, existing, target, propertyKey);
+    return;
+  }
+
+  // Property-decorator path: (target, propertyKey)
+  if (propertyKey !== undefined) {
+    const existing = (Reflect.getOwnMetadata(NO_LOG_FIELD_KEY, target) as Set<string> | undefined) ?? new Set<string>();
+    existing.add(String(propertyKey));
+    Reflect.defineMetadata(NO_LOG_FIELD_KEY, existing, target);
+    return;
+  }
+}
+
+/**
+ * Returns true if `@NoLog` was applied to `methodName`'s argument at `parameterIndex`
+ * on the given resolver class prototype. False otherwise.
+ *
+ * Pass the resolver class itself (e.g. `MyResolver`) — the function reads from the
+ * prototype internally to match how type-graphql stores resolver metadata.
+ */
+export function hasNoLogParameter(
+  resolverClass: Function,
+  methodName: string,
+  parameterIndex: number,
+): boolean {
+  const target = resolverClass.prototype as object;
+  const marks = Reflect.getMetadata(NO_LOG_PARAM_KEY, target, methodName) as Set<number> | undefined;
+  return marks !== undefined && marks.has(parameterIndex);
+}
+
+/**
+ * Returns the set of field names decorated `@NoLog` on the given input class. Empty set
+ * if none were marked.
+ *
+ * Pass the input class itself (e.g. `GetDataInputType`) — the function reads from the
+ * prototype internally.
+ */
+export function getNoLogFields(inputTypeClass: Function): ReadonlySet<string> {
+  const target = inputTypeClass.prototype as object;
+  const marks = Reflect.getMetadata(NO_LOG_FIELD_KEY, target) as Set<string> | undefined;
+  return marks ?? new Set<string>();
+}