@memberjunction/server 5.40.2 → 5.42.0

package/dist/index.js

@@ -7,6 +7,7 @@ import { resolveDbPlatformFromEnv } from '@memberjunction/generic-database-provi
 import { MJGlobal, MJEventType, UUIDsEqual, ShutdownRegistry } from '@memberjunction/global';
 import { setupSQLServerClient, SQLServerDataProvider, SQLServerProviderConfigData, UserCache } from '@memberjunction/sqlserver-dataprovider';
 import { extendConnectionPoolWithQuery } from './util.js';
+import { registerIntegrationCustomColumnPromoter } from './integration/CustomColumnPromoter.js';
 import { default as BodyParser } from 'body-parser';
 import compression from 'compression'; // Add compression middleware
 import cors from 'cors';
@@ -15,6 +16,7 @@ import { default as fg } from 'fast-glob';
 import { useServer } from 'graphql-ws/lib/use/ws';
 import { createServer } from 'node:http';
 import { fileURLToPath } from 'node:url';
+import { readFileSync } from 'node:fs';
 import { sep } from 'node:path';
 import 'reflect-metadata';
 import { ReplaySubject } from 'rxjs';
@@ -23,12 +25,14 @@ import { PubSub } from 'graphql-subscriptions';
 import sql from 'mssql';
 import { WebSocketServer } from 'ws';
 import buildApolloServer from './apolloServer/index.js';
-import { configInfo, dbDatabase, dbHost, dbPort, dbUsername, graphqlPort, graphqlRootPath, mj_core_schema, websiteRunFromPackage } from './config.js';
+import { configInfo, configFilePath, dbDatabase, dbHost, dbPort, dbUsername, graphqlPort, graphqlRootPath, mj_core_schema, websiteRunFromPackage } from './config.js';
 import { default as jwt } from 'jsonwebtoken';
 import { contextFunction, createUnifiedAuthMiddleware, getUserPayload } from './context.js';
 import { requireSystemUserDirective, publicDirective } from './directives/index.js';
 import { variablesLoggingMiddleware } from './logging/variablesLoggingMiddleware.js';
 import { auditResolversForUndecoratedArgs } from './logging/bootAudit.js';
+import { StartupLogger } from './logging/StartupLogger.js';
+import { AuthProviderFactory } from '@memberjunction/auth-providers';
 import createMSSQLConfig from './orm.js';
 import { setupRESTEndpoints } from './rest/setupRESTEndpoints.js';
 import { createOAuthCallbackHandler } from './rest/OAuthCallbackHandler.js';
@@ -37,13 +41,14 @@ import { createMagicLinkHandler, registerMagicLinkAuthProvider, MAGIC_LINK_MOUNT
 import { resolve } from 'node:path';
 import { DataSourceInfo, raiseEvent } from './types.js';
 import { ScheduledJobsService } from './services/ScheduledJobsService.js';
-import { LocalCacheManager, TelemetryManager } from '@memberjunction/core';
+import { LocalCacheManager, TelemetryManager, LogStatus, SetVerboseLogging } from '@memberjunction/core';
 import { GetAPIKeyEngine } from '@memberjunction/api-keys';
 import { RedisLocalStorageProvider } from '@memberjunction/redis-provider';
 import { PubSubManager } from './generic/PubSubManager.js';
 import { IntegrationProgressEmitter } from '@memberjunction/integration-progress-artifacts';
 import { PublishIntegrationProgress } from './resolvers/IntegrationProgressResolver.js';
 import { ClientToolRequestManager, AgentRunWatchdog } from '@memberjunction/ai-agents';
+import { SessionJanitor } from './agentSessions/index.js';
 import { CACHE_INVALIDATION_TOPIC } from './generic/CacheInvalidationResolver.js';
 import { ConnectorFactory, IntegrationEngine } from '@memberjunction/integration-engine';
 import { CronExpressionHelper } from '@memberjunction/scheduling-engine';
@@ -140,6 +145,10 @@ export * from './resolvers/UserViewResolver.js';
 export * from './resolvers/VersionHistoryResolver.js';
 export * from './resolvers/CurrentUserContextResolver.js';
 export * from './resolvers/RSUResolver.js';
+export * from './resolvers/AgentSessionResolver.js';
+export * from './resolvers/RealtimeClientSessionResolver.js';
+export * from './resolvers/RemoteBrowserActionResolver.js';
+export * from './agentSessions/index.js';
 export { GetReadOnlyDataSource, GetReadWriteDataSource, GetReadWriteProvider, GetReadOnlyProvider } from './util.js';
 export * from './generated/generated.js';
 export * from './multiTenancy/index.js';
@@ -154,13 +163,37 @@ const localPath = (p) => {
     return resolvedPath;
 };
 export const createApp = () => express();
+/**
+ * Resolves the MJServer package version for the startup summary header.
+ *
+ * Reads `@memberjunction/server`'s own `package.json` relative to this module.
+ * Returns `undefined` (and the header omits the version) if it can't be read,
+ * so version display is best-effort and never blocks startup.
+ */
+function resolveServerVersion() {
+    try {
+        // package.json sits at the package root, two levels up from dist/ (or src/).
+        const pkgPath = fileURLToPath(new URL('../package.json', import.meta.url));
+        const pkg = JSON.parse(readFileSync(pkgPath, 'utf-8'));
+        return pkg.version;
+    }
+    catch {
+        return undefined;
+    }
+}
 export const serve = async (resolverPaths, app = createApp(), options) => {
     const t0 = performance.now();
-    const lap = (label, since) => {
-        const ms = performance.now() - since;
-        console.log(`⏱️  [Startup] ${label}: ${ms.toFixed(0)}ms`);
-        return performance.now();
-    };
+    // Level-gated startup logger. Resolves verbosity from telemetry.level (single
+    // operator knob). At `standard` (default), per-phase timings are collapsed into
+    // the one-line summary; at `verbose`+ each phase prints inline as before.
+    const startupLog = new StartupLogger();
+    // Wire the GLOBAL verbose-logging gate to the resolved server level, so cross-package
+    // LogStatusEx({ verboseOnly: true }) lines (cache, scheduling, integration, MCP, …) honor the
+    // configured level instead of defaulting to hidden. Without this, "verbose-only" is "always hidden".
+    SetVerboseLogging(startupLog.IsAtLeast('verbose'));
+    // Transient boot spinner (standard level + TTY only); cleared by PrintSummary.
+    startupLog.StartBoot();
+    const lap = (label, since) => startupLog.EndPhase(label, since);
     const localResolverPaths = ['resolvers/**/*Resolver.{js,ts}', 'generic/*Resolver.{js,ts}', 'generated/generated.{js,ts}'].map(localPath);
     const combinedResolverPaths = [...resolverPaths, ...localResolverPaths];
     const isWindows = sep === '\\';
@@ -175,7 +208,8 @@ export const serve = async (resolverPaths, app = createApp(), options) => {
     const dataSources = [];
     if (dbType === 'postgresql') {
         // ─── PostgreSQL Path ───────────────────────────────────────────
-        console.log('Database type: PostgreSQL');
+        startupLog.BeginPhase('Connecting to database');
+        startupLog.LogIf('verbose', 'Database type: PostgreSQL');
         const pg = await import('pg');
         const { PostgreSQLDataProvider, PostgreSQLProviderConfigData } = await import('@memberjunction/postgresql-dataprovider');
         const pgHost = process.env.PG_HOST || process.env.DB_HOST || 'localhost';
@@ -198,7 +232,7 @@ export const serve = async (resolverPaths, app = createApp(), options) => {
         const testClient = await pgPool.connect();
         await testClient.query('SELECT 1');
         testClient.release();
-        console.log(`PostgreSQL pool connected to ${pgHost}:${pgPort}/${pgDatabase}`);
+        startupLog.LogIf('verbose', `PostgreSQL pool connected to ${pgHost}:${pgPort}/${pgDatabase}`);
         // Create a DataSourceInfo with a MSSQL-compatible wrapper around pg.Pool
         // This allows existing code (types, util, context) to work without changes
         const mssqlCompatPool = createMSSQLCompatPool(pgPool);
@@ -273,11 +307,10 @@ export const serve = async (resolverPaths, app = createApp(), options) => {
                 const codegenPgProvider = new PostgreSQLDataProvider();
                 await codegenPgProvider.Config(codegenPgConfigData); // separate pool (per-instance manager); does NOT touch the global API provider
                 RuntimeSchemaManager.Instance.SetDDLProvider(codegenPgProvider);
-                console.log('RSU DDL provider initialized with CodeGen credentials (PostgreSQL).');
+                startupLog.LogIf('verbose', 'RSU DDL provider initialized with CodeGen credentials (PostgreSQL).');
                 // Set up in-process CodeGen runner for RSU
                 try {
-                    const { RunCodeGenBase } = await import('@memberjunction/codegen-lib');
-                    const { PostgreSQLCodeGenConnection } = await import('@memberjunction/codegen-lib/dist/Database/providers/postgresql/PostgreSQLCodeGenConnection.js');
+                    const { RunCodeGenBase, PostgreSQLCodeGenConnection } = await import('@memberjunction/codegen-lib');
                     const codegenConnection = new PostgreSQLCodeGenConnection(codegenPgPool);
                     const codegenCurrentUser = UserCache.Instance.Users.find(u => u.Type?.trim().toLowerCase() === 'owner') ?? UserCache.Instance.Users[0];
                     const codegenDataSource = {
@@ -291,19 +324,19 @@ export const serve = async (resolverPaths, app = createApp(), options) => {
                     RuntimeSchemaManager.Instance.SetCodeGenRunner({
                         RunInProcess: (skipDB) => runObject.RunInProcess(codegenDataSource, skipDB, rsuWorkDir),
                     });
-                    console.log('RSU in-process CodeGen runner initialized (PostgreSQL).');
+                    startupLog.LogIf('verbose', 'RSU in-process CodeGen runner initialized (PostgreSQL).');
                     // Inject CodeGen output paths for targeted git staging
                     const { initializeConfig } = await import('@memberjunction/codegen-lib');
                     const cgConfig = initializeConfig(rsuWorkDir);
                     const outputPaths = (cgConfig.output ?? []).map((o) => o.directory);
                     RuntimeSchemaManager.Instance.SetCodeGenOutputPaths(outputPaths);
-                    console.log(`RSU CodeGen output paths: ${outputPaths.length} directories configured.`);
+                    startupLog.LogIf('verbose', `RSU CodeGen output paths: ${outputPaths.length} directories configured.`);
                     // Point RSU's soft PK/FK writer at the SAME file CodeGen reads (mj.config.cjs
                     // `additionalSchemaInfo`), or RSU writes soft PKs to its own default path while
                     // CodeGen reads a different one and skips integration tables with "No primary key found".
                     if (cgConfig.additionalSchemaInfo) {
                         RuntimeSchemaManager.Instance.SetAdditionalSchemaInfoPath(cgConfig.additionalSchemaInfo);
-                        console.log(`RSU additionalSchemaInfo path: ${cgConfig.additionalSchemaInfo}`);
+                        startupLog.LogIf('verbose', `RSU additionalSchemaInfo path: ${cgConfig.additionalSchemaInfo}`);
                     }
                 }
                 catch (codegenErr) {
@@ -315,12 +348,14 @@ export const serve = async (resolverPaths, app = createApp(), options) => {
             }
         }
         const md = new Metadata(); // global-provider-ok: bootstrap
-        console.log(`Data Source has been initialized. ${md?.Entities ? md.Entities.length : 0} entities loaded.`);
+        const pgEntityCount = md?.Entities ? md.Entities.length : 0;
+        startupLog.LogIf('verbose', `Data Source has been initialized. ${pgEntityCount} entities loaded.`);
+        startupLog.SetDatabaseInfo('PostgreSQL', `${pgHost}:${pgPort}/${pgDatabase}`, pgEntityCount);
     }
     else {
         // ─── SQL Server Path (existing behavior) ───────────────────────
-        console.log('Database type: SQL Server');
-        let tPhase = performance.now();
+        startupLog.LogIf('verbose', 'Database type: SQL Server');
+        let tPhase = startupLog.BeginPhase('Connecting to database');
         const pool = new sql.ConnectionPool(createMSSQLConfig());
         // Handle connection-level errors from dead/stale connections in the pool.
         // Without this handler, when Azure drops idle TCP connections, the pool silently
@@ -329,7 +364,8 @@ export const serve = async (resolverPaths, app = createApp(), options) => {
             console.error('[ConnectionPool] Pool-level connection error (stale connection evicted):', err.message);
         });
         await pool.connect();
-        tPhase = lap('DB Pool Connect', tPhase);
+        lap('DB Pool Connect', tPhase);
+        tPhase = startupLog.BeginPhase('Loading metadata + providers');
         dataSources.push(new DataSourceInfo({ dataSource: pool, type: 'Read-Write', host: dbHost, port: dbPort, database: dbDatabase, userName: dbUsername }));
         // Establish a second read-only connection to the database if dbReadOnlyUsername and dbReadOnlyPassword exist
         if (configInfo.dbReadOnlyUsername && configInfo.dbReadOnlyPassword) {
@@ -344,13 +380,16 @@ export const serve = async (resolverPaths, app = createApp(), options) => {
             });
             await readOnlyPool.connect();
             dataSources.push(new DataSourceInfo({ dataSource: readOnlyPool, type: 'Read-Only', host: dbHost, port: dbPort, database: dbDatabase, userName: configInfo.dbReadOnlyUsername }));
-            console.log('Read-only Connection Pool has been initialized.');
+            startupLog.LogIf('verbose', 'Read-only Connection Pool has been initialized.');
         }
         const config = new SQLServerProviderConfigData(pool, mj_core_schema, cacheRefreshInterval);
         await setupSQLServerClient(config);
-        tPhase = lap('Metadata + Provider Setup', tPhase);
+        lap('Metadata + Provider Setup', tPhase);
+        startupLog.BeginPhase('Initializing data provider');
         const md = new Metadata(); // global-provider-ok: bootstrap
-        console.log(`Data Source has been initialized. ${md?.Entities ? md.Entities.length : 0} entities loaded.`);
+        const entityCount = md?.Entities ? md.Entities.length : 0;
+        startupLog.LogIf('verbose', `Data Source has been initialized. ${entityCount} entities loaded.`);
+        startupLog.SetDatabaseInfo('SQL Server', `${dbHost}:${dbPort}/${dbDatabase}`, entityCount);
         // Set up CodeGen-credentialed provider for RSU DDL operations (CREATE TABLE, CREATE SCHEMA, etc.)
         const codegenUser = process.env.CODEGEN_DB_USERNAME;
         const codegenPass = process.env.CODEGEN_DB_PASSWORD;
@@ -377,11 +416,10 @@ export const serve = async (resolverPaths, app = createApp(), options) => {
                 const codegenProvider = new SQLServerDataProvider();
                 await codegenProvider.Config(codegenConfig);
                 RuntimeSchemaManager.Instance.SetDDLProvider(codegenProvider);
-                console.log('RSU DDL provider initialized with CodeGen credentials.');
+                startupLog.LogIf('verbose', 'RSU DDL provider initialized with CodeGen credentials.');
                 // Set up in-process CodeGen runner for RSU
                 try {
-                    const { RunCodeGenBase } = await import('@memberjunction/codegen-lib');
-                    const { SQLServerCodeGenConnection } = await import('@memberjunction/codegen-lib/dist/Database/providers/sqlserver/SQLServerCodeGenConnection.js');
+                    const { RunCodeGenBase, SQLServerCodeGenConnection } = await import('@memberjunction/codegen-lib');
                     const codegenConnection = new SQLServerCodeGenConnection(codegenPool);
                     const codegenCurrentUser = UserCache.Instance.Users.find(u => u.Type?.trim().toLowerCase() === 'owner') ?? UserCache.Instance.Users[0];
                     const codegenDataSource = {
@@ -395,20 +433,20 @@ export const serve = async (resolverPaths, app = createApp(), options) => {
                     RuntimeSchemaManager.Instance.SetCodeGenRunner({
                         RunInProcess: (skipDB) => runObject.RunInProcess(codegenDataSource, skipDB, rsuWorkDir),
                     });
-                    console.log('RSU in-process CodeGen runner initialized.');
+                    startupLog.LogIf('verbose', 'RSU in-process CodeGen runner initialized.');
                     // Inject CodeGen output paths for targeted git staging
                     const { initializeConfig } = await import('@memberjunction/codegen-lib');
                     const codegenConfig = initializeConfig(rsuWorkDir);
                     const outputPaths = (codegenConfig.output ?? []).map((o) => o.directory);
                     RuntimeSchemaManager.Instance.SetCodeGenOutputPaths(outputPaths);
-                    console.log(`RSU CodeGen output paths: ${outputPaths.length} directories configured.`);
+                    startupLog.LogIf('verbose', `RSU CodeGen output paths: ${outputPaths.length} directories configured.`);
                     // Point RSU's soft PK/FK writer at the SAME file CodeGen reads (mj.config.cjs
                     // `additionalSchemaInfo`). Without this, RSU writes soft PKs to its own default
                     // path while CodeGen reads a different one and skips every integration table
                     // with "No primary key found".
                     if (codegenConfig.additionalSchemaInfo) {
                         RuntimeSchemaManager.Instance.SetAdditionalSchemaInfoPath(codegenConfig.additionalSchemaInfo);
-                        console.log(`RSU additionalSchemaInfo path: ${codegenConfig.additionalSchemaInfo}`);
+                        startupLog.LogIf('verbose', `RSU additionalSchemaInfo path: ${codegenConfig.additionalSchemaInfo}`);
                     }
                 }
                 catch (codegenErr) {
@@ -420,7 +458,15 @@ export const serve = async (resolverPaths, app = createApp(), options) => {
             }
         }
     }
-    let tServe = performance.now();
+    // Register the post-sync custom-column promotion hook (gaps.md §2). Safe to call regardless of
+    // RSU config: the hook self-gates on captured overflow data and uses RSU only at fire time.
+    try {
+        registerIntegrationCustomColumnPromoter();
+    }
+    catch (err) {
+        console.warn(`Custom-column promoter registration failed (post-sync promotion disabled): ${err.message}`);
+    }
+    let tServe = startupLog.BeginPhase('Initializing services');
     // Store queryDialects config in GlobalObjectStore so MJQueryEntityServer can
     // read it without a circular dependency on MJServer
     if (configInfo.queryDialects) {
@@ -433,11 +479,11 @@ export const serve = async (resolverPaths, app = createApp(), options) => {
         if (configInfo.telemetry?.level) {
             tm.UpdateSettings({ level: configInfo.telemetry.level });
         }
-        console.log(`Server telemetry enabled with level: ${configInfo.telemetry.level || 'standard'}`);
+        startupLog.LogIf('verbose', `Server telemetry enabled with level: ${configInfo.telemetry.level || 'standard'}`);
     }
     else {
         tm.SetEnabled(false);
-        console.log('Server telemetry disabled');
+        startupLog.LogIf('verbose', 'Server telemetry disabled');
     }
     // Optionally inject Redis as the shared storage provider for cross-server cache invalidation
     if (process.env.REDIS_URL) {
@@ -468,14 +514,14 @@ export const serve = async (resolverPaths, app = createApp(), options) => {
                 });
             }
         });
-        console.log(`Redis cache provider connected: ${process.env.REDIS_URL}`);
+        startupLog.LogIf('verbose', `Redis cache provider connected: ${process.env.REDIS_URL}`);
     }
     // If Redis is available, swap LocalCacheManager's storage provider to Redis.
     // LocalCacheManager may have already been initialized (with in-memory provider)
     // during engine loading. SetStorageProvider migrates cached data to Redis.
     if (process.env.REDIS_URL) {
         await LocalCacheManager.Instance.SetStorageProvider(Metadata.Provider.LocalStorageProvider); // global-provider-ok: bootstrap
-        console.log('LocalCacheManager: storage provider swapped to Redis');
+        startupLog.LogIf('verbose', 'LocalCacheManager: storage provider swapped to Redis');
     }
     // Ensure LocalCacheManager is initialized (no-op if already done during engine loading)
     if (!LocalCacheManager.Instance.IsInitialized) {
@@ -489,11 +535,14 @@ export const serve = async (resolverPaths, app = createApp(), options) => {
             verboseLogging: cs.verboseLogging ?? false,
         };
         await LocalCacheManager.Instance.Initialize(Metadata.Provider.LocalStorageProvider, cacheConfig); // global-provider-ok: bootstrap
-        console.log('LocalCacheManager initialized with cache config:', JSON.stringify({
-            maxMemoryMB: cs.maxMemoryMB ?? 150,
-            maxPercentOfCachePerEntity: cs.maxPercentOfCachePerEntity ?? 50,
-            evictionSweepIntervalSeconds: cs.evictionSweepIntervalSeconds ?? 300,
-        }));
+        if (startupLog.IsAtLeast('verbose')) {
+            // eslint-disable-next-line no-console
+            console.log('LocalCacheManager initialized with cache config:', JSON.stringify({
+                maxMemoryMB: cs.maxMemoryMB ?? 150,
+                maxPercentOfCachePerEntity: cs.maxPercentOfCachePerEntity ?? 50,
+                evictionSweepIntervalSeconds: cs.evictionSweepIntervalSeconds ?? 300,
+            }));
+        }
     }
     // Initialize APIKeyEngine singleton — reads apiKeyGeneration from mj.config.cjs automatically
     // This must happen before any request handler calls GetAPIKeyEngine()
@@ -513,7 +562,8 @@ export const serve = async (resolverPaths, app = createApp(), options) => {
     // });
     /******TEST HARNESS FOR CHANGE DETECTION */
     /******TEST HARNESS FOR CHANGE DETECTION */
-    tServe = lap('Telemetry + Cache + APIKey Init', tServe);
+    lap('Telemetry + Cache + APIKey Init', tServe);
+    tServe = startupLog.BeginPhase('Discovering resolvers');
     const dynamicModules = await Promise.all(paths.map((modulePath) => {
         try {
             const module = import(isWindows ? `file://${modulePath}` : modulePath);
@@ -550,7 +600,7 @@ export const serve = async (resolverPaths, app = createApp(), options) => {
     // Initialize all middleware
     for (const mw of middlewares) {
         await mw.Initialize();
-        console.log(`  [Middleware] ${mw.Label}`);
+        startupLog.LogIf('verbose', `  [Middleware] ${mw.Label}`);
     }
     // Collect middleware contributions for each pipeline stage
     const mwPreAuth = [];
@@ -593,7 +643,7 @@ export const serve = async (resolverPaths, app = createApp(), options) => {
             }));
             const mwResolvers = mwModules.flatMap((module) => Object.values(module).filter((value) => typeof value === 'function'));
             allResolvers = [...resolvers, ...mwResolvers];
-            console.log(`  [Middleware Resolvers] Loaded ${mwResolverFiles.length} resolver file(s) from middleware`);
+            startupLog.LogIf('verbose', `  [Middleware Resolvers] Loaded ${mwResolverFiles.length} resolver file(s) from middleware`);
         }
     }
     // Create an explicit PubSub instance so we can reference it outside of resolvers
@@ -643,7 +693,8 @@ export const serve = async (resolverPaths, app = createApp(), options) => {
             }
         }
     });
-    tServe = lap('Resolver + Middleware Discovery', tServe);
+    lap('Resolver + Middleware Discovery', tServe);
+    tServe = startupLog.BeginPhase('Building GraphQL schema');
     let schema = mergeSchemas({
         schemas: [
             buildSchemaSync({
@@ -666,7 +717,8 @@ export const serve = async (resolverPaths, app = createApp(), options) => {
     for (const transformer of mwSchemaTransformers) {
         schema = transformer(schema);
     }
-    tServe = lap('Schema Build', tServe);
+    lap('Schema Build', tServe);
+    tServe = startupLog.BeginPhase('Starting HTTP server');
     const httpServer = createServer(app);
     const webSocketServer = new WebSocketServer({ server: httpServer, path: graphqlRootPath });
     // Track per-connection expiry timers so we can clean them up on close
@@ -766,7 +818,7 @@ export const serve = async (resolverPaths, app = createApp(), options) => {
     }
     // ─── OAuth callback routes (unauthenticated, registered BEFORE auth) ─────
     const oauthPublicUrl = configInfo.publicUrl || `${configInfo.baseUrl}:${configInfo.graphqlPort}${configInfo.graphqlRootPath || ''}`;
-    console.log(`[OAuth] publicUrl: ${oauthPublicUrl}`);
+    startupLog.LogIf('verbose', `[OAuth] publicUrl: ${oauthPublicUrl}`);
     let oauthAuthenticatedRouter;
     if (oauthPublicUrl) {
         const { callbackRouter, authenticatedRouter } = createOAuthCallbackHandler({
@@ -778,13 +830,13 @@ export const serve = async (resolverPaths, app = createApp(), options) => {
         const oauthCors = cors();
         // OAuth callback is unauthenticated (called by external auth server)
         app.use('/oauth', oauthCors, callbackRouter);
-        console.log('[OAuth] Callback route registered at /oauth/callback');
+        startupLog.LogIf('verbose', '[OAuth] Callback route registered at /oauth/callback');
     }
     // ─── eSignature webhook (unauthenticated, registered BEFORE auth) ─────
     // Called by external signature providers (DocuSign Connect, etc.) without an MJ bearer token.
     // The provider DRIVER verifies the payload signature/HMAC; MJ auth does not apply here.
     app.use('/esignature', cors(), createSignatureWebhookHandler());
-    console.log('[eSignature] Webhook route registered at /esignature/webhook/:driverKey');
+    startupLog.LogIf('verbose', '[eSignature] Webhook route registered at /esignature/webhook/:driverKey');
     // ─── Magic-link routes (MJ-issued, app-scoped external access) ───────────
     // Public router (JWKS + redeem) mounts BEFORE the auth middleware; the
     // authenticated invite-creation router mounts AFTER it (see below).
@@ -794,7 +846,7 @@ export const serve = async (resolverPaths, app = createApp(), options) => {
         magicLinkAuthenticatedRouter = authenticatedRouter;
         registerMagicLinkAuthProvider(oauthPublicUrl, configInfo.magicLink);
         app.use(MAGIC_LINK_MOUNT_PATH, cors(), publicRouter);
-        console.log(`[MagicLink] Public routes registered at ${MAGIC_LINK_MOUNT_PATH}/redeem and ${MAGIC_LINK_MOUNT_PATH}/jwks.json`);
+        startupLog.LogIf('verbose', `[MagicLink] Public routes registered at ${MAGIC_LINK_MOUNT_PATH}/redeem and ${MAGIC_LINK_MOUNT_PATH}/jwks.json`);
     }
     // ─── Global CORS (before auth so 401 responses include CORS headers) ─────
     // Without this, the browser blocks 401 responses from the auth middleware
@@ -843,12 +895,12 @@ export const serve = async (resolverPaths, app = createApp(), options) => {
     if (oauthAuthenticatedRouter) {
         const oauthCors = cors();
         app.use('/oauth', oauthCors, BodyParser.json(), oauthAuthenticatedRouter);
-        console.log('[OAuth] Authenticated routes registered at /oauth/status, /oauth/initiate, and /oauth/exchange');
+        startupLog.LogIf('verbose', '[OAuth] Authenticated routes registered at /oauth/status, /oauth/initiate, and /oauth/exchange');
     }
     // ─── Magic-link authenticated route (invite creation) ─────────────────────
     if (magicLinkAuthenticatedRouter) {
         app.use(MAGIC_LINK_MOUNT_PATH, cors(), magicLinkAuthenticatedRouter);
-        console.log(`[MagicLink] Authenticated route registered at ${MAGIC_LINK_MOUNT_PATH}/create`);
+        startupLog.LogIf('verbose', `[MagicLink] Authenticated route registered at ${MAGIC_LINK_MOUNT_PATH}/create`);
     }
     // ─── REST API endpoints (auth already handled by unified middleware) ─────
     const restApiConfig = {
@@ -862,9 +914,11 @@ export const serve = async (resolverPaths, app = createApp(), options) => {
     if (process.env.MJ_REST_API_ENABLED !== undefined) {
         restApiConfig.enabled = process.env.MJ_REST_API_ENABLED === 'true';
         if (restApiConfig.enabled) {
-            console.log('REST API is enabled via environment variable');
+            // Genuine config override — actionable, surfaced at all levels.
+            LogStatus('REST API is enabled via environment variable');
         }
     }
+    startupLog.SetRestEnabled(restApiConfig.enabled);
     if (process.env.MJ_REST_API_INCLUDE_ENTITIES) {
         restApiConfig.includeEntities = process.env.MJ_REST_API_INCLUDE_ENTITIES.split(',').map(e => e.trim());
     }
@@ -908,11 +962,23 @@ export const serve = async (resolverPaths, app = createApp(), options) => {
     if (options?.onBeforeServe) {
         await Promise.resolve(options.onBeforeServe());
     }
-    tServe = lap('Apollo + Express Setup', tServe);
+    lap('Apollo + Express Setup', tServe);
     await new Promise((resolve) => httpServer.listen({ port: graphqlPort }, resolve));
-    lap('Total Startup', t0);
-    console.log(`📦 Connected to database: ${dbHost}:${dbPort}/${dbDatabase}`);
-    console.log(`🚀 Server ready at http://localhost:${graphqlPort}/`);
+    // The summary headline reports TRUE wall-clock since process start (see
+    // StartupLogger.buildStartupLine), so we don't push a synthetic "total" phase row
+    // (that double-counted the headline). Keep a verbose-only line for the serve()-scoped span.
+    startupLog.LogIf('verbose', `serve() startup: ${((performance.now() - t0) / 1000).toFixed(1)}s`);
+    startupLog.SetReadyUrl(`http://localhost:${graphqlPort}/`);
+    // Populate summary fields that are known only now, then print the one summary block.
+    for (const provider of AuthProviderFactory.Instance.getAllProviders()) {
+        startupLog.AddAuthProvider(provider.name);
+    }
+    startupLog.SetVersion(resolveServerVersion());
+    startupLog.SetConfigPath(configFilePath);
+    if (scheduledJobsService) {
+        startupLog.SetScheduledJobCount(scheduledJobsService.GetStatus().activeJobs);
+    }
+    startupLog.PrintSummary();
     // Process pending RSU work from pre-restart (entity maps, field maps, sync)
     processRSUPendingWork().catch(err => console.warn(`RSU pending work processing failed: ${err}`));
     // Resume any integration syncs that were orphaned by the previous process restart
@@ -929,6 +995,13 @@ export const serve = async (resolverPaths, app = createApp(), options) => {
         AgentRunWatchdog.SweepOrphanedRuns(Metadata.Provider, resumeUser) // global-provider-ok: server startup recovery — one-shot orphaned-run sweep at boot
             .catch(err => console.warn(`[AgentRunWatchdog] Startup sweep failed: ${err}`));
     }
+    // Launch the AI Agent Session janitor: run own-host orphan recovery once at boot, then keep a
+    // periodic staleness sweep running. Self-registers with ShutdownRegistry, so its timer is cleared
+    // by the gracefulShutdown drain below (no explicit Stop() wiring needed here).
+    if (resumeUser && Metadata.Provider instanceof DatabaseProviderBase) { // global-provider-ok: server startup recovery — boot-time session janitor uses the server's own provider
+        SessionJanitor.Instance.Start(Metadata.Provider, resumeUser) // global-provider-ok: server-owned background reconciler runs under the server's provider + system user
+            .catch(err => console.warn(`[SessionJanitor] Startup failed: ${err}`));
+    }
     // Set up graceful shutdown handlers
     const gracefulShutdown = async (signal) => {
         console.log(`\n${signal} received, shutting down gracefully...`);