@memberjunction/server 5.46.0 → 5.48.0

package/dist/realtimeProxy/RealtimeProxyServer.js

@@ -0,0 +1,180 @@
+import { WebSocket as WsClient, WebSocketServer } from 'ws';
+import { BaseSingleton, ShutdownRegistry } from '@memberjunction/global';
+import { RealtimeProxyRegistry, REALTIME_PROXY_PATH } from '@memberjunction/ai';
+/**
+ * MJAPI's realtime websocket **proxy** — the transport half of the self-hosted realtime provider story.
+ *
+ * A provider driver (e.g. `HuggingFaceRealtime`) mints a one-time ticket into the shared
+ * {@link RealtimeProxyRegistry} pointing at an INTERNAL realtime endpoint, and hands the browser a
+ * `wss://<mjapi-public>{REALTIME_PROXY_PATH}?ticket=<id>` URL. The browser opens its socket HERE; this
+ * proxy consumes the ticket, opens the authenticated upstream leg (injecting any auth server-side), and
+ * pumps frames transparently in both directions. The internal endpoint + auth never reach the browser,
+ * and the internal box needs no browser-facing ingress — MJAPI stays the single ingress point.
+ *
+ * Deliberately provider-agnostic: it does no protocol translation (the same-keyed client driver owns the
+ * wire vocabulary) and knows nothing about any specific provider — it is a pure authenticated byte tunnel,
+ * reusable by any future self-hosted realtime provider that mints a ticket.
+ *
+ * A {@link BaseSingleton} + {@link IShutdownable}: it tracks live tunnels and closes them on graceful
+ * shutdown (drained by MJServer's `ShutdownRegistry` before `httpServer.close()`).
+ */
+export class RealtimeProxyServer extends BaseSingleton {
+    constructor() {
+        super();
+        this.ShutdownName = 'RealtimeProxyServer';
+        /** `noServer` so THIS server never binds its own upgrade listener — MJServer routes upgrades to it by path. */
+        this.wss = new WebSocketServer({ noServer: true });
+        /** Live browser↔upstream tunnels, tracked for shutdown teardown. */
+        this.tunnels = new Set();
+        this.registered = false;
+    }
+    /** Process-wide singleton accessor. */
+    static get Instance() {
+        return super.getInstance();
+    }
+    /**
+     * Routes an HTTP `upgrade` for {@link REALTIME_PROXY_PATH} to the proxy. Returns `true` when it OWNS
+     * (handled/rejected) the request, `false` when the path is not the proxy's — so the caller leaves the
+     * socket for the GraphQL websocket server's own upgrade listener. NEVER destroys a socket it doesn't own.
+     */
+    TryHandleUpgrade(request, socket, head) {
+        const url = RealtimeProxyServer.parseUrl(request.url);
+        if (!url || url.pathname !== REALTIME_PROXY_PATH) {
+            return false; // not ours — leave it for the GraphQL WS server
+        }
+        this.ensureRegistered();
+        const ticketId = url.searchParams.get('ticket') ?? '';
+        const entry = RealtimeProxyRegistry.Instance.Consume(ticketId);
+        if (!entry) {
+            RealtimeProxyServer.rejectUpgrade(socket, 401, 'Unauthorized');
+            return true;
+        }
+        this.wss.handleUpgrade(request, socket, head, (browserWs) => this.openTunnel(browserWs, entry));
+        return true;
+    }
+    /** Opens the upstream leg and wires a bidirectional pump between the browser socket and it. */
+    openTunnel(browserWs, entry) {
+        const tunnel = new RealtimeProxyTunnel(browserWs, entry, () => this.tunnels.delete(tunnel));
+        this.tunnels.add(tunnel);
+        tunnel.Start();
+    }
+    /** Registers for graceful-shutdown draining exactly once (lazily, on first real use). */
+    ensureRegistered() {
+        if (!this.registered) {
+            ShutdownRegistry.Instance.Register(this);
+            this.registered = true;
+        }
+    }
+    /** Closes every live tunnel and the proxy server. Idempotent; never throws. */
+    Shutdown() {
+        for (const tunnel of [...this.tunnels]) {
+            tunnel.Close();
+        }
+        this.tunnels.clear();
+        try {
+            this.wss.close();
+        }
+        catch {
+            /* already closing */
+        }
+    }
+    /** Parses `request.url` (a path+query) into a URL, or `null` when absent/unparseable. */
+    static parseUrl(rawUrl) {
+        if (!rawUrl) {
+            return null;
+        }
+        try {
+            return new URL(rawUrl, 'http://internal'); // base is only for parsing path+query
+        }
+        catch {
+            return null;
+        }
+    }
+    /** Writes a minimal HTTP error response and destroys the socket (used for a rejected upgrade). */
+    static rejectUpgrade(socket, code, reason) {
+        try {
+            socket.write(`HTTP/1.1 ${code} ${reason}\r\nConnection: close\r\n\r\n`);
+        }
+        catch {
+            /* socket already gone */
+        }
+        socket.destroy();
+    }
+}
+/**
+ * One live browser↔upstream tunnel. Buffers browser→upstream frames until the upstream socket is open,
+ * then pumps both directions byte-transparently (text and binary alike). Closing either side closes the other.
+ */
+class RealtimeProxyTunnel {
+    constructor(browser, entry, onClosed) {
+        this.browser = browser;
+        this.entry = entry;
+        this.onClosed = onClosed;
+        this.upstream = null;
+        /** Frames the browser sent before the upstream opened; flushed in order once it's ready. */
+        this.pending = [];
+        this.closed = false;
+    }
+    /** Opens the upstream socket and wires both legs. */
+    Start() {
+        const headers = this.entry.UpstreamAuthHeader ? { Authorization: this.entry.UpstreamAuthHeader } : undefined;
+        const upstream = new WsClient(this.entry.UpstreamUrl, { headers });
+        this.upstream = upstream;
+        upstream.on('open', () => this.flushPending());
+        upstream.on('message', (data, isBinary) => this.forward(this.browser, data, isBinary));
+        upstream.on('close', () => this.Close());
+        upstream.on('error', () => this.Close());
+        this.browser.on('message', (data, isBinary) => this.fromBrowser(data, isBinary));
+        this.browser.on('close', () => this.Close());
+        this.browser.on('error', () => this.Close());
+    }
+    /** Browser→upstream: forward immediately when the upstream is open, else queue until it is. */
+    fromBrowser(data, isBinary) {
+        if (this.upstream && this.upstream.readyState === WsClient.OPEN) {
+            this.forward(this.upstream, data, isBinary);
+        }
+        else {
+            this.pending.push({ data, isBinary });
+        }
+    }
+    /** Drains any frames queued before the upstream opened. */
+    flushPending() {
+        if (!this.upstream) {
+            return;
+        }
+        for (const frame of this.pending) {
+            this.forward(this.upstream, frame.data, frame.isBinary);
+        }
+        this.pending.length = 0;
+    }
+    /** Sends one frame on a socket, preserving the text/binary distinction; failures close the tunnel. */
+    forward(target, data, isBinary) {
+        if (target.readyState !== WsClient.OPEN) {
+            return;
+        }
+        try {
+            target.send(data, { binary: isBinary });
+        }
+        catch {
+            this.Close();
+        }
+    }
+    /** Closes both legs and detaches the tunnel from the server. Idempotent. */
+    Close() {
+        if (this.closed) {
+            return;
+        }
+        this.closed = true;
+        this.pending.length = 0;
+        for (const sock of [this.browser, this.upstream]) {
+            try {
+                sock?.close();
+            }
+            catch {
+                /* already closing */
+            }
+        }
+        this.onClosed();
+    }
+}
+//# sourceMappingURL=RealtimeProxyServer.js.map

package/dist/realtimeProxy/RealtimeProxyServer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"RealtimeProxyServer.js","sourceRoot":"","sources":["../../src/realtimeProxy/RealtimeProxyServer.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,SAAS,IAAI,QAAQ,EAAE,eAAe,EAAgB,MAAM,IAAI,CAAC;AAC1E,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAsB,MAAM,wBAAwB,CAAC;AAC7F,OAAO,EAAE,qBAAqB,EAAE,mBAAmB,EAAiC,MAAM,oBAAoB,CAAC;AAE/G;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,OAAO,mBAAoB,SAAQ,aAAkC;IAWvE;QACI,KAAK,EAAE,CAAC;QAXI,iBAAY,GAAG,qBAAqB,CAAC;QAErD,+GAA+G;QAC9F,QAAG,GAAG,IAAI,eAAe,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QAE/D,oEAAoE;QACnD,YAAO,GAAG,IAAI,GAAG,EAAuB,CAAC;QAElD,eAAU,GAAG,KAAK,CAAC;IAI3B,CAAC;IAED,uCAAuC;IAChC,MAAM,KAAK,QAAQ;QACtB,OAAO,KAAK,CAAC,WAAW,EAAuB,CAAC;IACpD,CAAC;IAED;;;;OAIG;IACI,gBAAgB,CAAC,OAAwB,EAAE,MAAc,EAAE,IAAY;QAC1E,MAAM,GAAG,GAAG,mBAAmB,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACtD,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,KAAK,mBAAmB,EAAE,CAAC;YAC/C,OAAO,KAAK,CAAC,CAAC,gDAAgD;QAClE,CAAC;QACD,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACxB,MAAM,QAAQ,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QACtD,MAAM,KAAK,GAAG,qBAAqB,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC/D,IAAI,CAAC,KAAK,EAAE,CAAC;YACT,mBAAmB,CAAC,aAAa,CAAC,MAAM,EAAE,GAAG,EAAE,cAAc,CAAC,CAAC;YAC/D,OAAO,IAAI,CAAC;QAChB,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC;QAChG,OAAO,IAAI,CAAC;IAChB,CAAC;IAED,+FAA+F;IACvF,UAAU,CAAC,SAAmB,EAAE,KAA+B;QACnE,MAAM,MAAM,GAAG,IAAI,mBAAmB,CAAC,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;QAC5F,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACzB,MAAM,CAAC,KAAK,EAAE,CAAC;IACnB,CAAC;IAED,yFAAyF;IACjF,gBAAgB;QACpB,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;YACnB,gBAAgB,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YACzC,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC;QAC3B,CAAC;IACL,CAAC;IAED,+EAA+E;IACxE,QAAQ;QACX,KAAK,MAAM,MAAM,IAAI,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YACrC,MAAM,CAAC,KAAK,EAAE,CAAC;QACnB,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QACrB,IAAI,CAAC;YACD,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC;QACrB,CAAC;QAAC,MAAM,CAAC;YACL,qBAAqB;QACzB,CAAC;IACL,CAAC;IAED,yFAAyF;IACjF,MAAM,CAAC,QAAQ,CAAC,MAA0B;QAC9C,IAAI,CAAC,MAAM,EAAE,CAAC;YACV,OAAO,IAAI,CAAC;QAChB,CAAC;QACD,IAAI,CAAC;YACD,OAAO,IAAI,GAAG,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC,CAAC,sCAAsC;QACrF,CAAC;QAAC,MAAM,CAAC;YACL,OAAO,IAAI,CAAC;QAChB,CAAC;IACL,CAAC;IAED,kGAAkG;IAC1F,MAAM,CAAC,aAAa,CAAC,MAAc,EAAE,IAAY,EAAE,MAAc;QACrE,IAAI,CAAC;YACD,MAAM,CAAC,KAAK,CAAC,YAAY,IAAI,IAAI,MAAM,+BAA+B,CAAC,CAAC;QAC5E,CAAC;QAAC,MAAM,CAAC;YACL,yBAAyB;QAC7B,CAAC;QACD,MAAM,CAAC,OAAO,EAAE,CAAC;IACrB,CAAC;CACJ;AAED;;;GAGG;AACH,MAAM,mBAAmB;IAMrB,YACqB,OAAiB,EACjB,KAA+B,EAC/B,QAAoB;QAFpB,YAAO,GAAP,OAAO,CAAU;QACjB,UAAK,GAAL,KAAK,CAA0B;QAC/B,aAAQ,GAAR,QAAQ,CAAY;QARjC,aAAQ,GAAoB,IAAI,CAAC;QACzC,4FAA4F;QAC3E,YAAO,GAAgD,EAAE,CAAC;QACnE,WAAM,GAAG,KAAK,CAAC;IAMpB,CAAC;IAEJ,qDAAqD;IAC9C,KAAK;QACR,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,IAAI,CAAC,KAAK,CAAC,kBAAkB,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;QAC7G,MAAM,QAAQ,GAAG,IAAI,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;QACnE,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QAEzB,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC;QAC/C,QAAQ,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,IAAa,EAAE,QAAiB,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;QACzG,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;QACzC,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;QAEzC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,IAAa,EAAE,QAAiB,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;QACnG,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;QAC7C,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;IACjD,CAAC;IAED,+FAA+F;IACvF,WAAW,CAAC,IAAa,EAAE,QAAiB;QAChD,IAAI,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ,CAAC,UAAU,KAAK,QAAQ,CAAC,IAAI,EAAE,CAAC;YAC9D,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;QAChD,CAAC;aAAM,CAAC;YACJ,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC1C,CAAC;IACL,CAAC;IAED,2DAA2D;IACnD,YAAY;QAChB,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACjB,OAAO;QACX,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YAC/B,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;QAC5D,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC;IAC5B,CAAC;IAED,sGAAsG;IAC9F,OAAO,CAAC,MAAgB,EAAE,IAAa,EAAE,QAAiB;QAC9D,IAAI,MAAM,CAAC,UAAU,KAAK,QAAQ,CAAC,IAAI,EAAE,CAAC;YACtC,OAAO;QACX,CAAC;QACD,IAAI,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC5C,CAAC;QAAC,MAAM,CAAC;YACL,IAAI,CAAC,KAAK,EAAE,CAAC;QACjB,CAAC;IACL,CAAC;IAED,4EAA4E;IACrE,KAAK;QACR,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YACd,OAAO;QACX,CAAC;QACD,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACnB,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC;QACxB,KAAK,MAAM,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC/C,IAAI,CAAC;gBACD,IAAI,EAAE,KAAK,EAAE,CAAC;YAClB,CAAC;YAAC,MAAM,CAAC;gBACL,qBAAqB;YACzB,CAAC;QACL,CAAC;QACD,IAAI,CAAC,QAAQ,EAAE,CAAC;IACpB,CAAC;CACJ"}

package/dist/resolvers/TestQuerySQLResolver.d.ts

@@ -34,6 +34,7 @@ export declare class TestQuerySQLResult {
     ExecutionTime: number;
     ErrorMessage?: string;
     AppliedParameters?: string;
+    RenderedSQL?: string;
 }
 /**
  * Resolver for testing transient (unsaved) query SQL with full composition + Nunjucks template processing.

package/dist/resolvers/TestQuerySQLResolver.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"TestQuerySQLResolver.d.ts","sourceRoot":"","sources":["../../src/resolvers/TestQuerySQLResolver.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAE1D;;;GAGG;AACH,qBACa,wBAAwB;IAEjC,IAAI,EAAE,MAAM,CAAC;IAGb,YAAY,EAAE,MAAM,CAAC;IAGrB,GAAG,EAAE,MAAM,CAAC;IAGZ,YAAY,CAAC,EAAE,OAAO,CAAC;IAGvB,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAGpC,YAAY,CAAC,EAAE,wBAAwB,EAAE,CAAC;CAC7C;AAED;;;;GAIG;AACH,qBACa,iBAAiB;IAE1B,GAAG,EAAE,MAAM,CAAC;IAGZ,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAGpC,YAAY,CAAC,EAAE,OAAO,CAAC;IAGvB,YAAY,CAAC,EAAE,wBAAwB,EAAE,CAAC;IAG1C,OAAO,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;GAEG;AACH,qBACa,kBAAkB;IAE3B,OAAO,EAAE,OAAO,CAAC;IAGjB,OAAO,CAAC,EAAE,MAAM,CAAC;IAGjB,QAAQ,EAAE,MAAM,CAAC;IAGjB,aAAa,EAAE,MAAM,CAAC;IAGtB,YAAY,CAAC,EAAE,MAAM,CAAC;IAGtB,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED;;;;;;;;;;;;GAYG;AACH,qBACa,oBAAqB,SAAQ,YAAY;IAI5C,YAAY,CACyB,KAAK,EAAE,iBAAiB,EACxD,OAAO,EAAE,UAAU,GAC3B,OAAO,CAAC,kBAAkB,CAAC;CA+CjC"}
+{"version":3,"file":"TestQuerySQLResolver.d.ts","sourceRoot":"","sources":["../../src/resolvers/TestQuerySQLResolver.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAE1D;;;GAGG;AACH,qBACa,wBAAwB;IAEjC,IAAI,EAAE,MAAM,CAAC;IAGb,YAAY,EAAE,MAAM,CAAC;IAGrB,GAAG,EAAE,MAAM,CAAC;IAGZ,YAAY,CAAC,EAAE,OAAO,CAAC;IAGvB,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAGpC,YAAY,CAAC,EAAE,wBAAwB,EAAE,CAAC;CAC7C;AAED;;;;GAIG;AACH,qBACa,iBAAiB;IAE1B,GAAG,EAAE,MAAM,CAAC;IAGZ,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAGpC,YAAY,CAAC,EAAE,OAAO,CAAC;IAGvB,YAAY,CAAC,EAAE,wBAAwB,EAAE,CAAC;IAG1C,OAAO,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;GAEG;AACH,qBACa,kBAAkB;IAE3B,OAAO,EAAE,OAAO,CAAC;IAGjB,OAAO,CAAC,EAAE,MAAM,CAAC;IAGjB,QAAQ,EAAE,MAAM,CAAC;IAGjB,aAAa,EAAE,MAAM,CAAC;IAGtB,YAAY,CAAC,EAAE,MAAM,CAAC;IAGtB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAG3B,WAAW,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;;;;;;;;;;;GAYG;AACH,qBACa,oBAAqB,SAAQ,YAAY;IAI5C,YAAY,CACyB,KAAK,EAAE,iBAAiB,EACxD,OAAO,EAAE,UAAU,GAC3B,OAAO,CAAC,kBAAkB,CAAC;CAgDjC"}

package/dist/resolvers/TestQuerySQLResolver.js

@@ -109,6 +109,10 @@ __decorate([
     Field(() => String, { nullable: true, description: 'JSON-stringified applied parameters including defaults' }),
     __metadata("design:type", String)
 ], TestQuerySQLResult.prototype, "AppliedParameters", void 0);
+__decorate([
+    Field(() => String, { nullable: true, description: 'The fully rendered SQL that was executed against the database. On error, reveals transformations (composition, templates, MaxRows wrapping) that may have caused the failure.' }),
+    __metadata("design:type", String)
+], TestQuerySQLResult.prototype, "RenderedSQL", void 0);
 TestQuerySQLResult = __decorate([
     ObjectType()
 ], TestQuerySQLResult);
@@ -157,6 +161,7 @@ let TestQuerySQLResolver = class TestQuerySQLResolver extends ResolverBase {
                 ExecutionTime: result.ExecutionTime,
                 ErrorMessage: result.ErrorMessage || undefined,
                 AppliedParameters: result.AppliedParameters ? JSON.stringify(result.AppliedParameters) : undefined,
+                RenderedSQL: result.RenderedSQL || undefined,
             };
         }
         catch (err) {

package/dist/resolvers/TestQuerySQLResolver.js.map

@@ -1 +1 @@
-{"version":3,"file":"TestQuerySQLResolver.js","sourceRoot":"","sources":["../../src/resolvers/TestQuerySQLResolver.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAC5F,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EAAE,QAAQ,EAAqB,QAAQ,EAAE,SAAS,EAAsB,MAAM,sBAAsB,CAAC;AAE5G,OAAO,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AACjD,OAAO,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAE1D;;;GAGG;AAEI,IAAM,wBAAwB,GAA9B,MAAM,wBAAwB;CAkBpC,CAAA;AAhBG;IADC,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,EAAE,WAAW,EAAE,mDAAmD,EAAE,CAAC;;sDAC7E;AAGb;IADC,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,EAAE,WAAW,EAAE,kFAAkF,EAAE,CAAC;;8DACpG;AAGrB;IADC,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,EAAE,WAAW,EAAE,iCAAiC,EAAE,CAAC;;qDAC5D;AAGZ;IADC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,uDAAuD,EAAE,CAAC;;8DACxF;AAGvB;IADC,KAAK,CAAC,GAAG,EAAE,CAAC,iBAAiB,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,sDAAsD,EAAE,CAAC;;4DACpF;AAGpC;IADC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,wBAAwB,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,iCAAiC,EAAE,CAAC;;8DAClE;AAjBjC,wBAAwB;IADpC,SAAS,EAAE;GACC,wBAAwB,CAkBpC;;AAED;;;;GAIG;AAEI,IAAM,iBAAiB,GAAvB,MAAM,iBAAiB;CAe7B,CAAA;AAbG;IADC,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,EAAE,WAAW,EAAE,kEAAkE,EAAE,CAAC;;8CAC7F;AAGZ;IADC,KAAK,CAAC,GAAG,EAAE,CAAC,iBAAiB,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,qDAAqD,EAAE,CAAC;;qDACnF;AAGpC;IADC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,kDAAkD,EAAE,CAAC;;uDACnF;AAGvB;IADC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,wBAAwB,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,sDAAsD,EAAE,CAAC;;uDACvF;AAG1C;IADC,KAAK,CAAC,GAAG,EAAE,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,EAAE,WAAW,EAAE,mCAAmC,EAAE,CAAC;;kDACzF;AAdR,iBAAiB;IAD7B,SAAS,EAAE;GACC,iBAAiB,CAe7B;;AAED;;GAEG;AAEI,IAAM,kBAAkB,GAAxB,MAAM,kBAAkB;CAkB9B,CAAA;AAhBG;IADC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,EAAE,WAAW,EAAE,yCAAyC,EAAE,CAAC;;mDAChE;AAGjB;IADC,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,8BAA8B,EAAE,CAAC;;mDACpE;AAGjB;IADC,KAAK,CAAC,GAAG,EAAE,CAAC,GAAG,EAAE,EAAE,WAAW,EAAE,yBAAyB,EAAE,CAAC;;oDAC5C;AAGjB;IADC,KAAK,CAAC,GAAG,EAAE,CAAC,GAAG,EAAE,EAAE,WAAW,EAAE,gCAAgC,EAAE,CAAC;;yDAC9C;AAGtB;IADC,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,mCAAmC,EAAE,CAAC;;wDACpE;AAGtB;IADC,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,wDAAwD,EAAE,CAAC;;6DACpF;AAjBlB,kBAAkB;IAD9B,UAAU,EAAE;GACA,kBAAkB,CAkB9B;;AAED;;;;;;;;;;;;GAYG;AAEI,IAAM,oBAAoB,GAA1B,MAAM,oBAAqB,SAAQ,YAAY;IAI5C,AAAN,KAAK,CAAC,YAAY,CACyB,KAAwB,EACxD,OAAmB;QAE1B,IAAI,CAAC;YACD,MAAM,IAAI,CAAC,6BAA6B,CAAC,YAAY,EAAE,GAAG,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;YACjF,6DAA6D;YAC7D,MAAM,QAAQ,GAAG,mBAAmB,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,wBAAwB,EAAE,KAAK,EAAE,CAAC,CAAC;YAC7F,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACZ,OAAO;oBACH,OAAO,EAAE,KAAK;oBACd,QAAQ,EAAE,CAAC;oBACX,aAAa,EAAE,CAAC;oBAChB,YAAY,EAAE,oGAAoG;iBACrH,CAAC;YACN,CAAC;YAED,MAAM,EAAE,GAAG,IAAI,QAAQ,CAAC,QAAwC,CAAC,CAAC;YAElE,MAAM,IAAI,GAAuB;gBAC7B,GAAG,EAAE,KAAK,CAAC,GAAG;gBACd,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,YAAY,EAAE,KAAK,CAAC,YAAY;gBAChC,YAAY,EAAE,KAAK,CAAC,YAAY;gBAChC,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,GAAG;aAChC,CAAC;YAEF,SAAS,CAAC,oDAAoD,IAAI,CAAC,OAAO,kBAAkB,IAAI,CAAC,YAAY,IAAI,KAAK,kBAAkB,IAAI,CAAC,YAAY,EAAE,MAAM,IAAI,CAAC,GAAG,CAAC,CAAC;YAE3K,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,eAAe,CAAC,IAAI,EAAE,OAAO,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;YAE9E,OAAO;gBACH,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS;gBACpE,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,aAAa,EAAE,MAAM,CAAC,aAAa;gBACnC,YAAY,EAAE,MAAM,CAAC,YAAY,IAAI,SAAS;gBAC9C,iBAAiB,EAAE,MAAM,CAAC,iBAAiB,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,SAAS;aACrG,CAAC;QACN,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACX,QAAQ,CAAC,GAAG,CAAC,CAAC;YACd,MAAM,YAAY,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACtE,OAAO;gBACH,OAAO,EAAE,KAAK;gBACd,QAAQ,EAAE,CAAC;gBACX,aAAa,EAAE,CAAC;gBAChB,YAAY,EAAE,wBAAwB,YAAY,EAAE;aACvD,CAAC;QACN,CAAC;IACL,CAAC;CACJ,CAAA;AAlDS;IAHL,KAAK,CAAC,GAAG,EAAE,CAAC,kBAAkB,EAAE;QAC7B,WAAW,EAAE,yGAAyG;KACzH,CAAC;IAEG,WAAA,GAAG,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,iBAAiB,CAAC,CAAA;IACrC,WAAA,GAAG,EAAE,CAAA;;qCADwC,iBAAiB;;wDAgDlE;AArDQ,oBAAoB;IADhC,QAAQ,EAAE;GACE,oBAAoB,CAsDhC"}
+{"version":3,"file":"TestQuerySQLResolver.js","sourceRoot":"","sources":["../../src/resolvers/TestQuerySQLResolver.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAC5F,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EAAE,QAAQ,EAAqB,QAAQ,EAAE,SAAS,EAAsB,MAAM,sBAAsB,CAAC;AAE5G,OAAO,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AACjD,OAAO,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAE1D;;;GAGG;AAEI,IAAM,wBAAwB,GAA9B,MAAM,wBAAwB;CAkBpC,CAAA;AAhBG;IADC,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,EAAE,WAAW,EAAE,mDAAmD,EAAE,CAAC;;sDAC7E;AAGb;IADC,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,EAAE,WAAW,EAAE,kFAAkF,EAAE,CAAC;;8DACpG;AAGrB;IADC,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,EAAE,WAAW,EAAE,iCAAiC,EAAE,CAAC;;qDAC5D;AAGZ;IADC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,uDAAuD,EAAE,CAAC;;8DACxF;AAGvB;IADC,KAAK,CAAC,GAAG,EAAE,CAAC,iBAAiB,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,sDAAsD,EAAE,CAAC;;4DACpF;AAGpC;IADC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,wBAAwB,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,iCAAiC,EAAE,CAAC;;8DAClE;AAjBjC,wBAAwB;IADpC,SAAS,EAAE;GACC,wBAAwB,CAkBpC;;AAED;;;;GAIG;AAEI,IAAM,iBAAiB,GAAvB,MAAM,iBAAiB;CAe7B,CAAA;AAbG;IADC,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,EAAE,WAAW,EAAE,kEAAkE,EAAE,CAAC;;8CAC7F;AAGZ;IADC,KAAK,CAAC,GAAG,EAAE,CAAC,iBAAiB,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,qDAAqD,EAAE,CAAC;;qDACnF;AAGpC;IADC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,kDAAkD,EAAE,CAAC;;uDACnF;AAGvB;IADC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,wBAAwB,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,sDAAsD,EAAE,CAAC;;uDACvF;AAG1C;IADC,KAAK,CAAC,GAAG,EAAE,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,EAAE,WAAW,EAAE,mCAAmC,EAAE,CAAC;;kDACzF;AAdR,iBAAiB;IAD7B,SAAS,EAAE;GACC,iBAAiB,CAe7B;;AAED;;GAEG;AAEI,IAAM,kBAAkB,GAAxB,MAAM,kBAAkB;CAqB9B,CAAA;AAnBG;IADC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,EAAE,WAAW,EAAE,yCAAyC,EAAE,CAAC;;mDAChE;AAGjB;IADC,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,8BAA8B,EAAE,CAAC;;mDACpE;AAGjB;IADC,KAAK,CAAC,GAAG,EAAE,CAAC,GAAG,EAAE,EAAE,WAAW,EAAE,yBAAyB,EAAE,CAAC;;oDAC5C;AAGjB;IADC,KAAK,CAAC,GAAG,EAAE,CAAC,GAAG,EAAE,EAAE,WAAW,EAAE,gCAAgC,EAAE,CAAC;;yDAC9C;AAGtB;IADC,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,mCAAmC,EAAE,CAAC;;wDACpE;AAGtB;IADC,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,wDAAwD,EAAE,CAAC;;6DACpF;AAG3B;IADC,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,+KAA+K,EAAE,CAAC;;uDACjN;AApBZ,kBAAkB;IAD9B,UAAU,EAAE;GACA,kBAAkB,CAqB9B;;AAED;;;;;;;;;;;;GAYG;AAEI,IAAM,oBAAoB,GAA1B,MAAM,oBAAqB,SAAQ,YAAY;IAI5C,AAAN,KAAK,CAAC,YAAY,CACyB,KAAwB,EACxD,OAAmB;QAE1B,IAAI,CAAC;YACD,MAAM,IAAI,CAAC,6BAA6B,CAAC,YAAY,EAAE,GAAG,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;YACjF,6DAA6D;YAC7D,MAAM,QAAQ,GAAG,mBAAmB,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,wBAAwB,EAAE,KAAK,EAAE,CAAC,CAAC;YAC7F,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACZ,OAAO;oBACH,OAAO,EAAE,KAAK;oBACd,QAAQ,EAAE,CAAC;oBACX,aAAa,EAAE,CAAC;oBAChB,YAAY,EAAE,oGAAoG;iBACrH,CAAC;YACN,CAAC;YAED,MAAM,EAAE,GAAG,IAAI,QAAQ,CAAC,QAAwC,CAAC,CAAC;YAElE,MAAM,IAAI,GAAuB;gBAC7B,GAAG,EAAE,KAAK,CAAC,GAAG;gBACd,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,YAAY,EAAE,KAAK,CAAC,YAAY;gBAChC,YAAY,EAAE,KAAK,CAAC,YAAY;gBAChC,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,GAAG;aAChC,CAAC;YAEF,SAAS,CAAC,oDAAoD,IAAI,CAAC,OAAO,kBAAkB,IAAI,CAAC,YAAY,IAAI,KAAK,kBAAkB,IAAI,CAAC,YAAY,EAAE,MAAM,IAAI,CAAC,GAAG,CAAC,CAAC;YAE3K,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,eAAe,CAAC,IAAI,EAAE,OAAO,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;YAE9E,OAAO;gBACH,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS;gBACpE,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,aAAa,EAAE,MAAM,CAAC,aAAa;gBACnC,YAAY,EAAE,MAAM,CAAC,YAAY,IAAI,SAAS;gBAC9C,iBAAiB,EAAE,MAAM,CAAC,iBAAiB,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,SAAS;gBAClG,WAAW,EAAE,MAAM,CAAC,WAAW,IAAI,SAAS;aAC/C,CAAC;QACN,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACX,QAAQ,CAAC,GAAG,CAAC,CAAC;YACd,MAAM,YAAY,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACtE,OAAO;gBACH,OAAO,EAAE,KAAK;gBACd,QAAQ,EAAE,CAAC;gBACX,aAAa,EAAE,CAAC;gBAChB,YAAY,EAAE,wBAAwB,YAAY,EAAE;aACvD,CAAC;QACN,CAAC;IACL,CAAC;CACJ,CAAA;AAnDS;IAHL,KAAK,CAAC,GAAG,EAAE,CAAC,kBAAkB,EAAE;QAC7B,WAAW,EAAE,yGAAyG;KACzH,CAAC;IAEG,WAAA,GAAG,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,iBAAiB,CAAC,CAAA;IACrC,WAAA,GAAG,EAAE,CAAA;;qCADwC,iBAAiB;;wDAiDlE;AAtDQ,oBAAoB;IADhC,QAAQ,EAAE;GACE,oBAAoB,CAuDhC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@memberjunction/server",
-  "version": "5.46.0",
+  "version": "5.48.0",
   "description": "MemberJunction: This project provides API access via GraphQL to the common data store.",
   "main": "./dist/index.js",
   "types": "./src/index.ts",
@@ -27,93 +27,93 @@
     "@as-integrations/express5": "^1.0.0",
     "@graphql-tools/schema": "latest",
     "@graphql-tools/utils": "^11.0.0",
-    "@memberjunction/actions": "5.46.0",
-    "@memberjunction/actions-apollo": "5.46.0",
-    "@memberjunction/actions-base": "5.46.0",
-    "@memberjunction/actions-bizapps-accounting": "5.46.0",
-    "@memberjunction/actions-bizapps-crm": "5.46.0",
-    "@memberjunction/actions-bizapps-formbuilders": "5.46.0",
-    "@memberjunction/actions-bizapps-lms": "5.46.0",
-    "@memberjunction/actions-bizapps-social": "5.46.0",
-    "@memberjunction/ai": "5.46.0",
-    "@memberjunction/ai-agent-manager": "5.46.0",
-    "@memberjunction/ai-agent-manager-actions": "5.46.0",
-    "@memberjunction/ai-agents": "5.46.0",
-    "@memberjunction/ai-bridge-base": "5.46.0",
-    "@memberjunction/ai-bridge-ringcentral": "5.46.0",
-    "@memberjunction/ai-bridge-server": "5.46.0",
-    "@memberjunction/ai-bridge-teams": "5.46.0",
-    "@memberjunction/ai-bridge-twilio": "5.46.0",
-    "@memberjunction/ai-bridge-vonage": "5.46.0",
-    "@memberjunction/ai-core-plus": "5.46.0",
-    "@memberjunction/ai-engine-base": "5.46.0",
-    "@memberjunction/ai-mcp-client": "5.46.0",
-    "@memberjunction/ai-prompts": "5.46.0",
-    "@memberjunction/ai-provider-bundle": "5.46.0",
-    "@memberjunction/ai-vector-sync": "5.46.0",
-    "@memberjunction/ai-vectordb": "5.46.0",
-    "@memberjunction/ai-vectors-pinecone": "5.46.0",
-    "@memberjunction/aiengine": "5.46.0",
-    "@memberjunction/api-keys": "5.46.0",
-    "@memberjunction/auth-providers": "5.46.0",
-    "@memberjunction/clustering-engine": "5.46.0",
-    "@memberjunction/codegen-lib": "5.46.0",
-    "@memberjunction/communication-engine": "5.46.0",
-    "@memberjunction/communication-ms-graph": "5.46.0",
-    "@memberjunction/notifications": "5.46.0",
-    "@memberjunction/communication-sendgrid": "5.46.0",
-    "@memberjunction/communication-types": "5.46.0",
-    "@memberjunction/component-registry-client-sdk": "5.46.0",
-    "@memberjunction/computer-use": "5.46.0",
-    "@memberjunction/computer-use-engine": "5.46.0",
-    "@memberjunction/config": "5.46.0",
-    "@memberjunction/core": "5.46.0",
-    "@memberjunction/core-actions": "5.46.0",
-    "@memberjunction/core-entities": "5.46.0",
-    "@memberjunction/core-entities-server": "5.46.0",
-    "@memberjunction/credentials": "5.46.0",
-    "@memberjunction/data-context": "5.46.0",
-    "@memberjunction/data-context-server": "5.46.0",
-    "@memberjunction/doc-utils": "5.46.0",
-    "@memberjunction/encryption": "5.46.0",
-    "@memberjunction/entity-communications-base": "5.46.0",
-    "@memberjunction/entity-communications-server": "5.46.0",
-    "@memberjunction/esignature": "5.46.0",
-    "@memberjunction/external-change-detection": "5.46.0",
-    "@memberjunction/generic-database-provider": "5.46.0",
-    "@memberjunction/global": "5.46.0",
-    "@memberjunction/graphql-dataprovider": "5.46.0",
-    "@memberjunction/integration-engine": "5.46.0",
-    "@memberjunction/integration-progress-artifacts": "5.46.0",
-    "@memberjunction/integration-schema-builder": "5.46.0",
-    "@memberjunction/interactive-component-types": "5.46.0",
-    "@memberjunction/lists": "5.46.0",
-    "@memberjunction/lists-base": "5.46.0",
-    "@memberjunction/livekit-room-server": "5.46.0",
-    "@memberjunction/postgresql-dataprovider": "5.46.0",
-    "@memberjunction/queue": "5.46.0",
-    "@memberjunction/record-comparison": "5.46.0",
-    "@memberjunction/redis-provider": "5.46.0",
-    "@memberjunction/remote-browser-base": "5.46.0",
-    "@memberjunction/remote-browser-cdp": "5.46.0",
-    "@memberjunction/remote-browser-selfhost": "5.46.0",
-    "@memberjunction/remote-browser-server": "5.46.0",
-    "@memberjunction/scheduling-actions": "5.46.0",
-    "@memberjunction/scheduling-base-types": "5.46.0",
-    "@memberjunction/scheduling-engine": "5.46.0",
-    "@memberjunction/scheduling-engine-base": "5.46.0",
-    "@memberjunction/schema-engine": "5.46.0",
-    "@memberjunction/search-engine": "5.46.0",
-    "@memberjunction/server-extensions-core": "5.46.0",
-    "@memberjunction/sql-dialect": "5.46.0",
-    "@memberjunction/sqlserver-dataprovider": "5.46.0",
-    "@memberjunction/storage": "5.46.0",
-    "@memberjunction/tag-engine": "5.46.0",
-    "@memberjunction/tag-engine-base": "5.46.0",
-    "@memberjunction/templates": "5.46.0",
-    "@memberjunction/testing-engine": "5.46.0",
-    "@memberjunction/testing-engine-base": "5.46.0",
-    "@memberjunction/version-history": "5.46.0",
+    "@memberjunction/actions": "5.48.0",
+    "@memberjunction/actions-apollo": "5.48.0",
+    "@memberjunction/actions-base": "5.48.0",
+    "@memberjunction/actions-bizapps-accounting": "5.48.0",
+    "@memberjunction/actions-bizapps-crm": "5.48.0",
+    "@memberjunction/actions-bizapps-formbuilders": "5.48.0",
+    "@memberjunction/actions-bizapps-lms": "5.48.0",
+    "@memberjunction/actions-bizapps-social": "5.48.0",
+    "@memberjunction/ai": "5.48.0",
+    "@memberjunction/ai-agent-manager": "5.48.0",
+    "@memberjunction/ai-agent-manager-actions": "5.48.0",
+    "@memberjunction/ai-agents": "5.48.0",
+    "@memberjunction/ai-bridge-base": "5.48.0",
+    "@memberjunction/ai-bridge-ringcentral": "5.48.0",
+    "@memberjunction/ai-bridge-server": "5.48.0",
+    "@memberjunction/ai-bridge-teams": "5.48.0",
+    "@memberjunction/ai-bridge-twilio": "5.48.0",
+    "@memberjunction/ai-bridge-vonage": "5.48.0",
+    "@memberjunction/ai-core-plus": "5.48.0",
+    "@memberjunction/ai-engine-base": "5.48.0",
+    "@memberjunction/ai-mcp-client": "5.48.0",
+    "@memberjunction/ai-prompts": "5.48.0",
+    "@memberjunction/ai-provider-bundle": "5.48.0",
+    "@memberjunction/ai-vector-sync": "5.48.0",
+    "@memberjunction/ai-vectordb": "5.48.0",
+    "@memberjunction/ai-vectors-pinecone": "5.48.0",
+    "@memberjunction/aiengine": "5.48.0",
+    "@memberjunction/api-keys": "5.48.0",
+    "@memberjunction/auth-providers": "5.48.0",
+    "@memberjunction/clustering-engine": "5.48.0",
+    "@memberjunction/codegen-lib": "5.48.0",
+    "@memberjunction/communication-engine": "5.48.0",
+    "@memberjunction/communication-ms-graph": "5.48.0",
+    "@memberjunction/notifications": "5.48.0",
+    "@memberjunction/communication-sendgrid": "5.48.0",
+    "@memberjunction/communication-types": "5.48.0",
+    "@memberjunction/component-registry-client-sdk": "5.48.0",
+    "@memberjunction/computer-use": "5.48.0",
+    "@memberjunction/computer-use-engine": "5.48.0",
+    "@memberjunction/config": "5.48.0",
+    "@memberjunction/core": "5.48.0",
+    "@memberjunction/core-actions": "5.48.0",
+    "@memberjunction/core-entities": "5.48.0",
+    "@memberjunction/core-entities-server": "5.48.0",
+    "@memberjunction/credentials": "5.48.0",
+    "@memberjunction/data-context": "5.48.0",
+    "@memberjunction/data-context-server": "5.48.0",
+    "@memberjunction/doc-utils": "5.48.0",
+    "@memberjunction/encryption": "5.48.0",
+    "@memberjunction/entity-communications-base": "5.48.0",
+    "@memberjunction/entity-communications-server": "5.48.0",
+    "@memberjunction/esignature": "5.48.0",
+    "@memberjunction/external-change-detection": "5.48.0",
+    "@memberjunction/generic-database-provider": "5.48.0",
+    "@memberjunction/global": "5.48.0",
+    "@memberjunction/graphql-dataprovider": "5.48.0",
+    "@memberjunction/integration-engine": "5.48.0",
+    "@memberjunction/integration-progress-artifacts": "5.48.0",
+    "@memberjunction/integration-schema-builder": "5.48.0",
+    "@memberjunction/interactive-component-types": "5.48.0",
+    "@memberjunction/lists": "5.48.0",
+    "@memberjunction/lists-base": "5.48.0",
+    "@memberjunction/livekit-room-server": "5.48.0",
+    "@memberjunction/postgresql-dataprovider": "5.48.0",
+    "@memberjunction/queue": "5.48.0",
+    "@memberjunction/record-comparison": "5.48.0",
+    "@memberjunction/redis-provider": "5.48.0",
+    "@memberjunction/remote-browser-base": "5.48.0",
+    "@memberjunction/remote-browser-cdp": "5.48.0",
+    "@memberjunction/remote-browser-selfhost": "5.48.0",
+    "@memberjunction/remote-browser-server": "5.48.0",
+    "@memberjunction/scheduling-actions": "5.48.0",
+    "@memberjunction/scheduling-base-types": "5.48.0",
+    "@memberjunction/scheduling-engine": "5.48.0",
+    "@memberjunction/scheduling-engine-base": "5.48.0",
+    "@memberjunction/schema-engine": "5.48.0",
+    "@memberjunction/search-engine": "5.48.0",
+    "@memberjunction/server-extensions-core": "5.48.0",
+    "@memberjunction/sql-dialect": "5.48.0",
+    "@memberjunction/sqlserver-dataprovider": "5.48.0",
+    "@memberjunction/storage": "5.48.0",
+    "@memberjunction/tag-engine": "5.48.0",
+    "@memberjunction/tag-engine-base": "5.48.0",
+    "@memberjunction/templates": "5.48.0",
+    "@memberjunction/testing-engine": "5.48.0",
+    "@memberjunction/testing-engine-base": "5.48.0",
+    "@memberjunction/version-history": "5.48.0",
     "@octokit/auth-app": "^7.1.5",
     "@octokit/rest": "^21.1.1",
     "@types/compression": "^1.8.1",

package/src/__tests__/RealtimeProxyServer.test.ts

@@ -0,0 +1,70 @@
+import { describe, it, expect, beforeEach } from 'vitest';
+import type { IncomingMessage } from 'node:http';
+import type { Duplex } from 'node:stream';
+import { RealtimeProxyRegistry, REALTIME_PROXY_PATH } from '@memberjunction/ai';
+import { RealtimeProxyServer } from '../realtimeProxy/RealtimeProxyServer';
+
+/** A fake upgrade socket capturing whether it was written to / destroyed (the rejection path). */
+class FakeSocket {
+    public Written: string[] = [];
+    public Destroyed = false;
+    public write(data: string): boolean {
+        this.Written.push(data);
+        return true;
+    }
+    public destroy(): void {
+        this.Destroyed = true;
+    }
+}
+
+function req(url: string): IncomingMessage {
+    return { url } as unknown as IncomingMessage;
+}
+function sock(fake: FakeSocket): Duplex {
+    return fake as unknown as Duplex;
+}
+const HEAD = Buffer.alloc(0);
+
+describe('RealtimeProxyServer.TryHandleUpgrade', () => {
+    let proxy: RealtimeProxyServer;
+
+    beforeEach(() => {
+        proxy = RealtimeProxyServer.Instance;
+    });
+
+    it('does NOT claim a non-proxy path (leaves the socket for the graphql-ws server)', () => {
+        const fake = new FakeSocket();
+        const owned = proxy.TryHandleUpgrade(req('/graphql'), sock(fake), HEAD);
+        expect(owned).toBe(false);
+        expect(fake.Destroyed).toBe(false);
+        expect(fake.Written).toHaveLength(0);
+    });
+
+    it('claims the proxy path but rejects a MISSING ticket with 401 + destroy', () => {
+        const fake = new FakeSocket();
+        const owned = proxy.TryHandleUpgrade(req(REALTIME_PROXY_PATH), sock(fake), HEAD);
+        expect(owned).toBe(true);
+        expect(fake.Written[0]).toContain('401');
+        expect(fake.Destroyed).toBe(true);
+    });
+
+    it('rejects an UNKNOWN ticket with 401 + destroy', () => {
+        const fake = new FakeSocket();
+        const owned = proxy.TryHandleUpgrade(req(`${REALTIME_PROXY_PATH}?ticket=does-not-exist`), sock(fake), HEAD);
+        expect(owned).toBe(true);
+        expect(fake.Written[0]).toContain('401');
+        expect(fake.Destroyed).toBe(true);
+    });
+
+    it('consumes a valid ticket exactly once (single-use)', () => {
+        // A valid ticket exists in the shared registry until consumed. We assert single-use by consuming
+        // it here first (proving it was live), then confirming the proxy would 401 a second attempt.
+        const ticket = RealtimeProxyRegistry.Instance.Issue({ UpstreamUrl: 'ws://hf.internal/v1/realtime', TTLSeconds: 60 });
+        expect(RealtimeProxyRegistry.Instance.Consume(ticket.ID)).not.toBeNull();
+
+        const fake = new FakeSocket();
+        const owned = proxy.TryHandleUpgrade(req(`${REALTIME_PROXY_PATH}?ticket=${ticket.ID}`), sock(fake), HEAD);
+        expect(owned).toBe(true);
+        expect(fake.Destroyed).toBe(true); // already consumed → treated as invalid
+    });
+});

package/src/context.ts

@@ -705,7 +705,12 @@ async function createPerRequestProviders(
     { provider: p, type: 'Read-Write' }
   ];
 
-  if (!isPostgres) {
+  if (isPostgres) {
+    const rp = await tryCreateReadOnlyPostgresProvider();
+    if (rp) {
+      providers.push({ provider: rp, type: 'Read-Only' });
+    }
+  } else {
     const rp = await tryCreateReadOnlyProvider(dataSources);
     if (rp) {
       providers.push({ provider: rp, type: 'Read-Only' });
@@ -748,6 +753,46 @@ async function createPostgresProvider(): Promise<DatabaseProviderBase> {
   return pgProvider;
 }
 
+/**
+ * Attempts to create a read-only PostgreSQL provider using DB_READ_ONLY_USERNAME/PASSWORD.
+ * Shares the connection pool from the primary provider. Returns null if no read-only credentials are configured.
+ */
+async function tryCreateReadOnlyPostgresProvider(): Promise<DatabaseProviderBase | null> {
+  const roUser = process.env.PG_READ_ONLY_USERNAME || process.env.DB_READ_ONLY_USERNAME;
+  const roPass = process.env.PG_READ_ONLY_PASSWORD || process.env.DB_READ_ONLY_PASSWORD;
+  if (!roUser || !roPass) {
+    return null;
+  }
+
+  try {
+    const { PostgreSQLDataProvider, PostgreSQLProviderConfigData } = await import('@memberjunction/postgresql-dataprovider');
+    const pgHost = process.env.PG_HOST || process.env.DB_HOST || 'localhost';
+    const pgPort = parseInt(process.env.PG_PORT || process.env.DB_PORT || '5432', 10);
+    const pgDatabase = process.env.PG_DATABASE || process.env.DB_DATABASE || '';
+
+    const roProvider = new PostgreSQLDataProvider();
+    const roConfig = new PostgreSQLProviderConfigData(
+      { Host: pgHost, Port: pgPort, Database: pgDatabase, User: roUser, Password: roPass },
+      mj_core_schema,
+      0,
+      undefined,
+      undefined,
+      false,
+    );
+
+    const primaryProvider = Metadata.Provider as unknown as { DatabaseConnection?: import('pg').Pool }; // global-provider-ok: bootstrap (share primary provider's PG pool with the read-only provider)
+    if (primaryProvider?.DatabaseConnection) {
+      await roProvider.ConfigWithSharedPool(roConfig, primaryProvider.DatabaseConnection);
+    } else {
+      await roProvider.Config(roConfig);
+    }
+
+    return roProvider;
+  } catch (_err) {
+    return null;
+  }
+}
+
 /**
  * Attempts to create a read-only SQL Server provider.
  * Returns null if no read-only data source is available.

package/src/index.ts

@@ -26,6 +26,7 @@ import { BuildSchemaOptions, buildSchemaSync, GraphQLTimestamp, PubSubEngine } f
 import { PubSub } from 'graphql-subscriptions';
 import sql from 'mssql';
 import { WebSocketServer } from 'ws';
+import { RealtimeProxyServer } from './realtimeProxy/RealtimeProxyServer.js';
 import buildApolloServer from './apolloServer/index.js';
 import { configInfo, configFilePath, dbDatabase, dbHost, dbPort, dbUsername, graphqlPort, graphqlRootPath, mj_core_schema, websiteRunFromPackage, RESTApiOptions } from './config.js';
 import { default as jwt } from 'jsonwebtoken';
@@ -857,7 +858,31 @@ export const serve = async (resolverPaths: Array<string>, app: Application = cre
 
   const httpServer = createServer(app);
 
-  const webSocketServer = new WebSocketServer({ server: httpServer, path: graphqlRootPath });
+  // `noServer` so we own the HTTP `upgrade` routing ourselves (below) and can dispatch by path between
+  // the graphql-ws server and the realtime proxy. (In `{ server, path }` mode, ws destroys any socket whose
+  // path doesn't match, which would kill the proxy's `/realtime-proxy` upgrades — hence the explicit router.)
+  const webSocketServer = new WebSocketServer({ noServer: true });
+
+  // Single upgrade router: the realtime proxy claims its own path first (an authenticated byte-tunnel that
+  // lets self-hosted realtime providers — e.g. HuggingFace speech-to-speech — run the shipped client-direct
+  // audio topology without the internal endpoint ever being exposed to the browser); everything on the
+  // graphql path goes to graphql-ws; anything else is rejected. Must be registered before httpServer.listen().
+  httpServer.on('upgrade', (request, socket, head) => {
+    if (RealtimeProxyServer.Instance.TryHandleUpgrade(request, socket, head as Buffer)) {
+      return;
+    }
+    let pathname = graphqlRootPath;
+    try {
+      pathname = new URL(request.url ?? graphqlRootPath, 'http://internal').pathname;
+    } catch {
+      /* unparseable — fall through to the graphql-path check, which will reject it */
+    }
+    if (pathname === graphqlRootPath) {
+      webSocketServer.handleUpgrade(request, socket, head, (ws) => webSocketServer.emit('connection', ws, request));
+    } else {
+      socket.destroy();
+    }
+  });
 
   // Track per-connection expiry timers so we can clean them up on close
   const expiryTimers = new WeakMap<object, ReturnType<typeof setTimeout>>();