@memberjunction/server 6.1.0-edge.1 → 6.1.0-edge.2

package/src/index.ts

@@ -5,9 +5,9 @@ dotenv.config({ quiet: true });
 import { expressMiddleware } from '@as-integrations/express5';
 import { mergeSchemas } from '@graphql-tools/schema';
 import { Metadata, DatabasePlatform, SetProvider, StartupManager as StartupManagerImport, BaseEntity, BaseEntityEvent, RunView, DatabaseProviderBase, ResolveStartupMode } from '@memberjunction/core';
-import { resolveDbPlatformFromEnv } from '@memberjunction/generic-database-provider';
+import { UserCache, resolveDbPlatformFromEnv } from '@memberjunction/generic-database-provider';
 import { MJGlobal, MJEventType, UUIDsEqual, ShutdownRegistry } from '@memberjunction/global';
-import { setupSQLServerClient, SQLServerDataProvider, SQLServerProviderConfigData, UserCache } from '@memberjunction/sqlserver-dataprovider';
+import { setupSQLServerClient, SQLServerDataProvider, SQLServerProviderConfigData } from '@memberjunction/sqlserver-dataprovider';
 import { extendConnectionPoolWithQuery } from './util.js';
 import { registerIntegrationCustomColumnPromoter } from './integration/CustomColumnPromoter.js';
 import { DisableUnselectedEntityMaps, ReenableFieldMapsForEntityMap } from './integration/EntityMapLifecycle.js';
@@ -19,11 +19,12 @@ import { default as fg } from 'fast-glob';
 import { useServer } from 'graphql-ws/lib/use/ws';
 import { createServer } from 'node:http';
 import { fileURLToPath } from 'node:url';
-import { readFileSync } from 'node:fs';
+import { readFileSync, writeFileSync } from 'node:fs';
+import { Session as InspectorSession } from 'node:inspector';
 import { sep } from 'node:path';
 import 'reflect-metadata';
 import { ReplaySubject } from 'rxjs';
-import { BuildSchemaOptions, buildSchemaSync, GraphQLTimestamp, PubSubEngine } from 'type-graphql';
+import { BuildSchemaOptions, buildSchemaSync, getMetadataStorage, GraphQLTimestamp, PubSubEngine } from 'type-graphql';
 import { PubSub } from 'graphql-subscriptions';
 import sql from 'mssql';
 import { WebSocketServer } from 'ws';
@@ -153,6 +154,7 @@ export * from './resolvers/QueryResolver.js';
 export * from './services/TaskGraphProviderFactory.js';
 export * from './services/TaskGraphAgentRunner.js';
 export * from './services/StartTaskGraphDispatcher.js';
+export * from './services/TaskGraphPromptRunner.js';
 export * from './services/TaskGraphContinuationDeliverer.js';
 export * from './resolvers/TaskGraphFrameResolver.js';
 export * from './resolvers/TestQuerySQLResolver.js';
@@ -328,8 +330,8 @@ export const serve = async (resolverPaths: Array<string>, app: Application = cre
     await provider.Config(pgConfigData);
     SetProvider(provider);
 
-    // Refresh user cache using PostgreSQL
-    await refreshUserCacheFromPG(pgPool, mj_core_schema);
+    // Warm the user cache — dialect-neutral, same call the SQL Server path makes
+    await UserCache.Instance.Refresh(provider);
 
     // Run startup actions — same 'full' entry-point default as the SQL Server path
     const sysUser = UserCache.Instance.GetSystemUser();
@@ -858,23 +860,73 @@ export const serve = async (resolverPaths: Array<string>, app: Application = cre
   lap('Resolver + Middleware Discovery', tServe);
   tServe = startupLog.BeginPhase('Building GraphQL schema');
 
+  // ── Scale-runtime instrumentation (fix #1 profiling) ─────────────────────────
+  // Split the previously-monolithic "Schema Build" phase into its three real
+  // sub-steps so we can see which one dominates at high entity counts, and capture
+  // the type-graphql metadata cardinality (the O(entities×fields) signal). Guarded
+  // by MJ_SCHEMA_PROFILE, and emits ONE explicit console line (independent of the
+  // startup logger's level, and NOT via EndPhase, so the "schema" summary token and
+  // its total math stay clean). No-op in normal deployments.
+  const schemaProfile = process.env.MJ_SCHEMA_PROFILE === '1';
+  let objectTypeCount = -1, fieldCount = -1;
+  if (schemaProfile) {
+    try {
+      const meta = getMetadataStorage();
+      // Read BEFORE buildSchemaSync — buildSchemaSync's internal build() resets these arrays.
+      objectTypeCount = meta.objectTypes.length;
+      fieldCount = meta.fields.length;
+    } catch {
+      /* metadata cardinality is best-effort; leave sentinels */
+    }
+  }
+
+  // Surgical CPU profile of ONLY buildSchemaSync (behind MJ_SCHEMA_CPUPROF=1), so we can see
+  // whether the ~66s at scale is uniform per-field work (cache is the only fix) or a patchable
+  // hotspot in type-graphql's generator. Deterministic flush (writes before serve continues) —
+  // no dependency on --cpu-prof surviving a process kill.
+  const cpuProf = process.env.MJ_SCHEMA_CPUPROF === '1';
+  let profSession: InspectorSession | undefined;
+  if (cpuProf) {
+    profSession = new InspectorSession();
+    profSession.connect();
+    await new Promise<void>((res, rej) => profSession!.post('Profiler.enable', (e) => (e ? rej(e) : res())));
+    await new Promise<void>((res, rej) => profSession!.post('Profiler.start', (e) => (e ? rej(e) : res())));
+  }
+
+  const tBuild = performance.now();
+  const builtSchema = buildSchemaSync({
+    resolvers: allResolvers,
+    validate: false,
+    scalarsMap: [{ type: Date, scalar: GraphQLTimestamp }],
+    emitSchemaFile: websiteRunFromPackage !== 1,
+    pubSub,
+    globalMiddlewares: [variablesLoggingMiddleware],
+  });
+  const buildMs = performance.now() - tBuild;
+
+  if (cpuProf && profSession) {
+    const profile = await new Promise<unknown>((res, rej) =>
+      profSession!.post('Profiler.stop', (e, r) => (e ? rej(e) : res((r as { profile: unknown }).profile)))
+    );
+    const outPath = `/tmp/mjapi_schema_build_${process.pid}.cpuprofile`;
+    writeFileSync(outPath, JSON.stringify(profile));
+    profSession.disconnect();
+    // eslint-disable-next-line no-console
+    console.log(`[SCHEMA-CPUPROF] wrote ${outPath} (buildSchemaSync=${buildMs.toFixed(0)}ms)`);
+  }
+
+  const tMerge = performance.now();
   let schema = mergeSchemas({
-    schemas: [
-      buildSchemaSync({
-        resolvers: allResolvers,
-        validate: false,
-        scalarsMap: [{ type: Date, scalar: GraphQLTimestamp }],
-        emitSchemaFile: websiteRunFromPackage !== 1,
-        pubSub,
-        globalMiddlewares: [variablesLoggingMiddleware],
-      }),
-    ],
+    schemas: [builtSchema],
     typeDefs: [requireSystemUserDirective.typeDefs, publicDirective.typeDefs],
   });
+  const mergeMs = performance.now() - tMerge;
 
   // Verbose-mode-only diagnostic: name custom-resolver args that aren't metadata-bound
   // and aren't @NoLog-marked. No-op in default config (logVariables=false).
   auditResolversForUndecoratedArgs();
+
+  const tTransform = performance.now();
   schema = requireSystemUserDirective.transformer(schema);
   schema = publicDirective.transformer(schema);
 
@@ -882,6 +934,17 @@ export const serve = async (resolverPaths: Array<string>, app: Application = cre
   for (const transformer of mwSchemaTransformers) {
     schema = transformer(schema);
   }
+  const transformMs = performance.now() - tTransform;
+
+  if (schemaProfile) {
+    const typeMapSize = Object.keys(schema.getTypeMap()).length;
+    // eslint-disable-next-line no-console
+    console.log(
+      `[SCHEMA-PROFILE] resolvers=${allResolvers.length} objectTypes=${objectTypeCount} fields=${fieldCount} ` +
+      `typeMap=${typeMapSize} | buildSchemaSync=${buildMs.toFixed(0)}ms mergeSchemas=${mergeMs.toFixed(0)}ms ` +
+      `transformers=${transformMs.toFixed(0)}ms`
+    );
+  }
 
   lap('Schema Build', tServe);
   tServe = startupLog.BeginPhase('Starting HTTP server');
@@ -1350,8 +1413,20 @@ export const serve = async (resolverPaths: Array<string>, app: Application = cre
   // submitted graph — submission would be durable and inert, which is strictly worse than the old
   // client-driven path it replaced. Gated on SQL Server because the provider factory mints
   // SQLServerDataProvider; the PG branch lands with PG parity. Self-registers with ShutdownRegistry.
+  //
+  // `MJ_DISABLE_TASK_GRAPH_DISPATCHER=1` suppresses it, for the one case where a second dispatcher
+  // is actively harmful: the integration suite's task-graph bundle drives its OWN dispatcher against
+  // a stub runner and asserts exactly-once execution. A dispatcher claims from the whole table, not
+  // from "its own" graphs, so a server sharing that database races the suite for every claim and
+  // executes the suite's tasks with the real agent runner. The bundle then reports tasks that never
+  // ran and graphs that settled to the wrong status — symptoms that read as engine defects and cost
+  // a release cycle to trace back to here. The suite still needs MJAPI up for its client-transport
+  // members, so "stop the server" is not the remedy; this is.
   const taskGraphPool = dataSources[0]?.dataSource;
-  if (resumeUser && taskGraphPool instanceof sql.ConnectionPool) {
+  const taskGraphDispatcherDisabled = process.env.MJ_DISABLE_TASK_GRAPH_DISPATCHER === '1';
+  if (taskGraphDispatcherDisabled) {
+    LogStatus('[TaskGraphDispatcher] Disabled by MJ_DISABLE_TASK_GRAPH_DISPATCHER=1 — submitted graphs will not be executed by this process.');
+  } else if (resumeUser && taskGraphPool instanceof sql.ConnectionPool) {
     StartTaskGraphDispatcher(taskGraphPool, resumeUser)
       .catch(err => console.warn(`[TaskGraphDispatcher] Startup failed: ${err}`));
   }
@@ -1745,31 +1820,6 @@ function createMSSQLCompatPool(pgPool: import('pg').Pool): sql.ConnectionPool {
   return wrapper as unknown as sql.ConnectionPool;
 }
 
-/**
- * Refreshes the UserCache using PostgreSQL queries instead of MSSQL.
- * This mirrors the logic in UserCache.Refresh() but uses pg.Pool.
- */
-async function refreshUserCacheFromPG(pgPool: import('pg').Pool, coreSchema: string): Promise<void> {
-  const { UserInfo } = await import('@memberjunction/core');
-  const uResult = await pgPool.query(`SELECT * FROM ${coreSchema}."vwUsers"`);
-  const rResult = await pgPool.query(`SELECT * FROM ${coreSchema}."vwUserRoles"`);
-  const users = uResult.rows;
-  const roles = rResult.rows;
-
-  if (users) {
-    const userInfos = users.map((user: Record<string, unknown>) => {
-      const userWithRoles = {
-        ...user,
-        UserRoles: roles.filter((role: Record<string, unknown>) => UUIDsEqual(role.UserID as string, user.ID as string)),
-      };
-      return new UserInfo(Metadata.Provider, userWithRoles); // global-provider-ok: bootstrap (UserCache initialization)
-    });
-    // Access the UserCache internals to set users
-    const cache = UserCache.Instance;
-    (cache as unknown as Record<string, unknown>)['_users'] = userInfos;
-  }
-}
-
 /**
  * Translates SQL Server bracket-quoted identifiers to PostgreSQL double-quoted identifiers.
  * Converts [schema].[table] to "schema"."table" and handles common T-SQL patterns.

package/src/logging/secretRedactor.ts

@@ -51,6 +51,20 @@ export function redactArg(ctx: RedactionContext): unknown {
     const entity = ctx.provider.Entities.find((e) => e.ClassName === match.groups!.name);
     if (entity) {
       encryptedFieldNames = new Set(entity.EncryptedFields.map((f) => f.Name));
+    } else {
+      // The name matched the CRUD convention but resolves to no entity — so the
+      // metadata half of the redactor contributes nothing and, absent any @NoLog
+      // field, this arg falls through to shortenForLog with its values intact.
+      //
+      // This is the silent case: the boot audit tests only the NAME pattern, so an
+      // input like `CreateConnectionInput` is classified as metadata-bound and never
+      // warned about, while the lookup here quietly fails. Every hand-written
+      // `Create*Input` in the resolvers hits this — codegen inputs embed the entity
+      // ClassName (`CreateMJCredentialInput`), hand-written ones do not.
+      //
+      // Report it once per input type so the operator who enabled variables logging
+      // learns which args are unprotected, rather than discovering it in a log file.
+      WarnUnboundCrudInput(ctx.inputTypeName);
     }
   }
 
@@ -80,3 +94,32 @@ export function redactArg(ctx: RedactionContext): unknown {
 }
 
 const EMPTY_SET: ReadonlySet<string> = new Set<string>();
+
+/**
+ * Input type names already reported by {@link WarnUnboundCrudInput}. Warning once
+ * per type keeps a hot mutation from flooding the log with the same diagnostic.
+ */
+const warnedUnboundInputTypes = new Set<string>();
+
+/**
+ * Reports, once per input type, that an arg named like a CRUD input resolves to no
+ * entity and is therefore logged unredacted unless its fields carry `@NoLog`.
+ *
+ * Exported for tests; not part of the redaction path's contract.
+ */
+export function WarnUnboundCrudInput(inputTypeName: string): void {
+  if (warnedUnboundInputTypes.has(inputTypeName)) {
+    return;
+  }
+  warnedUnboundInputTypes.add(inputTypeName);
+  console.warn(
+    `[MJServer] Variables logging: '${inputTypeName}' matches the Create/Update/Delete input ` +
+      `naming convention but maps to no entity, so encrypted-field redaction cannot apply to it. ` +
+      `Its values are being logged. Mark any sensitive @Field() on this input with @NoLog.`,
+  );
+}
+
+/** Test seam — clears the once-per-type warning state. */
+export function ResetUnboundCrudInputWarnings(): void {
+  warnedUnboundInputTypes.clear();
+}

package/src/middleware/BaseServerMiddleware.ts

@@ -126,6 +126,11 @@ export abstract class BaseServerMiddleware {
     /**
      * Hook that runs after a RunView operation completes. Can modify the result
      * (e.g., filtering or augmenting data) before it is returned to the caller.
+     *
+     * ⚠️ `results.Results` and its rows may be FROZEN shared cache state (LocalCacheManager
+     * freeze-on-write) — writing into a row throws `TypeError`. To modify, build copies and
+     * either reassign `results.Results = results.Results.map(r => ({ ...r, ... }))` or return
+     * a new result; never mutate rows in place.
      */
     PostRunView(params: RunViewParams, results: RunViewResult, contextUser: UserInfo | undefined): RunViewResult | Promise<RunViewResult> {
         return results;

package/src/realtimeWidget/WidgetSessionService.ts

@@ -17,7 +17,7 @@
 import { Metadata, RunView, UserInfo, LogError, LogStatus } from '@memberjunction/core';
 import { MJLruCache, UUIDsEqual } from '@memberjunction/global';
 import type { MJConversationWidgetInstanceEntity, MJConversationEntity } from '@memberjunction/core-entities';
-import { UserCache } from '@memberjunction/sqlserver-dataprovider';
+import { UserCache } from '@memberjunction/generic-database-provider';
 import { MagicLinkKeyManager } from '../auth/magicLink/MagicLinkKeys.js';
 import { generateSessionId } from '../auth/magicLink/magicLinkCore.js';
 import { MagicLinkService } from '../auth/magicLink/MagicLinkService.js';

package/src/realtimeWidget/widgetGuestElevation.ts

@@ -15,7 +15,7 @@
 
 import { RunView, LogError, type UserInfo, type DatabaseProviderBase } from '@memberjunction/core';
 import type { MJConversationWidgetInstanceEntity } from '@memberjunction/core-entities';
-import { UserCache } from '@memberjunction/sqlserver-dataprovider';
+import { UserCache } from '@memberjunction/generic-database-provider';
 import type { UserPayload } from '../types.js';
 
 const WIDGET_ENTITY = 'MJ: Conversation Widget Instances';

package/src/resolvers/ActionResolver.ts

@@ -366,6 +366,19 @@ export class ActionResolver extends ResolverBase {
       // Run the entity action
       const result = await EntityActionEngineServer.Instance.RunEntityAction(params);
 
+      if (!result) {
+        // The binding is scoped (ScopeEntityID/ScopeRecordID) and this record falls outside it, so
+        // the action never ran. That is a legitimate answer, not a failure — dereferencing the null
+        // here turned "this binding does not apply to that record" into a server error for the
+        // caller. Reported as a successful no-op with an explicit message, so a client can tell it
+        // apart from an action that ran and did nothing.
+        return {
+          Success: true,
+          Message: 'The entity action did not run: its binding is scoped to different records.',
+          ResultData: JSON.stringify({ Ran: false, Reason: 'OutOfScope' })
+        };
+      }
+
       // Return the result
       return {
         Success: result.Success,

package/src/resolvers/ComponentRegistryResolver.ts

@@ -1,7 +1,7 @@
 import { Arg, Ctx, Field, InputType, ObjectType, Query, Mutation, Resolver } from 'type-graphql';
 import { UserInfo, LogError, LogStatus } from '@memberjunction/core';
 import { UUIDsEqual, MJLruCache } from '@memberjunction/global';
-import { UserCache } from '@memberjunction/sqlserver-dataprovider';
+import { UserCache } from '@memberjunction/generic-database-provider';
 import { MJComponentRegistryEntity, ComponentMetadataEngine } from '@memberjunction/core-entities';
 import { CredentialEngine } from '@memberjunction/credentials';
 import { ComponentSpec } from '@memberjunction/interactive-component-types';

package/src/resolvers/EntityPermissionResolver.ts

@@ -3,7 +3,7 @@ import { LogError } from '@memberjunction/core';
 import { AppContext } from '../types.js';
 import { ResolverBase } from '../generic/ResolverBase.js';
 import { GetReadOnlyProvider } from '../util.js';
-import { UserCache } from '@memberjunction/sqlserver-dataprovider';
+import { UserCache } from '@memberjunction/generic-database-provider';
 
 @ObjectType()
 class EntityPermissionResult {

package/src/resolvers/IntegrationDiscoveryResolver.ts

@@ -1,6 +1,7 @@
 import { Resolver, Query, Mutation, Arg, Ctx, ObjectType, Field, InputType, Int, Float } from "type-graphql";
 import { CompositeKey, DatabaseProviderBase, EntityInfo, LocalCacheManager, Metadata, RunView, UserInfo, LogError, LogStatus, IMetadataProvider, TransactionGroupBase } from "@memberjunction/core";
 import { GetReadOnlyProvider, GetReadWriteProvider } from "../util.js";
+import { NoLog } from "../logging/NoLog.js";
 import { UUIDsEqual } from "@memberjunction/global";
 import { CronExpressionHelper } from "@memberjunction/scheduling-engine";
 import {
@@ -56,7 +57,7 @@ import { IntegrationCustomColumnPromoter } from "../integration/CustomColumnProm
 import { ComputeCascadeRemovalSet, ComputeRemovedDependencyWarnings, DisableUnselectedEntityMaps, ReenableFieldMapsForEntityMap, ResetPullWatermarks, SetEntityMapEnabled } from "../integration/EntityMapLifecycle.js";
 import { AppContext } from "../types.js";
 import { RequireSystemUser } from "../directives/RequireSystemUser.js";
-import { UserCache } from "@memberjunction/sqlserver-dataprovider";
+import { UserCache } from "@memberjunction/generic-database-provider";
 
 // ─── RSU Pipeline Output Types ──────────────────────────────────────────────
 
@@ -551,7 +552,16 @@ class CreateConnectionInput {
     @Field() CompanyID: string;
     @Field() CredentialTypeID: string;
     @Field() CredentialName: string;
-    @Field() CredentialValues: string;
+    /**
+     * The credential payload being connected, as a JSON string.
+     *
+     * `@NoLog` is load-bearing here, not decorative. This field does NOT map to an
+     * entity column — the resolver assigns it onto `MJ: Credentials`.`Values`
+     * (which IS `Encrypt=true`) in procedural code further down. The metadata-driven
+     * half of the redactor keys off entity columns, so it cannot see this field, and
+     * without the mark the variables log emits the credential in plaintext.
+     */
+    @Field() @NoLog CredentialValues: string;
     @Field({ nullable: true }) ExternalSystemID?: string;
     @Field({ nullable: true }) Configuration?: string;
 }

package/src/resolvers/PotentialDuplicateRecordResolver.ts

@@ -8,7 +8,7 @@ import {
   PotentialDuplicateResult,
 } from '@memberjunction/core';
 import { AppContext } from '../types.js';
-import { UserCache } from '@memberjunction/sqlserver-dataprovider';
+import { UserCache } from '@memberjunction/generic-database-provider';
 
 import { CompositeKeyInputType, CompositeKeyOutputType, KeyValuePairOutputType } from '../generic/KeyInputOutputTypes.js';
 import { GetReadOnlyProvider } from '../util.js';

package/src/resolvers/RealtimeClientSessionResolver.ts

@@ -227,6 +227,18 @@ export class StartRealtimeClientSessionResult {
     @Field(() => String, { nullable: true })
     ModelName?: string;
 
+    /**
+     * `DriverClass` of the vendor that actually runs the session (e.g. `OpenAIRealtime`,
+     * `ElevenLabsRealtime`). Null when unknown.
+     *
+     * Surfaced to the BROWSER because on the default-model path the framework picks the vendor itself:
+     * without this the caller cannot tell which vendor spoke, and so cannot diagnose a voice that did
+     * not land (issue #3530). `ModelName` alone is not enough — one model can resolve to different
+     * vendors depending on which API keys a deployment configures.
+     */
+    @Field(() => String, { nullable: true })
+    DriverClass?: string;
+
     /**
      * DB-driven progress-narration instruction template (contains a `{{ progressMessage }}`
      * placeholder). Null when the narration prompt is not present in this deployment's metadata —
@@ -1677,6 +1689,7 @@ export class RealtimeClientSessionResolver extends ResolverBase {
             ExpiresAt: cfg.ExpiresAt,
             SessionConfigJson: JSON.stringify(cfg.SessionConfig),
             ModelName: prep.ModelName,
+            DriverClass: prep.DriverClass,
             NarrationInstructionsTemplate: prep.NarrationInstructionsTemplate,
             NarrationPaceMs: prep.NarrationPaceMs,
             EffectiveConfigJson: prep.EffectiveConfig ? JSON.stringify(prep.EffectiveConfig) : undefined,

package/src/resolvers/SearchEntitiesResolver.ts

@@ -1,7 +1,7 @@
 import { Arg, Ctx, Field, Float, InputType, Int, ObjectType, Query, Resolver } from 'type-graphql';
 import { EntitySearchResult, SearchEntityParams } from '@memberjunction/core';
 import { AppContext } from '../types.js';
-import { UserCache } from '@memberjunction/sqlserver-dataprovider';
+import { UserCache } from '@memberjunction/generic-database-provider';
 import { GetReadOnlyProvider } from '../util.js';
 
 /**

package/src/resolvers/SqlLoggingConfigResolver.ts

@@ -2,14 +2,13 @@ import { Arg, Ctx, Field, InputType, Mutation, ObjectType, Query, Int, Resolver
 import { AppContext } from '../types.js';
 import { Metadata, UserInfo } from '@memberjunction/core';
 import { SQLServerDataProvider } from '@memberjunction/sqlserver-dataprovider';
-import { UserCache } from '@memberjunction/sqlserver-dataprovider';
 import { v4 as uuidv4 } from 'uuid';
 import * as path from 'path';
 import * as fs from 'fs/promises';
 import { loadConfig } from '../config.js';
 import { ResolverBase } from '../generic/ResolverBase.js';
 import { GetReadOnlyProvider } from '../util.js';
-import { SqlLoggingOptions as ProviderSqlLoggingOptions } from '@memberjunction/generic-database-provider';
+import { UserCache, SqlLoggingOptions as ProviderSqlLoggingOptions } from '@memberjunction/generic-database-provider';
 
 /**
  * Configuration options for SQL logging sessions.

package/src/resolvers/SyncRolesUsersResolver.ts

@@ -4,7 +4,7 @@ import { DatabaseProviderBase, EntityDeleteOptions, EntitySaveOptions, IMetadata
 import { UUIDsEqual } from '@memberjunction/global';
 import { RequireSystemUser } from '../directives/RequireSystemUser.js';
 import { MJRoleEntity, MJUserEntity, MJUserRoleEntity } from '@memberjunction/core-entities';
-import { UserCache } from '@memberjunction/sqlserver-dataprovider';
+import { UserCache } from '@memberjunction/generic-database-provider';
 import { GetReadWriteProvider } from '../util.js';
 
 @ObjectType()
@@ -112,7 +112,7 @@ export class SyncRolesAndUsersResolver {
                 await provider.CommitTransaction();
 
                 // refresh the user cache — one-time, since the normal auto-refresh is already scheduled
-                await UserCache.Instance.Refresh(context.dataSource);
+                await UserCache.Instance.Refresh(provider);
                 return usersResult;
             } catch (txErr) {
                 await provider.RollbackTransaction();

package/src/resolvers/UserFavoriteResolver.ts

@@ -14,7 +14,7 @@ import {
   Query,
   Resolver,
 } from '@memberjunction/server';
-import { UserCache } from '@memberjunction/sqlserver-dataprovider';
+import { UserCache } from '@memberjunction/generic-database-provider';
 
 import { MJUserFavorite_, MJUserFavoriteResolverBase } from '../generated/generated.js';
 import { GetReadOnlyProvider } from '../util.js';

package/src/rest/OAuthCallbackHandler.ts

@@ -15,7 +15,7 @@
 import express from 'express';
 import { LogError, LogStatus, RunView, UserInfo } from '@memberjunction/core';
 import { UUIDsEqual } from '@memberjunction/global';
-import { UserCache } from '@memberjunction/sqlserver-dataprovider';
+import { UserCache } from '@memberjunction/generic-database-provider';
 import { OAuthManager, MCPClientManager } from '@memberjunction/ai-mcp-client';
 import type { MCPServerOAuthConfig } from '@memberjunction/ai-mcp-client';
 

package/src/rest/SignatureWebhookHandler.ts

@@ -14,7 +14,7 @@
 import express from 'express';
 import BodyParser from 'body-parser';
 import { LogError, LogStatus, UserInfo } from '@memberjunction/core';
-import { UserCache } from '@memberjunction/sqlserver-dataprovider';
+import { UserCache } from '@memberjunction/generic-database-provider';
 import { SignatureEngine } from '@memberjunction/esignature/server';
 
 /**

package/src/services/DurableEntityActionTaskSubmitter.ts

@@ -0,0 +1,78 @@
+/**
+ * @fileoverview MJServer's implementation of the `DurableEntityActionSubmitter` seam.
+ *
+ * Turns one After* entity-action dispatch into a single-node durable task graph, which is D14's
+ * whole answer to "run this durably": not a new queue, the substrate that already has a claim
+ * protocol, restart recovery and orphan reclaim.
+ *
+ * Registered at boot beside the dispatcher, because the two are one capability — a submitter with
+ * no dispatcher writes rows nobody picks up, which is worse than staying inline.
+ *
+ * @module @memberjunction/server
+ */
+import type {
+    DurableEntityActionRequest,
+    DurableEntityActionSubmission,
+    DurableEntityActionSubmitter,
+} from '@memberjunction/actions-base';
+import { LogError } from '@memberjunction/core';
+import { TaskNode, type TaskGraphSpec } from '@memberjunction/ai-core-plus';
+import { MJEnvironmentEntityExtended } from '@memberjunction/core-entities';
+import { TaskGraphService, type ProviderFactory } from '@memberjunction/task-graph';
+
+export class DurableEntityActionTaskSubmitter implements DurableEntityActionSubmitter {
+    /**
+     * @param environmentID which environment the tasks belong to. Defaults to the platform default
+     *   because a save has no environment of its own to inherit — the record's entity is global, and
+     *   inventing a per-save environment would put a durable dispatch somewhere nobody looks.
+     */
+    constructor(
+        private readonly providerFactory: ProviderFactory,
+        private readonly environmentID: string = MJEnvironmentEntityExtended.DefaultEnvironmentID,
+    ) {}
+
+    public async Submit(request: DurableEntityActionRequest): Promise<DurableEntityActionSubmission> {
+        try {
+            const spec: TaskGraphSpec = {
+                workflowName: `${request.ActionName} — ${request.EntityName}`,
+                reasoning:
+                    `Durable dispatch of entity action binding ${request.EntityActionID} on ` +
+                    `${request.EntityName} (${request.RecordID}), fired by ${request.InvocationType}.`,
+                tasks: [
+                    TaskNode.Action(
+                        {
+                            tempId: 'action',
+                            name: request.ActionName,
+                            description: `Run ${request.ActionName} for ${request.EntityName} ${request.RecordID}.`,
+                            dependsOn: [],
+                            inputPayload: request.RedactedParams,
+                        },
+                        { actionName: request.ActionName },
+                    ),
+                ],
+                // Nothing to say to anyone: this graph exists because a record was saved, not
+                // because a person asked a question. Defaulting to 'message' would post an
+                // orphaned result into whichever conversation happened to be nearby.
+                continuation: 'none',
+                // The point of the exercise. A one-node graph constant-folds to in-run execution by
+                // default (D9), which is exactly the fire-and-forget behaviour being escaped.
+                durable: true,
+            };
+
+            const provider = await this.providerFactory.CreateProvider();
+            const result = await new TaskGraphService().Submit(spec, {
+                EnvironmentID: this.environmentID,
+                ContextUser: request.ContextUser,
+                Provider: provider,
+            });
+
+            return result.Success
+                ? { Success: true, ParentTaskID: result.ParentTaskID }
+                : { Success: false, ErrorMessage: result.ErrorMessage };
+        } catch (e) {
+            const message = e instanceof Error ? e.message : String(e);
+            LogError(`[DurableEntityActionTaskSubmitter] Submission failed for binding ${request.EntityActionID}: ${message}`);
+            return { Success: false, ErrorMessage: message };
+        }
+    }
+}

package/src/services/ScheduledJobsService.ts

@@ -4,7 +4,7 @@
  */
 
 import { LogError, LogStatus, LogStatusEx, UserInfo } from '@memberjunction/core';
-import { UserCache } from '@memberjunction/sqlserver-dataprovider';
+import { UserCache } from '@memberjunction/generic-database-provider';
 import { SchedulingEngine } from '@memberjunction/scheduling-engine';
 import { ScheduledJobsConfig } from '../config.js';
 

package/src/services/StartTaskGraphDispatcher.ts

@@ -18,9 +18,13 @@
  */
 import { UserInfo } from '@memberjunction/core';
 import { LoadTaskGraphOperations, TaskGraphDispatcher } from '@memberjunction/task-graph';
+import { TaskGraphPromptRunner } from './TaskGraphPromptRunner.js';
 import sql from 'mssql';
+import { DurableEntityActionRegistry } from '@memberjunction/actions-base';
 import { CreateTaskGraphProviderFactory } from './TaskGraphProviderFactory.js';
+import { TaskGraphActionRunner } from './TaskGraphActionRunner.js';
 import { TaskGraphAgentRunner } from './TaskGraphAgentRunner.js';
+import { DurableEntityActionTaskSubmitter } from './DurableEntityActionTaskSubmitter.js';
 import { TaskGraphContinuationDeliverer } from './TaskGraphContinuationDeliverer.js';
 import { PubSubManager } from '../generic/PubSubManager.js';
 import { TaskGraphFrameBroadcaster } from '../resolvers/TaskGraphFrameResolver.js';
@@ -55,7 +59,20 @@ export async function StartTaskGraphDispatcher(
         // Live signal. Supplied only when a PubSub engine exists — in a worker or a test there is
         // nobody to publish to, and the dispatcher runs identically without one.
         pubSub ? new TaskGraphFrameBroadcaster(pubSub) : undefined,
+        // Action nodes — the third execution shape, beside agents and people. Durable After* entity
+        // actions land as these.
+        new TaskGraphActionRunner(),
+        // Prompt nodes. Without this a Flow agent with a Prompt step submits and then
+        // stalls on a task nothing can execute — which is why the shipped User Onboarding
+        // Flow Agent could not run at all before this seam existed.
+        new TaskGraphPromptRunner(),
     );
     await dispatcher.Start();
+
+    // Registered only AFTER the dispatcher is running, and only here. A submitter without a
+    // dispatcher writes Task rows nobody picks up — strictly worse than staying inline, because the
+    // work is now both undone and invisible in the place it used to be logged.
+    DurableEntityActionRegistry.Instance.Register(new DurableEntityActionTaskSubmitter(providerFactory));
+
     return dispatcher;
 }