@memberjunction/server 6.1.0-edge.2 → 6.1.0-edge.4

package/src/integration/InactiveRowWarnings.ts

@@ -0,0 +1,85 @@
+/**
+ * Apply-time warnings for DECLARED integration rows that an apply silently leaves out.
+ *
+ * An IntegrationObject / IntegrationObjectField is never deleted — a comprehensive rediscovery
+ * that does not observe a declared row sets it `Status='Disabled'` instead (reversible on a later
+ * discovery), and a schema-limit breach can do the same. The apply path then rebuilds its source
+ * schema from ACTIVE rows only, so those rows simply are not in the schema it materializes: the
+ * table appears without the column, or a requested object is not created at all, and nothing in
+ * the apply output says why.
+ *
+ * The decision is kept pure here — the resolver supplies the rows and surfaces the strings — so it
+ * is testable without standing up the resolver or the metadata provider, matching how
+ * `decideAbsentDeactivations` and `ComputeRemovedDependencyWarnings` are factored.
+ */
+
+/** A row reduced to what the warning needs: its name and its lifecycle status. */
+export type NamedStatusRow = { Name: string; Status: string | null };
+
+export type InactiveRowWarningInput = {
+    /**
+     * The object names this apply asked for, exactly as requested. `null`/empty means "everything
+     * active", in which case deactivated OBJECTS are not reported: a large catalog can legitimately
+     * carry hundreds of them and announcing those on every apply is noise, not signal. Requested
+     * objects are always reported, because the caller named them and got nothing.
+     */
+    RequestedNames?: string[] | null;
+    /** Every object on the integration, active or not. */
+    AllObjects: NamedStatusRow[];
+    /**
+     * Fields keyed by object name, for the objects this apply actually materializes. Only those
+     * objects need their fields: a non-materialized object's fields are reported by the object
+     * warning, not one line per field.
+     */
+    FieldsByObjectName: Record<string, NamedStatusRow[]>;
+};
+
+/**
+ * Renders a name list for an operator-facing warning: every name when the list is short, and a
+ * capped sample plus a count when it is not. Apply runs against catalogs with hundreds of objects,
+ * so an uncapped list turns a useful warning into a wall of text nobody reads.
+ */
+export function SummarizeNames(names: string[], max = 12): string {
+    if (names.length <= max) return names.join(', ');
+    return `${names.slice(0, max).join(', ')}, and ${names.length - max} more`;
+}
+
+const isActive = (row: NamedStatusRow): boolean => row.Status === 'Active';
+
+/**
+ * Builds the operator-facing warnings for declared rows this apply will not materialize.
+ * Returns an empty array when everything declared and in scope is Active.
+ */
+export function ComputeInactiveRowWarnings(input: InactiveRowWarningInput): string[] {
+    const warnings: string[] = [];
+    const requested = input.RequestedNames && input.RequestedNames.length > 0
+        ? new Set(input.RequestedNames.map(n => n.toLowerCase()))
+        : null;
+
+    if (requested) {
+        const inactiveRequested = input.AllObjects
+            .filter(o => requested.has(o.Name.toLowerCase()) && !isActive(o))
+            .map(o => `${o.Name} (${o.Status ?? 'no status'})`);
+        if (inactiveRequested.length > 0) {
+            warnings.push(
+                `${inactiveRequested.length} requested object(s) are not Active and were NOT materialized — ` +
+                `${SummarizeNames(inactiveRequested)}. An object is deactivated (never deleted) when an ` +
+                `authoritative rediscovery does not observe it, or when it exceeded a schema limit; re-run ` +
+                `discovery against a source that exposes it, or re-enable it on MJ: Integration Objects.`,
+            );
+        }
+    }
+
+    for (const [objectName, fields] of Object.entries(input.FieldsByObjectName)) {
+        const dropped = fields.filter(f => !isActive(f)).map(f => `${f.Name} (${f.Status ?? 'no status'})`);
+        if (dropped.length === 0) continue;
+        warnings.push(
+            `${objectName}: ${dropped.length} declared field(s) are not Active and were NOT materialized — ` +
+            `${SummarizeNames(dropped)}. A field is deactivated (never deleted) when an authoritative ` +
+            `rediscovery does not observe it; re-run discovery against a source that exposes it, or re-enable ` +
+            `it on MJ: Integration Object Fields.`,
+        );
+    }
+
+    return warnings;
+}

package/src/integration/RSUProgressBridge.ts

@@ -0,0 +1,248 @@
+/**
+ * @fileoverview Bridges RSU pipeline lifecycle events onto the integration progress artifact
+ * stream, so a Runtime Schema Update is observable the same way a sync or a connector build is.
+ *
+ * The gap this closes: `IntegrationRunKind` has always included `'RSU'` and
+ * `RUN_KIND_TO_TOPIC` has always mapped it to an `'RSU'` subscription channel — but nothing in
+ * production ever constructed an emitter with that kind, so the channel carried no traffic and
+ * `IntegrationTailRunEvents` had no RSU runs to tail. The only live signal was polling
+ * `RuntimeSchemaUpdateStatus`, which reports the CURRENT step and nothing else: no history, no
+ * durable record, and nothing at all to read after a mid-run API restart — which the RSU pipeline
+ * does to itself, by design, as one of its own steps.
+ *
+ * Layering: `@memberjunction/schema-engine` must not depend on the progress artifacts package, so
+ * it publishes plain {@link RSUObserverEvent}s and this module — one layer up, where both are
+ * already dependencies — owns the emitter lifecycle.
+ */
+import { IntegrationProgressEmitter } from '@memberjunction/integration-progress-artifacts';
+import type { EmitterOptions } from '@memberjunction/integration-progress-artifacts';
+import { RuntimeSchemaManager } from '@memberjunction/schema-engine';
+import type { RSUObserverEvent } from '@memberjunction/schema-engine';
+import { LogError } from '@memberjunction/core';
+import { BaseSingleton } from '@memberjunction/global';
+
+/** The emitter stage name used for run-level (non-step) events. */
+const RUN_STAGE = 'RSUPipeline';
+
+/**
+ * How often an in-flight step reports that it is still alive.
+ *
+ * RSU's expensive steps — CodeGen, TypeScript compile, npm install — run for minutes with no
+ * intermediate observer event, so without this the stream goes silent for the entire step and a
+ * watcher cannot tell "compiling" from "hung". 30s matches the interval the agent notification
+ * conventions ask for on long phases.
+ */
+const HEARTBEAT_INTERVAL_MS = 30_000;
+
+/**
+ * Owns one emitter per RSU pipeline run and translates observer events into progress events.
+ *
+ * A {@link BaseSingleton} because the state here is inherently process-wide AND has to be readable
+ * from elsewhere. `RuntimeSchemaManager` is itself a singleton and serializes its runs behind the
+ * pipeline lock, so at most one RSU run is ever in flight and one current-emitter slot is sufficient
+ * — but the reason for the singleton is {@link CurrentRunID}: a resolver that has just triggered an
+ * RSU needs to hand its client a run to tail, and it can only do that if it can reach this instance.
+ * Constructing the bridge and keeping the only reference inside the observer closure made that
+ * accessor unreachable from any caller.
+ *
+ * NOT a `BaseEngine`: there is no metadata to load and nothing to `Config()`. The distinction is
+ * "single shared instance" (this) versus "cached metadata with a load lifecycle" (that).
+ */
+export class RSUProgressBridge extends BaseSingleton<RSUProgressBridge> {
+    private emitter: IntegrationProgressEmitter | null = null;
+    private currentRunID: string | null = null;
+    /** Liveness timer for the step currently in flight — see {@link HEARTBEAT_INTERVAL_MS}. */
+    private heartbeat: ReturnType<typeof setInterval> | null = null;
+    private emitterOptions: EmitterOptions = {};
+
+    /** The one bridge for this process. */
+    public static get Instance(): RSUProgressBridge {
+        return super.getInstance<RSUProgressBridge>();
+    }
+
+    /**
+     * Options passed through to each run's emitter. Set once, before the first run.
+     *
+     * The only field that matters in practice is `rootDir` — left unset in production so RSU runs
+     * land in the same `logs/integration-runs/` tree as every other run kind and
+     * `IntegrationTailRunEvents` finds them without configuration. Tests point it at a temp dir.
+     *
+     * A settable property rather than a constructor argument because `BaseSingleton.getInstance`
+     * requires a zero-argument constructor.
+     */
+    public Configure(emitterOptions: EmitterOptions): void {
+        this.emitterOptions = emitterOptions;
+    }
+
+    /**
+     * The run ID of the in-flight RSU run, or null when idle. Lets a caller that triggered an RSU
+     * hand a client something to tail via `IntegrationTailRunEvents` / the `RSU` subscription
+     * channel.
+     */
+    public get CurrentRunID(): string | null {
+        return this.currentRunID;
+    }
+
+    /**
+     * Abandons any in-flight run state and stops its heartbeat, without emitting a terminal event.
+     *
+     * Needed because singleton state outlives a single caller: a test (or a server tearing down)
+     * must be able to return the bridge to idle without the next run inheriting a stale emitter or
+     * leaking an interval that keeps the process alive.
+     */
+    public Reset(): void {
+        this.stopHeartbeat();
+        this.emitter = null;
+        this.currentRunID = null;
+    }
+
+    /** The observer to hand to {@link RuntimeSchemaManager.PipelineObserver}. */
+    public readonly Observe = (event: RSUObserverEvent): void => {
+        switch (event.Kind) {
+            case 'run.start':
+                return this.onRunStart(event);
+            case 'step.start':
+                return this.onStepStart(event);
+            case 'step.end':
+                return this.onStepEnd(event);
+            case 'run.end':
+                return this.onRunEnd(event);
+        }
+    };
+
+    private onRunStart(event: Extract<RSUObserverEvent, { Kind: 'run.start' }>): void {
+        // A retry re-enters RunPipelineBatch, so it legitimately starts a NEW run. If a previous
+        // emitter is still open (a throw escaped before run.end), close it rather than leak it.
+        if (this.emitter) this.closeCurrent('Superseded by a new RSU run');
+
+        const runID = IntegrationProgressEmitter.newRunID('rsu');
+        this.currentRunID = runID;
+        this.emitter = new IntegrationProgressEmitter(
+            {
+                runID,
+                runKind: 'RSU',
+                triggerType: 'Pipeline',
+                startedAt: new Date().toISOString(),
+                context: {
+                    itemCount: event.ItemCount,
+                    descriptions: event.Descriptions,
+                    affectedTables: event.AffectedTables,
+                    stepTotal: event.StepTotal,
+                },
+            },
+            this.emitterOptions,
+        );
+        this.emitter.runStart(
+            `RSU pipeline started — ${event.ItemCount} migration(s), ${event.StepTotal} expected step(s): ` +
+            event.Descriptions.join('; ')
+        );
+    }
+
+    private onStepStart(event: Extract<RSUObserverEvent, { Kind: 'step.start' }>): void {
+        if (!this.emitter) return;
+        this.emitter.stageStart(event.Name, this.positionLabel(event.StepIndex, event.StepTotal));
+        this.startHeartbeat(event.Name);
+    }
+
+    private onStepEnd(event: Extract<RSUObserverEvent, { Kind: 'step.end' }>): void {
+        this.stopHeartbeat();
+        if (!this.emitter) return;
+        // A failed step is a stage error, not a stage completion — the run may still continue (a
+        // per-item migration failure does not abort the batch), so this is deliberately not fatal.
+        if (event.Status === 'failed') {
+            this.emitter.stageError(event.Name, event.Message, { durationMs: event.DurationMs, code: 'RSU_STEP_FAILED' });
+            return;
+        }
+        // Deliberately no `counts` here. Counts roll up into the run aggregate, and the countable
+        // unit of an RSU run is MIGRATIONS, not steps — reporting "processed: 12" for a 12-step
+        // single-migration run would read as 12 migrations. The run-level quartet is emitted once,
+        // in onRunEnd. Step position lives in the stage name + the step.start message.
+        this.emitter.stageComplete(event.Name);
+    }
+
+    private onRunEnd(event: Extract<RSUObserverEvent, { Kind: 'run.end' }>): void {
+        this.stopHeartbeat();
+        const emitter = this.emitter;
+        if (!emitter) return;
+        this.emitter = null;
+        this.currentRunID = null;
+        const summary = `${event.SuccessCount}/${event.TotalCount} migration(s) succeeded`;
+        // The one authoritative applied quartet for the run, in migrations — this is what feeds
+        // the reader's aggregateCounts.
+        emitter.stageComplete(RUN_STAGE, {
+            processed: event.TotalCount,
+            succeeded: event.SuccessCount,
+            failed: event.FailureCount,
+            totalKnown: event.TotalCount,
+        });
+        // Terminal writes are async (they flush the JSONL + write result.json). The observer
+        // contract is synchronous, so this is intentionally fire-and-forget with a logged catch —
+        // a progress-artifact write must never surface as a pipeline failure.
+        const terminal = event.Success
+            ? emitter.complete(`RSU pipeline complete — ${summary}`)
+            : emitter.fail(
+                `RSU pipeline failed at '${event.ErrorStep ?? 'unknown step'}' — ${summary}: ` +
+                `${event.ErrorMessage ?? 'no error message'}`,
+                'rsu-pipeline-failed'
+            );
+        void terminal.catch(err => LogError(`RSUProgressBridge: terminal write failed — ${err}`));
+    }
+
+    /**
+     * Starts reporting liveness for the step that just opened. Any previous timer is cleared first,
+     * so a missed `step.end` can never leave two timers running.
+     */
+    private startHeartbeat(stage: string): void {
+        this.stopHeartbeat();
+        const startedAt = Date.now();
+        this.heartbeat = setInterval(() => {
+            const elapsedSec = Math.round((Date.now() - startedAt) / 1000);
+            this.emitter?.heartbeat(stage, `${stage} still running — ${elapsedSec}s elapsed`);
+        }, HEARTBEAT_INTERVAL_MS);
+        // Never hold the process open on a progress timer.
+        this.heartbeat.unref?.();
+    }
+
+    /** Stops the liveness timer. Safe to call when none is running. */
+    private stopHeartbeat(): void {
+        if (!this.heartbeat) return;
+        clearInterval(this.heartbeat);
+        this.heartbeat = null;
+    }
+
+    /** Closes an orphaned emitter so a leaked run does not stay in-flight forever. */
+    private closeCurrent(reason: string): void {
+        this.stopHeartbeat();
+        const emitter = this.emitter;
+        this.emitter = null;
+        this.currentRunID = null;
+        void emitter?.fail(reason, 'rsu-run-abandoned')
+            .catch(err => LogError(`RSUProgressBridge: abandon write failed — ${err}`));
+    }
+
+    /**
+     * "step 4 of 12" — omitted entirely when the determinate counter isn't armed.
+     *
+     * Explicit null/undefined checks rather than truthiness: a 0 index is falsy, and silently
+     * dropping the label for the first step of a 0-based counter would be a bug that only appears
+     * if the pipeline's numbering ever changes.
+     */
+    private positionLabel(stepIndex?: number, stepTotal?: number): string | undefined {
+        if (stepIndex == null || stepTotal == null) return undefined;
+        return `step ${stepIndex} of ${stepTotal}`;
+    }
+}
+
+/**
+ * Attaches a fresh {@link RSUProgressBridge} to the RuntimeSchemaManager singleton. Call once at
+ * server startup, after the progress publish hook is registered so the very first RSU event also
+ * reaches live subscribers.
+ *
+ * @returns the bridge, so callers can read {@link RSUProgressBridge.CurrentRunID}.
+ */
+export function RegisterRSUProgressBridge(emitterOptions: EmitterOptions = {}): RSUProgressBridge {
+    const bridge = RSUProgressBridge.Instance;
+    bridge.Configure(emitterOptions);
+    RuntimeSchemaManager.Instance.PipelineObserver = bridge.Observe;
+    return bridge;
+}

package/src/integration/SchemaRefreshLaunch.ts

@@ -0,0 +1,93 @@
+/**
+ * @fileoverview Pure reporting helpers for the connector schema-refresh pipeline launch.
+ *
+ * The refresh is a live vendor introspect and can run for minutes on a large catalog, so
+ * IntegrationCreateConnection / IntegrationUpdateConnection can launch it *detached* and hand the
+ * caller a tailable run ID instead of blocking. That split creates one easy-to-get-wrong reporting
+ * case: a detached summary's counts are placeholder zeros, and describing them as results ("0
+ * created, 0 updated") reads to an operator as "the refresh found nothing" — the opposite of "the
+ * refresh has not finished yet". This module owns that decision so it can be pinned by a test
+ * without standing up a resolver.
+ */
+
+/**
+ * The subset of the pipeline summary that message construction reads. Structural so both the
+ * GraphQL `@ObjectType` and a test fixture satisfy it without either depending on the other.
+ */
+export interface SchemaRefreshSummaryLike {
+    /** Tailable run ID — the only meaningful field while `InProgress` is true. */
+    RunID: string;
+    /** True ⇒ launched detached and still running; every count below is a placeholder zero. */
+    InProgress: boolean;
+    /**
+     * Whether the pipeline itself succeeded. A pipeline that fails at ConnectionTest RETURNS rather
+     * than throwing, with every count at zero — so counts alone read identically to a clean
+     * no-op refresh. Reporting that as "0 created, 0 updated" tells an operator the vendor had
+     * nothing new when in fact the credentials were never accepted.
+     */
+    Succeeded: boolean;
+    /** The pipeline's own failure reason, when `Succeeded` is false. */
+    FailureMessage?: string;
+    ObjectsCreated: number;
+    ObjectsUpdated: number;
+    UnresolvedObjects: string[];
+}
+
+/** The counts clause, or an explicit failure clause when the pipeline did not succeed. */
+function describeFinishedRefresh(summary: SchemaRefreshSummaryLike): string {
+    if (!summary.Succeeded) {
+        return `schema refresh FAILED (${summary.FailureMessage ?? 'no reason reported'}) — see run ${summary.RunID}`;
+    }
+    return `schema refresh: ${summary.ObjectsCreated} created, ` +
+        `${summary.ObjectsUpdated} updated, ${summary.UnresolvedObjects.length} PK-unresolved`;
+}
+
+/**
+ * Builds the human-facing `Message` for IntegrationCreateConnection.
+ *
+ * @param testConnection whether the caller asked for (and got) a live connection test
+ * @param summary the refresh summary, or undefined when no refresh was requested
+ */
+export function BuildCreateConnectionMessage(
+    testConnection: boolean,
+    summary: SchemaRefreshSummaryLike | undefined
+): string {
+    if (!summary) return 'Connection created and test passed';
+    const created = `Connection created${testConnection ? ', test passed' : ''}`;
+    // Never report a detached run's placeholder counts as findings — point at the run stream instead.
+    if (summary.InProgress) return `${created}, schema refresh running — tail run ${summary.RunID}`;
+    return `${created}, ${describeFinishedRefresh(summary)}`;
+}
+
+/**
+ * Builds the human-facing `Message` for IntegrationUpdateConnection's blocking-refresh path.
+ * Shares {@link describeFinishedRefresh} with create so a failed refresh can never be reported as
+ * a clean zero-count run on one path and honestly on the other.
+ */
+export function BuildUpdateConnectionMessage(summary: SchemaRefreshSummaryLike): string {
+    return `Updated, ${describeFinishedRefresh(summary)}`;
+}
+
+/**
+ * Builds the human-facing `Message` for IntegrationUpdateConnection's detached-refresh path.
+ * Separate from {@link BuildCreateConnectionMessage} because update has no connection-test clause.
+ */
+export function BuildDetachedRefreshMessage(runID: string): string {
+    return `Updated, schema refresh running — tail run ${runID}`;
+}
+
+/**
+ * Builds the human-facing `Message` for IntegrationReactivateConnection.
+ *
+ * Reactivation is committed before any refresh starts, so every message here begins by saying so.
+ * That ordering is the whole point: whatever the refresh does or fails to do afterwards, the
+ * connection IS active, and the operator must not read a refresh problem as "resume didn't work".
+ *
+ * @param summary the refresh summary, or undefined when no refresh was requested
+ */
+export function BuildReactivateMessage(summary: SchemaRefreshSummaryLike | undefined): string {
+    if (!summary) return 'Reactivated';
+    // Never report a detached run's placeholder counts as findings — point at the run stream instead.
+    if (summary.InProgress) return `Reactivated, schema refresh running — tail run ${summary.RunID}`;
+    return `Reactivated, ${describeFinishedRefresh(summary)}`;
+}

package/src/providerConfigUnits.ts

@@ -0,0 +1,21 @@
+/**
+ * Unit-conversion seam between MJServer's configuration and SQLServerDataProvider.
+ *
+ * MJServer configures `databaseSettings.metadataCacheRefreshInterval` in **milliseconds**
+ * (default 180000 = 3 minutes, overridable via the METADATA_CACHE_REFRESH_INTERVAL env var).
+ * `SQLServerProviderConfigData`'s third constructor parameter is `checkRefreshIntervalSeconds`
+ * — declared in **seconds**.
+ *
+ * Commit 645c5a5e8 fixed a bug where the raw millisecond value was handed straight to the
+ * provider, so the "3 minute" default became a 180000-second (~50 hour) metadata cache
+ * refresh cadence. This function is the single place that conversion happens; both provider
+ * bootstrap call sites in `index.ts` (the main pool and the CodeGen-credentialed pool) go
+ * through it, and `config-units.test.ts` pins the contract so the units can never silently
+ * regress again.
+ *
+ * @param metadataCacheRefreshIntervalMs - the configured refresh interval, in milliseconds
+ * @returns the same interval expressed in seconds, the unit `checkRefreshIntervalSeconds` declares
+ */
+export function MetadataCacheRefreshIntervalSeconds(metadataCacheRefreshIntervalMs: number): number {
+    return metadataCacheRefreshIntervalMs / 1000;
+}

package/src/resolvers/AdhocQueryResolver.ts

@@ -5,6 +5,7 @@ import { RenderPipeline } from '@memberjunction/generic-database-provider';
 import { AppContext } from '../types.js';
 import { GetReadOnlyDataSource, GetReadOnlyProvider } from '../util.js';
 import { ResolverBase } from '../generic/ResolverBase.js';
+import { IsScopeLimitedPrincipal } from '../auth/scopeLimitedPrincipal.js';
 import { RunQueryResultType } from './QueryResolver.js';
 import { exactTotalFromPage, resolveAdhocTotalRowCount } from './adhoc-query-helpers.js';
 import sql from 'mssql';
@@ -36,6 +37,10 @@ class AdhocQueryInput {
  * - Executes on read-only connection pool only (no fallback to read-write)
  * - Configurable timeout (default 30s)
  * - Requires authenticated user (standard GraphQL auth, no @RequireSystemUser)
+ * - Refuses scope-limited principals (see {@link IsScopeLimitedPrincipal}). Raw SQL bypasses
+ *   RunView, entity permissions and row-level security, so the RLS scope tokens that confine a
+ *   magic-link session are never applied on this path — there is no narrower filter to fall back
+ *   to, only refusal.
  *
  * Auto-discovered by MJServer's dynamic resolver import.
  */
@@ -49,14 +54,24 @@ export class AdhocQueryResolver extends ResolverBase {
         const startTime = Date.now();
 
         try {
-            // 1. Security: validate SQL using SQLExpressionValidator
+            // 1. SECURITY: refuse principals whose read authority is narrower than their role
+            // grant. This resolver runs a raw SELECT on the read-only pool — it does NOT go
+            // through RunView, entity permissions or row-level security, so the RLS scope tokens
+            // that confine a magic-link session are never substituted here. There is no filter
+            // to narrow, so the only correct answer for such a principal is no. Checked before
+            // the SQL is even validated: authorization gates the work, it does not race it.
+            if (IsScopeLimitedPrincipal(context.userPayload?.userRecord)) {
+                return this.buildErrorResult('Ad-hoc SQL execution is not permitted for scope-limited sessions.');
+            }
+
+            // 2. Security: validate SQL using SQLExpressionValidator
             const validator = SQLExpressionValidator.Instance;
             const validation = validator.validateFullQuery(input.SQL);
             if (!validation.valid) {
                 return this.buildErrorResult(validation.error || 'SQL validation failed');
             }
 
-            // 2. Get READ-ONLY data source (no fallback to read-write)
+            // 3. Get READ-ONLY data source (no fallback to read-write)
             let readOnlyDS: sql.ConnectionPool;
             try {
                 readOnlyDS = GetReadOnlyDataSource(context.dataSources, { allowFallbackToReadWrite: false });
@@ -64,7 +79,7 @@ export class AdhocQueryResolver extends ResolverBase {
                 return this.buildErrorResult('No read-only data source available for ad-hoc query execution');
             }
 
-            // 3. Resolve platform from the read-only provider for the render pipeline.
+            // 4. Resolve platform from the read-only provider for the render pipeline.
             let platform: DatabasePlatform = 'sqlserver';
             try {
                 const provider = GetReadOnlyProvider(context.providers, { allowFallbackToReadWrite: false });
@@ -74,7 +89,7 @@ export class AdhocQueryResolver extends ResolverBase {
             }
             const contextUser = context.userPayload?.userRecord;
 
-            // 4. Route the SQL through RenderPipeline so composition tokens
+            // 5. Route the SQL through RenderPipeline so composition tokens
             // resolve, comments and templates are processed, and the row cap
             // is applied at the database (via TOP / LIMIT / OFFSET-FETCH).
             //
@@ -106,7 +121,7 @@ export class AdhocQueryResolver extends ResolverBase {
                 return this.buildErrorResult(`Ad-hoc query rendering failed: ${renderMsg}`);
             }
 
-            // 5. Execute the page (and, only when a full page needs it, the count) under
+            // 6. Execute the page (and, only when a full page needs it, the count) under
             // a shared wall-clock deadline derived from the request's timeout budget.
             const deadline = startTime + (input.TimeoutSeconds ?? 30) * 1000;
             const { recordset, totalRowCount } = await this.executeDataAndCount(
@@ -114,7 +129,7 @@ export class AdhocQueryResolver extends ResolverBase {
             );
             const executionTimeMs = Date.now() - startTime;
 
-            // 6. Return as RunQueryResultType
+            // 7. Return as RunQueryResultType
             return {
                 QueryID: '',
                 QueryName: 'Ad-Hoc Query',