@memberjunction/server 6.2.0-edge.0 → 6.2.0-edge.2

package/src/__tests__/PrimaryKeyAlwaysMapped.test.ts

@@ -1,5 +1,5 @@
 import { describe, it, expect } from 'vitest';
-import { selectFieldsToMap } from '../integration/EntityMapLifecycle.js';
+import { SelectFieldsToMap } from '../integration/EntityMapLifecycle.js';
 
 /**
  * Deselecting the primary key must not cost the object its identity.
@@ -18,41 +18,41 @@ const names = (out: Array<{ Name: string }>) => out.map(x => x.Name);
 
 describe('selectFieldsToMap — the primary key is never optional', () => {
     it('includes the key even when the user did not select it', () => {
-        expect(names(selectFieldsToMap(ALL, ['name', 'email']))).toEqual(['id', 'name', 'email']);
+        expect(names(SelectFieldsToMap(ALL, ['name', 'email']))).toEqual(['id', 'name', 'email']);
     });
 
     it('includes the key when the selection is EMPTY — an empty choice is still a choice', () => {
         // Distinct from "no selection". An empty array is unusual but real, and it still cannot
         // produce a keyless map.
-        expect(names(selectFieldsToMap(ALL, []))).toEqual(['id']);
+        expect(names(SelectFieldsToMap(ALL, []))).toEqual(['id']);
     });
 
     it('does not duplicate the key when it IS selected', () => {
-        expect(names(selectFieldsToMap(ALL, ['id', 'name']))).toEqual(['id', 'name']);
+        expect(names(SelectFieldsToMap(ALL, ['id', 'name']))).toEqual(['id', 'name']);
     });
 
     it('null or undefined selection means every field', () => {
-        expect(names(selectFieldsToMap(ALL, null))).toEqual(['id', 'name', 'email', 'notes']);
-        expect(names(selectFieldsToMap(ALL, undefined))).toEqual(['id', 'name', 'email', 'notes']);
+        expect(names(SelectFieldsToMap(ALL, null))).toEqual(['id', 'name', 'email', 'notes']);
+        expect(names(SelectFieldsToMap(ALL, undefined))).toEqual(['id', 'name', 'email', 'notes']);
     });
 
     it('keeps every part of a COMPOSITE key, selected or not', () => {
         const composite = [f('tenant_id', true), f('row_id', true), f('label')];
-        expect(names(selectFieldsToMap(composite, ['label']))).toEqual(['tenant_id', 'row_id', 'label']);
+        expect(names(SelectFieldsToMap(composite, ['label']))).toEqual(['tenant_id', 'row_id', 'label']);
     });
 
     it('matches selection names case-insensitively', () => {
-        expect(names(selectFieldsToMap(ALL, ['NAME', 'Email']))).toEqual(['id', 'name', 'email']);
+        expect(names(SelectFieldsToMap(ALL, ['NAME', 'Email']))).toEqual(['id', 'name', 'email']);
     });
 
     it('preserves the discovered field order', () => {
         // Field-map creation walks this list; reordering would reshuffle Priority-adjacent behaviour
         // for no reason.
-        expect(names(selectFieldsToMap(ALL, ['notes', 'name']))).toEqual(['id', 'name', 'notes']);
+        expect(names(SelectFieldsToMap(ALL, ['notes', 'name']))).toEqual(['id', 'name', 'notes']);
     });
 
     it('an object with no key at all is unaffected', () => {
         const keyless = [f('a'), f('b')];
-        expect(names(selectFieldsToMap(keyless, ['a']))).toEqual(['a']);
+        expect(names(SelectFieldsToMap(keyless, ['a']))).toEqual(['a']);
     });
 });

package/src/__tests__/RESTEndpointHandler.test.ts

@@ -188,26 +188,26 @@ describe('RESTEndpointHandler.isEntityAllowed', () => {
     });
 
     it('blocks entities in excluded schemas (case-insensitive), with schema exclusion taking top precedence', () => {
-        const schemaOnly = makeHandler({ excludeSchemas: ['VAULT'] });
+        const schemaOnly = makeHandler({ ExcludeSchemas: ['VAULT'] });
         expect(schemaOnly.isEntityAllowed('Secrets')).toBe(false);
         expect(schemaOnly.isEntityAllowed('Users')).toBe(true); // other schemas unaffected
 
         // Even an explicit entity include cannot override a schema exclusion
-        const withInclude = makeHandler({ excludeSchemas: ['vault'], includeEntities: ['secrets'] });
+        const withInclude = makeHandler({ ExcludeSchemas: ['vault'], IncludeEntities: ['secrets'] });
         expect(withInclude.isEntityAllowed('Secrets')).toBe(false);
     });
 
     it('restricts to included schemas when includeSchemas is set', () => {
-        const handler = makeHandler({ includeSchemas: ['crm'] });
+        const handler = makeHandler({ IncludeSchemas: ['crm'] });
         expect(handler.isEntityAllowed('Users')).toBe(true);
         expect(handler.isEntityAllowed('Secrets')).toBe(false);
     });
 
     it('blocks lowercase exact-name exclusions and wildcard exclusions of any case', () => {
-        const lowercase = makeHandler({ excludeEntities: ['secrets'] });
+        const lowercase = makeHandler({ ExcludeEntities: ['secrets'] });
         expect(lowercase.isEntityAllowed('Secrets')).toBe(false);
 
-        const wildcard = makeHandler({ excludeEntities: ['Secret*'] });
+        const wildcard = makeHandler({ ExcludeEntities: ['Secret*'] });
         expect(wildcard.isEntityAllowed('Secrets')).toBe(false);
         expect(wildcard.isEntityAllowed('Users')).toBe(true);
     });
@@ -217,25 +217,25 @@ describe('RESTEndpointHandler.isEntityAllowed', () => {
         // the RAW configured pattern (only the wildcard branch lowercases patterns).
         // An operator writing excludeEntities: ['Secrets'] — the natural casing —
         // gets NO exclusion. Pinned so a normalization fix flips this test.
-        const handler = makeHandler({ excludeEntities: ['Secrets'] });
+        const handler = makeHandler({ ExcludeEntities: ['Secrets'] });
         expect(handler.isEntityAllowed('Secrets')).toBe(true); // exclusion ineffective!
     });
 
     it('exclusions override inclusions for the same entity', () => {
-        const handler = makeHandler({ includeEntities: ['user*'], excludeEntities: ['userroles'] });
+        const handler = makeHandler({ IncludeEntities: ['user*'], ExcludeEntities: ['userroles'] });
         expect(handler.isEntityAllowed('Users')).toBe(true);
         expect(handler.isEntityAllowed('UserRoles')).toBe(false);
     });
 
     it('an include list denies everything not on it, with wildcard support', () => {
-        const handler = makeHandler({ includeEntities: ['user*'] });
+        const handler = makeHandler({ IncludeEntities: ['user*'] });
         expect(handler.isEntityAllowed('Users')).toBe(true);
         expect(handler.isEntityAllowed('UserRoles')).toBe(true);
         expect(handler.isEntityAllowed('Secrets')).toBe(false);
     });
 
     it('SECURITY GAP: a mixed-case exact inclusion fails to include (same raw-pattern comparison)', () => {
-        const handler = makeHandler({ includeEntities: ['Users'] });
+        const handler = makeHandler({ IncludeEntities: ['Users'] });
         expect(handler.isEntityAllowed('Users')).toBe(false); // include list active, but never matches
     });
 });
@@ -271,7 +271,7 @@ describe('RESTEndpointHandler middleware', () => {
 
     describe('checkEntityAccess', () => {
         it('rejects blocked entities with 403 before any handler runs', () => {
-            const handler = makeHandler({ excludeEntities: ['secrets'] });
+            const handler = makeHandler({ ExcludeEntities: ['secrets'] });
             const req = makeReq({ params: { entityName: 'Secrets' } });
             const { res, statusCode, jsonBody } = makeRes();
             const next = vi.fn();
@@ -286,7 +286,7 @@ describe('RESTEndpointHandler middleware', () => {
         });
 
         it('passes allowed entities through', () => {
-            const handler = makeHandler({ excludeEntities: ['secrets'] });
+            const handler = makeHandler({ ExcludeEntities: ['secrets'] });
             const next = vi.fn();
 
             handler.checkEntityAccess(makeReq({ params: { entityName: 'Users' } }), makeRes().res, next);
@@ -295,7 +295,7 @@ describe('RESTEndpointHandler middleware', () => {
         });
 
         it('passes through when no entityName param is present', () => {
-            const handler = makeHandler({ includeEntities: ['nothing'] });
+            const handler = makeHandler({ IncludeEntities: ['nothing'] });
             const next = vi.fn();
 
             handler.checkEntityAccess(makeReq({ params: {} }), makeRes().res, next);
@@ -565,7 +565,7 @@ describe('RESTEndpointHandler view routes', () => {
         });
 
         it('returns 403 WITHOUT invoking the view layer when every requested entity is blocked', async () => {
-            const handler = makeHandler({ includeEntities: ['users'] });
+            const handler = makeHandler({ IncludeEntities: ['users'] });
             const { res, statusCode } = makeRes();
 
             await handler.runViews(
@@ -579,7 +579,7 @@ describe('RESTEndpointHandler view routes', () => {
 
         it('silently drops blocked entities and executes only the allowed remainder', async () => {
             mockOpsRunViews.mockResolvedValue({ success: true, results: [{ Success: true, Results: [] }] });
-            const handler = makeHandler({ excludeEntities: ['secrets'] });
+            const handler = makeHandler({ ExcludeEntities: ['secrets'] });
             const req = makeReq({ body: { params: [{ EntityName: 'Users' }, { EntityName: 'Secrets' }] } });
             const { res, jsonBody } = makeRes();
 

package/src/__tests__/RealtimeBridgeResolver.test.ts

@@ -50,8 +50,10 @@ vi.mock('@memberjunction/ai-agents', () => ({
 // Mock the meeting-recording registration so the thin resolver is tested in isolation (no MJStorage /
 // core-entities graph). Its own behavior is covered by meetingRecordingRegistration.test.ts.
 vi.mock('../resolvers/meetingRecordingRegistration', () => ({
-  registerMeetingRecordingFile: vi.fn(async () => ({ Success: true, RecordingFileID: 'file-1', ConversationID: 'conv-1' })),
-  correlateRecordingStart: vi.fn(async () => true),
+  RegisterMeetingRecordingFile: vi.fn(async () => ({ Success: true, RecordingFileID: 'file-1', ConversationID: 'conv-1' })),
+    get registerMeetingRecordingFile() { return this.RegisterMeetingRecordingFile; },
+  CorrelateRecordingStart: vi.fn(async () => true),
+    get correlateRecordingStart() { return this.CorrelateRecordingStart; },
 }));
 
 import { RealtimeBridgeResolver, MintLiveKitClientTokenInput, LiveKitRecordingInput } from '../resolvers/RealtimeBridgeResolver';

package/src/__tests__/RealtimeClientSessionResolver.test.ts

@@ -3,7 +3,7 @@
 // bring it in automatically — this line MUST precede any import that pulls in the resolver file.
 import 'reflect-metadata';
 
-import { describe, it, expect, vi, beforeEach } from 'vitest';
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
 
 // --- Mock CanRun authorization (AIAgentPermissionHelper.HasPermission) plus the
 //     provider-scoped AIEngineBase whose cached metadata serves the resolver's pairing-row
@@ -210,9 +210,23 @@ interface FakeSession {
     NewRecord: () => void;
     Save: () => Promise<boolean>;
     Load: (id: string) => Promise<boolean>;
-    LatestResult?: { CompleteMessage?: string };
+    LatestResult?: { CompleteMessage?: string; Success?: boolean };
+    /** Only set on the fakes exercising `describeSaveFailure`'s "no failure detail recorded" branches. */
+    ResultHistory?: unknown[];
 }
 
+/**
+ * A `console.error` spy shared by the save-failure-log tests (#4791) below. Assigned with
+ * `vi.spyOn(console, 'error').mockImplementation(() => undefined)` inside each test that needs it
+ * — restored here so no test leaks a mocked `console.error` into the ones after it.
+ */
+let errSpy: ReturnType<typeof vi.spyOn> | undefined;
+
+afterEach(() => {
+    errSpy?.mockRestore();
+    errSpy = undefined;
+});
+
 function makeSessionEntity(overrides: Partial<FakeSession> = {}): FakeSession {
     return {
         ID: 'session-1',
@@ -848,6 +862,28 @@ describe('RealtimeClientSessionResolver.ExecuteRealtimeSessionTool', () => {
             resolver.ExecuteRealtimeSessionTool('session-1', 'call-1', 'x', '{}', makeCtx(), makePubSub()),
         ).rejects.toThrow(/no target agent configured/i);
     });
+
+    it('logs the session id and "no failure detail recorded" when updatePendingFeedbackRunID\'s save is refused silently (#4791)', async () => {
+        errSpy = vi.spyOn(console, 'error').mockImplementation(() => undefined);
+        const session = makeSessionEntity({
+            Config_: JSON.stringify({ targetAgentID: 'target-1' }),
+            Save: vi.fn(async () => false),
+            LatestResult: undefined,
+            ResultHistory: [],
+        });
+        currentProvider = makeProvider(() => session);
+        executeRelayedToolMock.mockResolvedValue({ ResultJson: '{"q":1}', Success: true, PausedRunID: 'paused-1' });
+        const resolver = makeResolver();
+
+        await resolver.ExecuteRealtimeSessionTool('session-1', 'call-1', 'invoke-target-agent', '{}', makeCtx(), makePubSub());
+
+        const loggedLines = errSpy.mock.calls.map((call) => String(call[0]));
+        const failureLine = loggedLines.find((line) => line.includes('updatePendingFeedbackRunID'));
+        expect(failureLine).toBeDefined();
+        expect(failureLine).toContain('session-1');
+        expect(failureLine).toContain('no failure detail recorded');
+        expect(failureLine).not.toContain('unknown error');
+    });
 });
 
 describe('RealtimeClientSessionResolver.RelayRealtimeTranscript', () => {
@@ -1690,6 +1726,7 @@ describe('RealtimeClientSessionResolver.SaveSessionChannelArtifact', () => {
     });
 
     it('returns a structured failure when the artifact header save fails (no version attempted)', async () => {
+        errSpy = vi.spyOn(console, 'error').mockImplementation(() => undefined);
         const failingArtifact = makeSessionEntity({
             ID: 'artifact-fail',
             Save: vi.fn(async () => false),
@@ -1706,10 +1743,14 @@ describe('RealtimeClientSessionResolver.SaveSessionChannelArtifact', () => {
 
         expect(result.Success).toBe(false);
         expect(result.ErrorMessage).toMatch(/artifact save failed/i);
+        expect(result.ErrorMessage).toContain('session session-1');
+        expect(result.ErrorMessage).toContain('db down');
+        expect(errSpy.mock.calls.map((call) => String(call[0]))).toContain(result.ErrorMessage);
         expect(version.Save).not.toHaveBeenCalled();
     });
 
     it('returns a structured failure (carrying the orphaned ArtifactID) when the version save fails', async () => {
+        errSpy = vi.spyOn(console, 'error').mockImplementation(() => undefined);
         const failingVersion = makeSessionEntity({
             ID: 'version-fail',
             Save: vi.fn(async () => false),
@@ -1728,6 +1769,10 @@ describe('RealtimeClientSessionResolver.SaveSessionChannelArtifact', () => {
         expect(result.Success).toBe(false);
         expect(result.ArtifactID).toBe('artifact-1');
         expect(result.ArtifactVersionID).toBeUndefined();
+        expect(result.ErrorMessage).toMatch(/artifact version save failed/i);
+        expect(result.ErrorMessage).toContain('session session-1');
+        expect(result.ErrorMessage).toContain('too big');
+        expect(errSpy.mock.calls.map((call) => String(call[0]))).toContain(result.ErrorMessage);
         expect(junction.Save).not.toHaveBeenCalled();
     });
 
@@ -2880,6 +2925,44 @@ describe('RealtimeClientSessionResolver — scoped-anonymous elevation (issue #3
         expect(executeRelayedToolMock.mock.calls[0][1]).toBe(ANON_USER);
     });
 
+    it('writes the hidden direct-action tool turn (ExecuteRealtimeSessionTool) as the CALLER, not the system user (#4791)', async () => {
+        const detail = makeSessionEntity({ ID: 'detail-1' });
+        currentProvider = {
+            GetEntityObject: vi.fn(async (name: string) =>
+                name === 'MJ: Conversation Details' ? detail : makeSessionEntity({ UserID: 'anon-1' }),
+            ),
+        };
+        executeRelayedToolMock.mockResolvedValue({ ResultJson: '{"success":true}', Success: true });
+        const resolver = makeAnonResolver();
+
+        await resolver.ExecuteRealtimeSessionTool(
+            'session-1', 'call-1', 'Some Direct Action', '{}', makeCtx(), makePubSub(),
+        );
+
+        // The dispatch itself still runs elevated (SYSTEM_USER)…
+        expect(executeRelayedToolMock.mock.calls[0][1]).toBe(SYSTEM_USER);
+        // …but the hidden Conversation Detail turn is written as the CALLER, never the system user.
+        expect(getEntityObjectSpy()).toHaveBeenCalledWith('MJ: Conversation Details', ANON_USER);
+        expect(getEntityObjectSpy()).not.toHaveBeenCalledWith('MJ: Conversation Details', SYSTEM_USER);
+        expect(detail.Save).toHaveBeenCalled();
+        expect(detail.UserID).toBe('anon-1');
+    });
+
+    it('writes the direct-action tool turn as the caller unchanged for a normal authenticated user', async () => {
+        const detail = makeSessionEntity({ ID: 'detail-2' });
+        currentProvider = {
+            GetEntityObject: vi.fn(async (name: string) => (name === 'MJ: Conversation Details' ? detail : makeSessionEntity())),
+        };
+        executeRelayedToolMock.mockResolvedValue({ ResultJson: '{"success":true}', Success: true });
+        const resolver = makeResolver();
+
+        await resolver.ExecuteRealtimeSessionTool(
+            'session-1', 'call-1', 'Some Direct Action', '{}', makeCtx(), makePubSub(),
+        );
+
+        expect(getEntityObjectSpy()).toHaveBeenCalledWith('MJ: Conversation Details', USER);
+    });
+
     it('accumulates relayed usage onto the prompt run under the SYSTEM user', async () => {
         const session = makeSessionEntity({
             UserID: 'anon-1',
@@ -2942,6 +3025,32 @@ describe('RealtimeClientSessionResolver — scoped-anonymous elevation (issue #3
         expect(getEntityObjectSpy()).toHaveBeenCalledWith('MJ: AI Prompt Runs', SYSTEM_USER);
     });
 
+    it('writes the hidden co-agent tool turn (RelayRealtimeToolTurn) as the CALLER (#4791)', async () => {
+        const session = makeSessionEntity({
+            UserID: 'anon-1',
+            Config_: JSON.stringify({ targetAgentID: 'target-1', promptRunID: 'prompt-run-1' }),
+        });
+        const promptRun = makeSessionEntity({ ID: 'prompt-run-1', Messages: null });
+        const detail = makeSessionEntity({ ID: 'detail-3' });
+        currentProvider = {
+            GetEntityObject: vi.fn(async (name: string) => {
+                if (name === 'MJ: AI Prompt Runs') return promptRun;
+                if (name === 'MJ: Conversation Details') return detail;
+                return session;
+            }),
+        };
+        const resolver = makeAnonResolver();
+
+        const ok = await resolver.RelayRealtimeToolTurn('session-1', 'browser_navigate', makeCtx(), '{"url":"x"}');
+
+        expect(ok).toBe(true);
+        // The co-agent run mirror stays SYSTEM…
+        expect(getEntityObjectSpy()).toHaveBeenCalledWith('MJ: AI Prompt Runs', SYSTEM_USER);
+        // …but the hidden Conversation Detail tool-turn is written as the CALLER, never SYSTEM.
+        expect(getEntityObjectSpy()).toHaveBeenCalledWith('MJ: Conversation Details', ANON_USER);
+        expect(getEntityObjectSpy()).not.toHaveBeenCalledWith('MJ: Conversation Details', SYSTEM_USER);
+    });
+
     it('prepares the session with observability under the SYSTEM user while UserID stays the visitor', async () => {
         hasPermissionMock.mockResolvedValue(true);
         currentProvider = makeProvider(() => makeSessionEntity({ UserID: 'anon-1' }));
@@ -3003,6 +3112,10 @@ describe('RealtimeClientSessionResolver — scoped-anonymous elevation (issue #3
         // The junction write (an entity the anon role does NOT hold) runs as the SYSTEM user.
         expect(getEntityObjectSpy()).toHaveBeenCalledWith('MJ: Conversation Detail Artifacts', SYSTEM_USER);
         expect(junctions).toHaveLength(1);
+        // The hidden anchor `Conversation Detail` is written as the CALLER (#4791) — like every
+        // other `MJ: Conversation Details` write, the System user is refused as not the owner.
+        expect(getEntityObjectSpy()).toHaveBeenCalledWith('MJ: Conversation Details', ANON_USER);
+        expect(getEntityObjectSpy()).not.toHaveBeenCalledWith('MJ: Conversation Details', SYSTEM_USER);
         // The hidden anchor is attributed to the SESSION owner, not the elevated principal.
         expect(anchors).toHaveLength(1);
         expect(anchors[0].UserID).toBe('anon-1');
@@ -3102,6 +3215,107 @@ describe('RealtimeClientSessionResolver — scoped-anonymous elevation (issue #3
         expect((storeRecordingMock.mock.calls[0][0] as { ContextUser: unknown }).ContextUser).toBe(USER);
         expect(getSystemUserMock).not.toHaveBeenCalled();
     });
+
+    /** Provider routing a hidden-tool-turn RelayRealtimeToolTurn call: session, prompt run, detail. */
+    function makeToolTurnProvider(detail: FakeSession): unknown {
+        const session = makeSessionEntity({
+            UserID: 'anon-1',
+            Config_: JSON.stringify({ targetAgentID: 'target-1', promptRunID: 'prompt-run-1' }),
+        });
+        const promptRun = makeSessionEntity({ ID: 'prompt-run-1', Messages: null });
+        return {
+            GetEntityObject: vi.fn(async (name: string) => {
+                if (name === 'MJ: AI Prompt Runs') return promptRun;
+                if (name === 'MJ: Conversation Details') return detail;
+                return session;
+            }),
+        };
+    }
+
+    it('logs the session id, write user id and "no failure detail recorded" when a hidden tool turn save is refused without a LatestResult (#4791)', async () => {
+        errSpy = vi.spyOn(console, 'error').mockImplementation(() => undefined);
+        const detail = makeSessionEntity({
+            ID: 'detail-1',
+            Save: vi.fn(async () => false),
+            LatestResult: undefined,
+            ResultHistory: [],
+        });
+        currentProvider = makeToolTurnProvider(detail);
+        const resolver = makeAnonResolver();
+
+        await resolver.RelayRealtimeToolTurn('session-1', 'browser_navigate', makeCtx(), '{}');
+
+        const loggedLines = errSpy.mock.calls.map((call) => String(call[0]));
+        const failureLine = loggedLines.find((line) => line.includes('persistDirectActionTurn'));
+        expect(failureLine).toBeDefined();
+        // Exact substrings: 'anon-1' alone is the caller, session.UserID AND detail.UserID at once,
+        // so only the labelled form proves the WRITE user is what got logged.
+        expect(failureLine).toContain('session session-1');
+        expect(failureLine).toContain('write user anon-1');
+        expect(failureLine).toContain('no failure detail recorded (LatestResult null; ResultHistory length 0)');
+        expect(failureLine).toContain('the write was refused before reaching the provider');
+        expect(failureLine).not.toContain('unknown error');
+    });
+
+    it('does not claim WHERE the write was refused when a result was registered with an empty message (#4791)', async () => {
+        errSpy = vi.spyOn(console, 'error').mockImplementation(() => undefined);
+        const detail = makeSessionEntity({
+            ID: 'detail-1',
+            Save: vi.fn(async () => false),
+            LatestResult: { Success: false, CompleteMessage: '   ' },
+            ResultHistory: [{}],
+        });
+        currentProvider = makeToolTurnProvider(detail);
+        const resolver = makeAnonResolver();
+
+        await resolver.RelayRealtimeToolTurn('session-1', 'browser_navigate', makeCtx(), '{}');
+
+        const loggedLines = errSpy.mock.calls.map((call) => String(call[0]));
+        const failureLine = loggedLines.find((line) => line.includes('persistDirectActionTurn'));
+        expect(failureLine).toBeDefined();
+        expect(failureLine).toContain('no failure detail recorded (LatestResult empty; ResultHistory length 1)');
+        expect(failureLine).not.toContain('refused before reaching the provider');
+    });
+
+    it('never logs a PRIOR SUCCESS entry\'s text as the failure reason when the refusal registered nothing (#4791)', async () => {
+        errSpy = vi.spyOn(console, 'error').mockImplementation(() => undefined);
+        const detail = makeSessionEntity({
+            ID: 'detail-1',
+            Save: vi.fn(async () => false),
+            LatestResult: { Success: true, CompleteMessage: 'previous save ok' },
+            ResultHistory: [{}, {}],
+        });
+        currentProvider = makeToolTurnProvider(detail);
+        const resolver = makeAnonResolver();
+
+        await resolver.RelayRealtimeToolTurn('session-1', 'browser_navigate', makeCtx(), '{}');
+
+        const loggedLines = errSpy.mock.calls.map((call) => String(call[0]));
+        const failureLine = loggedLines.find((line) => line.includes('persistDirectActionTurn'));
+        expect(failureLine).toBeDefined();
+        expect(failureLine).toContain(
+            'no failure detail recorded (latest result entry is a prior success; ResultHistory length 2)',
+        );
+        expect(failureLine).not.toContain('previous save ok');
+    });
+
+    it('logs the real CompleteMessage when present (#4791)', async () => {
+        errSpy = vi.spyOn(console, 'error').mockImplementation(() => undefined);
+        const detail = makeSessionEntity({
+            ID: 'detail-1',
+            Save: vi.fn(async () => false),
+            LatestResult: { CompleteMessage: 'You do not have access to this conversation.' },
+        });
+        currentProvider = makeToolTurnProvider(detail);
+        const resolver = makeAnonResolver();
+
+        await resolver.RelayRealtimeToolTurn('session-1', 'browser_navigate', makeCtx(), '{}');
+
+        const loggedLines = errSpy.mock.calls.map((call) => String(call[0]));
+        const failureLine = loggedLines.find((line) => line.includes('persistDirectActionTurn'));
+        expect(failureLine).toBeDefined();
+        expect(failureLine).toContain('You do not have access to this conversation.');
+    });
 });
 
 describe('RealtimeClientSessionResolver — colleague authorization (allowedAgents)', () => {

package/src/__tests__/RealtimeSdpBrokerHandler.test.ts

@@ -2,7 +2,7 @@ import { describe, it, expect, beforeEach, vi } from 'vitest';
 import type { Request, Response, NextFunction } from 'express';
 import { MJGlobal, RegisterClass } from '@memberjunction/global';
 import { BaseRealtimeModel, RealtimeProxyRegistry, IRealtimeSession, RealtimeSessionParams } from '@memberjunction/ai';
-import { createRealtimeSdpBrokerRouter, createOpenAILiveBrokerRouter, requireTicket } from '../rest/RealtimeSdpBrokerHandler.js';
+import { CreateRealtimeSdpBrokerRouter, createOpenAILiveBrokerRouter, RequireTicket } from '../rest/RealtimeSdpBrokerHandler.js';
 
 @RegisterClass(BaseRealtimeModel, 'MockOpenAILiveForBrokerTest', 10)
 class MockOpenAILiveForBrokerTest extends BaseRealtimeModel {
@@ -67,20 +67,20 @@ function makeMockReqRes(query: Record<string, string>, body: unknown): {
 }
 
 describe('RealtimeSdpBrokerHandler', () => {
-    let router: ReturnType<typeof createRealtimeSdpBrokerRouter>;
+    let router: ReturnType<typeof CreateRealtimeSdpBrokerRouter>;
 
     beforeEach(() => {
-        router = createRealtimeSdpBrokerRouter();
+        router = CreateRealtimeSdpBrokerRouter();
     });
 
     it('createOpenAILiveBrokerRouter is backwards-compatible alias', () => {
-        expect(createOpenAILiveBrokerRouter).toBe(createRealtimeSdpBrokerRouter);
+        expect(createOpenAILiveBrokerRouter).toBe(CreateRealtimeSdpBrokerRouter);
     });
 
     it('requireTicket middleware rejects missing ticket without calling next()', () => {
         const { req, res, getStatus, getJson } = makeMockReqRes({}, {});
         const next = vi.fn();
-        requireTicket(req, res, next as NextFunction);
+        RequireTicket(req, res, next as NextFunction);
         expect(getStatus()).toBe(401);
         expect(getJson().error).toContain('missing ticket');
         expect(next).not.toHaveBeenCalled();
@@ -89,7 +89,7 @@ describe('RealtimeSdpBrokerHandler', () => {
     it('requireTicket middleware rejects invalid ticket without calling next()', () => {
         const { req, res, getStatus, getJson } = makeMockReqRes({ ticket: 'non-existent-ticket' }, {});
         const next = vi.fn();
-        requireTicket(req, res, next as NextFunction);
+        RequireTicket(req, res, next as NextFunction);
         expect(getStatus()).toBe(401);
         expect(getJson().error).toContain('invalid or expired ticket');
         expect(next).not.toHaveBeenCalled();

package/src/__tests__/RefreshAdoptsNewColumns.test.ts

@@ -1,7 +1,7 @@
 import { describe, it, expect } from 'vitest';
 import { readFileSync } from 'node:fs';
 import { join } from 'node:path';
-import { decideFieldMapReconcile } from '../integration/EntityMapLifecycle.js';
+import { DecideFieldMapReconcile } from '../integration/EntityMapLifecycle.js';
 
 /**
  * A REFRESH adopts the source's current shape: new objects and new columns both arrive ENABLED.
@@ -17,20 +17,20 @@ const fm = (SourceFieldName: string, Status: string) => ({ SourceFieldName, Stat
 
 describe('decideFieldMapReconcile — a refresh adopts new columns', () => {
     it('creates a new column ENABLED on an enabled map, by default', () => {
-        const plan = decideFieldMapReconcile(['id', 'brand_new_col'], [fm('id', 'Active')], true);
+        const plan = DecideFieldMapReconcile(['id', 'brand_new_col'], [fm('id', 'Active')], true);
         expect(plan.Create).toEqual([{ SourceFieldName: 'brand_new_col', Status: 'Active' }]);
         expect(plan.Enable).toEqual([]);
         expect(plan.Disable).toEqual([]);
     });
 
     it('autoEnableNewColumns:false gates it for a connection that wants to review first', () => {
-        const plan = decideFieldMapReconcile(['id', 'brand_new_col'], [fm('id', 'Active')], true, false);
+        const plan = DecideFieldMapReconcile(['id', 'brand_new_col'], [fm('id', 'Active')], true, false);
         expect(plan.Create).toEqual([{ SourceFieldName: 'brand_new_col', Status: 'Inactive' }]);
     });
 
     it('a DISABLED map never gets an Active column — the map always bounds the column', () => {
         // Adopting new columns must not resurrect a map the user switched off.
-        const plan = decideFieldMapReconcile(['brand_new_col'], [], false, true);
+        const plan = DecideFieldMapReconcile(['brand_new_col'], [], false, true);
         expect(plan.Create).toEqual([{ SourceFieldName: 'brand_new_col', Status: 'Inactive' }]);
     });
 });
@@ -40,24 +40,24 @@ describe('decideFieldMapReconcile — retiring and restoring are both non-destru
         // That row is not new — it was disabled because the source stopped reporting the column, so
         // it returns to the state it had. Gating it would silently demote a column the user chose to
         // sync whenever the source flickered.
-        const plan = decideFieldMapReconcile(['came_back'], [fm('came_back', 'Inactive')], true, false);
+        const plan = DecideFieldMapReconcile(['came_back'], [fm('came_back', 'Inactive')], true, false);
         expect(plan.Enable).toEqual(['came_back']);
         expect(plan.Create).toEqual([]);   // reuses the row, never mints a second one
     });
 
     it('a column absent from the resolution is DISABLED, never deleted', () => {
-        const plan = decideFieldMapReconcile(['kept'], [fm('kept', 'Active'), fm('vanished', 'Active')], true);
+        const plan = DecideFieldMapReconcile(['kept'], [fm('kept', 'Active'), fm('vanished', 'Active')], true);
         expect(plan.Disable).toEqual(['vanished']);
         expect(plan.Enable).toEqual([]);   // survivor untouched
     });
 
     it('does not re-enable anything while the map itself is disabled', () => {
-        const plan = decideFieldMapReconcile(['came_back'], [fm('came_back', 'Inactive')], false);
+        const plan = DecideFieldMapReconcile(['came_back'], [fm('came_back', 'Inactive')], false);
         expect(plan.Enable).toEqual([]);
     });
 
     it('matches source field names case-insensitively on both sides', () => {
-        const plan = decideFieldMapReconcile(['ID', 'Name'], [fm('id', 'Active'), fm('name', 'Active')], true);
+        const plan = DecideFieldMapReconcile(['ID', 'Name'], [fm('id', 'Active'), fm('name', 'Active')], true);
         expect(plan.Create).toEqual([]);
         expect(plan.Disable).toEqual([]);
     });

package/src/__tests__/RemoteBrowserActionRecovery.test.ts

@@ -59,7 +59,13 @@ vi.mock('@memberjunction/remote-browser-server', () => ({
 }));
 
 vi.mock('@memberjunction/aiengine', () => ({ AIEngine: { Instance: { Config: vi.fn(), Prompts: [] } } }));
-vi.mock('@memberjunction/ai-prompts', () => ({ AIPromptRunner: class {} }));
+// Spread the real module, as for ai-core-plus below, so transitively-loaded modules resolve: runners such as
+// AIRerankerRunner (which extends BaseModelRunner), and RunDecisionResolver's AIDecisionRunner. Only
+// AIPromptRunner is overridden for the test.
+vi.mock('@memberjunction/ai-prompts', async (importOriginal) => ({
+  ...(await importOriginal<typeof import('@memberjunction/ai-prompts')>()),
+  AIPromptRunner: class {},
+}));
 vi.mock('@memberjunction/ai-core-plus', async (importOriginal) => ({
   ...(await importOriginal<typeof import('@memberjunction/ai-core-plus')>()),
   AIPromptParams: class {},

package/src/__tests__/RemoteBrowserAudioStream.test.ts

@@ -72,7 +72,13 @@ vi.mock('@memberjunction/remote-browser-server', () => ({
 
 // Keep the AI imports (visual interpreter) inert — they aren't exercised by the audio path.
 vi.mock('@memberjunction/aiengine', () => ({ AIEngine: { Instance: { Config: vi.fn(), Prompts: [] } } }));
-vi.mock('@memberjunction/ai-prompts', () => ({ AIPromptRunner: class {} }));
+// Spread the real module, as for ai-core-plus below, so transitively-loaded modules resolve: runners such as
+// AIRerankerRunner (which extends BaseModelRunner), and RunDecisionResolver's AIDecisionRunner. Only
+// AIPromptRunner is overridden for the test.
+vi.mock('@memberjunction/ai-prompts', async (importOriginal) => ({
+  ...(await importOriginal<typeof import('@memberjunction/ai-prompts')>()),
+  AIPromptRunner: class {},
+}));
 // Spread the real module so transitively-loaded code (e.g. ArtifactToolManager → DataSnapshotToolLibrary,
 // which extends BaseArtifactToolLibrary) still resolves with its REAL base classes; only AIPromptParams is
 // overridden for the test. (Subsumes the narrower stub-two-exports approach — any other transitive export