@memberjunction/server 6.2.0-edge.4 → 6.2.0-edge.6

package/dist/generic/ResolverBase.js

@@ -1,19 +1,36 @@
-import { BaseEntity, BaseEntityEvent, CompositeKey, EntityFieldTSType, EntityPermissionType, KeyValuePair, LogDebug, LogError, LogStatus, Metadata, ReadableFieldsTransportKey, RecordChangeFieldSecurityProjector, RecordChangePayloadFields, } from '@memberjunction/core';
-import { UserCache } from '@memberjunction/generic-database-provider';
+import { AssertClientInputWritableForUser, BaseEntity, BaseEntityEvent, CompositeKey, EntityFieldTSType, EntityPermissionType, KeyValuePair, LogDebug, LogError, LogErrorEx, LogStatus, Metadata, ProjectEntityValuesForUser, ReadableFieldsTransportKey, RecordChangeFieldSecurityProjector, RecordChangePayloadFields, } from '@memberjunction/core';
+import { UserViewEngine } from '@memberjunction/core-entities';
+import { ClientClauseScreen, UserCache } from '@memberjunction/generic-database-provider';
 import { AuthorizationError } from 'type-graphql';
 import { GraphQLError } from 'graphql';
 import { RefusalExtensions } from './refusalExtensions.js';
 import { GetAPIKeyEngine } from '@memberjunction/api-keys';
 import { httpTransport, CloudEvent, emitterFor } from 'cloudevents';
 import { DeleteOptionsInput } from './DeleteOptionsInput.js';
-import { MJEventType, MJGlobal, ENCRYPTED_SENTINEL, ReplaceByteArraysWithBase64, EscapeSQLString, IsValueEncrypted, IsOnlyTimezoneShift } from '@memberjunction/global';
-import { SQLParser } from '@memberjunction/sql-parser';
-import { PostgreSQLDialect, SQLServerDialect } from '@memberjunction/sql-dialect';
+import { MJEventType, MJGlobal, UUIDsEqual, ENCRYPTED_SENTINEL, ReplaceByteArraysWithBase64, EscapeSQLString, IsValueEncrypted, IsOnlyTimezoneShift } from '@memberjunction/global';
+import { SQLParser, IsBalancedSQLFragment, LexSQL } from '@memberjunction/sql-parser';
 import { EncryptionEngine, IsEncryptionKeyUnavailable, ReportEncryptionKeyUnavailable } from '@memberjunction/encryption';
-import { PublishStatusUpdate } from './PushStatusResolver.js';
+import { PublishStatusUpdate, StatusUpdateOwnerID } from './PushStatusResolver.js';
 import { CACHE_INVALIDATION_TOPIC, MayBroadcastRecordData } from './CacheInvalidationResolver.js';
 import { PubSubManager } from './PubSubManager.js';
 import { FieldMapper } from '@memberjunction/graphql-dataprovider';
+/**
+ * Entities whose update is always hydrated from the stored row, never from the client's `OldValues___`, though they
+ * do not track record changes: their server-side write rules compare against the prior state, which a client could
+ * otherwise supply itself (lower-case names). See `ResolverBase.MustLoadTruthFromDatabase`.
+ *
+ * `mj: conversations` and `mj: ai agent sessions` carry the anonymous realtime-session ownership key
+ * (`ExternalID` / `ConversationID`), which their server entities refuse an anonymous visitor to change — a rule
+ * that decides on `Dirty`, so the baseline must be the stored row, not a client-supplied one (#4931).
+ */
+const ENTITIES_THAT_ALWAYS_LOAD_STORED_ROW = new Set([
+    'mj: record changes',
+    'mj: conversation details',
+    'mj: data context items',
+    'mj: conversations',
+    'mj: ai agent sessions',
+    'mj: ai agent runs',
+]);
 export class ResolverBase {
     static { this._emit = process.env.CLOUDEVENTS_HTTP_TRANSPORT ? emitterFor(httpTransport(process.env.CLOUDEVENTS_HTTP_TRANSPORT)) : null; }
     static { this._cloudeventsHeaders = process.env.CLOUDEVENTS_HTTP_HEADERS ? JSON.parse(process.env.CLOUDEVENTS_HTTP_HEADERS) : {}; }
@@ -51,131 +68,123 @@ export class ResolverBase {
      * @param contextUser - Optional user context for decryption (required for encrypted fields)
      * @returns A new object in transport shape, or null when there is nothing to map
      */
-    async MapFieldNamesToCodeNames(entityName, dataObject, contextUser, provider, deniedReadFields, recordChangeProjector) {
-        // Return null for empty objects (e.g. when no rows found due to RLS filtering)
+    /**
+     * Precomputed per-entity / per-request field-mapping plan shared across rows in
+     * {@link MapFieldNamesToCodeNames} and {@link ArrayMapFieldNamesToCodeNames}.
+     */
+    buildFieldMappingPlan(entityName, contextUser, provider, deniedReadFields, recordChangeProjector) {
+        const md = provider ?? new Metadata();
+        const entityInfo = md.EntityByName(entityName);
+        if (!entityInfo)
+            throw new Error(`Entity ${entityName} not found in metadata`);
+        const denied = deniedReadFields ?? (entityInfo.FieldLevelSecurityApplies && contextUser
+            ? entityInfo.GetDeniedReadFields(contextUser)
+            : null);
+        const mapper = new FieldMapper();
+        const fieldsToProcess = [];
+        for (const f of entityInfo.Fields) {
+            const mappedFieldName = mapper.MapFieldName(f.CodeName);
+            const isDenied = Boolean(denied?.has(f.Name.trim().toLowerCase()));
+            if (isDenied || mappedFieldName !== f.Name) {
+                fieldsToProcess.push({ name: f.Name, mappedFieldName, isDenied });
+            }
+        }
+        const readableFields = this.BuildReadableFieldsTransportValue(entityInfo, denied);
+        const projector = contextUser && RecordChangeFieldSecurityProjector.IsRecordChangesEntity(entityInfo)
+            ? (recordChangeProjector ?? new RecordChangeFieldSecurityProjector(md, contextUser))
+            : undefined;
+        const encryptedFields = entityInfo.EncryptedFields ?? [];
+        const checkBinary = entityInfo.HasBinaryFields !== false;
+        return {
+            entityInfo,
+            fieldsToProcess,
+            readableFields,
+            projector,
+            encryptedFields,
+            checkBinary,
+        };
+    }
+    /**
+     * Applies synchronous field renaming, FLS stripping, readable-fields transport stamping, and
+     * Record Changes payload projection for a single row using a precomputed mapping plan.
+     */
+    mapRowSynchronously(dataObject, plan) {
         if (!dataObject || Object.keys(dataObject).length === 0) {
             return null;
         }
-        // Shallow copy up front so every write below lands on our object, never the caller's.
-        // Binary values are base64 strings everywhere above the providers; any byte array that still
-        // reaches a resolver (custom code, an external driver) is converted here, because GraphQL's
-        // String scalar cannot serialize a Buffer and would fail the whole response.
-        dataObject = ReplaceByteArraysWithBase64({ ...dataObject });
-        // for the given entity name provided, check to see if there are any fields
-        // where the code name is different from the field name, and for just those
-        // fields, iterate through the dataObject and REPLACE the property that has the field name
-        // with the CodeName, because we can't transfer those via GraphQL as they are not
-        // valid property names in GraphQL
-        {
-            const md = provider ?? new Metadata();
-            const entityInfo = md.EntityByName(entityName);
-            if (!entityInfo)
-                throw new Error(`Entity ${entityName} not found in metadata`);
-            // const fields = entityInfo.Fields.filter((f) => f.Name !== f.CodeName || f.Name.startsWith('__mj_'));
-            // FIELD-LEVEL SECURITY — this is the authoritative read boundary for every GraphQL
-            // return path (single-record resolvers, external-data-source loads, and anything else
-            // routed through here), sitting exactly where encryption masking already lives.
-            //
-            // The denied set is normally computed ONCE per (entity, user) by the caller and passed
-            // in: this method runs once per ROW, so resolving it here would cost fields x rows
-            // aggregations. We fall back to computing it when a caller doesn't supply it (the
-            // single-record resolvers, where "once per row" and "once per request" are the same
-            // thing) rather than failing open — a missing argument must never mean missing security.
-            const denied = deniedReadFields ?? (entityInfo.EnableFieldLevelSecurity && contextUser
-                ? entityInfo.GetDeniedReadFields(contextUser)
-                : null);
-            const mapper = new FieldMapper();
-            entityInfo.Fields.forEach((f) => {
-                if (dataObject.hasOwnProperty(f.Name)) {
-                    // GraphQL doesn't allow us to pass back fields with __ so we are mapping our special field cases that start with __mj_ to _mj__ for transport - they are converted back on the other side automatically
-                    const mappedFieldName = mapper.MapFieldName(f.CodeName);
-                    if (denied?.has(f.Name.trim().toLowerCase())) {
-                        // Omit entirely rather than nulling — a null is indistinguishable from a real
-                        // null value, and the client should see the field as absent, not as empty.
-                        // Both key shapes are removed because callers reach this method with rows keyed
-                        // either way depending on whether mapping has already run.
-                        delete dataObject[f.Name];
-                        delete dataObject[mappedFieldName];
-                        return;
-                    }
-                    if (mappedFieldName !== f.Name) {
-                        dataObject[mappedFieldName] = dataObject[f.Name];
-                        delete dataObject[f.Name];
-                    }
+        let row = plan.checkBinary
+            ? ReplaceByteArraysWithBase64({ ...dataObject })
+            : { ...dataObject };
+        for (let i = 0; i < plan.fieldsToProcess.length; i++) {
+            const fp = plan.fieldsToProcess[i];
+            if (Object.prototype.hasOwnProperty.call(row, fp.name)) {
+                if (fp.isDenied) {
+                    delete row[fp.name];
+                    delete row[fp.mappedFieldName];
+                }
+                else {
+                    row[fp.mappedFieldName] = row[fp.name];
+                    delete row[fp.name];
                 }
-            });
-            // Field security, second half: say IN-BAND which fields this caller may read. Deleting the
-            // key above is not enough on its own — GraphQL emits every SELECTED field regardless, so a
-            // denied field the client asked for arrives as an explicit null it cannot tell apart from a
-            // genuine one. The client must not settle that from its own metadata: during the window
-            // after a permission change its copy disagrees with ours, and once metadata filtering lands
-            // (issue #3485) it may not hold the permission rows at all. Null for unrestricted callers,
-            // which is nearly every request.
-            const readableFields = this.BuildReadableFieldsTransportValue(entityInfo, denied);
-            if (readableFields) {
-                dataObject[ReadableFieldsTransportKey] = readableFields;
-            }
-            // Field security, third part — the audit trail. A 'MJ: Record Changes' row carries the old
-            // and new values of ANOTHER entity's fields, and its own EnableFieldLevelSecurity flag is
-            // off, so everything above is a no-op for it and the payload would flow out untouched. The
-            // projector recomputes the denied set against the entity each row is about; see
-            // RecordChangeFieldSecurityProjector for what each payload column gets.
-            //
-            // Same "a missing argument must never mean missing security" rule as the denied set above:
-            // the projector is normally built ONCE per request by the array caller and passed in, and
-            // we build one here when it wasn't — the single-record resolvers, where once-per-row and
-            // once-per-request are the same thing.
-            if (contextUser && RecordChangeFieldSecurityProjector.IsRecordChangesEntity(entityInfo)) {
-                const projector = recordChangeProjector ?? new RecordChangeFieldSecurityProjector(md, contextUser);
-                dataObject = projector.ProjectRow(dataObject);
             }
-            // Handle encrypted fields - data from raw SQL queries is still encrypted
-            const encryptedFields = entityInfo.EncryptedFields;
-            if (encryptedFields.length > 0) {
-                for (const field of encryptedFields) {
-                    const fieldName = field.CodeName;
-                    const value = dataObject[fieldName];
-                    // Skip null/undefined values
-                    if (value === null || value === undefined)
-                        continue;
-                    // Check if value is encrypted (raw SQL returns encrypted values)
-                    const engine = EncryptionEngine.Instance;
-                    await engine.Config(false, contextUser);
-                    const keyMarker = field.EncryptionKeyID ? engine.GetKeyByID(field.EncryptionKeyID)?.Marker : undefined;
-                    if (typeof value === 'string' && IsValueEncrypted(value, keyMarker)) {
-                        if (field.AllowDecryptInAPI) {
-                            // Decrypt the value for the client
-                            if (contextUser) {
-                                try {
-                                    const decryptedValue = await engine.Decrypt(value, contextUser);
-                                    dataObject[fieldName] = decryptedValue;
-                                }
-                                catch (err) {
-                                    if (IsEncryptionKeyUnavailable(err)) {
-                                        ReportEncryptionKeyUnavailable(err);
-                                    }
-                                    else {
-                                        LogError(`Failed to decrypt field ${fieldName} for API response: ${err}`);
-                                    }
-                                    // On decryption failure, use sentinel for safety
-                                    dataObject[fieldName] = ENCRYPTED_SENTINEL;
-                                }
+        }
+        if (plan.readableFields) {
+            row[ReadableFieldsTransportKey] = plan.readableFields;
+        }
+        if (plan.projector) {
+            row = plan.projector.ProjectRow(row);
+        }
+        return row;
+    }
+    /**
+     * Decrypts or masks encrypted fields on a mapped row when `plan.encryptedFields.length > 0`.
+     */
+    async decryptRowEncryptedFields(row, encryptedFields, contextUser) {
+        for (const field of encryptedFields) {
+            const fieldName = field.CodeName;
+            const value = row[fieldName];
+            if (value === null || value === undefined)
+                continue;
+            const engine = EncryptionEngine.Instance;
+            await engine.Config(false, contextUser);
+            const keyMarker = field.EncryptionKeyID ? engine.GetKeyByID(field.EncryptionKeyID)?.Marker : undefined;
+            if (typeof value === 'string' && IsValueEncrypted(value, keyMarker)) {
+                if (field.AllowDecryptInAPI) {
+                    if (contextUser) {
+                        try {
+                            const decryptedValue = await engine.Decrypt(value, contextUser);
+                            row[fieldName] = decryptedValue;
+                        }
+                        catch (err) {
+                            if (IsEncryptionKeyUnavailable(err)) {
+                                ReportEncryptionKeyUnavailable(err);
                             }
                             else {
-                                // No context user, can't decrypt - use sentinel
-                                dataObject[fieldName] = ENCRYPTED_SENTINEL;
+                                LogError(`Failed to decrypt field ${fieldName} for API response: ${err}`);
                             }
+                            row[fieldName] = ENCRYPTED_SENTINEL;
                         }
-                        else if (!field.SendEncryptedValue) {
-                            // AllowDecryptInAPI=false and SendEncryptedValue=false - use sentinel
-                            dataObject[fieldName] = ENCRYPTED_SENTINEL;
-                        }
-                        // else: AllowDecryptInAPI=false and SendEncryptedValue=true - keep encrypted value as-is
+                    }
+                    else {
+                        row[fieldName] = ENCRYPTED_SENTINEL;
                     }
                 }
+                else if (!field.SendEncryptedValue) {
+                    row[fieldName] = ENCRYPTED_SENTINEL;
+                }
             }
         }
-        return dataObject;
+    }
+    async MapFieldNamesToCodeNames(entityName, dataObject, contextUser, provider, deniedReadFields, recordChangeProjector) {
+        if (!dataObject || Object.keys(dataObject).length === 0) {
+            return null;
+        }
+        const plan = this.buildFieldMappingPlan(entityName, contextUser, provider, deniedReadFields, recordChangeProjector);
+        const mapped = this.mapRowSynchronously(dataObject, plan);
+        if (mapped && plan.encryptedFields.length > 0) {
+            await this.decryptRowEncryptedFields(mapped, plan.encryptedFields, contextUser);
+        }
+        return mapped;
     }
     /**
      * Reverse-maps GraphQL-safe field names back to entity CodeNames in a mutation input object.
@@ -232,26 +241,17 @@ export class ResolverBase {
         if (!dataObjectArray || dataObjectArray.length === 0) {
             return dataObjectArray;
         }
-        // Resolve the field-security denied set ONCE for the whole array and pass it into the
-        // per-row mapper. MapFieldNamesToCodeNames runs once per row, so computing this inside
-        // the loop would be fields x rows aggregations — 40,000 for a 1,000-row x 40-column
-        // result, each re-scanning the user's roles and allocating. Gated on the entity-level
-        // flag so non-FLS entities (nearly all of them) don't even resolve the entity twice.
-        const md = provider ?? new Metadata();
-        const entityInfo = md.EntityByName(entityName);
-        const deniedReadFields = entityInfo?.EnableFieldLevelSecurity && contextUser
-            ? entityInfo.GetDeniedReadFields(contextUser)
-            : undefined;
-        // Record Changes payload security is resolved per DISTINCT target entity, and one array can
-        // span many — so the projector, which owns that memo, must outlive the row loop. Built once
-        // here for the same reason the denied set above is: GetDeniedReadFields walks every field on
-        // an entity and must never be called per row.
-        const recordChangeProjector = contextUser && RecordChangeFieldSecurityProjector.IsRecordChangesEntity(entityInfo)
-            ? new RecordChangeFieldSecurityProjector(md, contextUser)
-            : undefined;
-        const mapped = [];
-        for (const element of dataObjectArray) {
-            mapped.push(await this.MapFieldNamesToCodeNames(entityName, element, contextUser, provider, deniedReadFields, recordChangeProjector));
+        // Precompute the entity lookup, FieldMapper plan, denied-fields set, readable-fields list,
+        // and Record Changes projector ONCE for the whole array rather than per row.
+        const plan = this.buildFieldMappingPlan(entityName, contextUser, provider);
+        const hasEncryptedFields = plan.encryptedFields.length > 0;
+        const mapped = new Array(dataObjectArray.length);
+        for (let i = 0; i < dataObjectArray.length; i++) {
+            const row = this.mapRowSynchronously(dataObjectArray[i], plan);
+            if (row && hasEncryptedFields) {
+                await this.decryptRowEncryptedFields(row, plan.encryptedFields, contextUser);
+            }
+            mapped[i] = row;
         }
         return mapped;
     }
@@ -292,6 +292,7 @@ export class ResolverBase {
         if (!loaded) {
             return null;
         }
+        // fls-guard: MapFieldNamesToCodeNames drops the fields the caller may not read
         const mapped = await this.MapFieldNamesToCodeNames(entityName, entityObject.GetAll(), contextUser);
         return mapped;
     }
@@ -307,9 +308,11 @@ export class ResolverBase {
      * @param dataObject - The data object containing field values
      * @param encryptionEngine - Optional encryption engine for re-encryption (lazy loaded if needed)
      * @param contextUser - User context for encryption operations
+     * @param fieldKey - What the object's keys are: field CodeNames (GraphQL transport rows, the
+     *   default) or field Names (raw provider rows, such as dataset item results)
      * @returns The filtered data object
      */
-    async FilterEncryptedFieldsForAPI(entityName, dataObject, contextUser, provider) {
+    async FilterEncryptedFieldsForAPI(entityName, dataObject, contextUser, provider, fieldKey = 'CodeName') {
         if (!dataObject)
             return dataObject;
         const md = provider ?? new Metadata();
@@ -322,7 +325,7 @@ export class ResolverBase {
             return dataObject;
         // Process each encrypted field
         for (const field of encryptedFields) {
-            const fieldName = field.CodeName;
+            const fieldName = fieldKey === 'Name' ? field.Name : field.CodeName;
             const value = dataObject[fieldName];
             // Skip null/undefined values
             if (value === null || value === undefined)
@@ -358,9 +361,10 @@ export class ResolverBase {
         return dataObject;
     }
     /**
-     * Filters encrypted fields for an array of data objects
+     * Filters encrypted fields for an array of data objects. `fieldKey` is as for
+     * {@link FilterEncryptedFieldsForAPI}.
      */
-    async ArrayFilterEncryptedFieldsForAPI(entityName, dataObjectArray, contextUser, provider) {
+    async ArrayFilterEncryptedFieldsForAPI(entityName, dataObjectArray, contextUser, provider, fieldKey = 'CodeName') {
         if (!dataObjectArray || dataObjectArray.length === 0)
             return dataObjectArray;
         // Check if entity has any encrypted fields first to avoid unnecessary processing
@@ -373,7 +377,7 @@ export class ResolverBase {
             return dataObjectArray;
         // Process each element
         for (const element of dataObjectArray) {
-            await this.FilterEncryptedFieldsForAPI(entityName, element, contextUser, provider);
+            await this.FilterEncryptedFieldsForAPI(entityName, element, contextUser, provider, fieldKey);
         }
         return dataObjectArray;
     }
@@ -454,23 +458,54 @@ export class ResolverBase {
             return [];
         }
     }
+    /**
+     * Resolves a User View by name, consulting the in-memory {@link UserViewEngine} cache first
+     * and falling back to a database `RunView` only on a cache miss.
+     */
+    async resolveUserViewByName(viewName, provider, contextUser) {
+        if (UserViewEngine.Instance.Loaded) {
+            const cached = UserViewEngine.Instance.GetViewByName(viewName);
+            if (cached) {
+                return cached;
+            }
+        }
+        const rv = provider;
+        const result = await rv.RunView({
+            EntityName: 'MJ: User Views',
+            // SECURITY: the view name is client-supplied and lands inside a SQL literal.
+            ExtraFilter: "Name='" + EscapeSQLString(viewName) + "'",
+        }, contextUser);
+        if (result && result.Success && result.Results.length > 0) {
+            return result.Results[0];
+        }
+        return null;
+    }
+    /**
+     * Resolves a User View by ID, consulting the in-memory {@link UserViewEngine} cache first
+     * and falling back to an entity `Load()` only on a cache miss.
+     */
+    async resolveUserViewByID(viewID, provider, contextUser) {
+        if (UserViewEngine.Instance.Loaded) {
+            const cached = UserViewEngine.Instance.GetViewById(viewID);
+            if (cached) {
+                return cached;
+            }
+        }
+        const viewInfo = await provider.GetEntityObject('MJ: User Views', contextUser);
+        await viewInfo.Load(viewID);
+        return viewInfo;
+    }
     async RunViewByNameGeneric(viewInput, provider, userPayload, pubSub) {
         try {
             // Log aggregate input for debugging
             if (viewInput.Aggregates?.length) {
                 LogStatus(`[ResolverBase] RunViewByNameGeneric received aggregates: viewName=${viewInput.ViewName}, aggregateCount=${viewInput.Aggregates.length}, aggregates=${JSON.stringify(viewInput.Aggregates.map(a => ({ expression: a.expression, alias: a.alias })))}`);
             }
-            const rv = provider;
-            const result = await rv.RunView({
-                EntityName: 'MJ: User Views',
-                // SECURITY: the view name is client-supplied and lands inside a SQL literal.
-                ExtraFilter: "Name='" + EscapeSQLString(viewInput.ViewName) + "'",
-            }, userPayload.userRecord);
-            if (result && result.Success && result.Results.length > 0) {
-                const viewInfo = result.Results[0];
+            const viewInfo = await this.resolveUserViewByName(viewInput.ViewName, provider, userPayload.userRecord);
+            if (viewInfo) {
                 return this.RunViewGenericInternal(provider, viewInfo, viewInput.ExtraFilter, viewInput.OrderBy, viewInput.UserSearchString, viewInput.ExcludeUserViewRunID, viewInput.OverrideExcludeFilter, viewInput.SaveViewResults, viewInput.Fields, viewInput.IgnoreMaxRows, viewInput.ExcludeDataFromAllPriorViewRuns, viewInput.ForceAuditLog, viewInput.AuditLogDescription, viewInput.ResultType, userPayload, viewInput.MaxRows, viewInput.StartRow, viewInput.Aggregates, viewInput.AfterKey
                     ? CompositeKey.FromKeyValuePairs(viewInput.AfterKey.KeyValuePairs)
-                    : undefined, viewInput.BypassCache, viewInput.DataSource, viewInput.IncludeBinaryFields);
+                    : undefined, viewInput.BypassCache, viewInput.DataSource, viewInput.IncludeBinaryFields, viewInput.AlternateBaseView, viewInput.Properties);
             }
             else {
                 LogError(`RunViewByNameGeneric: View ${viewInput.ViewName} not found or no results returned`);
@@ -489,9 +524,11 @@ export class ResolverBase {
                 LogStatus(`[ResolverBase] RunViewByIDGeneric received aggregates: viewID=${viewInput.ViewID}, aggregateCount=${viewInput.Aggregates.length}, aggregates=${JSON.stringify(viewInput.Aggregates.map(a => ({ expression: a.expression, alias: a.alias })))}`);
             }
             const contextUser = this.GetUserFromPayload(userPayload);
-            const viewInfo = await provider.GetEntityObject('MJ: User Views', contextUser);
-            await viewInfo.Load(viewInput.ViewID);
-            return this.RunViewGenericInternal(provider, viewInfo, viewInput.ExtraFilter, viewInput.OrderBy, viewInput.UserSearchString, viewInput.ExcludeUserViewRunID, viewInput.OverrideExcludeFilter, viewInput.SaveViewResults, viewInput.Fields, viewInput.IgnoreMaxRows, viewInput.ExcludeDataFromAllPriorViewRuns, viewInput.ForceAuditLog, viewInput.AuditLogDescription, viewInput.ResultType, userPayload, viewInput.MaxRows, viewInput.StartRow, viewInput.Aggregates, undefined, viewInput.BypassCache, viewInput.DataSource, viewInput.IncludeBinaryFields);
+            const viewInfo = await this.resolveUserViewByID(viewInput.ViewID, provider, contextUser);
+            if (!viewInfo) {
+                return null;
+            }
+            return this.RunViewGenericInternal(provider, viewInfo, viewInput.ExtraFilter, viewInput.OrderBy, viewInput.UserSearchString, viewInput.ExcludeUserViewRunID, viewInput.OverrideExcludeFilter, viewInput.SaveViewResults, viewInput.Fields, viewInput.IgnoreMaxRows, viewInput.ExcludeDataFromAllPriorViewRuns, viewInput.ForceAuditLog, viewInput.AuditLogDescription, viewInput.ResultType, userPayload, viewInput.MaxRows, viewInput.StartRow, viewInput.Aggregates, undefined, viewInput.BypassCache, viewInput.DataSource, viewInput.IncludeBinaryFields, viewInput.AlternateBaseView, viewInput.Properties);
         }
         catch (err) {
             console.log(err);
@@ -514,7 +551,7 @@ export class ResolverBase {
                 EntityID: entity.ID,
                 EntityBaseView: entity.BaseView,
             }; // only providing a few bits of data here, but it's enough to get the view to run
-            return this.RunViewGenericInternal(provider, viewInfo, viewInput.ExtraFilter, viewInput.OrderBy, viewInput.UserSearchString, viewInput.ExcludeUserViewRunID, viewInput.OverrideExcludeFilter, false, viewInput.Fields, viewInput.IgnoreMaxRows, false, viewInput.ForceAuditLog, viewInput.AuditLogDescription, viewInput.ResultType, userPayload, viewInput.MaxRows, viewInput.StartRow, viewInput.Aggregates, undefined, viewInput.BypassCache, viewInput.DataSource, viewInput.IncludeBinaryFields);
+            return this.RunViewGenericInternal(provider, viewInfo, viewInput.ExtraFilter, viewInput.OrderBy, viewInput.UserSearchString, viewInput.ExcludeUserViewRunID, viewInput.OverrideExcludeFilter, false, viewInput.Fields, viewInput.IgnoreMaxRows, false, viewInput.ForceAuditLog, viewInput.AuditLogDescription, viewInput.ResultType, userPayload, viewInput.MaxRows, viewInput.StartRow, viewInput.Aggregates, undefined, viewInput.BypassCache, viewInput.DataSource, viewInput.IncludeBinaryFields, viewInput.AlternateBaseView);
         }
         catch (err) {
             console.log(err);
@@ -529,7 +566,7 @@ export class ResolverBase {
             try {
                 let viewInfo = null;
                 if (viewInput.ViewName) {
-                    viewInfo = this.safeFirstArrayElement(await this.findBy(provider, 'MJ: User Views', { Name: viewInput.ViewName }, userPayload.userRecord));
+                    viewInfo = await this.resolveUserViewByName(viewInput.ViewName, provider, userPayload.userRecord);
                     // Populate EntityName on the input so callers (e.g. RunViews resolver) can
                     // look up the entity without re-querying the view
                     if (viewInfo && !viewInput.EntityName) {
@@ -537,8 +574,7 @@ export class ResolverBase {
                     }
                 }
                 else if (viewInput.ViewID) {
-                    viewInfo = await provider.GetEntityObject('MJ: User Views', contextUser);
-                    await viewInfo.Load(viewInput.ViewID);
+                    viewInfo = await this.resolveUserViewByID(viewInput.ViewID, provider, contextUser);
                     // Populate EntityName on the input so callers can look up the entity
                     if (viewInfo && !viewInput.EntityName) {
                         viewInput.EntityName = viewInfo.Entity;
@@ -585,6 +621,8 @@ export class ResolverBase {
                     bypassCache: viewInput.BypassCache,
                     dataSource: viewInput.DataSource,
                     includeBinaryFields: viewInput.IncludeBinaryFields,
+                    alternateBaseView: viewInput.AlternateBaseView,
+                    properties: viewInput.Properties,
                 });
             }
             catch (err) {
@@ -595,6 +633,30 @@ export class ResolverBase {
         let results = await this.RunViewsGenericInternal(params);
         return results;
     }
+    /**
+     * What an entity event may carry to a CloudEvents sink or a log line.
+     *
+     * The whole row for an entity without field security. For one where it applies (its own flag
+     * or an IS-A ancestor's), and for `MJ: Record Changes` (whose payload columns hold other
+     * entities' values), only the primary key and the names of the fields that changed: the sink
+     * is outside MemberJunction with no reader to project the row for, and these events fire for
+     * server-internal saves too, whose objects hold every column.
+     */
+    EntityEventPayload(baseEntity, changedFieldNames) {
+        const entityInfo = baseEntity.EntityInfo;
+        if (!entityInfo?.FieldLevelSecurityApplies && !RecordChangeFieldSecurityProjector.IsRecordChangesEntity(entityInfo)) {
+            // fls-guard: entity without field security and not the audit trail; whole row is the documented payload
+            return baseEntity.GetAll();
+        }
+        return {
+            // Read through Get() rather than PrimaryKey, which builds every field object of a raw-mode record.
+            PrimaryKey: (entityInfo.PrimaryKeys ?? []).map((pk) => ({ FieldName: pk.Name, Value: baseEntity.Get(pk.Name) })),
+            // A completed save has already rebased the object, so nothing on it is dirty: the event
+            // carries the names the save wrote. Other events (save_started) still read them off the object.
+            // GetDirtyFieldNames answers without building field objects for a record still in raw mode.
+            ChangedFields: changedFieldNames ?? baseEntity.GetDirtyFieldNames(),
+        };
+    }
     static { this._priorEmittedData = []; }
     async EmitCloudEvent({ component, event, eventCode, args }) {
         if (ResolverBase._emit && event === MJEventType.ComponentEvent && eventCode === BaseEntity.BaseEventCode) {
@@ -602,7 +664,7 @@ export class ResolverBase {
             const type = `MemberJunction.${event}${extendedType}`;
             const source = `${process.env.CLOUDEVENTS_SOURCE ?? 'MemberJunction'}`;
             const subject = args instanceof BaseEntityEvent ? args.baseEntity.EntityInfo.CodeName : undefined;
-            const data = args?.baseEntity?.GetAll() ?? {};
+            const data = args?.baseEntity ? this.EntityEventPayload(args.baseEntity, args.ChangedFieldNames) : {};
             const cloudEvent = new CloudEvent({ type, source, subject, data });
             try {
                 // check to see if the combination of Entity and pkey was already emitted, if so, Log that condtion next
@@ -732,48 +794,59 @@ export class ResolverBase {
      * This screen uses `@memberjunction/sql-parser` (same wrap as EDS `assertReadOnlyClause`):
      * wrap the fragment as a single SELECT, fail closed if it does not parse as a read, then
      * allow a FROM only when it is an entity **BaseView**. Base tables (`Meeting`, `__mj.User`)
-     * and catalogs are rejected. Server-internal RunView callers never hit this.
+     * and catalogs are rejected. Server-internal RunView callers get only the provider's
+     * statement-separator check, which cannot refuse a legitimate filter.
+     *
+     * The screen is `ClientClauseScreen` in `@memberjunction/generic-database-provider`, shared
+     * with the REST view routes, ad-hoc list sources, and the provider's saved-view checks.
+     *
+     * Before that parse, the fragment must be balanced on its own (`IsBalancedSQLFragment`). The
+     * provider and the tenant hook splice it inside parentheses and AND their own filters after
+     * it, so a fragment that closes those parentheses (`1=1) OR (1=1`) would leave row-level
+     * security, API-key row filters and tenant scope on one side of an OR the caller controls.
+     * The parse wraps the fragment in parentheses too, which is why it cannot catch this alone.
+     * A backslash inside a quoted string or identifier is refused as well: the parser reads `\'`
+     * inside a plain literal as an escaped quote, but SQL Server and PostgreSQL end the literal
+     * there, so the text after it could be code that the parse-based checks never saw.
      *
      * RLS is applied by RunView as an outer WHERE around the entity being queried, not compiled
-     * into the view. Subqueries against another entity's BaseView therefore do not inherit that
-     * entity's RLS; they are still restricted to the view (not the table).
+     * into the view, and RunView removes denied fields from its own result only. A subquery reads a
+     * base view directly with neither, so the screen refuses one over any entity the user reads under
+     * a row filter or with denied fields (`ClientClauseScreen.AssertUnscopedRead`), the queried
+     * entity included.
      */
     assertClientClauseUsesEntityBaseViews(clause, label, provider, user, options) {
         if (!clause?.trim())
             return;
+        // The balance and backslash checks run before the shared screen: it parses the fragment
+        // inside its own parentheses, so it cannot see a fragment that closes the parentheses the
+        // provider and the tenant hook splice it into.
         const dialect = this.dialectForProvider(provider);
         if (SQLParser.HasStackedStatements(clause, dialect)) {
             throw new Error(`Invalid ${label}: multiple statements are not permitted in client-supplied filters`);
         }
-        const wrapped = label === 'OrderBy'
-            ? `SELECT 1 FROM __mj_clause_screen ORDER BY ${clause}`
-            : `SELECT 1 FROM __mj_clause_screen WHERE (${clause})`;
-        const parser = new SQLParser(wrapped, dialect);
-        // A clause the provider checks again on its own (an aggregate expression) leaves text the parser
-        // cannot read to that per-item check instead of failing the whole request.
-        if (!parser.IsValid && options?.LeaveUnparseableToProvider)
-            return;
-        if (!parser.IsValid || parser.HasWriteStatement || parser.StatementKind !== 'select') {
-            throw new Error(`Invalid ${label}: not a safe read-only filter fragment — refusing under uncertainty`);
-        }
-        if (this.astContainsWriteNode(parser.AST)) {
-            throw new Error(`Invalid ${label}: write/DDL nested in a subquery is not permitted`);
+        const balance = IsBalancedSQLFragment(clause, dialect);
+        if (!balance.IsBalanced) {
+            throw new Error(`Invalid ${label}: ${balance.Reason}`);
         }
-        const allowed = this.entityBaseViewAllowList(provider);
-        const tables = SQLParser.ExtractTableRefs(wrapped, dialect);
-        for (const t of tables) {
-            const table = this.stripSqlIdent(t.TableName);
-            const schema = this.stripSqlIdent(t.SchemaName);
-            if (table.toLowerCase() === '__mj_clause_screen')
-                continue;
-            this.assertTableRefReadable(allowed, schema, table, label, user);
+        if (this.hasBackslashInQuotes(clause, dialect)) {
+            throw new Error(`Invalid ${label}: a backslash inside a quoted string or identifier is not permitted in client-supplied filters`);
         }
+        ClientClauseScreen.AssertClauseUsesEntityBaseViews(clause, label, provider?.Entities ?? [], dialect, user, options);
     }
     /**
      * SECURITY — screen for a FULL client-supplied SQL statement (ad-hoc query path). In addition
      * to the SELECT-only validation the caller performs, every table reference must resolve to an
-     * entity BaseView the acting user can read UNSCOPED. CTE names defined by the statement itself
-     * are excluded from the check. Fails closed: no user, or an unresolvable reference, refuses.
+     * entity BaseView the acting user can read UNSCOPED. A reference is excluded only when it reads a
+     * CTE that is in scope there (`StatementRelation.IsCTEReference`): unqualified, declared by its
+     * own SELECT or an enclosing one, and matched by the dialect's identifier rules. A name reserved
+     * for the SQL parser is refused before parsing (`ClientClauseScreen.AssertNoIdentifierAliasNames`).
+     * Fails closed: no user, or an unresolvable reference, refuses.
+     *
+     * The references come from a walk of the whole parse tree
+     * (`ClientClauseScreen.CollectStatementReads`). The statement is refused when that walk does not
+     * account for every SELECT in the text, or when a FROM item names no table (a table function or
+     * a row list).
      *
      * Entity CanRead is not unscoped base-view read authority: RunView narrows a granted read with
      * row-level security and denied-field projection, and raw SQL applies neither. Rather than try
@@ -786,6 +859,7 @@ export class ResolverBase {
             throw new Error(`Invalid ${label}: no acting user resolved for ad-hoc SQL — refusing`);
         }
         const dialect = this.dialectForProvider(provider);
+        ClientClauseScreen.AssertNoIdentifierAliasNames(sqlText, dialect, label);
         const parser = new SQLParser(sqlText, dialect);
         if (!parser.IsValid || parser.HasWriteStatement || parser.StatementKind !== 'select') {
             throw new Error(`Invalid ${label}: not a safe read-only statement — refusing under uncertainty`);
@@ -793,51 +867,20 @@ export class ResolverBase {
         if (this.astContainsWriteNode(parser.AST)) {
             throw new Error(`Invalid ${label}: write/DDL nested in a subquery is not permitted`);
         }
-        const cteNames = new Set();
-        this.collectCTENames(parser.AST, cteNames);
+        const reads = ClientClauseScreen.CollectStatementReads(parser);
+        ClientClauseScreen.AssertEverySelectAccountedFor(sqlText, dialect, reads, label);
         const allowed = this.entityBaseViewAllowList(provider);
-        const tables = SQLParser.ExtractTableRefs(sqlText, dialect);
-        for (const t of tables) {
-            const table = this.stripSqlIdent(t.TableName);
-            const schema = this.stripSqlIdent(t.SchemaName);
-            if (this.isUnqualifiedSchema(schema) && cteNames.has(table.toLowerCase()))
+        for (const relation of reads.Relations) {
+            if (relation.IsCTEReference)
                 continue;
-            const entity = this.assertTableRefReadable(allowed, schema, table, label, user);
-            this.assertUnscopedRead(entity, user, label);
+            const entity = ClientClauseScreen.AssertRelationReadable(allowed, relation, label, user);
+            if (entity)
+                this.assertUnscopedRead(entity, user, label);
         }
     }
-    /** Refuses an entity whose read is narrowed for this user by row-level security or field-level denials. */
+    /** Refuses an entity whose read is narrowed for this user; see `ClientClauseScreen.AssertUnscopedRead`. */
     assertUnscopedRead(entity, user, label) {
-        if (entity.GetEffectiveRowFilterWhereClause(user, EntityPermissionType.Read, '').length > 0) {
-            throw new Error(`Invalid ${label}: entity '${entity.Name}' is row-level-security filtered for you — ad-hoc SQL cannot apply that filter; use RunView`);
-        }
-        if (entity.GetDeniedReadFields(user).size > 0) {
-            throw new Error(`Invalid ${label}: entity '${entity.Name}' has fields you are not permitted to read — ad-hoc SQL cannot project them away; use RunView`);
-        }
-    }
-    /** Walks a parsed AST collecting the names of CTEs the statement itself defines. */
-    collectCTENames(node, names) {
-        if (!node || typeof node !== 'object')
-            return;
-        if (Array.isArray(node)) {
-            for (const n of node)
-                this.collectCTENames(n, names);
-            return;
-        }
-        const obj = node;
-        const withClause = obj.with;
-        if (Array.isArray(withClause)) {
-            for (const cte of withClause) {
-                const name = cte?.name;
-                if (typeof name === 'string')
-                    names.add(name.toLowerCase());
-                else if (name && typeof name === 'object' && typeof name.value === 'string') {
-                    names.add(name.value.toLowerCase());
-                }
-            }
-        }
-        for (const v of Object.values(obj))
-            this.collectCTENames(v, names);
+        ClientClauseScreen.AssertUnscopedRead(entity, user, label);
     }
     /**
      * Applies {@link assertClientClauseUsesEntityBaseViews} to every client-supplied clause
@@ -874,97 +917,30 @@ export class ResolverBase {
             this.assertClientClauseUsesEntityBaseViews(aggregate?.expression, 'Aggregate', provider, user, { LeaveUnparseableToProvider: true });
         }
     }
-    /** Same write-node walk as EDS `sqlReadOnlyScreen.astContainsWriteNode`. */
+    /**
+     * True when a string literal or quoted identifier in `clause`, read the way the database reads
+     * it, contains a backslash (see {@link assertClientClauseUsesEntityBaseViews}).
+     */
+    hasBackslashInQuotes(clause, dialect) {
+        return LexSQL(clause, dialect).some((t) => (t.Kind === 'string' || t.Kind === 'identifier') && t.Text.includes('\\'));
+    }
+    /** Write/DDL node walk shared with the clause screen; see `ClientClauseScreen.AstContainsWriteNode`. */
     astContainsWriteNode(node) {
-        if (!node || typeof node !== 'object')
-            return false;
-        if (Array.isArray(node))
-            return node.some((n) => this.astContainsWriteNode(n));
-        const obj = node;
-        const type = obj.type;
-        if (typeof type === 'string' && ResolverBase.WRITE_NODE_TYPES.has(type.toLowerCase())) {
-            return true;
-        }
-        return Object.values(obj).some((v) => this.astContainsWriteNode(v));
+        return ClientClauseScreen.AstContainsWriteNode(node);
     }
-    static { this.WRITE_NODE_TYPES = new Set([
-        'insert', 'update', 'delete', 'merge', 'replace', 'drop', 'create', 'alter', 'truncate',
-        'rename', 'call', 'exec', 'execute', 'grant', 'revoke', 'use', 'load', 'copy', 'do',
-    ]); }
     dialectForProvider(provider) {
-        const name = provider?.constructor?.name ?? '';
-        if (/postgres/i.test(name))
-            return new PostgreSQLDialect();
-        return new SQLServerDialect();
-    }
-    /** True for a reference with no schema — which `SQLParser.ExtractTableRefs` reports as `dbo`. */
-    isUnqualifiedSchema(schema) {
-        return !schema || schema.toLowerCase() === 'dbo';
+        return ClientClauseScreen.DialectFor(provider);
     }
-    stripSqlIdent(name) {
-        if (!name)
-            return '';
-        return name.replace(/^\[|\]$/g, '').replace(/^"|"$/g, '').replace(/^`|`$/g, '');
-    }
-    /**
-     * `bare` maps an unqualified view name to its entity, or to `null` when the name exists in
-     * more than one schema — the database, not this screen, would decide which one runs.
-     */
+    /** The entity base-view allow-list for a provider's entities. */
     entityBaseViewAllowList(provider) {
-        const qualified = new Map();
-        const bare = new Map();
-        const entities = provider?.Entities ?? [];
-        for (const e of entities) {
-            const view = this.stripSqlIdent(e.BaseView);
-            if (!view)
-                continue;
-            const schema = this.stripSqlIdent(e.SchemaName);
-            const bareKey = view.toLowerCase();
-            bare.set(bareKey, bare.has(bareKey) ? null : e);
-            if (schema)
-                qualified.set(`${schema}.${view}`.toLowerCase(), e);
-        }
-        return { qualified, bare };
-    }
-    /**
-     * SECURITY — resolves a table reference against the entity BaseView allow-list and, when an
-     * acting user is supplied, additionally requires that user to hold CanRead on the referenced
-     * entity. Base views do not embed RLS and entity permissions are otherwise checked only on
-     * the TOP entity of a request, so without this check a subquery (or ad-hoc query) could read
-     * entities the caller has no read grant on.
-     *
-     * A schema-qualified reference must match that exact schema — `secret.vwFoo` never resolves
-     * through another schema's `vwFoo`. An unqualified reference resolves only when the view name
-     * is unique across schemas; an ambiguous one must be qualified, because the database's
-     * default-schema resolution, not this screen, would pick which view actually runs.
-     *
-     * `SQLParser.ExtractTableRefs` reports an unqualified reference as schema `dbo`, so `dbo` is
-     * indistinguishable from "no schema" here and both take the unqualified path (an exact
-     * `dbo.<view>` entity wins first).
-     */
-    assertTableRefReadable(allowed, schema, table, label, user) {
-        const qualified = allowed.qualified.get(`${schema}.${table}`.toLowerCase());
-        const entity = this.isUnqualifiedSchema(schema) ? qualified ?? allowed.bare.get(table.toLowerCase()) : qualified;
-        if (entity === null) {
-            throw new Error(`Invalid ${label}: '${table}' is a base view in more than one schema — qualify it with its schema`);
-        }
-        if (!entity) {
-            throw new Error(`Invalid ${label}: subquery must use an entity base view, not '${schema ? schema + '.' : ''}${table}'`);
-        }
-        if (user) {
-            const perms = entity.GetUserPermisions(user);
-            if (!perms.CanRead) {
-                throw new Error(`Invalid ${label}: you do not have read permission on entity '${entity.Name}' referenced by '${schema ? schema + '.' : ''}${table}'`);
-            }
-        }
-        return entity;
+        return ClientClauseScreen.BuildEntityBaseViewAllowList(provider?.Entities ?? []);
     }
     /**
      * Optimized RunViewGenericInternal implementation with:
      * - Field filtering at source (Fix #7)
      * - Improved error handling (Fix #9)
      */
-    async RunViewGenericInternal(provider, viewInfo, extraFilter, orderBy, userSearchString, excludeUserViewRunID, overrideExcludeFilter, saveViewResults, fields, ignoreMaxRows, excludeDataFromAllPriorViewRuns, forceAuditLog, auditLogDescription, resultType, userPayload, maxRows, startRow, aggregates, afterKey, bypassCache, dataSource, includeBinaryFields) {
+    async RunViewGenericInternal(provider, viewInfo, extraFilter, orderBy, userSearchString, excludeUserViewRunID, overrideExcludeFilter, saveViewResults, fields, ignoreMaxRows, excludeDataFromAllPriorViewRuns, forceAuditLog, auditLogDescription, resultType, userPayload, maxRows, startRow, aggregates, afterKey, bypassCache, dataSource, includeBinaryFields, alternateBaseView, properties) {
         try {
             if (!viewInfo || !userPayload)
                 return null;
@@ -1010,6 +986,7 @@ export class ResolverBase {
             const result = await rv.RunView({
                 ViewID: viewInfo.ID,
                 ViewName: viewInfo.Name,
+                ViewEntity: viewInfo.ID ? viewInfo : undefined,
                 EntityName: viewInfo.Entity,
                 ExtraFilter: extraFilter,
                 OrderBy: orderBy,
@@ -1030,7 +1007,18 @@ export class ResolverBase {
                 BypassCache: bypassCache,
                 DataSource: dataSource,
                 IncludeBinaryFields: includeBinaryFields,
+                AlternateBaseView: alternateBaseView,
+                Properties: properties,
+                TimeZone: userPayload?.TimeZone,
             }, user);
+            if (result && typeof result === 'object') {
+                Object.defineProperty(result, '_resolvedViewEntity', {
+                    value: viewInfo,
+                    enumerable: false,
+                    configurable: true,
+                    writable: true,
+                });
+            }
             // Log aggregate results for debugging
             if (aggregates?.length) {
                 LogStatus(`[ResolverBase] RunView result aggregate info: entityName=${viewInfo.Entity}, hasAggregateResults=${!!result?.AggregateResults}, aggregateResultCount=${result?.AggregateResults?.length || 0}, aggregateExecutionTime=${result?.AggregateExecutionTime}, aggregateResults=${JSON.stringify(result?.AggregateResults)}`);
@@ -1057,7 +1045,7 @@ export class ResolverBase {
             if (result?.Success && result.Results?.length) {
                 result.Results = result.Results.map(r => mapper.MapFields({ ...r }));
                 // Filter encrypted fields before sending to API client
-                await this.ArrayFilterEncryptedFieldsForAPI(viewInfo.Entity, result.Results, user);
+                await this.ArrayFilterEncryptedFieldsForAPI(viewInfo.Entity, result.Results, user, md);
             }
             return result;
         }
@@ -1141,6 +1129,7 @@ export class ResolverBase {
                 runViewParams.push({
                     ViewID: param.viewInfo.ID,
                     ViewName: param.viewInfo.Name,
+                    ViewEntity: param.viewInfo.ID ? param.viewInfo : undefined,
                     EntityName: param.viewInfo.Entity,
                     ExtraFilter: param.extraFilter,
                     OrderBy: param.orderBy,
@@ -1161,6 +1150,9 @@ export class ResolverBase {
                     BypassCache: param.bypassCache,
                     DataSource: param.dataSource,
                     IncludeBinaryFields: param.includeBinaryFields,
+                    AlternateBaseView: param.alternateBaseView,
+                    Properties: param.properties,
+                    TimeZone: param.userPayload?.TimeZone,
                 });
             }
             // Fix #4: Run views in a single batch through RunViews
@@ -1177,7 +1169,7 @@ export class ResolverBase {
                     // Use the corresponding param's entity name
                     const entityName = params[i]?.viewInfo?.Entity;
                     if (entityName && contextUser) {
-                        await this.ArrayFilterEncryptedFieldsForAPI(entityName, runViewResult.Results, contextUser);
+                        await this.ArrayFilterEncryptedFieldsForAPI(entityName, runViewResult.Results, contextUser, md);
                     }
                 }
             }
@@ -1296,8 +1288,9 @@ export class ResolverBase {
      * skip redundant re-fetches (it already handled the event locally).
      *
      * The row itself rides along ONLY for entities opted in via
-     * `cacheSettings.recordDataBroadcastEntities` — this event reaches every connected client
-     * unfiltered, so the row would otherwise be readable by sessions that could not read the record.
+     * `cacheSettings.recordDataBroadcastEntities`, and never for one under field-level security —
+     * this event reaches every connected client unprojected, so the row would otherwise be readable
+     * by sessions that could not read the record or its restricted fields.
      */
     PublishCacheInvalidation(entityObject, action, userPayload) {
         const entityName = entityObject.EntityInfo.Name;
@@ -1308,23 +1301,25 @@ export class ResolverBase {
             sourceServerId: MJGlobal.Instance.ProcessUUID,
             timestamp: new Date(),
             originSessionId: userPayload?.sessionId || null,
-            recordData: action === 'save' && MayBroadcastRecordData(entityName)
+            recordData: action === 'save' && MayBroadcastRecordData(entityName, entityObject.EntityInfo)
+                // fls-guard: MayBroadcastRecordData refuses FLS entities and Record Changes
                 ? JSON.stringify(entityObject.GetAll())
                 : undefined,
         });
     }
     /**
      * Publishes a push-status update to the client on {@link PUSH_STATUS_UPDATES_TOPIC}, stamping the
-     * authenticated owner's user ID from `userPayload` so the subscription filter can bind delivery
-     * to identity (see B49 / `statusUpdatesFilter`). The ergonomic wrapper every resolver should use
-     * instead of calling `pubSub.publish` on the topic directly — it makes omitting identity
-     * impossible. Non-resolver publishers (services, the liveness heartbeat) call the shared
-     * `publishStatusUpdate()` function directly with an explicit `ownerUserId`.
+     * owner key of `userPayload` (`StatusUpdateOwnerID`: the request's user, or the widget guest an
+     * elevated payload stands in for) so the subscription filter can bind delivery to identity (see B49 /
+     * `StatusUpdatesFilter`). The ergonomic wrapper every resolver should use instead of calling
+     * `pubSub.publish` on the topic directly — it makes omitting identity impossible. Non-resolver
+     * publishers (services, the liveness heartbeat) call the shared `PublishStatusUpdate()` function
+     * directly with an explicit `ownerUserId`.
      */
     PublishStatusUpdate(pubSub, sessionId, message, userPayload) {
         PublishStatusUpdate(pubSub, {
             sessionId,
-            ownerUserId: userPayload?.userRecord?.ID ?? '',
+            ownerUserId: StatusUpdateOwnerID(userPayload),
             message,
         });
     }
@@ -1344,28 +1339,50 @@ export class ResolverBase {
                     if (baseEntity?.EntityInfo?.Name !== uniqueKey) {
                         return;
                     }
-                    const baseEntityValues = baseEntity ? baseEntity.GetAll() : null;
+                    const baseEntityValues = baseEntity ? this.EntityEventPayload(baseEntity, event.args instanceof BaseEntityEvent ? event.args.ChangedFieldNames : undefined) : null;
                     const eventToLog = { entityName: entityObject.EntityInfo.Name, baseEntity: baseEntityValues, event: event.event, eventCode: event.eventCode };
                     LogDebug(`ResolverBase.ListenForEntityMessages: Received Event from within MJGlobal.Instance.GetEventListener() callback. Will call EmitCloudEvent() next\nEvent data:\n${JSON.stringify(eventToLog)}`);
                     await this.EmitCloudEvent(event);
                     LogDebug(`ResolverBase.ListenForEntityMessages: EmitCloudEvent() completed successfully`);
-                    if (event.args && event.args instanceof BaseEntityEvent) {
-                        const baseEntityEvent = event.args;
-                        // message from our entity object, relay it to the client
+                    if (event.args && event.args instanceof BaseEntityEvent && this.EntityEventBelongsToSession(event.args, userPayload)) {
+                        // message from an entity object of this session's user, relay it to the client
                         LogDebug('ResolverBase.ListenForEntityMessages: About to publish PUSH_STATUS_UPDATES_TOPIC');
-                        this.PublishStatusUpdate(pubSub, userPayload.sessionId, JSON.stringify({
-                            status: 'OK',
-                            type: 'EntityObjectStatusMessage',
-                            entityName: baseEntityEvent.baseEntity.EntityInfo.Name,
-                            primaryKey: baseEntityEvent.baseEntity.PrimaryKey,
-                            message: event.args.payload,
-                        }), userPayload);
+                        this.PublishStatusUpdate(pubSub, userPayload.sessionId, this.EntityStatusMessage(event.args), userPayload);
                     }
                 }
             });
             this.eventSubscriptions.set(uniqueKey, theSub);
         }
     }
+    /**
+     * Whether an entity event may be relayed to the session whose call created the listener. The
+     * listener is shared by every caller in the process for that entity, so an event raised by an
+     * object loaded for another user (or for the system user) is never relayed to this session.
+     */
+    EntityEventBelongsToSession(event, userPayload) {
+        const sessionUserId = userPayload?.userRecord?.ID;
+        const objectUserId = event.baseEntity?.ContextCurrentUser?.ID;
+        return Boolean(sessionUserId && objectUserId && UUIDsEqual(sessionUserId, objectUserId));
+    }
+    /**
+     * The status message relayed for an entity event: the entity, key and event type. The event's
+     * payload is included only when it cannot carry record values: never for a delete (its payload
+     * is the whole deleted row), an entity under field-level security, or `MJ: Record Changes`.
+     */
+    EntityStatusMessage(event) {
+        const entityInfo = event.baseEntity.EntityInfo;
+        const mayCarryPayload = event.type !== 'delete'
+            && !entityInfo.FieldLevelSecurityApplies
+            && !RecordChangeFieldSecurityProjector.IsRecordChangesEntity(entityInfo);
+        return JSON.stringify({
+            status: 'OK',
+            type: 'EntityObjectStatusMessage',
+            entityName: entityInfo.Name,
+            primaryKey: event.baseEntity.PrimaryKey,
+            eventType: event.type,
+            message: mayCarryPayload ? event.payload : undefined,
+        });
+    }
     /**
      * IS-A PROMOTION over the wire: an EXISTING parent record gaining a subtype — an Animal that is
      * now also a Dog. It arrives as the CHILD's create mutation carrying the existing parent's
@@ -1439,6 +1456,9 @@ export class ResolverBase {
             // IS-A promotion: bind the new child to its EXISTING parent row BEFORE the field
             // assignments, so values the client sent for parent fields land on the loaded parent
             // (as an update) instead of being wiped by the load.
+            // Field-level security: refuse a key the caller may not read, or that names no field, before
+            // anything is applied (the same gate as the update path).
+            AssertClientInputWritableForUser(entityObject.EntityInfo, fieldsForSet, this.GetUserFromPayload(userPayload));
             await this.attachToExistingParentIfPromotion(entityObject, fieldsForSet);
             entityObject.SetMany(fieldsForSet);
             // Reconstruct the client-side restore context, if any, on this server
@@ -1452,6 +1472,7 @@ export class ResolverBase {
                 // Cache invalidation is now handled globally by the MJGlobal listener in index.ts
                 const contextUser = this.GetUserFromPayload(userPayload);
                 // MapFieldNamesToCodeNames now handles encryption filtering as well
+                // fls-guard: MapFieldNamesToCodeNames drops the fields the caller may not read
                 return await this.MapFieldNamesToCodeNames(entityName, entityObject.GetAll(), contextUser);
             }
             // save failed, throw error with message
@@ -1489,12 +1510,11 @@ export class ResolverBase {
                 }
             });
             // Field-level security: any value the client sends for a field it cannot READ is
-            // fabricated by construction (the field was stripped from every payload the client ever
-            // received), so strip such values before anything applies them. When any field is
-            // denied we also force the truth-load branch below — client OldValues for denied fields
-            // are equally fabricated, so hydrating from them (the no-DB-load path) would write
-            // fabricated state into the denied columns on save.
-            const hasDeniedReadFields = this.StripDeniedReadFieldsFromClientInput(entityInfo, userInfo, input, clientNewValues);
+            // fabricated by construction (the field was absent from every payload the client ever
+            // received), so the input is refused before anything applies it. When any field is
+            // denied we also force the truth-load branch below, so the denied columns keep what the
+            // database holds rather than anything derived from the client's OldValues.
+            const hasDeniedReadFields = this.AssertClientInputFieldSecurity(entityInfo, userInfo, input, clientNewValues);
             // The audit-trail equivalent. Its `true` matters most on THIS entity: 'MJ: Record Changes'
             // has TrackRecordChanges off, so without it a client sending OldValues takes the branch below
             // that hydrates from those values — never loading what the database actually holds.
@@ -1550,6 +1570,7 @@ export class ResolverBase {
                 await this.AfterUpdate(provider, input); // fire event
                 // Cache invalidation is now handled globally by the MJGlobal listener in index.ts
                 // MapFieldNamesToCodeNames now handles encryption filtering as well
+                // fls-guard: MapFieldNamesToCodeNames drops the fields the caller may not read
                 return await this.MapFieldNamesToCodeNames(entityName, entityObject.GetAll(), userInfo);
             }
             else {
@@ -1571,15 +1592,37 @@ export class ResolverBase {
                 extensions: { code: 'SAVE_ENTITY_ERROR', entityName },
             });
     }
+    /**
+     * Checks whether `oldValues` (`input.OldValues___`) contains every writable in-table field of
+     * `entityInfo` (plus primary keys).
+     *
+     * With the delta-only `Save()` wire protocol, `GraphQLDataProvider.Save()` sends only primary keys
+     * and dirty writable fields in `vars.input` and `OldValues___` on normal updates. Hydrating an
+     * entity directly from a partial-delta `OldValues___` via `entityObject.LoadFromData(oldValues)`
+     * (without first loading the authoritative row via `InnerLoad`) would leave every untouched column
+     * `NotLoaded = true` (or `null`), causing `spUpdate` or custom `Validate()` hooks to see incomplete
+     * state. Returning `false` for partial deltas ensures {@link MustLoadTruthFromDatabase} routes
+     * delta updates through `InnerLoad(cKey)` + {@link TestAndSetClientOldValuesToDBValues}, even on
+     * entities with `TrackRecordChanges === false`.
+     */
+    hasCompleteOldValues(entityInfo, oldValues) {
+        if (!oldValues || oldValues.length === 0) {
+            return false;
+        }
+        const providedKeys = new Set(oldValues.map((kv) => kv.Key));
+        return entityInfo.Fields.every((f) => (!f.IsPrimaryKey && (f.ReadOnly || f.IsVirtual)) || providedKeys.has(f.Name) || providedKeys.has(f.CodeName));
+    }
     /**
      * Whether `UpdateRecord` must hydrate the entity from the DATABASE rather than from the
      * client's `OldValues___`.
      *
-     * The `OldValues___` path exists as an optimization: when nothing needs the true prior state,
-     * the client already holds it and a round trip is wasted. Each condition below is a reason
-     * that assumption fails.
+     * The `OldValues___` path exists as an optimization when a client supplies the complete pre-save
+     * record (e.g. `IgnoreDirtyState: true`) and nothing else requires the database's authoritative prior
+     * state. Under the delta-only `Save()` wire protocol, normal updates send only primary keys and dirty
+     * writable fields in `OldValues___`, so {@link hasCompleteOldValues} returns `false` and forces the
+     * database load (`InnerLoad`) so untouched columns retain their stored values.
      *
-     * `EnableFieldLevelSecurity` is the security-critical one, and it is NOT redundant with
+     * `FieldLevelSecurityApplies` (own flag or an IS-A ancestor's) is the security-critical one, and it is NOT redundant with
      * `hasDeniedReadFields`. That flag reports READ denials, and the canonical FLS configuration is
      * Read Allow + Update Deny — which leaves it false. Such a caller would be hydrated from its own
      * `OldValues___`, and a value it supplies there for an update-denied field arrives through
@@ -1603,6 +1646,16 @@ export class ResolverBase {
      * caller pin forged audit columns as both old and new values. It doesn't track its own changes, so
      * nothing else forces the load.
      *
+     * `MJ: Data Context Items` always loads from the database for the same reason: its server class
+     * lets only an administrator save an item that holds SQL, and decides that from the item's `Type`
+     * and `SQL`. Hydrated from OldValues, a client could leave both out, and the stored procedure would
+     * keep the stored SQL item while the rule saw none.
+     *
+     * `MJ: Conversation Details` always loads for the same reason: its write gate decides from the stored
+     * row (who wrote a person's message, its role, the owner's rating), and an OldValues-hydrated entity
+     * would let a grantee claim to be a message's author while rewriting it. See
+     * {@link ENTITIES_THAT_ALWAYS_LOAD_STORED_ROW}.
+     *
      * A caller under an Update row filter (a role's Update RLS filter or an API-key row filter) always
      * loads from the database too (#4919). The save's post-image check skips its query when no column
      * the filter reads is dirty, and dirtiness measured against client OldValues is the caller's to
@@ -1613,64 +1666,47 @@ export class ResolverBase {
      */
     MustLoadTruthFromDatabase(entityInfo, input, hasDeniedReadFields, hasNarrowedAuditPayload, user) {
         return (entityInfo.TrackRecordChanges ||
-            entityInfo.Name.trim().toLowerCase() === 'mj: record changes' ||
-            !input.OldValues___ ||
+            ENTITIES_THAT_ALWAYS_LOAD_STORED_ROW.has(entityInfo.Name.trim().toLowerCase()) ||
+            !this.hasCompleteOldValues(entityInfo, input.OldValues___) ||
             hasDeniedReadFields ||
             hasNarrowedAuditPayload ||
-            entityInfo.EnableFieldLevelSecurity ||
+            entityInfo.FieldLevelSecurityApplies ||
             !user ||
             entityInfo.GetEffectiveRowFilterWhereClause(user, EntityPermissionType.Update, '').length > 0);
     }
     /**
-     * Field-level security guard for the update path.
+     * Field-level security gate on the update path's client input.
      *
-     * Every denied-read field is stripped — new values AND OldValues. A field the user cannot
-     * read was absent from every payload that client ever received, so any value coming back for
-     * it is the transport's invention rather than user intent, and applying it would silently
-     * overwrite the real column. Stripping is what makes "load a record, edit an unrelated field,
-     * save" safe for a restricted user.
+     * For a caller denied at least one field on the entity, refuses (with a `FieldSecurityError`)
+     * any key in the new values or in `OldValues___` that names a field the caller cannot READ, or
+     * that names no field at all, with the same message for both (see
+     * `AssertClientInputWritableForUser`), so the refusal does not reveal which columns exist.
      *
-     * There is no split by update permission: Read is required for Update, so a user denied read
-     * is denied update too and denied-read ∩ denied-update is just denied-read.
+     * Refused rather than dropped: a field the caller cannot read was absent from every payload the
+     * client received, so a value for it can only be fabricated. A well-behaved client never sends
+     * one (it omits fields it did not load), so ordinary traffic is unaffected.
      *
-     * Silent narrowing, not rejection — consistent with the output projection the client already
-     * experiences, and with the ambiguous-error rule (naming the field would confirm it exists
-     * and is restricted).
+     * There is no split by update permission: Read is required for Update, so a user denied read is
+     * denied update too.
      *
-     * Returns true when the user has a non-empty denied-read set on this entity. The caller
-     * must then hydrate the entity from the DATABASE (never from client OldValues), so denied
-     * fields hold true values that an omitted key leaves untouched.
+     * Returns true when the user has a non-empty denied-read set on this entity. The caller must
+     * then hydrate the entity from the DATABASE (never from client OldValues), so denied fields hold
+     * true values the client input never touches.
      */
-    StripDeniedReadFieldsFromClientInput(entityInfo, userInfo, input, clientNewValues) {
-        if (!entityInfo.EnableFieldLevelSecurity || !userInfo) {
+    AssertClientInputFieldSecurity(entityInfo, userInfo, input, clientNewValues) {
+        if (!entityInfo.FieldLevelSecurityApplies || !userInfo) {
             return false;
         }
-        const deniedReadNames = entityInfo.GetDeniedReadFields(userInfo);
-        if (deniedReadNames.size === 0) {
+        if (entityInfo.GetDeniedReadFields(userInfo).size === 0) {
             return false;
         }
-        // Input keys are entity CodeNames (post ReverseMapInputFieldNames); the denied set holds
-        // lowercased field Names — bridge via the field metadata once.
-        const deniedReadCodeNames = new Set();
-        for (const field of entityInfo.Fields) {
-            if (deniedReadNames.has(field.Name.trim().toLowerCase())) {
-                deniedReadCodeNames.add(field.CodeName.trim().toLowerCase());
-            }
-        }
-        const stripped = [];
-        for (const key of Object.keys(clientNewValues)) {
-            if (deniedReadCodeNames.has(key.trim().toLowerCase())) {
-                delete clientNewValues[key];
-                delete input[key];
-                stripped.push(key);
-            }
-        }
+        AssertClientInputWritableForUser(entityInfo, clientNewValues, userInfo);
         if (Array.isArray(input.OldValues___)) {
-            input.OldValues___ = input.OldValues___.filter((item) => !deniedReadCodeNames.has(String(item.Key).trim().toLowerCase()));
-        }
-        if (stripped.length > 0) {
-            LogDebug(`[FieldSecurity] UpdateRecord on '${entityInfo.Name}' for user ${userInfo.Email}: ` +
-                `stripped client-sent value(s) for denied-read field(s) ${stripped.join(', ')}`);
+            const oldValueKeys = {};
+            for (const item of input.OldValues___) {
+                oldValueKeys[String(item.Key)] = null;
+            }
+            AssertClientInputWritableForUser(entityInfo, oldValueKeys, userInfo);
         }
         return true;
     }
@@ -1765,41 +1801,59 @@ export class ResolverBase {
         }
     }
     /**
-     * This routine compares the OldValues property in the input object to the values in the DB that we just loaded. If there are differences, we need to check to see if the client
-     * is trying to update any of those fields (e.g. overlap). If there is overlap, we throw an error. If there is no overlap, we can proceed with the update even if the DB Values
-     * and the ClientOldValues are not 100% the same, so long as there is no overlap in the specific FIELDS that are different.
+     * Compares the client-supplied `OldValues___` array in `input` against the authoritative database
+     * values just loaded onto `entityObject` via `InnerLoad`, checks for overlapping concurrent field
+     * modifications, and then applies `clientNewValues` onto `entityObject` via `SetMany`.
      *
-     * ASSUMES: input object has an OldValues___ property that is an array of Key/Value pairs that represent the old values of the record that the client is trying to update.
+     * Supports both full-record and delta-only `OldValues___` payloads: only keys present in
+     * `input.OldValues___` (e.g. primary keys + dirty writable fields) are compared against `dbValues`,
+     * and `entityObject.SetMany(clientNewValues)` mutates only the fields sent in `clientNewValues`
+     * while preserving all untouched DB-loaded fields on `entityObject`.
+     *
+     * ASSUMES: `input` has an `OldValues___` property that is an array of Key/Value pairs representing
+     * the pre-mutation values of the fields the client is updating.
      */
+    /**
+     * Resolves a field on `entityInfo` by `CodeName` or `Name` in $O(1)$ via `FieldByCodeName` /
+     * `FieldByName` when available on `EntityInfo`, falling back to `.Fields.find()` for test stubs.
+     */
+    findEntityFieldByCodeNameOrName(entityInfo, key) {
+        if (typeof entityInfo.FieldByCodeName === 'function') {
+            return entityInfo.FieldByCodeName(key) ?? entityInfo.FieldByName(key);
+        }
+        return entityInfo.Fields.find((f) => f.CodeName === key || f.Name === key);
+    }
     async TestAndSetClientOldValuesToDBValues(input, clientNewValues, entityObject, contextUser) {
         // we have OldValues, so we need to compare them to the values we just loaded from the DB
         const clientOldValues = {};
         // for each item in the oldValues array, add it to the clientOldValues object
         input.OldValues___.forEach((item) => {
             // we need to do a quick transform on the values to make sure they match the TS Type for the given field because item.Value will always be a string
-            const field = entityObject.EntityInfo.Fields.find((f) => f.CodeName === item.Key);
+            const field = this.findEntityFieldByCodeNameOrName(entityObject.EntityInfo, item.Key);
             const val = this.ClientOldValueToFieldValue(field, item.Value);
             clientOldValues[item.Key] = val;
         });
         // clientOldValues now has all of the oldValues the CLIENT passed us. Now we need to build the same kind of object
         // with the DB values
+        // fls-guard: compared on the server only, never returned
         const dbValues = entityObject.GetAll();
         // now we need to compare clientOldValues and dbValues and have a new array that has entries for any differences and have FieldName, clientOldValue and dbValue as properties
         const dbDifferences = [];
         Object.keys(clientOldValues).forEach((key) => {
-            const f = entityObject.EntityInfo.Fields.find((f) => f.CodeName === key);
+            const f = this.findEntityFieldByCodeNameOrName(entityObject.EntityInfo, key);
+            const dbVal = f && f.Name in dbValues ? dbValues[f.Name] : dbValues[key];
             let different = false;
             switch (typeof clientOldValues[key]) {
                 case 'number':
-                    different = clientOldValues[key] !== dbValues[key];
+                    different = clientOldValues[key] !== dbVal;
                     break;
                 case 'boolean':
-                    different = clientOldValues[key] !== dbValues[key];
+                    different = clientOldValues[key] !== dbVal;
                     break;
                 case 'object':
                     if (clientOldValues[key] instanceof Date) {
                         const clientDate = clientOldValues[key];
-                        const dbDate = dbValues[key];
+                        const dbDate = dbVal;
                         if (dbDate == null || !(dbDate instanceof Date)) {
                             different = true;
                         }
@@ -1818,11 +1872,11 @@ export class ResolverBase {
                         }
                     }
                     else if (clientOldValues[key] === null) {
-                        different = dbValues[key] !== null;
+                        different = dbVal !== null;
                     }
                     break;
                 default:
-                    different = clientOldValues[key] !== dbValues[key];
+                    different = clientOldValues[key] !== dbVal;
                     break;
             }
             if (different && f && !f.ReadOnly) {
@@ -1830,7 +1884,7 @@ export class ResolverBase {
                 dbDifferences.push({
                     FieldName: key,
                     ClientOldValue: clientOldValues[key],
-                    DBValue: dbValues[key],
+                    DBValue: dbVal,
                 });
             }
         });
@@ -1839,8 +1893,8 @@ export class ResolverBase {
             // first step is to get clientNewValues into an object that is like clientOldValues, get the diff and then compare that diff to the differences array that shows diff between DB and ClientOld
             const clientDifferences = [];
             Object.keys(clientOldValues).forEach((key) => {
-                const f = entityObject.EntityInfo.Fields.find((f) => f.CodeName === key);
-                if (clientOldValues[key] !== clientNewValues[key] && f && f.AllowUpdateAPI && !f.IsPrimaryKey) {
+                const f = this.findEntityFieldByCodeNameOrName(entityObject.EntityInfo, key);
+                if (key in clientNewValues && clientOldValues[key] !== clientNewValues[key] && f && f.AllowUpdateAPI && !f.IsPrimaryKey) {
                     // only include updateable fields
                     clientDifferences.push({
                         FieldName: key,
@@ -1851,7 +1905,8 @@ export class ResolverBase {
             });
             // now we have clientDifferences which shows what the client thinks they are changing. And, we have the dbDifferences array that shows changes between the clientOldValues and the dbValues
             // if there is ANY overlap in the FIELDS that appear in both arrays, we need to log a warning but allow the save to continue
-            const overlap = clientDifferences.filter((cd) => dbDifferences.find((dd) => dd.FieldName === cd.FieldName));
+            const dbDiffFieldNames = new Set(dbDifferences.map((dd) => dd.FieldName));
+            const overlap = clientDifferences.filter((cd) => dbDiffFieldNames.has(cd.FieldName));
             if (overlap.length > 0) {
                 const msg = {
                     Message: 'Inconsistency between old values provided for changed fields, and the values of one or more of those fields in the database. Save operation continued with warning.',
@@ -1861,30 +1916,31 @@ export class ResolverBase {
                 };
                 // Log as warning to console and ErrorLog table instead of throwing error
                 console.warn('Entity save inconsistency detected but allowing save to continue:', JSON.stringify(msg));
-                LogError({
-                    service: 'ResolverBase',
-                    operation: 'TestAndSetClientOldValuesToDBValues',
-                    error: `Entity save inconsistency detected: ${JSON.stringify(msg)}`,
-                    details: {
+                LogErrorEx({
+                    message: `Entity save inconsistency detected: ${JSON.stringify(msg)}`,
+                    severity: 'warning',
+                    category: 'ResolverBase.TestAndSetClientOldValuesToDBValues',
+                    metadata: {
                         entityName: entityObject.EntityInfo.Name,
                         clientDifferences: clientDifferences,
                         dbDifferences: dbDifferences,
-                        overlap: overlap
-                    }
+                        overlap: overlap,
+                    },
                 });
                 // Create ErrorLog record in the database — use the entity's bound provider so the
                 // ErrorLog write goes to the same connection as the entity that triggered it.
                 try {
                     const md = entityObject.ProviderToUse;
                     const errorLogEntity = await md.GetEntityObject('MJ: Error Logs', contextUser);
-                    errorLogEntity.Code = 'ENTITY_SAVE_INCONSISTENCY';
+                    // Code is NCHAR(20); a longer value is rejected at the database
+                    errorLogEntity.Code = 'SAVE_INCONSISTENCY';
                     errorLogEntity.Message = `Entity save inconsistency detected for ${entityObject.EntityInfo.Name}: ${JSON.stringify(msg)}`;
                     errorLogEntity.Status = 'Warning';
                     errorLogEntity.Category = 'Entity Save';
                     errorLogEntity.CreatedBy = contextUser.Email || contextUser.Name;
                     const saveResult = await errorLogEntity.Save();
                     if (!saveResult) {
-                        console.error('Failed to save ErrorLog record');
+                        console.error(`Failed to save ErrorLog record for ${entityObject.EntityInfo.Name}: ${errorLogEntity.LatestResult?.CompleteMessage}`);
                     }
                 }
                 catch (errorLogError) {
@@ -1913,7 +1969,10 @@ export class ResolverBase {
                     extensions: { code: 'LOAD_ENTITY_ERROR', entityName },
                 });
             }
-            const returnValue = entityObject.GetAll(); // grab the values before we delete so we can return last state before delete if we are successful.
+            // Grab the values before we delete so we can return the last state if the delete succeeds,
+            // projected for the caller in case the object holds a column they may not read.
+            // fls-guard: projected by ProjectEntityValuesForUser
+            const returnValue = ProjectEntityValuesForUser(provider, entityObject.EntityInfo, entityObject.GetAll(), this.GetUserFromPayload(userPayload));
             this.ListenForEntityMessages(entityObject, pubSub, userPayload);
             if (await entityObject.Delete(options)) {
                 await this.AfterDelete(provider, key); // fire event