@memberjunction/server 6.2.0-edge.4 → 6.2.0-edge.6

package/src/resolvers/GetDataContextDataResolver.ts

@@ -1,9 +1,13 @@
 import { Arg, Ctx, Field, ObjectType, Query, Resolver } from "type-graphql";
+import type { DatabaseProviderBase, UserInfo } from "@memberjunction/core";
+import { IsValidUUID, UUIDsEqual } from "@memberjunction/global";
+import { DataContext, DataContextItem } from "@memberjunction/data-context";
+import { MJDataContextEntity, MJDataContextItemEntity } from "@memberjunction/core-entities";
+import { RenderPipeline } from "@memberjunction/generic-database-provider";
 import { AppContext } from "../types.js";
-import { DataContext } from "@memberjunction/data-context";
-import { GetReadOnlyDataSource, GetReadOnlyProvider } from "../util.js";
-import { MJDataContextItemEntity } from "@memberjunction/core-entities";
+import { GetReadOnlyProvider } from "../util.js";
 import { ResolverBase } from "../generic/ResolverBase.js";
+import { IsScopeLimitedPrincipal } from "../auth/scopeLimitedPrincipal.js";
 
 @ObjectType()
 export class GetDataContextItemDataOutputType {
@@ -39,6 +43,28 @@ export class GetDataContextDataOutputType {
 }
 
 
+/** The outcome of loading one data context item: its data as JSON, or why it has none. */
+interface ItemOutcome {
+    Result: string | null;
+    Error: string | null;
+}
+
+/** Which `sql` items of a data context may run: the read-only provider, and each refused item's reason. */
+interface SQLItemGate {
+    Provider: DatabaseProviderBase | null;
+    Refusals: Map<DataContextItem, string>;
+}
+
+/**
+ * Loads the data of data contexts and their items.
+ *
+ * Items of type `sql` hold raw SQL, which is held to the rules ExecuteAdhocQuery applies to
+ * caller-supplied SQL. It runs only for the data context's owner or an administrator (Owner-type
+ * user), never for a scope-limited session, only on the read-only provider, and only as a single read
+ * statement over entity base views the caller may read in full. A SQL item that may not run is
+ * refused on its own, and the other items still load. Items of the other types load through entity
+ * permissions for the calling user.
+ */
 @Resolver()
 export class GetDataContextDataResolver extends ResolverBase {
     /**
@@ -52,30 +78,25 @@ export class GetDataContextDataResolver extends ResolverBase {
     ) {
         // Check API key scope authorization for data context read
         await this.CheckAPIKeyScopeAuthorization('datacontext:read', DataContextItemID, appCtx.userPayload);
+        if (!IsValidUUID(DataContextItemID)) {
+            return { Success: false, ErrorMessage: 'DataContextItemID must be a UUID', Result: null };
+        }
 
         try {
-            const ds = GetReadOnlyDataSource(appCtx.dataSources, {
-                allowFallbackToReadWrite: true,
-            })
+            const user: UserInfo = appCtx.userPayload.userRecord;
             const md = GetReadOnlyProvider(appCtx.providers, {allowFallbackToReadWrite: true});
-            const dciData = await md.GetEntityObject<MJDataContextItemEntity>("MJ: Data Context Items", appCtx.userPayload.userRecord);
+            const dciData = await md.GetEntityObject<MJDataContextItemEntity>("MJ: Data Context Items", user);
             if (await dciData.Load(DataContextItemID)) {
                 const dci = DataContext.CreateDataContextItem(); // use class factory to get whatever lowest level sub-class is registered
-                await dci.LoadMetadataFromEntityRecord(dciData, md, appCtx.userPayload.userRecord);
+                await dci.LoadMetadataFromEntityRecord(dciData, md, user);
+                const ownerID = dci.Type === 'sql' ? await this.loadDataContextOwnerID(dciData.DataContextID, md, user) : null;
+                const gate = this.authorizeSQLItems([dci], ownerID, appCtx);
                 // now the metadata is loaded so we can call the regular load function
-                if (await dci.LoadData(ds)) {
-                    return {
-                        Success: true,
-                        ErrorMessage: null,
-                        Result: JSON.stringify(dci.Data),
-                    }
-                }
-                else {
-                    return {
-                        Success: false,
-                        ErrorMessage: 'Error loading data context item data',
-                        Result: null,
-                    }
+                const outcome = await this.loadItem(dci, gate, user, false);
+                return {
+                    Success: outcome.Error === null,
+                    ErrorMessage: outcome.Error,
+                    Result: outcome.Result,
                 }
             }
             else {
@@ -89,14 +110,15 @@ export class GetDataContextDataResolver extends ResolverBase {
         catch (e) {
             return {
                 Success: false,
-                ErrorMessage: e,
+                ErrorMessage: e instanceof Error ? e.message : String(e),
                 Result: null,
             }
         }
     }
 
     /**
-     * Returns data for a given data context.
+     * Returns data for a given data context. `Results` and `ErrorMessages` hold one entry per item, in
+     * item order. `Success` is true, and `ErrorMessages` null, only when every item loaded.
      * @param DataContextID
      */
     @Query(() => GetDataContextDataOutputType)
@@ -106,38 +128,114 @@ export class GetDataContextDataResolver extends ResolverBase {
     ) {
         // Check API key scope authorization for data context read
         await this.CheckAPIKeyScopeAuthorization('datacontext:read', DataContextID, appCtx.userPayload);
+        // DataContext.LoadMetadata places this ID in the item filter, so it must be a plain UUID.
+        if (!IsValidUUID(DataContextID)) {
+            return { Success: false, ErrorMessages: ['DataContextID must be a UUID'], Results: null };
+        }
 
         try {
             // our job here is to load the entire data context, so we do that with the Data Context object
+            const user: UserInfo = appCtx.userPayload.userRecord;
+            const md = GetReadOnlyProvider(appCtx.providers, { allowFallbackToReadWrite: true });
             const dc = new DataContext();
-            const ds = GetReadOnlyDataSource(appCtx.dataSources, {
-                allowFallbackToReadWrite: true,
-            })
-            const success = await dc.Load(DataContextID, ds, true, false, 0, appCtx.userPayload.userRecord);
-            if (success) {
-                const retVal =   {
-                    Success: true,
-                    ErrorMessages: null,
-                    Results: dc.Items.map((item) => {
-                        return JSON.stringify(item.Data);
-                    }),
-                }
-                return retVal;
-            }
-            else {
+            if (!(await dc.LoadMetadata(DataContextID, user, md))) {
                 return {
                     Success: false,
                     ErrorMessages: ['Error loading data context'],
-                    Results: null,    
+                    Results: null,
                 }
             }
+            const gate = this.authorizeSQLItems(dc.Items, dc.MJDataContextEntity.UserID, appCtx);
+            const outcomes = await Promise.all(dc.Items.map((item) => this.loadItem(item, gate, user, true)));
+            const allLoaded = outcomes.every((outcome) => outcome.Error === null);
+            return {
+                Success: allLoaded,
+                ErrorMessages: allLoaded ? null : outcomes.map((outcome) => outcome.Error),
+                Results: outcomes.map((outcome) => outcome.Result),
+            }
         }
         catch (e) {
             return {
                 Success: false,
-                ErrorMessages: [e],
+                ErrorMessages: [e instanceof Error ? e.message : String(e)],
                 Results: null,
             }
         }
     }
-}
+
+    /**
+     * Decides which `sql` items among `items` may run. Returns the read-only provider they run on, and
+     * the reason for each SQL item that may not run.
+     */
+    private authorizeSQLItems(items: DataContextItem[], ownerID: string | null, appCtx: AppContext): SQLItemGate {
+        const refusals = new Map<DataContextItem, string>();
+        const sqlItems = items.filter((item) => item.Type === 'sql');
+        if (sqlItems.length === 0) {
+            return { Provider: null, Refusals: refusals };
+        }
+        const user: UserInfo | undefined = appCtx.userPayload?.userRecord;
+        const provider = GetReadOnlyProvider(appCtx.providers, { allowFallbackToReadWrite: false });
+        for (const item of sqlItems) {
+            const refusal = this.sqlItemRefusal(item, ownerID, user, provider);
+            if (refusal !== null) {
+                refusals.set(item, refusal);
+            }
+        }
+        return { Provider: provider, Refusals: refusals };
+    }
+
+    /** Returns why `item` may not run for `user`, or null when it may. */
+    private sqlItemRefusal(item: DataContextItem, ownerID: string | null, user: UserInfo | undefined, provider: DatabaseProviderBase | null): string | null {
+        if (!user || IsScopeLimitedPrincipal(user)) {
+            return 'SQL data context items cannot be run by a scope-limited or unidentified session.';
+        }
+        if (!this.mayRunDataContextSQL(ownerID, user)) {
+            return 'Only the owner of this data context, or an administrator, may run its SQL items.';
+        }
+        if (!provider) {
+            return 'No read-only data source is configured, so SQL data context items cannot run.';
+        }
+        return this.screenItemSQL(item.SQL ?? '', provider, user);
+    }
+
+    /** True when `user` owns the data context or is an administrator (Owner-type user). */
+    private mayRunDataContextSQL(ownerID: string | null, user: UserInfo): boolean {
+        const isOwner = !!ownerID && UUIDsEqual(ownerID, user.ID);
+        return isOwner || user.Type?.trim().toLowerCase() === 'owner';
+    }
+
+    /**
+     * Returns why `sqlText` may not run, or null when it is a single read statement whose every table
+     * reference is an entity base view `user` may read without row-level or field-level narrowing. It is
+     * the check ExecuteAdhocQuery makes on the rendered SQL.
+     */
+    private screenItemSQL(sqlText: string, provider: DatabaseProviderBase, user: UserInfo): string | null {
+        try {
+            const rendered = RenderPipeline.Run(sqlText, { Platform: provider.PlatformKey, ContextUser: user, RequireReadStatement: true });
+            this.assertFullQueryUsesReadableEntityViews(rendered.Trace.AfterTemplates, provider, user, 'data context SQL');
+            return null;
+        }
+        catch (e) {
+            const reason = e instanceof Error ? e.message : String(e);
+            return reason || 'The SQL of this item did not pass the read-only check.';
+        }
+    }
+
+    /** Loads one item's data unless `gate` refused it. Returns the data as JSON, or why there is none. */
+    private async loadItem(item: DataContextItem, gate: SQLItemGate, user: UserInfo, forceRefresh: boolean): Promise<ItemOutcome> {
+        const refusal = gate.Refusals.get(item);
+        if (refusal !== undefined) {
+            return { Result: null, Error: refusal };
+        }
+        if (await item.LoadData(gate.Provider, forceRefresh, false, 0, user)) {
+            return { Result: JSON.stringify(item.Data), Error: null };
+        }
+        return { Result: null, Error: item.DataLoadingError || 'Error loading data context item data' };
+    }
+
+    /** Returns the owner (`UserID`) of a data context, or null when the caller cannot load it. */
+    private async loadDataContextOwnerID(dataContextID: string, provider: DatabaseProviderBase, user: UserInfo): Promise<string | null> {
+        const dataContext = await provider.GetEntityObject<MJDataContextEntity>('MJ: Data Contexts', user);
+        return (await dataContext.Load(dataContextID)) ? dataContext.UserID : null;
+    }
+}

package/src/resolvers/GetDataResolver.ts

@@ -158,14 +158,17 @@ export class GetDataResolver {
                         // Defense-in-depth: even system-token holders get SELECT-only SQL here.
                         // The read-only pool is the primary control, but if it is ever
                         // misconfigured to a read-write login this validator still refuses DML/DDL
-                        // (mirrors AdhocQueryResolver).
-                        const validation = SQLExpressionValidator.Instance.validateFullQuery(resolvedSQL);
+                        // (mirrors AdhocQueryResolver). The validator reads exactly the text that
+                        // runs: it is trimmed here as validate() trims it, and literal \n sequences
+                        // are not rewritten as ValidateFullQuery would.
+                        const sqlToRun = resolvedSQL.trim();
+                        const validation = SQLExpressionValidator.Instance.validate(sqlToRun, { context: 'full_query', Dialect: platform });
                         if (!validation.valid) {
                             return { result: null, error: validation.error || 'SQL validation failed' };
                         }
 
                         const request = new sql.Request(readOnlyDataSource);
-                        const result = await request.query(resolvedSQL);
+                        const result = await request.query(sqlToRun);
                         return { result: result.recordset, error: null };
                     } catch (err) {
                         // Extract clean SQL error message

package/src/resolvers/IntegrationDiscoveryResolver.ts

@@ -3,7 +3,7 @@ import { CompositeKey, DatabaseProviderBase, EntityInfo, LocalCacheManager, Meta
 import { GetReadOnlyProvider, GetReadWriteProvider } from "../util.js";
 import { NoLog } from "../logging/NoLog.js";
 import { UUIDsEqual } from "@memberjunction/global";
-import { DrainResponseBody } from "@memberjunction/network-utils";
+import { DrainResponseBody, SafeFetch } from "@memberjunction/network-utils";
 import { CronExpressionHelper } from "@memberjunction/scheduling-engine";
 import {
     MJCompanyIntegrationEntity,
@@ -33,7 +33,8 @@ import {
     IntegrationSchemaSync,
     decideSchemaLimitViolations,
     IntegrationConnectorCreationPipeline,
-    IntegrationActionGenerator
+    IntegrationActionGenerator,
+    ObjectsWithWatermarkFieldChange
 } from "@memberjunction/integration-engine";
 import type {
     IntegrationActionVerb,
@@ -1624,7 +1625,7 @@ export class IntegrationDiscoveryResolver extends ResolverBase {
                 Platform: validatedPlatform,
                 MJVersion: process.env.MJ_VERSION ?? '5.11.0',
                 SourceType: companyIntegration.Integration,
-                AdditionalSchemaInfoPath: process.env.RSU_ADDITIONAL_SCHEMA_INFO_PATH ?? 'additionalSchemaInfo.json',
+                AdditionalSchemaInfoPath: RuntimeSchemaManager.Instance.AdditionalSchemaInfoPath,
                 MigrationsDir: process.env.RSU_MIGRATIONS_PATH ?? 'migrations/rsu',
                 MetadataDir: process.env.RSU_METADATA_DIR ?? 'metadata',
                 ExistingTables: this.buildExistingTables(targetConfigs, provider),
@@ -3431,7 +3432,7 @@ export class IntegrationDiscoveryResolver extends ResolverBase {
                 Platform: validatedPlatform,
                 MJVersion: process.env.MJ_VERSION ?? '5.11.0',
                 SourceType: companyIntegration.Integration,
-                AdditionalSchemaInfoPath: process.env.RSU_ADDITIONAL_SCHEMA_INFO_PATH ?? 'additionalSchemaInfo.json',
+                AdditionalSchemaInfoPath: RuntimeSchemaManager.Instance.AdditionalSchemaInfoPath,
                 MigrationsDir: process.env.RSU_MIGRATIONS_PATH ?? 'migrations/rsu',
                 MetadataDir: process.env.RSU_METADATA_DIR ?? 'metadata',
                 ExistingTables: this.buildExistingTables(targetConfigs, provider),
@@ -3516,8 +3517,14 @@ export class IntegrationDiscoveryResolver extends ResolverBase {
                 return { Success: false, Message: 'No valid schema inputs to process', Items: itemResults };
             }
 
+            // Retrying variant, matching `IntegrationApplySchema` (which retries via
+            // SchemaBuilder.RunSchemaPipeline). This is the same install path over the same
+            // SchemaBuilder-generated DDL, and its expensive middle steps — ExecuteMigration,
+            // RunCodeGen, CompileTypeScript, RestartMJAPI — fail transiently. The wrapper replays
+            // only those four, and only while NOTHING in the batch has been applied, so a partially
+            // succeeded batch is still reported as-is rather than double-applied.
             const rsm = RuntimeSchemaManager.Instance;
-            const batchResult = await rsm.RunPipelineBatch(pipelineInputs);
+            const batchResult = await rsm.RunPipelineBatchWithRetry(pipelineInputs);
 
             return {
                 Success: batchResult.SuccessCount > 0,
@@ -4205,7 +4212,7 @@ export class IntegrationDiscoveryResolver extends ResolverBase {
             Platform: platform,
             MJVersion: process.env.MJ_VERSION ?? '5.11.0',
             SourceType: companyIntegration.Integration,
-            AdditionalSchemaInfoPath: process.env.RSU_ADDITIONAL_SCHEMA_INFO_PATH ?? 'additionalSchemaInfo.json',
+            AdditionalSchemaInfoPath: RuntimeSchemaManager.Instance.AdditionalSchemaInfoPath,
             MigrationsDir: process.env.RSU_MIGRATIONS_PATH ?? 'migrations/rsu',
             MetadataDir: process.env.RSU_METADATA_DIR ?? 'metadata',
             ExistingTables: this.buildExistingTables(targetConfigs, provider),
@@ -6186,7 +6193,7 @@ export class IntegrationDiscoveryResolver extends ResolverBase {
                 Platform: validatedPlatform,
                 MJVersion: process.env.MJ_VERSION ?? '5.11.0',
                 SourceType: companyIntegration.Integration,
-                AdditionalSchemaInfoPath: process.env.RSU_ADDITIONAL_SCHEMA_INFO_PATH ?? 'additionalSchemaInfo.json',
+                AdditionalSchemaInfoPath: RuntimeSchemaManager.Instance.AdditionalSchemaInfoPath,
                 MigrationsDir: process.env.RSU_MIGRATIONS_PATH ?? 'migrations/rsu',
                 MetadataDir: process.env.RSU_METADATA_DIR ?? 'metadata',
                 ExistingTables: existingTables,
@@ -6227,6 +6234,36 @@ export class IntegrationDiscoveryResolver extends ResolverBase {
                 }
             }
 
+            // ── Phase 5b — MJ-RUN-37: a WATERMARK-FIELD swap is a change the DDL diff cannot see ──
+            //
+            // A connector upgrade can move an object's incremental cursor to a different source
+            // column (`modified_at` → `last_updated`). Phase 1's persist already DETECTS that — the
+            // overlay rewrites `IntegrationObject.IncrementalWatermarkField` and records it in the
+            // merge log's `ChangedAttributes`. Nothing consumed it, and no other source of
+            // `changedObjects` can: a cursor swap adds no column (so `diff.AddedColumns` and
+            // `ModifiedColumns` are both empty) and touches no field map (so Phase 6 stays quiet).
+            //
+            // The object was therefore treated as unchanged, its Pull watermark survived, and the
+            // next incremental sync applied the OLD column's stored value as a lower bound on the
+            // NEW one. Where the new column sorts later, every row below that value is filtered out
+            // AT THE SOURCE — permanently, and with no artifact: the source reports a total
+            // consistent with the filter it was given, so fetched equals expected and the run
+            // closes clean. Absence, not duplication, is what this produces.
+            //
+            // Scoped to CONTINUING maps deliberately. A new object has no watermark to invalidate
+            // and a removed one has no sync left to protect; widening this to every persisted object
+            // would inflate `ChangedObjects` (and `hasChanges`) with names Phase 7 cannot act on.
+            const watermarkFieldChanged = ObjectsWithWatermarkFieldChange(
+                refresh.PersistResult?.ObjectMergeLog ?? [],
+                continuingMaps.map(m => m.ExternalObjectName ?? ''),
+            );
+            for (const name of watermarkFieldChanged) {
+                if (!changedObjects.some(n => n.toLowerCase() === name.toLowerCase())) changedObjects.push(name);
+            }
+            if (watermarkFieldChanged.length > 0) {
+                LogStatus(`[SchemaEvolution] IncrementalWatermarkField changed on ${watermarkFieldChanged.length} object(s) — resetting their Pull watermarks: ${watermarkFieldChanged.join(', ')}`);
+            }
+
             // ── Phase 6 — reconcile CONTINUING maps' field maps to the resolution ──
             // Added source fields get field maps (Active on enabled maps, Disabled on disabled
             // maps); field maps whose source field vanished from the resolution are disabled.
@@ -6301,8 +6338,13 @@ export class IntegrationDiscoveryResolver extends ResolverBase {
                     rsuInput.ContextUser = user;
                 }
 
+                // Retrying variant, for the same reason every other install path uses it: a refresh
+                // is unattended and long, and a transient ExecuteMigration / RunCodeGen /
+                // CompileTypeScript / RestartMJAPI failure would otherwise abandon it with the
+                // metadata already re-resolved and the DDL not applied — the half-state an operator
+                // then has to diagnose. Replay happens only while nothing was applied.
                 const rsm = RuntimeSchemaManager.Instance;
-                const batchResult = await rsm.RunPipelineBatch([rsuInput]);
+                const batchResult = await rsm.RunPipelineBatchWithRetry([rsuInput]);
                 const pipelineResult = batchResult.Results[0];
                 pipelineSteps = pipelineResult?.Steps.map((s: RSUPipelineStep) => ({
                     Name: s.Name, Status: s.Status, DurationMs: s.DurationMs, Message: s.Message, StepIndex: s.StepIndex, StepTotal: s.StepTotal,
@@ -6467,7 +6509,9 @@ export class IntegrationDiscoveryResolver extends ResolverBase {
 
     private async sendWebhook(url: string, payload: Record<string, unknown>): Promise<void> {
         try {
-            const response = await fetch(url, {
+            // SECURITY: the webhook URL is caller-supplied, so go through the SSRF guard —
+            // SafeFetch validates the URL (and every redirect hop) resolves to a public address.
+            const response = await SafeFetch(url, {
                 method: 'POST',
                 headers: { 'Content-Type': 'application/json' },
                 body: JSON.stringify(payload)

package/src/resolvers/MergeRecordsResolver.ts

@@ -38,6 +38,18 @@ export class EntityDependencyResolver {
   }
 }
 
+@InputType()
+export class RecordDependencyOptionsInput {
+  @Field(() => String, { nullable: true })
+  LinkType?: 'both' | 'hard' | 'soft';
+
+  @Field(() => Boolean, { nullable: true })
+  IncludeSystemEntities?: boolean;
+
+  @Field(() => [String], { nullable: true })
+  EntityNames?: string[];
+}
+
 @ObjectType()
 export class RecordDependencyResult {
   @Field(() => String)
@@ -49,6 +61,9 @@ export class RecordDependencyResult {
   @Field(() => String)
   FieldName: string; // required
 
+  @Field(() => String, { nullable: true })
+  FieldDisplayName?: string;
+
   @Field(() => CompositeKeyOutputType)
   PrimaryKey: CompositeKey;
 
@@ -70,17 +85,23 @@ export class RecordDependencyResolver {
     @Arg('entityName', () => String) entityName: string,
     @Arg('CompositeKey', () => CompositeKeyInputType) ckInput: CompositeKeyInputType,
     @Ctx() { dataSource, userPayload, providers }: AppContext,
-    @PubSub() pubSub: PubSubEngine
+    @PubSub() pubSub: PubSubEngine,
+    @Arg('options', () => RecordDependencyOptionsInput, { nullable: true }) options?: RecordDependencyOptionsInput
   ) {
     try {
       const md = GetReadOnlyProvider(providers);
       const ck = new CompositeKey(ckInput.KeyValuePairs);
-      const result = await md.GetRecordDependencies(entityName, ck);
+      const contextUser = userPayload?.userRecord;
+      const result =
+        options !== undefined || contextUser !== undefined
+          ? await md.GetRecordDependencies(entityName, ck, contextUser, options)
+          : await md.GetRecordDependencies(entityName, ck);
       
       return result.map(dep => ({
         EntityName: dep.EntityName,
         RelatedEntityName: dep.RelatedEntityName,
         FieldName: dep.FieldName,
+        FieldDisplayName: dep.FieldDisplayName,
         PrimaryKey: dep.PrimaryKey,
         CompositeKey: dep.PrimaryKey,
         IsSoftLink: dep.IsSoftLink,

package/src/resolvers/PipelineProgressResolver.ts

@@ -1,6 +1,7 @@
 import { Resolver, Subscription, Root, ObjectType, Field, Float, Mutation, Arg, Ctx, PubSub, PubSubEngine } from 'type-graphql';
 import { AppContext } from '../types.js';
 import { LogStatus, LogError } from '@memberjunction/core';
+import { UUIDsEqual } from '@memberjunction/global';
 import { ResolverBase } from '../generic/ResolverBase.js';
 
 const PIPELINE_PROGRESS_TOPIC = 'PIPELINE_PROGRESS';
@@ -49,6 +50,16 @@ export class PipelineStartResult {
     ErrorMessage?: string;
 }
 
+export function PipelineProgressFilter({
+    payload,
+    args,
+}: {
+    payload: PipelineProgressNotification;
+    args: { pipelineRunID: string };
+}): boolean {
+    return UUIDsEqual(payload.PipelineRunID, args.pipelineRunID) || payload.PipelineRunID === args.pipelineRunID;
+}
+
 @Resolver()
 export class PipelineProgressResolver extends ResolverBase {
     /**
@@ -56,9 +67,7 @@ export class PipelineProgressResolver extends ResolverBase {
      */
     @Subscription(() => PipelineProgressNotification, {
         topics: PIPELINE_PROGRESS_TOPIC,
-        filter: ({ payload, args }: { payload: PipelineProgressNotification; args: { pipelineRunID: string } }) => {
-            return payload.PipelineRunID === args.pipelineRunID;
-        },
+        filter: PipelineProgressFilter,
     })
     PipelineProgress(
         @Root() notification: PipelineProgressNotification,

package/src/resolvers/QueryResolver.ts

@@ -101,6 +101,12 @@ export class RunQueryCacheStatusInput {
 
   @Field(() => Int, { description: 'The number of rows in cached results' })
   rowCount: number;  // case-violation-ok-legacy-back-compat: the property name is the GraphQL schema field name — renaming it breaks every client query
+
+  @Field(() => String, {
+    nullable: true,
+    description: "The query definition hash the cached results were written under, as this server returned it. When it differs from the server's, the result is 'stale' with fresh rows. Empty string for a slot with no hash; omit to skip the definition check."
+  })
+  definitionHash?: string;  // case-violation-ok-legacy-back-compat: the property name is the GraphQL schema field name, matching its siblings
 }
 
 @InputType()
@@ -140,6 +146,9 @@ export class RunQueryWithCacheCheckResultOutput {
 
   @Field(() => String, { nullable: true, description: 'Error message if status is error' })
   errorMessage?: string;  // case-violation-ok-legacy-back-compat: the property name is the GraphQL schema field name — renaming it breaks every client query
+
+  @Field(() => String, { nullable: true, description: "The server's definition hash for the query; store it with the cached results and send it back in cacheStatus.definitionHash" })
+  definitionHash?: string;  // case-violation-ok-legacy-back-compat: the property name is the GraphQL schema field name, matching its siblings
 }
 
 @ObjectType()
@@ -217,7 +226,8 @@ export class RunQueryResolver extends ResolverBase {
         ForceAuditLog: ForceAuditLog,
         AuditLogDescription: AuditLogDescription,
         Enrichment: Enrichment,
-        DataSource: DataSource
+        DataSource: DataSource,
+        TimeZone: context.userPayload.TimeZone
       },
       context.userPayload.userRecord);
 
@@ -238,6 +248,7 @@ export class RunQueryResolver extends ResolverBase {
       QueryID: QueryID,
       QueryName: queryName || 'Unknown Query',
       Success: result.Success ?? false,
+      // fls-guard: saved-query rows. Its SQL is refused before it runs if it reads a field the caller is denied, unless the query has `MJ: Query Permissions` rows, which authorize it by role alone
       Results: JSON.stringify(result.Results ?? null),
       RowCount: result.RowCount ?? 0,
       TotalRowCount: result.TotalRowCount ?? 0,
@@ -279,7 +290,8 @@ export class RunQueryResolver extends ResolverBase {
         ForceAuditLog: ForceAuditLog,
         AuditLogDescription: AuditLogDescription,
         Enrichment: Enrichment,
-        DataSource: DataSource
+        DataSource: DataSource,
+        TimeZone: context.userPayload.TimeZone
       },
       context.userPayload.userRecord);
       
@@ -287,6 +299,7 @@ export class RunQueryResolver extends ResolverBase {
       QueryID: result.QueryID || '',
       QueryName: QueryName,
       Success: result.Success ?? false,
+      // fls-guard: saved-query rows. Its SQL is refused before it runs if it reads a field the caller is denied, unless the query has `MJ: Query Permissions` rows, which authorize it by role alone
       Results: JSON.stringify(result.Results ?? null),
       RowCount: result.RowCount ?? 0,
       TotalRowCount: result.TotalRowCount ?? 0,
@@ -328,7 +341,8 @@ export class RunQueryResolver extends ResolverBase {
         ForceAuditLog: ForceAuditLog,
         AuditLogDescription: AuditLogDescription,
         Enrichment: Enrichment,
-        DataSource: DataSource
+        DataSource: DataSource,
+        TimeZone: context.userPayload.TimeZone
       },
       context.userPayload.userRecord);
 
@@ -349,6 +363,7 @@ export class RunQueryResolver extends ResolverBase {
       QueryID: QueryID,
       QueryName: queryName || 'Unknown Query',
       Success: result.Success ?? false,
+      // fls-guard: saved-query rows. Its SQL is refused before it runs if it reads a field the caller is denied, unless the query has `MJ: Query Permissions` rows, which authorize it by role alone
       Results: JSON.stringify(result.Results ?? null),
       RowCount: result.RowCount ?? 0,
       TotalRowCount: result.TotalRowCount ?? 0,
@@ -389,7 +404,8 @@ export class RunQueryResolver extends ResolverBase {
         ForceAuditLog: ForceAuditLog,
         AuditLogDescription: AuditLogDescription,
         Enrichment: Enrichment,
-        DataSource: DataSource
+        DataSource: DataSource,
+        TimeZone: context.userPayload.TimeZone
       },
       context.userPayload.userRecord);
     
@@ -397,6 +413,7 @@ export class RunQueryResolver extends ResolverBase {
       QueryID: result.QueryID || '',
       QueryName: QueryName,
       Success: result.Success ?? false,
+      // fls-guard: saved-query rows. Its SQL is refused before it runs if it reads a field the caller is denied, unless the query has `MJ: Query Permissions` rows, which authorize it by role alone
       Results: JSON.stringify(result.Results ?? null),
       RowCount: result.RowCount ?? 0,
       TotalRowCount: result.TotalRowCount ?? 0,
@@ -438,7 +455,8 @@ export class RunQueryResolver extends ResolverBase {
       ForceAuditLog: i.ForceAuditLog,
       AuditLogDescription: i.AuditLogDescription,
       Enrichment: i.Enrichment,
-      DataSource: i.DataSource
+      DataSource: i.DataSource,
+      TimeZone: context.userPayload.TimeZone
     }));
 
     // Execute all queries in parallel using the batch method
@@ -451,6 +469,7 @@ export class RunQueryResolver extends ResolverBase {
         QueryID: result.QueryID || inputItem.QueryID || '',
         QueryName: result.QueryName || inputItem.QueryName || 'Unknown Query',
         Success: result.Success ?? false,
+        // fls-guard: saved-query rows. Its SQL is refused before it runs if it reads a field the caller is denied, unless the query has `MJ: Query Permissions` rows, which authorize it by role alone
         Results: JSON.stringify(result.Results ?? null),
         RowCount: result.RowCount ?? 0,
         TotalRowCount: result.TotalRowCount ?? 0,
@@ -489,7 +508,8 @@ export class RunQueryResolver extends ResolverBase {
       ForceAuditLog: i.ForceAuditLog,
       AuditLogDescription: i.AuditLogDescription,
       Enrichment: i.Enrichment,
-      DataSource: i.DataSource
+      DataSource: i.DataSource,
+      TimeZone: context.userPayload.TimeZone
     }));
 
     // Execute all queries in parallel using the batch method
@@ -502,6 +522,7 @@ export class RunQueryResolver extends ResolverBase {
         QueryID: result.QueryID || inputItem.QueryID || '',
         QueryName: result.QueryName || inputItem.QueryName || 'Unknown Query',
         Success: result.Success ?? false,
+        // fls-guard: saved-query rows. Its SQL is refused before it runs if it reads a field the caller is denied, unless the query has `MJ: Query Permissions` rows, which authorize it by role alone
         Results: JSON.stringify(result.Results ?? null),
         RowCount: result.RowCount ?? 0,
         TotalRowCount: result.TotalRowCount ?? 0,
@@ -554,10 +575,12 @@ export class RunQueryResolver extends ResolverBase {
           AuditLogDescription: item.params.AuditLogDescription,
           Enrichment: item.params.Enrichment,
           DataSource: item.params.DataSource,
+          TimeZone: context.userPayload.TimeZone,
         },
         cacheStatus: item.cacheStatus ? {
           maxUpdatedAt: item.cacheStatus.maxUpdatedAt,
           rowCount: item.cacheStatus.rowCount,
+          definitionHash: item.cacheStatus.definitionHash ?? undefined,
         } : undefined,
       }));
 
@@ -568,10 +591,12 @@ export class RunQueryResolver extends ResolverBase {
         queryIndex: result.queryIndex,
         queryId: result.queryId,
         status: result.status,
+        // fls-guard: saved-query rows. Its SQL is refused before it runs if it reads a field the caller is denied, unless the query has `MJ: Query Permissions` rows, which authorize it by role alone
         Results: result.results ? JSON.stringify(result.results) : undefined,
         maxUpdatedAt: result.maxUpdatedAt,
         rowCount: result.rowCount,
         errorMessage: result.errorMessage,
+        definitionHash: result.definitionHash,
       }));
 
       return {