@memberjunction/server 6.2.0-edge.5 → 6.2.0-edge.6

package/src/resolvers/FileResolver.ts

@@ -1,4 +1,4 @@
-import { EntityPermissionType, FieldValueCollection, EntitySaveOptions, IMetadataProvider, LogError, UserInfo } from '@memberjunction/core';
+import { AssertClientInputWritableForUser, EntityPermissionType, FieldValueCollection, EntitySaveOptions, IMetadataProvider, LogError, UserInfo } from '@memberjunction/core';
 import { NormalizeUUID } from '@memberjunction/global';
 import { MJFileEntity, MJFileStorageProviderEntity, MJFileStorageAccountEntity } from '@memberjunction/core-entities';
 import {
@@ -47,6 +47,7 @@ import {
 import { CreateMJFileInput, MJFileResolver as FileResolverBase, MJFile_, UpdateMJFileInput } from '../generated/generated.js';
 import { FieldMapper } from '@memberjunction/graphql-dataprovider';
 import { GetReadOnlyProvider } from '../util.js';
+import { ProjectEntityObjectForCaller, ProjectableEntityObject } from '../generic/fieldSecurityTransport.js';
 import { MediaAccessKeyManager } from '../rest/MediaAccessKeys.js';
 import { UploadTokenManager } from '../rest/UploadTokenManager.js';
 import { DeriveSidecarPath, ParsePeaksSidecar } from './peaksSidecar.js';
@@ -666,6 +667,8 @@ export class FileResolver extends FileResolverBase {
     const fileEntity = await provider.GetEntityObject<MJFileEntity>('MJ: Files', user);
     const providerEntity = await provider.GetEntityObject<MJFileStorageProviderEntity>('MJ: File Storage Providers', user);
     fileEntity.CheckPermissions(EntityPermissionType.Create, true);
+    // Field-level security: refuse a key the caller may not read, or that names no field, before anything else
+    AssertClientInputWritableForUser(fileEntity.EntityInfo, { ...input }, user);
 
     // The upload URL signs an overwrite of `Name` (and the row will point at `ProviderKey`): Write on the account the
     // provider resolves to, and the tracked-file rule on both keys, as for every other route that writes an object.
@@ -693,7 +696,7 @@ export class FileResolver extends FileResolverBase {
     if (!saved) {
       console.error('[CreateFile] File save failed:', fileEntity.LatestResult?.CompleteMessage);
     }
-    const File = mapper.MapFields({ ...fileEntity.GetAll() });
+    const File = this.fileResponse(fileEntity, user, provider);
 
     return { File, UploadUrl, NameExists };
   }
@@ -760,8 +763,7 @@ export class FileResolver extends FileResolverBase {
       });
 
       const loaded = await fileEntity.Load(uploadResult.FileID);
-      const mapper = new FieldMapper();
-      const File = loaded ? (mapper.MapFields({ ...fileEntity.GetAll() }) as unknown as MJFile_) : undefined;
+      const File = loaded ? (this.fileResponse(fileEntity, user, provider) as unknown as MJFile_) : undefined;
 
       return {
         Success: true,
@@ -778,6 +780,14 @@ export class FileResolver extends FileResolverBase {
     }
   }
 
+  /**
+   * The file record for a response: its field values as the caller may read them, in GraphQL field
+   * names. The record was just saved or reloaded, and a save re-reads the whole row.
+   */
+  private fileResponse(fileEntity: ProjectableEntityObject, user: UserInfo, provider: IMetadataProvider): Record<string, unknown> {
+    return new FieldMapper().MapFields({ ...ProjectEntityObjectForCaller(fileEntity, user, provider) });
+  }
+
   /**
    * The account an upload will land in: the requested one, else the engine's default (the first active account) —
    * returned as an explicit ID so the account the gate checks is the account `UploadFile` uses. A requested ID is

package/src/resolvers/IntegrationDiscoveryResolver.ts

@@ -33,7 +33,8 @@ import {
     IntegrationSchemaSync,
     decideSchemaLimitViolations,
     IntegrationConnectorCreationPipeline,
-    IntegrationActionGenerator
+    IntegrationActionGenerator,
+    ObjectsWithWatermarkFieldChange
 } from "@memberjunction/integration-engine";
 import type {
     IntegrationActionVerb,
@@ -1624,7 +1625,7 @@ export class IntegrationDiscoveryResolver extends ResolverBase {
                 Platform: validatedPlatform,
                 MJVersion: process.env.MJ_VERSION ?? '5.11.0',
                 SourceType: companyIntegration.Integration,
-                AdditionalSchemaInfoPath: process.env.RSU_ADDITIONAL_SCHEMA_INFO_PATH ?? 'additionalSchemaInfo.json',
+                AdditionalSchemaInfoPath: RuntimeSchemaManager.Instance.AdditionalSchemaInfoPath,
                 MigrationsDir: process.env.RSU_MIGRATIONS_PATH ?? 'migrations/rsu',
                 MetadataDir: process.env.RSU_METADATA_DIR ?? 'metadata',
                 ExistingTables: this.buildExistingTables(targetConfigs, provider),
@@ -3431,7 +3432,7 @@ export class IntegrationDiscoveryResolver extends ResolverBase {
                 Platform: validatedPlatform,
                 MJVersion: process.env.MJ_VERSION ?? '5.11.0',
                 SourceType: companyIntegration.Integration,
-                AdditionalSchemaInfoPath: process.env.RSU_ADDITIONAL_SCHEMA_INFO_PATH ?? 'additionalSchemaInfo.json',
+                AdditionalSchemaInfoPath: RuntimeSchemaManager.Instance.AdditionalSchemaInfoPath,
                 MigrationsDir: process.env.RSU_MIGRATIONS_PATH ?? 'migrations/rsu',
                 MetadataDir: process.env.RSU_METADATA_DIR ?? 'metadata',
                 ExistingTables: this.buildExistingTables(targetConfigs, provider),
@@ -3516,8 +3517,14 @@ export class IntegrationDiscoveryResolver extends ResolverBase {
                 return { Success: false, Message: 'No valid schema inputs to process', Items: itemResults };
             }
 
+            // Retrying variant, matching `IntegrationApplySchema` (which retries via
+            // SchemaBuilder.RunSchemaPipeline). This is the same install path over the same
+            // SchemaBuilder-generated DDL, and its expensive middle steps — ExecuteMigration,
+            // RunCodeGen, CompileTypeScript, RestartMJAPI — fail transiently. The wrapper replays
+            // only those four, and only while NOTHING in the batch has been applied, so a partially
+            // succeeded batch is still reported as-is rather than double-applied.
             const rsm = RuntimeSchemaManager.Instance;
-            const batchResult = await rsm.RunPipelineBatch(pipelineInputs);
+            const batchResult = await rsm.RunPipelineBatchWithRetry(pipelineInputs);
 
             return {
                 Success: batchResult.SuccessCount > 0,
@@ -4205,7 +4212,7 @@ export class IntegrationDiscoveryResolver extends ResolverBase {
             Platform: platform,
             MJVersion: process.env.MJ_VERSION ?? '5.11.0',
             SourceType: companyIntegration.Integration,
-            AdditionalSchemaInfoPath: process.env.RSU_ADDITIONAL_SCHEMA_INFO_PATH ?? 'additionalSchemaInfo.json',
+            AdditionalSchemaInfoPath: RuntimeSchemaManager.Instance.AdditionalSchemaInfoPath,
             MigrationsDir: process.env.RSU_MIGRATIONS_PATH ?? 'migrations/rsu',
             MetadataDir: process.env.RSU_METADATA_DIR ?? 'metadata',
             ExistingTables: this.buildExistingTables(targetConfigs, provider),
@@ -6186,7 +6193,7 @@ export class IntegrationDiscoveryResolver extends ResolverBase {
                 Platform: validatedPlatform,
                 MJVersion: process.env.MJ_VERSION ?? '5.11.0',
                 SourceType: companyIntegration.Integration,
-                AdditionalSchemaInfoPath: process.env.RSU_ADDITIONAL_SCHEMA_INFO_PATH ?? 'additionalSchemaInfo.json',
+                AdditionalSchemaInfoPath: RuntimeSchemaManager.Instance.AdditionalSchemaInfoPath,
                 MigrationsDir: process.env.RSU_MIGRATIONS_PATH ?? 'migrations/rsu',
                 MetadataDir: process.env.RSU_METADATA_DIR ?? 'metadata',
                 ExistingTables: existingTables,
@@ -6227,6 +6234,36 @@ export class IntegrationDiscoveryResolver extends ResolverBase {
                 }
             }
 
+            // ── Phase 5b — MJ-RUN-37: a WATERMARK-FIELD swap is a change the DDL diff cannot see ──
+            //
+            // A connector upgrade can move an object's incremental cursor to a different source
+            // column (`modified_at` → `last_updated`). Phase 1's persist already DETECTS that — the
+            // overlay rewrites `IntegrationObject.IncrementalWatermarkField` and records it in the
+            // merge log's `ChangedAttributes`. Nothing consumed it, and no other source of
+            // `changedObjects` can: a cursor swap adds no column (so `diff.AddedColumns` and
+            // `ModifiedColumns` are both empty) and touches no field map (so Phase 6 stays quiet).
+            //
+            // The object was therefore treated as unchanged, its Pull watermark survived, and the
+            // next incremental sync applied the OLD column's stored value as a lower bound on the
+            // NEW one. Where the new column sorts later, every row below that value is filtered out
+            // AT THE SOURCE — permanently, and with no artifact: the source reports a total
+            // consistent with the filter it was given, so fetched equals expected and the run
+            // closes clean. Absence, not duplication, is what this produces.
+            //
+            // Scoped to CONTINUING maps deliberately. A new object has no watermark to invalidate
+            // and a removed one has no sync left to protect; widening this to every persisted object
+            // would inflate `ChangedObjects` (and `hasChanges`) with names Phase 7 cannot act on.
+            const watermarkFieldChanged = ObjectsWithWatermarkFieldChange(
+                refresh.PersistResult?.ObjectMergeLog ?? [],
+                continuingMaps.map(m => m.ExternalObjectName ?? ''),
+            );
+            for (const name of watermarkFieldChanged) {
+                if (!changedObjects.some(n => n.toLowerCase() === name.toLowerCase())) changedObjects.push(name);
+            }
+            if (watermarkFieldChanged.length > 0) {
+                LogStatus(`[SchemaEvolution] IncrementalWatermarkField changed on ${watermarkFieldChanged.length} object(s) — resetting their Pull watermarks: ${watermarkFieldChanged.join(', ')}`);
+            }
+
             // ── Phase 6 — reconcile CONTINUING maps' field maps to the resolution ──
             // Added source fields get field maps (Active on enabled maps, Disabled on disabled
             // maps); field maps whose source field vanished from the resolution are disabled.
@@ -6301,8 +6338,13 @@ export class IntegrationDiscoveryResolver extends ResolverBase {
                     rsuInput.ContextUser = user;
                 }
 
+                // Retrying variant, for the same reason every other install path uses it: a refresh
+                // is unattended and long, and a transient ExecuteMigration / RunCodeGen /
+                // CompileTypeScript / RestartMJAPI failure would otherwise abandon it with the
+                // metadata already re-resolved and the DDL not applied — the half-state an operator
+                // then has to diagnose. Replay happens only while nothing was applied.
                 const rsm = RuntimeSchemaManager.Instance;
-                const batchResult = await rsm.RunPipelineBatch([rsuInput]);
+                const batchResult = await rsm.RunPipelineBatchWithRetry([rsuInput]);
                 const pipelineResult = batchResult.Results[0];
                 pipelineSteps = pipelineResult?.Steps.map((s: RSUPipelineStep) => ({
                     Name: s.Name, Status: s.Status, DurationMs: s.DurationMs, Message: s.Message, StepIndex: s.StepIndex, StepTotal: s.StepTotal,

package/src/resolvers/MergeRecordsResolver.ts

@@ -38,6 +38,18 @@ export class EntityDependencyResolver {
   }
 }
 
+@InputType()
+export class RecordDependencyOptionsInput {
+  @Field(() => String, { nullable: true })
+  LinkType?: 'both' | 'hard' | 'soft';
+
+  @Field(() => Boolean, { nullable: true })
+  IncludeSystemEntities?: boolean;
+
+  @Field(() => [String], { nullable: true })
+  EntityNames?: string[];
+}
+
 @ObjectType()
 export class RecordDependencyResult {
   @Field(() => String)
@@ -49,6 +61,9 @@ export class RecordDependencyResult {
   @Field(() => String)
   FieldName: string; // required
 
+  @Field(() => String, { nullable: true })
+  FieldDisplayName?: string;
+
   @Field(() => CompositeKeyOutputType)
   PrimaryKey: CompositeKey;
 
@@ -70,17 +85,23 @@ export class RecordDependencyResolver {
     @Arg('entityName', () => String) entityName: string,
     @Arg('CompositeKey', () => CompositeKeyInputType) ckInput: CompositeKeyInputType,
     @Ctx() { dataSource, userPayload, providers }: AppContext,
-    @PubSub() pubSub: PubSubEngine
+    @PubSub() pubSub: PubSubEngine,
+    @Arg('options', () => RecordDependencyOptionsInput, { nullable: true }) options?: RecordDependencyOptionsInput
   ) {
     try {
       const md = GetReadOnlyProvider(providers);
       const ck = new CompositeKey(ckInput.KeyValuePairs);
-      const result = await md.GetRecordDependencies(entityName, ck);
+      const contextUser = userPayload?.userRecord;
+      const result =
+        options !== undefined || contextUser !== undefined
+          ? await md.GetRecordDependencies(entityName, ck, contextUser, options)
+          : await md.GetRecordDependencies(entityName, ck);
       
       return result.map(dep => ({
         EntityName: dep.EntityName,
         RelatedEntityName: dep.RelatedEntityName,
         FieldName: dep.FieldName,
+        FieldDisplayName: dep.FieldDisplayName,
         PrimaryKey: dep.PrimaryKey,
         CompositeKey: dep.PrimaryKey,
         IsSoftLink: dep.IsSoftLink,

package/src/resolvers/PipelineProgressResolver.ts

@@ -1,6 +1,7 @@
 import { Resolver, Subscription, Root, ObjectType, Field, Float, Mutation, Arg, Ctx, PubSub, PubSubEngine } from 'type-graphql';
 import { AppContext } from '../types.js';
 import { LogStatus, LogError } from '@memberjunction/core';
+import { UUIDsEqual } from '@memberjunction/global';
 import { ResolverBase } from '../generic/ResolverBase.js';
 
 const PIPELINE_PROGRESS_TOPIC = 'PIPELINE_PROGRESS';
@@ -49,6 +50,16 @@ export class PipelineStartResult {
     ErrorMessage?: string;
 }
 
+export function PipelineProgressFilter({
+    payload,
+    args,
+}: {
+    payload: PipelineProgressNotification;
+    args: { pipelineRunID: string };
+}): boolean {
+    return UUIDsEqual(payload.PipelineRunID, args.pipelineRunID) || payload.PipelineRunID === args.pipelineRunID;
+}
+
 @Resolver()
 export class PipelineProgressResolver extends ResolverBase {
     /**
@@ -56,9 +67,7 @@ export class PipelineProgressResolver extends ResolverBase {
      */
     @Subscription(() => PipelineProgressNotification, {
         topics: PIPELINE_PROGRESS_TOPIC,
-        filter: ({ payload, args }: { payload: PipelineProgressNotification; args: { pipelineRunID: string } }) => {
-            return payload.PipelineRunID === args.pipelineRunID;
-        },
+        filter: PipelineProgressFilter,
     })
     PipelineProgress(
         @Root() notification: PipelineProgressNotification,

package/src/resolvers/QueryResolver.ts

@@ -226,7 +226,8 @@ export class RunQueryResolver extends ResolverBase {
         ForceAuditLog: ForceAuditLog,
         AuditLogDescription: AuditLogDescription,
         Enrichment: Enrichment,
-        DataSource: DataSource
+        DataSource: DataSource,
+        TimeZone: context.userPayload.TimeZone
       },
       context.userPayload.userRecord);
 
@@ -247,6 +248,7 @@ export class RunQueryResolver extends ResolverBase {
       QueryID: QueryID,
       QueryName: queryName || 'Unknown Query',
       Success: result.Success ?? false,
+      // fls-guard: saved-query rows. Its SQL is refused before it runs if it reads a field the caller is denied, unless the query has `MJ: Query Permissions` rows, which authorize it by role alone
       Results: JSON.stringify(result.Results ?? null),
       RowCount: result.RowCount ?? 0,
       TotalRowCount: result.TotalRowCount ?? 0,
@@ -288,7 +290,8 @@ export class RunQueryResolver extends ResolverBase {
         ForceAuditLog: ForceAuditLog,
         AuditLogDescription: AuditLogDescription,
         Enrichment: Enrichment,
-        DataSource: DataSource
+        DataSource: DataSource,
+        TimeZone: context.userPayload.TimeZone
       },
       context.userPayload.userRecord);
       
@@ -296,6 +299,7 @@ export class RunQueryResolver extends ResolverBase {
       QueryID: result.QueryID || '',
       QueryName: QueryName,
       Success: result.Success ?? false,
+      // fls-guard: saved-query rows. Its SQL is refused before it runs if it reads a field the caller is denied, unless the query has `MJ: Query Permissions` rows, which authorize it by role alone
       Results: JSON.stringify(result.Results ?? null),
       RowCount: result.RowCount ?? 0,
       TotalRowCount: result.TotalRowCount ?? 0,
@@ -337,7 +341,8 @@ export class RunQueryResolver extends ResolverBase {
         ForceAuditLog: ForceAuditLog,
         AuditLogDescription: AuditLogDescription,
         Enrichment: Enrichment,
-        DataSource: DataSource
+        DataSource: DataSource,
+        TimeZone: context.userPayload.TimeZone
       },
       context.userPayload.userRecord);
 
@@ -358,6 +363,7 @@ export class RunQueryResolver extends ResolverBase {
       QueryID: QueryID,
       QueryName: queryName || 'Unknown Query',
       Success: result.Success ?? false,
+      // fls-guard: saved-query rows. Its SQL is refused before it runs if it reads a field the caller is denied, unless the query has `MJ: Query Permissions` rows, which authorize it by role alone
       Results: JSON.stringify(result.Results ?? null),
       RowCount: result.RowCount ?? 0,
       TotalRowCount: result.TotalRowCount ?? 0,
@@ -398,7 +404,8 @@ export class RunQueryResolver extends ResolverBase {
         ForceAuditLog: ForceAuditLog,
         AuditLogDescription: AuditLogDescription,
         Enrichment: Enrichment,
-        DataSource: DataSource
+        DataSource: DataSource,
+        TimeZone: context.userPayload.TimeZone
       },
       context.userPayload.userRecord);
     
@@ -406,6 +413,7 @@ export class RunQueryResolver extends ResolverBase {
       QueryID: result.QueryID || '',
       QueryName: QueryName,
       Success: result.Success ?? false,
+      // fls-guard: saved-query rows. Its SQL is refused before it runs if it reads a field the caller is denied, unless the query has `MJ: Query Permissions` rows, which authorize it by role alone
       Results: JSON.stringify(result.Results ?? null),
       RowCount: result.RowCount ?? 0,
       TotalRowCount: result.TotalRowCount ?? 0,
@@ -447,7 +455,8 @@ export class RunQueryResolver extends ResolverBase {
       ForceAuditLog: i.ForceAuditLog,
       AuditLogDescription: i.AuditLogDescription,
       Enrichment: i.Enrichment,
-      DataSource: i.DataSource
+      DataSource: i.DataSource,
+      TimeZone: context.userPayload.TimeZone
     }));
 
     // Execute all queries in parallel using the batch method
@@ -460,6 +469,7 @@ export class RunQueryResolver extends ResolverBase {
         QueryID: result.QueryID || inputItem.QueryID || '',
         QueryName: result.QueryName || inputItem.QueryName || 'Unknown Query',
         Success: result.Success ?? false,
+        // fls-guard: saved-query rows. Its SQL is refused before it runs if it reads a field the caller is denied, unless the query has `MJ: Query Permissions` rows, which authorize it by role alone
         Results: JSON.stringify(result.Results ?? null),
         RowCount: result.RowCount ?? 0,
         TotalRowCount: result.TotalRowCount ?? 0,
@@ -498,7 +508,8 @@ export class RunQueryResolver extends ResolverBase {
       ForceAuditLog: i.ForceAuditLog,
       AuditLogDescription: i.AuditLogDescription,
       Enrichment: i.Enrichment,
-      DataSource: i.DataSource
+      DataSource: i.DataSource,
+      TimeZone: context.userPayload.TimeZone
     }));
 
     // Execute all queries in parallel using the batch method
@@ -511,6 +522,7 @@ export class RunQueryResolver extends ResolverBase {
         QueryID: result.QueryID || inputItem.QueryID || '',
         QueryName: result.QueryName || inputItem.QueryName || 'Unknown Query',
         Success: result.Success ?? false,
+        // fls-guard: saved-query rows. Its SQL is refused before it runs if it reads a field the caller is denied, unless the query has `MJ: Query Permissions` rows, which authorize it by role alone
         Results: JSON.stringify(result.Results ?? null),
         RowCount: result.RowCount ?? 0,
         TotalRowCount: result.TotalRowCount ?? 0,
@@ -563,6 +575,7 @@ export class RunQueryResolver extends ResolverBase {
           AuditLogDescription: item.params.AuditLogDescription,
           Enrichment: item.params.Enrichment,
           DataSource: item.params.DataSource,
+          TimeZone: context.userPayload.TimeZone,
         },
         cacheStatus: item.cacheStatus ? {
           maxUpdatedAt: item.cacheStatus.maxUpdatedAt,
@@ -578,6 +591,7 @@ export class RunQueryResolver extends ResolverBase {
         queryIndex: result.queryIndex,
         queryId: result.queryId,
         status: result.status,
+        // fls-guard: saved-query rows. Its SQL is refused before it runs if it reads a field the caller is denied, unless the query has `MJ: Query Permissions` rows, which authorize it by role alone
         Results: result.results ? JSON.stringify(result.results) : undefined,
         maxUpdatedAt: result.maxUpdatedAt,
         rowCount: result.rowCount,

package/src/resolvers/QuerySystemUserResolver.ts

@@ -1,6 +1,6 @@
 import { Arg, Ctx, Field, InputType, Mutation, ObjectType, registerEnumType, Resolver, PubSub, PubSubEngine } from 'type-graphql';
 import { AppContext } from '../types.js';
-import { LogError, UserInfo, CompositeKey, DatabaseProviderBase, LogStatus } from '@memberjunction/core';
+import { AssertClientInputWritableForUser, LogError, UserInfo, CompositeKey, DatabaseProviderBase, LogStatus } from '@memberjunction/core';
 import { MJQueryCategoryEntity, MJQueryPermissionEntity, MJQueryFieldEntity, MJQueryParameterEntity, MJQueryEntityEntity, QueryEngine } from '@memberjunction/core-entities';
 import { MJQueryResolver, MJQuery_, MJQueryField_, MJQueryParameter_, MJQueryEntity_, MJQueryPermission_ } from '../generated/generated.js';
 import { GetReadWriteProvider } from '../util.js';
@@ -301,6 +301,8 @@ export class MJQueryResolverExtended extends MJQueryResolver {
                 CacheMaxSize: input.CacheMaxSize || null
             };
 
+            // Field-level security: refuse a key the caller may not read, or that names no field
+            AssertClientInputWritableForUser(record.EntityInfo, fieldsToSet, context.userPayload.userRecord);
             record.SetMany(fieldsToSet, true);
 
             // Pass caller-provided parameter sample values to override LLM guesses
@@ -324,7 +326,7 @@ export class MJQueryResolverExtended extends MJQueryResolver {
                 }
 
 
-                return await this.buildSuccessResult(record);
+                return await this.buildSuccessResult(record, context.userPayload.userRecord, provider);
             }
             else {
                 // Save failed - check if another request created the same query (race condition)
@@ -337,7 +339,7 @@ export class MJQueryResolverExtended extends MJQueryResolver {
                     LogStatus(`[CreateQuery] Unique constraint detected for query '${input.Name}'. Using existing query (ID: ${existingQuery.ID}) created by concurrent request.`);
                     const existingEntity = await provider.GetEntityObject<MJQueryEntityServer>('MJ: Queries', context.userPayload.userRecord);
                     if (await existingEntity.Load(existingQuery.ID)) {
-                        return await this.buildSuccessResult(existingEntity);
+                        return await this.buildSuccessResult(existingEntity, context.userPayload.userRecord, provider);
                     }
                     // Entity load failed after confirming the row exists — extremely rare
                     return {
@@ -367,11 +369,16 @@ export class MJQueryResolverExtended extends MJQueryResolver {
      * Maps an MJQueryEntityServer (with loaded related metadata) to a QueryMutationResultType.
      * Uses entity.GetAll() for scalar fields so that new CodeGen-generated fields are included
      * automatically without manual updates. Related entity arrays are mapped explicitly.
+     *
+     * @param contextUser The caller the result is for. Field security projects the record for them.
      */
-    private async buildSuccessResult(entity: MJQueryEntityServer): Promise<QueryMutationResultType> {
+    private async buildSuccessResult(entity: MJQueryEntityServer, contextUser: UserInfo, provider: DatabaseProviderBase): Promise<QueryMutationResultType> {
         return {
             Success: true,
-            Query: await this.MapFieldNamesToCodeNames('MJ: Queries', entity.GetAll()) as MJQuery_,
+            // Mapped for the caller, so the field-security projection applies: the record was just
+            // saved, and a save re-reads the whole row.
+            // fls-guard: projected for contextUser by MapFieldNamesToCodeNames
+            Query: await this.MapFieldNamesToCodeNames('MJ: Queries', entity.GetAll(), contextUser, provider) as MJQuery_,
             Fields: this.mapFields(entity.QueryFields),
             Parameters: this.mapParameters(entity.QueryParameters),
             Entities: this.mapEntities(entity.QueryEntities),
@@ -523,6 +530,8 @@ export class MJQueryResolverExtended extends MJQueryResolver {
             if (input.CacheTTLMinutes !== undefined) updateFields.CacheTTLMinutes = input.CacheTTLMinutes;
             if (input.CacheMaxSize !== undefined) updateFields.CacheMaxSize = input.CacheMaxSize;
 
+            // Field-level security: refuse a key the caller may not read
+            AssertClientInputWritableForUser(queryEntity.EntityInfo, updateFields, context.userPayload.userRecord);
             // Use SetMany to update all fields at once
             queryEntity.SetMany(updateFields);
 
@@ -554,7 +563,7 @@ export class MJQueryResolverExtended extends MJQueryResolver {
                 await this.createPermissions(provider, input.Permissions, queryID, context.userPayload.userRecord);
             }
 
-            return await this.buildSuccessResult(queryEntity);
+            return await this.buildSuccessResult(queryEntity, context.userPayload.userRecord, provider);
 
         } catch (err) {
             LogError(err);

package/src/resolvers/RSUResolver.ts

@@ -318,6 +318,18 @@ export class RSUResolver {
             SkipRestart: input.SkipRestart ?? undefined,
         }));
 
+        // MJ-APPLY-6 — deliberately the BARE call, not RunPipelineBatchWithRetry. Everywhere else
+        // the MigrationSQL was generated by SchemaBuilder, so the manager knows what a replay would
+        // re-execute. Here it is arbitrary SQL handed in by the caller, and `executeMigration` is
+        // NOT transactional: it splits on GO/statement boundaries and issues one ExecuteSQL per
+        // chunk, so a migration that fails on chunk 3 leaves chunks 1-2 committed while the step is
+        // recorded `failed` — which is exactly the state `canSafelyRetry` reads as "nothing was
+        // applied, safe to replay". The replay then re-runs the committed chunks and reports THEIR
+        // "already exists" error in place of the real one. For generated DDL that risk is accepted
+        // upstream (SchemaBuilder.RunSchemaPipeline); for caller-authored DDL it is not ours to
+        // take. This is also an attended operator mutation with no in-repo caller — the human on
+        // the other end sees the failure and decides. Keep it in step with the singular
+        // RunRuntimeSchemaUpdate above, which uses bare RunPipeline for the same reason.
         const batchResult = await rsm.RunPipelineBatch(pipelineInputs);
 
         return {