@memberjunction/server 6.2.0-edge.5 → 6.2.0-edge.7

package/src/resolvers/QuerySystemUserResolver.ts

@@ -1,12 +1,12 @@
 import { Arg, Ctx, Field, InputType, Mutation, ObjectType, registerEnumType, Resolver, PubSub, PubSubEngine } from 'type-graphql';
 import { AppContext } from '../types.js';
-import { LogError, UserInfo, CompositeKey, DatabaseProviderBase, LogStatus } from '@memberjunction/core';
+import { AssertClientInputWritableForUser, LogError, UserInfo, CompositeKey, DatabaseProviderBase, LogStatus } from '@memberjunction/core';
 import { MJQueryCategoryEntity, MJQueryPermissionEntity, MJQueryFieldEntity, MJQueryParameterEntity, MJQueryEntityEntity, QueryEngine } from '@memberjunction/core-entities';
 import { MJQueryResolver, MJQuery_, MJQueryField_, MJQueryParameter_, MJQueryEntity_, MJQueryPermission_ } from '../generated/generated.js';
 import { GetReadWriteProvider } from '../util.js';
 import { DeleteOptionsInput } from '../generic/DeleteOptionsInput.js';
 import { MJQueryEntityServer } from '@memberjunction/core-entities-server';
-import { EscapeSQLString } from '@memberjunction/global';
+import { EscapeSQLString, UUIDsEqual } from '@memberjunction/global';
 
 /**
  * Minimal shape of a query row returned by RunView lookups (plain object, not entity instance).
@@ -243,6 +243,14 @@ export class DeleteQueryResultType {
     Status?: string;
 }
 
+/** A query's child rows, read from the database. */
+interface StoredQueryChildren {
+    readonly Fields: MJQueryFieldEntity[];
+    readonly Parameters: MJQueryParameterEntity[];
+    readonly Entities: MJQueryEntityEntity[];
+    readonly Permissions: MJQueryPermissionEntity[];
+}
+
 @Resolver()
 export class MJQueryResolverExtended extends MJQueryResolver {
     /**
@@ -269,6 +277,7 @@ export class MJQueryResolverExtended extends MJQueryResolver {
             }
 
             // Check for existing query with same name in the same category
+            const requestedName = input.Name;
             const existingQuery = await this.findExistingQuery(provider, input.Name, finalCategoryID, context.userPayload.userRecord);
 
             if (existingQuery) {
@@ -285,97 +294,160 @@ export class MJQueryResolverExtended extends MJQueryResolver {
                 }
             }
 
-            // Use MJQueryEntityServer which handles AI processing
-            const record = await provider.GetEntityObject<MJQueryEntityServer>("MJ: Queries", context.userPayload.userRecord);
-            
-            // Destructure out non-database fields, keep only fields to persist
-            const { Permissions: _permissions, CategoryPath: _categoryPath, ParameterHints: _parameterHints, AutoResolveCollision: _autoResolve, ...fieldsToSet } = {
-                ...input,
-                CategoryID: finalCategoryID || input.CategoryID,
-                Status: input.Status || 'Approved',
-                QualityRank: input.QualityRank || 0,
-                UsesTemplate: input.UsesTemplate || false,
-                AuditQueryRuns: input.AuditQueryRuns || false,
-                CacheEnabled: input.CacheEnabled || false,
-                CacheTTLMinutes: input.CacheTTLMinutes || null,
-                CacheMaxSize: input.CacheMaxSize || null
+            return await this.createQueryAsync(provider, input, requestedName, finalCategoryID, context, pubSub);
+        } 
+        catch (err) {
+            LogError(err);
+            return {
+                Success: false,
+                ErrorMessage: `MJQueryResolverExtended::CreateQuerySystemUser --- Error creating query: ${err instanceof Error ? err.message : String(err)}`
             };
+        }
+    }
 
-            record.SetMany(fieldsToSet, true);
+    /** The most times a create with `AutoResolveCollision` picks a new name after losing a same-name race. */
+    private static readonly maxCollisionRetries = 25;
 
-            // Pass caller-provided parameter sample values to override LLM guesses
-            if (input.ParameterHints && input.ParameterHints.length > 0) {
-                record.ParameterHints = new Map(input.ParameterHints.map(h => [h.Name, h.Value]));
+    /**
+     * Creates the query, handling a same-name race (#6007): when the insert fails and a query with
+     * the name now exists (another request created it in between), `AutoResolveCollision` picks a
+     * new unique name and tries again, a bounded number of times, and never returns the other
+     * request's query. Without it, the query that now exists is returned (create-or-get). Any other
+     * failure, including a save-time refusal of the SQL, returns the save's message.
+     *
+     * @param requestedName - The name the caller asked for; each retry's unique name is built from it.
+     */
+    private async createQueryAsync(
+        provider: DatabaseProviderBase,
+        input: CreateQuerySystemUserInput,
+        requestedName: string,
+        categoryID: string | null | undefined,
+        context: AppContext,
+        pubSub: PubSubEngine
+    ): Promise<QueryMutationResultType> {
+        const user = context.userPayload.userRecord;
+        for (let attempt = 0; ; attempt++) {
+            const record = await this.newQueryRecordAsync(provider, input, categoryID, context, pubSub);
+            if (await record.Save()) {
+                return this.completeCreateAsync(provider, input, record, user);
             }
+            const existing = await this.findExistingQuery(provider, input.Name, categoryID ?? null, user);
+            if (!existing) {
+                return { Success: false, ErrorMessage: `Failed to create query: ${record.LatestResult?.CompleteMessage || record.LatestResult?.Message || 'the save reported no reason'}` };
+            }
+            if (!input.AutoResolveCollision) {
+                return this.existingQueryResultAsync(provider, existing, input.Name, user);
+            }
+            if (attempt >= MJQueryResolverExtended.maxCollisionRetries) {
+                return { Success: false, ErrorMessage: `Failed to create query '${input.Name}': another request took each unique name tried, ${attempt + 1} times.` };
+            }
+            const lost = input.Name;
+            input.Name = await this.findUniqueName(provider, requestedName, categoryID ?? null, user);
+            LogStatus(`[CreateQuery] Lost a name race for "${lost}"; retrying as "${input.Name}"`);
+        }
+    }
 
-            this.ListenForEntityMessages(record, pubSub, context.userPayload.userRecord);
-
-            // Attempt to save the query
-            const saveResult = await record.Save();
-
-            if (saveResult) {
-                // Save succeeded - fire the AfterCreate event and return all the data
-                await this.AfterCreate(provider, input); // fire event
-                const queryID = record.ID;
-
-                if (input.Permissions && input.Permissions.length > 0) {
-                    await this.createPermissions(provider, input.Permissions, queryID, context.userPayload.userRecord);
-
-                }
-
+    /** A new, unsaved query record holding the input's values. */
+    private async newQueryRecordAsync(
+        provider: DatabaseProviderBase,
+        input: CreateQuerySystemUserInput,
+        categoryID: string | null | undefined,
+        context: AppContext,
+        pubSub: PubSubEngine
+    ): Promise<MJQueryEntityServer> {
+        const record = await provider.GetEntityObject<MJQueryEntityServer>("MJ: Queries", context.userPayload.userRecord);
+        // Destructure out non-database fields, keep only fields to persist
+        const { Permissions: _permissions, CategoryPath: _categoryPath, ParameterHints: _parameterHints, AutoResolveCollision: _autoResolve, ...fieldsToSet } = {
+            ...input,
+            CategoryID: categoryID || input.CategoryID,
+            Status: input.Status || 'Approved',
+            QualityRank: input.QualityRank || 0,
+            UsesTemplate: input.UsesTemplate || false,
+            AuditQueryRuns: input.AuditQueryRuns || false,
+            CacheEnabled: input.CacheEnabled || false,
+            CacheTTLMinutes: input.CacheTTLMinutes || null,
+            CacheMaxSize: input.CacheMaxSize || null
+        };
+        // Field-level security: refuse a key the caller may not read, or that names no field
+        AssertClientInputWritableForUser(record.EntityInfo, fieldsToSet, context.userPayload.userRecord);
+        record.SetMany(fieldsToSet, true);
+        // Pass caller-provided parameter sample values (used for new parameters and the described renders)
+        if (input.ParameterHints && input.ParameterHints.length > 0) {
+            record.ParameterHints = new Map(input.ParameterHints.map(h => [h.Name, h.Value]));
+        }
+        this.ListenForEntityMessages(record, pubSub, context.userPayload);
+        return record;
+    }
 
-                return await this.buildSuccessResult(record);
+    /** After a successful create: the AfterCreate event, the permissions, and the result. */
+    private async completeCreateAsync(provider: DatabaseProviderBase, input: CreateQuerySystemUserInput, record: MJQueryEntityServer, user: UserInfo): Promise<QueryMutationResultType> {
+        await this.AfterCreate(provider, input); // fire event
+        if (input.Permissions && input.Permissions.length > 0) {
+            try {
+                await this.createPermissions(provider, input.Permissions, record.ID, user);
+            } catch (e) {
+                return { Success: false, ErrorMessage: `Query '${record.Name}' (ID ${record.ID}) was created, but its permissions were not: ${e instanceof Error ? e.message : String(e)}` };
             }
-            else {
-                // Save failed - check if another request created the same query (race condition)
-                // Always recheck regardless of error type to handle all duplicate scenarios
-                const existingQuery = await this.findExistingQuery(provider, input.Name, finalCategoryID, context.userPayload.userRecord);
-
-                if (existingQuery) {
-                    // Found the query that was created by another request — load it as a full entity
-                    // so that related metadata (Fields, Parameters, Entities, Permissions) is populated
-                    LogStatus(`[CreateQuery] Unique constraint detected for query '${input.Name}'. Using existing query (ID: ${existingQuery.ID}) created by concurrent request.`);
-                    const existingEntity = await provider.GetEntityObject<MJQueryEntityServer>('MJ: Queries', context.userPayload.userRecord);
-                    if (await existingEntity.Load(existingQuery.ID)) {
-                        return await this.buildSuccessResult(existingEntity);
-                    }
-                    // Entity load failed after confirming the row exists — extremely rare
-                    return {
-                        Success: false,
-                        ErrorMessage: `Found query '${input.Name}' created by concurrent request (ID: ${existingQuery.ID}) but failed to load it as entity`
-                    };
-                }
+        }
+        return this.buildSuccessResult(record, user, provider);
+    }
 
-                // Genuine failure - couldn't find an existing query with the same name
-                const errorMessage = record.LatestResult?.Message || '';
-                return {
-                    Success: false,
-                    ErrorMessage: `Failed to create query: ${errorMessage || 'Unknown error'}`
-                };
-            }
-        } 
-        catch (err) {
-            LogError(err);
-            return {
-                Success: false,
-                ErrorMessage: `MJQueryResolverExtended::CreateQuerySystemUser --- Error creating query: ${err instanceof Error ? err.message : String(err)}`
-            };
+    /** The create-or-get result: the query another request created with this name. */
+    private async existingQueryResultAsync(provider: DatabaseProviderBase, existing: QueryViewRow, name: string, user: UserInfo): Promise<QueryMutationResultType> {
+        LogStatus(`[CreateQuery] Unique constraint detected for query '${name}'. Using existing query (ID: ${existing.ID}) created by concurrent request.`);
+        const existingEntity = await provider.GetEntityObject<MJQueryEntityServer>('MJ: Queries', user);
+        if (await existingEntity.Load(existing.ID)) {
+            // The other request may have run on another server, or its rows may not have reached this
+            // process's query cache yet, so the child rows are read from the database.
+            const children = await this.readStoredChildrenAsync(provider, existing.ID, user);
+            return this.buildSuccessResult(existingEntity, user, provider, children);
         }
+        return {
+            Success: false,
+            ErrorMessage: `Found query '${name}' created by concurrent request (ID: ${existing.ID}) but failed to load it as entity`
+        };
     }
 
     /**
      * Maps an MJQueryEntityServer (with loaded related metadata) to a QueryMutationResultType.
      * Uses entity.GetAll() for scalar fields so that new CodeGen-generated fields are included
      * automatically without manual updates. Related entity arrays are mapped explicitly.
+     *
+     * @param contextUser The caller the result is for. Field security projects the record for them.
      */
-    private async buildSuccessResult(entity: MJQueryEntityServer): Promise<QueryMutationResultType> {
+    private async buildSuccessResult(entity: MJQueryEntityServer, contextUser: UserInfo, provider: DatabaseProviderBase, children?: StoredQueryChildren): Promise<QueryMutationResultType> {
         return {
             Success: true,
-            Query: await this.MapFieldNamesToCodeNames('MJ: Queries', entity.GetAll()) as MJQuery_,
-            Fields: this.mapFields(entity.QueryFields),
-            Parameters: this.mapParameters(entity.QueryParameters),
-            Entities: this.mapEntities(entity.QueryEntities),
-            Permissions: this.mapPermissions(entity.QueryPermissions),
+            // Mapped for the caller, so the field-security projection applies: the record was just
+            // saved, and a save re-reads the whole row.
+            // fls-guard: projected for contextUser by MapFieldNamesToCodeNames
+            Query: await this.MapFieldNamesToCodeNames('MJ: Queries', entity.GetAll(), contextUser, provider) as MJQuery_,
+            Fields: this.mapFields(children?.Fields ?? entity.QueryFields),
+            Parameters: this.mapParameters(children?.Parameters ?? entity.QueryParameters),
+            Entities: this.mapEntities(children?.Entities ?? entity.QueryEntities),
+            Permissions: this.mapPermissions(children?.Permissions ?? entity.QueryPermissions),
+        };
+    }
+
+    /**
+     * A query's child rows read from the database with every cache bypassed. A collection whose
+     * read fails comes back empty, as the cache would have given it.
+     */
+    private async readStoredChildrenAsync(provider: DatabaseProviderBase, queryID: string, user: UserInfo): Promise<StoredQueryChildren> {
+        const filter = `QueryID='${EscapeSQLString(queryID)}'`;
+        const view = (entityName: string, orderBy?: string) => ({ EntityName: entityName, ExtraFilter: filter, OrderBy: orderBy, ResultType: 'entity_object' as const, BypassCache: true, IgnoreMaxRows: true });
+        const [fields, parameters, entities, permissions] = await provider.RunViews([
+            view('MJ: Query Fields', 'Sequence'),
+            view('MJ: Query Parameters', 'Name'),
+            view('MJ: Query Entities'),
+            view('MJ: Query Permissions'),
+        ], user);
+        const rows = <T>(result: { Success: boolean; Results: T[] } | undefined): T[] => (result?.Success ? result.Results : []);
+        return {
+            Fields: rows<MJQueryFieldEntity>(fields),
+            Parameters: rows<MJQueryParameterEntity>(parameters),
+            Entities: rows<MJQueryEntityEntity>(entities),
+            Permissions: rows<MJQueryPermissionEntity>(permissions),
         };
     }
 
@@ -391,6 +463,10 @@ export class MJQueryResolverExtended extends MJQueryResolver {
             SourceEntityID: f.SourceEntityID,
             SourceEntity: f.SourceEntity,
             SourceFieldName: f.SourceFieldName,
+            SourceEntityFieldID: f.SourceEntityFieldID,
+            SourceEntityField: f.SourceEntityField,
+            SourceObjectName: f.SourceObjectName,
+            IsNullable: f.IsNullable,
             IsComputed: f.IsComputed,
             ComputationDescription: f.ComputationDescription,
             IsSummary: f.IsSummary,
@@ -414,6 +490,7 @@ export class MJQueryResolverExtended extends MJQueryResolver {
             DefaultValue: p.DefaultValue,
             SampleValue: p.SampleValue,
             ValidationFilters: p.ValidationFilters,
+            IsServerSet: p.IsServerSet,
             _mj__CreatedAt: p.__mj_CreatedAt,
             _mj__UpdatedAt: p.__mj_UpdatedAt,
             DetectionMethod: p.DetectionMethod,
@@ -428,6 +505,8 @@ export class MJQueryResolverExtended extends MJQueryResolver {
             QueryID: e.QueryID,
             EntityID: e.EntityID,
             Entity: e.Entity,
+            AlternateBaseViewID: e.AlternateBaseViewID,
+            AlternateBaseView: e.AlternateBaseView,
             _mj__CreatedAt: e.__mj_CreatedAt,
             _mj__UpdatedAt: e.__mj_UpdatedAt,
             DetectionMethod: e.DetectionMethod,
@@ -448,17 +527,43 @@ export class MJQueryResolverExtended extends MJQueryResolver {
         }) as MJQueryPermission_);
     }
 
+    /**
+     * Saves one `MJ: Query Permissions` row per input role for the query.
+     *
+     * @throws Error naming the role and the save's own message when a row is not saved
+     */
     protected async createPermissions(p: DatabaseProviderBase, permissions: QueryPermissionInputType[], queryID: string, contextUser: UserInfo): Promise<void> {
         for (const perm of permissions) {
             const permissionEntity = await p.GetEntityObject<MJQueryPermissionEntity>('MJ: Query Permissions', contextUser);
             if (permissionEntity) {
                 permissionEntity.QueryID = queryID;
                 permissionEntity.RoleID = perm.RoleID;
-                await permissionEntity.Save();
+                if (!await permissionEntity.Save()) {
+                    throw new Error(MJQueryResolverExtended.permissionWriteError('save', perm.RoleID, permissionEntity));
+                }
+            }
+        }
+    }
+
+    /**
+     * Deletes every `MJ: Query Permissions` row of the query.
+     *
+     * @throws Error naming the role and the delete's own message when a row is not deleted
+     */
+    protected async deletePermissions(queryID: string): Promise<void> {
+        for (const perm of QueryEngine.Instance.GetQueryPermissions(queryID)) {
+            if (!await perm.Delete()) {
+                throw new Error(MJQueryResolverExtended.permissionWriteError('delete', perm.RoleID, perm));
             }
         }
     }
 
+    /** The message for a permission row that was not saved or deleted, with the entity's own reason. */
+    private static permissionWriteError(action: 'save' | 'delete', roleID: string, entity: MJQueryPermissionEntity): string {
+        const reason = entity.LatestResult?.CompleteMessage || entity.LatestResult?.Message || `the ${action} reported no reason`;
+        return `Failed to ${action} the query permission for role ${roleID}: ${reason}`;
+    }
+
     /**
      * Updates an existing query with the provided attributes. Requires `query:update` scope for API key users;
      * entity-level update permission on MJ: Queries for all users.
@@ -491,16 +596,14 @@ export class MJQueryResolverExtended extends MJQueryResolver {
                 finalCategoryID = await this.findOrCreateCategoryPath(input.CategoryPath, provider, context.userPayload.userRecord);
             }
 
-            // now make sure there is NO existing query by the same name in the specified category
-            const existingQueryResult = await provider.RunView({
-                EntityName: 'MJ: Queries',
-                ExtraFilter: `Name='${EscapeSQLString(input.Name)}' AND CategoryID='${EscapeSQLString(finalCategoryID)}'`
-            }, context.userPayload.userRecord);
-            if (existingQueryResult.Success && existingQueryResult.Results?.length > 0) {
-                // we have a match! Let's return an error
+            // A rename, or a move to another category, must not collide with another query's name
+            const targetName = input.Name ?? queryEntity.Name;
+            const targetCategoryID = finalCategoryID !== undefined ? finalCategoryID : queryEntity.CategoryID;
+            const sameName = await this.findExistingQuery(provider, targetName, targetCategoryID ?? null, context.userPayload.userRecord);
+            if (sameName && !UUIDsEqual(sameName.ID, queryEntity.ID)) {
                 return {
                     Success: false,
-                    ErrorMessage: `Query with name '${input.Name}' already exists in the specified ${input.CategoryID ? 'category' : 'categoryPath'}`
+                    ErrorMessage: `Query with name '${targetName}' already exists in the specified ${input.CategoryID ? 'category' : 'categoryPath'}`
                 };
             }
 
@@ -523,6 +626,8 @@ export class MJQueryResolverExtended extends MJQueryResolver {
             if (input.CacheTTLMinutes !== undefined) updateFields.CacheTTLMinutes = input.CacheTTLMinutes;
             if (input.CacheMaxSize !== undefined) updateFields.CacheMaxSize = input.CacheMaxSize;
 
+            // Field-level security: refuse a key the caller may not read
+            AssertClientInputWritableForUser(queryEntity.EntityInfo, updateFields, context.userPayload.userRecord);
             // Use SetMany to update all fields at once
             queryEntity.SetMany(updateFields);
 
@@ -536,7 +641,7 @@ export class MJQueryResolverExtended extends MJQueryResolver {
             if (!saveResult) {
                 return {
                     Success: false,
-                    ErrorMessage: `Failed to update query: ${queryEntity.LatestResult?.Message || 'Unknown error'}`
+                    ErrorMessage: `Failed to update query: ${queryEntity.LatestResult?.CompleteMessage || queryEntity.LatestResult?.Message || 'the save reported no reason'}`
                 };
             }
 
@@ -544,17 +649,16 @@ export class MJQueryResolverExtended extends MJQueryResolver {
 
             // Handle permissions update if provided
             if (input.Permissions !== undefined) {
-                // Delete existing permissions (read from QueryEngine cache)
-                const existingPermissions = QueryEngine.Instance.GetQueryPermissions(queryID);
-                for (const perm of existingPermissions) {
-                    await perm.Delete();
+                // Replace the existing permissions (read from the QueryEngine cache); a failed write stops the update with its reason
+                try {
+                    await this.deletePermissions(queryID);
+                    await this.createPermissions(provider, input.Permissions, queryID, context.userPayload.userRecord);
+                } catch (e) {
+                    return { Success: false, ErrorMessage: `Failed to update query permissions: ${e instanceof Error ? e.message : String(e)}` };
                 }
-
-                // Create new permissions
-                await this.createPermissions(provider, input.Permissions, queryID, context.userPayload.userRecord);
             }
 
-            return await this.buildSuccessResult(queryEntity);
+            return await this.buildSuccessResult(queryEntity, context.userPayload.userRecord, provider);
 
         } catch (err) {
             LogError(err);
@@ -731,12 +835,13 @@ export class MJQueryResolverExtended extends MJQueryResolver {
     ): Promise<QueryViewRow | null> {
         try {
             // Query database directly to avoid cache staleness issues
-            const categoryFilter = categoryID ? `CategoryID='${categoryID}'` : 'CategoryID IS NULL';
-            const nameFilter = `LOWER(Name) = LOWER('${queryName.replace(/'/g, "''")}')`;
+            const categoryFilter = categoryID ? `CategoryID='${EscapeSQLString(categoryID)}'` : 'CategoryID IS NULL';
+            const nameFilter = `LOWER(Name) = LOWER('${EscapeSQLString(queryName)}')`;
 
             const result = await provider.RunView<QueryViewRow>({
                 EntityName: 'MJ: Queries',
-                ExtraFilter: `${nameFilter} AND ${categoryFilter}`
+                ExtraFilter: `${nameFilter} AND ${categoryFilter}`,
+                BypassCache: true
             }, contextUser);
 
             if (result.Success && result.Results && result.Results.length > 0) {
@@ -788,13 +893,16 @@ export class MJQueryResolverExtended extends MJQueryResolver {
     private async findCategoryByNameAndParent(provider: DatabaseProviderBase, categoryName: string, parentID: string | null, contextUser: UserInfo): Promise<MJQueryCategoryEntity | null> {
         try {
             // Query database directly to avoid cache staleness issues
-            const parentFilter = parentID ? `ParentID='${parentID}'` : 'ParentID IS NULL';
-            const nameFilter = `LOWER(Name) = LOWER('${categoryName.replace(/'/g, "''")}')`; // Escape single quotes
+            const parentFilter = parentID ? `ParentID='${EscapeSQLString(parentID)}'` : 'ParentID IS NULL';
+            const nameFilter = `LOWER(Name) = LOWER('${EscapeSQLString(categoryName)}')`;
 
+            // Uncached: after losing a race to create the category, the re-check must see the row the
+            // other request just wrote.
             const result = await provider.RunView<MJQueryCategoryEntity>({
                 EntityName: 'MJ: Query Categories',
                 ExtraFilter: `${nameFilter} AND ${parentFilter}`,
-                ResultType: 'entity_object'
+                ResultType: 'entity_object',
+                BypassCache: true
             }, contextUser);
 
             if (result.Success && result.Results && result.Results.length > 0) {

package/src/resolvers/RSUResolver.ts

@@ -318,6 +318,18 @@ export class RSUResolver {
             SkipRestart: input.SkipRestart ?? undefined,
         }));
 
+        // MJ-APPLY-6 — deliberately the BARE call, not RunPipelineBatchWithRetry. Everywhere else
+        // the MigrationSQL was generated by SchemaBuilder, so the manager knows what a replay would
+        // re-execute. Here it is arbitrary SQL handed in by the caller, and `executeMigration` is
+        // NOT transactional: it splits on GO/statement boundaries and issues one ExecuteSQL per
+        // chunk, so a migration that fails on chunk 3 leaves chunks 1-2 committed while the step is
+        // recorded `failed` — which is exactly the state `canSafelyRetry` reads as "nothing was
+        // applied, safe to replay". The replay then re-runs the committed chunks and reports THEIR
+        // "already exists" error in place of the real one. For generated DDL that risk is accepted
+        // upstream (SchemaBuilder.RunSchemaPipeline); for caller-authored DDL it is not ours to
+        // take. This is also an attended operator mutation with no in-repo caller — the human on
+        // the other end sees the failure and decides. Keep it in step with the singular
+        // RunRuntimeSchemaUpdate above, which uses bare RunPipeline for the same reason.
         const batchResult = await rsm.RunPipelineBatch(pipelineInputs);
 
         return {

package/src/resolvers/RealtimeBridgeResolver.ts

@@ -701,6 +701,7 @@ export class RealtimeBridgeResolver extends ResolverBase {
               Fields: ['ExternalID'],
               OrderBy: '__mj_CreatedAt DESC',
               MaxRows: 1,
+              SkipTotalRowCount: true,
               ResultType: 'simple',
             },
             user,