@memberjunction/server 6.2.0-edge.5 → 6.2.0-edge.7

package/src/__tests__/EntityMapLifecycle.rekey.test.ts

@@ -0,0 +1,252 @@
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
+import { RunView, type DatabaseProviderBase, type UserInfo } from '@memberjunction/core';
+import { CatalogIdentityKey, ClearRekeyedObjectData, DecideRekeyed, IdentityKeyFields } from '../integration/EntityMapLifecycle.js';
+
+/**
+ * A connector upgrade can change what identifies a row. PheedLoop 1.4.6 makes Attendees
+ * `code + eventCode`, because the object is fetched once per event and an attendee at two events
+ * comes back twice carrying the same `code`.
+ *
+ * `ToExternalRecord` joins every IsPrimaryKey field with '|' in Sequence order, so both the
+ * MEMBERS and the ORDER are part of identity. These pin the two pure decisions that drive the
+ * evolution's clear-and-rebuild.
+ */
+const f = (Name: string, IsPrimaryKey: boolean | null, Sequence: number | null) =>
+    ({ Name, IsPrimaryKey, Sequence });
+
+describe('IdentityKeyFields', () => {
+    it('takes only key fields, in Sequence order — not declaration order', () => {
+        expect(IdentityKeyFields([
+            f('eventCode', true, 2),
+            f('is_checked_in', false, 3),
+            f('code', true, 1),
+        ])).toEqual(['code', 'eventCode']);
+    });
+
+    it('is empty when nothing is flagged', () => {
+        expect(IdentityKeyFields([f('a', false, 1), f('b', null, 2)])).toEqual([]);
+    });
+
+    it('treats a missing Sequence as 0 rather than dropping the field', () => {
+        expect(IdentityKeyFields([f('b', true, null), f('a', true, 1)])).toEqual(['b', 'a']);
+    });
+
+    it('does not mutate the caller array', () => {
+        const input = [f('z', true, 9), f('a', true, 1)];
+        IdentityKeyFields(input);
+        expect(input[0].Name).toBe('z');
+    });
+});
+
+describe('DecideRekeyed', () => {
+    it('a column joining the key is a re-key — the PheedLoop case', () => {
+        expect(DecideRekeyed(['code'], ['code', 'eventCode'])).toBe(true);
+    });
+
+    it('a column leaving the key is a re-key', () => {
+        expect(DecideRekeyed(['code', 'eventCode'], ['code'])).toBe(true);
+    });
+
+    it('the same columns in a different ORDER is a re-key — the identity string differs', () => {
+        expect(DecideRekeyed(['code', 'eventCode'], ['eventCode', 'code'])).toBe(true);
+    });
+
+    it('an unchanged key is not', () => {
+        expect(DecideRekeyed(['code', 'eventCode'], ['code', 'eventCode'])).toBe(false);
+    });
+
+    it('matches case-insensitively, as every catalog-to-map reconciliation does', () => {
+        expect(DecideRekeyed(['Code'], ['code'])).toBe(false);
+    });
+
+    // The guard that stops this from clearing the fleet. An empty BUILT key means the entity's
+    // fields could not be read, not that the table never had a key — and treating unknown as
+    // empty would re-key (and therefore WIPE) every table on a workspace whose metadata failed
+    // to load.
+    it('an unreadable built key is never a re-key, however different the catalog looks', () => {
+        expect(DecideRekeyed([], ['code', 'eventCode'])).toBe(false);
+        expect(DecideRekeyed([], [])).toBe(false);
+    });
+
+    it('a catalog that reports no key against a real built key IS a re-key', () => {
+        expect(DecideRekeyed(['code'], [])).toBe(true);
+    });
+
+    // The same guard on the catalog side. A refresh reading a per-connection object whose fields
+    // were never warmed got `[]`, and "no key" against a real built key cleared the object's
+    // record maps and rows on every refresh.
+    it('an unread catalog key is never a re-key', () => {
+        expect(DecideRekeyed(['code'], null)).toBe(false);
+        expect(DecideRekeyed(['code', 'eventCode'], CatalogIdentityKey([]))).toBe(false);
+    });
+});
+
+describe('CatalogIdentityKey', () => {
+    const row = (Name: string, IsPrimaryKey: boolean, Sequence: number, Status = 'Active') =>
+        ({ Name, IsPrimaryKey, Sequence, Status });
+
+    it('is null when no field row was read — a cold per-connection object answers []', () => {
+        expect(CatalogIdentityKey([])).toBeNull();
+    });
+
+    it('is null when no row is Active — nothing describes the object', () => {
+        expect(CatalogIdentityKey([row('code', true, 1, 'Inactive')])).toBeNull();
+    });
+
+    it('is the Active key fields in Sequence order', () => {
+        expect(CatalogIdentityKey([
+            row('eventCode', true, 2),
+            row('old_key', true, 0, 'Inactive'),
+            row('code', true, 1),
+            row('name', false, 3),
+        ])).toEqual(['code', 'eventCode']);
+    });
+
+    it('is [] when Active rows declare no key — read, and keyless, so still a re-key', () => {
+        const key = CatalogIdentityKey([row('name', false, 1)]);
+        expect(key).toEqual([]);
+        expect(DecideRekeyed(['code'], key)).toBe(true);
+    });
+});
+
+/**
+ * Two connections to the same vendor share one schema, so they share every entity table. The clear
+ * may only touch the rows THIS connection's record maps point at; the other connection's rows in
+ * the same table are not its to delete.
+ */
+describe('ClearRekeyedObjectData', () => {
+    const USER = { ID: 'user-1' } as UserInfo;
+    const RECORD_MAPS = { Name: 'MJ: Company Integration Record Maps', SchemaName: '__mj', BaseTable: 'CompanyIntegrationRecordMap' };
+    const TARGET = { ExternalObjectName: 'attendees', EntityMapID: 'M1', EntityID: 'E1', SchemaName: 'pheedloop', BaseTable: 'attendees' };
+    type MapRow = { ID: string; EntityRecordID: string };
+    type RunViewParams = Parameters<RunView['RunView']>[0];
+    type RunViewResult = Awaited<ReturnType<RunView['RunView']>>;
+
+    /** A provider that records every statement and transaction step, in order. */
+    function fakeProvider(key: string[], failOn?: string) {
+        const log: string[] = [];
+        const provider = {
+            Dialect: {
+                QuoteIdentifier: (s: string) => `[${s}]`,
+                QuoteStringLiteral: (s: string) => `'${s.replace(/'/g, "''")}'`,
+            },
+            Entities: [RECORD_MAPS],
+            EntityByName: (name: string) => (name === RECORD_MAPS.Name ? RECORD_MAPS : undefined),
+            EntityByID: (id: string) => (id === 'E1' ? { PrimaryKeys: key.map(Name => ({ Name })) } : undefined),
+            ExecuteSQL: async (sql: string) => {
+                log.push(sql);
+                if (failOn && sql.includes(failOn)) throw new Error('deadlock victim');
+                return [];
+            },
+            BeginTransaction: async () => { log.push('BEGIN'); },
+            CommitTransaction: async () => { log.push('COMMIT'); },
+            RollbackTransaction: async () => { log.push('ROLLBACK'); },
+        };
+        return { provider: provider as unknown as DatabaseProviderBase, log };
+    }
+
+    let runView: ReturnType<typeof vi.spyOn>;
+    /** Answers the record-map reads one page at a time, then empty. */
+    function recordMapPages(...pages: MapRow[][]) {
+        for (const page of pages) {
+            runView.mockResolvedValueOnce({ Success: true, Results: page } as unknown as RunViewResult);
+        }
+        runView.mockResolvedValue({ Success: true, Results: [] } as unknown as RunViewResult);
+    }
+    const reads = () => runView.mock.calls.map(c => c[0] as RunViewParams);
+
+    beforeEach(() => { runView = vi.spyOn(RunView.prototype, 'RunView'); });
+    afterEach(() => { vi.restoreAllMocks(); });
+
+    it('deletes only the rows this connection\'s record maps point at — never the whole table', async () => {
+        const { provider, log } = fakeProvider(['ID']);
+        recordMapPages([{ ID: 'm1', EntityRecordID: 'r1' }, { ID: 'm2', EntityRecordID: 'r2' }]);
+
+        const cleared = await ClearRekeyedObjectData([TARGET], 'CI-A', USER, provider);
+
+        expect(cleared).toEqual(['attendees']);
+        expect(log).not.toContain('DELETE FROM [pheedloop].[attendees]');
+        expect(log).toContain("DELETE FROM [pheedloop].[attendees] WHERE [ID] IN ('r1','r2')");
+        expect(reads()[0].EntityName).toBe(RECORD_MAPS.Name);
+        expect(reads()[0].ExtraFilter).toBe("CompanyIntegrationID='CI-A' AND EntityID='E1'");
+    });
+
+    it('deletes the rows while their maps still say which rows they are, in one transaction with the maps', async () => {
+        const { provider, log } = fakeProvider(['ID']);
+        recordMapPages([{ ID: 'm1', EntityRecordID: 'r1' }]);
+
+        await ClearRekeyedObjectData([TARGET], 'CI-A', USER, provider);
+
+        expect(log).toEqual([
+            'BEGIN',
+            "DELETE FROM [pheedloop].[attendees] WHERE [ID] IN ('r1')",
+            "DELETE FROM [__mj].[CompanyIntegrationRecordMap] WHERE [CompanyIntegrationID]='CI-A' AND [EntityID]='E1' AND [ID] IN ('m1')",
+            'COMMIT',
+        ]);
+    });
+
+    it('matches every column of a composite key, split the way the engine joined it', async () => {
+        const { provider, log } = fakeProvider(['code', 'eventCode']);
+        recordMapPages([{ ID: 'm1', EntityRecordID: 'a|1' }, { ID: 'm2', EntityRecordID: "b'x|2" }]);
+
+        await ClearRekeyedObjectData([TARGET], 'CI-A', USER, provider);
+
+        expect(log).toContain(
+            "DELETE FROM [pheedloop].[attendees] WHERE ([code]='a' AND [eventCode]='1') OR ([code]='b''x' AND [eventCode]='2')"
+        );
+    });
+
+    it('leaves a map whose id cannot name exactly one row, and does not report the object cleared', async () => {
+        // 'a|1|z' against a two-column key is a value that itself contained '|': splitting it would
+        // name some OTHER row. An empty component is a null key value, which matches nothing safely.
+        const { provider, log } = fakeProvider(['code', 'eventCode']);
+        recordMapPages([
+            { ID: 'm1', EntityRecordID: 'a|1' },
+            { ID: 'm2', EntityRecordID: 'a|1|z' },
+            { ID: 'm3', EntityRecordID: '|2' },
+        ]);
+
+        const cleared = await ClearRekeyedObjectData([TARGET], 'CI-A', USER, provider);
+
+        expect(cleared).toEqual([]);
+        expect(log).toContain("DELETE FROM [pheedloop].[attendees] WHERE ([code]='a' AND [eventCode]='1')");
+        expect(log.some(s => s.includes('m2') || s.includes('m3'))).toBe(false);
+    });
+
+    it('pages through the maps by id, so a big table is never read or deleted whole', async () => {
+        const { provider, log } = fakeProvider(['ID']);
+        recordMapPages(
+            [{ ID: 'm1', EntityRecordID: 'r1' }, { ID: 'm2', EntityRecordID: 'r2' }],
+            [{ ID: 'm3', EntityRecordID: 'r3' }],
+        );
+
+        const cleared = await ClearRekeyedObjectData([TARGET], 'CI-A', USER, provider, 2);
+
+        expect(cleared).toEqual(['attendees']);
+        expect(reads()).toHaveLength(2);
+        expect(reads()[0]).toMatchObject({ OrderBy: 'ID', MaxRows: 2, SkipTotalRowCount: true, BypassCache: true });
+        expect(reads()[1].ExtraFilter).toBe("CompanyIntegrationID='CI-A' AND EntityID='E1' AND ID > 'm2'");
+        expect(log.filter(s => s === 'COMMIT')).toHaveLength(2);
+    });
+
+    it('rolls a failed chunk back and does not report the object cleared', async () => {
+        const { provider, log } = fakeProvider(['ID'], 'CompanyIntegrationRecordMap');
+        recordMapPages([{ ID: 'm1', EntityRecordID: 'r1' }]);
+
+        const cleared = await ClearRekeyedObjectData([TARGET], 'CI-A', USER, provider);
+
+        expect(cleared).toEqual([]);
+        expect(log).toContain('ROLLBACK');
+        expect(log).not.toContain('COMMIT');
+    });
+
+    it('deletes nothing when the record maps cannot be read', async () => {
+        const { provider, log } = fakeProvider(['ID']);
+        runView.mockResolvedValue({ Success: false, Results: [], ErrorMessage: 'timeout' } as unknown as RunViewResult);
+
+        const cleared = await ClearRekeyedObjectData([TARGET], 'CI-A', USER, provider);
+
+        expect(cleared).toEqual([]);
+        expect(log).toEqual([]);
+    });
+});

package/src/__tests__/EvolutionActsOnWhatItDetects.test.ts

@@ -0,0 +1,113 @@
+/**
+ * Two ways the schema-evolution path stopped short of acting on what it already knew.
+ *
+ *  - MJ-RUN-37: the persist layer has always recorded an `IncrementalWatermarkField` change and
+ *    nothing consumed the record. `changedObjects` — the sole input to `ResetPullWatermarks` — was
+ *    built from a physical column diff and a field-map add/disable, and a cursor swap produces
+ *    neither. The stale Pull watermark then became a lower bound on a DIFFERENT column, and where
+ *    the new column sorts later, every row below it was filtered out at the source, permanently and
+ *    invisibly (an incremental's fetched-vs-expected check agrees, because the source counts
+ *    against the filter it was handed).
+ *
+ *  - MJ-APPLY-6 residual: `RunPipelineBatchWithRetry` existed and two of the six pipeline call
+ *    sites used it. `SchemaBuilder.RunSchemaPipeline` states the reason plainly — the middle steps
+ *    fail transiently and "the callers simply never used it".
+ *
+ * The evolution mutation needs a provider, a connector, a SchemaBuilder and an RSU pipeline to
+ * invoke, and the properties here are wiring, not behaviour worth standing all that up to observe.
+ * Read from source, the convention this directory already uses for this method. The DECISION the
+ * wiring feeds is unit-tested for real in the integration-engine package
+ * (WatermarkFieldChangeIsAChange.test.ts) — these pin that the resolver calls it, feeds it the
+ * right input, and does so before the watermark reset.
+ */
+import { describe, it, expect } from 'vitest';
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+
+const SRC = readFileSync(join(__dirname, '..', 'resolvers', 'IntegrationDiscoveryResolver.ts'), 'utf-8');
+const PROMOTER = readFileSync(join(__dirname, '..', 'integration', 'CustomColumnPromoter.ts'), 'utf-8');
+const RSU_RESOLVER = readFileSync(join(__dirname, '..', 'resolvers', 'RSUResolver.ts'), 'utf-8');
+
+/** The body of a named resolver method, up to the next @Query/@Mutation at the same indent. */
+function methodBody(src: string, name: string): string {
+  const start = src.indexOf(`async ${name}(`);
+  expect(start, `${name} not found`).toBeGreaterThan(-1);
+  const rest = src.slice(start);
+  const end = rest.search(/\n    @(Query|Mutation)\(/);
+  return end === -1 ? rest : rest.slice(0, end);
+}
+
+describe('MJ-RUN-37 — a watermark-field change reaches ResetPullWatermarks', () => {
+  const body = () => methodBody(SRC, 'IntegrationSchemaEvolution');
+
+  it('consumes the persist layer\'s detection rather than re-deriving it', () => {
+    // The whole defect was that this signal existed and had no consumer. It must come from the
+    // refresh's OWN PersistResult — re-reading the catalog afterwards cannot tell a changed
+    // watermark field from one that was always that way.
+    expect(body()).toMatch(/ObjectsWithWatermarkFieldChange\(\s*refresh\.PersistResult\?\.ObjectMergeLog \?\? \[\]/);
+  });
+
+  it('imports it from the engine that produces it', () => {
+    expect(SRC).toMatch(/ObjectsWithWatermarkFieldChange[\s\S]{0,200}?from "@memberjunction\/integration-engine"/);
+  });
+
+  it('scopes it to the CONTINUING maps, so it cannot report what nothing can reset', () => {
+    expect(body()).toMatch(/continuingMaps\.map\(m => m\.ExternalObjectName \?\? ''\)/);
+  });
+
+  it('folds the result into changedObjects — the only input ResetPullWatermarks has', () => {
+    const b = body();
+    const push = b.search(/if \(!changedObjects\.some\(n => n\.toLowerCase\(\) === name\.toLowerCase\(\)\)\) changedObjects\.push\(name\)/);
+    const reset = b.indexOf('ResetPullWatermarks(');
+    expect(push, 'the watermark-changed names are never pushed onto changedObjects').toBeGreaterThan(-1);
+    expect(reset).toBeGreaterThan(-1);
+    expect(push, 'the push must happen BEFORE the reset, or it changes nothing').toBeLessThan(reset);
+  });
+
+  it('does not push unconditionally — an unchanged run must not re-full-sync the connection', () => {
+    // The guard is the expensive half. `changedObjects` drives ResetPullWatermarks AND HasChanges,
+    // so a rule that fires when no cursor moved turns every refresh into a full re-fetch of
+    // everything. The emptiness of the detection is what has to carry that, never a bare loop.
+    const b = body();
+    const i = b.indexOf('ObjectsWithWatermarkFieldChange(');
+    const after = b.slice(i, i + 600);
+    expect(after).toMatch(/for \(const name of watermarkFieldChanged\)/);
+    expect(after).not.toMatch(/changedObjects\.push\(\.\.\./);
+  });
+});
+
+describe('MJ-APPLY-6 residual — the bare pipeline calls that should retry', () => {
+  it('IntegrationApplySchemaBatch retries, matching its single-connector sibling', () => {
+    // IntegrationApplySchema retries via SchemaBuilder.RunSchemaPipeline. Same install path, same
+    // generated DDL, same four transient steps — the batch simply never used the wrapper.
+    const b = methodBody(SRC, 'IntegrationApplySchemaBatch');
+    expect(b).toMatch(/rsm\.RunPipelineBatchWithRetry\(pipelineInputs\)/);
+    expect(b).not.toMatch(/rsm\.RunPipelineBatch\(/);
+  });
+
+  it('IntegrationSchemaEvolution retries', () => {
+    const b = methodBody(SRC, 'IntegrationSchemaEvolution');
+    expect(b).toMatch(/rsm\.RunPipelineBatchWithRetry\(/);
+    expect(b).not.toMatch(/rsm\.RunPipelineBatch\(/);
+  });
+
+  it('the custom-column promoter retries — it runs unattended, mid-sync', () => {
+    expect(PROMOTER).toMatch(/RuntimeSchemaManager\.Instance\.RunPipelineBatchWithRetry\(batchInputs\)/);
+    expect(PROMOTER).not.toMatch(/RuntimeSchemaManager\.Instance\.RunPipelineBatch\(/);
+  });
+
+  it('no bare RunPipelineBatch survives in the integration resolver', () => {
+    // A regression here is invisible at runtime: the pipeline still works, it just stops
+    // absorbing the hiccup it was wrapped to absorb.
+    expect(SRC).not.toMatch(/RunPipelineBatch\((?!\w)/);
+  });
+
+  it('RunRuntimeSchemaUpdateBatch deliberately does NOT retry, and says why', () => {
+    // The one exception, kept explicit so it reads as a decision rather than an oversight: this
+    // mutation replays CALLER-AUTHORED SQL, and executeMigration is not transactional.
+    const b = methodBody(RSU_RESOLVER, 'RunRuntimeSchemaUpdateBatch');
+    expect(b).toMatch(/rsm\.RunPipelineBatch\(pipelineInputs\)/);
+    expect(b).toMatch(/deliberately the BARE call/);
+    expect(b).toMatch(/NOT transactional/);
+  });
+});

package/src/__tests__/ExecuteRemoteOperationResolver.test.ts

@@ -0,0 +1,213 @@
+import 'reflect-metadata';
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+import type { PubSubEngine } from 'type-graphql';
+
+vi.mock('../config.js', () => ({
+    configInfo: {},
+}));
+
+import { RegisterClass } from '@memberjunction/global';
+import {
+    BaseRemotableOperation,
+    RemoteOperationError,
+    type IMetadataProvider,
+    type RemoteOpInvokeOptions,
+    type RemoteOpResult,
+    type RemoteOpServerContext,
+    type UserInfo,
+} from '@memberjunction/core';
+import { RemoteOperationEngineBase } from '@memberjunction/core-entities';
+import { DispatchRemoteOperationInProcess } from '@memberjunction/core';
+import { ExecuteRemoteOperationResolver, ExecuteRemoteOperationInput } from '../resolvers/ExecuteRemoteOperationResolver.js';
+import type { AppContext } from '../types.js';
+
+interface TestOpInput {
+    message: string;
+}
+
+interface TestOpOutput {
+    echoed: string;
+    origin?: string;
+    ip?: string;
+    sessionId?: string;
+    apiKeyHash?: string;
+}
+
+@RegisterClass(BaseRemotableOperation, 'TestServer.ContextEcho')
+class ContextEchoOperation extends BaseRemotableOperation<TestOpInput, TestOpOutput> {
+    public readonly OperationKey = 'TestServer.ContextEcho';
+    public override readonly ContractFingerprint = 'ro_fp_expected12345678';
+
+    protected override async Authorize(
+        _input: TestOpInput,
+        _user: UserInfo,
+        context?: RemoteOpServerContext,
+    ): Promise<boolean> {
+        return context?.requestOrigin !== 'https://evil.example.com';
+    }
+
+    protected override async InternalExecute(
+        input: TestOpInput,
+        _provider: IMetadataProvider,
+        _user: UserInfo,
+        context: RemoteOpServerContext,
+    ): Promise<TestOpOutput> {
+        return {
+            echoed: input.message,
+            origin: context.requestOrigin,
+            ip: context.clientIp,
+            sessionId: context.sessionId,
+            apiKeyHash: context.apiKeyHash,
+        };
+    }
+}
+void ContextEchoOperation;
+
+@RegisterClass(BaseRemotableOperation, 'TestServer.StructuredFailure')
+class StructuredFailureOperation extends BaseRemotableOperation<TestOpInput, TestOpOutput> {
+    public readonly OperationKey = 'TestServer.StructuredFailure';
+
+    protected override async InternalExecute(): Promise<TestOpOutput> {
+        throw new RemoteOperationError('CUSTOM_DOMAIN_CODE', 'Structured domain validation rejected request');
+    }
+}
+void StructuredFailureOperation;
+
+describe('ExecuteRemoteOperationResolver', () => {
+    const fakeUser = { ID: 'user-1', Email: 'ada@example.com' } as UserInfo;
+    const pubSub: PubSubEngine = {
+        publish: vi.fn(async () => undefined),
+        subscribe: vi.fn(async () => 1),
+        unsubscribe: vi.fn(),
+        asyncIterator: vi.fn(),
+    } as PubSubEngine;
+
+    beforeEach(() => {
+        vi.spyOn(RemoteOperationEngineBase.Instance, 'Config').mockResolvedValue(undefined);
+        vi.spyOn(RemoteOperationEngineBase.Instance, 'IsInvokable').mockReturnValue({ Invokable: true });
+        vi.spyOn(RemoteOperationEngineBase.Instance, 'GetContractFingerprint').mockReturnValue(undefined);
+    });
+
+    function buildContext(overrides: Partial<AppContext> = {}): {
+        ctx: AppContext;
+        capturedOptions: RemoteOpInvokeOptions[];
+    } {
+        const capturedOptions: RemoteOpInvokeOptions[] = [];
+        const provider = {
+            RouteOperation: async <TIn, TOut>(
+                key: string,
+                opInput: TIn,
+                options: RemoteOpInvokeOptions = {},
+            ): Promise<RemoteOpResult<TOut>> => {
+                capturedOptions.push(options);
+                return DispatchRemoteOperationInProcess<TIn, TOut>(
+                    key,
+                    opInput,
+                    options,
+                    provider as IMetadataProvider,
+                    fakeUser,
+                );
+            },
+        };
+
+        const ctx: AppContext = {
+            dataSource: {} as AppContext['dataSource'],
+            dataSources: [],
+            providers: [{ provider: provider as AppContext['providers'][number]['provider'], type: 'Read-Write' }],
+            userPayload: {
+                email: 'ada@example.com',
+                userRecord: fakeUser,
+                sessionId: 'sess-abc-123',
+                apiKeyHash: 'hash-xyz-987',
+            },
+            RequestOrigin: 'https://app.example.com',
+            ClientIp: '198.51.100.24',
+            ...overrides,
+        };
+        return { ctx, capturedOptions };
+    }
+
+    it('forwards RequestOrigin, ClientIp, sessionId, and apiKeyHash into RouteOperation and Authorize/InternalExecute', async () => {
+        const resolver = new ExecuteRemoteOperationResolver();
+        const { ctx, capturedOptions } = buildContext();
+
+        const input: ExecuteRemoteOperationInput = {
+            operationKey: 'TestServer.ContextEcho',
+            inputJSON: JSON.stringify({ message: 'hi' }),
+            invokeMode: 'attached',
+            contractFingerprint: 'ro_fp_expected12345678',
+        };
+
+        const res = await resolver.ExecuteRemoteOperation(input, ctx, pubSub);
+        expect(res.success).toBe(true);
+        expect(res.resultCode).toBe('SUCCESS');
+        expect(capturedOptions).toHaveLength(1);
+        expect(capturedOptions[0].requestOrigin).toBe('https://app.example.com');
+        expect(capturedOptions[0].clientIp).toBe('198.51.100.24');
+        expect(capturedOptions[0].sessionId).toBe('sess-abc-123');
+        expect(capturedOptions[0].apiKeyHash).toBe('hash-xyz-987');
+
+        const parsed = JSON.parse(res.outputJSON!) as TestOpOutput;
+        expect(parsed).toEqual({
+            echoed: 'hi',
+            origin: 'https://app.example.com',
+            ip: '198.51.100.24',
+            sessionId: 'sess-abc-123',
+            apiKeyHash: 'hash-xyz-987',
+        });
+    });
+
+    it('enforces Authorize against context.requestOrigin', async () => {
+        const resolver = new ExecuteRemoteOperationResolver();
+        const { ctx } = buildContext({ RequestOrigin: 'https://evil.example.com' });
+
+        const res = await resolver.ExecuteRemoteOperation(
+            {
+                operationKey: 'TestServer.ContextEcho',
+                inputJSON: JSON.stringify({ message: 'hi' }),
+                invokeMode: 'attached',
+            },
+            ctx,
+            pubSub,
+        );
+        expect(res.success).toBe(false);
+        expect(res.resultCode).toBe('FORBIDDEN');
+    });
+
+    it('rejects stale client contractFingerprint with CONTRACT_MISMATCH before running operation', async () => {
+        const resolver = new ExecuteRemoteOperationResolver();
+        const { ctx, capturedOptions } = buildContext();
+
+        const res = await resolver.ExecuteRemoteOperation(
+            {
+                operationKey: 'TestServer.ContextEcho',
+                inputJSON: JSON.stringify({ message: 'hi' }),
+                invokeMode: 'attached',
+                contractFingerprint: 'ro_fp_stale00000000000',
+            },
+            ctx,
+            pubSub,
+        );
+        expect(res.success).toBe(false);
+        expect(res.resultCode).toBe('CONTRACT_MISMATCH');
+        expect(capturedOptions).toHaveLength(0);
+    });
+
+    it('surfaces custom RemoteOperationError ResultCodes on the GraphQL result', async () => {
+        const resolver = new ExecuteRemoteOperationResolver();
+        const { ctx } = buildContext();
+
+        const res = await resolver.ExecuteRemoteOperation(
+            {
+                operationKey: 'TestServer.StructuredFailure',
+                inputJSON: JSON.stringify({ message: 'check' }),
+                invokeMode: 'attached',
+            },
+            ctx,
+            pubSub,
+        );
+        expect(res.success).toBe(false);
+        expect(res.resultCode).toBe('CUSTOM_DOMAIN_CODE');
+        expect(res.errorMessage).toBe('Structured domain validation rejected request');
+    });
+});