@memberjunction/server 6.2.0-edge.6 → 6.2.0-edge.7

package/src/integration/ScopedFieldsForBuild.ts

@@ -0,0 +1,113 @@
+/**
+ * The FIELD rows a schema build materializes, for a connection with its own catalog.
+ *
+ * A schema build (ApplySchema, ApplyAll, ApplyAllBatch, the connector build, schema evolution)
+ * reconstructs the source schema from persisted catalog rows and hands it to SchemaBuilder. It used
+ * to read each object's fields from the engine's in-memory catalog. Once a connection's field rows
+ * are no longer held resident — they are warmed per object on demand, and the only site that warms
+ * them is the sync loop — that read answers `[]` for every object of the connection, and an object
+ * with no fields materializes nothing. Observed on a per-connection catalog (364 objects, 7,230
+ * active fields): the apply logged "Reusing 364 persisted IOs", then ran a migration with an empty
+ * table list in 4 ms — no CREATE, no ALTER, no error.
+ *
+ * So the build reads the connection's field rows itself: one read per {@link SCOPED_FIELDS_CHUNK}
+ * objects, plain rows, bypassing the query cache (an answer cached before discovery's persist is the
+ * empty set), and without the row cap (one object can carry thousands of fields). A failed read
+ * THROWS: an empty answer here is exactly what produced the zero-table apply.
+ *
+ * Outside a per-connection scope — or for a connection without its own catalog — this returns
+ * `null`, and the build reads the shared catalog from memory exactly as before.
+ */
+import { RunView, type UserInfo } from '@memberjunction/core';
+import type { MJIntegrationObjectFieldEntity } from '@memberjunction/core-entities';
+import {
+    IntegrationEngineBase,
+    ENTITY_COMPANY_INTEGRATION_OBJECT_FIELDS,
+    type CompanyIntegrationObjectFieldRow,
+} from '@memberjunction/integration-engine-base';
+import { CurrentCatalogCI } from '@memberjunction/integration-engine';
+
+/**
+ * What a schema build — and a refresh's re-key check — reads off a field row. The shared entity and
+ * the per-connection row both satisfy it.
+ */
+export type BuildFieldRow = Pick<
+    MJIntegrationObjectFieldEntity,
+    'Name' | 'DisplayName' | 'Description' | 'Type' | 'IsRequired' | 'AllowsNull' | 'Length' | 'Precision'
+    | 'Scale' | 'DefaultValue' | 'IsPrimaryKey' | 'IsUniqueKey' | 'IsReadOnly' | 'RelatedIntegrationObjectID' | 'Status'
+    | 'Sequence'
+>;
+
+/** A connection's field rows, keyed by lower-cased per-connection object id. */
+export type ScopedBuildFields = Map<string, CompanyIntegrationObjectFieldRow[]>;
+
+/** Objects per read. Each read is one `IN (…)` list, so this bounds the filter's length. */
+export const SCOPED_FIELDS_CHUNK = 200;
+
+/** A per-connection field row as the database returns it — before the legacy read names are derived. */
+type StoredFieldRow = Omit<CompanyIntegrationObjectFieldRow, 'IntegrationObjectID' | 'RelatedIntegrationObjectID'>;
+
+/**
+ * Loads the field rows of the connection in catalog scope for a schema build, or returns `null`
+ * when the build should read the shared catalog (no scope, or no per-connection catalog).
+ *
+ * @throws PER_CONNECTION_FIELDS_UNREADABLE when a read fails — never an empty answer.
+ */
+export async function LoadScopedFieldsForBuild(integrationID: string, user: UserInfo): Promise<ScopedBuildFields | null> {
+    const ciID = CurrentCatalogCI();
+    if (!ciID) return null;
+    const engine = IntegrationEngineBase.Instance;
+    if (!engine.HasCompanyIntegrationCatalog(ciID)) return null;
+
+    const objects = engine.GetActiveIntegrationObjects(integrationID);
+    const byObject: ScopedBuildFields = new Map();
+    const rv = new RunView();
+    for (let i = 0; i < objects.length; i += SCOPED_FIELDS_CHUNK) {
+        const chunk = objects.slice(i, i + SCOPED_FIELDS_CHUNK);
+        const ids = chunk.map(o => `'${String(o.ID).replace(/'/g, "''")}'`).join(',');
+        const res = await rv.RunView<StoredFieldRow>({
+            EntityName: ENTITY_COMPANY_INTEGRATION_OBJECT_FIELDS,
+            ExtraFilter: `CompanyIntegrationObjectID IN (${ids})`,
+            ResultType: 'simple',
+            BypassCache: true,
+            IgnoreMaxRows: true,
+        }, user);
+        if (!res?.Success) {
+            throw new Error(
+                `PER_CONNECTION_FIELDS_UNREADABLE: could not read the field rows of connection ${ciID} ` +
+                `(objects ${i + 1}-${i + chunk.length} of ${objects.length}): ${res?.ErrorMessage ?? 'unknown error'}. ` +
+                `Refusing to build a schema from an empty field list.`
+            );
+        }
+        for (const row of res.Results ?? []) addRow(byObject, row);
+    }
+    const rowCount = [...byObject.values()].reduce((n, rows) => n + rows.length, 0);
+    console.log(`[LoadScopedFieldsForBuild] connection ${ciID}: ${rowCount} field rows for ${byObject.size} of ${objects.length} active objects`);
+    return byObject;
+}
+
+/**
+ * The fields a build reads for one object: the connection's rows when they were loaded, the
+ * engine's catalog otherwise. With loaded rows the engine is not consulted at all, so a cold
+ * per-connection field cache cannot empty the build.
+ */
+export function FieldsForBuild(objectID: string, scoped: ScopedBuildFields | null | undefined, engine: IntegrationEngineBase): BuildFieldRow[] {
+    if (scoped) return scoped.get(String(objectID).trim().toLowerCase()) ?? [];
+    return engine.GetIntegrationObjectFields(objectID);
+}
+
+/**
+ * Files one stored row under its object, deriving the two legacy names the build reads
+ * (`IntegrationObjectID`, `RelatedIntegrationObjectID`) exactly as the engine's projection does.
+ */
+function addRow(byObject: ScopedBuildFields, row: StoredFieldRow): void {
+    const key = String(row.CompanyIntegrationObjectID).trim().toLowerCase();
+    const projected: CompanyIntegrationObjectFieldRow = {
+        ...row,
+        IntegrationObjectID: row.CompanyIntegrationObjectID,
+        RelatedIntegrationObjectID: row.RelatedCompanyIntegrationObjectID ?? null,
+    };
+    const bucket = byObject.get(key);
+    if (bucket) bucket.push(projected);
+    else byObject.set(key, [projected]);
+}

package/src/integration/TargetConfigGuard.ts

@@ -0,0 +1,71 @@
+/**
+ * Refuses a schema build whose selected objects produced no target table.
+ *
+ * `buildTargetConfigs` drops a selected object that is not in the source schema, has no fields or
+ * has no primary key, and logs each drop — but every execution caller then built and ran a migration
+ * anyway. With nothing accepted that migration is a header-only file: RSU wrote it, opened and merged
+ * a PR, ran CodeGen, redeployed Explorer, and the sync "completed" over zero entity maps, every signal
+ * green. Seen 2026-10-29 on a PropFuel connection: three selections requested, three dropped as
+ * notInSchema, three empty migrations committed.
+ *
+ * A caller that asked for tables and gets none has failed, and should hear so with the names it asked
+ * for and why each was dropped — in the error itself, because an API or UI caller cannot read the
+ * server log line that used to be the only place the reasons appeared. Preview is deliberately not
+ * gated: an empty preview is an honest answer.
+ */
+import type { TargetTableConfig } from '@memberjunction/integration-schema-builder';
+
+/** Why `buildTargetConfigs` left each selected object out. */
+export interface TargetConfigDrops {
+    NotInSchema: string[];
+    NoFields: string[];
+    NoPrimaryKey: string[];
+}
+
+/** How many names one list in the error shows before summarising the rest — the summary log's cap. */
+export const TARGET_CONFIG_NAME_SAMPLE = 5;
+
+/** An empty set of drop lists, for `buildTargetConfigs` to fill. */
+export function NewTargetConfigDrops(): TargetConfigDrops {
+    return { NotInSchema: [], NoFields: [], NoPrimaryKey: [] };
+}
+
+/** `a, b, c, d, e and 163 more` — so a large selection cannot make a multi-KB error. */
+export function SampleNames(names: ReadonlyArray<string>): string {
+    const head = names.slice(0, TARGET_CONFIG_NAME_SAMPLE).join(', ');
+    const rest = names.length - TARGET_CONFIG_NAME_SAMPLE;
+    return rest > 0 ? `${head} and ${rest} more` : head;
+}
+
+/**
+ * Throws `NO_TARGET_TABLES` when objects were selected and none produced a target table.
+ *
+ * @param drops why each object was dropped; without it the error lists the three possible reasons.
+ * @param alreadyCommitted what the caller had already written before the build, for a caller that
+ *   cannot honestly say "Nothing was applied" (schema evolution persists the catalog and disables the
+ *   removed objects' maps first).
+ */
+export function AssertTargetConfigs(
+    objects: ReadonlyArray<{ SourceObjectName: string }>,
+    targetConfigs: ReadonlyArray<TargetTableConfig>,
+    sourceType: string,
+    drops?: TargetConfigDrops,
+    alreadyCommitted?: string,
+): void {
+    if (objects.length === 0 || targetConfigs.length > 0) return;
+    const reasons = drops ? describeDrops(drops) : '';
+    throw new Error(
+        `NO_TARGET_TABLES: none of the ${objects.length} selected object(s) for ${sourceType} produced a target table ` +
+        `(${SampleNames(objects.map(o => o.SourceObjectName))}). ` +
+        (reasons || 'Each was dropped as not in the source schema, without fields, or without a primary key.') +
+        ` ${alreadyCommitted ?? 'Nothing was applied.'} Re-run discovery for this connection and apply again.`
+    );
+}
+
+function describeDrops(drops: TargetConfigDrops): string {
+    const parts: string[] = [];
+    if (drops.NotInSchema.length > 0) parts.push(`not in the source schema: ${SampleNames(drops.NotInSchema)}`);
+    if (drops.NoFields.length > 0) parts.push(`no fields: ${SampleNames(drops.NoFields)}`);
+    if (drops.NoPrimaryKey.length > 0) parts.push(`no primary key: ${SampleNames(drops.NoPrimaryKey)}`);
+    return parts.length > 0 ? `Dropped as ${parts.join('; ')}.` : '';
+}

package/src/realtimeSessions/ownedRealtimeSession.ts

@@ -8,7 +8,7 @@
 import { IMetadataProvider, LogError, UserInfo } from '@memberjunction/core';
 import { UUIDsEqual } from '@memberjunction/global';
 import type { MJAIAgentSessionEntity } from '@memberjunction/core-entities';
-import { AuthorizeSessionAccess, LoadSessionConversationScope } from './sessionAccess.js';
+import { AuthorizeLoadedSession } from './sessionAccess.js';
 
 const SESSION_ENTITY = 'MJ: AI Agent Sessions';
 
@@ -54,11 +54,7 @@ export async function LoadOwnedRealtimeSession(
         );
         throw new RealtimeSessionOwnershipError(agentSessionId);
     }
-    const conversation = await LoadSessionConversationScope(session, contextUser, provider);
-    const access = AuthorizeSessionAccess(
-        { SessionUserID: session.UserID, ConversationExternalID: conversation.ExternalID, ConversationReadable: conversation.Readable },
-        contextUser,
-    );
+    const access = await AuthorizeLoadedSession(session, contextUser, provider);
     if (!access.Allowed) {
         LogError(
             `LoadOwnedRealtimeSession: session access refused (${access.Reason}) — user ${contextUser.ID} attempted to operate on session ${agentSessionId}`,

package/src/realtimeSessions/sessionAccess.ts

@@ -199,6 +199,36 @@ export async function LoadSessionConversationScope(
     return { ExternalID, Readable };
 }
 
+/**
+ * Decides whether `contextUser` may address an already-loaded `session`: the {@link AuthorizeSessionAccess}
+ * decision, reading the session's conversation only when that decision needs it.
+ *
+ * {@link AuthorizeSessionAccess} decides a principal without a scope identity — a named user with no magic-link
+ * scope, the usual signed-in caller — from the owner check alone, and refuses a non-owner before it looks at
+ * anything else, so neither needs the conversation read. This function and that one encode the same rule on
+ * purpose and live together for that reason: change the rule there, change the read here. The
+ * `AuthorizeLoadedSession` table test in `sessionAccess.test.ts` fails if the two ever disagree.
+ *
+ * @param session - the session, loaded through the caller's own gate
+ * @param contextUser - the authenticated caller; the conversation, when read, is read as this user (RLS applies)
+ * @param provider - the request-scoped provider
+ */
+export async function AuthorizeLoadedSession(
+    session: MJAIAgentSessionEntity,
+    contextUser: UserInfo,
+    provider: IMetadataProvider,
+): Promise<SessionAccessDecision> {
+    const ownsSession = !!contextUser?.ID && !!session.UserID && UUIDsEqual(session.UserID, contextUser.ID);
+    if (!ownsSession || !ResolveSessionScopeIdentity(contextUser)) {
+        return AuthorizeSessionAccess({ SessionUserID: session.UserID, ConversationExternalID: null, ConversationReadable: false }, contextUser);
+    }
+    const conversation = await LoadSessionConversationScope(session, contextUser, provider);
+    return AuthorizeSessionAccess(
+        { SessionUserID: session.UserID, ConversationExternalID: conversation.ExternalID, ConversationReadable: conversation.Readable },
+        contextUser,
+    );
+}
+
 /**
  * Reads a conversation's owner and scope id under `contextUser` (so its row-level security applies), for a
  * caller that addresses the conversation directly rather than through a session — a text agent turn, for

package/src/realtimeWidget/WidgetSessionService.ts

@@ -861,6 +861,7 @@ export class WidgetSessionService {
         ExtraFilter: `VisitorKey = '${visitorKey}' AND ApplicationID = '${applicationId.replace(/'/g, "''")}'`,
         OrderBy: '__mj_CreatedAt DESC',
         MaxRows: 1,
+        SkipTotalRowCount: true,
         Fields: ['ID'],
         ResultType: 'simple',
       },
@@ -885,6 +886,7 @@ export class WidgetSessionService {
         EntityName: WIDGET_ENTITY,
         ExtraFilter: `PublicKey = '${key.replace(/'/g, "''")}'`,
         MaxRows: 1,
+        SkipTotalRowCount: true,
         ResultType: 'entity_object',
       },
       contextUser,

package/src/realtimeWidget/visitorIdentity.ts

@@ -79,6 +79,7 @@ export async function ResolveIdentityByEmail(
         ExtraFilter: `${emailField} = '${trimmed.replace(/'/g, "''")}'`,
         Fields: pkNames,
         MaxRows: 1,
+        SkipTotalRowCount: true,
         ResultType: 'simple',
       },
       contextUser,

package/src/realtimeWidget/widgetCore.ts

@@ -14,6 +14,7 @@
 
 import { BuildSessionClaims, IsRoleGrantable } from '../auth/magicLink/magicLinkCore.js';
 import type { MagicLinkJWTClaims } from '../auth/magicLink/types.js';
+import { NormalizeOrigin } from '../requestOrigin.js';
 
 /**
  * The magic-link resource-scope `resourceType` used for a widget guest session. Pairs with the
@@ -77,12 +78,12 @@ export function ParseAllowedOrigins(allowedOrigins: string | null | undefined):
     list = JSON.parse(raw);
   } catch {
     // Not JSON — tolerate a CSV form.
-    return raw.split(',').map((s) => normalizeOrigin(s)).filter((s): s is string => !!s);
+    return raw.split(',').map((s) => NormalizeOrigin(s)).filter((s): s is string => !!s);
   }
   if (!Array.isArray(list)) {
     return [];
   }
-  return list.filter((s): s is string => typeof s === 'string').map(normalizeOrigin).filter((s): s is string => !!s);
+  return list.filter((s): s is string => typeof s === 'string').map(NormalizeOrigin).filter((s): s is string => !!s);
 }
 
 /** @deprecated Use {@link ParseAllowedOrigins}. */
@@ -90,11 +91,6 @@ export function parseAllowedOrigins(allowedOrigins: string | null | undefined):
   return ParseAllowedOrigins(allowedOrigins);
 }
 
-/** Lowercases + trims an origin and strips a trailing slash for stable comparison. */
-function normalizeOrigin(origin: string): string {
-  return origin.trim().toLowerCase().replace(/\/+$/, '');
-}
-
 /**
  * Parses the widget's `EnabledChannels` column into a clean list of channel names (Phase 2). Accepts a
  * JSON array (preferred, e.g. `["Whiteboard"]`) or a comma-separated string (tolerated). Returns an
@@ -129,7 +125,7 @@ export function IsOriginAllowed(requestOrigin: string | null | undefined, allowe
   if (!requestOrigin || allowedOrigins.length === 0) {
     return false;
   }
-  const candidate = normalizeOrigin(requestOrigin);
+  const candidate = NormalizeOrigin(requestOrigin);
   return allowedOrigins.some((o) => o === candidate);
 }
 

package/src/realtimeWidget/widgetGuestElevation.ts

@@ -190,6 +190,7 @@ async function loadWidgetById(
       EntityName: WIDGET_ENTITY,
       ExtraFilter: `ID = '${widgetId.replace(/'/g, "''")}'`,
       MaxRows: 1,
+      SkipTotalRowCount: true,
       ResultType: 'entity_object',
     },
     elevatedUser,

package/src/requestOrigin.ts

@@ -0,0 +1,64 @@
+/**
+ * Request-origin helpers shared by the GraphQL context (`AppContext.RequestOrigin`) and the realtime
+ * widget origin allowlist, so an origin read from a request and an origin read from an allowlist are
+ * normalized the same way and compare with plain string equality.
+ */
+
+/**
+ * Shape of a serialized http(s) origin: scheme, host and optional port, with no path, query,
+ * fragment or credentials. Applied after {@link NormalizeOrigin}, so it only needs lowercase.
+ */
+const HTTP_ORIGIN_PATTERN = /^https?:\/\/[^/?#@\s]+$/;
+
+/** Character code of `/`. */
+const SLASH_CHAR_CODE = 47;
+
+/**
+ * Normalizes an origin for stable comparison: trims whitespace, lowercases, and strips trailing
+ * slashes. It does not parse the value or rewrite ports, so `https://a.com:443` stays as written.
+ * @param origin an origin as written in a header or an allowlist entry
+ */
+export function NormalizeOrigin(origin: string): string {
+  return StripTrailingSlashes(origin.trim().toLowerCase());
+}
+
+/**
+ * Removes trailing `/` characters with a linear scan. A `/\/+$/` regex is quadratic on input with
+ * many `/` not at the end, and this runs on a request header the client controls.
+ */
+function StripTrailingSlashes(value: string): string {
+  let end = value.length;
+  while (end > 0 && value.charCodeAt(end - 1) === SLASH_CHAR_CODE) {
+    end--;
+  }
+  return value.slice(0, end);
+}
+
+/**
+ * Reads a request's `Origin` header into a normalized origin (`scheme://host[:port]`).
+ *
+ * Returns undefined when the header is absent, repeated, blank, opaque (`null`, which sandboxed
+ * frames and privacy-sensitive redirects send), or anything other than a parseable http(s) origin.
+ * Ports are kept as sent: browsers omit default ports from `Origin`, and allowlist entries pass
+ * through the same {@link NormalizeOrigin}, so both sides agree without rewriting.
+ * @param originHeader the raw `Origin` header value from the request
+ */
+export function ReadRequestOrigin(originHeader: string | string[] | undefined): string | undefined {
+  if (typeof originHeader !== 'string') {
+    return undefined;
+  }
+  const normalized = NormalizeOrigin(originHeader);
+  return IsHttpOrigin(normalized) ? normalized : undefined;
+}
+
+/** True when a normalized value is a parseable http(s) origin with no path, query, fragment or credentials. */
+function IsHttpOrigin(normalized: string): boolean {
+  if (!HTTP_ORIGIN_PATTERN.test(normalized)) {
+    return false;
+  }
+  try {
+    return new URL(normalized).host.length > 0;
+  } catch {
+    return false;
+  }
+}

package/src/resolvers/AgentSessionResolver.ts

@@ -23,8 +23,12 @@ import {
     RealtimeSessionOwnershipError,
 } from '../realtimeSessions/ownedRealtimeSession.js';
 
-/** The `CloseReason` values a client may stamp on its own session; `Janitor` and `Shutdown` are the server's. */
-const CLIENT_CLOSE_REASONS: readonly SessionCloseReason[] = ['Explicit', 'Error'];
+/**
+ * The `CloseReason` values a client may stamp on its own session; `Idle`, `Janitor` and `Shutdown` are the server's.
+ * `TimeLimit` is a claim: the browser's deadline alarm fired, and {@link SessionManager.CloseSession} verifies it
+ * against the session's stored deadline, recording `Explicit` instead when the deadline is not near.
+ */
+const CLIENT_CLOSE_REASONS: readonly SessionCloseReason[] = ['Explicit', 'Error', 'TimeLimit'];
 
 /** Reads the mutation's optional `closeReason`: absent means `Explicit`; a server-only or unknown value is refused. */
 function ParseClientCloseReason(closeReason: string | null | undefined): SessionCloseReason {

package/src/resolvers/AutotagPipelineResolver.ts

@@ -170,7 +170,8 @@ export class AutotagPipelineResolver extends ResolverBase {
                     EntityName: 'MJ: Content Sources',
                     Fields: ['ID'],
                     ResultType: 'simple',
-                    MaxRows: 1
+                    MaxRows: 1,
+                    SkipTotalRowCount: true
                 }, currentUser);
                 if (result.Success && result.Results.length > 0) {
                     sourceID = result.Results[0].ID;

package/src/resolvers/ConversationRunEventsResolver.ts

@@ -235,6 +235,7 @@ export class ConversationRunEventsResolver {
                 EntityName: 'MJ: Conversation Details',
                 ExtraFilter: `ID='${this.escape(conversationDetailID)}'`,
                 MaxRows: 1,
+                SkipTotalRowCount: true,
                 ResultType: 'entity_object',
                 BypassCache: true,
             },
@@ -259,6 +260,7 @@ export class ConversationRunEventsResolver {
                 ExtraFilter: `ConversationDetailID='${this.escape(conversationDetailID)}'`,
                 OrderBy: '__mj_CreatedAt DESC',
                 MaxRows: 1,
+                SkipTotalRowCount: true,
                 Fields: RUN_FIELDS,
                 ResultType: 'simple',
                 BypassCache: true,

package/src/resolvers/ExecuteRemoteOperationResolver.ts

@@ -12,13 +12,13 @@ const REMOTE_OP_PROGRESS_TOPIC = 'RemoteOperationProgress';
 /** Input for the generic Remote Operation transport mutation. */
 @InputType()
 export class ExecuteRemoteOperationInput {
-    @Field()
+    @Field(() => String)
     operationKey: string;  // case-violation-ok-legacy-back-compat: the property name is the GraphQL schema field name — renaming it breaks every client query
 
-    @Field()
+    @Field(() => String)
     inputJSON: string;  // case-violation-ok-legacy-back-compat: the property name is the GraphQL schema field name — renaming it breaks every client query
 
-    @Field()
+    @Field(() => String)
     invokeMode: string;  // case-violation-ok-legacy-back-compat: the property name is the GraphQL schema field name — renaming it breaks every client query
 
     /**
@@ -28,16 +28,24 @@ export class ExecuteRemoteOperationInput {
      */
     @Field(() => String, { nullable: true })
     progressChannelId?: string;  // case-violation-ok-legacy-back-compat: the property name is the GraphQL schema field name — renaming it breaks every client query
+
+    /**
+     * Optional structural contract fingerprint emitted by CodeGen (or supplied by the caller).
+     * When provided, the server rejects requests whose fingerprint diverges from the server's
+     * active operation contract with `ResultCode = 'CONTRACT_MISMATCH'`.
+     */
+    @Field(() => String, { nullable: true })
+    contractFingerprint?: string;  // case-violation-ok-legacy-back-compat: matches camelCase GraphQL input field convention on ExecuteRemoteOperationInput
 }
 
 /** A single streamed progress envelope delivered over the `RemoteOperationProgress` subscription. */
 @ObjectType()
 export class RemoteOperationProgressNotification {
-    @Field()
+    @Field(() => String)
     ChannelId: string;
 
     /** JSON-serialized {@link RemoteOpProgress}. */
-    @Field()
+    @Field(() => String)
     ProgressJSON: string;
 }
 
@@ -71,7 +79,7 @@ export class ExecuteRemoteOperationResultType {
 export class ExecuteRemoteOperationResolver extends ResolverBase {
     @Mutation(() => ExecuteRemoteOperationResultType)
     async ExecuteRemoteOperation(
-        @Arg('input') input: ExecuteRemoteOperationInput,
+        @Arg('input', () => ExecuteRemoteOperationInput) input: ExecuteRemoteOperationInput,
         @Ctx() ctx: AppContext,
         @PubSub() pubSub: PubSubEngine,
     ): Promise<ExecuteRemoteOperationResultType> {
@@ -111,9 +119,24 @@ export class ExecuteRemoteOperationResolver extends ResolverBase {
                 return fail(invokability.ResultCode ?? 'OPERATION_UNAVAILABLE', invokability.Reason ?? `Operation '${key}' is unavailable`);
             }
 
-            let parsedInput: unknown;
+            // (5) Contract fingerprint gate: when the client sends a contractFingerprint, verify it against
+            // the active server operation's ContractFingerprint (or metadata-derived fingerprint) so stale
+            // client bundles fail loudly with CONTRACT_MISMATCH rather than mis-deserializing.
+            const clientFingerprint = input.contractFingerprint?.trim();
+            if (clientFingerprint) {
+                const expectedFingerprint =
+                    opDecl?.ContractFingerprint ?? RemoteOperationEngineBase.Instance.GetContractFingerprint(key);
+                if (expectedFingerprint && clientFingerprint !== expectedFingerprint) {
+                    return fail(
+                        'CONTRACT_MISMATCH',
+                        `Contract fingerprint mismatch for operation '${key}' (client='${clientFingerprint}', server='${expectedFingerprint}')`,
+                    );
+                }
+            }
+
+            let parsedInput: object | string | number | boolean | null;
             try {
-                parsedInput = input.inputJSON ? JSON.parse(input.inputJSON) : {};
+                parsedInput = input.inputJSON ? (JSON.parse(input.inputJSON) as object | string | number | boolean | null) : {};
             } catch (e) {
                 return fail('INVALID_INPUT_JSON', `Invalid input JSON: ${e instanceof Error ? e.message : String(e)}`);
             }
@@ -127,7 +150,16 @@ export class ExecuteRemoteOperationResolver extends ResolverBase {
                 : undefined;
 
             // Route through the per-request provider (server in-process path; runs the op's Authorize + InternalExecute).
-            const result = await provider.RouteOperation(key, parsedInput, { user, mode: input.invokeMode as RemoteOpInvokeMode, onProgress });
+            const result = await provider.RouteOperation(key, parsedInput, {
+                user,
+                mode: input.invokeMode as RemoteOpInvokeMode,
+                onProgress,
+                contractFingerprint: clientFingerprint,
+                requestOrigin: ctx.RequestOrigin,
+                clientIp: ctx.ClientIp,
+                sessionId: ctx.userPayload?.sessionId,
+                apiKeyHash: ctx.userPayload?.apiKeyHash,
+            });
 
             return {
                 success: result.Success,

package/src/resolvers/GetDataResolver.ts

@@ -6,6 +6,7 @@ import { QueryCompositionEngine } from '@memberjunction/generic-database-provide
 import { RequireSystemUser } from '../directives/RequireSystemUser.js';
 import { NoLog } from '../logging/NoLog.js';
 import { v4 as uuidv4 } from 'uuid';
+import { createHash, timingSafeEqual } from 'node:crypto';
 import { GetReadOnlyDataSource, GetReadOnlyProvider } from '../util.js';
 import { GetDbType } from '../index.js';
 import { GetSystemUser } from '../auth/index.js';
@@ -125,9 +126,9 @@ export class GetDataResolver {
             });
             LogStatus(`GetData invoked: ${input.Queries.length} queries`);
 
-            // validate the token
+            // validate the token (never echo the raw token into error messages or logs — Token is @NoLog)
             if (!IsTokenValid(input.Token)) {
-                throw new Error(`Token ${input.Token} is not valid or has expired`);
+                throw new Error('Access token is not valid or has expired');
             }
 
             // Use the read-only connection for executing queries
@@ -296,6 +297,26 @@ export class GetDataAccessToken {
 const __accessTokens: GetDataAccessToken[] = [];
 const __defaultTokenLifeSpan = 1000 * 60 * 5; // 5 minutes
 
+/**
+ * Non-short-circuiting constant-time scan over active access tokens: hashes the presented token
+ * once and compares against every stored token digest with `timingSafeEqual` without breaking early,
+ * so neither prefix similarity, token length, nor array index leaks through timing.
+ */
+function findMatchingAccessTokenIndex(token: string): number {
+    if (typeof token !== 'string' || token.length === 0) {
+        return -1;
+    }
+    const targetDigest = createHash('sha256').update(token).digest();
+    let matchedIndex = -1;
+    for (let i = 0; i < __accessTokens.length; i++) {
+        const candidateDigest = createHash('sha256').update(__accessTokens[i].Token).digest();
+        if (timingSafeEqual(candidateDigest, targetDigest)) {
+            matchedIndex = i;
+        }
+    }
+    return matchedIndex;
+}
+
 /**
  * Removes every token whose `ExpiresAt` has already passed (and its `TokenUses`
  * log along with it). Without this sweep `__accessTokens` grows forever — nothing
@@ -339,7 +360,7 @@ export function RegisterAccessToken(token?: string, lifeSpan: number = __default
 
     if (TokenExists(tokenToUse)) {
         // should never happen if we used the uuidv4() function but could happen if someone tries to use a custom token
-        throw new Error(`Token ${tokenToUse} already exists`);
+        throw new Error('Access token already exists');
     }
 
     const newToken = new GetDataAccessToken();
@@ -356,12 +377,12 @@ export function registerAccessToken(token?: string, lifeSpan: number = __default
     return RegisterAccessToken(token, lifeSpan, requestorPayload);
 }
 export function DeleteAccessToken(token: string) {
-    const index = __accessTokens.findIndex((t) => t.Token === token);
+    const index = findMatchingAccessTokenIndex(token);
     if (index >= 0) {
         __accessTokens.splice(index, 1);
     }
     else {
-        throw new Error(`Token ${token} does not exist`);
+        throw new Error('Access token does not exist');
     }
 }
 
@@ -370,7 +391,7 @@ export function deleteAccessToken(token: string) {
     return DeleteAccessToken(token);
 }
 export function TokenExists(token: string) {
-    return __accessTokens.find((t) => t.Token === token) !== undefined;
+    return findMatchingAccessTokenIndex(token) >= 0;
 }
 
 /** @deprecated Use {@link TokenExists}. */
@@ -378,9 +399,9 @@ export function tokenExists(token: string) {
     return TokenExists(token);
 }
 export function IsTokenValid(token: string) {
-    const t = __accessTokens.find((t) => t.Token === token);
-    if (t) {
-        return t.ExpiresAt > new Date();
+    const index = findMatchingAccessTokenIndex(token);
+    if (index >= 0) {
+        return __accessTokens[index].ExpiresAt > new Date();
     }
     return false;
 }
@@ -390,15 +411,16 @@ export function isTokenValid(token: string) {
     return IsTokenValid(token);
 } 
 export function RecordTokenUse(token: string, usePayload: any) {
-    const t = __accessTokens.find((t) => t.Token === token);
-    if (t) {
+    const index = findMatchingAccessTokenIndex(token);
+    if (index >= 0) {
+        const t = __accessTokens[index];
         if (!t.TokenUses) {
             t.TokenUses = [];
         }
-        t.TokenUses.push({ Token: token, UsedAt: new Date(), UsePayload: usePayload });
+        t.TokenUses.push({ Token: t.Token, UsedAt: new Date(), UsePayload: usePayload });
     }
     else {
-        throw new Error(`Token ${token} does not exist`);
+        throw new Error('Access token does not exist');
     }
 }