@memberjunction/server 6.2.0-edge.6 → 6.2.0-edge.8

package/dist/generic/ResolverBase.js

@@ -7,8 +7,8 @@ import { RefusalExtensions } from './refusalExtensions.js';
 import { GetAPIKeyEngine } from '@memberjunction/api-keys';
 import { httpTransport, CloudEvent, emitterFor } from 'cloudevents';
 import { DeleteOptionsInput } from './DeleteOptionsInput.js';
-import { MJEventType, MJGlobal, UUIDsEqual, ENCRYPTED_SENTINEL, ReplaceByteArraysWithBase64, EscapeSQLString, IsValueEncrypted, IsOnlyTimezoneShift } from '@memberjunction/global';
-import { SQLParser, IsBalancedSQLFragment, LexSQL } from '@memberjunction/sql-parser';
+import { MJEventType, MJGlobal, UUIDsEqual, ENCRYPTED_SENTINEL, ReplaceByteArraysWithBase64, EscapeSQLString, IsValueEncrypted, IsOnlyTimezoneShift, Canonicalize } from '@memberjunction/global';
+import { SQLParser, IsBalancedSQLFragment, LexSQL, StrictFragmentValidator } from '@memberjunction/sql-parser';
 import { EncryptionEngine, IsEncryptionKeyUnavailable, ReportEncryptionKeyUnavailable } from '@memberjunction/encryption';
 import { PublishStatusUpdate, StatusUpdateOwnerID } from './PushStatusResolver.js';
 import { CACHE_INVALIDATION_TOPIC, MayBroadcastRecordData } from './CacheInvalidationResolver.js';
@@ -22,6 +22,12 @@ import { FieldMapper } from '@memberjunction/graphql-dataprovider';
  * `mj: conversations` and `mj: ai agent sessions` carry the anonymous realtime-session ownership key
  * (`ExternalID` / `ConversationID`), which their server entities refuse an anonymous visitor to change — a rule
  * that decides on `Dirty`, so the baseline must be the stored row, not a client-supplied one (#4931).
+ *
+ * `mj: projects` (conversation folders) is refused a change to `OwnerUserID` or `ParentID` by anyone but the
+ * stored owner, a rule that reads the stored owner, so it must hold even if a host stops tracking its changes.
+ *
+ * `mj: diagnostic sender registrations` is refused a change to its guarded fields by a rule that decides on
+ * `Dirty`, so the baseline must be the stored row.
  */
 const ENTITIES_THAT_ALWAYS_LOAD_STORED_ROW = new Set([
     'mj: record changes',
@@ -30,11 +36,16 @@ const ENTITIES_THAT_ALWAYS_LOAD_STORED_ROW = new Set([
     'mj: conversations',
     'mj: ai agent sessions',
     'mj: ai agent runs',
+    'mj: projects',
+    'mj: diagnostic sender registrations',
 ]);
+const ACTIVE_ENTITY_SESSION_TTL_MS = 24 * 60 * 60 * 1000;
+const ACTIVE_ENTITY_SESSION_MAX_PER_ENTITY = 2048;
 export class ResolverBase {
     static { this._emit = process.env.CLOUDEVENTS_HTTP_TRANSPORT ? emitterFor(httpTransport(process.env.CLOUDEVENTS_HTTP_TRANSPORT)) : null; }
     static { this._cloudeventsHeaders = process.env.CLOUDEVENTS_HTTP_HEADERS ? JSON.parse(process.env.CLOUDEVENTS_HTTP_HEADERS) : {}; }
     static { this._eventSubscriptionKey = '___MJServer___ResolverBase___EventSubscriptions'; }
+    static { this._activeEntitySessionsKey = '___MJServer___ResolverBase___ActiveEntitySessions'; }
     get eventSubscriptions() {
         // here we use the global object store instead of a static member becuase in some cases based on import code paths/bundling/etc, the static member
         // could actually be duplicated and we'd end up with multiple instances of the same map, which would be bad.
@@ -45,6 +56,13 @@ export class ResolverBase {
         }
         return g[ResolverBase._eventSubscriptionKey];
     }
+    get activeEntitySessions() {
+        const g = MJGlobal.Instance.GetGlobalObjectStore();
+        if (!g[ResolverBase._activeEntitySessionsKey]) {
+            g[ResolverBase._activeEntitySessionsKey] = new Map();
+        }
+        return g[ResolverBase._activeEntitySessionsKey];
+    }
     /**
      * Maps field names to their GraphQL-safe CodeNames and handles encryption for API responses.
      *
@@ -334,28 +352,25 @@ export class ResolverBase {
             if (field.AllowDecryptInAPI)
                 continue;
             // AllowDecryptInAPI is false - we need to filter the value
+            if (!field.SendEncryptedValue) {
+                // SendEncryptedValue is false - replace with sentinel immediately without touching EncryptionEngine
+                dataObject[fieldName] = ENCRYPTED_SENTINEL;
+                continue;
+            }
             const engine = EncryptionEngine.Instance;
             await engine.Config(false, contextUser);
             const keyMarker = field.EncryptionKeyID ? engine.GetKeyByID(field.EncryptionKeyID)?.Marker : undefined;
-            if (field.SendEncryptedValue) {
-                // Re-encrypt the value before sending
-                // Only re-encrypt if it's not already encrypted (data provider decrypted it)
-                if (typeof value === 'string' && !IsValueEncrypted(value, keyMarker)) {
-                    try {
-                        const encryptedValue = await engine.Encrypt(value, field.EncryptionKeyID, contextUser);
-                        dataObject[fieldName] = encryptedValue;
-                    }
-                    catch (err) {
-                        // If re-encryption fails, use sentinel for safety
-                        LogError(`Failed to re-encrypt field ${fieldName} for API response: ${err}`);
-                        dataObject[fieldName] = ENCRYPTED_SENTINEL;
-                    }
+            // Only encrypt if the value is not already encrypted (PreserveRestrictedApiCiphertext keeps DB/cache ciphertext intact)
+            if (typeof value === 'string' && !IsValueEncrypted(value, keyMarker)) {
+                try {
+                    const encryptedValue = await engine.Encrypt(value, field.EncryptionKeyID, contextUser);
+                    dataObject[fieldName] = encryptedValue;
+                }
+                catch (err) {
+                    // If re-encryption fails, use sentinel for safety
+                    LogError(`Failed to re-encrypt field ${fieldName} for API response: ${err}`);
+                    dataObject[fieldName] = ENCRYPTED_SENTINEL;
                 }
-                // If already encrypted (shouldn't happen normally), keep as-is
-            }
-            else {
-                // SendEncryptedValue is false - replace with sentinel
-                dataObject[fieldName] = ENCRYPTED_SENTINEL;
             }
         }
         return dataObject;
@@ -505,7 +520,7 @@ export class ResolverBase {
             if (viewInfo) {
                 return this.RunViewGenericInternal(provider, viewInfo, viewInput.ExtraFilter, viewInput.OrderBy, viewInput.UserSearchString, viewInput.ExcludeUserViewRunID, viewInput.OverrideExcludeFilter, viewInput.SaveViewResults, viewInput.Fields, viewInput.IgnoreMaxRows, viewInput.ExcludeDataFromAllPriorViewRuns, viewInput.ForceAuditLog, viewInput.AuditLogDescription, viewInput.ResultType, userPayload, viewInput.MaxRows, viewInput.StartRow, viewInput.Aggregates, viewInput.AfterKey
                     ? CompositeKey.FromKeyValuePairs(viewInput.AfterKey.KeyValuePairs)
-                    : undefined, viewInput.BypassCache, viewInput.DataSource, viewInput.IncludeBinaryFields, viewInput.AlternateBaseView, viewInput.Properties);
+                    : undefined, viewInput.BypassCache, viewInput.DataSource, viewInput.IncludeBinaryFields, viewInput.AlternateBaseView, viewInput.Properties, viewInput.SkipTotalRowCount);
             }
             else {
                 LogError(`RunViewByNameGeneric: View ${viewInput.ViewName} not found or no results returned`);
@@ -528,7 +543,7 @@ export class ResolverBase {
             if (!viewInfo) {
                 return null;
             }
-            return this.RunViewGenericInternal(provider, viewInfo, viewInput.ExtraFilter, viewInput.OrderBy, viewInput.UserSearchString, viewInput.ExcludeUserViewRunID, viewInput.OverrideExcludeFilter, viewInput.SaveViewResults, viewInput.Fields, viewInput.IgnoreMaxRows, viewInput.ExcludeDataFromAllPriorViewRuns, viewInput.ForceAuditLog, viewInput.AuditLogDescription, viewInput.ResultType, userPayload, viewInput.MaxRows, viewInput.StartRow, viewInput.Aggregates, undefined, viewInput.BypassCache, viewInput.DataSource, viewInput.IncludeBinaryFields, viewInput.AlternateBaseView, viewInput.Properties);
+            return this.RunViewGenericInternal(provider, viewInfo, viewInput.ExtraFilter, viewInput.OrderBy, viewInput.UserSearchString, viewInput.ExcludeUserViewRunID, viewInput.OverrideExcludeFilter, viewInput.SaveViewResults, viewInput.Fields, viewInput.IgnoreMaxRows, viewInput.ExcludeDataFromAllPriorViewRuns, viewInput.ForceAuditLog, viewInput.AuditLogDescription, viewInput.ResultType, userPayload, viewInput.MaxRows, viewInput.StartRow, viewInput.Aggregates, undefined, viewInput.BypassCache, viewInput.DataSource, viewInput.IncludeBinaryFields, viewInput.AlternateBaseView, viewInput.Properties, viewInput.SkipTotalRowCount);
         }
         catch (err) {
             console.log(err);
@@ -551,7 +566,7 @@ export class ResolverBase {
                 EntityID: entity.ID,
                 EntityBaseView: entity.BaseView,
             }; // only providing a few bits of data here, but it's enough to get the view to run
-            return this.RunViewGenericInternal(provider, viewInfo, viewInput.ExtraFilter, viewInput.OrderBy, viewInput.UserSearchString, viewInput.ExcludeUserViewRunID, viewInput.OverrideExcludeFilter, false, viewInput.Fields, viewInput.IgnoreMaxRows, false, viewInput.ForceAuditLog, viewInput.AuditLogDescription, viewInput.ResultType, userPayload, viewInput.MaxRows, viewInput.StartRow, viewInput.Aggregates, undefined, viewInput.BypassCache, viewInput.DataSource, viewInput.IncludeBinaryFields, viewInput.AlternateBaseView);
+            return this.RunViewGenericInternal(provider, viewInfo, viewInput.ExtraFilter, viewInput.OrderBy, viewInput.UserSearchString, viewInput.ExcludeUserViewRunID, viewInput.OverrideExcludeFilter, false, viewInput.Fields, viewInput.IgnoreMaxRows, false, viewInput.ForceAuditLog, viewInput.AuditLogDescription, viewInput.ResultType, userPayload, viewInput.MaxRows, viewInput.StartRow, viewInput.Aggregates, undefined, viewInput.BypassCache, viewInput.DataSource, viewInput.IncludeBinaryFields, viewInput.AlternateBaseView, undefined, viewInput.SkipTotalRowCount);
         }
         catch (err) {
             console.log(err);
@@ -621,6 +636,7 @@ export class ResolverBase {
                     bypassCache: viewInput.BypassCache,
                     dataSource: viewInput.DataSource,
                     includeBinaryFields: viewInput.IncludeBinaryFields,
+                    skipTotalRowCount: viewInput.SkipTotalRowCount,
                     alternateBaseView: viewInput.AlternateBaseView,
                     properties: viewInput.Properties,
                 });
@@ -844,7 +860,7 @@ export class ResolverBase {
      * Fails closed: no user, or an unresolvable reference, refuses.
      *
      * The references come from a walk of the whole parse tree
-     * (`ClientClauseScreen.CollectStatementReads`). The statement is refused when that walk does not
+     * (`StrictFragmentValidator.ValidateReadOnlyStatement`). The statement is refused when that walk does not
      * account for every SELECT in the text, or when a FROM item names no table (a table function or
      * a row list).
      *
@@ -860,14 +876,7 @@ export class ResolverBase {
         }
         const dialect = this.dialectForProvider(provider);
         ClientClauseScreen.AssertNoIdentifierAliasNames(sqlText, dialect, label);
-        const parser = new SQLParser(sqlText, dialect);
-        if (!parser.IsValid || parser.HasWriteStatement || parser.StatementKind !== 'select') {
-            throw new Error(`Invalid ${label}: not a safe read-only statement — refusing under uncertainty`);
-        }
-        if (this.astContainsWriteNode(parser.AST)) {
-            throw new Error(`Invalid ${label}: write/DDL nested in a subquery is not permitted`);
-        }
-        const reads = ClientClauseScreen.CollectStatementReads(parser);
+        const reads = this.strictReadOnlyStatementReads(sqlText, dialect, label);
         ClientClauseScreen.AssertEverySelectAccountedFor(sqlText, dialect, reads, label);
         const allowed = this.entityBaseViewAllowList(provider);
         for (const relation of reads.Relations) {
@@ -924,9 +933,19 @@ export class ResolverBase {
     hasBackslashInQuotes(clause, dialect) {
         return LexSQL(clause, dialect).some((t) => (t.Kind === 'string' || t.Kind === 'identifier') && t.Text.includes('\\'));
     }
-    /** Write/DDL node walk shared with the clause screen; see `ClientClauseScreen.AstContainsWriteNode`. */
-    astContainsWriteNode(node) {
-        return ClientClauseScreen.AstContainsWriteNode(node);
+    /**
+     * Parses a whole statement with the strict validator and returns what it reads; throws unless it
+     * is one plain read-only SELECT with no write or DDL at any depth.
+     */
+    strictReadOnlyStatementReads(sqlText, dialect, label) {
+        const result = StrictFragmentValidator.ValidateReadOnlyStatement(sqlText, dialect, { CollectReads: true });
+        if (result.Refusal === 'NestedWrite') {
+            throw new Error(`Invalid ${label}: write/DDL nested in a subquery is not permitted`);
+        }
+        if (!result.IsValid || !result.Reads) {
+            throw new Error(`Invalid ${label}: not a safe read-only statement — refusing under uncertainty`);
+        }
+        return result.Reads;
     }
     dialectForProvider(provider) {
         return ClientClauseScreen.DialectFor(provider);
@@ -940,7 +959,7 @@ export class ResolverBase {
      * - Field filtering at source (Fix #7)
      * - Improved error handling (Fix #9)
      */
-    async RunViewGenericInternal(provider, viewInfo, extraFilter, orderBy, userSearchString, excludeUserViewRunID, overrideExcludeFilter, saveViewResults, fields, ignoreMaxRows, excludeDataFromAllPriorViewRuns, forceAuditLog, auditLogDescription, resultType, userPayload, maxRows, startRow, aggregates, afterKey, bypassCache, dataSource, includeBinaryFields, alternateBaseView, properties) {
+    async RunViewGenericInternal(provider, viewInfo, extraFilter, orderBy, userSearchString, excludeUserViewRunID, overrideExcludeFilter, saveViewResults, fields, ignoreMaxRows, excludeDataFromAllPriorViewRuns, forceAuditLog, auditLogDescription, resultType, userPayload, maxRows, startRow, aggregates, afterKey, bypassCache, dataSource, includeBinaryFields, alternateBaseView, properties, skipTotalRowCount) {
         try {
             if (!viewInfo || !userPayload)
                 return null;
@@ -1007,9 +1026,11 @@ export class ResolverBase {
                 BypassCache: bypassCache,
                 DataSource: dataSource,
                 IncludeBinaryFields: includeBinaryFields,
+                SkipTotalRowCount: skipTotalRowCount,
                 AlternateBaseView: alternateBaseView,
                 Properties: properties,
                 TimeZone: userPayload?.TimeZone,
+                PreserveRestrictedApiCiphertext: true,
             }, user);
             if (result && typeof result === 'object') {
                 Object.defineProperty(result, '_resolvedViewEntity', {
@@ -1150,9 +1171,11 @@ export class ResolverBase {
                     BypassCache: param.bypassCache,
                     DataSource: param.dataSource,
                     IncludeBinaryFields: param.includeBinaryFields,
+                    SkipTotalRowCount: param.skipTotalRowCount,
                     AlternateBaseView: param.alternateBaseView,
                     Properties: param.properties,
                     TimeZone: param.userPayload?.TimeZone,
+                    PreserveRestrictedApiCiphertext: true,
                 });
             }
             // Fix #4: Run views in a single batch through RunViews
@@ -1324,11 +1347,38 @@ export class ResolverBase {
         });
     }
     ListenForEntityMessages(entityObject, pubSub, userPayload) {
-        // The unique key is set up for each entity object via it's primary key to ensure that we only have one listener at most for each unique
-        // entity in the system. This is important because we don't want to have multiple listeners for the same entity as it could
-        // cause issues with multiple messages for the same event.
+        // Maintain a single MJGlobal event listener per entity name so CloudEvents are emitted once
+        // per event, while routing WebSocket status updates dynamically across all active user sessions
+        // that have interacted with this entity type (instead of closing over only the first caller).
         const uniqueKey = entityObject.EntityInfo.Name;
-        if (!this.eventSubscriptions.has(uniqueKey)) {
+        const now = Date.now();
+        const isFreshSubscription = !this.eventSubscriptions.has(uniqueKey);
+        let sessionsForEntity = isFreshSubscription ? undefined : this.activeEntitySessions.get(uniqueKey);
+        if (!sessionsForEntity) {
+            sessionsForEntity = new Map();
+            this.activeEntitySessions.set(uniqueKey, sessionsForEntity);
+        }
+        else {
+            // Opportunistically evict expired session entries and enforce a safe per-entity cap
+            for (const [key, entry] of sessionsForEntity) {
+                if (now - entry.lastSeenAt > ACTIVE_ENTITY_SESSION_TTL_MS) {
+                    sessionsForEntity.delete(key);
+                }
+            }
+            if (sessionsForEntity.size >= ACTIVE_ENTITY_SESSION_MAX_PER_ENTITY) {
+                const oldestKey = sessionsForEntity.keys().next().value;
+                if (oldestKey !== undefined) {
+                    sessionsForEntity.delete(oldestKey);
+                }
+            }
+        }
+        if (userPayload) {
+            const sessionKey = userPayload.sessionId
+                ? `${userPayload.userRecord?.ID ?? ''}:${userPayload.sessionId}`
+                : (userPayload.userRecord?.ID ?? '__anonymous__');
+            sessionsForEntity.set(sessionKey, { pubSub, userPayload, lastSeenAt: now });
+        }
+        if (isFreshSubscription) {
             // listen for events from the entityObject in case it is a long running task and we can push messages back to the client via pubSub
             LogDebug(`ResolverBase.ListenForEntityMessages: About to call MJGlobal.Instance.GetEventListener() to get the event listener subscription for ${uniqueKey}`);
             const theSub = MJGlobal.Instance.GetEventListener(false).subscribe(async (event) => {
@@ -1340,14 +1390,27 @@ export class ResolverBase {
                         return;
                     }
                     const baseEntityValues = baseEntity ? this.EntityEventPayload(baseEntity, event.args instanceof BaseEntityEvent ? event.args.ChangedFieldNames : undefined) : null;
-                    const eventToLog = { entityName: entityObject.EntityInfo.Name, baseEntity: baseEntityValues, event: event.event, eventCode: event.eventCode };
+                    const eventToLog = { entityName: uniqueKey, baseEntity: baseEntityValues, event: event.event, eventCode: event.eventCode };
                     LogDebug(`ResolverBase.ListenForEntityMessages: Received Event from within MJGlobal.Instance.GetEventListener() callback. Will call EmitCloudEvent() next\nEvent data:\n${JSON.stringify(eventToLog)}`);
                     await this.EmitCloudEvent(event);
                     LogDebug(`ResolverBase.ListenForEntityMessages: EmitCloudEvent() completed successfully`);
-                    if (event.args && event.args instanceof BaseEntityEvent && this.EntityEventBelongsToSession(event.args, userPayload)) {
-                        // message from an entity object of this session's user, relay it to the client
-                        LogDebug('ResolverBase.ListenForEntityMessages: About to publish PUSH_STATUS_UPDATES_TOPIC');
-                        this.PublishStatusUpdate(pubSub, userPayload.sessionId, this.EntityStatusMessage(event.args), userPayload);
+                    if (event.args && event.args instanceof BaseEntityEvent) {
+                        const activeSessions = this.activeEntitySessions.get(uniqueKey);
+                        if (activeSessions && activeSessions.size > 0) {
+                            const eventNow = Date.now();
+                            let serializedMessage;
+                            for (const [sKey, session] of activeSessions) {
+                                if (eventNow - session.lastSeenAt > ACTIVE_ENTITY_SESSION_TTL_MS) {
+                                    activeSessions.delete(sKey);
+                                    continue;
+                                }
+                                if (this.EntityEventBelongsToSession(event.args, session.userPayload)) {
+                                    LogDebug('ResolverBase.ListenForEntityMessages: About to publish PUSH_STATUS_UPDATES_TOPIC');
+                                    serializedMessage ??= this.EntityStatusMessage(event.args);
+                                    this.PublishStatusUpdate(session.pubSub, session.userPayload.sessionId, serializedMessage, session.userPayload);
+                                }
+                            }
+                        }
                     }
                 }
             });
@@ -1823,134 +1886,268 @@ export class ResolverBase {
         }
         return entityInfo.Fields.find((f) => f.CodeName === key || f.Name === key);
     }
-    async TestAndSetClientOldValuesToDBValues(input, clientNewValues, entityObject, contextUser) {
-        // we have OldValues, so we need to compare them to the values we just loaded from the DB
+    /**
+     * Whether the API never gives a client this field's stored value: an encrypted field that is not
+     * decrypted for the API reaches the client only as the sentinel or as fresh ciphertext, so the
+     * client's old value for it can never be compared with the database value.
+     */
+    isFieldOpaqueToClient(field) {
+        return Boolean(field?.Encrypt && !field.AllowDecryptInAPI);
+    }
+    /**
+     * The client's new values without the opaque fields it only echoed back: the sentinel, or the same
+     * value it received as the old value. Writing either would replace the stored secret.
+     */
+    withoutEchoedOpaqueValues(entityInfo, clientNewValues, clientOldValues) {
+        const kept = {};
+        for (const key of Object.keys(clientNewValues)) {
+            const f = this.findEntityFieldByCodeNameOrName(entityInfo, key);
+            const newValue = clientNewValues[key];
+            const unchanged = key in clientOldValues && !this.areEntityFieldValuesDifferent(f, clientOldValues[key], newValue, false);
+            const echoed = this.isFieldOpaqueToClient(f) && (newValue === ENCRYPTED_SENTINEL || unchanged);
+            if (!echoed) {
+                kept[key] = newValue;
+            }
+        }
+        return kept;
+    }
+    /**
+     * Copies concurrency-conflict diagnostic entries with every encrypted field's values replaced by
+     * the sentinel, so the console, the error log and `MJ: Error Logs` never hold a secret.
+     */
+    redactEncryptedConflictValues(entityInfo, entries) {
+        return entries.map((entry) => {
+            if (!this.findEntityFieldByCodeNameOrName(entityInfo, entry.FieldName)?.Encrypt) {
+                return entry;
+            }
+            const redacted = { FieldName: entry.FieldName };
+            if ('ClientOldValue' in entry)
+                redacted.ClientOldValue = ENCRYPTED_SENTINEL;
+            if ('ClientNewValue' in entry)
+                redacted.ClientNewValue = ENCRYPTED_SENTINEL;
+            if ('DBValue' in entry)
+                redacted.DBValue = ENCRYPTED_SENTINEL;
+            return redacted;
+        });
+    }
+    /**
+     * Compares two typed entity field values for semantic inequality, handling `Date` epoch equality
+     * (plus optional non-`datetimeoffset` timezone-hour-shift tolerance) and `null`/`undefined` normalization.
+     */
+    areEntityFieldValuesDifferent(field, left, right, allowTimezoneShiftWarning, fieldKeyForLog) {
+        const normalizedLeft = left === undefined ? null : left;
+        const normalizedRight = right === undefined ? null : right;
+        if (normalizedLeft instanceof Date) {
+            const rightDate = normalizedRight instanceof Date
+                ? normalizedRight
+                : field?.TSType === EntityFieldTSType.Date && normalizedRight !== null
+                    ? this.ClientOldValueToFieldValue(field, normalizedRight)
+                    : null;
+            if (!(rightDate instanceof Date) || isNaN(rightDate.getTime())) {
+                return true;
+            }
+            if (this.datesEqualAtColumnResolution(field, normalizedLeft, rightDate)) {
+                return false;
+            }
+            const sqlType = field?.SQLFullType?.trim().toLowerCase() || '';
+            if (sqlType !== 'datetimeoffset' && IsOnlyTimezoneShift(normalizedLeft, rightDate)) {
+                if (allowTimezoneShiftWarning && fieldKeyForLog) {
+                    console.warn(`Timezone hour shift detected on field "${fieldKeyForLog}" (${sqlType || 'datetime'}). ` +
+                        `Client: ${normalizedLeft.toISOString()}, DB: ${rightDate.toISOString()}. ` +
+                        `Consider using datetimeoffset to avoid timezone ambiguity.`);
+                }
+                return false;
+            }
+            return true;
+        }
+        if (normalizedRight instanceof Date && field?.TSType === EntityFieldTSType.Date && normalizedLeft !== null) {
+            const leftDate = this.ClientOldValueToFieldValue(field, normalizedLeft);
+            if (leftDate instanceof Date && !isNaN(leftDate.getTime())) {
+                return !this.datesEqualAtColumnResolution(field, leftDate, normalizedRight);
+            }
+        }
+        if (typeof normalizedLeft === 'string' && typeof normalizedRight === 'string' && this.jsonStringsEquivalent(normalizedLeft, normalizedRight)) {
+            return false;
+        }
+        return Object.is(normalizedLeft, normalizedRight) ? false : normalizedLeft !== normalizedRight;
+    }
+    /**
+     * True when two instants would be stored as the same value in the field's column: SQL Server
+     * `datetime` resolves to 1/300 s and `smalldatetime` to one minute; every other type keeps milliseconds.
+     */
+    datesEqualAtColumnResolution(field, left, right) {
+        return Math.abs(left.getTime() - right.getTime()) < this.dateColumnResolutionMs(field);
+    }
+    dateColumnResolutionMs(field) {
+        switch ((field?.Type ?? '').trim().toLowerCase()) {
+            case 'datetime':
+                return 1000 / 300;
+            case 'smalldatetime':
+                return 60_000;
+            default:
+                return 1;
+        }
+    }
+    /**
+     * True when both strings are JSON documents with the same content, ignoring whitespace and key order.
+     */
+    jsonStringsEquivalent(left, right) {
+        const canonicalLeft = this.canonicalJSONDocument(left);
+        return canonicalLeft !== null && canonicalLeft === this.canonicalJSONDocument(right);
+    }
+    /**
+     * Canonical form of a JSON object or array string, or null when the text is not one.
+     */
+    canonicalJSONDocument(text) {
+        const first = text.trimStart().charAt(0);
+        if (first !== '{' && first !== '[') {
+            return null;
+        }
+        try {
+            return Canonicalize(JSON.parse(text));
+        }
+        catch {
+            return null;
+        }
+    }
+    async TestAndSetClientOldValuesToDBValues(input, rawClientNewValues, entityObject, contextUser) {
         const clientOldValues = {};
-        // for each item in the oldValues array, add it to the clientOldValues object
-        input.OldValues___.forEach((item) => {
-            // we need to do a quick transform on the values to make sure they match the TS Type for the given field because item.Value will always be a string
+        for (const item of input.OldValues___ ?? []) {
+            // Transform string-serialized wire values to match the field's TypeScript type
             const field = this.findEntityFieldByCodeNameOrName(entityObject.EntityInfo, item.Key);
-            const val = this.ClientOldValueToFieldValue(field, item.Value);
-            clientOldValues[item.Key] = val;
-        });
-        // clientOldValues now has all of the oldValues the CLIENT passed us. Now we need to build the same kind of object
-        // with the DB values
+            clientOldValues[item.Key] = this.ClientOldValueToFieldValue(field, item.Value);
+        }
+        const clientNewValues = this.withoutEchoedOpaqueValues(entityObject.EntityInfo, rawClientNewValues, clientOldValues);
         // fls-guard: compared on the server only, never returned
         const dbValues = entityObject.GetAll();
-        // now we need to compare clientOldValues and dbValues and have a new array that has entries for any differences and have FieldName, clientOldValue and dbValue as properties
         const dbDifferences = [];
-        Object.keys(clientOldValues).forEach((key) => {
+        const dbDiffByField = new Map();
+        for (const key of Object.keys(clientOldValues)) {
             const f = this.findEntityFieldByCodeNameOrName(entityObject.EntityInfo, key);
-            const dbVal = f && f.Name in dbValues ? dbValues[f.Name] : dbValues[key];
-            let different = false;
-            switch (typeof clientOldValues[key]) {
-                case 'number':
-                    different = clientOldValues[key] !== dbVal;
-                    break;
-                case 'boolean':
-                    different = clientOldValues[key] !== dbVal;
-                    break;
-                case 'object':
-                    if (clientOldValues[key] instanceof Date) {
-                        const clientDate = clientOldValues[key];
-                        const dbDate = dbVal;
-                        if (dbDate == null || !(dbDate instanceof Date)) {
-                            different = true;
-                        }
-                        else if (clientDate.getTime() !== dbDate.getTime()) {
-                            // Check if this is a datetime/datetime2 field with only a timezone hour shift
-                            const sqlType = f?.SQLFullType?.trim().toLowerCase() || '';
-                            if (sqlType !== 'datetimeoffset' && IsOnlyTimezoneShift(clientDate, dbDate)) {
-                                console.warn(`Timezone hour shift detected on field "${key}" (${sqlType || 'datetime'}). ` +
-                                    `Client: ${clientDate.toISOString()}, DB: ${dbDate.toISOString()}. ` +
-                                    `Consider using datetimeoffset to avoid timezone ambiguity.`);
-                                different = false; // Allow timezone shifts through for non-datetimeoffset fields
-                            }
-                            else {
-                                different = true;
-                            }
-                        }
-                    }
-                    else if (clientOldValues[key] === null) {
-                        different = dbVal !== null;
-                    }
-                    break;
-                default:
-                    different = clientOldValues[key] !== dbVal;
-                    break;
+            if (this.isFieldOpaqueToClient(f)) {
+                continue;
             }
+            const dbVal = f && f.Name in dbValues ? dbValues[f.Name] : dbValues[key];
+            const different = this.areEntityFieldValuesDifferent(f, clientOldValues[key], dbVal, true, key);
             if (different && f && !f.ReadOnly) {
-                // only include updateable fields
-                dbDifferences.push({
+                const entry = {
                     FieldName: key,
                     ClientOldValue: clientOldValues[key],
                     DBValue: dbVal,
-                });
+                };
+                dbDifferences.push(entry);
+                dbDiffByField.set(key, entry);
             }
-        });
+        }
+        let fieldsToPreserveFromDB;
         if (dbDifferences.length > 0) {
-            // now we have an array of any dbDifferences with length > 0, between the clientOldValues and the dbValues, we need to check to see if any of the differences are on fields that the client is trying to update
-            // first step is to get clientNewValues into an object that is like clientOldValues, get the diff and then compare that diff to the differences array that shows diff between DB and ClientOld
             const clientDifferences = [];
-            Object.keys(clientOldValues).forEach((key) => {
+            const clientDiffFieldNames = new Set();
+            for (const key of Object.keys(clientOldValues)) {
                 const f = this.findEntityFieldByCodeNameOrName(entityObject.EntityInfo, key);
-                if (key in clientNewValues && clientOldValues[key] !== clientNewValues[key] && f && f.AllowUpdateAPI && !f.IsPrimaryKey) {
-                    // only include updateable fields
+                if (key in clientNewValues &&
+                    f &&
+                    f.AllowUpdateAPI &&
+                    !f.IsPrimaryKey &&
+                    this.areEntityFieldValuesDifferent(f, clientOldValues[key], clientNewValues[key], false)) {
                     clientDifferences.push({
                         FieldName: key,
                         ClientOldValue: clientOldValues[key],
                         ClientNewValue: clientNewValues[key],
                     });
+                    clientDiffFieldNames.add(key);
                 }
+            }
+            // True conflicting overlap: client modified a field whose authoritative DB value differs from BOTH
+            // ClientOldValue AND ClientNewValue (idempotent concurrent writes to the same value converge cleanly).
+            const overlap = clientDifferences.filter((cd) => {
+                const dd = dbDiffByField.get(cd.FieldName);
+                if (!dd) {
+                    return false;
+                }
+                const f = this.findEntityFieldByCodeNameOrName(entityObject.EntityInfo, cd.FieldName);
+                return this.areEntityFieldValuesDifferent(f, cd.ClientNewValue, dd.DBValue, true);
             });
-            // now we have clientDifferences which shows what the client thinks they are changing. And, we have the dbDifferences array that shows changes between the clientOldValues and the dbValues
-            // if there is ANY overlap in the FIELDS that appear in both arrays, we need to log a warning but allow the save to continue
-            const dbDiffFieldNames = new Set(dbDifferences.map((dd) => dd.FieldName));
-            const overlap = clientDifferences.filter((cd) => dbDiffFieldNames.has(cd.FieldName));
             if (overlap.length > 0) {
+                const conflictingFields = overlap.map((o) => o.FieldName);
+                const entityInfo = entityObject.EntityInfo;
+                const shownClientDifferences = this.redactEncryptedConflictValues(entityInfo, clientDifferences);
+                const shownDBDifferences = this.redactEncryptedConflictValues(entityInfo, dbDifferences);
+                const shownOverlap = this.redactEncryptedConflictValues(entityInfo, overlap);
                 const msg = {
-                    Message: 'Inconsistency between old values provided for changed fields, and the values of one or more of those fields in the database. Save operation continued with warning.',
-                    ClientDifferences: clientDifferences,
-                    DBDifferences: dbDifferences,
-                    Overlap: overlap,
+                    Message: 'Concurrent modification conflict: one or more fields modified by the client were updated in the database since the record was loaded. Save rejected to prevent overwriting concurrent changes.',
+                    ClientDifferences: shownClientDifferences,
+                    DBDifferences: shownDBDifferences,
+                    Overlap: shownOverlap,
                 };
-                // Log as warning to console and ErrorLog table instead of throwing error
-                console.warn('Entity save inconsistency detected but allowing save to continue:', JSON.stringify(msg));
+                console.warn('Entity save concurrency conflict detected — rejecting conflicting update:', JSON.stringify(msg));
                 LogErrorEx({
                     message: `Entity save inconsistency detected: ${JSON.stringify(msg)}`,
                     severity: 'warning',
                     category: 'ResolverBase.TestAndSetClientOldValuesToDBValues',
                     metadata: {
                         entityName: entityObject.EntityInfo.Name,
-                        clientDifferences: clientDifferences,
-                        dbDifferences: dbDifferences,
-                        overlap: overlap,
+                        clientDifferences: shownClientDifferences,
+                        dbDifferences: shownDBDifferences,
+                        overlap: shownOverlap,
                     },
                 });
-                // Create ErrorLog record in the database — use the entity's bound provider so the
-                // ErrorLog write goes to the same connection as the entity that triggered it.
+                // Persist SAVE_INCONSISTENCY ErrorLog record on the entity's bound provider before rejecting
                 try {
-                    const md = entityObject.ProviderToUse;
-                    const errorLogEntity = await md.GetEntityObject('MJ: Error Logs', contextUser);
-                    // Code is NCHAR(20); a longer value is rejected at the database
-                    errorLogEntity.Code = 'SAVE_INCONSISTENCY';
-                    errorLogEntity.Message = `Entity save inconsistency detected for ${entityObject.EntityInfo.Name}: ${JSON.stringify(msg)}`;
-                    errorLogEntity.Status = 'Warning';
-                    errorLogEntity.Category = 'Entity Save';
-                    errorLogEntity.CreatedBy = contextUser.Email || contextUser.Name;
-                    const saveResult = await errorLogEntity.Save();
-                    if (!saveResult) {
-                        console.error(`Failed to save ErrorLog record for ${entityObject.EntityInfo.Name}: ${errorLogEntity.LatestResult?.CompleteMessage}`);
+                    const hasEntityObjectFactory = (p) => Boolean(p && 'GetEntityObject' in p);
+                    const providerCandidate = entityObject.ProviderToUse;
+                    if (hasEntityObjectFactory(providerCandidate)) {
+                        const errorLogEntity = await providerCandidate.GetEntityObject('MJ: Error Logs', contextUser);
+                        // Code is NCHAR(20); a longer value is rejected at the database
+                        errorLogEntity.Code = 'SAVE_INCONSISTENCY';
+                        errorLogEntity.Message = `Entity save inconsistency detected for ${entityObject.EntityInfo.Name}: ${JSON.stringify(msg)}`;
+                        errorLogEntity.Status = 'Warning';
+                        errorLogEntity.Category = 'Entity Save';
+                        errorLogEntity.CreatedBy = contextUser.Email || contextUser.Name;
+                        const saveResult = await errorLogEntity.Save();
+                        if (!saveResult) {
+                            console.error(`Failed to save ErrorLog record for ${entityObject.EntityInfo.Name}: ${errorLogEntity.LatestResult?.CompleteMessage}`);
+                        }
                     }
                 }
                 catch (errorLogError) {
                     console.error('Error creating ErrorLog record:', errorLogError);
                 }
+                throw new GraphQLError(`Concurrent modification conflict on ${entityObject.EntityInfo.Name} for field(s): ${conflictingFields.join(', ')}. Reload the record and retry your changes.`, {
+                    extensions: {
+                        code: 'CONCURRENT_MODIFICATION_CONFLICT',
+                        entityName: entityObject.EntityInfo.Name,
+                        conflictingFields,
+                    },
+                });
             }
+            // Non-overlapping concurrent DB edits: preserve any field that changed in the database
+            // when the client itself did NOT modify that field (prevents full-payload clients or forged
+            // OldValues___ from clobbering concurrent DB updates on untouched columns).
+            fieldsToPreserveFromDB = new Set();
+            for (const dd of dbDifferences) {
+                if (!clientDiffFieldNames.has(dd.FieldName)) {
+                    fieldsToPreserveFromDB.add(dd.FieldName);
+                    const f = this.findEntityFieldByCodeNameOrName(entityObject.EntityInfo, dd.FieldName);
+                    if (f) {
+                        fieldsToPreserveFromDB.add(f.Name);
+                        fieldsToPreserveFromDB.add(f.CodeName);
+                    }
+                }
+            }
+        }
+        if (fieldsToPreserveFromDB && fieldsToPreserveFromDB.size > 0) {
+            const mergedValues = {};
+            for (const key of Object.keys(clientNewValues)) {
+                if (!fieldsToPreserveFromDB.has(key)) {
+                    mergedValues[key] = clientNewValues[key];
+                }
+            }
+            entityObject.SetMany(mergedValues);
+        }
+        else {
+            entityObject.SetMany(clientNewValues);
         }
-        // If we get here that means we've not thrown an exception, so there is
-        // NO OVERLAP, so we can set the new values from the data provided from the client now...
-        entityObject.SetMany(clientNewValues);
     }
     async DeleteRecord(entityName, key, options, provider, userPayload, pubSub) {
         // Check API key scope authorization for entity delete operations