@memberjunction/server 6.2.0-edge.7 → 6.2.0-edge.8

package/src/__tests__/TagGovernanceAndAutotagResolvers.test.ts

@@ -0,0 +1,261 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+
+const {
+    mockTagEngineConfig,
+    mockMergeTags,
+    mockRecomputeCoOccurrence,
+    mockRunViewFn,
+    mockGetEntityObjectFn,
+    mockActionConfig,
+    mockRunAction,
+    mockPublish,
+    actionsList,
+} = vi.hoisted(() => ({
+    mockTagEngineConfig: vi.fn().mockResolvedValue(undefined),
+    mockMergeTags: vi.fn(),
+    mockRecomputeCoOccurrence: vi.fn(),
+    mockRunViewFn: vi.fn(),
+    mockGetEntityObjectFn: vi.fn(),
+    mockActionConfig: vi.fn().mockResolvedValue(undefined),
+    mockRunAction: vi.fn(),
+    mockPublish: vi.fn(),
+    actionsList: [{ Name: 'Autotag and Vectorize Content' }] as Array<{ Name: string }>,
+}));
+
+vi.mock('type-graphql', () => {
+    const noop = () => () => undefined;
+    const passthrough = () => (target: unknown) => target;
+    return {
+        Resolver: passthrough,
+        Mutation: noop,
+        Query: noop,
+        Subscription: noop,
+        Arg: noop,
+        Args: noop,
+        Ctx: noop,
+        Root: noop,
+        ObjectType: passthrough,
+        InputType: passthrough,
+        ArgsType: passthrough,
+        Field: noop,
+        Float: Number,
+        Int: Number,
+        ID: String,
+    };
+});
+
+vi.mock('../generic/ResolverBase.js', () => ({
+    ResolverBase: class {
+        GetUserFromPayload(payload: unknown) {
+            if (!payload) return null;
+            return { ID: 'user-1', Email: 'u@example.com', Name: 'User' };
+        }
+    },
+}));
+
+vi.mock('@memberjunction/tag-engine', () => ({
+    TagEngine: {
+        Instance: {
+            Config: (...args: unknown[]) => mockTagEngineConfig(...args),
+        },
+    },
+    TagGovernanceEngine: {
+        Instance: {
+            MergeTags: (...args: unknown[]) => mockMergeTags(...args),
+        },
+    },
+    TagHealthJob: {
+        Instance: {
+            Run: vi.fn(),
+        },
+    },
+    DEFAULT_TAG_HEALTH_THRESHOLDS: {
+        minCoOccurrence: 5,
+        minEmbeddingSimilarity: 0.85,
+        minNameSimilarity: 0.5,
+        maxUsage: 2,
+        maxImplicitChildren: 25,
+    },
+}));
+
+vi.mock('@memberjunction/tag-engine-base', () => ({
+    TagCoOccurrenceEngine: {
+        Instance: {
+            RecomputeCoOccurrence: (...args: unknown[]) => mockRecomputeCoOccurrence(...args),
+        },
+    },
+}));
+
+vi.mock('@memberjunction/actions', () => ({
+    ActionEngineServer: {
+        Instance: {
+            Config: (...args: unknown[]) => mockActionConfig(...args),
+            get Actions() {
+                return actionsList;
+            },
+            RunAction: (...args: unknown[]) => mockRunAction(...args),
+        },
+    },
+}));
+
+vi.mock('../generic/PubSubManager.js', () => ({
+    PubSubManager: {
+        Instance: {
+            Publish: (...args: unknown[]) => mockPublish(...args),
+        },
+    },
+}));
+
+vi.mock('../util.js', () => ({
+    GetReadWriteProvider: () => ({
+        GetEntityObject: (...args: unknown[]) => mockGetEntityObjectFn(...args),
+    }),
+}));
+
+vi.mock('@memberjunction/core', async (importOriginal) => {
+    const actual = await importOriginal<typeof import('@memberjunction/core')>();
+    class MockRunView {
+        RunView = mockRunViewFn;
+        static FromMetadataProvider() {
+            return new MockRunView();
+        }
+    }
+    class MockMetadata {
+        GetEntityObject = mockGetEntityObjectFn;
+    }
+    return {
+        ...actual,
+        RunView: MockRunView,
+        Metadata: MockMetadata,
+        LogError: vi.fn(),
+        LogStatus: vi.fn(),
+    };
+});
+
+import { TagGovernanceResolver } from '../resolvers/TagGovernanceResolver.js';
+import { AutotagPipelineResolver } from '../resolvers/AutotagPipelineResolver.js';
+import type { AppContext } from '../types.js';
+
+const mockUser = { ID: 'user-1', Email: 'u@example.com', Name: 'User' };
+
+describe('TagGovernanceResolver', () => {
+    let resolver: TagGovernanceResolver;
+
+    beforeEach(() => {
+        vi.clearAllMocks();
+        resolver = new TagGovernanceResolver();
+        (resolver as unknown as Record<string, unknown>)['GetUserFromPayload'] = vi.fn().mockReturnValue(mockUser);
+    });
+
+    it('RecomputeTagCoOccurrence delegates to TagCoOccurrenceEngine.Instance.RecomputeCoOccurrence', async () => {
+        mockRecomputeCoOccurrence.mockResolvedValueOnce({ PairsUpdated: 12, PairsDeleted: 3 });
+
+        const res = await resolver.RecomputeTagCoOccurrence({} as AppContext);
+
+        expect(mockRecomputeCoOccurrence).toHaveBeenCalledWith(mockUser);
+        expect(res).toEqual({ PairsUpdated: 12, PairsDeleted: 3 });
+    });
+
+    it('MergeTags calls TagEngine.Instance.Config first and returns ItemsMoved and TaggedItemsMoved', async () => {
+        mockMergeTags.mockResolvedValueOnce({ ItemsMoved: 4, TaggedItemsMoved: 7 });
+
+        const res = await resolver.MergeTags(['src-1'], 'surviving-1', {} as AppContext);
+
+        expect(mockTagEngineConfig).toHaveBeenCalledWith(false, mockUser);
+        expect(mockMergeTags).toHaveBeenCalledWith(['src-1'], 'surviving-1', mockUser);
+        expect(res).toEqual({
+            Success: true,
+            ItemsMoved: 4,
+            TaggedItemsMoved: 7,
+        });
+    });
+
+    it('MergeTags catches engine errors and maps them into ErrorMessage', async () => {
+        mockMergeTags.mockRejectedValueOnce(new Error('Failed to load surviving tag'));
+
+        const res = await resolver.MergeTags(['src-1'], 'bad-id', {} as AppContext);
+
+        expect(res).toEqual({
+            Success: false,
+            ItemsMoved: 0,
+            TaggedItemsMoved: 0,
+            ErrorMessage: 'Failed to load surviving tag',
+        });
+    });
+});
+
+describe('AutotagPipelineResolver', () => {
+    let resolver: AutotagPipelineResolver;
+
+    beforeEach(() => {
+        vi.clearAllMocks();
+        resolver = new AutotagPipelineResolver();
+        (resolver as unknown as Record<string, unknown>)['GetUserFromPayload'] = vi.fn().mockReturnValue(mockUser);
+    });
+
+    it('rejects a client-supplied pipelineRunID that is not a valid UUID', async () => {
+        const res = await resolver.RunAutotagPipeline(undefined, undefined, 'not-a-uuid', {} as AppContext);
+
+        expect(res.Success).toBe(false);
+        expect(res.ErrorMessage).toMatch(/Invalid pipelineRunID/);
+        expect(mockRunViewFn).not.toHaveBeenCalled();
+    });
+
+    it('rejects a client-supplied pipelineRunID when a Content Process Run with that ID already exists', async () => {
+        const existingId = '11111111-2222-3333-4444-555555555555';
+        mockRunViewFn.mockResolvedValueOnce({
+            Success: true,
+            Results: [{ ID: existingId }],
+        });
+
+        const res = await resolver.RunAutotagPipeline(undefined, undefined, existingId, {} as AppContext);
+
+        expect(res.Success).toBe(false);
+        expect(res.ErrorMessage).toContain('already exists');
+    });
+
+    it('passes processed item count (not pct) to publishProgress and clears heartbeatTimer in finally', async () => {
+        const clearIntervalSpy = vi.spyOn(global, 'clearInterval');
+        mockGetEntityObjectFn.mockResolvedValue({
+            NewRecord: vi.fn(),
+            Save: vi.fn().mockResolvedValue(true),
+            LatestResult: { CompleteMessage: '' },
+        });
+
+        mockRunAction.mockImplementationOnce(async ({ Params }: { Params: Array<{ Name: string; Value: unknown }> }) => {
+            const cbParam = Params.find(p => p.Name === '__progressCallback');
+            const cb = cbParam?.Value as ((processed: number, total: number, currentItem?: string) => void) | undefined;
+            cb?.(3, 10, 'https://example.com/page-3');
+            return { Success: true, Message: '' };
+        });
+
+        const runInBg = (resolver as unknown as {
+            runPipelineInBackground(
+                pipelineRunID: string,
+                currentUser: unknown,
+                provider: unknown,
+                contentSourceIDs?: string[],
+                forceReprocess?: boolean,
+            ): Promise<void>;
+        }).runPipelineInBackground.bind(resolver);
+
+        await runInBg(
+            'aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee',
+            mockUser,
+            { GetEntityObject: mockGetEntityObjectFn },
+            ['22222222-3333-4444-5555-666666666666'],
+            false,
+        );
+
+        const autotagEvent = mockPublish.mock.calls
+            .map(c => c[1] as Record<string, unknown>)
+            .find(n => n['Stage'] === 'autotag' && n['TotalItems'] === 10);
+
+        expect(autotagEvent).toBeDefined();
+        expect(autotagEvent?.['ProcessedItems']).toBe(3);
+        expect(autotagEvent?.['PercentComplete']).toBe(30);
+        expect(clearIntervalSpy).toHaveBeenCalled();
+        clearIntervalSpy.mockRestore();
+    });
+});
+

package/src/__tests__/TagGovernanceResolver.test.ts

@@ -10,12 +10,15 @@ import { describe, it, expect, vi, beforeEach } from 'vitest';
  * how errors are surfaced.
  */
 
-const { promoteCalls, rejectCalls, rebuildCalls, healthCalls, behaviorFlags } = vi.hoisted(() => ({
+const { promoteCalls, rejectCalls, rebuildCalls, healthCalls, mergeCalls, recomputeCalls, configCalls, behaviorFlags } = vi.hoisted(() => ({
     promoteCalls: [] as Array<{ id: string; strategy: unknown; user: unknown }>,
     rejectCalls: [] as Array<{ id: string; notes: string | null; user: unknown }>,
     rebuildCalls: [] as Array<{ user: unknown }>,
     healthCalls: [] as Array<{ thresholds: unknown; user: unknown }>,
-    behaviorFlags: { promoteThrows: false, rejectThrows: false, rebuildThrows: false, healthThrows: false },
+    mergeCalls: [] as Array<{ sourceTagIDs: string[]; survivingTagID: string; user: unknown }>,
+    recomputeCalls: [] as Array<{ user: unknown }>,
+    configCalls: [] as Array<{ forceRefresh: boolean; user: unknown }>,
+    behaviorFlags: { promoteThrows: false, rejectThrows: false, rebuildThrows: false, healthThrows: false, mergeThrows: false },
 }));
 
 vi.mock('@memberjunction/tag-engine', () => ({
@@ -30,10 +33,18 @@ vi.mock('@memberjunction/tag-engine', () => ({
                 rejectCalls.push({ id, notes, user });
                 if (behaviorFlags.rejectThrows) throw new Error('reject-fail');
             },
+            MergeTags: async (sourceTagIDs: string[], survivingTagID: string, user: unknown) => {
+                mergeCalls.push({ sourceTagIDs, survivingTagID, user });
+                if (behaviorFlags.mergeThrows) throw new Error('merge-fail');
+                return { ItemsMoved: 4, TaggedItemsMoved: 7 };
+            },
         },
     },
     TagEngine: {
         Instance: {
+            Config: async (forceRefresh: boolean, user: unknown) => {
+                configCalls.push({ forceRefresh, user });
+            },
             RebuildTagEmbeddings: async (user: unknown) => {
                 rebuildCalls.push({ user });
                 if (behaviorFlags.rebuildThrows) throw new Error('rebuild-fail');
@@ -59,6 +70,17 @@ vi.mock('@memberjunction/tag-engine', () => ({
     },
 }));
 
+vi.mock('@memberjunction/tag-engine-base', () => ({
+    TagCoOccurrenceEngine: {
+        Instance: {
+            RecomputeCoOccurrence: async (user: unknown) => {
+                recomputeCalls.push({ user });
+                return { PairsUpdated: 12, PairsDeleted: 3 };
+            },
+        },
+    },
+}));
+
 // Minimal type-graphql shim — we only need the decorators to be no-ops so the
 // resolver class can load. Method behavior is what we test.
 vi.mock('type-graphql', () => ({
@@ -98,10 +120,14 @@ describe('TagGovernanceResolver', () => {
         rejectCalls.length = 0;
         rebuildCalls.length = 0;
         healthCalls.length = 0;
+        mergeCalls.length = 0;
+        recomputeCalls.length = 0;
+        configCalls.length = 0;
         behaviorFlags.promoteThrows = false;
         behaviorFlags.rejectThrows = false;
         behaviorFlags.rebuildThrows = false;
         behaviorFlags.healthThrows = false;
+        behaviorFlags.mergeThrows = false;
         resolver = new TagGovernanceResolver();
     });
 
@@ -252,4 +278,36 @@ describe('TagGovernanceResolver', () => {
             expect(r.ErrorMessage).toBe('health-fail');
         });
     });
+
+    // ---- MergeTags ---------------------------------------------------------
+
+    describe('MergeTags', () => {
+        it('calls TagEngine.Instance.Config first and delegates to TagGovernanceEngine.Instance.MergeTags', async () => {
+            const r = await resolver.MergeTags(['src-1'], 'surviving-1', ctx() as never);
+            expect(r.Success).toBe(true);
+            expect(r.ItemsMoved).toBe(4);
+            expect(r.TaggedItemsMoved).toBe(7);
+            expect(configCalls).toHaveLength(1);
+            expect(mergeCalls[0]).toMatchObject({ sourceTagIDs: ['src-1'], survivingTagID: 'surviving-1' });
+        });
+
+        it('maps engine errors into ErrorMessage', async () => {
+            behaviorFlags.mergeThrows = true;
+            const r = await resolver.MergeTags(['src-1'], 'surviving-1', ctx() as never);
+            expect(r.Success).toBe(false);
+            expect(r.ItemsMoved).toBe(0);
+            expect(r.TaggedItemsMoved).toBe(0);
+            expect(r.ErrorMessage).toBe('merge-fail');
+        });
+    });
+
+    // ---- RecomputeTagCoOccurrence ------------------------------------------
+
+    describe('RecomputeTagCoOccurrence', () => {
+        it('delegates to TagCoOccurrenceEngine.Instance.RecomputeCoOccurrence', async () => {
+            const r = await resolver.RecomputeTagCoOccurrence(ctx() as never);
+            expect(r).toEqual({ PairsUpdated: 12, PairsDeleted: 3 });
+            expect(recomputeCalls).toHaveLength(1);
+        });
+    });
 });

package/src/__tests__/globalCors.test.ts

@@ -215,3 +215,15 @@ describe('X-Powered-By', () => {
         expect(src.match(/app\.disable\('x-powered-by'\)/g)?.length ?? 0).toBeGreaterThanOrEqual(2);
     });
 });
+
+describe('X-MJ-Diagnostic-Trigger', () => {
+    it('is exposed to the browser by the global CORS and by the GraphQL CORS', async () => {
+        const base = await startApp([]);
+        const res = await fetch(`${base}/core`, { headers: { Origin: OTHER_ORIGIN } });
+        expect(res.headers.get('access-control-expose-headers')).toContain('X-MJ-Diagnostic-Trigger');
+
+        const src = readFileSync(new URL('../index.ts', import.meta.url), 'utf8');
+        const graphqlCors = src.match(/app\.use\(\s*graphqlRootPath,\s*cors<cors\.CorsRequest>\(\{\s*exposedHeaders: \[([^\]]*)\]/);
+        expect(graphqlCors?.[1]).toContain('X-MJ-Diagnostic-Trigger');
+    });
+});

package/src/__tests__/review-capture-valid-token-log.test.ts

@@ -0,0 +1,98 @@
+/**
+ * Tests the debug log GetUserPayload writes for a freshly verified token. All auth and database
+ * dependencies are mocked; no connection is opened.
+ */
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
+
+vi.mock('jsonwebtoken', () => ({
+  default: {
+    decode: vi.fn(() => ({ iss: 'https://issuer.example.com/', exp: Math.floor(Date.now() / 1000) + 3600, sub: 'idp-subject' })),
+    verify: vi.fn((_token: string, _keys: unknown, _opts: unknown, cb: (err: Error | null, decoded: unknown) => void) =>
+      cb(null, { payload: { iss: 'https://issuer.example.com/', sub: 'idp-subject' } })
+    ),
+  },
+}));
+
+vi.mock('../auth/index.js', () => ({
+  GetSigningKeys: vi.fn(() => vi.fn()),
+  GetSystemUser: vi.fn(),
+  GetValidationOptions: vi.fn(() => ({ audience: 'mjapi' })),
+  ExtractUserInfoFromPayload: vi.fn(() => ({
+    fullName: 'Alice Smith',
+    firstName: 'Alice',
+    lastName: 'Smith',
+    email: 'alice@example.com',
+    preferredUsername: 'alice@example.com',
+  })),
+  VerifyUserRecord: vi.fn(async () => ({ ID: 'USER-ID-1', IsActive: true, Email: 'alice@example.com', UserRoles: [] })),
+}));
+
+vi.mock('@memberjunction/auth-providers', () => ({
+  TokenExpiredError: class extends Error {},
+  AuthProviderFactory: { Instance: { getByIssuer: vi.fn(() => ({})) } },
+}));
+
+vi.mock('../logging/StartupLogger.js', () => ({
+  StartupLogger: { resolveLevelFromConfig: vi.fn(() => 'debug') },
+}));
+
+vi.mock('../util.js', () => ({
+  GetReadOnlyDataSource: vi.fn(() => undefined),
+  GetReadWriteDataSource: vi.fn(() => undefined),
+}));
+
+vi.mock('../config.js', () => ({
+  configInfo: { databaseSettings: { metadataCacheRefreshInterval: 0 } },
+  userEmailMap: {},
+  apiKey: 'test-api-key',
+  mj_core_schema: '__mj',
+}));
+
+vi.mock('@memberjunction/sqlserver-dataprovider', () => ({
+  SQLServerDataProvider: class {},
+  SQLServerProviderConfigData: class {},
+}));
+
+vi.mock('@memberjunction/postgresql-dataprovider', () => ({
+  PostgreSQLDataProvider: class {},
+  PostgreSQLProviderConfigData: class {},
+}));
+
+vi.mock('@memberjunction/api-keys', () => ({
+  GetAPIKeyEngine: vi.fn(),
+}));
+
+vi.mock('@memberjunction/core', async (importOriginal) => {
+  const actual = await importOriginal<typeof import('@memberjunction/core')>();
+  return { ...actual, Metadata: { Provider: undefined } };
+});
+
+import { GetUserPayload } from '../context.js';
+
+describe('GetUserPayload valid-token debug log', () => {
+  let logged: string[];
+
+  beforeEach(() => {
+    logged = [];
+    vi.spyOn(console, 'log').mockImplementation((...args: unknown[]) => {
+      logged.push(args.map(String).join(' '));
+    });
+    vi.spyOn(console, 'warn').mockImplementation(() => {});
+    vi.spyOn(console, 'error').mockImplementation(() => {});
+  });
+
+  afterEach(() => {
+    vi.restoreAllMocks();
+  });
+
+  it('logs the user ID, not the name or email', async () => {
+    const result = await GetUserPayload('Bearer token-for-log-test', 'session-1', []);
+
+    expect(result.userRecord?.ID).toBe('USER-ID-1');
+    const tokenLines = logged.filter((line) => line.includes('Valid token'));
+    expect(tokenLines).toHaveLength(1);
+    expect(tokenLines[0]).toContain('USER-ID-1');
+    expect(tokenLines[0]).not.toContain('Alice');
+    expect(tokenLines[0]).not.toContain('alice@example.com');
+  });
+});

package/src/__tests__/runStreams.fieldSecurity.test.ts

@@ -1,10 +1,10 @@
 /**
  * Field-level security on the agent-run and test-run streams.
  *
- * Each of these publishes an entity object's `GetAll()` to the caller's session: the agent run on
- * every progress and streaming message and in the final result, the test run on every progress
- * message. The objects come from long-running engines and can have been built for another
- * identity, so the transport projects them for the recipient. The objects here are FULL WIDTH,
+ * Each of these publishes an entity object's values to the caller's session: the agent run on
+ * every progress message and in the final result, its summary on every streaming message, and the
+ * test run on every progress message. The objects come from long-running engines and can have
+ * been built for another identity, so the transport projects them for the recipient. The objects here are FULL WIDTH,
  * and the recipient may not read `Salary`.
  */
 import 'reflect-metadata';
@@ -64,8 +64,8 @@ describe('AgentRunStatusPublisher: the run is projected for the recipient', () =
         expect(messages()).toHaveLength(2);
         for (const message of messages()) {
             expect(message).not.toContain(String(SECRET_SALARY));
-            expect(message).toContain('"Name":"Ada"');
         }
+        expect(messages()[0]).toContain('"Name":"Ada"');
     });
 });
 

package/src/broadcast/BaseCacheInvalidationBroadcastProvider.ts

@@ -153,7 +153,8 @@ export const DEFAULT_HIGH_CHURN_SYSTEM_ENTITIES: readonly string[] = [
     'MJ: AI Prompt Runs',
     'MJ: AI Agent Runs',
     'MJ: AI Agent Run Steps',
-    'MJ: Query Execution Histories',
+    'MJ: Diagnostic Session Chunks',
+    'MJ: Diagnostic Bundles',
 ];
 
 /**

package/src/context.ts

@@ -21,7 +21,7 @@ import { GetReadOnlyDataSource, GetReadWriteDataSource } from './util.js';
 import { v4 as uuidv4 } from 'uuid';
 import e from 'express';
 import type { RequestHandler, Request, Response, NextFunction } from 'express';
-import { DatabaseProviderBase, UserInfo, type IMetadataProvider, type MagicLinkScope, type ReturningVisitorContext, type WidgetGuestContext } from '@memberjunction/core';
+import { DatabaseProviderBase, UserInfo, GetDiagnosticContext, type IMetadataProvider, type MagicLinkScope, type ReturningVisitorContext, type WidgetGuestContext } from '@memberjunction/core';
 import { SQLServerDataProvider, SQLServerProviderConfigData } from '@memberjunction/sqlserver-dataprovider';
 import { PostgreSQLDataProvider, PostgreSQLProviderConfigData } from '@memberjunction/postgresql-dataprovider';
 import { Metadata, IsValidTimeZone, TIME_ZONE_HEADER } from '@memberjunction/core';
@@ -49,7 +49,7 @@ function isDebugLogLevel(): boolean {
   if (isDebugLevelCache === undefined) {
     isDebugLevelCache = StartupLogger.resolveLevelFromConfig() === 'debug';
   }
-  return isDebugLevelCache;
+  return isDebugLevelCache || GetDiagnosticContext()?.sessionId != null;
 }
 
 const SESSION_AUDIT_TYPE = 'Session Established';
@@ -371,13 +371,6 @@ const verifyAsync = async (issuer: string, token: string): Promise<jwt.JwtPayloa
     jwt.verify(token, GetSigningKeys(issuer), verifyOptions, (err, jwt) => {
       if (jwt && typeof jwt !== 'string' && !err) {
         const payload = jwt.payload ?? jwt;
-
-        // Per-request token confirmation — debug-only (one of the worst
-        // "constantly on" offenders on an authenticated server).
-        if (isDebugLogLevel()) {
-          const userInfo = ExtractUserInfoFromPayload(payload);
-          console.log(`Valid token: ${userInfo.fullName || 'Unknown'} (${userInfo.email || userInfo.preferredUsername || 'Unknown'})`);
-        }
         resolve(payload);
       } else {
         console.warn('Invalid token');
@@ -578,6 +571,11 @@ export const GetUserPayload = async (
     // for everything else.
     const sessionUser = BuildMagicLinkSessionUser(userRecord, payload);
 
+    // Debug-only confirmation of a freshly verified token. It names the user by ID only.
+    if (!cachedAuth && isDebugLogLevel()) {
+      console.log(`Valid token: user ${sessionUser.ID}`);
+    }
+
     // Session-established audit — once per issued token (deduped), fire-and-forget so
     // it never adds latency to the request. The dedup mark is set synchronously here.
     if (markSessionAuditSeen(sessionAuditKey('sess', payload))) {