@memberjunction/server 6.2.0-edge.7 → 6.2.0-edge.8

package/src/generic/ResolverBase.ts

@@ -67,6 +67,12 @@ import { Subscription } from 'rxjs';
  * `mj: conversations` and `mj: ai agent sessions` carry the anonymous realtime-session ownership key
  * (`ExternalID` / `ConversationID`), which their server entities refuse an anonymous visitor to change — a rule
  * that decides on `Dirty`, so the baseline must be the stored row, not a client-supplied one (#4931).
+ *
+ * `mj: projects` (conversation folders) is refused a change to `OwnerUserID` or `ParentID` by anyone but the
+ * stored owner, a rule that reads the stored owner, so it must hold even if a host stops tracking its changes.
+ *
+ * `mj: diagnostic sender registrations` is refused a change to its guarded fields by a rule that decides on
+ * `Dirty`, so the baseline must be the stored row.
  */
 const ENTITIES_THAT_ALWAYS_LOAD_STORED_ROW: ReadonlySet<string> = new Set([
   'mj: record changes',
@@ -75,6 +81,8 @@ const ENTITIES_THAT_ALWAYS_LOAD_STORED_ROW: ReadonlySet<string> = new Set([
   'mj: conversations',
   'mj: ai agent sessions',
   'mj: ai agent runs',
+  'mj: projects',
+  'mj: diagnostic sender registrations',
 ]);
 
 /** One field's values in a concurrency-conflict diagnostic. */

package/src/globalCors.ts

@@ -44,6 +44,7 @@ export function CreateGlobalCorsMiddleware(
         },
         credentials: corsWildcard ? false : (settings?.allowCredentials ?? true),
         maxAge: settings?.maxAge ?? 86400,
+        exposedHeaders: ['X-MJ-Trace-ID', 'X-MJ-Diagnostic-Trigger'],
     }) as RequestHandler;
     return SkipForServerExtensionRoots(globalCors, extensionOwnedRoots);
 }

package/src/index.ts

@@ -4,8 +4,8 @@ dotenv.config({ quiet: true });
 
 import { expressMiddleware } from '@as-integrations/express5';
 import { mergeSchemas } from '@graphql-tools/schema';
-import { Metadata, DatabasePlatform, SetProvider, StartupManager as StartupManagerImport, BaseEntity, BaseEntityEvent, RunView, DatabaseProviderBase, ProviderBase, ResolveStartupMode, UserInfo } from '@memberjunction/core';
-import { UserCache, resolveDbPlatformFromEnv } from '@memberjunction/generic-database-provider';
+import { Metadata, DatabasePlatform, SetProvider, StartupManager as StartupManagerImport, BaseEntity, BaseEntityEvent, RunView, DatabaseProviderBase, ProviderBase, ResolveStartupMode, UserInfo, GetDiagnosticContext, IsDiagnosticCaptureSuppressed } from '@memberjunction/core';
+import { UserCache, resolveDbPlatformFromEnv, GenericDatabaseProvider, SummarizeSqlParameters } from '@memberjunction/generic-database-provider';
 import { MJGlobal, MJEventType, UUIDsEqual, ShutdownRegistry } from '@memberjunction/global';
 import { setupSQLServerClient, SQLServerDataProvider, SQLServerProviderConfigData } from '@memberjunction/sqlserver-dataprovider';
 import { extendConnectionPoolWithQuery } from './util.js';
@@ -299,10 +299,11 @@ export * from './multiTenancy/index.js';
 export * from './middleware/index.js';
 
 import { RegisterDataHook } from '@memberjunction/core';
+import { EnsureAnchoredConversationReadHookRegistered } from '@memberjunction/core-entities-server';
 import type { RequestHandler, ErrorRequestHandler } from 'express';
 import type { ApolloServerPlugin } from '@apollo/server';
 import type { GraphQLSchema } from 'graphql';
-import { BaseServerMiddleware } from './middleware/BaseServerMiddleware.js';
+import { BaseServerMiddleware, ServerMiddlewareContext } from './middleware/BaseServerMiddleware.js';
 import { SuppressTaskGraphSubmission } from '@memberjunction/ai-core-plus';
 
 export type MJServerOptions = {
@@ -499,7 +500,8 @@ const setupComplete$ = new ReplaySubject(1);
     await WirePushStatusFanOut(sharedCache);
     await wireHandoffOfferFanOut(sharedCache, startupLog);
     await wireRealtimeSessionEventFanOut(sharedCache);
-    startupLog.LogIf('verbose', `Redis cache provider connected: ${process.env.REDIS_URL}`);
+    const safeRedisUrl = (process.env.REDIS_URL ?? '').replace(/:\/\/[^@]+@/, '://***@');
+    startupLog.LogIf('verbose', `Redis cache provider connected: ${safeRedisUrl}`);
   }
   const cacheManagerConfig = CacheManagerConfigFromSettings(configInfo.cacheSettings);
   const warmupLeaseMs = WarmupLeaseMsFromSettings(configInfo.cacheSettings);
@@ -596,8 +598,38 @@ const setupComplete$ = new ReplaySubject(1);
         const thePgPool = poolAny._pgPool as import('pg').Pool;
         // Translate SQL Server bracket syntax to PostgreSQL double-quote syntax
         const pgQuery = TranslateBracketsToPG(query);
-        const result = await thePgPool.query(pgQuery);
-        return result.rows;
+        const startTime = performance.now();
+        try {
+          const result = await thePgPool.query(pgQuery);
+          if (!IsDiagnosticCaptureSuppressed() && GenericDatabaseProvider.HasSqlObservers()) {
+            GenericDatabaseProvider.NotifySqlObservers({
+              ts: Date.now(),
+              sql: pgQuery,
+              parameterSummaries: SummarizeSqlParameters(parameters),
+              durationMs: performance.now() - startTime,
+              rowCount: result.rows?.length ?? 0,
+              isMutation: false,
+              description: 'ExecuteSQLWithPool(PG)',
+              diagnosticContext: GetDiagnosticContext(),
+            });
+          }
+          return result.rows;
+        } catch (err) {
+          if (!IsDiagnosticCaptureSuppressed() && GenericDatabaseProvider.HasSqlObservers()) {
+            GenericDatabaseProvider.NotifySqlObservers({
+              ts: Date.now(),
+              sql: pgQuery,
+              parameterSummaries: SummarizeSqlParameters(parameters),
+              durationMs: performance.now() - startTime,
+              rowCount: 0,
+              isMutation: false,
+              errorMessage: err instanceof Error ? err.message : String(err),
+              description: 'ExecuteSQLWithPool(PG)',
+              diagnosticContext: GetDiagnosticContext(),
+            });
+          }
+          throw err;
+        }
       }
       return origExecuteSQLWithPool.call(this, pool, query, parameters, contextUser);
     };
@@ -982,8 +1014,9 @@ const setupComplete$ = new ReplaySubject(1);
   }
 
   // Initialize all middleware
+  const middlewareContext: ServerMiddlewareContext = { ApiRoute: (subpath, options) => ApiRoute(subpath, options) };
   for (const mw of middlewares) {
-      await mw.Initialize();
+      await mw.Initialize(middlewareContext);
       startupLog.LogIf('verbose', `  [Middleware] ${mw.Label}`);
   }
 
@@ -1005,7 +1038,7 @@ const setupComplete$ = new ReplaySubject(1);
 
       // Express app configuration escape hatch
       if (mw.ConfigureExpressApp) {
-          await mw.ConfigureExpressApp(app);
+          await mw.ConfigureExpressApp(app, middlewareContext);
       }
 
       // Extract hook methods and register in the global hook store
@@ -1014,6 +1047,7 @@ const setupComplete$ = new ReplaySubject(1);
       RegisterDataHook('PostRunView', mw.PostRunView.bind(mw));
       RegisterDataHook('PreSave', mw.PreSave.bind(mw));
   }
+  EnsureAnchoredConversationReadHookRegistered();
 
   // ─── Resolve middleware-contributed resolver paths and merge into resolvers ───
   let allResolvers = resolvers;
@@ -1606,7 +1640,7 @@ const setupComplete$ = new ReplaySubject(1);
   app.use(
     graphqlRootPath,
     cors<cors.CorsRequest>({
-      exposedHeaders: ['X-MJ-Cache-Seq', 'X-MJ-Server-ID'],
+      exposedHeaders: ['X-MJ-Cache-Seq', 'X-MJ-Server-ID', 'X-MJ-Trace-ID', 'X-MJ-Diagnostic-Trigger'],
     }),
     BodyParser.json({ limit: '50mb' }),
     // Express 5 leaves req.body as undefined for non-JSON or empty bodies;
@@ -2447,3 +2481,5 @@ export type { MagicLinkJWTClaims } from './auth/magicLink/index.js';
 export { VerifyHostAssertion } from './realtimeWidget/host-identity.js';
 export type { HostAssertedIdentity, HostAssertionResult } from './realtimeWidget/host-identity.js';
 export { IsScopeLimitedPrincipal } from './auth/scopeLimitedPrincipal.js';
+export const GetServerStartupSummary = () => StartupLogger.GetLastStartupSnapshot();
+export type { StartupSummarySnapshot } from './logging/StartupLogger.js';

package/src/logging/StartupLogger.ts

@@ -82,7 +82,25 @@ type StartupSummaryData = {
  * logger.PrintSummary();
  * ```
  */
+export type StartupSummarySnapshot = {
+  Level: ServerLogLevel;
+  Summary: Readonly<StartupSummaryData>;
+  PhaseTimings: ReadonlyArray<PhaseTiming>;
+  TotalStartupMs: number;
+};
+
 export class StartupLogger {
+  private static _lastSnapshot: StartupSummarySnapshot | null = null;
+
+  /**
+   * Returns a read-only snapshot of the most recent server startup summary,
+   * used by diagnostic health snapshots to report startup phase durations without
+   * mutating or re-running startup logic.
+   */
+  public static GetLastStartupSnapshot(): StartupSummarySnapshot | null {
+    return StartupLogger._lastSnapshot;
+  }
+
   private readonly resolvedLevel: ServerLogLevel;
   private readonly phaseTimings: PhaseTiming[] = [];
   private readonly summary: StartupSummaryData = { AuthProviders: [] };
@@ -302,6 +320,12 @@ export class StartupLogger {
     // Clear the transient spinner before any block output so the line it
     // occupied is replaced cleanly by the summary.
     this.StopBoot();
+    StartupLogger._lastSnapshot = {
+      Level: this.resolvedLevel,
+      Summary: { ...this.summary, AuthProviders: [...this.summary.AuthProviders] },
+      PhaseTimings: this.phaseTimings.map((p) => ({ ...p })),
+      TotalStartupMs: performance.now(),
+    };
     if (this.resolvedLevel === 'minimal') {
       this.printReadyLineOnly();
       return;

package/src/middleware/BaseServerMiddleware.ts

@@ -18,6 +18,20 @@ import type { ApolloServerPlugin } from '@apollo/server';
 import type { GraphQLSchema } from 'graphql';
 import type { RunViewParams, UserInfo, BaseEntity, RunViewResult } from '@memberjunction/core';
 
+/**
+ * What the server hands each middleware at startup.
+ */
+export interface ServerMiddlewareContext {
+    /**
+     * Builds the path of a route under MJAPI's base path (`MJAPI_BASE_PATH`).
+     * `subpath` must start with `/`. Use it for every route a middleware registers or compares against.
+     * With `{ absolute: true }` it returns the public URL of the route (`MJAPI_PUBLIC_URL` + subpath).
+     * The options type is written out here, not imported from `apiRoot.ts`: packages that read this
+     * file's types from source must not compile `config.ts`.
+     */
+    ApiRoute: (subpath: string, options?: { absolute?: boolean }) => string;
+}
+
 export abstract class BaseServerMiddleware {
     // --- Identity ---
 
@@ -37,9 +51,11 @@ export abstract class BaseServerMiddleware {
 
     /**
      * Optional async initialization (read config, warm caches, etc.).
-     * Called by serve() after instantiation, before middleware/hooks are extracted.
+     * Called by serve() after instantiation, before middleware/hooks are extracted,
+     * so a context stored here is available to every other hook.
+     * @param context - The server's route builder. serve() always passes it.
      */
-    async Initialize(): Promise<void> { /* no-op by default */ }
+    async Initialize(context?: ServerMiddlewareContext): Promise<void> { /* no-op by default */ }
 
     // --- Express Middleware ---
     // Each method corresponds to a named slot in the request pipeline.
@@ -73,8 +89,9 @@ export abstract class BaseServerMiddleware {
      * Called once during server setup with the Express app instance.
      * Use for: trust proxy settings, custom CORS, body parser config.
      * Return undefined to skip (default).
+     * @param context - The server's route builder. serve() always passes it.
      */
-    ConfigureExpressApp?(app: Application): void | Promise<void>;
+    ConfigureExpressApp?(app: Application, context?: ServerMiddlewareContext): void | Promise<void>;
 
     // --- Apollo / GraphQL Extensions ---
 

package/src/resolvers/AgentRunStatusPublisher.ts

@@ -17,13 +17,18 @@ import type {
 import type { EntityInfo } from '@memberjunction/core';
 import type { UserPayload } from '../types.js';
 import { PublishStatusUpdate, StatusUpdateOwnerID } from '../generic/PushStatusResolver.js';
-import { ProjectEntityObjectForCaller } from '../generic/fieldSecurityTransport.js';
+import { ProjectEntityObjectForCaller, ProjectValuesForCaller } from '../generic/fieldSecurityTransport.js';
 
 const SIGNIFICANT_STEPS = ['prompt_execution', 'action_execution', 'subagent_execution', 'decision_processing'];
 
 /** The run fields the published messages read. Entities and test fakes both satisfy this. */
 interface StatusRun {
     ID?: string;
+    AgentID?: string;
+    Agent?: string | null;
+    ParentRunID?: string | null;
+    Status?: string;
+    ConversationID?: string | null;
     ConversationDetailID?: string;
     ErrorMessage?: string;
     Steps?: Array<{ StepName?: string }>;
@@ -31,6 +36,9 @@ interface StatusRun {
     GetAll?: () => Record<string, unknown>;
 }
 
+/** The run fields a streamed chunk carries. */
+type RunSummary = Pick<StatusRun, 'ID' | 'AgentID' | 'Agent' | 'ParentRunID' | 'Status' | 'ConversationID' | 'ConversationDetailID'>;
+
 export class AgentRunStatusPublisher {
     private run: StatusRun | null = null;
 
@@ -102,7 +110,7 @@ export class AgentRunStatusPublisher {
                 agentRunId: agentRun.ID,
                 type: 'streaming',
                 ...this.replyRow(),
-                agentRun: this.runValues(agentRun),
+                agentRun: this.runSummary(agentRun),
                 streaming: {
                     content: chunk.content,
                     isPartial: !chunk.isComplete,
@@ -188,6 +196,23 @@ export class AgentRunStatusPublisher {
         return ProjectEntityObjectForCaller({ EntityInfo: agentRun.EntityInfo, GetAll: () => getAll.call(agentRun) }, this.userPayload?.userRecord);
     }
 
+    /**
+     * The run's identifying fields as the recipient may read them. A streamed chunk carries only
+     * these: the run's `GetAll()` holds every step and prompt run, and a run streams many chunks.
+     */
+    private runSummary(agentRun: StatusRun): RunSummary {
+        const summary: RunSummary = {
+            ID: agentRun.ID,
+            AgentID: agentRun.AgentID,
+            Agent: agentRun.Agent,
+            ParentRunID: agentRun.ParentRunID,
+            Status: agentRun.Status,
+            ConversationID: agentRun.ConversationID,
+            ConversationDetailID: agentRun.ConversationDetailID,
+        };
+        return ProjectValuesForCaller(agentRun.EntityInfo, summary, this.userPayload?.userRecord);
+    }
+
     private publish(type: 'ExecutionProgress' | 'StreamingContent', data: unknown): void {
         PublishStatusUpdate(this.pubSub, {
             sessionId: this.userPayload.sessionId,

package/src/resolvers/AutotagPipelineResolver.ts

@@ -1,6 +1,7 @@
 import { Resolver, Mutation, Ctx, Arg, ObjectType, Field } from 'type-graphql';
 import { AppContext } from '../types.js';
 import { IMetadataProvider, LogError, LogStatus, Metadata, RunView, UserInfo } from '@memberjunction/core';
+import { IsValidUUID, EscapeSQLString } from '@memberjunction/global';
 import { MJContentProcessRunEntity } from '@memberjunction/core-entities';
 import { ResolverBase } from '../generic/ResolverBase.js';
 import { ActionEngineServer } from '@memberjunction/actions';
@@ -32,6 +33,7 @@ export class AutotagPipelineResolver extends ResolverBase {
     async RunAutotagPipeline(
         @Arg('contentSourceIDs', () => [String], { nullable: true }) contentSourceIDs: string[] | undefined,
         @Arg('forceReprocess', { nullable: true }) forceReprocess: boolean | undefined,
+        @Arg('pipelineRunID', { nullable: true }) clientPipelineRunID: string | undefined,
         @Ctx() { userPayload, providers }: AppContext = {} as AppContext
     ): Promise<AutotagPipelineResult> {
         try {
@@ -40,14 +42,37 @@ export class AutotagPipelineResolver extends ResolverBase {
                 return { Success: false, Status: 'Error', ErrorMessage: 'Unable to determine current user' };
             }
 
-            const pipelineRunID = uuidv4();
-            LogStatus(`RunAutotagPipeline: starting pipeline ${pipelineRunID}`);
-
             // Capture the per-request provider snapshot before returning so the fire-and-forget
             // background job binds to the same connection the caller used. Without this, the
             // background job would silently use the global default — wrong for multi-tenant.
-            const provider = (GetReadWriteProvider(providers, { allowFallbackToReadOnly: true }) as unknown as IMetadataProvider)
-                ?? (new Metadata() as unknown as IMetadataProvider);
+            const provider: IMetadataProvider = GetReadWriteProvider(providers, { allowFallbackToReadOnly: true }) ?? Metadata.Provider;
+
+            let pipelineRunID: string;
+            if (clientPipelineRunID != null) {
+                if (!IsValidUUID(clientPipelineRunID)) {
+                    return { Success: false, Status: 'Error', ErrorMessage: 'Invalid pipelineRunID format' };
+                }
+                const rv = RunView.FromMetadataProvider(provider);
+                const existing = await rv.RunView<{ ID: string }>({
+                    EntityName: 'MJ: Content Process Runs',
+                    ExtraFilter: `ID='${EscapeSQLString(clientPipelineRunID)}'`,
+                    Fields: ['ID'],
+                    ResultType: 'simple',
+                    MaxRows: 1,
+                    SkipTotalRowCount: true,
+                }, currentUser);
+                if (!existing.Success) {
+                    return { Success: false, Status: 'Error', ErrorMessage: existing.ErrorMessage || 'Failed to validate pipelineRunID' };
+                }
+                if (existing.Results.length > 0) {
+                    return { Success: false, Status: 'Error', ErrorMessage: `Pipeline run ${clientPipelineRunID} already exists` };
+                }
+                pipelineRunID = clientPipelineRunID;
+            } else {
+                pipelineRunID = uuidv4();
+            }
+
+            LogStatus(`RunAutotagPipeline: starting pipeline ${pipelineRunID}`);
 
             // Fire-and-forget: start the pipeline in the background and return immediately
             this.runPipelineInBackground(pipelineRunID, currentUser, provider, contentSourceIDs, forceReprocess);
@@ -101,9 +126,19 @@ export class AutotagPipelineResolver extends ResolverBase {
             // and keeps the process run record in sync
             this.publishProgress(pipelineRunID, 'autotag', 0, 0, startTime, 'Running autotaggers...');
 
+            let lastTotal = 0;
+            let lastProcessed = 0;
+            let lastLabel = 'Scanning & extracting content from sources...';
+
             const progressCallback = (processed: number, total: number, currentItem?: string) => {
-                const pct = total > 0 ? Math.round((processed / total) * 80) : 0; // 0-80% for tagging
-                this.publishProgress(pipelineRunID, 'autotag', total, pct, startTime, currentItem || `${processed}/${total} items`);
+                lastProcessed = processed;
+                lastTotal = total;
+                if (currentItem) {
+                    lastLabel = currentItem;
+                } else if (total > 0) {
+                    lastLabel = `${processed}/${total} items`;
+                }
+                this.publishProgress(pipelineRunID, 'autotag', total, processed, startTime, lastLabel);
                 this.updateProcessRunProgress(processRun, processed, total);
             };
 
@@ -121,12 +156,21 @@ export class AutotagPipelineResolver extends ResolverBase {
                 actionParams.push({ Name: 'ForceReprocess', Value: 1, Type: 'Input' });
             }
 
-            const result = await ActionEngineServer.Instance.RunAction({
-                Action: action,
-                ContextUser: currentUser,
-                Filters: [],
-                Params: actionParams
-            });
+            const heartbeatTimer = setInterval(() => {
+                this.publishProgress(pipelineRunID, 'autotag', lastTotal, lastProcessed, startTime, lastLabel);
+            }, 3000);
+
+            let result;
+            try {
+                result = await ActionEngineServer.Instance.RunAction({
+                    Action: action,
+                    ContextUser: currentUser,
+                    Filters: [],
+                    Params: actionParams
+                });
+            } finally {
+                clearInterval(heartbeatTimer);
+            }
 
             // Stage: vectorize complete
             this.publishProgress(pipelineRunID, 'vectorize', 100, 90, startTime, 'Vectorizing content...');

package/src/resolvers/InfoResolver.ts

@@ -42,7 +42,7 @@ export class InfoResolver {
       Version: packageJson.version,
       IsSystemUser: Boolean(context.userPayload.isSystemUser),
       Platform: os.platform(),
-      Arch: os.platform(),
+      Arch: os.arch(),
       CpuModel: os.cpus()?.[0].model,
       Hostname: os.hostname(),
     };

package/src/resolvers/QuerySystemUserResolver.ts

@@ -382,14 +382,15 @@ export class MJQueryResolverExtended extends MJQueryResolver {
     /** After a successful create: the AfterCreate event, the permissions, and the result. */
     private async completeCreateAsync(provider: DatabaseProviderBase, input: CreateQuerySystemUserInput, record: MJQueryEntityServer, user: UserInfo): Promise<QueryMutationResultType> {
         await this.AfterCreate(provider, input); // fire event
+        let createdPermissions: MJQueryPermissionEntity[] | undefined;
         if (input.Permissions && input.Permissions.length > 0) {
             try {
-                await this.createPermissions(provider, input.Permissions, record.ID, user);
+                createdPermissions = await this.createPermissions(provider, input.Permissions, record.ID, user);
             } catch (e) {
                 return { Success: false, ErrorMessage: `Query '${record.Name}' (ID ${record.ID}) was created, but its permissions were not: ${e instanceof Error ? e.message : String(e)}` };
             }
         }
-        return this.buildSuccessResult(record, user, provider);
+        return this.buildSuccessResult(record, user, provider, undefined, createdPermissions);
     }
 
     /** The create-or-get result: the query another request created with this name. */
@@ -415,7 +416,14 @@ export class MJQueryResolverExtended extends MJQueryResolver {
      *
      * @param contextUser The caller the result is for. Field security projects the record for them.
      */
-    private async buildSuccessResult(entity: MJQueryEntityServer, contextUser: UserInfo, provider: DatabaseProviderBase, children?: StoredQueryChildren): Promise<QueryMutationResultType> {
+    private async buildSuccessResult(
+        entity: MJQueryEntityServer,
+        contextUser: UserInfo,
+        provider: DatabaseProviderBase,
+        children?: StoredQueryChildren,
+        createdPermissions?: MJQueryPermissionEntity[]
+    ): Promise<QueryMutationResultType> {
+        const permissionsToMap = children?.Permissions ?? createdPermissions ?? entity.QueryPermissions;
         return {
             Success: true,
             // Mapped for the caller, so the field-security projection applies: the record was just
@@ -425,7 +433,7 @@ export class MJQueryResolverExtended extends MJQueryResolver {
             Fields: this.mapFields(children?.Fields ?? entity.QueryFields),
             Parameters: this.mapParameters(children?.Parameters ?? entity.QueryParameters),
             Entities: this.mapEntities(children?.Entities ?? entity.QueryEntities),
-            Permissions: this.mapPermissions(children?.Permissions ?? entity.QueryPermissions),
+            Permissions: this.mapPermissions(permissionsToMap),
         };
     }
 
@@ -532,7 +540,8 @@ export class MJQueryResolverExtended extends MJQueryResolver {
      *
      * @throws Error naming the role and the save's own message when a row is not saved
      */
-    protected async createPermissions(p: DatabaseProviderBase, permissions: QueryPermissionInputType[], queryID: string, contextUser: UserInfo): Promise<void> {
+    protected async createPermissions(p: DatabaseProviderBase, permissions: QueryPermissionInputType[], queryID: string, contextUser: UserInfo): Promise<MJQueryPermissionEntity[]> {
+        const created: MJQueryPermissionEntity[] = [];
         for (const perm of permissions) {
             const permissionEntity = await p.GetEntityObject<MJQueryPermissionEntity>('MJ: Query Permissions', contextUser);
             if (permissionEntity) {
@@ -541,8 +550,10 @@ export class MJQueryResolverExtended extends MJQueryResolver {
                 if (!await permissionEntity.Save()) {
                     throw new Error(MJQueryResolverExtended.permissionWriteError('save', perm.RoleID, permissionEntity));
                 }
+                created.push(permissionEntity);
             }
         }
+        return created;
     }
 
     /**
@@ -648,17 +659,18 @@ export class MJQueryResolverExtended extends MJQueryResolver {
             const queryID = queryEntity.ID;
 
             // Handle permissions update if provided
+            let createdPermissions: MJQueryPermissionEntity[] | undefined;
             if (input.Permissions !== undefined) {
                 // Replace the existing permissions (read from the QueryEngine cache); a failed write stops the update with its reason
                 try {
                     await this.deletePermissions(queryID);
-                    await this.createPermissions(provider, input.Permissions, queryID, context.userPayload.userRecord);
+                    createdPermissions = await this.createPermissions(provider, input.Permissions, queryID, context.userPayload.userRecord);
                 } catch (e) {
                     return { Success: false, ErrorMessage: `Failed to update query permissions: ${e instanceof Error ? e.message : String(e)}` };
                 }
             }
 
-            return await this.buildSuccessResult(queryEntity, context.userPayload.userRecord, provider);
+            return await this.buildSuccessResult(queryEntity, context.userPayload.userRecord, provider, undefined, createdPermissions);
 
         } catch (err) {
             LogError(err);

package/src/resolvers/SqlLoggingConfigResolver.ts

@@ -9,6 +9,7 @@ import { LoadConfig } from '../config.js';
 import { ResolverBase } from '../generic/ResolverBase.js';
 import { GetReadOnlyProvider } from '../util.js';
 import { UserCache, SqlLoggingOptions as ProviderSqlLoggingOptions } from '@memberjunction/generic-database-provider';
+import { IsScopeLimitedPrincipal } from '../auth/scopeLimitedPrincipal.js';
 
 /**
  * Configuration options for SQL logging sessions.
@@ -252,6 +253,9 @@ export class SqlLoggingConfigResolver extends ResolverBase {
    * @private
    */
   private async checkOwnerAccess(context: AppContext): Promise<UserInfo> {
+    if (context?.userPayload?.userRecord && IsScopeLimitedPrincipal(context.userPayload.userRecord)) {
+      throw new Error('Access denied. Scope-limited principals cannot access SQL logging.');
+    }
     const userEmail = context.userPayload?.email;
     if (!userEmail) {
       throw new Error('User not authenticated');
@@ -263,15 +267,9 @@ export class SqlLoggingConfigResolver extends ResolverBase {
     if (!user) {
       throw new Error('User not found');
     }
-    
-    // Debug logging
-    console.log('SQL Logging access check:', {
-      email: user.Email,
-      type: user.Type,
-      typeLength: user.Type?.length,
-      typeTrimmed: user.Type?.trim(),
-      isOwner: user.Type?.trim().toLowerCase() === 'owner'
-    });
+    if (IsScopeLimitedPrincipal(user)) {
+      throw new Error('Access denied. Scope-limited principals cannot access SQL logging.');
+    }
     
     // Check if user has Type = 'Owner' (trim and case-insensitive for nchar fields)
     if (user.Type?.trim().toLowerCase() !== 'owner') {

package/src/resolvers/TagGovernanceResolver.ts

@@ -3,6 +3,7 @@ import { AppContext } from '../types.js';
 import { LogError, LogStatus } from '@memberjunction/core';
 import { ResolverBase } from '../generic/ResolverBase.js';
 import { TagGovernanceEngine, TagHealthJob, DEFAULT_TAG_HEALTH_THRESHOLDS, TagEngine } from '@memberjunction/tag-engine';
+import { TagCoOccurrenceEngine } from '@memberjunction/tag-engine-base';
 
 @ObjectType()
 export class PromoteSuggestionResult {
@@ -28,6 +29,30 @@ export class RejectSuggestionResult {
     ErrorMessage?: string;
 }
 
+@ObjectType()
+export class MergeTagsResult {
+    @Field()
+    Success: boolean;
+
+    @Field(() => Int)
+    ItemsMoved: number;
+
+    @Field(() => Int)
+    TaggedItemsMoved: number;
+
+    @Field({ nullable: true })
+    ErrorMessage?: string;
+}
+
+@ObjectType()
+export class RecomputeTagCoOccurrenceResult {
+    @Field(() => Int)
+    PairsUpdated: number;
+
+    @Field(() => Int)
+    PairsDeleted: number;
+}
+
 @ObjectType()
 export class RebuildTagEmbeddingsResult {
     @Field()
@@ -186,4 +211,44 @@ export class TagGovernanceResolver extends ResolverBase {
             return { Success: false, MergeCount: 0, LowUsageCount: 0, WideNodeCount: 0, DurationMs: 0, ErrorMessage: msg };
         }
     }
+
+    @Mutation(() => MergeTagsResult)
+    async MergeTags(
+        @Arg('sourceTagIDs', () => [String]) sourceTagIDs: string[],
+        @Arg('survivingTagID') survivingTagID: string,
+        @Ctx() { userPayload }: AppContext = {} as AppContext
+    ): Promise<MergeTagsResult> {
+        try {
+            const currentUser = this.GetUserFromPayload(userPayload);
+            if (!currentUser) {
+                return { Success: false, ItemsMoved: 0, TaggedItemsMoved: 0, ErrorMessage: 'Unable to determine current user' };
+            }
+            await TagEngine.Instance.Config(false, currentUser);
+            const result = await TagGovernanceEngine.Instance.MergeTags(sourceTagIDs, survivingTagID, currentUser);
+            return {
+                Success: true,
+                ItemsMoved: result.ItemsMoved,
+                TaggedItemsMoved: result.TaggedItemsMoved,
+            };
+        } catch (error) {
+            const msg = error instanceof Error ? error.message : String(error);
+            LogError(`MergeTags failed for survivingTagID ${survivingTagID}: ${msg}`);
+            return { Success: false, ItemsMoved: 0, TaggedItemsMoved: 0, ErrorMessage: msg };
+        }
+    }
+
+    @Mutation(() => RecomputeTagCoOccurrenceResult)
+    async RecomputeTagCoOccurrence(
+        @Ctx() { userPayload }: AppContext = {} as AppContext
+    ): Promise<RecomputeTagCoOccurrenceResult> {
+        const currentUser = this.GetUserFromPayload(userPayload);
+        if (!currentUser) {
+            throw new Error('Unable to determine current user');
+        }
+        const result = await TagCoOccurrenceEngine.Instance.RecomputeCoOccurrence(currentUser);
+        return {
+            PairsUpdated: result.PairsUpdated,
+            PairsDeleted: result.PairsDeleted,
+        };
+    }
 }