@memberjunction/server 6.2.0-edge.0 → 6.2.0-edge.1

package/src/generated/graphql-schemas/__mj.ts

@@ -15685,6 +15685,10 @@ export class MJAIPromptRun_ {
     @MaxLength(25)
     ToolCallingMode?: string;
         
+    @Field({nullable: true, description: `The user on whose behalf this prompt was executed, written when the run is created. NULL for automated/unauthenticated runs and for runs that pre-date this column. For an agent-driven run the agent run's user is also reachable through AIAgentRunStep.TargetLogID, which vwAIUsageFacts falls back to.`}) 
+    @MaxLength(36)
+    UserID?: string;
+        
     @Field({nullable: true}) 
     @MaxLength(255)
     Prompt?: string;
@@ -15733,6 +15737,10 @@ export class MJAIPromptRun_ {
     @MaxLength(50)
     UsageType?: string;
         
+    @Field({nullable: true}) 
+    @MaxLength(100)
+    User?: string;
+        
     @Field({nullable: true}) 
     @MaxLength(36)
     RootParentID?: string;
@@ -16029,6 +16037,9 @@ export class CreateMJAIPromptRunInput {
     @Field({ nullable: true })
     ToolCallingMode: string | null;
 
+    @Field({ nullable: true })
+    UserID: string | null;
+
     @Field(() => RestoreContextInput, { nullable: true })
     RestoreContext___?: RestoreContextInput;
 }
@@ -16309,6 +16320,9 @@ export class UpdateMJAIPromptRunInput {
     @Field({ nullable: true })
     ToolCallingMode?: string | null;
 
+    @Field({ nullable: true })
+    UserID?: string | null;
+
     @Field(() => [KeyValuePairInput], { nullable: true })
     OldValues___?: KeyValuePairInput[];
 
@@ -19215,6 +19229,9 @@ export class MJAIVendor_ {
     @MaxLength(36)
     CredentialTypeID?: string;
         
+    @Field({nullable: true, description: `Vendor configuration bag (JSON, IAIVendorConfiguration shape). Its ModelDefaults key is an IAIModelConfiguration bag (LLM / Realtime / Vision / Audio sections) that forms the default model configuration for every model this vendor serves: the vendor layer of the ModelConfiguration cascade, above AIModelType and AIModel and below AIModelVendor, which may override it per key. NULL = contributes nothing.`}) 
+    Configuration?: string;
+        
     @Field({nullable: true}) 
     @MaxLength(100)
     CredentialType?: string;
@@ -19241,6 +19258,9 @@ export class CreateMJAIVendorInput {
     @Field({ nullable: true })
     CredentialTypeID: string | null;
 
+    @Field({ nullable: true })
+    Configuration: string | null;
+
     @Field(() => RestoreContextInput, { nullable: true })
     RestoreContext___?: RestoreContextInput;
 }
@@ -19263,6 +19283,9 @@ export class UpdateMJAIVendorInput {
     @Field({ nullable: true })
     CredentialTypeID?: string | null;
 
+    @Field({ nullable: true })
+    Configuration?: string | null;
+
     @Field(() => [KeyValuePairInput], { nullable: true })
     OldValues___?: KeyValuePairInput[];
 
@@ -66952,6 +66975,10 @@ export class MJProject_ {
     @Field() 
     _mj__UpdatedAt: Date;
         
+    @Field({nullable: true, description: `The user who owns this folder, or NULL when the folder is shared with the whole environment. NULL (the value every pre-existing folder carries) means SHARED: visible to anyone who can read projects in the environment, which was the only possible behaviour before this column existed. A set value means PERSONAL: the folder belongs to that user and consumers filter it to them, so it stays out of other people's sidebars. Personal is opt-in at create time; nothing is migrated.`}) 
+    @MaxLength(36)
+    OwnerUserID?: string;
+        
     @Field({nullable: true}) 
     @MaxLength(255)
     Environment?: string;
@@ -66960,6 +66987,10 @@ export class MJProject_ {
     @MaxLength(255)
     Parent?: string;
         
+    @Field({nullable: true}) 
+    @MaxLength(100)
+    OwnerUser?: string;
+        
     @Field({nullable: true}) 
     @MaxLength(36)
     RootParentID?: string;
@@ -67010,6 +67041,9 @@ export class CreateMJProjectInput {
     @Field(() => Boolean, { nullable: true })
     IsArchived?: boolean;
 
+    @Field({ nullable: true })
+    OwnerUserID: string | null;
+
     @Field(() => RestoreContextInput, { nullable: true })
     RestoreContext___?: RestoreContextInput;
 }
@@ -67044,6 +67078,9 @@ export class UpdateMJProjectInput {
     @Field(() => Boolean, { nullable: true })
     IsArchived?: boolean;
 
+    @Field({ nullable: true })
+    OwnerUserID?: string | null;
+
     @Field(() => [KeyValuePairInput], { nullable: true })
     OldValues___?: KeyValuePairInput[];
 

package/src/generic/CacheInvalidationResolver.ts

@@ -1,7 +1,57 @@
 import { Field, ObjectType, Resolver, Root, Subscription } from 'type-graphql';
+import { Metadata, UserInfo } from '@memberjunction/core';
 
 export const CACHE_INVALIDATION_TOPIC = 'CACHE_INVALIDATION';
 
+/**
+ * Entities whose rows may ride along with an invalidation event. Empty until the server entry point
+ * supplies the configured list, so the default — including in any process that never configures it
+ * — is to broadcast nothing.
+ */
+let allowedRecordDataEntities: readonly string[] = [];
+
+/**
+ * Supply the configured allowlist. Called once from the server entry point during bootstrap.
+ *
+ * INJECTED rather than read from `configInfo` here, deliberately. `config.ts` runs `loadConfig()` at
+ * module scope, so importing it from this module would drag full config validation into every
+ * import chain that touches the resolver — including unit tests, which have no server config and
+ * would fail at import with "Configuration validation failed". This module deliberately imports
+ * nothing from MJServer itself — only type-graphql and `@memberjunction/core` (for the entity
+ * permission check in the subscription filter), neither of which loads config.
+ */
+export function ConfigureRecordDataBroadcast(entities: readonly string[] | undefined | null): void {
+  // Normalised HERE, once, rather than at each comparison. The wildcard used to be matched raw
+  // (`includes('*')`) while entity names were trimmed and lowercased two lines below, so a
+  // hand-edited `[' * ']` matched neither branch and silently opted nothing in — a config that
+  // looks like it disables the gate while leaving it fully on. Empty entries are dropped so a
+  // stray `''` cannot match an entity whose name is somehow blank.
+  allowedRecordDataEntities = (entities ?? [])
+    .map((e) => e.trim().toLowerCase())
+    .filter((e) => e.length > 0);
+}
+
+/**
+ * May the full row of `entityName` be broadcast alongside its cache-invalidation event?
+ *
+ * The subscription below is filtered only by ENTITY-level read permission, so anything included
+ * here is disclosed to every signed-in session that may read the entity at all — regardless of
+ * row-level security or any tenant scoping a consumer applies on the read path, neither of which
+ * this push traverses. The answer is therefore NO unless a deployment has explicitly opted the
+ * entity in via `cacheSettings.recordDataBroadcastEntities`.
+ *
+ * Callers that get `false` simply omit `recordData`; the event still carries the entity name and
+ * primary key, so clients evict and re-fetch through the normal access-controlled read path.
+ *
+ * Matching is exact (trimmed, case-insensitive) rather than substring: a loose match would let an
+ * allowlisted name drag in every entity whose name contains it.
+ */
+export function MayBroadcastRecordData(entityName: string): boolean {
+  if (allowedRecordDataEntities.length === 0) return false;
+  if (allowedRecordDataEntities.includes('*')) return true;
+  return allowedRecordDataEntities.includes(entityName.trim().toLowerCase());
+}
+
 @ObjectType()
 export class CacheInvalidationNotification {
     @Field(() => String)
@@ -40,17 +90,111 @@ export interface CacheInvalidationPayload {
     recordData?: string;
 }
 
+/**
+ * What the subscription filter needs off the WS connection.
+ *
+ * Declared structurally rather than importing MJServer's `UserPayload`, which reaches `types.ts`
+ * and through it `auth/index.js` and config. Keeping this module's imports minimal is not fussiness
+ * — importing `configInfo` here is what previously broke every unit test that touched the resolver,
+ * and the import-surface test in this package exists to keep it that way.
+ */
+export interface CacheInvalidationFilterContext {
+    userPayload?: { userRecord?: unknown };
+}
+
+/**
+ * Should this subscriber hear about this event at all?
+ *
+ * Entity-level narrowing, raised in review: an event for an entity a session has no read
+ * permission on tells that session the record exists, its stable key, and when it changed — and
+ * the session could never have read it anyway, so nothing is lost by withholding it. This is a
+ * monotonic reduction in disclosure that needs no tenancy model, which is why it is here and the
+ * row-level question is not.
+ *
+ * What it does NOT close: two sessions that both hold read permission on an entity still see each
+ * other's keys, because what separates them is row-level. That predicate is tracked separately —
+ * see the class docblock below.
+ *
+ * `GetUserPermisions` is an in-memory match of the entity's permission rows against the user's
+ * roles, so this stays cheap enough to run per subscriber per event. It is not free: it runs for
+ * every connected socket on every save, so keep it free of I/O.
+ */
+export function CacheInvalidationFilter(data: {
+    payload: CacheInvalidationPayload;
+    context: CacheInvalidationFilterContext | undefined;
+}): boolean {
+    const user = data.context?.userPayload?.userRecord as UserInfo | undefined;
+    // FAIL CLOSED on identity, matching `statusUpdatesFilter`. `onConnect` rejects a socket whose
+    // token does not validate, so a subscriber with no user record should not exist; if one does,
+    // it is the case least deserving of an unfiltered firehose.
+    if (!user) {
+        return false;
+    }
+
+    const entityName = data.payload?.entityName;
+    if (!entityName) {
+        return false;
+    }
+
+    // A pub/sub subscription filter has no per-request provider to thread: it runs on the server's
+    // own metadata, which is the one place the entity's permission rows can be answered from.
+    const entity = new Metadata().EntityByName(entityName); // global-provider-ok: subscription filter — server-wide metadata, no request-scoped provider exists here
+    // DELIVER when the entity is unknown here, deliberately — the opposite of the choice above.
+    // A name absent from metadata cannot be permission-checked, and withholding would silently
+    // stop invalidating a legitimately cacheable entity, which is a correctness bug rather than a
+    // disclosure one. All it discloses is the name and key of something this server cannot
+    // describe.
+    if (!entity) {
+        return true;
+    }
+
+    return entity.GetUserPermisions(user).CanRead;
+}
+
+/** @deprecated Use {@link CacheInvalidationFilter}. */
+export function cacheInvalidationFilter(data: {
+    payload: CacheInvalidationPayload;
+    context: CacheInvalidationFilterContext | undefined;
+}): boolean {
+  return CacheInvalidationFilter(data);
+}
+
 @Resolver()
 export class CacheInvalidationResolver {
     /**
-     * Subscription that broadcasts cache invalidation events to ALL connected clients.
-     * No session filter — every browser connected via WebSocket receives every event.
-     * This enables cross-server cache invalidation to propagate to browser clients.
+     * Subscription that broadcasts cache invalidation events to connected clients, so cross-server
+     * cache invalidation reaches browsers.
+     *
+     * Delivery is filtered only by ENTITY-level read permission (see {@link CacheInvalidationFilter}).
+     * Every session that may read an entity at all still receives every event for it, from every
+     * other session and tenant.
+     *
+     * Because that narrowing stops well short of row level, `RecordData` is only populated for entities a
+     * deployment has opted in through `cacheSettings.recordDataBroadcastEntities` — see
+     * {@link MayBroadcastRecordData}, applied at both publish sites.
+     *
+     * `EntityName`, `PrimaryKeyValues`, `Action` and `Timestamp` ARE still broadcast to every
+     * session, and that is a disclosure, not a safe residue. An earlier version of this comment
+     * called them "safe to broadcast" on the grounds that reading the record still goes through
+     * the access-controlled path — true of the row's CONTENTS, and beside the point for the
+     * metadata itself. A session with no relationship to a record still learns that it exists,
+     * its stable key, and every time it changes; across entities it learns the cadence and volume
+     * of another tenant's activity.
+     *
+     * The key is kept deliberately, because consumers need it to re-read the record they were
+     * told about (see `ResolveEntityEventKey` in @memberjunction/core) and because the alternative
+     * — a coarse "something in this entity changed" — forces whole-entity invalidation on the
+     * hottest write paths. That is a trade, not an absence of cost. Narrowing it means filtering
+     * delivery per subscriber, which needs an authorization predicate cheap enough to run per
+     * subscriber per event; entity-level permissions (`EntityInfo.GetUserPermisions`, an in-memory
+     * role match) would cover part of it, row-level tenancy would not.
      */
     @Subscription(() => CacheInvalidationNotification, {
         topics: CACHE_INVALIDATION_TOPIC,
+        filter: (data: { payload: CacheInvalidationPayload; context: CacheInvalidationFilterContext | undefined }) =>
+            CacheInvalidationFilter(data),
     })
-    cacheInvalidation(
+    cacheInvalidation(  // case-violation-ok-legacy-back-compat: the property name is the GraphQL schema field name — renaming it breaks every client query
         @Root() payload: CacheInvalidationPayload
     ): CacheInvalidationNotification {
         return {

package/src/generic/DeleteOptionsInput.ts

@@ -50,9 +50,16 @@ export class DeleteOptionsInput {
      * schema-sync gate requires `DeleteOptionsInput` to carry every `EntityDeleteOptions` field;
      * {@link DeleteOptionsInput.SanitizeFromWire} forces it back to false on every request. See
      * that method for why.
+     *
+     * **Optional on the wire, on purpose.** This field did not exist in 5.51.x, and every other
+     * field here is required, so making it required too turned a 6.1 upgrade into a hard failure
+     * for every client that spells out `options___` on a delete (`Field
+     * "DeleteOptionsInput.SkipRecordChanges" of required type "Boolean!" was not provided`). A
+     * 5.51 client that omits it and a 6.1 client that sends `false` mean the same thing, and the
+     * server forces it to `false` regardless, so `null`/absent defaults to `false` here.
      */
-    @Field(() => Boolean)
-    SkipRecordChanges: boolean;
+    @Field(() => Boolean, { nullable: true, defaultValue: false })
+    SkipRecordChanges?: boolean;
 
     /**
      * Strips wire-unreachable capabilities from client-supplied delete options.

package/src/generic/FireAndForgetHeartbeat.ts

@@ -1,6 +1,6 @@
 import { PubSubEngine } from 'type-graphql';
 import { LogError } from '@memberjunction/core';
-import { publishStatusUpdate } from './PushStatusResolver.js';
+import { PublishStatusUpdate } from './PushStatusResolver.js';
 
 /** Default cadence for fire-and-forget liveness pulses (5 minutes). */
 export const DEFAULT_PULSE_INTERVAL_MS = 5 * 60 * 1000;
@@ -15,38 +15,38 @@ export const HEARTBEAT_MESSAGE_TYPE = 'Heartbeat';
  */
 export interface PulseStatus {
     /** Primary key of the persisted run record (AIAgentRun, TestRun, TestSuiteRun). */
-    runId?: string;
+    runId?: string;  // case-violation-ok-legacy-back-compat: optional, and the old name is also read off a value the checker cannot type; renaming it stays assignable and silently yields undefined
     /** Current run status, e.g. 'Running'. */
-    status?: string;
+    status?: string;  // case-violation-ok-legacy-back-compat: optional, and the old name is also read off a value the checker cannot type; renaming it stays assignable and silently yields undefined
     /** Optional human-readable current step for UI display. */
-    currentStep?: string;
+    currentStep?: string;  // case-violation-ok-legacy-back-compat: optional, and the old name is also read off a value the checker cannot type; renaming it stays assignable and silently yields undefined
 }
 
 /** Handle returned by {@link startLivenessPulse}; call `stop()` when the work settles. */
 export interface LivenessPulseHandle {
-    stop(): void;
+    Stop(): void;
 }
 
 export interface LivenessPulseOptions {
     /** PubSub engine used to publish on the shared push-status topic. */
-    pubSub: PubSubEngine;
+    pubSub: PubSubEngine;  // case-violation-ok-legacy-back-compat: renaming it broke a use the checker could not see from the declaration — the compile proved it
     /** Session the client is subscribed on (used by the subscription filter). */
-    sessionId: string;
+    sessionId: string;  // case-violation-ok-legacy-back-compat: the old name is also read off a value typed `any`, where a rename would compile and silently return undefined
     /**
      * Authenticated user the operation belongs to (B49). Stamped on every pulse so the
      * subscription filter binds delivery to identity, not just the client-chosen sessionId.
      */
-    ownerUserId: string;
+    ownerUserId: string;  // case-violation-ok-legacy-back-compat: renaming it broke a use the checker could not see from the declaration — the compile proved it
     /** Resolver label echoed in the message envelope (e.g. 'RunAIAgentResolver'). */
-    resolver: string;
+    resolver: string;  // case-violation-ok-legacy-back-compat: the old name is also read off a value typed `any`, where a rename would compile and silently return undefined
     /** Pulse cadence in ms. Defaults to {@link DEFAULT_PULSE_INTERVAL_MS}. */
-    intervalMs?: number;
+    intervalMs?: number;  // case-violation-ok-legacy-back-compat: renaming it broke a use the checker could not see from the declaration — the compile proved it
     /**
      * Optional cheap status reader invoked on each tick. Should read from an
      * in-memory ref, not the database. Errors are swallowed so a transient read
      * never kills the pulse loop.
      */
-    readStatus?: () => PulseStatus | undefined;
+    readStatus?: () => PulseStatus | undefined;  // case-violation-ok-legacy-back-compat: renaming it broke a use the checker could not see from the declaration — the compile proved it
 }
 
 /**
@@ -60,7 +60,7 @@ export interface LivenessPulseOptions {
  * (`{ message: JSON.stringify({ resolver, type, status, data }), sessionId }`),
  * so the client receives it through the same subscription with no special parsing.
  */
-export function startLivenessPulse(options: LivenessPulseOptions): LivenessPulseHandle {
+export function StartLivenessPulse(options: LivenessPulseOptions): LivenessPulseHandle {
     const { pubSub, sessionId, ownerUserId, resolver, readStatus } = options;
     const intervalMs = options.intervalMs ?? DEFAULT_PULSE_INTERVAL_MS;
 
@@ -73,7 +73,7 @@ export function startLivenessPulse(options: LivenessPulseOptions): LivenessPulse
             LogError(`[LivenessPulse:${resolver}] readStatus failed: ${(e as Error).message}`);
         }
 
-        publishStatusUpdate(pubSub, {
+        PublishStatusUpdate(pubSub, {
             sessionId,
             ownerUserId,
             message: JSON.stringify({
@@ -86,6 +86,11 @@ export function startLivenessPulse(options: LivenessPulseOptions): LivenessPulse
     }, intervalMs);
 
     return {
-        stop: () => clearInterval(timer),
+        Stop: () => clearInterval(timer),
     };
 }
+
+/** @deprecated Use {@link StartLivenessPulse}. */
+export function startLivenessPulse(options: LivenessPulseOptions): LivenessPulseHandle {
+    return StartLivenessPulse(options);
+}

package/src/generic/PushStatusResolver.ts

@@ -7,13 +7,13 @@ export const PUSH_STATUS_UPDATES_TOPIC = 'PUSH_STATUS_UPDATES';
 @ObjectType()
 export class PushStatusNotification {
   @Field(() => String, { nullable: true })
-  message?: string;
+  message?: string;  // case-violation-ok-legacy-back-compat: the property name is the GraphQL schema field name — renaming it breaks every client query
 
   @Field((_type) => Date)
-  date!: Date;
+  date!: Date;  // case-violation-ok-legacy-back-compat: the property name is the GraphQL schema field name — renaming it breaks every client query
 
   @Field((_type) => ID)
-  sessionId!: string;
+  sessionId!: string;  // case-violation-ok-legacy-back-compat: the property name is the GraphQL schema field name — renaming it breaks every client query
 }
 
 /**
@@ -55,7 +55,7 @@ export interface StatusUpdateParams {
  * payload shape and the required-identity guarantee live in exactly one place. Adding a field to
  * the push is a one-line change here; a new publisher physically cannot omit `ownerUserId`.
  */
-export function publishStatusUpdate(pubSub: PubSubEngine, params: StatusUpdateParams): void {
+export function PublishStatusUpdate(pubSub: PubSubEngine, params: StatusUpdateParams): void {
   const payload: PushStatusNotificationPayload = {
     sessionId: params.sessionId,
     ownerUserId: params.ownerUserId,
@@ -64,6 +64,11 @@ export function publishStatusUpdate(pubSub: PubSubEngine, params: StatusUpdatePa
   pubSub.publish(PUSH_STATUS_UPDATES_TOPIC, payload);
 }
 
+/** @deprecated Use {@link PublishStatusUpdate}. */
+export function publishStatusUpdate(pubSub: PubSubEngine, params: StatusUpdateParams): void {
+  return PublishStatusUpdate(pubSub, params);
+}
+
 /** Minimal shape of the subscription's connection context needed by the filter. */
 export interface StatusUpdatesFilterContext {
   userPayload?: UserPayload;
@@ -82,7 +87,7 @@ export interface StatusUpdatesFilterContext {
  * `sessionId` is no longer sufficient. Fails CLOSED — a missing owner or connection identity never
  * matches.
  */
-export function statusUpdatesFilter(data: {
+export function StatusUpdatesFilter(data: {
   payload: PushStatusNotificationPayload;
   args: PushStatusNotificationArgs;
   context: StatusUpdatesFilterContext | undefined;
@@ -98,14 +103,23 @@ export function statusUpdatesFilter(data: {
   return UUIDsEqual(payload.ownerUserId, connectionUserId);
 }
 
+/** @deprecated Use {@link StatusUpdatesFilter}. */
+export function statusUpdatesFilter(data: {
+  payload: PushStatusNotificationPayload;
+  args: PushStatusNotificationArgs;
+  context: StatusUpdatesFilterContext | undefined;
+}): boolean {
+  return StatusUpdatesFilter(data);
+}
+
 @Resolver()
 export class PushStatusResolver {
   @Subscription(() => PushStatusNotification, {
     topics: PUSH_STATUS_UPDATES_TOPIC,
     filter: (data: ResolverFilterData<PushStatusNotificationPayload, PushStatusNotificationArgs, StatusUpdatesFilterContext>) =>
-      statusUpdatesFilter(data),
+      StatusUpdatesFilter(data),
   })
-  statusUpdates(
+  statusUpdates(  // case-violation-ok-legacy-back-compat: the property name is the GraphQL schema field name — renaming it breaks every client query
     @Root() { message }: PushStatusNotificationPayload,
     @Arg('sessionId', () => String) sessionId: string
   ): PushStatusNotification {

package/src/generic/ResolverBase.ts

@@ -40,8 +40,8 @@ import { MJEvent, MJEventType, MJGlobal, ENCRYPTED_SENTINEL, EscapeSQLString, Is
 import { SQLParser } from '@memberjunction/sql-parser';
 import { PostgreSQLDialect, SQLServerDialect, type SQLParserDialect } from '@memberjunction/sql-dialect';
 import { EncryptionEngine } from '@memberjunction/encryption';
-import { PUSH_STATUS_UPDATES_TOPIC, publishStatusUpdate } from './PushStatusResolver.js';
-import { CACHE_INVALIDATION_TOPIC } from './CacheInvalidationResolver.js';
+import { PUSH_STATUS_UPDATES_TOPIC, PublishStatusUpdate } from './PushStatusResolver.js';
+import { CACHE_INVALIDATION_TOPIC, MayBroadcastRecordData } from './CacheInvalidationResolver.js';
 import { PubSubManager } from './PubSubManager.js';
 import { FieldMapper } from '@memberjunction/graphql-dataprovider';
 import { Subscription } from 'rxjs';
@@ -51,7 +51,7 @@ export class ResolverBase {
   private static _cloudeventsHeaders = process.env.CLOUDEVENTS_HTTP_HEADERS ? JSON.parse(process.env.CLOUDEVENTS_HTTP_HEADERS) : {};
 
   private static _eventSubscriptionKey: string = '___MJServer___ResolverBase___EventSubscriptions';
-  private get EventSubscriptions(): Map<string, Subscription> {
+  private get eventSubscriptions(): Map<string, Subscription> {
     // here we use the global object store instead of a static member becuase in some cases based on import code paths/bundling/etc, the static member
     // could actually be duplicated and we'd end up with multiple instances of the same map, which would be bad.
     const g = MJGlobal.Instance.GetGlobalObjectStore();
@@ -1450,16 +1450,24 @@ export class ResolverBase {
    * Publishes a CACHE_INVALIDATION event to connected browser clients after a successful
    * entity save or delete. Includes the originSessionId so the originating browser can
    * skip redundant re-fetches (it already handled the event locally).
+   *
+   * The row itself rides along ONLY for entities opted in via
+   * `cacheSettings.recordDataBroadcastEntities` — this event reaches every connected client
+   * unfiltered, so the row would otherwise be readable by sessions that could not read the record.
    */
   protected PublishCacheInvalidation(entityObject: BaseEntity, action: 'save' | 'delete', userPayload: UserPayload): void {
+    const entityName = entityObject.EntityInfo.Name;
     PubSubManager.Instance.Publish(CACHE_INVALIDATION_TOPIC, {
-      entityName: entityObject.EntityInfo.Name,
+      entityName,
       primaryKeyValues: JSON.stringify(entityObject.PrimaryKey.KeyValuePairs),
       action,
       sourceServerId: MJGlobal.Instance.ProcessUUID,
       timestamp: new Date(),
       originSessionId: userPayload?.sessionId || null,
-      recordData: action === 'save' ? JSON.stringify(entityObject.GetAll()) : undefined,
+      recordData:
+        action === 'save' && MayBroadcastRecordData(entityName)
+          ? JSON.stringify(entityObject.GetAll())
+          : undefined,
     });
   }
 
@@ -1472,7 +1480,7 @@ export class ResolverBase {
    * `publishStatusUpdate()` function directly with an explicit `ownerUserId`.
    */
   protected PublishStatusUpdate(pubSub: PubSubEngine, sessionId: string, message: string | undefined, userPayload: UserPayload): void {
-    publishStatusUpdate(pubSub, {
+    PublishStatusUpdate(pubSub, {
       sessionId,
       ownerUserId: userPayload?.userRecord?.ID ?? '',
       message,
@@ -1485,7 +1493,7 @@ export class ResolverBase {
     // cause issues with multiple messages for the same event.
     const uniqueKey = entityObject.EntityInfo.Name;
 
-    if (!this.EventSubscriptions.has(uniqueKey)) {
+    if (!this.eventSubscriptions.has(uniqueKey)) {
       // listen for events from the entityObject in case it is a long running task and we can push messages back to the client via pubSub
       LogDebug(`ResolverBase.ListenForEntityMessages: About to call MJGlobal.Instance.GetEventListener() to get the event listener subscription for ${uniqueKey}`);
       const theSub = MJGlobal.Instance.GetEventListener(false).subscribe(async (event: MJEvent) => {
@@ -1518,7 +1526,7 @@ export class ResolverBase {
           }
         }
       });
-      this.EventSubscriptions.set(uniqueKey, theSub);
+      this.eventSubscriptions.set(uniqueKey, theSub);
     }
   }