@memberjunction/server 6.2.0-edge.0 → 6.2.0-edge.2

package/dist/generic/CacheInvalidationResolver.d.ts

@@ -1,4 +1,31 @@
 export declare const CACHE_INVALIDATION_TOPIC = "CACHE_INVALIDATION";
+/**
+ * Supply the configured allowlist. Called once from the server entry point during bootstrap.
+ *
+ * INJECTED rather than read from `configInfo` here, deliberately. `config.ts` runs `loadConfig()` at
+ * module scope, so importing it from this module would drag full config validation into every
+ * import chain that touches the resolver — including unit tests, which have no server config and
+ * would fail at import with "Configuration validation failed". This module deliberately imports
+ * nothing from MJServer itself — only type-graphql and `@memberjunction/core` (for the entity
+ * permission check in the subscription filter), neither of which loads config.
+ */
+export declare function ConfigureRecordDataBroadcast(entities: readonly string[] | undefined | null): void;
+/**
+ * May the full row of `entityName` be broadcast alongside its cache-invalidation event?
+ *
+ * The subscription below is filtered only by ENTITY-level read permission, so anything included
+ * here is disclosed to every signed-in session that may read the entity at all — regardless of
+ * row-level security or any tenant scoping a consumer applies on the read path, neither of which
+ * this push traverses. The answer is therefore NO unless a deployment has explicitly opted the
+ * entity in via `cacheSettings.recordDataBroadcastEntities`.
+ *
+ * Callers that get `false` simply omit `recordData`; the event still carries the entity name and
+ * primary key, so clients evict and re-fetch through the normal access-controlled read path.
+ *
+ * Matching is exact (trimmed, case-insensitive) rather than substring: a loose match would let an
+ * allowlisted name drag in every entity whose name contains it.
+ */
+export declare function MayBroadcastRecordData(entityName: string): boolean;
 export declare class CacheInvalidationNotification {
     EntityName: string;
     PrimaryKeyValues?: string;
@@ -21,12 +48,75 @@ export interface CacheInvalidationPayload {
     originSessionId?: string;
     recordData?: string;
 }
+/**
+ * What the subscription filter needs off the WS connection.
+ *
+ * Declared structurally rather than importing MJServer's `UserPayload`, which reaches `types.ts`
+ * and through it `auth/index.js` and config. Keeping this module's imports minimal is not fussiness
+ * — importing `configInfo` here is what previously broke every unit test that touched the resolver,
+ * and the import-surface test in this package exists to keep it that way.
+ */
+export interface CacheInvalidationFilterContext {
+    userPayload?: {
+        userRecord?: unknown;
+    };
+}
+/**
+ * Should this subscriber hear about this event at all?
+ *
+ * Entity-level narrowing, raised in review: an event for an entity a session has no read
+ * permission on tells that session the record exists, its stable key, and when it changed — and
+ * the session could never have read it anyway, so nothing is lost by withholding it. This is a
+ * monotonic reduction in disclosure that needs no tenancy model, which is why it is here and the
+ * row-level question is not.
+ *
+ * What it does NOT close: two sessions that both hold read permission on an entity still see each
+ * other's keys, because what separates them is row-level. That predicate is tracked separately —
+ * see the class docblock below.
+ *
+ * `GetUserPermisions` is an in-memory match of the entity's permission rows against the user's
+ * roles, so this stays cheap enough to run per subscriber per event. It is not free: it runs for
+ * every connected socket on every save, so keep it free of I/O.
+ */
+export declare function CacheInvalidationFilter(data: {
+    payload: CacheInvalidationPayload;
+    context: CacheInvalidationFilterContext | undefined;
+}): boolean;
+/** @deprecated Use {@link CacheInvalidationFilter}. */
+export declare function cacheInvalidationFilter(data: {
+    payload: CacheInvalidationPayload;
+    context: CacheInvalidationFilterContext | undefined;
+}): boolean;
 export declare class CacheInvalidationResolver {
     /**
-     * Subscription that broadcasts cache invalidation events to ALL connected clients.
-     * No session filter — every browser connected via WebSocket receives every event.
-     * This enables cross-server cache invalidation to propagate to browser clients.
+     * Subscription that broadcasts cache invalidation events to connected clients, so cross-server
+     * cache invalidation reaches browsers.
+     *
+     * Delivery is filtered only by ENTITY-level read permission (see {@link CacheInvalidationFilter}).
+     * Every session that may read an entity at all still receives every event for it, from every
+     * other session and tenant.
+     *
+     * Because that narrowing stops well short of row level, `RecordData` is only populated for entities a
+     * deployment has opted in through `cacheSettings.recordDataBroadcastEntities` — see
+     * {@link MayBroadcastRecordData}, applied at both publish sites.
+     *
+     * `EntityName`, `PrimaryKeyValues`, `Action` and `Timestamp` ARE still broadcast to every
+     * session, and that is a disclosure, not a safe residue. An earlier version of this comment
+     * called them "safe to broadcast" on the grounds that reading the record still goes through
+     * the access-controlled path — true of the row's CONTENTS, and beside the point for the
+     * metadata itself. A session with no relationship to a record still learns that it exists,
+     * its stable key, and every time it changes; across entities it learns the cadence and volume
+     * of another tenant's activity.
+     *
+     * The key is kept deliberately, because consumers need it to re-read the record they were
+     * told about (see `ResolveEntityEventKey` in @memberjunction/core) and because the alternative
+     * — a coarse "something in this entity changed" — forces whole-entity invalidation on the
+     * hottest write paths. That is a trade, not an absence of cost. Narrowing it means filtering
+     * delivery per subscriber, which needs an authorization predicate cheap enough to run per
+     * subscriber per event; entity-level permissions (`EntityInfo.GetUserPermisions`, an in-memory
+     * role match) would cover part of it, row-level tenancy would not.
      */
-    cacheInvalidation(payload: CacheInvalidationPayload): CacheInvalidationNotification;
+    cacheInvalidation(// case-violation-ok-legacy-back-compat: the property name is the GraphQL schema field name — renaming it breaks every client query
+    payload: CacheInvalidationPayload): CacheInvalidationNotification;
 }
 //# sourceMappingURL=CacheInvalidationResolver.d.ts.map

package/dist/generic/CacheInvalidationResolver.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"CacheInvalidationResolver.d.ts","sourceRoot":"","sources":["../../src/generic/CacheInvalidationResolver.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,wBAAwB,uBAAuB,CAAC;AAE7D,qBACa,6BAA6B;IAEtC,UAAU,EAAG,MAAM,CAAC;IAGpB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAG1B,MAAM,EAAG,MAAM,CAAC;IAGhB,cAAc,EAAG,MAAM,CAAC;IAGxB,SAAS,EAAG,IAAI,CAAC;IAGjB,eAAe,CAAC,EAAE,MAAM,CAAC;IAGzB,UAAU,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;;GAGG;AACH,MAAM,WAAW,wBAAwB;IACrC,UAAU,EAAE,MAAM,CAAC;IACnB,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,cAAc,EAAE,MAAM,CAAC;IACvB,SAAS,EAAE,IAAI,CAAC;IAChB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,qBACa,yBAAyB;IAClC;;;;OAIG;IAIH,iBAAiB,CACL,OAAO,EAAE,wBAAwB,GAC1C,6BAA6B;CAWnC"}
+{"version":3,"file":"CacheInvalidationResolver.d.ts","sourceRoot":"","sources":["../../src/generic/CacheInvalidationResolver.ts"],"names":[],"mappings":"AAGA,eAAO,MAAM,wBAAwB,uBAAuB,CAAC;AAS7D;;;;;;;;;GASG;AACH,wBAAgB,4BAA4B,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,GAAG,IAAI,GAAG,IAAI,CASjG;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,sBAAsB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAIlE;AAED,qBACa,6BAA6B;IAEtC,UAAU,EAAG,MAAM,CAAC;IAGpB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAG1B,MAAM,EAAG,MAAM,CAAC;IAGhB,cAAc,EAAG,MAAM,CAAC;IAGxB,SAAS,EAAG,IAAI,CAAC;IAGjB,eAAe,CAAC,EAAE,MAAM,CAAC;IAGzB,UAAU,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;;GAGG;AACH,MAAM,WAAW,wBAAwB;IACrC,UAAU,EAAE,MAAM,CAAC;IACnB,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,cAAc,EAAE,MAAM,CAAC;IACvB,SAAS,EAAE,IAAI,CAAC;IAChB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,8BAA8B;IAC3C,WAAW,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;CAC1C;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE;IAC1C,OAAO,EAAE,wBAAwB,CAAC;IAClC,OAAO,EAAE,8BAA8B,GAAG,SAAS,CAAC;CACvD,GAAG,OAAO,CA2BV;AAED,uDAAuD;AACvD,wBAAgB,uBAAuB,CAAC,IAAI,EAAE;IAC1C,OAAO,EAAE,wBAAwB,CAAC;IAClC,OAAO,EAAE,8BAA8B,GAAG,SAAS,CAAC;CACvD,GAAG,OAAO,CAEV;AAED,qBACa,yBAAyB;IAClC;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IAMH,iBAAiB,CAAG,mIAAmI;IAC3I,OAAO,EAAE,wBAAwB,GAC1C,6BAA6B;CAWnC"}

package/dist/generic/CacheInvalidationResolver.js

@@ -11,7 +11,56 @@ var __param = (this && this.__param) || function (paramIndex, decorator) {
     return function (target, key) { decorator(target, key, paramIndex); }
 };
 import { Field, ObjectType, Resolver, Root, Subscription } from 'type-graphql';
+import { Metadata } from '@memberjunction/core';
 export const CACHE_INVALIDATION_TOPIC = 'CACHE_INVALIDATION';
+/**
+ * Entities whose rows may ride along with an invalidation event. Empty until the server entry point
+ * supplies the configured list, so the default — including in any process that never configures it
+ * — is to broadcast nothing.
+ */
+let allowedRecordDataEntities = [];
+/**
+ * Supply the configured allowlist. Called once from the server entry point during bootstrap.
+ *
+ * INJECTED rather than read from `configInfo` here, deliberately. `config.ts` runs `loadConfig()` at
+ * module scope, so importing it from this module would drag full config validation into every
+ * import chain that touches the resolver — including unit tests, which have no server config and
+ * would fail at import with "Configuration validation failed". This module deliberately imports
+ * nothing from MJServer itself — only type-graphql and `@memberjunction/core` (for the entity
+ * permission check in the subscription filter), neither of which loads config.
+ */
+export function ConfigureRecordDataBroadcast(entities) {
+    // Normalised HERE, once, rather than at each comparison. The wildcard used to be matched raw
+    // (`includes('*')`) while entity names were trimmed and lowercased two lines below, so a
+    // hand-edited `[' * ']` matched neither branch and silently opted nothing in — a config that
+    // looks like it disables the gate while leaving it fully on. Empty entries are dropped so a
+    // stray `''` cannot match an entity whose name is somehow blank.
+    allowedRecordDataEntities = (entities ?? [])
+        .map((e) => e.trim().toLowerCase())
+        .filter((e) => e.length > 0);
+}
+/**
+ * May the full row of `entityName` be broadcast alongside its cache-invalidation event?
+ *
+ * The subscription below is filtered only by ENTITY-level read permission, so anything included
+ * here is disclosed to every signed-in session that may read the entity at all — regardless of
+ * row-level security or any tenant scoping a consumer applies on the read path, neither of which
+ * this push traverses. The answer is therefore NO unless a deployment has explicitly opted the
+ * entity in via `cacheSettings.recordDataBroadcastEntities`.
+ *
+ * Callers that get `false` simply omit `recordData`; the event still carries the entity name and
+ * primary key, so clients evict and re-fetch through the normal access-controlled read path.
+ *
+ * Matching is exact (trimmed, case-insensitive) rather than substring: a loose match would let an
+ * allowlisted name drag in every entity whose name contains it.
+ */
+export function MayBroadcastRecordData(entityName) {
+    if (allowedRecordDataEntities.length === 0)
+        return false;
+    if (allowedRecordDataEntities.includes('*'))
+        return true;
+    return allowedRecordDataEntities.includes(entityName.trim().toLowerCase());
+}
 let CacheInvalidationNotification = class CacheInvalidationNotification {
 };
 __decorate([
@@ -46,11 +95,80 @@ CacheInvalidationNotification = __decorate([
     ObjectType()
 ], CacheInvalidationNotification);
 export { CacheInvalidationNotification };
+/**
+ * Should this subscriber hear about this event at all?
+ *
+ * Entity-level narrowing, raised in review: an event for an entity a session has no read
+ * permission on tells that session the record exists, its stable key, and when it changed — and
+ * the session could never have read it anyway, so nothing is lost by withholding it. This is a
+ * monotonic reduction in disclosure that needs no tenancy model, which is why it is here and the
+ * row-level question is not.
+ *
+ * What it does NOT close: two sessions that both hold read permission on an entity still see each
+ * other's keys, because what separates them is row-level. That predicate is tracked separately —
+ * see the class docblock below.
+ *
+ * `GetUserPermisions` is an in-memory match of the entity's permission rows against the user's
+ * roles, so this stays cheap enough to run per subscriber per event. It is not free: it runs for
+ * every connected socket on every save, so keep it free of I/O.
+ */
+export function CacheInvalidationFilter(data) {
+    const user = data.context?.userPayload?.userRecord;
+    // FAIL CLOSED on identity, matching `statusUpdatesFilter`. `onConnect` rejects a socket whose
+    // token does not validate, so a subscriber with no user record should not exist; if one does,
+    // it is the case least deserving of an unfiltered firehose.
+    if (!user) {
+        return false;
+    }
+    const entityName = data.payload?.entityName;
+    if (!entityName) {
+        return false;
+    }
+    // A pub/sub subscription filter has no per-request provider to thread: it runs on the server's
+    // own metadata, which is the one place the entity's permission rows can be answered from.
+    const entity = new Metadata().EntityByName(entityName); // global-provider-ok: subscription filter — server-wide metadata, no request-scoped provider exists here
+    // DELIVER when the entity is unknown here, deliberately — the opposite of the choice above.
+    // A name absent from metadata cannot be permission-checked, and withholding would silently
+    // stop invalidating a legitimately cacheable entity, which is a correctness bug rather than a
+    // disclosure one. All it discloses is the name and key of something this server cannot
+    // describe.
+    if (!entity) {
+        return true;
+    }
+    return entity.GetUserPermisions(user).CanRead;
+}
+/** @deprecated Use {@link CacheInvalidationFilter}. */
+export function cacheInvalidationFilter(data) {
+    return CacheInvalidationFilter(data);
+}
 let CacheInvalidationResolver = class CacheInvalidationResolver {
     /**
-     * Subscription that broadcasts cache invalidation events to ALL connected clients.
-     * No session filter — every browser connected via WebSocket receives every event.
-     * This enables cross-server cache invalidation to propagate to browser clients.
+     * Subscription that broadcasts cache invalidation events to connected clients, so cross-server
+     * cache invalidation reaches browsers.
+     *
+     * Delivery is filtered only by ENTITY-level read permission (see {@link CacheInvalidationFilter}).
+     * Every session that may read an entity at all still receives every event for it, from every
+     * other session and tenant.
+     *
+     * Because that narrowing stops well short of row level, `RecordData` is only populated for entities a
+     * deployment has opted in through `cacheSettings.recordDataBroadcastEntities` — see
+     * {@link MayBroadcastRecordData}, applied at both publish sites.
+     *
+     * `EntityName`, `PrimaryKeyValues`, `Action` and `Timestamp` ARE still broadcast to every
+     * session, and that is a disclosure, not a safe residue. An earlier version of this comment
+     * called them "safe to broadcast" on the grounds that reading the record still goes through
+     * the access-controlled path — true of the row's CONTENTS, and beside the point for the
+     * metadata itself. A session with no relationship to a record still learns that it exists,
+     * its stable key, and every time it changes; across entities it learns the cadence and volume
+     * of another tenant's activity.
+     *
+     * The key is kept deliberately, because consumers need it to re-read the record they were
+     * told about (see `ResolveEntityEventKey` in @memberjunction/core) and because the alternative
+     * — a coarse "something in this entity changed" — forces whole-entity invalidation on the
+     * hottest write paths. That is a trade, not an absence of cost. Narrowing it means filtering
+     * delivery per subscriber, which needs an authorization predicate cheap enough to run per
+     * subscriber per event; entity-level permissions (`EntityInfo.GetUserPermisions`, an in-memory
+     * role match) would cover part of it, row-level tenancy would not.
      */
     cacheInvalidation(payload) {
         return {
@@ -67,6 +185,7 @@ let CacheInvalidationResolver = class CacheInvalidationResolver {
 __decorate([
     Subscription(() => CacheInvalidationNotification, {
         topics: CACHE_INVALIDATION_TOPIC,
+        filter: (data) => CacheInvalidationFilter(data),
     }),
     __param(0, Root()),
     __metadata("design:type", Function),

package/dist/generic/CacheInvalidationResolver.js.map

@@ -1 +1 @@
-{"version":3,"file":"CacheInvalidationResolver.js","sourceRoot":"","sources":["../../src/generic/CacheInvalidationResolver.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAE/E,MAAM,CAAC,MAAM,wBAAwB,GAAG,oBAAoB,CAAC;AAGtD,IAAM,6BAA6B,GAAnC,MAAM,6BAA6B;CAqBzC,CAAA;AAnBG;IADC,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC;;iEACA;AAGpB;IADC,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;uEACd;AAG1B;IADC,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC;;6DACJ;AAGhB;IADC,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC;;qEACI;AAGxB;IADC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC;8BACN,IAAI;gEAAC;AAGjB;IADC,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;sEACf;AAGzB;IADC,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;iEACpB;AApBX,6BAA6B;IADzC,UAAU,EAAE;GACA,6BAA6B,CAqBzC;;AAiBM,IAAM,yBAAyB,GAA/B,MAAM,yBAAyB;IAClC;;;;OAIG;IAIH,iBAAiB,CACL,OAAiC;QAEzC,OAAO;YACH,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,IAAI,SAAS;YACvD,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,cAAc,EAAE,OAAO,CAAC,cAAc;YACtC,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,eAAe,EAAE,OAAO,CAAC,eAAe,IAAI,SAAS;YACrD,UAAU,EAAE,OAAO,CAAC,UAAU,IAAI,SAAS;SAC9C,CAAC;IACN,CAAC;CACJ,CAAA;AAbG;IAHC,YAAY,CAAC,GAAG,EAAE,CAAC,6BAA6B,EAAE;QAC/C,MAAM,EAAE,wBAAwB;KACnC,CAAC;IAEG,WAAA,IAAI,EAAE,CAAA;;;oCACR,6BAA6B;kEAU/B;AArBQ,yBAAyB;IADrC,QAAQ,EAAE;GACE,yBAAyB,CAsBrC"}
+{"version":3,"file":"CacheInvalidationResolver.js","sourceRoot":"","sources":["../../src/generic/CacheInvalidationResolver.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC/E,OAAO,EAAE,QAAQ,EAAY,MAAM,sBAAsB,CAAC;AAE1D,MAAM,CAAC,MAAM,wBAAwB,GAAG,oBAAoB,CAAC;AAE7D;;;;GAIG;AACH,IAAI,yBAAyB,GAAsB,EAAE,CAAC;AAEtD;;;;;;;;;GASG;AACH,MAAM,UAAU,4BAA4B,CAAC,QAA8C;IACzF,6FAA6F;IAC7F,yFAAyF;IACzF,6FAA6F;IAC7F,4FAA4F;IAC5F,iEAAiE;IACjE,yBAAyB,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC;SACzC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;SAClC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AACjC,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,sBAAsB,CAAC,UAAkB;IACvD,IAAI,yBAAyB,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACzD,IAAI,yBAAyB,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACzD,OAAO,yBAAyB,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;AAC7E,CAAC;AAGM,IAAM,6BAA6B,GAAnC,MAAM,6BAA6B;CAqBzC,CAAA;AAnBG;IADC,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC;;iEACA;AAGpB;IADC,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;uEACd;AAG1B;IADC,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC;;6DACJ;AAGhB;IADC,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC;;qEACI;AAGxB;IADC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC;8BACN,IAAI;gEAAC;AAGjB;IADC,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;sEACf;AAGzB;IADC,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;iEACpB;AApBX,6BAA6B;IADzC,UAAU,EAAE;GACA,6BAA6B,CAqBzC;;AA4BD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,uBAAuB,CAAC,IAGvC;IACG,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,EAAE,WAAW,EAAE,UAAkC,CAAC;IAC3E,8FAA8F;IAC9F,8FAA8F;IAC9F,4DAA4D;IAC5D,IAAI,CAAC,IAAI,EAAE,CAAC;QACR,OAAO,KAAK,CAAC;IACjB,CAAC;IAED,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,EAAE,UAAU,CAAC;IAC5C,IAAI,CAAC,UAAU,EAAE,CAAC;QACd,OAAO,KAAK,CAAC;IACjB,CAAC;IAED,+FAA+F;IAC/F,0FAA0F;IAC1F,MAAM,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC,CAAC,yGAAyG;IACjK,4FAA4F;IAC5F,2FAA2F;IAC3F,8FAA8F;IAC9F,uFAAuF;IACvF,YAAY;IACZ,IAAI,CAAC,MAAM,EAAE,CAAC;QACV,OAAO,IAAI,CAAC;IAChB,CAAC;IAED,OAAO,MAAM,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC;AAClD,CAAC;AAED,uDAAuD;AACvD,MAAM,UAAU,uBAAuB,CAAC,IAGvC;IACC,OAAO,uBAAuB,CAAC,IAAI,CAAC,CAAC;AACvC,CAAC;AAGM,IAAM,yBAAyB,GAA/B,MAAM,yBAAyB;IAClC;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IAMH,iBAAiB,CACL,OAAiC;QAEzC,OAAO;YACH,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,IAAI,SAAS;YACvD,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,cAAc,EAAE,OAAO,CAAC,cAAc;YACtC,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,eAAe,EAAE,OAAO,CAAC,eAAe,IAAI,SAAS;YACrD,UAAU,EAAE,OAAO,CAAC,UAAU,IAAI,SAAS;SAC9C,CAAC;IACN,CAAC;CACJ,CAAA;AAbG;IALC,YAAY,CAAC,GAAG,EAAE,CAAC,6BAA6B,EAAE;QAC/C,MAAM,EAAE,wBAAwB;QAChC,MAAM,EAAE,CAAC,IAAgG,EAAE,EAAE,CACzG,uBAAuB,CAAC,IAAI,CAAC;KACpC,CAAC;IAEG,WAAA,IAAI,EAAE,CAAA;;;oCACR,6BAA6B;kEAU/B;AA9CQ,yBAAyB;IADrC,QAAQ,EAAE;GACE,yBAAyB,CA+CrC"}

package/dist/generic/DeleteOptionsInput.d.ts

@@ -38,8 +38,15 @@ export declare class DeleteOptionsInput {
      * schema-sync gate requires `DeleteOptionsInput` to carry every `EntityDeleteOptions` field;
      * {@link DeleteOptionsInput.SanitizeFromWire} forces it back to false on every request. See
      * that method for why.
+     *
+     * **Optional on the wire, on purpose.** This field did not exist in 5.51.x, and every other
+     * field here is required, so making it required too turned a 6.1 upgrade into a hard failure
+     * for every client that spells out `options___` on a delete (`Field
+     * "DeleteOptionsInput.SkipRecordChanges" of required type "Boolean!" was not provided`). A
+     * 5.51 client that omits it and a 6.1 client that sends `false` mean the same thing, and the
+     * server forces it to `false` regardless, so `null`/absent defaults to `false` here.
      */
-    SkipRecordChanges: boolean;
+    SkipRecordChanges?: boolean;
     /**
      * Strips wire-unreachable capabilities from client-supplied delete options.
      *

package/dist/generic/DeleteOptionsInput.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"DeleteOptionsInput.d.ts","sourceRoot":"","sources":["../../src/generic/DeleteOptionsInput.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;;GAaG;AACH,qBACa,kBAAkB;IAE3B,mBAAmB,EAAE,OAAO,CAAC;IAG7B,iBAAiB,EAAE,OAAO,CAAC;IAE3B;;;;OAIG;IAEH,UAAU,EAAE,OAAO,CAAC;IAEpB;;;;OAIG;IAEH,oBAAoB,EAAE,OAAO,CAAC;IAE9B;;;;;;;;;;;OAWG;IAEH,iBAAiB,EAAE,OAAO,CAAC;IAE3B;;;;;;;;;;;;;;;;;;;;;;OAsBG;WACW,gBAAgB,CAAC,OAAO,EAAE,kBAAkB,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,kBAAkB;CAU1H"}
+{"version":3,"file":"DeleteOptionsInput.d.ts","sourceRoot":"","sources":["../../src/generic/DeleteOptionsInput.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;;GAaG;AACH,qBACa,kBAAkB;IAE3B,mBAAmB,EAAE,OAAO,CAAC;IAG7B,iBAAiB,EAAE,OAAO,CAAC;IAE3B;;;;OAIG;IAEH,UAAU,EAAE,OAAO,CAAC;IAEpB;;;;OAIG;IAEH,oBAAoB,EAAE,OAAO,CAAC;IAE9B;;;;;;;;;;;;;;;;;;OAkBG;IAEH,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAE5B;;;;;;;;;;;;;;;;;;;;;;OAsBG;WACW,gBAAgB,CAAC,OAAO,EAAE,kBAAkB,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,kBAAkB;CAU1H"}

package/dist/generic/DeleteOptionsInput.js

@@ -73,7 +73,7 @@ __decorate([
     __metadata("design:type", Boolean)
 ], DeleteOptionsInput.prototype, "IsParentEntityDelete", void 0);
 __decorate([
-    Field(() => Boolean),
+    Field(() => Boolean, { nullable: true, defaultValue: false }),
     __metadata("design:type", Boolean)
 ], DeleteOptionsInput.prototype, "SkipRecordChanges", void 0);
 DeleteOptionsInput = __decorate([

package/dist/generic/DeleteOptionsInput.js.map

@@ -1 +1 @@
-{"version":3,"file":"DeleteOptionsInput.js","sourceRoot":"","sources":["../../src/generic/DeleteOptionsInput.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAEhD;;;;;;;;;;;;;GAaG;AAEI,IAAM,kBAAkB,GAAxB,MAAM,kBAAkB;IAsC3B;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACI,MAAM,CAAC,gBAAgB,CAAC,OAA2B,EAAE,UAAkB,EAAE,SAAkB;QAC9F,IAAI,CAAC,OAAO,EAAE,iBAAiB,EAAE,CAAC;YAC9B,OAAO,OAAO,CAAC;QACnB,CAAC;QACD,QAAQ,CACJ,mCAAmC,UAAU,wBAAwB,SAAS,IAAI,wBAAwB,IAAI;YAC9G,mEAAmE,CACtE,CAAC;QACF,OAAO,EAAE,GAAG,OAAO,EAAE,iBAAiB,EAAE,KAAK,EAAE,CAAC;IACpD,CAAC;CACJ,CAAA;AArEG;IADC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC;;+DACQ;AAG7B;IADC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC;;6DACM;AAQ3B;IADC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC;;sDACD;AAQpB;IADC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC;;gEACS;AAe9B;IADC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC;;6DACM;AApClB,kBAAkB;IAD9B,SAAS,EAAE;GACC,kBAAkB,CAuE9B"}
+{"version":3,"file":"DeleteOptionsInput.js","sourceRoot":"","sources":["../../src/generic/DeleteOptionsInput.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAEhD;;;;;;;;;;;;;GAaG;AAEI,IAAM,kBAAkB,GAAxB,MAAM,kBAAkB;IA6C3B;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACI,MAAM,CAAC,gBAAgB,CAAC,OAA2B,EAAE,UAAkB,EAAE,SAAkB;QAC9F,IAAI,CAAC,OAAO,EAAE,iBAAiB,EAAE,CAAC;YAC9B,OAAO,OAAO,CAAC;QACnB,CAAC;QACD,QAAQ,CACJ,mCAAmC,UAAU,wBAAwB,SAAS,IAAI,wBAAwB,IAAI;YAC9G,mEAAmE,CACtE,CAAC;QACF,OAAO,EAAE,GAAG,OAAO,EAAE,iBAAiB,EAAE,KAAK,EAAE,CAAC;IACpD,CAAC;CACJ,CAAA;AA5EG;IADC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC;;+DACQ;AAG7B;IADC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC;;6DACM;AAQ3B;IADC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC;;sDACD;AAQpB;IADC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC;;gEACS;AAsB9B;IADC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC;;6DAClC;AA3CnB,kBAAkB;IAD9B,SAAS,EAAE;GACC,kBAAkB,CA8E9B"}

package/dist/generic/FireAndForgetHeartbeat.d.ts

@@ -1,5 +1,19 @@
 import { PubSubEngine } from 'type-graphql';
-/** Default cadence for fire-and-forget liveness pulses (5 minutes). */
+/**
+ * Default cadence for fire-and-forget liveness pulses (60 seconds).
+ *
+ * MATCHED PAIR — do not change alone. The client's inactivity window
+ * (`DEFAULT_IDLE_TIMEOUT_MS` in GraphQLDataProvider's fireAndForgetHelper) is sized at roughly
+ * 3x this value, so a healthy run always refreshes the timer well before it expires. Lengthening
+ * this without lengthening that window makes every quiet stretch of a long agent run look like a
+ * stall and trips reconciliation; shortening the window without shortening this does the same.
+ *
+ * WAS 5 MINUTES (MJ #4222). Paired with the old 12-minute window, a client whose transport had
+ * silently died waited 12 minutes to notice — on runs that typically finish in 20 seconds. The
+ * pulse is a few dozen bytes and exists only while an operation is actually running, so the
+ * added traffic is negligible: a 40-minute run now sends ~40 pulses instead of ~8, and the
+ * 20-second run that motivated the change still sends none.
+ */
 export declare const DEFAULT_PULSE_INTERVAL_MS: number;
 /** The `type` discriminator carried by liveness pulse messages. */
 export declare const HEARTBEAT_MESSAGE_TYPE = "Heartbeat";
@@ -18,7 +32,7 @@ export interface PulseStatus {
 }
 /** Handle returned by {@link startLivenessPulse}; call `stop()` when the work settles. */
 export interface LivenessPulseHandle {
-    stop(): void;
+    Stop(): void;
 }
 export interface LivenessPulseOptions {
     /** PubSub engine used to publish on the shared push-status topic. */
@@ -52,5 +66,7 @@ export interface LivenessPulseOptions {
  * (`{ message: JSON.stringify({ resolver, type, status, data }), sessionId }`),
  * so the client receives it through the same subscription with no special parsing.
  */
+export declare function StartLivenessPulse(options: LivenessPulseOptions): LivenessPulseHandle;
+/** @deprecated Use {@link StartLivenessPulse}. */
 export declare function startLivenessPulse(options: LivenessPulseOptions): LivenessPulseHandle;
 //# sourceMappingURL=FireAndForgetHeartbeat.d.ts.map

package/dist/generic/FireAndForgetHeartbeat.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"FireAndForgetHeartbeat.d.ts","sourceRoot":"","sources":["../../src/generic/FireAndForgetHeartbeat.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAI5C,uEAAuE;AACvE,eAAO,MAAM,yBAAyB,QAAgB,CAAC;AAEvD,mEAAmE;AACnE,eAAO,MAAM,sBAAsB,cAAc,CAAC;AAElD;;;;GAIG;AACH,MAAM,WAAW,WAAW;IACxB,mFAAmF;IACnF,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,0CAA0C;IAC1C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,2DAA2D;IAC3D,WAAW,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,0FAA0F;AAC1F,MAAM,WAAW,mBAAmB;IAChC,IAAI,IAAI,IAAI,CAAC;CAChB;AAED,MAAM,WAAW,oBAAoB;IACjC,qEAAqE;IACrE,MAAM,EAAE,YAAY,CAAC;IACrB,6EAA6E;IAC7E,SAAS,EAAE,MAAM,CAAC;IAClB;;;OAGG;IACH,WAAW,EAAE,MAAM,CAAC;IACpB,iFAAiF;IACjF,QAAQ,EAAE,MAAM,CAAC;IACjB,0EAA0E;IAC1E,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,WAAW,GAAG,SAAS,CAAC;CAC9C;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,oBAAoB,GAAG,mBAAmB,CA4BrF"}
+{"version":3,"file":"FireAndForgetHeartbeat.d.ts","sourceRoot":"","sources":["../../src/generic/FireAndForgetHeartbeat.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAI5C;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,yBAAyB,QAAY,CAAC;AAEnD,mEAAmE;AACnE,eAAO,MAAM,sBAAsB,cAAc,CAAC;AAElD;;;;GAIG;AACH,MAAM,WAAW,WAAW;IACxB,mFAAmF;IACnF,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,0CAA0C;IAC1C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,2DAA2D;IAC3D,WAAW,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,0FAA0F;AAC1F,MAAM,WAAW,mBAAmB;IAChC,IAAI,IAAI,IAAI,CAAC;CAChB;AAED,MAAM,WAAW,oBAAoB;IACjC,qEAAqE;IACrE,MAAM,EAAE,YAAY,CAAC;IACrB,6EAA6E;IAC7E,SAAS,EAAE,MAAM,CAAC;IAClB;;;OAGG;IACH,WAAW,EAAE,MAAM,CAAC;IACpB,iFAAiF;IACjF,QAAQ,EAAE,MAAM,CAAC;IACjB,0EAA0E;IAC1E,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,WAAW,GAAG,SAAS,CAAC;CAC9C;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,oBAAoB,GAAG,mBAAmB,CA4BrF;AAED,kDAAkD;AAClD,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,oBAAoB,GAAG,mBAAmB,CAErF"}

package/dist/generic/FireAndForgetHeartbeat.js

@@ -1,7 +1,21 @@
 import { LogError } from '@memberjunction/core';
-import { publishStatusUpdate } from './PushStatusResolver.js';
-/** Default cadence for fire-and-forget liveness pulses (5 minutes). */
-export const DEFAULT_PULSE_INTERVAL_MS = 5 * 60 * 1000;
+import { PublishStatusUpdate } from './PushStatusResolver.js';
+/**
+ * Default cadence for fire-and-forget liveness pulses (60 seconds).
+ *
+ * MATCHED PAIR — do not change alone. The client's inactivity window
+ * (`DEFAULT_IDLE_TIMEOUT_MS` in GraphQLDataProvider's fireAndForgetHelper) is sized at roughly
+ * 3x this value, so a healthy run always refreshes the timer well before it expires. Lengthening
+ * this without lengthening that window makes every quiet stretch of a long agent run look like a
+ * stall and trips reconciliation; shortening the window without shortening this does the same.
+ *
+ * WAS 5 MINUTES (MJ #4222). Paired with the old 12-minute window, a client whose transport had
+ * silently died waited 12 minutes to notice — on runs that typically finish in 20 seconds. The
+ * pulse is a few dozen bytes and exists only while an operation is actually running, so the
+ * added traffic is negligible: a 40-minute run now sends ~40 pulses instead of ~8, and the
+ * 20-second run that motivated the change still sends none.
+ */
+export const DEFAULT_PULSE_INTERVAL_MS = 60 * 1000;
 /** The `type` discriminator carried by liveness pulse messages. */
 export const HEARTBEAT_MESSAGE_TYPE = 'Heartbeat';
 /**
@@ -15,7 +29,7 @@ export const HEARTBEAT_MESSAGE_TYPE = 'Heartbeat';
  * (`{ message: JSON.stringify({ resolver, type, status, data }), sessionId }`),
  * so the client receives it through the same subscription with no special parsing.
  */
-export function startLivenessPulse(options) {
+export function StartLivenessPulse(options) {
     const { pubSub, sessionId, ownerUserId, resolver, readStatus } = options;
     const intervalMs = options.intervalMs ?? DEFAULT_PULSE_INTERVAL_MS;
     const timer = setInterval(() => {
@@ -27,7 +41,7 @@ export function startLivenessPulse(options) {
             // A status read failure must not break the liveness loop.
             LogError(`[LivenessPulse:${resolver}] readStatus failed: ${e.message}`);
         }
-        publishStatusUpdate(pubSub, {
+        PublishStatusUpdate(pubSub, {
             sessionId,
             ownerUserId,
             message: JSON.stringify({
@@ -39,7 +53,11 @@ export function startLivenessPulse(options) {
         });
     }, intervalMs);
     return {
-        stop: () => clearInterval(timer),
+        Stop: () => clearInterval(timer),
     };
 }
+/** @deprecated Use {@link StartLivenessPulse}. */
+export function startLivenessPulse(options) {
+    return StartLivenessPulse(options);
+}
 //# sourceMappingURL=FireAndForgetHeartbeat.js.map

package/dist/generic/FireAndForgetHeartbeat.js.map

@@ -1 +1 @@
-{"version":3,"file":"FireAndForgetHeartbeat.js","sourceRoot":"","sources":["../../src/generic/FireAndForgetHeartbeat.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAChD,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAE9D,uEAAuE;AACvE,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAEvD,mEAAmE;AACnE,MAAM,CAAC,MAAM,sBAAsB,GAAG,WAAW,CAAC;AA2ClD;;;;;;;;;;GAUG;AACH,MAAM,UAAU,kBAAkB,CAAC,OAA6B;IAC5D,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,OAAO,CAAC;IACzE,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,yBAAyB,CAAC;IAEnE,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE;QAC3B,IAAI,IAA6B,CAAC;QAClC,IAAI,CAAC;YACD,IAAI,GAAG,UAAU,EAAE,EAAE,CAAC;QAC1B,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACT,0DAA0D;YAC1D,QAAQ,CAAC,kBAAkB,QAAQ,wBAAyB,CAAW,CAAC,OAAO,EAAE,CAAC,CAAC;QACvF,CAAC;QAED,mBAAmB,CAAC,MAAM,EAAE;YACxB,SAAS;YACT,WAAW;YACX,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC;gBACpB,QAAQ;gBACR,IAAI,EAAE,sBAAsB;gBAC5B,MAAM,EAAE,IAAI;gBACZ,IAAI,EAAE,IAAI,IAAI,EAAE;aACnB,CAAC;SACL,CAAC,CAAC;IACP,CAAC,EAAE,UAAU,CAAC,CAAC;IAEf,OAAO;QACH,IAAI,EAAE,GAAG,EAAE,CAAC,aAAa,CAAC,KAAK,CAAC;KACnC,CAAC;AACN,CAAC"}
+{"version":3,"file":"FireAndForgetHeartbeat.js","sourceRoot":"","sources":["../../src/generic/FireAndForgetHeartbeat.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAChD,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAE9D;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,EAAE,GAAG,IAAI,CAAC;AAEnD,mEAAmE;AACnE,MAAM,CAAC,MAAM,sBAAsB,GAAG,WAAW,CAAC;AA2ClD;;;;;;;;;;GAUG;AACH,MAAM,UAAU,kBAAkB,CAAC,OAA6B;IAC5D,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,OAAO,CAAC;IACzE,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,yBAAyB,CAAC;IAEnE,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE;QAC3B,IAAI,IAA6B,CAAC;QAClC,IAAI,CAAC;YACD,IAAI,GAAG,UAAU,EAAE,EAAE,CAAC;QAC1B,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACT,0DAA0D;YAC1D,QAAQ,CAAC,kBAAkB,QAAQ,wBAAyB,CAAW,CAAC,OAAO,EAAE,CAAC,CAAC;QACvF,CAAC;QAED,mBAAmB,CAAC,MAAM,EAAE;YACxB,SAAS;YACT,WAAW;YACX,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC;gBACpB,QAAQ;gBACR,IAAI,EAAE,sBAAsB;gBAC5B,MAAM,EAAE,IAAI;gBACZ,IAAI,EAAE,IAAI,IAAI,EAAE;aACnB,CAAC;SACL,CAAC,CAAC;IACP,CAAC,EAAE,UAAU,CAAC,CAAC;IAEf,OAAO;QACH,IAAI,EAAE,GAAG,EAAE,CAAC,aAAa,CAAC,KAAK,CAAC;KACnC,CAAC;AACN,CAAC;AAED,kDAAkD;AAClD,MAAM,UAAU,kBAAkB,CAAC,OAA6B;IAC5D,OAAO,kBAAkB,CAAC,OAAO,CAAC,CAAC;AACvC,CAAC"}

package/dist/generic/OrphanedConversationDetailReconciler.d.ts

@@ -0,0 +1,31 @@
+import type { IMetadataProvider, UserInfo } from '@memberjunction/core';
+/**
+ * Grace period after a run reaches a terminal state before its conversation detail is considered
+ * abandoned. The normal path closes the detail moments after the run finishes; this waits well past
+ * that so a reconcile can never race a completion that is already on its way.
+ */
+export declare const ORPHAN_DETAIL_GRACE_MS: number;
+/**
+ * Close conversation details left `In-Progress` by a run that is already over (MJ #4222).
+ *
+ * WHY THIS EXISTS. `AgentRunner` closes the detail as the final step of a run, so a process that
+ * dies mid-run never reaches it. The agent-run watchdog repairs the RUN — force-failing it once the
+ * heartbeat goes stale — but nothing repairs the detail, and the detail is the row the chat renders
+ * from. The result is durable state that disagrees with itself: a terminal run beside a message
+ * that still says it is being generated, spinning forever for anyone who opens it.
+ *
+ * WHY NOT IN THE SWEEP PROC. `spSweepStaleAIAgentRuns` is a single set-based UPDATE, and extending
+ * it to the detail would be the obvious fix. It would also be the wrong one: `MJ: Conversation
+ * Details` declares `TrustServerCacheCompletely`, so the server's RunView cache relies on
+ * `BaseEntity` events for invalidation and a stored procedure fires none. The row would change
+ * while every instance kept serving `In-Progress` from cache — a worse failure than the one being
+ * fixed, because reconciliation itself would read the stale value back. Going through
+ * `BaseEntity.Save()` costs a per-row write and buys correct invalidation everywhere.
+ *
+ * Idempotent and safe to run concurrently on several instances: the write is a no-op once the
+ * status is terminal, and each pass re-reads state before deciding.
+ *
+ * @returns How many details were closed.
+ */
+export declare function ReconcileOrphanedConversationDetails(provider: IMetadataProvider, contextUser: UserInfo, graceMs?: number): Promise<number>;
+//# sourceMappingURL=OrphanedConversationDetailReconciler.d.ts.map

package/dist/generic/OrphanedConversationDetailReconciler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"OrphanedConversationDetailReconciler.d.ts","sourceRoot":"","sources":["../../src/generic/OrphanedConversationDetailReconciler.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,iBAAiB,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAGxE;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,QAAgB,CAAC;AAiBpD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAsB,oCAAoC,CACtD,QAAQ,EAAE,iBAAiB,EAC3B,WAAW,EAAE,QAAQ,EACrB,OAAO,GAAE,MAA+B,GACzC,OAAO,CAAC,MAAM,CAAC,CAkGjB"}