@memberjunction/server 6.2.0-edge.0 → 6.2.0-edge.2

package/src/__tests__/TaskGraphActionRunner.durablePayload.test.ts

@@ -0,0 +1,131 @@
+/**
+ * End-to-end-in-miniature regression test for #4794.
+ *
+ * The bug: `BuildDurableDeferral` persisted a durable entity action's redacted params as a
+ * `LoggedParam[]` ARRAY (`RedactParamsToJSON`'s shape), while `TaskGraphActionRunner.buildParams`
+ * reads `Task.InputPayload` back as a name→value RECORD. Every released build with durable dispatch
+ * (v6.1.0 onward, including 6.1.4) hit the same real-world failure: `TaskGraphDispatcher`'s
+ * `mergedPayload` only merges plain objects, so it silently dropped the array before `buildParams`
+ * ever saw it, and the action ran with NONE of its declared inputs. `buildParams` itself has no such
+ * guard — `Object.assign(merged, arrayValue)` treats an array's indices as keys — so params named
+ * `'0'`, `'1'`, ... would only appear if the array reached it directly, bypassing the dispatcher's
+ * drop. That narrower path is exactly what this test exercises, by calling `RunActionForTask`
+ * on its own rather than through the dispatcher.
+ *
+ * This test proves the whole pipe, not just the writer or the reader in isolation: build the
+ * payload exactly as the deferral does (`RedactParamsToRecord`), push it through the same
+ * `JSON.stringify` / `JSON.parse` round trip `TaskGraphService` performs to persist and reload
+ * `Task.InputPayload`, then run it through the real `TaskGraphActionRunner` and assert the action
+ * receives its declared parameters BY NAME.
+ */
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+
+vi.mock('@memberjunction/actions', () => ({
+    ActionEngineServer: {
+        Instance: {
+            Config: vi.fn(),
+            Actions: [{ ID: 'A1', Name: 'Log Activity' }],
+            RunAction: vi.fn(),
+        },
+    },
+}));
+
+import { ActionEngineServer } from '@memberjunction/actions';
+import { RedactParamsToRecord, ActionParam } from '@memberjunction/actions-base';
+import type { MJActionExecutionLogEntity, MJActionParamEntity, MJEntityActionParamEntity } from '@memberjunction/core-entities';
+import type { IMetadataProvider, UserInfo } from '@memberjunction/core';
+import type { TaskActionRunParams } from '@memberjunction/task-graph';
+import { TaskGraphActionRunner } from '../services/TaskGraphActionRunner';
+
+// ── Test fixture builders — same shape as packages/Actions/Base/src/__tests__/ParamRedaction.test.ts ──
+
+function actionParam(name: string, value: unknown): ActionParam {
+    return { Name: name, Value: value, Type: 'Input' } as ActionParam;
+}
+
+function definition(id: string, name: string, logValue: boolean = true): MJActionParamEntity {
+    return { ID: id, Name: name, LogValue: logValue } as MJActionParamEntity;
+}
+
+function binding(actionParamID: string, valueType: string, logValue: boolean | null = null): MJEntityActionParamEntity {
+    return { ActionParamID: actionParamID, ValueType: valueType, LogValue: logValue } as MJEntityActionParamEntity;
+}
+
+// The declared parameters for the durable entity action under test: three that log normally, and
+// one ("InternalNotes") whose binding opts out of logging (rule 2 in ParamRedaction.ts).
+const RUNTIME_PARAMS: ActionParam[] = [
+    actionParam('TypeCode', 'SystemEvent'),
+    actionParam('Title', 'Person created'),
+    actionParam('RecordID', 'REC-123'),
+    actionParam('InternalNotes', 'do not persist this'),
+];
+const ACTION_PARAMS: MJActionParamEntity[] = [
+    definition('p1', 'TypeCode'),
+    definition('p2', 'Title'),
+    definition('p3', 'RecordID'),
+    definition('p4', 'InternalNotes'),
+];
+const ENTITY_ACTION_PARAMS: MJEntityActionParamEntity[] = [binding('p4', 'Static', false)];
+
+function baseRunParams(inputPayload: unknown): TaskActionRunParams {
+    return {
+        TaskID: 'T1',
+        ActionID: 'A1',
+        InputPayload: inputPayload,
+        DependencyOutputs: new Map(),
+        Provider: {} as IMetadataProvider,
+        ContextUser: {} as UserInfo,
+    };
+}
+
+describe('TaskGraphActionRunner — durable payload round-trips by param name (#4794)', () => {
+    beforeEach(() => {
+        // vitest's `restoreMocks: true` clears mock implementations before every test, including
+        // the ones assigned inside the `vi.mock` factory above — so the return value is (re)armed here.
+        // Call history on a vi.fn created inside vi.mock survives that restore, so clear it too.
+        vi.mocked(ActionEngineServer.Instance.Config).mockResolvedValue(undefined);
+        vi.mocked(ActionEngineServer.Instance.RunAction, { partial: true }).mockClear();
+        vi.mocked(ActionEngineServer.Instance.RunAction, { partial: true }).mockResolvedValue({
+            Success: true,
+            Params: [],
+            LogEntry: { ID: 'L1' } as MJActionExecutionLogEntity,
+        });
+    });
+
+    it('delivers RedactParamsToRecord\'s output to the action by name, after a JSON round trip', async () => {
+        // Exactly what the deferral writes, then exactly what TaskGraphService's JSON column does to it.
+        const stored = JSON.parse(JSON.stringify(RedactParamsToRecord(RUNTIME_PARAMS, ACTION_PARAMS, ENTITY_ACTION_PARAMS)));
+
+        const result = await new TaskGraphActionRunner().RunActionForTask(baseRunParams(stored));
+
+        expect(result.Success).toBe(true);
+        expect(result.ActionLogID).toBe('L1');
+
+        const runActionCall = vi.mocked(ActionEngineServer.Instance.RunAction).mock.calls[0][0];
+        const sentParams = runActionCall.Params as ActionParam[];
+
+        // The three logged declared names arrive, order-insensitive, with their values intact.
+        expect(sentParams.map((p) => p.Name).sort()).toEqual(['RecordID', 'Title', 'TypeCode']);
+        expect(sentParams.find((p) => p.Name === 'TypeCode')?.Value).toBe('SystemEvent');
+        expect(sentParams.find((p) => p.Name === 'Title')?.Value).toBe('Person created');
+        expect(sentParams.find((p) => p.Name === 'RecordID')?.Value).toBe('REC-123');
+
+        // The binding-suppressed parameter never reaches the action — absent, not present-with-undefined.
+        expect(sentParams.some((p) => p.Name === 'InternalNotes')).toBe(false);
+    });
+
+    it('does not turn dependency outputs into params named by the upstream task ID', async () => {
+        // The dispatcher keys DependencyOutputs by the upstream task's ID and has ALREADY merged their
+        // values into InputPayload (TaskGraphDispatcher.mergedPayload). A runner that also spread the
+        // map handed the action one extra param per dependency, named by a GUID and holding that
+        // task's whole output — which then landed, unredacted, in ActionExecutionLog.Params.
+        const upstreamID = '20924BD7-5128-4150-8404-FB44A55AEA0F';
+        const params = baseRunParams({ EntityName: 'MJ: Entities', Record: { ID: 'R1', Name: 'MJ: Tags' } });
+        params.DependencyOutputs = new Map([[upstreamID, { Record: { ID: 'R1', Name: 'MJ: Tags' } }]]);
+
+        await new TaskGraphActionRunner().RunActionForTask(params);
+
+        const sentParams = vi.mocked(ActionEngineServer.Instance.RunAction).mock.calls[0][0].Params as ActionParam[];
+        expect(sentParams.map((p) => p.Name).sort()).toEqual(['EntityName', 'Record']);
+    });
+});

package/src/__tests__/TaskGraphFrameResolver.test.ts

@@ -19,7 +19,7 @@ vi.mock('@memberjunction/core', () => ({ LogError: vi.fn() }));
 import {
     TASK_GRAPH_FRAMES_TOPIC,
     TaskGraphFrameBroadcaster,
-    taskGraphFrameFilter,
+    TaskGraphFrameFilter,
     type TaskGraphFramePayload,
 } from '../resolvers/TaskGraphFrameResolver';
 import type { TaskGraphFrame } from '@memberjunction/task-graph';
@@ -44,7 +44,7 @@ const payload = (over: Partial<TaskGraphFramePayload> = {}): TaskGraphFramePaylo
 const context = (userId: string | null) => (userId ? { userPayload: { userRecord: { ID: userId } } } : {});
 
 const check = (over: Partial<TaskGraphFramePayload> = {}, args = GRAPH, userId: string | null = OWNER) =>
-    taskGraphFrameFilter({ payload: payload(over), args: { parentTaskId: args }, context: context(userId) });
+    TaskGraphFrameFilter({ payload: payload(over), args: { parentTaskId: args }, context: context(userId) });
 
 describe('taskGraphFrameFilter — the delivery gate', () => {
     it('delivers a frame for the watched graph to its owner', () => {

package/src/__tests__/VectorizeEntityResolver.test.ts

@@ -0,0 +1,106 @@
+import 'reflect-metadata';
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+import { DatabaseProviderBase, UserInfo, type IMetadataProvider } from '@memberjunction/core';
+import sql from 'mssql';
+import { VectorizeEntityResolver } from '../resolvers/VectorizeEntityResolver.js';
+import type { AppContext, ProviderInfo } from '../types.js';
+
+const mockSyncerConstructedWith: (IMetadataProvider | undefined)[] = [];
+
+vi.mock('@memberjunction/ai-vector-sync', () => {
+    return {
+        EntityVectorSyncer: class {
+            constructor(provider?: IMetadataProvider) {
+                mockSyncerConstructedWith.push(provider);
+            }
+            Config() {
+                return Promise.resolve(undefined);
+            }
+            VectorizeEntity() {
+                return Promise.resolve({ success: true, status: 'Completed' });
+            }
+        },
+    };
+});
+
+vi.mock('../generic/PubSubManager.js', () => ({
+    PubSubManager: {
+        Instance: {
+            Publish: vi.fn(),
+        },
+    },
+}));
+
+function createAppContext(providers?: ProviderInfo[]): AppContext {
+    return {
+        dataSource: Object.create(sql.ConnectionPool.prototype) as sql.ConnectionPool,
+        dataSources: [],
+        providers: providers ?? [],
+        userPayload: {
+            email: 'test@example.com',
+            sessionId: 'test-session',
+            userRecord: new UserInfo(),
+        },
+    };
+}
+
+describe('VectorizeEntityResolver — provider propagation', () => {
+    beforeEach(() => {
+        mockSyncerConstructedWith.length = 0;
+    });
+
+    it('passes request-scoped Read-Write provider from AppContext to EntityVectorSyncer', async () => {
+        const mockProvider = Object.create(DatabaseProviderBase.prototype) as DatabaseProviderBase;
+        const providerInfo: ProviderInfo = {
+            provider: mockProvider,
+            type: 'Read-Write',
+        };
+
+        const resolver = new VectorizeEntityResolver();
+        const result = await resolver.VectorizeEntity(
+            'doc-1',
+            'entity-1',
+            10,
+            createAppContext([providerInfo])
+        );
+
+        expect(result.Success).toBe(true);
+        expect(result.Status).toBe('Started');
+        expect(mockSyncerConstructedWith.length).toBe(1);
+        expect(mockSyncerConstructedWith[0]).toBe(mockProvider);
+    });
+
+    it('falls back to Read-Only provider when no Read-Write provider exists', async () => {
+        const readOnlyProvider = Object.create(DatabaseProviderBase.prototype) as DatabaseProviderBase;
+        const providerInfo: ProviderInfo = {
+            provider: readOnlyProvider,
+            type: 'Read-Only',
+        };
+
+        const resolver = new VectorizeEntityResolver();
+        const result = await resolver.VectorizeEntity(
+            'doc-2',
+            'entity-2',
+            10,
+            createAppContext([providerInfo])
+        );
+
+        expect(result.Success).toBe(true);
+        expect(mockSyncerConstructedWith.length).toBe(1);
+        expect(mockSyncerConstructedWith[0]).toBe(readOnlyProvider);
+    });
+
+    it('passes undefined provider to EntityVectorSyncer when no providers in AppContext', async () => {
+        const resolver = new VectorizeEntityResolver();
+        const result = await resolver.VectorizeEntity(
+            'doc-3',
+            'entity-3',
+            10,
+            createAppContext([])
+        );
+
+        expect(result.Success).toBe(true);
+        expect(mockSyncerConstructedWith.length).toBe(1);
+        expect(mockSyncerConstructedWith[0]).toBeUndefined();
+    });
+});

package/src/__tests__/WidgetSessionService.test.ts

@@ -21,12 +21,16 @@ vi.mock('../auth/magicLink/MagicLinkService.js', () => ({
   MagicLinkService: class {},
 }));
 vi.mock('../agentSessions/ReturningVisitorRecap.js', () => ({
-  writeReturningVisitorRecap: async () => undefined,
+  WriteReturningVisitorRecap: async () => undefined,
+    get writeReturningVisitorRecap() { return this.WriteReturningVisitorRecap; },
 }));
 vi.mock('../realtimeWidget/visitorIdentity.js', () => ({
-  resolveIdentityByEmail: async () => null,
-  mergeVisitorIdentity: async () => 0,
-  forgetVisitor: async () => ({ notesArchived: 0, conversationsCleared: 0 }),
+  ResolveIdentityByEmail: async () => null,
+    get resolveIdentityByEmail() { return this.ResolveIdentityByEmail; },
+  MergeVisitorIdentity: async () => 0,
+    get mergeVisitorIdentity() { return this.MergeVisitorIdentity; },
+  ForgetVisitor: async () => ({ notesArchived: 0, conversationsCleared: 0 }),
+    get forgetVisitor() { return this.ForgetVisitor; },
 }));
 
 import { WidgetSessionService } from '../realtimeWidget/WidgetSessionService.js';

package/src/__tests__/adhoc-query-helpers.test.ts

@@ -1,50 +1,50 @@
 import { describe, it, expect } from 'vitest';
-import { exactTotalFromPage, resolveAdhocTotalRowCount } from '../resolvers/adhoc-query-helpers';
+import { ExactTotalFromPage, ResolveAdhocTotalRowCount } from '../resolvers/adhoc-query-helpers';
 
 describe('exactTotalFromPage', () => {
     it('returns the row count when not paging (maxRows null) — the query was uncapped', () => {
-        expect(exactTotalFromPage(0, 47, null)).toBe(47);
-        expect(exactTotalFromPage(0, 0, null)).toBe(0);
+        expect(ExactTotalFromPage(0, 47, null)).toBe(47);
+        expect(ExactTotalFromPage(0, 0, null)).toBe(0);
     });
 
     it('returns startRow + pageLength for a SHORT page (fewer rows than the page size)', () => {
-        expect(exactTotalFromPage(0, 47, 100)).toBe(47);   // page 1, short → exact total
-        expect(exactTotalFromPage(200, 30, 100)).toBe(230); // page 3, short last page
-        expect(exactTotalFromPage(100, 0, 100)).toBe(100);  // empty page past the end
+        expect(ExactTotalFromPage(0, 47, 100)).toBe(47);   // page 1, short → exact total
+        expect(ExactTotalFromPage(200, 30, 100)).toBe(230); // page 3, short last page
+        expect(ExactTotalFromPage(100, 0, 100)).toBe(100);  // empty page past the end
     });
 
     it('returns null for a FULL page — a COUNT is required because more rows may exist', () => {
-        expect(exactTotalFromPage(0, 100, 100)).toBeNull();
-        expect(exactTotalFromPage(500, 100, 100)).toBeNull();
+        expect(ExactTotalFromPage(0, 100, 100)).toBeNull();
+        expect(ExactTotalFromPage(500, 100, 100)).toBeNull();
     });
 
     it('treats an over-full page defensively as "needs count" (should not occur with OFFSET/FETCH)', () => {
-        expect(exactTotalFromPage(0, 150, 100)).toBeNull();
+        expect(ExactTotalFromPage(0, 150, 100)).toBeNull();
     });
 });
 
 describe('resolveAdhocTotalRowCount', () => {
     it('reads TotalRowCount from the count recordset', () => {
-        expect(resolveAdhocTotalRowCount([{ TotalRowCount: 2087 }], 100)).toBe(2087);
-        expect(resolveAdhocTotalRowCount([{ TotalRowCount: 0 }], 100)).toBe(0);
+        expect(ResolveAdhocTotalRowCount([{ TotalRowCount: 2087 }], 100)).toBe(2087);
+        expect(ResolveAdhocTotalRowCount([{ TotalRowCount: 0 }], 100)).toBe(0);
     });
 
     it('floors a fractional/stringified count', () => {
-        expect(resolveAdhocTotalRowCount([{ TotalRowCount: 42.9 }], 0)).toBe(42);
-        expect(resolveAdhocTotalRowCount([{ TotalRowCount: '2087' as unknown as number }], 0)).toBe(2087);
+        expect(ResolveAdhocTotalRowCount([{ TotalRowCount: 42.9 }], 0)).toBe(42);
+        expect(ResolveAdhocTotalRowCount([{ TotalRowCount: '2087' as unknown as number }], 0)).toBe(2087);
     });
 
     it('falls back when the count is absent, empty, null, or malformed', () => {
-        expect(resolveAdhocTotalRowCount(null, 100)).toBe(100);
-        expect(resolveAdhocTotalRowCount(undefined, 100)).toBe(100);
-        expect(resolveAdhocTotalRowCount([], 100)).toBe(100);
-        expect(resolveAdhocTotalRowCount([{}], 100)).toBe(100);
-        expect(resolveAdhocTotalRowCount([{ TotalRowCount: null }], 100)).toBe(100);
+        expect(ResolveAdhocTotalRowCount(null, 100)).toBe(100);
+        expect(ResolveAdhocTotalRowCount(undefined, 100)).toBe(100);
+        expect(ResolveAdhocTotalRowCount([], 100)).toBe(100);
+        expect(ResolveAdhocTotalRowCount([{}], 100)).toBe(100);
+        expect(ResolveAdhocTotalRowCount([{ TotalRowCount: null }], 100)).toBe(100);
     });
 
     it('falls back on non-finite or negative counts (never reports a misleading total)', () => {
-        expect(resolveAdhocTotalRowCount([{ TotalRowCount: Number.NaN }], 100)).toBe(100);
-        expect(resolveAdhocTotalRowCount([{ TotalRowCount: -5 }], 100)).toBe(100);
-        expect(resolveAdhocTotalRowCount([{ TotalRowCount: Infinity }], 100)).toBe(100);
+        expect(ResolveAdhocTotalRowCount([{ TotalRowCount: Number.NaN }], 100)).toBe(100);
+        expect(ResolveAdhocTotalRowCount([{ TotalRowCount: -5 }], 100)).toBe(100);
+        expect(ResolveAdhocTotalRowCount([{ TotalRowCount: Infinity }], 100)).toBe(100);
     });
 });

package/src/__tests__/bootAudit.test.ts

@@ -18,7 +18,7 @@ vi.mock('../config.js', () => ({
   },
 }));
 
-import { auditResolverList } from '../logging/bootAudit.js';
+import { AuditResolverList } from '../logging/bootAudit.js';
 import type { AuditArgParam, AuditResolver } from '../logging/bootAudit.js';
 import { NoLog } from '../logging/NoLog.js';
 
@@ -37,12 +37,12 @@ function makeArgParam(opts: {
   type: Function;
 }): AuditArgParam {
   return {
-    target: opts.target,
-    methodName: opts.methodName,
-    index: opts.index,
+    Target: opts.target,
+    MethodName: opts.methodName,
+    Index: opts.index,
     kind: 'arg',
     name: opts.name,
-    getType: () => opts.type,
+    GetType: () => opts.type,
   };
 }
 
@@ -52,8 +52,8 @@ function makeResolver(opts: {
   params: AuditArgParam[];
 }): AuditResolver {
   return {
-    target: opts.target,
-    methodName: opts.methodName,
+    Target: opts.target,
+    MethodName: opts.methodName,
     params: opts.params,
   };
 }
@@ -93,7 +93,7 @@ describe('auditResolverList', () => {
       ],
     });
 
-    auditResolverList([resolver]);
+    AuditResolverList([resolver]);
     expect(warnSpy).not.toHaveBeenCalled();
   });
 
@@ -117,7 +117,7 @@ describe('auditResolverList', () => {
       ],
     });
 
-    auditResolverList([resolver]);
+    AuditResolverList([resolver]);
     expect(warnSpy).toHaveBeenCalledTimes(1);
     const message = warnSpy.mock.calls[0][0];
     expect(typeof message).toBe('string');
@@ -148,7 +148,7 @@ describe('auditResolverList', () => {
       ],
     });
 
-    auditResolverList([resolver]);
+    AuditResolverList([resolver]);
     expect(warnSpy).not.toHaveBeenCalled();
   });
 
@@ -179,7 +179,7 @@ describe('auditResolverList', () => {
       ],
     });
 
-    auditResolverList([resolver]);
+    AuditResolverList([resolver]);
     expect(warnSpy).toHaveBeenCalledTimes(1);
     const message = warnSpy.mock.calls[0][0];
     expect(message).toContain("'custom'");

package/src/__tests__/boundaryLogPayload.test.ts

@@ -1,5 +1,5 @@
 import { describe, it, expect } from 'vitest';
-import { buildBoundaryLogPayload } from '../logging/boundaryLogPayload.js';
+import { BuildBoundaryLogPayload } from '../logging/boundaryLogPayload.js';
 
 /**
  * Guards the load-bearing #2638 fix: the always-on GraphQL boundary log line emits the
@@ -10,22 +10,22 @@ import { buildBoundaryLogPayload } from '../logging/boundaryLogPayload.js';
  */
 describe('buildBoundaryLogPayload', () => {
   it('returns operation name only', () => {
-    expect(buildBoundaryLogPayload('CreateMJCredential')).toEqual({ operationName: 'CreateMJCredential' });
+    expect(BuildBoundaryLogPayload('CreateMJCredential')).toEqual({ operationName: 'CreateMJCredential' });
   });
 
   it('never includes a `variables` key', () => {
-    const payload = buildBoundaryLogPayload('RunViewsWithCacheCheck');
+    const payload = BuildBoundaryLogPayload('RunViewsWithCacheCheck');
     expect('variables' in payload).toBe(false);
   });
 
   it('serialized form contains no value content — only the operation name', () => {
     // Even if someone passes a secret-shaped operation name, nothing but the name is emitted.
-    const serialized = JSON.stringify(buildBoundaryLogPayload('SomeOp'));
+    const serialized = JSON.stringify(BuildBoundaryLogPayload('SomeOp'));
     expect(serialized).toBe('{"operationName":"SomeOp"}');
   });
 
   it('handles undefined operation name (non-named operations)', () => {
-    expect(buildBoundaryLogPayload(undefined)).toEqual({ operationName: undefined });
-    expect('variables' in buildBoundaryLogPayload(undefined)).toBe(false);
+    expect(BuildBoundaryLogPayload(undefined)).toEqual({ operationName: undefined });
+    expect('variables' in BuildBoundaryLogPayload(undefined)).toBe(false);
   });
 });

package/src/__tests__/cacheInvalidationRecordData.test.ts

@@ -0,0 +1,177 @@
+// The gate lives beside the subscription it protects, and that module carries type-graphql
+// decorators — so the metadata shim has to be in place before it is imported.
+import 'reflect-metadata';
+import { afterEach, describe, expect, it, vi } from 'vitest';
+import {
+  ConfigureRecordDataBroadcast,
+  MayBroadcastRecordData,
+} from '../generic/CacheInvalidationResolver.js';
+
+/**
+ * The cache-invalidation subscription is delivered to every connected client with no per-user
+ * filter, so anything `MayBroadcastRecordData` lets through is readable by every signed-in session
+ * regardless of row-level security or any tenant scoping a consumer applies on the read path.
+ *
+ * The important case is the DEFAULT: an untouched deployment must broadcast no row data at all,
+ * because that is the configuration everyone upgrades into.
+ */
+describe('MayBroadcastRecordData', () => {
+  afterEach(() => ConfigureRecordDataBroadcast([]));
+
+  it('broadcasts nothing before anything has configured it', () => {
+    // No ConfigureRecordDataBroadcast call at all — the state a process starts in, and the state it
+    // stays in if bootstrap ever stops calling it. Failing closed there is the whole point.
+    expect(MayBroadcastRecordData('Users')).toBe(false);
+    expect(MayBroadcastRecordData('AI Models')).toBe(false);
+  });
+
+  it('broadcasts nothing when the deployment has not opted in', () => {
+    ConfigureRecordDataBroadcast([]);
+    expect(MayBroadcastRecordData('Users')).toBe(false);
+  });
+
+  it('broadcasts nothing when the config value is absent', () => {
+    ConfigureRecordDataBroadcast(undefined);
+    expect(MayBroadcastRecordData('Users')).toBe(false);
+  });
+
+  it('allows exactly the entities named, and no others', () => {
+    ConfigureRecordDataBroadcast(['AI Models']);
+    expect(MayBroadcastRecordData('AI Models')).toBe(true);
+    expect(MayBroadcastRecordData('Users')).toBe(false);
+    expect(MayBroadcastRecordData('AI Model Vendors')).toBe(false);
+    // The allowlisted name as a SUBSTRING of another entity must not carry it in. Written this way
+    // deliberately: 'AI Model Vendors' above does not contain 'AI Models', so it passes against a
+    // loose `includes` match too and proves nothing — a substring mutation survived it.
+    expect(MayBroadcastRecordData('Archived AI Models 2024')).toBe(false);
+    // ...and the reverse direction, where the entity name is a substring of the allowlisted one.
+    expect(MayBroadcastRecordData('AI Model')).toBe(false);
+  });
+
+  it('matches entity names case- and whitespace-insensitively', () => {
+    ConfigureRecordDataBroadcast(['  ai models  ']);
+    expect(MayBroadcastRecordData('AI Models')).toBe(true);
+  });
+
+  it("restores the previous broadcast-everything behaviour only on an explicit '*'", () => {
+    ConfigureRecordDataBroadcast(['*']);
+    expect(MayBroadcastRecordData('Users')).toBe(true);
+    expect(MayBroadcastRecordData('Organization Person Roles')).toBe(true);
+  });
+});
+
+/**
+ * Importing this module must not drag server config loading in with it.
+ *
+ * The first version of this change read `configInfo` at module scope. `config.ts` runs
+ * `loadConfig()` on import, so every test that touched the resolver — directly or through
+ * ResolverBase — died at import with "Configuration validation failed". CI caught it; this keeps
+ * it caught.
+ */
+describe('CacheInvalidationResolver module surface', () => {
+  it('imports without any server configuration present', async () => {
+    await expect(import('../generic/CacheInvalidationResolver.js')).resolves.toBeDefined();
+  });
+});
+
+/**
+ * The allowlist is normalised where it enters, not where it is compared.
+ *
+ * Raised in review: the wildcard was matched raw while entity names were trimmed and lowercased,
+ * so a hand-edited `[' * ']` matched neither branch and silently opted nothing in — a config that
+ * reads as "broadcast everything" while the gate stayed fully closed.
+ */
+describe('allowlist normalisation', () => {
+  afterEach(() => ConfigureRecordDataBroadcast([]));
+
+  it("honours a wildcard written with surrounding whitespace", () => {
+    ConfigureRecordDataBroadcast([' * ']);
+    expect(MayBroadcastRecordData('Users')).toBe(true);
+  });
+
+  it('ignores blank entries rather than letting one match something', () => {
+    ConfigureRecordDataBroadcast(['', '   ']);
+    expect(MayBroadcastRecordData('Users')).toBe(false);
+    // A blank entry must not become a wildcard by accident either.
+    expect(MayBroadcastRecordData('')).toBe(false);
+  });
+
+  it('still matches a normal name written with odd casing and padding', () => {
+    ConfigureRecordDataBroadcast(['  AI MODELS  ']);
+    expect(MayBroadcastRecordData('ai models')).toBe(true);
+    expect(MayBroadcastRecordData('Users')).toBe(false);
+  });
+});
+
+/**
+ * Entity-level delivery filtering, raised in review.
+ *
+ * An event for an entity a session cannot read at all tells that session the record exists, its
+ * stable key and when it changed — and the session could never have read it, so withholding costs
+ * nothing. This does NOT close the row-level case: two sessions that both hold read permission on
+ * an entity still see each other's keys. That is tracked separately and deliberately not faked
+ * green here.
+ */
+describe('cacheInvalidationFilter', () => {
+  const event = (entityName: string) => ({
+    entityName,
+    primaryKeyValues: '[{"FieldName":"ID","Value":"r1"}]',
+    action: 'save',
+    sourceServerId: 's1',
+    timestamp: new Date(),
+  });
+  const session = (userRecord: unknown) => ({ userPayload: { userRecord } });
+
+  const withEntities = async (entities: Array<{ Name: string; CanRead: boolean }>) => {
+    vi.resetModules();
+    vi.doMock('@memberjunction/core', () => ({
+      Metadata: class {
+        get Entities() {
+          return entities.map((e) => ({
+            Name: e.Name,
+            GetUserPermisions: () => ({ CanRead: e.CanRead }),
+          }));
+        }
+        // The real one is case-insensitive and trims — the filter relies on that, so the mock does too.
+        EntityByName(name: string) {
+          const key = name.trim().toLowerCase();
+          return this.Entities.find((e) => e.Name.toLowerCase() === key);
+        }
+      },
+    }));
+    return (await import('../generic/CacheInvalidationResolver.js')).cacheInvalidationFilter;
+  };
+
+  afterEach(() => vi.doUnmock('@memberjunction/core'));
+
+  it('delivers an event for an entity the session may read', async () => {
+    const filter = await withEntities([{ Name: 'AI Models', CanRead: true }]);
+    expect(filter({ payload: event('AI Models') as never, context: session({ ID: 'u1' }) })).toBe(true);
+  });
+
+  it('withholds an event for an entity the session may NOT read', async () => {
+    const filter = await withEntities([{ Name: 'Users', CanRead: false }]);
+    expect(filter({ payload: event('Users') as never, context: session({ ID: 'u1' }) })).toBe(false);
+  });
+
+  it('fails closed when the connection carries no user', async () => {
+    // onConnect rejects a socket whose token does not validate, so this should not arise — and it
+    // is the case least deserving of an unfiltered firehose if it does.
+    const filter = await withEntities([{ Name: 'AI Models', CanRead: true }]);
+    expect(filter({ payload: event('AI Models') as never, context: undefined })).toBe(false);
+    expect(filter({ payload: event('AI Models') as never, context: session(undefined) })).toBe(false);
+  });
+
+  it('delivers when the entity is unknown to this server, rather than silently going stale', async () => {
+    // Deliberately the opposite choice: a name absent from metadata cannot be permission-checked,
+    // and withholding would stop invalidating a legitimately cacheable entity — a correctness bug
+    // in place of a disclosure one.
+    const filter = await withEntities([{ Name: 'AI Models', CanRead: true }]);
+    expect(filter({ payload: event('Some Entity This Server Never Heard Of') as never, context: session({ ID: 'u1' }) })).toBe(true);
+  });
+
+  it('withholds an event with no entity name', async () => {
+    const filter = await withEntities([{ Name: 'AI Models', CanRead: true }]);
+    expect(filter({ payload: { ...event(''), entityName: '' } as never, context: session({ ID: 'u1' }) })).toBe(false);
+  });
+});