@memberjunction/server 6.2.0-edge.1 → 6.2.0-edge.3

package/dist/generic/FireAndForgetHeartbeat.d.ts

@@ -1,5 +1,19 @@
 import { PubSubEngine } from 'type-graphql';
-/** Default cadence for fire-and-forget liveness pulses (5 minutes). */
+/**
+ * Default cadence for fire-and-forget liveness pulses (60 seconds).
+ *
+ * MATCHED PAIR — do not change alone. The client's inactivity window
+ * (`DEFAULT_IDLE_TIMEOUT_MS` in GraphQLDataProvider's fireAndForgetHelper) is sized at roughly
+ * 3x this value, so a healthy run always refreshes the timer well before it expires. Lengthening
+ * this without lengthening that window makes every quiet stretch of a long agent run look like a
+ * stall and trips reconciliation; shortening the window without shortening this does the same.
+ *
+ * WAS 5 MINUTES (MJ #4222). Paired with the old 12-minute window, a client whose transport had
+ * silently died waited 12 minutes to notice — on runs that typically finish in 20 seconds. The
+ * pulse is a few dozen bytes and exists only while an operation is actually running, so the
+ * added traffic is negligible: a 40-minute run now sends ~40 pulses instead of ~8, and the
+ * 20-second run that motivated the change still sends none.
+ */
 export declare const DEFAULT_PULSE_INTERVAL_MS: number;
 /** The `type` discriminator carried by liveness pulse messages. */
 export declare const HEARTBEAT_MESSAGE_TYPE = "Heartbeat";

package/dist/generic/FireAndForgetHeartbeat.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"FireAndForgetHeartbeat.d.ts","sourceRoot":"","sources":["../../src/generic/FireAndForgetHeartbeat.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAI5C,uEAAuE;AACvE,eAAO,MAAM,yBAAyB,QAAgB,CAAC;AAEvD,mEAAmE;AACnE,eAAO,MAAM,sBAAsB,cAAc,CAAC;AAElD;;;;GAIG;AACH,MAAM,WAAW,WAAW;IACxB,mFAAmF;IACnF,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,0CAA0C;IAC1C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,2DAA2D;IAC3D,WAAW,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,0FAA0F;AAC1F,MAAM,WAAW,mBAAmB;IAChC,IAAI,IAAI,IAAI,CAAC;CAChB;AAED,MAAM,WAAW,oBAAoB;IACjC,qEAAqE;IACrE,MAAM,EAAE,YAAY,CAAC;IACrB,6EAA6E;IAC7E,SAAS,EAAE,MAAM,CAAC;IAClB;;;OAGG;IACH,WAAW,EAAE,MAAM,CAAC;IACpB,iFAAiF;IACjF,QAAQ,EAAE,MAAM,CAAC;IACjB,0EAA0E;IAC1E,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,WAAW,GAAG,SAAS,CAAC;CAC9C;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,oBAAoB,GAAG,mBAAmB,CA4BrF;AAED,kDAAkD;AAClD,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,oBAAoB,GAAG,mBAAmB,CAErF"}
+{"version":3,"file":"FireAndForgetHeartbeat.d.ts","sourceRoot":"","sources":["../../src/generic/FireAndForgetHeartbeat.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAI5C;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,yBAAyB,QAAY,CAAC;AAEnD,mEAAmE;AACnE,eAAO,MAAM,sBAAsB,cAAc,CAAC;AAElD;;;;GAIG;AACH,MAAM,WAAW,WAAW;IACxB,mFAAmF;IACnF,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,0CAA0C;IAC1C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,2DAA2D;IAC3D,WAAW,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,0FAA0F;AAC1F,MAAM,WAAW,mBAAmB;IAChC,IAAI,IAAI,IAAI,CAAC;CAChB;AAED,MAAM,WAAW,oBAAoB;IACjC,qEAAqE;IACrE,MAAM,EAAE,YAAY,CAAC;IACrB,6EAA6E;IAC7E,SAAS,EAAE,MAAM,CAAC;IAClB;;;OAGG;IACH,WAAW,EAAE,MAAM,CAAC;IACpB,iFAAiF;IACjF,QAAQ,EAAE,MAAM,CAAC;IACjB,0EAA0E;IAC1E,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,WAAW,GAAG,SAAS,CAAC;CAC9C;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,oBAAoB,GAAG,mBAAmB,CA4BrF;AAED,kDAAkD;AAClD,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,oBAAoB,GAAG,mBAAmB,CAErF"}

package/dist/generic/FireAndForgetHeartbeat.js

@@ -1,7 +1,21 @@
 import { LogError } from '@memberjunction/core';
 import { PublishStatusUpdate } from './PushStatusResolver.js';
-/** Default cadence for fire-and-forget liveness pulses (5 minutes). */
-export const DEFAULT_PULSE_INTERVAL_MS = 5 * 60 * 1000;
+/**
+ * Default cadence for fire-and-forget liveness pulses (60 seconds).
+ *
+ * MATCHED PAIR — do not change alone. The client's inactivity window
+ * (`DEFAULT_IDLE_TIMEOUT_MS` in GraphQLDataProvider's fireAndForgetHelper) is sized at roughly
+ * 3x this value, so a healthy run always refreshes the timer well before it expires. Lengthening
+ * this without lengthening that window makes every quiet stretch of a long agent run look like a
+ * stall and trips reconciliation; shortening the window without shortening this does the same.
+ *
+ * WAS 5 MINUTES (MJ #4222). Paired with the old 12-minute window, a client whose transport had
+ * silently died waited 12 minutes to notice — on runs that typically finish in 20 seconds. The
+ * pulse is a few dozen bytes and exists only while an operation is actually running, so the
+ * added traffic is negligible: a 40-minute run now sends ~40 pulses instead of ~8, and the
+ * 20-second run that motivated the change still sends none.
+ */
+export const DEFAULT_PULSE_INTERVAL_MS = 60 * 1000;
 /** The `type` discriminator carried by liveness pulse messages. */
 export const HEARTBEAT_MESSAGE_TYPE = 'Heartbeat';
 /**

package/dist/generic/FireAndForgetHeartbeat.js.map

@@ -1 +1 @@
-{"version":3,"file":"FireAndForgetHeartbeat.js","sourceRoot":"","sources":["../../src/generic/FireAndForgetHeartbeat.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAChD,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAE9D,uEAAuE;AACvE,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAEvD,mEAAmE;AACnE,MAAM,CAAC,MAAM,sBAAsB,GAAG,WAAW,CAAC;AA2ClD;;;;;;;;;;GAUG;AACH,MAAM,UAAU,kBAAkB,CAAC,OAA6B;IAC5D,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,OAAO,CAAC;IACzE,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,yBAAyB,CAAC;IAEnE,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE;QAC3B,IAAI,IAA6B,CAAC;QAClC,IAAI,CAAC;YACD,IAAI,GAAG,UAAU,EAAE,EAAE,CAAC;QAC1B,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACT,0DAA0D;YAC1D,QAAQ,CAAC,kBAAkB,QAAQ,wBAAyB,CAAW,CAAC,OAAO,EAAE,CAAC,CAAC;QACvF,CAAC;QAED,mBAAmB,CAAC,MAAM,EAAE;YACxB,SAAS;YACT,WAAW;YACX,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC;gBACpB,QAAQ;gBACR,IAAI,EAAE,sBAAsB;gBAC5B,MAAM,EAAE,IAAI;gBACZ,IAAI,EAAE,IAAI,IAAI,EAAE;aACnB,CAAC;SACL,CAAC,CAAC;IACP,CAAC,EAAE,UAAU,CAAC,CAAC;IAEf,OAAO;QACH,IAAI,EAAE,GAAG,EAAE,CAAC,aAAa,CAAC,KAAK,CAAC;KACnC,CAAC;AACN,CAAC;AAED,kDAAkD;AAClD,MAAM,UAAU,kBAAkB,CAAC,OAA6B;IAC5D,OAAO,kBAAkB,CAAC,OAAO,CAAC,CAAC;AACvC,CAAC"}
+{"version":3,"file":"FireAndForgetHeartbeat.js","sourceRoot":"","sources":["../../src/generic/FireAndForgetHeartbeat.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAChD,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAE9D;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,EAAE,GAAG,IAAI,CAAC;AAEnD,mEAAmE;AACnE,MAAM,CAAC,MAAM,sBAAsB,GAAG,WAAW,CAAC;AA2ClD;;;;;;;;;;GAUG;AACH,MAAM,UAAU,kBAAkB,CAAC,OAA6B;IAC5D,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,OAAO,CAAC;IACzE,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,yBAAyB,CAAC;IAEnE,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE;QAC3B,IAAI,IAA6B,CAAC;QAClC,IAAI,CAAC;YACD,IAAI,GAAG,UAAU,EAAE,EAAE,CAAC;QAC1B,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACT,0DAA0D;YAC1D,QAAQ,CAAC,kBAAkB,QAAQ,wBAAyB,CAAW,CAAC,OAAO,EAAE,CAAC,CAAC;QACvF,CAAC;QAED,mBAAmB,CAAC,MAAM,EAAE;YACxB,SAAS;YACT,WAAW;YACX,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC;gBACpB,QAAQ;gBACR,IAAI,EAAE,sBAAsB;gBAC5B,MAAM,EAAE,IAAI;gBACZ,IAAI,EAAE,IAAI,IAAI,EAAE;aACnB,CAAC;SACL,CAAC,CAAC;IACP,CAAC,EAAE,UAAU,CAAC,CAAC;IAEf,OAAO;QACH,IAAI,EAAE,GAAG,EAAE,CAAC,aAAa,CAAC,KAAK,CAAC;KACnC,CAAC;AACN,CAAC;AAED,kDAAkD;AAClD,MAAM,UAAU,kBAAkB,CAAC,OAA6B;IAC5D,OAAO,kBAAkB,CAAC,OAAO,CAAC,CAAC;AACvC,CAAC"}

package/dist/generic/OrphanedConversationDetailReconciler.d.ts

@@ -0,0 +1,31 @@
+import type { IMetadataProvider, UserInfo } from '@memberjunction/core';
+/**
+ * Grace period after a run reaches a terminal state before its conversation detail is considered
+ * abandoned. The normal path closes the detail moments after the run finishes; this waits well past
+ * that so a reconcile can never race a completion that is already on its way.
+ */
+export declare const ORPHAN_DETAIL_GRACE_MS: number;
+/**
+ * Close conversation details left `In-Progress` by a run that is already over (MJ #4222).
+ *
+ * WHY THIS EXISTS. `AgentRunner` closes the detail as the final step of a run, so a process that
+ * dies mid-run never reaches it. The agent-run watchdog repairs the RUN — force-failing it once the
+ * heartbeat goes stale — but nothing repairs the detail, and the detail is the row the chat renders
+ * from. The result is durable state that disagrees with itself: a terminal run beside a message
+ * that still says it is being generated, spinning forever for anyone who opens it.
+ *
+ * WHY NOT IN THE SWEEP PROC. `spSweepStaleAIAgentRuns` is a single set-based UPDATE, and extending
+ * it to the detail would be the obvious fix. It would also be the wrong one: `MJ: Conversation
+ * Details` declares `TrustServerCacheCompletely`, so the server's RunView cache relies on
+ * `BaseEntity` events for invalidation and a stored procedure fires none. The row would change
+ * while every instance kept serving `In-Progress` from cache — a worse failure than the one being
+ * fixed, because reconciliation itself would read the stale value back. Going through
+ * `BaseEntity.Save()` costs a per-row write and buys correct invalidation everywhere.
+ *
+ * Idempotent and safe to run concurrently on several instances: the write is a no-op once the
+ * status is terminal, and each pass re-reads state before deciding.
+ *
+ * @returns How many details were closed.
+ */
+export declare function ReconcileOrphanedConversationDetails(provider: IMetadataProvider, contextUser: UserInfo, graceMs?: number): Promise<number>;
+//# sourceMappingURL=OrphanedConversationDetailReconciler.d.ts.map

package/dist/generic/OrphanedConversationDetailReconciler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"OrphanedConversationDetailReconciler.d.ts","sourceRoot":"","sources":["../../src/generic/OrphanedConversationDetailReconciler.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,iBAAiB,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAGxE;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,QAAgB,CAAC;AAiBpD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAsB,oCAAoC,CACtD,QAAQ,EAAE,iBAAiB,EAC3B,WAAW,EAAE,QAAQ,EACrB,OAAO,GAAE,MAA+B,GACzC,OAAO,CAAC,MAAM,CAAC,CAkGjB"}

package/dist/generic/OrphanedConversationDetailReconciler.js

@@ -0,0 +1,215 @@
+import { LogError, LogStatus, RunView } from '@memberjunction/core';
+import { UUIDsEqual } from '@memberjunction/global';
+import { UserCache } from '@memberjunction/sqlserver-dataprovider';
+/**
+ * Grace period after a run reaches a terminal state before its conversation detail is considered
+ * abandoned. The normal path closes the detail moments after the run finishes; this waits well past
+ * that so a reconcile can never race a completion that is already on its way.
+ */
+export const ORPHAN_DETAIL_GRACE_MS = 2 * 60 * 1000;
+/** Ceiling on details closed per pass, so a large backlog cannot stall startup. */
+const MAX_DETAILS_PER_PASS = 200;
+/**
+ * Agent-run statuses that mean the run succeeded. `AwaitingFeedback` is the normal end of a chat
+ * turn: the agent replied and the next move is the user's.
+ */
+const SUCCESSFUL_RUN_STATUSES = ['Completed', 'AwaitingFeedback'];
+/**
+ * Agent-run statuses that mean execution is over, whatever the outcome. `Paused` is absent: the
+ * run is parked on a workflow that is still executing.
+ */
+const TERMINAL_RUN_STATUSES = [...SUCCESSFUL_RUN_STATUSES, 'Failed', 'Cancelled'];
+/**
+ * Close conversation details left `In-Progress` by a run that is already over (MJ #4222).
+ *
+ * WHY THIS EXISTS. `AgentRunner` closes the detail as the final step of a run, so a process that
+ * dies mid-run never reaches it. The agent-run watchdog repairs the RUN — force-failing it once the
+ * heartbeat goes stale — but nothing repairs the detail, and the detail is the row the chat renders
+ * from. The result is durable state that disagrees with itself: a terminal run beside a message
+ * that still says it is being generated, spinning forever for anyone who opens it.
+ *
+ * WHY NOT IN THE SWEEP PROC. `spSweepStaleAIAgentRuns` is a single set-based UPDATE, and extending
+ * it to the detail would be the obvious fix. It would also be the wrong one: `MJ: Conversation
+ * Details` declares `TrustServerCacheCompletely`, so the server's RunView cache relies on
+ * `BaseEntity` events for invalidation and a stored procedure fires none. The row would change
+ * while every instance kept serving `In-Progress` from cache — a worse failure than the one being
+ * fixed, because reconciliation itself would read the stale value back. Going through
+ * `BaseEntity.Save()` costs a per-row write and buys correct invalidation everywhere.
+ *
+ * Idempotent and safe to run concurrently on several instances: the write is a no-op once the
+ * status is terminal, and each pass re-reads state before deciding.
+ *
+ * @returns How many details were closed.
+ */
+export async function ReconcileOrphanedConversationDetails(provider, contextUser, graceMs = ORPHAN_DETAIL_GRACE_MS) {
+    try {
+        const rv = RunView.FromMetadataProvider(provider);
+        const detailResult = await rv.RunView({
+            EntityName: 'MJ: Conversation Details',
+            ExtraFilter: `Status = 'In-Progress' AND Role = 'AI'${hasTerminalRunClause(provider)}`,
+            OrderBy: '__mj_CreatedAt ASC',
+            MaxRows: MAX_DETAILS_PER_PASS,
+            ResultType: 'entity_object',
+        }, contextUser);
+        if (!detailResult.Success || !detailResult.Results?.length) {
+            return 0;
+        }
+        const runsByDetail = await loadTerminalRuns(rv, detailResult.Results.map(d => d.ID), contextUser);
+        if (runsByDetail.size === 0) {
+            return 0;
+        }
+        const ownersByConversation = await loadConversationOwners(rv, detailResult.Results.map(d => d.ConversationID).filter((id) => !!id), contextUser);
+        const cutoff = Date.now() - graceMs;
+        let closed = 0;
+        for (const detail of detailResult.Results) {
+            const run = runsByDetail.get(detail.ID);
+            if (!run) {
+                // No run yet, or its run is still executing. Both are legitimately in progress.
+                continue;
+            }
+            const completedAt = run.CompletedAt ? new Date(run.CompletedAt).getTime() : NaN;
+            if (!Number.isFinite(completedAt) || completedAt > cutoff) {
+                // Inside the grace window — the owning process may still be closing this itself.
+                continue;
+            }
+            // Write as the conversation's OWNER, not as the system user.
+            //
+            // `MJConversationDetailEntityExtended.Save()` gates writes on conversation ownership: a
+            // non-owner without a resource grant is refused, returning false with no result
+            // registered anywhere — indistinguishable from a crash, and the reason this pass
+            // silently wrote nothing at all until it was traced. The system user owns no
+            // conversations, so it is exactly the caller that gate exists to stop. Saving as the
+            // owner satisfies the gate on its own terms rather than routing around it, and keeps
+            // the write attributable to the person whose message it is.
+            const owner = detail.ConversationID ? ownersByConversation.get(detail.ConversationID) : undefined;
+            if (!owner) {
+                LogError(`[OrphanDetailReconciler] No owner resolved for conversation ${detail.ConversationID}; leaving detail ${detail.ID}`);
+                continue;
+            }
+            const writable = await provider.GetEntityObject('MJ: Conversation Details', owner);
+            if (!(await writable.Load(detail.ID))) {
+                LogError(`[OrphanDetailReconciler] Could not load detail ${detail.ID} for write`);
+                continue;
+            }
+            if (writable.Status !== 'In-Progress') {
+                // Closed by something else since the list query. Its outcome stands.
+                continue;
+            }
+            // The failure marker belongs only to the error branch. A completed run has nothing to
+            // report, so an empty message stays empty rather than contradicting its own status.
+            if (SUCCESSFUL_RUN_STATUSES.includes(run.Status)) {
+                writable.Status = 'Complete';
+            }
+            else {
+                writable.Status = 'Error';
+                if (!writable.Message) {
+                    writable.Message = run.ErrorMessage ?? '❌ Failed';
+                }
+            }
+            if (await writable.Save()) {
+                closed++;
+            }
+            else {
+                const result = writable.LatestResult;
+                LogError(`[OrphanDetailReconciler] Failed to close detail ${detail.ID}: ` +
+                    `${result?.CompleteMessage || result?.Message || 'no message'}`);
+            }
+        }
+        if (closed > 0) {
+            LogStatus(`[OrphanDetailReconciler] Closed ${closed} conversation detail(s) left behind by finished runs`);
+        }
+        return closed;
+    }
+    catch (err) {
+        // Maintenance work must never take the server down with it.
+        LogError(`[OrphanDetailReconciler] Pass failed: ${err instanceof Error ? err.message : String(err)}`);
+        return 0;
+    }
+}
+function isQuotingProvider(provider) {
+    const p = provider;
+    return typeof p.QuoteIdentifier === 'function' && typeof p.QuoteSchemaAndView === 'function';
+}
+/**
+ * Filter clause that keeps only details with at least one finished run.
+ *
+ * Details with no run, or whose run is still executing, are never closed here. Without this clause
+ * they fill the oldest-first window, and once 200 of them accumulate no closable orphan is reached.
+ * The newest-run check in {@link loadTerminalRuns} still decides each remaining detail.
+ *
+ * @returns An ` AND ...` clause, or an empty string when the provider cannot quote names.
+ */
+function hasTerminalRunClause(provider) {
+    const runs = provider.EntityByName('MJ: AI Agent Runs');
+    if (!runs || !isQuotingProvider(provider)) {
+        return '';
+    }
+    const statuses = TERMINAL_RUN_STATUSES.map(s => `'${s}'`).join(',');
+    return (` AND ID IN (SELECT ${provider.QuoteIdentifier('ConversationDetailID')}` +
+        ` FROM ${provider.QuoteSchemaAndView(runs.SchemaName, runs.BaseView)}` +
+        ` WHERE ${provider.QuoteIdentifier('Status')} IN (${statuses}))`);
+}
+/**
+ * Newest terminal run per conversation detail. Details whose newest run is still executing are
+ * deliberately absent, so a retried message is judged on its latest attempt rather than an older
+ * finished one.
+ */
+async function loadTerminalRuns(rv, detailIds, contextUser) {
+    const quoted = detailIds.map(id => `'${id.replace(/'/g, "''")}'`).join(',');
+    const result = await rv.RunView({
+        EntityName: 'MJ: AI Agent Runs',
+        ExtraFilter: `ConversationDetailID IN (${quoted})`,
+        OrderBy: '__mj_CreatedAt DESC',
+        ResultType: 'entity_object',
+    }, contextUser);
+    if (!result.Success) {
+        return new Map();
+    }
+    const newest = new Map();
+    for (const run of result.Results ?? []) {
+        const detailId = run.ConversationDetailID;
+        if (!detailId || newest.has(detailId)) {
+            continue; // DESC order puts the newest run first
+        }
+        newest.set(detailId, run);
+    }
+    // Drop any detail whose newest attempt is still running.
+    for (const [detailId, run] of newest) {
+        if (!TERMINAL_RUN_STATUSES.includes(run.Status)) {
+            newest.delete(detailId);
+        }
+    }
+    return newest;
+}
+/**
+ * Owner `UserInfo` per conversation, resolved through {@link UserCache}. The reconciler writes as
+ * the owner so the conversation-detail permission gate is satisfied on its own terms.
+ */
+async function loadConversationOwners(rv, conversationIds, contextUser) {
+    const owners = new Map();
+    if (conversationIds.length === 0) {
+        return owners;
+    }
+    const quoted = [...new Set(conversationIds)].map(id => `'${id.replace(/'/g, "''")}'`).join(',');
+    const result = await rv.RunView({
+        EntityName: 'MJ: Conversations',
+        ExtraFilter: `ID IN (${quoted})`,
+        Fields: ['ID', 'UserID'],
+        ResultType: 'simple',
+    }, contextUser);
+    if (!result.Success) {
+        return owners;
+    }
+    const users = UserCache.Instance.Users;
+    for (const row of result.Results ?? []) {
+        if (!row.UserID) {
+            continue;
+        }
+        const user = users.find(u => UUIDsEqual(u.ID, row.UserID));
+        if (user) {
+            owners.set(row.ID, user);
+        }
+    }
+    return owners;
+}
+//# sourceMappingURL=OrphanedConversationDetailReconciler.js.map

package/dist/generic/OrphanedConversationDetailReconciler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"OrphanedConversationDetailReconciler.js","sourceRoot":"","sources":["../../src/generic/OrphanedConversationDetailReconciler.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC;AACpE,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACpD,OAAO,EAAE,SAAS,EAAE,MAAM,wCAAwC,CAAC;AAInE;;;;GAIG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAEpD,mFAAmF;AACnF,MAAM,oBAAoB,GAAG,GAAG,CAAC;AAEjC;;;GAGG;AACH,MAAM,uBAAuB,GAAmC,CAAC,WAAW,EAAE,kBAAkB,CAAC,CAAC;AAElG;;;GAGG;AACH,MAAM,qBAAqB,GAAmC,CAAC,GAAG,uBAAuB,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC;AAElH;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAC,KAAK,UAAU,oCAAoC,CACtD,QAA2B,EAC3B,WAAqB,EACrB,UAAkB,sBAAsB;IAExC,IAAI,CAAC;QACD,MAAM,EAAE,GAAG,OAAO,CAAC,oBAAoB,CAAC,QAAQ,CAAC,CAAC;QAElD,MAAM,YAAY,GAAG,MAAM,EAAE,CAAC,OAAO,CACjC;YACI,UAAU,EAAE,0BAA0B;YACtC,WAAW,EAAE,yCAAyC,oBAAoB,CAAC,QAAQ,CAAC,EAAE;YACtF,OAAO,EAAE,oBAAoB;YAC7B,OAAO,EAAE,oBAAoB;YAC7B,UAAU,EAAE,eAAe;SAC9B,EACD,WAAW,CACd,CAAC;QACF,IAAI,CAAC,YAAY,CAAC,OAAO,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC;YACzD,OAAO,CAAC,CAAC;QACb,CAAC;QAED,MAAM,YAAY,GAAG,MAAM,gBAAgB,CAAC,EAAE,EAAE,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,WAAW,CAAC,CAAC;QAClG,IAAI,YAAY,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;YAC1B,OAAO,CAAC,CAAC;QACb,CAAC;QAED,MAAM,oBAAoB,GAAG,MAAM,sBAAsB,CACrD,EAAE,EACF,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,EAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAClF,WAAW,CACd,CAAC;QAEF,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC;QACpC,IAAI,MAAM,GAAG,CAAC,CAAC;QAEf,KAAK,MAAM,MAAM,IAAI,YAAY,CAAC,OAAO,EAAE,CAAC;YACxC,MAAM,GAAG,GAAG,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACxC,IAAI,CAAC,GAAG,EAAE,CAAC;gBACP,gFAAgF;gBAChF,SAAS;YACb,CAAC;YACD,MAAM,WAAW,GAAG,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;YAChF,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,WAAW,GAAG,MAAM,EAAE,CAAC;gBACxD,iFAAiF;gBACjF,SAAS;YACb,CAAC;YAED,6DAA6D;YAC7D,EAAE;YACF,wFAAwF;YACxF,gFAAgF;YAChF,iFAAiF;YACjF,6EAA6E;YAC7E,qFAAqF;YACrF,qFAAqF;YACrF,4DAA4D;YAC5D,MAAM,KAAK,GAAG,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,oBAAoB,CAAC,GAAG,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAClG,IAAI,CAAC,KAAK,EAAE,CAAC;gBACT,QAAQ,CAAC,+DAA+D,MAAM,CAAC,cAAc,oBAAoB,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC;gBAC9H,SAAS;YACb,CAAC;YACD,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,eAAe,CAA6B,0BAA0B,EAAE,KAAK,CAAC,CAAC;YAC/G,IAAI,CAAC,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;gBACpC,QAAQ,CAAC,kDAAkD,MAAM,CAAC,EAAE,YAAY,CAAC,CAAC;gBAClF,SAAS;YACb,CAAC;YACD,IAAI,QAAQ,CAAC,MAAM,KAAK,aAAa,EAAE,CAAC;gBACpC,qEAAqE;gBACrE,SAAS;YACb,CAAC;YACD,sFAAsF;YACtF,oFAAoF;YACpF,IAAI,uBAAuB,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC/C,QAAQ,CAAC,MAAM,GAAG,UAAU,CAAC;YACjC,CAAC;iBAAM,CAAC;gBACJ,QAAQ,CAAC,MAAM,GAAG,OAAO,CAAC;gBAC1B,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;oBACpB,QAAQ,CAAC,OAAO,GAAG,GAAG,CAAC,YAAY,IAAI,UAAU,CAAC;gBACtD,CAAC;YACL,CAAC;YAED,IAAI,MAAM,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC;gBACxB,MAAM,EAAE,CAAC;YACb,CAAC;iBAAM,CAAC;gBACJ,MAAM,MAAM,GAAG,QAAQ,CAAC,YAAY,CAAC;gBACrC,QAAQ,CACJ,mDAAmD,MAAM,CAAC,EAAE,IAAI;oBAChE,GAAG,MAAM,EAAE,eAAe,IAAI,MAAM,EAAE,OAAO,IAAI,YAAY,EAAE,CAClE,CAAC;YACN,CAAC;QACL,CAAC;QAED,IAAI,MAAM,GAAG,CAAC,EAAE,CAAC;YACb,SAAS,CAAC,mCAAmC,MAAM,sDAAsD,CAAC,CAAC;QAC/G,CAAC;QACD,OAAO,MAAM,CAAC;IAClB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACX,4DAA4D;QAC5D,QAAQ,CAAC,yCAAyC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACtG,OAAO,CAAC,CAAC;IACb,CAAC;AACL,CAAC;AAQD,SAAS,iBAAiB,CAAC,QAA2B;IAClD,MAAM,CAAC,GAAG,QAAwD,CAAC;IACnE,OAAO,OAAO,CAAC,CAAC,eAAe,KAAK,UAAU,IAAI,OAAO,CAAC,CAAC,kBAAkB,KAAK,UAAU,CAAC;AACjG,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,oBAAoB,CAAC,QAA2B;IACrD,MAAM,IAAI,GAAG,QAAQ,CAAC,YAAY,CAAC,mBAAmB,CAAC,CAAC;IACxD,IAAI,CAAC,IAAI,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,EAAE,CAAC;QACxC,OAAO,EAAE,CAAC;IACd,CAAC;IACD,MAAM,QAAQ,GAAG,qBAAqB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACpE,OAAO,CACH,sBAAsB,QAAQ,CAAC,eAAe,CAAC,sBAAsB,CAAC,EAAE;QACxE,SAAS,QAAQ,CAAC,kBAAkB,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC,EAAE;QACtE,UAAU,QAAQ,CAAC,eAAe,CAAC,QAAQ,CAAC,QAAQ,QAAQ,IAAI,CACnE,CAAC;AACN,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,gBAAgB,CAC3B,EAAW,EACX,SAAmB,EACnB,WAAqB;IAErB,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC5E,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,OAAO,CAC3B;QACI,UAAU,EAAE,mBAAmB;QAC/B,WAAW,EAAE,4BAA4B,MAAM,GAAG;QAClD,OAAO,EAAE,qBAAqB;QAC9B,UAAU,EAAE,eAAe;KAC9B,EACD,WAAW,CACd,CAAC;IACF,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QAClB,OAAO,IAAI,GAAG,EAAE,CAAC;IACrB,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,GAAG,EAA8B,CAAC;IACrD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC;QACrC,MAAM,QAAQ,GAAG,GAAG,CAAC,oBAAoB,CAAC;QAC1C,IAAI,CAAC,QAAQ,IAAI,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YACpC,SAAS,CAAC,uCAAuC;QACrD,CAAC;QACD,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IAC9B,CAAC;IAED,yDAAyD;IACzD,KAAK,MAAM,CAAC,QAAQ,EAAE,GAAG,CAAC,IAAI,MAAM,EAAE,CAAC;QACnC,IAAI,CAAC,qBAAqB,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YAC9C,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC5B,CAAC;IACL,CAAC;IACD,OAAO,MAAM,CAAC;AAClB,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,sBAAsB,CACjC,EAAW,EACX,eAAyB,EACzB,WAAqB;IAErB,MAAM,MAAM,GAAG,IAAI,GAAG,EAAoB,CAAC;IAC3C,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/B,OAAO,MAAM,CAAC;IAClB,CAAC;IACD,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAChG,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,OAAO,CAC3B;QACI,UAAU,EAAE,mBAAmB;QAC/B,WAAW,EAAE,UAAU,MAAM,GAAG;QAChC,MAAM,EAAE,CAAC,IAAI,EAAE,QAAQ,CAAC;QACxB,UAAU,EAAE,QAAQ;KACvB,EACD,WAAW,CACd,CAAC;IACF,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QAClB,OAAO,MAAM,CAAC;IAClB,CAAC;IACD,MAAM,KAAK,GAAG,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC;IACvC,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC;QACrC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC;YACd,SAAS;QACb,CAAC;QACD,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;QAC3D,IAAI,IAAI,EAAE,CAAC;YACP,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;QAC7B,CAAC;IACL,CAAC;IACD,OAAO,MAAM,CAAC;AAClB,CAAC"}

package/dist/generic/PushStatusResolver.d.ts

@@ -22,7 +22,45 @@ export interface PushStatusNotificationPayload {
     sessionId: string;
     /** Authenticated user the update belongs to. Server-side filter key; never sent to the client. */
     ownerUserId: string;
+    /**
+     * `MJGlobal.ProcessUUID` of the instance that first published this update. Used only for
+     * cross-instance echo suppression: an instance that receives its own message back from the
+     * message bus must drop it, or every push is delivered twice.
+     */
+    SourceServerId?: string;
 }
+/** Receives every locally-published status update, for fan-out to other server instances. */
+export type PushStatusPublishHook = (payload: PushStatusNotificationPayload) => void;
+/**
+ * Register (or clear, with no arg) the cross-instance fan-out hook.
+ *
+ * Inversion of control, deliberately: this module must not know that Redis exists. The server
+ * registers the hook at startup only when a message bus is configured, so a single-instance
+ * deployment behaves exactly as before.
+ */
+export declare function SetPushStatusPublishHook(hook?: PushStatusPublishHook): void;
+/**
+ * Validate an update received from the cross-instance message bus.
+ *
+ * The bus carries messages from other processes, so every field is type-checked before the update
+ * is republished onto the local topic, where {@link StatusUpdatesFilter} compares `ownerUserId`
+ * with the connection's user.
+ *
+ * @param raw The JSON text taken off the bus.
+ * @param localServerId This process's `MJGlobal.ProcessUUID`, used to drop our own echo.
+ * @returns The update to republish, or `null` to drop it.
+ */
+export declare function ParseReplicatedStatusUpdate(raw: string, localServerId: string): PushStatusNotificationPayload | null;
+/**
+ * Whether an update is worth sending to other server instances.
+ *
+ * Streaming content is excluded. It arrives at hundreds of messages per second and each one carries
+ * a full serialized agent run, so replicating it would cost far more bandwidth than the delivery it
+ * buys — and a token delta is worthless to a client that has already missed the ones before it.
+ * Progress and completion are low-rate and each is individually meaningful, which is exactly the
+ * kind of message that must survive landing on the wrong replica.
+ */
+export declare function ShouldReplicateStatusUpdate(message?: string): boolean;
 interface PushStatusNotificationArgs {
     sessionId: string;
 }

package/dist/generic/PushStatusResolver.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"PushStatusResolver.d.ts","sourceRoot":"","sources":["../../src/generic/PushStatusResolver.ts"],"names":[],"mappings":"AAAA,OAAO,EAA8B,YAAY,EAAoD,MAAM,cAAc,CAAC;AAE1H,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C,eAAO,MAAM,yBAAyB,wBAAwB,CAAC;AAE/D,qBACa,sBAAsB;IAEjC,OAAO,CAAC,EAAE,MAAM,CAAC;IAGjB,IAAI,EAAG,IAAI,CAAC;IAGZ,SAAS,EAAG,MAAM,CAAC;CACpB;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,6BAA6B;IAC5C,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,kGAAkG;IAClG,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,UAAU,0BAA0B;IAClC,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,mGAAmG;AACnG,MAAM,WAAW,kBAAkB;IACjC,0FAA0F;IAC1F,SAAS,EAAE,MAAM,CAAC;IAClB,0FAA0F;IAC1F,WAAW,EAAE,MAAM,CAAC;IACpB,mGAAmG;IACnG,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,kBAAkB,GAAG,IAAI,CAO1F;AAED,mDAAmD;AACnD,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,kBAAkB,GAAG,IAAI,CAE1F;AAED,mFAAmF;AACnF,MAAM,WAAW,0BAA0B;IACzC,WAAW,CAAC,EAAE,WAAW,CAAC;CAC3B;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE;IACxC,OAAO,EAAE,6BAA6B,CAAC;IACvC,IAAI,EAAE,0BAA0B,CAAC;IACjC,OAAO,EAAE,0BAA0B,GAAG,SAAS,CAAC;CACjD,GAAG,OAAO,CAUV;AAED,mDAAmD;AACnD,wBAAgB,mBAAmB,CAAC,IAAI,EAAE;IACxC,OAAO,EAAE,6BAA6B,CAAC;IACvC,IAAI,EAAE,0BAA0B,CAAC;IACjC,OAAO,EAAE,0BAA0B,GAAG,SAAS,CAAC;CACjD,GAAG,OAAO,CAEV;AAED,qBACa,kBAAkB;IAM7B,aAAa,CAAG,mIAAmI;IACzI,EAAE,OAAO,EAAE,EAAE,6BAA6B,EAClB,SAAS,EAAE,MAAM,GAChD,sBAAsB;CAI1B"}
+{"version":3,"file":"PushStatusResolver.d.ts","sourceRoot":"","sources":["../../src/generic/PushStatusResolver.ts"],"names":[],"mappings":"AAAA,OAAO,EAA8B,YAAY,EAAoD,MAAM,cAAc,CAAC;AAE1H,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C,eAAO,MAAM,yBAAyB,wBAAwB,CAAC;AAE/D,qBACa,sBAAsB;IAEjC,OAAO,CAAC,EAAE,MAAM,CAAC;IAGjB,IAAI,EAAG,IAAI,CAAC;IAGZ,SAAS,EAAG,MAAM,CAAC;CACpB;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,6BAA6B;IAC5C,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,kGAAkG;IAClG,WAAW,EAAE,MAAM,CAAC;IACpB;;;;OAIG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,6FAA6F;AAC7F,MAAM,MAAM,qBAAqB,GAAG,CAAC,OAAO,EAAE,6BAA6B,KAAK,IAAI,CAAC;AAIrF;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,CAAC,EAAE,qBAAqB,GAAG,IAAI,CAE3E;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,2BAA2B,CAAC,GAAG,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,6BAA6B,GAAG,IAAI,CAyBpH;AAED;;;;;;;;GAQG;AACH,wBAAgB,2BAA2B,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAYrE;AAED,UAAU,0BAA0B;IAClC,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,mGAAmG;AACnG,MAAM,WAAW,kBAAkB;IACjC,0FAA0F;IAC1F,SAAS,EAAE,MAAM,CAAC;IAClB,0FAA0F;IAC1F,WAAW,EAAE,MAAM,CAAC;IACpB,mGAAmG;IACnG,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,kBAAkB,GAAG,IAAI,CAoB1F;AAED,mDAAmD;AACnD,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,kBAAkB,GAAG,IAAI,CAE1F;AAED,mFAAmF;AACnF,MAAM,WAAW,0BAA0B;IACzC,WAAW,CAAC,EAAE,WAAW,CAAC;CAC3B;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE;IACxC,OAAO,EAAE,6BAA6B,CAAC;IACvC,IAAI,EAAE,0BAA0B,CAAC;IACjC,OAAO,EAAE,0BAA0B,GAAG,SAAS,CAAC;CACjD,GAAG,OAAO,CAUV;AAED,mDAAmD;AACnD,wBAAgB,mBAAmB,CAAC,IAAI,EAAE;IACxC,OAAO,EAAE,6BAA6B,CAAC;IACvC,IAAI,EAAE,0BAA0B,CAAC;IACjC,OAAO,EAAE,0BAA0B,GAAG,SAAS,CAAC;CACjD,GAAG,OAAO,CAEV;AAED,qBACa,kBAAkB;IAM7B,aAAa,CAAG,mIAAmI;IACzI,EAAE,OAAO,EAAE,EAAE,6BAA6B,EAClB,SAAS,EAAE,MAAM,GAChD,sBAAsB;CAI1B"}

package/dist/generic/PushStatusResolver.js

@@ -11,7 +11,7 @@ var __param = (this && this.__param) || function (paramIndex, decorator) {
     return function (target, key) { decorator(target, key, paramIndex); }
 };
 import { Arg, Field, ID, ObjectType, Resolver, Root, Subscription } from 'type-graphql';
-import { UUIDsEqual } from '@memberjunction/global';
+import { MJGlobal, UUIDsEqual } from '@memberjunction/global';
 export const PUSH_STATUS_UPDATES_TOPIC = 'PUSH_STATUS_UPDATES';
 let PushStatusNotification = class PushStatusNotification {
 };
@@ -31,6 +31,76 @@ PushStatusNotification = __decorate([
     ObjectType()
 ], PushStatusNotification);
 export { PushStatusNotification };
+let _publishHook;
+/**
+ * Register (or clear, with no arg) the cross-instance fan-out hook.
+ *
+ * Inversion of control, deliberately: this module must not know that Redis exists. The server
+ * registers the hook at startup only when a message bus is configured, so a single-instance
+ * deployment behaves exactly as before.
+ */
+export function SetPushStatusPublishHook(hook) {
+    _publishHook = hook;
+}
+/**
+ * Validate an update received from the cross-instance message bus.
+ *
+ * The bus carries messages from other processes, so every field is type-checked before the update
+ * is republished onto the local topic, where {@link StatusUpdatesFilter} compares `ownerUserId`
+ * with the connection's user.
+ *
+ * @param raw The JSON text taken off the bus.
+ * @param localServerId This process's `MJGlobal.ProcessUUID`, used to drop our own echo.
+ * @returns The update to republish, or `null` to drop it.
+ */
+export function ParseReplicatedStatusUpdate(raw, localServerId) {
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        return null;
+    }
+    if (typeof parsed !== 'object' || parsed === null) {
+        return null;
+    }
+    const { sessionId, ownerUserId, message, SourceServerId } = parsed;
+    const source = typeof SourceServerId === 'string' ? SourceServerId : undefined;
+    const body = typeof message === 'string' ? message : undefined;
+    if ((SourceServerId != null && source === undefined) || (message != null && body === undefined)) {
+        return null; // a present field of the wrong type
+    }
+    if (source === localServerId) {
+        return null; // our own message, echoed back
+    }
+    if (typeof sessionId !== 'string' || !sessionId || typeof ownerUserId !== 'string' || !ownerUserId) {
+        return null; // fail closed: an update with no valid identity can never be routed safely
+    }
+    return { sessionId, ownerUserId, message: body, SourceServerId: source };
+}
+/**
+ * Whether an update is worth sending to other server instances.
+ *
+ * Streaming content is excluded. It arrives at hundreds of messages per second and each one carries
+ * a full serialized agent run, so replicating it would cost far more bandwidth than the delivery it
+ * buys — and a token delta is worthless to a client that has already missed the ones before it.
+ * Progress and completion are low-rate and each is individually meaningful, which is exactly the
+ * kind of message that must survive landing on the wrong replica.
+ */
+export function ShouldReplicateStatusUpdate(message) {
+    if (!message) {
+        return false;
+    }
+    try {
+        const parsed = JSON.parse(message);
+        const type = parsed?.type;
+        return type !== 'StreamingContent';
+    }
+    catch {
+        // A plain-string message (not the resolvers' JSON envelope) is rare and low-rate. Replicate it.
+        return true;
+    }
+}
 /**
  * The single, centralized vehicle for publishing on {@link PUSH_STATUS_UPDATES_TOPIC}. Every
  * publisher — resolver or service — routes through here (resolvers via the
@@ -43,8 +113,21 @@ export function PublishStatusUpdate(pubSub, params) {
         sessionId: params.sessionId,
         ownerUserId: params.ownerUserId,
         message: params.message,
+        SourceServerId: MJGlobal.Instance.ProcessUUID,
     };
     pubSub.publish(PUSH_STATUS_UPDATES_TOPIC, payload);
+    // Fan out to other instances. Only reached by updates originating HERE: a message arriving from
+    // the bus is republished straight onto the local topic and never comes back through this
+    // function, so there is no loop to break beyond the SourceServerId check on the receiving side.
+    if (_publishHook && ShouldReplicateStatusUpdate(params.message)) {
+        try {
+            _publishHook(payload);
+        }
+        catch {
+            // Fan-out is an optimization over the durable tail query. A message bus that is down must
+            // never break local delivery, which is the path that works for the common case.
+        }
+    }
 }
 /** @deprecated Use {@link PublishStatusUpdate}. */
 export function publishStatusUpdate(pubSub, params) {

package/dist/generic/PushStatusResolver.js.map

@@ -1 +1 @@
-{"version":3,"file":"PushStatusResolver.js","sourceRoot":"","sources":["../../src/generic/PushStatusResolver.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE,UAAU,EAAgB,QAAQ,EAAsB,IAAI,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC1H,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAGpD,MAAM,CAAC,MAAM,yBAAyB,GAAG,qBAAqB,CAAC;AAGxD,IAAM,sBAAsB,GAA5B,MAAM,sBAAsB;CASlC,CAAA;AAPC;IADC,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;uDACvB;AAGjB;IADC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC;8BAChB,IAAI;oDAAC;AAGZ;IADC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,EAAE,CAAC;;yDACF;AARR,sBAAsB;IADlC,UAAU,EAAE;GACA,sBAAsB,CASlC;;AAkCD;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAAoB,EAAE,MAA0B;IAClF,MAAM,OAAO,GAAkC;QAC7C,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,OAAO,EAAE,MAAM,CAAC,OAAO;KACxB,CAAC;IACF,MAAM,CAAC,OAAO,CAAC,yBAAyB,EAAE,OAAO,CAAC,CAAC;AACrD,CAAC;AAED,mDAAmD;AACnD,MAAM,UAAU,mBAAmB,CAAC,MAAoB,EAAE,MAA0B;IAClF,OAAO,mBAAmB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AAC7C,CAAC;AAOD;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAInC;IACC,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;IACxC,IAAI,OAAO,CAAC,SAAS,KAAK,IAAI,CAAC,SAAS,EAAE,CAAC;QACzC,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,gBAAgB,GAAuB,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,EAAE,CAAC;IAClF,IAAI,CAAC,gBAAgB,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;QAC9C,OAAO,KAAK,CAAC,CAAC,6DAA6D;IAC7E,CAAC;IACD,OAAO,UAAU,CAAC,OAAO,CAAC,WAAW,EAAE,gBAAgB,CAAC,CAAC;AAC3D,CAAC;AAED,mDAAmD;AACnD,MAAM,UAAU,mBAAmB,CAAC,IAInC;IACC,OAAO,mBAAmB,CAAC,IAAI,CAAC,CAAC;AACnC,CAAC;AAGM,IAAM,kBAAkB,GAAxB,MAAM,kBAAkB;IAM7B,aAAa,CACH,EAAE,OAAO,EAAiC,EAClB,SAAiB;QAEjD,yFAAyF;QACzF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,IAAI,EAAE,EAAE,SAAS,EAAE,CAAC;IAClD,CAAC;CACF,CAAA;AAPC;IALC,YAAY,CAAC,GAAG,EAAE,CAAC,sBAAsB,EAAE;QAC1C,MAAM,EAAE,yBAAyB;QACjC,MAAM,EAAE,CAAC,IAA+G,EAAE,EAAE,CAC1H,mBAAmB,CAAC,IAAI,CAAC;KAC5B,CAAC;IAEC,WAAA,IAAI,EAAE,CAAA;IACN,WAAA,GAAG,CAAC,WAAW,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,CAAA;;;oCAC9B,sBAAsB;uDAGxB;AAZU,kBAAkB;IAD9B,QAAQ,EAAE;GACE,kBAAkB,CAa9B"}
+{"version":3,"file":"PushStatusResolver.js","sourceRoot":"","sources":["../../src/generic/PushStatusResolver.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE,UAAU,EAAgB,QAAQ,EAAsB,IAAI,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC1H,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAG9D,MAAM,CAAC,MAAM,yBAAyB,GAAG,qBAAqB,CAAC;AAGxD,IAAM,sBAAsB,GAA5B,MAAM,sBAAsB;CASlC,CAAA;AAPC;IADC,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;uDACvB;AAGjB;IADC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC;8BAChB,IAAI;oDAAC;AAGZ;IADC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,EAAE,CAAC;;yDACF;AARR,sBAAsB;IADlC,UAAU,EAAE;GACA,sBAAsB,CASlC;;AA6BD,IAAI,YAA+C,CAAC;AAEpD;;;;;;GAMG;AACH,MAAM,UAAU,wBAAwB,CAAC,IAA4B;IACnE,YAAY,GAAG,IAAI,CAAC;AACtB,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,2BAA2B,CAAC,GAAW,EAAE,aAAqB;IAC5E,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QAClD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,OAAO,EAAE,cAAc,EAAE,GAAG,MAAiC,CAAC;IAC9F,MAAM,MAAM,GAAG,OAAO,cAAc,KAAK,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS,CAAC;IAC/E,MAAM,IAAI,GAAG,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;IAC/D,IAAI,CAAC,cAAc,IAAI,IAAI,IAAI,MAAM,KAAK,SAAS,CAAC,IAAI,CAAC,OAAO,IAAI,IAAI,IAAI,IAAI,KAAK,SAAS,CAAC,EAAE,CAAC;QAChG,OAAO,IAAI,CAAC,CAAC,oCAAoC;IACnD,CAAC;IACD,IAAI,MAAM,KAAK,aAAa,EAAE,CAAC;QAC7B,OAAO,IAAI,CAAC,CAAC,+BAA+B;IAC9C,CAAC;IACD,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,CAAC,SAAS,IAAI,OAAO,WAAW,KAAK,QAAQ,IAAI,CAAC,WAAW,EAAE,CAAC;QACnG,OAAO,IAAI,CAAC,CAAC,2EAA2E;IAC1F,CAAC;IAED,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,MAAM,EAAE,CAAC;AAC3E,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,2BAA2B,CAAC,OAAgB;IAC1D,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC5C,MAAM,IAAI,GAAI,MAA6B,EAAE,IAAI,CAAC;QAClD,OAAO,IAAI,KAAK,kBAAkB,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,gGAAgG;QAChG,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAgBD;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAAoB,EAAE,MAA0B;IAClF,MAAM,OAAO,GAAkC;QAC7C,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,cAAc,EAAE,QAAQ,CAAC,QAAQ,CAAC,WAAW;KAC9C,CAAC;IACF,MAAM,CAAC,OAAO,CAAC,yBAAyB,EAAE,OAAO,CAAC,CAAC;IAEnD,gGAAgG;IAChG,yFAAyF;IACzF,gGAAgG;IAChG,IAAI,YAAY,IAAI,2BAA2B,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;QAChE,IAAI,CAAC;YACH,YAAY,CAAC,OAAO,CAAC,CAAC;QACxB,CAAC;QAAC,MAAM,CAAC;YACP,0FAA0F;YAC1F,gFAAgF;QAClF,CAAC;IACH,CAAC;AACH,CAAC;AAED,mDAAmD;AACnD,MAAM,UAAU,mBAAmB,CAAC,MAAoB,EAAE,MAA0B;IAClF,OAAO,mBAAmB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AAC7C,CAAC;AAOD;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAInC;IACC,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;IACxC,IAAI,OAAO,CAAC,SAAS,KAAK,IAAI,CAAC,SAAS,EAAE,CAAC;QACzC,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,gBAAgB,GAAuB,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,EAAE,CAAC;IAClF,IAAI,CAAC,gBAAgB,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;QAC9C,OAAO,KAAK,CAAC,CAAC,6DAA6D;IAC7E,CAAC;IACD,OAAO,UAAU,CAAC,OAAO,CAAC,WAAW,EAAE,gBAAgB,CAAC,CAAC;AAC3D,CAAC;AAED,mDAAmD;AACnD,MAAM,UAAU,mBAAmB,CAAC,IAInC;IACC,OAAO,mBAAmB,CAAC,IAAI,CAAC,CAAC;AACnC,CAAC;AAGM,IAAM,kBAAkB,GAAxB,MAAM,kBAAkB;IAM7B,aAAa,CACH,EAAE,OAAO,EAAiC,EAClB,SAAiB;QAEjD,yFAAyF;QACzF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,IAAI,EAAE,EAAE,SAAS,EAAE,CAAC;IAClD,CAAC;CACF,CAAA;AAPC;IALC,YAAY,CAAC,GAAG,EAAE,CAAC,sBAAsB,EAAE;QAC1C,MAAM,EAAE,yBAAyB;QACjC,MAAM,EAAE,CAAC,IAA+G,EAAE,EAAE,CAC1H,mBAAmB,CAAC,IAAI,CAAC;KAC5B,CAAC;IAEC,WAAA,IAAI,EAAE,CAAA;IACN,WAAA,GAAG,CAAC,WAAW,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,CAAA;;;oCAC9B,sBAAsB;uDAGxB;AAZU,kBAAkB;IAD9B,QAAQ,EAAE;GACE,kBAAkB,CAa9B"}

package/dist/generic/ResolverBase.d.ts

@@ -1,4 +1,4 @@
-import { AggregateExpression, BaseEntity, CompositeKey, DatabaseProviderBase, EntityInfo, EntityPermissionType, IMetadataProvider, RecordChangeFieldSecurityProjector, RunViewResult, UserInfo } from '@memberjunction/core';
+import { AggregateExpression, BaseEntity, CompositeKey, DatabaseProviderBase, EntityFieldInfo, EntityInfo, EntityPermissionType, IMetadataProvider, RecordChangeFieldSecurityProjector, RunViewResult, UserInfo } from '@memberjunction/core';
 import { MJUserViewEntityExtended } from '@memberjunction/core-entities';
 import { PubSubEngine } from 'type-graphql';
 import { RunViewGenericParams, UserPayload } from '../types.js';
@@ -169,7 +169,24 @@ export declare class ResolverBase {
      * into the view. Subqueries against another entity's BaseView therefore do not inherit that
      * entity's RLS; they are still restricted to the view (not the table).
      */
-    protected assertClientClauseUsesEntityBaseViews(clause: string | undefined | null, label: string, provider?: IMetadataProvider): void;
+    protected assertClientClauseUsesEntityBaseViews(clause: string | undefined | null, label: string, provider?: IMetadataProvider, user?: UserInfo): void;
+    /**
+     * SECURITY — screen for a FULL client-supplied SQL statement (ad-hoc query path). In addition
+     * to the SELECT-only validation the caller performs, every table reference must resolve to an
+     * entity BaseView the acting user can read UNSCOPED. CTE names defined by the statement itself
+     * are excluded from the check. Fails closed: no user, or an unresolvable reference, refuses.
+     *
+     * Entity CanRead is not unscoped base-view read authority: RunView narrows a granted read with
+     * row-level security and denied-field projection, and raw SQL applies neither. Rather than try
+     * to rewrite arbitrary SQL (joins, CTEs) to compose that policy, this refuses any entity that
+     * carries a row filter or a denied field for the caller — those reads belong on RunView. For
+     * the remaining entities CanRead genuinely means "every row and field of the view".
+     */
+    protected assertFullQueryUsesReadableEntityViews(sqlText: string, provider: IMetadataProvider | undefined, user: UserInfo | undefined, label?: string): void;
+    /** Refuses an entity whose read is narrowed for this user by row-level security or field-level denials. */
+    private assertUnscopedRead;
+    /** Walks a parsed AST collecting the names of CTEs the statement itself defines. */
+    private collectCTENames;
     /**
      * Applies {@link assertClientClauseUsesEntityBaseViews} to every client-supplied clause
      * a view request can carry that is actually a SQL fragment. GraphQL entry points
@@ -197,19 +214,42 @@ export declare class ResolverBase {
         orderBy?: string | null;
         userSearchString?: string | null;
         overrideExcludeFilter?: string | null;
-    }, provider?: IMetadataProvider): void;
+    }, provider?: IMetadataProvider, user?: UserInfo): void;
     /** Same write-node walk as EDS `sqlReadOnlyScreen.astContainsWriteNode`. */
     private astContainsWriteNode;
     private static readonly WRITE_NODE_TYPES;
     private dialectForProvider;
+    /** True for a reference with no schema — which `SQLParser.ExtractTableRefs` reports as `dbo`. */
+    private isUnqualifiedSchema;
     private stripSqlIdent;
+    /**
+     * `bare` maps an unqualified view name to its entity, or to `null` when the name exists in
+     * more than one schema — the database, not this screen, would decide which one runs.
+     */
     private entityBaseViewAllowList;
+    /**
+     * SECURITY — resolves a table reference against the entity BaseView allow-list and, when an
+     * acting user is supplied, additionally requires that user to hold CanRead on the referenced
+     * entity. Base views do not embed RLS and entity permissions are otherwise checked only on
+     * the TOP entity of a request, so without this check a subquery (or ad-hoc query) could read
+     * entities the caller has no read grant on.
+     *
+     * A schema-qualified reference must match that exact schema — `secret.vwFoo` never resolves
+     * through another schema's `vwFoo`. An unqualified reference resolves only when the view name
+     * is unique across schemas; an ambiguous one must be qualified, because the database's
+     * default-schema resolution, not this screen, would pick which view actually runs.
+     *
+     * `SQLParser.ExtractTableRefs` reports an unqualified reference as schema `dbo`, so `dbo` is
+     * indistinguishable from "no schema" here and both take the unqualified path (an exact
+     * `dbo.<view>` entity wins first).
+     */
+    private assertTableRefReadable;
     /**
      * Optimized RunViewGenericInternal implementation with:
      * - Field filtering at source (Fix #7)
      * - Improved error handling (Fix #9)
      */
-    protected RunViewGenericInternal(provider: DatabaseProviderBase, viewInfo: MJUserViewEntityExtended, extraFilter: string, orderBy: string, userSearchString: string, excludeUserViewRunID: string | undefined, overrideExcludeFilter: string | undefined, saveViewResults: boolean | undefined, fields: string[] | undefined, ignoreMaxRows: boolean | undefined, excludeDataFromAllPriorViewRuns: boolean | undefined, forceAuditLog: boolean | undefined, auditLogDescription: string | undefined, resultType: string | undefined, userPayload: UserPayload | null, maxRows: number | undefined, startRow: number | undefined, aggregates?: AggregateExpression[], afterKey?: CompositeKey, bypassCache?: boolean, dataSource?: 'Live' | 'Materialized'): Promise<RunViewResult<any>>;
+    protected RunViewGenericInternal(provider: DatabaseProviderBase, viewInfo: MJUserViewEntityExtended, extraFilter: string, orderBy: string, userSearchString: string, excludeUserViewRunID: string | undefined, overrideExcludeFilter: string | undefined, saveViewResults: boolean | undefined, fields: string[] | undefined, ignoreMaxRows: boolean | undefined, excludeDataFromAllPriorViewRuns: boolean | undefined, forceAuditLog: boolean | undefined, auditLogDescription: string | undefined, resultType: string | undefined, userPayload: UserPayload | null, maxRows: number | undefined, startRow: number | undefined, aggregates?: AggregateExpression[], afterKey?: CompositeKey, bypassCache?: boolean, dataSource?: 'Live' | 'Materialized', includeBinaryFields?: boolean): Promise<RunViewResult<any>>;
     /**
      * Optimized implementation that:
      * 1. Fetches user info only once (fixes N+1 query)
@@ -301,6 +341,11 @@ export declare class ResolverBase {
      *
      * Ordered so the boolean flag is evaluated last: the extra load lands only on entities that have
      * the feature switched on, which is almost none of them.
+     *
+     * `MJ: Record Changes` always loads from the database: its server class allows an update only when
+     * Comments is the one dirty field, and "dirty" compared against client-supplied OldValues lets a
+     * caller pin forged audit columns as both old and new values. It doesn't track its own changes, so
+     * nothing else forces the load.
      */
     protected MustLoadTruthFromDatabase(entityInfo: EntityInfo, input: {
         OldValues___?: Array<{
@@ -362,6 +407,13 @@ export declare class ResolverBase {
             Value: unknown;
         }>;
     } & Record<string, unknown>, clientNewValues: Record<string, unknown>, provider?: IMetadataProvider): boolean;
+    /**
+     * Converts one client-sent old value (always a string on the wire; dates as epoch milliseconds,
+     * the GraphQL Timestamp form) to the field's TypeScript type, so it compares equal to the stored
+     * value. Both the OldValues comparison and the load-from-OldValues path use it: without it a date
+     * old value becomes an Invalid Date and an unchanged date field reads as edited.
+     */
+    protected ClientOldValueToFieldValue(field: EntityFieldInfo | undefined, raw: unknown): string | number | boolean | Date | null;
     /**
      * This routine compares the OldValues property in the input object to the values in the DB that we just loaded. If there are differences, we need to check to see if the client
      * is trying to update any of those fields (e.g. overlap). If there is overlap, we throw an error. If there is no overlap, we can proceed with the update even if the DB Values