@memberjunction/server 6.2.0-edge.4 → 6.2.0-edge.6

package/dist/generic/CacheInvalidationResolver.d.ts

@@ -1,3 +1,5 @@
+import 'reflect-metadata';
+import { EntityInfo } from '@memberjunction/core';
 export declare const CACHE_INVALIDATION_TOPIC = "CACHE_INVALIDATION";
 /**
  * Supply the configured allowlist. Called once from the server entry point during bootstrap.
@@ -15,17 +17,23 @@ export declare function ConfigureRecordDataBroadcast(entities: readonly string[]
  *
  * The subscription below is filtered only by ENTITY-level read permission, so anything included
  * here is disclosed to every signed-in session that may read the entity at all — regardless of
- * row-level security or any tenant scoping a consumer applies on the read path, neither of which
- * this push traverses. The answer is therefore NO unless a deployment has explicitly opted the
- * entity in via `cacheSettings.recordDataBroadcastEntities`.
+ * row-level security, field-level security, or any tenant scoping a consumer applies on the read
+ * path, none of which this push traverses. The answer is therefore NO unless a deployment has
+ * explicitly opted the entity in via `cacheSettings.recordDataBroadcastEntities`, and always NO
+ * for an entity under field-level security (its own flag or an IS-A ancestor's), and for
+ * `MJ: Record Changes`, whatever the allowlist says: the row would carry columns (or, for Record
+ * Changes, other entities' values) some of those sessions may not read.
  *
  * Callers that get `false` simply omit `recordData`; the event still carries the entity name and
  * primary key, so clients evict and re-fetch through the normal access-controlled read path.
  *
  * Matching is exact (trimmed, case-insensitive) rather than substring: a loose match would let an
  * allowlisted name drag in every entity whose name contains it.
+ *
+ * @param entityInfo The entity's metadata, when the caller holds it. Otherwise it is looked up by
+ *   name, so the field-security refusal applies either way.
  */
-export declare function MayBroadcastRecordData(entityName: string): boolean;
+export declare function MayBroadcastRecordData(entityName: string, entityInfo?: EntityInfo | null): boolean;
 export declare class CacheInvalidationNotification {
     EntityName: string;
     PrimaryKeyValues?: string;
@@ -34,6 +42,22 @@ export declare class CacheInvalidationNotification {
     Timestamp: Date;
     OriginSessionID?: string;
     RecordData?: string;
+    Sequence?: number;
+}
+export declare class CacheInvalidationCatchUpResult {
+    RequiresFullRefresh: boolean;
+    CurrentSequence: number;
+    ServerProcessID: string;
+    Events: CacheInvalidationNotification[];
+}
+export declare class CacheBroadcastConnectionToken {
+    Provider: string;
+    Url: string;
+    Token?: string;
+    Groups: string[];
+    ExpiresAt: string;
+    ServerProcessID: string;
+    CurrentSequence: number;
 }
 /**
  * Payload interface for publishing cache invalidation events.
@@ -47,6 +71,7 @@ export interface CacheInvalidationPayload {
     timestamp: Date;
     originSessionId?: string;
     recordData?: string;
+    sequence?: number;
 }
 /**
  * What the subscription filter needs off the WS connection.
@@ -75,13 +100,51 @@ export interface CacheInvalidationFilterContext {
  * see the class docblock below.
  *
  * `GetUserPermisions` is an in-memory match of the entity's permission rows against the user's
- * roles, so this stays cheap enough to run per subscriber per event. It is not free: it runs for
- * every connected socket on every save, so keep it free of I/O.
+ * roles, memoized per `(payload, entityName, roleFingerprint)` by the active
+ * {@link BaseCacheInvalidationBroadcastProvider} so $N$ connected subscribers sharing $R$ role
+ * combinations only run `GetUserPermisions` $R$ times per event.
  */
 export declare function CacheInvalidationFilter(data: {
     payload: CacheInvalidationPayload;
     context: CacheInvalidationFilterContext | undefined;
 }): boolean;
+/** The part of a permission row and of a user this module reads, so the rule can be tested on plain objects. */
+export interface ReadPermissionRow {
+    RoleID: string;
+    CanRead: boolean | null;
+    /** `Deny` rows subtract; they never carry the read the rule looks at. */
+    IsDeny?: boolean;
+    Type?: string | null;
+    ReadRLSFilterID: string | null;
+}
+export interface RoleHolder {
+    UserRoles?: ReadonlyArray<{
+        RoleID: string;
+    }> | null;
+}
+/**
+ * Is this user's read of the entity row-filtered? True when every read the user holds on the entity comes through a permission
+ * row that carries a `ReadRLSFilterID`: there is a row-level security filter between them and the rows, so a record's key, its
+ * existence and when it changed are not theirs to learn unless the row passes the filter — which a subscription filter cannot
+ * evaluate per event. False when any of their read rows is unfiltered (they could read the row anyway), and false when they hold
+ * no read at all (the entity-level filter has already withheld the event).
+ *
+ * The same in-memory match `GetUserPermisions` does, with no I/O, so it can run per subscriber per event.
+ */
+export declare function ReadIsRowFiltered(entity: {
+    Permissions: ReadonlyArray<ReadPermissionRow>;
+}, user: RoleHolder): boolean;
+/**
+ * The event as one subscriber may see it. A subscriber whose read of the entity is row-filtered gets the entity, the action and
+ * the time, and neither the key nor the row: "something in this entity changed", which the client already takes as a
+ * whole-entity invalidation (a null key on `remote-invalidate`). Everyone else gets the event as published.
+ *
+ * Memoized per `(payload, entity, roleFingerprint)` via the active broadcast provider so $N$ subscribers
+ * sharing $R$ role buckets only allocate and evaluate `ReadIsRowFiltered` $R$ times per event.
+ */
+export declare function ShapeCacheInvalidationEvent(payload: CacheInvalidationPayload, user: RoleHolder | undefined, entity: {
+    Permissions: ReadonlyArray<ReadPermissionRow>;
+} | null | undefined): CacheInvalidationNotification;
 /** @deprecated Use {@link CacheInvalidationFilter}. */
 export declare function cacheInvalidationFilter(data: {
     payload: CacheInvalidationPayload;
@@ -92,31 +155,23 @@ export declare class CacheInvalidationResolver {
      * Subscription that broadcasts cache invalidation events to connected clients, so cross-server
      * cache invalidation reaches browsers.
      *
-     * Delivery is filtered only by ENTITY-level read permission (see {@link CacheInvalidationFilter}).
-     * Every session that may read an entity at all still receives every event for it, from every
-     * other session and tenant.
-     *
-     * Because that narrowing stops well short of row level, `RecordData` is only populated for entities a
-     * deployment has opted in through `cacheSettings.recordDataBroadcastEntities` — see
-     * {@link MayBroadcastRecordData}, applied at both publish sites.
-     *
-     * `EntityName`, `PrimaryKeyValues`, `Action` and `Timestamp` ARE still broadcast to every
-     * session, and that is a disclosure, not a safe residue. An earlier version of this comment
-     * called them "safe to broadcast" on the grounds that reading the record still goes through
-     * the access-controlled path — true of the row's CONTENTS, and beside the point for the
-     * metadata itself. A session with no relationship to a record still learns that it exists,
-     * its stable key, and every time it changes; across entities it learns the cadence and volume
-     * of another tenant's activity.
-     *
-     * The key is kept deliberately, because consumers need it to re-read the record they were
-     * told about (see `ResolveEntityEventKey` in @memberjunction/core) and because the alternative
-     * — a coarse "something in this entity changed" — forces whole-entity invalidation on the
-     * hottest write paths. That is a trade, not an absence of cost. Narrowing it means filtering
-     * delivery per subscriber, which needs an authorization predicate cheap enough to run per
-     * subscriber per event; entity-level permissions (`EntityInfo.GetUserPermisions`, an in-memory
-     * role match) would cover part of it, row-level tenancy would not.
+     * Delivery is filtered by ENTITY-level read permission (see {@link CacheInvalidationFilter})
+     * and shaped per role-fingerprint bucket (see {@link ShapeCacheInvalidationEvent}).
      */
     cacheInvalidation(// case-violation-ok-legacy-back-compat: the property name is the GraphQL schema field name — renaming it breaks every client query
-    payload: CacheInvalidationPayload): CacheInvalidationNotification;
+    payload: CacheInvalidationPayload, context: CacheInvalidationFilterContext | undefined): CacheInvalidationNotification;
+    /**
+     * Returns all permission-allowed, RLS-shaped cache invalidation events strictly after
+     * `sinceSequence` from the server's bounded circular ring buffer.
+     *
+     * Invoked by `GraphQLDataProvider` when an HTTP response's `X-MJ-Cache-Seq` header or a
+     * WebSocket reconnect reveals missed invalidation sequence numbers.
+     */
+    GetCacheInvalidationsSince(sinceSequence: number, context: CacheInvalidationFilterContext | undefined): CacheInvalidationCatchUpResult;
+    /**
+     * Negotiates a client broadcast connection (URL, signed token, and authorized role-bucket groups)
+     * for the active {@link BaseCacheInvalidationBroadcastProvider}.
+     */
+    NegotiateCacheBroadcastConnection(context: CacheInvalidationFilterContext | undefined): Promise<CacheBroadcastConnectionToken>;
 }
 //# sourceMappingURL=CacheInvalidationResolver.d.ts.map

package/dist/generic/CacheInvalidationResolver.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"CacheInvalidationResolver.d.ts","sourceRoot":"","sources":["../../src/generic/CacheInvalidationResolver.ts"],"names":[],"mappings":"AAGA,eAAO,MAAM,wBAAwB,uBAAuB,CAAC;AAS7D;;;;;;;;;GASG;AACH,wBAAgB,4BAA4B,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,GAAG,IAAI,GAAG,IAAI,CASjG;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,sBAAsB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAIlE;AAED,qBACa,6BAA6B;IAEtC,UAAU,EAAG,MAAM,CAAC;IAGpB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAG1B,MAAM,EAAG,MAAM,CAAC;IAGhB,cAAc,EAAG,MAAM,CAAC;IAGxB,SAAS,EAAG,IAAI,CAAC;IAGjB,eAAe,CAAC,EAAE,MAAM,CAAC;IAGzB,UAAU,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;;GAGG;AACH,MAAM,WAAW,wBAAwB;IACrC,UAAU,EAAE,MAAM,CAAC;IACnB,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,cAAc,EAAE,MAAM,CAAC;IACvB,SAAS,EAAE,IAAI,CAAC;IAChB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,8BAA8B;IAC3C,WAAW,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;CAC1C;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE;IAC1C,OAAO,EAAE,wBAAwB,CAAC;IAClC,OAAO,EAAE,8BAA8B,GAAG,SAAS,CAAC;CACvD,GAAG,OAAO,CA2BV;AAED,uDAAuD;AACvD,wBAAgB,uBAAuB,CAAC,IAAI,EAAE;IAC1C,OAAO,EAAE,wBAAwB,CAAC;IAClC,OAAO,EAAE,8BAA8B,GAAG,SAAS,CAAC;CACvD,GAAG,OAAO,CAEV;AAED,qBACa,yBAAyB;IAClC;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IAMH,iBAAiB,CAAG,mIAAmI;IAC3I,OAAO,EAAE,wBAAwB,GAC1C,6BAA6B;CAWnC"}
+{"version":3,"file":"CacheInvalidationResolver.d.ts","sourceRoot":"","sources":["../../src/generic/CacheInvalidationResolver.ts"],"names":[],"mappings":"AAAA,OAAO,kBAAkB,CAAC;AAE1B,OAAO,EAAE,UAAU,EAAmF,MAAM,sBAAsB,CAAC;AAKnI,eAAO,MAAM,wBAAwB,uBAAuB,CAAC;AAS7D;;;;;;;;;GASG;AACH,wBAAgB,4BAA4B,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,GAAG,IAAI,GAAG,IAAI,CASjG;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,sBAAsB,CAAC,UAAU,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,UAAU,GAAG,IAAI,GAAG,OAAO,CAMlG;AA2BD,qBACa,6BAA6B;IAEtC,UAAU,EAAG,MAAM,CAAC;IAGpB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAG1B,MAAM,EAAG,MAAM,CAAC;IAGhB,cAAc,EAAG,MAAM,CAAC;IAGxB,SAAS,EAAG,IAAI,CAAC;IAGjB,eAAe,CAAC,EAAE,MAAM,CAAC;IAGzB,UAAU,CAAC,EAAE,MAAM,CAAC;IAGpB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,qBACa,8BAA8B;IAEvC,mBAAmB,EAAG,OAAO,CAAC;IAG9B,eAAe,EAAG,MAAM,CAAC;IAGzB,eAAe,EAAG,MAAM,CAAC;IAGzB,MAAM,EAAG,6BAA6B,EAAE,CAAC;CAC5C;AAED,qBACa,6BAA6B;IAEtC,QAAQ,EAAG,MAAM,CAAC;IAGlB,GAAG,EAAG,MAAM,CAAC;IAGb,KAAK,CAAC,EAAE,MAAM,CAAC;IAGf,MAAM,EAAG,MAAM,EAAE,CAAC;IAGlB,SAAS,EAAG,MAAM,CAAC;IAGnB,eAAe,EAAG,MAAM,CAAC;IAGzB,eAAe,EAAG,MAAM,CAAC;CAC5B;AAED;;;GAGG;AACH,MAAM,WAAW,wBAAwB;IACrC,UAAU,EAAE,MAAM,CAAC;IACnB,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,cAAc,EAAE,MAAM,CAAC;IACvB,SAAS,EAAE,IAAI,CAAC;IAChB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,8BAA8B;IAC3C,WAAW,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;CAC1C;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE;IAC1C,OAAO,EAAE,wBAAwB,CAAC;IAClC,OAAO,EAAE,8BAA8B,GAAG,SAAS,CAAC;CACvD,GAAG,OAAO,CAUV;AAED,gHAAgH;AAChH,MAAM,WAAW,iBAAiB;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,OAAO,GAAG,IAAI,CAAC;IACxB,yEAAyE;IACzE,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;CAClC;AACD,MAAM,WAAW,UAAU;IACvB,SAAS,CAAC,EAAE,aAAa,CAAC;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,GAAG,IAAI,CAAC;CACxD;AAED;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE;IAAE,WAAW,EAAE,aAAa,CAAC,iBAAiB,CAAC,CAAA;CAAE,EAAE,IAAI,EAAE,UAAU,GAAG,OAAO,CAEtH;AAED;;;;;;;GAOG;AACH,wBAAgB,2BAA2B,CACvC,OAAO,EAAE,wBAAwB,EACjC,IAAI,EAAE,UAAU,GAAG,SAAS,EAC5B,MAAM,EAAE;IAAE,WAAW,EAAE,aAAa,CAAC,iBAAiB,CAAC,CAAA;CAAE,GAAG,IAAI,GAAG,SAAS,GAC7E,6BAA6B,CAE/B;AAED,uDAAuD;AACvD,wBAAgB,uBAAuB,CAAC,IAAI,EAAE;IAC1C,OAAO,EAAE,wBAAwB,CAAC;IAClC,OAAO,EAAE,8BAA8B,GAAG,SAAS,CAAC;CACvD,GAAG,OAAO,CAEV;AAED,qBACa,yBAAyB;IAClC;;;;;;OAMG;IAMH,iBAAiB,CAAG,mIAAmI;IAC3I,OAAO,EAAE,wBAAwB,EAClC,OAAO,EAAE,8BAA8B,GAAG,SAAS,GAC3D,6BAA6B;IAOhC;;;;;;OAMG;IAEH,0BAA0B,CACW,aAAa,EAAE,MAAM,EAC/C,OAAO,EAAE,8BAA8B,GAAG,SAAS,GAC3D,8BAA8B;IAKjC;;;OAGG;IAEG,iCAAiC,CAC5B,OAAO,EAAE,8BAA8B,GAAG,SAAS,GAC3D,OAAO,CAAC,6BAA6B,CAAC;CAO5C"}

package/dist/generic/CacheInvalidationResolver.js

@@ -10,8 +10,10 @@ var __metadata = (this && this.__metadata) || function (k, v) {
 var __param = (this && this.__param) || function (paramIndex, decorator) {
     return function (target, key) { decorator(target, key, paramIndex); }
 };
-import { Field, ObjectType, Resolver, Root, Subscription } from 'type-graphql';
-import { Metadata } from '@memberjunction/core';
+import 'reflect-metadata';
+import { Arg, Ctx, Field, Int, ObjectType, Query, Resolver, Root, Subscription } from 'type-graphql';
+import { Metadata, RecordChangeFieldSecurityProjector, RecordChangesEntityName } from '@memberjunction/core';
+import { CacheInvalidationBroadcastManager, } from '../broadcast/index.js';
 export const CACHE_INVALIDATION_TOPIC = 'CACHE_INVALIDATION';
 /**
  * Entities whose rows may ride along with an invalidation event. Empty until the server entry point
@@ -44,23 +46,57 @@ export function ConfigureRecordDataBroadcast(entities) {
  *
  * The subscription below is filtered only by ENTITY-level read permission, so anything included
  * here is disclosed to every signed-in session that may read the entity at all — regardless of
- * row-level security or any tenant scoping a consumer applies on the read path, neither of which
- * this push traverses. The answer is therefore NO unless a deployment has explicitly opted the
- * entity in via `cacheSettings.recordDataBroadcastEntities`.
+ * row-level security, field-level security, or any tenant scoping a consumer applies on the read
+ * path, none of which this push traverses. The answer is therefore NO unless a deployment has
+ * explicitly opted the entity in via `cacheSettings.recordDataBroadcastEntities`, and always NO
+ * for an entity under field-level security (its own flag or an IS-A ancestor's), and for
+ * `MJ: Record Changes`, whatever the allowlist says: the row would carry columns (or, for Record
+ * Changes, other entities' values) some of those sessions may not read.
  *
  * Callers that get `false` simply omit `recordData`; the event still carries the entity name and
  * primary key, so clients evict and re-fetch through the normal access-controlled read path.
  *
  * Matching is exact (trimmed, case-insensitive) rather than substring: a loose match would let an
  * allowlisted name drag in every entity whose name contains it.
+ *
+ * @param entityInfo The entity's metadata, when the caller holds it. Otherwise it is looked up by
+ *   name, so the field-security refusal applies either way.
  */
-export function MayBroadcastRecordData(entityName) {
+export function MayBroadcastRecordData(entityName, entityInfo) {
     if (allowedRecordDataEntities.length === 0)
         return false;
+    if (fieldSecurityApplies(entityName, entityInfo))
+        return false;
+    if (isRecordChanges(entityName, entityInfo))
+        return false;
     if (allowedRecordDataEntities.includes('*'))
         return true;
     return allowedRecordDataEntities.includes(entityName.trim().toLowerCase());
 }
+/** Whether field-level security applies to the entity, resolving it by name when not supplied. */
+function fieldSecurityApplies(entityName, entityInfo) {
+    const info = entityInfo ?? lookUpEntity(entityName);
+    return Boolean(info?.FieldLevelSecurityApplies);
+}
+/**
+ * Whether the entity is the Record Changes audit trail. Its rows carry other entities' values in
+ * `ChangesJSON` and `FullRecordJSON`, which are projected per reader, so a row is never broadcast
+ * even though field-level security is not switched on for the audit entity itself.
+ */
+function isRecordChanges(entityName, entityInfo) {
+    if (entityInfo)
+        return RecordChangeFieldSecurityProjector.IsRecordChangesEntity(entityInfo);
+    return entityName.trim().toLowerCase() === RecordChangesEntityName.toLowerCase();
+}
+/** The entity by name from the process's metadata, or undefined when none is loaded. */
+function lookUpEntity(entityName) {
+    try {
+        return new Metadata().EntityByName(entityName) ?? undefined; // global-provider-ok: metadata lookup for a process-wide broadcast gate
+    }
+    catch {
+        return undefined;
+    }
+}
 let CacheInvalidationNotification = class CacheInvalidationNotification {
 };
 __decorate([
@@ -91,10 +127,70 @@ __decorate([
     Field(() => String, { nullable: true }),
     __metadata("design:type", String)
 ], CacheInvalidationNotification.prototype, "RecordData", void 0);
+__decorate([
+    Field(() => Int, { nullable: true }),
+    __metadata("design:type", Number)
+], CacheInvalidationNotification.prototype, "Sequence", void 0);
 CacheInvalidationNotification = __decorate([
     ObjectType()
 ], CacheInvalidationNotification);
 export { CacheInvalidationNotification };
+let CacheInvalidationCatchUpResult = class CacheInvalidationCatchUpResult {
+};
+__decorate([
+    Field(() => Boolean),
+    __metadata("design:type", Boolean)
+], CacheInvalidationCatchUpResult.prototype, "RequiresFullRefresh", void 0);
+__decorate([
+    Field(() => Int),
+    __metadata("design:type", Number)
+], CacheInvalidationCatchUpResult.prototype, "CurrentSequence", void 0);
+__decorate([
+    Field(() => String),
+    __metadata("design:type", String)
+], CacheInvalidationCatchUpResult.prototype, "ServerProcessID", void 0);
+__decorate([
+    Field(() => [CacheInvalidationNotification]),
+    __metadata("design:type", Array)
+], CacheInvalidationCatchUpResult.prototype, "Events", void 0);
+CacheInvalidationCatchUpResult = __decorate([
+    ObjectType()
+], CacheInvalidationCatchUpResult);
+export { CacheInvalidationCatchUpResult };
+let CacheBroadcastConnectionToken = class CacheBroadcastConnectionToken {
+};
+__decorate([
+    Field(() => String),
+    __metadata("design:type", String)
+], CacheBroadcastConnectionToken.prototype, "Provider", void 0);
+__decorate([
+    Field(() => String),
+    __metadata("design:type", String)
+], CacheBroadcastConnectionToken.prototype, "Url", void 0);
+__decorate([
+    Field(() => String, { nullable: true }),
+    __metadata("design:type", String)
+], CacheBroadcastConnectionToken.prototype, "Token", void 0);
+__decorate([
+    Field(() => [String]),
+    __metadata("design:type", Array)
+], CacheBroadcastConnectionToken.prototype, "Groups", void 0);
+__decorate([
+    Field(() => String),
+    __metadata("design:type", String)
+], CacheBroadcastConnectionToken.prototype, "ExpiresAt", void 0);
+__decorate([
+    Field(() => String),
+    __metadata("design:type", String)
+], CacheBroadcastConnectionToken.prototype, "ServerProcessID", void 0);
+__decorate([
+    Field(() => Int),
+    __metadata("design:type", Number)
+], CacheBroadcastConnectionToken.prototype, "CurrentSequence", void 0);
+CacheBroadcastConnectionToken = __decorate([
+    ObjectType()
+], CacheBroadcastConnectionToken);
+export { CacheBroadcastConnectionToken };
 /**
  * Should this subscriber hear about this event at all?
  *
@@ -109,33 +205,40 @@ export { CacheInvalidationNotification };
  * see the class docblock below.
  *
  * `GetUserPermisions` is an in-memory match of the entity's permission rows against the user's
- * roles, so this stays cheap enough to run per subscriber per event. It is not free: it runs for
- * every connected socket on every save, so keep it free of I/O.
+ * roles, memoized per `(payload, entityName, roleFingerprint)` by the active
+ * {@link BaseCacheInvalidationBroadcastProvider} so $N$ connected subscribers sharing $R$ role
+ * combinations only run `GetUserPermisions` $R$ times per event.
  */
 export function CacheInvalidationFilter(data) {
     const user = data.context?.userPayload?.userRecord;
-    // FAIL CLOSED on identity, matching `statusUpdatesFilter`. `onConnect` rejects a socket whose
-    // token does not validate, so a subscriber with no user record should not exist; if one does,
-    // it is the case least deserving of an unfiltered firehose.
     if (!user) {
         return false;
     }
-    const entityName = data.payload?.entityName;
-    if (!entityName) {
-        return false;
-    }
-    // A pub/sub subscription filter has no per-request provider to thread: it runs on the server's
-    // own metadata, which is the one place the entity's permission rows can be answered from.
-    const entity = new Metadata().EntityByName(entityName); // global-provider-ok: subscription filter — server-wide metadata, no request-scoped provider exists here
-    // DELIVER when the entity is unknown here, deliberately — the opposite of the choice above.
-    // A name absent from metadata cannot be permission-checked, and withholding would silently
-    // stop invalidating a legitimately cacheable entity, which is a correctness bug rather than a
-    // disclosure one. All it discloses is the name and key of something this server cannot
-    // describe.
-    if (!entity) {
-        return true;
-    }
-    return entity.GetUserPermisions(user).CanRead;
+    return CacheInvalidationBroadcastManager.Instance.Provider.EvaluateEntityReadAccess(data.payload, user, (entityName) => new Metadata().EntityByName(entityName) // global-provider-ok: subscription filter — server-wide metadata, no request-scoped provider exists here
+    );
+}
+/**
+ * Is this user's read of the entity row-filtered? True when every read the user holds on the entity comes through a permission
+ * row that carries a `ReadRLSFilterID`: there is a row-level security filter between them and the rows, so a record's key, its
+ * existence and when it changed are not theirs to learn unless the row passes the filter — which a subscription filter cannot
+ * evaluate per event. False when any of their read rows is unfiltered (they could read the row anyway), and false when they hold
+ * no read at all (the entity-level filter has already withheld the event).
+ *
+ * The same in-memory match `GetUserPermisions` does, with no I/O, so it can run per subscriber per event.
+ */
+export function ReadIsRowFiltered(entity, user) {
+    return CacheInvalidationBroadcastManager.Instance.Provider.ReadIsRowFiltered(entity, user);
+}
+/**
+ * The event as one subscriber may see it. A subscriber whose read of the entity is row-filtered gets the entity, the action and
+ * the time, and neither the key nor the row: "something in this entity changed", which the client already takes as a
+ * whole-entity invalidation (a null key on `remote-invalidate`). Everyone else gets the event as published.
+ *
+ * Memoized per `(payload, entity, roleFingerprint)` via the active broadcast provider so $N$ subscribers
+ * sharing $R$ role buckets only allocate and evaluate `ReadIsRowFiltered` $R$ times per event.
+ */
+export function ShapeCacheInvalidationEvent(payload, user, entity) {
+    return CacheInvalidationBroadcastManager.Instance.Provider.ShapeEventForSubscriber(payload, user, entity);
 }
 /** @deprecated Use {@link CacheInvalidationFilter}. */
 export function cacheInvalidationFilter(data) {
@@ -146,40 +249,36 @@ let CacheInvalidationResolver = class CacheInvalidationResolver {
      * Subscription that broadcasts cache invalidation events to connected clients, so cross-server
      * cache invalidation reaches browsers.
      *
-     * Delivery is filtered only by ENTITY-level read permission (see {@link CacheInvalidationFilter}).
-     * Every session that may read an entity at all still receives every event for it, from every
-     * other session and tenant.
-     *
-     * Because that narrowing stops well short of row level, `RecordData` is only populated for entities a
-     * deployment has opted in through `cacheSettings.recordDataBroadcastEntities` — see
-     * {@link MayBroadcastRecordData}, applied at both publish sites.
-     *
-     * `EntityName`, `PrimaryKeyValues`, `Action` and `Timestamp` ARE still broadcast to every
-     * session, and that is a disclosure, not a safe residue. An earlier version of this comment
-     * called them "safe to broadcast" on the grounds that reading the record still goes through
-     * the access-controlled path — true of the row's CONTENTS, and beside the point for the
-     * metadata itself. A session with no relationship to a record still learns that it exists,
-     * its stable key, and every time it changes; across entities it learns the cadence and volume
-     * of another tenant's activity.
+     * Delivery is filtered by ENTITY-level read permission (see {@link CacheInvalidationFilter})
+     * and shaped per role-fingerprint bucket (see {@link ShapeCacheInvalidationEvent}).
+     */
+    cacheInvalidation(payload, context) {
+        const user = context?.userPayload?.userRecord;
+        const provider = CacheInvalidationBroadcastManager.Instance.Provider;
+        const entity = payload?.entityName ? provider.ResolveEntityForPayload(payload) : null;
+        return provider.ShapeEventForSubscriber(payload, user, entity);
+    }
+    /**
+     * Returns all permission-allowed, RLS-shaped cache invalidation events strictly after
+     * `sinceSequence` from the server's bounded circular ring buffer.
      *
-     * The key is kept deliberately, because consumers need it to re-read the record they were
-     * told about (see `ResolveEntityEventKey` in @memberjunction/core) and because the alternative
-     * — a coarse "something in this entity changed" — forces whole-entity invalidation on the
-     * hottest write paths. That is a trade, not an absence of cost. Narrowing it means filtering
-     * delivery per subscriber, which needs an authorization predicate cheap enough to run per
-     * subscriber per event; entity-level permissions (`EntityInfo.GetUserPermisions`, an in-memory
-     * role match) would cover part of it, row-level tenancy would not.
+     * Invoked by `GraphQLDataProvider` when an HTTP response's `X-MJ-Cache-Seq` header or a
+     * WebSocket reconnect reveals missed invalidation sequence numbers.
+     */
+    GetCacheInvalidationsSince(sinceSequence, context) {
+        const user = context?.userPayload?.userRecord;
+        return CacheInvalidationBroadcastManager.Instance.Provider.GetChangesSince(sinceSequence, user);
+    }
+    /**
+     * Negotiates a client broadcast connection (URL, signed token, and authorized role-bucket groups)
+     * for the active {@link BaseCacheInvalidationBroadcastProvider}.
      */
-    cacheInvalidation(payload) {
-        return {
-            EntityName: payload.entityName,
-            PrimaryKeyValues: payload.primaryKeyValues ?? undefined,
-            Action: payload.action,
-            SourceServerID: payload.sourceServerId,
-            Timestamp: payload.timestamp,
-            OriginSessionID: payload.originSessionId ?? undefined,
-            RecordData: payload.recordData ?? undefined,
-        };
+    async NegotiateCacheBroadcastConnection(context) {
+        const user = context?.userPayload?.userRecord;
+        if (!user) {
+            throw new Error('Authentication required to negotiate cache broadcast connection.');
+        }
+        return CacheInvalidationBroadcastManager.Instance.Provider.NegotiateClientConnection(user);
     }
 };
 __decorate([
@@ -188,10 +287,26 @@ __decorate([
         filter: (data) => CacheInvalidationFilter(data),
     }),
     __param(0, Root()),
+    __param(1, Ctx()),
     __metadata("design:type", Function),
-    __metadata("design:paramtypes", [Object]),
+    __metadata("design:paramtypes", [Object, Object]),
     __metadata("design:returntype", CacheInvalidationNotification)
 ], CacheInvalidationResolver.prototype, "cacheInvalidation", null);
+__decorate([
+    Query(() => CacheInvalidationCatchUpResult),
+    __param(0, Arg('sinceSequence', () => Int)),
+    __param(1, Ctx()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Number, Object]),
+    __metadata("design:returntype", CacheInvalidationCatchUpResult)
+], CacheInvalidationResolver.prototype, "GetCacheInvalidationsSince", null);
+__decorate([
+    Query(() => CacheBroadcastConnectionToken),
+    __param(0, Ctx()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], CacheInvalidationResolver.prototype, "NegotiateCacheBroadcastConnection", null);
 CacheInvalidationResolver = __decorate([
     Resolver()
 ], CacheInvalidationResolver);

package/dist/generic/CacheInvalidationResolver.js.map

@@ -1 +1 @@
-{"version":3,"file":"CacheInvalidationResolver.js","sourceRoot":"","sources":["../../src/generic/CacheInvalidationResolver.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC/E,OAAO,EAAE,QAAQ,EAAY,MAAM,sBAAsB,CAAC;AAE1D,MAAM,CAAC,MAAM,wBAAwB,GAAG,oBAAoB,CAAC;AAE7D;;;;GAIG;AACH,IAAI,yBAAyB,GAAsB,EAAE,CAAC;AAEtD;;;;;;;;;GASG;AACH,MAAM,UAAU,4BAA4B,CAAC,QAA8C;IACzF,6FAA6F;IAC7F,yFAAyF;IACzF,6FAA6F;IAC7F,4FAA4F;IAC5F,iEAAiE;IACjE,yBAAyB,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC;SACzC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;SAClC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AACjC,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,sBAAsB,CAAC,UAAkB;IACvD,IAAI,yBAAyB,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACzD,IAAI,yBAAyB,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACzD,OAAO,yBAAyB,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;AAC7E,CAAC;AAGM,IAAM,6BAA6B,GAAnC,MAAM,6BAA6B;CAqBzC,CAAA;AAnBG;IADC,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC;;iEACA;AAGpB;IADC,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;uEACd;AAG1B;IADC,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC;;6DACJ;AAGhB;IADC,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC;;qEACI;AAGxB;IADC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC;8BACN,IAAI;gEAAC;AAGjB;IADC,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;sEACf;AAGzB;IADC,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;iEACpB;AApBX,6BAA6B;IADzC,UAAU,EAAE;GACA,6BAA6B,CAqBzC;;AA4BD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,uBAAuB,CAAC,IAGvC;IACG,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,EAAE,WAAW,EAAE,UAAkC,CAAC;IAC3E,8FAA8F;IAC9F,8FAA8F;IAC9F,4DAA4D;IAC5D,IAAI,CAAC,IAAI,EAAE,CAAC;QACR,OAAO,KAAK,CAAC;IACjB,CAAC;IAED,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,EAAE,UAAU,CAAC;IAC5C,IAAI,CAAC,UAAU,EAAE,CAAC;QACd,OAAO,KAAK,CAAC;IACjB,CAAC;IAED,+FAA+F;IAC/F,0FAA0F;IAC1F,MAAM,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC,CAAC,yGAAyG;IACjK,4FAA4F;IAC5F,2FAA2F;IAC3F,8FAA8F;IAC9F,uFAAuF;IACvF,YAAY;IACZ,IAAI,CAAC,MAAM,EAAE,CAAC;QACV,OAAO,IAAI,CAAC;IAChB,CAAC;IAED,OAAO,MAAM,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC;AAClD,CAAC;AAED,uDAAuD;AACvD,MAAM,UAAU,uBAAuB,CAAC,IAGvC;IACC,OAAO,uBAAuB,CAAC,IAAI,CAAC,CAAC;AACvC,CAAC;AAGM,IAAM,yBAAyB,GAA/B,MAAM,yBAAyB;IAClC;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IAMH,iBAAiB,CACL,OAAiC;QAEzC,OAAO;YACH,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,IAAI,SAAS;YACvD,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,cAAc,EAAE,OAAO,CAAC,cAAc;YACtC,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,eAAe,EAAE,OAAO,CAAC,eAAe,IAAI,SAAS;YACrD,UAAU,EAAE,OAAO,CAAC,UAAU,IAAI,SAAS;SAC9C,CAAC;IACN,CAAC;CACJ,CAAA;AAbG;IALC,YAAY,CAAC,GAAG,EAAE,CAAC,6BAA6B,EAAE;QAC/C,MAAM,EAAE,wBAAwB;QAChC,MAAM,EAAE,CAAC,IAAgG,EAAE,EAAE,CACzG,uBAAuB,CAAC,IAAI,CAAC;KACpC,CAAC;IAEG,WAAA,IAAI,EAAE,CAAA;;;oCACR,6BAA6B;kEAU/B;AA9CQ,yBAAyB;IADrC,QAAQ,EAAE;GACE,yBAAyB,CA+CrC"}
+{"version":3,"file":"CacheInvalidationResolver.js","sourceRoot":"","sources":["../../src/generic/CacheInvalidationResolver.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,OAAO,kBAAkB,CAAC;AAC1B,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AACrG,OAAO,EAAc,QAAQ,EAAE,kCAAkC,EAAE,uBAAuB,EAAY,MAAM,sBAAsB,CAAC;AACnI,OAAO,EACH,iCAAiC,GACpC,MAAM,uBAAuB,CAAC;AAE/B,MAAM,CAAC,MAAM,wBAAwB,GAAG,oBAAoB,CAAC;AAE7D;;;;GAIG;AACH,IAAI,yBAAyB,GAAsB,EAAE,CAAC;AAEtD;;;;;;;;;GASG;AACH,MAAM,UAAU,4BAA4B,CAAC,QAA8C;IACzF,6FAA6F;IAC7F,yFAAyF;IACzF,6FAA6F;IAC7F,4FAA4F;IAC5F,iEAAiE;IACjE,yBAAyB,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC;SACzC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;SAClC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AACjC,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,sBAAsB,CAAC,UAAkB,EAAE,UAA8B;IACvF,IAAI,yBAAyB,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACzD,IAAI,oBAAoB,CAAC,UAAU,EAAE,UAAU,CAAC;QAAE,OAAO,KAAK,CAAC;IAC/D,IAAI,eAAe,CAAC,UAAU,EAAE,UAAU,CAAC;QAAE,OAAO,KAAK,CAAC;IAC1D,IAAI,yBAAyB,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACzD,OAAO,yBAAyB,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;AAC7E,CAAC;AAED,kGAAkG;AAClG,SAAS,oBAAoB,CAAC,UAAkB,EAAE,UAAyC;IACzF,MAAM,IAAI,GAAG,UAAU,IAAI,YAAY,CAAC,UAAU,CAAC,CAAC;IACpD,OAAO,OAAO,CAAC,IAAI,EAAE,yBAAyB,CAAC,CAAC;AAClD,CAAC;AAED;;;;GAIG;AACH,SAAS,eAAe,CAAC,UAAkB,EAAE,UAAyC;IACpF,IAAI,UAAU;QAAE,OAAO,kCAAkC,CAAC,qBAAqB,CAAC,UAAU,CAAC,CAAC;IAC5F,OAAO,UAAU,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,uBAAuB,CAAC,WAAW,EAAE,CAAC;AACnF,CAAC;AAED,wFAAwF;AACxF,SAAS,YAAY,CAAC,UAAkB;IACtC,IAAI,CAAC;QACH,OAAO,IAAI,QAAQ,EAAE,CAAC,YAAY,CAAC,UAAU,CAAC,IAAI,SAAS,CAAC,CAAC,wEAAwE;IACvI,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAGM,IAAM,6BAA6B,GAAnC,MAAM,6BAA6B;CAwBzC,CAAA;AAtBG;IADC,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC;;iEACA;AAGpB;IADC,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;uEACd;AAG1B;IADC,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC;;6DACJ;AAGhB;IADC,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC;;qEACI;AAGxB;IADC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC;8BACN,IAAI;gEAAC;AAGjB;IADC,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;sEACf;AAGzB;IADC,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;iEACpB;AAGpB;IADC,KAAK,CAAC,GAAG,EAAE,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;+DACnB;AAvBT,6BAA6B;IADzC,UAAU,EAAE;GACA,6BAA6B,CAwBzC;;AAGM,IAAM,8BAA8B,GAApC,MAAM,8BAA8B;CAY1C,CAAA;AAVG;IADC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC;;2EACS;AAG9B;IADC,KAAK,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC;;uEACQ;AAGzB;IADC,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC;;uEACK;AAGzB;IADC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,6BAA6B,CAAC,CAAC;;8DACJ;AAXhC,8BAA8B;IAD1C,UAAU,EAAE;GACA,8BAA8B,CAY1C;;AAGM,IAAM,6BAA6B,GAAnC,MAAM,6BAA6B;CAqBzC,CAAA;AAnBG;IADC,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC;;+DACF;AAGlB;IADC,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC;;0DACP;AAGb;IADC,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;4DACzB;AAGf;IADC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;;6DACJ;AAGlB;IADC,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC;;gEACD;AAGnB;IADC,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC;;sEACK;AAGzB;IADC,KAAK,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC;;sEACQ;AApBhB,6BAA6B;IADzC,UAAU,EAAE;GACA,6BAA6B,CAqBzC;;AA6BD;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,uBAAuB,CAAC,IAGvC;IACG,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,EAAE,WAAW,EAAE,UAAkC,CAAC;IAC3E,IAAI,CAAC,IAAI,EAAE,CAAC;QACR,OAAO,KAAK,CAAC;IACjB,CAAC;IACD,OAAO,iCAAiC,CAAC,QAAQ,CAAC,QAAQ,CAAC,wBAAwB,CAC/E,IAAI,CAAC,OAAO,EACZ,IAAI,EACJ,CAAC,UAAU,EAAE,EAAE,CAAC,IAAI,QAAQ,EAAE,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC,yGAAyG;KACpK,CAAC;AACN,CAAC;AAeD;;;;;;;;GAQG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAAyD,EAAE,IAAgB;IACzG,OAAO,iCAAiC,CAAC,QAAQ,CAAC,QAAQ,CAAC,iBAAiB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;AAC/F,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,2BAA2B,CACvC,OAAiC,EACjC,IAA4B,EAC5B,MAA4E;IAE5E,OAAO,iCAAiC,CAAC,QAAQ,CAAC,QAAQ,CAAC,uBAAuB,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;AAC9G,CAAC;AAED,uDAAuD;AACvD,MAAM,UAAU,uBAAuB,CAAC,IAGvC;IACC,OAAO,uBAAuB,CAAC,IAAI,CAAC,CAAC;AACvC,CAAC;AAGM,IAAM,yBAAyB,GAA/B,MAAM,yBAAyB;IAClC;;;;;;OAMG;IAMH,iBAAiB,CACL,OAAiC,EAClC,OAAmD;QAE1D,MAAM,IAAI,GAAG,OAAO,EAAE,WAAW,EAAE,UAAkC,CAAC;QACtE,MAAM,QAAQ,GAAG,iCAAiC,CAAC,QAAQ,CAAC,QAAQ,CAAC;QACrE,MAAM,MAAM,GAAG,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,uBAAuB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACtF,OAAO,QAAQ,CAAC,uBAAuB,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;IACnE,CAAC;IAED;;;;;;OAMG;IAEH,0BAA0B,CACW,aAAqB,EAC/C,OAAmD;QAE1D,MAAM,IAAI,GAAG,OAAO,EAAE,WAAW,EAAE,UAAkC,CAAC;QACtE,OAAO,iCAAiC,CAAC,QAAQ,CAAC,QAAQ,CAAC,eAAe,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC;IACpG,CAAC;IAED;;;OAGG;IAEG,AAAN,KAAK,CAAC,iCAAiC,CAC5B,OAAmD;QAE1D,MAAM,IAAI,GAAG,OAAO,EAAE,WAAW,EAAE,UAAkC,CAAC;QACtE,IAAI,CAAC,IAAI,EAAE,CAAC;YACR,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAC;QACxF,CAAC;QACD,OAAO,iCAAiC,CAAC,QAAQ,CAAC,QAAQ,CAAC,yBAAyB,CAAC,IAAI,CAAC,CAAC;IAC/F,CAAC;CACJ,CAAA;AAxCG;IALC,YAAY,CAAC,GAAG,EAAE,CAAC,6BAA6B,EAAE;QAC/C,MAAM,EAAE,wBAAwB;QAChC,MAAM,EAAE,CAAC,IAAgG,EAAE,EAAE,CACzG,uBAAuB,CAAC,IAAI,CAAC;KACpC,CAAC;IAEG,WAAA,IAAI,EAAE,CAAA;IACN,WAAA,GAAG,EAAE,CAAA;;;oCACP,6BAA6B;kEAK/B;AAUD;IADC,KAAK,CAAC,GAAG,EAAE,CAAC,8BAA8B,CAAC;IAEvC,WAAA,GAAG,CAAC,eAAe,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAAA;IAC/B,WAAA,GAAG,EAAE,CAAA;;;oCACP,8BAA8B;2EAGhC;AAOK;IADL,KAAK,CAAC,GAAG,EAAE,CAAC,6BAA6B,CAAC;IAEtC,WAAA,GAAG,EAAE,CAAA;;;;kFAOT;AApDQ,yBAAyB;IADrC,QAAQ,EAAE;GACE,yBAAyB,CAqDrC"}

package/dist/generic/OrphanedConversationDetailReconciler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"OrphanedConversationDetailReconciler.d.ts","sourceRoot":"","sources":["../../src/generic/OrphanedConversationDetailReconciler.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,iBAAiB,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAGxE;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,QAAgB,CAAC;AAiBpD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAsB,oCAAoC,CACtD,QAAQ,EAAE,iBAAiB,EAC3B,WAAW,EAAE,QAAQ,EACrB,OAAO,GAAE,MAA+B,GACzC,OAAO,CAAC,MAAM,CAAC,CAkGjB"}
+{"version":3,"file":"OrphanedConversationDetailReconciler.d.ts","sourceRoot":"","sources":["../../src/generic/OrphanedConversationDetailReconciler.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,iBAAiB,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAGxE;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,QAAgB,CAAC;AAiBpD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAsB,oCAAoC,CACtD,QAAQ,EAAE,iBAAiB,EAC3B,WAAW,EAAE,QAAQ,EACrB,OAAO,GAAE,MAA+B,GACzC,OAAO,CAAC,MAAM,CAAC,CAoGjB"}

package/dist/generic/OrphanedConversationDetailReconciler.js

@@ -87,6 +87,8 @@ export async function ReconcileOrphanedConversationDetails(provider, contextUser
                 continue;
             }
             const writable = await provider.GetEntityObject('MJ: Conversation Details', owner);
+            // Closing an agent's reply is the server's write: unmarked, the gate refuses any change to what a reply says.
+            writable.MarkServerAuthoredReply();
             if (!(await writable.Load(detail.ID))) {
                 LogError(`[OrphanDetailReconciler] Could not load detail ${detail.ID} for write`);
                 continue;

package/dist/generic/OrphanedConversationDetailReconciler.js.map

@@ -1 +1 @@
-{"version":3,"file":"OrphanedConversationDetailReconciler.js","sourceRoot":"","sources":["../../src/generic/OrphanedConversationDetailReconciler.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC;AACpE,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,SAAS,EAAE,MAAM,wCAAwC,CAAC;AAInE;;;;GAIG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAEpD,mFAAmF;AACnF,MAAM,oBAAoB,GAAG,GAAG,CAAC;AAEjC;;;GAGG;AACH,MAAM,uBAAuB,GAAmC,CAAC,WAAW,EAAE,kBAAkB,CAAC,CAAC;AAElG;;;GAGG;AACH,MAAM,qBAAqB,GAAmC,CAAC,GAAG,uBAAuB,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC;AAElH;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAC,KAAK,UAAU,oCAAoC,CACtD,QAA2B,EAC3B,WAAqB,EACrB,UAAkB,sBAAsB;IAExC,IAAI,CAAC;QACD,MAAM,EAAE,GAAG,OAAO,CAAC,oBAAoB,CAAC,QAAQ,CAAC,CAAC;QAElD,MAAM,YAAY,GAAG,MAAM,EAAE,CAAC,OAAO,CACjC;YACI,UAAU,EAAE,0BAA0B;YACtC,WAAW,EAAE,yCAAyC,oBAAoB,CAAC,QAAQ,CAAC,EAAE;YACtF,OAAO,EAAE,oBAAoB;YAC7B,OAAO,EAAE,oBAAoB;YAC7B,UAAU,EAAE,eAAe;SAC9B,EACD,WAAW,CACd,CAAC;QACF,IAAI,CAAC,YAAY,CAAC,OAAO,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC;YACzD,OAAO,CAAC,CAAC;QACb,CAAC;QAED,MAAM,YAAY,GAAG,MAAM,gBAAgB,CAAC,EAAE,EAAE,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,WAAW,CAAC,CAAC;QAClG,IAAI,YAAY,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;YAC1B,OAAO,CAAC,CAAC;QACb,CAAC;QAED,MAAM,oBAAoB,GAAG,MAAM,sBAAsB,CACrD,EAAE,EACF,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,EAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAClF,WAAW,CACd,CAAC;QAEF,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC;QACpC,IAAI,MAAM,GAAG,CAAC,CAAC;QAEf,KAAK,MAAM,MAAM,IAAI,YAAY,CAAC,OAAO,EAAE,CAAC;YACxC,MAAM,GAAG,GAAG,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACxC,IAAI,CAAC,GAAG,EAAE,CAAC;gBACP,gFAAgF;gBAChF,SAAS;YACb,CAAC;YACD,MAAM,WAAW,GAAG,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;YAChF,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,WAAW,GAAG,MAAM,EAAE,CAAC;gBACxD,iFAAiF;gBACjF,SAAS;YACb,CAAC;YAED,6DAA6D;YAC7D,EAAE;YACF,wFAAwF;YACxF,gFAAgF;YAChF,iFAAiF;YACjF,6EAA6E;YAC7E,qFAAqF;YACrF,qFAAqF;YACrF,4DAA4D;YAC5D,MAAM,KAAK,GAAG,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,oBAAoB,CAAC,GAAG,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAClG,IAAI,CAAC,KAAK,EAAE,CAAC;gBACT,QAAQ,CAAC,+DAA+D,MAAM,CAAC,cAAc,oBAAoB,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC;gBAC9H,SAAS;YACb,CAAC;YACD,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,eAAe,CAA6B,0BAA0B,EAAE,KAAK,CAAC,CAAC;YAC/G,IAAI,CAAC,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;gBACpC,QAAQ,CAAC,kDAAkD,MAAM,CAAC,EAAE,YAAY,CAAC,CAAC;gBAClF,SAAS;YACb,CAAC;YACD,IAAI,QAAQ,CAAC,MAAM,KAAK,aAAa,EAAE,CAAC;gBACpC,qEAAqE;gBACrE,SAAS;YACb,CAAC;YACD,sFAAsF;YACtF,oFAAoF;YACpF,IAAI,uBAAuB,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC/C,QAAQ,CAAC,MAAM,GAAG,UAAU,CAAC;YACjC,CAAC;iBAAM,CAAC;gBACJ,QAAQ,CAAC,MAAM,GAAG,OAAO,CAAC;gBAC1B,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;oBACpB,QAAQ,CAAC,OAAO,GAAG,GAAG,CAAC,YAAY,IAAI,UAAU,CAAC;gBACtD,CAAC;YACL,CAAC;YAED,IAAI,MAAM,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC;gBACxB,MAAM,EAAE,CAAC;YACb,CAAC;iBAAM,CAAC;gBACJ,MAAM,MAAM,GAAG,QAAQ,CAAC,YAAY,CAAC;gBACrC,QAAQ,CACJ,mDAAmD,MAAM,CAAC,EAAE,IAAI;oBAChE,GAAG,MAAM,EAAE,eAAe,IAAI,MAAM,EAAE,OAAO,IAAI,YAAY,EAAE,CAClE,CAAC;YACN,CAAC;QACL,CAAC;QAED,IAAI,MAAM,GAAG,CAAC,EAAE,CAAC;YACb,SAAS,CAAC,mCAAmC,MAAM,sDAAsD,CAAC,CAAC;QAC/G,CAAC;QACD,OAAO,MAAM,CAAC;IAClB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACX,4DAA4D;QAC5D,QAAQ,CAAC,yCAAyC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACtG,OAAO,CAAC,CAAC;IACb,CAAC;AACL,CAAC;AAQD,SAAS,iBAAiB,CAAC,QAA2B;IAClD,MAAM,CAAC,GAAG,QAAwD,CAAC;IACnE,OAAO,OAAO,CAAC,CAAC,eAAe,KAAK,UAAU,IAAI,OAAO,CAAC,CAAC,kBAAkB,KAAK,UAAU,CAAC;AACjG,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,oBAAoB,CAAC,QAA2B;IACrD,MAAM,IAAI,GAAG,QAAQ,CAAC,YAAY,CAAC,mBAAmB,CAAC,CAAC;IACxD,IAAI,CAAC,IAAI,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,EAAE,CAAC;QACxC,OAAO,EAAE,CAAC;IACd,CAAC;IACD,MAAM,QAAQ,GAAG,qBAAqB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACpE,OAAO,CACH,sBAAsB,QAAQ,CAAC,eAAe,CAAC,sBAAsB,CAAC,EAAE;QACxE,SAAS,QAAQ,CAAC,kBAAkB,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC,EAAE;QACtE,UAAU,QAAQ,CAAC,eAAe,CAAC,QAAQ,CAAC,QAAQ,QAAQ,IAAI,CACnE,CAAC;AACN,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,gBAAgB,CAC3B,EAAW,EACX,SAAmB,EACnB,WAAqB;IAErB,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC5E,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,OAAO,CAC3B;QACI,UAAU,EAAE,mBAAmB;QAC/B,WAAW,EAAE,4BAA4B,MAAM,GAAG;QAClD,OAAO,EAAE,qBAAqB;QAC9B,UAAU,EAAE,eAAe;KAC9B,EACD,WAAW,CACd,CAAC;IACF,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QAClB,OAAO,IAAI,GAAG,EAAE,CAAC;IACrB,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,GAAG,EAA8B,CAAC;IACrD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC;QACrC,MAAM,QAAQ,GAAG,GAAG,CAAC,oBAAoB,CAAC;QAC1C,IAAI,CAAC,QAAQ,IAAI,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YACpC,SAAS,CAAC,uCAAuC;QACrD,CAAC;QACD,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IAC9B,CAAC;IAED,yDAAyD;IACzD,KAAK,MAAM,CAAC,QAAQ,EAAE,GAAG,CAAC,IAAI,MAAM,EAAE,CAAC;QACnC,IAAI,CAAC,qBAAqB,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YAC9C,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC5B,CAAC;IACL,CAAC;IACD,OAAO,MAAM,CAAC;AAClB,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,sBAAsB,CACjC,EAAW,EACX,eAAyB,EACzB,WAAqB;IAErB,MAAM,MAAM,GAAG,IAAI,GAAG,EAAoB,CAAC;IAC3C,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/B,OAAO,MAAM,CAAC;IAClB,CAAC;IACD,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAChG,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,OAAO,CAC3B;QACI,UAAU,EAAE,mBAAmB;QAC/B,WAAW,EAAE,UAAU,MAAM,GAAG;QAChC,MAAM,EAAE,CAAC,IAAI,EAAE,QAAQ,CAAC;QACxB,UAAU,EAAE,QAAQ;KACvB,EACD,WAAW,CACd,CAAC;IACF,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QAClB,OAAO,MAAM,CAAC;IAClB,CAAC;IACD,MAAM,SAAS,GAAG,WAAW,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACxD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC;QACrC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC;YACd,SAAS;QACb,CAAC;QACD,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACvC,IAAI,IAAI,EAAE,CAAC;YACP,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;QAC7B,CAAC;IACL,CAAC;IACD,OAAO,MAAM,CAAC;AAClB,CAAC"}
+{"version":3,"file":"OrphanedConversationDetailReconciler.js","sourceRoot":"","sources":["../../src/generic/OrphanedConversationDetailReconciler.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC;AACpE,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,SAAS,EAAE,MAAM,wCAAwC,CAAC;AAInE;;;;GAIG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAEpD,mFAAmF;AACnF,MAAM,oBAAoB,GAAG,GAAG,CAAC;AAEjC;;;GAGG;AACH,MAAM,uBAAuB,GAAmC,CAAC,WAAW,EAAE,kBAAkB,CAAC,CAAC;AAElG;;;GAGG;AACH,MAAM,qBAAqB,GAAmC,CAAC,GAAG,uBAAuB,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC;AAElH;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAC,KAAK,UAAU,oCAAoC,CACtD,QAA2B,EAC3B,WAAqB,EACrB,UAAkB,sBAAsB;IAExC,IAAI,CAAC;QACD,MAAM,EAAE,GAAG,OAAO,CAAC,oBAAoB,CAAC,QAAQ,CAAC,CAAC;QAElD,MAAM,YAAY,GAAG,MAAM,EAAE,CAAC,OAAO,CACjC;YACI,UAAU,EAAE,0BAA0B;YACtC,WAAW,EAAE,yCAAyC,oBAAoB,CAAC,QAAQ,CAAC,EAAE;YACtF,OAAO,EAAE,oBAAoB;YAC7B,OAAO,EAAE,oBAAoB;YAC7B,UAAU,EAAE,eAAe;SAC9B,EACD,WAAW,CACd,CAAC;QACF,IAAI,CAAC,YAAY,CAAC,OAAO,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC;YACzD,OAAO,CAAC,CAAC;QACb,CAAC;QAED,MAAM,YAAY,GAAG,MAAM,gBAAgB,CAAC,EAAE,EAAE,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,WAAW,CAAC,CAAC;QAClG,IAAI,YAAY,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;YAC1B,OAAO,CAAC,CAAC;QACb,CAAC;QAED,MAAM,oBAAoB,GAAG,MAAM,sBAAsB,CACrD,EAAE,EACF,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,EAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAClF,WAAW,CACd,CAAC;QAEF,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC;QACpC,IAAI,MAAM,GAAG,CAAC,CAAC;QAEf,KAAK,MAAM,MAAM,IAAI,YAAY,CAAC,OAAO,EAAE,CAAC;YACxC,MAAM,GAAG,GAAG,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACxC,IAAI,CAAC,GAAG,EAAE,CAAC;gBACP,gFAAgF;gBAChF,SAAS;YACb,CAAC;YACD,MAAM,WAAW,GAAG,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;YAChF,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,WAAW,GAAG,MAAM,EAAE,CAAC;gBACxD,iFAAiF;gBACjF,SAAS;YACb,CAAC;YAED,6DAA6D;YAC7D,EAAE;YACF,wFAAwF;YACxF,gFAAgF;YAChF,iFAAiF;YACjF,6EAA6E;YAC7E,qFAAqF;YACrF,qFAAqF;YACrF,4DAA4D;YAC5D,MAAM,KAAK,GAAG,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,oBAAoB,CAAC,GAAG,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAClG,IAAI,CAAC,KAAK,EAAE,CAAC;gBACT,QAAQ,CAAC,+DAA+D,MAAM,CAAC,cAAc,oBAAoB,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC;gBAC9H,SAAS;YACb,CAAC;YACD,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,eAAe,CAAqC,0BAA0B,EAAE,KAAK,CAAC,CAAC;YACvH,8GAA8G;YAC9G,QAAQ,CAAC,uBAAuB,EAAE,CAAC;YACnC,IAAI,CAAC,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;gBACpC,QAAQ,CAAC,kDAAkD,MAAM,CAAC,EAAE,YAAY,CAAC,CAAC;gBAClF,SAAS;YACb,CAAC;YACD,IAAI,QAAQ,CAAC,MAAM,KAAK,aAAa,EAAE,CAAC;gBACpC,qEAAqE;gBACrE,SAAS;YACb,CAAC;YACD,sFAAsF;YACtF,oFAAoF;YACpF,IAAI,uBAAuB,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC/C,QAAQ,CAAC,MAAM,GAAG,UAAU,CAAC;YACjC,CAAC;iBAAM,CAAC;gBACJ,QAAQ,CAAC,MAAM,GAAG,OAAO,CAAC;gBAC1B,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;oBACpB,QAAQ,CAAC,OAAO,GAAG,GAAG,CAAC,YAAY,IAAI,UAAU,CAAC;gBACtD,CAAC;YACL,CAAC;YAED,IAAI,MAAM,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC;gBACxB,MAAM,EAAE,CAAC;YACb,CAAC;iBAAM,CAAC;gBACJ,MAAM,MAAM,GAAG,QAAQ,CAAC,YAAY,CAAC;gBACrC,QAAQ,CACJ,mDAAmD,MAAM,CAAC,EAAE,IAAI;oBAChE,GAAG,MAAM,EAAE,eAAe,IAAI,MAAM,EAAE,OAAO,IAAI,YAAY,EAAE,CAClE,CAAC;YACN,CAAC;QACL,CAAC;QAED,IAAI,MAAM,GAAG,CAAC,EAAE,CAAC;YACb,SAAS,CAAC,mCAAmC,MAAM,sDAAsD,CAAC,CAAC;QAC/G,CAAC;QACD,OAAO,MAAM,CAAC;IAClB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACX,4DAA4D;QAC5D,QAAQ,CAAC,yCAAyC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACtG,OAAO,CAAC,CAAC;IACb,CAAC;AACL,CAAC;AAQD,SAAS,iBAAiB,CAAC,QAA2B;IAClD,MAAM,CAAC,GAAG,QAAwD,CAAC;IACnE,OAAO,OAAO,CAAC,CAAC,eAAe,KAAK,UAAU,IAAI,OAAO,CAAC,CAAC,kBAAkB,KAAK,UAAU,CAAC;AACjG,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,oBAAoB,CAAC,QAA2B;IACrD,MAAM,IAAI,GAAG,QAAQ,CAAC,YAAY,CAAC,mBAAmB,CAAC,CAAC;IACxD,IAAI,CAAC,IAAI,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,EAAE,CAAC;QACxC,OAAO,EAAE,CAAC;IACd,CAAC;IACD,MAAM,QAAQ,GAAG,qBAAqB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACpE,OAAO,CACH,sBAAsB,QAAQ,CAAC,eAAe,CAAC,sBAAsB,CAAC,EAAE;QACxE,SAAS,QAAQ,CAAC,kBAAkB,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC,EAAE;QACtE,UAAU,QAAQ,CAAC,eAAe,CAAC,QAAQ,CAAC,QAAQ,QAAQ,IAAI,CACnE,CAAC;AACN,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,gBAAgB,CAC3B,EAAW,EACX,SAAmB,EACnB,WAAqB;IAErB,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC5E,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,OAAO,CAC3B;QACI,UAAU,EAAE,mBAAmB;QAC/B,WAAW,EAAE,4BAA4B,MAAM,GAAG;QAClD,OAAO,EAAE,qBAAqB;QAC9B,UAAU,EAAE,eAAe;KAC9B,EACD,WAAW,CACd,CAAC;IACF,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QAClB,OAAO,IAAI,GAAG,EAAE,CAAC;IACrB,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,GAAG,EAA8B,CAAC;IACrD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC;QACrC,MAAM,QAAQ,GAAG,GAAG,CAAC,oBAAoB,CAAC;QAC1C,IAAI,CAAC,QAAQ,IAAI,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YACpC,SAAS,CAAC,uCAAuC;QACrD,CAAC;QACD,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IAC9B,CAAC;IAED,yDAAyD;IACzD,KAAK,MAAM,CAAC,QAAQ,EAAE,GAAG,CAAC,IAAI,MAAM,EAAE,CAAC;QACnC,IAAI,CAAC,qBAAqB,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YAC9C,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC5B,CAAC;IACL,CAAC;IACD,OAAO,MAAM,CAAC;AAClB,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,sBAAsB,CACjC,EAAW,EACX,eAAyB,EACzB,WAAqB;IAErB,MAAM,MAAM,GAAG,IAAI,GAAG,EAAoB,CAAC;IAC3C,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/B,OAAO,MAAM,CAAC;IAClB,CAAC;IACD,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAChG,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,OAAO,CAC3B;QACI,UAAU,EAAE,mBAAmB;QAC/B,WAAW,EAAE,UAAU,MAAM,GAAG;QAChC,MAAM,EAAE,CAAC,IAAI,EAAE,QAAQ,CAAC;QACxB,UAAU,EAAE,QAAQ;KACvB,EACD,WAAW,CACd,CAAC;IACF,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QAClB,OAAO,MAAM,CAAC;IAClB,CAAC;IACD,MAAM,SAAS,GAAG,WAAW,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACxD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC;QACrC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC;YACd,SAAS;QACb,CAAC;QACD,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACvC,IAAI,IAAI,EAAE,CAAC;YACP,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;QAC7B,CAAC;IACL,CAAC;IACD,OAAO,MAAM,CAAC;AAClB,CAAC"}

package/dist/generic/PubSubManager.d.ts

@@ -1,5 +1,12 @@
 import { PubSubEngine } from 'type-graphql';
 import { BaseSingleton } from '@memberjunction/global';
+/**
+ * Wraps a TypeGraphQL `PubSubEngine` so that publishes to {@link PUSH_STATUS_UPDATES_TOPIC}
+ * carrying a specific `sessionId` (`sessionId !== '*'`) are dynamically routed in $O(1)$ to
+ * `PUSH_STATUS_UPDATES:session:<sessionId>` instead of waking every connected browser tab.
+ * Wildcard (`sessionId === '*'`) updates continue to publish on {@link PUSH_STATUS_UPDATES_TOPIC}.
+ */
+export declare function CreateSessionRoutingPubSub(pubSub: PubSubEngine): PubSubEngine;
 /**
  * Singleton manager that holds a reference to the type-graphql PubSubEngine,
  * allowing any server-side code (not just resolvers with @PubSub() injection)
@@ -12,6 +19,7 @@ export declare class PubSubManager extends BaseSingleton<PubSubManager> {
     /**
      * Sets the PubSubEngine instance. Should be called once during server startup
      * after buildSchemaSync creates the PubSub instance.
+     * Automatically installs $O(1)$ dynamic session routing for `PUSH_STATUS_UPDATES`.
      */
     SetPubSubEngine(pubSub: PubSubEngine): void;
     /**
@@ -20,6 +28,8 @@ export declare class PubSubManager extends BaseSingleton<PubSubManager> {
     get PubSubEngine(): PubSubEngine | null;
     /**
      * Publishes a payload to the specified topic via the PubSubEngine.
+     * For `CACHE_INVALIDATION`, automatically stamps a monotonic sequence number and
+     * records the event in the active {@link BaseCacheInvalidationBroadcastProvider}'s ring buffer.
      * No-op if the PubSubEngine has not been configured yet.
      */
     Publish(topic: string, payload: Record<string, unknown>): void;

package/dist/generic/PubSubManager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"PubSubManager.d.ts","sourceRoot":"","sources":["../../src/generic/PubSubManager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAEvD;;;;GAIG;AACH,qBAAa,aAAc,SAAQ,aAAa,CAAC,aAAa,CAAC;IAC3D,OAAO,CAAC,OAAO,CAA6B;IAE5C,SAAS;IAIT,WAAkB,QAAQ,IAAI,aAAa,CAE1C;IAED;;;OAGG;IACI,eAAe,CAAC,MAAM,EAAE,YAAY,GAAG,IAAI;IAIlD;;OAEG;IACH,IAAW,YAAY,IAAI,YAAY,GAAG,IAAI,CAE7C;IAED;;;OAGG;IACI,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI;CAOxE"}
+{"version":3,"file":"PubSubManager.d.ts","sourceRoot":"","sources":["../../src/generic/PubSubManager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAavD;;;;;GAKG;AACH,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,YAAY,GAAG,YAAY,CAqB7E;AAED;;;;GAIG;AACH,qBAAa,aAAc,SAAQ,aAAa,CAAC,aAAa,CAAC;IAC3D,OAAO,CAAC,OAAO,CAA6B;IAE5C,SAAS;IAIT,WAAkB,QAAQ,IAAI,aAAa,CAE1C;IAED;;;;OAIG;IACI,eAAe,CAAC,MAAM,EAAE,YAAY,GAAG,IAAI;IAIlD;;OAEG;IACH,IAAW,YAAY,IAAI,YAAY,GAAG,IAAI,CAE7C;IAED;;;;;OAKG;IACI,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI;CAiBxE"}