@memberjunction/server 6.2.0-edge.4 → 6.2.0-edge.6

package/src/generic/CacheInvalidationResolver.ts

@@ -1,5 +1,9 @@
-import { Field, ObjectType, Resolver, Root, Subscription } from 'type-graphql';
-import { Metadata, UserInfo } from '@memberjunction/core';
+import 'reflect-metadata';
+import { Arg, Ctx, Field, Int, ObjectType, Query, Resolver, Root, Subscription } from 'type-graphql';
+import { EntityInfo, Metadata, RecordChangeFieldSecurityProjector, RecordChangesEntityName, UserInfo } from '@memberjunction/core';
+import {
+    CacheInvalidationBroadcastManager,
+} from '../broadcast/index.js';
 
 export const CACHE_INVALIDATION_TOPIC = 'CACHE_INVALIDATION';
 
@@ -36,22 +40,55 @@ export function ConfigureRecordDataBroadcast(entities: readonly string[] | undef
  *
  * The subscription below is filtered only by ENTITY-level read permission, so anything included
  * here is disclosed to every signed-in session that may read the entity at all — regardless of
- * row-level security or any tenant scoping a consumer applies on the read path, neither of which
- * this push traverses. The answer is therefore NO unless a deployment has explicitly opted the
- * entity in via `cacheSettings.recordDataBroadcastEntities`.
+ * row-level security, field-level security, or any tenant scoping a consumer applies on the read
+ * path, none of which this push traverses. The answer is therefore NO unless a deployment has
+ * explicitly opted the entity in via `cacheSettings.recordDataBroadcastEntities`, and always NO
+ * for an entity under field-level security (its own flag or an IS-A ancestor's), and for
+ * `MJ: Record Changes`, whatever the allowlist says: the row would carry columns (or, for Record
+ * Changes, other entities' values) some of those sessions may not read.
  *
  * Callers that get `false` simply omit `recordData`; the event still carries the entity name and
  * primary key, so clients evict and re-fetch through the normal access-controlled read path.
  *
  * Matching is exact (trimmed, case-insensitive) rather than substring: a loose match would let an
  * allowlisted name drag in every entity whose name contains it.
+ *
+ * @param entityInfo The entity's metadata, when the caller holds it. Otherwise it is looked up by
+ *   name, so the field-security refusal applies either way.
  */
-export function MayBroadcastRecordData(entityName: string): boolean {
+export function MayBroadcastRecordData(entityName: string, entityInfo?: EntityInfo | null): boolean {
   if (allowedRecordDataEntities.length === 0) return false;
+  if (fieldSecurityApplies(entityName, entityInfo)) return false;
+  if (isRecordChanges(entityName, entityInfo)) return false;
   if (allowedRecordDataEntities.includes('*')) return true;
   return allowedRecordDataEntities.includes(entityName.trim().toLowerCase());
 }
 
+/** Whether field-level security applies to the entity, resolving it by name when not supplied. */
+function fieldSecurityApplies(entityName: string, entityInfo: EntityInfo | null | undefined): boolean {
+  const info = entityInfo ?? lookUpEntity(entityName);
+  return Boolean(info?.FieldLevelSecurityApplies);
+}
+
+/**
+ * Whether the entity is the Record Changes audit trail. Its rows carry other entities' values in
+ * `ChangesJSON` and `FullRecordJSON`, which are projected per reader, so a row is never broadcast
+ * even though field-level security is not switched on for the audit entity itself.
+ */
+function isRecordChanges(entityName: string, entityInfo: EntityInfo | null | undefined): boolean {
+  if (entityInfo) return RecordChangeFieldSecurityProjector.IsRecordChangesEntity(entityInfo);
+  return entityName.trim().toLowerCase() === RecordChangesEntityName.toLowerCase();
+}
+
+/** The entity by name from the process's metadata, or undefined when none is loaded. */
+function lookUpEntity(entityName: string): EntityInfo | undefined {
+  try {
+    return new Metadata().EntityByName(entityName) ?? undefined; // global-provider-ok: metadata lookup for a process-wide broadcast gate
+  } catch {
+    return undefined;
+  }
+}
+
 @ObjectType()
 export class CacheInvalidationNotification {
     @Field(() => String)
@@ -74,6 +111,48 @@ export class CacheInvalidationNotification {
 
     @Field(() => String, { nullable: true })
     RecordData?: string;
+
+    @Field(() => Int, { nullable: true })
+    Sequence?: number;
+}
+
+@ObjectType()
+export class CacheInvalidationCatchUpResult {
+    @Field(() => Boolean)
+    RequiresFullRefresh!: boolean;
+
+    @Field(() => Int)
+    CurrentSequence!: number;
+
+    @Field(() => String)
+    ServerProcessID!: string;
+
+    @Field(() => [CacheInvalidationNotification])
+    Events!: CacheInvalidationNotification[];
+}
+
+@ObjectType()
+export class CacheBroadcastConnectionToken {
+    @Field(() => String)
+    Provider!: string;
+
+    @Field(() => String)
+    Url!: string;
+
+    @Field(() => String, { nullable: true })
+    Token?: string;
+
+    @Field(() => [String])
+    Groups!: string[];
+
+    @Field(() => String)
+    ExpiresAt!: string;
+
+    @Field(() => String)
+    ServerProcessID!: string;
+
+    @Field(() => Int)
+    CurrentSequence!: number;
 }
 
 /**
@@ -88,6 +167,7 @@ export interface CacheInvalidationPayload {
     timestamp: Date;
     originSessionId?: string;
     recordData?: string;
+    sequence?: number;
 }
 
 /**
@@ -116,39 +196,65 @@ export interface CacheInvalidationFilterContext {
  * see the class docblock below.
  *
  * `GetUserPermisions` is an in-memory match of the entity's permission rows against the user's
- * roles, so this stays cheap enough to run per subscriber per event. It is not free: it runs for
- * every connected socket on every save, so keep it free of I/O.
+ * roles, memoized per `(payload, entityName, roleFingerprint)` by the active
+ * {@link BaseCacheInvalidationBroadcastProvider} so $N$ connected subscribers sharing $R$ role
+ * combinations only run `GetUserPermisions` $R$ times per event.
  */
 export function CacheInvalidationFilter(data: {
     payload: CacheInvalidationPayload;
     context: CacheInvalidationFilterContext | undefined;
 }): boolean {
     const user = data.context?.userPayload?.userRecord as UserInfo | undefined;
-    // FAIL CLOSED on identity, matching `statusUpdatesFilter`. `onConnect` rejects a socket whose
-    // token does not validate, so a subscriber with no user record should not exist; if one does,
-    // it is the case least deserving of an unfiltered firehose.
     if (!user) {
         return false;
     }
+    return CacheInvalidationBroadcastManager.Instance.Provider.EvaluateEntityReadAccess(
+        data.payload,
+        user,
+        (entityName) => new Metadata().EntityByName(entityName) // global-provider-ok: subscription filter — server-wide metadata, no request-scoped provider exists here
+    );
+}
 
-    const entityName = data.payload?.entityName;
-    if (!entityName) {
-        return false;
-    }
+/** The part of a permission row and of a user this module reads, so the rule can be tested on plain objects. */
+export interface ReadPermissionRow {
+    RoleID: string;
+    CanRead: boolean | null;
+    /** `Deny` rows subtract; they never carry the read the rule looks at. */
+    IsDeny?: boolean;
+    Type?: string | null;
+    ReadRLSFilterID: string | null;
+}
+export interface RoleHolder {
+    UserRoles?: ReadonlyArray<{ RoleID: string }> | null;
+}
 
-    // A pub/sub subscription filter has no per-request provider to thread: it runs on the server's
-    // own metadata, which is the one place the entity's permission rows can be answered from.
-    const entity = new Metadata().EntityByName(entityName); // global-provider-ok: subscription filter — server-wide metadata, no request-scoped provider exists here
-    // DELIVER when the entity is unknown here, deliberately — the opposite of the choice above.
-    // A name absent from metadata cannot be permission-checked, and withholding would silently
-    // stop invalidating a legitimately cacheable entity, which is a correctness bug rather than a
-    // disclosure one. All it discloses is the name and key of something this server cannot
-    // describe.
-    if (!entity) {
-        return true;
-    }
+/**
+ * Is this user's read of the entity row-filtered? True when every read the user holds on the entity comes through a permission
+ * row that carries a `ReadRLSFilterID`: there is a row-level security filter between them and the rows, so a record's key, its
+ * existence and when it changed are not theirs to learn unless the row passes the filter — which a subscription filter cannot
+ * evaluate per event. False when any of their read rows is unfiltered (they could read the row anyway), and false when they hold
+ * no read at all (the entity-level filter has already withheld the event).
+ *
+ * The same in-memory match `GetUserPermisions` does, with no I/O, so it can run per subscriber per event.
+ */
+export function ReadIsRowFiltered(entity: { Permissions: ReadonlyArray<ReadPermissionRow> }, user: RoleHolder): boolean {
+    return CacheInvalidationBroadcastManager.Instance.Provider.ReadIsRowFiltered(entity, user);
+}
 
-    return entity.GetUserPermisions(user).CanRead;
+/**
+ * The event as one subscriber may see it. A subscriber whose read of the entity is row-filtered gets the entity, the action and
+ * the time, and neither the key nor the row: "something in this entity changed", which the client already takes as a
+ * whole-entity invalidation (a null key on `remote-invalidate`). Everyone else gets the event as published.
+ *
+ * Memoized per `(payload, entity, roleFingerprint)` via the active broadcast provider so $N$ subscribers
+ * sharing $R$ role buckets only allocate and evaluate `ReadIsRowFiltered` $R$ times per event.
+ */
+export function ShapeCacheInvalidationEvent(
+    payload: CacheInvalidationPayload,
+    user: RoleHolder | undefined,
+    entity: { Permissions: ReadonlyArray<ReadPermissionRow> } | null | undefined,
+): CacheInvalidationNotification {
+    return CacheInvalidationBroadcastManager.Instance.Provider.ShapeEventForSubscriber(payload, user, entity);
 }
 
 /** @deprecated Use {@link CacheInvalidationFilter}. */
@@ -165,29 +271,8 @@ export class CacheInvalidationResolver {
      * Subscription that broadcasts cache invalidation events to connected clients, so cross-server
      * cache invalidation reaches browsers.
      *
-     * Delivery is filtered only by ENTITY-level read permission (see {@link CacheInvalidationFilter}).
-     * Every session that may read an entity at all still receives every event for it, from every
-     * other session and tenant.
-     *
-     * Because that narrowing stops well short of row level, `RecordData` is only populated for entities a
-     * deployment has opted in through `cacheSettings.recordDataBroadcastEntities` — see
-     * {@link MayBroadcastRecordData}, applied at both publish sites.
-     *
-     * `EntityName`, `PrimaryKeyValues`, `Action` and `Timestamp` ARE still broadcast to every
-     * session, and that is a disclosure, not a safe residue. An earlier version of this comment
-     * called them "safe to broadcast" on the grounds that reading the record still goes through
-     * the access-controlled path — true of the row's CONTENTS, and beside the point for the
-     * metadata itself. A session with no relationship to a record still learns that it exists,
-     * its stable key, and every time it changes; across entities it learns the cadence and volume
-     * of another tenant's activity.
-     *
-     * The key is kept deliberately, because consumers need it to re-read the record they were
-     * told about (see `ResolveEntityEventKey` in @memberjunction/core) and because the alternative
-     * — a coarse "something in this entity changed" — forces whole-entity invalidation on the
-     * hottest write paths. That is a trade, not an absence of cost. Narrowing it means filtering
-     * delivery per subscriber, which needs an authorization predicate cheap enough to run per
-     * subscriber per event; entity-level permissions (`EntityInfo.GetUserPermisions`, an in-memory
-     * role match) would cover part of it, row-level tenancy would not.
+     * Delivery is filtered by ENTITY-level read permission (see {@link CacheInvalidationFilter})
+     * and shaped per role-fingerprint bucket (see {@link ShapeCacheInvalidationEvent}).
      */
     @Subscription(() => CacheInvalidationNotification, {
         topics: CACHE_INVALIDATION_TOPIC,
@@ -195,16 +280,43 @@ export class CacheInvalidationResolver {
             CacheInvalidationFilter(data),
     })
     cacheInvalidation(  // case-violation-ok-legacy-back-compat: the property name is the GraphQL schema field name — renaming it breaks every client query
-        @Root() payload: CacheInvalidationPayload
+        @Root() payload: CacheInvalidationPayload,
+        @Ctx() context: CacheInvalidationFilterContext | undefined
     ): CacheInvalidationNotification {
-        return {
-            EntityName: payload.entityName,
-            PrimaryKeyValues: payload.primaryKeyValues ?? undefined,
-            Action: payload.action,
-            SourceServerID: payload.sourceServerId,
-            Timestamp: payload.timestamp,
-            OriginSessionID: payload.originSessionId ?? undefined,
-            RecordData: payload.recordData ?? undefined,
-        };
+        const user = context?.userPayload?.userRecord as UserInfo | undefined;
+        const provider = CacheInvalidationBroadcastManager.Instance.Provider;
+        const entity = payload?.entityName ? provider.ResolveEntityForPayload(payload) : null;
+        return provider.ShapeEventForSubscriber(payload, user, entity);
+    }
+
+    /**
+     * Returns all permission-allowed, RLS-shaped cache invalidation events strictly after
+     * `sinceSequence` from the server's bounded circular ring buffer.
+     *
+     * Invoked by `GraphQLDataProvider` when an HTTP response's `X-MJ-Cache-Seq` header or a
+     * WebSocket reconnect reveals missed invalidation sequence numbers.
+     */
+    @Query(() => CacheInvalidationCatchUpResult)
+    GetCacheInvalidationsSince(
+        @Arg('sinceSequence', () => Int) sinceSequence: number,
+        @Ctx() context: CacheInvalidationFilterContext | undefined
+    ): CacheInvalidationCatchUpResult {
+        const user = context?.userPayload?.userRecord as UserInfo | undefined;
+        return CacheInvalidationBroadcastManager.Instance.Provider.GetChangesSince(sinceSequence, user);
+    }
+
+    /**
+     * Negotiates a client broadcast connection (URL, signed token, and authorized role-bucket groups)
+     * for the active {@link BaseCacheInvalidationBroadcastProvider}.
+     */
+    @Query(() => CacheBroadcastConnectionToken)
+    async NegotiateCacheBroadcastConnection(
+        @Ctx() context: CacheInvalidationFilterContext | undefined
+    ): Promise<CacheBroadcastConnectionToken> {
+        const user = context?.userPayload?.userRecord as UserInfo | undefined;
+        if (!user) {
+            throw new Error('Authentication required to negotiate cache broadcast connection.');
+        }
+        return CacheInvalidationBroadcastManager.Instance.Provider.NegotiateClientConnection(user);
     }
 }

package/src/generic/OrphanedConversationDetailReconciler.ts

@@ -2,7 +2,7 @@ import { LogError, LogStatus, RunView } from '@memberjunction/core';
 import { IndexByUUID } from '@memberjunction/global';
 import { UserCache } from '@memberjunction/sqlserver-dataprovider';
 import type { IMetadataProvider, UserInfo } from '@memberjunction/core';
-import type { MJAIAgentRunEntity, MJConversationDetailEntity } from '@memberjunction/core-entities';
+import type { MJAIAgentRunEntity, MJConversationDetailEntity, MJConversationDetailEntityExtended } from '@memberjunction/core-entities';
 
 /**
  * Grace period after a run reaches a terminal state before its conversation detail is considered
@@ -110,7 +110,9 @@ export async function ReconcileOrphanedConversationDetails(
                 LogError(`[OrphanDetailReconciler] No owner resolved for conversation ${detail.ConversationID}; leaving detail ${detail.ID}`);
                 continue;
             }
-            const writable = await provider.GetEntityObject<MJConversationDetailEntity>('MJ: Conversation Details', owner);
+            const writable = await provider.GetEntityObject<MJConversationDetailEntityExtended>('MJ: Conversation Details', owner);
+            // Closing an agent's reply is the server's write: unmarked, the gate refuses any change to what a reply says.
+            writable.MarkServerAuthoredReply();
             if (!(await writable.Load(detail.ID))) {
                 LogError(`[OrphanDetailReconciler] Could not load detail ${detail.ID} for write`);
                 continue;

package/src/generic/PubSubManager.ts

@@ -1,5 +1,45 @@
 import { PubSubEngine } from 'type-graphql';
 import { BaseSingleton } from '@memberjunction/global';
+import {
+    CACHE_INVALIDATION_TOPIC,
+    type CacheInvalidationPayload,
+} from './CacheInvalidationResolver.js';
+import {
+    GetSessionStatusTopic,
+    PUSH_STATUS_UPDATES_TOPIC,
+} from './PushStatusResolver.js';
+import { CacheInvalidationBroadcastManager } from '../broadcast/index.js';
+
+const _wrappedPubSubEngines = new WeakSet<PubSubEngine>();
+
+/**
+ * Wraps a TypeGraphQL `PubSubEngine` so that publishes to {@link PUSH_STATUS_UPDATES_TOPIC}
+ * carrying a specific `sessionId` (`sessionId !== '*'`) are dynamically routed in $O(1)$ to
+ * `PUSH_STATUS_UPDATES:session:<sessionId>` instead of waking every connected browser tab.
+ * Wildcard (`sessionId === '*'`) updates continue to publish on {@link PUSH_STATUS_UPDATES_TOPIC}.
+ */
+export function CreateSessionRoutingPubSub(pubSub: PubSubEngine): PubSubEngine {
+    if (!pubSub || typeof pubSub.publish !== 'function' || _wrappedPubSubEngines.has(pubSub)) {
+        return pubSub;
+    }
+    const rawPublish = pubSub.publish.bind(pubSub);
+    pubSub.publish = async (routingKey: string, payload: unknown): Promise<void> => {
+        if (
+            routingKey === PUSH_STATUS_UPDATES_TOPIC &&
+            typeof payload === 'object' &&
+            payload !== null
+        ) {
+            const sessionId = (payload as { sessionId?: unknown }).sessionId;
+            if (typeof sessionId === 'string' && sessionId.trim().length > 0 && sessionId.trim() !== '*') {
+                await rawPublish(GetSessionStatusTopic(sessionId), payload);
+                return;
+            }
+        }
+        await rawPublish(routingKey, payload);
+    };
+    _wrappedPubSubEngines.add(pubSub);
+    return pubSub;
+}
 
 /**
  * Singleton manager that holds a reference to the type-graphql PubSubEngine,
@@ -20,9 +60,10 @@ export class PubSubManager extends BaseSingleton<PubSubManager> {
     /**
      * Sets the PubSubEngine instance. Should be called once during server startup
      * after buildSchemaSync creates the PubSub instance.
+     * Automatically installs $O(1)$ dynamic session routing for `PUSH_STATUS_UPDATES`.
      */
     public SetPubSubEngine(pubSub: PubSubEngine): void {
-        this._pubSub = pubSub;
+        this._pubSub = CreateSessionRoutingPubSub(pubSub);
     }
 
     /**
@@ -34,9 +75,21 @@ export class PubSubManager extends BaseSingleton<PubSubManager> {
 
     /**
      * Publishes a payload to the specified topic via the PubSubEngine.
+     * For `CACHE_INVALIDATION`, automatically stamps a monotonic sequence number and
+     * records the event in the active {@link BaseCacheInvalidationBroadcastProvider}'s ring buffer.
      * No-op if the PubSubEngine has not been configured yet.
      */
     public Publish(topic: string, payload: Record<string, unknown>): void {
+        if (topic === CACHE_INVALIDATION_TOPIC) {
+            const provider = CacheInvalidationBroadcastManager.Instance.Provider;
+            const entityName = typeof payload.entityName === 'string' ? payload.entityName : undefined;
+            if (!provider.ShouldBroadcastEntity(entityName)) {
+                return;
+            }
+            if (payload.sequence === undefined) {
+                provider.RecordInvalidation(payload as unknown as CacheInvalidationPayload);
+            }
+        }
         if (this._pubSub) {
             this._pubSub.publish(topic, payload);
         } else {

package/src/generic/PushStatusResolver.ts

@@ -1,6 +1,8 @@
+import 'reflect-metadata';
 import { Arg, Field, ID, ObjectType, PubSubEngine, Resolver, ResolverFilterData, Root, Subscription } from 'type-graphql';
 import { MJGlobal, UUIDsEqual } from '@memberjunction/global';
 import { UserPayload } from '../types.js';
+import { ResolveSessionScopeIdentity, type SessionAccessPrincipal } from '../realtimeSessions/sessionAccess.js';
 
 export const PUSH_STATUS_UPDATES_TOPIC = 'PUSH_STATUS_UPDATES';
 
@@ -94,6 +96,57 @@ export function ParseReplicatedStatusUpdate(raw: string, localServerId: string):
   return { sessionId, ownerUserId, message: body, SourceServerId: source };
 }
 
+/**
+ * Returns the $O(1)$ session-scoped pub/sub topic name for a given `sessionId`.
+ * Wildcard (`'*'`) or empty session IDs fall back to the broadcast {@link PUSH_STATUS_UPDATES_TOPIC}.
+ */
+export function GetSessionStatusTopic(sessionId: string): string {
+  const normalized = sessionId?.trim();
+  if (!normalized || normalized === '*') {
+    return PUSH_STATUS_UPDATES_TOPIC;
+  }
+  return `${PUSH_STATUS_UPDATES_TOPIC}:session:${normalized}`;
+}
+
+interface ParsedMessageCacheEntry {
+   parsed: Record<string, unknown> | null;
+   isJson: boolean;
+}
+
+const _parsedMessageMemo = new WeakMap<PushStatusNotificationPayload, ParsedMessageCacheEntry>();
+
+/**
+ * Parses and memoizes the JSON `message` envelope on a {@link PushStatusNotificationPayload}
+ * in a `WeakMap` so multiple consumers (`ShouldReplicateStatusUpdate`, filters, hooks) never
+ * call `JSON.parse` more than once per payload object.
+ */
+export function ParseStatusUpdateMessage(
+  payload: PushStatusNotificationPayload
+): ParsedMessageCacheEntry {
+  const cached = _parsedMessageMemo.get(payload);
+  if (cached) {
+    return cached;
+  }
+  if (!payload.message) {
+    const emptyEntry: ParsedMessageCacheEntry = { parsed: null, isJson: false };
+    _parsedMessageMemo.set(payload, emptyEntry);
+    return emptyEntry;
+  }
+  try {
+    const raw: unknown = JSON.parse(payload.message);
+    const entry: ParsedMessageCacheEntry = {
+      parsed: typeof raw === 'object' && raw !== null ? (raw as Record<string, unknown>) : null,
+      isJson: true,
+    };
+    _parsedMessageMemo.set(payload, entry);
+    return entry;
+  } catch {
+    const plainEntry: ParsedMessageCacheEntry = { parsed: null, isJson: false };
+    _parsedMessageMemo.set(payload, plainEntry);
+    return plainEntry;
+  }
+}
+
 /**
  * Whether an update is worth sending to other server instances.
  *
@@ -103,10 +156,20 @@ export function ParseReplicatedStatusUpdate(raw: string, localServerId: string):
  * Progress and completion are low-rate and each is individually meaningful, which is exactly the
  * kind of message that must survive landing on the wrong replica.
  */
-export function ShouldReplicateStatusUpdate(message?: string): boolean {
+export function ShouldReplicateStatusUpdate(
+  message?: string,
+  payload?: PushStatusNotificationPayload
+): boolean {
   if (!message) {
     return false;
   }
+  if (payload && payload.message === message) {
+    const entry = ParseStatusUpdateMessage(payload);
+    if (!entry.isJson) {
+      return true;
+    }
+    return entry.parsed?.type !== 'StreamingContent';
+  }
   try {
     const parsed: unknown = JSON.parse(message);
     const type = (parsed as { type?: unknown })?.type;
@@ -150,7 +213,7 @@ export function PublishStatusUpdate(pubSub: PubSubEngine, params: StatusUpdatePa
   // Fan out to other instances. Only reached by updates originating HERE: a message arriving from
   // the bus is republished straight onto the local topic and never comes back through this
   // function, so there is no loop to break beyond the SourceServerId check on the receiving side.
-  if (_publishHook && ShouldReplicateStatusUpdate(params.message)) {
+  if (_publishHook && ShouldReplicateStatusUpdate(params.message, payload)) {
     try {
       _publishHook(payload);
     } catch {
@@ -170,18 +233,47 @@ export interface StatusUpdatesFilterContext {
   userPayload?: UserPayload;
 }
 
+/**
+ * The owner key of a status update for `user`: its user ID, or, for an anonymous visitor, its user ID plus its scope
+ * identity (`ResolveSessionScopeIdentity`). Every anonymous visitor shares one Anonymous user and the session id is
+ * chosen by the client (`x-session-id`), so the user ID alone would let one visitor receive another's run events.
+ * An anonymous visitor with no scope identity gets no key and receives nothing.
+ */
+export function StatusUpdateOwnerKey(user: SessionAccessPrincipal | null | undefined): string {
+  if (!user?.ID) {
+    return '';
+  }
+  if (!user.IsMagicLinkAnonymous) {
+    return user.ID;
+  }
+  const scope = ResolveSessionScopeIdentity(user);
+  return scope ? `${user.ID.toLowerCase()}|${scope}` : '';
+}
+
+/**
+ * The owner key a status update is published with: that of the request's user, or, on a payload elevated by
+ * `ElevateUserPayload`, of the user the elevated principal stands in for (a public widget guest). The guest's socket
+ * is authenticated as the guest, so an update stamped with the elevated system user would never pass
+ * {@link StatusUpdatesFilter} and the guest would wait forever for its run to finish.
+ */
+export function StatusUpdateOwnerID(userPayload: UserPayload | undefined): string {
+  return StatusUpdateOwnerKey(userPayload?.ElevatedFrom ?? userPayload?.userRecord);
+}
+
 /**
  * Filter predicate for the `statusUpdates` subscription. Exported so it can be unit-tested in
  * isolation (it is the security-critical gate). A push reaches a subscriber only when BOTH hold:
- *   1. the push's `sessionId` matches the subscriber's requested `sessionId` (tab routing), AND
- *   2. the push's `ownerUserId` matches the subscriber CONNECTION's authenticated identity
- *      (`context.userPayload.userRecord.ID`, established once at WS connect).
+ *   1. the push's `sessionId` matches the subscriber's requested `sessionId` (tab routing), or is `'*'`, AND
+ *   2. the push's `ownerUserId` matches the owner key ({@link StatusUpdateOwnerKey}) of the subscriber
+ *      CONNECTION's authenticated identity (`context.userPayload.userRecord`, established once at WS
+ *      connect): the user ID for a named user, compared as a UUID; for an anonymous visitor, the user ID
+ *      plus its scope identity, compared exactly because the scope part is case-significant.
  *
  * Condition (2) is the fix for the session-hijack class (B49): `sessionId` is a client-chosen
  * correlation value, so a subscriber who lifts another user's `sessionId` would previously receive
  * their pushes. Binding delivery to the connection's server-authenticated identity means knowing a
- * `sessionId` is no longer sufficient. Fails CLOSED — a missing owner or connection identity never
- * matches.
+ * `sessionId` is no longer sufficient; the scope part does the same between anonymous visitors, who all
+ * share one Anonymous user. Fails CLOSED — a missing owner or connection key never matches.
  */
 export function StatusUpdatesFilter(data: {
   payload: PushStatusNotificationPayload;
@@ -189,14 +281,16 @@ export function StatusUpdatesFilter(data: {
   context: StatusUpdatesFilterContext | undefined;
 }): boolean {
   const { payload, args, context } = data;
-  if (payload.sessionId !== args.sessionId) {
+  if (payload.sessionId !== '*' && payload.sessionId !== args.sessionId) {
     return false;
   }
-  const connectionUserId: string | undefined = context?.userPayload?.userRecord?.ID;
-  if (!connectionUserId || !payload.ownerUserId) {
+  const connectionUser: SessionAccessPrincipal | undefined = context?.userPayload?.userRecord;
+  const connectionKey = StatusUpdateOwnerKey(connectionUser);
+  if (!connectionKey || !payload.ownerUserId) {
     return false; // fail closed — no identity on either side means no delivery
   }
-  return UUIDsEqual(payload.ownerUserId, connectionUserId);
+  // An anonymous visitor's key carries its scope identity (case-significant), so it must match exactly.
+  return connectionUser?.IsMagicLinkAnonymous ? payload.ownerUserId === connectionKey : UUIDsEqual(payload.ownerUserId, connectionKey);
 }
 
 /** @deprecated Use {@link StatusUpdatesFilter}. */
@@ -211,7 +305,10 @@ export function statusUpdatesFilter(data: {
 @Resolver()
 export class PushStatusResolver {
   @Subscription(() => PushStatusNotification, {
-    topics: PUSH_STATUS_UPDATES_TOPIC,
+    topics: ({ args }: { args: PushStatusNotificationArgs }) =>
+      args?.sessionId && args.sessionId !== '*'
+        ? [GetSessionStatusTopic(args.sessionId), PUSH_STATUS_UPDATES_TOPIC]
+        : PUSH_STATUS_UPDATES_TOPIC,
     filter: (data: ResolverFilterData<PushStatusNotificationPayload, PushStatusNotificationArgs, StatusUpdatesFilterContext>) =>
       StatusUpdatesFilter(data),
   })