@memberjunction/server 6.2.0-edge.5 → 6.2.0-edge.7

package/dist/generic/PubSubManager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"PubSubManager.d.ts","sourceRoot":"","sources":["../../src/generic/PubSubManager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAEvD;;;;GAIG;AACH,qBAAa,aAAc,SAAQ,aAAa,CAAC,aAAa,CAAC;IAC3D,OAAO,CAAC,OAAO,CAA6B;IAE5C,SAAS;IAIT,WAAkB,QAAQ,IAAI,aAAa,CAE1C;IAED;;;OAGG;IACI,eAAe,CAAC,MAAM,EAAE,YAAY,GAAG,IAAI;IAIlD;;OAEG;IACH,IAAW,YAAY,IAAI,YAAY,GAAG,IAAI,CAE7C;IAED;;;OAGG;IACI,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI;CAOxE"}
+{"version":3,"file":"PubSubManager.d.ts","sourceRoot":"","sources":["../../src/generic/PubSubManager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAavD;;;;;GAKG;AACH,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,YAAY,GAAG,YAAY,CAqB7E;AAED;;;;GAIG;AACH,qBAAa,aAAc,SAAQ,aAAa,CAAC,aAAa,CAAC;IAC3D,OAAO,CAAC,OAAO,CAA6B;IAE5C,SAAS;IAIT,WAAkB,QAAQ,IAAI,aAAa,CAE1C;IAED;;;;OAIG;IACI,eAAe,CAAC,MAAM,EAAE,YAAY,GAAG,IAAI;IAIlD;;OAEG;IACH,IAAW,YAAY,IAAI,YAAY,GAAG,IAAI,CAE7C;IAED;;;;;OAKG;IACI,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI;CAiBxE"}

package/dist/generic/PubSubManager.js

@@ -1,4 +1,34 @@
 import { BaseSingleton } from '@memberjunction/global';
+import { CACHE_INVALIDATION_TOPIC, } from './CacheInvalidationResolver.js';
+import { GetSessionStatusTopic, PUSH_STATUS_UPDATES_TOPIC, } from './PushStatusResolver.js';
+import { CacheInvalidationBroadcastManager } from '../broadcast/index.js';
+const _wrappedPubSubEngines = new WeakSet();
+/**
+ * Wraps a TypeGraphQL `PubSubEngine` so that publishes to {@link PUSH_STATUS_UPDATES_TOPIC}
+ * carrying a specific `sessionId` (`sessionId !== '*'`) are dynamically routed in $O(1)$ to
+ * `PUSH_STATUS_UPDATES:session:<sessionId>` instead of waking every connected browser tab.
+ * Wildcard (`sessionId === '*'`) updates continue to publish on {@link PUSH_STATUS_UPDATES_TOPIC}.
+ */
+export function CreateSessionRoutingPubSub(pubSub) {
+    if (!pubSub || typeof pubSub.publish !== 'function' || _wrappedPubSubEngines.has(pubSub)) {
+        return pubSub;
+    }
+    const rawPublish = pubSub.publish.bind(pubSub);
+    pubSub.publish = async (routingKey, payload) => {
+        if (routingKey === PUSH_STATUS_UPDATES_TOPIC &&
+            typeof payload === 'object' &&
+            payload !== null) {
+            const sessionId = payload.sessionId;
+            if (typeof sessionId === 'string' && sessionId.trim().length > 0 && sessionId.trim() !== '*') {
+                await rawPublish(GetSessionStatusTopic(sessionId), payload);
+                return;
+            }
+        }
+        await rawPublish(routingKey, payload);
+    };
+    _wrappedPubSubEngines.add(pubSub);
+    return pubSub;
+}
 /**
  * Singleton manager that holds a reference to the type-graphql PubSubEngine,
  * allowing any server-side code (not just resolvers with @PubSub() injection)
@@ -15,9 +45,10 @@ export class PubSubManager extends BaseSingleton {
     /**
      * Sets the PubSubEngine instance. Should be called once during server startup
      * after buildSchemaSync creates the PubSub instance.
+     * Automatically installs $O(1)$ dynamic session routing for `PUSH_STATUS_UPDATES`.
      */
     SetPubSubEngine(pubSub) {
-        this._pubSub = pubSub;
+        this._pubSub = CreateSessionRoutingPubSub(pubSub);
     }
     /**
      * Gets the current PubSubEngine instance, or null if not yet configured.
@@ -27,9 +58,21 @@ export class PubSubManager extends BaseSingleton {
     }
     /**
      * Publishes a payload to the specified topic via the PubSubEngine.
+     * For `CACHE_INVALIDATION`, automatically stamps a monotonic sequence number and
+     * records the event in the active {@link BaseCacheInvalidationBroadcastProvider}'s ring buffer.
      * No-op if the PubSubEngine has not been configured yet.
      */
     Publish(topic, payload) {
+        if (topic === CACHE_INVALIDATION_TOPIC) {
+            const provider = CacheInvalidationBroadcastManager.Instance.Provider;
+            const entityName = typeof payload.entityName === 'string' ? payload.entityName : undefined;
+            if (!provider.ShouldBroadcastEntity(entityName)) {
+                return;
+            }
+            if (payload.sequence === undefined) {
+                provider.RecordInvalidation(payload);
+            }
+        }
         if (this._pubSub) {
             this._pubSub.publish(topic, payload);
         }

package/dist/generic/PubSubManager.js.map

@@ -1 +1 @@
-{"version":3,"file":"PubSubManager.js","sourceRoot":"","sources":["../../src/generic/PubSubManager.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAEvD;;;;GAIG;AACH,MAAM,OAAO,aAAc,SAAQ,aAA4B;IAG3D;QACI,KAAK,EAAE,CAAC;QAHJ,YAAO,GAAwB,IAAI,CAAC;IAI5C,CAAC;IAEM,MAAM,KAAK,QAAQ;QACtB,OAAO,KAAK,CAAC,WAAW,EAAiB,CAAC;IAC9C,CAAC;IAED;;;OAGG;IACI,eAAe,CAAC,MAAoB;QACvC,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;IAC1B,CAAC;IAED;;OAEG;IACH,IAAW,YAAY;QACnB,OAAO,IAAI,CAAC,OAAO,CAAC;IACxB,CAAC;IAED;;;OAGG;IACI,OAAO,CAAC,KAAa,EAAE,OAAgC;QAC1D,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACf,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QACzC,CAAC;aAAM,CAAC;YACJ,OAAO,CAAC,IAAI,CAAC,sCAAsC,KAAK,0BAA0B,CAAC,CAAC;QACxF,CAAC;IACL,CAAC;CACJ"}
+{"version":3,"file":"PubSubManager.js","sourceRoot":"","sources":["../../src/generic/PubSubManager.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,EACH,wBAAwB,GAE3B,MAAM,gCAAgC,CAAC;AACxC,OAAO,EACH,qBAAqB,EACrB,yBAAyB,GAC5B,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,iCAAiC,EAAE,MAAM,uBAAuB,CAAC;AAE1E,MAAM,qBAAqB,GAAG,IAAI,OAAO,EAAgB,CAAC;AAE1D;;;;;GAKG;AACH,MAAM,UAAU,0BAA0B,CAAC,MAAoB;IAC3D,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,CAAC,OAAO,KAAK,UAAU,IAAI,qBAAqB,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QACvF,OAAO,MAAM,CAAC;IAClB,CAAC;IACD,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC/C,MAAM,CAAC,OAAO,GAAG,KAAK,EAAE,UAAkB,EAAE,OAAgB,EAAiB,EAAE;QAC3E,IACI,UAAU,KAAK,yBAAyB;YACxC,OAAO,OAAO,KAAK,QAAQ;YAC3B,OAAO,KAAK,IAAI,EAClB,CAAC;YACC,MAAM,SAAS,GAAI,OAAmC,CAAC,SAAS,CAAC;YACjE,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,IAAI,SAAS,CAAC,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;gBAC3F,MAAM,UAAU,CAAC,qBAAqB,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC,CAAC;gBAC5D,OAAO;YACX,CAAC;QACL,CAAC;QACD,MAAM,UAAU,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IAC1C,CAAC,CAAC;IACF,qBAAqB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAClC,OAAO,MAAM,CAAC;AAClB,CAAC;AAED;;;;GAIG;AACH,MAAM,OAAO,aAAc,SAAQ,aAA4B;IAG3D;QACI,KAAK,EAAE,CAAC;QAHJ,YAAO,GAAwB,IAAI,CAAC;IAI5C,CAAC;IAEM,MAAM,KAAK,QAAQ;QACtB,OAAO,KAAK,CAAC,WAAW,EAAiB,CAAC;IAC9C,CAAC;IAED;;;;OAIG;IACI,eAAe,CAAC,MAAoB;QACvC,IAAI,CAAC,OAAO,GAAG,0BAA0B,CAAC,MAAM,CAAC,CAAC;IACtD,CAAC;IAED;;OAEG;IACH,IAAW,YAAY;QACnB,OAAO,IAAI,CAAC,OAAO,CAAC;IACxB,CAAC;IAED;;;;;OAKG;IACI,OAAO,CAAC,KAAa,EAAE,OAAgC;QAC1D,IAAI,KAAK,KAAK,wBAAwB,EAAE,CAAC;YACrC,MAAM,QAAQ,GAAG,iCAAiC,CAAC,QAAQ,CAAC,QAAQ,CAAC;YACrE,MAAM,UAAU,GAAG,OAAO,OAAO,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;YAC3F,IAAI,CAAC,QAAQ,CAAC,qBAAqB,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC9C,OAAO;YACX,CAAC;YACD,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;gBACjC,QAAQ,CAAC,kBAAkB,CAAC,OAA8C,CAAC,CAAC;YAChF,CAAC;QACL,CAAC;QACD,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACf,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QACzC,CAAC;aAAM,CAAC;YACJ,OAAO,CAAC,IAAI,CAAC,sCAAsC,KAAK,0BAA0B,CAAC,CAAC;QACxF,CAAC;IACL,CAAC;CACJ"}

package/dist/generic/PushStatusResolver.d.ts

@@ -1,5 +1,7 @@
+import 'reflect-metadata';
 import { PubSubEngine } from 'type-graphql';
 import { UserPayload } from '../types.js';
+import { type SessionAccessPrincipal } from '../realtimeSessions/sessionAccess.js';
 export declare const PUSH_STATUS_UPDATES_TOPIC = "PUSH_STATUS_UPDATES";
 export declare class PushStatusNotification {
     message?: string;
@@ -51,6 +53,21 @@ export declare function SetPushStatusPublishHook(hook?: PushStatusPublishHook):
  * @returns The update to republish, or `null` to drop it.
  */
 export declare function ParseReplicatedStatusUpdate(raw: string, localServerId: string): PushStatusNotificationPayload | null;
+/**
+ * Returns the $O(1)$ session-scoped pub/sub topic name for a given `sessionId`.
+ * Wildcard (`'*'`) or empty session IDs fall back to the broadcast {@link PUSH_STATUS_UPDATES_TOPIC}.
+ */
+export declare function GetSessionStatusTopic(sessionId: string): string;
+interface ParsedMessageCacheEntry {
+    parsed: Record<string, unknown> | null;
+    isJson: boolean;
+}
+/**
+ * Parses and memoizes the JSON `message` envelope on a {@link PushStatusNotificationPayload}
+ * in a `WeakMap` so multiple consumers (`ShouldReplicateStatusUpdate`, filters, hooks) never
+ * call `JSON.parse` more than once per payload object.
+ */
+export declare function ParseStatusUpdateMessage(payload: PushStatusNotificationPayload): ParsedMessageCacheEntry;
 /**
  * Whether an update is worth sending to other server instances.
  *
@@ -60,7 +77,7 @@ export declare function ParseReplicatedStatusUpdate(raw: string, localServerId:
  * Progress and completion are low-rate and each is individually meaningful, which is exactly the
  * kind of message that must survive landing on the wrong replica.
  */
-export declare function ShouldReplicateStatusUpdate(message?: string): boolean;
+export declare function ShouldReplicateStatusUpdate(message?: string, payload?: PushStatusNotificationPayload): boolean;
 interface PushStatusNotificationArgs {
     sessionId: string;
 }
@@ -87,18 +104,34 @@ export declare function publishStatusUpdate(pubSub: PubSubEngine, params: Status
 export interface StatusUpdatesFilterContext {
     userPayload?: UserPayload;
 }
+/**
+ * The owner key of a status update for `user`: its user ID, or, for an anonymous visitor, its user ID plus its scope
+ * identity (`ResolveSessionScopeIdentity`). Every anonymous visitor shares one Anonymous user and the session id is
+ * chosen by the client (`x-session-id`), so the user ID alone would let one visitor receive another's run events.
+ * An anonymous visitor with no scope identity gets no key and receives nothing.
+ */
+export declare function StatusUpdateOwnerKey(user: SessionAccessPrincipal | null | undefined): string;
+/**
+ * The owner key a status update is published with: that of the request's user, or, on a payload elevated by
+ * `ElevateUserPayload`, of the user the elevated principal stands in for (a public widget guest). The guest's socket
+ * is authenticated as the guest, so an update stamped with the elevated system user would never pass
+ * {@link StatusUpdatesFilter} and the guest would wait forever for its run to finish.
+ */
+export declare function StatusUpdateOwnerID(userPayload: UserPayload | undefined): string;
 /**
  * Filter predicate for the `statusUpdates` subscription. Exported so it can be unit-tested in
  * isolation (it is the security-critical gate). A push reaches a subscriber only when BOTH hold:
- *   1. the push's `sessionId` matches the subscriber's requested `sessionId` (tab routing), AND
- *   2. the push's `ownerUserId` matches the subscriber CONNECTION's authenticated identity
- *      (`context.userPayload.userRecord.ID`, established once at WS connect).
+ *   1. the push's `sessionId` matches the subscriber's requested `sessionId` (tab routing), or is `'*'`, AND
+ *   2. the push's `ownerUserId` matches the owner key ({@link StatusUpdateOwnerKey}) of the subscriber
+ *      CONNECTION's authenticated identity (`context.userPayload.userRecord`, established once at WS
+ *      connect): the user ID for a named user, compared as a UUID; for an anonymous visitor, the user ID
+ *      plus its scope identity, compared exactly because the scope part is case-significant.
  *
  * Condition (2) is the fix for the session-hijack class (B49): `sessionId` is a client-chosen
  * correlation value, so a subscriber who lifts another user's `sessionId` would previously receive
  * their pushes. Binding delivery to the connection's server-authenticated identity means knowing a
- * `sessionId` is no longer sufficient. Fails CLOSED — a missing owner or connection identity never
- * matches.
+ * `sessionId` is no longer sufficient; the scope part does the same between anonymous visitors, who all
+ * share one Anonymous user. Fails CLOSED — a missing owner or connection key never matches.
  */
 export declare function StatusUpdatesFilter(data: {
     payload: PushStatusNotificationPayload;

package/dist/generic/PushStatusResolver.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"PushStatusResolver.d.ts","sourceRoot":"","sources":["../../src/generic/PushStatusResolver.ts"],"names":[],"mappings":"AAAA,OAAO,EAA8B,YAAY,EAAoD,MAAM,cAAc,CAAC;AAE1H,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C,eAAO,MAAM,yBAAyB,wBAAwB,CAAC;AAE/D,qBACa,sBAAsB;IAEjC,OAAO,CAAC,EAAE,MAAM,CAAC;IAGjB,IAAI,EAAG,IAAI,CAAC;IAGZ,SAAS,EAAG,MAAM,CAAC;CACpB;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,6BAA6B;IAC5C,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,kGAAkG;IAClG,WAAW,EAAE,MAAM,CAAC;IACpB;;;;OAIG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,6FAA6F;AAC7F,MAAM,MAAM,qBAAqB,GAAG,CAAC,OAAO,EAAE,6BAA6B,KAAK,IAAI,CAAC;AAIrF;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,CAAC,EAAE,qBAAqB,GAAG,IAAI,CAE3E;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,2BAA2B,CAAC,GAAG,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,6BAA6B,GAAG,IAAI,CAyBpH;AAED;;;;;;;;GAQG;AACH,wBAAgB,2BAA2B,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAYrE;AAED,UAAU,0BAA0B;IAClC,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,mGAAmG;AACnG,MAAM,WAAW,kBAAkB;IACjC,0FAA0F;IAC1F,SAAS,EAAE,MAAM,CAAC;IAClB,0FAA0F;IAC1F,WAAW,EAAE,MAAM,CAAC;IACpB,mGAAmG;IACnG,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,kBAAkB,GAAG,IAAI,CAoB1F;AAED,mDAAmD;AACnD,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,kBAAkB,GAAG,IAAI,CAE1F;AAED,mFAAmF;AACnF,MAAM,WAAW,0BAA0B;IACzC,WAAW,CAAC,EAAE,WAAW,CAAC;CAC3B;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE;IACxC,OAAO,EAAE,6BAA6B,CAAC;IACvC,IAAI,EAAE,0BAA0B,CAAC;IACjC,OAAO,EAAE,0BAA0B,GAAG,SAAS,CAAC;CACjD,GAAG,OAAO,CAUV;AAED,mDAAmD;AACnD,wBAAgB,mBAAmB,CAAC,IAAI,EAAE;IACxC,OAAO,EAAE,6BAA6B,CAAC;IACvC,IAAI,EAAE,0BAA0B,CAAC;IACjC,OAAO,EAAE,0BAA0B,GAAG,SAAS,CAAC;CACjD,GAAG,OAAO,CAEV;AAED,qBACa,kBAAkB;IAM7B,aAAa,CAAG,mIAAmI;IACzI,EAAE,OAAO,EAAE,EAAE,6BAA6B,EAClB,SAAS,EAAE,MAAM,GAChD,sBAAsB;CAI1B"}
+{"version":3,"file":"PushStatusResolver.d.ts","sourceRoot":"","sources":["../../src/generic/PushStatusResolver.ts"],"names":[],"mappings":"AAAA,OAAO,kBAAkB,CAAC;AAC1B,OAAO,EAA8B,YAAY,EAAoD,MAAM,cAAc,CAAC;AAE1H,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAA+B,KAAK,sBAAsB,EAAE,MAAM,sCAAsC,CAAC;AAEhH,eAAO,MAAM,yBAAyB,wBAAwB,CAAC;AAE/D,qBACa,sBAAsB;IAEjC,OAAO,CAAC,EAAE,MAAM,CAAC;IAGjB,IAAI,EAAG,IAAI,CAAC;IAGZ,SAAS,EAAG,MAAM,CAAC;CACpB;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,6BAA6B;IAC5C,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,kGAAkG;IAClG,WAAW,EAAE,MAAM,CAAC;IACpB;;;;OAIG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,6FAA6F;AAC7F,MAAM,MAAM,qBAAqB,GAAG,CAAC,OAAO,EAAE,6BAA6B,KAAK,IAAI,CAAC;AAIrF;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,CAAC,EAAE,qBAAqB,GAAG,IAAI,CAE3E;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,2BAA2B,CAAC,GAAG,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,6BAA6B,GAAG,IAAI,CAyBpH;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAM/D;AAED,UAAU,uBAAuB;IAC9B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IACvC,MAAM,EAAE,OAAO,CAAC;CAClB;AAID;;;;GAIG;AACH,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,6BAA6B,GACrC,uBAAuB,CAuBzB;AAED;;;;;;;;GAQG;AACH,wBAAgB,2BAA2B,CACzC,OAAO,CAAC,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE,6BAA6B,GACtC,OAAO,CAmBT;AAED,UAAU,0BAA0B;IAClC,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,mGAAmG;AACnG,MAAM,WAAW,kBAAkB;IACjC,0FAA0F;IAC1F,SAAS,EAAE,MAAM,CAAC;IAClB,0FAA0F;IAC1F,WAAW,EAAE,MAAM,CAAC;IACpB,mGAAmG;IACnG,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,kBAAkB,GAAG,IAAI,CAoB1F;AAED,mDAAmD;AACnD,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,kBAAkB,GAAG,IAAI,CAE1F;AAED,mFAAmF;AACnF,MAAM,WAAW,0BAA0B;IACzC,WAAW,CAAC,EAAE,WAAW,CAAC;CAC3B;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,sBAAsB,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,CAS5F;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,WAAW,EAAE,WAAW,GAAG,SAAS,GAAG,MAAM,CAEhF;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE;IACxC,OAAO,EAAE,6BAA6B,CAAC;IACvC,IAAI,EAAE,0BAA0B,CAAC;IACjC,OAAO,EAAE,0BAA0B,GAAG,SAAS,CAAC;CACjD,GAAG,OAAO,CAYV;AAED,mDAAmD;AACnD,wBAAgB,mBAAmB,CAAC,IAAI,EAAE;IACxC,OAAO,EAAE,6BAA6B,CAAC;IACvC,IAAI,EAAE,0BAA0B,CAAC;IACjC,OAAO,EAAE,0BAA0B,GAAG,SAAS,CAAC;CACjD,GAAG,OAAO,CAEV;AAED,qBACa,kBAAkB;IAS7B,aAAa,CAAG,mIAAmI;IACzI,EAAE,OAAO,EAAE,EAAE,6BAA6B,EAClB,SAAS,EAAE,MAAM,GAChD,sBAAsB;CAI1B"}

package/dist/generic/PushStatusResolver.js

@@ -10,8 +10,10 @@ var __metadata = (this && this.__metadata) || function (k, v) {
 var __param = (this && this.__param) || function (paramIndex, decorator) {
     return function (target, key) { decorator(target, key, paramIndex); }
 };
+import 'reflect-metadata';
 import { Arg, Field, ID, ObjectType, Resolver, Root, Subscription } from 'type-graphql';
 import { MJGlobal, UUIDsEqual } from '@memberjunction/global';
+import { ResolveSessionScopeIdentity } from '../realtimeSessions/sessionAccess.js';
 export const PUSH_STATUS_UPDATES_TOPIC = 'PUSH_STATUS_UPDATES';
 let PushStatusNotification = class PushStatusNotification {
 };
@@ -78,6 +80,48 @@ export function ParseReplicatedStatusUpdate(raw, localServerId) {
     }
     return { sessionId, ownerUserId, message: body, SourceServerId: source };
 }
+/**
+ * Returns the $O(1)$ session-scoped pub/sub topic name for a given `sessionId`.
+ * Wildcard (`'*'`) or empty session IDs fall back to the broadcast {@link PUSH_STATUS_UPDATES_TOPIC}.
+ */
+export function GetSessionStatusTopic(sessionId) {
+    const normalized = sessionId?.trim();
+    if (!normalized || normalized === '*') {
+        return PUSH_STATUS_UPDATES_TOPIC;
+    }
+    return `${PUSH_STATUS_UPDATES_TOPIC}:session:${normalized}`;
+}
+const _parsedMessageMemo = new WeakMap();
+/**
+ * Parses and memoizes the JSON `message` envelope on a {@link PushStatusNotificationPayload}
+ * in a `WeakMap` so multiple consumers (`ShouldReplicateStatusUpdate`, filters, hooks) never
+ * call `JSON.parse` more than once per payload object.
+ */
+export function ParseStatusUpdateMessage(payload) {
+    const cached = _parsedMessageMemo.get(payload);
+    if (cached) {
+        return cached;
+    }
+    if (!payload.message) {
+        const emptyEntry = { parsed: null, isJson: false };
+        _parsedMessageMemo.set(payload, emptyEntry);
+        return emptyEntry;
+    }
+    try {
+        const raw = JSON.parse(payload.message);
+        const entry = {
+            parsed: typeof raw === 'object' && raw !== null ? raw : null,
+            isJson: true,
+        };
+        _parsedMessageMemo.set(payload, entry);
+        return entry;
+    }
+    catch {
+        const plainEntry = { parsed: null, isJson: false };
+        _parsedMessageMemo.set(payload, plainEntry);
+        return plainEntry;
+    }
+}
 /**
  * Whether an update is worth sending to other server instances.
  *
@@ -87,10 +131,17 @@ export function ParseReplicatedStatusUpdate(raw, localServerId) {
  * Progress and completion are low-rate and each is individually meaningful, which is exactly the
  * kind of message that must survive landing on the wrong replica.
  */
-export function ShouldReplicateStatusUpdate(message) {
+export function ShouldReplicateStatusUpdate(message, payload) {
     if (!message) {
         return false;
     }
+    if (payload && payload.message === message) {
+        const entry = ParseStatusUpdateMessage(payload);
+        if (!entry.isJson) {
+            return true;
+        }
+        return entry.parsed?.type !== 'StreamingContent';
+    }
     try {
         const parsed = JSON.parse(message);
         const type = parsed?.type;
@@ -119,7 +170,7 @@ export function PublishStatusUpdate(pubSub, params) {
     // Fan out to other instances. Only reached by updates originating HERE: a message arriving from
     // the bus is republished straight onto the local topic and never comes back through this
     // function, so there is no loop to break beyond the SourceServerId check on the receiving side.
-    if (_publishHook && ShouldReplicateStatusUpdate(params.message)) {
+    if (_publishHook && ShouldReplicateStatusUpdate(params.message, payload)) {
         try {
             _publishHook(payload);
         }
@@ -133,29 +184,58 @@ export function PublishStatusUpdate(pubSub, params) {
 export function publishStatusUpdate(pubSub, params) {
     return PublishStatusUpdate(pubSub, params);
 }
+/**
+ * The owner key of a status update for `user`: its user ID, or, for an anonymous visitor, its user ID plus its scope
+ * identity (`ResolveSessionScopeIdentity`). Every anonymous visitor shares one Anonymous user and the session id is
+ * chosen by the client (`x-session-id`), so the user ID alone would let one visitor receive another's run events.
+ * An anonymous visitor with no scope identity gets no key and receives nothing.
+ */
+export function StatusUpdateOwnerKey(user) {
+    if (!user?.ID) {
+        return '';
+    }
+    if (!user.IsMagicLinkAnonymous) {
+        return user.ID;
+    }
+    const scope = ResolveSessionScopeIdentity(user);
+    return scope ? `${user.ID.toLowerCase()}|${scope}` : '';
+}
+/**
+ * The owner key a status update is published with: that of the request's user, or, on a payload elevated by
+ * `ElevateUserPayload`, of the user the elevated principal stands in for (a public widget guest). The guest's socket
+ * is authenticated as the guest, so an update stamped with the elevated system user would never pass
+ * {@link StatusUpdatesFilter} and the guest would wait forever for its run to finish.
+ */
+export function StatusUpdateOwnerID(userPayload) {
+    return StatusUpdateOwnerKey(userPayload?.ElevatedFrom ?? userPayload?.userRecord);
+}
 /**
  * Filter predicate for the `statusUpdates` subscription. Exported so it can be unit-tested in
  * isolation (it is the security-critical gate). A push reaches a subscriber only when BOTH hold:
- *   1. the push's `sessionId` matches the subscriber's requested `sessionId` (tab routing), AND
- *   2. the push's `ownerUserId` matches the subscriber CONNECTION's authenticated identity
- *      (`context.userPayload.userRecord.ID`, established once at WS connect).
+ *   1. the push's `sessionId` matches the subscriber's requested `sessionId` (tab routing), or is `'*'`, AND
+ *   2. the push's `ownerUserId` matches the owner key ({@link StatusUpdateOwnerKey}) of the subscriber
+ *      CONNECTION's authenticated identity (`context.userPayload.userRecord`, established once at WS
+ *      connect): the user ID for a named user, compared as a UUID; for an anonymous visitor, the user ID
+ *      plus its scope identity, compared exactly because the scope part is case-significant.
  *
  * Condition (2) is the fix for the session-hijack class (B49): `sessionId` is a client-chosen
  * correlation value, so a subscriber who lifts another user's `sessionId` would previously receive
  * their pushes. Binding delivery to the connection's server-authenticated identity means knowing a
- * `sessionId` is no longer sufficient. Fails CLOSED — a missing owner or connection identity never
- * matches.
+ * `sessionId` is no longer sufficient; the scope part does the same between anonymous visitors, who all
+ * share one Anonymous user. Fails CLOSED — a missing owner or connection key never matches.
  */
 export function StatusUpdatesFilter(data) {
     const { payload, args, context } = data;
     if (payload.sessionId !== '*' && payload.sessionId !== args.sessionId) {
         return false;
     }
-    const connectionUserId = context?.userPayload?.userRecord?.ID;
-    if (!connectionUserId || !payload.ownerUserId) {
+    const connectionUser = context?.userPayload?.userRecord;
+    const connectionKey = StatusUpdateOwnerKey(connectionUser);
+    if (!connectionKey || !payload.ownerUserId) {
         return false; // fail closed — no identity on either side means no delivery
     }
-    return UUIDsEqual(payload.ownerUserId, connectionUserId);
+    // An anonymous visitor's key carries its scope identity (case-significant), so it must match exactly.
+    return connectionUser?.IsMagicLinkAnonymous ? payload.ownerUserId === connectionKey : UUIDsEqual(payload.ownerUserId, connectionKey);
 }
 /** @deprecated Use {@link StatusUpdatesFilter}. */
 export function statusUpdatesFilter(data) {
@@ -169,7 +249,9 @@ let PushStatusResolver = class PushStatusResolver {
 };
 __decorate([
     Subscription(() => PushStatusNotification, {
-        topics: PUSH_STATUS_UPDATES_TOPIC,
+        topics: ({ args }) => args?.sessionId && args.sessionId !== '*'
+            ? [GetSessionStatusTopic(args.sessionId), PUSH_STATUS_UPDATES_TOPIC]
+            : PUSH_STATUS_UPDATES_TOPIC,
         filter: (data) => StatusUpdatesFilter(data),
     }),
     __param(0, Root()),

package/dist/generic/PushStatusResolver.js.map

@@ -1 +1 @@
-{"version":3,"file":"PushStatusResolver.js","sourceRoot":"","sources":["../../src/generic/PushStatusResolver.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE,UAAU,EAAgB,QAAQ,EAAsB,IAAI,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC1H,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAG9D,MAAM,CAAC,MAAM,yBAAyB,GAAG,qBAAqB,CAAC;AAGxD,IAAM,sBAAsB,GAA5B,MAAM,sBAAsB;CASlC,CAAA;AAPC;IADC,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;uDACvB;AAGjB;IADC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC;8BAChB,IAAI;oDAAC;AAGZ;IADC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,EAAE,CAAC;;yDACF;AARR,sBAAsB;IADlC,UAAU,EAAE;GACA,sBAAsB,CASlC;;AA6BD,IAAI,YAA+C,CAAC;AAEpD;;;;;;GAMG;AACH,MAAM,UAAU,wBAAwB,CAAC,IAA4B;IACnE,YAAY,GAAG,IAAI,CAAC;AACtB,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,2BAA2B,CAAC,GAAW,EAAE,aAAqB;IAC5E,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QAClD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,OAAO,EAAE,cAAc,EAAE,GAAG,MAAiC,CAAC;IAC9F,MAAM,MAAM,GAAG,OAAO,cAAc,KAAK,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS,CAAC;IAC/E,MAAM,IAAI,GAAG,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;IAC/D,IAAI,CAAC,cAAc,IAAI,IAAI,IAAI,MAAM,KAAK,SAAS,CAAC,IAAI,CAAC,OAAO,IAAI,IAAI,IAAI,IAAI,KAAK,SAAS,CAAC,EAAE,CAAC;QAChG,OAAO,IAAI,CAAC,CAAC,oCAAoC;IACnD,CAAC;IACD,IAAI,MAAM,KAAK,aAAa,EAAE,CAAC;QAC7B,OAAO,IAAI,CAAC,CAAC,+BAA+B;IAC9C,CAAC;IACD,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,CAAC,SAAS,IAAI,OAAO,WAAW,KAAK,QAAQ,IAAI,CAAC,WAAW,EAAE,CAAC;QACnG,OAAO,IAAI,CAAC,CAAC,2EAA2E;IAC1F,CAAC;IAED,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,MAAM,EAAE,CAAC;AAC3E,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,2BAA2B,CAAC,OAAgB;IAC1D,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC5C,MAAM,IAAI,GAAI,MAA6B,EAAE,IAAI,CAAC;QAClD,OAAO,IAAI,KAAK,kBAAkB,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,gGAAgG;QAChG,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAgBD;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAAoB,EAAE,MAA0B;IAClF,MAAM,OAAO,GAAkC;QAC7C,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,cAAc,EAAE,QAAQ,CAAC,QAAQ,CAAC,WAAW;KAC9C,CAAC;IACF,MAAM,CAAC,OAAO,CAAC,yBAAyB,EAAE,OAAO,CAAC,CAAC;IAEnD,gGAAgG;IAChG,yFAAyF;IACzF,gGAAgG;IAChG,IAAI,YAAY,IAAI,2BAA2B,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;QAChE,IAAI,CAAC;YACH,YAAY,CAAC,OAAO,CAAC,CAAC;QACxB,CAAC;QAAC,MAAM,CAAC;YACP,0FAA0F;YAC1F,gFAAgF;QAClF,CAAC;IACH,CAAC;AACH,CAAC;AAED,mDAAmD;AACnD,MAAM,UAAU,mBAAmB,CAAC,MAAoB,EAAE,MAA0B;IAClF,OAAO,mBAAmB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AAC7C,CAAC;AAOD;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAInC;IACC,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;IACxC,IAAI,OAAO,CAAC,SAAS,KAAK,GAAG,IAAI,OAAO,CAAC,SAAS,KAAK,IAAI,CAAC,SAAS,EAAE,CAAC;QACtE,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,gBAAgB,GAAuB,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,EAAE,CAAC;IAClF,IAAI,CAAC,gBAAgB,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;QAC9C,OAAO,KAAK,CAAC,CAAC,6DAA6D;IAC7E,CAAC;IACD,OAAO,UAAU,CAAC,OAAO,CAAC,WAAW,EAAE,gBAAgB,CAAC,CAAC;AAC3D,CAAC;AAED,mDAAmD;AACnD,MAAM,UAAU,mBAAmB,CAAC,IAInC;IACC,OAAO,mBAAmB,CAAC,IAAI,CAAC,CAAC;AACnC,CAAC;AAGM,IAAM,kBAAkB,GAAxB,MAAM,kBAAkB;IAM7B,aAAa,CACH,EAAE,OAAO,EAAiC,EAClB,SAAiB;QAEjD,yFAAyF;QACzF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,IAAI,EAAE,EAAE,SAAS,EAAE,CAAC;IAClD,CAAC;CACF,CAAA;AAPC;IALC,YAAY,CAAC,GAAG,EAAE,CAAC,sBAAsB,EAAE;QAC1C,MAAM,EAAE,yBAAyB;QACjC,MAAM,EAAE,CAAC,IAA+G,EAAE,EAAE,CAC1H,mBAAmB,CAAC,IAAI,CAAC;KAC5B,CAAC;IAEC,WAAA,IAAI,EAAE,CAAA;IACN,WAAA,GAAG,CAAC,WAAW,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,CAAA;;;oCAC9B,sBAAsB;uDAGxB;AAZU,kBAAkB;IAD9B,QAAQ,EAAE;GACE,kBAAkB,CAa9B"}
+{"version":3,"file":"PushStatusResolver.js","sourceRoot":"","sources":["../../src/generic/PushStatusResolver.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,OAAO,kBAAkB,CAAC;AAC1B,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE,UAAU,EAAgB,QAAQ,EAAsB,IAAI,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC1H,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAE9D,OAAO,EAAE,2BAA2B,EAA+B,MAAM,sCAAsC,CAAC;AAEhH,MAAM,CAAC,MAAM,yBAAyB,GAAG,qBAAqB,CAAC;AAGxD,IAAM,sBAAsB,GAA5B,MAAM,sBAAsB;CASlC,CAAA;AAPC;IADC,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;uDACvB;AAGjB;IADC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC;8BAChB,IAAI;oDAAC;AAGZ;IADC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,EAAE,CAAC;;yDACF;AARR,sBAAsB;IADlC,UAAU,EAAE;GACA,sBAAsB,CASlC;;AA6BD,IAAI,YAA+C,CAAC;AAEpD;;;;;;GAMG;AACH,MAAM,UAAU,wBAAwB,CAAC,IAA4B;IACnE,YAAY,GAAG,IAAI,CAAC;AACtB,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,2BAA2B,CAAC,GAAW,EAAE,aAAqB;IAC5E,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QAClD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,OAAO,EAAE,cAAc,EAAE,GAAG,MAAiC,CAAC;IAC9F,MAAM,MAAM,GAAG,OAAO,cAAc,KAAK,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS,CAAC;IAC/E,MAAM,IAAI,GAAG,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;IAC/D,IAAI,CAAC,cAAc,IAAI,IAAI,IAAI,MAAM,KAAK,SAAS,CAAC,IAAI,CAAC,OAAO,IAAI,IAAI,IAAI,IAAI,KAAK,SAAS,CAAC,EAAE,CAAC;QAChG,OAAO,IAAI,CAAC,CAAC,oCAAoC;IACnD,CAAC;IACD,IAAI,MAAM,KAAK,aAAa,EAAE,CAAC;QAC7B,OAAO,IAAI,CAAC,CAAC,+BAA+B;IAC9C,CAAC;IACD,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,CAAC,SAAS,IAAI,OAAO,WAAW,KAAK,QAAQ,IAAI,CAAC,WAAW,EAAE,CAAC;QACnG,OAAO,IAAI,CAAC,CAAC,2EAA2E;IAC1F,CAAC;IAED,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,MAAM,EAAE,CAAC;AAC3E,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CAAC,SAAiB;IACrD,MAAM,UAAU,GAAG,SAAS,EAAE,IAAI,EAAE,CAAC;IACrC,IAAI,CAAC,UAAU,IAAI,UAAU,KAAK,GAAG,EAAE,CAAC;QACtC,OAAO,yBAAyB,CAAC;IACnC,CAAC;IACD,OAAO,GAAG,yBAAyB,YAAY,UAAU,EAAE,CAAC;AAC9D,CAAC;AAOD,MAAM,kBAAkB,GAAG,IAAI,OAAO,EAA0D,CAAC;AAEjG;;;;GAIG;AACH,MAAM,UAAU,wBAAwB,CACtC,OAAsC;IAEtC,MAAM,MAAM,GAAG,kBAAkB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAC/C,IAAI,MAAM,EAAE,CAAC;QACX,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;QACrB,MAAM,UAAU,GAA4B,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;QAC5E,kBAAkB,CAAC,GAAG,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;QAC5C,OAAO,UAAU,CAAC;IACpB,CAAC;IACD,IAAI,CAAC;QACH,MAAM,GAAG,GAAY,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACjD,MAAM,KAAK,GAA4B;YACrC,MAAM,EAAE,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,CAAC,CAAC,CAAE,GAA+B,CAAC,CAAC,CAAC,IAAI;YACzF,MAAM,EAAE,IAAI;SACb,CAAC;QACF,kBAAkB,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACvC,OAAO,KAAK,CAAC;IACf,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,UAAU,GAA4B,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;QAC5E,kBAAkB,CAAC,GAAG,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;QAC5C,OAAO,UAAU,CAAC;IACpB,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,2BAA2B,CACzC,OAAgB,EAChB,OAAuC;IAEvC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,OAAO,IAAI,OAAO,CAAC,OAAO,KAAK,OAAO,EAAE,CAAC;QAC3C,MAAM,KAAK,GAAG,wBAAwB,CAAC,OAAO,CAAC,CAAC;QAChD,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YAClB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,KAAK,CAAC,MAAM,EAAE,IAAI,KAAK,kBAAkB,CAAC;IACnD,CAAC;IACD,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC5C,MAAM,IAAI,GAAI,MAA6B,EAAE,IAAI,CAAC;QAClD,OAAO,IAAI,KAAK,kBAAkB,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,gGAAgG;QAChG,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAgBD;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAAoB,EAAE,MAA0B;IAClF,MAAM,OAAO,GAAkC;QAC7C,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,cAAc,EAAE,QAAQ,CAAC,QAAQ,CAAC,WAAW;KAC9C,CAAC;IACF,MAAM,CAAC,OAAO,CAAC,yBAAyB,EAAE,OAAO,CAAC,CAAC;IAEnD,gGAAgG;IAChG,yFAAyF;IACzF,gGAAgG;IAChG,IAAI,YAAY,IAAI,2BAA2B,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,CAAC;QACzE,IAAI,CAAC;YACH,YAAY,CAAC,OAAO,CAAC,CAAC;QACxB,CAAC;QAAC,MAAM,CAAC;YACP,0FAA0F;YAC1F,gFAAgF;QAClF,CAAC;IACH,CAAC;AACH,CAAC;AAED,mDAAmD;AACnD,MAAM,UAAU,mBAAmB,CAAC,MAAoB,EAAE,MAA0B;IAClF,OAAO,mBAAmB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AAC7C,CAAC;AAOD;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAA+C;IAClF,IAAI,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC;QACd,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,oBAAoB,EAAE,CAAC;QAC/B,OAAO,IAAI,CAAC,EAAE,CAAC;IACjB,CAAC;IACD,MAAM,KAAK,GAAG,2BAA2B,CAAC,IAAI,CAAC,CAAC;IAChD,OAAO,KAAK,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,EAAE,CAAC,WAAW,EAAE,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AAC1D,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,WAAoC;IACtE,OAAO,oBAAoB,CAAC,WAAW,EAAE,YAAY,IAAI,WAAW,EAAE,UAAU,CAAC,CAAC;AACpF,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAInC;IACC,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;IACxC,IAAI,OAAO,CAAC,SAAS,KAAK,GAAG,IAAI,OAAO,CAAC,SAAS,KAAK,IAAI,CAAC,SAAS,EAAE,CAAC;QACtE,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,cAAc,GAAuC,OAAO,EAAE,WAAW,EAAE,UAAU,CAAC;IAC5F,MAAM,aAAa,GAAG,oBAAoB,CAAC,cAAc,CAAC,CAAC;IAC3D,IAAI,CAAC,aAAa,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;QAC3C,OAAO,KAAK,CAAC,CAAC,6DAA6D;IAC7E,CAAC;IACD,sGAAsG;IACtG,OAAO,cAAc,EAAE,oBAAoB,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,KAAK,aAAa,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;AACvI,CAAC;AAED,mDAAmD;AACnD,MAAM,UAAU,mBAAmB,CAAC,IAInC;IACC,OAAO,mBAAmB,CAAC,IAAI,CAAC,CAAC;AACnC,CAAC;AAGM,IAAM,kBAAkB,GAAxB,MAAM,kBAAkB;IAS7B,aAAa,CACH,EAAE,OAAO,EAAiC,EAClB,SAAiB;QAEjD,yFAAyF;QACzF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,IAAI,EAAE,EAAE,SAAS,EAAE,CAAC;IAClD,CAAC;CACF,CAAA;AAPC;IARC,YAAY,CAAC,GAAG,EAAE,CAAC,sBAAsB,EAAE;QAC1C,MAAM,EAAE,CAAC,EAAE,IAAI,EAAwC,EAAE,EAAE,CACzD,IAAI,EAAE,SAAS,IAAI,IAAI,CAAC,SAAS,KAAK,GAAG;YACvC,CAAC,CAAC,CAAC,qBAAqB,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,yBAAyB,CAAC;YACpE,CAAC,CAAC,yBAAyB;QAC/B,MAAM,EAAE,CAAC,IAA+G,EAAE,EAAE,CAC1H,mBAAmB,CAAC,IAAI,CAAC;KAC5B,CAAC;IAEC,WAAA,IAAI,EAAE,CAAA;IACN,WAAA,GAAG,CAAC,WAAW,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,CAAA;;;oCAC9B,sBAAsB;uDAGxB;AAfU,kBAAkB;IAD9B,QAAQ,EAAE;GACE,kBAAkB,CAgB9B"}

package/dist/generic/ResolverBase.d.ts

@@ -1,5 +1,12 @@
-import { AggregateExpression, BaseEntity, CompositeKey, DatabaseProviderBase, EntityFieldInfo, EntityInfo, EntityPermissionType, IMetadataProvider, RecordChangeFieldSecurityProjector, RunViewResult, UserInfo } from '@memberjunction/core';
+import { AggregateExpression, BaseEntity, BaseEntityEvent, CompositeKey, DatabaseProviderBase, EntityFieldInfo, EntityInfo, EntityPermissionType, IMetadataProvider, RecordChangeFieldSecurityProjector, RunViewResult, UserInfo, ViewPropertyValues } from '@memberjunction/core';
 import { MJUserViewEntityExtended } from '@memberjunction/core-entities';
+/**
+ * Extended RunViewResult carrying a non-enumerable reference to the resolved view entity
+ * so downstream resolvers (e.g. RunViewResolver) do not re-query `MJ: User Views` a third time.
+ */
+export type RunViewResultWithResolvedView<T = unknown> = RunViewResult<T> & {
+    _resolvedViewEntity?: MJUserViewEntityExtended;
+};
 import { PubSubEngine } from 'type-graphql';
 import { RunViewGenericParams, UserPayload } from '../types.js';
 import { RunDynamicViewInput, RunViewByIDInput, RunViewByNameInput } from './RunViewResolver.js';
@@ -9,7 +16,9 @@ export declare class ResolverBase {
     private static _emit;
     private static _cloudeventsHeaders;
     private static _eventSubscriptionKey;
+    private static _activeEntitySessionsKey;
     private get eventSubscriptions();
+    private get activeEntitySessions();
     /**
      * Maps field names to their GraphQL-safe CodeNames and handles encryption for API responses.
      *
@@ -151,10 +160,30 @@ export declare class ResolverBase {
      */
     private formatFilterValue;
     protected findBy<T = any>(provider: DatabaseProviderBase, entity: string, params: any, contextUser: UserInfo): Promise<Array<T>>;
+    /**
+     * Resolves a User View by name, consulting the in-memory {@link UserViewEngine} cache first
+     * and falling back to a database `RunView` only on a cache miss.
+     */
+    protected resolveUserViewByName(viewName: string, provider: DatabaseProviderBase, contextUser?: UserInfo): Promise<MJUserViewEntityExtended | null>;
+    /**
+     * Resolves a User View by ID, consulting the in-memory {@link UserViewEngine} cache first
+     * and falling back to an entity `Load()` only on a cache miss.
+     */
+    protected resolveUserViewByID(viewID: string, provider: DatabaseProviderBase, contextUser?: UserInfo): Promise<MJUserViewEntityExtended | null>;
     RunViewByNameGeneric(viewInput: RunViewByNameInput, provider: DatabaseProviderBase, userPayload: UserPayload, pubSub: PubSubEngine): Promise<RunViewResult<any>>;
     RunViewByIDGeneric(viewInput: RunViewByIDInput, provider: DatabaseProviderBase, userPayload: UserPayload, pubSub: PubSubEngine): Promise<RunViewResult<any>>;
     RunDynamicViewGeneric(viewInput: RunDynamicViewInput, provider: DatabaseProviderBase, userPayload: UserPayload, pubSub: PubSubEngine): Promise<RunViewResult<any>>;
     RunViewsGeneric(viewInputs: (RunViewByNameInput & RunViewByIDInput & RunDynamicViewInput)[], provider: DatabaseProviderBase, userPayload: UserPayload): Promise<RunViewResult[]>;
+    /**
+     * What an entity event may carry to a CloudEvents sink or a log line.
+     *
+     * The whole row for an entity without field security. For one where it applies (its own flag
+     * or an IS-A ancestor's), and for `MJ: Record Changes` (whose payload columns hold other
+     * entities' values), only the primary key and the names of the fields that changed: the sink
+     * is outside MemberJunction with no reader to project the row for, and these events fire for
+     * server-internal saves too, whose objects hold every column.
+     */
+    protected EntityEventPayload(baseEntity: BaseEntity, changedFieldNames?: string[]): Record<string, unknown>;
     private static _priorEmittedData;
     protected EmitCloudEvent({ component, event, eventCode, args }: MJEvent): Promise<void>;
     protected CheckUserReadPermissions(entityName: string, userPayload: UserPayload | null, provider?: IMetadataProvider): void;
@@ -214,7 +243,7 @@ export declare class ResolverBase {
      * Fails closed: no user, or an unresolvable reference, refuses.
      *
      * The references come from a walk of the whole parse tree
-     * (`ClientClauseScreen.CollectStatementReads`). The statement is refused when that walk does not
+     * (`StrictFragmentValidator.ValidateReadOnlyStatement`). The statement is refused when that walk does not
      * account for every SELECT in the text, or when a FROM item names no table (a table function or
      * a row list).
      *
@@ -266,8 +295,11 @@ export declare class ResolverBase {
      * it, contains a backslash (see {@link assertClientClauseUsesEntityBaseViews}).
      */
     private hasBackslashInQuotes;
-    /** Write/DDL node walk shared with the clause screen; see `ClientClauseScreen.AstContainsWriteNode`. */
-    private astContainsWriteNode;
+    /**
+     * Parses a whole statement with the strict validator and returns what it reads; throws unless it
+     * is one plain read-only SELECT with no write or DDL at any depth.
+     */
+    private strictReadOnlyStatementReads;
     private dialectForProvider;
     /** The entity base-view allow-list for a provider's entities. */
     private entityBaseViewAllowList;
@@ -276,7 +308,7 @@ export declare class ResolverBase {
      * - Field filtering at source (Fix #7)
      * - Improved error handling (Fix #9)
      */
-    protected RunViewGenericInternal(provider: DatabaseProviderBase, viewInfo: MJUserViewEntityExtended, extraFilter: string, orderBy: string, userSearchString: string, excludeUserViewRunID: string | undefined, overrideExcludeFilter: string | undefined, saveViewResults: boolean | undefined, fields: string[] | undefined, ignoreMaxRows: boolean | undefined, excludeDataFromAllPriorViewRuns: boolean | undefined, forceAuditLog: boolean | undefined, auditLogDescription: string | undefined, resultType: string | undefined, userPayload: UserPayload | null, maxRows: number | undefined, startRow: number | undefined, aggregates?: AggregateExpression[], afterKey?: CompositeKey, bypassCache?: boolean, dataSource?: 'Live' | 'Materialized', includeBinaryFields?: boolean): Promise<RunViewResult<any>>;
+    protected RunViewGenericInternal(provider: DatabaseProviderBase, viewInfo: MJUserViewEntityExtended, extraFilter: string, orderBy: string, userSearchString: string, excludeUserViewRunID: string | undefined, overrideExcludeFilter: string | undefined, saveViewResults: boolean | undefined, fields: string[] | undefined, ignoreMaxRows: boolean | undefined, excludeDataFromAllPriorViewRuns: boolean | undefined, forceAuditLog: boolean | undefined, auditLogDescription: string | undefined, resultType: string | undefined, userPayload: UserPayload | null, maxRows: number | undefined, startRow: number | undefined, aggregates?: AggregateExpression[], afterKey?: CompositeKey, bypassCache?: boolean, dataSource?: 'Live' | 'Materialized', includeBinaryFields?: boolean, alternateBaseView?: string, properties?: ViewPropertyValues, skipTotalRowCount?: boolean): Promise<RunViewResult<any>>;
     /**
      * Optimized implementation that:
      * 1. Fetches user info only once (fixes N+1 query)
@@ -298,20 +330,34 @@ export declare class ResolverBase {
      * skip redundant re-fetches (it already handled the event locally).
      *
      * The row itself rides along ONLY for entities opted in via
-     * `cacheSettings.recordDataBroadcastEntities` — this event reaches every connected client
-     * unfiltered, so the row would otherwise be readable by sessions that could not read the record.
+     * `cacheSettings.recordDataBroadcastEntities`, and never for one under field-level security —
+     * this event reaches every connected client unprojected, so the row would otherwise be readable
+     * by sessions that could not read the record or its restricted fields.
      */
     protected PublishCacheInvalidation(entityObject: BaseEntity, action: 'save' | 'delete', userPayload: UserPayload): void;
     /**
      * Publishes a push-status update to the client on {@link PUSH_STATUS_UPDATES_TOPIC}, stamping the
-     * authenticated owner's user ID from `userPayload` so the subscription filter can bind delivery
-     * to identity (see B49 / `statusUpdatesFilter`). The ergonomic wrapper every resolver should use
-     * instead of calling `pubSub.publish` on the topic directly — it makes omitting identity
-     * impossible. Non-resolver publishers (services, the liveness heartbeat) call the shared
-     * `publishStatusUpdate()` function directly with an explicit `ownerUserId`.
+     * owner key of `userPayload` (`StatusUpdateOwnerID`: the request's user, or the widget guest an
+     * elevated payload stands in for) so the subscription filter can bind delivery to identity (see B49 /
+     * `StatusUpdatesFilter`). The ergonomic wrapper every resolver should use instead of calling
+     * `pubSub.publish` on the topic directly — it makes omitting identity impossible. Non-resolver
+     * publishers (services, the liveness heartbeat) call the shared `PublishStatusUpdate()` function
+     * directly with an explicit `ownerUserId`.
      */
     protected PublishStatusUpdate(pubSub: PubSubEngine, sessionId: string, message: string | undefined, userPayload: UserPayload): void;
     protected ListenForEntityMessages(entityObject: BaseEntity, pubSub: PubSubEngine, userPayload: UserPayload): void;
+    /**
+     * Whether an entity event may be relayed to the session whose call created the listener. The
+     * listener is shared by every caller in the process for that entity, so an event raised by an
+     * object loaded for another user (or for the system user) is never relayed to this session.
+     */
+    protected EntityEventBelongsToSession(event: BaseEntityEvent, userPayload: UserPayload): boolean;
+    /**
+     * The status message relayed for an entity event: the entity, key and event type. The event's
+     * payload is included only when it cannot carry record values: never for a delete (its payload
+     * is the whole deleted row), an entity under field-level security, or `MJ: Record Changes`.
+     */
+    protected EntityStatusMessage(event: BaseEntityEvent): string;
     /**
      * IS-A PROMOTION over the wire: an EXISTING parent record gaining a subtype — an Animal that is
      * now also a Dog. It arrives as the CHILD's create mutation carrying the existing parent's
@@ -369,7 +415,7 @@ export declare class ResolverBase {
      * writable fields in `OldValues___`, so {@link hasCompleteOldValues} returns `false` and forces the
      * database load (`InnerLoad`) so untouched columns retain their stored values.
      *
-     * `EnableFieldLevelSecurity` is the security-critical one, and it is NOT redundant with
+     * `FieldLevelSecurityApplies` (own flag or an IS-A ancestor's) is the security-critical one, and it is NOT redundant with
      * `hasDeniedReadFields`. That flag reports READ denials, and the canonical FLS configuration is
      * Read Allow + Update Deny — which leaves it false. Such a caller would be hydrated from its own
      * `OldValues___`, and a value it supplies there for an update-denied field arrives through
@@ -418,26 +464,25 @@ export declare class ResolverBase {
         }>;
     }, hasDeniedReadFields: boolean, hasNarrowedAuditPayload: boolean, user: UserInfo | undefined): boolean;
     /**
-     * Field-level security guard for the update path.
+     * Field-level security gate on the update path's client input.
      *
-     * Every denied-read field is stripped — new values AND OldValues. A field the user cannot
-     * read was absent from every payload that client ever received, so any value coming back for
-     * it is the transport's invention rather than user intent, and applying it would silently
-     * overwrite the real column. Stripping is what makes "load a record, edit an unrelated field,
-     * save" safe for a restricted user.
+     * For a caller denied at least one field on the entity, refuses (with a `FieldSecurityError`)
+     * any key in the new values or in `OldValues___` that names a field the caller cannot READ, or
+     * that names no field at all, with the same message for both (see
+     * `AssertClientInputWritableForUser`), so the refusal does not reveal which columns exist.
      *
-     * There is no split by update permission: Read is required for Update, so a user denied read
-     * is denied update too and denied-read ∩ denied-update is just denied-read.
+     * Refused rather than dropped: a field the caller cannot read was absent from every payload the
+     * client received, so a value for it can only be fabricated. A well-behaved client never sends
+     * one (it omits fields it did not load), so ordinary traffic is unaffected.
      *
-     * Silent narrowing, not rejection — consistent with the output projection the client already
-     * experiences, and with the ambiguous-error rule (naming the field would confirm it exists
-     * and is restricted).
+     * There is no split by update permission: Read is required for Update, so a user denied read is
+     * denied update too.
      *
-     * Returns true when the user has a non-empty denied-read set on this entity. The caller
-     * must then hydrate the entity from the DATABASE (never from client OldValues), so denied
-     * fields hold true values that an omitted key leaves untouched.
+     * Returns true when the user has a non-empty denied-read set on this entity. The caller must
+     * then hydrate the entity from the DATABASE (never from client OldValues), so denied fields hold
+     * true values the client input never touches.
      */
-    protected StripDeniedReadFieldsFromClientInput(entityInfo: EntityInfo, userInfo: UserInfo, input: {
+    protected AssertClientInputFieldSecurity(entityInfo: EntityInfo, userInfo: UserInfo, input: {
         OldValues___?: Array<{
             Key: string;
             Value: unknown;
@@ -496,7 +541,47 @@ export declare class ResolverBase {
      * `FieldByName` when available on `EntityInfo`, falling back to `.Fields.find()` for test stubs.
      */
     private findEntityFieldByCodeNameOrName;
-    protected TestAndSetClientOldValuesToDBValues(input: any, clientNewValues: any, entityObject: BaseEntity, contextUser: UserInfo): Promise<void>;
+    /**
+     * Whether the API never gives a client this field's stored value: an encrypted field that is not
+     * decrypted for the API reaches the client only as the sentinel or as fresh ciphertext, so the
+     * client's old value for it can never be compared with the database value.
+     */
+    private isFieldOpaqueToClient;
+    /**
+     * The client's new values without the opaque fields it only echoed back: the sentinel, or the same
+     * value it received as the old value. Writing either would replace the stored secret.
+     */
+    private withoutEchoedOpaqueValues;
+    /**
+     * Copies concurrency-conflict diagnostic entries with every encrypted field's values replaced by
+     * the sentinel, so the console, the error log and `MJ: Error Logs` never hold a secret.
+     */
+    private redactEncryptedConflictValues;
+    /**
+     * Compares two typed entity field values for semantic inequality, handling `Date` epoch equality
+     * (plus optional non-`datetimeoffset` timezone-hour-shift tolerance) and `null`/`undefined` normalization.
+     */
+    private areEntityFieldValuesDifferent;
+    /**
+     * True when two instants would be stored as the same value in the field's column: SQL Server
+     * `datetime` resolves to 1/300 s and `smalldatetime` to one minute; every other type keeps milliseconds.
+     */
+    private datesEqualAtColumnResolution;
+    private dateColumnResolutionMs;
+    /**
+     * True when both strings are JSON documents with the same content, ignoring whitespace and key order.
+     */
+    private jsonStringsEquivalent;
+    /**
+     * Canonical form of a JSON object or array string, or null when the text is not one.
+     */
+    private canonicalJSONDocument;
+    protected TestAndSetClientOldValuesToDBValues<TOldVal, TNewVal, TInput extends {
+        OldValues___?: ReadonlyArray<{
+            Key: string;
+            Value: TOldVal;
+        }> | null;
+    }>(input: TInput, rawClientNewValues: Record<string, TNewVal>, entityObject: BaseEntity, contextUser: UserInfo): Promise<void>;
     protected DeleteRecord(entityName: string, key: CompositeKey, options: DeleteOptionsInput, provider: DatabaseProviderBase, userPayload: UserPayload, pubSub: PubSubEngine): Promise<any>;
     protected BeforeDelete(provider: DatabaseProviderBase, key: CompositeKey): Promise<boolean>;
     protected AfterDelete(provider: DatabaseProviderBase, key: CompositeKey): Promise<void>;