@memberjunction/server 6.2.0-edge.6 → 6.2.0-edge.7

package/src/resolvers/__tests__/GetDataResolver.tokens.test.ts

@@ -23,6 +23,8 @@ vi.mock('../../auth/index.js', () => ({ GetSystemUser: vi.fn(),
 vi.mock('mssql', () => ({ default: { Request: vi.fn() } }));
 
 import {
+  GetDataResolver,
+  GetDataInputType,
   RegisterAccessToken,
   DeleteAccessToken,
   TokenExists,
@@ -31,6 +33,7 @@ import {
   PruneExpiredTokens,
   GetAccessTokenCount,
 } from '../GetDataResolver.js';
+import type { AppContext } from '../../types.js';
 
 // ---------------------------------------------------------------------------
 // Regression coverage for a memory leak (Memory Leak Audit Round 7, Critical):
@@ -137,4 +140,53 @@ describe('GetDataResolver access-token lifecycle', () => {
     expect(GetAccessTokenCount()).toBeLessThan(before + 51);
     expect(TokenExists(survivorToken)).toBe(true);
   });
+
+  it('never leaks raw secret token values in thrown or returned error messages', async () => {
+    const duplicateSecret = `secret-dup-${uniqueToken()}`;
+    RegisterAccessToken(duplicateSecret, 60_000);
+
+    try {
+      RegisterAccessToken(duplicateSecret, 60_000);
+      expect.unreachable('Expected duplicate registration to throw');
+    } catch (err) {
+      expect((err as Error).message).not.toContain(duplicateSecret);
+    }
+
+    const missingSecret = `secret-missing-${uniqueToken()}`;
+    try {
+      DeleteAccessToken(missingSecret);
+      expect.unreachable('Expected deleting unknown token to throw');
+    } catch (err) {
+      expect((err as Error).message).not.toContain(missingSecret);
+    }
+
+    try {
+      RecordTokenUse(missingSecret, {});
+      expect.unreachable('Expected recording unknown token use to throw');
+    } catch (err) {
+      expect((err as Error).message).not.toContain(missingSecret);
+    }
+
+    const resolver = new GetDataResolver();
+    const input = new GetDataInputType();
+    input.Token = missingSecret;
+    input.Queries = ['SELECT 1'];
+    const output = await resolver.GetData(input, { dataSources: [] } as Partial<AppContext> as AppContext);
+    expect(output.Success).toBe(false);
+    expect(JSON.stringify(output.ErrorMessages)).not.toContain(missingSecret);
+  });
+
+  it('rejects empty tokens and near-miss prefix tokens across multiple active slots', () => {
+    const first = `slot-a-${uniqueToken()}`;
+    const second = `slot-b-${uniqueToken()}`;
+    RegisterAccessToken(first, 60_000);
+    RegisterAccessToken(second, 60_000);
+
+    expect(IsTokenValid('')).toBe(false);
+    expect(TokenExists('')).toBe(false);
+    expect(IsTokenValid(first.slice(0, -1))).toBe(false);
+    expect(IsTokenValid(`${second}-extra`)).toBe(false);
+    expect(IsTokenValid(first)).toBe(true);
+    expect(IsTokenValid(second)).toBe(true);
+  });
 });

package/src/resolvers/meetingRecordingRegistration.ts

@@ -268,6 +268,7 @@ async function findConversationByEgressID(egressID: string, contextUser: UserInf
       Fields: ['ID'],
       OrderBy: '__mj_CreatedAt DESC',
       MaxRows: 1,
+      SkipTotalRowCount: true,
       ResultType: 'simple',
     },
     contextUser,
@@ -288,6 +289,7 @@ async function findConversationByRoomName(roomName: string, contextUser: UserInf
       Fields: ['ID'],
       OrderBy: '__mj_CreatedAt DESC',
       MaxRows: 1,
+      SkipTotalRowCount: true,
       ResultType: 'simple',
     },
     contextUser,

package/src/rest/MediaAccessKeys.ts

@@ -18,7 +18,7 @@
 
 import { BaseSingleton } from '@memberjunction/global';
 import { LogStatus } from '@memberjunction/core';
-import { randomBytes } from 'node:crypto';
+import { createHmac, randomBytes } from 'node:crypto';
 import jwt from 'jsonwebtoken';
 
 /** The token's `typ` claim — the route rejects any token whose `typ` differs. */
@@ -78,7 +78,11 @@ export class MediaAccessKeyManager extends BaseSingleton<MediaAccessKeyManager>
     }
     const configured = process.env.MJ_BASE_ENCRYPTION_KEY?.trim();
     if (configured) {
-      this.secret = configured;
+      // Key separation: never sign tokens with the field-encryption master key itself. Derive a
+      // dedicated HS256 signing key (HKDF-style HMAC expand) so a token-signing compromise and the
+      // data-at-rest key stay decoupled. Tokens are short-lived, so changing the derivation only
+      // invalidates in-flight URLs, exactly like a restart on the ephemeral path below.
+      this.secret = createHmac('sha256', configured).update('mj-media-access-token-signing-v1').digest('base64');
     } else {
       this.secret = randomBytes(32).toString('base64');
       LogStatus(

package/src/rest/OAuthCallbackHandler.ts

@@ -28,6 +28,15 @@ const ENTITY_MCP_SERVERS = 'MJ: MCP Servers';
 /** Entity name for OAuth Authorization States */
 const ENTITY_OAUTH_AUTHORIZATION_STATES = 'MJ: O Auth Authorization States';
 
+const UUID_SHAPE = /^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$/;
+
+function sqlUuid(value: string, argName: string): string {
+    if (typeof value !== 'string' || !UUID_SHAPE.test(value)) {
+        throw new Error(`${argName} must be a UUID`);
+    }
+    return value;
+}
+
 /**
  * Configuration for OAuth callback handler
  */
@@ -693,12 +702,11 @@ export class OAuthCallbackHandler {
             const rv = new RunView();
 
             // Get connection to get server ID.
-            // connectionId is caller-supplied (POST /oauth/initiate body). MJ ExtraFilter is a raw
-            // SQL fragment, so single quotes MUST be doubled to prevent injection — matching the
-            // escaping used for stateParameter in loadAuthorizationState().
+            // connectionId is caller-supplied (POST /oauth/initiate body); enforce strict UUID shape
+            // (matching MCPResolver.getServerOAuthConfig) before interpolating into ExtraFilter.
             const connResult = await rv.RunView<{ MCPServerID: string }>({
                 EntityName: ENTITY_MCP_SERVER_CONNECTIONS,
-                ExtraFilter: `ID='${connectionId.replace(/'/g, "''")}'`,
+                ExtraFilter: `ID='${sqlUuid(connectionId, 'connectionId')}'`,
                 Fields: ['MCPServerID'],
                 ResultType: 'simple'
             }, contextUser);
@@ -719,7 +727,7 @@ export class OAuthCallbackHandler {
                 OAuthRequirePKCE: boolean | null;
             }>({
                 EntityName: ENTITY_MCP_SERVERS,
-                ExtraFilter: `ID='${serverId}'`,
+                ExtraFilter: `ID='${sqlUuid(serverId, 'serverId')}'`,
                 Fields: [
                     'OAuthIssuerURL', 'OAuthScopes', 'OAuthMetadataCacheTTLMinutes',
                     'OAuthClientID', 'OAuthClientSecretEncrypted', 'OAuthRequirePKCE'

package/src/rest/RealtimeRecordingHandler.ts

@@ -34,7 +34,7 @@ import {
     LoadOwnedRealtimeSession, RealtimeSessionNotFoundError, RealtimeSessionOwnershipError,
 } from '../realtimeSessions/ownedRealtimeSession.js';
 import type { IRecordingAssemblyScheduler } from '../realtimeSessions/RecordingAssemblyScheduler.js';
-import { AuthorizeSessionAccess, LoadSessionConversationScope } from '../realtimeSessions/sessionAccess.js';
+import { AuthorizeLoadedSession } from '../realtimeSessions/sessionAccess.js';
 
 /** Where {@link CreateRealtimeRecordingRouter} is mounted (under the reserved `/realtime` root). */
 export const REALTIME_RECORDING_MOUNT_PATH = '/realtime/recording';
@@ -76,8 +76,8 @@ export interface RealtimeRecordingRouterDeps {
     /** The authenticated caller, or null (answered 401). */
     ResolveCaller(req: Request): RealtimeRecordingCaller | null;
     LoadOwnedSession: typeof LoadOwnedRealtimeSession;
-    /** The session conversation's scope id and whether the caller could read it: the scope half of the access decision. */
-    LoadConversationScope: typeof LoadSessionConversationScope;
+    /** The per-session scope rule of the access decision, applied to the session {@link LoadOwnedSession} returned. */
+    AuthorizeSession: typeof AuthorizeLoadedSession;
     /** The ledger for one request; `contextUser` is the caller (used for logging by the procs). */
     CreateLedger(provider: DatabaseProviderBase, contextUser: UserInfo): IRealtimeRecordingLedger;
     Scheduler: IRecordingAssemblyScheduler;
@@ -258,7 +258,7 @@ async function handleTerminal(deps: RealtimeRecordingRouterDeps, req: Request, r
 
 /**
  * Loads the session through the shared ownership gate, then applies the per-session scope rule of
- * {@link AuthorizeSessionAccess}. The production gate (`LoadOwnedRealtimeSession`) already applies the same
+ * {@link AuthorizeLoadedSession}. The production gate (`LoadOwnedRealtimeSession`) already applies the same
  * rule, so this is a deliberate second check at the HTTP boundary: `LoadOwnedSession` is an injected dependency,
  * and without the scope rule one anonymous guest could write shards to another guest's recording (every guest
  * shares the one Anonymous user), and a different-bytes shard would mark it Failed. It costs one extra
@@ -266,11 +266,7 @@ async function handleTerminal(deps: RealtimeRecordingRouterDeps, req: Request, r
  */
 async function loadAuthorizedSession(deps: RealtimeRecordingRouterDeps, sessionID: string, caller: RealtimeRecordingCaller): Promise<MJAIAgentSessionEntity> {
     const session = await deps.LoadOwnedSession(sessionID, caller.ContextUser, caller.Provider);
-    const conversation = await deps.LoadConversationScope(session, caller.ContextUser, caller.Provider);
-    const decision = AuthorizeSessionAccess(
-        { SessionUserID: session.UserID, ConversationExternalID: conversation.ExternalID, ConversationReadable: conversation.Readable },
-        caller.ContextUser,
-    );
+    const decision = await deps.AuthorizeSession(session, caller.ContextUser, caller.Provider);
     if (decision.Allowed === false) {
         LogError(`RealtimeRecordingHandler: refused user ${caller.ContextUser.ID} on session ${sessionID}: ${decision.Reason}`);
         throw new RecordingRequestError(403, 'Not authorized for this realtime session');

package/src/rest/ViewOperationsHandler.ts

@@ -2,6 +2,7 @@ import {
     BaseEntity, EntityInfo, LogError, Metadata, RunView, RunViewParams, 
     RunViewResult, UserInfo, type IRunViewProvider 
 } from '@memberjunction/core';
+import { EscapeSQLString } from '@memberjunction/global';
 import { ClientClauseScreen } from '@memberjunction/generic-database-provider';
 import { ProjectRowsForCaller } from '../generic/fieldSecurityTransport.js';
 
@@ -163,7 +164,7 @@ export class ViewOperationsHandler {
             // Run a view to get the available views
             const params: RunViewParams = {
                 EntityName: 'MJ: User Views',
-                ExtraFilter: `Entity = '${entityName}'`
+                ExtraFilter: `Entity = '${EscapeSQLString(entity.Name)}'`
             };
             
             const runView = new RunView();

package/src/rest/setupRESTEndpoints.ts

@@ -53,10 +53,12 @@ export interface RESTApiOptions {
 }
 
 /**
- * Default REST API configuration
+ * Default REST API configuration. Disabled by default (matching the documented default and
+ * MJServer's own config default): mounting a full-entity REST API must be an explicit decision,
+ * never a side effect of calling SetupRESTEndpoints with no options.
  */
 export const DEFAULT_REST_API_OPTIONS: RESTApiOptions = {
-    enabled: true,
+    enabled: false,
 };
 
 /**
@@ -95,6 +97,13 @@ export function SetupRESTEndpoints(
     if (authMiddleware) {
         app.use(basePath, BodyParser.json({ limit: '50mb' }), authMiddleware, restHandler.getRouter());
     } else {
+        // MJServer itself is safe here (its unified auth middleware runs globally before this
+        // mount), but a third-party caller passing no authMiddleware may be mounting a fully
+        // UNauthenticated entity CRUD API — say so loudly.
+        LogStatusEx({
+            message: `REST API mounted at ${basePath} WITHOUT a route-level auth middleware. ` +
+                `Ensure an authentication middleware runs globally before this mount, or pass one to SetupRESTEndpoints.`,
+        });
         app.use(basePath, BodyParser.json({ limit: '50mb' }), restHandler.getRouter());
     }
 

package/src/services/DurableEntityActionTaskSubmitter.ts

@@ -15,7 +15,7 @@ import type {
     DurableEntityActionSubmission,
     DurableEntityActionSubmitter,
 } from '@memberjunction/actions-base';
-import { LogError } from '@memberjunction/core';
+import { type IEntityDataProvider, type IMetadataProvider, LogError } from '@memberjunction/core';
 import { TaskNode, type TaskGraphSpec } from '@memberjunction/ai-core-plus';
 import { MJEnvironmentEntityExtended } from '@memberjunction/core-entities';
 import { TaskGraphService, type ProviderFactory } from '@memberjunction/task-graph';
@@ -59,7 +59,9 @@ export class DurableEntityActionTaskSubmitter implements DurableEntityActionSubm
                 durable: true,
             };
 
-            const provider = await this.providerFactory.CreateProvider();
+            const provider: IMetadataProvider = isMetadataProvider(request.Provider)
+                ? request.Provider
+                : await this.providerFactory.CreateProvider();
             const result = await new TaskGraphService().Submit(spec, {
                 EnvironmentID: this.environmentID,
                 ContextUser: request.ContextUser,
@@ -76,3 +78,9 @@ export class DurableEntityActionTaskSubmitter implements DurableEntityActionSubm
         }
     }
 }
+
+function isMetadataProvider(
+    provider: IMetadataProvider | IEntityDataProvider | undefined,
+): provider is IMetadataProvider {
+    return !!provider && 'GetEntityObject' in provider && typeof provider.GetEntityObject === 'function';
+}

package/src/services/TaskGraphActionRunner.ts

@@ -11,6 +11,7 @@
  */
 import { ActionEngineServer } from '@memberjunction/actions';
 import { ActionParam } from '@memberjunction/actions-base';
+import { BuildActionOutputObject } from '@memberjunction/ai-core-plus';
 import { LogError } from '@memberjunction/core';
 import { UUIDsEqual } from '@memberjunction/global';
 import type { TaskActionRunner, TaskActionRunParams, TaskActionRunResult } from '@memberjunction/task-graph';
@@ -97,29 +98,7 @@ export class TaskGraphActionRunner implements TaskActionRunner {
      * produced.
      */
     private buildOutput(actionParams: ActionParam[], resultMessage?: string | null): Record<string, unknown> {
-        const output: Record<string, unknown> = {};
-        if (typeof resultMessage === 'string') {
-            const trimmed = resultMessage.trim();
-            if (trimmed.startsWith('{') && trimmed.endsWith('}')) {
-                try {
-                    const parsed: unknown = JSON.parse(trimmed);
-                    if (parsed && typeof parsed === 'object' && !Array.isArray(parsed)) {
-                        Object.assign(output, parsed as Record<string, unknown>);
-                    }
-                } catch {
-                    // Non-JSON prose message; ignore.
-                }
-            }
-        }
-        for (const p of actionParams ?? []) {
-            if (p.Type === 'Output' || p.Type === 'Both') output[p.Name] = p.Value;
-        }
-        if (typeof output.handle === 'string' && output.Handle === undefined) {
-            output.Handle = output.handle;
-        } else if (typeof output.Handle === 'string' && output.handle === undefined) {
-            output.handle = output.Handle;
-        }
-        return output;
+        return BuildActionOutputObject(actionParams, resultMessage);
     }
 
     /**

package/src/services/TaskGraphAgentRunner.ts

@@ -43,6 +43,25 @@ export class TaskGraphAgentRunner implements TaskAgentRunner {
                     };
                 }
             }
+
+            let configurationId: string | undefined;
+            const requestedPreset = params.ConfigurationPresetName?.trim();
+            if (requestedPreset) {
+                const matched = AIEngine.Instance.FindActiveAgentConfigurationPreset(agent.ID, requestedPreset);
+                if (!matched) {
+                    const presets = AIEngine.Instance.GetAgentConfigurationPresets(agent.ID, true);
+                    const available = presets.map((p) => p.Name).join(', ') || 'none';
+                    return {
+                        Success: false,
+                        ErrorMessage: `Agent '${agent.Name || params.AgentID}' has no active preset '${requestedPreset}'. Available: ${available}.`,
+                    };
+                }
+                configurationId = matched.AIConfigurationID ?? undefined;
+            } else {
+                configurationId = parentRun?.ConfigurationID ?? undefined;
+            }
+
+            const parentAgentHierarchy = this.buildParentAgentHierarchy(parentRun, params);
             const taskContext = await this.resolveTaskContext(params);
             const conversationDetailId =
                 parentRun?.ConversationDetailID ?? taskContext.conversationDetailId ?? undefined;
@@ -66,6 +85,8 @@ export class TaskGraphAgentRunner implements TaskAgentRunner {
                 // rather than starting the chain over. Without it MAX_REINVOKE_DEPTH never fires.
                 continuationDepth: params.ContinuationDepth ?? 0,
                 parentRun,
+                parentAgentHierarchy,
+                configurationId,
                 // The bridge from the agent's own progress stream up to graph-level observers: the
                 // dispatcher turns these into rate-limited `NodeProgress` frames, which is how a
                 // running Agent step shows "what it is doing right now" on the workflow canvas.
@@ -221,6 +242,28 @@ export class TaskGraphAgentRunner implements TaskAgentRunner {
         }
     }
 
+    /**
+     * Reads the root-first ancestor agent name hierarchy carried on the task from when its graph was
+     * submitted (`params.ParentAgentHierarchy`), falling back to the submitting run's own agent name
+     * when no hierarchy was persisted on the parent task.
+     */
+    private buildParentAgentHierarchy(
+        parentRun: MJAIAgentRunEntityExtended | undefined,
+        params: TaskAgentRunParams,
+    ): string[] | undefined {
+        if (Array.isArray(params.ParentAgentHierarchy)) {
+            const carried = params.ParentAgentHierarchy
+                .filter((name): name is string => typeof name === 'string')
+                .map((name) => name.trim())
+                .filter((name) => name.length > 0);
+            if (carried.length > 0) {
+                return carried;
+            }
+        }
+        const submittingAgentName = parentRun?.Agent?.trim();
+        return submittingAgentName ? [submittingAgentName] : undefined;
+    }
+
     /**
      * Builds the agent's instruction from the task's name/description, its structured input payload,
      * and its dependencies' outputs.

package/src/services/TaskGraphContinuationDeliverer.ts

@@ -491,6 +491,7 @@ export class TaskGraphContinuationDeliverer implements TaskContinuationDeliverer
                     Fields: ['ID'],
                     OrderBy: '__mj_CreatedAt DESC',
                     MaxRows: 1,
+                    SkipTotalRowCount: true,
                     ResultType: 'simple',
                     BypassCache: true,
                 },

package/src/services/WorkQueueHostService.ts

@@ -28,13 +28,25 @@ export interface StartableWorkQueueHost {
 export interface WorkQueueHostStartDependencies {
     Env: EnvironmentVariables;
     FindUserByEmail(email: string): UserInfo | undefined;
+    FindSystemUser?(): UserInfo | undefined;
     ConfigureEngine(user: UserInfo, provider: DatabaseProviderBase): Promise<WorkQueueEngine>;
     CreateHost(config: WorkQueueHostConfig, engine: WorkQueueEngine, user: UserInfo, provider: DatabaseProviderBase, providerSource: WorkQueueProviderSource): StartableWorkQueueHost;
 }
 
+const DEFAULT_SYSTEM_USER_EMAILS = new Set(['system@memberjunction.org', 'not.set@nowhere.com']);
+
+type IndependentProviderCapable = IMetadataProvider & {
+    CreateIndependentInstance(): Promise<IMetadataProvider>;
+};
+
+function hasCreateIndependentInstance(provider: IMetadataProvider): provider is IndependentProviderCapable {
+    return 'CreateIndependentInstance' in provider && typeof provider.CreateIndependentInstance === 'function';
+}
+
 export const DEFAULT_WORK_QUEUE_HOST_START_DEPENDENCIES: WorkQueueHostStartDependencies = {
     Env: process.env,
     FindUserByEmail: email => UserCache.Users.find(user => user.Email?.trim().toLowerCase() === email.trim().toLowerCase()),
+    FindSystemUser: () => UserCache.Instance.GetSystemUser(),
     ConfigureEngine: async (user, provider) => {
         await WorkQueueEngine.Instance.Config(false, user, provider);
         await ReportTopologyIssues(WorkQueueEngine.Instance);
@@ -89,7 +101,7 @@ export function BuildWorkQueueHostConfig(config: WorkQueueConfig, instanceID: st
     };
 }
 
-/** A fresh SQL Server provider per delivery over the shared pool; the server provider otherwise. */
+/** A fresh SQL Server or PostgreSQL provider per delivery over the shared pool; the server provider otherwise. */
 export class MJServerWorkQueueProviderSource implements WorkQueueProviderSource {
     private readonly factory: TaskGraphProviderFactory | null;
 
@@ -97,8 +109,14 @@ export class MJServerWorkQueueProviderSource implements WorkQueueProviderSource
         this.factory = pool ? new TaskGraphProviderFactory(pool) : null;
     }
 
-    public CreateProvider(): Promise<IMetadataProvider> {
-        return this.factory ? this.factory.CreateProvider() : Promise.resolve(this.fallback);
+    public async CreateProvider(): Promise<IMetadataProvider> {
+        if (this.factory) {
+            return this.factory.CreateProvider();
+        }
+        if (hasCreateIndependentInstance(this.fallback)) {
+            return this.fallback.CreateIndependentInstance();
+        }
+        return this.fallback;
     }
 }
 
@@ -116,7 +134,11 @@ export async function StartWorkQueueHost(
         LogStatus(`[WorkQueue] Host disabled by ${WORK_QUEUE_DISABLE_ENV}=1 — this process publishes but runs no subscriptions.`);
         return null;
     }
-    const user = dependencies.FindUserByEmail(config.systemUserEmail);
+    const configuredEmail = config.systemUserEmail?.trim() ?? '';
+    let user = configuredEmail ? dependencies.FindUserByEmail(configuredEmail) : undefined;
+    if (!user && (!configuredEmail || DEFAULT_SYSTEM_USER_EMAILS.has(configuredEmail.toLowerCase()))) {
+        user = dependencies.FindSystemUser?.();
+    }
     if (!user) {
         throw new Error(`[WorkQueue] System user not found with email: ${config.systemUserEmail} — set workQueue.systemUserEmail in mj.config.cjs`);
     }

package/src/services/workQueueConfig.ts

@@ -18,7 +18,7 @@ export const WorkQueueSubscriptionEntrySchema = z.object({
  */
 export const WorkQueueSchema = z
   .object({
-    enabled: z.boolean().optional().default(false),
+    enabled: z.boolean().optional().default(true),
     systemUserEmail: z.string().optional().default('system@memberjunction.org'),
     subscriptions: z.array(WorkQueueSubscriptionEntrySchema).optional().default([{ name: '*', concurrency: 4 }]),
     idlePollMinMs: z.number().int().positive().optional().default(250),
@@ -36,12 +36,12 @@ export const WorkQueueSchema = z
 export type WorkQueueConfig = z.infer<typeof WorkQueueSchema>;
 
 /**
- * The merge base for mj.config.cjs. Like scheduledJobs and integrationSyncWorker, the EFFECTIVE default system user
- * is the placeholder: set workQueue.systemUserEmail explicitly, or StartWorkQueueHost fails fast and says so.
+ * The merge base for mj.config.cjs. Enabled by default with the Database transport out of the box; StartWorkQueueHost
+ * resolves `systemUserEmail` first and falls back to `UserCache.Instance.GetSystemUser()` when the default is unchanged.
  */
 export const DEFAULT_WORK_QUEUE_CONFIG: WorkQueueConfig = {
-  enabled: false,
-  systemUserEmail: 'not.set@nowhere.com',
+  enabled: true,
+  systemUserEmail: 'system@memberjunction.org',
   subscriptions: [{ name: '*', concurrency: 4 }],
   idlePollMinMs: 250,
   idlePollMaxMs: 5000,

package/src/sharedCache.ts

@@ -238,7 +238,7 @@ function relayRunViewChangeToBrowsers(event: CacheChangedEvent): void {
     PubSubManager.Instance.Publish(CACHE_INVALIDATION_TOPIC, {
         entityName,
         primaryKeyValues: null, // entity-level invalidation
-        action: event.Action,
+        action: event.Action === 'row_delta' ? 'set' : event.Action,
         sourceServerId: event.SourceServerId || 'unknown',
         timestamp: new Date(),
     });

package/src/types.ts

@@ -73,6 +73,19 @@ export type AppContext = {
    * Used only to key abuse limits (e.g. realtime verification sends) — never as an identity.
    */
   ClientIp?: string;
+
+  /**
+   * The request's `Origin` header as a normalized origin — scheme, host and port, lowercased, no
+   * trailing slash (e.g. `https://app.example.com:8443`). Normalized by `NormalizeOrigin`, the same
+   * helper the realtime widget allowlist uses, so it compares to allowlist entries normalized the
+   * same way with plain string equality. Ports are kept as sent; browsers omit default ports.
+   *
+   * Undefined when the request sent no `Origin` (server-to-server calls, many same-origin GETs),
+   * sent the opaque `null` origin, or sent a value that is not an http(s) origin. Always absent on
+   * WebSocket (subscription) contexts. Treat undefined as "origin unknown": an allowlist check
+   * must fail closed on it.
+   */
+  RequestOrigin?: string;
 };
 
 export class ProviderInfo {
@@ -145,6 +158,11 @@ export type RunViewGenericParams = {
    * Propagated to `RunViewParams.IncludeBinaryFields`.
    */
   includeBinaryFields?: boolean;
+  /**
+   * When true, no count runs to populate `TotalRowCount`, which comes back undefined.
+   * Propagated to `RunViewParams.SkipTotalRowCount`.
+   */
+  skipTotalRowCount?: boolean;
   /**
    * Optional registered Alternate Base View logical Name (from `EntityAlternateBaseView.Name`)
    * for this entity. Propagated to `RunViewParams.AlternateBaseView`.