@memberjunction/server 6.1.0-edge.0 → 6.1.0-edge.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@memberjunction/server",
-  "version": "6.1.0-edge.0",
+  "version": "6.1.0-edge.2",
   "description": "MemberJunction: This project provides API access via GraphQL to the common data store.",
   "main": "./dist/index.js",
   "types": "./src/index.ts",
@@ -19,94 +19,95 @@
     "@as-integrations/express5": "^1.0.0",
     "@graphql-tools/schema": "^10.0.38",
     "@graphql-tools/utils": "^11.0.0",
-    "@memberjunction/actions": "6.1.0-edge.0",
-    "@memberjunction/actions-apollo": "6.1.0-edge.0",
-    "@memberjunction/actions-base": "6.1.0-edge.0",
-    "@memberjunction/actions-bizapps-accounting": "6.1.0-edge.0",
-    "@memberjunction/actions-bizapps-crm": "6.1.0-edge.0",
-    "@memberjunction/actions-bizapps-formbuilders": "6.1.0-edge.0",
-    "@memberjunction/actions-bizapps-lms": "6.1.0-edge.0",
-    "@memberjunction/actions-bizapps-social": "6.1.0-edge.0",
-    "@memberjunction/ai": "6.1.0-edge.0",
-    "@memberjunction/ai-agent-manager": "6.1.0-edge.0",
-    "@memberjunction/ai-agent-manager-actions": "6.1.0-edge.0",
-    "@memberjunction/ai-agents": "6.1.0-edge.0",
-    "@memberjunction/ai-bridge-base": "6.1.0-edge.0",
-    "@memberjunction/ai-bridge-ringcentral": "6.1.0-edge.0",
-    "@memberjunction/ai-bridge-server": "6.1.0-edge.0",
-    "@memberjunction/ai-bridge-teams": "6.1.0-edge.0",
-    "@memberjunction/ai-bridge-twilio": "6.1.0-edge.0",
-    "@memberjunction/ai-bridge-vonage": "6.1.0-edge.0",
-    "@memberjunction/ai-core-plus": "6.1.0-edge.0",
-    "@memberjunction/ai-engine-base": "6.1.0-edge.0",
-    "@memberjunction/ai-mcp-client": "6.1.0-edge.0",
-    "@memberjunction/ai-prompts": "6.1.0-edge.0",
-    "@memberjunction/ai-provider-bundle": "6.1.0-edge.0",
-    "@memberjunction/ai-vector-sync": "6.1.0-edge.0",
-    "@memberjunction/ai-vectordb": "6.1.0-edge.0",
-    "@memberjunction/ai-vectors-pinecone": "6.1.0-edge.0",
-    "@memberjunction/aiengine": "6.1.0-edge.0",
-    "@memberjunction/api-keys": "6.1.0-edge.0",
-    "@memberjunction/auth-providers": "6.1.0-edge.0",
-    "@memberjunction/clustering-engine": "6.1.0-edge.0",
-    "@memberjunction/codegen-lib": "6.1.0-edge.0",
-    "@memberjunction/communication-engine": "6.1.0-edge.0",
-    "@memberjunction/communication-ms-graph": "6.1.0-edge.0",
-    "@memberjunction/communication-sendgrid": "6.1.0-edge.0",
-    "@memberjunction/communication-types": "6.1.0-edge.0",
-    "@memberjunction/component-registry-client-sdk": "6.1.0-edge.0",
-    "@memberjunction/computer-use": "6.1.0-edge.0",
-    "@memberjunction/computer-use-engine": "6.1.0-edge.0",
-    "@memberjunction/config": "6.1.0-edge.0",
-    "@memberjunction/core": "6.1.0-edge.0",
-    "@memberjunction/core-actions": "6.1.0-edge.0",
-    "@memberjunction/core-entities": "6.1.0-edge.0",
-    "@memberjunction/core-entities-server": "6.1.0-edge.0",
-    "@memberjunction/credentials": "6.1.0-edge.0",
-    "@memberjunction/data-context": "6.1.0-edge.0",
-    "@memberjunction/data-context-server": "6.1.0-edge.0",
-    "@memberjunction/doc-utils": "6.1.0-edge.0",
-    "@memberjunction/encryption": "6.1.0-edge.0",
-    "@memberjunction/entity-communications-base": "6.1.0-edge.0",
-    "@memberjunction/entity-communications-server": "6.1.0-edge.0",
-    "@memberjunction/esignature": "6.1.0-edge.0",
-    "@memberjunction/external-change-detection": "6.1.0-edge.0",
-    "@memberjunction/generic-database-provider": "6.1.0-edge.0",
-    "@memberjunction/global": "6.1.0-edge.0",
-    "@memberjunction/graphql-dataprovider": "6.1.0-edge.0",
-    "@memberjunction/integration-engine": "6.1.0-edge.0",
-    "@memberjunction/integration-engine-base": "6.1.0-edge.0",
-    "@memberjunction/integration-progress-artifacts": "6.1.0-edge.0",
-    "@memberjunction/integration-schema-builder": "6.1.0-edge.0",
-    "@memberjunction/interactive-component-types": "6.1.0-edge.0",
-    "@memberjunction/lists": "6.1.0-edge.0",
-    "@memberjunction/lists-base": "6.1.0-edge.0",
-    "@memberjunction/livekit-room-server": "6.1.0-edge.0",
-    "@memberjunction/notifications": "6.1.0-edge.0",
-    "@memberjunction/postgresql-dataprovider": "6.1.0-edge.0",
-    "@memberjunction/queue": "6.1.0-edge.0",
-    "@memberjunction/record-comparison": "6.1.0-edge.0",
-    "@memberjunction/redis-provider": "6.1.0-edge.0",
-    "@memberjunction/remote-browser-base": "6.1.0-edge.0",
-    "@memberjunction/remote-browser-cdp": "6.1.0-edge.0",
-    "@memberjunction/remote-browser-selfhost": "6.1.0-edge.0",
-    "@memberjunction/remote-browser-server": "6.1.0-edge.0",
-    "@memberjunction/scheduling-actions": "6.1.0-edge.0",
-    "@memberjunction/scheduling-base-types": "6.1.0-edge.0",
-    "@memberjunction/scheduling-engine": "6.1.0-edge.0",
-    "@memberjunction/scheduling-engine-base": "6.1.0-edge.0",
-    "@memberjunction/schema-engine": "6.1.0-edge.0",
-    "@memberjunction/search-engine": "6.1.0-edge.0",
-    "@memberjunction/server-extensions-core": "6.1.0-edge.0",
-    "@memberjunction/sql-dialect": "6.1.0-edge.0",
-    "@memberjunction/sqlserver-dataprovider": "6.1.0-edge.0",
-    "@memberjunction/storage": "6.1.0-edge.0",
-    "@memberjunction/tag-engine": "6.1.0-edge.0",
-    "@memberjunction/tag-engine-base": "6.1.0-edge.0",
-    "@memberjunction/templates": "6.1.0-edge.0",
-    "@memberjunction/testing-engine": "6.1.0-edge.0",
-    "@memberjunction/testing-engine-base": "6.1.0-edge.0",
-    "@memberjunction/version-history": "6.1.0-edge.0",
+    "@memberjunction/actions": "6.1.0-edge.2",
+    "@memberjunction/actions-apollo": "6.1.0-edge.2",
+    "@memberjunction/actions-base": "6.1.0-edge.2",
+    "@memberjunction/actions-bizapps-accounting": "6.1.0-edge.2",
+    "@memberjunction/actions-bizapps-crm": "6.1.0-edge.2",
+    "@memberjunction/actions-bizapps-formbuilders": "6.1.0-edge.2",
+    "@memberjunction/actions-bizapps-lms": "6.1.0-edge.2",
+    "@memberjunction/actions-bizapps-social": "6.1.0-edge.2",
+    "@memberjunction/ai": "6.1.0-edge.2",
+    "@memberjunction/ai-agent-manager": "6.1.0-edge.2",
+    "@memberjunction/ai-agent-manager-actions": "6.1.0-edge.2",
+    "@memberjunction/ai-agents": "6.1.0-edge.2",
+    "@memberjunction/ai-bridge-base": "6.1.0-edge.2",
+    "@memberjunction/ai-bridge-ringcentral": "6.1.0-edge.2",
+    "@memberjunction/ai-bridge-server": "6.1.0-edge.2",
+    "@memberjunction/ai-bridge-teams": "6.1.0-edge.2",
+    "@memberjunction/ai-bridge-twilio": "6.1.0-edge.2",
+    "@memberjunction/ai-bridge-vonage": "6.1.0-edge.2",
+    "@memberjunction/ai-core-plus": "6.1.0-edge.2",
+    "@memberjunction/ai-engine-base": "6.1.0-edge.2",
+    "@memberjunction/ai-mcp-client": "6.1.0-edge.2",
+    "@memberjunction/ai-prompts": "6.1.0-edge.2",
+    "@memberjunction/ai-provider-bundle": "6.1.0-edge.2",
+    "@memberjunction/ai-vector-sync": "6.1.0-edge.2",
+    "@memberjunction/ai-vectordb": "6.1.0-edge.2",
+    "@memberjunction/ai-vectors-pinecone": "6.1.0-edge.2",
+    "@memberjunction/aiengine": "6.1.0-edge.2",
+    "@memberjunction/api-keys": "6.1.0-edge.2",
+    "@memberjunction/auth-providers": "6.1.0-edge.2",
+    "@memberjunction/clustering-engine": "6.1.0-edge.2",
+    "@memberjunction/codegen-lib": "6.1.0-edge.2",
+    "@memberjunction/communication-engine": "6.1.0-edge.2",
+    "@memberjunction/communication-ms-graph": "6.1.0-edge.2",
+    "@memberjunction/communication-sendgrid": "6.1.0-edge.2",
+    "@memberjunction/communication-types": "6.1.0-edge.2",
+    "@memberjunction/component-registry-client-sdk": "6.1.0-edge.2",
+    "@memberjunction/computer-use": "6.1.0-edge.2",
+    "@memberjunction/computer-use-engine": "6.1.0-edge.2",
+    "@memberjunction/config": "6.1.0-edge.2",
+    "@memberjunction/core": "6.1.0-edge.2",
+    "@memberjunction/core-actions": "6.1.0-edge.2",
+    "@memberjunction/core-entities": "6.1.0-edge.2",
+    "@memberjunction/core-entities-server": "6.1.0-edge.2",
+    "@memberjunction/credentials": "6.1.0-edge.2",
+    "@memberjunction/data-context": "6.1.0-edge.2",
+    "@memberjunction/data-context-server": "6.1.0-edge.2",
+    "@memberjunction/doc-utils": "6.1.0-edge.2",
+    "@memberjunction/encryption": "6.1.0-edge.2",
+    "@memberjunction/entity-communications-base": "6.1.0-edge.2",
+    "@memberjunction/entity-communications-server": "6.1.0-edge.2",
+    "@memberjunction/esignature": "6.1.0-edge.2",
+    "@memberjunction/external-change-detection": "6.1.0-edge.2",
+    "@memberjunction/generic-database-provider": "6.1.0-edge.2",
+    "@memberjunction/global": "6.1.0-edge.2",
+    "@memberjunction/graphql-dataprovider": "6.1.0-edge.2",
+    "@memberjunction/integration-engine": "6.1.0-edge.2",
+    "@memberjunction/integration-engine-base": "6.1.0-edge.2",
+    "@memberjunction/integration-progress-artifacts": "6.1.0-edge.2",
+    "@memberjunction/integration-schema-builder": "6.1.0-edge.2",
+    "@memberjunction/interactive-component-types": "6.1.0-edge.2",
+    "@memberjunction/lists": "6.1.0-edge.2",
+    "@memberjunction/lists-base": "6.1.0-edge.2",
+    "@memberjunction/livekit-room-server": "6.1.0-edge.2",
+    "@memberjunction/notifications": "6.1.0-edge.2",
+    "@memberjunction/postgresql-dataprovider": "6.1.0-edge.2",
+    "@memberjunction/queue": "6.1.0-edge.2",
+    "@memberjunction/record-comparison": "6.1.0-edge.2",
+    "@memberjunction/redis-provider": "6.1.0-edge.2",
+    "@memberjunction/remote-browser-base": "6.1.0-edge.2",
+    "@memberjunction/remote-browser-cdp": "6.1.0-edge.2",
+    "@memberjunction/remote-browser-selfhost": "6.1.0-edge.2",
+    "@memberjunction/remote-browser-server": "6.1.0-edge.2",
+    "@memberjunction/scheduling-actions": "6.1.0-edge.2",
+    "@memberjunction/scheduling-base-types": "6.1.0-edge.2",
+    "@memberjunction/scheduling-engine": "6.1.0-edge.2",
+    "@memberjunction/scheduling-engine-base": "6.1.0-edge.2",
+    "@memberjunction/schema-engine": "6.1.0-edge.2",
+    "@memberjunction/search-engine": "6.1.0-edge.2",
+    "@memberjunction/server-extensions-core": "6.1.0-edge.2",
+    "@memberjunction/sql-dialect": "6.1.0-edge.2",
+    "@memberjunction/sqlserver-dataprovider": "6.1.0-edge.2",
+    "@memberjunction/storage": "6.1.0-edge.2",
+    "@memberjunction/tag-engine": "6.1.0-edge.2",
+    "@memberjunction/tag-engine-base": "6.1.0-edge.2",
+    "@memberjunction/task-graph": "6.1.0-edge.2",
+    "@memberjunction/templates": "6.1.0-edge.2",
+    "@memberjunction/testing-engine": "6.1.0-edge.2",
+    "@memberjunction/testing-engine-base": "6.1.0-edge.2",
+    "@memberjunction/version-history": "6.1.0-edge.2",
     "@octokit/auth-app": "^7.1.5",
     "@octokit/rest": "^21.1.1",
     "@types/compression": "^1.8.1",
@@ -148,6 +149,7 @@
   "devDependencies": {
     "@types/express": "^5.0.6",
     "pkgroll": "2.23.0",
+    "rimraf": "6.1.2",
     "typescript": "^5.9.3",
     "vitest": "^3.1.1"
   },
@@ -156,6 +158,7 @@
     "url": "https://github.com/MemberJunction/MJ"
   },
   "scripts": {
+    "prebuild": "rimraf dist",
     "build": "tsc && tsc-alias -f",
     "bundle": "tsc -noEmit && pkgroll --sourcemap --minify",
     "watch": "tsc -w",

package/src/__tests__/RealtimeClientSessionResolver.test.ts

@@ -148,7 +148,7 @@ vi.mock('../util.js', () => ({
 // --- Partial mock: control ONLY UserCache.GetSystemUser (the scoped-anonymous elevation seam,
 //     issue #3371); everything else in the data provider stays real ---
 const getSystemUserMock = vi.fn<[], UserInfo | undefined>();
-vi.mock('@memberjunction/sqlserver-dataprovider', async (importOriginal) => {
+vi.mock('@memberjunction/generic-database-provider', async (importOriginal) => {
     const actual = await importOriginal<Record<string, unknown>>();
     return {
         ...actual,

package/src/__tests__/ResolverBase.frozenRecordMapping.test.ts

@@ -0,0 +1,133 @@
+// ResolverBase transitively pulls in type-graphql decorators, which need the
+// Reflect.metadata polyfill at import time.
+import 'reflect-metadata';
+import { describe, it, expect } from 'vitest';
+import type { IMetadataProvider, UserInfo } from '@memberjunction/core';
+import { ResolverBase } from '../generic/ResolverBase.js';
+
+/**
+ * `MapFieldNamesToCodeNames` must not write into the rows it is handed
+ * (PR #3425 review, finding M2).
+ *
+ * This is the SINGLE-RECORD half of the transport rename. The RunView half was fixed to
+ * copy-then-map, but this one still renamed `__mj_*` → `_mj__*` by writing onto its argument —
+ * and its arguments are frequently rows straight out of `findBy`/`RunView`, i.e. the server
+ * cache's own objects.
+ *
+ * Now that `LocalCacheManager` deep-freezes cached rows, that in-place rename does not corrupt
+ * the cache — it throws. Reproduced live against a running MJAPI before the fix:
+ *
+ *     UserByEmail → "Cannot add property _mj__CreatedAt, object is not extensible"
+ *
+ * deterministically, on every call, because `MJ: Users` has caching enabled. `UserByID` and
+ * `UserByEmployeeID` share the code path, and so does every CodeGen-generated single-record
+ * resolver in `generated.ts` (`MapFieldNamesToCodeNames(entity, rows[0], ...)`), which is why
+ * the fix belongs in the shared helper rather than at the call sites.
+ */
+
+/** Exposes the two protected mappers and supplies metadata without a live provider. */
+class MappingProbe extends ResolverBase {
+    public MapOne(entityName: string, dataObject: unknown, provider: IMetadataProvider): Promise<unknown> {
+        return this.MapFieldNamesToCodeNames(entityName, dataObject, undefined, provider);
+    }
+    public MapMany(entityName: string, rows: unknown[], provider: IMetadataProvider, contextUser?: UserInfo): Promise<unknown[]> {
+        return this.ArrayMapFieldNamesToCodeNames(entityName, rows as Record<string, unknown>[], contextUser, provider);
+    }
+}
+
+const ENTITY_NAME = 'MJ: Users';
+
+/**
+ * Minimal metadata: the field set drives the rename, `EncryptedFields` empty so the
+ * EncryptionEngine is never consulted.
+ */
+function fakeProvider(): IMetadataProvider {
+    return {
+        EntityByName: (name: string) =>
+            name === ENTITY_NAME
+                ? {
+                      Name: ENTITY_NAME,
+                      Fields: [
+                          { Name: 'ID', CodeName: 'ID' },
+                          { Name: 'Name', CodeName: 'Name' },
+                          { Name: '__mj_CreatedAt', CodeName: '__mj_CreatedAt' },
+                          { Name: '__mj_UpdatedAt', CodeName: '__mj_UpdatedAt' },
+                      ],
+                      EncryptedFields: [],
+                  }
+                : undefined,
+    } as unknown as IMetadataProvider;
+}
+
+/** A row as the cache hands it out: deep-frozen. */
+function frozenCachedRow(): Record<string, unknown> {
+    return Object.freeze({
+        ID: 'u-1',
+        Name: 'Ada',
+        __mj_CreatedAt: 'T0',
+        __mj_UpdatedAt: 'T1',
+    }) as Record<string, unknown>;
+}
+
+describe('MapFieldNamesToCodeNames on frozen cache rows', () => {
+    it('maps a FROZEN row to transport keys instead of throwing (the live UserByEmail 500)', async () => {
+        const row = frozenCachedRow();
+
+        const mapped = (await new MappingProbe().MapOne(ENTITY_NAME, row, fakeProvider())) as Record<string, unknown>;
+
+        expect(mapped._mj__CreatedAt).toBe('T0');
+        expect(mapped._mj__UpdatedAt).toBe('T1');
+        expect(mapped.ID).toBe('u-1');
+        expect(mapped.Name).toBe('Ada');
+        // The transport aliases replace the originals in the OUTGOING shape.
+        expect(mapped.__mj_CreatedAt).toBeUndefined();
+    });
+
+    it('returns a copy — the caller\'s row keeps its entity field names', async () => {
+        // Unfrozen input, so a regression to in-place mapping would silently pass the frozen
+        // test above only if it also stopped mapping. This one pins non-mutation directly.
+        const row: Record<string, unknown> = { ID: 'u-1', Name: 'Ada', __mj_CreatedAt: 'T0', __mj_UpdatedAt: 'T1' };
+
+        const mapped = (await new MappingProbe().MapOne(ENTITY_NAME, row, fakeProvider())) as Record<string, unknown>;
+
+        expect(row.__mj_CreatedAt).toBe('T0');
+        expect(row._mj__CreatedAt).toBeUndefined();
+        expect(mapped).not.toBe(row);
+    });
+
+    it('still returns null for empty/absent input (contract unchanged)', async () => {
+        const probe = new MappingProbe();
+        expect(await probe.MapOne(ENTITY_NAME, null, fakeProvider())).toBeNull();
+        expect(await probe.MapOne(ENTITY_NAME, {}, fakeProvider())).toBeNull();
+    });
+
+    it('leaves rows with no __mj_ fields structurally intact', async () => {
+        const row = Object.freeze({ ID: 'u-1', Name: 'Ada' }) as Record<string, unknown>;
+
+        const mapped = (await new MappingProbe().MapOne(ENTITY_NAME, row, fakeProvider())) as Record<string, unknown>;
+
+        expect(mapped).toEqual({ ID: 'u-1', Name: 'Ada' });
+    });
+});
+
+describe('ArrayMapFieldNamesToCodeNames on frozen cache rows', () => {
+    it('maps a frozen ARRAY of frozen rows without mutating either', async () => {
+        // The array itself is frozen too — LocalCacheManager freezes the array as well as the
+        // rows, because `results.sort()`/`.push()` on a live cache array is its own hazard.
+        const rows = Object.freeze([frozenCachedRow(), frozenCachedRow()]) as unknown as Record<string, unknown>[];
+
+        const mapped = (await new MappingProbe().MapMany(ENTITY_NAME, rows, fakeProvider())) as Record<string, unknown>[];
+
+        expect(mapped).toHaveLength(2);
+        expect(mapped[0]._mj__CreatedAt).toBe('T0');
+        expect(mapped[1]._mj__UpdatedAt).toBe('T1');
+        // Inputs untouched.
+        expect(rows[0].__mj_CreatedAt).toBe('T0');
+        expect(rows[0]._mj__CreatedAt).toBeUndefined();
+        expect(mapped[0]).not.toBe(rows[0]);
+    });
+
+    it('passes an empty array straight through', async () => {
+        expect(await new MappingProbe().MapMany(ENTITY_NAME, [], fakeProvider())).toEqual([]);
+    });
+});

package/src/__tests__/ResolverBase.transportMapping.test.ts

@@ -0,0 +1,289 @@
+// ResolverBase transitively pulls in type-graphql decorators, which need the
+// Reflect.metadata polyfill at import time.
+import 'reflect-metadata';
+import { describe, it, expect } from 'vitest';
+import type { DatabaseProviderBase, RunViewParams, RunViewResult, UserInfo } from '@memberjunction/core';
+import type { MJUserViewEntityExtended } from '@memberjunction/core-entities';
+import { FieldMapper } from '@memberjunction/graphql-dataprovider';
+import { ResolverBase } from '../generic/ResolverBase.js';
+import type { UserPayload } from '../types.js';
+
+/**
+ * Regression guard for the server-cache corruption behind
+ * "Field _mj__CreatedAt does not exist on MJ: Template Categories".
+ *
+ * GraphQL reserves the `__` prefix, so MJ renames `__mj_*` columns to the
+ * transport alias `_mj__*` on the way out. `ResolverBase` used to apply that
+ * rename IN PLACE over `result.Results` — but those are the data provider's own
+ * row objects, and the server's cache holds them BY REFERENCE. Preparing one
+ * GraphQL response therefore rewrote the keys inside the live cache, and every
+ * subsequent read served from it handed the client transport-shaped rows that
+ * `BaseEntity.SetMany` rejects. Process-wide cache ⇒ one response poisoned every
+ * later request, across all workers.
+ *
+ * The fix is copy-then-map. The first block exercises the REAL resolver path (so a
+ * revert to in-place mapping fails here); the second pins the two `FieldMapper`
+ * invariants that make the fix correct.
+ *
+ * These copies are now LOAD-BEARING rather than merely defensive: `LocalCacheManager`
+ * deep-freezes cached rows on reference-sharing storage providers, so mapping in place
+ * would throw a `TypeError` instead of silently corrupting the cache. The third block
+ * pins that the copy-then-map pattern still works on frozen input — the shape the cache
+ * actually hands out — and that in-place mapping is now refused outright.
+ */
+
+/** A cache-held row, shaped the way the provider hands them back. */
+type CachedRow = Record<string, unknown>;
+
+/**
+ * Reaches the protected `RunViewGenericInternal` and records what
+ * `ArrayFilterEncryptedFieldsForAPI` was handed — the second in-place mutator that
+ * must also see copies, and stubbed here so the assertion needs no live Metadata.
+ */
+class Probe extends ResolverBase {
+    public filteredRows: Record<string, unknown>[] | null = null;
+
+    protected override async ArrayFilterEncryptedFieldsForAPI(
+        _entityName: string,
+        dataObjectArray: Record<string, unknown>[]
+    ): Promise<Record<string, unknown>[]> {
+        this.filteredRows = dataObjectArray;
+        return dataObjectArray;
+    }
+
+    public Run(provider: DatabaseProviderBase, viewInfo: MJUserViewEntityExtended, userPayload: UserPayload) {
+        return this.RunViewGenericInternal(
+            provider,
+            viewInfo,
+            '', // extraFilter
+            '', // orderBy
+            '', // userSearchString
+            undefined, // excludeUserViewRunID
+            undefined, // overrideExcludeFilter
+            undefined, // saveViewResults
+            undefined, // fields
+            undefined, // ignoreMaxRows
+            undefined, // excludeDataFromAllPriorViewRuns
+            undefined, // forceAuditLog
+            undefined, // auditLogDescription
+            'simple', // resultType
+            userPayload,
+            undefined, // maxRows
+            undefined // startRow
+        );
+    }
+}
+
+const ENTITY_NAME = 'MJ: Template Categories';
+
+/** Minimal provider: the entity lookup + the RunView the resolver awaits. */
+function fakeProvider(rows: CachedRow[]): DatabaseProviderBase {
+    return {
+        Entities: [{ Name: ENTITY_NAME, PrimaryKeys: [{ Name: 'ID' }] }],
+        RunView: async (_params: RunViewParams): Promise<RunViewResult> =>
+            ({ Success: true, Results: rows, RowCount: rows.length, TotalRowCount: rows.length, ErrorMessage: '' } as RunViewResult),
+    } as unknown as DatabaseProviderBase;
+}
+
+const fakeViewInfo = () =>
+    ({ ID: 'view-1', Name: 'Test View', Entity: ENTITY_NAME } as unknown as MJUserViewEntityExtended);
+
+/** `userRecord` short-circuits the UserCache lookup; no apiKeyHash skips the scope check. */
+const fakePayload = () =>
+    ({ email: 'tester@example.com', userRecord: { Email: 'tester@example.com' } as UserInfo } as UserPayload);
+
+describe('ResolverBase.RunViewGenericInternal — cache safety', () => {
+    it('leaves the provider\'s (cache-held) rows untouched while returning transport keys', async () => {
+        const cachedRow: CachedRow = { ID: 'a1', Name: 'Cat', __mj_CreatedAt: 'T0', __mj_UpdatedAt: 'T1' };
+        const probe = new Probe();
+
+        const result = await probe.Run(fakeProvider([cachedRow]), fakeViewInfo(), fakePayload());
+
+        // The pre-fix code renamed these keys in place — this is the assertion that fails on a revert.
+        expect(cachedRow.__mj_CreatedAt).toBe('T0');
+        expect(cachedRow.__mj_UpdatedAt).toBe('T1');
+        expect(cachedRow._mj__CreatedAt).toBeUndefined();
+
+        // The outgoing rows carry the GraphQL-legal aliases, and are NOT the cached objects.
+        const wire = result?.Results as Record<string, unknown>[];
+        expect(wire[0]._mj__CreatedAt).toBe('T0');
+        expect(wire[0]).not.toBe(cachedRow);
+    });
+
+    it('hands the encrypted-field filter the copies, not the cached rows', async () => {
+        const cachedRow: CachedRow = { ID: 'a1', Secret: 'plaintext', __mj_CreatedAt: 'T0' };
+        const probe = new Probe();
+
+        await probe.Run(fakeProvider([cachedRow]), fakeViewInfo(), fakePayload());
+
+        expect(probe.filteredRows).not.toBeNull();
+        expect(probe.filteredRows![0]).not.toBe(cachedRow);
+    });
+});
+
+describe('FieldMapper transport mapping — the invariants the fix rests on', () => {
+    it('MapFields MUTATES its argument (the hazard the resolver must not expose the cache to)', () => {
+        // Documents WHY the resolver must copy. If this ever becomes non-mutating,
+        // the copy in ResolverBase is redundant rather than load-bearing — and this
+        // test failing is the signal to revisit it.
+        const row: Record<string, unknown> = { ID: 'a1', Name: 'Cat', __mj_CreatedAt: 'T0' };
+
+        new FieldMapper().MapFields(row);
+
+        expect(row.__mj_CreatedAt).toBeUndefined();
+        expect(row._mj__CreatedAt).toBe('T0');
+    });
+
+    it('post-map mutation of the copy cannot reach the cached row', () => {
+        // ArrayFilterEncryptedFieldsForAPI redacts in place after mapping; on the
+        // pre-fix code that stripped secrets out of the CACHED row too.
+        const mapper = new FieldMapper();
+        const cachedRow: Record<string, unknown> = { ID: 'a1', Secret: 'plaintext', __mj_CreatedAt: 'T0' };
+
+        const wireRow = mapper.MapFields({ ...cachedRow })!;
+        wireRow.Secret = null; // stand-in for the encrypted-field filter
+
+        expect(cachedRow.Secret).toBe('plaintext');
+        expect(wireRow.Secret).toBeNull();
+    });
+
+    it('round-trips a mapped copy back to entity field names', () => {
+        // The client's ConvertBackToMJFields must undo exactly what the server did.
+        const mapper = new FieldMapper();
+        const original: Record<string, unknown> = { ID: 'a1', __mj_CreatedAt: 'T0', __mj_UpdatedAt: 'T1' };
+
+        const wire = mapper.MapFields({ ...original })!;
+        const back = mapper.ReverseMapFields({ ...wire });
+
+        expect(back).toEqual(original);
+    });
+
+    it('leaves rows without __mj_ fields structurally unchanged', () => {
+        const mapper = new FieldMapper();
+        const row = { ID: 'a1', Name: 'Cat' };
+
+        expect(mapper.MapFields({ ...row })).toEqual(row);
+    });
+});
+
+describe('transport mapping against FROZEN cache rows', () => {
+    // The cache deep-freezes rows it hands out (LocalCacheManager freeze-on-write), so the
+    // resolver's input is frozen in the deployment that matters — MJAPI on the in-memory
+    // storage provider. That turns the copy from a precaution into a requirement.
+    it('copy-then-map works on a frozen row', () => {
+        const mapper = new FieldMapper();
+        const cachedRow = Object.freeze({ ID: 'a1', Name: 'Cat', __mj_CreatedAt: 'T0' }) as Record<string, unknown>;
+
+        const wireRow = mapper.MapFields({ ...cachedRow })!;
+
+        expect(wireRow._mj__CreatedAt).toBe('T0');
+        expect(wireRow.__mj_CreatedAt).toBeUndefined();
+        // The copy is mutable, so the encrypted-field filter can still redact in place.
+        expect(Object.isFrozen(wireRow)).toBe(false);
+        // And the frozen cached row is untouched.
+        expect(cachedRow.__mj_CreatedAt).toBe('T0');
+    });
+
+    it('in-place mapping of a frozen row THROWS — silent corruption is now impossible', () => {
+        // This is the safety net the freeze adds on top of the copy: if a future refactor
+        // reverts to in-place mapping, it fails loudly at the offending line instead of
+        // quietly rewriting process-wide state.
+        const mapper = new FieldMapper();
+        const cachedRow = Object.freeze({ ID: 'a1', __mj_CreatedAt: 'T0' }) as Record<string, unknown>;
+
+        expect(() => mapper.MapFields(cachedRow)).toThrow(TypeError);
+    });
+});
+
+/**
+ * The BATCH path (`RunViewsGenericInternal`), which the single-view tests above do not reach
+ * (PR #3425 review, finding M8).
+ *
+ * This is the path multi-view clients actually take — MJExplorer batches its view loads — so
+ * leaving it uncovered meant the original corruption bug could be reintroduced on the more
+ * heavily used of the two legs with CI still green.
+ */
+class BatchProbe extends ResolverBase {
+    public filteredRows: Record<string, unknown>[] | null = null;
+
+    protected override async ArrayFilterEncryptedFieldsForAPI(
+        _entityName: string,
+        dataObjectArray: Record<string, unknown>[]
+    ): Promise<Record<string, unknown>[]> {
+        this.filteredRows = dataObjectArray;
+        return dataObjectArray;
+    }
+
+    public RunBatch(provider: DatabaseProviderBase, viewInfos: MJUserViewEntityExtended[], userPayload: UserPayload) {
+        return this.RunViewsGenericInternal(
+            viewInfos.map(viewInfo => ({ provider, viewInfo, userPayload, resultType: 'simple' })) as never
+        );
+    }
+}
+
+/** Batch provider: `RunViews` returns one result per param, in order. */
+function fakeBatchProvider(rowsPerView: CachedRow[][]): DatabaseProviderBase {
+    return {
+        Entities: [{ Name: ENTITY_NAME, PrimaryKeys: [{ Name: 'ID' }] }],
+        EntityByName: (name: string) => (name === ENTITY_NAME ? { Name: ENTITY_NAME } : undefined),
+        RunViews: async (params: RunViewParams[]): Promise<RunViewResult[]> =>
+            params.map((_p, i) => {
+                const rows = rowsPerView[i] ?? [];
+                return { Success: true, Results: rows, RowCount: rows.length, TotalRowCount: rows.length, ErrorMessage: '' } as RunViewResult;
+            }),
+    } as unknown as DatabaseProviderBase;
+}
+
+describe('ResolverBase.RunViewsGenericInternal (batch) — cache safety', () => {
+    it('leaves every view\'s cache-held rows untouched while returning transport keys', async () => {
+        const viewARow: CachedRow = { ID: 'a1', Name: 'Cat', __mj_CreatedAt: 'T0', __mj_UpdatedAt: 'T1' };
+        const viewBRow: CachedRow = { ID: 'b1', Name: 'Dog', __mj_CreatedAt: 'T2', __mj_UpdatedAt: 'T3' };
+        const probe = new BatchProbe();
+
+        const results = await probe.RunBatch(
+            fakeBatchProvider([[viewARow], [viewBRow]]),
+            [fakeViewInfo(), fakeViewInfo()],
+            fakePayload()
+        );
+
+        // Both source rows keep entity field names — the assertion that fails on a revert
+        // to in-place mapping in the batch loop.
+        expect(viewARow.__mj_CreatedAt).toBe('T0');
+        expect(viewARow._mj__CreatedAt).toBeUndefined();
+        expect(viewBRow.__mj_CreatedAt).toBe('T2');
+        expect(viewBRow._mj__CreatedAt).toBeUndefined();
+
+        // ...and both outgoing views carry the aliases, on objects that are not the cached ones.
+        const wireA = results[0].Results as Record<string, unknown>[];
+        const wireB = results[1].Results as Record<string, unknown>[];
+        expect(wireA[0]._mj__CreatedAt).toBe('T0');
+        expect(wireB[0]._mj__CreatedAt).toBe('T2');
+        expect(wireA[0]).not.toBe(viewARow);
+        expect(wireB[0]).not.toBe(viewBRow);
+    });
+
+    it('maps FROZEN cache rows rather than throwing on them', async () => {
+        // The shape the cache actually hands out on a hit.
+        const frozenRow = Object.freeze({ ID: 'a1', Name: 'Cat', __mj_CreatedAt: 'T0' }) as CachedRow;
+        const probe = new BatchProbe();
+
+        const results = await probe.RunBatch(
+            fakeBatchProvider([[frozenRow]]),
+            [fakeViewInfo()],
+            fakePayload()
+        );
+
+        expect((results[0].Results as Record<string, unknown>[])[0]._mj__CreatedAt).toBe('T0');
+        expect(frozenRow.__mj_CreatedAt).toBe('T0');
+    });
+
+    it('hands the encrypted-field filter copies, not the cached rows', async () => {
+        const cachedRow: CachedRow = { ID: 'a1', Secret: 'plaintext', __mj_CreatedAt: 'T0' };
+        const probe = new BatchProbe();
+
+        await probe.RunBatch(fakeBatchProvider([[cachedRow]]), [fakeViewInfo()], fakePayload());
+
+        expect(probe.filteredRows).not.toBeNull();
+        expect(probe.filteredRows![0]).not.toBe(cachedRow);
+    });
+});

package/src/__tests__/SessionManager.test.ts

@@ -43,7 +43,7 @@ vi.mock('@memberjunction/core', async (importOriginal) => {
 // --- Partial mock: control ONLY UserCache.GetSystemUser (the scoped-anonymous elevation seam,
 //     issue #3371); everything else in the data provider stays real ---
 const getSystemUserMock = vi.fn<[], UserInfo | undefined>();
-vi.mock('@memberjunction/sqlserver-dataprovider', async (importOriginal) => {
+vi.mock('@memberjunction/generic-database-provider', async (importOriginal) => {
     const actual = await importOriginal<Record<string, unknown>>();
     return {
         ...actual,