@memberjunction/server 6.1.4 → 6.2.0-edge.1

package/src/__tests__/principals.test.ts

@@ -13,7 +13,7 @@
  * singleton nor a database — the seam is `(candidate, users) -> resolution`.
  */
 import { describe, it, expect } from 'vitest';
-import { resolvePrincipalFrom, type ResolvablePrincipal } from '../auth/principals.js';
+import { ResolvePrincipalFrom, type ResolvablePrincipal } from '../auth/principals.js';
 
 /**
  * The system user's ID, pinned by `UserCache` (`SYSTEM_USER_ID`) and seeded by every baseline.
@@ -63,14 +63,14 @@ const STOCK_HOST: ResolvablePrincipal[] = [SYSTEM, ANONYMOUS, HOST_ADMIN];
 describe('resolvePrincipalFrom', () => {
     describe('the shipped default (#4209)', () => {
         it('resolves the email-shaped default to the seeded System user', () => {
-            const result = resolvePrincipalFrom(SHIPPED_DEFAULT, STOCK_HOST, SYSTEM_USER_ID);
+            const result = ResolvePrincipalFrom(SHIPPED_DEFAULT, STOCK_HOST, SYSTEM_USER_ID);
 
             expect(result.user).toBe(SYSTEM);
             expect(result.reason).toBe('email');
         });
 
         it('reports no warning when the default resolves, so a stock host logs nothing', () => {
-            const result = resolvePrincipalFrom(SHIPPED_DEFAULT, STOCK_HOST, SYSTEM_USER_ID);
+            const result = ResolvePrincipalFrom(SHIPPED_DEFAULT, STOCK_HOST, SYSTEM_USER_ID);
 
             expect(result.warning).toBeUndefined();
         });
@@ -81,8 +81,8 @@ describe('resolvePrincipalFrom', () => {
             // `SELECT * FROM vwUsers` carries no ORDER BY and the cache is mutated in place at
             // runtime, so row order differs between boots AND within a process. Attribution must
             // not depend on it: this is what made CreatedByUserID incidental.
-            const ordered = resolvePrincipalFrom(SHIPPED_DEFAULT, STOCK_HOST, SYSTEM_USER_ID);
-            const reversed = resolvePrincipalFrom(SHIPPED_DEFAULT, [...STOCK_HOST].reverse(), SYSTEM_USER_ID);
+            const ordered = ResolvePrincipalFrom(SHIPPED_DEFAULT, STOCK_HOST, SYSTEM_USER_ID);
+            const reversed = ResolvePrincipalFrom(SHIPPED_DEFAULT, [...STOCK_HOST].reverse(), SYSTEM_USER_ID);
 
             expect(reversed.user).toBe(ordered.user);
         });
@@ -107,7 +107,7 @@ describe('resolvePrincipalFrom', () => {
                 IsActive: true,
             };
 
-            const result = resolvePrincipalFrom('support@acme.com', [emailSupport, namedSupport], SYSTEM_USER_ID);
+            const result = ResolvePrincipalFrom('support@acme.com', [emailSupport, namedSupport], SYSTEM_USER_ID);
 
             expect(result.user).toBe(namedSupport);
             expect(result.reason).toBe('name');
@@ -125,15 +125,15 @@ describe('resolvePrincipalFrom', () => {
         const HIGH: ResolvablePrincipal = { ID: 'FFFFFFFF-0000-0000-0000-00000000000F', Name: 'shared.name', Email: 'high@acme.com', Type: 'User', IsActive: true };
 
         it('picks the lowest-ID user when two users share the configured Name', () => {
-            const result = resolvePrincipalFrom('shared.name', [HIGH, LOW, SYSTEM], SYSTEM_USER_ID);
+            const result = ResolvePrincipalFrom('shared.name', [HIGH, LOW, SYSTEM], SYSTEM_USER_ID);
 
             expect(result.user).toBe(LOW);
             expect(result.reason).toBe('name');
         });
 
         it('resolves a duplicated Name identically however the cache is ordered', () => {
-            const forward = resolvePrincipalFrom('shared.name', [HIGH, LOW, SYSTEM], SYSTEM_USER_ID);
-            const reversed = resolvePrincipalFrom('shared.name', [SYSTEM, LOW, HIGH], SYSTEM_USER_ID);
+            const forward = ResolvePrincipalFrom('shared.name', [HIGH, LOW, SYSTEM], SYSTEM_USER_ID);
+            const reversed = ResolvePrincipalFrom('shared.name', [SYSTEM, LOW, HIGH], SYSTEM_USER_ID);
 
             expect(reversed.user).toBe(forward.user);
         });
@@ -145,7 +145,7 @@ describe('resolvePrincipalFrom', () => {
             const lowEmail: ResolvablePrincipal = { ...LOW, Name: 'a.person', Email: 'shared@acme.com' };
             const highEmail: ResolvablePrincipal = { ...HIGH, Name: 'b.person', Email: 'shared@acme.com' };
 
-            const result = resolvePrincipalFrom('shared@acme.com', [highEmail, lowEmail, SYSTEM], SYSTEM_USER_ID);
+            const result = ResolvePrincipalFrom('shared@acme.com', [highEmail, lowEmail, SYSTEM], SYSTEM_USER_ID);
 
             expect(result.user).toBe(lowEmail);
             expect(result.reason).toBe('email');
@@ -169,7 +169,7 @@ describe('resolvePrincipalFrom', () => {
         };
 
         it('does not resolve a deactivated candidate by Email', () => {
-            const result = resolvePrincipalFrom('departed@acme.com', [...STOCK_HOST, RETIRED], SYSTEM_USER_ID);
+            const result = ResolvePrincipalFrom('departed@acme.com', [...STOCK_HOST, RETIRED], SYSTEM_USER_ID);
 
             expect(result.user).toBe(SYSTEM);
             expect(result.reason).toBe('system');
@@ -180,14 +180,14 @@ describe('resolvePrincipalFrom', () => {
             // most: without it the guarantee holds only for the rungs nobody configures.
             const renamed: ResolvablePrincipal = { ...RETIRED, Name: 'ops-service-account', Email: 'ops@acme.com' };
 
-            const result = resolvePrincipalFrom('ops-service-account', [...STOCK_HOST, renamed], SYSTEM_USER_ID);
+            const result = ResolvePrincipalFrom('ops-service-account', [...STOCK_HOST, renamed], SYSTEM_USER_ID);
 
             expect(result.user).toBe(SYSTEM);
             expect(result.reason).toBe('system');
         });
 
         it('reports that the candidate matched but is inactive, not that it matched nothing', () => {
-            const result = resolvePrincipalFrom('departed@acme.com', [...STOCK_HOST, RETIRED], SYSTEM_USER_ID);
+            const result = ResolvePrincipalFrom('departed@acme.com', [...STOCK_HOST, RETIRED], SYSTEM_USER_ID);
 
             // "matched no user's Name or Email" would send the operator hunting for a typo in a
             // value that is spelled correctly. The fix here is to reactivate the account or name a
@@ -215,7 +215,7 @@ describe('resolvePrincipalFrom', () => {
                 IsActive: true,
             };
 
-            const result = resolvePrincipalFrom('ops@acme.com', [inactiveByName, activeByEmail], SYSTEM_USER_ID);
+            const result = ResolvePrincipalFrom('ops@acme.com', [inactiveByName, activeByEmail], SYSTEM_USER_ID);
 
             expect(result.user).toBe(activeByEmail);
             expect(result.reason).toBe('email');
@@ -224,14 +224,14 @@ describe('resolvePrincipalFrom', () => {
     });
     describe('fallbacks', () => {
         it('falls back to the System user rather than an arbitrary Owner when the candidate is unresolvable', () => {
-            const result = resolvePrincipalFrom('nobody@nowhere.example', STOCK_HOST, SYSTEM_USER_ID);
+            const result = ResolvePrincipalFrom('nobody@nowhere.example', STOCK_HOST, SYSTEM_USER_ID);
 
             expect(result.user).toBe(SYSTEM);
             expect(result.reason).toBe('system');
         });
 
         it('warns when a configured candidate did not resolve, naming the candidate', () => {
-            const result = resolvePrincipalFrom('nobody@nowhere.example', STOCK_HOST, SYSTEM_USER_ID);
+            const result = ResolvePrincipalFrom('nobody@nowhere.example', STOCK_HOST, SYSTEM_USER_ID);
 
             expect(result.warning).toContain('nobody@nowhere.example');
         });
@@ -239,7 +239,7 @@ describe('resolvePrincipalFrom', () => {
         it('falls back to the System user WITHOUT warning when no candidate is configured', () => {
             // Zod defaults this setting to '', so an unset/blank value must not be reported as a
             // misconfiguration — but it must still land somewhere deterministic.
-            const result = resolvePrincipalFrom('', STOCK_HOST, SYSTEM_USER_ID);
+            const result = ResolvePrincipalFrom('', STOCK_HOST, SYSTEM_USER_ID);
 
             expect(result.user).toBe(SYSTEM);
             expect(result.warning).toBeUndefined();
@@ -256,7 +256,7 @@ describe('resolvePrincipalFrom', () => {
             };
             const users = [laterOwner, HOST_ADMIN, ANONYMOUS];
 
-            const result = resolvePrincipalFrom('nobody@nowhere.example', users, SYSTEM_USER_ID);
+            const result = ResolvePrincipalFrom('nobody@nowhere.example', users, SYSTEM_USER_ID);
 
             expect(result.user).toBe(HOST_ADMIN);
             expect(result.reason).toBe('owner');
@@ -271,7 +271,7 @@ describe('resolvePrincipalFrom', () => {
                 IsActive: false,
             };
 
-            const result = resolvePrincipalFrom('nobody@nowhere.example', [inactiveOwner, HOST_ADMIN], SYSTEM_USER_ID);
+            const result = ResolvePrincipalFrom('nobody@nowhere.example', [inactiveOwner, HOST_ADMIN], SYSTEM_USER_ID);
 
             expect(result.user).toBe(HOST_ADMIN);
         });
@@ -281,7 +281,7 @@ describe('resolvePrincipalFrom', () => {
             // "we never act as a disabled user, except as the one user we reach first".
             const inactiveSystem: ResolvablePrincipal = { ...SYSTEM, IsActive: false };
 
-            const result = resolvePrincipalFrom('nobody@nowhere.example', [inactiveSystem, HOST_ADMIN], SYSTEM_USER_ID);
+            const result = ResolvePrincipalFrom('nobody@nowhere.example', [inactiveSystem, HOST_ADMIN], SYSTEM_USER_ID);
 
             expect(result.user).toBe(HOST_ADMIN);
             expect(result.reason).toBe('owner');
@@ -290,13 +290,13 @@ describe('resolvePrincipalFrom', () => {
         it('returns no principal when the system user is deactivated and no active Owner remains', () => {
             const inactiveSystem: ResolvablePrincipal = { ...SYSTEM, IsActive: false };
 
-            const result = resolvePrincipalFrom('nobody@nowhere.example', [inactiveSystem, ANONYMOUS], SYSTEM_USER_ID);
+            const result = ResolvePrincipalFrom('nobody@nowhere.example', [inactiveSystem, ANONYMOUS], SYSTEM_USER_ID);
 
             expect(result.user).toBeNull();
         });
 
         it('returns no principal at all when the cache is empty', () => {
-            const result = resolvePrincipalFrom(SHIPPED_DEFAULT, [], SYSTEM_USER_ID);
+            const result = ResolvePrincipalFrom(SHIPPED_DEFAULT, [], SYSTEM_USER_ID);
 
             expect(result.user).toBeNull();
             expect(result.reason).toBe('none');

package/src/__tests__/pushStatusResolver.filter.test.ts

@@ -10,7 +10,7 @@
  */
 import 'reflect-metadata';
 import { describe, it, expect } from 'vitest';
-import { statusUpdatesFilter, type PushStatusNotificationPayload, type StatusUpdatesFilterContext } from '../generic/PushStatusResolver';
+import { StatusUpdatesFilter, type PushStatusNotificationPayload, type StatusUpdatesFilterContext } from '../generic/PushStatusResolver';
 import type { UserPayload } from '../types';
 
 const OWNER = 'AA11BB22-0000-4000-8000-000000000001';
@@ -28,29 +28,29 @@ function push(overrides: Partial<PushStatusNotificationPayload> = {}): PushStatu
 
 describe('statusUpdatesFilter (B49 session-hijack gate)', () => {
   it('delivers when sessionId matches AND the connection identity owns the push', () => {
-    expect(statusUpdatesFilter({ payload: push(), args: { sessionId: SESSION }, context: ctxFor(OWNER) })).toBe(true);
+    expect(StatusUpdatesFilter({ payload: push(), args: { sessionId: SESSION }, context: ctxFor(OWNER) })).toBe(true);
   });
 
   it('THE FIX: rejects a matching sessionId when the connection identity is a DIFFERENT user (hijack)', () => {
     // Attacker lifted the victim's sessionId and subscribes with it — but their authenticated
     // connection identity is their own, so delivery must be denied.
-    expect(statusUpdatesFilter({ payload: push({ ownerUserId: OWNER }), args: { sessionId: SESSION }, context: ctxFor(ATTACKER) })).toBe(false);
+    expect(StatusUpdatesFilter({ payload: push({ ownerUserId: OWNER }), args: { sessionId: SESSION }, context: ctxFor(ATTACKER) })).toBe(false);
   });
 
   it('rejects when the requested sessionId does not match the push', () => {
-    expect(statusUpdatesFilter({ payload: push(), args: { sessionId: 'some-other-session' }, context: ctxFor(OWNER) })).toBe(false);
+    expect(StatusUpdatesFilter({ payload: push(), args: { sessionId: 'some-other-session' }, context: ctxFor(OWNER) })).toBe(false);
   });
 
   it('fails closed when the push carries no ownerUserId', () => {
-    expect(statusUpdatesFilter({ payload: push({ ownerUserId: '' }), args: { sessionId: SESSION }, context: ctxFor(OWNER) })).toBe(false);
+    expect(StatusUpdatesFilter({ payload: push({ ownerUserId: '' }), args: { sessionId: SESSION }, context: ctxFor(OWNER) })).toBe(false);
   });
 
   it('fails closed when the connection has no authenticated identity', () => {
-    expect(statusUpdatesFilter({ payload: push(), args: { sessionId: SESSION }, context: ctxFor(undefined) })).toBe(false);
-    expect(statusUpdatesFilter({ payload: push(), args: { sessionId: SESSION }, context: undefined })).toBe(false);
+    expect(StatusUpdatesFilter({ payload: push(), args: { sessionId: SESSION }, context: ctxFor(undefined) })).toBe(false);
+    expect(StatusUpdatesFilter({ payload: push(), args: { sessionId: SESSION }, context: undefined })).toBe(false);
   });
 
   it('matches identity case-insensitively (SQL Server upper vs PostgreSQL lower UUIDs)', () => {
-    expect(statusUpdatesFilter({ payload: push({ ownerUserId: OWNER.toUpperCase() }), args: { sessionId: SESSION }, context: ctxFor(OWNER.toLowerCase()) })).toBe(true);
+    expect(StatusUpdatesFilter({ payload: push({ ownerUserId: OWNER.toUpperCase() }), args: { sessionId: SESSION }, context: ctxFor(OWNER.toLowerCase()) })).toBe(true);
   });
 });

package/src/__tests__/secretRedactor.failOpen.test.ts

@@ -1,6 +1,6 @@
 import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
 import type { IMetadataProvider } from '@memberjunction/core';
-import { redactArg, ResetUnboundCrudInputWarnings } from '../logging/secretRedactor.js';
+import { RedactArg, ResetUnboundCrudInputWarnings } from '../logging/secretRedactor.js';
 
 /**
  * `redactArg` binds a GraphQL input type to an entity by NAME:
@@ -42,7 +42,7 @@ afterEach(() => {
 
 describe('redactArg — entity-bound inputs (the codegen case)', () => {
     it('redacts an encrypted column, keeping the rest', () => {
-        const out = redactArg({
+        const out = RedactArg({
             inputTypeName: 'CreateMJCredentialInput',
             rawValue: { Name: 'Stripe', Values: SECRET },
             provider: CREDENTIAL_ENTITY,
@@ -55,7 +55,7 @@ describe('redactArg — entity-bound inputs (the codegen case)', () => {
     });
 
     it('emits no warning, because the binding resolved', () => {
-        redactArg({
+        RedactArg({
             inputTypeName: 'CreateMJCredentialInput',
             rawValue: { Values: SECRET },
             provider: CREDENTIAL_ENTITY,
@@ -76,14 +76,14 @@ describe('redactArg — name matches the convention but no entity exists', () =>
     };
 
     it('falls open — values are logged, which is the defect being surfaced', () => {
-        const out = redactArg({ ...unbound });
+        const out = RedactArg({ ...unbound });
         // Documents current behaviour: no entity binding and no @NoLog means no
         // redaction source, so the value survives into the log.
         expect(JSON.stringify(out)).toContain(SECRET);
     });
 
     it('now warns, naming the input type and what to do about it', () => {
-        redactArg({ ...unbound });
+        RedactArg({ ...unbound });
 
         expect(console.warn).toHaveBeenCalledTimes(1);
         const message = vi.mocked(console.warn).mock.calls[0][0] as string;
@@ -94,22 +94,22 @@ describe('redactArg — name matches the convention but no entity exists', () =>
     });
 
     it('warns only once per input type, however hot the mutation is', () => {
-        redactArg({ ...unbound });
-        redactArg({ ...unbound });
-        redactArg({ ...unbound });
+        RedactArg({ ...unbound });
+        RedactArg({ ...unbound });
+        RedactArg({ ...unbound });
         expect(console.warn).toHaveBeenCalledTimes(1);
     });
 
     it('warns separately for a different unbound input type', () => {
-        redactArg({ ...unbound });
-        redactArg({ ...unbound, inputTypeName: 'CreateScheduleInput' });
+        RedactArg({ ...unbound });
+        RedactArg({ ...unbound, inputTypeName: 'CreateScheduleInput' });
         expect(console.warn).toHaveBeenCalledTimes(2);
     });
 });
 
 describe('redactArg — @NoLog closes the gap the metadata cannot', () => {
     it('redacts a marked field on an input with no entity binding', () => {
-        const out = redactArg({
+        const out = RedactArg({
             inputTypeName: 'CreateConnectionInput',
             rawValue: { CredentialName: 'acme', CredentialValues: SECRET },
             provider: CREDENTIAL_ENTITY,
@@ -123,7 +123,7 @@ describe('redactArg — @NoLog closes the gap the metadata cannot', () => {
     });
 
     it('a parameter-level mark redacts the whole arg regardless of binding', () => {
-        const out = redactArg({
+        const out = RedactArg({
             inputTypeName: 'CreateConnectionInput',
             rawValue: { CredentialValues: SECRET },
             provider: CREDENTIAL_ENTITY,

package/src/__tests__/secretRedactor.test.ts

@@ -1,6 +1,6 @@
 import { describe, it, expect } from 'vitest';
 import type { IMetadataProvider } from '@memberjunction/core';
-import { redactArg } from '../logging/secretRedactor.js';
+import { RedactArg } from '../logging/secretRedactor.js';
 
 type EncryptedField = { Name: string };
 type FakeEntity = { ClassName: string; EncryptedFields: EncryptedField[] };
@@ -22,7 +22,7 @@ describe('redactArg', () => {
   };
 
   it('returns "<redacted>" when noLogParameter is set, regardless of other inputs', () => {
-    const result = redactArg({
+    const result = RedactArg({
       inputTypeName: 'CreateMJCredentialInput',
       rawValue: { Values: 'FAKE_SECRET_VALUE_DO_NOT_USE' },
       provider: makeProvider([credentialEntity]),
@@ -33,7 +33,7 @@ describe('redactArg', () => {
   });
 
   it('returns "<metadata-not-ready>" when the provider has no entities (bootstrap window)', () => {
-    const result = redactArg({
+    const result = RedactArg({
       inputTypeName: 'CreateMJCredentialInput',
       rawValue: { Values: 'FAKE_SECRET_VALUE_DO_NOT_USE' },
       provider: makeProvider([]),
@@ -44,7 +44,7 @@ describe('redactArg', () => {
   });
 
   it('fails open (passes through) when input type does not match Create/Update<X>Input regex', () => {
-    const result = redactArg({
+    const result = RedactArg({
       inputTypeName: 'SomeCustomArgs',
       rawValue: { accessToken: 'FAKE_TOKEN' },
       provider: makeProvider([credentialEntity]),
@@ -55,7 +55,7 @@ describe('redactArg', () => {
   });
 
   it('fails open when input type matches regex but no entity is found', () => {
-    const result = redactArg({
+    const result = RedactArg({
       inputTypeName: 'CreateUnknownEntityInput',
       rawValue: { Foo: 'bar' },
       provider: makeProvider([credentialEntity]),
@@ -66,7 +66,7 @@ describe('redactArg', () => {
   });
 
   it('redacts top-level keys matching EntityFieldInfo.Encrypt=true on entity-bound CRUD inputs', () => {
-    const result = redactArg({
+    const result = RedactArg({
       inputTypeName: 'CreateMJCredentialInput',
       rawValue: { ID: 'abc-123', Name: 'HubSpot', Values: 'FAKE_SECRET_VALUE_DO_NOT_USE' },
       provider: makeProvider([credentialEntity]),
@@ -81,7 +81,7 @@ describe('redactArg', () => {
   });
 
   it('redacts top-level keys in noLogFields even when EncryptedFields does not include them', () => {
-    const result = redactArg({
+    const result = RedactArg({
       inputTypeName: 'CreateUserInput',
       rawValue: { Name: 'Alice', SecretToken: 'oops' },
       provider: makeProvider([userEntity]),
@@ -95,7 +95,7 @@ describe('redactArg', () => {
   });
 
   it('Update<X>Input is also handled (not just Create<X>Input)', () => {
-    const result = redactArg({
+    const result = RedactArg({
       inputTypeName: 'UpdateMJCredentialInput',
       rawValue: { ID: 'abc-123', Values: 'NEW_FAKE_SECRET' },
       provider: makeProvider([credentialEntity]),
@@ -113,7 +113,7 @@ describe('redactArg', () => {
     // resolvers as metadata-bound instead of flooding with false positives. Security is identical:
     // delete inputs carry PK + Options only — no encrypted field, so nothing is redacted, the keys
     // just pass through. See docs/adr/0001-graphql-variables-logging-tiered-by-verbose.md.
-    const result = redactArg({
+    const result = RedactArg({
       inputTypeName: 'DeleteMJCredentialInput',
       rawValue: { ID: 'abc-123' },
       provider: makeProvider([credentialEntity]),
@@ -125,7 +125,7 @@ describe('redactArg', () => {
 
   it('Delete<X>Input never exposes an encrypted value even if one were somehow present', () => {
     // Defense-in-depth: even if a delete input carried an encrypted field name, it must still mask.
-    const result = redactArg({
+    const result = RedactArg({
       inputTypeName: 'DeleteMJCredentialInput',
       rawValue: { ID: 'abc-123', Values: 'FAKE_SECRET_VALUE_DO_NOT_USE' },
       provider: makeProvider([credentialEntity]),
@@ -136,7 +136,7 @@ describe('redactArg', () => {
   });
 
   it('only walks TOP-level keys — nested objects with encrypted-field names are not recursed', () => {
-    const result = redactArg({
+    const result = RedactArg({
       inputTypeName: 'CreateMJCredentialInput',
       rawValue: {
         Name: 'HubSpot',
@@ -151,7 +151,7 @@ describe('redactArg', () => {
   });
 
   it('passes non-object raw values through to shortenForLog', () => {
-    const result = redactArg({
+    const result = RedactArg({
       inputTypeName: 'CreateMJCredentialInput',
       rawValue: 'plain-string',
       provider: makeProvider([credentialEntity]),

package/src/__tests__/serverExtensionReservedRoots.test.ts

@@ -11,7 +11,7 @@ import { fileURLToPath } from 'node:url';
 import {
     CORE_CONSTANT_RESERVED_SERVER_EXTENSION_ROOTS,
     CORE_STATIC_RESERVED_SERVER_EXTENSION_ROOTS,
-    coreReservedServerExtensionRoots,
+    CoreReservedServerExtensionRoots,
 } from '../serverExtensionReservedRoots.js';
 import { validateServerExtensionRootPath } from '@memberjunction/server-extensions-core';
 
@@ -58,12 +58,12 @@ describe('coreReservedServerExtensionRoots', () => {
 
     it('structurally guarantees every pre-auth app.use / app.get / app.post mount in index.ts is reserved', () => {
         const indexSrc = readFileSync(join(SRC, 'index.ts'), 'utf8');
-        const authMiddlewareIndex = indexSrc.indexOf('app.use(createUnifiedAuthMiddleware');
+        const authMiddlewareIndex = indexSrc.indexOf('app.use(CreateUnifiedAuthMiddleware');
         expect(authMiddlewareIndex).toBeGreaterThan(0);
         const preAuthSrc = indexSrc.substring(0, authMiddlewareIndex);
 
         const mountRegex = /app\.(?:use|get|post)\s*\(\s*([^,\s)]+)/g;
-        const reservedRoots = coreReservedServerExtensionRoots('/');
+        const reservedRoots = CoreReservedServerExtensionRoots('/');
 
         // Explicit allowlist of known non-path middleware mounts (e.g. app.use(mw), app.use(cors()), app.use(compression(...)))
         const knownNonPathTokens = [
@@ -71,7 +71,7 @@ describe('coreReservedServerExtensionRoots', () => {
             'express.',
             'compression',
             'cookieParser',
-            'createUnifiedAuthMiddleware',
+            'CreateUnifiedAuthMiddleware',
             'mw',
         ];
         const isKnownNonPath = (t: string): boolean =>
@@ -120,7 +120,7 @@ describe('coreReservedServerExtensionRoots', () => {
     });
 
     it('includes graphqlRootPath and every core mount', () => {
-        const roots = coreReservedServerExtensionRoots('/api');
+        const roots = CoreReservedServerExtensionRoots('/api');
         expect(roots).toEqual(
             expect.arrayContaining([
                 '/api',
@@ -139,7 +139,7 @@ describe('coreReservedServerExtensionRoots', () => {
     });
 
     it('closes the F-M2 bypasses: cased /auth and sibling /healthcheck', () => {
-        const extra = coreReservedServerExtensionRoots('/');
+        const extra = CoreReservedServerExtensionRoots('/');
         expect(validateServerExtensionRootPath('/Auth', extra)).toMatch(/reserved prefix/);
         expect(validateServerExtensionRootPath('/healthcheck', extra)).toMatch(/reserved prefix/);
         expect(validateServerExtensionRootPath('/Healthcheck', extra)).toMatch(/reserved prefix/);
@@ -156,7 +156,7 @@ describe('coreReservedServerExtensionRoots', () => {
     });
 
     it('reserves a non-default graphqlRootPath and its nested paths', () => {
-        const extra = coreReservedServerExtensionRoots('/api');
+        const extra = CoreReservedServerExtensionRoots('/api');
         expect(validateServerExtensionRootPath('/api', extra)).toMatch(/reserved prefix/);
         expect(validateServerExtensionRootPath('/api/graphql', extra)).toMatch(/reserved prefix/);
         expect(validateServerExtensionRootPath('/apiv2', extra)).toBeNull();

package/src/__tests__/subscriptionRedaction.test.ts

@@ -45,7 +45,7 @@ vi.mock('../config.js', () => ({
   },
 }));
 
-import { variablesLoggingMiddleware } from '../logging/variablesLoggingMiddleware.js';
+import { VariablesLoggingMiddleware } from '../logging/variablesLoggingMiddleware.js';
 
 /**
  * Build a synthetic GraphQLResolveInfo-shaped object that matches what type-graphql passes
@@ -99,7 +99,7 @@ describe('variablesLoggingMiddleware', () => {
 
   it('skips field resolvers (info.path.prev !== undefined) without logging', async () => {
     const next = vi.fn(async () => 'next-result');
-    const result = await variablesLoggingMiddleware(
+    const result = await VariablesLoggingMiddleware(
       {
         root: undefined,
         args: { x: 1 },
@@ -126,7 +126,7 @@ describe('variablesLoggingMiddleware', () => {
       ],
     };
 
-    await variablesLoggingMiddleware(
+    await VariablesLoggingMiddleware(
       {
         root: undefined,
         args: { input: { ID: 'abc', Name: 'HubSpot', Values: 'FAKE_SECRET' } },
@@ -165,7 +165,7 @@ describe('variablesLoggingMiddleware', () => {
       Entities: [{ ClassName: 'SomeUnrelatedEntity', EncryptedFields: [] }],
     };
 
-    await variablesLoggingMiddleware(
+    await VariablesLoggingMiddleware(
       {
         root: undefined,
         args: { token: 'plaintext-leak' },
@@ -196,7 +196,7 @@ describe('variablesLoggingMiddleware', () => {
     const next = vi.fn(async () => undefined);
     const fakeProvider = { Entities: [] };
 
-    await variablesLoggingMiddleware(
+    await VariablesLoggingMiddleware(
       {
         root: undefined,
         args: { input: { Values: 'FAKE_SECRET' } },

package/src/__tests__/unifiedAuth.test.ts

@@ -59,16 +59,22 @@ vi.mock('jsonwebtoken', () => ({
 }));
 
 vi.mock('../auth/index.js', () => ({
-  getSigningKeys: mockGetSigningKeys,
-  getSystemUser: vi.fn(),
-  getValidationOptions: mockGetValidationOptions,
-  verifyUserRecord: mockVerifyUserRecord,
-  extractUserInfoFromPayload: mockExtractUserInfo,
+  GetSigningKeys: mockGetSigningKeys,
+    get getSigningKeys() { return this.GetSigningKeys; },
+  GetSystemUser: vi.fn(),
+    get getSystemUser() { return this.GetSystemUser; },
+  GetValidationOptions: mockGetValidationOptions,
+    get getValidationOptions() { return this.GetValidationOptions; },
+  VerifyUserRecord: mockVerifyUserRecord,
+    get verifyUserRecord() { return this.VerifyUserRecord; },
+  ExtractUserInfoFromPayload: mockExtractUserInfo,
+    get extractUserInfoFromPayload() { return this.ExtractUserInfoFromPayload; },
 }));
 
 vi.mock('../cache.js', () => {
   const map = new Map<string, boolean>();
-  return { authCache: map };
+  return { AuthCache: map,
+    get authCache() { return this.AuthCache; } };
 });
 
 vi.mock('../config.js', () => ({
@@ -95,7 +101,7 @@ vi.mock('@memberjunction/api-keys', () => ({
   GetAPIKeyEngine: vi.fn(),
 }));
 
-import { createUnifiedAuthMiddleware } from '../context.js';
+import { CreateUnifiedAuthMiddleware } from '../context.js';
 import type { Request, Response, NextFunction } from 'express';
 import type { DataSourceInfo } from '../types.js';
 
@@ -178,11 +184,11 @@ function setupSuccessfulAuth() {
 // ─── Tests ──────────────────────────────────────────────────────────────────
 
 describe('createUnifiedAuthMiddleware', () => {
-  let middleware: ReturnType<typeof createUnifiedAuthMiddleware>;
+  let middleware: ReturnType<typeof CreateUnifiedAuthMiddleware>;
 
   beforeEach(() => {
     vi.clearAllMocks();
-    middleware = createUnifiedAuthMiddleware(mockDataSources);
+    middleware = CreateUnifiedAuthMiddleware(mockDataSources);
   });
 
   describe('OPTIONS passthrough', () => {

package/src/__tests__/visitorIdentity.resolve.test.ts

@@ -13,7 +13,7 @@ vi.mock('@memberjunction/core', async (importOriginal) => {
     };
 });
 
-import { resolveIdentityByEmail } from '../realtimeWidget/visitorIdentity.js';
+import { ResolveIdentityByEmail } from '../realtimeWidget/visitorIdentity.js';
 import type { EntityInfo, IMetadataProvider, UserInfo } from '@memberjunction/core';
 
 type LookupParams = { EntityName: string; ExtraFilter: string; Fields: string[] };
@@ -32,7 +32,7 @@ describe('resolveIdentityByEmail — the configured identity entity can have ANY
     it('selects the real key column and returns its bare value for a single non-ID key', async () => {
         runViewMock.mockResolvedValue({ Success: true, Results: [{ individual_id: 4711 }] });
         const provider = makeProvider({ ID: 'ent-persons', PrimaryKeys: [{ Name: 'individual_id' }] });
-        const out = await resolveIdentityByEmail('ada@example.com', user, provider, { entityName: 'Persons', emailField: 'EmailAddress' });
+        const out = await ResolveIdentityByEmail('ada@example.com', user, provider, { entityName: 'Persons', EmailField: 'EmailAddress' });
         expect(lastParams().Fields).toEqual(['individual_id']);
         expect(lastParams().ExtraFilter).toBe("EmailAddress = 'ada@example.com'");
         expect(out).toEqual({ entityId: 'ent-persons', recordId: '4711' });
@@ -41,7 +41,7 @@ describe('resolveIdentityByEmail — the configured identity entity can have ANY
     it('selects EVERY key column and carries a composite key as a full segment, not its first column', async () => {
         runViewMock.mockResolvedValue({ Success: true, Results: [{ OrderID: '11055', LineNo: 3 }] });
         const provider = makeProvider({ ID: 'ent-lines', PrimaryKeys: [{ Name: 'OrderID' }, { Name: 'LineNo' }] });
-        const out = await resolveIdentityByEmail('x@y.com', user, provider, { entityName: 'Order Lines' });
+        const out = await ResolveIdentityByEmail('x@y.com', user, provider, { entityName: 'Order Lines' });
         expect(lastParams().Fields).toEqual(['OrderID', 'LineNo']);
         expect(out).toEqual({ entityId: 'ent-lines', recordId: 'OrderID|11055||LineNo|3' });
     });
@@ -49,13 +49,13 @@ describe('resolveIdentityByEmail — the configured identity entity can have ANY
     it('stays anonymous when no row matches or a key column is null', async () => {
         const provider = makeProvider({ ID: 'ent-users', PrimaryKeys: [{ Name: 'ID' }] });
         runViewMock.mockResolvedValue({ Success: true, Results: [] });
-        expect(await resolveIdentityByEmail('none@y.com', user, provider)).toBeUndefined();
+        expect(await ResolveIdentityByEmail('none@y.com', user, provider)).toBeUndefined();
         runViewMock.mockResolvedValue({ Success: true, Results: [{ ID: null }] });
-        expect(await resolveIdentityByEmail('null@y.com', user, provider)).toBeUndefined();
+        expect(await ResolveIdentityByEmail('null@y.com', user, provider)).toBeUndefined();
     });
 
     it('stays anonymous when the configured entity is not in metadata', async () => {
-        expect(await resolveIdentityByEmail('a@b.com', user, makeProvider(undefined), { entityName: 'Nope' })).toBeUndefined();
+        expect(await ResolveIdentityByEmail('a@b.com', user, makeProvider(undefined), { entityName: 'Nope' })).toBeUndefined();
         expect(runViewMock).not.toHaveBeenCalled();
     });
 });