@memberjunction/server 6.1.4 → 6.2.0-edge.1

package/src/integration/EntityMapLifecycle.ts

@@ -242,7 +242,7 @@ export interface SelectableSourceField {
  * `null`/`undefined` selection means "all fields", which is not the same as an EMPTY selection —
  * an empty array is a real (if unusual) choice, and still yields the keys.
  */
-export function selectFieldsToMap<T extends SelectableSourceField>(
+export function SelectFieldsToMap<T extends SelectableSourceField>(
     allFields: readonly T[],
     selectedFieldNames: readonly string[] | null | undefined,
 ): T[] {
@@ -251,6 +251,14 @@ export function selectFieldsToMap<T extends SelectableSourceField>(
     return allFields.filter(f => selected.has(f.Name.toLowerCase()) || f.IsPrimaryKey === true);
 }
 
+/** @deprecated Use {@link SelectFieldsToMap}. */
+export function selectFieldsToMap<T extends SelectableSourceField>(
+    allFields: readonly T[],
+    selectedFieldNames: readonly string[] | null | undefined,
+): T[] {
+    return SelectFieldsToMap(allFields, selectedFieldNames);
+}
+
 /** One existing field map, reduced to what the reconciliation decision needs. */
 export interface ExistingFieldMapRead {
     SourceFieldName: string | null;
@@ -289,7 +297,7 @@ export interface FieldMapReconcilePlan {
  *    stopped reporting the column, so it returns to the state it had.
  *  - **Vanished column → `Inactive`, never deleted.** Retiring is reversible by the branch above.
  */
-export function decideFieldMapReconcile(
+export function DecideFieldMapReconcile(
     activeFieldNames: readonly string[],
     existing: readonly ExistingFieldMapRead[],
     mapEnabled: boolean,
@@ -320,3 +328,13 @@ export function decideFieldMapReconcile(
     }
     return plan;
 }
+
+/** @deprecated Use {@link DecideFieldMapReconcile}. */
+export function decideFieldMapReconcile(
+    activeFieldNames: readonly string[],
+    existing: readonly ExistingFieldMapRead[],
+    mapEnabled: boolean,
+    autoEnableNewColumns = true,
+): FieldMapReconcilePlan {
+    return DecideFieldMapReconcile(activeFieldNames, existing, mapEnabled, autoEnableNewColumns);
+}

package/src/logging/NoLog.ts

@@ -64,7 +64,7 @@ export function NoLog(target: object, propertyKey?: string | symbol, parameterIn
  * Pass the resolver class itself (e.g. `MyResolver`) — the function reads from the
  * prototype internally to match how type-graphql stores resolver metadata.
  */
-export function hasNoLogParameter(
+export function HasNoLogParameter(
   resolverClass: Function,
   methodName: string,
   parameterIndex: number,
@@ -74,6 +74,15 @@ export function hasNoLogParameter(
   return marks !== undefined && marks.has(parameterIndex);
 }
 
+/** @deprecated Use {@link HasNoLogParameter}. */
+export function hasNoLogParameter(
+  resolverClass: Function,
+  methodName: string,
+  parameterIndex: number,
+): boolean {
+  return HasNoLogParameter(resolverClass, methodName, parameterIndex);
+}
+
 /**
  * Returns the set of field names decorated `@NoLog` on the given input class. Empty set
  * if none were marked.
@@ -81,8 +90,13 @@ export function hasNoLogParameter(
  * Pass the input class itself (e.g. `GetDataInputType`) — the function reads from the
  * prototype internally.
  */
-export function getNoLogFields(inputTypeClass: Function): ReadonlySet<string> {
+export function GetNoLogFields(inputTypeClass: Function): ReadonlySet<string> {
   const target = inputTypeClass.prototype as object;
   const marks = Reflect.getMetadata(NO_LOG_FIELD_KEY, target) as Set<string> | undefined;
   return marks ?? new Set<string>();
 }
+
+/** @deprecated Use {@link GetNoLogFields}. */
+export function getNoLogFields(inputTypeClass: Function): ReadonlySet<string> {
+  return GetNoLogFields(inputTypeClass);
+}

package/src/logging/StartupLogger.ts

@@ -117,7 +117,7 @@ export class StartupLogger {
    * operator knob governs both telemetry and server logging. Defaults to
    * `standard` when unset or unrecognized.
    */
-  public static resolveLevelFromConfig(): ServerLogLevel {
+  public static ResolveLevelFromConfig(): ServerLogLevel {
     const raw = configInfo.telemetry?.level;
     if (raw === 'minimal' || raw === 'standard' || raw === 'verbose' || raw === 'debug') {
       return raw;
@@ -125,6 +125,11 @@ export class StartupLogger {
     return 'standard';
   }
 
+  /** @deprecated Use {@link ResolveLevelFromConfig}. */
+  public static resolveLevelFromConfig(): ServerLogLevel {
+    return this.ResolveLevelFromConfig();
+  }
+
   /**
    * True when the active level is at least `minLevel` (using the ascending
    * `minimal < standard < verbose < debug` ordering).

package/src/logging/bootAudit.ts

@@ -1,6 +1,6 @@
 import { getMetadataStorage } from 'type-graphql';
 import { configInfo } from '../config.js';
-import { hasNoLogParameter } from './NoLog.js';
+import { HasNoLogParameter } from './NoLog.js';
 
 // Delete is included alongside Create/Update so codegen DeleteMJ*Input resolvers count as
 // metadata-bound and don't flood the audit with false positives (their args are PK + Options
@@ -13,12 +13,12 @@ const INPUT_TYPE_REGEX = /^(Create|Update|Delete).+Input$/;
  * Used by the audit walker. Mirrors the subset of `ArgParamMetadata` we need.
  */
 export type AuditArgParam = {
-  kind: 'arg';
-  index: number;
-  name: string;
-  target: Function;
-  methodName: string;
-  getType: () => unknown;
+  kind: 'arg';  // case-violation-ok-legacy-back-compat: the old name is also read off a value typed `any`, where a rename would compile and silently return undefined
+  Index: number;
+  name: string;  // case-violation-ok-legacy-back-compat: the old name is also read off a value typed `any`, where a rename would compile and silently return undefined
+  Target: Function;
+  MethodName: string;
+  GetType: () => unknown;
 };
 
 /**
@@ -26,9 +26,9 @@ export type AuditArgParam = {
  * Includes `@Query`, `@Mutation`, `@Subscription` entries.
  */
 export type AuditResolver = {
-  target: Function;
-  methodName: string;
-  params?: ReadonlyArray<{ kind: string; index: number } & Partial<AuditArgParam>>;
+  Target: Function;
+  MethodName: string;
+  params?: ReadonlyArray<{ kind: string; Index: number } & Partial<AuditArgParam>>;  // case-violation-ok-legacy-back-compat: optional, and the old name is also read off a value the checker cannot type; renaming it stays assignable and silently yields undefined
 };
 
 /**
@@ -42,7 +42,7 @@ export type AuditResolver = {
  *
  * Never throws. Boot does not fail on a missed `@NoLog`.
  */
-export function auditResolversForUndecoratedArgs(): void {
+export function AuditResolversForUndecoratedArgs(): void {
   if (!configInfo.loggingSettings.graphql.logVariables) {
     return;
   }
@@ -52,24 +52,34 @@ export function auditResolversForUndecoratedArgs(): void {
     mutations: AuditResolver[];
     subscriptions: AuditResolver[];
   };
-  auditResolverList([
+  AuditResolverList([
     ...storage.queries,
     ...storage.mutations,
     ...storage.subscriptions,
   ]);
 }
 
+/** @deprecated Use {@link AuditResolversForUndecoratedArgs}. */
+export function auditResolversForUndecoratedArgs(): void {
+  return AuditResolversForUndecoratedArgs();
+}
+
 /**
  * Internal helper exported for test injection. Takes a list of resolver metadata directly,
  * skipping the global `getMetadataStorage()` lookup. The boot-time scan uses this after
  * pulling from the global storage; tests pass in a synthetic fixture.
  */
-export function auditResolverList(resolvers: ReadonlyArray<AuditResolver>): void {
+export function AuditResolverList(resolvers: ReadonlyArray<AuditResolver>): void {
   for (const resolver of resolvers) {
     auditResolver(resolver);
   }
 }
 
+/** @deprecated Use {@link AuditResolverList}. */
+export function auditResolverList(resolvers: ReadonlyArray<AuditResolver>): void {
+  return AuditResolverList(resolvers);
+}
+
 function auditResolver(resolver: AuditResolver): void {
   for (const param of resolver.params ?? []) {
     if (param.kind !== 'arg') {
@@ -84,10 +94,10 @@ function auditArg(resolver: AuditResolver, argParam: AuditArgParam): void {
   if (typeName && INPUT_TYPE_REGEX.test(typeName)) {
     return;
   }
-  if (hasNoLogParameter(resolver.target, resolver.methodName, argParam.index)) {
+  if (HasNoLogParameter(resolver.Target, resolver.MethodName, argParam.Index)) {
     return;
   }
-  const resolverName = `${resolver.target.name}.${resolver.methodName}`;
+  const resolverName = `${resolver.Target.name}.${resolver.MethodName}`;
   console.warn(
     `[mj:NoLog audit] Custom resolver ${resolverName} takes argument '${argParam.name}' ` +
     `(type ${typeName ?? 'unknown'}) which is not marked @NoLog. Verify this argument does ` +
@@ -103,7 +113,7 @@ function auditArg(resolver: AuditResolver, argParam: AuditArgParam): void {
  */
 function readArgTypeName(argParam: AuditArgParam): string | undefined {
   try {
-    const type = argParam.getType();
+    const type = argParam.GetType();
     if (typeof type === 'function') {
       return (type as { name?: string }).name;
     }

package/src/logging/boundaryLogPayload.ts

@@ -12,8 +12,15 @@
  *
  * See docs/adr/0001-graphql-variables-logging-tiered-by-verbose.md.
  */
-export function buildBoundaryLogPayload(
+export function BuildBoundaryLogPayload(
   operationName: string | undefined,
 ): { operationName: string | undefined } {
   return { operationName };
 }
+
+/** @deprecated Use {@link BuildBoundaryLogPayload}. */
+export function buildBoundaryLogPayload(
+  operationName: string | undefined,
+): { operationName: string | undefined } {
+  return BuildBoundaryLogPayload(operationName);
+}

package/src/logging/secretRedactor.ts

@@ -1,5 +1,5 @@
 import type { IMetadataProvider } from '@memberjunction/core';
-import { shortenForLog } from './shortenForLog.js';
+import { ShortenForLog } from './shortenForLog.js';
 
 /**
  * Input to the redactor. Built per `@Arg` per resolver call by the variables-logging middleware.
@@ -15,11 +15,11 @@ import { shortenForLog } from './shortenForLog.js';
  *   this set (decorator-driven) when walking top-level keys.
  */
 export type RedactionContext = {
-  inputTypeName: string;
-  rawValue: unknown;
-  provider: IMetadataProvider;
-  noLogParameter: boolean;
-  noLogFields: ReadonlySet<string>;
+  inputTypeName: string;  // case-violation-ok-legacy-back-compat: renaming it broke a use the checker could not see from the declaration — the compile proved it
+  rawValue: unknown;  // case-violation-ok-legacy-back-compat: renaming it broke a use the checker could not see from the declaration — the compile proved it
+  provider: IMetadataProvider;  // case-violation-ok-legacy-back-compat: the old name is also read off a value typed `any`, where a rename would compile and silently return undefined
+  noLogParameter: boolean;  // case-violation-ok-legacy-back-compat: renaming it broke a use the checker could not see from the declaration — the compile proved it
+  noLogFields: ReadonlySet<string>;  // case-violation-ok-legacy-back-compat: renaming it broke a use the checker could not see from the declaration — the compile proved it
 };
 
 // Delete is included so DeleteMJ*Input resolvers resolve to their entity (yielding an empty
@@ -33,7 +33,7 @@ const INPUT_TYPE_REGEX = /^(Create|Update|Delete)(?<name>.+)Input$/;
 // type-graphql allows @Field({ name: 'overrideName' }) to rename fields at the
 // GraphQL layer; MJ codegen does not use this. A future maintainer renaming an
 // encrypted field at the GraphQL layer would silently miss redaction.
-export function redactArg(ctx: RedactionContext): unknown {
+export function RedactArg(ctx: RedactionContext): unknown {
   if (ctx.noLogParameter) {
     return '<redacted>';
   }
@@ -79,7 +79,7 @@ export function redactArg(ctx: RedactionContext): unknown {
     !Array.isArray(ctx.rawValue);
 
   if (!canWalk) {
-    return shortenForLog(ctx.rawValue);
+    return ShortenForLog(ctx.rawValue);
   }
 
   const result: Record<string, unknown> = {};
@@ -87,12 +87,17 @@ export function redactArg(ctx: RedactionContext): unknown {
     if (encryptedFieldNames.has(key) || ctx.noLogFields.has(key)) {
       result[key] = '<redacted>';
     } else {
-      result[key] = shortenForLog(value);
+      result[key] = ShortenForLog(value);
     }
   }
   return result;
 }
 
+/** @deprecated Use {@link RedactArg}. */
+export function redactArg(ctx: RedactionContext): unknown {
+  return RedactArg(ctx);
+}
+
 const EMPTY_SET: ReadonlySet<string> = new Set<string>();
 
 /**

package/src/logging/shortenForLog.ts

@@ -4,14 +4,19 @@
  * Objects whose JSON exceeds `maxLen` and contain nested structure are recursed into so
  * outer keys remain visible.
  */
-export function shortenForLog(value: unknown, maxLen = 300): unknown {
+export function ShortenForLog(value: unknown, maxLen = 300): unknown {
   if (value === null || typeof value !== 'object') return value;
-  if (Array.isArray(value)) return value.map((v) => shortenForLog(v, maxLen));
+  if (Array.isArray(value)) return value.map((v) => ShortenForLog(v, maxLen));
   const json = JSON.stringify(value);
   if (json.length <= maxLen) return json;
   const result: Record<string, unknown> = {};
   for (const [k, v] of Object.entries(value as Record<string, unknown>)) {
-    result[k] = shortenForLog(v, maxLen);
+    result[k] = ShortenForLog(v, maxLen);
   }
   return result;
 }
+
+/** @deprecated Use {@link ShortenForLog}. */
+export function shortenForLog(value: unknown, maxLen = 300): unknown {
+  return ShortenForLog(value, maxLen);
+}

package/src/logging/variablesLoggingMiddleware.ts

@@ -4,8 +4,8 @@ import { getNamedType } from 'graphql';
 import type { GraphQLArgument } from 'graphql';
 import { configInfo } from '../config.js';
 import type { AppContext } from '../types.js';
-import { redactArg } from './secretRedactor.js';
-import { hasNoLogParameter, getNoLogFields } from './NoLog.js';
+import { RedactArg } from './secretRedactor.js';
+import { HasNoLogParameter, GetNoLogFields } from './NoLog.js';
 import { StartupLogger } from './StartupLogger.js';
 
 /**
@@ -112,7 +112,7 @@ const warnedResolverSignatures = new Set<string>();
  * differ from the always-on log line (`operationName` vs `operation`, `variables` vs `args`)
  * — operators with log-grep automation should update their patterns.
  */
-export const variablesLoggingMiddleware: MiddlewareFn<AppContext> = async (action, next) => {
+export const VariablesLoggingMiddleware: MiddlewareFn<AppContext> = async (action, next) => {
   // Field resolvers (info.path.prev !== undefined) are skipped — only root @Query/@Mutation/@Subscription.
   if (action.info.path.prev !== undefined) {
     return next();
@@ -144,13 +144,13 @@ export const variablesLoggingMiddleware: MiddlewareFn<AppContext> = async (actio
 
     const paramMeta = argParams.find((p) => p.name === argDef.name);
     const noLogParameter = paramMeta && resolverEntry
-      ? hasNoLogParameter(resolverEntry.target, resolverEntry.methodName, paramMeta.index)
+      ? HasNoLogParameter(resolverEntry.target, resolverEntry.methodName, paramMeta.index)
       : false;
 
     const inputClass = findInputClass(inputTypeName);
-    const noLogFields = inputClass ? getNoLogFields(inputClass) : new Set<string>();
+    const noLogFields = inputClass ? GetNoLogFields(inputClass) : new Set<string>();
 
-    redactedArgs[argDef.name] = redactArg({
+    redactedArgs[argDef.name] = RedactArg({
       inputTypeName,
       rawValue,
       provider,
@@ -188,6 +188,9 @@ export const variablesLoggingMiddleware: MiddlewareFn<AppContext> = async (actio
   return next();
 };
 
+/** @deprecated Use {@link VariablesLoggingMiddleware}. */
+export const variablesLoggingMiddleware: MiddlewareFn<AppContext> = VariablesLoggingMiddleware;
+
 /**
  * Heuristic: an arg is "custom" (i.e. needs `@NoLog` discipline because metadata can't redact it)
  * when its GraphQL input type is not a known `Create<X>Input` / `Update<X>Input` for an entity

package/src/metadataRefreshSignal.ts

@@ -0,0 +1,45 @@
+import { LogError, LogStatus } from '@memberjunction/core';
+
+/**
+ * Operator control: `kill -HUP <pid>` (or `docker kill -s HUP`, `pm2 sendSignal SIGHUP`) makes a
+ * running MJAPI hard-reload its metadata from the database, without a restart and without a
+ * user-facing endpoint. SIGHUP is the conventional "reload" signal; SIGUSR1 is reserved by Node
+ * for the inspector.
+ *
+ * Only the global provider needs refreshing: per-request providers adopt the global provider's
+ * metadata on every request (ProviderBase.CopyMetadataFromGlobalProvider).
+ */
+export const METADATA_REFRESH_SIGNAL = 'SIGHUP';
+
+/**
+ * Builds the signal handler. A signal that arrives while a refresh is still running is ignored
+ * (and logged) rather than stacked, so a burst of signals cannot queue a burst of full reloads.
+ * The handler never rejects — a failed refresh is logged.
+ *
+ * @param refresh - performs the hard reload, e.g. `() => Metadata.Provider.Refresh()`
+ */
+export function CreateMetadataRefreshSignalHandler(refresh: () => Promise<boolean>): () => Promise<void> {
+    let inFlight = false;
+
+    return async () => {
+        if (inFlight) {
+            LogStatus(`🔄 ${METADATA_REFRESH_SIGNAL} received while a metadata refresh is already running; ignored. Send it again once the current refresh finishes.`);
+            return;
+        }
+
+        inFlight = true;
+        LogStatus(`🔄 ${METADATA_REFRESH_SIGNAL} received, refreshing metadata from the database`);
+        try {
+            const ok = await refresh();
+            if (ok) {
+                LogStatus('✅ Metadata refreshed');
+            } else {
+                LogError(`❌ ${METADATA_REFRESH_SIGNAL} metadata refresh reported failure`);
+            }
+        } catch (err) {
+            LogError(`❌ ${METADATA_REFRESH_SIGNAL} metadata refresh failed`, undefined, err);
+        } finally {
+            inFlight = false;
+        }
+    };
+}

package/src/middleware/MJTenantFilterMiddleware.ts

@@ -10,7 +10,7 @@
 import { RegisterClass } from '@memberjunction/global';
 import { BaseServerMiddleware } from './BaseServerMiddleware.js';
 import { configInfo } from '../config.js';
-import { createTenantMiddleware, createTenantPreRunViewHook, createTenantPreSaveHook } from '../multiTenancy/index.js';
+import { CreateTenantMiddleware, CreateTenantPreRunViewHook, CreateTenantPreSaveHook } from '../multiTenancy/index.js';
 import type { RequestHandler } from 'express';
 import type { RunViewParams, UserInfo, BaseEntity } from '@memberjunction/core';
 
@@ -26,14 +26,14 @@ export class MJTenantFilterMiddleware extends BaseServerMiddleware {
     }
 
     GetPostAuthMiddleware(): RequestHandler[] {
-        return [createTenantMiddleware(configInfo.multiTenancy!)];
+        return [CreateTenantMiddleware(configInfo.multiTenancy!)];
     }
 
     PreRunView(params: RunViewParams, contextUser: UserInfo | undefined): RunViewParams | Promise<RunViewParams> {
-        return createTenantPreRunViewHook(configInfo.multiTenancy!)(params, contextUser);
+        return CreateTenantPreRunViewHook(configInfo.multiTenancy!)(params, contextUser);
     }
 
     PreSave(entity: BaseEntity, contextUser: UserInfo | undefined): boolean | string | Promise<boolean | string> {
-        return createTenantPreSaveHook(configInfo.multiTenancy!)(entity, contextUser);
+        return CreateTenantPreSaveHook(configInfo.multiTenancy!)(entity, contextUser);
     }
 }

package/src/multiTenancy/index.ts

@@ -48,7 +48,7 @@ export type TenantContextExtractor = (
  * By the time GraphQL resolvers or REST handlers run, the contextUser already
  * has TenantContext set — no deferred pickup via `req['__mj_tenantId']` needed.
  */
-export function createTenantMiddleware(config: MultiTenancyConfig): RequestHandler {
+export function CreateTenantMiddleware(config: MultiTenancyConfig): RequestHandler {
   return (req, res, next) => {
     const userPayload = (req as { userPayload?: UserPayload }).userPayload;
     if (!userPayload?.userRecord) {
@@ -79,7 +79,7 @@ export function createTenantMiddleware(config: MultiTenancyConfig): RequestHandl
         // instance, and stamping it in place races concurrent requests for the
         // same user (one request's tenant becomes another's, same-instant).
         const sessionUser = CloneUserForSessionContext(userPayload.userRecord as UserInfo);
-        attachTenantContext(sessionUser, tenantId, 'header');
+        AttachTenantContext(sessionUser, tenantId, 'header');
         userPayload.userRecord = sessionUser;
       }
     }
@@ -87,6 +87,11 @@ export function createTenantMiddleware(config: MultiTenancyConfig): RequestHandl
   };
 }
 
+/** @deprecated Use {@link CreateTenantMiddleware}. */
+export function createTenantMiddleware(config: MultiTenancyConfig): RequestHandler {
+  return CreateTenantMiddleware(config);
+}
+
 /**
  * Attaches TenantContext to a UserInfo object.
  * Called from the GraphQL context function after authentication.
@@ -98,7 +103,7 @@ export function createTenantMiddleware(config: MultiTenancyConfig): RequestHandl
  * so a future caller from a different source ('linkedEntity', 'custom') cannot
  * reintroduce the injection path.
  */
-export function attachTenantContext(
+export function AttachTenantContext(
   user: UserInfo,
   tenantId: string,
   source: TenantContext['Source']
@@ -109,6 +114,15 @@ export function attachTenantContext(
   user.TenantContext = { TenantID: tenantId, Source: source };
 }
 
+/** @deprecated Use {@link AttachTenantContext}. */
+export function attachTenantContext(
+  user: UserInfo,
+  tenantId: string,
+  source: TenantContext['Source']
+): void {
+  return AttachTenantContext(user, tenantId, source);
+}
+
 /**
  * Determines whether a given entity name should have tenant filtering applied.
  */
@@ -151,7 +165,7 @@ function isAdminUser(user: UserInfo, adminRoles: string[]): boolean {
  * Creates a PreRunViewHook that auto-injects tenant WHERE clauses
  * into RunView queries for scoped entities.
  */
-export function createTenantPreRunViewHook(config: MultiTenancyConfig): PreRunViewHook {
+export function CreateTenantPreRunViewHook(config: MultiTenancyConfig): PreRunViewHook {
   return (params, contextUser) => {
     // No tenant context → no filtering
     if (!contextUser?.TenantContext) return params;
@@ -201,6 +215,11 @@ export function createTenantPreRunViewHook(config: MultiTenancyConfig): PreRunVi
   };
 }
 
+/** @deprecated Use {@link CreateTenantPreRunViewHook}. */
+export function createTenantPreRunViewHook(config: MultiTenancyConfig): PreRunViewHook {
+  return CreateTenantPreRunViewHook(config);
+}
+
 /**
  * Quotes an identifier for use in a tenant predicate via the active provider's
  * QuoteIdentifier (DatabaseProviderBase always exposes one server-side, yielding [x]
@@ -227,7 +246,7 @@ export function QuoteFilterIdentifier(name: string): string {
  * match the user's TenantContext. In 'log' mode, warns but allows. In
  * 'off' mode, this hook is a no-op.
  */
-export function createTenantPreSaveHook(config: MultiTenancyConfig): PreSaveHook {
+export function CreateTenantPreSaveHook(config: MultiTenancyConfig): PreSaveHook {
   return (entity, contextUser) => {
     // No validation needed if write protection is off
     if (config.writeProtection === 'off') return true;
@@ -268,3 +287,8 @@ export function createTenantPreSaveHook(config: MultiTenancyConfig): PreSaveHook
     return true;
   };
 }
+
+/** @deprecated Use {@link CreateTenantPreSaveHook}. */
+export function createTenantPreSaveHook(config: MultiTenancyConfig): PreSaveHook {
+  return CreateTenantPreSaveHook(config);
+}

package/src/realtimeWidget/WidgetRouter.ts

@@ -15,9 +15,9 @@ import { rateLimit, ipKeyGenerator } from 'express-rate-limit';
 import { LogStatus } from '@memberjunction/core';
 import { configInfo, type WidgetConfig } from '../config.js';
 import { MagicLinkKeyManager } from '../auth/magicLink/MagicLinkKeys.js';
-import { registerMagicLinkAuthProvider } from '../auth/magicLink/MagicLinkRouter.js';
+import { RegisterMagicLinkAuthProvider } from '../auth/magicLink/MagicLinkRouter.js';
 import { WidgetSessionService, type MintGuestSessionResult } from './WidgetSessionService.js';
-import { looksLikeBot } from './widgetCore.js';
+import { LooksLikeBot } from './widgetCore.js';
 
 /** The mount path for the widget public router (`/widget`). */
 export const WIDGET_MOUNT_PATH = '/widget';
@@ -41,7 +41,7 @@ function ensureWidgetSigning(publicUrl: string, widgetConfig: WidgetConfig): voi
   // Register the magic-link provider against the magic-link config (its audience),
   // which is what validates widget tokens. No-op if already registered.
   if (mlConfig) {
-    registerMagicLinkAuthProvider(publicUrl, mlConfig);
+    RegisterMagicLinkAuthProvider(publicUrl, mlConfig);
   }
 }
 
@@ -51,7 +51,7 @@ function ensureWidgetSigning(publicUrl: string, widgetConfig: WidgetConfig): voi
  * `authenticatedRouter` at the same path AFTER it (the RV4 resolve-identity endpoint needs the
  * verified principal from `req.userPayload`).
  */
-export function createWidgetHandler(publicUrl: string, config: WidgetConfig): { publicRouter: Router; authenticatedRouter: Router } {
+export function CreateWidgetHandler(publicUrl: string, config: WidgetConfig): { publicRouter: Router; authenticatedRouter: Router } {
   ensureWidgetSigning(publicUrl, config);
 
   const service = new WidgetSessionService(publicUrl, config);
@@ -106,6 +106,11 @@ export function createWidgetHandler(publicUrl: string, config: WidgetConfig): {
   return { publicRouter, authenticatedRouter };
 }
 
+/** @deprecated Use {@link CreateWidgetHandler}. */
+export function createWidgetHandler(publicUrl: string, config: WidgetConfig): { publicRouter: Router; authenticatedRouter: Router } {
+  return CreateWidgetHandler(publicUrl, config);
+}
+
 /** Reads the `widgetKey` from a parsed JSON body, or '' when absent (used to key the dynamic limiter). */
 function readWidgetKey(req: Request): string {
   const body = (req.body ?? {}) as { widgetKey?: string };
@@ -121,7 +126,7 @@ async function handleForget(service: WidgetSessionService, req: Request, res: Re
     res.status(400).json({ success: false, errorCode: 'not_found', error: 'widgetKey is required.' });
     return;
   }
-  const result = await service.ForgetVisitor({ widgetKey, visitorKey, origin: req.get('origin') ?? undefined });
+  const result = await service.ForgetVisitor({ WidgetKey: widgetKey, VisitorKey: visitorKey, origin: req.get('origin') ?? undefined });
   res.status(result.success ? 200 : result.errorCode === 'server_error' ? 500 : 403).json(result);
 }
 
@@ -143,9 +148,9 @@ async function handleResolveIdentity(service: WidgetSessionService, req: Request
     return;
   }
   const result = await service.ResolveVisitorIdentity({
-    widgetKey,
-    visitorKey,
-    verifiedEmail: verifiedUser.Email,
+    WidgetKey: widgetKey,
+    VisitorKey: visitorKey,
+    VerifiedEmail: verifiedUser.Email,
     origin: req.get('origin') ?? undefined,
   });
   res.status(result.success ? 200 : result.errorCode === 'server_error' ? 500 : 403).json(result);
@@ -160,7 +165,7 @@ async function handleUpgrade(service: WidgetSessionService, req: Request, res: R
     res.status(400).json({ success: false, errorCode: 'not_found', error: 'widgetKey is required.' });
     return;
   }
-  const result = await service.RequestUpgrade({ widgetKey, email, origin: req.get('origin') ?? undefined });
+  const result = await service.RequestUpgrade({ WidgetKey: widgetKey, email, origin: req.get('origin') ?? undefined });
   // 400 for a bad email (client can fix it); 403 for any policy rejection (uniform, non-enumerable); 500 for faults.
   const status = result.success ? 200 : result.errorCode === 'invalid_email' ? 400 : result.errorCode === 'server_error' ? 500 : 403;
   res.status(status).json(result);
@@ -177,7 +182,7 @@ async function handleMint(service: WidgetSessionService, req: Request, res: Resp
 
   // W6 hardening: coarse bot/automation rejection before any DB lookup or token mint. Returns the same
   // 403 as a policy rejection so a probe can't distinguish "bot-blocked" from "bad key/origin".
-  if (looksLikeBot(req.get('user-agent'))) {
+  if (LooksLikeBot(req.get('user-agent'))) {
     res.status(403).json({ success: false, errorCode: 'origin_not_allowed', error: 'Widget mint rejected.' });
     return;
   }