@memberjunction/server 6.1.4 → 6.2.0-edge.1

package/src/realtimeWidget/widgetCore.ts

@@ -12,7 +12,7 @@
  * @module @memberjunction/server/widget
  */
 
-import { buildSessionClaims } from '../auth/magicLink/magicLinkCore.js';
+import { BuildSessionClaims } from '../auth/magicLink/magicLinkCore.js';
 import type { MagicLinkJWTClaims } from '../auth/magicLink/types.js';
 
 /**
@@ -46,7 +46,7 @@ export interface WidgetInstanceEligibilityInput {
  * comma-separated string (tolerated). Returns an empty array for null/blank/garbage
  * — which makes the allowlist FAIL-CLOSED (no origin is allowed) by construction.
  */
-export function parseAllowedOrigins(allowedOrigins: string | null | undefined): string[] {
+export function ParseAllowedOrigins(allowedOrigins: string | null | undefined): string[] {
   const raw = allowedOrigins?.trim();
   if (!raw) {
     return [];
@@ -64,6 +64,11 @@ export function parseAllowedOrigins(allowedOrigins: string | null | undefined):
   return list.filter((s): s is string => typeof s === 'string').map(normalizeOrigin).filter((s): s is string => !!s);
 }
 
+/** @deprecated Use {@link ParseAllowedOrigins}. */
+export function parseAllowedOrigins(allowedOrigins: string | null | undefined): string[] {
+  return ParseAllowedOrigins(allowedOrigins);
+}
+
 /** Lowercases + trims an origin and strips a trailing slash for stable comparison. */
 function normalizeOrigin(origin: string): string {
   return origin.trim().toLowerCase().replace(/\/+$/, '');
@@ -74,7 +79,7 @@ function normalizeOrigin(origin: string): string {
  * JSON array (preferred, e.g. `["Whiteboard"]`) or a comma-separated string (tolerated). Returns an
  * empty array for null/blank/garbage — the backwards-compatible default (no channels attached).
  */
-export function parseEnabledChannels(enabledChannels: string | null | undefined): string[] {
+export function ParseEnabledChannels(enabledChannels: string | null | undefined): string[] {
   const raw = enabledChannels?.trim();
   if (!raw) {
     return [];
@@ -89,12 +94,17 @@ export function parseEnabledChannels(enabledChannels: string | null | undefined)
   }
 }
 
+/** @deprecated Use {@link ParseEnabledChannels}. */
+export function parseEnabledChannels(enabledChannels: string | null | undefined): string[] {
+  return ParseEnabledChannels(enabledChannels);
+}
+
 /**
  * FAIL-CLOSED origin check. The request's `Origin` header must exactly match one of
  * the widget's allowed origins (after normalization). A missing request origin, or
  * an empty allowlist, is rejected — a public mint endpoint must never accept "*".
  */
-export function isOriginAllowed(requestOrigin: string | null | undefined, allowedOrigins: readonly string[]): boolean {
+export function IsOriginAllowed(requestOrigin: string | null | undefined, allowedOrigins: readonly string[]): boolean {
   if (!requestOrigin || allowedOrigins.length === 0) {
     return false;
   }
@@ -102,8 +112,13 @@ export function isOriginAllowed(requestOrigin: string | null | undefined, allowe
   return allowedOrigins.some((o) => o === candidate);
 }
 
+/** @deprecated Use {@link IsOriginAllowed}. */
+export function isOriginAllowed(requestOrigin: string | null | undefined, allowedOrigins: readonly string[]): boolean {
+  return IsOriginAllowed(requestOrigin, allowedOrigins);
+}
+
 /** True when the requested modality (or the widget's default render) is enabled by the instance. */
-export function isModalityEnabled(widgetModality: string, requested: 'Text' | 'Voice'): boolean {
+export function IsModalityEnabled(widgetModality: string, requested: 'Text' | 'Voice'): boolean {
   const m = widgetModality.trim().toLowerCase();
   if (m === 'both') {
     return true;
@@ -111,25 +126,38 @@ export function isModalityEnabled(widgetModality: string, requested: 'Text' | 'V
   return m === requested.toLowerCase();
 }
 
+/** @deprecated Use {@link IsModalityEnabled}. */
+export function isModalityEnabled(widgetModality: string, requested: 'Text' | 'Voice'): boolean {
+  return IsModalityEnabled(widgetModality, requested);
+}
+
 /**
  * Pure eligibility check for a mint: the widget must be Active and the request's
  * origin must be on the allowlist. Returns an error code on the first failure so the
  * router can map it to a precise HTTP status. Modality is checked separately by the
  * voice path (W4) since a text mint is always permitted for an enabled widget.
  */
-export function evaluateWidgetMint(
+export function EvaluateWidgetMint(
   widget: WidgetInstanceEligibilityInput,
   requestOrigin: string | null | undefined,
 ): { ok: boolean; errorCode?: WidgetMintErrorCode } {
   if (widget.Status.trim().toLowerCase() !== 'active') {
     return { ok: false, errorCode: 'disabled' };
   }
-  if (!isOriginAllowed(requestOrigin, parseAllowedOrigins(widget.AllowedOrigins))) {
+  if (!IsOriginAllowed(requestOrigin, ParseAllowedOrigins(widget.AllowedOrigins))) {
     return { ok: false, errorCode: 'origin_not_allowed' };
   }
   return { ok: true };
 }
 
+/** @deprecated Use {@link EvaluateWidgetMint}. */
+export function evaluateWidgetMint(
+  widget: WidgetInstanceEligibilityInput,
+  requestOrigin: string | null | undefined,
+): { ok: boolean; errorCode?: WidgetMintErrorCode } {
+  return EvaluateWidgetMint(widget, requestOrigin);
+}
+
 /**
  * Known automated-client User-Agent substrings (lowercased). A public mint endpoint is a cheap
  * target for crawlers and scripted abuse; this catches the obvious non-browser callers. It is a
@@ -148,7 +176,7 @@ const BOT_USER_AGENT_MARKERS = [
  * known automation marker. Deliberately conservative to avoid false positives on real browsers; pair
  * with the origin allowlist + rate limits, which are the hard controls.
  */
-export function looksLikeBot(userAgent: string | null | undefined): boolean {
+export function LooksLikeBot(userAgent: string | null | undefined): boolean {
   const ua = (userAgent ?? '').trim().toLowerCase();
   if (!ua) {
     return true;
@@ -156,6 +184,11 @@ export function looksLikeBot(userAgent: string | null | undefined): boolean {
   return BOT_USER_AGENT_MARKERS.some((marker) => ua.includes(marker));
 }
 
+/** @deprecated Use {@link LooksLikeBot}. */
+export function looksLikeBot(userAgent: string | null | undefined): boolean {
+  return LooksLikeBot(userAgent);
+}
+
 /**
  * Builds the guest-session JWT claims for a widget visitor. Reuses magic-link's
  * `buildSessionClaims` (anonymous mode → the shared Anonymous principal + claims-based
@@ -163,7 +196,7 @@ export function looksLikeBot(userAgent: string | null | undefined): boolean {
  * principal is locked to one widget instance. The role name carried here is the
  * widget's restricted guest role (D5 backstop).
  */
-export function buildWidgetGuestClaims(args: {
+export function BuildWidgetGuestClaims(args: {
   issuer: string;
   audience: string;
   widgetId: string;
@@ -191,7 +224,7 @@ export function buildWidgetGuestClaims(args: {
     linkedRecordId?: string;
   };
 }): MagicLinkJWTClaims {
-  const claims = buildSessionClaims({
+  const claims = BuildSessionClaims({
     issuer: args.issuer,
     audience: args.audience,
     // No invite row for a direct-mint guest; the opaque session id stands in as the
@@ -229,3 +262,35 @@ export function buildWidgetGuestClaims(args: {
   }
   return claims;
 }
+
+/** @deprecated Use {@link BuildWidgetGuestClaims}. */
+export function buildWidgetGuestClaims(args: {
+  issuer: string;
+  audience: string;
+  widgetId: string;
+  sessionId: string;
+  anonymousEmail: string;
+  applicationId: string;
+  guestRoleName: string;
+  nowSeconds: number;
+  ttlSeconds: number;
+  /**
+   * Host-asserted identity for a `host-identity` session. Its email/name are carried as
+   * INFORMATIONAL claims only — the principal-resolving `email`/`sub` remain the shared
+   * Anonymous principal, so a host can never escalate a guest into a real account.
+   */
+  hostIdentity?: { email: string; firstName?: string; lastName?: string };
+  /**
+   * Returning-visitor anchor + linked identity (RV1/RV2/RV4) carried as claims so the VOICE path
+   * (server-created conversation) stamps the same fields the text path stamps client-side. Set only
+   * when the widget remembers returning visitors. Omitted ⇒ no returning-visitor claims (default off).
+   */
+  returningVisitor?: {
+    visitorKey?: string;
+    lastConversationId?: string;
+    linkedEntityId?: string;
+    linkedRecordId?: string;
+  };
+}): MagicLinkJWTClaims {
+  return BuildWidgetGuestClaims(args);
+}

package/src/realtimeWidget/widgetGuestElevation.ts

@@ -22,19 +22,19 @@ const WIDGET_ENTITY = 'MJ: Conversation Widget Instances';
 
 /**
  * Resolved elevation context for a widget-guest agent run. Returned only when the request is a
- * widget guest; the dispatch resolver runs the agent under {@link WidgetGuestRunContext.elevatedUser}
- * with {@link WidgetGuestRunContext.pinnedAgentId} (authoritative), keeping ownership checks under
+ * widget guest; the dispatch resolver runs the agent under {@link WidgetGuestRunContext.ElevatedUser}
+ * with {@link WidgetGuestRunContext.PinnedAgentId} (authoritative), keeping ownership checks under
  * the guest principal.
  */
 export interface WidgetGuestRunContext {
   /** The trusted server principal under which the agent run (and its run-entity writes) executes. */
-  elevatedUser: UserInfo;
+  ElevatedUser: UserInfo;
   /** The widget instance the guest session is bound to (authoritative config). */
-  widget: MJConversationWidgetInstanceEntity;
+  Widget: MJConversationWidgetInstanceEntity;
   /** The authoritative pinned support agent id — overrides any client-supplied agent id (D5). */
-  pinnedAgentId: string;
+  PinnedAgentId: string;
   /** The guest's per-session scope id (Conversation.ExternalID), used to validate conversation ownership. */
-  sessionScopeId?: string;
+  SessionScopeId?: string;
 }
 
 /**
@@ -47,7 +47,7 @@ export interface WidgetGuestRunContext {
  * Never throws: a resolution failure (no system user, widget not found, read error) returns `null`,
  * so the caller falls back to the normal (guest-principal) path rather than failing the request.
  */
-export async function resolveWidgetGuestRunContext(
+export async function ResolveWidgetGuestRunContext(
   userPayload: UserPayload,
   provider: DatabaseProviderBase,
 ): Promise<WidgetGuestRunContext | null> {
@@ -70,13 +70,21 @@ export async function resolveWidgetGuestRunContext(
   }
 
   return {
-    elevatedUser,
-    widget,
-    pinnedAgentId: widget.PinnedAgentID,
-    sessionScopeId: guest.MagicLinkScope?.ResourceID,
+    ElevatedUser: elevatedUser,
+    Widget: widget,
+    PinnedAgentId: widget.PinnedAgentID,
+    SessionScopeId: guest.MagicLinkScope?.ResourceID,
   };
 }
 
+/** @deprecated Use {@link ResolveWidgetGuestRunContext}. */
+export async function resolveWidgetGuestRunContext(
+  userPayload: UserPayload,
+  provider: DatabaseProviderBase,
+): Promise<WidgetGuestRunContext | null> {
+  return ResolveWidgetGuestRunContext(userPayload, provider);
+}
+
 /**
  * Returns the identity a realtime session's AI-RUN-ENTITY work (delegated tool dispatch +
  * observability run creation/append/finalize) should execute as: the trusted SYSTEM principal when
@@ -123,7 +131,7 @@ export function ResolveScopedAnonymousRunUser(contextUser: UserInfo): UserInfo {
  * preserving the guest's `sessionId` — so progress/streaming PubSub still routes to the guest's
  * live websocket, but all AI run-entity writes happen under the trusted server principal.
  */
-export function elevateUserPayload(userPayload: UserPayload, elevatedUser: UserInfo): UserPayload {
+export function ElevateUserPayload(userPayload: UserPayload, elevatedUser: UserInfo): UserPayload {
   return {
     ...userPayload,
     email: elevatedUser.Email,
@@ -132,6 +140,11 @@ export function elevateUserPayload(userPayload: UserPayload, elevatedUser: UserI
   };
 }
 
+/** @deprecated Use {@link ElevateUserPayload}. */
+export function elevateUserPayload(userPayload: UserPayload, elevatedUser: UserInfo): UserPayload {
+  return ElevateUserPayload(userPayload, elevatedUser);
+}
+
 /** Loads a single widget instance by id under the elevated principal (read-only). */
 async function loadWidgetById(
   widgetId: string,

package/src/resolvers/AdhocQueryResolver.ts

@@ -7,7 +7,7 @@ import { GetReadOnlyDataSource, GetReadOnlyProvider } from '../util.js';
 import { ResolverBase } from '../generic/ResolverBase.js';
 import { IsScopeLimitedPrincipal } from '../auth/scopeLimitedPrincipal.js';
 import { RunQueryResultType } from './QueryResolver.js';
-import { exactTotalFromPage, resolveAdhocTotalRowCount } from './adhoc-query-helpers.js';
+import { ExactTotalFromPage, ResolveAdhocTotalRowCount } from './adhoc-query-helpers.js';
 import sql from 'mssql';
 
 /**
@@ -200,7 +200,7 @@ export class AdhocQueryResolver extends ResolverBase {
         const recordset = (dataResult.recordset ?? []) as Record<string, unknown>[];
 
         // Total already known from the page alone (unpaged, or a short page)? Skip the count.
-        const exact = exactTotalFromPage(startRow, recordset.length, maxRows);
+        const exact = ExactTotalFromPage(startRow, recordset.length, maxRows);
         if (exact != null || !countSQL) {
             return { recordset, totalRowCount: exact ?? recordset.length };
         }
@@ -209,7 +209,7 @@ export class AdhocQueryResolver extends ResolverBase {
         const lowerBound = startRow + recordset.length;
         try {
             const countResult = await this.runSqlWithDeadline<{ TotalRowCount: number }>(ds, countSQL, deadline);
-            return { recordset, totalRowCount: resolveAdhocTotalRowCount(countResult.recordset, lowerBound) };
+            return { recordset, totalRowCount: ResolveAdhocTotalRowCount(countResult.recordset, lowerBound) };
         } catch (countErr) {
             const msg = countErr instanceof Error ? countErr.message : String(countErr);
             LogError(`Ad-hoc query row-count failed; reporting a lower-bound total (${lowerBound}). ${msg}`);

package/src/resolvers/AgentSessionResolver.ts

@@ -25,15 +25,15 @@ import { SessionManager, SessionAuthorizationError } from '../agentSessions/inde
 export class StartAgentSessionResult {
     /** ID of the newly created session. */
     @Field()
-    agentSessionId: string;
+    agentSessionId: string;  // case-violation-ok-legacy-back-compat: the property name is the GraphQL schema field name — renaming it breaks every client query
 
     /** Lifecycle status of the session (always `Active` on a successful start). */
     @Field()
-    status: string;
+    status: string;  // case-violation-ok-legacy-back-compat: the property name is the GraphQL schema field name — renaming it breaks every client query
 
     /** ID of the conversation the session is attached to (supplied or freshly created). */
     @Field()
-    conversationId: string;
+    conversationId: string;  // case-violation-ok-legacy-back-compat: the property name is the GraphQL schema field name — renaming it breaks every client query
 }
 
 /**

package/src/resolvers/ColorResolver.ts

@@ -10,22 +10,22 @@ export class Color {
 
   @Field(() => String)
   @Public()
-  name: string;
+  name: string;  // case-violation-ok-legacy-back-compat: the property name is the GraphQL schema field name — renaming it breaks every client query
 
   @Field(() => String)
   @Public()
-  createdZ: string;
+  createdZ: string;  // case-violation-ok-legacy-back-compat: the property name is the GraphQL schema field name — renaming it breaks every client query
 }
 
 @ObjectType()
 export class ColorNotification {
   @Public()
   @Field(() => String, { nullable: true })
-  message?: string;
+  message?: string;  // case-violation-ok-legacy-back-compat: the property name is the GraphQL schema field name — renaming it breaks every client query
 
   @Public()
   @Field((_type) => Date)
-  date!: Date;
+  date!: Date;  // case-violation-ok-legacy-back-compat: the property name is the GraphQL schema field name — renaming it breaks every client query
 }
 
 export interface ColorNotificationPayload {
@@ -36,13 +36,13 @@ export interface ColorNotificationPayload {
 export class ColorResolver {
   @Subscription(() => ColorNotification, { topics: 'COLOR' })
   @Public()
-  colorSubscription(@Root() { message }: ColorNotificationPayload): ColorNotification {
+  colorSubscription(@Root() { message }: ColorNotificationPayload): ColorNotification {  // case-violation-ok-legacy-back-compat: the property name is the GraphQL schema field name — renaming it breaks every client query
     return { message, date: new Date() };
   }
 
   @Query(() => [Color])
   @Public()
-  async colors(@Ctx() _ctx: AppContext, @PubSub() pubSub: PubSubEngine) {
+  async colors(@Ctx() _ctx: AppContext, @PubSub() pubSub: PubSubEngine) {  // case-violation-ok-legacy-back-compat: the property name is the GraphQL schema field name — renaming it breaks every client query
     const createdZ = new Date().toISOString();
 
     pubSub.publish('COLOR', {

package/src/resolvers/ComponentRegistryResolver.ts

@@ -25,79 +25,79 @@ import { configInfo } from '../config.js';
 @ObjectType()
 class ComponentSpecWithHashType {
     @Field(() => String, { nullable: true })
-    specification?: string; // JSON string of ComponentSpec
+    specification?: string; // JSON string of ComponentSpec — case-violation-ok-legacy-back-compat: the property name is the GraphQL schema field name — renaming it breaks every client query
     
     @Field(() => String)
-    hash: string;
+    hash: string;  // case-violation-ok-legacy-back-compat: the property name is the GraphQL schema field name — renaming it breaks every client query
     
     @Field(() => Boolean)
-    notModified: boolean;
+    notModified: boolean;  // case-violation-ok-legacy-back-compat: the property name is the GraphQL schema field name — renaming it breaks every client query
     
     @Field(() => String, { nullable: true })
-    message?: string;
+    message?: string;  // case-violation-ok-legacy-back-compat: the property name is the GraphQL schema field name — renaming it breaks every client query
 }
 
 @InputType()
 class SearchRegistryComponentsInput {
     @Field({ nullable: true })
-    registryId?: string;
+    registryId?: string;  // case-violation-ok-legacy-back-compat: the property name is the GraphQL schema field name — renaming it breaks every client query
 
     @Field({ nullable: true })
-    namespace?: string;
+    namespace?: string;  // case-violation-ok-legacy-back-compat: the property name is the GraphQL schema field name — renaming it breaks every client query
 
     @Field({ nullable: true })
-    query?: string;
+    query?: string;  // case-violation-ok-legacy-back-compat: the property name is the GraphQL schema field name — renaming it breaks every client query
 
     @Field({ nullable: true })
-    type?: string;
+    type?: string;  // case-violation-ok-legacy-back-compat: the property name is the GraphQL schema field name — renaming it breaks every client query
 
     @Field(() => [String], { nullable: true })
-    tags?: string[];
+    tags?: string[];  // case-violation-ok-legacy-back-compat: the property name is the GraphQL schema field name — renaming it breaks every client query
 
     @Field({ nullable: true })
-    limit?: number;
+    limit?: number;  // case-violation-ok-legacy-back-compat: the property name is the GraphQL schema field name — renaming it breaks every client query
 
     @Field({ nullable: true })
-    offset?: number;
+    offset?: number;  // case-violation-ok-legacy-back-compat: the property name is the GraphQL schema field name — renaming it breaks every client query
 }
 
 @ObjectType()
 class RegistryComponentSearchResultType {
     @Field(() => [String])
-    components: string[]; // Array of JSON strings of ComponentSpec
+    components: string[]; // Array of JSON strings of ComponentSpec — case-violation-ok-legacy-back-compat: the property name is the GraphQL schema field name — renaming it breaks every client query
 
     @Field()
-    total: number;
+    total: number;  // case-violation-ok-legacy-back-compat: the property name is the GraphQL schema field name — renaming it breaks every client query
 
     @Field()
-    offset: number;
+    offset: number;  // case-violation-ok-legacy-back-compat: the property name is the GraphQL schema field name — renaming it breaks every client query
 
     @Field()
-    limit: number;
+    limit: number;  // case-violation-ok-legacy-back-compat: the property name is the GraphQL schema field name — renaming it breaks every client query
 }
 
 @ObjectType()
 class ComponentDependencyTreeType {
     @Field()
-    componentId: string;
+    componentId: string;  // case-violation-ok-legacy-back-compat: the property name is the GraphQL schema field name — renaming it breaks every client query
 
     @Field({ nullable: true })
-    name?: string;
+    name?: string;  // case-violation-ok-legacy-back-compat: the property name is the GraphQL schema field name — renaming it breaks every client query
 
     @Field({ nullable: true })
-    namespace?: string;
+    namespace?: string;  // case-violation-ok-legacy-back-compat: the property name is the GraphQL schema field name — renaming it breaks every client query
 
     @Field({ nullable: true })
-    version?: string;
+    version?: string;  // case-violation-ok-legacy-back-compat: the property name is the GraphQL schema field name — renaming it breaks every client query
 
     @Field({ nullable: true })
-    circular?: boolean;
+    circular?: boolean;  // case-violation-ok-legacy-back-compat: the property name is the GraphQL schema field name — renaming it breaks every client query
 
     @Field({ nullable: true })
-    totalCount?: number;
+    totalCount?: number;  // case-violation-ok-legacy-back-compat: the property name is the GraphQL schema field name — renaming it breaks every client query
 
     @Field(() => [ComponentDependencyTreeType], { nullable: true })
-    dependencies?: ComponentDependencyTreeType[];
+    dependencies?: ComponentDependencyTreeType[];  // case-violation-ok-legacy-back-compat: the property name is the GraphQL schema field name — renaming it breaks every client query
 }
 
 /**
@@ -107,37 +107,37 @@ class ComponentDependencyTreeType {
 @InputType()
 class ComponentFeedbackInput {
     @Field()
-    componentName: string;
+    componentName: string;  // case-violation-ok-legacy-back-compat: the property name is the GraphQL schema field name — renaming it breaks every client query
 
     @Field()
-    componentNamespace: string;
+    componentNamespace: string;  // case-violation-ok-legacy-back-compat: the property name is the GraphQL schema field name — renaming it breaks every client query
 
     @Field({ nullable: true })
-    componentVersion?: string;
+    componentVersion?: string;  // case-violation-ok-legacy-back-compat: the property name is the GraphQL schema field name — renaming it breaks every client query
 
     @Field({ nullable: true })
-    registryName?: string;
+    registryName?: string;  // case-violation-ok-legacy-back-compat: the property name is the GraphQL schema field name — renaming it breaks every client query
 
     @Field()
-    rating: number;
+    rating: number;  // case-violation-ok-legacy-back-compat: the property name is the GraphQL schema field name — renaming it breaks every client query
 
     @Field({ nullable: true })
-    feedbackType?: string;
+    feedbackType?: string;  // case-violation-ok-legacy-back-compat: the property name is the GraphQL schema field name — renaming it breaks every client query
 
     @Field({ nullable: true })
-    comments?: string;
+    comments?: string;  // case-violation-ok-legacy-back-compat: the property name is the GraphQL schema field name — renaming it breaks every client query
 
     @Field({ nullable: true })
-    conversationID?: string;
+    conversationID?: string;  // case-violation-ok-legacy-back-compat: the property name is the GraphQL schema field name — renaming it breaks every client query
 
     @Field({ nullable: true })
-    conversationDetailID?: string;
+    conversationDetailID?: string;  // case-violation-ok-legacy-back-compat: the property name is the GraphQL schema field name — renaming it breaks every client query
 
     @Field({ nullable: true })
-    reportID?: string;
+    reportID?: string;  // case-violation-ok-legacy-back-compat: the property name is the GraphQL schema field name — renaming it breaks every client query
 
     @Field({ nullable: true })
-    dashboardID?: string;
+    dashboardID?: string;  // case-violation-ok-legacy-back-compat: the property name is the GraphQL schema field name — renaming it breaks every client query
 }
 
 /**
@@ -146,13 +146,13 @@ class ComponentFeedbackInput {
 @ObjectType()
 class ComponentFeedbackResponse {
     @Field()
-    success: boolean;
+    success: boolean;  // case-violation-ok-legacy-back-compat: the property name is the GraphQL schema field name — renaming it breaks every client query
 
     @Field({ nullable: true })
-    feedbackID?: string;
+    feedbackID?: string;  // case-violation-ok-legacy-back-compat: the property name is the GraphQL schema field name — renaming it breaks every client query
 
     @Field({ nullable: true })
-    error?: string;
+    error?: string;  // case-violation-ok-legacy-back-compat: the property name is the GraphQL schema field name — renaming it breaks every client query
 }
 
 /**

package/src/resolvers/EntityCommunicationsResolver.ts

@@ -31,10 +31,10 @@ export class CommunicationProviderMessageType {
   AdditionalAttributes: string;
 
   @Field()
-  _mj_CreatedAt: Date;
+  _mj_CreatedAt: Date;  // case-violation-ok-legacy-back-compat: the property name is the GraphQL schema field name — renaming it breaks every client query
 
   @Field()
-  _mj_UpdatedAt: Date;
+  _mj_UpdatedAt: Date;  // case-violation-ok-legacy-back-compat: the property name is the GraphQL schema field name — renaming it breaks every client query
 
   @Field()
   CommunicationProvider?: string;
@@ -73,10 +73,10 @@ export class TemplateInputType {
   IsActive: boolean;
 
   @Field()
-  _mj_CreatedAt: Date;
+  _mj_CreatedAt: Date;  // case-violation-ok-legacy-back-compat: the property name is the GraphQL schema field name — renaming it breaks every client query
 
   @Field()
-  _mj_UpdatedAt: Date;
+  _mj_UpdatedAt: Date;  // case-violation-ok-legacy-back-compat: the property name is the GraphQL schema field name — renaming it breaks every client query
 
   @Field({ nullable: true })
   Category?: string;

package/src/resolvers/ExecuteRemoteOperationResolver.ts

@@ -13,13 +13,13 @@ const REMOTE_OP_PROGRESS_TOPIC = 'RemoteOperationProgress';
 @InputType()
 export class ExecuteRemoteOperationInput {
     @Field()
-    operationKey: string;
+    operationKey: string;  // case-violation-ok-legacy-back-compat: the property name is the GraphQL schema field name — renaming it breaks every client query
 
     @Field()
-    inputJSON: string;
+    inputJSON: string;  // case-violation-ok-legacy-back-compat: the property name is the GraphQL schema field name — renaming it breaks every client query
 
     @Field()
-    invokeMode: string;
+    invokeMode: string;  // case-violation-ok-legacy-back-compat: the property name is the GraphQL schema field name — renaming it breaks every client query
 
     /**
      * Optional client-generated channel id. When set (attached mode over the wire), the server publishes every
@@ -27,7 +27,7 @@ export class ExecuteRemoteOperationInput {
      * so the caller's `onProgress` fires live while the operation runs. Omitted for sync / no-progress calls.
      */
     @Field(() => String, { nullable: true })
-    progressChannelId?: string;
+    progressChannelId?: string;  // case-violation-ok-legacy-back-compat: the property name is the GraphQL schema field name — renaming it breaks every client query
 }
 
 /** A single streamed progress envelope delivered over the `RemoteOperationProgress` subscription. */
@@ -45,19 +45,19 @@ export class RemoteOperationProgressNotification {
 @ObjectType()
 export class ExecuteRemoteOperationResultType {
     @Field(() => Boolean)
-    success: boolean;
+    success: boolean;  // case-violation-ok-legacy-back-compat: the property name is the GraphQL schema field name — renaming it breaks every client query
 
     @Field(() => String, { nullable: true })
-    resultCode?: string;
+    resultCode?: string;  // case-violation-ok-legacy-back-compat: the property name is the GraphQL schema field name — renaming it breaks every client query
 
     @Field(() => String, { nullable: true })
-    outputJSON?: string;
+    outputJSON?: string;  // case-violation-ok-legacy-back-compat: the property name is the GraphQL schema field name — renaming it breaks every client query
 
     @Field(() => String, { nullable: true })
-    handle?: string;
+    handle?: string;  // case-violation-ok-legacy-back-compat: the property name is the GraphQL schema field name — renaming it breaks every client query
 
     @Field(() => String, { nullable: true })
-    errorMessage?: string;
+    errorMessage?: string;  // case-violation-ok-legacy-back-compat: the property name is the GraphQL schema field name — renaming it breaks every client query
 }
 
 /**

package/src/resolvers/FetchEntityVectorsResolver.ts

@@ -5,7 +5,7 @@ import { MJEntityDocumentEntity, MJVectorIndexEntity, MJVectorDatabaseEntity } f
 import { ResolverBase } from '../generic/ResolverBase.js';
 import { GetAIAPIKey } from '@memberjunction/ai';
 import { VectorDBBase } from '@memberjunction/ai-vectordb';
-import { MJGlobal, UUIDsEqual } from '@memberjunction/global';
+import { EscapeSQLString, MJGlobal, UUIDsEqual } from '@memberjunction/global';
 
 /* ───── GraphQL types ───── */
 
@@ -144,7 +144,7 @@ export class FetchEntityVectorsResolver extends ResolverBase {
         const rv = new RunView();
         const result = await rv.RunView<MJEntityDocumentEntity>({
             EntityName: 'MJ: Entity Documents',
-            ExtraFilter: `ID='${entityDocumentID}'`,
+            ExtraFilter: `ID='${EscapeSQLString(entityDocumentID)}'`,
             ResultType: 'entity_object',
         }, contextUser);