@memberjunction/server 6.2.0-edge.0 → 6.2.0-edge.1

package/dist/auth/initializeProviders.js

@@ -13,7 +13,7 @@ import { AuthProviderEngine } from './AuthProviderEngine.js';
  * {@link initializeAuthProvidersFromMetadata}, which runs later in startup once a database
  * connection and a system user exist.
  */
-export function initializeAuthProviders() {
+export function InitializeAuthProviders() {
     const factory = AuthProviderFactory.Instance;
     // Clear any existing providers
     factory.clear();
@@ -55,6 +55,10 @@ export function initializeAuthProviders() {
     // validateAuthProvidersRegistered(). A metadata-only deployment legitimately has an empty
     // authProviders array at this point, and erroring here would cry wolf on every boot.
 }
+/** @deprecated Use {@link InitializeAuthProviders}. */
+export function initializeAuthProviders() {
+    return InitializeAuthProviders();
+}
 /**
  * Layers the metadata provider catalog on top of the config-declared providers.
  *
@@ -69,7 +73,7 @@ export function initializeAuthProviders() {
  *
  * @returns the number of providers registered from metadata.
  */
-export async function initializeAuthProvidersFromMetadata(contextUser, provider) {
+export async function InitializeAuthProvidersFromMetadata(contextUser, provider) {
     try {
         await AuthProviderEngine.Instance.Config(false, contextUser, provider);
         const count = await AuthProviderEngine.Instance.RegisterAll(contextUser);
@@ -84,6 +88,10 @@ export async function initializeAuthProvidersFromMetadata(contextUser, provider)
         return 0;
     }
 }
+/** @deprecated Use {@link InitializeAuthProvidersFromMetadata}. */
+export async function initializeAuthProvidersFromMetadata(contextUser, provider) {
+    return InitializeAuthProvidersFromMetadata(contextUser, provider);
+}
 /**
  * Rebuilds the provider registry from scratch: config-declared providers first, then the
  * metadata catalog layered on top — the same two-source order as startup.
@@ -114,17 +122,21 @@ export async function initializeAuthProvidersFromMetadata(contextUser, provider)
  *
  * @returns the number of providers registered from metadata after the refresh.
  */
-export async function refreshAuthProviders(contextUser, provider) {
+export async function RefreshAuthProviders(contextUser, provider) {
     await AuthProviderEngine.Instance.Config(true, contextUser, provider);
     // Probe the reloaded catalog BEFORE clearing anything: reading Providers throws
     // PermissionConstrainedError when the load was skipped for permission reasons, and that
     // failure must abort the refresh while the registry is still intact.
     const pendingRows = AuthProviderEngine.Instance.Providers.length;
-    initializeAuthProviders();
+    InitializeAuthProviders();
     const count = await AuthProviderEngine.Instance.RegisterAll(contextUser);
     LogStatus(`[Auth] Provider registry refreshed — ${count} of ${pendingRows} metadata provider(s) registered on top of the config-declared set.`);
     return count;
 }
+/** @deprecated Use {@link RefreshAuthProviders}. */
+export async function refreshAuthProviders(contextUser, provider) {
+    return RefreshAuthProviders(contextUser, provider);
+}
 /**
  * Reports whether any provider is registered, from either source, and logs a diagnostic when none
  * is.
@@ -132,7 +144,7 @@ export async function refreshAuthProviders(contextUser, provider) {
  * Split out from {@link initializeAuthProviders} because "no providers" is only genuinely wrong
  * once BOTH sources have had their turn.
  */
-export function validateAuthProvidersRegistered() {
+export function ValidateAuthProvidersRegistered() {
     const hasProviders = AuthProviderFactory.Instance.hasProviders();
     if (!hasProviders) {
         LogError('No authentication providers are configured. Define them in the "MJ: Authentication Providers" metadata entity, ' +
@@ -140,4 +152,8 @@ export function validateAuthProvidersRegistered() {
     }
     return hasProviders;
 }
+/** @deprecated Use {@link ValidateAuthProvidersRegistered}. */
+export function validateAuthProvidersRegistered() {
+    return ValidateAuthProvidersRegistered();
+}
 //# sourceMappingURL=initializeProviders.js.map

package/dist/auth/initializeProviders.js.map

@@ -1 +1 @@
-{"version":3,"file":"initializeProviders.js","sourceRoot":"","sources":["../../src/auth/initializeProviders.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAsB,QAAQ,EAAE,SAAS,EAAE,WAAW,EAAoC,MAAM,sBAAsB,CAAC;AAC9H,OAAO,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AACrE,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAE7D;;;;;;;;;;GAUG;AACH,MAAM,UAAU,uBAAuB;IACrC,MAAM,OAAO,GAAG,mBAAmB,CAAC,QAAQ,CAAC;IAE7C,+BAA+B;IAC/B,OAAO,CAAC,KAAK,EAAE,CAAC;IAEhB,6FAA6F;IAC7F,uFAAuF;IACvF,gGAAgG;IAChG,+FAA+F;IAC/F,uFAAuF;IACvF,EAAE;IACF,8FAA8F;IAC9F,iGAAiG;IACjG,2CAA2C;IAC3C,IAAI,CAAC,UAAU,CAAC,aAAa,IAAI,UAAU,CAAC,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvE,MAAM,UAAU,GAAG,mBAAmB,CAAC,uBAAuB,EAAE,CAAC;QACjE,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1B,UAAU,CAAC,aAAa,GAAG,UAAU,CAAC;YACtC,WAAW,CAAC;gBACV,OAAO,EAAE,qBAAqB,UAAU,CAAC,MAAM,4CAA4C,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;gBACrI,WAAW,EAAE,IAAI;aAClB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,iDAAiD;IACjD,IAAI,UAAU,CAAC,aAAa,IAAI,UAAU,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpE,KAAK,MAAM,cAAc,IAAI,UAAU,CAAC,aAAa,EAAE,CAAC;YACtD,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,mBAAmB,CAAC,cAAc,CAAC,cAAoC,CAAC,CAAC;gBAC1F,sFAAsF;gBACtF,mFAAmF;gBACnF,6CAA6C;gBAC7C,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YAC7B,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,QAAQ,CAAC,sCAAsC,cAAc,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC,CAAC;YAClF,CAAC;QACH,CAAC;IACH,CAAC;IAED,2FAA2F;IAC3F,0FAA0F;IAC1F,qFAAqF;AACvF,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,mCAAmC,CAAC,WAAsB,EAAE,QAA4B;IAC5G,IAAI,CAAC;QACH,MAAM,kBAAkB,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;QACvE,MAAM,KAAK,GAAG,MAAM,kBAAkB,CAAC,QAAQ,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC;QACzE,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;YACd,SAAS,CAAC,UAAU,KAAK,uDAAuD,CAAC,CAAC;QACpF,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvE,QAAQ,CAAC,4EAA4E,OAAO,kDAAkD,CAAC,CAAC;QAChJ,OAAO,CAAC,CAAC;IACX,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,WAAsB,EAAE,QAA4B;IAC7F,MAAM,kBAAkB,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;IAEtE,gFAAgF;IAChF,wFAAwF;IACxF,qEAAqE;IACrE,MAAM,WAAW,GAAG,kBAAkB,CAAC,QAAQ,CAAC,SAAS,CAAC,MAAM,CAAC;IAEjE,uBAAuB,EAAE,CAAC;IAC1B,MAAM,KAAK,GAAG,MAAM,kBAAkB,CAAC,QAAQ,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC;IACzE,SAAS,CACP,wCAAwC,KAAK,OAAO,WAAW,qEAAqE,CACrI,CAAC;IACF,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,+BAA+B;IAC7C,MAAM,YAAY,GAAG,mBAAmB,CAAC,QAAQ,CAAC,YAAY,EAAE,CAAC;IACjE,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,QAAQ,CACN,iHAAiH;YAC/G,iDAAiD,CACpD,CAAC;IACJ,CAAC;IACD,OAAO,YAAY,CAAC;AACtB,CAAC"}
+{"version":3,"file":"initializeProviders.js","sourceRoot":"","sources":["../../src/auth/initializeProviders.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAsB,QAAQ,EAAE,SAAS,EAAE,WAAW,EAAoC,MAAM,sBAAsB,CAAC;AAC9H,OAAO,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AACrE,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAE7D;;;;;;;;;;GAUG;AACH,MAAM,UAAU,uBAAuB;IACrC,MAAM,OAAO,GAAG,mBAAmB,CAAC,QAAQ,CAAC;IAE7C,+BAA+B;IAC/B,OAAO,CAAC,KAAK,EAAE,CAAC;IAEhB,6FAA6F;IAC7F,uFAAuF;IACvF,gGAAgG;IAChG,+FAA+F;IAC/F,uFAAuF;IACvF,EAAE;IACF,8FAA8F;IAC9F,iGAAiG;IACjG,2CAA2C;IAC3C,IAAI,CAAC,UAAU,CAAC,aAAa,IAAI,UAAU,CAAC,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvE,MAAM,UAAU,GAAG,mBAAmB,CAAC,uBAAuB,EAAE,CAAC;QACjE,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1B,UAAU,CAAC,aAAa,GAAG,UAAU,CAAC;YACtC,WAAW,CAAC;gBACV,OAAO,EAAE,qBAAqB,UAAU,CAAC,MAAM,4CAA4C,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;gBACrI,WAAW,EAAE,IAAI;aAClB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,iDAAiD;IACjD,IAAI,UAAU,CAAC,aAAa,IAAI,UAAU,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpE,KAAK,MAAM,cAAc,IAAI,UAAU,CAAC,aAAa,EAAE,CAAC;YACtD,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,mBAAmB,CAAC,cAAc,CAAC,cAAoC,CAAC,CAAC;gBAC1F,sFAAsF;gBACtF,mFAAmF;gBACnF,6CAA6C;gBAC7C,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YAC7B,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,QAAQ,CAAC,sCAAsC,cAAc,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC,CAAC;YAClF,CAAC;QACH,CAAC;IACH,CAAC;IAED,2FAA2F;IAC3F,0FAA0F;IAC1F,qFAAqF;AACvF,CAAC;AAED,uDAAuD;AACvD,MAAM,UAAU,uBAAuB;IACrC,OAAO,uBAAuB,EAAE,CAAC;AACnC,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,mCAAmC,CAAC,WAAsB,EAAE,QAA4B;IAC5G,IAAI,CAAC;QACH,MAAM,kBAAkB,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;QACvE,MAAM,KAAK,GAAG,MAAM,kBAAkB,CAAC,QAAQ,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC;QACzE,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;YACd,SAAS,CAAC,UAAU,KAAK,uDAAuD,CAAC,CAAC;QACpF,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvE,QAAQ,CAAC,4EAA4E,OAAO,kDAAkD,CAAC,CAAC;QAChJ,OAAO,CAAC,CAAC;IACX,CAAC;AACH,CAAC;AAED,mEAAmE;AACnE,MAAM,CAAC,KAAK,UAAU,mCAAmC,CAAC,WAAsB,EAAE,QAA4B;IAC5G,OAAO,mCAAmC,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;AACpE,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,WAAsB,EAAE,QAA4B;IAC7F,MAAM,kBAAkB,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;IAEtE,gFAAgF;IAChF,wFAAwF;IACxF,qEAAqE;IACrE,MAAM,WAAW,GAAG,kBAAkB,CAAC,QAAQ,CAAC,SAAS,CAAC,MAAM,CAAC;IAEjE,uBAAuB,EAAE,CAAC;IAC1B,MAAM,KAAK,GAAG,MAAM,kBAAkB,CAAC,QAAQ,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC;IACzE,SAAS,CACP,wCAAwC,KAAK,OAAO,WAAW,qEAAqE,CACrI,CAAC;IACF,OAAO,KAAK,CAAC;AACf,CAAC;AAED,oDAAoD;AACpD,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,WAAsB,EAAE,QAA4B;IAC7F,OAAO,oBAAoB,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;AACrD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,+BAA+B;IAC7C,MAAM,YAAY,GAAG,mBAAmB,CAAC,QAAQ,CAAC,YAAY,EAAE,CAAC;IACjE,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,QAAQ,CACN,iHAAiH;YAC/G,iDAAiD,CACpD,CAAC;IACJ,CAAC;IACD,OAAO,YAAY,CAAC;AACtB,CAAC;AAED,+DAA+D;AAC/D,MAAM,UAAU,+BAA+B;IAC7C,OAAO,+BAA+B,EAAE,CAAC;AAC3C,CAAC"}

package/dist/auth/magicLink/MagicLinkRouter.d.ts

@@ -17,6 +17,11 @@ export declare const MAGIC_LINK_JWKS_PATH = "/magic-link/jwks.json";
  * Builds the magic-link routers. The caller mounts `publicRouter` before the
  * auth middleware and `authenticatedRouter` after it (both at MAGIC_LINK_MOUNT_PATH).
  */
+export declare function CreateMagicLinkHandler(publicUrl: string, config: MagicLinkConfig): {
+    publicRouter: Router;
+    authenticatedRouter: Router;
+};
+/** @deprecated Use {@link CreateMagicLinkHandler}. */
 export declare function createMagicLinkHandler(publicUrl: string, config: MagicLinkConfig): {
     publicRouter: Router;
     authenticatedRouter: Router;
@@ -30,6 +35,8 @@ export declare function createMagicLinkHandler(publicUrl: string, config: MagicL
  * request 401s. Assumes the key is already initialized (the widget handler does
  * this via `MagicLinkKeyManager.Instance.Initialize` at startup).
  */
+export declare function CreateMagicLinkJwksRouter(): Router;
+/** @deprecated Use {@link CreateMagicLinkJwksRouter}. */
 export declare function createMagicLinkJwksRouter(): Router;
 /**
  * Registers the `magic-link` auth provider so MJServer's issuer-driven JWT
@@ -39,5 +46,7 @@ export declare function createMagicLinkJwksRouter(): Router;
  * Also appends the provider to `configInfo.authProviders` so a later
  * `initializeAuthProviders()` (which clears + repopulates from config) keeps it.
  */
+export declare function RegisterMagicLinkAuthProvider(publicUrl: string, config: MagicLinkConfig): void;
+/** @deprecated Use {@link RegisterMagicLinkAuthProvider}. */
 export declare function registerMagicLinkAuthProvider(publicUrl: string, config: MagicLinkConfig): void;
 //# sourceMappingURL=MagicLinkRouter.d.ts.map

package/dist/auth/magicLink/MagicLinkRouter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"MagicLinkRouter.d.ts","sourceRoot":"","sources":["../../../src/auth/magicLink/MagicLinkRouter.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,MAAM,EAAiD,MAAM,SAAS,CAAC;AAIhF,OAAO,EAAc,KAAK,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAMnE,uDAAuD;AACvD,eAAO,MAAM,qBAAqB,gBAAgB,CAAC;AAEnD,4DAA4D;AAC5D,eAAO,MAAM,oBAAoB,0BAAuC,CAAC;AAEzE;;;GAGG;AACH,wBAAgB,sBAAsB,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,eAAe,GAAG;IAClF,YAAY,EAAE,MAAM,CAAC;IACrB,mBAAmB,EAAE,MAAM,CAAC;CAC7B,CAgJA;AAED;;;;;;;;GAQG;AACH,wBAAgB,yBAAyB,IAAI,MAAM,CAMlD;AAED;;;;;;;GAOG;AACH,wBAAgB,6BAA6B,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,eAAe,GAAG,IAAI,CAqB9F"}
+{"version":3,"file":"MagicLinkRouter.d.ts","sourceRoot":"","sources":["../../../src/auth/magicLink/MagicLinkRouter.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,MAAM,EAAiD,MAAM,SAAS,CAAC;AAIhF,OAAO,EAAc,KAAK,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAMnE,uDAAuD;AACvD,eAAO,MAAM,qBAAqB,gBAAgB,CAAC;AAEnD,4DAA4D;AAC5D,eAAO,MAAM,oBAAoB,0BAAuC,CAAC;AAEzE;;;GAGG;AACH,wBAAgB,sBAAsB,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,eAAe,GAAG;IAClF,YAAY,EAAE,MAAM,CAAC;IACrB,mBAAmB,EAAE,MAAM,CAAC;CAC7B,CAgJA;AAED,sDAAsD;AACtD,wBAAgB,sBAAsB,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,eAAe,GAAG;IAClF,YAAY,EAAE,MAAM,CAAC;IACrB,mBAAmB,EAAE,MAAM,CAAC;CAC7B,CAEA;AAED;;;;;;;;GAQG;AACH,wBAAgB,yBAAyB,IAAI,MAAM,CAMlD;AAED,yDAAyD;AACzD,wBAAgB,yBAAyB,IAAI,MAAM,CAElD;AAED;;;;;;;GAOG;AACH,wBAAgB,6BAA6B,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,eAAe,GAAG,IAAI,CAqB9F;AAED,6DAA6D;AAC7D,wBAAgB,6BAA6B,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,eAAe,GAAG,IAAI,CAE9F"}

package/dist/auth/magicLink/MagicLinkRouter.js

@@ -14,7 +14,7 @@ import { AuthProviderFactory } from '@memberjunction/auth-providers';
 import { configInfo } from '../../config.js';
 import { MagicLinkKeyManager } from './MagicLinkKeys.js';
 import { MagicLinkService } from './MagicLinkService.js';
-import { buildRedeemLandingHtml } from './redeemLanding.js';
+import { BuildRedeemLandingHtml } from './redeemLanding.js';
 /** The mount path for both routers (`/magic-link`). */
 export const MAGIC_LINK_MOUNT_PATH = '/magic-link';
 /** Path of the JWKS endpoint relative to the public URL. */
@@ -23,7 +23,7 @@ export const MAGIC_LINK_JWKS_PATH = `${MAGIC_LINK_MOUNT_PATH}/jwks.json`;
  * Builds the magic-link routers. The caller mounts `publicRouter` before the
  * auth middleware and `authenticatedRouter` after it (both at MAGIC_LINK_MOUNT_PATH).
  */
-export function createMagicLinkHandler(publicUrl, config) {
+export function CreateMagicLinkHandler(publicUrl, config) {
     // Initialize the signing keypair once.
     MagicLinkKeyManager.Instance.Initialize(config.rsaPrivateKey);
     const service = new MagicLinkService(publicUrl, config);
@@ -100,7 +100,7 @@ export function createMagicLinkHandler(publicUrl, config) {
         res
             .status(200)
             .type('html')
-            .send(buildRedeemLandingHtml(token, `${MAGIC_LINK_MOUNT_PATH}/redeem`));
+            .send(BuildRedeemLandingHtml(token, `${MAGIC_LINK_MOUNT_PATH}/redeem`));
     });
     // POST /redeem performs the actual (side-effectful) redemption. Token arrives
     // from the interstitial form body, an API client's JSON body, or the query.
@@ -131,16 +131,16 @@ export function createMagicLinkHandler(publicUrl, config) {
             return;
         }
         const body = (req.body ?? {});
-        if (!body.email || !body.applicationId) {
+        if (!body.email || !body.ApplicationId) {
             res.status(400).json({ success: false, error: 'email and applicationId are required.' });
             return;
         }
         const result = await service.CreateInvite({
             email: body.email,
-            applicationId: body.applicationId,
-            roleId: body.roleId,
-            expiresInHours: body.expiresInHours,
-            maxUses: body.maxUses,
+            ApplicationId: body.ApplicationId,
+            RoleId: body.RoleId,
+            ExpiresInHours: body.ExpiresInHours,
+            MaxUses: body.MaxUses,
             firstName: body.firstName,
             lastName: body.lastName,
         }, creatingUser);
@@ -151,6 +151,10 @@ export function createMagicLinkHandler(publicUrl, config) {
     });
     return { publicRouter, authenticatedRouter };
 }
+/** @deprecated Use {@link CreateMagicLinkHandler}. */
+export function createMagicLinkHandler(publicUrl, config) {
+    return CreateMagicLinkHandler(publicUrl, config);
+}
 /**
  * A minimal PUBLIC router that serves ONLY the JWKS endpoint (the magic-link
  * signing key's public half). Mount this when the full magic-link flow is
@@ -160,13 +164,17 @@ export function createMagicLinkHandler(publicUrl, config) {
  * request 401s. Assumes the key is already initialized (the widget handler does
  * this via `MagicLinkKeyManager.Instance.Initialize` at startup).
  */
-export function createMagicLinkJwksRouter() {
+export function CreateMagicLinkJwksRouter() {
     const router = Router();
     router.get('/jwks.json', (_req, res) => {
         res.status(200).json(MagicLinkKeyManager.Instance.GetJWKS());
     });
     return router;
 }
+/** @deprecated Use {@link CreateMagicLinkJwksRouter}. */
+export function createMagicLinkJwksRouter() {
+    return CreateMagicLinkJwksRouter();
+}
 /**
  * Registers the `magic-link` auth provider so MJServer's issuer-driven JWT
  * validation accepts MJ-issued session tokens. Issuer = public URL, JWKS URL =
@@ -175,7 +183,7 @@ export function createMagicLinkJwksRouter() {
  * Also appends the provider to `configInfo.authProviders` so a later
  * `initializeAuthProviders()` (which clears + repopulates from config) keeps it.
  */
-export function registerMagicLinkAuthProvider(publicUrl, config) {
+export function RegisterMagicLinkAuthProvider(publicUrl, config) {
     const base = publicUrl.replace(/\/$/, '');
     const providerConfig = {
         name: 'magic-link',
@@ -197,4 +205,8 @@ export function registerMagicLinkAuthProvider(publicUrl, config) {
         LogError(`[MagicLink] Failed to register auth provider: ${e instanceof Error ? e.message : String(e)}`);
     }
 }
+/** @deprecated Use {@link RegisterMagicLinkAuthProvider}. */
+export function registerMagicLinkAuthProvider(publicUrl, config) {
+    return RegisterMagicLinkAuthProvider(publicUrl, config);
+}
 //# sourceMappingURL=MagicLinkRouter.js.map

package/dist/auth/magicLink/MagicLinkRouter.js.map

@@ -1 +1 @@
-{"version":3,"file":"MagicLinkRouter.js","sourceRoot":"","sources":["../../../src/auth/magicLink/MagicLinkRouter.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAA+B,MAAM,SAAS,CAAC;AAChF,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,QAAQ,EAAa,WAAW,EAA2B,MAAM,sBAAsB,CAAC;AACjG,OAAO,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AACrE,OAAO,EAAE,UAAU,EAAwB,MAAM,iBAAiB,CAAC;AACnE,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AAG5D,uDAAuD;AACvD,MAAM,CAAC,MAAM,qBAAqB,GAAG,aAAa,CAAC;AAEnD,4DAA4D;AAC5D,MAAM,CAAC,MAAM,oBAAoB,GAAG,GAAG,qBAAqB,YAAY,CAAC;AAEzE;;;GAGG;AACH,MAAM,UAAU,sBAAsB,CAAC,SAAiB,EAAE,MAAuB;IAI/E,uCAAuC;IACvC,mBAAmB,CAAC,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;IAE9D,MAAM,OAAO,GAAG,IAAI,gBAAgB,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IAExD,yEAAyE;IACzE,uEAAuE;IACvE,2EAA2E;IAC3E,iEAAiE;IACjE,MAAM,aAAa,GAAG,SAAS,CAAC;QAC9B,QAAQ,EAAE,MAAM,CAAC,iBAAiB;QAClC,KAAK,EAAE,MAAM,CAAC,kBAAkB;QAChC,eAAe,EAAE,SAAS;QAC1B,aAAa,EAAE,KAAK;QACpB,OAAO,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK,EAAE,gDAAgD,EAAE;KAC3G,CAAC,CAAC;IACH,MAAM,aAAa,GAAG,SAAS,CAAC;QAC9B,QAAQ,EAAE,MAAM,CAAC,iBAAiB;QAClC,KAAK,EAAE,MAAM,CAAC,kBAAkB;QAChC,eAAe,EAAE,SAAS;QAC1B,aAAa,EAAE,KAAK;QACpB,OAAO,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,4CAA4C,EAAE;KACjF,CAAC,CAAC;IAEH,6EAA6E;IAC7E,MAAM,YAAY,GAAG,MAAM,EAAE,CAAC;IAE9B,YAAY,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC,IAAa,EAAE,GAAa,EAAE,EAAE;QAC9D,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;IAC/D,CAAC,CAAC,CAAC;IAEH,6EAA6E;IAC7E,6EAA6E;IAC7E,yEAAyE;IACzE,MAAM,gBAAgB,GAAG,CAAC,GAAa,EAAE,MAA6B,EAAE,SAAkB,EAAQ,EAAE;QAClG,MAAM,WAAW,GAAG,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAC3D,IAAI,WAAW,IAAI,CAAC,SAAS,EAAE,CAAC;YAC9B,IAAI,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;gBACnC,0EAA0E;gBAC1E,4EAA4E;gBAC5E,sEAAsE;gBACtE,uEAAuE;gBACvE,2EAA2E;gBAC3E,0DAA0D;gBAC1D,MAAM,OAAO,GAAG,MAAM,CAAC,eAAe;oBACpC,CAAC,CAAC,MAAM,CAAC,eAAe;oBACxB,CAAC,CAAC,MAAM,CAAC,eAAe;wBACxB,CAAC,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC;wBAClE,CAAC,CAAC,EAAE,CAAC;gBACP,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,QAAQ,kBAAkB,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;gBACnE,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,WAAW,GAAG,IAAI,UAAU,kBAAkB,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YACvF,CAAC;iBAAM,CAAC;gBACN,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,WAAW,aAAa,kBAAkB,CAAC,MAAM,CAAC,SAAS,IAAI,SAAS,CAAC,EAAE,CAAC,CAAC;YACpG,CAAC;YACD,OAAO;QACT,CAAC;QACD,iBAAiB;QACjB,kFAAkF;QAClF,8CAA8C;QAC9C,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,KAAK,cAAc,IAAI,MAAM,CAAC,SAAS,KAAK,qBAAqB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;QACpI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAClC,CAAC,CAAC;IAEF,6EAA6E;IAC7E,8EAA8E;IAC9E,+EAA+E;IAC/E,6EAA6E;IAC7E,YAAY,CAAC,GAAG,CAAC,SAAS,EAAE,aAAa,EAAE,CAAC,GAAY,EAAE,GAAa,EAAE,EAAE;QACzE,MAAM,KAAK,GAAG,OAAO,GAAG,CAAC,KAAK,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QACzE,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;YAClE,OAAO;QACT,CAAC;QACD,6CAA6C;QAC7C,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAChC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,2BAA2B,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,qBAAqB,SAAS,EAAE,CAAC,CAAC;YACtI,OAAO;QACT,CAAC;QACD,GAAG;aACA,MAAM,CAAC,GAAG,CAAC;aACX,IAAI,CAAC,MAAM,CAAC;aACZ,IAAI,CAAC,sBAAsB,CAAC,KAAK,EAAE,GAAG,qBAAqB,SAAS,CAAC,CAAC,CAAC;IAC5E,CAAC,CAAC,CAAC;IAEH,8EAA8E;IAC9E,4EAA4E;IAC5E,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE,aAAa,EAAE,UAAU,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;QACzH,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAuB,CAAC;QACpD,MAAM,KAAK,GACT,CAAC,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,IAAI,IAAI,CAAC,KAAK,CAAC;YAC9C,CAAC,OAAO,GAAG,CAAC,KAAK,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC/D,MAAM,SAAS,GAAG,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,MAAM,IAAI,GAAG,CAAC,EAAE,CAAC,kBAAkB,CAAC,KAAK,kBAAkB,CAAC;QAEnG,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;YAClE,OAAO;QACT,CAAC;QAED,6EAA6E;QAC7E,kFAAkF;QAClF,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC,KAAK,EAAE;YAC/C,SAAS,EAAE,GAAG,CAAC,EAAE;YACjB,SAAS,EAAE,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,SAAS;YAC7C,MAAM,EAAE,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,SAAS;SACvC,CAAC,CAAC;QACH,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;IAEH,6EAA6E;IAC7E,MAAM,mBAAmB,GAAG,MAAM,EAAE,CAAC;IAErC,mBAAmB,CAAC,IAAI,CAAC,SAAS,EAAE,aAAa,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;QAC/F,MAAM,YAAY,GAAG,GAAG,CAAC,WAAW,EAAE,UAAU,CAAC;QACjD,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,0BAA0B,EAAE,CAAC,CAAC;YAC5E,OAAO;QACT,CAAC;QAED,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAyC,CAAC;QACtE,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;YACvC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,uCAAuC,EAAE,CAAC,CAAC;YACzF,OAAO;QACT,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,YAAY,CACvC;YACE,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,QAAQ,EAAE,IAAI,CAAC,QAAQ;SACxB,EACD,YAAY,CACb,CAAC;QACF,0EAA0E;QAC1E,mCAAmC;QACnC,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,KAAK,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;QACnF,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAClC,CAAC,CAAC,CAAC;IAEH,OAAO,EAAE,YAAY,EAAE,mBAAmB,EAAE,CAAC;AAC/C,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,yBAAyB;IACvC,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC;IACxB,MAAM,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC,IAAa,EAAE,GAAa,EAAE,EAAE;QACxD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;IAC/D,CAAC,CAAC,CAAC;IACH,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,6BAA6B,CAAC,SAAiB,EAAE,MAAuB;IACtF,MAAM,IAAI,GAAG,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC1C,MAAM,cAAc,GAAuB;QACzC,IAAI,EAAE,YAAY;QAClB,IAAI,EAAE,YAAY;QAClB,MAAM,EAAE,SAAS;QACjB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,OAAO,EAAE,GAAG,IAAI,GAAG,oBAAoB,EAAE;KAC1C,CAAC;IAEF,IAAI,CAAC;QACH,UAAU,CAAC,aAAa,GAAG,UAAU,CAAC,aAAa,IAAI,EAAE,CAAC;QAC1D,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,YAAY,CAAC,EAAE,CAAC;YACnE,UAAU,CAAC,aAAa,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAChD,CAAC;QACD,MAAM,OAAO,GAAG,mBAAmB,CAAC,QAAQ,CAAC;QAC7C,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAC,cAAc,CAAC,cAAc,CAAC,CAAC,CAAC;QACrE,WAAW,CAAC,EAAE,OAAO,EAAE,iDAAiD,SAAS,WAAW,cAAc,CAAC,OAAO,GAAG,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9I,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,QAAQ,CAAC,iDAAiD,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC1G,CAAC;AACH,CAAC"}
+{"version":3,"file":"MagicLinkRouter.js","sourceRoot":"","sources":["../../../src/auth/magicLink/MagicLinkRouter.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAA+B,MAAM,SAAS,CAAC;AAChF,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,QAAQ,EAAa,WAAW,EAA2B,MAAM,sBAAsB,CAAC;AACjG,OAAO,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AACrE,OAAO,EAAE,UAAU,EAAwB,MAAM,iBAAiB,CAAC;AACnE,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AAG5D,uDAAuD;AACvD,MAAM,CAAC,MAAM,qBAAqB,GAAG,aAAa,CAAC;AAEnD,4DAA4D;AAC5D,MAAM,CAAC,MAAM,oBAAoB,GAAG,GAAG,qBAAqB,YAAY,CAAC;AAEzE;;;GAGG;AACH,MAAM,UAAU,sBAAsB,CAAC,SAAiB,EAAE,MAAuB;IAI/E,uCAAuC;IACvC,mBAAmB,CAAC,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;IAE9D,MAAM,OAAO,GAAG,IAAI,gBAAgB,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IAExD,yEAAyE;IACzE,uEAAuE;IACvE,2EAA2E;IAC3E,iEAAiE;IACjE,MAAM,aAAa,GAAG,SAAS,CAAC;QAC9B,QAAQ,EAAE,MAAM,CAAC,iBAAiB;QAClC,KAAK,EAAE,MAAM,CAAC,kBAAkB;QAChC,eAAe,EAAE,SAAS;QAC1B,aAAa,EAAE,KAAK;QACpB,OAAO,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK,EAAE,gDAAgD,EAAE;KAC3G,CAAC,CAAC;IACH,MAAM,aAAa,GAAG,SAAS,CAAC;QAC9B,QAAQ,EAAE,MAAM,CAAC,iBAAiB;QAClC,KAAK,EAAE,MAAM,CAAC,kBAAkB;QAChC,eAAe,EAAE,SAAS;QAC1B,aAAa,EAAE,KAAK;QACpB,OAAO,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,4CAA4C,EAAE;KACjF,CAAC,CAAC;IAEH,6EAA6E;IAC7E,MAAM,YAAY,GAAG,MAAM,EAAE,CAAC;IAE9B,YAAY,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC,IAAa,EAAE,GAAa,EAAE,EAAE;QAC9D,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;IAC/D,CAAC,CAAC,CAAC;IAEH,6EAA6E;IAC7E,6EAA6E;IAC7E,yEAAyE;IACzE,MAAM,gBAAgB,GAAG,CAAC,GAAa,EAAE,MAA6B,EAAE,SAAkB,EAAQ,EAAE;QAClG,MAAM,WAAW,GAAG,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAC3D,IAAI,WAAW,IAAI,CAAC,SAAS,EAAE,CAAC;YAC9B,IAAI,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;gBACnC,0EAA0E;gBAC1E,4EAA4E;gBAC5E,sEAAsE;gBACtE,uEAAuE;gBACvE,2EAA2E;gBAC3E,0DAA0D;gBAC1D,MAAM,OAAO,GAAG,MAAM,CAAC,eAAe;oBACpC,CAAC,CAAC,MAAM,CAAC,eAAe;oBACxB,CAAC,CAAC,MAAM,CAAC,eAAe;wBACxB,CAAC,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC;wBAClE,CAAC,CAAC,EAAE,CAAC;gBACP,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,QAAQ,kBAAkB,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;gBACnE,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,WAAW,GAAG,IAAI,UAAU,kBAAkB,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YACvF,CAAC;iBAAM,CAAC;gBACN,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,WAAW,aAAa,kBAAkB,CAAC,MAAM,CAAC,SAAS,IAAI,SAAS,CAAC,EAAE,CAAC,CAAC;YACpG,CAAC;YACD,OAAO;QACT,CAAC;QACD,iBAAiB;QACjB,kFAAkF;QAClF,8CAA8C;QAC9C,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,KAAK,cAAc,IAAI,MAAM,CAAC,SAAS,KAAK,qBAAqB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;QACpI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAClC,CAAC,CAAC;IAEF,6EAA6E;IAC7E,8EAA8E;IAC9E,+EAA+E;IAC/E,6EAA6E;IAC7E,YAAY,CAAC,GAAG,CAAC,SAAS,EAAE,aAAa,EAAE,CAAC,GAAY,EAAE,GAAa,EAAE,EAAE;QACzE,MAAM,KAAK,GAAG,OAAO,GAAG,CAAC,KAAK,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QACzE,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;YAClE,OAAO;QACT,CAAC;QACD,6CAA6C;QAC7C,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAChC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,2BAA2B,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,qBAAqB,SAAS,EAAE,CAAC,CAAC;YACtI,OAAO;QACT,CAAC;QACD,GAAG;aACA,MAAM,CAAC,GAAG,CAAC;aACX,IAAI,CAAC,MAAM,CAAC;aACZ,IAAI,CAAC,sBAAsB,CAAC,KAAK,EAAE,GAAG,qBAAqB,SAAS,CAAC,CAAC,CAAC;IAC5E,CAAC,CAAC,CAAC;IAEH,8EAA8E;IAC9E,4EAA4E;IAC5E,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE,aAAa,EAAE,UAAU,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;QACzH,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAuB,CAAC;QACpD,MAAM,KAAK,GACT,CAAC,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,IAAI,IAAI,CAAC,KAAK,CAAC;YAC9C,CAAC,OAAO,GAAG,CAAC,KAAK,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC/D,MAAM,SAAS,GAAG,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,MAAM,IAAI,GAAG,CAAC,EAAE,CAAC,kBAAkB,CAAC,KAAK,kBAAkB,CAAC;QAEnG,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;YAClE,OAAO;QACT,CAAC;QAED,6EAA6E;QAC7E,kFAAkF;QAClF,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC,KAAK,EAAE;YAC/C,SAAS,EAAE,GAAG,CAAC,EAAE;YACjB,SAAS,EAAE,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,SAAS;YAC7C,MAAM,EAAE,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,SAAS;SACvC,CAAC,CAAC;QACH,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;IAEH,6EAA6E;IAC7E,MAAM,mBAAmB,GAAG,MAAM,EAAE,CAAC;IAErC,mBAAmB,CAAC,IAAI,CAAC,SAAS,EAAE,aAAa,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;QAC/F,MAAM,YAAY,GAAG,GAAG,CAAC,WAAW,EAAE,UAAU,CAAC;QACjD,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,0BAA0B,EAAE,CAAC,CAAC;YAC5E,OAAO;QACT,CAAC;QAED,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAyC,CAAC;QACtE,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;YACvC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,uCAAuC,EAAE,CAAC,CAAC;YACzF,OAAO;QACT,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,YAAY,CACvC;YACE,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,QAAQ,EAAE,IAAI,CAAC,QAAQ;SACxB,EACD,YAAY,CACb,CAAC;QACF,0EAA0E;QAC1E,mCAAmC;QACnC,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,KAAK,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;QACnF,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAClC,CAAC,CAAC,CAAC;IAEH,OAAO,EAAE,YAAY,EAAE,mBAAmB,EAAE,CAAC;AAC/C,CAAC;AAED,sDAAsD;AACtD,MAAM,UAAU,sBAAsB,CAAC,SAAiB,EAAE,MAAuB;IAI/E,OAAO,sBAAsB,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;AACnD,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,yBAAyB;IACvC,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC;IACxB,MAAM,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC,IAAa,EAAE,GAAa,EAAE,EAAE;QACxD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;IAC/D,CAAC,CAAC,CAAC;IACH,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,yDAAyD;AACzD,MAAM,UAAU,yBAAyB;IACvC,OAAO,yBAAyB,EAAE,CAAC;AACrC,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,6BAA6B,CAAC,SAAiB,EAAE,MAAuB;IACtF,MAAM,IAAI,GAAG,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC1C,MAAM,cAAc,GAAuB;QACzC,IAAI,EAAE,YAAY;QAClB,IAAI,EAAE,YAAY;QAClB,MAAM,EAAE,SAAS;QACjB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,OAAO,EAAE,GAAG,IAAI,GAAG,oBAAoB,EAAE;KAC1C,CAAC;IAEF,IAAI,CAAC;QACH,UAAU,CAAC,aAAa,GAAG,UAAU,CAAC,aAAa,IAAI,EAAE,CAAC;QAC1D,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,YAAY,CAAC,EAAE,CAAC;YACnE,UAAU,CAAC,aAAa,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAChD,CAAC;QACD,MAAM,OAAO,GAAG,mBAAmB,CAAC,QAAQ,CAAC;QAC7C,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAC,cAAc,CAAC,cAAc,CAAC,CAAC,CAAC;QACrE,WAAW,CAAC,EAAE,OAAO,EAAE,iDAAiD,SAAS,WAAW,cAAc,CAAC,OAAO,GAAG,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9I,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,QAAQ,CAAC,iDAAiD,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC1G,CAAC;AACH,CAAC;AAED,6DAA6D;AAC7D,MAAM,UAAU,6BAA6B,CAAC,SAAiB,EAAE,MAAuB;IACtF,OAAO,6BAA6B,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;AAC1D,CAAC"}

package/dist/auth/magicLink/MagicLinkService.d.ts

@@ -32,9 +32,9 @@ export declare class MagicLinkService {
      * session JWT. Runs in the public (pre-auth) path, so it uses the global
      * provider and a configured provisioning context user.
      *
-     * Single-use is enforced by a compare-and-swap UPDATE ({@link consumeInvite})
-     * BEFORE the token is minted — two concurrent redemptions of a single-use
-     * link race on the same row and exactly one wins. The consume is the gate:
+     * Single-use is enforced by the guarded UPDATE inside the `spConsumeMagicLinkInvite`
+     * procedure ({@link consumeInvite}) BEFORE the token is minted — two concurrent
+     * redemptions of a single-use link race on the same row and exactly one wins. The consume is the gate:
      * if a later step fails, the use is already burned (fail-closed). That is the
      * correct trade-off for a single-use credential — burning a token on a server
      * error is recoverable (re-issue); allowing replay is not.
@@ -98,20 +98,22 @@ export declare class MagicLinkService {
     /** Idempotently ensures the role has CanAccess to the application (Application Role). */
     private ensureAppAccess;
     /**
-     * Atomically consumes one use of the invite via a compare-and-swap UPDATE.
-     * The WHERE clause re-checks every eligibility condition (Active, not
-     * exhausted, not expired) at the DB level, so the increment and the guard are
-     * a single atomic operation. Returns true ONLY when this call updated the row
-     * (won the race); concurrent redemptions of a single-use link see 0 rows.
+     * Atomically consumes one use of the invite with a single guarded UPDATE that re-checks every
+     * eligibility condition (Active, not exhausted, not expired) at the DB level, so the increment and
+     * the guard are one atomic operation. Concurrent redemptions of a single-use link race on the row
+     * and exactly one gets the row back.
      *
-     * Dialect-aware: SQL Server uses an `OUTPUT`-into-table-variable win-detect;
-     * PostgreSQL uses `UPDATE … WHERE … RETURNING` (the WHERE guard is itself the
-     * atomic single-use gate). The platform is read from the provider itself
-     * (`PlatformKey`), not from process env, so this is correct even under a
-     * non-default per-connection provider. The invite ID always binds as a
-     * parameter (`@p0` / `$1`), never interpolated.
+     * The statement differs per platform because the grants do:
+     * - **SQL Server** calls {@link CONSUME_INVITE_PROC} (`EXEC … @ID=@p0`). Runtime roles have
+     *   EXECUTE on procedures but no DML on base tables (#4753).
+     * - **PostgreSQL** runs {@link BuildConsumeInvitePostgresSQL}'s `UPDATE … RETURNING` directly.
+     *   Runtime roles hold table DML there, and no PG counterpart of the procedure exists.
+     * The ID is always a bound parameter.
      *
-     * Fail-closed: any DB error returns false and the redemption is rejected.
+     * Returns `'won'` (this call consumed a use), `'lost'` (the guard matched nothing: consumed,
+     * revoked or expired concurrently) or `'failed'` (the statement never ran — permissions, a missing
+     * procedure, a connection error). `'failed'` is kept distinct from `'lost'` on purpose: collapsing
+     * them is what made #4753's permission error surface to users as "already redeemed".
      */
     private consumeInvite;
     /** Pushes a freshly created user into the UserCache with its single role. */

package/dist/auth/magicLink/MagicLinkService.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"MagicLinkService.d.ts","sourceRoot":"","sources":["../../../src/auth/magicLink/MagicLinkService.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAGL,QAAQ,EAIR,KAAK,iBAAiB,EAEvB,MAAM,sBAAsB,CAAC;AAiB9B,OAAO,EAAc,KAAK,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAGnE,OAAO,KAAK,EACV,2BAA2B,EAC3B,2BAA2B,EAC3B,qBAAqB,EACrB,kBAAkB,EACnB,MAAM,YAAY,CAAC;AAkBpB;;;GAGG;AACH,qBAAa,gBAAgB;IAEzB,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,MAAM;gBADN,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,eAAe;IAG1C;;;;;;;OAOG;IACU,YAAY,CACvB,MAAM,EAAE,2BAA2B,EACnC,YAAY,EAAE,QAAQ,EACtB,QAAQ,CAAC,EAAE,iBAAiB,GAC3B,OAAO,CAAC,2BAA2B,CAAC;IAsFvC;;;;;;;;;;;;OAYG;IACU,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,kBAAkB,GAAG,OAAO,CAAC,qBAAqB,CAAC;IAmIvG;;;;;;;;;OASG;YACW,gBAAgB;IAoC9B;;;;;;;OAOG;YACW,yBAAyB;IA4BvC,gEAAgE;IAChE,OAAO,CAAC,uBAAuB;IAM/B,2CAA2C;IAC3C,OAAO,CAAC,kBAAkB;IAK1B;;;OAGG;YACW,aAAa;IAgD3B;;;;;;;OAOG;IACH,OAAO,CAAC,yBAAyB;IASjC;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,kBAAkB;IAY1B,yFAAyF;YAC3E,gBAAgB;IA+D9B,mFAAmF;YACrE,gBAAgB;IA4C9B,yFAAyF;YAC3E,eAAe;IA6B7B;;;;;;;;;;;;;;;OAeG;YACW,aAAa;IAqB3B,6EAA6E;IAC7E,OAAO,CAAC,eAAe;IAOvB;;;;OAIG;IACH,OAAO,CAAC,eAAe;IAQvB,mEAAmE;IACnE,OAAO,CAAC,8BAA8B;IAKtC,qFAAqF;YACvE,eAAe;CA0B9B"}
+{"version":3,"file":"MagicLinkService.d.ts","sourceRoot":"","sources":["../../../src/auth/magicLink/MagicLinkService.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAGL,QAAQ,EAIR,KAAK,iBAAiB,EAEvB,MAAM,sBAAsB,CAAC;AAiB9B,OAAO,EAAc,KAAK,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAGnE,OAAO,KAAK,EACV,2BAA2B,EAC3B,2BAA2B,EAC3B,qBAAqB,EACrB,kBAAkB,EACnB,MAAM,YAAY,CAAC;AAiCpB;;;GAGG;AACH,qBAAa,gBAAgB;IAEzB,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,MAAM;gBADN,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,eAAe;IAG1C;;;;;;;OAOG;IACU,YAAY,CACvB,MAAM,EAAE,2BAA2B,EACnC,YAAY,EAAE,QAAQ,EACtB,QAAQ,CAAC,EAAE,iBAAiB,GAC3B,OAAO,CAAC,2BAA2B,CAAC;IAsFvC;;;;;;;;;;;;OAYG;IACU,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,kBAAkB,GAAG,OAAO,CAAC,qBAAqB,CAAC;IAuIvG;;;;;;;;;OASG;YACW,gBAAgB;IAoC9B;;;;;;;OAOG;YACW,yBAAyB;IA4BvC,gEAAgE;IAChE,OAAO,CAAC,uBAAuB;IAM/B,2CAA2C;IAC3C,OAAO,CAAC,kBAAkB;IAK1B;;;OAGG;YACW,aAAa;IAgD3B;;;;;;;OAOG;IACH,OAAO,CAAC,yBAAyB;IASjC;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,kBAAkB;IAY1B,yFAAyF;YAC3E,gBAAgB;IA+D9B,mFAAmF;YACrE,gBAAgB;IA4C9B,yFAAyF;YAC3E,eAAe;IA6B7B;;;;;;;;;;;;;;;;;OAiBG;YACW,aAAa;IAmB3B,6EAA6E;IAC7E,OAAO,CAAC,eAAe;IAOvB;;;;OAIG;IACH,OAAO,CAAC,eAAe;IAQvB,mEAAmE;IACnE,OAAO,CAAC,8BAA8B;IAKtC,qFAAqF;YACvE,eAAe;CA0B9B"}

package/dist/auth/magicLink/MagicLinkService.js

@@ -14,11 +14,21 @@ import { CommunicationEngine } from '@memberjunction/communication-engine';
 import { Message } from '@memberjunction/communication-types';
 import { configInfo } from '../../config.js';
 import { MagicLinkKeyManager } from './MagicLinkKeys.js';
-import { generateRawToken, generateSessionId, hashToken, evaluateInvite, buildSessionClaims, buildConsumeInviteSQL, canIssueInvites, isRoleGrantable, MAGIC_LINK_TOKEN_PREFIX } from './magicLinkCore.js';
+import { GenerateRawToken, GenerateSessionId, HashToken, EvaluateInvite, BuildSessionClaims, BuildConsumeInvitePostgresSQL, CanIssueInvites, IsRoleGrantable, MAGIC_LINK_TOKEN_PREFIX } from './magicLinkCore.js';
 const INVITE_ENTITY = 'MJ: Magic Link Invites';
 const REDEMPTION_ENTITY = 'MJ: Magic Link Redemptions';
 /** Shared Anonymous principal — seeded by the Phase-4 migration; must match that UUID. */
 const ANONYMOUS_USER_ID = '273910DF-28F1-45C1-A8F8-6E9AD8E5F008';
+/**
+ * The SQL Server guarded single-use procedure (migration V202609291627__v6.2.x__MagicLink_Consume_Invite_Sproc).
+ * A procedure, not raw DML, because on SQL Server MJ grants its runtime roles EXECUTE on procedures
+ * and SELECT on views — never DML on base tables — so on any host whose MJAPI login is not db_owner
+ * a raw UPDATE is refused (#4753). Ownership chaining lets the procedure update the table on the
+ * caller's behalf. PostgreSQL has no counterpart function; see {@link BuildConsumeInvitePostgresSQL}.
+ */
+const CONSUME_INVITE_PROC = 'spConsumeMagicLinkInvite';
+/** MagicLinkInvite base table (core schema) — the PostgreSQL consume updates it directly. */
+const INVITE_TABLE = 'MagicLinkInvite';
 /**
  * Magic-link service. One instance per server, constructed with the resolved
  * public URL and the validated config.
@@ -44,10 +54,10 @@ export class MagicLinkService {
             // external user already holding a restricted magic-link session — could
             // issue invites and escalate.
             const callerRoleNames = (creatingUser.UserRoles ?? []).map((r) => r.Role).filter((n) => !!n);
-            if (!canIssueInvites(creatingUser.Type, callerRoleNames, this.config.inviteIssuerRoleNames)) {
+            if (!CanIssueInvites(creatingUser.Type, callerRoleNames, this.config.inviteIssuerRoleNames)) {
                 return { success: false, errorCode: 'forbidden', error: 'Not authorized to issue magic-link invites.' };
             }
-            const roleId = params.roleId ?? this.resolveRestrictedRoleId(md);
+            const roleId = params.RoleId ?? this.resolveRestrictedRoleId(md);
             if (!roleId) {
                 return { success: false, error: `Restricted role '${this.config.restrictedRoleName}' not found and no roleId supplied.` };
             }
@@ -58,28 +68,28 @@ export class MagicLinkService {
             if (!roleToGrant) {
                 return { success: false, errorCode: 'invalid_role', error: `Role '${roleId}' not found.` };
             }
-            if (!isRoleGrantable(roleToGrant.Name, this.config.restrictedRoleName, this.config.grantableRoleNames)) {
+            if (!IsRoleGrantable(roleToGrant.Name, this.config.restrictedRoleName, this.config.grantableRoleNames)) {
                 return {
                     success: false,
                     errorCode: 'invalid_role',
                     error: `Role '${roleToGrant.Name}' is not grantable via magic-link. Add it to magicLink.grantableRoleNames to allow it.`,
                 };
             }
-            const app = md.Applications.find((a) => UUIDsEqual(a.ID, params.applicationId));
+            const app = md.Applications.find((a) => UUIDsEqual(a.ID, params.ApplicationId));
             if (!app) {
-                return { success: false, error: `Application '${params.applicationId}' not found.` };
+                return { success: false, error: `Application '${params.ApplicationId}' not found.` };
             }
-            const rawToken = generateRawToken();
-            const expiresInHours = params.expiresInHours ?? this.config.defaultExpiresInHours;
+            const rawToken = GenerateRawToken();
+            const expiresInHours = params.ExpiresInHours ?? this.config.defaultExpiresInHours;
             const expiresAt = new Date(Date.now() + expiresInHours * 3600 * 1000);
             const invite = await md.GetEntityObject(INVITE_ENTITY, creatingUser);
             invite.NewRecord();
-            invite.TokenHash = hashToken(rawToken);
+            invite.TokenHash = HashToken(rawToken);
             invite.Email = params.email;
-            invite.ApplicationID = params.applicationId;
+            invite.ApplicationID = params.ApplicationId;
             invite.RoleID = roleId;
             invite.ExpiresAt = expiresAt;
-            invite.MaxUses = params.maxUses ?? 1;
+            invite.MaxUses = params.MaxUses ?? 1;
             invite.UseCount = 0;
             invite.CreatedByUserID = creatingUser.ID;
             invite.Status = 'Active';
@@ -90,7 +100,7 @@ export class MagicLinkService {
             // the single ApplicationID/RoleID. Additive — the columns stay authoritative for
             // redemption today; this populates the child tables for the eventual switch to
             // multi-scope reads. Best-effort so a child-row hiccup never fails issuance.
-            await this.writeInviteScopeChildRows(invite.ID, params.applicationId, roleId, creatingUser, md);
+            await this.writeInviteScopeChildRows(invite.ID, params.ApplicationId, roleId, creatingUser, md);
             const redemptionUrl = this.buildRedemptionUrl(rawToken);
             let emailSent = false;
             if (this.config.communicationProvider) {
@@ -117,9 +127,9 @@ export class MagicLinkService {
      * session JWT. Runs in the public (pre-auth) path, so it uses the global
      * provider and a configured provisioning context user.
      *
-     * Single-use is enforced by a compare-and-swap UPDATE ({@link consumeInvite})
-     * BEFORE the token is minted — two concurrent redemptions of a single-use
-     * link race on the same row and exactly one wins. The consume is the gate:
+     * Single-use is enforced by the guarded UPDATE inside the `spConsumeMagicLinkInvite`
+     * procedure ({@link consumeInvite}) BEFORE the token is minted — two concurrent
+     * redemptions of a single-use link race on the same row and exactly one wins. The consume is the gate:
      * if a later step fails, the use is already burned (fail-closed). That is the
      * correct trade-off for a single-use credential — burning a token on a server
      * error is recoverable (re-issue); allowing replay is not.
@@ -148,7 +158,7 @@ export class MagicLinkService {
             // global-provider-ok: redemption runs in the pre-auth flow, no per-request provider yet
             const md = Metadata.Provider; // global-provider-ok: server-side magic-link service; runs under the server's single default provider
             const provider = md;
-            const tokenHash = hashToken(rawToken);
+            const tokenHash = HashToken(rawToken);
             const rv = new RunView();
             const found = await rv.RunView({
                 EntityName: INVITE_ENTITY,
@@ -166,7 +176,7 @@ export class MagicLinkService {
             inviteId = invite.ID;
             // Fast, friendly pre-check (returns a precise reason). NOT the authority —
             // the atomic consume below is what actually enforces single-use.
-            const eligibility = evaluateInvite(invite, Date.now());
+            const eligibility = EvaluateInvite(invite, Date.now());
             if (!eligibility.ok) {
                 return done({ success: false, errorCode: eligibility.errorCode, error: `Invite is ${eligibility.errorCode}.` });
             }
@@ -184,14 +194,18 @@ export class MagicLinkService {
                 LogError(`[MagicLink] Invite ${invite.ID} references missing role ${invite.RoleID}.`);
                 return done({ success: false, errorCode: 'server_error', error: 'Invite role not found.' });
             }
-            // Atomic consume BEFORE minting. If we lose the race (0 rows updated), the
-            // invite was concurrently consumed/expired — re-evaluate the now-stale
-            // in-memory copy only to surface a precise code; default to 'consumed'.
-            if (!(await this.consumeInvite(invite, provider, contextUser))) {
+            // Atomic consume BEFORE minting. A statement that never ran (permissions,
+            // missing procedure, connection) is a server fault, not a lost race — report
+            // it as such so operators aren't sent hunting a double-redeem (#4753).
+            const consume = await this.consumeInvite(invite, provider, contextUser);
+            if (consume === 'failed') {
+                return done({ success: false, errorCode: 'server_error', error: 'Could not redeem the invite due to a server error.' });
+            }
+            if (consume === 'lost') {
                 // Lost the race or the invite expired between the pre-check and the
                 // consume. The in-memory copy still looks eligible if only the DB-side
                 // use count changed, so default that case to 'consumed'.
-                const recheck = evaluateInvite(invite, Date.now());
+                const recheck = EvaluateInvite(invite, Date.now());
                 return done({ success: false, errorCode: recheck.ok ? 'consumed' : recheck.errorCode, error: 'Invite already redeemed or expired.' });
             }
             const provision = await this.provisionUser(invite, role, contextUser);
@@ -203,7 +217,7 @@ export class MagicLinkService {
             provisionedUserId = provision.userId;
             const nowSeconds = Math.floor(Date.now() / 1000);
             const isAnon = invite.IdentityMode === 'anonymous';
-            const claims = buildSessionClaims({
+            const claims = BuildSessionClaims({
                 issuer: this.publicUrl,
                 audience: this.config.audience,
                 inviteId: invite.ID,
@@ -216,7 +230,7 @@ export class MagicLinkService {
                 anonymous: isAnon,
                 // Per-session id for anon forensics (correlates one session's activity since all
                 // anon redemptions share the Anonymous principal). Carried into the redemption audit row.
-                sessionId: isAnon ? generateSessionId() : undefined,
+                sessionId: isAnon ? GenerateSessionId() : undefined,
                 // Resource-share scope (Phase 5): the single shared resource this link grants.
                 resourceId: invite.ResourceID ?? undefined,
                 nowSeconds,
@@ -523,40 +537,40 @@ export class MagicLinkService {
         }
     }
     /**
-     * Atomically consumes one use of the invite via a compare-and-swap UPDATE.
-     * The WHERE clause re-checks every eligibility condition (Active, not
-     * exhausted, not expired) at the DB level, so the increment and the guard are
-     * a single atomic operation. Returns true ONLY when this call updated the row
-     * (won the race); concurrent redemptions of a single-use link see 0 rows.
+     * Atomically consumes one use of the invite with a single guarded UPDATE that re-checks every
+     * eligibility condition (Active, not exhausted, not expired) at the DB level, so the increment and
+     * the guard are one atomic operation. Concurrent redemptions of a single-use link race on the row
+     * and exactly one gets the row back.
      *
-     * Dialect-aware: SQL Server uses an `OUTPUT`-into-table-variable win-detect;
-     * PostgreSQL uses `UPDATE … WHERE … RETURNING` (the WHERE guard is itself the
-     * atomic single-use gate). The platform is read from the provider itself
-     * (`PlatformKey`), not from process env, so this is correct even under a
-     * non-default per-connection provider. The invite ID always binds as a
-     * parameter (`@p0` / `$1`), never interpolated.
+     * The statement differs per platform because the grants do:
+     * - **SQL Server** calls {@link CONSUME_INVITE_PROC} (`EXEC … @ID=@p0`). Runtime roles have
+     *   EXECUTE on procedures but no DML on base tables (#4753).
+     * - **PostgreSQL** runs {@link BuildConsumeInvitePostgresSQL}'s `UPDATE … RETURNING` directly.
+     *   Runtime roles hold table DML there, and no PG counterpart of the procedure exists.
+     * The ID is always a bound parameter.
      *
-     * Fail-closed: any DB error returns false and the redemption is rejected.
+     * Returns `'won'` (this call consumed a use), `'lost'` (the guard matched nothing: consumed,
+     * revoked or expired concurrently) or `'failed'` (the statement never ran — permissions, a missing
+     * procedure, a connection error). `'failed'` is kept distinct from `'lost'` on purpose: collapsing
+     * them is what made #4753's permission error surface to users as "already redeemed".
      */
     async consumeInvite(invite, provider, contextUser) {
+        const isPg = provider.PlatformKey === 'postgresql';
+        const statement = isPg ? `PostgreSQL guarded UPDATE on ${INVITE_TABLE}` : CONSUME_INVITE_PROC;
         try {
-            const entityInfo = provider.EntityByName(INVITE_ENTITY);
-            if (!entityInfo) {
-                LogError(`[MagicLink] Entity metadata for '${INVITE_ENTITY}' not found; cannot consume invite.`);
-                return false;
-            }
-            const isPg = provider.PlatformKey === 'postgresql';
-            // PG identifiers are auto-quoted by PostgreSQLDataProvider.ExecuteSQL, so
-            // pass the bare `schema.table`; SQL Server takes the bracket-quoted form.
-            const table = isPg ? `${entityInfo.SchemaName}.${entityInfo.BaseTable}` : `[${entityInfo.SchemaName}].[${entityInfo.BaseTable}]`;
-            // OUTPUT/RETURNING yields one row iff the WHERE matched — the atomic single-use gate.
-            const sql = buildConsumeInviteSQL(table, isPg ? 'postgresql' : 'sqlserver');
-            const rows = await provider.ExecuteSQL(sql, [invite.ID], { isMutation: true }, contextUser);
-            return Array.isArray(rows) && rows.length === 1;
+            const sql = isPg
+                ? BuildConsumeInvitePostgresSQL(`${provider.MJCoreSchemaName}.${INVITE_TABLE}`)
+                : provider.Dialect.ProcedureCallSyntax(provider.MJCoreSchemaName, CONSUME_INVITE_PROC, [`@ID=${provider.BuildParameterPlaceholder(0)}`]);
+            const rows = await provider.ExecuteSQL(sql, [invite.ID], { isMutation: true, description: `MagicLink ${statement}` }, contextUser);
+            if (!Array.isArray(rows)) {
+                LogError(`[MagicLink] ${statement} returned no result set for invite ${invite.ID}; treating the consume as failed.`);
+                return 'failed';
+            }
+            return rows.length === 1 ? 'won' : 'lost';
         }
         catch (e) {
-            LogError(`[MagicLink] Atomic consume failed for invite ${invite.ID}: ${e instanceof Error ? e.message : String(e)}`);
-            return false;
+            LogError(`[MagicLink] ${statement} FAILED for invite ${invite.ID} — the statement never ran, so this is NOT a lost race: ${e instanceof Error ? e.message : String(e)}`);
+            return 'failed';
         }
     }
     /** Pushes a freshly created user into the UserCache with its single role. */