@memberjunction/server 6.2.0-edge.0 → 6.2.0-edge.1

package/src/__tests__/serverExtensionReservedRoots.test.ts

@@ -11,7 +11,7 @@ import { fileURLToPath } from 'node:url';
 import {
     CORE_CONSTANT_RESERVED_SERVER_EXTENSION_ROOTS,
     CORE_STATIC_RESERVED_SERVER_EXTENSION_ROOTS,
-    coreReservedServerExtensionRoots,
+    CoreReservedServerExtensionRoots,
 } from '../serverExtensionReservedRoots.js';
 import { validateServerExtensionRootPath } from '@memberjunction/server-extensions-core';
 
@@ -58,12 +58,12 @@ describe('coreReservedServerExtensionRoots', () => {
 
     it('structurally guarantees every pre-auth app.use / app.get / app.post mount in index.ts is reserved', () => {
         const indexSrc = readFileSync(join(SRC, 'index.ts'), 'utf8');
-        const authMiddlewareIndex = indexSrc.indexOf('app.use(createUnifiedAuthMiddleware');
+        const authMiddlewareIndex = indexSrc.indexOf('app.use(CreateUnifiedAuthMiddleware');
         expect(authMiddlewareIndex).toBeGreaterThan(0);
         const preAuthSrc = indexSrc.substring(0, authMiddlewareIndex);
 
         const mountRegex = /app\.(?:use|get|post)\s*\(\s*([^,\s)]+)/g;
-        const reservedRoots = coreReservedServerExtensionRoots('/');
+        const reservedRoots = CoreReservedServerExtensionRoots('/');
 
         // Explicit allowlist of known non-path middleware mounts (e.g. app.use(mw), app.use(cors()), app.use(compression(...)))
         const knownNonPathTokens = [
@@ -71,7 +71,7 @@ describe('coreReservedServerExtensionRoots', () => {
             'express.',
             'compression',
             'cookieParser',
-            'createUnifiedAuthMiddleware',
+            'CreateUnifiedAuthMiddleware',
             'mw',
         ];
         const isKnownNonPath = (t: string): boolean =>
@@ -120,7 +120,7 @@ describe('coreReservedServerExtensionRoots', () => {
     });
 
     it('includes graphqlRootPath and every core mount', () => {
-        const roots = coreReservedServerExtensionRoots('/api');
+        const roots = CoreReservedServerExtensionRoots('/api');
         expect(roots).toEqual(
             expect.arrayContaining([
                 '/api',
@@ -139,7 +139,7 @@ describe('coreReservedServerExtensionRoots', () => {
     });
 
     it('closes the F-M2 bypasses: cased /auth and sibling /healthcheck', () => {
-        const extra = coreReservedServerExtensionRoots('/');
+        const extra = CoreReservedServerExtensionRoots('/');
         expect(validateServerExtensionRootPath('/Auth', extra)).toMatch(/reserved prefix/);
         expect(validateServerExtensionRootPath('/healthcheck', extra)).toMatch(/reserved prefix/);
         expect(validateServerExtensionRootPath('/Healthcheck', extra)).toMatch(/reserved prefix/);
@@ -156,7 +156,7 @@ describe('coreReservedServerExtensionRoots', () => {
     });
 
     it('reserves a non-default graphqlRootPath and its nested paths', () => {
-        const extra = coreReservedServerExtensionRoots('/api');
+        const extra = CoreReservedServerExtensionRoots('/api');
         expect(validateServerExtensionRootPath('/api', extra)).toMatch(/reserved prefix/);
         expect(validateServerExtensionRootPath('/api/graphql', extra)).toMatch(/reserved prefix/);
         expect(validateServerExtensionRootPath('/apiv2', extra)).toBeNull();

package/src/__tests__/subscriptionRedaction.test.ts

@@ -45,7 +45,7 @@ vi.mock('../config.js', () => ({
   },
 }));
 
-import { variablesLoggingMiddleware } from '../logging/variablesLoggingMiddleware.js';
+import { VariablesLoggingMiddleware } from '../logging/variablesLoggingMiddleware.js';
 
 /**
  * Build a synthetic GraphQLResolveInfo-shaped object that matches what type-graphql passes
@@ -99,7 +99,7 @@ describe('variablesLoggingMiddleware', () => {
 
   it('skips field resolvers (info.path.prev !== undefined) without logging', async () => {
     const next = vi.fn(async () => 'next-result');
-    const result = await variablesLoggingMiddleware(
+    const result = await VariablesLoggingMiddleware(
       {
         root: undefined,
         args: { x: 1 },
@@ -126,7 +126,7 @@ describe('variablesLoggingMiddleware', () => {
       ],
     };
 
-    await variablesLoggingMiddleware(
+    await VariablesLoggingMiddleware(
       {
         root: undefined,
         args: { input: { ID: 'abc', Name: 'HubSpot', Values: 'FAKE_SECRET' } },
@@ -165,7 +165,7 @@ describe('variablesLoggingMiddleware', () => {
       Entities: [{ ClassName: 'SomeUnrelatedEntity', EncryptedFields: [] }],
     };
 
-    await variablesLoggingMiddleware(
+    await VariablesLoggingMiddleware(
       {
         root: undefined,
         args: { token: 'plaintext-leak' },
@@ -196,7 +196,7 @@ describe('variablesLoggingMiddleware', () => {
     const next = vi.fn(async () => undefined);
     const fakeProvider = { Entities: [] };
 
-    await variablesLoggingMiddleware(
+    await VariablesLoggingMiddleware(
       {
         root: undefined,
         args: { input: { Values: 'FAKE_SECRET' } },

package/src/__tests__/unifiedAuth.test.ts

@@ -59,16 +59,22 @@ vi.mock('jsonwebtoken', () => ({
 }));
 
 vi.mock('../auth/index.js', () => ({
-  getSigningKeys: mockGetSigningKeys,
-  getSystemUser: vi.fn(),
-  getValidationOptions: mockGetValidationOptions,
-  verifyUserRecord: mockVerifyUserRecord,
-  extractUserInfoFromPayload: mockExtractUserInfo,
+  GetSigningKeys: mockGetSigningKeys,
+    get getSigningKeys() { return this.GetSigningKeys; },
+  GetSystemUser: vi.fn(),
+    get getSystemUser() { return this.GetSystemUser; },
+  GetValidationOptions: mockGetValidationOptions,
+    get getValidationOptions() { return this.GetValidationOptions; },
+  VerifyUserRecord: mockVerifyUserRecord,
+    get verifyUserRecord() { return this.VerifyUserRecord; },
+  ExtractUserInfoFromPayload: mockExtractUserInfo,
+    get extractUserInfoFromPayload() { return this.ExtractUserInfoFromPayload; },
 }));
 
 vi.mock('../cache.js', () => {
   const map = new Map<string, boolean>();
-  return { authCache: map };
+  return { AuthCache: map,
+    get authCache() { return this.AuthCache; } };
 });
 
 vi.mock('../config.js', () => ({
@@ -95,7 +101,7 @@ vi.mock('@memberjunction/api-keys', () => ({
   GetAPIKeyEngine: vi.fn(),
 }));
 
-import { createUnifiedAuthMiddleware } from '../context.js';
+import { CreateUnifiedAuthMiddleware } from '../context.js';
 import type { Request, Response, NextFunction } from 'express';
 import type { DataSourceInfo } from '../types.js';
 
@@ -178,11 +184,11 @@ function setupSuccessfulAuth() {
 // ─── Tests ──────────────────────────────────────────────────────────────────
 
 describe('createUnifiedAuthMiddleware', () => {
-  let middleware: ReturnType<typeof createUnifiedAuthMiddleware>;
+  let middleware: ReturnType<typeof CreateUnifiedAuthMiddleware>;
 
   beforeEach(() => {
     vi.clearAllMocks();
-    middleware = createUnifiedAuthMiddleware(mockDataSources);
+    middleware = CreateUnifiedAuthMiddleware(mockDataSources);
   });
 
   describe('OPTIONS passthrough', () => {

package/src/__tests__/visitorIdentity.resolve.test.ts

@@ -13,7 +13,7 @@ vi.mock('@memberjunction/core', async (importOriginal) => {
     };
 });
 
-import { resolveIdentityByEmail } from '../realtimeWidget/visitorIdentity.js';
+import { ResolveIdentityByEmail } from '../realtimeWidget/visitorIdentity.js';
 import type { EntityInfo, IMetadataProvider, UserInfo } from '@memberjunction/core';
 
 type LookupParams = { EntityName: string; ExtraFilter: string; Fields: string[] };
@@ -32,7 +32,7 @@ describe('resolveIdentityByEmail — the configured identity entity can have ANY
     it('selects the real key column and returns its bare value for a single non-ID key', async () => {
         runViewMock.mockResolvedValue({ Success: true, Results: [{ individual_id: 4711 }] });
         const provider = makeProvider({ ID: 'ent-persons', PrimaryKeys: [{ Name: 'individual_id' }] });
-        const out = await resolveIdentityByEmail('ada@example.com', user, provider, { entityName: 'Persons', emailField: 'EmailAddress' });
+        const out = await ResolveIdentityByEmail('ada@example.com', user, provider, { entityName: 'Persons', EmailField: 'EmailAddress' });
         expect(lastParams().Fields).toEqual(['individual_id']);
         expect(lastParams().ExtraFilter).toBe("EmailAddress = 'ada@example.com'");
         expect(out).toEqual({ entityId: 'ent-persons', recordId: '4711' });
@@ -41,7 +41,7 @@ describe('resolveIdentityByEmail — the configured identity entity can have ANY
     it('selects EVERY key column and carries a composite key as a full segment, not its first column', async () => {
         runViewMock.mockResolvedValue({ Success: true, Results: [{ OrderID: '11055', LineNo: 3 }] });
         const provider = makeProvider({ ID: 'ent-lines', PrimaryKeys: [{ Name: 'OrderID' }, { Name: 'LineNo' }] });
-        const out = await resolveIdentityByEmail('x@y.com', user, provider, { entityName: 'Order Lines' });
+        const out = await ResolveIdentityByEmail('x@y.com', user, provider, { entityName: 'Order Lines' });
         expect(lastParams().Fields).toEqual(['OrderID', 'LineNo']);
         expect(out).toEqual({ entityId: 'ent-lines', recordId: 'OrderID|11055||LineNo|3' });
     });
@@ -49,13 +49,13 @@ describe('resolveIdentityByEmail — the configured identity entity can have ANY
     it('stays anonymous when no row matches or a key column is null', async () => {
         const provider = makeProvider({ ID: 'ent-users', PrimaryKeys: [{ Name: 'ID' }] });
         runViewMock.mockResolvedValue({ Success: true, Results: [] });
-        expect(await resolveIdentityByEmail('none@y.com', user, provider)).toBeUndefined();
+        expect(await ResolveIdentityByEmail('none@y.com', user, provider)).toBeUndefined();
         runViewMock.mockResolvedValue({ Success: true, Results: [{ ID: null }] });
-        expect(await resolveIdentityByEmail('null@y.com', user, provider)).toBeUndefined();
+        expect(await ResolveIdentityByEmail('null@y.com', user, provider)).toBeUndefined();
     });
 
     it('stays anonymous when the configured entity is not in metadata', async () => {
-        expect(await resolveIdentityByEmail('a@b.com', user, makeProvider(undefined), { entityName: 'Nope' })).toBeUndefined();
+        expect(await ResolveIdentityByEmail('a@b.com', user, makeProvider(undefined), { entityName: 'Nope' })).toBeUndefined();
         expect(runViewMock).not.toHaveBeenCalled();
     });
 });

package/src/__tests__/widget.test.ts

@@ -2,32 +2,32 @@ import { describe, it, expect } from 'vitest';
 import jwt from 'jsonwebtoken';
 import { createPublicKey } from 'node:crypto';
 import {
-  parseAllowedOrigins,
-  isOriginAllowed,
-  isModalityEnabled,
-  evaluateWidgetMint,
-  buildWidgetGuestClaims,
-  looksLikeBot,
+  ParseAllowedOrigins,
+  IsOriginAllowed,
+  IsModalityEnabled,
+  EvaluateWidgetMint,
+  BuildWidgetGuestClaims,
+  LooksLikeBot,
 } from '../realtimeWidget/widgetCore.js';
 import { MagicLinkKeyManager } from '../auth/magicLink/MagicLinkKeys.js';
 
 describe('widget core — parseAllowedOrigins', () => {
   it('parses a JSON array of origins', () => {
-    expect(parseAllowedOrigins('["https://a.com","https://b.com"]')).toEqual(['https://a.com', 'https://b.com']);
+    expect(ParseAllowedOrigins('["https://a.com","https://b.com"]')).toEqual(['https://a.com', 'https://b.com']);
   });
 
   it('tolerates a comma-separated string', () => {
-    expect(parseAllowedOrigins('https://a.com, https://b.com')).toEqual(['https://a.com', 'https://b.com']);
+    expect(ParseAllowedOrigins('https://a.com, https://b.com')).toEqual(['https://a.com', 'https://b.com']);
   });
 
   it('normalizes case and strips trailing slashes', () => {
-    expect(parseAllowedOrigins('["HTTPS://Acme.COM/"]')).toEqual(['https://acme.com']);
+    expect(ParseAllowedOrigins('["HTTPS://Acme.COM/"]')).toEqual(['https://acme.com']);
   });
 
   it('returns empty (fail-closed) for null / blank / non-array JSON', () => {
-    expect(parseAllowedOrigins(null)).toEqual([]);
-    expect(parseAllowedOrigins('   ')).toEqual([]);
-    expect(parseAllowedOrigins('{"not":"an-array"}')).toEqual([]);
+    expect(ParseAllowedOrigins(null)).toEqual([]);
+    expect(ParseAllowedOrigins('   ')).toEqual([]);
+    expect(ParseAllowedOrigins('{"not":"an-array"}')).toEqual([]);
   });
 });
 
@@ -35,37 +35,37 @@ describe('widget core — isOriginAllowed (fail-closed)', () => {
   const allowed = ['https://acme.com', 'https://www.acme.com'];
 
   it('accepts an exact (normalized) match', () => {
-    expect(isOriginAllowed('https://acme.com', allowed)).toBe(true);
-    expect(isOriginAllowed('HTTPS://ACME.COM/', allowed)).toBe(true);
+    expect(IsOriginAllowed('https://acme.com', allowed)).toBe(true);
+    expect(IsOriginAllowed('HTTPS://ACME.COM/', allowed)).toBe(true);
   });
 
   it('rejects a non-listed origin', () => {
-    expect(isOriginAllowed('https://evil.com', allowed)).toBe(false);
-    expect(isOriginAllowed('https://sub.acme.com', allowed)).toBe(false);
+    expect(IsOriginAllowed('https://evil.com', allowed)).toBe(false);
+    expect(IsOriginAllowed('https://sub.acme.com', allowed)).toBe(false);
   });
 
   it('rejects a missing request origin', () => {
-    expect(isOriginAllowed(undefined, allowed)).toBe(false);
-    expect(isOriginAllowed('', allowed)).toBe(false);
+    expect(IsOriginAllowed(undefined, allowed)).toBe(false);
+    expect(IsOriginAllowed('', allowed)).toBe(false);
   });
 
   it('rejects everything when the allowlist is empty (never "*")', () => {
-    expect(isOriginAllowed('https://acme.com', [])).toBe(false);
+    expect(IsOriginAllowed('https://acme.com', [])).toBe(false);
   });
 });
 
 describe('widget core — isModalityEnabled', () => {
   it('Both enables text and voice', () => {
-    expect(isModalityEnabled('Both', 'Text')).toBe(true);
-    expect(isModalityEnabled('Both', 'Voice')).toBe(true);
+    expect(IsModalityEnabled('Both', 'Text')).toBe(true);
+    expect(IsModalityEnabled('Both', 'Voice')).toBe(true);
   });
   it('Text enables only text', () => {
-    expect(isModalityEnabled('Text', 'Text')).toBe(true);
-    expect(isModalityEnabled('Text', 'Voice')).toBe(false);
+    expect(IsModalityEnabled('Text', 'Text')).toBe(true);
+    expect(IsModalityEnabled('Text', 'Voice')).toBe(false);
   });
   it('Voice enables only voice', () => {
-    expect(isModalityEnabled('Voice', 'Voice')).toBe(true);
-    expect(isModalityEnabled('Voice', 'Text')).toBe(false);
+    expect(IsModalityEnabled('Voice', 'Voice')).toBe(true);
+    expect(IsModalityEnabled('Voice', 'Text')).toBe(false);
   });
 });
 
@@ -73,22 +73,22 @@ describe('widget core — evaluateWidgetMint', () => {
   const base = { Status: 'Active', AllowedOrigins: '["https://acme.com"]', Modality: 'Both' };
 
   it('passes for an active widget from an allowed origin', () => {
-    expect(evaluateWidgetMint(base, 'https://acme.com')).toEqual({ ok: true });
+    expect(EvaluateWidgetMint(base, 'https://acme.com')).toEqual({ ok: true });
   });
 
   it('rejects a disabled widget', () => {
-    expect(evaluateWidgetMint({ ...base, Status: 'Disabled' }, 'https://acme.com')).toEqual({
+    expect(EvaluateWidgetMint({ ...base, Status: 'Disabled' }, 'https://acme.com')).toEqual({
       ok: false,
       errorCode: 'disabled',
     });
   });
 
   it('rejects a disallowed origin', () => {
-    expect(evaluateWidgetMint(base, 'https://evil.com')).toEqual({ ok: false, errorCode: 'origin_not_allowed' });
+    expect(EvaluateWidgetMint(base, 'https://evil.com')).toEqual({ ok: false, errorCode: 'origin_not_allowed' });
   });
 
   it('rejects a missing origin (fail-closed)', () => {
-    expect(evaluateWidgetMint(base, undefined)).toEqual({ ok: false, errorCode: 'origin_not_allowed' });
+    expect(EvaluateWidgetMint(base, undefined)).toEqual({ ok: false, errorCode: 'origin_not_allowed' });
   });
 });
 
@@ -106,14 +106,14 @@ describe('widget core — buildWidgetGuestClaims', () => {
   };
 
   it('marks the session anonymous + magic-link and binds the widget id', () => {
-    const claims = buildWidgetGuestClaims(args);
+    const claims = BuildWidgetGuestClaims(args);
     expect(claims.mj_anon).toBe(true);
     expect(claims.mj_magic_link).toBe(true);
     expect(claims.mj_widget_id).toBe('WIDGET-123');
   });
 
   it('scopes to the application + guest role and the configured anon email', () => {
-    const claims = buildWidgetGuestClaims(args);
+    const claims = BuildWidgetGuestClaims(args);
     expect(claims.mj_app_id).toBe('APP-1');
     expect(claims.mj_role).toBe('Widget Guest');
     expect(claims.email).toBe('anonymous@magic-link.local');
@@ -122,13 +122,13 @@ describe('widget core — buildWidgetGuestClaims', () => {
   });
 
   it('carries a single scope entry for the guest grant', () => {
-    const claims = buildWidgetGuestClaims(args);
+    const claims = BuildWidgetGuestClaims(args);
     expect(claims.mj_scopes).toHaveLength(1);
     expect(claims.mj_scopes?.[0]).toMatchObject({ appId: 'APP-1', role: 'Widget Guest' });
   });
 
   it('sets exp = iat + ttl', () => {
-    const claims = buildWidgetGuestClaims(args);
+    const claims = BuildWidgetGuestClaims(args);
     expect(claims.iat).toBe(1_000_000);
     expect(claims.exp).toBe(1_000_900);
   });
@@ -139,7 +139,7 @@ describe('widget core — RS256 sign + verify roundtrip (reuses MagicLinkKeyMana
     const km = MagicLinkKeyManager.Instance;
     km.Initialize(); // ephemeral keypair (idempotent if already initialized in-process)
 
-    const claims = buildWidgetGuestClaims({
+    const claims = BuildWidgetGuestClaims({
       issuer: 'https://mj.example.com',
       audience: 'mj-magic-link',
       widgetId: 'WIDGET-XYZ',
@@ -164,7 +164,7 @@ describe('widget core — RS256 sign + verify roundtrip (reuses MagicLinkKeyMana
   it('rejects a tampered widget token', () => {
     const km = MagicLinkKeyManager.Instance;
     km.Initialize();
-    const claims = buildWidgetGuestClaims({
+    const claims = BuildWidgetGuestClaims({
       issuer: 'https://mj.example.com',
       audience: 'mj-magic-link',
       widgetId: 'W',
@@ -184,21 +184,21 @@ describe('widget core — RS256 sign + verify roundtrip (reuses MagicLinkKeyMana
 
 describe('widget core — looksLikeBot (W6 mint heuristic)', () => {
   it('flags a missing / blank user-agent as a bot', () => {
-    expect(looksLikeBot(undefined)).toBe(true);
-    expect(looksLikeBot(null)).toBe(true);
-    expect(looksLikeBot('   ')).toBe(true);
+    expect(LooksLikeBot(undefined)).toBe(true);
+    expect(LooksLikeBot(null)).toBe(true);
+    expect(LooksLikeBot('   ')).toBe(true);
   });
 
   it('flags known automation user-agents', () => {
-    expect(looksLikeBot('curl/8.4.0')).toBe(true);
-    expect(looksLikeBot('python-requests/2.31')).toBe(true);
-    expect(looksLikeBot('Googlebot/2.1 (+http://www.google.com/bot.html)')).toBe(true);
-    expect(looksLikeBot('Mozilla/5.0 (compatible; bingbot/2.0)')).toBe(true);
-    expect(looksLikeBot('HeadlessChrome/120.0.0.0')).toBe(true);
+    expect(LooksLikeBot('curl/8.4.0')).toBe(true);
+    expect(LooksLikeBot('python-requests/2.31')).toBe(true);
+    expect(LooksLikeBot('Googlebot/2.1 (+http://www.google.com/bot.html)')).toBe(true);
+    expect(LooksLikeBot('Mozilla/5.0 (compatible; bingbot/2.0)')).toBe(true);
+    expect(LooksLikeBot('HeadlessChrome/120.0.0.0')).toBe(true);
   });
 
   it('allows real browser user-agents', () => {
-    expect(looksLikeBot('Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0 Safari/537.36')).toBe(false);
-    expect(looksLikeBot('Mozilla/5.0 (iPhone; CPU iPhone OS 17_0 like Mac OS X) AppleWebKit/605.1.15 Version/17.0 Mobile/15E148 Safari/604.1')).toBe(false);
+    expect(LooksLikeBot('Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0 Safari/537.36')).toBe(false);
+    expect(LooksLikeBot('Mozilla/5.0 (iPhone; CPU iPhone OS 17_0 like Mac OS X) AppleWebKit/605.1.15 Version/17.0 Mobile/15E148 Safari/604.1')).toBe(false);
   });
 });

package/src/__tests__/widgetGuestElevation.test.ts

@@ -13,8 +13,8 @@ vi.mock('@memberjunction/generic-database-provider', () => ({
 }));
 
 import {
-  resolveWidgetGuestRunContext,
-  elevateUserPayload,
+  ResolveWidgetGuestRunContext,
+  ElevateUserPayload,
   ResolveScopedAnonymousRunUser,
 } from '../realtimeWidget/widgetGuestElevation.js';
 import type { UserPayload } from '../types.js';
@@ -29,12 +29,12 @@ function payloadWith(userRecord: Partial<UserInfo>): UserPayload {
 
 describe('widgetGuestElevation — resolveWidgetGuestRunContext (guard paths, no DB)', () => {
   it('returns null for a normal authenticated user (not anonymous)', async () => {
-    const result = await resolveWidgetGuestRunContext(payloadWith({ IsMagicLinkAnonymous: false }), providerStub);
+    const result = await ResolveWidgetGuestRunContext(payloadWith({ IsMagicLinkAnonymous: false }), providerStub);
     expect(result).toBeNull();
   });
 
   it('returns null for an anonymous magic-link session that is NOT a widget guest (no WidgetGuestContext)', async () => {
-    const result = await resolveWidgetGuestRunContext(
+    const result = await ResolveWidgetGuestRunContext(
       payloadWith({ IsMagicLinkAnonymous: true, WidgetGuestContext: undefined }),
       providerStub,
     );
@@ -42,7 +42,7 @@ describe('widgetGuestElevation — resolveWidgetGuestRunContext (guard paths, no
   });
 
   it('returns null when userRecord is absent', async () => {
-    const result = await resolveWidgetGuestRunContext({ email: '', userRecord: undefined, sessionId: 's' }, providerStub);
+    const result = await ResolveWidgetGuestRunContext({ email: '', userRecord: undefined, sessionId: 's' }, providerStub);
     expect(result).toBeNull();
   });
 });
@@ -104,7 +104,7 @@ describe('widgetGuestElevation — elevateUserPayload', () => {
     const guestPayload = payloadWith({ IsMagicLinkAnonymous: true });
     const systemUser = { Email: 'system@system.org' } as UserInfo;
 
-    const elevated = elevateUserPayload(guestPayload, systemUser);
+    const elevated = ElevateUserPayload(guestPayload, systemUser);
 
     expect(elevated.userRecord).toBe(systemUser);
     expect(elevated.email).toBe('system@system.org');
@@ -117,7 +117,7 @@ describe('widgetGuestElevation — elevateUserPayload', () => {
     const guestPayload = payloadWith({ IsMagicLinkAnonymous: true });
     const systemUser = { Email: 'system@system.org' } as UserInfo;
 
-    elevateUserPayload(guestPayload, systemUser);
+    ElevateUserPayload(guestPayload, systemUser);
 
     expect(guestPayload.isSystemUser).toBeUndefined();
     expect(guestPayload.email).toBe('anonymous@magic-link.local');

package/src/__tests__/widgetHostIdentity.test.ts

@@ -1,8 +1,8 @@
 import { describe, it, expect } from 'vitest';
 import jwt from 'jsonwebtoken';
 import { generateKeyPairSync } from 'node:crypto';
-import { verifyHostAssertion, extractHostIdentity } from '../realtimeWidget/host-identity.js';
-import { buildWidgetGuestClaims } from '../realtimeWidget/widgetCore.js';
+import { VerifyHostAssertion, ExtractHostIdentity } from '../realtimeWidget/host-identity.js';
+import { BuildWidgetGuestClaims } from '../realtimeWidget/widgetCore.js';
 
 /** A throwaway RSA keypair for signing test host assertions. */
 function keypair(): { privatePem: string; publicPem: string } {
@@ -23,54 +23,54 @@ describe('verifyHostAssertion', () => {
     it('accepts a valid host assertion and extracts the identity', () => {
         const kp = keypair();
         const token = sign(kp.privatePem, { email: 'jane@acme.com', given_name: 'Jane', family_name: 'Doe', sub: 'host-123' });
-        const result = verifyHostAssertion(token, kp.publicPem, WIDGET_KEY);
+        const result = VerifyHostAssertion(token, kp.publicPem, WIDGET_KEY);
         expect(result.ok).toBe(true);
         if (result.ok) {
-            expect(result.identity).toMatchObject({ email: 'jane@acme.com', firstName: 'Jane', lastName: 'Doe', hostUserId: 'host-123' });
+            expect(result.Identity).toMatchObject({ email: 'jane@acme.com', firstName: 'Jane', lastName: 'Doe', hostUserId: 'host-123' });
         }
     });
 
     it('rejects a missing assertion', () => {
         const kp = keypair();
-        expect(verifyHostAssertion(undefined, kp.publicPem, WIDGET_KEY)).toEqual({ ok: false, errorCode: 'missing' });
+        expect(VerifyHostAssertion(undefined, kp.publicPem, WIDGET_KEY)).toEqual({ ok: false, errorCode: 'missing' });
     });
 
     it('rejects when no host key is configured (fail-closed)', () => {
         const kp = keypair();
         const token = sign(kp.privatePem, { email: 'x@y.com' });
-        expect(verifyHostAssertion(token, undefined, WIDGET_KEY)).toEqual({ ok: false, errorCode: 'no_key' });
+        expect(VerifyHostAssertion(token, undefined, WIDGET_KEY)).toEqual({ ok: false, errorCode: 'no_key' });
     });
 
     it('rejects a signature from the wrong key', () => {
         const signer = keypair();
         const other = keypair();
         const token = sign(signer.privatePem, { email: 'x@y.com' });
-        expect(verifyHostAssertion(token, other.publicPem, WIDGET_KEY)).toEqual({ ok: false, errorCode: 'bad_signature' });
+        expect(VerifyHostAssertion(token, other.publicPem, WIDGET_KEY)).toEqual({ ok: false, errorCode: 'bad_signature' });
     });
 
     it('rejects a wrong-audience assertion', () => {
         const kp = keypair();
         const token = sign(kp.privatePem, { email: 'x@y.com' }, { audience: 'pk_live_someone_else' });
-        expect(verifyHostAssertion(token, kp.publicPem, WIDGET_KEY)).toEqual({ ok: false, errorCode: 'bad_signature' });
+        expect(VerifyHostAssertion(token, kp.publicPem, WIDGET_KEY)).toEqual({ ok: false, errorCode: 'bad_signature' });
     });
 
     it('rejects an expired assertion', () => {
         const kp = keypair();
         const token = sign(kp.privatePem, { email: 'x@y.com' }, { expiresIn: -10 });
-        expect(verifyHostAssertion(token, kp.publicPem, WIDGET_KEY)).toEqual({ ok: false, errorCode: 'expired' });
+        expect(VerifyHostAssertion(token, kp.publicPem, WIDGET_KEY)).toEqual({ ok: false, errorCode: 'expired' });
     });
 
     it('rejects an assertion with no email', () => {
         const kp = keypair();
         const token = sign(kp.privatePem, { given_name: 'NoEmail' });
-        expect(verifyHostAssertion(token, kp.publicPem, WIDGET_KEY)).toEqual({ ok: false, errorCode: 'no_email' });
+        expect(VerifyHostAssertion(token, kp.publicPem, WIDGET_KEY)).toEqual({ ok: false, errorCode: 'no_email' });
     });
 
     it('rejects an assertion with no exp (unbounded lifetime)', () => {
         const kp = keypair();
         // Sign directly with no expiresIn so the token carries iat but no exp.
         const token = jwt.sign({ email: 'x@y.com' }, kp.privatePem, { algorithm: 'RS256', audience: WIDGET_KEY });
-        expect(verifyHostAssertion(token, kp.publicPem, WIDGET_KEY)).toEqual({ ok: false, errorCode: 'expired' });
+        expect(VerifyHostAssertion(token, kp.publicPem, WIDGET_KEY)).toEqual({ ok: false, errorCode: 'expired' });
     });
 
     it('rejects an assertion older than the maxAge cap even when its exp is still in the future', () => {
@@ -81,13 +81,13 @@ describe('verifyHostAssertion', () => {
             algorithm: 'RS256',
             audience: WIDGET_KEY,
         });
-        expect(verifyHostAssertion(token, kp.publicPem, WIDGET_KEY)).toEqual({ ok: false, errorCode: 'expired' });
+        expect(VerifyHostAssertion(token, kp.publicPem, WIDGET_KEY)).toEqual({ ok: false, errorCode: 'expired' });
     });
 });
 
 describe('buildWidgetGuestClaims with hostIdentity', () => {
     it('carries the host identity as INFORMATIONAL claims but keeps the Anonymous principal email', () => {
-        const claims = buildWidgetGuestClaims({
+        const claims = BuildWidgetGuestClaims({
             issuer: 'iss',
             audience: 'mj-magic-link',
             widgetId: 'W',
@@ -111,7 +111,7 @@ describe('buildWidgetGuestClaims with hostIdentity', () => {
 
 describe('extractHostIdentity', () => {
     it('tolerates firstName/lastName fallbacks', () => {
-        const id = extractHostIdentity({ email: 'a@b.com', firstName: 'Al', lastName: 'Bo' });
+        const id = ExtractHostIdentity({ email: 'a@b.com', firstName: 'Al', lastName: 'Bo' });
         expect(id).toMatchObject({ email: 'a@b.com', firstName: 'Al', lastName: 'Bo' });
     });
 });

package/src/agentSessions/ReturningVisitorRecap.ts

@@ -52,7 +52,7 @@ const MAX_TRANSCRIPT_TURNS = 60;
  *   `ExpiresAt` that many days out (the Memory Manager's decay phase reaps expired notes). Omit/0
  *   for no expiry (system default retention applies).
  */
-export async function writeReturningVisitorRecap(
+export async function WriteReturningVisitorRecap(
   conversationId: string | null | undefined,
   agentId: string | null | undefined,
   contextUser: UserInfo,
@@ -101,6 +101,17 @@ export async function writeReturningVisitorRecap(
   }
 }
 
+/** @deprecated Use {@link WriteReturningVisitorRecap}. */
+export async function writeReturningVisitorRecap(
+  conversationId: string | null | undefined,
+  agentId: string | null | undefined,
+  contextUser: UserInfo,
+  provider: IMetadataProvider,
+  retentionDays?: number | null,
+): Promise<void> {
+  return WriteReturningVisitorRecap(conversationId, agentId, contextUser, provider, retentionDays);
+}
+
 /** The polymorphic scope a recap note is filed under. */
 interface RecapScope {
   entityId: string;

package/src/agentSessions/SessionManager.ts

@@ -8,7 +8,7 @@ import {
 import { AIAgentPermissionHelper } from '@memberjunction/ai-engine-base';
 import { RealtimeClientSessionService, RealtimeChannelServerHost } from '@memberjunction/ai-agents';
 import { GetHostInstanceID } from './HostInstance.js';
-import { writeReturningVisitorRecap } from './ReturningVisitorRecap.js';
+import { WriteReturningVisitorRecap } from './ReturningVisitorRecap.js';
 import { ResolveScopedAnonymousRunUser } from '../realtimeWidget/widgetGuestElevation.js';
 
 /** Entity names — centralised so the `MJ:`-prefix convention is applied in exactly one place. */
@@ -207,7 +207,7 @@ export class SessionManager {
         // Returning-visitor recap (RV2): if this session's conversation is returning-visitor-enabled,
         // summarize it into an Active memory note so the visitor's next session opens with prior context.
         // Best-effort + no-op for non-returning-visitor conversations; never blocks teardown.
-        await writeReturningVisitorRecap(session.ConversationID, session.AgentID, contextUser, provider);
+        await WriteReturningVisitorRecap(session.ConversationID, session.AgentID, contextUser, provider);
         return true;
     }