@memberjunction/server 6.2.0-edge.0 → 6.2.0-edge.1

package/src/auth/magicLink/types.ts

@@ -10,14 +10,14 @@
  */
 export interface MagicLinkScopeEntry {
   /** The invite that granted this scope entry. */
-  inviteId: string;
+  inviteId: string;  // case-violation-ok-legacy-back-compat: the old name is also read off a value typed `any`, where a rename would compile and silently return undefined
   /** The Application this entry grants access to. */
-  appId: string;
+  appId: string;  // case-violation-ok-legacy-back-compat: the old name is also read off a value typed `any`, where a rename would compile and silently return undefined
   /** The role name this entry carries (email/app-session links). */
-  role?: string;
+  role?: string;  // case-violation-ok-legacy-back-compat: optional, and the old name is also read off a value the checker cannot type; renaming it stays assignable and silently yields undefined
   /** For resource-share/embed links: the shared resource's type + id. */
-  resourceType?: string;
-  resourceId?: string;
+  resourceType?: string;  // case-violation-ok-legacy-back-compat: optional, and the old name is also read off a value the checker cannot type; renaming it stays assignable and silently yields undefined
+  resourceId?: string;  // case-violation-ok-legacy-back-compat: optional, and the old name is also read off a value the checker cannot type; renaming it stays assignable and silently yields undefined
 }
 
 /**
@@ -27,25 +27,25 @@ export interface MagicLinkScopeEntry {
  */
 export interface MagicLinkJWTClaims {
   /** Issuer — MJ's public URL; resolves to the registered `magic-link` auth provider. */
-  iss: string;
+  iss: string;  // case-violation-ok-legacy-back-compat: the type crosses a serialization boundary (JSON / HTTP body), so this member name is part of a wire or on-disk shape
   /** Audience — the configured magic-link audience (default `mj-magic-link`). */
-  aud: string;
+  aud: string;  // case-violation-ok-legacy-back-compat: the type crosses a serialization boundary (JSON / HTTP body), so this member name is part of a wire or on-disk shape
   /** Subject — `magic-link|<inviteId>`. */
-  sub: string;
+  sub: string;  // case-violation-ok-legacy-back-compat: the type crosses a serialization boundary (JSON / HTTP body), so this member name is part of a wire or on-disk shape
   /** Issued-at (epoch seconds). */
-  iat: number;
+  iat: number;  // case-violation-ok-legacy-back-compat: the type crosses a serialization boundary (JSON / HTTP body), so this member name is part of a wire or on-disk shape
   /** Expiry (epoch seconds). */
-  exp: number;
-  email: string;
-  given_name?: string;
-  family_name?: string;
-  name?: string;
+  exp: number;  // case-violation-ok-legacy-back-compat: the type crosses a serialization boundary (JSON / HTTP body), so this member name is part of a wire or on-disk shape
+  email: string;  // case-violation-ok-legacy-back-compat: the type crosses a serialization boundary (JSON / HTTP body), so this member name is part of a wire or on-disk shape
+  given_name?: string;  // case-violation-ok-legacy-back-compat: snake_case mirrors an external payload — the remote spelling is the contract, not MJ convention
+  family_name?: string;  // case-violation-ok-legacy-back-compat: snake_case mirrors an external payload — the remote spelling is the contract, not MJ convention
+  name?: string;  // case-violation-ok-legacy-back-compat: the type crosses a serialization boundary (JSON / HTTP body), so this member name is part of a wire or on-disk shape
   /** The single Application this session is scoped to. */
-  mj_app_id: string;
+  mj_app_id: string;  // case-violation-ok-legacy-back-compat: snake_case mirrors an external payload — the remote spelling is the contract, not MJ convention
   /** The restricted role name assigned to this user (informational; enforcement is server-side via the role's entity permissions). */
-  mj_role: string;
+  mj_role: string;  // case-violation-ok-legacy-back-compat: snake_case mirrors an external payload — the remote spelling is the contract, not MJ convention
   /** UserID of the internal user who issued the invite (attribution/audit). Absent on links whose inviter could not be resolved. */
-  mj_invited_by?: string;
+  mj_invited_by?: string;  // case-violation-ok-legacy-back-compat: snake_case mirrors an external payload — the remote spelling is the contract, not MJ convention
   /**
    * Per-session scope UNION (Phase 4+). Each entry is one redeemed link's grant.
    * The server enforces anonymous sessions against THIS set (not the user's role
@@ -53,81 +53,81 @@ export interface MagicLinkJWTClaims {
    * different scopes without accretion. For email sessions the singular mj_app_id/
    * mj_role remain authoritative; this carries the union when links are stacked.
    */
-  mj_scopes?: MagicLinkScopeEntry[];
+  mj_scopes?: MagicLinkScopeEntry[];  // case-violation-ok-legacy-back-compat: snake_case mirrors an external payload — the remote spelling is the contract, not MJ convention
   /** True when this session resolves to the shared Anonymous principal (claims-based enforcement). */
-  mj_anon?: boolean;
+  mj_anon?: boolean;  // case-violation-ok-legacy-back-compat: snake_case mirrors an external payload — the remote spelling is the contract, not MJ convention
   /** Opaque per-session id — correlates one anonymous session's activity across audit rows without a real user. */
-  mj_sid?: string;
+  mj_sid?: string;  // case-violation-ok-legacy-back-compat: snake_case mirrors an external payload — the remote spelling is the contract, not MJ convention
   /**
    * Public web widget instance id (additive — set only for widget guest sessions
    * minted by WidgetSessionService). Binds the synthesized guest principal to one
    * widget instance so its pinned agent / guest role can be locked down. Absent on
    * ordinary magic-link sessions.
    */
-  mj_widget_id?: string;
+  mj_widget_id?: string;  // case-violation-ok-legacy-back-compat: snake_case mirrors an external payload — the remote spelling is the contract, not MJ convention
   /**
    * Host-asserted visitor email for a widget `host-identity` session (additive). The
    * authoritative `email`/`sub` still resolve the constrained shared Anonymous principal;
    * this carries WHO the host says the visitor is, for the agent to look up their account —
    * without granting that account's permissions. Absent on anonymous/ordinary sessions.
    */
-  mj_host_email?: string;
+  mj_host_email?: string;  // case-violation-ok-legacy-back-compat: snake_case mirrors an external payload — the remote spelling is the contract, not MJ convention
   /**
    * Returning-visitor anchor for a widget guest session (additive, RV1). Carried so the VOICE path —
    * whose conversation is created server-side — can stamp the same Conversation.VisitorKey the text
    * path stamps client-side. Present only when the widget remembers returning visitors.
    */
-  mj_visitor_key?: string;
+  mj_visitor_key?: string;  // case-violation-ok-legacy-back-compat: snake_case mirrors an external payload — the remote spelling is the contract, not MJ convention
   /** The prior conversation this visit chains from (RV2), for the voice path to stamp Conversation.LastConversationID. */
-  mj_last_conversation_id?: string;
+  mj_last_conversation_id?: string;  // case-violation-ok-legacy-back-compat: snake_case mirrors an external payload — the remote spelling is the contract, not MJ convention
   /** Resolved polymorphic identity entity id (RV4), for the voice path to stamp the existing Conversation.LinkedEntityID / AIAgentSession.LinkedEntityID. */
-  mj_linked_entity_id?: string;
+  mj_linked_entity_id?: string;  // case-violation-ok-legacy-back-compat: snake_case mirrors an external payload — the remote spelling is the contract, not MJ convention
   /** Resolved polymorphic identity record id (RV4), for the voice path to stamp the existing Conversation.LinkedRecordID / AIAgentSession.LinkedRecordID. */
-  mj_linked_record_id?: string;
+  mj_linked_record_id?: string;  // case-violation-ok-legacy-back-compat: snake_case mirrors an external payload — the remote spelling is the contract, not MJ convention
   /** Marks the session as magic-link so the Explorer can confine the UI. */
-  mj_magic_link: true;
+  mj_magic_link: true;  // case-violation-ok-legacy-back-compat: snake_case mirrors an external payload — the remote spelling is the contract, not MJ convention
 }
 
 /** Parameters for creating a magic-link invite (POST /magic-link/create). */
 export interface CreateMagicLinkInviteParams {
   /** Recipient email — becomes the provisioned user's email. */
-  email: string;
+  email: string;  // case-violation-ok-legacy-back-compat: the old name is also read off a value typed `any`, where a rename would compile and silently return undefined
   /** The Application the invite grants access to. */
-  applicationId: string;
+  ApplicationId: string;
   /** Restricted role to assign. Defaults to the configured `restrictedRoleName`. */
-  roleId?: string;
+  RoleId?: string;
   /** Hours until the link expires. Defaults to config `defaultExpiresInHours`. */
-  expiresInHours?: number;
+  ExpiresInHours?: number;
   /** Maximum redemptions. Defaults to 1 (single-use). */
-  maxUses?: number;
+  MaxUses?: number;
   /** Optional given/family name to seed the provisioned user. */
-  firstName?: string;
-  lastName?: string;
+  firstName?: string;  // case-violation-ok-legacy-back-compat: optional, and the old name is also read off a value the checker cannot type; renaming it stays assignable and silently yields undefined
+  lastName?: string;  // case-violation-ok-legacy-back-compat: optional, and the old name is also read off a value the checker cannot type; renaming it stays assignable and silently yields undefined
 }
 
 /** Result of creating an invite. */
 export interface CreateMagicLinkInviteResult {
-  success: boolean;
-  inviteId?: string;
+  success: boolean;  // case-violation-ok-legacy-back-compat: the type crosses a serialization boundary (JSON / HTTP body), so this member name is part of a wire or on-disk shape
+  inviteId?: string;  // case-violation-ok-legacy-back-compat: the type crosses a serialization boundary (JSON / HTTP body), so this member name is part of a wire or on-disk shape
   /** Full redemption URL to share. */
-  redemptionUrl?: string;
+  redemptionUrl?: string;  // case-violation-ok-legacy-back-compat: the type crosses a serialization boundary (JSON / HTTP body), so this member name is part of a wire or on-disk shape
   /**
    * The raw token, returned ONLY when no email provider is configured (so the
    * caller can deliver the link out of band). Never returned once email send
    * succeeds, and never persisted.
    */
-  rawToken?: string;
+  rawToken?: string;  // case-violation-ok-legacy-back-compat: the type crosses a serialization boundary (JSON / HTTP body), so this member name is part of a wire or on-disk shape
   /** Whether the invite email was dispatched. */
-  emailSent?: boolean;
+  emailSent?: boolean;  // case-violation-ok-legacy-back-compat: the type crosses a serialization boundary (JSON / HTTP body), so this member name is part of a wire or on-disk shape
   /** ISO expiry timestamp. */
-  expiresAt?: string;
-  error?: string;
+  expiresAt?: string;  // case-violation-ok-legacy-back-compat: the type crosses a serialization boundary (JSON / HTTP body), so this member name is part of a wire or on-disk shape
+  error?: string;  // case-violation-ok-legacy-back-compat: the type crosses a serialization boundary (JSON / HTTP body), so this member name is part of a wire or on-disk shape
   /**
    * Set when the request was rejected for authorization reasons:
    * `forbidden` — caller may not issue invites; `invalid_role` — the requested
    * role is not grantable via magic-link. Drives the HTTP status in the router.
    */
-  errorCode?: 'forbidden' | 'invalid_role';
+  errorCode?: 'forbidden' | 'invalid_role';  // case-violation-ok-legacy-back-compat: the type crosses a serialization boundary (JSON / HTTP body), so this member name is part of a wire or on-disk shape
 }
 
 /** Why a redemption failed. */
@@ -139,25 +139,25 @@ export type RedeemErrorCode = 'not_found' | 'expired' | 'consumed' | 'revoked' |
  * all fields optional because the API/JSON flow may omit them.
  */
 export interface RedeemAuditContext {
-  ipAddress?: string;
-  userAgent?: string;
-  origin?: string;
+  ipAddress?: string;  // case-violation-ok-legacy-back-compat: optional, and the old name is also read off a value the checker cannot type; renaming it stays assignable and silently yields undefined
+  userAgent?: string;  // case-violation-ok-legacy-back-compat: optional, and the old name is also read off a value the checker cannot type; renaming it stays assignable and silently yields undefined
+  origin?: string;  // case-violation-ok-legacy-back-compat: optional, and the old name is also read off a value the checker cannot type; renaming it stays assignable and silently yields undefined
 }
 
 /** Result of redeeming an invite. */
 export interface RedeemMagicLinkResult {
-  success: boolean;
+  success: boolean;  // case-violation-ok-legacy-back-compat: the type crosses a serialization boundary (JSON / HTTP body), so this member name is part of a wire or on-disk shape
   /** The minted session JWT (RS256). */
-  token?: string;
+  token?: string;  // case-violation-ok-legacy-back-compat: the type crosses a serialization boundary (JSON / HTTP body), so this member name is part of a wire or on-disk shape
   /** ISO expiry of the session token. */
-  expiresAt?: string;
+  expiresAt?: string;  // case-violation-ok-legacy-back-compat: the type crosses a serialization boundary (JSON / HTTP body), so this member name is part of a wire or on-disk shape
   /** The Application the session is scoped to. */
-  applicationId?: string;
+  applicationId?: string;  // case-violation-ok-legacy-back-compat: the type crosses a serialization boundary (JSON / HTTP body), so this member name is part of a wire or on-disk shape
   /** The Application's display name (used to deep-link the browser into that app). */
-  applicationName?: string;
+  applicationName?: string;  // case-violation-ok-legacy-back-compat: the type crosses a serialization boundary (JSON / HTTP body), so this member name is part of a wire or on-disk shape
   /** The Application's URL path slug (preferred for deep-linking; falls back to name). */
-  applicationPath?: string;
-  email?: string;
-  error?: string;
-  errorCode?: RedeemErrorCode;
+  applicationPath?: string;  // case-violation-ok-legacy-back-compat: the type crosses a serialization boundary (JSON / HTTP body), so this member name is part of a wire or on-disk shape
+  email?: string;  // case-violation-ok-legacy-back-compat: the type crosses a serialization boundary (JSON / HTTP body), so this member name is part of a wire or on-disk shape
+  error?: string;  // case-violation-ok-legacy-back-compat: the type crosses a serialization boundary (JSON / HTTP body), so this member name is part of a wire or on-disk shape
+  errorCode?: RedeemErrorCode;  // case-violation-ok-legacy-back-compat: the type crosses a serialization boundary (JSON / HTTP body), so this member name is part of a wire or on-disk shape
 }

package/src/auth/newUsers.ts

@@ -5,7 +5,7 @@ import { configInfo } from "../config.js";
 import { MJUserEntity, MJUserRoleEntity, MJUserApplicationEntity, MJUserApplicationEntityEntity, MJApplicationEntityType, MJApplicationEntityEntityType, UserInfoEngine } from "@memberjunction/core-entities";
 
 export class NewUserBase {
-    public async createNewUser(firstName: string, lastName: string, email: string, linkedRecordType: string = 'None', linkedEntityId?: string, linkedEntityRecordId?: string): Promise<MJUserEntity | null> {
+    public async createNewUser(firstName: string, lastName: string, email: string, linkedRecordType: string = 'None', linkedEntityId?: string, linkedEntityRecordId?: string): Promise<MJUserEntity | null> {  // case-violation-ok-legacy-back-compat: a subclass overrides this; a stub preserves CALLING the old name but not OVERRIDING it
         try {
             const contextUser: UserInfo | null = ResolveConfiguredPrincipal(
                 configInfo?.userHandling?.contextUserForNewUserCreation,

package/src/auth/principals.ts

@@ -116,7 +116,7 @@ function lowestActiveById<T extends ResolvablePrincipal>(matches: readonly T[]):
  * @param users      the candidate pool, normally `UserCache.Users`
  * @param systemUserId the deployment's system user ID (`UserCache.Instance.SYSTEM_USER_ID`)
  */
-export function resolvePrincipalFrom<T extends ResolvablePrincipal>(
+export function ResolvePrincipalFrom<T extends ResolvablePrincipal>(
     candidate: string | undefined,
     users: readonly T[],
     systemUserId: string,
@@ -156,6 +156,15 @@ export function resolvePrincipalFrom<T extends ResolvablePrincipal>(
     };
 }
 
+/** @deprecated Use {@link ResolvePrincipalFrom}. */
+export function resolvePrincipalFrom<T extends ResolvablePrincipal>(
+    candidate: string | undefined,
+    users: readonly T[],
+    systemUserId: string,
+): PrincipalResolution<T> {
+    return ResolvePrincipalFrom(candidate, users, systemUserId);
+}
+
 /**
  * Why a configured candidate yielded nothing. The two causes need opposite fixes, so the message
  * has to tell them apart: "no such user" is a typo or the wrong column, while "matched, but
@@ -230,7 +239,7 @@ export function ReportedMisconfigurationCount(): number {
  *          handle null rather than assume a principal is always available
  */
 export function ResolveConfiguredPrincipal(candidate: string | undefined, purpose: string): UserInfo | null {
-    const resolution = resolvePrincipalFrom(candidate, UserCache.Instance.Users, UserCache.Instance.SYSTEM_USER_ID);
+    const resolution = ResolvePrincipalFrom(candidate, UserCache.Instance.Users, UserCache.Instance.SYSTEM_USER_ID);
 
     if (resolution.warning) {
         const key = `${purpose} :: ${candidate ?? ''}`;

package/src/cache.ts

@@ -2,9 +2,12 @@ import { LRUCache } from 'lru-cache';
 
 const oneHourMs = 60 * 60 * 1000;
 
-export const authCache = new LRUCache({
+export const AuthCache = new LRUCache({
   max: 50000,
   ttl: oneHourMs,
   ttlAutopurge: false,
 });
 
+/** @deprecated Use {@link AuthCache}. */
+export const authCache = AuthCache;
+

package/src/config.ts

@@ -230,6 +230,29 @@ const cacheSettingsSchema = z.object({
   evictionSweepIntervalSeconds: z.number().optional().default(300),
   /** Enable verbose cache logging (hits, misses, evictions). Default: false. */
   verboseLogging: z.boolean().optional().default(false),
+  /**
+   * Entity names whose FULL ROW may ride along with a cache-invalidation broadcast.
+   *
+   * The cache-invalidation subscription is delivered to EVERY connected client with no per-user
+   * filter (see CacheInvalidationResolver), so any row named here is disclosed to every signed-in
+   * session, whatever row-level security or tenant scoping would otherwise apply to reading it.
+   *
+   * Defaults to `[]`: invalidation still carries the entity name and primary key, which is all a
+   * client needs to evict, and the client re-fetches through the normal read path where access
+   * control applies. Listing an entity re-enables the apply-in-place optimisation for it — correct
+   * only for reference data every signed-in user is allowed to read.
+   *
+   * What the re-fetch costs depends on the consumer. `ConversationEngine` re-reads the ONE record
+   * by primary key. `BaseEngine` (every engine subclass with `AutoRefresh`, the default) applies a
+   * remote save in place only when the row is present, so without it a remote save falls through to
+   * a full reload of each matching config — a `RunView` of that entity, not a keyed read. Remote
+   * deletes still apply in place from the primary key. Engine-cached reference entities that every
+   * signed-in user may read are the ones worth listing here.
+   *
+   * `['*']` opts every entity in, restoring the previous behaviour. Only safe on a deployment where
+   * every signed-in user may read every row of every entity.
+   */
+  recordDataBroadcastEntities: z.array(z.string()).optional().default([]),
 });
 
 const loggingSettingsSchema = z.object({
@@ -812,9 +835,14 @@ export const DEFAULT_SERVER_CONFIG: Partial<ConfigInfo> = {
  * startup summary `Config` line. Declared before `configInfo` so the assignment
  * inside `loadConfig()` (invoked below) is not in its temporal dead zone.
  */
-export let configFilePath: string | undefined;
+export let ConfigFilePath: string | undefined;
 
-export const configInfo: ConfigInfo = loadConfig();
+export {
+  /** @deprecated Use {@link ConfigFilePath} instead. */
+  ConfigFilePath as configFilePath,
+};
+
+export const configInfo: ConfigInfo = LoadConfig();  // case-violation-ok-legacy-back-compat: the PascalCase name is already taken in this scope
 
 export const {
   dbUsername,
@@ -841,7 +869,7 @@ export const {
   restApiOptions: RESTApiOptions,
 } = configInfo;
 
-export function loadConfig() {
+export function LoadConfig() {
   const configSearchResult = explorer.search(process.cwd());
 
   // Start with DEFAULT_SERVER_CONFIG as base
@@ -851,7 +879,7 @@ export function loadConfig() {
   if (configSearchResult && !configSearchResult.isEmpty) {
     // Resolved config-file path. Surfaced in the startup summary `Config` line at standard
     // level (see StartupLogger). Demoted to verbose-only here to avoid a duplicate inline line.
-    configFilePath = configSearchResult.filepath;
+    ConfigFilePath = configSearchResult.filepath;
     LogStatusEx({ message: `Config file found at ${configSearchResult.filepath}`, verboseOnly: true });
 
     // Merge user config with defaults (user config takes precedence)
@@ -868,3 +896,8 @@ export function loadConfig() {
   }
   return configParsing.data;
 }
+
+/** @deprecated Use {@link LoadConfig}. */
+export function loadConfig() {
+  return LoadConfig();
+}

package/src/context.ts

@@ -5,13 +5,13 @@ import 'reflect-metadata';
 import { Subject, firstValueFrom } from 'rxjs';
 import { AuthenticationError, AuthorizationError } from 'type-graphql';
 import sql from 'mssql';
-import { getSigningKeys, getSystemUser, getValidationOptions, verifyUserRecord, extractUserInfoFromPayload } from './auth/index.js';
+import { GetSigningKeys, GetSystemUser, GetValidationOptions, VerifyUserRecord, ExtractUserInfoFromPayload } from './auth/index.js';
 import { CloneUserForSessionContext } from './auth/sessionUserClone.js';
 import { GetAPIKeyActingContextResolver } from './auth/actingContextResolver.js';
 import { TokenExpiredError, AuthProviderFactory } from '@memberjunction/auth-providers';
-import { authCache } from './cache.js';
+import { AuthCache } from './cache.js';
 import { userEmailMap, apiKey, mj_core_schema } from './config.js';
-import { buildBoundaryLogPayload } from './logging/boundaryLogPayload.js';
+import { BuildBoundaryLogPayload } from './logging/boundaryLogPayload.js';
 import { StartupLogger } from './logging/StartupLogger.js';
 import { DataSourceInfo, UserPayload } from './types.js';
 import { GetReadOnlyDataSource, GetReadWriteDataSource } from './util.js';
@@ -110,7 +110,7 @@ async function writeSessionAudit(args: {
     // as them silently fails the permission check (this is exactly why the built-in
     // CreateAuditLogRecord, which saves as `user`, drops guest session rows). We record
     // the real session user in UserID but write the row as the system user.
-    const writer = await getSystemUser();
+    const writer = await GetSystemUser();
     const auditType = provider.AuditLogTypes?.find(
       (t) => t?.Name?.trim().toLowerCase() === args.auditTypeName.trim().toLowerCase(),
     );
@@ -170,7 +170,7 @@ async function auditLoginFailure(
       return; // already logged this failing identity/token — don't let a retry loop spam
     }
     // No-arg: getSystemUser pulls from the process-global UserCache (no ConnectionPool needed here).
-    const systemUser = await getSystemUser();
+    const systemUser = await GetSystemUser();
     if (!systemUser) {
       return;
     }
@@ -316,7 +316,7 @@ function extractWidgetGuestContext(payload: jwt.JwtPayload): WidgetGuestContext
 
 const verifyAsync = async (issuer: string, token: string): Promise<jwt.JwtPayload> =>
   new Promise((resolve, reject) => {
-    const options = getValidationOptions(issuer);
+    const options = GetValidationOptions(issuer);
     
     if (!options) {
       reject(new Error(`No validation options found for issuer ${issuer}`));
@@ -336,14 +336,14 @@ const verifyAsync = async (issuer: string, token: string): Promise<jwt.JwtPayloa
       verifyOptions.audience = options.audience;
     }
 
-    jwt.verify(token, getSigningKeys(issuer), verifyOptions, (err, jwt) => {
+    jwt.verify(token, GetSigningKeys(issuer), verifyOptions, (err, jwt) => {
       if (jwt && typeof jwt !== 'string' && !err) {
         const payload = jwt.payload ?? jwt;
 
         // Per-request token confirmation — debug-only (one of the worst
         // "constantly on" offenders on an authenticated server).
         if (isDebugLogLevel()) {
-          const userInfo = extractUserInfoFromPayload(payload);
+          const userInfo = ExtractUserInfoFromPayload(payload);
           console.log(`Valid token: ${userInfo.fullName || 'Unknown'} (${userInfo.email || userInfo.preferredUsername || 'Unknown'})`);
         }
         resolve(payload);
@@ -359,18 +359,18 @@ const verifyAsync = async (issuer: string, token: string): Promise<jwt.JwtPayloa
  */
 export interface RequestContext {
   /** The API endpoint path (e.g., '/graphql', '/mcp') */
-  endpoint: string;
+  endpoint: string;  // case-violation-ok-legacy-back-compat: the old name is also read off a value typed `any`, where a rename would compile and silently return undefined
   /** HTTP method (e.g., 'POST', 'GET') */
-  method: string;
+  method: string;  // case-violation-ok-legacy-back-compat: the old name is also read off a value typed `any`, where a rename would compile and silently return undefined
   /** GraphQL operation name if available */
-  operationName?: string;
+  operationName?: string;  // case-violation-ok-legacy-back-compat: optional, and the old name is also read off a value the checker cannot type; renaming it stays assignable and silently yields undefined
   /** Client IP address */
-  ipAddress?: string;
+  ipAddress?: string;  // case-violation-ok-legacy-back-compat: optional, and the old name is also read off a value the checker cannot type; renaming it stays assignable and silently yields undefined
   /** User-Agent header */
-  userAgent?: string;
+  userAgent?: string;  // case-violation-ok-legacy-back-compat: optional, and the old name is also read off a value the checker cannot type; renaming it stays assignable and silently yields undefined
 }
 
-export const getUserPayload = async (
+export const GetUserPayload = async (
   bearerToken: string,
   sessionId = 'default',
   dataSources: DataSourceInfo[],
@@ -388,7 +388,7 @@ export const getUserPayload = async (
     // This authenticates as the specific user who owns the API key
     if (userApiKey && userApiKey !== String(undefined)) {
       // Use system user as context for validation operations
-      const systemUser = await getSystemUser(readOnlyDataSource);
+      const systemUser = await GetSystemUser(readOnlyDataSource);
       const apiKeyEngine = GetAPIKeyEngine();
       const validationResult = await apiKeyEngine.ValidateAPIKey(
         {
@@ -463,7 +463,7 @@ export const getUserPayload = async (
       const systemKeyDigest = createHash('sha256').update(String(systemApiKey)).digest();
       const providedKeyDigest = createHash('sha256').update(String(apiKey)).digest();
       if (timingSafeEqual(systemKeyDigest, providedKeyDigest)) {
-        const systemUser = await getSystemUser(readOnlyDataSource);
+        const systemUser = await GetSystemUser(readOnlyDataSource);
         return {
           userRecord: systemUser,
           email: systemUser.Email,
@@ -497,7 +497,7 @@ export const getUserPayload = async (
       throw new TokenExpiredError(expiryDate);
     }
 
-    if (!authCache.has(token)) {
+    if (!AuthCache.has(token)) {
       const issuer = payload.iss;
       if (!issuer) {
         console.warn('No issuer claim on token');
@@ -512,14 +512,14 @@ export const getUserPayload = async (
       }
 
       await verifyAsync(issuer, token);
-      authCache.set(token, true);
+      AuthCache.set(token, true);
     }
 
     // Use provider to extract user information
-    const userInfo = extractUserInfoFromPayload(payload);
+    const userInfo = ExtractUserInfoFromPayload(payload);
     const email = userInfo.email ? ((userEmailMap ?? {})[userInfo.email] ?? userInfo.email) : userInfo.preferredUsername;
     
-    const userRecord = await verifyUserRecord(
+    const userRecord = await VerifyUserRecord(
       email, 
       userInfo.firstName, 
       userInfo.lastName, 
@@ -602,6 +602,9 @@ export const getUserPayload = async (
   }
 };
 
+/** @deprecated Use {@link GetUserPayload}. */
+export const getUserPayload = GetUserPayload;
+
 /**
  * Extracts auth headers and builds a RequestContext from an Express request.
  * Shared by both the unified auth middleware and the WebSocket context.
@@ -665,7 +668,7 @@ function extractAuthInputs(req: IncomingMessage): {
  *
  * Register OAuth callback routes BEFORE this middleware so they remain unauthenticated.
  */
-export function createUnifiedAuthMiddleware(
+export function CreateUnifiedAuthMiddleware(
   dataSources: DataSourceInfo[]
 ): RequestHandler {
   return async (req: Request, res: Response, next: NextFunction): Promise<void> => {
@@ -680,7 +683,7 @@ export function createUnifiedAuthMiddleware(
       const { bearerToken, sessionId, requestDomain, systemApiKey, userApiKey, requestContext } =
         extractAuthInputs(req);
 
-      const userPayload = await getUserPayload(
+      const userPayload = await GetUserPayload(
         bearerToken,
         sessionId,
         dataSources,
@@ -730,13 +733,20 @@ export function createUnifiedAuthMiddleware(
   };
 }
 
+/** @deprecated Use {@link CreateUnifiedAuthMiddleware}. */
+export function createUnifiedAuthMiddleware(
+  dataSources: DataSourceInfo[]
+): RequestHandler {
+  return CreateUnifiedAuthMiddleware(dataSources);
+}
+
 /**
  * Creates the GraphQL context from an already-authenticated request.
  *
  * The unified auth middleware has already resolved `req.userPayload` before this runs.
  * This function reads the payload and creates per-request database providers.
  */
-export const contextFunction =
+export const ContextFunction =
   ({ setupComplete$, dataSource, dataSources }: { setupComplete$: Subject<unknown>; dataSource: sql.ConnectionPool, dataSources: DataSourceInfo[] }) =>
   async ({ req }: { req: IncomingMessage }) => {
     await firstValueFrom(setupComplete$); // wait for setup to complete before processing the request
@@ -748,7 +758,7 @@ export const contextFunction =
     // Per-request GraphQL boundary line — debug-only. Kept (not deleted) so the
     // data is available when an operator opts into debug, but off by default.
     if (operationName !== 'IntrospectionQuery' && isDebugLogLevel()) {
-      console.dir(buildBoundaryLogPayload(operationName), { depth: null, breakLength: 200 });
+      console.dir(BuildBoundaryLogPayload(operationName), { depth: null, breakLength: 200 });
     }
 
     // Auth already happened in the unified auth middleware — just read the result
@@ -773,6 +783,9 @@ export const contextFunction =
     };
   };
 
+/** @deprecated Use {@link ContextFunction}. */
+export const contextFunction = ContextFunction;
+
 /**
  * Creates per-request DatabaseProviderBase instances for the GraphQL context.
  * Handles both SQL Server and PostgreSQL paths.

package/src/directives/Public.ts

@@ -11,7 +11,7 @@ export function Public(): PropertyDecorator | MethodDecorator | ClassDecorator {
     Directive(`@${DIRECTIVE_NAME}`)(targetOrPrototype, propertyKey, descriptor);
 }
 
-export const publicDirective: DirectiveBuilder = {
+export const PublicDirective: DirectiveBuilder = {
   typeDefs: `directive @${DIRECTIVE_NAME} on FIELD_DEFINITION`,
   transformer: (schema) => {
     const fieldMapper: FieldMapper = (fieldConfig) => {
@@ -40,3 +40,6 @@ export const publicDirective: DirectiveBuilder = {
     return mapSchema(schema, { [MapperKind.OBJECT_FIELD]: fieldMapper });
   },
 };
+
+/** @deprecated Use {@link PublicDirective}. */
+export const publicDirective = PublicDirective;

package/src/directives/RequireSystemUser.ts

@@ -9,7 +9,7 @@ export function RequireSystemUser(): PropertyDecorator | MethodDecorator | Class
   return (targetOrPrototype, propertyKey, descriptor) => Directive(`@${DIRECTIVE_NAME}`)(targetOrPrototype, propertyKey, descriptor);
 }
 
-export const requireSystemUserDirective: DirectiveBuilder = {
+export const RequireSystemUserDirective: DirectiveBuilder = {
   typeDefs: `directive @${DIRECTIVE_NAME} on FIELD_DEFINITION`,
   transformer: (schema) => {
     const fieldMapper: FieldMapper = (fieldConfig) => {
@@ -29,3 +29,6 @@ export const requireSystemUserDirective: DirectiveBuilder = {
     return mapSchema(schema, { [MapperKind.OBJECT_FIELD]: fieldMapper });
   },
 };
+
+/** @deprecated Use {@link RequireSystemUserDirective}. */
+export const requireSystemUserDirective = RequireSystemUserDirective;