@memberjunction/server 6.2.0-edge.0 → 6.2.0-edge.2

package/src/index.ts

@@ -32,7 +32,7 @@ import { RealtimeProxyServer } from './realtimeProxy/RealtimeProxyServer.js';
 import buildApolloServer from './apolloServer/index.js';
 import { configInfo, configFilePath, dbDatabase, dbHost, dbPort, dbUsername, graphqlPort, graphqlRootPath, mj_core_schema, websiteRunFromPackage, RESTApiOptions } from './config.js';
 import { default as jwt } from 'jsonwebtoken';
-import { contextFunction, createUnifiedAuthMiddleware, getUserPayload } from './context.js';
+import { contextFunction, CreateUnifiedAuthMiddleware, getUserPayload } from './context.js';
 import { UserPayload } from './types.js';
 import { requireSystemUserDirective, publicDirective } from './directives/index.js';
 import { variablesLoggingMiddleware } from './logging/variablesLoggingMiddleware.js';
@@ -61,6 +61,12 @@ import { GetAPIKeyEngine } from '@memberjunction/api-keys';
 import { RedisLocalStorageProvider } from '@memberjunction/redis-provider';
 import { GenericDatabaseProvider } from '@memberjunction/generic-database-provider';
 import { PubSubManager } from './generic/PubSubManager.js';
+import { ReconcileOrphanedConversationDetails } from './generic/OrphanedConversationDetailReconciler.js';
+import {
+  PUSH_STATUS_UPDATES_TOPIC,
+  SetPushStatusPublishHook,
+  ParseReplicatedStatusUpdate,
+} from './generic/PushStatusResolver.js';
 import { IntegrationProgressEmitter } from '@memberjunction/integration-progress-artifacts';
 import { PublishIntegrationProgress } from './resolvers/IntegrationProgressResolver.js';
 import { RegisterRSUProgressBridge } from './integration/RSUProgressBridge.js';
@@ -69,7 +75,7 @@ import { SessionJanitor } from './agentSessions/index.js';
 import { StartTaskGraphDispatcher } from './services/StartTaskGraphDispatcher.js';
 import { GetAttachmentService } from '@memberjunction/aiengine';
 import { MJStorageBlobStore } from './services/MJStorageBlobStore.js';
-import { CACHE_INVALIDATION_TOPIC } from './generic/CacheInvalidationResolver.js';
+import { CACHE_INVALIDATION_TOPIC, MayBroadcastRecordData, ConfigureRecordDataBroadcast } from './generic/CacheInvalidationResolver.js';
 import { ConnectorFactory, IntegrationEngine, IntegrationSyncOptions } from '@memberjunction/integration-engine';
 import { CronExpressionHelper } from '@memberjunction/scheduling-engine';
 import {
@@ -82,6 +88,7 @@ import {
 import { ServerExtensionLoader, ServerExtensionConfig, mergeServerExtensionConfigs, prepareServerExtensionConfigs, describeServerExtensionMount, InstallMediaUpgradeDispatcher, IsGraphQLWsPath } from '@memberjunction/server-extensions-core';
 import { coreReservedServerExtensionRoots } from './serverExtensionReservedRoots.js';
 import { MetadataCacheRefreshIntervalSeconds } from './providerConfigUnits.js';
+import { CreateMetadataRefreshSignalHandler, METADATA_REFRESH_SIGNAL } from './metadataRefreshSignal.js';
 
 const cacheRefreshInterval = configInfo.databaseSettings.metadataCacheRefreshInterval;
 
@@ -99,10 +106,15 @@ export { MetadataCacheRefreshIntervalSeconds } from './providerConfigUnits.js';
  * CodeGenLib). This wrapper keeps the public `getDbType()` symbol that
  * MJServer consumers (and the broader stack) already import.
  */
-export function getDbType(): DatabasePlatform {
+export function GetDbType(): DatabasePlatform {
     return resolveDbPlatformFromEnv() ?? 'sqlserver';
 }
 
+/** @deprecated Use {@link GetDbType}. */
+export function getDbType(): DatabasePlatform {
+  return GetDbType();
+}
+
 export { MaxLength } from 'class-validator';
 export * from 'type-graphql';
 // Named re-export so Open App generated resolvers get a live ESM binding for
@@ -161,7 +173,9 @@ export * from './generic/refusalExtensions.js';
 export * from './generic/RunViewResolver.js';
 export * from './resolvers/RunTemplateResolver.js';
 export * from './resolvers/RunAIPromptResolver.js';
+export * from './resolvers/RunDecisionResolver.js';
 export * from './resolvers/RunAIAgentResolver.js';
+export { AgentRunStatusPublisher } from './resolvers/AgentRunStatusPublisher.js';
 export * from './resolvers/VectorizeEntityResolver.js';
 export * from './resolvers/SearchKnowledgeResolver.js';
 export * from './resolvers/SearchKnowledgeStreamResolver.js';
@@ -218,6 +232,7 @@ export * from './rest/MediaAccessKeys.js';
 export * from './rest/MediaStreamHandler.js';
 export * from './resolvers/InfoResolver.js';
 export * from './resolvers/PotentialDuplicateRecordResolver.js';
+export * from './resolvers/DuplicateEntryCheckResolver.js';
 export * from './resolvers/RunTestResolver.js';
 export * from './resolvers/SearchEntitiesResolver.js';
 export * from './resolvers/UserFavoriteResolver.js';
@@ -263,7 +278,10 @@ const localPath = (p: string) => {
   return resolvedPath;
 };
 
-export const createApp = (): Application => express();
+export const CreateApp = (): Application => express();
+
+/** @deprecated Use {@link CreateApp}. */
+export const createApp = CreateApp;
 
 /**
  * Resolves the MJServer package version for the startup summary header.
@@ -283,6 +301,61 @@ function resolveServerVersion(): string | undefined {
   }
 }
 
+/** How often to re-check for conversation details left behind by finished runs. */
+const ORPHAN_DETAIL_SWEEP_INTERVAL_MS = 5 * 60_000;
+
+/** Redis channel carrying replicated push-status updates between server instances. */
+const PUSH_STATUS_FANOUT_CHANNEL = 'push-status-updates';
+
+/**
+ * Replicate push-status updates across server instances over Redis (MJ #4222).
+ *
+ * Outbound: every locally-published update is forwarded on a shared channel. Inbound: a message
+ * from another instance is republished onto THIS instance's local topic, where the normal
+ * subscription filter decides who receives it — so the identity gate (`ownerUserId` vs. the
+ * connection's authenticated user) still applies to a replicated message exactly as it does to a
+ * local one. The replica has no say in who sees what.
+ *
+ * Republishing goes straight to `PubSubManager`, never back through `publishStatusUpdate`, so an
+ * inbound message cannot be re-broadcast and loop. `SourceServerId` guards the remaining case: a
+ * publisher also receives its own message from Redis.
+ */
+async function wirePushStatusFanOut(redisProvider: RedisLocalStorageProvider, startupLog: StartupLogger): Promise<void> {
+  try {
+    await redisProvider.SubscribeToChannel(PUSH_STATUS_FANOUT_CHANNEL, (raw: string) => {
+      try {
+        const payload = ParseReplicatedStatusUpdate(raw, MJGlobal.Instance.ProcessUUID);
+        if (!payload) {
+          return;
+        }
+        // Rebuilt as a plain record: the topic's publish signature takes an index-signature type,
+        // and listing the fields keeps the wire shape explicit at the one place it crosses hosts.
+        PubSubManager.Instance.Publish(PUSH_STATUS_UPDATES_TOPIC, {
+          sessionId: payload.sessionId,
+          ownerUserId: payload.ownerUserId,
+          message: payload.message,
+          SourceServerId: payload.SourceServerId,
+        });
+      } catch {
+        // A malformed message on a shared channel must not take down the subscriber.
+      }
+    });
+
+    SetPushStatusPublishHook((payload) => {
+      redisProvider.PublishMessage(PUSH_STATUS_FANOUT_CHANNEL, JSON.stringify(payload));
+    });
+
+    // Printed unconditionally, not verbose-gated. "Is fan-out actually on?" is the first question
+    // anyone debugging a hung conversation behind a load balancer asks, and a silent default left
+    // no way to answer it.
+    console.log('[MJAPI] Push-status updates: cross-instance fan-out enabled via Redis');
+  } catch (err) {
+    // Single-instance delivery still works, and the durable tail query covers the rest. Degraded,
+    // not broken — so this must not stop the server from starting.
+    console.warn(`Push-status fan-out unavailable: ${(err as Error).message}`);
+  }
+}
+
 // Bind MJStorage as the conversation-attachment blob store. The attachment service itself no longer
 // imports `@memberjunction/storage` — that dependency made it unusable from any browser or React
 // Native client, which is why the same attachment rules had been reimplemented three times.
@@ -294,7 +367,7 @@ function resolveServerVersion(): string | undefined {
 // there is no ordering hazard in binding this early.
 GetAttachmentService().BlobStore = new MJStorageBlobStore();
 
-export const serve = async (resolverPaths: Array<string>, app: Application = createApp(), options?: MJServerOptions): Promise<void> => {
+export const Serve = async (resolverPaths: Array<string>, app: Application = CreateApp(), options?: MJServerOptions): Promise<void> => {
   const t0 = performance.now();
   // Level-gated startup logger. Resolves verbosity from telemetry.level (single
   // operator knob). At `standard` (default), per-phase timings are collapsed into
@@ -321,7 +394,7 @@ export const serve = async (resolverPaths: Array<string>, app: Application = cre
   }
 
 const setupComplete$ = new ReplaySubject(1);
-  const dbType = getDbType();
+  const dbType = GetDbType();
   const dataSources: DataSourceInfo[] = [];
 
   if (dbType === 'postgresql') {
@@ -711,6 +784,15 @@ const setupComplete$ = new ReplaySubject(1);
         }
     });
 
+    // Fan push-status updates across server instances (MJ #4222).
+    //
+    // Behind a load balancer the browser's WebSocket lives on one replica while the mutation that
+    // drives the agent can be handled by another. The push topic is an in-process PubSub, so a
+    // completion published on replica B never reaches a subscriber on replica A — the browser waits
+    // forever for an event that was delivered to nobody. Replicating progress and completion over
+    // Redis closes that, and the durable tail query remains the backstop if Redis is down.
+    await wirePushStatusFanOut(redisProvider, startupLog);
+
     startupLog.LogIf('verbose', `Redis cache provider connected: ${process.env.REDIS_URL}`);
   }
 
@@ -909,6 +991,11 @@ const setupComplete$ = new ReplaySubject(1);
   // publish hook above so the first RSU event also reaches live subscribers.
   RegisterRSUProgressBridge();
 
+  // Hand the resolver its allowlist before anything can publish. It cannot read configInfo itself:
+  // config.ts loads and validates at module scope, so importing it there would pull full config
+  // validation into every import chain that touches the resolver, unit tests included.
+  ConfigureRecordDataBroadcast(configInfo.cacheSettings?.recordDataBroadcastEntities);
+
   // Global listener: broadcast CACHE_INVALIDATION to all browser clients whenever
   // ANY BaseEntity save/delete occurs on this server — regardless of whether it
   // originated from a GraphQL mutation or internal server-side code (agents, actions,
@@ -918,14 +1005,21 @@ const setupComplete$ = new ReplaySubject(1);
     if (event.event === MJEventType.ComponentEvent && event.eventCode === BaseEntity.BaseEventCode) {
       const beEvent = event.args as BaseEntityEvent;
       if (beEvent.type === 'save' || beEvent.type === 'delete') {
+        const entityName = beEvent.baseEntity.EntityInfo.Name;
         PubSubManager.Instance.Publish(CACHE_INVALIDATION_TOPIC, {
-          entityName: beEvent.baseEntity.EntityInfo.Name,
+          entityName,
           primaryKeyValues: JSON.stringify(beEvent.baseEntity.PrimaryKey.KeyValuePairs),
           action: beEvent.type,
           sourceServerId: MJGlobal.Instance.ProcessUUID,
           timestamp: new Date(),
           originSessionId: null,
-          recordData: beEvent.type === 'save' ? JSON.stringify(beEvent.baseEntity.GetAll()) : undefined,
+          // Opt-in only: this event reaches every connected client unfiltered, and this listener
+          // fires for server-internal saves too (agents, actions, orchestrator), which are exactly
+          // the ones no browser session asked for.
+          recordData:
+            beEvent.type === 'save' && MayBroadcastRecordData(entityName)
+              ? JSON.stringify(beEvent.baseEntity.GetAll())
+              : undefined,
         });
       }
     }
@@ -1054,6 +1148,15 @@ const setupComplete$ = new ReplaySubject(1);
     }
   });
 
+  // graphql-ws's ws integration takes its keepalive as a THIRD POSITIONAL argument to useServer,
+  // defaulting to 12_000 when omitted. That default was doing real work here while being invisible
+  // at the call site: the server pings every 12s and terminates the socket after an unanswered
+  // pong, which is why MJAPI notices a half-open link in ~12-24s while the browser — whose
+  // graphql-ws client does nothing on an unanswered pong — noticed nothing at all (MJ #4222).
+  // Stated explicitly so the behaviour is visible and tunable, and so the next reader does not
+  // conclude from the call site that no server-side heartbeat exists. Value unchanged.
+  const WS_SERVER_KEEPALIVE_MS = 12_000;
+
   // Track per-connection expiry timers so we can clean them up on close
   const expiryTimers = new WeakMap<object, ReturnType<typeof setTimeout>>();
 
@@ -1128,7 +1231,8 @@ const setupComplete$ = new ReplaySubject(1);
         console.error('WebSocket error:', errors);
       },
     },
-    webSocketServer
+    webSocketServer,
+    WS_SERVER_KEEPALIVE_MS
   );
 
   const apolloServer = buildApolloServer(
@@ -1378,7 +1482,7 @@ const setupComplete$ = new ReplaySubject(1);
   startupLog.LogIf('verbose', `[Auth] Public provider catalog registered at ${AUTH_CATALOG_MOUNT_PATH}/providers`);
 
   // ─── Unified auth middleware (replaces both REST authMiddleware and contextFunction auth) ─────
-  app.use(createUnifiedAuthMiddleware(dataSources));
+  app.use(CreateUnifiedAuthMiddleware(dataSources));
 
   // ─── Post-auth middleware from BaseServerMiddleware plugins ─────
   // Middleware here has access to the authenticated user via req.userPayload.
@@ -1559,8 +1663,25 @@ const setupComplete$ = new ReplaySubject(1);
   // instance is still heart-beating. The watchdog also self-registers for graceful-shutdown
   // cancellation (via ShutdownRegistry) once it begins tracking this process's first live run.
   if (resumeUser && Metadata.Provider instanceof DatabaseProviderBase) { // global-provider-ok: server startup recovery — one-shot orphaned-run sweep at boot
-    AgentRunWatchdog.SweepOrphanedRuns(Metadata.Provider, resumeUser) // global-provider-ok: server startup recovery — one-shot orphaned-run sweep at boot
+    const sweepUser = resumeUser;
+    const sweepProvider = Metadata.Provider; // global-provider-ok: server startup recovery — one-shot orphaned-run sweep at boot
+    AgentRunWatchdog.SweepOrphanedRuns(sweepProvider, sweepUser)
       .catch(err => console.warn(`[AgentRunWatchdog] Startup sweep failed: ${err}`));
+
+    // The watchdog repairs the RUN; nothing repaired the conversation detail, which is the row the
+    // chat actually renders from (MJ #4222). A process that dies mid-run leaves a terminal run
+    // beside a message that still claims to be generating, and it spins forever for anyone who
+    // opens it. Runs at boot (closes restart orphans) and on a timer (closes mid-life orphans),
+    // mirroring the watchdog's own two-phase shape.
+    const reconcileOrphans = () =>
+      ReconcileOrphanedConversationDetails(sweepProvider, sweepUser)
+        .catch(err => console.warn(`[OrphanDetailReconciler] Pass failed: ${err}`));
+    void reconcileOrphans();
+    const orphanDetailTimer = setInterval(() => void reconcileOrphans(), ORPHAN_DETAIL_SWEEP_INTERVAL_MS);
+    ShutdownRegistry.Instance.Register({
+      ShutdownName: 'OrphanDetailReconciler',
+      Shutdown: () => { clearInterval(orphanDetailTimer); },
+    });
   }
 
   // Launch the AI Agent Session janitor: run own-host orphan recovery once at boot, then keep a
@@ -1667,6 +1788,8 @@ const setupComplete$ = new ReplaySubject(1);
 
   process.on('SIGTERM', () => gracefulShutdown('SIGTERM'));
   process.on('SIGINT', () => gracefulShutdown('SIGINT'));
+  // Operator control: `kill -HUP <pid>` hard-reloads metadata from the DB — see metadataRefreshSignal.ts
+  process.on(METADATA_REFRESH_SIGNAL, CreateMetadataRefreshSignalHandler(() => Metadata.Provider.Refresh())); // global-provider-ok: operator-triggered refresh of the global cache that per-request providers adopt from
 
   // Handle unhandled promise rejections to prevent server crashes
   process.on('unhandledRejection', (reason, promise) => {
@@ -1677,6 +1800,9 @@ const setupComplete$ = new ReplaySubject(1);
   });
 };
 
+/** @deprecated Use {@link Serve}. */
+export const serve = Serve;
+
 /**
  * Age at which an unprocessed `MJ: RSU Pending Works` row is reported as stranded.
  * A row older than this survived at least one full restart cycle without being completed.

package/src/integration/CustomColumnPromoter.ts

@@ -133,7 +133,7 @@ interface WorkItem {
 }
 
 /** Registers the post-sync custom-column promotion hook on the IntegrationEngine singleton. */
-export function registerIntegrationCustomColumnPromoter(): void {
+export function RegisterIntegrationCustomColumnPromoter(): void {
     IntegrationEngine.Instance.SetPostSyncSchemaPromotionCallback(async (ctx) => {
         const user = ctx.ContextUser as UserInfo;
         const provider = ctx.Provider as IMetadataProvider | undefined;
@@ -164,6 +164,11 @@ export function registerIntegrationCustomColumnPromoter(): void {
     LogStatusEx({ message: '[CustomColumnPromoter] Registered post-sync custom-column promotion hook (auto-promote opt-in, default OFF).', verboseOnly: true });
 }
 
+/** @deprecated Use {@link RegisterIntegrationCustomColumnPromoter}. */
+export function registerIntegrationCustomColumnPromoter(): void {
+    return RegisterIntegrationCustomColumnPromoter();
+}
+
 /** Reads the per-connection `autoPromoteCustomColumns` flag (default false = capture-only, on-demand promotion). */
 async function readAutoPromoteFlag(companyIntegrationID: string, user: UserInfo, provider?: IMetadataProvider): Promise<boolean> {
     try {

package/src/integration/EntityMapLifecycle.ts

@@ -242,7 +242,7 @@ export interface SelectableSourceField {
  * `null`/`undefined` selection means "all fields", which is not the same as an EMPTY selection —
  * an empty array is a real (if unusual) choice, and still yields the keys.
  */
-export function selectFieldsToMap<T extends SelectableSourceField>(
+export function SelectFieldsToMap<T extends SelectableSourceField>(
     allFields: readonly T[],
     selectedFieldNames: readonly string[] | null | undefined,
 ): T[] {
@@ -251,6 +251,14 @@ export function selectFieldsToMap<T extends SelectableSourceField>(
     return allFields.filter(f => selected.has(f.Name.toLowerCase()) || f.IsPrimaryKey === true);
 }
 
+/** @deprecated Use {@link SelectFieldsToMap}. */
+export function selectFieldsToMap<T extends SelectableSourceField>(
+    allFields: readonly T[],
+    selectedFieldNames: readonly string[] | null | undefined,
+): T[] {
+    return SelectFieldsToMap(allFields, selectedFieldNames);
+}
+
 /** One existing field map, reduced to what the reconciliation decision needs. */
 export interface ExistingFieldMapRead {
     SourceFieldName: string | null;
@@ -289,7 +297,7 @@ export interface FieldMapReconcilePlan {
  *    stopped reporting the column, so it returns to the state it had.
  *  - **Vanished column → `Inactive`, never deleted.** Retiring is reversible by the branch above.
  */
-export function decideFieldMapReconcile(
+export function DecideFieldMapReconcile(
     activeFieldNames: readonly string[],
     existing: readonly ExistingFieldMapRead[],
     mapEnabled: boolean,
@@ -320,3 +328,13 @@ export function decideFieldMapReconcile(
     }
     return plan;
 }
+
+/** @deprecated Use {@link DecideFieldMapReconcile}. */
+export function decideFieldMapReconcile(
+    activeFieldNames: readonly string[],
+    existing: readonly ExistingFieldMapRead[],
+    mapEnabled: boolean,
+    autoEnableNewColumns = true,
+): FieldMapReconcilePlan {
+    return DecideFieldMapReconcile(activeFieldNames, existing, mapEnabled, autoEnableNewColumns);
+}

package/src/logging/NoLog.ts

@@ -64,7 +64,7 @@ export function NoLog(target: object, propertyKey?: string | symbol, parameterIn
  * Pass the resolver class itself (e.g. `MyResolver`) — the function reads from the
  * prototype internally to match how type-graphql stores resolver metadata.
  */
-export function hasNoLogParameter(
+export function HasNoLogParameter(
   resolverClass: Function,
   methodName: string,
   parameterIndex: number,
@@ -74,6 +74,15 @@ export function hasNoLogParameter(
   return marks !== undefined && marks.has(parameterIndex);
 }
 
+/** @deprecated Use {@link HasNoLogParameter}. */
+export function hasNoLogParameter(
+  resolverClass: Function,
+  methodName: string,
+  parameterIndex: number,
+): boolean {
+  return HasNoLogParameter(resolverClass, methodName, parameterIndex);
+}
+
 /**
  * Returns the set of field names decorated `@NoLog` on the given input class. Empty set
  * if none were marked.
@@ -81,8 +90,13 @@ export function hasNoLogParameter(
  * Pass the input class itself (e.g. `GetDataInputType`) — the function reads from the
  * prototype internally.
  */
-export function getNoLogFields(inputTypeClass: Function): ReadonlySet<string> {
+export function GetNoLogFields(inputTypeClass: Function): ReadonlySet<string> {
   const target = inputTypeClass.prototype as object;
   const marks = Reflect.getMetadata(NO_LOG_FIELD_KEY, target) as Set<string> | undefined;
   return marks ?? new Set<string>();
 }
+
+/** @deprecated Use {@link GetNoLogFields}. */
+export function getNoLogFields(inputTypeClass: Function): ReadonlySet<string> {
+  return GetNoLogFields(inputTypeClass);
+}

package/src/logging/StartupLogger.ts

@@ -117,7 +117,7 @@ export class StartupLogger {
    * operator knob governs both telemetry and server logging. Defaults to
    * `standard` when unset or unrecognized.
    */
-  public static resolveLevelFromConfig(): ServerLogLevel {
+  public static ResolveLevelFromConfig(): ServerLogLevel {
     const raw = configInfo.telemetry?.level;
     if (raw === 'minimal' || raw === 'standard' || raw === 'verbose' || raw === 'debug') {
       return raw;
@@ -125,6 +125,11 @@ export class StartupLogger {
     return 'standard';
   }
 
+  /** @deprecated Use {@link ResolveLevelFromConfig}. */
+  public static resolveLevelFromConfig(): ServerLogLevel {
+    return this.ResolveLevelFromConfig();
+  }
+
   /**
    * True when the active level is at least `minLevel` (using the ascending
    * `minimal < standard < verbose < debug` ordering).

package/src/logging/bootAudit.ts

@@ -1,6 +1,6 @@
 import { getMetadataStorage } from 'type-graphql';
 import { configInfo } from '../config.js';
-import { hasNoLogParameter } from './NoLog.js';
+import { HasNoLogParameter } from './NoLog.js';
 
 // Delete is included alongside Create/Update so codegen DeleteMJ*Input resolvers count as
 // metadata-bound and don't flood the audit with false positives (their args are PK + Options
@@ -13,12 +13,12 @@ const INPUT_TYPE_REGEX = /^(Create|Update|Delete).+Input$/;
  * Used by the audit walker. Mirrors the subset of `ArgParamMetadata` we need.
  */
 export type AuditArgParam = {
-  kind: 'arg';
-  index: number;
-  name: string;
-  target: Function;
-  methodName: string;
-  getType: () => unknown;
+  kind: 'arg';  // case-violation-ok-legacy-back-compat: the old name is also read off a value typed `any`, where a rename would compile and silently return undefined
+  Index: number;
+  name: string;  // case-violation-ok-legacy-back-compat: the old name is also read off a value typed `any`, where a rename would compile and silently return undefined
+  Target: Function;
+  MethodName: string;
+  GetType: () => unknown;
 };
 
 /**
@@ -26,9 +26,9 @@ export type AuditArgParam = {
  * Includes `@Query`, `@Mutation`, `@Subscription` entries.
  */
 export type AuditResolver = {
-  target: Function;
-  methodName: string;
-  params?: ReadonlyArray<{ kind: string; index: number } & Partial<AuditArgParam>>;
+  Target: Function;
+  MethodName: string;
+  params?: ReadonlyArray<{ kind: string; Index: number } & Partial<AuditArgParam>>;  // case-violation-ok-legacy-back-compat: optional, and the old name is also read off a value the checker cannot type; renaming it stays assignable and silently yields undefined
 };
 
 /**
@@ -42,7 +42,7 @@ export type AuditResolver = {
  *
  * Never throws. Boot does not fail on a missed `@NoLog`.
  */
-export function auditResolversForUndecoratedArgs(): void {
+export function AuditResolversForUndecoratedArgs(): void {
   if (!configInfo.loggingSettings.graphql.logVariables) {
     return;
   }
@@ -52,24 +52,34 @@ export function auditResolversForUndecoratedArgs(): void {
     mutations: AuditResolver[];
     subscriptions: AuditResolver[];
   };
-  auditResolverList([
+  AuditResolverList([
     ...storage.queries,
     ...storage.mutations,
     ...storage.subscriptions,
   ]);
 }
 
+/** @deprecated Use {@link AuditResolversForUndecoratedArgs}. */
+export function auditResolversForUndecoratedArgs(): void {
+  return AuditResolversForUndecoratedArgs();
+}
+
 /**
  * Internal helper exported for test injection. Takes a list of resolver metadata directly,
  * skipping the global `getMetadataStorage()` lookup. The boot-time scan uses this after
  * pulling from the global storage; tests pass in a synthetic fixture.
  */
-export function auditResolverList(resolvers: ReadonlyArray<AuditResolver>): void {
+export function AuditResolverList(resolvers: ReadonlyArray<AuditResolver>): void {
   for (const resolver of resolvers) {
     auditResolver(resolver);
   }
 }
 
+/** @deprecated Use {@link AuditResolverList}. */
+export function auditResolverList(resolvers: ReadonlyArray<AuditResolver>): void {
+  return AuditResolverList(resolvers);
+}
+
 function auditResolver(resolver: AuditResolver): void {
   for (const param of resolver.params ?? []) {
     if (param.kind !== 'arg') {
@@ -84,10 +94,10 @@ function auditArg(resolver: AuditResolver, argParam: AuditArgParam): void {
   if (typeName && INPUT_TYPE_REGEX.test(typeName)) {
     return;
   }
-  if (hasNoLogParameter(resolver.target, resolver.methodName, argParam.index)) {
+  if (HasNoLogParameter(resolver.Target, resolver.MethodName, argParam.Index)) {
     return;
   }
-  const resolverName = `${resolver.target.name}.${resolver.methodName}`;
+  const resolverName = `${resolver.Target.name}.${resolver.MethodName}`;
   console.warn(
     `[mj:NoLog audit] Custom resolver ${resolverName} takes argument '${argParam.name}' ` +
     `(type ${typeName ?? 'unknown'}) which is not marked @NoLog. Verify this argument does ` +
@@ -103,7 +113,7 @@ function auditArg(resolver: AuditResolver, argParam: AuditArgParam): void {
  */
 function readArgTypeName(argParam: AuditArgParam): string | undefined {
   try {
-    const type = argParam.getType();
+    const type = argParam.GetType();
     if (typeof type === 'function') {
       return (type as { name?: string }).name;
     }

package/src/logging/boundaryLogPayload.ts

@@ -12,8 +12,15 @@
  *
  * See docs/adr/0001-graphql-variables-logging-tiered-by-verbose.md.
  */
-export function buildBoundaryLogPayload(
+export function BuildBoundaryLogPayload(
   operationName: string | undefined,
 ): { operationName: string | undefined } {
   return { operationName };
 }
+
+/** @deprecated Use {@link BuildBoundaryLogPayload}. */
+export function buildBoundaryLogPayload(
+  operationName: string | undefined,
+): { operationName: string | undefined } {
+  return BuildBoundaryLogPayload(operationName);
+}

package/src/logging/secretRedactor.ts

@@ -1,5 +1,5 @@
 import type { IMetadataProvider } from '@memberjunction/core';
-import { shortenForLog } from './shortenForLog.js';
+import { ShortenForLog } from './shortenForLog.js';
 
 /**
  * Input to the redactor. Built per `@Arg` per resolver call by the variables-logging middleware.
@@ -15,11 +15,11 @@ import { shortenForLog } from './shortenForLog.js';
  *   this set (decorator-driven) when walking top-level keys.
  */
 export type RedactionContext = {
-  inputTypeName: string;
-  rawValue: unknown;
-  provider: IMetadataProvider;
-  noLogParameter: boolean;
-  noLogFields: ReadonlySet<string>;
+  inputTypeName: string;  // case-violation-ok-legacy-back-compat: renaming it broke a use the checker could not see from the declaration — the compile proved it
+  rawValue: unknown;  // case-violation-ok-legacy-back-compat: renaming it broke a use the checker could not see from the declaration — the compile proved it
+  provider: IMetadataProvider;  // case-violation-ok-legacy-back-compat: the old name is also read off a value typed `any`, where a rename would compile and silently return undefined
+  noLogParameter: boolean;  // case-violation-ok-legacy-back-compat: renaming it broke a use the checker could not see from the declaration — the compile proved it
+  noLogFields: ReadonlySet<string>;  // case-violation-ok-legacy-back-compat: renaming it broke a use the checker could not see from the declaration — the compile proved it
 };
 
 // Delete is included so DeleteMJ*Input resolvers resolve to their entity (yielding an empty
@@ -33,7 +33,7 @@ const INPUT_TYPE_REGEX = /^(Create|Update|Delete)(?<name>.+)Input$/;
 // type-graphql allows @Field({ name: 'overrideName' }) to rename fields at the
 // GraphQL layer; MJ codegen does not use this. A future maintainer renaming an
 // encrypted field at the GraphQL layer would silently miss redaction.
-export function redactArg(ctx: RedactionContext): unknown {
+export function RedactArg(ctx: RedactionContext): unknown {
   if (ctx.noLogParameter) {
     return '<redacted>';
   }
@@ -79,7 +79,7 @@ export function redactArg(ctx: RedactionContext): unknown {
     !Array.isArray(ctx.rawValue);
 
   if (!canWalk) {
-    return shortenForLog(ctx.rawValue);
+    return ShortenForLog(ctx.rawValue);
   }
 
   const result: Record<string, unknown> = {};
@@ -87,12 +87,17 @@ export function redactArg(ctx: RedactionContext): unknown {
     if (encryptedFieldNames.has(key) || ctx.noLogFields.has(key)) {
       result[key] = '<redacted>';
     } else {
-      result[key] = shortenForLog(value);
+      result[key] = ShortenForLog(value);
     }
   }
   return result;
 }
 
+/** @deprecated Use {@link RedactArg}. */
+export function redactArg(ctx: RedactionContext): unknown {
+  return RedactArg(ctx);
+}
+
 const EMPTY_SET: ReadonlySet<string> = new Set<string>();
 
 /**

package/src/logging/shortenForLog.ts

@@ -4,14 +4,19 @@
  * Objects whose JSON exceeds `maxLen` and contain nested structure are recursed into so
  * outer keys remain visible.
  */
-export function shortenForLog(value: unknown, maxLen = 300): unknown {
+export function ShortenForLog(value: unknown, maxLen = 300): unknown {
   if (value === null || typeof value !== 'object') return value;
-  if (Array.isArray(value)) return value.map((v) => shortenForLog(v, maxLen));
+  if (Array.isArray(value)) return value.map((v) => ShortenForLog(v, maxLen));
   const json = JSON.stringify(value);
   if (json.length <= maxLen) return json;
   const result: Record<string, unknown> = {};
   for (const [k, v] of Object.entries(value as Record<string, unknown>)) {
-    result[k] = shortenForLog(v, maxLen);
+    result[k] = ShortenForLog(v, maxLen);
   }
   return result;
 }
+
+/** @deprecated Use {@link ShortenForLog}. */
+export function shortenForLog(value: unknown, maxLen = 300): unknown {
+  return ShortenForLog(value, maxLen);
+}