@checkstack/automation-backend 0.2.0 → 0.3.0

package/src/dispatch/wait-until.test.ts

@@ -0,0 +1,540 @@
+import { describe, it, expect } from "bun:test";
+import { AutomationDefinitionSchema } from "@checkstack/automation-common";
+import { createActionRegistry } from "../action-registry";
+import {
+  checkWaitUntil,
+  dispatchTrigger,
+  WAIT_TIMEOUT_QUEUE_NAME,
+} from "./engine";
+import { startStalledSweeper } from "./stalled-sweeper";
+import { createChangeDeriverRegistry } from "../entity/change-derivers";
+import { routeEntityChange } from "./stage1-router";
+import { handleDispatchJob, DISPATCH_QUEUE_NAME } from "./stage2-dispatch";
+import type { EntityChanged } from "@checkstack/automation-common";
+import { SYSTEM_ACTOR } from "@checkstack/common";
+import {
+  makeDispatchDeps,
+  makeRecordingAction,
+  testPlugin,
+} from "./test-fixtures";
+import type { LoadedAutomation } from "./types";
+import type { AutomationStore } from "../automation-store";
+
+/** A health client whose `system` status is mutable between checks. */
+function mutableHealthClient(initial: string) {
+  const state = { status: initial };
+  const stateObj = () => ({
+    status: state.status,
+    inStatusSince: new Date(),
+    inStatusForMs: 0,
+    inMaintenance: false,
+    evaluatedAt: new Date(),
+  });
+  return {
+    set: (s: string) => {
+      state.status = s;
+    },
+    client: {
+      getHealthState: async () => stateObj(),
+      getBulkHealthState: async ({ systemIds }: { systemIds: string[] }) => {
+        const states: Record<string, unknown> = {};
+        for (const id of systemIds) states[id] = stateObj();
+        return { states };
+      },
+    } as never,
+  };
+}
+
+/**
+ * A health client that flips to `flipped` on the Nth `getBulkHealthState`
+ * call (1-based) — used to simulate a change landing in the wait_until ARM
+ * WINDOW (between the lock being committed and the engine's re-evaluation).
+ */
+function flipOnNthBulkCall(args: {
+  initial: string;
+  flipped: string;
+  nthCall: number;
+}) {
+  let calls = 0;
+  const stateObj = (status: string) => ({
+    status,
+    inStatusSince: new Date(),
+    inStatusForMs: 0,
+    inMaintenance: false,
+    evaluatedAt: new Date(),
+  });
+  return {
+    callCount: () => calls,
+    client: {
+      getHealthState: async () => stateObj(args.initial),
+      getBulkHealthState: async ({ systemIds }: { systemIds: string[] }) => {
+        calls += 1;
+        const status = calls >= args.nthCall ? args.flipped : args.initial;
+        const states: Record<string, unknown> = {};
+        for (const id of systemIds) states[id] = stateObj(status);
+        return { states };
+      },
+    } as never,
+  };
+}
+
+function automation(actions: unknown[]): LoadedAutomation {
+  const definition = AutomationDefinitionSchema.parse({
+    name: "WU",
+    triggers: [{ event: "test.event" }],
+    conditions: [],
+    actions,
+    mode: "single",
+    max_runs: 10,
+  });
+  return { id: "auto-1", name: "WU", status: "enabled", definition };
+}
+
+/** Minimal automation store returning a single fixed automation. */
+function storeFor(auto: LoadedAutomation): AutomationStore {
+  return {
+    create: async () => {
+      throw new Error("nope");
+    },
+    update: async () => {
+      throw new Error("nope");
+    },
+    delete: async () => {},
+    toggle: async () => {
+      throw new Error("nope");
+    },
+    getById: async (id) =>
+      id === auto.id
+        ? {
+            id: auto.id,
+            name: auto.name,
+            description: undefined,
+            status: auto.status,
+            definition: auto.definition,
+            managedBy: undefined,
+            createdAt: new Date(),
+            updatedAt: new Date(),
+          }
+        : undefined,
+    list: async () => ({ items: [], total: 0 }),
+    listGroups: async () => [],
+    findEnabledByTriggerEvent: async () => [auto],
+    listEnabled: async () => [auto],
+  };
+}
+
+const CONDITION = "health.system.status == 'healthy'";
+
+function setup(initialStatus: string) {
+  const actionsReg = createActionRegistry();
+  const rec = makeRecordingAction();
+  actionsReg.register(rec.definition, testPlugin);
+  const health = mutableHealthClient(initialStatus);
+  const { deps, runs, queue, state } = makeDispatchDeps({
+    actions: actionsReg,
+    healthCheckClient: health.client,
+  });
+  return { deps, runs, queue, state, rec, health };
+}
+
+/** A `health:<id>` entity change, used to drive Stage-1 wake routing. */
+function healthChange(id: string): EntityChanged {
+  return {
+    kind: "health",
+    id,
+    prev: { status: "unhealthy" },
+    next: { status: "healthy" },
+    delta: { status: "healthy" },
+    changedFields: ["status"],
+    actor: SYSTEM_ACTOR,
+    occurredAt: new Date().toISOString(),
+  };
+}
+
+describe("wait_until — immediate satisfaction", () => {
+  it("continues inline without suspending when already true", async () => {
+    const { deps, runs, rec } = setup("healthy");
+    const auto = automation([
+      { wait_until: { condition: CONDITION } },
+      { action: "test.record", config: { value: "after" } },
+    ]);
+    const result = await dispatchTrigger(deps, {
+      automation: auto,
+      triggerId: "test_event",
+      triggerEventId: "test.event",
+      payload: { id: "sys-1" },
+      contextKey: "sys-1",
+    });
+    expect(result.status).toBe("success");
+    expect(runs.waitLocks.size).toBe(0);
+    expect(rec.calls.map((c) => c.value)).toEqual(["after"]);
+  });
+});
+
+describe("wait_until — reactive suspend + wake-index", () => {
+  it("suspends with a wake-index ref and NO poll job, then a relevant change wakes + resumes", async () => {
+    const { deps, runs, queue, rec, health } = setup("unhealthy");
+    const auto = automation([
+      { wait_until: { condition: CONDITION } },
+      { action: "test.record", config: { value: "recovered" } },
+    ]);
+
+    const result = await dispatchTrigger(deps, {
+      automation: auto,
+      triggerId: "test_event",
+      triggerEventId: "test.event",
+      payload: { id: "sys-1" },
+      contextKey: "sys-1",
+    });
+    expect(result.status).toBe("waiting");
+    expect(runs.waitLocks.size).toBe(1);
+    expect(rec.calls).toHaveLength(0);
+
+    // Reactive: NO poll re-check job is enqueued (and no timeout was set).
+    expect(queue.jobs).toHaveLength(0);
+
+    // The wake-index recorded the health wildcard (health.system → kind:*).
+    const lock = [...runs.waitLocks.values()][0]!;
+    const refs = runs.wakeRefs.get(lock.id);
+    expect(refs && [...refs]).toEqual(["health:*"]);
+
+    // Stage-1 routing of a relevant ENTITY_CHANGED enqueues a Stage-2 wake.
+    health.set("healthy");
+    const changeDerivers = createChangeDeriverRegistry();
+    const jobs = await routeEntityChange({
+      deps,
+      automationStore: storeFor(auto),
+      changeDerivers,
+      changed: healthChange("sys-1"),
+    });
+    expect(jobs).toHaveLength(1);
+    expect(jobs[0]?.reason).toBe("wake");
+    // The Stage-2 wake job was enqueued onto the dispatch queue.
+    expect(queue.jobs.some((j) => j.queue === DISPATCH_QUEUE_NAME)).toBe(true);
+
+    // Run the Stage-2 wake job → re-eval (now true) → resume.
+    await handleDispatchJob({
+      deps,
+      automationStore: storeFor(auto),
+      changeDerivers,
+      job: jobs[0]!,
+    });
+    expect(runs.runs.get(result.runId)?.status).toBe("success");
+    expect(rec.calls.map((c) => c.value)).toEqual(["recovered"]);
+    expect(runs.waitLocks.size).toBe(0);
+  });
+
+  it("a wake while the condition is still false does NOT resume (re-eval gate)", async () => {
+    const { deps, runs, rec } = setup("unhealthy");
+    const auto = automation([
+      { wait_until: { condition: CONDITION } },
+      { action: "test.record", config: { value: "recovered" } },
+    ]);
+    const result = await dispatchTrigger(deps, {
+      automation: auto,
+      triggerId: "test_event",
+      triggerEventId: "test.event",
+      payload: { id: "sys-1" },
+      contextKey: "sys-1",
+    });
+    expect(result.status).toBe("waiting");
+
+    const lock = [...runs.waitLocks.values()][0]!;
+    // Still unhealthy → re-eval false → still-waiting.
+    const outcome = await checkWaitUntil(deps, {
+      runId: result.runId,
+      waitLockId: lock.id,
+      automation: auto,
+    });
+    expect(outcome).toBe("still-waiting");
+    expect(rec.calls).toHaveLength(0);
+    expect(runs.waitLocks.size).toBe(1);
+  });
+});
+
+describe("wait_until — lost-wakeup arm-window guard (§17)", () => {
+  it("resumes inline (no stall) when the condition becomes true between arming the lock and the re-eval", async () => {
+    // The fast path sees `unhealthy` (call 1, at dispatch start), arms the
+    // wait lock + wake-index, THEN the arm-window re-eval (call 2) sees the
+    // system flip to `healthy` — modelling an ENTITY_CHANGED that landed
+    // during the arm window and was NOT routed to a wake job. Without the
+    // re-evaluate-on-registration guard this NO-TIMEOUT wait would stall
+    // forever (the sweeper only re-checks locks with a timeout).
+    const actionsReg = createActionRegistry();
+    const rec = makeRecordingAction();
+    actionsReg.register(rec.definition, testPlugin);
+    const health = flipOnNthBulkCall({
+      initial: "unhealthy",
+      flipped: "healthy",
+      nthCall: 2,
+    });
+    const { deps, runs, queue } = makeDispatchDeps({
+      actions: actionsReg,
+      healthCheckClient: health.client,
+    });
+
+    const auto = automation([
+      { wait_until: { condition: CONDITION } },
+      { action: "test.record", config: { value: "recovered" } },
+    ]);
+
+    const result = await dispatchTrigger(deps, {
+      automation: auto,
+      triggerId: "test_event",
+      triggerEventId: "test.event",
+      payload: { id: "sys-1" },
+      contextKey: "sys-1",
+    });
+
+    // Resumed inline: the run finished rather than stalling as `waiting`.
+    expect(result.status).toBe("success");
+    expect(runs.runs.get(result.runId)?.status).toBe("success");
+    // The post-wait action ran.
+    expect(rec.calls.map((c) => c.value)).toEqual(["recovered"]);
+    // The lock (and its wake-index rows) were cleaned up.
+    expect(runs.waitLocks.size).toBe(0);
+    // No timeout job was armed (no timeout was set), and crucially no poll
+    // loop — the run completed purely via the inline re-eval.
+    expect(queue.jobs).toHaveLength(0);
+    // Sanity: the arm-window re-eval actually re-queried health.
+    expect(health.callCount()).toBeGreaterThanOrEqual(2);
+  });
+});
+
+describe("wait_until — timeout", () => {
+  it("arms a single timeout timer job (not a poll loop)", async () => {
+    const { deps, queue } = setup("unhealthy");
+    const auto = automation([
+      { wait_until: { condition: CONDITION, timeout_seconds: 60 } },
+      { action: "test.record", config: { value: "escalate" } },
+    ]);
+    await dispatchTrigger(deps, {
+      automation: auto,
+      triggerId: "test_event",
+      triggerEventId: "test.event",
+      payload: { id: "sys-1" },
+      contextKey: "sys-1",
+    });
+    const timeoutJobs = queue.jobs.filter(
+      (j) => j.queue === WAIT_TIMEOUT_QUEUE_NAME,
+    );
+    expect(timeoutJobs).toHaveLength(1);
+    expect(timeoutJobs[0]?.startDelay).toBeGreaterThan(0);
+  });
+
+  it("continues past on timeout when continue_on_timeout is true (default)", async () => {
+    const { deps, runs, rec } = setup("unhealthy");
+    const auto = automation([
+      { wait_until: { condition: CONDITION, timeout_seconds: 60 } },
+      { action: "test.record", config: { value: "escalate" } },
+    ]);
+    const result = await dispatchTrigger(deps, {
+      automation: auto,
+      triggerId: "test_event",
+      triggerEventId: "test.event",
+      payload: { id: "sys-1" },
+      contextKey: "sys-1",
+    });
+    expect(result.status).toBe("waiting");
+    const lock = [...runs.waitLocks.values()][0]!;
+    // Force the deadline into the past.
+    lock.timeoutAt = new Date(Date.now() - 1000);
+
+    const outcome = await checkWaitUntil(deps, {
+      runId: result.runId,
+      waitLockId: lock.id,
+      automation: auto,
+    });
+    expect(outcome).toBe("resumed");
+    expect(runs.runs.get(result.runId)?.status).toBe("success");
+    expect(rec.calls.map((c) => c.value)).toEqual(["escalate"]);
+  });
+
+  it("fails the run on timeout when continue_on_timeout is false", async () => {
+    const { deps, runs, rec } = setup("unhealthy");
+    const auto = automation([
+      {
+        wait_until: {
+          condition: CONDITION,
+          timeout_seconds: 60,
+          continue_on_timeout: false,
+        },
+      },
+      { action: "test.record", config: { value: "after" } },
+    ]);
+    const result = await dispatchTrigger(deps, {
+      automation: auto,
+      triggerId: "test_event",
+      triggerEventId: "test.event",
+      payload: { id: "sys-1" },
+      contextKey: "sys-1",
+    });
+    const lock = [...runs.waitLocks.values()][0]!;
+    lock.timeoutAt = new Date(Date.now() - 1000);
+
+    const outcome = await checkWaitUntil(deps, {
+      runId: result.runId,
+      waitLockId: lock.id,
+      automation: auto,
+    });
+    expect(outcome).toBe("failed");
+    expect(runs.runs.get(result.runId)?.status).toBe("failed");
+    expect(rec.calls).toHaveLength(0);
+  });
+});
+
+describe("wait_until — timeout backstop via sweeper", () => {
+  it("the sweeper applies the timeout policy for an expired until lock whose timer was lost", async () => {
+    const { deps, runs, rec } = setup("unhealthy");
+    const auto = automation([
+      { wait_until: { condition: CONDITION, timeout_seconds: 60 } },
+      { action: "test.record", config: { value: "escalate" } },
+    ]);
+    const result = await dispatchTrigger(deps, {
+      automation: auto,
+      triggerId: "test_event",
+      triggerEventId: "test.event",
+      payload: { id: "sys-1" },
+      contextKey: "sys-1",
+    });
+    expect(result.status).toBe("waiting");
+
+    // The timeout timer job is "lost"; force the deadline into the past and
+    // only the sweeper runs.
+    const lock = [...runs.waitLocks.values()][0]!;
+    lock.timeoutAt = new Date(Date.now() - 1000);
+    const sweeper = startStalledSweeper({
+      deps,
+      automationStore: storeFor(auto),
+      logger: deps.logger,
+    });
+    await sweeper.sweep();
+    sweeper.stop();
+
+    // continue_on_timeout defaults to true → run continues past the wait.
+    expect(runs.runs.get(result.runId)?.status).toBe("success");
+    expect(rec.calls.map((c) => c.value)).toEqual(["escalate"]);
+    expect(runs.waitLocks.size).toBe(0);
+  });
+});
+
+describe("wait_until — nested inside containers", () => {
+  it("resumes a wait_until nested inside a choose branch", async () => {
+    const { deps, runs, rec, health } = setup("unhealthy");
+    const auto = automation([
+      {
+        choose: [
+          {
+            when: "trigger.payload.sev == 'crit'",
+            sequence: [
+              { action: "test.record", config: { value: "opened" } },
+              { wait_until: { condition: CONDITION } },
+              { action: "test.record", config: { value: "closed" } },
+            ],
+          },
+        ],
+      },
+    ]);
+    const result = await dispatchTrigger(deps, {
+      automation: auto,
+      triggerId: "test_event",
+      triggerEventId: "test.event",
+      payload: { id: "sys-1", sev: "crit" },
+      contextKey: "sys-1",
+    });
+    expect(result.status).toBe("waiting");
+    expect(rec.calls.map((c) => c.value)).toEqual(["opened"]);
+
+    const lock = [...runs.waitLocks.values()][0]!;
+    expect(lock.actionPath).toBe("actions[0].choose[0].sequence[1]");
+
+    health.set("healthy");
+    const outcome = await checkWaitUntil(deps, {
+      runId: result.runId,
+      waitLockId: lock.id,
+      automation: auto,
+    });
+    expect(outcome).toBe("resumed");
+    expect(runs.runs.get(result.runId)?.status).toBe("success");
+    expect(rec.calls.map((c) => c.value)).toEqual(["opened", "closed"]);
+  });
+
+  it("resumes a wait_until nested inside a repeat iteration", async () => {
+    const { deps, runs, rec, health } = setup("unhealthy");
+    const auto = automation([
+      {
+        repeat: {
+          count: 1,
+          sequence: [
+            { action: "test.record", config: { value: "iter" } },
+            { wait_until: { condition: CONDITION } },
+            { action: "test.record", config: { value: "done" } },
+          ],
+        },
+      },
+    ]);
+    const result = await dispatchTrigger(deps, {
+      automation: auto,
+      triggerId: "test_event",
+      triggerEventId: "test.event",
+      payload: { id: "sys-1" },
+      contextKey: "sys-1",
+    });
+    expect(result.status).toBe("waiting");
+    expect(rec.calls.map((c) => c.value)).toEqual(["iter"]);
+
+    const lock = [...runs.waitLocks.values()][0]!;
+    health.set("healthy");
+    const outcome = await checkWaitUntil(deps, {
+      runId: result.runId,
+      waitLockId: lock.id,
+      automation: auto,
+    });
+    expect(outcome).toBe("resumed");
+    expect(runs.runs.get(result.runId)?.status).toBe("success");
+    expect(rec.calls.map((c) => c.value)).toEqual(["iter", "done"]);
+  });
+
+  it("resumes a wait_until nested inside a parallel branch (via sequence)", async () => {
+    const { deps, runs, rec, health } = setup("unhealthy");
+    const auto = automation([
+      {
+        parallel: [
+          {
+            sequence: [
+              { action: "test.record", config: { value: "branch-a" } },
+              { wait_until: { condition: CONDITION } },
+              { action: "test.record", config: { value: "a-done" } },
+            ],
+          },
+          { action: "test.record", config: { value: "branch-b" } },
+        ],
+      },
+      { action: "test.record", config: { value: "after-parallel" } },
+    ]);
+    const result = await dispatchTrigger(deps, {
+      automation: auto,
+      triggerId: "test_event",
+      triggerEventId: "test.event",
+      payload: { id: "sys-1" },
+      contextKey: "sys-1",
+    });
+    expect(result.status).toBe("waiting");
+    // branch-a's first action + branch-b ran; branch-a suspended at the wait.
+    expect(rec.calls.map((c) => c.value).sort()).toEqual(
+      ["branch-a", "branch-b"].sort(),
+    );
+
+    const lock = [...runs.waitLocks.values()][0]!;
+    health.set("healthy");
+    const outcome = await checkWaitUntil(deps, {
+      runId: result.runId,
+      waitLockId: lock.id,
+      automation: auto,
+    });
+    expect(outcome).toBe("resumed");
+    expect(runs.runs.get(result.runId)?.status).toBe("success");
+    expect(rec.calls.map((c) => c.value)).toContain("a-done");
+    expect(rec.calls.map((c) => c.value)).toContain("after-parallel");
+  });
+});

package/src/dispatch/wake-refs.test.ts

@@ -0,0 +1,158 @@
+import { describe, it, expect } from "bun:test";
+import type { Condition } from "@checkstack/automation-common";
+
+import { extractWakeRefs, refToString, type WakeRef } from "./wake-refs";
+
+/** Sort + stringify refs for stable comparison. */
+function refStrings(refs: ReadonlyArray<WakeRef>): string[] {
+  return refs.map(refToString).toSorted();
+}
+
+describe("extractWakeRefs — structured `state` conditions", () => {
+  it("extracts the health entity ref from a state condition", () => {
+    const condition: Condition = {
+      state: { entity: "sys-1", status: "healthy" },
+    };
+    const { refs, indeterminate } = extractWakeRefs(condition);
+    expect(refStrings(refs)).toEqual(["health:sys-1"]);
+    expect(indeterminate).toBe(false);
+  });
+
+  it("carries the `for` dwell without affecting the ref", () => {
+    const condition: Condition = {
+      state: { entity: "sys-2", status: "degraded", for: { minutes: 5 } },
+    };
+    expect(refStrings(extractWakeRefs(condition).refs)).toEqual([
+      "health:sys-2",
+    ]);
+  });
+});
+
+describe("extractWakeRefs — structured `numeric_state` conditions", () => {
+  it("extracts a ref from a health.* value path", () => {
+    const condition: Condition = {
+      numeric_state: { value: "health.system.p95_latency_ms", above: 500 },
+    };
+    // health.system has no concrete id → kind wildcard.
+    expect(refStrings(extractWakeRefs(condition).refs)).toEqual(["health:*"]);
+  });
+
+  it("extracts a concrete ref from a state.<kind>.<id>.<field> value path", () => {
+    const condition: Condition = {
+      numeric_state: {
+        value: "state.slo['obj-1'].budget_remaining_percent",
+        below: 20,
+      },
+    };
+    expect(refStrings(extractWakeRefs(condition).refs)).toEqual(["slo:obj-1"]);
+  });
+
+  it("a literal numeric value references no entity", () => {
+    const condition: Condition = { numeric_state: { value: 42, above: 1 } };
+    const { refs, indeterminate } = extractWakeRefs(condition);
+    expect(refs).toHaveLength(0);
+    // touchedState (numeric_state) but no ref → indeterminate fallback.
+    expect(indeterminate).toBe(true);
+  });
+});
+
+describe("extractWakeRefs — template-string conditions", () => {
+  it("extracts state.<kind>.<id> member chains (identifier ids)", () => {
+    const condition: Condition = "state.incident.inc9.status == 'resolved'";
+    expect(refStrings(extractWakeRefs(condition).refs)).toEqual([
+      "incident:inc9",
+    ]);
+  });
+
+  it("extracts state.<kind>[<id>] index chains (hyphenated ids)", () => {
+    const condition: Condition = "state.incident['inc-9'].status == 'resolved'";
+    expect(refStrings(extractWakeRefs(condition).refs)).toEqual([
+      "incident:inc-9",
+    ]);
+  });
+
+  it("extracts health.systems[<id>] index chains", () => {
+    const condition: Condition =
+      "health.systems['sys-7'].status == 'healthy'";
+    expect(refStrings(extractWakeRefs(condition).refs)).toEqual(["health:sys-7"]);
+  });
+
+  it("treats health.system as a kind wildcard (implicit context id)", () => {
+    const condition: Condition = "health.system.status == 'healthy'";
+    expect(refStrings(extractWakeRefs(condition).refs)).toEqual(["health:*"]);
+  });
+
+  it("collects multiple distinct refs across a boolean expression", () => {
+    const condition: Condition =
+      "state.incident['inc-1'].status == 'open' && state.health['sys-2'].status == 'degraded'";
+    expect(refStrings(extractWakeRefs(condition).refs)).toEqual([
+      "health:sys-2",
+      "incident:inc-1",
+    ]);
+  });
+
+  it("de-duplicates repeated refs", () => {
+    const condition: Condition =
+      "state.health['sys-1'].status == 'healthy' || state.health['sys-1'].latency_ms > 100";
+    expect(refStrings(extractWakeRefs(condition).refs)).toEqual(["health:sys-1"]);
+  });
+});
+
+describe("extractWakeRefs — combinators", () => {
+  it("recurses into and/or/not", () => {
+    const condition: Condition = {
+      and: [
+        { state: { entity: "sys-a", status: "healthy" } },
+        {
+          or: [
+            "state.slo['obj-x'].budget_remaining_percent < 10",
+            { not: "state.maintenance['win-1'].status == 'active'" },
+          ],
+        },
+      ],
+    };
+    expect(refStrings(extractWakeRefs(condition).refs)).toEqual([
+      "health:sys-a",
+      "maintenance:win-1",
+      "slo:obj-x",
+    ]);
+  });
+});
+
+describe("extractWakeRefs — wildcard fallback (uncertain id/kind)", () => {
+  it("wildcards the kind when the id is a dynamic key", () => {
+    const condition: Condition =
+      "state.incident[trigger.payload.incidentId].status == 'open'";
+    const out = extractWakeRefs(condition);
+    // The dynamic index yields the kind wildcard. The dynamic key itself
+    // (`trigger.payload.incidentId`) reads no state, so no extra ref.
+    expect(refStrings(out.refs)).toEqual(["incident:*"]);
+  });
+
+  it("wildcards when state.<kind> is read with no id", () => {
+    const condition: Condition = "state.health.systems != null";
+    // `state.health.systems`: kind=health, id=systems is treated as the id
+    // segment — a concrete (if unusual) ref. Use a bare-kind case instead:
+    const bareKind: Condition = "state.incident != null";
+    expect(refStrings(extractWakeRefs(condition).refs)).toEqual([
+      "health:systems",
+    ]);
+    expect(refStrings(extractWakeRefs(bareKind).refs)).toEqual(["incident:*"]);
+  });
+
+  it("is indeterminate when even the kind is dynamic", () => {
+    const condition: Condition = "state[trigger.kind][trigger.id].status == 1";
+    const { refs, indeterminate } = extractWakeRefs(condition);
+    expect(refs).toHaveLength(0);
+    expect(indeterminate).toBe(true);
+  });
+
+  it("is indeterminate for an unparseable template that reads no resolvable state", () => {
+    // A condition string with no state.* / health.* root and no parse error
+    // references no entity at all → not indeterminate, just empty.
+    const noState: Condition = "trigger.payload.count > 5";
+    const r1 = extractWakeRefs(noState);
+    expect(r1.refs).toHaveLength(0);
+    expect(r1.indeterminate).toBe(false);
+  });
+});