@elevasis/core 0.11.2 → 0.13.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (50) hide show
  1. package/dist/index.d.ts +2 -1
  2. package/dist/index.js +8 -1
  3. package/dist/organization-model/index.d.ts +2 -1
  4. package/dist/organization-model/index.js +8 -1
  5. package/dist/test-utils/index.d.ts +27 -15
  6. package/dist/test-utils/index.js +25 -0
  7. package/package.json +1 -1
  8. package/src/_gen/__tests__/__snapshots__/contracts.md.snap +27 -270
  9. package/src/auth/multi-tenancy/credentials/__tests__/encryption.test.ts +217 -216
  10. package/src/auth/multi-tenancy/credentials/server/encryption.ts +69 -39
  11. package/src/auth/multi-tenancy/credentials/server/kek-loader.ts +37 -0
  12. package/src/auth/multi-tenancy/index.ts +3 -0
  13. package/src/auth/multi-tenancy/invitations/api-schemas.ts +104 -107
  14. package/src/auth/multi-tenancy/memberships/api-schemas.ts +6 -5
  15. package/src/auth/multi-tenancy/memberships/membership.ts +130 -138
  16. package/src/auth/multi-tenancy/permissions.ts +12 -5
  17. package/src/auth/multi-tenancy/role-management/api-schemas.ts +78 -0
  18. package/src/auth/multi-tenancy/role-management/index.ts +16 -0
  19. package/src/business/acquisition/activity-events.ts +142 -0
  20. package/src/business/acquisition/api-schemas.ts +694 -689
  21. package/src/business/acquisition/derive-actions.ts +90 -0
  22. package/src/business/acquisition/index.ts +111 -109
  23. package/src/execution/engine/index.ts +434 -434
  24. package/src/execution/engine/tools/integration/server/adapters/apify/__tests__/apify-run-actor.integration.test.ts +298 -293
  25. package/src/execution/engine/tools/integration/server/adapters/attio/__tests__/attio-crud.integration.test.ts +0 -1
  26. package/src/execution/engine/tools/integration/service.test.ts +214 -0
  27. package/src/execution/engine/tools/integration/service.ts +169 -161
  28. package/src/execution/engine/tools/lead-service-types.ts +882 -879
  29. package/src/execution/engine/tools/registry.ts +699 -700
  30. package/src/execution/engine/tools/tool-maps.ts +777 -780
  31. package/src/integrations/credentials/__tests__/api-schemas.test.ts +420 -496
  32. package/src/integrations/credentials/api-schemas.ts +127 -143
  33. package/src/integrations/webhook-endpoints/__tests__/api-schemas.test.ts +327 -318
  34. package/src/integrations/webhook-endpoints/api-schemas.ts +103 -102
  35. package/src/integrations/webhook-endpoints/types.ts +58 -51
  36. package/src/operations/activities/api-schemas.ts +80 -79
  37. package/src/operations/activities/types.ts +64 -63
  38. package/src/organization-model/contracts.ts +1 -0
  39. package/src/organization-model/defaults.ts +6 -0
  40. package/src/organization-model/domains/navigation.ts +37 -23
  41. package/src/organization-model/organization-graph.mdx +2 -2
  42. package/src/organization-model/published.ts +2 -1
  43. package/src/platform/constants/versions.ts +1 -1
  44. package/src/reference/_generated/contracts.md +27 -270
  45. package/src/scaffold-registry/__tests__/index.test.ts +72 -7
  46. package/src/scaffold-registry/index.ts +163 -29
  47. package/src/scaffold-registry/schema.ts +68 -62
  48. package/src/server.ts +281 -272
  49. package/src/supabase/database.types.ts +16 -10
  50. package/src/test-utils/rls/RLSTestContext.ts +585 -553
@@ -1,318 +1,327 @@
1
- /**
2
- * Webhook Endpoint API schemas tests
3
- * Tests validation schemas for webhook endpoint CRUD API
4
- * Focus: Mass assignment prevention, required field enforcement, partial update rules, type coercion
5
- */
6
-
7
- import { describe, it, expect } from 'vitest'
8
- import {
9
- CreateWebhookEndpointRequestSchema,
10
- UpdateWebhookEndpointRequestSchema,
11
- ListWebhookEndpointsQuerySchema,
12
- WebhookEndpointResponseSchema
13
- } from '../api-schemas'
14
-
15
- const validUuid = 'a0eebc99-9c0b-4ef8-bb6d-6bb9bd380a11'
16
- const validUuid2 = 'b1eebc99-9c0b-4ef8-bb6d-6bb9bd380a22'
17
-
18
- describe('CreateWebhookEndpointRequestSchema', () => {
19
- const validPayload = {
20
- name: 'My Inbound Webhook',
21
- resourceId: 'my-workflow-workflow'
22
- }
23
-
24
- describe('valid requests', () => {
25
- it('accepts name and resourceId', () => {
26
- const result = CreateWebhookEndpointRequestSchema.parse(validPayload)
27
- expect(result.name).toBe('My Inbound Webhook')
28
- expect(result.resourceId).toBe('my-workflow-workflow')
29
- })
30
-
31
- it('accepts optional description', () => {
32
- const payload = { ...validPayload, description: 'Receives Stripe events' }
33
- const result = CreateWebhookEndpointRequestSchema.parse(payload)
34
- expect(result.description).toBe('Receives Stripe events')
35
- })
36
-
37
- it('omits description when not provided', () => {
38
- const result = CreateWebhookEndpointRequestSchema.parse(validPayload)
39
- expect(result.description).toBeUndefined()
40
- })
41
-
42
- it('accepts empty string description (description is z.string, not NonEmptyString)', () => {
43
- const payload = { ...validPayload, description: '' }
44
- const result = CreateWebhookEndpointRequestSchema.parse(payload)
45
- expect(result.description).toBe('')
46
- })
47
- })
48
-
49
- describe('required fields', () => {
50
- it('rejects missing name', () => {
51
- const { name: _name, ...payload } = validPayload
52
- expect(() => CreateWebhookEndpointRequestSchema.parse(payload)).toThrow()
53
- })
54
-
55
- it('accepts missing resourceId (optional field)', () => {
56
- const { resourceId: _resourceId, ...payload } = validPayload
57
- const result = CreateWebhookEndpointRequestSchema.parse(payload)
58
- expect(result.resourceId).toBeUndefined()
59
- })
60
-
61
- it('rejects empty name (NonEmptyString enforcement)', () => {
62
- expect(() => CreateWebhookEndpointRequestSchema.parse({ ...validPayload, name: '' })).toThrow()
63
- })
64
-
65
- it('rejects empty resourceId (NonEmptyString enforcement)', () => {
66
- expect(() => CreateWebhookEndpointRequestSchema.parse({ ...validPayload, resourceId: '' })).toThrow()
67
- })
68
- })
69
-
70
- describe('SECURITY: mass assignment prevention', () => {
71
- it('rejects organizationId injection', () => {
72
- const payload = { ...validPayload, organizationId: 'attacker-org-id' }
73
- expect(() => CreateWebhookEndpointRequestSchema.parse(payload)).toThrow()
74
- })
75
-
76
- it('rejects id injection (server-generated field)', () => {
77
- const payload = { ...validPayload, id: validUuid }
78
- expect(() => CreateWebhookEndpointRequestSchema.parse(payload)).toThrow()
79
- })
80
-
81
- it('rejects key injection (server-generated field)', () => {
82
- const payload = { ...validPayload, key: 'whk_custom_key' }
83
- expect(() => CreateWebhookEndpointRequestSchema.parse(payload)).toThrow()
84
- })
85
-
86
- it('rejects status injection', () => {
87
- const payload = { ...validPayload, status: 'active' }
88
- expect(() => CreateWebhookEndpointRequestSchema.parse(payload)).toThrow()
89
- })
90
-
91
- it('rejects arbitrary unknown fields', () => {
92
- const payload = { ...validPayload, malicious: 'value' }
93
- expect(() => CreateWebhookEndpointRequestSchema.parse(payload)).toThrow()
94
- })
95
- })
96
- })
97
-
98
- describe('UpdateWebhookEndpointRequestSchema', () => {
99
- describe('valid partial updates', () => {
100
- it('accepts update with name only', () => {
101
- const result = UpdateWebhookEndpointRequestSchema.parse({ name: 'New Name' })
102
- expect(result.name).toBe('New Name')
103
- expect(result.status).toBeUndefined()
104
- })
105
-
106
- it('accepts update with status only', () => {
107
- const result = UpdateWebhookEndpointRequestSchema.parse({ status: 'paused' })
108
- expect(result.status).toBe('paused')
109
- })
110
-
111
- it('accepts update with resourceId only', () => {
112
- const result = UpdateWebhookEndpointRequestSchema.parse({ resourceId: 'other-workflow-workflow' })
113
- expect(result.resourceId).toBe('other-workflow-workflow')
114
- })
115
-
116
- it('accepts update with description only', () => {
117
- const result = UpdateWebhookEndpointRequestSchema.parse({ description: 'Updated desc' })
118
- expect(result.description).toBe('Updated desc')
119
- })
120
-
121
- it('accepts update with all fields', () => {
122
- const payload = {
123
- name: 'Updated',
124
- description: 'New desc',
125
- resourceId: 'new-workflow-workflow',
126
- status: 'active' as const
127
- }
128
- const result = UpdateWebhookEndpointRequestSchema.parse(payload)
129
- expect(result).toEqual(payload)
130
- })
131
- })
132
-
133
- describe('status values', () => {
134
- it('accepts active status', () => {
135
- const result = UpdateWebhookEndpointRequestSchema.parse({ status: 'active' })
136
- expect(result.status).toBe('active')
137
- })
138
-
139
- it('accepts paused status', () => {
140
- const result = UpdateWebhookEndpointRequestSchema.parse({ status: 'paused' })
141
- expect(result.status).toBe('paused')
142
- })
143
-
144
- it('rejects invalid status value', () => {
145
- expect(() => UpdateWebhookEndpointRequestSchema.parse({ status: 'disabled' })).toThrow()
146
- })
147
-
148
- it('rejects empty string status', () => {
149
- expect(() => UpdateWebhookEndpointRequestSchema.parse({ status: '' })).toThrow()
150
- })
151
- })
152
-
153
- describe('at least one field required', () => {
154
- it('rejects empty object', () => {
155
- expect(() => UpdateWebhookEndpointRequestSchema.parse({})).toThrow(
156
- 'At least one field (name, description, resourceId, or status) must be provided'
157
- )
158
- })
159
-
160
- it('rejects object with all fields explicitly undefined', () => {
161
- expect(() =>
162
- UpdateWebhookEndpointRequestSchema.parse({
163
- name: undefined,
164
- description: undefined,
165
- resourceId: undefined,
166
- status: undefined
167
- })
168
- ).toThrow('At least one field')
169
- })
170
- })
171
-
172
- describe('SECURITY: mass assignment prevention', () => {
173
- it('rejects organizationId injection', () => {
174
- const payload = { name: 'Valid', organizationId: 'attacker-org' }
175
- expect(() => UpdateWebhookEndpointRequestSchema.parse(payload)).toThrow()
176
- })
177
-
178
- it('rejects id injection', () => {
179
- const payload = { name: 'Valid', id: validUuid }
180
- expect(() => UpdateWebhookEndpointRequestSchema.parse(payload)).toThrow()
181
- })
182
-
183
- it('rejects unknown fields', () => {
184
- const payload = { name: 'Valid', unknownField: 'value' }
185
- expect(() => UpdateWebhookEndpointRequestSchema.parse(payload)).toThrow()
186
- })
187
- })
188
- })
189
-
190
- describe('ListWebhookEndpointsQuerySchema', () => {
191
- describe('defaults', () => {
192
- it('accepts empty query and applies defaults', () => {
193
- const result = ListWebhookEndpointsQuerySchema.parse({})
194
- expect(result.limit).toBe(20)
195
- expect(result.offset).toBe(0)
196
- expect(result.status).toBeUndefined()
197
- })
198
- })
199
-
200
- describe('status filter', () => {
201
- it('accepts active status filter', () => {
202
- const result = ListWebhookEndpointsQuerySchema.parse({ status: 'active' })
203
- expect(result.status).toBe('active')
204
- })
205
-
206
- it('accepts paused status filter', () => {
207
- const result = ListWebhookEndpointsQuerySchema.parse({ status: 'paused' })
208
- expect(result.status).toBe('paused')
209
- })
210
-
211
- it('rejects invalid status value', () => {
212
- expect(() => ListWebhookEndpointsQuerySchema.parse({ status: 'deleted' })).toThrow()
213
- })
214
- })
215
-
216
- describe('string coercion (querystring params arrive as strings)', () => {
217
- it('coerces string limit to number', () => {
218
- const result = ListWebhookEndpointsQuerySchema.parse({ limit: '50' })
219
- expect(result.limit).toBe(50)
220
- })
221
-
222
- it('coerces string offset to number', () => {
223
- const result = ListWebhookEndpointsQuerySchema.parse({ offset: '100' })
224
- expect(result.offset).toBe(100)
225
- })
226
-
227
- it('coerces both limit and offset together', () => {
228
- const result = ListWebhookEndpointsQuerySchema.parse({ limit: '10', offset: '30' })
229
- expect(result.limit).toBe(10)
230
- expect(result.offset).toBe(30)
231
- })
232
-
233
- it('rejects limit above max (100)', () => {
234
- expect(() => ListWebhookEndpointsQuerySchema.parse({ limit: '101' })).toThrow()
235
- })
236
-
237
- it('rejects negative offset', () => {
238
- expect(() => ListWebhookEndpointsQuerySchema.parse({ offset: '-1' })).toThrow()
239
- })
240
- })
241
- })
242
-
243
- describe('WebhookEndpointResponseSchema', () => {
244
- const validResponse = {
245
- id: validUuid,
246
- organizationId: validUuid2,
247
- key: 'whk_abc123def456',
248
- name: 'Stripe Inbound',
249
- description: 'Handles Stripe webhook events',
250
- resourceId: 'stripe-handler-workflow',
251
- status: 'active' as const,
252
- lastTriggeredAt: '2026-03-01T12:00:00.000Z',
253
- requestCount: 42,
254
- createdAt: '2026-01-01T00:00:00.000Z',
255
- updatedAt: '2026-03-01T12:00:00.000Z'
256
- }
257
-
258
- it('accepts a complete valid response object', () => {
259
- const result = WebhookEndpointResponseSchema.parse(validResponse)
260
- expect(result.id).toBe(validUuid)
261
- expect(result.status).toBe('active')
262
- expect(result.requestCount).toBe(42)
263
- })
264
-
265
- describe('nullable fields', () => {
266
- it('accepts null description', () => {
267
- const result = WebhookEndpointResponseSchema.parse({ ...validResponse, description: null })
268
- expect(result.description).toBeNull()
269
- })
270
-
271
- it('accepts null lastTriggeredAt (endpoint never triggered)', () => {
272
- const result = WebhookEndpointResponseSchema.parse({ ...validResponse, lastTriggeredAt: null })
273
- expect(result.lastTriggeredAt).toBeNull()
274
- })
275
-
276
- it('accepts both nullable fields as null', () => {
277
- const result = WebhookEndpointResponseSchema.parse({
278
- ...validResponse,
279
- description: null,
280
- lastTriggeredAt: null
281
- })
282
- expect(result.description).toBeNull()
283
- expect(result.lastTriggeredAt).toBeNull()
284
- })
285
- })
286
-
287
- describe('forward compatibility (not strict)', () => {
288
- it('accepts extra fields in response (allows API additions without breaking clients)', () => {
289
- const result = WebhookEndpointResponseSchema.parse({
290
- ...validResponse,
291
- newFieldFromFutureApiVersion: 'some-value'
292
- })
293
- expect(result.id).toBe(validUuid)
294
- })
295
- })
296
-
297
- describe('field validation', () => {
298
- it('rejects invalid UUID for id', () => {
299
- expect(() => WebhookEndpointResponseSchema.parse({ ...validResponse, id: 'not-a-uuid' })).toThrow()
300
- })
301
-
302
- it('rejects invalid UUID for organizationId', () => {
303
- expect(() => WebhookEndpointResponseSchema.parse({ ...validResponse, organizationId: 'not-a-uuid' })).toThrow()
304
- })
305
-
306
- it('rejects negative requestCount', () => {
307
- expect(() => WebhookEndpointResponseSchema.parse({ ...validResponse, requestCount: -1 })).toThrow()
308
- })
309
-
310
- it('rejects invalid datetime for createdAt', () => {
311
- expect(() => WebhookEndpointResponseSchema.parse({ ...validResponse, createdAt: 'not-a-date' })).toThrow()
312
- })
313
-
314
- it('rejects invalid status in response', () => {
315
- expect(() => WebhookEndpointResponseSchema.parse({ ...validResponse, status: 'unknown' })).toThrow()
316
- })
317
- })
318
- })
1
+ /**
2
+ * Webhook Endpoint API schemas tests
3
+ * Tests validation schemas for webhook endpoint CRUD API
4
+ * Focus: Mass assignment prevention, required field enforcement, partial update rules, type coercion
5
+ */
6
+
7
+ import { describe, it, expect } from 'vitest'
8
+ import {
9
+ CreateWebhookEndpointRequestSchema,
10
+ UpdateWebhookEndpointRequestSchema,
11
+ ListWebhookEndpointsQuerySchema,
12
+ WebhookEndpointResponseSchema
13
+ } from '../api-schemas'
14
+
15
+ const validUuid = 'a0eebc99-9c0b-4ef8-bb6d-6bb9bd380a11'
16
+ const validUuid2 = 'b1eebc99-9c0b-4ef8-bb6d-6bb9bd380a22'
17
+
18
+ describe('CreateWebhookEndpointRequestSchema', () => {
19
+ const validPayload = {
20
+ name: 'My Inbound Webhook',
21
+ resourceId: 'my-workflow-workflow'
22
+ }
23
+
24
+ describe('valid requests', () => {
25
+ it('accepts name and resourceId', () => {
26
+ const result = CreateWebhookEndpointRequestSchema.parse(validPayload)
27
+ expect(result.name).toBe('My Inbound Webhook')
28
+ expect(result.resourceId).toBe('my-workflow-workflow')
29
+ })
30
+
31
+ it('accepts optional description', () => {
32
+ const payload = { ...validPayload, description: 'Receives Stripe events' }
33
+ const result = CreateWebhookEndpointRequestSchema.parse(payload)
34
+ expect(result.description).toBe('Receives Stripe events')
35
+ })
36
+
37
+ it('omits description when not provided', () => {
38
+ const result = CreateWebhookEndpointRequestSchema.parse(validPayload)
39
+ expect(result.description).toBeUndefined()
40
+ })
41
+
42
+ it('accepts empty string description (description is z.string, not NonEmptyString)', () => {
43
+ const payload = { ...validPayload, description: '' }
44
+ const result = CreateWebhookEndpointRequestSchema.parse(payload)
45
+ expect(result.description).toBe('')
46
+ })
47
+ })
48
+
49
+ describe('required fields', () => {
50
+ it('rejects missing name', () => {
51
+ const { name: _name, ...payload } = validPayload
52
+ expect(() => CreateWebhookEndpointRequestSchema.parse(payload)).toThrow()
53
+ })
54
+
55
+ it('accepts missing resourceId (optional field)', () => {
56
+ const { resourceId: _resourceId, ...payload } = validPayload
57
+ const result = CreateWebhookEndpointRequestSchema.parse(payload)
58
+ expect(result.resourceId).toBeUndefined()
59
+ })
60
+
61
+ it('rejects empty name (NonEmptyString enforcement)', () => {
62
+ expect(() => CreateWebhookEndpointRequestSchema.parse({ ...validPayload, name: '' })).toThrow()
63
+ })
64
+
65
+ it('rejects empty resourceId (NonEmptyString enforcement)', () => {
66
+ expect(() => CreateWebhookEndpointRequestSchema.parse({ ...validPayload, resourceId: '' })).toThrow()
67
+ })
68
+ })
69
+
70
+ describe('SECURITY: mass assignment prevention', () => {
71
+ it('rejects organizationId injection', () => {
72
+ const payload = { ...validPayload, organizationId: 'attacker-org-id' }
73
+ expect(() => CreateWebhookEndpointRequestSchema.parse(payload)).toThrow()
74
+ })
75
+
76
+ it('rejects id injection (server-generated field)', () => {
77
+ const payload = { ...validPayload, id: validUuid }
78
+ expect(() => CreateWebhookEndpointRequestSchema.parse(payload)).toThrow()
79
+ })
80
+
81
+ it('rejects key injection (server-generated field)', () => {
82
+ const payload = { ...validPayload, key: 'whk_custom_key' }
83
+ expect(() => CreateWebhookEndpointRequestSchema.parse(payload)).toThrow()
84
+ })
85
+
86
+ it('rejects status injection', () => {
87
+ const payload = { ...validPayload, status: 'active' }
88
+ expect(() => CreateWebhookEndpointRequestSchema.parse(payload)).toThrow()
89
+ })
90
+
91
+ it('rejects arbitrary unknown fields', () => {
92
+ const payload = { ...validPayload, malicious: 'value' }
93
+ expect(() => CreateWebhookEndpointRequestSchema.parse(payload)).toThrow()
94
+ })
95
+ })
96
+ })
97
+
98
+ describe('UpdateWebhookEndpointRequestSchema', () => {
99
+ describe('valid partial updates', () => {
100
+ it('accepts update with name only', () => {
101
+ const result = UpdateWebhookEndpointRequestSchema.parse({ name: 'New Name' })
102
+ expect(result.name).toBe('New Name')
103
+ expect(result.status).toBeUndefined()
104
+ })
105
+
106
+ it('accepts update with status only', () => {
107
+ const result = UpdateWebhookEndpointRequestSchema.parse({ status: 'paused' })
108
+ expect(result.status).toBe('paused')
109
+ })
110
+
111
+ it('accepts update with resourceId only', () => {
112
+ const result = UpdateWebhookEndpointRequestSchema.parse({ resourceId: 'other-workflow-workflow' })
113
+ expect(result.resourceId).toBe('other-workflow-workflow')
114
+ })
115
+
116
+ it('accepts update with description only', () => {
117
+ const result = UpdateWebhookEndpointRequestSchema.parse({ description: 'Updated desc' })
118
+ expect(result.description).toBe('Updated desc')
119
+ })
120
+
121
+ it('accepts update with all fields', () => {
122
+ const payload = {
123
+ name: 'Updated',
124
+ description: 'New desc',
125
+ resourceId: 'new-workflow-workflow',
126
+ status: 'active' as const
127
+ }
128
+ const result = UpdateWebhookEndpointRequestSchema.parse(payload)
129
+ expect(result).toEqual(payload)
130
+ })
131
+ })
132
+
133
+ describe('status values', () => {
134
+ it('accepts active status', () => {
135
+ const result = UpdateWebhookEndpointRequestSchema.parse({ status: 'active' })
136
+ expect(result.status).toBe('active')
137
+ })
138
+
139
+ it('accepts paused status', () => {
140
+ const result = UpdateWebhookEndpointRequestSchema.parse({ status: 'paused' })
141
+ expect(result.status).toBe('paused')
142
+ })
143
+
144
+ it('rejects invalid status value', () => {
145
+ expect(() => UpdateWebhookEndpointRequestSchema.parse({ status: 'disabled' })).toThrow()
146
+ })
147
+
148
+ it('rejects empty string status', () => {
149
+ expect(() => UpdateWebhookEndpointRequestSchema.parse({ status: '' })).toThrow()
150
+ })
151
+ })
152
+
153
+ describe('at least one field required', () => {
154
+ it('rejects empty object', () => {
155
+ expect(() => UpdateWebhookEndpointRequestSchema.parse({})).toThrow(
156
+ 'At least one field (name, description, resourceId, or status) must be provided'
157
+ )
158
+ })
159
+
160
+ it('rejects object with all fields explicitly undefined', () => {
161
+ expect(() =>
162
+ UpdateWebhookEndpointRequestSchema.parse({
163
+ name: undefined,
164
+ description: undefined,
165
+ resourceId: undefined,
166
+ status: undefined
167
+ })
168
+ ).toThrow('At least one field')
169
+ })
170
+ })
171
+
172
+ describe('SECURITY: mass assignment prevention', () => {
173
+ it('rejects organizationId injection', () => {
174
+ const payload = { name: 'Valid', organizationId: 'attacker-org' }
175
+ expect(() => UpdateWebhookEndpointRequestSchema.parse(payload)).toThrow()
176
+ })
177
+
178
+ it('rejects id injection', () => {
179
+ const payload = { name: 'Valid', id: validUuid }
180
+ expect(() => UpdateWebhookEndpointRequestSchema.parse(payload)).toThrow()
181
+ })
182
+
183
+ it('rejects unknown fields', () => {
184
+ const payload = { name: 'Valid', unknownField: 'value' }
185
+ expect(() => UpdateWebhookEndpointRequestSchema.parse(payload)).toThrow()
186
+ })
187
+ })
188
+ })
189
+
190
+ describe('ListWebhookEndpointsQuerySchema', () => {
191
+ describe('defaults', () => {
192
+ it('accepts empty query and applies defaults', () => {
193
+ const result = ListWebhookEndpointsQuerySchema.parse({})
194
+ expect(result.limit).toBe(20)
195
+ expect(result.offset).toBe(0)
196
+ expect(result.status).toBeUndefined()
197
+ })
198
+ })
199
+
200
+ describe('status filter', () => {
201
+ it('accepts active status filter', () => {
202
+ const result = ListWebhookEndpointsQuerySchema.parse({ status: 'active' })
203
+ expect(result.status).toBe('active')
204
+ })
205
+
206
+ it('accepts paused status filter', () => {
207
+ const result = ListWebhookEndpointsQuerySchema.parse({ status: 'paused' })
208
+ expect(result.status).toBe('paused')
209
+ })
210
+
211
+ it('rejects invalid status value', () => {
212
+ expect(() => ListWebhookEndpointsQuerySchema.parse({ status: 'deleted' })).toThrow()
213
+ })
214
+ })
215
+
216
+ describe('string coercion (querystring params arrive as strings)', () => {
217
+ it('coerces string limit to number', () => {
218
+ const result = ListWebhookEndpointsQuerySchema.parse({ limit: '50' })
219
+ expect(result.limit).toBe(50)
220
+ })
221
+
222
+ it('coerces string offset to number', () => {
223
+ const result = ListWebhookEndpointsQuerySchema.parse({ offset: '100' })
224
+ expect(result.offset).toBe(100)
225
+ })
226
+
227
+ it('coerces both limit and offset together', () => {
228
+ const result = ListWebhookEndpointsQuerySchema.parse({ limit: '10', offset: '30' })
229
+ expect(result.limit).toBe(10)
230
+ expect(result.offset).toBe(30)
231
+ })
232
+
233
+ it('rejects limit above max (100)', () => {
234
+ expect(() => ListWebhookEndpointsQuerySchema.parse({ limit: '101' })).toThrow()
235
+ })
236
+
237
+ it('rejects negative offset', () => {
238
+ expect(() => ListWebhookEndpointsQuerySchema.parse({ offset: '-1' })).toThrow()
239
+ })
240
+ })
241
+ })
242
+
243
+ describe('WebhookEndpointResponseSchema', () => {
244
+ const validResponse = {
245
+ id: validUuid,
246
+ organizationId: validUuid2,
247
+ key: 'whk_abc123def456',
248
+ keyPrefix: 'whk_abc1',
249
+ name: 'Stripe Inbound',
250
+ description: 'Handles Stripe webhook events',
251
+ resourceId: 'stripe-handler-workflow',
252
+ status: 'active' as const,
253
+ lastTriggeredAt: '2026-03-01T12:00:00.000Z',
254
+ requestCount: 42,
255
+ createdAt: '2026-01-01T00:00:00.000Z',
256
+ updatedAt: '2026-03-01T12:00:00.000Z'
257
+ }
258
+
259
+ it('accepts a complete valid response object (with key — create response)', () => {
260
+ const result = WebhookEndpointResponseSchema.parse(validResponse)
261
+ expect(result.id).toBe(validUuid)
262
+ expect(result.status).toBe('active')
263
+ expect(result.requestCount).toBe(42)
264
+ expect(result.key).toBe('whk_abc123def456')
265
+ })
266
+
267
+ it('accepts a response without key (list/get response — key is optional)', () => {
268
+ const { key: _key, ...responseWithoutKey } = validResponse
269
+ const result = WebhookEndpointResponseSchema.parse(responseWithoutKey)
270
+ expect(result.id).toBe(validUuid)
271
+ expect(result.key).toBeUndefined()
272
+ })
273
+
274
+ describe('nullable fields', () => {
275
+ it('accepts null description', () => {
276
+ const result = WebhookEndpointResponseSchema.parse({ ...validResponse, description: null })
277
+ expect(result.description).toBeNull()
278
+ })
279
+
280
+ it('accepts null lastTriggeredAt (endpoint never triggered)', () => {
281
+ const result = WebhookEndpointResponseSchema.parse({ ...validResponse, lastTriggeredAt: null })
282
+ expect(result.lastTriggeredAt).toBeNull()
283
+ })
284
+
285
+ it('accepts both nullable fields as null', () => {
286
+ const result = WebhookEndpointResponseSchema.parse({
287
+ ...validResponse,
288
+ description: null,
289
+ lastTriggeredAt: null
290
+ })
291
+ expect(result.description).toBeNull()
292
+ expect(result.lastTriggeredAt).toBeNull()
293
+ })
294
+ })
295
+
296
+ describe('forward compatibility (not strict)', () => {
297
+ it('accepts extra fields in response (allows API additions without breaking clients)', () => {
298
+ const result = WebhookEndpointResponseSchema.parse({
299
+ ...validResponse,
300
+ newFieldFromFutureApiVersion: 'some-value'
301
+ })
302
+ expect(result.id).toBe(validUuid)
303
+ })
304
+ })
305
+
306
+ describe('field validation', () => {
307
+ it('rejects invalid UUID for id', () => {
308
+ expect(() => WebhookEndpointResponseSchema.parse({ ...validResponse, id: 'not-a-uuid' })).toThrow()
309
+ })
310
+
311
+ it('rejects invalid UUID for organizationId', () => {
312
+ expect(() => WebhookEndpointResponseSchema.parse({ ...validResponse, organizationId: 'not-a-uuid' })).toThrow()
313
+ })
314
+
315
+ it('rejects negative requestCount', () => {
316
+ expect(() => WebhookEndpointResponseSchema.parse({ ...validResponse, requestCount: -1 })).toThrow()
317
+ })
318
+
319
+ it('rejects invalid datetime for createdAt', () => {
320
+ expect(() => WebhookEndpointResponseSchema.parse({ ...validResponse, createdAt: 'not-a-date' })).toThrow()
321
+ })
322
+
323
+ it('rejects invalid status in response', () => {
324
+ expect(() => WebhookEndpointResponseSchema.parse({ ...validResponse, status: 'unknown' })).toThrow()
325
+ })
326
+ })
327
+ })