@tellescope/sdk 1.250.1 → 1.251.0

package/src/tests/api_tests/enduser_cross_access_isolation.test.ts

@@ -339,6 +339,32 @@ export const enduser_cross_access_isolation_tests = async (
     await sdkA.authenticate(enduserA.email!, password)
     await sdkB.authenticate(enduserB.email!, password)
 
+    // Regression guard: hashedPassword must never appear in updateOne responses,
+    // for either enduser self-update or admin-side update of an enduser.
+    const selfUpdateResponse = await sdkA.api.endusers.updateOne(enduserA.id, { fname: 'RedactionProbe' })
+    assert(
+      !!selfUpdateResponse && (selfUpdateResponse as any).fname === 'RedactionProbe',
+      'enduser self-update: response should reflect the applied update',
+      'enduser self-update: update applied (sanity)',
+    )
+    assert(
+      (selfUpdateResponse as any).hashedPassword === undefined,
+      'enduser self-update: hashedPassword leaked in response',
+      'enduser self-update: hashedPassword redacted from response',
+    )
+
+    const adminUpdateResponse = await sdk.api.endusers.updateOne(enduserA.id, { fname: 'AdminProbe' })
+    assert(
+      !!adminUpdateResponse && (adminUpdateResponse as any).fname === 'AdminProbe',
+      'admin update of enduser: response should reflect the applied update',
+      'admin update of enduser: update applied (sanity)',
+    )
+    assert(
+      (adminUpdateResponse as any).hashedPassword === undefined,
+      'admin update of enduser: hashedPassword leaked in response',
+      'admin update of enduser: hashedPassword redacted from response',
+    )
+
     for (const c of MODEL_CASES) {
       const sublog = (variant: string) => `${c.model}: ${variant}`
 

package/src/tests/api_tests/enduser_login.test.ts

@@ -0,0 +1,215 @@
+require('source-map-support').install();
+
+import axios from "axios"
+import { Session } from "../../sdk"
+import {
+  async_test,
+  log_header,
+} from "@tellescope/testing"
+import { setup_tests } from "../setup"
+
+const host = process.env.API_URL || 'http://localhost:8080' as const
+
+// Coverage for the /v1/login-enduser response surface:
+// - When an enduser has no password set, the error response must not include
+//   enduser fields (PHI, hashedPassword, etc.).
+// - The "enduser not found" and "wrong password" cases must be indistinguishable
+//   (same status code, same message) to prevent account enumeration.
+// - verify_otp invalid-code error must not include enduser fields.
+
+const post_login = async (body: any) => {
+  try {
+    const res = await axios.post(`${host}/v1/login-enduser`, body, { validateStatus: () => true })
+    return { status: res.status, data: res.data }
+  } catch (err: any) {
+    return { status: err?.response?.status, data: err?.response?.data }
+  }
+}
+
+export const enduser_login_tests = async ({ sdk, sdkNonAdmin } : { sdk: Session, sdkNonAdmin: Session }) => {
+  log_header("Enduser Login Tests")
+
+  const ts = Date.now()
+  // Distinctive markers we can grep the response body for.
+  const MARKER_FNAME = `LoginTestFname${ts}`
+  const MARKER_ADDRESS = `${ts} Test Way`
+  const MARKER_DOB = '01-01-1990'
+
+  const noPasswordEnduser = await sdk.api.endusers.createOne({
+    fname: MARKER_FNAME,
+    lname: 'LoginTest',
+    email: `login-test-no-password-${ts}@tellescope.com`,
+    dateOfBirth: MARKER_DOB,
+    addressLineOne: MARKER_ADDRESS,
+    addressLineTwo: 'Apt 4B',
+    city: 'Springfield',
+    state: 'IL',
+    zipCode: '62701',
+    gender: 'Female',
+    assignedTo: [sdk.userInfo.id],
+    fields: { secretField: `should-not-leak-${ts}` },
+    tags: ['vip', 'sensitive'],
+  })
+
+  const withPasswordEnduser = await sdk.api.endusers.createOne({
+    fname: 'PasswordedEnduser',
+    lname: 'LoginTest',
+    email: `login-test-with-password-${ts}@tellescope.com`,
+  })
+  await sdk.api.endusers.set_password({ id: withPasswordEnduser.id, password: 'CorrectPassword123!' })
+
+  try {
+    // Login response for an enduser without a password set must not include
+    // enduser fields.
+    const noPasswordResp = await post_login({
+      email: noPasswordEnduser.email,
+      password: 'arbitrary-password',
+      businessId: sdk.userInfo.businessId,
+    })
+
+    const noPasswordBody = JSON.stringify(noPasswordResp.data ?? {})
+
+    await async_test(
+      'No-password login response does not include fname marker',
+      async () => noPasswordBody.includes(MARKER_FNAME) ? 'leaked' : 'safe',
+      { expectedResult: 'safe' }
+    )
+    await async_test(
+      'No-password login response does not include dateOfBirth',
+      async () => noPasswordBody.includes(MARKER_DOB) ? 'leaked' : 'safe',
+      { expectedResult: 'safe' }
+    )
+    await async_test(
+      'No-password login response does not include addressLineOne marker',
+      async () => noPasswordBody.includes(MARKER_ADDRESS) ? 'leaked' : 'safe',
+      { expectedResult: 'safe' }
+    )
+    for (const sensitiveKey of ['hashedPassword', 'assignedTo', 'fields', 'tags', 'insurance', 'customFields']) {
+      await async_test(
+        `No-password login response does not include "${sensitiveKey}" key`,
+        async () => noPasswordBody.includes(`"${sensitiveKey}"`) ? 'leaked' : 'safe',
+        { expectedResult: 'safe' }
+      )
+    }
+    await async_test(
+      'No-password login response info field is absent or empty',
+      async () => {
+        const info = (noPasswordResp.data ?? {}).info
+        if (info === undefined) return 'safe'
+        if (typeof info === 'object' && info !== null && Object.keys(info).length === 0) return 'safe'
+        return 'leaked'
+      },
+      { expectedResult: 'safe' }
+    )
+
+    // All three failure modes (no-password-set, wrong-password, unknown-email)
+    // must return an identical 401 + identical message — no enumeration of
+    // which case actually applies.
+    const wrongPasswordResp = await post_login({
+      email: withPasswordEnduser.email,
+      password: 'WrongPassword!2025',
+      businessId: sdk.userInfo.businessId,
+    })
+    const unknownEmailResp = await post_login({
+      email: `does-not-exist-${ts}@tellescope.com`,
+      password: 'AnyPassword!2025',
+      businessId: sdk.userInfo.businessId,
+    })
+
+    await async_test(
+      'Login returns 401 for no-password account (indistinguishable from wrong password)',
+      async () => `${noPasswordResp.status}:${noPasswordResp.data?.message ?? ''}`,
+      { expectedResult: '401:Login details are invalid' }
+    )
+    await async_test(
+      'Login returns same status for no-password vs wrong-password vs unknown-email',
+      async () => {
+        const statuses = [noPasswordResp.status, wrongPasswordResp.status, unknownEmailResp.status]
+        const allSame = statuses.every(s => s === statuses[0])
+        return allSame ? `same:${statuses[0]}` : `diff:${statuses.join(',')}`
+      },
+      { expectedResult: 'same:401' }
+    )
+    await async_test(
+      'Login returns same message for no-password vs wrong-password vs unknown-email',
+      async () => {
+        const messages = [noPasswordResp.data?.message, wrongPasswordResp.data?.message, unknownEmailResp.data?.message]
+        const allSame = messages.every(m => m === messages[0])
+        return allSame ? 'same' : `diff:${JSON.stringify(messages)}`
+      },
+      { expectedResult: 'same' }
+    )
+
+    // verify_otp invalid-code response must not include enduser fields.
+    const verifyOtpInvalidResp = await axios.post(
+      `${host}/v1/verify-otp-code`,
+      { token: 'not-a-real-token', code: '000000', businessId: sdk.userInfo.businessId },
+      { validateStatus: () => true }
+    )
+    const verifyOtpBody = JSON.stringify(verifyOtpInvalidResp.data ?? {})
+    await async_test(
+      'verify_otp invalid-code response does not include any enduser fields',
+      async () => (
+        verifyOtpBody.includes('"hashedPassword"')
+        || verifyOtpBody.includes('"assignedTo"')
+        || verifyOtpBody.includes(MARKER_FNAME)
+          ? 'leaked' : 'safe'
+      ),
+      { expectedResult: 'safe' }
+    )
+
+    // Regression: admin creating a duplicate enduser (same email) must still
+    // receive the existing record's id in the error info — this is an
+    // authenticated, intentional API-aid pattern via uniquenessError and must
+    // not be regressed by the public-endpoint sanitizer.
+    let duplicateError: any = null
+    try {
+      await sdk.api.endusers.createOne({ email: noPasswordEnduser.email })
+    } catch (err: any) {
+      duplicateError = err
+    }
+    await async_test(
+      'Admin duplicate enduser create rejects with 409 Uniqueness Violation',
+      async () => duplicateError?.message ?? 'no-error',
+      { expectedResult: 'Uniqueness Violation' }
+    )
+    await async_test(
+      'Admin duplicate enduser create returns the existing record id in info',
+      async () => {
+        const info = duplicateError?.info
+        if (!Array.isArray(info) || info.length === 0) return `no-info:${JSON.stringify(info)}`
+        const existing = info[0]?.existingRecord
+        const existingId = existing?._id ?? existing?.id
+        return existingId === noPasswordEnduser.id ? 'matched' : `mismatched:${existingId}`
+      },
+      { expectedResult: 'matched' }
+    )
+  } finally {
+    await Promise.all([
+      sdk.api.endusers.deleteOne(noPasswordEnduser.id).catch(() => null),
+      sdk.api.endusers.deleteOne(withPasswordEnduser.id).catch(() => null),
+    ])
+  }
+}
+
+// Allow running this test file independently
+if (require.main === module) {
+  console.log(`🌐 Using API URL: ${host}`)
+  const sdk = new Session({ host })
+  const sdkNonAdmin = new Session({ host })
+
+  const runTests = async () => {
+    await setup_tests(sdk, sdkNonAdmin)
+    await enduser_login_tests({ sdk, sdkNonAdmin })
+  }
+
+  runTests()
+    .then(() => {
+      console.log("✅ Enduser login test suite completed successfully")
+      process.exit(0)
+    })
+    .catch((error) => {
+      console.error("❌ Enduser login test suite failed:", error)
+      process.exit(1)
+    })
+}

package/src/tests/api_tests/medication_added_trigger.test.ts

@@ -182,7 +182,7 @@ export const medication_added_trigger_tests = async ({ sdk, sdkNonAdmin } : { sd
     title: "Medication - Beluga Protocol Test"
   })
 
-  // Simulate the Beluga RX_WRITTEN webhook
+  // Simulate the Beluga RX_WRITTEN webhook with two meds covering category present (typical) and "N/A"
   const webhookResponse = await fetch(`${host}/v1/webhooks/beluga`, {
     method: 'POST',
     headers: { 'Content-Type': 'application/json' },
@@ -197,6 +197,15 @@ export const medication_added_trigger_tests = async ({ sdk, sdkNonAdmin } : { sd
         quantity: '1',
         medId: 'test-ndc-123',
         rxId: 'test-rx-456',
+        category: 'weightloss1',
+      }, {
+        name: 'Metformin',
+        strength: '500mg',
+        refills: '2',
+        quantity: '1',
+        medId: 'test-ndc-789',
+        rxId: 'test-rx-789',
+        category: 'N/A',
       }],
     }),
   })
@@ -216,18 +225,83 @@ export const medication_added_trigger_tests = async ({ sdk, sdkNonAdmin } : { sd
 
   // Verify the medication was created with correct protocol and source
   const belugaMeds = await sdk.api.enduser_medications.getSome({ filter: { enduserId: belugaEnduser.id } })
-  const belugaMed = belugaMeds[0]
+  const belugaMedSemaglutide = belugaMeds.find(m => m.title === 'Semaglutide')
+  const belugaMedMetformin = belugaMeds.find(m => m.title === 'Metformin')
+  if (!belugaMedSemaglutide || !belugaMedMetformin) {
+    throw new Error(`Beluga RX_WRITTEN - expected medications missing. Got: ${belugaMeds.map(m => m.title).join(', ')}`)
+  }
   await async_test(
     "Beluga RX_WRITTEN - Medication has protocol from form belugaVisitType",
-    async () => belugaMed,
-    { onResult: (m: EnduserMedication) => m.protocol === 'Weight Loss' && m.source === 'Beluga' && m.title === 'Semaglutide' }
+    async () => belugaMedSemaglutide,
+    { onResult: (m: EnduserMedication) => m?.protocol === 'Weight Loss' && m?.source === 'Beluga' && m?.title === 'Semaglutide' }
+  )
+  await async_test(
+    "Beluga RX_WRITTEN - Medication has category from webhook",
+    async () => belugaMedSemaglutide,
+    { onResult: (m: EnduserMedication) => m?.category === 'weightloss1' }
+  )
+  await async_test(
+    "Beluga RX_WRITTEN - Medication preserves N/A category verbatim",
+    async () => belugaMedMetformin,
+    { onResult: (m: EnduserMedication) => m?.category === 'N/A' }
+  )
+
+  // Backwards-compatibility: a webhook with no category on any med should result in undefined category
+  const belugaFormNoCategory = await sdk.api.forms.createOne({
+    title: 'Beluga Protocol Test Form (no category)',
+    belugaVisitType: 'Weight Loss',
+  })
+  const belugaEnduserNoCategory = await sdk.api.endusers.createOne({})
+  const belugaFormResponseNoCategory = await sdk.api.form_responses.createOne({
+    formId: belugaFormNoCategory.id,
+    enduserId: belugaEnduserNoCategory.id,
+    formTitle: belugaFormNoCategory.title,
+    responses: [{
+      fieldId: PLACEHOLDER_ID,
+      fieldTitle: 'placeholder',
+      answer: { type: 'string', value: 'test' },
+    }],
+  })
+
+  const webhookResponseNoCategory = await fetch(`${host}/v1/webhooks/beluga`, {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json' },
+    body: JSON.stringify({
+      masterId: `tellescope_${belugaFormResponseNoCategory.id}`,
+      event: 'RX_WRITTEN',
+      docName: 'Dr. Test',
+      medsPrescribed: [{
+        name: 'Ibuprofen',
+        strength: '200mg',
+        refills: '1',
+        quantity: '1',
+        medId: 'test-ndc-nocat',
+        rxId: 'test-rx-nocat',
+      }],
+    }),
+  })
+
+  if (!webhookResponseNoCategory.ok) {
+    throw new Error(`Beluga webhook (no category) failed with status ${webhookResponseNoCategory.status}: ${await webhookResponseNoCategory.text()}`)
+  }
+
+  await wait(undefined, 500)
+
+  const belugaMedsNoCategory = await sdk.api.enduser_medications.getSome({ filter: { enduserId: belugaEnduserNoCategory.id } })
+  const belugaMedNoCategory = belugaMedsNoCategory[0]
+  await async_test(
+    "Beluga RX_WRITTEN - Medication omits category when not provided",
+    async () => belugaMedNoCategory,
+    { onResult: (m: EnduserMedication) => m?.category === undefined || m?.category === null }
   )
 
   try {
     // Clean up Beluga test data
     await sdk.api.automation_triggers.deleteOne(belugaTrigger.id)
     await sdk.api.forms.deleteOne(belugaForm.id)
+    await sdk.api.forms.deleteOne(belugaFormNoCategory.id)
     await sdk.api.endusers.deleteOne(belugaEnduser.id) // also cleans up form response and medications
+    await sdk.api.endusers.deleteOne(belugaEnduserNoCategory.id) // also cleans up form response and medications
   } finally {}
 
   // ---- Set Fields with {{medication.name}} Test ----
@@ -276,11 +350,278 @@ export const medication_added_trigger_tests = async ({ sdk, sdkNonAdmin } : { sd
     { onResult: (e: Enduser) => e.fields?.['Specific Med'] === 'Metformin 500mg' }
   )
 
+  // ---- Set Fields with {{medication.category}} Test ----
+  log_header("Medication Added - Set Fields with {{medication.category}}")
+
+  const setFieldsCategoryTrigger = await sdk.api.automation_triggers.createOne({
+    event: { type: 'Medication Added', info: { titles: [], protocols: [] } },
+    action: { type: 'Set Fields', info: { fields: [{ name: 'Medication Category', type: 'Custom Value' as const, value: '{{medication.category}}' }] }},
+    status: 'Active',
+    title: "Medication - Set Fields medication.category"
+  })
+
+  const setFieldsCategoryEnduser = await sdk.api.endusers.createOne({})
+
+  const setFieldsCategoryMed = await sdk.api.enduser_medications.createOne({
+    enduserId: setFieldsCategoryEnduser.id,
+    title: 'Ozempic 0.5mg',
+    category: 'weightloss1',
+  })
+  await wait(undefined, 500)
+
+  await async_test(
+    "Medication Added - Set Fields copies medication.category to enduser field",
+    () => sdk.api.endusers.getOne(setFieldsCategoryEnduser.id),
+    { onResult: (e: Enduser) => e.fields?.['Medication Category'] === 'weightloss1' }
+  )
+
+  // Category absent on medication → placeholder resolves to empty string
+  const setFieldsCategoryEnduserEmpty = await sdk.api.endusers.createOne({})
+  const setFieldsCategoryMedEmpty = await sdk.api.enduser_medications.createOne({
+    enduserId: setFieldsCategoryEnduserEmpty.id,
+    title: 'Lisinopril 20mg',
+  })
+  await wait(undefined, 500)
+
+  await async_test(
+    "Medication Added - Set Fields with no category resolves to empty string",
+    () => sdk.api.endusers.getOne(setFieldsCategoryEnduserEmpty.id),
+    { onResult: (e: Enduser) => e.fields?.['Medication Category'] === '' }
+  )
+
   try {
     await sdk.api.automation_triggers.deleteOne(setFieldsTrigger.id)
     await sdk.api.automation_triggers.deleteOne(setFieldsTriggerFiltered.id)
+    await sdk.api.automation_triggers.deleteOne(setFieldsCategoryTrigger.id)
     await sdk.api.endusers.deleteOne(setFieldsEnduser.id)
     await sdk.api.endusers.deleteOne(setFieldsEnduser2.id)
+    await sdk.api.endusers.deleteOne(setFieldsCategoryEnduser.id)
+    await sdk.api.endusers.deleteOne(setFieldsCategoryEnduserEmpty.id)
+  } finally {}
+
+  // ---- titleCondition (compound conditional logic on title) ----
+  log_header("Medication Added - titleCondition compound logic")
+
+  // C1: simple $contains — fires for medications whose title contains 'GLP' (case-sensitive)
+  const c1Trigger = await sdk.api.automation_triggers.createOne({
+    event: {
+      type: 'Medication Added',
+      info: {
+        titles: [],
+        protocols: [],
+        titleCondition: { condition: { title: { $contains: 'GLP' } } },
+      },
+    },
+    action: { type: 'Add Tags', info: { tags: ['Med-Cond-Contains-GLP'] }},
+    status: 'Active',
+    title: "Medication - titleCondition contains GLP"
+  })
+
+  const c1MatchEnduser = await sdk.api.endusers.createOne({})
+  await sdk.api.enduser_medications.createOne({ enduserId: c1MatchEnduser.id, title: 'Semaglutide GLP-1' })
+  await wait(undefined, 500)
+  await async_test(
+    "titleCondition $contains - matching medication fires",
+    () => sdk.api.endusers.getOne(c1MatchEnduser.id),
+    { onResult: (e: Enduser) => !!e.tags?.includes('Med-Cond-Contains-GLP') }
+  )
+
+  const c1MissEnduser = await sdk.api.endusers.createOne({})
+  await sdk.api.enduser_medications.createOne({ enduserId: c1MissEnduser.id, title: 'Aspirin' })
+  await wait(undefined, 500)
+  await async_test(
+    "titleCondition $contains - non-matching medication does NOT fire",
+    () => sdk.api.endusers.getOne(c1MissEnduser.id),
+    { onResult: (e: Enduser) => !e.tags?.includes('Med-Cond-Contains-GLP') }
+  )
+
+  // C2: $ne — fires for everything except 'Placebo'
+  const c2Trigger = await sdk.api.automation_triggers.createOne({
+    event: {
+      type: 'Medication Added',
+      info: {
+        titles: [],
+        protocols: [],
+        titleCondition: { condition: { title: { $ne: 'Placebo' } } },
+      },
+    },
+    action: { type: 'Add Tags', info: { tags: ['Med-Cond-Ne-Placebo'] }},
+    status: 'Active',
+    title: "Medication - titleCondition ne Placebo"
+  })
+
+  const c2MatchEnduser = await sdk.api.endusers.createOne({})
+  await sdk.api.enduser_medications.createOne({ enduserId: c2MatchEnduser.id, title: 'Metformin' })
+  await wait(undefined, 500)
+  await async_test(
+    "titleCondition $ne - non-Placebo medication fires",
+    () => sdk.api.endusers.getOne(c2MatchEnduser.id),
+    { onResult: (e: Enduser) => !!e.tags?.includes('Med-Cond-Ne-Placebo') }
+  )
+
+  const c2MissEnduser = await sdk.api.endusers.createOne({})
+  await sdk.api.enduser_medications.createOne({ enduserId: c2MissEnduser.id, title: 'Placebo' })
+  await wait(undefined, 500)
+  await async_test(
+    "titleCondition $ne - Placebo medication does NOT fire",
+    () => sdk.api.endusers.getOne(c2MissEnduser.id),
+    { onResult: (e: Enduser) => !e.tags?.includes('Med-Cond-Ne-Placebo') }
+  )
+
+  // C3: compound $and — contains 'mg' AND does not contain 'Placebo' (case-sensitive)
+  const c3Trigger = await sdk.api.automation_triggers.createOne({
+    event: {
+      type: 'Medication Added',
+      info: {
+        titles: [],
+        protocols: [],
+        titleCondition: {
+          $and: [
+            { condition: { title: { $contains: 'mg' } } },
+            { condition: { title: { $doesNotContain: 'Placebo' } } },
+          ],
+        },
+      },
+    },
+    action: { type: 'Add Tags', info: { tags: ['Med-Cond-And'] }},
+    status: 'Active',
+    title: "Medication - titleCondition compound AND"
+  })
+
+  const c3MatchEnduser = await sdk.api.endusers.createOne({})
+  await sdk.api.enduser_medications.createOne({ enduserId: c3MatchEnduser.id, title: 'Lisinopril 10mg' })
+  await wait(undefined, 500)
+  await async_test(
+    "titleCondition $and - both pass fires",
+    () => sdk.api.endusers.getOne(c3MatchEnduser.id),
+    { onResult: (e: Enduser) => !!e.tags?.includes('Med-Cond-And') }
+  )
+
+  const c3MissEnduser = await sdk.api.endusers.createOne({})
+  await sdk.api.enduser_medications.createOne({ enduserId: c3MissEnduser.id, title: 'Placebo 5mg' })
+  await wait(undefined, 500)
+  await async_test(
+    "titleCondition $and - second branch fails does NOT fire",
+    () => sdk.api.endusers.getOne(c3MissEnduser.id),
+    { onResult: (e: Enduser) => !e.tags?.includes('Med-Cond-And') }
+  )
+
+  // C4: compound $or — equals 'Aspirin' OR contains 'pril'
+  const c4Trigger = await sdk.api.automation_triggers.createOne({
+    event: {
+      type: 'Medication Added',
+      info: {
+        titles: [],
+        protocols: [],
+        titleCondition: {
+          $or: [
+            { condition: { title: 'Aspirin' } },
+            { condition: { title: { $contains: 'pril' } } },
+          ],
+        },
+      },
+    },
+    action: { type: 'Add Tags', info: { tags: ['Med-Cond-Or'] }},
+    status: 'Active',
+    title: "Medication - titleCondition compound OR"
+  })
+
+  const c4MatchA = await sdk.api.endusers.createOne({})
+  await sdk.api.enduser_medications.createOne({ enduserId: c4MatchA.id, title: 'Aspirin' })
+  await wait(undefined, 500)
+  await async_test(
+    "titleCondition $or - first branch matches fires",
+    () => sdk.api.endusers.getOne(c4MatchA.id),
+    { onResult: (e: Enduser) => !!e.tags?.includes('Med-Cond-Or') }
+  )
+
+  const c4MatchB = await sdk.api.endusers.createOne({})
+  await sdk.api.enduser_medications.createOne({ enduserId: c4MatchB.id, title: 'Lisinopril' })
+  await wait(undefined, 500)
+  await async_test(
+    "titleCondition $or - second branch matches fires",
+    () => sdk.api.endusers.getOne(c4MatchB.id),
+    { onResult: (e: Enduser) => !!e.tags?.includes('Med-Cond-Or') }
+  )
+
+  const c4Miss = await sdk.api.endusers.createOne({})
+  await sdk.api.enduser_medications.createOne({ enduserId: c4Miss.id, title: 'Metformin' })
+  await wait(undefined, 500)
+  await async_test(
+    "titleCondition $or - neither branch matches does NOT fire",
+    () => sdk.api.endusers.getOne(c4Miss.id),
+    { onResult: (e: Enduser) => !e.tags?.includes('Med-Cond-Or') }
+  )
+
+  // C5: backwards compatibility — no titleCondition, titles array still works
+  const c5Trigger = await sdk.api.automation_triggers.createOne({
+    event: { type: 'Medication Added', info: { titles: ['Atorvastatin'], protocols: [] } },
+    action: { type: 'Add Tags', info: { tags: ['Med-Cond-BackCompat'] }},
+    status: 'Active',
+    title: "Medication - titles array back-compat"
+  })
+
+  const c5Match = await sdk.api.endusers.createOne({})
+  await sdk.api.enduser_medications.createOne({ enduserId: c5Match.id, title: 'Atorvastatin' })
+  await wait(undefined, 500)
+  await async_test(
+    "titles back-compat - title match still fires without titleCondition",
+    () => sdk.api.endusers.getOne(c5Match.id),
+    { onResult: (e: Enduser) => !!e.tags?.includes('Med-Cond-BackCompat') }
+  )
+
+  const c5Miss = await sdk.api.endusers.createOne({})
+  await sdk.api.enduser_medications.createOne({ enduserId: c5Miss.id, title: 'Aspirin' })
+  await wait(undefined, 500)
+  await async_test(
+    "titles back-compat - non-match does NOT fire without titleCondition",
+    () => sdk.api.endusers.getOne(c5Miss.id),
+    { onResult: (e: Enduser) => !e.tags?.includes('Med-Cond-BackCompat') }
+  )
+
+  // C6: combined — titles array AND titleCondition compose (both must pass)
+  const c6Trigger = await sdk.api.automation_triggers.createOne({
+    event: {
+      type: 'Medication Added',
+      info: {
+        titles: ['Lisinopril'],
+        protocols: [],
+        titleCondition: { condition: { title: { $contains: 'Lisin' } } },
+      },
+    },
+    action: { type: 'Add Tags', info: { tags: ['Med-Cond-Combined'] }},
+    status: 'Active',
+    title: "Medication - titles + titleCondition combined"
+  })
+
+  const c6Match = await sdk.api.endusers.createOne({})
+  await sdk.api.enduser_medications.createOne({ enduserId: c6Match.id, title: 'Lisinopril' })
+  await wait(undefined, 500)
+  await async_test(
+    "titleCondition combined - both pass fires",
+    () => sdk.api.endusers.getOne(c6Match.id),
+    { onResult: (e: Enduser) => !!e.tags?.includes('Med-Cond-Combined') }
+  )
+
+  try {
+    await sdk.api.automation_triggers.deleteOne(c1Trigger.id)
+    await sdk.api.automation_triggers.deleteOne(c2Trigger.id)
+    await sdk.api.automation_triggers.deleteOne(c3Trigger.id)
+    await sdk.api.automation_triggers.deleteOne(c4Trigger.id)
+    await sdk.api.automation_triggers.deleteOne(c5Trigger.id)
+    await sdk.api.automation_triggers.deleteOne(c6Trigger.id)
+    await sdk.api.endusers.deleteOne(c1MatchEnduser.id)
+    await sdk.api.endusers.deleteOne(c1MissEnduser.id)
+    await sdk.api.endusers.deleteOne(c2MatchEnduser.id)
+    await sdk.api.endusers.deleteOne(c2MissEnduser.id)
+    await sdk.api.endusers.deleteOne(c3MatchEnduser.id)
+    await sdk.api.endusers.deleteOne(c3MissEnduser.id)
+    await sdk.api.endusers.deleteOne(c4MatchA.id)
+    await sdk.api.endusers.deleteOne(c4MatchB.id)
+    await sdk.api.endusers.deleteOne(c4Miss.id)
+    await sdk.api.endusers.deleteOne(c5Match.id)
+    await sdk.api.endusers.deleteOne(c5Miss.id)
+    await sdk.api.endusers.deleteOne(c6Match.id)
   } finally {}
 }