@tellescope/sdk 1.253.0 → 1.254.0

package/src/tests/tests.ts

@@ -83,14 +83,16 @@ import { cross_org_api_key_tests } from "./api_tests/cross_org_api_key.test";
 import { custom_dashboards_tests } from "./api_tests/custom_dashboards.test";
 import { message_assignment_trigger_tests } from "./api_tests/message_assignment_trigger.test";
 import { outbound_chat_sent_trigger_tests } from "./api_tests/outbound_chat_sent_trigger.test";
-import { time_tracks_tests, time_tracks_historical_tests, time_tracks_correction_tests, time_tracks_review_tests, time_tracks_lock_tests, time_tracks_edge_case_tests } from "./api_tests/time_tracks.test";
+import { time_tracks_tests, time_tracks_historical_tests, time_tracks_correction_tests, time_tracks_review_tests, time_tracks_lock_tests, time_tracks_edge_case_tests, time_tracks_resubmit_tests, time_tracks_appointment_duration_tests } from "./api_tests/time_tracks.test";
 import { monthly_availability_restrictions_tests } from "./api_tests/monthly_availability_restrictions.test";
 import { calendar_event_limits_tests } from "./api_tests/calendar_event_limits.test";
 import { custom_aggregation_tests } from "./api_tests/custom_aggregation.test";
 import { chats_analytics_tests } from "./api_tests/chats_analytics.test";
 import { no_access_permission_checks_tests } from "./api_tests/no_access_permission_checks.test";
+import { resource_access_tags_tests } from "./api_tests/resource_access_tags.test";
 import { field_redaction_tests } from "./api_tests/field_redaction.test";
 import { data_sync_redaction_bypass_tests } from "./api_tests/security/F-0001-data-sync-redaction-bypass.test";
+import { enduser_write_restrictions_tests } from "./api_tests/security/F-0106-F-0110-enduser-write-restrictions.test";
 import { ai_conversations_rbac_tests } from "./api_tests/security/F-0005-ai-conversations-rbac.test";
 import { cascade_role_rename_cross_tenant_tests } from "./api_tests/security/F-0053-cascade-role-rename-cross-tenant.test";
 import { self_admin_role_assignment_tests } from "./api_tests/security/F-0076-self-admin-role-assignment.test";
@@ -114,6 +116,7 @@ import { organization_settings_duplicates_tests } from "./api_tests/organization
 import { calendar_events_bulk_update_tests } from "./api_tests/calendar_events_bulk_update.test";
 import { openloop_webhooks_tests } from "./api_tests/openloop_webhooks.test";
 import { beluga_pharmacy_mappings_tests } from "./api_tests/beluga_pharmacy_mappings.test";
+import { beluga_manual_sync_tests } from "./api_tests/beluga_manual_sync.test";
 import { mdi_webhooks_tests } from "./api_tests/mdi_webhooks.test";
 import { account_switcher_tests } from "./api_tests/account_switcher.test";
 import { set_fields_order_templates_tests } from "./api_tests/set_fields_order_templates.test";
@@ -3711,6 +3714,290 @@ const order_status_equals_tests = async () => {
   ])
 }
 
+// Covers the "blank status matches any order status" behavior (Order Status Equals acting as "Order Status Changed").
+// Kept separate from order_status_equals_tests because a blank-status trigger would break that test's exact tag-count assertions.
+const order_status_blank_tests = async () => {
+  log_header("Automation Trigger Tests (Order Status Equals - blank status)")
+
+  // A and A2 both fire on any status for BlankSource; the only difference is omitted vs. empty-string status.
+  const A = await sdk.api.automation_triggers.createOne({
+    event: { type: 'Order Status Equals', info: { source: 'BlankSource' } }, // status omitted entirely
+    action: { type: 'Add Tags', info: { tags: ['AnyOmit'] }},
+    status: 'Active',
+    title: "Blank status (omitted)"
+  })
+  const A2 = await sdk.api.automation_triggers.createOne({
+    event: { type: 'Order Status Equals', info: { source: 'BlankSource', status: '' } }, // explicit empty string
+    action: { type: 'Add Tags', info: { tags: ['AnyEmpty'] }},
+    status: 'Active',
+    title: "Blank status (empty string)"
+  })
+  const B = await sdk.api.automation_triggers.createOne({
+    event: { type: 'Order Status Equals', info: { source: 'BlankSource', status: '', skus: ['MATCH-SKU'] } },
+    action: { type: 'Add Tags', info: { tags: ['BlankWithSku'] }},
+    status: 'Active',
+    title: "Blank status with SKU filter"
+  })
+  const C = await sdk.api.automation_triggers.createOne({
+    event: { type: 'Order Status Equals', info: { source: 'OtherSource' } }, // blank status, different source
+    action: { type: 'Add Tags', info: { tags: ['WrongSource'] }},
+    status: 'Active',
+    title: "Blank status, other source"
+  })
+  const D = await sdk.api.automation_triggers.createOne({
+    event: { type: 'Order Status Equals', info: { source: 'BlankSource', status: 'Shipped' } }, // status-specific (regression)
+    action: { type: 'Add Tags', info: { tags: ['ShippedOnly'] }},
+    status: 'Active',
+    title: "Status-specific (regression)"
+  })
+  // BA/BD exercise the separate bulk-create code path (createSome of 2+); kept on their own source so the
+  // pre-existing "bulk ignores sku/protocol filters" divergence doesn't affect these assertions.
+  const BA = await sdk.api.automation_triggers.createOne({
+    event: { type: 'Order Status Equals', info: { source: 'BulkSource' } }, // blank status
+    action: { type: 'Add Tags', info: { tags: ['BulkAny'] }},
+    status: 'Active',
+    title: "Bulk blank status"
+  })
+  const BD = await sdk.api.automation_triggers.createOne({
+    event: { type: 'Order Status Equals', info: { source: 'BulkSource', status: 'Shipped' } }, // status-specific
+    action: { type: 'Add Tags', info: { tags: ['BulkShipped'] }},
+    status: 'Active',
+    title: "Bulk status-specific"
+  })
+  // BD2's status matches NO order in the bulk batch below; backwards-compat: it must never fire (the query's $in
+  // branch excludes it entirely, exactly as before the blank-status change).
+  const BD2 = await sdk.api.automation_triggers.createOne({
+    event: { type: 'Order Status Equals', info: { source: 'BulkSource', status: 'NeverInBatch' } },
+    action: { type: 'Add Tags', info: { tags: ['BulkNever'] }},
+    status: 'Active',
+    title: "Bulk status-specific (absent from batch)"
+  })
+  // P: blank status composed with a protocol filter (proves blank works with non-SKU filters + the no-protocol branch)
+  const P = await sdk.api.automation_triggers.createOne({
+    event: { type: 'Order Status Equals', info: { source: 'BlankSource', status: '', protocols: ['Protocol-A'] } },
+    action: { type: 'Add Tags', info: { tags: ['BlankProtocol'] }},
+    status: 'Active',
+    title: "Blank status with protocol filter"
+  })
+
+  // Case 1: validation accepts triggers with no status / empty status (A and A2 created above without error)
+  await async_test(
+    "Trigger with omitted status was created",
+    () => Promise.resolve(A),
+    { onResult: t => !!t.id && t.event.type === 'Order Status Equals' && !t.event.info.status }
+  )
+  await async_test(
+    "Trigger with empty-string status was created",
+    () => Promise.resolve(A2),
+    { onResult: t => !!t.id && t.event.type === 'Order Status Equals' && t.event.info.status === '' }
+  )
+
+  // Case 2: blank status fires on an arbitrary status
+  const e2 = await sdk.api.endusers.createOne({})
+  await sdk.api.enduser_orders.createOne({ status: 'StatusOne', source: 'BlankSource', title: 'Title', externalId: 'blank-1', enduserId: e2.id })
+  await wait(undefined, 500) // allow triggers to happen
+  await async_test(
+    "Blank status fires on arbitrary status (no other tags)",
+    () => sdk.api.endusers.getOne(e2.id),
+    { onResult: e => !!(
+       e.tags?.includes('AnyOmit')
+    && e.tags?.includes('AnyEmpty')
+    && !e.tags?.includes('BlankWithSku')
+    && !e.tags?.includes('WrongSource')
+    && !e.tags?.includes('ShippedOnly')
+    ) }
+  )
+
+  // Case 3: blank status fires on a totally different status value (status-value-independent)
+  const e3 = await sdk.api.endusers.createOne({})
+  await sdk.api.enduser_orders.createOne({ status: 'totally-arbitrary-xyz', source: 'BlankSource', title: 'Title', externalId: 'blank-2', enduserId: e3.id })
+  await wait(undefined, 500) // allow triggers to happen
+  await async_test(
+    "Blank status fires on a different arbitrary status",
+    () => sdk.api.endusers.getOne(e3.id),
+    { onResult: e => !!(
+       e.tags?.includes('AnyOmit')
+    && e.tags?.includes('AnyEmpty')
+    ) }
+  )
+
+  // Case 4: source isolation - blank trigger does not fire for a different source
+  const e4 = await sdk.api.endusers.createOne({})
+  await sdk.api.enduser_orders.createOne({ status: 'StatusOne', source: 'DifferentSource', title: 'Title', externalId: 'blank-3', enduserId: e4.id })
+  await wait(undefined, 500) // allow triggers to happen
+  await async_test(
+    "Blank status is still scoped to its source",
+    () => sdk.api.endusers.getOne(e4.id),
+    { onResult: e => !!(
+       !e.tags?.includes('AnyOmit')
+    && !e.tags?.includes('AnyEmpty')
+    && !e.tags?.includes('WrongSource') // C only matches OtherSource
+    ) }
+  )
+
+  // Case 5a: other filters still enforced with blank status (sku mismatch)
+  const e5 = await sdk.api.endusers.createOne({})
+  await sdk.api.enduser_orders.createOne({ status: 'whatever', source: 'BlankSource', title: 'Title', externalId: 'blank-4', enduserId: e5.id, sku: 'NOPE' })
+  await wait(undefined, 500) // allow triggers to happen
+  await async_test(
+    "Blank status + SKU filter does not fire on SKU mismatch",
+    () => sdk.api.endusers.getOne(e5.id),
+    { onResult: e => !!(
+       e.tags?.includes('AnyOmit')
+    && e.tags?.includes('AnyEmpty')
+    && !e.tags?.includes('BlankWithSku')
+    ) }
+  )
+
+  // Case 5b: other filters still enforced with blank status (sku match)
+  const e6 = await sdk.api.endusers.createOne({})
+  await sdk.api.enduser_orders.createOne({ status: 'whatever', source: 'BlankSource', title: 'Title', externalId: 'blank-5', enduserId: e6.id, sku: 'MATCH-SKU' })
+  await wait(undefined, 500) // allow triggers to happen
+  await async_test(
+    "Blank status + SKU filter fires on SKU match",
+    () => sdk.api.endusers.getOne(e6.id),
+    { onResult: e => !!(
+       e.tags?.includes('AnyOmit')
+    && e.tags?.includes('AnyEmpty')
+    && e.tags?.includes('BlankWithSku')
+    ) }
+  )
+
+  // Case 6: update path + regression coexistence with a status-specific trigger
+  const e7 = await sdk.api.endusers.createOne({})
+  const o7 = await sdk.api.enduser_orders.createOne({ status: 'Created', source: 'BlankSource', title: 'Title', externalId: 'blank-6', enduserId: e7.id })
+  await wait(undefined, 500) // allow triggers to happen
+  await async_test(
+    "Blank fires on create; status-specific (Shipped) does not yet",
+    () => sdk.api.endusers.getOne(e7.id),
+    { onResult: e => !!(
+       e.tags?.includes('AnyOmit')
+    && e.tags?.includes('AnyEmpty')
+    && !e.tags?.includes('ShippedOnly')
+    ) }
+  )
+  // update to a NON-matching status: blank fires again, but the status-specific trigger must stay un-fired
+  await sdk.api.enduser_orders.updateOne(o7.id, { status: 'Delivered', externalId: 'blank-6-delivered' })
+  await wait(undefined, 500) // allow triggers to happen
+  await async_test(
+    "Update to non-matching status: blank fires, status-specific (Shipped) does NOT fire",
+    () => sdk.api.endusers.getOne(e7.id),
+    { onResult: e => !!(
+       e.tags?.includes('AnyOmit') // proves the update event was processed
+    && e.tags?.includes('AnyEmpty')
+    && !e.tags?.includes('ShippedOnly') // 'Delivered' must not trigger the 'Shipped' trigger
+    ) }
+  )
+  // now update to the matching status: status-specific trigger fires
+  await sdk.api.enduser_orders.updateOne(o7.id, { status: 'Shipped', externalId: 'blank-6-shipped' })
+  await wait(undefined, 500) // allow triggers to happen
+  await async_test(
+    "Blank fires on update too; status-specific (Shipped) now fires",
+    () => sdk.api.endusers.getOne(e7.id),
+    { onResult: e => !!(
+       e.tags?.includes('AnyOmit')
+    && e.tags?.includes('AnyEmpty')
+    && e.tags?.includes('ShippedOnly')
+    ) }
+  )
+
+  // Case 7: bulk create path (createSome of 2+) must honor blank status + status-specific selectivity.
+  // This exercises a SEPARATE matching code path (handle_orders_create bulk branch) from single creates.
+  const eb1 = await sdk.api.endusers.createOne({})
+  const eb2 = await sdk.api.endusers.createOne({})
+  const eb3 = await sdk.api.endusers.createOne({})
+  await sdk.api.enduser_orders.createSome([
+    { status: 'StatusA', source: 'BulkSource', title: 'Title', externalId: 'bulk-1', enduserId: eb1.id },
+    { status: 'Shipped',  source: 'BulkSource', title: 'Title', externalId: 'bulk-2', enduserId: eb2.id },
+    { status: 'StatusB', source: 'BulkSource', title: 'Title', externalId: 'bulk-3', enduserId: eb3.id },
+  ])
+  await wait(undefined, 500) // allow triggers to happen
+  await async_test(
+    "Bulk create: blank fires on non-Shipped order; status-specific (matching + absent) do not",
+    () => sdk.api.endusers.getOne(eb1.id),
+    { onResult: e => !!(e.tags?.includes('BulkAny') && !e.tags?.includes('BulkShipped') && !e.tags?.includes('BulkNever')) }
+  )
+  await async_test(
+    "Bulk create: blank + matching status-specific fire on the Shipped order; absent-status one does not",
+    () => sdk.api.endusers.getOne(eb2.id),
+    { onResult: e => !!(e.tags?.includes('BulkAny') && e.tags?.includes('BulkShipped') && !e.tags?.includes('BulkNever')) }
+  )
+  await async_test(
+    "Bulk create: blank fires on the other non-Shipped order; status-specific (matching + absent) do not",
+    () => sdk.api.endusers.getOne(eb3.id),
+    { onResult: e => !!(e.tags?.includes('BulkAny') && !e.tags?.includes('BulkShipped') && !e.tags?.includes('BulkNever')) }
+  )
+
+  // Case 8: an order update that does NOT change status must not run the handler (true "status changed" semantic).
+  const e8 = await sdk.api.endusers.createOne({})
+  const o8 = await sdk.api.enduser_orders.createOne({ status: 'Shipped', source: 'BlankSource', title: 'Title', externalId: 'noChange-1', enduserId: e8.id })
+  await wait(undefined, 500) // allow triggers to happen
+  await async_test(
+    "Setup: status-specific (Shipped) fired on create",
+    () => sdk.api.endusers.getOne(e8.id),
+    { onResult: e => !!(e.tags?.includes('AnyOmit') && e.tags?.includes('ShippedOnly')) }
+  )
+  // clear tags (replaceObjectFields forces the empty array to actually replace)
+  await sdk.api.endusers.updateOne(e8.id, { tags: [] }, { replaceObjectFields: true })
+  // sanity-check the clear actually took, so a later failure points at re-firing rather than a broken clear
+  await async_test(
+    "Setup: tags cleared before non-status update",
+    () => sdk.api.endusers.getOne(e8.id),
+    { onResult: e => !e.tags?.length }
+  )
+  // update a non-status field (status stays 'Shipped'); handler should early-return and re-add nothing.
+  // If it wrongly fired, the blank triggers A/A2 would re-add AnyOmit/AnyEmpty, so empty tags proves non-firing.
+  await sdk.api.enduser_orders.updateOne(o8.id, { tracking: 'tracking-123', externalId: 'noChange-1b' })
+  await wait(undefined, 500) // allow triggers to happen
+  await async_test(
+    "Update with unchanged status does not fire any trigger",
+    () => sdk.api.endusers.getOne(e8.id),
+    { onResult: e => !e.tags?.length }
+  )
+
+  // Case 9: protocol filter with blank status - order without a protocol must not fire (the order.protocol ? : false branch)
+  const e9 = await sdk.api.endusers.createOne({})
+  await sdk.api.enduser_orders.createOne({ status: 'whatever', source: 'BlankSource', title: 'Title', externalId: 'proto-1', enduserId: e9.id })
+  await wait(undefined, 500) // allow triggers to happen
+  await async_test(
+    "Blank + protocol filter does not fire when order has no protocol",
+    () => sdk.api.endusers.getOne(e9.id),
+    { onResult: e => !!(e.tags?.includes('AnyOmit') && !e.tags?.includes('BlankProtocol')) }
+  )
+  const e10 = await sdk.api.endusers.createOne({})
+  await sdk.api.enduser_orders.createOne({ status: 'whatever', source: 'BlankSource', title: 'Title', externalId: 'proto-2', enduserId: e10.id, protocol: 'Protocol-A' })
+  await wait(undefined, 500) // allow triggers to happen
+  await async_test(
+    "Blank + protocol filter fires when order protocol matches",
+    () => sdk.api.endusers.getOne(e10.id),
+    { onResult: e => !!(e.tags?.includes('AnyOmit') && e.tags?.includes('BlankProtocol')) }
+  )
+
+  await Promise.all([
+    sdk.api.automation_triggers.deleteOne(A.id),
+    sdk.api.automation_triggers.deleteOne(A2.id),
+    sdk.api.automation_triggers.deleteOne(B.id),
+    sdk.api.automation_triggers.deleteOne(C.id),
+    sdk.api.automation_triggers.deleteOne(D.id),
+    sdk.api.automation_triggers.deleteOne(BA.id),
+    sdk.api.automation_triggers.deleteOne(BD.id),
+    sdk.api.automation_triggers.deleteOne(BD2.id),
+    sdk.api.automation_triggers.deleteOne(P.id),
+    sdk.api.endusers.deleteOne(e2.id),
+    sdk.api.endusers.deleteOne(e3.id),
+    sdk.api.endusers.deleteOne(e4.id),
+    sdk.api.endusers.deleteOne(e5.id),
+    sdk.api.endusers.deleteOne(e6.id),
+    sdk.api.endusers.deleteOne(e7.id),
+    sdk.api.endusers.deleteOne(eb1.id),
+    sdk.api.endusers.deleteOne(eb2.id),
+    sdk.api.endusers.deleteOne(eb3.id),
+    sdk.api.endusers.deleteOne(e8.id),
+    sdk.api.endusers.deleteOne(e9.id),
+    sdk.api.endusers.deleteOne(e10.id),
+  ])
+}
+
 const tag_added_tests = async () => {
   log_header("Automation Trigger Tests (Tag Added)")
 
@@ -4296,12 +4583,208 @@ const assign_care_team_tests = async () => {
     { onResult: e => e.assignedTo?.length === 1 && e.primaryAssignee === e.assignedTo[0] }
   )
 
+  // restrictByState (state credentialing) tests
+  await sdk.api.users.updateOne(sdk.userInfo.id, { credentialedStates: [{ state: 'CA' }] }, { replaceObjectFields: true })
+
+  const t4 = await sdk.api.automation_triggers.createOne({
+    title: 't4',
+    event: { type: 'Tag Added', info: { tag: 'Trigger State' } },
+    action: {
+      type: "Assign Care Team",
+      info: {
+        tags: { qualifier: 'One Of', values: ["Assignment"] },
+        restrictByState: true,
+      },
+    },
+    status: 'Active',
+  })
+  const e2 = await sdk.api.endusers.createOne({ state: 'CA' })
+  const e3 = await sdk.api.endusers.createOne({ state: 'NY' })
+  const e4 = await sdk.api.endusers.createOne({ })
+
+  await Promise.all([
+    sdk.api.endusers.updateOne(e2.id, { tags: ['Trigger State'] }),
+    sdk.api.endusers.updateOne(e3.id, { tags: ['Trigger State'] }),
+    sdk.api.endusers.updateOne(e4.id, { tags: ['Trigger State'] }),
+  ])
+  await wait(undefined, 500) // allow triggers to happen
+  await async_test(
+    "Care team added for enduser in credentialed state",
+    () => sdk.api.endusers.getOne(e2.id),
+    { onResult: e => e.assignedTo?.length === 1 }
+  )
+  await async_test(
+    "No care team added for enduser in non-credentialed state",
+    () => sdk.api.endusers.getOne(e3.id),
+    { onResult: e => !e.assignedTo?.length }
+  )
+  await async_test(
+    "No care team added for enduser with unknown state",
+    () => sdk.api.endusers.getOne(e4.id),
+    { onResult: e => !e.assignedTo?.length }
+  )
+
+  // creating multiple appointments in a single request routes through bulk_handle_actions_for_triggers
+  // (unlike Tag Added above, which uses the per-enduser handler), covering the bulk Assign Care Team
+  // path with mixed enduser states in one batch
+  const t5 = await sdk.api.automation_triggers.createOne({
+    title: 't5',
+    event: { type: 'Appointment Created', info: { titles: ['Bulk Assign State'] } },
+    action: {
+      type: "Assign Care Team",
+      info: {
+        tags: { qualifier: 'One Of', values: ["Assignment"] },
+        restrictByState: true,
+        setAsPrimary: true, // not yet supported in the bulk handler — see canary assertion below
+      },
+    },
+    status: 'Active',
+  })
+  const e5 = await sdk.api.endusers.createOne({ state: 'CA' })
+  const e6 = await sdk.api.endusers.createOne({ state: 'NY' })
+  const e7 = await sdk.api.endusers.createOne({ })
+
+  const bulkEvents = (await sdk.api.calendar_events.createSome([
+    { title: 'Bulk Assign State', durationInMinutes: 30, startTimeInMS: Date.now(), attendees: [{ type: 'enduser', id: e5.id }] },
+    { title: 'Bulk Assign State', durationInMinutes: 30, startTimeInMS: Date.now(), attendees: [{ type: 'enduser', id: e6.id }] },
+    { title: 'Bulk Assign State', durationInMinutes: 30, startTimeInMS: Date.now(), attendees: [{ type: 'enduser', id: e7.id }] },
+  ])).created
+  await wait(undefined, 500) // allow triggers to happen
+  await async_test(
+    "(Bulk) Care team added for enduser in credentialed state",
+    () => sdk.api.endusers.getOne(e5.id),
+    { onResult: e => e.assignedTo?.length === 1 }
+  )
+  // canary: the bulk handler doesn't implement setAsPrimary (the per-enduser handler does), so a set
+  // primaryAssignee here means multi-event creates no longer route through the bulk handler (or
+  // setAsPrimary was implemented there — update this test if so)
+  await async_test(
+    "(Bulk) Primary not set (bulk handler routing canary)",
+    () => sdk.api.endusers.getOne(e5.id),
+    { onResult: e => !e.primaryAssignee }
+  )
+  await async_test(
+    "(Bulk) No care team added for enduser in non-credentialed state",
+    () => sdk.api.endusers.getOne(e6.id),
+    { onResult: e => !e.assignedTo?.length }
+  )
+  await async_test(
+    "(Bulk) No care team added for enduser with unknown state",
+    () => sdk.api.endusers.getOne(e7.id),
+    { onResult: e => !e.assignedTo?.length }
+  )
+
+  // bulk path with restrictByState off: state should not matter (default behavior unchanged)
+  const t6 = await sdk.api.automation_triggers.createOne({
+    title: 't6',
+    event: { type: 'Appointment Created', info: { titles: ['Bulk Assign Any'] } },
+    action: {
+      type: "Assign Care Team",
+      info: {
+        tags: { qualifier: 'One Of', values: ["Assignment"] },
+      },
+    },
+    status: 'Active',
+  })
+  const bulkEventsAny = (await sdk.api.calendar_events.createSome([
+    { title: 'Bulk Assign Any', durationInMinutes: 30, startTimeInMS: Date.now(), attendees: [{ type: 'enduser', id: e6.id }] },
+    { title: 'Bulk Assign Any', durationInMinutes: 30, startTimeInMS: Date.now(), attendees: [{ type: 'enduser', id: e7.id }] },
+  ])).created
+  await wait(undefined, 500) // allow triggers to happen
+  await async_test(
+    "(Bulk, no restriction) Care team added for enduser in non-credentialed state",
+    () => sdk.api.endusers.getOne(e6.id),
+    { onResult: e => e.assignedTo?.length === 1 }
+  )
+  await async_test(
+    "(Bulk, no restriction) Care team added for enduser with unknown state",
+    () => sdk.api.endusers.getOne(e7.id),
+    { onResult: e => e.assignedTo?.length === 1 }
+  )
+
+  // limitToOneUser on both handler branches: with two matching users, exactly one is assigned
+  const u2 = await sdk.api.users.createOne({
+    email: `assign-care-team-limit-${Date.now()}@tellescope.example`, fname: 'Throwaway', lname: 'Assignment',
+  } as any)
+  await sdk.api.users.updateOne(u2.id, { tags: ['Assignment'], credentialedStates: [{ state: 'CA' }] }, { replaceObjectFields: true })
+
+  const t7 = await sdk.api.automation_triggers.createOne({
+    title: 't7',
+    event: { type: 'Tag Added', info: { tag: 'Trigger One' } },
+    action: {
+      type: "Assign Care Team",
+      info: {
+        tags: { qualifier: 'One Of', values: ["Assignment"] },
+        restrictByState: true,
+        limitToOneUser: true,
+      },
+    },
+    status: 'Active',
+  })
+  const e8 = await sdk.api.endusers.createOne({ state: 'CA' })
+  await sdk.api.endusers.updateOne(e8.id, { tags: ['Trigger One'] })
+  await wait(undefined, 500) // allow triggers to happen
+  await async_test(
+    "(limitToOneUser) Exactly one of multiple matching users assigned",
+    () => sdk.api.endusers.getOne(e8.id),
+    { onResult: e => e.assignedTo?.length === 1 }
+  )
+
+  const t8 = await sdk.api.automation_triggers.createOne({
+    title: 't8',
+    event: { type: 'Appointment Created', info: { titles: ['Bulk Assign One'] } },
+    action: {
+      type: "Assign Care Team",
+      info: {
+        tags: { qualifier: 'One Of', values: ["Assignment"] },
+        restrictByState: true,
+        limitToOneUser: true,
+      },
+    },
+    status: 'Active',
+  })
+  const e9 = await sdk.api.endusers.createOne({ state: 'CA' })
+  const e10 = await sdk.api.endusers.createOne({ state: 'CA' })
+  const bulkEventsOne = (await sdk.api.calendar_events.createSome([
+    { title: 'Bulk Assign One', durationInMinutes: 30, startTimeInMS: Date.now(), attendees: [{ type: 'enduser', id: e9.id }] },
+    { title: 'Bulk Assign One', durationInMinutes: 30, startTimeInMS: Date.now(), attendees: [{ type: 'enduser', id: e10.id }] },
+  ])).created
+  await wait(undefined, 500) // allow triggers to happen
+  await async_test(
+    "(Bulk, limitToOneUser) Exactly one of multiple matching users assigned",
+    () => sdk.api.endusers.getOne(e9.id),
+    { onResult: e => e.assignedTo?.length === 1 }
+  )
+  await async_test(
+    "(Bulk, limitToOneUser) Exactly one of multiple matching users assigned (second enduser)",
+    () => sdk.api.endusers.getOne(e10.id),
+    { onResult: e => e.assignedTo?.length === 1 }
+  )
+
   await Promise.all([
-    sdk.api.users.updateOne(sdk.userInfo.id, { tags: [] }, { replaceObjectFields: true }),
+    sdk.api.users.updateOne(sdk.userInfo.id, { tags: [], credentialedStates: [] }, { replaceObjectFields: true }),
     sdk.api.endusers.deleteOne(e1.id),
+    sdk.api.endusers.deleteOne(e2.id),
+    sdk.api.endusers.deleteOne(e3.id),
+    sdk.api.endusers.deleteOne(e4.id),
+    sdk.api.endusers.deleteOne(e5.id),
+    sdk.api.endusers.deleteOne(e6.id),
+    sdk.api.endusers.deleteOne(e7.id),
     sdk.api.automation_triggers.deleteOne(t1.id),
     sdk.api.automation_triggers.deleteOne(t2.id),
     sdk.api.automation_triggers.deleteOne(t3.id),
+    sdk.api.endusers.deleteOne(e8.id),
+    sdk.api.endusers.deleteOne(e9.id),
+    sdk.api.endusers.deleteOne(e10.id),
+    sdk.api.users.deleteOne(u2.id),
+    sdk.api.automation_triggers.deleteOne(t4.id),
+    sdk.api.automation_triggers.deleteOne(t5.id),
+    sdk.api.automation_triggers.deleteOne(t6.id),
+    sdk.api.automation_triggers.deleteOne(t7.id),
+    sdk.api.automation_triggers.deleteOne(t8.id),
+    ...bulkEvents.map(e => sdk.api.calendar_events.deleteOne(e.id)),
+    ...bulkEventsAny.map(e => sdk.api.calendar_events.deleteOne(e.id)),
+    ...bulkEventsOne.map(e => sdk.api.calendar_events.deleteOne(e.id)),
   ])
 }
 
@@ -5104,8 +5587,10 @@ const trigger_events_api_tests = async () => {
 const automation_trigger_tests = async () => {
   log_header("Automation Trigger Tests")
 
+  await assign_care_team_tests()
   await push_forms_to_portal_group_completion_tests({ sdk, sdkNonAdmin })
   await order_status_equals_tests()
+  await order_status_blank_tests()
   await set_fields_order_templates_tests({ sdk, sdkNonAdmin })
   await medication_added_trigger_tests({ sdk, sdkNonAdmin })
   await appointment_cancelled_tests()
@@ -5118,7 +5603,6 @@ const automation_trigger_tests = async () => {
   await trigger_events_api_tests()
   await fields_changed_tests()
   await field_equals_trigger_tests()
-  await assign_care_team_tests()
   await contact_created_tests()
   await appointment_created_tests()
   await tag_added_tests()
@@ -8664,8 +9148,11 @@ export const switch_to_related_contacts_tests = async () => {
     () => pollForResults(
       () => sdk.api.endusers.getOne(parent.id),
       e => !!e.tags?.includes('Success'),
-      50,
-      200,
+      // switchToRelatedContact (cycle 1) then the afterAction addEnduserTags (cycle 2) each wait a
+      // full worker poll cycle (>= 8s, see worker pollingDelaySeconds), so ~16s worst case. Poll for
+      // 30s (500ms x 60) to cover two cycles plus buffer; the old 10s window timed out flakily.
+      500,
+      60,
     ),
     passOnAnyResult
   )
@@ -11147,7 +11634,23 @@ const register_as_enduser_tests = async () => {
   )
   await async_test(
     "Enduser register (rate limited)",
-    () => enduserSDK.register({ email: 'test@tellescope.com', password: 'testpassWord12345!' }),
+    // The register limiter records its throttle event at request start with a 1s expiry
+    // (countPerInterval: 1, intervalInMS: 1000), so back-to-back registers are only
+    // rate limited when they land within 1s of each other. A slow register (bcrypt on a
+    // cold/loaded server) can exceed the window and flake — retry the pair instead of
+    // failing on a timing miss. Any "Too many requests" from either call is the expected error.
+    async () => {
+      for (let attempt = 0; attempt < 3; attempt++) {
+        const windowStart = Date.now()
+        await enduserSDK.register({ email: 'test@tellescope.com', password: 'testpassWord12345!' })
+        await enduserSDK.register({ email: 'test@tellescope.com', password: 'testpassWord12345!' })
+        if (Date.now() - windowStart < 900) {
+          return 'two registers within the same 1s window were not rate limited'
+        }
+        await wait(undefined, 1100) // let the throttle window expire before retrying the pair
+      }
+      return 'rate-limit timing window missed on every attempt'
+    },
     { shouldError: true, onError: e => e.message === "Too many requests" }
   )
   await wait(undefined, 1000)
@@ -14181,7 +14684,7 @@ const ip_address_form_tests = async () => {
   })
 
   await wait(undefined, 500) // wait for IP to be set
-  async_test(
+  await async_test(
     'IP Set on Enduser creation',
     () => sdk.api.endusers.getOne(enduserId),
     { onResult: result => !!result.fields?.IP }
@@ -14200,7 +14703,8 @@ const ip_address_form_tests = async () => {
     lname: 'test',
   })
 
-  async_test(
+  await wait(undefined, 500) // wait for IP to be re-set
+  await async_test(
     'IP Set on update',
     () => sdk.api.endusers.getOne(enduserId),
     { onResult: result => !!result.fields?.IP && result.fields?.otherField === 'Set' && result.id === enduserId }
@@ -14333,6 +14837,12 @@ const ip_address_form_tests = async () => {
     await replace_form_field_template_values_tests()
     await mfa_tests()
     await setup_tests(sdk, sdkNonAdmin)
+    await resource_access_tags_tests({ sdk, sdkNonAdmin })
+    await beluga_manual_sync_tests({ sdk, sdkNonAdmin })
+    await beluga_pharmacy_mappings_tests({ sdk, sdkNonAdmin })
+    await enduser_write_restrictions_tests({ sdk, sdkNonAdmin })
+    await user_portal_settings_tests({ sdk, sdkNonAdmin })
+    await automation_trigger_tests()
     await invite_user_enumeration_tests({ sdk, sdkNonAdmin })
     await handle_incoming_communication_cross_tenant_tests({ sdk, sdkNonAdmin })
     await calendar_event_webhook_template_tests({ sdk, sdkNonAdmin })
@@ -14344,7 +14854,6 @@ const ip_address_form_tests = async () => {
     await self_admin_role_assignment_tests({ sdk, sdkNonAdmin })
     await sanitize_user_html_xss_tests()
     await prototype_pollution_tests()
-    await automation_trigger_tests()
     await account_switcher_tests({ sdk, sdkNonAdmin })
     await enduser_login_tests({ sdk, sdkNonAdmin })
     await outbound_chat_sent_trigger_tests({ sdk })
@@ -14368,6 +14877,8 @@ const ip_address_form_tests = async () => {
     await time_tracks_review_tests({ sdk, sdkNonAdmin })
     await time_tracks_lock_tests({ sdk, sdkNonAdmin })
     await time_tracks_edge_case_tests({ sdk, sdkNonAdmin })
+    await time_tracks_resubmit_tests({ sdk, sdkNonAdmin })
+    await time_tracks_appointment_duration_tests({ sdk, sdkNonAdmin })
     await calendar_event_limits_tests({ sdk, sdkNonAdmin })
     await get_some_projection_tests({ sdk, sdkNonAdmin })
     await elation_user_id_tests({ sdk, sdkNonAdmin })
@@ -14384,7 +14895,6 @@ const ip_address_form_tests = async () => {
     await load_threads_autobuild_tests({ sdk, sdkNonAdmin })
     await inbox_threads_new_fields_tests()
     await auto_merge_form_submission_tests({ sdk, sdkNonAdmin })
-    await beluga_pharmacy_mappings_tests({ sdk, sdkNonAdmin })
     await threadKeyTests()
     await managed_content_enduser_access_tests({ sdk, sdkNonAdmin })
     await managed_content_file_access_tests({ sdk, sdkNonAdmin })
@@ -14400,7 +14910,6 @@ const ip_address_form_tests = async () => {
     await inbox_threads_loading_tests()
     await load_inbox_data_tests({ sdk, sdkNonAdmin })
     await enduser_observations_acknowledge_tests({ sdk, sdkNonAdmin })
-    await user_portal_settings_tests({ sdk, sdkNonAdmin })
     await create_user_notifications_trigger_tests({ sdk })
     await group_mms_active_tests()
     await auto_reply_tests()