@tellescope/sdk 1.255.13 → 1.255.15

package/src/sdk.ts

@@ -704,6 +704,9 @@ type Queries = { [K in keyof ClientModelForName]: APIQuery<K> } & {
     upgrade_to_conference: (args: extractFields<CustomActions['phone_calls']['upgrade_to_conference']['parameters']>) => (
       Promise<extractFields<CustomActions['phone_calls']['upgrade_to_conference']['returns']>>
     ),
+    cold_transfer: (args: extractFields<CustomActions['phone_calls']['cold_transfer']['parameters']>) => (
+      Promise<extractFields<CustomActions['phone_calls']['cold_transfer']['returns']>>
+    ),
     add_conference_attendees: (args: extractFields<CustomActions['phone_calls']['add_conference_attendees']['parameters']>) => (
       Promise<extractFields<CustomActions['phone_calls']['add_conference_attendees']['returns']>>
     ),
@@ -1154,6 +1157,7 @@ export class Session extends SessionManager {
     queries.phone_calls.get_report = a => this._GET(`/v1/${schema.phone_calls.customActions.get_report.path}`, a)
     queries.phone_calls.authenticate_calling = a => this._POST(`/v1${schema.phone_calls.customActions.authenticate_calling.path}`, a)
     queries.phone_calls.upgrade_to_conference = a => this._POST(`/v1${schema.phone_calls.customActions.upgrade_to_conference.path}`, a)
+    queries.phone_calls.cold_transfer = a => this._POST(`/v1${schema.phone_calls.customActions.cold_transfer.path}`, a)
     queries.phone_calls.add_conference_attendees = a => this._POST(`/v1${schema.phone_calls.customActions.add_conference_attendees.path}`, a)
     queries.phone_calls.remove_conference_attendees = a => this._POST(`/v1${schema.phone_calls.customActions.remove_conference_attendees.path}`, a)
     queries.phone_calls.end_conference = a => this._POST(`/v1${schema.phone_calls.customActions.end_conference.path}`, a)

package/src/tests/api_tests/calendar_event_references_update.test.ts

@@ -0,0 +1,108 @@
+require('source-map-support').install();
+
+import { Session, EnduserSession } from "../../sdk"
+import {
+  async_test,
+  log_header,
+} from "@tellescope/testing"
+import { setup_tests, authenticate_enduser_via_token } from "../setup"
+
+const host = process.env.API_URL || 'http://localhost:8080' as const
+const businessId = '60398b1131a295e64f084ff6'
+
+/**
+ * CU-86e2dvrn9: calendar_events.references switched from updatesDisabled to
+ * enduserUpdatesDisabled (schema.ts), mirroring the Enduser references behavior:
+ *   - staff / API-key sessions may update references (e.g. to set or clear
+ *     external appointment IDs like stale Elation references)
+ *   - enduser (patient) sessions remain blocked — required because endusers DO
+ *     have update access on calendar_events they attend (for cancelling)
+ */
+export const calendar_event_references_update_tests = async ({ sdk } : { sdk: Session, sdkNonAdmin: Session }) => {
+  log_header("Calendar Event References Update (enduserUpdatesDisabled)")
+
+  let enduserId: string | undefined
+  let eventId: string | undefined
+
+  try {
+    // Setup: enduser attending a calendar event, so the enduser session has update access to it
+    const enduser = await sdk.api.endusers.createOne({
+      email: `references-update-${Date.now()}@example.com`,
+      fname: 'References',
+      lname: 'UpdateTest',
+    })
+    enduserId = enduser.id
+
+    const event = await sdk.api.calendar_events.createOne({
+      title: "References Update Test Event",
+      durationInMinutes: 30,
+      startTimeInMS: Date.now(),
+      attendees: [{ id: enduser.id, type: 'enduser' }],
+    })
+    eventId = event.id
+
+    const enduserSDK = new EnduserSession({ host, businessId })
+    await authenticate_enduser_via_token(sdk, enduserSDK, { id: enduser.id })
+
+    // ---- Staff/API session can update references ----
+    const staffReferences = [{ type: 'Elation', id: 'elation-appointment-123' }]
+    await async_test(
+      'staff can update calendar_events.references',
+      () => sdk.api.calendar_events.updateOne(event.id, { references: staffReferences }),
+      { onResult: e => e.references?.length === 1 && e.references[0].type === 'Elation' && e.references[0].id === 'elation-appointment-123' },
+    )
+    await async_test(
+      'staff references update persisted',
+      () => sdk.api.calendar_events.getOne(event.id),
+      { onResult: e => e.references?.length === 1 && e.references[0].type === 'Elation' && e.references[0].id === 'elation-appointment-123' },
+    )
+
+    // ---- Enduser session (attendee with update access) is still blocked on references ----
+    await async_test(
+      'enduser cannot update calendar_events.references',
+      () => enduserSDK.api.calendar_events.updateOne(event.id, { references: [{ type: 'Attacker', id: 'attacker-reference' }] } as any),
+      { shouldError: true, onError: e => e.message === "references cannot be updated by endusers" },
+    )
+    await async_test(
+      'rejected enduser references update did not persist',
+      () => sdk.api.calendar_events.getOne(event.id),
+      { onResult: e => e.references?.length === 1 && e.references[0].type === 'Elation' && e.references[0].id === 'elation-appointment-123' },
+    )
+
+    // ---- Positive control: the guard is field-scoped — enduser can still cancel the event ----
+    await async_test(
+      'enduser can still perform allowed update (cancelledAt)',
+      () => enduserSDK.api.calendar_events.updateOne(event.id, { cancelledAt: new Date() }),
+      { onResult: e => !!e.cancelledAt },
+    )
+  } finally {
+    if (eventId) {
+      try { await sdk.api.calendar_events.deleteOne(eventId) } catch {}
+    }
+    if (enduserId) {
+      try { await sdk.api.endusers.deleteOne(enduserId) } catch {}
+    }
+  }
+}
+
+// Allow running this test file independently
+if (require.main === module) {
+  console.log(`🌐 Using API URL: ${host}`)
+  const sdk = new Session({ host })
+  const sdkNonAdmin = new Session({ host })
+
+  const runTests = async () => {
+    await setup_tests(sdk, sdkNonAdmin)
+    await calendar_event_references_update_tests({ sdk, sdkNonAdmin })
+  }
+
+  runTests()
+    .then(() => {
+      console.log("✅ Calendar event references update test suite completed successfully")
+      process.exit(0)
+    })
+    .catch((error) => {
+      console.error("❌ Calendar event references update test suite failed:", error)
+      process.exit(1)
+    })
+}

package/src/tests/api_tests/formsort_header_auth.test.ts

@@ -0,0 +1,179 @@
+require('source-map-support').install();
+
+import axios from "axios"
+import { Session } from "../../sdk"
+import { log_header, async_test, assert } from "@tellescope/testing"
+import { setup_tests } from "../setup"
+
+const host = process.env.API_URL || "http://localhost:8080"
+
+// same seeded test API key used by formsort_tests (tests.ts)
+const TEST_API_KEY = "9d4f9dff00f60df2690a16da2cb848f289b447614ad9bef850e54af09a1fbf7a"
+// seeded second-tenant key (sdkOther in tests.ts) — valid, but for a different organization
+const OTHER_TENANT_API_KEY = "ba745e25162bb95a795c5fa1af70df188d93c4d3aac9c48b34a5c8c9dd7b80f7"
+const TEST_EMAIL = "formsort-header-auth@tellescope.com"
+
+export const formsort_header_auth_tests = async ({ sdk, sdkNonAdmin } : { sdk: Session, sdkNonAdmin: Session }) => {
+  log_header("FormSort Header Auth Tests")
+
+  const form = await sdk.api.forms.createOne({ title: "FormSort Header Auth" })
+
+  const buildUrl = (route: 'formsort' | 'form-ingestion', pathSegment: string) => {
+    const url = new URL(`${host}/v1/webhooks/${route}/${pathSegment}`)
+    url.searchParams.set('formId', form.id)
+    url.searchParams.set('returnJSON', 'true')
+    return url.toString()
+  }
+
+  const bodyFor = (responder_uuid: string) => ({
+    answers: [{ key: 'email', value: TEST_EMAIL }],
+    responder_uuid,
+    finalized: true,
+  })
+
+  const formResponseIds: string[] = []
+
+  try {
+    // 1. Valid key via Authorization: API_KEY header (placeholder path segment)
+    const headerAuthResult = await axios.post(
+      buildUrl('formsort', 'key-in-header'),
+      bodyFor("fha-1"),
+      { headers: { Authorization: `API_KEY ${TEST_API_KEY}` } },
+    )
+    assert(
+      headerAuthResult.status === 200 && !!headerAuthResult.data?.formResponseId && !!headerAuthResult.data?.enduserId,
+      `Header auth failed: ${headerAuthResult.status} ${JSON.stringify(headerAuthResult.data)}`,
+      "Valid API_KEY header authenticates",
+    )
+    if (headerAuthResult.data?.formResponseId) formResponseIds.push(headerAuthResult.data.formResponseId)
+
+    await async_test(
+      "Form response created via header auth is retrievable",
+      () => sdk.api.form_responses.getOne(headerAuthResult.data.formResponseId),
+      { onResult: fr => fr.formId === form.id && fr.source === 'Formsort' && !!fr.submittedAt },
+    )
+
+    // 2. Invalid key in header rejected, even with a valid key in the path (header takes precedence)
+    await async_test(
+      "Invalid API_KEY header rejected despite valid key in path",
+      () => axios.post(
+        buildUrl('formsort', TEST_API_KEY),
+        bodyFor("fha-2"),
+        { headers: { Authorization: `API_KEY not-a-real-key` } },
+      ),
+      { shouldError: true, onError: (e: any) => e.response?.status === 401 },
+    )
+
+    // 3. Back-compat: valid key in path, no Authorization header
+    const pathAuthResult = await axios.post(buildUrl('formsort', TEST_API_KEY), bodyFor("fha-3"))
+    assert(
+      pathAuthResult.status === 200 && !!pathAuthResult.data?.formResponseId,
+      `Path auth failed: ${pathAuthResult.status} ${JSON.stringify(pathAuthResult.data)}`,
+      "Path-segment API key still authenticates (no header)",
+    )
+    if (pathAuthResult.data?.formResponseId) formResponseIds.push(pathAuthResult.data.formResponseId)
+
+    // 4. Back-compat: non-API_KEY Authorization scheme falls through to path key
+    const bearerFallthroughResult = await axios.post(
+      buildUrl('formsort', TEST_API_KEY),
+      bodyFor("fha-4"),
+      { headers: { Authorization: 'Bearer unrelated-token' } },
+    )
+    assert(
+      bearerFallthroughResult.status === 200 && !!bearerFallthroughResult.data?.formResponseId,
+      `Bearer fallthrough failed: ${bearerFallthroughResult.status} ${JSON.stringify(bearerFallthroughResult.data)}`,
+      "Non-API_KEY Authorization scheme falls through to path key",
+    )
+    if (bearerFallthroughResult.data?.formResponseId) formResponseIds.push(bearerFallthroughResult.data.formResponseId)
+
+    // 5. No valid key in header or path
+    await async_test(
+      "No valid key anywhere rejected",
+      () => axios.post(buildUrl('formsort', 'not-a-real-key'), bodyFor("fha-5")),
+      { shouldError: true, onError: (e: any) => e.response?.status === 401 },
+    )
+
+    // 6. Alias route accepts header auth too
+    const aliasResult = await axios.post(
+      buildUrl('form-ingestion', 'key-in-header'),
+      bodyFor("fha-6"),
+      { headers: { Authorization: `API_KEY ${TEST_API_KEY}` } },
+    )
+    assert(
+      aliasResult.status === 200 && !!aliasResult.data?.formResponseId,
+      `form-ingestion header auth failed: ${aliasResult.status} ${JSON.stringify(aliasResult.data)}`,
+      "form-ingestion alias accepts API_KEY header",
+    )
+    if (aliasResult.data?.formResponseId) formResponseIds.push(aliasResult.data.formResponseId)
+
+    // 7. Back-compat: API_KEY scheme with no value falls through to the path key
+    const emptyValueResult = await axios.post(
+      buildUrl('formsort', TEST_API_KEY),
+      bodyFor("fha-7"),
+      { headers: { Authorization: 'API_KEY' } },
+    )
+    assert(
+      emptyValueResult.status === 200 && !!emptyValueResult.data?.formResponseId,
+      `Empty-value header fallthrough failed: ${emptyValueResult.status} ${JSON.stringify(emptyValueResult.data)}`,
+      "API_KEY scheme without value falls through to path key",
+    )
+    if (emptyValueResult.data?.formResponseId) formResponseIds.push(emptyValueResult.data.formResponseId)
+
+    // 8. Back-compat: single-token (schemeless) Authorization header falls through to the path key
+    const singleTokenResult = await axios.post(
+      buildUrl('formsort', TEST_API_KEY),
+      bodyFor("fha-8"),
+      { headers: { Authorization: 'some-opaque-token' } },
+    )
+    assert(
+      singleTokenResult.status === 200 && !!singleTokenResult.data?.formResponseId,
+      `Single-token header fallthrough failed: ${singleTokenResult.status} ${JSON.stringify(singleTokenResult.data)}`,
+      "Schemeless Authorization header falls through to path key",
+    )
+    if (singleTokenResult.data?.formResponseId) formResponseIds.push(singleTokenResult.data.formResponseId)
+
+    // 9. When header and path both hold VALID keys, the header key's organization scopes the request:
+    // the formId belongs to the primary tenant, so an other-tenant header key must fail form lookup (400),
+    // proving the path key's org is not used
+    await async_test(
+      "Valid other-tenant header key overrides valid path key (org scoping)",
+      () => axios.post(
+        buildUrl('formsort', TEST_API_KEY),
+        bodyFor("fha-9"),
+        { headers: { Authorization: `API_KEY ${OTHER_TENANT_API_KEY}` } },
+      ),
+      { shouldError: true, onError: (e: any) => e.response?.status === 400 && e.response?.data === 'formId Invalid' },
+    )
+  } finally {
+    for (const id of formResponseIds) {
+      try { await sdk.api.form_responses.deleteOne(id) } catch (err) { /* may not exist */ }
+    }
+    try {
+      const enduser = await sdk.api.endusers.getOne({ email: TEST_EMAIL })
+      await sdk.api.endusers.deleteOne(enduser.id)
+    } catch (err) { /* may not exist */ }
+    try { await sdk.api.forms.deleteOne(form.id) } catch (err) { /* may not exist */ }
+  }
+}
+
+// Allow running this test file independently
+if (require.main === module) {
+  console.log(`🌐 Using API URL: ${host}`)
+  const sdk = new Session({ host })
+  const sdkNonAdmin = new Session({ host })
+
+  const runTests = async () => {
+    await setup_tests(sdk, sdkNonAdmin)
+    await formsort_header_auth_tests({ sdk, sdkNonAdmin })
+  }
+
+  runTests()
+    .then(() => {
+      console.log("✅ FormSort header auth tests completed successfully")
+      process.exit(0)
+    })
+    .catch((error) => {
+      console.error("❌ FormSort header auth tests failed:", error)
+      process.exit(1)
+    })
+}

package/src/tests/api_tests/phone_calls_cold_transfer.test.ts

@@ -0,0 +1,113 @@
+require('source-map-support').install();
+
+import { Session } from "../../sdk"
+import {
+  async_test,
+  handleAnyError,
+  log_header,
+} from "@tellescope/testing"
+import { setup_tests } from "../setup"
+
+const host = process.env.API_URL || 'http://localhost:8080' as const
+
+const NONEXISTENT_MONGO_ID = '60398b1131a295e64f084fff'
+
+// Validation-path tests for the cold transfer endpoint. All assertions below hit
+// validations that run before any Twilio access, so no Twilio config is needed.
+export const phone_calls_cold_transfer_tests = async ({ sdk, sdkNonAdmin } : { sdk: Session, sdkNonAdmin: Session }) => {
+  log_header("Phone Calls Cold Transfer Tests")
+
+  const enduser = await sdk.api.endusers.createOne({ fname: 'Cold', lname: 'Transfer' })
+  const targetUsers: { id: string }[] = []
+
+  try {
+    const inboundCall = await sdk.api.phone_calls.createOne({
+      enduserId: enduser.id,
+      inbound: true,
+      externalId: 'CAcoldtransfertestinbound000000001',
+      from: '+15550001111',
+      to: '+15550002222',
+      userId: sdk.userInfo.id,
+    })
+    const outboundCall = await sdk.api.phone_calls.createOne({
+      enduserId: enduser.id,
+      inbound: false,
+      externalId: 'CAcoldtransfertestoutbound00000001',
+      from: '+15550002222',
+      to: '+15550001111',
+      userId: sdk.userInfo.id,
+    })
+
+    // throwaway target users (never modify existing users' roles)
+    const disabledTargetUser = await sdk.api.users.createOne({
+      email: 'cold.transfer.disabled@tellescope.com',
+      verifiedEmail: true,
+      notificationEmailsDisabled: true,
+      disableIncomingPhoneCalls: true,
+    })
+    targetUsers.push(disabledTargetUser)
+
+    await async_test(
+      "cold_transfer: cannot transfer to yourself",
+      () => sdk.api.phone_calls.cold_transfer({ callSid: inboundCall.externalId, targetUserId: sdk.userInfo.id }),
+      { shouldError: true, onError: (e: any) => e.message === "Cannot transfer a call to yourself" }
+    )
+    await async_test(
+      "cold_transfer: bogus callSid rejected",
+      () => sdk.api.phone_calls.cold_transfer({ callSid: 'CAdoesnotexist0000000000000000000', targetUserId: disabledTargetUser.id }),
+      { shouldError: true, onError: (e: any) => e.message === "Call not found" }
+    )
+    await async_test(
+      "cold_transfer: outbound calls rejected",
+      () => sdk.api.phone_calls.cold_transfer({ callSid: outboundCall.externalId, targetUserId: disabledTargetUser.id }),
+      { shouldError: true, onError: (e: any) => e.message === "Only inbound calls can be transferred" }
+    )
+    // conferenceId is not settable via the public API (only set internally by conference webhooks),
+    // so the "Conference calls cannot be transferred" branch is covered by manual E2E testing only
+    await async_test(
+      "cold_transfer: nonexistent target user rejected",
+      () => sdk.api.phone_calls.cold_transfer({ callSid: inboundCall.externalId, targetUserId: NONEXISTENT_MONGO_ID }),
+      { shouldError: true, onError: (e: any) => e.message === "Target user not found" }
+    )
+    await async_test(
+      "cold_transfer: target user with incoming calls disabled rejected",
+      () => sdk.api.phone_calls.cold_transfer({ callSid: inboundCall.externalId, targetUserId: disabledTargetUser.id }),
+      { shouldError: true, onError: (e: any) => e.message === "Target user has incoming calls disabled" }
+    )
+    // non-admin either can't see the call (Call not found) or is stopped by a later
+    // validation (target has incoming calls disabled) — errors on every path
+    await async_test(
+      "cold_transfer: non-admin cannot transfer an inaccessible call",
+      () => sdkNonAdmin.api.phone_calls.cold_transfer({ callSid: inboundCall.externalId, targetUserId: disabledTargetUser.id }),
+      handleAnyError
+    )
+  } finally {
+    // deleting the enduser cascades deletion of its phone_calls records
+    await Promise.all([
+      sdk.api.endusers.deleteOne(enduser.id),
+      ...targetUsers.map(u => sdk.api.users.deleteOne(u.id)),
+    ]).catch(console.error)
+  }
+}
+
+// Allow running this test file independently
+if (require.main === module) {
+  console.log(`🌐 Using API URL: ${host}`)
+  const sdk = new Session({ host })
+  const sdkNonAdmin = new Session({ host })
+
+  const runTests = async () => {
+    await setup_tests(sdk, sdkNonAdmin)
+    await phone_calls_cold_transfer_tests({ sdk, sdkNonAdmin })
+  }
+
+  runTests()
+    .then(() => {
+      console.log("✅ Phone calls cold transfer test suite completed successfully")
+      process.exit(0)
+    })
+    .catch((error) => {
+      console.error("❌ Phone calls cold transfer test suite failed:", error)
+      process.exit(1)
+    })
+}

package/src/tests/api_tests/phone_tree_enduser_condition.test.ts

@@ -0,0 +1,174 @@
+require('source-map-support').install();
+
+import { Session } from "../../sdk"
+import {
+  assert,
+  async_test,
+  handleAnyError,
+  log_header,
+} from "@tellescope/testing"
+import { PhoneTreeNode } from "@tellescope/types-models"
+import { setup_tests } from "../setup"
+
+const host = process.env.API_URL || 'http://localhost:8080' as const
+
+const SPLIT_NODE_ID = 'enduser-condition-split-node'
+const VIP_NODE_ID = 'vip-play-message-node'
+const ELSE_NODE_ID = 'else-play-message-node'
+
+const valid_condition_split_nodes: PhoneTreeNode[] = [
+  {
+    id: SPLIT_NODE_ID,
+    action: {
+      type: 'Enduser Condition Split',
+      info: {
+        branches: [
+          { name: 'VIP', enduserCondition: { $and: [{ condition: { tags: 'VIP' } }] } },
+          { name: 'Everyone Else' }, // no condition — catch-all
+        ],
+      },
+    },
+    events: [{ type: 'Start', parentId: SPLIT_NODE_ID, info: {} }],
+    flowchartUI: { x: 0, y: 0 },
+  },
+  {
+    id: VIP_NODE_ID,
+    action: {
+      type: 'Play Message',
+      info: { playback: { type: 'Say', info: { script: 'Welcome, VIP caller' } } },
+    },
+    events: [{ type: 'On Condition Branch', parentId: SPLIT_NODE_ID, info: { branch: 'VIP' } }],
+    flowchartUI: { x: -100, y: 100 },
+  },
+  {
+    id: ELSE_NODE_ID,
+    action: {
+      type: 'Play Message',
+      info: { playback: { type: 'Say', info: { script: 'Welcome' } } },
+    },
+    events: [{ type: 'On Condition Branch', parentId: SPLIT_NODE_ID, info: { branch: 'Everyone Else' } }],
+    flowchartUI: { x: 100, y: 100 },
+  },
+]
+
+export const phone_tree_enduser_condition_tests = async ({ sdk, sdkNonAdmin } : { sdk: Session, sdkNonAdmin: Session }) => {
+  log_header("Phone Tree Enduser Condition Split Tests")
+
+  const treeIds: string[] = []
+  try {
+    // valid Enduser Condition Split node with On Condition Branch children saves
+    const tree = await sdk.api.phone_trees.createOne({
+      number: '+15005550006',
+      isActive: false,
+      nodes: valid_condition_split_nodes,
+    })
+    treeIds.push(tree.id)
+    assert(!!tree.id, 'failed to create tree with Enduser Condition Split', 'create tree with Enduser Condition Split')
+
+    const loaded = await sdk.api.phone_trees.getOne(tree.id)
+    const loadedSplit = loaded.nodes.find(n => n.action.type === 'Enduser Condition Split')
+    assert(
+      loadedSplit?.action.type === 'Enduser Condition Split'
+      && loadedSplit.action.info.branches.length === 2
+      && loadedSplit.action.info.branches[0].name === 'VIP'
+      && !!loadedSplit.action.info.branches[0].enduserCondition
+      && loadedSplit.action.info.branches[1].enduserCondition === undefined,
+      'branches did not round-trip',
+      'branches (conditions + catch-all) round-trip on read',
+    )
+
+    // regression: existing Conditional Split shape is unaffected
+    const conditionalSplitTree = await sdk.api.phone_trees.createOne({
+      number: '+15005550006',
+      isActive: false,
+      nodes: [{
+        id: 'conditional-split-node',
+        // timezone + weeklyAvailabilities included to match the webapp's default Conditional Split shape
+        action: { type: 'Conditional Split', info: { timezone: 'US/Eastern', weeklyAvailabilities: [], hasCareTeam: true } },
+        events: [{ type: 'Start', parentId: 'conditional-split-node', info: {} }],
+        flowchartUI: { x: 0, y: 0 },
+      }],
+    })
+    treeIds.push(conditionalSplitTree.id)
+    assert(!!conditionalSplitTree.id, 'failed to create Conditional Split tree', 'existing Conditional Split still saves (regression)')
+
+    // invalid: enduserCondition must be an object
+    await async_test(
+      "non-object enduserCondition is rejected",
+      () => sdk.api.phone_trees.createOne({
+        number: '+15005550006',
+        isActive: false,
+        nodes: [{
+          id: SPLIT_NODE_ID,
+          action: {
+            type: 'Enduser Condition Split',
+            info: { branches: [{ name: 'Bad', enduserCondition: "not-an-object" as any }] },
+          },
+          events: [{ type: 'Start', parentId: SPLIT_NODE_ID, info: {} }],
+          flowchartUI: { x: 0, y: 0 },
+        }],
+      }).then(t => { treeIds.push(t.id); return t }), // cleanup if it unexpectedly passes
+      handleAnyError,
+    )
+
+    // invalid: branches must include a name
+    await async_test(
+      "branch without a name is rejected",
+      () => sdk.api.phone_trees.createOne({
+        number: '+15005550006',
+        isActive: false,
+        nodes: [{
+          id: SPLIT_NODE_ID,
+          action: {
+            type: 'Enduser Condition Split',
+            info: { branches: [{ enduserCondition: {} } as any] },
+          },
+          events: [{ type: 'Start', parentId: SPLIT_NODE_ID, info: {} }],
+          flowchartUI: { x: 0, y: 0 },
+        }],
+      }).then(t => { treeIds.push(t.id); return t }),
+      handleAnyError,
+    )
+
+    // invalid: On Condition Branch events must include a branch value
+    await async_test(
+      "On Condition Branch event without branch is rejected",
+      () => sdk.api.phone_trees.createOne({
+        number: '+15005550006',
+        isActive: false,
+        nodes: valid_condition_split_nodes.map(n => (
+          n.id !== VIP_NODE_ID
+            ? n
+            : { ...n, events: [{ type: 'On Condition Branch', parentId: SPLIT_NODE_ID, info: {} as any }] }
+        )),
+      }).then(t => { treeIds.push(t.id); return t }),
+      handleAnyError,
+    )
+  } finally {
+    for (const id of treeIds) {
+      await sdk.api.phone_trees.deleteOne(id).catch(console.error)
+    }
+  }
+}
+
+// Allow running this test file independently
+if (require.main === module) {
+  console.log(`Using API URL: ${host}`)
+  const sdk = new Session({ host })
+  const sdkNonAdmin = new Session({ host })
+
+  const runTests = async () => {
+    await setup_tests(sdk, sdkNonAdmin)
+    await phone_tree_enduser_condition_tests({ sdk, sdkNonAdmin })
+  }
+
+  runTests()
+    .then(() => {
+      console.log("✅ Phone tree enduser condition test suite completed successfully")
+      process.exit(0)
+    })
+    .catch((error) => {
+      console.error("❌ Phone tree enduser condition test suite failed:", error)
+      process.exit(1)
+    })
+}

package/src/tests/tests.ts

@@ -81,6 +81,7 @@ import {
 
 import fs from "fs"
 import { load_inbox_data_tests } from "./api_tests/load_inbox_data.test";
+import { phone_calls_cold_transfer_tests } from "./api_tests/phone_calls_cold_transfer.test";
 import { enduser_login_tests } from "./api_tests/enduser_login.test";
 import { enduser_login_rate_limits_tests } from "./api_tests/enduser_login_rate_limits.test";
 import { eom_procedure_codes_tests } from "./api_tests/eom_procedure_codes.test";
@@ -120,6 +121,7 @@ import { database_cascade_delete_tests } from "./api_tests/database_cascade_dele
 import { ai_conversations_tests } from "./api_tests/ai_conversations.test";
 import { load_team_chat_tests } from "./api_tests/load_team_chat.test";
 import { form_started_trigger_tests } from "./api_tests/form_started_trigger.test";
+import { formsort_header_auth_tests } from "./api_tests/formsort_header_auth.test";
 import { form_submitted_trigger_tests } from "./api_tests/form_submitted_trigger.test";
 import { dont_sync_to_elation_form_submission_tests } from "./api_tests/dont_sync_to_elation_form_submission.test";
 import { medication_added_trigger_tests } from "./api_tests/medication_added_trigger.test";
@@ -127,6 +129,7 @@ import { conditional_logic_medication_unit_tests } from "./unit_tests/conditiona
 import { elation_user_id_tests } from "./api_tests/elation_user_id.test";
 import { organization_settings_duplicates_tests } from "./api_tests/organization_settings_duplicates.test";
 import { calendar_events_bulk_update_tests } from "./api_tests/calendar_events_bulk_update.test";
+import { calendar_event_references_update_tests } from "./api_tests/calendar_event_references_update.test";
 import { openloop_webhooks_tests } from "./api_tests/openloop_webhooks.test";
 import { beluga_pharmacy_mappings_tests } from "./api_tests/beluga_pharmacy_mappings.test";
 import { mdi_case_offerings_tests } from "./api_tests/mdi_case_offerings.test";
@@ -140,6 +143,7 @@ import { enduser_session_invalidation_tests } from "./api_tests/enduser_session_
 import { enduser_cross_access_isolation_tests } from "./api_tests/enduser_cross_access_isolation.test";
 import { calendar_event_webhook_template_tests } from "./api_tests/calendar_event_webhook_template.test";
 import { webhook_error_handling_tests } from "./api_tests/webhook_error_handling.test";
+import { phone_tree_enduser_condition_tests } from "./api_tests/phone_tree_enduser_condition.test";
 
 const UniquenessViolationMessage = 'Uniqueness Violation'
 
@@ -15087,6 +15091,7 @@ const ip_address_form_tests = async () => {
     await form_submitted_trigger_tests({ sdk, sdkNonAdmin })
     await dont_sync_to_elation_form_submission_tests({ sdk, sdkNonAdmin })
     await date_string_validation_tests({ sdk, sdkNonAdmin })
+    await phone_tree_enduser_condition_tests({ sdk, sdkNonAdmin })
     await openloop_webhooks_tests({ sdk, sdkNonAdmin })
     await mdi_webhooks_tests({ sdk, sdkNonAdmin })
     await integrations_redacted_tests({ sdk, sdkNonAdmin })
@@ -15122,6 +15127,7 @@ const ip_address_form_tests = async () => {
     await afteraction_day_of_month_delay_tests({ sdk, sdkNonAdmin })
     await bulk_assignment_tests({ sdk, sdkNonAdmin })
     await formsort_tests()
+    await formsort_header_auth_tests({ sdk, sdkNonAdmin })
     await self_serve_appointment_booking_tests()
     await test_ticket_automation_assignment_and_optimization()
     await monthly_availability_restrictions_tests({ sdk, sdkNonAdmin })
@@ -15131,6 +15137,7 @@ const ip_address_form_tests = async () => {
     await inbox_threads_building_tests()
     await inbox_threads_loading_tests()
     await load_inbox_data_tests({ sdk, sdkNonAdmin })
+    await phone_calls_cold_transfer_tests({ sdk, sdkNonAdmin })
     await enduser_observations_acknowledge_tests({ sdk, sdkNonAdmin })
     await nutrition_tracking_tests({ sdk, sdkNonAdmin })
     await translations_tests({ sdk, sdkNonAdmin })
@@ -15142,6 +15149,7 @@ const ip_address_form_tests = async () => {
     await ip_address_form_tests()
     await bulk_update_tests()
     await calendar_events_bulk_update_tests({ sdk })
+    await calendar_event_references_update_tests({ sdk, sdkNonAdmin })
     await cancel_upcoming_appointments_journey_action_test()
     await multi_tenant_tests() // should come right after setup tests
     await sync_tests_with_access_tags() // should come directly after setup to avoid extra sync values