@tellescope/sdk 1.255.18 → 1.256.0

package/lib/esm/tests/api_tests/security/public_endpoint_auth_field_lock.test.js

@@ -0,0 +1,2323 @@
+var __assign = (this && this.__assign) || function () {
+    __assign = Object.assign || function(t) {
+        for (var s, i = 1, n = arguments.length; i < n; i++) {
+            s = arguments[i];
+            for (var p in s) if (Object.prototype.hasOwnProperty.call(s, p))
+                t[p] = s[p];
+        }
+        return t;
+    };
+    return __assign.apply(this, arguments);
+};
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __generator = (this && this.__generator) || function (thisArg, body) {
+    var _ = { label: 0, sent: function() { if (t[0] & 1) throw t[1]; return t[1]; }, trys: [], ops: [] }, f, y, t, g;
+    return g = { next: verb(0), "throw": verb(1), "return": verb(2) }, typeof Symbol === "function" && (g[Symbol.iterator] = function() { return this; }), g;
+    function verb(n) { return function (v) { return step([n, v]); }; }
+    function step(op) {
+        if (f) throw new TypeError("Generator is already executing.");
+        while (g && (g = 0, op[0] && (_ = 0)), _) try {
+            if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
+            if (y = 0, t) op = [op[0] & 2, t.value];
+            switch (op[0]) {
+                case 0: case 1: t = op; break;
+                case 4: _.label++; return { value: op[1], done: false };
+                case 5: _.label++; y = op[1]; op = [0]; continue;
+                case 7: op = _.ops.pop(); _.trys.pop(); continue;
+                default:
+                    if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) { _ = 0; continue; }
+                    if (op[0] === 3 && (!t || (op[1] > t[0] && op[1] < t[3]))) { _.label = op[1]; break; }
+                    if (op[0] === 6 && _.label < t[1]) { _.label = t[1]; t = op; break; }
+                    if (t && _.label < t[2]) { _.label = t[2]; _.ops.push(op); break; }
+                    if (t[2]) _.ops.pop();
+                    _.trys.pop(); continue;
+            }
+            op = body.call(thisArg, _);
+        } catch (e) { op = [6, e]; y = 0; } finally { f = t = 0; }
+        if (op[0] & 5) throw op[1]; return { value: op[0] ? op[1] : void 0, done: true };
+    }
+};
+require('source-map-support').install();
+import axios from "axios";
+import { Session, EnduserSession } from "../../../sdk";
+import { assert, log_header, } from "@tellescope/testing";
+import { setup_tests, authenticate_enduser_via_token } from "../../setup";
+var host = process.env.API_URL || 'http://localhost:8080';
+/**
+ * Regression test for: email / phone are locked against writes from public session-start endpoints.
+ *
+ * Two public, unauthenticated endpoints match an existing patient on a loose $or
+ * ({ email } OR { fname, lname, dateOfBirth }) and then update the matched record:
+ *
+ *   A  POST /v1/session-for-public-form
+ *   B  POST /v1/session-for-public-appointment-booking
+ *
+ * Both used to overwrite `email`, `phone` and `state` on the matched patient. `email` and `phone`
+ * are authentication channels, so that overwrite chains to account takeover:
+ *
+ *   - email-less patients are common and cheap to create (sms_messages.leave_message is an
+ *     unauthenticated enduser-creation primitive that writes only phone/fname/lname)
+ *   - attacker submits a public form matching on fname + lname + dateOfBirth with their own email
+ *   - POST /v1/request-enduser-password-reset resolves purely by findOne({ email }) -> mints a
+ *     passwordReset token and mails the reset link to the attacker
+ *   - reset_password sets hashedPassword; the attacker logs into the portal as the patient
+ *
+ * phone is equally load-bearing: begin_login_flow accepts email OR phone, and send_otp delivers
+ * login codes to enduser.phone. A "fill only if blank" fix does NOT close this — the email-less
+ * patient is precisely the common case, which is why the UNSET shapes below are the load-bearing
+ * rows of G1/G2.
+ *
+ * The rule under test: `email` and `phone` may be written only on the INSERT path. On a matched
+ * existing patient they are never written — not even when the stored value is blank.
+ *
+ * `state` deliberately still overwrites on match (G6 pins the status quo): it is not an auth
+ * channel, and moving it behind "if unset" would break a relocated patient booking with a
+ * provider licensed in their new state.
+ *
+ * Scenario groups (pre-fix expectation in parens):
+ *   G1  (RED)   A — overwrite blocked on match, 4 victim shapes (both set / email unset / phone unset / both unset)
+ *   G2  (RED)   B — same 4 shapes
+ *   G3  (RED)   A — overwrite blocked when the victim is targeted directly via the enduserId param
+ *   G4  (RED)   takeover chain: email-less victim -> overwrite via A -> password-reset resolvability
+ *   G5  (GREEN) blank fname/lname/dateOfBirth/gender still filled; blank phone still NOT filled
+ *   G6  (GREEN) state still overwrites on match (status-quo pin)
+ *   G7  (GREEN) brand-new visitor still created WITH submitted email + phone
+ *   G8  (GREEN) form submission completes end-to-end under the returned token
+ *   G9  (GREEN) appointment availability / booking works under the returned session
+ *   G10 (GREEN) skipMatch still inserts, and skipMatch + autoMergeOnSubmission sets eligibleForAutoMerge
+ *
+ * SECOND WRITE PATH (G11-G18). Locking the endpoints is not sufficient on its own. `email` and
+ * `phone` are also UI-selectable form intakeField mappings, and save_enduser_updates_for_form_response
+ * (api/modules/forms.ts) copies those answers onto the enduser named by the form response — with no
+ * session argument and no only-if-blank guard. Two of its callers sit in the 'public-form' session scope
+ * (submit_form_response, and save_field_response for fields with options.saveIntakeOnPartial), so the
+ * whole chain above is reachable with the token the hardened endpoint itself mints: match the victim,
+ * get a session scoped to their id, then answer the form's Email question with the attacker address.
+ *
+ * The lock is scoped to "a public session that matched a PRE-EXISTING patient", not to every public
+ * session, because intakeEmailHidden / intakePhone: 'hidden' are supported configurations in which
+ * the intake question is the only source of a brand-new patient's contact info (G16).
+ *
+ *   G11 (RED)   intake answers do not overwrite a matched patient (submit path), 4 victim shapes
+ *   G12 (RED)   same via save_field_response + saveIntakeOnPartial, without ever submitting
+ *   G13 (RED)   full takeover chain driven through an intake answer
+ *   G14 (RED)   pivot: public session -> prepare_form_response for a NON-public form -> submit
+ *   G15 (RED)   save_field_response rejects another patient's formResponseId (accessCode path stays open)
+ *   G16 (GREEN) brand-new visitor still gets email/phone from intake answers
+ *   G17 (GREEN) authenticated (non-public) portal session can still self-update via intake
+ *   G18 (GREEN) staff submitting on a patient's behalf can still set email/phone
+ *
+ * NULL-MATCH / COLD START (G19-G22). In both handlers' $or, `email` and `dateOfBirth` get `|| "never"`
+ * sentinels but fname/lname are interpolated RAW. `ignoreUndefined` is not set on the Mongo client and
+ * findOne does not strip undefined keys, so an absent fname serializes to `{fname: null}` — which
+ * matches every document where the field is null OR MISSING. A request supplying ONLY dateOfBirth can
+ * therefore match another patient and receive a session scoped to THEIR record. The cold-start pattern
+ * (a public form started with no intake info, which just creates an Enduser with an ID) is what
+ * manufactures those nameless endusers.
+ *
+ *   G19 (RED)   DOB-only request does not hijack a nameless patient — form endpoint
+ *   G20 (RED)   same — booking endpoint (no skipMatch, no phone guard, so reached unconditionally)
+ *   G21 (GREEN) the match sentinel never leaks into a stored fname/lname
+ *   G22 (GREEN) cold start still lets intake answers populate email/phone on the fresh record
+ *
+ * TENANT SCOPING (G23). addPublicEndpoint overwrites the schema's `required: true` for businessId with
+ * mongoIdStringOptional, and a falsy businessId leaves restrictAccess as the IDENTITY function in the
+ * query builders — the tenant clause is never appended, so the handler queries every tenant. It fails
+ * OPEN. session_for_public_appointment_booking already guards this; session_for_public_form did not.
+ *
+ *   G23 (RED)   session_for_public_form rejects a missing or malformed businessId
+ *
+ * LOCK BYPASSES (G24-G26). The lock is defeated two ways, each needing more than one hop — which is
+ * why the single-hop groups above pass while the chain is still open:
+ *   - prepare_form_response mints a token that preserves allowedPaths but DROPS fromPublicSession, so
+ *     a second hop through the same endpoint produces an unlocked response. That flag also gates PHI
+ *     on refresh_session, so the chained token additionally reads the victim's whole record.
+ *   - the lock is a snapshot taken at session start; a later repoint of the response at a pre-existing
+ *     patient leaves a stale `false` behind unless it also writes the flag. Two callers repoint:
+ *     autoMergeOnSubmission (G26) and the staff endusers.merge handler (G27).
+ *
+ *   G24 (RED)   chained prepare_form_response session stays locked
+ *   G25 (RED)   chained session does not expose the enduser record on refresh
+ *   G26 (RED)   auto-merge does not let an intake answer repoint the merged patient
+ *   G27 (RED)   the staff endusers.merge repoint applies the lock too
+ *
+ * SCOPE BOUNDARY (G28). The formsort / form-ingestion webhook re-opens a blank email/phone for one
+ * hour after the Stripe integration creates a contact, because that endpoint is API-key
+ * authenticated. This anonymous path gets no such exemption.
+ *
+ *   G28         a fresh Stripe-created patient gets no grace here
+ *
+ * STRUCTURE: record -> report -> cleanup -> assert.
+ * EXIT_ON_FIRST_ERROR is true in testing.ts, so assert() calls process.exit(1) synchronously on the
+ * first failure. Two consequences shape this file:
+ *   1. No async_test here. Every scenario records into `results`, a summary table prints, and a
+ *      single assert() loop runs LAST — so a pre-fix run prints the complete failure picture
+ *      instead of dying on the first probe.
+ *   2. process.exit() does not unwind pending finally blocks, so cleanup runs BEFORE the assert
+ *      loop; otherwise a by-design-failing run would leak every fixture into the next run.
+ */
+var post = function (path, body) { return __awaiter(void 0, void 0, void 0, function () {
+    var res, err_1;
+    var _a, _b;
+    return __generator(this, function (_c) {
+        switch (_c.label) {
+            case 0:
+                _c.trys.push([0, 2, , 3]);
+                return [4 /*yield*/, axios.post("".concat(host).concat(path), body, { validateStatus: function () { return true; } })];
+            case 1:
+                res = _c.sent();
+                return [2 /*return*/, { status: res.status, data: res.data }];
+            case 2:
+                err_1 = _c.sent();
+                return [2 /*return*/, { status: (_a = err_1 === null || err_1 === void 0 ? void 0 : err_1.response) === null || _a === void 0 ? void 0 : _a.status, data: (_b = err_1 === null || err_1 === void 0 ? void 0 : err_1.response) === null || _b === void 0 ? void 0 : _b.data }];
+            case 3: return [2 /*return*/];
+        }
+    });
+}); };
+// Endpoint A's update is fire-and-forget (.catch(console.error), not awaited); B's is awaited.
+// Reading the victim immediately after calling A would frequently show the un-overwritten value on
+// a VULNERABLE server -> false pass. So poll for the attack landing: fails fast against vulnerable
+// code, burns the full window against fixed code.
+var OVERWRITE_WINDOW_MS = 3000;
+var AWAITED_WINDOW_MS = 1200;
+var POLL_INTERVAL_MS = 150;
+var sleep = function (ms) { return new Promise(function (resolve) { return setTimeout(resolve, ms); }); };
+export var public_endpoint_auth_field_lock_tests = function (_a) {
+    var sdk = _a.sdk, sdkNonAdmin = _a.sdkNonAdmin;
+    return __awaiter(void 0, void 0, void 0, function () {
+        var businessId, RUN, results, record, skip, runScenario, phoneOffset, phoneSeed, nextPhone, emailFor, createdEnduserIds, createdFormIds, createdFormFieldIds, createdUserIds, createdEventIds, createdTemplateIds, organization, MATCH_EMAIL_AND_NAMES, form, plainField, autoMergeForm, autoMergeField, makeIntakeForm, intake, partialIntake, pivotIntake, MERGE_CUSTOM_KEY, autoMergeIntake, template, hostUser, publicSDK, startForm, startBooking, startFormOn, asEnduser, postAuthed, tokenFromURL, patchAuthed, intakeAnswers, pollEnduser, describe, makeVictim, VICTIM_SHAPES, _loop_1, _i, VICTIM_SHAPES_1, shape, _loop_2, _b, VICTIM_SHAPES_2, shape, formSessions, bookingTokens, _loop_3, _c, VICTIM_SHAPES_3, shape, G12_NAME, G13_NAME, G14_NAME, G15_NAME, namelessDob, makeNamelessVictim, G19_NAME, G20_NAME, coldStartCase, G23_NAME, chainForVictim, G24_NAME, G25_NAME, G26_NAME, G27_NAME, G28_NAME, failures, skipped, _d, results_1, r, status_1, _e, createdEventIds_1, id, _f, createdFormIds_1, formId, responses, _g, responses_1, response, _h, createdFormFieldIds_1, id, _j, createdFormIds_2, id, uniqueEnduserIds, _k, uniqueEnduserIds_1, id, _l, createdTemplateIds_1, id, _m, createdUserIds_1, id, _o, results_2, r;
+        var _p, _q;
+        return __generator(this, function (_r) {
+            switch (_r.label) {
+                case 0:
+                    log_header("Public Endpoint Auth Field Lock (email / phone)");
+                    businessId = sdk.userInfo.businessId;
+                    RUN = Date.now().toString(36);
+                    results = [];
+                    record = function (group, name, ok, detail) {
+                        if (detail === void 0) { detail = ''; }
+                        results.push({ group: group, name: name, ok: ok, detail: detail });
+                        console.log("   ".concat(ok ? '✓' : '✗', " [").concat(group, "] ").concat(name).concat(detail ? " \u2014 ".concat(detail) : ''));
+                    };
+                    skip = function (group, name, detail) {
+                        results.push({ group: group, name: name, ok: true, skipped: true, detail: detail });
+                        console.log("   \u26A0 SKIP [".concat(group, "] ").concat(name, " \u2014 ").concat(detail));
+                    };
+                    runScenario = function (group, name, fn) { return __awaiter(void 0, void 0, void 0, function () {
+                        var err_2, message;
+                        var _a, _b;
+                        return __generator(this, function (_c) {
+                            switch (_c.label) {
+                                case 0:
+                                    _c.trys.push([0, 2, , 3]);
+                                    return [4 /*yield*/, fn()];
+                                case 1:
+                                    _c.sent();
+                                    return [3 /*break*/, 3];
+                                case 2:
+                                    err_2 = _c.sent();
+                                    message = (_b = (_a = err_2 === null || err_2 === void 0 ? void 0 : err_2.message) !== null && _a !== void 0 ? _a : err_2 === null || err_2 === void 0 ? void 0 : err_2.error) !== null && _b !== void 0 ? _b : JSON.stringify(err_2 !== null && err_2 !== void 0 ? err_2 : {}).slice(0, 300);
+                                    record(group, name, false, "threw: ".concat(message));
+                                    return [3 /*break*/, 3];
+                                case 3: return [2 /*return*/];
+                            }
+                        });
+                    }); };
+                    phoneOffset = 0;
+                    phoneSeed = Number(RUN.replace(/[^0-9]/g, '') || '0');
+                    nextPhone = function () { return "+1555555".concat(String((phoneSeed + (phoneOffset += 1)) % 10000).padStart(4, '0')); };
+                    emailFor = function (label) { return "".concat(label, "-").concat(RUN, "@tellescope.com").toLowerCase(); };
+                    createdEnduserIds = [];
+                    createdFormIds = [];
+                    createdFormFieldIds = [];
+                    createdUserIds = [];
+                    createdEventIds = [];
+                    createdTemplateIds = [];
+                    return [4 /*yield*/, sdk.api.organizations.getOne(businessId).catch(function () { return null; })];
+                case 1:
+                    organization = _r.sent();
+                    MATCH_EMAIL_AND_NAMES = !!((_q = (_p = organization === null || organization === void 0 ? void 0 : organization.settings) === null || _p === void 0 ? void 0 : _p.endusers) === null || _q === void 0 ? void 0 : _q.matchEmailAndNames);
+                    return [4 /*yield*/, sdk.api.forms.createOne({ title: "auth field lock ".concat(RUN), allowPublicURL: true })];
+                case 2:
+                    form = _r.sent();
+                    createdFormIds.push(form.id);
+                    return [4 /*yield*/, sdk.api.form_fields.createOne({
+                            formId: form.id,
+                            title: 'Anything',
+                            type: 'string',
+                            previousFields: [{ type: 'root', info: {} }],
+                        })];
+                case 3:
+                    plainField = _r.sent();
+                    createdFormFieldIds.push(plainField.id);
+                    return [4 /*yield*/, sdk.api.forms.createOne({
+                            title: "auth field lock automerge ".concat(RUN),
+                            allowPublicURL: true,
+                            autoMergeOnSubmission: true,
+                        })];
+                case 4:
+                    autoMergeForm = _r.sent();
+                    createdFormIds.push(autoMergeForm.id);
+                    return [4 /*yield*/, sdk.api.form_fields.createOne({
+                            formId: autoMergeForm.id,
+                            title: 'Anything',
+                            type: 'string',
+                            previousFields: [{ type: 'root', info: {} }],
+                        })];
+                case 5:
+                    autoMergeField = _r.sent();
+                    createdFormFieldIds.push(autoMergeField.id);
+                    makeIntakeForm = function (label, opts) {
+                        if (opts === void 0) { opts = {}; }
+                        return __awaiter(void 0, void 0, void 0, function () {
+                            var intakeForm, fieldOptions, emailField, phoneField;
+                            return __generator(this, function (_a) {
+                                switch (_a.label) {
+                                    case 0: return [4 /*yield*/, sdk.api.forms.createOne(__assign({ title: "auth field lock ".concat(label, " ").concat(RUN), intakePhone: 'hidden' }, (opts.public === false ? {} : { allowPublicURL: true })))];
+                                    case 1:
+                                        intakeForm = _a.sent();
+                                        createdFormIds.push(intakeForm.id);
+                                        fieldOptions = opts.saveIntakeOnPartial ? { options: { saveIntakeOnPartial: true } } : {};
+                                        return [4 /*yield*/, sdk.api.form_fields.createOne(__assign({ formId: intakeForm.id, title: 'Email', type: 'email', intakeField: 'email', previousFields: [{ type: 'root', info: {} }] }, fieldOptions))];
+                                    case 2:
+                                        emailField = _a.sent();
+                                        createdFormFieldIds.push(emailField.id);
+                                        return [4 /*yield*/, sdk.api.form_fields.createOne(__assign({ formId: intakeForm.id, title: 'Phone Number', type: 'phone', intakeField: 'phone', previousFields: [{ type: 'after', info: { fieldId: emailField.id } }] }, fieldOptions))];
+                                    case 3:
+                                        phoneField = _a.sent();
+                                        createdFormFieldIds.push(phoneField.id);
+                                        return [2 /*return*/, { form: intakeForm, emailField: emailField, phoneField: phoneField }];
+                                }
+                            });
+                        });
+                    };
+                    return [4 /*yield*/, makeIntakeForm('intake')];
+                case 6:
+                    intake = _r.sent();
+                    return [4 /*yield*/, makeIntakeForm('partial', { saveIntakeOnPartial: true })
+                        // Deliberately NOT allowPublicURL. prepare_form_response does not require it, so a public session
+                        // can pivot from any public form to any form in the org carrying an email/phone intake mapping.
+                    ];
+                case 7:
+                    partialIntake = _r.sent();
+                    return [4 /*yield*/, makeIntakeForm('pivot', { public: false })
+                        // Auto-merge fixture for G26. Needs real intakeField mappings, because resolveAutoMergeBeforeSubmission
+                        // derives its match values from the submitted answers via those mappings — and the custom field is the
+                        // anti-vacuity control (it proves the intake write ran at all).
+                    ];
+                case 8:
+                    pivotIntake = _r.sent();
+                    MERGE_CUSTOM_KEY = "aflMerge".concat(RUN);
+                    return [4 /*yield*/, (function () { return __awaiter(void 0, void 0, void 0, function () {
+                            var form, spec, made, _i, spec_1, s, field, fname, lname, dateOfBirth, email, custom;
+                            return __generator(this, function (_a) {
+                                switch (_a.label) {
+                                    case 0: return [4 /*yield*/, sdk.api.forms.createOne({
+                                            title: "auth field lock automerge intake ".concat(RUN),
+                                            allowPublicURL: true,
+                                            autoMergeOnSubmission: true,
+                                            intakePhone: 'hidden',
+                                        })];
+                                    case 1:
+                                        form = _a.sent();
+                                        createdFormIds.push(form.id);
+                                        spec = [
+                                            { title: 'First Name', type: 'string', intakeField: 'fname' },
+                                            { title: 'Last Name', type: 'string', intakeField: 'lname' },
+                                            { title: 'Date of Birth', type: 'dateString', intakeField: 'dateOfBirth' },
+                                            { title: 'Email', type: 'email', intakeField: 'email' },
+                                            { title: 'Custom', type: 'string', intakeField: MERGE_CUSTOM_KEY },
+                                        ];
+                                        made = [];
+                                        _i = 0, spec_1 = spec;
+                                        _a.label = 2;
+                                    case 2:
+                                        if (!(_i < spec_1.length)) return [3 /*break*/, 5];
+                                        s = spec_1[_i];
+                                        return [4 /*yield*/, sdk.api.form_fields.createOne({
+                                                formId: form.id,
+                                                title: s.title,
+                                                type: s.type,
+                                                intakeField: s.intakeField,
+                                                previousFields: made.length
+                                                    ? [{ type: 'after', info: { fieldId: made[made.length - 1].id } }]
+                                                    : [{ type: 'root', info: {} }],
+                                            })];
+                                    case 3:
+                                        field = _a.sent();
+                                        createdFormFieldIds.push(field.id);
+                                        made.push(field);
+                                        _a.label = 4;
+                                    case 4:
+                                        _i++;
+                                        return [3 /*break*/, 2];
+                                    case 5:
+                                        fname = made[0], lname = made[1], dateOfBirth = made[2], email = made[3], custom = made[4];
+                                        return [2 /*return*/, { form: form, fname: fname, lname: lname, dateOfBirth: dateOfBirth, email: email, custom: custom }];
+                                }
+                            });
+                        }); })()];
+                case 9:
+                    autoMergeIntake = _r.sent();
+                    return [4 /*yield*/, sdk.api.calendar_event_templates.createOne({
+                            title: "auth field lock ".concat(RUN),
+                            durationInMinutes: 60,
+                            confirmationEmailDisabled: true,
+                            confirmationSMSDisabled: true,
+                            reminders: [],
+                        })];
+                case 10:
+                    template = _r.sent();
+                    createdTemplateIds.push(template.id);
+                    return [4 /*yield*/, sdk.api.users.createOne({
+                            email: emailFor('lock-host'),
+                            verifiedEmail: true,
+                            fname: 'Lock',
+                            lname: "Host".concat(RUN),
+                        })];
+                case 11:
+                    hostUser = _r.sent();
+                    createdUserIds.push(hostUser.id);
+                    return [4 /*yield*/, sdk.api.users.updateOne(hostUser.id, {
+                            weeklyAvailabilities: [0, 1, 2, 3, 4, 5, 6].map(function (dayOfWeekStartingSundayIndexedByZero) { return ({
+                                dayOfWeekStartingSundayIndexedByZero: dayOfWeekStartingSundayIndexedByZero,
+                                startTimeInMinutes: 9 * 60,
+                                endTimeInMinutes: 17 * 60,
+                                intervalInMinutes: 60,
+                            }); }),
+                            calendarEventLimits: [],
+                        }, { replaceObjectFields: true })];
+                case 12:
+                    _r.sent();
+                    return [4 /*yield*/, sleep(250)
+                        // ---------------------------------------------------------------------------------------------
+                        // Helpers
+                        // ---------------------------------------------------------------------------------------------
+                    ]; // let form.numFields settle before the public endpoints validate it
+                case 13:
+                    _r.sent(); // let form.numFields settle before the public endpoints validate it
+                    publicSDK = function () { return new EnduserSession({ host: host, businessId: businessId }); };
+                    startForm = function (args) { return publicSDK().api.form_responses.session_for_public_form(__assign({ formId: form.id, businessId: businessId }, args)); };
+                    startBooking = function (args) { return publicSDK().api.calendar_events.session_for_public_appointment_booking(__assign({ calendarEventTemplateId: template.id, businessId: businessId }, args)); };
+                    startFormOn = function (formId, args) { return publicSDK().api.form_responses.session_for_public_form(__assign({ formId: formId, businessId: businessId }, args)); };
+                    asEnduser = function (authToken) { return new EnduserSession({ host: host, businessId: businessId, authToken: authToken }); };
+                    postAuthed = function (path, body, authToken) { return __awaiter(void 0, void 0, void 0, function () {
+                        var res, err_3;
+                        var _a, _b;
+                        return __generator(this, function (_c) {
+                            switch (_c.label) {
+                                case 0:
+                                    _c.trys.push([0, 2, , 3]);
+                                    return [4 /*yield*/, axios.post("".concat(host).concat(path), body, {
+                                            headers: { Authorization: "Bearer ".concat(authToken) },
+                                            validateStatus: function () { return true; },
+                                        })];
+                                case 1:
+                                    res = _c.sent();
+                                    return [2 /*return*/, { status: res.status, data: res.data }];
+                                case 2:
+                                    err_3 = _c.sent();
+                                    return [2 /*return*/, { status: (_a = err_3 === null || err_3 === void 0 ? void 0 : err_3.response) === null || _a === void 0 ? void 0 : _a.status, data: (_b = err_3 === null || err_3 === void 0 ? void 0 : err_3.response) === null || _b === void 0 ? void 0 : _b.data }];
+                                case 3: return [2 /*return*/];
+                            }
+                        });
+                    }); };
+                    tokenFromURL = function (fullURL) { var _a; return (_a = /[?&]token=([^&]+)/.exec(fullURL !== null && fullURL !== void 0 ? fullURL : '')) === null || _a === void 0 ? void 0 : _a[1]; };
+                    patchAuthed = function (path, body, authToken) { return __awaiter(void 0, void 0, void 0, function () {
+                        var res, err_4;
+                        var _a, _b;
+                        return __generator(this, function (_c) {
+                            switch (_c.label) {
+                                case 0:
+                                    _c.trys.push([0, 2, , 3]);
+                                    return [4 /*yield*/, axios.patch("".concat(host).concat(path), body, {
+                                            headers: { Authorization: "Bearer ".concat(authToken) },
+                                            validateStatus: function () { return true; },
+                                        })];
+                                case 1:
+                                    res = _c.sent();
+                                    return [2 /*return*/, { status: res.status, data: res.data }];
+                                case 2:
+                                    err_4 = _c.sent();
+                                    return [2 /*return*/, { status: (_a = err_4 === null || err_4 === void 0 ? void 0 : err_4.response) === null || _a === void 0 ? void 0 : _a.status, data: (_b = err_4 === null || err_4 === void 0 ? void 0 : err_4.response) === null || _b === void 0 ? void 0 : _b.data }];
+                                case 3: return [2 /*return*/];
+                            }
+                        });
+                    }); };
+                    intakeAnswers = function (f, email, phone) { return ([
+                        { fieldId: f.emailField.id, fieldTitle: f.emailField.title, answer: { type: 'email', value: email } },
+                        { fieldId: f.phoneField.id, fieldTitle: f.phoneField.title, answer: { type: 'phone', value: phone } },
+                    ]); };
+                    pollEnduser = function (id, landed, windowMs) { return __awaiter(void 0, void 0, void 0, function () {
+                        var deadline, latest;
+                        return __generator(this, function (_a) {
+                            switch (_a.label) {
+                                case 0:
+                                    deadline = Date.now() + windowMs;
+                                    latest = null;
+                                    _a.label = 1;
+                                case 1:
+                                    if (!true) return [3 /*break*/, 4];
+                                    return [4 /*yield*/, sdk.api.endusers.getOne(id).catch(function () { return null; })];
+                                case 2:
+                                    latest = _a.sent();
+                                    if (latest && landed(latest))
+                                        return [2 /*return*/, { landed: true, enduser: latest }];
+                                    if (Date.now() >= deadline)
+                                        return [2 /*return*/, { landed: false, enduser: latest }];
+                                    return [4 /*yield*/, sleep(POLL_INTERVAL_MS)];
+                                case 3:
+                                    _a.sent();
+                                    return [3 /*break*/, 1];
+                                case 4: return [2 /*return*/];
+                            }
+                        });
+                    }); };
+                    describe = function (e) { return "email=".concat((e === null || e === void 0 ? void 0 : e.email) || '(unset)', " phone=").concat((e === null || e === void 0 ? void 0 : e.phone) || '(unset)'); };
+                    makeVictim = function (tag, fields) {
+                        if (fields === void 0) { fields = {}; }
+                        return __awaiter(void 0, void 0, void 0, function () {
+                            var victim;
+                            return __generator(this, function (_a) {
+                                switch (_a.label) {
+                                    case 0: return [4 /*yield*/, sdk.api.endusers.createOne(__assign({ fname: "Lock".concat(RUN), lname: "Victim".concat(RUN).concat(tag), dateOfBirth: '01-02-1990' }, fields))];
+                                    case 1:
+                                        victim = _a.sent();
+                                        createdEnduserIds.push(victim.id);
+                                        return [2 /*return*/, victim];
+                                }
+                            });
+                        });
+                    };
+                    VICTIM_SHAPES = [
+                        { tag: 'A1', label: 'victim has email + phone', withEmail: true, withPhone: true },
+                        { tag: 'A2', label: 'victim email UNSET (load-bearing)', withEmail: false, withPhone: true },
+                        { tag: 'A3', label: 'victim phone UNSET', withEmail: true, withPhone: false },
+                        { tag: 'A4', label: 'victim email + phone UNSET (load-bearing)', withEmail: false, withPhone: false },
+                    ];
+                    _loop_1 = function (shape) {
+                        var name_1;
+                        return __generator(this, function (_s) {
+                            switch (_s.label) {
+                                case 0:
+                                    name_1 = "A blocks email/phone overwrite \u2014 ".concat(shape.label);
+                                    return [4 /*yield*/, runScenario('G1', name_1, function () { return __awaiter(void 0, void 0, void 0, function () {
+                                            var victim, attackerEmail, attackerPhone, session, _a, landed, enduser;
+                                            return __generator(this, function (_b) {
+                                                switch (_b.label) {
+                                                    case 0: return [4 /*yield*/, makeVictim(shape.tag, __assign(__assign({}, (shape.withEmail ? { email: emailFor("lock-v-".concat(shape.tag)) } : {})), (shape.withPhone ? { phone: nextPhone() } : {})))];
+                                                    case 1:
+                                                        victim = _b.sent();
+                                                        attackerEmail = emailFor("atk-".concat(shape.tag));
+                                                        attackerPhone = nextPhone();
+                                                        return [4 /*yield*/, startForm({
+                                                                fname: victim.fname,
+                                                                lname: victim.lname,
+                                                                dateOfBirth: victim.dateOfBirth,
+                                                                email: attackerEmail,
+                                                                phone: attackerPhone,
+                                                            })
+                                                            // Probe-validity guard: if the handler INSERTED instead of matching, the victim is trivially
+                                                            // unchanged and the test would pass for the wrong reason.
+                                                        ];
+                                                    case 2:
+                                                        session = _b.sent();
+                                                        // Probe-validity guard: if the handler INSERTED instead of matching, the victim is trivially
+                                                        // unchanged and the test would pass for the wrong reason.
+                                                        if (session.enduserId !== victim.id) {
+                                                            if (session.enduserId)
+                                                                createdEnduserIds.push(session.enduserId);
+                                                            record('G1', name_1, false, "probe invalid \u2014 endpoint inserted ".concat(session.enduserId, " instead of matching victim ").concat(victim.id));
+                                                            return [2 /*return*/];
+                                                        }
+                                                        return [4 /*yield*/, pollEnduser(victim.id, function (e) { return e.email === attackerEmail || e.phone === attackerPhone; }, OVERWRITE_WINDOW_MS)];
+                                                    case 3:
+                                                        _a = _b.sent(), landed = _a.landed, enduser = _a.enduser;
+                                                        record('G1', name_1, !landed, landed
+                                                            ? "EXPLOIT: attacker values landed on victim (".concat(describe(enduser), ")")
+                                                            : "unchanged (".concat(describe(enduser), ")"));
+                                                        return [2 /*return*/];
+                                                }
+                                            });
+                                        }); })];
+                                case 1:
+                                    _s.sent();
+                                    return [2 /*return*/];
+                            }
+                        });
+                    };
+                    _i = 0, VICTIM_SHAPES_1 = VICTIM_SHAPES;
+                    _r.label = 14;
+                case 14:
+                    if (!(_i < VICTIM_SHAPES_1.length)) return [3 /*break*/, 17];
+                    shape = VICTIM_SHAPES_1[_i];
+                    return [5 /*yield**/, _loop_1(shape)];
+                case 15:
+                    _r.sent();
+                    _r.label = 16;
+                case 16:
+                    _i++;
+                    return [3 /*break*/, 14];
+                case 17:
+                    _loop_2 = function (shape) {
+                        var name_2;
+                        return __generator(this, function (_t) {
+                            switch (_t.label) {
+                                case 0:
+                                    name_2 = "B blocks email/phone overwrite \u2014 ".concat(shape.label);
+                                    return [4 /*yield*/, runScenario('G2', name_2, function () { return __awaiter(void 0, void 0, void 0, function () {
+                                            var victim, attackerEmail, attackerPhone, matching, _i, matching_1, m, _a, landed, enduser;
+                                            return __generator(this, function (_b) {
+                                                switch (_b.label) {
+                                                    case 0: return [4 /*yield*/, makeVictim("B".concat(shape.tag), __assign(__assign({}, (shape.withEmail ? { email: emailFor("lock-vb-".concat(shape.tag)) } : {})), (shape.withPhone ? { phone: nextPhone() } : {})))];
+                                                    case 1:
+                                                        victim = _b.sent();
+                                                        attackerEmail = emailFor("atkb-".concat(shape.tag));
+                                                        attackerPhone = nextPhone();
+                                                        return [4 /*yield*/, startBooking({
+                                                                fname: victim.fname,
+                                                                lname: victim.lname,
+                                                                dateOfBirth: victim.dateOfBirth,
+                                                                email: attackerEmail,
+                                                                phone: attackerPhone,
+                                                            })];
+                                                    case 2:
+                                                        _b.sent();
+                                                        return [4 /*yield*/, sdk.api.endusers.getSome({ filter: { lname: victim.lname } })];
+                                                    case 3:
+                                                        matching = _b.sent();
+                                                        if (matching.length !== 1 || matching[0].id !== victim.id) {
+                                                            for (_i = 0, matching_1 = matching; _i < matching_1.length; _i++) {
+                                                                m = matching_1[_i];
+                                                                if (m.id !== victim.id)
+                                                                    createdEnduserIds.push(m.id);
+                                                            }
+                                                            record('G2', name_2, false, "probe invalid \u2014 ".concat(matching.length, " records match lname ").concat(victim.lname, "; endpoint inserted instead of matching"));
+                                                            return [2 /*return*/];
+                                                        }
+                                                        return [4 /*yield*/, pollEnduser(victim.id, function (e) { return e.email === attackerEmail || e.phone === attackerPhone; }, AWAITED_WINDOW_MS)];
+                                                    case 4:
+                                                        _a = _b.sent(), landed = _a.landed, enduser = _a.enduser;
+                                                        record('G2', name_2, !landed, landed
+                                                            ? "EXPLOIT: attacker values landed on victim (".concat(describe(enduser), ")")
+                                                            : "unchanged (".concat(describe(enduser), ")"));
+                                                        return [2 /*return*/];
+                                                }
+                                            });
+                                        }); })];
+                                case 1:
+                                    _t.sent();
+                                    return [2 /*return*/];
+                            }
+                        });
+                    };
+                    _b = 0, VICTIM_SHAPES_2 = VICTIM_SHAPES;
+                    _r.label = 18;
+                case 18:
+                    if (!(_b < VICTIM_SHAPES_2.length)) return [3 /*break*/, 21];
+                    shape = VICTIM_SHAPES_2[_b];
+                    return [5 /*yield**/, _loop_2(shape)];
+                case 19:
+                    _r.sent();
+                    _r.label = 20;
+                case 20:
+                    _b++;
+                    return [3 /*break*/, 18];
+                case 21: 
+                // ---------------------------------------------------------------------------------------------
+                // G3 — Endpoint A with the raw enduserId parameter (findById, no ownership check). Not reachable
+                // as an attack through the first-party frontend, but trivially reachable by POSTing directly.
+                // The field lock must hold on this path too.
+                // ---------------------------------------------------------------------------------------------
+                return [4 /*yield*/, runScenario('G3', 'A blocks email/phone overwrite when victim targeted via enduserId', function () { return __awaiter(void 0, void 0, void 0, function () {
+                        var victim, attackerEmail, attackerPhone, session, _a, landed, enduser;
+                        return __generator(this, function (_b) {
+                            switch (_b.label) {
+                                case 0: return [4 /*yield*/, makeVictim('C1')]; // no email, no phone — the takeover-ready shape
+                                case 1:
+                                    victim = _b.sent() // no email, no phone — the takeover-ready shape
+                                    ;
+                                    attackerEmail = emailFor('atk-c1');
+                                    attackerPhone = nextPhone();
+                                    return [4 /*yield*/, startForm({ enduserId: victim.id, email: attackerEmail, phone: attackerPhone })];
+                                case 2:
+                                    session = _b.sent();
+                                    if (session.enduserId !== victim.id) {
+                                        if (session.enduserId)
+                                            createdEnduserIds.push(session.enduserId);
+                                        record('G3', 'A blocks email/phone overwrite when victim targeted via enduserId', false, "probe invalid \u2014 endpoint returned ".concat(session.enduserId, ", expected victim ").concat(victim.id));
+                                        return [2 /*return*/];
+                                    }
+                                    return [4 /*yield*/, pollEnduser(victim.id, function (e) { return e.email === attackerEmail || e.phone === attackerPhone; }, OVERWRITE_WINDOW_MS)];
+                                case 3:
+                                    _a = _b.sent(), landed = _a.landed, enduser = _a.enduser;
+                                    record('G3', 'A blocks email/phone overwrite when victim targeted via enduserId', !landed, landed
+                                        ? "EXPLOIT: attacker values landed on victim (".concat(describe(enduser), ")")
+                                        : "unchanged (".concat(describe(enduser), ")"));
+                                    return [2 /*return*/];
+                            }
+                        });
+                    }); })
+                    // ---------------------------------------------------------------------------------------------
+                    // G4 — The takeover chain itself.
+                    //
+                    // access_tokens is not readable from a test (written via getInternalQueries(), no schema entry,
+                    // no SDK surface) and request-enduser-password-reset returns 204 unconditionally — success,
+                    // no-match and throttled alike — so it carries zero signal. Two sound substitutes:
+                    //   1. endusers.getSome({ filter: { email: attackerEmail } }) is empty. That is the exact
+                    //      predicate the handler gates on (findOne({ email }); if (!enduser) return 204) before
+                    //      minting anything, so an empty set proves non-issuance.
+                    //   2. begin-enduser-login-flow with the attacker email still returns continue-with-password.
+                    //      On a vulnerable server the now-email-bearing, password-less victim flips this to
+                    //      sent-email/sent-sms and an OTP is genuinely dispatched to the attacker.
+                    // Rate-limit budget: begin_login_flow is 5 / 10 min per identifier and 10 / 60s per IP. Exactly
+                    // two calls are made, on the same run-unique identifier. A 429 is recorded as SKIP, not a
+                    // failure (reset_db is deliberately NOT called here — it would wipe other suites' fixtures when
+                    // this file runs as part of tests.ts).
+                    // ---------------------------------------------------------------------------------------------
+                ];
+                case 22:
+                    // ---------------------------------------------------------------------------------------------
+                    // G3 — Endpoint A with the raw enduserId parameter (findById, no ownership check). Not reachable
+                    // as an attack through the first-party frontend, but trivially reachable by POSTing directly.
+                    // The field lock must hold on this path too.
+                    // ---------------------------------------------------------------------------------------------
+                    _r.sent();
+                    // ---------------------------------------------------------------------------------------------
+                    // G4 — The takeover chain itself.
+                    //
+                    // access_tokens is not readable from a test (written via getInternalQueries(), no schema entry,
+                    // no SDK surface) and request-enduser-password-reset returns 204 unconditionally — success,
+                    // no-match and throttled alike — so it carries zero signal. Two sound substitutes:
+                    //   1. endusers.getSome({ filter: { email: attackerEmail } }) is empty. That is the exact
+                    //      predicate the handler gates on (findOne({ email }); if (!enduser) return 204) before
+                    //      minting anything, so an empty set proves non-issuance.
+                    //   2. begin-enduser-login-flow with the attacker email still returns continue-with-password.
+                    //      On a vulnerable server the now-email-bearing, password-less victim flips this to
+                    //      sent-email/sent-sms and an OTP is genuinely dispatched to the attacker.
+                    // Rate-limit budget: begin_login_flow is 5 / 10 min per identifier and 10 / 60s per IP. Exactly
+                    // two calls are made, on the same run-unique identifier. A 429 is recorded as SKIP, not a
+                    // failure (reset_db is deliberately NOT called here — it would wipe other suites' fixtures when
+                    // this file runs as part of tests.ts).
+                    // ---------------------------------------------------------------------------------------------
+                    return [4 /*yield*/, runScenario('G4', 'takeover chain: email-less victim is not made resolvable by A', function () { return __awaiter(void 0, void 0, void 0, function () {
+                            var victim, attackerEmail, baseline, baselineResult, session, enduser, resetRes, resolvable, after, afterResult;
+                            var _a, _b;
+                            return __generator(this, function (_c) {
+                                switch (_c.label) {
+                                    case 0: return [4 /*yield*/, makeVictim('D1', { phone: nextPhone() })]; // email-less: the common, cheap case
+                                    case 1:
+                                        victim = _c.sent() // email-less: the common, cheap case
+                                        ;
+                                        attackerEmail = emailFor('atk-d1');
+                                        return [4 /*yield*/, post('/v1/begin-enduser-login-flow', { email: attackerEmail, businessId: businessId })];
+                                    case 2:
+                                        baseline = _c.sent();
+                                        baselineResult = (_a = baseline.data) === null || _a === void 0 ? void 0 : _a.result;
+                                        if (baseline.status === 429) {
+                                            skip('G4', 'begin_login_flow oracle baseline', 'rate limited (429) — oracle unavailable this run');
+                                        }
+                                        else {
+                                            record('G4', 'begin_login_flow oracle baseline is continue-with-password', baselineResult === 'continue-with-password', "result=".concat(baselineResult, " status=").concat(baseline.status));
+                                        }
+                                        return [4 /*yield*/, startForm({
+                                                fname: victim.fname,
+                                                lname: victim.lname,
+                                                dateOfBirth: victim.dateOfBirth,
+                                                email: attackerEmail,
+                                                phone: nextPhone(),
+                                            })];
+                                    case 3:
+                                        session = _c.sent();
+                                        if (session.enduserId !== victim.id) {
+                                            if (session.enduserId)
+                                                createdEnduserIds.push(session.enduserId);
+                                            record('G4', 'takeover chain: email-less victim is not made resolvable by A', false, "probe invalid \u2014 endpoint inserted ".concat(session.enduserId, " instead of matching victim ").concat(victim.id));
+                                            return [2 /*return*/];
+                                        }
+                                        return [4 /*yield*/, pollEnduser(victim.id, function (e) { return e.email === attackerEmail; }, OVERWRITE_WINDOW_MS)
+                                            // Informational only: 204 regardless of outcome.
+                                        ];
+                                    case 4:
+                                        enduser = (_c.sent()).enduser;
+                                        return [4 /*yield*/, post('/v1/request-enduser-password-reset', { email: attackerEmail, businessId: businessId })];
+                                    case 5:
+                                        resetRes = _c.sent();
+                                        console.log("   (info) request-enduser-password-reset -> HTTP ".concat(resetRes.status, " \u2014 unconditional, carries no signal"));
+                                        return [4 /*yield*/, sdk.api.endusers.getSome({ filter: { email: attackerEmail } })];
+                                    case 6:
+                                        resolvable = _c.sent();
+                                        record('G4', 'attacker email resolves to no enduser (password reset cannot be issued)', resolvable.length === 0, resolvable.length === 0
+                                            ? "no enduser carries ".concat(attackerEmail, " (victim still ").concat(describe(enduser), ")")
+                                            : "EXPLOIT: ".concat(resolvable.length, " enduser(s) now resolve for ").concat(attackerEmail, " \u2014 reset token would be minted and mailed to the attacker"));
+                                        return [4 /*yield*/, post('/v1/begin-enduser-login-flow', { email: attackerEmail, businessId: businessId })];
+                                    case 7:
+                                        after = _c.sent();
+                                        afterResult = (_b = after.data) === null || _b === void 0 ? void 0 : _b.result;
+                                        if (after.status === 429) {
+                                            skip('G4', 'begin_login_flow oracle after attack', 'rate limited (429) — oracle unavailable this run');
+                                        }
+                                        else {
+                                            record('G4', 'begin_login_flow still returns continue-with-password after attack', afterResult === 'continue-with-password', afterResult === 'continue-with-password'
+                                                ? "result=".concat(afterResult)
+                                                : "EXPLOIT: result=".concat(afterResult, " \u2014 an OTP / magic link was dispatched for the attacker's address"));
+                                        }
+                                        return [2 /*return*/];
+                                }
+                            });
+                        }); })
+                        // ---------------------------------------------------------------------------------------------
+                        // G5 — Intended intake behavior preserved: blank match keys still get filled, blank phone does not.
+                        // ---------------------------------------------------------------------------------------------
+                    ];
+                case 23:
+                    // ---------------------------------------------------------------------------------------------
+                    // G4 — The takeover chain itself.
+                    //
+                    // access_tokens is not readable from a test (written via getInternalQueries(), no schema entry,
+                    // no SDK surface) and request-enduser-password-reset returns 204 unconditionally — success,
+                    // no-match and throttled alike — so it carries zero signal. Two sound substitutes:
+                    //   1. endusers.getSome({ filter: { email: attackerEmail } }) is empty. That is the exact
+                    //      predicate the handler gates on (findOne({ email }); if (!enduser) return 204) before
+                    //      minting anything, so an empty set proves non-issuance.
+                    //   2. begin-enduser-login-flow with the attacker email still returns continue-with-password.
+                    //      On a vulnerable server the now-email-bearing, password-less victim flips this to
+                    //      sent-email/sent-sms and an OTP is genuinely dispatched to the attacker.
+                    // Rate-limit budget: begin_login_flow is 5 / 10 min per identifier and 10 / 60s per IP. Exactly
+                    // two calls are made, on the same run-unique identifier. A 429 is recorded as SKIP, not a
+                    // failure (reset_db is deliberately NOT called here — it would wipe other suites' fixtures when
+                    // this file runs as part of tests.ts).
+                    // ---------------------------------------------------------------------------------------------
+                    _r.sent();
+                    // ---------------------------------------------------------------------------------------------
+                    // G5 — Intended intake behavior preserved: blank match keys still get filled, blank phone does not.
+                    // ---------------------------------------------------------------------------------------------
+                    return [4 /*yield*/, runScenario('G5', 'blank match keys filled on match, blank phone NOT filled', function () { return __awaiter(void 0, void 0, void 0, function () {
+                            var victimEmail, victim, submittedPhone, session, filled, phoneLanded;
+                            var _a, _b, _c, _d, _e;
+                            return __generator(this, function (_f) {
+                                switch (_f.label) {
+                                    case 0:
+                                        victimEmail = emailFor('lock-v-e1');
+                                        return [4 /*yield*/, sdk.api.endusers.createOne(__assign({ email: victimEmail }, (MATCH_EMAIL_AND_NAMES ? { fname: "Lock".concat(RUN), lname: "Victim".concat(RUN, "E1") } : {})))];
+                                    case 1:
+                                        victim = _f.sent();
+                                        createdEnduserIds.push(victim.id);
+                                        if (MATCH_EMAIL_AND_NAMES) {
+                                            skip('G5', 'blank fname/lname fill', 'organization has settings.endusers.matchEmailAndNames — a name-less record is unmatchable');
+                                        }
+                                        submittedPhone = nextPhone();
+                                        return [4 /*yield*/, startForm({
+                                                email: victimEmail,
+                                                fname: "Lock".concat(RUN),
+                                                lname: "Victim".concat(RUN, "E1"),
+                                                dateOfBirth: '03-04-1991',
+                                                gender: 'Female',
+                                                phone: submittedPhone,
+                                            })];
+                                    case 2:
+                                        session = _f.sent();
+                                        if (session.enduserId !== victim.id) {
+                                            if (session.enduserId)
+                                                createdEnduserIds.push(session.enduserId);
+                                            record('G5', 'blank match keys filled on match, blank phone NOT filled', false, "probe invalid \u2014 endpoint inserted ".concat(session.enduserId, " instead of matching victim ").concat(victim.id));
+                                            return [2 /*return*/];
+                                        }
+                                        return [4 /*yield*/, pollEnduser(victim.id, function (e) { return !!e.dateOfBirth && !!e.gender && (MATCH_EMAIL_AND_NAMES || (!!e.fname && !!e.lname)); }, OVERWRITE_WINDOW_MS)];
+                                    case 3:
+                                        filled = _f.sent();
+                                        record('G5', 'blank fname/lname/dateOfBirth/gender still filled on match', filled.landed, "fname=".concat(((_a = filled.enduser) === null || _a === void 0 ? void 0 : _a.fname) || '(unset)', " lname=").concat(((_b = filled.enduser) === null || _b === void 0 ? void 0 : _b.lname) || '(unset)', " ")
+                                            + "dateOfBirth=".concat(((_c = filled.enduser) === null || _c === void 0 ? void 0 : _c.dateOfBirth) || '(unset)', " gender=").concat(((_d = filled.enduser) === null || _d === void 0 ? void 0 : _d.gender) || '(unset)'));
+                                        return [4 /*yield*/, pollEnduser(victim.id, function (e) { return !!e.phone; }, AWAITED_WINDOW_MS)];
+                                    case 4:
+                                        phoneLanded = _f.sent();
+                                        record('G5', 'blank phone still NOT filled on match', !phoneLanded.landed, phoneLanded.landed
+                                            ? "EXPLOIT: phone=".concat((_e = phoneLanded.enduser) === null || _e === void 0 ? void 0 : _e.phone, " written into a blank field (submitted ").concat(submittedPhone, ")")
+                                            : 'phone remains unset');
+                                        return [2 /*return*/];
+                                }
+                            });
+                        }); })
+                        // ---------------------------------------------------------------------------------------------
+                        // G6 — Status-quo pin: state still overwrites on match. This is deliberate, not incidental —
+                        // state is not an auth channel, and locking it would break a relocated patient booking with a
+                        // provider licensed in their new state.
+                        // ---------------------------------------------------------------------------------------------
+                    ];
+                case 24:
+                    // ---------------------------------------------------------------------------------------------
+                    // G5 — Intended intake behavior preserved: blank match keys still get filled, blank phone does not.
+                    // ---------------------------------------------------------------------------------------------
+                    _r.sent();
+                    // ---------------------------------------------------------------------------------------------
+                    // G6 — Status-quo pin: state still overwrites on match. This is deliberate, not incidental —
+                    // state is not an auth channel, and locking it would break a relocated patient booking with a
+                    // provider licensed in their new state.
+                    // ---------------------------------------------------------------------------------------------
+                    return [4 /*yield*/, runScenario('G6', 'state still overwrites on match (status-quo pin)', function () { return __awaiter(void 0, void 0, void 0, function () {
+                            var victim, session, _a, landed, enduser;
+                            return __generator(this, function (_b) {
+                                switch (_b.label) {
+                                    case 0: return [4 /*yield*/, makeVictim('F1', { email: emailFor('lock-v-f1'), state: 'NY' })];
+                                    case 1:
+                                        victim = _b.sent();
+                                        return [4 /*yield*/, startForm({
+                                                fname: victim.fname,
+                                                lname: victim.lname,
+                                                dateOfBirth: victim.dateOfBirth,
+                                                phone: nextPhone(),
+                                                state: 'CA',
+                                            })];
+                                    case 2:
+                                        session = _b.sent();
+                                        if (session.enduserId !== victim.id) {
+                                            if (session.enduserId)
+                                                createdEnduserIds.push(session.enduserId);
+                                            record('G6', 'state still overwrites on match (status-quo pin)', false, "probe invalid \u2014 endpoint inserted ".concat(session.enduserId, " instead of matching victim ").concat(victim.id));
+                                            return [2 /*return*/];
+                                        }
+                                        return [4 /*yield*/, pollEnduser(victim.id, function (e) { return e.state === 'CA'; }, OVERWRITE_WINDOW_MS)];
+                                    case 3:
+                                        _a = _b.sent(), landed = _a.landed, enduser = _a.enduser;
+                                        record('G6', 'state still overwrites on match (status-quo pin)', landed, "state=".concat((enduser === null || enduser === void 0 ? void 0 : enduser.state) || '(unset)'));
+                                        return [2 /*return*/];
+                                }
+                            });
+                        }); })
+                        // ---------------------------------------------------------------------------------------------
+                        // G7 — Insert path unchanged: a brand-new visitor is still created with the submitted email/phone.
+                        // ---------------------------------------------------------------------------------------------
+                        // Accumulator arrays rather than `let ... | null`: values are assigned inside runScenario's
+                        // callback, and TS's control-flow narrowing does not account for closure assignments.
+                    ];
+                case 25:
+                    // ---------------------------------------------------------------------------------------------
+                    // G6 — Status-quo pin: state still overwrites on match. This is deliberate, not incidental —
+                    // state is not an auth channel, and locking it would break a relocated patient booking with a
+                    // provider licensed in their new state.
+                    // ---------------------------------------------------------------------------------------------
+                    _r.sent();
+                    formSessions = [];
+                    return [4 /*yield*/, runScenario('G7', 'A creates a new visitor with submitted email + phone', function () { return __awaiter(void 0, void 0, void 0, function () {
+                            var email, phone, session, created, ok;
+                            return __generator(this, function (_a) {
+                                switch (_a.label) {
+                                    case 0:
+                                        email = emailFor('lock-new-a');
+                                        phone = nextPhone();
+                                        return [4 /*yield*/, startForm({
+                                                fname: "Lock".concat(RUN), lname: "NewA".concat(RUN), dateOfBirth: '05-06-1992',
+                                                email: email,
+                                                phone: phone,
+                                            })];
+                                    case 1:
+                                        session = _a.sent();
+                                        if (session.enduserId)
+                                            createdEnduserIds.push(session.enduserId);
+                                        return [4 /*yield*/, sdk.api.endusers.getOne(session.enduserId)];
+                                    case 2:
+                                        created = _a.sent();
+                                        ok = created.email === email && created.phone === phone
+                                            && !!session.accessCode && !!session.authToken && !!session.enduserId;
+                                        record('G7', 'A creates a new visitor with submitted email + phone', ok, "".concat(describe(created), "; accessCode=").concat(!!session.accessCode, " authToken=").concat(!!session.authToken, " enduserId=").concat(!!session.enduserId));
+                                        if (ok)
+                                            formSessions.push(session);
+                                        return [2 /*return*/];
+                                }
+                            });
+                        }); })];
+                case 26:
+                    _r.sent();
+                    bookingTokens = [];
+                    return [4 /*yield*/, runScenario('G7', 'B creates a new visitor with submitted email + phone', function () { return __awaiter(void 0, void 0, void 0, function () {
+                            var email, phone, lname, session, matching, _i, matching_2, m, created, ok;
+                            return __generator(this, function (_a) {
+                                switch (_a.label) {
+                                    case 0:
+                                        email = emailFor('lock-new-b');
+                                        phone = nextPhone();
+                                        lname = "NewB".concat(RUN);
+                                        return [4 /*yield*/, startBooking({
+                                                fname: "Lock".concat(RUN),
+                                                lname: lname,
+                                                dateOfBirth: '07-08-1993',
+                                                email: email,
+                                                phone: phone,
+                                            })];
+                                    case 1:
+                                        session = _a.sent();
+                                        return [4 /*yield*/, sdk.api.endusers.getSome({ filter: { lname: lname } })];
+                                    case 2:
+                                        matching = _a.sent();
+                                        for (_i = 0, matching_2 = matching; _i < matching_2.length; _i++) {
+                                            m = matching_2[_i];
+                                            createdEnduserIds.push(m.id);
+                                        }
+                                        created = matching.length === 1 ? matching[0] : null;
+                                        ok = !!session.authToken && !!created && created.email === email && created.phone === phone;
+                                        record('G7', 'B creates a new visitor with submitted email + phone', ok, "authToken=".concat(!!session.authToken, "; ").concat(matching.length, " record(s); ").concat(describe(created)));
+                                        if (session.authToken)
+                                            bookingTokens.push(session.authToken);
+                                        return [2 /*return*/];
+                                }
+                            });
+                        }); })
+                        // ---------------------------------------------------------------------------------------------
+                        // G8 — The returned public-form session still works end-to-end.
+                        // ---------------------------------------------------------------------------------------------
+                    ];
+                case 27:
+                    _r.sent();
+                    // ---------------------------------------------------------------------------------------------
+                    // G8 — The returned public-form session still works end-to-end.
+                    // ---------------------------------------------------------------------------------------------
+                    return [4 /*yield*/, runScenario('G8', 'form submission completes under the returned token', function () { return __awaiter(void 0, void 0, void 0, function () {
+                            var session, authed, formResponse;
+                            return __generator(this, function (_a) {
+                                switch (_a.label) {
+                                    case 0:
+                                        session = formSessions[0];
+                                        if (!session) {
+                                            record('G8', 'form submission completes under the returned token', false, 'no session available from G7');
+                                            return [2 /*return*/];
+                                        }
+                                        authed = new EnduserSession({ host: host, businessId: businessId, authToken: session.authToken });
+                                        return [4 /*yield*/, authed.api.form_responses.submit_form_response({
+                                                accessCode: session.accessCode,
+                                                responses: [{
+                                                        fieldId: plainField.id,
+                                                        fieldTitle: plainField.title,
+                                                        answer: { type: 'string', value: "lock test ".concat(RUN) },
+                                                    }],
+                                            })];
+                                    case 1:
+                                        formResponse = (_a.sent()).formResponse;
+                                        record('G8', 'form submission completes under the returned token', !!(formResponse === null || formResponse === void 0 ? void 0 : formResponse.submittedAt), "formResponse=".concat(formResponse === null || formResponse === void 0 ? void 0 : formResponse.id, " submittedAt=").concat((formResponse === null || formResponse === void 0 ? void 0 : formResponse.submittedAt) ? 'set' : '(unset)'));
+                                        return [2 /*return*/];
+                                }
+                            });
+                        }); })
+                        // ---------------------------------------------------------------------------------------------
+                        // G9 — The returned booking session still works. Tiered: availability is always asserted; an
+                        // actual booking is attempted only when a slot exists, so an empty window never reads as a
+                        // regression.
+                        // ---------------------------------------------------------------------------------------------
+                    ];
+                case 28:
+                    // ---------------------------------------------------------------------------------------------
+                    // G8 — The returned public-form session still works end-to-end.
+                    // ---------------------------------------------------------------------------------------------
+                    _r.sent();
+                    // ---------------------------------------------------------------------------------------------
+                    // G9 — The returned booking session still works. Tiered: availability is always asserted; an
+                    // actual booking is attempted only when a slot exists, so an empty window never reads as a
+                    // regression.
+                    // ---------------------------------------------------------------------------------------------
+                    return [4 /*yield*/, runScenario('G9', 'availability + booking work under the returned session', function () { return __awaiter(void 0, void 0, void 0, function () {
+                            var bookingAuthToken, booking, DAY_IN_MS, from, to, availabilityBlocks, slots, createdEvent;
+                            return __generator(this, function (_a) {
+                                switch (_a.label) {
+                                    case 0:
+                                        bookingAuthToken = bookingTokens[0];
+                                        if (!bookingAuthToken) {
+                                            record('G9', 'availability + booking work under the returned session', false, 'no booking session available from G7');
+                                            return [2 /*return*/];
+                                        }
+                                        booking = new EnduserSession({ host: host, businessId: businessId, authToken: bookingAuthToken });
+                                        DAY_IN_MS = 24 * 60 * 60 * 1000;
+                                        from = new Date(Date.now() + DAY_IN_MS);
+                                        to = new Date(from.getTime() + (7 * DAY_IN_MS));
+                                        return [4 /*yield*/, booking.api.calendar_events.get_appointment_availability({
+                                                calendarEventTemplateId: template.id,
+                                                userIds: [hostUser.id],
+                                                restrictedByState: false,
+                                                from: from,
+                                                to: to,
+                                            })];
+                                    case 1:
+                                        availabilityBlocks = (_a.sent()).availabilityBlocks;
+                                        slots = availabilityBlocks.filter(function (b) { return b.userId === hostUser.id && b.startTimeInMS > Date.now(); });
+                                        record('G9', 'get_appointment_availability succeeds under the confined booking token', true, "".concat(availabilityBlocks.length, " block(s), ").concat(slots.length, " future slot(s) for the throwaway host"));
+                                        if (slots.length === 0) {
+                                            skip('G9', 'book_appointment under the confined booking token', 'no future availability slot in the 7-day window');
+                                            return [2 /*return*/];
+                                        }
+                                        return [4 /*yield*/, booking.api.calendar_events.book_appointment({
+                                                userId: hostUser.id,
+                                                calendarEventTemplateId: template.id,
+                                                startTime: new Date(slots[0].startTimeInMS),
+                                                timezone: 'America/New_York',
+                                            })];
+                                    case 2:
+                                        createdEvent = (_a.sent()).createdEvent;
+                                        if (createdEvent === null || createdEvent === void 0 ? void 0 : createdEvent.id)
+                                            createdEventIds.push(createdEvent.id);
+                                        record('G9', 'book_appointment succeeds under the confined booking token', !!(createdEvent === null || createdEvent === void 0 ? void 0 : createdEvent.id), "createdEvent=".concat(createdEvent === null || createdEvent === void 0 ? void 0 : createdEvent.id));
+                                        return [2 /*return*/];
+                                }
+                            });
+                        }); })
+                        // ---------------------------------------------------------------------------------------------
+                        // G10 — skipMatch behavior unchanged.
+                        // ---------------------------------------------------------------------------------------------
+                    ];
+                case 29:
+                    // ---------------------------------------------------------------------------------------------
+                    // G9 — The returned booking session still works. Tiered: availability is always asserted; an
+                    // actual booking is attempted only when a slot exists, so an empty window never reads as a
+                    // regression.
+                    // ---------------------------------------------------------------------------------------------
+                    _r.sent();
+                    // ---------------------------------------------------------------------------------------------
+                    // G10 — skipMatch behavior unchanged.
+                    // ---------------------------------------------------------------------------------------------
+                    return [4 /*yield*/, runScenario('G10', 'skipMatch=true still inserts a new record', function () { return __awaiter(void 0, void 0, void 0, function () {
+                            var victim, session;
+                            return __generator(this, function (_a) {
+                                switch (_a.label) {
+                                    case 0: return [4 /*yield*/, makeVictim('H1', { email: emailFor('lock-v-h1'), phone: nextPhone() })];
+                                    case 1:
+                                        victim = _a.sent();
+                                        return [4 /*yield*/, startForm({
+                                                fname: victim.fname,
+                                                lname: victim.lname,
+                                                dateOfBirth: victim.dateOfBirth,
+                                                email: emailFor('lock-skip'),
+                                                phone: nextPhone(),
+                                                skipMatch: true,
+                                            })];
+                                    case 2:
+                                        session = _a.sent();
+                                        if (session.enduserId)
+                                            createdEnduserIds.push(session.enduserId);
+                                        record('G10', 'skipMatch=true still inserts a new record', session.enduserId !== victim.id, "inserted=".concat(session.enduserId, " victim=").concat(victim.id));
+                                        return [2 /*return*/];
+                                }
+                            });
+                        }); })];
+                case 30:
+                    // ---------------------------------------------------------------------------------------------
+                    // G10 — skipMatch behavior unchanged.
+                    // ---------------------------------------------------------------------------------------------
+                    _r.sent();
+                    return [4 /*yield*/, runScenario('G10', 'skipMatch + autoMergeOnSubmission sets eligibleForAutoMerge', function () { return __awaiter(void 0, void 0, void 0, function () {
+                            var session, created;
+                            return __generator(this, function (_a) {
+                                switch (_a.label) {
+                                    case 0: return [4 /*yield*/, publicSDK().api.form_responses.session_for_public_form({
+                                            formId: autoMergeForm.id,
+                                            businessId: businessId,
+                                            skipMatch: true,
+                                            fname: "Lock".concat(RUN),
+                                            lname: "Merge".concat(RUN),
+                                            dateOfBirth: '09-10-1994',
+                                            email: emailFor('lock-merge'),
+                                            phone: nextPhone(),
+                                        })];
+                                    case 1:
+                                        session = _a.sent();
+                                        if (session.enduserId)
+                                            createdEnduserIds.push(session.enduserId);
+                                        return [4 /*yield*/, sdk.api.endusers.getOne(session.enduserId)];
+                                    case 2:
+                                        created = _a.sent();
+                                        record('G10', 'skipMatch + autoMergeOnSubmission sets eligibleForAutoMerge', created.eligibleForAutoMerge === true, "eligibleForAutoMerge=".concat(created.eligibleForAutoMerge));
+                                        return [2 /*return*/];
+                                }
+                            });
+                        }); })
+                        // ---------------------------------------------------------------------------------------------
+                        // G11 — Intake answers must not overwrite email/phone on a matched patient (submit path).
+                        // ---------------------------------------------------------------------------------------------
+                    ];
+                case 31:
+                    _r.sent();
+                    _loop_3 = function (shape) {
+                        var name_3;
+                        return __generator(this, function (_u) {
+                            switch (_u.label) {
+                                case 0:
+                                    name_3 = "intake answers do not overwrite a matched patient \u2014 ".concat(shape.label);
+                                    return [4 /*yield*/, runScenario('G11', name_3, function () { return __awaiter(void 0, void 0, void 0, function () {
+                                            var victimEmail, victimPhone, victim, attackerEmail, attackerPhone, session, enduser, emailHeld, phoneHeld;
+                                            return __generator(this, function (_a) {
+                                                switch (_a.label) {
+                                                    case 0:
+                                                        victimEmail = shape.withEmail ? emailFor("lock-i-".concat(shape.tag)) : undefined;
+                                                        victimPhone = shape.withPhone ? nextPhone() : undefined;
+                                                        return [4 /*yield*/, makeVictim("I".concat(shape.tag), __assign(__assign({}, (victimEmail ? { email: victimEmail } : {})), (victimPhone ? { phone: victimPhone } : {})))];
+                                                    case 1:
+                                                        victim = _a.sent();
+                                                        attackerEmail = emailFor("atk-i-".concat(shape.tag));
+                                                        attackerPhone = nextPhone();
+                                                        return [4 /*yield*/, startFormOn(intake.form.id, {
+                                                                fname: victim.fname, lname: victim.lname, dateOfBirth: victim.dateOfBirth,
+                                                            })];
+                                                    case 2:
+                                                        session = _a.sent();
+                                                        if (session.enduserId)
+                                                            createdEnduserIds.push(session.enduserId);
+                                                        if (session.enduserId !== victim.id) {
+                                                            record('G11', name_3, false, "probe invalid \u2014 endpoint inserted ".concat(session.enduserId, " instead of matching victim ").concat(victim.id));
+                                                            return [2 /*return*/];
+                                                        }
+                                                        return [4 /*yield*/, asEnduser(session.authToken).api.form_responses.submit_form_response({
+                                                                accessCode: session.accessCode,
+                                                                responses: intakeAnswers(intake, attackerEmail, attackerPhone),
+                                                            })];
+                                                    case 3:
+                                                        _a.sent();
+                                                        return [4 /*yield*/, pollEnduser(victim.id, function (e) { return e.email === attackerEmail || e.phone === attackerPhone; }, OVERWRITE_WINDOW_MS)];
+                                                    case 4:
+                                                        enduser = (_a.sent()).enduser;
+                                                        emailHeld = ((enduser === null || enduser === void 0 ? void 0 : enduser.email) || undefined) === victimEmail;
+                                                        phoneHeld = ((enduser === null || enduser === void 0 ? void 0 : enduser.phone) || undefined) === victimPhone;
+                                                        record('G11', "".concat(name_3, " \u2014 email"), emailHeld, emailHeld
+                                                            ? "email still ".concat(victimEmail || '(unset)')
+                                                            : "EXPLOIT: intake answer wrote ".concat(enduser === null || enduser === void 0 ? void 0 : enduser.email, " (was ").concat(victimEmail || '(unset)', ")"));
+                                                        record('G11', "".concat(name_3, " \u2014 phone"), phoneHeld, phoneHeld
+                                                            ? "phone still ".concat(victimPhone || '(unset)')
+                                                            : "EXPLOIT: intake answer wrote ".concat(enduser === null || enduser === void 0 ? void 0 : enduser.phone, " (was ").concat(victimPhone || '(unset)', ")"));
+                                                        return [2 /*return*/];
+                                                }
+                                            });
+                                        }); })];
+                                case 1:
+                                    _u.sent();
+                                    return [2 /*return*/];
+                            }
+                        });
+                    };
+                    _c = 0, VICTIM_SHAPES_3 = VICTIM_SHAPES;
+                    _r.label = 32;
+                case 32:
+                    if (!(_c < VICTIM_SHAPES_3.length)) return [3 /*break*/, 35];
+                    shape = VICTIM_SHAPES_3[_c];
+                    return [5 /*yield**/, _loop_3(shape)];
+                case 33:
+                    _r.sent();
+                    _r.label = 34;
+                case 34:
+                    _c++;
+                    return [3 /*break*/, 32];
+                case 35:
+                    G12_NAME = 'saveIntakeOnPartial answers do not overwrite a matched patient';
+                    return [4 /*yield*/, runScenario('G12', G12_NAME, function () { return __awaiter(void 0, void 0, void 0, function () {
+                            var victim, attackerEmail, session, enduser;
+                            return __generator(this, function (_a) {
+                                switch (_a.label) {
+                                    case 0: return [4 /*yield*/, makeVictim('J1', { phone: nextPhone() })]; // email-less: the load-bearing shape
+                                    case 1:
+                                        victim = _a.sent() // email-less: the load-bearing shape
+                                        ;
+                                        attackerEmail = emailFor('atk-j1');
+                                        return [4 /*yield*/, startFormOn(partialIntake.form.id, {
+                                                fname: victim.fname, lname: victim.lname, dateOfBirth: victim.dateOfBirth,
+                                            })];
+                                    case 2:
+                                        session = _a.sent();
+                                        if (session.enduserId)
+                                            createdEnduserIds.push(session.enduserId);
+                                        if (session.enduserId !== victim.id) {
+                                            record('G12', G12_NAME, false, "probe invalid \u2014 endpoint inserted ".concat(session.enduserId, " instead of matching victim ").concat(victim.id));
+                                            return [2 /*return*/];
+                                        }
+                                        // No submit at all: for fields carrying options.saveIntakeOnPartial, save_field_response alone
+                                        // triggers the intake write.
+                                        return [4 /*yield*/, asEnduser(session.authToken).api.form_responses.save_field_response({
+                                                accessCode: session.accessCode,
+                                                response: {
+                                                    fieldId: partialIntake.emailField.id,
+                                                    fieldTitle: partialIntake.emailField.title,
+                                                    answer: { type: 'email', value: attackerEmail },
+                                                },
+                                            })];
+                                    case 3:
+                                        // No submit at all: for fields carrying options.saveIntakeOnPartial, save_field_response alone
+                                        // triggers the intake write.
+                                        _a.sent();
+                                        return [4 /*yield*/, pollEnduser(victim.id, function (e) { return e.email === attackerEmail; }, OVERWRITE_WINDOW_MS)];
+                                    case 4:
+                                        enduser = (_a.sent()).enduser;
+                                        record('G12', G12_NAME, !(enduser === null || enduser === void 0 ? void 0 : enduser.email), !(enduser === null || enduser === void 0 ? void 0 : enduser.email)
+                                            ? 'email still (unset) after partial save'
+                                            : "EXPLOIT: partial save wrote ".concat(enduser === null || enduser === void 0 ? void 0 : enduser.email, " without ever submitting the form"));
+                                        return [2 /*return*/];
+                                }
+                            });
+                        }); })
+                        // ---------------------------------------------------------------------------------------------
+                        // G13 — The full takeover chain, driven through an intake answer instead of the endpoint.
+                        // ---------------------------------------------------------------------------------------------
+                    ];
+                case 36:
+                    _r.sent();
+                    G13_NAME = 'takeover chain via intake answer: victim not made resolvable';
+                    return [4 /*yield*/, runScenario('G13', G13_NAME, function () { return __awaiter(void 0, void 0, void 0, function () {
+                            var victim, attackerEmail, session, enduser, resetRes, resolvable, after, afterResult;
+                            var _a;
+                            return __generator(this, function (_b) {
+                                switch (_b.label) {
+                                    case 0: return [4 /*yield*/, makeVictim('K1', { phone: nextPhone() })];
+                                    case 1:
+                                        victim = _b.sent();
+                                        attackerEmail = emailFor('atk-k1');
+                                        return [4 /*yield*/, startFormOn(intake.form.id, {
+                                                fname: victim.fname, lname: victim.lname, dateOfBirth: victim.dateOfBirth,
+                                            })];
+                                    case 2:
+                                        session = _b.sent();
+                                        if (session.enduserId)
+                                            createdEnduserIds.push(session.enduserId);
+                                        if (session.enduserId !== victim.id) {
+                                            record('G13', G13_NAME, false, "probe invalid \u2014 endpoint inserted ".concat(session.enduserId, " instead of matching victim ").concat(victim.id));
+                                            return [2 /*return*/];
+                                        }
+                                        return [4 /*yield*/, asEnduser(session.authToken).api.form_responses.submit_form_response({
+                                                accessCode: session.accessCode,
+                                                responses: intakeAnswers(intake, attackerEmail, nextPhone()),
+                                            })];
+                                    case 3:
+                                        _b.sent();
+                                        return [4 /*yield*/, pollEnduser(victim.id, function (e) { return e.email === attackerEmail; }, OVERWRITE_WINDOW_MS)
+                                            // Informational only: 204 regardless of outcome.
+                                        ];
+                                    case 4:
+                                        enduser = (_b.sent()).enduser;
+                                        return [4 /*yield*/, post('/v1/request-enduser-password-reset', { email: attackerEmail, businessId: businessId })];
+                                    case 5:
+                                        resetRes = _b.sent();
+                                        console.log("   (info) request-enduser-password-reset -> HTTP ".concat(resetRes.status, " \u2014 unconditional, carries no signal"));
+                                        return [4 /*yield*/, sdk.api.endusers.getSome({ filter: { email: attackerEmail } })];
+                                    case 6:
+                                        resolvable = _b.sent();
+                                        record('G13', 'attacker email resolves to no enduser after intake submit', resolvable.length === 0, resolvable.length === 0
+                                            ? "no enduser carries ".concat(attackerEmail, " (victim still ").concat(describe(enduser), ")")
+                                            : "EXPLOIT: ".concat(resolvable.length, " enduser(s) now resolve for ").concat(attackerEmail, " \u2014 reset token would be mailed to the attacker"));
+                                        return [4 /*yield*/, post('/v1/begin-enduser-login-flow', { email: attackerEmail, businessId: businessId })];
+                                    case 7:
+                                        after = _b.sent();
+                                        afterResult = (_a = after.data) === null || _a === void 0 ? void 0 : _a.result;
+                                        if (after.status === 429) {
+                                            skip('G13', 'begin_login_flow oracle after intake attack', 'rate limited (429) — oracle unavailable this run');
+                                        }
+                                        else {
+                                            record('G13', 'begin_login_flow still returns continue-with-password after intake attack', afterResult === 'continue-with-password', afterResult === 'continue-with-password'
+                                                ? "result=".concat(afterResult)
+                                                : "EXPLOIT: result=".concat(afterResult, " \u2014 an OTP / magic link was dispatched for the attacker's address"));
+                                        }
+                                        return [2 /*return*/];
+                                }
+                            });
+                        }); })
+                        // ---------------------------------------------------------------------------------------------
+                        // G14 — Pivot: a public session can prepare a response for a NON-public form and submit that.
+                        // ---------------------------------------------------------------------------------------------
+                    ];
+                case 37:
+                    _r.sent();
+                    G14_NAME = 'pivot via prepare_form_response to a non-public form is also blocked';
+                    return [4 /*yield*/, runScenario('G14', G14_NAME, function () { return __awaiter(void 0, void 0, void 0, function () {
+                            var victimPhone, victim, attackerEmail, attackerPhone, session, authed, prepared, enduser;
+                            return __generator(this, function (_a) {
+                                switch (_a.label) {
+                                    case 0:
+                                        victimPhone = nextPhone();
+                                        return [4 /*yield*/, makeVictim('L1', { phone: victimPhone })];
+                                    case 1:
+                                        victim = _a.sent();
+                                        attackerEmail = emailFor('atk-l1');
+                                        attackerPhone = nextPhone();
+                                        return [4 /*yield*/, startFormOn(intake.form.id, {
+                                                fname: victim.fname, lname: victim.lname, dateOfBirth: victim.dateOfBirth,
+                                            })];
+                                    case 2:
+                                        session = _a.sent();
+                                        if (session.enduserId)
+                                            createdEnduserIds.push(session.enduserId);
+                                        if (session.enduserId !== victim.id) {
+                                            record('G14', G14_NAME, false, "probe invalid \u2014 endpoint inserted ".concat(session.enduserId, " instead of matching victim ").concat(victim.id));
+                                            return [2 /*return*/];
+                                        }
+                                        authed = asEnduser(session.authToken);
+                                        return [4 /*yield*/, authed.api.form_responses.prepare_form_response({
+                                                formId: pivotIntake.form.id,
+                                                enduserId: victim.id,
+                                            })];
+                                    case 3:
+                                        prepared = _a.sent();
+                                        return [4 /*yield*/, authed.api.form_responses.submit_form_response({
+                                                accessCode: prepared.accessCode,
+                                                responses: intakeAnswers(pivotIntake, attackerEmail, attackerPhone),
+                                            })];
+                                    case 4:
+                                        _a.sent();
+                                        return [4 /*yield*/, pollEnduser(victim.id, function (e) { return e.email === attackerEmail || e.phone === attackerPhone; }, OVERWRITE_WINDOW_MS)];
+                                    case 5:
+                                        enduser = (_a.sent()).enduser;
+                                        record('G14', "".concat(G14_NAME, " \u2014 email"), !(enduser === null || enduser === void 0 ? void 0 : enduser.email), !(enduser === null || enduser === void 0 ? void 0 : enduser.email)
+                                            ? 'email still (unset) after pivot submit'
+                                            : "EXPLOIT: pivot to a non-public form wrote ".concat(enduser === null || enduser === void 0 ? void 0 : enduser.email));
+                                        record('G14', "".concat(G14_NAME, " \u2014 phone"), (enduser === null || enduser === void 0 ? void 0 : enduser.phone) === victimPhone, (enduser === null || enduser === void 0 ? void 0 : enduser.phone) === victimPhone
+                                            ? "phone still ".concat(victimPhone)
+                                            : "EXPLOIT: pivot to a non-public form wrote ".concat(enduser === null || enduser === void 0 ? void 0 : enduser.phone, " (was ").concat(victimPhone, ")"));
+                                        return [2 /*return*/];
+                                }
+                            });
+                        }); })
+                        // ---------------------------------------------------------------------------------------------
+                        // G15 — save_field_response ownership: a guessable formResponseId must not reach another patient.
+                        // ---------------------------------------------------------------------------------------------
+                    ];
+                case 38:
+                    _r.sent();
+                    G15_NAME = "save_field_response rejects another patient's formResponseId";
+                    return [4 /*yield*/, runScenario('G15', G15_NAME, function () { return __awaiter(void 0, void 0, void 0, function () {
+                            var patientA, patientB, sessionA, bPrepared, bResponseId, answer, byId, byCode, byIdWrongCode, aResponse, ownBoth;
+                            var _a, _b, _c;
+                            return __generator(this, function (_d) {
+                                switch (_d.label) {
+                                    case 0: return [4 /*yield*/, makeVictim('M1', { phone: nextPhone() })];
+                                    case 1:
+                                        patientA = _d.sent();
+                                        return [4 /*yield*/, makeVictim('M2', { phone: nextPhone() })];
+                                    case 2:
+                                        patientB = _d.sent();
+                                        return [4 /*yield*/, startFormOn(partialIntake.form.id, {
+                                                fname: patientA.fname, lname: patientA.lname, dateOfBirth: patientA.dateOfBirth,
+                                            })];
+                                    case 3:
+                                        sessionA = _d.sent();
+                                        if (sessionA.enduserId)
+                                            createdEnduserIds.push(sessionA.enduserId);
+                                        if (sessionA.enduserId !== patientA.id) {
+                                            record('G15', G15_NAME, false, "probe invalid \u2014 endpoint inserted ".concat(sessionA.enduserId, " instead of matching patient A ").concat(patientA.id));
+                                            return [2 /*return*/];
+                                        }
+                                        return [4 /*yield*/, sdk.api.form_responses.prepare_form_response({
+                                                formId: partialIntake.form.id, enduserId: patientB.id,
+                                            })];
+                                    case 4:
+                                        bPrepared = _d.sent();
+                                        bResponseId = (_b = (_a = bPrepared.response) === null || _a === void 0 ? void 0 : _a.id) !== null && _b !== void 0 ? _b : (_c = bPrepared.response) === null || _c === void 0 ? void 0 : _c._id;
+                                        answer = {
+                                            fieldId: partialIntake.emailField.id,
+                                            fieldTitle: partialIntake.emailField.title,
+                                            answer: { type: 'email', value: emailFor('atk-m1') },
+                                        };
+                                        return [4 /*yield*/, patchAuthed('/v1/save-field-response', { formResponseId: bResponseId, response: answer }, sessionA.authToken)];
+                                    case 5:
+                                        byId = _d.sent();
+                                        record('G15', G15_NAME, byId.status === 403, byId.status === 403
+                                            ? 'HTTP 403 as expected'
+                                            : "EXPLOIT: HTTP ".concat(byId.status, " \u2014 patient A wrote into patient B's in-progress response"));
+                                        return [4 /*yield*/, patchAuthed('/v1/save-field-response', { accessCode: bPrepared.accessCode, response: answer }, sessionA.authToken)];
+                                    case 6:
+                                        byCode = _d.sent();
+                                        record('G15', 'save_field_response still accepts a known accessCode', byCode.status === 200, "HTTP ".concat(byCode.status));
+                                        return [4 /*yield*/, patchAuthed('/v1/save-field-response', { formResponseId: bResponseId, accessCode: 'not-a-real-access-code', response: answer }, sessionA.authToken)];
+                                    case 7:
+                                        byIdWrongCode = _d.sent();
+                                        record('G15', "another patient's formResponseId + wrong accessCode is rejected", byIdWrongCode.status === 403, "HTTP ".concat(byIdWrongCode.status));
+                                        return [4 /*yield*/, sdk.api.form_responses.getSome({ filter: { accessCode: sessionA.accessCode } })];
+                                    case 8:
+                                        aResponse = (_d.sent())[0];
+                                        return [4 /*yield*/, patchAuthed('/v1/save-field-response', {
+                                                formResponseId: aResponse === null || aResponse === void 0 ? void 0 : aResponse.id,
+                                                accessCode: sessionA.accessCode,
+                                                response: {
+                                                    fieldId: partialIntake.emailField.id,
+                                                    fieldTitle: partialIntake.emailField.title,
+                                                    answer: { type: 'email', value: emailFor('own-both') },
+                                                },
+                                            }, sessionA.authToken)];
+                                    case 9:
+                                        ownBoth = _d.sent();
+                                        record('G15', 'own response with accessCode + formResponseId still succeeds (real UI shape)', ownBoth.status === 200, ownBoth.status === 200 ? 'HTTP 200' : "REGRESSION: HTTP ".concat(ownBoth.status, " \u2014 this is how the form UI calls it"));
+                                        return [2 /*return*/];
+                                }
+                            });
+                        }); })
+                        // ---------------------------------------------------------------------------------------------
+                        // G16 — No-regression: the intake path is the ONLY source of contact info for a new visitor.
+                        // This is the intakeEmailHidden / intakePhone:'hidden' configuration, and the reason the lock is
+                        // scoped to "matched a pre-existing patient" rather than "any public session".
+                        // ---------------------------------------------------------------------------------------------
+                    ];
+                case 39:
+                    _r.sent();
+                    // ---------------------------------------------------------------------------------------------
+                    // G16 — No-regression: the intake path is the ONLY source of contact info for a new visitor.
+                    // This is the intakeEmailHidden / intakePhone:'hidden' configuration, and the reason the lock is
+                    // scoped to "matched a pre-existing patient" rather than "any public session".
+                    // ---------------------------------------------------------------------------------------------
+                    return [4 /*yield*/, runScenario('G16', 'brand-new visitor still gets email/phone from intake answers', function () { return __awaiter(void 0, void 0, void 0, function () {
+                            var submittedEmail, submittedPhone, session, created, enduser;
+                            return __generator(this, function (_a) {
+                                switch (_a.label) {
+                                    case 0:
+                                        submittedEmail = emailFor('lock-new-intake');
+                                        submittedPhone = nextPhone();
+                                        return [4 /*yield*/, startFormOn(intake.form.id, {
+                                                fname: "Lock".concat(RUN), lname: "NewIntake".concat(RUN), dateOfBirth: '05-06-1992',
+                                            })];
+                                    case 1:
+                                        session = _a.sent();
+                                        if (session.enduserId)
+                                            createdEnduserIds.push(session.enduserId);
+                                        return [4 /*yield*/, sdk.api.endusers.getOne(session.enduserId)];
+                                    case 2:
+                                        created = _a.sent();
+                                        record('G16', 'new visitor starts with no contact info from the endpoint', !created.email && !created.phone, describe(created));
+                                        return [4 /*yield*/, asEnduser(session.authToken).api.form_responses.submit_form_response({
+                                                accessCode: session.accessCode,
+                                                responses: intakeAnswers(intake, submittedEmail, submittedPhone),
+                                            })];
+                                    case 3:
+                                        _a.sent();
+                                        return [4 /*yield*/, pollEnduser(session.enduserId, function (e) { return !!e.email && !!e.phone; }, AWAITED_WINDOW_MS)];
+                                    case 4:
+                                        enduser = (_a.sent()).enduser;
+                                        record('G16', 'brand-new visitor still gets email from intake answers', (enduser === null || enduser === void 0 ? void 0 : enduser.email) === submittedEmail, "email=".concat((enduser === null || enduser === void 0 ? void 0 : enduser.email) || '(unset)', " expected=").concat(submittedEmail));
+                                        record('G16', 'brand-new visitor still gets phone from intake answers', (enduser === null || enduser === void 0 ? void 0 : enduser.phone) === submittedPhone, "phone=".concat((enduser === null || enduser === void 0 ? void 0 : enduser.phone) || '(unset)', " expected=").concat(submittedPhone));
+                                        return [2 /*return*/];
+                                }
+                            });
+                        }); })
+                        // ---------------------------------------------------------------------------------------------
+                        // G17 — No-regression: a fully authenticated (non-public) portal session may still self-update.
+                        // ---------------------------------------------------------------------------------------------
+                    ];
+                case 40:
+                    // ---------------------------------------------------------------------------------------------
+                    // G16 — No-regression: the intake path is the ONLY source of contact info for a new visitor.
+                    // This is the intakeEmailHidden / intakePhone:'hidden' configuration, and the reason the lock is
+                    // scoped to "matched a pre-existing patient" rather than "any public session".
+                    // ---------------------------------------------------------------------------------------------
+                    _r.sent();
+                    // ---------------------------------------------------------------------------------------------
+                    // G17 — No-regression: a fully authenticated (non-public) portal session may still self-update.
+                    // ---------------------------------------------------------------------------------------------
+                    return [4 /*yield*/, runScenario('G17', 'authenticated portal enduser can still self-update via intake', function () { return __awaiter(void 0, void 0, void 0, function () {
+                            var patient, newEmail, newPhone, portalSDK, prepared, enduser;
+                            return __generator(this, function (_a) {
+                                switch (_a.label) {
+                                    case 0: return [4 /*yield*/, makeVictim('N1', { email: emailFor('lock-n1'), phone: nextPhone() })];
+                                    case 1:
+                                        patient = _a.sent();
+                                        newEmail = emailFor('lock-n1-new');
+                                        newPhone = nextPhone();
+                                        portalSDK = new EnduserSession({ host: host, businessId: businessId });
+                                        return [4 /*yield*/, authenticate_enduser_via_token(sdk, portalSDK, { id: patient.id })];
+                                    case 2:
+                                        _a.sent();
+                                        return [4 /*yield*/, sdk.api.form_responses.prepare_form_response({
+                                                formId: intake.form.id, enduserId: patient.id,
+                                            })];
+                                    case 3:
+                                        prepared = _a.sent();
+                                        return [4 /*yield*/, portalSDK.api.form_responses.submit_form_response({
+                                                accessCode: prepared.accessCode,
+                                                responses: intakeAnswers(intake, newEmail, newPhone),
+                                            })];
+                                    case 4:
+                                        _a.sent();
+                                        return [4 /*yield*/, pollEnduser(patient.id, function (e) { return e.email === newEmail; }, AWAITED_WINDOW_MS)];
+                                    case 5:
+                                        enduser = (_a.sent()).enduser;
+                                        record('G17', 'authenticated portal intake still updates email', (enduser === null || enduser === void 0 ? void 0 : enduser.email) === newEmail, "email=".concat((enduser === null || enduser === void 0 ? void 0 : enduser.email) || '(unset)', " expected=").concat(newEmail));
+                                        record('G17', 'authenticated portal intake still updates phone', (enduser === null || enduser === void 0 ? void 0 : enduser.phone) === newPhone, "phone=".concat((enduser === null || enduser === void 0 ? void 0 : enduser.phone) || '(unset)', " expected=").concat(newPhone));
+                                        return [2 /*return*/];
+                                }
+                            });
+                        }); })
+                        // ---------------------------------------------------------------------------------------------
+                        // G18 — No-regression: staff submitting on a patient's behalf may still set email/phone.
+                        // ---------------------------------------------------------------------------------------------
+                    ];
+                case 41:
+                    // ---------------------------------------------------------------------------------------------
+                    // G17 — No-regression: a fully authenticated (non-public) portal session may still self-update.
+                    // ---------------------------------------------------------------------------------------------
+                    _r.sent();
+                    // ---------------------------------------------------------------------------------------------
+                    // G18 — No-regression: staff submitting on a patient's behalf may still set email/phone.
+                    // ---------------------------------------------------------------------------------------------
+                    return [4 /*yield*/, runScenario('G18', 'staff intake submission still updates email/phone', function () { return __awaiter(void 0, void 0, void 0, function () {
+                            var patient, newEmail, newPhone, prepared, enduser;
+                            return __generator(this, function (_a) {
+                                switch (_a.label) {
+                                    case 0: return [4 /*yield*/, makeVictim('O1', { email: emailFor('lock-o1'), phone: nextPhone() })];
+                                    case 1:
+                                        patient = _a.sent();
+                                        newEmail = emailFor('lock-o1-new');
+                                        newPhone = nextPhone();
+                                        return [4 /*yield*/, sdk.api.form_responses.prepare_form_response({
+                                                formId: intake.form.id, enduserId: patient.id,
+                                            })];
+                                    case 2:
+                                        prepared = _a.sent();
+                                        return [4 /*yield*/, sdk.api.form_responses.submit_form_response({
+                                                accessCode: prepared.accessCode,
+                                                responses: intakeAnswers(intake, newEmail, newPhone),
+                                            })];
+                                    case 3:
+                                        _a.sent();
+                                        return [4 /*yield*/, pollEnduser(patient.id, function (e) { return e.email === newEmail; }, AWAITED_WINDOW_MS)];
+                                    case 4:
+                                        enduser = (_a.sent()).enduser;
+                                        record('G18', 'staff intake submission still updates email', (enduser === null || enduser === void 0 ? void 0 : enduser.email) === newEmail, "email=".concat((enduser === null || enduser === void 0 ? void 0 : enduser.email) || '(unset)', " expected=").concat(newEmail));
+                                        record('G18', 'staff intake submission still updates phone', (enduser === null || enduser === void 0 ? void 0 : enduser.phone) === newPhone, "phone=".concat((enduser === null || enduser === void 0 ? void 0 : enduser.phone) || '(unset)', " expected=").concat(newPhone));
+                                        return [2 /*return*/];
+                                }
+                            });
+                        }); })
+                        // ---------------------------------------------------------------------------------------------
+                        // G19 / G20 — Cross-patient session via a null fname/lname match.
+                        //
+                        // In both handlers' $or, `email` and `dateOfBirth` get `|| "never"` sentinels but fname/lname are
+                        // interpolated RAW. `ignoreUndefined` is not set on the Mongo client (database.ts connect options;
+                        // driver 5.7.0 defaults it to false), and findOne does not strip undefined keys — so an absent
+                        // fname serializes to `{fname: null}`, which matches every document where the field is null OR
+                        // MISSING. fname/lname have no schema initializer, so a cold-started enduser has them absent.
+                        //
+                        // Net: a request supplying ONLY dateOfBirth queries {fname: null, lname: null, dateOfBirth: X} and
+                        // can match another patient, returning a session scoped to THEIR record. The cold-start pattern is
+                        // what manufactures nameless endusers, and a later intakeField: 'dateOfBirth' question fills the DOB.
+                        // ---------------------------------------------------------------------------------------------
+                        // dateOfBirth is only string-validated and the handlers merely trim it, so a run-tokenized value is
+                        // accepted. Deliberately opaque rather than date-shaped, so match-vs-insert is unambiguous even when
+                        // this file runs inside the full suite (no reset_db between files).
+                    ];
+                case 42:
+                    // ---------------------------------------------------------------------------------------------
+                    // G18 — No-regression: staff submitting on a patient's behalf may still set email/phone.
+                    // ---------------------------------------------------------------------------------------------
+                    _r.sent();
+                    namelessDob = "01-02-1990-".concat(RUN);
+                    makeNamelessVictim = function (tag) { return __awaiter(void 0, void 0, void 0, function () {
+                        var victim, stored;
+                        return __generator(this, function (_a) {
+                            switch (_a.label) {
+                                case 0: return [4 /*yield*/, sdk.api.endusers.createOne({ dateOfBirth: "".concat(namelessDob, "-").concat(tag) })];
+                                case 1:
+                                    victim = _a.sent();
+                                    createdEnduserIds.push(victim.id);
+                                    return [4 /*yield*/, sdk.api.endusers.getOne(victim.id)];
+                                case 2:
+                                    stored = _a.sent();
+                                    return [2 /*return*/, { victim: victim, stored: stored }];
+                            }
+                        });
+                    }); };
+                    G19_NAME = 'DOB-only request does not hijack a nameless patient (form endpoint)';
+                    return [4 /*yield*/, runScenario('G19', G19_NAME, function () { return __awaiter(void 0, void 0, void 0, function () {
+                            var _a, victim, stored, session;
+                            return __generator(this, function (_b) {
+                                switch (_b.label) {
+                                    case 0: return [4 /*yield*/, makeNamelessVictim('f')
+                                        // Probe validity: a stored '' would not be null-matched and would make this test vacuous.
+                                    ];
+                                    case 1:
+                                        _a = _b.sent(), victim = _a.victim, stored = _a.stored;
+                                        // Probe validity: a stored '' would not be null-matched and would make this test vacuous.
+                                        record('G19', 'nameless victim really has absent fname/lname (probe validity)', stored.fname === undefined && stored.lname === undefined, "fname=".concat(JSON.stringify(stored.fname), " lname=").concat(JSON.stringify(stored.lname)));
+                                        return [4 /*yield*/, startFormOn(intake.form.id, { dateOfBirth: stored.dateOfBirth })];
+                                    case 2:
+                                        session = _b.sent();
+                                        if (session.enduserId)
+                                            createdEnduserIds.push(session.enduserId);
+                                        record('G19', G19_NAME, session.enduserId !== victim.id, session.enduserId !== victim.id
+                                            ? "inserted a new record (".concat(session.enduserId, ") instead of matching the victim")
+                                            : "EXPLOIT: returned a session for the victim's record ".concat(victim.id, " from a DOB-only request"));
+                                        return [2 /*return*/];
+                                }
+                            });
+                        }); })];
+                case 43:
+                    _r.sent();
+                    G20_NAME = 'DOB-only request does not hijack a nameless patient (booking endpoint)';
+                    return [4 /*yield*/, runScenario('G20', G20_NAME, function () { return __awaiter(void 0, void 0, void 0, function () {
+                            var _a, victim, stored, dob, withDob;
+                            return __generator(this, function (_b) {
+                                switch (_b.label) {
+                                    case 0: return [4 /*yield*/, makeNamelessVictim('b')];
+                                    case 1:
+                                        _a = _b.sent(), victim = _a.victim, stored = _a.stored;
+                                        dob = stored.dateOfBirth;
+                                        // The booking endpoint has no skipMatch option and no phone guard at all, so this filter is
+                                        // reached unconditionally. It returns only { authToken }, so detect match-vs-insert by counting
+                                        // records carrying this run-unique DOB.
+                                        return [4 /*yield*/, startBooking({ dateOfBirth: dob })];
+                                    case 2:
+                                        // The booking endpoint has no skipMatch option and no phone guard at all, so this filter is
+                                        // reached unconditionally. It returns only { authToken }, so detect match-vs-insert by counting
+                                        // records carrying this run-unique DOB.
+                                        _b.sent();
+                                        return [4 /*yield*/, sdk.api.endusers.getSome({ filter: { dateOfBirth: dob } })];
+                                    case 3:
+                                        withDob = _b.sent();
+                                        withDob.forEach(function (e) { if (e.id !== victim.id)
+                                            createdEnduserIds.push(e.id); });
+                                        record('G20', G20_NAME, withDob.length > 1, withDob.length > 1
+                                            ? "inserted a new record (".concat(withDob.length, " total with this DOB) instead of matching the victim")
+                                            : "EXPLOIT: matched the victim's record ".concat(victim.id, " from a DOB-only request \u2014 a booking session was issued for it"));
+                                        return [2 /*return*/];
+                                }
+                            });
+                        }); })
+                        // ---------------------------------------------------------------------------------------------
+                        // G21 — The match sentinel must never be stored as a patient's name.
+                        // Guard rail on the fix: the fallback belongs in the filter literal only, never written into
+                        // enduserInfo (which is spread into both the enduser insert and the form_responses record).
+                        // ---------------------------------------------------------------------------------------------
+                    ];
+                case 44:
+                    _r.sent();
+                    // ---------------------------------------------------------------------------------------------
+                    // G21 — The match sentinel must never be stored as a patient's name.
+                    // Guard rail on the fix: the fallback belongs in the filter literal only, never written into
+                    // enduserInfo (which is spread into both the enduser insert and the form_responses record).
+                    // ---------------------------------------------------------------------------------------------
+                    return [4 /*yield*/, runScenario('G21', 'match sentinel never leaks into stored fname/lname', function () { return __awaiter(void 0, void 0, void 0, function () {
+                            var session, created, leaked, response;
+                            return __generator(this, function (_a) {
+                                switch (_a.label) {
+                                    case 0: return [4 /*yield*/, startFormOn(intake.form.id, { dateOfBirth: "".concat(namelessDob, "-sentinel") })];
+                                    case 1:
+                                        session = _a.sent();
+                                        if (session.enduserId)
+                                            createdEnduserIds.push(session.enduserId);
+                                        return [4 /*yield*/, sdk.api.endusers.getOne(session.enduserId)];
+                                    case 2:
+                                        created = _a.sent();
+                                        leaked = function (v) { return v === '__never__' || v === 'never'; };
+                                        record('G21', 'created enduser fname/lname are not the sentinel', !leaked(created.fname) && !leaked(created.lname), "fname=".concat(JSON.stringify(created.fname), " lname=").concat(JSON.stringify(created.lname)));
+                                        return [4 /*yield*/, sdk.api.form_responses.getSome({ filter: { accessCode: session.accessCode } })];
+                                    case 3:
+                                        response = (_a.sent())[0];
+                                        record('G21', 'form_responses fname/lname are not the sentinel', !leaked(response === null || response === void 0 ? void 0 : response.fname) && !leaked(response === null || response === void 0 ? void 0 : response.lname), "fname=".concat(JSON.stringify(response === null || response === void 0 ? void 0 : response.fname), " lname=").concat(JSON.stringify(response === null || response === void 0 ? void 0 : response.lname)));
+                                        return [2 /*return*/];
+                                }
+                            });
+                        }); })
+                        // ---------------------------------------------------------------------------------------------
+                        // G22 — The cold-start pattern: a public form started with NO intake info, which just creates an
+                        // Enduser with an ID. Intake answers (including the authentication fields email/phone) must still
+                        // populate that fresh record — the lock is scoped to "matched a pre-existing patient", not to
+                        // "any public session", precisely so this keeps working.
+                        // ---------------------------------------------------------------------------------------------
+                    ];
+                case 45:
+                    // ---------------------------------------------------------------------------------------------
+                    // G21 — The match sentinel must never be stored as a patient's name.
+                    // Guard rail on the fix: the fallback belongs in the filter literal only, never written into
+                    // enduserInfo (which is spread into both the enduser insert and the form_responses record).
+                    // ---------------------------------------------------------------------------------------------
+                    _r.sent();
+                    coldStartCase = function (label, args) { return __awaiter(void 0, void 0, void 0, function () {
+                        var group, submittedEmail, submittedPhone, session, created, enduser;
+                        return __generator(this, function (_a) {
+                            switch (_a.label) {
+                                case 0:
+                                    group = 'G22';
+                                    submittedEmail = emailFor("cold-".concat(label));
+                                    submittedPhone = nextPhone();
+                                    return [4 /*yield*/, startFormOn(intake.form.id, args)];
+                                case 1:
+                                    session = _a.sent();
+                                    if (session.enduserId)
+                                        createdEnduserIds.push(session.enduserId);
+                                    return [4 /*yield*/, sdk.api.endusers.getOne(session.enduserId)];
+                                case 2:
+                                    created = _a.sent();
+                                    record(group, "".concat(label, ": cold start creates a bare enduser"), !created.email && !created.phone && !!session.enduserId, describe(created));
+                                    return [4 /*yield*/, asEnduser(session.authToken).api.form_responses.submit_form_response({
+                                            accessCode: session.accessCode,
+                                            responses: intakeAnswers(intake, submittedEmail, submittedPhone),
+                                        })];
+                                case 3:
+                                    _a.sent();
+                                    return [4 /*yield*/, pollEnduser(session.enduserId, function (e) { return !!e.email && !!e.phone; }, AWAITED_WINDOW_MS)];
+                                case 4:
+                                    enduser = (_a.sent()).enduser;
+                                    record(group, "".concat(label, ": intake email (an auth field) still populates the cold-started record"), (enduser === null || enduser === void 0 ? void 0 : enduser.email) === submittedEmail, "email=".concat((enduser === null || enduser === void 0 ? void 0 : enduser.email) || '(unset)', " expected=").concat(submittedEmail));
+                                    record(group, "".concat(label, ": intake phone (an auth field) still populates the cold-started record"), (enduser === null || enduser === void 0 ? void 0 : enduser.phone) === submittedPhone, "phone=".concat((enduser === null || enduser === void 0 ? void 0 : enduser.phone) || '(unset)', " expected=").concat(submittedPhone));
+                                    return [2 /*return*/];
+                            }
+                        });
+                    }); };
+                    // The shape the real webapp sends (public_form.tsx handleNoIntakeRedirect): nothing but ids.
+                    return [4 /*yield*/, runScenario('G22', 'cold start with skipMatch (real webapp shape)', function () { return coldStartCase('skipMatch', { skipMatch: true }); })
+                        // And the same with no skipMatch, which still cannot match: the email branch needs email === "never"
+                        // (unstorable) and the name branch needs dateOfBirth === "never" literally.
+                    ];
+                case 46:
+                    // The shape the real webapp sends (public_form.tsx handleNoIntakeRedirect): nothing but ids.
+                    _r.sent();
+                    // And the same with no skipMatch, which still cannot match: the email branch needs email === "never"
+                    // (unstorable) and the name branch needs dateOfBirth === "never" literally.
+                    return [4 /*yield*/, runScenario('G22', 'cold start without skipMatch', function () { return coldStartCase('no-skipMatch', {}); })
+                        // ---------------------------------------------------------------------------------------------
+                        // G23 — businessId must be required on session_for_public_form.
+                        //
+                        // addPublicEndpoint overwrites the schema's `required: true` for businessId with
+                        // mongoIdStringOptional (routing.ts, and its own "todo: make businessId required"), and TypeScript
+                        // cannot catch it because CustomAction declares businessId as a non-optional string.
+                        //
+                        // A falsy businessId then leaves restrictAccess as the IDENTITY function in
+                        // buildAllQueries/buildOrganizationWideQueries (database.ts): the tenant clause is not appended at
+                        // all, so every query in the handler runs across ALL tenants. It fails OPEN, which is worse than
+                        // matching nothing. login_enduser signs the JWT from enduser.businessId, not from the request, so
+                        // the returned token is a fully valid session on whatever record matched.
+                        //
+                        // session_for_public_appointment_booking already guards this (its own comment says the schema
+                        // cannot enforce it); this endpoint did not. Note the sentinel fix in G19/G20 does NOT cover this:
+                        // sentinels constrain which record shapes the filter can match, not which tenants it searches.
+                        // ---------------------------------------------------------------------------------------------
+                    ];
+                case 47:
+                    // And the same with no skipMatch, which still cannot match: the email branch needs email === "never"
+                    // (unstorable) and the name branch needs dateOfBirth === "never" literally.
+                    _r.sent();
+                    G23_NAME = 'session_for_public_form requires businessId';
+                    return [4 /*yield*/, runScenario('G23', G23_NAME, function () { return __awaiter(void 0, void 0, void 0, function () {
+                            var victim, omitted, blocked, wrongBiz, badBiz;
+                            var _a, _b, _c, _d, _e, _f, _g, _h, _j, _k, _l;
+                            return __generator(this, function (_m) {
+                                switch (_m.label) {
+                                    case 0: return [4 /*yield*/, makeVictim('P1', { email: emailFor('lock-bizid'), phone: nextPhone() })
+                                        // (a) THE ISSUE. Omit businessId entirely and name the patient directly via enduserId, which
+                                        // reaches an untenanted findById — no name/DOB guessing required. Pre-fix this hands back a
+                                        // working session for that patient; post-fix it must 400 before touching the database.
+                                    ];
+                                    case 1:
+                                        victim = _m.sent();
+                                        return [4 /*yield*/, post('/v1/session-for-public-form', {
+                                                formId: intake.form.id,
+                                                enduserId: victim.id,
+                                            })];
+                                    case 2:
+                                        omitted = _m.sent();
+                                        if ((_a = omitted.data) === null || _a === void 0 ? void 0 : _a.enduserId)
+                                            createdEnduserIds.push(omitted.data.enduserId);
+                                        blocked = omitted.status === 400 && ((_b = omitted.data) === null || _b === void 0 ? void 0 : _b.message) === 'businessId is required';
+                                        record('G23', "".concat(G23_NAME, " \u2014 omitted businessId is rejected"), blocked, blocked
+                                            ? 'HTTP 400 businessId is required'
+                                            : "EXPLOIT: HTTP ".concat(omitted.status, " \u2014 got enduserId=").concat((_c = omitted.data) === null || _c === void 0 ? void 0 : _c.enduserId, " authToken=").concat(!!((_d = omitted.data) === null || _d === void 0 ? void 0 : _d.authToken), " for victim ").concat(victim.id, " with NO businessId, i.e. tenant filtering was disabled entirely"));
+                                        return [4 /*yield*/, post('/v1/session-for-public-form', {
+                                                formId: intake.form.id,
+                                                enduserId: victim.id,
+                                                businessId: '000000000000000000000001',
+                                            })];
+                                    case 3:
+                                        wrongBiz = _m.sent();
+                                        record('G23', "".concat(G23_NAME, " \u2014 a wrong businessId cannot reach the patient"), wrongBiz.status !== 200 && ((_e = wrongBiz.data) === null || _e === void 0 ? void 0 : _e.enduserId) !== victim.id, "HTTP ".concat(wrongBiz.status, " ").concat(JSON.stringify((_j = (_g = (_f = wrongBiz.data) === null || _f === void 0 ? void 0 : _f.message) !== null && _g !== void 0 ? _g : (_h = wrongBiz.data) === null || _h === void 0 ? void 0 : _h.enduserId) !== null && _j !== void 0 ? _j : '')));
+                                        return [4 /*yield*/, post('/v1/session-for-public-form', {
+                                                formId: intake.form.id,
+                                                enduserId: victim.id,
+                                                businessId: 'not-a-mongo-id',
+                                            })];
+                                    case 4:
+                                        badBiz = _m.sent();
+                                        record('G23', "".concat(G23_NAME, " \u2014 a malformed businessId is rejected"), badBiz.status === 400, "HTTP ".concat(badBiz.status, " ").concat(JSON.stringify((_l = (_k = badBiz.data) === null || _k === void 0 ? void 0 : _k.message) !== null && _l !== void 0 ? _l : '')));
+                                        return [2 /*return*/];
+                                }
+                            });
+                        }); })
+                        // ---------------------------------------------------------------------------------------------
+                        // G24 / G25 — The token prepare_form_response mints drops `fromPublicSession`.
+                        //
+                        // The lock in prepare_form_response keys off session.fromPublicSession, but the token it mints
+                        // preserved the session's confinement WITHOUT that flag and handed it back in fullURL (?token=...).
+                        // Since prepare_form_response is itself in the 'public-form' session scope, a caller can hop twice:
+                        // the first hop's response is locked, the second hop's is not — because by then the session no longer
+                        // looks like a public one. Submitting an intakeField: 'email' answer against that second response
+                        // then repoints the victim's login channel.
+                        //
+                        // The same flag also gates PHI on refresh_session (G25): when it is falsy the handler returns
+                        // redact_field(enduser, 'hashedPassword') — the whole record — instead of just assignedTo.
+                        // ---------------------------------------------------------------------------------------------
+                    ];
+                case 48:
+                    _r.sent();
+                    chainForVictim = function (tag, victim) { return __awaiter(void 0, void 0, void 0, function () {
+                        var t1, hop1;
+                        return __generator(this, function (_a) {
+                            switch (_a.label) {
+                                case 0: return [4 /*yield*/, startFormOn(intake.form.id, {
+                                        fname: victim.fname, lname: victim.lname, dateOfBirth: victim.dateOfBirth,
+                                    })];
+                                case 1:
+                                    t1 = _a.sent();
+                                    if (t1.enduserId)
+                                        createdEnduserIds.push(t1.enduserId);
+                                    if (t1.enduserId !== victim.id)
+                                        return [2 /*return*/, { matched: false, t1: t1, t2: undefined, hop1: undefined }];
+                                    return [4 /*yield*/, asEnduser(t1.authToken).api.form_responses.prepare_form_response({
+                                            formId: pivotIntake.form.id, enduserId: victim.id,
+                                        })];
+                                case 2:
+                                    hop1 = _a.sent();
+                                    return [2 /*return*/, { matched: true, t1: t1, hop1: hop1, t2: tokenFromURL(hop1 === null || hop1 === void 0 ? void 0 : hop1.fullURL) }];
+                            }
+                        });
+                    }); };
+                    G24_NAME = 'chained prepare_form_response session stays locked';
+                    return [4 /*yield*/, runScenario('G24', G24_NAME, function () { return __awaiter(void 0, void 0, void 0, function () {
+                            var victimEmail, victim, attackerEmail, _a, matched, t2, hop2, hop2Response, enduser;
+                            return __generator(this, function (_b) {
+                                switch (_b.label) {
+                                    case 0:
+                                        victimEmail = emailFor('lock-q1');
+                                        return [4 /*yield*/, makeVictim('Q1', { email: victimEmail, phone: nextPhone() })];
+                                    case 1:
+                                        victim = _b.sent();
+                                        attackerEmail = emailFor('atk-q1');
+                                        return [4 /*yield*/, chainForVictim('Q1', victim)];
+                                    case 2:
+                                        _a = _b.sent(), matched = _a.matched, t2 = _a.t2;
+                                        if (!matched) {
+                                            record('G24', G24_NAME, false, "probe invalid \u2014 first hop did not match victim ".concat(victim.id));
+                                            return [2 /*return*/];
+                                        }
+                                        record('G24', 'chained token is returned in fullURL (probe validity)', !!t2, "token extracted=".concat(!!t2));
+                                        if (!t2)
+                                            return [2 /*return*/];
+                                        return [4 /*yield*/, asEnduser(t2).api.form_responses.prepare_form_response({
+                                                formId: pivotIntake.form.id, enduserId: victim.id,
+                                            })];
+                                    case 3:
+                                        hop2 = _b.sent();
+                                        record('G24', 'second-hop prepare succeeds (probe validity)', !!(hop2 === null || hop2 === void 0 ? void 0 : hop2.accessCode), "accessCode=".concat(!!(hop2 === null || hop2 === void 0 ? void 0 : hop2.accessCode)));
+                                        if (!(hop2 === null || hop2 === void 0 ? void 0 : hop2.accessCode))
+                                            return [2 /*return*/];
+                                        return [4 /*yield*/, sdk.api.form_responses.getSome({ filter: { accessCode: hop2.accessCode } })];
+                                    case 4:
+                                        hop2Response = (_b.sent())[0];
+                                        record('G24', "".concat(G24_NAME, " \u2014 second-hop response carries the lock"), (hop2Response === null || hop2Response === void 0 ? void 0 : hop2Response.authFieldIntakeDisabled) === true, "authFieldIntakeDisabled=".concat(JSON.stringify(hop2Response === null || hop2Response === void 0 ? void 0 : hop2Response.authFieldIntakeDisabled)));
+                                        // The assertion that actually matters: does the victim's login channel move?
+                                        return [4 /*yield*/, asEnduser(t2).api.form_responses.submit_form_response({
+                                                accessCode: hop2.accessCode,
+                                                responses: intakeAnswers(pivotIntake, attackerEmail, nextPhone()),
+                                            })];
+                                    case 5:
+                                        // The assertion that actually matters: does the victim's login channel move?
+                                        _b.sent();
+                                        return [4 /*yield*/, pollEnduser(victim.id, function (e) { return e.email === attackerEmail; }, OVERWRITE_WINDOW_MS)];
+                                    case 6:
+                                        enduser = (_b.sent()).enduser;
+                                        record('G24', "".concat(G24_NAME, " \u2014 victim email unchanged after chained submit"), (enduser === null || enduser === void 0 ? void 0 : enduser.email) === victimEmail, (enduser === null || enduser === void 0 ? void 0 : enduser.email) === victimEmail
+                                            ? "email still ".concat(victimEmail)
+                                            : "EXPLOIT: chained session wrote ".concat(enduser === null || enduser === void 0 ? void 0 : enduser.email, " via an intake answer"));
+                                        return [2 /*return*/];
+                                }
+                            });
+                        }); })];
+                case 49:
+                    _r.sent();
+                    G25_NAME = 'chained session does not expose the enduser record on refresh';
+                    return [4 /*yield*/, runScenario('G25', G25_NAME, function () { return __awaiter(void 0, void 0, void 0, function () {
+                            var victim, _a, matched, t1, t2, PHI_KEYS, leakedIn, base, chained, leaked;
+                            return __generator(this, function (_b) {
+                                switch (_b.label) {
+                                    case 0: return [4 /*yield*/, makeVictim('R1', { email: emailFor('lock-r1'), phone: nextPhone() })];
+                                    case 1:
+                                        victim = _b.sent();
+                                        return [4 /*yield*/, chainForVictim('R1', victim)];
+                                    case 2:
+                                        _a = _b.sent(), matched = _a.matched, t1 = _a.t1, t2 = _a.t2;
+                                        if (!matched) {
+                                            record('G25', G25_NAME, false, "probe invalid \u2014 first hop did not match victim ".concat(victim.id));
+                                            return [2 /*return*/];
+                                        }
+                                        PHI_KEYS = ['email', 'phone', 'dateOfBirth', 'fname', 'lname'];
+                                        leakedIn = function (body) { return PHI_KEYS.filter(function (k) { var _a; return ((_a = body === null || body === void 0 ? void 0 : body.enduser) !== null && _a !== void 0 ? _a : {})[k] !== undefined; }); };
+                                        return [4 /*yield*/, postAuthed('/v1/refresh-enduser-session', {}, t1.authToken)];
+                                    case 3:
+                                        base = _b.sent();
+                                        record('G25', 'baseline: original public token withholds the record (control)', base.status === 200 && leakedIn(base.data).length === 0, "HTTP ".concat(base.status, " leaked=[").concat(leakedIn(base.data).join(', '), "]"));
+                                        if (!t2) {
+                                            record('G25', G25_NAME, false, 'probe invalid — no chained token');
+                                            return [2 /*return*/];
+                                        }
+                                        return [4 /*yield*/, postAuthed('/v1/refresh-enduser-session', {}, t2)];
+                                    case 4:
+                                        chained = _b.sent();
+                                        leaked = leakedIn(chained.data);
+                                        record('G25', G25_NAME, chained.status === 200 && leaked.length === 0, leaked.length === 0
+                                            ? "HTTP ".concat(chained.status, ", no PHI fields returned")
+                                            : "EXPLOIT: refresh under the chained token returned [".concat(leaked.join(', '), "] for victim ").concat(victim.id));
+                                        return [2 /*return*/];
+                                }
+                            });
+                        }); })
+                        // ---------------------------------------------------------------------------------------------
+                        // G26 — Auto-merge re-points the response after the lock was computed.
+                        //
+                        // authFieldIntakeDisabled is a snapshot taken at session start (`!!existing`). With skipMatch it is
+                        // correctly false, because a fresh record really was inserted. But on submission
+                        // resolveAutoMergeBeforeSubmission repoints the response at a PRE-EXISTING patient and persists only
+                        // enduserId — so the intake write later reads a stale `false` and lands email/phone on the victim.
+                        // The merge matches on { fname, lname, dateOfBirth }, so the attacker never needs to know the
+                        // victim's email or phone.
+                        //
+                        // performAutoMerge copies no demographic fields itself, so the intake write is the only channel —
+                        // which is why the custom-field assertion below is essential: it proves the write RAN, so "email
+                        // unchanged" cannot pass just because nothing happened.
+                        // ---------------------------------------------------------------------------------------------
+                    ];
+                case 50:
+                    _r.sent();
+                    G26_NAME = 'auto-merge does not let an intake answer repoint the merged patient';
+                    return [4 /*yield*/, runScenario('G26', G26_NAME, function () { return __awaiter(void 0, void 0, void 0, function () {
+                            var victimEmail, victimPhone, victimDob, victim, attackerEmail, session, sourceId, f, after, merged, customLanded;
+                            var _a, _b, _c;
+                            return __generator(this, function (_d) {
+                                switch (_d.label) {
+                                    case 0:
+                                        victimEmail = emailFor('lock-s1');
+                                        victimPhone = nextPhone();
+                                        victimDob = '07-08-1988';
+                                        return [4 /*yield*/, sdk.api.endusers.createOne({
+                                                fname: "Lock".concat(RUN),
+                                                lname: "Merge".concat(RUN, "S1"),
+                                                dateOfBirth: victimDob,
+                                                email: victimEmail,
+                                                phone: victimPhone,
+                                            })];
+                                    case 1:
+                                        victim = _d.sent();
+                                        createdEnduserIds.push(victim.id);
+                                        attackerEmail = emailFor('atk-s1');
+                                        return [4 /*yield*/, startFormOn(autoMergeIntake.form.id, { skipMatch: true })];
+                                    case 2:
+                                        session = _d.sent();
+                                        if (session.enduserId)
+                                            createdEnduserIds.push(session.enduserId);
+                                        sourceId = session.enduserId;
+                                        f = autoMergeIntake;
+                                        return [4 /*yield*/, asEnduser(session.authToken).api.form_responses.submit_form_response({
+                                                accessCode: session.accessCode,
+                                                responses: [
+                                                    { fieldId: f.fname.id, fieldTitle: f.fname.title, answer: { type: 'string', value: victim.fname } },
+                                                    { fieldId: f.lname.id, fieldTitle: f.lname.title, answer: { type: 'string', value: victim.lname } },
+                                                    { fieldId: f.dateOfBirth.id, fieldTitle: f.dateOfBirth.title, answer: { type: 'dateString', value: victimDob } },
+                                                    { fieldId: f.email.id, fieldTitle: f.email.title, answer: { type: 'email', value: attackerEmail } },
+                                                    { fieldId: f.custom.id, fieldTitle: f.custom.title, answer: { type: 'string', value: 'merged-ok' } },
+                                                ],
+                                            })];
+                                    case 3:
+                                        _d.sent();
+                                        return [4 /*yield*/, pollEnduser(victim.id, function (e) { return e.email === attackerEmail; }, OVERWRITE_WINDOW_MS)];
+                                    case 4:
+                                        after = (_d.sent()).enduser;
+                                        merged = ((_a = after === null || after === void 0 ? void 0 : after.mergedIds) !== null && _a !== void 0 ? _a : []).includes(sourceId);
+                                        record('G26', 'auto-merge actually resolved to the victim (probe validity)', merged, "mergedIds=".concat(JSON.stringify(after === null || after === void 0 ? void 0 : after.mergedIds), " source=").concat(sourceId));
+                                        customLanded = ((_b = after === null || after === void 0 ? void 0 : after.fields) === null || _b === void 0 ? void 0 : _b[MERGE_CUSTOM_KEY]) === 'merged-ok';
+                                        record('G26', 'non-auth intake fields still reconcile onto the merged patient (anti-vacuity)', customLanded, "fields.".concat(MERGE_CUSTOM_KEY, "=").concat(JSON.stringify((_c = after === null || after === void 0 ? void 0 : after.fields) === null || _c === void 0 ? void 0 : _c[MERGE_CUSTOM_KEY])));
+                                        record('G26', "".concat(G26_NAME, " \u2014 email"), (after === null || after === void 0 ? void 0 : after.email) === victimEmail, (after === null || after === void 0 ? void 0 : after.email) === victimEmail
+                                            ? "email still ".concat(victimEmail)
+                                            : "EXPLOIT: auto-merge intake write set ".concat(after === null || after === void 0 ? void 0 : after.email, " on the merged-into victim"));
+                                        record('G26', "".concat(G26_NAME, " \u2014 phone"), (after === null || after === void 0 ? void 0 : after.phone) === victimPhone, (after === null || after === void 0 ? void 0 : after.phone) === victimPhone ? "phone still ".concat(victimPhone) : "EXPLOIT: phone became ".concat(after === null || after === void 0 ? void 0 : after.phone));
+                                        return [2 /*return*/];
+                                }
+                            });
+                        }); })
+                        // ---------------------------------------------------------------------------------------------
+                        // G27 — The STAFF merge re-points responses too, and must also apply the lock.
+                        //
+                        // Same shape as G26 but through endusers.merge rather than autoMergeOnSubmission: the response is
+                        // created by a skipMatch public session (so the flag is correctly false — a fresh record really was
+                        // inserted), then staff resolve that ephemeral duplicate into a real patient. The merge loop copies
+                        // enduserId onto every model that has one, so without the fix the response ends up attached to a
+                        // patient who pre-existed it while still carrying a stale `false`.
+                        //
+                        // Note the source enduser is DELETED by the merge, which kills the original public token — so the
+                        // stored flag is the load-bearing assertion here, not a follow-up submit.
+                        // ---------------------------------------------------------------------------------------------
+                    ];
+                case 51:
+                    _r.sent();
+                    G27_NAME = 'staff merge applies the lock when it repoints a response';
+                    return [4 /*yield*/, runScenario('G27', G27_NAME, function () { return __awaiter(void 0, void 0, void 0, function () {
+                            var victimEmail, victim, session, beforeMerge, afterMerge, repointed, stillVictim;
+                            return __generator(this, function (_a) {
+                                switch (_a.label) {
+                                    case 0:
+                                        victimEmail = emailFor('lock-t1');
+                                        return [4 /*yield*/, makeVictim('T1', { email: victimEmail, phone: nextPhone() })];
+                                    case 1:
+                                        victim = _a.sent();
+                                        return [4 /*yield*/, startFormOn(intake.form.id, { skipMatch: true })];
+                                    case 2:
+                                        session = _a.sent();
+                                        if (session.enduserId)
+                                            createdEnduserIds.push(session.enduserId);
+                                        return [4 /*yield*/, sdk.api.form_responses.getSome({ filter: { accessCode: session.accessCode } })
+                                            // Probe validity: if this were already true the test could not distinguish the fix from the
+                                            // pre-existing state.
+                                        ];
+                                    case 3:
+                                        beforeMerge = (_a.sent())[0];
+                                        // Probe validity: if this were already true the test could not distinguish the fix from the
+                                        // pre-existing state.
+                                        record('G27', 'skipMatch response starts unlocked (probe validity)', (beforeMerge === null || beforeMerge === void 0 ? void 0 : beforeMerge.authFieldIntakeDisabled) === false, "authFieldIntakeDisabled=".concat(JSON.stringify(beforeMerge === null || beforeMerge === void 0 ? void 0 : beforeMerge.authFieldIntakeDisabled)));
+                                        return [4 /*yield*/, sdk.api.endusers.merge({
+                                                sourceEnduserId: session.enduserId,
+                                                destinationEnduserId: victim.id,
+                                            })];
+                                    case 4:
+                                        _a.sent();
+                                        return [4 /*yield*/, sdk.api.form_responses.getSome({ filter: { accessCode: session.accessCode } })];
+                                    case 5:
+                                        afterMerge = (_a.sent())[0];
+                                        repointed = (afterMerge === null || afterMerge === void 0 ? void 0 : afterMerge.enduserId) === victim.id;
+                                        record('G27', 'merge repointed the response at the pre-existing patient (probe validity)', repointed, "enduserId=".concat(afterMerge === null || afterMerge === void 0 ? void 0 : afterMerge.enduserId, " expected=").concat(victim.id));
+                                        record('G27', G27_NAME, (afterMerge === null || afterMerge === void 0 ? void 0 : afterMerge.authFieldIntakeDisabled) === true, (afterMerge === null || afterMerge === void 0 ? void 0 : afterMerge.authFieldIntakeDisabled) === true
+                                            ? 'authFieldIntakeDisabled=true'
+                                            : "EXPLOIT: response now points at pre-existing patient ".concat(victim.id, " with ")
+                                                + "authFieldIntakeDisabled=".concat(JSON.stringify(afterMerge === null || afterMerge === void 0 ? void 0 : afterMerge.authFieldIntakeDisabled), " \u2014 ")
+                                                + "an intake email/phone answer would repoint their login channel");
+                                        return [4 /*yield*/, sdk.api.endusers.getOne(victim.id).catch(function () { return null; })];
+                                    case 6:
+                                        stillVictim = _a.sent();
+                                        record('G27', 'merge did not itself move the victim email', (stillVictim === null || stillVictim === void 0 ? void 0 : stillVictim.email) === victimEmail, "email=".concat((stillVictim === null || stillVictim === void 0 ? void 0 : stillVictim.email) || '(unset)', " expected=").concat(victimEmail));
+                                        return [2 /*return*/];
+                                }
+                            });
+                        }); })
+                        // ---------------------------------------------------------------------------------------------
+                        // G28 — SCOPE BOUNDARY for the Stripe intake grace.
+                        //
+                        // The formsort / form-ingestion webhook re-opens a BLANK email/phone for one hour after the Stripe
+                        // integration creates a contact (enduser_is_provisional_stripe_record, exercised by G12/R12-R15 in
+                        // formsort_webhook_auth_field_lock.test.ts). That endpoint is API-key authenticated. THIS path is
+                        // anonymous, and its match only needs a name + DOB or an email, so the same exemption here would
+                        // hand an attacker an OTP login channel on a patient who just paid. It must not apply.
+                        //
+                        // This gate exists because the tempting refactor — moving the grace down into
+                        // save_enduser_updates_for_form_response, the single chokepoint — would silently extend it to every
+                        // caller including this one, with no other test noticing.
+                        // ---------------------------------------------------------------------------------------------
+                    ];
+                case 52:
+                    _r.sent();
+                    G28_NAME = 'a fresh Stripe-created patient gets no grace on the public form path';
+                    return [4 /*yield*/, runScenario('G28', G28_NAME, function () { return __awaiter(void 0, void 0, void 0, function () {
+                            var victimEmail, victim, attackerEmail, attackerPhone, session, enduser;
+                            return __generator(this, function (_a) {
+                                switch (_a.label) {
+                                    case 0:
+                                        victimEmail = emailFor('lock-stripe');
+                                        return [4 /*yield*/, makeVictim('Stripe', {
+                                                email: victimEmail,
+                                                source: 'Stripe',
+                                                stripeCustomerId: "cus_".concat(RUN, "g28"),
+                                            })];
+                                    case 1:
+                                        victim = _a.sent();
+                                        attackerEmail = emailFor('atk-stripe');
+                                        attackerPhone = nextPhone();
+                                        return [4 /*yield*/, startFormOn(intake.form.id, {
+                                                fname: victim.fname, lname: victim.lname, dateOfBirth: victim.dateOfBirth,
+                                            })];
+                                    case 2:
+                                        session = _a.sent();
+                                        if (session.enduserId)
+                                            createdEnduserIds.push(session.enduserId);
+                                        if (session.enduserId !== victim.id) {
+                                            record('G28', G28_NAME, false, "probe invalid \u2014 endpoint inserted ".concat(session.enduserId, " instead of matching victim ").concat(victim.id));
+                                            return [2 /*return*/];
+                                        }
+                                        return [4 /*yield*/, asEnduser(session.authToken).api.form_responses.submit_form_response({
+                                                accessCode: session.accessCode,
+                                                responses: intakeAnswers(intake, attackerEmail, attackerPhone),
+                                            })];
+                                    case 3:
+                                        _a.sent();
+                                        return [4 /*yield*/, pollEnduser(victim.id, function (e) { return e.email === attackerEmail || e.phone === attackerPhone; }, OVERWRITE_WINDOW_MS)
+                                            // phone is UNSET on the victim, so this is exactly the shape the webhook grace would have filled
+                                        ];
+                                    case 4:
+                                        enduser = (_a.sent()).enduser;
+                                        // phone is UNSET on the victim, so this is exactly the shape the webhook grace would have filled
+                                        record('G28', "".concat(G28_NAME, " \u2014 phone"), !(enduser === null || enduser === void 0 ? void 0 : enduser.phone), (enduser === null || enduser === void 0 ? void 0 : enduser.phone)
+                                            ? "EXPLOIT: intake answer wrote phone ".concat(enduser.phone, " on a Stripe-created patient (was unset)")
+                                            : 'phone still (unset)');
+                                        record('G28', "".concat(G28_NAME, " \u2014 email"), (enduser === null || enduser === void 0 ? void 0 : enduser.email) === victimEmail, (enduser === null || enduser === void 0 ? void 0 : enduser.email) === victimEmail
+                                            ? "email still ".concat(victimEmail)
+                                            : "EXPLOIT: intake answer wrote ".concat(enduser === null || enduser === void 0 ? void 0 : enduser.email, " (was ").concat(victimEmail, ")"));
+                                        return [2 /*return*/];
+                                }
+                            });
+                        }); })
+                        // ---------------------------------------------------------------------------------------------
+                        // Report
+                        // ---------------------------------------------------------------------------------------------
+                    ];
+                case 53:
+                    _r.sent();
+                    failures = results.filter(function (r) { return !r.ok; });
+                    skipped = results.filter(function (r) { return !!r.skipped; });
+                    console.log('');
+                    console.log('   ┌─ Public endpoint auth-field lock — summary ────────────────────────────');
+                    for (_d = 0, results_1 = results; _d < results_1.length; _d++) {
+                        r = results_1[_d];
+                        status_1 = r.skipped ? 'SKIP' : r.ok ? 'PASS' : 'FAIL';
+                        console.log("   \u2502 ".concat(status_1, "  ").concat(r.group.padEnd(3), "  ").concat(r.name).concat(r.detail ? "  \u2014  ".concat(r.detail) : ''));
+                    }
+                    console.log("   \u2514\u2500 ".concat(results.length - failures.length, "/").concat(results.length, " passed, ").concat(skipped.length, " skipped, ").concat(failures.length, " failed"));
+                    console.log('');
+                    _e = 0, createdEventIds_1 = createdEventIds;
+                    _r.label = 54;
+                case 54:
+                    if (!(_e < createdEventIds_1.length)) return [3 /*break*/, 57];
+                    id = createdEventIds_1[_e];
+                    return [4 /*yield*/, sdk.api.calendar_events.deleteOne(id).catch(function () { return null; })];
+                case 55:
+                    _r.sent();
+                    _r.label = 56;
+                case 56:
+                    _e++;
+                    return [3 /*break*/, 54];
+                case 57:
+                    _f = 0, createdFormIds_1 = createdFormIds;
+                    _r.label = 58;
+                case 58:
+                    if (!(_f < createdFormIds_1.length)) return [3 /*break*/, 64];
+                    formId = createdFormIds_1[_f];
+                    return [4 /*yield*/, sdk.api.form_responses.getSome({ filter: { formId: formId } }).catch(function () { return []; })];
+                case 59:
+                    responses = _r.sent();
+                    _g = 0, responses_1 = responses;
+                    _r.label = 60;
+                case 60:
+                    if (!(_g < responses_1.length)) return [3 /*break*/, 63];
+                    response = responses_1[_g];
+                    return [4 /*yield*/, sdk.api.form_responses.deleteOne(response.id).catch(function () { return null; })];
+                case 61:
+                    _r.sent();
+                    _r.label = 62;
+                case 62:
+                    _g++;
+                    return [3 /*break*/, 60];
+                case 63:
+                    _f++;
+                    return [3 /*break*/, 58];
+                case 64:
+                    _h = 0, createdFormFieldIds_1 = createdFormFieldIds;
+                    _r.label = 65;
+                case 65:
+                    if (!(_h < createdFormFieldIds_1.length)) return [3 /*break*/, 68];
+                    id = createdFormFieldIds_1[_h];
+                    return [4 /*yield*/, sdk.api.form_fields.deleteOne(id).catch(function () { return null; })];
+                case 66:
+                    _r.sent();
+                    _r.label = 67;
+                case 67:
+                    _h++;
+                    return [3 /*break*/, 65];
+                case 68:
+                    _j = 0, createdFormIds_2 = createdFormIds;
+                    _r.label = 69;
+                case 69:
+                    if (!(_j < createdFormIds_2.length)) return [3 /*break*/, 72];
+                    id = createdFormIds_2[_j];
+                    return [4 /*yield*/, sdk.api.forms.deleteOne(id).catch(function () { return null; })];
+                case 70:
+                    _r.sent();
+                    _r.label = 71;
+                case 71:
+                    _j++;
+                    return [3 /*break*/, 69];
+                case 72:
+                    uniqueEnduserIds = createdEnduserIds.filter(function (id, i) { return !!id && createdEnduserIds.indexOf(id) === i; });
+                    _k = 0, uniqueEnduserIds_1 = uniqueEnduserIds;
+                    _r.label = 73;
+                case 73:
+                    if (!(_k < uniqueEnduserIds_1.length)) return [3 /*break*/, 76];
+                    id = uniqueEnduserIds_1[_k];
+                    return [4 /*yield*/, sdk.api.endusers.deleteOne(id).catch(function () { return null; })];
+                case 74:
+                    _r.sent();
+                    _r.label = 75;
+                case 75:
+                    _k++;
+                    return [3 /*break*/, 73];
+                case 76:
+                    _l = 0, createdTemplateIds_1 = createdTemplateIds;
+                    _r.label = 77;
+                case 77:
+                    if (!(_l < createdTemplateIds_1.length)) return [3 /*break*/, 80];
+                    id = createdTemplateIds_1[_l];
+                    return [4 /*yield*/, sdk.api.calendar_event_templates.deleteOne(id).catch(function () { return null; })];
+                case 78:
+                    _r.sent();
+                    _r.label = 79;
+                case 79:
+                    _l++;
+                    return [3 /*break*/, 77];
+                case 80:
+                    _m = 0, createdUserIds_1 = createdUserIds;
+                    _r.label = 81;
+                case 81:
+                    if (!(_m < createdUserIds_1.length)) return [3 /*break*/, 84];
+                    id = createdUserIds_1[_m];
+                    return [4 /*yield*/, sdk.api.users.deleteOne(id).catch(function () { return null; })];
+                case 82:
+                    _r.sent();
+                    _r.label = 83;
+                case 83:
+                    _m++;
+                    return [3 /*break*/, 81];
+                case 84:
+                    // ---------------------------------------------------------------------------------------------
+                    // Assert — single pass, last, so the full table above is always printed first.
+                    // ---------------------------------------------------------------------------------------------
+                    for (_o = 0, results_2 = results; _o < results_2.length; _o++) {
+                        r = results_2[_o];
+                        assert(r.ok, "\u274C [".concat(r.group, "] ").concat(r.name, " \u2014 ").concat(r.detail), "[".concat(r.group, "] ").concat(r.name).concat(r.skipped ? ' (SKIPPED)' : ''));
+                    }
+                    return [2 /*return*/];
+            }
+        });
+    });
+};
+// Allow running this test file independently
+if (require.main === module) {
+    console.log("\uD83C\uDF10 Using API URL: ".concat(host));
+    var sdk_1 = new Session({ host: host });
+    var sdkNonAdmin_1 = new Session({ host: host });
+    var runTests = function () { return __awaiter(void 0, void 0, void 0, function () {
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0: return [4 /*yield*/, setup_tests(sdk_1, sdkNonAdmin_1)];
+                case 1:
+                    _a.sent();
+                    return [4 /*yield*/, public_endpoint_auth_field_lock_tests({ sdk: sdk_1, sdkNonAdmin: sdkNonAdmin_1 })];
+                case 2:
+                    _a.sent();
+                    return [2 /*return*/];
+            }
+        });
+    }); };
+    runTests()
+        .then(function () {
+        console.log("✅ Public endpoint auth field lock test suite completed successfully");
+        process.exit(0);
+    })
+        .catch(function (error) {
+        console.error("❌ Public endpoint auth field lock test suite failed:", error);
+        process.exit(1);
+    });
+}
+//# sourceMappingURL=public_endpoint_auth_field_lock.test.js.map