@tellescope/sdk 1.256.15 → 2.0.0-beta.0

package/src/tests/api_tests/validation_behavior_locks.test.ts

@@ -0,0 +1,204 @@
+import { dateValidator, dateOptionalOrEmptyStringValidator, dateValidatorOptional, slugValidator, urlValidator } from "@tellescope/validation"
+
+// Pins the accept-sets of the validators whose behavior is delegated to the `validator` package, so
+// a dependency upgrade cannot move what the API accepts without a test failing.
+//
+// These assertions describe PRODUCTION — deliberately, including the parts that are wrong. Two of
+// them are: a bare `YYYY-MM-DD` is rejected while an ISO datetime is accepted, and an unparseable
+// string is accepted and persisted as an `Invalid Date`. Both predate this work and both are
+// API-visible across ~135 schema fields, so changing them belongs in its own PR. Pinning them is
+// what makes this file useful: it is proof of how the deployed API behaves, not an aspiration.
+//
+// Why it was needed. Validator 13.11.0's `isDate` was timezone-dependent — its last step compared a
+// UTC-parsed date against a local-time `.getDate()` — so it answered false west of Greenwich and
+// true in UTC. The servers run UTC, so the behavior pinned below is what production has been doing,
+// while the same code on a US developer's machine did the opposite. 13.12.0 fixed that (#2257), and
+// 13.15.35 was verified to return exactly what 13.11.0 returned under UTC, across 26 inputs and four
+// timezones. So every assertion here holds in EVERY timezone — that is the point of the file, and
+// the reason it can be trusted as a statement about production while running on a laptop.
+//
+// The `isSlug` half is different: 13.15.35 genuinely narrowed it (lowercase-only, alphanumeric ends,
+// 1-character minimum), which would have moved the subdomain accept-set. `validation.ts` pins
+// 13.11.0's pattern inline instead, and the checks below are that pattern.
+//
+// The `isURL` half (section 5) is neither: 13.11.0 and 13.15.35 were compared across 37 URL inputs
+// and agreed on every one, so nothing was at risk in that upgrade and nothing needed pinning inline.
+// It is here as a forward guard — webhook destinations are customer-configured and an accept-set that
+// narrows silently breaks live integrations — and because the staging QA asserted this behavior with
+// no test behind it. `isURL` reads no clock, so that section has no timezone caveat.
+//
+// Pure-function test — no Session needed. Runs as part of the main suite and standalone:
+//   npm run test:modular -- api_tests/validation_behavior_locks
+//   TZ=UTC npm run test:modular -- api_tests/validation_behavior_locks   (must give the same result)
+
+// Every assertion runs before anything throws, so one run reports the complete diff rather than the
+// first case that happened to trip.
+const failures: string[] = []
+
+const accepts = (label: string, validate: (v: any) => any, value: any) => {
+  try { validate(value) }
+  catch (err: any) { failures.push(`${label}: expected to ACCEPT ${JSON.stringify(value)}, but it was rejected (${err?.message || err})`) }
+}
+
+const rejects = (label: string, validate: (v: any) => any, value: any) => {
+  let accepted = false
+  try { validate(value); accepted = true }
+  catch { /* expected */ }
+  if (accepted) failures.push(`${label}: expected to REJECT ${JSON.stringify(value)}, but it was accepted`)
+}
+
+export const validation_behavior_lock_tests = async () => {
+  console.log(`Running validation behavior lock tests (TZ=${process.env.TZ || Intl.DateTimeFormat().resolvedOptions().timeZone})`)
+
+  const date = dateValidator.validate()
+  const dateOptional = dateValidatorOptional.validate()
+  const dateOrEmpty = dateOptionalOrEmptyStringValidator.validate()
+
+  // -----------------------------------------------------------------------------------------------
+  // 1. Date fields: ISO datetimes are accepted
+  // -----------------------------------------------------------------------------------------------
+  // What the SDK sends, since JSON.stringify turns a Date into one of these.
+  for (const value of [
+    '2024-06-15T14:30:00Z',
+    '2024-06-15T00:00:00.000Z',
+    '2024-06-15T14:30:00+05:00',
+  ]) {
+    accepts('dateValidator', date, value)
+    accepts('dateValidatorOptional', dateOptional, value)
+    accepts('dateOptionalOrEmptyStringValidator', dateOrEmpty, value)
+  }
+
+  // Epoch milliseconds round-trip through `new Date()`.
+  accepts('dateValidator', date, 1718400000000)
+
+  // The empty string is the "cleared" value for the two lenient variants only.
+  accepts('dateOptionalOrEmptyStringValidator', dateOrEmpty, '')
+  rejects('dateValidator', date, '')
+
+  // -----------------------------------------------------------------------------------------------
+  // 2. Date fields: a bare calendar date is REJECTED
+  // -----------------------------------------------------------------------------------------------
+  // Surprising, and not a typo. `isDate` returns true for these and the check is inverted, so they
+  // 400. This is long-standing production behavior; it is pinned, not endorsed. A client sending
+  // `"1985-03-12"` to a date field gets an error and must send an ISO datetime instead.
+  for (const value of ['1985-03-12', '2024-01-01', '2026-10-01', '2000-02-29', '1999/12/31']) {
+    rejects('dateValidator', date, value)
+    rejects('dateValidatorOptional', dateOptional, value)
+  }
+
+  // A real Date object is rejected by the same mechanism (isDate is true for one). Nothing sends a
+  // Date over HTTP, so this only reaches internal callers — but the three validators disagree here:
+  // the `dateOrEmpty` variant coerces with `.toString()` first, producing "Sat Jun 15 2024 ...",
+  // which isDate calls false, so it accepts. Pinned because it is a real inconsistency.
+  rejects('dateValidator', date, new Date('2024-06-15T14:30:00Z'))
+  rejects('dateValidatorOptional', dateOptional, new Date('2024-06-15T14:30:00Z'))
+  accepts('dateOptionalOrEmptyStringValidator', dateOrEmpty, new Date('2024-06-15T14:30:00Z'))
+
+  // -----------------------------------------------------------------------------------------------
+  // 3. Date fields: an unparseable string is ACCEPTED and stored as an Invalid Date
+  // -----------------------------------------------------------------------------------------------
+  // A data-corruption path, pinned so it is documented and so a future fix is a deliberate, visible
+  // change rather than a silent one. `new Date('not a date')` is an Invalid Date, and it is what
+  // gets written.
+  for (const value of ['not a date', 'hello world', 'tomorrow', '??']) {
+    accepts('dateValidator', date, value)
+    accepts('dateValidatorOptional', dateOptional, value)
+    accepts('dateOptionalOrEmptyStringValidator', dateOrEmpty, value)
+  }
+
+  // -----------------------------------------------------------------------------------------------
+  // 4. Organization subdomain
+  // -----------------------------------------------------------------------------------------------
+  const slug = slugValidator.validate()
+
+  // Valid, and must stay valid — 13.15.35's isSlug would reject the mixed-case ones.
+  for (const value of ['acme', 'acme-health', 'tellescope-demo', 'demo_org_1', 'Acme', 'My-Org', 'TellescopeDemo', 'abc']) {
+    accepts('slugValidator', slug, value)
+  }
+
+  // Also accepted today, though none of these are valid DNS labels. Pinned so the upgrade does not
+  // quietly change them; tightening is a separate decision.
+  for (const value of ['acme.health', 'org/sub', 'my@org', 'org?x=1']) {
+    accepts('slugValidator', slug, value)
+  }
+
+  // Rejected today — note 13.15.35's isSlug would ACCEPT the 1- and 2-character cases.
+  for (const value of ['a', 'ab', 'my--org', 'my__org', '-acme', 'acme-', 'org name']) {
+    rejects('slugValidator', slug, value)
+  }
+
+  // -----------------------------------------------------------------------------------------------
+  // 5. Webhook and other URL fields
+  // -----------------------------------------------------------------------------------------------
+  // `urlValidator` is a thin `isURL` passthrough behind `build_validator`, used for webhook
+  // subscriptions (schema `webhooks.url`) among others. It is a SYNTAX check only — refusing internal
+  // destinations is a separate layer (`api/modules/outbound_url.ts`), which is why several things
+  // accepted here are refused at delivery time.
+  const url = urlValidator.validate()
+
+  // Ports and query strings, the cases the staging QA calls out.
+  for (const value of [
+    'https://example.com:8443/hook',
+    'https://example.com/hook?a=1&b=two',
+    'https://example.com:8443/hook?a=1',
+    'https://example.com/a?b=c&d=%7B%22x%22%3A1%7D', // percent-encoded JSON in the query
+    'https://example.com:443/hook',
+    'https://example.com:8443',                      // port, no path
+    'https://example.com/hook#frag',
+    'HTTPS://EXAMPLE.COM/Hook',
+    'https://[::1]:8443/hook',
+  ]) {
+    accepts('urlValidator', url, value)
+  }
+
+  // Accepted, but quirks rather than intent — pinned like the date quirks above so that tightening any
+  // of them is a deliberate, visible change.
+  //  - schemeless: values of this shape exist in the webhooks collection today (outbound_url.ts:213)
+  //  - ftp: isURL's default protocol list is http/https/ftp
+  //  - the last two are refused by assertPublicHttpUrl at delivery, not here
+  for (const value of [
+    'api.customer.com/hook',
+    'ftp://example.com/x',
+    'http://10.0.0.1/hook',
+    'https://user:pass@example.com/hook',
+  ]) {
+    accepts('urlValidator', url, value)
+  }
+
+  // Rejected. `localhost` fails isURL's require_tld, which defaults on — a local webhook receiver has
+  // to be configured as 127.0.0.1, and that is why the SSRF suite binds loopback by address.
+  for (const value of [
+    'http://localhost:8080/hook',
+    'localhost:8080/hook',
+    'https://example.com:65536/hook',
+    'https://example.com:0/hook',
+    'https://example.com:abc/x',
+    'javascript:alert(1)',
+    'file:///etc/passwd',
+    'mailto:a@b.com',
+    '//example.com/hook',
+    'not a url',
+    'https://example.com/hook with space',
+    'https://example.com./hook', // trailing dot
+  ]) {
+    rejects('urlValidator', url, value)
+  }
+
+  // Non-string and absent values. The empty string is rejected by build_validator's non-empty rule
+  // rather than by isURL, so it is pinned separately from the malformed strings above.
+  rejects('urlValidator', url, '')
+  rejects('urlValidator', url, 123)
+  rejects('urlValidator', url, null)
+  rejects('urlValidator', url, undefined)
+
+  if (failures.length) {
+    throw new Error(`${failures.length} validation behavior lock(s) broken:\n  - ` + failures.join('\n  - '))
+  }
+  console.log("✅ validation behavior lock tests passed")
+}
+
+if (require.main === module) {
+  validation_behavior_lock_tests()
+    .then(() => { console.log("✅ suite completed"); process.exit(0) })
+    .catch((err) => { console.error("❌ suite failed:", err); process.exit(1) })
+}

package/src/tests/public_endpoint_tests.ts

@@ -9,6 +9,7 @@ import {
 } from "@tellescope/utilities"
 import { Session, /* APIQuery */ } from "../sdk"
 import { PublicEndpoints } from "../public"
+import { reset_test_tenant } from "./setup"
 
 const host = process.env.API_URL || 'http://localhost:8080'
 const [email, password] = [process.env.TEST_EMAIL, process.env.TEST_PASSWORD]
@@ -18,7 +19,7 @@ const sdkPub = PublicEndpoints({ host })
 
 if (!(email && password)) {
   console.error("Set TEST_EMAIL and TEST_PASSWORD")
-  process.exit()
+  process.exit(1) // 1, not 0: an unconfigured run must not report success
 }
 
 const enduser_login_tests = async () => {
@@ -59,7 +60,7 @@ const enduser_login_tests = async () => {
 
   try {
     await sdk.authenticate(email, password)
-    await sdk.reset_db()
+    await reset_test_tenant(sdk)
 
     await enduser_login_tests()
   } catch(err) {

package/src/tests/setup.ts

@@ -9,19 +9,55 @@ import {
   assert,
 } from "@tellescope/testing"
 
+import { test_support_request } from "./setup_isolated"
+
 const host = process.env.API_URL || 'http://localhost:8080' as const
 const [email, password] = [process.env.TEST_EMAIL, process.env.TEST_PASSWORD]
 const [nonAdminEmail, nonAdminPassword] = [process.env.NON_ADMIN_EMAIL, process.env.NON_ADMIN_PASSWORD]
-const businessId = '60398b1131a295e64f084ff6'
 
+/** The hand-seeded shared fixture this suite was written against; still the default. */
+export const LEGACY_TEST_BUSINESS_ID = '60398b1131a295e64f084ff6'
+const businessId = process.env.TEST_BUSINESS_ID || LEGACY_TEST_BUSINESS_ID
+// The legacy fixture's local API key. `npm run bootstrap` writes a provisioned tenant's key to
+// TEST_API_KEY, so a fresh checkout does not need a copy of anyone's database.
+const apiKey = process.env.TEST_API_KEY || '3n5q0SCBT_iUvZz-b9BJtX7o7HQUVJ9v132PgHJNJsg.'
+
+// exit 1, not 0: a bare process.exit() reports success, which turns "nobody configured the
+// credentials" into a silently passing test run
 if (!(email && password)) {
   console.error("Set TEST_EMAIL and TEST_PASSWORD")
-  process.exit()
+  process.exit(1)
 }
 
 if (!(nonAdminEmail && nonAdminPassword)) {
   console.error("Set NON_ADMIN_EMAIL and NON_ADMIN_PASSWORD")
-  process.exit()
+  process.exit(1)
+}
+
+/**
+ * Per-run database reset for whichever tenant the fixture is pointed at.
+ *
+ * The legacy path is `sdk.reset_db()` (POST /reset-demo): it deletes a HARDCODED businessId's records
+ * plus six global throttle namespaces, and requires a session whose email is in the API's
+ * ADMIN_EMAILS allowlist — so it does nothing useful for, and is not even authorized for, a tenant
+ * provisioned by /test-support. That tenant resets through /test-support/reset-tenant instead, which
+ * is scoped to its own businessId and keeps the org, users, API keys and roles the caller is holding.
+ *
+ * `clearGlobalThrottles` is requested here (and honored only under LOCAL) because this is the shared
+ * fixture: setup_tests deliberately exhausts login throttles and must clear them, exactly as
+ * reset_db did. Isolated tests use `reset_isolated_tenant`, which never touches global state.
+ */
+export const reset_test_tenant = async (sdk: Session) => {
+  const id = sdk.userInfo?.businessId || businessId
+  const provisioned = process.env.TEST_TENANT_PROVISIONED === 'true' || id !== LEGACY_TEST_BUSINESS_ID
+  if (!provisioned) { await sdk.reset_db(); return }
+
+  const { status, body } = await test_support_request('/reset-tenant', {
+    businessId: id, clearGlobalThrottles: true,
+  })
+  if (status !== 200) {
+    throw new Error(`test-support /reset-tenant failed (${status}): ${JSON.stringify(body)}`)
+  }
 }
 
 const passOnAnyResult = { shouldError: false, onResult: () => true }
@@ -49,7 +85,7 @@ export const setup_tests = async (sdk: Session, sdkNonAdmin: Session) => {
 
   await async_test(
     'test_authenticated (with API Key)', 
-    (new Session({ host, apiKey: '3n5q0SCBT_iUvZz-b9BJtX7o7HQUVJ9v132PgHJNJsg.' /* local test key */  })).test_authenticated, 
+    (new Session({ host, apiKey })).test_authenticated, 
     { expectedResult: 'Authenticated!' }
   )
 
@@ -71,7 +107,7 @@ export const setup_tests = async (sdk: Session, sdkNonAdmin: Session) => {
     passOnAnyResult
   )
 
-  const badEnduserSDK = new EnduserSession({ host, businessId });
+  const badEnduserSDK = new EnduserSession({ host, businessId: sdk.userInfo.businessId });
   await badEnduserSDK.authenticate('bademail@tellescope.com', 'badpassword').catch(console.error)
   await badEnduserSDK.authenticate('bademail@tellescope.com', 'badpassword').catch(console.error)
   await badEnduserSDK.authenticate('bademail@tellescope.com', 'badpassword').catch(console.error)
@@ -89,7 +125,7 @@ export const setup_tests = async (sdk: Session, sdkNonAdmin: Session) => {
   )
 
   // prevent additional login throttling
-  await async_test('reset_db', () => sdk.reset_db(), passOnVoid)
+  await async_test('reset_test_tenant', () => reset_test_tenant(sdk), passOnVoid)
 
   await sdk.logout()
   await async_test<string, string>('test_authenticated - (logout invalidates jwt)', sdk.test_authenticated, { shouldError: true, onError: e => e === 'Unauthenticated' })
@@ -148,7 +184,7 @@ export const setup_tests = async (sdk: Session, sdkNonAdmin: Session) => {
   await sdkNonAdmin.authenticate(nonAdminEmail, nonAdminPassword)
 
   // may do some stuff in background after returning
-  await async_test('reset_db', () => sdk.reset_db(), passOnVoid)
+  await async_test('reset_test_tenant', () => reset_test_tenant(sdk), passOnVoid)
   await wait(undefined, 250)
 
   // Prevent test-triggered notifications (e.g. timeTrackRejected, inbound-message

package/src/tests/setup_isolated.ts

@@ -103,6 +103,16 @@ export const set_email_verification_code = async (email: string, code: string) =
   post('/set-email-verification-code', { email, code })
 )
 
+/**
+ * Empties a provisioned tenant's records while keeping the tenant, its users, API keys and roles —
+ * for a test that wants a clean slate between phases without re-provisioning.
+ *
+ * Records only: the shared login/IP throttle namespaces are NOT cleared, so this stays safe to call
+ * while another suite is running. (setup.ts's `reset_test_tenant` does ask for those, because the
+ * shared fixture deliberately exhausts login throttles.)
+ */
+export const reset_isolated_tenant = async (businessId: string) => post('/reset-tenant', { businessId })
+
 /** Raw access, for tests that need to assert on the response of a rejected call. */
 export const test_support_request = async (path: string, body: object) => {
   const r = await axios.request({

package/src/tests/socket_tests.ts

@@ -16,6 +16,7 @@ import {
 } from "@tellescope/types-utilities"
 import { EnduserSession } from "../enduser"
 import { Session, /* APIQuery */ } from "../sdk"
+import { reset_test_tenant } from "./setup"
 import { PLACEHOLDER_ID } from "@tellescope/constants"
 import { UserSession } from "@tellescope/types-models"
 
@@ -29,7 +30,7 @@ const host = process.env.API_URL || 'http://localhost:8080'
 const [email, password] = [process.env.TEST_EMAIL, process.env.TEST_PASSWORD]
 const [email2, password2] = [process.env.TEST_EMAIL_2, process.env.TEST_PASSWORD_2]
 const [nonAdminEmail, nonAdminPassword] = [process.env.NON_ADMIN_EMAIL, process.env.NON_ADMIN_PASSWORD]
-const businessId = '60398b1131a295e64f084ff6'
+const businessId = process.env.TEST_BUSINESS_ID || '60398b1131a295e64f084ff6'
 
 const subUserEmail = process.env.SUB_EMAIL
 const otherSubUserEmail = process.env.OTHER_SUB_EMAIL
@@ -487,7 +488,7 @@ const cleanup_cache = () => {
 
   try {
     await user1.authenticate(email, password)
-    await user1.reset_db()
+    await reset_test_tenant(user1)
 
     await Promise.all([
       user2.authenticate(email2, password2), // generate authToken + socket connection for API keyj

package/src/tests/tests.ts

@@ -123,6 +123,9 @@ import { register_business_id_injection_tests } from "./api_tests/security/regis
 import { handle_incoming_communication_cross_tenant_tests } from "./api_tests/security/handle-incoming-communication-cross-tenant.test";
 import { sanitize_user_html_xss_tests } from "./api_tests/security/sanitize-user-html.test";
 import { sanitize_user_html_with_iframes_tests } from "./api_tests/security/sanitize-user-html-with-iframes.test";
+import { validation_behavior_lock_tests } from "./api_tests/validation_behavior_locks.test";
+import { templated_message_date_field_tests } from "./api_tests/templated_message_date_fields.test";
+import { templated_message_link_tests } from "./api_tests/templated_message_links.test";
 import { prototype_pollution_tests } from "./api_tests/security/prototype-pollution.test";
 import { enduser_cross_create_tests } from "./api_tests/security/enduser-cross-create.test";
 import { globalunique_leak_tests } from "./api_tests/security/globalunique-conflict-redaction.test";
@@ -140,6 +143,7 @@ import { automated_actions_process_gate_tests } from "./api_tests/security/autom
 import { schema_adminonly_enforcement_tests } from "./api_tests/security/schema-adminonly-enforcement.test";
 import { startlinktoken_escalation_tests } from "./api_tests/security/startlinktoken-enduser-staff-escalation.test";
 import { form_logic_js_execution_checks } from "./api_tests/security/form-logic-js-execution.test";
+import { rich_text_answer_sanitized_on_write_checks } from "./api_tests/security/rich-text-answer-sanitized-on-write.test";
 import { bulk_assignment_tests } from "./api_tests/bulk_assignment.test";
 import { tickets_bulk_assign_care_team_tests } from "./api_tests/tickets_bulk_assign_care_team.test";
 import { managed_content_enduser_access_tests } from "./api_tests/managed_content_enduser_access.test";
@@ -163,6 +167,7 @@ import { organization_signup_checks } from "./api_tests/organization_signup.test
 import { add_to_journey_foreign_enduserid_checks } from "./api_tests/security/add-to-journey-foreign-enduserid.test";
 import { tickets_bulk_assign_from_queue_checks } from "./api_tests/tickets_bulk_assign_from_queue.test";
 import { enduser_observations_auto_review_checks } from "./api_tests/enduser_observations_auto_review.test";
+import { file_link_session_confinement_checks } from "./api_tests/security/file-link-session-confinement.test";
 import { run_isolated_in_parallel } from "./setup_isolated";
 import { elation_user_id_tests } from "./api_tests/elation_user_id.test";
 import { organization_settings_duplicates_tests } from "./api_tests/organization_settings_duplicates.test";
@@ -204,7 +209,7 @@ const otherSubUserEmail = process.env.OTHER_SUB_EMAIL
 const subSubUserEmail = process.env.SUB_SUB_EMAIL
 
 const userId = '60398b0231a295e64f084fd9'
-const businessId = '60398b1131a295e64f084ff6'
+const businessId = process.env.TEST_BUSINESS_ID || '60398b1131a295e64f084ff6'
 
 // const example_SDK_usage = async () => {
 //   // initialize SDK and authenticate a user
@@ -255,7 +260,7 @@ const enduserSDKDifferentBusinessId = new EnduserSession({ host, businessId: '80
 
 if (!(email && mfaEmail && mfaPassword && subUserEmail && otherSubUserEmail && subSubUserEmail && password && email2 && password2 && nonAdminEmail && nonAdminPassword)) {
   console.error("Set TEST_EMAIL and TEST_PASSWORD")
-  process.exit()
+  process.exit(1) // 1, not 0: an unconfigured run must not report success
 }
 
 const recordNotFound =  { shouldError: true, onError: (e: { message: string }) => e.message === 'Could not find a record for the given id' } 
@@ -15405,6 +15410,8 @@ const ip_address_form_tests = async () => {
       { name: 'Tickets bulk assign from queue', run: tickets_bulk_assign_from_queue_checks },
       { name: 'Vital auto-review on create', run: enduser_observations_auto_review_checks },
       { name: '$JS in stored conditional logic', run: form_logic_js_execution_checks },
+      { name: 'Rich Text answers sanitized on write', run: rich_text_answer_sanitized_on_write_checks },
+      { name: 'Shared file link session confinement', run: file_link_session_confinement_checks },
     ])
     await embeddables_auth_token_tests({ sdk, sdkNonAdmin })
     await proxy_image_ssrf_tests({ sdk, sdkNonAdmin })
@@ -15450,6 +15457,9 @@ const ip_address_form_tests = async () => {
     await self_admin_role_assignment_tests({ sdk, sdkNonAdmin })
     await sanitize_user_html_xss_tests()
     await sanitize_user_html_with_iframes_tests()
+    await validation_behavior_lock_tests()
+    await templated_message_date_field_tests()
+    await templated_message_link_tests()
     await prototype_pollution_tests()
     await account_switcher_tests({ sdk, sdkNonAdmin })
     await totp_mfa_tests({ sdk, sdkNonAdmin })

package/src/tests/webhooks_tests.ts

@@ -31,7 +31,9 @@ const [nonAdminEmail, nonAdminPassword] = [process.env.NON_ADMIN_EMAIL, process.
 const subUserEmail = process.env.SUB_EMAIL
 
 const host = process.env.API_URL || 'http://localhost:8080'
-const businessId = '60398b1131a295e64f084ff6'
+import { reset_test_tenant } from "./setup"
+
+const businessId = process.env.TEST_BUSINESS_ID || '60398b1131a295e64f084ff6'
 const enduserSDK = new EnduserSession({ host, businessId })
 
 if (!(email && subUserEmail && password && email2 && password2 && nonAdminEmail && nonAdminPassword)) {
@@ -754,7 +756,7 @@ const run_tests = async () => {
   log_header("Webhooks Tests")
   await sdk.authenticate(email, password)
   await sdkSub.authenticate(subUserEmail, password)
-  await sdk.reset_db() 
+  await reset_test_tenant(sdk) 
   await nonAdminSdk.authenticate(nonAdminEmail, nonAdminPassword)
 
   await async_test(

package/tsconfig.cjs.json

@@ -0,0 +1,17 @@
+{
+  // CommonJS build (lib/cjs, also where the runnable tests land); see constants/tsconfig.cjs.json.
+  "extends": "./tsconfig.json",
+  "compilerOptions": {
+    "module": "commonjs",
+    "outDir": "lib/cjs",
+    "tsBuildInfoFile": "lib/cjs/tsconfig.cjs.tsbuildinfo"
+  },
+  "references": [
+    { "path": "../constants/tsconfig.cjs.json" },
+    { "path": "../schema/tsconfig.cjs.json" },
+    { "path": "../testing/tsconfig.cjs.json" },
+    { "path": "../types-client/tsconfig.cjs.json" },
+    { "path": "../utilities/tsconfig.cjs.json" },
+    { "path": "../validation/tsconfig.cjs.json" }
+  ]
+}