@tellescope/sdk 1.256.16 → 2.0.0-beta.0

package/package.json

@@ -1,25 +1,25 @@
 {
   "name": "@tellescope/sdk",
-  "version": "1.256.16",
+  "version": "2.0.0-beta.0",
   "description": "Code for interacting with the Tellescope API",
   "main": "./lib/cjs/sdk.js",
   "module": "./lib/esm/sdk.js",
   "types": "./lib/esm/sdk.d.ts",
   "scripts": {
-    "test": "npm run-script build:cjs && npm run-script retest",
+    "test": "npm run-script build:cjs && node ../../../scripts/dev/check-build-fresh.mjs && npm run-script retest",
     "retest": "npm run-script retest-api && npm run-script retest-public-api && npm run-script retest-webhooks",
-    "test-api": "npm run-script build:cjs && npm run-script retest-api",
+    "test-api": "npm run-script build:cjs && node ../../../scripts/dev/check-build-fresh.mjs && npm run-script retest-api",
     "retest-api": "node -r dotenv/config lib/cjs/tests/tests.js",
-    "test-public-api": "npm run-script build:cjs && npm run-script retest-public-api",
+    "test-public-api": "npm run-script build:cjs && node ../../../scripts/dev/check-build-fresh.mjs && npm run-script retest-public-api",
     "retest-public-api": "node -r dotenv/config lib/cjs/tests/public_endpoint_tests.js",
-    "test-sockets": "npm run-script build:cjs && npm run-script retest-sockets",
+    "test-sockets": "npm run-script build:cjs && node ../../../scripts/dev/check-build-fresh.mjs && npm run-script retest-sockets",
     "retest-sockets": "node -r dotenv/config lib/cjs/tests/socket_tests.js",
-    "test-webhooks": "npm run-script build:cjs && npm run-script retest-webhooks",
+    "test-webhooks": "npm run-script build:cjs && node ../../../scripts/dev/check-build-fresh.mjs && npm run-script retest-webhooks",
     "retest-webhooks": "node -r dotenv/config lib/cjs/tests/webhooks_tests.js",
     "build": "npm run-script build:esm && npm run-script build:cjs",
     "build:esm": "tsc",
-    "build:cjs": "tsc --module commonjs --outDir lib/cjs",
-    "watch:cjs": "tsc --module commonjs --outDir lib/cjs --watch"
+    "build:cjs": "tsc -b tsconfig.cjs.json",
+    "watch:cjs": "tsc -b -w --preserveWatchOutput tsconfig.cjs.json"
   },
   "repository": {
     "type": "git",
@@ -31,18 +31,21 @@
     "url": "https://github.com/tellescope-os/tellescope/issues"
   },
   "homepage": "https://github.com/tellescope-os/tellescope#readme",
+  "engines": {
+    "node": ">=22.12.0"
+  },
   "dependencies": {
-    "@tellescope/constants": "1.256.16",
-    "@tellescope/schema": "1.256.16",
-    "@tellescope/testing": "1.256.16",
-    "@tellescope/types-client": "1.256.16",
-    "@tellescope/types-models": "1.256.16",
-    "@tellescope/types-utilities": "1.256.16",
-    "@tellescope/utilities": "1.256.16",
-    "@tellescope/validation": "1.256.16",
-    "axios": "0.30.3",
+    "@tellescope/constants": "2.0.0-beta.0",
+    "@tellescope/schema": "2.0.0-beta.0",
+    "@tellescope/testing": "2.0.0-beta.0",
+    "@tellescope/types-client": "2.0.0-beta.0",
+    "@tellescope/types-models": "2.0.0-beta.0",
+    "@tellescope/types-utilities": "2.0.0-beta.0",
+    "@tellescope/utilities": "2.0.0-beta.0",
+    "@tellescope/validation": "2.0.0-beta.0",
+    "axios": "0.33.0",
     "dotenv": "14.3.2",
-    "form-data": "4.0.4",
+    "form-data": "4.0.6",
     "source-map-support": "0.5.21"
   },
   "devDependencies": {
@@ -55,5 +58,5 @@
   "publishConfig": {
     "access": "public"
   },
-  "gitHead": "5874f0e4ca75d8ce70768a5933cd5bb5b3b15c58"
+  "gitHead": "95b2448bb219e7634e29ef4b7850f8f74d73dcbc"
 }

package/src/sdk.ts

@@ -313,6 +313,9 @@ type Queries = { [K in keyof ClientModelForName]: APIQuery<K> } & {
     get_form_statistics: (args: extractFields<CustomActions['forms']['get_form_statistics']['parameters']>) => (
       Promise<extractFields<CustomActions['forms']['get_form_statistics']['returns']>>
     ),
+    public_form_details: (args: extractFields<PublicActions['forms']['public_form_details']['parameters']>) => (
+      Promise<extractFields<PublicActions['forms']['public_form_details']['returns']>>
+    ),
   },
   phone_trees: {
     start_outbound_call: (args: extractFields<CustomActions['phone_trees']['start_outbound_call']['parameters']>) => (
@@ -1052,6 +1055,7 @@ export class Session extends SessionManager {
     queries.organizations.invite_user = a => this._POST(`/v1/${schema.users.customActions.invite_user.path}`, a) 
 
     queries.forms.get_form_statistics = args => this._GET(`/v1${schema.forms.customActions.get_form_statistics.path}`, args)
+    queries.forms.public_form_details = args => this._GET(`/v1${schema.forms.publicActions.public_form_details.path}`, args)
 
     queries.form_fields.load_choices_from_database = args => this._GET(`/v1${schema.form_fields.customActions.load_choices_from_database.path}`, args)
     queries.form_fields.booking_info = args => this._GET(`/v1${schema.form_fields.customActions.booking_info.path}`, args)
@@ -1350,4 +1354,4 @@ export class Session extends SessionManager {
   sync = (a: { from: Date }) => this.GET<typeof a, { results: Pick<DataSyncRecord, 'modelName' | 'recordId' | 'data'>[], to: string }>('/v1/data-sync', a)
 }
 
-export { SessionOptions }
+export type { SessionOptions }

package/src/tests/api_tests/active_patient_count.test.ts

@@ -10,7 +10,7 @@ import {
 import { authenticate_enduser_via_token, setup_tests } from "../setup"
 
 const host = process.env.API_URL || 'http://localhost:8080' as const
-const businessId = '60398b1131a295e64f084ff6'
+const businessId = process.env.TEST_BUSINESS_ID || '60398b1131a295e64f084ff6'
 
 // Second-tenant session, used to prove the active patient count never crosses tenants.
 // Same key used by the org-isolation tests in tests.ts.

package/src/tests/api_tests/appointment_rescheduled_trigger.test.ts

@@ -3,7 +3,7 @@ import { log_header, wait, async_test } from "@tellescope/testing"
 import { Enduser } from "@tellescope/types-client"
 import { setup_tests } from "../setup"
 
-const host = process.env.TEST_HOST || "http://localhost:8080"
+const host = process.env.API_URL || process.env.TEST_HOST || "http://localhost:8080"
 
 export const appointment_rescheduled_trigger_tests = async ({ sdk, sdkNonAdmin } : { sdk: Session, sdkNonAdmin: Session }) => {
   log_header("Automation Trigger Tests (Appointment Rescheduled)")

package/src/tests/api_tests/calendar_event_references_update.test.ts

@@ -8,7 +8,7 @@ import {
 import { setup_tests, authenticate_enduser_via_token } from "../setup"
 
 const host = process.env.API_URL || 'http://localhost:8080' as const
-const businessId = '60398b1131a295e64f084ff6'
+const businessId = process.env.TEST_BUSINESS_ID || '60398b1131a295e64f084ff6'
 
 /**
  * CU-86e2dvrn9: calendar_events.references switched from updatesDisabled to

package/src/tests/api_tests/enduser_cross_access_isolation.test.ts

@@ -12,7 +12,7 @@ import { ModelName } from "@tellescope/types-models"
 import { authenticate_enduser_via_token, setup_tests } from "../setup"
 
 const host = process.env.API_URL || 'http://localhost:8080' as const
-const businessId = '60398b1131a295e64f084ff6'
+const businessId = process.env.TEST_BUSINESS_ID || '60398b1131a295e64f084ff6'
 
 type OwnerField = 'enduserId' | 'enduserIds' | 'attendees.id'
 

package/src/tests/api_tests/enduser_login_rate_limits.test.ts

@@ -6,7 +6,7 @@ import {
   async_test,
   log_header,
 } from "@tellescope/testing"
-import { setup_tests } from "../setup"
+import { reset_test_tenant, setup_tests } from "../setup"
 
 const host = process.env.API_URL || 'http://localhost:8080' as const
 
@@ -43,7 +43,7 @@ export const enduser_login_rate_limits_tests = async ({ sdk, sdkNonAdmin } : { s
   const businessId = sdk.userInfo.businessId
 
   // Ensure throttled_events from prior tests don't bleed in.
-  await sdk.reset_db()
+  await reset_test_tenant(sdk)
 
   // ---- /v1/login-enduser per-IP cap (20/min) ----
   // Bogus emails ensure we never reach the actual DB lookup / login work.
@@ -58,7 +58,7 @@ export const enduser_login_rate_limits_tests = async ({ sdk, sdkNonAdmin } : { s
     { expectedResult: 'tripped' }
   )
 
-  await sdk.reset_db()
+  await reset_test_tenant(sdk)
 
   // ---- /v1/begin-enduser-login-flow per-IP cap (10/min) ----
   // Use distinct emails so the per-identifier limit (5/10min) does NOT trip first;
@@ -73,7 +73,7 @@ export const enduser_login_rate_limits_tests = async ({ sdk, sdkNonAdmin } : { s
     { expectedResult: 'tripped' }
   )
 
-  await sdk.reset_db()
+  await reset_test_tenant(sdk)
 
   // ---- /v1/begin-enduser-login-flow per-identifier cap (5 / 10 min per email) ----
   // Hit a single email below the per-IP cap.
@@ -88,7 +88,7 @@ export const enduser_login_rate_limits_tests = async ({ sdk, sdkNonAdmin } : { s
     { expectedResult: 'tripped' }
   )
 
-  await sdk.reset_db()
+  await reset_test_tenant(sdk)
 
   // ---- /v1/endusers/send-otp-code per-IP cap (5/min) ----
   // Use a bogus JWT-shaped token so we trip the IP guard first (it runs before any DB work).
@@ -116,7 +116,7 @@ export const enduser_login_rate_limits_tests = async ({ sdk, sdkNonAdmin } : { s
 
   // ---- Legitimate-login regression: a single successful login should still go through ----
   // Reset state, then create a real enduser with a password and confirm one login succeeds.
-  await sdk.reset_db()
+  await reset_test_tenant(sdk)
 
   const ts = Date.now()
   const enduser = await sdk.api.endusers.createOne({
@@ -151,7 +151,7 @@ export const enduser_login_rate_limits_tests = async ({ sdk, sdkNonAdmin } : { s
     )
   } finally {
     await sdk.api.endusers.deleteOne(enduser.id).catch(() => null)
-    await sdk.reset_db().catch(() => null)
+    await reset_test_tenant(sdk).catch(() => null)
   }
 }
 

package/src/tests/api_tests/enduser_session_invalidation.test.ts

@@ -7,10 +7,10 @@ import {
   log_header,
   wait,
 } from "@tellescope/testing"
-import { setup_tests } from "../setup"
+import { reset_test_tenant, setup_tests } from "../setup"
 
 const host = process.env.API_URL || 'http://localhost:8080' as const
-const businessId = '60398b1131a295e64f084ff6'
+const businessId = process.env.TEST_BUSINESS_ID || '60398b1131a295e64f084ff6'
 
 // Main test function that can be called independently
 export const enduser_session_invalidation_tests = async ({ sdk, sdkNonAdmin } : { sdk: Session, sdkNonAdmin: Session }) => {
@@ -126,7 +126,7 @@ export const enduser_session_invalidation_tests = async ({ sdk, sdkNonAdmin } :
   }
 
   // Ensure OTP is off and db is clean before starting
-  await sdk.reset_db()
+  await reset_test_tenant(sdk)
   await wait(undefined, 500)
   await resetOTPSettings(sdk)
 
@@ -242,7 +242,7 @@ export const enduser_session_invalidation_tests = async ({ sdk, sdkNonAdmin } :
   )
 
   // Reset rate limiting state before continuing
-  await sdk.reset_db()
+  await reset_test_tenant(sdk)
   await wait(undefined, 500)
 
   // Test 8: Disabling OTP does NOT invalidate sessions

package/src/tests/api_tests/managed_content_enduser_access.test.ts

@@ -9,7 +9,7 @@ import {
 import { setup_tests } from "../setup"
 
 const host = process.env.API_URL || 'http://localhost:8080' as const
-const businessId = '60398b1131a295e64f084ff6'
+const businessId = process.env.TEST_BUSINESS_ID || '60398b1131a295e64f084ff6'
 
 /**
  * Tests for managed_content_records enduser access filtering.

package/src/tests/api_tests/managed_content_file_access.test.ts

@@ -9,7 +9,7 @@ import {
 import { setup_tests } from "../setup"
 
 const host = process.env.API_URL || 'http://localhost:8080' as const
-const businessId = '60398b1131a295e64f084ff6'
+const businessId = process.env.TEST_BUSINESS_ID || '60398b1131a295e64f084ff6'
 
 /**
  * Tests for file_download_URL enduser access via managed content fallback.

package/src/tests/api_tests/mdi_webhooks.test.ts

@@ -75,6 +75,15 @@ export const mdi_webhooks_tests = async ({ sdk, sdkNonAdmin }: { sdk: Session, s
     )
     assert(status === 401, `message_created with bad auth should 401 (got ${status})`, "MDI webhook authenticates before patient lookup")
   }
+
+  // 5. case_order_created / case_order_updated with bogus auth -> still 401.
+  for (const event_type of ['case_order_created', 'case_order_updated']) {
+    const { status } = await postMDI(
+      { event_type, case_id: 'mdi-case-test-1', case_order_id: 'mdi-order-test-1', order_status: 'ready' },
+      { 'Authorization': `Bearer not-a-real-mdi-token-${Date.now()}` },
+    )
+    assert(status === 401, `${event_type} with bad auth should 401 (got ${status})`, `MDI webhook authenticates before ${event_type} dispatch`)
+  }
 }
 
 // Allow running this test file independently

package/src/tests/api_tests/nutrition_tracking.test.ts

@@ -9,7 +9,7 @@ import { ObservationComponent } from "@tellescope/types-models"
 import { authenticate_enduser_via_token, setup_tests } from "../setup"
 
 const host = process.env.API_URL || 'http://localhost:8080' as const
-const businessId = '60398b1131a295e64f084ff6'
+const businessId = process.env.TEST_BUSINESS_ID || '60398b1131a295e64f084ff6'
 
 const ENDUSER_PASSWORD = 'NutritionTestPassword!123'
 

package/src/tests/api_tests/openloop_webhooks.test.ts

@@ -10,7 +10,7 @@ import {
 import { setup_tests } from "../setup"
 
 const host = process.env.API_URL || 'http://localhost:8080' as const
-const businessId = '60398b1131a295e64f084ff6'
+const businessId = process.env.TEST_BUSINESS_ID || '60398b1131a295e64f084ff6'
 
 const v1Url = `${host}/v1/webhooks/openloop/${businessId}`
 const v2Url = `${host}/v1/webhooks/openloop-v2/${businessId}`

package/src/tests/api_tests/security/allowed-paths-confinement.test.ts

@@ -631,7 +631,7 @@ export const allowed_paths_confinement_tests = async ({ sdk } : { sdk: Session,
     // record. `allowedPaths` is a JWT claim only (WithAllowedPaths in types-models is used solely on
     // the session type; there is no schema validator for it), so an API-key session can never carry
     // one and is never path-confined. Assert that rather than reason about it.
-    const apiKeySDK = new Session({ host, apiKey: '3n5q0SCBT_iUvZz-b9BJtX7o7HQUVJ9v132PgHJNJsg.' })
+    const apiKeySDK = new Session({ host, apiKey: process.env.TEST_API_KEY || '3n5q0SCBT_iUvZz-b9BJtX7o7HQUVJ9v132PgHJNJsg.' })
     for (const path of ['/journeys', '/form-responses', '/endusers', '/calendar-events', '/files']) {
       const r = await axios.request({
         method: 'get',

package/src/tests/api_tests/security/booking-info-idor-token-mint.test.ts

@@ -8,7 +8,7 @@ import {
 import { authenticate_enduser_via_token, setup_tests } from "../../setup"
 
 const host = process.env.API_URL || 'http://localhost:8080' as const
-const businessId = '60398b1131a295e64f084ff6'
+const businessId = process.env.TEST_BUSINESS_ID || '60398b1131a295e64f084ff6'
 
 const RAND = () => Math.random().toString(36).slice(2, 10)
 

package/src/tests/api_tests/security/enduser-ai-summary-trust-gate.test.ts

@@ -6,7 +6,7 @@ import { FormResponse } from "@tellescope/types-client"
 import { setup_tests } from "../../setup"
 
 const host = process.env.API_URL || "http://localhost:8080"
-const businessId = '60398b1131a295e64f084ff6'
+const businessId = process.env.TEST_BUSINESS_ID || '60398b1131a295e64f084ff6'
 
 const ENDUSER_PASSWORD = 'AISummaryGateTestPassword!123'
 

package/src/tests/api_tests/security/enduser-cross-create.test.ts

@@ -8,7 +8,7 @@ import {
 import { setup_tests } from "../../setup"
 
 const host = process.env.API_URL || 'http://localhost:8080' as const
-const businessId = '60398b1131a295e64f084ff6'
+const businessId = process.env.TEST_BUSINESS_ID || '60398b1131a295e64f084ff6'
 
 const ENDUSER_PASSWORD = 'F0116TestPassword!123'
 

package/src/tests/api_tests/security/enduser-write-restrictions.test.ts

@@ -8,7 +8,7 @@ import {
 import { setup_tests } from "../../setup"
 
 const host = process.env.API_URL || 'http://localhost:8080' as const
-const businessId = '60398b1131a295e64f084ff6'
+const businessId = process.env.TEST_BUSINESS_ID || '60398b1131a295e64f084ff6'
 
 const ENDUSER_PASSWORD = 'F0106TestPassword!123'
 

package/src/tests/api_tests/security/invite-user-enumeration.test.ts

@@ -7,7 +7,7 @@ import {
   log_header,
   wait,
 } from "@tellescope/testing"
-import { setup_tests } from "../../setup"
+import { reset_test_tenant, setup_tests } from "../../setup"
 
 const host = process.env.API_URL || 'http://localhost:8080' as const
 
@@ -53,7 +53,7 @@ export const invite_user_enumeration_tests = async ({ sdk, sdkNonAdmin } : { sdk
   log_header("users.invite_user cross-tenant enumeration regression")
 
   // Reset state so prior tests' rate-limit accounting doesn't leak in.
-  await sdk.reset_db()
+  await reset_test_tenant(sdk)
 
   const organizationId = sdk.userInfo.organizationIds?.[0] ?? sdk.userInfo.businessId
   // Use the test admin's own email — guaranteed to exist in the test tenant, so every invite
@@ -98,7 +98,7 @@ export const invite_user_enumeration_tests = async ({ sdk, sdkNonAdmin } : { sdk
   // ====================================================================
   // Let rate limit decay so this single call isn't blocked.
   await wait(undefined, 5000)
-  await sdk.reset_db()
+  await reset_test_tenant(sdk)
 
   const sameTenantRes = await post(
     '/v1/invite-user-to-organization',

package/src/tests/api_tests/security/rich-text-answer-sanitized-on-write.test.ts

@@ -0,0 +1,197 @@
+require('source-map-support').install();
+
+import { EnduserSession } from "../../../sdk"
+import {
+  assert_checks,
+  Check,
+  setup_isolated_tenant,
+} from "../../setup_isolated"
+
+const host = process.env.API_URL || 'http://localhost:8080' as const
+
+const RAND = () => Math.random().toString(36).slice(2, 10)
+
+/**
+ * Form "Rich Text" answers must be sanitized when they are stored, not only when they are rendered.
+ *
+ * A Rich Text answer is HTML authored by whoever fills the form — including an unauthenticated
+ * visitor on a public intake page — and it is stored verbatim by the generic write path (the only
+ * thing it strips is `<script>`). Every read path re-sanitizes before `dangerouslySetInnerHTML`,
+ * but the staff-side rich text *editor* did not: `@tellescope/react-components`'s `RichTextInput`
+ * fed the stored answer straight into `html-to-draftjs`, whose `<iframe>` handling produces a
+ * Draft.js EMBEDDED_LINK block that `react-draft-wysiwyg` renders as a real, unsandboxed iframe.
+ * So an enduser could submit `<iframe src="javascript:…">` in an answer and have it execute in the
+ * session of the staff member who opened that response for editing (enduser -> staff stored XSS,
+ * i.e. a PHI-egress class). The editor was fixed to sanitize before parsing; this test covers the
+ * second layer: the answer is sanitized once, on write, so exports, PDFs, integrations, AI
+ * summaries and any future consumer inherit it instead of each having to remember.
+ *
+ * Every client write of answers goes through `formResponseValidator` — generic create/update
+ * (endusers may PATCH `responses`), `submit_form_response` and `save_field_response` — so all three
+ * are exercised here. The server-side writers that bypass validation (Formsort, Healthie sync, AI
+ * form filling) never construct a `'Rich Text'` answer; see the note on the validator in
+ * `@tellescope/validation`.
+ *
+ * The negative checks are paired with positive ones: formatting and legitimate external links must
+ * survive, or a "sanitized" result could just mean the answer was discarded. The last two checks
+ * guard the two ways this change could break normal use: an empty answer must round-trip
+ * unchanged (the portal compares against `''` / `'<p></p>'`), and a long answer must not be
+ * rejected because the sanitizer's own `target`/`rel` additions pushed it over the length limit.
+ */
+export const rich_text_answer_sanitized_on_write_checks = async (): Promise<Check[]> => {
+  const checks: Check[] = []
+  const record = (label: string, pass: boolean, detail: string) => checks.push({ label, pass, detail })
+
+  const PAYLOAD = '<p>hi <b>bold</b> <a href="https://x.io">l</a></p>'
+    + '<iframe src="javascript:alert(1)"></iframe>'
+    + '<img src="x" onerror="alert(1)">'
+    + '<script>alert(1)</script>'
+    + '<a href="javascript:alert(2)">j</a>'
+
+  const dangerous = (stored: string) => ([
+    ['<iframe', stored.toLowerCase().includes('<iframe')],
+    ['onerror', stored.toLowerCase().includes('onerror')],
+    ['<script', stored.toLowerCase().includes('<script')],
+    ['javascript:', stored.toLowerCase().includes('javascript:')],
+  ] as [string, boolean][]).filter(([, present]) => present).map(([name]) => name)
+
+  const record_sanitized = (label: string, stored: string | undefined) => {
+    if (typeof stored !== 'string') {
+      record(label, false, `no answer stored (got ${JSON.stringify(stored)})`)
+      return
+    }
+    const bad = dangerous(stored)
+    const keptFormatting = stored.includes('<b>bold</b>')
+    const keptLink = stored.includes('href="https://x.io"') && stored.includes('rel="noopener noreferrer"')
+
+    record(label, bad.length === 0 && keptFormatting && keptLink,
+      bad.length !== 0 ? `dangerous markup stored: ${bad.join(', ')} — ${stored.slice(0, 300)}`
+      : !keptFormatting ? `formatting did not survive — ${stored.slice(0, 300)}`
+      : !keptLink ? `external link lost its href or rel — ${stored.slice(0, 300)}`
+      : `stored sanitized: ${stored.slice(0, 300)}`
+    )
+  }
+
+  let tenant: Awaited<ReturnType<typeof setup_isolated_tenant>> | undefined
+
+  try {
+    tenant = await setup_isolated_tenant({ name: `RichText ${RAND()}`, users: [{ isAdmin: true }], apiKeys: 0 })
+    const sdk = tenant.sdk
+
+    const form = await sdk.api.forms.createOne({ title: `rich text ${RAND()}` })
+    const field = await sdk.api.form_fields.createOne({
+      formId: form.id, title: 'Tell us more', type: 'Rich Text', previousFields: [{ type: 'root', info: {} }],
+    })
+    const enduser = await sdk.api.endusers.createOne({
+      email: `richtext-${RAND()}@tellescope.com`, fname: 'Rich', lname: 'Text',
+    })
+    // generate_auth_token rather than .authenticate — repeated logins hit the rate limiter.
+    const { authToken } = await sdk.api.endusers.generate_auth_token({ id: enduser.id })
+    const enduserSDK = new EnduserSession({ host, businessId: tenant.businessId, authToken })
+
+    const prepare = () => sdk.api.form_responses.prepare_form_response({ formId: form.id, enduserId: enduser.id })
+    const answer = (value: string) => ({
+      fieldId: field.id, fieldTitle: field.title, answer: { type: 'Rich Text' as const, value },
+    })
+    /** What is actually in the database, read back by an admin session. */
+    const stored_answer = async (formResponseId: string) => {
+      const formResponse = await sdk.api.form_responses.getOne(formResponseId)
+      const response = (formResponse.responses || []).find(r => r.fieldId === field.id)
+      return (response?.answer as { value?: string } | undefined)?.value
+    }
+
+    /* ===== 1. submit_form_response — the path a patient filling out a form takes ===== */
+
+    const submitted = await prepare()
+    await enduserSDK.api.form_responses.submit_form_response({
+      accessCode: submitted.accessCode, responses: [answer(PAYLOAD)],
+    })
+    const submittedValue = await stored_answer(submitted.response.id)
+    record_sanitized('1: submit_form_response stores a sanitized answer', submittedValue)
+
+    /* ===== 2. save_field_response — the partial/draft save the portal fires per question ===== */
+
+    const partial = await prepare()
+    await enduserSDK.api.form_responses.save_field_response({
+      accessCode: partial.accessCode, response: answer(PAYLOAD),
+    })
+    record_sanitized('2: save_field_response stores a sanitized answer', await stored_answer(partial.response.id))
+
+    /* ===== 3. generic PATCH of responses — endusers are allowed to update their own ===== */
+
+    const patched = await prepare()
+    await enduserSDK.api.form_responses.updateOne(patched.response.id, { responses: [answer(PAYLOAD)] })
+    record_sanitized('3: enduser PATCH of responses stores a sanitized answer', await stored_answer(patched.response.id))
+
+    /* ===== 4. Idempotence: re-submitting what was stored must not change it again ===== */
+
+    if (typeof submittedValue === 'string') {
+      const resubmitted = await prepare()
+      await enduserSDK.api.form_responses.submit_form_response({
+        accessCode: resubmitted.accessCode, responses: [answer(submittedValue)],
+      })
+      const again = await stored_answer(resubmitted.response.id)
+      record('4: re-submitting a sanitized answer is idempotent', again === submittedValue,
+        again === submittedValue ? 'unchanged on the second pass' : `changed — ${String(again).slice(0, 300)}`)
+    } else {
+      record('4: re-submitting a sanitized answer is idempotent', false, 'skipped: check 1 stored nothing')
+    }
+
+    /* ===== 5. Empty answers round-trip: the portal treats '' and '<p></p>' as "unanswered" ===== */
+
+    const empties = await prepare()
+    const roundTrips: string[] = []
+    for (const value of ['<p></p>', '']) {
+      await enduserSDK.api.form_responses.save_field_response({
+        accessCode: empties.accessCode, response: answer(value),
+      })
+      roundTrips.push(`${JSON.stringify(value)} -> ${JSON.stringify(await stored_answer(empties.response.id))}`)
+    }
+    const emptiesOk = roundTrips[0] === '"<p></p>" -> "<p></p>"' && roundTrips[1] === '"" -> ""'
+    record('5: empty and <p></p> answers round-trip unchanged', emptiesOk, roundTrips.join(', '))
+
+    /* ===== 6. Length headroom: the sanitizer ADDS target/rel to every external link ===== */
+
+    // ~24.9k of legitimate answer, just under the old 25000 limit. Sanitizing adds ~41 characters
+    // per external link, so at the old limit the sanitized result would be rejected on a re-save.
+    const LINKS = 12
+    const longAnswer = `<p>${'a'.repeat(24400)}</p>`
+      + `<a href="https://example.com/a">link</a>`.repeat(LINKS)
+    const longResponse = await prepare()
+    const longResult = await enduserSDK.api.form_responses.submit_form_response({
+      accessCode: longResponse.accessCode, responses: [answer(longAnswer)],
+    }).then(() => stored_answer(longResponse.response.id))
+     .catch((e: any) => `rejected: ${e?.message || e}`)
+
+    const longOk = typeof longResult === 'string'
+      && longResult.split('rel="noopener noreferrer"').length - 1 === LINKS
+    record('6: a ~24.9k answer with external links is accepted after sanitizing', longOk,
+      longOk ? `stored ${longResult.length} characters with ${LINKS} rel-tagged links (submitted ${longAnswer.length})`
+             : `submitted ${longAnswer.length} characters — ${String(longResult).slice(0, 300)}`)
+  } finally {
+    // Teardown BEFORE anything asserts — assert calls process.exit, which skips pending finallys and
+    // would strand the provisioned tenant permanently.
+    if (tenant) { try { await tenant.teardown() } catch (e) { console.error('teardown failed', e) } }
+  }
+
+  return checks
+}
+
+/** Asserting wrapper, for standalone runs and for sequential use in the suite. */
+export const rich_text_answer_sanitized_on_write_tests = async () => {
+  assert_checks('Rich Text answers sanitized on write', await rich_text_answer_sanitized_on_write_checks())
+}
+
+// Allow running this test file independently
+if (require.main === module) {
+  console.log(`🌐 Using API URL: ${host}`)
+  rich_text_answer_sanitized_on_write_tests()
+    .then(() => {
+      console.log("✅ rich text answer sanitization test suite completed successfully")
+      process.exit(0)
+    })
+    .catch((error) => {
+      console.error("❌ rich text answer sanitization test suite failed:", error)
+      process.exit(1)
+    })
+}

package/src/tests/api_tests/security/sanitize-user-html-with-iframes.test.ts

@@ -147,7 +147,10 @@ export const sanitize_user_html_with_iframes_tests = async () => {
   // sandbox="" is the MOST restrictive value and must not be replaced by the default
   const emptySandbox = sanitize_user_html_with_iframes(`<iframe src="https://ok.example" sandbox=""></iframe>`)
   if (emptySandbox.includes('allow-')) fail(`empty sandbox was replaced with the permissive default: ${emptySandbox}`)
-  if (!/\ssandbox(\s|>)/.test(emptySandbox)) fail(`empty sandbox attribute lost entirely: ${emptySandbox}`)
+  // Accepts either spelling — a bare `sandbox` and `sandbox=""` are identical per the HTML spec,
+  // and which one sanitize-html emits has changed between releases. What must never happen is the
+  // attribute disappearing, which leaves the frame with no sandbox at all.
+  if (!/\ssandbox(=""|\s|>)/.test(emptySandbox)) fail(`empty sandbox attribute lost entirely: ${emptySandbox}`)
 
   // author referrerpolicy honored
   const noref = sanitize_user_html_with_iframes(`<iframe src="https://ok.example" referrerpolicy="no-referrer"></iframe>`)