@tellescope/sdk 1.256.16 → 2.0.0-beta.1

package/package.json

@@ -1,25 +1,25 @@
 {
   "name": "@tellescope/sdk",
-  "version": "1.256.16",
+  "version": "2.0.0-beta.1",
   "description": "Code for interacting with the Tellescope API",
   "main": "./lib/cjs/sdk.js",
   "module": "./lib/esm/sdk.js",
   "types": "./lib/esm/sdk.d.ts",
   "scripts": {
-    "test": "npm run-script build:cjs && npm run-script retest",
+    "test": "npm run-script build:cjs && node ../../../scripts/dev/check-build-fresh.mjs && npm run-script retest",
     "retest": "npm run-script retest-api && npm run-script retest-public-api && npm run-script retest-webhooks",
-    "test-api": "npm run-script build:cjs && npm run-script retest-api",
+    "test-api": "npm run-script build:cjs && node ../../../scripts/dev/check-build-fresh.mjs && npm run-script retest-api",
     "retest-api": "node -r dotenv/config lib/cjs/tests/tests.js",
-    "test-public-api": "npm run-script build:cjs && npm run-script retest-public-api",
+    "test-public-api": "npm run-script build:cjs && node ../../../scripts/dev/check-build-fresh.mjs && npm run-script retest-public-api",
     "retest-public-api": "node -r dotenv/config lib/cjs/tests/public_endpoint_tests.js",
-    "test-sockets": "npm run-script build:cjs && npm run-script retest-sockets",
+    "test-sockets": "npm run-script build:cjs && node ../../../scripts/dev/check-build-fresh.mjs && npm run-script retest-sockets",
     "retest-sockets": "node -r dotenv/config lib/cjs/tests/socket_tests.js",
-    "test-webhooks": "npm run-script build:cjs && npm run-script retest-webhooks",
+    "test-webhooks": "npm run-script build:cjs && node ../../../scripts/dev/check-build-fresh.mjs && npm run-script retest-webhooks",
     "retest-webhooks": "node -r dotenv/config lib/cjs/tests/webhooks_tests.js",
     "build": "npm run-script build:esm && npm run-script build:cjs",
     "build:esm": "tsc",
-    "build:cjs": "tsc --module commonjs --outDir lib/cjs",
-    "watch:cjs": "tsc --module commonjs --outDir lib/cjs --watch"
+    "build:cjs": "tsc -b tsconfig.cjs.json",
+    "watch:cjs": "tsc -b -w --preserveWatchOutput tsconfig.cjs.json"
   },
   "repository": {
     "type": "git",
@@ -31,18 +31,21 @@
     "url": "https://github.com/tellescope-os/tellescope/issues"
   },
   "homepage": "https://github.com/tellescope-os/tellescope#readme",
+  "engines": {
+    "node": ">=22.12.0"
+  },
   "dependencies": {
-    "@tellescope/constants": "1.256.16",
-    "@tellescope/schema": "1.256.16",
-    "@tellescope/testing": "1.256.16",
-    "@tellescope/types-client": "1.256.16",
-    "@tellescope/types-models": "1.256.16",
-    "@tellescope/types-utilities": "1.256.16",
-    "@tellescope/utilities": "1.256.16",
-    "@tellescope/validation": "1.256.16",
-    "axios": "0.30.3",
+    "@tellescope/constants": "2.0.0-beta.1",
+    "@tellescope/schema": "2.0.0-beta.1",
+    "@tellescope/testing": "2.0.0-beta.1",
+    "@tellescope/types-client": "2.0.0-beta.1",
+    "@tellescope/types-models": "2.0.0-beta.1",
+    "@tellescope/types-utilities": "2.0.0-beta.1",
+    "@tellescope/utilities": "2.0.0-beta.1",
+    "@tellescope/validation": "2.0.0-beta.1",
+    "axios": "0.33.0",
     "dotenv": "14.3.2",
-    "form-data": "4.0.4",
+    "form-data": "4.0.6",
     "source-map-support": "0.5.21"
   },
   "devDependencies": {
@@ -55,5 +58,5 @@
   "publishConfig": {
     "access": "public"
   },
-  "gitHead": "5874f0e4ca75d8ce70768a5933cd5bb5b3b15c58"
+  "gitHead": "20732ce4e382a7d81dde795ce9c7194c2aca1ce6"
 }

package/src/sdk.ts

@@ -234,6 +234,11 @@ const loadDefaultQueries = (s: Session): { [K in keyof ClientModelForName] : API
 })
 
 type Queries = { [K in keyof ClientModelForName]: APIQuery<K> } & {
+  user_logs: {
+    restore_deleted: (args: extractFields<CustomActions['user_logs']['restore_deleted']['parameters']>) => (
+      Promise<extractFields<CustomActions['user_logs']['restore_deleted']['returns']>>
+    ),
+  },
   inbox_threads: {
     build_threads: (args: extractFields<CustomActions['inbox_threads']['build_threads']['parameters']>) => (
       Promise<extractFields<CustomActions['inbox_threads']['build_threads']['returns']>>
@@ -313,6 +318,9 @@ type Queries = { [K in keyof ClientModelForName]: APIQuery<K> } & {
     get_form_statistics: (args: extractFields<CustomActions['forms']['get_form_statistics']['parameters']>) => (
       Promise<extractFields<CustomActions['forms']['get_form_statistics']['returns']>>
     ),
+    public_form_details: (args: extractFields<PublicActions['forms']['public_form_details']['parameters']>) => (
+      Promise<extractFields<PublicActions['forms']['public_form_details']['returns']>>
+    ),
   },
   phone_trees: {
     start_outbound_call: (args: extractFields<CustomActions['phone_trees']['start_outbound_call']['parameters']>) => (
@@ -993,6 +1001,7 @@ export class Session extends SessionManager {
     queries.api_keys.get_organization_api_keys = () => this._GET(`/v1${schema.api_keys.customActions.get_organization_api_keys.path}`)
     queries.api_keys.delete_organization_api_key = ({ id }) => this._DELETE(`/v1/organization-api-key/${id}`)
 
+    queries.user_logs.restore_deleted = a => this._POST(`/v1${schema.user_logs.customActions.restore_deleted.path}`, a)
     queries.enduser_orders.get_available_tests = a => this._GET(`/v1${schema.enduser_orders.customActions.get_available_tests.path}`, a)
     queries.enduser_orders.create_lab_order = a => this._POST(`/v1${schema.enduser_orders.customActions.create_lab_order.path}`, a)
     queries.enduser_orders.cancel_order = a => this._POST(`/v1${schema.enduser_orders.customActions.cancel_order.path}`, a)
@@ -1052,6 +1061,7 @@ export class Session extends SessionManager {
     queries.organizations.invite_user = a => this._POST(`/v1/${schema.users.customActions.invite_user.path}`, a) 
 
     queries.forms.get_form_statistics = args => this._GET(`/v1${schema.forms.customActions.get_form_statistics.path}`, args)
+    queries.forms.public_form_details = args => this._GET(`/v1${schema.forms.publicActions.public_form_details.path}`, args)
 
     queries.form_fields.load_choices_from_database = args => this._GET(`/v1${schema.form_fields.customActions.load_choices_from_database.path}`, args)
     queries.form_fields.booking_info = args => this._GET(`/v1${schema.form_fields.customActions.booking_info.path}`, args)
@@ -1350,4 +1360,4 @@ export class Session extends SessionManager {
   sync = (a: { from: Date }) => this.GET<typeof a, { results: Pick<DataSyncRecord, 'modelName' | 'recordId' | 'data'>[], to: string }>('/v1/data-sync', a)
 }
 
-export { SessionOptions }
+export type { SessionOptions }

package/src/tests/api_tests/active_patient_count.test.ts

@@ -10,7 +10,7 @@ import {
 import { authenticate_enduser_via_token, setup_tests } from "../setup"
 
 const host = process.env.API_URL || 'http://localhost:8080' as const
-const businessId = '60398b1131a295e64f084ff6'
+const businessId = process.env.TEST_BUSINESS_ID || '60398b1131a295e64f084ff6'
 
 // Second-tenant session, used to prove the active patient count never crosses tenants.
 // Same key used by the org-isolation tests in tests.ts.

package/src/tests/api_tests/appointment_rescheduled_trigger.test.ts

@@ -3,7 +3,7 @@ import { log_header, wait, async_test } from "@tellescope/testing"
 import { Enduser } from "@tellescope/types-client"
 import { setup_tests } from "../setup"
 
-const host = process.env.TEST_HOST || "http://localhost:8080"
+const host = process.env.API_URL || process.env.TEST_HOST || "http://localhost:8080"
 
 export const appointment_rescheduled_trigger_tests = async ({ sdk, sdkNonAdmin } : { sdk: Session, sdkNonAdmin: Session }) => {
   log_header("Automation Trigger Tests (Appointment Rescheduled)")

package/src/tests/api_tests/calendar_event_references_update.test.ts

@@ -8,7 +8,7 @@ import {
 import { setup_tests, authenticate_enduser_via_token } from "../setup"
 
 const host = process.env.API_URL || 'http://localhost:8080' as const
-const businessId = '60398b1131a295e64f084ff6'
+const businessId = process.env.TEST_BUSINESS_ID || '60398b1131a295e64f084ff6'
 
 /**
  * CU-86e2dvrn9: calendar_events.references switched from updatesDisabled to

package/src/tests/api_tests/enduser_cross_access_isolation.test.ts

@@ -12,7 +12,7 @@ import { ModelName } from "@tellescope/types-models"
 import { authenticate_enduser_via_token, setup_tests } from "../setup"
 
 const host = process.env.API_URL || 'http://localhost:8080' as const
-const businessId = '60398b1131a295e64f084ff6'
+const businessId = process.env.TEST_BUSINESS_ID || '60398b1131a295e64f084ff6'
 
 type OwnerField = 'enduserId' | 'enduserIds' | 'attendees.id'
 

package/src/tests/api_tests/enduser_fields_sync.test.ts

@@ -0,0 +1,150 @@
+require('source-map-support').install();
+
+import {
+  assert_checks,
+  Check,
+  setup_isolated_tenant,
+} from "../setup_isolated"
+
+const host = process.env.API_URL || 'http://localhost:8080' as const
+
+const RAND = () => Math.random().toString(36).slice(2, 10)
+
+/**
+ * Schema round-trip for `Form.syncEnduserFieldsToEHR` and `Form.enduserFieldsSync`, the two fields
+ * behind "Sync Patient Fields to Healthie".
+ *
+ * The names are deliberately EHR-agnostic — each row's `externalId` is the question id in whichever
+ * EHR the form syncs to (`Form.externalId`) — even though only the Healthie push reads them today.
+ *
+ * What this file can and cannot cover: the actual `createFormAnswerGroup` round trip needs live
+ * Healthie credentials that no suite here has, and there is no Healthie mock or fixture layer in the
+ * repository, so the push itself is covered by the resolver's unit tests
+ * (api/modules/forms.test.ts) plus manual QA against Healthie staging. What IS covered here is
+ * everything the API owns: that the fields persist and read back unchanged, that validation rejects
+ * malformed rows, and — the one that guards a real decision in the form-editor modal — that an
+ * update with `replaceObjectFields` actually SHRINKS the list rather than merging into it, which is
+ * what makes deleting a mapping row persist.
+ */
+export const enduser_fields_sync_checks = async (): Promise<Check[]> => {
+  const checks: Check[] = []
+  const record = (label: string, pass: boolean, detail: string) => checks.push({ label, pass, detail })
+
+  /** records a check that the given write is rejected (any 4xx), not silently accepted */
+  const record_rejected = async (label: string, write: () => Promise<any>) => {
+    try {
+      const accepted = await write()
+      record(label, false, `accepted, expected a validation error — got ${JSON.stringify(accepted?.enduserFieldsSync)}`)
+    } catch (err: any) {
+      const message = err?.message || String(err)
+      record(label, true, `rejected: ${message.slice(0, 200)}`)
+    }
+  }
+
+  let tenant: Awaited<ReturnType<typeof setup_isolated_tenant>> | undefined
+
+  try {
+    tenant = await setup_isolated_tenant({ name: `FieldSync ${RAND()}`, users: [{ isAdmin: true }], apiKeys: 0 })
+    const sdk = tenant.sdk
+
+    const TWO_ROWS = [
+      { field: 'dateOfBirth', externalId: '111111' },
+      { field: 'Referring Provider', externalId: '222222' },
+    ]
+
+    /* ===== 1. Create with both fields set, and read them back ===== */
+    const created = await sdk.api.forms.createOne({
+      title: `Field sync ${RAND()}`,
+      externalId: 'healthie-form-id',
+      syncEnduserFieldsToEHR: true,
+      enduserFieldsSync: TWO_ROWS,
+    })
+    const readBack = await sdk.api.forms.getOne(created.id)
+
+    record('1: create persists syncEnduserFieldsToEHR', readBack.syncEnduserFieldsToEHR === true,
+      `got ${JSON.stringify(readBack.syncEnduserFieldsToEHR)}`)
+    record('1: create persists enduserFieldsSync verbatim',
+      JSON.stringify(readBack.enduserFieldsSync) === JSON.stringify(TWO_ROWS),
+      `got ${JSON.stringify(readBack.enduserFieldsSync)} expected ${JSON.stringify(TWO_ROWS)}`)
+
+    /* ===== 2. replaceObjectFields must SHRINK the list, not merge into it =====
+       This is the guard for the form-editor modal's `replaceObjectFields` change. Without it,
+       deleting a mapping row in the UI would save and then silently come back on reload. */
+    const ONE_ROW = [{ field: 'insurance.memberId', externalId: '333333' }]
+    await sdk.api.forms.updateOne(created.id, { enduserFieldsSync: ONE_ROW }, { replaceObjectFields: true })
+    const shrunk = await sdk.api.forms.getOne(created.id)
+
+    record('2: replaceObjectFields shrinks a two-row list to one row',
+      JSON.stringify(shrunk.enduserFieldsSync) === JSON.stringify(ONE_ROW),
+      `got ${JSON.stringify(shrunk.enduserFieldsSync)} expected ${JSON.stringify(ONE_ROW)}`)
+
+    /* ===== 3. Malformed rows are rejected ===== */
+    await record_rejected('3: a row with a non-string field is rejected', () =>
+      sdk.api.forms.updateOne(created.id, { enduserFieldsSync: [{ field: 1, externalId: '1' }] } as any,
+        { replaceObjectFields: true }))
+
+    await record_rejected('3: a row missing externalId is rejected', () =>
+      sdk.api.forms.updateOne(created.id, { enduserFieldsSync: [{ field: 'fname' }] } as any,
+        { replaceObjectFields: true }))
+
+    await record_rejected('3: an externalId over 100 characters is rejected', () =>
+      sdk.api.forms.updateOne(created.id,
+        { enduserFieldsSync: [{ field: 'fname', externalId: 'x'.repeat(101) }] },
+        { replaceObjectFields: true }))
+
+    // a rejected write must not have partially applied - the one-row list from step 2 stands
+    const afterRejections = await sdk.api.forms.getOne(created.id)
+    record('3: rejected writes leave the stored list untouched',
+      JSON.stringify(afterRejections.enduserFieldsSync) === JSON.stringify(ONE_ROW),
+      `got ${JSON.stringify(afterRejections.enduserFieldsSync)} expected ${JSON.stringify(ONE_ROW)}`)
+
+    /* ===== 4. An empty list is accepted (clearing every row) ===== */
+    try {
+      await sdk.api.forms.updateOne(created.id, { enduserFieldsSync: [] }, { replaceObjectFields: true })
+      const cleared = await sdk.api.forms.getOne(created.id)
+      const rows = cleared.enduserFieldsSync
+      record('4: an empty list is accepted and clears the mapping',
+        Array.isArray(rows) && rows.length === 0,
+        `got ${JSON.stringify(rows)}`)
+    } catch (err: any) {
+      record('4: an empty list is accepted and clears the mapping', false,
+        `rejected: ${(err?.message || String(err)).slice(0, 200)}`)
+    }
+
+    /* ===== 5. Backward compatibility: a form that sets neither field reads back with neither ===== */
+    const plain = await sdk.api.forms.createOne({ title: `No field sync ${RAND()}` })
+    const plainReadBack = await sdk.api.forms.getOne(plain.id)
+
+    record('5: a form created without either field has no syncEnduserFieldsToEHR',
+      plainReadBack.syncEnduserFieldsToEHR === undefined,
+      `got ${JSON.stringify(plainReadBack.syncEnduserFieldsToEHR)}`)
+    record('5: a form created without either field has no enduserFieldsSync',
+      plainReadBack.enduserFieldsSync === undefined,
+      `got ${JSON.stringify(plainReadBack.enduserFieldsSync)}`)
+  } finally {
+    // Teardown BEFORE anything asserts — assert calls process.exit, which skips pending finallys and
+    // would strand the provisioned tenant permanently.
+    if (tenant) { try { await tenant.teardown() } catch (e) { console.error('teardown failed', e) } }
+  }
+
+  return checks
+}
+
+/** Asserting wrapper, for standalone runs and for sequential use in the suite. */
+export const enduser_fields_sync_tests = async () => {
+  assert_checks('Enduser fields sync schema round-trip', await enduser_fields_sync_checks())
+}
+
+// Allow running this test file independently
+if (require.main === module) {
+  console.log(`🌐 Using API URL: ${host}`)
+  enduser_fields_sync_tests()
+    .then(() => {
+      console.log("✅ enduser fields sync test suite completed successfully")
+      process.exit(0)
+    })
+    .catch((error) => {
+      console.error("❌ enduser fields sync test suite failed:", error)
+      process.exit(1)
+    })
+}

package/src/tests/api_tests/enduser_login_rate_limits.test.ts

@@ -6,7 +6,7 @@ import {
   async_test,
   log_header,
 } from "@tellescope/testing"
-import { setup_tests } from "../setup"
+import { reset_test_tenant, setup_tests } from "../setup"
 
 const host = process.env.API_URL || 'http://localhost:8080' as const
 
@@ -43,7 +43,7 @@ export const enduser_login_rate_limits_tests = async ({ sdk, sdkNonAdmin } : { s
   const businessId = sdk.userInfo.businessId
 
   // Ensure throttled_events from prior tests don't bleed in.
-  await sdk.reset_db()
+  await reset_test_tenant(sdk)
 
   // ---- /v1/login-enduser per-IP cap (20/min) ----
   // Bogus emails ensure we never reach the actual DB lookup / login work.
@@ -58,7 +58,7 @@ export const enduser_login_rate_limits_tests = async ({ sdk, sdkNonAdmin } : { s
     { expectedResult: 'tripped' }
   )
 
-  await sdk.reset_db()
+  await reset_test_tenant(sdk)
 
   // ---- /v1/begin-enduser-login-flow per-IP cap (10/min) ----
   // Use distinct emails so the per-identifier limit (5/10min) does NOT trip first;
@@ -73,7 +73,7 @@ export const enduser_login_rate_limits_tests = async ({ sdk, sdkNonAdmin } : { s
     { expectedResult: 'tripped' }
   )
 
-  await sdk.reset_db()
+  await reset_test_tenant(sdk)
 
   // ---- /v1/begin-enduser-login-flow per-identifier cap (5 / 10 min per email) ----
   // Hit a single email below the per-IP cap.
@@ -88,7 +88,7 @@ export const enduser_login_rate_limits_tests = async ({ sdk, sdkNonAdmin } : { s
     { expectedResult: 'tripped' }
   )
 
-  await sdk.reset_db()
+  await reset_test_tenant(sdk)
 
   // ---- /v1/endusers/send-otp-code per-IP cap (5/min) ----
   // Use a bogus JWT-shaped token so we trip the IP guard first (it runs before any DB work).
@@ -116,7 +116,7 @@ export const enduser_login_rate_limits_tests = async ({ sdk, sdkNonAdmin } : { s
 
   // ---- Legitimate-login regression: a single successful login should still go through ----
   // Reset state, then create a real enduser with a password and confirm one login succeeds.
-  await sdk.reset_db()
+  await reset_test_tenant(sdk)
 
   const ts = Date.now()
   const enduser = await sdk.api.endusers.createOne({
@@ -151,7 +151,7 @@ export const enduser_login_rate_limits_tests = async ({ sdk, sdkNonAdmin } : { s
     )
   } finally {
     await sdk.api.endusers.deleteOne(enduser.id).catch(() => null)
-    await sdk.reset_db().catch(() => null)
+    await reset_test_tenant(sdk).catch(() => null)
   }
 }
 

package/src/tests/api_tests/enduser_session_invalidation.test.ts

@@ -7,10 +7,10 @@ import {
   log_header,
   wait,
 } from "@tellescope/testing"
-import { setup_tests } from "../setup"
+import { reset_test_tenant, setup_tests } from "../setup"
 
 const host = process.env.API_URL || 'http://localhost:8080' as const
-const businessId = '60398b1131a295e64f084ff6'
+const businessId = process.env.TEST_BUSINESS_ID || '60398b1131a295e64f084ff6'
 
 // Main test function that can be called independently
 export const enduser_session_invalidation_tests = async ({ sdk, sdkNonAdmin } : { sdk: Session, sdkNonAdmin: Session }) => {
@@ -126,7 +126,7 @@ export const enduser_session_invalidation_tests = async ({ sdk, sdkNonAdmin } :
   }
 
   // Ensure OTP is off and db is clean before starting
-  await sdk.reset_db()
+  await reset_test_tenant(sdk)
   await wait(undefined, 500)
   await resetOTPSettings(sdk)
 
@@ -242,7 +242,7 @@ export const enduser_session_invalidation_tests = async ({ sdk, sdkNonAdmin } :
   )
 
   // Reset rate limiting state before continuing
-  await sdk.reset_db()
+  await reset_test_tenant(sdk)
   await wait(undefined, 500)
 
   // Test 8: Disabling OTP does NOT invalidate sessions

package/src/tests/api_tests/load_threads_care_team.test.ts

@@ -0,0 +1,210 @@
+require('source-map-support').install();
+
+import {
+  assert_checks,
+  Check,
+  setup_isolated_tenant,
+} from "../setup_isolated"
+
+const host = process.env.API_URL || 'http://localhost:8080' as const
+
+const RAND = () => Math.random().toString(36).slice(2, 10)
+
+/**
+ * Coverage for the `careTeamUserIds` parameter on `load_threads` (GET /v1/inbox-threads/load).
+ *
+ * The caller used to resolve "every patient these users are on the care team for" client-side and
+ * push the resulting enduser ids into `mdbFilter`. For a care team of hundreds of patients that
+ * overflows the GET query string (Node's 16KB header limit) before any Tellescope code runs. The
+ * parameter moves the join to the server: the API resolves the user ids to endusers via
+ * `assignedTo`, and ANDs `{ enduserIds: { $in: [...] } }` onto the thread filter.
+ *
+ * `setup_isolated` rather than `setup_tests` because several checks assert on the COMPLETE thread
+ * set of the tenant. On the shared fixture org, `build_threads` and the other inbox suites leave
+ * threads behind and every "returns exactly these" assertion would be flaky.
+ *
+ * The threads are created directly with `inbox_threads.createOne` (the model exposes create for
+ * exactly this reason) rather than via `build_threads`, so the tenant contains exactly three.
+ *
+ * Check 4 is the one that catches a wrong implementation: a care team with no patients resolves to
+ * an empty enduser list, and the clause must still be applied (returning nothing) rather than
+ * dropped (returning everything). Check 5 is its counterweight — it rules out an implementation
+ * that returns nothing for every call, which would satisfy 3, 4 and 7c vacuously.
+ *
+ * Check 7 is the permission boundary. A provisioned non-admin gets
+ * `sms_messages: ASSIGNED_AND_DEFAULT_ACCESS` (read: 'Assigned'), and the fixture threads carry
+ * `userIds: []`, so that session sees a thread only through the assigned-enduser branch. 7c fails
+ * if the care-team clause is ever pushed into the access `$or` instead of `filter.$and`, i.e. if
+ * the parameter could be used to WIDEN what a session can see.
+ */
+export const load_threads_care_team_checks = async (): Promise<Check[]> => {
+  const checks: Check[] = []
+  const record = (label: string, pass: boolean, detail: string) => checks.push({ label, pass, detail })
+
+  let tenant: Awaited<ReturnType<typeof setup_isolated_tenant>> | undefined
+
+  try {
+    /* ================= fixtures ================= */
+
+    tenant = await setup_isolated_tenant({
+      name: `LoadThreadsCareTeam ${RAND()}`,
+      users: [{ isAdmin: true }, { roles: ['Non-Admin'] }],
+      apiKeys: 0,
+    })
+
+    const { sdk, sdkNonAdmin } = tenant
+    const NA = tenant.users[1].id // the non-admin's own user id
+
+    // care-team users: they never log in, they exist only to appear in endusers.assignedTo
+    const [U1, U2, U3] = await Promise.all([1, 2, 3].map(n => sdk.api.users.createOne({
+      email: `dontsend-care-team-${n}-${RAND()}@tellescope.com`,
+      fname: 'CareTeam', lname: `User${n}`,
+      verifiedEmail: true,
+      notificationEmailsDisabled: true,
+    })))
+
+    // E1 is also assigned to the non-admin, so check 7a has a non-empty baseline to measure against
+    const E1 = await sdk.api.endusers.createOne({ fname: 'CareTeam', lname: 'PatientOne', assignedTo: [U1.id, NA] })
+    const E2 = await sdk.api.endusers.createOne({ fname: 'CareTeam', lname: 'PatientTwo', assignedTo: [U2.id] })
+    const E3 = await sdk.api.endusers.createOne({ fname: 'CareTeam', lname: 'PatientThree', assignedTo: [] })
+
+    const now = Date.now()
+    const MINUTE = 60 * 1000
+    const defaultThreadFields = {
+      type: 'SMS' as const,
+      assignedTo: [],
+      userIds: [],
+      inboxStatus: 'New',
+      preview: 'care team test',
+      title: 'Care team test',
+    }
+
+    const T1 = await sdk.api.inbox_threads.createOne({
+      ...defaultThreadFields,
+      enduserIds: [E1.id], threadId: `care-team-t1-${RAND()}`, timestamp: new Date(now - 3 * MINUTE),
+    })
+    const T2 = await sdk.api.inbox_threads.createOne({
+      ...defaultThreadFields,
+      enduserIds: [E2.id], threadId: `care-team-t2-${RAND()}`, timestamp: new Date(now - 2 * MINUTE),
+    })
+    const T3 = await sdk.api.inbox_threads.createOne({
+      ...defaultThreadFields,
+      enduserIds: [E3.id], threadId: `care-team-t3-${RAND()}`, timestamp: new Date(now - 1 * MINUTE),
+    })
+
+    const label_for: { [id: string]: string } = { [T1.id]: 'T1', [T2.id]: 'T2', [T3.id]: 'T3' }
+    const describe = (ids: string[]) => `[${ids.map(id => label_for[id] || id).sort().join(', ')}]`
+    const load = async (args: any, session = sdk) => (
+      (await session.api.inbox_threads.load_threads(args)).threads.map(t => t.id)
+    )
+    const same_set = (a: string[], b: string[]) => (
+      a.length === b.length && [...a].sort().join() === [...b].sort().join()
+    )
+
+    /* ===== 1: a single care-team user ===== */
+
+    const one = await load({ careTeamUserIds: [U1.id] })
+    record(
+      '1: careTeamUserIds=[U1] returns exactly the thread for U1\'s patient',
+      same_set(one, [T1.id]),
+      `got ${describe(one)} (want [T1])`,
+    )
+
+    /* ===== 2: multiple care-team users union their patients ===== */
+
+    const two = await load({ careTeamUserIds: [U1.id, U2.id] })
+    record(
+      '2: careTeamUserIds=[U1, U2] returns both their threads and not the unassigned one',
+      same_set(two, [T1.id, T2.id]),
+      `got ${describe(two)} (want [T1, T2] — T3\'s enduser has an empty care team)`,
+    )
+
+    /* ===== 3: ANDs with enduserIds rather than ORing ===== */
+
+    const intersect = await load({ careTeamUserIds: [U2.id], enduserIds: [E1.id] })
+    record(
+      '3: careTeamUserIds AND enduserIds narrows to the intersection',
+      intersect.length === 0,
+      `got ${describe(intersect)} (want [] — E1 is not on U2\'s care team; a non-empty result means the`
+      + ` two filters OR instead of AND)`,
+    )
+
+    /* ===== 4: an empty resolution must not degrade to "no filter" ===== */
+
+    const emptyCareTeam = await load({ careTeamUserIds: [U3.id] })
+    record(
+      '4: a care-team user with no patients returns no threads, not every thread',
+      emptyCareTeam.length === 0,
+      `got ${describe(emptyCareTeam)} (want [] — returning all three means the clause was dropped when`
+      + ` the enduser lookup came back empty)`,
+    )
+
+    /* ===== 5: the feature-off path is unchanged ===== */
+
+    const baseline = await load({})
+    const emptyParam = await load({ careTeamUserIds: [] })
+    record(
+      '5: omitting careTeamUserIds, and passing [], both return exactly the three fixture threads',
+      same_set(baseline, [T1.id, T2.id, T3.id]) && same_set(emptyParam, baseline),
+      `omitted=${describe(baseline)} empty=${describe(emptyParam)} (want [T1, T2, T3] for both)`,
+    )
+
+    /* ===== 6: the count path shares the filter ===== */
+
+    const { count } = await sdk.api.inbox_threads.load_threads({ careTeamUserIds: [U1.id], returnCount: true })
+    record(
+      '6: returnCount applies the care-team filter too',
+      count === 1,
+      `count=${count} (want 1 — 3 means the count path skipped the filter)`,
+    )
+
+    /* ===== 7: permission boundary — the parameter can only narrow, never widen ===== */
+
+    const naBaseline = await load({}, sdkNonAdmin)
+    record(
+      '7a: the non-admin\'s unfiltered inbox is exactly the thread for the patient assigned to them',
+      same_set(naBaseline, [T1.id]),
+      `got ${describe(naBaseline)} (want [T1] — the baseline the next two checks are measured against;`
+      + ` if this is empty, 7b and 7c pass vacuously)`,
+    )
+
+    const naOwnCareTeam = await load({ careTeamUserIds: [U1.id] }, sdkNonAdmin)
+    record(
+      '7b: the parameter does not remove a thread the non-admin legitimately sees',
+      same_set(naOwnCareTeam, [T1.id]),
+      `got ${describe(naOwnCareTeam)} (want [T1])`,
+    )
+
+    const naForeignCareTeam = await load({ careTeamUserIds: [U2.id] }, sdkNonAdmin)
+    record(
+      '7c: the parameter cannot reach a thread outside the non-admin\'s access',
+      naForeignCareTeam.length === 0,
+      `got ${describe(naForeignCareTeam)} (want [] — T2 matches U2\'s care team but is outside this`
+      + ` session's access; a non-empty result means the clause was pushed into the access $or)`,
+    )
+  } finally {
+    // Teardown BEFORE anything asserts — assert calls process.exit, which would strand the tenant.
+    if (tenant) { try { await tenant.teardown() } catch (e) { console.error('teardown failed', e) } }
+  }
+
+  return checks
+}
+
+/** Asserting wrapper, for standalone runs and for sequential use in the suite. */
+export const load_threads_care_team_tests = async () => {
+  assert_checks('Load threads care team', await load_threads_care_team_checks())
+}
+
+// Allow running this test file independently
+if (require.main === module) {
+  console.log(`🌐 Using API URL: ${host}`)
+  load_threads_care_team_tests()
+    .then(() => {
+      console.log("✅ Load threads care team test suite completed successfully")
+      process.exit(0)
+    })
+    .catch((error) => {
+      console.error("❌ Load threads care team test suite failed:", error)
+      process.exit(1)
+    })
+}

package/src/tests/api_tests/managed_content_enduser_access.test.ts

@@ -9,7 +9,7 @@ import {
 import { setup_tests } from "../setup"
 
 const host = process.env.API_URL || 'http://localhost:8080' as const
-const businessId = '60398b1131a295e64f084ff6'
+const businessId = process.env.TEST_BUSINESS_ID || '60398b1131a295e64f084ff6'
 
 /**
  * Tests for managed_content_records enduser access filtering.

package/src/tests/api_tests/managed_content_file_access.test.ts

@@ -9,7 +9,7 @@ import {
 import { setup_tests } from "../setup"
 
 const host = process.env.API_URL || 'http://localhost:8080' as const
-const businessId = '60398b1131a295e64f084ff6'
+const businessId = process.env.TEST_BUSINESS_ID || '60398b1131a295e64f084ff6'
 
 /**
  * Tests for file_download_URL enduser access via managed content fallback.