@tellescope/sdk 1.256.6 → 1.256.7

package/lib/esm/tests/api_tests/security/public_endpoint_auth_field_lock.test.js

@@ -193,10 +193,10 @@ var sleep = function (ms) { return new Promise(function (resolve) { return setTi
 export var public_endpoint_auth_field_lock_tests = function (_a) {
     var sdk = _a.sdk, sdkNonAdmin = _a.sdkNonAdmin;
     return __awaiter(void 0, void 0, void 0, function () {
-        var businessId, RUN, results, record, skip, runScenario, phoneOffset, phoneSeed, nextPhone, emailFor, createdEnduserIds, createdFormIds, createdFormFieldIds, createdUserIds, createdEventIds, createdTemplateIds, organization, MATCH_EMAIL_AND_NAMES, form, plainField, autoMergeForm, autoMergeField, makeIntakeForm, intake, partialIntake, pivotIntake, MERGE_CUSTOM_KEY, autoMergeIntake, template, hostUser, publicSDK, startForm, startBooking, startFormOn, asEnduser, postAuthed, tokenFromURL, patchAuthed, intakeAnswers, pollEnduser, describe, makeVictim, VICTIM_SHAPES, _loop_1, _i, VICTIM_SHAPES_1, shape, _loop_2, _b, VICTIM_SHAPES_2, shape, formSessions, bookingTokens, _loop_3, _c, VICTIM_SHAPES_3, shape, G12_NAME, G13_NAME, G14_NAME, G15_NAME, namelessDob, makeNamelessVictim, G19_NAME, G20_NAME, coldStartCase, G23_NAME, chainForVictim, G24_NAME, G25_NAME, G26_NAME, G27_NAME, G28_NAME, failures, skipped, _d, results_1, r, status_1, _e, createdEventIds_1, id, _f, createdFormIds_1, formId, responses, _g, responses_1, response, _h, createdFormFieldIds_1, id, _j, createdFormIds_2, id, uniqueEnduserIds, _k, uniqueEnduserIds_1, id, _l, createdTemplateIds_1, id, _m, createdUserIds_1, id, _o, results_2, r;
-        var _p, _q;
-        return __generator(this, function (_r) {
-            switch (_r.label) {
+        var businessId, RUN, results, record, skip, runScenario, phoneOffset, phoneSeed, nextPhone, emailFor, createdEnduserIds, createdFormIds, createdFormFieldIds, createdUserIds, createdEventIds, createdTemplateIds, organization, MATCH_EMAIL_AND_NAMES, form, plainField, autoMergeForm, autoMergeField, makeIntakeForm, intake, partialIntake, pivotIntake, MERGE_CUSTOM_KEY, autoMergeIntake, template, hostEmail, hostUser, _b, publicSDK, startForm, startBooking, startFormOn, asEnduser, postAuthed, tokenFromURL, patchAuthed, intakeAnswers, pollEnduser, describe, makeVictim, VICTIM_SHAPES, _loop_1, _i, VICTIM_SHAPES_1, shape, _loop_2, _c, VICTIM_SHAPES_2, shape, formSessions, bookingTokens, _loop_3, _d, VICTIM_SHAPES_3, shape, G12_NAME, G13_NAME, G14_NAME, G15_NAME, namelessDob, makeNamelessVictim, G19_NAME, G20_NAME, coldStartCase, G23_NAME, chainForVictim, G24_NAME, G25_NAME, G26_NAME, G27_NAME, G28_NAME, failures, skipped, _e, results_1, r, status_1, _f, createdEventIds_1, id, _g, createdFormIds_1, formId, responses, _h, responses_1, response, _j, createdFormFieldIds_1, id, _k, createdFormIds_2, id, uniqueEnduserIds, _l, uniqueEnduserIds_1, id, _m, createdTemplateIds_1, id, _o, createdUserIds_1, id, _p, results_2, r;
+        var _q, _r;
+        return __generator(this, function (_s) {
+            switch (_s.label) {
                 case 0:
                     log_header("Public Endpoint Auth Field Lock (email / phone)");
                     businessId = sdk.userInfo.businessId;
@@ -243,11 +243,11 @@ export var public_endpoint_auth_field_lock_tests = function (_a) {
                     createdTemplateIds = [];
                     return [4 /*yield*/, sdk.api.organizations.getOne(businessId).catch(function () { return null; })];
                 case 1:
-                    organization = _r.sent();
-                    MATCH_EMAIL_AND_NAMES = !!((_q = (_p = organization === null || organization === void 0 ? void 0 : organization.settings) === null || _p === void 0 ? void 0 : _p.endusers) === null || _q === void 0 ? void 0 : _q.matchEmailAndNames);
+                    organization = _s.sent();
+                    MATCH_EMAIL_AND_NAMES = !!((_r = (_q = organization === null || organization === void 0 ? void 0 : organization.settings) === null || _q === void 0 ? void 0 : _q.endusers) === null || _r === void 0 ? void 0 : _r.matchEmailAndNames);
                     return [4 /*yield*/, sdk.api.forms.createOne({ title: "auth field lock ".concat(RUN), allowPublicURL: true })];
                 case 2:
-                    form = _r.sent();
+                    form = _s.sent();
                     createdFormIds.push(form.id);
                     return [4 /*yield*/, sdk.api.form_fields.createOne({
                             formId: form.id,
@@ -256,7 +256,7 @@ export var public_endpoint_auth_field_lock_tests = function (_a) {
                             previousFields: [{ type: 'root', info: {} }],
                         })];
                 case 3:
-                    plainField = _r.sent();
+                    plainField = _s.sent();
                     createdFormFieldIds.push(plainField.id);
                     return [4 /*yield*/, sdk.api.forms.createOne({
                             title: "auth field lock automerge ".concat(RUN),
@@ -264,7 +264,7 @@ export var public_endpoint_auth_field_lock_tests = function (_a) {
                             autoMergeOnSubmission: true,
                         })];
                 case 4:
-                    autoMergeForm = _r.sent();
+                    autoMergeForm = _s.sent();
                     createdFormIds.push(autoMergeForm.id);
                     return [4 /*yield*/, sdk.api.form_fields.createOne({
                             formId: autoMergeForm.id,
@@ -273,7 +273,7 @@ export var public_endpoint_auth_field_lock_tests = function (_a) {
                             previousFields: [{ type: 'root', info: {} }],
                         })];
                 case 5:
-                    autoMergeField = _r.sent();
+                    autoMergeField = _s.sent();
                     createdFormFieldIds.push(autoMergeField.id);
                     makeIntakeForm = function (label, opts) {
                         if (opts === void 0) { opts = {}; }
@@ -301,20 +301,20 @@ export var public_endpoint_auth_field_lock_tests = function (_a) {
                     };
                     return [4 /*yield*/, makeIntakeForm('intake')];
                 case 6:
-                    intake = _r.sent();
+                    intake = _s.sent();
                     return [4 /*yield*/, makeIntakeForm('partial', { saveIntakeOnPartial: true })
                         // Deliberately NOT allowPublicURL. prepare_form_response does not require it, so a public session
                         // can pivot from any public form to any form in the org carrying an email/phone intake mapping.
                     ];
                 case 7:
-                    partialIntake = _r.sent();
+                    partialIntake = _s.sent();
                     return [4 /*yield*/, makeIntakeForm('pivot', { public: false })
                         // Auto-merge fixture for G26. Needs real intakeField mappings, because resolveAutoMergeBeforeSubmission
                         // derives its match values from the submitted answers via those mappings — and the custom field is the
                         // anti-vacuity control (it proves the intake write ran at all).
                     ];
                 case 8:
-                    pivotIntake = _r.sent();
+                    pivotIntake = _s.sent();
                     MERGE_CUSTOM_KEY = "aflMerge".concat(RUN);
                     return [4 /*yield*/, (function () { return __awaiter(void 0, void 0, void 0, function () {
                             var form, spec, made, _i, spec_1, s, field, fname, lname, dateOfBirth, email, custom;
@@ -366,7 +366,7 @@ export var public_endpoint_auth_field_lock_tests = function (_a) {
                             });
                         }); })()];
                 case 9:
-                    autoMergeIntake = _r.sent();
+                    autoMergeIntake = _s.sent();
                     return [4 /*yield*/, sdk.api.calendar_event_templates.createOne({
                             title: "auth field lock ".concat(RUN),
                             durationInMinutes: 60,
@@ -375,16 +375,24 @@ export var public_endpoint_auth_field_lock_tests = function (_a) {
                             reminders: [],
                         })];
                 case 10:
-                    template = _r.sent();
+                    template = _s.sent();
                     createdTemplateIds.push(template.id);
+                    hostEmail = 'lock-host@tellescope.com';
+                    return [4 /*yield*/, sdk.api.users.getOne({ email: hostEmail }).catch(function () { return null; })];
+                case 11:
+                    _b = (_s.sent());
+                    if (_b) return [3 /*break*/, 13];
                     return [4 /*yield*/, sdk.api.users.createOne({
-                            email: emailFor('lock-host'),
+                            email: hostEmail,
                             verifiedEmail: true,
                             fname: 'Lock',
-                            lname: "Host".concat(RUN),
+                            lname: 'Host',
                         })];
-                case 11:
-                    hostUser = _r.sent();
+                case 12:
+                    _b = (_s.sent());
+                    _s.label = 13;
+                case 13:
+                    hostUser = _b;
                     createdUserIds.push(hostUser.id);
                     return [4 /*yield*/, sdk.api.users.updateOne(hostUser.id, {
                             weeklyAvailabilities: [0, 1, 2, 3, 4, 5, 6].map(function (dayOfWeekStartingSundayIndexedByZero) { return ({
@@ -395,15 +403,15 @@ export var public_endpoint_auth_field_lock_tests = function (_a) {
                             }); }),
                             calendarEventLimits: [],
                         }, { replaceObjectFields: true })];
-                case 12:
-                    _r.sent();
+                case 14:
+                    _s.sent();
                     return [4 /*yield*/, sleep(250)
                         // ---------------------------------------------------------------------------------------------
                         // Helpers
                         // ---------------------------------------------------------------------------------------------
                     ]; // let form.numFields settle before the public endpoints validate it
-                case 13:
-                    _r.sent(); // let form.numFields settle before the public endpoints validate it
+                case 15:
+                    _s.sent(); // let form.numFields settle before the public endpoints validate it
                     publicSDK = function () { return new EnduserSession({ host: host, businessId: businessId }); };
                     startForm = function (args) { return publicSDK().api.form_responses.session_for_public_form(__assign({ formId: form.id, businessId: businessId }, args)); };
                     startBooking = function (args) { return publicSDK().api.calendar_events.session_for_public_appointment_booking(__assign({ calendarEventTemplateId: template.id, businessId: businessId }, args)); };
@@ -505,8 +513,8 @@ export var public_endpoint_auth_field_lock_tests = function (_a) {
                     ];
                     _loop_1 = function (shape) {
                         var name_1;
-                        return __generator(this, function (_s) {
-                            switch (_s.label) {
+                        return __generator(this, function (_t) {
+                            switch (_t.label) {
                                 case 0:
                                     name_1 = "A blocks email/phone overwrite \u2014 ".concat(shape.label);
                                     return [4 /*yield*/, runScenario('G1', name_1, function () { return __awaiter(void 0, void 0, void 0, function () {
@@ -549,28 +557,28 @@ export var public_endpoint_auth_field_lock_tests = function (_a) {
                                             });
                                         }); })];
                                 case 1:
-                                    _s.sent();
+                                    _t.sent();
                                     return [2 /*return*/];
                             }
                         });
                     };
                     _i = 0, VICTIM_SHAPES_1 = VICTIM_SHAPES;
-                    _r.label = 14;
-                case 14:
-                    if (!(_i < VICTIM_SHAPES_1.length)) return [3 /*break*/, 17];
+                    _s.label = 16;
+                case 16:
+                    if (!(_i < VICTIM_SHAPES_1.length)) return [3 /*break*/, 19];
                     shape = VICTIM_SHAPES_1[_i];
                     return [5 /*yield**/, _loop_1(shape)];
-                case 15:
-                    _r.sent();
-                    _r.label = 16;
-                case 16:
-                    _i++;
-                    return [3 /*break*/, 14];
                 case 17:
+                    _s.sent();
+                    _s.label = 18;
+                case 18:
+                    _i++;
+                    return [3 /*break*/, 16];
+                case 19:
                     _loop_2 = function (shape) {
                         var name_2;
-                        return __generator(this, function (_t) {
-                            switch (_t.label) {
+                        return __generator(this, function (_u) {
+                            switch (_u.label) {
                                 case 0:
                                     name_2 = "B blocks email/phone overwrite \u2014 ".concat(shape.label);
                                     return [4 /*yield*/, runScenario('G2', name_2, function () { return __awaiter(void 0, void 0, void 0, function () {
@@ -614,24 +622,24 @@ export var public_endpoint_auth_field_lock_tests = function (_a) {
                                             });
                                         }); })];
                                 case 1:
-                                    _t.sent();
+                                    _u.sent();
                                     return [2 /*return*/];
                             }
                         });
                     };
-                    _b = 0, VICTIM_SHAPES_2 = VICTIM_SHAPES;
-                    _r.label = 18;
-                case 18:
-                    if (!(_b < VICTIM_SHAPES_2.length)) return [3 /*break*/, 21];
-                    shape = VICTIM_SHAPES_2[_b];
-                    return [5 /*yield**/, _loop_2(shape)];
-                case 19:
-                    _r.sent();
-                    _r.label = 20;
+                    _c = 0, VICTIM_SHAPES_2 = VICTIM_SHAPES;
+                    _s.label = 20;
                 case 20:
-                    _b++;
-                    return [3 /*break*/, 18];
-                case 21: 
+                    if (!(_c < VICTIM_SHAPES_2.length)) return [3 /*break*/, 23];
+                    shape = VICTIM_SHAPES_2[_c];
+                    return [5 /*yield**/, _loop_2(shape)];
+                case 21:
+                    _s.sent();
+                    _s.label = 22;
+                case 22:
+                    _c++;
+                    return [3 /*break*/, 20];
+                case 23: 
                 // ---------------------------------------------------------------------------------------------
                 // G3 — Endpoint A with the raw enduserId parameter (findById, no ownership check). Not reachable
                 // as an attack through the first-party frontend, but trivially reachable by POSTing directly.
@@ -684,13 +692,13 @@ export var public_endpoint_auth_field_lock_tests = function (_a) {
                     // this file runs as part of tests.ts).
                     // ---------------------------------------------------------------------------------------------
                 ];
-                case 22:
+                case 24:
                     // ---------------------------------------------------------------------------------------------
                     // G3 — Endpoint A with the raw enduserId parameter (findById, no ownership check). Not reachable
                     // as an attack through the first-party frontend, but trivially reachable by POSTing directly.
                     // The field lock must hold on this path too.
                     // ---------------------------------------------------------------------------------------------
-                    _r.sent();
+                    _s.sent();
                     // ---------------------------------------------------------------------------------------------
                     // G4 — The takeover chain itself.
                     //
@@ -778,7 +786,7 @@ export var public_endpoint_auth_field_lock_tests = function (_a) {
                         // G5 — Intended intake behavior preserved: blank match keys still get filled, blank phone does not.
                         // ---------------------------------------------------------------------------------------------
                     ];
-                case 23:
+                case 25:
                     // ---------------------------------------------------------------------------------------------
                     // G4 — The takeover chain itself.
                     //
@@ -796,7 +804,7 @@ export var public_endpoint_auth_field_lock_tests = function (_a) {
                     // failure (reset_db is deliberately NOT called here — it would wipe other suites' fixtures when
                     // this file runs as part of tests.ts).
                     // ---------------------------------------------------------------------------------------------
-                    _r.sent();
+                    _s.sent();
                     // ---------------------------------------------------------------------------------------------
                     // G5 — Intended intake behavior preserved: blank match keys still get filled, blank phone does not.
                     // ---------------------------------------------------------------------------------------------
@@ -852,11 +860,11 @@ export var public_endpoint_auth_field_lock_tests = function (_a) {
                         // provider licensed in their new state.
                         // ---------------------------------------------------------------------------------------------
                     ];
-                case 24:
+                case 26:
                     // ---------------------------------------------------------------------------------------------
                     // G5 — Intended intake behavior preserved: blank match keys still get filled, blank phone does not.
                     // ---------------------------------------------------------------------------------------------
-                    _r.sent();
+                    _s.sent();
                     // ---------------------------------------------------------------------------------------------
                     // G6 — Status-quo pin: state still overwrites on match. This is deliberate, not incidental —
                     // state is not an auth channel, and locking it would break a relocated patient booking with a
@@ -898,13 +906,13 @@ export var public_endpoint_auth_field_lock_tests = function (_a) {
                         // Accumulator arrays rather than `let ... | null`: values are assigned inside runScenario's
                         // callback, and TS's control-flow narrowing does not account for closure assignments.
                     ];
-                case 25:
+                case 27:
                     // ---------------------------------------------------------------------------------------------
                     // G6 — Status-quo pin: state still overwrites on match. This is deliberate, not incidental —
                     // state is not an auth channel, and locking it would break a relocated patient booking with a
                     // provider licensed in their new state.
                     // ---------------------------------------------------------------------------------------------
-                    _r.sent();
+                    _s.sent();
                     formSessions = [];
                     return [4 /*yield*/, runScenario('G7', 'A creates a new visitor with submitted email + phone', function () { return __awaiter(void 0, void 0, void 0, function () {
                             var email, phone, session, created, ok;
@@ -934,8 +942,8 @@ export var public_endpoint_auth_field_lock_tests = function (_a) {
                                 }
                             });
                         }); })];
-                case 26:
-                    _r.sent();
+                case 28:
+                    _s.sent();
                     bookingTokens = [];
                     return [4 /*yield*/, runScenario('G7', 'B creates a new visitor with submitted email + phone', function () { return __awaiter(void 0, void 0, void 0, function () {
                             var email, phone, lname, session, matching, _i, matching_2, m, created, ok;
@@ -974,8 +982,8 @@ export var public_endpoint_auth_field_lock_tests = function (_a) {
                         // G8 — The returned public-form session still works end-to-end.
                         // ---------------------------------------------------------------------------------------------
                     ];
-                case 27:
-                    _r.sent();
+                case 29:
+                    _s.sent();
                     // ---------------------------------------------------------------------------------------------
                     // G8 — The returned public-form session still works end-to-end.
                     // ---------------------------------------------------------------------------------------------
@@ -1011,11 +1019,11 @@ export var public_endpoint_auth_field_lock_tests = function (_a) {
                         // regression.
                         // ---------------------------------------------------------------------------------------------
                     ];
-                case 28:
+                case 30:
                     // ---------------------------------------------------------------------------------------------
                     // G8 — The returned public-form session still works end-to-end.
                     // ---------------------------------------------------------------------------------------------
-                    _r.sent();
+                    _s.sent();
                     // ---------------------------------------------------------------------------------------------
                     // G9 — The returned booking session still works. Tiered: availability is always asserted; an
                     // actual booking is attempted only when a slot exists, so an empty window never reads as a
@@ -1069,13 +1077,13 @@ export var public_endpoint_auth_field_lock_tests = function (_a) {
                         // G10 — skipMatch behavior unchanged.
                         // ---------------------------------------------------------------------------------------------
                     ];
-                case 29:
+                case 31:
                     // ---------------------------------------------------------------------------------------------
                     // G9 — The returned booking session still works. Tiered: availability is always asserted; an
                     // actual booking is attempted only when a slot exists, so an empty window never reads as a
                     // regression.
                     // ---------------------------------------------------------------------------------------------
-                    _r.sent();
+                    _s.sent();
                     // ---------------------------------------------------------------------------------------------
                     // G10 — skipMatch behavior unchanged.
                     // ---------------------------------------------------------------------------------------------
@@ -1103,11 +1111,11 @@ export var public_endpoint_auth_field_lock_tests = function (_a) {
                                 }
                             });
                         }); })];
-                case 30:
+                case 32:
                     // ---------------------------------------------------------------------------------------------
                     // G10 — skipMatch behavior unchanged.
                     // ---------------------------------------------------------------------------------------------
-                    _r.sent();
+                    _s.sent();
                     return [4 /*yield*/, runScenario('G10', 'skipMatch + autoMergeOnSubmission sets eligibleForAutoMerge', function () { return __awaiter(void 0, void 0, void 0, function () {
                             var session, created;
                             return __generator(this, function (_a) {
@@ -1138,12 +1146,12 @@ export var public_endpoint_auth_field_lock_tests = function (_a) {
                         // G11 — Intake answers must not overwrite email/phone on a matched patient (submit path).
                         // ---------------------------------------------------------------------------------------------
                     ];
-                case 31:
-                    _r.sent();
+                case 33:
+                    _s.sent();
                     _loop_3 = function (shape) {
                         var name_3;
-                        return __generator(this, function (_u) {
-                            switch (_u.label) {
+                        return __generator(this, function (_v) {
+                            switch (_v.label) {
                                 case 0:
                                     name_3 = "intake answers do not overwrite a matched patient \u2014 ".concat(shape.label);
                                     return [4 /*yield*/, runScenario('G11', name_3, function () { return __awaiter(void 0, void 0, void 0, function () {
@@ -1191,24 +1199,24 @@ export var public_endpoint_auth_field_lock_tests = function (_a) {
                                             });
                                         }); })];
                                 case 1:
-                                    _u.sent();
+                                    _v.sent();
                                     return [2 /*return*/];
                             }
                         });
                     };
-                    _c = 0, VICTIM_SHAPES_3 = VICTIM_SHAPES;
-                    _r.label = 32;
-                case 32:
-                    if (!(_c < VICTIM_SHAPES_3.length)) return [3 /*break*/, 35];
-                    shape = VICTIM_SHAPES_3[_c];
-                    return [5 /*yield**/, _loop_3(shape)];
-                case 33:
-                    _r.sent();
-                    _r.label = 34;
+                    _d = 0, VICTIM_SHAPES_3 = VICTIM_SHAPES;
+                    _s.label = 34;
                 case 34:
-                    _c++;
-                    return [3 /*break*/, 32];
+                    if (!(_d < VICTIM_SHAPES_3.length)) return [3 /*break*/, 37];
+                    shape = VICTIM_SHAPES_3[_d];
+                    return [5 /*yield**/, _loop_3(shape)];
                 case 35:
+                    _s.sent();
+                    _s.label = 36;
+                case 36:
+                    _d++;
+                    return [3 /*break*/, 34];
+                case 37:
                     G12_NAME = 'saveIntakeOnPartial answers do not overwrite a matched patient';
                     return [4 /*yield*/, runScenario('G12', G12_NAME, function () { return __awaiter(void 0, void 0, void 0, function () {
                             var victim, attackerEmail, session, enduser;
@@ -1258,8 +1266,8 @@ export var public_endpoint_auth_field_lock_tests = function (_a) {
                         // G13 — The full takeover chain, driven through an intake answer instead of the endpoint.
                         // ---------------------------------------------------------------------------------------------
                     ];
-                case 36:
-                    _r.sent();
+                case 38:
+                    _s.sent();
                     G13_NAME = 'takeover chain via intake answer: victim not made resolvable';
                     return [4 /*yield*/, runScenario('G13', G13_NAME, function () { return __awaiter(void 0, void 0, void 0, function () {
                             var victim, attackerEmail, session, enduser, resetRes, resolvable, after, afterResult;
@@ -1322,8 +1330,8 @@ export var public_endpoint_auth_field_lock_tests = function (_a) {
                         // G14 — Pivot: a public session can prepare a response for a NON-public form and submit that.
                         // ---------------------------------------------------------------------------------------------
                     ];
-                case 37:
-                    _r.sent();
+                case 39:
+                    _s.sent();
                     G14_NAME = 'pivot via prepare_form_response to a non-public form is also blocked';
                     return [4 /*yield*/, runScenario('G14', G14_NAME, function () { return __awaiter(void 0, void 0, void 0, function () {
                             var victimPhone, victim, attackerEmail, attackerPhone, session, authed, prepared, enduser;
@@ -1377,8 +1385,8 @@ export var public_endpoint_auth_field_lock_tests = function (_a) {
                         // G15 — save_field_response ownership: a guessable formResponseId must not reach another patient.
                         // ---------------------------------------------------------------------------------------------
                     ];
-                case 38:
-                    _r.sent();
+                case 40:
+                    _s.sent();
                     G15_NAME = "save_field_response rejects another patient's formResponseId";
                     return [4 /*yield*/, runScenario('G15', G15_NAME, function () { return __awaiter(void 0, void 0, void 0, function () {
                             var patientA, patientB, sessionA, bPrepared, bResponseId, answer, byId, byCode, byIdWrongCode, aResponse, ownBoth;
@@ -1452,8 +1460,8 @@ export var public_endpoint_auth_field_lock_tests = function (_a) {
                         // scoped to "matched a pre-existing patient" rather than "any public session".
                         // ---------------------------------------------------------------------------------------------
                     ];
-                case 39:
-                    _r.sent();
+                case 41:
+                    _s.sent();
                     // ---------------------------------------------------------------------------------------------
                     // G16 — No-regression: the intake path is the ONLY source of contact info for a new visitor.
                     // This is the intakeEmailHidden / intakePhone:'hidden' configuration, and the reason the lock is
@@ -1496,13 +1504,13 @@ export var public_endpoint_auth_field_lock_tests = function (_a) {
                         // G17 — No-regression: a fully authenticated (non-public) portal session may still self-update.
                         // ---------------------------------------------------------------------------------------------
                     ];
-                case 40:
+                case 42:
                     // ---------------------------------------------------------------------------------------------
                     // G16 — No-regression: the intake path is the ONLY source of contact info for a new visitor.
                     // This is the intakeEmailHidden / intakePhone:'hidden' configuration, and the reason the lock is
                     // scoped to "matched a pre-existing patient" rather than "any public session".
                     // ---------------------------------------------------------------------------------------------
-                    _r.sent();
+                    _s.sent();
                     // ---------------------------------------------------------------------------------------------
                     // G17 — No-regression: a fully authenticated (non-public) portal session may still self-update.
                     // ---------------------------------------------------------------------------------------------
@@ -1543,11 +1551,11 @@ export var public_endpoint_auth_field_lock_tests = function (_a) {
                         // G18 — No-regression: staff submitting on a patient's behalf may still set email/phone.
                         // ---------------------------------------------------------------------------------------------
                     ];
-                case 41:
+                case 43:
                     // ---------------------------------------------------------------------------------------------
                     // G17 — No-regression: a fully authenticated (non-public) portal session may still self-update.
                     // ---------------------------------------------------------------------------------------------
-                    _r.sent();
+                    _s.sent();
                     // ---------------------------------------------------------------------------------------------
                     // G18 — No-regression: staff submitting on a patient's behalf may still set email/phone.
                     // ---------------------------------------------------------------------------------------------
@@ -1597,11 +1605,11 @@ export var public_endpoint_auth_field_lock_tests = function (_a) {
                         // accepted. Deliberately opaque rather than date-shaped, so match-vs-insert is unambiguous even when
                         // this file runs inside the full suite (no reset_db between files).
                     ];
-                case 42:
+                case 44:
                     // ---------------------------------------------------------------------------------------------
                     // G18 — No-regression: staff submitting on a patient's behalf may still set email/phone.
                     // ---------------------------------------------------------------------------------------------
-                    _r.sent();
+                    _s.sent();
                     namelessDob = "01-02-1990-".concat(RUN);
                     makeNamelessVictim = function (tag) { return __awaiter(void 0, void 0, void 0, function () {
                         var victim, stored;
@@ -1642,8 +1650,8 @@ export var public_endpoint_auth_field_lock_tests = function (_a) {
                                 }
                             });
                         }); })];
-                case 43:
-                    _r.sent();
+                case 45:
+                    _s.sent();
                     G20_NAME = 'DOB-only request does not hijack a nameless patient (booking endpoint)';
                     return [4 /*yield*/, runScenario('G20', G20_NAME, function () { return __awaiter(void 0, void 0, void 0, function () {
                             var _a, victim, stored, dob, withDob;
@@ -1680,8 +1688,8 @@ export var public_endpoint_auth_field_lock_tests = function (_a) {
                         // enduserInfo (which is spread into both the enduser insert and the form_responses record).
                         // ---------------------------------------------------------------------------------------------
                     ];
-                case 44:
-                    _r.sent();
+                case 46:
+                    _s.sent();
                     // ---------------------------------------------------------------------------------------------
                     // G21 — The match sentinel must never be stored as a patient's name.
                     // Guard rail on the fix: the fallback belongs in the filter literal only, never written into
@@ -1716,13 +1724,13 @@ export var public_endpoint_auth_field_lock_tests = function (_a) {
                         // "any public session", precisely so this keeps working.
                         // ---------------------------------------------------------------------------------------------
                     ];
-                case 45:
+                case 47:
                     // ---------------------------------------------------------------------------------------------
                     // G21 — The match sentinel must never be stored as a patient's name.
                     // Guard rail on the fix: the fallback belongs in the filter literal only, never written into
                     // enduserInfo (which is spread into both the enduser insert and the form_responses record).
                     // ---------------------------------------------------------------------------------------------
-                    _r.sent();
+                    _s.sent();
                     coldStartCase = function (label, args) { return __awaiter(void 0, void 0, void 0, function () {
                         var group, submittedEmail, submittedPhone, session, created, enduser;
                         return __generator(this, function (_a) {
@@ -1760,9 +1768,9 @@ export var public_endpoint_auth_field_lock_tests = function (_a) {
                         // And the same with no skipMatch, which still cannot match: the email branch needs email === "never"
                         // (unstorable) and the name branch needs dateOfBirth === "never" literally.
                     ];
-                case 46:
+                case 48:
                     // The shape the real webapp sends (public_form.tsx handleNoIntakeRedirect): nothing but ids.
-                    _r.sent();
+                    _s.sent();
                     // And the same with no skipMatch, which still cannot match: the email branch needs email === "never"
                     // (unstorable) and the name branch needs dateOfBirth === "never" literally.
                     return [4 /*yield*/, runScenario('G22', 'cold start without skipMatch', function () { return coldStartCase('no-skipMatch', {}); })
@@ -1784,10 +1792,10 @@ export var public_endpoint_auth_field_lock_tests = function (_a) {
                         // sentinels constrain which record shapes the filter can match, not which tenants it searches.
                         // ---------------------------------------------------------------------------------------------
                     ];
-                case 47:
+                case 49:
                     // And the same with no skipMatch, which still cannot match: the email branch needs email === "never"
                     // (unstorable) and the name branch needs dateOfBirth === "never" literally.
-                    _r.sent();
+                    _s.sent();
                     G23_NAME = 'session_for_public_form requires businessId';
                     return [4 /*yield*/, runScenario('G23', G23_NAME, function () { return __awaiter(void 0, void 0, void 0, function () {
                             var victim, omitted, blocked, wrongBiz, badBiz;
@@ -1847,8 +1855,8 @@ export var public_endpoint_auth_field_lock_tests = function (_a) {
                         // redact_field(enduser, 'hashedPassword') — the whole record — instead of just assignedTo.
                         // ---------------------------------------------------------------------------------------------
                     ];
-                case 48:
-                    _r.sent();
+                case 50:
+                    _s.sent();
                     chainForVictim = function (tag, victim) { return __awaiter(void 0, void 0, void 0, function () {
                         var t1, hop1;
                         return __generator(this, function (_a) {
@@ -1922,8 +1930,8 @@ export var public_endpoint_auth_field_lock_tests = function (_a) {
                                 }
                             });
                         }); })];
-                case 49:
-                    _r.sent();
+                case 51:
+                    _s.sent();
                     G25_NAME = 'chained session does not expose the enduser record on refresh';
                     return [4 /*yield*/, runScenario('G25', G25_NAME, function () { return __awaiter(void 0, void 0, void 0, function () {
                             var victim, _a, matched, t1, t2, PHI_KEYS, leakedIn, base, chained, leaked;
@@ -1975,8 +1983,8 @@ export var public_endpoint_auth_field_lock_tests = function (_a) {
                         // unchanged" cannot pass just because nothing happened.
                         // ---------------------------------------------------------------------------------------------
                     ];
-                case 50:
-                    _r.sent();
+                case 52:
+                    _s.sent();
                     G26_NAME = 'auto-merge does not let an intake answer repoint the merged patient';
                     return [4 /*yield*/, runScenario('G26', G26_NAME, function () { return __awaiter(void 0, void 0, void 0, function () {
                             var victimEmail, victimPhone, victimDob, victim, attackerEmail, session, sourceId, f, after, merged, customLanded;
@@ -2045,8 +2053,8 @@ export var public_endpoint_auth_field_lock_tests = function (_a) {
                         // stored flag is the load-bearing assertion here, not a follow-up submit.
                         // ---------------------------------------------------------------------------------------------
                     ];
-                case 51:
-                    _r.sent();
+                case 53:
+                    _s.sent();
                     G27_NAME = 'staff merge applies the lock when it repoints a response';
                     return [4 /*yield*/, runScenario('G27', G27_NAME, function () { return __awaiter(void 0, void 0, void 0, function () {
                             var victimEmail, victim, session, beforeMerge, afterMerge, repointed, stillVictim;
@@ -2109,8 +2117,8 @@ export var public_endpoint_auth_field_lock_tests = function (_a) {
                         // caller including this one, with no other test noticing.
                         // ---------------------------------------------------------------------------------------------
                     ];
-                case 52:
-                    _r.sent();
+                case 54:
+                    _s.sent();
                     G28_NAME = 'a fresh Stripe-created patient gets no grace on the public form path';
                     return [4 /*yield*/, runScenario('G28', G28_NAME, function () { return __awaiter(void 0, void 0, void 0, function () {
                             var victimEmail, victim, attackerEmail, attackerPhone, session, enduser;
@@ -2164,127 +2172,127 @@ export var public_endpoint_auth_field_lock_tests = function (_a) {
                         // Report
                         // ---------------------------------------------------------------------------------------------
                     ];
-                case 53:
-                    _r.sent();
+                case 55:
+                    _s.sent();
                     failures = results.filter(function (r) { return !r.ok; });
                     skipped = results.filter(function (r) { return !!r.skipped; });
                     console.log('');
                     console.log('   ┌─ Public endpoint auth-field lock — summary ────────────────────────────');
-                    for (_d = 0, results_1 = results; _d < results_1.length; _d++) {
-                        r = results_1[_d];
+                    for (_e = 0, results_1 = results; _e < results_1.length; _e++) {
+                        r = results_1[_e];
                         status_1 = r.skipped ? 'SKIP' : r.ok ? 'PASS' : 'FAIL';
                         console.log("   \u2502 ".concat(status_1, "  ").concat(r.group.padEnd(3), "  ").concat(r.name).concat(r.detail ? "  \u2014  ".concat(r.detail) : ''));
                     }
                     console.log("   \u2514\u2500 ".concat(results.length - failures.length, "/").concat(results.length, " passed, ").concat(skipped.length, " skipped, ").concat(failures.length, " failed"));
                     console.log('');
-                    _e = 0, createdEventIds_1 = createdEventIds;
-                    _r.label = 54;
-                case 54:
-                    if (!(_e < createdEventIds_1.length)) return [3 /*break*/, 57];
-                    id = createdEventIds_1[_e];
-                    return [4 /*yield*/, sdk.api.calendar_events.deleteOne(id).catch(function () { return null; })];
-                case 55:
-                    _r.sent();
-                    _r.label = 56;
+                    _f = 0, createdEventIds_1 = createdEventIds;
+                    _s.label = 56;
                 case 56:
-                    _e++;
-                    return [3 /*break*/, 54];
+                    if (!(_f < createdEventIds_1.length)) return [3 /*break*/, 59];
+                    id = createdEventIds_1[_f];
+                    return [4 /*yield*/, sdk.api.calendar_events.deleteOne(id).catch(function () { return null; })];
                 case 57:
-                    _f = 0, createdFormIds_1 = createdFormIds;
-                    _r.label = 58;
+                    _s.sent();
+                    _s.label = 58;
                 case 58:
-                    if (!(_f < createdFormIds_1.length)) return [3 /*break*/, 64];
-                    formId = createdFormIds_1[_f];
-                    return [4 /*yield*/, sdk.api.form_responses.getSome({ filter: { formId: formId } }).catch(function () { return []; })];
+                    _f++;
+                    return [3 /*break*/, 56];
                 case 59:
-                    responses = _r.sent();
-                    _g = 0, responses_1 = responses;
-                    _r.label = 60;
+                    _g = 0, createdFormIds_1 = createdFormIds;
+                    _s.label = 60;
                 case 60:
-                    if (!(_g < responses_1.length)) return [3 /*break*/, 63];
-                    response = responses_1[_g];
-                    return [4 /*yield*/, sdk.api.form_responses.deleteOne(response.id).catch(function () { return null; })];
+                    if (!(_g < createdFormIds_1.length)) return [3 /*break*/, 66];
+                    formId = createdFormIds_1[_g];
+                    return [4 /*yield*/, sdk.api.form_responses.getSome({ filter: { formId: formId } }).catch(function () { return []; })];
                 case 61:
-                    _r.sent();
-                    _r.label = 62;
+                    responses = _s.sent();
+                    _h = 0, responses_1 = responses;
+                    _s.label = 62;
                 case 62:
-                    _g++;
-                    return [3 /*break*/, 60];
+                    if (!(_h < responses_1.length)) return [3 /*break*/, 65];
+                    response = responses_1[_h];
+                    return [4 /*yield*/, sdk.api.form_responses.deleteOne(response.id).catch(function () { return null; })];
                 case 63:
-                    _f++;
-                    return [3 /*break*/, 58];
+                    _s.sent();
+                    _s.label = 64;
                 case 64:
-                    _h = 0, createdFormFieldIds_1 = createdFormFieldIds;
-                    _r.label = 65;
+                    _h++;
+                    return [3 /*break*/, 62];
                 case 65:
-                    if (!(_h < createdFormFieldIds_1.length)) return [3 /*break*/, 68];
-                    id = createdFormFieldIds_1[_h];
-                    return [4 /*yield*/, sdk.api.form_fields.deleteOne(id).catch(function () { return null; })];
+                    _g++;
+                    return [3 /*break*/, 60];
                 case 66:
-                    _r.sent();
-                    _r.label = 67;
+                    _j = 0, createdFormFieldIds_1 = createdFormFieldIds;
+                    _s.label = 67;
                 case 67:
-                    _h++;
-                    return [3 /*break*/, 65];
+                    if (!(_j < createdFormFieldIds_1.length)) return [3 /*break*/, 70];
+                    id = createdFormFieldIds_1[_j];
+                    return [4 /*yield*/, sdk.api.form_fields.deleteOne(id).catch(function () { return null; })];
                 case 68:
-                    _j = 0, createdFormIds_2 = createdFormIds;
-                    _r.label = 69;
+                    _s.sent();
+                    _s.label = 69;
                 case 69:
-                    if (!(_j < createdFormIds_2.length)) return [3 /*break*/, 72];
-                    id = createdFormIds_2[_j];
-                    return [4 /*yield*/, sdk.api.forms.deleteOne(id).catch(function () { return null; })];
+                    _j++;
+                    return [3 /*break*/, 67];
                 case 70:
-                    _r.sent();
-                    _r.label = 71;
+                    _k = 0, createdFormIds_2 = createdFormIds;
+                    _s.label = 71;
                 case 71:
-                    _j++;
-                    return [3 /*break*/, 69];
+                    if (!(_k < createdFormIds_2.length)) return [3 /*break*/, 74];
+                    id = createdFormIds_2[_k];
+                    return [4 /*yield*/, sdk.api.forms.deleteOne(id).catch(function () { return null; })];
                 case 72:
-                    uniqueEnduserIds = createdEnduserIds.filter(function (id, i) { return !!id && createdEnduserIds.indexOf(id) === i; });
-                    _k = 0, uniqueEnduserIds_1 = uniqueEnduserIds;
-                    _r.label = 73;
+                    _s.sent();
+                    _s.label = 73;
                 case 73:
-                    if (!(_k < uniqueEnduserIds_1.length)) return [3 /*break*/, 76];
-                    id = uniqueEnduserIds_1[_k];
-                    return [4 /*yield*/, sdk.api.endusers.deleteOne(id).catch(function () { return null; })];
+                    _k++;
+                    return [3 /*break*/, 71];
                 case 74:
-                    _r.sent();
-                    _r.label = 75;
+                    uniqueEnduserIds = createdEnduserIds.filter(function (id, i) { return !!id && createdEnduserIds.indexOf(id) === i; });
+                    _l = 0, uniqueEnduserIds_1 = uniqueEnduserIds;
+                    _s.label = 75;
                 case 75:
-                    _k++;
-                    return [3 /*break*/, 73];
+                    if (!(_l < uniqueEnduserIds_1.length)) return [3 /*break*/, 78];
+                    id = uniqueEnduserIds_1[_l];
+                    return [4 /*yield*/, sdk.api.endusers.deleteOne(id).catch(function () { return null; })];
                 case 76:
-                    _l = 0, createdTemplateIds_1 = createdTemplateIds;
-                    _r.label = 77;
+                    _s.sent();
+                    _s.label = 77;
                 case 77:
-                    if (!(_l < createdTemplateIds_1.length)) return [3 /*break*/, 80];
-                    id = createdTemplateIds_1[_l];
-                    return [4 /*yield*/, sdk.api.calendar_event_templates.deleteOne(id).catch(function () { return null; })];
+                    _l++;
+                    return [3 /*break*/, 75];
                 case 78:
-                    _r.sent();
-                    _r.label = 79;
+                    _m = 0, createdTemplateIds_1 = createdTemplateIds;
+                    _s.label = 79;
                 case 79:
-                    _l++;
-                    return [3 /*break*/, 77];
+                    if (!(_m < createdTemplateIds_1.length)) return [3 /*break*/, 82];
+                    id = createdTemplateIds_1[_m];
+                    return [4 /*yield*/, sdk.api.calendar_event_templates.deleteOne(id).catch(function () { return null; })];
                 case 80:
-                    _m = 0, createdUserIds_1 = createdUserIds;
-                    _r.label = 81;
+                    _s.sent();
+                    _s.label = 81;
                 case 81:
-                    if (!(_m < createdUserIds_1.length)) return [3 /*break*/, 84];
-                    id = createdUserIds_1[_m];
-                    return [4 /*yield*/, sdk.api.users.deleteOne(id).catch(function () { return null; })];
+                    _m++;
+                    return [3 /*break*/, 79];
                 case 82:
-                    _r.sent();
-                    _r.label = 83;
+                    _o = 0, createdUserIds_1 = createdUserIds;
+                    _s.label = 83;
                 case 83:
-                    _m++;
-                    return [3 /*break*/, 81];
+                    if (!(_o < createdUserIds_1.length)) return [3 /*break*/, 86];
+                    id = createdUserIds_1[_o];
+                    return [4 /*yield*/, sdk.api.users.deleteOne(id).catch(function () { return null; })];
                 case 84:
+                    _s.sent();
+                    _s.label = 85;
+                case 85:
+                    _o++;
+                    return [3 /*break*/, 83];
+                case 86:
                     // ---------------------------------------------------------------------------------------------
                     // Assert — single pass, last, so the full table above is always printed first.
                     // ---------------------------------------------------------------------------------------------
-                    for (_o = 0, results_2 = results; _o < results_2.length; _o++) {
-                        r = results_2[_o];
+                    for (_p = 0, results_2 = results; _p < results_2.length; _p++) {
+                        r = results_2[_p];
                         assert(r.ok, "\u274C [".concat(r.group, "] ").concat(r.name, " \u2014 ").concat(r.detail), "[".concat(r.group, "] ").concat(r.name).concat(r.skipped ? ' (SKIPPED)' : ''));
                     }
                     return [2 /*return*/];