@tellescope/sdk 1.256.6 → 1.256.8

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tellescope/sdk",
-  "version": "1.256.6",
+  "version": "1.256.8",
   "description": "Code for interacting with the Tellescope API",
   "main": "./lib/cjs/sdk.js",
   "module": "./lib/esm/sdk.js",
@@ -32,14 +32,14 @@
   },
   "homepage": "https://github.com/tellescope-os/tellescope#readme",
   "dependencies": {
-    "@tellescope/constants": "1.256.6",
-    "@tellescope/schema": "1.256.6",
-    "@tellescope/testing": "1.256.6",
-    "@tellescope/types-client": "1.256.6",
-    "@tellescope/types-models": "1.256.6",
-    "@tellescope/types-utilities": "1.256.6",
-    "@tellescope/utilities": "1.256.6",
-    "@tellescope/validation": "1.256.6",
+    "@tellescope/constants": "1.256.7",
+    "@tellescope/schema": "1.256.8",
+    "@tellescope/testing": "1.256.7",
+    "@tellescope/types-client": "1.256.7",
+    "@tellescope/types-models": "1.256.7",
+    "@tellescope/types-utilities": "1.256.7",
+    "@tellescope/utilities": "1.256.7",
+    "@tellescope/validation": "1.256.7",
     "axios": "0.30.3",
     "dotenv": "14.3.2",
     "form-data": "4.0.4",
@@ -55,5 +55,5 @@
   "publishConfig": {
     "access": "public"
   },
-  "gitHead": "b5672761d4ea6995488faaeb9a0ccc12436f7b30"
+  "gitHead": "194f5c52adb83f8950ad515f37a9c638b8233c90"
 }

package/src/enduser.ts

@@ -59,6 +59,7 @@ type EnduserAccessibleModels = (
   | 'allergy_codes'
   | 'forms'
   | 'enduser_eligibility_results'
+  | 'configurations' // reads reduced to publicRead: true records (form translation maps)
 )
 
 export const defaultQueries = <N extends keyof ClientModelForName>(
@@ -281,8 +282,9 @@ const loadDefaultQueries = (s: EnduserSession): { [K in EnduserAccessibleModels]
   enduser_problems: defaultQueries(s, 'enduser_problems'), 
   diagnosis_codes: defaultQueries(s, 'diagnosis_codes'), 
   allergy_codes: defaultQueries(s, 'allergy_codes'), 
-  forms: defaultQueries(s, 'forms'), 
-  enduser_eligibility_results: defaultQueries(s, 'enduser_eligibility_results'), 
+  forms: defaultQueries(s, 'forms'),
+  enduser_eligibility_results: defaultQueries(s, 'enduser_eligibility_results'),
+  configurations: defaultQueries(s, 'configurations'), // reads reduced to publicRead: true records (form translation maps)
 })
 
 

package/src/tests/api_tests/calendar_event_create_and_bulk_triggers.test.ts

@@ -0,0 +1,293 @@
+import { Session } from "../../sdk"
+import { log_header, wait, async_test } from "@tellescope/testing"
+import { setup_tests } from "../setup"
+
+const host = process.env.API_URL || "http://localhost:8080"
+
+// Every trigger in this suite is filtered to this single title, so the suite can neither perturb nor
+// be perturbed by other suites' calendar events. Assertions use includes()/!includes() rather than
+// exact tag counts for the same reason.
+const TITLE = 'Create Bulk Trigger Test'
+
+const TAG = {
+  Created: 'CB: Created',
+  Completed: 'CB: Completed',
+  'No-showed': 'CB: No-showed',
+  Cancelled: 'CB: Cancelled',
+  CancelledByUser: 'CB: Cancelled by user',
+} as const
+
+export const calendar_event_create_and_bulk_triggers_tests = async ({ sdk } : { sdk: Session, sdkNonAdmin: Session }) => {
+  log_header("Automation Trigger Tests (Create Path + bulk_update)")
+
+  const createdTriggerIds: string[] = []
+  const createdEnduserIds: string[] = []
+  const createdEventIds: string[] = []
+
+  const createEnduser = async () => {
+    const e = await sdk.api.endusers.createOne({})
+    createdEnduserIds.push(e.id)
+    return e
+  }
+  const createEvent = async (overrides: Record<string, any> = {}) => {
+    const event = await sdk.api.calendar_events.createOne({
+      title: TITLE,
+      durationInMinutes: 30,
+      startTimeInMS: Date.now() + Math.floor(Math.random() * 100000),
+      ...overrides,
+    } as any)
+    createdEventIds.push(event.id)
+    return event
+  }
+
+  const tagsOf = async (enduserId: string) => (await sdk.api.endusers.getOne(enduserId)).tags || []
+
+  try {
+    for (const [type, info, tag] of [
+      ['Appointment Created', { titles: [TITLE] }, TAG.Created],
+      ['Appointment Completed', { titles: [TITLE] }, TAG.Completed],
+      ['Appointment No-Showed', { titles: [TITLE] }, TAG['No-showed']],
+      ['Appointment Cancelled', { titles: [TITLE] }, TAG.Cancelled],
+      ['Appointment Cancelled', { titles: [TITLE], by: 'user' }, TAG.CancelledByUser],
+    ] as const) {
+      const t = await sdk.api.automation_triggers.createOne({
+        event: { type, info } as any,
+        action: { type: 'Add Tags', info: { tags: [tag] } },
+        status: 'Active',
+        title: tag,
+      })
+      createdTriggerIds.push(t.id)
+    }
+
+    // ============================================================
+    // SECTION 1: single create path, with per-attendee statuses already set at creation.
+    // Covers the completed-at-create branch of handle_new_events_trigger, which routes through
+    // enduser_ids_for_event_wide_completion. Nothing else in the test suite creates an event with
+    // attendeeStatuses / cancelledGroupAttendees preset.
+    // ============================================================
+    log_header("Create-time per-attendee statuses respected by completed-at-create")
+
+    const createNoShow = await createEnduser()
+    const createLegacyCancelled = await createEnduser()
+    const createActive = await createEnduser()
+
+    await createEvent({
+      attendees: [
+        { type: 'enduser', id: createNoShow.id },
+        { type: 'enduser', id: createLegacyCancelled.id },
+        { type: 'enduser', id: createActive.id },
+      ],
+      completedAt: new Date(),
+      completedBy: sdk.userInfo.id,
+      attendeeStatuses: [{ id: createNoShow.id, at: new Date(), status: 'No-showed' }],
+      // legacy shape: cancelled with no attendeeStatuses entry (what the portal writes)
+      cancelledGroupAttendees: [{ id: createLegacyCancelled.id, at: new Date() }],
+    })
+    await wait(undefined, 1000)
+
+    await async_test(
+      "completed-at-create fires Completed for the un-statused attendee",
+      () => tagsOf(createActive.id),
+      { onResult: (tags: string[]) => tags.includes(TAG.Completed) }
+    )
+    await async_test(
+      "completed-at-create does NOT fire Completed for a 'No-showed' attendee",
+      () => tagsOf(createNoShow.id),
+      { onResult: (tags: string[]) => !tags.includes(TAG.Completed) }
+    )
+    await async_test(
+      "completed-at-create does NOT fire Completed for a cancelledGroupAttendees attendee",
+      () => tagsOf(createLegacyCancelled.id),
+      { onResult: (tags: string[]) => !tags.includes(TAG.Completed) }
+    )
+    // the create path has no per-attendee status dispatch (that only runs as an update side effect),
+    // so a status set at creation fires nothing of its own — pinning current behavior
+    await async_test(
+      "a 'No-showed' status set at creation fires no No-Showed trigger",
+      () => tagsOf(createNoShow.id),
+      { onResult: (tags: string[]) => !tags.includes(TAG['No-showed']) }
+    )
+    // an event completed at creation uses the Completed trigger only, never Created
+    for (const [label, e] of [
+      ['no-showed', createNoShow], ['legacy-cancelled', createLegacyCancelled], ['active', createActive],
+    ] as const) {
+      await async_test(
+        `completed-at-create does NOT fire Created for the ${label} attendee`,
+        () => tagsOf(e.id),
+        { onResult: (tags: string[]) => !tags.includes(TAG.Created) }
+      )
+    }
+
+    // ============================================================
+    // SECTION 2: bulk create path (createSome with >1 event) — handle_new_events_trigger returns early
+    // for a single event, so more than one event is required to route through bulk_handle_actions_for_triggers.
+    // ============================================================
+    log_header("Bulk create path respects per-attendee statuses")
+
+    const bulkNoShow = await createEnduser()
+    const bulkActive = await createEnduser()
+    const bulkCreated = await createEnduser()
+
+    const bulkResult = await sdk.api.calendar_events.createSome([
+      {
+        title: TITLE,
+        durationInMinutes: 30,
+        startTimeInMS: Date.now(),
+        attendees: [{ type: 'enduser', id: bulkNoShow.id }, { type: 'enduser', id: bulkActive.id }],
+        completedAt: new Date(),
+        completedBy: sdk.userInfo.id,
+        attendeeStatuses: [{ id: bulkNoShow.id, at: new Date(), status: 'No-showed' }],
+      },
+      {
+        title: TITLE,
+        durationInMinutes: 30,
+        startTimeInMS: Date.now(),
+        attendees: [{ type: 'enduser', id: bulkCreated.id }],
+      },
+    ] as any)
+    createdEventIds.push(...bulkResult.created.map(e => e.id))
+    await wait(undefined, 1000)
+
+    // routing canary: a single created event short-circuits before the bulk handler, so this suite only
+    // covers the bulk branch as long as both events are created in one request
+    await async_test(
+      "bulk create routing canary: both events created in one request",
+      async () => bulkResult.created.length,
+      { onResult: (count: number) => count === 2 }
+    )
+    await async_test(
+      "bulk create fires Completed for the un-statused attendee",
+      () => tagsOf(bulkActive.id),
+      { onResult: (tags: string[]) => tags.includes(TAG.Completed) }
+    )
+    await async_test(
+      "bulk create does NOT fire Completed for a 'No-showed' attendee",
+      () => tagsOf(bulkNoShow.id),
+      { onResult: (tags: string[]) => !tags.includes(TAG.Completed) }
+    )
+    await async_test(
+      "bulk create fires Created for an attendee of the non-completed event",
+      () => tagsOf(bulkCreated.id),
+      { onResult: (tags: string[]) => tags.includes(TAG.Created) }
+    )
+    await async_test(
+      "bulk create does NOT fire Created for attendees of the completed event",
+      () => tagsOf(bulkActive.id),
+      { onResult: (tags: string[]) => !tags.includes(TAG.Created) }
+    )
+
+    // ============================================================
+    // SECTION 3: Appointment Created fans out to every attendee of a group event.
+    // ============================================================
+    log_header("Appointment Created fires for all attendees of a group event")
+
+    const created1 = await createEnduser()
+    const created2 = await createEnduser()
+    const created3 = await createEnduser()
+
+    await createEvent({
+      attendees: [
+        { type: 'enduser', id: created1.id },
+        { type: 'enduser', id: created2.id },
+        { type: 'enduser', id: created3.id },
+      ],
+    })
+    await wait(undefined, 1000)
+
+    const groupCreatedAttendees = [created1, created2, created3]
+    for (let i = 0; i < groupCreatedAttendees.length; i++) {
+      const enduserId = groupCreatedAttendees[i].id
+      await async_test(
+        `group event fires Created for attendee #${i + 1}`,
+        () => tagsOf(enduserId),
+        { onResult: (tags: string[]) => tags.includes(TAG.Created) }
+      )
+    }
+
+    // ============================================================
+    // SECTION 4: bulk_update action 'no_show' fires the No-Showed trigger.
+    // ============================================================
+    log_header("bulk_update 'no_show' fires No-Showed for all attendees")
+
+    const noShowA = await createEnduser()
+    const noShowB = await createEnduser()
+    const noShowEvent = await createEvent({
+      attendees: [{ type: 'enduser', id: noShowA.id }, { type: 'enduser', id: noShowB.id }],
+    })
+
+    await sdk.api.calendar_events.bulk_update({ ids: [noShowEvent.id], action: 'no_show' })
+    await wait(undefined, 1000)
+
+    await async_test(
+      "bulk_update 'no_show' fires No-Showed for attendee #1",
+      () => tagsOf(noShowA.id),
+      { onResult: (tags: string[]) => tags.includes(TAG['No-showed']) }
+    )
+    await async_test(
+      "bulk_update 'no_show' fires No-Showed for attendee #2",
+      () => tagsOf(noShowB.id),
+      { onResult: (tags: string[]) => tags.includes(TAG['No-showed']) }
+    )
+
+    // ============================================================
+    // SECTION 5: bulk_update action 'cancel' fires the Cancelled trigger, including by:'user'
+    // (the bulk cancel writes statusChangeSource: { source: 'user' }).
+    // ============================================================
+    log_header("bulk_update 'cancel' fires Cancelled for all attendees")
+
+    const cancelA = await createEnduser()
+    const cancelB = await createEnduser()
+    const cancelEvent = await createEvent({
+      attendees: [{ type: 'enduser', id: cancelA.id }, { type: 'enduser', id: cancelB.id }],
+    })
+
+    await sdk.api.calendar_events.bulk_update({ ids: [cancelEvent.id], action: 'cancel' })
+    await wait(undefined, 1000)
+
+    for (const [label, e] of [['#1', cancelA], ['#2', cancelB]] as const) {
+      await async_test(
+        `bulk_update 'cancel' fires Cancelled for attendee ${label}`,
+        () => tagsOf(e.id),
+        { onResult: (tags: string[]) => tags.includes(TAG.Cancelled) }
+      )
+      await async_test(
+        `bulk_update 'cancel' fires by:'user' Cancelled for attendee ${label}`,
+        () => tagsOf(e.id),
+        { onResult: (tags: string[]) => tags.includes(TAG.CancelledByUser) }
+      )
+    }
+
+  } finally {
+    for (const id of createdEventIds) {
+      try { await sdk.api.calendar_events.deleteOne(id) } catch (_) {}
+    }
+    for (const id of createdEnduserIds) {
+      try { await sdk.api.endusers.deleteOne(id) } catch (_) {}
+    }
+    for (const id of createdTriggerIds) {
+      try { await sdk.api.automation_triggers.deleteOne(id) } catch (_) {}
+    }
+  }
+}
+
+// Allow running this test file independently
+if (require.main === module) {
+  console.log(`🌐 Using API URL: ${host}`)
+  const sdk = new Session({ host })
+  const sdkNonAdmin = new Session({ host })
+
+  const runTests = async () => {
+    await setup_tests(sdk, sdkNonAdmin)
+    await calendar_event_create_and_bulk_triggers_tests({ sdk, sdkNonAdmin })
+  }
+
+  runTests()
+    .then(() => {
+      console.log("✅ Calendar event create path + bulk_update trigger tests completed successfully")
+      process.exit(0)
+    })
+    .catch((error) => {
+      console.error("❌ Calendar event create path + bulk_update trigger tests failed:", error)
+      process.exit(1)
+    })
+}

package/src/tests/api_tests/configurations_public_read.test.ts

@@ -0,0 +1,116 @@
+require('source-map-support').install();
+
+import { Session, EnduserSession } from "../../sdk"
+import {
+  assert,
+  async_test,
+  handleAnyError,
+  log_header,
+} from "@tellescope/testing"
+import { setup_tests } from "../setup"
+
+const host = process.env.API_URL || 'http://localhost:8080' as const
+
+// Modular test for the configurations publicRead flag (added for AI form translation maps).
+//
+// The critical security property: configurations hold sensitive integration settings (API keys etc.),
+// so enduser read access is opt-in PER RECORD via publicRead: true. A configuration without the flag
+// must remain completely invisible to enduser sessions, and endusers must never be able to write
+// configurations at all.
+export const configurations_public_read_tests = async ({ sdk } : { sdk: Session, sdkNonAdmin: Session }) => {
+  log_header("Configurations publicRead Tests")
+
+  const createdConfigurationIds: string[] = []
+  let enduserId: string | undefined
+
+  try {
+    // config A simulates an integration config (no flag); config B is a flagged translation-map-style record
+    const configA = await sdk.api.configurations.createOne({
+      type: 'test-private-configuration',
+      value: JSON.stringify({ apiKey: 'super-secret' }),
+    })
+    createdConfigurationIds.push(configA.id)
+
+    const configB = await sdk.api.configurations.createOne({
+      type: 'test-public-configuration',
+      value: JSON.stringify({ Hello: 'Hola' }),
+      publicRead: true,
+    })
+    createdConfigurationIds.push(configB.id)
+
+    const enduser = await sdk.api.endusers.createOne({
+      email: `configurations_public_read_${Date.now()}@test.tellescope.com`,
+    })
+    enduserId = enduser.id
+
+    const { authToken, enduser: authEnduser } = await sdk.api.endusers.generate_auth_token({ id: enduser.id })
+    const enduserSDK = new EnduserSession({ host, authToken, enduser: authEnduser, businessId: sdk.userInfo.businessId })
+
+    // --- reads ---
+    await async_test(
+      'enduser CAN read a publicRead configuration by id',
+      () => enduserSDK.api.configurations.getOne(configB.id),
+      { onResult: c => c?.id === configB.id && c.value === configB.value },
+    )
+    await async_test(
+      'enduser CANNOT read an unflagged configuration by id (key security assertion)',
+      () => enduserSDK.api.configurations.getOne(configA.id),
+      handleAnyError,
+    )
+    await async_test(
+      'enduser getSome returns only publicRead configurations',
+      () => enduserSDK.api.configurations.getSome({}),
+      { onResult: configurations => (
+        configurations.some(c => c.id === configB.id)
+        && !configurations.some(c => c.id === configA.id)
+      )},
+    )
+
+    // --- writes: endusers have no create/update/delete on configurations ---
+    await async_test(
+      'enduser CANNOT create a configuration',
+      () => enduserSDK.api.configurations.createOne({ type: 'test-enduser-create', value: '{}', publicRead: true }),
+      handleAnyError,
+    )
+    await async_test(
+      'enduser CANNOT update a configuration (even a publicRead one)',
+      () => enduserSDK.api.configurations.updateOne(configB.id, { value: '{}' }),
+      handleAnyError,
+    )
+    await async_test(
+      'enduser CANNOT delete a configuration',
+      () => enduserSDK.api.configurations.deleteOne(configB.id),
+      handleAnyError,
+    )
+
+    // staff access is unchanged by the flag
+    const staffRead = await sdk.api.configurations.getOne(configA.id)
+    assert(staffRead?.id === configA.id, 'staff could not read unflagged configuration', 'staff reads unflagged configuration')
+  } finally {
+    for (const id of createdConfigurationIds) {
+      await sdk.api.configurations.deleteOne(id).catch(() => {})
+    }
+    if (enduserId) await sdk.api.endusers.deleteOne(enduserId).catch(() => {})
+  }
+}
+
+// Allow running this test file independently
+if (require.main === module) {
+  const sdk = new Session({ host })
+  const sdkNonAdmin = new Session({ host })
+
+  const runTests = async () => {
+    await setup_tests(sdk, sdkNonAdmin)
+    await configurations_public_read_tests({ sdk, sdkNonAdmin })
+  }
+
+  runTests()
+    .then(() => {
+      console.log("✅ Configurations publicRead test suite completed successfully")
+      process.exit(0)
+    })
+    .catch((error) => {
+      console.error("❌ Configurations publicRead test suite failed:", error)
+      process.exit(1)
+    })
+}

package/src/tests/api_tests/form_started_trigger.test.ts

@@ -30,13 +30,14 @@ export const form_started_trigger_tests = async ({ sdk, sdkNonAdmin } : { sdk: S
   }
 
   // Helper to start a public form session (this triggers Form Started)
-  const startPublicForm = async (email: string) => {
+  const startPublicForm = async (email: string, publicIdentifier?: string) => {
     const enduserSDK = new EnduserSession({ host, businessId: form.businessId })
     return await enduserSDK.api.form_responses.session_for_public_form({
       formId: form.id,
       businessId: form.businessId,
       email,
       skipMatch: true,
+      ...publicIdentifier ? { publicIdentifier } : {},
     })
   }
 
@@ -257,11 +258,58 @@ export const form_started_trigger_tests = async ({ sdk, sdkNonAdmin } : { sdk: S
 
   await sdk.api.automation_triggers.deleteOne(triggerFinalized.id)
 
+  // Test 7: {{PUBLIC_IDENTIFIER}} resolves in Add Tags / Set Fields, matching Form Submitted
+  const triggerPublicIdentifierTag = await sdk.api.automation_triggers.createOne({
+    event: { type: 'Form Started', info: { formIds: [form.id] } },
+    action: { type: 'Add Tags', info: { tags: ['{{PUBLIC_IDENTIFIER}}'] } },
+    status: 'Active',
+    title: "Public identifier tag",
+  })
+  const triggerPublicIdentifierField = await sdk.api.automation_triggers.createOne({
+    event: { type: 'Form Started', info: { formIds: [form.id] } },
+    action: { type: 'Set Fields', info: { fields: [{
+      name: 'fstSource', type: 'Custom Value', value: '{{PUBLIC_IDENTIFIER}}',
+    }] } },
+    status: 'Active',
+    title: "Public identifier field",
+  })
+
+  const PUBLIC_IDENTIFIER = 'fst-pubid-abc123'
+  const { enduserId: enduserId11 } = await startPublicForm('fst-test11@tellescope.com', PUBLIC_IDENTIFIER)
+  await wait(undefined, 500)
+  await async_test(
+    "{{PUBLIC_IDENTIFIER}} resolves to the identifier in Add Tags",
+    () => sdk.api.endusers.getOne(enduserId11),
+    { onResult: (e: Enduser) => (
+      !!e.tags?.includes(PUBLIC_IDENTIFIER) && !e.tags?.includes('{{PUBLIC_IDENTIFIER}}')
+    )}
+  )
+  await async_test(
+    "{{PUBLIC_IDENTIFIER}} resolves to the identifier in Set Fields",
+    () => sdk.api.endusers.getOne(enduserId11),
+    { onResult: (e: Enduser) => e.fields?.fstSource === PUBLIC_IDENTIFIER }
+  )
+
+  // no publicIdentifier on the link => literal is left as-is (same guard as Form Submitted)
+  const { enduserId: enduserId12 } = await startPublicForm('fst-test12@tellescope.com')
+  await wait(undefined, 500)
+  await async_test(
+    "{{PUBLIC_IDENTIFIER}} left as literal when form started without an identifier",
+    () => sdk.api.endusers.getOne(enduserId12),
+    { onResult: (e: Enduser) => (
+      !!e.tags?.includes('{{PUBLIC_IDENTIFIER}}') && e.fields?.fstSource === '{{PUBLIC_IDENTIFIER}}'
+    )}
+  )
+
+  await sdk.api.automation_triggers.deleteOne(triggerPublicIdentifierTag.id)
+  await sdk.api.automation_triggers.deleteOne(triggerPublicIdentifierField.id)
+
   // Cleanup - delete all endusers created during test
   const enduserEmails = [
     'fst-test1@tellescope.com', 'fst-test2@tellescope.com', 'fst-test3@tellescope.com',
     'fst-test4@tellescope.com', 'fst-test5@tellescope.com', 'fst-test7@tellescope.com',
     'fst-test8@tellescope.com', 'fst-test9@tellescope.com', 'fst-test10@tellescope.com',
+    'fst-test11@tellescope.com', 'fst-test12@tellescope.com',
     'fst-test-prepare1@tellescope.com', 'fst-test-prepare2@tellescope.com',
   ]
   for (const email of enduserEmails) {