@tellescope/sdk 2.0.0-beta.0 → 2.0.0-beta.2

package/lib/cjs/tests/api_tests/security/form-logic-js-execution.test.js.map

@@ -1 +1 @@
-{"version":3,"file":"form-logic-js-execution.test.js","sourceRoot":"","sources":["../../../../../src/tests/api_tests/security/form-logic-js-execution.test.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,OAAO,CAAC,oBAAoB,CAAC,CAAC,OAAO,EAAE,CAAC;AAExC,uDAI6B;AAE7B,IAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,uBAAgC,CAAA;AAEpE,IAAM,IAAI,GAAG,cAAM,OAAA,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAvC,CAAuC,CAAA;AAE1D;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACI,IAAM,8BAA8B,GAAG;;;;;gBACtC,MAAM,GAAY,EAAE,CAAA;gBACpB,MAAM,GAAG,UAAC,KAAa,EAAE,IAAa,EAAE,MAAc,IAAK,OAAA,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,OAAA,EAAE,IAAI,MAAA,EAAE,MAAM,QAAA,EAAE,CAAC,EAApC,CAAoC,CAAA;gBAE/F,UAAU,GAAG,eAAe,CAAA;gBAC5B,UAAU,GAAG,IAAI,CAAA;gBAEjB,SAAS,GAAG,UAAC,KAAa,IAAK,OAAA,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,SAAS,EAAE,EAAE,aAAa,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,EAA9D,CAA8D,CAAA;gBAC7F,cAAc,GAAG,UAAC,KAAa,IAAK,OAAA,CAAC,CAAC;wBAC1C,IAAI,EAAE,eAAe;wBACrB,IAAI,EAAE,EAAE,OAAO,EAAE,0BAA0B,EAAE,QAAQ,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,SAAS,EAAE,SAAS,CAAC,KAAK,CAAC,EAAE;qBACnG,CAAC,CAAC,EAHuC,CAGvC,CAAA;gBAEG,OAAO,GAAG,UAAO,EAAsB;;wBAAK,sBAAA,CAChD,EAAE,EAAE,CAAC,IAAI,CAAC,cAAM,OAAA,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAG,MAAM,EAAE,UAAU,EAAE,CAAC,EAAzC,CAAyC,CAAC;iCACrD,KAAK,CAAC,UAAC,CAAM,IAAK,OAAA,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAa,CAAA,CAAC,aAAD,CAAC,uBAAD,CAAC,CAAE,OAAO,KAAI,CAAC,CAAE,EAAE,CAAC,EAA7D,CAA6D,CAAC,CACtF,EAAA;;qBAAA,CAAA;;;;gBAKU,qBAAM,IAAA,sCAAqB,EAAC,EAAE,IAAI,EAAE,gBAAS,IAAI,EAAE,CAAE,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,EAAA;;gBAAzG,MAAM,GAAG,SAAgG,CAAA;gBACnG,QAAM,MAAM,CAAC,GAAG,CAAA;gBAET,qBAAM,KAAG,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,UAAG,IAAI,EAAE,CAAE,EAAE,CAAC,EAAA;;gBAA5D,SAAO,SAAqD;gBACpD,qBAAM,KAAG,CAAC,GAAG,CAAC,WAAW,CAAC,SAAS,CAAC;wBAChD,MAAM,EAAE,MAAI,CAAC,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,cAAc,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;qBAC/F,CAAC;oBAEF,iGAAiG;kBAF/F;;gBAFI,UAAQ,SAEZ;gBAIoB,qBAAM,OAAO,CAAC,cAAM,OAAA,KAAG,CAAC,GAAG,CAAC,WAAW,CAAC,SAAS,CAAC;wBACtE,MAAM,EAAE,MAAI,CAAC,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ;wBACjD,cAAc,EAAE,cAAc,CAAC,UAAU,CAAQ;qBAClD,CAAC,EAHwC,CAGxC,CAAC,EAAA;;gBAHG,aAAa,GAAG,SAGnB;gBACH,MAAM,CACJ,+DAA+D,EAC/D,aAAa,CAAC,QAAQ,EAAE,aAAa,CAAC,MAAM,CAC7C,CAAA;gBAEqB,qBAAM,OAAO,CAAC,cAAM,OAAA,KAAG,CAAC,GAAG,CAAC,WAAW,CAAC,SAAS,CAAC;wBACtE,MAAM,EAAE,MAAI,CAAC,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ;wBACjD,cAAc,EAAE,cAAc,CAAC,UAAU,CAAQ;qBAClD,CAAC,EAHwC,CAGxC,CAAC,EAAA;;gBAHG,aAAa,GAAG,SAGnB;gBACH,MAAM,CACJ,oEAAoE,EACpE,CAAC,aAAa,CAAC,QAAQ,EAAE,aAAa,CAAC,MAAM,CAC9C,CAAA;gBAEqB,qBAAM,OAAO,CAAC,cAAM,OAAA,KAAG,CAAC,GAAG,CAAC,WAAW,CAAC,SAAS,CAAC,OAAK,CAAC,EAAE,EAAE;wBAChF,cAAc,EAAE,cAAc,CAAC,UAAU,CAAQ;qBAClD,CAAC,EAFwC,CAExC,CAAC,EAAA;;gBAFG,aAAa,GAAG,SAEnB;gBACH,MAAM,CACJ,oEAAoE,EACpE,CAAC,aAAa,CAAC,QAAQ,EAAE,aAAa,CAAC,MAAM,CAC9C,CAAA;gBAIoB,qBAAM,OAAO,CAAC,cAAM,OAAA,KAAG,CAAC,GAAG,CAAC,WAAW,CAAC,SAAS,CAAC,OAAK,CAAC,EAAE,EAAE;wBAC/E,kBAAkB,EAAE,SAAS,CAAC,UAAU,CAAQ;qBACjD,CAAC,EAFuC,CAEvC,CAAC,EAAA;;gBAFG,YAAY,GAAG,SAElB;gBACH,MAAM,CAAC,wDAAwD,EAAE,YAAY,CAAC,QAAQ,EAAE,YAAY,CAAC,MAAM,CAAC,CAAA;gBAEvF,qBAAM,OAAO,CAAC,cAAM,OAAA,KAAG,CAAC,GAAG,CAAC,WAAW,CAAC,SAAS,CAAC,OAAK,CAAC,EAAE,EAAE;wBAC/E,kBAAkB,EAAE,SAAS,CAAC,UAAU,CAAQ;qBACjD,CAAC,EAFuC,CAEvC,CAAC,EAAA;;gBAFG,YAAY,GAAG,SAElB;gBACH,MAAM,CAAC,6DAA6D,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,YAAY,CAAC,MAAM,CAAC,CAAA;gBAI5F,qBAAM,OAAO,CAAC,cAAM,OAAA,KAAG,CAAC,GAAG,CAAC,WAAW,CAAC,SAAS,CAAC,OAAK,CAAC,EAAE,EAAE;wBAChF,OAAO,EAAE,EAAE,aAAa,EAAE,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,aAAa,EAAE,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC,EAAS;qBAC3F,CAAC,EAFwC,CAExC,CAAC,EAAA;;gBAFG,aAAa,GAAG,SAEnB;gBACH,MAAM,CAAC,iEAAiE,EAAE,aAAa,CAAC,QAAQ,EAAE,aAAa,CAAC,MAAM,CAAC,CAAA;gBAEjG,qBAAM,OAAO,CAAC,cAAM,OAAA,KAAG,CAAC,GAAG,CAAC,WAAW,CAAC,SAAS,CAAC,OAAK,CAAC,EAAE,EAAE;wBAChF,OAAO,EAAE,EAAE,aAAa,EAAE,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,aAAa,EAAE,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC,EAAS;qBAC3F,CAAC,EAFwC,CAExC,CAAC,EAAA;;gBAFG,aAAa,GAAG,SAEnB;gBACH,MAAM,CAAC,sEAAsE,EAAE,CAAC,aAAa,CAAC,QAAQ,EAAE,aAAa,CAAC,MAAM,CAAC,CAAA;gBAItG,qBAAM,OAAO,CAAC,cAAM,OAAA,KAAG,CAAC,GAAG,CAAC,WAAW,CAAC,SAAS,CAAC,OAAK,CAAC,EAAE,EAAE;wBACjF,OAAO,EAAE,EAAE,iBAAiB,EAAE,CAAC,EAAE,SAAS,EAAE,0BAA0B,EAAE,aAAa,EAAE,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC,EAAS;qBACzH,CAAC,EAFyC,CAEzC,CAAC,EAAA;;gBAFG,cAAc,GAAG,SAEpB;gBACH,MAAM,CAAC,qEAAqE,EAAE,cAAc,CAAC,QAAQ,EAAE,cAAc,CAAC,MAAM,CAAC,CAAA;gBAEtG,qBAAM,OAAO,CAAC,cAAM,OAAA,KAAG,CAAC,GAAG,CAAC,WAAW,CAAC,SAAS,CAAC,OAAK,CAAC,EAAE,EAAE;wBACjF,OAAO,EAAE,EAAE,iBAAiB,EAAE,CAAC,EAAE,SAAS,EAAE,0BAA0B,EAAE,aAAa,EAAE,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC,EAAS;qBACzH,CAAC,EAFyC,CAEzC,CAAC,EAAA;;gBAFG,cAAc,GAAG,SAEpB;gBACH,MAAM,CAAC,0EAA0E,EAAE,CAAC,cAAc,CAAC,QAAQ,EAAE,cAAc,CAAC,MAAM,CAAC,CAAA;gBAI7H,YAAU,UAAC,UAAkB,EAAE,SAAsB;oBAAtB,0BAAA,EAAA,cAAsB;oBAAK,OAAA,CAAC;wBAC/D,KAAK,EAAE,UAAG,IAAI,EAAE,CAAE;wBAClB,MAAM,EAAE,UAAU;wBAClB,KAAK,aAAI,IAAI,EAAE,gBAAgB,EAAE,IAAI,aAAI,MAAM,EAAE,MAAI,CAAC,EAAE,IAAK,SAAS,KAAO,UAAU,CAAE;wBACzF,MAAM,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,qBAAqB,CAAC,EAAE,EAAE;qBAC9D,CAAA;gBALuD,CAKvD,CAAA;gBAEc,qBAAM,OAAO,CAAC,cAAM,OAAA,KAAG,CAAC,GAAG,CAAC,mBAAmB,CAAC,SAAS,CAC9E,SAAO,CAAC,EAAE,UAAU,EAAE,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC,CAC/C,EAF0C,CAE1C,CAAC,EAAA;;gBAFI,cAAc,GAAG,SAErB;gBACF,MAAM,CAAC,8DAA8D,EAAE,cAAc,CAAC,QAAQ,EAAE,cAAc,CAAC,MAAM,CAAC,CAAA;gBAG/F,qBAAM,OAAO,CAAC,cAAM,OAAA,KAAG,CAAC,GAAG,CAAC,mBAAmB,CAAC,SAAS,CAC9E,SAAO,CAAC,EAAE,UAAU,EAAE,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC,CAC/C,EAF0C,CAE1C,CAAC,EAAA;;gBAFI,cAAc,GAAG,SAErB;gBACF,MAAM,CAAC,0DAA0D,EAAE,CAAC,cAAc,CAAC,QAAQ,EAAE,cAAc,CAAC,MAAM,CAAC,CAAA;gBAE3F,qBAAM,OAAO,CAAC;;wBAAM,OAAA,KAAG,CAAC,GAAG,CAAC,mBAAmB,CAAC,SAAS,CAC/E,SAAO,CAAC,EAAE,EAAE,EAAE,kBAAkB,YAAI,GAAC,MAAI,CAAC,EAAE,IAAG,SAAS,CAAC,UAAU,CAAC,KAAE,EAAE,CAAC,CAC1E;oBAF2C,CAE3C,CAAC,EAAA;;gBAFI,eAAe,GAAG,SAEtB;gBACF,MAAM,CAAC,uEAAuE,EAAE,CAAC,eAAe,CAAC,QAAQ,EAAE,eAAe,CAAC,MAAM,CAAC,CAAA;;;qBAI9H,MAAM,EAAN,yBAAM;;;;gBAAU,qBAAM,MAAM,CAAC,QAAQ,EAAE,EAAA;;gBAAvB,SAAuB,CAAA;;;;gBAAe,OAAO,CAAC,KAAK,CAAC,iBAAiB,EAAE,GAAC,CAAC,CAAA;;;qBAG/F,sBAAO,MAAM,EAAA;;;KACd,CAAA;AA5HY,QAAA,8BAA8B,kCA4H1C;AAED,kFAAkF;AAC3E,IAAM,6BAA6B,GAAG;;;;;gBAC3C,KAAA,8BAAa,CAAA;sBAAC,iCAAiC;gBAAE,qBAAM,IAAA,sCAA8B,GAAE,EAAA;;gBAAvF,4BAAiD,SAAsC,GAAC,CAAA;;;;KACzF,CAAA;AAFY,QAAA,6BAA6B,iCAEzC;AAED,6CAA6C;AAC7C,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,EAAE;IAC3B,OAAO,CAAC,GAAG,CAAC,sCAAqB,IAAI,CAAE,CAAC,CAAA;IACxC,IAAA,qCAA6B,GAAE;SAC5B,IAAI,CAAC;QACJ,OAAO,CAAC,GAAG,CAAC,6DAA6D,CAAC,CAAA;QAC1E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC,CAAC;SACD,KAAK,CAAC,UAAC,KAAK;QACX,OAAO,CAAC,KAAK,CAAC,8CAA8C,EAAE,KAAK,CAAC,CAAA;QACpE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC,CAAC,CAAA;CACL"}
+{"version":3,"file":"form-logic-js-execution.test.js","sourceRoot":"","sources":["../../../../../src/tests/api_tests/security/form-logic-js-execution.test.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,OAAO,CAAC,oBAAoB,CAAC,CAAC,OAAO,EAAE,CAAC;AAExC,uDAK6B;AAE7B,IAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,uBAAgC,CAAA;AAEpE,IAAM,IAAI,GAAG,cAAM,OAAA,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAvC,CAAuC,CAAA;AAE1D;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACI,IAAM,8BAA8B,GAAG;;;;;gBACtC,MAAM,GAAY,EAAE,CAAA;gBACpB,MAAM,GAAG,UAAC,KAAa,EAAE,IAAa,EAAE,MAAc,IAAK,OAAA,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,OAAA,EAAE,IAAI,MAAA,EAAE,MAAM,QAAA,EAAE,CAAC,EAApC,CAAoC,CAAA;gBAE/F,UAAU,GAAG,eAAe,CAAA;gBAC5B,UAAU,GAAG,IAAI,CAAA;gBAEjB,SAAS,GAAG,UAAC,KAAa,IAAK,OAAA,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,SAAS,EAAE,EAAE,aAAa,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,EAA9D,CAA8D,CAAA;gBAC7F,cAAc,GAAG,UAAC,KAAa,IAAK,OAAA,CAAC,CAAC;wBAC1C,IAAI,EAAE,eAAe;wBACrB,IAAI,EAAE,EAAE,OAAO,EAAE,0BAA0B,EAAE,QAAQ,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,SAAS,EAAE,SAAS,CAAC,KAAK,CAAC,EAAE;qBACnG,CAAC,CAAC,EAHuC,CAGvC,CAAA;gBAEG,OAAO,GAAG,UAAO,EAAsB;;wBAAK,sBAAA,CAChD,EAAE,EAAE,CAAC,IAAI,CAAC,cAAM,OAAA,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAG,MAAM,EAAE,UAAU,EAAE,CAAC,EAAzC,CAAyC,CAAC;iCACrD,KAAK,CAAC,UAAC,CAAM,IAAK,OAAA,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAa,CAAA,CAAC,aAAD,CAAC,uBAAD,CAAC,CAAE,OAAO,KAAI,CAAC,CAAE,EAAE,CAAC,EAA7D,CAA6D,CAAC,CACtF,EAAA;;qBAAA,CAAA;;;;gBAKU,qBAAM,IAAA,sCAAqB,EAAC,EAAE,IAAI,EAAE,gBAAS,IAAI,EAAE,CAAE,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,EAAA;;gBAAzG,MAAM,GAAG,SAAgG,CAAA;gBACnG,QAAM,MAAM,CAAC,GAAG,CAAA;gBAET,qBAAM,KAAG,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,UAAG,IAAI,EAAE,CAAE,EAAE,CAAC,EAAA;;gBAA5D,SAAO,SAAqD;gBACpD,qBAAM,KAAG,CAAC,GAAG,CAAC,WAAW,CAAC,SAAS,CAAC;wBAChD,MAAM,EAAE,MAAI,CAAC,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,cAAc,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;qBAC/F,CAAC;oBAEF,iGAAiG;kBAF/F;;gBAFI,UAAQ,SAEZ;gBAIoB,qBAAM,OAAO,CAAC,cAAM,OAAA,KAAG,CAAC,GAAG,CAAC,WAAW,CAAC,SAAS,CAAC;wBACtE,MAAM,EAAE,MAAI,CAAC,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ;wBACjD,cAAc,EAAE,cAAc,CAAC,UAAU,CAAQ;qBAClD,CAAC,EAHwC,CAGxC,CAAC,EAAA;;gBAHG,aAAa,GAAG,SAGnB;gBACH,MAAM,CACJ,+DAA+D,EAC/D,aAAa,CAAC,QAAQ,EAAE,aAAa,CAAC,MAAM,CAC7C,CAAA;gBAEqB,qBAAM,OAAO,CAAC,cAAM,OAAA,KAAG,CAAC,GAAG,CAAC,WAAW,CAAC,SAAS,CAAC;wBACtE,MAAM,EAAE,MAAI,CAAC,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ;wBACjD,cAAc,EAAE,cAAc,CAAC,UAAU,CAAQ;qBAClD,CAAC,EAHwC,CAGxC,CAAC,EAAA;;gBAHG,aAAa,GAAG,SAGnB;gBACH,MAAM,CACJ,oEAAoE,EACpE,CAAC,aAAa,CAAC,QAAQ,EAAE,aAAa,CAAC,MAAM,CAC9C,CAAA;gBAEqB,qBAAM,OAAO,CAAC,cAAM,OAAA,KAAG,CAAC,GAAG,CAAC,WAAW,CAAC,SAAS,CAAC,OAAK,CAAC,EAAE,EAAE;wBAChF,cAAc,EAAE,cAAc,CAAC,UAAU,CAAQ;qBAClD,CAAC,EAFwC,CAExC,CAAC,EAAA;;gBAFG,aAAa,GAAG,SAEnB;gBACH,MAAM,CACJ,oEAAoE,EACpE,CAAC,aAAa,CAAC,QAAQ,EAAE,aAAa,CAAC,MAAM,CAC9C,CAAA;gBAIoB,qBAAM,OAAO,CAAC,cAAM,OAAA,KAAG,CAAC,GAAG,CAAC,WAAW,CAAC,SAAS,CAAC,OAAK,CAAC,EAAE,EAAE;wBAC/E,kBAAkB,EAAE,SAAS,CAAC,UAAU,CAAQ;qBACjD,CAAC,EAFuC,CAEvC,CAAC,EAAA;;gBAFG,YAAY,GAAG,SAElB;gBACH,MAAM,CAAC,wDAAwD,EAAE,YAAY,CAAC,QAAQ,EAAE,YAAY,CAAC,MAAM,CAAC,CAAA;gBAEvF,qBAAM,OAAO,CAAC,cAAM,OAAA,KAAG,CAAC,GAAG,CAAC,WAAW,CAAC,SAAS,CAAC,OAAK,CAAC,EAAE,EAAE;wBAC/E,kBAAkB,EAAE,SAAS,CAAC,UAAU,CAAQ;qBACjD,CAAC,EAFuC,CAEvC,CAAC,EAAA;;gBAFG,YAAY,GAAG,SAElB;gBACH,MAAM,CAAC,6DAA6D,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,YAAY,CAAC,MAAM,CAAC,CAAA;gBAI5F,qBAAM,OAAO,CAAC,cAAM,OAAA,KAAG,CAAC,GAAG,CAAC,WAAW,CAAC,SAAS,CAAC,OAAK,CAAC,EAAE,EAAE;wBAChF,OAAO,EAAE,EAAE,aAAa,EAAE,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,aAAa,EAAE,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC,EAAS;qBAC3F,CAAC,EAFwC,CAExC,CAAC,EAAA;;gBAFG,aAAa,GAAG,SAEnB;gBACH,MAAM,CAAC,iEAAiE,EAAE,aAAa,CAAC,QAAQ,EAAE,aAAa,CAAC,MAAM,CAAC,CAAA;gBAEjG,qBAAM,OAAO,CAAC,cAAM,OAAA,KAAG,CAAC,GAAG,CAAC,WAAW,CAAC,SAAS,CAAC,OAAK,CAAC,EAAE,EAAE;wBAChF,OAAO,EAAE,EAAE,aAAa,EAAE,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,aAAa,EAAE,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC,EAAS;qBAC3F,CAAC,EAFwC,CAExC,CAAC,EAAA;;gBAFG,aAAa,GAAG,SAEnB;gBACH,MAAM,CAAC,sEAAsE,EAAE,CAAC,aAAa,CAAC,QAAQ,EAAE,aAAa,CAAC,MAAM,CAAC,CAAA;gBAItG,qBAAM,OAAO,CAAC,cAAM,OAAA,KAAG,CAAC,GAAG,CAAC,WAAW,CAAC,SAAS,CAAC,OAAK,CAAC,EAAE,EAAE;wBACjF,OAAO,EAAE,EAAE,iBAAiB,EAAE,CAAC,EAAE,SAAS,EAAE,0BAA0B,EAAE,aAAa,EAAE,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC,EAAS;qBACzH,CAAC,EAFyC,CAEzC,CAAC,EAAA;;gBAFG,cAAc,GAAG,SAEpB;gBACH,MAAM,CAAC,qEAAqE,EAAE,cAAc,CAAC,QAAQ,EAAE,cAAc,CAAC,MAAM,CAAC,CAAA;gBAEtG,qBAAM,OAAO,CAAC,cAAM,OAAA,KAAG,CAAC,GAAG,CAAC,WAAW,CAAC,SAAS,CAAC,OAAK,CAAC,EAAE,EAAE;wBACjF,OAAO,EAAE,EAAE,iBAAiB,EAAE,CAAC,EAAE,SAAS,EAAE,0BAA0B,EAAE,aAAa,EAAE,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC,EAAS;qBACzH,CAAC,EAFyC,CAEzC,CAAC,EAAA;;gBAFG,cAAc,GAAG,SAEpB;gBACH,MAAM,CAAC,0EAA0E,EAAE,CAAC,cAAc,CAAC,QAAQ,EAAE,cAAc,CAAC,MAAM,CAAC,CAAA;gBAI7H,YAAU,UAAC,UAAkB,EAAE,SAAsB;oBAAtB,0BAAA,EAAA,cAAsB;oBAAK,OAAA,CAAC;wBAC/D,KAAK,EAAE,UAAG,IAAI,EAAE,CAAE;wBAClB,MAAM,EAAE,UAAU;wBAClB,KAAK,aAAI,IAAI,EAAE,gBAAgB,EAAE,IAAI,aAAI,MAAM,EAAE,MAAI,CAAC,EAAE,IAAK,SAAS,KAAO,UAAU,CAAE;wBACzF,MAAM,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,qBAAqB,CAAC,EAAE,EAAE;qBAC9D,CAAA;gBALuD,CAKvD,CAAA;gBAEc,qBAAM,OAAO,CAAC,cAAM,OAAA,KAAG,CAAC,GAAG,CAAC,mBAAmB,CAAC,SAAS,CAC9E,SAAO,CAAC,EAAE,UAAU,EAAE,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC,CAC/C,EAF0C,CAE1C,CAAC,EAAA;;gBAFI,cAAc,GAAG,SAErB;gBACF,MAAM,CAAC,8DAA8D,EAAE,cAAc,CAAC,QAAQ,EAAE,cAAc,CAAC,MAAM,CAAC,CAAA;gBAG/F,qBAAM,OAAO,CAAC,cAAM,OAAA,KAAG,CAAC,GAAG,CAAC,mBAAmB,CAAC,SAAS,CAC9E,SAAO,CAAC,EAAE,UAAU,EAAE,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC,CAC/C,EAF0C,CAE1C,CAAC,EAAA;;gBAFI,cAAc,GAAG,SAErB;gBACF,MAAM,CAAC,0DAA0D,EAAE,CAAC,cAAc,CAAC,QAAQ,EAAE,cAAc,CAAC,MAAM,CAAC,CAAA;gBAE3F,qBAAM,OAAO,CAAC;;wBAAM,OAAA,KAAG,CAAC,GAAG,CAAC,mBAAmB,CAAC,SAAS,CAC/E,SAAO,CAAC,EAAE,EAAE,EAAE,kBAAkB,YAAI,GAAC,MAAI,CAAC,EAAE,IAAG,SAAS,CAAC,UAAU,CAAC,KAAE,EAAE,CAAC,CAC1E;oBAF2C,CAE3C,CAAC,EAAA;;gBAFI,eAAe,GAAG,SAEtB;gBACF,MAAM,CAAC,uEAAuE,EAAE,CAAC,eAAe,CAAC,QAAQ,EAAE,eAAe,CAAC,MAAM,CAAC,CAAA;;;qBAI9H,MAAM,EAAN,yBAAM;;;;gBAAU,qBAAM,MAAM,CAAC,QAAQ,EAAE,EAAA;;gBAAvB,SAAuB,CAAA;;;;gBAAe,OAAO,CAAC,KAAK,CAAC,iBAAiB,EAAE,GAAC,CAAC,CAAA;;;qBAG/F,sBAAO,MAAM,EAAA;;;KACd,CAAA;AA5HY,QAAA,8BAA8B,kCA4H1C;AAED,kFAAkF;AAC3E,IAAM,6BAA6B,GAAG;;;;;gBAC3C,KAAA,8BAAa,CAAA;sBAAC,iCAAiC;gBAAE,qBAAM,IAAA,sCAA8B,GAAE,EAAA;;gBAAvF,4BAAiD,SAAsC,GAAC,CAAA;;;;KACzF,CAAA;AAFY,QAAA,6BAA6B,iCAEzC;AAED,oGAAoG;AACvF,QAAA,cAAc,GAAkB,EAAE,IAAI,EAAE,iCAAiC,EAAE,GAAG,EAAE,sCAA8B,EAAE,CAAA;AAE7H,6CAA6C;AAC7C,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,EAAE;IAC3B,OAAO,CAAC,GAAG,CAAC,sCAAqB,IAAI,CAAE,CAAC,CAAA;IACxC,IAAA,qCAA6B,GAAE;SAC5B,IAAI,CAAC;QACJ,OAAO,CAAC,GAAG,CAAC,6DAA6D,CAAC,CAAA;QAC1E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC,CAAC;SACD,KAAK,CAAC,UAAC,KAAK;QACX,OAAO,CAAC,KAAK,CAAC,8CAA8C,EAAE,KAAK,CAAC,CAAA;QACpE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC,CAAC,CAAA;CACL"}

package/lib/cjs/tests/api_tests/security/formsort_webhook_auth_field_lock.test.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"formsort_webhook_auth_field_lock.test.d.ts","sourceRoot":"","sources":["../../../../../src/tests/api_tests/security/formsort_webhook_auth_field_lock.test.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AAyFtC,eAAO,MAAM,sCAAsC;SACpB,OAAO;iBAAe,OAAO;mBA6nB3D,CAAA"}
+{"version":3,"file":"formsort_webhook_auth_field_lock.test.d.ts","sourceRoot":"","sources":["../../../../../src/tests/api_tests/security/formsort_webhook_auth_field_lock.test.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AAsGtC,eAAO,MAAM,sCAAsC;SACpB,OAAO;iBAAe,OAAO;mBAi1B3D,CAAA"}

package/lib/cjs/tests/api_tests/security/formsort_webhook_auth_field_lock.test.js

@@ -111,6 +111,19 @@ var host = process.env.API_URL || 'http://localhost:8080';
  *   R14         both grace markers are load-bearing: neither source nor stripeCustomerId alone opens it
  *   R15         the grace is per-request — it does not clear the stored flag
  *
+ * ?alwaysSetPhone=true (CU-86e3k4ptv) is a second per-request override, narrower than ?enduserId=:
+ * it allows PHONE ONLY through the lock, on every finalized webhook, overwriting an existing and
+ * different number. Email — the password-reset channel this lock exists to protect — stays blocked.
+ *   G16 (GREEN) the flag overwrites an existing, different phone on a guessed match
+ *   G17 (GREEN) ...and in that same request the submitted email is still dropped
+ *   R16 (RED)   the identical request WITHOUT the flag leaves both phone and email blocked
+ *   R17 (RED)   the flag does not open email on a phone match either
+ *   R18 (RED)   only the literal string 'true' enables it — ?alwaysSetPhone=1 keeps the lock
+ *   G18 (GREEN) a flagged webhook still stamps authFieldIntakeDisabled on the response, so later
+ *               writes through save_enduser_updates_for_form_response stay blocked
+ *   R19 (RED)   it is request-scoped: a flag passed on an earlier webhook for the same
+ *               responder_uuid does not unlock a later one that omits it
+ *
  * The Stripe grace is deliberately confined to THIS endpoint, which is API-key authenticated. The
  * anonymous public-form path gets no exemption; that boundary is pinned by G28 in
  * public_endpoint_auth_field_lock.test.ts.
@@ -198,6 +211,8 @@ var formsort_webhook_auth_field_lock_tests = function (_a) {
                                         url.searchParams.set('enduserId', o.enduserId);
                                     if (o.createNewEnduser)
                                         url.searchParams.set('createNewEnduser', 'true');
+                                    if (o.alwaysSetPhone !== undefined)
+                                        url.searchParams.set('alwaysSetPhone', o.alwaysSetPhone);
                                     return [4 /*yield*/, axios_1.default.post(url.toString(), { answers: o.answers, responder_uuid: uuidFor(o.label), finalized: o.finalized }, { validateStatus: function () { return true; } })
                                         // In-progress webhooks always return a bare 200 (the handler returns before the returnJSON
                                         // block), so `data` is only populated for finalized calls.
@@ -1070,7 +1085,10 @@ var formsort_webhook_auth_field_lock_tests = function (_a) {
                             });
                         }); })
                         // ---------------------------------------------------------------------------------------------
-                        // Report
+                        // G16 — ?alwaysSetPhone=true: the opt-in allows phone through the lock on a GUESSED match (the
+                        // path R2 blocks), overwriting a phone that is already stored and different. Phone is also the
+                        // only field this submission changes, which exercises the "at least one update provided" guard —
+                        // if the delete happened before that guard, nothing would be written at all.
                         // ---------------------------------------------------------------------------------------------
                     ];
                 case 20:
@@ -1081,6 +1099,373 @@ var formsort_webhook_auth_field_lock_tests = function (_a) {
                     // after the window closes) stays protected.
                     // ---------------------------------------------------------------------------------------------
                     _h.sent();
+                    // ---------------------------------------------------------------------------------------------
+                    // G16 — ?alwaysSetPhone=true: the opt-in allows phone through the lock on a GUESSED match (the
+                    // path R2 blocks), overwriting a phone that is already stored and different. Phone is also the
+                    // only field this submission changes, which exercises the "at least one update provided" guard —
+                    // if the delete happened before that guard, nothing would be written at all.
+                    // ---------------------------------------------------------------------------------------------
+                    return [4 /*yield*/, runScenario('G16', 'alwaysSetPhone=true overwrites an existing phone on a guessed match', function () { return __awaiter(void 0, void 0, void 0, function () {
+                            var email, originalPhone, victim, intakePhone, data, enduser;
+                            return __generator(this, function (_a) {
+                                switch (_a.label) {
+                                    case 0:
+                                        email = emailFor('g16');
+                                        originalPhone = nextPhone();
+                                        return [4 /*yield*/, makeVictim('g16', { email: email, phone: originalPhone })];
+                                    case 1:
+                                        victim = _a.sent();
+                                        intakePhone = nextPhone();
+                                        return [4 /*yield*/, postWebhook({
+                                                label: 'g16',
+                                                finalized: true,
+                                                alwaysSetPhone: 'true',
+                                                answers: [{ key: 'email', value: email }, { key: 'phone', value: intakePhone }],
+                                            })];
+                                    case 2:
+                                        data = (_a.sent()).data;
+                                        if (!matched('G16', 'alwaysSetPhone=true overwrites an existing phone on a guessed match', data, victim.id))
+                                            return [2 /*return*/];
+                                        return [4 /*yield*/, pollEnduser(victim.id, function (e) { return e.phone === intakePhone; })];
+                                    case 3:
+                                        enduser = _a.sent();
+                                        record('G16', 'alwaysSetPhone=true overwrites an existing phone on a guessed match', (enduser === null || enduser === void 0 ? void 0 : enduser.phone) === intakePhone, "phone=".concat((enduser === null || enduser === void 0 ? void 0 : enduser.phone) || '(unset)', " expected=").concat(intakePhone));
+                                        return [2 /*return*/];
+                                }
+                            });
+                        }); })
+                        // ---------------------------------------------------------------------------------------------
+                        // G17 — the same request, with BOTH a new phone and a different email, so the two halves of the
+                        // rule are observed together: phone lands, email does not. Shaped like R3 (a draft formed by a
+                        // guess, finalized through the sticky flag) because that is the only resolution path where the
+                        // submitted email can differ from the stored one while the patient still matches.
+                        // ---------------------------------------------------------------------------------------------
+                    ];
+                case 21:
+                    // ---------------------------------------------------------------------------------------------
+                    // G16 — ?alwaysSetPhone=true: the opt-in allows phone through the lock on a GUESSED match (the
+                    // path R2 blocks), overwriting a phone that is already stored and different. Phone is also the
+                    // only field this submission changes, which exercises the "at least one update provided" guard —
+                    // if the delete happened before that guard, nothing would be written at all.
+                    // ---------------------------------------------------------------------------------------------
+                    _h.sent();
+                    // ---------------------------------------------------------------------------------------------
+                    // G17 — the same request, with BOTH a new phone and a different email, so the two halves of the
+                    // rule are observed together: phone lands, email does not. Shaped like R3 (a draft formed by a
+                    // guess, finalized through the sticky flag) because that is the only resolution path where the
+                    // submitted email can differ from the stored one while the patient still matches.
+                    // ---------------------------------------------------------------------------------------------
+                    return [4 /*yield*/, runScenario('G17', 'alwaysSetPhone=true writes phone and still drops email', function () { return __awaiter(void 0, void 0, void 0, function () {
+                            var originalEmail, originalPhone, victim, attackerEmail, intakePhone, data, enduser;
+                            return __generator(this, function (_a) {
+                                switch (_a.label) {
+                                    case 0:
+                                        originalEmail = emailFor('g17');
+                                        originalPhone = nextPhone();
+                                        return [4 /*yield*/, makeVictim('g17', { email: originalEmail, phone: originalPhone })];
+                                    case 1:
+                                        victim = _a.sent();
+                                        attackerEmail = emailFor('g17-attacker');
+                                        intakePhone = nextPhone();
+                                        // draft matches the pre-existing patient by phone -> authFieldIntakeDisabled is stamped on it
+                                        return [4 /*yield*/, postWebhook({ label: 'g17', finalized: false, answers: [{ key: 'phone', value: originalPhone }] })];
+                                    case 2:
+                                        // draft matches the pre-existing patient by phone -> authFieldIntakeDisabled is stamped on it
+                                        _a.sent();
+                                        return [4 /*yield*/, postWebhook({
+                                                label: 'g17',
+                                                finalized: true,
+                                                alwaysSetPhone: 'true',
+                                                answers: [{ key: 'phone', value: intakePhone }, { key: 'email', value: attackerEmail }],
+                                            })];
+                                    case 3:
+                                        data = (_a.sent()).data;
+                                        if (!matched('G17', 'alwaysSetPhone=true writes phone and still drops email', data, victim.id))
+                                            return [2 /*return*/];
+                                        return [4 /*yield*/, pollEnduser(victim.id, function (e) { return e.phone === intakePhone; })];
+                                    case 4:
+                                        enduser = _a.sent();
+                                        record('G17', 'alwaysSetPhone=true writes phone through the sticky flag', (enduser === null || enduser === void 0 ? void 0 : enduser.phone) === intakePhone, "phone=".concat((enduser === null || enduser === void 0 ? void 0 : enduser.phone) || '(unset)', " expected=").concat(intakePhone));
+                                        record('G17', 'alwaysSetPhone=true leaves email blocked in the same request', (enduser === null || enduser === void 0 ? void 0 : enduser.email) === originalEmail, "email=".concat((enduser === null || enduser === void 0 ? void 0 : enduser.email) || '(unset)', " expected=").concat(originalEmail));
+                                        return [2 /*return*/];
+                                }
+                            });
+                        }); })
+                        // ---------------------------------------------------------------------------------------------
+                        // R16 — the control for G17: byte-identical request without the flag. Both fields stay blocked,
+                        // i.e. the default behavior is unchanged.
+                        // ---------------------------------------------------------------------------------------------
+                    ];
+                case 22:
+                    // ---------------------------------------------------------------------------------------------
+                    // G17 — the same request, with BOTH a new phone and a different email, so the two halves of the
+                    // rule are observed together: phone lands, email does not. Shaped like R3 (a draft formed by a
+                    // guess, finalized through the sticky flag) because that is the only resolution path where the
+                    // submitted email can differ from the stored one while the patient still matches.
+                    // ---------------------------------------------------------------------------------------------
+                    _h.sent();
+                    // ---------------------------------------------------------------------------------------------
+                    // R16 — the control for G17: byte-identical request without the flag. Both fields stay blocked,
+                    // i.e. the default behavior is unchanged.
+                    // ---------------------------------------------------------------------------------------------
+                    return [4 /*yield*/, runScenario('R16', 'without the flag the same request blocks phone and email', function () { return __awaiter(void 0, void 0, void 0, function () {
+                            var originalEmail, originalPhone, victim, attackerEmail, intakePhone, data, enduser;
+                            return __generator(this, function (_a) {
+                                switch (_a.label) {
+                                    case 0:
+                                        originalEmail = emailFor('r16');
+                                        originalPhone = nextPhone();
+                                        return [4 /*yield*/, makeVictim('r16', { email: originalEmail, phone: originalPhone })];
+                                    case 1:
+                                        victim = _a.sent();
+                                        attackerEmail = emailFor('r16-attacker');
+                                        intakePhone = nextPhone();
+                                        return [4 /*yield*/, postWebhook({ label: 'r16', finalized: false, answers: [{ key: 'phone', value: originalPhone }] })];
+                                    case 2:
+                                        _a.sent();
+                                        return [4 /*yield*/, postWebhook({
+                                                label: 'r16',
+                                                finalized: true,
+                                                answers: [{ key: 'phone', value: intakePhone }, { key: 'email', value: attackerEmail }],
+                                            })];
+                                    case 3:
+                                        data = (_a.sent()).data;
+                                        if (!matched('R16', 'without the flag the same request blocks phone and email', data, victim.id))
+                                            return [2 /*return*/];
+                                        return [4 /*yield*/, pollEnduser(victim.id, function (e) { return e.phone === intakePhone || e.email === attackerEmail; })];
+                                    case 4:
+                                        enduser = _a.sent();
+                                        record('R16', 'without the flag phone stays blocked', (enduser === null || enduser === void 0 ? void 0 : enduser.phone) === originalPhone, "phone=".concat((enduser === null || enduser === void 0 ? void 0 : enduser.phone) || '(unset)', " expected=").concat(originalPhone));
+                                        record('R16', 'without the flag email stays blocked', (enduser === null || enduser === void 0 ? void 0 : enduser.email) === originalEmail, "email=".concat((enduser === null || enduser === void 0 ? void 0 : enduser.email) || '(unset)', " expected=").concat(originalEmail));
+                                        return [2 /*return*/];
+                                }
+                            });
+                        }); })
+                        // ---------------------------------------------------------------------------------------------
+                        // R17 — the flag is phone-only in BOTH match directions: matched on phone (R1's shape), the
+                        // submitted email must still not land.
+                        // ---------------------------------------------------------------------------------------------
+                    ];
+                case 23:
+                    // ---------------------------------------------------------------------------------------------
+                    // R16 — the control for G17: byte-identical request without the flag. Both fields stay blocked,
+                    // i.e. the default behavior is unchanged.
+                    // ---------------------------------------------------------------------------------------------
+                    _h.sent();
+                    // ---------------------------------------------------------------------------------------------
+                    // R17 — the flag is phone-only in BOTH match directions: matched on phone (R1's shape), the
+                    // submitted email must still not land.
+                    // ---------------------------------------------------------------------------------------------
+                    return [4 /*yield*/, runScenario('R17', 'alwaysSetPhone=true does not repoint email on a phone match', function () { return __awaiter(void 0, void 0, void 0, function () {
+                            var originalEmail, phone, victim, attackerEmail, data, enduser;
+                            return __generator(this, function (_a) {
+                                switch (_a.label) {
+                                    case 0:
+                                        originalEmail = emailFor('r17');
+                                        phone = nextPhone();
+                                        return [4 /*yield*/, makeVictim('r17', { email: originalEmail, phone: phone })];
+                                    case 1:
+                                        victim = _a.sent();
+                                        attackerEmail = emailFor('r17-attacker');
+                                        return [4 /*yield*/, postWebhook({
+                                                label: 'r17',
+                                                finalized: true,
+                                                alwaysSetPhone: 'true',
+                                                answers: [{ key: 'phone', value: phone }, { key: 'email', value: attackerEmail }],
+                                            })];
+                                    case 2:
+                                        data = (_a.sent()).data;
+                                        if (!matched('R17', 'alwaysSetPhone=true does not repoint email on a phone match', data, victim.id))
+                                            return [2 /*return*/];
+                                        return [4 /*yield*/, pollEnduser(victim.id, function (e) { return e.email === attackerEmail; })];
+                                    case 3:
+                                        enduser = _a.sent();
+                                        record('R17', 'alwaysSetPhone=true does not repoint email on a phone match', (enduser === null || enduser === void 0 ? void 0 : enduser.email) === originalEmail, "email=".concat((enduser === null || enduser === void 0 ? void 0 : enduser.email) || '(unset)', " expected=").concat(originalEmail));
+                                        return [2 /*return*/];
+                                }
+                            });
+                        }); })
+                        // ---------------------------------------------------------------------------------------------
+                        // R18 — parsed as === 'true', matching createNewEnduser / matchByName. Any other value, including
+                        // a truthy-looking one, keeps today's behavior.
+                        // ---------------------------------------------------------------------------------------------
+                    ];
+                case 24:
+                    // ---------------------------------------------------------------------------------------------
+                    // R17 — the flag is phone-only in BOTH match directions: matched on phone (R1's shape), the
+                    // submitted email must still not land.
+                    // ---------------------------------------------------------------------------------------------
+                    _h.sent();
+                    // ---------------------------------------------------------------------------------------------
+                    // R18 — parsed as === 'true', matching createNewEnduser / matchByName. Any other value, including
+                    // a truthy-looking one, keeps today's behavior.
+                    // ---------------------------------------------------------------------------------------------
+                    return [4 /*yield*/, runScenario('R18', 'alwaysSetPhone=1 does not enable the opt-in', function () { return __awaiter(void 0, void 0, void 0, function () {
+                            var email, originalPhone, victim, intakePhone, data, enduser;
+                            return __generator(this, function (_a) {
+                                switch (_a.label) {
+                                    case 0:
+                                        email = emailFor('r18');
+                                        originalPhone = nextPhone();
+                                        return [4 /*yield*/, makeVictim('r18', { email: email, phone: originalPhone })];
+                                    case 1:
+                                        victim = _a.sent();
+                                        intakePhone = nextPhone();
+                                        return [4 /*yield*/, postWebhook({
+                                                label: 'r18',
+                                                finalized: true,
+                                                alwaysSetPhone: '1',
+                                                answers: [{ key: 'email', value: email }, { key: 'phone', value: intakePhone }],
+                                            })];
+                                    case 2:
+                                        data = (_a.sent()).data;
+                                        if (!matched('R18', 'alwaysSetPhone=1 does not enable the opt-in', data, victim.id))
+                                            return [2 /*return*/];
+                                        return [4 /*yield*/, pollEnduser(victim.id, function (e) { return e.phone === intakePhone; })];
+                                    case 3:
+                                        enduser = _a.sent();
+                                        record('R18', 'alwaysSetPhone=1 does not enable the opt-in', (enduser === null || enduser === void 0 ? void 0 : enduser.phone) === originalPhone, "phone=".concat((enduser === null || enduser === void 0 ? void 0 : enduser.phone) || '(unset)', " expected=").concat(originalPhone));
+                                        return [2 /*return*/];
+                                }
+                            });
+                        }); })
+                        // ---------------------------------------------------------------------------------------------
+                        // G18 — the opt-in is a per-REQUEST allow, exactly like G11 (?enduserId=) and R15 (the Stripe
+                        // grace): the response still records that it attached to a pre-existing patient, so the other
+                        // consumer of that flag — save_enduser_updates_for_form_response, reached by later staff edits —
+                        // stays protected.
+                        // ---------------------------------------------------------------------------------------------
+                    ];
+                case 25:
+                    // ---------------------------------------------------------------------------------------------
+                    // R18 — parsed as === 'true', matching createNewEnduser / matchByName. Any other value, including
+                    // a truthy-looking one, keeps today's behavior.
+                    // ---------------------------------------------------------------------------------------------
+                    _h.sent();
+                    // ---------------------------------------------------------------------------------------------
+                    // G18 — the opt-in is a per-REQUEST allow, exactly like G11 (?enduserId=) and R15 (the Stripe
+                    // grace): the response still records that it attached to a pre-existing patient, so the other
+                    // consumer of that flag — save_enduser_updates_for_form_response, reached by later staff edits —
+                    // stays protected.
+                    // ---------------------------------------------------------------------------------------------
+                    return [4 /*yield*/, runScenario('G18', 'alwaysSetPhone does not clear the stored flag', function () { return __awaiter(void 0, void 0, void 0, function () {
+                            var email, victim, intakePhone, data, enduser, response;
+                            return __generator(this, function (_a) {
+                                switch (_a.label) {
+                                    case 0:
+                                        email = emailFor('g18');
+                                        return [4 /*yield*/, makeVictim('g18', { email: email, phone: nextPhone() })];
+                                    case 1:
+                                        victim = _a.sent();
+                                        intakePhone = nextPhone();
+                                        return [4 /*yield*/, postWebhook({
+                                                label: 'g18',
+                                                finalized: true,
+                                                alwaysSetPhone: 'true',
+                                                answers: [{ key: 'email', value: email }, { key: 'phone', value: intakePhone }],
+                                            })];
+                                    case 2:
+                                        data = (_a.sent()).data;
+                                        if (!matched('G18', 'alwaysSetPhone does not clear the stored flag', data, victim.id))
+                                            return [2 /*return*/];
+                                        return [4 /*yield*/, pollEnduser(victim.id, function (e) { return e.phone === intakePhone; })];
+                                    case 3:
+                                        enduser = _a.sent();
+                                        record('G18', 'flagged webhook landed the phone (probe precondition)', (enduser === null || enduser === void 0 ? void 0 : enduser.phone) === intakePhone, "phone=".concat((enduser === null || enduser === void 0 ? void 0 : enduser.phone) || '(unset)', " expected=").concat(intakePhone));
+                                        if (!data.formResponseId) {
+                                            skip('G18', 'alwaysSetPhone does not clear the stored flag', 'webhook returned no formResponseId');
+                                            return [2 /*return*/];
+                                        }
+                                        return [4 /*yield*/, sdk.api.form_responses.getOne(data.formResponseId).catch(function () { return null; })];
+                                    case 4:
+                                        response = _a.sent();
+                                        if (!response) {
+                                            skip('G18', 'alwaysSetPhone does not clear the stored flag', 'form response not readable');
+                                        }
+                                        else if (response.authFieldIntakeDisabled === undefined) {
+                                            // deliberately absent from schema.ts; if reads project it away there is nothing to assert here
+                                            skip('G18', 'alwaysSetPhone does not clear the stored flag', 'authFieldIntakeDisabled not exposed on read');
+                                        }
+                                        else {
+                                            record('G18', 'alwaysSetPhone does not clear the stored flag', response.authFieldIntakeDisabled === true, "authFieldIntakeDisabled=".concat(response.authFieldIntakeDisabled, " expected=true"));
+                                        }
+                                        return [2 /*return*/];
+                                }
+                            });
+                        }); })
+                        // ---------------------------------------------------------------------------------------------
+                        // R19 — nothing about the opt-in is recorded on the response, so a later webhook for the same
+                        // responder_uuid that omits it is blocked as usual. The earlier webhook here must be the DRAFT:
+                        // once a response is submitted the handler returns 'Already submitted' before reaching the lock,
+                        // which would make a finalized-then-finalized pair pass no matter what the implementation did.
+                        // ---------------------------------------------------------------------------------------------
+                    ];
+                case 26:
+                    // ---------------------------------------------------------------------------------------------
+                    // G18 — the opt-in is a per-REQUEST allow, exactly like G11 (?enduserId=) and R15 (the Stripe
+                    // grace): the response still records that it attached to a pre-existing patient, so the other
+                    // consumer of that flag — save_enduser_updates_for_form_response, reached by later staff edits —
+                    // stays protected.
+                    // ---------------------------------------------------------------------------------------------
+                    _h.sent();
+                    // ---------------------------------------------------------------------------------------------
+                    // R19 — nothing about the opt-in is recorded on the response, so a later webhook for the same
+                    // responder_uuid that omits it is blocked as usual. The earlier webhook here must be the DRAFT:
+                    // once a response is submitted the handler returns 'Already submitted' before reaching the lock,
+                    // which would make a finalized-then-finalized pair pass no matter what the implementation did.
+                    // ---------------------------------------------------------------------------------------------
+                    return [4 /*yield*/, runScenario('R19', 'alwaysSetPhone on an earlier webhook does not unlock a later one', function () { return __awaiter(void 0, void 0, void 0, function () {
+                            var email, originalPhone, victim, intakePhone, draft, data, enduser;
+                            return __generator(this, function (_a) {
+                                switch (_a.label) {
+                                    case 0:
+                                        email = emailFor('r19');
+                                        originalPhone = nextPhone();
+                                        return [4 /*yield*/, makeVictim('r19', { email: email, phone: originalPhone })];
+                                    case 1:
+                                        victim = _a.sent();
+                                        intakePhone = nextPhone();
+                                        return [4 /*yield*/, postWebhook({
+                                                label: 'r19',
+                                                finalized: false,
+                                                alwaysSetPhone: 'true',
+                                                answers: [{ key: 'email', value: email }],
+                                            })];
+                                    case 2:
+                                        draft = _a.sent();
+                                        if (draft.status !== 200) {
+                                            record('R19', 'alwaysSetPhone on an earlier webhook does not unlock a later one', false, "draft webhook returned ".concat(draft.status));
+                                            return [2 /*return*/];
+                                        }
+                                        return [4 /*yield*/, postWebhook({
+                                                label: 'r19',
+                                                finalized: true,
+                                                answers: [{ key: 'email', value: email }, { key: 'phone', value: intakePhone }],
+                                            })];
+                                    case 3:
+                                        data = (_a.sent()).data;
+                                        if (!matched('R19', 'alwaysSetPhone on an earlier webhook does not unlock a later one', data, victim.id))
+                                            return [2 /*return*/];
+                                        return [4 /*yield*/, pollEnduser(victim.id, function (e) { return e.phone === intakePhone; })];
+                                    case 4:
+                                        enduser = _a.sent();
+                                        record('R19', 'alwaysSetPhone on an earlier webhook does not unlock a later one', (enduser === null || enduser === void 0 ? void 0 : enduser.phone) === originalPhone, "phone=".concat((enduser === null || enduser === void 0 ? void 0 : enduser.phone) || '(unset)', " expected=").concat(originalPhone));
+                                        return [2 /*return*/];
+                                }
+                            });
+                        }); })
+                        // ---------------------------------------------------------------------------------------------
+                        // Report
+                        // ---------------------------------------------------------------------------------------------
+                    ];
+                case 27:
+                    // ---------------------------------------------------------------------------------------------
+                    // R19 — nothing about the opt-in is recorded on the response, so a later webhook for the same
+                    // responder_uuid that omits it is blocked as usual. The earlier webhook here must be the DRAFT:
+                    // once a response is submitted the handler returns 'Already submitted' before reaching the lock,
+                    // which would make a finalized-then-finalized pair pass no matter what the implementation did.
+                    // ---------------------------------------------------------------------------------------------
+                    _h.sent();
                     failures = results.filter(function (r) { return !r.ok; });
                     skipped = results.filter(function (r) { return !!r.skipped; });
                     console.log('');
@@ -1093,69 +1478,69 @@ var formsort_webhook_auth_field_lock_tests = function (_a) {
                     console.log("   \u2514\u2500 ".concat(results.length - failures.length, "/").concat(results.length, " passed, ").concat(skipped.length, " skipped, ").concat(failures.length, " failed"));
                     console.log('');
                     _b = 0, createdFormIds_1 = createdFormIds;
-                    _h.label = 21;
-                case 21:
-                    if (!(_b < createdFormIds_1.length)) return [3 /*break*/, 27];
+                    _h.label = 28;
+                case 28:
+                    if (!(_b < createdFormIds_1.length)) return [3 /*break*/, 34];
                     formId = createdFormIds_1[_b];
                     return [4 /*yield*/, sdk.api.form_responses.getSome({ filter: { formId: formId } }).catch(function () { return []; })];
-                case 22:
+                case 29:
                     responses = _h.sent();
                     _c = 0, responses_1 = responses;
-                    _h.label = 23;
-                case 23:
-                    if (!(_c < responses_1.length)) return [3 /*break*/, 26];
+                    _h.label = 30;
+                case 30:
+                    if (!(_c < responses_1.length)) return [3 /*break*/, 33];
                     response = responses_1[_c];
                     return [4 /*yield*/, sdk.api.form_responses.deleteOne(response.id).catch(function () { return null; })];
-                case 24:
+                case 31:
                     _h.sent();
-                    _h.label = 25;
-                case 25:
+                    _h.label = 32;
+                case 32:
                     _c++;
-                    return [3 /*break*/, 23];
-                case 26:
+                    return [3 /*break*/, 30];
+                case 33:
                     _b++;
-                    return [3 /*break*/, 21];
-                case 27:
+                    return [3 /*break*/, 28];
+                case 34:
                     _d = 0, createdFormIds_2 = createdFormIds;
-                    _h.label = 28;
-                case 28:
-                    if (!(_d < createdFormIds_2.length)) return [3 /*break*/, 31];
+                    _h.label = 35;
+                case 35:
+                    if (!(_d < createdFormIds_2.length)) return [3 /*break*/, 38];
                     id = createdFormIds_2[_d];
                     return [4 /*yield*/, sdk.api.forms.deleteOne(id).catch(function () { return null; })];
-                case 29:
+                case 36:
                     _h.sent();
-                    _h.label = 30;
-                case 30:
+                    _h.label = 37;
+                case 37:
                     _d++;
-                    return [3 /*break*/, 28];
-                case 31:
+                    return [3 /*break*/, 35];
+                case 38:
                     uniqueEnduserIds = createdEnduserIds.filter(function (id, i) { return !!id && createdEnduserIds.indexOf(id) === i; });
                     _e = 0, uniqueEnduserIds_1 = uniqueEnduserIds;
-                    _h.label = 32;
-                case 32:
-                    if (!(_e < uniqueEnduserIds_1.length)) return [3 /*break*/, 35];
+                    _h.label = 39;
+                case 39:
+                    if (!(_e < uniqueEnduserIds_1.length)) return [3 /*break*/, 42];
                     id = uniqueEnduserIds_1[_e];
                     return [4 /*yield*/, sdk.api.endusers.deleteOne(id).catch(function () { return null; })];
-                case 33:
+                case 40:
                     _h.sent();
-                    _h.label = 34;
-                case 34:
+                    _h.label = 41;
+                case 41:
                     _e++;
-                    return [3 /*break*/, 32];
-                case 35:
+                    return [3 /*break*/, 39];
+                case 42:
                     _f = 0, createdApiKeyIds_1 = createdApiKeyIds;
-                    _h.label = 36;
-                case 36:
-                    if (!(_f < createdApiKeyIds_1.length)) return [3 /*break*/, 39];
+                    _h.label = 43;
+                case 43:
+                    if (!(_f < createdApiKeyIds_1.length)) return [3 /*break*/, 46];
                     id = createdApiKeyIds_1[_f];
                     return [4 /*yield*/, sdk.api.api_keys.deleteOne(id).catch(function () { return null; })];
-                case 37:
+                case 44:
                     _h.sent();
-                    _h.label = 38;
-                case 38:
+                    _h.label = 45;
+                case 45:
                     _f++;
-                    return [3 /*break*/, 36];
-                case 39:
+                    return [3 /*break*/, 43];
+                case 46:
                     // ---------------------------------------------------------------------------------------------
                     // Assert — single pass, last, so the full table above is always printed first.
                     // ---------------------------------------------------------------------------------------------