@tellescope/sdk 2.0.0-beta.0 → 2.0.0-beta.2

package/src/tests/api_tests/stripe_checkout_items.test.ts

@@ -0,0 +1,186 @@
+require('source-map-support').install();
+
+import {
+  assert_checks,
+  Check,
+  setup_isolated_tenant,
+  IsolatedSuite,
+} from "../setup_isolated"
+import { authenticate_enduser_via_token } from "../setup"
+import { EnduserSession } from "../../sdk"
+
+const host = process.env.API_URL || 'http://localhost:8080' as const
+
+const RAND = () => Math.random().toString(36).slice(2, 10)
+
+const ENDUSER_RAW_IDS_MESSAGE = "stripePriceId and subscriptionPriceId are not supported for enduser sessions"
+const QUANTITY_MESSAGE = "quantity must be a whole number of at least 1"
+const EXACTLY_ONE_ID_MESSAGE = "Each items entry must specify exactly one of productId, stripePriceId, or subscriptionPriceId"
+// what the handler throws once a request is past every items guard and no Stripe account is
+// configured - the marker for "this cart was accepted, it only ran out of Stripe"
+const NO_STRIPE_MESSAGE = "Stripe Connection not found"
+
+/**
+ * The guards on the `items` parameter of products/prepare-stripe-checkout that run BEFORE any Stripe
+ * integration is resolved, so they are reachable without a Stripe account: the enduser rejection of
+ * raw Stripe price ids, the productIds/items exclusivity, the per-entry shape rules and the quantity
+ * validator.
+ *
+ * The quantity guards themselves (the cap of 99, the two "greater than 1" rejections) sit on the
+ * Stripe Custom branch and are pinned instead by the unit suite in
+ * packages/private/api/api/integrations/payments/stripe_line_items.test.ts, which needs no database
+ * and no Stripe account. Anything that creates or inspects a real Checkout session is manual QA.
+ */
+export const stripe_checkout_items_checks = async (): Promise<Check[]> => {
+  const checks: Check[] = []
+  const record = (label: string, pass: boolean, detail: string) => checks.push({ label, pass, detail })
+
+  let tenant: Awaited<ReturnType<typeof setup_isolated_tenant>> | undefined
+
+  try {
+    tenant = await setup_isolated_tenant({
+      name: `stripe items ${RAND()}`,
+      users: [{ isAdmin: true }],
+      apiKeys: 0,
+    })
+    const { sdk, businessId } = tenant
+
+    const product = await sdk.api.products.createOne({
+      title: `Checkout Item Product ${RAND()}`,
+      cost: { amount: 500, currency: 'USD' },
+      processor: 'Stripe',
+    })
+
+    const enduser = await sdk.api.endusers.createOne({ email: `items_${RAND()}@test.tellescope.com` })
+    const enduserSDK = new EnduserSession({ host, businessId })
+    await authenticate_enduser_via_token(sdk, enduserSDK, { id: enduser.id })
+
+    // returns the error message for a rejected request, or '' when the request succeeded
+    const errorFor = async (session: typeof sdk | typeof enduserSDK, args: any): Promise<string> => {
+      try {
+        await (session.api.products.prepare_stripe_checkout as any)(args)
+        return ''
+      } catch (err: any) {
+        return typeof err === 'string' ? err : (err?.message ?? JSON.stringify(err))
+      }
+    }
+
+    // ---- raw Stripe price ids are staff / API-key only ----
+    const enduserRawPrice = await errorFor(enduserSDK, { items: [{ stripePriceId: 'price_raw', quantity: 1 }] })
+    record(
+      'an enduser naming a raw stripePriceId is rejected',
+      enduserRawPrice === ENDUSER_RAW_IDS_MESSAGE,
+      `expected "${ENDUSER_RAW_IDS_MESSAGE}", got "${enduserRawPrice}"`,
+    )
+
+    const enduserRawSubscription = await errorFor(enduserSDK, { items: [{ subscriptionPriceId: 'price_sub', quantity: 1 }] })
+    record(
+      'an enduser naming a raw subscriptionPriceId is rejected',
+      enduserRawSubscription === ENDUSER_RAW_IDS_MESSAGE,
+      `expected "${ENDUSER_RAW_IDS_MESSAGE}", got "${enduserRawSubscription}"`,
+    )
+
+    // the rejection is about raw Stripe ids, not about items: a patient can still buy a Tellescope
+    // product at a quantity, and only runs out of road at the missing Stripe account
+    const enduserProduct = await errorFor(enduserSDK, { items: [{ productId: product.id, quantity: 2 }] })
+    record(
+      'an enduser naming a Tellescope productId is allowed through the guard',
+      enduserProduct === NO_STRIPE_MESSAGE,
+      `expected "${NO_STRIPE_MESSAGE}", got "${enduserProduct}"`,
+    )
+
+    // the same raw price from a staff session passes the guard
+    const userRawPrice = await errorFor(sdk, { items: [{ stripePriceId: 'price_raw', quantity: 1 }] })
+    record(
+      'a user session naming a raw stripePriceId is allowed through the guard',
+      userRawPrice === NO_STRIPE_MESSAGE,
+      `expected "${NO_STRIPE_MESSAGE}", got "${userRawPrice}"`,
+    )
+
+    // ---- productIds and items are mutually exclusive ----
+    const both = await errorFor(sdk, { productIds: [product.id], items: [{ productId: product.id, quantity: 1 }] })
+    record(
+      'passing both productIds and items is rejected',
+      both === "Pass either productIds or items, not both",
+      `expected the "not both" message, got "${both}"`,
+    )
+
+    const neither = await errorFor(sdk, {})
+    record(
+      'passing neither productIds nor items is rejected',
+      neither === "One of productIds or items is required",
+      `expected the "one of" message, got "${neither}"`,
+    )
+
+    // ---- per-entry shape ----
+    const noId = await errorFor(sdk, { items: [{ quantity: 1 }] })
+    record(
+      'an items entry naming no id is rejected',
+      noId === EXACTLY_ONE_ID_MESSAGE,
+      `expected the "exactly one" message, got "${noId}"`,
+    )
+
+    const twoIds = await errorFor(sdk, { items: [{ productId: product.id, stripePriceId: 'price_raw', quantity: 1 }] })
+    record(
+      'an items entry naming two ids is rejected',
+      twoIds === EXACTLY_ONE_ID_MESSAGE,
+      `expected the "exactly one" message, got "${twoIds}"`,
+    )
+
+    // unlike productIds, which silently drops ids it cannot find, items rejects the whole cart
+    const unknownId = '60398b0231a295e64f084fd9'
+    const unknown = await errorFor(sdk, { items: [{ productId: unknownId, quantity: 1 }] })
+    record(
+      'an items entry naming an unknown productId is rejected, naming the id',
+      unknown.includes(unknownId) && unknown.includes('No product found'),
+      `expected a "No product found for productId ${unknownId}", got "${unknown}"`,
+    )
+
+    // ---- quantity must be a whole number of at least 1 ----
+    // quantity: 0 is the one that nearly got away: build_validator returns 0 early for any isNumber
+    // field, so the schema validator cannot reject it and the guard in resolve_checkout_items is
+    // the only thing between a zero quantity and a Stripe line item
+    for (const quantity of [0, -1, 1.5]) {
+      const message = await errorFor(sdk, { items: [{ productId: product.id, quantity }] })
+      record(
+        `quantity ${quantity} is rejected`,
+        message.includes(QUANTITY_MESSAGE),
+        `expected a message containing "${QUANTITY_MESSAGE}", got "${message}"`,
+      )
+    }
+
+    // a productIds-only request still reaches the Stripe lookup exactly as before
+    const productIdsOnly = await errorFor(sdk, { productIds: [product.id] })
+    record(
+      'a productIds-only request is unaffected',
+      productIdsOnly === NO_STRIPE_MESSAGE,
+      `expected "${NO_STRIPE_MESSAGE}", got "${productIdsOnly}"`,
+    )
+  } finally {
+    // teardown before anything asserts — assert calls process.exit, which skips pending finallys
+    if (tenant) { try { await tenant.teardown() } catch (e) { console.error('teardown failed', e) } }
+  }
+
+  return checks
+}
+
+export const stripe_checkout_items_tests = async () => {
+  assert_checks('prepare_stripe_checkout items guards', await stripe_checkout_items_checks())
+}
+
+/** Enrolls this suite in the auto-discovered parallel pool — see run_discovered_isolated_suites. */
+export const ISOLATED_SUITE: IsolatedSuite = { name: 'prepare_stripe_checkout items guards', run: stripe_checkout_items_checks }
+
+// Allow running this test file independently
+if (require.main === module) {
+  console.log(`🌐 Using API URL: ${host}`)
+  stripe_checkout_items_tests()
+    .then(() => {
+      console.log("✅ stripe_checkout_items test suite completed successfully")
+      process.exit(0)
+    })
+    .catch((error) => {
+      console.error("❌ stripe_checkout_items test suite failed:", error)
+      process.exit(1)
+    })
+}

package/src/tests/api_tests/tickets_bulk_assign_from_queue.test.ts

@@ -5,6 +5,7 @@ import {
   assert_checks,
   Check,
   setup_isolated_tenant,
+  IsolatedSuite,
 } from "../setup_isolated"
 
 const host = process.env.API_URL || 'http://localhost:8080' as const
@@ -264,6 +265,9 @@ export const tickets_bulk_assign_from_queue_tests = async () => {
   assert_checks('Tickets bulk assign from queue', await tickets_bulk_assign_from_queue_checks())
 }
 
+/** Enrolls this suite in the auto-discovered parallel pool — see run_discovered_isolated_suites. */
+export const ISOLATED_SUITE: IsolatedSuite = { name: 'Tickets bulk assign from queue', run: tickets_bulk_assign_from_queue_checks }
+
 // Allow running this test file independently
 if (require.main === module) {
   console.log(`🌐 Using API URL: ${host}`)

package/src/tests/api_tests/totp_mfa.test.ts

@@ -302,11 +302,16 @@ export const totp_mfa_tests = async ({ sdk, sdkNonAdmin } : { sdk: Session, sdkN
     // the already-configured email method must keep working (no lockout)
     await set_allowed_mfa_methods(['authenticator'])
 
-    await async_test(
-      'E5. grace: configured email challenge still works after restriction',
-      () => sdkNonAdmin.api.users.generate_MFA_challenge({ method: 'email' }),
-      { shouldError: false, onResult: () => true }
-    )
+    // a successful challenge really emails the code, so only send it to a do-not-send address
+    if (NON_ADMIN_EMAIL.startsWith('dontsend') && NON_ADMIN_EMAIL.endsWith('@tellescope.com')) {
+      await async_test(
+        'E5. grace: configured email challenge still works after restriction',
+        () => sdkNonAdmin.api.users.generate_MFA_challenge({ method: 'email' }),
+        { shouldError: false, onResult: () => true }
+      )
+    } else {
+      console.log('   E5 skipped: NON_ADMIN_EMAIL is not a dontsend address, a challenge would send a real email')
+    }
 
     // cleanup E: clear restriction + disable email
     await clear_allowed_mfa_methods()

package/src/tests/api_tests/trigger_contains_matching.test.ts

@@ -0,0 +1,349 @@
+require('source-map-support').install();
+
+import {
+  assert_checks,
+  Check,
+  setup_isolated_tenant,
+  IsolatedSuite,
+} from "../setup_isolated"
+
+const host = process.env.API_URL || 'http://localhost:8080' as const
+
+const RAND = () => Math.random().toString(36).slice(2, 10)
+
+/**
+ * End-to-end coverage for "contains" title matching on the `Problem Created` and `Order Created`
+ * automation triggers — the optional `titlePartials` (case sensitive) and `titlePartialsIgnoreCase`
+ * lists that sit beside the existing exact `titles` list.
+ *
+ * Three backend call sites implement this and they must agree:
+ *   - handle_problems_create           (enduser_problems.ts — single AND bulk problem creates)
+ *   - handle_order_created             (automation_triggers.ts — orders created ONE at a time)
+ *   - handle_orders_create bulk branch (enduser_orders.ts — orders created via createSome, >1)
+ *
+ * The order paths diverge structurally (`created.length === 1` takes an entirely different branch),
+ * so every order assertion here is made twice: once through `createOne` and once through a
+ * `createSome` of more than one record. That divergence is the main risk in this change.
+ *
+ * Own tenant: automation triggers are business-wide, so a shared tenant would let these triggers tag
+ * other concurrently running suites' endusers and vice versa. Never calls sdk.reset_db().
+ *
+ * Trigger actions are fire-and-forget, so positives poll. Negatives wait for a catch-all sentinel
+ * trigger (one with no title filter at all, which must fire for every record) to land first, then
+ * settle before reading — otherwise "the tag is absent" would just mean "the tag has not arrived
+ * yet".
+ */
+
+const poll_for = async <T,>(get: () => Promise<T>, done: (v: T) => boolean, attempts=24): Promise<T> => {
+  let value = await get()
+  for (let i = 0; i < attempts && !done(value); i++) {
+    await new Promise(resolve => setTimeout(resolve, 250))
+    value = await get()
+  }
+  return value
+}
+
+const wait = (ms: number) => new Promise(resolve => setTimeout(resolve, ms))
+
+export const trigger_contains_matching_checks = async (): Promise<Check[]> => {
+  const checks: Check[] = []
+  const record = (label: string, pass: boolean, detail: string) => checks.push({ label, pass, detail })
+
+  let tenant: Awaited<ReturnType<typeof setup_isolated_tenant>> | undefined
+
+  try {
+    tenant = await setup_isolated_tenant({
+      name: `ContainsTriggers ${RAND()}`,
+      users: [{ isAdmin: true }],
+      apiKeys: 0,
+    })
+    const { sdk } = tenant
+
+    /* ============================ triggers ============================ */
+
+    const trigger = (
+      title: string,
+      event: any,
+      tag: string,
+    ) => sdk.api.automation_triggers.createOne({
+      title,
+      status: 'Active',
+      event,
+      action: { type: 'Add Tags', info: { tags: [tag] } },
+    })
+
+    await Promise.all([
+      // ---- Order Created ----
+      // fires for every order — the sentinel that tells a negative check "the handler has run"
+      trigger('Order any', { type: 'Order Created', info: {} }, 'order-any'),
+      trigger('Order contains CS', { type: 'Order Created', info: { titlePartials: ['Semaglutide'] } }, 'order-cs'),
+      trigger('Order contains CI', { type: 'Order Created', info: { titlePartialsIgnoreCase: ['semaglutide'] } }, 'order-ci'),
+      // exact titles AND a contains fragment — both must pass
+      trigger(
+        'Order exact AND contains',
+        { type: 'Order Created', info: { titles: ['Semaglutide 0.25mg'], titlePartials: ['Sema'] } },
+        'order-and',
+      ),
+      // exact-only, unchanged prior behaviour
+      trigger('Order exact only', { type: 'Order Created', info: { titles: ['Semaglutide 0.25mg'] } }, 'order-exact'),
+
+      // ---- Problem Created ----
+      trigger('Problem any', { type: 'Problem Created', info: {} }, 'problem-any'),
+      trigger('Problem contains CS', { type: 'Problem Created', info: { titlePartials: ['Endometriosis'] } }, 'problem-cs'),
+      trigger('Problem contains CI', { type: 'Problem Created', info: { titlePartialsIgnoreCase: ['endometriosis'] } }, 'problem-ci'),
+      trigger(
+        'Problem exact AND contains',
+        { type: 'Problem Created', info: { titles: ['Endometriosis, unspecified'], titlePartials: ['Endo'] } },
+        'problem-and',
+      ),
+      trigger('Problem exact only', { type: 'Problem Created', info: { titles: ['Diabetes'] } }, 'problem-exact'),
+      // entries are trimmed before matching
+      trigger('Problem contains padded', { type: 'Problem Created', info: { titlePartials: ['  Endo  '] } }, 'problem-padded'),
+      // a blank sibling entry is dropped, not treated as "matches everything"
+      trigger(
+        'Problem contains with blank entry',
+        { type: 'Problem Created', info: { titlePartials: ['Endometriosis', '   '] } },
+        'problem-blankentry',
+      ),
+    ])
+
+    /* ============================ helpers ============================ */
+
+    const new_enduser = (fname: string) => sdk.api.endusers.createOne({ fname, lname: 'Contains' })
+
+    /** enduser_orders requires externalId/source/status; none of them affect title matching. */
+    const order_fields = (enduserId: string, title: string) => ({
+      enduserId,
+      title,
+      externalId: `contains-${RAND()}`,
+      source: 'ContainsQA',
+      status: 'created',
+    })
+
+    /** Polls until the sentinel tag has landed, then settles so absent tags mean absent. */
+    const tags_after_settling = async (enduserId: string, sentinel: string) => {
+      await poll_for(
+        () => sdk.api.endusers.getOne(enduserId),
+        e => !!e.tags?.includes(sentinel),
+      )
+      await wait(1500)
+      const e = await sdk.api.endusers.getOne(enduserId)
+      return e.tags ?? []
+    }
+
+    const expect_tags = async (
+      label: string,
+      enduserId: string,
+      sentinel: string,
+      expected: string[],
+      unexpected: string[],
+    ) => {
+      // give the positives a chance to arrive before the sentinel settle window closes
+      await poll_for(
+        () => sdk.api.endusers.getOne(enduserId),
+        e => expected.every(t => e.tags?.includes(t)),
+      )
+      const tags = await tags_after_settling(enduserId, sentinel)
+      const missing = expected.filter(t => !tags.includes(t))
+      const present = unexpected.filter(t => tags.includes(t))
+      record(
+        label,
+        missing.length === 0 && present.length === 0,
+        `tags=${JSON.stringify(tags)}`
+        + (missing.length ? ` MISSING=${JSON.stringify(missing)}` : '')
+        + (present.length ? ` UNEXPECTED=${JSON.stringify(present)}` : ''),
+      )
+    }
+
+    /* ============================ orders: single-create path ============================ */
+
+    const orderSingleMatch = await new_enduser('OrderSingleMatch')
+    await sdk.api.enduser_orders.createOne(order_fields(orderSingleMatch.id, 'Semaglutide 0.25mg'))
+    await expect_tags(
+      'A1: single-created order matching both contains lists and the exact title fires all four triggers',
+      orderSingleMatch.id, 'order-any',
+      ['order-any', 'order-cs', 'order-ci', 'order-and', 'order-exact'],
+      [],
+    )
+
+    const orderSingleCase = await new_enduser('OrderSingleCase')
+    await sdk.api.enduser_orders.createOne(order_fields(orderSingleCase.id, 'SEMAGLUTIDE injection'))
+    await expect_tags(
+      'A2: single-created order in a different case fires only the case-insensitive contains trigger',
+      orderSingleCase.id, 'order-any',
+      ['order-any', 'order-ci'],
+      ['order-cs', 'order-and', 'order-exact'],
+    )
+
+    const orderSingleMiss = await new_enduser('OrderSingleMiss')
+    await sdk.api.enduser_orders.createOne(order_fields(orderSingleMiss.id, 'Tirzepatide 5mg'))
+    await expect_tags(
+      'A3: single-created order matching no contains entry fires only the unfiltered trigger',
+      orderSingleMiss.id, 'order-any',
+      ['order-any'],
+      ['order-cs', 'order-ci', 'order-and', 'order-exact'],
+    )
+
+    const orderSingleAndMiss = await new_enduser('OrderSingleAndMiss')
+    // contains 'Sema' but is not exactly 'Semaglutide 0.25mg' — the lists AND, they do not OR
+    await sdk.api.enduser_orders.createOne(order_fields(orderSingleAndMiss.id, 'Semaglutide 1mg'))
+    await expect_tags(
+      'A4: exact+contains trigger does NOT fire when only the contains half matches (single create)',
+      orderSingleAndMiss.id, 'order-any',
+      ['order-any', 'order-cs', 'order-ci'],
+      ['order-and', 'order-exact'],
+    )
+
+    /* ============================ orders: bulk-create path ============================ */
+    /* createSome with more than one record takes handle_orders_create's bulk branch, which is a
+     * separate implementation of the same filtering. Same four assertions, same expectations. */
+
+    const [bulkMatch, bulkCase, bulkMiss, bulkAndMiss] = await Promise.all([
+      new_enduser('OrderBulkMatch'),
+      new_enduser('OrderBulkCase'),
+      new_enduser('OrderBulkMiss'),
+      new_enduser('OrderBulkAndMiss'),
+    ])
+
+    await sdk.api.enduser_orders.createSome([
+      order_fields(bulkMatch.id, 'Semaglutide 0.25mg'),
+      order_fields(bulkCase.id, 'SEMAGLUTIDE injection'),
+      order_fields(bulkMiss.id, 'Tirzepatide 5mg'),
+      order_fields(bulkAndMiss.id, 'Semaglutide 1mg'),
+    ])
+
+    await expect_tags(
+      'B1: bulk-created order matching both contains lists and the exact title fires all four triggers',
+      bulkMatch.id, 'order-any',
+      ['order-any', 'order-cs', 'order-ci', 'order-and', 'order-exact'],
+      [],
+    )
+    await expect_tags(
+      'B2: bulk-created order in a different case fires only the case-insensitive contains trigger',
+      bulkCase.id, 'order-any',
+      ['order-any', 'order-ci'],
+      ['order-cs', 'order-and', 'order-exact'],
+    )
+    await expect_tags(
+      'B3: bulk-created order matching no contains entry fires only the unfiltered trigger',
+      bulkMiss.id, 'order-any',
+      ['order-any'],
+      ['order-cs', 'order-ci', 'order-and', 'order-exact'],
+    )
+    await expect_tags(
+      'B4: exact+contains trigger does NOT fire when only the contains half matches (bulk create)',
+      bulkAndMiss.id, 'order-any',
+      ['order-any', 'order-cs', 'order-ci'],
+      ['order-and', 'order-exact'],
+    )
+
+    /* ============================ problems ============================ */
+
+    const problemMatch = await new_enduser('ProblemMatch')
+    await sdk.api.enduser_problems.createOne({ enduserId: problemMatch.id, title: 'Endometriosis, unspecified' })
+    await expect_tags(
+      'C1: problem whose title contains the case-sensitive fragment fires the contains triggers',
+      problemMatch.id, 'problem-any',
+      ['problem-any', 'problem-cs', 'problem-ci', 'problem-and', 'problem-padded', 'problem-blankentry'],
+      ['problem-exact'],
+    )
+
+    const problemCase = await new_enduser('ProblemCase')
+    await sdk.api.enduser_problems.createOne({ enduserId: problemCase.id, title: 'Chronic endometriosis pain' })
+    await expect_tags(
+      'C2: a lowercase title fires the case-insensitive trigger but not the case-sensitive one',
+      problemCase.id, 'problem-any',
+      ['problem-any', 'problem-ci'],
+      ['problem-cs', 'problem-and', 'problem-blankentry', 'problem-exact'],
+    )
+
+    const problemAndMiss = await new_enduser('ProblemAndMiss')
+    // contains 'Endo' (so the padded trigger fires) but is not the exact title the AND trigger needs
+    await sdk.api.enduser_problems.createOne({ enduserId: problemAndMiss.id, title: 'Endometrial hyperplasia' })
+    await expect_tags(
+      'C3: exact+contains problem trigger does NOT fire on a title that only satisfies the contains half',
+      problemAndMiss.id, 'problem-any',
+      ['problem-any', 'problem-padded'],
+      ['problem-and', 'problem-cs', 'problem-ci', 'problem-blankentry', 'problem-exact'],
+    )
+
+    const problemBlank = await new_enduser('ProblemBlank')
+    await sdk.api.enduser_problems.createOne({ enduserId: problemBlank.id, title: 'Common cold' })
+    await expect_tags(
+      'C4: a blank entry beside a real one does not make the trigger fire on an unrelated title',
+      problemBlank.id, 'problem-any',
+      ['problem-any'],
+      ['problem-blankentry', 'problem-cs', 'problem-ci', 'problem-and', 'problem-padded', 'problem-exact'],
+    )
+
+    /* ---- problems created in bulk (the EHR-sync shape) take the same handler with created.length > 1 ---- */
+
+    const [problemBulkMatch, problemBulkMiss] = await Promise.all([
+      new_enduser('ProblemBulkMatch'),
+      new_enduser('ProblemBulkMiss'),
+    ])
+    await sdk.api.enduser_problems.createSome([
+      { enduserId: problemBulkMatch.id, title: 'Endometriosis, unspecified' },
+      { enduserId: problemBulkMiss.id, title: 'Common cold' },
+    ])
+    await expect_tags(
+      'D1: bulk-created problem matching the contains lists fires the same triggers as a single create',
+      problemBulkMatch.id, 'problem-any',
+      ['problem-any', 'problem-cs', 'problem-ci', 'problem-and', 'problem-padded', 'problem-blankentry'],
+      ['problem-exact'],
+    )
+    await expect_tags(
+      'D2: an unrelated problem in the same bulk create fires only the unfiltered trigger',
+      problemBulkMiss.id, 'problem-any',
+      ['problem-any'],
+      ['problem-cs', 'problem-ci', 'problem-and', 'problem-padded', 'problem-blankentry'],
+    )
+
+    /* ============================ regression: exact matching unchanged ============================ */
+
+    const exactHit = await new_enduser('ExactHit')
+    await sdk.api.enduser_problems.createOne({ enduserId: exactHit.id, title: 'Diabetes' })
+    await expect_tags(
+      'E1: an exact-titles-only trigger still fires on an exactly matching title',
+      exactHit.id, 'problem-any',
+      ['problem-any', 'problem-exact'],
+      ['problem-cs', 'problem-ci', 'problem-and', 'problem-padded', 'problem-blankentry'],
+    )
+
+    const exactMiss = await new_enduser('ExactMiss')
+    await sdk.api.enduser_problems.createOne({ enduserId: exactMiss.id, title: 'Diabetes mellitus type 2' })
+    await expect_tags(
+      'E2: an exact-titles-only trigger still does NOT fire on a superstring of its title',
+      exactMiss.id, 'problem-any',
+      ['problem-any'],
+      ['problem-exact', 'problem-cs', 'problem-ci', 'problem-and', 'problem-padded', 'problem-blankentry'],
+    )
+  } finally {
+    // Teardown BEFORE anything asserts — assert calls process.exit, which would strand this tenant.
+    if (tenant) { try { await tenant.teardown() } catch (e) { console.error('teardown failed', e) } }
+  }
+
+  return checks
+}
+
+/** Asserting wrapper, for standalone runs and for sequential use in the suite. */
+export const trigger_contains_matching_tests = async () => {
+  assert_checks('Trigger contains title matching', await trigger_contains_matching_checks())
+}
+
+/** Enrolls this suite in the auto-discovered parallel pool — see run_discovered_isolated_suites. */
+export const ISOLATED_SUITE: IsolatedSuite = { name: 'Trigger contains title matching', run: trigger_contains_matching_checks }
+
+// Allow running this test file independently
+if (require.main === module) {
+  console.log(`🌐 Using API URL: ${host}`)
+  trigger_contains_matching_tests()
+    .then(() => {
+      console.log("✅ Trigger contains matching test suite completed successfully")
+      process.exit(0)
+    })
+    .catch((error) => {
+      console.error("❌ Trigger contains matching test suite failed:", error)
+      process.exit(1)
+    })
+}